@rovela-ai/sdk 0.3.34 → 0.4.1

package/dist/admin/api/index.js

@@ -1,127 +0,0 @@
-/**
- * @rovela/sdk/admin/api
- *
- * Admin API route handlers for Next.js App Router.
- *
- * These handlers can be re-exported directly in your route files:
- *
- * ```typescript
- * // app/api/admin/auth/[...nextauth]/route.ts
- * export const { GET, POST } = createAdminAuthHandlers()
- *
- * // app/api/admin/products/route.ts
- * export { GET, POST } from '@rovela/sdk/admin/api/products'
- *
- * // app/api/admin/products/[id]/route.ts
- * export { getProduct as GET, PUT, DELETE } from '@rovela/sdk/admin/api/products'
- *
- * // app/api/admin/products/[id]/variants/route.ts
- * export { addVariant as POST } from '@rovela/sdk/admin/api/products'
- *
- * // app/api/admin/products/variants/[variantId]/route.ts
- * export { updateVariantHandler as PUT, deleteVariantHandler as DELETE } from '@rovela/sdk/admin/api/products'
- *
- * // app/api/admin/orders/route.ts
- * export { GET } from '@rovela/sdk/admin/api/orders'
- *
- * // app/api/admin/orders/[id]/route.ts
- * export { getOrder as GET, PUT } from '@rovela/sdk/admin/api/orders'
- *
- * // app/api/admin/orders/[id]/refund/route.ts
- * export { POST } from '@rovela/sdk/admin/api/refund'
- *
- * // app/api/admin/categories/route.ts
- * export { GET, POST } from '@rovela/sdk/admin/api/categories'
- *
- * // app/api/admin/categories/[id]/route.ts
- * export { getCategory as GET, PUT, DELETE } from '@rovela/sdk/admin/api/categories'
- *
- * // app/api/admin/customers/route.ts
- * export { GET } from '@rovela/sdk/admin/api/customers'
- *
- * // app/api/admin/customers/[id]/route.ts
- * export { getCustomer as GET, updateCustomer as PUT, deleteCustomer as DELETE } from '@rovela/sdk/admin/api/customers'
- *
- * // app/api/admin/stats/route.ts
- * export { GET } from '@rovela/sdk/admin/api/stats'
- *
- * // app/api/admin/setup/route.ts (first-time admin creation)
- * export { POST } from '@rovela/sdk/admin/api/setup'
- *
- * // app/api/admin/check/route.ts (check if admin exists)
- * export { GET } from '@rovela/sdk/admin/api/check'
- *
- * // app/api/admin/settings/route.ts (store settings)
- * export { GET, PUT } from '@rovela/sdk/admin/api/settings'
- *
- * // app/api/admin/stripe-status/route.ts (Stripe connection & tax status)
- * export { getStripeStatus as GET } from '@rovela/sdk/admin/api'
- *
- * // app/api/admin/shipping/zones/route.ts
- * export { getZones as GET, createZone as POST } from '@rovela/sdk/admin/api/shipping'
- *
- * // app/api/admin/shipping/zones/[id]/route.ts
- * export { getZone as GET, updateZone as PUT, deleteZone as DELETE } from '@rovela/sdk/admin/api/shipping'
- *
- * // app/api/admin/shipping/rates/route.ts
- * export { createRate as POST } from '@rovela/sdk/admin/api/shipping'
- *
- * // app/api/admin/shipping/rates/[id]/route.ts
- * export { updateRate as PUT, deleteRate as DELETE } from '@rovela/sdk/admin/api/shipping'
- *
- * // app/api/admin/tax-zones/route.ts
- * export { getTaxZones as GET, createTaxZone as POST } from '@rovela/sdk/admin/api'
- *
- * // app/api/admin/tax-zones/[id]/route.ts
- * export { getTaxZone as GET, updateTaxZone as PUT, deleteTaxZone as DELETE } from '@rovela/sdk/admin/api'
- *
