@endora-commerce/mod-quick-order 0.100.0

package/dist/backend/index.js

@@ -0,0 +1,235 @@
+import { z } from 'zod';
+import { lazyPort } from '@endora-commerce/platform/kernel';
+import { effectiveState } from '@endora-commerce/platform/kernel';
+import { SettingNotRegistered, SettingOutOfScopeForChannel } from '@endora-commerce/platform/kernel';
+import { QUICK_ORDER_SETTING_CODES, DEFAULT_IMPORT_MAX_ROWS, DEFAULT_ONE_CLICK_BUY_ENABLED, } from '../manifest.js';
+import { CatalogPortLookup } from './services/catalog-lookup.js';
+import { QuickOrderImportPipeline } from './services/import-pipeline.js';
+import { QuickOrderBuildService } from './services/quick-order-build-service.js';
+import { DefaultPreferenceService } from './services/default-preference-service.js';
+import { OneClickService } from './services/one-click-service.js';
+import { registerQuickOrderRoutes } from './routes.js';
+import { registerQuickOrderAdminRoutes } from './routes.admin.js';
+import { registerQuickOrderPreferenceRoutes } from './routes.preferences.js';
+import { registerQuickOrderPreferenceAdminRoutes } from './routes.preferences.admin.js';
+import { registerQuickOrderOneClickRoutes } from './routes.one-click.js';
+import { QuickOrderDefaultPreference } from './entities/quick-order-default-preference.entity.js';
+/**
+ * Conditions this module has already reported (D-43's warn-once). Module scope
+ * and never reset: the import cap is read on every upload, admin and customer.
+ */
+const warnedConditions = new Set();
+function warnOnce(condition, message) {
+    if (warnedConditions.has(condition))
+        return;
+    warnedConditions.add(condition);
+    console.warn(message);
+}
+/**
+ * `customers` absent: the buyer has no personal addresses (issue #216).
+ *
+ * D-44 `degrades-without`, and the degrade is not invented for the occasion.
+ * Principle XVII says a switched-off module behaves as if never installed, and
+ * a platform on which `customers` was never installed has no
+ * `customer_addresses`: only the organisation's shared addresses are eligible
+ * defaults. That is exactly what `resolveForCustomer` already does with a
+ * default it finds ineligible (FR-020) — it drops the field to `null`, and
+ * one-click buy hides itself because not all four defaults resolve. A buyer
+ * whose defaults are org addresses is unaffected.
+ *
+ * Failing closed here instead would 503 the whole preference resolution — and
+ * with it one-click buy for *every* buyer — because the personal-address branch
+ * is probed on every eligibility check. Switching off a CRM surface must not do
+ * that.
+ *
+ * `customerAddressReadPort` is a **gated** port: a closed gate throws rather
+ * than answering `null`, so the presence probe comes *before* the resolution,
+ * and it is per call rather than per composition — the factory below is a
+ * singleton, and an operator flipping `customers` on must not need a restart.
+ */
+const ABSENT_CUSTOMER_ADDRESSES = {
+    findById: async () => null,
+    listForCustomer: async () => [],
+};
+export function customerAddressesOrAbsent(port) {
+    const pick = () => effectiveState.isPresent('customers') ? port : ABSENT_CUSTOMER_ADDRESSES;
+    return {
+        findById: (customerAccountId, addressId, options) => pick().findById(customerAccountId, addressId, options),
+        listForCustomer: (customerAccountId, kind) => pick().listForCustomer(customerAccountId, kind),
+    };
+}
+export function registerModule(ctx) {
+    const cradle = () => ctx.cradle();
+    /**
+     * Feature 075, Phase P — the buyer's one-click defaults.
+     *
+     * `customers` renders and edits them from its own customer-detail screen, so
+     * the surface and the table sit in different modules by design.
+     * `resolveForCustomer` answers with the defaults **already resolved** —
+     * through the buyer's saved addresses and the platform's methods — rather
+     * than the stored row, because the fallback chain is this module's and a
+     * caller reproducing it would reproduce it differently.
+     */
+    ctx.di.providePort('defaultPreferencePort', ctx
+        .asFunction(() => ({
+        resolveForCustomer: (customerAccountId) => cradle().quickOrderPreferenceService.resolveForCustomer(customerAccountId),
+        upsert: (actor, input, audit) => cradle().quickOrderPreferenceService.upsert(actor, input, audit),
+    }))
+        .singleton());
+    ctx.di.register({
+        quickOrderPipeline: ctx
+            .asFunction(() => new QuickOrderImportPipeline(new CatalogPortLookup(lazyPort(ctx, 'catalogProductReadPort'), 
