@endora-commerce/mod-customers 0.100.0

package/dist/backend/services/customer-authority-service.js

@@ -0,0 +1,42 @@
+/**
+ * CustomerAuthorityService — encodes WHICH staff member may act on a given
+ * Customer (block / unblock / delete / org-assign), per the clarified rule
+ * (spec FR-037, research §R2):
+ *
+ *   - A Platform Administrator may act on any customer. Whether the actor IS
+ *     a platform admin is decided by the caller (route layer) and passed in —
+ *     mirroring `SalesRepAssignmentService.canSeeOrganization`, which checks
+ *     the assignment table only.
+ *   - Only the Salesperson responsible for that
+ *     customer's Organization may act — "responsible" = assigned via
+ *     `OrganizationSalesRepAssignment`, including the unassigned-org fallback
+ *     (an org with zero assigned reps is visible to every Salesperson).
+ *
+ * **D-178 removed a third rule** — *"for a standalone (org-less) customer, any
+ * Salesperson may act"* — because there is no such customer:
+ * `customer_accounts.organization_id` is `NOT NULL` and an individual is backed
+ * by a personal organisation. The outcome is unchanged rather than merely
+ * unreachable: `SalesRepAssignmentService` refuses to assign a rep to a personal
+ * organisation, so such an organisation always has zero assigned reps and the
+ * unassigned-org fallback answers `true` for every Salesperson — which is what
+ * the deleted rule said, arrived at through the assignment table instead of
+ * through the absence of a tenant.
+ *
+ * The route layer is responsible for the coarse permission gate
+ * (`requireAdmin('customers:manage')`) before this finer check runs.
+ */
+export class CustomerAuthorityService {
+    salesReps;
+    constructor(salesReps) {
+        this.salesReps = salesReps;
+    }
+    /**
+     * True when the acting staff member is authorized to manage the customer.
+     */
+    async canManageCustomer(input) {
+        if (input.isPlatformAdmin)
+            return true;
+        return this.salesReps.canSeeOrganization(input.adminUserId, input.customerOrganizationId);
+    }
+}
+//# sourceMappingURL=customer-authority-service.js.map

package/dist/backend/services/customer-authority-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-authority-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-authority-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAcH,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,SAA6B;QAA7B,cAAS,GAAT,SAAS,CAAoB;IAAG,CAAC;IAE9D;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAA6B;QACnD,IAAI,KAAK,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,CACtC,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,sBAAsB,CAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/services/customer-defaults-service.d.ts

@@ -0,0 +1,48 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { CustomerDefaults, DefaultPreferencePort, PreferenceAuditContext } from '@endora-commerce/contracts';
+import type { CustomerAddressService } from './customer-address-service.js';
+/**
+ * CustomerDefaultsService — the customer's checkout defaults (feature 040, US2).
+ *
+ * Split source of truth (research §R5, reconciled with the existing schema):
+ *   - default **payment / delivery method** → the quick_order
+ *     `QuickOrderDefaultPreference` (scope `customer`), which checkout already
+ *     consumes. Reached through `defaultPreferencePort` (issue #216). This
+ *     module used to build a **second instance** of `quick_order`'s
+ *     `DefaultPreferenceService` out of an import of that module's directory,
+ *     which is what kept the port — published for exactly this consumer —
+ *     unreached, and what blocked converting that service's own entity reads
+ *     to ports.
+ *   - default **billing / shipping address** → the `isDefault` flag on the
+ *     customer's personal `customer_addresses` rows. (The preference table's
+ *     address columns FK to the org `addresses` table, so personal addresses
+ *     cannot be stored there.)
+ */
+export interface CustomerDefaultsPatch {
+    paymentMethodId?: string | null | undefined;
+    deliveryMethodId?: string | null | undefined;
+    billingAddressId?: string | null | undefined;
+    shippingAddressId?: string | null | undefined;
+}
+export declare class CustomerDefaultsService {
+    private readonly emFactory;
+    private readonly preferences;
+    private readonly addresses;
+    constructor(emFactory: () => EntityManager, preferences: DefaultPreferencePort, addresses: CustomerAddressService);
+    getForCustomer(customerAccountId: string): Promise<CustomerDefaults>;
+    /** Self-service update — the customer manages their own customer-scoped defaults. */
+    setForCustomer(customerAccountId: string, patch: CustomerDefaultsPatch, audit: PreferenceAuditContext): Promise<CustomerDefaults>;
+    /**
+     * The widening is `CustomerAddressService`'s, for the same reason and on the
+     * same terms — see `#forAuthorisedCustomer` there. This method has two
+     * callers and both establish the authority before reaching it: the self route
+     * passes the caller's **own** account id, and the admin detail screen
+     * (`CustomerAdminQueryService.getDetail`) has already resolved the account
+     * through `customer_accounts`' `@OrgScoped` read model and returned `null` if
+     * it was out of scope. The statement pins `customerAccountId`, so widening
+     * the filter widens the authority by nothing. It goes when feature 087 gives
+     * `customer_addresses` an `organization_id` of its own.
+     */
+    private defaultAddressId;
+}
+//# sourceMappingURL=customer-defaults-service.d.ts.map

