@endora-commerce/mod-customer-accounts 0.100.0

package/dist/migrations/20260825T141659_customer_accounts_organization_required.js

@@ -0,0 +1,133 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * D-178 — `customer_accounts.organization_id` becomes `NOT NULL`.
+ *
+ * The column was relaxed by `20260611T140351_customer_accounts_organization_optional`
+ * for feature 026 US2 ("Customer accounts may exist without an Organization"), a
+ * design feature 051 replaced and D-178 confirms is dead: every transacting
+ * customer is backed by an Organization, an individual by a single-member
+ * **personal** one, and there is no "no-organization" scoping path
+ * (Constitution XI).
+ *
+ * **The constraint is the only refusal available.** MikroORM applies its tenant
+ * filter to `SELECT` / `UPDATE` / `DELETE` and not to `INSERT`, so no guard can
+ * stop a tenant-less account being written; the column can.
+ *
+ * ## Provision, then count, then refuse — never delete
+ *
+ * These rows are customer logins: a person's credentials, the owner of their
+ * order history and the parent of their address book. A migration that deleted
+ * one to satisfy a constraint would be deleting a customer, so this one
+ * provisions instead and raises on whatever it could not provision.
+ *
+ * Feature 051's backfill
+ * (`organizations/20260717T151403_organizations_personal_organizations`) ran the
+ * same provisioning once. It closed the population as of the moment it ran and
+ * closed no write path, so three producers went on filling it: standalone
+ * registration's two-flush window, federated sign-in (which provisioned no
+ * organisation at all), and the admin "un-assign" button. All three are closed
+ * in the merge request that carries this migration — without that, the
+ * constraint would convert three silent defects into three runtime failures.
+ *
+ * Two deliberate differences from that backfill:
+ *
+ *  - **Soft-deleted accounts are included.** 051 skipped them with its own
+ *    `and ca."deleted_at" is null`. A soft-deleted row still has to satisfy the
+ *    constraint, and `customer_account.restored` would otherwise resurrect an
+ *    account the platform cannot scope.
+ *  - **The insert skips an account whose personal organisation already exists**,
+ *    and a second statement links it. `tax_id` is derived from the account id
+ *    and is globally unique, so an account that was provisioned once and then
+ *    un-assigned would otherwise collide — the migration would abort on a
+ *    constraint violation rather than on the sentence it wants to say.
+ *
+ * The provisioning mirrors `PersonalOrganizationService.provisionFor`: name from
+ * the trimmed "first last" or else the e-mail local part, `tax_id` the account
+ * UUID with the dashes stripped (32 hex characters — an individual has no
+ * company tax id), `vat_status = 'vat_exempt'`, `status = 'active'`,
+ * `is_personal = true`, and the placeholder registered address the column's
+ * `not null` demands.
+ *
+ * `organizations` is a hard `dependencies` entry of this module's manifest, so
+ * that module's tables exist by the time this runs.
+ */
+export class Migration20260825T141659CustomerAccountsOrganizationRequired extends Migration {
+    async up() {
+        // 1. Provision a personal organisation for every account that has none and
+        //    whose derived one does not already exist.
+        this.addSql(`
+      insert into "organizations" (
+        "id", "name", "tax_id", "status", "vat_status", "is_personal",
+        "registered_address", "created_at", "updated_at"
+      )
+      select
+        gen_random_uuid(),
+        coalesce(
+          nullif(trim(coalesce(ca."first_name", '') || ' ' || coalesce(ca."last_name", '')), ''),
+          split_part(ca."email", '@', 1)
+        ),
+        replace(ca."id"::text, '-', ''),
+        'active',
+        'vat_exempt',
+        true,
+        '{"street":"-","city":"-","postalCode":"-","country":"PL"}'::json,
+        now(), now()
+      from "customer_accounts" ca
+      where ca."organization_id" is null
+        and not exists (
+          select 1 from "organizations" o
+          where o."tax_id" = replace(ca."id"::text, '-', '')
+        );
+    `);
+        // 2. Link every such account to it — both the ones just created and the ones
+        //    whose organisation survived an earlier provisioning (the state an
+        //    un-assigned account was left in before this ruling).
+        //
+        //    `is_personal` is the load-bearing word. Without it, an account whose
+        //    derived `tax_id` happened to be held by a **company** organisation
+        //    would be linked into that company's tenant — a stranger's — silently.
+        //    With it, such an account is served by neither statement and falls
+        //    through to the refusal below, which is what step 3's message describes.
+        this.addSql(`
+      update "customer_accounts" ca
+      set "organization_id" = o."id"
+      from "organizations" o
+      where ca."organization_id" is null
+        and o."is_personal" = true
+        and o."tax_id" = replace(ca."id"::text, '-', '');
+    `);
+        // 3. Count what is left and refuse. It can only be non-zero if an account's
+        //    provisioning failed — a `tax_id` collision with a company organisation
+        //    is the plausible one, since that column is globally unique. The merge
+        //    request that hits this decides what to do; deleting is never it.
+        this.addSql(`
+      do $$
+      declare
+        remaining bigint;
+        sample text;
+      begin
+        select count(*) into remaining
+          from "customer_accounts" where "organization_id" is null;
+        if remaining > 0 then
+          select string_agg(id::text, ', ') into sample from (
+            select "id" from "customer_accounts"
+            where "organization_id" is null order by "id" limit 20
+          ) s;
+          raise exception
+            'D-178: % customer_accounts row(s) still have organization_id IS NULL after provisioning. First ids: %. These rows are customer logins - do not delete them. The likely cause is a tax_id collision on organizations.tax_id, which is globally unique.',
+            remaining, sample;
+        end if;
+      end $$;
+    `);
+        // 4. The constraint.
+        this.addSql(`alter table "customer_accounts" alter column "organization_id" set not null;`);
+    }
+    async down() {
+        // Re-drop the constraint, and nothing else. The NULLs this migration filled
+        // in were a defect rather than data, so there is nothing to restore — and
+        // the personal organisations it created are left in place, because an
+        // account still points at each of them.
+        this.addSql(`alter table "customer_accounts" alter column "organization_id" drop not null;`);
+    }
+}
+//# sourceMappingURL=20260825T141659_customer_accounts_organization_required.js.map

