@porulle/core 0.10.8 → 0.13.0

package/dist/modules/orders/service.js

@@ -1,14 +1,17 @@
-import { resolveOrgId } from "../../auth/org.js";
-import { assertOwnership, assertPermission } from "../../auth/permissions.js";
-import { CommerceForbiddenError, CommerceInvalidTransitionError, CommerceNotFoundError, CommerceValidationError, toCommerceError, } from "../../kernel/errors.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
+import { assertOwnership, assertPermission, hasPermission } from "../../auth/permissions.js";
+import { defaultGuestOrderAccess } from "./guest-access.js";
+import { isCatalogEntityVisible } from "../catalog/read-policy.js";
+import { CommerceConflictError, CommerceForbiddenError, CommerceInvalidTransitionError, CommerceNotFoundError, CommerceValidationError, toCommerceError, } from "../../kernel/errors.js";
 import { runAfterHooks, runBeforeHooks } from "../../kernel/hooks/executor.js";
 import { createHookContext } from "../../kernel/hooks/create-context.js";
 import { canTransition, orderStateMachine, } from "../../kernel/state-machine/machine.js";
 import { Err, Ok } from "../../kernel/result.js";
 import { createLogger } from "../../utils/logger.js";
+import { makeIdempotencyScope } from "../../utils/id.js";
 import { paginate } from "../../utils/pagination.js";
 import { withTransaction, } from "../../kernel/database/tx-context.js";
-function context(actor, services, database, tx = null) {
+function context(actor, services, database, config, tx = null) {
     return createHookContext({
         actor,
         tx,
@@ -17,6 +20,7 @@ function context(actor, services, database, tx = null) {
         ...(services.jobs ? { jobs: services.jobs } : {}),
         context: { moduleName: "orders" },
         database: { db: database.db },
+        commerceConfig: config,
     });
 }
 export class OrderService {
@@ -58,8 +62,15 @@ export class OrderService {
         const resolved = [];
         for (const item of input.lineItems) {
             // Org-integrity — the referenced entity must belong to this order's org.
-            const owned = await catalog.getById(item.entityId, { includeVariants: item.variantId !== undefined }, actor, ctx);
-            if (!owned.ok) {
+            // This is an internal invariant check, so it reads past the storefront
+            // visibility policy; unprivileged buyers are gated in the same branch.
+            const owned = await catalog.getByIdForInternalUse(item.entityId, resolveOrgIdForCommerce(actor, this.deps.config), { includeVariants: item.variantId !== undefined }, ctx);
+            if (!owned.ok ||
+                !owned.value ||
+                !isCatalogEntityVisible({
+                    status: owned.value?.status ?? "draft",
+                    isVisible: owned.value?.isVisible ?? false,
+                }, actor)) {
                 return Err(new CommerceValidationError(`Line item entity ${item.entityId} does not belong to this organization.`));
             }
             if (item.variantId !== undefined &&
@@ -92,6 +103,112 @@ export class OrderService {
         }
         return Ok(resolved);
     }
+    async resolveCreateCustomerId(requestedCustomerId, actor, ctx) {
+        // API keys are the documented POS operator actor. Keep this as an actor
+        // type predicate so self-service user actors remain unable to choose a
+        // foreign customerId even when they are authenticated.
+        const isOperator = actor?.type === "api_key";
+        if (isOperator) {
+            if (requestedCustomerId === undefined)
+                return undefined;
+            return this.resolveRequestedCustomerId(requestedCustomerId, actor, ctx);
+        }
+        if (hasPermission(actor, "orders:create:on-behalf")) {
+            if (requestedCustomerId === undefined)
+                return undefined;
+            return this.resolveRequestedCustomerId(requestedCustomerId, actor, ctx);
+        }
+        // `orders:read:own` is the system's existing "this actor is a shopper"
+        // marker -- it is in DEFAULT_CUSTOMER_PERMISSIONS and guards the read-own
+        // order routes. Using it here decides *attribution*, which is a proxy and is
+        // deliberately a stopgap: the honest discriminator is caller intent, which a
+        // storefront route knows and this service cannot see.
+        //
+        // Known misclassification: a dual-hatted role holding `orders:read:own` for
+        // its own personal orders, plus `orders:create`, self-attributes a walk-in
+        // sale. The proxy is tolerable only because it fails narrow -- it can attach
+        // the actor's own profile or fall through to a guest order, never expose
+        // another principal's data.
+        if (!hasPermission(actor, "orders:read:own"))
+            return undefined;
+        if (!actor?.userId)
+            return undefined;
+        const customers = this.deps.services.customers;
+        if (!customers?.getByUserId)
+            return undefined;
+        const own = await customers.getByUserId(actor.userId, actor, ctx);
+        return own.ok ? own.value?.id : undefined;