- * // app/api/admin/linked-customer/route.ts (R112: admin ↔ customer role switcher)
- * export { GET } from '@rovela-ai/sdk/admin/api/linked-customer'
- * ```
- */
-// Auth
-export { createAdminAuthHandlers } from './auth';
-// Products
-export { GET as getProducts, POST as createProduct, getProduct, PUT as updateProduct, DELETE as deleteProduct, addVariant, updateVariantHandler, deleteVariantHandler, } from './products';
-// Products — bulk actions (activate / archive / delete) for the list page
-export { POST as bulkProducts } from './products-bulk';
-// Products — aggregate metrics (active count, out-of-stock count, best seller)
-export { GET as getProductMetrics } from './products-stats';
-// Setup guide — orchestrator for the new-store onboarding card on /admin
-export { GET as getSetupGuide, POST as markSetupTask, } from './setup-guide';
-// Orders
-export { GET as getOrders, getOrder, PUT as updateOrder, getShippoRatesForOrder, shipWithShippo, } from './orders';
-// Refund
-export { POST as processRefund } from './refund';
-// Return (approve/reject return requests)
-export { APPROVE_POST as approveReturn, REJECT_POST as rejectReturn } from './return';
-// Stats
-export { GET as getStats } from './stats';
-// Categories
-export { GET as getCategories, POST as createCategory, getCategory, PUT as updateCategory, DELETE as deleteCategory, } from './categories';
-// Customers
-export { GET as getCustomers, getCustomer, updateCustomer, deleteCustomer, } from './customers';
-// Setup (first-time admin creation)
-export { POST as setupAdmin } from './setup';
-// Check (check if admin exists)
-export { GET as checkAdminExists } from './check';
-// Password reset (forgot + reset flow)
-export { POST as adminForgotPassword } from './forgot-password';
-export { GET as validateAdminResetTokenHandler, POST as adminResetPassword, } from './reset-password';
-// User management (list, invite, detail, lifecycle actions, hard delete)
-export { GET as getUsers, POST as inviteUser, getUser, PATCH as updateUser, DELETE as deleteUser, } from './users';
-// Accept invite (Phase 3) — unauthenticated, public routes
-export { GET as validateAdminInviteHandler, POST as acceptAdminInviteHandler, } from './accept-invite';
-// Self-service (Phase 4)
-export { GET as getMe, PATCH as updateMe, PATCH_PASSWORD as updateMyPassword, } from './me';
-// Settings
-export { GET as getSettings, PUT as updateSettings } from './settings';
-// Stripe Status
-export { GET as getStripeStatus } from './stripe-status';
-// Shipping Carriers
-export { getCarriers as getShippingCarriers, createCarrier as createShippingCarrier, getCarrier as getShippingCarrier, updateCarrier as updateShippingCarrier, deleteCarrier as deleteShippingCarrier, } from './shipping';
-// Shipping Zones & Rates
-export { getZones as getShippingZones, createZone as createShippingZone, getZone as getShippingZone, updateZone as updateShippingZone, deleteZone as deleteShippingZone, createRate as createShippingRate, updateRate as updateShippingRate, deleteRate as deleteShippingRate, validateShippoApiKey, saveShippoApiKey, deleteShippoApiKey, } from './shipping';
-// Tax Zones
-export { getTaxZones, createTaxZone, getTaxZone, updateTaxZone, deleteTaxZone, } from './tax-zones';
-//# sourceMappingURL=index.js.map

