@porulle/core 0.1.0

package/dist/auth/strict-org-resolution.d.ts

@@ -0,0 +1,4 @@
+import type { CommerceConfig } from "../config/types.js";
+export declare function setBootStrictOrgResolution(strict: boolean): void;
+export declare function isStrictOrgResolution(config?: CommerceConfig | null): boolean;
+//# sourceMappingURL=strict-org-resolution.d.ts.map

package/dist/auth/strict-org-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-org-resolution.d.ts","sourceRoot":"","sources":["../../src/auth/strict-org-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIzD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAEhE;AAED,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO,CAK7E"}

package/dist/auth/strict-org-resolution.js

@@ -0,0 +1,13 @@
+let _bootStrictOrgResolution = false;
+export function setBootStrictOrgResolution(strict) {
+    _bootStrictOrgResolution = strict;
+}
+export function isStrictOrgResolution(config) {
+    if (config?.auth?.strictOrgResolution === true)
+        return true;
+    if (process.env.STRICT_ORG_RESOLUTION === "true")
+        return true;
+    if ((config === undefined || config === null) && _bootStrictOrgResolution)
+        return true;
+    return false;
+}

package/dist/auth/system-actor.d.ts

@@ -0,0 +1,7 @@
+import type { Actor } from "./types.js";
+/**
+ * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
+ * System actors have full permissions and are scoped to a specific organization.
+ */
+export declare function createSystemActor(orgId?: string): Actor;
+//# sourceMappingURL=system-actor.d.ts.map

package/dist/auth/system-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-actor.d.ts","sourceRoot":"","sources":["../../src/auth/system-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,MAAuB,GAAG,KAAK,CAWvE"}

package/dist/auth/system-actor.js

@@ -0,0 +1,17 @@
+import { DEFAULT_ORG_ID } from "./org.js";
+/**
+ * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
+ * System actors have full permissions and are scoped to a specific organization.
+ */
+export function createSystemActor(orgId = DEFAULT_ORG_ID) {
+    return {
+        type: "api_key",
+        userId: "system:internal",
+        email: null,
+        name: "System",
+        vendorId: null,
+        organizationId: orgId,
+        role: "system",
+        permissions: ["*:*"],
+    };
+}

package/dist/auth/types.d.ts

@@ -0,0 +1,11 @@
+export interface Actor {
+    type: "user" | "api_key";
+    userId: string;
+    email: string | null;
+    name: string;
+    vendorId: string | null;
+    organizationId: string | null;
+    role: string;
+    permissions: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB"}

package/dist/auth/types.js

@@ -0,0 +1 @@
+export {};

package/dist/config/defaults.d.ts

@@ -0,0 +1,3 @@
+import type { CommerceConfig } from "./types.js";
+export declare const defaultConfig: Partial<CommerceConfig>;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/config/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,cAAc,CAkFjD,CAAC"}

package/dist/config/defaults.js

@@ -0,0 +1,83 @@
+export const defaultConfig = {
+    version: "0.0.1",
+    auth: {
+        requireEmailVerification: true,
+        sessionDuration: 60 * 60 * 24 * 7,
+        twoFactor: { enabled: false },
+        apiKeys: { enabled: false },
+        posPin: { enabled: false },
+        apiKeyScopes: {
+            compensation_admin: {
+                prefix: "uc_cfadm_",
+                description: "List and resolve compensation step failures",
+                permissions: { compensation: ["admin"] },
+            },
+        },
+        roles: {
+            owner: { permissions: ["*:*"] },
+            admin: { permissions: ["*:*", "compensation:admin"] },
+            manager: {
+                permissions: [
+                    "catalog:create",
+                    "catalog:update",
+                    "catalog:delete",
+                    "catalog:read",
+                    "inventory:read",
+                    "inventory:adjust",
+                    "orders:read",
+                    "orders:update",
+                    "cart:create",
+                    "cart:update",
+                    "customers:read:self",
+                    "customers:update:self",
+                ],
+            },
+            customer: {
+                permissions: [
+                    "catalog:read",
+                    "cart:create",
+                    "cart:read",
+                    "cart:update",
+                    "orders:create",
+                    "orders:read:own",
+                    "customers:read:self",
+                    "customers:update:self",
+                ],
+            },
+        },
+        customerPermissions: [
+            "catalog:read",
+            "cart:create",
+            "cart:read",
+            "cart:update",
+            "orders:create",
+            "orders:read:own",
+            "customers:read:self",
+            "customers:update:self",
+        ],
+    },
+    cart: {
+        ttlMinutes: 60 * 24 * 7,
+        hooks: {},
+    },
+    checkout: {
+        hooks: {
+            beforeCreate: [],
+            afterCreate: [],
+        },
+    },
+    orders: {
+        hooks: {
+            beforeCreate: [],
+            afterCreate: [],
+            beforeStatusChange: [],
+            afterStatusChange: [],
+            beforeDelete: [],
+        },
+    },
+    inventory: {
+        hooks: {
+            afterAdjust: [],
+        },
+    },
+};

