@endora-commerce/mod-customer-accounts 0.100.0

package/dist/backend/services/customer-auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-auth-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,eAAe,CAAC;IACjC,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,IAAI,CAAC;CACxB;AAED,mEAAmE;AACnE,MAAM,MAAM,oBAAoB,GAC5B,CAAC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG,WAAW,CAAC,GAC3C;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAJT,SAAS,EAAE,MAAM,aAAa,EAC9B,cAAc,EAAE,eAAe;IAChD,mEAAmE;IAClD,eAAe,CAAC,GAAE,MAAM,YAAY,GAAG,SAAS,aAAA,EAChD,QAAQ,CAAC,EAAE,SAAS,YAAA;IAGjC,KAAK,CAAC,KAAK,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqE3B,cAAc,CAClB,iBAAiB,EAAE,MAAM,EACzB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IA8BV,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/C"}

package/dist/backend/services/customer-auth-service.js

@@ -0,0 +1,105 @@
+import { ERROR_CODES, normalizeEmailAddress, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { hashPassword, verifyPassword } from '@endora-commerce/platform/kernel';
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+export class CustomerAuthService {
+    emFactory;
+    sessionService;
+    getMfaLoginPort;
+    auditLog;
+    constructor(emFactory, sessionService, 
+    /** Lazily resolved so composition can late-bind the MFA module. */
+    getMfaLoginPort, auditLog) {
+        this.emFactory = emFactory;
+        this.sessionService = sessionService;
+        this.getMfaLoginPort = getMfaLoginPort;
+        this.auditLog = auditLog;
+    }
+    async login(input) {
+        const em = this.emFactory();
+        // Folded, because the row is. `=` on `text` is case-sensitive in Postgres,
+        // so comparing the address exactly as typed refused every account whose
+        // holder had capitalised anything — with the generic error above, which
+        // says nothing they or support could act on.
+        const customer = await em.findOne(CustomerAccount, {
+            email: normalizeEmailAddress(input.email),
+        });
+        if (!customer) {
+            // Generic error to avoid account enumeration.
+            throw new HttpError(401, ERROR_CODES.INVALID_CREDENTIALS, 'Invalid email or password.');
+        }
+        if (customer.deletedAt) {
+            throw new HttpError(401, ERROR_CODES.INVALID_CREDENTIALS, 'Invalid email or password.');
+        }
+        // Feature 040 — a blocked account cannot log in (FR-012/FR-016). The
+        // distinct error lets the storefront show a clear "account blocked" message.
+        if (customer.blockedAt) {
+            throw new HttpError(403, ERROR_CODES.ACCOUNT_BLOCKED, 'This account has been blocked. Please contact support.');
+        }
+        const ok = await verifyPassword(customer.passwordHash, input.password);
+        if (!ok) {
+            throw new HttpError(401, ERROR_CODES.INVALID_CREDENTIALS, 'Invalid email or password.');
+        }
+        // Second factor (feature 042). No session is issued until it succeeds.
+        const mfaPort = this.getMfaLoginPort?.();
+        if (mfaPort) {
+            const decision = await mfaPort.beginLogin({ subjectType: 'customer', subjectId: customer.id }, {
+                salesChannelId: input.salesChannelId ?? null,
+                organizationId: customer.organizationId ?? null,
+            });
+            if (decision.kind === 'challenge') {
+                return { status: 'mfaRequired', challengeId: decision.challengeId };
+            }
+            if (decision.kind === 'setup') {
+                return { status: 'mfaSetupRequired', setupTicket: decision.setupTicket };
+            }
+        }
+        const session = await this.sessionService.createSession({
+            kind: 'customer',
+            customerAccountId: customer.id,
+            ...(input.ip !== undefined ? { ipAddress: input.ip } : {}),
+            ...(input.userAgent !== undefined ? { userAgent: input.userAgent } : {}),
+        });
+        // command-coverage-ignore: stamps lastLoginAt for the session — high-volume
+        // auth bookkeeping (session lifecycle is owned by SessionService), not an
+        // audited domain-state mutation.
+        customer.lastLoginAt = new Date();
+        await em.flush();
+        return {
+            status: 'authenticated',
+            customerAccount: customer,
+            sessionCookieValue: session.cookieValue,
+            sessionExpiresAt: session.expiresAt,
+        };
+    }
+    async changePassword(customerAccountId, currentPassword, newPassword) {
+        const em = this.emFactory();
+        const customer = await em.findOne(CustomerAccount, { id: customerAccountId });
+        if (!customer) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Customer session required.');
+        }
+        const ok = await verifyPassword(customer.passwordHash, currentPassword);
+        if (!ok) {
+            throw new HttpError(401, ERROR_CODES.CURRENT_PASSWORD_INVALID, 'Current password is incorrect.');
+        }
+        customer.passwordHash = await hashPassword(newPassword);
+        // Issue #222 — the holder proved the current password and chose the new
+        // one, so the account has a password on record whatever it had before.
+        customer.passwordSetAt = new Date();
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, {
+                action: 'customer_account.change_password',
+                objectType: 'customer_account',
+                objectId: customer.id,
+                stateBefore: null,
+                stateAfter: { via: 'self_service' },
+            });
+        }
+        await em.flush();
+    }
+    async logout(sessionId) {
+        await this.sessionService.destroySession(sessionId);
+    }
+}
+//# sourceMappingURL=customer-auth-service.js.map

