@endora-commerce/mod-quote-requests 0.100.0

package/dist/migrations/20260912T125614_quote_requests_quote_request_channel_attribution.d.ts

@@ -0,0 +1,34 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * `quote_requests.sales_channel_id` — the channel a quote request was raised
+ * on (feature 005, FR-012).
+ *
+ * The column, its foreign key and its index were added by the platform's
+ * frozen `Migration20260430T170044CoreSalesChannelsPromote` until
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3. Under D-226 a
+ * migration may name a table only if its own module creates it, a module in
+ * its transitive `dependencies` closure creates it, or the platform creates
+ * it — and the platform declares no dependencies, so it could never name
+ * `quote_requests` at all. An instance that omits this module had a frozen
+ * corpus altering a table nothing builds.
+ *
+ * Here the closure holds in both directions the SQL runs: `quote_requests` is
+ * this module's own table, and `sales_channels` is the kernel's, created
+ * inside the frozen prefix that every above-watermark migration runs after.
+ * `sales_channels` is in this module's `dependencies` besides.
+ *
+ * **Written idempotently**, because a database that has already applied the
+ * frozen migration carries all three objects. The storage keys on the class
+ * name and holds no checksum, so the reduced frozen body is not re-offered
+ * there; this migration is the no-op it reads as, and on a fresh database it
+ * is the change. The constraint add is guarded by a `pg_constraint` probe
+ * because PostgreSQL has no `add constraint if not exists`.
+ *
+ * The column stays NULLABLE, as it was: the backfill and the NOT NULL flip
+ * are a separate step (feature 005 T060) and are not this migration's.
+ */
+export declare class Migration20260912T125614QuoteRequestsQuoteRequestChannelAttribution extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260912T125614_quote_requests_quote_request_channel_attribution.d.ts.map

package/dist/migrations/20260912T125614_quote_requests_quote_request_channel_attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260912T125614_quote_requests_quote_request_channel_attribution.d.ts","sourceRoot":"","sources":["../../src/migrations/20260912T125614_quote_requests_quote_request_channel_attribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,mEAAoE,SAAQ,SAAS;IACjF,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAOrC"}

package/dist/migrations/20260912T125614_quote_requests_quote_request_channel_attribution.js

@@ -0,0 +1,57 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * `quote_requests.sales_channel_id` — the channel a quote request was raised
+ * on (feature 005, FR-012).
+ *
+ * The column, its foreign key and its index were added by the platform's
+ * frozen `Migration20260430T170044CoreSalesChannelsPromote` until
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3. Under D-226 a
+ * migration may name a table only if its own module creates it, a module in
+ * its transitive `dependencies` closure creates it, or the platform creates
+ * it — and the platform declares no dependencies, so it could never name
+ * `quote_requests` at all. An instance that omits this module had a frozen
+ * corpus altering a table nothing builds.
+ *
+ * Here the closure holds in both directions the SQL runs: `quote_requests` is
+ * this module's own table, and `sales_channels` is the kernel's, created
+ * inside the frozen prefix that every above-watermark migration runs after.
+ * `sales_channels` is in this module's `dependencies` besides.
+ *
+ * **Written idempotently**, because a database that has already applied the
+ * frozen migration carries all three objects. The storage keys on the class
+ * name and holds no checksum, so the reduced frozen body is not re-offered
+ * there; this migration is the no-op it reads as, and on a fresh database it
+ * is the change. The constraint add is guarded by a `pg_constraint` probe
+ * because PostgreSQL has no `add constraint if not exists`.
+ *
+ * The column stays NULLABLE, as it was: the backfill and the NOT NULL flip
+ * are a separate step (feature 005 T060) and are not this migration's.
+ */
+export class Migration20260912T125614QuoteRequestsQuoteRequestChannelAttribution extends Migration {
+    async up() {
+        this.addSql('alter table "quote_requests" add column if not exists "sales_channel_id" uuid null;');
+        this.addSql(`
+      do $$
+      begin
+        if not exists (
+          select 1 from pg_constraint
+          where "conname" = 'quote_requests_sales_channel_fk'
+            and "conrelid" = '"quote_requests"'::regclass
+        ) then
+          alter table "quote_requests"
+            add constraint "quote_requests_sales_channel_fk"
+            foreign key ("sales_channel_id") references "sales_channels" ("id")
+            on delete restrict;
+        end if;
+      end $$;
+    `);
+        this.addSql('create index if not exists "quote_requests_sales_channel_id_index" ' +
+            'on "quote_requests" ("sales_channel_id");');
+    }
+    async down() {
+        this.addSql('drop index if exists "quote_requests_sales_channel_id_index";');
+        this.addSql('alter table "quote_requests" drop constraint if exists "quote_requests_sales_channel_fk";');
+        this.addSql('alter table "quote_requests" drop column if exists "sales_channel_id";');
+    }
+}
+//# sourceMappingURL=20260912T125614_quote_requests_quote_request_channel_attribution.js.map