package/dist/migrations/20260825T141659_customer_accounts_organization_required.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260825T141659_customer_accounts_organization_required.js","sourceRoot":"","sources":["../../src/migrations/20260825T141659_customer_accounts_organization_required.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,OAAO,4DAA6D,SAAQ,SAAS;IAChF,KAAK,CAAC,EAAE;QACf,2EAA2E;QAC3E,+CAA+C;QAC/C,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;KAuBX,CAAC,CAAC;QAEH,6EAA6E;QAC7E,uEAAuE;QACvE,0DAA0D;QAC1D,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,6EAA6E;QAC7E,IAAI,CAAC,MAAM,CAAC;;;;;;;KAOX,CAAC,CAAC;QAEH,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;KAkBX,CAAC,CAAC;QAEH,qBAAqB;QACrB,IAAI,CAAC,MAAM,CAAC,8EAA8E,CAAC,CAAC;IAC9F,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,wCAAwC;QACxC,IAAI,CAAC,MAAM,CAAC,+EAA+E,CAAC,CAAC;IAC/F,CAAC;CACF"}

package/dist/migrations/20260912T094701_customer_accounts_sales_channel_customer_accounts.d.ts

@@ -0,0 +1,27 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * The `sales_channel_customer_accounts` sales-channel bridge — the customers a channel is visible to.
+ *
+ * It was created by the platform's frozen `Migration20260430T170044CoreSalesChannelsPromote`
+ * until `specs/120-migration-closure-bridge-ownership/` Phase 2. Under D-226 a
+ * bridge between an always-present near side (`sales_channels`, a kernel table)
+ * and a switchable far side belongs to the far side, so this module creates it:
+ * an instance that does not install `customer_accounts` no longer has a migration corpus
+ * naming a table nothing builds.
+ *
+ * `if not exists`, because every database that has already applied the frozen
+ * migration has this table. The storage keys on the class name and holds no
+ * checksum, so nothing is re-offered there and this migration is the no-op it
+ * reads as; on a fresh database it is the creation.
+ *
+ * The statements are the frozen ones verbatim — same columns, same primary key,
+ * same two foreign keys, same index — so the two paths reach one schema. Its
+ * position needs nothing declared: `sales_channels` is the kernel's and
+ * `customer_accounts` is created inside the frozen prefix, which every
+ * above-watermark migration runs after.
+ */
+export declare class Migration20260912T094701CustomerAccountsSalesChannelCustomerAccounts extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260912T094701_customer_accounts_sales_channel_customer_accounts.d.ts.map

package/dist/migrations/20260912T094701_customer_accounts_sales_channel_customer_accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260912T094701_customer_accounts_sales_channel_customer_accounts.d.ts","sourceRoot":"","sources":["../../src/migrations/20260912T094701_customer_accounts_sales_channel_customer_accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,oEAAqE,SAAQ,SAAS;IAClF,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAGrC"}

package/dist/migrations/20260912T094701_customer_accounts_sales_channel_customer_accounts.js

