@endora-commerce/contracts 0.100.0

package/dist/admin-i18n.js

@@ -0,0 +1,72 @@
+// Admin UI language versions (feature 019).
+//
+// Source-of-truth schemas for the Admin UI's i18n boundary. Distinct from
+// `i18n.ts` (feature 017) which owns the storefront/customer-facing language
+// pool — see specs/019-admin-i18n/research.md §R1 for the separation.
+//
+// At GA the supported set is `en` and `pl`; English is the platform-wide
+// fallback (specs/019-admin-i18n/spec.md FR-013, FR-016).
+//
+// The set and the fallback themselves now live in `platform-language.ts`
+// (feature 083, D-136): a buyer is answered out of the same enum, so naming it
+// after the Admin UI was the thing that let `ADMIN_LANGUAGE_FALLBACK` sit on a
+// buyer's code path for a year without anybody reading it as wrong (#234).
+import { z } from 'zod';
+import { SupportedLanguageSchema } from './platform-language.js';
+/**
+ * @deprecated Use `SupportedLanguageSchema` from `platform-language.ts`. The set
+ * is the platform's, not the Admin UI's — a buyer is answered out of the same
+ * enum (feature 083, D-136). Draining task: `specs/083-buyer-language-resolution`
+ * T021.
+ */
+export const SupportedAdminLanguageSchema = SupportedLanguageSchema;
+/**
+ * On-disk bundle JSON shape and the row payload persisted to
+ * `translation_bundles.entries`. Flat string→string only at v1; nested
+ * objects, arrays, and non-string values are rejected.
+ */
+export const TranslationBundleEntriesSchema = z.record(z.string().min(1), z.string());
+/** Admin SPA boot fetch — `GET /api/v1/admin/i18n/bundles?language=…` response. */
+export const GetBundlesResponseSchema = z.object({
+    language: SupportedAdminLanguageSchema,
+    // Monotonically-non-decreasing version vector. SPA refetches when its cached value is older.
+    version: z.number().int().nonnegative(),
+    // module_id → flat key/string map. The synthetic `core` namespace owns admin-chrome strings.
+    bundles: z.record(z.string(), TranslationBundleEntriesSchema),
+});
+/** `PATCH /api/v1/admin/me/preferred-language` body. `null` reverts to the platform default. */
+export const PatchPreferredLanguageBodySchema = z.object({
+    preferredLanguage: SupportedAdminLanguageSchema.nullable(),
+});
+/** Standard 400 envelope when an unsupported language is requested. */
+export const UnsupportedLanguageErrorSchema = z.object({
+    error: z.literal('unsupported-language'),
+    supported: z.array(SupportedAdminLanguageSchema),
+});
+// ---------------------------------------------------------------------------
+// Coverage diagnostic — feature 021
+// ---------------------------------------------------------------------------
+export const I18nCoverageLanguageSchema = z.object({
+    languageCode: SupportedAdminLanguageSchema,
+    totalKeysSeen: z.number().int().nonnegative(),
+    missingCount: z.number().int().nonnegative(),
+    missingKeys: z.array(z.string()),
+    fellBackToEnCount: z.number().int().nonnegative(),
+    fellBackToEnKeys: z.array(z.string()),
+});
+export const I18nCoverageModuleSchema = z.object({
+    moduleId: z.string(),
+    languages: z.array(I18nCoverageLanguageSchema),
+});
+export const I18nCoverageResponseSchema = z.object({
+    capturedAt: z.iso.datetime(),
+    modules: z.array(I18nCoverageModuleSchema),
+});
+export const I18nCoverageQuerySchema = z.object({
+    module: z.union([z.string(), z.array(z.string())]).optional(),
+    language: z
+        .union([SupportedAdminLanguageSchema, z.array(SupportedAdminLanguageSchema)])
+        .optional(),
+    includeKeys: z.enum(['missing', 'all']).default('missing').optional(),
+});
+//# sourceMappingURL=admin-i18n.js.map

