feat(commercial) : add Client API Platform provider + processor + business rules

Branche l'API REST du repertoire clients (M1) sur l'entite Client preparee en
ERP-54. Operations GetCollection / Get / Post / Patch (pas de Delete au M1 :
l'archivage passe par PATCH isArchived).

ClientProvider :
- liste paginee (Paginator ORM, aligne sur la convention ERP-72) + echappatoire
  ?pagination=false
- exclut archives + soft-deletes par defaut (RG-1.24), ?includeArchived=true
  reintegre les archives (RG-1.25)
- tri companyName ASC (RG-1.26), filtres ?search (fuzzy companyName/lastName/
  email) et ?categoryType=<code>
- detail : 404 sur soft-delete, embarque contacts/adresses/ribs

ClientProcessor :
- normalisation serveur via ClientFieldNormalizer (RG-1.18 a 1.21)
- 409 sur doublon de nom de societe (RG-1.16) ; 409 dedie sur conflit de
  restauration (RG-1.23)
- gating par onglet : champ comptable -> accounting.manage, isArchived ->
  archive, mode strict 403 sur tout le payload (RG-1.28) ; archivage exclusif
  (RG-1.22) + pose/retrait archivedAt
- regles metier RG-1.01 (prenom/nom), RG-1.03 (distributor/broker exclusifs +
  controle du type de categorie), RG-1.12 (Virement -> banque), RG-1.13 (LCR ->
  >= 1 RIB), RG-1.04 (completude Information pour le role Commerciale)

Lecture comptable conditionnelle : ClientReadGroupContextBuilder ajoute le
groupe client:read:accounting selon commercial.clients.accounting.view.

Resolution des references categorie : CategoryReferenceDenormalizer resout les
IRI vers Category quand la propriete est type-hintee par le contrat
CategoryInterface (denormalisation impossible sur une interface sinon).

Contrats Shared :
- CategoryInterface::getCategoryTypeCode() (implemente par Category) pour la
  verification de type sans import inter-modules
- BusinessRoleAwareInterface (implemente par User) + BusinessRoles::COMMERCIALE
  pour detecter le role metier ; le code de role sera seede par ERP-74 et
  reutilise par ERP-59/60. RG-1.04 reste dormante tant qu'aucun user ne porte
  ce role.

Coordination stack :
- chaines de permission commercial.clients.* referencees ici, declarees en
  ERP-59 (tests RBAC complets en ERP-60)
- config globale de pagination (itemsPerPage client, max 50) portee par ERP-72
- referentiels comptables (PaymentType/Bank/...) exposes en ERP-56

Tests : 31 tests Commercial (integration admin sur les regles metier + unitaires
sur le gating, RG-1.04/1.12/1.13 et le context builder). Suite complete verte
(339 tests).

config/packages/doctrine.yaml

@@ -37,6 +37,10 @@ doctrine:
             # Permet a Shared de referencer UserInterface dans ses ORM mappings sans
             # importer la classe concrete du module Core (cf. spec-back M0 § 2.8).
             Symfony\Component\Security\Core\User\UserInterface: App\Module\Core\Domain\Entity\User
+            # Cible des ManyToMany Client.categories / ClientAddress.categories (M1).
+            # Permet au module Commercial de referencer une Category via le contrat
+            # Shared sans importer la classe concrete du module Catalog (regle n°1).
+            App\Shared\Domain\Contract\CategoryInterface: App\Module\Catalog\Domain\Entity\Category
         mappings:
             Core:
                 type: attribute
@@ -66,6 +70,16 @@ doctrine:
                 dir: '%kernel.project_dir%/src/Module/Catalog/Domain/Entity'
                 prefix: 'App\Module\Catalog\Domain\Entity'
                 alias: Catalog
+            # Mapping inconditionnel du module Commercial (meme logique que Catalog) :
+            # les tables (client, sous-collections, referentiels comptables) creees
+            # par la migration M1 (Version20260601000000) doivent etre connues de
+            # l'ORM. L'activation fonctionnelle passe par config/modules.php.
+            Commercial:
+                type: attribute
+                is_bundle: false
+                dir: '%kernel.project_dir%/src/Module/Commercial/Domain/Entity'
+                prefix: 'App\Module\Commercial\Domain\Entity'
+                alias: Commercial
         controller_resolver:
             auto_mapping: false
 

makefile

@@ -200,13 +200,14 @@ migration-migrate:
 #     en DB, le purger crash.
 #  3. fixtures -> sync-permissions : fixtures:load purge la table permission,
 #     donc sync doit passer apres.
-#  4. recreation index `uq_category_name_type_active` : schema:update drop
-#     les index orphelins du mapping ORM. L'index partiel (LOWER + WHERE) du
-#     M0 Catalog n'est pas exprimable via les attributs Doctrine ORM 3
-#     (fonctionnel + partiel), donc il disparait apres schema:update. On le
-#     recree par dbal:run-sql pour que les tests RG-1.07 (unicite
-#     case-insensitive) voient bien la contrainte SQL. Sans ce restore, les
-#     POST doublons remontent 201 au lieu de 409.
+#  4. recreation des index partiels uniques : schema:update drop les index
+#     orphelins du mapping ORM. Les index partiels (LOWER + WHERE) ne sont pas
+#     exprimables via les attributs Doctrine ORM (fonctionnel + partiel), donc
+#     ils disparaissent apres schema:update. On les recree par dbal:run-sql :
+#       - `uq_category_name_type_active` (M0 Catalog) : tests RG-1.07.
+#       - `uq_client_company_name_active` (M1 Commercial) : unicite nom societe
+#         parmi actifs non archives/non supprimes (RG-1.16), tests ERP-55.
+#     Sans ces restores, les POST doublons remontent 201 au lieu de 409.
 #  5. app:apply-column-comments : meme cause, schema:update drop les COMMENT
 #     ON COLUMN/TABLE des tables managees par l'ORM (le mapping PHP ne porte
 #     pas d'attribut options['comment']). On rejoue le catalogue partage
@@ -220,6 +221,7 @@ test-db-setup:
 	$(SYMFONY_CONSOLE) --env=test --no-interaction doctrine:fixtures:load
 	$(SYMFONY_CONSOLE) --env=test --no-interaction app:sync-permissions
 	$(SYMFONY_CONSOLE) --env=test dbal:run-sql "CREATE UNIQUE INDEX IF NOT EXISTS uq_category_name_type_active ON category (LOWER(name), category_type_id) WHERE deleted_at IS NULL"
+	$(SYMFONY_CONSOLE) --env=test dbal:run-sql "CREATE UNIQUE INDEX IF NOT EXISTS uq_client_company_name_active ON client (LOWER(company_name)) WHERE is_archived = FALSE AND deleted_at IS NULL"
 
 fixtures:
 	$(SYMFONY_CONSOLE) --no-interaction doctrine:fixtures:load

migrations/Version20260528120000.php

@@ -39,7 +39,19 @@ final class Version20260528120000 extends AbstractMigration
 
     public function up(Schema $schema): void
     {
-        foreach (ColumnCommentsCatalog::toSqlStatements() as $sql) {
+        // Ne commente que les tables deja presentes a ce stade de la chaine de
+        // migrations. Les modules crees plus tard (ex: M1 Commercial, 06-01)
+        // figurent desormais dans le catalogue partage mais leurs tables
+        // n'existent pas encore ici : elles posent leurs propres COMMENT dans
+        // leur migration dediee (regle ABSOLUE n°12). Garde-fou indispensable,
+        // sinon l'ajout d'un module au catalogue casse ce retrofit avec un
+        // "relation X does not exist".
+        $existingTables = array_values(array_filter(
+            array_keys(ColumnCommentsCatalog::comments()),
+            static fn (string $table): bool => $schema->hasTable($table),
+        ));
+
+        foreach (ColumnCommentsCatalog::toSqlStatements($existingTables) as $sql) {
             $this->addSql($sql);
         }
     }
@@ -47,6 +59,13 @@ final class Version20260528120000 extends AbstractMigration
     public function down(Schema $schema): void
     {
         foreach (ColumnCommentsCatalog::comments() as $table => $entries) {
+            // Symetrie avec up() : on n'efface que les commentaires des tables
+            // presentes (les tables des modules ulterieurs sont gerees par leur
+            // propre migration).
+            if (!$schema->hasTable($table)) {
+                continue;
+            }
+
             $quotedTable = '"'.str_replace('"', '""', $table).'"';
             foreach ($entries as $column => $_) {
                 if ('_table' === $column) {

src/Module/Catalog/Domain/Entity/Category.php

@@ -15,6 +15,7 @@ use App\Module\Catalog\Infrastructure\ApiPlatform\State\Provider\CategoryProvide
 use App\Module\Catalog\Infrastructure\Doctrine\DoctrineCategoryRepository;
 use App\Shared\Domain\Attribute\Auditable;
 use App\Shared\Domain\Contract\BlamableInterface;
+use App\Shared\Domain\Contract\CategoryInterface;
 use App\Shared\Domain\Contract\TimestampableInterface;
 use App\Shared\Domain\Trait\TimestampableBlamableTrait;
 use DateTimeImmutable;
@@ -82,7 +83,7 @@ use Symfony\Component\Validator\Constraints as Assert;
 #[ORM\Index(name: 'idx_category_created_by', columns: ['created_by'])]
 #[ORM\Index(name: 'idx_category_updated_by', columns: ['updated_by'])]
 #[Auditable]
-class Category implements TimestampableInterface, BlamableInterface
+class Category implements TimestampableInterface, BlamableInterface, CategoryInterface
 {
     // === Timestampable + Blamable ===
     // Les 4 colonnes (created_at, updated_at, created_by, updated_by) + leurs
@@ -152,6 +153,16 @@ class Category implements TimestampableInterface, BlamableInterface
         return $this;
     }
 
+    /**
+     * Implemente CategoryInterface : code du type rattache (ou null). Permet
+     * aux modules tiers de filtrer/valider par type metier sans dependre de
+     * Catalog.
+     */
+    public function getCategoryTypeCode(): ?string
+    {
+        return $this->categoryType?->getCode();
+    }
+
     public function getDeletedAt(): ?DateTimeImmutable
     {
         return $this->deletedAt;

src/Module/Commercial/Application/Service/ClientFieldNormalizer.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Application\Service;
+
+/**
+ * Normalisation serveur des champs texte d'un Client / ClientContact, appliquee
+ * par le ClientProcessor (et plus tard le ClientContactProcessor) AVANT
+ * persistance. Cf. spec-back M1 § 2.9 + RG-1.18 a RG-1.21.
+ *
+ * - companyName  : UPPERCASE integral (RG-1.18)
+ * - firstName / lastName (personnes) : Title Case (RG-1.19)
+ * - phone* : chiffres uniquement, ex "06.12.34.56.78" -> "0612345678" (RG-1.20).
+ *   Le formatage d'affichage "XX XX XX XX XX" est de la responsabilite du front.
+ * - email : lowercase integral (RG-1.21)
+ *
+ * Toutes les methodes sont null-safe et trim-ent l'entree ; une chaine vide
+ * apres trim devient null (evite de persister "" dans des colonnes nullable).
+ */
+final class ClientFieldNormalizer
+{
+    /**
+     * Nom de societe en majuscules (RG-1.18). Conserve null tel quel ; une
+     * chaine non vide est trim + upper. Une chaine vide reste "" (champ
+     * obligatoire : c'est l'Assert\NotBlank qui rejette, pas le normalizer).
+     */
+    public function normalizeCompanyName(?string $value): ?string
+    {
+        if (null === $value) {
+            return null;
+        }
+
+        return mb_strtoupper(trim($value), 'UTF-8');
+    }
+
+    /**
+     * Nom/prenom de personne en Title Case (RG-1.19) : "JEAN dupont" ->
+     * "Jean Dupont". Une chaine vide apres trim devient null.
+     */
+    public function normalizePersonName(?string $value): ?string
+    {
+        if (null === $value) {
+            return null;
+        }
+
+        $value = trim($value);
+
+        return '' === $value ? null : mb_convert_case($value, MB_CASE_TITLE, 'UTF-8');
+    }
+
+    /**
+     * Email en minuscules (RG-1.21). Une chaine vide apres trim devient null.
+     */
+    public function normalizeEmail(?string $value): ?string
+    {
+        if (null === $value) {
+            return null;
+        }
+
+        $value = trim($value);
+
+        return '' === $value ? null : mb_strtolower($value, 'UTF-8');
+    }
+
+    /**
+     * Telephone reduit aux chiffres (RG-1.20) : "06.12.34.56.78" ->
+     * "0612345678". Une valeur sans aucun chiffre devient null.
+     */
+    public function normalizePhone(?string $value): ?string
+    {
+        if (null === $value) {
+            return null;
+        }
+
+        $digits = preg_replace('/\D+/', '', $value) ?? '';
+
+        return '' === $digits ? null : $digits;
+    }
+}

src/Module/Commercial/Application/Validator/ClientInformationCompletenessValidator.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Application\Validator;
+
+use ApiPlatform\Validator\Exception\ValidationException;
+use App\Module\Commercial\Domain\Entity\Client;
+use Symfony\Component\Validator\ConstraintViolation;
+use Symfony\Component\Validator\ConstraintViolationList;
+
+/**
+ * Validator metier RG-1.04 : pour un utilisateur portant le role metier
+ * Commerciale, TOUS les champs de l'onglet Information deviennent obligatoires
+ * lors d'un PATCH touchant le groupe `client:write:information`.
+ *
+ * Invoque par le ClientProcessor UNIQUEMENT quand les deux conditions sont
+ * reunies (role Commerciale + payload touchant l'onglet Information). Pour les
+ * autres roles, ces champs restent optionnels — le validator n'est pas appele.
+ *
+ * Tant qu'aucun user ne porte le role `commerciale` (seede par ERP-74,
+ * cf. App\Shared\Domain\Security\BusinessRoles::COMMERCIALE), cette regle reste
+ * DORMANTE : aucun appelant ne la declenche.
+ *
+ * Leve une ValidationException (HTTP 422) listant chaque champ manquant, par
+ * coherence avec les violations Symfony rendues par API Platform.
+ */
+final class ClientInformationCompletenessValidator
+{
+    public function validate(Client $client): void
+    {
+        // Map champ -> valeur courante de l'onglet Information.
+        $fields = [
+            'description'    => $client->getDescription(),
+            'competitors'    => $client->getCompetitors(),
+            'foundedAt'      => $client->getFoundedAt(),
+            'employeesCount' => $client->getEmployeesCount(),
+            'revenueAmount'  => $client->getRevenueAmount(),
+            'directorName'   => $client->getDirectorName(),
+            'profitAmount'   => $client->getProfitAmount(),
+        ];
+
+        $violations = new ConstraintViolationList();
+
+        foreach ($fields as $property => $value) {
+            if ($this->isMissing($value)) {
+                $violations->add(new ConstraintViolation(
+                    sprintf('Ce champ est obligatoire pour le role Commerciale (champ "%s").', $property),
+                    null,
+                    [],
+                    $client,
+                    $property,
+                    $value,
+                ));
+            }
+        }
+
+        if (count($violations) > 0) {
+            throw new ValidationException($violations);
+        }
+    }
+
+    /**
+     * Une valeur est manquante si null ou, pour une chaine, vide apres trim.
+     * Les zeros numeriques (employeesCount = 0, profitAmount = "0.00") sont des
+     * valeurs valides : on ne les considere pas manquants.
+     */
+    private function isMissing(mixed $value): bool
+    {
+        if (null === $value) {
+            return true;
+        }
+
+        return is_string($value) && '' === trim($value);
+    }
+}

src/Module/Commercial/Domain/Entity/Bank.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Entity;
+
+use App\Module\Commercial\Infrastructure\Doctrine\DoctrineBankRepository;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+
+/**
+ * Banque selectionnable pour le reglement par virement (Societe Generale,
+ * CIC, Credit Agricole) : referentiel statique seede par la migration M1 et
+ * re-seede en dev/test par CommercialReferentialFixtures.
+ *
+ * Lecture seule au M1 (HP-M2-2). Pas de Timestampable/Blamable (referentiel
+ * statique whiteliste dans EntitiesAreTimestampableBlamableTest::EXCLUDED). Le
+ * groupe `client:read:accounting` permet l'embarquement dans la reponse Client.
+ */
+#[ORM\Entity(repositoryClass: DoctrineBankRepository::class)]
+#[ORM\Table(name: 'bank')]
+#[ORM\UniqueConstraint(name: 'uq_bank_code', columns: ['code'])]
+class Bank
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['bank:read', 'client:read:accounting'])]
+    private ?int $id = null;
+
+    #[ORM\Column(length: 30)]
+    #[Groups(['bank:read', 'client:read:accounting'])]
+    private ?string $code = null;
+
+    #[ORM\Column(length: 120)]
+    #[Groups(['bank:read', 'client:read:accounting'])]
+    private ?string $label = null;
+
+    #[ORM\Column(options: ['default' => 0])]
+    #[Groups(['bank:read'])]
+    private int $position = 0;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getCode(): ?string
+    {
+        return $this->code;
+    }
+
+    public function setCode(string $code): static
+    {
+        $this->code = $code;
+
+        return $this;
+    }
+
+    public function getLabel(): ?string
+    {
+        return $this->label;
+    }
+
+    public function setLabel(string $label): static
+    {
+        $this->label = $label;
+
+        return $this;
+    }
+
+    public function getPosition(): int
+    {
+        return $this->position;
+    }
+
+    public function setPosition(int $position): static
+    {
+        $this->position = $position;
+
+        return $this;
+    }
+}

