@endora-commerce/mod-pwa 0.100.0

package/dist/manifest.js

@@ -0,0 +1,207 @@
+import { defineModuleManifest, defineModuleSettingsManifest, PWA_PERMISSIONS, PWA_SETTING_CODES, } from '@endora-commerce/contracts';
+/**
+ * PWA module — feature 046.
+ *
+ * Adds Progressive-Web-App capabilities to the storefront and admin: home-screen
+ * installability, a Settings-driven per-channel installable identity (icon, name,
+ * theme), opt-in static-asset caching, a controlled service-worker update path,
+ * and opt-in push notifications behind a provider-agnostic abstraction (default
+ * backend: Web-Push/VAPID; FCM/OneSignal are drop-in providers).
+ *
+ * Configuration lives in the Settings module (group `pwa`) and resolves per Sales
+ * Channel via the standard global + override chain (FR-011). VAPID private key and
+ * the optional FCM service-account JSON are `secret` value types (encrypted at rest).
+ */
+// Every PWA setting is managed exclusively from the dedicated PWA settings
+// page (/settings/pwa). Marking them `hidden: true` (applied below) keeps them
+// out of the generic Settings screen so each value lives in exactly one place.
+const pwaSettingEntries = [
+    {
+        code: PWA_SETTING_CODES.APP_NAME,
+        name: 'App name',
+        description: 'Installed-app name shown on the device home screen (manifest `name`).',
+        groupCode: 'pwa',
+        valueType: 'string',
+        defaultValue: 'B2B Platform',
+    },
+    {
+        code: PWA_SETTING_CODES.SHORT_NAME,
+        name: 'Short name',
+        description: 'Short installed-app name used where space is constrained (manifest `short_name`).',
+        groupCode: 'pwa',
+        valueType: 'string',
+        defaultValue: 'B2B',
+    },
+    {
+        code: PWA_SETTING_CODES.THEME_COLOR,
+        name: 'Theme color',
+        description: 'Hex theme color applied to the installed-app UI (manifest `theme_color`).',
+        groupCode: 'pwa',
+        valueType: 'string',
+        defaultValue: '#1d4ed8',
+    },
+    {
+        code: PWA_SETTING_CODES.BACKGROUND_COLOR,
+        name: 'Background color',
+        description: 'Hex background color shown on the splash screen (manifest `background_color`).',
+        groupCode: 'pwa',
+        valueType: 'string',
+        defaultValue: '#fafafa',
+    },
+    {
+        code: PWA_SETTING_CODES.DISPLAY_MODE,
+        name: 'Display mode',
+        description: "How the installed app launches: 'standalone', 'fullscreen' or 'minimal-ui'.",
+        groupCode: 'pwa',
+        valueType: 'string',
+        defaultValue: 'standalone',
+    },
+    {
+        code: PWA_SETTING_CODES.ICON_ASSET_ID,
+        name: 'Icon source asset id',
+        description: 'Assets-library id of the uploaded source icon. Empty falls back to bundled placeholder icons.',
+        groupCode: 'pwa',
+        valueType: 'string',
+        defaultValue: '',
+    },
+    {
+        code: PWA_SETTING_CODES.CACHING_ENABLED,
+        name: 'Static-asset caching enabled',
+        description: 'When on, the storefront service worker caches static assets for faster repeat visits and an offline shell.',
+        groupCode: 'pwa',
+        valueType: 'boolean',
+        defaultValue: false,
+    },
+    {
+        code: PWA_SETTING_CODES.PUSH_ENABLED,
+        name: 'Push notifications enabled',
+        description: 'When on, the storefront offers a push opt-in and the platform can deliver notifications to subscribed devices.',
+        groupCode: 'pwa',
+        valueType: 'boolean',
+        defaultValue: false,
+    },
+    {
+        code: PWA_SETTING_CODES.VAPID_PUBLIC_KEY,
+        name: 'VAPID public key',
+        description: 'Public VAPID key served to the storefront subscribe flow. Generated together with the private key.',
+        groupCode: 'pwa',
+        valueType: 'string',
+        defaultValue: '',
+    },
+    {
+        code: PWA_SETTING_CODES.VAPID_PRIVATE_KEY,
+        name: 'VAPID private key',
+        description: 'Private VAPID key used to sign Web-Push messages. Write-only: encrypted at rest and never returned after saving.',
+        groupCode: 'pwa',
+        valueType: 'secret',
+        defaultValue: '',
+    },
+    {
+        code: PWA_SETTING_CODES.FCM_SERVICE_ACCOUNT,
+        name: 'FCM service account (JSON)',
+        description: 'Optional Firebase service-account JSON for the token-based FCM provider. Write-only: encrypted at rest.',
+        groupCode: 'pwa',
+        valueType: 'secret',
+        defaultValue: '',
+    },
+];
+const settings = defineModuleSettingsManifest({
+    moduleCode: 'pwa',
+    groups: [{ code: 'pwa', name: 'Progressive Web App' }],
+    settings: [
+        ...pwaSettingEntries.map((entry) => ({ ...entry, hidden: true })),
+        {
+            // Feature 073 — the operator's activation control. Deliberately NOT
+            // hidden: every other setting here is internal plumbing the PWA screen
+            // manages, while this one is the operator's own switch and belongs on
+            // `/platform/modules`.
