@endora-commerce/mod-comparisons 0.0.0-stage → 0.100.0

package/dist/backend/entities/comparison.entity.js

@@ -0,0 +1,115 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, Index, OptionalProps, PrimaryKey, Property, Unique } from '@mikro-orm/core';
+import { CustomerScoped } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * Comparison — feature 007 / T011 / data-model.md §1.1.
+ *
+ * A customer-owned set of product references with a chosen display mode,
+ * an owner (customer account or anonymous browser session), an associated
+ * sales channel, and a stable shareable URL token. Owner is *exclusively*
+ * one of the two — the DB CHECK constraint
+ * `comparisons_owner_xor_chk` enforces it; the service layer also
+ * validates before insert.
+ *
+ * `displayMode` persists across re-opens so the customer's chosen mode is
+ * remembered. The default `'all'` matches spec FR-008.
+ *
+ * State transitions: live → deleted (hard delete; `comparison_products`
+ * cascades). No soft-delete: spec FR-014 requires the share-token endpoint
+ * to resolve to a clear "no longer exists" state, which a missing row
+ * already satisfies.
+ */
+let Comparison = class Comparison {
+    [OptionalProps];
+    id = randomUUID();
+    shareToken;
+    /**
+     * Set when the owner is authenticated. Mutually exclusive with
+     * `anonymousToken` (DB CHECK + service-side guard).
+     */
+    customerAccountId;
+    /**
+     * The organisation that owns this comparison — feature 087 Group B, ruling
+     * D-187.
+     *
+     * Derived from {@link customerAccountId}'s account and stamped at the write,
+     * never resolved on read: `customerOrganizationColumn` asks the ORM's own
+     * metadata whether this property exists, so its presence is what makes
+     * `customerFilterCond`'s `allowed-set` arm **grant** on this table rather
+     * than refuse it whole. A sales representative assigned to the buyer's
+     * organisation sees this row because this column is here.
+     *
+     * Nullable, and the constraint is an implication rather than an equivalence:
+     * `comparisons_organization_attribution_chk` requires an organisation of a
+     * row that names an account, and says nothing about a row that names none.
+     * An **anonymous** comparison is a representable state (FR-011) — this table
+     * enforces the owner XOR, so half of it is anonymous by construction — and
+     * who such a row belongs to is R-6's open question, which a constraint must
+     * not answer.
+     */
+    organizationId;
+    /**
+     * Set when the owner is an anonymous browser session. Same encoding as
+     * `shareToken` (16 random bytes, base64url) but a separate value so a
+     * leaked anonymous-cookie token does not double as a public share link.
+     */
+    anonymousToken;
+    salesChannelId;
+    displayMode = 'all';
+    createdAt = new Date();
+    updatedAt = new Date();
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], Comparison.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'string', length: 32 }),
+    Unique(),
+    __metadata("design:type", String)
+], Comparison.prototype, "shareToken", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    __metadata("design:type", Object)
+], Comparison.prototype, "customerAccountId", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    Index(),
+    __metadata("design:type", Object)
+], Comparison.prototype, "organizationId", void 0);
+__decorate([
+    Property({ type: 'string', length: 32, nullable: true }),
+    __metadata("design:type", Object)
+], Comparison.prototype, "anonymousToken", void 0);
+__decorate([
+    Property({ type: 'uuid' }),
+    Index(),
+    __metadata("design:type", String)
+], Comparison.prototype, "salesChannelId", void 0);
+__decorate([
+    Property({ type: 'string', length: 16 }),
+    __metadata("design:type", String)
+], Comparison.prototype, "displayMode", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], Comparison.prototype, "createdAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onUpdate: () => new Date() }),
+    __metadata("design:type", Date)
+], Comparison.prototype, "updatedAt", void 0);
+Comparison = __decorate([
+    CustomerScoped(),
+    Entity({ tableName: 'comparisons' })
+], Comparison);
+export { Comparison };
+//# sourceMappingURL=comparison.entity.js.map