package/dist/config/define-config.d.ts

@@ -0,0 +1,10 @@
+import type { CommerceConfig, DefineConfigInput } from "./types.js";
+/**
+ * Builds the final CommerceConfig by:
+ * 1. Merging user input with defaults
+ * 2. Applying all plugins (each is a config transform function)
+ * 3. Merging built-in job task definitions (user tasks override by slug)
+ * 4. Freezing the result to prevent runtime mutation
+ */
+export declare function defineConfig(input: DefineConfigInput): Promise<CommerceConfig>;
+//# sourceMappingURL=define-config.d.ts.map

package/dist/config/define-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-config.d.ts","sourceRoot":"","sources":["../../src/config/define-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgDpE;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,cAAc,CAAC,CAsBzB"}

package/dist/config/define-config.js

@@ -0,0 +1,64 @@
+import { defaultConfig } from "./defaults.js";
+import { defaultKernelJobTasks } from "../kernel/jobs/builtin-job-tasks.js";
+import { _resetRegisteredPlugins } from "../kernel/plugin/manifest.js";
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function mergeBuiltinJobTasks(jobs) {
+    const userTasks = jobs?.tasks ?? [];
+    const bySlug = new Map();
+    for (const t of defaultKernelJobTasks) {
+        bySlug.set(t.slug, t);
+    }
+    for (const t of userTasks) {
+        bySlug.set(t.slug, t);
+    }
+    return {
+        ...(jobs ?? {}),
+        tasks: Array.from(bySlug.values()),
+    };
+}
+function merge(base, next) {
+    const output = {
+        ...base,
+    };
+    for (const [key, value] of Object.entries(next)) {
+        if (value === undefined)
+            continue;
+        const baseValue = output[key];
+        if (isRecord(value) &&
+            isRecord(baseValue)) {
+            output[key] = merge(baseValue, value);
+        }
+        else {
+            output[key] = value;
+        }
+    }
+    return output;
+}
+/**
+ * Builds the final CommerceConfig by:
+ * 1. Merging user input with defaults
+ * 2. Applying all plugins (each is a config transform function)
+ * 3. Merging built-in job task definitions (user tasks override by slug)
+ * 4. Freezing the result to prevent runtime mutation
+ */
+export async function defineConfig(input) {
+    let config = merge(defaultConfig, input);
+    // Merge top-level `schema` into `customSchemas` before plugins run
+    if (config.schema?.length) {
+        config = {
+            ...config,
+            customSchemas: [...(config.customSchemas ?? []), ...config.schema],
+        };
+    }
+    _resetRegisteredPlugins();
+    for (const plugin of config.plugins ?? []) {
+        config = await plugin(config);
+    }
+    config = {
+        ...config,
+        jobs: mergeBuiltinJobTasks(config.jobs),
+    };
+    return Object.freeze(config);
+}

