@endora-commerce/mod-admin-users 0.100.0

package/dist/manifest.d.ts

@@ -0,0 +1,182 @@
+import { type ModuleCliCommand } from '@endora-commerce/contracts';
+import type { ModuleContext } from '@endora-commerce/platform/kernel';
+/**
+ * Admin Users module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("email" | "invoice" | "cms" | "newsletter")[];
+        fields: Record<string, {
+            type: "number" | "object" | "array" | "uuid" | "text" | "textarea" | "select" | "radio" | "external" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("email" | "invoice" | "cms" | "newsletter")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+/**
+ * The operator command this module declares — feature 080, T042b / D-160.9.
+ *
+ * It was `scripts/create-admin.ts`, whose one `check:module-boundary` key was an
+ * `AdminRole` **entity** import: with no container there was nothing to resolve
+ * `adminRolePort` from. Composing reaches it, and D-157.5 is why that is safe on
+ * a database with no administrator in it — `loadModulePresence` runs before the
+ * first module registers and its reconciler is what puts the presence rows
+ * there, so a composed bootstrap resolves a working port on a virgin schema.
+ */
+export declare const cliCommands: ReadonlyArray<ModuleCliCommand<ModuleContext>>;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AA8BtE;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuJnB,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAetE,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,208 @@
+import { defineModuleManifest, } from '@endora-commerce/contracts';
+/**
+ * The demo data this module owns (feature 113, T222 — contract §1.3).
+ *
+ * A typed `const` rather than an inline object literal: declared inline the
+ * parameter infers from the schema and is `never`, so the author loses
+ * `context.ctx: ModuleContext`.
+ *
+ * Both bodies are reached by a **relative `await import()`** (§1.4), in
+ * `cliCommands.run`'s shape and for `cliCommands`' reason: a manifest is loaded
+ * by every process that composes the platform and by the check scripts that
+ * import the generated index, so a demo body imported at the top of this file
+ * would be a service graph pulled into all of them. It needs no `exports`
+ * subpath and no `files` entry (§1.5).
+ *
+ * **The role each account holds is not here.** An `admin_users` row carrying an
+ * `admin_roles` id is two modules' rows in one statement, so the assignment is a
+ * composition step (§5.1) and belongs to whoever owns the instance. The column
+ * is nullable, which is what makes that split available at all.
+ *
+ * The sign-in details come back as `DemoSeedResult.credentials`, so the runner
+ * formats them once (§3.7) instead of the seed printing them itself.
+ */
+const demo = {
+    summary: 'Three administrator accounts to sign in to the Admin UI with.',
+    seed: async (context) => (await import('./backend/demo/seed.js')).seedDemo(context),
+    reset: async (context) => (await import('./backend/demo/reset.js')).resetDemo(context),
+};
+/**
+ * Admin Users module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export const manifest = defineModuleManifest({
+    id: 'admin_users',
+    name: 'Admin Users',
+    description: 'Admin user accounts, sessions, and impersonation flows.',
+    version: '1.0.0',
+    dependencies: ['admin_roles', 'auth'],
+    /**
+     * Feature 075, Phase C — impersonation resolves its target through
+     * `customerAccountReadPort` instead of querying `customer_accounts`' entity.
+     *
+     * It is acknowledged rather than declared, because the ordinary declaration
+     * closes a cycle `module-graph.test.ts` and the composer generator both refuse:
+     * `customer_accounts` → `price_lists` → `catalog` → `admin_users`. The same
+     * shape `auth` records against `customer_accounts` and `admin_roles` against
+     * this module.
+     *
+     * The seam fails closed — the port is gated, and an impersonation that cannot
+     * identify its target must refuse rather than mint a session against a
+     * customer nobody looked up. That is what the edge costs, stated as a
+     * behaviour rather than as a claim about which flips are refused: the locked
+     * set is re-derived on every run, and a sentence here is a copy nothing
+     * refreshes (D-100).
+     */
+    acknowledgedDependencies: [
+        {
+            moduleId: 'customer_accounts',
+            port: 'customerAccountReadPort',
+            reason: 'Starting an impersonation reads the target customer account — its organisation ' +
+                'membership and whether it is still live — and that row belongs to customer_accounts, ' +
+                'which reaches this module transitively through price_lists and catalog. Declaring it ' +
+                'here closes a cycle. With customer_accounts absent the seam fails closed: an ' +
+                'impersonation that cannot identify its target refuses rather than minting a session ' +
+                'against a customer nobody looked up.',
+        },
+    ],
+    /**
+     * D-96 — `mfaLoginPort`, the second factor on admin login.