+        // Issue #259 — the channel assortment gate on the pasted-SKU
+        // seam. A kernel registration, so no module edge to declare.
+        lazyPort(ctx, 'salesChannelMembershipPort'))))
+            .singleton(),
+        quickOrderBuildService: ctx
+            .asFunction(() => new QuickOrderBuildService(
+        // Both are other modules' gated ports and both are stored by the
+        // constructor, so a singleton may not hold them directly — Awilix's
+        // strict mode refuses a transient inside a longer-lived object.
+        lazyPort(ctx, 'cartWritePort'), lazyPort(ctx, 'rfqService')))
+            .singleton(),
+        quickOrderPreferenceService: ctx
+            .asFunction(({ emFactory, auditLogService }) => new DefaultPreferenceService(emFactory, auditLogService, {
+            // Five gated ports and one degrade. Every one of these was an
+            // `em.findOne` against another module's entity until issue #216:
+            // deactivation drops no tables, so a stored default kept resolving
+            // out of a switched-off module's rows and one-click buy went on
+            // offering a payment method the platform had stopped serving.
+            //
+            // `payment_methods`, `delivery_methods`, `addresses`,
+            // `customer_accounts` and `organizations` are all binding
+            // dependencies of this module, so their gates fail closed: the
+            // resolution throws `ModuleDisabledError` and the call answers 503
+            // `MODULE_DISABLED` rather than resolving half a set of defaults.
+            customerAccounts: lazyPort(ctx, 'customerAccountReadPort'),
+            paymentMethods: lazyPort(ctx, 'paymentMethodReadPort'),
+            deliveryMethods: lazyPort(ctx, 'deliveryMethodReadPort'),
+            addresses: lazyPort(ctx, 'addressReadPort'),
+            customerAddresses: customerAddressesOrAbsent(lazyPort(ctx, 'customerAddressReadPort')),
+            restriction: lazyPort(ctx, 'organizationRestrictionPort'),
+        }))
+            .singleton(),
+        quickOrderOneClickService: ctx
+            .asFunction(({ quickOrderPreferenceService }) => new OneClickService(quickOrderPreferenceService, lazyPort(ctx, 'cartWritePort'), lazyPort(ctx, 'orderPlacementPort'), 
+        // This module's own setting, read here rather than through a
+        // resolver a host passes down. The channel comes from the request
+        // (`routes.one-click.ts`), so `null` means there was none and the
+        // per-storefront value is read platform-wide (D-41 case c).
+        //
+        // The bare `catch { return false }` this replaces is what made
+        // issue #99 invisible: it swallowed `SettingsChannelIdInvalid` from
+        // the `'default'` code the service used to compile in, and reported
+        // the result as `setting_disabled`. It would swallow
+        // `ModuleDisabledError` just as happily (composition rule 7). Only
+        // the two conditions with a defined degrade are absorbed now, and
+        // both degrade to the manifest default rather than to a second
+        // literal beside it (D-43).
+        async (salesChannelId) => {
+            try {
+                return await cradle().settingsReadPort.get(QUICK_ORDER_SETTING_CODES.ONE_CLICK_BUY_ENABLED, salesChannelId, z.boolean());
+            }
+            catch (error) {
+                if (error instanceof SettingNotRegistered)
+                    return DEFAULT_ONE_CLICK_BUY_ENABLED;
+                if (error instanceof SettingOutOfScopeForChannel) {
+                    warnOnce(`out-of-scope:${QUICK_ORDER_SETTING_CODES.ONE_CLICK_BUY_ENABLED}`, `[quick_order] setting "${QUICK_ORDER_SETTING_CODES.ONE_CLICK_BUY_ENABLED}" ` +
+                        `is scoped to specific sales channels, so it has no value for this read — ` +
+                        `falling back to the manifest default (logged once per process).`);
+                    return DEFAULT_ONE_CLICK_BUY_ENABLED;
+                }
+                throw error;
+            }
+        }))
+            .singleton(),
+    });
+    ctx.routes(async (app) => {
+        const { requireAdmin, quickOrderPipeline: pipeline, quickOrderBuildService: buildService, quickOrderPreferenceService: preferenceService, quickOrderOneClickService: oneClickService, } = cradle();
+        const requireCustomer = (req, reply) => cradle().requireCustomer(req, reply);
+        const resolveCustomerContext = (req) => cradle().customerContextResolver(req);
