@porulle/core 0.10.8 → 0.13.0

package/dist/modules/settings/service.js

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok } from "../../kernel/result.js";
 const GROUP_NAME_RE = /^[a-z][a-z0-9_-]*$/;
@@ -11,8 +11,10 @@ const GROUP_NAME_RE = /^[a-z][a-z0-9_-]*$/;
  */
 export class SettingsService {
     repository;
+    config;
     constructor(deps) {
         this.repository = deps.repository;
+        this.config = deps.config;
     }
     /** Runtime read for plugins/hooks. Unset groups read as `{}`. */
     async read(orgId, group, ctx) {
@@ -20,11 +22,11 @@ export class SettingsService {
         return row?.value ?? {};
     }
     async getGroup(group, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         return Ok(await this.read(orgId, group, ctx));
     }
     async getAll(actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         const rows = await this.repository.findAll(orgId, ctx);
         const all = {};
         for (const row of rows)
@@ -36,7 +38,7 @@ export class SettingsService {
         if (!GROUP_NAME_RE.test(group)) {
             return Err(new CommerceValidationError("Settings group must match [a-z][a-z0-9_-]* (e.g. general, branding, policies)."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         const current = await this.read(orgId, group, ctx);
         const next = { ...current };
         for (const [key, value] of Object.entries(patch)) {

package/dist/modules/shipping/service.js

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok } from "../../kernel/result.js";
 import { calculateShippingCost, computeShippableWeightGrams, } from "./calculator.js";
@@ -83,7 +83,7 @@ export class ShippingService {
         if (input.countries.length === 0) {
             return Err(new CommerceValidationError("A shipping zone requires at least one country (\"*\" matches any)."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const zone = await this.deps.repository.createZone({
             organizationId: orgId,
             name: input.name,
@@ -95,11 +95,11 @@ export class ShippingService {
         return Ok(zone);
     }
     async listZones(actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         return Ok(await this.deps.repository.findZones(orgId, ctx));
     }
     async updateZone(id, patch, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const existing = await this.deps.repository.findZoneById(orgId, id, ctx);
         if (!existing)
             return Err(new CommerceNotFoundError("Shipping zone not found."));
@@ -117,7 +117,7 @@ export class ShippingService {
         return Ok(updated);
     }
     async deleteZone(id, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const existing = await this.deps.repository.findZoneById(orgId, id, ctx);
         if (!existing)
             return Err(new CommerceNotFoundError("Shipping zone not found."));
@@ -125,7 +125,7 @@ export class ShippingService {
         return Ok({ deleted: true });
     }
     async createRate(input, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const zone = await this.deps.repository.findZoneById(orgId, input.zoneId, ctx);
         if (!zone)
             return Err(new CommerceNotFoundError("Shipping zone not found."));
@@ -145,11 +145,11 @@ export class ShippingService {
         return Ok(rate);
     }
     async listRates(filter, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         return Ok(await this.deps.repository.findRates(orgId, filter?.zoneId !== undefined ? { zoneId: filter.zoneId } : undefined, ctx));
     }
     async updateRate(id, patch, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const existing = await this.deps.repository.findRateById(orgId, id, ctx);
         if (!existing)
             return Err(new CommerceNotFoundError("Shipping rate not found."));
@@ -169,7 +169,7 @@ export class ShippingService {
         return Ok(updated);
     }
     async deleteRate(id, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const existing = await this.deps.repository.findRateById(orgId, id, ctx);
         if (!existing)
             return Err(new CommerceNotFoundError("Shipping rate not found."));

package/dist/modules/tax/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/tax/module.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,eAAO,MAAM,SAAS;cACR,OAAO,QAAQ;gBAAc,OAAO,UAAU;qCAW1D,CAAC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/tax/module.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,eAAO,MAAM,SAAS;cACR,OAAO,QAAQ;gBAAc,OAAO,UAAU;qCAY1D,CAAC"}

