@openlup/platform 0.16.0 → 0.18.0

package/src/catalog/bundleCatalogStore.ts

@@ -0,0 +1,269 @@
+import {
+  BundleCatalogReadError,
+} from "./bundleCatalogReadPort.js";
+import type {
+  ActiveBundleComposition,
+  BundleCatalogReadPort,
+  BundleComponentRow,
+  BundleDetail,
+  BundleHistoryInput,
+  BundleHistoryResult,
+  BundleSummary,
+  GetBundleInput,
+  ListBundlesInput,
+  ListBundlesResult,
+} from "./bundleCatalogReadPort.js";
+import type { PgQueryExecutor } from "../data/index.js";
+import {
+  LIST_SQL,
+  COUNT_SQL,
+  DETAIL_SQL,
+  COMPONENT_SQL,
+  FEED_COMPONENT_SQL,
+  PRICE_SQL,
+  OWN_LIST_SQL,
+  CURRENCY_LIST_SQL,
+  FEED_SQL,
+  HISTORY_SQL,
+  HISTORY_COUNT_SQL,
+} from "./bundleCatalogQueries.js";
+
+
+/**
+ * Direct-Postgres adapter for the bundle read port. A real adapter: it renders the
+ * joins itself, against the same three relations both chains declare, and reads no
+ * row the port's contract does not name.
+ *
+ * It goes through no transaction lane and switches no role. A read needs no
+ * principal, and the public platform manifest declares no managed role to switch
+ * into; the port contract has no write operation, so read-only is a property of
+ * the shape rather than a promise in a comment.
+ *
+ * The one place the two chains genuinely differ is the operator trail: this chain
+ * reads the neutral `catalog_bundle_write_events` ledger the platform forward
+ * created, because it has no audit table and no operator registry to name.
+ */
+
+interface BundleRow {
+  id: string;
+  code: string;
+  title: string;
+  status: string;
+  fulfillment_mode: string;
+  updated_at: string;
+  component_count: string | number;
+  has_active_target_price: boolean;
+  composition_constraint: Record<string, unknown> | null;
+  metadata: Record<string, unknown> | null;
+}
+
+interface ComponentRow {
+  bundle_id: string;
+  sku: string;
+  title: string | null;
+  product_slug: string;
+  variant_id: string;
+  quantity: number;
+  is_addon: boolean;
+  sort_order: number;
+  reference_unit_price_minor: number | null;
+}
+
+interface PriceRow {
+  mode: string;
+  target_price_minor: number;
+  currency: string;
+  amount_kind: string;
+  active: boolean;
+  valid_from: string;
+  valid_to: string | null;
+}
+
+interface ActiveBundleRow {
+  id: string;
+  code: string;
+  title: string;
+  fulfillment_mode: string;
+  mode: string;
+  target_price_minor: number;
+  price_list_id: string;
+  currency: string;
+}
+
+interface WriteEventRow {
+  id: string;
+  bundle_code: string;
+  action: string;
+  before_state: unknown;
+  after_state: unknown;
+  created_at: string;
+}
+
+export function createPostgresBundleCatalogStore(
+  executor: PgQueryExecutor,
+): BundleCatalogReadPort {
+  async function rows<T>(sql: string, values: unknown[]): Promise<T[]> {
+    // A driver failure becomes the port's own read error, so a caller sees the
+    // same distinction between "found nothing" and "could not ask" on both chains.