src/Module/Commercial/Domain/Entity/Client.php

@@ -0,0 +1,711 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Entity;
+
+use ApiPlatform\Metadata\ApiResource;
+use ApiPlatform\Metadata\Get;
+use ApiPlatform\Metadata\GetCollection;
+use ApiPlatform\Metadata\Patch;
+use ApiPlatform\Metadata\Post;
+use App\Module\Commercial\Infrastructure\ApiPlatform\State\Processor\ClientProcessor;
+use App\Module\Commercial\Infrastructure\ApiPlatform\State\Provider\ClientProvider;
+use App\Module\Commercial\Infrastructure\Doctrine\DoctrineClientRepository;
+use App\Shared\Domain\Attribute\Auditable;
+use App\Shared\Domain\Contract\BlamableInterface;
+use App\Shared\Domain\Contract\CategoryInterface;
+use App\Shared\Domain\Contract\TimestampableInterface;
+use App\Shared\Domain\Trait\TimestampableBlamableTrait;
+use DateTimeImmutable;
+use Doctrine\Common\Collections\ArrayCollection;
+use Doctrine\Common\Collections\Collection;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+use Symfony\Component\Serializer\Attribute\SerializedName;
+use Symfony\Component\Validator\Constraints as Assert;
+
+/**
+ * Client (M1 Commercial) — entite racine du repertoire clients. Porte le
+ * formulaire principal, l'onglet Information, l'onglet Comptabilite, le
+ * mecanisme d'archivage (is_archived / archived_at) et le soft-delete technique
+ * prepare mais non expose au M1 (deleted_at, HP-M2-1).
+ *
+ * Decisions structurantes :
+ *  - Audit complet (#[Auditable]) sur tous les champs (M2M categories audite
+ *    automatiquement). Timestampable/Blamable via le trait Shared.
+ *  - PAS de #[ORM\UniqueConstraint] : l'unicite du nom de societe (RG-1.16) est
+ *    portee par l'index partiel fonctionnel uq_client_company_name_active
+ *    (LOWER(company_name) WHERE is_archived = FALSE AND deleted_at IS NULL),
+ *    inexprimable en attribut ORM, donc possede par la seule migration. Le SIREN
+ *    et l'email NE SONT PAS uniques (RG-1.15/1.17 supprimees, decision Q4).
+ *  - distributor / broker : 2 FK auto-referentes mutuellement exclusives
+ *    (RG-1.03, CHECK chk_client_distrib_or_broker en base).
+ *  - categories : M2M vers Category (module Catalog) via le contrat
+ *    CategoryInterface + resolve_target_entities (regle n°1, pas d'import direct).
+ *
+ * Operations API (Provider + Processor) branchees en ERP-55 :
+ *  - GetCollection / Get : security commercial.clients.view. La liste expose le
+ *    groupe client:read ; le detail embarque en plus contacts/adresses/ribs
+ *    (groupe client:item:read). Les champs comptables (client:read:accounting)
+ *    sont ajoutes DYNAMIQUEMENT par ClientReadGroupContextBuilder si l'user a
+ *    la permission accounting.view (§ 2.7 / § 4.1 / § 4.2).
+ *  - Post / Patch : security commercial.clients.manage ; le ClientProcessor
+ *    applique normalisation, gating accounting/archive et regles metier.
+ *  - Pas de Delete au M1 (HP-M2-1) : l'archivage passe par PATCH isArchived.
+ */
+#[ApiResource(
+    operations: [
+        new GetCollection(
+            security: "is_granted('commercial.clients.view')",
+            normalizationContext: ['groups' => ['client:read', 'default:read']],
+            provider: ClientProvider::class,
+        ),
+        new Get(
+            security: "is_granted('commercial.clients.view')",
+            // Detail : client + sous-collections embarquees. Le groupe
+            // client:read:accounting est ajoute par le context builder selon la
+            // permission, donc absent ici volontairement.
+            normalizationContext: ['groups' => [
+                'client:read',
+                'client:item:read',
+                'client_contact:read',
+                'client_address:read',
+                'client_rib:read',
+                'default:read',
+            ]],
+            provider: ClientProvider::class,
+        ),
+        new Post(
+            security: "is_granted('commercial.clients.manage')",
+            normalizationContext: ['groups' => ['client:read', 'default:read']],
+            denormalizationContext: ['groups' => ['client:write:main']],
+            processor: ClientProcessor::class,
+        ),
+        new Patch(
+            security: "is_granted('commercial.clients.manage')",
+            // Le ClientProcessor inspecte les champs reellement envoyes pour
+            // autoriser/refuser onglet par onglet (RG-1.22 / RG-1.28) : les
+            // champs accounting exigent accounting.manage, isArchived exige
+            // archive.
+            normalizationContext: ['groups' => ['client:read', 'default:read']],
+            denormalizationContext: ['groups' => [
+                'client:write:main',
+                'client:write:information',
+                'client:write:accounting',
+                'client:write:archive',
+            ]],
+            provider: ClientProvider::class,
+            processor: ClientProcessor::class,
+        ),
+    ],
+)]
+#[ORM\Entity(repositoryClass: DoctrineClientRepository::class)]
+#[ORM\Table(name: 'client')]
+// Index nommes pour matcher la migration (Version20260601000000). L'index
+// unique partiel uq_client_company_name_active reste possede par la migration :
+// Doctrine ORM ne sait pas exprimer un index fonctionnel (LOWER) + partiel
+// (WHERE) via attribut. Pas de #[ORM\UniqueConstraint] (decision Q4).
+#[ORM\Index(name: 'idx_client_is_archived', columns: ['is_archived'])]
+#[ORM\Index(name: 'idx_client_deleted_at', columns: ['deleted_at'])]
+#[ORM\Index(name: 'idx_client_distributor_id', columns: ['distributor_id'])]
+#[ORM\Index(name: 'idx_client_broker_id', columns: ['broker_id'])]
+#[ORM\Index(name: 'idx_client_created_by', columns: ['created_by'])]
+#[ORM\Index(name: 'idx_client_updated_by', columns: ['updated_by'])]
+#[Auditable]
+class Client implements TimestampableInterface, BlamableInterface
+{
+    use TimestampableBlamableTrait;
+
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['client:read'])]
+    private ?int $id = null;
+
+    // === Formulaire principal ===
+    #[ORM\Column(length: 180)]
+    #[Assert\NotBlank(message: 'Le nom de l\'entreprise est obligatoire.', normalizer: 'trim')]
+    #[Assert\Length(min: 2, max: 180, normalizer: 'trim')]
+    #[Groups(['client:read', 'client:write:main'])]
+    private ?string $companyName = null;
+
+    // RG-1.01 : firstName OU lastName obligatoire (validation au futur Processor).
+    #[ORM\Column(length: 120, nullable: true)]
+    #[Assert\Length(max: 120, normalizer: 'trim')]
+    #[Groups(['client:read', 'client:write:main'])]
+    private ?string $firstName = null;
+
+    #[ORM\Column(length: 120, nullable: true)]
+    #[Assert\Length(max: 120, normalizer: 'trim')]
+    #[Groups(['client:read', 'client:write:main'])]
+    private ?string $lastName = null;
+
+    #[ORM\Column(length: 20)]
+    #[Assert\NotBlank]
+    #[Groups(['client:read', 'client:write:main'])]
+    private ?string $phonePrimary = null;
+
+    #[ORM\Column(length: 20, nullable: true)]
+    #[Groups(['client:read', 'client:write:main'])]
+    private ?string $phoneSecondary = null;
+
+    #[ORM\Column(length: 180)]
+    #[Assert\NotBlank]
+    #[Assert\Email]
+    #[Groups(['client:read', 'client:write:main'])]
+    private ?string $email = null;
+
+    // RG-1.03 : distributor / broker auto-references mutuellement exclusives
+    // (CHECK chk_client_distrib_or_broker en base).
+    #[ORM\ManyToOne(targetEntity: self::class)]
+    #[ORM\JoinColumn(name: 'distributor_id', referencedColumnName: 'id', nullable: true, onDelete: 'SET NULL')]
+    #[Groups(['client:read', 'client:write:main'])]
+    private ?Client $distributor = null;
+
+    #[ORM\ManyToOne(targetEntity: self::class)]
+    #[ORM\JoinColumn(name: 'broker_id', referencedColumnName: 'id', nullable: true, onDelete: 'SET NULL')]
+    #[Groups(['client:read', 'client:write:main'])]
+    private ?Client $broker = null;
+
+    #[ORM\Column(name: 'triage_service', options: ['default' => false])]
+    #[Groups(['client:read', 'client:write:main'])]
+    private bool $triageService = false;
+
+    // RG : au moins une categorie (Count min 1). M2M vers Category via le contrat
+    // CategoryInterface (resolve_target_entities -> Category).
+    /** @var Collection<int, CategoryInterface> */
+    #[ORM\ManyToMany(targetEntity: CategoryInterface::class)]
+    #[ORM\JoinTable(name: 'client_category')]
+    #[ORM\JoinColumn(name: 'client_id', referencedColumnName: 'id', onDelete: 'CASCADE')]
+    #[ORM\InverseJoinColumn(name: 'category_id', referencedColumnName: 'id', onDelete: 'RESTRICT')]
+    #[Assert\Count(min: 1, minMessage: 'Au moins une catégorie est obligatoire.')]
+    #[Groups(['client:read', 'client:write:main'])]
+    private Collection $categories;
+
+    // === Onglet Information ===
+    #[ORM\Column(type: 'text', nullable: true)]
+    #[Groups(['client:read', 'client:write:information'])]
+    private ?string $description = null;
+
+    #[ORM\Column(length: 255, nullable: true)]
+    #[Groups(['client:read', 'client:write:information'])]
+    private ?string $competitors = null;
+
+    #[ORM\Column(type: 'date_immutable', nullable: true)]
+    #[Groups(['client:read', 'client:write:information'])]
+    private ?DateTimeImmutable $foundedAt = null;
+
+    #[ORM\Column(nullable: true)]
+    #[Assert\PositiveOrZero]
+    #[Groups(['client:read', 'client:write:information'])]
+    private ?int $employeesCount = null;
+
+    #[ORM\Column(type: 'decimal', precision: 15, scale: 2, nullable: true)]
+    #[Groups(['client:read', 'client:write:information'])]
+    private ?string $revenueAmount = null;
+
+    #[ORM\Column(length: 120, nullable: true)]
+    #[Groups(['client:read', 'client:write:information'])]
+    private ?string $directorName = null;
+
+    #[ORM\Column(type: 'decimal', precision: 15, scale: 2, nullable: true)]
+    #[Groups(['client:read', 'client:write:information'])]
+    private ?string $profitAmount = null;
+
+    // === Onglet Comptabilite ===
+    // Lecture conditionnee via le groupe `client:read:accounting` (ajoute par le
+    // futur Provider si l'user a la permission accounting.view). Ecriture via
+    // `client:write:accounting` (le futur Processor exige accounting.manage).
+    #[ORM\Column(length: 20, nullable: true)]
+    #[Groups(['client:read:accounting', 'client:write:accounting'])]
+    private ?string $siren = null;
+
+    #[ORM\Column(length: 40, nullable: true)]
+    #[Groups(['client:read:accounting', 'client:write:accounting'])]
+    private ?string $accountNumber = null;
+
+    #[ORM\ManyToOne(targetEntity: TvaMode::class)]
+    #[ORM\JoinColumn(name: 'tva_mode_id', referencedColumnName: 'id', nullable: true, onDelete: 'RESTRICT')]
+    #[Groups(['client:read:accounting', 'client:write:accounting'])]
+    private ?TvaMode $tvaMode = null;
+
+    #[ORM\Column(length: 40, nullable: true)]
+    #[Groups(['client:read:accounting', 'client:write:accounting'])]
+    private ?string $nTva = null;
+
+    #[ORM\ManyToOne(targetEntity: PaymentDelay::class)]
+    #[ORM\JoinColumn(name: 'payment_delay_id', referencedColumnName: 'id', nullable: true, onDelete: 'RESTRICT')]
+    #[Groups(['client:read:accounting', 'client:write:accounting'])]
+    private ?PaymentDelay $paymentDelay = null;
+
+    #[ORM\ManyToOne(targetEntity: PaymentType::class)]
+    #[ORM\JoinColumn(name: 'payment_type_id', referencedColumnName: 'id', nullable: true, onDelete: 'RESTRICT')]
+    #[Groups(['client:read:accounting', 'client:write:accounting'])]
+    private ?PaymentType $paymentType = null;
+
+    #[ORM\ManyToOne(targetEntity: Bank::class)]
+    #[ORM\JoinColumn(name: 'bank_id', referencedColumnName: 'id', nullable: true, onDelete: 'RESTRICT')]
+    #[Groups(['client:read:accounting', 'client:write:accounting'])]
+    private ?Bank $bank = null;
+
+    // === Sous-collections (exposees via sous-ressources API dediees, ulterieur) ===
+    /** @var Collection<int, ClientContact> */
+    #[ORM\OneToMany(mappedBy: 'client', targetEntity: ClientContact::class, cascade: ['persist', 'remove'], orphanRemoval: true)]
+    private Collection $contacts;
+
+    /** @var Collection<int, ClientAddress> */
+    #[ORM\OneToMany(mappedBy: 'client', targetEntity: ClientAddress::class, cascade: ['persist', 'remove'], orphanRemoval: true)]
+    private Collection $addresses;
+
+    /** @var Collection<int, ClientRib> */
+    #[ORM\OneToMany(mappedBy: 'client', targetEntity: ClientRib::class, cascade: ['persist', 'remove'], orphanRemoval: true)]
+    private Collection $ribs;
+
+    // === Archive / Soft delete ===
+    // Groupe d'ECRITURE uniquement sur la propriete (denormalisation PATCH
+    // archive). Le groupe de LECTURE est declare sur le getter isArchived()
+    // avec SerializedName('isArchived') : sans cela, Symfony strip le prefixe
+    // "is" et exposerait la cle JSON "archived" (meme pattern que User::isAdmin
+    // et Role::isSystem).
+    #[ORM\Column(name: 'is_archived', options: ['default' => false])]
+    #[Groups(['client:write:archive'])]
+    private bool $isArchived = false;
+
+    #[ORM\Column(type: 'datetime_immutable', nullable: true)]
+    #[Groups(['client:read'])]
+    private ?DateTimeImmutable $archivedAt = null;
+
+    // Soft delete technique (HP-M2-1) : non expose en lecture/ecriture au M1.
+    #[ORM\Column(type: 'datetime_immutable', nullable: true)]
+    private ?DateTimeImmutable $deletedAt = null;
+
+    public function __construct()
+    {
+        $this->categories = new ArrayCollection();
+        $this->contacts   = new ArrayCollection();
+        $this->addresses  = new ArrayCollection();
+        $this->ribs       = new ArrayCollection();
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getCompanyName(): ?string
+    {
+        return $this->companyName;
+    }
+
+    public function setCompanyName(string $companyName): static
+    {
+        $this->companyName = $companyName;
+
+        return $this;
+    }
+
+    public function getFirstName(): ?string
+    {
+        return $this->firstName;
+    }
+
+    public function setFirstName(?string $firstName): static
+    {
+        $this->firstName = $firstName;
+
+        return $this;
+    }
+
+    public function getLastName(): ?string
+    {
+        return $this->lastName;
+    }
+
+    public function setLastName(?string $lastName): static
+    {
+        $this->lastName = $lastName;
+
+        return $this;
+    }
+
+    public function getPhonePrimary(): ?string
+    {
+        return $this->phonePrimary;
+    }
+
+    public function setPhonePrimary(string $phonePrimary): static
+    {
+        $this->phonePrimary = $phonePrimary;
+
+        return $this;
+    }
+
+    public function getPhoneSecondary(): ?string
+    {
+        return $this->phoneSecondary;
+    }
+
+    public function setPhoneSecondary(?string $phoneSecondary): static
+    {
+        $this->phoneSecondary = $phoneSecondary;
+
+        return $this;
+    }
+
+    public function getEmail(): ?string
+    {
+        return $this->email;
+    }
+
+    public function setEmail(string $email): static
+    {
+        $this->email = $email;
+
+        return $this;
+    }
+
+    public function getDistributor(): ?Client
+    {
+        return $this->distributor;
+    }
+
+    public function setDistributor(?Client $distributor): static
+    {
+        $this->distributor = $distributor;
+
+        return $this;
+    }
+
+    public function getBroker(): ?Client
+    {
+        return $this->broker;
+    }
+
+    public function setBroker(?Client $broker): static
+    {
+        $this->broker = $broker;
+
+        return $this;
+    }
+
+    public function isTriageService(): bool
+    {
+        return $this->triageService;
+    }
+
+    public function setTriageService(bool $triageService): static
+    {
+        $this->triageService = $triageService;
+
+        return $this;
+    }
+
+    /** @return Collection<int, CategoryInterface> */
+    public function getCategories(): Collection
+    {
+        return $this->categories;
+    }
+
+    public function addCategory(CategoryInterface $category): static
+    {
+        if (!$this->categories->contains($category)) {
+            $this->categories->add($category);
+        }
+
+        return $this;
+    }
+
+    public function removeCategory(CategoryInterface $category): static
+    {
+        $this->categories->removeElement($category);
+
+        return $this;
+    }
+
+    public function getDescription(): ?string
+    {
+        return $this->description;
+    }
+
+    public function setDescription(?string $description): static
+    {
+        $this->description = $description;
+
+        return $this;
+    }
+
+    public function getCompetitors(): ?string
+    {
+        return $this->competitors;
+    }
+
+    public function setCompetitors(?string $competitors): static
+    {
+        $this->competitors = $competitors;
+
+        return $this;
+    }
+
+    public function getFoundedAt(): ?DateTimeImmutable
+    {
+        return $this->foundedAt;
+    }
+
+    public function setFoundedAt(?DateTimeImmutable $foundedAt): static
+    {
+        $this->foundedAt = $foundedAt;
+
+        return $this;
+    }
+
+    public function getEmployeesCount(): ?int
+    {
+        return $this->employeesCount;
+    }
+
+    public function setEmployeesCount(?int $employeesCount): static
+    {
+        $this->employeesCount = $employeesCount;
+
+        return $this;
+    }
+
+    public function getRevenueAmount(): ?string
+    {
+        return $this->revenueAmount;
+    }
+
+    public function setRevenueAmount(?string $revenueAmount): static
+    {
+        $this->revenueAmount = $revenueAmount;
+
+        return $this;
+    }
+
+    public function getDirectorName(): ?string
+    {
+        return $this->directorName;
+    }
+
+    public function setDirectorName(?string $directorName): static
+    {
+        $this->directorName = $directorName;
+
+        return $this;
+    }
+
+    public function getProfitAmount(): ?string
+    {
+        return $this->profitAmount;
+    }
+
+    public function setProfitAmount(?string $profitAmount): static
+    {
+        $this->profitAmount = $profitAmount;
+
+        return $this;
+    }
+
+    public function getSiren(): ?string
+    {
+        return $this->siren;
+    }
+
+    public function setSiren(?string $siren): static
+    {
+        $this->siren = $siren;
+
+        return $this;
+    }
+
+    public function getAccountNumber(): ?string
+    {
+        return $this->accountNumber;
+    }
+
+    public function setAccountNumber(?string $accountNumber): static
+    {
+        $this->accountNumber = $accountNumber;
+
+        return $this;
+    }
+
+    public function getTvaMode(): ?TvaMode
+    {
+        return $this->tvaMode;
+    }
+
+    public function setTvaMode(?TvaMode $tvaMode): static
+    {
+        $this->tvaMode = $tvaMode;
+
+        return $this;
+    }
+
+    public function getNTva(): ?string
+    {
+        return $this->nTva;
+    }
+
+    public function setNTva(?string $nTva): static
+    {
+        $this->nTva = $nTva;
+
+        return $this;
+    }
+
+    public function getPaymentDelay(): ?PaymentDelay
+    {
+        return $this->paymentDelay;
+    }
+
+    public function setPaymentDelay(?PaymentDelay $paymentDelay): static
+    {
+        $this->paymentDelay = $paymentDelay;
+
+        return $this;
+    }
+
+    public function getPaymentType(): ?PaymentType
+    {
+        return $this->paymentType;
+    }
+
+    public function setPaymentType(?PaymentType $paymentType): static
+    {
+        $this->paymentType = $paymentType;
+
+        return $this;
+    }
+
+    public function getBank(): ?Bank
+    {
+        return $this->bank;
+    }
+
+    public function setBank(?Bank $bank): static
+    {
+        $this->bank = $bank;
+
+        return $this;
+    }
+
+    /** @return Collection<int, ClientContact> */
+    #[Groups(['client:item:read'])]
+    public function getContacts(): Collection
+    {
+        return $this->contacts;
+    }
+
+    public function addContact(ClientContact $contact): static
+    {
+        if (!$this->contacts->contains($contact)) {
+            $this->contacts->add($contact);
+            $contact->setClient($this);
+        }
+
+        return $this;
+    }
+
+    public function removeContact(ClientContact $contact): static
+    {
+        if ($this->contacts->removeElement($contact) && $contact->getClient() === $this) {
+            $contact->setClient(null);
+        }
+
+        return $this;
+    }
+
+    /** @return Collection<int, ClientAddress> */
+    #[Groups(['client:item:read'])]
+    public function getAddresses(): Collection
+    {
+        return $this->addresses;
+    }
+
+    public function addAddress(ClientAddress $address): static
+    {
+        if (!$this->addresses->contains($address)) {
+            $this->addresses->add($address);
+            $address->setClient($this);
+        }
+
+        return $this;
+    }
+
+    public function removeAddress(ClientAddress $address): static
+    {
+        if ($this->addresses->removeElement($address) && $address->getClient() === $this) {
+            $address->setClient(null);
+        }
+
+        return $this;
+    }
+
+    /** @return Collection<int, ClientRib> */
+    #[Groups(['client:item:read'])]
+    public function getRibs(): Collection
+    {
+        return $this->ribs;
+    }
+
+    public function addRib(ClientRib $rib): static
+    {
+        if (!$this->ribs->contains($rib)) {
+            $this->ribs->add($rib);
+            $rib->setClient($this);
+        }
+
+        return $this;
+    }
+
+    public function removeRib(ClientRib $rib): static
+    {
+        if ($this->ribs->removeElement($rib) && $rib->getClient() === $this) {
+            $rib->setClient(null);
+        }
+
+        return $this;
+    }
+
+    // Groupe de lecture + nom serialise explicite : sans SerializedName, Symfony
+    // exposerait la cle "archived" (strip du prefixe "is" sur les getters).
+    #[Groups(['client:read'])]
+    #[SerializedName('isArchived')]
+    public function isArchived(): bool
+    {
+        return $this->isArchived;
+    }
+
+    public function setIsArchived(bool $isArchived): static
+    {
+        $this->isArchived = $isArchived;
+
+        return $this;
+    }
+
+    public function getArchivedAt(): ?DateTimeImmutable
+    {
+        return $this->archivedAt;
+    }
+
+    public function setArchivedAt(?DateTimeImmutable $archivedAt): static
+    {
+        $this->archivedAt = $archivedAt;
+
+        return $this;
+    }
+
+    public function getDeletedAt(): ?DateTimeImmutable
+    {
+        return $this->deletedAt;
+    }
+
+    public function setDeletedAt(?DateTimeImmutable $deletedAt): static
+    {
+        $this->deletedAt = $deletedAt;
+
+        return $this;
+    }
+}

