@endora-commerce/mod-customer-accounts 0.100.0

package/dist/backend/entities/customer-account.entity.js

@@ -0,0 +1,230 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, Index, OptionalProps, PrimaryKey, Property, Unique } from '@mikro-orm/core';
+import { OrgScoped } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * CustomerAccount — a user inside an Organization. One email ⇒ at most one
+ * CustomerAccount installation-wide (FR-041).
+ *
+ * `passwordHash` is an argon2id-derived key (see services/password-hasher.ts
+ * in the auth module).
+ */
+let CustomerAccount = class CustomerAccount {
+    [OptionalProps];
+    id = randomUUID();
+    /**
+     * The tenant that scopes this account, and the platform's single unit of
+     * tenancy (Principle XI).
+     *
+     * **Not nullable, since D-178.** Feature 026 US2 relaxed it so the platform
+     * could serve "no-org / guest-style" accounts falling back to platform
+     * defaults for prices, credit limit, allowed payment and delivery methods and
+     * warehouse visibility. Feature 051 replaced that design: an individual (B2C)
+     * customer is backed by a single-member **personal** organisation, so the
+     * guard always has a concrete tenant and there is no "no-organization"
+     * scoping path. The column stayed nullable for another year and three write
+     * paths went on producing NULLs — self-registration's two-flush window,
+     * federated sign-in (which provisioned no organisation at all), and an admin
+     * "un-assign" button. All three are closed, and the column is `NOT NULL`,
+     * which is the only refusal available: MikroORM applies its tenant filter to
+     * `SELECT` / `UPDATE` / `DELETE` and not to `INSERT`, so nothing in the guard
+     * can stop a tenant-less row being written.
+     *
+     * The account and its organisation are created in **one transaction** — see
+     * `CustomerAccountLifecycleWriteService.createStandalone` and the
+     * federated-sign-in `autoCreate` in this module's `backend.ts`.
+     */
+    organizationId;
+    email;
+    passwordHash;
+    /**
+     * Issue #222 — when a password somebody supplied was last set on this
+     * account. `null` means "no such password is on record", which covers both
+     * the account federated sign-in auto-created (its hash is a random pair of
+     * UUIDs nobody was told) and every row written before this column existed.
+     *
+     * It exists because `passwordHash` is NOT NULL for *every* account and
+     * therefore answers a different question from the one that matters on a
+     * security surface: whether the holder has a credential they can actually
+     * use. `SocialLinkService` is the first reader — it refuses to sever an
+     * account's last federated identity while this is null.
+     *
+     * Stamped by every write of a caller-supplied password (registration, the
+     * member write port, a redeemed reset token, a self-service change) and
+     * deliberately **not** by the generated hash. The anonymization sweep clears
+     * it back to null with the hash it scrubs.
+     */
+    passwordSetAt;
+    firstName;
+    lastName;
+    role = 'regular_user';
+    emailVerifiedAt;
+    /**
+     * Never written, and since 2026-08-28 never **read** either.
+     *
+     * Its only non-null writer was the superseded customer 2FA path, deleted with
+     * `two_factor_secret`, so the published `twoFactorEnabled` derived from it
+     * was a provably constant `false` — including on `GET /api/v1/me/customer`,
+     * which told a buyer their own account was unprotected while it was not.
+     * `CustomerAccountRecord.twoFactorEnabled` is now the live `mfa` enrolment,
+     * read through `mfaEnrolmentStatePort`, and nothing in the tree reads this
+     * column.
+     *
+     * It is dead schema kept for one more step: dropping it is a migration on
+     * this module's table and is deliberately not folded into the repair of the
+     * five derivation sites. Do not read it — the honest answer is `mfa`'s.
+     */
+    twoFactorConfirmedAt;
+    lastLoginAt;
+    createdAt = new Date();
+    updatedAt = new Date();
+    // Feature 055 — Custom Fields Layer value bag (inherits host tenant scope).
+    customFieldValues = {};
+    deletedAt;
+    // ── Feature 040 (Customers) lifecycle extensions ────────────────────────
+    /**
+     * Direct customer→customer-group membership (FR-022). Independent of the
+     * Organization's group: the effective pricing group is
+     * `customerGroupId ?? organization.customerGroupId`. FK to `customer_groups`
+     * (owned by price_lists), ON DELETE SET NULL.
+     */
+    customerGroupId;
+    /**
+     * Feature 056 (T032) — customer-side roll-up capability. When `true`, this
+     * login sees/acts across its organization's **subtree** (the tenant scope is
+     * widened from single-org to `allowed-set(subtreeIds(theirOrg))` server-side,
+     * Principle XI). Default `false` ⇒ node-only (flat behavior). Set only by a
+     * platform admin on the org member surface; mirrors the admin/sales-rep
+     * `organizations:rollup` capability for a buyer account.
+     */
+    subtreeRollupEnabled = false;
+    /** Non-null ⇒ the account is blocked and login is denied (FR-012/FR-016). */
+    blockedAt;
+    blockReason;
+    /** Who applied the block — drives unblock authority (FR-013/FR-015). */
+    blockSource;
+    blockedByAdminUserId;
+    blockedByCustomerAccountId;
+    /** Admin who soft-deleted the account (paired with `deletedAt`, FR-039). */
+    deletionRequestedByAdminUserId;
+    /**
+     * Non-null ⇒ PII has been irreversibly scrubbed by the anonymization sweep
+     * after the retention window; restore is no longer possible (FR-040).
+     */
+    anonymizedAt;
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], CustomerAccount.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'uuid' }),
+    Index(),
+    __metadata("design:type", String)
+], CustomerAccount.prototype, "organizationId", void 0);
+__decorate([
+    Property({ type: 'string', length: 320 }),
+    Unique(),
+    __metadata("design:type", String)
+], CustomerAccount.prototype, "email", void 0);
+__decorate([
+    Property({ type: 'string', length: 512 }),
+    __metadata("design:type", String)
+], CustomerAccount.prototype, "passwordHash", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "passwordSetAt", void 0);
+__decorate([
+    Property({ type: 'string', length: 120 }),
+    __metadata("design:type", String)
+], CustomerAccount.prototype, "firstName", void 0);
+__decorate([
+    Property({ type: 'string', length: 120 }),
+    __metadata("design:type", String)
+], CustomerAccount.prototype, "lastName", void 0);
+__decorate([
+    Property({ type: 'string', length: 32 }),
+    Index(),
+    __metadata("design:type", String)
+], CustomerAccount.prototype, "role", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "emailVerifiedAt", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "twoFactorConfirmedAt", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "lastLoginAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], CustomerAccount.prototype, "createdAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onUpdate: () => new Date() }),
+    __metadata("design:type", Date)
+], CustomerAccount.prototype, "updatedAt", void 0);
+__decorate([
+    Property({ type: 'json' }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "customFieldValues", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "deletedAt", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    Index(),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "customerGroupId", void 0);
+__decorate([
+    Property({ type: 'boolean' }),
+    __metadata("design:type", Boolean)
+], CustomerAccount.prototype, "subtreeRollupEnabled", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    Index(),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "blockedAt", void 0);
+__decorate([
+    Property({ type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "blockReason", void 0);
+__decorate([
+    Property({ type: 'string', length: 16, nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "blockSource", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "blockedByAdminUserId", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "blockedByCustomerAccountId", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "deletionRequestedByAdminUserId", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], CustomerAccount.prototype, "anonymizedAt", void 0);
+CustomerAccount = __decorate([
+    OrgScoped(),
+    Entity({ tableName: 'customer_accounts' })
+], CustomerAccount);
+export { CustomerAccount };
+//# sourceMappingURL=customer-account.entity.js.map