package/dist/migrations/20260912T125614_quote_requests_quote_request_channel_attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260912T125614_quote_requests_quote_request_channel_attribution.js","sourceRoot":"","sources":["../../src/migrations/20260912T125614_quote_requests_quote_request_channel_attribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,OAAO,mEAAoE,SAAQ,SAAS;IACvF,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;KAcX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,qEAAqE;YACnE,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,+DAA+D,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,wEAAwE,CAAC,CAAC;IACxF,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent — *"the `./migrations` export of
+ * @endora-commerce/mod-quote-requests exports no 'migrations' array"*. `blog`
+ * published only `export *` here until D-168, so an installed `blog` did not
+ * merely lose its schema, it stopped the platform from booting; the defect was
+ * invisible because a workspace member is not an installed package and the
+ * committed host registry names each class directly.
+ *
+ * **Six classes, and the order in this array is not the order they run in.**
+ * They are listed here in ascending timestamp, which is the order
+ * `backend/src/db/migration-order.ts` computes *within* a module — and within a
+ * module only. Where this module's block sits relative to every other module's
+ * is decided by the manifest `dependencies` graph, not by a timestamp and not by
+ * this file (feature 081). Two of these six share nothing but their day:
+ * `…T140415_…_qr_item_packaging` and `…T140417_…_business_id` are two minutes
+ * apart and both depend on the `…T141344_…_workflow` rewrite above them, which
+ * is exactly what "a timestamp orders a module's own migrations" buys.
+ *
+ * The **named** exports stay, and the asymmetry with `./backend` — which
+ * publishes an array and no named class (D-168) — is deliberate.
+ * `db/migrations-registry.generated.ts` imports each class by name from this
+ * specifier and hands it to `migration('quote_requests', …)`, and a migration
+ * class name is contract in a way an entity class name is not:
+ * `mikro_orm_migrations` persists it, so it is a string every already-migrated
+ * database holds. It also carries none of the hazard D-168 removes — no module
+ * has a reason to name another module's migration, and doing so buys nothing an
+ * entity import buys.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created. The composer refuses a migration file
+ * no declared subpath covers for exactly that reason, but it cannot see whether
+ * the barrel behind the subpath actually carries the class — that is this
+ * file's job.
+ *
+ * `status-mapping.ts` sits in this directory and is deliberately **not** here:
+ * it is a §4 helper, not a migration (see the note in `generate-composer.ts`).
+ */
+import { Migration20260424T190112QuoteRequestsInit } from './20260424T190112_quote_requests_init.js';
+import { Migration20260503T141344QuoteRequestsWorkflow } from './20260503T141344_quote_requests_workflow.js';
+import { Migration20260611T140415QuoteRequestsQrItemPackaging } from './20260611T140415_quote_requests_qr_item_packaging.js';
+import { Migration20260611T140417QuoteRequestsBusinessId } from './20260611T140417_quote_requests_business_id.js';
+import { Migration20260617T095510QuoteRequestsBackfillAdminCreatedAwaiting } from './20260617T095510_quote_requests_backfill_admin_created_awaiting.js';
+import { Migration20260718T200342QuoteRequestsQuoteRequestCustomFieldValues } from './20260718T200342_quote_requests_quote_request_custom_field_values.js';
+import { Migration20260912T125614QuoteRequestsQuoteRequestChannelAttribution } from './20260912T125614_quote_requests_quote_request_channel_attribution.js';
+export declare const migrations: (typeof Migration20260424T190112QuoteRequestsInit)[];
+export { Migration20260424T190112QuoteRequestsInit, Migration20260503T141344QuoteRequestsWorkflow, Migration20260611T140415QuoteRequestsQrItemPackaging, Migration20260611T140417QuoteRequestsBusinessId, Migration20260617T095510QuoteRequestsBackfillAdminCreatedAwaiting, Migration20260718T200342QuoteRequestsQuoteRequestCustomFieldValues, Migration20260912T125614QuoteRequestsQuoteRequestChannelAttribution, };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,6CAA6C,EAAE,MAAM,8CAA8C,CAAC;AAC7G,OAAO,EAAE,oDAAoD,EAAE,MAAM,uDAAuD,CAAC;AAC7H,OAAO,EAAE,+CAA+C,EAAE,MAAM,iDAAiD,CAAC;AAClH,OAAO,EAAE,iEAAiE,EAAE,MAAM,qEAAqE,CAAC;AACxJ,OAAO,EAAE,kEAAkE,EAAE,MAAM,uEAAuE,CAAC;AAC3J,OAAO,EAAE,mEAAmE,EAAE,MAAM,uEAAuE,CAAC;AAE5J,eAAO,MAAM,UAAU,sDAQtB,CAAC;AAEF,OAAO,EACL,yCAAyC,EACzC,6CAA6C,EAC7C,oDAAoD,EACpD,+CAA+C,EAC/C,iEAAiE,EACjE,kEAAkE,EAClE,mEAAmE,GACpE,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,61 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent — *"the `./migrations` export of