+    }
+    async resolveRequestedCustomerId(requestedCustomerId, actor, ctx) {
+        const customers = this.deps.services.customers;
+        const customer = await customers?.getById(requestedCustomerId, actor, ctx);
+        if (!customer?.ok || !customer.value) {
+            throw new CommerceValidationError("customerId must reference a customer in this organization.");
+        }
+        return customer.value.id;
+    }
+    async authorizeOrderRead(order, actor, ctx, guestCredential) {
+        try {
+            if (actor?.permissions.includes("orders:read") ||
+                actor?.permissions.includes("*:*")) {
+                // no-op
+            }
+            else if (actor?.permissions.includes("orders:read:own")) {
+                if (order.customerId == null) {
+                    const cartId = typeof order.metadata?.cartId === "string"
+                        ? order.metadata.cartId
+                        : undefined;
+                    const cart = this.deps.services.cart;
+                    if (!cartId || !guestCredential || !cart?.getById) {
+                        throw new CommerceForbiddenError("You do not have access to this resource.");
+                    }
+                    const guestCart = await cart.getById(cartId, actor, ctx, guestCredential);
+                    if (!guestCart.ok) {
+                        throw new CommerceForbiddenError("You do not have access to this resource.");
+                    }
+                    // The secret is genuine, but a bearer credential with no lifetime
+                    // reads this order forever — and a secret leaks far more easily than
+                    // it is guessed. Bound it to a window after placement, and fail with
+                    // the identical error so a stale window is not an oracle telling the
+                    // caller their secret is valid.
+                    const guestAccess = this.deps.config.orders?.guestAccessStrategy ?? defaultGuestOrderAccess;
+                    if (!guestAccess.canAccessOrder(order, new Date())) {
+                        throw new CommerceForbiddenError("You do not have access to this resource.");
+                    }
+                }
+                else {
+                    // Older integrations may have stored the auth user ID directly as
+                    // customerId. Keep that valid ownership shape while resolving the
+                    // normal auth-user -> customer-profile relationship below.
+                    let ownerActor = actor;
+                    if (actor.userId !== order.customerId) {
+                        const customers = this.deps.services.customers;
+                        const profile = actor.userId && customers?.getByUserId
+                            ? await customers.getByUserId(actor.userId, actor, ctx)
+                            : { ok: false };
+                        ownerActor = profile.ok
+                            ? { ...actor, userId: profile.value.id }
+                            : actor;
+                    }
+                    assertOwnership(ownerActor, order.customerId);
+                }
+            }
+            else {
+                assertPermission(actor, "orders:read");
+            }
+        }
+        catch (error) {
+            return Err(toCommerceError(error));
+        }
+        return Ok(undefined);
+    }
+    async authorizedReplay(order, actor, ctx, guestCredential) {
+        const access = await this.authorizeOrderRead(order, actor, ctx, guestCredential);
+        if (!access.ok) {
+            return Err(new CommerceConflictError("Idempotency key does not belong to this account."));
+        }
+        return Ok(await this.hydrateOrder(order, ctx));
+    }
     async create(input, actor, ctx, opts) {
         if (opts?.stockPolicy === "reserve" && !ctx) {
             return withTransaction(this.deps.database, { actor }, (txCtx) => this.create(input, actor, txCtx, opts));
@@ -105,17 +222,37 @@ export class OrderService {
         if (input.lineItems.length === 0) {
             return Err(new CommerceValidationError("Order requires at least one line item."));
         }
+        let resolvedCustomerId;
+        try {
+            resolvedCustomerId = await this.resolveCreateCustomerId(input.customerId, actor, ctx);
+        }
+        catch (error) {
+            return Err(toCommerceError(error));
+        }
+        const serviceInput = {
+            ...input,
+            ...(resolvedCustomerId !== undefined
+                ? { customerId: resolvedCustomerId }
+                : {}),
+        };
+        if (resolvedCustomerId === undefined)
+            delete serviceInput.customerId;
         const beforeHooks = this.deps.hooks.resolve("orders.beforeCreate");
         const afterHooks = this.deps.hooks.resolve("orders.afterCreate");
-        const hookCtx = context(actor, this.deps.services, this.deps.database, ctx?.tx);
-        const processed = await runBeforeHooks(beforeHooks, input, "create", hookCtx);
-        const orgId = resolveOrgId(actor);
