@endora-commerce/mod-quote-requests 0.100.0

package/dist/backend/index.js

@@ -0,0 +1,361 @@
+import { z } from 'zod';
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { QuoteRequestReadService } from './services/quote-request-read-port.js';
+import { registerQuoteRequestSalesChannelAttributions } from './services/sales-channel-attributions.js';
+import { lazyPort, SettingNotRegistered, SettingOutOfScopeForChannel, } from '@endora-commerce/platform/kernel';
+import { QUOTE_REQUESTS_SETTING_CODES } from '../manifest.js';
+import { quoteRequestsModule } from './plugin.js';
+import { QuoteRequest } from './entities/quote-request.entity.js';
+import { QuoteRequestEvent } from './entities/quote-request-event.entity.js';
+import { QuoteRequestItem } from './entities/quote-request-item.entity.js';
+import { QuoteRequestNotificationEvent } from './entities/quote-request-notification-event.entity.js';
+import { QuoteRequestRevision } from './entities/quote-request-revision.entity.js';
+/**
+ * `setting_values.sales_channel_id` is a `uuid` column, so a channel id that is
+ * not one cannot match a row — PostgreSQL rejects the comparison outright. The
+ * check is here rather than in the settings service because this is the caller
+ * that has somewhere to degrade to.
+ */
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Conditions this module has already reported. Module scope and never reset, so
+ * the guard is deliberately **per process** rather than per read: an unresolved
+ * channel or a mis-scoped setting is a deployment fact that holds for every
+ * subsequent read, and RFQ settings are read on every quote creation and every
+ * storefront page load. One line per condition is what makes it findable; one
+ * line per read is what makes it invisible. Same shape as
+ * `transactional_emails`' `noTransportWarned`.
+ */
+const warnedConditions = new Set();
+function warnOnce(condition, message) {
+    if (warnedConditions.has(condition))
+        return;
+    warnedConditions.add(condition);
+    console.warn(message);
+}
+/**
+ * The two actor-shaped names this module reads, defaulted here
+ * (`specs/117-instance-bring-up/` Phase 6, FR-033).
+ *
+ * They were contributed by `backend/src/composition.ts` and by
+ * `backend/test/helpers/test-server.ts` and by nothing else, so a composition
+ * that is neither of those two — which is every client instance, `composeApp`
+ * being the whole of what one calls — could not resolve them. `composeApp`'s
+ * own options say what that state is: `contribute` is *"the one slot where a
+ * value a module defaults may be overwritten"*, and a name **nothing** defaults
+ * supplied through it is a required value wearing an override's clothes.
+ *
+ * Both bodies are this module's own and carry no deployment judgement. They
+ * read `request.actor`, which is the platform's decoration since T118b, and
+ * three ports this manifest already declares as binding `dependencies`:
+ * `customer_accounts`, `admin_users` and `admin_roles`. A root that wants a
+ * different answer still contributes one — the test harness does, and its
+ * divergence is deliberate — which is what the window is for.
+ */
+function registerActorResolvers(ctx) {
+    ctx.di.register({
+        /**
+         * Who is asking, in this module's shape: the account, its Organization and
+         * whether the caller administers it.
+         *
+         * The Organization guard asserts an invariant rather than describing a
+         * business state (D-178) — `customer_accounts.organization_id` is `NOT NULL`
+         * and an individual is backed by a personal organisation — so a caller
+         * reaching it is a broken invariant and not a buyer who should be told to
+         * attach something they cannot attach. It is kept rather than deleted
+         * because `Actor`'s `organizationId` is `string | null` at this seam and
+         * `CustomerContext`'s is `string`.
+         */
+        rfqCustomerContextResolver: ctx
+            .asFunction(() => {
+            const accounts = lazyPort(ctx, 'customerAccountReadPort');
+            return async (request) => {
+                const actor = request.actor;
+                if (actor?.kind !== 'customer') {
+                    throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Customer session required.');
+                }
+                if (!actor.organizationId) {
+                    throw new HttpError(500, ERROR_CODES.INTERNAL, 'Invariant violated: a customer account has no Organization (Principle XI).', { code: 'customer_account_organization_missing' });
+                }
+                const account = await accounts.findById(actor.customerAccountId);
+                return {
+                    customerAccountId: actor.customerAccountId,
+                    organizationId: actor.organizationId,
+                    isOrgAdmin: account?.role === 'organization_admin',
+                };
+            };
+        })
+            .singleton(),
+        /**
+         * Who is administering, with the role the admin surface renders beside the
+         * RFQ and scopes its list by.
+         *
+         * `getById` rather than a nullable lookup, and it cannot 404 here:
+         * `admin_users_admin_role_fk` is `on delete restrict`, so a non-null
+         * `adminRoleId` names a row that exists.
+         */
+        rfqAdminContextResolver: ctx
+            .asFunction(() => {
+            const admins = lazyPort(ctx, 'adminUserReadPort');
+            const roles = lazyPort(ctx, 'adminRolePort');
+            return async (request) => {
+                const actor = request.actor;
+                if (actor?.kind !== 'admin') {
+                    throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Admin session required.');
+                }
+                const adminUser = await admins.findById(actor.adminUserId);
+                const role = adminUser?.adminRoleId ? await roles.getById(adminUser.adminRoleId) : null;
+                return {
+                    adminUserId: actor.adminUserId,
+                    isPlatformAdmin: role?.code === 'platform_admin',
+                    roleLabel: role?.code === 'platform_admin'
+                        ? 'Platform administrator'
+                        : role?.code === 'sales_representative'
+                            ? 'Sales representative'
+                            : (role?.name ?? 'Administrator'),
+                };
+            };
+        })
+            .singleton(),
+    });
+}
+/**
+ * The rate a quoted line is priced at (`specs/117-instance-bring-up/` Phase 6,
+ * FR-033).
