@endora-commerce/mod-customer-accounts 0.100.0

package/dist/migrations/20260611T140403_customer_accounts_lifecycle.d.ts

@@ -0,0 +1,54 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 040 (Customers) — extends `customer_accounts` with the lifecycle
+ * fields the Customers module needs:
+ *
+ *  - `customer_group_id` — direct customer→customer-group membership (FR-022),
+ *    FK to `customer_groups` ON DELETE SET NULL.
+ *  - block state + provenance (`blocked_at`, `block_reason`, `block_source`,
+ *    `blocked_by_admin_user_id`, `blocked_by_customer_account_id`) — FR-012…017.
+ *  - deletion / anonymization state (`deletion_requested_by_admin_user_id`,
+ *    `anonymized_at`) paired with the existing `deleted_at` — FR-039/FR-040.
+ *
+ * All columns are nullable; existing rows are unaffected.
+ *
+ * **It also creates `customer_groups` since
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3.** The table was
+ * created by `price_lists`' frozen
+ * `Migration20260426T075235PriceListsPricingInit` while this module owns it —
+ * its `CustomerGroup` entity declares the table name — because tiered pricing
+ * needed customer groups first and created them where it needed them.
+ * The table was created by whoever needed it first rather than by whoever owns
+ * it, and the comment above used to record that as *"owned by price_lists"*.
+ *
+ * **Why this site is repaired while 27 other misfiled creations are not.**
+ * Moving a *reference* into its owner's module can only move it strictly later
+ * in the computed order, which is always safe; moving a *creation* moves it to
+ * a position every existing reference must be re-checked against. The other 27
+ * fail **safe** — a client omitting `catalog` gets an empty `products` table.
+ * This one also produced a fail-**closed** reference: the foreign key below
+ * named a table outside this module's closure, and declaring `price_lists`
+ * here to fix that would close a cycle, `price_lists` already declaring
+ * `customer_accounts`. That, and nothing else, is why it is on the list
+ * (owner's ruling, 2026-09-12).
+ *
+ * **The re-check, derived from the computed order rather than from a stamp.**
+ * The only reference to `customer_groups` in the entire corpus is this
+ * migration's own foreign key, three statements below. `price_lists` does not
+ * reference it: `price_list_assignments.customer_group_id` is a nullable column
+ * with an index and no foreign key, and so is `organizations.customer_group_id`.
+ * So the creation is placed in the frozen body that carries the only reference,
+ * above it, and every position in between is unaffected.
+ *
+ * **`if not exists`, and it is load-bearing.** A database that applied the
+ * April migration and has not yet reached this one already has the table while
+ * this migration is pending; a verbatim `create table` would fail there. Both
+ * class names are unchanged and `BASELINE_MIGRATIONS` is untouched —
+ * `mikro_orm_migrations` persists the class name and no checksum, so neither
+ * edited body is re-offered to a database that has applied it.
+ */
+export declare class Migration20260611T140403CustomerAccountsLifecycle extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260611T140403_customer_accounts_lifecycle.d.ts.map

package/dist/migrations/20260611T140403_customer_accounts_lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140403_customer_accounts_lifecycle.d.ts","sourceRoot":"","sources":["../../src/migrations/20260611T140403_customer_accounts_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,qBAAa,iDAAkD,SAAQ,SAAS;IAC/D,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAqCnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAgBrC"}