package/dist/admin/api/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/admin/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAEH,OAAO;AACP,OAAO,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAA;AAEhD,WAAW;AACX,OAAO,EACL,GAAG,IAAI,WAAW,EAClB,IAAI,IAAI,aAAa,EACrB,UAAU,EACV,GAAG,IAAI,aAAa,EACpB,MAAM,IAAI,aAAa,EACvB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,0EAA0E;AAC1E,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEtD,+EAA+E;AAC/E,OAAO,EAAE,GAAG,IAAI,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,yEAAyE;AACzE,OAAO,EACL,GAAG,IAAI,aAAa,EACpB,IAAI,IAAI,aAAa,GACtB,MAAM,eAAe,CAAA;AAGtB,SAAS;AACT,OAAO,EACL,GAAG,IAAI,SAAS,EAChB,QAAQ,EACR,GAAG,IAAI,WAAW,EAClB,sBAAsB,EACtB,cAAc,GACf,MAAM,UAAU,CAAA;AAEjB,SAAS;AACT,OAAO,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,UAAU,CAAA;AAEhD,0CAA0C;AAC1C,OAAO,EAAE,YAAY,IAAI,aAAa,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,UAAU,CAAA;AAErF,QAAQ;AACR,OAAO,EAAE,GAAG,IAAI,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzC,aAAa;AACb,OAAO,EACL,GAAG,IAAI,aAAa,EACpB,IAAI,IAAI,cAAc,EACtB,WAAW,EACX,GAAG,IAAI,cAAc,EACrB,MAAM,IAAI,cAAc,GACzB,MAAM,cAAc,CAAA;AAErB,YAAY;AACZ,OAAO,EACL,GAAG,IAAI,YAAY,EACnB,WAAW,EACX,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,oCAAoC;AACpC,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,SAAS,CAAA;AAE5C,gCAAgC;AAChC,OAAO,EAAE,GAAG,IAAI,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAEjD,uCAAuC;AACvC,OAAO,EAAE,IAAI,IAAI,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EACL,GAAG,IAAI,8BAA8B,EACrC,IAAI,IAAI,kBAAkB,GAC3B,MAAM,kBAAkB,CAAA;AAEzB,yEAAyE;AACzE,OAAO,EACL,GAAG,IAAI,QAAQ,EACf,IAAI,IAAI,UAAU,EAClB,OAAO,EACP,KAAK,IAAI,UAAU,EACnB,MAAM,IAAI,UAAU,GACrB,MAAM,SAAS,CAAA;AAGhB,2DAA2D;AAC3D,OAAO,EACL,GAAG,IAAI,0BAA0B,EACjC,IAAI,IAAI,wBAAwB,GACjC,MAAM,iBAAiB,CAAA;AAExB,yBAAyB;AACzB,OAAO,EACL,GAAG,IAAI,KAAK,EACZ,KAAK,IAAI,QAAQ,EACjB,cAAc,IAAI,gBAAgB,GACnC,MAAM,MAAM,CAAA;AAEb,WAAW;AACX,OAAO,EAAE,GAAG,IAAI,WAAW,EAAE,GAAG,IAAI,cAAc,EAAE,MAAM,YAAY,CAAA;AAEtE,gBAAgB;AAChB,OAAO,EAAE,GAAG,IAAI,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAExD,oBAAoB;AACpB,OAAO,EACL,WAAW,IAAI,mBAAmB,EAClC,aAAa,IAAI,qBAAqB,EACtC,UAAU,IAAI,kBAAkB,EAChC,aAAa,IAAI,qBAAqB,EACtC,aAAa,IAAI,qBAAqB,GACvC,MAAM,YAAY,CAAA;AAEnB,yBAAyB;AACzB,OAAO,EACL,QAAQ,IAAI,gBAAgB,EAC5B,UAAU,IAAI,kBAAkB,EAChC,OAAO,IAAI,eAAe,EAC1B,UAAU,IAAI,kBAAkB,EAChC,UAAU,IAAI,kBAAkB,EAChC,UAAU,IAAI,kBAAkB,EAChC,UAAU,IAAI,kBAAkB,EAChC,UAAU,IAAI,kBAAkB,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AAEnB,YAAY;AACZ,OAAO,EACL,WAAW,EACX,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,aAAa,CAAA"}