+        /**
+         * Read **platform-wide** (feature 072, D-41 case c). The manifest has
+         * always described this setting as "Global" — it is an upper bound on what
+         * one upload may cost the server, not a per-storefront policy — and the
+         * same value has to answer on the admin surface, where there is no
+         * storefront channel to resolve at all.
+         *
+         * Before T139 the host read it against a `settingsChannelId` option it
+         * defaulted to `'default'`, and fell back to the constant whenever a
+         * composition passed no settings service — which the harness did, so every
+         * test ran the manifest default while production read the configured value
+         * (T133's finding, one layer down). T139 lifted the read here and kept the
+         * `'default'` literal, which is a channel **code** against a `uuid` column:
+         * every read threw in the driver and the bare `catch` made it look like an
+         * unconfigured platform. The cap has therefore been the compiled-in 2000 on
+         * every deployment, whatever the operator set.
+         */
+        const resolveImportMaxRows = async () => {
+            try {
+                return await cradle().settingsReadPort.get(QUICK_ORDER_SETTING_CODES.IMPORT_MAX_ROWS, null, z.number().int().positive());
+            }
+            catch (error) {
+                if (error instanceof SettingNotRegistered)
+                    return DEFAULT_IMPORT_MAX_ROWS;
+                if (error instanceof SettingOutOfScopeForChannel) {
+                    warnOnce(`out-of-scope:${QUICK_ORDER_SETTING_CODES.IMPORT_MAX_ROWS}`, `[quick_order] setting "${QUICK_ORDER_SETTING_CODES.IMPORT_MAX_ROWS}" is ` +
+                        `scoped to specific sales channels, so it has no platform-wide value — ` +
+                        `falling back to the manifest default (logged once per process).`);
+                    return DEFAULT_IMPORT_MAX_ROWS;
+                }
+                throw error;
+            }
+        };
+        await registerQuickOrderRoutes(app, {
+            pipeline,
+            buildService,
+            requireCustomer,
+            resolveCustomerContext,
+            resolveImportMaxRows,
+            // Issue #174 — one port where three deps used to be, and the type-ahead
+            // is scoped to the request's sales channel because `catalog` scopes it.
+            catalogQuickSearch: lazyPort(ctx, 'catalogQuickSearchPort'),
+        });
+        await registerQuickOrderAdminRoutes(app, {
+            pipeline,
+            buildService,
+            requireAdmin,
+            resolveImportMaxRows,
+            customerAccounts: lazyPort(ctx, 'customerAccountReadPort'),
+        });
+        await registerQuickOrderPreferenceRoutes(app, {
+            service: preferenceService,
+            customerAccounts: lazyPort(ctx, 'customerAccountReadPort'),
+            requireCustomer,
+            resolveCustomerContext,
+        });
+        await registerQuickOrderPreferenceAdminRoutes(app, {
+            service: preferenceService,
+            customerAccounts: lazyPort(ctx, 'customerAccountReadPort'),
+            salesRepScope: lazyPort(ctx, 'organizationSalesRepScopePort'),
+            requireAdmin,
+            resolveAdminContext: (req) => cradle().adminContextResolver(req),
+        });
+        await registerQuickOrderOneClickRoutes(app, {
+            service: oneClickService,
+            requireCustomer,
+            resolveCustomerContext,
+        });
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export const entities = [
+    QuickOrderDefaultPreference,
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGlE,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAErG,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,uCAAuC,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AA+DlG;;;GAGG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE3C,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IAC5C,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,yBAAyB,GAA4B;IACzD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;IAC1B,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;CAChC,CAAC;AAEF,MAAM,UAAU,yBAAyB,CACvC,IAA6B;IAE7B,MAAM,IAAI,GAAG,GAA4B,EAAE,CACzC,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC3E,OAAO;QACL,QAAQ,EAAE,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAClD,IAAI,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC;QACxD,eAAe,EAAE,