@porulle/core 0.10.8 → 0.13.0

package/src/modules/orders/service.ts

@@ -1,7 +1,11 @@
-import { resolveOrgId } from "../../auth/org.js";
-import { assertOwnership, assertPermission } from "../../auth/permissions.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
+import { assertOwnership, assertPermission, hasPermission } from "../../auth/permissions.js";
 import type { Actor } from "../../auth/types.js";
+import { defaultGuestOrderAccess } from "./guest-access.js";
+import type { CommerceConfig } from "../../config/types.js";
+import { isCatalogEntityVisible } from "../catalog/read-policy.js";
 import {
+  CommerceConflictError,
   CommerceForbiddenError,
   CommerceInvalidTransitionError,
   CommerceNotFoundError,
@@ -25,6 +29,7 @@ import {
 } from "../../kernel/state-machine/machine.js";
 import { Err, Ok, type Result } from "../../kernel/result.js";
 import { createLogger } from "../../utils/logger.js";
+import { makeIdempotencyScope } from "../../utils/id.js";
 import { paginate, type Pagination } from "../../utils/pagination.js";
 import {
   withTransaction,
@@ -99,12 +104,20 @@ export interface ChangeStatusInput {
 export interface OrderServiceDeps {
   repository: OrdersRepository;
   hooks: HookRegistry;
+  config: CommerceConfig;
   services: Record<string, unknown>;
   /** Custom state machine. If provided, overrides the default order transitions. */
   stateMachine?: StateDefinition<string>;
   database: DatabaseAdapter;
 }
 
+export interface CreateOrderOptions {
+  trustedPricing?: boolean;
+  stockPolicy?: "reserve" | "backorder";
+  /** Credential presented by a guest cart owner for idempotent replay. */
+  guestCredential?: string;
+}
+
 export type HydratedOrder = Order & { lineItems: OrderLineItem[] };
 type OrderListResult = {
   items: HydratedOrder[];
@@ -126,6 +139,7 @@ function context(
   actor: Actor | null,
   services: Record<string, unknown>,
   database: DatabaseAdapter,
+  config: CommerceConfig,
   tx: unknown = null,
 ): HookContext {
   return createHookContext({
@@ -136,6 +150,7 @@ function context(
     ...(services.jobs ? { jobs: services.jobs as JobsAdapter } : {}),
     context: { moduleName: "orders" },
     database: { db: database.db as PluginDb },
+    commerceConfig: config,
   });
 }
 
@@ -182,14 +197,18 @@ export class OrderService {
       }
     }
     const catalog = this.deps.services.catalog as {
-      getById(
+      getByIdForInternalUse(
         id: string,
-        options: Record<string, unknown>,
-        actor?: Actor | null,
+        organizationId: string,
+        options?: Record<string, unknown>,
         ctx?: TxContext,
       ): Promise<{
         ok: boolean;
-        value?: { variants?: Array<{ id: string }> };
+        value?: {
+          status?: string;
+          isVisible?: boolean;
+          variants?: Array<{ id: string }>;
+        };
       }>;
     };
     const pricing = this.deps.services.pricing as {
@@ -210,13 +229,25 @@ export class OrderService {
     > = [];
     for (const item of input.lineItems) {
       // Org-integrity — the referenced entity must belong to this order's org.
-      const owned = await catalog.getById(
+      // This is an internal invariant check, so it reads past the storefront
+      // visibility policy; unprivileged buyers are gated in the same branch.
+      const owned = await catalog.getByIdForInternalUse(
         item.entityId,
+        resolveOrgIdForCommerce(actor, this.deps.config),
         { includeVariants: item.variantId !== undefined },
-        actor,
         ctx,
       );
-      if (!owned.ok) {
+      if (
+        !owned.ok ||
+        !owned.value ||
+        !isCatalogEntityVisible(
+          {
+            status: owned.value?.status ?? "draft",
+            isVisible: owned.value?.isVisible ?? false,
+          },
+          actor,
+        )
+      ) {
         return Err(
           new CommerceValidationError(
             `Line item entity ${item.entityId} does not belong to this organization.`,
@@ -266,11 +297,180 @@ export class OrderService {
     return Ok(resolved);
   }
 
