@unchainedshop/api 5.0.0-alpha.3 → 5.0.0-alpha.5

package/README.md

@@ -168,8 +168,8 @@ The API layer implements comprehensive security controls.
 |----------|---------|---------|
 | `UNCHAINED_TOKEN_SECRET` | Session encryption (min 32 chars) | Required |
 | `UNCHAINED_COOKIE_NAME` | Cookie name | `unchained_token` |
-| `UNCHAINED_COOKIE_SAMESITE` | SameSite attribute | `none` |
-| `UNCHAINED_COOKIE_INSECURE` | Disable secure flag | `false` |
+| `UNCHAINED_COOKIE_SAMESITE` | SameSite attribute | `lax` |
+| `UNCHAINED_COOKIE_INSECURE` | Disable secure flag (development only) | `false` |
 
 Cookies are `httpOnly` and `secure` by default.
 

package/lib/acl.js

@@ -9,7 +9,11 @@ const SENSITIVE_ACTION_PREFIXES = [
     'forgot',
     'impersonate',
     'updateUser',
+    'removeUser',
     'createUser',
+    'bulkSetUserRoles',
+    'bulkRemoveUsers',
+    'bulkUpdateUserTags',
 ];
 const defaultOptions = {
     showKey: true,

package/lib/adminUiPlugins.d.ts

@@ -1,3 +1,27 @@
+export interface AdminUIThemeTokens {
+    surface?: string;
+    'surface-subtle'?: string;
+    'surface-raised'?: string;
+    'surface-input'?: string;
+    border?: string;
+    'border-subtle'?: string;
+    'text-primary'?: string;
+    'text-secondary'?: string;
+    'text-muted'?: string;
+    'text-on-dark'?: string;
+    accent?: string;
+    'accent-hover'?: string;
+    danger?: string;
+    'danger-surface'?: string;
+    success?: string;
+    warning?: string;
+    'focus-ring'?: string;
+    'text-on-accent'?: string;
+}
+export interface AdminUIThemeConfig {
+    light?: AdminUIThemeTokens;
+    dark?: AdminUIThemeTokens;
+}
 export interface AdminUIPluginEntityConfig {
     path: string;
     label: string;
@@ -61,13 +85,24 @@ interface StaticAsset {
 export interface PreparedPluginAssets {
     routes: Map<string, StaticAsset>;
     validPlugins: AdminUIPluginConfig[];
+    importMapTag: string | null;
+    importMapJSON: string | null;
+}
+export interface PreparedAdminUIHTML {
+    htmlByRoute: Map<string, string>;
+    rootHtml: string;
+    extHtml: string | null;
 }
 export declare const resolveAdminUIPath: () => string | null;
-export declare const parseBundleExports: (bundle: string) => Set<string> | null;
+export declare const prepareAdminUIHTML: (adminUIPath: string) => PreparedAdminUIHTML;
+export declare const resolveAdminUIHTML: (prepared: PreparedAdminUIHTML, urlPath: string, prefix?: string) => string;
+export declare const injectAdminUIImportMap: (prepared: PreparedAdminUIHTML, urlPath: string, importMapTag: string, prefix?: string) => string;
+export declare const parseEsmBundleExports: (bundle: string) => Set<string> | null;
 export declare function preparePluginAssets(plugins: AdminUIPluginConfig[], log: {
     info: (...args: any[]) => void;
     warn: (...args: any[]) => void;
 }, options?: {
     devMode?: boolean;
 }): PreparedPluginAssets;
+export declare function buildImportMapTag(importMapJSON: string, nonce?: string): string;
 export {};