package/dist/migrations/20260611T140403_customer_accounts_lifecycle.js

@@ -0,0 +1,97 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 040 (Customers) — extends `customer_accounts` with the lifecycle
+ * fields the Customers module needs:
+ *
+ *  - `customer_group_id` — direct customer→customer-group membership (FR-022),
+ *    FK to `customer_groups` ON DELETE SET NULL.
+ *  - block state + provenance (`blocked_at`, `block_reason`, `block_source`,
+ *    `blocked_by_admin_user_id`, `blocked_by_customer_account_id`) — FR-012…017.
+ *  - deletion / anonymization state (`deletion_requested_by_admin_user_id`,
+ *    `anonymized_at`) paired with the existing `deleted_at` — FR-039/FR-040.
+ *
+ * All columns are nullable; existing rows are unaffected.
+ *
+ * **It also creates `customer_groups` since
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3.** The table was
+ * created by `price_lists`' frozen
+ * `Migration20260426T075235PriceListsPricingInit` while this module owns it —
+ * its `CustomerGroup` entity declares the table name — because tiered pricing
+ * needed customer groups first and created them where it needed them.
+ * The table was created by whoever needed it first rather than by whoever owns
+ * it, and the comment above used to record that as *"owned by price_lists"*.
+ *
+ * **Why this site is repaired while 27 other misfiled creations are not.**
+ * Moving a *reference* into its owner's module can only move it strictly later
+ * in the computed order, which is always safe; moving a *creation* moves it to
+ * a position every existing reference must be re-checked against. The other 27
+ * fail **safe** — a client omitting `catalog` gets an empty `products` table.
+ * This one also produced a fail-**closed** reference: the foreign key below
+ * named a table outside this module's closure, and declaring `price_lists`
+ * here to fix that would close a cycle, `price_lists` already declaring
+ * `customer_accounts`. That, and nothing else, is why it is on the list
+ * (owner's ruling, 2026-09-12).
+ *
+ * **The re-check, derived from the computed order rather than from a stamp.**
+ * The only reference to `customer_groups` in the entire corpus is this
+ * migration's own foreign key, three statements below. `price_lists` does not
+ * reference it: `price_list_assignments.customer_group_id` is a nullable column
+ * with an index and no foreign key, and so is `organizations.customer_group_id`.
+ * So the creation is placed in the frozen body that carries the only reference,
+ * above it, and every position in between is unaffected.
+ *
+ * **`if not exists`, and it is load-bearing.** A database that applied the
+ * April migration and has not yet reached this one already has the table while
+ * this migration is pending; a verbatim `create table` would fail there. Both
+ * class names are unchanged and `BASELINE_MIGRATIONS` is untouched —
+ * `mikro_orm_migrations` persists the class name and no checksum, so neither
+ * edited body is re-offered to a database that has applied it.
+ */
+export class Migration20260611T140403CustomerAccountsLifecycle extends Migration {
+    async up() {
+        this.addSql(`
+      create table if not exists "customer_groups" (
+        "id" uuid not null,
+        "code" varchar(64) not null,
+        "name" varchar(160) not null,
+        "description" varchar(1000) null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "customer_groups_pkey" primary key ("id"),
+        constraint "customer_groups_code_unique" unique ("code")
+      );
+    `);
+        this.addSql(`alter table "customer_accounts"
+      add column "customer_group_id" uuid null,
+      add column "blocked_at" timestamptz null,
+      add column "block_reason" text null,
+      add column "block_source" varchar(16) null,
+      add column "blocked_by_admin_user_id" uuid null,
+      add column "blocked_by_customer_account_id" uuid null,
+      add column "deletion_requested_by_admin_user_id" uuid null,
+      add column "anonymized_at" timestamptz null;`);
+        this.addSql(`alter table "customer_accounts"
+      add constraint "customer_accounts_customer_group_fk"
+      foreign key ("customer_group_id") references "customer_groups" ("id")
+      on update cascade on delete set null;`);
+        this.addSql(`create index "customer_accounts_customer_group_id_index" on "customer_accounts" ("customer_group_id");`);
+        this.addSql(`create index "customer_accounts_blocked_at_index" on "customer_accounts" ("blocked_at");`);
+    }
+    async down() {
+        this.addSql(`alter table "customer_accounts"
+      drop constraint if exists "customer_accounts_customer_group_fk";`);
+        this.addSql(`drop index if exists "customer_accounts_customer_group_id_index";`);
+        this.addSql(`drop index if exists "customer_accounts_blocked_at_index";`);
+        this.addSql(`alter table "customer_accounts"
+      drop column if exists "customer_group_id",
+      drop column if exists "blocked_at",
+      drop column if exists "block_reason",
+      drop column if exists "block_source",
+      drop column if exists "blocked_by_admin_user_id",
+      drop column if exists "blocked_by_customer_account_id",
+      drop column if exists "deletion_requested_by_admin_user_id",
+      drop column if exists "anonymized_at";`);
+        this.addSql('drop table if exists "customer_groups" cascade;');
+    }
+}
+//# sourceMappingURL=20260611T140403_customer_accounts_lifecycle.js.map

