@sixtyninecommerce/admin 0.1.0

package/dist/client.js

@@ -0,0 +1,236 @@
+import { createChannelResolver, createTransport, mergeTenant, UNSCOPED_TENANT, ValidationError, } from '@sixtyninecommerce/core';
+import { createApiTokensModule } from './api-tokens/index.js';
+import { createAuthModule } from './auth/index.js';
+import { createFormsModule } from './content/forms.js';
+import { createRedirectsModule } from './seo/redirects.js';
+import { createChannelsModule } from './tenant/channels.js';
+/**
+ * An admin credential in a browser is a credential the whole internet can read
+ * (spec §18 amendment 3, §15.21). A SESSION bearer is fine there — that is what
+ * the dashboard is — so the refusal is specifically about a long-lived token.
+ */
+function assertNotInBrowser(auth) {
+    if (!('token' in auth))
+        return;
+    // Indexed off a typed view of globalThis: this package compiles without the
+    // DOM lib on purpose, so that a stray `document.` reference cannot slip in.
+    const runtime = globalThis;
+    const inBrowser = runtime.window !== undefined && runtime.document !== undefined;
+    if (!inBrowser)
+        return;
+    throw new ValidationError({
+        code: 'CREDENTIAL_IN_BROWSER',
+        message: 'An API token must never be constructed in a browser — it would ship the credential to every visitor. Use a session bearer in the browser and keep tokens server-side.',
+        status: 400,
+        service: 'vendure',
+    });
+}
+/**
+ * Where the session bearer lives: in the caller's own `session` object, always.
+ *
+ * Two earlier designs both shipped a defect. Storing it ONLY in the caller's
+ * hands meant a client built with `auth: { session: {} }` signed in and then
+ * made every following call — starting with the `me()` inside `login()` —
+ * unauthenticated. Keeping a private slot inside the client and falling back to
+ * it meant a server with one module-scope client and a per-request bearer
+ * served one administrator's session to the next visitor: both requests read
+ * `undefined` from their own store, so both fell through to the slot holding
+ * the last bearer anyone had rotated to.
+ *
+ * There is no fallback slot now. The caller's object is read live on every call
+ * and written on every rotation, so a per-request store isolates per request,
+ * `withTenant` and a second client over the same config share one session for
+ * free, and a caller who clears their copy is signed out.
+ */
+function sessionStore(configured) {
+    return {
+        read: () => configured.token ?? '',
+        write: (next) => {
+            configured.token = next;
+            try {
+                configured.onToken?.(next ?? '');
+            }
+            catch (error) {
+                // The consumer's handler is not allowed to fail the operation that
+                // produced the token. `localStorage.setItem` throws in a private
+                // window, and a `logout()` that rejected after Vendure had already
+                // destroyed the session would leave an app on its signed-in shell while
+                // every later call 401s. The transport isolates the same handler on the
+                // rotation path for the same reason.
+                console.warn('[admin] session onToken handler threw; the bearer was still stored', error);
+            }
+        },
+    };
+}
+function credentialMissing() {
+    return new ValidationError({
+        code: 'CREDENTIAL_MISSING',
+        message: 'auth.token is empty, so the call would go out with no credential and be refused as a permission failure. Check the environment variable or store holding the API token.',
+        status: 400,
+        service: 'vendure',
+    });
+}
+/**
+ * `auth: { token: process.env.SIXTYNINE_API_TOKEN! }` with the variable unset
+ * is the commonest way to build a client with no credential at all: TypeScript's
+ * `!` hides the `undefined`, the transport sends no Authorization header, and
+ * the first call comes back as PermissionDeniedError — "you may not do this" —
