@endora-commerce/platform 0.100.0

package/dist/kernel/sales-channels/compose.d.ts

@@ -0,0 +1,69 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { FastifyInstance } from 'fastify';
+import type { Redis } from 'ioredis';
+import type { EventBus } from '../../events/bus.js';
+import type { AuditPort } from '../ports/audit.js';
+import { SalesChannelsCache } from './sales-channels-cache.js';
+import { SalesChannelResolverService } from './sales-channel-resolver.service.js';
+import { SalesChannelMembershipService } from './sales-channel-membership.service.js';
+import { type ChannelBridgeRegistry } from './channel-bridge-registry.js';
+/**
+ * The sales-channel resolution machinery, composed as kernel infrastructure
+ * rather than as part of the `sales_channels` module (feature 072, T110).
+ *
+ * The split follows what the code already was after T019 moved these files
+ * into `kernel/`: resolving which channel a request belongs to is something
+ * every channel-scoped read depends on (Principle XII), and it has to keep
+ * working whether or not an operator wants the channel *administration*
+ * screens. Gating the middleware behind the module would mean switching
+ * `sales_channels` off leaves every storefront request with no resolved
+ * channel — not a smaller platform, a broken one.
+ *
+ * So the module keeps what is genuinely its own — the admin CRUD service, its
+ * routes, its migrations and its settings — and this function composes the
+ * rest for a composition root.
+ */
+export interface SalesChannelsKernelOptions {
+    readonly emFactory: () => EntityManager;
+    readonly eventBus: EventBus;
+    readonly redis: Redis;
+    readonly auditLogService?: AuditPort;
+    /**
+     * The bridge registry the owning modules contribute into (feature 120,
+     * FR-015). Defaults to the process-level one, which is what every
+     * composition root in this repository uses; a caller supplies its own only
+     * to compose an isolated platform.
+     */
+    readonly bridgeRegistry?: ChannelBridgeRegistry;
+    /**
+     * Forwarded to the resolver middleware. Defaults to `false` so admin routes
+     * keep working without `X-Sales-Channel`.
+     */
+    readonly strictAdmin?: boolean;
+}
+export interface SalesChannelsKernel {
+    readonly cache: SalesChannelsCache;
+    readonly resolver: SalesChannelResolverService;
+    readonly membershipService: SalesChannelMembershipService;
+    /**
+     * The channel-bridge contribution registry (feature 120, FR-015).
+     *
+     * A composition root contributes it to the container as
+     * `salesChannelBridgeRegistry`, which is the name each owning module resolves
+     * from its boot hook to declare the one bridge it owns. The platform holds no
+     * map of its own: a member no module registered refuses rather than reaching
+     * a relation an instance that omits that module does not have.
+     */
+    readonly bridgeRegistry: ChannelBridgeRegistry;
+    /**
+     * Withdraws this process's cache from the operator-facing clear. Released
+     * for tests; in production it lives until process exit.
+     */
+    readonly cacheRegistration: {
+        readonly dispose: () => void;
+    };
+    /** The resolver middleware, mounted by the root and never module-gated. */
+    readonly plugin: (app: FastifyInstance) => Promise<void>;
+}
+export declare function composeSalesChannelsKernel(options: SalesChannelsKernelOptions): SalesChannelsKernel;
+//# sourceMappingURL=compose.d.ts.map

package/dist/kernel/sales-channels/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../../src/kernel/sales-channels/compose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAEL,kBAAkB,EACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;IAC1D;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IAC7D,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAyCrB"}