package/dist/backend/services/customer-defaults-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-defaults-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-defaults-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG5E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC/C;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,SAAS,EAAE,MAAM,aAAa,EAC9B,WAAW,EAAE,qBAAqB,EAClC,SAAS,EAAE,sBAAsB;IAG9C,cAAc,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAc1E,qFAAqF;IAC/E,cAAc,CAClB,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,qBAAqB,EAC5B,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA4B5B;;;;;;;;;;OAUG;YACW,gBAAgB;CAiB/B"}

package/dist/backend/services/customer-defaults-service.js

@@ -0,0 +1,71 @@
+import { withSystemScope } from '@endora-commerce/platform/tenancy';
+import { CustomerAddress } from '../entities/customer-address.entity.js';
+export class CustomerDefaultsService {
+    emFactory;
+    preferences;
+    addresses;
+    constructor(emFactory, preferences, addresses) {
+        this.emFactory = emFactory;
+        this.preferences = preferences;
+        this.addresses = addresses;
+    }
+    async getForCustomer(customerAccountId) {
+        const methods = await this.preferences.resolveForCustomer(customerAccountId);
+        const [billingAddressId, shippingAddressId] = await Promise.all([
+            this.defaultAddressId(customerAccountId, 'billing'),
+            this.defaultAddressId(customerAccountId, 'delivery'),
+        ]);
+        return {
+            paymentMethodId: methods.paymentMethodId,
+            deliveryMethodId: methods.deliveryMethodId,
+            billingAddressId,
+            shippingAddressId,
+        };
+    }
+    /** Self-service update — the customer manages their own customer-scoped defaults. */
+    async setForCustomer(customerAccountId, patch, audit) {
+        // Default payment / delivery method → preference store.
+        if (patch.paymentMethodId !== undefined || patch.deliveryMethodId !== undefined) {
+            await this.preferences.upsert({ kind: 'customer', customerAccountId }, {
+                scope: 'customer',
+                scopeId: customerAccountId,
+                ...(patch.paymentMethodId !== undefined
+                    ? { defaultPaymentMethodId: patch.paymentMethodId }
+                    : {}),
+                ...(patch.deliveryMethodId !== undefined
+                    ? { defaultDeliveryMethodId: patch.deliveryMethodId }
+                    : {}),
+            }, audit);
+        }
+        // Default billing / shipping address → the personal address book.
+        if (patch.billingAddressId != null) {
+            await this.addresses.setDefault(customerAccountId, patch.billingAddressId);
+        }
+        if (patch.shippingAddressId != null) {
+            await this.addresses.setDefault(customerAccountId, patch.shippingAddressId);
+        }
+        return this.getForCustomer(customerAccountId);
+    }
+    /**
+     * The widening is `CustomerAddressService`'s, for the same reason and on the
+     * same terms — see `#forAuthorisedCustomer` there. This method has two
+     * callers and both establish the authority before reaching it: the self route
+     * passes the caller's **own** account id, and the admin detail screen
+     * (`CustomerAdminQueryService.getDetail`) has already resolved the account
+     * through `customer_accounts`' `@OrgScoped` read model and returned `null` if
+     * it was out of scope. The statement pins `customerAccountId`, so widening
+     * the filter widens the authority by nothing. It goes when feature 087 gives
+     * `customer_addresses` an `organization_id` of its own.
+     */
+    async defaultAddressId(customerAccountId, kind) {
+        const em = this.emFactory();
+        const row = await withSystemScope(`customers: default ${kind} address of customer account ${customerAccountId}, authorised by its own @OrgScoped account read`, () => em.findOne(CustomerAddress, {
+            customerAccountId,
+            kind,
+            isDefault: true,
+            deletedAt: null,
+        }));
+        return row?.id ?? null;
+    }
+}
+//# sourceMappingURL=customer-defaults-service.js.map