package/dist/admin-i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-i18n.js","sourceRoot":"","sources":["../src/admin-i18n.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,0DAA0D;AAC1D,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAE3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAA0B,MAAM,wBAAwB,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAOpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CACpD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,MAAM,EAAE,CACX,CAAC;AAGF,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,4BAA4B;IACtC,6FAA6F;IAC7F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,6FAA6F;IAC7F,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC;CAC9D,CAAC,CAAC;AAGH,gGAAgG;AAChG,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,iBAAiB,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAGH,uEAAuE;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC;CACjD,CAAC,CAAC;AAGH,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,YAAY,EAAE,4BAA4B;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACtC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;CAC/C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;CAC3C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;SAC5E,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC,CAAC"}

package/dist/admin-notifications.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `admin_notifications` module contracts — the in-process port surface
+ * (feature 075, Phase P).
+ *
+ * The cross-module demand is one method wherever it comes from: something
+ * finished, and the administrator who asked for it should see a bell entry.
+ * `organizations` records one when a new organisation registers; `catalog`,
+ * `product_feeds` and `pim_ergonode` record one when a bulk operation, a feed
+ * generation or an import run ends. So the port is that one method, not the
+ * module's five — the other four are its own admin surface (listing, marking
+ * read, archiving, counting) and stay unpublished.
+ *
+ * Plain TypeScript rather than Zod: this describes an in-process call.
+ */
+export type AdminNotificationAudience = 'admin_user' | 'all_admins';
+export interface RecordAdminNotificationInput {
+    audience: AdminNotificationAudience;
+    /** Required when `audience` is `admin_user`; rejected otherwise. */
+    targetAdminUserId?: string | null;
+    kind: string;
+    subjectType?: string | null;
+    subjectId?: string | null;
+    title: string;
+    body?: string | null;
+    linkPath?: string | null;
+}
+/** What was recorded, for a caller that wants to correlate its own log. */
+export interface AdminNotificationRecord {
+    id: string;
+    audience: AdminNotificationAudience;
+    targetAdminUserId: string | null;
+    kind: string;
+    subjectType: string | null;
+    subjectId: string | null;
+    title: string;
+    body: string | null;
+    linkPath: string | null;
+    createdAt: Date;
+}
+/**
+ * Container name: `adminNotificationRecordPort`. Owner: `admin_notifications`.
+ *
+ * When `admin_notifications` is off the call fails closed, and every caller
+ * decides absence in front of it rather than catching the refusal behind it
+ * (D-60). `organizations` records *after* the organisation has been created
+ * and committed, so a swallowed refusal there would be indistinguishable from
+ * a call that never happened; the three run-completion callers compose the
+ * presence question into their own return type — `'recorded' | 'not-present'`
+ * — so an operator reading "not notified" can tell their own choice from a
+ * defect.
+ */
+export interface AdminNotificationRecordPort {
+    record(input: RecordAdminNotificationInput): Promise<AdminNotificationRecord>;
+}
+//# sourceMappingURL=admin-notifications.d.ts.map

package/dist/admin-notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-notifications.d.ts","sourceRoot":"","sources":["../src/admin-notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,yBAAyB,GAAG,YAAY,GAAG,YAAY,CAAC;AAEpE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,yBAAyB,CAAC;IACpC,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,yBAAyB,CAAC;IACpC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E"}

package/dist/admin-notifications.js

@@ -0,0 +1,16 @@
+/**
+ * `admin_notifications` module contracts — the in-process port surface
+ * (feature 075, Phase P).
+ *
+ * The cross-module demand is one method wherever it comes from: something
+ * finished, and the administrator who asked for it should see a bell entry.
+ * `organizations` records one when a new organisation registers; `catalog`,
+ * `product_feeds` and `pim_ergonode` record one when a bulk operation, a feed
+ * generation or an import run ends. So the port is that one method, not the
+ * module's five — the other four are its own admin surface (listing, marking
+ * read, archiving, counting) and stay unpublished.
+ *
+ * Plain TypeScript rather than Zod: this describes an in-process call.
+ */
+export {};
+//# sourceMappingURL=admin-notifications.js.map

package/dist/admin-notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-notifications.js","sourceRoot":"","sources":["../src/admin-notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/admin-roles.d.ts