package/dist/kernel/sales-channels/compose.js

@@ -0,0 +1,43 @@
+import { inProcessCaches } from '../cache/in-process-cache-registry.js';
+import { SALES_CHANNELS_CACHE_NAMESPACE, SalesChannelsCache, } from './sales-channels-cache.js';
+import { SalesChannelResolverService } from './sales-channel-resolver.service.js';
+import { SalesChannelMembershipService } from './sales-channel-membership.service.js';
+import { channelBridges } from './channel-bridge-registry.js';
+import { registerSalesChannelResolverMiddleware } from './sales-channel-resolver.middleware.js';
+export function composeSalesChannelsKernel(options) {
+    const cache = new SalesChannelsCache(options.redis);
+    const resolver = new SalesChannelResolverService(options.emFactory, cache);
+    const bridgeRegistry = options.bridgeRegistry ?? channelBridges;
+    const membershipService = new SalesChannelMembershipService(options.emFactory, options.eventBus, options.auditLogService, bridgeRegistry);
+    /**
+     * The one thing composing the cache still has to *do*: announce it to the
+     * operator-facing "clear cache" action (issue #33). The clear runs in this
+     * process and has to reach the object that owns both layers, or it drops the
+     * Redis keys while every warm process keeps serving — and re-pinning — the
+     * channel it had already resolved.
+     *
+     * It used to ride on `attachSalesChannelsCacheInvalidator`, which also
+     * subscribed to `sales_channels.identity_changed` and
+     * `sales_channels.lifecycle_changed`. Those subscriptions are gone (D-93);
+     * the registration is not, because it never had anything to do with the bus.
+     */
+    const unregister = inProcessCaches.register(SALES_CHANNELS_CACHE_NAMESPACE, cache);
+    return {
+        cache,
+        resolver,
+        membershipService,
+        bridgeRegistry,
+        cacheRegistration: { dispose: unregister },
+        plugin: async (app) => {
+            await registerSalesChannelResolverMiddleware(app, {
+                resolver,
+                ...(options.strictAdmin !== undefined ? { strictAdmin: options.strictAdmin } : {}),
+                // Feature 062 — audit sink for bound-key channel-mismatch refusals.
+                ...(options.auditLogService !== undefined
+                    ? { auditLogService: options.auditLogService }
+                    : {}),
+            });
+        },
+    };
+}
+//# sourceMappingURL=compose.js.map

package/dist/kernel/sales-channels/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../../src/kernel/sales-channels/compose.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,cAAc,EAA8B,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,sCAAsC,EAAE,MAAM,wCAAwC,CAAC;AA4DhG,MAAM,UAAU,0BAA0B,CACxC,OAAmC;IAEnC,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,2BAA2B,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,cAAc,CAAC;IAChE,MAAM,iBAAiB,GAAG,IAAI,6BAA6B,CACzD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,eAAe,EACvB,cAAc,CACf,CAAC;IACF;;;;;;;;;;;OAWG;IACH,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;IAEnF,OAAO;QACL,KAAK;QACL,QAAQ;QACR,iBAAiB;QACjB,cAAc;QACd,iBAAiB,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;QAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,sCAAsC,CAAC,GAAG,EAAE;gBAChD,QAAQ;gBACR,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,oEAAoE;gBACpE,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/kernel/sales-channels/default-channel-reconciler.d.ts

@@ -0,0 +1,66 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AuditPort } from '../ports/audit.js';
+import { SalesChannel } from './sales-channel.entity.js';
+/**
+ * DefaultChannelReconciler — feature 005 / T013.
+ *
+ * Boot-time idempotent guarantee that the platform has exactly one
+ * `system_default = true` Sales Channel (FR-002, research R-4). The
+ * partial unique index on `system_default` (migration 025) prevents two
+ * winners; this service handles the "zero winners" case across all
+ * possible startup states.
+ *
+ * Decision tree (run on every backend boot):
+ *
+ *   1. Zero rows in `sales_channels`
+ *      → INSERT a fresh `Default` row with `system_default = true`,
+ *        sourced from env var `DEFAULT_SALES_CHANNEL_CODE` (default
+ *        `default`). Audit `lifecycle.changed{op:'system-default-promoted'}`.
+ *
+ *   2. ≥1 rows AND none has `system_default = true`
+ *      → Promote the lexically-first row by `code` (with a tie-break
+ *        toward `code = 'default'`). This handles the upgrade-from-002
+ *        case where the seed inserted a channel before this feature
+ *        existed. Audit the promotion.
+ *
+ *   3. Exactly one row has `system_default = true`
+ *      → No-op. Idempotent re-runs land here.
+ *
+ * The reconciler NEVER DEMOTES an already-promoted row, never deletes,
+ * and never edits identity. A platform that finds itself with multiple
+ * system-default rows (only possible if the partial unique index is
+ * missing, e.g. on a partially-migrated DB) leaves the rows alone and
+ * emits a critical warning so the operator can intervene — see
+ * {@link DefaultChannelReconciliationResult.warning}.
+ */
+export interface DefaultChannelReconciliationResult {
+    /** Action taken in this run. */
+    action: 'inserted' | 'promoted' | 'no_change' | 'warning';
+    /** The system-default channel after reconciliation, when known. */
+    systemDefault?: SalesChannel;
+    /** Operator-actionable warning text when the partial unique index is missing or multiple defaults are observed. */
+    warning?: string;
+}
+export interface DefaultChannelReconcilerOptions {
+    /**
+     * Used by tests whose `languages` / `currencies` seed differs from the
+     * `en` / `EUR` fallbacks. Production always uses the env-driven
+     * fallbacks (research R-4); these overrides are not exposed in
+     * `composition.ts`.
+     */
+    bootstrapDefaults?: {
+        code?: string;
+        language?: string;
+        currency?: string;
+    };
+}
+export declare class DefaultChannelReconciler {
+    private readonly emFactory;
+    private readonly auditLogService?;
+    private readonly options;
+    constructor(emFactory: () => EntityManager, auditLogService?: AuditPort | undefined, options?: DefaultChannelReconcilerOptions);
+    run(): Promise<DefaultChannelReconciliationResult>;
+    private insertDefault;
+    private audit;
+}
+//# sourceMappingURL=default-channel-reconciler.d.ts.map