package/dist/backend/services/customer-defaults-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-defaults-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-defaults-service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AA0BzE,MAAM,OAAO,uBAAuB;IAEf;IACA;IACA;IAHnB,YACmB,SAA8B,EAC9B,WAAkC,EAClC,SAAiC;QAFjC,cAAS,GAAT,SAAS,CAAqB;QAC9B,gBAAW,GAAX,WAAW,CAAuB;QAClC,cAAS,GAAT,SAAS,CAAwB;IACjD,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,iBAAyB;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAC7E,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,SAAS,CAAC;YACnD,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,UAAU,CAAC;SACrD,CAAC,CAAC;QACH,OAAO;YACL,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,gBAAgB;YAChB,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,cAAc,CAClB,iBAAyB,EACzB,KAA4B,EAC5B,KAA6B;QAE7B,wDAAwD;QACxD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAC3B,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,EACvC;gBACE,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,eAAe,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,gBAAgB,EAAE;oBACrD,CAAC,CAAC,EAAE,CAAC;aACR,EACD,KAAK,CACN,CAAC;QACJ,CAAC;QACD,kEAAkE;QAClE,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,gBAAgB,CAC5B,iBAAyB,EACzB,IAA4B;QAE5B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,eAAe,CAC/B,sBAAsB,IAAI,gCAAgC,iBAAiB,iDAAiD,EAC5H,GAAG,EAAE,CACH,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC1B,iBAAiB;YACjB,IAAI;YACJ,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;SAChB,CAAC,CACL,CAAC;QACF,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;IACzB,CAAC;CACF"}

package/dist/backend/services/customer-deletion-service.d.ts

@@ -0,0 +1,39 @@
+import { type CustomerAccountLifecycleWritePort, type CustomerAccountReadPort, type CustomerAccountRecord, type PersonalOrganizationPort } from '@endora-commerce/contracts';
+import type { CustomerAuthorityService } from './customer-authority-service.js';
+import type { ModerationActor, SessionRevoker } from './customer-moderation-service.js';
+/**
+ * CustomerDeletionService — soft-delete, restore, and permanent anonymization
+ * (feature 040, US7 / FR-039/FR-040).
+ *
+ * Deletion is a soft-disable: login is denied, the account is hidden, and
+ * sessions are revoked; history (orders, RFQs, audit) is retained. Within the
+ * retention window an authorized actor can restore. The anonymization sweep
+ * irreversibly scrubs PII after the window, after which restore is impossible.
+ *
+ * **Feature 075, Phase C — this service holds no other module's entity.** The
+ * account writes and the scrub are `customer_accounts`', through
+ * `customerAccountLifecycleWritePort`; the cascade onto a member-less personal
+ * organisation is `organizations`', through `personalOrganizationPort`. Each
+ * owner records the one audit row that describes its own write, with the same
+ * action strings as before. What is left here is the *order* of the sweep and
+ * the authority checks, which are this module's.
+ */
+export declare class CustomerDeletionService {
+    private readonly accounts;
+    private readonly accountWrites;
+    private readonly personalOrganizations;
+    private readonly authority;
+    private readonly sessions;
+    constructor(accounts: CustomerAccountReadPort, accountWrites: CustomerAccountLifecycleWritePort, personalOrganizations: PersonalOrganizationPort, authority: CustomerAuthorityService, sessions: SessionRevoker);
+    softDelete(customerAccountId: string, actor: ModerationActor): Promise<CustomerAccountRecord>;
+    restore(customerAccountId: string, actor: ModerationActor): Promise<CustomerAccountRecord>;
+    /**
+     * Permanently anonymizes every soft-deleted account whose retention window
+     * has elapsed (`deletedAt + retentionDays < now`). Returns the number
+     * anonymized. Called by the repeatable sweep worker.
+     */
+    sweep(retentionDays: number, now: Date): Promise<number>;
+    private load;
+    private assertAuthorized;
+}
+//# sourceMappingURL=customer-deletion-service.d.ts.map

package/dist/backend/services/customer-deletion-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-deletion-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-deletion-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC9B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACf,MAAM,kCAAkC,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAJR,QAAQ,EAAE,uBAAuB,EACjC,aAAa,EAAE,iCAAiC,EAChD,qBAAqB,EAAE,wBAAwB,EAC/C,SAAS,EAAE,wBAAwB,EACnC,QAAQ,EAAE,cAAc;IAGrC,UAAU,CACd,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,qBAAqB,CAAC;IA8B3B,OAAO,CACX,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,qBAAqB,CAAC;IAMjC;;;;OAIG;IACG,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;YAehD,IAAI;YAQJ,gBAAgB;CAa/B"}