+     *
+     * Real to the container, binding on no operator. `mfa` declares this module
+     * in its own `dependencies`, so the ordinary declaration closes a cycle; and
+     * an acknowledged edge would put admin login among the dependents that refuse
+     * the flip, which is the wrong way round — two-factor authentication is a
+     * client security policy, not a platform floor, and feature 074 gave the
+     * operator a switch for exactly that reason.
+     */
+    nonBindingDependencies: [
+        {
+            moduleId: 'mfa',
+            name: 'mfaLoginPort',
+            kind: 'degrades-without',
+            whenAbsent: 'Admin sign-in stops asking for a second factor and offers no Google/Microsoft button. ' +
+                'Every admin has a password a peer admin can reset, so no admin is locked out.',
+            reason: 'AdminAuthService verifies the password first and then asks the second factor what to ' +
+                'do. With `mfa` absent it asks nobody: `backend.ts` probes ' +
+                '`effectiveState.isPresent("mfa")` and passes `undefined`, which selects the ' +
+                'password-only branch feature 042 FR-033 requires and this service has always had. ' +
+                'Nothing catches `ModuleDisabledError` — the decision is taken before the port is ' +
+                'resolved, so the degrade is declared rather than laundered out of a closed gate. ' +
+                'Enrolled secrets, recovery codes and every policy value stay in the database and ' +
+                'apply again on the way back, which is what the activation control promises. Admin ' +
+                'accounts are never auto-created and always carry a human-chosen password a peer ' +
+                'admin can reset, so no admin becomes unreachable while the module is off.',
+        },
+        {
+            moduleId: 'mfa',
+            name: 'mfaEnrolmentStatePort',
+            kind: 'degrades-without',
+            whenAbsent: 'Reads "no second factor" for every admin on /admin-users, on /admin/me and on the ' +
+                'login response. True while MFA is off — admin sign-in asks for none — and not a ' +
+                'claim that nobody is enrolled.',
+            reason: '`twoFactorEnabled` on every response carrying an admin user is the live `mfa` ' +
+                'enrolment, read in one batch through `mfaEnrolmentStatePort`. It was ' +
+                '`!!u.twoFactorConfirmedAt` until 2026-08-28 — a column on this module\'s own table ' +
+                'that has never had a writer — so the screen whose job is to tell an operator who is ' +
+                'protected answered "nobody" while people were protected. Non-binding for the reason ' +
+                'the login edge beside it is: `mfa` declares this module in its own `dependencies`, ' +
+                'so an ordinary declaration closes a cycle, and an acknowledged edge would make a ' +
+                'client security policy unswitchable over a column on a list screen. The degrade is ' +
+                'taken by **not resolving** — `backend.ts` probes presence first and answers an empty ' +
+                'set — so nothing catches `ModuleDisabledError`.',
+        },
+    ],
+    // D-173 — `customers:impersonate` is a **shared** gate, in the shape issue
+    // #213 gave `integrations:manage`: it guards this module's
+    // `/admin/organizations/:id/impersonate` and `/admin/impersonation/end`
+    // endpoints and `customers`' own impersonation start, and the core
+    // `PERMISSION_CATALOGUE` row that carries its label names `customers` alone.
+    // Declaring it here makes this module a second *owner*, so the presence
+    // filter on `/admin-roles` keeps it grantable while either surface is on.
+    // Without this line, switching `customers` off would take the code off the
+    // role editor while these routes — owned by a module that declares itself
+    // non-deactivatable — went on enforcing it: a gate nobody can be granted.
+    //
+    // The label decides which repair applies: *"Impersonate customers"* reads as
+    // a sentence about this module's own screen, so the code is shared rather
+    // than replaced by one of this module's own.
+    /**
+     * This module's first i18n bundle and its first command-palette action —
+     * feature 091, Phase 4, batch four.
+     *
+     * The bundle exists because the sidebar entry moved into this package with
+     * the two screens and a nav declaration's `labelKey` is **module-relative**
+     * (R8): `appShell.nav.users` was one of `_i18n`'s and is
+     * `nav.adminUsers.label` here. It is a **flat** `{"a.b.c": "text"}` map at
+     * the **package root**, for the reason `admin_roles`' bundle records.
+     *
+     * The action pays one of the fifteen entries `specs/deferred-defects.md`
+     * still holds under *"Sixteen modules with an admin screen declare no
+     * command-palette action"*. `admin_users:manage` is the code every endpoint
+     * under `/api/v1/admin/admin-users` enforces, which is what
