@rovela-ai/sdk 0.4.1 → 0.4.2

package/dist/admin/api/index.js

@@ -0,0 +1,128 @@
+/**
+ * @rovela/sdk/admin/api
+ *
+ * Admin API route handlers for Next.js App Router.
+ *
+ * These handlers can be re-exported directly in your route files:
+ *
+ * ```typescript
+ * // app/api/admin-auth/[...nextauth]/route.ts
+ * import NextAuth from 'next-auth'
+ * import { createAdminAuthOptions } from '@rovela-ai/sdk/admin'
+ * const handler = NextAuth(createAdminAuthOptions())
+ * export { handler as GET, handler as POST }
+ *
+ * // app/api/admin/products/route.ts
+ * export { GET, POST } from '@rovela/sdk/admin/api/products'
+ *
+ * // app/api/admin/products/[id]/route.ts
+ * export { getProduct as GET, PUT, DELETE } from '@rovela/sdk/admin/api/products'
+ *
+ * // app/api/admin/products/[id]/variants/route.ts
+ * export { addVariant as POST } from '@rovela/sdk/admin/api/products'
+ *
+ * // app/api/admin/products/variants/[variantId]/route.ts
+ * export { updateVariantHandler as PUT, deleteVariantHandler as DELETE } from '@rovela/sdk/admin/api/products'
+ *
+ * // app/api/admin/orders/route.ts
+ * export { GET } from '@rovela/sdk/admin/api/orders'
+ *
+ * // app/api/admin/orders/[id]/route.ts
+ * export { getOrder as GET, PUT } from '@rovela/sdk/admin/api/orders'
+ *
+ * // app/api/admin/orders/[id]/refund/route.ts
+ * export { POST } from '@rovela/sdk/admin/api/refund'
+ *
+ * // app/api/admin/categories/route.ts
+ * export { GET, POST } from '@rovela/sdk/admin/api/categories'
+ *
+ * // app/api/admin/categories/[id]/route.ts
+ * export { getCategory as GET, PUT, DELETE } from '@rovela/sdk/admin/api/categories'
+ *
+ * // app/api/admin/customers/route.ts
+ * export { GET } from '@rovela/sdk/admin/api/customers'
+ *
+ * // app/api/admin/customers/[id]/route.ts
+ * export { getCustomer as GET, updateCustomer as PUT, deleteCustomer as DELETE } from '@rovela/sdk/admin/api/customers'
+ *
+ * // app/api/admin/stats/route.ts
+ * export { GET } from '@rovela/sdk/admin/api/stats'
+ *
+ * // app/api/admin/setup/route.ts (first-time admin creation)
+ * export { POST } from '@rovela/sdk/admin/api/setup'
+ *
+ * // app/api/admin/check/route.ts (check if admin exists)
+ * export { GET } from '@rovela/sdk/admin/api/check'
+ *
+ * // app/api/admin/settings/route.ts (store settings)
+ * export { GET, PUT } from '@rovela/sdk/admin/api/settings'
+ *
+ * // app/api/admin/stripe-status/route.ts (Stripe connection & tax status)
+ * export { getStripeStatus as GET } from '@rovela/sdk/admin/api'
+ *
+ * // app/api/admin/shipping/zones/route.ts
+ * export { getZones as GET, createZone as POST } from '@rovela/sdk/admin/api/shipping'
+ *
+ * // app/api/admin/shipping/zones/[id]/route.ts
+ * export { getZone as GET, updateZone as PUT, deleteZone as DELETE } from '@rovela/sdk/admin/api/shipping'
+ *
+ * // app/api/admin/shipping/rates/route.ts
+ * export { createRate as POST } from '@rovela/sdk/admin/api/shipping'
+ *
+ * // app/api/admin/shipping/rates/[id]/route.ts
+ * export { updateRate as PUT, deleteRate as DELETE } from '@rovela/sdk/admin/api/shipping'
+ *
+ * // app/api/admin/tax-zones/route.ts
+ * export { getTaxZones as GET, createTaxZone as POST } from '@rovela/sdk/admin/api'
+ *
+ * // app/api/admin/tax-zones/[id]/route.ts
+ * export { getTaxZone as GET, updateTaxZone as PUT, deleteTaxZone as DELETE } from '@rovela/sdk/admin/api'
+ *
+ * // app/api/admin/linked-customer/route.ts (R112: admin ↔ customer role switcher)
+ * export { GET } from '@rovela-ai/sdk/admin/api/linked-customer'
+ * ```
+ */
+// Products
+export { GET as getProducts, POST as createProduct, getProduct, PUT as updateProduct, DELETE as deleteProduct, addVariant, updateVariantHandler, deleteVariantHandler, } from './products';
+// Products — bulk actions (activate / archive / delete) for the list page
+export { POST as bulkProducts } from './products-bulk';
+// Products — aggregate metrics (active count, out-of-stock count, best seller)
+export { GET as getProductMetrics } from './products-stats';
+// Setup guide — orchestrator for the new-store onboarding card on /admin
+export { GET as getSetupGuide, POST as markSetupTask, } from './setup-guide';
+// Orders
+export { GET as getOrders, getOrder, PUT as updateOrder, getShippoRatesForOrder, shipWithShippo, } from './orders';
+// Refund
+export { POST as processRefund } from './refund';
+// Return (approve/reject return requests)
+export { APPROVE_POST as approveReturn, REJECT_POST as rejectReturn } from './return';
+// Stats
+export { GET as getStats } from './stats';
+// Categories
+export { GET as getCategories, POST as createCategory, getCategory, PUT as updateCategory, DELETE as deleteCategory, } from './categories';
+// Customers
+export { GET as getCustomers, getCustomer, updateCustomer, deleteCustomer, } from './customers';
+// Setup (first-time admin creation)
+export { POST as setupAdmin } from './setup';
+// Check (check if admin exists)
+export { GET as checkAdminExists } from './check';
+// Password reset (forgot + reset flow)
+export { POST as adminForgotPassword } from './forgot-password';
+export { GET as validateAdminResetTokenHandler, POST as adminResetPassword, } from './reset-password';
+// User management (list, invite, detail, lifecycle actions, hard delete)
+export { GET as getUsers, POST as inviteUser, getUser, PATCH as updateUser, DELETE as deleteUser, } from './users';
+// Accept invite (Phase 3) — unauthenticated, public routes
+export { GET as validateAdminInviteHandler, POST as acceptAdminInviteHandler, } from './accept-invite';
+// Self-service (Phase 4)
+export { GET as getMe, PATCH as updateMe, PATCH_PASSWORD as updateMyPassword, } from './me';
+// Settings
+export { GET as getSettings, PUT as updateSettings } from './settings';
+// Stripe Status
+export { GET as getStripeStatus } from './stripe-status';
+// Shipping Carriers
+export { getCarriers as getShippingCarriers, createCarrier as createShippingCarrier, getCarrier as getShippingCarrier, updateCarrier as updateShippingCarrier, deleteCarrier as deleteShippingCarrier, } from './shipping';
+// Shipping Zones & Rates
+export { getZones as getShippingZones, createZone as createShippingZone, getZone as getShippingZone, updateZone as updateShippingZone, deleteZone as deleteShippingZone, createRate as createShippingRate, updateRate as updateShippingRate, deleteRate as deleteShippingRate, validateShippoApiKey, saveShippoApiKey, deleteShippoApiKey, } from './shipping';
+// Tax Zones
+export { getTaxZones, createTaxZone, getTaxZone, updateTaxZone, deleteTaxZone, } from './tax-zones';
+//# sourceMappingURL=index.js.map

