@porulle/core 0.1.0

package/dist/modules/media/schema.d.ts

@@ -0,0 +1,289 @@
+export declare const mediaAssets: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "media_assets";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        organizationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "organization_id";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        storageKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "storage_key";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        filename: import("drizzle-orm/pg-core").PgColumn<{
+            name: "filename";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        contentType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "content_type";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        size: import("drizzle-orm/pg-core").PgColumn<{
+            name: "size";
+            tableName: "media_assets";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        width: import("drizzle-orm/pg-core").PgColumn<{
+            name: "width";
+            tableName: "media_assets";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        height: import("drizzle-orm/pg-core").PgColumn<{
+            name: "height";
+            tableName: "media_assets";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        alt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "alt";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        metadata: import("drizzle-orm/pg-core").PgColumn<{
+            name: "metadata";
+            tableName: "media_assets";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        uploadedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "uploaded_at";
+            tableName: "media_assets";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const entityMedia: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "entity_media";
+    schema: undefined;
+    columns: {
+        entityId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entity_id";
+            tableName: "entity_media";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        variantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "variant_id";
+            tableName: "entity_media";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        mediaAssetId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "media_asset_id";
+            tableName: "entity_media";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        role: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role";
+            tableName: "entity_media";
+            dataType: "string";
+            columnType: "PgText";
+            data: "primary" | "gallery" | "thumbnail" | "video" | "document";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["primary", "gallery", "thumbnail", "video", "document"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sortOrder: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sort_order";
+            tableName: "entity_media";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/modules/media/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/media/schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBvB,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EActB,CAAC"}

package/dist/modules/media/schema.js

@@ -0,0 +1,35 @@
+import { index, integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+import { organization } from "../../auth/auth-schema.js";
+import { sellableEntities, variants } from "../catalog/schema.js";
+export const mediaAssets = pgTable("media_assets", {
+    id: uuid("id").defaultRandom().primaryKey(),
+    organizationId: text("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    storageKey: text("storage_key").notNull(),
+    filename: text("filename").notNull(),
+    contentType: text("content_type").notNull(),
+    size: integer("size").notNull(),
+    width: integer("width"),
+    height: integer("height"),
+    alt: text("alt"),
+    metadata: jsonb("metadata").$type().default({}),
+    uploadedAt: timestamp("uploaded_at", { withTimezone: true }).defaultNow().notNull(),
+}, (table) => ({
+    orgIdx: index("idx_media_assets_org").on(table.organizationId),
+}));
+export const entityMedia = pgTable("entity_media", {
+    entityId: uuid("entity_id")
+        .references(() => sellableEntities.id, { onDelete: "cascade" })
+        .notNull(),
+    variantId: uuid("variant_id").references(() => variants.id, {
+        onDelete: "cascade",
+    }),
+    mediaAssetId: uuid("media_asset_id")
+        .references(() => mediaAssets.id, { onDelete: "cascade" })
+        .notNull(),
+    role: text("role", {
+        enum: ["primary", "gallery", "thumbnail", "video", "document"],
+    }).notNull(),
+    sortOrder: integer("sort_order").notNull().default(0),
+});

