@gigamusic/admin 0.1.1 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gigamusic/admin",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Admin UI (releases CRUD, tracks, settings, links, link-pages, orders) and admin API handler factories for the gigamusic platform. Fully replaceable by the consumer — mount the pages directly or override individual slots.",
   "license": "MIT",
   "repository": {
@@ -34,13 +34,13 @@
   },
   "dependencies": {
     "zod": "^3.24.1",
-    "@gigamusic/audio": "0.1.1",
-    "@gigamusic/config": "0.1.1",
-    "@gigamusic/core": "0.1.1",
-    "@gigamusic/db": "0.1.1",
-    "@gigamusic/email": "0.1.1",
-    "@gigamusic/ui": "0.1.1",
-    "@gigamusic/storage": "0.1.1"
+    "@gigamusic/audio": "0.2.0",
+    "@gigamusic/db": "0.2.0",
+    "@gigamusic/email": "0.2.0",
+    "@gigamusic/config": "0.2.0",
+    "@gigamusic/storage": "0.2.0",
+    "@gigamusic/core": "0.2.0",
+    "@gigamusic/ui": "0.2.0"
   },
   "peerDependencies": {
     "next": ">=15",

package/src/client.ts

@@ -5,7 +5,6 @@
 // server-only modules.
 
 export { AdminHomePage } from "./pages/AdminHomePage";
-export { AdminLoginPage } from "./pages/AdminLoginPage";
 export { AdminReleasesPage } from "./pages/AdminReleasesPage";
 export { AdminNewReleasePage } from "./pages/AdminNewReleasePage";
 export { AdminEditReleasePage } from "./pages/AdminEditReleasePage";
@@ -14,5 +13,4 @@ export { AdminSettingsPage } from "./pages/AdminSettingsPage";
 export { AdminOrdersPage } from "./pages/AdminOrdersPage";
 export { ReleaseForm } from "./components/ReleaseForm";
 export type { ReleaseFormProps } from "./components/ReleaseForm";
-export { AdminLoginForm } from "./components/AdminLoginForm";
 export { AdminNav } from "./components/AdminNav";

package/src/handlers/links.ts

@@ -1,7 +1,6 @@
 import type { AdminDeps, RouteHandler } from "../lib/types";
 import type { LinkInput } from "@gigamusic/db";
-import { badRequest, json, notFound, unauthorized } from "../lib/responses";
-import { isAdminAuthenticated } from "../lib/session";
+import { badRequest, json, notFound } from "../lib/responses";
 
 interface LinkBody {
   id?: unknown;
@@ -38,8 +37,13 @@ function toLinkInput(body: LinkBody): LinkInput | null {
  * to reorder the whole list in one round-trip.
  *
  * DELETE expects `?id=...`.
+ *
+ * Auth: the package assumes the request has been gated by the consumer's
+ * `proxy.ts` / middleware. These handlers don't verify a session.
  */
-export function createAdminLinksHandlers(deps: AdminDeps): {
+export function createAdminLinksHandlers(
+  deps: Pick<AdminDeps, "queries" | "logger">,
+): {
   GET: RouteHandler;
   POST: RouteHandler;
   PUT: RouteHandler;
@@ -47,15 +51,9 @@ export function createAdminLinksHandlers(deps: AdminDeps): {
 } {
   return {
     GET: async () => {
-      if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-        return unauthorized();
-      }
       return json(await deps.queries.listAllLinks());
     },
     POST: async (req) => {
-      if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-        return unauthorized();
-      }
       const body = (await safeJson(req)) as LinkBody;
       const input = toLinkInput(body);
       if (!input) return badRequest("title and url are required");
@@ -63,9 +61,6 @@ export function createAdminLinksHandlers(deps: AdminDeps): {
       return json(link, { status: 201 });
     },
     PUT: async (req) => {
-      if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-        return unauthorized();
-      }
       const body = (await safeJson(req)) as LinkBody & ReorderBody;
       if (Array.isArray(body.orderedIds)) {
         const ids = body.orderedIds
@@ -89,9 +84,6 @@ export function createAdminLinksHandlers(deps: AdminDeps): {
       return json(link);
     },
     DELETE: async (req) => {
-      if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-        return unauthorized();
-      }
       const url = new URL(req.url);
       const idRaw = url.searchParams.get("id");
       if (!idRaw) return badRequest("id is required");

package/src/handlers/orders.ts

@@ -1,17 +1,17 @@
 import type { AdminDeps, RouteHandler } from "../lib/types";
-import { badRequest, json, unauthorized } from "../lib/responses";
-import { isAdminAuthenticated } from "../lib/session";
+import { badRequest, json } from "../lib/responses";
 