package/dist/backend/entities/customer-account.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-account.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/customer-account.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;GAMG;AAGI,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,CAAC,aAAa,CAAC,CAmBI;IAGnB,EAAE,GAAW,UAAU,EAAE,CAAC;IAE1B;;;;;;;;;;;;;;;;;;;;;OAqBG;IAGH,cAAc,CAAU;IAIxB,KAAK,CAAU;IAGf,YAAY,CAAU;IAEtB;;;;;;;;;;;;;;;;OAgBG;IAEH,aAAa,CAAe;IAG5B,SAAS,CAAU;IAGnB,QAAQ,CAAU;IAIlB,IAAI,GAA0C,cAAc,CAAC;IAG7D,eAAe,CAAe;IAE9B;;;;;;;;;;;;;;OAcG;IAEH,oBAAoB,CAAe;IAGnC,WAAW,CAAe;IAG1B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;IAG7B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;IAE7B,4EAA4E;IAE5E,iBAAiB,GAA4B,EAAE,CAAC;IAGhD,SAAS,CAAe;IAExB,2EAA2E;IAE3E;;;;;OAKG;IAGH,eAAe,CAAiB;IAEhC;;;;;;;OAOG;IAEH,oBAAoB,GAAY,KAAK,CAAC;IAEtC,6EAA6E;IAG7E,SAAS,CAAe;IAGxB,WAAW,CAAiB;IAE5B,wEAAwE;IAExE,WAAW,CAAgC;IAG3C,oBAAoB,CAAiB;IAGrC,0BAA0B,CAAiB;IAE3C,4EAA4E;IAE5E,8BAA8B,CAAiB;IAE/C;;;OAGG;IAEH,YAAY,CAAe;CAC5B,CAAA;AAzJC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;2CACH;AA0B1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE;;uDACgB;AAIxB;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzC,MAAM,EAAE;;8CACM;AAGf;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;qDACpB;AAoBtB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACnB;AAG5B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;kDACvB;AAGnB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;iDACxB;AAIlB;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxC,KAAK,EAAE;;6CACqD;AAG7D;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;wDACjB;AAkB9B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6DACZ;AAGnC;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDACrB;AAG1B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;kDAAc;AAG7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;kDAAc;AAI7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;0DACqB;AAGhD;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACvB;AAYxB;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,KAAK,EAAE;;wDACwB;AAWhC;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;6DACQ;AAKtC;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,KAAK,EAAE;;kDACgB;AAGxB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDACf;AAI5B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDACd;AAG3C;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6DACN;AAGrC;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mEACA;AAI3C;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uEACI;AAO/C;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACpB;AA/KhB,eAAe;IAF3B,SAAS,EAAE;IACX,MAAM,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;GAC9B,eAAe,CAgL3B"}