+  private async resolveCreateCustomerId(
+    requestedCustomerId: string | undefined,
+    actor: Actor | null,
+    ctx?: TxContext,
+  ): Promise<string | undefined> {
+    // API keys are the documented POS operator actor. Keep this as an actor
+    // type predicate so self-service user actors remain unable to choose a
+    // foreign customerId even when they are authenticated.
+    const isOperator = actor?.type === "api_key";
+    if (isOperator) {
+      if (requestedCustomerId === undefined) return undefined;
+      return this.resolveRequestedCustomerId(requestedCustomerId, actor, ctx);
+    }
+
+    if (hasPermission(actor, "orders:create:on-behalf")) {
+      if (requestedCustomerId === undefined) return undefined;
+      return this.resolveRequestedCustomerId(requestedCustomerId, actor, ctx);
+    }
+
+    // `orders:read:own` is the system's existing "this actor is a shopper"
+    // marker -- it is in DEFAULT_CUSTOMER_PERMISSIONS and guards the read-own
+    // order routes. Using it here decides *attribution*, which is a proxy and is
+    // deliberately a stopgap: the honest discriminator is caller intent, which a
+    // storefront route knows and this service cannot see.
+    //
+    // Known misclassification: a dual-hatted role holding `orders:read:own` for
+    // its own personal orders, plus `orders:create`, self-attributes a walk-in
+    // sale. The proxy is tolerable only because it fails narrow -- it can attach
+    // the actor's own profile or fall through to a guest order, never expose
+    // another principal's data.
+    if (!hasPermission(actor, "orders:read:own")) return undefined;
+    if (!actor?.userId) return undefined;
+    const customers = this.deps.services.customers as
+      | {
+          getByUserId(
+            userId: string,
+            actor?: Actor | null,
+            ctx?: TxContext,
+          ): Promise<{ ok: boolean; value?: { id: string } }>;
+        }
+      | undefined;
+    if (!customers?.getByUserId) return undefined;
+    const own = await customers.getByUserId(actor.userId, actor, ctx);
+    return own.ok ? own.value?.id : undefined;
+  }
+
+  private async resolveRequestedCustomerId(
+    requestedCustomerId: string,
+    actor: Actor | null,
+    ctx?: TxContext,
+  ): Promise<string> {
+    const customers = this.deps.services.customers as
+      | {
+          getById(
+            id: string,
+            actor?: Actor | null,
+            ctx?: TxContext,
+          ): Promise<{ ok: boolean; value?: { id: string } }>;
+        }
+      | undefined;
+    const customer = await customers?.getById(requestedCustomerId, actor, ctx);
+    if (!customer?.ok || !customer.value) {
+      throw new CommerceValidationError(
+        "customerId must reference a customer in this organization.",
+      );
+    }
+    return customer.value.id;
+  }
+
+  private async authorizeOrderRead(
+    order: Order,
+    actor: Actor | null,
+    ctx?: TxContext,
+    guestCredential?: string,
+  ): Promise<Result<void>> {
+    try {
+      if (
+        actor?.permissions.includes("orders:read") ||
+        actor?.permissions.includes("*:*")
+      ) {
+        // no-op
+      } else if (actor?.permissions.includes("orders:read:own")) {
+        if (order.customerId == null) {
+          const cartId =
+            typeof order.metadata?.cartId === "string"
+              ? order.metadata.cartId
+              : undefined;
+          const cart = this.deps.services.cart as
+            | {
+                getById(
+                  id: string,
+                  actor?: Actor | null,
+                  ctx?: TxContext,
+                  secret?: string,
+                ): Promise<{ ok: boolean }>;
+              }
+            | undefined;
+          if (!cartId || !guestCredential || !cart?.getById) {
+            throw new CommerceForbiddenError("You do not have access to this resource.");
+          }
+          const guestCart = await cart.getById(
+            cartId,
+            actor,
+            ctx,
+            guestCredential,
+          );
+          if (!guestCart.ok) {
+            throw new CommerceForbiddenError("You do not have access to this resource.");
+          }
+          // The secret is genuine, but a bearer credential with no lifetime
+          // reads this order forever — and a secret leaks far more easily than
+          // it is guessed. Bound it to a window after placement, and fail with
+          // the identical error so a stale window is not an oracle telling the
+          // caller their secret is valid.
+          const guestAccess =
+            this.deps.config.orders?.guestAccessStrategy ?? defaultGuestOrderAccess;
+          if (!guestAccess.canAccessOrder(order, new Date())) {
+            throw new CommerceForbiddenError("You do not have access to this resource.");
+          }
+        } else {
+          // Older integrations may have stored the auth user ID directly as
+          // customerId. Keep that valid ownership shape while resolving the
+          // normal auth-user -> customer-profile relationship below.
+          let ownerActor = actor;
+          if (actor.userId !== order.customerId) {
+            const customers = this.deps.services.customers as
+              | {
+                  getByUserId(
+                    userId: string,
+                    actor?: Actor | null,
+                    ctx?: TxContext,
+                  ): Promise<{ ok: boolean; value?: { id: string } }>;
+                }
+              | undefined;
+            const profile = actor.userId && customers?.getByUserId
+              ? await customers.getByUserId(actor.userId, actor, ctx)
+              : { ok: false as const };
+            ownerActor = profile.ok
+              ? { ...actor, userId: profile.value!.id }
+              : actor;
+          }
+          assertOwnership(ownerActor, order.customerId);
+        }
+      } else {
+        assertPermission(actor, "orders:read");
+      }
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
+    return Ok(undefined);
+  }
+
+  private async authorizedReplay(
+    order: Order,
+    actor: Actor | null,
+    ctx?: TxContext,
+    guestCredential?: string,
+  ): Promise<Result<HydratedOrder>> {
+    const access = await this.authorizeOrderRead(order, actor, ctx, guestCredential);
+    if (!access.ok) {
+      return Err(
+        new CommerceConflictError(
+          "Idempotency key does not belong to this account.",
+        ),
+      );
+    }
+    return Ok(await this.hydrateOrder(order, ctx));
+  }
+
   async create(
     input: CreateOrderInput,
     actor: Actor | null,
     ctx?: TxContext,
-    opts?: { trustedPricing?: boolean; stockPolicy?: "reserve" | "backorder" },
+    opts?: CreateOrderOptions,
   ): Promise<Result<HydratedOrder>> {
     if (opts?.stockPolicy === "reserve" && !ctx) {
       return withTransaction(this.deps.database, { actor }, (txCtx) =>
@@ -290,22 +490,49 @@ export class OrderService {
       );
     }
 
