@endora-commerce/mod-customer-accounts 0.100.0

package/dist/backend/services/role-service.js

@@ -0,0 +1,83 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { CustomerAccount } from '../entities/customer-account.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+/**
+ * RoleService (T174).
+ *
+ * Members management on the buyer side. Two safety guards:
+ *   - CANNOT_REMOVE_LAST_ADMIN — DELETE on the only `organization_admin`
+ *     member of an org returns 409.
+ *   - CANNOT_DEMOTE_LAST_ADMIN — PATCH /role downgrading the only
+ *     `organization_admin` returns 409.
+ */
+export class RoleService {
+    emFactory;
+    auditLog;
+    constructor(emFactory, auditLog) {
+        this.emFactory = emFactory;
+        this.auditLog = auditLog;
+    }
+    #audit(em, action, objectId, stateBefore, stateAfter) {
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, {
+                action,
+                objectType: 'customer_account',
+                objectId,
+                stateBefore,
+                stateAfter,
+            });
+        }
+    }
+    async listMembers(organizationId) {
+        const em = this.emFactory();
+        return em.find(CustomerAccount, { organizationId, deletedAt: null }, { orderBy: { role: 'asc', createdAt: 'asc' } });
+    }
+    async changeRole(organizationId, targetCustomerAccountId, newRole) {
+        const em = this.emFactory();
+        const target = await em.findOne(CustomerAccount, {
+            id: targetCustomerAccountId,
+            organizationId,
+            deletedAt: null,
+        });
+        if (!target) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Member not found.');
+        }
+        if (target.role === 'organization_admin' &&
+            newRole === 'regular_user' &&
+            (await this.#countAdmins(em, organizationId)) === 1) {
+            throw new HttpError(409, ERROR_CODES.CANNOT_DEMOTE_LAST_ADMIN, 'Cannot demote the only organization admin.');
+        }
+        const previousRole = target.role;
+        target.role = newRole;
+        this.#audit(em, 'customer_account.change_role', target.id, { role: previousRole }, { role: newRole });
+        await em.flush();
+        return target;
+    }
+    async removeMember(organizationId, targetCustomerAccountId) {
+        const em = this.emFactory();
+        const target = await em.findOne(CustomerAccount, {
+            id: targetCustomerAccountId,
+            organizationId,
+            deletedAt: null,
+        });
+        if (!target) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Member not found.');
+        }
+        if (target.role === 'organization_admin' &&
+            (await this.#countAdmins(em, organizationId)) === 1) {
+            throw new HttpError(409, ERROR_CODES.CANNOT_REMOVE_LAST_ADMIN, 'Cannot remove the only organization admin.');
+        }
+        target.deletedAt = new Date();
+        this.#audit(em, 'customer_account.remove_member', target.id, { role: target.role }, null);
+        await em.flush();
+    }
+    async #countAdmins(em, organizationId) {
+        return em.count(CustomerAccount, {
+            organizationId,
+            role: 'organization_admin',
+            deletedAt: null,
+        });
+    }
+}
+//# sourceMappingURL=role-service.js.map

