@porulle/core 0.11.0 → 0.13.0

package/dist/modules/webhooks/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA4CjF,UAAU,kBAAkB;IAC1B,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAED,qBAAa,cAAc;IAGb,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAEtB,IAAI,EAAE,kBAAkB;IAItC,cAAc,CAClB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAyB7B,aAAa,CACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAM/B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAWlB,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;CAItC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA4CjF,UAAU,kBAAkB;IAC1B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,qBAAa,cAAc;IAGb,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAEtB,IAAI,EAAE,kBAAkB;IAItC,cAAc,CAClB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAyB7B,aAAa,CACjB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAM/B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAWlB,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;CAItC"}

package/dist/modules/webhooks/service.js

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok } from "../../kernel/result.js";
 /**
@@ -62,7 +62,7 @@ export class WebhookService {
         if (isPrivateUrl(input.url)) {
             return Err(new CommerceValidationError("Webhook URL must not point to a private or internal address."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const endpoint = await this.repo.createEndpoint({
             organizationId: orgId,
             url: input.url,
@@ -74,12 +74,12 @@ export class WebhookService {
         return Ok(endpoint);
     }
     async listEndpoints(actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const endpoints = await this.repo.findAllEndpoints(orgId, ctx);
         return Ok(endpoints);
     }
     async deleteEndpoint(id, actor, ctx) {
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
         const existing = await this.repo.findEndpointById(id, orgId, ctx);
         if (!existing) {
             return Err(new CommerceNotFoundError("Webhook endpoint not found."));

package/dist/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAOzD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAcvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAyVxB,MAAM,UAAU,MAAM;GA2FtD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/runtime/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AASzD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAMtE,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAcvC;AAeD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,cAAc;;;;;sBAiWxB,MAAM,UAAU,MAAM;GA6FtD"}

package/dist/runtime/server.js

@@ -7,12 +7,15 @@ import { rateLimiter } from "hono-rate-limiter";
 import { createHash } from "node:crypto";
 import { createClientIpResolver } from "./client-ip.js";
 import { authMiddleware } from "../auth/middleware.js";
+import { organizationGuard } from "../auth/organization-guard.js";
 import { CommerceCsrfError } from "../kernel/errors.js";
 import { createRestRoutes } from "../interfaces/rest/index.js";
 import { createCustomerPortalRoutes } from "../interfaces/rest/customer-portal.js";
 import { createCommerce } from "./commerce.js";
 import { rewriteCommerceAliasRequest } from "./url-alias-rewrite.js";
 import { mapErrorToResponse } from "../kernel/error-mapper.js";
+import { assertRouteCoverage } from "../interfaces/rest/route-coverage.js";
+import { markRoutePermissionGuard } from "../interfaces/rest/utils.js";
 /**
  * Returns true if running in a Node-like runtime that supports
  * `process.on()` + `process.exit()`. Edge runtimes (Cloudflare Workers,
@@ -265,6 +268,10 @@ export async function createServer(config) {
         }
     }
     // ─── Auth ──────────────────────────────────────────────────────────
+    // Better Auth's organization endpoints are mounted below but governed here:
+    // `admin/staff.ts` owns membership, and this guard keeps the plugin's own
+    // paths from minting members outside those rules.
+    app.use("/api/auth/organization/*", organizationGuard(kernel.database.db, config));
     app.use("/api/auth/*", async (c, next) => {
         if (c.req.path.startsWith("/api/auth/pos/")) {
             await next();
@@ -367,7 +374,7 @@ export async function createServer(config) {
     // Strategy 1: Built-in cron endpoint for serverless deployments.
     // Point Vercel Cron or Cloudflare Cron Trigger at GET /api/jobs/run
     // Optional query params: ?queue=emails&limit=20
-    app.get("/api/jobs/run", async (c) => {
+    app.get("/api/jobs/run", markRoutePermissionGuard(async (c) => {
         // Always require admin — cron triggers must authenticate
         const actor = c.get("actor");
         if (!actor?.permissions?.includes("*:*")) {
@@ -383,7 +390,7 @@ export async function createServer(config) {
             logger.error({ err }, "Job runner endpoint failed");
             return c.json({ error: { code: "INTERNAL_ERROR", message: "Job processing failed" } }, 500);
         }
-    });
+    }));
     // Strategy 2: In-process polling for long-running servers (ECS, Cloud Run, Docker).
     // Enable via config.jobs.autorun.enabled = true
     if (config.jobs?.autorun?.enabled) {
@@ -413,6 +420,7 @@ export async function createServer(config) {
                 "or set config.jobs.autorun.enabled = true for in-process polling.");
         }
     }
+    assertRouteCoverage(app);
     const dispatchFetch = app.fetch.bind(app);
     app.fetch = ((input, env, executionCtx) => {
         const req = input instanceof Request ? input : new Request(input);