package/dist/kernel/sales-channels/default-channel-reconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-channel-reconciler.d.ts","sourceRoot":"","sources":["../../../src/kernel/sales-channels/default-channel-reconciler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,kCAAkC;IACjD,gCAAgC;IAChC,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC1D,mEAAmE;IACnE,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,MAAM,WAAW,+BAA+B;IAC9C;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,SAAS,EAAE,MAAM,aAAa,EAC9B,eAAe,CAAC,EAAE,SAAS,YAAA,EAC3B,OAAO,GAAE,+BAAoC;IAG1D,GAAG,IAAI,OAAO,CAAC,kCAAkC,CAAC;YAoD1C,aAAa;YAmCb,KAAK;CAUpB"}

package/dist/kernel/sales-channels/default-channel-reconciler.js

@@ -0,0 +1,91 @@
+import { SALES_CHANNEL_AUDIT_ACTIONS } from '@endora-commerce/contracts';
+import { SalesChannel } from './sales-channel.entity.js';
+const DEFAULT_CODE_FALLBACK = 'default';
+const DEFAULT_LANGUAGE_FALLBACK = 'en';
+const DEFAULT_CURRENCY_FALLBACK = 'EUR';
+export class DefaultChannelReconciler {
+    emFactory;
+    auditLogService;
+    options;
+    constructor(emFactory, auditLogService, options = {}) {
+        this.emFactory = emFactory;
+        this.auditLogService = auditLogService;
+        this.options = options;
+    }
+    async run() {
+        const em = this.emFactory();
+        const all = await em.find(SalesChannel, {});
+        // Branch 1 — empty table. Insert Default.
+        if (all.length === 0) {
+            const inserted = await this.insertDefault(em);
+            return { action: 'inserted', systemDefault: inserted };
+        }
+        const defaults = all.filter((c) => c.systemDefault);
+        // Branch 3 — exactly one already promoted: no-op.
+        if (defaults.length === 1) {
+            return { action: 'no_change', systemDefault: defaults[0] };
+        }
+        // Branch warning — multiple defaults observed (only possible if the
+        // partial unique index is missing). Leave them alone, emit a warning.
+        if (defaults.length > 1) {
+            return {
+                action: 'warning',
+                warning: `[sales_channels] expected at most one row with system_default = true, ` +
+                    `observed ${defaults.length}. The partial unique index ` +
+                    `"sales_channels_one_system_default" is likely missing or migration 025 ` +
+                    `has not been applied. Manual intervention is required.`,
+            };
+        }
+        // Branch 2 — no defaults. Promote the lexically-first row, tie-breaking
+        // toward `code = 'default'`.
+        const candidates = [...all].sort((a, b) => {
+            const aIsDefault = a.code === DEFAULT_CODE_FALLBACK ? 0 : 1;
+            const bIsDefault = b.code === DEFAULT_CODE_FALLBACK ? 0 : 1;
+            if (aIsDefault !== bIsDefault)
+                return aIsDefault - bIsDefault;
+            return a.code.localeCompare(b.code);
+        });
+        const winner = candidates[0];
+        winner.systemDefault = true;
+        winner.version += 1;
+        await em.persistAndFlush(winner);
+        await this.audit(winner.id, 'system-default-promoted', `boot-time reconciler promoted "${winner.code}" to system default`);
+        return { action: 'promoted', systemDefault: winner };
+    }
+    async insertDefault(em) {
+        const code = this.options.bootstrapDefaults?.code ??
+            process.env['DEFAULT_SALES_CHANNEL_CODE'] ??
+            DEFAULT_CODE_FALLBACK;
+        const language = this.options.bootstrapDefaults?.language ?? DEFAULT_LANGUAGE_FALLBACK;
+        const currency = this.options.bootstrapDefaults?.currency ?? DEFAULT_CURRENCY_FALLBACK;
+        const channel = em.create(SalesChannel, {
+            code,
+            name: { en: 'Default' },
+            languages: [language],
+            defaultLanguage: language,
+            currencies: [currency],
+            defaultCurrency: currency,
+            active: true,
+            systemDefault: true,
+            version: 1,
+            // Legacy columns preserved for one release (research R-12).
+            isPublic: false,
+            status: 'active',
+        });
+        await em.persistAndFlush(channel);
+        await this.audit(channel.id, 'system-default-promoted', `boot-time reconciler inserted fresh "${code}" as system default`);
+        return channel;
+    }
+    async audit(channelId, op, reason) {
+        if (!this.auditLogService)
+            return;
+        await this.auditLogService.record({
+            actorAdminUserId: null,
+            action: SALES_CHANNEL_AUDIT_ACTIONS.LIFECYCLE_CHANGED,
+            objectType: 'sales_channel',
+            objectId: channelId,
+            stateAfter: { op, reason },
+        });
+    }
+}
+//# sourceMappingURL=default-channel-reconciler.js.map

