@porulle/core 0.11.0 → 0.13.0

package/src/modules/pricing/service.ts

@@ -1,5 +1,6 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 import type { DatabaseAdapter } from "../../kernel/database/adapter.js";
 import type { PluginDb } from "../../kernel/database/plugin-types.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
@@ -33,6 +34,7 @@ interface PricingServiceDeps {
   repository: PricingRepository;
   catalogRepository: CatalogRepository;
   hooks: HookRegistry;
+  config: CommerceConfig;
   services: Record<string, unknown>;
   database: DatabaseAdapter;
 }
@@ -41,6 +43,7 @@ function hookContext(
   actor: Actor | null,
   services: Record<string, unknown>,
   database: DatabaseAdapter,
+  config: CommerceConfig,
   tx: unknown,
 ): HookContext {
   return createHookContext({
@@ -50,6 +53,7 @@ function hookContext(
     services,
     context: { moduleName: "pricing" },
     database: { db: database.db as PluginDb },
+    commerceConfig: config,
   });
 }
 
@@ -211,7 +215,7 @@ export class PricingService {
       );
     }
 
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
     if (!entity) {
       return Err(
@@ -267,10 +271,7 @@ export class PricingService {
       "pricing.afterCreate",
     ) as AfterHook<Price>[];
     const hctx = hookContext(
-      actor ?? ctx?.actor ?? null,
-      this.deps.services,
-      this.deps.database,
-      ctx?.tx ?? null,
+      actor ?? ctx?.actor ?? null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx ?? null,
     );
     await runAfterHooks(afterHooks, null, record, "create", hctx);
 
@@ -301,7 +302,7 @@ export class PricingService {
       );
     }
 
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
 
     const modifierData: PriceModifierInsert = {
       organizationId: orgId,
@@ -327,10 +328,7 @@ export class PricingService {
       "pricing.afterCreate",
     ) as AfterHook<PriceModifier>[];
     const hctx = hookContext(
-      actor ?? ctx?.actor ?? null,
-      this.deps.services,
-      this.deps.database,
-      ctx?.tx ?? null,
+      actor ?? ctx?.actor ?? null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx ?? null,
     );
     await runAfterHooks(afterHooks, null, modifier, "create", hctx);
 
@@ -342,7 +340,7 @@ export class PricingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<PriceModifier[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const rows = await this.repo.findModifiers(
       orgId,
       {
@@ -372,7 +370,7 @@ export class PricingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<PriceModifier>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.repo.findModifierById(orgId, id, ctx);
     if (!existing) {
       return Err(new CommerceNotFoundError("Price modifier not found."));
@@ -399,7 +397,7 @@ export class PricingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<{ deleted: true }>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.repo.findModifierById(orgId, id, ctx);
     if (!existing) {
       return Err(new CommerceNotFoundError("Price modifier not found."));
@@ -418,7 +416,7 @@ export class PricingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<{ prices: Price[]; modifiers: PriceModifier[] }>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     // Get all prices for the entity if specified, or filter after retrieval
     let prices: Price[] = [];
     if (filter?.entityId) {
@@ -477,7 +475,7 @@ export class PricingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ResolvedPrice>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
     if (!entity) {
       return Err(

package/src/modules/promotions/module.ts

@@ -1,3 +1,4 @@
+import type { CommerceConfig } from "../../config/types.js";
 import type { DrizzleDatabase } from "../../kernel/database/drizzle-db.js";
 import { defineModule } from "../../kernel/module/index.js";
 import type { CatalogServiceImpl } from "../catalog/service.js";
@@ -26,6 +27,7 @@ export const promotionsModule = defineModule<
       catalogRepository: deps.services.catalog.repository,
       ordersRepository: new OrdersRepository(deps.db.db as DrizzleDatabase),
       hooks: deps.hooks,
+      config: deps.config as CommerceConfig,
       services: deps.services,
       database: deps.db,
     }),