+ *
+ * Two ports, both already binding `dependencies` of this manifest: the
+ * organisation's VAT status and country from `organizations`, and the rate
+ * itself from `taxes`.
+ *
+ * **No `catch`, and that is the design** (issue #84). `taxRateFor` answers
+ * "nothing applies" as a *value* — `{ source: 'none' }`, with no rate to read —
+ * so the only errors that reach this seam are a failing database and a
+ * switched-off owner, and returning 0 for either would quote a zero-VAT price
+ * on an operator's behalf and call it an answer. Both owners are
+ * `nonDeactivatable`, so neither has an off state here; the refusal is what
+ * reaches a caller if that ever changes.
+ */
+function registerTaxRateResolver(ctx) {
+    ctx.di.register({
+        rfqTaxRateResolver: ctx
+            .asFunction(() => {
+            const taxProfiles = lazyPort(ctx, 'organizationTaxProfilePort');
+            const taxes = lazyPort(ctx, 'taxService');
+            return async (organizationId) => {
+                const org = await taxProfiles.taxProfileOf(organizationId);
+                const vatStatus = org?.vatStatus ?? 'vat_payer';
+                if (vatStatus !== 'vat_payer')
+                    return 0;
+                const resolved = await taxes.taxRateFor({
+                    country: org?.country ?? 'PL',
+                    productType: 'simple',
+                    vatStatus,
+                });
+                // `none` is the operator's own configuration state — `taxes` is
+                // present and holds no rule that applies and no default — so a quote
+                // is priced net and the quote view drops its VAT row rather than
+                // printing a 0% one.
+                return resolved.source === 'none' ? 0 : resolved.rate;
+            };
+        })
+            .singleton(),
+    });
+}
+export function registerModule(ctx) {
+    registerActorResolvers(ctx);
+    registerTaxRateResolver(ctx);
+    ctx.di.register({
+        quoteRequests: ctx
+            .asFunction(({ emFactory, eventBus, auditLogService }) => {
+            /**
+             * This module's own settings, read through the port it already holds,
+             * against the **resolved** sales channel.
+             *
+             * It used to pass the literal `'default'` as the `salesChannelId`, a
+             * spelling that came down from the composition root T132 lifted this
+             * out of. `'default'` is a channel *code*; `setting_values.sales_channel_id`
+             * is `uuid`, so PostgreSQL rejected every one of these reads
+             * (`invalid input syntax for type uuid: "default"`), the bare `catch`
+             * below swallowed it, and all four settings answered with their module
+             * fallback on every call — expiry never applied, RFQ numbers never
+             * carried the configured prefix or suffix, and an operator switching a
+             * storefront flag off changed nothing.
+             *
+             * What the handler may absorb is now enumerated, because a bare `catch`
+             * around a port call turns fail-closed into fail-open
+             * (`docs/docs/architecture/kernel.md`; the composition checklist's rule 7):
+             *
+             *  - `SettingNotRegistered` — "no value configured yet", the normal
+             *    state before the manifest reconciler has run. Quiet fallback.
+             *  - `SettingOutOfScopeForChannel` — the operator scoped this setting to
+             *    other channels, so no value applies here. The module default is the
+             *    right answer, but the scoping is almost certainly unintended, so it
+             *    is warned about.
+             *  - everything else — a shape mismatch, a driver error, a
+             *    `ModuleDisabledError` from a switched-off owner — propagates.
+             */
+            const setting = async (code, schema, fallback) => {
+                const cradle = ctx.cradle();
+                const channelId = await cradle.settingsChannelResolver();
+                if (channelId === null || !UUID_PATTERN.test(channelId)) {
+                    // Both roots answer this resolver with the system-default channel's
+                    // id, falling back to `ORGANIZATIONS_SETTINGS_CHANNEL_ID` — an env
+                    // knob whose own default is the string `'default'`. So "no channel"
+                    // arrives here in two shapes, `null` and a non-uuid placeholder, and
+                    // neither can address a `setting_values` row. Degrading to the
+                    // module default keeps RFQs working, but silently is exactly the
+                    // failure above, so it is reported.
+                    warnOnce('unresolved-channel', `[quote_requests] no sales channel resolved for settings (got ` +
+                        `${channelId === null ? 'null' : `"${channelId}"`}) — every ` +
+                        `quote_requests.* setting falls back to its module default ` +
+                        `(logged once per process).`);
+                    return fallback;
+                }
+                try {
+                    return await cradle.settingsReadPort.get(code, channelId, schema);
+                }
+                catch (error) {
+                    if (error instanceof SettingNotRegistered)
+                        return fallback;
+                    if (error instanceof SettingOutOfScopeForChannel) {
+                        warnOnce(`out-of-scope:${code}`, `[quote_requests] setting "${code}" is not in scope for sales channel ` +
+                            `"${channelId}" — falling back to the module default ` +
+                            `(logged once per process).`);
+                        return fallback;
+                    }
+                    throw error;
+                }
+            };
+            return quoteRequestsModule({
+                emFactory,
+                eventBus,
+                auditLog: auditLogService,
+                customFieldValues: lazyPort(ctx, 'customFieldValueService'),
+                requireAdmin: (permission) => async (req, reply) => ctx.cradle().requireAdmin(permission)(req, reply),
+                requireCustomer: (req, reply) => ctx.cradle().requireCustomer(req, reply),
+                resolveCustomerContext: (req) => ctx.cradle().rfqCustomerContextResolver(req),
+                resolveAdminContext: (req) => ctx.cradle().rfqAdminContextResolver(req),
+                resolveTaxRate: (organizationId) => ctx.cradle().rfqTaxRateResolver(organizationId),
+                // Issue #108 — `organizations`' scope, resolved. This used to be the
+                // two feature-056 subtree deps, out of which this module built its own
+                // `SalesRepAssignmentService`: one of three assemblies of one class,
+                // and the shape whose optional third argument `customers` omitted.