package/dist/backend/services/customer-auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-auth-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-auth-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,qBAAqB,GAGtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAsC5E,MAAM,OAAO,mBAAmB;IAEX;IACA;IAEA;IACA;IALnB,YACmB,SAA8B,EAC9B,cAA+B;IAChD,mEAAmE;IAClD,eAAgD,EAChD,QAAoB;QAJpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,mBAAc,GAAd,cAAc,CAAiB;QAE/B,oBAAe,GAAf,eAAe,CAAiC;QAChD,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,KAMX;QACC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,2EAA2E;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YACjD,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,8CAA8C;YAC9C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;QAC1F,CAAC;QACD,qEAAqE;QACrE,6EAA6E;QAC7E,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,eAAe,EAC3B,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;QAC1F,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CACvC,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,EACnD;gBACE,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;gBAC5C,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI;aAChD,CACF,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC;YACtD,IAAI,EAAE,UAAU;YAChB,iBAAiB,EAAE,QAAQ,CAAC,EAAE;YAC9B,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;QAEH,4EAA4E;QAC5E,0EAA0E;QAC1E,iCAAiC;QACjC,QAAQ,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAEjB,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,eAAe,EAAE,QAAQ;YACzB,kBAAkB,EAAE,OAAO,CAAC,WAAW;YACvC,gBAAgB,EAAE,OAAO,CAAC,SAAS;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,iBAAyB,EACzB,eAAuB,EACvB,WAAmB;QAEnB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACxD,wEAAwE;QACxE,uEAAuE;QACvE,QAAQ,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxC,MAAM,EAAE,kCAAkC;gBAC1C,UAAU,EAAE,kBAAkB;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/backend/services/customer-group-read-port.d.ts

@@ -0,0 +1,24 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { CustomerGroupReadPort, CustomerGroupRecord } from '@endora-commerce/contracts';
+import { CustomerGroup } from '../entities/customer-group.entity.js';
+/**
+ * The row-level read model `customer_accounts` publishes over customer groups.
+ *
+ * It arrived here with the entity (feature 076, D-79) from
+ * `price_lists/services/price-list-read-port.ts`, unchanged in shape: the
+ * container name, the interface and its three methods are what they were, so
+ * `pwa/backend.ts` did not have to be touched and the port check's before and
+ * after are directly comparable.
+ *
+ * `price_lists` is now a consumer rather than the provider — the pricing
+ * rule-target picker and the rule-target validation read it.
+ */
+export declare class CustomerGroupReadService implements CustomerGroupReadPort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    findById(id: string): Promise<CustomerGroupRecord | null>;
+    findByIds(ids: readonly string[]): Promise<CustomerGroupRecord[]>;
+    listAll(): Promise<CustomerGroupRecord[]>;
+}
+export declare function toCustomerGroupRecord(group: CustomerGroup): CustomerGroupRecord;
+//# sourceMappingURL=customer-group-read-port.d.ts.map