+ * @endora-commerce/mod-quote-requests exports no 'migrations' array"*. `blog`
+ * published only `export *` here until D-168, so an installed `blog` did not
+ * merely lose its schema, it stopped the platform from booting; the defect was
+ * invisible because a workspace member is not an installed package and the
+ * committed host registry names each class directly.
+ *
+ * **Six classes, and the order in this array is not the order they run in.**
+ * They are listed here in ascending timestamp, which is the order
+ * `backend/src/db/migration-order.ts` computes *within* a module — and within a
+ * module only. Where this module's block sits relative to every other module's
+ * is decided by the manifest `dependencies` graph, not by a timestamp and not by
+ * this file (feature 081). Two of these six share nothing but their day:
+ * `…T140415_…_qr_item_packaging` and `…T140417_…_business_id` are two minutes
+ * apart and both depend on the `…T141344_…_workflow` rewrite above them, which
+ * is exactly what "a timestamp orders a module's own migrations" buys.
+ *
+ * The **named** exports stay, and the asymmetry with `./backend` — which
+ * publishes an array and no named class (D-168) — is deliberate.
+ * `db/migrations-registry.generated.ts` imports each class by name from this
+ * specifier and hands it to `migration('quote_requests', …)`, and a migration
+ * class name is contract in a way an entity class name is not:
+ * `mikro_orm_migrations` persists it, so it is a string every already-migrated
+ * database holds. It also carries none of the hazard D-168 removes — no module
+ * has a reason to name another module's migration, and doing so buys nothing an
+ * entity import buys.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created. The composer refuses a migration file
+ * no declared subpath covers for exactly that reason, but it cannot see whether
+ * the barrel behind the subpath actually carries the class — that is this
+ * file's job.
+ *
+ * `status-mapping.ts` sits in this directory and is deliberately **not** here:
+ * it is a §4 helper, not a migration (see the note in `generate-composer.ts`).
+ */
+import { Migration20260424T190112QuoteRequestsInit } from './20260424T190112_quote_requests_init.js';
+import { Migration20260503T141344QuoteRequestsWorkflow } from './20260503T141344_quote_requests_workflow.js';
+import { Migration20260611T140415QuoteRequestsQrItemPackaging } from './20260611T140415_quote_requests_qr_item_packaging.js';
+import { Migration20260611T140417QuoteRequestsBusinessId } from './20260611T140417_quote_requests_business_id.js';
+import { Migration20260617T095510QuoteRequestsBackfillAdminCreatedAwaiting } from './20260617T095510_quote_requests_backfill_admin_created_awaiting.js';
+import { Migration20260718T200342QuoteRequestsQuoteRequestCustomFieldValues } from './20260718T200342_quote_requests_quote_request_custom_field_values.js';
+import { Migration20260912T125614QuoteRequestsQuoteRequestChannelAttribution } from './20260912T125614_quote_requests_quote_request_channel_attribution.js';
+export const migrations = [
+    Migration20260424T190112QuoteRequestsInit,
+    Migration20260503T141344QuoteRequestsWorkflow,
+    Migration20260611T140415QuoteRequestsQrItemPackaging,
+    Migration20260611T140417QuoteRequestsBusinessId,
+    Migration20260617T095510QuoteRequestsBackfillAdminCreatedAwaiting,
+    Migration20260718T200342QuoteRequestsQuoteRequestCustomFieldValues,
+    Migration20260912T125614QuoteRequestsQuoteRequestChannelAttribution,
+];
+export { Migration20260424T190112QuoteRequestsInit, Migration20260503T141344QuoteRequestsWorkflow, Migration20260611T140415QuoteRequestsQrItemPackaging, Migration20260611T140417QuoteRequestsBusinessId, Migration20260617T095510QuoteRequestsBackfillAdminCreatedAwaiting, Migration20260718T200342QuoteRequestsQuoteRequestCustomFieldValues, Migration20260912T125614QuoteRequestsQuoteRequestChannelAttribution, };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,6CAA6C,EAAE,MAAM,8CAA8C,CAAC;AAC7G,OAAO,EAAE,oDAAoD,EAAE,MAAM,uDAAuD,CAAC;AAC7H,OAAO,EAAE,+CAA+C,EAAE,MAAM,iDAAiD,CAAC;AAClH,OAAO,EAAE,iEAAiE,EAAE,MAAM,qEAAqE,CAAC;AACxJ,OAAO,EAAE,kEAAkE,EAAE,MAAM,uEAAuE,CAAC;AAC3J,OAAO,EAAE,mEAAmE,EAAE,MAAM,uEAAuE,CAAC;AAE5J,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,yCAAyC;IACzC,6CAA6C;IAC7C,oDAAoD;IACpD,+CAA+C;IAC/C,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;CACpE,CAAC;AAEF,OAAO,EACL,yCAAyC,EACzC,6CAA6C,EAC7C,oDAAoD,EACpD,+CAA+C,EAC/C,iEAAiE,EACjE,kEAAkE,EAClE,mEAAmE,GACpE,CAAC"}