package/dist/backend/services/customer-deletion-service.js

@@ -0,0 +1,94 @@
+import { ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+/**
+ * CustomerDeletionService — soft-delete, restore, and permanent anonymization
+ * (feature 040, US7 / FR-039/FR-040).
+ *
+ * Deletion is a soft-disable: login is denied, the account is hidden, and
+ * sessions are revoked; history (orders, RFQs, audit) is retained. Within the
+ * retention window an authorized actor can restore. The anonymization sweep
+ * irreversibly scrubs PII after the window, after which restore is impossible.
+ *
+ * **Feature 075, Phase C — this service holds no other module's entity.** The
+ * account writes and the scrub are `customer_accounts`', through
+ * `customerAccountLifecycleWritePort`; the cascade onto a member-less personal
+ * organisation is `organizations`', through `personalOrganizationPort`. Each
+ * owner records the one audit row that describes its own write, with the same
+ * action strings as before. What is left here is the *order* of the sweep and
+ * the authority checks, which are this module's.
+ */
+export class CustomerDeletionService {
+    accounts;
+    accountWrites;
+    personalOrganizations;
+    authority;
+    sessions;
+    constructor(accounts, accountWrites, personalOrganizations, authority, sessions) {
+        this.accounts = accounts;
+        this.accountWrites = accountWrites;
+        this.personalOrganizations = personalOrganizations;
+        this.authority = authority;
+        this.sessions = sessions;
+    }
+    async softDelete(customerAccountId, actor) {
+        const customer = await this.load(customerAccountId);
+        await this.assertAuthorized(actor, customer.organizationId);
+        if (customer.deletedAt) {
+            throw new HttpError(409, ERROR_CODES.CUSTOMER_ALREADY_DELETED, 'Customer is already deleted.');
+        }
+        // Refuse to strand an org without an admin.
+        if (customer.organizationId && customer.role === 'organization_admin') {
+            const remaining = await this.accounts.countByOrganizationRole(customer.organizationId, 'organization_admin', { excludeCustomerAccountId: customer.id, activeOnly: true });
+            if (remaining === 0) {
+                throw new HttpError(409, ERROR_CODES.ORG_OWNER_DEPLETION, 'Cannot delete the last organization administrator.');
+            }
+        }
+        const deleted = await this.accountWrites.softDelete(customer.id, {
+            actorAdminUserId: actor.adminUserId,
+        });
+        await this.sessions.destroyAllForCustomer(customer.id);
+        return deleted;
+    }
+    async restore(customerAccountId, actor) {
+        const customer = await this.load(customerAccountId);
+        await this.assertAuthorized(actor, customer.organizationId);
+        return this.accountWrites.restore(customer.id, { actorAdminUserId: actor.adminUserId });
+    }
+    /**
+     * Permanently anonymizes every soft-deleted account whose retention window
+     * has elapsed (`deletedAt + retentionDays < now`). Returns the number
+     * anonymized. Called by the repeatable sweep worker.
+     */
+    async sweep(retentionDays, now) {
+        const cutoff = new Date(now.getTime() - retentionDays * 24 * 60 * 60 * 1000);
+        const due = await this.accountWrites.listDueForAnonymization(cutoff);
+        for (const customer of due) {
+            await this.accountWrites.anonymize(customer.id);
+            // Feature 051 — a personal (B2C) organization backs exactly one customer.
+            // Once that customer is anonymized the org is member-less, so the scrub
+            // cascades: the owner renames it, blanks its address and soft-deletes it.
+            // Company (multi-member) orgs are never touched, and the owner decides
+            // that — this sweep only says which customer it just scrubbed.
+            await this.personalOrganizations.anonymizeIfOrphaned(customer.id);
+        }
+        return due.length;
+    }
+    async load(id) {
+        const customer = await this.accounts.findById(id);
+        if (!customer) {
+            throw new HttpError(404, ERROR_CODES.CUSTOMER_NOT_FOUND, 'Customer not found.');
+        }
+        return customer;
+    }
+    async assertAuthorized(actor, organizationId) {
+        const allowed = await this.authority.canManageCustomer({
+            isPlatformAdmin: actor.isPlatformAdmin,
+            adminUserId: actor.adminUserId,
+            customerOrganizationId: organizationId,
+        });
+        if (!allowed) {
+            throw new HttpError(403, ERROR_CODES.FORBIDDEN, 'You are not allowed to manage this customer.');
+        }
+    }
+}
+//# sourceMappingURL=customer-deletion-service.js.map

package/dist/backend/services/customer-deletion-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-deletion-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-deletion-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAKZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAO3D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,uBAAuB;IAEf;IACA;IACA;IACA;IACA;IALnB,YACmB,QAAiC,EACjC,aAAgD,EAChD,qBAA+C,EAC/C,SAAmC,EACnC,QAAwB;QAJxB,aAAQ,GAAR,QAAQ,CAAyB;QACjC,kBAAa,GAAb,aAAa,CAAmC;QAChD,0BAAqB,GAArB,qBAAqB,CAA0B;QAC/C,cAAS,GAAT,SAAS,CAA0B;QACnC,aAAQ,GAAR,QAAQ,CAAgB;IACxC,CAAC;IAEJ,KAAK,CAAC,UAAU,CACd,iBAAyB,EACzB,KAAsB;QAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,wBAAwB,EAAE,8BAA8B,CAAC,CAAC;QACjG,CAAC;QAED,4CAA4C;QAC5C,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAC3D,QAAQ,CAAC,cAAc,EACvB,oBAAoB,EACpB,EAAE,wBAAwB,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAC5D,CAAC;YACF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,mBAAmB,EAC/B,oDAAoD,CACrD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC/D,gBAAgB,EAAE,KAAK,CAAC,WAAW;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,iBAAyB,EACzB,KAAsB;QAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,aAAqB,EAAE,GAAS;QAC1C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACrE,KAAK,MAAM,QAAQ,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAChD,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,+DAA+D;YAC/D,MAAM,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,EAAU;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAsB,EACtB,cAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACrD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,sBAAsB,EAAE,cAAc;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;CACF"}

