@endora-commerce/platform 0.100.0

package/dist/kernel/audit/audit-log-entry.entity.js

@@ -0,0 +1,102 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, Index, OptionalProps, PrimaryKey, Property } from '@mikro-orm/core';
+import { GlobalEntity } from '../../tenancy/org-scoped.decorator.js';
+import { randomUUID } from 'crypto';
+/**
+ * Row in the audit log of sensitive operations (FR-084, R-12).
+ * Never soft-deleted — accounting + audit retention ≥ 5 years per spec assumptions.
+ */
+let AuditLogEntry = class AuditLogEntry {
+    [OptionalProps];
+    id = randomUUID();
+    /** The Admin User who performed the action. Null for system-initiated entries. */
+    actorAdminUserId;
+    /**
+     * The Customer Account being acted upon by the Admin User during Impersonation (R-12).
+     * Non-null entries describe operations performed on behalf of the Customer.
+     */
+    impersonatedCustomerAccountId;
+    actedAt = new Date();
+    /**
+     * Screaming-snake-case action identifier, e.g. `price.update`, `permission.change`,
+     * `credit_limit.adjust`, `impersonation.start`, `impersonation.end`.
+     */
+    action;
+    /** Polymorphic pointer to the affected entity. */
+    objectType;
+    objectId;
+    /** Diff-friendly snapshot of the affected fields before the mutation. */
+    stateBefore;
+    stateAfter;
+    ipAddress;
+    userAgent;
+    /** Correlation id from the inbound request (X-Request-Id). */
+    requestId;
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], AuditLogEntry.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    Index(),
+    __metadata("design:type", Object)
+], AuditLogEntry.prototype, "actorAdminUserId", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    Index(),
+    __metadata("design:type", Object)
+], AuditLogEntry.prototype, "impersonatedCustomerAccountId", void 0);
+__decorate([
+    Property({ type: 'datetime' }),
+    Index(),
+    __metadata("design:type", Date)
+], AuditLogEntry.prototype, "actedAt", void 0);
+__decorate([
+    Property({ type: 'string', length: 120 }),
+    Index(),
+    __metadata("design:type", String)
+], AuditLogEntry.prototype, "action", void 0);
+__decorate([
+    Property({ type: 'string', length: 120 }),
+    __metadata("design:type", String)
+], AuditLogEntry.prototype, "objectType", void 0);
+__decorate([
+    Property({ type: 'string', length: 120 }),
+    Index(),
+    __metadata("design:type", String)
+], AuditLogEntry.prototype, "objectId", void 0);
+__decorate([
+    Property({ type: 'json', nullable: true }),
+    __metadata("design:type", Object)
+], AuditLogEntry.prototype, "stateBefore", void 0);
+__decorate([
+    Property({ type: 'json', nullable: true }),
+    __metadata("design:type", Object)
+], AuditLogEntry.prototype, "stateAfter", void 0);
+__decorate([
+    Property({ type: 'string', length: 45, nullable: true }),
+    __metadata("design:type", Object)
+], AuditLogEntry.prototype, "ipAddress", void 0);
+__decorate([
+    Property({ type: 'string', length: 255, nullable: true }),
+    __metadata("design:type", Object)
+], AuditLogEntry.prototype, "userAgent", void 0);
+__decorate([
+    Property({ type: 'string', length: 64, nullable: true }),
+    __metadata("design:type", Object)
+], AuditLogEntry.prototype, "requestId", void 0);
+AuditLogEntry = __decorate([
+    GlobalEntity(),
+    Entity({ tableName: 'audit_log_entries' })
+], AuditLogEntry);
+export { AuditLogEntry };
+//# sourceMappingURL=audit-log-entry.entity.js.map