package/dist/test-utils/create-pglite-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA0BxE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CA+DD"}
+{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA0BxE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqFD"}

package/dist/test-utils/create-pglite-adapter.js

@@ -62,21 +62,43 @@ export async function createPGliteTestAdapter() {
     /**
      * PGlite-compatible transaction wrapper.
      *
-     * Drizzle's transaction() method can hang with PGlite due to how
-     * the adapter manages transaction state. This implementation uses
-     * manual BEGIN/COMMIT control which works more reliably.
+     * Drizzle's transaction() method can hang with PGlite due to how the adapter
+     * manages transaction state, so this drives BEGIN/COMMIT manually.
+     *
+     * PGlite is a single connection, so two transaction bodies awaiting
+     * concurrently would otherwise interleave their statements between one
+     * BEGIN and one COMMIT — the second BEGIN is a no-op Postgres only warns
+     * about. Merged that way, two callers share a snapshot and hold each other's
+     * row locks, so an isolation bug reads as if the guard failed. Bodies are
+     * queued instead, which is what a connection pool would do to two
+     * transactions competing for the same rows.
+     *
+     * A nested call joins the transaction already open rather than deadlocking
+     * on the queue; without savepoints that is the only sound reading.
      */
+    let transactionQueue = Promise.resolve();
+    let inTransaction = false;
     async function transaction(fn) {
-        await pg.exec("BEGIN");
-        try {
-            const result = await fn(db);
-            await pg.exec("COMMIT");
-            return result;
-        }
-        catch (error) {
-            await pg.exec("ROLLBACK");
-            throw error;
-        }
+        if (inTransaction)
+            return fn(db);
+        const run = transactionQueue.then(async () => {
+            inTransaction = true;
+            await pg.exec("BEGIN");
+            try {
+                const result = await fn(db);
+                await pg.exec("COMMIT");
+                return result;
+            }
+            catch (error) {
+                await pg.exec("ROLLBACK");
+                throw error;
+            }
+            finally {
+                inTransaction = false;
+            }
+        });
+        transactionQueue = run.catch(() => undefined);
+        return run;
     }
     const adapter = {
         provider: "postgresql",

package/dist/test-utils/create-test-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAiHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}
+{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAqHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}

package/dist/test-utils/create-test-config.js

@@ -67,11 +67,13 @@ export async function createTestConfig(overrides = {}) {
                         "catalog:update",
                         "catalog:delete",
                         "catalog:read",
+                        "catalog:read:unpublished",
                         "inventory:adjust",
                         "orders:create",
                         "orders:read",
                         "orders:update",
                         "orders:manage",
+                        "orders:create:on-behalf",
                         "cart:create",
                         "cart:update",
                         "customers:update:self",
@@ -80,10 +82,12 @@ export async function createTestConfig(overrides = {}) {
                 ai_agent: {
                     permissions: [
                         "catalog:read",
+                        "catalog:read:unpublished",
                         "catalog:create",
                         "inventory:read",
                         "inventory:adjust",
                         "orders:read",
+                        "orders:create:on-behalf",
                         "cart:create",
                         "cart:update",
                     ],

