@porulle/core 0.21.0 → 0.23.0

package/dist/auth/actor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../src/auth/actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,mBAAmB,qBAAwC,CAAC;AAEzE,eAAO,MAAM,4BAA4B,0JAS/B,CAAC;AAEX,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,EAAE,CAEvE;AAsBD,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAsD,GAC9D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CA2EvB"}
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../src/auth/actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAmB/C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,mBAAmB,qBAAwC,CAAC;AAEzE,eAAO,MAAM,4BAA4B,0JAS/B,CAAC;AAEX,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,EAAE,CAEvE;AAkED,8EAA8E;AAC9E,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,OAAsD,GAC9D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAiDvB"}

package/dist/auth/actor.js

@@ -31,6 +31,44 @@ function toIsoString(value) {
     const date = value instanceof Date ? value : typeof value === "string" ? new Date(value) : null;
     return date !== null && Number.isFinite(date.getTime()) ? date.toISOString() : null;
 }
+/**
+ * The caller's role in one organization, by one indexed read of `member`.
+ *
+ * This used to go through the organization plugin's endpoints, and that cost six
+ * statements instead of one. `getFullOrganization` loads the organization row,
+ * its invitations and its ENTIRE member list, then scans in JavaScript for a
+ * single membership; `getActiveMemberRole` then looks for the same membership
+ * again. Both take `headers` and re-resolve the session from them, so each also
+ * re-reads `session` and `user`, and the plugin writes `active_organization_id`
+ * back to the session row — a write on the hot path of every GET.
+ *
+ * For a shopper every one of those is a guaranteed miss: a shopper is not a
+ * member of the platform organization and never will be. The member-by-
+ * organization scan also grows with the member list, so the platform's busiest
+ * request got slower as the platform got bigger.
+ *
+ * The adapter read below is the same query the plugin ended with, issued once
+ * and without re-resolving anything. `findOne` returning null IS the answer for
+ * a shopper — one miss, done.
+ */
+async function findMembershipRole(auth, userId, organizationId) {
+    try {
+        const context = await auth.$context;
+        const membership = await context?.adapter?.findOne({
+            model: "member",
+            where: [
+                { field: "userId", value: userId },
+                { field: "organizationId", value: organizationId },
+            ],
+        });
+        return membership?.role;
+    }
+    catch {
+        // A membership that cannot be read is not a role. Treated as customer, as
+        // the plugin-endpoint version was, so this stays a performance change.
+        return undefined;
+    }
+}
 /** Resolve a better-auth session and its porulle organization permissions. */
 export async function resolveActor(headers, auth, config, request = new Request("http://localhost", { headers })) {
     let session;
@@ -52,32 +90,10 @@ export async function resolveActor(headers, auth, config, request = new Request(
     const defaultOrgId = config.auth?.defaultOrganizationId ?? DEFAULT_ORG_ID;
     let role = session.session.activeOrganizationRole;
     let orgId = session.session.activeOrganizationId;
-    if (!role && auth.api.getFullOrganization) {
-        try {
-            const org = await auth.api.getFullOrganization({
-                query: { organizationId: orgId ?? defaultOrgId },
-                headers,
-            });
-            if (org?.members) {
-                const membership = org.members.find((m) => m.userId === session.user.id);
-                if (membership) {
-                    role = membership.role;
-                    orgId = orgId ?? defaultOrgId;
-                }
-            }
-        }
-        catch {
-            // fall through — treat as customer
-        }
-    }
-    if (!role && orgId && auth.api.getActiveMemberRole) {
-        try {
-            const roleResult = await auth.api.getActiveMemberRole({ headers });
-            role = roleResult?.role;
-        }
-        catch {
-            // fall through — treat as customer
-        }
+    if (!role) {
+        role = await findMembershipRole(auth, session.user.id, orgId ?? defaultOrgId);
+        if (role)
+            orgId = orgId ?? defaultOrgId;
     }
     if (!orgId && config.auth?.storeResolver) {
         try {

