@porulle/core 0.1.0 → 0.6.0

package/dist/modules/promotions/service.js

@@ -4,6 +4,9 @@ import { createHookContext } from "../../kernel/hooks/create-context.js";
 import { Err, Ok } from "../../kernel/result.js";
 import { createLogger } from "../../utils/logger.js";
 import { resolveOrgId } from "../../auth/org.js";
+// PromotionType is derived from the zod enum (single source of truth) in
+// ./schemas.js; re-export it here for backwards-compatible imports.
+import { promotionTypeEnum } from "./schemas.js";
 function hookContext(actor, services, database, tx) {
     return createHookContext({
         actor,
@@ -74,15 +77,8 @@ export class PromotionService {
         if (input.value < 0) {
             return Err(new CommerceValidationError("Promotion value cannot be negative."));
         }
-        // Validate promotion type
-        const validTypes = [
-            "percentage_off_order",
-            "fixed_off_order",
-            "percentage_off_item",
-            "fixed_off_item",
-            "free_shipping",
-            "buy_x_get_y",
-        ];
+        // Validate promotion type against the single-source enum
+        const validTypes = promotionTypeEnum.options;
         if (!validTypes.includes(input.type)) {
             return Err(new CommerceValidationError(`Invalid promotion type "${input.type}". Must be one of: ${validTypes.join(", ")}`));
         }
@@ -131,6 +127,75 @@ export class PromotionService {
         await runAfterHooks(afterHooks, promotion, updated, "update", hctx);
         return Ok(updated);
     }
+    /**
+     * Edit any subset of a promotion's fields. Validated the same way create is
+     * (value bounds, type enum, code uniqueness). Only provided keys are written.
+     */
+    async update(orgId, id, input, actor, ctx) {
+        const existing = await this.repo.findById(orgId, id, ctx);
+        if (!existing) {
+            return Err(new CommerceNotFoundError("Promotion not found."));
+        }
+        if (input.value !== undefined && input.value < 0) {
+            return Err(new CommerceValidationError("Promotion value cannot be negative."));
+        }
+        if (input.type !== undefined) {
+            const validTypes = promotionTypeEnum.options;
+            if (!validTypes.includes(input.type)) {
+                return Err(new CommerceValidationError(`Invalid promotion type "${input.type}". Must be one of: ${validTypes.join(", ")}`));
+            }
+        }
+        let normalizedCode;
+        if (input.code !== undefined) {
+            normalizedCode = input.code ? input.code.trim().toUpperCase() : null;
+            if (normalizedCode) {
+                const other = await this.repo.findByCode(orgId, normalizedCode, ctx);
+                if (other && other.id !== id) {
+                    return Err(new CommerceValidationError(`Promotion code ${normalizedCode} already exists.`));
+                }
+            }
+        }
+        const patch = {};
+        if (input.name !== undefined)
+            patch.name = input.name;
+        if (input.type !== undefined)
+            patch.type = input.type;
+        if (input.value !== undefined)
+            patch.value = roundMoney(input.value);
+        if (input.isAutomatic !== undefined)
+            patch.isAutomatic = input.isAutomatic;
+        if (input.isActive !== undefined)
+            patch.isActive = input.isActive;
+        if (input.priority !== undefined)
+            patch.priority = input.priority;
+        if (input.conditions !== undefined)
+            patch.conditions = input.conditions;
+        if (input.metadata !== undefined)
+            patch.metadata = input.metadata;
+        if (normalizedCode !== undefined)
+            patch.code = normalizedCode;
+        if (input.buyQuantity !== undefined)
+            patch.buyQuantity = input.buyQuantity;
+        if (input.getQuantity !== undefined)
+            patch.getQuantity = input.getQuantity;
+        if (input.usageLimitTotal !== undefined)
+            patch.usageLimitTotal = input.usageLimitTotal;
+        if (input.usageLimitPerCustomer !== undefined) {
+            patch.usageLimitPerCustomer = input.usageLimitPerCustomer;
+        }
+        if (input.validFrom !== undefined)
+            patch.validFrom = input.validFrom;
+        if (input.validUntil !== undefined)
+            patch.validUntil = input.validUntil;
+        const updated = await this.repo.update(id, patch, ctx);
+        if (!updated) {
+            return Err(new CommerceNotFoundError("Promotion not found."));
+        }
+        const afterHooks = this.deps.hooks.resolve("promotions.afterUpdate");
+        const hctx = hookContext(actor ?? ctx?.actor ?? null, this.deps.services, this.deps.database, ctx?.tx ?? null);
+        await runAfterHooks(afterHooks, existing, updated, "update", hctx);
+        return Ok(updated);
+    }
     async list(filter, actor, ctx) {
         const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
         const all = await this.repo.findAll(orgId, ctx);