+     * `check:action-route-permissions` holds this declaration to.
+     *
+     * **There is exactly one action and it points at `/admin-users`, not at
+     * `/admin-roles`.** This module declares the roles editor's *route* — the
+     * screen's API is its own — but the roles *advertisement* is `admin_roles`',
+     * which ships the sidebar entry and the palette action for it. See
+     * `src/admin/index.ts` for the split and for why it is inert while both
+     * modules are locked.
+     */
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    actions: [
+        {
+            id: 'open-admin-users',
+            labelKey: 'actions.openAdminUsers.label',
+            descriptionKey: 'actions.openAdminUsers.description',
+            icon: 'Users',
+            targetRoute: '/admin-users',
+            requiredPermission: 'admin_users:manage',
+            keywords: ['admin', 'users', 'uzytkownicy', 'operators', 'operatorzy', 'staff', 'konta'],
+            weight: 200,
+        },
+    ],
+    permissions: [{ code: 'customers:impersonate', label: 'Impersonate customers' }],
+    demo,
+    // Feature 072/073 (Constitution XVII) — this module owns the admin login
+    // route, the admin session and the impersonation flow. Switched off, nobody
+    // can sign in to the Admin UI, including to switch it back on: the one
+    // control that would undo the change is behind the door it just locked.
+    activation: {
+        nonDeactivatable: true,
+        reason: 'Owns admin login, sessions and impersonation; switched off, no operator could sign in ' +
+            'to the Admin UI at all — including to switch it back on.',
+    },
+});
+/**
+ * The operator command this module declares — feature 080, T042b / D-160.9.
+ *
+ * It was `scripts/create-admin.ts`, whose one `check:module-boundary` key was an
+ * `AdminRole` **entity** import: with no container there was nothing to resolve
+ * `adminRolePort` from. Composing reaches it, and D-157.5 is why that is safe on
+ * a database with no administrator in it — `loadModulePresence` runs before the
+ * first module registers and its reconciler is what puts the presence rows
+ * there, so a composed bootstrap resolves a working port on a virgin schema.
+ */
+export const cliCommands = [
+    {
+        name: 'create',
+        summary: 'Create or update an admin user, bootstrapping the platform_admin role.',
+        help: `usage: admin_users create --email=<e> --password=<p> --first-name=<f> --last-name=<l>
+                          [--role=<code>] [--skip-role-bootstrap]
+
+Idempotent: re-running with the same email updates the password and the role
+assignment. The first admin created gets the \`platform_admin\` role with the
+wildcard \`*\` permission; narrower roles are defined from the Admin UI.
+
+  --role=<code>            an existing role code (default: platform_admin)
+  --skip-role-bootstrap    do not create platform_admin when it is missing`,
+        run: async (context) => (await import('./backend/cli/create-admin.js')).createAdmin(context),
+    },
+];
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,4BAA4B,CAAC;AAGpC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,IAAI,GAAsC;IAC9C,OAAO,EAAE,+DAA+D;IACxE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IACnF,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;CACvF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,aAAa;IACnB,WAAW,EACT,yDAAyD;IAC3D,OAAO,EAAE,OAAO;IAChB,YAAY,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,EAAE;QACxB;YACE,QAAQ,EAAE,mBAAmB;YAC7B,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EACJ,iFAAiF;gBACjF,uFAAuF;gBACvF,uFAAuF;gBACvF,+EAA+E;gBAC/E,sFAAsF;gBACtF,sCAAsC;SACzC;KACF;IACD;;;;;;;;;OASG;IACH,sBAAsB,EAAE;QACtB;YACE,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,kBAAkB;YACxB,UAAU,EACR,wFAAwF;gBACxF,+EAA+E;YACjF,MAAM,EACJ,uFAAuF;gBACvF,4DAA4D;gBAC5D,8EAA8E;gBAC9E,oFAAoF;gBACpF,mFAAmF;gBACnF,mFAAmF;gBACnF,mFAAmF;gBACnF,oFAAoF;gBACpF,kFAAkF;gBAClF,2EAA2E;SAC9E;QACD;YACE,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,kBAAkB;YACxB,UAAU,EACR,oFAAoF;gBACpF,kFAAkF;gBAClF,gCAAgC;YAClC,MAAM,EACJ,gFAAgF;gBAChF,uEAAuE;gBACvE,qFAAqF;gBACrF,sFAAsF;gBACtF,sFAAsF;gBACtF,qFAAqF;gBACrF,mFAAmF;gBACnF,qFAAqF;gBACrF,uFAAuF;gBACvF,iDAAiD;SACpD;KACF;IACD,2EAA2E;IAC3E,2DAA2D;IAC3D,wEAAwE;IACxE,mEAAmE;IACnE,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,6CAA6C;IAC7C;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB,OAAO,EAAE;QACP;YACE,EAAE,EAAE,kBAAkB;YACtB,QAAQ,EAAE,8BAA8B;YACxC,cAAc,EAAE,oCAAoC;YACpD,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,cAAc;YAC3B,kBAAkB,EAAE,oBAAoB;YACxC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC;YACxF,MAAM,EAAE,GAAG;SACZ;KACF;IACD,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAChF,IAAI;IACJ,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,UAAU,EAAE;QACV,gBAAgB,EAAE,IAAI;QACtB,MAAM,EACJ,wFAAwF;YACxF,0DAA0D;KAC7D;CACF,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAmD;IACzE;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,wEAAwE;QACjF,IAAI,EAAE;;;;;;;;2EAQiE;QACvE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;KAC7F;CACF,CAAC"}

