@porulle/core 0.10.8 → 0.13.0

package/dist/modules/fulfillment/service.js

@@ -1,6 +1,7 @@
 import { createHmac } from "node:crypto";
-import { resolveOrgId } from "../../auth/org.js";
-import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
+import { assertPermission } from "../../auth/permissions.js";
+import { CommerceNotFoundError, CommerceValidationError, toCommerceError } from "../../kernel/errors.js";
 import { runAfterHooks } from "../../kernel/hooks/executor.js";
 import { createHookContext } from "../../kernel/hooks/create-context.js";
 import { Err, Ok } from "../../kernel/result.js";
@@ -133,7 +134,7 @@ export class FulfillmentService {
         this.strategies.set("appointment", new AppointmentFulfillmentStrategy());
     }
     async fulfillOrder(orderId, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const order = await this.deps.ordersRepository.findById(orgId, orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -185,6 +186,7 @@ export class FulfillmentService {
                 services: this.deps.services,
                 context: { moduleName: "fulfillment" },
                 database: { db: this.deps.database.db },
+                commerceConfig: this.deps.config,
             });
             await runAfterHooks(afterHooks, null, record, "create", hookCtx);
             // Create a fulfillment line item linking this fulfillment to the order line item
@@ -204,7 +206,13 @@ export class FulfillmentService {
      * fulfillment (per-line quantities) and multiple fulfillments per order.
      */
     async createFulfillment(input, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        try {
+            assertPermission(actor ?? null, "orders:update");
+        }
+        catch (error) {
+            return Err(toCommerceError(error));
+        }
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const order = await this.deps.ordersRepository.findById(orgId, input.orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -246,7 +254,7 @@ export class FulfillmentService {
             fulfillmentId: created.id,
             eventType: "created",
             toStatus: status,
-            ...(actor?.userId !== undefined ? { actorId: actor.userId } : {}),
+            ...(actor?.userId != null ? { actorId: actor.userId } : {}),
             description: input.trackingNumber
                 ? `Shipment recorded (${input.trackingNumber})`
                 : "Fulfillment recorded",
@@ -278,6 +286,7 @@ export class FulfillmentService {
             services: this.deps.services,
             context: { moduleName: "fulfillment" },
             database: { db: this.deps.database.db },
+            commerceConfig: this.deps.config,
         });
         await runAfterHooks(afterHooks, null, record, "create", hookCtx);
         return Ok(record);
@@ -328,7 +337,7 @@ export class FulfillmentService {
         if (!matchedRecord) {
             return Err(new CommerceNotFoundError("Digital download not found."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const order = await this.deps.ordersRepository.findById(orgId, orderId, ctx);
         if (!order || order.customerId !== userId) {
             return Err(new CommerceNotFoundError("Order not found."));

package/dist/modules/inventory/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/inventory/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAW5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EACL,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACvG,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEvG,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,mBAAmB,CAAC;IAChC,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,qBAAa,gBAAgB;IAGf,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;gBAEvB,IAAI,EAAE,oBAAoB;YAIhC,eAAe;YAQf,aAAa;IA6BrB,eAAe,CACnB,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EACzB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IA6BvB,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAUnF,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,EACf,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAepB,UAAU,CACd,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACpD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IA0B9B,aAAa,CACjB,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAUpC,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,SAAS,EACf,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAU9B,OAAO,CACX,KAAK,EAAE,qBAAqB,EAC5B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA0DlB,OAAO,CACX,KAAK,EAAE,qBAAqB,EAC5B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAsDxB;;;;;;OAMG;IACG,cAAc,CAClB,KAAK,EAAE,oBAAoB,EAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CACR,MAAM,CAAC;QACL,KAAK,EAAE,cAAc,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CACH;IA6HD;;;OAGG;IACG,MAAM,CACV,KAAK,EAAE,oBAAoB,EAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAKlC;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAiClC;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EACD,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA+ClB,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;CA4BnC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/inventory/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAW5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EACL,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACvG,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEvG,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,mBAAmB,CAAC;IAChC,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,qBAAa,gBAAgB;IAGf,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;gBAEvB,IAAI,EAAE,oBAAoB;YAIhC,eAAe;YAQf,aAAa;IA6BrB,eAAe,CACnB,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EACzB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IA4BvB,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IASnF,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,EACf,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAcpB,UAAU,CACd,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACpD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAyB9B,aAAa,CACjB,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IASpC,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,SAAS,EACf,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,GACnB,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAS9B,OAAO,CACX,KAAK,EAAE,qBAAqB,EAC5B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyDlB,OAAO,CACX,KAAK,EAAE,qBAAqB,EAC5B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAqDxB;;;;;;OAMG;IACG,cAAc,CAClB,KAAK,EAAE,oBAAoB,EAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CACR,MAAM,CAAC;QACL,KAAK,EAAE,cAAc,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CACH;IA8HD;;;OAGG;IACG,MAAM,CACV,KAAK,EAAE,oBAAoB,EAC3B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAKlC;;;;;;OAMG;IACG,WAAW,CACf,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAgClC;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EACD,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA+ClB,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;CA2BnC"}