package/dist/modules/media/service.d.ts

@@ -0,0 +1,45 @@
+import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
+import type { StorageAdapter, StoredFile } from "./adapter.js";
+import { type Result } from "../../kernel/result.js";
+import type { MediaRepository } from "./repository/index.js";
+import type { CatalogRepository } from "../catalog/repository/index.js";
+import type { TxContext } from "../../kernel/database/tx-context.js";
+export interface UploadMediaInput {
+    filename: string;
+    contentType: string;
+    data: ArrayBuffer;
+    alt?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface AttachMediaInput {
+    entityId: string;
+    mediaAssetId: string;
+    role: "primary" | "gallery" | "thumbnail" | "video" | "document";
+    variantId?: string;
+    sortOrder?: number;
+}
+interface MediaServiceDeps {
+    repository: MediaRepository;
+    catalogRepository: CatalogRepository;
+    storage: StorageAdapter;
+    config: CommerceConfig;
+}
+export declare function detectMimeFromBuffer(buffer: Uint8Array): string | null;
+export declare class MediaService {
+    private deps;
+    private readonly repo;
+    private readonly catalogRepo;
+    constructor(deps: MediaServiceDeps);
+    upload(input: UploadMediaInput, actor?: Actor | null, ctx?: TxContext): Promise<Result<{
+        id: string;
+        url: string;
+    }>>;
+    getUrl(id: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<string>>;
+    getSignedUrl(id: string, expiresIn?: number, actor?: Actor | null, ctx?: TxContext): Promise<Result<string>>;
+    delete(id: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<void>>;
+    list(prefix?: string): Promise<Result<StoredFile[]>>;
+    attachToEntity(input: AttachMediaInput, actor?: Actor | null, ctx?: TxContext): Promise<Result<void>>;
+}
+export {};
+//# sourceMappingURL=service.d.ts.map

package/dist/modules/media/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/media/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAGrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,gBAAgB;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,cAAc,CAAC;CACxB;AAkBD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAyBtE;AAED,qBAAa,YAAY;IAIX,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,gBAAgB;IAKpC,MAAM,CACV,KAAK,EAAE,gBAAgB,EACvB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAkEzC,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAOpB,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,SAAS,SAAU,EACnB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAOpB,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,IAAI,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAMhD,cAAc,CAClB,KAAK,EAAE,gBAAgB,EACvB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CA2BzB"}