package/dist/kernel/sales-channels/default-channel-reconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-channel-reconciler.js","sourceRoot":"","sources":["../../../src/kernel/sales-channels/default-channel-reconciler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA4CzD,MAAM,qBAAqB,GAAG,SAAS,CAAC;AACxC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AACvC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAgBxC,MAAM,OAAO,wBAAwB;IAEhB;IACA;IACA;IAHnB,YACmB,SAA8B,EAC9B,eAA2B,EAC3B,UAA2C,EAAE;QAF7C,cAAS,GAAT,SAAS,CAAqB;QAC9B,oBAAe,GAAf,eAAe,CAAY;QAC3B,YAAO,GAAP,OAAO,CAAsC;IAC7D,CAAC;IAEJ,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAE5C,0CAA0C;QAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAEpD,kDAAkD;QAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC;QAC9D,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EACL,wEAAwE;oBACxE,YAAY,QAAQ,CAAC,MAAM,6BAA6B;oBACxD,yEAAyE;oBACzE,wDAAwD;aAC3D,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,6BAA6B;QAC7B,MAAM,UAAU,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACxC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,IAAI,UAAU,KAAK,UAAU;gBAAE,OAAO,UAAU,GAAG,UAAU,CAAC;YAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAC9B,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACpB,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,IAAI,CAAC,KAAK,CACd,MAAM,CAAC,EAAE,EACT,yBAAyB,EACzB,kCAAkC,MAAM,CAAC,IAAI,qBAAqB,CACnE,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,EAAiB;QAC3C,MAAM,IAAI,GACR,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI;YACpC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YACzC,qBAAqB,CAAC;QACxB,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,IAAI,yBAAyB,CAAC;QACxE,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,IAAI,yBAAyB,CAAC;QAExE,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE;YACtC,IAAI;YACJ,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;YACvB,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,eAAe,EAAE,QAAQ;YACzB,UAAU,EAAE,CAAC,QAAQ,CAAC;YACtB,eAAe,EAAE,QAAQ;YACzB,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,CAAC;YACV,4DAA4D;YAC5D,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,IAAI,CAAC,KAAK,CACd,OAAO,CAAC,EAAE,EACV,yBAAyB,EACzB,wCAAwC,IAAI,qBAAqB,CAClE,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,EAAU,EAAE,MAAc;QAC/D,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO;QAClC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAChC,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,2BAA2B,CAAC,iBAAiB;YACrD,UAAU,EAAE,eAAe;YAC3B,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/kernel/sales-channels/no-system-default-channel.error.d.ts