src/Module/Commercial/Domain/Entity/ClientAddress.php

@@ -0,0 +1,337 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Entity;
+
+use App\Module\Commercial\Infrastructure\Doctrine\DoctrineClientAddressRepository;
+use App\Shared\Domain\Attribute\Auditable;
+use App\Shared\Domain\Contract\BlamableInterface;
+use App\Shared\Domain\Contract\CategoryInterface;
+use App\Shared\Domain\Contract\SiteInterface;
+use App\Shared\Domain\Contract\TimestampableInterface;
+use App\Shared\Domain\Trait\TimestampableBlamableTrait;
+use Doctrine\Common\Collections\ArrayCollection;
+use Doctrine\Common\Collections\Collection;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+use Symfony\Component\Validator\Constraints as Assert;
+
+/**
+ * Adresse d'un client (1:n) — onglet Adresse. Une adresse de prospection
+ * (isProspect) est exclusive d'une adresse de livraison/facturation
+ * (RG-1.06/07/08, CHECK BDD). Un email de facturation est obligatoire ssi
+ * isBilling (RG-1.11, CHECK BDD). Au moins un site doit etre rattache
+ * (RG-1.10, Assert\Count).
+ *
+ * Relations M2M :
+ *  - sites : SiteInterface (module Sites) via resolve_target_entities
+ *  - contacts : ClientContact (meme module)
+ *  - categories : CategoryInterface (module Catalog) via resolve_target_entities
+ *    — limitees aux types SECTEUR/AUTRE cote validation (RG-1.29, futur Processor)
+ *
+ * Audite (#[Auditable]) + Timestampable/Blamable. Aucun ApiResource au M1.1
+ * (sous-ressources branchees a un ticket dedie).
+ */
+#[ORM\Entity(repositoryClass: DoctrineClientAddressRepository::class)]
+#[ORM\Table(name: 'client_address')]
+#[ORM\Index(name: 'idx_client_address_client', columns: ['client_id'])]
+#[Auditable]
+class ClientAddress implements TimestampableInterface, BlamableInterface
+{
+    use TimestampableBlamableTrait;
+
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['client_address:read'])]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: Client::class, inversedBy: 'addresses')]
+    #[ORM\JoinColumn(name: 'client_id', referencedColumnName: 'id', nullable: false, onDelete: 'CASCADE')]
+    private ?Client $client = null;
+
+    #[ORM\Column(name: 'is_prospect', options: ['default' => false])]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private bool $isProspect = false;
+
+    #[ORM\Column(name: 'is_delivery', options: ['default' => false])]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private bool $isDelivery = false;
+
+    #[ORM\Column(name: 'is_billing', options: ['default' => false])]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private bool $isBilling = false;
+
+    #[ORM\Column(length: 80, options: ['default' => 'France'])]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private string $country = 'France';
+
+    // RG-1.09 : code postal a 4 ou 5 chiffres (pas de controle CP/ville serveur).
+    #[ORM\Column(length: 20)]
+    #[Assert\NotBlank]
+    #[Assert\Regex(pattern: '/^[0-9]{4,5}$/', message: 'Le code postal doit comporter 4 ou 5 chiffres.')]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private ?string $postalCode = null;
+
+    #[ORM\Column(length: 120)]
+    #[Assert\NotBlank]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private ?string $city = null;
+
+    #[ORM\Column(length: 255)]
+    #[Assert\NotBlank]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private ?string $street = null;
+
+    #[ORM\Column(length: 255, nullable: true)]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private ?string $streetComplement = null;
+
+    // RG-1.11 : obligatoire ssi isBilling (CHECK BDD + futur Processor).
+    #[ORM\Column(length: 180, nullable: true)]
+    #[Assert\Email]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private ?string $billingEmail = null;
+
+    #[ORM\Column(options: ['default' => 0])]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private int $position = 0;
+
+    // RG-1.10 : au moins un site rattache a chaque adresse.
+    /** @var Collection<int, SiteInterface> */
+    #[ORM\ManyToMany(targetEntity: SiteInterface::class)]
+    #[ORM\JoinTable(name: 'client_address_site')]
+    #[ORM\JoinColumn(name: 'client_address_id', referencedColumnName: 'id', onDelete: 'CASCADE')]
+    #[ORM\InverseJoinColumn(name: 'site_id', referencedColumnName: 'id', onDelete: 'RESTRICT')]
+    #[Assert\Count(min: 1, minMessage: 'Au moins un site est obligatoire.')]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private Collection $sites;
+
+    /** @var Collection<int, ClientContact> */
+    #[ORM\ManyToMany(targetEntity: ClientContact::class)]
+    #[ORM\JoinTable(name: 'client_address_contact')]
+    #[ORM\JoinColumn(name: 'client_address_id', referencedColumnName: 'id', onDelete: 'CASCADE')]
+    #[ORM\InverseJoinColumn(name: 'client_contact_id', referencedColumnName: 'id', onDelete: 'CASCADE')]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private Collection $contacts;
+
+    // RG-1.29 : categories de type SECTEUR/AUTRE uniquement (filtre au Processor).
+    /** @var Collection<int, CategoryInterface> */
+    #[ORM\ManyToMany(targetEntity: CategoryInterface::class)]
+    #[ORM\JoinTable(name: 'client_address_category')]
+    #[ORM\JoinColumn(name: 'client_address_id', referencedColumnName: 'id', onDelete: 'CASCADE')]
+    #[ORM\InverseJoinColumn(name: 'category_id', referencedColumnName: 'id', onDelete: 'RESTRICT')]
+    #[Groups(['client_address:read', 'client_address:write'])]
+    private Collection $categories;
+
+    public function __construct()
+    {
+        $this->sites      = new ArrayCollection();
+        $this->contacts   = new ArrayCollection();
+        $this->categories = new ArrayCollection();
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getClient(): ?Client
+    {
+        return $this->client;
+    }
+
+    public function setClient(?Client $client): static
+    {
+        $this->client = $client;
+
+        return $this;
+    }
+
+    public function isProspect(): bool
+    {
+        return $this->isProspect;
+    }
+
+    public function setIsProspect(bool $isProspect): static
+    {
+        $this->isProspect = $isProspect;
+
+        return $this;
+    }
+
+    public function isDelivery(): bool
+    {
+        return $this->isDelivery;
+    }
+
+    public function setIsDelivery(bool $isDelivery): static
+    {
+        $this->isDelivery = $isDelivery;
+
+        return $this;
+    }
+
+    public function isBilling(): bool
+    {
+        return $this->isBilling;
+    }
+
+    public function setIsBilling(bool $isBilling): static
+    {
+        $this->isBilling = $isBilling;
+
+        return $this;
+    }
+
+    public function getCountry(): string
+    {
+        return $this->country;
+    }
+
+    public function setCountry(string $country): static
+    {
+        $this->country = $country;
+
+        return $this;
+    }
+
+    public function getPostalCode(): ?string
+    {
+        return $this->postalCode;
+    }
+
+    public function setPostalCode(?string $postalCode): static
+    {
+        $this->postalCode = $postalCode;
+
+        return $this;
+    }
+
+    public function getCity(): ?string
+    {
+        return $this->city;
+    }
+
+    public function setCity(?string $city): static
+    {
+        $this->city = $city;
+
+        return $this;
+    }
+
+    public function getStreet(): ?string
+    {
+        return $this->street;
+    }
+
+    public function setStreet(?string $street): static
+    {
+        $this->street = $street;
+
+        return $this;
+    }
+
+    public function getStreetComplement(): ?string
+    {
+        return $this->streetComplement;
+    }
+
+    public function setStreetComplement(?string $streetComplement): static
+    {
+        $this->streetComplement = $streetComplement;
+
+        return $this;
+    }
+
+    public function getBillingEmail(): ?string
+    {
+        return $this->billingEmail;
+    }
+
+    public function setBillingEmail(?string $billingEmail): static
+    {
+        $this->billingEmail = $billingEmail;
+
+        return $this;
+    }
+
+    public function getPosition(): int
+    {
+        return $this->position;
+    }
+
+    public function setPosition(int $position): static
+    {
+        $this->position = $position;
+
+        return $this;
+    }
+
+    /** @return Collection<int, SiteInterface> */
+    public function getSites(): Collection
+    {
+        return $this->sites;
+    }
+
+    public function addSite(SiteInterface $site): static
+    {
+        if (!$this->sites->contains($site)) {
+            $this->sites->add($site);
+        }
+
+        return $this;
+    }
+
+    public function removeSite(SiteInterface $site): static
+    {
+        $this->sites->removeElement($site);
+
+        return $this;
+    }
+
+    /** @return Collection<int, ClientContact> */
+    public function getContacts(): Collection
+    {
+        return $this->contacts;
+    }
+
+    public function addContact(ClientContact $contact): static
+    {
+        if (!$this->contacts->contains($contact)) {
+            $this->contacts->add($contact);
+        }
+
+        return $this;
+    }
+
+    public function removeContact(ClientContact $contact): static
+    {
+        $this->contacts->removeElement($contact);
+
+        return $this;
+    }
+
+    /** @return Collection<int, CategoryInterface> */
+    public function getCategories(): Collection
+    {
+        return $this->categories;
+    }
+
+    public function addCategory(CategoryInterface $category): static
+    {
+        if (!$this->categories->contains($category)) {
+            $this->categories->add($category);
+        }
+
+        return $this;
+    }
+
+    public function removeCategory(CategoryInterface $category): static
+    {
+        $this->categories->removeElement($category);
+
+        return $this;
+    }
+}

src/Module/Commercial/Domain/Entity/ClientContact.php

@@ -0,0 +1,178 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Entity;
+
+use App\Module\Commercial\Infrastructure\Doctrine\DoctrineClientContactRepository;
+use App\Shared\Domain\Attribute\Auditable;
+use App\Shared\Domain\Contract\BlamableInterface;
+use App\Shared\Domain\Contract\TimestampableInterface;
+use App\Shared\Domain\Trait\TimestampableBlamableTrait;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+use Symfony\Component\Validator\Constraints as Assert;
+
+/**
+ * Contact d'un client (1:n) — onglet Contact. Au moins firstName OU lastName
+ * doit etre renseigne (RG-1.05) : la contrainte est portee par un CHECK BDD
+ * (chk_client_contact_name) et validee dans le futur ClientContactProcessor ;
+ * l'entite reste permissive (les deux champs sont nullable).
+ *
+ * Audite (#[Auditable]) + Timestampable/Blamable (pattern Shared standard).
+ * Les operations CRUD (sous-ressources POST/PATCH/DELETE) sont branchees au
+ * ticket dedie des sous-ressources — aucun ApiResource au M1.1 (ERP-54).
+ */
+#[ORM\Entity(repositoryClass: DoctrineClientContactRepository::class)]
+#[ORM\Table(name: 'client_contact')]
+#[ORM\Index(name: 'idx_client_contact_client', columns: ['client_id'])]
+#[Auditable]
+class ClientContact implements TimestampableInterface, BlamableInterface
+{
+    use TimestampableBlamableTrait;
+
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['client_contact:read'])]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: Client::class, inversedBy: 'contacts')]
+    #[ORM\JoinColumn(name: 'client_id', referencedColumnName: 'id', nullable: false, onDelete: 'CASCADE')]
+    private ?Client $client = null;
+
+    // RG-1.05 : firstName OU lastName obligatoire (CHECK BDD + Processor). Les
+    // deux restent nullable au niveau ORM.
+    #[ORM\Column(length: 120, nullable: true)]
+    #[Assert\Length(max: 120, normalizer: 'trim')]
+    #[Groups(['client_contact:read', 'client_contact:write'])]
+    private ?string $firstName = null;
+
+    #[ORM\Column(length: 120, nullable: true)]
+    #[Assert\Length(max: 120, normalizer: 'trim')]
+    #[Groups(['client_contact:read', 'client_contact:write'])]
+    private ?string $lastName = null;
+
+    #[ORM\Column(length: 120, nullable: true)]
+    #[Assert\Length(max: 120, normalizer: 'trim')]
+    #[Groups(['client_contact:read', 'client_contact:write'])]
+    private ?string $jobTitle = null;
+
+    #[ORM\Column(length: 20, nullable: true)]
+    #[Groups(['client_contact:read', 'client_contact:write'])]
+    private ?string $phonePrimary = null;
+
+    #[ORM\Column(length: 20, nullable: true)]
+    #[Groups(['client_contact:read', 'client_contact:write'])]
+    private ?string $phoneSecondary = null;
+
+    #[ORM\Column(length: 180, nullable: true)]
+    #[Assert\Email]
+    #[Groups(['client_contact:read', 'client_contact:write'])]
+    private ?string $email = null;
+
+    #[ORM\Column(options: ['default' => 0])]
+    #[Groups(['client_contact:read', 'client_contact:write'])]
+    private int $position = 0;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getClient(): ?Client
+    {
+        return $this->client;
+    }
+
+    public function setClient(?Client $client): static
+    {
+        $this->client = $client;
+
+        return $this;
+    }
+
+    public function getFirstName(): ?string
+    {
+        return $this->firstName;
+    }
+
+    public function setFirstName(?string $firstName): static
+    {
+        $this->firstName = $firstName;
+
+        return $this;
+    }
+
+    public function getLastName(): ?string
+    {
+        return $this->lastName;
+    }
+
+    public function setLastName(?string $lastName): static
+    {
+        $this->lastName = $lastName;
+
+        return $this;
+    }
+
+    public function getJobTitle(): ?string
+    {
+        return $this->jobTitle;
+    }
+
+    public function setJobTitle(?string $jobTitle): static
+    {
+        $this->jobTitle = $jobTitle;
+
+        return $this;
+    }
+
+    public function getPhonePrimary(): ?string
+    {
+        return $this->phonePrimary;
+    }
+
+    public function setPhonePrimary(?string $phonePrimary): static
+    {
+        $this->phonePrimary = $phonePrimary;
+
+        return $this;
+    }
+
+    public function getPhoneSecondary(): ?string
+    {
+        return $this->phoneSecondary;
+    }
+
+    public function setPhoneSecondary(?string $phoneSecondary): static
+    {
+        $this->phoneSecondary = $phoneSecondary;
+
+        return $this;
+    }
+
+    public function getEmail(): ?string
+    {
+        return $this->email;
+    }
+
+    public function setEmail(?string $email): static
+    {
+        $this->email = $email;
+
+        return $this;
+    }
+
+    public function getPosition(): int
+    {
+        return $this->position;
+    }
+
+    public function setPosition(int $position): static
+    {
+        $this->position = $position;
+
+        return $this;
+    }
+}

src/Module/Commercial/Domain/Entity/ClientRib.php

@@ -0,0 +1,134 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Entity;
+
+use App\Module\Commercial\Infrastructure\Doctrine\DoctrineClientRibRepository;
+use App\Shared\Domain\Attribute\Auditable;
+use App\Shared\Domain\Contract\BlamableInterface;
+use App\Shared\Domain\Contract\TimestampableInterface;
+use App\Shared\Domain\Trait\TimestampableBlamableTrait;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+use Symfony\Component\Validator\Constraints as Assert;
+
+/**
+ * Coordonnees bancaires d'un client (1:n) — onglet Comptabilite. Au moins un
+ * RIB est obligatoire si le type de reglement du client est LCR (RG-1.13,
+ * verifie au futur Processor).
+ *
+ * Audit (#[Auditable]) : TOUS les champs sont audites, y compris `iban` et
+ * `bic` — AUCUN #[AuditIgnore] (decision Matthieu en revue MR 29/05/2026 :
+ * l'audit etant admin-only, la tracabilite RIB est necessaire pour le suivi
+ * comptable et la conformite, cf. spec § 2.5 / § 6.1).
+ *
+ * Validation IBAN/BIC : Assert\Iban + Assert\Bic standard Symfony au M1
+ * (HP-M2-14 : pas de controle externe banque reelle). Timestampable/Blamable
+ * standard. Aucun ApiResource au M1.1 (sous-ressource branchee ulterieurement).
+ */
+#[ORM\Entity(repositoryClass: DoctrineClientRibRepository::class)]
+#[ORM\Table(name: 'client_rib')]
+#[ORM\Index(name: 'idx_client_rib_client', columns: ['client_id'])]
+#[Auditable]
+class ClientRib implements TimestampableInterface, BlamableInterface
+{
+    use TimestampableBlamableTrait;
+
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['client_rib:read'])]
+    private ?int $id = null;
+
+    #[ORM\ManyToOne(targetEntity: Client::class, inversedBy: 'ribs')]
+    #[ORM\JoinColumn(name: 'client_id', referencedColumnName: 'id', nullable: false, onDelete: 'CASCADE')]
+    private ?Client $client = null;
+
+    #[ORM\Column(length: 120)]
+    #[Assert\NotBlank]
+    #[Assert\Length(max: 120, normalizer: 'trim')]
+    #[Groups(['client_rib:read', 'client_rib:write'])]
+    private ?string $label = null;
+
+    #[ORM\Column(length: 20)]
+    #[Assert\NotBlank]
+    #[Assert\Bic]
+    #[Groups(['client_rib:read', 'client_rib:write'])]
+    private ?string $bic = null;
+
+    #[ORM\Column(length: 34)]
+    #[Assert\NotBlank]
+    #[Assert\Iban]
+    #[Groups(['client_rib:read', 'client_rib:write'])]
+    private ?string $iban = null;
+
+    #[ORM\Column(options: ['default' => 0])]
+    #[Groups(['client_rib:read', 'client_rib:write'])]
+    private int $position = 0;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getClient(): ?Client
+    {
+        return $this->client;
+    }
+
+    public function setClient(?Client $client): static
+    {
+        $this->client = $client;
+
+        return $this;
+    }
+
+    public function getLabel(): ?string
+    {
+        return $this->label;
+    }
+
+    public function setLabel(string $label): static
+    {
+        $this->label = $label;
+
+        return $this;
+    }
+
+    public function getBic(): ?string
+    {
+        return $this->bic;
+    }
+
+    public function setBic(string $bic): static
+    {
+        $this->bic = $bic;
+
+        return $this;
+    }
+
+    public function getIban(): ?string
+    {
+        return $this->iban;
+    }
+
+    public function setIban(string $iban): static
+    {
+        $this->iban = $iban;
+
+        return $this;
+    }
+
+    public function getPosition(): int
+    {
+        return $this->position;
+    }
+
+    public function setPosition(int $position): static
+    {
+        $this->position = $position;
+
+        return $this;
+    }
+}