package/dist/backend/entities/customer-group.entity.d.ts

@@ -0,0 +1,29 @@
+import { OptionalProps } from '@mikro-orm/core';
+/**
+ * CustomerGroup — the segmentation bucket a customer belongs to.
+ *
+ * A customer account carries one directly (`CustomerAccount.customerGroupId`,
+ * a real foreign key into this table with `on delete set null`) and inherits
+ * its Organization's (`Organization.customerGroupId`, an indexed column with no
+ * constraint) when it has none of its own. Groups have no behavioural state of
+ * their own; they exist as an addressable target — for the feature 011
+ * Application Rule's `customerGroup` criterion, for a promotion's audience and
+ * for a push audience rule.
+ *
+ * Feature 076 (D-79) moved this class here from `price_lists`. Table ownership
+ * resolves from the module directory the decorated class lives in — its
+ * `tableName` read out of the entity decorator below — so the move *is* the
+ * ownership change; no SQL was written, the creating migration stayed in
+ * `price_lists/migrations/`, and the foreign key from `customer_accounts`
+ * became intra-module.
+ */
+export declare class CustomerGroup {
+    [OptionalProps]?: 'id' | 'createdAt' | 'updatedAt' | 'description';
+    id: string;
+    code: string;
+    name: string;
+    description?: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=customer-group.entity.d.ts.map

package/dist/backend/entities/customer-group.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-group.entity.d.ts","sourceRoot":"","sources":["../../../src/backend/entities/customer-group.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,aAAa,EAAgC,MAAM,iBAAiB,CAAC;AAItF;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAEa,aAAa;IACxB,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC;IAGnE,EAAE,EAAE,MAAM,CAAgB;IAI1B,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG5B,SAAS,EAAE,IAAI,CAAc;IAG7B,SAAS,EAAE,IAAI,CAAc;CAC9B"}