+    let resolvedCustomerId: string | undefined;
+    try {
+      resolvedCustomerId = await this.resolveCreateCustomerId(
+        input.customerId,
+        actor,
+        ctx,
+      );
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
+    const serviceInput: CreateOrderInput = {
+      ...input,
+      ...(resolvedCustomerId !== undefined
+        ? { customerId: resolvedCustomerId }
+        : {}),
+    };
+    if (resolvedCustomerId === undefined) delete serviceInput.customerId;
+
     const beforeHooks = this.deps.hooks.resolve(
       "orders.beforeCreate",
     ) as BeforeCreateOrderHook[];
     const afterHooks = this.deps.hooks.resolve(
       "orders.afterCreate",
     ) as AfterCreateOrderHook[];
-    const hookCtx = context(actor, this.deps.services, this.deps.database, ctx?.tx);
+    const hookCtx = context(actor, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
 
     const processed = await runBeforeHooks(
       beforeHooks,
-      input,
+      serviceInput,
       "create",
       hookCtx,
     );
 
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
+    const idempotencyScope = processed.idempotencyKey
+      ? await makeIdempotencyScope(
+          actor,
+          opts?.guestCredential,
+          typeof processed.metadata?.cartId === "string"
+            ? processed.metadata.cartId
+            : undefined,
+        )
+      : undefined;
 
     // Idempotent replay: offline POS queues and network retries re-submit the
     // same create — return the original order instead of double-creating.
@@ -313,10 +540,16 @@ export class OrderService {
       const existing = await this.repo.findByIdempotencyKey(
         orgId,
         processed.idempotencyKey,
+        idempotencyScope!,
         ctx,
       );
       if (existing) {
-        return Ok(await this.hydrateOrder(existing, ctx));
+        return this.authorizedReplay(
+          existing,
+          actor,
+          ctx,
+          opts?.guestCredential,
+        );
       }
     }
 