src/Module/Commercial/Domain/Entity/PaymentDelay.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Entity;
+
+use App\Module\Commercial\Infrastructure\Doctrine\DoctrinePaymentDelayRepository;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+
+/**
+ * Delai de reglement applique a un client (15 jours, 30 jours, a reception) :
+ * referentiel statique seede par la migration M1 et re-seede en dev/test par
+ * CommercialReferentialFixtures.
+ *
+ * Lecture seule au M1 (HP-M2-2). Pas de Timestampable/Blamable (referentiel
+ * statique whiteliste dans EntitiesAreTimestampableBlamableTest::EXCLUDED). Le
+ * groupe `client:read:accounting` permet l'embarquement dans la reponse Client.
+ */
+#[ORM\Entity(repositoryClass: DoctrinePaymentDelayRepository::class)]
+#[ORM\Table(name: 'payment_delay')]
+#[ORM\UniqueConstraint(name: 'uq_payment_delay_code', columns: ['code'])]
+class PaymentDelay
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['payment_delay:read', 'client:read:accounting'])]
+    private ?int $id = null;
+
+    #[ORM\Column(length: 30)]
+    #[Groups(['payment_delay:read', 'client:read:accounting'])]
+    private ?string $code = null;
+
+    #[ORM\Column(length: 120)]
+    #[Groups(['payment_delay:read', 'client:read:accounting'])]
+    private ?string $label = null;
+
+    #[ORM\Column(options: ['default' => 0])]
+    #[Groups(['payment_delay:read'])]
+    private int $position = 0;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getCode(): ?string
+    {
+        return $this->code;
+    }
+
+    public function setCode(string $code): static
+    {
+        $this->code = $code;
+
+        return $this;
+    }
+
+    public function getLabel(): ?string
+    {
+        return $this->label;
+    }
+
+    public function setLabel(string $label): static
+    {
+        $this->label = $label;
+
+        return $this;
+    }
+
+    public function getPosition(): int
+    {
+        return $this->position;
+    }
+
+    public function setPosition(int $position): static
+    {
+        $this->position = $position;
+
+        return $this;
+    }
+}

src/Module/Commercial/Domain/Entity/PaymentType.php

@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Entity;
+
+use App\Module\Commercial\Infrastructure\Doctrine\DoctrinePaymentTypeRepository;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+
+/**
+ * Type de reglement applique a un client (virement, LCR, cheque, non soumise) :
+ * referentiel statique seede par la migration M1 et re-seede en dev/test par
+ * CommercialReferentialFixtures.
+ *
+ * Le `code` porte une semantique metier : VIREMENT impose une banque (RG-1.12),
+ * LCR impose au moins un RIB (RG-1.13).
+ *
+ * Lecture seule au M1 (HP-M2-2). Pas de Timestampable/Blamable (referentiel
+ * statique whiteliste dans EntitiesAreTimestampableBlamableTest::EXCLUDED). Le
+ * groupe `client:read:accounting` permet l'embarquement dans la reponse Client.
+ */
+#[ORM\Entity(repositoryClass: DoctrinePaymentTypeRepository::class)]
+#[ORM\Table(name: 'payment_type')]
+#[ORM\UniqueConstraint(name: 'uq_payment_type_code', columns: ['code'])]
+class PaymentType
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['payment_type:read', 'client:read:accounting'])]
+    private ?int $id = null;
+
+    #[ORM\Column(length: 30)]
+    #[Groups(['payment_type:read', 'client:read:accounting'])]
+    private ?string $code = null;
+
+    #[ORM\Column(length: 120)]
+    #[Groups(['payment_type:read', 'client:read:accounting'])]
+    private ?string $label = null;
+
+    #[ORM\Column(options: ['default' => 0])]
+    #[Groups(['payment_type:read'])]
+    private int $position = 0;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getCode(): ?string
+    {
+        return $this->code;
+    }
+
+    public function setCode(string $code): static
+    {
+        $this->code = $code;
+
+        return $this;
+    }
+
+    public function getLabel(): ?string
+    {
+        return $this->label;
+    }
+
+    public function setLabel(string $label): static
+    {
+        $this->label = $label;
+
+        return $this;
+    }
+
+    public function getPosition(): int
+    {
+        return $this->position;
+    }
+
+    public function setPosition(int $position): static
+    {
+        $this->position = $position;
+
+        return $this;
+    }
+}

src/Module/Commercial/Domain/Entity/TvaMode.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Entity;
+
+use App\Module\Commercial\Infrastructure\Doctrine\DoctrineTvaModeRepository;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Component\Serializer\Attribute\Groups;
+
+/**
+ * Mode de TVA applique a un client (France ventes, Export, Intracom) :
+ * referentiel statique seede par la migration M1 (Version20260601000000) et
+ * re-seede en dev/test par CommercialReferentialFixtures.
+ *
+ * Lecture seule au M1 : pas de POST/PATCH/DELETE (HP-M2-2). L'ApiResource
+ * (GetCollection + Get, tri position ASC) est branche au ticket dedie des
+ * referentiels lecture seule.
+ *
+ * Referentiel statique : pas de Timestampable/Blamable (whiteliste dans
+ * EntitiesAreTimestampableBlamableTest::EXCLUDED, comme CategoryType). Le
+ * groupe `client:read:accounting` permet d'embarquer le mode dans la reponse
+ * d'un Client (onglet Comptabilite) au lieu d'un IRI.
+ */
+#[ORM\Entity(repositoryClass: DoctrineTvaModeRepository::class)]
+#[ORM\Table(name: 'tva_mode')]
+#[ORM\UniqueConstraint(name: 'uq_tva_mode_code', columns: ['code'])]
+class TvaMode
+{
+    #[ORM\Id]
+    #[ORM\GeneratedValue]
+    #[ORM\Column]
+    #[Groups(['tva_mode:read', 'client:read:accounting'])]
+    private ?int $id = null;
+
+    #[ORM\Column(length: 30)]
+    #[Groups(['tva_mode:read', 'client:read:accounting'])]
+    private ?string $code = null;
+
+    #[ORM\Column(length: 120)]
+    #[Groups(['tva_mode:read', 'client:read:accounting'])]
+    private ?string $label = null;
+
+    #[ORM\Column(options: ['default' => 0])]
+    #[Groups(['tva_mode:read'])]
+    private int $position = 0;
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getCode(): ?string
+    {
+        return $this->code;
+    }
+
+    public function setCode(string $code): static
+    {
+        $this->code = $code;
+
+        return $this;
+    }
+
+    public function getLabel(): ?string
+    {
+        return $this->label;
+    }
+
+    public function setLabel(string $label): static
+    {
+        $this->label = $label;
+
+        return $this;
+    }
+
+    public function getPosition(): int
+    {
+        return $this->position;
+    }
+
+    public function setPosition(int $position): static
+    {
+        $this->position = $position;
+
+        return $this;
+    }
+}

src/Module/Commercial/Domain/Repository/BankRepositoryInterface.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Repository;
+
+use App\Module\Commercial\Domain\Entity\Bank;
+
+interface BankRepositoryInterface
+{
+    public function findById(int $id): ?Bank;
+
+    /**
+     * Retourne toutes les banques triees position ASC puis label ASC.
+     *
+     * @return list<Bank>
+     */
+    public function findAllOrdered(): array;
+}

src/Module/Commercial/Domain/Repository/ClientAddressRepositoryInterface.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Repository;
+
+use App\Module\Commercial\Domain\Entity\ClientAddress;
+
+interface ClientAddressRepositoryInterface
+{
+    public function findById(int $id): ?ClientAddress;
+
+    public function save(ClientAddress $address): void;
+}

src/Module/Commercial/Domain/Repository/ClientContactRepositoryInterface.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Repository;
+
+use App\Module\Commercial\Domain\Entity\ClientContact;
+
+interface ClientContactRepositoryInterface
+{
+    public function findById(int $id): ?ClientContact;
+
+    public function save(ClientContact $contact): void;
+}

src/Module/Commercial/Domain/Repository/ClientRepositoryInterface.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Repository;
+
+use App\Module\Commercial\Domain\Entity\Client;
+use Doctrine\ORM\QueryBuilder;
+
+interface ClientRepositoryInterface
+{
+    public function findById(int $id): ?Client;
+
+    public function save(Client $client): void;
+
+    /**
+     * Construit un QueryBuilder de liste pour le repertoire clients.
+     * - Exclut toujours les clients soft-deletes (deleted_at IS NOT NULL, RG-1.24).
+     * - Exclut les archives sauf si $includeArchived = true (RG-1.25).
+     * - Tri par defaut : companyName ASC (RG-1.26).
+     */
+    public function createListQueryBuilder(bool $includeArchived = false): QueryBuilder;
+}

src/Module/Commercial/Domain/Repository/ClientRibRepositoryInterface.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Repository;
+
+use App\Module\Commercial\Domain\Entity\ClientRib;
+
+interface ClientRibRepositoryInterface
+{
+    public function findById(int $id): ?ClientRib;
+
+    public function save(ClientRib $rib): void;
+}

src/Module/Commercial/Domain/Repository/PaymentDelayRepositoryInterface.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Repository;
+
+use App\Module\Commercial\Domain\Entity\PaymentDelay;
+
+interface PaymentDelayRepositoryInterface
+{
+    public function findById(int $id): ?PaymentDelay;
+
+    /**
+     * Retourne tous les delais de reglement tries position ASC puis label ASC.
+     *
+     * @return list<PaymentDelay>
+     */
+    public function findAllOrdered(): array;
+}

src/Module/Commercial/Domain/Repository/PaymentTypeRepositoryInterface.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Repository;
+
+use App\Module\Commercial\Domain\Entity\PaymentType;
+
+interface PaymentTypeRepositoryInterface
+{
+    public function findById(int $id): ?PaymentType;
+
+    /**
+     * Retourne tous les types de reglement tries position ASC puis label ASC.
+     *
+     * @return list<PaymentType>
+     */
+    public function findAllOrdered(): array;
+}

src/Module/Commercial/Domain/Repository/TvaModeRepositoryInterface.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Domain\Repository;
+
+use App\Module\Commercial\Domain\Entity\TvaMode;
+
+interface TvaModeRepositoryInterface
+{
+    public function findById(int $id): ?TvaMode;
+
+    /**
+     * Retourne tous les modes de TVA tries position ASC puis label ASC
+     * (ordre des selecteurs, reutilise par la fixture de re-seed).
+     *
+     * @return list<TvaMode>
+     */
+    public function findAllOrdered(): array;
+}

src/Module/Commercial/Infrastructure/ApiPlatform/Serializer/CategoryReferenceDenormalizer.php

@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\ApiPlatform\Serializer;
+
+use ApiPlatform\Metadata\IriConverterInterface;
+use App\Shared\Domain\Contract\CategoryInterface;
+use Symfony\Component\Serializer\Normalizer\DenormalizerInterface;
+
+/**
+ * Denormalise un IRI (`/api/categories/{id}`) vers la Category concrete quand la
+ * propriete cible est type-hintee par le contrat CategoryInterface (ex:
+ * Client::$categories, ClientAddress::$categories).
+ *
+ * Pourquoi ce denormalizer : API Platform deduit le type de l'element de
+ * collection depuis le phpdoc `@var Collection<int, CategoryInterface>`, donc
+ * l'INTERFACE. Or le serializer ne sait pas denormaliser un IRI vers une
+ * interface (« Could not denormalize object of type CategoryInterface[] ») : il
+ * lui faut une classe-ressource concrete. On resout donc l'IRI via l'IriConverter
+ * (qui retourne la Category mappee a la route) sans importer Category — la regle
+ * ABSOLUE n°1 reste respectee (dependance au seul contrat Shared + API Platform).
+ *
+ * En lecture (normalisation), aucun probleme : l'objet reel EST une Category,
+ * resource a part entiere, serialisee en IRI par le normalizer standard.
+ */
+final class CategoryReferenceDenormalizer implements DenormalizerInterface
+{
+    public function __construct(
+        private readonly IriConverterInterface $iriConverter,
+    ) {}
+
+    public function denormalize(mixed $data, string $type, ?string $format = null, array $context = []): ?CategoryInterface
+    {
+        if (!is_string($data) || '' === $data) {
+            return null;
+        }
+
+        // getResourceFromIri leve une exception sur IRI invalide -> 400, ce qui
+        // est le comportement attendu pour une reference cassee.
+        $resource = $this->iriConverter->getResourceFromIri($data);
+
+        return $resource instanceof CategoryInterface ? $resource : null;
+    }
+
+    public function supportsDenormalization(mixed $data, string $type, ?string $format = null, array $context = []): bool
+    {
+        // Support base sur le seul type cible : l'ArrayDenormalizer (collection
+        // `CategoryInterface[]`) interroge le support en passant le TABLEAU
+        // complet comme $data avant de deleguer element par element. Tester
+        // is_string($data) ici casserait donc la chaine pour les collections.
+        return CategoryInterface::class === $type;
+    }
+
+    /**
+     * @return array<class-string|string, bool>
+     */
+    public function getSupportedTypes(?string $format): array
+    {
+        return [CategoryInterface::class => true];
+    }
+}

src/Module/Commercial/Infrastructure/ApiPlatform/Serializer/ClientReadGroupContextBuilder.php

@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\ApiPlatform\Serializer;
+
+use ApiPlatform\State\SerializerContextBuilderInterface;
+use App\Module\Commercial\Domain\Entity\Client;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\DependencyInjection\Attribute\AsDecorator;
+use Symfony\Component\DependencyInjection\Attribute\AutowireDecorated;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * Decore le context builder de serialisation d'API Platform pour ajouter
+ * DYNAMIQUEMENT le groupe de lecture `client:read:accounting` sur les ressources
+ * Client, uniquement si l'utilisateur courant a la permission
+ * `commercial.clients.accounting.view` (cf. spec-back M1 § 2.7 / § 4.1 / § 4.2).
+ *
+ * Pourquoi un context builder et pas le Provider : un Provider retourne des
+ * donnees mais ne peut pas influencer les groupes de serialisation. Le contexte
+ * de normalisation est construit ici, en amont du serializer — c'est le point
+ * d'extension idiomatique d'API Platform pour conditionner un groupe selon
+ * l'utilisateur. Realise l'intention « ajout conditionnel du groupe accounting »
+ * de la spec.
+ *
+ * S'applique aux operations de LECTURE (normalization) sur Client : liste ET
+ * detail. Sans la permission, les champs comptables (siren, accountNumber,
+ * tvaMode, nTva, paymentDelay, paymentType, bank) ne sont jamais serialises.
+ */
+#[AsDecorator('api_platform.serializer.context_builder')]
+final readonly class ClientReadGroupContextBuilder implements SerializerContextBuilderInterface
+{
+    public function __construct(
+        #[AutowireDecorated]
+        private SerializerContextBuilderInterface $decorated,
+        private Security $security,
+    ) {}
+
+    public function createFromRequest(Request $request, bool $normalization, ?array $extractedAttributes = null): array
+    {
+        $context = $this->decorated->createFromRequest($request, $normalization, $extractedAttributes);
+
+        // Uniquement en lecture, sur la ressource Client, avec la permission.
+        if (!$normalization) {
+            return $context;
+        }
+
+        if (Client::class !== ($context['resource_class'] ?? null)) {
+            return $context;
+        }
+
+        if (!$this->security->isGranted('commercial.clients.accounting.view')) {
+            return $context;
+        }
+
+        $groups = $context['groups'] ?? [];
+        if (!in_array('client:read:accounting', $groups, true)) {
+            $groups[] = 'client:read:accounting';
+        }
+        $context['groups'] = $groups;
+
+        return $context;
+    }
+}

src/Module/Commercial/Infrastructure/ApiPlatform/State/Processor/ClientProcessor.php

