@unchainedshop/api 5.0.0-alpha.4 → 5.0.0-alpha.5

package/lib/acl.js

@@ -9,7 +9,11 @@ const SENSITIVE_ACTION_PREFIXES = [
     'forgot',
     'impersonate',
     'updateUser',
+    'removeUser',
     'createUser',
+    'bulkSetUserRoles',
+    'bulkRemoveUsers',
+    'bulkUpdateUserTags',
 ];
 const defaultOptions = {
     showKey: true,

package/lib/adminUiPlugins.d.ts

@@ -85,13 +85,24 @@ interface StaticAsset {
 export interface PreparedPluginAssets {
     routes: Map<string, StaticAsset>;
     validPlugins: AdminUIPluginConfig[];
+    importMapTag: string | null;
+    importMapJSON: string | null;
+}
+export interface PreparedAdminUIHTML {
+    htmlByRoute: Map<string, string>;
+    rootHtml: string;
+    extHtml: string | null;
 }
 export declare const resolveAdminUIPath: () => string | null;
-export declare const parseBundleExports: (bundle: string) => Set<string> | null;
+export declare const prepareAdminUIHTML: (adminUIPath: string) => PreparedAdminUIHTML;
+export declare const resolveAdminUIHTML: (prepared: PreparedAdminUIHTML, urlPath: string, prefix?: string) => string;
+export declare const injectAdminUIImportMap: (prepared: PreparedAdminUIHTML, urlPath: string, importMapTag: string, prefix?: string) => string;
+export declare const parseEsmBundleExports: (bundle: string) => Set<string> | null;
 export declare function preparePluginAssets(plugins: AdminUIPluginConfig[], log: {
     info: (...args: any[]) => void;
     warn: (...args: any[]) => void;
 }, options?: {
     devMode?: boolean;
 }): PreparedPluginAssets;
+export declare function buildImportMapTag(importMapJSON: string, nonce?: string): string;
 export {};