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,IAAI,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,MAAM,MAAM,GAAG,GAAqB,EAAE,CAAC,GAAG,CAAC,MAAM,EAAoB,CAAC;IAEtE;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,uBAAuB,EACvB,GAAG;SACA,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QACjB,kBAAkB,EAAE,CAAC,iBAAyB,EAAE,EAAE,CAChD,MAAM,EAAE,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;QAC5E,MAAM,EAAE,CACN,KAAqD,EACrD,KAAqD,EACrD,KAAqD,EACrD,EAAE,CAAC,MAAM,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;KACtE,CAAC,CAAC;SACF,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,kBAAkB,EAAE,GAAG;aACpB,UAAU,CACT,GAAG,EAAE,CACH,IAAI,wBAAwB,CAC1B,IAAI,iBAAiB,CACnB,QAAQ,CAAyB,GAAG,EAAE,wBAAwB,CAAC;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,QAAQ,CAA6B,GAAG,EAAE,4BAA4B,CAAC,CACxE,CACF,CACJ;aACA,SAAS,EAAE;QAEd,sBAAsB,EAAE,GAAG;aACxB,UAAU,CACT,GAAG,EAAE,CACH,IAAI,sBAAsB;QACxB,iEAAiE;QACjE,oEAAoE;QACpE,gEAAgE;QAChE,QAAQ,CAAgB,GAAG,EAAE,eAAe,CAAC,EAC7C,QAAQ,CAAkB,GAAG,EAAE,YAAY,CAAC,CAC7C,CACJ;aACA,SAAS,EAAE;QAEd,2BAA2B,EAAE,GAAG;aAC7B,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,eAAe,EAAoB,EAAE,EAAE,CACnD,IAAI,wBAAwB,CAAC,SAAS,EAAE,eAAe,EAAE;YACvD,8DAA8D;YAC9D,iEAAiE;YACjE,mEAAmE;YACnE,gEAAgE;YAChE,8DAA8D;YAC9D,EAAE;YACF,sDAAsD;YACtD,0DAA0D;YAC1D,+DAA+D;YAC/D,mEAAmE;YACnE,kEAAkE;YAClE,gBAAgB,EAAE,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC;YACnF,cAAc,EAAE,QAAQ,CAAwB,GAAG,EAAE,uBAAuB,CAAC;YAC7E,eAAe,EAAE,QAAQ,CAAyB,GAAG,EAAE,wBAAwB,CAAC;YAChF,SAAS,EAAE,QAAQ,CAAkB,GAAG,EAAE,iBAAiB,CAAC;YAC5D,iBAAiB,EAAE,yBAAyB,CAC1C,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC,CAClE;YACD,WAAW,EAAE,QAAQ,CAA8B,GAAG,EAAE,6BAA6B,CAAC;SACvF,CAAC,CACL;aACA,SAAS,EAAE;QAEd,yBAAyB,EAAE,GAAG;aAC3B,UAAU,CACT,CAAC,EAAE,2BAA2B,EAAoB,EAAE,EAAE,CACpD,IAAI,eAAe,CACjB,2BAA2B,EAC3B,QAAQ,CAAgB,GAAG,EAAE,eAAe,CAAC,EAC7C,QAAQ,CAAqB,GAAG,EAAE,oBAAoB,CAAC;QACvD,6DAA6D;QAC7D,kEAAkE;QAClE,kEAAkE;QAClE,4DAA4D;QAC5D,EAAE;QACF,+DAA+D;QAC/D,oEAAoE;QACpE,oEAAoE;QACpE,qDAAqD;QACrD,mEAAmE;QACnE,kEAAkE;QAClE,+DAA+D;QAC/D,4BAA4B;QAC5B,KAAK,EAAE,cAA6B,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,EAAE,CAAC,gBAAgB,CAAC,GAAG,CACxC,yBAAyB,CAAC,qBAAqB,EAC/C,cAAc,EACd,CAAC,CAAC,OAAO,EAAE,CACZ,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB;oBAAE,OAAO,6BAA6B,CAAC;gBAChF,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;oBACjD,QAAQ,CACN,gBAAgB,yBAAyB,CAAC,qBAAqB,EAAE,EACjE,0BAA0B,yBAAyB,CAAC,qBAAqB,IAAI;wBAC3E,2EAA2E;wBAC3E,iEAAiE,CACpE,CAAC;oBACF,OAAO,6BAA6B,CAAC;gBACvC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CACF,CACJ;aACA,SAAS,EAAE;KACf,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,EACJ,YAAY,EACZ,kBAAkB,EAAE,QAAQ,EAC5B,sBAAsB,EAAE,YAAY,EACpC,2BAA2B,EAAE,iBAAiB,EAC9C,yBAAyB,EAAE,eAAe,GAC3C,GAAG,MAAM,EAAE,CAAC;QACb,MAAM,eAAe,GAAG,CAAC,GAAmB,EAAE,KAAc,EAAiB,EAAE,CAC7E,MAAM,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,sBAAsB,GAAG,CAC7B,GAAmB,EACoC,EAAE,CACzD,MAAM,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAExC;;;;;;;;;;;;;;;;WAgBG;QACH,MAAM,oBAAoB,GAAG,KAAK,IAAqB,EAAE;YACvD,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,EAAE,CAAC,gBAAgB,CAAC,GAAG,CACxC,yBAAyB,CAAC,eAAe,EACzC,IAAI,EACJ,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAC5B,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB;oBAAE,OAAO,uBAAuB,CAAC;gBAC1E,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;oBACjD,QAAQ,CACN,gBAAgB,yBAAyB,CAAC,eAAe,EAAE,EAC3D,0BAA0B,yBAAyB,CAAC,eAAe,OAAO;wBACxE,wEAAwE;wBACxE,iEAAiE,CACpE,CAAC;oBACF,OAAO,uBAAuB,CAAC;gBACjC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,wBAAwB,CAAC,GAAG,EAAE;YAClC,QAAQ;YACR,YAAY;YACZ,eAAe;YACf,sBAAsB;YACtB,oBAAoB;YACpB,wEAAwE;YACxE,wEAAwE;YACxE,kBAAkB,EAAE,QAAQ,CAAyB,GAAG,EAAE,wBAAwB,CAAC;SACpF,CAAC,CAAC;QAEH,MAAM,6BAA6B,CAAC,GAAG,EAAE;YACvC,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,oBAAoB;YACpB,gBAAgB,EAAE,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC;SACpF,CAAC,CAAC;QAEH,MAAM,kCAAkC,CAAC,GAAG,EAAE;YAC5C,OAAO,EAAE,iBAAiB;YAC1B,gBAAgB,EAAE,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC;YACnF,eAAe;YACf,sBAAsB;SACvB,CAAC,CAAC;QAEH,MAAM,uCAAuC,CAAC,GAAG,EAAE;YACjD,OAAO,EAAE,iBAAiB;YAC1B,gBAAgB,EAAE,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC;YACnF,aAAa,EAAE,QAAQ,CAAyB,GAAG,EAAE,+BAA+B,CAAC;YACrF,YAAY;YACZ,mBAAmB,EAAE,CAAC,GAAmB,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC;SACjF,CAAC,CAAC;QAEH,MAAM,gCAAgC,CAAC,GAAG,EAAE;YAC1C,OAAO,EAAE,eAAe;YACxB,eAAe;YACf,sBAAsB;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,2BAA2B;CAC5B,CAAC"}

