@endora-commerce/mod-credit-limits 0.100.0

package/dist/migrations/20260818T081252_credit_limits_credit_limit_reservation_order_fk.js

@@ -0,0 +1,81 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * `credit_limit_reservations.order_id` gains the foreign key it never had
+ * (D-94.1, site 4 — the site the D-94 sweep found, of exactly the shape D-90
+ * repaired for `shipments.order_id`).
+ *
+ * `CreditLimitService.reserve({ tx })` is called from `placeOrder` with the
+ * placement `EntityManager`, so the `PESSIMISTIC_WRITE` on the organization's
+ * `credit_limits` row — or the owning ancestor's row, taken with
+ * `select … for update` — is held until placement commits. A separate
+ * transaction would leave credit consumed for an order that rolled back:
+ * `stock_allocations`' argument, in money. D-78 point 2 rules such a seam
+ * permanent and *declared*, and what makes the declaration honest is a
+ * constraint. The omission tracks the module boundary and nothing else — the
+ * same `create table` (`20260425T063333_credit_limits_init.ts:34-48`) declares
+ * `credit_limit_reservations_credit_limit_fk` on `credit_limit_id` and leaves
+ * `order_id` bare.
+ *
+ * `on delete restrict`: a reservation row is one half of a counter. Deleting
+ * an order under `cascade` would drop the reservation while the credit stays
+ * drawn. `restrict` says the only correct thing — release it first.
+ *
+ * The column accepted unconstrained values from 2026-04-25 until this
+ * migration, so the constraint is preceded by an explicit orphan report. Any
+ * orphan with `status = 'active'` has been silently consuming an
+ * organization's available credit, and `releaseByOrder` — which looks the
+ * reservation up **by order id** — cannot reach it. Export first (it is a
+ * money record), then delete; releasing rather than deleting does not satisfy
+ * the constraint, because the row still names a missing order. If the locked
+ * amount is non-zero, tell the organization's owner what their available
+ * credit was and what it now is: this is a customer-facing correction, not a
+ * schema chore (D-94.2, remedy 3).
+ *
+ * `credit_limits` declares `orders` in its manifest `dependencies` for this
+ * edge (AGENTS.md § Migrations item 4). The reverse port edge — `orders`
+ * resolving `creditLimitService` — moves to `acknowledgedDependencies`, which
+ * drops the install ordering the constraint says is backwards and keeps every
+ * refusal exactly as it was (D-94.3).
+ */
+export class Migration20260818T081252CreditLimitsCreditLimitReservationOrderFk extends Migration {
+    async up() {
+        this.addSql(`
+      do $$
+      declare
+        orphan_count bigint;
+        amount_locked numeric(14,2);
+        sample text;
+      begin
+        select count(*),
+               coalesce(sum(r."amount") filter (where r."status" = 'active'), 0)
+          into orphan_count, amount_locked
+          from "credit_limit_reservations" r
+          left join "orders" o on o."id" = r."order_id"
+         where o."id" is null;
+
+        if orphan_count > 0 then
+          select string_agg(x."order_id"::text, ', ') into sample
+            from (
+              select distinct r."order_id"
+                from "credit_limit_reservations" r
+                left join "orders" o on o."id" = r."order_id"
+               where o."id" is null
+               limit 10
+            ) x;
+          raise exception
+            'credit_limit_reservations_order_fk cannot be added: % orphaned credit_limit_reservations.order_id value(s) reference no orders row, holding % in still-active reservations releaseByOrder cannot reach (first ten: %). Export those money records, delete them, tell each affected organization what their available credit was and what it now is, then re-run the migration.',
+            orphan_count, amount_locked, sample;
+        end if;
+      end $$;
+    `);
+        this.addSql(`
+      alter table "credit_limit_reservations"
+        add constraint "credit_limit_reservations_order_fk" foreign key ("order_id")
+          references "orders" ("id") on delete restrict;
+    `);
+    }
+    async down() {
+        this.addSql(`alter table "credit_limit_reservations" drop constraint if exists "credit_limit_reservations_order_fk";`);
+    }
+}
+//# sourceMappingURL=20260818T081252_credit_limits_credit_limit_reservation_order_fk.js.map

package/dist/migrations/20260818T081252_credit_limits_credit_limit_reservation_order_fk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260818T081252_credit_limits_credit_limit_reservation_order_fk.js","sourceRoot":"","sources":["../../src/migrations/20260818T081252_credit_limits_credit_limit_reservation_order_fk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,OAAO,iEAAkE,SAAQ,SAAS;IACrF,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BX,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC;;;;KAIX,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CACT,yGAAyG,CAC1G,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/20260821T140323_credit_limits_reservation_reserving_organization.d.ts

