@rovela-ai/sdk 0.4.1 → 0.4.2

package/dist/admin/api/accept-invite.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @rovela/sdk/admin/api/accept-invite
+ *
+ * Public API routes for the admin invite acceptance flow.
+ *
+ * Two methods on the same route:
+ *   - GET ?token=X — non-destructive validation; returns invitee snippet
+ *                    (email, name, role) so the UI can render context
+ *   - POST { token, password } — consume the token, set password, activate
+ *
+ * **Unauthenticated** — the token IS the auth. Anyone holding a valid
+ * invite token can accept the invite. No `requireAdmin` guard; the
+ * service layer enforces all the real invariants (token validity,
+ * expiry, admin status, password strength).
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/accept-invite/route.ts
+ * export { GET, POST } from '@rovela-ai/sdk/admin/api/accept-invite'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import type { AdminApiError } from '../types';
+import type { AdminRole } from '../../core/types';
+export declare const runtime = "nodejs";
+interface ValidateInviteResponse {
+    valid: boolean;
+    error?: string;
+    admin?: {
+        email: string;
+        name: string;
+        role: AdminRole;
+    };
+}
+interface AcceptInviteResponse {
+    success: boolean;
+    message: string;
+}
+/**
+ * GET /api/admin/accept-invite?token=X
+ *
+ * Used by the accept-invite page on mount to decide whether to render
+ * the password form or an "invalid/expired link" error. Returns the
+ * invitee's email, name, and role so the UI can personalize the form
+ * ("Welcome, Jane — you've been invited as Administrator").
+ *
+ * Does NOT consume the token.
+ */
+export declare function GET(request: Request): Promise<NextResponse<ValidateInviteResponse>>;
+/**
+ * POST /api/admin/accept-invite
+ *
+ * Body: `{ "token": "...", "password": "..." }`
+ *
+ * Consumes the invite token, hashes and stores the new password, flips
+ * the admin's status from `invited` to `active`, and deletes all invite
+ * + password reset tokens for the admin so they can't be reused.
+ *
+ * After this succeeds, the invitee should be redirected to /admin/login
+ * where they sign in with their new credentials. No session is issued
+ * here — accept-invite is a one-shot flow.
+ */
+export declare function POST(request: Request): Promise<NextResponse<AcceptInviteResponse | AdminApiError>>;
+export {};
+//# sourceMappingURL=accept-invite.d.ts.map

package/dist/admin/api/accept-invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accept-invite.d.ts","sourceRoot":"","sources":["../../../src/admin/api/accept-invite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAK1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,OAAO,WAAW,CAAA;AAM/B,UAAU,sBAAsB;IAC9B,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,SAAS,CAAA;KAChB,CAAA;CACF;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAMD;;;;;;;;;GASG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAyC/C;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,IAAI,CACxB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,CAAC,oBAAoB,GAAG,aAAa,CAAC,CAAC,CAmD7D"}