package/dist/kernel/audit/audit-log-entry.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log-entry.entity.js","sourceRoot":"","sources":["../../../src/kernel/audit/audit-log-entry.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;GAGG;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,CAAC,aAAa,CAAC,CAAoB;IAGnC,EAAE,GAAW,UAAU,EAAE,CAAC;IAE1B,kFAAkF;IAGlF,gBAAgB,CAAiB;IAEjC;;;OAGG;IAGH,6BAA6B,CAAiB;IAI9C,OAAO,GAAS,IAAI,IAAI,EAAE,CAAC;IAE3B;;;OAGG;IAGH,MAAM,CAAU;IAEhB,kDAAkD;IAElD,UAAU,CAAU;IAIpB,QAAQ,CAAU;IAElB,yEAAyE;IAEzE,WAAW,CAAkC;IAG7C,UAAU,CAAkC;IAG5C,SAAS,CAAiB;IAG1B,SAAS,CAAiB;IAE1B,8DAA8D;IAE9D,SAAS,CAAiB;CAC3B,CAAA;AAnDC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;yCACH;AAK1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,KAAK,EAAE;;uDACyB;AAQjC;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,KAAK,EAAE;;oEACsC;AAI9C;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,KAAK,EAAE;8BACC,IAAI;8CAAc;AAQ3B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzC,KAAK,EAAE;;6CACQ;AAIhB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;iDACtB;AAIpB;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzC,KAAK,EAAE;;+CACU;AAIlB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACE;AAG7C;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACC;AAG5C;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDAC/B;AAG1B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDAChC;AAI1B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDAC/B;AAtDf,aAAa;IAFzB,YAAY,EAAE;IACd,MAAM,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;GAC9B,aAAa,CAuDzB"}

package/dist/kernel/audit/audit-log-service.d.ts

@@ -0,0 +1,63 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { AuditLogEntry } from './audit-log-entry.entity.js';
+import type { AuditLogFilter, AuditPort, RecordAuditInput } from '../ports/audit.js';
+/**
+ * Append-only audit log writer. Every sensitive operation (FR-084) calls `record()`
+ * — price changes, permission changes, credit-limit adjustments, order-status changes
+ * performed during Impersonation, etc.
+ *
+ * This service is deliberately narrow: it only appends rows. Queries are the concern
+ * of the admin-panel audit viewer (US4 / T195).
+ *
+ * **The class is the host's implementation and not the platform's contract**
+ * (D-160.10). {@link AuditPort} is what a module types on and what the kernel
+ * barrel publishes; this file is reachable only by its relative path, which the
+ * composition roots and the tests have and a packaged module does not. The
+ * shapes it used to declare — `RecordAuditInput` and `AuditLogFilter` — moved to
+ * the port beside the methods that take them, so the class cannot widen the
+ * contract by growing a field.
+ */
+export declare class AuditLogService implements AuditPort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    record(input: RecordAuditInput): Promise<AuditLogEntry>;
+    /**
+     * Co-transactional audit writer (feature 054, Constitution Principle XIII).
+     *
+     * Persists the entry on the CALLER's transactional `em` with NO fork and NO
+     * flush — the caller's `em.transactional(...)` commits it atomically with the
+     * domain write, so the audit row and the write live or die together (FR-003).
+     *
+     * The {@link CommandBus} is its main caller. `CartAuditService` is the other
+     * one (issue #152): a sweep lands a batch of audit rows beside the batch of
+     * domain rows it is auditing, and one flush over one EntityManager is what
+     * makes "the flip and its audit row commit together" true rather than
+     * documented. `record()` is still what a service reaches for when it has one
+     * row and no unit of work of its own to join.
+     */
+    recordWithin(em: EntityManager, input: RecordAuditInput): AuditLogEntry;
+    private build;
+    query(filter?: AuditLogFilter): Promise<AuditLogEntry[]>;
+    /**
+     * Every entry recorded under one action for a **set** of objects, oldest
+     * first (issue #284).
+     *
+     * `query()` above answers for one object and caps the answer; this one
+     * answers for a page. The difference is the whole reason it exists: its
+     * caller is a list of orders asking who wrote each one's current status, and
+     * `query()` per row is an N+1 across the page — the class of defect MR !822
+     * spent a day pinning out of the catalogue listing.
+     *
+     * Deliberately **uncapped**. A `limit` over a set does not bound the work
+     * evenly, it drops whichever objects sort last, and an object whose history
+     * was silently truncated reads as an object with no history — a wrong answer
+     * rather than a slow one. The population is bounded by the caller instead:
+     * it passes the ids on one page.
+     */
+    findByObjectIds(input: {
+        action: string;
+        objectType: string;
+        objectIds: readonly string[];
+    }): Promise<AuditLogEntry[]>;
+}
+//# sourceMappingURL=audit-log-service.d.ts.map