+            code: 'pwa.enabled',
+            name: 'Progressive Web App enabled',
+            description: 'Switches the installable-app manifest, the push-subscription registry and push delivery on or off. Nothing is dropped: subscriptions and icons stay in the database, and pushes resume for the same subscribers when you switch it back on.',
+            groupCode: 'pwa',
+            valueType: 'boolean',
+            defaultValue: true,
+        },
+    ],
+});
+/** Settings-only export consumed by the boot-time ManifestReconciler list. */
+export const pwaSettingsManifest = settings;
+export const manifest = defineModuleManifest({
+    id: 'pwa',
+    name: 'Progressive Web App',
+    description: 'Installability, static-asset caching, controlled service-worker updates, and provider-agnostic push notifications for the storefront and admin.',
+    version: '1.0.0',
+    /**
+     * What this module needs from the environment (`specs/117-instance-bring-up/`
+     * FR-002). Only what it **owns**: its reads of platform-owned names are
+     * satisfied by `packages/platform/src/env/index.ts`.
+     *
+     * Why each of these is not a Setting is its entry in
+     * `backend/scripts/ledgers/module-environment-inputs/pwa.ts`.
+     */
+    env: [
+        {
+            name: 'PWA_VAPID_SUBJECT',
+            describes: {
+                en: 'The contact address push services are given for this shop, so a provider can reach somebody about its notifications.',
+                pl: 'Adres kontaktowy przekazywany usługom push dla tego sklepu, aby dostawca miał się z kim skontaktować w sprawie powiadomień.',
+            },
+            requirement: {
+                kind: 'optional',
+                without: {
+                    en: 'Push services are given the platform’s placeholder contact rather than this shop’s, so a provider with a delivery problem has nobody to write to.',
+                    pl: 'Usługi push dostają zastępczy kontakt platformy zamiast kontaktu tego sklepu, więc dostawca mający problem z doręczeniem nie ma do kogo napisać.',
+                },
+            },
+            secret: false,
+            generable: false,
+            owner: { kind: 'module', moduleId: 'pwa' },
+            consumers: ['backend'],
+            addressOf: null,
+        },
+    ],
+    // `auth` owns the `requireAdmin` port the admin routes are gated by; feature
+    // 072 made it a container resolution rather than a constructor argument.
+    //
+    // `customer_accounts` and `organizations` arrived with feature 075 Phase C:
+    // the push Rule Builder's three target pickers and the rule-audience
+    // expansion read rows those modules own, and they used to read them off the
+    // tables directly. Both are **binding**: a picker that silently lists nothing
+    // and an audience that silently resolves to nobody both read as legitimate
+    // answers, so the seam fails closed. `price_lists` was the third, for
+    // `customerGroupReadPort`; feature 076 (D-79) moved that port to
+    // `customer_accounts`, which this module already declares, and the port check
+    // confirms nothing else here resolves out of `price_lists`.
+    //
+    // `orders` arrived with `specs/110-instance-repository/` T118c: the FR-024
+    // order-status auto-trigger reads the order it is announcing over
+    // `orderReadPort`, which a composition root used to read on this module's
+    // behalf inside `pwaBridge`. It is **binding**, and it costs no operator a
+    // control, derived rather than waived: `orders` is `nonDeactivatable`.
+    // `assets_library` and `sales_channels` are `nonDeactivatable` as well, and
+    // both were already declared, so the two ports that drained beside it owe no
+    // `refuses-without` sentence either. The kernel's
+    // `salesChannelResolutionPort` is a platform name and puts nothing here at
+    // all.