package/dist/config/types.d.ts

@@ -0,0 +1,412 @@
+import type { Hono, MiddlewareHandler } from "hono";
+import type { Actor } from "../auth/types.js";
+import type { BeforeHook, AfterHook } from "../kernel/hooks/types.js";
+import type { PaymentAdapter } from "../modules/payments/adapter.js";
+import type { StorageAdapter } from "../modules/media/adapter.js";
+import type { Kernel } from "../runtime/kernel.js";
+import type { DatabaseAdapter } from "../kernel/database/adapter.js";
+import type { TaxAdapter } from "../modules/tax/adapter.js";
+import type { SearchAdapter } from "../modules/search/adapter.js";
+import type { JobsAdapter } from "../kernel/jobs/adapter.js";
+import type { TaskDefinition } from "../kernel/jobs/types.js";
+export interface RoleDefinition {
+    permissions: string[];
+}
+/**
+ * Permission scope declared by a plugin manifest.
+ * Collected at config resolution and exposed on the kernel and GET /api/admin/permissions.
+ */
+export interface PluginPermission {
+    scope: string;
+    description: string;
+    /** Set when collected from defineCommercePlugin (the manifest `id`). */
+    pluginId?: string;
+}
+export type FieldType = "text" | "number" | "boolean" | "date" | "json" | "relation" | "select";
+export interface EntityFieldDefinition {
+    name: string;
+    type: FieldType;
+    unit?: string;
+    schema?: unknown;
+    target?: string;
+    options?: string[];
+}
+export interface EntityVariantConfig {
+    enabled: boolean;
+    optionTypes?: string[];
+}
+export interface EntityHooks {
+    beforeCreate?: BeforeHook<unknown>[];
+    afterCreate?: AfterHook<unknown>[];
+    beforeUpdate?: BeforeHook<unknown>[];
+    afterUpdate?: AfterHook<unknown>[];
+    beforeDelete?: BeforeHook<unknown>[];
+    afterDelete?: AfterHook<unknown>[];
+    /**
+     * Runs after global `catalog.beforeRead` hooks. Registered at `catalog.{entityType}.beforeRead`
+     * (see kernel entity hook registration). Payload `{ id, slug?, options? }` — `id` is set once the
+     * entity row is resolved; hooks may transform `id` / `slug` before hydration.
+     */
+    beforeRead?: BeforeHook<unknown>[];
+    /**
+     * Runs after global `catalog.afterRead`. Registered at `catalog.{entityType}.afterRead`.
+     * Receives the hydrated entity as `result` (same shape as `catalog.afterRead`).
+     */
+    afterRead?: AfterHook<unknown>[];
+    /**
+     * Runs after global `catalog.beforeList` when `filter.type` matches this entity type (after global
+     * hooks). Registered at `catalog.{entityType}.beforeList`. Payload matches catalog `list` params:
+     * optional `filter`, `sort`, and `pagination`.
+     */
+    beforeList?: BeforeHook<unknown>[];
+    /**
+     * Runs after global `catalog.afterList` when the list request’s `filter.type` (after all before-hooks)
+     * matches this entity type. Registered at `catalog.{entityType}.afterList`. Payload `result` is
+     * `{ items: CatalogEntityHydrated[]; pagination: { page, limit, total, totalPages } }`.
+     */
+    afterList?: AfterHook<unknown>[];
+}
+export interface EntityConfig {
+    fields: EntityFieldDefinition[];
+    variants: EntityVariantConfig;
+    fulfillment: string;
+    hooks?: EntityHooks;
+    /** Optional URL alias. Generates ergonomic CRUD routes at `/api/{alias}` that delegate to the catalog service with `type` pre-injected. E.g., `alias: "products"` creates `GET /api/products`, `POST /api/products`, etc. */
+    alias?: string;
+}
+/**
+ * A predefined API key scope — a named set of permissions, prefix, and rate limit.
+ * Used with `bunx @porulle/cli api-key create --scope <name>`.
+ *
+ * Permissions use Better Auth's native format: Record<string, string[]>
+ * where keys are resource types and values are arrays of allowed actions.
+ */
+export interface ApiKeyScopeDefinition {
+    /** Prefix for generated keys (e.g., "uc_pub_", "uc_adm_"). */
+    prefix: string;
+    /** Human description shown in CLI output. */
+    description: string;
+    /** Permissions in Better Auth format: { catalog: ["read"], orders: ["create", "read"] } */
+    permissions: Record<string, string[]>;
+    /** Rate limiting for keys created with this scope. */
+    rateLimit?: {
+        maxRequests: number;
+        /** Time window in milliseconds. */
+        timeWindow: number;
+    };
+}
+export interface AuthConfig {
+    /**
+     * The default organization ID for single-store deployments.
+     * Created by the seed script via `auth.api.createOrganization()`.
+     * Used as fallback when a request has no org context (no session org,
+     * no storeResolver match). If not set and no storeResolver is configured,
+     * falls back to `"org_default"` with a deprecation warning.
+     *
+     * @example
+     * ```ts