package/dist/backend/services/role-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-service.js","sourceRoot":"","sources":["../../../src/backend/services/role-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAG5E;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,SAA8B,EAC9B,QAAoB;QADpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,MAAM,CACJ,EAAiB,EACjB,MAAc,EACd,QAAgB,EAChB,WAA2C,EAC3C,UAA0C;QAE1C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxC,MAAM;gBACN,UAAU,EAAE,kBAAkB;gBAC9B,QAAQ;gBACR,WAAW;gBACX,UAAU;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,cAAsB;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,IAAI,CACZ,eAAe,EACf,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,EACnC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CACd,cAAsB,EACtB,uBAA+B,EAC/B,OAA8C;QAE9C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC/C,EAAE,EAAE,uBAAuB;YAC3B,cAAc;YACd,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACvE,CAAC;QACD,IACE,MAAM,CAAC,IAAI,KAAK,oBAAoB;YACpC,OAAO,KAAK,cAAc;YAC1B,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QACjC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,8BAA8B,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,cAAsB,EAAE,uBAA+B;QACxE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC/C,EAAE,EAAE,uBAAuB;YAC3B,cAAc;YACd,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACvE,CAAC;QACD,IACE,MAAM,CAAC,IAAI,KAAK,oBAAoB;YACpC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,gCAAgC,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1F,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAiB,EAAE,cAAsB;QAC1D,OAAO,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE;YAC/B,cAAc;YACd,IAAI,EAAE,oBAAoB;YAC1B,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/backend/services/two-factor-enrolments.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Which customer accounts hold a second factor — this module's own view of a
+ * fact `mfa` owns.
+ *
+ * A function type rather than an interface, and not shared with `admin_users`,
+ * because there is nothing to share: the published shape is
+ * `MfaEnrolmentStatePort` in `@endora-commerce/contracts`, and this is only the
+ * shape in which *this* module's mapper wants the answer — `subjectType` is
+ * already decided, and a `Set` is what a list surface asks per row.
+ *
+ * `backend.ts` builds the one implementation: it decides `mfa`'s presence and
+ * then resolves the port, so an absent owner produces an empty set rather than
+ * a `ModuleDisabledError` on a customer's own account page. That is a declared
+ * degrade — see the `degrades-without` entry for `mfaEnrolmentStatePort` in
+ * this module's manifest — and not a caught gate.
+ */
+export type TwoFactorEnrolmentReader = (customerAccountIds: readonly string[]) => Promise<ReadonlySet<string>>;
+//# sourceMappingURL=two-factor-enrolments.d.ts.map

package/dist/backend/services/two-factor-enrolments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-enrolments.d.ts","sourceRoot":"","sources":["../../../src/backend/services/two-factor-enrolments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,kBAAkB,EAAE,SAAS,MAAM,EAAE,KAClC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/backend/services/two-factor-enrolments.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=two-factor-enrolments.js.map

package/dist/backend/services/two-factor-enrolments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-enrolments.js","sourceRoot":"","sources":["../../../src/backend/services/two-factor-enrolments.ts"],"names":[],"mappings":""}