package/dist/backend/routes.admin.d.ts

@@ -0,0 +1,35 @@
+import type { FastifyInstance } from 'fastify';
+import { type CustomerAccountReadPort } from '@endora-commerce/contracts';
+import type { QuickOrderImportPipeline } from './services/import-pipeline.js';
+import type { QuickOrderBuildService } from './services/quick-order-build-service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * Admin quick-order routes (feature 039, FR-008). An operator imports a file
+ * and builds a Cart / Quote Request on behalf of a specific customer +
+ * organization (`onBehalfOf`), priced under that organization's price list.
+ * Guarded by the `orders:write` permission.
+ *
+ * **A permission is not a tenant gate.** `onBehalfOf` names the customer
+ * account and the organization the built Cart or Quote Request is written to,
+ * and it arrives in the request body. No filter can reach it: MikroORM applies
+ * a global filter to `SELECT`, `UPDATE` and `DELETE` and **not** to `INSERT`,
+ * so a route that takes its tenant identity from its own input writes wherever
+ * the input says. An assignment-scoped administrator (`allowed-set`) therefore
+ * has to be refused here or nowhere — see {@link assertOnBehalfOfInScope}.
+ */
+export interface QuickOrderAdminRoutesDeps {
+    pipeline: QuickOrderImportPipeline;
+    buildService: QuickOrderBuildService;
+    requireAdmin: RequireAdminFactory;
+    resolveImportMaxRows: () => Promise<number>;
+    /**
+     * `customer_accounts`' published read model — the tenant boundary of the
+     * build route and not a convenience. The account is `@OrgScoped`, so asking
+     * this port whether it exists *is* asking whether this caller may act for
+     * that customer. The module already declares the edge for its two preference
+     * surfaces (manifest `dependencies`).
+     */
+    customerAccounts: CustomerAccountReadPort;
+}
+export declare function registerQuickOrderAdminRoutes(app: FastifyInstance, deps: QuickOrderAdminRoutesDeps): Promise<void>;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/backend/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,YAAY,EAAE,sBAAsB,CAAC;IACrC,YAAY,EAAE,mBAAmB,CAAC;IAClC,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,gBAAgB,EAAE,uBAAuB,CAAC;CAC3C;AAED,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA6Ef"}

package/dist/backend/routes.admin.js

@@ -0,0 +1,64 @@
+import { ERROR_CODES, quickOrderBuildRequestSchema, quickOrderImportRequestSchema, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { isOrgInScope } from '@endora-commerce/platform/tenancy';
+import { parseImportRequest } from './services/import-from-request.js';
+export async function registerQuickOrderAdminRoutes(app, deps) {
+    const { pipeline, buildService, requireAdmin, resolveImportMaxRows, customerAccounts } = deps;
+    /**
+     * Refuse an `onBehalfOf` the caller's organizations do not reach.
+     *
+     * Two questions, because the body answers two: the organization the row is
+     * stamped with must be one the caller may act in, and the customer account
+     * the row hangs off must be one the caller may reach. Passing an in-scope
+     * organization id beside a foreign customer account would otherwise satisfy
+     * the first on its own.
+     *
+     * 404 rather than 403, and the code an absent customer gets: an out-of-scope
+     * customer must not be distinguishable from one that is not there.
+     */
+    const assertOnBehalfOfInScope = async (onBehalfOf) => {
+        const refuse = () => {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Customer account not found.');
+        };
+        if (!isOrgInScope(onBehalfOf.organizationId))
+            refuse();
+        const account = await customerAccounts.findById(onBehalfOf.customerAccountId);
+        if (!account)
+            refuse();
+    };
+    app.post('/api/v1/admin/quick-order/import', { preHandler: requireAdmin('orders:write'), schema: { body: quickOrderImportRequestSchema } }, async (request) => {
+        const body = quickOrderImportRequestSchema.parse(request.body);
+        const maxRows = await resolveImportMaxRows();
+        const parse = await parseImportRequest(body);
+        // Issue #227 — `'unrestricted'`, and stated rather than omitted. This
+        // route is gated by `orders:write`, and the operator names the
+        // organisation on the *build* call one step later, so at import time
+        // there is no buyer whose allow-list this run could be scoped by.
+        const result = await pipeline.run(parse, { maxRows, audience: 'unrestricted' });
+        return { data: result };
+    });
+    app.post('/api/v1/admin/quick-order/build', { preHandler: requireAdmin('orders:write'), schema: { body: quickOrderBuildRequestSchema } }, async (request) => {
+        const body = quickOrderBuildRequestSchema.parse(request.body);
+        if (!body.onBehalfOf) {
+            throw new HttpError(422, ERROR_CODES.VALIDATION_FAILED, 'onBehalfOf is required for an admin quick-order build.');
+        }
+        await assertOnBehalfOfInScope({
+            customerAccountId: body.onBehalfOf.customerAccountId,
+            organizationId: body.onBehalfOf.organizationId,
+        });
+        const result = await buildService.build({
+            customerAccountId: body.onBehalfOf.customerAccountId,
+            organizationId: body.onBehalfOf.organizationId,
+            isOrgAdmin: false,
+        }, {
+            target: body.target,
+            items: body.items.map((item) => ({
+                productId: item.productId,
+                variantId: item.variantId ?? null,
+                quantity: item.quantity,
+            })),
+        });
+        return { data: result };
+    });
+}
+//# sourceMappingURL=routes.admin.js.map

package/dist/backend/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,4BAA4B,EAC5B,6BAA6B,GAE9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAgCvE,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAoB,EACpB,IAA+B;IAE/B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAE9F;;;;;;;;;;;OAWG;IACH,MAAM,uBAAuB,GAAG,KAAK,EAAE,UAGtC,EAAiB,EAAE;QAClB,MAAM,MAAM,GAAG,GAAU,EAAE;YACzB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QACjF,CAAC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,MAAM,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO;YAAE,MAAM,EAAE,CAAC;IACzB,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,kCAAkC,EAClC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE,EAC7F,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7C,sEAAsE;QACtE,+DAA+D;QAC/D,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,iCAAiC,EACjC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,EAAE,EAC5F,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,iBAAiB,EAC7B,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,CAAC;YAC5B,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB;YACpD,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc;SAC/C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CACrC;YACE,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,iBAAiB;YACpD,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc;YAC9C,UAAU,EAAE,KAAK;SAClB,EACD;YACE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;SACJ,CACF,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/backend/routes.d.ts