package/dist/admin/api/linked-customer.d.ts

@@ -1,32 +0,0 @@
-/**
- * @rovela/sdk/admin/api/linked-customer
- *
- * Self-service detection endpoint: does the currently signed-in admin also
- * have a customer row on this same store? Used by the admin user menu
- * (AdminUserMenu) to show/hide the "My customer account" link (R112).
- *
- *   GET /api/admin/linked-customer  →  { hasLinkedCustomer: boolean }
- *
- * Per-store DB isolation is inherent (branch-per-store), so no cross-tenant
- * concern. Gated on `requireAdmin()` — same auth guard as the rest of the
- * admin API surface.
- *
- * Fail-safe: any internal error resolves to `false` rather than 500. The
- * link's job is disclosure, not security — we'd rather hide it than crash
- * the dropdown UX.
- *
- * Usage (template):
- * ```typescript
- * // app/api/admin/linked-customer/route.ts
- * export { GET } from '@rovela-ai/sdk/admin/api/linked-customer'
- * ```
- */
-import { NextResponse } from 'next/server';
-import type { AdminApiError } from '../types';
-export declare const runtime = "nodejs";
-interface LinkedCustomerResponse {
-    hasLinkedCustomer: boolean;
-}
-export declare function GET(): Promise<NextResponse<LinkedCustomerResponse | AdminApiError>>;
-export {};
-//# sourceMappingURL=linked-customer.d.ts.map

package/dist/admin/api/linked-customer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"linked-customer.d.ts","sourceRoot":"","sources":["../../../src/admin/api/linked-customer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE7C,eAAO,MAAM,OAAO,WAAW,CAAA;AAE/B,UAAU,sBAAsB;IAC9B,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,wBAAsB,GAAG,IAAI,OAAO,CAClC,YAAY,CAAC,sBAAsB,GAAG,aAAa,CAAC,CACrD,CAgBA"}

package/dist/admin/api/linked-customer.js

@@ -1,45 +0,0 @@
-/**
- * @rovela/sdk/admin/api/linked-customer
- *
- * Self-service detection endpoint: does the currently signed-in admin also
- * have a customer row on this same store? Used by the admin user menu
- * (AdminUserMenu) to show/hide the "My customer account" link (R112).
- *
- *   GET /api/admin/linked-customer  →  { hasLinkedCustomer: boolean }
- *
- * Per-store DB isolation is inherent (branch-per-store), so no cross-tenant
- * concern. Gated on `requireAdmin()` — same auth guard as the rest of the
- * admin API surface.
- *
- * Fail-safe: any internal error resolves to `false` rather than 500. The
- * link's job is disclosure, not security — we'd rather hide it than crash
- * the dropdown UX.
- *
- * Usage (template):
- * ```typescript
- * // app/api/admin/linked-customer/route.ts
- * export { GET } from '@rovela-ai/sdk/admin/api/linked-customer'
- * ```
- */
-import { NextResponse } from 'next/server';
-import { requireAdmin } from '../server/admin-session';
-import { findCustomerByEmail } from '../../auth/server/customer-service';
-export const runtime = 'nodejs';
-export async function GET() {
-    const guard = await requireAdmin();
-    if (!guard.ok) {
-        return guard.response;
-    }
-    try {
-        const customer = await findCustomerByEmail(guard.admin.email);
-        return NextResponse.json({ hasLinkedCustomer: !!customer });
-    }
-    catch (error) {
-        console.error('[Admin LinkedCustomer] lookup error:', error);
-        // Fail-safe: treat errors as "not linked" so the admin dropdown just
-        // hides the link rather than rendering a broken 5xx in the UI. The
-        // menu is cosmetic — a false negative is strictly better than a crash.
-        return NextResponse.json({ hasLinkedCustomer: false });
-    }
-}
-//# sourceMappingURL=linked-customer.js.map