+     * defaultOrganizationId: process.env.UC_ORG_ID,
+     * ```
+     */
+    defaultOrganizationId?: string;
+    requireEmailVerification?: boolean;
+    sessionDuration?: number;
+    socialProviders?: Record<string, {
+        clientId: string;
+        clientSecret: string;
+    }>;
+    twoFactor?: {
+        enabled: boolean;
+        requiredForRoles?: string[];
+    };
+    apiKeys?: {
+        enabled: boolean;
+        /** Default permissions for API keys that don't specify their own. */
+        defaultPermissions?: string[];
+    };
+    posPin?: {
+        enabled: boolean;
+    };
+    roles?: Record<string, RoleDefinition>;
+    customerPermissions?: string[];
+    /** Origins allowed for CSRF protection (Better Auth `trustedOrigins`). */
+    trustedOrigins?: string[];
+    /**
+     * Predefined API key scopes. Each scope defines a named permission set
+     * that can be used with `bunx @porulle/cli api-key create --scope <name>`.
+     *
+     * Better Auth's API key plugin is configured with one config per scope.
+     */
+    apiKeyScopes?: Record<string, ApiKeyScopeDefinition>;
+    /**
+     * Resolves which organization (store) a request belongs to.
+     *
+     * Used in multi-store SaaS deployments where each store is a separate
+     * organization. The resolver runs when a customer has no org membership
+     * (i.e., they're not an admin/staff/vendor).
+     *
+     * Common patterns:
+     * - Header-based: read `x-store-id` header set by the frontend
+     * - Domain-based: resolve org from request origin/host
+     * - Path-based: extract org slug from URL prefix
+     *
+     * Single-store and marketplace deployments don't need this — all data
+     * is scoped to org_default automatically.
+     *
+     * @example
+     * ```ts
+     * storeResolver: async (request) => {
+     *   // Header-based: frontend sends x-store-id
+     *   const storeId = request.headers.get("x-store-id");
+     *   if (storeId) return storeId;
+     *
+     *   // Domain-based: resolve from origin
+     *   const origin = request.headers.get("origin");
+     *   if (origin) return await lookupOrgByDomain(origin);
+     *
+     *   return null; // falls back to org_default
+     * }
+     * ```
+     */
+    storeResolver?: (request: Request) => string | null | Promise<string | null>;
+    /**
+     * When true, a failing `storeResolver` for anonymous requests returns HTTP 503
+     * instead of continuing with `actor = null` (legacy). Same behavior when env
+     * `STRICT_ORG_RESOLUTION` is `"true"`. Default false keeps backward-compatible
+     * fallback for single-store and lenient multi-store setups.
+     */
+    strictOrgResolution?: boolean;
+    /**
+     * Phone number OTP authentication via Better Auth's phoneNumber plugin.
+     * When configured, users can sign in/up with phone + OTP instead of email/password.
+     * You provide the SMS delivery callback; Better Auth handles OTP generation,
+     * storage, expiry, brute force protection, and session creation.
+     */
+    phoneAuth?: {
+        /** Send OTP to the phone number. Implement with Twilio, AWS SNS, or any SMS gateway. */
+        sendOTP: (params: {
+            phoneNumber: string;
+            code: string;
+        }, ctx: unknown) => void | Promise<void>;
+        /** Optional custom OTP verification (e.g., Twilio Verify). Overrides internal logic. */
+        verifyOTP?: (params: {
+            phoneNumber: string;
+            code: string;
+        }, ctx: unknown) => boolean | Promise<boolean>;
+        /** OTP length. Default: 6. */
+        otpLength?: number;
+        /** OTP expiry in seconds. Default: 300 (5 minutes). */
+        expiresIn?: number;
+        /** Auto-create user on first OTP verification. Default: generates temp email from phone. */
+        signUpOnVerification?: {
+            getTempEmail: (phoneNumber: string) => string;
+            getTempName?: (phoneNumber: string) => string;
+        };
+    };
+    /**
+     * Extra Better Auth plugins to inject (e.g., `@better-auth/expo`).
+     * Appended to the core plugin list (organization, bearer, jwt, etc.).
+     */
+    extraAuthPlugins?: unknown[];
+}
+export interface CartConfig {
+    ttlMinutes?: number;
+    hooks?: {
+        beforeAddItem?: BeforeHook<unknown>[];
+        afterAddItem?: AfterHook<unknown>[];
+        beforeRemoveItem?: BeforeHook<unknown>[];
+        afterRemoveItem?: AfterHook<unknown>[];
+        beforeUpdateQuantity?: BeforeHook<unknown>[];
+        afterUpdateQuantity?: AfterHook<unknown>[];
+    };
+}
+export interface CheckoutConfig {
+    hooks?: {
+        beforeCreate?: BeforeHook<unknown>[];
+        afterCreate?: AfterHook<unknown>[];
+    };
+}
+export interface OrdersConfig {
+    hooks?: {