package/dist/modules/cart/service.d.ts

@@ -37,6 +37,13 @@ export declare class CartService {
         lineItems: CartLineItem[];
     }>>;
     addItem(input: AddCartItemInput, actor?: Actor | null, ctx?: TxContext, presentedSecret?: string): Promise<Result<CartLineItem>>;
+    /**
+     * The unit price for a new cart line, from the pricing step. Refuses — naming the entity and the
+     * currency — when no price is configured, when the pricing service is absent, or when resolution
+     * fails for any other reason: every one of those is a value the system cannot determine, and the
+     * defect this replaces was substituting a literal for exactly that.
+     */
+    private resolveUnitPrice;
     removeItem(cartId: string, itemId: string, actor?: Actor | null, ctx?: TxContext, presentedSecret?: string): Promise<Result<void>>;
     updateQuantity(input: UpdateCartItemInput, actor?: Actor | null, ctx?: TxContext, presentedSecret?: string): Promise<Result<CartLineItem>>;
     merge(sourceCartId: string, targetCartId: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<void>>;

package/dist/modules/cart/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/cart/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAc5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAY,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAE5E,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,cAAc,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AA+BD,qBAAa,WAAW;IAIV,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,eAAe;IAKnC,MAAM,CACV,KAAK,EAAE,eAAe,EACtB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA0ElB,OAAO,CACX,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;QAAE,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IA6BxD;;;;OAIG;IACG,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;QAAE,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IAWlD,OAAO,CACX,KAAK,EAAE,gBAAgB,EACvB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAmH1B,UAAU,CACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAqClB,cAAc,CAClB,KAAK,EAAE,mBAAmB,EAC1B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAoD1B,KAAK,CACT,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyCxB;;;;OAIG;IACG,IAAI,CACR,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,IAAI,CAAC;QACjB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG;YAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAoBrG;;;;;OAKG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CACR,MAAM,CAAC;QACL,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC,CACH;IA6CK,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASrF,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASxB;;;;;;OAMG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYxB;;;;;;OAMG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAI/B;;;;OAIG;IACG,eAAe,CACnB,QAAQ,SAAQ,EAChB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAsBlD;;;;OAIG;IACG,UAAU,CACd,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,KAAK,EACZ,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA0CxB;;;;;OAKG;YACW,sBAAsB;IAmBpC;;;;;;;;;;OAUG;YACW,mBAAmB;IAuCjC;;;;;;;;OAQG;YACW,oBAAoB;CA4CnC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/cart/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAc5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAY,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAE5E,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,cAAc,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AA+BD,qBAAa,WAAW;IAIV,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,eAAe;IAKnC,MAAM,CACV,KAAK,EAAE,eAAe,EACtB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA0ElB,OAAO,CACX,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;QAAE,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IA6BxD;;;;OAIG;IACG,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG;QAAE,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAC;IAWlD,OAAO,CACX,KAAK,EAAE,gBAAgB,EACvB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IA6IhC;;;;;OAKG;YACW,gBAAgB;IA4CxB,UAAU,CACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAqClB,cAAc,CAClB,KAAK,EAAE,mBAAmB,EAC1B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,EACf,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAoD1B,KAAK,CACT,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAyCxB;;;;OAIG;IACG,IAAI,CACR,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,IAAI,CAAC;QACjB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG;YAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAoBrG;;;;;OAKG;IACG,OAAO,CACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CACR,MAAM,CAAC;QACL,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KAC3B,CAAC,CACH;IA6CK,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASrF,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IASxB;;;;;;OAMG;IACG,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAYxB;;;;;;OAMG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAI/B;;;;OAIG;IACG,eAAe,CACnB,QAAQ,SAAQ,EAChB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAsBlD;;;;OAIG;IACG,UAAU,CACd,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,KAAK,EACZ,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IA0CxB;;;;;OAKG;YACW,sBAAsB;IAmBpC;;;;;;;;;;OAUG;YACW,mBAAmB;IAuCjC;;;;;;;;OAQG;YACW,oBAAoB;CA4CnC"}