package/dist/migrations/20260611T140403_customer_accounts_lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140403_customer_accounts_lifecycle.js","sourceRoot":"","sources":["../../src/migrations/20260611T140403_customer_accounts_lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,OAAO,iDAAkD,SAAQ,SAAS;IACrE,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;KAWX,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC;;;;;;;;mDAQmC,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,CAAC;;;4CAG4B,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,CACT,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC;uEACuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,mEAAmE,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC;;;;;;;;6CAQ6B,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/migrations/20260718T200341_customer_accounts_customer_account_custom_field_values.d.ts

@@ -0,0 +1,12 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 055 — Custom Fields Layer. Additive: adds the `custom_field_values`
+ * JSONB bag to `customer_accounts` so operator-defined fields persist on the host row.
+ * The column inherits the host entity's tenant classification (Principle XI);
+ * no scoping column is added.
+ */
+export declare class Migration20260718T200341CustomerAccountsCustomerAccountCustomFieldValues extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260718T200341_customer_accounts_customer_account_custom_field_values.d.ts.map

package/dist/migrations/20260718T200341_customer_accounts_customer_account_custom_field_values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260718T200341_customer_accounts_customer_account_custom_field_values.d.ts","sourceRoot":"","sources":["../../src/migrations/20260718T200341_customer_accounts_customer_account_custom_field_values.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;GAKG;AACH,qBAAa,wEAAyE,SAAQ,SAAS;IACtF,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260718T200341_customer_accounts_customer_account_custom_field_values.js

@@ -0,0 +1,16 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 055 — Custom Fields Layer. Additive: adds the `custom_field_values`
+ * JSONB bag to `customer_accounts` so operator-defined fields persist on the host row.
+ * The column inherits the host entity's tenant classification (Principle XI);
+ * no scoping column is added.
+ */
+export class Migration20260718T200341CustomerAccountsCustomerAccountCustomFieldValues extends Migration {
+    async up() {
+        this.addSql(`alter table "customer_accounts" add column "custom_field_values" jsonb not null default '{}';`);
+    }
+    async down() {
+        this.addSql(`alter table "customer_accounts" drop column "custom_field_values";`);
+    }
+}
+//# sourceMappingURL=20260718T200341_customer_accounts_customer_account_custom_field_values.js.map

package/dist/migrations/20260718T200341_customer_accounts_customer_account_custom_field_values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260718T200341_customer_accounts_customer_account_custom_field_values.js","sourceRoot":"","sources":["../../src/migrations/20260718T200341_customer_accounts_customer_account_custom_field_values.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;GAKG;AACH,MAAM,OAAO,wEAAyE,SAAQ,SAAS;IAC5F,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CACT,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,oEAAoE,CAAC,CAAC;IACpF,CAAC;CACF"}

package/dist/migrations/20260720T044255_customer_accounts_customer_subtree_rollup.d.ts

@@ -0,0 +1,14 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 056 (T032) — customer-side roll-up capability.
+ *
+ * Adds `customer_accounts.subtree_rollup_enabled` (boolean, NOT NULL DEFAULT
+ * false). When true, the customer's tenant scope widens from single-org to its
+ * organization's subtree (server-derived, Principle XI). Default false ⇒ every
+ * existing customer stays node-only, preserving flat behavior byte-for-byte.
+ */
+export declare class Migration20260720T044255CustomerAccountsCustomerSubtreeRollup extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260720T044255_customer_accounts_customer_subtree_rollup.d.ts.map

package/dist/migrations/20260720T044255_customer_accounts_customer_subtree_rollup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260720T044255_customer_accounts_customer_subtree_rollup.d.ts","sourceRoot":"","sources":["../../src/migrations/20260720T044255_customer_accounts_customer_subtree_rollup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;GAOG;AACH,qBAAa,6DAA8D,SAAQ,SAAS;IAC3E,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260720T044255_customer_accounts_customer_subtree_rollup.js