package/src/modules/promotions/service.ts

@@ -19,8 +19,9 @@ import type {
 } from "./repository/index.js";
 import type { CatalogRepository } from "../catalog/repository/index.js";
 import type { OrdersRepository } from "../orders/repository/index.js";
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgId, resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 
 // PromotionType is derived from the zod enum (single source of truth) in
 // ./schemas.js; re-export it here for backwards-compatible imports.
@@ -35,6 +36,7 @@ interface PromotionServiceDeps {
   catalogRepository: CatalogRepository;
   ordersRepository: OrdersRepository;
   hooks: HookRegistry;
+  config: CommerceConfig;
   services: Record<string, unknown>;
   database: DatabaseAdapter;
 }
@@ -43,6 +45,7 @@ function hookContext(
   actor: Actor | null,
   services: Record<string, unknown>,
   database: DatabaseAdapter,
+  config: CommerceConfig,
   tx: unknown,
 ): HookContext {
   return createHookContext({
@@ -52,6 +55,7 @@ function hookContext(
     services,
     context: { moduleName: "promotions" },
     database: { db: database.db as PluginDb },
+    commerceConfig: config,
   });
 }
 
@@ -165,6 +169,16 @@ export class PromotionService {
     this.ordersRepo = deps.ordersRepository;
   }
 
+  private resolveEvaluationOrgId(
+    ctx: TxContext | undefined,
+    explicitOrgId?: string,
+  ): string {
+    if (explicitOrgId) {
+      return resolveOrgId(ctx?.actor ?? null, explicitOrgId);
+    }
+    return resolveOrgIdForCommerce(ctx?.actor ?? null, this.deps.config);
+  }
+
   async create(
     input: CreatePromotionInput,
     actor?: Actor | null,
@@ -189,7 +203,7 @@ export class PromotionService {
       );
     }
 
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
 
     if (input.code) {
       const normalized = input.code.trim().toUpperCase();
@@ -229,10 +243,7 @@ export class PromotionService {
       "promotions.afterCreate",
     ) as AfterHook<Promotion>[];
     const hctx = hookContext(
-      actor ?? ctx?.actor ?? null,
-      this.deps.services,
-      this.deps.database,
-      ctx?.tx ?? null,
+      actor ?? ctx?.actor ?? null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx ?? null,
     );
     await runAfterHooks(afterHooks, null, promotion, "create", hctx);
 
@@ -253,7 +264,8 @@ export class PromotionService {
     const afterHooks = this.deps.hooks.resolve(
       "promotions.afterUpdate",
     ) as AfterHook<Promotion>[];
-    const hctx = hookContext(null, this.deps.services, this.deps.database, ctx?.tx ?? null);
+    // Actor-less by design; resolves to the deployment's declared organization.
+    const hctx = hookContext(null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx ?? null);
     await runAfterHooks(afterHooks, promotion, updated, "update", hctx);
 
     return Ok(updated);
@@ -331,10 +343,7 @@ export class PromotionService {
       "promotions.afterUpdate",
     ) as AfterHook<Promotion>[];
     const hctx = hookContext(
-      actor ?? ctx?.actor ?? null,
-      this.deps.services,
-      this.deps.database,
-      ctx?.tx ?? null,
+      actor ?? ctx?.actor ?? null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx ?? null,
     );
     await runAfterHooks(afterHooks, existing, updated, "update", hctx);
 
@@ -346,7 +355,7 @@ export class PromotionService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<Promotion[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const all = await this.repo.findAll(orgId, ctx);
     const now = new Date();
 