package/lib/adminUiPlugins.js

@@ -1,8 +1,23 @@
 import { createHash } from 'node:crypto';
-import { readFileSync, statSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { join, resolve, sep } from 'node:path';
 const PLUGIN_NAME_RE = /^[a-z0-9]([a-z0-9_-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9_-]*[a-z0-9])?)*$/i;
 const IMMUTABLE_CACHE = 'public, max-age=31536000, immutable';
+const requireFromAPI = createRequire(import.meta.url);
+const loadPluginRuntime = (log) => {
+    try {
+        const runtime = requireFromAPI('@unchainedshop/admin-ui/plugin-runtime');
+        if (!runtime.SHARED_DEP_SHIMS || !runtime.SDK_MODULE_FILES) {
+            throw new Error('runtime module does not expose the expected module graph');
+        }
+        return runtime;
+    }
+    catch (err) {
+        log.warn(`admin-ui plugin runtime could not be loaded; shared plugin modules will be unavailable: ${err.message}`);
+        return null;
+    }
+};
 export const resolveAdminUIPath = () => {
     try {
         const staticURL = import.meta.resolve('@unchainedshop/admin-ui');
@@ -12,17 +27,82 @@ export const resolveAdminUIPath = () => {
         return null;
     }
 };
+const trimTrailingSlashes = (value) => {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/')
+        end -= 1;
+    return value.slice(0, end);
+};
+const normalizeAdminUIRoute = (urlPath, prefix = '/') => {
+    let pathOnly = urlPath.split('?')[0];
+    const normalizedPrefix = `/${trimTrailingSlashes(prefix.replace(/^\/+/, ''))}`;
+    if (normalizedPrefix !== '/' &&
+        (pathOnly === normalizedPrefix || pathOnly.startsWith(`${normalizedPrefix}/`))) {
+        pathOnly = pathOnly.slice(normalizedPrefix.length) || '/';
+    }
+    const withLeadingSlash = pathOnly.startsWith('/') ? pathOnly : `/${pathOnly}`;
+    return trimTrailingSlashes(withLeadingSlash) || '/';
+};
+export const prepareAdminUIHTML = (adminUIPath) => {
+    const htmlByRoute = new Map();
+    let extHtml = null;
+    for (const entry of readdirSync(adminUIPath, { recursive: true })) {
+        const relativePath = String(entry).split(sep).join('/');
+        if (relativePath !== 'index.html' && !relativePath.endsWith('/index.html'))
+            continue;
+        const route = relativePath === 'index.html' ? '/' : `/${relativePath.slice(0, -'/index.html'.length)}`;
+        const html = readFileSync(join(adminUIPath, relativePath), 'utf-8');
+        if (route === '/ext/[[...slug]]') {
+            extHtml = html;
+        }
+        else if (!route.includes('[')) {
+            htmlByRoute.set(route, html);
+        }
+    }
+    const rootHtml = htmlByRoute.get('/');
+    if (!rootHtml) {
+        throw new Error(`admin-ui root index.html not found in ${adminUIPath}`);
+    }
+    return { htmlByRoute, rootHtml, extHtml };
+};
+export const resolveAdminUIHTML = (prepared, urlPath, prefix = '/') => {
+    const route = normalizeAdminUIRoute(urlPath, prefix);
+    const exactHtml = prepared.htmlByRoute.get(route);
+    if (exactHtml)
+        return exactHtml;
+    if (prepared.extHtml && (route === '/ext' || route.startsWith('/ext/'))) {
+        return prepared.extHtml;
+    }
+    return prepared.rootHtml;
+};
+export const injectAdminUIImportMap = (prepared, urlPath, importMapTag, prefix = '/') => resolveAdminUIHTML(prepared, urlPath, prefix).replace('</head>', `${importMapTag}</head>`);
 const contentHash = (content) => createHash('sha256').update(content).digest('hex').slice(0, 8);
-export const parseBundleExports = (bundle) => {
-    const returnMatch = bundle.match(/return __toCommonJS\(([\w$]+)\);/);
-    if (!returnMatch)
-        return null;
-    const blockMatch = bundle.match(new RegExp(`__export\\(${returnMatch[1].replace(/\$/g, '\\$')},\\s*\\{([\\s\\S]*?)\\}\\);`));
-    if (!blockMatch)
-        return null;
+const listSDKDistFiles = (distPath) => {
+    try {
+        if (!statSync(distPath).isDirectory())
+            return [];
+        return readdirSync(distPath, { recursive: true })
+            .map((file) => String(file).split(sep).join('/'))
+            .filter((file) => file.endsWith('.js'));
+    }
+    catch {
+        return [];