package/dist/backend/entities/customer-group.entity.js

@@ -0,0 +1,70 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, OptionalProps, PrimaryKey, Property, Unique } from '@mikro-orm/core';
+import { GlobalEntity } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * CustomerGroup — the segmentation bucket a customer belongs to.
+ *
+ * A customer account carries one directly (`CustomerAccount.customerGroupId`,
+ * a real foreign key into this table with `on delete set null`) and inherits
+ * its Organization's (`Organization.customerGroupId`, an indexed column with no
+ * constraint) when it has none of its own. Groups have no behavioural state of
+ * their own; they exist as an addressable target — for the feature 011
+ * Application Rule's `customerGroup` criterion, for a promotion's audience and
+ * for a push audience rule.
+ *
+ * Feature 076 (D-79) moved this class here from `price_lists`. Table ownership
+ * resolves from the module directory the decorated class lives in — its
+ * `tableName` read out of the entity decorator below — so the move *is* the
+ * ownership change; no SQL was written, the creating migration stayed in
+ * `price_lists/migrations/`, and the foreign key from `customer_accounts`
+ * became intra-module.
+ */
+let CustomerGroup = class CustomerGroup {
+    [OptionalProps];
+    id = randomUUID();
+    code;
+    name;
+    description;
+    createdAt = new Date();
+    updatedAt = new Date();
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], CustomerGroup.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'string', length: 64 }),
+    Unique(),
+    __metadata("design:type", String)
+], CustomerGroup.prototype, "code", void 0);
+__decorate([
+    Property({ type: 'string', length: 160 }),
+    __metadata("design:type", String)
+], CustomerGroup.prototype, "name", void 0);
+__decorate([
+    Property({ type: 'string', length: 1000, nullable: true }),
+    __metadata("design:type", Object)
+], CustomerGroup.prototype, "description", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], CustomerGroup.prototype, "createdAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onUpdate: () => new Date() }),
+    __metadata("design:type", Date)
+], CustomerGroup.prototype, "updatedAt", void 0);
+CustomerGroup = __decorate([
+    GlobalEntity(),
+    Entity({ tableName: 'customer_groups' })
+], CustomerGroup);
+export { CustomerGroup };
+//# sourceMappingURL=customer-group.entity.js.map

package/dist/backend/entities/customer-group.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-group.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/customer-group.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;;;;;;;;;;;;GAiBG;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,CAAC,aAAa,CAAC,CAAoD;IAGnE,EAAE,GAAW,UAAU,EAAE,CAAC;IAI1B,IAAI,CAAU;IAGd,IAAI,CAAU;IAGd,WAAW,CAAiB;IAG5B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;IAG7B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;CAC9B,CAAA;AAjBC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;yCACH;AAI1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxC,MAAM,EAAE;;2CACK;AAGd;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;2CAC5B;AAGd;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDAC/B;AAG5B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;gDAAc;AAG7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;gDAAc;AApBlB,aAAa;IAFzB,YAAY,EAAE;IACd,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;GAC5B,aAAa,CAqBzB"}

package/dist/backend/entities/password-reset-token.entity.d.ts

@@ -0,0 +1,16 @@
+import { OptionalProps } from '@mikro-orm/core';
+/**
+ * One-shot password-reset token. Same shape as EmailVerificationToken — sha256
+ * hash stored, expires_at + consumed_at one-shot. Issued by the public
+ * /auth/password-reset/request endpoint.
+ */
+export declare class PasswordResetToken {
+    [OptionalProps]?: 'id' | 'createdAt' | 'consumedAt';
+    id: string;
+    customerAccountId: string;
+    tokenHash: string;
+    expiresAt: Date;
+    consumedAt?: Date | null;
+    createdAt: Date;
+}
+//# sourceMappingURL=password-reset-token.entity.d.ts.map

package/dist/backend/entities/password-reset-token.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-token.entity.d.ts","sourceRoot":"","sources":["../../../src/backend/entities/password-reset-token.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,aAAa,EAAgC,MAAM,iBAAiB,CAAC;AAI7F;;;;GAIG;AACH,qBAEa,kBAAkB;IAC7B,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,WAAW,GAAG,YAAY,CAAC;IAGpD,EAAE,EAAE,MAAM,CAAgB;IAI1B,iBAAiB,EAAG,MAAM,CAAC;IAI3B,SAAS,EAAG,MAAM,CAAC;IAInB,SAAS,EAAG,IAAI,CAAC;IAGjB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAGzB,SAAS,EAAE,IAAI,CAAc;CAC9B"}

package/dist/backend/entities/password-reset-token.entity.js

@@ -0,0 +1,59 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, Index, OptionalProps, PrimaryKey, Property, Unique } from '@mikro-orm/core';
+import { CustomerScoped } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * One-shot password-reset token. Same shape as EmailVerificationToken — sha256
+ * hash stored, expires_at + consumed_at one-shot. Issued by the public
+ * /auth/password-reset/request endpoint.
+ */
+let PasswordResetToken = class PasswordResetToken {
+    [OptionalProps];
+    id = randomUUID();
+    customerAccountId;
+    tokenHash;
+    expiresAt;
+    consumedAt;
+    createdAt = new Date();
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], PasswordResetToken.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'uuid' }),
+    Index(),
+    __metadata("design:type", String)
+], PasswordResetToken.prototype, "customerAccountId", void 0);
+__decorate([
+    Property({ type: 'string', length: 128 }),
+    Unique(),
+    __metadata("design:type", String)
+], PasswordResetToken.prototype, "tokenHash", void 0);
+__decorate([
+    Property({ type: 'datetime' }),
+    Index(),
+    __metadata("design:type", Date)
+], PasswordResetToken.prototype, "expiresAt", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], PasswordResetToken.prototype, "consumedAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], PasswordResetToken.prototype, "createdAt", void 0);
+PasswordResetToken = __decorate([
+    CustomerScoped(),
+    Entity({ tableName: 'password_reset_tokens' })
+], PasswordResetToken);
+export { PasswordResetToken };
+//# sourceMappingURL=password-reset-token.entity.js.map