@@ -394,6 +627,7 @@ export class OrderService {
           ...(processed.paymentIntentId != null ? { paymentIntentId: processed.paymentIntentId } : {}),
           ...(processed.paymentMethodId != null ? { paymentMethodId: processed.paymentMethodId } : {}),
           ...(processed.idempotencyKey != null ? { idempotencyKey: processed.idempotencyKey } : {}),
+          ...(idempotencyScope !== undefined ? { idempotencyScope } : {}),
           metadata: processed.metadata ?? {},
           placedAt: new Date(),
           ...(processed.customerId !== undefined
@@ -408,9 +642,17 @@ export class OrderService {
         const winner = await this.repo.findByIdempotencyKey(
           orgId,
           processed.idempotencyKey,
+          idempotencyScope!,
           ctx,
         );
-        if (winner) return Ok(await this.hydrateOrder(winner, ctx));
+        if (winner) {
+          return this.authorizedReplay(
+            winner,
+            actor,
+            ctx,
+            opts?.guestCredential,
+          );
+        }
       }
       throw error;
     }
@@ -503,25 +745,19 @@ export class OrderService {
     id: string,
     actor: Actor | null,
     ctx?: TxContext,
+    guestCredential?: string,
   ): Promise<Result<HydratedOrder>> {
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const order = await this.repo.findById(orgId, id, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
 
-    try {
-      if (
-        actor?.permissions.includes("orders:read") ||
-        actor?.permissions.includes("*:*")
-      ) {
-        // no-op
-      } else if (actor?.permissions.includes("orders:read:own")) {
-        assertOwnership(actor, order.customerId ?? null);
-      } else {
-        assertPermission(actor, "orders:read");
-      }
-    } catch (error) {
-      return Err(toCommerceError(error));
-    }
+    const access = await this.authorizeOrderRead(
+      order,
+      actor,
+      ctx,
+      guestCredential,
+    );
+    if (!access.ok) return access;
 
     const hydrated = await this.hydrateOrder(order, ctx);
 
@@ -530,7 +766,7 @@ export class OrderService {
       "orders.afterGet",
     ) as AfterHook<HydratedOrder>[];
     if (afterGetHooks.length > 0) {
-      const hookCtx = context(actor, this.deps.services, this.deps.database, ctx?.tx);
+      const hookCtx = context(actor, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
       await runAfterHooks(afterGetHooks, null, hydrated, "read", hookCtx);
     }
 
@@ -541,11 +777,12 @@ export class OrderService {
     orderNumber: string,
     actor: Actor | null,
     ctx?: TxContext,
+    guestCredential?: string,
   ): Promise<Result<HydratedOrder>> {
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const order = await this.repo.findByOrderNumber(orgId, orderNumber, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
-    return this.getById(order.id, actor, ctx);
+    return this.getById(order.id, actor, ctx, guestCredential);
   }
 
   /** Returns the order previously created with this idempotency key, or null. */
@@ -553,11 +790,24 @@ export class OrderService {
     idempotencyKey: string,
     actor?: Actor | null,
     ctx?: TxContext,
+    guestCredential?: string,
   ): Promise<Result<HydratedOrder | null>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
-    const order = await this.repo.findByIdempotencyKey(orgId, idempotencyKey, ctx);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
+    const resolvedActor = actor ?? ctx?.actor ?? null;
+    const idempotencyScope = await makeIdempotencyScope(resolvedActor, guestCredential);
+    const order = await this.repo.findByIdempotencyKey(
+      orgId,
+      idempotencyKey,
+      idempotencyScope,
+      ctx,
+    );
     if (!order) return Ok(null);
-    return Ok(await this.hydrateOrder(order, ctx));
+    return this.authorizedReplay(
+      order,
+      actor ?? ctx?.actor ?? null,
+      ctx,
+      guestCredential,
+    );
   }
 
   async list(
@@ -571,7 +821,7 @@ export class OrderService {
       return Err(toCommerceError(error));
     }
 
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     let items: Order[];
     if (params.status) {
       items = await this.repo.findByStatus(orgId, params.status, ctx);
@@ -599,7 +849,7 @@ export class OrderService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<OrderListResult>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     let items = await this.repo.findByCustomerId(orgId, customerId, ctx);
 
     if (params.status) {
@@ -670,7 +920,7 @@ export class OrderService {
       return Ok({ items: [], hint: "Enter at least 3 characters to search." });
     }
 
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const rows = await this.repo.lookup(orgId, term, opts, ctx);
     const items = rows.map((r) => ({
       id: r.id,
@@ -694,7 +944,7 @@ export class OrderService {
     actor: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<HydratedOrder>> {
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const order = await this.repo.findById(orgId, input.orderId, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
 
