@rovela-ai/sdk 0.4.0 → 0.4.1

package/dist/admin/server/admin-session.d.ts

@@ -1,173 +0,0 @@
-/**
- * @rovela/sdk/admin/server/admin-session
- *
- * Centralized session + permission check for admin API routes.
- *
- * # Why this exists
- *
- * Before this module, every admin API handler had its own local copy of a
- * `requireAdmin()` helper — ten copies across products, orders, customers,
- * refund, return, settings, stats, stripe-status, categories, shipping, and
- * tax-zones. None of them enforced role-based permissions.
- *
- * # Which auth config we read
- *
- * Post two-cookie split (SDK 0.3.20), the sandbox template mounts a dedicated
- * admin NextAuth endpoint at `/api/admin-auth/[...nextauth]/route.ts`, wired
- * to `createAdminAuthOptions()` from `@rovela-ai/sdk/admin`. That config
- * writes `__Secure-rovela.admin.session-token`, distinct from the customer
- * cookie, so an admin and a customer session can coexist in the same browser
- * (the foundation of the "linked customer" feature).
- *
- * `requireAdmin` reads through the SAME admin config it's paired with, so
- * the cookie name and SameSite policy match between write and read.
- *
- * Single gatekeeper that:
- *   1. Reads the NextAuth session via `createAdminAuthOptions()`.
- *   2. Fetches a fresh admin row from the DB and confirms `status = 'active'`
- *      so that deactivated users are kicked out on their next request without
- *      waiting for the JWT to expire.
- *   3. Optionally checks a specific `Permission` from the permission matrix.
- *   4. Optionally enforces a minimum role rank via `meetsMinRole`.
- *   5. Ensures the runtime schema migration has run (once per process) so
- *      stores on an older schema still work with the new SDK code paths.
- *
- * # Caching
- *
- * The DB status check is cached in-memory for 30 seconds per admin ID. This
- * keeps the hot path fast (most admin routes already do a DB query for their
- * actual work; one extra read would add ~10ms, and we want to avoid even
- * that for back-to-back requests). Cache is invalidated via
- * `invalidateAdminSession(adminId)` after any user-management operation that
- * changes the admin's role or status, so the next request sees the new state
- * without waiting for the 30-second TTL.
- *
- * # Schema assumptions
- *
- * This helper assumes the store's Neon database is already on the latest
- * admin schema (v2). Schema is applied manually via Neon MCP once per store
- * (master branch for new stores, per-branch for existing stores that want
- * the feature). The helper tolerates missing fields gracefully: if the
- * `status` column doesn't exist on an older store, it's read as undefined
- * and defaulted to 'active' so existing owner sessions keep working.
- *
- * # Return contract
- *
- * `requireAdmin()` returns a discriminated union:
- *   - `{ ok: true, admin }`  — caller proceeds
- *   - `{ ok: false, response }` — caller returns `response` directly
- *
- * This pattern keeps the happy path terse at call sites:
- *
- * ```ts
- * const guard = await requireAdmin({ permission: 'products.write' })
- * if (!guard.ok) return guard.response
- * const { admin } = guard
- * // ...proceed with admin.id, admin.role, etc.
- * ```
- */
-import { NextResponse } from 'next/server';
-import { type Permission } from '../permissions';
-import type { AdminRole } from '../../core/types';
-import type { StoreAdmin } from '../../core/db/schema';
-import type { AdminApiError } from '../types';
-export interface RequireAdminOptions {
-    /** Require a specific permission from the permission matrix. */
-    permission?: Permission;
-    /** Require at least this role rank (e.g. 'administrator' means owner OR administrator). */
-    minRole?: AdminRole;
-}
-export type RequireAdminResult = {
-    ok: true;
-    admin: StoreAdmin;
-} | {
-    ok: false;
-    response: NextResponse<AdminApiError>;
-};
-/**
- * Invalidate the session cache for a specific admin. Call this after any
- * user-management operation that changes the admin's role or status, so the
- * next request sees the new state without waiting for the 30s TTL.
- *
- * @example
- * ```ts
- * await deactivateAdmin(adminId)
- * invalidateAdminSession(adminId)
- * ```
- */
-export declare function invalidateAdminSession(adminId: string): void;
-/**
- * Clear the entire admin session cache. Exposed for tests; rarely needed in
- * production since per-admin invalidation is sufficient.
- * @internal
- */
-export declare function __clearAdminSessionCache(): void;
-/**
- * Authenticate + authorize the current request as an admin.
- *
- * Resolves with either `{ ok: true, admin }` (caller may proceed) or
- * `{ ok: false, response }` (caller returns `response` to the client).
- *
- * Never throws — any internal error is converted to a 401/403/500 response
- * that's safe to return directly.
- *
- * @example
- * ```ts
- * // List products (any authenticated admin with 'products.read')
- * export async function GET(request: NextRequest) {
- *   const guard = await requireAdmin({ permission: 'products.read' })
- *   if (!guard.ok) return guard.response
- *   const { admin } = guard
- *   // ...proceed, admin.role is known, admin.status === 'active'
- * }
- * ```
- *
- * @example
- * ```ts
- * // Change a user's role (only owners)
- * export async function PATCH(request: NextRequest) {
- *   const guard = await requireAdmin({ permission: 'users.write' })
- *   if (!guard.ok) return guard.response
- *   // ...
- * }
- * ```
- */
-export declare function requireAdmin(options?: RequireAdminOptions): Promise<RequireAdminResult>;
-/**
- * Layout-friendly variant of `requireAdmin`.
- *
- * Returns the authenticated admin (with status + sessionVersion already
- * validated against the DB, via the same 30s in-memory cache that powers
- * `requireAdmin`) or `null` when the session is missing, stale, or for a
- * deactivated admin. Permission/role checks are intentionally skipped — a
- * layout's job is "is this an active admin?", not "can they read products?".
- *
- * Use in async Server Component layouts that need to gate rendering BEFORE
- * any HTML reaches the client. For API routes use `requireAdmin` directly —
- * it returns the discriminated union with the right NextResponse shape.
- *
- * Eliminates the flash-of-admin-content seen by unauthenticated users on
- * cold loads of `/admin/*` routes.
- *
- * @example
- * ```tsx
- * // app/admin/(dashboard)/layout.tsx
- * import { redirect } from 'next/navigation'
- * import { getCurrentAdmin } from '@rovela-ai/sdk/admin/server'
- * import { AdminLayout, AdminGuard } from '@rovela-ai/sdk/admin'
- *
- * export default async function AdminRootLayout({ children }) {
- *   const session = await getCurrentAdmin()
- *   if (!session) redirect('/admin/login')
- *   return (
- *     <AdminLayout>
- *       <AdminGuard redirectTo="/admin/login">{children}</AdminGuard>
- *     </AdminLayout>
- *   )
- * }
- * ```
- */
-export declare function getCurrentAdmin(): Promise<{
-    admin: StoreAdmin;
-} | null>;
-//# sourceMappingURL=admin-session.d.ts.map