package/lib/adminUiPlugins.js

@@ -1,8 +1,23 @@
 import { createHash } from 'node:crypto';
-import { readFileSync, statSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { join, resolve, sep } from 'node:path';
 const PLUGIN_NAME_RE = /^[a-z0-9]([a-z0-9_-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9_-]*[a-z0-9])?)*$/i;
 const IMMUTABLE_CACHE = 'public, max-age=31536000, immutable';
+const requireFromAPI = createRequire(import.meta.url);
+const loadPluginRuntime = (log) => {
+    try {
+        const runtime = requireFromAPI('@unchainedshop/admin-ui/plugin-runtime');
+        if (!runtime.SHARED_DEP_SHIMS || !runtime.SDK_MODULE_FILES) {
+            throw new Error('runtime module does not expose the expected module graph');
+        }
+        return runtime;
+    }
+    catch (err) {
+        log.warn(`admin-ui plugin runtime could not be loaded; shared plugin modules will be unavailable: ${err.message}`);
+        return null;
+    }
+};
 export const resolveAdminUIPath = () => {
     try {
         const staticURL = import.meta.resolve('@unchainedshop/admin-ui');
@@ -12,17 +27,82 @@ export const resolveAdminUIPath = () => {
         return null;
     }
 };
+const trimTrailingSlashes = (value) => {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/')
+        end -= 1;
+    return value.slice(0, end);
+};
+const normalizeAdminUIRoute = (urlPath, prefix = '/') => {
+    let pathOnly = urlPath.split('?')[0];
+    const normalizedPrefix = `/${trimTrailingSlashes(prefix.replace(/^\/+/, ''))}`;
+    if (normalizedPrefix !== '/' &&
+        (pathOnly === normalizedPrefix || pathOnly.startsWith(`${normalizedPrefix}/`))) {
+        pathOnly = pathOnly.slice(normalizedPrefix.length) || '/';
+    }
+    const withLeadingSlash = pathOnly.startsWith('/') ? pathOnly : `/${pathOnly}`;
+    return trimTrailingSlashes(withLeadingSlash) || '/';
+};
+export const prepareAdminUIHTML = (adminUIPath) => {
+    const htmlByRoute = new Map();
+    let extHtml = null;
+    for (const entry of readdirSync(adminUIPath, { recursive: true })) {
+        const relativePath = String(entry).split(sep).join('/');
+        if (relativePath !== 'index.html' && !relativePath.endsWith('/index.html'))
+            continue;
+        const route = relativePath === 'index.html' ? '/' : `/${relativePath.slice(0, -'/index.html'.length)}`;
+        const html = readFileSync(join(adminUIPath, relativePath), 'utf-8');
+        if (route === '/ext/[[...slug]]') {
+            extHtml = html;
+        }
+        else if (!route.includes('[')) {
+            htmlByRoute.set(route, html);
+        }
+    }
+    const rootHtml = htmlByRoute.get('/');
+    if (!rootHtml) {
+        throw new Error(`admin-ui root index.html not found in ${adminUIPath}`);
+    }
+    return { htmlByRoute, rootHtml, extHtml };
+};
+export const resolveAdminUIHTML = (prepared, urlPath, prefix = '/') => {
+    const route = normalizeAdminUIRoute(urlPath, prefix);
+    const exactHtml = prepared.htmlByRoute.get(route);
+    if (exactHtml)
+        return exactHtml;
+    if (prepared.extHtml && (route === '/ext' || route.startsWith('/ext/'))) {
+        return prepared.extHtml;
+    }
+    return prepared.rootHtml;
+};
+export const injectAdminUIImportMap = (prepared, urlPath, importMapTag, prefix = '/') => resolveAdminUIHTML(prepared, urlPath, prefix).replace('</head>', `${importMapTag}</head>`);
 const contentHash = (content) => createHash('sha256').update(content).digest('hex').slice(0, 8);
-export const parseBundleExports = (bundle) => {
-    const returnMatch = bundle.match(/return __toCommonJS\(([\w$]+)\);/);
-    if (!returnMatch)
-        return null;
-    const blockMatch = bundle.match(new RegExp(`__export\\(${returnMatch[1].replace(/\$/g, '\\$')},\\s*\\{([\\s\\S]*?)\\}\\);`));
-    if (!blockMatch)
-        return null;
+const listSDKDistFiles = (distPath) => {
+    try {
+        if (!statSync(distPath).isDirectory())
+            return [];
+        return readdirSync(distPath, { recursive: true })
+            .map((file) => String(file).split(sep).join('/'))
+            .filter((file) => file.endsWith('.js'));
+    }
+    catch {
+        return [];
