@endora-commerce/mod-customers 0.100.0

package/dist/backend/serializers.js

@@ -0,0 +1,39 @@
+/** Maps a persisted CustomerAddress to its API contract shape. */
+export function serializeCustomerAddress(a) {
+    return {
+        id: a.id,
+        customerAccountId: a.customerAccountId,
+        kind: a.kind,
+        recipientName: a.recipientName,
+        street: a.street,
+        city: a.city,
+        postalCode: a.postalCode,
+        country: a.country,
+        phone: a.phone ?? null,
+        isDefault: a.isDefault,
+        createdAt: a.createdAt.toISOString(),
+        updatedAt: a.updatedAt.toISOString(),
+    };
+}
+/**
+ * Maps an org-shared address to the read-only reference shape.
+ *
+ * Feature 075 — the argument is `addresses`' published {@link AddressRecord},
+ * not its `Address` entity: this module only ever read the columns the record
+ * carries, and an entity crossing a boundary is what the port exists to stop.
+ */
+export function serializeOrganizationAddress(a) {
+    return {
+        id: a.id,
+        organizationId: a.organizationId,
+        kind: a.kind,
+        recipientName: a.recipientName,
+        street: a.street,
+        city: a.city,
+        postalCode: a.postalCode,
+        country: a.country,
+        phone: a.phone ?? null,
+        isDefault: a.isDefault,
+    };
+}
+//# sourceMappingURL=serializers.js.map

package/dist/backend/serializers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializers.js","sourceRoot":"","sources":["../../src/backend/serializers.ts"],"names":[],"mappings":"AAOA,kEAAkE;AAClE,MAAM,UAAU,wBAAwB,CAAC,CAAkB;IACzD,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,CAAgB;IAC3D,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC"}

package/dist/backend/services/customer-address-read-port.d.ts

@@ -0,0 +1,29 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { CustomerAddressReadPort, CustomerAddressRecord } from '@endora-commerce/contracts';
+import { CustomerAddress } from '../entities/customer-address.entity.js';
+/**
+ * The customer-address read model `customers` publishes (feature 075, Phase P).
+ *
+ * One consumer: `quick_order` resolves a buyer's saved personal address when
+ * it fills in their one-click defaults.
+ *
+ * The table is distinct from `addresses`' on purpose and the port keeps them
+ * distinct: this one hangs off a **customer account**, that one off an
+ * **organisation**. A B2C buyer keeps addresses that are theirs rather than
+ * their personal organisation's, and a merged shape would hide which of the
+ * two a caller is holding.
+ *
+ * `findById` is scoped by customer account for the reason its organisation
+ * twin gives: the caller already knows whose address it wants, and one query
+ * is what stops the ownership check being forgotten.
+ */
+export declare class CustomerAddressReadService implements CustomerAddressReadPort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    findById(customerAccountId: string, addressId: string, options?: {
+        liveOnly?: boolean;
+    }): Promise<CustomerAddressRecord | null>;
+    listForCustomer(customerAccountId: string, kind?: 'delivery' | 'billing'): Promise<CustomerAddressRecord[]>;
+}
+export declare function toCustomerAddressRecord(address: CustomerAddress): CustomerAddressRecord;
+//# sourceMappingURL=customer-address-read-port.d.ts.map

package/dist/backend/services/customer-address-read-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-address-read-port.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-address-read-port.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,0BAA2B,YAAW,uBAAuB;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,QAAQ,CACZ,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IASlC,eAAe,CACnB,iBAAiB,EAAE,MAAM,EACzB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAC5B,OAAO,CAAC,qBAAqB,EAAE,CAAC;CAQpC;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,eAAe,GAAG,qBAAqB,CAgBvF"}