+ * from deep inside whichever module the caller invoked.
+ *
+ * Only an OWN DATA PROPERTY is checked here, at construction, because its value
+ * can only have come from the caller. Anything else — an own accessor, a getter
+ * inherited from a class prototype, a Proxy — is read live on every call, so it
+ * is legitimately empty at construction (a request context not yet populated, a
+ * secret manager not yet consulted) and checking it then would refuse the
+ * documented per-request pattern at IMPORT time. Those are checked on the call
+ * that would have sent the credential instead.
+ */
+function descriptorOf(target, key) {
+    for (let node = target; node !== null; node = Object.getPrototypeOf(node)) {
+        const descriptor = Object.getOwnPropertyDescriptor(node, key);
+        if (descriptor !== undefined)
+            return descriptor;
+    }
+    return undefined;
+}
+function assertTokenIsPresent(auth) {
+    const descriptor = descriptorOf(auth, 'token');
+    if (descriptor === undefined || descriptor.get !== undefined)
+        return;
+    if (isPresent(auth.token))
+        return;
+    throw credentialMissing();
+}
+const isPresent = (token) => typeof token === 'string' && token.trim() !== '';
+/**
+ * Refuse a session object this client cannot store into. Discovering it at the
+ * first rotation instead would mean `login()` succeeding and every call after
+ * it going out unauthenticated — the exact failure this check exists to name.
+ */
+function assertSessionIsWritable(session) {
+    // Walked, not `getOwnPropertyDescriptor`: a request context or a secret store
+    // is usually a CLASS, so its `token` accessor lives on the prototype and an
+    // own-property check reports nothing — accepting a read-only object and
+    // producing the misdiagnosis this guard exists to prevent.
+    const descriptor = descriptorOf(session, 'token');
+    const writable = descriptor === undefined
+        ? Object.isExtensible(session)
+        : descriptor.writable === true || typeof descriptor.set === 'function';
+    if (writable)
+        return;
+    throw new ValidationError({
+        code: 'SESSION_NOT_WRITABLE',
+        message: 'auth.session.token is read-only, so this client could never store the bearer Vendure returns and every call after login would be unauthenticated. Use a plain property, or a getter with a setter over your own store.',
+        status: 400,
+        service: 'vendure',
+    });
+}
+export function createAdminClient(config) {
+    assertNotInBrowser(config.auth);
+    const resolver = createChannelResolver({
+        cmsUrl: config.urls.cmsUrl,
+        ...(config.fetch ? { fetch: config.fetch } : {}),
+        ...(config.timeoutMs === undefined ? {} : { timeoutMs: config.timeoutMs }),
+    });
+    if ('session' in config.auth)
+        assertSessionIsWritable(config.auth.session);
+    else
+        assertTokenIsPresent(config.auth);
+    // Shared by every client `withTenant` derives, because the session store is.
+    // `rotations` lets `login()` tell a bearer THIS sign-in produced apart from
+    // one that merely sits in the slot already.
+    const shared = { rotations: 0 };
+    return buildClient(config, config.tenant, resolver, shared);
+}
+function buildClient(config, overrides, resolver, shared) {
+    // No scope configured leaves the client on UNSCOPED_TENANT, which only the
+    // auth documents may use; the transport refuses everything else with
+    // TENANT_REQUIRED (spec §15.2).
+    const tenant = mergeTenant(UNSCOPED_TENANT, overrides);
+    const configured = 'session' in config.auth ? config.auth.session : undefined;
+    const store = configured ? sessionStore(configured) : undefined;
+    const transport = createTransport({
+        urls: config.urls,
+        channels: resolver,
+        tenant,
+        principal: () => {
+            if (!store) {
+                // Read live, so a getter over a request context follows the request
+                // being served — and refuse an empty one HERE rather than sending an