package/dist/admin/api/accept-invite.js

@@ -0,0 +1,115 @@
+/**
+ * @rovela/sdk/admin/api/accept-invite
+ *
+ * Public API routes for the admin invite acceptance flow.
+ *
+ * Two methods on the same route:
+ *   - GET ?token=X — non-destructive validation; returns invitee snippet
+ *                    (email, name, role) so the UI can render context
+ *   - POST { token, password } — consume the token, set password, activate
+ *
+ * **Unauthenticated** — the token IS the auth. Anyone holding a valid
+ * invite token can accept the invite. No `requireAdmin` guard; the
+ * service layer enforces all the real invariants (token validity,
+ * expiry, admin status, password strength).
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/accept-invite/route.ts
+ * export { GET, POST } from '@rovela-ai/sdk/admin/api/accept-invite'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { validateInviteToken, acceptAdminInvite, } from '../server/admin-invite';
+export const runtime = 'nodejs';
+// =============================================================================
+// GET — validate token (non-destructive)
+// =============================================================================
+/**
+ * GET /api/admin/accept-invite?token=X
+ *
+ * Used by the accept-invite page on mount to decide whether to render
+ * the password form or an "invalid/expired link" error. Returns the
+ * invitee's email, name, and role so the UI can personalize the form
+ * ("Welcome, Jane — you've been invited as Administrator").
+ *
+ * Does NOT consume the token.
+ */
+export async function GET(request) {
+    try {
+        const { searchParams } = new URL(request.url);
+        const token = searchParams.get('token');
+        if (!token) {
+            return NextResponse.json({ valid: false, error: 'Invite token is required.' }, { status: 400 });
+        }
+        const result = await validateInviteToken(token);
+        if (!result.valid) {
+            return NextResponse.json({ valid: false, error: result.error }, { status: 400 });
+        }
+        // Return a SAFE snippet of the invitee — just enough for the form
+        // to render ("Hi {name}, you're invited as {role}"). The full admin
+        // row is never returned to an unauthenticated caller.
+        return NextResponse.json({
+            valid: true,
+            admin: result.admin
+                ? {
+                    email: result.admin.email,
+                    name: result.admin.name,
+                    role: result.admin.role,
+                }
+                : undefined,
+        });
+    }
+    catch (error) {
+        console.error('[Admin Accept Invite] Validation error:', error);
+        return NextResponse.json({ valid: false, error: 'Failed to validate invite. Please try again.' }, { status: 500 });
+    }
+}
+// =============================================================================
+// POST — consume token, activate admin
+// =============================================================================
+/**
+ * POST /api/admin/accept-invite
+ *
+ * Body: `{ "token": "...", "password": "..." }`
+ *
+ * Consumes the invite token, hashes and stores the new password, flips
+ * the admin's status from `invited` to `active`, and deletes all invite
+ * + password reset tokens for the admin so they can't be reused.
+ *
+ * After this succeeds, the invitee should be redirected to /admin/login
+ * where they sign in with their new credentials. No session is issued
+ * here — accept-invite is a one-shot flow.
+ */
+export async function POST(request) {
+    try {
+        const body = (await request.json().catch(() => null));
+        const token = typeof body?.token === 'string' ? body.token : '';
+        const password = typeof body?.password === 'string' ? body.password : '';
+        if (!token) {
+            return NextResponse.json({ error: 'Invite token is required.', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        if (!password) {
+            return NextResponse.json({ error: 'Password is required.', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        const result = await acceptAdminInvite(token, password);
+        if (!result.success) {
+            return NextResponse.json({
+                error: result.error || 'Failed to accept invite.',
+                code: 'VALIDATION_ERROR',
+            }, { status: 400 });
+        }
+        return NextResponse.json({
+            success: true,
+            message: 'Invite accepted. You can now sign in to the admin dashboard with your new password.',
+        });
+    }
+    catch (error) {
+        console.error('[Admin Accept Invite] Error:', error);
+        return NextResponse.json({
+            error: 'Failed to accept invite. Please try again.',
+            code: 'INTERNAL_ERROR',
+        }, { status: 500 });
+    }
+}
+//# sourceMappingURL=accept-invite.js.map

