@porulle/core 0.11.0 → 0.14.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { defineConfig } from "./config/define-config.js";
-export type { CommerceConfig, CommercePlugin, ApiKeyScopeDefinition, } from "./config/types.js";
+export type { CommerceConfig, CommercePlugin, ApiKeyScopeDefinition, GuestOrderAccessStrategy, } from "./config/types.js";
 export { defineCommercePlugin } from "./kernel/plugin/manifest.js";
 export type { CommercePluginManifest, PluginContext, PluginHookRegistration, PluginLogger, PluginPermission, PluginRouteRegistration, } from "./kernel/plugin/manifest.js";
 export { router } from "./interfaces/rest/router.js";
@@ -15,12 +15,13 @@ export { setupGracefulShutdown } from "./runtime/shutdown.js";
 export { createKernel } from "./runtime/kernel.js";
 export type { Kernel } from "./runtime/kernel.js";
 export type { Actor } from "./auth/types.js";
-export { resolveOrgId, ensureDefaultOrg, DEFAULT_ORG_ID } from "./auth/org.js";
+export { AUTH_COOKIE_PREFIX, resolveActor, SESSION_COOKIE_NAME, } from "./auth/actor.js";
+export { resolveOrgId, resolveOrgIdForCommerce, ensureDefaultOrg, DEFAULT_ORG_ID } from "./auth/org.js";
 export { createSystemActor } from "./auth/system-actor.js";
 export { OrganizationService } from "./modules/organization/service.js";
 export { createScopedDb } from "./kernel/database/scoped-db.js";
 export type { ScopedOrganizationId } from "./kernel/database/scoped-db.js";
-export { assertOwnership, assertPermission } from "./auth/permissions.js";
+export { assertOwnership, assertPermission, requireUserId } from "./auth/permissions.js";
 export type { AccessResult, AccessContext, AccessFn, WhereClause } from "./auth/access.js";
 export { accessOR, accessAND, conditional, isAdmin, isAuthenticated, isDocumentOwner, publicAccess, denyAll, } from "./auth/access.js";
 export { HookRegistry } from "./kernel/hooks/registry.js";
@@ -62,8 +63,8 @@ export type { SearchAdapter, SearchDocument, SearchFilters, SearchHit, SearchQue
 export type { DatabaseAdapter } from "./kernel/database/adapter.js";
 export { isValidFieldPath, validateFieldPath } from "./modules/catalog/ownership.js";
 export type { FieldPath, FieldOwner } from "./modules/catalog/ownership.js";
-export { createTxContext, reuseOrCreateTxContext, withTransaction, } from "./kernel/database/tx-context.js";
-export type { TxContext, WithTransactionOptions, } from "./kernel/database/tx-context.js";
+export type { TxContext, WithTransactionOptions, CatalogWriteContext, HookContextCarrier, } from "./kernel/database/tx-context.js";
+export { createTxContext, reuseOrCreateTxContext, withTransaction, isWriteContextTransactional, resolveWriteContextHookContext, } from "./kernel/database/tx-context.js";
 export type { TaxAdapter, TaxAddress, TaxCalculationParams, TaxCalculationResult, TaxLineItem, TaxReportParams, TaxVoidParams, } from "./modules/tax/adapter.js";
 export { getSchema, buildSchema, getTableNames, getSchemaFiles, pushSchema, } from "./kernel/database/migrate.js";
 export { consoleEmailAdapter } from "./adapters/console-email.js";
@@ -85,6 +86,7 @@ export type { RelationDefinition, EntityDefinition, } from "./kernel/query/regis
 export type { QueryInput, QueryResult } from "./kernel/query/executor.js";
 export type { CommerceModuleTypes } from "./types/commerce-types.js";
 export { staleOrderCleanupTask } from "./modules/orders/stale-order-cleanup.js";
+export { windowedGuestOrderAccess, defaultGuestOrderAccess, parseAccessWindow, } from "./modules/orders/guest-access.js";
 export { COMMERCE_AGENT_SYSTEM_PROMPT } from "./utils/agent-prompt.js";
 export { DrizzleAnalyticsAdapter } from "./modules/analytics/drizzle-adapter.js";
 export { BUILTIN_ANALYTICS_MODELS } from "./modules/analytics/models.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,YAAY,EACV,cAAc,EACd,cAAc,EACd,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAKlD,YAAY,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EACL,QAAQ,EACR,SAAS,EACT,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,EACf,YAAY,EACZ,OAAO,GACR,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,YAAY,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,YAAY,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACxF,YAAY,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC9E,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAE3C,YAAY,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,EACb,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iCAAiC,EACjC,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,EAC7B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,YAAY,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACrF,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,SAAS,EACT,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,aAAa,GACd,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,SAAS,EACT,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAExF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACjE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAErF,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