package/dist/backend/services/customer-address-read-port.js

@@ -0,0 +1,53 @@
+import { CustomerAddress } from '../entities/customer-address.entity.js';
+/**
+ * The customer-address read model `customers` publishes (feature 075, Phase P).
+ *
+ * One consumer: `quick_order` resolves a buyer's saved personal address when
+ * it fills in their one-click defaults.
+ *
+ * The table is distinct from `addresses`' on purpose and the port keeps them
+ * distinct: this one hangs off a **customer account**, that one off an
+ * **organisation**. A B2C buyer keeps addresses that are theirs rather than
+ * their personal organisation's, and a merged shape would hide which of the
+ * two a caller is holding.
+ *
+ * `findById` is scoped by customer account for the reason its organisation
+ * twin gives: the caller already knows whose address it wants, and one query
+ * is what stops the ownership check being forgotten.
+ */
+export class CustomerAddressReadService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async findById(customerAccountId, addressId, options) {
+        const address = await this.emFactory().findOne(CustomerAddress, {
+            id: addressId,
+            customerAccountId,
+            ...(options?.liveOnly ? { deletedAt: null } : {}),
+        });
+        return address ? toCustomerAddressRecord(address) : null;
+    }
+    async listForCustomer(customerAccountId, kind) {
+        const addresses = await this.emFactory().find(CustomerAddress, { customerAccountId, deletedAt: null, ...(kind === undefined ? {} : { kind }) }, { orderBy: { isDefault: 'desc', createdAt: 'asc' } });
+        return addresses.map(toCustomerAddressRecord);
+    }
+}
+export function toCustomerAddressRecord(address) {
+    return {
+        id: address.id,
+        customerAccountId: address.customerAccountId,
+        kind: address.kind,
+        recipientName: address.recipientName,
+        street: address.street,
+        city: address.city,
+        postalCode: address.postalCode,
+        country: address.country,
+        phone: address.phone ?? null,
+        isDefault: address.isDefault,
+        createdAt: address.createdAt,
+        updatedAt: address.updatedAt,
+        deletedAt: address.deletedAt ?? null,
+    };
+}
+//# sourceMappingURL=customer-address-read-port.js.map

package/dist/backend/services/customer-address-read-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-address-read-port.js","sourceRoot":"","sources":["../../../src/backend/services/customer-address-read-port.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,QAAQ,CACZ,iBAAyB,EACzB,SAAiB,EACjB,OAAgC;QAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC9D,EAAE,EAAE,SAAS;YACb,iBAAiB;YACjB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,iBAAyB,EACzB,IAA6B;QAE7B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAC3C,eAAe,EACf,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAC/E,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CACrD,CAAC;QACF,OAAO,SAAS,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAChD,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAwB;IAC9D,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC"}