package/dist/migrations/20260425T053028_admin_users_init.d.ts

@@ -0,0 +1,11 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Admin module — Phase 6 (T184). Creates admin_roles + admin_users tables.
+ * admin_users.admin_role_id is RESTRICT-deleted to keep audit references
+ * meaningful even after a Role is deactivated.
+ */
+export declare class Migration20260425T053028AdminUsersInit extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260425T053028_admin_users_init.d.ts.map

package/dist/migrations/20260425T053028_admin_users_init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260425T053028_admin_users_init.d.ts","sourceRoot":"","sources":["../../src/migrations/20260425T053028_admin_users_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;GAIG;AACH,qBAAa,sCAAuC,SAAQ,SAAS;IACpD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAwCnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAIrC"}

package/dist/migrations/20260425T053028_admin_users_init.js

@@ -0,0 +1,51 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Admin module — Phase 6 (T184). Creates admin_roles + admin_users tables.
+ * admin_users.admin_role_id is RESTRICT-deleted to keep audit references
+ * meaningful even after a Role is deactivated.
+ */
+export class Migration20260425T053028AdminUsersInit extends Migration {
+    async up() {
+        this.addSql(`
+      create table "admin_roles" (
+        "id" uuid not null,
+        "code" varchar(64) not null,
+        "name" varchar(160) not null,
+        "permissions" jsonb not null default '[]'::jsonb,
+        "requires_two_factor" boolean not null default false,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "admin_roles_pkey" primary key ("id"),
+        constraint "admin_roles_code_unique" unique ("code")
+      );
+    `);
+        this.addSql(`
+      create table "admin_users" (
+        "id" uuid not null,
+        "email" varchar(320) not null,
+        "password_hash" varchar(512) not null,
+        "first_name" varchar(120) not null,
+        "last_name" varchar(120) not null,
+        "admin_role_id" uuid null,
+        "status" varchar(16) not null default 'active',
+        "two_factor_secret" varchar(64) null,
+        "two_factor_confirmed_at" timestamptz null,
+        "last_login_at" timestamptz null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        "deleted_at" timestamptz null,
+        constraint "admin_users_pkey" primary key ("id"),
+        constraint "admin_users_email_unique" unique ("email"),
+        constraint "admin_users_admin_role_fk" foreign key ("admin_role_id")
+          references "admin_roles" ("id") on delete restrict
+      );
+    `);
+        this.addSql('create index "admin_users_admin_role_id_index" on "admin_users" ("admin_role_id");');
+        this.addSql('create index "admin_users_status_index" on "admin_users" ("status");');
+    }
+    async down() {
+        this.addSql('drop table if exists "admin_users" cascade;');
+        this.addSql('drop table if exists "admin_roles" cascade;');
+    }
+}
+//# sourceMappingURL=20260425T053028_admin_users_init.js.map