package/dist/admin/api/accept-invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accept-invite.js","sourceRoot":"","sources":["../../../src/admin/api/accept-invite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,wBAAwB,CAAA;AAI/B,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAA;AAqB/B,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,EACpD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAE/C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EACrC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,kEAAkE;QAClE,oEAAoE;QACpE,sDAAsD;QACtD,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,MAAM,CAAC,KAAK;gBACjB,CAAC,CAAC;oBACE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;oBACzB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;oBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;iBACxB;gBACH,CAAC,CAAC,SAAS;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAA;QAC/D,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,EACvE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAG5C,CAAA;QAER,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/D,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QAExE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAChE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAEvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,0BAA0B;gBACjD,IAAI,EAAE,kBAAkB;aACzB,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,OAAO,EAAE,IAAI;YACb,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;QACpD,OAAO,YAAY,CAAC,IAAI,CACtB;YACE,KAAK,EAAE,4CAA4C;YACnD,IAAI,EAAE,gBAAgB;SACvB,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/admin/api/categories.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @rovela/sdk/admin/api/categories
+ *
+ * API route handlers for admin category management.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/categories/route.ts
+ * export { GET, POST } from '@rovela/sdk/admin/api/categories'
+ *
+ * // app/api/admin/categories/[id]/route.ts
+ * export { GET as getCategory, PUT, DELETE } from '@rovela/sdk/admin/api/categories'
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { AdminApiError, CrudResult } from '../types';
+/**
+ * GET /api/admin/categories
+ *
+ * List all categories with hierarchy.
+ *
+ * Query Parameters:
+ * - flat: boolean - Return flat list instead of tree (default false)
+ */
+export declare function GET(request: NextRequest): Promise<NextResponse<{
+    data: unknown[];
+} | AdminApiError>>;
+/**
+ * POST /api/admin/categories
+ *
+ * Create a new category.
+ */
+export declare function POST(request: NextRequest): Promise<NextResponse<CrudResult<unknown> | AdminApiError>>;
+/**
+ * GET /api/admin/categories/[id]
+ *
+ * Get a single category by ID.
+ */
+export declare function getCategory(_request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    data: unknown;
+} | AdminApiError>>;
+/**
+ * PUT /api/admin/categories/[id]
+ *
+ * Update a category by ID.
+ */
+export declare function PUT(request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<CrudResult<unknown> | AdminApiError>>;
+/**
+ * DELETE /api/admin/categories/[id]
+ *
+ * Delete a category by ID.
+ */
+export declare function DELETE(_request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    success: boolean;
+} | AdminApiError>>;
+//# sourceMappingURL=categories.d.ts.map

package/dist/admin/api/categories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../../src/admin/api/categories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAUvD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAMzD;;;;;;;GAOG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC;IAAE,IAAI,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CA4B5D;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CACxB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,CA0D5D;AAMD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,WAAW,EACrB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CA0B1D;AAED;;;;GAIG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,WAAW,EACpB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,CAmE5D;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAC1B,QAAQ,EAAE,WAAW,EACrB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAmC7D"}