package/dist/backend/services/customer-address-service.d.ts

@@ -0,0 +1,94 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type AddressReadPort, type AddressRecord, type CustomerAccountReadPort } from '@endora-commerce/contracts';
+import { CustomerAddress } from '../entities/customer-address.entity.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * CustomerAddressService — the personal address book (feature 040, US2).
+ *
+ * Clones the org `AddressService` default-demotion pattern (transactional +
+ * partial unique index) but keyed by `customerAccountId`. For org-bound
+ * customers the read endpoints also surface the Organization's shared
+ * addresses (read-only) so they can be selected (FR-038).
+ */
+export interface CustomerAddressInputView {
+    kind: 'delivery' | 'billing';
+    recipientName: string;
+    street: string;
+    city: string;
+    postalCode: string;
+    country: string;
+    phone?: string | undefined;
+    isDefault?: boolean | undefined;
+}
+/** Mutable fields on update — `kind` is immutable once created. */
+export interface CustomerAddressPatch {
+    recipientName?: string | undefined;
+    street?: string | undefined;
+    city?: string | undefined;
+    postalCode?: string | undefined;
+    country?: string | undefined;
+    phone?: string | undefined;
+    isDefault?: boolean | undefined;
+}
+export declare class CustomerAddressService {
+    #private;
+    private readonly emFactory;
+    /**
+     * Feature 075 — `addresses`' published read port, where this service used
+     * to run `em.find(Address, …)` over that module's table. The org-shared
+     * list is the only thing it ever asked for, and the port already scopes
+     * every read by organisation.
+     */
+    private readonly organizationAddresses;
+    /**
+     * `customer_accounts`' published read model — the tenant boundary of every
+     * method on this service, and not a convenience.
+     *
+     * `CustomerAddress` is `@CustomerScoped`, and `customerFilterCond`
+     * contributes **no predicate at all** under `allowed-set`, the mode an
+     * assignment-scoped administrator resolves to. This table carries no
+     * organization column of its own, so nothing here can express the
+     * restriction — but its owner `CustomerAccount` is `@OrgScoped`, and this
+     * port reads it through a filtered EntityManager. Asking it whether the
+     * account exists *is* asking whether the caller may reach that customer.
+     *
+     * For the buyer's own surface it is a no-op: their own account is in their
+     * own scope. For a platform administrator it is a no-op too.
+     */
+    private readonly customerAccounts;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, 
+    /**
+     * Feature 075 — `addresses`' published read port, where this service used
+     * to run `em.find(Address, …)` over that module's table. The org-shared
+     * list is the only thing it ever asked for, and the port already scopes
+     * every read by organisation.
+     */
+    organizationAddresses: AddressReadPort, 
+    /**
+     * `customer_accounts`' published read model — the tenant boundary of every
+     * method on this service, and not a convenience.
+     *
+     * `CustomerAddress` is `@CustomerScoped`, and `customerFilterCond`
+     * contributes **no predicate at all** under `allowed-set`, the mode an
+     * assignment-scoped administrator resolves to. This table carries no
+     * organization column of its own, so nothing here can express the
+     * restriction — but its owner `CustomerAccount` is `@OrgScoped`, and this
+     * port reads it through a filtered EntityManager. Asking it whether the
+     * account exists *is* asking whether the caller may reach that customer.
+     *
+     * For the buyer's own surface it is a no-op: their own account is in their
+     * own scope. For a platform administrator it is a no-op too.
+     */
+    customerAccounts: CustomerAccountReadPort, auditLog?: AuditPort | undefined);
+    listPersonal(customerAccountId: string, kind?: 'delivery' | 'billing'): Promise<CustomerAddress[]>;
+    /** Org-shared addresses, read-only, for org-bound customers (FR-038). */
+    listOrganizationAddresses(organizationId: string, kind?: 'delivery' | 'billing'): Promise<AddressRecord[]>;
+    create(customerAccountId: string, input: CustomerAddressInputView): Promise<CustomerAddress>;
+    update(customerAccountId: string, addressId: string, patch: CustomerAddressPatch): Promise<CustomerAddress>;
+    /** Marks the address the default for its kind (demoting the previous one). */
+    setDefault(customerAccountId: string, addressId: string): Promise<CustomerAddress>;
+    delete(customerAccountId: string, addressId: string): Promise<void>;
+    private findOwned;
+}
+//# sourceMappingURL=customer-address-service.d.ts.map

package/dist/backend/services/customer-address-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-address-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-address-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,qBAAa,sBAAsB;;IAE/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAxBT,SAAS,EAAE,MAAM,aAAa;IAC/C;;;;;OAKG;IACc,qBAAqB,EAAE,eAAe;IACvD;;;;;;;;;;;;;;OAcG;IACc,gBAAgB,EAAE,uBAAuB,EACzC,QAAQ,CAAC,EAAE,SAAS,YAAA;IAmDjC,YAAY,CAChB,iBAAiB,EAAE,MAAM,EACzB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAC5B,OAAO,CAAC,eAAe,EAAE,CAAC;IAY7B,yEAAyE;IACnE,yBAAyB,CAC7B,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAC5B,OAAO,CAAC,aAAa,EAAE,CAAC;IAIrB,MAAM,CACV,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,eAAe,CAAC;IA+BrB,MAAM,CACV,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,eAAe,CAAC;IA2B3B,8EAA8E;IACxE,UAAU,CACd,iBAAiB,EAAE,MAAM,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC;IAIrB,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAc3D,SAAS;CAqBxB"}