@@ -0,0 +1,125 @@
+import type { PermissionCatalogueEntry } from './admin.js';
+/**
+ * `admin_roles` module contracts — the in-process port surface (feature 075,
+ * Phase P).
+ *
+ * The module's HTTP shapes and the shared `PERMISSION_CATALOGUE` live in
+ * `admin.ts`; what belongs here is behaviour — the fourteen inbound sites from
+ * `admin_users`, `admin_actions`, `blog` and the dev seed.
+ *
+ * **Not here on purpose:** `AdminPermissionChecker`. `auth`'s guard resolves
+ * `permissionService` for one method and the kernel already declares that
+ * narrow shape at `src/kernel/ports/require-admin.ts`, because the guard is
+ * the kernel's and every module's routes go through it. A second declaration
+ * of the same method would be two answers to one question.
+ *
+ * Plain TypeScript rather than Zod: these describe in-process calls.
+ */
+/** An admin role as it crosses a module boundary — never the ORM entity. */
+export interface AdminRoleRecord {
+    id: string;
+    code: string;
+    name: string;
+    /** Permission codes granted by this role. */
+    permissions: string[];
+    requiresTwoFactor: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface UpsertAdminRoleInput {
+    code: string;
+    name: string;
+    permissions: string[];
+    requiresTwoFactor?: boolean;
+}
+/**
+ * Container name: `adminRolePort`. Owner: `admin_roles`.
+ *
+ * (It said `adminRoleService` until issue #192. That name is registered — it is
+ * the `AdminRoleService` **class**, a plain `di.register` with no presence gate,
+ * whose `list()` returns `AdminRole` **entities**. `AdminRole` is structurally
+ * assignable to `AdminRoleRecord`, so a consumer that copied the old name got an
+ * ungated registration and entities across the boundary, and `tsc` said nothing.
+ * Nothing in the tree ever did — `admin_users` resolves `adminRolePort` — but the
+ * comment was a standing invitation to.)
+ *
+ * `admin_users` reads a role to render it beside its user and to enforce the
+ * role's `requiresTwoFactor` at login. `remove` refuses a role whose code was
+ * registered as system-protected (feature 016 FR-025), and that refusal stays
+ * on this side of the port.
+ *
+ * **Owner off:** the seam fails closed — resolving this port throws
+ * `ModuleDisabledError` and the call answers 503 `MODULE_DISABLED`, so nothing
+ * half-executes. Whether `admin_roles` has an off state at all is its manifest's
+ * `activation` to say, not this line's: a module declaring
+ * `nonDeactivatable` never enters one.
+ */
+export interface AdminRolePort {
+    list(): Promise<AdminRoleRecord[]>;
+    getById(id: string): Promise<AdminRoleRecord>;
+    findByCode(code: string): Promise<AdminRoleRecord | null>;
+    upsertByCode(input: UpsertAdminRoleInput): Promise<AdminRoleRecord>;
+    remove(id: string): Promise<void>;
+}
+/**
+ * Container name: `systemRoleCodePort`. Owner: `admin_roles`.
+ *
+ * A **contribution seam**: a module that seeds a role registers its code here
+ * so `remove` refuses to delete it. `blog` is the only contributor today, from
+ * its own boot hook.
+ *
+ * It is a contribution rather than a call, so an absent contributor's code is
+ * simply not protected — which is the correct answer, because a module that is
+ * not installed has no seeded role to protect. That classification must not
+ * change: gating the registration would let an operator delete a protected
+ * role by switching its owner off for a moment.
+ */
+export interface SystemRoleCodePort {
+    register(code: string): void;
+    /** Every protected code, in registration order. */
+    list(): readonly string[];
+}
+/**
+ * Container name: `permissionCataloguePort`. Owner: `admin_roles`.
+ *
+ * (It said `permissionCatalogueService` until issue #192 — the same trap as
+ * {@link AdminRolePort}: that name is a plain `di.register` of the
+ * `PermissionCatalogueService` class, with no presence gate on it. The gated
+ * registration is this one.)
+ *
+ * The permission codes an operator may actually grant — core
+ * `PERMISSION_CATALOGUE` plus every registered module's manifest
+ * `permissions`. `admin_users` renders the role editor from it.
+ *
+ * Synchronous by contract: the catalogue is assembled from manifests at
+ * composition time and never queried.
+ *
+ * **Owner off:** the seam fails closed — resolving this port throws
+ * `ModuleDisabledError` and the call answers 503 `MODULE_DISABLED`, so nothing
+ * half-executes. Whether `admin_roles` has an off state at all is its manifest's
+ * `activation` to say, not this line's: a module declaring
+ * `nonDeactivatable` never enters one.
+ */
+export interface PermissionCataloguePort {
+    listAssignable(): PermissionCatalogueEntry[];
+}
+/**
+ * Container name: `permissionService`. Owner: `admin_roles`.
+ *
+ * The effective permission codes of one admin user, resolved through their
+ * role. `admin_actions` reads it to filter the command palette, so an action
+ * is never advertised to somebody who would get a 403 opening it.
+ *
+ * The single-permission check `auth`'s guard makes is deliberately not here —
+ * see the file header.
+ *
+ * **Owner off:** the seam fails closed — resolving this port throws
+ * `ModuleDisabledError` and the call answers 503 `MODULE_DISABLED`, so nothing
+ * half-executes. Whether `admin_roles` has an off state at all is its manifest's
+ * `activation` to say, not this line's: a module declaring
+ * `nonDeactivatable` never enters one.
+ */
+export interface PermissionReadPort {
+    listPermissions(adminUserId: string): Promise<string[]>;
+}
+//# sourceMappingURL=admin-roles.d.ts.map