package/dist/admin/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/admin/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AAEH,WAAW;AACX,OAAO,EACL,GAAG,IAAI,WAAW,EAClB,IAAI,IAAI,aAAa,EACrB,UAAU,EACV,GAAG,IAAI,aAAa,EACpB,MAAM,IAAI,aAAa,EACvB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAEnB,0EAA0E;AAC1E,OAAO,EAAE,IAAI,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEtD,+EAA+E;AAC/E,OAAO,EAAE,GAAG,IAAI,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,yEAAyE;AACzE,OAAO,EACL,GAAG,IAAI,aAAa,EACpB,IAAI,IAAI,aAAa,GACtB,MAAM,eAAe,CAAA;AAGtB,SAAS;AACT,OAAO,EACL,GAAG,IAAI,SAAS,EAChB,QAAQ,EACR,GAAG,IAAI,WAAW,EAClB,sBAAsB,EACtB,cAAc,GACf,MAAM,UAAU,CAAA;AAEjB,SAAS;AACT,OAAO,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,UAAU,CAAA;AAEhD,0CAA0C;AAC1C,OAAO,EAAE,YAAY,IAAI,aAAa,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,UAAU,CAAA;AAErF,QAAQ;AACR,OAAO,EAAE,GAAG,IAAI,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEzC,aAAa;AACb,OAAO,EACL,GAAG,IAAI,aAAa,EACpB,IAAI,IAAI,cAAc,EACtB,WAAW,EACX,GAAG,IAAI,cAAc,EACrB,MAAM,IAAI,cAAc,GACzB,MAAM,cAAc,CAAA;AAErB,YAAY;AACZ,OAAO,EACL,GAAG,IAAI,YAAY,EACnB,WAAW,EACX,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,oCAAoC;AACpC,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,SAAS,CAAA;AAE5C,gCAAgC;AAChC,OAAO,EAAE,GAAG,IAAI,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAEjD,uCAAuC;AACvC,OAAO,EAAE,IAAI,IAAI,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EACL,GAAG,IAAI,8BAA8B,EACrC,IAAI,IAAI,kBAAkB,GAC3B,MAAM,kBAAkB,CAAA;AAEzB,yEAAyE;AACzE,OAAO,EACL,GAAG,IAAI,QAAQ,EACf,IAAI,IAAI,UAAU,EAClB,OAAO,EACP,KAAK,IAAI,UAAU,EACnB,MAAM,IAAI,UAAU,GACrB,MAAM,SAAS,CAAA;AAGhB,2DAA2D;AAC3D,OAAO,EACL,GAAG,IAAI,0BAA0B,EACjC,IAAI,IAAI,wBAAwB,GACjC,MAAM,iBAAiB,CAAA;AAExB,yBAAyB;AACzB,OAAO,EACL,GAAG,IAAI,KAAK,EACZ,KAAK,IAAI,QAAQ,EACjB,cAAc,IAAI,gBAAgB,GACnC,MAAM,MAAM,CAAA;AAEb,WAAW;AACX,OAAO,EAAE,GAAG,IAAI,WAAW,EAAE,GAAG,IAAI,cAAc,EAAE,MAAM,YAAY,CAAA;AAEtE,gBAAgB;AAChB,OAAO,EAAE,GAAG,IAAI,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAExD,oBAAoB;AACpB,OAAO,EACL,WAAW,IAAI,mBAAmB,EAClC,aAAa,IAAI,qBAAqB,EACtC,UAAU,IAAI,kBAAkB,EAChC,aAAa,IAAI,qBAAqB,EACtC,aAAa,IAAI,qBAAqB,GACvC,MAAM,YAAY,CAAA;AAEnB,yBAAyB;AACzB,OAAO,EACL,QAAQ,IAAI,gBAAgB,EAC5B,UAAU,IAAI,kBAAkB,EAChC,OAAO,IAAI,eAAe,EAC1B,UAAU,IAAI,kBAAkB,EAChC,UAAU,IAAI,kBAAkB,EAChC,UAAU,IAAI,kBAAkB,EAChC,UAAU,IAAI,kBAAkB,EAChC,UAAU,IAAI,kBAAkB,EAChC,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAA;AAEnB,YAAY;AACZ,OAAO,EACL,WAAW,EACX,aAAa,EACb,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,aAAa,CAAA"}