+    }
+};
+export const parseEsmBundleExports = (bundle) => {
     const names = new Set();
-    for (const m of blockMatch[1].matchAll(/(?:^|,)\s*(?:"([^"]+)"|([\w$]+)):\s*\(\)\s*=>/g)) {
-        names.add(m[1] ?? m[2]);
+    for (const clause of bundle.matchAll(/(?:^|[;\n])\s*export\s*\{([^}]*)\}/g)) {
+        for (const entry of clause[1].split(',')) {
+            const parts = entry.trim().split(/\s+as\s+/);
+            const exported = (parts[1] ?? parts[0]).trim().replace(/^["']|["']$/g, '');
+            if (exported)
+                names.add(exported);
+        }
+    }
+    if (/(?:^|[;\n])\s*export\s+default\b/.test(bundle))
+        names.add('default');
+    for (const decl of bundle.matchAll(/(?:^|[;\n])\s*export\s+(?:async\s+)?(?:const|let|var|function|class)\s+([\w$]+)/g)) {
+        names.add(decl[1]);
     }
     return names.size > 0 ? names : null;
 };
@@ -48,24 +128,41 @@ const collectReferencedComponents = (plugin) => {
     }
     return [...names];
 };
+const parseBundleSdkVersion = (bundle) => {
+    const match = bundle.match(/^\/\* unchained admin-ui plugin: .+? \(esm, sdk ([^)]+)\) \*\//);
+    return match?.[1] ?? null;
+};
+const readHostSdkVersion = () => {
+    const adminUIPath = resolveAdminUIPath();
+    if (!adminUIPath)
+        return null;
+    try {
+        const pkg = JSON.parse(readFileSync(join(adminUIPath, '..', 'package.json'), 'utf-8'));
+        return typeof pkg.version === 'string' ? pkg.version : null;
+    }
+    catch {
+        return null;
+    }
+};
 export function preparePluginAssets(plugins, log, options = {}) {
     const { devMode = false } = options;
     const routes = new Map();
     const devCacheControl = 'no-cache, no-store, must-revalidate';
-    const validPlugins = plugins.filter((p) => {
+    const namedPlugins = plugins.filter((p) => {
         if (!PLUGIN_NAME_RE.test(p.name)) {
             log.warn(`Skipping admin-ui plugin with invalid name: "${p.name}"`);
             return false;
         }
         return true;
     });
-    const seenNames = new Set();
-    for (const plugin of validPlugins) {
-        if (seenNames.has(plugin.name)) {
+    const validPlugins = namedPlugins.filter((plugin, index) => {
+        const lastIndex = namedPlugins.findLastIndex((p) => p.name === plugin.name);
+        if (index !== lastIndex) {
             log.warn(`Duplicate admin-ui plugin name "${plugin.name}": later entries override earlier ones`);
+            return false;
         }
-        seenNames.add(plugin.name);
-    }
+        return true;
+    });
     if (validPlugins.length > 0) {
         const pluginList = validPlugins
             .map((p) => `${p.name}${p.version ? `@${p.version}` : ''}`)
@@ -86,13 +183,19 @@ export function preparePluginAssets(plugins, log, options = {}) {
         }
     }
     const pluginsWithBundles = validPlugins.filter((p) => pluginBundles.has(p.name));
+    const hostSdkVersion = pluginsWithBundles.length > 0 ? readHostSdkVersion() : null;
     for (const plugin of pluginsWithBundles) {
-        const exportNames = parseBundleExports(pluginBundles.get(plugin.name).content);
-        if (!exportNames)
-            continue;
-        const missing = collectReferencedComponents(plugin).filter((name) => !exportNames.has(name));
-        if (missing.length > 0) {
-            log.warn(`admin-ui plugin "${plugin.name}" references component(s) not exported by its bundle: ${missing.join(', ')}. Exported: ${[...exportNames].join(', ')}`);
+        const bundle = pluginBundles.get(plugin.name).content;
+        const exportNames = parseEsmBundleExports(bundle);
+        if (exportNames) {
+            const missing = collectReferencedComponents(plugin).filter((name) => !exportNames.has(name));
+            if (missing.length > 0) {
+                log.warn(`admin-ui plugin "${plugin.name}" references component(s) not exported by its bundle: ${missing.join(', ')}. Exported: ${[...exportNames].join(', ')}`);
+            }
+        }
+        const bundleSdkVersion = parseBundleSdkVersion(bundle);
+        if (hostSdkVersion && bundleSdkVersion && bundleSdkVersion !== hostSdkVersion) {