+    }
+};
+export const parseEsmBundleExports = (bundle) => {
     const names = new Set();
-    for (const m of blockMatch[1].matchAll(/(?:^|,)\s*(?:"([^"]+)"|([\w$]+)):\s*\(\)\s*=>/g)) {
-        names.add(m[1] ?? m[2]);
+    for (const clause of bundle.matchAll(/(?:^|[;\n])\s*export\s*\{([^}]*)\}/g)) {
+        for (const entry of clause[1].split(',')) {
+            const parts = entry.trim().split(/\s+as\s+/);
+            const exported = (parts[1] ?? parts[0]).trim().replace(/^["']|["']$/g, '');
+            if (exported)
+                names.add(exported);
+        }
+    }
+    if (/(?:^|[;\n])\s*export\s+default\b/.test(bundle))
+        names.add('default');
+    for (const decl of bundle.matchAll(/(?:^|[;\n])\s*export\s+(?:async\s+)?(?:const|let|var|function|class)\s+([\w$]+)/g)) {
+        names.add(decl[1]);
     }
     return names.size > 0 ? names : null;
 };
@@ -48,24 +128,41 @@ const collectReferencedComponents = (plugin) => {
     }
     return [...names];
 };
+const parseBundleSdkVersion = (bundle) => {
+    const match = bundle.match(/^\/\* unchained admin-ui plugin: .+? \(esm, sdk ([^)]+)\) \*\//);
+    return match?.[1] ?? null;
+};
+const readHostSdkVersion = () => {
+    const adminUIPath = resolveAdminUIPath();
+    if (!adminUIPath)
+        return null;
+    try {
+        const pkg = JSON.parse(readFileSync(join(adminUIPath, '..', 'package.json'), 'utf-8'));
+        return typeof pkg.version === 'string' ? pkg.version : null;
+    }
+    catch {
+        return null;
+    }
+};
 export function preparePluginAssets(plugins, log, options = {}) {
     const { devMode = false } = options;
     const routes = new Map();
     const devCacheControl = 'no-cache, no-store, must-revalidate';
-    const validPlugins = plugins.filter((p) => {
+    const namedPlugins = plugins.filter((p) => {
         if (!PLUGIN_NAME_RE.test(p.name)) {
             log.warn(`Skipping admin-ui plugin with invalid name: "${p.name}"`);
             return false;
         }
         return true;
     });
-    const seenNames = new Set();
-    for (const plugin of validPlugins) {
-        if (seenNames.has(plugin.name)) {
+    const validPlugins = namedPlugins.filter((plugin, index) => {
+        const lastIndex = namedPlugins.findLastIndex((p) => p.name === plugin.name);
+        if (index !== lastIndex) {
             log.warn(`Duplicate admin-ui plugin name "${plugin.name}": later entries override earlier ones`);
+            return false;
         }
-        seenNames.add(plugin.name);
-    }
+        return true;
+    });
     if (validPlugins.length > 0) {
         const pluginList = validPlugins
             .map((p) => `${p.name}${p.version ? `@${p.version}` : ''}`)
@@ -86,13 +183,19 @@ export function preparePluginAssets(plugins, log, options = {}) {
         }
     }
     const pluginsWithBundles = validPlugins.filter((p) => pluginBundles.has(p.name));
+    const hostSdkVersion = pluginsWithBundles.length > 0 ? readHostSdkVersion() : null;
     for (const plugin of pluginsWithBundles) {
-        const exportNames = parseBundleExports(pluginBundles.get(plugin.name).content);
-        if (!exportNames)
-            continue;
-        const missing = collectReferencedComponents(plugin).filter((name) => !exportNames.has(name));
-        if (missing.length > 0) {
-            log.warn(`admin-ui plugin "${plugin.name}" references component(s) not exported by its bundle: ${missing.join(', ')}. Exported: ${[...exportNames].join(', ')}`);
+        const bundle = pluginBundles.get(plugin.name).content;
+        const exportNames = parseEsmBundleExports(bundle);
+        if (exportNames) {
+            const missing = collectReferencedComponents(plugin).filter((name) => !exportNames.has(name));
+            if (missing.length > 0) {
+                log.warn(`admin-ui plugin "${plugin.name}" references component(s) not exported by its bundle: ${missing.join(', ')}. Exported: ${[...exportNames].join(', ')}`);
+            }
+        }
+        const bundleSdkVersion = parseBundleSdkVersion(bundle);
+        if (hostSdkVersion && bundleSdkVersion && bundleSdkVersion !== hostSdkVersion) {