package/dist/backend/services/customer-moderation-service.d.ts

@@ -0,0 +1,58 @@
+import { type CustomerAccountLifecycleWritePort, type CustomerAccountReadPort, type CustomerAccountRecord } from '@endora-commerce/contracts';
+import type { CustomerAuthorityService } from './customer-authority-service.js';
+/**
+ * CustomerModerationService — block / unblock a Customer account (feature 040,
+ * US3). Enforces the staff-authority rules (FR-013/FR-015 via
+ * CustomerAuthorityService), revokes sessions on block, and guards against
+ * stranding an Organization with zero usable admins.
+ *
+ * **Feature 075, Phase C — the row is `customer_accounts`'.** This service used
+ * to load and mutate that module's entity and write the audit row for it; both
+ * moved behind `customerAccountLifecycleWritePort`, which records exactly the
+ * same `customer_account.blocked` / `.unblocked` entry (FR-017). What stays is
+ * everything that is a *decision*: whether this staff member may act on this
+ * customer, and whether the block would leave an Organization without an
+ * administrator. The session revocation stays too — it is `auth`'s, and it must
+ * happen after the block is durable rather than inside it.
+ */
+export interface SessionRevoker {
+    destroyAllForCustomer(customerAccountId: string): Promise<void>;
+}
+export interface ModerationActor {
+    adminUserId: string;
+    isPlatformAdmin: boolean;
+}
+export interface ModerationAuditMeta {
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    requestId?: string | null;
+}
+export interface BlockCustomerInput {
+    targetCustomerAccountId: string;
+    actor: ModerationActor;
+    reason?: string | null;
+    audit?: ModerationAuditMeta;
+}
+export interface UnblockCustomerInput {
+    targetCustomerAccountId: string;
+    actor: ModerationActor;
+    audit?: ModerationAuditMeta;
+}
+export declare class CustomerModerationService {
+    private readonly accounts;
+    private readonly accountWrites;
+    private readonly authority;
+    private readonly sessions;
+    constructor(accounts: CustomerAccountReadPort, accountWrites: CustomerAccountLifecycleWritePort, authority: CustomerAuthorityService, sessions: SessionRevoker);
+    block(input: BlockCustomerInput): Promise<CustomerAccountRecord>;
+    unblock(input: UnblockCustomerInput): Promise<CustomerAccountRecord>;
+    private loadActive;
+    private assertAuthorized;
+    /**
+     * Refuses to block the last usable (active, non-blocked) organization admin
+     * of an Organization — that would strand the org with nobody able to manage
+     * it (spec edge case "org-owner depletion").
+     */
+    private assertWouldNotStrandOrg;
+}
+//# sourceMappingURL=customer-moderation-service.d.ts.map

package/dist/backend/services/customer-moderation-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-moderation-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-moderation-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC3B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC7B,qBAAqB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,uBAAuB,EAAE,MAAM,CAAC;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,uBAAuB,EAAE,MAAM,CAAC;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,CAAC,EAAE,mBAAmB,CAAC;CAC7B;AAED,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAHR,QAAQ,EAAE,uBAAuB,EACjC,aAAa,EAAE,iCAAiC,EAChD,SAAS,EAAE,wBAAwB,EACnC,QAAQ,EAAE,cAAc;IAGrC,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmBhE,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAY5D,UAAU;YAQV,gBAAgB;IAkB9B;;;;OAIG;YACW,uBAAuB;CAetC"}

