@porulle/core 0.63.0 → 0.65.0

package/src/auth/strict-org-resolution.ts

@@ -1,20 +1,13 @@
 import type { CommerceConfig } from "../config/types.js";
 
-let _bootStrictOrgResolution = false;
-
-export function setBootStrictOrgResolution(strict: boolean): void {
-  _bootStrictOrgResolution = strict;
-}
-
+/**
+ * Whether a request with no actor must fail rather than resolve to a default
+ * organization. Fail closed by default: without an actor there is no tenant,
+ * and silently resolving to a default organization served one merchant's data
+ * to unauthenticated callers on every unguarded or allowlisted read path.
+ * Single-tenant deployments that relied on that fallback opt out explicitly
+ * with `auth.strictOrgResolution: false` or `STRICT_ORG_RESOLUTION=false`.
+ */
 export function isStrictOrgResolution(config?: CommerceConfig | null): boolean {
-  // Fail closed by default. Without an actor there is no tenant, and silently
-  // resolving to a default organization served one merchant's data to
-  // unauthenticated callers on every unguarded or allowlisted read path.
-  // Single-tenant deployments that relied on that fallback opt out explicitly.
-  if (config?.auth?.strictOrgResolution === false) return false;
-  if (process.env.STRICT_ORG_RESOLUTION === "false") return false;
-  if (config?.auth?.strictOrgResolution === true) return true;
-  if (process.env.STRICT_ORG_RESOLUTION === "true") return true;
-  if ((config === undefined || config === null) && _bootStrictOrgResolution) return true;
-  return true;
+  return config?.auth?.strictOrgResolution !== false && process.env.STRICT_ORG_RESOLUTION !== "false";
 }

package/src/auth/system-actor.ts

@@ -1,11 +1,11 @@
 import type { Actor } from "./types.js";
-import { DEFAULT_ORG_ID } from "./org.js";
 
 /**
  * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
- * System actors have full permissions and are scoped to a specific organization.
+ * System actors have full permissions, so the organization they act in is
+ * always named by the caller — there is no default tenant to fall back to.
  */
-export function createSystemActor(orgId: string = DEFAULT_ORG_ID): Actor {
+export function createSystemActor(orgId: string): Actor {
   return {
     type: "api_key",
     userId: "system:internal",

package/src/config/defaults.ts

@@ -1,4 +1,5 @@
 import type { CommerceConfig } from "./types.js";
+import { DEFAULT_CUSTOMER_PERMISSIONS } from "../auth/actor.js";
 
 export const defaultConfig: Partial<CommerceConfig> = {
   version: "0.0.1",
@@ -44,28 +45,10 @@ export const defaultConfig: Partial<CommerceConfig> = {
         ],
       },
       customer: {
-        permissions: [
-          "catalog:read",
-          "cart:create",
-          "cart:read",
-          "cart:update",
-          "orders:create",
-          "orders:read:own",
-          "customers:read:self",
-          "customers:update:self",
-        ],
+        permissions: [...DEFAULT_CUSTOMER_PERMISSIONS],
       },
     },
-    customerPermissions: [
-      "catalog:read",
-      "cart:create",
-      "cart:read",
-      "cart:update",
-      "orders:create",
-      "orders:read:own",
-      "customers:read:self",
-      "customers:update:self",
-    ],
+    customerPermissions: [...DEFAULT_CUSTOMER_PERMISSIONS],
   },
   cart: {
     ttlMinutes: 60 * 24 * 7,

package/src/config/define-config.ts

@@ -1,7 +1,8 @@
 import { defaultConfig } from "./defaults.js";
-import type { CommerceConfig, DefineConfigInput } from "./types.js";
+import type { CommerceConfig } from "./types.js";
 import type { TaskDefinition } from "../kernel/jobs/types.js";
-import { defaultKernelJobTasks } from "../kernel/jobs/builtin-job-tasks.js";
+import { staleJobReaperTask } from "../kernel/jobs/reaper.js";
+import { webhookDeliveryTask } from "../modules/webhooks/tasks.js";
 import { _resetRegisteredPlugins } from "../kernel/plugin/manifest.js";
 import { noopStorageAdapter } from "../modules/media/noop-adapter.js";
 