@@ -375,7 +384,7 @@ export class PromotionService {
     timestamp = new Date(),
     ctx?: TxContext,
   ): Promise<Result<Promotion[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const active = await this.repo.findActive(orgId, ctx);
     // Further filter by timestamp in case repo returns slightly stale results
     const filtered = active.filter((p) => matchesWindow(p, timestamp));
@@ -388,7 +397,7 @@ export class PromotionService {
     ctx?: TxContext,
   ): Promise<Result<Promotion>> {
     const normalized = code.trim().toUpperCase();
-    const evalOrgId = resolveOrgId(ctx?.actor ?? null, context.orgId);
+    const evalOrgId = this.resolveEvaluationOrgId(ctx, context.orgId);
     const promotion = await this.repo.findByCode(evalOrgId, normalized, ctx);
     if (!promotion) {
       return Err(
@@ -434,7 +443,7 @@ export class PromotionService {
     ctx?: TxContext,
   ): Promise<Result<PromotionApplicationResult>> {
     const timestamp = context.timestamp ?? new Date();
-    const applyOrgId = resolveOrgId(ctx?.actor ?? null, context.orgId);
+    const applyOrgId = this.resolveEvaluationOrgId(ctx, context.orgId);
     const result: PromotionApplicationResult = {
       totalDiscount: 0,
       freeShipping: false,
@@ -580,7 +589,7 @@ export class PromotionService {
         return "First-order promotion requires authenticated customer.";
       }
       const orders = await this.ordersRepo.findByCustomerId(
-        resolveOrgId(ctx?.actor ?? null, context.orgId),
+        this.resolveEvaluationOrgId(ctx, context.orgId),
         context.customerId,
         ctx,
       );

package/src/modules/search/adapter.ts

@@ -2,11 +2,13 @@ import type { Result } from "../../kernel/result.js";
 
 export interface SearchDocument {
   id: string;
+  organizationId?: string;
   type: string;
   slug: string;
   title: string;
   description?: string;
   status?: string;
+  isVisible?: boolean;
   categories: string[];
   brands: string[];
   text: string;
@@ -15,6 +17,8 @@ export interface SearchDocument {
 }
 
 export interface SearchFilters {
+  /** Server-supplied tenant constraint; REST callers cannot choose this value. */
+  organizationId?: string;
   type?: string;
   category?: string;
   brand?: string;
@@ -34,6 +38,8 @@ export interface SearchSuggestParams {
   prefix: string;
   type?: string;
   limit?: number;
+  /** Server-supplied tenant constraint; REST callers cannot choose this value. */
+  organizationId?: string;
 }
 
 export interface SearchHit {

package/src/modules/search/module.ts

@@ -17,6 +17,7 @@ export const searchModule = defineModule<Record<string, never>, SearchService, S
       return new SearchService({
         catalogRepository: deps.services.catalog.repository,
         resolveEntityFieldDefinitions: deps.services.catalog.resolveEntityFieldDefinitions.bind(deps.services.catalog),
+        config,
         ...(config.entities ? { entities: config.entities } : {}),
         ...(config.search?.adapter ? { adapter: config.search.adapter } : {}),
         ...(config.search?.defaultFacets

package/src/modules/search/service.ts

@@ -1,5 +1,6 @@
-import { Ok, type Result } from "../../kernel/result.js";
-import { resolveOrgId } from "../../auth/org.js";
+import { Err, Ok, type Result } from "../../kernel/result.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
+import { OrgResolutionError } from "../../kernel/errors.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import type { CommerceConfig } from "../../config/types.js";
 import type {
@@ -16,9 +17,11 @@ import type {
   SearchSuggestParams,
 } from "./adapter.js";
 import type { EntityFieldDefinitionResolver } from "../catalog/service.js";
+import { canReadUnpublishedCatalog } from "../catalog/read-policy.js";
 
 interface SearchServiceDeps {
   catalogRepository: CatalogRepository;
+  config: CommerceConfig;
   entities?: CommerceConfig["entities"];
   resolveEntityFieldDefinitions?: EntityFieldDefinitionResolver;
   adapter?: SearchAdapter;
@@ -180,11 +183,13 @@ export class SearchService {
 
     return {
       id: entity.id,
+      organizationId: entity.organizationId,
       type: entity.type,
       slug: entity.slug,
       title,
       ...(description ? { description } : {}),
       status: entity.status,
+      isVisible: entity.isVisible,
       categories,
       brands,
       text: textParts.join(" ").trim(),
@@ -196,10 +201,18 @@ export class SearchService {
   }
 