package/dist/backend/services/customer-group-read-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-group-read-port.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-group-read-port.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,qBAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAKzD,SAAS,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAMjE,OAAO,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAIhD;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,mBAAmB,CAS/E"}

package/dist/backend/services/customer-group-read-port.js

@@ -0,0 +1,44 @@
+import { CustomerGroup } from '../entities/customer-group.entity.js';
+/**
+ * The row-level read model `customer_accounts` publishes over customer groups.
+ *
+ * It arrived here with the entity (feature 076, D-79) from
+ * `price_lists/services/price-list-read-port.ts`, unchanged in shape: the
+ * container name, the interface and its three methods are what they were, so
+ * `pwa/backend.ts` did not have to be touched and the port check's before and
+ * after are directly comparable.
+ *
+ * `price_lists` is now a consumer rather than the provider — the pricing
+ * rule-target picker and the rule-target validation read it.
+ */
+export class CustomerGroupReadService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async findById(id) {
+        const group = await this.emFactory().findOne(CustomerGroup, { id });
+        return group ? toCustomerGroupRecord(group) : null;
+    }
+    async findByIds(ids) {
+        if (ids.length === 0)
+            return [];
+        const groups = await this.emFactory().find(CustomerGroup, { id: { $in: [...ids] } });
+        return groups.map(toCustomerGroupRecord);
+    }
+    async listAll() {
+        const groups = await this.emFactory().find(CustomerGroup, {}, { orderBy: { code: 'asc' } });
+        return groups.map(toCustomerGroupRecord);
+    }
+}
+export function toCustomerGroupRecord(group) {
+    return {
+        id: group.id,
+        code: group.code,
+        name: group.name,
+        description: group.description ?? null,
+        createdAt: group.createdAt,
+        updatedAt: group.updatedAt,
+    };
+}
+//# sourceMappingURL=customer-group-read-port.js.map

package/dist/backend/services/customer-group-read-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-group-read-port.js","sourceRoot":"","sources":["../../../src/backend/services/customer-group-read-port.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAsB;QACpC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC"}

package/dist/backend/services/customer-group-service.d.ts

@@ -0,0 +1,21 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { CommandBus } from '@endora-commerce/platform/commands';
+import { CustomerGroup } from '../entities/customer-group.entity.js';
+export declare class CustomerGroupService {
+    #private;
+    private readonly emFactory;
+    /** Feature 054 — audits customer-group writes co-transactionally when provided. */
+    private readonly commandBus?;
+    constructor(emFactory: () => EntityManager, 
+    /** Feature 054 — audits customer-group writes co-transactionally when provided. */
+    commandBus?: CommandBus | undefined);
+    list(): Promise<CustomerGroup[]>;
+    getById(id: string): Promise<CustomerGroup>;
+    upsertByCode(input: {
+        code: string;
+        name: string;
+        description?: string | null | undefined;
+    }): Promise<CustomerGroup>;
+    remove(id: string): Promise<void>;
+}
+//# sourceMappingURL=customer-group-service.d.ts.map

package/dist/backend/services/customer-group-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-group-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-group-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAErE,qBAAa,oBAAoB;;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAFX,SAAS,EAAE,MAAM,aAAa;IAC/C,mFAAmF;IAClE,UAAU,CAAC,EAAE,UAAU,YAAA;IAGpC,IAAI,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAIhC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAM3C,YAAY,CAAC,KAAK,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;KACzC,GAAG,OAAO,CAAC,aAAa,CAAC;IA4DpB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAyBxC"}