package/dist/modules/cart/service.js

@@ -191,12 +191,35 @@ export class CartService {
             item = updated;
         }
         else {
+            // A new line needs a price, and a price the system cannot determine is refused rather than
+            // invented. This used to read `processed.unitPriceSnapshot ?? 1000`: a silent default in a
+            // money path, which nothing in the response, the logs or the schema disclosed. An integrator
+            // found it by comparing a deployed cart reading 1000 against a catalog priced 14500-22800.
+            //
+            // A hook still wins when it supplies one, so bespoke pricing keeps its seam; otherwise the
+            // pricing step answers — the SAME step `resolveCurrentPrices` uses at checkout, so a cart and
+            // its order agree by construction rather than by an integrator remembering to install a hook.
+            const currency = processed.currency ?? cart.currency;
+            let unitPriceSnapshot = processed.unitPriceSnapshot;
+            if (unitPriceSnapshot === undefined) {
+                const resolved = await this.resolveUnitPrice({
+                    entityId: processed.entityId,
+                    currency,
+                    quantity,
+                    ...(processed.variantId != null
+                        ? { variantId: processed.variantId }
+                        : {}),
+                }, actor ?? null, ctx);
+                if (!resolved.ok)
+                    return resolved;
+                unitPriceSnapshot = resolved.value;
+            }
             item = await this.repo.createLineItem({
                 cartId: input.cartId,
                 entityId: processed.entityId,
                 quantity,
-                unitPriceSnapshot: processed.unitPriceSnapshot ?? 1000,
-                currency: processed.currency ?? cart.currency,
+                unitPriceSnapshot,
+                currency,
                 metadata: processed.metadata ?? {},
                 ...(processed.variantId !== undefined
                     ? { variantId: processed.variantId }
@@ -206,6 +229,23 @@ export class CartService {
         await runAfterHooks(afterHooks, null, item, "addItem", context);
         return Ok(item);
     }
+    /**
+     * The unit price for a new cart line, from the pricing step. Refuses — naming the entity and the
+     * currency — when no price is configured, when the pricing service is absent, or when resolution
+     * fails for any other reason: every one of those is a value the system cannot determine, and the
+     * defect this replaces was substituting a literal for exactly that.
+     */
+    async resolveUnitPrice(input, actor, ctx) {
+        const pricing = this.deps.services.pricing;
+        if (typeof pricing?.resolve !== "function") {
+            return Err(new CommerceValidationError(`Cannot resolve a unit price for ${input.entityId}: no pricing service is configured.`));
+        }
+        const resolved = await pricing.resolve(input, actor, ctx);
+        if (!resolved.ok) {
+            return Err(new CommerceValidationError(`Cannot resolve a unit price for ${input.entityId} (${input.currency}). Configure a price for it, or supply unitPriceSnapshot from a cart.beforeAddItem hook.`));
+        }
+        return Ok(resolved.value.finalAmount);
+    }
     async removeItem(cartId, itemId, actor, ctx, presentedSecret) {
         try {
             assertPermission(actor ?? null, "cart:update");

package/dist/test-utils/create-pglite-adapter.d.ts

@@ -13,6 +13,20 @@
  */
 import type { DatabaseAdapter } from "../kernel/database/adapter.js";
 import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
+/**
+ * Records the SQL statements issued between `start()` and `stop()`.
+ *
+ * Counting statements is the regression guard for round-trip cost: the queries
+ * behind an authenticated request take 0.3 ms of database time between them, so
+ * a timing assertion measures the network and tells you nothing you can act on,
+ * while a count is stable, fast and names exactly what regressed.
+ */
+export interface QueryLog {
+    /** Begin recording; clears anything previously recorded. */
+    start(): void;
+    /** Stop recording and return the statements captured, in order. */
+    stop(): string[];
+}
 /**
  * Creates a PGlite-backed database adapter for testing.
  *
@@ -28,5 +42,6 @@ export declare function createPGliteTestAdapter(): Promise<{
     adapter: DatabaseAdapter;
     db: DrizzleDatabase;
     cleanup: () => Promise<void>;
+    queryLog: QueryLog;
 }>;
 //# sourceMappingURL=create-pglite-adapter.d.ts.map