,YAAY,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,mBAAmB,EACnB,IAAI,GACL,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,YAAY,EACV,cAAc,EACd,uBAAuB,EACvB,aAAa,EACb,OAAO,EACP,WAAW,GACZ,MAAM,wCAAwC,CAAC;AAEhD,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,YAAY,EACV,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE1E,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EAEb,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,GACf,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,YAAY,EACV,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAKlD,YAAY,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACzF,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EACL,QAAQ,EACR,SAAS,EACT,WAAW,EACX,OAAO,EACP,eAAe,EACf,eAAe,EACf,YAAY,EACZ,OAAO,GACR,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,YAAY,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E,YAAY,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACxF,YAAY,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC9E,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAE3C,YAAY,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,EACb,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iCAAiC,EACjC,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,EAC5B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,EAC7B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,YAAY,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACrF,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5E,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,aAAa,GACd,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,SAAS,EACT,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAExF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,iCAAiC,CAAC;AACjE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAErF,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,YAAY,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,mBAAmB,EACnB,IAAI,GACL,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,YAAY,EACV,cAAc,EACd,uBAAuB,EACvB,aAAa,EACb,OAAO,EACP,WAAW,GACZ,MAAM,wCAAwC,CAAC;AAEhD,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,YAAY,EACV,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE1E,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EAEb,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,GACf,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -9,11 +9,12 @@ export { createClientIpResolver } from "./runtime/client-ip.js";
 export { createLogger } from "./runtime/logger.js";
 export { setupGracefulShutdown } from "./runtime/shutdown.js";
 export { createKernel } from "./runtime/kernel.js";
-export { resolveOrgId, ensureDefaultOrg, DEFAULT_ORG_ID } from "./auth/org.js";
+export { AUTH_COOKIE_PREFIX, resolveActor, SESSION_COOKIE_NAME, } from "./auth/actor.js";
+export { resolveOrgId, resolveOrgIdForCommerce, ensureDefaultOrg, DEFAULT_ORG_ID } from "./auth/org.js";
 export { createSystemActor } from "./auth/system-actor.js";
 export { OrganizationService } from "./modules/organization/service.js";
 export { createScopedDb } from "./kernel/database/scoped-db.js";
-export { assertOwnership, assertPermission } from "./auth/permissions.js";
+export { assertOwnership, assertPermission, requireUserId } from "./auth/permissions.js";
 export { accessOR, accessAND, conditional, isAdmin, isAuthenticated, isDocumentOwner, publicAccess, denyAll, } from "./auth/access.js";
 export { HookRegistry } from "./kernel/hooks/registry.js";
 export { runBeforeHooks, runAfterHooks } from "./kernel/hooks/executor.js";
@@ -36,7 +37,7 @@ export { canTransition, assertTransition, orderStateMachine, extendOrderStateMac
 export { defineChannelConnector } from "./modules/channels/adapter.js";
 export { noopStorageAdapter } from "./modules/media/noop-adapter.js";
 export { isValidFieldPath, validateFieldPath } from "./modules/catalog/ownership.js";
-export { createTxContext, reuseOrCreateTxContext, withTransaction, } from "./kernel/database/tx-context.js";
+export { createTxContext, reuseOrCreateTxContext, withTransaction, isWriteContextTransactional, resolveWriteContextHookContext, } from "./kernel/database/tx-context.js";
 export { getSchema, buildSchema, getTableNames, getSchemaFiles, pushSchema, } from "./kernel/database/migrate.js";
 export { consoleEmailAdapter } from "./adapters/console-email.js";
 export { promotionTypeEnum } from "./modules/promotions/schemas.js";
@@ -49,6 +50,7 @@ export { canAccessCart } from "./modules/cart/access.js";
 export { QueryRegistry } from "./kernel/query/registry.js";
 export { executeQuery } from "./kernel/query/executor.js";
 export { staleOrderCleanupTask } from "./modules/orders/stale-order-cleanup.js";
+export { windowedGuestOrderAccess, defaultGuestOrderAccess, parseAccessWindow, } from "./modules/orders/guest-access.js";
 export { COMMERCE_AGENT_SYSTEM_PROMPT } from "./utils/agent-prompt.js";
 export { DrizzleAnalyticsAdapter } from "./modules/analytics/drizzle-adapter.js";
 export { BUILTIN_ANALYTICS_MODELS } from "./modules/analytics/models.js";