+                // anonymous request that comes back as a permission failure.
+                const token = config.auth.token;
+                if (!isPresent(token))
+                    throw credentialMissing();
+                return { kind: 'bearer', token };
+            }
+            const sent = store.read();
+            return {
+                kind: 'bearer',
+                token: sent,
+                onToken: (rotated) => {
+                    // Only while the slot still holds what THIS call sent. A `logout()`
+                    // that landed meanwhile cleared it, and a rotation for the session
+                    // that ended must not re-arm the one that replaced it.
+                    //
+                    // Keyed on the bearer, never on a per-client counter: the session
+                    // store is the CALLER's, and on the documented one-client-per-server
+                    // pattern each request has its own. A counter is global to the
+                    // process, so one administrator's sign-out discarded the bearer
+                    // another administrator's concurrent sign-in had just been issued —
+                    // reported to them as "the engine returned no vendure-auth-token".
+                    if (store.read() !== sent)
+                        return;
+                    store.write(rotated);
+                    shared.rotations += 1;
+                },
+            };
+        },
+        ...(config.fetch ? { fetch: config.fetch } : {}),
+        ...(config.retry ? { retry: config.retry } : {}),
+        ...(config.timeoutMs === undefined ? {} : { timeoutMs: config.timeoutMs }),
+        ...(config.onDeprecation ? { onDeprecation: config.onDeprecation } : {}),
+    });
+    // No guard here: the transport refuses an unscoped call itself with
+    // TENANT_REQUIRED unless it opts in, and only `auth` does. One rule, in the
+    // one place that knows what left the process.
+    return {
+        auth: createAuthModule(transport, store && {
+            present: () => store.read() !== '',
+            current: () => store.read(),
+            rotations: () => shared.rotations,
+            end: (sent) => {
+                // Vendure destroys the session and answers `vendure-auth-token: ''`,
+                // which the transport drops as "not a rotation". Without this the
+                // caller's store keeps a dead bearer — and every client derived from
+                // this one reads the same store.
+                //
+                // `sent` guards the other direction: a response that PROVES a bearer
+                // is dead arrives late, and by then a fresh sign-in may hold the
+                // slot. Clearing then would sign the new session out.
+                if (sent !== undefined && store.read() !== sent)
+                    return;
+                store.write(undefined);
+            },
+        }),
+        apiTokens: createApiTokensModule(transport),
+        channels: createChannelsModule(resolver),
+        content: { forms: createFormsModule(transport) },
+        seo: { redirects: createRedirectsModule(transport) },
+        platform: {},
+        withTenant(next) {
+            // `mergeTenant`, not a spread: it merges `actor` FIELD BY FIELD, so a
+            // derived client that names only a registerRef keeps the staffRef this
+            // one was built with — exactly as the per-call `tenant` override does.
+            // A spread replaced the whole actor, silently dropping the
+            // `x-on-behalf-of` that attributes a mutation in the audit trail.
+            //
+            // Resolver and rotation count are shared, and the session store IS the
+            // caller's object — so a derived client reuses the channel cache and the
+            // bearer this one signed in with, in both directions and in either order.
+            return buildClient(config, mergeTenant(tenant, next), resolver, shared);
+        },
+        get rateLimit() {
+            return transport.rateLimit;
+        },
+    };
+}