+            log.warn(`admin-ui plugin "${plugin.name}" was built against SDK ${bundleSdkVersion} but the running admin-ui is ${hostSdkVersion}. It may still work, but rebuild it against the current @unchainedshop/admin-ui to be safe.`);
         }
     }
     const bundleMtimes = new Map();
@@ -147,7 +250,7 @@ export function preparePluginAssets(plugins, log, options = {}) {
         if (devMode) {
             routes.set(`/admin-plugins/${plugin.name}.js`, {
                 content: () => readFileSync(bundlePath, 'utf-8'),
-                contentType: 'application/javascript',
+                contentType: 'text/javascript',
                 cacheControl: devCacheControl,
             });
         }
@@ -155,10 +258,69 @@ export function preparePluginAssets(plugins, log, options = {}) {
             const { content } = pluginBundles.get(plugin.name);
             routes.set(`/admin-plugins/${plugin.name}.js`, {
                 content,
-                contentType: 'application/javascript',
+                contentType: 'text/javascript',
                 cacheControl: IMMUTABLE_CACHE,
             });
         }
     }
-    return { routes, validPlugins };
+    let importMapTag = null;
+    let importMapContent = null;
+    if (pluginBundles.size > 0) {
+        const runtime = loadPluginRuntime(log);
+        const adminUIPath = resolveAdminUIPath();
+        const distPath = adminUIPath ? join(adminUIPath, '..', 'dist') : null;
+        const sdkFiles = distPath ? listSDKDistFiles(distPath) : [];
+        if (runtime && distPath && sdkFiles.length > 0) {
+            const sdkFileHashes = new Map();
+            for (const file of sdkFiles) {
+                const filePath = join(distPath, file);
+                if (devMode) {
+                    routes.set(`/admin-ui-sdk/${file}`, {
+                        content: () => readFileSync(filePath, 'utf-8'),
+                        contentType: 'text/javascript',
+                        cacheControl: devCacheControl,
+                    });
+                }
+                else {
+                    const content = readFileSync(filePath, 'utf-8');
+                    sdkFileHashes.set(file, contentHash(content));
+                    routes.set(`/admin-ui-sdk/${file}`, {
+                        content,
+                        contentType: 'text/javascript',
+                        cacheControl: IMMUTABLE_CACHE,
+                    });
+                }
+            }
+            const imports = {};
+            for (const [specifier, file] of [
+                ...Object.entries(runtime.SDK_MODULE_FILES),
+                ...Object.entries(runtime.SHARED_DEP_SHIMS),
+            ]) {
+                if (!sdkFiles.includes(file)) {
+                    log.warn(`admin-ui plugin runtime: expected SDK file "${file}" for "${specifier}" not found in ${distPath}`);
+                    continue;
+                }
+                const version = sdkFileHashes.get(file);
+                imports[specifier] = `/admin-ui-sdk/${file}${version ? `?v=${version}` : ''}`;
+            }
+            const importMapJSON = JSON.stringify({ imports });
+            const importMapHash = contentHash(importMapJSON);
+            routes.set('/admin-ui-importmap.json', {
+                content: importMapJSON,
+                contentType: 'application/json',
+                cacheControl: devMode ? devCacheControl : 'public, max-age=0, must-revalidate',
+                etag: `"${importMapHash}"`,
+            });
+            importMapContent = importMapJSON;
+            importMapTag = `<script type="importmap" data-unchained-admin-ui>${importMapJSON}</script>`;
+        }
+        else if (runtime) {
+            log.warn('admin-ui plugin runtime: SDK dist files not found; plugins depending on shared modules will fail to load');
+        }
+    }
+    return { routes, validPlugins, importMapTag, importMapJSON: importMapContent };
+}
+export function buildImportMapTag(importMapJSON, nonce) {
+    const nonceAttr = nonce ? ` nonce="${nonce}"` : '';
+    return `<script type="importmap" data-unchained-admin-ui${nonceAttr}>${importMapJSON}</script>`;
 }