package/dist/interfaces/rest/audit-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-middleware.d.ts","sourceRoot":"","sources":["../../../src/interfaces/rest/audit-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAK9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,wCAAwC;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;CACpB;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAgDjE"}
+{"version":3,"file":"audit-middleware.d.ts","sourceRoot":"","sources":["../../../src/interfaces/rest/audit-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAK9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,wCAAwC;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,SAAS,EAAE,OAAO,CAAC;CACpB;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAkDjE"}

package/dist/interfaces/rest/audit-middleware.js

@@ -66,12 +66,14 @@ export function auditMiddleware(kernel) {
         try {
             const requestId = c.get("requestId");
             const ctx = createHookContext({
+                // Anonymous audit records retain actor: null; organization comes from the deployment config.
                 actor: c.get("actor") ?? null,
                 ...(requestId ? { requestId } : {}),
                 logger: kernel.logger,
                 services: kernel.services,
                 database: { db: kernel.database.db },
                 origin: "rest",
+                commerceConfig: kernel.config,
             });
             await kernel.services.audit.record({ entityType, entityId, event, payload, ctx });
         }

package/dist/interfaces/rest/customer-portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"customer-portal.d.ts","sourceRoot":"","sources":["../../../src/interfaces/rest/customer-portal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAgBzC,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,gCAsRxD"}
+{"version":3,"file":"customer-portal.d.ts","sourceRoot":"","sources":["../../../src/interfaces/rest/customer-portal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAkBzC,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,gCA2RxD"}

package/dist/interfaces/rest/customer-portal.js

@@ -1,15 +1,16 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import { assertPermission } from "../../auth/permissions.js";
+import { assertPermission, requireUserId } from "../../auth/permissions.js";
 import { getProfileRoute, listAddressesRoute, listCustomerOrdersRoute, getCustomerOrderRoute, getOrderTrackingRoute, getOrderDownloadsRoute, listCoursesRoute, deleteAddressRoute, reorderRoute, updateProfileRoute, createAddressRoute, } from "./schemas/customer-portal.js";
-import { isUUID, mapErrorToStatus } from "./utils.js";
+import { isUUID, mapErrorToStatus, markRoutePermissionGuard } from "./utils.js";
 export function createCustomerPortalRoutes(kernel) {
     const router = new OpenAPIHono();
-    router.use("*", async (c, next) => {
-        if (!c.get("actor")) {
+    router.use("*", markRoutePermissionGuard(async (c, next) => {
+        const actor = c.get("actor");
+        if (!actor?.userId) {
             return c.json({ error: { code: "FORBIDDEN", message: "Authentication required." } }, 401);
         }
         await next();
-    });
+    }));
     /**
      * Resolves an actor whose userId is the customer profile UUID (not the Better Auth user ID).
      * Required so that `assertOwnership(actor, order.customerId)` compares UUIDs correctly,
@@ -71,9 +72,9 @@ export function createCustomerPortalRoutes(kernel) {
             page: Number.parseInt(c.req.query("page") ?? "1", 10),
             limit: Number.parseInt(c.req.query("limit") ?? "20", 10),
             ...(status !== undefined ? { status } : {}),
-        });
+        }, actor);
         if (!result.ok)
-            return c.json({ error: result.error }, 500);
+            return c.json({ error: result.error }, mapErrorToStatus(result.error));
         return c.json({ data: result.value.items, meta: result.value.pagination });
     });
     // @ts-expect-error -- openapi handler union return type
@@ -171,7 +172,7 @@ export function createCustomerPortalRoutes(kernel) {
             return c.json({ error: orderResult.error }, mapErrorToStatus(orderResult.error));
         }
         const cartResult = await kernel.services.cart.create({
-            customerId: actor.userId,
+            customerId: requireUserId(actor),
             currency: orderResult.value.currency,
         }, actor);
         if (!cartResult.ok)