package/dist/backend/services/customer-group-service.js

@@ -0,0 +1,97 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { CustomerGroup } from '../entities/customer-group.entity.js';
+export class CustomerGroupService {
+    emFactory;
+    commandBus;
+    constructor(emFactory, 
+    /** Feature 054 — audits customer-group writes co-transactionally when provided. */
+    commandBus) {
+        this.emFactory = emFactory;
+        this.commandBus = commandBus;
+    }
+    async list() {
+        return this.emFactory().find(CustomerGroup, {}, { orderBy: { code: 'asc' } });
+    }
+    async getById(id) {
+        const row = await this.emFactory().findOne(CustomerGroup, { id });
+        if (!row)
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, `Customer group ${id} not found.`);
+        return row;
+    }
+    async upsertByCode(input) {
+        if (this.commandBus)
+            return this.commandBus.run(this.#upsertCommand(input));
+        const em = this.emFactory();
+        const r = await this.#applyUpsert(em, input);
+        await em.flush();
+        return r.row;
+    }
+    #upsertCommand(input) {
+        return {
+            action: 'customer_group.upsert',
+            objectType: 'customer_group',
+            objectId: input.code,
+            run: async ({ em }) => {
+                const r = await this.#applyUpsert(em, input);
+                return { result: r.row, before: r.before, after: r.after };
+            },
+        };
+    }
+    /** Pure upsert on the given em — no flush, no audit. */
+    async #applyUpsert(em, input) {
+        const existing = await em.findOne(CustomerGroup, { code: input.code });
+        if (existing) {
+            const before = {
+                code: existing.code,
+                name: existing.name,
+                description: existing.description ?? null,
+            };
+            existing.name = input.name;
+            if (input.description !== undefined)
+                existing.description = input.description ?? null;
+            return {
+                row: existing,
+                before,
+                after: { code: existing.code, name: existing.name, description: existing.description ?? null },
+            };
+        }
+        const row = em.create(CustomerGroup, {
+            code: input.code,
+            name: input.name,
+            ...(input.description !== undefined ? { description: input.description ?? null } : {}),
+        });
+        return {
+            row,
+            before: null,
+            after: { code: row.code, name: row.name, description: row.description ?? null },
+        };
+    }
+    async remove(id) {
+        if (this.commandBus) {
+            await this.commandBus.run(this.#removeCommand(id));
+            return;
+        }
+        const em = this.emFactory();
+        const row = await em.findOne(CustomerGroup, { id });
+        if (!row)
+            return;
+        await em.removeAndFlush(row);
+    }
+    #removeCommand(id) {
+        return {
+            action: 'customer_group.delete',
+            objectType: 'customer_group',
+            objectId: id,
+            run: async ({ em }) => {
+                const row = await em.findOne(CustomerGroup, { id });
+                if (!row)
+                    return { result: undefined, skipAudit: true };
+                const before = { code: row.code, name: row.name };
+                em.remove(row);
+                return { result: undefined, before, after: null };
+            },
+        };
+    }
+}
+//# sourceMappingURL=customer-group-service.js.map

package/dist/backend/services/customer-group-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-group-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-group-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAErE,MAAM,OAAO,oBAAoB;IAEZ;IAEA;IAHnB,YACmB,SAA8B;IAC/C,mFAAmF;IAClE,UAAuB;QAFvB,cAAS,GAAT,SAAS,CAAqB;QAE9B,eAAU,GAAV,UAAU,CAAa;IACvC,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC;QAC7F,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAIlB;QACC,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,CAAC,GAAG,CAAC;IACf,CAAC;IAED,cAAc,CAAC,KAId;QACC,OAAO;YACL,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,gBAAgB;YAC5B,QAAQ,EAAE,KAAK,CAAC,IAAI;YACpB,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBACpB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC7C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7D,CAAC;SACF,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,YAAY,CAChB,EAAiB,EACjB,KAA8E;QAM9E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;aAC1C,CAAC;YACF,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAC3B,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;gBAAE,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;YACtF,OAAO;gBACL,GAAG,EAAE,QAAQ;gBACb,MAAM;gBACN,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI,EAAE;aAC/F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,CAAC,CAAC;QACH,OAAO;YACL,GAAG;YACH,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE;SAChF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,EAAU;QACvB,OAAO;YACL,MAAM,EAAE,uBAAuB;YAC/B,UAAU,EAAE,gBAAgB;YAC5B,QAAQ,EAAE,EAAE;YACZ,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBACpB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBACxD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;gBAClD,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/services/customer-rollup-scope.d.ts