@@ -0,0 +1,18 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 056 (T032) — customer-side roll-up capability.
+ *
+ * Adds `customer_accounts.subtree_rollup_enabled` (boolean, NOT NULL DEFAULT
+ * false). When true, the customer's tenant scope widens from single-org to its
+ * organization's subtree (server-derived, Principle XI). Default false ⇒ every
+ * existing customer stays node-only, preserving flat behavior byte-for-byte.
+ */
+export class Migration20260720T044255CustomerAccountsCustomerSubtreeRollup extends Migration {
+    async up() {
+        this.addSql('alter table "customer_accounts" add column "subtree_rollup_enabled" boolean not null default false;');
+    }
+    async down() {
+        this.addSql('alter table "customer_accounts" drop column "subtree_rollup_enabled";');
+    }
+}
+//# sourceMappingURL=20260720T044255_customer_accounts_customer_subtree_rollup.js.map

package/dist/migrations/20260720T044255_customer_accounts_customer_subtree_rollup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260720T044255_customer_accounts_customer_subtree_rollup.js","sourceRoot":"","sources":["../../src/migrations/20260720T044255_customer_accounts_customer_subtree_rollup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,OAAO,6DAA8D,SAAQ,SAAS;IACjF,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CACT,qGAAqG,CACtG,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;CACF"}

package/dist/migrations/20260819T074816_customer_accounts_password_set_at.d.ts

@@ -0,0 +1,22 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Issue #222 — `customer_accounts.password_set_at`.
+ *
+ * `password_hash` is NOT NULL for every account, including the ones federated
+ * sign-in auto-creates with a random pair of UUIDs nobody is told, so it cannot
+ * answer "does the holder have a password they can use". This column can.
+ *
+ * **Backfilled `null` for every existing row, with no conditional logic.** The
+ * alternative considered was `created_at` for everyone except accounts holding
+ * a social link — but there are no socially-created accounts anywhere, so that
+ * exception has an empty extension and what would actually ship is `created_at`
+ * for *every* row: the claim that every existing holder personally chose their
+ * password, which is untrue for any account an admin, an import or any other
+ * on-their-behalf path created. `null` says what is true — we do not know — and
+ * becomes accurate for every account from the first write onwards.
+ */
+export declare class Migration20260819T074816CustomerAccountsPasswordSetAt extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260819T074816_customer_accounts_password_set_at.d.ts.map

package/dist/migrations/20260819T074816_customer_accounts_password_set_at.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260819T074816_customer_accounts_password_set_at.d.ts","sourceRoot":"","sources":["../../src/migrations/20260819T074816_customer_accounts_password_set_at.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qDAAsD,SAAQ,SAAS;IACnE,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAInB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260819T074816_customer_accounts_password_set_at.js

@@ -0,0 +1,26 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Issue #222 — `customer_accounts.password_set_at`.
+ *
+ * `password_hash` is NOT NULL for every account, including the ones federated
+ * sign-in auto-creates with a random pair of UUIDs nobody is told, so it cannot
+ * answer "does the holder have a password they can use". This column can.
+ *
+ * **Backfilled `null` for every existing row, with no conditional logic.** The
+ * alternative considered was `created_at` for everyone except accounts holding
+ * a social link — but there are no socially-created accounts anywhere, so that
+ * exception has an empty extension and what would actually ship is `created_at`
+ * for *every* row: the claim that every existing holder personally chose their
+ * password, which is untrue for any account an admin, an import or any other
+ * on-their-behalf path created. `null` says what is true — we do not know — and
+ * becomes accurate for every account from the first write onwards.
+ */
+export class Migration20260819T074816CustomerAccountsPasswordSetAt extends Migration {
+    async up() {
+        this.addSql('alter table "customer_accounts" add column "password_set_at" timestamptz null;');
+    }
+    async down() {
+        this.addSql('alter table "customer_accounts" drop column "password_set_at";');
+    }
+}
+//# sourceMappingURL=20260819T074816_customer_accounts_password_set_at.js.map

