@endora-commerce/mod-customers 0.100.0

package/dist/migrations/20260611T140404_customers_customer_addresses_init.d.ts

@@ -0,0 +1,14 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 040 (Customers) US2 — the personal address book.
+ *
+ * Mirrors the org-level `addresses` table but keyed by `customer_account_id`,
+ * so standalone (org-less) customers can keep their own billing/delivery
+ * addresses. "At most one default per (customer, kind)" is enforced by a
+ * partial unique index, exactly like `addresses`.
+ */
+export declare class Migration20260611T140404CustomersCustomerAddressesInit extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260611T140404_customers_customer_addresses_init.d.ts.map

package/dist/migrations/20260611T140404_customers_customer_addresses_init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140404_customers_customer_addresses_init.d.ts","sourceRoot":"","sources":["../../src/migrations/20260611T140404_customers_customer_addresses_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;GAOG;AACH,qBAAa,sDAAuD,SAAQ,SAAS;IACpE,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAgCnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260611T140404_customers_customer_addresses_init.js

@@ -0,0 +1,40 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 040 (Customers) US2 — the personal address book.
+ *
+ * Mirrors the org-level `addresses` table but keyed by `customer_account_id`,
+ * so standalone (org-less) customers can keep their own billing/delivery
+ * addresses. "At most one default per (customer, kind)" is enforced by a
+ * partial unique index, exactly like `addresses`.
+ */
+export class Migration20260611T140404CustomersCustomerAddressesInit extends Migration {
+    async up() {
+        this.addSql(`
+      create table "customer_addresses" (
+        "id" uuid not null,
+        "customer_account_id" uuid not null,
+        "kind" varchar(16) not null,
+        "recipient_name" varchar(160) not null,
+        "street" varchar(255) not null,
+        "city" varchar(120) not null,
+        "postal_code" varchar(20) not null,
+        "country" varchar(2) not null,
+        "phone" varchar(32) null,
+        "is_default" boolean not null default false,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        "deleted_at" timestamptz null,
+        constraint "customer_addresses_pkey" primary key ("id"),
+        constraint "customer_addresses_customer_fk" foreign key ("customer_account_id")
+          references "customer_accounts" ("id") on delete cascade
+      );
+    `);
+        this.addSql('create index "customer_addresses_customer_account_id_index" on "customer_addresses" ("customer_account_id");');
+        this.addSql('create index "customer_addresses_kind_index" on "customer_addresses" ("kind");');
+        this.addSql(`create unique index "customer_addresses_one_default_per_kind" on "customer_addresses" ("customer_account_id", "kind") where "is_default" = true and "deleted_at" is null;`);
+    }
+    async down() {
+        this.addSql('drop table if exists "customer_addresses" cascade;');
+    }
+}
+//# sourceMappingURL=20260611T140404_customers_customer_addresses_init.js.map

package/dist/migrations/20260611T140404_customers_customer_addresses_init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140404_customers_customer_addresses_init.js","sourceRoot":"","sources":["../../src/migrations/20260611T140404_customers_customer_addresses_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,OAAO,sDAAuD,SAAQ,SAAS;IAC1E,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;KAmBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,8GAA8G,CAC/G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gFAAgF,CACjF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2KAA2K,CAC5K,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260611T140404CustomersCustomerAddressesInit } from './20260611T140404_customers_customer_addresses_init.js';
+export declare const migrations: (typeof Migration20260611T140404CustomersCustomerAddressesInit)[];
+export { Migration20260611T140404CustomersCustomerAddressesInit, };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sDAAsD,EAAE,MAAM,wDAAwD,CAAC;AAEhI,eAAO,MAAM,UAAU,mEAEtB,CAAC;AAEF,OAAO,EACL,sDAAsD,GACvD,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,29 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260611T140404CustomersCustomerAddressesInit } from './20260611T140404_customers_customer_addresses_init.js';
+export const migrations = [
+    Migration20260611T140404CustomersCustomerAddressesInit,
+];
+export { Migration20260611T140404CustomersCustomerAddressesInit, };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sDAAsD,EAAE,MAAM,wDAAwD,CAAC;AAEhI,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,sDAAsD;CACvD,CAAC;AAEF,OAAO,EACL,sDAAsD,GACvD,CAAC"}