package/dist/kernel/audit/audit-log-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log-service.d.ts","sourceRoot":"","sources":["../../../src/kernel/audit/audit-log-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErF;;;;;;;;;;;;;;;GAeG;AAEH,qBAAa,eAAgB,YAAW,SAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;IAO7D;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,GAAG,aAAa;IAMvE,OAAO,CAAC,KAAK;IAiBP,KAAK,CAAC,MAAM,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAgBlE;;;;;;;;;;;;;;;OAeG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;KAC9B,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAU7B"}

package/dist/kernel/audit/audit-log-service.js

@@ -0,0 +1,107 @@
+import { AuditLogEntry } from './audit-log-entry.entity.js';
+/**
+ * Append-only audit log writer. Every sensitive operation (FR-084) calls `record()`
+ * — price changes, permission changes, credit-limit adjustments, order-status changes
+ * performed during Impersonation, etc.
+ *
+ * This service is deliberately narrow: it only appends rows. Queries are the concern
+ * of the admin-panel audit viewer (US4 / T195).
+ *
+ * **The class is the host's implementation and not the platform's contract**
+ * (D-160.10). {@link AuditPort} is what a module types on and what the kernel
+ * barrel publishes; this file is reachable only by its relative path, which the
+ * composition roots and the tests have and a packaged module does not. The
+ * shapes it used to declare — `RecordAuditInput` and `AuditLogFilter` — moved to
+ * the port beside the methods that take them, so the class cannot widen the
+ * contract by growing a field.
+ */
+export class AuditLogService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async record(input) {
+        const em = this.emFactory();
+        const entry = this.build(em, input);
+        await em.persistAndFlush(entry);
+        return entry;
+    }
+    /**
+     * Co-transactional audit writer (feature 054, Constitution Principle XIII).
+     *
+     * Persists the entry on the CALLER's transactional `em` with NO fork and NO
+     * flush — the caller's `em.transactional(...)` commits it atomically with the
+     * domain write, so the audit row and the write live or die together (FR-003).
+     *
+     * The {@link CommandBus} is its main caller. `CartAuditService` is the other
+     * one (issue #152): a sweep lands a batch of audit rows beside the batch of
+     * domain rows it is auditing, and one flush over one EntityManager is what
+     * makes "the flip and its audit row commit together" true rather than
+     * documented. `record()` is still what a service reaches for when it has one
+     * row and no unit of work of its own to join.
+     */
+    recordWithin(em, input) {
+        const entry = this.build(em, input);
+        em.persist(entry);
+        return entry;
+    }
+    build(em, input) {
+        return em.create(AuditLogEntry, {
+            action: input.action,
+            objectType: input.objectType,
+            objectId: input.objectId,
+            ...(input.actorAdminUserId !== undefined ? { actorAdminUserId: input.actorAdminUserId } : {}),
+            ...(input.impersonatedCustomerAccountId !== undefined
+                ? { impersonatedCustomerAccountId: input.impersonatedCustomerAccountId }
+                : {}),
+            ...(input.stateBefore !== undefined ? { stateBefore: input.stateBefore } : {}),
+            ...(input.stateAfter !== undefined ? { stateAfter: input.stateAfter } : {}),
+            ...(input.ipAddress !== undefined ? { ipAddress: input.ipAddress } : {}),
+            ...(input.userAgent !== undefined ? { userAgent: input.userAgent } : {}),
+            ...(input.requestId !== undefined ? { requestId: input.requestId } : {}),
+        });
+    }
+    async query(filter = {}) {
+        const em = this.emFactory();
+        const where = {};
+        if (filter.actorAdminUserId)
+            where['actorAdminUserId'] = filter.actorAdminUserId;
+        if (filter.action)
+            where['action'] = filter.action;
+        if (filter.objectType)
+            where['objectType'] = filter.objectType;
+        if (filter.objectId)
+            where['objectId'] = filter.objectId;
+        if (filter.impersonatedCustomerAccountId) {
+            where['impersonatedCustomerAccountId'] = filter.impersonatedCustomerAccountId;
+        }
+        return em.find(AuditLogEntry, where, {
+            orderBy: { actedAt: 'desc' },
+            limit: Math.min(Math.max(filter.limit ?? 100, 1), 500),
+        });
+    }
+    /**
+     * Every entry recorded under one action for a **set** of objects, oldest
+     * first (issue #284).
+     *
+     * `query()` above answers for one object and caps the answer; this one
+     * answers for a page. The difference is the whole reason it exists: its
+     * caller is a list of orders asking who wrote each one's current status, and
+     * `query()` per row is an N+1 across the page — the class of defect MR !822
+     * spent a day pinning out of the catalogue listing.
+     *
+     * Deliberately **uncapped**. A `limit` over a set does not bound the work
+     * evenly, it drops whichever objects sort last, and an object whose history
+     * was silently truncated reads as an object with no history — a wrong answer
+     * rather than a slow one. The population is bounded by the caller instead:
+     * it passes the ids on one page.
+     */
+    async findByObjectIds(input) {
+        const objectIds = [...new Set(input.objectIds)];
+        // No ids is no question, and an `$in: []` is still a round trip.
+        if (objectIds.length === 0)
+            return [];
+        return this.emFactory().find(AuditLogEntry, { action: input.action, objectType: input.objectType, objectId: { $in: objectIds } }, { orderBy: { actedAt: 'asc' } });
+    }
+}
+//# sourceMappingURL=audit-log-service.js.map