@@ -0,0 +1,362 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\ApiPlatform\State\Processor;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use ApiPlatform\Validator\Exception\ValidationException;
+use App\Module\Commercial\Application\Service\ClientFieldNormalizer;
+use App\Module\Commercial\Application\Validator\ClientInformationCompletenessValidator;
+use App\Module\Commercial\Domain\Entity\Client;
+use App\Shared\Domain\Contract\BusinessRoleAwareInterface;
+use App\Shared\Domain\Contract\CategoryInterface;
+use App\Shared\Domain\Security\BusinessRoles;
+use DateTimeImmutable;
+use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
+use JsonException;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\DependencyInjection\Attribute\Autowire;
+use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\ConflictHttpException;
+use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException;
+use Symfony\Component\Validator\ConstraintViolation;
+use Symfony\Component\Validator\ConstraintViolationList;
+
+/**
+ * Processor d'ecriture du repertoire clients (M1). Cf. spec-back M1 § 2.8 /
+ * § 2.9 / § 4.3 / § 4.4 + RG-1.01 a RG-1.28.
+ *
+ * Sequence (POST / PATCH) :
+ *  1. Autorisation additionnelle par groupe d'onglet (le `security` de
+ *     l'operation a deja exige commercial.clients.manage) :
+ *     - champ comptable dans le payload -> exige accounting.manage (RG-1.28, 403) ;
+ *     - champ isArchived dans le payload -> exige archive (RG-1.22, 403) et
+ *       interdit toute autre modification dans la meme requete (RG-1.22, 422).
+ *  2. Normalisation serveur (RG-1.18 a 1.21) via ClientFieldNormalizer.
+ *  3. Regles metier : RG-1.01 (prenom/nom), RG-1.03 (distributor/broker
+ *     exclusifs + type de categorie), RG-1.12 (Virement -> banque),
+ *     RG-1.13 (LCR -> >= 1 RIB), RG-1.04 (completude Information pour le role
+ *     Commerciale).
+ *  4. Pose / retrait de archivedAt (RG-1.22 true=now, RG-1.23 false=null).
+ *  5. Persistance via le persist_processor Doctrine, avec traduction des
+ *     collisions d'unicite en 409 (RG-1.16 doublon de nom ; RG-1.23 conflit de
+ *     restauration).
+ *
+ * Note : la validation Symfony (Assert\NotBlank, Assert\Email, Assert\Count sur
+ * categories...) est jouee par API Platform AVANT ce processor ; on n'y traite
+ * donc que les regles non exprimables en simples contraintes d'attribut.
+ *
+ * @implements ProcessorInterface<Client, Client>
+ */
+final class ClientProcessor implements ProcessorInterface
+{
+    /** Champs de l'onglet principal (groupe client:write:main). */
+    private const array MAIN_FIELDS = [
+        'companyName', 'firstName', 'lastName', 'phonePrimary', 'phoneSecondary',
+        'email', 'distributor', 'broker', 'triageService', 'categories',
+    ];
+
+    /** Champs de l'onglet Information (groupe client:write:information). */
+    private const array INFORMATION_FIELDS = [
+        'description', 'competitors', 'foundedAt', 'employeesCount',
+        'revenueAmount', 'directorName', 'profitAmount',
+    ];
+
+    /** Champs de l'onglet Comptabilite (groupe client:write:accounting). */
+    private const array ACCOUNTING_FIELDS = [
+        'siren', 'accountNumber', 'tvaMode', 'nTva', 'paymentDelay',
+        'paymentType', 'bank',
+    ];
+
+    /** Champ d'archivage (groupe client:write:archive). */
+    private const string ARCHIVE_FIELD = 'isArchived';
+
+    private const string PERM_ACCOUNTING_MANAGE = 'commercial.clients.accounting.manage';
+    private const string PERM_ARCHIVE           = 'commercial.clients.archive';
+
+    public function __construct(
+        #[Autowire(service: 'api_platform.doctrine.orm.state.persist_processor')]
+        private readonly ProcessorInterface $persistProcessor,
+        private readonly ClientFieldNormalizer $normalizer,
+        private readonly ClientInformationCompletenessValidator $informationValidator,
+        private readonly Security $security,
+        private readonly RequestStack $requestStack,
+    ) {}
+
+    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
+    {
+        if (!$data instanceof Client) {
+            return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
+        }
+
+        $payloadKeys = $this->payloadKeys();
+
+        $isArchiveRequest = $this->guardArchive($data, $payloadKeys);
+        $this->guardAccounting($payloadKeys);
+
+        $this->normalize($data);
+
+        $this->validateMainContact($data);
+        $this->validateDistributorBroker($data);
+        $this->validateAccountingConsistency($data);
+        $this->validateInformationCompleteness($data, $payloadKeys);
+
+        try {
+            return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
+        } catch (UniqueConstraintViolationException $e) {
+            // Le seul index unique partiel est uq_client_company_name_active
+            // (LOWER(company_name) parmi non-archives/non-deletes — decision Q4).
+            if ($isArchiveRequest && false === $data->isArchived()) {
+                // RG-1.23 : restauration en conflit avec un homonyme actif.
+                throw new ConflictHttpException(
+                    'Restauration impossible : un autre client a pris le nom entre-temps.',
+                    $e,
+                );
+            }
+
+            // RG-1.16 : doublon de nom de societe.
+            throw new ConflictHttpException(
+                sprintf('Un client nommé "%s" existe déjà.', (string) $data->getCompanyName()),
+                $e,
+            );
+        }
+    }
+
+    /**
+     * RG-1.22 / RG-1.23 : si le payload porte isArchived, exige la permission
+     * archive (403), interdit toute autre modification (422) et pose/retire
+     * archivedAt. Retourne true si la requete est une requete d'archivage.
+     *
+     * @param list<string> $payloadKeys
+     */
+    private function guardArchive(Client $data, array $payloadKeys): bool
+    {
+        if (!in_array(self::ARCHIVE_FIELD, $payloadKeys, true)) {
+            return false;
+        }
+
+        if (!$this->security->isGranted(self::PERM_ARCHIVE)) {
+            throw new AccessDeniedHttpException(sprintf(
+                'Le champ "%s" requiert la permission "%s".',
+                self::ARCHIVE_FIELD,
+                self::PERM_ARCHIVE,
+            ));
+        }
+
+        // RG-1.22 : une requete d'archivage ne modifie aucun autre champ.
+        if ([] !== array_diff($payloadKeys, [self::ARCHIVE_FIELD])) {
+            throw new UnprocessableEntityHttpException(
+                'Une requête d\'archivage ne peut modifier aucun autre champ que "isArchived".',
+            );
+        }
+
+        // RG-1.22 (true -> now) / RG-1.23 (false -> null).
+        $data->setArchivedAt($data->isArchived() ? new DateTimeImmutable() : null);
+
+        return true;
+    }
+
+    /**
+     * RG-1.28 : un champ comptable dans le payload exige accounting.manage,
+     * sinon 403 sur l'ensemble du payload (mode strict, pas de filtrage
+     * silencieux). Le message precise le premier champ fautif.
+     *
+     * @param list<string> $payloadKeys
+     */
+    private function guardAccounting(array $payloadKeys): void
+    {
+        $touched = array_values(array_intersect($payloadKeys, self::ACCOUNTING_FIELDS));
+
+        if ([] === $touched) {
+            return;
+        }
+
+        if (!$this->security->isGranted(self::PERM_ACCOUNTING_MANAGE)) {
+            throw new AccessDeniedHttpException(sprintf(
+                'Le champ "%s" requiert la permission "%s".',
+                $touched[0],
+                self::PERM_ACCOUNTING_MANAGE,
+            ));
+        }
+    }
+
+    /**
+     * Normalisation serveur (RG-1.18 a 1.21). Les setters non-nullables
+     * (companyName, email, phonePrimary) ne sont touches que si une valeur est
+     * presente, pour ne jamais ecraser l'existant lors d'un PATCH partiel.
+     */
+    private function normalize(Client $data): void
+    {
+        if (null !== $data->getCompanyName()) {
+            $data->setCompanyName((string) $this->normalizer->normalizeCompanyName($data->getCompanyName()));
+        }
+        if (null !== $data->getEmail()) {
+            $data->setEmail((string) $this->normalizer->normalizeEmail($data->getEmail()));
+        }
+        if (null !== $data->getPhonePrimary()) {
+            $data->setPhonePrimary((string) $this->normalizer->normalizePhone($data->getPhonePrimary()));
+        }
+
+        $data->setFirstName($this->normalizer->normalizePersonName($data->getFirstName()));
+        $data->setLastName($this->normalizer->normalizePersonName($data->getLastName()));
+        $data->setPhoneSecondary($this->normalizer->normalizePhone($data->getPhoneSecondary()));
+    }
+
+    /**
+     * RG-1.01 : au moins le prenom OU le nom du contact principal.
+     */
+    private function validateMainContact(Client $data): void
+    {
+        if (null === $data->getFirstName() && null === $data->getLastName()) {
+            $this->throwViolation(
+                'firstName',
+                'Le prénom ou le nom du contact principal est obligatoire.',
+                $data,
+            );
+        }
+    }
+
+    /**
+     * RG-1.03 : distributor et broker mutuellement exclusifs ; un distributor
+     * doit referencer un client de categorie DISTRIBUTEUR (idem broker ->
+     * COURTIER).
+     */
+    private function validateDistributorBroker(Client $data): void
+    {
+        $distributor = $data->getDistributor();
+        $broker      = $data->getBroker();
+
+        if (null !== $distributor && null !== $broker) {
+            $this->throwViolation(
+                'distributor',
+                'Un client ne peut pas être rattaché à la fois à un distributeur et à un courtier.',
+                $data,
+            );
+        }
+
+        if (null !== $distributor && !$this->hasCategoryType($distributor, 'DISTRIBUTEUR')) {
+            $this->throwViolation(
+                'distributor',
+                'Le distributeur référencé doit être un client de catégorie DISTRIBUTEUR.',
+                $data,
+            );
+        }
+
+        if (null !== $broker && !$this->hasCategoryType($broker, 'COURTIER')) {
+            $this->throwViolation(
+                'broker',
+                'Le courtier référencé doit être un client de catégorie COURTIER.',
+                $data,
+            );
+        }
+    }
+
+    /**
+     * RG-1.12 : Virement -> banque obligatoire. RG-1.13 : LCR -> au moins un RIB.
+     */
+    private function validateAccountingConsistency(Client $data): void
+    {
+        $paymentCode = $data->getPaymentType()?->getCode();
+
+        if ('VIREMENT' === $paymentCode && null === $data->getBank()) {
+            $this->throwViolation(
+                'bank',
+                'La banque est obligatoire pour le type de règlement Virement.',
+                $data,
+            );
+        }
+
+        if ('LCR' === $paymentCode && $data->getRibs()->isEmpty()) {
+            $this->throwViolation(
+                'paymentType',
+                'Au moins un RIB est obligatoire pour le type de règlement LCR.',
+                $data,
+            );
+        }
+    }
+
+    /**
+     * RG-1.04 : si l'utilisateur porte le role metier Commerciale ET que le
+     * payload touche l'onglet Information, tous les champs Information sont
+     * obligatoires. Dormant tant qu'aucun user ne porte le role `commerciale`.
+     *
+     * @param list<string> $payloadKeys
+     */
+    private function validateInformationCompleteness(Client $data, array $payloadKeys): void
+    {
+        $touchesInformation = [] !== array_intersect($payloadKeys, self::INFORMATION_FIELDS);
+
+        if ($touchesInformation && $this->currentUserIsCommerciale()) {
+            $this->informationValidator->validate($data);
+        }
+    }
+
+    /**
+     * Vrai si au moins une categorie du client porte le type donne. S'appuie
+     * sur CategoryInterface::getCategoryTypeCode() (pas d'import de Category).
+     */
+    private function hasCategoryType(Client $client, string $typeCode): bool
+    {
+        foreach ($client->getCategories() as $category) {
+            if ($category instanceof CategoryInterface && $category->getCategoryTypeCode() === $typeCode) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function currentUserIsCommerciale(): bool
+    {
+        $user = $this->security->getUser();
+
+        return $user instanceof BusinessRoleAwareInterface
+            && $user->hasBusinessRole(BusinessRoles::COMMERCIALE);
+    }
+
+    /**
+     * Cles de premier niveau effectivement envoyees par le client (payload JSON
+     * brut). Pour un PATCH merge-patch+json, ce sont les seuls champs modifies ;
+     * c'est ce qui permet le gating par onglet (RG-1.22 / RG-1.28) et le
+     * declenchement conditionnel de RG-1.04.
+     *
+     * @return list<string>
+     */
+    private function payloadKeys(): array
+    {
+        $request = $this->requestStack->getCurrentRequest();
+        if (null === $request) {
+            return [];
+        }
+
+        $content = $request->getContent();
+        if ('' === $content) {
+            return [];
+        }
+
+        try {
+            $decoded = json_decode($content, true, 512, JSON_THROW_ON_ERROR);
+        } catch (JsonException) {
+            return [];
+        }
+
+        return is_array($decoded) ? array_values(array_filter(array_keys($decoded), 'is_string')) : [];
+    }
+
+    /**
+     * Leve une ValidationException (HTTP 422) portant une violation unique sur
+     * la propriete visee — meme rendu Hydra que les contraintes Symfony.
+     *
+     * @return never
+     */
+    private function throwViolation(string $property, string $message, Client $root): void
+    {
+        $violations = new ConstraintViolationList();
+        $violations->add(new ConstraintViolation($message, null, [], $root, $property, null));
+
+        throw new ValidationException($violations);
+    }
+}

src/Module/Commercial/Infrastructure/ApiPlatform/State/Provider/ClientProvider.php

@@ -0,0 +1,170 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\ApiPlatform\State\Provider;
+
+use ApiPlatform\Doctrine\Orm\Paginator;
+use ApiPlatform\Metadata\CollectionOperationInterface;
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\Pagination\Pagination;
+use ApiPlatform\State\ProviderInterface;
+use App\Module\Commercial\Domain\Entity\Client;
+use App\Module\Commercial\Domain\Repository\ClientRepositoryInterface;
+use Doctrine\ORM\QueryBuilder;
+use Doctrine\ORM\Tools\Pagination\Paginator as DoctrinePaginator;
+use Symfony\Component\DependencyInjection\Attribute\Autowire;
+
+/**
+ * Provider du repertoire clients (M1). Cf. spec-back M1 § 4.1 / § 4.2.
+ *
+ * Collection (GET /api/clients) :
+ *  - exclut par defaut les archives (is_archived = true) ET les soft-deletes
+ *    (deleted_at IS NOT NULL) — RG-1.24 ;
+ *  - ?includeArchived=true reintegre les archives (les soft-deletes restent
+ *    exclus au M1) — RG-1.25 ;
+ *  - tri par defaut companyName ASC — RG-1.26 ;
+ *  - filtres ?search=... (fuzzy companyName + lastName + email) et
+ *    ?categoryType=<code> (clients ayant >= 1 categorie de ce type) ;
+ *  - pagination obligatoire (convention Starseed ERP-72) : Paginator ORM ;
+ *    echappatoire ?pagination=false pour alimenter un <select> sans pagination.
+ *
+ * Item (GET /api/clients/{id} + provider de PATCH) :
+ *  - 404 si introuvable OU soft-delete (deleted_at non null, jamais expose au
+ *    M1) ; les archives restent consultables/restaurables en detail.
+ *
+ * Le filtrage des champs comptables en lecture (groupe client:read:accounting)
+ * n'est PAS fait ici mais dans ClientReadGroupContextBuilder (le provider ne
+ * peut pas influencer les groupes de serialisation).
+ *
+ * @implements ProviderInterface<Client>
+ */
+final class ClientProvider implements ProviderInterface
+{
+    public function __construct(
+        #[Autowire(service: 'App\Module\Commercial\Infrastructure\Doctrine\DoctrineClientRepository')]
+        private readonly ClientRepositoryInterface $repository,
+        private readonly Pagination $pagination,
+    ) {}
+
+    public function provide(Operation $operation, array $uriVariables = [], array $context = []): Client|iterable|Paginator|null
+    {
+        if ($operation instanceof CollectionOperationInterface) {
+            return $this->provideCollection($operation, $context);
+        }
+
+        return $this->provideItem($uriVariables);
+    }
+
+    /**
+     * @param array<string, mixed> $context
+     *
+     * @return list<Client>|Paginator<Client>
+     */
+    private function provideCollection(Operation $operation, array $context): array|Paginator
+    {
+        $filters         = $context['filters'] ?? [];
+        $includeArchived = $this->readBool($filters['includeArchived'] ?? false);
+
+        $qb = $this->repository->createListQueryBuilder($includeArchived);
+        $this->applySearch($qb, $filters['search'] ?? null);
+        $this->applyCategoryType($qb, $filters['categoryType'] ?? null);
+
+        // Echappatoire ?pagination=false : collection complete sans Paginator
+        // (cf. convention ERP-72 — utile pour un <select> cote front).
+        if (!$this->pagination->isEnabled($operation, $context)) {
+            /** @var list<Client> $result */
+            return $qb->getQuery()->getResult();
+        }
+
+        $limit  = $this->pagination->getLimit($operation, $context);
+        $page   = max(1, $this->pagination->getPage($context));
+        $offset = ($page - 1) * $limit;
+
+        $qb->setFirstResult($offset)->setMaxResults($limit);
+
+        // fetchJoinCollection: true pour un COUNT correct des que des JOINs
+        // to-many seront ajoutes (sous-collections embarquees en detail).
+        return new Paginator(new DoctrinePaginator($qb->getQuery(), fetchJoinCollection: true));
+    }
+
+    /**
+     * @param array<string, mixed> $uriVariables
+     */
+    private function provideItem(array $uriVariables): ?Client
+    {
+        $id = $uriVariables['id'] ?? null;
+        if (!is_int($id) && !(is_string($id) && ctype_digit($id))) {
+            return null;
+        }
+
+        $client = $this->repository->findById((int) $id);
+        if (null === $client) {
+            return null;
+        }
+
+        // Soft-delete : jamais expose au M1 (HP-M2-1) — 404 via retour null.
+        // Les archives restent visibles en detail (consultation + restauration).
+        if (null !== $client->getDeletedAt()) {
+            return null;
+        }
+
+        return $client;
+    }
+
+    /**
+     * Recherche fuzzy insensible a la casse sur companyName + lastName + email.
+     * Les metacaracteres LIKE (%, _, \) saisis sont echappes pour rester
+     * litteraux.
+     */
+    private function applySearch(QueryBuilder $qb, mixed $search): void
+    {
+        if (!is_string($search) || '' === trim($search)) {
+            return;
+        }
+
+        $escaped = str_replace(['\\', '%', '_'], ['\\\\', '\%', '\_'], trim($search));
+        $pattern = '%'.mb_strtolower($escaped, 'UTF-8').'%';
+
+        $qb->andWhere(
+            'LOWER(c.companyName) LIKE :search '
+            .'OR LOWER(c.lastName) LIKE :search '
+            .'OR LOWER(c.email) LIKE :search',
+        )->setParameter('search', $pattern);
+    }
+
+    /**
+     * Restreint aux clients possedant au moins une categorie du type donne.
+     * Sous-requete IN (plutot qu'un JOIN sur la collection M2M) pour ne pas
+     * perturber le DISTINCT / ORDER BY de la requete paginee principale.
+     */
+    private function applyCategoryType(QueryBuilder $qb, mixed $categoryType): void
+    {
+        if (!is_string($categoryType) || '' === trim($categoryType)) {
+            return;
+        }
+
+        $sub = $this->repository->createQueryBuilder('c2')
+            ->select('c2.id')
+            ->join('c2.categories', 'cat2')
+            ->join('cat2.categoryType', 'ct2')
+            ->where('ct2.code = :categoryType')
+        ;
+
+        $qb->andWhere($qb->expr()->in('c.id', $sub->getDQL()))
+            ->setParameter('categoryType', trim($categoryType))
+        ;
+    }
+
+    /**
+     * Lit un flag booleen issu des query params. Accepte true / "true" / "1".
+     */
+    private function readBool(mixed $raw): bool
+    {
+        if (is_bool($raw)) {
+            return $raw;
+        }
+
+        return is_string($raw) && in_array(strtolower($raw), ['true', '1'], true);
+    }
+}