package/dist/admin/server/admin-session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-session.d.ts","sourceRoot":"","sources":["../../../src/admin/server/admin-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI1C,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAA;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAM7C,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,SAAS,CAAA;CACpB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAC,aAAa,CAAC,CAAA;CAAE,CAAA;AA+BxD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,YAAY,CAChC,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAgF7B;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG,IAAI,CAAC,CAI7E"}

package/dist/admin/server/admin-session.js

@@ -1,272 +0,0 @@
-/**
- * @rovela/sdk/admin/server/admin-session
- *
- * Centralized session + permission check for admin API routes.
- *
- * # Why this exists
- *
- * Before this module, every admin API handler had its own local copy of a
- * `requireAdmin()` helper — ten copies across products, orders, customers,
- * refund, return, settings, stats, stripe-status, categories, shipping, and
- * tax-zones. None of them enforced role-based permissions.
- *
- * # Which auth config we read
- *
- * Post two-cookie split (SDK 0.3.20), the sandbox template mounts a dedicated
- * admin NextAuth endpoint at `/api/admin-auth/[...nextauth]/route.ts`, wired
- * to `createAdminAuthOptions()` from `@rovela-ai/sdk/admin`. That config
- * writes `__Secure-rovela.admin.session-token`, distinct from the customer
- * cookie, so an admin and a customer session can coexist in the same browser
- * (the foundation of the "linked customer" feature).
- *
- * `requireAdmin` reads through the SAME admin config it's paired with, so
- * the cookie name and SameSite policy match between write and read.
- *
- * Single gatekeeper that:
- *   1. Reads the NextAuth session via `createAdminAuthOptions()`.
- *   2. Fetches a fresh admin row from the DB and confirms `status = 'active'`
- *      so that deactivated users are kicked out on their next request without
- *      waiting for the JWT to expire.
- *   3. Optionally checks a specific `Permission` from the permission matrix.
- *   4. Optionally enforces a minimum role rank via `meetsMinRole`.
- *   5. Ensures the runtime schema migration has run (once per process) so
- *      stores on an older schema still work with the new SDK code paths.
- *
- * # Caching
- *
- * The DB status check is cached in-memory for 30 seconds per admin ID. This
- * keeps the hot path fast (most admin routes already do a DB query for their
- * actual work; one extra read would add ~10ms, and we want to avoid even
- * that for back-to-back requests). Cache is invalidated via
- * `invalidateAdminSession(adminId)` after any user-management operation that
- * changes the admin's role or status, so the next request sees the new state
- * without waiting for the 30-second TTL.
- *
- * # Schema assumptions
- *
- * This helper assumes the store's Neon database is already on the latest
- * admin schema (v2). Schema is applied manually via Neon MCP once per store
- * (master branch for new stores, per-branch for existing stores that want
- * the feature). The helper tolerates missing fields gracefully: if the
- * `status` column doesn't exist on an older store, it's read as undefined
- * and defaulted to 'active' so existing owner sessions keep working.
- *
- * # Return contract
- *
- * `requireAdmin()` returns a discriminated union:
- *   - `{ ok: true, admin }`  — caller proceeds
- *   - `{ ok: false, response }` — caller returns `response` directly
- *
- * This pattern keeps the happy path terse at call sites:
- *
- * ```ts
- * const guard = await requireAdmin({ permission: 'products.write' })
- * if (!guard.ok) return guard.response
- * const { admin } = guard
- * // ...proceed with admin.id, admin.role, etc.
- * ```
- */
-import { NextResponse } from 'next/server';
-import { getServerSession } from 'next-auth';