@@ -0,0 +1,35 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { type CatalogQuickSearchPort } from '@endora-commerce/contracts';
+import type { QuickOrderImportPipeline } from './services/import-pipeline.js';
+import type { QuickOrderBuildService } from './services/quick-order-build-service.js';
+/**
+ * Quick-order routes (feature 039).
+ *   - POST /quick-order/import  parses CSV / .xlsx → recognised + rejected rows
+ *   - POST /quick-order/build   recognised rows → Cart or Quote Request
+ *   - GET  /quick-order/search  type-ahead over the catalogue, in the channel
+ *     the request resolved
+ *
+ * Requires an authenticated customer session: SKU-to-product disclosure and
+ * cart / RFQ mutation are gated to logged-in buyers.
+ */
+export interface QuickOrderRoutesDeps {
+    pipeline: QuickOrderImportPipeline;
+    buildService: QuickOrderBuildService;
+    requireCustomer: (req: FastifyRequest, reply: unknown) => Promise<void>;
+    resolveCustomerContext: (req: FastifyRequest) => {
+        customerAccountId: string;
+        organizationId: string;
+    };
+    /** Reads the `quick_order.import_max_rows` setting (falls back internally). */
+    resolveImportMaxRows: () => Promise<number>;
+    /**
+     * `catalog`'s channel-scoped type-ahead (issue #174). It replaces three
+     * things at once: the `emFactory` this file used to open a knex query with,
+     * the attribute read it used to source `quickSearchable` keys from, and the
+     * product read it used to hydrate the ids that query returned. The predicate
+     * and the `matchedOn` labels belong to the module that owns the tables.
+     */
+    catalogQuickSearch: CatalogQuickSearchPort;
+}
+export declare function registerQuickOrderRoutes(app: FastifyInstance, deps: QuickOrderRoutesDeps): Promise<void>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/backend/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/backend/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAC9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAGtF;;;;;;;;;GASG;AAEH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,YAAY,EAAE,sBAAsB,CAAC;IACrC,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,sBAAsB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAC/C,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,kBAAkB,EAAE,sBAAsB,CAAC;CAC5C;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAuFf"}

package/dist/backend/routes.js

@@ -0,0 +1,77 @@
+import { quickOrderBuildRequestSchema, quickOrderImportRequestSchema, quickOrderSearchQuerySchema, } from '@endora-commerce/contracts';
+import { getResolvedChannel } from '@endora-commerce/platform/kernel';
+import { productAudienceOf } from '@endora-commerce/platform/http';
+import { parseImportRequest } from './services/import-from-request.js';
+export async function registerQuickOrderRoutes(app, deps) {
+    const { pipeline, buildService, requireCustomer, resolveCustomerContext } = deps;
+    app.post('/api/v1/quick-order/import', { preHandler: requireCustomer, schema: { body: quickOrderImportRequestSchema } }, async (request) => {
+        const body = quickOrderImportRequestSchema.parse(request.body);
+        const maxRows = await deps.resolveImportMaxRows();
+        const parse = await parseImportRequest(body);
+        // Issue #227 — the audience is the buyer's own, off the session this
+        // route already requires. The type-ahead below has had it since issue
+        // #174; the pasted-SKU path next to it had not, and a SKU list is the
+        // easier of the two to enumerate.
+        const result = await pipeline.run(parse, {
+            maxRows,
+            audience: productAudienceOf(request),
+        });
+        return { data: result };
+    });
+    app.post('/api/v1/quick-order/build', { preHandler: requireCustomer, schema: { body: quickOrderBuildRequestSchema } }, async (request) => {
+        const body = quickOrderBuildRequestSchema.parse(request.body);
+        const ctx = resolveCustomerContext(request);
+        const result = await buildService.build({ customerAccountId: ctx.customerAccountId, organizationId: ctx.organizationId }, {
+            target: body.target,
+            items: body.items.map((item) => ({
+                productId: item.productId,
+                variantId: item.variantId ?? null,
+                quantity: item.quantity,
+            })),
+        });
+        return { data: result };
+    });
+    app.get('/api/v1/quick-order/search', { preHandler: requireCustomer }, async (request) => {
+        const query = quickOrderSearchQuerySchema.parse(request.query ?? {});
+        /**
+         * Issue #174 — the type-ahead asks `catalog`, and asks it *in a channel*.
+         *
+         * This used to be a hand-written knex `select` against `catalog`'s
+         * `products` table, reaching into its `attribute_values` JSONB and
+         * filtering on `status = 'active'` and nothing else. Two costs. The edge
+         * had no import specifier, so `check:module-boundary` could not see it and
+         * no ledger shard could key it — trap 6's "strictly worse than an import".
+         * And with no channel predicate, a signed-in buyer's type-ahead returned
+         * every active product on the platform, whichever channel they were
+         * shopping: Constitution XII, in the one place no static check was looking.
+         *
+         * `catalogQuickSearchPort` owns the predicate now, including which
+         * attributes are `quickSearchable` and which `matchedOn` labels a hit
+         * carries — both are facts about `catalog`'s own tables. What is left here
+         * is the buyer's language pick, which is this surface's business.
+         *
+         * The channel is the one the canonical resolver already put on the request
+         * scope (feature 053 / Constitution XII), never re-resolved from a header
+         * here. The organisation comes off the buyer's session for the same reason
+         * — it decides which restricted products `catalog` will disclose, and this
+         * surface is the one that knows who is asking.
+         */
+        const hits = await deps.catalogQuickSearch.quickSearch({
+            q: query.q,
+            limit: query.limit,
+            salesChannelId: getResolvedChannel(request).id,
+            organizationId: resolveCustomerContext(request).organizationId,
+        });
+        return {
+            data: hits.map((hit) => ({
+                productId: hit.productId,
+                sku: hit.sku,
+                name: hit.name['en-US'] ?? Object.values(hit.name)[0] ?? hit.sku,
+                slug: hit.slug,
+                status: hit.status,
+                matchedOn: hit.matchedOn,
+            })),
+        };
+    });
+}
+//# sourceMappingURL=routes.js.map