+    const result = await executor.query(sql, values).catch((error: unknown) => {
+      throw new BundleCatalogReadError(error instanceof Error ? error.message : String(error));
+    });
+    return (result.rows ?? []) as unknown as T[];
+  }
+
+  async function components(bundleId: string, priceListId: string | null) {
+    return (await rows<ComponentRow>(COMPONENT_SQL, [bundleId, priceListId])).map(toComponent);
+  }
+
+  async function selectPriceList(
+    bundleId: string,
+    input: GetBundleInput,
+  ): Promise<{ id: string; currency: string } | null> {
+    const list = input.currency
+      ? await rows<{ id: string; currency: string }>(CURRENCY_LIST_SQL, [input.currency])
+      : await rows<{ id: string; currency: string }>(OWN_LIST_SQL, [bundleId, input.mode ?? null]);
+    return list[0] ?? null;
+  }
+
+  return {
+    async listBundles(input: ListBundlesInput): Promise<ListBundlesResult> {
+      const filter = [input.status, input.query ?? null];
+      const [page, counted] = await Promise.all([
+        rows<BundleRow>(LIST_SQL, [...filter, input.limit, input.offset]),
+        rows<{ total: string | number }>(COUNT_SQL, filter),
+      ]);
+      return { bundles: page.map(toSummary), total: Number(counted[0]?.total ?? page.length) };
+    },
+
+    async getBundle(input: GetBundleInput): Promise<BundleDetail | null> {
+      const bundle = (await rows<BundleRow>(DETAIL_SQL, [input.code]))[0];
+      if (!bundle) return null;
+      const list = await selectPriceList(bundle.id, input);
+      const [componentRows, priceRows] = await Promise.all([
+        components(bundle.id, list?.id ?? null),
+        rows<PriceRow>(PRICE_SQL, [bundle.id]),
+      ]);
+      return {
+        ...toSummary(bundle),
+        compositionConstraint: toConstraint(bundle.composition_constraint),
+        metadata: bundle.metadata ?? {},
+        components: componentRows,
+        prices: priceRows.map(toPrice),
+        resolvedCurrency: list?.currency ?? null,
+        resolvedPriceListId: list?.id ?? null,
+      };
+    },
+
+    async listActiveBundleCompositions(
+      input: { currency?: string } = {},
+    ): Promise<ActiveBundleComposition[]> {
+      // A bundle may carry several active prices (a scheduled successor); the feed
+      // takes the newest window per bundle, which is what the ORDER BY already put first.
+      const selected = new Map<string, ActiveBundleRow>();
+      for (const row of await rows<ActiveBundleRow>(FEED_SQL, [input.currency ?? null])) {
+        if (!selected.has(row.id)) selected.set(row.id, row);
+      }
+      if (selected.size === 0) return [];
+
+      const chosen = [...selected.values()];
+      const byBundle = groupComponents(
+        await rows<ComponentRow>(FEED_COMPONENT_SQL, [
+          chosen.map((row) => row.id),
+          chosen.map((row) => row.price_list_id),
+        ]),
+      );
+      return chosen.map((row) => ({
+        code: row.code,
+        title: row.title,
+        fulfillmentMode: row.fulfillment_mode,
+        currency: row.currency,
+        targetPriceMinor: row.target_price_minor,
+        mode: row.mode,
+        components: byBundle.get(row.id) ?? [],
+      }));
+    },
+
+    async listBundleHistory(input: BundleHistoryInput): Promise<BundleHistoryResult> {
+      const [page, counted] = await Promise.all([
+        rows<WriteEventRow>(HISTORY_SQL, [input.code, input.limit, input.offset]),
+        rows<{ total: string | number }>(HISTORY_COUNT_SQL, [input.code]),
+      ]);
+      return {
+        // This chain has no operator registry, so it can record WHICH principal
+        // wrote but never what kind of actor it was; both fields stay null rather
+        // than being invented from the principal id.