package/dist/modules/tax/module.js

@@ -8,5 +8,6 @@ export const taxModule = defineModule({
     service: (deps) => new TaxService({
         adapter: deps.config.tax?.adapter,
         repository: new TaxRatesRepository(deps.db.db),
+        config: deps.config,
     }),
 });

package/dist/modules/tax/service.d.ts

@@ -1,4 +1,5 @@
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import { type Result } from "../../kernel/result.js";
 import type { TaxAdapter, TaxCalculationParams, TaxCalculationResult, TaxReportParams, TaxVoidParams } from "./adapter.js";
@@ -6,10 +7,12 @@ import type { TaxClass, TaxRate, TaxRatesRepository } from "./repository/index.j
 interface TaxServiceDeps {
     adapter: TaxAdapter | undefined;
     repository?: TaxRatesRepository;
+    config: CommerceConfig;
 }
 export declare class TaxService {
     private adapter;
     private repository;
+    private config;
     constructor(deps: TaxServiceDeps);
     /**
      * Calculates tax. Resolution order:

package/dist/modules/tax/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/tax/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,aAAa,EACd,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEnF,UAAU,cAAc;IACtB,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,UAAU,CAAiC;gBAEvC,IAAI,EAAE,cAAc;IAKhC;;;;;;;;;;;OAWG;IACG,SAAS,CACb,MAAM,EAAE,oBAAoB,EAC5B,KAAK,CAAC,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAuDxC,0EAA0E;YAC5D,kBAAkB;IAoE1B,cAAc,CAClB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,EACzG,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAqBtB,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAOlF,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,EACnI,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAoBtB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;YAU7F,iBAAiB;IAoBzB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAKtF,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAKxF,iBAAiB,IAAI,MAAM,CAAC,UAAU,CAAC;IASvC,OAAO,CAAC,iBAAiB;IAOnB,aAAa,CACjB,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAChC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAuBrB,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAO/E,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QAClC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAChC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAwBrB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAS3G"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/tax/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,aAAa,EACd,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEnF,UAAU,cAAc;IACtB,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,MAAM,CAAiB;gBAEnB,IAAI,EAAE,cAAc;IAMhC;;;;;;;;;;;OAWG;IACG,SAAS,CACb,MAAM,EAAE,oBAAoB,EAC5B,KAAK,CAAC,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAuDxC,0EAA0E;YAC5D,kBAAkB;IAoE1B,cAAc,CAClB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,EACzG,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAqBtB,cAAc,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAOlF,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,EACnI,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAoBtB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;YAU7F,iBAAiB;IAoBzB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAKtF,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAKxF,iBAAiB,IAAI,MAAM,CAAC,UAAU,CAAC;IASvC,OAAO,CAAC,iBAAiB;IAOnB,aAAa,CACjB,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAChC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAuBrB,YAAY,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAO/E,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QAClC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;KAChC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAwBrB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAS3G"}