package/dist/test-utils/create-pglite-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA0BxE;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqFD"}
+{"version":3,"file":"create-pglite-adapter.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-pglite-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,4DAA4D;IAC5D,KAAK,IAAI,IAAI,CAAC;IACd,mEAAmE;IACnE,IAAI,IAAI,MAAM,EAAE,CAAC;CAClB;AA0BD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC;IACvD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,eAAe,CAAC;IACpB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAAC,CA6GD"}

package/dist/test-utils/create-pglite-adapter.js

@@ -50,8 +50,32 @@ async function pushCoreSchema(db) {
 export async function createPGliteTestAdapter() {
     // Create in-memory PGlite instance
     const pg = new PGlite();
+    // Every statement Drizzle issues passes through this logger, and Better Auth's
+    // drizzleAdapter shares this same instance — so a recording covers the auth
+    // reads too. That is the point: the only honest regression guard for "this
+    // request costs N round trips" is a count of the statements, not a stopwatch.
+    const recorded = [];
+    let recording = false;
+    const queryLog = {
+        start() {
+            recorded.length = 0;
+            recording = true;
+        },
+        stop() {
+            recording = false;
+            return [...recorded];
+        },
+    };
     // Wrap with Drizzle ORM first (pushSchema needs the Drizzle instance)
-    const db = drizzle(pg, { schema: fullSchema });
+    const db = drizzle(pg, {
+        schema: fullSchema,
+        logger: {
+            logQuery(query) {
+                if (recording)
+                    recorded.push(query);
+            },
+        },
+    });
     // Push core schema via drizzle-kit/api (no migration files needed)
     // PgliteDatabase<Schema> and DrizzleDatabase share the same Schema type;
     // the HKT parameter differs (PgliteQueryResultHKT vs PgQueryResultHKT)
@@ -125,5 +149,5 @@ export async function createPGliteTestAdapter() {
         // Re-insert default org after truncation (CASCADE wipes it)
         await ensureDefaultOrg(db);
     }
-    return { adapter, db, cleanup };
+    return { adapter, db, cleanup, queryLog };
 }

package/dist/test-utils/create-test-config.d.ts

@@ -1,4 +1,5 @@
 import type { CommerceConfig } from "../config/types.js";
+import type { QueryLog } from "./create-pglite-adapter.js";
 export declare function createTestConfig(overrides?: Partial<CommerceConfig>): Promise<CommerceConfig>;
 /**
  * Creates a test config backed by PGlite (in-memory PostgreSQL).
@@ -14,5 +15,6 @@ export declare function createTestConfig(overrides?: Partial<CommerceConfig>): P
 export declare function createPGliteTestConfig(overrides?: Partial<CommerceConfig>): Promise<{
     config: CommerceConfig;
     cleanup: () => Promise<void>;
+    queryLog: QueryLog;
 }>;
 //# sourceMappingURL=create-test-config.d.ts.map

package/dist/test-utils/create-test-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAqHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}
+{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AA8C3D,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAqHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAAC,CAUD"}

package/dist/test-utils/create-test-config.js

@@ -169,10 +169,10 @@ export async function createTestConfig(overrides = {}) {
  */
 export async function createPGliteTestConfig(overrides = {}) {
     const { createPGliteTestAdapter } = await import("./create-pglite-adapter.js");
-    const { adapter, cleanup } = await createPGliteTestAdapter();
+    const { adapter, cleanup, queryLog } = await createPGliteTestAdapter();
     const config = await createTestConfig({
         databaseAdapter: adapter,
         ...overrides,
     });
-    return { config, cleanup };
+    return { config, cleanup, queryLog };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/actor.ts