package/dist/interfaces/rest/route-coverage.d.ts

@@ -0,0 +1,14 @@
+import type { RouterRoute } from "hono/types";
+export type PublicRoute = {
+    method: string;
+    path: string;
+    justification: string;
+};
+export declare const PUBLIC_ROUTES: readonly PublicRoute[];
+type RouteTableApp = {
+    routes: readonly RouterRoute[];
+};
+export declare function findUncoveredRoutes(app: RouteTableApp): string[];
+export declare function assertRouteCoverage(app: RouteTableApp): void;
+export {};
+//# sourceMappingURL=route-coverage.d.ts.map

package/dist/interfaces/rest/route-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-coverage.d.ts","sourceRoot":"","sources":["../../../src/interfaces/rest/route-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAc/C,CAAC;AAEF,KAAK,aAAa,GAAG;IACnB,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;CAChC,CAAC;AA6CF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,EAAE,CAuBhE;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAK5D"}

package/dist/interfaces/rest/route-coverage.js

@@ -0,0 +1,81 @@
+import { isRoutePermissionGuard } from "./utils.js";
+export const PUBLIC_ROUTES = [
+    { method: "GET", path: "/api/health", justification: "Load balancers need an unauthenticated liveness probe." },
+    { method: "GET", path: "/api/reference", justification: "The development API explorer is intentionally public when enabled." },
+    { method: "GET", path: "/api/doc", justification: "The generated OpenAPI document is public when documentation exposure is enabled." },
+    { method: "GET", path: "/api/doc-ext", justification: "The enriched OpenAPI document is public when documentation exposure is enabled." },
+    { method: "POST", path: "/api/carts", justification: "Anonymous storefront shoppers create secret-backed guest carts." },
+    { method: "GET", path: "/api/carts/:id", justification: "Guest cart reads require the cart secret; customer carts require ownership in the service." },
+    { method: "POST", path: "/api/carts/:id/items", justification: "Anonymous storefront shoppers add items to a secret-backed guest cart." },
+    { method: "PATCH", path: "/api/carts/:id/items/:itemId", justification: "Anonymous storefront shoppers change quantities in a secret-backed guest cart." },
+    { method: "DELETE", path: "/api/carts/:id/items/:itemId", justification: "Anonymous storefront shoppers remove items from a secret-backed guest cart." },
+    { method: "POST", path: "/api/checkout", justification: "Anonymous storefront checkout is authorized by the customer actor and cart/payment pipeline." },
+    { method: "GET", path: "/api/media/:id", justification: "Public media assets redirect to their configured public storage URL; signed URLs still require an actor in the handler." },
+    { method: "POST", path: "/api/promotions/validate", justification: "Storefront shoppers validate a promotion code before checkout; the route is rate-limited." },
+    { method: "POST", path: "/api/payments/webhook", justification: "The payment provider authenticates this endpoint with its signed webhook payload." },
+];
+function hasPermissionGuard(handler, method, seen = new Set()) {
+    if (typeof handler !== "function" || seen.has(handler))
+        return false;
+    seen.add(handler);
+    if (isRoutePermissionGuard(handler, method))
+        return true;
+    const composed = handler.__COMPOSED_HANDLER;
+    return hasPermissionGuard(composed, method, seen);
+}
+function splitPath(path) {
+    return path.split("/").filter(Boolean);
+}
+function pathPatternCovers(pattern, target) {
+    const patternParts = splitPath(pattern);
+    const targetParts = splitPath(target);
+    const wildcardIndex = patternParts.indexOf("*");
+    if (wildcardIndex >= 0) {
+        if (wildcardIndex !== patternParts.length - 1 || targetParts.length < wildcardIndex)
+            return false;
+    }
+    else if (patternParts.length !== targetParts.length) {
+        return false;
+    }
+    return patternParts.every((part, index) => {
+        if (part === "*")
+            return true;
+        const targetPart = targetParts[index];
+        return part.startsWith(":") || part === targetPart;
+    });
+}
+function publicRouteCovers(route) {
+    return PUBLIC_ROUTES.some((publicRoute) => publicRoute.method === route.method && pathPatternCovers(publicRoute.path, route.path));
+}
+function routeKey(route) {
+    return `${route.method} ${route.path}`;
+}
+export function findUncoveredRoutes(app) {
+    const routes = app.routes;
+    const guardedRoutes = routes
+        .map((route, index) => ({ route, index }))
+        .filter(({ route }) => route.method === "ALL" && hasPermissionGuard(route.handler));
+    const endpoints = new Map();
+    for (const [index, route] of routes.entries()) {
+        if (route.method === "ALL")
+            continue;
+        const key = routeKey(route);
+        if (!endpoints.has(key))
+            endpoints.set(key, { route, index });
+    }
+    return [...endpoints.values()]
+        .filter(({ route, index }) => {
+        if (publicRouteCovers(route))
+            return false;
+        const directlyGuarded = hasPermissionGuard(route.handler, route.method);
+        const coveredByMiddleware = guardedRoutes.some(({ route: guard, index: guardIndex }) => guardIndex <= index && pathPatternCovers(guard.path, route.path) && hasPermissionGuard(guard.handler, route.method));
+        return !directlyGuarded && !coveredByMiddleware;
+    })
+        .map(({ route }) => routeKey(route));
+}
+export function assertRouteCoverage(app) {
+    const uncovered = findUncoveredRoutes(app);
+    if (uncovered.length > 0) {
+        throw new Error(`Unclassified routes: ${uncovered.join(", ")}`);
+    }
+}