 /**
- * GET /api/admin/orders?email=… — returns the order history for a given email
- * address. The plan only requires an admin "view" surface; this is the small
- * read endpoint that backs the OrdersPage filter.
+ * GET /api/admin/orders?email=… — returns the order history for a given
+ * email address.
+ *
+ * Auth: the package assumes the request has been gated by the consumer's
+ * `proxy.ts` / middleware. This handler doesn't verify a session.
  */
-export function createAdminOrdersHandler(deps: AdminDeps): RouteHandler {
+export function createAdminOrdersHandler(
+  deps: Pick<AdminDeps, "queries">,
+): RouteHandler {
   return async (req) => {
-    if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-      return unauthorized();
-    }
     const url = new URL(req.url);
     const email = url.searchParams.get("email");
     if (!email) return badRequest("email query param is required");

package/src/handlers/releases.ts

@@ -5,8 +5,9 @@ import {
   type ReleaseInput,
 } from "@gigamusic/core";
 import type { AdminDeps, RouteHandler } from "../lib/types";
-import { badRequest, json, notFound, unauthorized } from "../lib/responses";
-import { isAdminAuthenticated } from "../lib/session";
+import { badRequest, json, notFound } from "../lib/responses";
+
+type ReleasesDeps = Pick<AdminDeps, "queries" | "storage" | "logger">;
 
 /**
  * Draft releases skip the strict published-validation rules so an admin can
@@ -40,23 +41,22 @@ function flattenIssues(error: z.ZodError): Record<string, string[]> {
   return out;
 }
 
-function requireAuth(deps: Pick<AdminDeps, "adminSessionSecret">) {
-  return isAdminAuthenticated(deps.adminSessionSecret);
-}
-
-/** GET /api/admin/releases and POST /api/admin/releases. */
+/**
+ * GET /api/admin/releases and POST /api/admin/releases.
+ *
+ * Auth: the package assumes the request has been gated by the consumer's
+ * `proxy.ts` / middleware. These handlers don't verify a session.
+ */
 export function createAdminReleasesHandlers(
-  deps: AdminDeps,
+  deps: Pick<ReleasesDeps, "queries" | "logger">,
 ): { GET: RouteHandler; POST: RouteHandler } {
   return {
     GET: async () => {
-      if (!(await requireAuth(deps))) return unauthorized();
       const releases = await deps.queries.listAllReleases();
       return json(releases);
     },
     POST: async (req) => {
-      if (!(await requireAuth(deps))) return unauthorized();
-      const body = await readJson(req);
+const body = await readJson(req);
       if (!body.ok) return badRequest("Invalid JSON");
 
       const parsed = ReleasePayloadSchema.safeParse(body.value);
@@ -81,22 +81,24 @@ export function createAdminReleasesHandlers(
   };
 }
 
-/** GET/PUT/DELETE /api/admin/releases/[id]. */
+/**
+ * GET/PUT/DELETE /api/admin/releases/[id].
+ *
+ * Auth: gated by the consumer upstream — see `createAdminReleasesHandlers`.
+ */
 export function createAdminReleaseByIdHandlers(
-  deps: AdminDeps,
+  deps: ReleasesDeps,
 ): { GET: RouteHandler; PUT: RouteHandler; DELETE: RouteHandler } {
   return {
     GET: async (_req, ctx) => {
-      if (!(await requireAuth(deps))) return unauthorized();
-      const id = await resolveIdParam(ctx);
+const id = await resolveIdParam(ctx);
       if (id == null) return badRequest("Missing id");
       const all = await deps.queries.listAllReleases();
       const found = all.find((r) => r.id === id);
       return found ? json(found) : notFound("Release not found");
     },
     PUT: async (req, ctx) => {
-      if (!(await requireAuth(deps))) return unauthorized();
-      const id = await resolveIdParam(ctx);
+const id = await resolveIdParam(ctx);
       if (id == null) return badRequest("Missing id");
 
       const body = await readJson(req);
@@ -125,8 +127,7 @@ export function createAdminReleaseByIdHandlers(
       }
     },
     DELETE: async (_req, ctx) => {
-      if (!(await requireAuth(deps))) return unauthorized();
-      const id = await resolveIdParam(ctx);
+const id = await resolveIdParam(ctx);
       if (id == null) return badRequest("Missing id");
 