   private async allDocuments(ctx?: TxContext): Promise<SearchDocument[]> {
-    const orgId = resolveOrgId(ctx?.actor ?? null);
+    const actor = ctx?.actor;
+    if (!actor) {
+      // Deliberate exception: this needs an authenticated actor, not merely a
+      // resolvable organization, because visibility scoping is decided from the
+      // actor's permissions. A declared deployment default would satisfy the
+      // organization but not that.
+      throw new OrgResolutionError("Organization could not be resolved for a search read.");
+    }
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const entities = await this.deps.catalogRepository.findEntities(
       orgId,
-      undefined,
+      canReadUnpublishedCatalog(actor) ? undefined : { status: "active", isVisible: true },
       ctx,
     );
     return Promise.all(
@@ -212,6 +225,7 @@ export class SearchService {
     filters: SearchFilters | undefined,
   ): boolean {
     if (!filters) return true;
+    if (filters.organizationId && document.organizationId !== filters.organizationId) return false;
     if (filters.type && document.type !== filters.type) return false;
     if (filters.status && document.status !== filters.status) return false;
     if (filters.category && !document.categories.includes(filters.category))
@@ -318,11 +332,35 @@ export class SearchService {
     const safeQuery = (params.query ?? "").slice(0, 500);
 
     if (this.deps.adapter) {
-      return this.deps.adapter.search({
+      const actor = ctx?.actor ?? null;
+      // Deliberate exception: this needs an authenticated actor, not merely a
+      // resolvable organization, because visibility scoping is decided from the
+      // actor's permissions. A declared deployment default would satisfy the
+      // organization but not that.
+      if (!actor) return Err(new OrgResolutionError("Organization could not be resolved for a search read."));
+      const organizationId = resolveOrgIdForCommerce(actor, this.deps.config);
+      const result = await this.deps.adapter.search({
         ...params,
         query: safeQuery,
         page,
         limit,
+        filters: {
+          ...params.filters,
+          organizationId,
+          ...(!canReadUnpublishedCatalog(actor) ? { status: "active" } : {}),
+        },
+      });
+      if (!result.ok) return result;
+      const hits = result.value.hits.filter((hit) =>
+        hit.document.organizationId === organizationId &&
+        (canReadUnpublishedCatalog(actor) ||
+          (hit.document.status === "active" && hit.document.isVisible !== false)),
+      );
+      return Ok({
+        ...result.value,
+        hits,
+        total: hits.length,
+        facets: this.computeFacets(hits.map((hit) => hit.document), params.facets),
       });
     }
 
@@ -390,11 +428,22 @@ export class SearchService {
     if (prefix.length === 0) return Ok([]);
 
     if (this.deps.adapter) {
-      return this.deps.adapter.suggest({
+      const actor = ctx?.actor ?? null;
+      // Deliberate exception: this needs an authenticated actor, not merely a
+      // resolvable organization, because visibility scoping is decided from the
+      // actor's permissions. A declared deployment default would satisfy the
+      // organization but not that.
+      if (!actor) return Err(new OrgResolutionError("Organization could not be resolved for a search read."));
+      const organizationId = resolveOrgIdForCommerce(actor, this.deps.config);
+      const result = await this.deps.adapter.suggest({
         ...params,
         prefix,
         limit,
+        organizationId,
       });
+      if (!result.ok) return result;
+      const visibleTitles = new Set((await this.allDocuments(ctx)).map((document) => document.title));
+      return Ok(result.value.filter((title) => visibleTitles.has(title)));
     }
 
     // In-memory fallback: require prefix >= 2 chars to avoid loading all entities

package/src/modules/settings/module.ts

@@ -1,3 +1,4 @@
+import type { CommerceConfig } from "../../config/types.js";
 import type { DrizzleDatabase } from "../../kernel/database/drizzle-db.js";
 import { defineModule } from "../../kernel/module/index.js";
 import { SettingsRepository } from "./repository/index.js";
@@ -14,5 +15,6 @@ export const settingsModule = defineModule<
   service: (deps) =>
     new SettingsService({
       repository: new SettingsRepository(deps.db.db as DrizzleDatabase),
+      config: deps.config as CommerceConfig,
     }),
 });

package/src/modules/settings/service.ts

@@ -1,5 +1,6 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { Actor } from "../../auth/types.js";
+import type { CommerceConfig } from "../../config/types.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import { CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok, type Result } from "../../kernel/result.js";
@@ -9,6 +10,7 @@ const GROUP_NAME_RE = /^[a-z][a-z0-9_-]*$/;
 
 interface SettingsServiceDeps {
   repository: SettingsRepository;
+  config: CommerceConfig;
 }
 