+        events: page.map((row) => ({
+          id: row.id,
+          action: row.action,
+          actorKind: null,
+          actorEmail: null,
+          entityId: row.bundle_code,
+          oldValue: row.before_state ?? null,
+          newValue: row.after_state ?? null,
+          occurredAt: row.created_at,
+        })),
+        total: Number(counted[0]?.total ?? page.length),
+      };
+    },
+  };
+}
+
+function groupComponents(rows: readonly ComponentRow[]): Map<string, BundleComponentRow[]> {
+  const grouped = new Map<string, BundleComponentRow[]>();
+  for (const row of rows) {
+    const bucket = grouped.get(row.bundle_id) ?? [];
+    bucket.push(toComponent(row));
+    grouped.set(row.bundle_id, bucket);
+  }
+  return grouped;
+}
+
+function toComponent(row: ComponentRow): BundleComponentRow {
+  return {
+    sku: row.sku,
+    title: row.title ?? null,
+    productSlug: row.product_slug,
+    variantId: row.variant_id,
+    quantity: Number(row.quantity),
+    isAddon: row.is_addon === true,
+    sortOrder: Number(row.sort_order),
+    referenceUnitPriceMinor:
+      row.reference_unit_price_minor === null || row.reference_unit_price_minor === undefined
+        ? null
+        : Number(row.reference_unit_price_minor),
+  };
+}
+
+function toSummary(row: BundleRow): BundleSummary {
+  return {
+    code: row.code,
+    title: row.title,
+    status: row.status,
+    fulfillmentMode: row.fulfillment_mode,
+    componentCount: Number(row.component_count ?? 0),
+    hasActiveTargetPrice: row.has_active_target_price === true,
+    updatedAt: row.updated_at,
+  };
+}
+
+function toPrice(row: PriceRow) {
+  return {
+    mode: row.mode,
+    targetPriceMinor: Number(row.target_price_minor),
+    currency: row.currency,
+    amountKind: row.amount_kind,
+    active: row.active === true,
+    validFrom: row.valid_from,
+    validTo: row.valid_to ?? null,
+  };
+}
+
+/** An empty envelope is stored as `{}`; that is "unconstrained", not a constraint. */
+function toConstraint(value: Record<string, unknown> | null) {
+  if (!value || typeof value.kind !== "string" || value.kind.trim() === "") return null;
+  return {
+    kind: value.kind,
+    version: typeof value.version === "number" ? value.version : 0,
+    data: (value.data ?? {}) as Record<string, unknown>,
+  };
+}

package/src/catalog/bundleRuleCodes.ts

@@ -0,0 +1,134 @@
+import type { BundleAllocationFailureCode } from "@openlup/core/pricing";
+
+
+
+/**
+ * Bundle write rules — the named, enforced invariants of the agent-operable
+ * bundle write path. These codes are the single vocabulary shared by the request
+ * contracts, the pure rule predicates (`bundleRules.ts`), managed write routines
+ * and the over-the-wire error taxonomy. Managed routines re-derive state rules;
+ * native actor-kind enforcement relies on the handler, not an independent
+ * database gate.
+ *
+ * The catalog rules use this same shape; the lifecycle subset is expressed
+ * through the host lifecycle kit, and the codes stay here as
+ * this domain's registry.
+ */
+export const BUNDLE_RULE_CODES = [
+  // Machine (agent) actors compose, price and archive drafts, but may NOT
+  // activate or deactivate. Enforced by the handler (allowedActorKinds); the
+  // managed activate/deactivate routines also re-derive and RAISE it, while the
+  // native routines rely on the handler gate.
+  "DRAFT_ONLY_FOR_MACHINE",
+  // A bundle with no components is not a bill of materials. Request-decidable on
+  // the whole-set composition replace.
+  "MIN_COMPONENTS",
+  // Every component being an add-on leaves nothing that is always in the box.
+  // At least one non-addon component is required. Request-decidable.
+  "ADDON_ONLY_COMPOSITION",
+  // One row per unit per bundle: multiplicity is the quantity, never a repeated
+  // component. Request-decidable on the whole-set replace.
+  "DUPLICATE_COMPONENT",
+  // Creating a bundle whose code is already used is rejected (unique code).
+  "CODE_TAKEN",
+  // A composition entry naming a unit that does not exist is rejected.
+  "COMPONENT_NOT_FOUND",
+  // A component must itself be sellable: active AND sellable on its own. A bundle
+  // must not become the only way an unsellable unit reaches a customer.
+  "COMPONENT_NOT_SELLABLE",
+  // Every component must be priced in the currency of the bundle's price list;
+  // a mixed-currency bill of materials has no single reference total.