package/dist/backend/entities/password-reset-token.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-token.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/password-reset-token.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;GAIG;AAGI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,CAAC,aAAa,CAAC,CAAqC;IAGpD,EAAE,GAAW,UAAU,EAAE,CAAC;IAI1B,iBAAiB,CAAU;IAI3B,SAAS,CAAU;IAInB,SAAS,CAAQ;IAGjB,UAAU,CAAe;IAGzB,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;CAC9B,CAAA;AAnBC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;8CACH;AAI1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE;;6DACmB;AAI3B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzC,MAAM,EAAE;;qDACU;AAInB;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,KAAK,EAAE;8BACI,IAAI;qDAAC;AAGjB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACtB;AAGzB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;qDAAc;AAtBlB,kBAAkB;IAF9B,cAAc,EAAE;IAChB,MAAM,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC;GAClC,kBAAkB,CAuB9B"}

package/dist/backend/index.d.ts

@@ -0,0 +1,144 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { ChannelMemberEntityType } from '@endora-commerce/contracts';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { CommandBus } from '@endora-commerce/platform/commands';
+import type { ModuleContext } from '@endora-commerce/platform/kernel';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import type { SettingsReadPort } from '@endora-commerce/platform/kernel';
+import { CustomerAccount } from './entities/customer-account.entity.js';
+import { CustomerGroup } from './entities/customer-group.entity.js';
+import { PasswordResetToken } from './entities/password-reset-token.entity.js';
+import { CustomerAuthService } from './services/customer-auth-service.js';
+import { CustomerGroupService } from './services/customer-group-service.js';
+import { PasswordResetService } from './services/password-reset-service.js';
+import { RoleService } from './services/role-service.js';
+/**
+ * `customer_accounts` — one customer auth service, where there were two
+ * (feature 072, wave 1, T094).
+ *
+ * The module owns no routes: `organizations` serves customer login and
+ * registration, `customers` serves the self-service surface. Both built their
+ * own `CustomerAuthService`, and the third constructor argument differed:
+ *
+ *     organizations:  new CustomerAuthService(em, sessions, options.getMfaLoginPort, audit)
+ *     customers:      new CustomerAuthService(em, sessions, undefined, audit)
+ *                                                          ^ "not wired in the
+ *                                                            customers composition"
+ *
+ * That comment was accurate rather than careless, and this is **not** a live
+ * MFA bypass today: `getMfaLoginPort` is consulted only inside `login()`, the
+ * single login route lives in `organizations`, and the `customers` instance is
+ * used only for `changePassword`. What it is, is the `addresses` shape — two
+ * instances of one service that are not required to agree, one of which cannot
+ * enforce a second factor. The day a customer-side route needs `login()`, the
+ * divergence stops being latent, and nothing in the tree would flag it.
+ *
+ * `PasswordResetService` was doubled the same way, with identical arguments.
+ *
+ * **The MFA port is resolved here now, behind a presence probe** (D-96). It was
+ * a contribution both roots filled from one getter — a root resolving a gated
+ * port on this module's behalf, which is composition checklist item 6 — and the
+ * harness captured that gate at compose time, so `mfa` switched off was
+ * unobservable. The edge is declared `degrades-without` in this module's
+ * manifest: `mfa` declares `customer_accounts`, so the ordinary declaration
+ * would close a cycle and would make customer login refuse the operator's flip.
+ *
+ * Everything here is a **port**: `organizations` and `customers` resolve these
+ * services across a module boundary, so an operator switching customer accounts
+ * off should get an explicit 503 rather than a service that half-answers.
+ *
+ * `customerOrgResolver` moves here from `HOST_REGISTERED_PORTS`, where a
+ * composition root stood in for this module. `auth` reads it in its request
+ * hook to attach the organization to a customer session; the lookup is a plain
+ * read of this module's own table, so it belongs to this module and the root's
+ * entry goes away.
+ *
+ * **Social-login account creation came home in T143a cluster 6, and the two
+ * roots disagreed about what it does.** Both wrote `mfaSocialAccountResolvers`
+ * closures that read and created rows in this module's table. Production gated