package/dist/modules/tax/service.js

@@ -1,12 +1,14 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok } from "../../kernel/result.js";
 export class TaxService {
     adapter;
     repository;
+    config;
     constructor(deps) {
         this.adapter = deps.adapter;
         this.repository = deps.repository;
+        this.config = deps.config;
     }
     /**
      * Calculates tax. Resolution order:
@@ -117,7 +119,7 @@ export class TaxService {
         if (input.rateBps < 0) {
             return Err(new CommerceValidationError("rateBps must be non-negative."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         if (input.isDefault)
             await repo.value.clearDefaultClass(orgId, ctx);
         const created = await repo.value.createClass({
@@ -133,14 +135,14 @@ export class TaxService {
         const repo = this.requireRepository();
         if (!repo.ok)
             return repo;
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         return Ok(await repo.value.findAllClasses(orgId, ctx));
     }
     async updateTaxClass(id, patch, actor, ctx) {
         const repo = this.requireRepository();
         if (!repo.ok)
             return repo;
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         const existing = await repo.value.findClassById(orgId, id, ctx);
         if (!existing)
             return Err(new CommerceNotFoundError("Tax class not found."));
@@ -158,7 +160,7 @@ export class TaxService {
         const repo = this.requireRepository();
         if (!repo.ok)
             return repo;
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         const existing = await repo.value.findClassById(orgId, id, ctx);
         if (!existing)
             return Err(new CommerceNotFoundError("Tax class not found."));
@@ -207,7 +209,7 @@ export class TaxService {
         if (input.rateBps < 0) {
             return Err(new CommerceValidationError("rateBps must be non-negative."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         const rate = await repo.value.create({
             organizationId: orgId,
             name: input.name,
@@ -224,14 +226,14 @@ export class TaxService {
         const repo = this.requireRepository();
         if (!repo.ok)
             return repo;
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         return Ok(await repo.value.findAll(orgId, ctx));
     }
     async updateTaxRate(id, patch, actor, ctx) {
         const repo = this.requireRepository();
         if (!repo.ok)
             return repo;
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         const existing = await repo.value.findById(orgId, id, ctx);
         if (!existing)
             return Err(new CommerceNotFoundError("Tax rate not found."));
@@ -252,7 +254,7 @@ export class TaxService {
         const repo = this.requireRepository();
         if (!repo.ok)
             return repo;
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
         const existing = await repo.value.findById(orgId, id, ctx);
         if (!existing)
             return Err(new CommerceNotFoundError("Tax rate not found."));

package/dist/modules/webhooks/hook.js

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 /**
  * Webhook delivery hook — enqueues delivery jobs instead of blocking.
  *
@@ -15,7 +15,7 @@ export const deliverWebhooks = async ({ result, operation, context }) => {
     // VAPT r2 (codex) finding: fan-out queried ALL endpoints across the
     // database, so Tenant B's webhooks fired on Tenant A's events —
     // payload-level cross-tenant data leak. Now scoped to the actor's org.
-    const orgId = resolveOrgId(context.actor);
+    const orgId = resolveOrgIdForCommerce(context.actor, context.commerceConfig);
     const endpoints = await webhooksService.getEndpointsForEvent(eventName, orgId);
     if (!endpoints.ok)
         return;

package/dist/modules/webhooks/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/module.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAO9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAWzB,CAAC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/module.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAO9C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAYzB,CAAC"}

package/dist/modules/webhooks/module.js

@@ -11,5 +11,6 @@ export const webhooksModule = defineModule({
     }),
     service: (deps) => new WebhookService({
         repository: new WebhooksRepository(deps.db.db),
+        config: deps.config,
     }),
 });

package/dist/modules/webhooks/service.d.ts

@@ -1,9 +1,11 @@
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 import { type Result } from "../../kernel/result.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import type { WebhooksRepository, WebhookEndpoint } from "./repository/index.js";
 interface WebhookServiceDeps {
     repository: WebhooksRepository;
+    config: CommerceConfig;
 }
 export declare class WebhookService {
     private deps;

package/dist/modules/webhooks/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA4CjF,UAAU,kBAAkB;IAC1B,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,qBAAa,cAAc;IAGb,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAEtB,IAAI,EAAE,kBAAkB;IAItC,cAAc,CAClB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAyB7B,aAAa,CACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAM/B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAWlB,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;CAItC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA4CjF,UAAU,kBAAkB;IAC1B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,qBAAa,cAAc;IAGb,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAEtB,IAAI,EAAE,kBAAkB;IAItC,cAAc,CAClB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAyB7B,aAAa,CACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAM/B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAWlB,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;CAItC"}

