@rovela-ai/sdk 0.4.1 → 0.4.2

package/dist/admin/api/tax-zones.js

@@ -0,0 +1,265 @@
+/**
+ * @rovela/sdk/admin/api/tax-zones
+ *
+ * API route handlers for admin tax zone management.
+ * Tax zones define tax rates by country/state for zone-based tax calculation.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/tax-zones/route.ts
+ * export { getTaxZones as GET, createTaxZone as POST } from '@rovela/sdk/admin/api'
+ *
+ * // app/api/admin/tax-zones/[id]/route.ts
+ * export { getTaxZone as GET, updateTaxZone as PUT, deleteTaxZone as DELETE } from '@rovela/sdk/admin/api'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { requireAdmin } from '../server/admin-session';
+import { findTaxZones, findTaxZoneById, createTaxZone as createTaxZoneQuery, updateTaxZone as updateTaxZoneQuery, deleteTaxZone as deleteTaxZoneQuery, } from '../../core/db/queries';
+// =============================================================================
+// Tax Zones - List & Create
+// =============================================================================
+/**
+ * GET /api/admin/tax-zones
+ *
+ * List all tax zones ordered by priority (sortOrder ascending).
+ * Returns zones with their country/state coverage and tax rates.
+ */
+export async function getTaxZones() {
+    // Tax zones are store configuration — read permission.
+    const guard = await requireAdmin({ permission: 'settings.read' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const zones = await findTaxZones();
+        return NextResponse.json({ data: zones });
+    }
+    catch (error) {
+        console.error('[Tax Zones API] GET error:', error);
+        return NextResponse.json({ error: 'Failed to fetch tax zones', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+/**
+ * POST /api/admin/tax-zones
+ *
+ * Create a new tax zone.
+ *
+ * Request Body:
+ * ```json
+ * {
+ *   "name": "US - California",
+ *   "countries": ["US"],
+ *   "states": ["CA"],
+ *   "taxRate": 8.25,
+ *   "isActive": true,
+ *   "sortOrder": 0
+ * }
+ * ```
+ *
+ * Notes:
+ * - `countries` is an array of ISO-2 country codes or ['*'] for wildcard
+ * - `states` is optional, only used when countries includes 'US'
+ * - `sortOrder` determines priority (lower = checked first during matching)
+ */
+export async function createTaxZone(request) {
+    // Creating a tax zone is a settings write.
+    const guard = await requireAdmin({ permission: 'settings.write' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const body = await request.json();
+        // Validate required fields
+        if (!body.name || typeof body.name !== 'string') {
+            return NextResponse.json({ error: 'Name is required', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        if (!Array.isArray(body.countries) || body.countries.length === 0) {
+            return NextResponse.json({ error: 'Countries array is required and must not be empty', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        if (typeof body.taxRate !== 'number' || body.taxRate < 0 || body.taxRate > 100) {
+            return NextResponse.json({ error: 'Tax rate must be a number between 0 and 100', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        // Normalize country codes to uppercase
+        const countries = body.countries.map((c) => c.toUpperCase().trim());
+        // Normalize state codes if provided
+        const states = Array.isArray(body.states)
+            ? body.states.map((s) => s.toUpperCase().trim()).filter((s) => s.length > 0)
+            : [];
+        const zone = await createTaxZoneQuery({
+            name: body.name.trim().slice(0, 100),
+            countries,
+            states,
+            taxRate: body.taxRate,
+            isActive: body.isActive !== false, // Default true
+            sortOrder: typeof body.sortOrder === 'number' ? body.sortOrder : 0,
+        });
+        // Convert to TaxZoneData format
+        const zoneData = {
+            id: zone.id,
+            name: zone.name,
+            countries: zone.countries || [],
+            states: zone.states || [],
+            taxRate: parseFloat(String(zone.taxRate)),
+            isActive: zone.isActive,
+            sortOrder: zone.sortOrder,
+            createdAt: zone.createdAt,
+            updatedAt: zone.updatedAt,
+        };
+        return NextResponse.json({ success: true, data: zoneData }, { status: 201 });
+    }
+    catch (error) {
+        console.error('[Tax Zones API] POST error:', error);
+        return NextResponse.json({ error: 'Failed to create tax zone', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+// =============================================================================
+// Tax Zones - Get, Update, Delete by ID
+// =============================================================================
+/**
+ * GET /api/admin/tax-zones/[id]
+ *
+ * Get a single tax zone by ID.