       // Snapshot storage keys before the cascade nukes the rows, so we can

package/src/handlers/settings.ts

@@ -1,6 +1,5 @@
 import type { AdminDeps, RouteHandler } from "../lib/types";
-import { badRequest, json, unauthorized } from "../lib/responses";
-import { isAdminAuthenticated } from "../lib/session";
+import { badRequest, json } from "../lib/responses";
 
 interface SettingPayload {
   key?: unknown;
@@ -10,22 +9,23 @@ interface SettingPayload {
 /**
  * GET/PUT /api/admin/settings.
  *
- * GET returns all known settings as a `Record<string, unknown>`. PUT upserts a
- * single key/value pair; the consumer's `queries.setSetting` is the source of
- * truth for serialization (JSON stringification happens inside the db layer).
+ * GET returns all known settings as a `Record<string, unknown>`. PUT upserts
+ * a single key/value pair; the consumer's `queries.setSetting` is the source
+ * of truth for serialization (JSON stringification happens inside the db
+ * layer).
  *
  * Per-key validation is intentionally not done here — settings are
  * heterogeneous and the admin form for each setting validates before
  * submitting.
+ *
+ * Auth: the package assumes the request has been gated by the consumer's
+ * `proxy.ts` / middleware. These handlers don't verify a session.
  */
 export function createAdminSettingsHandlers(
-  deps: AdminDeps,
+  deps: Pick<AdminDeps, "queries">,
 ): { GET: RouteHandler; PUT: RouteHandler } {
   return {
     GET: async (req) => {
-      if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-        return unauthorized();
-      }
       const url = new URL(req.url);
       const key = url.searchParams.get("key");
       if (key) {
@@ -35,9 +35,6 @@ export function createAdminSettingsHandlers(
       return json({});
     },
     PUT: async (req) => {
-      if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-        return unauthorized();
-      }
       let body: SettingPayload;
       try {
         body = (await req.json()) as SettingPayload;

package/src/handlers/upload.ts

@@ -4,8 +4,10 @@ import { join } from "node:path";
 import { writeFile, readFile, unlink, stat } from "node:fs/promises";
 import { createReadStream } from "node:fs";
 import type { AdminDeps, RouteHandler } from "../lib/types";
-import { badRequest, json, serverError, unauthorized } from "../lib/responses";
-import { isAdminAuthenticated } from "../lib/session";
+import { badRequest, json, serverError } from "../lib/responses";
+
+type PresignDeps = Pick<AdminDeps, "storage">;
+type ProcessDeps = Pick<AdminDeps, "storage" | "audio" | "queries" | "logger">;
 
 // Path segments allow the punctuation common in real-world track filenames
 // alongside alphanumerics, dashes, dots, underscores, spaces, parens, and
@@ -33,13 +35,14 @@ interface ProcessBody {
   coverImageUrl?: unknown;
 }
 
-/** Build POST /api/admin/upload/presign. */
-export function createAdminUploadPresignHandler(deps: AdminDeps): RouteHandler {
+/**
+ * Build POST /api/admin/upload/presign.
+ *
+ * Auth: the package assumes the request has been gated by the consumer's
+ * `proxy.ts` / middleware. This handler doesn't verify a session.
+ */
+export function createAdminUploadPresignHandler(deps: PresignDeps): RouteHandler {
   return async (req) => {
-    if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-      return unauthorized();
-    }
-
     const body = (await safeJson(req)) as {
       key?: unknown;
       contentType?: unknown;
@@ -118,12 +121,8 @@ function bufferFromDataUrl(value: unknown): Buffer | null {
  *      because the track row isn't created yet — the release POST handler
  *      persists the files alongside the row).
  */
-export function createAdminUploadProcessHandler(deps: AdminDeps): RouteHandler {
+export function createAdminUploadProcessHandler(deps: ProcessDeps): RouteHandler {
   return async (req) => {
-    if (!(await isAdminAuthenticated(deps.adminSessionSecret))) {
-      return unauthorized();
-    }
-
     const body = (await safeJson(req)) as ProcessBody;
     const key = typeof body.key === "string" ? body.key : "";
     if (!key.endsWith(".wav")) {