@@ -14,7 +15,7 @@ function mergeBuiltinJobTasks(
 ): NonNullable<CommerceConfig["jobs"]> {
   const userTasks = jobs?.tasks ?? [];
   const bySlug = new Map<string, TaskDefinition>();
-  for (const t of defaultKernelJobTasks) {
+  for (const t of [webhookDeliveryTask, staleJobReaperTask] as TaskDefinition[]) {
     bySlug.set(t.slug, t);
   }
   for (const t of userTasks) {
@@ -56,7 +57,7 @@ function merge<T extends object>(base: T, next: Partial<T>): T {
  * 4. Freezing the result to prevent runtime mutation
  */
 export async function defineConfig(
-  input: DefineConfigInput,
+  input: CommerceConfig,
 ): Promise<CommerceConfig> {
   let config = merge(defaultConfig as CommerceConfig, input);
 

package/src/config/types.ts

@@ -165,6 +165,17 @@ export interface AuthConfig {
   customerPermissions?: string[];
   /** Origins allowed for CSRF protection (Better Auth `trustedOrigins`). */
   trustedOrigins?: string[];
+  /**
+   * Request headers the auth rate limiter reads the client IP from, in order (Better Auth
+   * `advanced.ipAddress.ipAddressHeaders`). Unset keeps Better Auth's default: `x-forwarded-for`, one value.
+   *
+   * On Cloudflare Workers set `["cf-connecting-ip"]`. An internet request to a Worker carries no
+   * `x-forwarded-for`, so under the default every caller has NO IP and shares one per-path bucket — one
+   * client flooding sign-in throttles everyone's. Cloudflare sets `cf-connecting-ip` and overwrites any
+   * client-sent value; over a service binding only the calling Worker can set it, so that Worker must
+   * forward a verified client IP or nothing.
+   */
+  ipAddressHeaders?: string[];
   /**
    * Predefined API key scopes. Each scope defines a named permission set
    * that can be used with `bunx @porulle/cli api-key create --scope <name>`.
@@ -431,7 +442,6 @@ export interface CommerceConfig {
   version?: string;
   database: {
     provider: "postgresql";
-    options?: Record<string, unknown>;
   };
   databaseAdapter?: DatabaseAdapter;
   auth?: AuthConfig;
@@ -559,7 +569,6 @@ export interface CommerceConfig {
   };
 }
 
-export interface DefineConfigInput extends CommerceConfig {}
 
 export interface AuthSessionLike {
   user: {
@@ -567,6 +576,8 @@ export interface AuthSessionLike {
     email?: string | null;
     name?: string | null;
     vendorId?: string | null;
+    /** Set by Better Auth's twoFactor plugin once the user has enrolled. */
+    twoFactorEnabled?: boolean | null;
   };
   session: {
     activeOrganizationId?: string | null;

package/src/hooks/checkout.ts

@@ -573,93 +573,9 @@ export const authorizePayment: BeforeHook<CheckoutData> = async ({
   return data;
 };
 