package/dist/admin/api/linked-customer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"linked-customer.js","sourceRoot":"","sources":["../../../src/admin/api/linked-customer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAGxE,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAA;AAM/B,MAAM,CAAC,KAAK,UAAU,GAAG;IAGvB,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC7D,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;QAC5D,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAA;IACxD,CAAC;AACH,CAAC"}

package/dist/admin/api/me.d.ts

@@ -1,72 +0,0 @@
-/**
- * @rovela/sdk/admin/api/me
- *
- * Self-service API routes for logged-in admins.
- *
- *   GET   /api/admin/me            — return the caller's profile
- *   PATCH /api/admin/me            — update own name / email
- *   PATCH /api/admin/me/password   — change own password (requires current)
- *
- * All routes gate on `requireAdmin()` (no permission required — every
- * logged-in admin can self-service). Invariants are enforced at the
- * service layer in `admin-self-service.ts`:
- *
- *   - `changeOwnPassword` requires current password as proof of identity
- *   - `updateOwnProfile` checks email uniqueness against every other admin
- *   - Password change bumps `sessionVersion` → forced logout on next request
- *
- * Usage:
- * ```typescript
- * // app/api/admin/me/route.ts
- * export { GET, PATCH } from '@rovela-ai/sdk/admin/api/me'
- *
- * // app/api/admin/me/password/route.ts
- * export { PATCH_PASSWORD as PATCH } from '@rovela-ai/sdk/admin/api/me'
- * ```
- */
-import { NextRequest, NextResponse } from 'next/server';
-import type { AdminApiError } from '../types';
-export declare const runtime = "nodejs";
-interface MeResponse {
-    id: string;
-    email: string;
-    name: string;
-    role: string;
-    status: string;
-    createdAt: string;
-    lastLoginAt: string | null;
-}
-/**
- * Used by the account page on mount + by client code that needs a fresh
- * copy of the logged-in admin's data (e.g., after a profile update).
- * Returns the SAFE projection — no passwordHash, no internal fields.
- */
-export declare function GET(_request: NextRequest): Promise<NextResponse<MeResponse | AdminApiError>>;
-/**
- * Body: `{ name?: string, email?: string }`
- *
- * Both fields are optional, but at least one must be provided. Email
- * changes are checked for uniqueness against every other admin. No
- * re-verification required — the dialog on the client side warns the
- * user about forgot-password implications of a typo.
- *
- * No sessionVersion bump — profile changes don't invalidate sessions.
- */
-export declare function PATCH(request: NextRequest): Promise<NextResponse<{
-    success: boolean;
-} | AdminApiError>>;
-/**
- * Body: `{ currentPassword: string, newPassword: string }`
- *
- * Verifies the current password, validates the new password, updates
- * the hash, bumps `sessionVersion`, clears any stale reset tokens, and
- * flushes the session cache. The admin's CURRENT session will be
- * invalidated on their very next request — they'll need to sign in
- * again with the new password. This is intentional: password rotation
- * should kick out all sessions, including your own.
- */
-export declare function PATCH_PASSWORD(request: NextRequest): Promise<NextResponse<{
-    success: boolean;
-} | AdminApiError>>;
-export {};
-//# sourceMappingURL=me.d.ts.map

package/dist/admin/api/me.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/admin/api/me.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE7C,eAAO,MAAM,OAAO,WAAW,CAAA;AAM/B,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAMD;;;;GAIG;AACH,wBAAsB,GAAG,CACvB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,YAAY,CAAC,UAAU,GAAG,aAAa,CAAC,CAAC,CA+BnD;AAMD;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAqC7D;AAMD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAwD7D"}