@@ -0,0 +1,30 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { CustomerRollupScopePort } from '@endora-commerce/contracts';
+/**
+ * Feature 056 (T032) — customer roll-up scope derivation.
+ *
+ * Resolves, server-side, whether a customer login widens from single-org to its
+ * organization's subtree (Principle XI — derived from the authenticated actor,
+ * never request inputs). Returns the subtree id set when the customer holds the
+ * `subtreeRollupEnabled` capability, else `undefined` (stay single-org).
+ *
+ * Lives in the `customer_accounts` module (owner of `CustomerAccount`) and takes
+ * the tree traversal as an injected argument (`subtreeIds`) so it never reaches
+ * into the organizations module's internals (Principle I). The capability read
+ * runs under a system scope because the tenant context is being *established*
+ * by the caller — it does not exist yet (mirrors the auth org resolver).
+ *
+ * **Feature 080 (T040b) — a published port rather than an exported function.**
+ * Its only two callers are the composition roots, which used to import this
+ * file: a value import of a module's source, which is the spelling that stops
+ * existing the day the module becomes a package (D-160.6.1). The rule is
+ * unchanged and so is the query, including the single-column projection and the
+ * system scope; what changed is that the roots resolve it from the container
+ * they already composed.
+ */
+export declare class CustomerRollupScopeService implements CustomerRollupScopePort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    resolveSubtreeIds(customerAccountId: string, organizationId: string | null, subtreeIds: (organizationId: string) => Promise<string[]>): Promise<string[] | undefined>;
+}
+//# sourceMappingURL=customer-rollup-scope.d.ts.map

package/dist/backend/services/customer-rollup-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-rollup-scope.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-rollup-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAI1E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,0BAA2B,YAAW,uBAAuB;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,iBAAiB,CACrB,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,UAAU,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GACxD,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC;CAajC"}

package/dist/backend/services/customer-rollup-scope.js

@@ -0,0 +1,42 @@
+import { withSystemScope } from '@endora-commerce/platform/tenancy';
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+/**
+ * Feature 056 (T032) — customer roll-up scope derivation.
+ *
+ * Resolves, server-side, whether a customer login widens from single-org to its
+ * organization's subtree (Principle XI — derived from the authenticated actor,
+ * never request inputs). Returns the subtree id set when the customer holds the
+ * `subtreeRollupEnabled` capability, else `undefined` (stay single-org).
+ *
+ * Lives in the `customer_accounts` module (owner of `CustomerAccount`) and takes
+ * the tree traversal as an injected argument (`subtreeIds`) so it never reaches
+ * into the organizations module's internals (Principle I). The capability read
+ * runs under a system scope because the tenant context is being *established*
+ * by the caller — it does not exist yet (mirrors the auth org resolver).
+ *
+ * **Feature 080 (T040b) — a published port rather than an exported function.**
+ * Its only two callers are the composition roots, which used to import this
+ * file: a value import of a module's source, which is the spelling that stops
+ * existing the day the module becomes a package (D-160.6.1). The rule is
+ * unchanged and so is the query, including the single-column projection and the
+ * system scope; what changed is that the roots resolve it from the container
+ * they already composed.
+ */
+export class CustomerRollupScopeService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async resolveSubtreeIds(customerAccountId, organizationId, subtreeIds) {
+        if (!organizationId)
+            return undefined;
+        const enabled = await withSystemScope('tenant: resolve customer roll-up flag', async () => {
+            const account = await this.emFactory().findOne(CustomerAccount, { id: customerAccountId }, { fields: ['subtreeRollupEnabled'] });
+            return account?.subtreeRollupEnabled ?? false;
+        });
+        if (!enabled)
+            return undefined;
+        return subtreeIds(organizationId);
+    }
+}
+//# sourceMappingURL=customer-rollup-scope.js.map

package/dist/backend/services/customer-rollup-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-rollup-scope.js","sourceRoot":"","sources":["../../../src/backend/services/customer-rollup-scope.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,iBAAiB,CACrB,iBAAyB,EACzB,cAA6B,EAC7B,UAAyD;QAEzD,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;YACxF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAC5C,eAAe,EACf,EAAE,EAAE,EAAE,iBAAiB,EAAE,EACzB,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,CACrC,CAAC;YACF,OAAO,OAAO,EAAE,oBAAoB,IAAI,KAAK,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/backend/services/password-reset-service.d.ts