package/dist/migrations/20260819T074816_customer_accounts_password_set_at.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260819T074816_customer_accounts_password_set_at.js","sourceRoot":"","sources":["../../src/migrations/20260819T074816_customer_accounts_password_set_at.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qDAAsD,SAAQ,SAAS;IACzE,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,gFAAgF,CAAC,CAAC;IAChG,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/migrations/20260819T142837_customer_accounts_fold_email_case.d.ts

@@ -0,0 +1,46 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Fold `customer_accounts.email` to the form the code now stores and compares.
+ *
+ * The writes folded the address and the login read did not, so a buyer who
+ * registered as `Jan.Kowalski@example.pl` could never sign in: Postgres' `=` on
+ * `text` is case-sensitive and the row said `jan.kowalski@example.pl`. The code
+ * side of the repair makes every read and every write go through
+ * `normalizeEmailAddress`; this migration brings the rows written before it to
+ * the same form, so an address stored mixed-case stays reachable.
+ *
+ * ## What a collision means, and why it does not fail the deploy
+ *
+ * Two rows differing only in case are two accounts that the fold turns into one
+ * address, and `customer_accounts_email_unique` will not hold both. The
+ * migration therefore **folds one row per address and leaves the rest exactly as
+ * they are** — it drops nothing, merges nothing and refuses nothing:
+ *
+ *  - a row that **already holds the folded address** wins it, because it is the
+ *    one every other table's foreign keys have been resolving to by that
+ *    address all along;
+ *  - otherwise the **earliest-created** row wins it, since it is the account
+ *    with the longer history of orders, invoices and addresses behind it;
+ *  - every other row in the group keeps its stored spelling and is counted by
+ *    the warning below.
+ *
+ * A stranded row is not data loss but it is not a working account either: the
+ * login read folds, so nothing will match its spelling until an operator merges
+ * or renames it. That is a decision about somebody's orders, and a migration
+ * running unattended must not take it. The alternative — failing the deploy —
+ * would stop every other repair in the same release over a pair of rows that a
+ * human has to look at anyway.
+ *
+ * ## Measured before it was written
+ *
+ * Zero collisions and zero mixed-case rows across both developer databases
+ * (`b2b`: 1 account; `b2b_test`: 3), which is what the two-developer-environment
+ * / no-production state of the platform predicts. The rules above are therefore
+ * written for the environments this will meet later, not for a pair of rows
+ * anybody has today.
+ */
+export declare class Migration20260819T142837CustomerAccountsFoldEmailCase extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260819T142837_customer_accounts_fold_email_case.d.ts.map

package/dist/migrations/20260819T142837_customer_accounts_fold_email_case.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260819T142837_customer_accounts_fold_email_case.d.ts","sourceRoot":"","sources":["../../src/migrations/20260819T142837_customer_accounts_fold_email_case.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBAAa,qDAAsD,SAAQ,SAAS;IACnE,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IA+CnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAQrC"}