package/dist/admin/api/me.js

@@ -1,177 +0,0 @@
-/**
- * @rovela/sdk/admin/api/me
- *
- * Self-service API routes for logged-in admins.
- *
- *   GET   /api/admin/me            — return the caller's profile
- *   PATCH /api/admin/me            — update own name / email
- *   PATCH /api/admin/me/password   — change own password (requires current)
- *
- * All routes gate on `requireAdmin()` (no permission required — every
- * logged-in admin can self-service). Invariants are enforced at the
- * service layer in `admin-self-service.ts`:
- *
- *   - `changeOwnPassword` requires current password as proof of identity
- *   - `updateOwnProfile` checks email uniqueness against every other admin
- *   - Password change bumps `sessionVersion` → forced logout on next request
- *
- * Usage:
- * ```typescript
- * // app/api/admin/me/route.ts
- * export { GET, PATCH } from '@rovela-ai/sdk/admin/api/me'
- *
- * // app/api/admin/me/password/route.ts
- * export { PATCH_PASSWORD as PATCH } from '@rovela-ai/sdk/admin/api/me'
- * ```
- */
-import { NextResponse } from 'next/server';
-import { requireAdmin } from '../server/admin-session';
-import { changeOwnPassword, updateOwnProfile, } from '../server/admin-self-service';
-export const runtime = 'nodejs';
-// =============================================================================
-// GET /api/admin/me — return the caller's profile
-// =============================================================================
-/**
- * Used by the account page on mount + by client code that needs a fresh
- * copy of the logged-in admin's data (e.g., after a profile update).
- * Returns the SAFE projection — no passwordHash, no internal fields.
- */
-export async function GET(_request) {
-    const guard = await requireAdmin();
-    if (!guard.ok) {
-        return guard.response;
-    }
-    try {
-        const admin = guard.admin;
-        return NextResponse.json({
-            id: admin.id,
-            email: admin.email,
-            name: admin.name,
-            role: admin.role,
-            status: admin.status ?? 'active',
-            createdAt: admin.createdAt instanceof Date
-                ? admin.createdAt.toISOString()
-                : String(admin.createdAt),
-            lastLoginAt: admin.lastLoginAt
-                ? admin.lastLoginAt instanceof Date
-                    ? admin.lastLoginAt.toISOString()
-                    : String(admin.lastLoginAt)
-                : null,
-        });
-    }
-    catch (error) {
-        console.error('[Admin Me API] GET error:', error);
-        return NextResponse.json({ error: 'Failed to fetch profile', code: 'INTERNAL_ERROR' }, { status: 500 });
-    }
-}
-// =============================================================================
-// PATCH /api/admin/me — update own profile (name + email)
-// =============================================================================
-/**
- * Body: `{ name?: string, email?: string }`
- *
- * Both fields are optional, but at least one must be provided. Email
- * changes are checked for uniqueness against every other admin. No
- * re-verification required — the dialog on the client side warns the
- * user about forgot-password implications of a typo.
- *
- * No sessionVersion bump — profile changes don't invalidate sessions.
- */
-export async function PATCH(request) {
-    const guard = await requireAdmin();
-    if (!guard.ok) {
-        return guard.response;
-    }
-    try {
-        const body = (await request.json().catch(() => null));
-        const name = typeof body?.name === 'string' ? body.name : undefined;
-        const email = typeof body?.email === 'string' ? body.email : undefined;
-        const result = await updateOwnProfile(guard.admin.id, { name, email });
-        if (!result.ok) {
-            const status = result.error.code === 'EMAIL_EXISTS'
-                ? 409
-                : result.error.code === 'NOT_FOUND'
-                    ? 404
-                    : 400;
-            return NextResponse.json({ error: result.error.message, code: mapProfileErrorCode(result.error.code) }, { status });
-        }
-        return NextResponse.json({ success: true });
-    }
-    catch (error) {
-        console.error('[Admin Me API] PATCH error:', error);
-        return NextResponse.json({ error: 'Failed to update profile', code: 'INTERNAL_ERROR' }, { status: 500 });
-    }
-}
-// =============================================================================
-// PATCH /api/admin/me/password — change own password
-// =============================================================================
-/**
- * Body: `{ currentPassword: string, newPassword: string }`
- *
- * Verifies the current password, validates the new password, updates
- * the hash, bumps `sessionVersion`, clears any stale reset tokens, and
- * flushes the session cache. The admin's CURRENT session will be
- * invalidated on their very next request — they'll need to sign in
- * again with the new password. This is intentional: password rotation
- * should kick out all sessions, including your own.
- */
-export async function PATCH_PASSWORD(request) {
-    const guard = await requireAdmin();
-    if (!guard.ok) {
-        return guard.response;
-    }
-    try {
-        const body = (await request.json().catch(() => null));
-        const currentPassword = typeof body?.currentPassword === 'string' ? body.currentPassword : '';
-        const newPassword = typeof body?.newPassword === 'string' ? body.newPassword : '';
-        if (!currentPassword || !newPassword) {
-            return NextResponse.json({
-                error: 'currentPassword and newPassword are required.',
-                code: 'VALIDATION_ERROR',
-            }, { status: 400 });
-        }
-        const result = await changeOwnPassword(guard.admin.id, currentPassword, newPassword);
-        if (!result.ok) {
-            const status = result.error.code === 'INVALID_CREDENTIALS'
-                ? 401
-                : result.error.code === 'NOT_FOUND'
-                    ? 404
-                    : 400;
-            return NextResponse.json({
-                error: result.error.message,
-                code: mapPasswordErrorCode(result.error.code),
-            }, { status });
-        }
-        return NextResponse.json({ success: true });
-    }
-    catch (error) {
-        console.error('[Admin Me API] PATCH_PASSWORD error:', error);
-        return NextResponse.json({ error: 'Failed to change password', code: 'INTERNAL_ERROR' }, { status: 500 });
-    }
-}
-// =============================================================================
-// Helpers
-// =============================================================================
-function mapProfileErrorCode(code) {
-    switch (code) {
-        case 'NOT_FOUND':
-            return 'NOT_FOUND';
-        case 'EMAIL_EXISTS':
-            return 'EMAIL_EXISTS';
-        case 'INVALID_CREDENTIALS':
-        case 'VALIDATION_ERROR':
-            return 'VALIDATION_ERROR';
-    }
-}
-function mapPasswordErrorCode(code) {
-    switch (code) {
-        case 'NOT_FOUND':
-            return 'NOT_FOUND';
-        case 'INVALID_CREDENTIALS':
-            return 'INVALID_CREDENTIALS';
-        case 'EMAIL_EXISTS':
-        case 'VALIDATION_ERROR':
-            return 'VALIDATION_ERROR';
-    }
-}
-//# sourceMappingURL=me.js.map