package/dist/migrations/status-mapping.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Legacy → new status mapping for the Quote Requests workflow rewrite
+ * (feature 008). The mapping itself is pure so we can unit-test it
+ * without bringing up Postgres. The migration consumes this exact
+ * function in its data step.
+ *
+ * Spec reference: research.md §R1, data-model.md §8.
+ */
+export type LegacyStatus = 'draft' | 'new' | 'under_review' | 'quoted' | 'accepted' | 'rejected' | 'expired';
+export type NewStatus = 'Created from admin' | 'Pending' | 'Canceled' | 'Approved' | 'Completed' | 'Expired';
+export interface MappingResult {
+    /** Target status. `null` means the row should be deleted (legacy `draft`). */
+    status: NewStatus | null;
+    /** Whether to set `awaiting_customer_revision_acceptance = true`. */
+    awaitingCustomerRevisionAcceptance: boolean;
+}
+export declare function mapLegacyStatus(legacy: LegacyStatus): MappingResult;
+//# sourceMappingURL=status-mapping.d.ts.map

package/dist/migrations/status-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-mapping.d.ts","sourceRoot":"","sources":["../../src/migrations/status-mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,KAAK,GACL,cAAc,GACd,QAAQ,GACR,UAAU,GACV,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,SAAS,GACT,UAAU,GACV,UAAU,GACV,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,qEAAqE;IACrE,kCAAkC,EAAE,OAAO,CAAC;CAC7C;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,CAkBnE"}