package/dist/content/forms.d.ts

@@ -0,0 +1,133 @@
+import { type Page, type Transport } from '@sixtyninecommerce/core';
+import type { Call, ListOptions } from '../types.js';
+/**
+ * Everything a visitor reads is TRANSLATED, per language, in its own row:
+ * `forms_translations` and `form_fields_translations`. `name` and `slug` are
+ * the authoring identity, not display copy — a form with no translation for a
+ * storefront's language renders the untranslated fallback, so a multilingual
+ * tenant that cannot express this dimension is a tenant whose labels are all in
+ * the authoring language.
+ */
+export interface FormTranslation {
+    /** e.g. `en`, `nl`, `de`. */
+    languageCode: string;
+    title?: string | null;
+    description?: string | null;
+    submitButtonText?: string | null;
+    successMessage?: string | null;
+    [extra: string]: unknown;
+}
+export interface FormFieldTranslation {
+    languageCode: string;
+    label: string;
+    placeholder?: string | null;
+    helpText?: string | null;
+    errorMessage?: string | null;
+    [extra: string]: unknown;
+}
+/**
+ * The WRITE shapes, mirroring `FormTranslationDto` and
+ * `FormFieldTranslationDto` exactly — separate from the read shapes for the
+ * same reason `FormFieldInput` is separate from `FormField`.
+ *
+ * A read carries the translation row's own `id`, `formId` and timestamps, and
+ * `forbidNonWhitelisted` refuses every one of them, so handing a fetched
+ * `translations` array straight back is a 400 on the edit-and-save flow this
+ * type exists to support. No index signature, so excess-property checking
+ * actually fires on a literal.
+ *
+ * `title` and `label` are the two NOT NULL columns, so they take no `| null`:
+ * `@IsOptional()` SKIPS null rather than rejecting it and the service assigns it
+ * through, which is a 500 where a 400 belongs. Every other member is nullable in
+ * the database and the service treats an explicit null as a CLEAR — so `| null`
+ * stays there, and omitting the key leaves the value alone. `''` is not the same
+ * thing: a storefront doing `submitButtonText ?? 'Send'` renders an empty button
+ * for an empty string and the default for a null.
+ */
+export interface FormTranslationInput {
+    languageCode: string;
+    title?: string;
+    description?: string | null;
+    submitButtonText?: string | null;
+    successMessage?: string | null;
+}
+export interface FormFieldTranslationInput {
+    languageCode: string;
+    label: string;
+    placeholder?: string | null;
+    helpText?: string | null;
+    errorMessage?: string | null;
+}
+/** A form as the CMS stores it (the admin projection, not the storefront one). */
+export interface Form {
+    id: string;
+    channelId: string;
+    name: string;
+    slug: string;
+    notificationEmails: string | null;
+    redirectUrlOnSuccess: string | null;
+    submitAction: string;
+    /** Free-form JSONB the CMS stores verbatim — never case-converted. */
+    settings: Record<string, unknown> | null;
+    translations?: FormTranslation[];
+    fields?: FormField[];
+    createdAt: string;
+    updatedAt: string;
+    [extra: string]: unknown;
+}
+export interface FormField {
+    id: string;
+    name: string;
+    slug: string;
+    fieldType: string;
+    isRequired: boolean;
+    position: number;
+    config: Record<string, unknown> | null;
+    validation: Record<string, unknown> | null;
+    translations?: FormFieldTranslation[];
+    [extra: string]: unknown;
+}
+/**
+ * Exactly what `CreateFormFieldDto` whitelists, and nothing else. The CMS runs
+ * `ValidationPipe({ whitelist: true, forbidNonWhitelisted: true })`, so an
+ * extra key is a 400, not an ignored extra — which is why this is not
+ * `Partial<FormField>`: handing a fetched field straight back would send `id`,
+ * `formId` and `createdAt` and fail the whole write.
+ */
+export interface FormFieldInput {
+    name: string;
+    slug: string;
+    fieldType: string;
+    isRequired?: boolean;
+    position?: number;
+    config?: Record<string, unknown>;
+    validation?: Record<string, unknown>;
+    translations?: FormFieldTranslationInput[];
+}
+/**
+ * Exactly what `UpsertFormDto` whitelists. `slug` is NOT here on purpose: it
+ * comes from the URL, and sending it is a 400 under `forbidNonWhitelisted`.
+ */
+export interface FormInput {
+    name: string;
+    /**
+     * `null` CLEARS, `undefined` (or an absent key) leaves the stored value
+     * alone — the service only assigns what the DTO names, and these three
+     * columns are nullable. `''` is a different thing: it stores an empty string
+     * a storefront's `?? fallback` can never replace.
+     */
+    notificationEmails?: string | null;
+    redirectUrlOnSuccess?: string | null;
+    submitAction?: string;
+    settings?: Record<string, unknown> | null;
+    translations?: FormTranslationInput[];
+    fields?: FormFieldInput[];
+}
+export interface FormsModule {
+    list(options?: ListOptions): Promise<Page<Form>>;
+    get(id: string, options?: Call): Promise<Form>;
+    getBySlug(slug: string, options?: Call): Promise<Form>;
+    upsertBySlug(slug: string, input: FormInput, options?: Call): Promise<Form>;
+    delete(id: string, options?: Call): Promise<void>;
+}
+export declare function createFormsModule(transport: Transport): FormsModule;