package/dist/manifest.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Customer Accounts module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("email" | "invoice" | "cms" | "newsletter")[];
+        fields: Record<string, {
+            type: "number" | "object" | "array" | "text" | "textarea" | "select" | "radio" | "external" | "uuid" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("email" | "invoice" | "cms" | "newsletter")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+MnB,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,212 @@
+import { defineModuleManifest } from '@endora-commerce/contracts';
+/**
+ * Customer Accounts module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export const manifest = defineModuleManifest({
+    id: 'customer_accounts',
+    name: 'Customer Accounts',
+    description: 'Customer (B2B) account records, including organization membership and role.',
+    version: '1.0.0',
+    // `auth` owns `authSessionPort`, which `CustomerAuthService` resolves to mint
+    // and destroy a customer session; the edge became real with the conversion
+    // (feature 072, T094) and stays binding — a platform that cannot mint a
+    // session must refuse the login rather than issue one nothing can validate.
+    // It is *only* that: feature 075's Phase C took password hashing and the TOTP
+    // primitives out of this edge, because a pure function has no owner to be
+    // switched off.
+    // `customer_accounts.organization_id` is a real foreign key, and feature 072
+    // is what made it visible: the module exports its entities now, so the ORM
+    // registry attributes the table to it and the FK-drift check can see across
+    // the boundary. The edge predates the conversion — it was simply
+    // unattributable while the table belonged to nobody.
+    // `customer_accounts.customer_group_id` is a real foreign key too, and since
+    // feature 076 (D-79) it points at `customer_groups`, which this module now
+    // owns: the constraint is intra-module and declares nothing.
+    // `audit_logs` owns `auditReferenceRegistry`, the registry this module pushes
+    // its own "what is this audit row called, and where does the admin app show
+    // it?" resolver into (feature 075, D-87). The registry is ungated and its
+    // owner is non-deactivatable, so the declaration buys install and migration
+    // order rather than a flip-time refusal.
+    dependencies: ['audit_logs', 'auth', 'organizations'],
+    /**
+     * D-96 — `mfaLoginPort`, the second factor on customer login.
+     *
+     * Real to the container, binding on no operator. `mfa` declares this module
+     * in its own `dependencies`, so the ordinary declaration closes a cycle; and
+     * an acknowledged edge would put customer login among the dependents that
+     * refuse the flip, making a client security policy permanently unswitchable.
+     */
+    nonBindingDependencies: [
+        {
+            moduleId: 'mfa',
+            name: 'mfaLoginPort',
+            kind: 'degrades-without',
+            whenAbsent: 'Customer sign-in stops asking for a second factor and offers no Google/Microsoft ' +
+                'button. An account created by social sign-in has no known password: its route in is ' +
+                '"forgot password".',
+            reason: 'CustomerAuthService verifies the password first and then asks the second factor what ' +
+                'to do. With `mfa` absent it asks nobody: `backend.ts` probes ' +
+                '`effectiveState.isPresent("mfa")` and passes `undefined`, which selects the ' +
+                'password-only branch feature 042 FR-033 requires and this service has always had. ' +
+                'Nothing catches `ModuleDisabledError` — the decision is taken before the port is ' +
+                'resolved. Org-level TOTP enforcement is `mfa`\'s own policy and goes with it. One ' +
+                'edge is not repaired by the degrade and the operator has to know it: an account this ' +
+                'module auto-created from a Google/Microsoft sign-in holds a random password nobody ' +
+                'was ever told, so with the buttons gone its only route back is a password reset, ' +
+                'keyed on the e-mail the provider verified.',
+        },
+        {
+            moduleId: 'mfa',
+            name: 'mfaEnrolmentStatePort',
+            kind: 'degrades-without',
+            whenAbsent: 'Reads "no second factor" for every customer — admin customer detail, both ' +
+                'organisation member panels, and the buyer\'s own account page. True while MFA is off; ' +
+                'not a claim that nobody is enrolled.',
+            reason: '`twoFactorEnabled` on `CustomerAccountRecord` is the live `mfa` enrolment, read in ' +
+                'one batch through `mfaEnrolmentStatePort`. It was ' +
+                '`Boolean(account.twoFactorConfirmedAt)` until 2026-08-28, and that column\'s only ' +
+                'non-null writer was the superseded TOTP path deleted on 2026-08-25 — so GET ' +