+    dependencies: [
+        '_i18n',
+        '_lifecycle',
+        'assets_library',
+        'orders',
+        'sales_channels',
+        'settings',
+        'auth',
+        'customer_accounts',
+        'organizations',
+    ],
+    settings,
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    permissions: [
+        { code: PWA_PERMISSIONS.READ, label: 'View PWA settings' },
+        { code: PWA_PERMISSIONS.WRITE, label: 'Configure PWA' },
+        { code: PWA_PERMISSIONS.SEND_PUSH, label: 'Send push notifications' },
+    ],
+    activation: { settingCode: 'pwa.enabled', default: true },
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,eAAe,EACf,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;GAYG;AAEH,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,iBAAiB,GAA2B;IAC9C;QACE,IAAI,EAAE,iBAAiB,CAAC,QAAQ;QAChC,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,uEAAuE;QACpF,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,cAAc;KAC7B;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,UAAU;QAClC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mFAAmF;QAChG,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,WAAW;QACnC,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2EAA2E;QACxF,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,SAAS;KACxB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,gBAAgB;QACxC,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,gFAAgF;QAC7F,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,SAAS;KACxB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,YAAY;QACpC,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,6EAA6E;QAC1F,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,YAAY;KAC3B;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,+FAA+F;QAC5G,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,EAAE;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,eAAe;QACvC,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,4GAA4G;QACzH,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS;QACpB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,YAAY;QACpC,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE,gHAAgH;QAC7H,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS;QACpB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,gBAAgB;QACxC,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,oGAAoG;QACjH,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,EAAE;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;QACzC,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,kHAAkH;QAC/H,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,EAAE;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB,CAAC,mBAAmB;QAC3C,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE,yGAAyG;QACtH,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,EAAE;KACjB;CACJ,CAAC;AAEF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;IAC5C,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IACtD,QAAQ,EAAE;QACR,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE;YACE,oEAAoE;YACpE,uEAAuE;YACvE,sEAAsE;YACtE,uBAAuB;YACvB,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,6BAA6B;YACnC,WAAW,EACT,6OAA6O;YAC/O,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAkB;YAC7B,YAAY,EAAE,IAAI;SACnB;KACF;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,iJAAiJ;IACnJ,OAAO,EAAE,OAAO;IAChB;;;;;;;OAOG;IACH,GAAG,EAAE;QACH;YACE,IAAI,EAAE,mBAAmB;YACzB,SAAS,EAAE;gBACT,EAAE,EAAE,sHAAsH;gBAC1H,EAAE,EAAE,6HAA6H;aAClI;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE;oBACP,EAAE,EAAE,mJAAmJ;oBACvJ,EAAE,EAAE,kJAAkJ;iBACvJ;aACF;YACD,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC1C,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,SAAS,EAAE,IAAI;SAChB;KACF;IACD,6EAA6E;IAC7E,yEAAyE;IACzE,EAAE;IACF,4EAA4E;IAC5E,qEAAqE;IACrE,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,iEAAiE;IACjE,8EAA8E;IAC9E,4DAA4D;IAC5D,EAAE;IACF,2EAA2E;IAC3E,kEAAkE;IAClE,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,kDAAkD;IAClD,2EAA2E;IAC3E,OAAO;IACP,YAAY,EAAE;QACZ,OAAO;QACP,YAAY;QACZ,gBAAgB;QAChB,QAAQ;QACR,gBAAgB;QAChB,UAAU;QACV,MAAM;QACN,mBAAmB;QACnB,eAAe;KAChB;IACD,QAAQ;IACR,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE;QAC1D,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE;QACvD,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE;KACtE;IACD,UAAU,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE;CAC1D,CAAC,CAAC"}

package/dist/migrations/20260625T144228_pwa_init.d.ts

@@ -0,0 +1,18 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * PWA module init (feature 046).
+ *
+ * Four tables owned by the `pwa` module:
+ *   - push_subscriptions       — one subscribed device (Web-Push), unique endpoint
+ *   - push_messages            — a notification (admin- or event-triggered)
+ *   - push_message_deliveries  — (message × subscription) delivery, idempotency unit
+ *   - pwa_icon_renditions      — derived icon sizes per channel (global = null channel)
+ *
+ * PWA identity/toggles are NOT a table — they live in the Settings module
+ * (group `pwa`, seeded by the manifest reconciler).
+ */
+export declare class Migration20260625T144228PwaInit extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260625T144228_pwa_init.d.ts.map

package/dist/migrations/20260625T144228_pwa_init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260625T144228_pwa_init.d.ts","sourceRoot":"","sources":["../../src/migrations/20260625T144228_pwa_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,qBAAa,+BAAgC,SAAQ,SAAS;IAC7C,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IA6GnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAMrC"}

package/dist/migrations/20260625T144228_pwa_init.js

@@ -0,0 +1,105 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * PWA module init (feature 046).