package/dist/modules/media/service.js

@@ -0,0 +1,149 @@
+import { resolveOrgId } from "../../auth/org.js";
+import { Err, Ok } from "../../kernel/result.js";
+import { CommerceNotFoundError, CommerceValidationError, } from "../../kernel/errors.js";
+import { makeId } from "../../utils/id.js";
+const DEFAULT_ALLOWED_MIME_TYPES = [
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+    "application/pdf",
+];
+function isSvgOrXml(buffer) {
+    const prefix = new TextDecoder()
+        .decode(buffer.slice(0, 256))
+        .trimStart()
+        .toLowerCase();
+    return prefix.startsWith("<?xml") || prefix.startsWith("<svg");
+}
+export function detectMimeFromBuffer(buffer) {
+    if (buffer.length >= 8 &&
+        buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4e && buffer[3] === 0x47 &&
+        buffer[4] === 0x0d && buffer[5] === 0x0a && buffer[6] === 0x1a && buffer[7] === 0x0a)
+        return "image/png";
+    if (buffer.length >= 3 &&
+        buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff)
+        return "image/jpeg";
+    if (buffer.length >= 6 &&
+        buffer[0] === 0x47 && buffer[1] === 0x49 && buffer[2] === 0x46 && buffer[3] === 0x38 &&
+        (buffer[4] === 0x37 || buffer[4] === 0x39) && buffer[5] === 0x61)
+        return "image/gif";
+    if (buffer.length >= 12 &&
+        buffer[0] === 0x52 && buffer[1] === 0x49 && buffer[2] === 0x46 && buffer[3] === 0x46 &&
+        buffer[8] === 0x57 && buffer[9] === 0x45 && buffer[10] === 0x42 && buffer[11] === 0x50)
+        return "image/webp";
+    if (buffer.length >= 4 &&
+        buffer[0] === 0x25 && buffer[1] === 0x50 && buffer[2] === 0x44 && buffer[3] === 0x46)
+        return "application/pdf";
+    return null;
+}
+export class MediaService {
+    deps;
+    repo;
+    catalogRepo;
+    constructor(deps) {
+        this.deps = deps;
+        this.repo = deps.repository;
+        this.catalogRepo = deps.catalogRepository;
+    }
+    async upload(input, actor, ctx) {
+        if (!input.filename || !input.contentType) {
+            return Err(new CommerceValidationError("filename and contentType are required."));
+        }
+        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const bytes = new Uint8Array(input.data);
+        const detectedMime = detectMimeFromBuffer(bytes);
+        const allowSvg = this.deps.config.media?.allowSvg === true;
+        const allowedMimeTypes = this.deps.config.media?.allowedMimeTypes ?? DEFAULT_ALLOWED_MIME_TYPES;
+        if (isSvgOrXml(bytes) && !allowSvg) {
+            return Err(new CommerceValidationError("SVG uploads are disabled."));
+        }
+        if (detectedMime && input.contentType !== detectedMime) {
+            return Err(new CommerceValidationError(`Content type mismatch — declared ${input.contentType}, detected ${detectedMime}.`));
+        }
+        const effectiveMime = detectedMime ?? input.contentType;
+        if (!allowedMimeTypes.includes(effectiveMime)) {
+            return Err(new CommerceValidationError(`Unsupported content type: ${effectiveMime}.`));
+        }
+        const id = makeId();
+        const key = `${new Date().getFullYear()}/${id}-${input.filename}`;
+        const uploaded = await this.deps.storage.upload(key, input.data, effectiveMime);
+        if (!uploaded.ok)
+            return uploaded;
+        await this.repo.createAsset({
+            organizationId: orgId,
+            id,
+            storageKey: key,
+            filename: input.filename,
+            contentType: effectiveMime,
+            size: input.data.byteLength,
+            metadata: input.metadata ?? {},
+            uploadedAt: new Date(),
+            ...(input.alt !== undefined ? { alt: input.alt } : {}),
+        }, ctx);
+        const url = await this.deps.storage.getUrl(key);
+        if (!url.ok)
+            return url;
+        return Ok({ id, url: url.value });
+    }
+    // VAPT r2 (codex) finding: getUrl/getSignedUrl/delete loaded media by
+    // global id with no actor/org filter even though the repo accepts orgId.
+    // A tenant who knew or guessed a media UUID could read or delete another
+    // tenant's assets — same class as the prior catalog CRITICAL-2 fix.
+    // All three now resolve the actor's org and pass it to findAssetById,
+    // and delete additionally requires the actor to pass cross-tenant
+    // ownership (any actor without *:* must be in the asset's org).
+    async getUrl(id, actor, ctx) {
+        const orgId = resolveOrgId(actor ?? null);
+        const asset = await this.repo.findAssetById(id, ctx, orgId);
+        if (!asset)
+            return Err(new CommerceNotFoundError("Media asset not found."));
+        return this.deps.storage.getUrl(asset.storageKey);
+    }
+    async getSignedUrl(id, expiresIn = 60 * 15, actor, ctx) {
+        const orgId = resolveOrgId(actor ?? null);
+        const asset = await this.repo.findAssetById(id, ctx, orgId);
+        if (!asset)
+            return Err(new CommerceNotFoundError("Media asset not found."));
+        return this.deps.storage.getSignedUrl(asset.storageKey, expiresIn);
+    }
+    async delete(id, actor, ctx) {
+        const orgId = resolveOrgId(actor ?? null);
+        const asset = await this.repo.findAssetById(id, ctx, orgId);
+        if (!asset)
+            return Err(new CommerceNotFoundError("Media asset not found."));
+        const deleted = await this.deps.storage.delete(asset.storageKey);
+        if (!deleted.ok)
+            return deleted;
+        await this.repo.removeAllMediaByAssetId(id, ctx);
+        await this.repo.deleteAsset(id, ctx);
+        return Ok(undefined);
+    }
+    async list(prefix = "") {
+        const listed = await this.deps.storage.list(prefix);
+        if (!listed.ok)
+            return listed;
+        return Ok(listed.value);
+    }
+    async attachToEntity(input, actor, ctx) {
+        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
+        if (!entity) {
+            return Err(new CommerceNotFoundError("Entity not found."));
+        }
+        const asset = await this.repo.findAssetById(input.mediaAssetId, ctx, orgId);
+        if (!asset) {
+            return Err(new CommerceNotFoundError("Media asset not found."));
+        }
+        await this.repo.createEntityMedia({
+            entityId: input.entityId,
+            mediaAssetId: input.mediaAssetId,
+            role: input.role,
+            sortOrder: input.sortOrder ?? 0,
+            ...(input.variantId !== undefined
+                ? { variantId: input.variantId }
+                : {}),
+        }, ctx);
+        return Ok(undefined);
+    }
+}