package/dist/modules/search/repository/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/search/repository/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,WAAW,gBAAgB;IAE/B,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/search/repository/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/modules/shipping/repository/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/shipping/repository/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,WAAW,kBAAkB;IAEjC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/shipping/repository/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/modules/tax/repository/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/tax/repository/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,WAAW,aAAa;IAE5B,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/tax/repository/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/runtime/client-ip.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Client-IP resolution for rate limiting.
+ *
+ * The Node default reads `c.req.raw.socket.remoteAddress` — which is always
+ * undefined on edge runtimes (Cloudflare Workers, Deno Deploy, Vercel Edge),
+ * collapsing every client onto a single rate-limit key (a trivial DoS). Edge
+ * deployments inject `runtime.getClientIp` to read the platform header instead
+ * (CF: `cf-connecting-ip`, Vercel Edge: `x-real-ip`, Fly: `fly-client-ip`).
+ */
+export interface ClientIpContext {
+    req: {
+        raw: unknown;
+        header(name: string): string | undefined;
+    };
+}
+export type ClientIpResolver = (c: ClientIpContext) => string;
+export interface RuntimeConfig {
+    /** Resolve the client IP from the request (used as the rate-limit key). */
+    getClientIp?: ClientIpResolver;
+    /** Direct-connection IP of the trusted reverse proxy (Node default only). */
+    trustedProxyIp?: string;
+}
+/**
+ * Build the client-IP resolver. Prefers an injected `runtime.getClientIp`;
+ * otherwise falls back to the Node behavior (socket address, trusting
+ * X-Forwarded-For only from `trustedProxyIp` / `TRUSTED_PROXY_IP`).
+ */
+export declare function createClientIpResolver(config: {
+    runtime?: RuntimeConfig;
+}): ClientIpResolver;
+//# sourceMappingURL=client-ip.d.ts.map

package/dist/runtime/client-ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.d.ts","sourceRoot":"","sources":["../../src/runtime/client-ip.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACjE;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,EAAE,eAAe,KAAK,MAAM,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,GAAG,gBAAgB,CAkBnB"}

package/dist/runtime/client-ip.js

@@ -0,0 +1,31 @@
+/**
+ * Client-IP resolution for rate limiting.
+ *
+ * The Node default reads `c.req.raw.socket.remoteAddress` — which is always
+ * undefined on edge runtimes (Cloudflare Workers, Deno Deploy, Vercel Edge),
+ * collapsing every client onto a single rate-limit key (a trivial DoS). Edge
+ * deployments inject `runtime.getClientIp` to read the platform header instead
+ * (CF: `cf-connecting-ip`, Vercel Edge: `x-real-ip`, Fly: `fly-client-ip`).
+ */
+/**
+ * Build the client-IP resolver. Prefers an injected `runtime.getClientIp`;
+ * otherwise falls back to the Node behavior (socket address, trusting
+ * X-Forwarded-For only from `trustedProxyIp` / `TRUSTED_PROXY_IP`).
+ */
+export function createClientIpResolver(config) {
+    if (config.runtime?.getClientIp) {
+        return config.runtime.getClientIp;
+    }
+    const trustedProxyIp = config.runtime?.trustedProxyIp ??
+        (typeof process !== "undefined" ? process.env?.TRUSTED_PROXY_IP : undefined);
+    return (c) => {
+        const raw = c.req.raw;
+        const remoteAddress = raw?.socket?.remoteAddress;
+        if (trustedProxyIp && remoteAddress === trustedProxyIp) {
+            const xff = c.req.header("x-forwarded-for")?.split(",")[0]?.trim();
+            if (xff)
+                return xff;
+        }
+        return remoteAddress ?? "unknown";
+    };
+}