package/dist/backend/entities/comparison.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comparison.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/comparison.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAIpC;;;;;;;;;;;;;;;;;GAiBG;AAGI,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,CAAC,aAAa,CAAC,CAOM;IAGrB,EAAE,GAAW,UAAU,EAAE,CAAC;IAI1B,UAAU,CAAU;IAEpB;;;OAGG;IAEH,iBAAiB,CAAiB;IAElC;;;;;;;;;;;;;;;;;;OAkBG;IAGH,cAAc,CAAiB;IAE/B;;;;OAIG;IAEH,cAAc,CAAiB;IAI/B,cAAc,CAAU;IAGxB,WAAW,GAA0B,KAAK,CAAC;IAG3C,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;IAG7B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;CAC9B,CAAA;AAxDC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;sCACH;AAI1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxC,MAAM,EAAE;;8CACW;AAOpB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACT;AAuBlC;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,KAAK,EAAE;;kDACuB;AAQ/B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDAC1B;AAI/B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE;;kDACgB;AAGxB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;+CACE;AAG3C;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;6CAAc;AAG7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;6CAAc;AAlElB,UAAU;IAFtB,cAAc,EAAE;IAChB,MAAM,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;GACxB,UAAU,CAmEtB"}

package/dist/backend/index.d.ts

@@ -0,0 +1,61 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { ModuleContext } from '@endora-commerce/platform/kernel';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import type { SettingsReadPort } from '@endora-commerce/platform/kernel';
+import { ComparisonService } from './services/comparison-service.js';
+import { ComparisonAdminService } from './services/comparison-admin.service.js';
+import { ShareTokenGenerator } from './services/share-token-generator.js';
+import { ComparisonProduct } from './entities/comparison-product.entity.js';
+import { Comparison } from './entities/comparison.entity.js';
+/**
+ * `comparisons` — the module that made a whole service to throw it away
+ * (feature 072, wave 2, T111).
+ *
+ * `ComparisonService`'s second constructor parameter was `_catalogQuery:
+ * CatalogQueryService` — underscore-prefixed, unused, kept with the comment
+ * "constructor contract kept; attribute reads moved to `catalogAttributes`".
+ * To feed it, each composition root built an entire `CatalogQueryService`,
+ * one of four per composition, and handed it to a parameter that discards it.
+ * The parameter is gone and so is the construction; `catalogAttributeRead` is
+ * what this module actually reads attributes through, and it stays.
+ *
+ * **`requireAdmin` becomes required, and this one failed *safe* before.** Where
+ * `cms` and `assets_library` defaulted an absent gate to a permissive no-op,
+ * this module's plugin read
+ *
+ *     if (options.requireAdmin) { await registerComparisonsAdminRoutes(…) }
+ *
+ * so an omitted gate removed the admin surface rather than opening it. That is
+ * the right direction to fail in, and it is still worth removing: whether an
+ * API exists at all should not be a side effect of an argument being passed.
+ * Both roots passed one, so the surface is unchanged.
+ *
+ * `settingsService` stops being optional too. Absent, `compare.max_products`
+ * silently fell back to a constant on every call, which is the quiet form —
+ * an operator's configured limit ignored with no indication.
+ *
+ * `comparisonService` is a **port**: the login flow adopts an anonymous
+ * comparison through it, across a module boundary.
+ */
+export interface ComparisonsCradle {
+    readonly emFactory: () => EntityManager;
+    readonly requireAdmin: RequireAdminFactory;
+    readonly settingsReadPort: SettingsReadPort;
+    readonly comparisonService: ComparisonService;
+    readonly comparisonAdminService: ComparisonAdminService;
+    readonly comparisonShareTokens: ShareTokenGenerator;
+}
+export declare function registerModule(ctx: ModuleContext): void;
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export declare const entities: (typeof Comparison | typeof ComparisonProduct)[];
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAS3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAK1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IACxD,QAAQ,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;CACrD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CA8GvD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,kDAGpB,CAAC"}