+ */
+export async function getTaxZone(_request, { params }) {
+    // Single tax zone detail — settings read.
+    const guard = await requireAdmin({ permission: 'settings.read' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const { id } = await params;
+        if (!id) {
+            return NextResponse.json({ error: 'Zone ID is required', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        const zone = await findTaxZoneById(id);
+        if (!zone) {
+            return NextResponse.json({ error: 'Tax zone not found', code: 'NOT_FOUND' }, { status: 404 });
+        }
+        return NextResponse.json({ data: zone });
+    }
+    catch (error) {
+        console.error('[Tax Zones API] GET by ID error:', error);
+        return NextResponse.json({ error: 'Failed to fetch tax zone', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+/**
+ * PUT /api/admin/tax-zones/[id]
+ *
+ * Update a tax zone by ID.
+ *
+ * Request Body (all fields optional):
+ * ```json
+ * {
+ *   "name": "US - California (Updated)",
+ *   "countries": ["US"],
+ *   "states": ["CA", "NV"],
+ *   "taxRate": 8.5,
+ *   "isActive": true,
+ *   "sortOrder": 1
+ * }
+ * ```
+ */
+export async function updateTaxZone(request, { params }) {
+    // Updating a tax zone is a settings write.
+    const guard = await requireAdmin({ permission: 'settings.write' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const { id } = await params;
+        const body = await request.json();
+        if (!id) {
+            return NextResponse.json({ error: 'Zone ID is required', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        // Check if zone exists
+        const existing = await findTaxZoneById(id);
+        if (!existing) {
+            return NextResponse.json({ error: 'Tax zone not found', code: 'NOT_FOUND' }, { status: 404 });
+        }
+        // Build update data
+        const updateData = {};
+        if (typeof body.name === 'string') {
+            updateData.name = body.name.trim().slice(0, 100);
+        }
+        if (Array.isArray(body.countries)) {
+            if (body.countries.length === 0) {
+                return NextResponse.json({ error: 'Countries array must not be empty', code: 'VALIDATION_ERROR' }, { status: 400 });
+            }
+            updateData.countries = body.countries.map((c) => c.toUpperCase().trim());
+        }
+        if (Array.isArray(body.states)) {
+            updateData.states = body.states.map((s) => s.toUpperCase().trim()).filter((s) => s.length > 0);
+        }
+        if (typeof body.taxRate === 'number') {
+            if (body.taxRate < 0 || body.taxRate > 100) {
+                return NextResponse.json({ error: 'Tax rate must be between 0 and 100', code: 'VALIDATION_ERROR' }, { status: 400 });
+            }
+            updateData.taxRate = body.taxRate;
+        }
+        if (typeof body.isActive === 'boolean') {
+            updateData.isActive = body.isActive;
+        }
+        if (typeof body.sortOrder === 'number') {
+            updateData.sortOrder = body.sortOrder;
+        }
+        // Check if there's anything to update
+        if (Object.keys(updateData).length === 0) {
+            return NextResponse.json({ error: 'No valid fields to update', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        const zone = await updateTaxZoneQuery(id, updateData);
+        if (!zone) {
+            return NextResponse.json({ error: 'Failed to update tax zone', code: 'INTERNAL_ERROR' }, { status: 500 });
+        }
+        // Convert to TaxZoneData format
+        const zoneData = {
+            id: zone.id,
+            name: zone.name,
+            countries: zone.countries || [],
+            states: zone.states || [],
+            taxRate: parseFloat(String(zone.taxRate)),
+            isActive: zone.isActive,
+            sortOrder: zone.sortOrder,
+            createdAt: zone.createdAt,
+            updatedAt: zone.updatedAt,
+        };
+        return NextResponse.json({ success: true, data: zoneData });
+    }
+    catch (error) {
+        console.error('[Tax Zones API] PUT error:', error);
+        return NextResponse.json({ error: 'Failed to update tax zone', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+/**
+ * DELETE /api/admin/tax-zones/[id]
+ *
+ * Delete a tax zone by ID.
+ */
+export async function deleteTaxZone(_request, { params }) {
+    // Deleting a tax zone is a settings write.