package/dist/admin/api/me.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"me.js","sourceRoot":"","sources":["../../../src/admin/api/me.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AAGrC,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAA;AAgB/B,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,QAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACzB,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAG,KAAwC,CAAC,MAAM,IAAI,QAAQ;YACpE,SAAS,EACP,KAAK,CAAC,SAAS,YAAY,IAAI;gBAC7B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC/B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC5B,CAAC,CAAC,KAAK,CAAC,WAAW,YAAY,IAAI;oBACjC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;oBACjC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC7B,CAAC,CAAC,IAAI;SACT,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAA;QACjD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,0DAA0D;AAC1D,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,OAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE5C,CAAA;QAER,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QACnE,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAEtE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAEtE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GACV,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;gBAClC,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;oBACjC,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,GAAG,CAAA;YACX,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAC7E,EAAE,MAAM,EAAE,CACX,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE5C,CAAA;QAER,MAAM,eAAe,GACnB,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAA;QACvE,MAAM,WAAW,GACf,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;QAE/D,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,+CAA+C;gBACtD,IAAI,EAAE,kBAAkB;aACzB,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,eAAe,EACf,WAAW,CACZ,CAAA;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GACV,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB;gBACzC,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;oBACjC,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,GAAG,CAAA;YACX,OAAO,YAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;aAC9C,EACD,EAAE,MAAM,EAAE,CACX,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;QAC5D,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAS,mBAAmB,CAC1B,IAA+E;IAE/E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,WAAW,CAAA;QACpB,KAAK,cAAc;YACjB,OAAO,cAAc,CAAA;QACvB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,kBAAkB;YACrB,OAAO,kBAAkB,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAA+E;IAE/E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,WAAW,CAAA;QACpB,KAAK,qBAAqB;YACxB,OAAO,qBAAqB,CAAA;QAC9B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,kBAAkB,CAAA;IAC7B,CAAC;AACH,CAAC"}