package/dist/backend/index.js

@@ -0,0 +1,117 @@
+import { lazyPort } from '@endora-commerce/platform/kernel';
+import { ComparisonService } from './services/comparison-service.js';
+import { ComparisonAdminService } from './services/comparison-admin.service.js';
+import { ComparableAttributeProjection } from './services/comparable-attribute-projection.js';
+import { ShareTokenGenerator } from './services/share-token-generator.js';
+import { ComparisonPdfRenderer } from './services/comparison-pdf-renderer.js';
+import { registerComparisonsPublicRoutes } from './routes.public.js';
+import { registerComparisonsShareRoutes } from './routes.share.js';
+import { registerComparisonsAdminRoutes } from './routes.admin.js';
+import { ComparisonProduct } from './entities/comparison-product.entity.js';
+import { Comparison } from './entities/comparison.entity.js';
+export function registerModule(ctx) {
+    ctx.di.providePort('comparisonService', ctx
+        .asFunction(({ emFactory }) => new ComparisonService(emFactory, new ComparableAttributeProjection(), ctx.cradle().comparisonShareTokens, 
+    // Feature 075, Phase C — the products a comparison holds are
+    // `catalog`'s rows. They used to be read with `em.find(Product, …)`
+    // from inside this module, which no gate can see; over the port the
+    // same read answers 503 when `catalog` is off, which is the
+    // binding dependency this manifest declares.
+    lazyPort(ctx, 'catalogProductReadPort'), 
+    // Issue #259 — the channel assortment gate on the add seam. A
+    // kernel registration, so there is no module edge to declare and
+    // nothing to switch off underneath it.
+    lazyPort(ctx, 'salesChannelMembershipPort'), 
+    // Feature 075 / D-87 — the base image of a column, over `catalog`'s
+    // batch gallery read. It used to be a three-table join written
+    // here, reaching two of `catalog`'s tables and one of
+    // `assets_library`'s; a raw statement names no import specifier, so
+    // nothing in the tree could see it and no gate could stop it. The
+    // edge binds — `catalog` is already a dependency of this manifest,
+    // and a comparison whose products are unreadable has no column to
+    // put an image in.
+    lazyPort(ctx, 'galleryService'), lazyPort(ctx, 'settingsReadPort'), 
+    // The attribute read model, now `catalog`'s published port rather
+    // than a hand-made adapter over a name a root registered.
+    lazyPort(ctx, 'catalogAttributeReadPort'), 
+    // Issue #132 — a comparison column is a listing and prices through
+    // the engine, not off the catalogue's legacy attribute.
+    lazyPort(ctx, 'pricingService'), 
+    // The viewer's organisation, for the customer group the pricing
+    // engine selects a group-targeted list by. The edge binds: a
+    // comparison that cannot read the buyer's organisation would quote
+    // the channel price to a buyer who has negotiated one, which is
+    // silently wrong rather than visibly refused.
+    lazyPort(ctx, 'organizationDetailsPort'), 
+    // Feature 087 Group B / D-187 — the organisation an owned
+    // comparison is stamped with, derived from the owning account
+    // rather than from the ambient request context. Both write paths
+    // need it and only one of them has a request:
+    // `adoptAnonymousComparison` runs inside the post-login hook. The
+    // edge binds — a comparison this module cannot attribute is a row
+    // `comparisons_organization_attribution_chk` refuses, so failing
+    // closed at the port is the same answer arriving earlier and with
+    // the account named. Nothing to declare: the same port is already
+    // resolved for `comparisonAdminService` below, and
+    // `check:port-dependencies` reads the manifest's transitive
+    // closure.
+    lazyPort(ctx, 'customerAccountReadPort')))
+        .singleton());
+    ctx.di.register({
+        // One generator, registered rather than constructed twice. It happens to be
+        // stateless today — `randomBytes(16)` and nothing else — so two instances
+        // would agree; registering it means that stays true by construction rather
+        // than by the class never gaining a key.
+        comparisonShareTokens: ctx.asFunction(() => new ShareTokenGenerator()).singleton(),
+        comparisonAdminService: ctx