package/docs/customers.md

@@ -0,0 +1,108 @@
+---
+title: customers
+description: Customer lifecycle over `customer_accounts` — company and personal Organizations, sales-rep assignment and the admin customer surface
+---
+
+# `customers`
+
+Customer (Klienci) lifecycle business logic layered on top of the
+`customer_accounts` data module. **Every customer belongs to an
+Organization** — a company for B2B, a single-member *personal* organization for
+an individual, and `customer_accounts.organization_id` is
+`NOT NULL`. "Standalone" throughout this page means *outside a company
+organization*, never *without one*: such a customer is their own tenant, and the
+organization-scoped features a company offers (shared addresses, invitations,
+credit limit, a sales-rep assignment) are simply absent for them rather than
+switched off by a special case.
+
+## Capabilities
+
+**Storefront (self-service)**
+
+- Standalone registration, gated by the
+  `customers.allow_registration_without_organization` setting. On success the
+  account and its personal organization are written in one transaction and the
+  new account is logged in automatically.
+- A personal address book (billing/delivery), one default per kind, plus the
+  ability to select the Organization's shared addresses (org-bound customers).
+- Default payment method, delivery method, and default addresses.
+- Change password; read-only history of own orders and quote requests.
+
+**Admin (oversight)**
+
+- Customer list (search + status/organization/group filters) and a detail view
+  showing creation date, customer group, organization, blocked status, and last
+  login.
+- Block / unblock and soft-delete / restore, with role-based authority: a
+  Platform Administrator may act on anyone; otherwise the authorized salesperson
+  is the one inherited from the customer's Organization. A personal organization
+  never carries a sales-rep assignment, so the unassigned-organization fallback
+  leaves a standalone customer open to any salesperson. An org-owner depletion
+  guard refuses blocking or deleting the last organization administrator.
+- Impersonation; audited as `impersonation.start` / `impersonation.end`.
+- Admin-triggered password reset (emails a set-password link).
+- NIP/VAT validation (VIES / Biała lista port).
+- Organization assign, and detach-from-organization, which moves the customer to
+  their own personal organization rather than leaving them without one.
+  Direct customer-group assignment (overrides the Organization's group when
+  resolving pricing and promotions).
+- Read-only orders, quote-requests, and (current + abandoned) carts panels.
+- An "online customers" view backed by recent session activity.
+
+## Deletion & anonymization
+
+Deletion is a soft-disable: login is denied, the account is hidden, and sessions
+are revoked, while orders, quote requests, and audit history are retained.
+Within a configurable retention window (`customers.deletion_retention_days`,
+default 365) an authorized actor can restore the account. After the window the
+anonymization sweep (`AnonymizationSweepWorker`) irreversibly scrubs personal
+data, and restore is no longer possible.
+
+## Public surface
+
+Admin routes are gated by `customers:read` (reads), `customers:manage`
+(mutations), and `customers:impersonate` (impersonation).
+
+| Verb + Path | Audience | Purpose |
+| --- | --- | --- |
+| `POST /api/v1/customers/register` | anon | Standalone registration (setting-gated) |
+| `GET /api/v1/me/customer` | customer | Own profile |
+| `POST /api/v1/me/customer/change-password` | customer | Change password |
+| `GET /api/v1/me/customer/addresses` | customer | Personal + org-shared addresses |
+| `POST/PATCH/DELETE /api/v1/me/customer/addresses[/:id]` | customer | Manage personal addresses |
+| `PUT /api/v1/me/customer/addresses/:id/default` | customer | Set a default address |
+| `GET/PUT /api/v1/me/customer/defaults` | customer | Default payment/delivery method + addresses |
+| `GET /api/v1/me/customer/orders` | customer | Own order history |
+| `GET /api/v1/me/customer/quote-requests` | customer | Own RFQ history |
+| `GET /api/v1/admin/customers` | admin | List (authority-scoped) |
+| `GET /api/v1/admin/customers/:id` | admin | Detail |
+| `POST /api/v1/admin/customers/:id/block` · `/unblock` | admin | Block / unblock |
+| `DELETE /api/v1/admin/customers/:id` · `POST .../restore` | admin | Soft-delete / restore |
+| `POST /api/v1/admin/customers/:id/impersonate` | admin | Start impersonation |
+| `POST /api/v1/admin/customers/:id/password-reset` | admin | Email a set-password link |
+| `POST/DELETE /api/v1/admin/customers/:id/organization` | admin | Assign / unassign organization |
+| `PUT /api/v1/admin/customers/:id/customer-group` | admin | Set / clear customer group |
+| `GET/POST/PATCH/DELETE /api/v1/admin/customers/:id/addresses[/:addressId]` | admin | Manage addresses |
+| `POST /api/v1/admin/customers/:id/vat-validate` | admin | Validate a NIP/VAT number |
+| `GET /api/v1/admin/customers/:id/orders` · `/quote-requests` · `/carts` | admin | Read-only history panels |
+| `GET /api/v1/admin/customers/online` | admin | Currently-online customers |
+
+## Settings
+
+| Code | Type | Default | Purpose |
+| --- | --- | --- | --- |
+| `customers.allow_registration_without_organization` | boolean | `false` | Gate standalone registration |
+| `customers.deletion_retention_days` | number | `365` | Restore window before permanent anonymization |
+| `customers.presence_freshness_minutes` | number | `10` | "Online" threshold |
+
+## Schema
+
+- `060_customer_accounts_lifecycle` — adds `customer_group_id`, block state
+  (`blocked_at`, `block_reason`, `block_source`, `blocked_by_*`), and
+  deletion/anonymization state (`deletion_requested_by_admin_user_id`,
+  `anonymized_at`) to `customer_accounts`.
+- `061_customer_addresses_init` — the `customer_addresses` table (one default
+  per `(customer, kind)`).
+
+Default payment/delivery preferences reuse the `quick_order_default_preferences`
+table; no new table is introduced for them.