package/dist/modules/webhooks/service.js

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok } from "../../kernel/result.js";
 /**
@@ -62,7 +62,7 @@ export class WebhookService {
         if (isPrivateUrl(input.url)) {
             return Err(new CommerceValidationError("Webhook URL must not point to a private or internal address."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const endpoint = await this.repo.createEndpoint({
             organizationId: orgId,
             url: input.url,
@@ -74,12 +74,12 @@ export class WebhookService {
         return Ok(endpoint);
     }
     async listEndpoints(actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const endpoints = await this.repo.findAllEndpoints(orgId, ctx);
         return Ok(endpoints);
     }
     async deleteEndpoint(id, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const existing = await this.repo.findEndpointById(id, orgId, ctx);
         if (!existing) {
             return Err(new CommerceNotFoundError("Webhook endpoint not found."));

package/dist/runtime/kernel-modules.d.ts

@@ -764,6 +764,57 @@ export declare const KERNEL_ALL_MODULES: {
                 }, {}, {
                     $type: Record<string, unknown>;
                 }>;
+                origin: import("drizzle-orm/pg-core").PgColumn<{
+                    name: "origin";
+                    tableName: "media_assets";
+                    dataType: "string";
+                    columnType: "PgEnumColumn";
+                    data: "generated" | "merchant" | "imported";
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: true;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: ["merchant", "generated", "imported"];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                confidence: import("drizzle-orm/pg-core").PgColumn<{
+                    name: "confidence";
+                    tableName: "media_assets";
+                    dataType: "string";
+                    columnType: "PgNumeric";
+                    data: string;
+                    driverParam: string;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                derivedFromAssetId: import("drizzle-orm/pg-core").PgColumn<{
+                    name: "derived_from_asset_id";
+                    tableName: "media_assets";
+                    dataType: "string";
+                    columnType: "PgUUID";
+                    data: string;
+                    driverParam: string;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
                 uploadedAt: import("drizzle-orm/pg-core").PgColumn<{
                     name: "uploaded_at";
                     tableName: "media_assets";
@@ -873,6 +924,23 @@ export declare const KERNEL_ALL_MODULES: {
                     identity: undefined;
                     generated: undefined;
                 }, {}, {}>;
+                createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                    name: "created_at";
+                    tableName: "entity_media";
+                    dataType: "date";
+                    columnType: "PgTimestamp";
+                    data: Date;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: true;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
             };
             dialect: "pg";
         }>;
@@ -1653,14 +1721,19 @@ export declare const KERNEL_ALL_MODULES: {
         sellableEntities: typeof import("../modules/catalog/schema.js").sellableEntities;
         sellableAttributes: typeof import("../modules/catalog/schema.js").sellableAttributes;
         sellableCustomFields: typeof import("../modules/catalog/schema.js").sellableCustomFields;
+        entityFieldDefinitions: typeof import("../modules/catalog/schema.js").entityFieldDefinitions;
+        sellableEntityRevisions: typeof import("../modules/catalog/schema.js").sellableEntityRevisions;
         categories: typeof import("../modules/catalog/schema.js").categories;
         entityCategories: typeof import("../modules/catalog/schema.js").entityCategories;
         brands: typeof import("../modules/catalog/schema.js").brands;
         entityBrands: typeof import("../modules/catalog/schema.js").entityBrands;
+        tags: typeof import("../modules/catalog/schema.js").tags;
+        entityTags: typeof import("../modules/catalog/schema.js").entityTags;
         optionTypes: typeof import("../modules/catalog/schema.js").optionTypes;
         optionValues: typeof import("../modules/catalog/schema.js").optionValues;
         variants: typeof import("../modules/catalog/schema.js").variants;
         variantOptionValues: typeof import("../modules/catalog/schema.js").variantOptionValues;
+        catalogFieldOwnership: typeof import("../modules/catalog/schema.js").catalogFieldOwnership;
     }, import("../modules/catalog/service.js").CatalogServiceImpl, {
         pricing: import("../modules/pricing/service.js").PricingService;
     }>;