+ *
+ * Four tables owned by the `pwa` module:
+ *   - push_subscriptions       — one subscribed device (Web-Push), unique endpoint
+ *   - push_messages            — a notification (admin- or event-triggered)
+ *   - push_message_deliveries  — (message × subscription) delivery, idempotency unit
+ *   - pwa_icon_renditions      — derived icon sizes per channel (global = null channel)
+ *
+ * PWA identity/toggles are NOT a table — they live in the Settings module
+ * (group `pwa`, seeded by the manifest reconciler).
+ */
+export class Migration20260625T144228PwaInit extends Migration {
+    async up() {
+        this.addSql(`
+      create table "push_subscriptions" (
+        "id" uuid not null,
+        "sales_channel_id" uuid not null,
+        "customer_account_id" uuid null,
+        "endpoint" text not null,
+        "p256dh" text not null,
+        "auth" text not null,
+        "provider" varchar(32) not null default 'web_push',
+        "status" varchar(16) not null default 'active',
+        "user_agent" text null,
+        "created_at" timestamptz not null,
+        "last_seen_at" timestamptz not null,
+        constraint "push_subscriptions_pkey" primary key ("id"),
+        constraint "push_subscriptions_status_check" check ("status" in ('active', 'invalid'))
+      );
+    `);
+        this.addSql(`alter table "push_subscriptions" add constraint "push_subscriptions_endpoint_unique" unique ("endpoint");`);
+        this.addSql(`create index "push_subscriptions_channel_status_idx" on "push_subscriptions" ("sales_channel_id", "status");`);
+        this.addSql(`create index "push_subscriptions_customer_idx" on "push_subscriptions" ("customer_account_id") where "customer_account_id" is not null;`);
+        this.addSql(`
+      create table "push_messages" (
+        "id" uuid not null,
+        "sales_channel_id" uuid not null,
+        "title" varchar(120) not null,
+        "body" varchar(500) not null,
+        "icon_url" text null,
+        "url" text null,
+        "audience" jsonb not null,
+        "trigger" varchar(32) not null,
+        "source_event_id" varchar(128) null,
+        "status" varchar(16) not null default 'queued',
+        "sent_count" int not null default 0,
+        "failed_count" int not null default 0,
+        "created_by_admin_user_id" uuid null,
+        "created_at" timestamptz not null,
+        "sent_at" timestamptz null,
+        constraint "push_messages_pkey" primary key ("id"),
+        constraint "push_messages_trigger_check" check ("trigger" in ('admin', 'order_status', 'quote_request')),
+        constraint "push_messages_status_check" check ("status" in ('queued', 'sending', 'sent', 'failed'))
+      );
+    `);
+        this.addSql(`create index "push_messages_channel_created_idx" on "push_messages" ("sales_channel_id", "created_at" desc);`);
+        this.addSql(`create unique index "push_messages_trigger_event_uniq" on "push_messages" ("trigger", "source_event_id") where "source_event_id" is not null;`);
+        this.addSql(`
+      create table "push_message_deliveries" (
+        "id" uuid not null,
+        "message_id" uuid not null,
+        "subscription_id" uuid not null,
+        "status" varchar(16) not null default 'pending',
+        "attempts" int not null default 0,
+        "last_error" text null,
+        "attempted_at" timestamptz null,
+        "created_at" timestamptz not null,
+        constraint "push_message_deliveries_pkey" primary key ("id"),
+        constraint "push_message_deliveries_status_check" check ("status" in ('pending', 'sent', 'failed', 'pruned'))
+      );
+    `);
+        this.addSql(`alter table "push_message_deliveries" add constraint "push_message_deliveries_message_id_foreign" foreign key ("message_id") references "push_messages" ("id") on update cascade on delete cascade;`);
+        this.addSql(`alter table "push_message_deliveries" add constraint "push_message_deliveries_subscription_id_foreign" foreign key ("subscription_id") references "push_subscriptions" ("id") on update cascade on delete cascade;`);
+        this.addSql(`alter table "push_message_deliveries" add constraint "push_message_deliveries_msg_sub_unique" unique ("message_id", "subscription_id");`);
+        this.addSql(`create index "push_message_deliveries_status_idx" on "push_message_deliveries" ("status");`);
+        this.addSql(`
+      create table "pwa_icon_renditions" (
+        "id" uuid not null,
+        "sales_channel_id" uuid null,
+        "source_asset_id" uuid not null,
+        "size" int not null,
+        "purpose" varchar(16) not null,
+        "asset_id" uuid not null,
+        "content_hash" varchar(64) not null,
+        "created_at" timestamptz not null,
+        constraint "pwa_icon_renditions_pkey" primary key ("id"),
+        constraint "pwa_icon_renditions_purpose_check" check ("purpose" in ('any', 'maskable'))
+      );
+    `);
+        // One rendition per (size, purpose) per scope. Two partial unique indexes so
+        // the rule holds for both per-channel rows and the single global (null-channel)
+        // row without relying on PG15-only NULLS NOT DISTINCT.