@@ -0,0 +1,44 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * The `sales_channel_customer_accounts` sales-channel bridge — the customers a channel is visible to.
+ *
+ * It was created by the platform's frozen `Migration20260430T170044CoreSalesChannelsPromote`
+ * until `specs/120-migration-closure-bridge-ownership/` Phase 2. Under D-226 a
+ * bridge between an always-present near side (`sales_channels`, a kernel table)
+ * and a switchable far side belongs to the far side, so this module creates it:
+ * an instance that does not install `customer_accounts` no longer has a migration corpus
+ * naming a table nothing builds.
+ *
+ * `if not exists`, because every database that has already applied the frozen
+ * migration has this table. The storage keys on the class name and holds no
+ * checksum, so nothing is re-offered there and this migration is the no-op it
+ * reads as; on a fresh database it is the creation.
+ *
+ * The statements are the frozen ones verbatim — same columns, same primary key,
+ * same two foreign keys, same index — so the two paths reach one schema. Its
+ * position needs nothing declared: `sales_channels` is the kernel's and
+ * `customer_accounts` is created inside the frozen prefix, which every
+ * above-watermark migration runs after.
+ */
+export class Migration20260912T094701CustomerAccountsSalesChannelCustomerAccounts extends Migration {
+    async up() {
+        this.addSql(`
+      create table if not exists "sales_channel_customer_accounts" (
+        "sales_channel_id" uuid not null,
+        "customer_account_id" uuid not null,
+        constraint "sales_channel_customer_accounts_pkey"
+          primary key ("sales_channel_id", "customer_account_id"),
+        constraint "sales_channel_customer_accounts_channel_fk"
+          foreign key ("sales_channel_id") references "sales_channels" ("id") on delete cascade,
+        constraint "sales_channel_customer_accounts_customer_account_fk"
+          foreign key ("customer_account_id") references "customer_accounts" ("id") on delete cascade
+      );
+    `);
+        this.addSql('create index if not exists "sales_channel_customer_accounts_customer_account_id_index" ' +
+            'on "sales_channel_customer_accounts" ("customer_account_id");');
+    }
+    async down() {
+        this.addSql('drop table if exists "sales_channel_customer_accounts" cascade;');
+    }
+}
+//# sourceMappingURL=20260912T094701_customer_accounts_sales_channel_customer_accounts.js.map