package/dist/test-utils/rest-api-test-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAoCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}
+{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAsCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}

package/dist/test-utils/rest-api-test-utils.js

@@ -125,9 +125,11 @@ export const testActor = {
         "catalog:create",
         "catalog:update",
         "catalog:read",
+        "catalog:read:unpublished",
         "inventory:adjust",
         "inventory:read",
         "orders:create",
+        "orders:create:on-behalf",
         "orders:read",
         "orders:update",
         "orders:manage",

package/dist/test-utils/test-actors.js

@@ -27,8 +27,8 @@ export const testStaffActor = {
     organizationId: TEST_ORG_ID,
     role: "staff",
     permissions: [
-        "catalog:read", "catalog:create", "catalog:update",
-        "inventory:adjust", "orders:read", "orders:create", "orders:update", "orders:manage",
+        "catalog:read", "catalog:read:unpublished", "catalog:create", "catalog:update",
+        "inventory:adjust", "orders:read", "orders:create", "orders:create:on-behalf", "orders:update", "orders:manage",
     ],
 };
 /** Customer with minimal read/write-own permissions. */

package/dist/utils/id.d.ts

@@ -1,3 +1,5 @@
+import type { Actor } from "../auth/types.js";
 export declare function makeId(): string;
 export declare function makeDeterministicId(value: string): Promise<string>;
+export declare function makeIdempotencyScope(actor: Actor | null | undefined, guestCredential?: string, fallbackBinding?: string): Promise<string>;
 //# sourceMappingURL=id.d.ts.map

package/dist/utils/id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE"}
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,SAAS,EAC/B,eAAe,CAAC,EAAE,MAAM,EACxB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/dist/utils/id.js

@@ -9,3 +9,14 @@ export async function makeDeterministicId(value) {
     const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
+export async function makeIdempotencyScope(actor, guestCredential, fallbackBinding) {
+    const binding = actor?.userId
+        ? `actor:${actor.type}:${actor.userId}`
+        : guestCredential
+            ? `guest:${guestCredential}`
+            : fallbackBinding
+                ? `resource:${fallbackBinding}`
+                : "anonymous";
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(binding)));
+    return [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -36,11 +36,11 @@
     }
   },
   "dependencies": {
-    "@better-auth/api-key": "^1.3.8",
-    "@better-auth/drizzle-adapter": "^1.3.8",
+    "@better-auth/api-key": "^1.7.1",
+    "@better-auth/drizzle-adapter": "^1.7.1",
     "@hono/zod-openapi": "^1.2.2",
     "@scalar/hono-api-reference": "^0.10.5",
-    "better-auth": "^1.3.8",
+    "better-auth": "^1.7.1",
     "drizzle-orm": "^0.45.1",
     "drizzle-zod": "^0.8.3",
     "hono": "^4.9.8",
@@ -81,7 +81,8 @@
   "scripts": {
     "generate:plugins": "node ./scripts/generate-plugin-types.mjs",
     "check:store-guard": "node ./scripts/check-store-guard.mjs",
-    "build": "rm -rf dist tsconfig.build.tsbuildinfo && npm run generate:plugins && npm run check:store-guard && tsc -p tsconfig.build.json",
+    "check:auth-schema": "vitest run test/auth-schema-better-auth-parity.test.ts",
+    "build": "rm -rf dist tsconfig.build.tsbuildinfo && npm run generate:plugins && npm run check:store-guard && npm run check:auth-schema && tsc -p tsconfig.build.json",
     "check-types": "npm run generate:plugins && npm run check:store-guard && tsc --noEmit",
     "lint": "eslint . --max-warnings 1000",
     "test": "vitest run"