package/dist/backend/services/customer-address-service.js

@@ -0,0 +1,176 @@
+import { ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { withSystemScope } from '@endora-commerce/platform/tenancy';
+import { CustomerAddress } from '../entities/customer-address.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+export class CustomerAddressService {
+    emFactory;
+    organizationAddresses;
+    customerAccounts;
+    auditLog;
+    constructor(emFactory, 
+    /**
+     * Feature 075 — `addresses`' published read port, where this service used
+     * to run `em.find(Address, …)` over that module's table. The org-shared
+     * list is the only thing it ever asked for, and the port already scopes
+     * every read by organisation.
+     */
+    organizationAddresses, 
+    /**
+     * `customer_accounts`' published read model — the tenant boundary of every
+     * method on this service, and not a convenience.
+     *
+     * `CustomerAddress` is `@CustomerScoped`, and `customerFilterCond`
+     * contributes **no predicate at all** under `allowed-set`, the mode an
+     * assignment-scoped administrator resolves to. This table carries no
+     * organization column of its own, so nothing here can express the
+     * restriction — but its owner `CustomerAccount` is `@OrgScoped`, and this
+     * port reads it through a filtered EntityManager. Asking it whether the
+     * account exists *is* asking whether the caller may reach that customer.
+     *
+     * For the buyer's own surface it is a no-op: their own account is in their
+     * own scope. For a platform administrator it is a no-op too.
+     */
+    customerAccounts, auditLog) {
+        this.emFactory = emFactory;
+        this.organizationAddresses = organizationAddresses;
+        this.customerAccounts = customerAccounts;
+        this.auditLog = auditLog;
+    }
+    /**
+     * Refuse a customer the caller's organizations do not reach.
+     *
+     * 404 rather than 403: an out-of-scope customer must read the same as one
+     * that is not there, which is what the account read already answers.
+     */
+    async #assertCustomerInScope(customerAccountId) {
+        const account = await this.customerAccounts.findById(customerAccountId);
+        if (!account) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Customer account not found.');
+        }
+    }
+    /**
+     * Run a `customer_addresses` statement for the account
+     * {@link CustomerAddressService.#assertCustomerInScope} has just authorised.
+     *
+     * Feature 087 gave `customerFilterCond` a real `allowed-set` arm, and this
+     * table is one of the fifteen that carry no `organization_id` yet — so the
+     * arm matches **nothing** here, which is the right floor for a guard that
+     * cannot determine the allowed set and the wrong answer for a caller who has
+     * already been shown to be inside it. Without this widening a sales
+     * representative's own customer's address book reads as empty, and the
+     * default-demotion `nativeUpdate` below silently demotes nothing, which
+     * leaves two defaults.
+     *
+     * The widening is the sanctioned crossing (feature 050, FR-005) and not a
+     * `catch`: every call is preceded, in the same method, by the
+     * `customer_accounts` read that decides whether this caller may reach this
+     * account at all — and `customer_accounts` is `@OrgScoped`, so that read is
+     * the organization check. It is also narrow by construction: every statement
+     * it covers names `customerAccountId` in its own `where`, so widening the
+     * filter widens the authority by exactly nothing. It stops being needed when
+     * feature 087 gives this table its own column.
+     */
+    #forAuthorisedCustomer(customerAccountId, fn) {
+        return withSystemScope(`customers: personal addresses of customer account ${customerAccountId}, authorised by its own @OrgScoped account read`, fn);
+    }
+    #audit(em, action, objectId, stateBefore, stateAfter) {
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, { action, objectType: 'customer_address', objectId, stateBefore, stateAfter });
+        }
+    }
+    async listPersonal(customerAccountId, kind) {
+        await this.#assertCustomerInScope(customerAccountId);
+        const em = this.emFactory();
+        const where = { customerAccountId, deletedAt: null };
+        if (kind)
+            where.kind = kind;
+        return this.#forAuthorisedCustomer(customerAccountId, () => em.find(CustomerAddress, where, {
+            orderBy: { isDefault: 'desc', createdAt: 'asc' },
+        }));
+    }
+    /** Org-shared addresses, read-only, for org-bound customers (FR-038). */
+    async listOrganizationAddresses(organizationId, kind) {
+        return this.organizationAddresses.listForOrganization(organizationId, kind);
+    }
+    async create(customerAccountId, input) {
+        await this.#assertCustomerInScope(customerAccountId);
+        const em = this.emFactory();
+        return em.transactional(async (txEm) => {
+            if (input.isDefault) {
+                await this.#forAuthorisedCustomer(customerAccountId, () => txEm.nativeUpdate(CustomerAddress, { customerAccountId, kind: input.kind, isDefault: true, deletedAt: null }, { isDefault: false }));
+            }
+            const address = txEm.create(CustomerAddress, {
+                customerAccountId,
+                kind: input.kind,
+                recipientName: input.recipientName,
+                street: input.street,
+                city: input.city,
+                postalCode: input.postalCode,
+                country: input.country,
+                phone: input.phone ?? null,
+                isDefault: input.isDefault ?? false,
+            });
+            txEm.persist(address);
+            this.#audit(txEm, 'customer_address.create', address.id, null, { customerAccountId, kind: address.kind });
+            await txEm.flush();
+            return address;
+        });
+    }
+    async update(customerAccountId, addressId, patch) {
+        await this.#assertCustomerInScope(customerAccountId);
+        const em = this.emFactory();
+        return em.transactional(async (txEm) => {
+            const address = await this.findOwned(txEm, customerAccountId, addressId);
+            if (patch.isDefault === true && !address.isDefault) {
+                await this.#forAuthorisedCustomer(customerAccountId, () => txEm.nativeUpdate(CustomerAddress, { customerAccountId, kind: address.kind, isDefault: true, deletedAt: null }, { isDefault: false }));
+            }
+            if (patch.recipientName !== undefined)
+                address.recipientName = patch.recipientName;
+            if (patch.street !== undefined)
+                address.street = patch.street;
+            if (patch.city !== undefined)
+                address.city = patch.city;
+            if (patch.postalCode !== undefined)
+                address.postalCode = patch.postalCode;
+            if (patch.country !== undefined)
+                address.country = patch.country;
+            if (patch.phone !== undefined)
+                address.phone = patch.phone ?? null;
+            if (patch.isDefault !== undefined)
+                address.isDefault = patch.isDefault;
+            this.#audit(txEm, 'customer_address.update', address.id, null, { customerAccountId, kind: address.kind });
+            await txEm.persistAndFlush(address);
+            return address;
+        });
+    }
+    /** Marks the address the default for its kind (demoting the previous one). */
+    async setDefault(customerAccountId, addressId) {
+        return this.update(customerAccountId, addressId, { isDefault: true });
+    }
+    async delete(customerAccountId, addressId) {
+        await this.#assertCustomerInScope(customerAccountId);
+        const em = this.emFactory();
+        await em.transactional(async (txEm) => {
+            const address = await this.findOwned(txEm, customerAccountId, addressId);
+            address.deletedAt = new Date();
+            // Deleting a default leaves no default of that kind (FR-009 graceful
+            // degrade); the storefront prompts re-selection.
+            address.isDefault = false;
+            this.#audit(txEm, 'customer_address.delete', address.id, { customerAccountId, kind: address.kind }, null);
+            await txEm.persistAndFlush(address);
+        });
+    }
+    async findOwned(em, customerAccountId, addressId) {
+        const address = await this.#forAuthorisedCustomer(customerAccountId, () => em.findOne(CustomerAddress, {
+            id: addressId,
+            customerAccountId,
+            deletedAt: null,
+        }));
+        if (!address) {
+            throw new HttpError(404, ERROR_CODES.CUSTOMER_ADDRESS_NOT_FOUND, 'Address not found.');
+        }
+        return address;
+    }
+}
+//# sourceMappingURL=customer-address-service.js.map