@@ -0,0 +1,29 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * `credit_limit_reservations.reserving_organization_id` — who drew the credit,
+ * recorded by this module instead of asked of `orders` (feature 075).
+ *
+ * The `independent_default` inheritance mode sums "the active reservations this
+ * descendant has consumed", and until now the only record of which descendant
+ * that was lived in somebody else's table: the sum ran
+ * `join orders o on o.id = r.order_id where o.organization_id = ?`, inside the
+ * placement transaction, while a `PESSIMISTIC_WRITE` was held on the owning
+ * organization's credit row. The value it read is one this module already has
+ * in hand — `reserve` is called with the reserving organization, and placement
+ * writes the same value onto the order — so the join was buying nothing but a
+ * cross-module reach the boundary check had to carry as debt.
+ *
+ * The backfill is the one place that still needs `orders`, and it is the right
+ * place for it: a migration naming another module's table is ordered by the
+ * dependency graph (this module declares `orders`, which
+ * `credit_limit_reservations_order_fk` already obliges) rather than executed on
+ * a hot money path.
+ *
+ * `not null` holds because that foreign key does: `on delete restrict` against
+ * `orders.id` means every reservation row has an order to take the value from.
+ */
+export declare class Migration20260821T140323CreditLimitsReservationReservingOrganization extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260821T140323_credit_limits_reservation_reserving_organization.d.ts.map

package/dist/migrations/20260821T140323_credit_limits_reservation_reserving_organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260821T140323_credit_limits_reservation_reserving_organization.d.ts","sourceRoot":"","sources":["../../src/migrations/20260821T140323_credit_limits_reservation_reserving_organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,oEAAqE,SAAQ,SAAS;IAClF,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAQrC"}

package/dist/migrations/20260821T140323_credit_limits_reservation_reserving_organization.js

@@ -0,0 +1,45 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * `credit_limit_reservations.reserving_organization_id` — who drew the credit,
+ * recorded by this module instead of asked of `orders` (feature 075).
+ *
+ * The `independent_default` inheritance mode sums "the active reservations this
+ * descendant has consumed", and until now the only record of which descendant
+ * that was lived in somebody else's table: the sum ran
+ * `join orders o on o.id = r.order_id where o.organization_id = ?`, inside the
+ * placement transaction, while a `PESSIMISTIC_WRITE` was held on the owning
+ * organization's credit row. The value it read is one this module already has
+ * in hand — `reserve` is called with the reserving organization, and placement
+ * writes the same value onto the order — so the join was buying nothing but a
+ * cross-module reach the boundary check had to carry as debt.
+ *
+ * The backfill is the one place that still needs `orders`, and it is the right
+ * place for it: a migration naming another module's table is ordered by the
+ * dependency graph (this module declares `orders`, which
+ * `credit_limit_reservations_order_fk` already obliges) rather than executed on
+ * a hot money path.
+ *
+ * `not null` holds because that foreign key does: `on delete restrict` against
+ * `orders.id` means every reservation row has an order to take the value from.
+ */
+export class Migration20260821T140323CreditLimitsReservationReservingOrganization extends Migration {
+    async up() {
+        this.addSql(`alter table "credit_limit_reservations" add column "reserving_organization_id" uuid null;`);
+        this.addSql(`
+      update "credit_limit_reservations" r
+         set "reserving_organization_id" = o."organization_id"
+        from "orders" o
+       where o."id" = r."order_id";
+    `);
+        this.addSql(`alter table "credit_limit_reservations" alter column "reserving_organization_id" set not null;`);
+        this.addSql(`
+      create index "credit_limit_reservations_reserving_organization_id_index"
+        on "credit_limit_reservations" ("reserving_organization_id");
+    `);
+    }
+    async down() {
+        this.addSql(`drop index if exists "credit_limit_reservations_reserving_organization_id_index";`);
+        this.addSql(`alter table "credit_limit_reservations" drop column "reserving_organization_id";`);
+    }
+}
+//# sourceMappingURL=20260821T140323_credit_limits_reservation_reserving_organization.js.map