+    const guard = await requireAdmin({ permission: 'settings.write' });
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const { id } = await params;
+        if (!id) {
+            return NextResponse.json({ error: 'Zone ID is required', code: 'VALIDATION_ERROR' }, { status: 400 });
+        }
+        // Check if zone exists
+        const existing = await findTaxZoneById(id);
+        if (!existing) {
+            return NextResponse.json({ error: 'Tax zone not found', code: 'NOT_FOUND' }, { status: 404 });
+        }
+        const deleted = await deleteTaxZoneQuery(id);
+        if (!deleted) {
+            return NextResponse.json({ error: 'Failed to delete tax zone', code: 'INTERNAL_ERROR' }, { status: 500 });
+        }
+        return NextResponse.json({ success: true });
+    }
+    catch (error) {
+        console.error('[Tax Zones API] DELETE error:', error);
+        return NextResponse.json({ error: 'Failed to delete tax zone', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+//# sourceMappingURL=tax-zones.js.map

package/dist/admin/api/tax-zones.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tax-zones.js","sourceRoot":"","sources":["../../../src/admin/api/tax-zones.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,aAAa,IAAI,kBAAkB,EACnC,aAAa,IAAI,kBAAkB,EACnC,aAAa,IAAI,kBAAkB,GACpC,MAAM,uBAAuB,CAAA;AAI9B,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,uDAAuD;IACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;QAClC,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAA;QAClD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAmB,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAoB;IAEpB,2CAA2C;IAC3C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QAEjC,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EACxE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,mDAAmD,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EACzG,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YAC/E,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,6CAA6C,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EACnG,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;QAE3E,oCAAoC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5F,CAAC,CAAC,EAAE,CAAA;QAEN,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACpC,SAAS;YACT,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,eAAe;YAClD,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACnE,CAAC,CAAA;QAEF,gCAAgC;QAChC,MAAM,QAAQ,GAAgB;YAC5B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAA;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAmB,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,wCAAwC;AACxC,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAqB,EACrB,EAAE,MAAM,EAAuC;IAE/C,0CAA0C;IAC1C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAA;QAE3B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EAC3E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAA;QAEtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAmB,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAA;QACxD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,gBAAgB,EAAmB,EAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAoB,EACpB,EAAE,MAAM,EAAuC;IAE/C,2CAA2C;IAC3C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QAEjC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EAC3E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAmB,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAA4B,EAAE,CAAA;QAE9C,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,mCAAmC,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EACzF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;QAClF,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAChH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;gBAC3C,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oCAAoC,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EAC1F,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QACnC,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QACrC,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QACvC,CAAC;QAED,sCAAsC;QACtC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EACjF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,UAOzC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAmB,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,QAAQ,GAAgB;YAC5B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAA;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAA;QAClD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAmB,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAqB,EACrB,EAAE,MAAM,EAAuC;IAE/C,2CAA2C;IAC3C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAA;QAE3B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,EAAmB,EAC3E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAmB,EACnE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;QAE5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAmB,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAA;QACrD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAmB,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/admin/api/users.d.ts

@@ -0,0 +1,142 @@
+/**
+ * @rovela/sdk/admin/api/users
+ *
+ * API route handlers for admin user management.
+ *
+ * Routes exposed:
+ *   GET    /api/admin/users          — list all admins (owner + administrator)
+ *   GET    /api/admin/users/[id]     — detail
+ *   PATCH  /api/admin/users/[id]     — action-based: { action: "deactivate" | "reactivate" }
+ *   DELETE /api/admin/users/[id]     — hard delete (owner only, prior deactivation required)
+ *
+ * All business logic lives in `admin/server/user-management.ts`. These
+ * handlers only: parse input, gate on `requireAdmin({ permission })`, call
+ * the service, serialize the response, and map error codes to HTTP status.
+ *
+ * Phase 3 will add `{ action: "change_role", role: "manager" }` to PATCH
+ * and a POST route for invites. No structural changes needed for Phase 3 —
+ * the discriminated action pattern extends naturally.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/users/route.ts
+ * export { GET } from '@rovela-ai/sdk/admin/api/users'
+ *
+ * // app/api/admin/users/[id]/route.ts
+ * export { getUser as GET, PATCH, DELETE } from '@rovela-ai/sdk/admin/api/users'
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { AdminRole } from '../../core/types';
+import type { AdminApiError, PaginatedResponse } from '../types';
+export declare const runtime = "nodejs";
+/**
+ * Safe projection of a store admin — strips `passwordHash` and normalizes
+ * dates to ISO strings for JSON serialization.