+            .asFunction(({ emFactory }) => new ComparisonAdminService(emFactory, 
+        // Resolved per call, not captured. `comparisonService` is a
+        // transient port gate and Awilix's strict mode refuses a singleton
+        // holding one — rightly, since a captured port keeps answering
+        // after its module is switched off. `buildOwnerView` is the only
+        // method this service reaches.
+        {
+            buildOwnerView: (...args) => ctx.cradle().comparisonService.buildOwnerView(...args),
+        }, 
+        // Feature 075, Phase C — the owner column's e-mail address is
+        // `customer_accounts`' row, read over its port instead of out of
+        // its table.
+        lazyPort(ctx, 'customerAccountReadPort')))
+            .singleton(),
+    });
+    ctx.routes(async (app) => {
+        const { requireAdmin, comparisonShareTokens } = ctx.cradle();
+        // The module's own two ports, read lazily. Route *registration* runs
+        // whatever the module's effective state is — `defineModuleRoutes` gates
+        // requests, not the wiring — so destructuring a gated port here asked the
+        // gate inside `buildServer`, and an operator who had switched `comparisons`
+        // off stopped the backend from starting rather than stopping its routes.
+        const comparisonService = lazyPort(ctx, 'comparisonService');
+        await registerComparisonsPublicRoutes(app, {
+            comparisonService,
+            tokens: comparisonShareTokens,
+            pdfRenderer: new ComparisonPdfRenderer(),
+        });
+        await registerComparisonsShareRoutes(app, { comparisonService });
+        await registerComparisonsAdminRoutes(app, {
+            adminService: lazyPort(ctx, 'comparisonAdminService'),
+            requireAdmin,
+        });
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export const entities = [
+    ComparisonProduct,
+    Comparison,
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAI5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AA0C7D,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,mBAAmB,EACnB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAqB,EAAE,EAAE,CACnC,IAAI,iBAAiB,CACnB,SAAS,EACT,IAAI,6BAA6B,EAAE,EACnC,GAAG,CAAC,MAAM,EAAqB,CAAC,qBAAqB;IACrD,6DAA6D;IAC7D,oEAAoE;IACpE,oEAAoE;IACpE,4DAA4D;IAC5D,6CAA6C;IAC7C,QAAQ,CAAyB,GAAG,EAAE,wBAAwB,CAAC;IAC/D,8DAA8D;IAC9D,iEAAiE;IACjE,uCAAuC;IACvC,QAAQ,CAA6B,GAAG,EAAE,4BAA4B,CAAC;IACvE,oEAAoE;IACpE,+DAA+D;IAC/D,sDAAsD;IACtD,oEAAoE;IACpE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,mBAAmB;IACnB,QAAQ,CAAqB,GAAG,EAAE,gBAAgB,CAAC,EACnD,QAAQ,CAAmB,GAAG,EAAE,kBAAkB,CAAC;IACnD,kEAAkE;IAClE,0DAA0D;IAC1D,QAAQ,CAA2B,GAAG,EAAE,0BAA0B,CAAC;IACnE,mEAAmE;IACnE,wDAAwD;IACxD,QAAQ,CAAmB,GAAG,EAAE,gBAAgB,CAAC;IACjD,gEAAgE;IAChE,6DAA6D;IAC7D,mEAAmE;IACnE,gEAAgE;IAChE,8CAA8C;IAC9C,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC;IACjE,0DAA0D;IAC1D,8DAA8D;IAC9D,iEAAiE;IACjE,8CAA8C;IAC9C,kEAAkE;IAClE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,kEAAkE;IAClE,mDAAmD;IACnD,4DAA4D;IAC5D,WAAW;IACX,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC,CAClE,CACJ;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yCAAyC;QACzC,qBAAqB,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE;QAElF,sBAAsB,EAAE,GAAG;aACxB,UAAU,CACT,CAAC,EAAE,SAAS,EAAqB,EAAE,EAAE,CACnC,IAAI,sBAAsB,CACxB,SAAS;QACT,4DAA4D;QAC5D,mEAAmE;QACnE,+DAA+D;QAC/D,iEAAiE;QACjE,+BAA+B;QAC/B;YACE,cAAc,EAAE,CACd,GAAG,IAAqD,EACxD,EAAE,CAAC,GAAG,CAAC,MAAM,EAAqB,CAAC,iBAAiB,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;SAC1D;QACtB,8DAA8D;QAC9D,iEAAiE;QACjE,aAAa;QACb,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC,CAClE,CACJ;aACA,SAAS,EAAE;KACf,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAqB,CAAC;QAChF,qEAAqE;QACrE,wEAAwE;QACxE,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,iBAAiB,GAAG,QAAQ,CAAoB,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAChF,MAAM,+BAA+B,CAAC,GAAG,EAAE;YACzC,iBAAiB;YACjB,MAAM,EAAE,qBAAqB;YAC7B,WAAW,EAAE,IAAI,qBAAqB,EAAE;SACzC,CAAC,CAAC;QACH,MAAM,8BAA8B,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjE,MAAM,8BAA8B,CAAC,GAAG,EAAE;YACxC,YAAY,EAAE,QAAQ,CAAyB,GAAG,EAAE,wBAAwB,CAAC;YAC7E,YAAY;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,iBAAiB;IACjB,UAAU;CACX,CAAC"}