package/dist/modules/inventory/service.js

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { assertPermission } from "../../auth/permissions.js";
 import { CommerceInventoryRecordNotFoundError, CommerceNotFoundError, CommerceValidationError, INVENTORY_RECORD_NOT_FOUND_MESSAGE, toCommerceError, } from "../../kernel/errors.js";
 import { runAfterHooks } from "../../kernel/hooks/executor.js";
@@ -20,7 +20,7 @@ export class InventoryService {
     }
     async pickWarehouse(actor, ctx, orgIdOverride) {
         const orgId = orgIdOverride ??
-            resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+            resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const warehouses = await this.repo.findAllWarehouses(orgId, ctx);
         const sorted = warehouses.sort((a, b) => a.priority - b.priority);
         if (sorted.length > 0) {
@@ -41,7 +41,7 @@ export class InventoryService {
         if (!input.name || !input.code) {
             return Err(new CommerceValidationError("Warehouse name and code are required."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const warehouse = await this.repo.createWarehouse({
             organizationId: orgId,
             name: input.name,
@@ -54,17 +54,17 @@ export class InventoryService {
         return Ok(warehouse);
     }
     async listWarehouses(actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const warehouses = await this.repo.findAllWarehouses(orgId, ctx);
         return Ok(warehouses.sort((a, b) => a.priority - b.priority));
     }
     async getAvailable(entityId, variantId, ctx, actor) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const available = await this.repo.getAvailableQuantity(orgId, entityId, variantId, ctx);
         return Ok(available);
     }
     async listLevels(params, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         if (params?.entityId) {
             const levels = await this.repo.findLevelsByEntityId(orgId, params.entityId, ctx);
             return Ok(levels);
@@ -77,12 +77,12 @@ export class InventoryService {
         return Ok(levels);
     }
     async checkMultiple(entityIds, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const data = await this.repo.getAvailableQuantities(orgId, entityIds, ctx);
         return Ok(data);
     }
     async getLevelsByEntityId(entityId, ctx, actor) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const levels = await this.repo.findLevelsByEntityId(orgId, entityId, ctx);
         return Ok(levels);
     }
@@ -90,7 +90,7 @@ export class InventoryService {
         if (input.quantity <= 0) {
             return Err(new CommerceValidationError("Reservation quantity must be greater than zero."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const warehouseId = input.warehouseId ?? (await this.pickWarehouse(actor, ctx));
         const performedBy = input.performedBy ?? actor?.userId ?? "system";
         const variantId = input.variantId ?? null;
@@ -119,7 +119,7 @@ export class InventoryService {
         });
     }
     async release(input, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const warehouseId = input.warehouseId ?? (await this.pickWarehouse(actor, ctx));
         const performedBy = input.performedBy ?? actor?.userId ?? "system";
         const variantId = input.variantId ?? null;
@@ -177,7 +177,7 @@ export class InventoryService {
         const variantId = input.variantId ?? null;
         const performedBy = input.performedBy ?? actor?.userId ?? "system";
         const doAdjust = async (txCtx) => {
-            const orgId = resolveOrgId(actor ?? txCtx.actor ?? null, undefined, this.deps.config);
+            const orgId = resolveOrgIdForCommerce(actor ?? txCtx.actor ?? null, this.deps.config);
             // Lock the level first so `before` and the write are atomic.
             const existing = await this.repo.findLevelForUpdate(orgId, input.entityId, variantId, warehouseId, txCtx);
             const before = existing?.quantityOnHand ?? 0;
@@ -237,6 +237,7 @@ export class InventoryService {
                 services: this.deps.services,
                 context: { moduleName: "inventory" },
                 database: { db: this.deps.database.db },
+                commerceConfig: this.deps.config,
             });
             const afterHooks = this.deps.hooks.resolve("inventory.afterAdjust");
             await runAfterHooks(afterHooks, null, level, "update", hookCtx);
@@ -264,7 +265,7 @@ export class InventoryService {
      */
     async setAbsolute(input, actor, ctx) {
         const warehouseId = input.warehouseId ?? (await this.pickWarehouse(actor, ctx));
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const existingLevel = await this.repo.findLevelByKey(orgId, input.entityId, warehouseId, input.variantId, ctx);
         const currentOnHand = existingLevel?.quantityOnHand ?? 0;
         const delta = input.quantity - currentOnHand;
@@ -290,7 +291,7 @@ export class InventoryService {
      */
     async deductForFulfillment(input, ctx) {
         const orgId = input.orgId ??
-            resolveOrgId(ctx?.actor ?? null, undefined, this.deps.config);
+            resolveOrgIdForCommerce(ctx?.actor ?? null, this.deps.config);
         const warehouseId = input.warehouseId ?? (await this.pickWarehouse(null, ctx, orgId));
         const variantId = input.variantId ?? null;
         const level = await this.repo.findLevelByKey(orgId, input.entityId, warehouseId, variantId != null ? variantId : undefined, ctx);
@@ -314,7 +315,7 @@ export class InventoryService {
         return Ok(undefined);
     }
     async setUnitCost(entityId, warehouseId, unitCost, variantId, ctx) {
-        const orgId = resolveOrgId(ctx?.actor ?? null, undefined, this.deps.config);
+        const orgId = resolveOrgIdForCommerce(ctx?.actor ?? null, this.deps.config);
         const level = await this.repo.findLevelByKey(orgId, entityId, warehouseId, variantId, ctx);
         if (!level) {
             return Err(new CommerceNotFoundError(`Inventory level not found for entity ${entityId} at warehouse ${warehouseId}.`));