package/dist/migrations/20260425T053028_admin_users_init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260425T053028_admin_users_init.js","sourceRoot":"","sources":["../../src/migrations/20260425T053028_admin_users_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;GAIG;AACH,MAAM,OAAO,sCAAuC,SAAQ,SAAS;IAC1D,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;KAYX,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;KAoBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,oFAAoF,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM,CAAC,sEAAsE,CAAC,CAAC;IACtF,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,6CAA6C,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/migrations/20260819T155150_admin_users_fold_email_case.d.ts

@@ -0,0 +1,55 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Fold `admin_users.email` to the form the code now stores and compares.
+ *
+ * `AdminUserService.create` folded the address and the login read compared it
+ * verbatim, so an operator created as `Operator.Mixed@example.com` had
+ * `operator.mixed@example.com` on record and could never sign in with the address
+ * they were handed: Postgres' `=` on `text` is case-sensitive. The code side of
+ * the repair makes every read and every write go through
+ * `normalizeEmailAddress`; this migration brings the rows written before it to
+ * the same form, so an address stored mixed-case stays reachable.
+ *
+ * The policy is the one the buyer-side twin of this defect settled on
+ * (`20260819T142837_customer_accounts_fold_email_case.ts`), and it is repeated
+ * rather than re-decided.
+ *
+ * ## What a collision means, and why it does not fail the deploy
+ *
+ * Two rows differing only in case are two operators that the fold turns into
+ * one address, and `admin_users_email_unique` will not hold both. The migration
+ * therefore **folds one row per address and leaves the rest exactly as they
+ * are** — it drops nothing, merges nothing and refuses nothing:
+ *
+ *  - a row that **already holds the folded address** wins it, because it is the
+ *    one every audit row, every assignment and every session has been resolving
+ *    to by that address all along;
+ *  - otherwise the **earliest-created** row wins it, since it is the operator
+ *    with the longer history behind it;
+ *  - every other row in the group keeps its stored spelling and is counted by
+ *    the warning below.
+ *
+ * A stranded row is not data loss but it is not a working operator either: the
+ * login read folds, so nothing will match its spelling until an operator
+ * renames it. Which admin account somebody's audit trail belongs to is not a
+ * decision a migration running unattended may take, and failing the deploy
+ * would stop every other repair in the same release over a pair of rows a human
+ * has to look at anyway.
+ *
+ * The admin side has one aggravating circumstance the buyer side does not: it
+ * ships no e-mail-keyed password reset, so a stranded operator has no
+ * self-service way back in at all. That is what the warning is for — it names a
+ * row somebody has to go and fix.
+ *
+ * ## Measured before it was written
+ *
+ * Zero collisions and zero mixed-case rows across both developer databases
+ * (`b2b`: 3 admin users; `b2b_test`: 4). The rules above are therefore written
+ * for the environments this will meet later, not for a pair of rows anybody has
+ * today.
+ */
+export declare class Migration20260819T155150AdminUsersFoldEmailCase extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260819T155150_admin_users_fold_email_case.d.ts.map

package/dist/migrations/20260819T155150_admin_users_fold_email_case.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260819T155150_admin_users_fold_email_case.d.ts","sourceRoot":"","sources":["../../src/migrations/20260819T155150_admin_users_fold_email_case.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBAAa,+CAAgD,SAAQ,SAAS;IAC7D,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IA+CnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAQrC"}