package/dist/backend/services/customer-moderation-service.js

@@ -0,0 +1,70 @@
+import { ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+export class CustomerModerationService {
+    accounts;
+    accountWrites;
+    authority;
+    sessions;
+    constructor(accounts, accountWrites, authority, sessions) {
+        this.accounts = accounts;
+        this.accountWrites = accountWrites;
+        this.authority = authority;
+        this.sessions = sessions;
+    }
+    async block(input) {
+        const customer = await this.loadActive(input.targetCustomerAccountId);
+        await this.assertAuthorized(input.actor, customer);
+        if (customer.blockedAt)
+            return customer; // idempotent
+        await this.assertWouldNotStrandOrg(customer);
+        const blocked = await this.accountWrites.block(customer.id, {
+            actorAdminUserId: input.actor.adminUserId,
+            reason: input.reason ?? null,
+            ...(input.audit ? { audit: input.audit } : {}),
+        });
+        // Revoke active sessions so the block takes effect promptly (SC-002).
+        await this.sessions.destroyAllForCustomer(customer.id);
+        return blocked;
+    }
+    async unblock(input) {
+        const customer = await this.loadActive(input.targetCustomerAccountId);
+        await this.assertAuthorized(input.actor, customer);
+        if (!customer.blockedAt)
+            return customer; // idempotent
+        return this.accountWrites.unblock(customer.id, {
+            actorAdminUserId: input.actor.adminUserId,
+            ...(input.audit ? { audit: input.audit } : {}),
+        });
+    }
+    async loadActive(id) {
+        const customer = await this.accounts.findById(id, { activeOnly: true });
+        if (!customer) {
+            throw new HttpError(404, ERROR_CODES.CUSTOMER_NOT_FOUND, 'Customer not found.');
+        }
+        return customer;
+    }
+    async assertAuthorized(actor, customer) {
+        const allowed = await this.authority.canManageCustomer({
+            isPlatformAdmin: actor.isPlatformAdmin,
+            adminUserId: actor.adminUserId,
+            customerOrganizationId: customer.organizationId,
+        });
+        if (!allowed) {
+            throw new HttpError(403, ERROR_CODES.FORBIDDEN, 'You are not allowed to manage this customer.');
+        }
+    }
+    /**
+     * Refuses to block the last usable (active, non-blocked) organization admin
+     * of an Organization — that would strand the org with nobody able to manage
+     * it (spec edge case "org-owner depletion").
+     */
+    async assertWouldNotStrandOrg(customer) {
+        if (!customer.organizationId || customer.role !== 'organization_admin')
+            return;
+        const remaining = await this.accounts.countByOrganizationRole(customer.organizationId, 'organization_admin', { excludeCustomerAccountId: customer.id, activeOnly: true, notBlocked: true });
+        if (remaining === 0) {
+            throw new HttpError(409, ERROR_CODES.ORG_OWNER_DEPLETION, 'Cannot block the last organization administrator; the organization would be left without an admin.');
+        }
+    }
+}
+//# sourceMappingURL=customer-moderation-service.js.map

package/dist/backend/services/customer-moderation-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-moderation-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-moderation-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAIZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AA8C3D,MAAM,OAAO,yBAAyB;IAEjB;IACA;IACA;IACA;IAJnB,YACmB,QAAiC,EACjC,aAAgD,EAChD,SAAmC,EACnC,QAAwB;QAHxB,aAAQ,GAAR,QAAQ,CAAyB;QACjC,kBAAa,GAAb,aAAa,CAAmC;QAChD,cAAS,GAAT,SAAS,CAA0B;QACnC,aAAQ,GAAR,QAAQ,CAAgB;IACxC,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,KAAyB;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEnD,IAAI,QAAQ,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,aAAa;QAEtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC1D,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;QAEH,sEAAsE;QACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAA2B;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEnD,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,aAAa;QAEvD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC7C,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;YACzC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,EAAU;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAsB,EACtB,QAA+B;QAE/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACrD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,sBAAsB,EAAE,QAAQ,CAAC,cAAc;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,SAAS,EACrB,8CAA8C,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CAAC,QAA+B;QACnE,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,IAAI,KAAK,oBAAoB;YAAE,OAAO;QAC/E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAC3D,QAAQ,CAAC,cAAc,EACvB,oBAAoB,EACpB,EAAE,wBAAwB,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAC9E,CAAC;QACF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,mBAAmB,EAC/B,oGAAoG,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/backend/services/customer-org-assignment-service.d.ts