+        const hookCtx = context(actor, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
+        const processed = await runBeforeHooks(beforeHooks, serviceInput, "create", hookCtx);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
+        const idempotencyScope = processed.idempotencyKey
+            ? await makeIdempotencyScope(actor, opts?.guestCredential, typeof processed.metadata?.cartId === "string"
+                ? processed.metadata.cartId
+                : undefined)
+            : undefined;
         // Idempotent replay: offline POS queues and network retries re-submit the
         // same create — return the original order instead of double-creating.
         if (processed.idempotencyKey) {
-            const existing = await this.repo.findByIdempotencyKey(orgId, processed.idempotencyKey, ctx);
+            const existing = await this.repo.findByIdempotencyKey(orgId, processed.idempotencyKey, idempotencyScope, ctx);
             if (existing) {
-                return Ok(await this.hydrateOrder(existing, ctx));
+                return this.authorizedReplay(existing, actor, ctx, opts?.guestCredential);
             }
         }
         // Resolve line prices with org-integrity + provenance (see resolveLines).
@@ -167,6 +304,7 @@ export class OrderService {
                 ...(processed.paymentIntentId != null ? { paymentIntentId: processed.paymentIntentId } : {}),
                 ...(processed.paymentMethodId != null ? { paymentMethodId: processed.paymentMethodId } : {}),
                 ...(processed.idempotencyKey != null ? { idempotencyKey: processed.idempotencyKey } : {}),
+                ...(idempotencyScope !== undefined ? { idempotencyScope } : {}),
                 metadata: processed.metadata ?? {},
                 placedAt: new Date(),
                 ...(processed.customerId !== undefined
@@ -177,9 +315,10 @@ export class OrderService {
         catch (error) {
             // Concurrent replay lost the unique-index race — return the winner.
             if (processed.idempotencyKey) {
-                const winner = await this.repo.findByIdempotencyKey(orgId, processed.idempotencyKey, ctx);
-                if (winner)
-                    return Ok(await this.hydrateOrder(winner, ctx));
+                const winner = await this.repo.findByIdempotencyKey(orgId, processed.idempotencyKey, idempotencyScope, ctx);
+                if (winner) {
+                    return this.authorizedReplay(winner, actor, ctx, opts?.guestCredential);
+                }
             }
             throw error;
         }
@@ -228,49 +367,39 @@ export class OrderService {
         const report = await runAfterHooks(afterHooks, null, hydrated, "create", hookCtx);
         return Ok(hydrated, report.hasErrors ? { hookErrors: report.errors } : undefined);
     }
-    async getById(id, actor, ctx) {
-        const orgId = resolveOrgId(actor);
+    async getById(id, actor, ctx, guestCredential) {
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const order = await this.repo.findById(orgId, id, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
-        try {
-            if (actor?.permissions.includes("orders:read") ||
-                actor?.permissions.includes("*:*")) {
-                // no-op
-            }
-            else if (actor?.permissions.includes("orders:read:own")) {
-                assertOwnership(actor, order.customerId ?? null);
-            }
-            else {
-                assertPermission(actor, "orders:read");
-            }
-        }
-        catch (error) {
-            return Err(toCommerceError(error));
-        }
+        const access = await this.authorizeOrderRead(order, actor, ctx, guestCredential);
+        if (!access.ok)
+            return access;
         const hydrated = await this.hydrateOrder(order, ctx);
         // Run afterGet hooks — allows plugins to enrich the order (e.g., vendor fulfillment)
         const afterGetHooks = this.deps.hooks.resolve("orders.afterGet");
         if (afterGetHooks.length > 0) {
-            const hookCtx = context(actor, this.deps.services, this.deps.database, ctx?.tx);
+            const hookCtx = context(actor, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
             await runAfterHooks(afterGetHooks, null, hydrated, "read", hookCtx);
         }
         return Ok(hydrated);
     }
-    async getByNumber(orderNumber, actor, ctx) {
-        const orgId = resolveOrgId(actor);
+    async getByNumber(orderNumber, actor, ctx, guestCredential) {
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const order = await this.repo.findByOrderNumber(orgId, orderNumber, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
-        return this.getById(order.id, actor, ctx);
+        return this.getById(order.id, actor, ctx, guestCredential);
     }
     /** Returns the order previously created with this idempotency key, or null. */
-    async getByIdempotencyKey(idempotencyKey, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
-        const order = await this.repo.findByIdempotencyKey(orgId, idempotencyKey, ctx);