+        beforeCreate?: BeforeHook<unknown>[];
+        afterCreate?: AfterHook<unknown>[];
+        beforeStatusChange?: BeforeHook<unknown>[];
+        afterStatusChange?: AfterHook<unknown>[];
+        afterGet?: AfterHook<unknown>[];
+        beforeDelete?: BeforeHook<unknown>[];
+    };
+    /**
+     * Extend the order state machine with custom transitions.
+     * New states (e.g., "payment_initiated", "shipped", "delivered", "defaulted")
+     * are added to the default machine. Existing transitions are preserved.
+     * See extendOrderStateMachine() for the merge logic.
+     */
+    customTransitions?: Record<string, string[]>;
+}
+export interface InventoryConfig {
+    hooks?: {
+        afterAdjust?: AfterHook<unknown>[];
+    };
+}
+export interface ShippingConfig {
+    type: "flat" | "weight_based";
+    flatRate: number;
+    freeShippingThreshold?: number;
+    brackets: Array<{
+        upToGrams: number;
+        cost: number;
+    }>;
+    fallbackCost: number;
+}
+export interface TaxConfig {
+    adapter?: TaxAdapter;
+    defaultFromAddress?: {
+        country: string;
+        postalCode: string;
+        state?: string;
+        city?: string;
+        line1?: string;
+    };
+}
+export interface AnalyticsConfig {
+    customSchemaPath?: string;
+    models?: unknown[];
+}
+export interface SearchConfig {
+    adapter?: SearchAdapter;
+    defaultFacets?: string[];
+}
+/**
+ * A CommercePlugin is a config transform function (PayloadCMS pattern).
+ * Receives the current config, returns the modified config.
+ * All plugins — simple or complex — are just functions.
+ *
+ * Use `defineCommercePlugin()` for a structured way to build plugins,
+ * or write a raw transform function for full control.
+ */
+export type CommercePlugin = (config: CommerceConfig) => CommerceConfig | Promise<CommerceConfig>;
+export interface CommerceConfig {
+    storeName?: string;
+    version?: string;
+    database: {
+        provider: "postgresql";
+        options?: Record<string, unknown>;
+    };
+    databaseAdapter?: DatabaseAdapter;
+    auth?: AuthConfig;
+    entities?: Record<string, EntityConfig>;
+    cart?: CartConfig;
+    checkout?: CheckoutConfig;
+    orders?: OrdersConfig;
+    inventory?: InventoryConfig;
+    shipping?: ShippingConfig;
+    payments?: PaymentAdapter[];
+    storage?: StorageAdapter;
+    media?: {
+        allowedMimeTypes?: string[];
+        allowSvg?: boolean;
+    };
+    email?: {
+        send(input: {
+            template: string;
+            to: string;
+            data?: Record<string, unknown>;
+        }): Promise<void>;
+    };
+    tax?: TaxConfig;
+    analytics?: AnalyticsConfig;
+    search?: SearchConfig;
+    jobs?: {
+        adapter?: JobsAdapter;
+        tasks?: TaskDefinition[];
+        autorun?: {
+            enabled: boolean;
+            intervalMs?: number;
+        };
+    };
+    /**
+     * Additional Drizzle table definitions — new tables or extended core tables.
+     * Each entry is an object of `{ exportName: pgTable(...) }`.
+     *
+     * These are merged with core schema by `buildSchema(config)` and must also
+     * be listed in the app's `drizzle.config.ts` for `db:push` / `db:generate`.
+     *
+     * Plugins push into this array automatically via `defineCommercePlugin({ schema })`.
+     * Apps can also add entries directly — no plugin wrapper needed:
+     *
+     * ```ts
+     * import { reviewsTable } from "./schema/reviews.js";
+     * import { extendedProducts } from "./schema/extended-products.js";
+     *
+     * defineConfig({
+     *   schema: [
+     *     { reviewsTable },
+     *     { extendedProducts },
+     *   ],
+     *   // ...
+     * });
+     * ```
+     */
+    schema?: Array<Record<string, unknown>>;
+    /** @internal Merged from `schema` + plugin schemas. Use `schema` instead. */
+    customSchemas?: Array<Record<string, unknown>>;
+    /**
+     * Permission scopes declared by plugins via defineCommercePlugin (`manifest.permissions`).
+     * Populated during plugin transforms; each entry includes `pluginId`.
+     */
+    pluginPermissions?: PluginPermission[];
+    hooks?: Record<string, Array<(...args: unknown[]) => unknown>>;
+    plugins?: CommercePlugin[];
+    middleware?: MiddlewareHandler[];
+    routes?: (app: Hono<any>, kernel: Kernel) => void;
+    /** Log level for structured logging. Default: "info". */
+    logLevel?: "fatal" | "error" | "warn" | "info" | "debug" | "trace";
+    /**
+     * Expose the OpenAPI spec (`/api/doc`) and Swagger UI (`/api/reference`).
+     * Default: `true` in development, `false` in production.
+     */
+    exposeOpenApiSpec?: boolean;
+    /** Rate limiting overrides. */
+    rateLimits?: {
+        /** Requests per minute for general API. Default: 100. */