package/dist/runtime/kernel-modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kernel-modules.d.ts","sourceRoot":"","sources":["../../src/runtime/kernel-modules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB3D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoBrB,CAAC;AAEX,2FAA2F;AAC3F,wBAAgB,wBAAwB,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAoBpE;AAED,wBAAgB,8BAA8B,IAAI,SAAS,MAAM,EAAE,CAElE"}
+{"version":3,"file":"kernel-modules.d.ts","sourceRoot":"","sources":["../../src/runtime/kernel-modules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB3D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoBrB,CAAC;AAEX,2FAA2F;AAC3F,wBAAgB,wBAAwB,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAoBpE;AAED,wBAAgB,8BAA8B,IAAI,SAAS,MAAM,EAAE,CAElE"}

package/dist/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAOzD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAcvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAyVxB,MAAM,UAAU,MAAM;GA2FtD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AASzD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAcvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAiWxB,MAAM,UAAU,MAAM;GA6FtD"}

package/dist/runtime/server.js

@@ -7,12 +7,15 @@ import { rateLimiter } from "hono-rate-limiter";
 import { createHash } from "node:crypto";
 import { createClientIpResolver } from "./client-ip.js";
 import { authMiddleware } from "../auth/middleware.js";
+import { organizationGuard } from "../auth/organization-guard.js";
 import { CommerceCsrfError } from "../kernel/errors.js";
 import { createRestRoutes } from "../interfaces/rest/index.js";
 import { createCustomerPortalRoutes } from "../interfaces/rest/customer-portal.js";
 import { createCommerce } from "./commerce.js";
 import { rewriteCommerceAliasRequest } from "./url-alias-rewrite.js";
 import { mapErrorToResponse } from "../kernel/error-mapper.js";
+import { assertRouteCoverage } from "../interfaces/rest/route-coverage.js";
+import { markRoutePermissionGuard } from "../interfaces/rest/utils.js";
 /**
  * Returns true if running in a Node-like runtime that supports
  * `process.on()` + `process.exit()`. Edge runtimes (Cloudflare Workers,
@@ -265,6 +268,10 @@ export async function createServer(config) {
         }
     }
     // ─── Auth ──────────────────────────────────────────────────────────
+    // Better Auth's organization endpoints are mounted below but governed here:
+    // `admin/staff.ts` owns membership, and this guard keeps the plugin's own
+    // paths from minting members outside those rules.
+    app.use("/api/auth/organization/*", organizationGuard(kernel.database.db, config));
     app.use("/api/auth/*", async (c, next) => {
         if (c.req.path.startsWith("/api/auth/pos/")) {
             await next();
@@ -367,7 +374,7 @@ export async function createServer(config) {
     // Strategy 1: Built-in cron endpoint for serverless deployments.
     // Point Vercel Cron or Cloudflare Cron Trigger at GET /api/jobs/run
     // Optional query params: ?queue=emails&limit=20
-    app.get("/api/jobs/run", async (c) => {
+    app.get("/api/jobs/run", markRoutePermissionGuard(async (c) => {
         // Always require admin — cron triggers must authenticate
         const actor = c.get("actor");
         if (!actor?.permissions?.includes("*:*")) {
@@ -383,7 +390,7 @@ export async function createServer(config) {
             logger.error({ err }, "Job runner endpoint failed");
             return c.json({ error: { code: "INTERNAL_ERROR", message: "Job processing failed" } }, 500);
         }
-    });
+    }));
     // Strategy 2: In-process polling for long-running servers (ECS, Cloud Run, Docker).
     // Enable via config.jobs.autorun.enabled = true
     if (config.jobs?.autorun?.enabled) {
@@ -413,6 +420,7 @@ export async function createServer(config) {
                 "or set config.jobs.autorun.enabled = true for in-process polling.");
         }
     }
+    assertRouteCoverage(app);
     const dispatchFetch = app.fetch.bind(app);
     app.fetch = ((input, env, executionCtx) => {
         const req = input instanceof Request ? input : new Request(input);

package/dist/test-utils/create-pglite-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA0BxE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CA+DD"}
+{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA0BxE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqFD"}