-import { createAdminAuthOptions } from '../config';
-import { findAdminById } from './admin-service';
-import { hasPermission, meetsMinRole, } from '../permissions';
-const STATUS_CACHE_TTL_MS = 30 * 1000;
-const statusCache = new Map();
-function getCachedAdmin(adminId) {
-    const entry = statusCache.get(adminId);
-    if (!entry)
-        return null;
-    if (Date.now() > entry.expiresAt) {
-        statusCache.delete(adminId);
-        return null;
-    }
-    return entry.admin;
-}
-function setCachedAdmin(adminId, admin) {
-    statusCache.set(adminId, {
-        admin,
-        expiresAt: Date.now() + STATUS_CACHE_TTL_MS,
-    });
-}
-/**
- * Invalidate the session cache for a specific admin. Call this after any
- * user-management operation that changes the admin's role or status, so the
- * next request sees the new state without waiting for the 30s TTL.
- *
- * @example
- * ```ts
- * await deactivateAdmin(adminId)
- * invalidateAdminSession(adminId)
- * ```
- */
-export function invalidateAdminSession(adminId) {
-    statusCache.delete(adminId);
-}
-/**
- * Clear the entire admin session cache. Exposed for tests; rarely needed in
- * production since per-admin invalidation is sufficient.
- * @internal
- */
-export function __clearAdminSessionCache() {
-    statusCache.clear();
-}
-// =============================================================================
-// Response helpers
-// =============================================================================
-function unauthorized() {
-    return NextResponse.json({ error: 'Unauthorized', code: 'UNAUTHORIZED' }, { status: 401 });
-}
-function forbidden() {
-    return NextResponse.json({ error: 'Forbidden', code: 'FORBIDDEN' }, { status: 403 });
-}
-// =============================================================================
-// Main helper
-// =============================================================================
-/**
- * Authenticate + authorize the current request as an admin.
- *
- * Resolves with either `{ ok: true, admin }` (caller may proceed) or
- * `{ ok: false, response }` (caller returns `response` to the client).
- *
- * Never throws — any internal error is converted to a 401/403/500 response
- * that's safe to return directly.
- *
- * @example
- * ```ts
- * // List products (any authenticated admin with 'products.read')
- * export async function GET(request: NextRequest) {
- *   const guard = await requireAdmin({ permission: 'products.read' })
- *   if (!guard.ok) return guard.response
- *   const { admin } = guard
- *   // ...proceed, admin.role is known, admin.status === 'active'
- * }
- * ```
- *
- * @example
- * ```ts
- * // Change a user's role (only owners)
- * export async function PATCH(request: NextRequest) {
- *   const guard = await requireAdmin({ permission: 'users.write' })
- *   if (!guard.ok) return guard.response
- *   // ...
- * }
- * ```
- */
-export async function requireAdmin(options = {}) {
-    // 1. NextAuth admin session — read through the ADMIN auth config. Post
-    // two-cookie-split (SDK 0.3.20), the template mounts a dedicated admin
-    // endpoint at `/api/admin-auth/[...nextauth]` wired to
-    // `createAdminAuthOptions()`, which writes its own cookie
-    // (`__Secure-rovela.admin.session-token`). Customer cookies live in a
-    // separate jar and cannot reach this endpoint.
-    //
-    // The `as unknown as` dance is unavoidable: getServerSession's overloaded
-    // return type infers to `{}` in this generic context, and our session user
-    // carries a custom `role` field we need to read.
-    let rawSession;
-    try {
-        rawSession = await getServerSession(createAdminAuthOptions());
-    }
-    catch (err) {
-        console.error('[requireAdmin] Failed to read session:', err);
-        return { ok: false, response: unauthorized() };
-    }
-    const sessionUser = rawSession?.user;
-    if (!sessionUser?.id) {
-        return { ok: false, response: unauthorized() };
-    }
-    // 2. Fresh DB status check (cached 30s per admin).