package/dist/migrations/20260819T155150_admin_users_fold_email_case.js

@@ -0,0 +1,106 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Fold `admin_users.email` to the form the code now stores and compares.
+ *
+ * `AdminUserService.create` folded the address and the login read compared it
+ * verbatim, so an operator created as `Operator.Mixed@example.com` had
+ * `operator.mixed@example.com` on record and could never sign in with the address
+ * they were handed: Postgres' `=` on `text` is case-sensitive. The code side of
+ * the repair makes every read and every write go through
+ * `normalizeEmailAddress`; this migration brings the rows written before it to
+ * the same form, so an address stored mixed-case stays reachable.
+ *
+ * The policy is the one the buyer-side twin of this defect settled on
+ * (`20260819T142837_customer_accounts_fold_email_case.ts`), and it is repeated
+ * rather than re-decided.
+ *
+ * ## What a collision means, and why it does not fail the deploy
+ *
+ * Two rows differing only in case are two operators that the fold turns into
+ * one address, and `admin_users_email_unique` will not hold both. The migration
+ * therefore **folds one row per address and leaves the rest exactly as they
+ * are** — it drops nothing, merges nothing and refuses nothing:
+ *
+ *  - a row that **already holds the folded address** wins it, because it is the
+ *    one every audit row, every assignment and every session has been resolving
+ *    to by that address all along;
+ *  - otherwise the **earliest-created** row wins it, since it is the operator
+ *    with the longer history behind it;
+ *  - every other row in the group keeps its stored spelling and is counted by
+ *    the warning below.
+ *
+ * A stranded row is not data loss but it is not a working operator either: the
+ * login read folds, so nothing will match its spelling until an operator
+ * renames it. Which admin account somebody's audit trail belongs to is not a
+ * decision a migration running unattended may take, and failing the deploy
+ * would stop every other repair in the same release over a pair of rows a human
+ * has to look at anyway.
+ *
+ * The admin side has one aggravating circumstance the buyer side does not: it
+ * ships no e-mail-keyed password reset, so a stranded operator has no
+ * self-service way back in at all. That is what the warning is for — it names a
+ * row somebody has to go and fix.
+ *
+ * ## Measured before it was written
+ *
+ * Zero collisions and zero mixed-case rows across both developer databases
+ * (`b2b`: 3 admin users; `b2b_test`: 4). The rules above are therefore written
+ * for the environments this will meet later, not for a pair of rows anybody has
+ * today.
+ */
+export class Migration20260819T155150AdminUsersFoldEmailCase extends Migration {
+    async up() {
+        // One winner per folded address: a row that already holds it first
+        // (`email = folded` sorts true-first under `desc`), then the earliest
+        // created, then the smallest id so the choice is deterministic. The winner
+        // is only updated when it does not already hold the folded value, which is
+        // also why this statement cannot violate the unique index: an update
+        // happens only for a group in which no row holds the target address.
+        this.addSql(`
+      with ranked as (
+        select "id",
+               lower(btrim("email")) as folded,
+               row_number() over (
+                 partition by lower(btrim("email"))
+                 order by ("email" = lower(btrim("email"))) desc,
+                          "created_at" asc,
+                          "id" asc
+               ) as rank
+          from "admin_users"
+      )
+      update "admin_users" au
+         set "email" = r.folded
+        from ranked r
+       where r."id" = au."id"
+         and r.rank = 1
+         and au."email" <> r.folded;
+    `);
+        // Say out loud what was left behind. A migration that quietly leaves an
+        // operator nobody can sign in as is the same class of defect as the one
+        // being repaired here.
+        this.addSql(`
+      do $$
+      declare
+        stranded integer;
+      begin
+        select count(*) into stranded
+          from "admin_users"
+         where "email" <> lower(btrim("email"));
+        if stranded > 0 then
+          raise warning
+            'admin_users: % row(s) kept a mixed-case e-mail because another admin user already holds the folded address. They cannot be signed into until an operator renames them.',
+            stranded;
+        end if;
+      end $$;
+    `);
+    }
+    async down() {
+        // Deliberately empty. The original capitalisation is not recorded anywhere
+        // — this migration overwrites the only copy of it — so there is nothing to
+        // restore, and an `up` that folded a handful of rows must not be paired
+        // with a `down` that pretends otherwise. Rolling this back means rolling
+        // back the code that reads the folded form; the rows are then already in
+        // the shape the old code wrote, which is what it was folding to anyway.
+    }
+}
+//# sourceMappingURL=20260819T155150_admin_users_fold_email_case.js.map

package/dist/migrations/20260819T155150_admin_users_fold_email_case.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260819T155150_admin_users_fold_email_case.js","sourceRoot":"","sources":["../../src/migrations/20260819T155150_admin_users_fold_email_case.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,OAAO,+CAAgD,SAAQ,SAAS;IACnE,KAAK,CAAC,EAAE;QACf,mEAAmE;QACnE,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;KAkBX,CAAC,CAAC;QAEH,wEAAwE;QACxE,wEAAwE;QACxE,uBAAuB;QACvB,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;KAcX,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;IAC1E,CAAC;CACF"}