package/dist/backend/request-actor.d.ts

@@ -0,0 +1,22 @@
+import type { FastifyRequest } from 'fastify';
+/**
+ * The signed-in customer behind a request, or `null`.
+ *
+ * `request.actor` is not on `FastifyRequest`: it is a declaration-merging
+ * augmentation the `auth` module contributes (`modules/auth/plugin.ts`). Inside
+ * `backend/src` that augmentation arrived ambiently through the host's own
+ * `types` graph, so nothing in this module ever named it. A package compiles
+ * against its own manifest and `auth` publishes nothing a package can name — it
+ * is the one module still holding an unpublished platform reach — so the
+ * property is simply not there (TS2339).
+ *
+ * So the shape is read structurally, in **one** place rather than at each of the
+ * three call sites, and it is the same door `admin_notifications` already uses
+ * for the admin half of the same augmentation. It narrows rather than asserts:
+ * a request carrying no actor, or an actor of another kind, answers `null`, so
+ * the anonymous `compare_token` path is reached exactly as before.
+ */
+export declare function customerActor(request: FastifyRequest): {
+    customerAccountId: string;
+} | null;
+//# sourceMappingURL=request-actor.d.ts.map

package/dist/backend/request-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-actor.d.ts","sourceRoot":"","sources":["../../src/backend/request-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM3F"}

package/dist/backend/request-actor.js

@@ -0,0 +1,24 @@
+/**
+ * The signed-in customer behind a request, or `null`.
+ *
+ * `request.actor` is not on `FastifyRequest`: it is a declaration-merging
+ * augmentation the `auth` module contributes (`modules/auth/plugin.ts`). Inside
+ * `backend/src` that augmentation arrived ambiently through the host's own
+ * `types` graph, so nothing in this module ever named it. A package compiles
+ * against its own manifest and `auth` publishes nothing a package can name — it
+ * is the one module still holding an unpublished platform reach — so the
+ * property is simply not there (TS2339).
+ *
+ * So the shape is read structurally, in **one** place rather than at each of the
+ * three call sites, and it is the same door `admin_notifications` already uses
+ * for the admin half of the same augmentation. It narrows rather than asserts:
+ * a request carrying no actor, or an actor of another kind, answers `null`, so
+ * the anonymous `compare_token` path is reached exactly as before.
+ */
+export function customerActor(request) {
+    const { actor } = request;
+    if (actor?.kind !== 'customer' || typeof actor.customerAccountId !== 'string')
+        return null;
+    return { customerAccountId: actor.customerAccountId };
+}
+//# sourceMappingURL=request-actor.js.map

package/dist/backend/request-actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-actor.js","sourceRoot":"","sources":["../../src/backend/request-actor.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,OAEjB,CAAC;IACF,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3F,OAAO,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;AACxD,CAAC"}

package/dist/backend/routes.admin.d.ts

@@ -0,0 +1,22 @@
+import type { FastifyInstance } from 'fastify';
+import type { ComparisonAdminService } from './services/comparison-admin.service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * Admin HTTP surface — feature 007 / US5 / T064.
+ *
+ * Mounts under `/api/v1/admin/comparisons/*` and is GET-only:
+ *
+ *   - GET /api/v1/admin/comparisons         — list with filters
+ *   - GET /api/v1/admin/comparisons/:id     — single-comparison detail
+ *
+ * Spec FR-022: "MUST allow an administrator to open any single
+ * Comparison and inspect ... without offering any controls that mutate
+ * the Comparison." Translated literally — no PATCH, no POST, no
+ * DELETE under this prefix.
+ */
+export interface ComparisonsAdminDeps {
+    adminService: ComparisonAdminService;
+    requireAdmin: RequireAdminFactory;
+}
+export declare function registerComparisonsAdminRoutes(app: FastifyInstance, deps: ComparisonsAdminDeps): Promise<void>;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/backend/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAO/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,sBAAsB,CAAC;IACrC,YAAY,EAAE,mBAAmB,CAAC;CACnC;AAED,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CA+Bf"}