+ * the creation on `customers.allow_registration_without_organization`, which
+ * ships **off**; the harness gated it on nothing, so federated sign-in
+ * auto-created an account in every test run and the gate itself was covered by
+ * no test — a policy the platform has and the suite denied. Production
+ * system-scoped the identity read (tenancy comes after identity) and the
+ * harness did not, and production minted a random password where the harness
+ * hashed one fixed string for every auto-created account. One implementation
+ * now, and it is this module's, because the table is.
+ */
+export interface CustomerAccountsCradle {
+    /**
+     * Feature 120 (FR-015) — the platform's channel-bridge registry, resolved by
+     * **container name** rather than imported. The shape is the narrow one this
+     * module needs, which is what `ctx.cradle<C>()` asks an author to declare;
+     * the registry itself is the kernel's and is published on no barrel.
+     */
+    readonly salesChannelBridgeRegistry: {
+        register(bridge: {
+            entityType: ChannelMemberEntityType;
+            table: string;
+            entityIdColumn: string;
+        }): void;
+    };
+    readonly emFactory: () => EntityManager;
+    readonly auditLogService: AuditPort;
+    /** Feature 054 — the customer-group writes audit co-transactionally. */
+    readonly commandBus: CommandBus;
+    /** `auth`'s admin guard, for the customer-group admin routes. */
+    readonly requireAdmin: RequireAdminFactory;
+    readonly settingsReadPort: SettingsReadPort;
+    /**
+     * Which channel a global-scope settings read resolves against — the
+     * deployment's system-default channel. A property of the deployment, so a
+     * root supplies it; `inventory` reads the same name.
+     */
+    readonly settingsChannelResolver: () => Promise<string | null>;
+    /**
+     * The two customer-side halves of `mfa`'s `SocialIdentityDeps` (T143a): match
+     * a verified provider e-mail to an account, and create one when nothing
+     * matches and the platform allows an org-less registration.
+     */
+    readonly customerSocialLoginPort: {
+        resolveByEmail(email: string): Promise<{
+            id: string;
+        } | null>;
+        autoCreate(email: string): Promise<{
+            id: string;
+        } | null>;
+    };
+    readonly customerAuthService: CustomerAuthService;
+    readonly passwordResetService: PasswordResetService;
+    readonly customerRoleService: RoleService;
+    readonly customerGroupService: CustomerGroupService;
+}
+export declare function registerModule(ctx: ModuleContext): void;
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table->owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ *
+ * The order is the one `db/entities-registry.generated.ts` declared before this
+ * module became a package, so the registered set is the same list in the same
+ * sequence.
+ */
+export declare const entities: (typeof CustomerAccount | typeof CustomerGroup | typeof PasswordResetToken)[];
+/**
+ * The sales-channel membership bridge this module owns (feature 120, FR-015).
+ *
+ * Exported as well as registered because the owning module is the only honest
+ * source for it: a caller that composes no platform — the bare-database test
+ * harness, which constructs the kernel's membership service directly — declares
+ * these from here rather than from a list of nine it keeps itself, which is
+ * exactly the total map this feature deleted.
+ */
+export declare const salesChannelBridges: ReadonlyArray<{
+    readonly entityType: ChannelMemberEntityType;
+    readonly table: string;
+    readonly entityIdColumn: string;
+}>;
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAmB1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAGrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAItE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAIzE,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAc/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAGzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,0BAA0B,EAAE;QACnC,QAAQ,CAAC,MAAM,EAAE;YACf,UAAU,EAAE,uBAAuB,CAAC;YACpC,KAAK,EAAE,MAAM,CAAC;YACd,cAAc,EAAE,MAAM,CAAC;SACxB,GAAG,IAAI,CAAC;KACV,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,EAAE;QAChC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QAC9D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;KAC3D,CAAC;IACF,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;IACpD,QAAQ,CAAC,mBAAmB,EAAE,WAAW,CAAC;IAC1C,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;CACrD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CA0evD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ,+EAAuD,CAAC;AAE7E;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAEA,CAAC"}