package/i18n/en.json

@@ -0,0 +1,94 @@
+{
+  "nav.customers.label": "Customers",
+  "nav.customersOnline.label": "Online customers",
+
+  "actions.openCustomers.label": "Customers",
+  "actions.openCustomers.description": "Browse and manage customer accounts",
+  "actions.onlineCustomers.label": "Online customers",
+  "actions.onlineCustomers.description": "See which customers are currently online",
+
+  "status.active": "Active",
+  "status.blocked": "Blocked",
+  "status.deleted": "Deleted",
+
+  "list.title": "Customers",
+  "list.description": "Browse and manage customer accounts",
+  "list.error": "Could not load customers.",
+  "list.loading": "Loading…",
+  "list.empty": "No customers found.",
+  "list.none": "None",
+  "list.field.status": "Status",
+  "list.field.search": "Search",
+  "list.field.organization": "Organization",
+  "list.filter.all": "All",
+  "list.filter.allOrgs": "All organizations",
+  "list.action.resetOrgMfa": "Reset 2FA for organization",
+  "list.action.resetOrgMfaDone": "2FA reset complete",
+  "list.column.customer": "Customer",
+  "list.column.status": "Status",
+  "list.column.organization": "Organization",
+  "list.column.group": "Customer group",
+  "list.column.created": "Created",
+  "list.action.open": "Open",
+
+  "detail.title": "Customer",
+  "detail.loading": "Loading…",
+  "detail.error": "Could not load the customer.",
+  "detail.actionError": "The action could not be completed.",
+  "detail.info.title": "Account information",
+  "detail.actions.title": "Actions",
+  "detail.field.email": "Email",
+  "detail.field.created": "Created",
+  "detail.field.group": "Customer group",
+  "detail.field.organization": "Organization",
+  "detail.field.status": "Status",
+  "detail.field.lastLogin": "Last login",
+  "detail.action.block": "Block",
+  "detail.action.unblock": "Unblock",
+  "detail.action.passwordReset": "Reset password",
+  "detail.action.resetMfa": "Reset 2FA",
+  "detail.action.impersonate": "Impersonate",
+  "detail.action.restore": "Restore",
+  "detail.action.delete": "Delete",
+
+  "online.title": "Online customers",
+  "online.description": "Customers active within the freshness window",
+  "online.error": "Could not load online customers.",
+  "online.loading": "Loading…",
+  "online.empty": "No customers are currently online.",
+  "online.column.lastSeen": "Last seen",
+  "online.refresh": "Refresh",
+  "online.autoRefresh": "Auto-refresh",
+  "online.intervalLabel": "Interval (seconds)",
+  "online.refreshedAt": "Updated {time}",
+
+  "detail.panel.loading": "Loading…",
+  "detail.panel.error": "Could not load this section.",
+  "detail.orders.title": "Orders",
+  "detail.orders.empty": "No orders.",
+  "detail.rfqs.title": "Quote requests",
+  "detail.rfqs.empty": "No quote requests.",
+  "detail.carts.title": "Carts",
+  "detail.carts.items": "items",
+  "detail.carts.noCurrent": "No active cart.",
+  "detail.carts.empty": "No carts.",
+
+  "detail.org.title": "Organization",
+  "detail.org.assignLabel": "Assign to organization",
+  "detail.org.assign": "Assign",
+  "detail.org.unassign": "Detach from organization",
+  "detail.org.unassignHint": "The customer keeps their account and moves to their own personal organization.",
+  "detail.group.title": "Customer group",
+  "detail.group.setLabel": "Set customer group",
+  "detail.group.set": "Set",
+  "detail.group.clear": "Clear group",
+  "detail.addresses.title": "Addresses",
+  "detail.addresses.empty": "No personal addresses.",
+  "detail.addresses.default": "default",
+  "detail.addresses.recipient": "Recipient",
+  "detail.addresses.street": "Street",
+  "detail.addresses.city": "City",
+  "detail.addresses.postal": "Postal code",
+  "detail.addresses.country": "Country",
+  "detail.addresses.add": "Add address"
+}