package/dist/runtime/server.d.ts

@@ -32,6 +32,10 @@ export declare function createServer(config: CommerceConfig): Promise<{
     kernel: import("./kernel-types.js").Kernel;
     logger: Logger;
     commerce: CommerceInstance;
+    runJobs: (queue?: string, limit?: number) => Promise<{
+        processed: number;
+        failed: number;
+    }>;
 }>;
 export {};
 //# sourceMappingURL=server.d.ts.map

package/dist/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAMzD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAMvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;GAoZxD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAMzD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAMvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAwVxB,MAAM,UAAU,MAAM;;;;GAgFtD"}

package/dist/runtime/server.js

@@ -4,6 +4,7 @@ import { csrf } from "hono/csrf";
 import { bodyLimit } from "hono/body-limit";
 import { rateLimiter } from "hono-rate-limiter";
 import { createHash } from "node:crypto";
+import { createClientIpResolver } from "./client-ip.js";
 import { authMiddleware } from "../auth/middleware.js";
 import { createRestRoutes } from "../interfaces/rest/index.js";
 import { createCustomerPortalRoutes } from "../interfaces/rest/customer-portal.js";
@@ -64,12 +65,12 @@ export async function createServer(config) {
     if (config.auth?.enableDevKey !== undefined) {
         throw new Error("FATAL: auth.enableDevKey has been removed. " +
             "Use 'bunx @porulle/cli api-key create --scope admin' to generate a real API key. " +
-            "See RFC-050: https://github.com/octalpixel/unified-commerce/blob/main/RFC-050-AUTH-KEY-SCOPING.md");
+            "See https://github.com/asyncdotengineering/porulle/blob/main/SECURITY.md for the auth/key scoping rationale.");
     }
     if (config.auth?.devKey !== undefined) {
         throw new Error("FATAL: auth.devKey has been removed. " +
             "Use 'bunx @porulle/cli api-key create --scope admin' to generate a real API key. " +
-            "See RFC-050: https://github.com/octalpixel/unified-commerce/blob/main/RFC-050-AUTH-KEY-SCOPING.md");
+            "See https://github.com/asyncdotengineering/porulle/blob/main/SECURITY.md for the auth/key scoping rationale.");
     }
     // exposed for direct unit testing — see test/server-edge-runtime.test.ts
     // ─── Process Crash Handlers (F4) ─────────────────────────────────────
@@ -143,28 +144,30 @@ export async function createServer(config) {
             : (process.env.NODE_ENV === "production" ? [] : ["http://localhost:*"]),
     }));
     // ─── Body Size Limit (F6) ──────────────────────────────────────────
-    app.use("*", bodyLimit({
+    // Media uploads (phone photos are 3–8MB) get their own larger limit and are
+    // exempt from the global 1MB limit. Everything else stays at 1MB.
+    const mediaMaxUploadSize = config.media?.maxUploadSize ?? 10 * 1024 * 1024;
+    const MEDIA_UPLOAD_PATH = "/api/media/upload";
+    app.use(MEDIA_UPLOAD_PATH, bodyLimit({
+        maxSize: mediaMaxUploadSize,
+        onError: (c) => c.json({
+            error: { code: "FILE_TOO_LARGE", message: `Upload exceeds the ${mediaMaxUploadSize}-byte limit.` },
+        }, 413),
+    }));
+    const globalBodyLimit = bodyLimit({
         maxSize: 1024 * 1024, // 1 MB default
         onError: (c) => c.json({
