@sixtyninecommerce/admin 0.1.0

package/dist/types.d.ts

@@ -0,0 +1,118 @@
+import type { ChannelInfo, TenantContext, TenantScope } from '@sixtyninecommerce/core';
+/** Per-call options every admin method accepts (spec §9.2). */
+export interface Call {
+    /**
+     * Sent as `Idempotency-Key` on a REST write, and ignored on a GraphQL one —
+     * the Admin API has no header for it, so an `apiTokens.*` write is never
+     * deduplicated and a repeat is a second write.
+     *
+     * On REST, two of this SDK's writes are deduplicated by the service itself:
+     * `content.forms.upsertBySlug` (`PUT /forms/by-slug/:slug`) and
+     * `seo.redirects.create` (`POST /redirects`). Repeating one under the same
+     * key replays the first response instead of running it again; sending the
+     * same key with a DIFFERENT body is refused with 409. Everything else
+     * records the key on the wire and acts on nothing.
+     *
+     * Use a fresh key per intended write — a UUIDv7 is ideal — and reuse it only
+     * when retrying that same write. This SDK never retries a write on its own,
+     * so a repeat is always yours to send.
+     */
+    idempotencyKey?: string;
+    tenant?: Partial<TenantContext>;
+    signal?: AbortSignal;
+}
+/** Options for a list method. `after` is the cursor from the previous page. */
+export interface ListOptions extends Call {
+    after?: string;
+    limit?: number;
+}
+/** The signed-in principal, as the Admin API reports it. */
+export interface Me {
+    id: string;
+    identifier: string;
+    channels: Array<{
+        id: string;
+        code: string;
+        token: string;
+        permissions: string[];
+    }>;
+    administrator: {
+        id: string;
+        firstName: string;
+        lastName: string;
+        emailAddress: string;
+    } | null;
+}
+/** What `auth.whoami()` reports about the calling credential. */
+export interface WhoAmI {
+    /** `api_token` never discloses the hidden administrator behind the token. */
+    kind: 'api_token' | 'user';
+    /** Present only for a token principal; null for a human session. */
+    token: {
+        id: string;
+        name: string;
+        tokenPrefix: string;
+        /** Null means the token never expires. */
+        expiresAt: string | null;
+        lastUsedAt: string | null;
+        scopeKind: string;
+    } | null;
+    /** Present only for a human session; null for a token principal. */
+    user: {
+        id: string;
+        identifier: string;
+    } | null;
+    /** Every channel the principal may act on. */
+    channels: Array<{
+        id: string;
+        code: string;
+        permissions: string[];
+    }>;
+    /** Null means unrestricted — location restriction is not implemented yet. */
+    locations: string[] | null;
+    /** Effective permissions on the ACTIVE channel, not the union of all of them. */
+    permissions: string[];
+    /** Connected plugin-catalogue keys for the active channel. */
+    entitlements: string[];
+    /** Reserved for per-token rate limits; always null until they exist. */
+    rateLimit: null;
+}
+export interface ApiToken {
+    id: string;
+    name: string;
+    tokenPrefix: string;
+    permissions: string[];
+    channelId: string;
+    /**
+     * ISO-8601 instant, or null for a token that never expires — the Admin API
+     * models `expiresAt` as nullable and the service returns null when neither
+     * `expiresAt` nor `expiresInDays` was given.
+     */
+    expiresAt: string | null;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+    createdAt: string;
+}
+export interface CreateApiTokenInput {
+    name: string;
+    /** Explicit grants. Union with whatever `templateKeys` expands to. */
+    permissions?: string[];
+    /** Named presets from the platform's permission catalogue. */
+    templateKeys?: string[];
+    /**
+     * ISO-8601 instant WITH an offset; the engine refuses a past date. Wins over
+     * `expiresInDays`. Omit BOTH and the token never expires — the engine allows
+     * it, so the SDK does too rather than inventing a policy.
+     */
+    expiresAt?: string;
+    expiresInDays?: number;
+    /** Defaults to the client's own tenant channel. */
+    channelId?: string;
+}
+/** Expiry is absent on purpose: it is fixed at creation (ADR 2026-07-29). */
+export interface UpdateApiTokenInput {
+    name?: string;
+    permissions?: string[];
+    templateKeys?: string[];
+}
+export type { ChannelInfo, TenantContext, TenantScope };

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@sixtyninecommerce/admin",
+  "version": "0.1.0",
+  "description": "Back-office SDK for sixtynine-commerce: every capability of the platform as a method",
+  "homepage": "https://github.com/SIXTYNINE-digital/sixtynine-commerce-engine/tree/main/packages/admin-client#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SIXTYNINE-digital/sixtynine-commerce-engine.git",
+    "directory": "packages/admin-client"
+  },
+  "bugs": "https://github.com/SIXTYNINE-digital/sixtynine-commerce-engine/issues",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "license": "MIT",
+  "keywords": [
+    "ecommerce",
+    "sdk",
+    "headless",
+    "admin",
+    "vendure"
+  ],
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@sixtyninecommerce/core": "0.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "22.19.7",
+    "typescript": "5.9.3",
+    "vitest": "4.1.6"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsc -p tsconfig.build.json --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:unit": "vitest run",
+    "release:publish": "pnpm pack && npm publish *.tgz --access public"
+  }
+}