package/dist/migrations/20260912T094701_customer_accounts_sales_channel_customer_accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260912T094701_customer_accounts_sales_channel_customer_accounts.js","sourceRoot":"","sources":["../../src/migrations/20260912T094701_customer_accounts_sales_channel_customer_accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,oEAAqE,SAAQ,SAAS;IACxF,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;KAWX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,yFAAyF;YACvF,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,iEAAiE,CAAC,CAAC;IACjF,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which orders **this module's own** migrations
+ * and nothing else (feature 081). Where the block sits relative to every other
+ * module's is decided by the manifest `dependencies` graph.
+ *
+ * The **named** exports stay, and the asymmetry with `./backend` — which
+ * publishes an array and no entity class by name (D-168) — is deliberate.
+ * `db/migrations-registry.generated.ts` imports each class by name from this
+ * specifier, and a migration class name is contract in a way an entity class
+ * name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom
+ * is a query against a table nobody created.
+ */
+import { Migration20260425T055041CustomerAccountsPasswordResetTokens } from './20260425T055041_customer_accounts_password_reset_tokens.js';
+import { Migration20260611T140351CustomerAccountsOrganizationOptional } from './20260611T140351_customer_accounts_organization_optional.js';
+import { Migration20260611T140403CustomerAccountsLifecycle } from './20260611T140403_customer_accounts_lifecycle.js';
+import { Migration20260718T200341CustomerAccountsCustomerAccountCustomFieldValues } from './20260718T200341_customer_accounts_customer_account_custom_field_values.js';
+import { Migration20260720T044255CustomerAccountsCustomerSubtreeRollup } from './20260720T044255_customer_accounts_customer_subtree_rollup.js';
+import { Migration20260819T074816CustomerAccountsPasswordSetAt } from './20260819T074816_customer_accounts_password_set_at.js';
+import { Migration20260819T142837CustomerAccountsFoldEmailCase } from './20260819T142837_customer_accounts_fold_email_case.js';
+import { Migration20260825T124759CustomerAccountsDropLegacyTwoFactorSecret } from './20260825T124759_customer_accounts_drop_legacy_two_factor_secret.js';
+import { Migration20260825T141659CustomerAccountsOrganizationRequired } from './20260825T141659_customer_accounts_organization_required.js';
+import { Migration20260912T094701CustomerAccountsSalesChannelCustomerAccounts } from './20260912T094701_customer_accounts_sales_channel_customer_accounts.js';
+export declare const migrations: (typeof Migration20260425T055041CustomerAccountsPasswordResetTokens)[];
+export { Migration20260425T055041CustomerAccountsPasswordResetTokens, Migration20260611T140351CustomerAccountsOrganizationOptional, Migration20260611T140403CustomerAccountsLifecycle, Migration20260718T200341CustomerAccountsCustomerAccountCustomFieldValues, Migration20260720T044255CustomerAccountsCustomerSubtreeRollup, Migration20260819T074816CustomerAccountsPasswordSetAt, Migration20260819T142837CustomerAccountsFoldEmailCase, Migration20260825T124759CustomerAccountsDropLegacyTwoFactorSecret, Migration20260825T141659CustomerAccountsOrganizationRequired, Migration20260912T094701CustomerAccountsSalesChannelCustomerAccounts, };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,2DAA2D,EAAE,MAAM,8DAA8D,CAAC;AAC3I,OAAO,EAAE,4DAA4D,EAAE,MAAM,8DAA8D,CAAC;AAC5I,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AACrH,OAAO,EAAE,wEAAwE,EAAE,MAAM,6EAA6E,CAAC;AACvK,OAAO,EAAE,6DAA6D,EAAE,MAAM,gEAAgE,CAAC;AAC/I,OAAO,EAAE,qDAAqD,EAAE,MAAM,wDAAwD,CAAC;AAC/H,OAAO,EAAE,qDAAqD,EAAE,MAAM,wDAAwD,CAAC;AAC/H,OAAO,EAAE,iEAAiE,EAAE,MAAM,sEAAsE,CAAC;AACzJ,OAAO,EAAE,4DAA4D,EAAE,MAAM,8DAA8D,CAAC;AAC5I,OAAO,EAAE,oEAAoE,EAAE,MAAM,wEAAwE,CAAC;AAE9J,eAAO,MAAM,UAAU,wEAWtB,CAAC;AAEF,OAAO,EACL,2DAA2D,EAC3D,4DAA4D,EAC5D,iDAAiD,EACjD,wEAAwE,EACxE,6DAA6D,EAC7D,qDAAqD,EACrD,qDAAqD,EACrD,iEAAiE,EACjE,4DAA4D,EAC5D,oEAAoE,GACrE,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,47 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which orders **this module's own** migrations