package/dist/admin/api/linked-customer.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @rovela/sdk/admin/api/linked-customer
+ *
+ * Self-service detection endpoint: does the currently signed-in admin also
+ * have a customer row on this same store? Used by the admin user menu
+ * (AdminUserMenu) to show/hide the "My customer account" link (R112).
+ *
+ *   GET /api/admin/linked-customer  →  { hasLinkedCustomer: boolean }
+ *
+ * Per-store DB isolation is inherent (branch-per-store), so no cross-tenant
+ * concern. Gated on `requireAdmin()` — same auth guard as the rest of the
+ * admin API surface.
+ *
+ * Fail-safe: any internal error resolves to `false` rather than 500. The
+ * link's job is disclosure, not security — we'd rather hide it than crash
+ * the dropdown UX.
+ *
+ * Usage (template):
+ * ```typescript
+ * // app/api/admin/linked-customer/route.ts
+ * export { GET } from '@rovela-ai/sdk/admin/api/linked-customer'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import type { AdminApiError } from '../types';
+export declare const runtime = "nodejs";
+interface LinkedCustomerResponse {
+    hasLinkedCustomer: boolean;
+}
+export declare function GET(): Promise<NextResponse<LinkedCustomerResponse | AdminApiError>>;
+export {};
+//# sourceMappingURL=linked-customer.d.ts.map