-    let admin = getCachedAdmin(sessionUser.id);
-    if (!admin) {
-        try {
-            const fetched = await findAdminById(sessionUser.id);
-            if (!fetched) {
-                return { ok: false, response: unauthorized() };
-            }
-            admin = fetched;
-            setCachedAdmin(sessionUser.id, admin);
-        }
-        catch (err) {
-            console.error('[requireAdmin] Failed to fetch admin row:', err);
-            return { ok: false, response: unauthorized() };
-        }
-    }
-    // 3. Status must be 'active'. 'invited' admins cannot use the dashboard
-    // until they accept their invite; 'deactivated' admins are blocked entirely.
-    // The `status` column may not exist on stores running an older schema — in
-    // that case the field is undefined and we treat it as 'active' (backward
-    // compatible for stores that haven't run the v2 migration yet).
-    const status = admin.status ?? 'active';
-    if (status !== 'active') {
-        return { ok: false, response: unauthorized() };
-    }
-    // 4. Session version check (Phase 4). Compare the JWT's embedded
-    // `sessionVersion` to the DB row's current version. On any mismatch,
-    // treat as forced logout.
-    //
-    // Backward compatibility: JWTs issued before Phase 4 have no
-    // sessionVersion claim (→ undefined → 0), and all DB rows start at 0
-    // after the migration, so pre-Phase-4 sessions match cleanly. The
-    // first password change for any admin bumps the DB version to 1;
-    // their old JWTs fail the match on the next request and get kicked
-    // out — which is exactly what we want.
-    const jwtVersion = sessionUser.sessionVersion ?? 0;
-    const dbVersion = admin.sessionVersion ?? 0;
-    if (jwtVersion !== dbVersion) {
-        return { ok: false, response: unauthorized() };
-    }
-    // 5. Permission check (if requested).
-    if (options.permission && !hasPermission(admin.role, options.permission)) {
-        return { ok: false, response: forbidden() };
-    }
-    // 6. Min-role check (if requested).
-    if (options.minRole && !meetsMinRole(admin.role, options.minRole)) {
-        return { ok: false, response: forbidden() };
-    }
-    return { ok: true, admin };
-}
-// =============================================================================
-// Layout-friendly variant
-// =============================================================================
-/**
- * Layout-friendly variant of `requireAdmin`.
- *
- * Returns the authenticated admin (with status + sessionVersion already
- * validated against the DB, via the same 30s in-memory cache that powers
- * `requireAdmin`) or `null` when the session is missing, stale, or for a
- * deactivated admin. Permission/role checks are intentionally skipped — a
- * layout's job is "is this an active admin?", not "can they read products?".
- *
- * Use in async Server Component layouts that need to gate rendering BEFORE
- * any HTML reaches the client. For API routes use `requireAdmin` directly —
- * it returns the discriminated union with the right NextResponse shape.
- *
- * Eliminates the flash-of-admin-content seen by unauthenticated users on
- * cold loads of `/admin/*` routes.
- *
- * @example
- * ```tsx
- * // app/admin/(dashboard)/layout.tsx
- * import { redirect } from 'next/navigation'
- * import { getCurrentAdmin } from '@rovela-ai/sdk/admin/server'
- * import { AdminLayout, AdminGuard } from '@rovela-ai/sdk/admin'
- *
- * export default async function AdminRootLayout({ children }) {
- *   const session = await getCurrentAdmin()
- *   if (!session) redirect('/admin/login')
- *   return (
- *     <AdminLayout>
- *       <AdminGuard redirectTo="/admin/login">{children}</AdminGuard>
- *     </AdminLayout>
- *   )
- * }
- * ```
- */
-export async function getCurrentAdmin() {
-    const result = await requireAdmin();
-    if (!result.ok)
-        return null;
-    return { admin: result.admin };
-}
-//# sourceMappingURL=admin-session.js.map