package/lib/errors.d.ts

@@ -19,6 +19,7 @@ export declare const CurrencyNotFoundError: any;
 export declare const DeliverProviderNotFoundError: any;
 export declare const LanguageNotFoundError: any;
 export declare const UserNotFoundError: any;
+export declare const LastAdminError: any;
 export declare const UserWebAuthnCredentialsNotFoundError: any;
 export declare const WebAuthnDisabledError: any;
 export declare const UserWeb3AddressNotFoundError: any;
@@ -56,6 +57,7 @@ export declare const EnrollmentWrongStatusError: any;
 export declare const EnrollmentNotFoundError: any;
 export declare const WarehousingProviderNotFoundError: any;
 export declare const InvalidIdError: any;
+export declare const BulkOperationTooLargeError: any;
 export declare const ProviderConfigurationInvalid: any;
 export declare const TokenWrongStatusError: any;
 export declare const TokenNotFoundError: any;

package/lib/errors.js

@@ -29,6 +29,7 @@ export const CurrencyNotFoundError = createError('CurrencyNotFoundError', 'Curre
 export const DeliverProviderNotFoundError = createError('DeliverProviderNotFoundError', 'Delivery provider not found');
 export const LanguageNotFoundError = createError('LanguageNotFoundError', 'Language not found');
 export const UserNotFoundError = createError('UserNotFoundError', 'User not found');
+export const LastAdminError = createError('LastAdminError', 'At least one active administrator is required. Assign another administrator before removing this account or revoking its admin role.');
 export const UserWebAuthnCredentialsNotFoundError = createError('UserWebAuthnCredentialsNotFoundError', 'User WebAuth Credentials not found');
 export const WebAuthnDisabledError = createError('WebAuthnDisabledError', 'WebAuthn disabled');
 export const UserWeb3AddressNotFoundError = createError('UserWeb3AddressNotFoundError', 'Web3 Account not found for User');
@@ -66,6 +67,7 @@ export const EnrollmentWrongStatusError = createError('EnrollmentWrongStatusErro
 export const EnrollmentNotFoundError = createError('EnrollmentNotFoundError', 'Enrollment not found');
 export const WarehousingProviderNotFoundError = createError('WarehousingProviderNotFoundError', 'Warehousing provider not found');
 export const InvalidIdError = createError('InvalidIdError', 'Invalid ID provided');
+export const BulkOperationTooLargeError = createError('BulkOperationTooLargeError', 'Bulk operation exceeds the maximum number of entities');
 export const ProviderConfigurationInvalid = createError('ProviderConfigurationInvalid', 'Provider Configuration invalid (check if the Adapter Key exists)');
 export const TokenWrongStatusError = createError('TokenWrongStatusError', 'The current status of the token does not allow this operation');
 export const TokenNotFoundError = createError('TokenNotFoundError', 'Token not found');

package/lib/events.d.ts

@@ -1,5 +1,6 @@
 export declare const API_EVENTS: {
     readonly API_LOGIN_TOKEN_CREATED: "API_LOGIN_TOKEN_CREATED";
+    readonly API_LOGIN_FAILED: "API_LOGIN_FAILED";
     readonly API_LOGOUT: "API_LOGOUT";
     readonly ACL_DENIED: "ACL_DENIED";
     readonly ACL_GRANTED_SENSITIVE: "ACL_GRANTED_SENSITIVE";

package/lib/events.js

@@ -1,5 +1,6 @@
 export const API_EVENTS = {
     API_LOGIN_TOKEN_CREATED: 'API_LOGIN_TOKEN_CREATED',
+    API_LOGIN_FAILED: 'API_LOGIN_FAILED',
     API_LOGOUT: 'API_LOGOUT',
     ACL_DENIED: 'ACL_DENIED',
     ACL_GRANTED_SENSITIVE: 'ACL_GRANTED_SENSITIVE',