package/dist/admin/api/linked-customer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linked-customer.d.ts","sourceRoot":"","sources":["../../../src/admin/api/linked-customer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE7C,eAAO,MAAM,OAAO,WAAW,CAAA;AAE/B,UAAU,sBAAsB;IAC9B,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AAED,wBAAsB,GAAG,IAAI,OAAO,CAClC,YAAY,CAAC,sBAAsB,GAAG,aAAa,CAAC,CACrD,CAgBA"}

package/dist/admin/api/linked-customer.js

@@ -0,0 +1,45 @@
+/**
+ * @rovela/sdk/admin/api/linked-customer
+ *
+ * Self-service detection endpoint: does the currently signed-in admin also
+ * have a customer row on this same store? Used by the admin user menu
+ * (AdminUserMenu) to show/hide the "My customer account" link (R112).
+ *
+ *   GET /api/admin/linked-customer  →  { hasLinkedCustomer: boolean }
+ *
+ * Per-store DB isolation is inherent (branch-per-store), so no cross-tenant
+ * concern. Gated on `requireAdmin()` — same auth guard as the rest of the
+ * admin API surface.
+ *
+ * Fail-safe: any internal error resolves to `false` rather than 500. The
+ * link's job is disclosure, not security — we'd rather hide it than crash
+ * the dropdown UX.
+ *
+ * Usage (template):
+ * ```typescript
+ * // app/api/admin/linked-customer/route.ts
+ * export { GET } from '@rovela-ai/sdk/admin/api/linked-customer'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { requireAdmin } from '../server/admin-session';
+import { findCustomerByEmail } from '../../auth/server/customer-service';
+export const runtime = 'nodejs';
+export async function GET() {
+    const guard = await requireAdmin();
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const customer = await findCustomerByEmail(guard.admin.email);
+        return NextResponse.json({ hasLinkedCustomer: !!customer });
+    }
+    catch (error) {
+        console.error('[Admin LinkedCustomer] lookup error:', error);
+        // Fail-safe: treat errors as "not linked" so the admin dropdown just
+        // hides the link rather than rendering a broken 5xx in the UI. The
+        // menu is cosmetic — a false negative is strictly better than a crash.
+        return NextResponse.json({ hasLinkedCustomer: false });
+    }
+}
+//# sourceMappingURL=linked-customer.js.map