package/dist/backend/services/customer-address-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-address-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-address-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,GAIZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAiC5E,MAAM,OAAO,sBAAsB;IAEd;IAOA;IAgBA;IACA;IAzBnB,YACmB,SAA8B;IAC/C;;;;;OAKG;IACc,qBAAsC;IACvD;;;;;;;;;;;;;;OAcG;IACc,gBAAyC,EACzC,QAAoB;QAxBpB,cAAS,GAAT,SAAS,CAAqB;QAO9B,0BAAqB,GAArB,qBAAqB,CAAiB;QAgBtC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAAC,iBAAyB;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,sBAAsB,CAAI,iBAAyB,EAAE,EAAoB;QACvE,OAAO,eAAe,CACpB,qDAAqD,iBAAiB,iDAAiD,EACvH,EAAE,CACH,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAiB,EAAE,MAAc,EAAE,QAAgB,EAAE,WAA2C,EAAE,UAA0C;QACjJ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,iBAAyB,EACzB,IAA6B;QAE7B,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAA4B,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC9E,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACzD,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE;YAC9B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;SACjD,CAAC,CACH,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,yBAAyB,CAC7B,cAAsB,EACtB,IAA6B;QAE7B,OAAO,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,MAAM,CACV,iBAAyB,EACzB,KAA+B;QAE/B,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACrC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxD,IAAI,CAAC,YAAY,CACf,eAAe,EACf,EAAE,iBAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EACzE,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CACF,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;gBAC3C,iBAAiB;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1G,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,iBAAyB,EACzB,SAAiB,EACjB,KAA2B;QAE3B,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;YACzE,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnD,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxD,IAAI,CAAC,YAAY,CACf,eAAe,EACf,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAC3E,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CACF,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;gBAAE,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;YACnF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YAC1E,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACjE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC;YACnE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1G,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,UAAU,CACd,iBAAyB,EACzB,SAAiB;QAEjB,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,iBAAyB,EAAE,SAAiB;QACvD,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;YACzE,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC/B,qEAAqE;YACrE,iDAAiD;YACjD,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1G,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,EAAiB,EACjB,iBAAyB,EACzB,SAAiB;QAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxE,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC1B,EAAE,EAAE,SAAS;YACb,iBAAiB;YACjB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,0BAA0B,EACtC,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/backend/services/customer-admin-query-service.d.ts