package/lib/express/index.js

@@ -1,16 +1,23 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
 import e from 'express';
 import cookieParser from 'cookie-parser';
 import { pluginRegistry } from '@unchainedshop/core';
 import { createHash } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { runWithAuditContext } from '@unchainedshop/events';
 import { getCurrentContextResolver } from "../context.js";
 import { createAuthContext } from "../middleware/createAuthMiddleware.js";
 import createMCPMiddleware from "./createMCPMiddleware.js";
 import { connectChat } from "./chatHandler.js";
 import { mountRoutes } from "./mountRoutes.js";
 import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
-import { preparePluginAssets, resolveAdminUIPath, } from "../adminUiPlugins.js";
+import { preparePluginAssets, prepareAdminUIHTML, resolveAdminUIHTML, injectAdminUIImportMap, buildImportMapTag, resolveAdminUIPath, } from "../adminUiPlugins.js";
 export const adminUIRouter = (enabled = true, theme, plugins = []) => {
     const router = e.Router();
     const adminUIPath = resolveAdminUIPath();
@@ -22,7 +29,8 @@ export const adminUIRouter = (enabled = true, theme, plugins = []) => {
             let css = '/* default theme */';
             if (theme) {
                 try {
-                    const { generateThemeCSS } = await import('@unchainedshop/admin-ui/theme');
+                    const themeModuleUrl = import.meta.resolve('@unchainedshop/admin-ui/theme');
+                    const { generateThemeCSS } = await import(__rewriteRelativeImportExtension(themeModuleUrl));
                     css = generateThemeCSS(theme);
                 }
                 catch {
@@ -45,7 +53,7 @@ export const adminUIRouter = (enabled = true, theme, plugins = []) => {
         });
         const log = { info: console.info, warn: console.warn };
         const devMode = process.env.NODE_ENV !== 'production';
-        const { routes: pluginRoutes } = preparePluginAssets(plugins, log, { devMode });
+        const { routes: pluginRoutes, importMapTag, importMapJSON, } = preparePluginAssets(plugins, log, { devMode });
         for (const [path, asset] of pluginRoutes) {
             router.get(path, (req, res) => {
                 if (asset.etag) {
@@ -63,16 +71,23 @@ export const adminUIRouter = (enabled = true, theme, plugins = []) => {
                     .send(body);
             });
         }
-        router.use(e.static(adminUIPath));
-        const extHtmlPath = join(adminUIPath, 'ext', '[[...slug]]', 'index.html');
-        const hasExtHtml = existsSync(extHtmlPath);
-        router.get(/(.*)/, (req, res) => {
-            const urlPath = req.path.replace(/\/+$/, '');
-            if (hasExtHtml && (urlPath === '/ext' || urlPath.startsWith('/ext/'))) {
-                return res.sendFile(extHtmlPath);
-            }
-            return res.sendFile(join(adminUIPath, 'index.html'));
-        });
+        router.use(e.static(adminUIPath, importMapTag ? { index: false } : undefined));
+        if (importMapJSON) {
+            const preparedHTML = prepareAdminUIHTML(adminUIPath);
+            router.get(/(.*)/, (req, res) => {
+                if (devMode)
+                    res.set('Cache-Control', 'no-cache');
+                const nonce = res.locals?.cspNonce;
+                const tag = nonce ? buildImportMapTag(importMapJSON, nonce) : importMapTag;
+                return res.type('text/html').send(injectAdminUIImportMap(preparedHTML, req.path, tag));
+            });
+        }
+        else {
+            const preparedHTML = prepareAdminUIHTML(adminUIPath);
+            router.get(/(.*)/, (req, res) => {
+                return res.type('text/html').send(resolveAdminUIHTML(preparedHTML, req.path));
+            });
+        }
     }
     return router;
 };
@@ -112,7 +127,7 @@ const createAddContextMiddleware = (authConfig, trustProxy = false) => async fun
         };
         const authContext = await createAuthContext(authContextParams, authConfig);
         const context = getCurrentContextResolver();
-        req.unchainedContext = await context({
+        const unchainedContext = await context({
             setHeader,
             getHeader,
             remoteAddress,
@@ -124,6 +139,12 @@ const createAddContextMiddleware = (authConfig, trustProxy = false) => async fun
             impersonatorId: authContext.impersonatorId,
             tokenVersion: authContext.tokenVersion,
         }, req, res);
+        req.unchainedContext = unchainedContext;
+        req._auditContext = {
+            userId: unchainedContext.userId,
+            userName: unchainedContext.user?.username || unchainedContext.user?.emails?.[0]?.address,
+            remoteAddress,
+        };
         next();
     }
     catch (error) {
@@ -152,7 +173,13 @@ export const connect = async (expressApp, { graphqlHandler, unchainedAPI, }, { a
     }
     expressApp.use(cookieParser());
     expressApp.use(createAddContextMiddleware(authConfig, trustProxy || allowRemoteToLocalhostSecureCookies));
-    expressApp.use(graphqlHandler.graphqlEndpoint, graphqlHandler.handle);
+    expressApp.use(graphqlHandler.graphqlEndpoint, (req, res) => {
+        const auditCtx = req._auditContext;
+        if (auditCtx) {
+            return runWithAuditContext(auditCtx, () => graphqlHandler.handle(req, res));
+        }
+        return graphqlHandler.handle(req, res);
+    });
     expressApp.use(MCP_API_PATH, e.json({ limit: '10mb' }));
     expressApp.use(MCP_API_PATH, createMCPMiddleware);
     if (chat) {