+            log.warn(`admin-ui plugin "${plugin.name}" was built against SDK ${bundleSdkVersion} but the running admin-ui is ${hostSdkVersion}. It may still work, but rebuild it against the current @unchainedshop/admin-ui to be safe.`);
         }
     }
     const bundleMtimes = new Map();
@@ -147,7 +250,7 @@ export function preparePluginAssets(plugins, log, options = {}) {
         if (devMode) {
             routes.set(`/admin-plugins/${plugin.name}.js`, {
                 content: () => readFileSync(bundlePath, 'utf-8'),
-                contentType: 'application/javascript',
+                contentType: 'text/javascript',
                 cacheControl: devCacheControl,
             });
         }
@@ -155,10 +258,69 @@ export function preparePluginAssets(plugins, log, options = {}) {
             const { content } = pluginBundles.get(plugin.name);
             routes.set(`/admin-plugins/${plugin.name}.js`, {
                 content,
-                contentType: 'application/javascript',
+                contentType: 'text/javascript',
                 cacheControl: IMMUTABLE_CACHE,
             });
         }
     }
-    return { routes, validPlugins };
+    let importMapTag = null;
+    let importMapContent = null;
+    if (pluginBundles.size > 0) {
+        const runtime = loadPluginRuntime(log);
+        const adminUIPath = resolveAdminUIPath();
+        const distPath = adminUIPath ? join(adminUIPath, '..', 'dist') : null;
+        const sdkFiles = distPath ? listSDKDistFiles(distPath) : [];
+        if (runtime && distPath && sdkFiles.length > 0) {
+            const sdkFileHashes = new Map();
+            for (const file of sdkFiles) {
+                const filePath = join(distPath, file);
+                if (devMode) {
+                    routes.set(`/admin-ui-sdk/${file}`, {
+                        content: () => readFileSync(filePath, 'utf-8'),
+                        contentType: 'text/javascript',
+                        cacheControl: devCacheControl,
+                    });
+                }
+                else {
+                    const content = readFileSync(filePath, 'utf-8');
+                    sdkFileHashes.set(file, contentHash(content));
+                    routes.set(`/admin-ui-sdk/${file}`, {
+                        content,
+                        contentType: 'text/javascript',
+                        cacheControl: IMMUTABLE_CACHE,
+                    });
+                }
+            }
+            const imports = {};
+            for (const [specifier, file] of [
+                ...Object.entries(runtime.SDK_MODULE_FILES),
+                ...Object.entries(runtime.SHARED_DEP_SHIMS),
+            ]) {
+                if (!sdkFiles.includes(file)) {
+                    log.warn(`admin-ui plugin runtime: expected SDK file "${file}" for "${specifier}" not found in ${distPath}`);
+                    continue;
+                }
+                const version = sdkFileHashes.get(file);
+                imports[specifier] = `/admin-ui-sdk/${file}${version ? `?v=${version}` : ''}`;
+            }
+            const importMapJSON = JSON.stringify({ imports });
+            const importMapHash = contentHash(importMapJSON);
+            routes.set('/admin-ui-importmap.json', {
+                content: importMapJSON,
+                contentType: 'application/json',
+                cacheControl: devMode ? devCacheControl : 'public, max-age=0, must-revalidate',
+                etag: `"${importMapHash}"`,
+            });
+            importMapContent = importMapJSON;
+            importMapTag = `<script type="importmap" data-unchained-admin-ui>${importMapJSON}</script>`;
+        }
+        else if (runtime) {
+            log.warn('admin-ui plugin runtime: SDK dist files not found; plugins depending on shared modules will fail to load');
+        }
+    }
+    return { routes, validPlugins, importMapTag, importMapJSON: importMapContent };
+}
+export function buildImportMapTag(importMapJSON, nonce) {
+    const nonceAttr = nonce ? ` nonce="${nonce}"` : '';
+    return `<script type="importmap" data-unchained-admin-ui${nonceAttr}>${importMapJSON}</script>`;
 }