-export const capturePayment: AfterHook<OrderResult> = async ({ context }) => {
-  const payments = context.services.payments as {
-    capture(paymentIntentId: string, amount?: number, paymentMethodId?: string): Promise<unknown>;
-  };
-  const paymentIntentId = context.context.paymentIntentId as string | undefined;
-  const paymentMethodId = context.context.paymentMethodId as string | undefined;
-  if (!paymentIntentId) return;
-  await payments.capture(paymentIntentId, undefined, paymentMethodId);
-};
-
-export const reserveInventory: AfterHook<OrderResult> = async ({ result, context }) => {
-  const inventory = context.services.inventory as {
-    reserve(input: {
-      entityId: string;
-      variantId?: string;
-      quantity: number;
-      orderId: string;
-      performedBy: string;
-    }, actor?: unknown): Promise<unknown>;
-  };
-  for (const lineItem of result.lineItems ?? []) {
-    await inventory.reserve(
-      {
-        entityId: lineItem.entityId,
-        ...(lineItem.variantId != null ? { variantId: lineItem.variantId } : {}),
-        quantity: lineItem.quantity,
-        orderId: result.id,
-        performedBy: context.actor?.userId ?? "system",
-      },
-      context.actor,
-    );
-  }
-};
-
-export const initiateFulfillment: AfterHook<OrderResult> = async ({
-  result,
-  context,
-}) => {
-  const fulfillment = context.services.fulfillment as {
-    fulfillOrder(orderId: string, actor?: unknown): Promise<unknown>;
-  };
-  await fulfillment.fulfillOrder(result.id, context.actor);
-};
-
-export const sendConfirmation: AfterHook<OrderResult> = async ({ result, context }) => {
-  const customers = context.services.customers as {
-    getByUserId(
-      userId: string,
-      actor?: unknown,
-    ): Promise<{ ok: boolean; value?: { email?: string } }>;
-  };
-  const email = context.services.email as
-    | {
-        send(input: {
-          template: string;
-          to: string;
-          data?: Record<string, unknown>;
-        }): Promise<void>;
-      }
-    | undefined;
-
-  if (!result.customerId || !email?.send) return;
-  const customer = await customers.getByUserId(result.customerId, context.actor);
-  if (!customer.ok || !customer.value?.email) return;
-
-  await email.send({
-    template: "order-confirmation",
-    to: customer.value.email,
-    data: { order: result },
-  });
-};
-
-/**
- * Analytics event recording — intentional no-op.
- *
- * The DrizzleAnalyticsAdapter queries source tables (orders, inventory)
- * directly via SQL, so no separate event recording is needed. The export
- * is preserved for backwards compatibility with checkout route imports.
- */
-export const recordAnalyticsEvent: AfterHook<OrderResult> = async () => {
-  // No-op: source tables ARE the analytics events.
-};
-
 /**
- * Replaces the separate capturePayment and reserveInventory AfterHooks
- * with a single compensation chain that can roll back completed steps
- * if any step fails.
+ * Completes a placed order as one compensation chain that can roll back
+ * completed steps if any step fails.
  *
  * Order of steps:
  *   1. Reserve inventory — if this fails, no money is charged

package/src/index.ts

@@ -53,17 +53,6 @@ export {
   isUnauthenticatedActor,
   requireUserId,
 } from "./auth/permissions.js";
-export type { AccessResult, AccessContext, AccessFn, WhereClause } from "./auth/access.js";
-export {
-  accessOR,
-  accessAND,
-  conditional,
-  isAdmin,
-  isAuthenticated,
-  isDocumentOwner,
-  publicAccess,
-  denyAll,
-} from "./auth/access.js";
 
 export { HookRegistry } from "./kernel/hooks/registry.js";
 export type {
@@ -89,6 +78,7 @@ export type {
 } from "./kernel/jobs/adapter.js";
 export { NullJobsAdapter } from "./kernel/jobs/adapter.js";
 export { DrizzleJobsAdapter } from "./kernel/jobs/drizzle-adapter.js";
+export { prepareEnqueue, type PreparedEnqueue } from "./kernel/jobs/prepare-enqueue.js";
 export { runPendingJobs } from "./kernel/jobs/runner.js";
 export type { RunPendingJobsArgs } from "./kernel/jobs/runner.js";
 export type {
@@ -102,7 +92,7 @@ export type {
   JobProcessingOrderField,
   JobProcessingOrderRecord,
 } from "./kernel/jobs/types.js";
-export { BUILTIN_JOB_TASK_SLUGS, TaskNonRetryableError } from "./kernel/jobs/types.js";
+export { TaskNonRetryableError } from "./kernel/jobs/types.js";
 export { createPassThroughTaskStep } from "./kernel/jobs/step.js";
 export {
   staleJobReaperTask,
@@ -111,7 +101,7 @@ export {
   getJobsReaperIntervalMs,
 } from "./kernel/jobs/reaper.js";
 