src/Module/Commercial/Infrastructure/DataFixtures/CommercialReferentialFixtures.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\DataFixtures;
+
+use App\Module\Commercial\Domain\Entity\Bank;
+use App\Module\Commercial\Domain\Entity\PaymentDelay;
+use App\Module\Commercial\Domain\Entity\PaymentType;
+use App\Module\Commercial\Domain\Entity\TvaMode;
+use Doctrine\Bundle\FixturesBundle\Fixture;
+use Doctrine\Persistence\ObjectManager;
+
+/**
+ * Fixtures du module Commercial : re-seed des 4 referentiels comptables
+ * (tva_mode, payment_delay, payment_type, bank) seedes par la migration M1
+ * (Version20260601000000).
+ *
+ * Pourquoi cette fixture EN PLUS du seed de la migration : depuis ERP-54 ces
+ * 4 tables sont des entites managees par l'ORM, donc le purger Doctrine les
+ * vide avant chaque `doctrine:fixtures:load`. Sans cette fixture, les
+ * referentiels seedes par la migration disparaitraient apres `make db-reset`
+ * (0 ligne en dev/test) — cassant les FK Client -> referentiels et les tests
+ * RG-1.12/1.13. Le seed migration couvre la prod (ou les fixtures ne tournent
+ * pas) ; cette fixture re-aligne dev et test. Memes valeurs des deux cotes.
+ *
+ * Idempotence : lookup par `code` avant insertion (sur le modele de
+ * CategoryTypeFixtures). Rejouable sans doublon meme si le purger est desactive.
+ */
+class CommercialReferentialFixtures extends Fixture
+{
+    /**
+     * Source unique des referentiels : classe d'entite => [code => [label, position]].
+     * Doit rester aligne sur le seed de la migration Version20260601000000.
+     *
+     * @var array<class-string, array<string, array{string, int}>>
+     */
+    private const REFERENTIALS = [
+        TvaMode::class => [
+            'FRANCE_VENTES'   => ['France (ventes)', 10],
+            'EXPORT_VENTES'   => ['Export (ventes)', 20],
+            'INTRACOM_VENTES' => ['Intracom (ventes)', 30],
+        ],
+        PaymentDelay::class => [
+            'J15'         => ['15 jours', 10],
+            'J30'         => ['30 jours', 20],
+            'A_RECEPTION' => ['À réception', 30],
+        ],
+        PaymentType::class => [
+            'VIREMENT'    => ['Virement', 10],
+            'LCR'         => ['LCR', 20],
+            'NON_SOUMISE' => ['Non soumise', 30],
+            'CHEQUE'      => ['Chèque', 40],
+        ],
+        Bank::class => [
+            'SG'  => ['Société Générale', 10],
+            'CIC' => ['CIC', 20],
+            'CA'  => ['Crédit Agricole', 30],
+        ],
+    ];
+
+    public function load(ObjectManager $manager): void
+    {
+        foreach (self::REFERENTIALS as $entityClass => $rows) {
+            $this->seedReferential($manager, $entityClass, $rows);
+        }
+
+        $manager->flush();
+    }
+
+    /**
+     * Upsert idempotent d'un referentiel : indexe l'existant par code puis
+     * cree/met a jour chaque entree. Les 4 entites partagent le meme contrat
+     * setCode/setLabel/setPosition.
+     *
+     * @param class-string                      $entityClass
+     * @param array<string, array{string, int}> $rows
+     */
+    private function seedReferential(ObjectManager $manager, string $entityClass, array $rows): void
+    {
+        $existingByCode = [];
+        foreach ($manager->getRepository($entityClass)->findAll() as $entity) {
+            $existingByCode[$entity->getCode()] = $entity;
+        }
+
+        foreach ($rows as $code => [$label, $position]) {
+            $entity = $existingByCode[$code] ?? new $entityClass();
+            $entity->setCode($code);
+            $entity->setLabel($label);
+            $entity->setPosition($position);
+            $manager->persist($entity);
+        }
+    }
+}

src/Module/Commercial/Infrastructure/Doctrine/DoctrineBankRepository.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\Doctrine;
+
+use App\Module\Commercial\Domain\Entity\Bank;
+use App\Module\Commercial\Domain\Repository\BankRepositoryInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<Bank>
+ */
+class DoctrineBankRepository extends ServiceEntityRepository implements BankRepositoryInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, Bank::class);
+    }
+
+    public function findById(int $id): ?Bank
+    {
+        return $this->find($id);
+    }
+
+    public function findAllOrdered(): array
+    {
+        return $this->createQueryBuilder('b')
+            ->orderBy('b.position', 'ASC')
+            ->addOrderBy('b.label', 'ASC')
+            ->getQuery()
+            ->getResult()
+        ;
+    }
+}

src/Module/Commercial/Infrastructure/Doctrine/DoctrineClientAddressRepository.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\Doctrine;
+
+use App\Module\Commercial\Domain\Entity\ClientAddress;
+use App\Module\Commercial\Domain\Repository\ClientAddressRepositoryInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<ClientAddress>
+ */
+class DoctrineClientAddressRepository extends ServiceEntityRepository implements ClientAddressRepositoryInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, ClientAddress::class);
+    }
+
+    public function findById(int $id): ?ClientAddress
+    {
+        return $this->find($id);
+    }
+
+    public function save(ClientAddress $address): void
+    {
+        $this->getEntityManager()->persist($address);
+        $this->getEntityManager()->flush();
+    }
+}

src/Module/Commercial/Infrastructure/Doctrine/DoctrineClientContactRepository.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\Doctrine;
+
+use App\Module\Commercial\Domain\Entity\ClientContact;
+use App\Module\Commercial\Domain\Repository\ClientContactRepositoryInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<ClientContact>
+ */
+class DoctrineClientContactRepository extends ServiceEntityRepository implements ClientContactRepositoryInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, ClientContact::class);
+    }
+
+    public function findById(int $id): ?ClientContact
+    {
+        return $this->find($id);
+    }
+
+    public function save(ClientContact $contact): void
+    {
+        $this->getEntityManager()->persist($contact);
+        $this->getEntityManager()->flush();
+    }
+}

src/Module/Commercial/Infrastructure/Doctrine/DoctrineClientRepository.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\Doctrine;
+
+use App\Module\Commercial\Domain\Entity\Client;
+use App\Module\Commercial\Domain\Repository\ClientRepositoryInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\ORM\QueryBuilder;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<Client>
+ */
+class DoctrineClientRepository extends ServiceEntityRepository implements ClientRepositoryInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, Client::class);
+    }
+
+    public function findById(int $id): ?Client
+    {
+        return $this->find($id);
+    }
+
+    public function save(Client $client): void
+    {
+        $this->getEntityManager()->persist($client);
+        $this->getEntityManager()->flush();
+    }
+
+    public function createListQueryBuilder(bool $includeArchived = false): QueryBuilder
+    {
+        $qb = $this->createQueryBuilder('c')
+            ->andWhere('c.deletedAt IS NULL')
+            ->orderBy('c.companyName', 'ASC')
+        ;
+
+        if (!$includeArchived) {
+            $qb->andWhere('c.isArchived = false');
+        }
+
+        return $qb;
+    }
+}

src/Module/Commercial/Infrastructure/Doctrine/DoctrineClientRibRepository.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\Doctrine;
+
+use App\Module\Commercial\Domain\Entity\ClientRib;
+use App\Module\Commercial\Domain\Repository\ClientRibRepositoryInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<ClientRib>
+ */
+class DoctrineClientRibRepository extends ServiceEntityRepository implements ClientRibRepositoryInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, ClientRib::class);
+    }
+
+    public function findById(int $id): ?ClientRib
+    {
+        return $this->find($id);
+    }
+
+    public function save(ClientRib $rib): void
+    {
+        $this->getEntityManager()->persist($rib);
+        $this->getEntityManager()->flush();
+    }
+}

src/Module/Commercial/Infrastructure/Doctrine/DoctrinePaymentDelayRepository.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\Doctrine;
+
+use App\Module\Commercial\Domain\Entity\PaymentDelay;
+use App\Module\Commercial\Domain\Repository\PaymentDelayRepositoryInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<PaymentDelay>
+ */
+class DoctrinePaymentDelayRepository extends ServiceEntityRepository implements PaymentDelayRepositoryInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, PaymentDelay::class);
+    }
+
+    public function findById(int $id): ?PaymentDelay
+    {
+        return $this->find($id);
+    }
+
+    public function findAllOrdered(): array
+    {
+        return $this->createQueryBuilder('p')
+            ->orderBy('p.position', 'ASC')
+            ->addOrderBy('p.label', 'ASC')
+            ->getQuery()
+            ->getResult()
+        ;
+    }
+}

src/Module/Commercial/Infrastructure/Doctrine/DoctrinePaymentTypeRepository.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\Doctrine;
+
+use App\Module\Commercial\Domain\Entity\PaymentType;
+use App\Module\Commercial\Domain\Repository\PaymentTypeRepositoryInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<PaymentType>
+ */
+class DoctrinePaymentTypeRepository extends ServiceEntityRepository implements PaymentTypeRepositoryInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, PaymentType::class);
+    }
+
+    public function findById(int $id): ?PaymentType
+    {
+        return $this->find($id);
+    }
+
+    public function findAllOrdered(): array
+    {
+        return $this->createQueryBuilder('p')
+            ->orderBy('p.position', 'ASC')
+            ->addOrderBy('p.label', 'ASC')
+            ->getQuery()
+            ->getResult()
+        ;
+    }
+}

src/Module/Commercial/Infrastructure/Doctrine/DoctrineTvaModeRepository.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Module\Commercial\Infrastructure\Doctrine;
+
+use App\Module\Commercial\Domain\Entity\TvaMode;
+use App\Module\Commercial\Domain\Repository\TvaModeRepositoryInterface;
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+
+/**
+ * @extends ServiceEntityRepository<TvaMode>
+ */
+class DoctrineTvaModeRepository extends ServiceEntityRepository implements TvaModeRepositoryInterface
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, TvaMode::class);
+    }
+
+    public function findById(int $id): ?TvaMode
+    {
+        return $this->find($id);
+    }
+
+    public function findAllOrdered(): array
+    {
+        return $this->createQueryBuilder('t')
+            ->orderBy('t.position', 'ASC')
+            ->addOrderBy('t.label', 'ASC')
+            ->getQuery()
+            ->getResult()
+        ;
+    }
+}

src/Module/Core/Domain/Entity/User.php

@@ -22,6 +22,7 @@ use App\Module\Core\Infrastructure\Doctrine\DoctrineUserRepository;
 // C'est le pattern officiel Doctrine pour les bounded contexts DDD.
 use App\Shared\Domain\Attribute\Auditable;
 use App\Shared\Domain\Attribute\AuditIgnore;
+use App\Shared\Domain\Contract\BusinessRoleAwareInterface;
 use App\Shared\Domain\Contract\SiteInterface;
 use App\Shared\Domain\Exception\SiteNotAuthorizedException;
 use DateTimeImmutable;
@@ -75,7 +76,7 @@ use Symfony\Component\Serializer\Attribute\SerializedName;
 #[ORM\Entity(repositoryClass: DoctrineUserRepository::class)]
 #[ORM\Table(name: '`user`')]
 #[Auditable]
-class User implements UserInterface, PasswordAuthenticatedUserInterface
+class User implements UserInterface, PasswordAuthenticatedUserInterface, BusinessRoleAwareInterface
 {
     #[ORM\Id]
     #[ORM\GeneratedValue]
@@ -337,6 +338,23 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
         return $keys;
     }
 
+    /**
+     * Implemente BusinessRoleAwareInterface : vrai si l'un des roles RBAC
+     * rattaches porte le code donne. Permet aux modules tiers de detecter un
+     * role metier (ex: `commerciale` pour RG-1.04 du M1 Clients) sans importer
+     * cette classe. Comparaison stricte sur Role::code.
+     */
+    public function hasBusinessRole(string $roleCode): bool
+    {
+        foreach ($this->rbacRoles as $role) {
+            if ($role->getCode() === $roleCode) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     public function getPassword(): ?string
     {
         return $this->password;

src/Shared/Domain/Contract/BusinessRoleAwareInterface.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Shared\Domain\Contract;
+
+/**
+ * Expose, sans coupler a la classe concrete User (module Core), le moyen de
+ * savoir si un utilisateur porte un role METIER donne (par son code, cf.
+ * App\Shared\Domain\Security\BusinessRoles).
+ *
+ * Implementee par App\Module\Core\Domain\Entity\User. Permet a un module tiers
+ * (ex: Commercial — RG-1.04, completude Information pour le role Commerciale)
+ * de raisonner sur les roles metier via Security::getUser() sans importer User
+ * (regle ABSOLUE n°1 : pas d'import inter-modules).
+ *
+ * Distinct de UserInterface::getRoles() (roles SYSTEME Symfony ROLE_*, derives
+ * de is_admin) : ici on parle des roles RBAC metier rattaches a l'utilisateur.
+ */
+interface BusinessRoleAwareInterface
+{
+    /**
+     * Vrai si l'utilisateur porte le role RBAC metier identifie par $roleCode
+     * (compare au champ Role::code).
+     */
+    public function hasBusinessRole(string $roleCode): bool;
+}

src/Shared/Domain/Contract/CategoryInterface.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Shared\Domain\Contract;
+
+/**
+ * Interface minimale exposant ce qu'un module tiers (Commercial...) doit
+ * connaitre d'une Category, sans creer de couplage direct vers le module
+ * Catalog (regle ABSOLUE n°1 : pas d'import inter-modules).
+ *
+ * Implementee par App\Module\Catalog\Domain\Entity\Category.
+ * Utilisee comme cible des ManyToMany Client.categories et
+ * ClientAddress.categories via resolve_target_entities (cf. doctrine.yaml),
+ * sur le meme modele que SiteInterface / UserInterface.
+ */
+interface CategoryInterface
+{
+    public function getId(): ?int;
+
+    public function getName(): ?string;
+
+    /**
+     * Code du type de categorie rattache (CategoryType::code), ou null si la
+     * categorie n'a pas de type. Expose pour permettre a un module tiers de
+     * raisonner sur le type metier (ex: M1 Commercial — RG-1.03 : un distributor
+     * doit referencer un client categorise DISTRIBUTEUR ; RG-1.29 : categorie
+     * d'adresse limitee a SECTEUR/AUTRE) sans importer la classe concrete
+     * Category (regle ABSOLUE n°1).
+     */
+    public function getCategoryTypeCode(): ?string;
+}

src/Shared/Domain/Security/BusinessRoles.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Shared\Domain\Security;
+
+/**
+ * Codes des roles METIER MALIO partages entre modules.
+ *
+ * Distincts des roles SYSTEME (cf. App\Module\Core\Domain\Security\SystemRoles :
+ * `admin` / `user`). Un role metier porte une intention fonctionnelle (poste de
+ * travail) et conditionne certaines regles de gestion au-dela des permissions
+ * RBAC pures — ex : RG-1.04 du M1 Clients rend l'onglet Information obligatoire
+ * pour le seul role Commerciale, alors que Commerciale et Bureau partagent les
+ * memes permissions (commercial.clients.view + manage, cf. spec-back M1 § 5.2).
+ *
+ * Ces constantes vivent dans Shared (et non dans un module) pour que :
+ *  - le seed des roles cote Core (ERP-74) reference le meme code sans importer
+ *    une constante du module Commercial (regle ABSOLUE n°1 : pas d'import
+ *    inter-modules) ;
+ *  - le ClientProcessor (module Commercial) detecte le role Commerciale via ce
+ *    meme code, sans dependre de Core.
+ *
+ * Coordination stack M1 :
+ *  - ERP-74 seede le role `commerciale` avec ce code exact.
+ *  - ERP-59 / ERP-60 (declaration RBAC + tests personas) le reutilisent.
+ *  - ERP-55 (ici) ne fait que le REFERENCER : tant qu'aucun user ne porte le
+ *    role `commerciale`, la validation de completude Information reste dormante.
+ */
+final class BusinessRoles
+{
+    /**
+     * Role metier « Commerciale » — code de Role RBAC (champ Role::code,
+     * snake_case impose par la regex Role). Conditionne RG-1.04.
+     */
+    public const string COMMERCIALE = 'commerciale';
+
+    private function __construct()
+    {
+        // Classe de constantes : non instanciable.
+    }
+}