package/lib/auth.d.ts

@@ -2,7 +2,6 @@ export interface AccessTokenPayload {
     iss: string;
     sub: string;
     ver: number;
-    fgp?: string;
     imp?: string;
     jti?: string;
     iat?: number;
@@ -16,14 +15,8 @@ export interface OIDCProviderConfig {
 export interface AuthConfig {
     oidcProviders?: OIDCProviderConfig[];
 }
-export declare function generateFingerprint(): {
-    raw: string;
-    hash: string;
-};
-export declare function verifyFingerprint(raw: string, hash: string): boolean;
 export declare function signAccessToken(userId: string, tokenVersion: number, options?: {
     impersonatorId?: string;
-    fingerprintHash?: string;
 }): Promise<{
     token: string;
     expires: Date;
@@ -37,7 +30,6 @@ export interface AuthHandlerResult {
     userId?: string;
     tokenVersion?: number;
     impersonatorId?: string;
-    fingerprintHash?: string;
     accessToken?: string;
     isApiKey?: boolean;
 }

package/lib/auth.js

@@ -1,6 +1,5 @@
 import { createLogger } from '@unchainedshop/logger';
 import * as jose from 'jose';
-import { createHash } from 'crypto';
 const logger = createLogger('unchained:api:auth');
 const { UNCHAINED_TOKEN_SECRET, UNCHAINED_TOKEN_EXPIRY_SECONDS = '3600', UNCHAINED_TOKEN_ISSUER = 'unchained-engine', } = process.env;
 const MIN_SECRET_LENGTH = 32;
@@ -11,21 +10,6 @@ function validateSecretStrength(secret) {
             `Current length: ${secret.length}. Generate a secure secret with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"`);
     }
 }
-export function generateFingerprint() {
-    const raw = crypto.randomUUID() + crypto.randomUUID();
-    const hash = createHash('sha256').update(raw).digest('hex');
-    return { raw, hash };
-}
-export function verifyFingerprint(raw, hash) {
-    const computedHash = createHash('sha256').update(raw).digest('hex');
-    if (computedHash.length !== hash.length)
-        return false;
-    let result = 0;
-    for (let i = 0; i < computedHash.length; i++) {
-        result |= computedHash.charCodeAt(i) ^ hash.charCodeAt(i);
-    }
-    return result === 0;
-}
 export async function signAccessToken(userId, tokenVersion, options) {
     if (!UNCHAINED_TOKEN_SECRET) {
         throw new Error('UNCHAINED_TOKEN_SECRET environment variable is required');
@@ -38,9 +22,6 @@ export async function signAccessToken(userId, tokenVersion, options) {
         ver: tokenVersion,
         jti: crypto.randomUUID(),
     };
-    if (options?.fingerprintHash) {
-        payload.fgp = options.fingerprintHash;
-    }
     if (options?.impersonatorId) {
         payload.imp = options.impersonatorId;
     }
@@ -168,7 +149,6 @@ export function createAuthHandler(config) {
                 userId: localPayload.sub,
                 tokenVersion: localPayload.ver,
                 impersonatorId: localPayload.imp,
-                fingerprintHash: localPayload.fgp,
             };
         }
         if (config?.oidcProviders?.length) {

package/lib/errors.d.ts

@@ -19,6 +19,7 @@ export declare const CurrencyNotFoundError: any;
 export declare const DeliverProviderNotFoundError: any;
 export declare const LanguageNotFoundError: any;
 export declare const UserNotFoundError: any;
+export declare const LastAdminError: any;
 export declare const UserWebAuthnCredentialsNotFoundError: any;
 export declare const WebAuthnDisabledError: any;
 export declare const UserWeb3AddressNotFoundError: any;
@@ -56,6 +57,7 @@ export declare const EnrollmentWrongStatusError: any;
 export declare const EnrollmentNotFoundError: any;
 export declare const WarehousingProviderNotFoundError: any;
 export declare const InvalidIdError: any;
+export declare const BulkOperationTooLargeError: any;
 export declare const ProviderConfigurationInvalid: any;
 export declare const TokenWrongStatusError: any;
 export declare const TokenNotFoundError: any;

package/lib/errors.js

@@ -29,6 +29,7 @@ export const CurrencyNotFoundError = createError('CurrencyNotFoundError', 'Curre
 export const DeliverProviderNotFoundError = createError('DeliverProviderNotFoundError', 'Delivery provider not found');
 export const LanguageNotFoundError = createError('LanguageNotFoundError', 'Language not found');
 export const UserNotFoundError = createError('UserNotFoundError', 'User not found');
+export const LastAdminError = createError('LastAdminError', 'At least one active administrator is required. Assign another administrator before removing this account or revoking its admin role.');
 export const UserWebAuthnCredentialsNotFoundError = createError('UserWebAuthnCredentialsNotFoundError', 'User WebAuth Credentials not found');
 export const WebAuthnDisabledError = createError('WebAuthnDisabledError', 'WebAuthn disabled');
 export const UserWeb3AddressNotFoundError = createError('UserWeb3AddressNotFoundError', 'Web3 Account not found for User');
@@ -66,6 +67,7 @@ export const EnrollmentWrongStatusError = createError('EnrollmentWrongStatusErro
 export const EnrollmentNotFoundError = createError('EnrollmentNotFoundError', 'Enrollment not found');
 export const WarehousingProviderNotFoundError = createError('WarehousingProviderNotFoundError', 'Warehousing provider not found');
 export const InvalidIdError = createError('InvalidIdError', 'Invalid ID provided');
+export const BulkOperationTooLargeError = createError('BulkOperationTooLargeError', 'Bulk operation exceeds the maximum number of entities');
 export const ProviderConfigurationInvalid = createError('ProviderConfigurationInvalid', 'Provider Configuration invalid (check if the Adapter Key exists)');
 export const TokenWrongStatusError = createError('TokenWrongStatusError', 'The current status of the token does not allow this operation');
 export const TokenNotFoundError = createError('TokenNotFoundError', 'Token not found');

