@porulle/core 0.58.0 → 0.60.0

package/dist/auth/auth-failure.d.ts

@@ -11,5 +11,10 @@
  * better-call's `APIError` carries `name === "APIError"` and a numeric
  * `statusCode`; its `status` is a string such as `"UNAUTHORIZED"`.
  */
-export declare function isCredentialRejection(err: unknown): boolean;
+export declare function isCredentialRejection(err: unknown): err is {
+    name: "APIError";
+    statusCode: number;
+};
+/** The HTTP status better-auth attached to a credential rejection, or null for anything else. */
+export declare function credentialRejectionStatus(err: unknown): number | null;
 //# sourceMappingURL=auth-failure.d.ts.map

package/dist/auth/auth-failure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-failure.d.ts","sourceRoot":"","sources":["../../src/auth/auth-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAI3D"}
+{"version":3,"file":"auth-failure.d.ts","sourceRoot":"","sources":["../../src/auth/auth-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAInG;AAED,iGAAiG;AACjG,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAErE"}

package/dist/auth/auth-failure.js

@@ -17,3 +17,7 @@ export function isCredentialRejection(err) {
     const { name, statusCode } = err;
     return name === "APIError" && typeof statusCode === "number";
 }
+/** The HTTP status better-auth attached to a credential rejection, or null for anything else. */
+export function credentialRejectionStatus(err) {
+    return isCredentialRejection(err) ? err.statusCode : null;
+}

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,yBAAuB,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAInE;AAKD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAuPnB"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,yBAAuB,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAInE;AAKD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAsQnB"}

package/dist/auth/middleware.js

@@ -1,6 +1,6 @@
 import { getCustomerPermissions, resolveActor } from "./actor.js";
 import { DEFAULT_ORG_ID } from "./org.js";
-import { isCredentialRejection } from "./auth-failure.js";
+import { credentialRejectionStatus, isCredentialRejection } from "./auth-failure.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 import { isIdentityFreeRoute } from "./identity-free-routes.js";
 function emptyToNull(value) {
@@ -182,14 +182,28 @@ export function authMiddleware(auth, config) {
                 }
             }
             catch (err) {
-                // An invalid, expired, or rate-limited key is a rejection: fall through
-                // to anonymous. Anything else means the key was never checked.
+                // A rejection better-auth raised was an evaluated credential; anything else means the key
+                // was never checked, and is a fault. A rate-limited key is not a bad one: say so.
                 if (!isCredentialRejection(err)) {
                     reportAuthCheckFault(err, "api_key");
                     throw err;
                 }
+                if (credentialRejectionStatus(err) === 429) {
+                    return c.json({ error: { code: "RATE_LIMITED", message: "Too many requests for this credential." } }, 429);
+                }
             }
         }
+        // A credential the caller PRESENTED and that did not verify is refused, not served as a guest.
+        // Falling through to anonymous gave a shopper whose token had expired a fresh guest cart in
+        // place of theirs, and told a broken client nothing. Absent credentials stay anonymous (guest
+        // checkout depends on it), and a stale session COOKIE is not "presented": browsers carry one on
+        // every public page, and refusing it would 401 logged-out browsing.
+        const presented = (c.req.header("x-api-key") ?? "").trim() !== "" || (c.req.header("authorization") ?? "").trim() !== "";
+        if (presented) {
+            const refused = c.json({ error: { code: "UNAUTHORIZED", message: "The presented credential could not be verified." } }, 401);
+            applyAuthenticateChallenge(refused);
+            return refused;
+        }
         if (!c.get("actor")) {
             // For anonymous requests in multi-store deployments, resolve the
             // store so catalog/search queries return the right store's data.