src/Shared/Infrastructure/Database/ColumnCommentsCatalog.php

@@ -128,6 +128,135 @@ final class ColumnCommentsCatalog
                 'user_id' => 'FK -> user.id, ON DELETE CASCADE — utilisateur ayant acces au site.',
                 'site_id' => 'FK -> site.id, ON DELETE CASCADE — site accessible par l utilisateur.',
             ],
+
+            // === M1 Commercial (ERP-53/54) — miroir des COMMENT de la migration
+            // Version20260601000000 pour le chemin schema:update (dev/test). ===
+
+            'tva_mode' => [
+                '_table'   => 'Referentiel des modes de TVA appliques a un client (France, Export, Intracom).',
+                'id'       => 'Identifiant interne auto-incremente.',
+                'code'     => 'Code technique stable (UPPER_SNAKE, ≤ 30 caracteres) — unique, utilise par le code metier.',
+                'label'    => 'Libelle affichable (FR, ≤ 120 caracteres).',
+                'position' => 'Ordre d affichage croissant dans les selecteurs (tri position ASC puis label ASC).',
+            ],
+
+            'payment_delay' => [
+                '_table'   => 'Referentiel des delais de reglement (15 jours, 30 jours, a reception).',
+                'id'       => 'Identifiant interne auto-incremente.',
+                'code'     => 'Code technique stable (UPPER_SNAKE, ≤ 30 caracteres) — unique, utilise par le code metier.',
+                'label'    => 'Libelle affichable (FR, ≤ 120 caracteres).',
+                'position' => 'Ordre d affichage croissant dans les selecteurs (tri position ASC puis label ASC).',
+            ],
+
+            'payment_type' => [
+                '_table'   => 'Referentiel des types de reglement (virement, LCR, cheque, non soumise).',
+                'id'       => 'Identifiant interne auto-incremente.',
+                'code'     => 'Code technique stable (UPPER_SNAKE, ≤ 30 caracteres) — unique, utilise par le code metier.',
+                'label'    => 'Libelle affichable (FR, ≤ 120 caracteres).',
+                'position' => 'Ordre d affichage croissant dans les selecteurs (tri position ASC puis label ASC).',
+            ],
+
+            'bank' => [
+                '_table'   => 'Referentiel des banques selectionnables pour le reglement par virement.',
+                'id'       => 'Identifiant interne auto-incremente.',
+                'code'     => 'Code technique stable (UPPER_SNAKE, ≤ 30 caracteres) — unique, utilise par le code metier.',
+                'label'    => 'Libelle affichable (FR, ≤ 120 caracteres).',
+                'position' => 'Ordre d affichage croissant dans les selecteurs (tri position ASC puis label ASC).',
+            ],
+
+            'client' => [
+                '_table'           => 'Repertoire clients (M1 Commercial) — entites archivables (is_archived) et soft-deletables (deleted_at, HP M2).',
+                'id'               => 'Identifiant interne auto-incremente.',
+                'company_name'     => 'Raison sociale (stockee en MAJUSCULES, RG-1.18). Unique case-insensitive parmi les actifs non archives/non supprimes (RG-1.16, uq_client_company_name_active).',
+                'first_name'       => 'Prenom du contact principal (capitalise serveur, RG-1.19). first_name OU last_name obligatoire (RG-1.01).',
+                'last_name'        => 'Nom du contact principal (capitalise serveur, RG-1.19). first_name OU last_name obligatoire (RG-1.01).',
+                'phone_primary'    => 'Telephone principal — stocke en chiffres uniquement (RG-1.20). Obligatoire.',
+                'phone_secondary'  => 'Telephone secondaire optionnel — chiffres uniquement (RG-1.20).',
+                'email'            => 'Email principal (lowercase serveur, RG-1.21). NON unique (RG-1.17 supprimee, Q4).',
+                'distributor_id'   => 'FK auto-referente vers un client porteur de la categorie DISTRIBUTEUR — exclusive avec broker_id (RG-1.03, chk_client_distrib_or_broker). FK -> client.id, ON DELETE SET NULL.',
+                'broker_id'        => 'FK auto-referente vers un client porteur de la categorie COURTIER — exclusive avec distributor_id (RG-1.03). FK -> client.id, ON DELETE SET NULL.',
+                'triage_service'   => 'Drapeau service triage active pour le client. Faux par defaut.',
+                'description'      => 'Onglet Information : description libre. Obligatoire pour le role Commerciale (RG-1.04), optionnel sinon.',
+                'competitors'      => 'Onglet Information : concurrents identifies (texte libre ≤ 255). Obligatoire role Commerciale (RG-1.04).',
+                'founded_at'       => 'Onglet Information : date de creation de l entreprise. Obligatoire role Commerciale (RG-1.04).',
+                'employees_count'  => 'Onglet Information : effectif (entier >= 0). Obligatoire role Commerciale (RG-1.04).',
+                'revenue_amount'   => 'Onglet Information : chiffre d affaires (NUMERIC 15,2). Obligatoire role Commerciale (RG-1.04).',
+                'director_name'    => 'Onglet Information : nom du dirigeant. Obligatoire role Commerciale (RG-1.04).',
+                'profit_amount'    => 'Onglet Information : resultat / benefice (NUMERIC 15,2). Obligatoire role Commerciale (RG-1.04).',
+                'siren'            => 'Onglet Comptabilite : SIREN (9 chiffres attendus). NON unique — peut etre partage entre etablissements (RG-1.15 supprimee, Q4).',
+                'account_number'   => 'Onglet Comptabilite : numero de compte comptable du client.',
+                'tva_mode_id'      => 'Onglet Comptabilite : mode de TVA applique — FK -> tva_mode.id, ON DELETE RESTRICT.',
+                'n_tva'            => 'Onglet Comptabilite : numero de TVA intracommunautaire.',
+                'payment_delay_id' => 'Onglet Comptabilite : delai de reglement — FK -> payment_delay.id, ON DELETE RESTRICT.',
+                'payment_type_id'  => 'Onglet Comptabilite : type de reglement — FK -> payment_type.id, ON DELETE RESTRICT. Code LCR impose >= 1 RIB (RG-1.13), VIREMENT impose une banque (RG-1.12).',
+                'bank_id'          => 'Onglet Comptabilite : banque — FK -> bank.id, ON DELETE RESTRICT. Obligatoire si payment_type = VIREMENT (RG-1.12).',
+                'is_archived'      => 'Drapeau fonctionnel d archivage — masque par defaut dans la liste. Bascule via permission commercial.clients.archive (RG-1.22/23).',
+                'archived_at'      => 'Horodatage de l archivage — pose quand is_archived passe a vrai, remis a null a la restauration (RG-1.22/23).',
+                'deleted_at'       => 'Horodatage du soft-delete technique (HP M2) — non expose par l API au M1. Null = ligne active.',
+            ] + self::timestampableBlamableComments(),
+
+            'client_category' => [
+                '_table'      => 'Jointure M2M client <-> category (Catalog) — categories metier du client (au moins une obligatoire).',
+                'client_id'   => 'FK -> client.id, ON DELETE CASCADE — client porteur de la categorie.',
+                'category_id' => 'FK -> category.id, ON DELETE RESTRICT — categorie rattachee au client.',
+            ],
+
+            'client_contact' => [
+                '_table'          => 'Contacts d un client (1:n) — au moins firstName OU lastName par contact (RG-1.05).',
+                'id'              => 'Identifiant interne auto-incremente.',
+                'client_id'       => 'FK -> client.id, ON DELETE CASCADE — client proprietaire du contact.',
+                'first_name'      => 'Prenom du contact (capitalise serveur). first_name OU last_name obligatoire (RG-1.05, chk_client_contact_name).',
+                'last_name'       => 'Nom du contact (capitalise serveur). first_name OU last_name obligatoire (RG-1.05, chk_client_contact_name).',
+                'job_title'       => 'Fonction / intitule de poste du contact (≤ 120 caracteres).',
+                'phone_primary'   => 'Telephone principal du contact — chiffres uniquement (RG-1.20).',
+                'phone_secondary' => 'Telephone secondaire du contact — chiffres uniquement (RG-1.20).',
+                'email'           => 'Email du contact (lowercase serveur, RG-1.21).',
+                'position'        => 'Ordre d affichage du contact dans la liste du client (croissant).',
+            ] + self::timestampableBlamableComments(),
+
+            'client_address' => [
+                '_table'            => 'Adresses d un client (1:n) — prospect exclusif de livraison/facturation (RG-1.06/07/08), >= 1 site rattache (RG-1.10).',
+                'id'                => 'Identifiant interne auto-incremente.',
+                'client_id'         => 'FK -> client.id, ON DELETE CASCADE — client proprietaire de l adresse.',
+                'is_prospect'       => 'Adresse de prospection — exclusive de is_delivery/is_billing (RG-1.06/07/08, chk_client_address_prospect_exclusive). Faux par defaut.',
+                'is_delivery'       => 'Adresse de livraison. Exclusive de is_prospect. Faux par defaut.',
+                'is_billing'        => 'Adresse de facturation. Exclusive de is_prospect. Impose billing_email (RG-1.11). Faux par defaut.',
+                'country'           => 'Pays de l adresse — defaut France.',
+                'postal_code'       => 'Code postal (4-5 chiffres attendus, RG-1.09).',
+                'city'              => 'Ville — preremplie depuis le code postal via API BAN cote front (RG-1.09).',
+                'street'            => 'Numero et voie de l adresse.',
+                'street_complement' => 'Complement d adresse (etage, batiment...) — optionnel.',
+                'billing_email'     => 'Email de facturation — obligatoire si is_billing, null sinon (RG-1.11, chk_client_address_billing_email).',
+                'position'          => 'Ordre d affichage de l adresse dans la liste du client (croissant).',
+            ] + self::timestampableBlamableComments(),
+
+            'client_address_site' => [
+                '_table'            => 'Jointure M2M client_address <-> site (Sites) — sites desservis par l adresse (>= 1 obligatoire, RG-1.10).',
+                'client_address_id' => 'FK -> client_address.id, ON DELETE CASCADE — adresse concernee.',
+                'site_id'           => 'FK -> site.id, ON DELETE RESTRICT — site rattache a l adresse.',
+            ],
+
+            'client_address_contact' => [
+                '_table'            => 'Jointure M2M client_address <-> client_contact — contacts associes a une adresse.',
+                'client_address_id' => 'FK -> client_address.id, ON DELETE CASCADE — adresse concernee.',
+                'client_contact_id' => 'FK -> client_contact.id, ON DELETE CASCADE — contact associe a l adresse.',
+            ],
+
+            'client_address_category' => [
+                '_table'            => 'Jointure M2M client_address <-> category — categories d adresse (types SECTEUR/AUTRE uniquement, RG-1.29).',
+                'client_address_id' => 'FK -> client_address.id, ON DELETE CASCADE — adresse concernee.',
+                'category_id'       => 'FK -> category.id, ON DELETE RESTRICT — categorie d adresse (type SECTEUR ou AUTRE, RG-1.29).',
+            ],
+
+            'client_rib' => [
+                '_table'    => 'Coordonnees bancaires d un client (1:n) — >= 1 RIB obligatoire si payment_type = LCR (RG-1.13). Tous les champs audites (pas d AuditIgnore).',
+                'id'        => 'Identifiant interne auto-incremente.',
+                'client_id' => 'FK -> client.id, ON DELETE CASCADE — client proprietaire du RIB.',
+                'label'     => 'Libelle du RIB (ex: compte principal).',
+                'bic'       => 'Code BIC/SWIFT de la banque (8 ou 11 caracteres).',
+                'iban'      => 'IBAN du compte (≤ 34 caracteres).',
+                'position'  => 'Ordre d affichage du RIB dans la liste du client (croissant).',
+            ] + self::timestampableBlamableComments(),
         ];
     }
 
@@ -151,12 +280,25 @@ final class ColumnCommentsCatalog
      * Construit la liste des requetes SQL `COMMENT ON TABLE/COLUMN` (en
      * dollar-quoting Postgres `$_$`) a partir du catalogue.
      *
+     * @param null|list<string> $onlyTables Restreint la generation a ces tables
+     *                                      (utile pour la migration retrofit qui
+     *                                      ne doit commenter que les tables deja
+     *                                      presentes a son instant T — les tables
+     *                                      des modules crees plus tard posent
+     *                                      leurs propres COMMENT). null = tout.
+     *
      * @return list<string>
      */
-    public static function toSqlStatements(): array
+    public static function toSqlStatements(?array $onlyTables = null): array
     {
+        $allowed = null === $onlyTables ? null : array_fill_keys($onlyTables, true);
+
         $statements = [];
         foreach (self::comments() as $table => $entries) {
+            if (null !== $allowed && !isset($allowed[$table])) {
+                continue;
+            }
+
             $quotedTable = self::quoteIdent($table);
             foreach ($entries as $column => $description) {
                 if ('_table' === $column) {

tests/Architecture/EntitiesAreTimestampableBlamableTest.php

@@ -5,6 +5,10 @@ declare(strict_types=1);
 namespace App\Tests\Architecture;
 
 use App\Module\Catalog\Domain\Entity\CategoryType;
+use App\Module\Commercial\Domain\Entity\Bank;
+use App\Module\Commercial\Domain\Entity\PaymentDelay;
+use App\Module\Commercial\Domain\Entity\PaymentType;
+use App\Module\Commercial\Domain\Entity\TvaMode;
 use App\Module\Core\Domain\Entity\Permission;
 use App\Module\Core\Domain\Entity\Role;
 use App\Module\Core\Domain\Entity\User;
@@ -49,6 +53,11 @@ final class EntitiesAreTimestampableBlamableTest extends TestCase
      * - CategoryType : referentiel statique (codes de typage des categories),
      *   pas de besoin de tracabilite user-driven (cree par migration/seed,
      *   pas pilote utilisateur au M0). Cf. spec-back § 2.8.bis + RG-1.17.
+     * - TvaMode / PaymentDelay / PaymentType / Bank (M1 Commercial) : referentiels
+     *   comptables statiques (id/code/label/position), seedes par migration +
+     *   CommercialReferentialFixtures, lecture seule au M1 (HP-M2-2). Pas de
+     *   tracabilite user-driven, meme justification que CategoryType. Cf.
+     *   spec-back M1 § 2.6 + § 3.5.
      *
      * Les futurs referentiels statiques s'ajoutent ici avec une justification.
      */
@@ -58,6 +67,10 @@ final class EntitiesAreTimestampableBlamableTest extends TestCase
         Permission::class,
         Site::class,
         CategoryType::class,
+        TvaMode::class,
+        PaymentDelay::class,
+        PaymentType::class,
+        Bank::class,
     ];
 
     public function testAllBusinessEntitiesImplementBothInterfaces(): void

tests/Module/Commercial/Api/AbstractCommercialApiTestCase.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Commercial\Api;
+
+use ApiPlatform\Symfony\Bundle\Test\Client;
+use App\Module\Catalog\Domain\Entity\Category;
+use App\Module\Catalog\Domain\Entity\CategoryType;
+use App\Module\Commercial\Domain\Entity\Client as ClientEntity;
+use App\Module\Core\Domain\Entity\Role;
+use App\Module\Core\Domain\Entity\User;
+use App\Tests\Module\Core\Api\AbstractApiTestCase;
+use DateTimeImmutable;
+
+/**
+ * Base des tests fonctionnels du module Commercial (M1 — repertoire clients).
+ *
+ * Etend la base Core : ajoute des factories pour seeder vite des categories
+ * typees (DISTRIBUTEUR / COURTIER / SECTEUR) et des clients, plus un helper
+ * d'authentification admin.
+ *
+ * Cleanup : tearDown purge clients, categories `test_cli_cat_*` et users/roles
+ * `test_*`. Les category_types business sont fetch-or-create (idempotents) et
+ * laisses en place (pas de DELETE pour ne pas entrer en conflit avec d'autres
+ * suites). Pas de DAMA en local -> purge manuelle obligatoire.
+ *
+ * @internal
+ */
+abstract class AbstractCommercialApiTestCase extends AbstractApiTestCase
+{
+    protected const string TEST_CATEGORY_PREFIX = 'test_cli_cat_';
+
+    protected function tearDown(): void
+    {
+        $this->cleanupCommercialTestData();
+        parent::tearDown();
+    }
+
+    protected function createAdminClient(): Client
+    {
+        return $this->authenticatedClient('admin', 'admin');
+    }
+
+    /**
+     * Recupere (ou cree) un CategoryType par son code metier. Idempotent : la
+     * contrainte d'unicite sur category_type.code interdit les doublons.
+     */
+    protected function createCategoryType(string $code): CategoryType
+    {
+        $em       = $this->getEm();
+        $existing = $em->getRepository(CategoryType::class)->findOneBy(['code' => $code]);
+        if (null !== $existing) {
+            return $existing;
+        }
+
+        $type = new CategoryType();
+        $type->setCode($code);
+        $type->setLabel(ucfirst(strtolower($code)));
+        $em->persist($type);
+        $em->flush();
+
+        return $type;
+    }
+
+    /**
+     * Cree une Category de test rattachee a un type metier donne (code).
+     */
+    protected function createCategory(string $typeCode = 'SECTEUR'): Category
+    {
+        $em       = $this->getEm();
+        $suffix   = substr(bin2hex(random_bytes(4)), 0, 8);
+        $category = new Category();
+        $category->setName(self::TEST_CATEGORY_PREFIX.$suffix);
+        $category->setCategoryType($this->createCategoryType($typeCode));
+        $em->persist($category);
+        $em->flush();
+
+        return $category;
+    }
+
+    /**
+     * Seede directement un Client en base (sans passer par l'API), pour les
+     * tests de liste / archivage. Le client porte une categorie SECTEUR.
+     */
+    protected function seedClient(string $companyName, bool $isArchived = false, string $categoryTypeCode = 'SECTEUR'): ClientEntity
+    {
+        $em     = $this->getEm();
+        $client = new ClientEntity();
+        // Stocke en MAJUSCULES pour refleter l'etat normalise (RG-1.18) qu'aurait
+        // produit le ClientProcessor via l'API.
+        $client->setCompanyName(mb_strtoupper($companyName, 'UTF-8'));
+        $client->setLastName('Seed');
+        $client->setPhonePrimary('0102030405');
+        $client->setEmail(strtolower(str_replace(' ', '', $companyName)).'@seed.test');
+        $client->addCategory($this->createCategory($categoryTypeCode));
+        $client->setIsArchived($isArchived);
+        if ($isArchived) {
+            $client->setArchivedAt(new DateTimeImmutable());
+        }
+        $em->persist($client);
+        $em->flush();
+
+        return $client;
+    }
+
+    private function cleanupCommercialTestData(): void
+    {
+        $em = $this->getEm();
+
+        // Clients d'abord (la jointure client_category est purgee par
+        // ON DELETE CASCADE ; les auto-references distributor/broker sont
+        // ON DELETE SET NULL).
+        $em->createQuery('DELETE FROM '.ClientEntity::class)->execute();
+
+        // Categories de test ensuite (FK client_category deja purgee).
+        $em->createQuery(
+            'DELETE FROM '.Category::class.' c WHERE c.name LIKE :prefix',
+        )->setParameter('prefix', self::TEST_CATEGORY_PREFIX.'%')->execute();
+
+        // Users / roles jetables.
+        $em->createQuery(
+            'DELETE FROM '.User::class.' u WHERE u.username LIKE :prefix',
+        )->setParameter('prefix', 'test_%')->execute();
+
+        $em->createQuery(
+            'DELETE FROM '.Role::class.' r WHERE r.code LIKE :prefix',
+        )->setParameter('prefix', 'test_%')->execute();
+    }
+}