package/dist/admin/api/linked-customer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linked-customer.js","sourceRoot":"","sources":["../../../src/admin/api/linked-customer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAGxE,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAA;AAM/B,MAAM,CAAC,KAAK,UAAU,GAAG;IAGvB,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC7D,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;QAC5D,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAA;IACxD,CAAC;AACH,CAAC"}

package/dist/admin/api/me.d.ts

@@ -0,0 +1,72 @@
+/**
+ * @rovela/sdk/admin/api/me
+ *
+ * Self-service API routes for logged-in admins.
+ *
+ *   GET   /api/admin/me            — return the caller's profile
+ *   PATCH /api/admin/me            — update own name / email
+ *   PATCH /api/admin/me/password   — change own password (requires current)
+ *
+ * All routes gate on `requireAdmin()` (no permission required — every
+ * logged-in admin can self-service). Invariants are enforced at the
+ * service layer in `admin-self-service.ts`:
+ *
+ *   - `changeOwnPassword` requires current password as proof of identity
+ *   - `updateOwnProfile` checks email uniqueness against every other admin
+ *   - Password change bumps `sessionVersion` → forced logout on next request
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/me/route.ts
+ * export { GET, PATCH } from '@rovela-ai/sdk/admin/api/me'
+ *
+ * // app/api/admin/me/password/route.ts
+ * export { PATCH_PASSWORD as PATCH } from '@rovela-ai/sdk/admin/api/me'
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { AdminApiError } from '../types';
+export declare const runtime = "nodejs";
+interface MeResponse {
+    id: string;
+    email: string;
+    name: string;
+    role: string;
+    status: string;
+    createdAt: string;
+    lastLoginAt: string | null;
+}
+/**
+ * Used by the account page on mount + by client code that needs a fresh
+ * copy of the logged-in admin's data (e.g., after a profile update).
+ * Returns the SAFE projection — no passwordHash, no internal fields.
+ */
+export declare function GET(_request: NextRequest): Promise<NextResponse<MeResponse | AdminApiError>>;
+/**
+ * Body: `{ name?: string, email?: string }`
+ *
+ * Both fields are optional, but at least one must be provided. Email
+ * changes are checked for uniqueness against every other admin. No
+ * re-verification required — the dialog on the client side warns the
+ * user about forgot-password implications of a typo.
+ *
+ * No sessionVersion bump — profile changes don't invalidate sessions.
+ */
+export declare function PATCH(request: NextRequest): Promise<NextResponse<{
+    success: boolean;
+} | AdminApiError>>;
+/**
+ * Body: `{ currentPassword: string, newPassword: string }`
+ *
+ * Verifies the current password, validates the new password, updates
+ * the hash, bumps `sessionVersion`, clears any stale reset tokens, and
+ * flushes the session cache. The admin's CURRENT session will be
+ * invalidated on their very next request — they'll need to sign in
+ * again with the new password. This is intentional: password rotation
+ * should kick out all sessions, including your own.
+ */
+export declare function PATCH_PASSWORD(request: NextRequest): Promise<NextResponse<{
+    success: boolean;
+} | AdminApiError>>;
+export {};
+//# sourceMappingURL=me.d.ts.map

package/dist/admin/api/me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../../src/admin/api/me.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE7C,eAAO,MAAM,OAAO,WAAW,CAAA;AAM/B,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAMD;;;;GAIG;AACH,wBAAsB,GAAG,CACvB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,YAAY,CAAC,UAAU,GAAG,aAAa,CAAC,CAAC,CA+BnD;AAMD;;;;;;;;;GASG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAqC7D;AAMD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAwD7D"}