package/dist/admin/server/admin-session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-session.js","sourceRoot":"","sources":["../../../src/admin/server/admin-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/C,OAAO,EACL,aAAa,EACb,YAAY,GAEb,MAAM,gBAAgB,CAAA;AA6BvB,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAA;AACrC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAA;AAEvD,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;QACjC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,KAAiB;IACxD,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;QACvB,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB;KAC5C,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,WAAW,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,SAAS,YAAY;IACnB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAC/C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAA+B,EAAE;IAEjC,uEAAuE;IACvE,uEAAuE;IACvE,uDAAuD;IACvD,0DAA0D;IAC1D,sEAAsE;IACtE,+CAA+C;IAC/C,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,gBAAgB,CAAC,sBAAsB,EAAE,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAA;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,WAAW,GAAI,UAEZ,EAAE,IAAI,CAAA;IACf,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,mDAAmD;IACnD,IAAI,KAAK,GAAG,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;YAChD,CAAC;YACD,KAAK,GAAG,OAAgC,CAAA;YACxC,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAA;YAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;QAChD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,MAAM,GAAI,KAAwC,CAAC,MAAM,IAAI,QAAQ,CAAA;IAC3E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,iEAAiE;IACjE,qEAAqE;IACrE,0BAA0B;IAC1B,EAAE;IACF,6DAA6D;IAC7D,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,uCAAuC;IACvC,MAAM,UAAU,GAAG,WAAW,CAAC,cAAc,IAAI,CAAC,CAAA;IAClD,MAAM,SAAS,GACZ,KAAgD,CAAC,cAAc,IAAI,CAAC,CAAA;IACvE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAA;IAChD,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,oCAAoC;IACpC,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAA;IACnC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;AAChC,CAAC"}