             error: { code: "PAYLOAD_TOO_LARGE", message: "Request body exceeds 1MB limit." },
         }, 413),
-    }));
+    });
+    app.use("*", (c, next) => c.req.path === MEDIA_UPLOAD_PATH ? next() : globalBodyLimit(c, next));
     // ─── Rate Limiting (F1) ──────────────────────────────────────────────
-    // Trust X-Forwarded-For ONLY from a known reverse proxy IP.
-    // Set TRUSTED_PROXY_IP env var to the proxy's IP (e.g., "127.0.0.1").
-    const trustedProxyIp = process.env.TRUSTED_PROXY_IP;
+    // Client IP drives the rate-limit key. Defaults to the Node socket address
+    // (trusting X-Forwarded-For only from a known proxy via config.runtime
+    // .trustedProxyIp / TRUSTED_PROXY_IP); edge runtimes inject
+    // config.runtime.getClientIp to read the platform header instead.
     const signInEmailRateKeyCache = new WeakMap();
-    const getClientIp = (c) => {
-        const raw = c.req.raw;
-        const remoteAddress = raw.socket?.remoteAddress;
-        // Only trust X-Forwarded-For when the direct connection is from a trusted proxy
-        if (trustedProxyIp && remoteAddress === trustedProxyIp) {
-            const xff = c.req.header("x-forwarded-for")?.split(",")[0]?.trim();
-            if (xff)
-                return xff;
-        }
-        return remoteAddress ?? "unknown";
-    };
+    const getClientIp = createClientIpResolver(config);
     const keyGenerator = getClientIp;
     app.use("/api/auth/*", rateLimiter({
         windowMs: 60 * 1000,
@@ -394,5 +397,18 @@ export async function createServer(config) {
         const rewritten = rewriteCommerceAliasRequest(req, config.entities);
         return dispatchFetch(rewritten, env, executionCtx);
     });
-    return { app, kernel, logger, commerce };
+    // `runJobs` triggers one job-runner tick. On Cloudflare Workers, call it
+    // from `scheduled()` so cron triggers drive the queue without an in-process
+    // setInterval (which can't outlive a request on Workers):
+    //
+    //   // wrangler.toml
+    //   [triggers]
+    //   crons = ["*/5 * * * *"]
+    //
+    //   // worker.ts
+    //   export default {
+    //     fetch: (req, env, ctx) => server.app.fetch(req, env, ctx),
+    //     scheduled: (_event, env, ctx) => ctx.waitUntil(server.runJobs()),
+    //   };
+    return { app, kernel, logger, commerce, runJobs };
 }

package/dist/test-utils/create-plugin-test-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-plugin-test-app.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-plugin-test-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAenD;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE;QACT,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,GAAG,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,EAAE,EAAE,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,eAAe,GAAE,OAAO,CAAC,cAAc,CAAM,GAC5C,OAAO,CAAC,aAAa,CAAC,CA+ExB"}
+{"version":3,"file":"create-plugin-test-app.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-plugin-test-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAgBnD;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE;QACT,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,GAAG,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAC7B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,EAAE,EAAE,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,eAAe,GAAE,OAAO,CAAC,cAAc,CAAM,GAC5C,OAAO,CAAC,aAAa,CAAC,CAgFxB"}