package/dist/migrations/20260819T142837_customer_accounts_fold_email_case.js

@@ -0,0 +1,97 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Fold `customer_accounts.email` to the form the code now stores and compares.
+ *
+ * The writes folded the address and the login read did not, so a buyer who
+ * registered as `Jan.Kowalski@example.pl` could never sign in: Postgres' `=` on
+ * `text` is case-sensitive and the row said `jan.kowalski@example.pl`. The code
+ * side of the repair makes every read and every write go through
+ * `normalizeEmailAddress`; this migration brings the rows written before it to
+ * the same form, so an address stored mixed-case stays reachable.
+ *
+ * ## What a collision means, and why it does not fail the deploy
+ *
+ * Two rows differing only in case are two accounts that the fold turns into one
+ * address, and `customer_accounts_email_unique` will not hold both. The
+ * migration therefore **folds one row per address and leaves the rest exactly as
+ * they are** — it drops nothing, merges nothing and refuses nothing:
+ *
+ *  - a row that **already holds the folded address** wins it, because it is the
+ *    one every other table's foreign keys have been resolving to by that
+ *    address all along;
+ *  - otherwise the **earliest-created** row wins it, since it is the account
+ *    with the longer history of orders, invoices and addresses behind it;
+ *  - every other row in the group keeps its stored spelling and is counted by
+ *    the warning below.
+ *
+ * A stranded row is not data loss but it is not a working account either: the
+ * login read folds, so nothing will match its spelling until an operator merges
+ * or renames it. That is a decision about somebody's orders, and a migration
+ * running unattended must not take it. The alternative — failing the deploy —
+ * would stop every other repair in the same release over a pair of rows that a
+ * human has to look at anyway.
+ *
+ * ## Measured before it was written
+ *
+ * Zero collisions and zero mixed-case rows across both developer databases
+ * (`b2b`: 1 account; `b2b_test`: 3), which is what the two-developer-environment
+ * / no-production state of the platform predicts. The rules above are therefore
+ * written for the environments this will meet later, not for a pair of rows
+ * anybody has today.
+ */
+export class Migration20260819T142837CustomerAccountsFoldEmailCase extends Migration {
+    async up() {
+        // One winner per folded address: a row that already holds it first
+        // (`email = folded` sorts true-first under `desc`), then the earliest
+        // created, then the smallest id so the choice is deterministic. The winner
+        // is only updated when it does not already hold the folded value, which is
+        // also why this statement cannot violate the unique index: an update
+        // happens only for a group in which no row holds the target address.
+        this.addSql(`
+      with ranked as (
+        select "id",
+               lower(btrim("email")) as folded,
+               row_number() over (
+                 partition by lower(btrim("email"))
+                 order by ("email" = lower(btrim("email"))) desc,
+                          "created_at" asc,
+                          "id" asc
+               ) as rank
+          from "customer_accounts"
+      )
+      update "customer_accounts" ca
+         set "email" = r.folded
+        from ranked r
+       where r."id" = ca."id"
+         and r.rank = 1
+         and ca."email" <> r.folded;
+    `);
+        // Say out loud what was left behind. A migration that quietly leaves an
+        // account nobody can log into is the same class of defect as the one being
+        // repaired here.
+        this.addSql(`
+      do $$
+      declare
+        stranded integer;
+      begin
+        select count(*) into stranded
+          from "customer_accounts"
+         where "email" <> lower(btrim("email"));
+        if stranded > 0 then
+          raise warning
+            'customer_accounts: % row(s) kept a mixed-case e-mail because another account already holds the folded address. They cannot be signed into until an operator merges or renames them.',
+            stranded;
+        end if;
+      end $$;
+    `);
+    }
+    async down() {
+        // Deliberately empty. The original capitalisation is not recorded anywhere
+        // — this migration overwrites the only copy of it — so there is nothing to
+        // restore, and an `up` that folded a handful of rows must not be paired
+        // with a `down` that pretends otherwise. Rolling this back means rolling
+        // back the code that reads the folded form; the rows are then already in
+        // the shape the old code wrote, which is what it was folding to anyway.
+    }
+}
+//# sourceMappingURL=20260819T142837_customer_accounts_fold_email_case.js.map

package/dist/migrations/20260819T142837_customer_accounts_fold_email_case.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260819T142837_customer_accounts_fold_email_case.js","sourceRoot":"","sources":["../../src/migrations/20260819T142837_customer_accounts_fold_email_case.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,OAAO,qDAAsD,SAAQ,SAAS;IACzE,KAAK,CAAC,EAAE;QACf,mEAAmE;QACnE,sEAAsE;QACtE,2EAA2E;QAC3E,2EAA2E;QAC3E,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;KAkBX,CAAC,CAAC;QAEH,wEAAwE;QACxE,2EAA2E;QAC3E,iBAAiB;QACjB,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;KAcX,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;IAC1E,CAAC;CACF"}

package/dist/migrations/20260825T124759_customer_accounts_drop_legacy_two_factor_secret.d.ts