@@ -0,0 +1,28 @@
+import { HttpError } from '../../http/error-envelope.js';
+/**
+ * The platform has no sales channel holding `system_default` (feature 072,
+ * D-47 / D-48).
+ *
+ * This is a **platform fault, not a caller error**, and it is unreachable on a
+ * booted deployment: the boot reconciler
+ * (`kernel/sales-channels/default-channel-reconciler.ts`) inserts or promotes a
+ * default on every serving path, a partial unique index forbids a second one,
+ * and `SalesChannelsService` refuses every delete, deactivate and `active:false`
+ * that would take the flag away. The only way to observe it is to read a
+ * channel before composition has run the reconciler.
+ *
+ * It exists so that state has **one** spelling. Before D-48 it had four — a
+ * `'default'` channel code where an id was wanted, a nil UUID, a `randomUUID()`
+ * persisted into an order, and a silent switch to the platform-wide settings
+ * tier — because `getSystemDefault()` returned `null` and every author had to
+ * invent a value for a branch that cannot be taken.
+ *
+ * 500 `INTERNAL` is deliberate and matches what the resolver middleware already
+ * answered on this condition: no request can be blamed for it and no client can
+ * retry into a fix. The one surface that *renders* the condition rather than
+ * failing on it is `/sales-channels` (D-51); every consumer propagates.
+ */
+export declare class NoSystemDefaultChannel extends HttpError {
+    constructor();
+}
+//# sourceMappingURL=no-system-default-channel.error.d.ts.map

package/dist/kernel/sales-channels/no-system-default-channel.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-system-default-channel.error.d.ts","sourceRoot":"","sources":["../../../src/kernel/sales-channels/no-system-default-channel.error.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,sBAAuB,SAAQ,SAAS;;CAUpD"}

package/dist/kernel/sales-channels/no-system-default-channel.error.js

@@ -0,0 +1,33 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '../../http/error-envelope.js';
+/**
+ * The platform has no sales channel holding `system_default` (feature 072,
+ * D-47 / D-48).
+ *
+ * This is a **platform fault, not a caller error**, and it is unreachable on a
+ * booted deployment: the boot reconciler
+ * (`kernel/sales-channels/default-channel-reconciler.ts`) inserts or promotes a
+ * default on every serving path, a partial unique index forbids a second one,
+ * and `SalesChannelsService` refuses every delete, deactivate and `active:false`
+ * that would take the flag away. The only way to observe it is to read a
+ * channel before composition has run the reconciler.
+ *
+ * It exists so that state has **one** spelling. Before D-48 it had four — a
+ * `'default'` channel code where an id was wanted, a nil UUID, a `randomUUID()`
+ * persisted into an order, and a silent switch to the platform-wide settings
+ * tier — because `getSystemDefault()` returned `null` and every author had to
+ * invent a value for a branch that cannot be taken.
+ *
+ * 500 `INTERNAL` is deliberate and matches what the resolver middleware already
+ * answered on this condition: no request can be blamed for it and no client can
+ * retry into a fix. The one surface that *renders* the condition rather than
+ * failing on it is `/sales-channels` (D-51); every consumer propagates.
+ */
+export class NoSystemDefaultChannel extends HttpError {
+    constructor() {
+        super(500, ERROR_CODES.INTERNAL, 'No sales channel holds the system-default flag; the boot-time default-channel ' +
+            'reconciler has not run or could not repair the registry.');
+        this.name = 'NoSystemDefaultChannel';
+    }
+}
+//# sourceMappingURL=no-system-default-channel.error.js.map

package/dist/kernel/sales-channels/no-system-default-channel.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-system-default-channel.error.js","sourceRoot":"","sources":["../../../src/kernel/sales-channels/no-system-default-channel.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IACnD;QACE,KAAK,CACH,GAAG,EACH,WAAW,CAAC,QAAQ,EACpB,gFAAgF;YAC9E,0DAA0D,CAC7D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF"}