package/dist/modules/orders/module.d.ts

@@ -0,0 +1,25 @@
+import type { CartService } from "../cart/service.js";
+import type { FulfillmentService } from "../fulfillment/service.js";
+import type { InventoryService } from "../inventory/service.js";
+import type { PaymentsService } from "../payments/service.js";
+import type { PricingService } from "../pricing/service.js";
+import type { PromotionService } from "../promotions/service.js";
+import type { TaxService } from "../tax/service.js";
+import { orderLineItems, orders, orderStatusHistory } from "./schema.js";
+import { OrderService } from "./service.js";
+type OrdersModuleDeps = {
+    cart: CartService;
+    inventory: InventoryService;
+    payments: PaymentsService;
+    pricing: PricingService;
+    promotions: PromotionService;
+    fulfillment: FulfillmentService;
+    tax: TaxService;
+};
+export declare const ordersModule: import("../../kernel/module/define.js").AppModule<{
+    orders: typeof orders;
+    orderLineItems: typeof orderLineItems;
+    orderStatusHistory: typeof orderStatusHistory;
+}, OrderService, OrdersModuleDeps>;
+export {};
+//# sourceMappingURL=module.d.ts.map

package/dist/modules/orders/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/orders/module.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EACL,cAAc,EACd,MAAM,EACN,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,KAAK,gBAAgB,GAAG;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,WAAW,EAAE,kBAAkB,CAAC;IAChC,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,YAAY;YAEb,OAAO,MAAM;oBACL,OAAO,cAAc;wBACjB,OAAO,kBAAkB;kCAgC/C,CAAC"}

package/dist/modules/orders/module.js

@@ -0,0 +1,32 @@
+import { defineModule } from "../../kernel/module/index.js";
+import { extendOrderStateMachine } from "../../kernel/state-machine/machine.js";
+import { OrdersRepository } from "./repository/index.js";
+import { orderLineItems, orders, orderStatusHistory, } from "./schema.js";
+import { OrderService } from "./service.js";
+export const ordersModule = defineModule({
+    id: "orders",
+    dependencies: [
+        "cart",
+        "inventory",
+        "payments",
+        "pricing",
+        "promotions",
+        "fulfillment",
+        "tax",
+    ],
+    schema: () => ({ orders, orderLineItems, orderStatusHistory }),
+    service: (deps) => {
+        const config = deps.config;
+        return new OrderService({
+            repository: new OrdersRepository(deps.db.db),
+            hooks: deps.hooks,
+            services: deps.services,
+            database: deps.db,
+            ...(config.orders?.customTransitions
+                ? {
+                    stateMachine: extendOrderStateMachine(config.orders.customTransitions),
+                }
+                : {}),
+        });
+    },
+});