package/dist/admin/api/me.js

@@ -0,0 +1,177 @@
+/**
+ * @rovela/sdk/admin/api/me
+ *
+ * Self-service API routes for logged-in admins.
+ *
+ *   GET   /api/admin/me            — return the caller's profile
+ *   PATCH /api/admin/me            — update own name / email
+ *   PATCH /api/admin/me/password   — change own password (requires current)
+ *
+ * All routes gate on `requireAdmin()` (no permission required — every
+ * logged-in admin can self-service). Invariants are enforced at the
+ * service layer in `admin-self-service.ts`:
+ *
+ *   - `changeOwnPassword` requires current password as proof of identity
+ *   - `updateOwnProfile` checks email uniqueness against every other admin
+ *   - Password change bumps `sessionVersion` → forced logout on next request
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/me/route.ts
+ * export { GET, PATCH } from '@rovela-ai/sdk/admin/api/me'
+ *
+ * // app/api/admin/me/password/route.ts
+ * export { PATCH_PASSWORD as PATCH } from '@rovela-ai/sdk/admin/api/me'
+ * ```
+ */
+import { NextResponse } from 'next/server';
+import { requireAdmin } from '../server/admin-session';
+import { changeOwnPassword, updateOwnProfile, } from '../server/admin-self-service';
+export const runtime = 'nodejs';
+// =============================================================================
+// GET /api/admin/me — return the caller's profile
+// =============================================================================
+/**
+ * Used by the account page on mount + by client code that needs a fresh
+ * copy of the logged-in admin's data (e.g., after a profile update).
+ * Returns the SAFE projection — no passwordHash, no internal fields.
+ */
+export async function GET(_request) {
+    const guard = await requireAdmin();
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const admin = guard.admin;
+        return NextResponse.json({
+            id: admin.id,
+            email: admin.email,
+            name: admin.name,
+            role: admin.role,
+            status: admin.status ?? 'active',
+            createdAt: admin.createdAt instanceof Date
+                ? admin.createdAt.toISOString()
+                : String(admin.createdAt),
+            lastLoginAt: admin.lastLoginAt
+                ? admin.lastLoginAt instanceof Date
+                    ? admin.lastLoginAt.toISOString()
+                    : String(admin.lastLoginAt)
+                : null,
+        });
+    }
+    catch (error) {
+        console.error('[Admin Me API] GET error:', error);
+        return NextResponse.json({ error: 'Failed to fetch profile', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+// =============================================================================
+// PATCH /api/admin/me — update own profile (name + email)
+// =============================================================================
+/**
+ * Body: `{ name?: string, email?: string }`
+ *
+ * Both fields are optional, but at least one must be provided. Email
+ * changes are checked for uniqueness against every other admin. No
+ * re-verification required — the dialog on the client side warns the
+ * user about forgot-password implications of a typo.
+ *
+ * No sessionVersion bump — profile changes don't invalidate sessions.
+ */
+export async function PATCH(request) {
+    const guard = await requireAdmin();
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const body = (await request.json().catch(() => null));
+        const name = typeof body?.name === 'string' ? body.name : undefined;
+        const email = typeof body?.email === 'string' ? body.email : undefined;
+        const result = await updateOwnProfile(guard.admin.id, { name, email });
+        if (!result.ok) {
+            const status = result.error.code === 'EMAIL_EXISTS'
+                ? 409
+                : result.error.code === 'NOT_FOUND'
+                    ? 404
+                    : 400;
+            return NextResponse.json({ error: result.error.message, code: mapProfileErrorCode(result.error.code) }, { status });
+        }
+        return NextResponse.json({ success: true });
+    }
+    catch (error) {
+        console.error('[Admin Me API] PATCH error:', error);
+        return NextResponse.json({ error: 'Failed to update profile', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+// =============================================================================
+// PATCH /api/admin/me/password — change own password
+// =============================================================================
+/**
+ * Body: `{ currentPassword: string, newPassword: string }`
+ *
+ * Verifies the current password, validates the new password, updates
+ * the hash, bumps `sessionVersion`, clears any stale reset tokens, and
+ * flushes the session cache. The admin's CURRENT session will be
+ * invalidated on their very next request — they'll need to sign in
+ * again with the new password. This is intentional: password rotation
+ * should kick out all sessions, including your own.
+ */
+export async function PATCH_PASSWORD(request) {
+    const guard = await requireAdmin();
+    if (!guard.ok) {
+        return guard.response;
+    }
+    try {
+        const body = (await request.json().catch(() => null));
+        const currentPassword = typeof body?.currentPassword === 'string' ? body.currentPassword : '';
+        const newPassword = typeof body?.newPassword === 'string' ? body.newPassword : '';
+        if (!currentPassword || !newPassword) {
+            return NextResponse.json({
+                error: 'currentPassword and newPassword are required.',
+                code: 'VALIDATION_ERROR',
+            }, { status: 400 });
+        }
+        const result = await changeOwnPassword(guard.admin.id, currentPassword, newPassword);
+        if (!result.ok) {
+            const status = result.error.code === 'INVALID_CREDENTIALS'
+                ? 401
+                : result.error.code === 'NOT_FOUND'
+                    ? 404
+                    : 400;
+            return NextResponse.json({
+                error: result.error.message,
+                code: mapPasswordErrorCode(result.error.code),
+            }, { status });
+        }
+        return NextResponse.json({ success: true });
+    }
+    catch (error) {
+        console.error('[Admin Me API] PATCH_PASSWORD error:', error);
+        return NextResponse.json({ error: 'Failed to change password', code: 'INTERNAL_ERROR' }, { status: 500 });
+    }
+}
+// =============================================================================
+// Helpers
+// =============================================================================
+function mapProfileErrorCode(code) {
+    switch (code) {
+        case 'NOT_FOUND':
+            return 'NOT_FOUND';
+        case 'EMAIL_EXISTS':
+            return 'EMAIL_EXISTS';
+        case 'INVALID_CREDENTIALS':
+        case 'VALIDATION_ERROR':
+            return 'VALIDATION_ERROR';
+    }
+}
+function mapPasswordErrorCode(code) {
+    switch (code) {
+        case 'NOT_FOUND':
+            return 'NOT_FOUND';
+        case 'INVALID_CREDENTIALS':
+            return 'INVALID_CREDENTIALS';
+        case 'EMAIL_EXISTS':
+        case 'VALIDATION_ERROR':
+            return 'VALIDATION_ERROR';
+    }
+}
+//# sourceMappingURL=me.js.map