package/dist/test-utils/create-plugin-test-app.js

@@ -21,6 +21,7 @@ import { createRequire } from "node:module";
 import { createTestConfig } from "./create-test-config.js";
 import { createKernel } from "../runtime/kernel.js";
 import { buildSchema } from "../kernel/database/migrate.js";
+import { unwrapDb } from "../kernel/database/adapter.js";
 import { ensureDefaultOrg } from "../auth/org.js";
 import { mapErrorToStatus } from "../kernel/error-mapper.js";
 // drizzle-kit/api uses CJS internally; createRequire provides ESM compat.
@@ -46,7 +47,9 @@ export async function createPluginTestApp(plugin, configOverrides = {}) {
     //    Diffs current DB state against pgTable definitions, generates DDL, applies it.
     //    On fresh PGlite: creates all tables. On existing DB: creates only missing tables.
     const drizzleKit = require("drizzle-kit/api");
-    const { apply } = await drizzleKit.pushSchema(mergedSchema, kernel.database.db);
+    const { apply } = await drizzleKit.pushSchema(mergedSchema, 
+    // drizzle-kit needs the native driver result shape; unwrap the normalized db.
+    unwrapDb(kernel.database.db));
     await apply();
     // Ensure the default organization exists for plugin tests
     await ensureDefaultOrg(kernel.database.db);

package/dist/test-utils/test-actors.d.ts

@@ -1,8 +1,9 @@
 import type { Actor } from "../auth/types.js";
 /**
  * Organization ID used in test fixtures. Tests use the deprecated DEFAULT_ORG_ID
- * because ensureDefaultOrg() creates this org in test setup. When RFC-060 Phase 6
- * removes DEFAULT_ORG_ID, test setup will create a real org via Better Auth API.
+ * because ensureDefaultOrg() creates this org during test setup. When
+ * DEFAULT_ORG_ID is removed, test setup will create a real org via the
+ * Better Auth API instead.
  */
 export declare const TEST_ORG_ID = "org_default";
 /** Admin with wildcard permissions. Use for setup operations in beforeAll. */

package/dist/test-utils/test-actors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-actors.d.ts","sourceRoot":"","sources":["../../src/test-utils/test-actors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C;;;;GAIG;AACH,eAAO,MAAM,WAAW,gBAAiB,CAAC;AAE1C,8EAA8E;AAC9E,eAAO,MAAM,cAAc,EAAE,KAS5B,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,cAAc,EAAE,KAY5B,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,KAS/B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,eAAe,EAAE,KAS7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIjE"}
+{"version":3,"file":"test-actors.d.ts","sourceRoot":"","sources":["../../src/test-utils/test-actors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,gBAAiB,CAAC;AAE1C,8EAA8E;AAC9E,eAAO,MAAM,cAAc,EAAE,KAS5B,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,cAAc,EAAE,KAY5B,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,KAS/B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,eAAe,EAAE,KAS7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIjE"}