+        this.addSql(`create unique index "pwa_icon_renditions_channel_size_purpose_uniq" on "pwa_icon_renditions" ("sales_channel_id", "size", "purpose") where "sales_channel_id" is not null;`);
+        this.addSql(`create unique index "pwa_icon_renditions_global_size_purpose_uniq" on "pwa_icon_renditions" ("size", "purpose") where "sales_channel_id" is null;`);
+    }
+    async down() {
+        this.addSql(`drop table if exists "pwa_icon_renditions" cascade;`);
+        this.addSql(`drop table if exists "push_message_deliveries" cascade;`);
+        this.addSql(`drop table if exists "push_messages" cascade;`);
+        this.addSql(`drop table if exists "push_subscriptions" cascade;`);
+    }
+}
+//# sourceMappingURL=20260625T144228_pwa_init.js.map

package/dist/migrations/20260625T144228_pwa_init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260625T144228_pwa_init.js","sourceRoot":"","sources":["../../src/migrations/20260625T144228_pwa_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,+BAAgC,SAAQ,SAAS;IACnD,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;KAgBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,2GAA2G,CAC5G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8GAA8G,CAC/G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yIAAyI,CAC1I,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;KAqBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,8GAA8G,CAC/G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+IAA+I,CAChJ,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;KAaX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,qMAAqM,CACtM,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oNAAoN,CACrN,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yIAAyI,CAC1I,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4FAA4F,CAC7F,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;KAaX,CAAC,CAAC;QACH,6EAA6E;QAC7E,gFAAgF;QAChF,uDAAuD;QACvD,IAAI,CAAC,MAAM,CACT,4KAA4K,CAC7K,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,qDAAqD,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;CACF"}

package/dist/migrations/20260830T172022_pwa_organization_attribution.d.ts

@@ -0,0 +1,102 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * D-187 — `push_subscriptions` gains its organisation, and a row that names a
+ * customer account carries one.
+ *
+ * Feature 087 Group B, class 2 of 4 (`specs/087-tenant-scope-enforcement/`).
+ * `PushSubscription` is `@CustomerScoped`, and until this migration the
+ * `allowed-set` arm of `customerFilterCond` had no column to grant on: a sales
+ * representative assigned to the buyer's own organisation was shown **none** of
+ * their subscribed devices and told so, through the
+ * `ORGANIZATION_ATTRIBUTION_PENDING` notice the refusing arm records. The
+ * column is what turns that into an answer.
+ *
+ * ## The column and the read arrive together, on purpose
+ *
+ * `customerOrganizationColumn` asks the ORM's own metadata whether the filtered
+ * entity carries `organizationId`, **per query**, so the entity property in
+ * this same merge request is what switches the grant on — there is no third
+ * artefact, no flag and no staging. At the same instant the notice retires
+ * itself: it is keyed on the column's *absence*.
+ *
+ * That pairing is why this migration is not "column and backfill". From the
+ * moment the grant is live, a row inserted without an organisation is invisible
+ * to the representative who serves that organisation, on a screen that has just
+ * stopped explaining itself — and MikroORM applies no filter to `INSERT`
+ * (`r1-spike.md` §4, measured), so the filter cannot refuse it. The `CHECK`
+ * below is the only refusal an `INSERT` has.
+ *
+ * ## An implication, not an equivalence
+ *
+ * `customer_account_id is null or organization_id is not null` is FR-010 and
+ * FR-011 together and nothing wider: an **owned** row has an organisation, an
+ * **ownerless** row need not. This table is ownerless by construction for every
+ * device that subscribes before anybody signs in (FR-023 — `customer_account_id`
+ * has been nullable since `20260625T144228_pwa_init.ts`), and who such a device
+ * belongs to is R-6's open question. The equivalence would answer it in the
+ * schema, which D-187 declines to do.