package/dist/content/forms.js

@@ -0,0 +1,65 @@
+import { createPage, offsetCursor, PLATFORM_PASSTHROUGH_KEYS, readOffsetCursor, } from '@sixtyninecommerce/core';
+import { AdminProjectionError } from '../errors.js';
+const DEFAULT_PAGE_SIZE = 25;
+/**
+ * A form carries three bags the CMS stores verbatim: `settings`, and each
+ * field's `config` and `validation` (whose constraint keys are snake_case —
+ * `min_length` — and are read back by the CMS validator). Case-converting them
+ * renames a merchant's own keys, so every call in this module names them.
+ * `Transport.rest` preserves nothing that is not named.
+ */
+const FORM_PASSTHROUGH = PLATFORM_PASSTHROUGH_KEYS;
+/**
+ * `GET /forms*` is a PUBLIC CMS route with OPTIONAL auth: a token the CMS does
+ * not accept for this channel is not rejected — the route answers 200 with the
+ * STOREFRONT projection, which carries no `channelId` and no field ids.
+ * Returning that as an admin `Form` hands the caller `undefined` under a
+ * `string` type and turns the next write into an opaque 400 that names neither
+ * the token nor the channel. `channelId` is the discriminator: the entity
+ * always has it, the projection never does.
+ */
+function assertAdminProjection(form, what) {
+    if (form && typeof form.channelId === 'string' && form.channelId !== '')
+        return form;
+    throw new AdminProjectionError(what);
+}
+export function createFormsModule(transport) {
+    async function listPage(offset, limit, options) {
+        const body = await transport.rest('cms', { method: 'GET', path: '/forms', query: { limit, offset } }, { ...options, preserveKeys: FORM_PASSTHROUGH });
+        const items = body.data ?? [];
+        // `GET /forms` is `@Public()` exactly like the two single reads, so a
+        // credential the CMS will not accept for this channel is answered 200 with
+        // the storefront projection — rows with no channelId and no field ids. One
+        // row is enough to tell: the route projects all of them or none.
+        if (items[0] !== undefined)
+            assertAdminProjection(items[0], 'the form list');
+        // The CMS echoes neither the offset nor a cursor, so the page is built from
+        // what THIS call asked for — `readRestPage` cannot derive it.
+        const total = body.pagination?.total ?? items.length;
+        const advanced = offset + (items.length > 0 ? items.length : limit);
+        const hasNext = advanced < total;
+        return createPage(items, { nextCursor: hasNext ? offsetCursor(advanced) : null, hasNext, total }, (cursor) => listPage(readOffsetCursor(cursor), limit, options));
+    }
+    return {
+        list(options) {
+            const limit = options?.limit ?? DEFAULT_PAGE_SIZE;
+            const offset = options?.after === undefined ? 0 : readOffsetCursor(options.after);
+            return listPage(offset, limit, options);
+        },
+        async get(id, options) {
+            const body = await transport.rest('cms', { method: 'GET', path: `/forms/${encodeURIComponent(id)}` }, { ...options, preserveKeys: FORM_PASSTHROUGH });
+            return assertAdminProjection(body.data, `form "${id}"`);
+        },
+        async getBySlug(slug, options) {
+            const body = await transport.rest('cms', { method: 'GET', path: `/forms/by-slug/${encodeURIComponent(slug)}` }, { ...options, preserveKeys: FORM_PASSTHROUGH });
+            return assertAdminProjection(body.data, `form "${slug}"`);
+        },
+        async upsertBySlug(slug, input, options) {
+            const body = await transport.rest('cms', { method: 'PUT', path: `/forms/by-slug/${encodeURIComponent(slug)}`, body: input }, { ...options, preserveKeys: FORM_PASSTHROUGH });
+            return body.data;
+        },
+        async delete(id, options) {
+            await transport.rest('cms', { method: 'DELETE', path: `/forms/${encodeURIComponent(id)}`, expect: 'void' }, options);
+        },
+    };
+}

package/dist/errors.d.ts

@@ -0,0 +1,10 @@
+import { PlatformError } from '@sixtyninecommerce/core';
+/**
+ * The CMS answered a public-with-optional-auth route with its STOREFRONT
+ * projection, which means the credential was not accepted for this channel.
+ * A distinct class because the HTTP status is 200: nothing else in the
+ * hierarchy would tell a caller that their token, not their request, is wrong.
+ */
+export declare class AdminProjectionError extends PlatformError {
+    constructor(what: string);
+}