+ * and nothing else (feature 081). Where the block sits relative to every other
+ * module's is decided by the manifest `dependencies` graph.
+ *
+ * The **named** exports stay, and the asymmetry with `./backend` — which
+ * publishes an array and no entity class by name (D-168) — is deliberate.
+ * `db/migrations-registry.generated.ts` imports each class by name from this
+ * specifier, and a migration class name is contract in a way an entity class
+ * name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom
+ * is a query against a table nobody created.
+ */
+import { Migration20260425T055041CustomerAccountsPasswordResetTokens } from './20260425T055041_customer_accounts_password_reset_tokens.js';
+import { Migration20260611T140351CustomerAccountsOrganizationOptional } from './20260611T140351_customer_accounts_organization_optional.js';
+import { Migration20260611T140403CustomerAccountsLifecycle } from './20260611T140403_customer_accounts_lifecycle.js';
+import { Migration20260718T200341CustomerAccountsCustomerAccountCustomFieldValues } from './20260718T200341_customer_accounts_customer_account_custom_field_values.js';
+import { Migration20260720T044255CustomerAccountsCustomerSubtreeRollup } from './20260720T044255_customer_accounts_customer_subtree_rollup.js';
+import { Migration20260819T074816CustomerAccountsPasswordSetAt } from './20260819T074816_customer_accounts_password_set_at.js';
+import { Migration20260819T142837CustomerAccountsFoldEmailCase } from './20260819T142837_customer_accounts_fold_email_case.js';
+import { Migration20260825T124759CustomerAccountsDropLegacyTwoFactorSecret } from './20260825T124759_customer_accounts_drop_legacy_two_factor_secret.js';
+import { Migration20260825T141659CustomerAccountsOrganizationRequired } from './20260825T141659_customer_accounts_organization_required.js';
+import { Migration20260912T094701CustomerAccountsSalesChannelCustomerAccounts } from './20260912T094701_customer_accounts_sales_channel_customer_accounts.js';
+export const migrations = [
+    Migration20260425T055041CustomerAccountsPasswordResetTokens,
+    Migration20260611T140351CustomerAccountsOrganizationOptional,
+    Migration20260611T140403CustomerAccountsLifecycle,
+    Migration20260718T200341CustomerAccountsCustomerAccountCustomFieldValues,
+    Migration20260720T044255CustomerAccountsCustomerSubtreeRollup,
+    Migration20260819T074816CustomerAccountsPasswordSetAt,
+    Migration20260819T142837CustomerAccountsFoldEmailCase,
+    Migration20260825T124759CustomerAccountsDropLegacyTwoFactorSecret,
+    Migration20260825T141659CustomerAccountsOrganizationRequired,
+    Migration20260912T094701CustomerAccountsSalesChannelCustomerAccounts,
+];
+export { Migration20260425T055041CustomerAccountsPasswordResetTokens, Migration20260611T140351CustomerAccountsOrganizationOptional, Migration20260611T140403CustomerAccountsLifecycle, Migration20260718T200341CustomerAccountsCustomerAccountCustomFieldValues, Migration20260720T044255CustomerAccountsCustomerSubtreeRollup, Migration20260819T074816CustomerAccountsPasswordSetAt, Migration20260819T142837CustomerAccountsFoldEmailCase, Migration20260825T124759CustomerAccountsDropLegacyTwoFactorSecret, Migration20260825T141659CustomerAccountsOrganizationRequired, Migration20260912T094701CustomerAccountsSalesChannelCustomerAccounts, };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,2DAA2D,EAAE,MAAM,8DAA8D,CAAC;AAC3I,OAAO,EAAE,4DAA4D,EAAE,MAAM,8DAA8D,CAAC;AAC5I,OAAO,EAAE,iDAAiD,EAAE,MAAM,kDAAkD,CAAC;AACrH,OAAO,EAAE,wEAAwE,EAAE,MAAM,6EAA6E,CAAC;AACvK,OAAO,EAAE,6DAA6D,EAAE,MAAM,gEAAgE,CAAC;AAC/I,OAAO,EAAE,qDAAqD,EAAE,MAAM,wDAAwD,CAAC;AAC/H,OAAO,EAAE,qDAAqD,EAAE,MAAM,wDAAwD,CAAC;AAC/H,OAAO,EAAE,iEAAiE,EAAE,MAAM,sEAAsE,CAAC;AACzJ,OAAO,EAAE,4DAA4D,EAAE,MAAM,8DAA8D,CAAC;AAC5I,OAAO,EAAE,oEAAoE,EAAE,MAAM,wEAAwE,CAAC;AAE9J,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,2DAA2D;IAC3D,4DAA4D;IAC5D,iDAAiD;IACjD,wEAAwE;IACxE,6DAA6D;IAC7D,qDAAqD;IACrD,qDAAqD;IACrD,iEAAiE;IACjE,4DAA4D;IAC5D,oEAAoE;CACrE,CAAC;AAEF,OAAO,EACL,2DAA2D,EAC3D,4DAA4D,EAC5D,iDAAiD,EACjD,wEAAwE,EACxE,6DAA6D,EAC7D,qDAAqD,EACrD,qDAAqD,EACrD,iEAAiE,EACjE,4DAA4D,EAC5D,oEAAoE,GACrE,CAAC"}