@@ -0,0 +1,57 @@
+import type { AdminCustomerDetail, AdminCustomerListItem, CustomerAccountAdminSearchPort, CustomerAccountReadPort, CustomerGroupReadPort, OrderReadPort, OrganizationDetailsPort } from '@endora-commerce/contracts';
+import type { CustomerDefaultsService } from './customer-defaults-service.js';
+/**
+ * CustomerAdminQueryService — the admin customer list + detail (feature 040,
+ * US5). Applies the same visibility scope as moderation: a Platform
+ * Administrator sees everyone; a Salesperson sees standalone customers plus
+ * customers of the Organizations they are assigned to.
+ *
+ * **Feature 075, Phase C — the three foreign tables are three ports now.** The
+ * account page, the organisation names beside it and the customer-group names
+ * were all `em.find` calls on other modules' entities. The scope decision stays
+ * here, because it is this module's: the port takes the organisations the actor
+ * may see and does not decide who the actor is.
+ *
+ * **Feature 080, T048 (D-169) — and so is the fourth.** The detail header's
+ * sales-channel list was the last `orders` entity this module named:
+ * `em.find(Order, { placedByCustomerAccountId }, { fields: ['salesChannelId'] })`.
+ * It is a plain read, so it took a read-port method
+ * (`OrderReadPort.salesChannelIdsForCustomer`) and not an
+ * `EntityManager`-taking apply port — handing a read a transaction handle
+ * re-opens a write seam to serve it. With that gone this service holds no
+ * `EntityManager` at all: it owns no table, and every question it answers is
+ * somebody's published read.
+ */
+export interface AdminCustomerListScope {
+    isPlatformAdmin: boolean;
+    allowedOrganizationIds: string[];
+}
+export interface AdminCustomerListQuery {
+    q?: string | undefined;
+    status?: 'active' | 'blocked' | 'deleted' | undefined;
+    organizationId?: string | undefined;
+    customerGroupId?: string | undefined;
+    page: number;
+    pageSize: number;
+}
+export interface AdminCustomerListResult {
+    rows: AdminCustomerListItem[];
+    total: number;
+}
+export interface CustomerAdminQueryPorts {
+    accounts: CustomerAccountReadPort;
+    accountSearch: CustomerAccountAdminSearchPort;
+    organizations: OrganizationDetailsPort;
+    customerGroups: CustomerGroupReadPort;
+    orders: OrderReadPort;
+}
+export declare class CustomerAdminQueryService {
+    private readonly defaults;
+    private readonly ports;
+    constructor(defaults: CustomerDefaultsService, ports: CustomerAdminQueryPorts);
+    list(query: AdminCustomerListQuery, scope: AdminCustomerListScope): Promise<AdminCustomerListResult>;
+    getDetail(id: string): Promise<AdminCustomerDetail | null>;
+    private resolveNames;
+    private toListItem;
+}
+//# sourceMappingURL=customer-admin-query-service.d.ts.map

package/dist/backend/services/customer-admin-query-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-admin-query-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-admin-query-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,EAC9B,uBAAuB,EAEvB,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB,sBAAsB,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACtD,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,qBAAqB,EAAE,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,aAAa,EAAE,8BAA8B,CAAC;IAC9C,aAAa,EAAE,uBAAuB,CAAC;IACvC,cAAc,EAAE,qBAAqB,CAAC;IACtC,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,QAAQ,EAAE,uBAAuB,EACjC,KAAK,EAAE,uBAAuB;IAG3C,IAAI,CACR,KAAK,EAAE,sBAAsB,EAC7B,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC;IAoB7B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAuClD,YAAY;IAsB1B,OAAO,CAAC,UAAU;CAoBnB"}