+                '/api/v1/me/customer told a buyer who had enrolled an hour earlier that their own ' +
+                'account was unprotected. Non-binding for the reason the login edge beside it is: ' +
+                '`mfa` declares this module in its own `dependencies`, so an ordinary declaration ' +
+                'closes a cycle, and an acknowledged edge would make a client security policy ' +
+                'unswitchable. The degrade is taken by **not resolving** — `backend.ts` probes ' +
+                'presence first and answers an empty set — so nothing catches `ModuleDisabledError`.',
+        },
+    ],
+    // Feature 074 (Constitution XVII), test C1 — reachability. The flag used to
+    // rest on four port edges another module declares; ruling 2 withdraws that
+    // authority, so the ground is now this module's own and it is the stronger
+    // one anyway. This module owns the identity a buyer signs in as. Switch it
+    // off and no customer-side path exists at all — no registration, no login,
+    // no cart belonging to anyone, no order placed by anyone — which is the
+    // reachability test rather than a reduction in capability.
+    /**
+     * Nothing to demonstrate of its own (feature 113, T211/T222 — contract §1.2).
+     *
+     * The demo shop does have a buyer, and it is not this module's demo data:
+     * `customer_accounts.organization_id` is `NOT NULL` (Principle XI), so there
+     * is no account to create before an `organizations` row exists to hold it, and
+     * "create the account, then join it" cannot be written at all. The account and
+     * its organisation are created in one statement, which makes them two modules'
+     * rows and a composition step (§5.1) — step 5 of
+     * `backend/src/seeds/demo-composition.ts`, which says so in its own words.
+     *
+     * `false` rather than absent, because the two are different states: this is a
+     * decision that the module owes nothing, not a module nobody has looked at.
+     */
+    demo: false,
+    activation: {
+        nonDeactivatable: true,
+        reason: 'The identity a buyer signs in as; no customer-side path — registration, login, cart, ' +
+            'order or account — exists without it.',
+    },
+    /**
+     * The seven error codes this module owns — D-129's remaining sweep, MR 4
+     * (`specs/090-module-owned-error-codes/d129-sweep.md` §5.2, Appendix A;
+     * D-186 in `specs/080-f4-real-scope/rulings.md`).
+     *
+     * This module declared none until now. All seven were `_i18n`'s, not because
+     * anybody judged them the platform's but because the deleted prefix chain had
+     * no rule for them and its last line was `return 'core'`.
+     *
+     * **Four of them are the `CUSTOMER_*` record family, and D-186 §1 is what put
+     * them here rather than in `customers`.** The two modules are a data/behaviour
+     * pair — this one holds the `CustomerAccount` row, `customers` holds the
+     * lifecycle logic and the admin and storefront surfaces on top of it — and the
+     * ruling splits the family by noun: the customer **record** is this module's,
+     * `CustomerAddress` is `customers`', which is why `CUSTOMER_ADDRESS_NOT_FOUND`
+     * went there in MR 3 and these four come here.
+     *
+     * **Two of the four are codes `customers` raises and this module owns**, and
+     * that is the shape a reviewer will stop on. `CUSTOMER_NOT_FOUND` is raised
+     * six times, four of them in `customers`
+     * (`routes.self.ts`, `customer-deletion-service.ts`,
+     * `customer-moderation-service.ts`, `customer-org-assignment-service.ts`) and
+     * two here; `CUSTOMER_ALREADY_DELETED` is raised once in each. In every one of
+     * those `customers` sites the module is resolving or re-checking a
+     * `CustomerAccount` before doing its own work — it is the caller, and the row
+     * whose absence or deleted state it is reporting is this module's. D-95.2
+     * already ruled that shape for `INVOICE_NOT_READY`: the owner of a noun is not
+     * required to be the module that throws about it, and D-186 §1 accepts this
+     * consequence in terms.
+     *
+     * `CUSTOMER_NOT_DELETED` and `CUSTOMER_RESTORE_WINDOW_ELAPSED` are the same
+     * noun read the other way round, and both are raised only here, from
+     * `customer-account-lifecycle-ports.ts` — the soft-delete window is a property
+     * of the account row and of nothing on top of it.
+     *
+     * **`ACCOUNT_BLOCKED`** names the account itself: `customer-auth-service.ts`
+     * refuses a sign-in for a `CustomerAccount` whose status is blocked, which is
+     * this module's own column and its own gate.
+     *
+     * **`CANNOT_DEMOTE_LAST_ADMIN` and `CANNOT_REMOVE_LAST_ADMIN`** read like
+     * `organizations` and are not. The invariant they protect is counted over
+     * `CustomerAccount.role` inside one organization, in this module's
+     * `role-service.ts`, which is the only thing in the tree that raises either;
+     * `organizations` owns the organization, this module owns its membership.
+     *
+     * **The two of them arrive with a sentence, and it is a new one.** Both