package/dist/admin-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-roles.d.ts","sourceRoot":"","sources":["../src/admin-roles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC1D,YAAY,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACpE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mDAAmD;IACnD,IAAI,IAAI,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,uBAAuB;IACtC,cAAc,IAAI,wBAAwB,EAAE,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACzD"}

package/dist/admin-roles.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-roles.js.map

package/dist/admin-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-roles.js","sourceRoot":"","sources":["../src/admin-roles.ts"],"names":[],"mappings":""}

package/dist/admin-users.d.ts

@@ -0,0 +1,178 @@
+/**
+ * `admin_users` module contracts — the in-process port surface (feature 075,
+ * Phase P).
+ *
+ * Eleven inbound sites, and they split cleanly in two: seven read the
+ * `AdminUser` entity to put a name beside an id — `admin_roles` resolving a
+ * user's role, `quote_requests` listing the admins a notification goes to,
+ * `catalog` attributing a bulk operation, `organizations` rendering the
+ * sales-rep picker — and the rest reach two services.
+ *
+ * Plain TypeScript rather than Zod: these describe in-process calls.
+ */
+/**
+ * An admin user as it crosses a module boundary — a plain shape, never the ORM
+ * entity (FR-011).
+ *
+ * `passwordHash` is absent, as it is from `CustomerAccountRecord` and for the
+ * same reason: exactly one module reads it, and a record that carried it would
+ * turn every consumer into a place a credential can leak from.
+ */
+export interface AdminUserRecord {
+    id: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+    adminRoleId: string | null;
+    status: 'active' | 'inactive';
+    /** Whether a confirmed TOTP enrolment exists. The secret itself never travels. */
+    twoFactorEnabled: boolean;
+    lastLoginAt: Date | null;
+    /** Admin-UI language override, or `null` to follow the platform default. */
+    preferredLanguage: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt: Date | null;
+}
+/** Which admins a lookup should consider. */
+export interface AdminUserLookupOptions {
+    /** Exclude soft-deleted admins. Defaults to `false` — the wider read. */
+    activeOnly?: boolean;
+}
+/**
+ * Container name: `adminUserReadPort`. Owner: `admin_users`.
+ *
+ * `listAll` is the notification fan-out: when an organisation has no assigned
+ * sales rep, a quote request notifies every admin. It is the one read here
+ * that is not a lookup by id, and it stays because the alternative — a
+ * consumer paging the table itself — is the same query in a module that does
+ * not own it.
+ *
+ * When `admin_users` is off every method fails closed. The module is
+ * non-deactivatable in practice — a platform with no admin identity has no
+ * admin surface — but the gate is registered anyway, for the reason `auth`
+ * gives for its own.
+ */
+export interface AdminUserReadPort {
+    findById(id: string, options?: AdminUserLookupOptions): Promise<AdminUserRecord | null>;
+    findByIds(ids: readonly string[], options?: AdminUserLookupOptions): Promise<AdminUserRecord[]>;
+    findByEmail(email: string, options?: AdminUserLookupOptions): Promise<AdminUserRecord | null>;
+    /** Every admin, ordered by email. */
+    listAll(options?: AdminUserLookupOptions): Promise<AdminUserRecord[]>;
+    /** Admins holding a given role — the guard against deleting a role in use. */
+    listByRoleId(adminRoleId: string): Promise<AdminUserRecord[]>;
+}
+/**
+ * Container name: `adminUserPreferencePort`. Owner: `admin_users`.
+ *
+ * `_i18n` writes the admin's language choice and reads nothing else off the
+ * row. One method, because that is the whole of the demand.
+ */
+export interface AdminUserPreferencePort {
+    setPreferredLanguage(id: string, preferredLanguage: string | null): Promise<AdminUserRecord>;
+}
+/**
+ * Container name: `adminPasswordVerificationPort`. Owner: `admin_users`.
+ *
+ * Does the stored credential of this admin match the password presented? One
+ * method, because that is the whole of the demand: `mfa`'s step-up