package/dist/admin/api/categories.js

@@ -0,0 +1,266 @@
+/**
+ * @rovela/sdk/admin/api/categories
+ *
+ * API route handlers for admin category management.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/categories/route.ts
+ * export { GET, POST } from '@rovela/sdk/admin/api/categories'
+ *
+ * // app/api/admin/categories/[id]/route.ts
+ * export { GET as getCategory, PUT, DELETE } from '@rovela/sdk/admin/api/categories'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { requireAdmin } from '../server/admin-session';
+import { findCategories, findCategoryById, createCategory, updateCategory, deleteCategory, } from '../../core/db/queries';
+import { generateSlug } from '../../core/utils';
+// =============================================================================
+// List Categories
+// =============================================================================
+/**
+ * GET /api/admin/categories
+ *
+ * List all categories with hierarchy.
+ *
+ * Query Parameters:
+ * - flat: boolean - Return flat list instead of tree (default false)
+ */
+export async function GET(request) {
+    // Categories are product taxonomy — gated on `products.read`.
+    const guard = await requireAdmin({ permission: 'products.read' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const searchParams = request.nextUrl.searchParams;
+        const flat = searchParams.get('flat') === 'true';
+        const categories = await findCategories();
+        if (flat) {
+            return NextResponse.json({ data: categories });
+        }
+        // Build tree structure
+        const tree = buildCategoryTree(categories);
+        return NextResponse.json({ data: tree });
+    }
+    catch (error) {
+        console.error('[Admin Categories API] GET error:', error);
+        return NextResponse.json({ error: 'Failed to fetch categories', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+/**
+ * POST /api/admin/categories
+ *
+ * Create a new category.
+ */
+export async function POST(request) {
+    // Creating a category is part of editing the product catalog.
+    const guard = await requireAdmin({ permission: 'products.write' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const body = await request.json();
+        // Validate required fields
+        if (!body.name || typeof body.name !== 'string') {
+            return NextResponse.json({ error: 'Category name is required', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        // Generate slug if not provided
+        const slug = body.slug || generateSlug(body.name);
+        // Validate parent exists if provided
+        if (body.parentId) {
+            const parent = await findCategoryById(body.parentId);
+            if (!parent) {
+                return NextResponse.json({ error: 'Parent category not found', code: 'VALIDATION_ERROR' }, { status: 400 });
+            }
+        }
+        const category = await createCategory({
+            name: body.name,
+            slug,
+            description: body.description || null,
+            image: body.image || null,
+            parentId: body.parentId || null,
+            order: body.order || 0,
+        });
+        return NextResponse.json({ success: true, data: category }, { status: 201 });
+    }
+    catch (error) {
+        console.error('[Admin Categories API] POST error:', error);
+        // Handle unique constraint violation
+        if (error?.code === '23505') {
+            return NextResponse.json({ error: 'A category with this slug already exists', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        return NextResponse.json({ error: 'Failed to create category', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+// =============================================================================
+// Single Category Operations
+// =============================================================================
+/**
+ * GET /api/admin/categories/[id]
+ *
+ * Get a single category by ID.
+ */
+export async function getCategory(_request, { params }) {
+    // Reading a single category — taxonomy read.
+    const guard = await requireAdmin({ permission: 'products.read' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const { id } = await params;
+        const category = await findCategoryById(id);
+        if (!category) {
+            return NextResponse.json({ error: 'Category not found', code: 'NOT_FOUND' }, { status: 404 });
+        }
+        return NextResponse.json({ data: category });
+    }
+    catch (error) {
+        console.error('[Admin Categories API] getCategory error:', error);
+        return NextResponse.json({ error: 'Failed to fetch category', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+/**
+ * PUT /api/admin/categories/[id]
+ *
+ * Update a category by ID.
+ */
+export async function PUT(request, { params }) {
+    // Editing a category — taxonomy write.
+    const guard = await requireAdmin({ permission: 'products.write' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const { id } = await params;
+        const body = await request.json();
+        // Check category exists
+        const existing = await findCategoryById(id);
+        if (!existing) {
+            return NextResponse.json({ error: 'Category not found', code: 'NOT_FOUND' }, { status: 404 });
+        }
+        // Validate parent if being changed
+        if (body.parentId !== undefined && body.parentId !== null) {
+            // Prevent setting self as parent
+            if (body.parentId === id) {
+                return NextResponse.json({ error: 'Category cannot be its own parent', code: 'VALIDATION_ERROR' }, { status: 400 });
+            }
+            const parent = await findCategoryById(body.parentId);
+            if (!parent) {
+                return NextResponse.json({ error: 'Parent category not found', code: 'VALIDATION_ERROR' }, { status: 400 });
+            }
+            // Prevent circular reference
+            if (await isDescendant(body.parentId, id)) {
+                return NextResponse.json({ error: 'Cannot set a descendant as parent (circular reference)', code: 'VALIDATION_ERROR' }, { status: 400 });
+            }
+        }
+        // Build update data
+        const updateData = {};
+        if (body.name !== undefined)
+            updateData.name = body.name;
+        if (body.slug !== undefined)
+            updateData.slug = body.slug;
+        if (body.description !== undefined)
+            updateData.description = body.description || null;
+        if (body.image !== undefined)
+            updateData.image = body.image || null;
+        if (body.parentId !== undefined)
+            updateData.parentId = body.parentId || null;
+        if (body.order !== undefined)
+            updateData.order = body.order;
+        const category = await updateCategory(id, updateData);
+        return NextResponse.json({ success: true, data: category });
+    }
+    catch (error) {
+        console.error('[Admin Categories API] PUT error:', error);
+        return NextResponse.json({ error: 'Failed to update category', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+/**
+ * DELETE /api/admin/categories/[id]
+ *
+ * Delete a category by ID.
+ */
+export async function DELETE(_request, { params }) {
+    // Hard-deleting a category — owner/administrator only.
+    const guard = await requireAdmin({ permission: 'products.delete' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const { id } = await params;
+        const deleted = await deleteCategory(id);
+        if (!deleted) {
+            return NextResponse.json({ error: 'Category not found', code: 'NOT_FOUND' }, { status: 404 });
+        }
+        return NextResponse.json({ success: true });
+    }
+    catch (error) {
+        console.error('[Admin Categories API] DELETE error:', error);
+        // Handle foreign key constraint (products still in category)
+        if (error?.code === '23503') {
+            return NextResponse.json({ error: 'Cannot delete category with products. Move or delete products first.', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        return NextResponse.json({ error: 'Failed to delete category', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+/**
+ * Build hierarchical category tree from flat list.
+ */
+function buildCategoryTree(categories) {
+    const categoryMap = new Map();
+    const roots = [];
+    // First pass: create map entries
+    for (const cat of categories) {
+        categoryMap.set(cat.id, {
+            ...cat,
+            children: [],
+        });
+    }
+    // Second pass: build tree
+    for (const cat of categories) {
+        const node = categoryMap.get(cat.id);
+        if (cat.parentId && categoryMap.has(cat.parentId)) {
+            categoryMap.get(cat.parentId).children.push(node);
+        }
+        else {
+            roots.push(node);
+        }
+    }
+    // Sort by order
+    const sortByOrder = (a, b) => a.order - b.order;
+    roots.sort(sortByOrder);
+    for (const node of categoryMap.values()) {
+        node.children.sort(sortByOrder);
+    }
+    return roots;
+}
+/**
+ * Check if candidateId is a descendant of ancestorId.
+ */
+async function isDescendant(candidateId, ancestorId) {
+    const categories = await findCategories();
+    const categoryMap = new Map();
+    for (const cat of categories) {
+        categoryMap.set(cat.id, { parentId: cat.parentId });
+    }
+    let current = candidateId;
+    const visited = new Set();
+    while (current) {
+        if (visited.has(current)) {
+            // Circular reference detected
+            return true;
+        }
+        visited.add(current);
+        const node = categoryMap.get(current);
+        if (!node)
+            break;
+        if (node.parentId === ancestorId) {
+            return true;
+        }
+        current = node.parentId || '';
+    }
+    return false;
+}
+//# sourceMappingURL=categories.js.map