package/dist/migrations/status-mapping.js

@@ -0,0 +1,28 @@
+/**
+ * Legacy → new status mapping for the Quote Requests workflow rewrite
+ * (feature 008). The mapping itself is pure so we can unit-test it
+ * without bringing up Postgres. The migration consumes this exact
+ * function in its data step.
+ *
+ * Spec reference: research.md §R1, data-model.md §8.
+ */
+export function mapLegacyStatus(legacy) {
+    switch (legacy) {
+        case 'draft':
+            return { status: null, awaitingCustomerRevisionAcceptance: false };
+        case 'new':
+        case 'under_review':
+            return { status: 'Pending', awaitingCustomerRevisionAcceptance: false };
+        case 'quoted':
+            // Sales rep had issued a counter-quote; under the new model that is
+            // the "modified, awaiting customer accept/reject" state.
+            return { status: 'Pending', awaitingCustomerRevisionAcceptance: true };
+        case 'accepted':
+            return { status: 'Approved', awaitingCustomerRevisionAcceptance: false };
+        case 'rejected':
+            return { status: 'Canceled', awaitingCustomerRevisionAcceptance: false };
+        case 'expired':
+            return { status: 'Expired', awaitingCustomerRevisionAcceptance: false };
+    }
+}
+//# sourceMappingURL=status-mapping.js.map

package/dist/migrations/status-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-mapping.js","sourceRoot":"","sources":["../../src/migrations/status-mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0BH,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC;QACrE,KAAK,KAAK,CAAC;QACX,KAAK,cAAc;YACjB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC;QAC1E,KAAK,QAAQ;YACX,oEAAoE;YACpE,yDAAyD;YACzD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC;QACzE,KAAK,UAAU;YACb,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC;QAC3E,KAAK,UAAU;YACb,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC;QAC3E,KAAK,SAAS;YACZ,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,kCAAkC,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/docs/quote_requests.md