package/dist/admin/api/me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../../src/admin/api/me.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAe,YAAY,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,8BAA8B,CAAA;AAGrC,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAA;AAgB/B,gFAAgF;AAChF,kDAAkD;AAClD,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,QAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACzB,OAAO,YAAY,CAAC,IAAI,CAAC;YACvB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAG,KAAwC,CAAC,MAAM,IAAI,QAAQ;YACpE,SAAS,EACP,KAAK,CAAC,SAAS,YAAY,IAAI;gBAC7B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC/B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC5B,CAAC,CAAC,KAAK,CAAC,WAAW,YAAY,IAAI;oBACjC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;oBACjC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC7B,CAAC,CAAC,IAAI;SACT,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAA;QACjD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,0DAA0D;AAC1D,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,OAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE5C,CAAA;QAER,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QACnE,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAEtE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAEtE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GACV,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;gBAClC,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;oBACjC,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,GAAG,CAAA;YACX,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAC7E,EAAE,MAAM,EAAE,CACX,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE5C,CAAA;QAER,MAAM,eAAe,GACnB,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAA;QACvE,MAAM,WAAW,GACf,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;QAE/D,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,+CAA+C;gBACtD,IAAI,EAAE,kBAAkB;aACzB,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,KAAK,CAAC,KAAK,CAAC,EAAE,EACd,eAAe,EACf,WAAW,CACZ,CAAA;QAED,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,MAAM,GACV,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,qBAAqB;gBACzC,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;oBACjC,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,GAAG,CAAA;YACX,OAAO,YAAY,CAAC,IAAI,CACtB;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;gBAC3B,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;aAC9C,EACD,EAAE,MAAM,EAAE,CACX,CAAA;QACH,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;QAC5D,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,2BAA2B,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAS,mBAAmB,CAC1B,IAA+E;IAE/E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,WAAW,CAAA;QACpB,KAAK,cAAc;YACjB,OAAO,cAAc,CAAA;QACvB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,kBAAkB;YACrB,OAAO,kBAAkB,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAA+E;IAE/E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,WAAW,CAAA;QACpB,KAAK,qBAAqB;YACxB,OAAO,qBAAqB,CAAA;QAC9B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB;YACrB,OAAO,kBAAkB,CAAA;IAC7B,CAAC;AACH,CAAC"}