package/dist/admin/server/index.d.ts

@@ -1,17 +0,0 @@
-/**
- * @rovela/sdk/admin/server
- *
- * Server-side admin functions.
- * Re-exports from admin-service for cleaner imports.
- */
-export { authenticateAdmin, createAdmin, findAdminForSession, findAdminByEmail, findAdminById, updateAdmin, updateAdminPassword, adminEmailExists, countAdmins, type CreateAdminResult, type AuthenticateAdminResult, type AuthenticateAdminError, } from './admin-service';
-export { requestAdminPasswordReset, validateAdminResetToken, resetAdminPassword, deleteAdminPasswordResetTokens, cleanupExpiredAdminResetTokens, } from './admin-password-reset';
-export { listAdmins, countActiveOwners, deactivateAdmin, reactivateAdmin, hardDeleteAdmin, statusCodeFor, inviteAdmin, resendAdminInvite, cancelAdminInvite, changeAdminRole, } from './user-management';
-export type { Actor, AdminListOptions, UserManagementError, UserManagementResult, InviteAdminRequest, InviteAdminSuccess, InviteAdminResult, ResendInviteSuccess, ResendInviteResult, } from './user-management';
-export { validateInviteToken, acceptAdminInvite, deleteAdminInviteTokens, cleanupExpiredInviteTokens, createInviteToken, INVITE_EXPIRY_HOURS, } from './admin-invite';
-export type { AdminInviteSnapshot, ValidateInviteResult, AcceptInviteResult, } from './admin-invite';
-export { changeOwnPassword, updateOwnProfile, } from './admin-self-service';
-export type { SelfServiceError, ChangeOwnPasswordResult, UpdateOwnProfileResult, } from './admin-self-service';
-export { requireAdmin, getCurrentAdmin, invalidateAdminSession, } from './admin-session';
-export type { RequireAdminOptions, RequireAdminResult, } from './admin-session';
-//# sourceMappingURL=index.d.ts.map

package/dist/admin/server/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/admin/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAEL,iBAAiB,EAEjB,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EAEX,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAA;AAMxB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAM/B,OAAO,EAEL,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,aAAa,EAEb,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,mBAAmB,CAAA;AAE1B,YAAY,EACV,KAAK,EACL,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EAEpB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAA;AAM1B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AAEvB,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AAMvB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAE7B,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EACL,YAAY,EACZ,eAAe,EACf,sBAAsB,GACvB,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iBAAiB,CAAA"}

package/dist/admin/server/index.js

@@ -1,39 +0,0 @@
-/**
- * @rovela/sdk/admin/server
- *
- * Server-side admin functions.
- * Re-exports from admin-service for cleaner imports.
- */
-// =============================================================================
-// Admin Service
-// =============================================================================
-export { 
-// Authentication
-authenticateAdmin, 
-// CRUD
-createAdmin, findAdminForSession, findAdminByEmail, findAdminById, updateAdmin, updateAdminPassword, adminEmailExists, countAdmins, } from './admin-service';
-// =============================================================================
-// Admin Password Reset Service
-// =============================================================================
-export { requestAdminPasswordReset, validateAdminResetToken, resetAdminPassword, deleteAdminPasswordResetTokens, cleanupExpiredAdminResetTokens, } from './admin-password-reset';
-// =============================================================================
-// User Management (Phase 2 + Phase 3)
-// =============================================================================
-export { 
-// Phase 2
-listAdmins, countActiveOwners, deactivateAdmin, reactivateAdmin, hardDeleteAdmin, statusCodeFor, 
-// Phase 3
-inviteAdmin, resendAdminInvite, cancelAdminInvite, changeAdminRole, } from './user-management';
-// =============================================================================
-// Admin Invite Token Service (Phase 3)
-// =============================================================================
-export { validateInviteToken, acceptAdminInvite, deleteAdminInviteTokens, cleanupExpiredInviteTokens, createInviteToken, INVITE_EXPIRY_HOURS, } from './admin-invite';
-// =============================================================================
-// Self-Service (Phase 4)
-// =============================================================================
-export { changeOwnPassword, updateOwnProfile, } from './admin-self-service';
-// =============================================================================
-// Admin Session Guard (centralized auth for custom template routes)
-// =============================================================================
-export { requireAdmin, getCurrentAdmin, invalidateAdminSession, } from './admin-session';
-//# sourceMappingURL=index.js.map

package/dist/admin/server/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/admin/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,OAAO;AACL,iBAAiB;AACjB,iBAAiB;AACjB,OAAO;AACP,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,GAKZ,MAAM,iBAAiB,CAAA;AAExB,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,wBAAwB,CAAA;AAE/B,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAEhF,OAAO;AACL,UAAU;AACV,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,aAAa;AACb,UAAU;AACV,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,mBAAmB,CAAA;AAe1B,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AAQvB,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAQ7B,gFAAgF;AAChF,oEAAoE;AACpE,gFAAgF;AAEhF,OAAO,EACL,YAAY,EACZ,eAAe,EACf,sBAAsB,GACvB,MAAM,iBAAiB,CAAA"}