+  "COMPONENT_CURRENCY_MISMATCH",
+  // A bundle is never priced above the sum of its parts. Hard refusal, not a
+  // warning: the discount framing is the product, and the kernel allocator
+  // returns the same decision as one comparison.
+  "TARGET_ABOVE_COMPONENT_SUM",
+  // The target cannot cover every component's minimum payable amount.
+  "TARGET_BELOW_FLOOR",
+  // Activation requires an active target price on the bundle.
+  "PRICE_REQUIRED_TO_SELL",
+  // Activation requires a non-empty composition.
+  "COMPOSITION_REQUIRED_TO_SELL",
+  // Target-price changes INSERT a new price row and deactivate the old one; an
+  // existing row is never mutated in place.
+  "APPEND_ONLY_PRICE",
+  // A bundle referenced by an order or a subscription is never hard-deleted;
+  // removal is an archive (status flip).
+  "NO_HARD_DELETE",
+  // Restore is the inverse of archive: it applies only to an ARCHIVED bundle.
+  "RESTORE_REQUIRES_ARCHIVED",
+  // Deactivate (unpublish) applies only to a LIVE bundle.
+  "DEACTIVATE_REQUIRES_ACTIVE",
+  // Only the exploded fulfillment mode has a runtime. The stored column admits
+  // the pre-packed mode so it never has to be widened; the refusal lives here.
+  "FULFILLMENT_MODE_UNSUPPORTED",
+  // A non-empty composition constraint is validated by the injected
+  // CompositionRulesPort; its refusal surfaces under this code.
+  "CONSTRAINT_VALIDATION_FAILED",
+  // Clone reads its source before replaying a fresh draft; a missing source is
+  // rejected before the replay.
+  "CLONE_SOURCE_NOT_FOUND",
+] as const;
+
+export type BundleRuleCode = (typeof BUNDLE_RULE_CODES)[number];
+
+/**
+ * The two target-price codes are NOT re-derived here — they are the kernel
+ * allocator's own failure vocabulary, projected onto this domain's registry.
+ *
+ * Declared as an exhaustive `Record` over `BundleAllocationFailureCode` on
+ * purpose: when `@openlup/core/pricing` learns a new failure code, this object
+ * stops compiling until the domain decides which rule it is. `REFERENCE_TOTAL_ZERO`
+ * means the composition weighed nothing, which is the same condition
+ * `MIN_COMPONENTS` names from the request side.
+ */
+export const BUNDLE_ALLOCATION_RULE_CODE: Record<BundleAllocationFailureCode, BundleRuleCode> = {
+  REFERENCE_TOTAL_ZERO: "MIN_COMPONENTS",
+  TARGET_ABOVE_COMPONENT_SUM: "TARGET_ABOVE_COMPONENT_SUM",
+  TARGET_BELOW_FLOOR: "TARGET_BELOW_FLOOR",
+};
+
+/**
+ * Which rules are decidable from the request alone (pure, pre-flight) and which
+ * are state-dependent and authoritatively enforced by the write routine. This
+ * documents intent and keeps the handler honest about what it can decide before
+ * the write. `CONSTRAINT_VALIDATION_FAILED` is `port`: it is decided by the
+ * injected `CompositionRulesPort`, which is neither the request nor the database.