package/i18n/pl.json

@@ -0,0 +1,94 @@
+{
+  "nav.customers.label": "Klienci",
+  "nav.customersOnline.label": "Klienci online",
+
+  "actions.openCustomers.label": "Klienci",
+  "actions.openCustomers.description": "Przeglądaj i zarządzaj kontami klientów",
+  "actions.onlineCustomers.label": "Klienci online",
+  "actions.onlineCustomers.description": "Zobacz, którzy klienci są teraz online",
+
+  "status.active": "Aktywne",
+  "status.blocked": "Zablokowane",
+  "status.deleted": "Usunięte",
+
+  "list.title": "Klienci",
+  "list.description": "Przeglądaj i zarządzaj kontami klientów",
+  "list.error": "Nie udało się wczytać klientów.",
+  "list.loading": "Wczytywanie…",
+  "list.empty": "Nie znaleziono klientów.",
+  "list.none": "Brak",
+  "list.field.status": "Status",
+  "list.field.search": "Szukaj",
+  "list.field.organization": "Organizacja",
+  "list.filter.all": "Wszyscy",
+  "list.filter.allOrgs": "Wszystkie organizacje",
+  "list.action.resetOrgMfa": "Resetuj 2FA dla organizacji",
+  "list.action.resetOrgMfaDone": "Reset 2FA zakończony",
+  "list.column.customer": "Klient",
+  "list.column.status": "Status",
+  "list.column.organization": "Organizacja",
+  "list.column.group": "Grupa klientów",
+  "list.column.created": "Utworzono",
+  "list.action.open": "Otwórz",
+
+  "detail.title": "Klient",
+  "detail.loading": "Wczytywanie…",
+  "detail.error": "Nie udało się wczytać klienta.",
+  "detail.actionError": "Nie udało się wykonać akcji.",
+  "detail.info.title": "Informacje o koncie",
+  "detail.actions.title": "Akcje",
+  "detail.field.email": "E-mail",
+  "detail.field.created": "Utworzono",
+  "detail.field.group": "Grupa klientów",
+  "detail.field.organization": "Organizacja",
+  "detail.field.status": "Status",
+  "detail.field.lastLogin": "Ostatnie logowanie",
+  "detail.action.block": "Zablokuj",
+  "detail.action.unblock": "Odblokuj",
+  "detail.action.passwordReset": "Zresetuj hasło",
+  "detail.action.resetMfa": "Resetuj 2FA",
+  "detail.action.impersonate": "Zaloguj jako klient",
+  "detail.action.restore": "Przywróć",
+  "detail.action.delete": "Usuń",
+
+  "online.title": "Klienci online",
+  "online.description": "Klienci aktywni w oknie świeżości",
+  "online.error": "Nie udało się wczytać klientów online.",
+  "online.loading": "Wczytywanie…",
+  "online.empty": "Żaden klient nie jest teraz online.",
+  "online.column.lastSeen": "Ostatnio widziany",
+  "online.refresh": "Odśwież",
+  "online.autoRefresh": "Automatyczne odświeżanie",
+  "online.intervalLabel": "Interwał (sekundy)",
+  "online.refreshedAt": "Zaktualizowano {time}",
+
+  "detail.panel.loading": "Wczytywanie…",
+  "detail.panel.error": "Nie udało się wczytać tej sekcji.",
+  "detail.orders.title": "Zamówienia",
+  "detail.orders.empty": "Brak zamówień.",
+  "detail.rfqs.title": "Zapytania ofertowe",
+  "detail.rfqs.empty": "Brak zapytań ofertowych.",
+  "detail.carts.title": "Koszyki",
+  "detail.carts.items": "pozycji",
+  "detail.carts.noCurrent": "Brak aktywnego koszyka.",
+  "detail.carts.empty": "Brak koszyków.",
+
+  "detail.org.title": "Organizacja",
+  "detail.org.assignLabel": "Przypisz do organizacji",
+  "detail.org.assign": "Przypisz",
+  "detail.org.unassign": "Odłącz od organizacji",
+  "detail.org.unassignHint": "Klient zachowuje konto i przechodzi do własnej organizacji osobistej.",
+  "detail.group.title": "Grupa klientów",
+  "detail.group.setLabel": "Ustaw grupę klientów",
+  "detail.group.set": "Ustaw",
+  "detail.group.clear": "Wyczyść grupę",
+  "detail.addresses.title": "Adresy",
+  "detail.addresses.empty": "Brak adresów osobistych.",
+  "detail.addresses.default": "domyślny",
+  "detail.addresses.recipient": "Odbiorca",
+  "detail.addresses.street": "Ulica",
+  "detail.addresses.city": "Miasto",
+  "detail.addresses.postal": "Kod pocztowy",
+  "detail.addresses.country": "Kraj",
+  "detail.addresses.add": "Dodaj adres"
+}