package/dist/migrations/20260821T140323_credit_limits_reservation_reserving_organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260821T140323_credit_limits_reservation_reserving_organization.js","sourceRoot":"","sources":["../../src/migrations/20260821T140323_credit_limits_reservation_reserving_organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,oEAAqE,SAAQ,SAAS;IACxF,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CAAC;;;KAGX,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CACT,mFAAmF,CACpF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kFAAkF,CACnF,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent — *"the `./migrations` export of
+ * @endora-commerce/mod-credit-limits exports no 'migrations' array"* (D-168).
+ *
+ * **Four classes, listed in ascending timestamp, which orders this module's own
+ * migrations and nothing else** (feature 081). Where this block sits relative
+ * to every other module's is decided by the manifest `dependencies` graph:
+ * `credit_limits` declares `orders`, and
+ * `…T081252_…_credit_limit_reservation_order_fk` is why — it adds
+ * `credit_limit_reservations_order_fk` (`credit_limit_reservations.order_id` ->
+ * `orders.id`, `on delete restrict`), so `orders`' tables must already exist
+ * when this block runs. A foreign key needs the **table**, never the owner's
+ * entity class (D-169), which is what lets that constraint stand while
+ * `./backend` publishes no entity class by name.
+ *
+ * The **named** exports stay, and the asymmetry with `./backend` — which
+ * publishes an array and no named class (D-168) — is deliberate.
+ * `db/migrations-registry.generated.ts` imports each class by name from this
+ * specifier and hands it to `migration('credit_limits', …)`, and a migration
+ * class name is contract in a way an entity class name is not:
+ * `mikro_orm_migrations` persists it, so it is a string every already-migrated
+ * database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260425T063333CreditLimitsInit } from './20260425T063333_credit_limits_init.js';
+import { Migration20260817T201111CreditLimitsReturnTopups } from './20260817T201111_credit_limits_return_topups.js';
+import { Migration20260818T081252CreditLimitsCreditLimitReservationOrderFk } from './20260818T081252_credit_limits_credit_limit_reservation_order_fk.js';
+import { Migration20260821T140323CreditLimitsReservationReservingOrganization } from './20260821T140323_credit_limits_reservation_reserving_organization.js';
+export declare const migrations: (typeof Migration20260425T063333CreditLimitsInit)[];
+export { Migration20260425T063333CreditLimitsInit, Migration20260817T201111CreditLimitsReturnTopups, Migration20260818T081252CreditLimitsCreditLimitReservationOrderFk, Migration20260821T140323CreditLimitsReservationReservingOrganization, };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,gDAAgD,EAAE,MAAM,kDAAkD,CAAC;AACpH,OAAO,EAAE,iEAAiE,EAAE,MAAM,sEAAsE,CAAC;AACzJ,OAAO,EAAE,oEAAoE,EAAE,MAAM,uEAAuE,CAAC;AAE7J,eAAO,MAAM,UAAU,qDAKtB,CAAC;AAEF,OAAO,EACL,wCAAwC,EACxC,gDAAgD,EAChD,iEAAiE,EACjE,oEAAoE,GACrE,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,44 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent — *"the `./migrations` export of
+ * @endora-commerce/mod-credit-limits exports no 'migrations' array"* (D-168).
+ *
+ * **Four classes, listed in ascending timestamp, which orders this module's own
+ * migrations and nothing else** (feature 081). Where this block sits relative
+ * to every other module's is decided by the manifest `dependencies` graph:
+ * `credit_limits` declares `orders`, and
+ * `…T081252_…_credit_limit_reservation_order_fk` is why — it adds
+ * `credit_limit_reservations_order_fk` (`credit_limit_reservations.order_id` ->
+ * `orders.id`, `on delete restrict`), so `orders`' tables must already exist
+ * when this block runs. A foreign key needs the **table**, never the owner's
+ * entity class (D-169), which is what lets that constraint stand while
+ * `./backend` publishes no entity class by name.
+ *
+ * The **named** exports stay, and the asymmetry with `./backend` — which
+ * publishes an array and no named class (D-168) — is deliberate.
+ * `db/migrations-registry.generated.ts` imports each class by name from this
+ * specifier and hands it to `migration('credit_limits', …)`, and a migration
+ * class name is contract in a way an entity class name is not:
+ * `mikro_orm_migrations` persists it, so it is a string every already-migrated
+ * database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260425T063333CreditLimitsInit } from './20260425T063333_credit_limits_init.js';
+import { Migration20260817T201111CreditLimitsReturnTopups } from './20260817T201111_credit_limits_return_topups.js';
+import { Migration20260818T081252CreditLimitsCreditLimitReservationOrderFk } from './20260818T081252_credit_limits_credit_limit_reservation_order_fk.js';
+import { Migration20260821T140323CreditLimitsReservationReservingOrganization } from './20260821T140323_credit_limits_reservation_reserving_organization.js';
+export const migrations = [
+    Migration20260425T063333CreditLimitsInit,
+    Migration20260817T201111CreditLimitsReturnTopups,
+    Migration20260818T081252CreditLimitsCreditLimitReservationOrderFk,
+    Migration20260821T140323CreditLimitsReservationReservingOrganization,
+];
+export { Migration20260425T063333CreditLimitsInit, Migration20260817T201111CreditLimitsReturnTopups, Migration20260818T081252CreditLimitsCreditLimitReservationOrderFk, Migration20260821T140323CreditLimitsReservationReservingOrganization, };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,gDAAgD,EAAE,MAAM,kDAAkD,CAAC;AACpH,OAAO,EAAE,iEAAiE,EAAE,MAAM,sEAAsE,CAAC;AACzJ,OAAO,EAAE,oEAAoE,EAAE,MAAM,uEAAuE,CAAC;AAE7J,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,wCAAwC;IACxC,gDAAgD;IAChD,iEAAiE;IACjE,oEAAoE;CACrE,CAAC;AAEF,OAAO,EACL,wCAAwC,EACxC,gDAAgD,EAChD,iEAAiE,EACjE,oEAAoE,GACrE,CAAC"}