package/dist/modules/media/module.d.ts

@@ -176,6 +176,57 @@ export declare const mediaModule: import("../../kernel/module/define.js").AppMod
             }, {}, {
                 $type: Record<string, unknown>;
             }>;
+            origin: import("drizzle-orm/pg-core").PgColumn<{
+                name: "origin";
+                tableName: "media_assets";
+                dataType: "string";
+                columnType: "PgEnumColumn";
+                data: "generated" | "merchant" | "imported";
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: ["merchant", "generated", "imported"];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            confidence: import("drizzle-orm/pg-core").PgColumn<{
+                name: "confidence";
+                tableName: "media_assets";
+                dataType: "string";
+                columnType: "PgNumeric";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            derivedFromAssetId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "derived_from_asset_id";
+                tableName: "media_assets";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             uploadedAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "uploaded_at";
                 tableName: "media_assets";
@@ -285,6 +336,23 @@ export declare const mediaModule: import("../../kernel/module/define.js").AppMod
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "entity_media";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
         };
         dialect: "pg";
     }>;

package/dist/modules/media/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/media/module.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCAgBtB,CAAC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/media/module.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCAkBtB,CAAC"}

package/dist/modules/media/module.js

@@ -17,6 +17,8 @@ export const mediaModule = defineModule({
             catalogRepository: new CatalogRepository(db),
             storage,
             config: deps.config,
+            database: deps.db,
+            services: deps.services,
         });
     },
 });