+ * re-verification asks it before it disables a second factor, and a boolean is
+ * the entire answer.
+ *
+ * It is a port rather than a field on {@link AdminUserRecord} because the hash
+ * must not travel — the record says so, and this method is what makes that
+ * survivable. Until feature 080's T052 a composition root read
+ * `admin_users`' `passwordHash` off the entity and compared it with the
+ * platform hasher itself, so the one file in the tree that owns neither the
+ * column nor the hashing held both.
+ *
+ * `false` for an unknown id as well — an admin nobody can find has no password
+ * to match. It is a lookup by id and nothing else: whether the caller may
+ * authenticate as that admin at all is the session layer's question, asked
+ * before this one, and answering it twice in two places is how the two come to
+ * disagree.
+ *
+ * **Owner off:** the seam fails closed — resolving this port throws
+ * `ModuleDisabledError` and the call answers 503 `MODULE_DISABLED`, so nothing
+ * half-executes. Whether `admin_users` has an off state at all is its
+ * manifest's `activation` to say, not this line's: a module declaring
+ * `nonDeactivatable` never enters one.
+ */
+export interface AdminPasswordVerificationPort {
+    verifyPassword(adminUserId: string, password: string): Promise<boolean>;
+}
+export interface ImpersonationStartInput {
+    adminUserId: string;
+    /** Raw admin session cookie value — must be preserved as the shadow. */
+    adminSessionCookieValue: string;
+    customerAccountId: string;
+    /**
+     * Feature 040 — optional: standalone (org-less) customers have no
+     * organisation. When provided it scopes the target lookup; when omitted the
+     * target is found by id alone.
+     */
+    organizationId?: string | null;
+    reason?: string;
+    ip?: string;
+    userAgent?: string;
+    requestId?: string;
+}
+/**
+ * Who is being impersonated, as the one consumer renders them.
+ *
+ * Four fields, not a `CustomerAccountRecord`. `customers` reads exactly
+ * `id`, `email`, `firstName` and `lastName` off this and returns them in the
+ * response body; publishing the whole account here would have meant
+ * `admin_users` importing `customer_accounts`' mapper to build a shape nobody
+ * asked for — a new cross-module edge, added by the merge request whose job is
+ * to remove them.
+ */
+export interface ImpersonatedCustomerIdentity {
+    id: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+}
+export interface ImpersonationStartResult {
+    impersonationSessionId: string;
+    impersonationCookieValue: string;
+    impersonationExpiresAt: Date;
+    adminShadowSessionCookieValue: string;
+    impersonatedCustomerAccount: ImpersonatedCustomerIdentity;
+}
+export interface ImpersonationEndInput {
+    impersonationSessionCookieValue: string;
+    adminShadowCookieValue: string;
+    ip?: string;
+    userAgent?: string;
+    requestId?: string;
+}
+export interface ImpersonationEndResult {
+    adminSessionCookieValue: string;
+    adminSessionExpiresAt: Date;
+}
+/**
+ * Container name: `impersonationPort`. Owner: `admin_users`.
+ *
+ * (It said `impersonationService` until issue #192. Nothing registers that
+ * name — a consumer copying it out of here got
+ * `[kernel] 'impersonationService' is not registered in this composition` on
+ * first call, and no `tsc` error before it.)
+ *
+ * `customers` hosts the "view as this customer" control, so the surface and
+ * the machinery sit in different modules by design.
+ *
+ * `impersonatedCustomerAccount` is the four-field identity the caller renders,
+ * not the account entity and not `CustomerAccountRecord` — see its own note.
+ *
+ * **Owner off:** the seam fails closed — resolving this port throws
+ * `ModuleDisabledError` and the call answers 503 `MODULE_DISABLED`, so nothing
+ * half-executes. Whether `admin_users` has an off state at all is its manifest's
+ * `activation` to say, not this line's: a module declaring
+ * `nonDeactivatable` never enters one.
+ */
+export interface ImpersonationPort {
+    start(input: ImpersonationStartInput): Promise<ImpersonationStartResult>;
+    end(input: ImpersonationEndInput): Promise<ImpersonationEndResult>;
+}
+//# sourceMappingURL=admin-users.d.ts.map