package/dist/admin/api/orders.d.ts

@@ -0,0 +1,91 @@
+/**
+ * @rovela/sdk/admin/api/orders
+ *
+ * API route handlers for admin order management.
+ *
+ * Usage:
+ * ```typescript
+ * // app/api/admin/orders/route.ts
+ * export { GET } from '@rovela/sdk/admin/api/orders'
+ *
+ * // app/api/admin/orders/[id]/route.ts
+ * export { GET as getOrder, PUT } from '@rovela/sdk/admin/api/orders'
+ * ```
+ */
+import { NextRequest, NextResponse } from 'next/server';
+import type { ShippoRate } from '../types';
+import type { AdminApiError, PaginatedResponse } from '../types';
+/**
+ * GET /api/admin/orders
+ *
+ * List orders with filtering and pagination.
+ *
+ * Query Parameters:
+ * - status: Order status filter
+ * - page: number (default 1)
+ * - limit: number (default 20, max 100)
+ */
+export declare function GET(request: NextRequest): Promise<NextResponse<PaginatedResponse<unknown> | AdminApiError>>;
+/**
+ * GET /api/admin/orders/[id]
+ *
+ * Get a single order by ID with items.
+ */
+export declare function getOrder(_request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    data: unknown;
+} | AdminApiError>>;
+/**
+ * PUT /api/admin/orders/[id]
+ *
+ * Update order status.
+ *
+ * Body:
+ * - status: New order status
+ * - notifyCustomer: boolean (default true)
+ * - trackingNumber: string (for shipped status)
+ * - trackingUrl: string (for shipped status)
+ */
+export declare function PUT(request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    success: boolean;
+    data?: unknown;
+} | AdminApiError>>;
+/**
+ * GET /api/admin/orders/[id]/shippo-rates
+ *
+ * Get available Shippo carrier rates for an order.
+ * Requires order to have a shipping address.
+ */
+export declare function getShippoRatesForOrder(_request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    rates: ShippoRate[];
+} | AdminApiError>>;
+/**
+ * POST /api/admin/orders/[id]/ship-with-shippo
+ *
+ * Purchase a shipping label from Shippo and update order with tracking info.
+ *
+ * Body:
+ * - rateId: Shippo rate object ID to purchase
+ * - notifyCustomer: boolean (default true)
+ */
+export declare function shipWithShippo(request: NextRequest, { params }: {
+    params: Promise<{
+        id: string;
+    }>;
+}): Promise<NextResponse<{
+    success: boolean;
+    trackingNumber?: string;
+    labelUrl?: string;
+} | AdminApiError>>;
+//# sourceMappingURL=orders.d.ts.map

package/dist/admin/api/orders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orders.d.ts","sourceRoot":"","sources":["../../../src/admin/api/orders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAcvD,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,UAAU,CAAA;AAQzD,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAYhE;;;;;;;;;GASG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,CA0CnE;AAMD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,QAAQ,EAAE,WAAW,EACrB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CA0B1D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,WAAW,EACpB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CA0E7E;AA2JD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,WAAW,EACrB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,KAAK,EAAE,UAAU,EAAE,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAkFhE;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,EACpB,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC9C,OAAO,CAAC,YAAY,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC,CAAC,CAoGzG"}