package/dist/modules/catalog/import-service.d.ts

@@ -103,6 +103,7 @@ export declare class CatalogImportService {
     private readonly deps;
     constructor(deps: CatalogServiceDeps);
     importProducts(page: ImportProduct[], options: ImportProductsOptions, actor: Actor | null, ctx?: CatalogWriteContext): Promise<Result<ImportProductsReport>>;
+    private importItemByItem;
     private withTransaction;
 }
 //# sourceMappingURL=import-service.d.ts.map

package/dist/modules/catalog/import-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-service.d.ts","sourceRoot":"","sources":["../../../src/modules/catalog/import-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAGjD,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAG9D,OAAO,EAAgF,KAAK,mBAAmB,EAAkB,MAAM,qCAAqC,CAAC;AAK7K,OAAO,EAYL,KAAK,4BAA4B,EAElC,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAChC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC,4BAA4B,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;CACrE;AAED,MAAM,MAAM,oBAAoB,GAC5B,mBAAmB,GACnB,SAAS,GACT,eAAe,GACf,UAAU,GACV,cAAc,GACd,oBAAoB,CAAC;AAEzB,MAAM,MAAM,sBAAsB,GAC9B;IACA,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GACC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,MAAM,WAAW,oBAAqB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,IAAI,EAAE,sBAAsB,EAAE,CAAC;CAChC;AA+SD,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,kBAAkB;IAE/C,cAAc,CAClB,IAAI,EAAE,aAAa,EAAE,EACrB,OAAO,EAAE,qBAAqB,EAC9B,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,GAAG,CAAC,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAyG1B,eAAe;CAS9B"}
+{"version":3,"file":"import-service.d.ts","sourceRoot":"","sources":["../../../src/modules/catalog/import-service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAGjD,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAG9D,OAAO,EAAgF,KAAK,mBAAmB,EAAkB,MAAM,qCAAqC,CAAC;AAK7K,OAAO,EAYL,KAAK,4BAA4B,EAElC,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,EAAE,uBAAuB,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAChC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC,4BAA4B,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;CACrE;AAED,MAAM,MAAM,oBAAoB,GAC5B,mBAAmB,GACnB,SAAS,GACT,eAAe,GACf,UAAU,GACV,cAAc,GACd,oBAAoB,CAAC;AAEzB,MAAM,MAAM,sBAAsB,GAC9B;IACA,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,GACC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,MAAM,WAAW,oBAAqB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,IAAI,EAAE,sBAAsB,EAAE,CAAC;CAChC;AA+SD,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,kBAAkB;IAE/C,cAAc,CAClB,IAAI,EAAE,aAAa,EAAE,EACrB,OAAO,EAAE,qBAAqB,EAC9B,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,GAAG,CAAC,EAAE,mBAAmB,GACxB,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAkH1B,gBAAgB;YA+ChB,eAAe;CAS9B"}