package/dist/modules/media/schema.d.ts

@@ -1,3 +1,5 @@
+export declare const mediaAssetOrigin: import("drizzle-orm/pg-core").PgEnum<["merchant", "generated", "imported"]>;
+export type MediaAssetOrigin = (typeof mediaAssetOrigin.enumValues)[number];
 export declare const mediaAssets: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "media_assets";
     schema: undefined;
@@ -174,6 +176,57 @@ export declare const mediaAssets: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {
             $type: Record<string, unknown>;
         }>;
+        origin: import("drizzle-orm/pg-core").PgColumn<{
+            name: "origin";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgEnumColumn";
+            data: "generated" | "merchant" | "imported";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["merchant", "generated", "imported"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        confidence: import("drizzle-orm/pg-core").PgColumn<{
+            name: "confidence";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgNumeric";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        derivedFromAssetId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "derived_from_asset_id";
+            tableName: "media_assets";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         uploadedAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "uploaded_at";
             tableName: "media_assets";
@@ -283,6 +336,23 @@ export declare const entityMedia: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "entity_media";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;

package/dist/modules/media/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/media/schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBvB,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EActB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/media/schema.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gBAAgB,6EAAsE,CAAC;AACpG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyBvB,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyBrB,CAAC"}

package/dist/modules/media/schema.js

@@ -1,6 +1,8 @@
-import { index, integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+import { index, integer, jsonb, numeric, pgEnum, pgTable, text, timestamp, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 import { organization } from "../../auth/auth-schema.js";
 import { sellableEntities, variants } from "../catalog/schema.js";
+export const mediaAssetOrigin = pgEnum("media_asset_origin", ["merchant", "generated", "imported"]);
 export const mediaAssets = pgTable("media_assets", {
     id: uuid("id").defaultRandom().primaryKey(),
     organizationId: text("organization_id")
@@ -14,6 +16,11 @@ export const mediaAssets = pgTable("media_assets", {
     height: integer("height"),
     alt: text("alt"),
     metadata: jsonb("metadata").$type().default({}),
+    origin: mediaAssetOrigin("origin").notNull().default("merchant"),
+    confidence: numeric("confidence", { precision: 4, scale: 3 }),
+    derivedFromAssetId: uuid("derived_from_asset_id").references(() => mediaAssets.id, {
+        onDelete: "set null",
+    }),
     uploadedAt: timestamp("uploaded_at", { withTimezone: true }).defaultNow().notNull(),
 }, (table) => ({
     orgIdx: index("idx_media_assets_org").on(table.organizationId),
@@ -32,4 +39,15 @@ export const entityMedia = pgTable("entity_media", {
         enum: ["primary", "gallery", "thumbnail", "video", "document"],
     }).notNull(),
     sortOrder: integer("sort_order").notNull().default(0),
-});
+    createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
+}, (table) => ({
+    // Two partial indexes instead of one NULLS DISTINCT index: Postgres treats
+    // null variant ids as distinct, so a single index cannot reject duplicate
+    // entity-level rows.
+    entityLevelUnique: uniqueIndex("entity_media_entity_level_unique")
+        .on(table.entityId, table.mediaAssetId)
+        .where(sql `${table.variantId} IS NULL`),
+    variantLevelUnique: uniqueIndex("entity_media_variant_level_unique")
+        .on(table.entityId, table.variantId, table.mediaAssetId)
+        .where(sql `${table.variantId} IS NOT NULL`),
+}));

package/dist/modules/media/service.d.ts

@@ -2,15 +2,18 @@ import type { Actor } from "../../auth/types.js";
 import type { CommerceConfig } from "../../config/types.js";
 import type { StorageAdapter, StoredFile } from "./adapter.js";
 import { type Result } from "../../kernel/result.js";
-import type { MediaRepository } from "./repository/index.js";
+import type { MediaRepository, MediaAsset } from "./repository/index.js";
 import type { CatalogRepository } from "../catalog/repository/index.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
+import type { DatabaseAdapter } from "../../kernel/database/adapter.js";
+import type { MediaAssetOrigin } from "./schema.js";
 export interface UploadMediaInput {
     filename: string;
     contentType: string;
     data: ArrayBuffer;
     alt?: string;
     metadata?: Record<string, unknown>;
+    origin?: MediaAssetOrigin;
 }
 export interface AttachMediaInput {
     entityId: string;
@@ -33,13 +36,17 @@ interface MediaServiceDeps {
     catalogRepository: CatalogRepository;
     storage: StorageAdapter;
     config: CommerceConfig;
+    database?: DatabaseAdapter;
+    services?: Record<string, unknown>;
 }
+export declare function assertMediaWritable(asset: Pick<MediaAsset, "origin">, actor: Actor | null): void;
 export declare function detectMimeFromBuffer(buffer: Uint8Array): string | null;
 export declare class MediaService {
     private deps;
     private readonly repo;
     private readonly catalogRepo;
     constructor(deps: MediaServiceDeps);
+    private withTransaction;
     upload(input: UploadMediaInput, actor?: Actor | null, ctx?: TxContext): Promise<Result<{
         id: string;
         url: string;