+     * carried a placeholder in `_i18n`'s bundle — `"Cannot Demote Last Admin."` /
+     * `"Błąd: cannot demote last admin."` — which D-186 §2 deletes rather than
+     * moves, because a placeholder in a module's own bundle reads as that module's
+     * answer and every instrument then counts the code as translated.
+     * `d129-sweep.md` §5.4 keeps writing the prose available and calls it the
+     * better outcome; here the reader is an organization administrator managing
+     * their own company's users and the refusal is one sentence to explain, so it
+     * is written. The other five had no sentence in either language before the
+     * move and have none after: they were entries in
+     * `check-error-translations.ts`'s `UNTRANSLATED_ERROR_CODES` under `_i18n` and
+     * are entries under `customer_accounts`, which changes who owes the sentence
+     * and not whether one is owed.
+     *
+     * **No `tokens`, derived from the raise sites rather than from the bundle**
+     * (runbook §5). All eleven raise sites were read by balancing the parentheses
+     * of the call itself rather than by a line-wise grep, and not one passes a
+     * `details` object at all — so `refusalToken` has nothing to read and a
+     * sentence written at `errors.<CODE>` is the key the envelope actually looks
+     * up. That mattered enough to measure: where a code always carries a
+     * `details.code`, `localizeErrorEnvelope` resolves `errors.<CODE>.<token>`
+     * with no fallback to the base key, and a base sentence would be dead text
+     * that P1 nevertheless counts as translated.
+     */
+    errorCodes: [
+        { code: 'ACCOUNT_BLOCKED' },
+        { code: 'CANNOT_DEMOTE_LAST_ADMIN' },
+        { code: 'CANNOT_REMOVE_LAST_ADMIN' },
+        { code: 'CUSTOMER_ALREADY_DELETED' },
+        { code: 'CUSTOMER_NOT_DELETED' },
+        { code: 'CUSTOMER_NOT_FOUND' },
+        { code: 'CUSTOMER_RESTORE_WINDOW_ELAPSED' },
+    ],
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    // Feature 076 (D-79) — the customer-group admin surface came here with the
+    // entity, and its gate came with a correction. `price_lists` served these
+    // three routes under `catalog:write`, which asks a pricing question about a
+    // customer's segmentation; these two codes ask the right one. Granting them
+    // is a deliberate act on each admin role — nothing inherits from
+    // `catalog:write`.
+    permissions: [
+        { code: 'customer_groups:read', label: 'View customer groups' },
+        { code: 'customer_groups:write', label: 'Manage customer groups' },
+    ],
+    actions: [
+        {
+            id: 'open-customer-groups',
+            labelKey: 'actions.openCustomerGroups.label',
+            descriptionKey: 'actions.openCustomerGroups.description',
+            icon: 'Users',
+            targetRoute: '/customer-groups',
+            requiredPermission: 'customer_groups:read',
+            keywords: ['customer', 'group', 'segment', 'klient', 'grupa', 'segment'],
+            weight: 140,
+        },
+    ],
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,6EAA6E;IAC/E,OAAO,EAAE,OAAO;IAChB,8EAA8E;IAC9E,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,gBAAgB;IAChB,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,iEAAiE;IACjE,qDAAqD;IACrD,6EAA6E;IAC7E,2EAA2E;IAC3E,6DAA6D;IAC7D,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,yCAAyC;IACzC,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC;IACrD;;;;;;;OAOG;IACH,sBAAsB,EAAE;QACtB;YACE,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,kBAAkB;YACxB,UAAU,EACR,mFAAmF;gBACnF,sFAAsF;gBACtF,oBAAoB;YACtB,MAAM,EACJ,uFAAuF;gBACvF,+DAA+D;gBAC/D,8EAA8E;gBAC9E,oFAAoF;gBACpF,mFAAmF;gBACnF,oFAAoF;gBACpF,uFAAuF;gBACvF,qFAAqF;gBACrF,mFAAmF;gBACnF,4CAA4C;SAC/C;QACD;YACE,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,kBAAkB;YACxB,UAAU,EACR,4EAA4E;gBAC5E,wFAAwF;gBACxF,sCAAsC;YACxC,MAAM,EACJ,qFAAqF;gBACrF,oDAAoD;gBACpD,oFAAoF;gBACpF,8EAA8E;gBAC9E,mFAAmF;gBACnF,mFAAmF;gBACnF,mFAAmF;gBACnF,+EAA+E;gBAC/E,gFAAgF;gBAChF,qFAAqF;SACxF;KACF;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,2DAA2D;IAC3D;;;;;;;;;;;;;OAaG;IACH,IAAI,EAAE,KAAK;IACX,UAAU,EAAE;QACV,gBAAgB,EAAE,IAAI;QACtB,MAAM,EACJ,uFAAuF;YACvF,uCAAuC;KAC1C;IACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoEG;IACH,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,iBAAiB,EAAE;QAC3B,EAAE,IAAI,EAAE,0BAA0B,EAAE;QACpC,EAAE,IAAI,EAAE,0BAA0B,EAAE;QACpC,EAAE,IAAI,EAAE,0BAA0B,EAAE;QACpC,EAAE,IAAI,EAAE,sBAAsB,EAAE;QAChC,EAAE,IAAI,EAAE,oBAAoB,EAAE;QAC9B,EAAE,IAAI,EAAE,iCAAiC,EAAE;KAC5C;IACD,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,iEAAiE;IACjE,mBAAmB;IACnB,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,sBAAsB,EAAE;QAC/D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,wBAAwB,EAAE;KACnE;IACD,OAAO,EAAE;QACP;YACE,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,kCAAkC;YAC5C,cAAc,EAAE,wCAAwC;YACxD,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,kBAAkB;YAC/B,kBAAkB,EAAE,sBAAsB;YAC1C,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;YACxE,MAAM,EAAE,GAAG;SACZ;KACF;CACF,CAAC,CAAC"}