@@ -0,0 +1,31 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Drops `customer_accounts.two_factor_secret`, the superseded customer 2FA
+ * column.
+ *
+ * The column could never hold a value. `POST /api/v1/me/two-factor/enable`,
+ * the only writer, assembled `<32-char base32 secret>|<10 sha256 hashes>` —
+ * 682 characters — and the column is `varchar(64)`, on which PostgreSQL
+ * raises `22001` rather than truncating. So the route answered 500 for every
+ * customer from the day it was written, and the routes, the port and the
+ * service that owned it are deleted in the same merge request. The live
+ * customer 2FA surface is `mfa`'s `/api/v1/account/mfa/*`, whose own init
+ * migration already records these columns as SUPERSEDED.
+ *
+ * **Nothing is destroyed.** Measured on the dev database on 2026-08-25:
+ * `customer_accounts` holds 1 row, of which `count(two_factor_secret)` is 0.
+ * `deploy/` carries `example` and `acceptance` only — there is no client
+ * deployment and no production database. `down()` therefore re-creates the
+ * column's shape and nothing else, because there has never been a value to
+ * restore.
+ *
+ * `two_factor_confirmed_at` deliberately stays: it still feeds a published
+ * `twoFactorEnabled` field on six API responses and two admin screens, and
+ * what happens to that field is an open owner decision
+ * (`specs/087-tenant-scope-enforcement/superseded-2fa-analysis.md` §7).
+ */
+export declare class Migration20260825T124759CustomerAccountsDropLegacyTwoFactorSecret extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260825T124759_customer_accounts_drop_legacy_two_factor_secret.d.ts.map

package/dist/migrations/20260825T124759_customer_accounts_drop_legacy_two_factor_secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260825T124759_customer_accounts_drop_legacy_two_factor_secret.d.ts","sourceRoot":"","sources":["../../src/migrations/20260825T124759_customer_accounts_drop_legacy_two_factor_secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,iEAAkE,SAAQ,SAAS;IAC/E,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAInB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260825T124759_customer_accounts_drop_legacy_two_factor_secret.js

@@ -0,0 +1,35 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Drops `customer_accounts.two_factor_secret`, the superseded customer 2FA
+ * column.
+ *
+ * The column could never hold a value. `POST /api/v1/me/two-factor/enable`,
+ * the only writer, assembled `<32-char base32 secret>|<10 sha256 hashes>` —
+ * 682 characters — and the column is `varchar(64)`, on which PostgreSQL
+ * raises `22001` rather than truncating. So the route answered 500 for every
+ * customer from the day it was written, and the routes, the port and the
+ * service that owned it are deleted in the same merge request. The live
+ * customer 2FA surface is `mfa`'s `/api/v1/account/mfa/*`, whose own init
+ * migration already records these columns as SUPERSEDED.
+ *
+ * **Nothing is destroyed.** Measured on the dev database on 2026-08-25:
+ * `customer_accounts` holds 1 row, of which `count(two_factor_secret)` is 0.
+ * `deploy/` carries `example` and `acceptance` only — there is no client
+ * deployment and no production database. `down()` therefore re-creates the
+ * column's shape and nothing else, because there has never been a value to
+ * restore.
+ *
+ * `two_factor_confirmed_at` deliberately stays: it still feeds a published
+ * `twoFactorEnabled` field on six API responses and two admin screens, and
+ * what happens to that field is an open owner decision
+ * (`specs/087-tenant-scope-enforcement/superseded-2fa-analysis.md` §7).
+ */
+export class Migration20260825T124759CustomerAccountsDropLegacyTwoFactorSecret extends Migration {
+    async up() {
+        this.addSql(`alter table "customer_accounts" drop column "two_factor_secret";`);
+    }
+    async down() {
+        this.addSql(`alter table "customer_accounts" add column "two_factor_secret" varchar(64) null;`);
+    }
+}
+//# sourceMappingURL=20260825T124759_customer_accounts_drop_legacy_two_factor_secret.js.map