package/dist/modules/media/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/media/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAK9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAGrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,gBAAgB;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,cAAc,CAAC;CACxB;AAkBD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAyBtE;AAED,qBAAa,YAAY;IAIX,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,gBAAgB;IAKpC,MAAM,CACV,KAAK,EAAE,gBAAgB,EACvB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAkEzC,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAOpB,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,SAAS,SAAU,EACnB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAOpB,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAalB,IAAI,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAMhD,cAAc,CAClB,KAAK,EAAE,gBAAgB,EACvB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA4BxB;;;;OAIG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAC7C,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;CAoBpC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/media/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,gBAAgB;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAUD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,IAAI,CAEhG;AAiBD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAyBtE;AAED,qBAAa,YAAY;IAIX,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,gBAAgB;YAK5B,eAAe;IAUvB,MAAM,CACV,KAAK,EAAE,gBAAgB,EACvB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAmEzC,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAOpB,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,SAAS,SAAU,EACnB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAOpB,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBlB,IAAI,CAAC,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAMhD,cAAc,CAClB,KAAK,EAAE,gBAAgB,EACvB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAoDxB;;;;OAIG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAC7C,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;CAoBpC"}

package/dist/modules/media/service.js

@@ -1,6 +1,8 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
+import { assertPermission } from "../../auth/permissions.js";
 import { Err, Ok } from "../../kernel/result.js";
-import { CommerceNotFoundError, CommerceValidationError, } from "../../kernel/errors.js";
+import { CommerceConflictError, CommerceNotFoundError, CommerceValidationError, toCommerceError, } from "../../kernel/errors.js";
+import { createTxContext } from "../../kernel/database/tx-context.js";
 import { makeId } from "../../utils/id.js";
 const DEFAULT_ALLOWED_MIME_TYPES = [
     "image/png",
@@ -9,6 +11,18 @@ const DEFAULT_ALLOWED_MIME_TYPES = [
     "image/webp",
     "application/pdf",
 ];
+export function assertMediaWritable(asset, actor) {
+    if (asset.origin === "merchant")
+        assertPermission(actor, "media:write");
+}
+function isUniqueViolation(error) {
+    if (error == null || typeof error !== "object")
+        return false;
+    const value = error;
+    if (value.code === "23505")
+        return true;
+    return isUniqueViolation(value.cause);
+}
 function isSvgOrXml(buffer) {
     const prefix = new TextDecoder()
         .decode(buffer.slice(0, 256))
@@ -46,11 +60,18 @@ export class MediaService {
         this.repo = deps.repository;
         this.catalogRepo = deps.catalogRepository;
     }
+    async withTransaction(actor, ctx, fn) {
+        if (ctx?.tx != null)
+            return fn(ctx);
+        if (this.deps.database == null)
+            throw new Error("Database is required for media mutations.");
+        return this.deps.database.transaction(async (tx) => fn(createTxContext(tx, { actor })));
+    }
     async upload(input, actor, ctx) {
         if (!input.filename || !input.contentType) {
             return Err(new CommerceValidationError("filename and contentType are required."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const bytes = new Uint8Array(input.data);
         const detectedMime = detectMimeFromBuffer(bytes);
         const allowSvg = this.deps.config.media?.allowSvg === true;
@@ -78,6 +99,7 @@ export class MediaService {
             contentType: effectiveMime,
             size: input.data.byteLength,
             metadata: input.metadata ?? {},
+            origin: input.origin ?? "merchant",
             uploadedAt: new Date(),
             ...(input.alt !== undefined ? { alt: input.alt } : {}),
         }, ctx);
@@ -94,24 +116,30 @@ export class MediaService {