+ */
+export const BUNDLE_RULE_ENFORCEMENT: Record<BundleRuleCode, "request" | "port" | "rpc"> = {
+  DRAFT_ONLY_FOR_MACHINE: "request",
+  MIN_COMPONENTS: "request",
+  ADDON_ONLY_COMPOSITION: "request",
+  DUPLICATE_COMPONENT: "request",
+  FULFILLMENT_MODE_UNSUPPORTED: "request",
+  CONSTRAINT_VALIDATION_FAILED: "port",
+  CODE_TAKEN: "rpc",
+  COMPONENT_NOT_FOUND: "rpc",
+  COMPONENT_NOT_SELLABLE: "rpc",
+  COMPONENT_CURRENCY_MISMATCH: "rpc",
+  TARGET_ABOVE_COMPONENT_SUM: "rpc",
+  TARGET_BELOW_FLOOR: "rpc",
+  PRICE_REQUIRED_TO_SELL: "rpc",
+  COMPOSITION_REQUIRED_TO_SELL: "rpc",
+  APPEND_ONLY_PRICE: "rpc",
+  NO_HARD_DELETE: "rpc",
+  RESTORE_REQUIRES_ARCHIVED: "rpc",
+  DEACTIVATE_REQUIRES_ACTIVE: "rpc",
+  CLONE_SOURCE_NOT_FOUND: "rpc",
+};
+
+export type BundleActorKind = "human" | "machine";
+
+export type BundleWriteOperation =
+  | "create_draft"
+  | "update_draft"
+  | "set_composition"
+  | "set_target_price"
+  | "archive"
+  | "restore"
+  | "clone_draft"
+  | "activate"
+  | "deactivate";
+
+/** The domain's rule result, projected from the generic kit `RuleResult`. */
+export type BundleRuleResult = { ok: boolean; violations: BundleRuleCode[] };

package/src/catalog/bundleRules.ts

@@ -0,0 +1,153 @@
+import { allocateBundleTargetPrice } from "@openlup/core/pricing";
+import type { BundleComponentInput } from "@openlup/core/pricing";
+import type { CompositionConstraint, CompositionRulesPort } from "@openlup/core/bundle";
+
+import type { BundleRuleBindings } from "./bundleBindings.js";
+import {
+  BUNDLE_ALLOCATION_RULE_CODE,
+  type BundleActorKind,
+  type BundleRuleResult,
+} from "./bundleRuleCodes.js";
+
+/**
+ * Pure, request-checkable bundle write rules.
+ *
+ * Only what is decidable from the request alone lives here. The state-dependent
+ * rules (code uniqueness, component existence/sellability/currency, the target
+ * price against real component prices, the activation preconditions, append-only
+ * pricing, archive-not-delete) are re-derived by the managed write routines.
+ * This layer fast-fails request-checkable violations without replacing those
+ * state checks. Actor-kind enforcement is separate: managed publication routines
+ * independently check it, while native publication relies on the handler gate.
+ */
+
+/** The composition shape the request-layer rules can reason about. */
+export interface BundleCompositionEntry {
+  readonly sku: string;
+  readonly quantity: number;
+  readonly isAddon: boolean;
+}
+
+/** The only fulfillment mode with a runtime. The column admits more; this does not. */
+export const SUPPORTED_BUNDLE_FULFILLMENT_MODES = ["virtual"] as const;
+
+export type SupportedBundleFulfillmentMode = (typeof SUPPORTED_BUNDLE_FULFILLMENT_MODES)[number];
+
+function isSupportedFulfillmentMode(mode: string): boolean {
+  return (SUPPORTED_BUNDLE_FULFILLMENT_MODES as readonly string[]).includes(mode);
+}
+
+/**
+ * The lifecycle/actor gate every operation passes. Machine actors are confined to
+ * drafts: they may compose, price, archive, restore and clone, but neither
+ * activate nor deactivate.
+ */
+export function createBundleWriteRules({ assertActivateNotMachineActor }: Pick<BundleRuleBindings, "assertActivateNotMachineActor">) {
+function evaluateBundleWriteRules(input: {
+  operation: string;
+  actorKind: BundleActorKind;
+}): BundleRuleResult {
+  const violations: BundleRuleResult["violations"] = [];
+
+  const activateViolation = assertActivateNotMachineActor(input);
+  if (activateViolation) violations.push(activateViolation);
+  // `assertActivateNotMachineActor` only knows the publish direction it was written
+  // for. Unpublish is the same class of transition and carries the same code.