package/dist/migrations/20260425T055041_customer_accounts_password_reset_tokens.d.ts

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260425T055041CustomerAccountsPasswordResetTokens extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260425T055041_customer_accounts_password_reset_tokens.d.ts.map

package/dist/migrations/20260425T055041_customer_accounts_password_reset_tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260425T055041_customer_accounts_password_reset_tokens.d.ts","sourceRoot":"","sources":["../../src/migrations/20260425T055041_customer_accounts_password_reset_tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,2DAA4D,SAAQ,SAAS;IACzE,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260425T055041_customer_accounts_password_reset_tokens.js

@@ -0,0 +1,25 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260425T055041CustomerAccountsPasswordResetTokens extends Migration {
+    async up() {
+        this.addSql(`
+      create table "password_reset_tokens" (
+        "id" uuid not null,
+        "customer_account_id" uuid not null,
+        "token_hash" varchar(128) not null,
+        "expires_at" timestamptz not null,
+        "consumed_at" timestamptz null,
+        "created_at" timestamptz not null,
+        constraint "password_reset_tokens_pkey" primary key ("id"),
+        constraint "password_reset_tokens_token_hash_unique" unique ("token_hash"),
+        constraint "password_reset_tokens_customer_fk" foreign key ("customer_account_id")
+          references "customer_accounts" ("id") on delete cascade
+      );
+    `);
+        this.addSql('create index "password_reset_tokens_customer_account_id_index" on "password_reset_tokens" ("customer_account_id");');
+        this.addSql('create index "password_reset_tokens_expires_at_index" on "password_reset_tokens" ("expires_at");');
+    }
+    async down() {
+        this.addSql('drop table if exists "password_reset_tokens" cascade;');
+    }
+}
+//# sourceMappingURL=20260425T055041_customer_accounts_password_reset_tokens.js.map

package/dist/migrations/20260425T055041_customer_accounts_password_reset_tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260425T055041_customer_accounts_password_reset_tokens.js","sourceRoot":"","sources":["../../src/migrations/20260425T055041_customer_accounts_password_reset_tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,2DAA4D,SAAQ,SAAS;IAC/E,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;KAaX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,oHAAoH,CAAC,CAAC;QAClI,IAAI,CAAC,MAAM,CAAC,kGAAkG,CAAC,CAAC;IAClH,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/migrations/20260611T140351_customer_accounts_organization_optional.d.ts