package/dist/kernel/audit/audit-log-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-log-service.js","sourceRoot":"","sources":["../../../src/kernel/audit/audit-log-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAiB,EAAE,KAAuB;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,EAAiB,EAAE,KAAuB;QACtD,OAAO,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,6BAA6B,KAAK,SAAS;gBACnD,CAAC,CAAC,EAAE,6BAA6B,EAAE,KAAK,CAAC,6BAA6B,EAAE;gBACxE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAyB,EAAE;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,gBAAgB;YAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACjF,IAAI,MAAM,CAAC,MAAM;YAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACnD,IAAI,MAAM,CAAC,UAAU;YAAE,KAAK,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/D,IAAI,MAAM,CAAC,QAAQ;YAAE,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzD,IAAI,MAAM,CAAC,6BAA6B,EAAE,CAAC;YACzC,KAAK,CAAC,+BAA+B,CAAC,GAAG,MAAM,CAAC,6BAA6B,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE;YACnC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;YAC5B,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,eAAe,CAAC,KAIrB;QACC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,iEAAiE;QACjE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAC1B,aAAa,EACb,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EACpF,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAChC,CAAC;IACJ,CAAC;CACF"}

package/dist/kernel/cache/in-process-cache-registry.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The caches that keep a per-process layer in front of Redis, by the namespace
+ * key the operator-facing "clear cache" surface uses.
+ *
+ * Six of the eight clearable namespaces are Redis-only, so SCAN+DEL over the
+ * key space is a complete clear for them. Two are not: `settings` and
+ * `sales_channels` each hold a per-process LRU, and dropping only the Redis
+ * keys leaves every warm process serving the value it had already resolved —
+ * which the next read then re-pins into Redis. The operator gets a green
+ * confirmation and an unchanged system.
+ *
+ * The clear therefore has to reach the object that owns both layers, and this
+ * is how it finds it. A registry rather than an injected dependency because
+ * the two caches live in the kernel while the clear surface is a route of the
+ * `settings` module: a module may not reach into another module for an
+ * instance, and threading two handles through every composition root to reach
+ * one maintenance button is a lot of wiring for a rare action.
+ *
+ * Nothing here is required: a process that registered no layer — the
+ * `cache:clear` CLI, a unit test — clears the Redis keys and is correct,
+ * because it has no in-memory layer to be stale.
+ *
+ * **The second reader is the platform's own module-state notification**
+ * (D-174). A per-process cache derived from what an install rewrites —
+ * `module_actions` rows, another module's translation bundles — cannot see
+ * those inputs move: `registryCache.presenceVersion()` is a content hash of the
+ * two presence axes and of nothing else, so a consumer polling it is
+ * structurally blind to them. What does announce them is
+ * `b2b:module:state-changed`, and a module may not name that channel — it is a
+ * transport detail of `kernel/lifecycle/registry-cache.ts`, carrying a payload
+ * the consumer does not even read. So the kernel's own subscriber calls
+ * {@link InProcessCacheRegistry.invalidateForModuleStateChange} and a module
+ * registers a layer that opts in. Same argument as the paragraph above, one
+ * seam further: a module may not reach into the platform for an instance, and