+ *
+ * **What that deliberately leaves open, and where it is held instead.** The
+ * equivalence would also close the opposite shape — an **ownerless** row still
+ * carrying an organisation — and this table is the one in Group B that can
+ * produce it. Its write is an upsert on `endpoint`, so re-subscribing a
+ * previously owned device anonymously clears the account, and an implication
+ * says nothing about the organisation left behind. That row would be visible to
+ * a representative of an organisation it no longer belongs to. It is closed at
+ * the write instead of in the schema: `PushSubscriptionService` writes both
+ * columns from one resolved owner value, so there is no branch in which one
+ * moves without the other, and `admin-and-storefront.contract.test.ts` asserts
+ * the de-association end to end. A constraint here would have bought the same
+ * guarantee at the price of deciding R-6.
+ *
+ * ## No foreign key
+ *
+ * Matching `Cart` and `Comparison`, neither of which carries one. D-187
+ * withdraws `r1-spike.md` §8's `on delete set null` recommendation as
+ * contradicting FR-011: it produces a row that names an account and no
+ * organisation, which is precisely the state this migration makes unreachable,
+ * and under the constraint below it would abort an unrelated organisation
+ * delete with a message about a table the operator was not touching. If one is
+ * ever taken here it must be `restrict`, and it is not this migration's
+ * decision.
+ *
+ * ## Derive, then count, then refuse — never delete
+ *
+ * The derivation is the owning account's own organisation. **On this table the
+ * refusal is a real branch, not a formality**, and that is why it is written
+ * with as much care as the derivation: unlike `comparisons`, `push_subscriptions`
+ * has **no foreign key** on `customer_account_id` (the init migration declares
+ * the column `uuid null` and constrains nothing), so a row naming an account
+ * that is gone is representable here.
+ *
+ * It is nevertheless empty today, and the reason is worth knowing rather than
+ * hoping: a customer account is never hard-deleted in this tree.
+ * `customer-account-lifecycle-ports.ts` soft-deletes, restores and
+ * **anonymises** — the last one rewrites the e-mail and the name and keeps the
+ * row — and every one of those still satisfies `organization_id NOT NULL`
+ * (D-178), so it still derives. Change any of that and the count below is the
+ * only thing that would notice.
+ *
+ * It raises with the count and up to twenty ids and deletes nothing (D-184), in
+ * the shape `20260825T141659_customer_accounts_organization_required.ts`
+ * established and `20260830T112911_carts_organization_attribution_check.ts`
+ * repeated.
+ *
+ * ## Nothing to declare in the manifest
+ *
+ * `pwa` already declares both `customer_accounts` and `organizations` in its
+ * manifest `dependencies`, so the table this reads is created before this runs.
+ * No foreign key is added, so `fk-dependency-drift` has nothing to say either,
+ * and a migration naming another module's table is outside
+ * `check:module-boundary`'s population by that check's own rule.
+ *
+ * The standing guard is
+ * `backend/test/integration/tenancy/customer-scoped-organization-completeness.test.ts`,
+ * which derives its population from the ORM's metadata rather than from a list
+ * — so this class is covered by gaining the column, with no edit to that file.
+ */
+export declare class Migration20260830T172022PwaOrganizationAttribution extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260830T172022_pwa_organization_attribution.d.ts.map

package/dist/migrations/20260830T172022_pwa_organization_attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260830T172022_pwa_organization_attribution.d.ts","sourceRoot":"","sources":["../../src/migrations/20260830T172022_pwa_organization_attribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AACH,qBAAa,kDAAmD,SAAQ,SAAS;IAChE,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAiEnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAWrC"}

package/dist/migrations/20260830T172022_pwa_organization_attribution.js

@@ -0,0 +1,169 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * D-187 — `push_subscriptions` gains its organisation, and a row that names a
+ * customer account carries one.
+ *
+ * Feature 087 Group B, class 2 of 4 (`specs/087-tenant-scope-enforcement/`).
+ * `PushSubscription` is `@CustomerScoped`, and until this migration the
+ * `allowed-set` arm of `customerFilterCond` had no column to grant on: a sales
+ * representative assigned to the buyer's own organisation was shown **none** of
+ * their subscribed devices and told so, through the
+ * `ORGANIZATION_ATTRIBUTION_PENDING` notice the refusing arm records. The
+ * column is what turns that into an answer.