package/dist/admin/api/orders.d.ts

@@ -1,91 +0,0 @@
-/**
- * @rovela/sdk/admin/api/orders
- *
- * API route handlers for admin order management.
- *
- * Usage:
- * ```typescript
- * // app/api/admin/orders/route.ts
- * export { GET } from '@rovela/sdk/admin/api/orders'
- *
- * // app/api/admin/orders/[id]/route.ts
- * export { GET as getOrder, PUT } from '@rovela/sdk/admin/api/orders'
- * ```
- */
-import { NextRequest, NextResponse } from 'next/server';
-import type { ShippoRate } from '../types';
-import type { AdminApiError, PaginatedResponse } from '../types';
-/**
- * GET /api/admin/orders
- *
- * List orders with filtering and pagination.
- *
- * Query Parameters:
- * - status: Order status filter
- * - page: number (default 1)
- * - limit: number (default 20, max 100)
- */
-export declare function GET(request: NextRequest): Promise<NextResponse<PaginatedResponse<unknown> | AdminApiError>>;
-/**
- * GET /api/admin/orders/[id]
- *
- * Get a single order by ID with items.
- */
-export declare function getOrder(request: NextRequest, { params }: {
-    params: Promise<{
-        id: string;
-    }>;
-}): Promise<NextResponse<{
-    data: unknown;
-} | AdminApiError>>;
-/**
- * PUT /api/admin/orders/[id]
- *
- * Update order status.
- *
- * Body:
- * - status: New order status
- * - notifyCustomer: boolean (default true)
- * - trackingNumber: string (for shipped status)
- * - trackingUrl: string (for shipped status)
- */
-export declare function PUT(request: NextRequest, { params }: {
-    params: Promise<{
-        id: string;
-    }>;
-}): Promise<NextResponse<{
-    success: boolean;
-    data?: unknown;
-} | AdminApiError>>;
-/**
- * GET /api/admin/orders/[id]/shippo-rates
- *
- * Get available Shippo carrier rates for an order.
- * Requires order to have a shipping address.
- */
-export declare function getShippoRatesForOrder(_request: NextRequest, { params }: {
-    params: Promise<{
-        id: string;
-    }>;
-}): Promise<NextResponse<{
-    rates: ShippoRate[];
-} | AdminApiError>>;
-/**
- * POST /api/admin/orders/[id]/ship-with-shippo
- *
- * Purchase a shipping label from Shippo and update order with tracking info.
- *
- * Body:
- * - rateId: Shippo rate object ID to purchase
- * - notifyCustomer: boolean (default true)
- */
-export declare function shipWithShippo(request: NextRequest, { params }: {
-    params: Promise<{
-        id: string;
-    }>;
-}): Promise<NextResponse<{
-    success: boolean;
-    trackingNumber?: string;
-    labelUrl?: string;
-} | AdminApiError>>;
-//# sourceMappingURL=orders.d.ts.map

package/dist/admin/api/orders.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"orders.d.ts","sourceRoot":"","sources":["../../../src/admin/api/orders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAcvD,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,UAAU,CAAA;AAQzD,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAYhE;;;;;;;;;GASG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,CA0CnE;AAMD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,WAAW,EACpB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CA0B1D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,WAAW,EACpB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CA0E7E;AA2JD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,WAAW,EACrB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,KAAK,EAAE,UAAU,EAAE,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAkFhE;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,EACpB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAoGzG"}