@@ -4,6 +4,21 @@ import type { AuthInstance } from "./setup.js";
 import { DEFAULT_ORG_ID } from "./org.js";
 import { isCredentialRejection } from "./auth-failure.js";
 
+/**
+ * The slice of Better Auth's internal context this file uses. Declared here
+ * rather than imported because `$context` is not on the public `Auth` type; if a
+ * future Better Auth removes or renames it, `findMembershipRole` degrades to
+ * "no role" rather than throwing, and the membership tests fail loudly.
+ */
+interface AuthContextLike {
+  adapter?: {
+    findOne<T>(query: {
+      model: string;
+      where: { field: string; value: unknown }[];
+    }): Promise<T | null>;
+  };
+}
+
 export const AUTH_COOKIE_PREFIX = "uc";
 export const SESSION_COOKIE_NAME = `${AUTH_COOKIE_PREFIX}.session_token`;
 
@@ -42,6 +57,50 @@ function toIsoString(value: unknown): string | null {
   return date !== null && Number.isFinite(date.getTime()) ? date.toISOString() : null;
 }
 
+/**
+ * The caller's role in one organization, by one indexed read of `member`.
+ *
+ * This used to go through the organization plugin's endpoints, and that cost six
+ * statements instead of one. `getFullOrganization` loads the organization row,
+ * its invitations and its ENTIRE member list, then scans in JavaScript for a
+ * single membership; `getActiveMemberRole` then looks for the same membership
+ * again. Both take `headers` and re-resolve the session from them, so each also
+ * re-reads `session` and `user`, and the plugin writes `active_organization_id`
+ * back to the session row — a write on the hot path of every GET.
+ *
+ * For a shopper every one of those is a guaranteed miss: a shopper is not a
+ * member of the platform organization and never will be. The member-by-
+ * organization scan also grows with the member list, so the platform's busiest
+ * request got slower as the platform got bigger.
+ *
+ * The adapter read below is the same query the plugin ended with, issued once
+ * and without re-resolving anything. `findOne` returning null IS the answer for
+ * a shopper — one miss, done.
+ */
+async function findMembershipRole(
+  auth: AuthInstance,
+  userId: string,
+  organizationId: string,
+): Promise<string | undefined> {
+  try {
+    const context = await (
+      auth as unknown as { $context?: Promise<AuthContextLike> }
+    ).$context;
+    const membership = await context?.adapter?.findOne<{ role?: string }>({
+      model: "member",
+      where: [
+        { field: "userId", value: userId },
+        { field: "organizationId", value: organizationId },
+      ],
+    });
+    return membership?.role;
+  } catch {
+    // A membership that cannot be read is not a role. Treated as customer, as
+    // the plugin-endpoint version was, so this stays a performance change.
+    return undefined;
+  }
+}
+
 /** Resolve a better-auth session and its porulle organization permissions. */
 export async function resolveActor(
   headers: Headers,
@@ -68,35 +127,9 @@ export async function resolveActor(
   let role = session.session.activeOrganizationRole as string | undefined;
   let orgId = session.session.activeOrganizationId as string | null;
 
-  if (!role && auth.api.getFullOrganization) {
-    try {
-      const org = await auth.api.getFullOrganization({
-        query: { organizationId: orgId ?? defaultOrgId },
-        headers,
-      });
-      if (org?.members) {
-        const membership = org.members.find(
-          (m) => m.userId === session.user.id,
-        );
-        if (membership) {
-          role = membership.role;
-          orgId = orgId ?? defaultOrgId;
-        }
-      }
-    } catch {
-      // fall through — treat as customer
-    }
-  }
-
-  if (!role && orgId && auth.api.getActiveMemberRole) {
-    try {
-      const roleResult = await auth.api.getActiveMemberRole({ headers });
-      role = (roleResult as Record<string, unknown>)?.role as
-        | string
-        | undefined;
-    } catch {
-      // fall through — treat as customer
-    }
+  if (!role) {
+    role = await findMembershipRole(auth, session.user.id, orgId ?? defaultOrgId);
+    if (role) orgId = orgId ?? defaultOrgId;
   }
 