+        api?: number;
+        /** Requests per minute for auth endpoints. Default: 10. */
+        auth?: number;
+        /** Requests per minute for checkout. Default: 5. */
+        checkout?: number;
+        /** Attempts per 15 minutes for sign-in per email. Default: 10. */
+        signInPerEmail?: number;
+    };
+    /**
+     * Security header hooks.
+     *
+     * `default` applies to all responses.
+     * `perRoute` overrides by request path. Use exact paths or prefix patterns
+     * ending with `*` (for example `/api/checkout/*`).
+     */
+    security?: {
+        csp?: {
+            default?: string;
+            perRoute?: Record<string, string>;
+        };
+    };
+}
+export interface DefineConfigInput extends CommerceConfig {
+}
+export interface AuthSessionLike {
+    user: {
+        id: string;
+        email?: string | null;
+        name?: string | null;
+        vendorId?: string | null;
+    };
+    session: {
+        activeOrganizationId?: string | null;
+        activeOrganizationRole?: string | null;
+    };
+}
+export interface KernelFactoryContext {
+    config: CommerceConfig;
+    actor: Actor | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACpD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEhG,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,WAAW,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,WAAW,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,WAAW,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,6NAA6N;IAC7N,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,sDAAsD;IACtD,SAAS,CAAC,EAAE;QACV,WAAW,EAAE,MAAM,CAAC;QACpB,mCAAmC;QACnC,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9D,OAAO,CAAC,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,qEAAqE;QACrE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC/B,CAAC;IACF,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACvC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,wFAAwF;QACxF,OAAO,EAAE,CAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/F,wFAAwF;QACxF,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxG,8BAA8B;QAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,uDAAuD;QACvD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,4FAA4F;QAC5F,oBAAoB,CAAC,EAAE;YACrB,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;YAC9C,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;SAC/C,CAAC;KACH,CAAC;IACF;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE;QACN,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,YAAY,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,gBAAgB,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,eAAe,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,oBAAoB,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE;QACN,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,WAAW,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE;QACN,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,WAAW,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,kBAAkB,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,iBAAiB,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;KACtC,CAAC;IACF;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE;QACN,WAAW,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,kBAAkB,CAAC,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,cAAc,KACnB,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE;QACR,QAAQ,EAAE,YAAY,CAAC;QACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,CAAC;IACF,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE;QACN,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,KAAK,EAAE;YACV,QAAQ,EAAE,MAAM,CAAC;YACjB,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACnB,CAAC;IACF,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,WAAW,CAAC;QACtB,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;QACzB,OAAO,CAAC,EAAE;YACR,OAAO,EAAE,OAAO,CAAC;YACjB,UAAU,CAAC,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IACF;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAClD,yDAAyD;IACzD,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACnE;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,+BAA+B;IAC/B,UAAU,CAAC,EAAE;QACX,yDAAyD;QACzD,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,2DAA2D;QAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oDAAoD;QACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kEAAkE;QAClE,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE;YACJ,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACnC,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,iBAAkB,SAAQ,cAAc;CAAG;AAE5D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IACF,OAAO,EAAE;QACP,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxC,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB"}

package/dist/config/types.js

@@ -0,0 +1 @@
+export {};