package/docs/customer_accounts.md

@@ -0,0 +1,38 @@
+---
+title: customer_accounts
+description: Customer login, password reset, 2FA, role assignment
+---
+
+# `customer_accounts`
+
+Per-user state for Customers: login, password management, optional 2FA,
+role within their Organization. Backed by the shared `auth` session
+service; this module owns the customer-facing identity surface.
+
+## Public surface
+
+| Verb + Path | Purpose |
+| --- | --- |
+| `POST /api/v1/auth/login` | Email + password (+ TOTP step if 2FA enabled) |
+| `POST /api/v1/auth/logout` | Destroy session |
+| `POST /api/v1/me/password` | Change password (rejects wrong `currentPassword`) |
+| `POST /api/v1/auth/password-reset/request` | Begin reset flow |
+| `POST /api/v1/auth/password-reset/confirm` | Redeem reset token |
+
+## Entities
+
+`CustomerAccount` (email, passwordHash, role), `PasswordResetToken`. Role is
+enum `organization_admin | regular_user`.
+
+## Extension points
+
+- **Password policy** — `password-hasher.ts` wraps argon2id; tune cost
+  parameters there.
+- **Backup codes and second factors** — not this module's. Customer and admin
+  2FA is the `mfa` module's, over `mfa_enrolments`, served at
+  `/api/v1/account/mfa/*`; recovery codes are single-use rows there. The
+  superseded scaffolding this bullet used to point at
+  (`totp-enrolment-service.ts`) was deleted on 2026-08-25 — it could never
+  complete a single enrolment.
+- **Login throttling** — relies on Fastify `@fastify/rate-limit` at server
+  level; per-account lockout would be added here.

package/i18n/en.json

@@ -0,0 +1,30 @@
+{
+  "errors.CANNOT_DEMOTE_LAST_ADMIN": "This is the only administrator in the organization, and an organization always keeps at least one — demoting them would leave nobody able to manage members, addresses or approvals. Promote another member to administrator first, and then this role can be changed.",
+  "errors.CANNOT_REMOVE_LAST_ADMIN": "This is the only administrator in the organization, and an organization always keeps at least one — removing them would leave nobody able to manage members, addresses or approvals. Promote another member to administrator first, and then this one can be removed.",
+  "actions.openCustomerGroups.label": "Customer groups",
+  "actions.openCustomerGroups.description": "Manage the segmentation groups customers and organizations are assigned to",
+  "groups.page.title": "Customer groups",
+  "groups.page.description": "A customer group is a segment you assign to a customer or to an organization. Pricing rules, promotions and push audiences target these groups; a customer's own group wins over the one inherited from their organization.",
+  "groups.error.load": "Failed to load customer groups.",
+  "groups.error.save": "Failed to save the customer group.",
+  "groups.error.delete": "Failed to delete the customer group.",
+  "groups.loading": "Loading customer groups…",
+  "groups.empty": "No customer groups yet.",
+  "groups.column.code": "Code",
+  "groups.column.name": "Name",
+  "groups.column.description": "Description",
+  "groups.form.newTitle": "New customer group",
+  "groups.form.editTitle": "Edit “{code}”",
+  "groups.field.code": "Code",
+  "groups.field.code.help": "Lower-case identifier used by pricing rules and promotions. It cannot be changed after the group is created.",
+  "groups.field.name": "Name",
+  "groups.field.description": "Description",
+  "groups.action.edit": "Edit",
+  "groups.action.delete": "Delete",
+  "groups.action.save": "Save",
+  "groups.action.cancel": "Cancel",
+  "groups.action.delete.confirm": "Delete customer group “{code}”? Customers and organizations assigned to it keep their records and lose the assignment.",
+  "groups.message.saved": "Customer group “{code}” saved.",
+  "groups.message.deleted": "Customer group deleted.",
+  "nav.customerGroups.label": "Customer groups"
+}