+ *
+ * ## The column and the read arrive together, on purpose
+ *
+ * `customerOrganizationColumn` asks the ORM's own metadata whether the filtered
+ * entity carries `organizationId`, **per query**, so the entity property in
+ * this same merge request is what switches the grant on — there is no third
+ * artefact, no flag and no staging. At the same instant the notice retires
+ * itself: it is keyed on the column's *absence*.
+ *
+ * That pairing is why this migration is not "column and backfill". From the
+ * moment the grant is live, a row inserted without an organisation is invisible
+ * to the representative who serves that organisation, on a screen that has just
+ * stopped explaining itself — and MikroORM applies no filter to `INSERT`
+ * (`r1-spike.md` §4, measured), so the filter cannot refuse it. The `CHECK`
+ * below is the only refusal an `INSERT` has.
+ *
+ * ## An implication, not an equivalence
+ *
+ * `customer_account_id is null or organization_id is not null` is FR-010 and
+ * FR-011 together and nothing wider: an **owned** row has an organisation, an
+ * **ownerless** row need not. This table is ownerless by construction for every
+ * device that subscribes before anybody signs in (FR-023 — `customer_account_id`
+ * has been nullable since `20260625T144228_pwa_init.ts`), and who such a device
+ * belongs to is R-6's open question. The equivalence would answer it in the
+ * schema, which D-187 declines to do.
+ *
+ * **What that deliberately leaves open, and where it is held instead.** The
+ * equivalence would also close the opposite shape — an **ownerless** row still
+ * carrying an organisation — and this table is the one in Group B that can
+ * produce it. Its write is an upsert on `endpoint`, so re-subscribing a
+ * previously owned device anonymously clears the account, and an implication
+ * says nothing about the organisation left behind. That row would be visible to
+ * a representative of an organisation it no longer belongs to. It is closed at
+ * the write instead of in the schema: `PushSubscriptionService` writes both
+ * columns from one resolved owner value, so there is no branch in which one
+ * moves without the other, and `admin-and-storefront.contract.test.ts` asserts
+ * the de-association end to end. A constraint here would have bought the same
+ * guarantee at the price of deciding R-6.
+ *
+ * ## No foreign key
+ *
+ * Matching `Cart` and `Comparison`, neither of which carries one. D-187
+ * withdraws `r1-spike.md` §8's `on delete set null` recommendation as
+ * contradicting FR-011: it produces a row that names an account and no
+ * organisation, which is precisely the state this migration makes unreachable,
+ * and under the constraint below it would abort an unrelated organisation
+ * delete with a message about a table the operator was not touching. If one is
+ * ever taken here it must be `restrict`, and it is not this migration's
+ * decision.
+ *
+ * ## Derive, then count, then refuse — never delete
+ *
+ * The derivation is the owning account's own organisation. **On this table the
+ * refusal is a real branch, not a formality**, and that is why it is written
+ * with as much care as the derivation: unlike `comparisons`, `push_subscriptions`
+ * has **no foreign key** on `customer_account_id` (the init migration declares
+ * the column `uuid null` and constrains nothing), so a row naming an account
+ * that is gone is representable here.
+ *
+ * It is nevertheless empty today, and the reason is worth knowing rather than
+ * hoping: a customer account is never hard-deleted in this tree.
+ * `customer-account-lifecycle-ports.ts` soft-deletes, restores and
+ * **anonymises** — the last one rewrites the e-mail and the name and keeps the
+ * row — and every one of those still satisfies `organization_id NOT NULL`
+ * (D-178), so it still derives. Change any of that and the count below is the
+ * only thing that would notice.
+ *
+ * It raises with the count and up to twenty ids and deletes nothing (D-184), in
+ * the shape `20260825T141659_customer_accounts_organization_required.ts`
+ * established and `20260830T112911_carts_organization_attribution_check.ts`
+ * repeated.
+ *
+ * ## Nothing to declare in the manifest
+ *
+ * `pwa` already declares both `customer_accounts` and `organizations` in its
+ * manifest `dependencies`, so the table this reads is created before this runs.
+ * No foreign key is added, so `fk-dependency-drift` has nothing to say either,
+ * and a migration naming another module's table is outside
+ * `check:module-boundary`'s population by that check's own rule.
+ *
+ * The standing guard is
+ * `backend/test/integration/tenancy/customer-scoped-organization-completeness.test.ts`,
+ * which derives its population from the ORM's metadata rather than from a list
+ * — so this class is covered by gaining the column, with no edit to that file.