+                salesRepAssignment: lazyPort(ctx, 'organizationSalesRepScopePort'),
+                // Feature 075, Phase C — the five owners this module read out of
+                // directly, and the one it wrote into. Each was an `em.find` /
+                // `em.create` against another module's table, which no gate can see;
+                // all six are already binding `dependencies` of this manifest, and
+                // `carts.replaceItemsForCustomer` moves the quote-to-cart conversion
+                // inside the module that owns the tables (D-78 rule 1).
+                catalogProducts: lazyPort(ctx, 'catalogProductReadPort'),
+                // Issue #259 — the channel assortment gate on the three quote-line
+                // seams. A kernel registration, so there is no seventh module edge.
+                channelMembership: lazyPort(ctx, 'salesChannelMembershipPort'),
+                customerAccounts: lazyPort(ctx, 'customerAccountReadPort'),
+                organizations: lazyPort(ctx, 'organizationDetailsPort'),
+                adminUsers: lazyPort(ctx, 'adminUserReadPort'),
+                orders: lazyPort(ctx, 'orderReadPort'),
+                carts: lazyPort(ctx, 'cartWritePort'),
+                resolveExpiryDays: () => setting(QUOTE_REQUESTS_SETTING_CODES.EXPIRY_DAYS, z.number().int().nonnegative(), 0),
+                resolveBoolSetting: (key) => setting(key === 'show_add_to_quote_on_card'
+                    ? QUOTE_REQUESTS_SETTING_CODES.SHOW_ADD_TO_QUOTE_ON_CARD
+                    : QUOTE_REQUESTS_SETTING_CODES.SHOW_ADD_TO_QUOTE_ON_PDP, z.boolean(), true),
+                resolveBusinessIdPrefix: () => setting(QUOTE_REQUESTS_SETTING_CODES.BUSINESS_ID_PREFIX, z.string(), ''),
+                resolveBusinessIdSuffix: () => setting(QUOTE_REQUESTS_SETTING_CODES.BUSINESS_ID_SUFFIX, z.string(), ''),
+            });
+        })
+            .singleton(),
+    });
+    // The type parameter is feature 075 Phase P's compile-time proof that the
+    // service still satisfies `RfqCustomerPort` — the two methods `carts`,
+    // `orders`, `shopping_lists`, `quick_order` and `customers` measurably call.
+    // Both already answer with contract DTOs, so no adapter was needed.
+    ctx.di.providePort('quoteRequestReadPort', ctx
+        .asFunction(({ emFactory }) => new QuoteRequestReadService(emFactory))
+        .singleton());
+    ctx.di.providePort('rfqService', ctx
+        .asFunction(({ quoteRequests }) => quoteRequests.handle().rfqService)
+        .singleton());
+    /**
+     * US5 — an order created from a quote request completes it (issue #107).
+     *
+     * This was a bare `eventBus.on` in the plugin body: with `quote_requests`
+     * switched off it still flipped the RFQ to Completed, appended a `completed`
+     * event row and enqueued the customer notification — while every route that
+     * could show the customer that quote request refused. `ctx.subscribe` makes
+     * the module's effective state decide.
+     */
+    ctx.subscribe('order.created.v1', async (payload) => {
+        await ctx
+            .cradle()
+            .quoteRequests.handle()
+            .orderCompletionReactor.onOrderCreated(payload);
+    });
+    /**
+     * How many quote requests are attributed to a sales channel (feature 075,
+     * D-87).
+     *
+     * `sales_channels` used to count them itself, naming this module's table and
+     * this module's column in raw SQL. A read port would have been the wrong
+     * repair and this module is the reason: `sales_channels` is
+     * `nonDeactivatable`, and the lifecycle refuses to disable a module a
+     * non-deactivatable one depends on, so a `dependencies` entry pointing this
+     * way would have made this module permanently undeactivatable in order to
+     * count rows before a channel delete.
+     *
+     * A **contribution** hook: it pushes an inert counter into
+     * `salesChannelAttributionRegistry`, an ungated registry, and carries no
+     * presence probe (D-67/D-68). It must not carry one for a second reason here
+     * — the registry's policy is to honour an absent contributor, because the
+     * rows survive a deactivation and `quote_requests_sales_channel_fk` is
+     * `on delete restrict`, so a probe would turn a 422 naming this module into a
+     * raw constraint violation.