package/dist/admin-users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../src/admin-users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC9B,kFAAkF;IAClF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,4EAA4E;IAC5E,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,6CAA6C;AAC7C,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxF,SAAS,CACP,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9B,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC9F,qCAAqC;IACrC,OAAO,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACtE,8EAA8E;IAC9E,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC9F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,6BAA6B;IAC5C,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,uBAAuB,EAAE,MAAM,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,CAAC;IACjC,sBAAsB,EAAE,IAAI,CAAC;IAC7B,6BAA6B,EAAE,MAAM,CAAC;IACtC,2BAA2B,EAAE,4BAA4B,CAAC;CAC3D;AAED,MAAM,WAAW,qBAAqB;IACpC,+BAA+B,EAAE,MAAM,CAAC;IACxC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzE,GAAG,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpE"}

package/dist/admin-users.js

@@ -0,0 +1,14 @@
+/**
+ * `admin_users` module contracts — the in-process port surface (feature 075,
+ * Phase P).
+ *
+ * Eleven inbound sites, and they split cleanly in two: seven read the
+ * `AdminUser` entity to put a name beside an id — `admin_roles` resolving a
+ * user's role, `quote_requests` listing the admins a notification goes to,
+ * `catalog` attributing a bulk operation, `organizations` rendering the
+ * sales-rep picker — and the rest reach two services.
+ *
+ * Plain TypeScript rather than Zod: these describe in-process calls.
+ */
+export {};
+//# sourceMappingURL=admin-users.js.map

package/dist/admin-users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-users.js","sourceRoot":"","sources":["../src/admin-users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}