package/dist/backend/services/customer-admin-query-service.js

@@ -0,0 +1,97 @@
+export class CustomerAdminQueryService {
+    defaults;
+    ports;
+    constructor(defaults, ports) {
+        this.defaults = defaults;
+        this.ports = ports;
+    }
+    async list(query, scope) {
+        const { rows, total } = await this.ports.accountSearch.search({
+            q: query.q,
+            status: query.status,
+            organizationId: query.organizationId,
+            customerGroupId: query.customerGroupId,
+            // `null` is the unscoped read. A salesperson gets their territory, and
+            // org-less customers are visible to every salesperson by construction.
+            allowedOrganizationIds: scope.isPlatformAdmin ? null : scope.allowedOrganizationIds,
+            page: query.page,
+            pageSize: query.pageSize,
+        });
+        const { orgNames, groupNames } = await this.resolveNames(rows);
+        return {
+            rows: rows.map((c) => this.toListItem(c, orgNames, groupNames)),
+            total,
+        };
+    }
+    async getDetail(id) {
+        const customer = await this.ports.accounts.findById(id);
+        if (!customer)
+            return null;
+        const { orgNames, groupNames } = await this.resolveNames([customer]);
+        const base = this.toListItem(customer, orgNames, groupNames);
+        // Already distinct, newest-ordered-on first — the owner does both, because
+        // the deduplication is what makes the ordering mean anything.
+        const salesChannelIds = await this.ports.orders.salesChannelIdsForCustomer(customer.id);
+        const defaults = await this.defaults.getForCustomer(customer.id);
+        return {
+            ...base,
+            block: customer.blockedAt
+                ? {
+                    blockedAt: customer.blockedAt.toISOString(),
+                    blockSource: customer.blockSource ?? 'staff',
+                    blockReason: customer.blockReason ?? null,
+                    blockedByAdminUserId: customer.blockedByAdminUserId ?? null,
+                    blockedByCustomerAccountId: customer.blockedByCustomerAccountId ?? null,
+                }
+                : null,
+            deletion: customer.deletedAt
+                ? {
+                    deletedAt: customer.deletedAt.toISOString(),
+                    anonymizedAt: customer.anonymizedAt ? customer.anonymizedAt.toISOString() : null,
+                    restorableUntil: null,
+                }
+                : null,
+            emailVerifiedAt: customer.emailVerifiedAt ? customer.emailVerifiedAt.toISOString() : null,
+            twoFactorEnabled: customer.twoFactorEnabled,
+            salesChannelIds,
+            defaults,
+            customFieldValues: customer.customFieldValues ?? {},
+        };
+    }
+    async resolveNames(rows) {
+        const orgIds = [...new Set(rows.map((r) => r.organizationId).filter((x) => !!x))];
+        const groupIds = [
+            ...new Set(rows.map((r) => r.customerGroupId).filter((x) => !!x)),
+        ];
+        const orgNames = new Map();
+        const groupNames = new Map();
+        if (orgIds.length) {
+            for (const o of await this.ports.organizations.findByIds(orgIds)) {
+                orgNames.set(o.id, o.name);
+            }
+        }
+        if (groupIds.length) {
+            for (const g of await this.ports.customerGroups.findByIds(groupIds)) {
+                groupNames.set(g.id, g.name);
+            }
+        }
+        return { orgNames, groupNames };
+    }
+    toListItem(c, orgNames, groupNames) {
+        return {
+            id: c.id,
+            email: c.email,
+            firstName: c.firstName,
+            lastName: c.lastName,
+            organizationId: c.organizationId ?? null,
+            organizationName: c.organizationId ? orgNames.get(c.organizationId) ?? null : null,
+            customerGroupId: c.customerGroupId ?? null,
+            customerGroupName: c.customerGroupId ? groupNames.get(c.customerGroupId) ?? null : null,
+            blocked: c.blockedAt != null,
+            deleted: c.deletedAt != null,
+            createdAt: c.createdAt.toISOString(),
+            lastLoginAt: c.lastLoginAt ? c.lastLoginAt.toISOString() : null,
+        };
+    }
+}
+//# sourceMappingURL=customer-admin-query-service.js.map