+ */
+export interface AdminListItem {
+    id: string;
+    email: string;
+    name: string;
+    role: AdminRole;
+    status: 'active' | 'invited' | 'deactivated';
+    createdBy: string | null;
+    createdAt: string;
+    lastLoginAt: string | null;
+    deactivatedAt: string | null;
+    deactivatedBy: string | null;
+}
+/**
+ * GET /api/admin/users
+ *
+ * Query parameters:
+ *   search  — ilike substring match against email OR name
+ *   status  — 'all' | 'active' | 'invited' | 'deactivated' (default: 'all')
+ *   role    — 'all' | 'owner' | 'administrator' | 'manager' | 'user' (default: 'all')
+ *   page    — 1-indexed page number (default: 1)
+ *   limit   — page size, max 100 (default: 20)
+ *
+ * Response: PaginatedResponse<AdminListItem>
+ *
+ * Requires: `users.read` (owner + administrator).
+ */
+export declare function GET(request: NextRequest): Promise<NextResponse<PaginatedResponse<AdminListItem> | AdminApiError>>;
+/**
+ * GET /api/admin/users/[id]
+ *
+ * Requires: `users.read`.
+ */
+export declare function getUser(_request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    data: AdminListItem;
+} | AdminApiError>>;
+/**
+ * POST /api/admin/users
+ *
+ * Body: `{ email, name, role }`
+ *
+ * Creates an admin row in `invited` status, issues a 72h invite token,
+ * and sends the invite email. Returns the invite URL in the response so
+ * the caller can show a "copy link manually" fallback if email delivery
+ * is unreliable.
+ *
+ * Requires: `users.write` (owner + administrator). The service layer
+ * additionally enforces `canManageUser({role})` — administrators can only
+ * invite managers and users.
+ */
+export declare function POST(request: NextRequest): Promise<NextResponse<{
+    success: boolean;
+    adminId: string;
+    inviteUrl: string;
+    message: string;
+} | AdminApiError>>;
+/**
+ * PATCH /api/admin/users/[id]
+ *
+ * Body:
+ *   { "action": "deactivate" }                              — Phase 2
+ *   { "action": "reactivate" }                              — Phase 2
+ *   { "action": "change_role", "role": "manager" }          — Phase 3
+ *   { "action": "resend_invite" }                           — Phase 3
+ *   { "action": "cancel_invite" }                           — Phase 3
+ *
+ * The action discriminator keeps the contract explicit: each action has
+ * its own invariants enforced by the service layer. Every action other
+ * than `resend_invite` returns `{success: true}` on success.
+ * `resend_invite` additionally returns the new inviteUrl so the UI can
+ * display a copy-link fallback, matching the POST (invite) shape.
+ *
+ * Requires: `users.write` (owner + administrator). The service layer
+ * additionally enforces `canManageUser` — administrators cannot touch
+ * owners or other administrators.
+ */
+export declare function PATCH(request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    success: boolean;
+    inviteUrl?: string;
+} | AdminApiError>>;
+/**
+ * DELETE /api/admin/users/[id]
+ *
+ * Permanently removes the admin row + cascaded tokens. Requires:
+ *   - `users.delete` permission (owner only — enforced by the permission matrix)
+ *   - Target must already be in 'deactivated' status
+ *   - Target cannot be the actor themselves
+ *
+ * The service layer re-checks all invariants. Safe to call from any future
+ * caller (CLI, scripts) as long as they pass a proper actor.
+ */
+export declare function DELETE(_request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    success: boolean;
+} | AdminApiError>>;
+//# sourceMappingURL=users.d.ts.map

package/dist/admin/api/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/admin/api/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAgBvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAGhE,eAAO,MAAM,OAAO,WAAW,CAAA;AAM/B;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,CAAA;IACf,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAA;IAC5C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAgCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC,CAAC,CAyCzE;AAMD;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,QAAQ,EAAE,WAAW,EACrB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAyBhE;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,IAAI,CACxB,OAAO,EAAE,WAAW,GACnB,OAAO,CACR,YAAY,CACR;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzE,aAAa,CAChB,CACF,CA2DA;AAaD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,WAAW,EACpB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CACR,YAAY,CACR;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,aAAa,CAChB,CACF,CAiGA;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,MAAM,CAC1B,QAAQ,EAAE,WAAW,EACrB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CA6B7D"}