package/src/auth/auth-schema-guard.ts

@@ -0,0 +1,143 @@
+/**
+ * Compares Porulle's Drizzle auth tables against better-auth's canonical
+ * {@link getAuthTables} output so a dependency minor bump cannot add a column
+ * the declared schema omits.
+ */
+
+import { getTableColumns, getTableName } from "drizzle-orm";
+import type { PgColumn, PgTable } from "drizzle-orm/pg-core";
+import { getAuthTables } from "better-auth/db";
+import type { BetterAuthOptions } from "better-auth";
+import { apiKey } from "@better-auth/api-key";
+import { organization, twoFactor, phoneNumber, jwt, bearer } from "better-auth/plugins";
+import * as authSchema from "./auth-schema.js";
+
+/**
+ * Every plugin {@link createAuth} can enable, not only the ones it enables by
+ * default. The shipped schema has to satisfy any configuration a merchant
+ * chooses, so the guard compares against the maximal table set: a column that
+ * only `twoFactor` needs is still a column this package must declare.
+ */
+export const AUTH_SCHEMA_GUARD_OPTIONS = {
+  plugins: [
+    organization({ roles: {} }),
+    bearer(),
+    jwt(),
+    twoFactor({ issuer: "porulle-auth-schema-guard" }),
+    apiKey(),
+    phoneNumber(),
+  ],
+  user: {
+    additionalFields: {
+      vendorId: { type: "string", required: false },
+      posOperatorPin: { type: "string", required: false },
+    },
+  },
+} satisfies BetterAuthOptions;
+
+/**
+ * Drizzle tables keyed by the SQL table name they declare, so the guard walks
+ * whatever models better-auth reports rather than a list someone has to
+ * remember to extend. A hand-maintained model list is how `jwks.alg` shipped
+ * missing while this guard passed.
+ */
+function drizzleTablesByName(): Map<string, PgTable> {
+  const byName = new Map<string, PgTable>();
+  for (const value of Object.values(authSchema)) {
+    try {
+      byName.set(getTableName(value as PgTable), value as PgTable);
+    } catch {
+      // Not a Drizzle table (type export, index helper) — skip.
+    }
+  }
+  return byName;
+}
+
+function drizzleColumnForField(
+  table: PgTable,
+  fieldKey: string,
+  fieldName: string,
+): PgColumn | undefined {
+  const columns = getTableColumns(table);
+  if (fieldKey in columns) {
+    return columns[fieldKey] as PgColumn;
+  }
+  for (const column of Object.values(columns)) {
+    if (column.name === fieldName) {
+      return column as PgColumn;
+    }
+  }
+  return undefined;
+}
+
+export type AuthSchemaParityMismatch = {
+  model: string;
+  field: string;
+  issue: string;
+};
+
+/**
+ * Returns every mismatch between better-auth's expected auth tables and the
+ * Drizzle definitions Porulle ships. An empty array means parity holds.
+ */
+export function findAuthSchemaParityMismatches(
+  options: BetterAuthOptions = AUTH_SCHEMA_GUARD_OPTIONS,
+): AuthSchemaParityMismatch[] {
+  const mismatches: AuthSchemaParityMismatch[] = [];
+  const authTables = getAuthTables(options);
+  const byName = drizzleTablesByName();
+
+  for (const [model, tableDef] of Object.entries(authTables)) {
+    if (!tableDef) continue;
+    const drizzleTable = byName.get(tableDef.modelName);
+    if (!drizzleTable) {
+      mismatches.push({
+        model,
+        field: "*",
+        issue: `no drizzle table declares better-auth model "${tableDef.modelName}"`,
+      });
+      continue;
+    }
+
+    for (const [fieldKey, fieldAttr] of Object.entries(tableDef.fields)) {
+      const column = drizzleColumnForField(
+        drizzleTable,
+        fieldKey,
+        fieldAttr.fieldName ?? fieldKey,
+      );
+      if (!column) {
+        mismatches.push({
+          model,
+          field: fieldKey,
+          issue: `drizzle column missing for better-auth field "${fieldKey}"`,
+        });
+        continue;
+      }
+
+      const required = fieldAttr.required !== false;
+      if (required && !column.notNull) {
+        mismatches.push({
+          model,
+          field: fieldKey,
+          issue: `column "${column.name}" must be NOT NULL (better-auth required)`,
+        });
+      }
+    }
+  }
+
+  return mismatches;
+}
+
+export function assertAuthSchemaParity(
+  options: BetterAuthOptions = AUTH_SCHEMA_GUARD_OPTIONS,
+): void {
+  const mismatches = findAuthSchemaParityMismatches(options);
+  if (mismatches.length === 0) return;
+
+  const detail = mismatches
+    .map((m) => `  ${m.model}.${m.field}: ${m.issue}`)
+    .join("\n");
+  throw new Error(
+    `Porulle auth-schema.ts is out of sync with installed better-auth:\n${detail}`,
+  );
+}