+  if (input.operation === "deactivate" && input.actorKind === "machine") {
+    violations.push("DRAFT_ONLY_FOR_MACHINE");
+  }
+
+  return { ok: violations.length === 0, violations };
+}
+
+  return { evaluateBundleWriteRules };
+}
+
+/**
+ * Whole-set composition rules, decidable from the replacement set alone: it must
+ * carry at least one entry, at least one entry that is not an add-on, and no unit
+ * twice (multiplicity is the quantity, never a repeated row).
+ */
+export function evaluateBundleComposition(components: readonly BundleCompositionEntry[]): BundleRuleResult {
+  const violations: BundleRuleResult["violations"] = [];
+
+  if (components.length === 0) violations.push("MIN_COMPONENTS");
+  else if (components.every((component) => component.isAddon)) violations.push("ADDON_ONLY_COMPOSITION");
+
+  const seen = new Set<string>();
+  for (const component of components) {
+    if (seen.has(component.sku)) {
+      violations.push("DUPLICATE_COMPONENT");
+      break;
+    }
+    seen.add(component.sku);
+  }
+
+  return { ok: violations.length === 0, violations };
+}
+
+/** The runtime refusal of every fulfillment mode the stored column admits but no code honours. */
+export function evaluateBundleFulfillmentMode(mode: string): BundleRuleResult {
+  return isSupportedFulfillmentMode(mode)
+    ? { ok: true, violations: [] }
+    : { ok: false, violations: ["FULFILLMENT_MODE_UNSUPPORTED"] };
+}
+
+/**
+ * Project the kernel allocator's decision onto this domain's rule vocabulary.
+ *
+ * The allocator (`@openlup/core/pricing`) owns the arithmetic and the two
+ * refusals a target price can earn; this maps its failure code through the
+ * exhaustive `BUNDLE_ALLOCATION_RULE_CODE` table so the codes cannot drift apart.
+ * It is pure: the caller supplies the component reference prices it already holds.
+ * The authority for a committed write remains the write routine, which holds the
+ * live prices.
+ */
+export function evaluateBundleTargetPrice(input: {
+  components: readonly BundleComponentInput[];
+  targetPriceMinor: number;
+  minimumUnitPayableMinor?: number;
+}): BundleRuleResult {
+  const outcome = allocateBundleTargetPrice({
+    components: input.components,
+    targetPriceMinor: input.targetPriceMinor,
+    ...(input.minimumUnitPayableMinor === undefined
+      ? {}
+      : { minimumUnitPayableMinor: input.minimumUnitPayableMinor }),
+  });
+  // Narrowed by presence rather than by the `ok` literal: the app compiler runs
+  // without strictNullChecks, where a boolean-literal discriminant does not narrow.
+  if (!("code" in outcome)) return { ok: true, violations: [] };
+  return { ok: false, violations: [BUNDLE_ALLOCATION_RULE_CODE[outcome.code]] };
+}
+
+/** An empty envelope means "unconstrained"; there is nothing for the port to decide. */
+export function isEmptyCompositionConstraint(constraint: CompositionConstraint | null | undefined): boolean {
+  return !constraint || constraint.kind.trim() === "";
+}
+
+/**
+ * Delegate a non-empty composition constraint to the injected rules port. The
+ * platform stores the envelope and never interprets it, so this domain does not
+ * either: it asks the adopter's port and reports the refusal under one code.