package/dist/migrations/20260825T124759_customer_accounts_drop_legacy_two_factor_secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260825T124759_customer_accounts_drop_legacy_two_factor_secret.js","sourceRoot":"","sources":["../../src/migrations/20260825T124759_customer_accounts_drop_legacy_two_factor_secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,iEAAkE,SAAQ,SAAS;IACrF,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,kEAAkE,CAAC,CAAC;IAClF,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,kFAAkF,CAAC,CAAC;IAClG,CAAC;CACF"}

package/dist/migrations/20260825T141659_customer_accounts_organization_required.d.ts

@@ -0,0 +1,58 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * D-178 — `customer_accounts.organization_id` becomes `NOT NULL`.
+ *
+ * The column was relaxed by `20260611T140351_customer_accounts_organization_optional`
+ * for feature 026 US2 ("Customer accounts may exist without an Organization"), a
+ * design feature 051 replaced and D-178 confirms is dead: every transacting
+ * customer is backed by an Organization, an individual by a single-member
+ * **personal** one, and there is no "no-organization" scoping path
+ * (Constitution XI).
+ *
+ * **The constraint is the only refusal available.** MikroORM applies its tenant
+ * filter to `SELECT` / `UPDATE` / `DELETE` and not to `INSERT`, so no guard can
+ * stop a tenant-less account being written; the column can.
+ *
+ * ## Provision, then count, then refuse — never delete
+ *
+ * These rows are customer logins: a person's credentials, the owner of their
+ * order history and the parent of their address book. A migration that deleted
+ * one to satisfy a constraint would be deleting a customer, so this one
+ * provisions instead and raises on whatever it could not provision.
+ *
+ * Feature 051's backfill
+ * (`organizations/20260717T151403_organizations_personal_organizations`) ran the
+ * same provisioning once. It closed the population as of the moment it ran and
+ * closed no write path, so three producers went on filling it: standalone
+ * registration's two-flush window, federated sign-in (which provisioned no
+ * organisation at all), and the admin "un-assign" button. All three are closed
+ * in the merge request that carries this migration — without that, the
+ * constraint would convert three silent defects into three runtime failures.
+ *
+ * Two deliberate differences from that backfill:
+ *
+ *  - **Soft-deleted accounts are included.** 051 skipped them with its own
+ *    `and ca."deleted_at" is null`. A soft-deleted row still has to satisfy the
+ *    constraint, and `customer_account.restored` would otherwise resurrect an
+ *    account the platform cannot scope.
+ *  - **The insert skips an account whose personal organisation already exists**,
+ *    and a second statement links it. `tax_id` is derived from the account id
+ *    and is globally unique, so an account that was provisioned once and then
+ *    un-assigned would otherwise collide — the migration would abort on a
+ *    constraint violation rather than on the sentence it wants to say.
+ *
+ * The provisioning mirrors `PersonalOrganizationService.provisionFor`: name from
+ * the trimmed "first last" or else the e-mail local part, `tax_id` the account
+ * UUID with the dashes stripped (32 hex characters — an individual has no
+ * company tax id), `vat_status = 'vat_exempt'`, `status = 'active'`,
+ * `is_personal = true`, and the placeholder registered address the column's
+ * `not null` demands.
+ *
+ * `organizations` is a hard `dependencies` entry of this module's manifest, so
+ * that module's tables exist by the time this runs.
+ */
+export declare class Migration20260825T141659CustomerAccountsOrganizationRequired extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260825T141659_customer_accounts_organization_required.d.ts.map

package/dist/migrations/20260825T141659_customer_accounts_organization_required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260825T141659_customer_accounts_organization_required.d.ts","sourceRoot":"","sources":["../../src/migrations/20260825T141659_customer_accounts_organization_required.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,qBAAa,4DAA6D,SAAQ,SAAS;IAC1E,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IA0EnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAOrC"}