package/src/auth/auth-schema.ts

@@ -4,6 +4,7 @@ import {
   timestamp,
   boolean,
   integer,
+  uniqueIndex,
 } from "drizzle-orm/pg-core";
 
 export const user = pgTable("user", {
@@ -19,6 +20,12 @@ export const user = pgTable("user", {
     .notNull(),
   vendorId: text("vendor_id"),
   posOperatorPin: text("pos_operator_pin"),
+  // Contributed by the twoFactor and phoneNumber plugins. Declared
+  // unconditionally: the plugins are config-gated, but one shipped schema has
+  // to satisfy every configuration a merchant can choose.
+  twoFactorEnabled: boolean("two_factor_enabled").default(false),
+  phoneNumber: text("phone_number").unique(),
+  phoneNumberVerified: boolean("phone_number_verified").default(false),
 });
 
 export const session = pgTable("session", {
@@ -37,25 +44,35 @@ export const session = pgTable("session", {
   activeOrganizationId: text("active_organization_id"),
 });
 
-export const account = pgTable("account", {
-  id: text("id").primaryKey(),
-  accountId: text("account_id").notNull(),
-  providerId: text("provider_id").notNull(),
-  userId: text("user_id")
-    .notNull()
-    .references(() => user.id, { onDelete: "cascade" }),
-  accessToken: text("access_token"),
-  refreshToken: text("refresh_token"),
-  idToken: text("id_token"),
-  accessTokenExpiresAt: timestamp("access_token_expires_at"),
-  refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
-  scope: text("scope"),
-  password: text("password"),
-  createdAt: timestamp("created_at").defaultNow().notNull(),
-  updatedAt: timestamp("updated_at")
-    .$onUpdate(() => /* @__PURE__ */ new Date())
-    .notNull(),
-});
+export const account = pgTable(
+  "account",
+  {
+    id: text("id").primaryKey(),
+    issuer: text("issuer").notNull(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    password: text("password"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+  },
+  (table) => [
+    uniqueIndex("account_issuer_account_id_unique").on(
+      table.issuer,
+      table.accountId,
+    ),
+  ],
+);
 
 export const verification = pgTable("verification", {
   id: text("id").primaryKey(),
@@ -136,4 +153,18 @@ export const jwks = pgTable("jwks", {
   privateKey: text("private_key").notNull(),
   createdAt: timestamp("created_at").notNull(),
   expiresAt: timestamp("expires_at"),
+  alg: text("alg"),
+  crv: text("crv"),
+});
+
+export const twoFactor = pgTable("twoFactor", {
+  id: text("id").primaryKey(),
+  secret: text("secret").notNull(),
+  backupCodes: text("backup_codes").notNull(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  verified: boolean("verified").default(false),
+  failedVerificationCount: integer("failed_verification_count").default(0),
+  lockedUntil: timestamp("locked_until"),
 });