+     */
+    ctx.onBoot(() => {
+        registerQuoteRequestSalesChannelAttributions(lazyPort(ctx, 'salesChannelAttributionRegistry'), ctx.cradle().emFactory);
+    });
+    ctx.routes(async (app) => {
+        await ctx.cradle().quoteRequests.register(app);
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform already reads, in two places: the boot-time
+ * loader (`src/packages/package-runtime.ts`, `exported['entities']`) and the
+ * static declaration reader (`scripts/lib/package-declarations.ts`), which is
+ * the third source of `check:module-boundary`'s `table→owner` map and the
+ * package pass of `check-entity-tenant-classification`. `blog` published
+ * `export *` lines instead until D-168, which satisfied only the committed host
+ * registry — the one path that stops being taken the day the module is
+ * *installed* rather than linked, at which point the loader read `undefined`,
+ * returned `[]`, and registered zero entities without a word.
+ *
+ * The absence of a named export is the load-bearing half. With one,
+ * `import type { QuoteRequest } from '@endora-commerce/mod-quote-requests/backend'`
+ * compiles in any consumer — ours, a deployment's, a stranger's — and only a
+ * check whose population is *this* repository could ever object. Without it,
+ * that import is TS2459 in the consumer's own tree (the barrel imports the
+ * classes to build the array, so TypeScript gives the more precise "declares it
+ * locally, but it is not exported"), which is Principle I holding by
+ * construction. Nothing legitimate is lost: D-32 already forbids an ORM
+ * relation from another module into these classes, and every other cross-module
+ * read goes through a contract type — `QuoteRequestReadPort` and
+ * `RfqCustomerPort`, both published above.
+ *
+ * Identity matters more here than anywhere else in the package: MikroORM keys
+ * its metadata on the class, so a consumer that reached these files by a second
+ * specifier would register a second `QuoteRequest` and lose one of them at
+ * discovery (D-160.6, measured). One array behind one declared subpath is the
+ * only way in.
+ */
+export const entities = [
+    QuoteRequest,
+    QuoteRequestEvent,
+    QuoteRequestItem,
+    QuoteRequestNotificationEvent,
+    QuoteRequestRevision,
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAiB3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,4CAA4C,EAAE,MAAM,0CAA0C,CAAC;AACxG,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAmC,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAiFnF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,iEAAiE,CAAC;AAEvF;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE3C,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO;IAC5C,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,sBAAsB,CAAC,GAAkB;IAChD,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd;;;;;;;;;;;WAWG;QACH,0BAA0B,EAAE,GAAG;aAC5B,UAAU,CAAC,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACnF,OAAO,KAAK,EAAE,OAAuB,EAAE,EAAE;gBACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA0B,CAAC;gBACjD,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC/B,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;gBACnF,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;oBAC1B,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,QAAQ,EACpB,4EAA4E,EAC5E,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAClD,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACjE,OAAO;oBACL,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,UAAU,EAAE,OAAO,EAAE,IAAI,KAAK,oBAAoB;iBACnD,CAAC;YACJ,CAAC,CAAC;QACJ,CAAC,CAAC;aACD,SAAS,EAAE;QACd;;;;;;;WAOG;QACH,uBAAuB,EAAE,GAAG;aACzB,UAAU,CAAC,GAAG,EAAE;YACf,MAAM,MAAM,GAAG,QAAQ,CAAoB,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,QAAQ,CAAgB,GAAG,EAAE,eAAe,CAAC,CAAC;YAC5D,OAAO,KAAK,EAAE,OAAuB,EAAE,EAAE;gBACvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA0B,CAAC;gBACjD,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC5B,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;gBAChF,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC3D,MAAM,IAAI,GAAG,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxF,OAAO;oBACL,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,eAAe,EAAE,IAAI,EAAE,IAAI,KAAK,gBAAgB;oBAChD,SAAS,EACP,IAAI,EAAE,IAAI,KAAK,gBAAgB;wBAC7B,CAAC,CAAC,wBAAwB;wBAC1B,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,sBAAsB;4BACrC,CAAC,CAAC,sBAAsB;4BACxB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,eAAe,CAAC;iBACxC,CAAC;YACJ,CAAC,CAAC;QACJ,CAAC,CAAC;aACD,SAAS,EAAE;