package/dist/interfaces/rest/router.d.ts

@@ -26,6 +26,7 @@
  * ```
  */
 import { z } from "@hono/zod-openapi";
+import type { CommerceConfig } from "../../config/types.js";
 import type { PluginRouteRegistration } from "../../kernel/plugin/manifest.js";
 export interface RouteHandlerContext {
     /** Validated request body (from .input()). Undefined if no .input() was called. */
@@ -36,13 +37,13 @@ export interface RouteHandlerContext {
     params: Record<string, string>;
     /** Authenticated actor. Guaranteed non-null if .auth() or .permission() was called. */
     actor: {
-        userId: string;
+        userId: string | null;
         role: string;
         permissions: string[];
         vendorId?: string | null;
         [key: string]: unknown;
     } | null;
-    /** Resolved organization ID. Derived from actor.organizationId, falls back to DEFAULT_ORG_ID. */
+    /** Resolved organization ID. Derived from actor.organizationId or the deployment config. */
     orgId: string;
     /** Kernel services (orders, cart, inventory, etc.) */
     services: Record<string, unknown>;
@@ -69,6 +70,7 @@ declare class RouteChain {
     private _requireAuth;
     private _requiredPermission;
     constructor(method: string, fullPath: string, tag: string, routesList: PluginRouteRegistration[], pluginCtx?: {
+        config?: CommerceConfig;
         services: Record<string, unknown>;
         db: unknown;
     } | undefined);
@@ -116,6 +118,7 @@ declare class RouterImpl {
     private _prefix;
     private _pluginCtx;
     constructor(tag: string, prefix: string, pluginCtx?: {
+        config?: CommerceConfig;
         services?: Record<string, unknown>;
         database?: {
             db: unknown;
@@ -123,6 +126,7 @@ declare class RouterImpl {
     });
     /** @internal — used by RouteChain to wire plugin context into handlers */
     get pluginContext(): {
+        config?: CommerceConfig;
         services: Record<string, unknown>;
         db: unknown;
     } | undefined;
@@ -155,6 +159,7 @@ declare class RouterImpl {
  * ```
  */
 export declare function router(tag: string, prefix: string, ctx?: {
+    config?: CommerceConfig;
     services?: Record<string, unknown>;
     database?: {
         db: unknown;