package/dist/admin/api/categories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"categories.js","sourceRoot":"","sources":["../../../src/admin/api/categories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAG/C,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,OAAoB;IAEpB,8DAA8D;IAC9D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAA;QACjD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAA;QAEhD,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAA;QAEzC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAChD,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;QAE1C,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAA;QACzD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,OAAoB;IAEpB,8DAA8D;IAC9D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QAEjC,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAChE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAEjD,qCAAqC;QACrC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAChE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;SACvB,CAAC,CAAA;QAEF,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAA;QAE1D,qCAAqC;QACrC,IAAK,KAA2B,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACnD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,0CAA0C,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAqB,EACrB,EAAE,MAAM,EAAuC;IAE/C,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAA;QAC3B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAA;QAE3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EAClD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAA;QACjE,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,OAAoB,EACpB,EAAE,MAAM,EAAuC;IAE/C,uCAAuC;IACvC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QAEjC,wBAAwB;QACxB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EAClD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC1D,iCAAiC;YACjC,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACzB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,mCAAmC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EACxE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAChE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YAED,6BAA6B;YAC7B,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC1C,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,wDAAwD,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAC7F,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAA4B,EAAE,CAAA;QAE9C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACxD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACxD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAA;QACrF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAA;QACnE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAA;QAC5E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QAE3D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAErD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAA;QACzD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,QAAqB,EACrB,EAAE,MAAM,EAAuC;IAE/C,uDAAuD;IACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAA;QAC3B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAA;QAExC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,EAClD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;QAE5D,6DAA6D;QAC7D,IAAK,KAA2B,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACnD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,sEAAsE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAC3G,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAiBD;;GAEG;AACH,SAAS,iBAAiB,CAAC,UAAqB;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgC,CAAA;IAC3D,MAAM,KAAK,GAA2B,EAAE,CAAA;IAExC,iCAAiC;IACjC,KAAK,MAAM,GAAG,IAAI,UAAoJ,EAAE,CAAC;QACvK,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;YACtB,GAAG,GAAG;YACN,QAAQ,EAAE,EAAE;SACb,CAAC,CAAA;IACJ,CAAC;IAED,0BAA0B;IAC1B,KAAK,MAAM,GAAG,IAAI,UAAuD,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAE,CAAA;QACrC,IAAI,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,MAAM,WAAW,GAAG,CAAC,CAAuB,EAAE,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;IAC3F,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACvB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACjC,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,UAAkB;IACjE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAA;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuC,CAAA;IAElE,KAAK,MAAM,GAAG,IAAI,UAAuD,EAAE,CAAC;QAC1E,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,IAAI,OAAO,GAAG,WAAW,CAAA;IACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IAEjC,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,8BAA8B;YAC9B,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAEpB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI;YAAE,MAAK;QAEhB,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAA;IAC/B,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/admin/api/check.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @rovela/sdk/admin/api/check
+ *
+ * Admin check API route handler.
+ * Returns whether any admin exists and the store owner email for pre-filling.
+ */
+import { NextResponse } from 'next/server';
+/**
+ * Response for admin check
+ */
+interface AdminCheckResponse {
+    hasAdmin: boolean;
+    ownerEmail: string;
+}
+/**
+ * GET handler to check if any admin exists.
+ *
+ * This is used by the login page to determine whether to show
+ * the setup form or the login form.
+ *
+ * @example
+ * ```typescript
+ * // app/api/admin/check/route.ts
+ * export { GET } from '@rovela-ai/sdk/admin/api/check'
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Response
+ * {
+ *   "hasAdmin": false,
+ *   "ownerEmail": "owner@store.com"
+ * }
+ * ```
+ */
+export declare function GET(): Promise<NextResponse<AdminCheckResponse>>;
+export {};
+//# sourceMappingURL=check.d.ts.map