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,uBAAuB,CAAC,GAAkB;IACjD,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,kBAAkB,EAAE,GAAG;aACpB,UAAU,CAAC,GAA8D,EAAE;YAC1E,MAAM,WAAW,GAAG,QAAQ,CAC1B,GAAG,EACH,4BAA4B,CAC7B,CAAC;YACF,MAAM,KAAK,GAAG,QAAQ,CAAiB,GAAG,EAAE,YAAY,CAAC,CAAC;YAC1D,OAAO,KAAK,EAAE,cAAsB,EAAE,EAAE;gBACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC3D,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,WAAW,CAAC;gBAChD,IAAI,SAAS,KAAK,WAAW;oBAAE,OAAO,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC;oBACtC,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;oBAC7B,WAAW,EAAE,QAAQ;oBACrB,SAAS;iBACV,CAAC,CAAC;gBACH,gEAAgE;gBAChE,qEAAqE;gBACrE,iEAAiE;gBACjE,qBAAqB;gBACrB,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxD,CAAC,CAAC;QACJ,CAAC,CAAC;aACD,SAAS,EAAE;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5B,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,aAAa,EAAE,GAAG;aACf,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAuB,EAAE,EAAE;YAC5E;;;;;;;;;;;;;;;;;;;;;;;;;;eA0BG;YACH,MAAM,OAAO,GAAG,KAAK,EACnB,IAAY,EACZ,MAAoB,EACpB,QAAW,EACC,EAAE;gBACd,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAuB,CAAC;gBACjD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,uBAAuB,EAAE,CAAC;gBACzD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxD,oEAAoE;oBACpE,mEAAmE;oBACnE,oEAAoE;oBACpE,qEAAqE;oBACrE,+DAA+D;oBAC/D,iEAAiE;oBACjE,oCAAoC;oBACpC,QAAQ,CACN,oBAAoB,EACpB,+DAA+D;wBAC7D,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,GAAG,YAAY;wBAC7D,4DAA4D;wBAC5D,4BAA4B,CAC/B,CAAC;oBACF,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBACD,IAAI,CAAC;oBACH,OAAO,MAAM,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBACpE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,oBAAoB;wBAAE,OAAO,QAAQ,CAAC;oBAC3D,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;wBACjD,QAAQ,CACN,gBAAgB,IAAI,EAAE,EACtB,6BAA6B,IAAI,sCAAsC;4BACrE,IAAI,SAAS,yCAAyC;4BACtD,4BAA4B,CAC/B,CAAC;wBACF,OAAO,QAAQ,CAAC;oBAClB,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC,CAAC;YAEF,OAAO,mBAAmB,CAAC;gBACzB,SAAS;gBACT,QAAQ;gBACR,QAAQ,EAAE,eAAe;gBACzB,iBAAiB,EAAE,QAAQ,CACzB,GAAG,EACH,yBAAyB,CAC1B;gBACD,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CACjD,GAAG,CAAC,MAAM,EAAuB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC;gBACxE,eAAe,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAC9B,GAAG,CAAC,MAAM,EAAuB,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC;gBAC/D,sBAAsB,EAAE,CAAC,GAAG,EAAE,EAAE,CAC9B,GAAG,CAAC,MAAM,EAAuB,CAAC,0BAA0B,CAAC,GAAG,CAAC;gBACnE,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE,CAC3B,GAAG,CAAC,MAAM,EAAuB,CAAC,uBAAuB,CAAC,GAAG,CAAC;gBAChE,cAAc,EAAE,CAAC,cAAc,EAAE,EAAE,CACjC,GAAG,CAAC,MAAM,EAAuB,CAAC,kBAAkB,CAAC,cAAc,CAAC;gBACtE,qEAAqE;gBACrE,uEAAuE;gBACvE,qEAAqE;gBACrE,mEAAmE;gBACnE,kBAAkB,EAAE,QAAQ,CAC1B,GAAG,EACH,+BAA+B,CAChC;gBACD,iEAAiE;gBACjE,+DAA+D;gBAC/D,qEAAqE;gBACrE,mEAAmE;gBACnE,qEAAqE;gBACrE,wDAAwD;gBACxD,eAAe,EAAE,QAAQ,CAAyB,GAAG,EAAE,wBAAwB,CAAC;gBAChF,mEAAmE;gBACnE,oEAAoE;gBACpE,iBAAiB,EAAE,QAAQ,CACzB,GAAG,EACH,4BAA4B,CAC7B;gBACD,gBAAgB,EAAE,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC;gBACnF,aAAa,EAAE,QAAQ,CAA0B,GAAG,EAAE,yBAAyB,CAAC;gBAChF,UAAU,EAAE,QAAQ,CAAoB,GAAG,EAAE,mBAAmB,CAAC;gBACjE,MAAM,EAAE,QAAQ,CAAgB,GAAG,EAAE,eAAe,CAAC;gBACrD,KAAK,EAAE,QAAQ,CAAgB,GAAG,EAAE,eAAe,CAAC;gBACpD,iBAAiB,EAAE,GAAG,EAAE,CACtB,OAAO,CAAC,4BAA4B,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBACtF,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAC1B,OAAO,CACL,GAAG,KAAK,2BAA2B;oBACjC,CAAC,CAAC,4BAA4B,CAAC,yBAAyB;oBACxD,CAAC,CAAC,4BAA4B,CAAC,wBAAwB,EACzD,CAAC,CAAC,OAAO,EAAE,EACX,IAAI,CACL;gBACH,uBAAuB,EAAE,GAAG,EAAE,CAC5B,OAAO,CAAC,4BAA4B,CAAC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;gBAC1E,uBAAuB,EAAE,GAAG,EAAE,CAC5B,OAAO,CAAC,4BAA4B,CAAC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;aAC3E,CAAC,CAAC;QACL,CAAC,CAAC;aACD,SAAS,EAAE;KACf,CAAC,CAAC;IAEH,0EAA0E;IAC1E,uEAAuE;IACvE,6EAA6E;IAC7E,oEAAoE;IACpE,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,sBAAsB,EACtB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAuB,EAAE,EAAE,CAAC,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAC/E;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,YAAY,EACZ,GAAG;SACA,UAAU,CAAC,CAAC,EAAE,aAAa,EAAuB,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC;SACzF,SAAS,EAAE,CACf,CAAC;IAEF;;;;;;;;OAQG;IACH,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClD,MAAM,GAAG;aACN,MAAM,EAAuB;aAC7B,aAAa,CAAC,MAAM,EAAE;aACtB,sBAAsB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,4CAA4C,CAC1C,QAAQ,CAAsC,GAAG,EAAE,iCAAiC,CAAC,EACrF,GAAG,CAAC,MAAM,EAAuB,CAAC,SAAS,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,GAAG,CAAC,MAAM,EAAuB,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,YAAY;IACZ,iBAAiB;IACjB,gBAAgB;IAChB,6BAA6B;IAC7B,oBAAoB;CACrB,CAAC"}