package/lib/fastify/index.d.ts

@@ -11,6 +11,8 @@ export interface AdminUIRouterOptions {
     enabled?: boolean;
     theme?: AdminUIThemeConfig;
     plugins?: AdminUIPluginConfig[];
+    importMapTag?: string | null;
+    importMapJSON?: string | null;
 }
 export declare const unchainedLogger: (prefix: string) => FastifyBaseLogger;
 export declare const connect: (fastify: FastifyInstance, { graphqlHandler, unchainedAPI, }: {

package/lib/fastify/index.js

@@ -1,3 +1,12 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { runWithAuditContext } from '@unchainedshop/events';
 import { getCurrentContextResolver } from "../context.js";
 import { createAuthContext } from "../middleware/createAuthMiddleware.js";
 import { pluginRegistry } from '@unchainedshop/core';
@@ -7,10 +16,9 @@ import mcpHandler from "./mcpHandler.js";
 import { connectChat } from "./chatHandler.js";
 import { mountRoutes } from "./mountRoutes.js";
 import { createHash } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
 import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
-import { preparePluginAssets, resolveAdminUIPath, } from "../adminUiPlugins.js";
+import { preparePluginAssets, prepareAdminUIHTML, resolveAdminUIHTML, injectAdminUIImportMap, buildImportMapTag, resolveAdminUIPath, } from "../adminUiPlugins.js";
 const resolveUserRemoteAddress = (req, trustProxy = false) => {
     let remoteAddress;
     if (trustProxy) {
@@ -46,7 +54,7 @@ const createMiddlewareHook = (authConfig, trustProxy = false) => async function
     };
     const authContext = await createAuthContext(authContextParams, authConfig);
     const context = getCurrentContextResolver();
-    req.unchainedContext = await context({
+    const unchainedContext = await context({
         setHeader,
         getHeader,
         remoteAddress,
@@ -58,6 +66,12 @@ const createMiddlewareHook = (authConfig, trustProxy = false) => async function
         impersonatorId: authContext.impersonatorId,
         tokenVersion: authContext.tokenVersion,
     }, req, reply);
+    req.unchainedContext = unchainedContext;
+    req._auditContext = {
+        userId: unchainedContext.userId,
+        userName: unchainedContext.user?.username || unchainedContext.user?.emails?.[0]?.address,
+        remoteAddress,
+    };
 };
 export const unchainedLogger = (prefix) => {
     const logger = createLogger(prefix);
@@ -103,10 +117,15 @@ export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allo
         url: graphqlHandler.graphqlEndpoint,
         method: ['GET', 'POST', 'OPTIONS'],
         handler: async (req, reply) => {
-            return graphqlHandler.handleNodeRequestAndResponse(req, reply, {
+            const auditCtx = req._auditContext;
+            const handle = () => graphqlHandler.handleNodeRequestAndResponse(req, reply, {
                 req,
                 reply,
             });
+            if (auditCtx) {
+                return runWithAuditContext(auditCtx, handle);
+            }
+            return handle();
         },
     });
     fastify.route({
@@ -130,7 +149,8 @@ export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allo
             let css = '/* default theme */';
             if (adminUIOptions?.theme) {
                 try {
-                    const { generateThemeCSS } = await import('@unchainedshop/admin-ui/theme');
+                    const themeModuleUrl = import.meta.resolve('@unchainedshop/admin-ui/theme');
+                    const { generateThemeCSS } = await import(__rewriteRelativeImportExtension(themeModuleUrl));
                     css = generateThemeCSS(adminUIOptions.theme);
                 }
                 catch {
@@ -152,7 +172,7 @@ export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allo
                 .send(css);
         });
         const devMode = process.env.NODE_ENV !== 'production';
-        const { routes: pluginRoutes } = preparePluginAssets(adminUIPlugins, fastify.log, {
+        const { routes: pluginRoutes, importMapTag, importMapJSON, } = preparePluginAssets(adminUIPlugins, fastify.log, {
             devMode,
         });
         for (const [path, asset] of pluginRoutes) {
@@ -177,6 +197,8 @@ export const connect = async (fastify, { graphqlHandler, unchainedAPI, }, { allo