+ */
+export class Migration20260830T172022PwaOrganizationAttribution extends Migration {
+    async up() {
+        // 1. The column. Nullable, because an anonymous device legitimately has
+        //    none (FR-011/FR-023) and this table is mostly anonymous in practice.
+        this.addSql(`alter table "push_subscriptions" add column "organization_id" uuid null;`);
+        // 2. Derive the organisation from the account that owns the subscription.
+        //    Every account carries one since D-178, including a soft-deleted or
+        //    anonymised one, so this is total for every row whose account is still
+        //    there. Step 3 is about the rows for which it is not.
+        this.addSql(`
+      update "push_subscriptions" ps
+      set "organization_id" = ca."organization_id"
+      from "customer_accounts" ca
+      where ca."id" = ps."customer_account_id"
+        and ps."organization_id" is null;
+    `);
+        // 3. Count what is left and refuse. This table has no foreign key on
+        //    `customer_account_id`, so a dangling account id is representable and
+        //    this branch is real. It deletes nothing (D-184): a subscribed device
+        //    is a customer's, and a migration is not the place to decide that one
+        //    of them should stop receiving notifications.
+        this.addSql(`
+      do $$
+      declare
+        remaining bigint;
+        sample text;
+      begin
+        select count(*) into remaining
+          from "push_subscriptions"
+         where "customer_account_id" is not null
+           and "organization_id" is null;
+        if remaining > 0 then
+          select string_agg(id::text, ', ') into sample from (
+            select "id" from "push_subscriptions"
+             where "customer_account_id" is not null
+               and "organization_id" is null
+             order by "id" limit 20
+          ) s;
+          raise exception
+            'D-187: % push_subscriptions row(s) still name a customer account with organization_id IS NULL after derivation. First ids: %. Every customer account has an organization (D-178) and none is ever hard-deleted, so these rows name an account that is gone. Do not delete them - find out how they got here.',
+            remaining, sample;
+        end if;
+      end $$;
+    `);
+        // 4. The constraint.
+        this.addSql(`
+      alter table "push_subscriptions"
+        add constraint "push_subscriptions_organization_attribution_chk"
+        check ("customer_account_id" is null or "organization_id" is not null);
+    `);
+        // 5. The index the entity property declares. Partial, matching this table's
+        //    own owner index — `push_subscriptions_customer_idx` is
+        //    `("customer_account_id") where "customer_account_id" is not null` —
+        //    for the same reason: the column is null on every anonymous device, and
+        //    the reader is an organisation-scoped list.
+        this.addSql(`
+      create index "push_subscriptions_organization_idx"
+        on "push_subscriptions" ("organization_id")
+        where "organization_id" is not null;
+    `);
+    }
+    async down() {
+        // The constraint, the index and the column. The organisations step 2
+        // derived go with the column they were written into — there is nothing to
+        // preserve, because each of them was already implied by the account its row
+        // names.
+        this.addSql(`alter table "push_subscriptions" drop constraint if exists "push_subscriptions_organization_attribution_chk";`);
+        this.addSql(`drop index if exists "push_subscriptions_organization_idx";`);
+        this.addSql(`alter table "push_subscriptions" drop column if exists "organization_id";`);
+    }
+}
+//# sourceMappingURL=20260830T172022_pwa_organization_attribution.js.map

package/dist/migrations/20260830T172022_pwa_organization_attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260830T172022_pwa_organization_attribution.js","sourceRoot":"","sources":["../../src/migrations/20260830T172022_pwa_organization_attribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AACH,MAAM,OAAO,kDAAmD,SAAQ,SAAS;IACtE,KAAK,CAAC,EAAE;QACf,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,CAAC,MAAM,CAAC,0EAA0E,CAAC,CAAC;QAExF,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,0DAA0D;QAC1D,IAAI,CAAC,MAAM,CAAC;;;;;;KAMX,CAAC,CAAC;QAEH,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;KAsBX,CAAC,CAAC;QAEH,qBAAqB;QACrB,IAAI,CAAC,MAAM,CAAC;;;;KAIX,CAAC,CAAC;QAEH,4EAA4E;QAC5E,4DAA4D;QAC5D,yEAAyE;QACzE,4EAA4E;QAC5E,gDAAgD;QAChD,IAAI,CAAC,MAAM,CAAC;;;;KAIX,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,qEAAqE;QACrE,0EAA0E;QAC1E,4EAA4E;QAC5E,SAAS;QACT,IAAI,CAAC,MAAM,CACT,+GAA+G,CAChH,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;CACF"}