@@ -0,0 +1,34 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Relaxes `customer_accounts.organization_id` from NOT NULL to nullable
+ * (feature 026 US2 — Customer accounts may exist without an Organization).
+ *
+ * **This migration's design is dead, and everything below it describes a
+ * platform that no longer exists.** Feature 051 replaced it — an individual is
+ * backed by a single-member personal Organization — and D-178 re-tightened the
+ * column in
+ * `20260825T141659_customer_accounts_organization_required`. The paragraphs
+ * below are kept because they say what this statement did on the day it ran;
+ * read them as history and not as current behaviour. In particular the `down()`
+ * here is not a working re-tightening recipe: it sets `organization_id` to the
+ * account's own id against a live `customer_accounts_organization_fk`, so it
+ * fails rather than corrupting. Do not copy it.
+ *
+ * Existing rows are unaffected (they keep their organization_id). The
+ * column's foreign-key constraint stays in place — when the column IS
+ * populated, it still references organizations(id) ON DELETE RESTRICT.
+ *
+ * Application-side implications (handled in code, not in this migration):
+ *  - The Customer's effective Organization (for prices, credit limit,
+ *    payment / delivery / warehouse allow-lists) becomes null → falls
+ *    back to platform defaults.
+ *  - Order placement and Quote Request submission still REQUIRE an
+ *    Organization — the route handlers surface a friendly 422 when the
+ *    caller has no Organization. Orders and RFQs remain NOT NULL at the
+ *    schema level.
+ */
+export declare class Migration20260611T140351CustomerAccountsOrganizationOptional extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260611T140351_customer_accounts_organization_optional.d.ts.map

package/dist/migrations/20260611T140351_customer_accounts_organization_optional.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140351_customer_accounts_organization_optional.d.ts","sourceRoot":"","sources":["../../src/migrations/20260611T140351_customer_accounts_organization_optional.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,4DAA6D,SAAQ,SAAS;IAC1E,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAInB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAUrC"}

package/dist/migrations/20260611T140351_customer_accounts_organization_optional.js

@@ -0,0 +1,43 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Relaxes `customer_accounts.organization_id` from NOT NULL to nullable
+ * (feature 026 US2 — Customer accounts may exist without an Organization).
+ *
+ * **This migration's design is dead, and everything below it describes a
+ * platform that no longer exists.** Feature 051 replaced it — an individual is
+ * backed by a single-member personal Organization — and D-178 re-tightened the
+ * column in
+ * `20260825T141659_customer_accounts_organization_required`. The paragraphs
+ * below are kept because they say what this statement did on the day it ran;
+ * read them as history and not as current behaviour. In particular the `down()`
+ * here is not a working re-tightening recipe: it sets `organization_id` to the
+ * account's own id against a live `customer_accounts_organization_fk`, so it
+ * fails rather than corrupting. Do not copy it.
+ *
+ * Existing rows are unaffected (they keep their organization_id). The
+ * column's foreign-key constraint stays in place — when the column IS
+ * populated, it still references organizations(id) ON DELETE RESTRICT.
+ *
+ * Application-side implications (handled in code, not in this migration):
+ *  - The Customer's effective Organization (for prices, credit limit,
+ *    payment / delivery / warehouse allow-lists) becomes null → falls
+ *    back to platform defaults.
+ *  - Order placement and Quote Request submission still REQUIRE an
+ *    Organization — the route handlers surface a friendly 422 when the
+ *    caller has no Organization. Orders and RFQs remain NOT NULL at the
+ *    schema level.
+ */
+export class Migration20260611T140351CustomerAccountsOrganizationOptional extends Migration {
+    async up() {
+        this.addSql(`alter table "customer_accounts" alter column "organization_id" drop not null;`);
+    }
+    async down() {
+        // Safe re-tightening: only re-add NOT NULL if every existing row has a
+        // value. (Production should NEVER hit this path while feature 026 is in
+        // use — but the down() must be valid even if it cannot succeed against
+        // partially-migrated data.)
+        this.addSql(`update "customer_accounts" set "organization_id" = "id" where "organization_id" is null;`);
+        this.addSql(`alter table "customer_accounts" alter column "organization_id" set not null;`);
+    }
+}
+//# sourceMappingURL=20260611T140351_customer_accounts_organization_optional.js.map

package/dist/migrations/20260611T140351_customer_accounts_organization_optional.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140351_customer_accounts_organization_optional.js","sourceRoot":"","sources":["../../src/migrations/20260611T140351_customer_accounts_organization_optional.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,OAAO,4DAA6D,SAAQ,SAAS;IAChF,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,+EAA+E,CAAC,CAAC;IAC/F,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,4BAA4B;QAC5B,IAAI,CAAC,MAAM,CACT,0FAA0F,CAC3F,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,8EAA8E,CAAC,CAAC;IAC9F,CAAC;CACF"}