package/src/index.ts

@@ -4,7 +4,6 @@
 
 export { AdminLayout } from "./pages/AdminLayout";
 export { AdminHomePage } from "./pages/AdminHomePage";
-export { AdminLoginPage } from "./pages/AdminLoginPage";
 export { AdminReleasesPage } from "./pages/AdminReleasesPage";
 export { AdminNewReleasePage } from "./pages/AdminNewReleasePage";
 export { AdminEditReleasePage } from "./pages/AdminEditReleasePage";
@@ -14,7 +13,6 @@ export { AdminOrdersPage } from "./pages/AdminOrdersPage";
 
 export { ReleaseForm } from "./components/ReleaseForm";
 export type { ReleaseFormProps } from "./components/ReleaseForm";
-export { AdminLoginForm } from "./components/AdminLoginForm";
 export { AdminNav } from "./components/AdminNav";
 
 export type {

package/src/lib/types.ts

@@ -14,16 +14,19 @@ export type RouteHandler = (
 ) => Promise<Response>;
 
 /**
- * Aggregate dependency bag for every admin route handler factory. The consumer
- * builds this once at startup and passes a slice (or the whole bag) into each
- * factory; nothing inside the admin package reads `process.env` directly.
+ * Aggregate dependency bag for every admin route handler factory. The
+ * consumer builds this once at startup and passes a slice (or the whole
+ * bag) into each factory; nothing inside the admin package reads
+ * `process.env` directly.
+ *
+ * Auth deliberately isn't here: the package's handlers trust that the
+ * request has been gated by the consumer's `proxy.ts` (or middleware /
+ * route-level wrapper). See `docs/setup.md` for auth recipes.
  */
 export interface AdminDeps {
   queries: Queries;
   storage: StorageProvider;
   audio: typeof Audio;
-  adminPasswordHash: string;
-  adminSessionSecret: string;
   branding: EmailBranding;
   /**
    * Optional logger. Defaults to a no-op so the package never writes to

package/src/server.ts

@@ -1,14 +1,17 @@
-// Server-side surface: every admin API route-handler factory + the session
-// verification helper for the consumer's `proxy.ts`.
+// Server-side surface: every admin API route-handler factory.
 //
-// The consumer wires each factory's return value into the matching route file:
-//   // app/api/admin/auth/route.ts
-//   export const POST = createAdminLoginHandler({ adminPasswordHash, adminSessionSecret });
+// **Auth is the consumer's responsibility.** Handlers exported here trust
+// that the request has already been gated upstream — typically via the
+// consumer's `proxy.ts` (Next 16) or middleware. See `docs/setup.md` for
+// the three recommended auth recipes (bcrypt env hash, Auth.js, Clerk).
 //
-// `verifyAdminSession(req, secret)` is the request-aware variant the
-// consumer's `proxy.ts` calls before redirecting unauthenticated users.
+// Each factory takes a slice of `AdminDeps`:
+//   // app/api/admin/releases/route.ts (consumer)
+//   import { createAdminReleasesHandlers } from "@gigamusic/admin/server";
+//   const handlers = createAdminReleasesHandlers({ queries });
+//   export const GET = handlers.GET;
+//   export const POST = handlers.POST;
 
-export { createAdminLoginHandler, createAdminLogoutHandler } from "./handlers/auth";
 export {
   createAdminReleasesHandlers,
   createAdminReleaseByIdHandlers,
@@ -21,14 +24,6 @@ export { createAdminSettingsHandlers } from "./handlers/settings";
 export { createAdminLinksHandlers } from "./handlers/links";
 export { createAdminOrdersHandler } from "./handlers/orders";
 