@@ -0,0 +1,15 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+export declare class PasswordResetService {
+    private readonly emFactory;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, auditLog?: AuditPort | undefined);
+    /** Returns the raw token only when the email matched a real account. Caller emails it. */
+    requestReset(email: string): Promise<{
+        rawToken: string | null;
+    }>;
+    confirmReset(rawToken: string, newPassword: string): Promise<void>;
+    /** Test-only — returns the latest unconsumed token id for probe tests. */
+    latestUnconsumedTokenId(): Promise<string | null>;
+}
+//# sourceMappingURL=password-reset-service.d.ts.map

package/dist/backend/services/password-reset-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/password-reset-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAS3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAclE,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBADT,SAAS,EAAE,MAAM,aAAa,EAC9B,QAAQ,CAAC,EAAE,SAAS,YAAA;IAGvC,0FAA0F;IACpF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAyBjE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCxE,0EAA0E;IACpE,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CASxD"}

package/dist/backend/services/password-reset-service.js

@@ -0,0 +1,90 @@
+import { createHash, randomBytes } from 'crypto';
+import { ERROR_CODES, normalizeEmailAddress } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+// Feature 075, Phase C — a pure function over its argument, so it lives in the
+// kernel rather than behind a gate that would answer 503 to "hash this string".
+import { hashPassword } from '@endora-commerce/platform/kernel';
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+import { PasswordResetToken } from '../entities/password-reset-token.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+/**
+ * Password reset flow (FR-045 / T119).
+ *
+ *   - request: always returns success regardless of account existence
+ *     (account-enumeration defense). Issues a sha256-hashed token with a
+ *     short TTL (1 hour). The raw token is returned for the email body.
+ *   - confirm: validates token (one-shot, expiry), rehashes the new password,
+ *     marks the token consumed.
+ */
+const TOKEN_TTL_HOURS = 1;
+export class PasswordResetService {
+    emFactory;
+    auditLog;
+    constructor(emFactory, auditLog) {
+        this.emFactory = emFactory;
+        this.auditLog = auditLog;
+    }
+    /** Returns the raw token only when the email matched a real account. Caller emails it. */
+    async requestReset(email) {
+        // command-coverage-ignore: issues a short-TTL, one-shot reset token (rate-
+        // limited, account-enumeration-safe); the actual password change is audited
+        // at confirmReset (customer_account.password_reset).
+        const em = this.emFactory();
+        // Folded like every other lookup on this table (see `normalizeEmailAddress`).
+        // An unmatched address is indistinguishable from an unknown one here — the
+        // method answers `{ rawToken: null }` to both — so a case-sensitive compare
+        // silently denied a reset to exactly the accounts that most needed one.
+        const customer = await em.findOne(CustomerAccount, {
+            email: normalizeEmailAddress(email),
+            deletedAt: null,
+        });
+        if (!customer)
+            return { rawToken: null };
+        const rawToken = randomBytes(32).toString('base64url');
+        const token = em.create(PasswordResetToken, {
+            customerAccountId: customer.id,
+            tokenHash: sha256Hex(rawToken),
+            expiresAt: new Date(Date.now() + TOKEN_TTL_HOURS * 60 * 60 * 1_000),
+        });
+        await em.persistAndFlush(token);
+        return { rawToken };
+    }
+    async confirmReset(rawToken, newPassword) {
+        const em = this.emFactory();
+        const token = await em.findOne(PasswordResetToken, { tokenHash: sha256Hex(rawToken) });
+        if (!token || token.consumedAt || token.expiresAt.getTime() <= Date.now()) {
+            throw new HttpError(400, ERROR_CODES.TOKEN_INVALID_OR_EXPIRED, 'Reset token is invalid or has expired.');
+        }
+        const customer = await em.findOne(CustomerAccount, { id: token.customerAccountId });
+        if (!customer) {
+            throw new HttpError(400, ERROR_CODES.TOKEN_INVALID_OR_EXPIRED, 'Associated account no longer exists.');
+        }
+        customer.passwordHash = await hashPassword(newPassword);
+        // Issue #222 — the holder proved control of the address and chose the
+        // password themselves, so the account has one on record from here on. This
+        // is also the one route into that state for an account federated sign-in
+        // created: it never knew a current password to change.
+        customer.passwordSetAt = new Date();
+        token.consumedAt = new Date();
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, {
+                action: 'customer_account.password_reset',
+                objectType: 'customer_account',
+                objectId: customer.id,
+                stateBefore: null,
+                stateAfter: { via: 'reset_token' },
+            });
+        }
+        await em.flush();
+    }
+    /** Test-only — returns the latest unconsumed token id for probe tests. */
+    async latestUnconsumedTokenId() {
+        const em = this.emFactory();
+        const row = await em.findOne(PasswordResetToken, { consumedAt: null }, { orderBy: { createdAt: 'desc' } });
+        return row?.id ?? null;
+    }
+}
+function sha256Hex(input) {
+    return createHash('sha256').update(input, 'utf8').digest('hex');
+}
+//# sourceMappingURL=password-reset-service.js.map