package/package.json

@@ -0,0 +1,101 @@
+{
+  "name": "@endora-commerce/mod-customers",
+  "version": "0.100.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Customer lifecycle business logic: registration, self-service, blocking, impersonation, groups, deletion, and presence.",
+  "license": "MIT",
+  "endora": {
+    "type": "module",
+    "id": "customers"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/modules/customers"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "default": "./dist/backend/index.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations/index.d.ts",
+      "default": "./dist/migrations/index.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "default": "./dist/admin/index.js"
+    },
+    "./tailwind.css": "./tailwind.css",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "i18n",
+    "docs",
+    "tailwind.css"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "peerDependencies": {
+    "@fastify/cookie": "^11",
+    "@mikro-orm/core": "^6",
+    "@mikro-orm/migrations": "^6",
+    "@mikro-orm/postgresql": "^6",
+    "fastify": "^5",
+    "lucide-react": "^1",
+    "react": "^19",
+    "react-router-dom": "^7",
+    "zod": "^4",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "peerDependenciesMeta": {
+    "@endora-commerce/admin-kit": {
+      "optional": true
+    },
+    "lucide-react": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-router-dom": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@fastify/cookie": "^11.0.2",
+    "@mikro-orm/core": "^6.6.13",
+    "@mikro-orm/migrations": "^6.6.13",
+    "@mikro-orm/postgresql": "^6.6.13",
+    "@types/node": "^22.9.0",
+    "@types/react": "^19.2.14",
+    "fastify": "^5.12.5",
+    "lucide-react": "^1.11.0",
+    "react": "^19.2.5",
+    "react-router-dom": "^7.18.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11",
+    "zod": "^4.2.0",
+    "@endora-commerce/platform": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/admin-kit": "0.100.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.ui.json",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.ui.json --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}

package/tailwind.css

@@ -0,0 +1,14 @@
+/* @endora-commerce/mod-customers — AUTO-GENERATED by `pnpm --filter backend run manifests:generate`.
+ *
+ * The `@source` directives this package asks its host to scan
+ * (`specs/110-instance-repository/contracts/admin-stylesheet-composition.md` R1).
+ * They resolve relative to **this file**, so they hold wherever the package is
+ * installed — a workspace link here, `node_modules` in a client's instance.
+ *
+ * The `dist` line is what a published tarball ships and is what an instance
+ * scans; the `src` line is inert there and is what keeps `pnpm --filter admin
+ * run dev` reading source in this repository. Do not edit: run
+ * `pnpm --filter backend run manifests:generate`.
+ */
+@source "./dist/admin";
+@source "./src/admin";