package/dist/ports/index.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The `./ports` subpath — the port interfaces this module publishes, and
+ * **nothing that exists at runtime** (layout contract R8, D-169).
+ *
+ * `tsc` compiles this file to `export {};`, and that emitted empty module is the
+ * `default` condition's target. A `types`-only `exports` entry type-checks and
+ * then answers `ERR_PACKAGE_PATH_NOT_EXPORTED` to any consumer whose toolchain
+ * emits the import, which is every consumer that cannot prove the import is a
+ * type. The implementation stays in `../backend/services/credit-limit-service.ts`
+ * and is reached through the container name `creditLimitService`, never through
+ * this subpath.
+ *
+ * No entity class leaves by this door either, type-only included: D-168 shut
+ * that door on `./backend` precisely so that a stranger's
+ * `import type { CreditLimit } from '<pkg>/backend'` is a compile error in the
+ * stranger's own tree, and erasure would make re-opening it free at runtime and
+ * permanent at compile time.
+ *
+ * `backend/test/unit/packages/module-package-ports-surface.test.ts` holds this
+ * file to all of that, over the real package.
+ */
+import type { EntityManager } from '@mikro-orm/postgresql';
+/**
+ * What order placement asks of a credit limit, typed by its owner (D-94.5).
+ *
+ * `orders` used to declare this interface itself, in `order-service.ts`, and
+ * `CreditLimitService` satisfied it structurally. That is the shape D-77
+ * rejected: `lazyPort<T>` is an unchecked cast, so with `T` on the consumer's
+ * side **nothing verifies that the provider still satisfies it**. The
+ * declaration lives here, and `orders` imports it as a type from
+ * `@endora-commerce/mod-credit-limits/ports`.
+ *
+ * It stays **out of `@endora-commerce/contracts`**: `reserve` takes the caller's MikroORM
+ * `EntityManager`, and FR-034 forbids a MikroORM type there — `admin` and
+ * `storefront` both compile that package, which is why it holds zero
+ * `@mikro-orm` imports. That is what qualifies this interface for `./ports`
+ * rather than for the contracts package: the test is not *"is this a real
+ * published port"* but *"does this signature stop the interface living in
+ * `packages/contracts`"* (D-171). `quote_requests`' two ports are real published
+ * ports and fail that test, being contract DTOs end to end.
+ *
+ * The seam itself is not a defect in the design, it *is* the design. `reserve`
+ * holds a `PESSIMISTIC_WRITE` on the organization's `credit_limits` row — or the
+ * owning ancestor's, taken with `select … for update` — and the lock has to be
+ * held until the order commits; a second transaction would leave credit consumed
+ * for a placement that then rolled back. `credit_limit_reservations_order_fk`
+ * (`credit_limit_reservations.order_id` -> `orders.id`, `on delete restrict`) is
+ * what says so in the schema. A foreign key needs the **table** and never the
+ * class (D-169), so that constraint stands while `./backend` publishes no entity
+ * class by name.
+ */
+export interface CreditLimitPort {
+    /**
+     * Reserve `amount` against the organization's available credit.
+     *
+     * `tx` is **required** (D-94.5). It has one caller, `placeOrder`, which
+     * always passes its own `EntityManager`; the optional shape is what let the
+     * same method double as a standalone transaction, and that is a lie about
+     * the seam — the reservation is not separable from the placement it belongs
+     * to.
+     */
+    reserve(input: {
+        organizationId: string;
+        orderId: string;
+        amount: number;
+        currency: string;
+        tx: EntityManager;
+    }): Promise<{
+        ok: true;
+        reservationId: string;
+        availableAmountAfter: number;
+    } | {
+        ok: false;
+        code: 'LIMIT_INSUFFICIENT';
+        availableAmount: number;
+    } | {
+        ok: false;
+        code: 'CREDIT_LIMIT_NOT_GRANTED';
+    } | {
+        ok: false;
+        code: 'CURRENCY_MISMATCH';
+    }>;
+    /**
+     * Release the reservation an order holds. Runs in its own transaction: the
+     * order is committed by the time an invoice is paid, a cancellation lands or
+     * an admin revokes.
+     */
+    releaseByOrder(input: {
+        orderId: string;
+        reason: 'invoice_paid' | 'order_cancelled' | 'admin_revocation';
+    }): Promise<unknown>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/ports/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,EAAE,aAAa,CAAC;KACnB,GAAG,OAAO,CACP;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,GACjE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,oBAAoB,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,0BAA0B,CAAA;KAAE,GAC/C;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAC3C,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,cAAc,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;KACjE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB"}