package/dist/backend/plugin.d.ts

@@ -0,0 +1,95 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { EventBus } from '@endora-commerce/platform/events';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { AdminUserReadPort, CartWritePort, CatalogProductReadPort, CustomerAccountReadPort, CustomFieldValuePort, OrderReadPort, OrganizationDetailsPort, SalesRepAssignmentPort } from '@endora-commerce/contracts';
+import { RfqService } from './services/rfq-service.js';
+import { RfqAdminService } from './services/rfq-admin-service.js';
+import { RfqExpiryWorker } from './services/rfq-expiry-worker.js';
+import { createOrderCompletionReactor } from './services/order-completion-reactor.js';
+import { type CustomerContextResolver, type RequireCustomerGuard } from './routes.customer.js';
+import { type AdminContextResolver } from './routes.admin.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import type { SalesChannelMembershipPort } from '@endora-commerce/platform/kernel';
+export interface QuoteRequestsModuleOptions {
+    emFactory: () => EntityManager;
+    eventBus: EventBus;
+    requireCustomer: RequireCustomerGuard;
+    requireAdmin: RequireAdminFactory;
+    resolveCustomerContext: CustomerContextResolver;
+    resolveAdminContext: AdminContextResolver;
+    /** Reads the current `quote_requests.expiry_days` from the settings module. */
+    resolveExpiryDays: () => Promise<number>;
+    /** Reads the storefront-visibility flags from settings. */
+    resolveBoolSetting: (key: 'show_add_to_quote_on_card' | 'show_add_to_quote_on_pdp') => Promise<boolean>;
+    /**
+     * Reads the business Quote Request ID prefix/suffix from settings
+     * (`quote_requests.business_id.*`). Optional — when omitted, generated IDs
+     * are the bare sequence number.
+     */
+    resolveBusinessIdPrefix?: () => Promise<string>;
+    resolveBusinessIdSuffix?: () => Promise<string>;
+    /**
+     * Feature 026 — refuses RFQ submission when the Customer's Organization is
+     * not `active`.
+     */
+    assertOrganizationCanTransact?: (organizationId: string) => Promise<void>;
+    /**
+     * Resolves the VAT rate (fraction, e.g. `0.23`) applied to a quote's net
+     * prices for the given Organization. Supplied by composition (reads the
+     * Organization VAT status + tax rules).
+     *
+     * Required since issue #124: omitting it quoted every organization at 0% VAT
+     * and called that a price, which is indistinguishable from a deployment whose
+     * rules genuinely say 0%. An absent `taxes` module now reaches the caller as
+     * the 503 `MODULE_DISABLED` envelope through this resolver.
+     */
+    resolveTaxRate: (organizationId: string) => Promise<number>;
+    /** Feature 054 — audits RFQ lifecycle writes co-transactionally when provided. */
+    auditLog?: AuditPort;
+    /** Feature 055 — validates + reads RFQ custom-field values on the admin edit path. */
+    customFieldValues?: CustomFieldValuePort;
+    /**
+     * Feature 075, Phase C — the five owners this module reads, and the one it
+     * writes. Each replaces an `em.find` against another module's table, which
+     * deactivation cannot reach; each owner is a binding dependency of this
+     * manifest, so every one of them fails closed.
+     */
+    catalogProducts: CatalogProductReadPort;
+    /**
+     * The sanctioned bridge accessor (Constitution XII), for the assortment gate
+     * a quote line owes (issue #259). Kernel-registered, so it is not one of the
+     * six module edges above.
+     */
+    channelMembership: SalesChannelMembershipPort;
+    customerAccounts: CustomerAccountReadPort;
+    organizations: OrganizationDetailsPort;
+    adminUsers: AdminUserReadPort;
+    orders: OrderReadPort;
+    carts: CartWritePort;
+    /**
+     * `organizations`' sales-rep assignment port (issue #108).
+     *
+     * This used to be `salesRepSubtree`, the feature-056 deps out of which this
+     * module built its **own** `SalesRepAssignmentService`. One class, assembled
+     * in three places — its owner and two consumers — and the assembly here was
+     * complete; the one in `customers` omitted the optional argument that carries
+     * the roll-up, which is what a copy makes possible. The scope is
+     * `organizations`', so it is resolved, not rebuilt.
