Tax-exempt customer handling is implemented

B2B buyers — resellers, nonprofits, government entities — present tax exemption certificates that legally prohibit collecting sales tax on qualifying purchases. When a customer's is_tax_exempt flag exists in the database but the tax calculation function never checks it, the store collects tax it is not entitled to receive and must remit it to the state, then issue refunds when challenged. US state resale exemption certificate laws (uniform under the Streamlined Sales Tax Agreement in 24 states) impose penalty exposure when a seller knowingly ignores a valid certificate. CWE-682 applies: the calculation produces an incorrect non-zero result when it should return $0.00.

Gate the tax calculation on the customer's exemption status in lib/tax.ts:

// lib/tax.ts
function calculateTax(
  customer: Customer,
  items: OrderItem[],
  address: Address
): number {
  if (customer.is_tax_exempt) {
    return 0 // exempt customer — do not collect tax
  }
  // ... normal taxable calculation
  const taxable = items
    .filter(i => !i.is_tax_exempt)
    .reduce((sum, i) => sum + i.price * i.quantity, 0)
  return Math.round(taxable * getTaxRate(address))
}

Add the matching schema column if it doesn't exist:

ALTER TABLE customers ADD COLUMN is_tax_exempt BOOLEAN NOT NULL DEFAULT FALSE;
ALTER TABLE customers ADD COLUMN tax_exempt_certificate_id TEXT;

Verify in test that a cart for an exempt customer returns tax: 0 regardless of items or jurisdiction.