@@ -0,0 +1,52 @@
+import { type CustomerAccountLifecycleWritePort, type CustomerAccountReadPort, type CustomerAccountRecord, type OrganizationDetailsPort, type PersonalOrganizationPort } from '@endora-commerce/contracts';
+import type { CustomerAuthorityService } from './customer-authority-service.js';
+import type { ModerationActor } from './customer-moderation-service.js';
+/**
+ * CustomerOrgAssignmentService — assign a Customer to an Organization, or
+ * detach one from the company it belongs to (feature 040, US5 / FR-026). Both
+ * actions are authority-checked and audited; detaching the last usable org
+ * admin is refused (depletion guard, mirroring moderation).
+ *
+ * **D-178 redefined the second action.** `unassign` wrote
+ * `organization_id = NULL` and produced an account with no tenant: it could not
+ * place an order, submit an RFQ or read an address, it shared one filter bucket
+ * with every other tenant-less account, and nothing ever gave it an
+ * organisation back. The operator's intent — *this person no longer belongs to
+ * that company* — is served exactly by moving them to their own single-member
+ * personal organisation, which is what the operation does now, and what the
+ * platform would have given them had they registered on their own.
+ *
+ * **Feature 075, Phase C — neither row is this module's.** The membership
+ * column belongs to `customer_accounts` and the organisation it points at
+ * belongs to `organizations`; both are reached through their published ports
+ * now, and the audit row goes with the write. The authority checks and the
+ * depletion guard stay here, because they are this module's policy.
+ */
+export declare class CustomerOrgAssignmentService {
+    private readonly accounts;
+    private readonly accountWrites;
+    private readonly organizations;
+    private readonly authority;
+    /** D-178 — where a detached member goes. */
+    private readonly personalOrganizations;
+    constructor(accounts: CustomerAccountReadPort, accountWrites: CustomerAccountLifecycleWritePort, organizations: OrganizationDetailsPort, authority: CustomerAuthorityService, 
+    /** D-178 — where a detached member goes. */
+    personalOrganizations: PersonalOrganizationPort);
+    assign(customerAccountId: string, organizationId: string, actor: ModerationActor): Promise<CustomerAccountRecord>;
+    /**
+     * Detach the customer from the company they belong to, moving them to their
+     * own personal organisation (D-178).
+     *
+     * The destination is resolved before the depletion guard runs, so the refusal
+     * an operator sees is still the depletion one and not a provisioning failure
+     * underneath it. It is idempotent: a customer already in their own personal
+     * organisation is returned unchanged, and no audit row is written for a move
+     * that did not happen.
+     */
+    unassign(customerAccountId: string, actor: ModerationActor): Promise<CustomerAccountRecord>;
+    /** Sets (or clears) the customer's direct customer-group (feature 040, US6). */
+    setCustomerGroup(customerAccountId: string, customerGroupId: string | null, actor: ModerationActor): Promise<CustomerAccountRecord>;
+    private loadActive;
+    private assertAuthorized;
+}
+//# sourceMappingURL=customer-org-assignment-service.d.ts.map

package/dist/backend/services/customer-org-assignment-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-org-assignment-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/customer-org-assignment-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iCAAiC,EACtC,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,4BAA4B;IAErC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,4CAA4C;IAC5C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBALrB,QAAQ,EAAE,uBAAuB,EACjC,aAAa,EAAE,iCAAiC,EAChD,aAAa,EAAE,uBAAuB,EACtC,SAAS,EAAE,wBAAwB;IACpD,4CAA4C;IAC3B,qBAAqB,EAAE,wBAAwB;IAG5D,MAAM,CACV,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,qBAAqB,CAAC;IAkBjC;;;;;;;;;OASG;IACG,QAAQ,CACZ,iBAAiB,EAAE,MAAM,EACzB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,qBAAqB,CAAC;IA4BjC,gFAAgF;IAC1E,gBAAgB,CACpB,iBAAiB,EAAE,MAAM,EACzB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,qBAAqB,CAAC;YASnB,UAAU;YAQV,gBAAgB;CAa/B"}