+ * the registry is where it says what it owns instead.
+ *
+ * The opt-in is deliberate and is not a convenience. `settings` and
+ * `sales_channels` clear a **Redis** key space with SCAN+DEL, and running that
+ * in every API and worker process on every operator flip is a storm nobody
+ * asked for — and a cold settings cache platform-wide, for a write those caches
+ * already invalidate at their own seam.
+ */
+export interface InProcessCacheLayer {
+    /**
+     * Drop every entry in this namespace across **both** layers, shared layer
+     * first and with the key prefix marked for the whole operation. Returns the
+     * number of shared keys deleted, which is what the operator is shown.
+     */
+    invalidateAll(): Promise<number>;
+}
+export declare class InProcessCacheRegistry {
+    private readonly layers;
+    /**
+     * Register this process's layer for `namespace`. Returns the unregister
+     * function; a second composition root in the same process (the test harness
+     * builds one per file) replaces the entry, so the registry always names the
+     * live cache rather than a discarded one.
+     *
+     * `invalidateOnModuleStateChange` declares that this layer's content is
+     * derived from what an install, an uninstall or an operator's activation flip
+     * rewrites, so the platform's module-state notification must drop it in every
+     * process. Default `false`: see the header for why a blanket drop would be
+     * wrong for a layer that owns Redis keys.
+     */
+    register(namespace: string, layer: InProcessCacheLayer, opts?: {
+        readonly invalidateOnModuleStateChange?: boolean;
+    }): () => void;
+    has(namespace: string): boolean;
+    /**
+     * Clear the namespace through its owning cache, or `undefined` when nothing
+     * registered one — the caller then falls back to clearing the shared layer
+     * by key pattern.
+     */
+    clear(namespace: string): Promise<number | undefined>;
+    /**
+     * Drop every layer that declared itself derived from module state. Called by
+     * the kernel's `b2b:module:state-changed` subscriber, in every process that
+     * armed it.
+     *
+     * Every layer is **started synchronously**, before the first `await`: the
+     * notification's whole value over the presence-version pull is that the drop
+     * lands on receipt rather than a PostgreSQL round-trip later, and awaiting
+     * layer by layer would give that away for the second one onwards.
+     *
+     * A layer that throws is reported and skipped rather than propagated. The
+     * caller is a pub/sub handler with nowhere to throw to, and one bad consumer
+     * must not stop the refresh every gating seam depends on.
+     */
+    invalidateForModuleStateChange(): Promise<void>;
+}
+/** Process singleton, read by the settings module's cache-maintenance service. */
+export declare const inProcessCaches: InProcessCacheRegistry;
+//# sourceMappingURL=in-process-cache-registry.d.ts.map

package/dist/kernel/cache/in-process-cache-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-process-cache-registry.d.ts","sourceRoot":"","sources":["../../../src/kernel/cache/in-process-cache-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAOD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D;;;;;;;;;;;OAWG;IACH,QAAQ,CACN,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,6BAA6B,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1D,MAAM,IAAI;IAWb,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI/B;;;;OAIG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAM3D;;;;;;;;;;;;;OAaG;IACG,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBtD;AAUD,kFAAkF;AAClF,eAAO,MAAM,eAAe,wBAA+B,CAAC"}