package/dist/test-utils/test-actors.js

@@ -1,8 +1,9 @@
 import { DEFAULT_ORG_ID } from "../auth/org.js";
 /**
  * Organization ID used in test fixtures. Tests use the deprecated DEFAULT_ORG_ID
- * because ensureDefaultOrg() creates this org in test setup. When RFC-060 Phase 6
- * removes DEFAULT_ORG_ID, test setup will create a real org via Better Auth API.
+ * because ensureDefaultOrg() creates this org during test setup. When
+ * DEFAULT_ORG_ID is removed, test setup will create a real org via the
+ * Better Auth API instead.
  */
 export const TEST_ORG_ID = DEFAULT_ORG_ID;
 /** Admin with wildcard permissions. Use for setup operations in beforeAll. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.1.0",
+  "version": "0.6.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -35,15 +35,8 @@
       "types": "./src/drizzle.ts"
     }
   },
-  "scripts": {
-    "generate:plugins": "node ./scripts/generate-plugin-types.mjs",
-    "check:store-guard": "node ./scripts/check-store-guard.mjs",
-    "build": "rm -rf dist tsconfig.build.tsbuildinfo && npm run generate:plugins && npm run check:store-guard && tsc -p tsconfig.build.json",
-    "check-types": "npm run generate:plugins && npm run check:store-guard && tsc --noEmit",
-    "lint": "eslint . --max-warnings 1000",
-    "test": "vitest run"
-  },
   "dependencies": {
+    "@better-auth/api-key": "^1.3.8",
     "@better-auth/drizzle-adapter": "^1.3.8",
     "@hono/zod-openapi": "^1.2.2",
     "@scalar/hono-api-reference": "^0.10.5",
@@ -56,16 +49,15 @@
     "zod": "^4.1.11"
   },
   "devDependencies": {
-    "@better-auth/api-key": "^1.5.4",
     "@electric-sql/pglite": "^0.3.15",
-    "@repo/eslint-config": "*",
-    "@repo/typescript-config": "*",
     "@types/node": "^25.5.0",
     "@vitest/coverage-v8": "^3.2.4",
     "drizzle-kit": "^0.31.9",
     "eslint": "^9.39.1",
     "typescript": "5.9.2",
-    "vitest": "^3.2.4"
+    "vitest": "^3.2.4",
+    "@porulle/eslint-config": "0.1.0",
+    "@porulle/typescript-config": "0.1.0"
   },
   "publishConfig": {
     "access": "public"
@@ -85,5 +77,13 @@
     "url": "git+https://github.com/asyncdotengineering/porulle.git",
     "directory": "packages/core"
   },
-  "author": "Porulle contributors"
-}
+  "author": "Porulle contributors",
+  "scripts": {
+    "generate:plugins": "node ./scripts/generate-plugin-types.mjs",
+    "check:store-guard": "node ./scripts/check-store-guard.mjs",
+    "build": "rm -rf dist tsconfig.build.tsbuildinfo && npm run generate:plugins && npm run check:store-guard && tsc -p tsconfig.build.json",
+    "check-types": "npm run generate:plugins && npm run check:store-guard && tsc --noEmit",
+    "lint": "eslint . --max-warnings 1000",
+    "test": "vitest run"
+  }
+}

package/src/auth/middleware.ts

@@ -146,11 +146,28 @@ export function authMiddleware(
       auth.api.verifyApiKey
     ) {
       try {
+        // Resolve the key's configId from its prefix. Better Auth's apiKey
+        // plugin throws "No default api-key configuration found" when named
+        // scopes are configured and none is `default`/unset — and verifyApiKey
+        // only resolves a named scope (and enforces its configId match) when
+        // the configId is forwarded. Match the key's prefix to a configured
+        // scope so named-scope keys authenticate instead of silently 401-ing.
+        let configId: string | undefined;
+        const scopes = config.auth?.apiKeyScopes;
+        if (scopes) {
+          for (const [scopeId, scope] of Object.entries(scopes)) {
+            if (scope.prefix && apiKeyHeader.startsWith(scope.prefix)) {
+              configId = scopeId;
+              break;
+            }
+          }
+        }
+
         // Better Auth server-side calls require { body: { ... } } wrapper.
         // Returns { valid, error, key: Omit<ApiKey,"key"> | null }.
         // See: https://better-auth.com/docs/plugins/api-key/reference
         const result = await auth.api.verifyApiKey({
-          body: { key: apiKeyHeader },
+          body: { key: apiKeyHeader, ...(configId ? { configId } : {}) },
         });
         if (result?.valid && result.key) {
           const apiKey = result.key as Record<string, unknown>;

package/src/config/define-config.ts

@@ -3,6 +3,7 @@ import type { CommerceConfig, DefineConfigInput } from "./types.js";
 import type { TaskDefinition } from "../kernel/jobs/types.js";
 import { defaultKernelJobTasks } from "../kernel/jobs/builtin-job-tasks.js";
 import { _resetRegisteredPlugins } from "../kernel/plugin/manifest.js";
+import { noopStorageAdapter } from "../modules/media/noop-adapter.js";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -77,5 +78,11 @@ export async function defineConfig(
     jobs: mergeBuiltinJobTasks(config.jobs),
   };
 