-export {
-  verifyAdminSession,
-  isAdminAuthenticated,
-  writeAdminSessionCookie,
-  clearAdminSessionCookie,
-  ADMIN_SESSION_COOKIE,
-} from "./lib/session";
-
 export type {
   AdminDeps,
   AdminLogger,

package/src/components/AdminLoginForm.tsx

@@ -1,63 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { useRouter, useSearchParams } from "next/navigation";
-import { useSlot } from "@gigamusic/ui/client";
-
-/** Block off-site redirects via the `?next=` param. */
-function safeNext(value: string | null): string | null {
-  if (!value) return null;
-  if (!value.startsWith("/")) return null;
-  if (value.startsWith("//") || value.startsWith("/\\")) return null;
-  return value;
-}
-
-export function AdminLoginForm() {
-  const Button = useSlot("Button");
-  const [password, setPassword] = useState("");
-  const [error, setError] = useState("");
-  const [loading, setLoading] = useState(false);
-  const router = useRouter();
-  const searchParams = useSearchParams();
-  const next = safeNext(searchParams.get("next"));
-
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault();
-    setLoading(true);
-    setError("");
-    const res = await fetch("/api/admin/auth", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ password }),
-    });
-    if (res.ok) {
-      if (next) router.push(next);
-      else router.refresh();
-    } else {
-      setError("Invalid password");
-      setLoading(false);
-    }
-  }
-
-  return (
-    <form onSubmit={handleSubmit} className="gm-admin-login space-y-4">
-      <div className="space-y-2">
-        <label htmlFor="password" className="text-sm font-medium">
-          Password
-        </label>
-        <input
-          id="password"
-          type="password"
-          value={password}
-          onChange={(e) => setPassword(e.target.value)}
-          required
-          className="block w-full rounded border border-border bg-background px-3 py-2 text-sm"
-        />
-      </div>
-      {error && <p className="text-sm text-destructive">{error}</p>}
-      <Button type="submit" className="w-full" disabled={loading}>
-        {loading ? "Logging in..." : "Log In"}
-      </Button>
-    </form>
-  );
-}

package/src/handlers/auth.ts

@@ -1,58 +0,0 @@
-import { verifyAdminPassword } from "@gigamusic/core";
-import type { Queries } from "@gigamusic/db";
-import {
-  clearAdminSessionCookie,
-  writeAdminSessionCookie,
-} from "../lib/session";
-import type { RouteHandler } from "../lib/types";
-import { json, unauthorized } from "../lib/responses";
-import { clientIp, consumeAdminLoginAttempt } from "../lib/rate-limit";
-
-interface LoginDeps {
-  adminPasswordHash: string;
-  adminSessionSecret: string;
-  /** Optional — supply to gate brute-force login attempts. */
-  queries?: Queries;
-}
-
-/**
- * Build the `POST /api/admin/auth` handler. Verifies the supplied password
- * against the consumer's bcrypt hash, mints a session cookie on success, and
- * rate-limits per-IP attempts when `queries` is provided.
- */
-export function createAdminLoginHandler(deps: LoginDeps): RouteHandler {
-  return async (req) => {
-    if (deps.queries) {
-      const result = await consumeAdminLoginAttempt(deps.queries, clientIp(req));
-      if (!result.ok) {
-        return json(
-          { error: "Too many attempts. Please try again later." },
-          { status: 429 },
-        );
-      }
-    }
-
-    let password: string;
-    try {
-      const body = (await req.json()) as { password?: unknown };
-      password = typeof body.password === "string" ? body.password : "";
-    } catch {
-      return unauthorized();
-    }
-
-    if (!password) return unauthorized();
-    const ok = await verifyAdminPassword(password, deps.adminPasswordHash);
-    if (!ok) return unauthorized();
-
-    await writeAdminSessionCookie(deps.adminSessionSecret);
-    return json({ ok: true });
-  };
-}
-
-/** Build the `POST /api/admin/auth/logout` handler. Clears the session cookie. */
-export function createAdminLogoutHandler(): RouteHandler {
-  return async () => {
-    await clearAdminSessionCookie();
-    return json({ ok: true });
-  };
-}