package/dist/kernel/cache/in-process-cache-registry.js

@@ -0,0 +1,78 @@
+export class InProcessCacheRegistry {
+    layers = new Map();
+    /**
+     * Register this process's layer for `namespace`. Returns the unregister
+     * function; a second composition root in the same process (the test harness
+     * builds one per file) replaces the entry, so the registry always names the
+     * live cache rather than a discarded one.
+     *
+     * `invalidateOnModuleStateChange` declares that this layer's content is
+     * derived from what an install, an uninstall or an operator's activation flip
+     * rewrites, so the platform's module-state notification must drop it in every
+     * process. Default `false`: see the header for why a blanket drop would be
+     * wrong for a layer that owns Redis keys.
+     */
+    register(namespace, layer, opts) {
+        const entry = {
+            layer,
+            invalidateOnModuleStateChange: opts?.invalidateOnModuleStateChange === true,
+        };
+        this.layers.set(namespace, entry);
+        return () => {
+            if (this.layers.get(namespace) === entry)
+                this.layers.delete(namespace);
+        };
+    }
+    has(namespace) {
+        return this.layers.has(namespace);
+    }
+    /**
+     * Clear the namespace through its owning cache, or `undefined` when nothing
+     * registered one — the caller then falls back to clearing the shared layer
+     * by key pattern.
+     */
+    async clear(namespace) {
+        const entry = this.layers.get(namespace);
+        if (!entry)
+            return undefined;
+        return entry.layer.invalidateAll();
+    }
+    /**
+     * Drop every layer that declared itself derived from module state. Called by
+     * the kernel's `b2b:module:state-changed` subscriber, in every process that
+     * armed it.
+     *
+     * Every layer is **started synchronously**, before the first `await`: the
+     * notification's whole value over the presence-version pull is that the drop
+     * lands on receipt rather than a PostgreSQL round-trip later, and awaiting
+     * layer by layer would give that away for the second one onwards.
+     *
+     * A layer that throws is reported and skipped rather than propagated. The
+     * caller is a pub/sub handler with nowhere to throw to, and one bad consumer
+     * must not stop the refresh every gating seam depends on.
+     */
+    async invalidateForModuleStateChange() {
+        const pending = [];
+        for (const [namespace, entry] of this.layers) {
+            if (!entry.invalidateOnModuleStateChange)
+                continue;
+            try {
+                pending.push(Promise.resolve(entry.layer.invalidateAll()).catch((err) => {
+                    warnLayerFailed(namespace, err);
+                }));
+            }
+            catch (err) {
+                // A layer whose `invalidateAll` threw synchronously never produced a
+                // promise to attach the handler above to.
+                warnLayerFailed(namespace, err);
+            }
+        }
+        await Promise.all(pending);
+    }
+}
+function warnLayerFailed(namespace, err) {
+    console.warn(`[in-process-cache] "${namespace}" failed to invalidate on a module-state change: ${err instanceof Error ? err.message : String(err)}`);
+}
+/** Process singleton, read by the settings module's cache-maintenance service. */
+export const inProcessCaches = new InProcessCacheRegistry();
+//# sourceMappingURL=in-process-cache-registry.js.map

package/dist/kernel/cache/in-process-cache-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-process-cache-registry.js","sourceRoot":"","sources":["../../../src/kernel/cache/in-process-cache-registry.ts"],"names":[],"mappings":"AAwDA,MAAM,OAAO,sBAAsB;IAChB,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7D;;;;;;;;;;;OAWG;IACH,QAAQ,CACN,SAAiB,EACjB,KAA0B,EAC1B,IAA2D;QAE3D,MAAM,KAAK,GAAoB;YAC7B,KAAK;YACL,6BAA6B,EAAE,IAAI,EAAE,6BAA6B,KAAK,IAAI;SAC5E,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,GAAG,EAAE;YACV,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1E,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,8BAA8B;QAClC,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,6BAA6B;gBAAE,SAAS;YACnD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CACV,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBAClE,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAClC,CAAC,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,qEAAqE;gBACrE,0CAA0C;gBAC1C,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,eAAe,CAAC,SAAiB,EAAE,GAAY;IACtD,OAAO,CAAC,IAAI,CACV,uBAAuB,SAAS,oDAC9B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,sBAAsB,EAAE,CAAC"}

package/dist/kernel/cache/shared-drop-marks.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Bookkeeping for the invalidation window of a two-layer cache (Redis + a
+ * per-process LRU), shared by `SettingsCache` and `SalesChannelsCache`.
+ *
+ * Both caches invalidate the same way, for the reasons MR !449 established:
+ * drop the **shared** layer first, because it is the layer that outlives this
+ * process and would otherwise be re-pulled into every other process's LRU, and
+ * because it is the step that can fail. A half-done invalidation must degrade
+ * to "slower but correct", never to "fast and wrong", which needs two marks:
+ *
+ *   - `draining` — a drop for this prefix is on the wire. Reads bypass both
+ *     layers and writes do not repopulate them, because the notification that
+ *     triggered the drop is dispatched fire-and-forget and a read routinely
+ *     lands mid-invalidation.
+ *   - `failed` — the shared drop threw, so Redis may still hold the
+ *     pre-invalidation value. The prefix stays marked until a later drop
+ *     succeeds; reads keep bypassing the cache (and keep retrying the drop)
+ *     rather than being served a value the invalidation was supposed to remove.
+ *
+ * It is deliberately just the bookkeeping: the caller owns the drop, so the
+ * retry stays where the key layout and the scan count are known.
+ */
+export declare class SharedDropMarks {
+    /** Key prefixes whose shared drop is on the wire right now, by depth. */
+    private readonly draining;
+    /** Key prefixes whose shared drop threw; the shared layer may be stale. */
+    private readonly failed;
+    /** True when neither mark is set — the hot path's early exit. */
+    get isClean(): boolean;
+    begin(prefix: string): void;
+    finish(prefix: string): void;
+    markFailed(prefix: string): void;
+    /** A successful drop also retires any narrower outstanding failure. */
+    retireFailedUnder(prefix: string): void;
+    isDraining(key: string): boolean;
+    /** The outstanding failed prefix covering `key`, so the caller can retry it. */
+    failedPrefixFor(key: string): string | undefined;
+}
+//# sourceMappingURL=shared-drop-marks.d.ts.map