package/dist/backend/routes.admin.js

@@ -0,0 +1,41 @@
+import { ERROR_CODES, comparisonAdminListQuerySchema, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { ComparisonNotFoundError } from './services/comparison-service.js';
+export async function registerComparisonsAdminRoutes(app, deps) {
+    const { adminService, requireAdmin } = deps;
+    app.get('/api/v1/admin/comparisons', { preHandler: requireAdmin('comparisons:read') }, async (request) => {
+        const query = parseListQuery(request.query);
+        const { data, nextCursor, limit } = await adminService.list(query);
+        return { data, meta: { limit, nextCursor } };
+    });
+    app.get('/api/v1/admin/comparisons/:id', { preHandler: requireAdmin('comparisons:read') }, async (request) => {
+        try {
+            return { data: await adminService.detail(request.params.id) };
+        }
+        catch (err) {
+            if (err instanceof ComparisonNotFoundError) {
+                throw new HttpError(404, ERROR_CODES.COMPARISON_NOT_FOUND, 'Comparison not found.');
+            }
+            throw err;
+        }
+    });
+}
+function parseListQuery(input) {
+    // Coerce numeric strings (Fastify hands query params as strings) before Zod.
+    const raw = (input ?? {});
+    const coerced = {
+        ...raw,
+        ...(typeof raw['limit'] === 'string'
+            ? { limit: Number(raw['limit']) }
+            : {}),
+    };
+    const parsed = comparisonAdminListQuerySchema.safeParse(coerced);
+    if (!parsed.success) {
+        throw new HttpError(422, ERROR_CODES.VALIDATION_FAILED, 'Validation failed.', parsed.error.issues.map((i) => ({
+            path: i.path.map(String).join('.'),
+            issue: i.message,
+        })));
+    }
+    return parsed.data;
+}
+//# sourceMappingURL=routes.admin.js.map

package/dist/backend/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAuB3E,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAoB,EACpB,IAA0B;IAE1B,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE5C,GAAG,CAAC,GAAG,CACL,2BAA2B,EAC3B,EAAE,UAAU,EAAE,YAAY,CAAC,kBAAkB,CAAC,EAAE,EAChD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IAC/C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,+BAA+B,EAC/B,EAAE,UAAU,EAAE,YAAY,CAAC,kBAAkB,CAAC,EAAE,EAChD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,oBAAoB,EAChC,uBAAuB,CACxB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,6EAA6E;IAC7E,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IACrD,MAAM,OAAO,GAAG;QACd,GAAG,GAAG;QACN,GAAG,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;YAClC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE;YACjC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,iBAAiB,EAC7B,oBAAoB,EACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,KAAK,EAAE,CAAC,CAAC,OAAO;SACjB,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/backend/routes.public.d.ts

@@ -0,0 +1,33 @@
+import type { FastifyInstance } from 'fastify';
+import { type ComparisonService } from './services/comparison-service.js';
+import type { ComparisonPdfRenderer } from './services/comparison-pdf-renderer.js';
+import { COMPARE_TOKEN_COOKIE } from './services/anonymous-token-cookie.js';
+import type { ShareTokenGenerator } from './services/share-token-generator.js';
+/**
+ * Public HTTP surface — feature 007 / US1 (T027).
+ *
+ * Routes mounted under `/api/v1/comparisons/me*` (project convention is
+ * `/api/v1/<module>/<resource>`; the contract README's `/public/`
+ * prefix follows spec wording but the codebase strips it — same as
+ * `catalog`, `search`, `sales_channels`).
+ *
+ *   - GET    /me                        — read; 204 when none exists
+ *   - POST   /me/products               — add (creates on first call,
+ *                                         mints `compare_token` cookie)
+ *   - DELETE /me/products/:productId    — remove
+ *   - PATCH  /me                        — update display mode
+ *   - DELETE /me                        — hard-delete the comparison
+ *
+ * Owner resolution: authenticated customer wins over anonymous cookie.
+ * On a write where neither is present, a fresh anonymous token is
+ * minted and the `compare_token` cookie is set on the response (R-2).
+ */
+export interface ComparisonsPublicDeps {
+    comparisonService: ComparisonService;
+    tokens: ShareTokenGenerator;
+    /** Optional — when omitted, `GET /me/pdf` is not mounted (foundation tests). */
+    pdfRenderer?: ComparisonPdfRenderer;
+}
+export declare function registerComparisonsPublicRoutes(app: FastifyInstance, deps: ComparisonsPublicDeps): Promise<void>;
+export { COMPARE_TOKEN_COOKIE };
+//# sourceMappingURL=routes.public.d.ts.map

package/dist/backend/routes.public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.d.ts","sourceRoot":"","sources":["../../src/backend/routes.public.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAU7E,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EACL,oBAAoB,EAGrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAI/E;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,gFAAgF;IAChF,WAAW,CAAC,EAAE,qBAAqB,CAAC;CACrC;AAED,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC,CA6Kf;AAoGD,OAAO,EAAE,oBAAoB,EAAE,CAAC"}