package/dist/modules/orders/repository/index.d.ts

@@ -0,0 +1,48 @@
+import type { TxContext } from "../../../kernel/database/tx-context.js";
+import type { DrizzleDatabase } from "../../../kernel/database/drizzle-db.js";
+import { orders, orderLineItems, orderStatusHistory } from "../schema.js";
+export type Order = typeof orders.$inferSelect;
+export type OrderInsert = typeof orders.$inferInsert;
+export type OrderLineItem = typeof orderLineItems.$inferSelect;
+export type OrderLineItemInsert = typeof orderLineItems.$inferInsert;
+export type OrderStatusHistory = typeof orderStatusHistory.$inferSelect;
+export type OrderStatusHistoryInsert = typeof orderStatusHistory.$inferInsert;
+/**
+ * OrdersRepository provides type-safe database operations for orders.
+ *
+ * This repository manages orders, order line items, and order status history.
+ * All methods support an optional TxContext parameter for transaction participation.
+ */
+export declare class OrdersRepository {
+    private readonly db;
+    constructor(db: DrizzleDatabase);
+    private getDb;
+    findById(orgId: string, id: string, ctx?: TxContext): Promise<Order | undefined>;
+    findByOrderNumber(orgId: string, orderNumber: string, ctx?: TxContext): Promise<Order | undefined>;
+    findByCustomerId(orgId: string, customerId: string, ctx?: TxContext): Promise<Order[]>;
+    findByStatus(orgId: string, status: string, ctx?: TxContext): Promise<Order[]>;
+    findAll(orgId: string, options?: {
+        limit?: number;
+        offset?: number;
+    }, ctx?: TxContext): Promise<Order[]>;
+    create(data: OrderInsert, ctx?: TxContext): Promise<Order>;
+    update(id: string, data: Partial<Omit<OrderInsert, "id">>, ctx?: TxContext): Promise<Order | undefined>;
+    updateStatus(id: string, currentStatus: string, newStatus: string, ctx?: TxContext): Promise<Order | undefined>;
+    delete(id: string, ctx?: TxContext): Promise<boolean>;
+    findAllLineItems(ctx?: TxContext): Promise<OrderLineItem[]>;
+    findLineItemById(id: string, ctx?: TxContext): Promise<OrderLineItem | undefined>;
+    findLineItemsByOrderId(orderId: string, ctx?: TxContext): Promise<OrderLineItem[]>;
+    createLineItem(data: OrderLineItemInsert, ctx?: TxContext): Promise<OrderLineItem>;
+    createLineItems(data: OrderLineItemInsert[], ctx?: TxContext): Promise<OrderLineItem[]>;
+    updateLineItem(id: string, data: Partial<Omit<OrderLineItemInsert, "id">>, ctx?: TxContext): Promise<OrderLineItem | undefined>;
+    deleteLineItem(id: string, ctx?: TxContext): Promise<boolean>;
+    deleteLineItemsByOrderId(orderId: string, ctx?: TxContext): Promise<void>;
+    findStatusHistoryByOrderId(orderId: string, ctx?: TxContext): Promise<OrderStatusHistory[]>;
+    createStatusHistory(data: OrderStatusHistoryInsert, ctx?: TxContext): Promise<OrderStatusHistory>;
+    findWithLineItems(orgId: string, id: string, ctx?: TxContext): Promise<{
+        order: Order;
+        lineItems: OrderLineItem[];
+    } | undefined>;
+    getNextOrderNumber(ctx?: TxContext): Promise<string>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/orders/repository/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/orders/repository/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG1E,MAAM,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC;AAC/C,MAAM,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC;AACrD,MAAM,MAAM,aAAa,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAC/D,MAAM,MAAM,mBAAmB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AACrE,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AACxE,MAAM,MAAM,wBAAwB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAE9E;;;;;GAKG;AACH,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,eAAe;IAEhD,OAAO,CAAC,KAAK;IAQP,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAShF,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IASvB,gBAAgB,CACpB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,KAAK,EAAE,CAAC;IASb,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAS9E,OAAO,CACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAC7C,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,KAAK,EAAE,CAAC;IAkBb,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;IAM1D,MAAM,CACV,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EACtC,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAUvB,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAiBvB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAUrD,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAK3D,gBAAgB,CACpB,EAAE,EAAE,MAAM,EACV,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAS/B,sBAAsB,CAC1B,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,aAAa,EAAE,CAAC;IAQrB,cAAc,CAClB,IAAI,EAAE,mBAAmB,EACzB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,aAAa,CAAC;IAMnB,eAAe,CACnB,IAAI,EAAE,mBAAmB,EAAE,EAC3B,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,aAAa,EAAE,CAAC;IAMrB,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,EAC9C,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAU/B,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAS7D,wBAAwB,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC;IASV,0BAA0B,CAC9B,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAS1B,mBAAmB,CACvB,IAAI,EAAE,wBAAwB,EAC9B,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,kBAAkB,CAAC;IAUxB,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,SAAS,EAAE,aAAa,EAAE,CAAA;KAAE,GAAG,SAAS,CAAC;IAW9D,kBAAkB,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;CAiB3D"}