package/dist/errors.js

@@ -0,0 +1,17 @@
+import { PlatformError } from '@sixtyninecommerce/core';
+/**
+ * The CMS answered a public-with-optional-auth route with its STOREFRONT
+ * projection, which means the credential was not accepted for this channel.
+ * A distinct class because the HTTP status is 200: nothing else in the
+ * hierarchy would tell a caller that their token, not their request, is wrong.
+ */
+export class AdminProjectionError extends PlatformError {
+    constructor(what) {
+        super({
+            code: 'ADMIN_PROJECTION_UNAVAILABLE',
+            message: `The CMS returned the public projection for ${what}, so the credential was not accepted for this channel — it is invalid or expired, or its principal has no access. Admin-only fields are unavailable.`,
+            status: 403,
+            service: 'cms',
+        });
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `@sixtyninecommerce/admin` — the back-office SDK.
+ *
+ * Every capability of the platform is a method here (the parity rule, spec §5).
+ * Phase 0 ships the skeleton: auth, personal API tokens, channel resolution,
+ * CMS forms and SEO redirects, plus the `platform` guard every cross-tenant
+ * method added later runs through.
+ *
+ * Server-side by default. A session bearer is welcome in a browser — the
+ * dashboard is one — but constructing a client with an API token there throws
+ * `CREDENTIAL_IN_BROWSER` (spec §18 amendment 3).
+ */
+/**
+ * Every type a consumer needs to NAME something `AdminClientConfig` accepts or
+ * a method returns. core is a transitive dependency, so under pnpm's strict
+ * node_modules they cannot import these from it even though that is where they
+ * are defined — without this they can only pass inline literals.
+ */
+export type { DeprecationNotice, Page, PageMeta, RateLimitInfo, RetryPolicy, } from '@sixtyninecommerce/core';
+/**
+ * The error hierarchy this package throws, re-exported so a consumer can catch
+ * it without adding a direct dependency on `@sixtyninecommerce/core` — which,
+ * being transitive, pnpm would not resolve for them anyway.
+ */
+export { AuthenticationError, BusinessRuleError, ConflictError, type ErrorDetail, NotFoundError, PermissionDeniedError, PlatformError, type ProblemDetails, RateLimitedError, TransportError, UpstreamError, ValidationError, } from '@sixtyninecommerce/core';
+export type { ApiTokensModule, CreatedApiToken } from './api-tokens/index.js';
+export type { AuthModule } from './auth/index.js';
+export { type AdminClient, type AdminClientConfig, createAdminClient, type SessionConfig, } from './client.js';
+export type { Form, FormField, FormFieldInput, FormFieldTranslation, FormFieldTranslationInput, FormInput, FormsModule, FormTranslation, FormTranslationInput, } from './content/forms.js';
+export { AdminProjectionError } from './errors.js';
+export { requireHumanSession } from './platform/guard.js';
+export type { Redirect, RedirectCreateInput, RedirectsModule, RedirectUpdateInput, } from './seo/redirects.js';
+export type { ChannelsModule } from './tenant/channels.js';
+export type { ApiToken, Call, ChannelInfo, CreateApiTokenInput, ListOptions, Me, TenantContext, TenantScope, UpdateApiTokenInput, WhoAmI, } from './types.js';

package/dist/index.js

@@ -0,0 +1,21 @@
+/**
+ * `@sixtyninecommerce/admin` — the back-office SDK.
+ *
+ * Every capability of the platform is a method here (the parity rule, spec §5).
+ * Phase 0 ships the skeleton: auth, personal API tokens, channel resolution,
+ * CMS forms and SEO redirects, plus the `platform` guard every cross-tenant
+ * method added later runs through.
+ *
+ * Server-side by default. A session bearer is welcome in a browser — the
+ * dashboard is one — but constructing a client with an API token there throws
+ * `CREDENTIAL_IN_BROWSER` (spec §18 amendment 3).
+ */
+/**
+ * The error hierarchy this package throws, re-exported so a consumer can catch
+ * it without adding a direct dependency on `@sixtyninecommerce/core` — which,
+ * being transitive, pnpm would not resolve for them anyway.
+ */
+export { AuthenticationError, BusinessRuleError, ConflictError, NotFoundError, PermissionDeniedError, PlatformError, RateLimitedError, TransportError, UpstreamError, ValidationError, } from '@sixtyninecommerce/core';
+export { createAdminClient, } from './client.js';
+export { AdminProjectionError } from './errors.js';
+export { requireHumanSession } from './platform/guard.js';

package/dist/platform/guard.d.ts

@@ -0,0 +1,11 @@
+import type { AdminClientConfig } from '../client.js';
+/**
+ * `admin.platform.*` — organizations, tenant provisioning, entitlements,
+ * channel lifecycle, fleet, cross-tenant audit — needs a human SuperAdmin
+ * session (spec §6.3, §15.10). The server refuses a token there anyway; the SDK
+ * refuses to SEND one, so a machine credential is never put on the wire towards
+ * a cross-tenant surface in the first place.
+ *
+ * Phase 0 ships no platform method. Every one added later calls this first.
+ */
+export declare function requireHumanSession(config: AdminClientConfig): void;