+     */
+    salesRepAssignment: SalesRepAssignmentPort;
+}
+export interface QuoteRequestsModuleHandle {
+    /** US5 reactor; `backend.ts` owns its subscription. */
+    orderCompletionReactor: ReturnType<typeof createOrderCompletionReactor>;
+    expiryWorker: RfqExpiryWorker;
+    rfqService: RfqService;
+    adminService: RfqAdminService;
+    salesRepAssignment: SalesRepAssignmentPort;
+}
+export declare function quoteRequestsModule(options: QuoteRequestsModuleOptions): {
+    register: (app: FastifyInstance) => Promise<void>;
+    handle: () => QuoteRequestsModuleHandle;
+};
+export type { CustomerContextResolver, AdminContextResolver, RequireCustomerGuard, FastifyRequest };
+//# sourceMappingURL=plugin.d.ts.map

package/dist/backend/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EACV,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,UAAU,EAAoB,MAAM,2BAA2B,CAAC;AAEzE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAIlE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAWnF,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB,eAAe,EAAE,oBAAoB,CAAC;IACtC,YAAY,EAAE,mBAAmB,CAAC;IAClC,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,2DAA2D;IAC3D,kBAAkB,EAAE,CAAC,GAAG,EAAE,2BAA2B,GAAG,0BAA0B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxG;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;OAGG;IACH,6BAA6B,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E;;;;;;;;;OASG;IACH,cAAc,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,kFAAkF;IAClF,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,oBAAoB,CAAC;IACzC;;;;;OAKG;IACH,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,iBAAiB,EAAE,0BAA0B,CAAC;IAC9C,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,aAAa,EAAE,uBAAuB,CAAC;IACvC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,aAAa,CAAC;IACrB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,sBAAsB,CAAC;CAC5C;AAED,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,sBAAsB,EAAE,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC;IACxE,YAAY,EAAE,eAAe,CAAC;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,eAAe,CAAC;IAC9B,kBAAkB,EAAE,sBAAsB,CAAC;CAC5C;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG;IACxE,QAAQ,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,yBAAyB,CAAC;CACzC,CA6IA;AAED,YAAY,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC"}

package/dist/backend/plugin.js

@@ -0,0 +1,152 @@
+import { RfqService } from './services/rfq-service.js';
+import { createQuoteRequestBusinessIdGenerator } from './services/quote-request-business-id-generator.js';
+import { RfqAdminService } from './services/rfq-admin-service.js';
+import { RfqEventService } from './services/rfq-event-service.js';
+import { RfqRevisionService } from './services/rfq-revision-service.js';
+import { RfqNotificationService } from './services/rfq-notification-service.js';
+import { RfqExpiryWorker } from './services/rfq-expiry-worker.js';
+import { createOrderCompletionReactor } from './services/order-completion-reactor.js';
+import { registerQuoteRequestsCustomerRoutes, } from './routes.customer.js';
+import { registerQuoteRequestsAdminRoutes, } from './routes.admin.js';
+import { registerQuoteRequestsSalesRepRoutes } from './routes.sales-reps.js';
+import { ModuleDisabledError } from '@endora-commerce/platform/kernel';
+/**
+ * Conditions the storefront flag handler has already reported (D-43). Per
+ * process: these two flags are read on every product card render, so one line
+ * per condition is what makes a settings outage findable and one line per read
+ * is what buries it.
+ */
+const storefrontFlagWarned = new Set();
+export function quoteRequestsModule(options) {
+    const eventService = new RfqEventService(options.emFactory);
+    const revisionService = new RfqRevisionService(options.emFactory);
+    const notificationService = new RfqNotificationService(options.emFactory);
+    const salesRepAssignment = options.salesRepAssignment;
+    // Business Quote Request ID generator — adapts the composition-wired
+    // prefix/suffix resolver closures (SettingsService-backed) to the
+    // generator's settings port; the generator itself draws the sequence.
+    const businessIdGenerator = createQuoteRequestBusinessIdGenerator(options.resolveBusinessIdPrefix || options.resolveBusinessIdSuffix
+        ? {
+            resolvePrefix: () => options.resolveBusinessIdPrefix?.() ?? Promise.resolve(''),
+            resolveSuffix: () => options.resolveBusinessIdSuffix?.() ?? Promise.resolve(''),
+        }
+        : undefined);
+    const rfqService = new RfqService({
+        emFactory: options.emFactory,
+        events: options.eventBus,
+        eventService,
+        revisionService,
+        notificationService,
+        salesRepAssignment,
+        catalogProducts: options.catalogProducts,
+        channelMembership: options.channelMembership,
+        customerAccounts: options.customerAccounts,
+        adminUsers: options.adminUsers,
+        carts: options.carts,
+        businessId: businessIdGenerator,
+        resolveTaxRate: options.resolveTaxRate,
+        ...(options.auditLog ? { auditLog: options.auditLog } : {}),
+    });
+    const adminService = new RfqAdminService({
+        emFactory: options.emFactory,
+        events: options.eventBus,
+        rfqService,
+        eventService,
+        revisionService,
+        notificationService,
+        salesRepAssignment,
+        catalogProducts: options.catalogProducts,
+        customerAccounts: options.customerAccounts,
+        organizations: options.organizations,
+        adminUsers: options.adminUsers,
+        ...(options.auditLog ? { auditLog: options.auditLog } : {}),
+        ...(options.customFieldValues ? { customFieldValues: options.customFieldValues } : {}),
+    });
+    const expiryWorker = new RfqExpiryWorker({
+        emFactory: options.emFactory,
+        events: options.eventBus,
+        eventService,
+        notificationService,
+        salesRepAssignment,
+        adminUsers: options.adminUsers,
+        resolveExpiryDays: options.resolveExpiryDays,
+    });
+    // US5 — the `order.created.v1` reactor. `backend.ts` registers it through
+    // `ctx.subscribe`, so a switched-off module completes no quote request.
+    const orderCompletionReactor = createOrderCompletionReactor({
+        emFactory: options.emFactory,
+        orders: options.orders,
+        eventService,
+        notificationService,
+    });
+    return {
+        register: async (app) => {
+            await registerQuoteRequestsCustomerRoutes(app, {
+                rfqService,
+                requireCustomer: options.requireCustomer,
+                resolveCustomerContext: options.resolveCustomerContext,
+                ...(options.assertOrganizationCanTransact
+                    ? { assertOrganizationCanTransact: options.assertOrganizationCanTransact }
+                    : {}),
+            });
+            await registerQuoteRequestsAdminRoutes(app, {
+                adminService,
+                requireAdmin: options.requireAdmin,
+                resolveAdminContext: options.resolveAdminContext,
+            });
+            // D-166 — this module's one endpoint of the sales-rep pair, in this
+            // module's own file. It used to `import()` `organizations`' route file
+            // and register all four of its endpoints, which is what put a
+            // `quote_requests` gate on the assignment screen and an entry in each
+            // module's cross-module-import shard. The three endpoints that qualify an
+            // organisation are registered by `organizations` from its own
+            // `backend.ts` now, under a code that module declares.