package/dist/interfaces/rest/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/interfaces/rest/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAe,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAwB/E,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,KAAK,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uFAAuF;IACvF,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACxH,iGAAiG;IACjG,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,gCAAgC;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,oCAAoC;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,GAAG,EAAE,OAAO,CAAC;CACd;AAID,cAAM,UAAU;IASZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS,CAAC;IAZpB,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,mBAAmB,CAAqB;gBAEtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,uBAAuB,EAAE,EACrC,SAAS,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,YAAA;IAUxE,8CAA8C;IAC9C,OAAO,CAAC,IAAI,EAAE,MAAM;IAEpB,kDAAkD;IAClD,WAAW,CAAC,IAAI,EAAE,MAAM;IAExB,4DAA4D;IAC5D,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;IAEvB,sCAAsC;IACtC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;IAEvB,wDAAwD;IACxD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;IAExB;;;OAGG;IACH,IAAI;IAEJ;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM;IAMxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;CAoHlE;AAID,cAAM,UAAU;IAMZ,OAAO,CAAC,GAAG;IALb,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAiE;gBAGzE,GAAG,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE;YAAE,EAAE,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE;IAgBhF,0EAA0E;IAC1E,IAAI,aAAa;kBAtBe,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;YAAM,OAAO;kBAsBrB;IAE/C,OAAO,CAAC,WAAW;IAMnB,GAAG,CAAC,IAAI,EAAE,MAAM;IAChB,IAAI,CAAC,IAAI,EAAE,MAAM;IACjB,KAAK,CAAC,IAAI,EAAE,MAAM;IAClB,MAAM,CAAC,IAAI,EAAE,MAAM;IACnB,GAAG,CAAC,IAAI,EAAE,MAAM;IAEhB,iEAAiE;IACjE,MAAM,IAAI,uBAAuB,EAAE;CACpC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG,UAAU,CAExI"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../src/interfaces/rest/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAe,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAwB/E,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,KAAK,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uFAAuF;IACvF,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/H,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,gCAAgC;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,oCAAoC;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,GAAG,EAAE,OAAO,CAAC;CACd;AAID,cAAM,UAAU;IASZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS,CAAC;IAZpB,OAAO,CAAC,QAAQ,CAAM;IACtB,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,mBAAmB,CAAqB;gBAEtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,uBAAuB,EAAE,EACrC,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,YAAA;IAUjG,8CAA8C;IAC9C,OAAO,CAAC,IAAI,EAAE,MAAM;IAEpB,kDAAkD;IAClD,WAAW,CAAC,IAAI,EAAE,MAAM;IAExB,4DAA4D;IAC5D,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;IAEvB,sCAAsC;IACtC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;IAEvB,wDAAwD;IACxD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO;IAExB;;;OAGG;IACH,IAAI;IAEJ;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM;IAMxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;CAwHlE;AAID,cAAM,UAAU;IAMZ,OAAO,CAAC,GAAG;IALb,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAA0F;gBAGlG,GAAG,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,cAAc,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE;YAAE,EAAE,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE;IAiBzG,0EAA0E;IAC1E,IAAI,aAAa;iBAvBc,cAAc;kBAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;YAAM,OAAO;kBAuB9C;IAE/C,OAAO,CAAC,WAAW;IAMnB,GAAG,CAAC,IAAI,EAAE,MAAM;IAChB,IAAI,CAAC,IAAI,EAAE,MAAM;IACjB,KAAK,CAAC,IAAI,EAAE,MAAM;IAClB,MAAM,CAAC,IAAI,EAAE,MAAM;IACnB,GAAG,CAAC,IAAI,EAAE,MAAM;IAEhB,iEAAiE;IACjE,MAAM,IAAI,uBAAuB,EAAE;CACpC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG,UAAU,CAEjK"}