package/dist/kernel/sales-channels/request-channel-assortment.d.ts

@@ -0,0 +1,72 @@
+import type { SalesChannelMembershipPort } from '../ports/sales-channel.js';
+/**
+ * The assortment gate the **product acquisition seams** owe (issue #259,
+ * Constitution XII).
+ *
+ * ## What was wrong
+ *
+ * Issue #227 taught every buyer-facing product path to ask
+ * `isProductVisibleTo(product, audience)`, and that predicate says in writing
+ * that it is *not* the channel answer — the channel is "a second filter every
+ * buyer-facing path owes on top of this one". The view side pays it: a listing
+ * page and a product detail both narrow to
+ * `sales_channel_products` before they answer. The **acquisition** side did
+ * not. A product published on one channel only was still reachable by id and by
+ * SKU through cart add, comparison add, a quote-request line, a saved list and
+ * a pasted quick-order SKU list — every one of them holding an identifier the
+ * caller supplied, and every one of them applying the audience filter and no
+ * channel test at all.
+ *
+ * ## Why this is not folded into `isProductVisibleTo`
+ *
+ * Owner ruling, 2026-08-21. The channel is a property of the **request**, not
+ * of the viewer's relationship to the product: `isProductVisibleTo(product,
+ * audience)` answers "may this audience see this product at all", and it is
+ * pure, synchronous and shared by two SQL restatements with derived parity
+ * tests. Folding an asynchronous membership read into it would merge two
+ * questions, change a published contract shape and rewrite every parity test to
+ * answer for a dimension neither SQL site has. The two filters stay separate
+ * and every seam applies both.
+ *
+ * ## `null` is a real answer, and it is not "no channel"
+ *
+ * The resolver middleware runs as an `onRequest` hook on every `/api/v1/*` path
+ * and falls back to the system-default channel, so **inside a request there is
+ * always a channel** — including an anonymous one, including an admin one. The
+ * scope slot is empty only where there is no request at all: a CLI entry point,
+ * a BullMQ worker, a seed, a fixture calling the service directly. There, the
+ * honest answer is that this acquisition is happening on no channel, so there
+ * is nothing to narrow against — and {@link productIdsInRequestChannel} says so
+ * with `null` rather than with an empty set or with a channel it made up.
+ *
+ * Narrowing against the system-default channel instead would be the fabrication
+ * D-47…D-51 drained under four spellings (`'default'`, the nil UUID, the empty
+ * string, `randomUUID()`): it would refuse an operator's own action because a
+ * channel nobody named happens not to publish the row. The return type is what
+ * keeps the two apart — `ReadonlySet` and `null` are different types, so a
+ * caller cannot mistake "the channel publishes none of these" for "there was no
+ * channel to ask about", which is the mistake an empty set invites. It is the
+ * same shape, and for the same reason, as `allowedIdsFor(): Promise<string[] |
+ * null>`.
+ *
+ * ## The read itself
+ *
+ * Through {@link SalesChannelMembershipPort.filterEntityIdsInChannel} — the
+ * sanctioned bridge accessor (Constitution XII), the same one
+ * `catalog.filterByChannel` narrows a listing page with. No statement against
+ * `sales_channel_products` is written here; `check:module-boundary`'s SQL
+ * predicate would be right to report one.
+ */
+export declare function productIdsInRequestChannel(membership: SalesChannelMembershipPort, productIds: readonly string[]): Promise<ReadonlySet<string> | null>;
+/**
+ * `true` when the request's channel does **not** publish `productId` — the
+ * single-product spelling of {@link productIdsInRequestChannel}, for the seams
+ * that acquire one product at a time.
+ *
+ * Reads as the refusal it guards (`if (await outOfRequestChannel(…)) throw`),
+ * which is what keeps the `null` arm from being written as a silent `true` at
+ * five call sites: outside a request there is no channel to be out of, so the
+ * answer is `false` and the seam proceeds on the audience filter alone.
+ */
+export declare function outOfRequestChannel(membership: SalesChannelMembershipPort, productId: string): Promise<boolean>;
+//# sourceMappingURL=request-channel-assortment.d.ts.map

package/dist/kernel/sales-channels/request-channel-assortment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-channel-assortment.d.ts","sourceRoot":"","sources":["../../../src/kernel/sales-channels/request-channel-assortment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAG5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,0BAA0B,EACtC,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAUrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,0BAA0B,EACtC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/kernel/sales-channels/request-channel-assortment.js