@@ -0,0 +1,168 @@
+---
+title: quote_requests
+description: RFQ lifecycle (draft → quote → accept/reject)
+---
+
+# `quote_requests`
+
+The Quote Requests module implements the B2B negotiation loop.
+A customer (or sales representative on the
+customer's behalf) drafts a Quote Request, the other side reviews it,
+either side may modify the request and require explicit re-acceptance,
+and an approved Quote Request can be turned into an order through the
+standard checkout. Every transition is captured in an append-only
+event log so the customer-facing detail page and the admin detail page
+both render the same chronological history.
+
+## Statuses
+
+Six values, replacing the foundation-era set:
+
+- `Created from admin` — drafted by a sales rep / admin, awaiting customer acceptance.
+- `Pending` — submitted by the customer, awaiting internal-side response.
+- `Approved` — green-lit by the responsible party.
+- `Completed` — an order has been placed from this Quote Request.
+- `Canceled` — rejected by either party (with optional reason).
+- `Expired` — auto-flipped by the expiry worker when the configured threshold elapses.
+
+`Canceled`, `Completed`, and `Expired` are terminal.
+
+## Public surface
+
+Customer endpoints require a customer session; admin endpoints are
+gated by `rfqs:handle`. PATCH-shaped endpoints accept `If-Match`
+versions for optimistic concurrency, and customer accept/reject
+revision additionally pin `expectedRevisionNumber`.
+
+| Verb + Path | Audience | Purpose |
+| --- | --- | --- |
+| `GET /api/v1/quote-requests` | customer | List visible Quote Requests (org-admin role expands to whole-org visibility). |
+| `GET /api/v1/quote-requests/:id` | customer | Detail with optional `comparisonAgainstLastSeen` block while awaiting acceptance. |
+| `POST /api/v1/quote-requests` | customer | Create + submit in one call. |
+| `PATCH /api/v1/quote-requests/:id` | customer | Edit a Pending RFQ that the internal side has not yet touched. |
+| `POST /api/v1/quote-requests/:id/accept-revision` | customer | Accept the latest revision (also covers `Created from admin`). |
+| `POST /api/v1/quote-requests/:id/reject-revision` | customer | Reject the latest revision with optional reason. |
+| `POST /api/v1/quote-requests/:id/resubmit` | customer | Clone an old Quote Request into a new Pending one at the customer's current price list. |
+| `GET /api/v1/admin/quote-requests` | admin | List, scoped by sales-rep assignment + filterable by status / organization. |
+| `GET /api/v1/admin/quote-requests/:id` | admin | Detail with full actor identity in the event log. |
+| `POST /api/v1/admin/quote-requests` | admin | Create on customer's behalf → status `Created from admin`. |
+| `PATCH /api/v1/admin/quote-requests/:id` | admin | Modify a Pending or Created from admin RFQ → triggers customer re-acceptance. |
+| `POST /api/v1/admin/quote-requests/:id/approve` | admin | Approve a Pending RFQ. |
+| `POST /api/v1/admin/quote-requests/:id/cancel` | admin | Cancel with optional reason. |
+| `POST /api/v1/admin/quote-requests/:id/assign` | admin | Set `assignedAdminUserId` (informational). |
+| `GET /api/v1/admin/sales-reps/:adminUserId/organizations` | admin | Reverse view — organizations a rep is responsible for, with the count of open quote requests in each. |
+| `GET /api/v1/storefront/settings/quote-requests` | public | Returns the two storefront visibility flags. |
+
+The three endpoints that assign a sales representative *to* an organization —
+`GET`, `POST` and `DELETE` under
+`/api/v1/admin/organizations/:id/sales-reps` — belong to the **organizations**
+module and are gated by `organizations:assign-sales-rep`, not by `rfqs:handle`.
+They used to be registered here, and the split is not cosmetic: assigning a
+representative qualifies an organization, so it must keep working when quote
+requests is switched off, and it cannot be gated by a permission code declared
+by a module that can disappear. The one endpoint left above is the one that
+reads a quote request, and it is gated `rfqs:handle` precisely so that it
+disappears with this module.
+
+## Visibility model
+
+A sales representative is a platform administrator with the
+`sales_representative` role. The
+`SalesRepAssignmentService.canSeeOrganization(adminUserId, organizationId)`
+predicate centralises the visibility rule:
+
+1. `platform_admin` role → sees every organization.
+2. Otherwise the admin sees an organization iff a row in
+   `organization_sales_rep_assignments` ties them together, OR the