package/dist/interfaces/rest/router.js

@@ -27,9 +27,9 @@
  */
 import { createRoute, z } from "@hono/zod-openapi";
 import { ErrorSchema } from "./schemas/shared.js";
-import { mapErrorToResponse, mapErrorToStatus } from "./utils.js";
+import { mapErrorToResponse, mapErrorToStatus, markRoutePermissionGuard } from "./utils.js";
 import { createScopedDb } from "../../kernel/database/scoped-db.js";
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 // ─── Shared OpenAPI Error Responses ──────────────────────────────────────────
 const errorResponses = {
     400: { content: { "application/json": { schema: ErrorSchema } }, description: "Bad request." },
@@ -166,7 +166,7 @@ class RouteChain {
                 // Plugin route handlers receive a db that auto-filters queries
                 // and auto-stamps inserts with the actor's organizationId.
                 const rawDb = kernel?.db;
-                const orgId = resolveOrgId(actor);
+                const orgId = resolveOrgIdForCommerce(actor, kernel?.config);
                 const scopedDb = rawDb ? createScopedDb(rawDb, orgId) : rawDb;
                 const handlerCtx = {
                     input: inputSchema ? ctx.req.valid("json") : undefined,
@@ -198,7 +198,10 @@ class RouteChain {
                 }
             }
         };
-        this.routesList.push({ openapi: routeConfig, handler: honoHandler });
+        const registeredHandler = requireAuth || requiredPermission
+            ? markRoutePermissionGuard(honoHandler)
+            : honoHandler;
+        this.routesList.push({ openapi: routeConfig, handler: registeredHandler });
     }
 }
 // ─── Router ──────────────────────────────────────────────────────────────────
@@ -216,6 +219,7 @@ class RouterImpl {
         // If plugin context is provided, wire services + db for handler access
         if (pluginCtx) {
             this._pluginCtx = {
+                ...(pluginCtx.config !== undefined ? { config: pluginCtx.config } : {}),
                 services: pluginCtx.services ?? {},
                 db: pluginCtx.database?.db,
             };

package/dist/interfaces/rest/routes/admin/compensation-failures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compensation-failures.d.ts","sourceRoot":"","sources":["../../../../../src/interfaces/rest/routes/admin/compensation-failures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAU5D,OAAO,EAAE,KAAK,MAAM,EAAwC,MAAM,gBAAgB,CAAC;AAuDnF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,gCA6F5D"}
+{"version":3,"file":"compensation-failures.d.ts","sourceRoot":"","sources":["../../../../../src/interfaces/rest/routes/admin/compensation-failures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAU5D,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,gBAAgB,CAAC;AAuDhG,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,gCAgG5D"}

package/dist/interfaces/rest/routes/admin/compensation-failures.js

@@ -1,9 +1,9 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { assertPermission } from "../../../../auth/permissions.js";
-import { resolveOrgId } from "../../../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../../../auth/org.js";
 import { CommerceValidationError } from "../../../../kernel/errors.js";
 import { listCompensationFailuresRoute, resolveCompensationFailureRoute, } from "../../schemas/compensation-failures.js";
-import { mapErrorToResponse, mapErrorToStatus } from "../../utils.js";
+import { mapErrorToResponse, mapErrorToStatus, requirePerm } from "../../utils.js";
 function toIso(d) {
     if (d == null)
         return null;
@@ -45,11 +45,13 @@ function parseResolvedFilter(raw) {
 }
 export function compensationFailureAdminRoutes(kernel) {
     const router = new OpenAPIHono();
+    router.use("/compensation-failures", requirePerm("compensation:admin"));
+    router.use("/compensation-failures/*", requirePerm("compensation:admin"));
     // @ts-expect-error -- openapi handler union return type
     router.openapi(listCompensationFailuresRoute, async (c) => {
         const actor = c.get("actor");
         assertPermission(actor, "compensation:admin");
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, kernel.config);
         const resolvedParsed = parseResolvedFilter(c.req.query("resolved"));
         if (!resolvedParsed.ok) {
             return c.json(mapErrorToResponse(new CommerceValidationError('Query "resolved" must be true, false, or all.')), 422);
@@ -82,7 +84,7 @@ export function compensationFailureAdminRoutes(kernel) {
     router.openapi(resolveCompensationFailureRoute, async (c) => {
         const actor = c.get("actor");
         assertPermission(actor, "compensation:admin");
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, kernel.config);
         const id = c.req.param("id");
         const body = c.req.valid("json");
         const found = await kernel.services.compensationFailures.findById(id);
@@ -102,7 +104,7 @@ export function compensationFailureAdminRoutes(kernel) {
         const resolved = await kernel.services.compensationFailures.markResolved({
             id,
             organizationId: orgId,
-            resolvedBy: actor.userId,
+            resolvedBy: actor.userId ?? "system",
             ...(body.notes !== undefined ? { notes: body.notes } : {}),
         });
         if (!resolved.ok) {