+            await registerQuoteRequestsSalesRepRoutes(app, {
+                emFactory: options.emFactory,
+                requireAdmin: options.requireAdmin,
+                salesRepAssignment,
+                organizations: options.organizations,
+            });
+            // Storefront-public Quote Requests settings (FR-032 / FR-033) so the
+            // storefront can show/hide "Add to quote" buttons without going through
+            // the admin-gated settings endpoint. Reads through `resolveBoolSetting`,
+            // supplied by `backend.ts`, which already routes the two conditions D-43
+            // allows to the module default.
+            //
+            // The policy — a settings outage must not hide "Add to quote" — is right
+            // and stays. What was wrong is that a bare `catch` answered `true` for a
+            // **switched-off module** too, which Constitution XVII rule 5 forbids: a
+            // module that is off contributes no storefront element. So
+            // `ModuleDisabledError` is re-thrown, and anything else is reported once
+            // before the fail-open, because a fail-open nobody can see is the defect
+            // this whole cluster is about.
+            app.get('/api/v1/storefront/settings/quote-requests', async (_request, reply) => {
+                reply.header('cache-control', 'public, max-age=60');
+                try {
+                    const card = await options.resolveBoolSetting('show_add_to_quote_on_card');
+                    const pdp = await options.resolveBoolSetting('show_add_to_quote_on_pdp');
+                    return { data: { showAddToQuoteOnCard: card, showAddToQuoteOnPdp: pdp } };
+                }
+                catch (error) {
+                    if (error instanceof ModuleDisabledError)
+                        throw error;
+                    const name = error.name ?? 'Error';
+                    if (!storefrontFlagWarned.has(name)) {
+                        storefrontFlagWarned.add(name);
+                        app.log.warn({ err: error }, '[quote_requests] storefront flag settings unreadable — showing the ' +
+                            'quote affordances (logged once per condition per process)');
+                    }
+                    return { data: { showAddToQuoteOnCard: true, showAddToQuoteOnPdp: true } };
+                }
+            });
+        },
+        handle: () => ({
+            orderCompletionReactor,
+            expiryWorker,
+            rfqService,
+            adminService,
+            salesRepAssignment,
+        }),
+    };
+}
+//# sourceMappingURL=plugin.js.map

package/dist/backend/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAoB,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,mDAAmD,CAAC;AAC1G,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EACL,mCAAmC,GAGpC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,gCAAgC,GAEjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAG7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;AAgF/C,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IAIrE,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,IAAI,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAEtD,qEAAqE;IACrE,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,mBAAmB,GAAG,qCAAqC,CAC/D,OAAO,CAAC,uBAAuB,IAAI,OAAO,CAAC,uBAAuB;QAChE,CAAC,CAAC;YACE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;SAChF;QACH,CAAC,CAAC,SAAS,CACd,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,QAAuB;QACvC,YAAY;QACZ,eAAe;QACf,mBAAmB;QACnB,kBAAkB;QAClB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,mBAAmB;QAC/B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;QACvC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,QAAuB;QACvC,UAAU;QACV,YAAY;QACZ,eAAe;QACf,mBAAmB;QACnB,kBAAkB;QAClB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;QACvC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,QAAuB;QACvC,YAAY;QACZ,mBAAmB;QACnB,kBAAkB;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IAEH,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;QAC1D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY;QACZ,mBAAmB;KACpB,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,KAAK,EAAE,GAAoB,EAAiB,EAAE;YACtD,MAAM,mCAAmC,CAAC,GAAG,EAAE;gBAC7C,UAAU;gBACV,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;gBACtD,GAAG,CAAC,OAAO,CAAC,6BAA6B;oBACvC,CAAC,CAAC,EAAE,6BAA6B,EAAE,OAAO,CAAC,6BAA6B,EAAE;oBAC1E,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,MAAM,gCAAgC,CAAC,GAAG,EAAE;gBAC1C,YAAY;gBACZ,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;YACH,oEAAoE;YACpE,uEAAuE;YACvE,8DAA8D;YAC9D,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,uDAAuD;YACvD,MAAM,mCAAmC,CAAC,GAAG,EAAE;gBAC7C,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,kBAAkB;gBAClB,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;YAEH,qEAAqE;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,gCAAgC;YAChC,EAAE;YACF,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,2DAA2D;YAC3D,yEAAyE;YACzE,yEAAyE;YACzE,+BAA+B;YAC/B,GAAG,CAAC,GAAG,CAAC,4CAA4C,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;gBAC9E,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;gBACpD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;oBAC3E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;oBACzE,OAAO,EAAE,IAAI,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,CAAC;gBAC5E,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,mBAAmB;wBAAE,MAAM,KAAK,CAAC;oBACtD,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,IAAI,OAAO,CAAC;oBAC1D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACpC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC/B,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,qEAAqE;4BACnE,2DAA2D,CAC9D,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,GAA8B,EAAE,CAAC,CAAC;YACxC,sBAAsB;YACtB,YAAY;YACZ,UAAU;YACV,YAAY;YACZ,kBAAkB;SACnB,CAAC;KACH,CAAC;AACJ,CAAC"}