package/dist/modules/catalog/import-service.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { and, eq, inArray } from "drizzle-orm";
 import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { assertPermission } from "../../auth/permissions.js";
@@ -342,62 +343,70 @@ export class CatalogImportService {
             // committed: 36.6 s behind one 89 s page on the sim, 2026-09-24. The cost is that a page
             // rejected afterwards can leave new vocabulary behind; it is organization-wide and reusable.
             const taxonomy = await this.withTransaction(actor, undefined, (txCtx) => resolveTaxonomy(writerOf(txCtx), orgId, candidates.map(({ item }) => item)));
-            const report = await this.withTransaction(actor, ctx, async (txCtx) => {
-                const tx = writerOf(txCtx);
-                // Page-level reads: the slugs already taken, then the shared vocabulary.
-                const slugs = candidates.map(({ item }) => item.slug);
-                const taken = slugs.length === 0
-                    ? []
-                    : await tx.select({ slug: sellableEntities.slug }).from(sellableEntities)
-                        .where(and(eq(sellableEntities.organizationId, orgId), inArray(sellableEntities.slug, slugs)));
-                const takenSlugs = new Set(taken.map((row) => row.slug));
-                const writable = [];
-                for (const candidate of candidates) {
-                    if (takenSlugs.has(candidate.item.slug)) {
-                        rows[candidate.index] = failed(candidate.item.ref, "slug-conflict", `Slug "${candidate.item.slug}" already exists in this organization.`);
+            const revisionRow = (write, requestId) => ({
+                organizationId: orgId,
+                entityId: write.entityId,
+                revision: 1,
+                pinned: true,
+                snapshot: write.snapshot,
+                reason,
+                actorId: actor?.userId ?? null,
+                actorType: actor?.type ?? null,
+                requestId,
+            });
+            // Each item in its OWN transaction, so no item's rows outlive that item. As savepoints of one
+            // page transaction, an item's rows stayed uncommitted until the page's LAST item committed,
+            // and another store's page naming the same product slug (an organization-wide unique key)
+            // waited on it for the rest of the page. `reject-everything` keeps the page transaction (it
+            // must roll the page back as one), and so does a caller's transaction, which this cannot split.
+            const report = errorPolicy === "reject-failed-rows" && !isWriteContextTransactional(ctx)
+                ? await this.importItemByItem(actor, ctx, orgId, options.sourceStoreId, candidates, rows, taxonomy, revisionRow, page.length)
+                : await this.withTransaction(actor, ctx, async (txCtx) => {
+                    const tx = writerOf(txCtx);
+                    // Page-level reads: the slugs already taken, then the shared vocabulary.
+                    const slugs = candidates.map(({ item }) => item.slug);
+                    const taken = slugs.length === 0
+                        ? []
+                        : await tx.select({ slug: sellableEntities.slug }).from(sellableEntities)
+                            .where(and(eq(sellableEntities.organizationId, orgId), inArray(sellableEntities.slug, slugs)));
+                    const takenSlugs = new Set(taken.map((row) => row.slug));
+                    const writable = [];
+                    for (const candidate of candidates) {
+                        if (takenSlugs.has(candidate.item.slug)) {
+                            rows[candidate.index] = failed(candidate.item.ref, "slug-conflict", `Slug "${candidate.item.slug}" already exists in this organization.`);
+                        }
+                        else {
+                            writable.push(candidate);
+                        }
                     }
-                    else {
-                        writable.push(candidate);
+                    if (errorPolicy === "reject-everything" && writable.length < candidates.length) {
+                        throw new RejectEverything();
                     }
-                }
-                if (errorPolicy === "reject-everything" && writable.length < candidates.length) {
-                    throw new RejectEverything();
-                }
-                const written = [];
-                for (const { item, index } of writable) {
-                    try {
-                        // Drizzle nests a transaction as a SAVEPOINT; a throw inside rolls back to it and the
-                        // page continues. That is what makes one poisoned item cost one item.
-                        const write = await tx.transaction((sp) => writeItem(sp, orgId, options.sourceStoreId, item, taxonomy));
-                        written.push({ index, write });
+                    const written = [];
+                    for (const { item, index } of writable) {
+                        try {
+                            // Drizzle nests a transaction as a SAVEPOINT; a throw inside rolls back to it and the
+                            // page continues. That is what makes one poisoned item cost one item.
+                            const write = await tx.transaction((sp) => writeItem(sp, orgId, options.sourceStoreId, item, taxonomy));
+                            written.push({ index, write });
+                        }
+                        catch (error) {
+                            if (errorPolicy === "reject-everything")