package/dist/backend/services/customer-org-assignment-service.js

@@ -0,0 +1,106 @@
+import { ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+/**
+ * CustomerOrgAssignmentService — assign a Customer to an Organization, or
+ * detach one from the company it belongs to (feature 040, US5 / FR-026). Both
+ * actions are authority-checked and audited; detaching the last usable org
+ * admin is refused (depletion guard, mirroring moderation).
+ *
+ * **D-178 redefined the second action.** `unassign` wrote
+ * `organization_id = NULL` and produced an account with no tenant: it could not
+ * place an order, submit an RFQ or read an address, it shared one filter bucket
+ * with every other tenant-less account, and nothing ever gave it an
+ * organisation back. The operator's intent — *this person no longer belongs to
+ * that company* — is served exactly by moving them to their own single-member
+ * personal organisation, which is what the operation does now, and what the
+ * platform would have given them had they registered on their own.
+ *
+ * **Feature 075, Phase C — neither row is this module's.** The membership
+ * column belongs to `customer_accounts` and the organisation it points at
+ * belongs to `organizations`; both are reached through their published ports
+ * now, and the audit row goes with the write. The authority checks and the
+ * depletion guard stay here, because they are this module's policy.
+ */
+export class CustomerOrgAssignmentService {
+    accounts;
+    accountWrites;
+    organizations;
+    authority;
+    personalOrganizations;
+    constructor(accounts, accountWrites, organizations, authority, 
+    /** D-178 — where a detached member goes. */
+    personalOrganizations) {
+        this.accounts = accounts;
+        this.accountWrites = accountWrites;
+        this.organizations = organizations;
+        this.authority = authority;
+        this.personalOrganizations = personalOrganizations;
+    }
+    async assign(customerAccountId, organizationId, actor) {
+        const customer = await this.loadActive(customerAccountId);
+        // Actor must be able to manage the customer in its CURRENT state and in
+        // the TARGET organization.
+        await this.assertAuthorized(actor, customer.organizationId);
+        await this.assertAuthorized(actor, organizationId);
+        const org = await this.organizations.findById(organizationId);
+        if (!org) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Organization not found.');
+        }
+        return this.accountWrites.setOrganization(customer.id, organizationId, {
+            actorAdminUserId: actor.adminUserId,
+        });
+    }
+    /**
+     * Detach the customer from the company they belong to, moving them to their
+     * own personal organisation (D-178).
+     *
+     * The destination is resolved before the depletion guard runs, so the refusal
+     * an operator sees is still the depletion one and not a provisioning failure
+     * underneath it. It is idempotent: a customer already in their own personal
+     * organisation is returned unchanged, and no audit row is written for a move
+     * that did not happen.
+     */
+    async unassign(customerAccountId, actor) {
+        const customer = await this.loadActive(customerAccountId);
+        await this.assertAuthorized(actor, customer.organizationId);
+        const personal = await this.personalOrganizations.provisionPersonalOrganization(customer.id);
+        if (customer.organizationId === personal.id)
+            return customer; // already their own
+        // Refuse to strand the org without an admin.
+        if (customer.role === 'organization_admin') {
+            const remaining = await this.accounts.countByOrganizationRole(customer.organizationId, 'organization_admin', { excludeCustomerAccountId: customer.id, activeOnly: true });
+            if (remaining === 0) {
+                throw new HttpError(409, ERROR_CODES.ORG_OWNER_DEPLETION, 'Cannot unassign the last organization administrator.');
+            }
+        }
+        return this.accountWrites.detachToPersonalOrganization(customer.id, personal.id, {
+            actorAdminUserId: actor.adminUserId,
+        });
+    }
+    /** Sets (or clears) the customer's direct customer-group (feature 040, US6). */
+    async setCustomerGroup(customerAccountId, customerGroupId, actor) {
+        const customer = await this.loadActive(customerAccountId);
+        await this.assertAuthorized(actor, customer.organizationId);
+        return this.accountWrites.setCustomerGroup(customer.id, customerGroupId, {
+            actorAdminUserId: actor.adminUserId,
+        });
+    }
+    async loadActive(id) {
+        const customer = await this.accounts.findById(id, { activeOnly: true });
+        if (!customer) {
+            throw new HttpError(404, ERROR_CODES.CUSTOMER_NOT_FOUND, 'Customer not found.');
+        }
+        return customer;
+    }
+    async assertAuthorized(actor, organizationId) {
+        const allowed = await this.authority.canManageCustomer({
+            isPlatformAdmin: actor.isPlatformAdmin,
+            adminUserId: actor.adminUserId,
+            customerOrganizationId: organizationId,
+        });
+        if (!allowed) {
+            throw new HttpError(403, ERROR_CODES.FORBIDDEN, 'Not allowed for this organization.');
+        }
+    }
+}
+//# sourceMappingURL=customer-org-assignment-service.js.map

package/dist/backend/services/customer-org-assignment-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"customer-org-assignment-service.js","sourceRoot":"","sources":["../../../src/backend/services/customer-org-assignment-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAMZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAI3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,4BAA4B;IAEpB;IACA;IACA;IACA;IAEA;IANnB,YACmB,QAAiC,EACjC,aAAgD,EAChD,aAAsC,EACtC,SAAmC;IACpD,4CAA4C;IAC3B,qBAA+C;QAL/C,aAAQ,GAAR,QAAQ,CAAyB;QACjC,kBAAa,GAAb,aAAa,CAAmC;QAChD,kBAAa,GAAb,aAAa,CAAyB;QACtC,cAAS,GAAT,SAAS,CAA0B;QAEnC,0BAAqB,GAArB,qBAAqB,CAA0B;IAC/D,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,iBAAyB,EACzB,cAAsB,EACtB,KAAsB;QAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAE1D,wEAAwE;QACxE,2BAA2B;QAC3B,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAEnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE;YACrE,gBAAgB,EAAE,KAAK,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CACZ,iBAAyB,EACzB,KAAsB;QAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7F,IAAI,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,CAAC,oBAAoB;QAElF,6CAA6C;QAC7C,IAAI,QAAQ,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAC3D,QAAQ,CAAC,cAAc,EACvB,oBAAoB,EACpB,EAAE,wBAAwB,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAC5D,CAAC;YACF,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,mBAAmB,EAC/B,sDAAsD,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC/E,gBAAgB,EAAE,KAAK,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,gBAAgB,CACpB,iBAAyB,EACzB,eAA8B,EAC9B,KAAsB;QAEtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE;YACvE,gBAAgB,EAAE,KAAK,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,EAAU;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAsB,EACtB,cAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACrD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,sBAAsB,EAAE,cAAc;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;CACF"}