+  // Storage is opt-in: default to a no-op adapter so catalog-only deployments
+  // boot with zero storage config. A real adapter (local/S3/R2) enables media.
+  if (!config.storage) {
+    config = { ...config, storage: noopStorageAdapter };
+  }
+
   return Object.freeze(config);
 }

package/src/config/types.ts

@@ -306,9 +306,21 @@ export interface CommerceConfig {
   shipping?: ShippingConfig;
   payments?: PaymentAdapter[];
   storage?: StorageAdapter;
+  /**
+   * Runtime/edge overrides. `getClientIp` lets edge deployments (Workers,
+   * Vercel Edge, Fly) resolve the client IP from the platform header instead
+   * of the Node socket. Defaults to Node behavior.
+   */
+  runtime?: import("../runtime/client-ip.js").RuntimeConfig;
   media?: {
     allowedMimeTypes?: string[];
     allowSvg?: boolean;
+    /**
+     * Max request body size (bytes) for `POST /api/media/upload`. Phone photos
+     * are typically 3–8MB, so this path is exempt from the global 1MB body
+     * limit. Defaults to 10MB.
+     */
+    maxUploadSize?: number;
   };
   email?: {
     send(input: {

package/src/hooks/checkout.ts

@@ -596,14 +596,14 @@ export const sendConfirmation: AfterHook<OrderResult> = async ({ result, context
 };
 
 /**
- * Analytics event recording — no-op since RFC-006.
+ * Analytics event recording — intentional no-op.
  *
  * The DrizzleAnalyticsAdapter queries source tables (orders, inventory)
- * directly via SQL. No separate event recording is needed.
- * Kept as an export for backwards compatibility with checkout route.
+ * directly via SQL, so no separate event recording is needed. The export
+ * is preserved for backwards compatibility with checkout route imports.
  */
 export const recordAnalyticsEvent: AfterHook<OrderResult> = async () => {
-  // No-op: source tables ARE the analytics events (RFC-006)
+  // No-op: source tables ARE the analytics events.
 };
 
 /**

package/src/index.ts

@@ -18,6 +18,8 @@ export { router } from "./interfaces/rest/router.js";
 export { webhookRouter, type WebhookRouterResult } from "./interfaces/rest/webhook-router.js";
 export { isPrivateUrl, isPrivateIp } from "./modules/webhooks/ssrf-guard.js";
 export { createServer } from "./runtime/server.js";
+export { createClientIpResolver } from "./runtime/client-ip.js";
+export type { ClientIpResolver, ClientIpContext, RuntimeConfig } from "./runtime/client-ip.js";
 export { createLogger } from "./runtime/logger.js";
 export type { Logger as PinoLogger } from "./runtime/logger.js";
 export { setupGracefulShutdown } from "./runtime/shutdown.js";
@@ -125,6 +127,7 @@ export type {
   PaymentWebhookEvent,
 } from "./modules/payments/adapter.js";
 export type { StorageAdapter } from "./modules/media/adapter.js";
+export { noopStorageAdapter } from "./modules/media/noop-adapter.js";
 export type {
   SearchAdapter,
   SearchDocument,
@@ -154,9 +157,23 @@ export type {
   TaxVoidParams,
 } from "./modules/tax/adapter.js";
 
-export { getSchema, buildSchema, getTableNames } from "./kernel/database/migrate.js";
+export {
+  getSchema,
+  buildSchema,
+  getTableNames,
+  getSchemaFiles,
+  pushSchema,
+} from "./kernel/database/migrate.js";
 export { consoleEmailAdapter } from "./adapters/console-email.js";
 
+export { promotionTypeEnum, type PromotionType } from "./modules/promotions/schemas.js";
+
+export { parseJson, err } from "./interfaces/rest/parse-json.js";
+export type { ValidationIssue, ErrorDetails } from "./interfaces/rest/parse-json.js";
+
+export { auditMiddleware } from "./interfaces/rest/audit-middleware.js";
+export type { AuditVars } from "./interfaces/rest/audit-middleware.js";
+
 export { runCompensationChain } from "./kernel/compensation/executor.js";
 export type {
   CompensationContext,