package/dist/backend/services/customer-admin-query-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-admin-query-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-admin-query-service.ts"],"names":[],"mappings":"AA6DA,MAAM,OAAO,yBAAyB;IAEjB;IACA;IAFnB,YACmB,QAAiC,EACjC,KAA8B;QAD9B,aAAQ,GAAR,QAAQ,CAAyB;QACjC,UAAK,GAAL,KAAK,CAAyB;IAC9C,CAAC;IAEJ,KAAK,CAAC,IAAI,CACR,KAA6B,EAC7B,KAA6B;QAE7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5D,CAAC,EAAE,KAAK,CAAC,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,uEAAuE;YACvE,uEAAuE;YACvE,sBAAsB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB;YACnF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/D,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC/D,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE7D,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAExF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEjE,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,QAAQ,CAAC,SAAS;gBACvB,CAAC,CAAC;oBACE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE;oBAC3C,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,OAAO;oBAC5C,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;oBACzC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,IAAI,IAAI;oBAC3D,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,IAAI;iBACxE;gBACH,CAAC,CAAC,IAAI;YACR,QAAQ,EAAE,QAAQ,CAAC,SAAS;gBAC1B,CAAC,CAAC;oBACE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE;oBAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;oBAChF,eAAe,EAAE,IAAI;iBACtB;gBACH,CAAC,CAAC,IAAI;YACR,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YACzF,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,eAAe;YACf,QAAQ;YACR,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,EAAE;SACpD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,IAAsC;QAEtC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG;YACf,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/E,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC;IAEO,UAAU,CAChB,CAAwB,EACxB,QAA6B,EAC7B,UAA+B;QAE/B,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;YACxC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAClF,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;YAC1C,iBAAiB,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YACvF,OAAO,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;YAC5B,OAAO,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;YAC5B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;YACpC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;SAChE,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/services/customer-authority-service.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CustomerAuthorityService — encodes WHICH staff member may act on a given
+ * Customer (block / unblock / delete / org-assign), per the clarified rule
+ * (spec FR-037, research §R2):
+ *
+ *   - A Platform Administrator may act on any customer. Whether the actor IS
+ *     a platform admin is decided by the caller (route layer) and passed in —
+ *     mirroring `SalesRepAssignmentService.canSeeOrganization`, which checks
+ *     the assignment table only.
+ *   - Only the Salesperson responsible for that
+ *     customer's Organization may act — "responsible" = assigned via
+ *     `OrganizationSalesRepAssignment`, including the unassigned-org fallback
+ *     (an org with zero assigned reps is visible to every Salesperson).
+ *
+ * **D-178 removed a third rule** — *"for a standalone (org-less) customer, any
+ * Salesperson may act"* — because there is no such customer:
+ * `customer_accounts.organization_id` is `NOT NULL` and an individual is backed
+ * by a personal organisation. The outcome is unchanged rather than merely
+ * unreachable: `SalesRepAssignmentService` refuses to assign a rep to a personal
+ * organisation, so such an organisation always has zero assigned reps and the
+ * unassigned-org fallback answers `true` for every Salesperson — which is what
+ * the deleted rule said, arrived at through the assignment table instead of
+ * through the absence of a tenant.
+ *
+ * The route layer is responsible for the coarse permission gate
+ * (`requireAdmin('customers:manage')`) before this finer check runs.
+ */
+export interface SalesRepVisibility {
+    canSeeOrganization(adminUserId: string, organizationId: string): Promise<boolean>;
+}
+export interface CustomerAuthorityInput {
+    /** True when the acting admin is a Platform Administrator (caller-decided). */
+    isPlatformAdmin: boolean;
+    adminUserId: string;
+    /** The target customer's Organization. Never null since D-178. */
+    customerOrganizationId: string;
+}
+export declare class CustomerAuthorityService {
+    private readonly salesReps;
+    constructor(salesReps: SalesRepVisibility);
+    /**
+     * True when the acting staff member is authorized to manage the customer.
+     */
+    canManageCustomer(input: CustomerAuthorityInput): Promise<boolean>;
+}
+//# sourceMappingURL=customer-authority-service.d.ts.map

package/dist/backend/services/customer-authority-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-authority-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-authority-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,kBAAkB;IAE1D;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC;CAOzE"}