package/src/auth/middleware.ts

@@ -5,7 +5,15 @@ import type { AuthInstance } from "./setup.js";
 import { DEFAULT_ORG_ID } from "./org.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 
-const DEFAULT_CUSTOMER_PERMISSIONS = [
+function emptyToNull(value: string | null | undefined): string | null {
+  return value == null || value === "" ? null : value;
+}
+
+// Exported so the storefront contract can be pinned by a test: an anonymous
+// visitor resolved by `storeResolver` gets these permissions, so dropping
+// `catalog:read` here would 401 every public storefront read.
+
+export const DEFAULT_CUSTOMER_PERMISSIONS = [
   "catalog:read",
   "cart:create",
   "cart:read",
@@ -192,9 +200,13 @@ export function authMiddleware(
                 : null;
           const metaOrg = typeof meta?.organizationId === "string" ? meta.organizationId : undefined;
           const orgId = (metaOrg ?? apiKey.organizationId ?? defaultOrgId) as string;
-          const userId = ((typeof meta?.operatorId === "string" ? meta.operatorId : undefined)
-            ?? apiKey.referenceId
-            ?? "") as string;
+          // No operator and no reference means the key carries no user
+          // identity. Leave it absent rather than substituting a shared
+          // placeholder, which would make every such key look like one person.
+          const userId = emptyToNull(
+            (typeof meta?.operatorId === "string" ? meta.operatorId : undefined) ??
+              (typeof apiKey.referenceId === "string" ? apiKey.referenceId : undefined),
+          );
 
           // Better Auth stores permissions as Record<string, string[]>
           // (e.g. {"catalog":["read","create"]}).  Flatten to the
@@ -245,7 +257,7 @@ export function authMiddleware(
             // services can scope queries correctly.
             c.set("actor", {
               type: "user",
-              userId: "anonymous",
+              userId: null,
               email: null,
               name: "Anonymous",
               vendorId: null,

package/src/auth/org.ts

@@ -37,14 +37,26 @@ export function setBootDefaultOrgId(orgId: string): void {
   _bootDefaultOrgId = orgId;
 }
 
+/**
+ * Resolves org using an explicit config default — not ambient boot state.
+ * Use when the caller holds CommerceConfig and may lack an actor organizationId.
+ */
+export function resolveOrgIdForCommerce(
+  actor: unknown,
+  config?: CommerceConfig | null,
+): string {
+  return resolveOrgId(actor, config?.auth?.defaultOrganizationId, config ?? undefined);
+}
+
 /**
  * Extracts the organization ID from an actor.
  *
  * Resolution order:
  * 1. Actor's organizationId (set by middleware from session/API key/storeResolver)
  * 2. Explicit defaultOrgId parameter (caller override)
- * 3. Boot-time default (from config.auth.defaultOrganizationId via setBootDefaultOrgId)
- * 4. Deprecated fallback to DEFAULT_ORG_ID (will be removed)
+ * 3. Strict check — throw OrgResolutionError when enabled
+ * 4. Boot-time default (from config.auth.defaultOrganizationId via setBootDefaultOrgId)
+ * 5. Deprecated fallback to DEFAULT_ORG_ID (will be removed)
  */
 export function resolveOrgId(
   actor: unknown,
@@ -56,12 +68,12 @@ export function resolveOrgId(
     if (typeof orgId === "string") return orgId;
   }
   if (defaultOrgId) return defaultOrgId;
-  if (_bootDefaultOrgId) return _bootDefaultOrgId;
   if (isStrictOrgResolution(commerceConfig)) {
     throw new OrgResolutionError(
       "Organization could not be resolved: no actor organizationId, no defaultOrgId, and no configured default organization.",
     );
   }
+  if (_bootDefaultOrgId) return _bootDefaultOrgId;
   warnDeprecatedOrgDefaultFallback();
   return DEFAULT_ORG_ID;
 }