@@ -725,7 +975,7 @@ export class OrderService {
       "orders.afterStatusChange",
     ) as AfterStatusChangeHook[];
 
-    const hookCtx = context(actor, this.deps.services, this.deps.database, ctx?.tx);
+    const hookCtx = context(actor, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
     const statusHookInput: StatusChangeHookInput = {
       orderId: order.id,
       fromStatus: order.status as OrderState,
@@ -1057,7 +1307,7 @@ export class OrderService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const found = await this.repo.findWithLineItems(orgId, orderId, ctx);
     if (!found) return Err(new CommerceNotFoundError("Order not found."));
     if (input.lines.length === 0) {
@@ -1206,7 +1456,7 @@ export class OrderService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const refund = await this.repo.findRefundById(orgId, refundId, ctx);
     if (!refund || refund.orderId !== orderId) {
       return Err(new CommerceNotFoundError("Refund not found."));
@@ -1265,7 +1515,7 @@ export class OrderService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const order = await this.repo.findById(orgId, orderId, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
     return Ok(await this.repo.findRefundsByOrderId(orderId, ctx));
@@ -1281,7 +1531,7 @@ export class OrderService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const policies = await this.refundPolicies(orgId, ctx);
     const usedToday = await this.repo.sumRefundsByOperatorToday(
       orgId,
@@ -1309,7 +1559,7 @@ export class OrderService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const order = await this.repo.findById(orgId, orderId, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
     return Ok(order);
@@ -1446,7 +1696,7 @@ export class OrderService {
     opts?: { amount?: number },
     ctx?: TxContext,
   ): Promise<Result<HydratedOrder>> {
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const order = await this.repo.findById(orgId, orderId, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
 
@@ -1515,7 +1765,7 @@ export class OrderService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<OrderStatusHistory[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const order = await this.repo.findById(orgId, orderId, ctx);
     if (!order) {
       return Err(new CommerceNotFoundError("Order not found."));
@@ -1611,7 +1861,7 @@ export class OrderService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const order = await this.repo.findById(orgId, orderId, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
     const guard = this.lineItemEditGuard(order);
@@ -1690,7 +1940,7 @@ export class OrderService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const order = await this.repo.findById(orgId, orderId, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
     const guard = this.lineItemEditGuard(order);
@@ -1737,7 +1987,7 @@ export class OrderService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const order = await this.repo.findById(orgId, orderId, ctx);
     if (!order) return Err(new CommerceNotFoundError("Order not found."));
     const guard = this.lineItemEditGuard(order);
@@ -1776,7 +2026,7 @@ export class OrderService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<Order>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const order = await this.repo.findById(orgId, orderId, ctx);
     if (!order) {
       return Err(new CommerceNotFoundError("Order not found."));

package/src/modules/pricing/module.ts

@@ -1,3 +1,4 @@
+import type { CommerceConfig } from "../../config/types.js";
 import type { DrizzleDatabase } from "../../kernel/database/drizzle-db.js";
 import { defineModule } from "../../kernel/module/index.js";
 import type { CatalogRepository } from "../catalog/repository/index.js";
@@ -24,6 +25,7 @@ export const pricingModule = defineModule<
       repository: new PricingRepository(deps.db.db as DrizzleDatabase),
       catalogRepository: deps.services.catalog.repository,
       hooks: deps.hooks,
+      config: deps.config as CommerceConfig,
       services: deps.services,
       database: deps.db,
     }),

package/src/modules/pricing/schema.ts

@@ -15,6 +15,7 @@ export const prices = pgTable(
     variantId: uuid("variant_id").references(() => variants.id, { onDelete: "cascade" }),
     currency: text("currency").notNull(),
     amount: integer("amount").notNull(),
+    compareAtAmount: integer("compare_at_amount"),
     customerGroupId: text("customer_group_id"),
     minQuantity: integer("min_quantity"),
     maxQuantity: integer("max_quantity"),

package/src/modules/pricing/schemas.ts

@@ -7,6 +7,7 @@ export const SetBasePriceBodySchema = z.object({
   variantId: z.string().optional().openapi({ example: "variant-uuid" }),
   currency: z.string().length(3).openapi({ example: "USD" }),
   amount: z.number().openapi({ example: 29.99 }),
+  compareAtAmount: z.number().nullable().optional(),
   customerGroupId: z.string().optional(),
   minQuantity: z.number().int().optional(),
   maxQuantity: z.number().int().optional(),