+ */
+export async function evaluateBundleCompositionConstraint(
+  port: CompositionRulesPort | undefined,
+  input: {
+    readonly components: readonly BundleCompositionEntry[];
+    readonly constraint: CompositionConstraint | null | undefined;
+  },
+): Promise<BundleRuleResult> {
+  if (isEmptyCompositionConstraint(input.constraint) || !port) return { ok: true, violations: [] };
+  const constraint = input.constraint as CompositionConstraint;
+  const outcome = await port.validateComposition({
+    coreLines: input.components
+      .filter((component) => !component.isAddon)
+      .map((component) => ({ variantId: component.sku, qty: component.quantity, isAddon: false })),
+    addonLines: input.components
+      .filter((component) => component.isAddon)
+      .map((component) => ({ variantId: component.sku, qty: component.quantity, isAddon: true })),
+    constraint,
+  });
+  return outcome.ok ? { ok: true, violations: [] } : { ok: false, violations: ["CONSTRAINT_VALIDATION_FAILED"] };
+}

package/src/catalog/catalogDraftStore.ts

@@ -0,0 +1,71 @@
+import {
+  catalogDraftApplyResultSchema,
+  catalogDraftGetQuerySchema,
+  catalogDraftListQuerySchema,
+  catalogDraftPageSchema,
+  catalogDraftRecordSchema,
+  type CatalogDraftRefusal,
+} from "./draftSchemas.js";
+import { CatalogDraftStoreError, type CatalogDraftStorePort } from "./draftPorts.js";
+import type { PgQueryExecutor } from "../data/index.js";
+
+/** Dark owner-only storage. Composition must verify the operator before use. */
+export function createPostgresCatalogDraftStore(client: PgQueryExecutor): CatalogDraftStorePort {
+  async function call(sql: string, values: unknown[]): Promise<unknown> {
+    try {
+      const { rows } = await client.query(sql, values);
+      if (rows.length !== 1 || !("result" in rows[0]!)) {
+        throw new CatalogDraftStoreError({ outcome: "dependency_unavailable", reason: "invalid_store_response" });
+      }
+      return rows[0]!.result;
+    } catch (error) {
+      if (error instanceof CatalogDraftStoreError) throw error;
+      throw new CatalogDraftStoreError(refusal(error));
+    }
+  }
+  return {
+    async apply(request) {
+      try {
+        const result = await call(
+          "SELECT public.catalog_draft_apply($1::text, $2::text, $3::text) AS result",
+          [request.canonicalCommand, request.fingerprint, request.actorId],
+        );
+        const parsed = catalogDraftApplyResultSchema.safeParse(result);
+        if (!parsed.success) return { outcome: "dependency_unavailable", reason: "invalid_store_response" };
+        return parsed.data;
+      } catch (error) {
+        return error instanceof CatalogDraftStoreError ? error.refusal : refusal(error);
+      }
+    },
+    async get(query) {
+      const input = catalogDraftGetQuerySchema.safeParse(query);
+      if (!input.success) throw new CatalogDraftStoreError({ outcome: "validation_issue", reason: "invalid_get_query" });
+      const result = await call(
+        "SELECT public.catalog_draft_get($1::uuid, $2::integer, $3::text) AS result",
+        [input.data.draftId, input.data.revision ?? null, input.data.commandKey ?? null],
+      );
+      const parsed = catalogDraftRecordSchema.nullable().safeParse(result);
+      if (!parsed.success) throw new CatalogDraftStoreError({ outcome: "dependency_unavailable", reason: "invalid_store_response" });
+      return parsed.data;
+    },
+    async list(query) {
+      const input = catalogDraftListQuerySchema.safeParse(query);
+      if (!input.success) throw new CatalogDraftStoreError({ outcome: "validation_issue", reason: "invalid_list_query" });
+      const result = await call(
+        "SELECT public.catalog_draft_list($1::uuid, $2::integer) AS result",
+        [input.data.afterDraftId ?? null, input.data.limit],
+      );
+      const parsed = catalogDraftPageSchema.safeParse(result);
+      if (!parsed.success) throw new CatalogDraftStoreError({ outcome: "dependency_unavailable", reason: "invalid_store_response" });
+      return parsed.data;
+    },
+  };
+}
+
+function refusal(error: unknown): CatalogDraftRefusal {
+  const code = error && typeof error === "object" && "code" in error ? error.code : null;
+  if (code === "42501") return { outcome: "unauthorized", reason: "operator_required" };
+  if (code === "22023") return { outcome: "validation_issue", reason: "invalid_store_request" };
+  if (code === "23505") return { outcome: "conflict", reason: "identity_reserved" };
+  return { outcome: "dependency_unavailable", reason: "store_unavailable" };
+}