@@ -0,0 +1,83 @@
+import { currentSalesChannel } from './sales-channel-resolver.middleware.js';
+/**
+ * The assortment gate the **product acquisition seams** owe (issue #259,
+ * Constitution XII).
+ *
+ * ## What was wrong
+ *
+ * Issue #227 taught every buyer-facing product path to ask
+ * `isProductVisibleTo(product, audience)`, and that predicate says in writing
+ * that it is *not* the channel answer — the channel is "a second filter every
+ * buyer-facing path owes on top of this one". The view side pays it: a listing
+ * page and a product detail both narrow to
+ * `sales_channel_products` before they answer. The **acquisition** side did
+ * not. A product published on one channel only was still reachable by id and by
+ * SKU through cart add, comparison add, a quote-request line, a saved list and
+ * a pasted quick-order SKU list — every one of them holding an identifier the
+ * caller supplied, and every one of them applying the audience filter and no
+ * channel test at all.
+ *
+ * ## Why this is not folded into `isProductVisibleTo`
+ *
+ * Owner ruling, 2026-08-21. The channel is a property of the **request**, not
+ * of the viewer's relationship to the product: `isProductVisibleTo(product,
+ * audience)` answers "may this audience see this product at all", and it is
+ * pure, synchronous and shared by two SQL restatements with derived parity
+ * tests. Folding an asynchronous membership read into it would merge two
+ * questions, change a published contract shape and rewrite every parity test to
+ * answer for a dimension neither SQL site has. The two filters stay separate
+ * and every seam applies both.
+ *
+ * ## `null` is a real answer, and it is not "no channel"
+ *
+ * The resolver middleware runs as an `onRequest` hook on every `/api/v1/*` path
+ * and falls back to the system-default channel, so **inside a request there is
+ * always a channel** — including an anonymous one, including an admin one. The
+ * scope slot is empty only where there is no request at all: a CLI entry point,
+ * a BullMQ worker, a seed, a fixture calling the service directly. There, the
+ * honest answer is that this acquisition is happening on no channel, so there
+ * is nothing to narrow against — and {@link productIdsInRequestChannel} says so
+ * with `null` rather than with an empty set or with a channel it made up.
+ *
+ * Narrowing against the system-default channel instead would be the fabrication
+ * D-47…D-51 drained under four spellings (`'default'`, the nil UUID, the empty
+ * string, `randomUUID()`): it would refuse an operator's own action because a
+ * channel nobody named happens not to publish the row. The return type is what
+ * keeps the two apart — `ReadonlySet` and `null` are different types, so a
+ * caller cannot mistake "the channel publishes none of these" for "there was no
+ * channel to ask about", which is the mistake an empty set invites. It is the
+ * same shape, and for the same reason, as `allowedIdsFor(): Promise<string[] |
+ * null>`.
+ *
+ * ## The read itself
+ *
+ * Through {@link SalesChannelMembershipPort.filterEntityIdsInChannel} — the
+ * sanctioned bridge accessor (Constitution XII), the same one
+ * `catalog.filterByChannel` narrows a listing page with. No statement against
+ * `sales_channel_products` is written here; `check:module-boundary`'s SQL
+ * predicate would be right to report one.
+ */
+export async function productIdsInRequestChannel(membership, productIds) {
+    const channel = currentSalesChannel();
+    if (!channel)
+        return null;
+    if (productIds.length === 0)
+        return new Set();
+    const published = await membership.filterEntityIdsInChannel(channel.id, 'product', Array.from(new Set(productIds)));
+    return new Set(published);
+}
+/**
+ * `true` when the request's channel does **not** publish `productId` — the
+ * single-product spelling of {@link productIdsInRequestChannel}, for the seams
+ * that acquire one product at a time.
+ *
+ * Reads as the refusal it guards (`if (await outOfRequestChannel(…)) throw`),
+ * which is what keeps the `null` arm from being written as a silent `true` at
+ * five call sites: outside a request there is no channel to be out of, so the
+ * answer is `false` and the seam proceeds on the audience filter alone.
+ */
+export async function outOfRequestChannel(membership, productId) {
+    const published = await productIdsInRequestChannel(membership, [productId]);
+    return published !== null && !published.has(productId);
+}
+//# sourceMappingURL=request-channel-assortment.js.map

package/dist/kernel/sales-channels/request-channel-assortment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-channel-assortment.js","sourceRoot":"","sources":["../../../src/kernel/sales-channels/request-channel-assortment.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAsC,EACtC,UAA6B;IAE7B,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAU,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,wBAAwB,CACzD,OAAO,CAAC,EAAE,EACV,SAAS,EACT,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAChC,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAsC,EACtC,SAAiB;IAEjB,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,OAAO,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC"}