     // and delete additionally requires the actor to pass cross-tenant
     // ownership (any actor without *:* must be in the asset's org).
     async getUrl(id, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
         const asset = await this.repo.findAssetById(id, ctx, orgId);
         if (!asset)
             return Err(new CommerceNotFoundError("Media asset not found."));
         return this.deps.storage.getUrl(asset.storageKey);
     }
     async getSignedUrl(id, expiresIn = 60 * 15, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
         const asset = await this.repo.findAssetById(id, ctx, orgId);
         if (!asset)
             return Err(new CommerceNotFoundError("Media asset not found."));
         return this.deps.storage.getSignedUrl(asset.storageKey, expiresIn);
     }
     async delete(id, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
         const asset = await this.repo.findAssetById(id, ctx, orgId);
         if (!asset)
             return Err(new CommerceNotFoundError("Media asset not found."));
+        try {
+            assertMediaWritable(asset, actor ?? ctx?.actor ?? null);
+        }
+        catch (error) {
+            return Err(toCommerceError(error));
+        }
         const deleted = await this.deps.storage.delete(asset.storageKey);
         if (!deleted.ok)
             return deleted;
@@ -126,25 +154,45 @@ export class MediaService {
         return Ok(listed.value);
     }
     async attachToEntity(input, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
-        const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
-        if (!entity) {
-            return Err(new CommerceNotFoundError("Entity not found."));
+        try {
+            return await this.withTransaction(actor ?? ctx?.actor ?? null, ctx, async (txCtx) => {
+                const orgId = resolveOrgIdForCommerce(actor ?? txCtx.actor, this.deps.config);
+                const entity = await this.catalogRepo.findEntityById(input.entityId, txCtx, orgId);
+                if (!entity)
+                    return Err(new CommerceNotFoundError("Entity not found."));
+                const asset = await this.repo.findAssetById(input.mediaAssetId, txCtx, orgId);
+                if (!asset)
+                    return Err(new CommerceNotFoundError("Media asset not found."));
+                const existing = await this.repo.findEntityMedia(input.entityId, input.variantId, txCtx);
+                if (existing.some((link) => link.mediaAssetId === input.mediaAssetId)) {
+                    return Err(new CommerceConflictError("Media asset is already attached at this level."));
+                }
+                await this.repo.createEntityMedia({
+                    entityId: input.entityId,
+                    mediaAssetId: input.mediaAssetId,
+                    role: input.role,
+                    sortOrder: input.sortOrder ?? 0,
+                    ...(input.variantId !== undefined
+                        ? { variantId: input.variantId }
+                        : {}),
+                }, txCtx);
+                const catalog = this.deps.services?.catalog;
+                if (catalog == null || typeof catalog !== "object") {
+                    throw new Error("Catalog service is required for media revision capture.");
+                }
+                const catalogService = catalog;
+                const revision = await catalogService.recordEntityRevision(input.entityId, actor ?? txCtx.actor, "update", txCtx);
+                if (!revision.ok)
+                    throw revision.error;
+                return Ok(undefined);
+            });
         }
-        const asset = await this.repo.findAssetById(input.mediaAssetId, ctx, orgId);
-        if (!asset) {
-            return Err(new CommerceNotFoundError("Media asset not found."));
+        catch (error) {
+            if (isUniqueViolation(error)) {
+                return Err(new CommerceConflictError("Media asset is already attached at this level."));
+            }
+            return Err(toCommerceError(error));
         }
-        await this.repo.createEntityMedia({
-            entityId: input.entityId,
-            mediaAssetId: input.mediaAssetId,
-            role: input.role,
-            sortOrder: input.sortOrder ?? 0,
-            ...(input.variantId !== undefined
-                ? { variantId: input.variantId }
-                : {}),
-        }, ctx);
-        return Ok(undefined);
     }
     /**
      * Media attached to an entity, resolved to public URLs and ordered by