package/dist/admin/api/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/admin/api/check.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C;;GAEG;AACH,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,OAAO,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,GAAG,IAAI,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAmBrE"}

package/dist/admin/api/check.js

@@ -0,0 +1,49 @@
+/**
+ * @rovela/sdk/admin/api/check
+ *
+ * Admin check API route handler.
+ * Returns whether any admin exists and the store owner email for pre-filling.
+ */
+import { NextResponse } from 'next/server';
+import { countAdmins } from '../server/admin-service';
+/**
+ * GET handler to check if any admin exists.
+ *
+ * This is used by the login page to determine whether to show
+ * the setup form or the login form.
+ *
+ * @example
+ * ```typescript
+ * // app/api/admin/check/route.ts
+ * export { GET } from '@rovela-ai/sdk/admin/api/check'
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Response
+ * {
+ *   "hasAdmin": false,
+ *   "ownerEmail": "owner@store.com"
+ * }
+ * ```
+ */
+export async function GET() {
+    try {
+        const adminCount = await countAdmins();
+        const ownerEmail = process.env.STORE_OWNER_EMAIL || '';
+        return NextResponse.json({
+            hasAdmin: adminCount > 0,
+            ownerEmail,
+        });
+    }
+    catch (error) {
+        console.error('[Admin Check] Error:', error);
+        // On error, assume no admin exists to allow setup
+        // This is safer than blocking setup due to a DB error
+        return NextResponse.json({
+            hasAdmin: false,
+            ownerEmail: process.env.STORE_OWNER_EMAIL || '',
+        });
+    }
+}
+//# sourceMappingURL=check.js.map

package/dist/admin/api/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/admin/api/check.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAUrD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG;IACvB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,WAAW,EAAE,CAAA;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAA;QAEtD,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,QAAQ,EAAE,UAAU,GAAG,CAAC;YACxB,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAA;QAE5C,kDAAkD;QAClD,sDAAsD;QACtD,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}