tests/Module/Commercial/Api/ClientApiTest.php

@@ -0,0 +1,285 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Commercial\Api;
+
+/**
+ * Tests fonctionnels de l'API /api/clients (M1) — branche ERP-55.
+ *
+ * Authentifies en ADMIN (bypass RBAC via isAdmin) : on valide ici les regles
+ * METIER (normalisation, unicite, distributor/broker, archivage, liste). Le
+ * gating par permission (accounting.manage / archive / RG-1.28 strict, RG-1.04
+ * Commerciale) est couvert par les tests unitaires du ClientProcessor : il
+ * exige des users non-admin portant des permissions `commercial.clients.*` qui
+ * ne sont declarees qu'en ERP-59 (tests RBAC complets en ERP-60).
+ *
+ * @internal
+ */
+final class ClientApiTest extends AbstractCommercialApiTestCase
+{
+    private const string LD = 'application/ld+json';
+
+    public function testPostNormalizesTextFields(): void
+    {
+        $client = $this->createAdminClient();
+        $cat    = $this->createCategory('SECTEUR');
+
+        $response = $client->request('POST', '/api/clients', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'companyName'  => 'acme sas',
+                'firstName'    => 'JEAN',
+                'lastName'     => 'dupont',
+                'phonePrimary' => '06.12.34.56.78',
+                'email'        => 'Jean.DUPONT@ACME.FR',
+                'categories'   => ['/api/categories/'.$cat->getId()],
+            ],
+        ]);
+
+        self::assertResponseStatusCodeSame(201);
+        $data = $response->toArray();
+        // RG-1.18 / 1.19 / 1.20 / 1.21
+        self::assertSame('ACME SAS', $data['companyName']);
+        self::assertSame('Jean', $data['firstName']);
+        self::assertSame('Dupont', $data['lastName']);
+        self::assertSame('0612345678', $data['phonePrimary']);
+        self::assertSame('jean.dupont@acme.fr', $data['email']);
+        self::assertFalse($data['isArchived']);
+    }
+
+    public function testPostDuplicateCompanyNameReturns409(): void
+    {
+        $client = $this->createAdminClient();
+        $cat    = $this->createCategory('SECTEUR');
+        $iri    = '/api/categories/'.$cat->getId();
+
+        $payload = [
+            'companyName'  => 'Doublon SARL',
+            'firstName'    => 'A',
+            'phonePrimary' => '0102030405',
+            'email'        => 'dup@test.fr',
+            'categories'   => [$iri],
+        ];
+
+        $client->request('POST', '/api/clients', ['headers' => ['Content-Type' => self::LD], 'json' => $payload]);
+        self::assertResponseStatusCodeSame(201);
+
+        // Meme nom (insensible a la casse via l'index LOWER) -> 409 (RG-1.16).
+        $payload['email'] = 'dup2@test.fr';
+        $client->request('POST', '/api/clients', ['headers' => ['Content-Type' => self::LD], 'json' => $payload]);
+        self::assertResponseStatusCodeSame(409);
+    }
+
+    public function testPostWithoutFirstOrLastNameReturns422(): void
+    {
+        $client = $this->createAdminClient();
+        $cat    = $this->createCategory('SECTEUR');
+
+        $client->request('POST', '/api/clients', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'companyName'  => 'No Contact Name',
+                'phonePrimary' => '0102030405',
+                'email'        => 'nc@test.fr',
+                'categories'   => ['/api/categories/'.$cat->getId()],
+            ],
+        ]);
+
+        // RG-1.01
+        self::assertResponseStatusCodeSame(422);
+    }
+
+    public function testPostWithoutCategoryReturns422(): void
+    {
+        $client = $this->createAdminClient();
+
+        $client->request('POST', '/api/clients', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'companyName'  => 'No Category',
+                'firstName'    => 'A',
+                'phonePrimary' => '0102030405',
+                'email'        => 'nocat@test.fr',
+                'categories'   => [],
+            ],
+        ]);
+
+        // Assert\Count(min: 1)
+        self::assertResponseStatusCodeSame(422);
+    }
+
+    public function testPostWithDistributorAndBrokerReturns422(): void
+    {
+        $client      = $this->createAdminClient();
+        $cat         = $this->createCategory('SECTEUR');
+        $distributor = $this->seedClient('Distrib Mutex', false, 'DISTRIBUTEUR');
+
+        $client->request('POST', '/api/clients', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'companyName'  => 'Mutex Client',
+                'firstName'    => 'A',
+                'phonePrimary' => '0102030405',
+                'email'        => 'mutex@test.fr',
+                'categories'   => ['/api/categories/'.$cat->getId()],
+                'distributor'  => '/api/clients/'.$distributor->getId(),
+                'broker'       => '/api/clients/'.$distributor->getId(),
+            ],
+        ]);
+
+        // RG-1.03 (exclusivite)
+        self::assertResponseStatusCodeSame(422);
+    }
+
+    public function testPostDistributorReferencingNonDistributorReturns422(): void
+    {
+        $client    = $this->createAdminClient();
+        $cat       = $this->createCategory('SECTEUR');
+        $notDistro = $this->seedClient('Pas Un Distrib', false, 'SECTEUR');
+
+        $client->request('POST', '/api/clients', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'companyName'  => 'Bad Distrib Ref',
+                'firstName'    => 'A',
+                'phonePrimary' => '0102030405',
+                'email'        => 'baddistrib@test.fr',
+                'categories'   => ['/api/categories/'.$cat->getId()],
+                'distributor'  => '/api/clients/'.$notDistro->getId(),
+            ],
+        ]);
+
+        // RG-1.03 (le distributor doit etre categorise DISTRIBUTEUR)
+        self::assertResponseStatusCodeSame(422);
+    }
+
+    public function testPostValidDistributorReturns201(): void
+    {
+        $client      = $this->createAdminClient();
+        $cat         = $this->createCategory('SECTEUR');
+        $distributor = $this->seedClient('Vrai Distrib', false, 'DISTRIBUTEUR');
+
+        $client->request('POST', '/api/clients', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'companyName'  => 'Client Avec Distrib',
+                'firstName'    => 'A',
+                'phonePrimary' => '0102030405',
+                'email'        => 'okdistrib@test.fr',
+                'categories'   => ['/api/categories/'.$cat->getId()],
+                'distributor'  => '/api/clients/'.$distributor->getId(),
+            ],
+        ]);
+
+        self::assertResponseStatusCodeSame(201);
+    }
+
+    public function testListSortedByCompanyNameAscAndExcludesArchived(): void
+    {
+        $client = $this->createAdminClient();
+        $this->seedClient('Zebra Co');
+        $this->seedClient('Alpha Co');
+        $this->seedClient('Archivé Co', true);
+
+        $names = $client->request('GET', '/api/clients?pagination=false', [
+            'headers' => ['Accept' => self::LD],
+        ])->toArray()['member'];
+        $companyNames = array_map(static fn (array $c): string => $c['companyName'], $names);
+
+        // RG-1.24 : l'archive est exclue par defaut.
+        self::assertNotContains('ARCHIVÉ CO', $companyNames);
+        // RG-1.26 : tri companyName ASC (Alpha avant Zebra).
+        $alpha = array_search('ALPHA CO', $companyNames, true);
+        $zebra = array_search('ZEBRA CO', $companyNames, true);
+        self::assertNotFalse($alpha);
+        self::assertNotFalse($zebra);
+        self::assertLessThan($zebra, $alpha);
+    }
+
+    public function testListIncludeArchivedReturnsArchived(): void
+    {
+        $client = $this->createAdminClient();
+        $this->seedClient('Hidden Archived', true);
+
+        $members = $client->request('GET', '/api/clients?includeArchived=true&pagination=false', [
+            'headers' => ['Accept' => self::LD],
+        ])->toArray()['member'];
+        $names = array_map(static fn (array $c): string => $c['companyName'], $members);
+
+        // RG-1.25
+        self::assertContains('HIDDEN ARCHIVED', $names);
+    }
+
+    public function testCollectionIsPaginated(): void
+    {
+        $client = $this->createAdminClient();
+        $this->seedClient('Paginated One');
+
+        // Collection Hydra avec total (la cle `view` n'apparait qu'a partir de
+        // 2 pages cote API Platform 4, donc non assertable sur page unique).
+        $page1 = $client->request('GET', '/api/clients', ['headers' => ['Accept' => self::LD]])->toArray();
+        self::assertArrayHasKey('totalItems', $page1);
+        self::assertNotEmpty($page1['member']);
+
+        // Preuve que la pagination serveur est bien engagee : la page 2 d'un jeu
+        // tenant sur une page est vide (un provider non pagine ignorerait `page`
+        // et renverrait quand meme les items).
+        $page2 = $client->request('GET', '/api/clients?page=2', ['headers' => ['Accept' => self::LD]])->toArray();
+        self::assertSame([], $page2['member']);
+    }
+
+    public function testPatchArchiveSetsArchivedAtThenRestore(): void
+    {
+        $client = $this->createAdminClient();
+        $seed   = $this->seedClient('To Archive');
+        $iri    = '/api/clients/'.$seed->getId();
+
+        // Archive (RG-1.22) : admin a la permission archive via bypass isAdmin.
+        $archived = $client->request('PATCH', $iri, [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['isArchived' => true],
+        ])->toArray();
+        self::assertResponseStatusCodeSame(200);
+        self::assertTrue($archived['isArchived']);
+        self::assertNotNull($archived['archivedAt']);
+
+        // Restauration (RG-1.23) : archivedAt repasse a null.
+        $restored = $client->request('PATCH', $iri, [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['isArchived' => false],
+        ])->toArray();
+        self::assertResponseStatusCodeSame(200);
+        self::assertFalse($restored['isArchived']);
+        self::assertNull($restored['archivedAt']);
+    }
+
+    public function testPatchArchiveWithOtherFieldReturns422(): void
+    {
+        $client = $this->createAdminClient();
+        $seed   = $this->seedClient('Archive Plus Field');
+
+        $client->request('PATCH', '/api/clients/'.$seed->getId(), [
+            'headers' => ['Content-Type' => 'application/merge-patch+json'],
+            'json'    => ['isArchived' => true, 'companyName' => 'Renamed'],
+        ]);
+
+        // RG-1.22 : une requete d'archivage ne modifie aucun autre champ.
+        self::assertResponseStatusCodeSame(422);
+    }
+
+    public function testGetDetailEmbedsSubCollections(): void
+    {
+        $client = $this->createAdminClient();
+        $seed   = $this->seedClient('Detail Embed');
+
+        $data = $client->request('GET', '/api/clients/'.$seed->getId(), [
+            'headers' => ['Accept' => self::LD],
+        ])->toArray();
+
+        // § 4.2 : le detail embarque contacts / adresses / ribs.
+        self::assertArrayHasKey('contacts', $data);
+        self::assertArrayHasKey('addresses', $data);
+        self::assertArrayHasKey('ribs', $data);
+    }
+}

tests/Module/Commercial/Unit/ClientFieldNormalizerTest.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Commercial\Unit;
+
+use App\Module\Commercial\Application\Service\ClientFieldNormalizer;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Tests unitaires de la normalisation serveur (RG-1.18 a RG-1.21).
+ *
+ * @internal
+ */
+final class ClientFieldNormalizerTest extends TestCase
+{
+    private ClientFieldNormalizer $normalizer;
+
+    protected function setUp(): void
+    {
+        $this->normalizer = new ClientFieldNormalizer();
+    }
+
+    public function testCompanyNameIsUppercased(): void
+    {
+        // RG-1.18
+        self::assertSame('ACME SAS', $this->normalizer->normalizeCompanyName('  acme sas '));
+        self::assertNull($this->normalizer->normalizeCompanyName(null));
+    }
+
+    public function testPersonNameIsTitleCased(): void
+    {
+        // RG-1.19
+        self::assertSame('Jean', $this->normalizer->normalizePersonName('JEAN'));
+        self::assertSame('Dupont', $this->normalizer->normalizePersonName('dupont'));
+        self::assertNull($this->normalizer->normalizePersonName('   '));
+        self::assertNull($this->normalizer->normalizePersonName(null));
+    }
+
+    public function testEmailIsLowercased(): void
+    {
+        // RG-1.21
+        self::assertSame('jean.dupont@acme.fr', $this->normalizer->normalizeEmail(' Jean.DUPONT@ACME.FR '));
+        self::assertNull($this->normalizer->normalizeEmail(null));
+        self::assertNull($this->normalizer->normalizeEmail('   '));
+    }
+
+    public function testPhoneKeepsOnlyDigits(): void
+    {
+        // RG-1.20
+        self::assertSame('0612345678', $this->normalizer->normalizePhone('06.12.34.56.78'));
+        self::assertSame('0612345678', $this->normalizer->normalizePhone('06 12 34 56 78'));
+        self::assertNull($this->normalizer->normalizePhone('----'));
+        self::assertNull($this->normalizer->normalizePhone(null));
+    }
+}

tests/Module/Commercial/Unit/ClientProcessorTest.php

@@ -0,0 +1,253 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Commercial\Unit;
+
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use ApiPlatform\Validator\Exception\ValidationException;
+use App\Module\Commercial\Application\Service\ClientFieldNormalizer;
+use App\Module\Commercial\Application\Validator\ClientInformationCompletenessValidator;
+use App\Module\Commercial\Domain\Entity\Bank;
+use App\Module\Commercial\Domain\Entity\Client;
+use App\Module\Commercial\Domain\Entity\ClientRib;
+use App\Module\Commercial\Domain\Entity\PaymentType;
+use App\Module\Commercial\Infrastructure\ApiPlatform\State\Processor\ClientProcessor;
+use App\Shared\Domain\Contract\BusinessRoleAwareInterface;
+use App\Shared\Domain\Security\BusinessRoles;
+use PHPUnit\Framework\TestCase;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+/**
+ * Tests unitaires du ClientProcessor : gating par permission (accounting.manage
+ * / archive / RG-1.28 strict) et regles metier non testables en HTTP admin
+ * (RG-1.04 Commerciale, RG-1.12 Virement, RG-1.13 LCR), grace a un Security et
+ * un RequestStack stubbes.
+ *
+ * @internal
+ */
+final class ClientProcessorTest extends TestCase
+{
+    public function testAccountingFieldWithoutPermissionIsForbidden(): void
+    {
+        // RG-1.28 : un champ comptable sans accounting.manage -> 403.
+        $processor = $this->makeProcessor(granted: [], payload: ['siren' => '123456789']);
+
+        $this->expectException(AccessDeniedHttpException::class);
+        $processor->process($this->minimalClient(), $this->operation());
+    }
+
+    public function testStrictMixWithAccountingFieldIsForbidden(): void
+    {
+        // RG-1.28 : payload mixant main + accounting sans la permission -> 403
+        // sur l'ensemble (pas de filtrage silencieux).
+        $processor = $this->makeProcessor(
+            granted: [],
+            payload: ['companyName' => 'X', 'siren' => '123456789'],
+        );
+
+        $this->expectException(AccessDeniedHttpException::class);
+        $processor->process($this->minimalClient(), $this->operation());
+    }
+
+    public function testArchiveWithoutPermissionIsForbidden(): void
+    {
+        // RG-1.22 : isArchived sans la permission archive -> 403.
+        $processor = $this->makeProcessor(granted: [], payload: ['isArchived' => true]);
+
+        $this->expectException(AccessDeniedHttpException::class);
+        $processor->process($this->minimalClient(), $this->operation());
+    }
+
+    public function testArchiveWithOtherFieldIsUnprocessable(): void
+    {
+        // RG-1.22 : une requete d'archivage ne modifie aucun autre champ.
+        $processor = $this->makeProcessor(
+            granted: ['commercial.clients.archive'],
+            payload: ['isArchived' => true, 'companyName' => 'X'],
+        );
+
+        $this->expectException(UnprocessableEntityHttpException::class);
+        $processor->process($this->minimalClient(), $this->operation());
+    }
+
+    public function testVirementWithoutBankIsUnprocessable(): void
+    {
+        // RG-1.12
+        $client = $this->minimalClient();
+        $client->setPaymentType($this->paymentType('VIREMENT'));
+
+        $processor = $this->makeProcessor(
+            granted: ['commercial.clients.accounting.manage'],
+            payload: ['paymentType' => '/api/payment_types/1'],
+        );
+
+        $this->expectException(ValidationException::class);
+        $processor->process($client, $this->operation());
+    }
+
+    public function testVirementWithBankPasses(): void
+    {
+        // RG-1.12 satisfait : Virement + banque.
+        $client = $this->minimalClient();
+        $client->setPaymentType($this->paymentType('VIREMENT'));
+        $client->setBank(new Bank());
+
+        $processor = $this->makeProcessor(
+            granted: ['commercial.clients.accounting.manage'],
+            payload: ['paymentType' => '/api/payment_types/1', 'bank' => '/api/banks/1'],
+        );
+
+        $result = $processor->process($client, $this->operation());
+        self::assertInstanceOf(Client::class, $result);
+    }
+
+    public function testLcrWithoutRibIsUnprocessable(): void
+    {
+        // RG-1.13
+        $client = $this->minimalClient();
+        $client->setPaymentType($this->paymentType('LCR'));
+
+        $processor = $this->makeProcessor(
+            granted: ['commercial.clients.accounting.manage'],
+            payload: ['paymentType' => '/api/payment_types/2'],
+        );
+
+        $this->expectException(ValidationException::class);
+        $processor->process($client, $this->operation());
+    }
+
+    public function testLcrWithRibPasses(): void
+    {
+        // RG-1.13 satisfait : LCR + au moins un RIB.
+        $client = $this->minimalClient();
+        $client->setPaymentType($this->paymentType('LCR'));
+        $client->addRib(new ClientRib());
+
+        $processor = $this->makeProcessor(
+            granted: ['commercial.clients.accounting.manage'],
+            payload: ['paymentType' => '/api/payment_types/2'],
+        );
+
+        self::assertInstanceOf(Client::class, $processor->process($client, $this->operation()));
+    }
+
+    public function testCommercialeIncompleteInformationIsUnprocessable(): void
+    {
+        // RG-1.04 : role Commerciale + onglet Information incomplet -> 422.
+        $client = $this->minimalClient();
+        $client->setDescription('Une description'); // les autres champs Information restent null
+
+        $processor = $this->makeProcessor(
+            granted: [],
+            payload: ['description' => 'Une description'],
+            user: $this->commercialeUser(),
+        );
+
+        $this->expectException(ValidationException::class);
+        $processor->process($client, $this->operation());
+    }
+
+    public function testNonCommercialeSkipsInformationCompleteness(): void
+    {
+        // Meme payload incomplet, mais user non-Commerciale -> aucun blocage.
+        $client = $this->minimalClient();
+        $client->setDescription('Une description');
+
+        $processor = $this->makeProcessor(
+            granted: [],
+            payload: ['description' => 'Une description'],
+            user: null,
+        );
+
+        self::assertInstanceOf(Client::class, $processor->process($client, $this->operation()));
+    }
+
+    /**
+     * @param list<string>         $granted Permissions accordees a l'utilisateur courant
+     * @param array<string, mixed> $payload Corps JSON simule de la requete
+     */
+    private function makeProcessor(array $granted, array $payload, ?UserInterface $user = null): ClientProcessor
+    {
+        $persist = new class implements ProcessorInterface {
+            public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
+            {
+                return $data;
+            }
+        };
+
+        $security = $this->createStub(Security::class);
+        $security->method('isGranted')->willReturnCallback(
+            static fn (mixed $attribute): bool => is_string($attribute) && in_array($attribute, $granted, true),
+        );
+        $security->method('getUser')->willReturn($user);
+
+        $requestStack = new RequestStack();
+        $requestStack->push(new Request([], [], [], [], [], [], json_encode($payload, JSON_THROW_ON_ERROR)));
+
+        return new ClientProcessor(
+            $persist,
+            new ClientFieldNormalizer(),
+            new ClientInformationCompletenessValidator(),
+            $security,
+            $requestStack,
+        );
+    }
+
+    /**
+     * Client minimal valide vis-a-vis de RG-1.01 (un nom de contact) — suffisant
+     * pour atteindre les validations testees.
+     */
+    private function minimalClient(): Client
+    {
+        $client = new Client();
+        $client->setCompanyName('Test Co');
+        $client->setLastName('Dupont');
+        $client->setPhonePrimary('0102030405');
+        $client->setEmail('t@test.fr');
+
+        return $client;
+    }
+
+    private function paymentType(string $code): PaymentType
+    {
+        $type = new PaymentType();
+        $type->setCode($code);
+        $type->setLabel($code);
+
+        return $type;
+    }
+
+    private function operation(): Operation
+    {
+        return $this->createStub(Operation::class);
+    }
+
+    private function commercialeUser(): UserInterface
+    {
+        return new class implements UserInterface, BusinessRoleAwareInterface {
+            public function hasBusinessRole(string $roleCode): bool
+            {
+                return BusinessRoles::COMMERCIALE === $roleCode;
+            }
+
+            public function getRoles(): array
+            {
+                return ['ROLE_USER'];
+            }
+
+            public function eraseCredentials(): void {}
+
+            public function getUserIdentifier(): string
+            {
+                return 'commerciale-test';
+            }
+        };
+    }
+}

tests/Module/Commercial/Unit/ClientReadGroupContextBuilderTest.php

@@ -0,0 +1,85 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Commercial\Unit;
+
+use ApiPlatform\State\SerializerContextBuilderInterface;
+use App\Module\Commercial\Domain\Entity\Client;
+use App\Module\Commercial\Infrastructure\ApiPlatform\Serializer\ClientReadGroupContextBuilder;
+use PHPUnit\Framework\TestCase;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * Tests unitaires du context builder qui ajoute conditionnellement le groupe
+ * de lecture `client:read:accounting` selon la permission accounting.view
+ * (§ 2.7 / § 4.1 / § 4.2).
+ *
+ * @internal
+ */
+final class ClientReadGroupContextBuilderTest extends TestCase
+{
+    public function testAddsAccountingGroupForClientReadWhenGranted(): void
+    {
+        $builder = $this->builder(
+            baseContext: ['resource_class' => Client::class, 'groups' => ['client:read', 'default:read']],
+            granted: true,
+        );
+
+        $context = $builder->createFromRequest(new Request(), true);
+
+        self::assertContains('client:read:accounting', $context['groups']);
+    }
+
+    public function testDoesNotAddAccountingGroupWhenNotGranted(): void
+    {
+        $builder = $this->builder(
+            baseContext: ['resource_class' => Client::class, 'groups' => ['client:read', 'default:read']],
+            granted: false,
+        );
+
+        $context = $builder->createFromRequest(new Request(), true);
+
+        self::assertNotContains('client:read:accounting', $context['groups']);
+    }
+
+    public function testDoesNotAddAccountingGroupOnWrite(): void
+    {
+        $builder = $this->builder(
+            baseContext: ['resource_class' => Client::class, 'groups' => ['client:write:main']],
+            granted: true,
+        );
+
+        // normalization = false -> ecriture : pas de groupe de lecture ajoute.
+        $context = $builder->createFromRequest(new Request(), false);
+
+        self::assertNotContains('client:read:accounting', $context['groups']);
+    }
+
+    public function testIgnoresOtherResources(): void
+    {
+        $builder = $this->builder(
+            baseContext: ['resource_class' => 'App\Other\Resource', 'groups' => ['other:read']],
+            granted: true,
+        );
+
+        $context = $builder->createFromRequest(new Request(), true);
+
+        self::assertSame(['other:read'], $context['groups']);
+    }
+
+    /**
+     * @param array<string, mixed> $baseContext
+     */
+    private function builder(array $baseContext, bool $granted): ClientReadGroupContextBuilder
+    {
+        $decorated = $this->createStub(SerializerContextBuilderInterface::class);
+        $decorated->method('createFromRequest')->willReturn($baseContext);
+
+        $security = $this->createStub(Security::class);
+        $security->method('isGranted')->willReturn($granted);
+
+        return new ClientReadGroupContextBuilder($decorated, $security);
+    }
+}