+                                throw new RejectEverything();
+                            rows[index] = failed(item.ref, isUniqueViolation(error) ? "conflict" : "write-failed", describeWriteError(error));
+                        }
                     }
-                    catch (error) {
-                        if (errorPolicy === "reject-everything")
-                            throw new RejectEverything();
-                        rows[index] = failed(item.ref, isUniqueViolation(error) ? "conflict" : "write-failed", describeWriteError(error));
+                    if (written.length > 0) {
+                        await tx.insert(sellableEntityRevisions).values(written.map(({ write }) => revisionRow(write, txCtx.requestId)));
                     }
-                }
-                if (written.length > 0) {
-                    await tx.insert(sellableEntityRevisions).values(written.map(({ write }) => ({
-                        organizationId: orgId,
-                        entityId: write.entityId,
-                        revision: 1,
-                        pinned: true,
-                        snapshot: write.snapshot,
-                        reason,
-                        actorId: actor?.userId ?? null,
-                        actorType: actor?.type ?? null,
-                        requestId: txCtx.requestId,
-                    })));
-                }
-                for (const { index, write } of written) {
-                    const item = page[index];
-                    if (item)
-                        rows[index] = { ref: item.ref, status: "created", entityId: write.entityId, variantIds: write.variantIds, warnings: write.warnings };
-                }
-                const createdCount = written.length;
-                return { sourceStoreId: options.sourceStoreId, created: createdCount, failed: page.length - createdCount, rows };
-            });
+                    for (const { index, write } of written) {
+                        const item = page[index];
+                        if (item)
+                            rows[index] = { ref: item.ref, status: "created", entityId: write.entityId, variantIds: write.variantIds, warnings: write.warnings };
+                    }
+                    const createdCount = written.length;
+                    return { sourceStoreId: options.sourceStoreId, created: createdCount, failed: page.length - createdCount, rows };
+                });
             const afterHooks = this.deps.hooks.resolve("catalog.afterImport");
             if (afterHooks.length > 0) {
                 const context = catalogHookContext(this.deps, actor, ctx, "import");
@@ -411,6 +420,40 @@ export class CatalogImportService {
             return Err(toCommerceError(error));
         }
     }
+    async importItemByItem(actor, ctx, orgId, sourceStoreId, candidates, rows, taxonomy, revisionRow, pageLength) {
+        // One request id for the page, so the revisions it writes still group as one import.
+        const requestId = randomUUID();
+        const hookContext = resolveWriteContextHookContext(ctx);
+        const inItemTransaction = (fn) => this.deps.database.transaction(async (tx) => fn(writerOf(createTxContext(tx, { actor, requestId, ...(hookContext ? { hookContext } : {}) }))));
+        const slugs = candidates.map(({ item }) => item.slug);
+        const taken = slugs.length === 0
+            ? []
+            : await inItemTransaction((tx) => tx.select({ slug: sellableEntities.slug }).from(sellableEntities)
+                .where(and(eq(sellableEntities.organizationId, orgId), inArray(sellableEntities.slug, slugs))));
+        const takenSlugs = new Set(taken.map((row) => row.slug));
+        const written = [];
+        for (const { item, index } of candidates) {
+            if (takenSlugs.has(item.slug)) {
+                rows[index] = failed(item.ref, "slug-conflict", `Slug "${item.slug}" already exists in this organization.`);
+                continue;
+            }
+            try {
+                const write = await inItemTransaction((tx) => writeItem(tx, orgId, sourceStoreId, item, taxonomy));
+                rows[index] = { ref: item.ref, status: "created", entityId: write.entityId, variantIds: write.variantIds, warnings: write.warnings };
+                written.push(write);
+            }
+            catch (error) {
+                rows[index] = failed(item.ref, isUniqueViolation(error) ? "conflict" : "write-failed", describeWriteError(error));
+            }
+        }
+        // The page's revisions in ONE statement, as the page transaction wrote them: a revision per item
+        // would put a statement per product back on the import's critical path (links-provenance-budget).
+        // Revision rows carry no unique key another store's page could wait on.
+        if (written.length > 0) {
+            await inItemTransaction((tx) => tx.insert(sellableEntityRevisions).values(written.map((write) => revisionRow(write, requestId))));
+        }
+        return { sourceStoreId, created: written.length, failed: pageLength - written.length, rows };
+    }
     async withTransaction(actor, ctx, fn) {
         if (isWriteContextTransactional(ctx))
             return fn(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -62,8 +62,8 @@
     "eslint": "^9.39.1",
     "typescript": "5.9.2",
     "vitest": "^3.2.4",
-    "@porulle/eslint-config": "0.1.0",
-    "@porulle/typescript-config": "0.1.0"
+    "@porulle/typescript-config": "0.1.0",
+    "@porulle/eslint-config": "0.1.0"
   },
   "publishConfig": {
     "access": "public"