             enabled: true,
             prefix: adminUIOptions?.prefix || '/',
             plugins: adminUIPlugins,
+            importMapTag,
+            importMapJSON,
         });
     }
 };
@@ -209,24 +231,43 @@ export const adminUIRouter = async (fastify, opts) => {
         if (fastifyStatic) {
             const adminUIPath = resolveAdminUIPath();
             if (adminUIPath) {
-                const indexHtml = readFileSync(join(adminUIPath, 'index.html'), 'utf-8');
-                const extHtmlPath = join(adminUIPath, 'ext', '[[...slug]]', 'index.html');
-                const extHtml = existsSync(extHtmlPath) ? readFileSync(extHtmlPath, 'utf-8') : null;
-                await fastify.register(fastifyStatic, {
-                    root: adminUIPath,
-                    prefix: opts.prefix || '/',
-                    wildcard: false,
-                });
-                fastify.setNotFoundHandler(async (request, reply) => {
-                    if (request.method === 'GET' && !request.url.includes('.')) {
-                        const urlPath = request.url.split('?')[0].replace(/\/+$/, '');
-                        if (extHtml && (urlPath === '/ext' || urlPath.startsWith('/ext/'))) {
-                            return reply.type('text/html').send(extHtml);
+                if (opts.importMapJSON) {
+                    const preparedHTML = prepareAdminUIHTML(adminUIPath);
+                    await fastify.register(fastifyStatic, {
+                        root: adminUIPath,
+                        prefix: opts.prefix || '/',
+                        wildcard: false,
+                        index: false,
+                    });
+                    fastify.setNotFoundHandler(async (request, reply) => {
+                        if (request.method === 'GET' && !request.url.includes('.')) {
+                            if (process.env.NODE_ENV !== 'production')
+                                reply.header('Cache-Control', 'no-cache');
+                            const nonce = reply.cspNonce?.script;
+                            const tag = nonce ? buildImportMapTag(opts.importMapJSON, nonce) : opts.importMapTag;
+                            return reply
+                                .type('text/html')
+                                .send(injectAdminUIImportMap(preparedHTML, request.url, tag, opts.prefix));
                         }
-                        return reply.type('text/html').send(indexHtml);
-                    }
-                    return reply.code(404).send({ error: 'Not Found' });
-                });
+                        return reply.code(404).send({ error: 'Not Found' });
+                    });
+                }
+                else {
+                    const preparedHTML = prepareAdminUIHTML(adminUIPath);
+                    await fastify.register(fastifyStatic, {
+                        root: adminUIPath,
+                        prefix: opts.prefix || '/',
+                        wildcard: false,
+                    });
+                    fastify.setNotFoundHandler(async (request, reply) => {
+                        if (request.method === 'GET' && !request.url.includes('.')) {
+                            return reply
+                                .type('text/html')
+                                .send(resolveAdminUIHTML(preparedHTML, request.url, opts.prefix));
+                        }
+                        return reply.code(404).send({ error: 'Not Found' });
+                    });
+                }
                 return;
             }
         }

package/lib/mcp/tools/system/handlers/allocateWork.js

@@ -1,8 +1,8 @@
 import { buildObfuscatedFieldsFilter } from '@unchainedshop/utils';
+import { WorkerDirector } from '@unchainedshop/core';
 const allocateWork = async (context, options) => {
-    const { modules } = context;
     const removePrivateFieldsFromWork = buildObfuscatedFieldsFilter(context.options.worker?.blacklistedVariables);
-    const work = await modules.worker.allocateWork({
+    const work = await WorkerDirector.allocateWork(context, {
         types: options.types || [],
         worker: options.worker || '',
     });