package/dist/backend/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/backend/routes.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAiCvE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAoB,EACpB,IAA0B;IAE1B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;IAEjF,GAAG,CAAC,IAAI,CACN,4BAA4B,EAC5B,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE,EAChF,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7C,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,kCAAkC;QAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE;YACvC,OAAO;YACP,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,2BAA2B,EAC3B,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,EAAE,EAC/E,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CACrC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,EAChF;YACE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;SACJ,CACF,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvF,MAAM,KAAK,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAErE;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC;YACrD,CAAC,EAAE,KAAK,CAAC,CAAC;YACV,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,EAAE;YAC9C,cAAc,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,cAAc;SAC/D,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACvB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG;gBAChE,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/routes.one-click.d.ts

@@ -0,0 +1,22 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { OneClickService } from './services/one-click-service.js';
+/**
+ * One-click buy routes (feature 039, US5).
+ *   - GET  /quick-order/one-click/eligibility  should the PDP button show?
+ *   - POST /quick-order/one-click              place the order from defaults
+ *
+ * Both read the channel the canonical resolver already put on the request scope
+ * (Constitution XII) and hand it to the service. Before issue #99 the service
+ * carried a `'default'` constructor default instead — a channel code where an id
+ * was wanted — and the storefront request's real channel was never consulted.
+ */
+export interface QuickOrderOneClickRoutesDeps {
+    service: OneClickService;
+    requireCustomer: (req: FastifyRequest, reply: unknown) => Promise<void>;
+    resolveCustomerContext: (req: FastifyRequest) => {
+        customerAccountId: string;
+        organizationId: string;
+    };
+}
+export declare function registerQuickOrderOneClickRoutes(app: FastifyInstance, deps: QuickOrderOneClickRoutesDeps): Promise<void>;
+//# sourceMappingURL=routes.one-click.d.ts.map

package/dist/backend/routes.one-click.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.one-click.d.ts","sourceRoot":"","sources":["../../src/backend/routes.one-click.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE;;;;;;;;;GASG;AACH,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,eAAe,CAAC;IACzB,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,sBAAsB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAC/C,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,wBAAsB,gCAAgC,CACpD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,IAAI,CAAC,CA6Cf"}

package/dist/backend/routes.one-click.js

@@ -0,0 +1,35 @@
+import { quickOrderOneClickRequestSchema } from '@endora-commerce/contracts';
+import { currentSalesChannel } from '@endora-commerce/platform/kernel';
+export async function registerQuickOrderOneClickRoutes(app, deps) {
+    const { service, requireCustomer, resolveCustomerContext } = deps;
+    app.get('/api/v1/quick-order/one-click/eligibility', { preHandler: requireCustomer }, async (request) => {
+        const ctx = resolveCustomerContext(request);
+        return {
+            data: await service.eligibility(ctx.customerAccountId, currentSalesChannel()?.id ?? null),
+        };
+    });
+    app.post('/api/v1/quick-order/one-click', { preHandler: requireCustomer, schema: { body: quickOrderOneClickRequestSchema } }, async (request, reply) => {
+        const body = quickOrderOneClickRequestSchema.parse(request.body);
+        const ctx = resolveCustomerContext(request);
+        const order = await service.place(ctx, {
+            productId: body.productId,
+            variantId: body.variantId ?? null,
+            ...(body.quantity ? { quantity: body.quantity } : {}),
+            ...(body.idempotencyKey ? { idempotencyKey: body.idempotencyKey } : {}),
+        }, currentSalesChannel()?.id ?? null);
+        reply.status(201);
+        return {
+            data: {
+                order: {
+                    id: order.id,
+                    businessId: order.businessId,
+                    status: order.status,
+                    total: Number(order.total),
+                    currency: order.currency,
+                },
+                nextAction: order.nextAction ?? null,
+            },
+        };
+    });
+}
+//# sourceMappingURL=routes.one-click.js.map

package/dist/backend/routes.one-click.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.one-click.js","sourceRoot":"","sources":["../../src/backend/routes.one-click.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAsBvE,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAAoB,EACpB,IAAkC;IAElC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;IAElE,GAAG,CAAC,GAAG,CACL,2CAA2C,EAC3C,EAAE,UAAU,EAAE,eAAe,EAAE,EAC/B,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO;YACL,IAAI,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC;SAC1F,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,+BAA+B,EAC/B,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAClF,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAC/B,GAAG,EACH;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,EACD,mBAAmB,EAAE,EAAE,EAAE,IAAI,IAAI,CAClC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO;YACL,IAAI,EAAE;gBACJ,KAAK,EAAE;oBACL,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;oBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB;gBACD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;aACrC;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/backend/routes.preferences.admin.d.ts