package/dist/kernel/cache/shared-drop-marks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-drop-marks.d.ts","sourceRoot":"","sources":["../../../src/kernel/cache/shared-drop-marks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,eAAe;IAC1B,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IACtD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAE5C,iEAAiE;IACjE,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI3B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAM5B,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIhC,uEAAuE;IACvE,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMvC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAOhC,gFAAgF;IAChF,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAMjD"}

package/dist/kernel/cache/shared-drop-marks.js

@@ -0,0 +1,68 @@
+/**
+ * Bookkeeping for the invalidation window of a two-layer cache (Redis + a
+ * per-process LRU), shared by `SettingsCache` and `SalesChannelsCache`.
+ *
+ * Both caches invalidate the same way, for the reasons MR !449 established:
+ * drop the **shared** layer first, because it is the layer that outlives this
+ * process and would otherwise be re-pulled into every other process's LRU, and
+ * because it is the step that can fail. A half-done invalidation must degrade
+ * to "slower but correct", never to "fast and wrong", which needs two marks:
+ *
+ *   - `draining` — a drop for this prefix is on the wire. Reads bypass both
+ *     layers and writes do not repopulate them, because the notification that
+ *     triggered the drop is dispatched fire-and-forget and a read routinely
+ *     lands mid-invalidation.
+ *   - `failed` — the shared drop threw, so Redis may still hold the
+ *     pre-invalidation value. The prefix stays marked until a later drop
+ *     succeeds; reads keep bypassing the cache (and keep retrying the drop)
+ *     rather than being served a value the invalidation was supposed to remove.
+ *
+ * It is deliberately just the bookkeeping: the caller owns the drop, so the
+ * retry stays where the key layout and the scan count are known.
+ */
+export class SharedDropMarks {
+    /** Key prefixes whose shared drop is on the wire right now, by depth. */
+    draining = new Map();
+    /** Key prefixes whose shared drop threw; the shared layer may be stale. */
+    failed = new Set();
+    /** True when neither mark is set — the hot path's early exit. */
+    get isClean() {
+        return this.draining.size === 0 && this.failed.size === 0;
+    }
+    begin(prefix) {
+        this.draining.set(prefix, (this.draining.get(prefix) ?? 0) + 1);
+    }
+    finish(prefix) {
+        const depth = (this.draining.get(prefix) ?? 1) - 1;
+        if (depth <= 0)
+            this.draining.delete(prefix);
+        else
+            this.draining.set(prefix, depth);
+    }
+    markFailed(prefix) {
+        this.failed.add(prefix);
+    }
+    /** A successful drop also retires any narrower outstanding failure. */
+    retireFailedUnder(prefix) {
+        for (const p of this.failed) {
+            if (p.startsWith(prefix))
+                this.failed.delete(p);
+        }
+    }
+    isDraining(key) {
+        for (const prefix of this.draining.keys()) {
+            if (key.startsWith(prefix))
+                return true;
+        }
+        return false;
+    }
+    /** The outstanding failed prefix covering `key`, so the caller can retry it. */
+    failedPrefixFor(key) {
+        for (const prefix of this.failed) {
+            if (key.startsWith(prefix))
+                return prefix;
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=shared-drop-marks.js.map

package/dist/kernel/cache/shared-drop-marks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-drop-marks.js","sourceRoot":"","sources":["../../../src/kernel/cache/shared-drop-marks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,eAAe;IAC1B,yEAAyE;IACxD,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtD,2EAA2E;IAC1D,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,iEAAiE;IACjE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAc;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,MAAc;QACnB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,KAAK,IAAI,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;;YACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,uEAAuE;IACvE,iBAAiB,CAAC,MAAc;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gFAAgF;IAChF,eAAe,CAAC,GAAW;QACzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}