 /**
@@ -20,9 +22,11 @@ interface SettingsServiceDeps {
  */
 export class SettingsService {
   private repository: SettingsRepository;
+  private config: CommerceConfig;
 
   constructor(deps: SettingsServiceDeps) {
     this.repository = deps.repository;
+    this.config = deps.config;
   }
 
   /** Runtime read for plugins/hooks. Unset groups read as `{}`. */
@@ -40,7 +44,7 @@ export class SettingsService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<Record<string, unknown>>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     return Ok(await this.read(orgId, group, ctx));
   }
 
@@ -48,7 +52,7 @@ export class SettingsService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<Record<string, Record<string, unknown>>>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     const rows = await this.repository.findAll(orgId, ctx);
     const all: Record<string, Record<string, unknown>> = {};
     for (const row of rows) all[row.group] = row.value;
@@ -69,7 +73,7 @@ export class SettingsService {
         ),
       );
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.config);
     const current = await this.read(orgId, group, ctx);
     const next: Record<string, unknown> = { ...current };
     for (const [key, value] of Object.entries(patch)) {

package/src/modules/shipping/service.ts

@@ -1,5 +1,5 @@
 import type { CommerceConfig } from "../../config/types.js";
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { Actor } from "../../auth/types.js";
 import { CommerceNotFoundError, CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok, type Result } from "../../kernel/result.js";
@@ -147,7 +147,7 @@ export class ShippingService {
     if (input.countries.length === 0) {
       return Err(new CommerceValidationError("A shipping zone requires at least one country (\"*\" matches any)."));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const zone = await this.deps.repository.createZone(
       {
         organizationId: orgId,
@@ -163,7 +163,7 @@ export class ShippingService {
   }
 
   async listZones(actor?: Actor | null, ctx?: TxContext): Promise<Result<ShippingZone[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     return Ok(await this.deps.repository.findZones(orgId, ctx));
   }
 
@@ -179,7 +179,7 @@ export class ShippingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ShippingZone>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.deps.repository.findZoneById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Shipping zone not found."));
     const updated = await this.deps.repository.updateZone(
@@ -201,7 +201,7 @@ export class ShippingService {
   }
 
   async deleteZone(id: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<{ deleted: true }>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.deps.repository.findZoneById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Shipping zone not found."));
     await this.deps.repository.deleteZone(id, ctx);
@@ -224,7 +224,7 @@ export class ShippingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ShippingRate>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const zone = await this.deps.repository.findZoneById(orgId, input.zoneId, ctx);
     if (!zone) return Err(new CommerceNotFoundError("Shipping zone not found."));
     const rate = await this.deps.repository.createRate(
@@ -251,7 +251,7 @@ export class ShippingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ShippingRate[]>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     return Ok(
       await this.deps.repository.findRates(
         orgId,
@@ -277,7 +277,7 @@ export class ShippingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ShippingRate>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.deps.repository.findRateById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Shipping rate not found."));
     const updated = await this.deps.repository.updateRate(
@@ -301,7 +301,7 @@ export class ShippingService {
   }
 
   async deleteRate(id: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<{ deleted: true }>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const existing = await this.deps.repository.findRateById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Shipping rate not found."));
     await this.deps.repository.deleteRate(id, ctx);

package/src/modules/tax/module.ts

@@ -16,5 +16,6 @@ export const taxModule = defineModule<
     new TaxService({
       adapter: (deps.config as CommerceConfig).tax?.adapter,
       repository: new TaxRatesRepository(deps.db.db as DrizzleDatabase),
+      config: deps.config as CommerceConfig,
     }),
 });