package/src/lib/rate-limit.ts

@@ -1,31 +0,0 @@
-import type { Queries } from "@gigamusic/db";
-
-/**
- * Extract a best-effort client IP for rate-limit bucketing. Honours common
- * Vercel/Cloudflare forward headers and falls back to a constant so the
- * handler still rate-limits the entire route when no IP is available.
- */
-export function clientIp(req: Request): string {
-  const forwarded = req.headers.get("x-forwarded-for");
-  if (forwarded) {
-    const first = forwarded.split(",")[0]?.trim();
-    if (first) return first;
-  }
-  const real = req.headers.get("x-real-ip");
-  if (real) return real;
-  return "unknown";
-}
-
-const LOGIN_MAX_ATTEMPTS = 10;
-const LOGIN_WINDOW_MS = 15 * 60 * 1000;
-
-/** Consume one slot in the admin-login bucket for `ip`. Returns false when over the limit. */
-export function consumeAdminLoginAttempt(
-  queries: Queries,
-  ip: string,
-): Promise<{ ok: boolean; remaining: number; resetAt: Date }> {
-  return queries.consumeRateLimit(`admin-login:${ip}`, {
-    max: LOGIN_MAX_ATTEMPTS,
-    windowMs: LOGIN_WINDOW_MS,
-  });
-}

package/src/lib/session.ts

@@ -1,89 +0,0 @@
-import { cookies } from "next/headers";
-import {
-  createAdminSessionToken,
-  verifyAdminSessionToken,
-} from "@gigamusic/core";
-
-export const ADMIN_SESSION_COOKIE = "admin_session";
-const SESSION_DURATION_SECONDS = 60 * 60 * 24;
-
-/** Default cookie options consumed by every Set-Cookie path. */
-function cookieOptions(maxAge: number) {
-  return {
-    httpOnly: true,
-    secure: true,
-    sameSite: "lax" as const,
-    maxAge,
-    path: "/",
-  };
-}
-
-/**
- * Mint a fresh admin session token and write the httpOnly cookie. Called
- * after a successful password check from `createAdminLoginHandler`.
- */
-export async function writeAdminSessionCookie(
-  adminSessionSecret: string,
-): Promise<void> {
-  const token = await createAdminSessionToken({ secret: adminSessionSecret });
-  const jar = await cookies();
-  jar.set(ADMIN_SESSION_COOKIE, token, cookieOptions(SESSION_DURATION_SECONDS));
-}
-
-/** Clear the admin session cookie (logout). */
-export async function clearAdminSessionCookie(): Promise<void> {
-  const jar = await cookies();
-  jar.set(ADMIN_SESSION_COOKIE, "", cookieOptions(0));
-}
-
-/**
- * Check the current request's cookie jar for a valid admin session.
- *
- * Returns `true` if the cookie verifies; `false` for missing or invalid tokens.
- * Never throws — callers can branch on the boolean.
- */
-export async function isAdminAuthenticated(
-  adminSessionSecret: string,
-): Promise<boolean> {
-  const jar = await cookies();
-  const token = jar.get(ADMIN_SESSION_COOKIE)?.value;
-  if (!token) return false;
-  try {
-    await verifyAdminSessionToken(token, adminSessionSecret);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Stateless verification for handlers that already have a `Request`. Reads the
- * cookie out of the request's `Cookie` header so the function works in
- * middleware-like contexts where `next/headers` is unavailable.
- */
-export async function verifyAdminSession(
-  req: Request,
-  adminSessionSecret: string,
-): Promise<boolean> {
-  const header = req.headers.get("cookie");
-  if (!header) return false;
-  const token = parseCookieHeader(header, ADMIN_SESSION_COOKIE);
-  if (!token) return false;
-  try {
-    await verifyAdminSessionToken(token, adminSessionSecret);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/** Tiny single-cookie reader. Avoids pulling in a cookie parser dependency. */
-function parseCookieHeader(header: string, name: string): string | null {
-  const parts = header.split(";");
-  for (const raw of parts) {
-    const trimmed = raw.trim();
-    if (!trimmed.startsWith(`${name}=`)) continue;
-    return decodeURIComponent(trimmed.slice(name.length + 1));
-  }
-  return null;
-}

package/src/pages/AdminLoginPage.tsx

@@ -1,11 +0,0 @@
-import { AdminLoginForm } from "../components/AdminLoginForm";
-
-/** Standalone login page — useful when the consumer wants `/admin/login` separate from layout-driven gating. */
-export function AdminLoginPage() {
-  return (
-    <div className="gm-admin-shell mx-auto max-w-sm px-4 py-20">
-      <h1 className="mb-6 text-center text-2xl font-semibold">Admin Login</h1>
-      <AdminLoginForm />
-    </div>
-  );
-}