package/dist/interfaces/rest/routes/admin/custom-field-proposals.js

@@ -1,5 +1,5 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import { resolveOrgId } from "../../../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../../../auth/org.js";
 import { listCustomFieldProposalsRoute, } from "../../schemas/admin-custom-field-proposals.js";
 import { parsePagination, requirePerm, } from "../../utils.js";
 export function adminCustomFieldProposalRoutes(kernel) {
@@ -8,7 +8,7 @@ export function adminCustomFieldProposalRoutes(kernel) {
     router.openapi(listCustomFieldProposalsRoute, async (c) => {
         const pagination = parsePagination(c.req.query());
         const entityType = c.req.query("entityType");
-        const result = await kernel.services.catalog.repository.listProposedCustomFields(resolveOrgId(c.get("actor")), pagination, entityType !== undefined ? { entityType } : undefined);
+        const result = await kernel.services.catalog.repository.listProposedCustomFields(resolveOrgIdForCommerce(c.get("actor"), kernel.config), pagination, entityType !== undefined ? { entityType } : undefined);
         return c.json({
             data: {
                 items: result.items,

package/dist/interfaces/rest/routes/admin/permissions.d.ts

@@ -1,5 +1,5 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import type { Kernel } from "../../../../runtime/kernel.js";
-import type { AppEnv } from "../../utils.js";
+import { type AppEnv } from "../../utils.js";
 export declare function adminPermissionsRoutes(kernel: Kernel): OpenAPIHono<AppEnv, {}, "/">;
 //# sourceMappingURL=permissions.d.ts.map

package/dist/interfaces/rest/routes/admin/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../../src/interfaces/rest/routes/admin/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAI5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAa7C,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,gCAkBpD"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../../../src/interfaces/rest/routes/admin/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAI5D,OAAO,EAAE,KAAK,MAAM,EAAe,MAAM,gBAAgB,CAAC;AAa1D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,gCAoBpD"}

package/dist/interfaces/rest/routes/admin/permissions.js

@@ -1,6 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { assertPermission } from "../../../../auth/permissions.js";
 import { listAdminPermissionsRoute } from "../../schemas/admin-permissions.js";
+import { requirePerm } from "../../utils.js";
 function flattenCoreRolePermissions(config) {
     const roles = config.auth?.roles ?? {};
     const set = new Set();
@@ -13,6 +14,7 @@ function flattenCoreRolePermissions(config) {
 }
 export function adminPermissionsRoutes(kernel) {
     const router = new OpenAPIHono();
+    router.use("/permissions", requirePerm("admin"));
     router.openapi(listAdminPermissionsRoute, (c) => {
         const actor = c.get("actor");
         assertPermission(actor, "admin");

package/dist/interfaces/rest/routes/admin/staff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staff.d.ts","sourceRoot":"","sources":["../../../../../src/interfaces/rest/routes/admin/staff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAe5D,OAAO,EAAE,KAAK,MAAM,EAAe,MAAM,gBAAgB,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,gCAyO9C"}
+{"version":3,"file":"staff.d.ts","sourceRoot":"","sources":["../../../../../src/interfaces/rest/routes/admin/staff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAwB5D,OAAO,EAAE,KAAK,MAAM,EAAe,MAAM,gBAAgB,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,gCAyT9C"}