package/lib/events.d.ts

@@ -1,5 +1,6 @@
 export declare const API_EVENTS: {
     readonly API_LOGIN_TOKEN_CREATED: "API_LOGIN_TOKEN_CREATED";
+    readonly API_LOGIN_FAILED: "API_LOGIN_FAILED";
     readonly API_LOGOUT: "API_LOGOUT";
     readonly ACL_DENIED: "ACL_DENIED";
     readonly ACL_GRANTED_SENSITIVE: "ACL_GRANTED_SENSITIVE";

package/lib/events.js

@@ -1,5 +1,6 @@
 export const API_EVENTS = {
     API_LOGIN_TOKEN_CREATED: 'API_LOGIN_TOKEN_CREATED',
+    API_LOGIN_FAILED: 'API_LOGIN_FAILED',
     API_LOGOUT: 'API_LOGOUT',
     ACL_DENIED: 'ACL_DENIED',
     ACL_GRANTED_SENSITIVE: 'ACL_GRANTED_SENSITIVE',

package/lib/express/chatHandler.js

@@ -43,6 +43,16 @@ const setupMCPChatHandler = (chatConfiguration) => {
             res.status(405).json({ error: 'Method Not Allowed. Use POST.' });
             return;
         }
+        const unchainedContext = req.unchainedContext;
+        const user = unchainedContext?.user;
+        if (!user) {
+            res.status(401).json({ error: 'unauthorized' });
+            return;
+        }
+        if (!(user.roles || []).includes('admin')) {
+            res.status(403).json({ error: 'forbidden', message: 'Chat requires admin privileges' });
+            return;
+        }
         let client;
         const lifecycle = createChatRequestLifecycle(res, configuredAbortSignal);
         try {
@@ -52,13 +62,14 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     url: unchainedMCPUrl,
                     headers: {
                         Cookie: req.headers.cookie || '',
+                        ...(req.headers.authorization ? { Authorization: req.headers.authorization } : {}),
                     },
                 },
                 initializationOptions: { signal: lifecycle.signal },
             });
             lifecycle.setClientClose(() => client.close());
             const defaultUnchainedTools = await client.tools();
-            const resourceContext = await buildChatResourceContext(req.unchainedContext);
+            const resourceContext = await buildChatResourceContext(unchainedContext);
             const tools = {
                 ...defaultUnchainedTools,
                 ...additionalTools,

package/lib/express/index.d.ts

@@ -4,10 +4,8 @@ import type { UnchainedCore } from '@unchainedshop/core';
 import type { AuthConfig } from '../auth.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
 import { connectChat } from './chatHandler.ts';
-import { type AdminUIThemeConfig } from '@unchainedshop/admin-ui/theme';
-import { type AdminUIPluginConfig } from '../adminUiPlugins.ts';
-export type { AdminUIPluginConfig, AdminUIPluginEntityConfig, AdminUIPluginPageConfig, AdminUIPluginTabConfig, AdminUIPluginWidgetConfig, AdminUIPluginSlotConfig, } from '../adminUiPlugins.ts';
-export type { AdminUIThemeTokens, AdminUIThemeConfig } from '@unchainedshop/admin-ui/theme';
+import { type AdminUIPluginConfig, type AdminUIThemeConfig } from '../adminUiPlugins.ts';
+export type { AdminUIPluginConfig, AdminUIPluginEntityConfig, AdminUIPluginPageConfig, AdminUIPluginTabConfig, AdminUIPluginWidgetConfig, AdminUIPluginSlotConfig, AdminUIThemeTokens, AdminUIThemeConfig, } from '../adminUiPlugins.ts';
 export interface AdminUIRouterOptions {
     prefix?: string;
     enabled?: boolean;