package/dist/test-utils/create-pglite-adapter.js

@@ -62,21 +62,43 @@ export async function createPGliteTestAdapter() {
     /**
      * PGlite-compatible transaction wrapper.
      *
-     * Drizzle's transaction() method can hang with PGlite due to how
-     * the adapter manages transaction state. This implementation uses
-     * manual BEGIN/COMMIT control which works more reliably.
+     * Drizzle's transaction() method can hang with PGlite due to how the adapter
+     * manages transaction state, so this drives BEGIN/COMMIT manually.
+     *
+     * PGlite is a single connection, so two transaction bodies awaiting
+     * concurrently would otherwise interleave their statements between one
+     * BEGIN and one COMMIT — the second BEGIN is a no-op Postgres only warns
+     * about. Merged that way, two callers share a snapshot and hold each other's
+     * row locks, so an isolation bug reads as if the guard failed. Bodies are
+     * queued instead, which is what a connection pool would do to two
+     * transactions competing for the same rows.
+     *
+     * A nested call joins the transaction already open rather than deadlocking
+     * on the queue; without savepoints that is the only sound reading.
      */
+    let transactionQueue = Promise.resolve();
+    let inTransaction = false;
     async function transaction(fn) {
-        await pg.exec("BEGIN");
-        try {
-            const result = await fn(db);
-            await pg.exec("COMMIT");
-            return result;
-        }
-        catch (error) {
-            await pg.exec("ROLLBACK");
-            throw error;
-        }
+        if (inTransaction)
+            return fn(db);
+        const run = transactionQueue.then(async () => {
+            inTransaction = true;
+            await pg.exec("BEGIN");
+            try {
+                const result = await fn(db);
+                await pg.exec("COMMIT");
+                return result;
+            }
+            catch (error) {
+                await pg.exec("ROLLBACK");
+                throw error;
+            }
+            finally {
+                inTransaction = false;
+            }
+        });
+        transactionQueue = run.catch(() => undefined);
+        return run;
     }
     const adapter = {
         provider: "postgresql",

package/dist/test-utils/create-test-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAiHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}
+{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAqHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}

package/dist/test-utils/create-test-config.js

@@ -67,11 +67,13 @@ export async function createTestConfig(overrides = {}) {
                         "catalog:update",
                         "catalog:delete",
                         "catalog:read",
+                        "catalog:read:unpublished",
                         "inventory:adjust",
                         "orders:create",
                         "orders:read",
                         "orders:update",
                         "orders:manage",
+                        "orders:create:on-behalf",
                         "cart:create",
                         "cart:update",
                         "customers:update:self",
@@ -80,10 +82,12 @@ export async function createTestConfig(overrides = {}) {
                 ai_agent: {
                     permissions: [
                         "catalog:read",
+                        "catalog:read:unpublished",
                         "catalog:create",
                         "inventory:read",
                         "inventory:adjust",
                         "orders:read",
+                        "orders:create:on-behalf",
                         "cart:create",
                         "cart:update",
                     ],

package/dist/test-utils/rest-api-test-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAoCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}
+{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAsCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}

package/dist/test-utils/rest-api-test-utils.js

@@ -125,9 +125,11 @@ export const testActor = {
         "catalog:create",
         "catalog:update",
         "catalog:read",
+        "catalog:read:unpublished",
         "inventory:adjust",
         "inventory:read",
         "orders:create",
+        "orders:create:on-behalf",
         "orders:read",
         "orders:update",
         "orders:manage",

package/dist/test-utils/test-actors.js

@@ -27,8 +27,8 @@ export const testStaffActor = {
     organizationId: TEST_ORG_ID,
     role: "staff",
     permissions: [
-        "catalog:read", "catalog:create", "catalog:update",
-        "inventory:adjust", "orders:read", "orders:create", "orders:update", "orders:manage",
+        "catalog:read", "catalog:read:unpublished", "catalog:create", "catalog:update",
+        "inventory:adjust", "orders:read", "orders:create", "orders:create:on-behalf", "orders:update", "orders:manage",
     ],
 };
 /** Customer with minimal read/write-own permissions. */