package/dist/backend/services/password-reset-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-service.js","sourceRoot":"","sources":["../../../src/backend/services/password-reset-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,+EAA+E;AAC/E,gFAAgF;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAG5E;;;;;;;;GAQG;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,SAA8B,EAC9B,QAAoB;QADpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,2EAA2E;QAC3E,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,8EAA8E;QAC9E,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YACjD,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC;YACnC,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAEzC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE;YAC1C,iBAAiB,EAAE,QAAQ,CAAC,EAAE;YAC9B,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;SACpE,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,WAAmB;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1E,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,wCAAwC,CACzC,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACxD,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,uDAAuD;QACvD,QAAQ,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC;QACpC,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxC,MAAM,EAAE,iCAAiC;gBACzC,UAAU,EAAE,kBAAkB;gBAC9B,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,uBAAuB;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B,kBAAkB,EAClB,EAAE,UAAU,EAAE,IAAI,EAAE,EACpB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CACnC,CAAC;QACF,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;IACzB,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}

package/dist/backend/services/role-service.d.ts

@@ -0,0 +1,22 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * RoleService (T174).
+ *
+ * Members management on the buyer side. Two safety guards:
+ *   - CANNOT_REMOVE_LAST_ADMIN — DELETE on the only `organization_admin`
+ *     member of an org returns 409.
+ *   - CANNOT_DEMOTE_LAST_ADMIN — PATCH /role downgrading the only
+ *     `organization_admin` returns 409.
+ */
+export declare class RoleService {
+    #private;
+    private readonly emFactory;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, auditLog?: AuditPort | undefined);
+    listMembers(organizationId: string): Promise<CustomerAccount[]>;
+    changeRole(organizationId: string, targetCustomerAccountId: string, newRole: 'organization_admin' | 'regular_user'): Promise<CustomerAccount>;
+    removeMember(organizationId: string, targetCustomerAccountId: string): Promise<void>;
+}
+//# sourceMappingURL=role-service.d.ts.map

package/dist/backend/services/role-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/role-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;;;;;;GAQG;AACH,qBAAa,WAAW;;IAEpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBADT,SAAS,EAAE,MAAM,aAAa,EAC9B,QAAQ,CAAC,EAAE,SAAS,YAAA;IAqBjC,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAS/D,UAAU,CACd,cAAc,EAAE,MAAM,EACtB,uBAAuB,EAAE,MAAM,EAC/B,OAAO,EAAE,oBAAoB,GAAG,cAAc,GAC7C,OAAO,CAAC,eAAe,CAAC;IA4BrB,YAAY,CAAC,cAAc,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgC3F"}