+    async getByIdempotencyKey(idempotencyKey, actor, ctx, guestCredential) {
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
+        const resolvedActor = actor ?? ctx?.actor ?? null;
+        const idempotencyScope = await makeIdempotencyScope(resolvedActor, guestCredential);
+        const order = await this.repo.findByIdempotencyKey(orgId, idempotencyKey, idempotencyScope, ctx);
         if (!order)
             return Ok(null);
-        return Ok(await this.hydrateOrder(order, ctx));
+        return this.authorizedReplay(order, actor ?? ctx?.actor ?? null, ctx, guestCredential);
     }
     async list(params, actor, ctx) {
         try {
@@ -279,7 +408,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         let items;
         if (params.status) {
             items = await this.repo.findByStatus(orgId, params.status, ctx);
@@ -297,7 +426,7 @@ export class OrderService {
         });
     }
     async listByCustomer(customerId, params, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         let items = await this.repo.findByCustomerId(orgId, customerId, ctx);
         if (params.status) {
             items = items.filter((order) => order.status === params.status);
@@ -342,7 +471,7 @@ export class OrderService {
         if (term.length < 3) {
             return Ok({ items: [], hint: "Enter at least 3 characters to search." });
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const rows = await this.repo.lookup(orgId, term, opts, ctx);
         const items = rows.map((r) => ({
             id: r.id,
@@ -361,7 +490,7 @@ export class OrderService {
         return Ok({ items });
     }
     async changeStatus(input, actor, ctx) {
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const order = await this.repo.findById(orgId, input.orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -376,7 +505,7 @@ export class OrderService {
         }
         const beforeHooks = this.deps.hooks.resolve("orders.beforeStatusChange");
         const afterHooks = this.deps.hooks.resolve("orders.afterStatusChange");
-        const hookCtx = context(actor, this.deps.services, this.deps.database, ctx?.tx);
+        const hookCtx = context(actor, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
         const statusHookInput = {
             orderId: order.id,
             fromStatus: order.status,
@@ -562,7 +691,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const found = await this.repo.findWithLineItems(orgId, orderId, ctx);
         if (!found)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -662,7 +791,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const refund = await this.repo.findRefundById(orgId, refundId, ctx);
         if (!refund || refund.orderId !== orderId) {
             return Err(new CommerceNotFoundError("Refund not found."));
@@ -704,7 +833,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const order = await this.repo.findById(orgId, orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -718,7 +847,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const policies = await this.refundPolicies(orgId, ctx);
         const usedToday = await this.repo.sumRefundsByOperatorToday(orgId, actor?.userId ?? "system", policies.timezone, ctx);
         return Ok({
@@ -735,7 +864,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const order = await this.repo.findById(orgId, orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -831,7 +960,7 @@ export class OrderService {
      * payment operation, not a fulfillment one.
      */
     async capture(orderId, actor, opts, ctx) {
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
         const order = await this.repo.findById(orgId, orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -870,7 +999,7 @@ export class OrderService {
         return Ok(hydrated);
     }
     async getStatusHistory(orderId, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const order = await this.repo.findById(orgId, orderId, ctx);
         if (!order) {
             return Err(new CommerceNotFoundError("Order not found."));
@@ -924,7 +1053,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const order = await this.repo.findById(orgId, orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -989,7 +1118,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const order = await this.repo.findById(orgId, orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -1022,7 +1151,7 @@ export class OrderService {
         catch (error) {
             return Err(toCommerceError(error));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const order = await this.repo.findById(orgId, orderId, ctx);
         if (!order)
             return Err(new CommerceNotFoundError("Order not found."));
@@ -1044,7 +1173,7 @@ export class OrderService {
         return Ok(await this.recalcOrderTotals(order, actor, "line_item_removed", ctx));
     }
     async updateOrder(orderId, data, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const order = await this.repo.findById(orgId, orderId, ctx);
         if (!order) {
             return Err(new CommerceNotFoundError("Order not found."));