   if (!orgId && config.auth?.storeResolver) {

package/src/modules/cart/service.ts

@@ -318,13 +318,39 @@ export class CartService {
       );
       item = updated!;
     } else {
+      // A new line needs a price, and a price the system cannot determine is refused rather than
+      // invented. This used to read `processed.unitPriceSnapshot ?? 1000`: a silent default in a
+      // money path, which nothing in the response, the logs or the schema disclosed. An integrator
+      // found it by comparing a deployed cart reading 1000 against a catalog priced 14500-22800.
+      //
+      // A hook still wins when it supplies one, so bespoke pricing keeps its seam; otherwise the
+      // pricing step answers — the SAME step `resolveCurrentPrices` uses at checkout, so a cart and
+      // its order agree by construction rather than by an integrator remembering to install a hook.
+      const currency = processed.currency ?? cart.currency;
+      let unitPriceSnapshot = processed.unitPriceSnapshot;
+      if (unitPriceSnapshot === undefined) {
+        const resolved = await this.resolveUnitPrice(
+          {
+            entityId: processed.entityId,
+            currency,
+            quantity,
+            ...(processed.variantId != null
+              ? { variantId: processed.variantId }
+              : {}),
+          },
+          actor ?? null,
+          ctx,
+        );
+        if (!resolved.ok) return resolved;
+        unitPriceSnapshot = resolved.value;
+      }
       item = await this.repo.createLineItem(
         {
           cartId: input.cartId,
           entityId: processed.entityId,
           quantity,
-          unitPriceSnapshot: processed.unitPriceSnapshot ?? 1000,
-          currency: processed.currency ?? cart.currency,
+          unitPriceSnapshot,
+          currency,
           metadata: processed.metadata ?? {},
           ...(processed.variantId !== undefined
             ? { variantId: processed.variantId }
@@ -339,6 +365,56 @@ export class CartService {
     return Ok(item);
   }
 
+  /**
+   * The unit price for a new cart line, from the pricing step. Refuses — naming the entity and the
+   * currency — when no price is configured, when the pricing service is absent, or when resolution
+   * fails for any other reason: every one of those is a value the system cannot determine, and the
+   * defect this replaces was substituting a literal for exactly that.
+   */
+  private async resolveUnitPrice(
+    input: {
+      entityId: string;
+      currency: string;
+      quantity: number;
+      variantId?: string;
+    },
+    actor: Actor | null,
+    ctx?: TxContext,
+  ): Promise<Result<number>> {
+    const pricing = this.deps.services.pricing as
+      | {
+          resolve(
+            params: {
+              entityId: string;
+              currency: string;
+              quantity: number;
+              variantId?: string;
+            },
+            actor?: Actor | null,
+            ctx?: TxContext,
+          ): Promise<Result<{ finalAmount: number }>>;
+        }
+      | undefined;
+
+    if (typeof pricing?.resolve !== "function") {
+      return Err(
+        new CommerceValidationError(
+          `Cannot resolve a unit price for ${input.entityId}: no pricing service is configured.`,
+        ),
+      );
+    }
+
+    const resolved = await pricing.resolve(input, actor, ctx);
+    if (!resolved.ok) {
+      return Err(
+        new CommerceValidationError(
+          `Cannot resolve a unit price for ${input.entityId} (${input.currency}). Configure a price for it, or supply unitPriceSnapshot from a cart.beforeAddItem hook.`,
+        ),
+      );
+    }
+    return Ok(resolved.value.finalAmount);
+  }
+
   async removeItem(
     cartId: string,
     itemId: string,

package/src/test-utils/create-pglite-adapter.ts

@@ -24,6 +24,21 @@ import { ensureDefaultOrg } from "../auth/org.js";
 import * as fullSchema from "../kernel/database/schema.js";
 import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
 