+   organization has zero rows in that table (the "unassigned-org
+   fallback" — visible to every sales rep).
+
+A customer with the `org_admin` role on their own organization sees
+every Quote Request in the organization, not just their own.
+
+## Settings
+
+Three settings drive the module — all live under the `quote_requests`
+group and are configured through the existing settings module.
+
+| Code | Type | Default | Effect |
+| --- | --- | --- | --- |
+| `quote_requests.expiry_days` | integer | `0` | Auto-expire Pending / Created from admin RFQs after N days. `0` disables. |
+| `quote_requests.show_add_to_quote_on_card` | boolean | `true` | Toggle the "Add to quote" button on storefront product cards. |
+| `quote_requests.show_add_to_quote_on_pdp` | boolean | `true` | Toggle the "Add to quote" button on product detail pages. |
+
+## Background jobs
+
+`RfqExpiryWorker.sweep()` runs every 30 minutes via the foundation
+BullMQ scheduler. It reads `quote_requests.expiry_days` from the
+settings module's resolved snapshot; if that value is 0 the sweep is
+a no-op. Otherwise it transitions every Pending and Created from
+admin row whose `updated_at < now() - INTERVAL <expiryDays> days` to
+`Expired`, writes one `expired` event per row, and fans out
+notifications to both parties.
+
+## Data model
+
+Three tables on top of the foundation `quote_requests` and
+`quote_request_items`:
+
+- `quote_request_revisions` — full snapshot per modify event.
+- `quote_request_events` — append-only history (one row per state
+  transition or modification, with discriminated-union payload).
+- `quote_request_notification_events` — one row per recipient ×
+  channel; unique on `(quote_request_id, source_event_id, recipient*,
+  channel)` so retries are idempotent.
+
+`organization_sales_rep_assignments` — the m:n relation between
+organizations and admin users that the visibility model above reads —
+is **not** one of them: it is owned by the `organizations` module,
+which qualifies the organization with it, and this module reaches it
+through that module's `organizationSalesRepScopePort`.
+
+The canonical `quote_requests` row carries the current state plus
+`current_revision_number`, `last_customer_seen_revision_number`, and
+`awaiting_customer_revision_acceptance`. The customer's "what changed
+since I last visited" diff is computed on read by comparing the
+revision identified by `last_customer_seen_revision_number` against
+the revision identified by `current_revision_number`.
+
+### `sales_channel_id` is nullable, and stays nullable
+
+Every request records the sales channel it was raised on, taken from
+the resolved request channel. The column is nullable and will remain
+so.
+
+It was added nullable on purpose: the deploy that shipped it must not
+depend on the boot-time default-channel reconciler having already run,
+which is the ordinary phased shape — add nullable, start writing,
+backfill, flip to `NOT NULL`. The middle step is the one that cannot
+be taken here. Nothing wrote the column between the migration that
+added it and the change that started populating it, so every request
+raised in that window carries `null`, and no record anywhere says
+which channel it came from. Projecting the system-default channel over
+that gap would not recover an attribution, it would invent one — and
+the sales-channel delete guard would then start refusing deletions on
+evidence the platform made up.
+
+A deployment that genuinely needs the column non-nullable therefore
+deletes the null tail, or takes a per-row answer from a source that
+knows one. There is no backfill script, and there deliberately never
+will be one.
+
+## Notifications
+
+Every state transition fans out through `RfqNotificationService` to
+the appropriate recipients (customer for admin-side actions, sales
+reps + platform admins for customer-side actions, both parties on
+expiry). Email and in-account channels both fire. The unique
+constraint on `quote_request_notification_events` guarantees once-only
+delivery per (transition, recipient, channel).
+
+## Conversion to order
+
+When an order is created with a populated `source_quote_request_id`,
+an event subscriber inside the module flips the originating Quote
+Request to `Completed`, populates `converted_order_id`, and fires the
+`completed` notification. The cart-creation step that locks RFQ
+agreed prices into a checkout cart is delivered through the existing
+cart and checkout flows.