package/i18n/pl.json

@@ -0,0 +1,30 @@
+{
+  "errors.CANNOT_DEMOTE_LAST_ADMIN": "To jedyny administrator w tej organizacji, a organizacja zawsze musi mieć co najmniej jednego — po odebraniu mu tej roli nikt nie mógłby zarządzać użytkownikami, adresami ani akceptacjami. Najpierw nadaj rolę administratora innemu użytkownikowi, a potem tę rolę będzie można zmienić.",
+  "errors.CANNOT_REMOVE_LAST_ADMIN": "To jedyny administrator w tej organizacji, a organizacja zawsze musi mieć co najmniej jednego — po jego usunięciu nikt nie mógłby zarządzać użytkownikami, adresami ani akceptacjami. Najpierw nadaj rolę administratora innemu użytkownikowi, a potem tego będzie można usunąć.",
+  "actions.openCustomerGroups.label": "Grupy klientów",
+  "actions.openCustomerGroups.description": "Zarządzaj grupami segmentacji przypisywanymi klientom i organizacjom",
+  "groups.page.title": "Grupy klientów",
+  "groups.page.description": "Grupa klientów to segment przypisywany klientowi lub organizacji. Reguły cenowe, promocje i odbiorcy powiadomień push celują w te grupy; grupa przypisana bezpośrednio klientowi ma pierwszeństwo przed grupą odziedziczoną z organizacji.",
+  "groups.error.load": "Nie udało się wczytać grup klientów.",
+  "groups.error.save": "Nie udało się zapisać grupy klientów.",
+  "groups.error.delete": "Nie udało się usunąć grupy klientów.",
+  "groups.loading": "Wczytywanie grup klientów…",
+  "groups.empty": "Nie ma jeszcze żadnych grup klientów.",
+  "groups.column.code": "Kod",
+  "groups.column.name": "Nazwa",
+  "groups.column.description": "Opis",
+  "groups.form.newTitle": "Nowa grupa klientów",
+  "groups.form.editTitle": "Edycja „{code}”",
+  "groups.field.code": "Kod",
+  "groups.field.code.help": "Identyfikator pisany małymi literami, używany przez reguły cenowe i promocje. Po utworzeniu grupy nie można go zmienić.",
+  "groups.field.name": "Nazwa",
+  "groups.field.description": "Opis",
+  "groups.action.edit": "Edytuj",
+  "groups.action.delete": "Usuń",
+  "groups.action.save": "Zapisz",
+  "groups.action.cancel": "Anuluj",
+  "groups.action.delete.confirm": "Usunąć grupę klientów „{code}”? Klienci i organizacje do niej przypisani zachowają swoje dane i utracą to przypisanie.",
+  "groups.message.saved": "Grupa klientów „{code}” została zapisana.",
+  "groups.message.deleted": "Grupa klientów została usunięta.",
+  "nav.customerGroups.label": "Grupy klientów"
+}

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "@endora-commerce/mod-customer-accounts",
+  "version": "0.100.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Customer (B2B) account records, including organization membership and role.",
+  "license": "MIT",
+  "endora": {
+    "type": "module",
+    "id": "customer_accounts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/modules/customer_accounts"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "default": "./dist/backend/index.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations/index.d.ts",
+      "default": "./dist/migrations/index.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "default": "./dist/admin/index.js"
+    },
+    "./tailwind.css": "./tailwind.css",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "i18n",
+    "docs",
+    "tailwind.css"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "peerDependencies": {
+    "@mikro-orm/core": "^6",
+    "@mikro-orm/migrations": "^6",
+    "@mikro-orm/postgresql": "^6",
+    "fastify": "^5",
+    "lucide-react": "^1",
+    "react": "^19",
+    "zod": "^4",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/mod-organizations": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "peerDependenciesMeta": {
+    "@endora-commerce/admin-kit": {
+      "optional": true
+    },
+    "lucide-react": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@mikro-orm/core": "^6.6.13",
+    "@mikro-orm/migrations": "^6.6.13",
+    "@mikro-orm/postgresql": "^6.6.13",
+    "@types/node": "^22.9.0",
+    "@types/react": "^19.2.14",
+    "fastify": "^5.12.5",
+    "lucide-react": "^1.11.0",
+    "react": "^19.2.5",
+    "typescript": "^5.9.3",
+    "zod": "^4.2.0",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/mod-organizations": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.ui.json",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.ui.json --noEmit",
+    "lint": "eslint src"
+  }
+}

package/tailwind.css

@@ -0,0 +1,14 @@
+/* @endora-commerce/mod-customer-accounts — AUTO-GENERATED by `pnpm --filter backend run manifests:generate`.
+ *
+ * The `@source` directives this package asks its host to scan
+ * (`specs/110-instance-repository/contracts/admin-stylesheet-composition.md` R1).
+ * They resolve relative to **this file**, so they hold wherever the package is
+ * installed — a workspace link here, `node_modules` in a client's instance.
+ *
+ * The `dist` line is what a published tarball ships and is what an instance
+ * scans; the `src` line is inert there and is what keeps `pnpm --filter admin
+ * run dev` reading source in this repository. Do not edit: run
+ * `pnpm --filter backend run manifests:generate`.
+ */
+@source "./dist/admin";
+@source "./src/admin";