@@ -0,0 +1,23 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { type CustomerAccountReadPort, type SalesRepAssignmentPort } from '@endora-commerce/contracts';
+import type { DefaultPreferenceService } from './services/default-preference-service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * Admin default-preferences routes (feature 039, FR-018). A platform admin
+ * (no sales-rep assignments) manages any scope; a salesperson manages only
+ * their assigned organizations and the customers within them. Guarded by
+ * `orders:write`.
+ */
+export interface QuickOrderPreferenceAdminRoutesDeps {
+    service: DefaultPreferenceService;
+    /** `customer_accounts`' read model — the target customer's organisation. */
+    customerAccounts: CustomerAccountReadPort;
+    /** `organizations`' sales-rep scope — which orgs this admin may act on. */
+    salesRepScope: SalesRepAssignmentPort;
+    requireAdmin: RequireAdminFactory;
+    resolveAdminContext: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+}
+export declare function registerQuickOrderPreferenceAdminRoutes(app: FastifyInstance, deps: QuickOrderPreferenceAdminRoutesDeps): Promise<void>;
+//# sourceMappingURL=routes.preferences.admin.d.ts.map

package/dist/backend/routes.preferences.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.preferences.admin.d.ts","sourceRoot":"","sources":["../../src/backend/routes.preferences.admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AAEzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,WAAW,mCAAmC;IAClD,OAAO,EAAE,wBAAwB,CAAC;IAClC,4EAA4E;IAC5E,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,2EAA2E;IAC3E,aAAa,EAAE,sBAAsB,CAAC;IACtC,YAAY,EAAE,mBAAmB,CAAC;IAClC,mBAAmB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAmBD,wBAAsB,uCAAuC,CAC3D,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,mCAAmC,GACxC,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/dist/backend/routes.preferences.admin.js

@@ -0,0 +1,40 @@
+import { ERROR_CODES, quickOrderPreferenceScopeSchema, quickOrderPreferenceUpsertSchema, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { canManagePreference } from './services/default-preference-authz.js';
+/**
+ * "No assignments" is what makes an admin a platform admin here, and the port
+ * answers exactly that question — `listAssignedOrganizationIds` replaces an
+ * `em.find(OrganizationSalesRepAssignment, …)` against a table `organizations`
+ * owns (feature 075, Phase C).
+ */
+async function adminActor(salesRepScope, adminUserId) {
+    const assignedOrganizationIds = await salesRepScope.listAssignedOrganizationIds(adminUserId);
+    if (assignedOrganizationIds.length > 0) {
+        return { kind: 'salesperson', assignedOrganizationIds };
+    }
+    return { kind: 'platform_admin' };
+}
+export async function registerQuickOrderPreferenceAdminRoutes(app, deps) {
+    const { service, customerAccounts, salesRepScope, requireAdmin, resolveAdminContext } = deps;
+    app.get('/api/v1/admin/quick-order/preferences', { preHandler: requireAdmin('orders:write') }, async (request) => {
+        const query = request.query;
+        const scope = quickOrderPreferenceScopeSchema.parse(query.scope);
+        const scopeId = query.scopeId ?? '';
+        const actor = await adminActor(salesRepScope, resolveAdminContext(request).adminUserId);
+        const targetCustomerOrgId = scope === 'customer'
+            ? ((await customerAccounts.findById(scopeId))?.organizationId ?? null)
+            : null;
+        if (!canManagePreference(actor, { scope, scopeId }, targetCustomerOrgId)) {
+            throw new HttpError(403, ERROR_CODES.FORBIDDEN, 'Not allowed to read these defaults.');
+        }
+        return { data: await service.readRaw(scope, scopeId) };
+    });
+    app.put('/api/v1/admin/quick-order/preferences', { preHandler: requireAdmin('orders:write'), schema: { body: quickOrderPreferenceUpsertSchema } }, async (request) => {
+        const body = quickOrderPreferenceUpsertSchema.parse(request.body);
+        const ctx = resolveAdminContext(request);
+        const actor = await adminActor(salesRepScope, ctx.adminUserId);
+        const result = await service.upsert(actor, body, { actorAdminUserId: ctx.adminUserId });
+        return { data: result };
+    });
+}
+//# sourceMappingURL=routes.preferences.admin.js.map

package/dist/backend/routes.preferences.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.preferences.admin.js","sourceRoot":"","sources":["../../src/backend/routes.preferences.admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,+BAA+B,EAC/B,gCAAgC,GAGjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAwB,MAAM,wCAAwC,CAAC;AAmBnG;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,aAAqC,EACrC,WAAmB;IAEnB,MAAM,uBAAuB,GAAG,MAAM,aAAa,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAC7F,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,GAAoB,EACpB,IAAyC;IAEzC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IAE7F,GAAG,CAAC,GAAG,CACL,uCAAuC,EACvC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,EAC5C,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,OAAO,CAAC,KAA6C,CAAC;QACpE,MAAM,KAAK,GAAG,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,mBAAmB,GACvB,KAAK,KAAK,UAAU;YAClB,CAAC,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,cAAc,IAAI,IAAI,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;IACzD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,uCAAuC,EACvC,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAChG,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,CACF,CAAC;AACJ,CAAC"}