package/i18n/en.json

@@ -0,0 +1,14 @@
+{
+  "actions.openInbox.label": "Open RFQ inbox",
+  "actions.openInbox.description": "Review pending quote requests",
+  "errors.RFQ_NOT_DRAFT": "Rfq Not Draft.",
+  "errors.RFQ_EMPTY": "Rfq Empty.",
+  "errors.RFQ_NOT_QUOTED": "Rfq Not Quoted.",
+  "errors.RFQ_NOT_ACCEPTED": "Rfq Not Accepted.",
+  "errors.RFQ_NOT_NEW": "Rfq Not New.",
+  "errors.RFQ_ALREADY_CLAIMED": "Rfq Already Claimed.",
+  "errors.RFQ_EXPIRED": "This quote is no longer valid — its validity period has ended. Ask your sales representative for a new quote, or submit the request again.",
+  "errors.QUOTE_INCOMPLETE": "Quote Incomplete.",
+  "errors.QUOTE_VALIDITY_ENDED": "The accepted quote is no longer valid — its validity period has ended. Ask your sales representative for a new quote before ordering.",
+  "nav.quoteRequests.label": "Quote requests"
+}

package/i18n/pl.json

@@ -0,0 +1,14 @@
+{
+  "actions.openInbox.label": "Otwórz skrzynkę zapytań",
+  "actions.openInbox.description": "Przejrzyj oczekujące zapytania ofertowe",
+  "errors.RFQ_NOT_DRAFT": "Błąd: rfq not draft.",
+  "errors.RFQ_EMPTY": "Błąd: rfq empty.",
+  "errors.RFQ_NOT_QUOTED": "Błąd: rfq not quoted.",
+  "errors.RFQ_NOT_ACCEPTED": "Błąd: rfq not accepted.",
+  "errors.RFQ_NOT_NEW": "Błąd: rfq not new.",
+  "errors.RFQ_ALREADY_CLAIMED": "Błąd: rfq already claimed.",
+  "errors.RFQ_EXPIRED": "Ta oferta straciła ważność — termin jej ważności upłynął. Poproś opiekuna handlowego o nową ofertę lub złóż zapytanie ponownie.",
+  "errors.QUOTE_INCOMPLETE": "Błąd: quote incomplete.",
+  "errors.QUOTE_VALIDITY_ENDED": "Zaakceptowana oferta straciła ważność — termin jej ważności upłynął. Przed złożeniem zamówienia poproś opiekuna handlowego o nową ofertę.",
+  "nav.quoteRequests.label": "Zapytania ofertowe"
+}

package/package.json

@@ -0,0 +1,99 @@
+{
+  "name": "@endora-commerce/mod-quote-requests",
+  "version": "0.100.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Customer-initiated RFQ workflow with admin pricing, approvals, and expiry.",
+  "license": "MIT",
+  "endora": {
+    "type": "module",
+    "id": "quote_requests"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/modules/quote_requests"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "default": "./dist/backend/index.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations/index.d.ts",
+      "default": "./dist/migrations/index.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "default": "./dist/admin/index.js"
+    },
+    "./tailwind.css": "./tailwind.css",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "i18n",
+    "docs",
+    "tailwind.css"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "peerDependencies": {
+    "@mikro-orm/core": "^6",
+    "@mikro-orm/migrations": "^6",
+    "@mikro-orm/postgresql": "^6",
+    "fastify": "^5",
+    "lucide-react": "^1",
+    "react": "^19",
+    "react-router-dom": "^7",
+    "zod": "^4",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "peerDependenciesMeta": {
+    "@endora-commerce/admin-kit": {
+      "optional": true
+    },
+    "lucide-react": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-router-dom": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@mikro-orm/core": "^6.6.13",
+    "@mikro-orm/migrations": "^6.6.13",
+    "@mikro-orm/postgresql": "^6.6.13",
+    "@types/node": "^22.9.0",
+    "@types/react": "^19.2.14",
+    "fastify": "^5.12.5",
+    "lucide-react": "^1.11.0",
+    "react": "^19.2.5",
+    "react-router-dom": "^7.18.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11",
+    "zod": "^4.2.0",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/platform": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.ui.json",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.ui.json --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}

package/tailwind.css

@@ -0,0 +1,14 @@
+/* @endora-commerce/mod-quote-requests — AUTO-GENERATED by `pnpm --filter backend run manifests:generate`.
+ *
+ * The `@source` directives this package asks its host to scan
+ * (`specs/110-instance-repository/contracts/admin-stylesheet-composition.md` R1).
+ * They resolve relative to **this file**, so they hold wherever the package is
+ * installed — a workspace link here, `node_modules` in a client's instance.
+ *
+ * The `dist` line is what a published tarball ships and is what an instance
+ * scans; the `src` line is inert there and is what keeps `pnpm --filter admin
+ * run dev` reading source in this repository. Do not edit: run
+ * `pnpm --filter backend run manifests:generate`.
+ */
+@source "./dist/admin";
+@source "./src/admin";