package/dist/ports/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/ports/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":""}

package/docs/credit_limits.md

@@ -0,0 +1,53 @@
+---
+title: credit_limits
+description: Credit-limit grant + atomic reservation
+---
+
+# `credit_limits`
+
+The Credit Limit payment method. Admins grant a per-Organization limit;
+Customers consume it at checkout. Reservations are atomic and idempotently
+released on invoice paid or order cancellation.
+
+## Public surface
+
+All admin routes are gated by the `credit_limits:manage` permission.
+
+| Verb + Path | Audience | Purpose |
+| --- | --- | --- |
+| `GET /api/v1/me/credit-limit` | customer | View granted limit + currently reserved (404 `CREDIT_LIMIT_NOT_GRANTED` if none) |
+| `GET /api/v1/admin/credit-limits` | admin | Roster of every granted limit with active reservations |
+| `GET /api/v1/admin/organizations/:id/credit-limit` | admin | One organization's limit + reservations |
+| `POST /api/v1/admin/organizations/:id/credit-limit` | admin | Grant initial limit |
+| `PATCH /api/v1/admin/organizations/:id/credit-limit` | admin | Adjust amount (rejects below active reservations unless `allowOverAllocation`) |
+
+Storefront UX: the Account profile and Checkout page render a
+`CreditLimitWidget` (granted / available / reservation breakdown) when
+the limit exists; `credit_limit`-kind payment methods are filtered out
+of Checkout when no limit is granted or the cart total exceeds the
+available credit.
+
+## Concurrency model
+
+`CreditLimitService.reserve()` opens a `SELECT … FOR UPDATE` on the
+`credit_limits` row, then inserts the reservation. Two simultaneous orders
+that would together exceed the limit are serialized; one succeeds and the
+other receives `409 LIMIT_INSUFFICIENT`. See
+`backend/test/contract/credit_limits/concurrent-race.test.ts`.
+
+## Entities
+
+`CreditLimit`, `CreditLimitReservation` (status: `active | released`).
+Index on `(credit_limit_id, status)` keeps the available-balance query fast.
+
+## Events emitted
+
+`credit_limit.granted.v1`, `credit_limit.adjusted.v1`,
+`credit_limit.reservation_released.v1`.
+
+## Extension points
+
+- **Release reasons** — `releaseByOrder(reason)` accepts
+  `'invoice_paid'` and `'order_cancelled'` today. New reasons (e.g.
+  `'manual_override'`) are added by extending the enum and wiring the
+  caller.