package/src/auth/auth-failure.ts

@@ -11,8 +11,13 @@
  * better-call's `APIError` carries `name === "APIError"` and a numeric
  * `statusCode`; its `status` is a string such as `"UNAUTHORIZED"`.
  */
-export function isCredentialRejection(err: unknown): boolean {
+export function isCredentialRejection(err: unknown): err is { name: "APIError"; statusCode: number } {
   if (typeof err !== "object" || err === null) return false;
   const { name, statusCode } = err as { name?: unknown; statusCode?: unknown };
   return name === "APIError" && typeof statusCode === "number";
 }
+
+/** The HTTP status better-auth attached to a credential rejection, or null for anything else. */
+export function credentialRejectionStatus(err: unknown): number | null {
+  return isCredentialRejection(err) ? err.statusCode : null;
+}

package/src/auth/middleware.ts

@@ -4,7 +4,7 @@ import type { Actor } from "./types.js";
 import type { AuthInstance } from "./setup.js";
 import { getCustomerPermissions, resolveActor } from "./actor.js";
 import { DEFAULT_ORG_ID } from "./org.js";
-import { isCredentialRejection } from "./auth-failure.js";
+import { credentialRejectionStatus, isCredentialRejection } from "./auth-failure.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 import { isIdentityFreeRoute } from "./identity-free-routes.js";
 
@@ -208,15 +208,30 @@ export function authMiddleware(
           return;
         }
       } catch (err) {
-        // An invalid, expired, or rate-limited key is a rejection: fall through
-        // to anonymous. Anything else means the key was never checked.
+        // A rejection better-auth raised was an evaluated credential; anything else means the key
+        // was never checked, and is a fault. A rate-limited key is not a bad one: say so.
         if (!isCredentialRejection(err)) {
           reportAuthCheckFault(err, "api_key");
           throw err;
         }
+        if (credentialRejectionStatus(err) === 429) {
+          return c.json({ error: { code: "RATE_LIMITED", message: "Too many requests for this credential." } }, 429);
+        }
       }
     }
 
+    // A credential the caller PRESENTED and that did not verify is refused, not served as a guest.
+    // Falling through to anonymous gave a shopper whose token had expired a fresh guest cart in
+    // place of theirs, and told a broken client nothing. Absent credentials stay anonymous (guest
+    // checkout depends on it), and a stale session COOKIE is not "presented": browsers carry one on
+    // every public page, and refusing it would 401 logged-out browsing.
+    const presented = (c.req.header("x-api-key") ?? "").trim() !== "" || (c.req.header("authorization") ?? "").trim() !== "";
+    if (presented) {
+      const refused = c.json({ error: { code: "UNAUTHORIZED", message: "The presented credential could not be verified." } }, 401);
+      applyAuthenticateChallenge(refused);
+      return refused;
+    }
+
     if (!c.get("actor")) {
       // For anonymous requests in multi-store deployments, resolve the
       // store so catalog/search queries return the right store's data.

package/src/modules/catalog/import-service.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { and, eq, inArray } from "drizzle-orm";
 import type { Actor } from "../../auth/types.js";
 import { resolveOrgIdForCommerce } from "../../auth/org.js";
@@ -480,8 +481,27 @@ export class CatalogImportService {
       // rejected afterwards can leave new vocabulary behind; it is organization-wide and reusable.
       const taxonomy = await this.withTransaction(actor, undefined, (txCtx) =>
         resolveTaxonomy(writerOf(txCtx), orgId, candidates.map(({ item }) => item)));
+      const revisionRow = (write: ItemWrite, requestId: string) => ({
+        organizationId: orgId,
+        entityId: write.entityId,
+        revision: 1,
+        pinned: true,
+        snapshot: write.snapshot,
+        reason,
+        actorId: actor?.userId ?? null,
+        actorType: actor?.type ?? null,
+        requestId,
+      });
+
+      // Each item in its OWN transaction, so no item's rows outlive that item. As savepoints of one
+      // page transaction, an item's rows stayed uncommitted until the page's LAST item committed,
+      // and another store's page naming the same product slug (an organization-wide unique key)
+      // waited on it for the rest of the page. `reject-everything` keeps the page transaction (it
+      // must roll the page back as one), and so does a caller's transaction, which this cannot split.
+      const report = errorPolicy === "reject-failed-rows" && !isWriteContextTransactional(ctx)
+        ? await this.importItemByItem(actor, ctx, orgId, options.sourceStoreId, candidates, rows, taxonomy, revisionRow, page.length)
+        : await this.withTransaction(actor, ctx, async (txCtx): Promise<ImportProductsReport> => {
 