package/dist/platform/guard.js

@@ -0,0 +1,20 @@
+import { PermissionDeniedError } from '@sixtyninecommerce/core';
+/**
+ * `admin.platform.*` — organizations, tenant provisioning, entitlements,
+ * channel lifecycle, fleet, cross-tenant audit — needs a human SuperAdmin
+ * session (spec §6.3, §15.10). The server refuses a token there anyway; the SDK
+ * refuses to SEND one, so a machine credential is never put on the wire towards
+ * a cross-tenant surface in the first place.
+ *
+ * Phase 0 ships no platform method. Every one added later calls this first.
+ */
+export function requireHumanSession(config) {
+    if ('session' in config.auth)
+        return;
+    throw new PermissionDeniedError({
+        code: 'PLATFORM_REQUIRES_SESSION',
+        message: 'Platform operations need a human SuperAdmin session. An API token cannot be used for cross-tenant administration.',
+        status: 403,
+        service: 'vendure',
+    });
+}

package/dist/seo/redirects.d.ts

@@ -0,0 +1,27 @@
+import { type Page, type Transport } from '@sixtyninecommerce/core';
+import type { Call, ListOptions } from '../types.js';
+export interface Redirect {
+    id: string;
+    channelId: string;
+    oldPath: string;
+    newPath: string;
+    statusCode: number;
+    /** `manual`, `import`, or `auto` (created by the URL-change engine). */
+    source?: string;
+    createdAt: string;
+    updatedAt: string;
+    [extra: string]: unknown;
+}
+export interface RedirectCreateInput {
+    oldPath: string;
+    newPath: string;
+    statusCode?: number;
+}
+export type RedirectUpdateInput = Partial<RedirectCreateInput>;
+export interface RedirectsModule {
+    list(options?: ListOptions): Promise<Page<Redirect>>;
+    create(input: RedirectCreateInput, options?: Call): Promise<Redirect>;
+    update(id: string, input: RedirectUpdateInput, options?: Call): Promise<Redirect>;
+    delete(id: string, options?: Call): Promise<void>;
+}
+export declare function createRedirectsModule(transport: Transport): RedirectsModule;

package/dist/seo/redirects.js

@@ -0,0 +1,37 @@
+import { createPage, readRestPage } from '@sixtyninecommerce/core';
+export function createRedirectsModule(transport) {
+    async function list(options) {
+        // `GET /redirects` answers with a bare array unless the request OPTS IN.
+        // Spec §18 amendment 9 supersedes amendment 5 for exactly this: a bare
+        // `?limit=` must not change a deployed caller's shape, so cursor mode is
+        // triggered by `?after=` or an explicit `?cursor=1` and by nothing else
+        // (`services/plugins/src/common/pagination/cursor.ts`, `wantsCursor`).
+        // Without the opt-in the service ignores `limit` and returns every
+        // non-removed row for the channel, and no page ever carries a cursor — so
+        // `after` is unreachable and `next()` can never fire.
+        const body = await transport.rest('plugins', {
+            method: 'GET',
+            path: '/redirects',
+            query: { cursor: 1, after: options?.after, limit: options?.limit },
+        }, options);
+        // `readRestPage` labels a malformed body as a CMS failure — it takes no
+        // service. Harmless here (the shape check is the same) but worth knowing if
+        // such an error ever shows up against the plugins service.
+        const { items, meta } = readRestPage(body);
+        return createPage(items, meta, (cursor) => list({ ...options, after: cursor }));
+    }
+    return {
+        list,
+        create(input, options) {
+            return transport.rest('plugins', { method: 'POST', path: '/redirects', body: input }, options);
+        },
+        update(id, input, options) {
+            return transport.rest('plugins', { method: 'PATCH', path: `/redirects/${encodeURIComponent(id)}`, body: input }, options);
+        },
+        async delete(id, options) {
+            // The endpoint answers 200 with `{ message }`, not 204 — `expect: 'void'`
+            // discards the body rather than pretending it is a Redirect.
+            await transport.rest('plugins', { method: 'DELETE', path: `/redirects/${encodeURIComponent(id)}`, expect: 'void' }, options);
+        },
+    };
+}

package/dist/tenant/channels.d.ts

@@ -0,0 +1,6 @@
+import type { ChannelInfo, ChannelResolver } from '@sixtyninecommerce/core';
+export interface ChannelsModule {
+    /** Resolve a channel code to its id, token and defaults (cached). */
+    byCode(code: string): Promise<ChannelInfo>;
+}
+export declare function createChannelsModule(resolver: ChannelResolver): ChannelsModule;

package/dist/tenant/channels.js

@@ -0,0 +1,7 @@
+export function createChannelsModule(resolver) {
+    return {
+        byCode(code) {
+            return resolver.resolve(code);
+        },
+    };
+}