package/i18n/en.json

@@ -0,0 +1,9 @@
+{
+  "errors.ADJUSTMENT_BELOW_ACTIVE": "The credit limit cannot be lowered below the amount that active reservations are already holding. Release or settle those reservations first, or set a higher amount.",
+  "errors.CREDIT_LIMIT_ALREADY_GRANTED": "This organization already has a credit limit. Adjust the existing limit instead of granting a second one.",
+  "errors.CREDIT_LIMIT_NOT_GRANTED": "No credit limit has been granted for this organization.",
+  "errors.LIMIT_INSUFFICIENT": "The available credit limit does not cover this order. Reduce the order or choose a different payment method.",
+  "nav.creditLimits.label": "Credit limits",
+  "actions.openCreditLimits.label": "Credit limits",
+  "actions.openCreditLimits.description": "Customer credit limits & balances"
+}

package/i18n/pl.json

@@ -0,0 +1,9 @@
+{
+  "errors.ADJUSTMENT_BELOW_ACTIVE": "Nie można obniżyć limitu kredytowego poniżej kwoty, którą blokują aktywne rezerwacje. Najpierw zwolnij lub rozlicz te rezerwacje albo ustaw wyższą kwotę.",
+  "errors.CREDIT_LIMIT_ALREADY_GRANTED": "Ta organizacja ma już przyznany limit kredytowy. Zmień istniejący limit zamiast przyznawać drugi.",
+  "errors.CREDIT_LIMIT_NOT_GRANTED": "Tej organizacji nie przyznano limitu kredytowego.",
+  "errors.LIMIT_INSUFFICIENT": "Dostępny limit kredytowy nie pokrywa wartości tego zamówienia. Zmniejsz zamówienie albo wybierz inną metodę płatności.",
+  "nav.creditLimits.label": "Limity kredytowe",
+  "actions.openCreditLimits.label": "Limity kredytowe",
+  "actions.openCreditLimits.description": "Limity kredytowe i salda klientów"
+}

package/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "@endora-commerce/mod-credit-limits",
+  "version": "0.100.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Per-organization credit limits and credit-check enforcement at checkout.",
+  "license": "MIT",
+  "endora": {
+    "type": "module",
+    "id": "credit_limits"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/modules/credit_limits"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "default": "./dist/backend/index.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations/index.d.ts",
+      "default": "./dist/migrations/index.js"
+    },
+    "./ports": {
+      "types": "./dist/ports/index.d.ts",
+      "default": "./dist/ports/index.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "default": "./dist/admin/index.js"
+    },
+    "./tailwind.css": "./tailwind.css",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "i18n",
+    "docs",
+    "tailwind.css"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "peerDependencies": {
+    "@mikro-orm/core": "^6",
+    "@mikro-orm/migrations": "^6",
+    "@mikro-orm/postgresql": "^6",
+    "fastify": "^5",
+    "react": "^19",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "peerDependenciesMeta": {
+    "@endora-commerce/admin-kit": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@fastify/type-provider-zod": "^1.0.0",
+    "@mikro-orm/core": "^6.6.13",
+    "@mikro-orm/migrations": "^6.6.13",
+    "@mikro-orm/postgresql": "^6.6.13",
+    "@types/node": "^22.9.0",
+    "@types/react": "^19.2.14",
+    "fastify": "^5.12.5",
+    "react": "^19.2.5",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.ui.json",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.ui.json --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}

package/tailwind.css

@@ -0,0 +1,14 @@
+/* @endora-commerce/mod-credit-limits — AUTO-GENERATED by `pnpm --filter backend run manifests:generate`.
+ *
+ * The `@source` directives this package asks its host to scan
+ * (`specs/110-instance-repository/contracts/admin-stylesheet-composition.md` R1).
+ * They resolve relative to **this file**, so they hold wherever the package is
+ * installed — a workspace link here, `node_modules` in a client's instance.
+ *
+ * The `dist` line is what a published tarball ships and is what an instance
+ * scans; the `src` line is inert there and is what keeps `pnpm --filter admin
+ * run dev` reading source in this repository. Do not edit: run
+ * `pnpm --filter backend run manifests:generate`.
+ */
+@source "./dist/admin";
+@source "./src/admin";