-      const report = await this.withTransaction(actor, ctx, async (txCtx): Promise<ImportProductsReport> => {
         const tx = writerOf(txCtx);
 
         // Page-level reads: the slugs already taken, then the shared vocabulary.
@@ -517,17 +537,7 @@ export class CatalogImportService {
         }
 
         if (written.length > 0) {
-          await tx.insert(sellableEntityRevisions).values(written.map(({ write }) => ({
-            organizationId: orgId,
-            entityId: write.entityId,
-            revision: 1,
-            pinned: true,
-            snapshot: write.snapshot,
-            reason,
-            actorId: actor?.userId ?? null,
-            actorType: actor?.type ?? null,
-            requestId: txCtx.requestId,
-          })));
+          await tx.insert(sellableEntityRevisions).values(written.map(({ write }) => revisionRow(write, txCtx.requestId)));
         }
         for (const { index, write } of written) {
           const item = page[index];
@@ -549,6 +559,53 @@ export class CatalogImportService {
     }
   }
 
+  private async importItemByItem(
+    actor: Actor | null,
+    ctx: CatalogWriteContext | undefined,
+    orgId: string,
+    sourceStoreId: string,
+    candidates: Array<{ item: ImportProduct; index: number }>,
+    rows: ImportProductRowResult[],
+    taxonomy: Taxonomy,
+    revisionRow: (write: ItemWrite, requestId: string) => typeof sellableEntityRevisions.$inferInsert,
+    pageLength: number,
+  ): Promise<ImportProductsReport> {
+    // One request id for the page, so the revisions it writes still group as one import.
+    const requestId = randomUUID();
+    const hookContext = resolveWriteContextHookContext(ctx);
+    const inItemTransaction = <T>(fn: (tx: PluginDb) => Promise<T>): Promise<T> =>
+      this.deps.database.transaction(async (tx) => fn(writerOf(createTxContext(tx, { actor, requestId, ...(hookContext ? { hookContext } : {}) }))));
+
+    const slugs = candidates.map(({ item }) => item.slug);
+    const taken = slugs.length === 0
+      ? []
+      : await inItemTransaction((tx) => tx.select({ slug: sellableEntities.slug }).from(sellableEntities)
+        .where(and(eq(sellableEntities.organizationId, orgId), inArray(sellableEntities.slug, slugs))));
+    const takenSlugs = new Set(taken.map((row) => row.slug));
+
+    const written: ItemWrite[] = [];
+    for (const { item, index } of candidates) {
+      if (takenSlugs.has(item.slug)) {
+        rows[index] = failed(item.ref, "slug-conflict", `Slug "${item.slug}" already exists in this organization.`);
+        continue;
+      }
+      try {
+        const write = await inItemTransaction((tx) => writeItem(tx, orgId, sourceStoreId, item, taxonomy));
+        rows[index] = { ref: item.ref, status: "created", entityId: write.entityId, variantIds: write.variantIds, warnings: write.warnings };
+        written.push(write);
+      } catch (error) {
+        rows[index] = failed(item.ref, isUniqueViolation(error) ? "conflict" : "write-failed", describeWriteError(error));
+      }
+    }
+    // The page's revisions in ONE statement, as the page transaction wrote them: a revision per item
+    // would put a statement per product back on the import's critical path (links-provenance-budget).
+    // Revision rows carry no unique key another store's page could wait on.
+    if (written.length > 0) {
+      await inItemTransaction((tx) => tx.insert(sellableEntityRevisions).values(written.map((write) => revisionRow(write, requestId))));
+    }
+    return { sourceStoreId, created: written.length, failed: pageLength - written.length, rows };
+  }
+
   private async withTransaction<T>(
     actor: Actor | null,
     ctx: CatalogWriteContext | undefined,