package/dist/modules/pricing/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/module.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE;QACP,UAAU,EAAE,iBAAiB,CAAC;KAC/B,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,aAAa;YACd,OAAO,MAAM;oBAAkB,OAAO,cAAc;qCAe9D,CAAC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/module.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE;QACP,UAAU,EAAE,iBAAiB,CAAC;KAC/B,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,aAAa;YACd,OAAO,MAAM;oBAAkB,OAAO,cAAc;qCAgB9D,CAAC"}

package/dist/modules/pricing/module.js

@@ -10,6 +10,7 @@ export const pricingModule = defineModule({
         repository: new PricingRepository(deps.db.db),
         catalogRepository: deps.services.catalog.repository,
         hooks: deps.hooks,
+        config: deps.config,
         services: deps.services,
         database: deps.db,
     }),

package/dist/modules/pricing/schema.d.ts

@@ -104,6 +104,23 @@ export declare const prices: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        compareAtAmount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "compare_at_amount";
+            tableName: "prices";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         customerGroupId: import("drizzle-orm/pg-core").PgColumn<{
             name: "customer_group_id";
             tableName: "prices";

package/dist/modules/pricing/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiClB,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+B1B,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/schema.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkClB,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+B1B,CAAC"}

package/dist/modules/pricing/schema.js

@@ -12,6 +12,7 @@ export const prices = pgTable("prices", {
     variantId: uuid("variant_id").references(() => variants.id, { onDelete: "cascade" }),
     currency: text("currency").notNull(),
     amount: integer("amount").notNull(),
+    compareAtAmount: integer("compare_at_amount"),
     customerGroupId: text("customer_group_id"),
     minQuantity: integer("min_quantity"),
     maxQuantity: integer("max_quantity"),

package/dist/modules/pricing/schemas.d.ts

@@ -4,6 +4,7 @@ export declare const SetBasePriceBodySchema: z.ZodObject<{
     variantId: z.ZodOptional<z.ZodString>;
     currency: z.ZodString;
     amount: z.ZodNumber;
+    compareAtAmount: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     customerGroupId: z.ZodOptional<z.ZodString>;
     minQuantity: z.ZodOptional<z.ZodNumber>;
     maxQuantity: z.ZodOptional<z.ZodNumber>;

package/dist/modules/pricing/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAItC,eAAO,MAAM,sBAAsB;;;;;;;;;;;iBAWF,CAAC;AAElC,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;iBAeF,CAAC;AAIpC,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACvE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAItC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAYF,CAAC;AAElC,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;iBAeF,CAAC;AAIpC,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACvE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/modules/pricing/schemas.js

@@ -5,6 +5,7 @@ export const SetBasePriceBodySchema = z.object({
     variantId: z.string().optional().openapi({ example: "variant-uuid" }),
     currency: z.string().length(3).openapi({ example: "USD" }),
     amount: z.number().openapi({ example: 29.99 }),
+    compareAtAmount: z.number().nullable().optional(),
     customerGroupId: z.string().optional(),
     minQuantity: z.number().int().optional(),
     maxQuantity: z.number().int().optional(),

package/dist/modules/pricing/service.d.ts

@@ -1,4 +1,5 @@
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 import type { DatabaseAdapter } from "../../kernel/database/adapter.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import type { HookRegistry } from "../../kernel/hooks/registry.js";
@@ -10,6 +11,7 @@ interface PricingServiceDeps {
     repository: PricingRepository;
     catalogRepository: CatalogRepository;
     hooks: HookRegistry;
+    config: CommerceConfig;
     services: Record<string, unknown>;
     database: DatabaseAdapter;
 }

package/dist/modules/pricing/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAOrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EACV,iBAAiB,EACjB,KAAK,EACL,aAAa,EAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,gBAAgB,GAChB,QAAQ,GACR,UAAU,CAAC;AAEf,UAAU,kBAAkB;IAC1B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAkBD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,KAAK,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,iBAAiB,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAuGhF,qBAAa,cAAc;IAIb,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,kBAAkB;IAKtC,YAAY,CAChB,KAAK,EAAE,iBAAiB,EACxB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAoEnB,cAAc,CAClB,KAAK,EAAE,wBAAwB,EAC/B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAwD3B,aAAa,CACjB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACnE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAgB7B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;QACpC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAChD,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAuB3B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAU/B,UAAU,CACd,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,SAAS,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC,CAAC;IAuD7D,OAAO,CACX,KAAK,EAAE,sBAAsB,EAC7B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAqLlC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAOrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EACV,iBAAiB,EACjB,KAAK,EACL,aAAa,EAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,gBAAgB,GAChB,QAAQ,GACR,UAAU,CAAC;AAEf,UAAU,kBAAkB;IAC1B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAoBD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,KAAK,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,iBAAiB,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAuGhF,qBAAa,cAAc;IAIb,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,kBAAkB;IAKtC,YAAY,CAChB,KAAK,EAAE,iBAAiB,EACxB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAsEnB,cAAc,CAClB,KAAK,EAAE,wBAAwB,EAC/B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAqD3B,aAAa,CACjB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACnE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAgB7B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;QACpC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAChD,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAuB3B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAU/B,UAAU,CACd,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,SAAS,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC,CAAC;IAuD7D,OAAO,CACX,KAAK,EAAE,sBAAsB,EAC7B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAqLlC"}