+/**
+ * Records the SQL statements issued between `start()` and `stop()`.
+ *
+ * Counting statements is the regression guard for round-trip cost: the queries
+ * behind an authenticated request take 0.3 ms of database time between them, so
+ * a timing assertion measures the network and tells you nothing you can act on,
+ * while a count is stable, fast and names exactly what regressed.
+ */
+export interface QueryLog {
+  /** Begin recording; clears anything previously recorded. */
+  start(): void;
+  /** Stop recording and return the statements captured, in order. */
+  stop(): string[];
+}
+
 // drizzle-kit/api uses CJS internally; createRequire provides ESM compat.
 const require = createRequire(import.meta.url);
 
@@ -63,12 +78,37 @@ export async function createPGliteTestAdapter(): Promise<{
   adapter: DatabaseAdapter;
   db: DrizzleDatabase;
   cleanup: () => Promise<void>;
+  queryLog: QueryLog;
 }> {
   // Create in-memory PGlite instance
   const pg = new PGlite();
 
+  // Every statement Drizzle issues passes through this logger, and Better Auth's
+  // drizzleAdapter shares this same instance — so a recording covers the auth
+  // reads too. That is the point: the only honest regression guard for "this
+  // request costs N round trips" is a count of the statements, not a stopwatch.
+  const recorded: string[] = [];
+  let recording = false;
+  const queryLog: QueryLog = {
+    start() {
+      recorded.length = 0;
+      recording = true;
+    },
+    stop() {
+      recording = false;
+      return [...recorded];
+    },
+  };
+
   // Wrap with Drizzle ORM first (pushSchema needs the Drizzle instance)
-  const db = drizzle(pg, { schema: fullSchema });
+  const db = drizzle(pg, {
+    schema: fullSchema,
+    logger: {
+      logQuery(query) {
+        if (recording) recorded.push(query);
+      },
+    },
+  });
 
   // Push core schema via drizzle-kit/api (no migration files needed)
   // PgliteDatabase<Schema> and DrizzleDatabase share the same Schema type;
@@ -147,5 +187,5 @@ export async function createPGliteTestAdapter(): Promise<{
     await ensureDefaultOrg(db);
   }
 
-  return { adapter, db, cleanup };
+  return { adapter, db, cleanup, queryLog };
 }

package/src/test-utils/create-test-config.ts

@@ -2,6 +2,7 @@ import { defineConfig } from "../config/define-config.js";
 import type { CommerceConfig } from "../config/types.js";
 import { Ok } from "../kernel/result.js";
 import type { StorageAdapter } from "../modules/media/adapter.js";
+import type { QueryLog } from "./create-pglite-adapter.js";
 
 function createInMemoryStorageAdapter(): StorageAdapter {
   const files = new Map<string, { data: ArrayBuffer; contentType: string }>();
@@ -181,14 +182,18 @@ export async function createTestConfig(
  */
 export async function createPGliteTestConfig(
   overrides: Partial<CommerceConfig> = {},
-): Promise<{ config: CommerceConfig; cleanup: () => Promise<void> }> {
+): Promise<{
+  config: CommerceConfig;
+  cleanup: () => Promise<void>;
+  queryLog: QueryLog;
+}> {
   const { createPGliteTestAdapter } = await import("./create-pglite-adapter.js");
-  const { adapter, cleanup } = await createPGliteTestAdapter();
+  const { adapter, cleanup, queryLog } = await createPGliteTestAdapter();
 
   const config = await createTestConfig({
     databaseAdapter: adapter,
     ...overrides,
   });
 
-  return { config, cleanup };
+  return { config, cleanup, queryLog };
 }