-export { createLocalAPI, LocalAPI } from "./kernel/local-api.js";
+export { createLocalAPI } from "./kernel/local-api.js";
 export type { CommerceLocalAPI, LocalAPIOptions } from "./kernel/local-api.js";
 export { createCommerce } from "./runtime/commerce.js";
 export type { CommerceInstance } from "./runtime/commerce.js";
@@ -127,10 +117,6 @@ export type {
 export type { Result, PluginResult, PluginResultErr } from "./kernel/result.js";
 export { Ok, Err, PluginErr } from "./kernel/result.js";
 export type { PluginDb, PluginTxFn } from "./kernel/database/plugin-types.js";
-export type { ServiceRegistry } from "./kernel/service-registry.js";
-export { defineModule } from "./kernel/module/index.js";
-export type { AppModule, ModuleDeps, ServiceMap } from "./kernel/module/index.js";
-export { toHttpError, type HttpErrorResponse } from "./kernel/http-error.js";
 export { withTiming } from "./kernel/service-timing.js";
 
 export {
@@ -139,6 +125,7 @@ export {
   CommerceForbiddenError,
   CommerceUnauthorizedError,
   CommerceReauthRequiredError,
+  CommerceTwoFactorRequiredError,
   CommerceConflictError,
   CommerceInvalidTransitionError,
   OrgResolutionError,
@@ -213,6 +200,8 @@ export type {
   SearchSuggestParams,
 } from "./modules/search/adapter.js";
 export type { DatabaseAdapter } from "./kernel/database/adapter.js";
+export { normalizeExecuteShape } from "./kernel/database/adapter.js";
+export { createPGliteTransaction, type PGliteExec } from "./kernel/database/pglite-transaction.js";
 export { isValidFieldPath, validateFieldPath } from "./modules/catalog/ownership.js";
 export type { FieldPath, FieldOwner } from "./modules/catalog/ownership.js";
 export type {
@@ -240,7 +229,6 @@ export type {
 } from "./kernel/database/tx-context.js";
 export {
   createTxContext,
-  reuseOrCreateTxContext,
   withTransaction,
   isWriteContextTransactional,
   resolveWriteContextHookContext,
@@ -258,11 +246,13 @@ export type {
 export {
   getSchema,
   buildSchema,
-  getTableNames,
   getSchemaFiles,
   pushSchema,
 } from "./kernel/database/migrate.js";
 export { consoleEmailAdapter } from "./adapters/console-email.js";
+export { renderEmail, type EmailData, type EmailTemplateMap, type RenderEmailOptions } from "./adapters/email-render.js";
+export { escapeHtml } from "./utils/escape-html.js";
+export { currencyExponent, formatAmount, toMinorUnits } from "./utils/money.js";
 
 export { promotionTypeEnum, type PromotionType } from "./modules/promotions/schemas.js";
 
@@ -278,28 +268,11 @@ export type {
   Step,
 } from "./kernel/compensation/types.js";
 
-export { createRepository } from "./kernel/factory/repository-factory.js";
-export type {
-  BaseRepository,
-  SoftDeletableRepository,
-  RepositoryFor,
-  Filters,
-  FindOptions,
-} from "./kernel/factory/repository-factory.js";
 
 export type { CartItemMatcher } from "./modules/cart/matcher.js";
 export { defaultCartItemMatcher } from "./modules/cart/matcher.js";
-export { canAccessCart } from "./modules/cart/access.js";
 
-export { QueryRegistry } from "./kernel/query/registry.js";
-export { executeQuery } from "./kernel/query/executor.js";
-export type {
-  RelationDefinition,
-  EntityDefinition,
-} from "./kernel/query/registry.js";
-export type { QueryInput, QueryResult } from "./kernel/query/executor.js";
 
-export type { CommerceModuleTypes } from "./types/commerce-types.js";
 
 export { staleOrderCleanupTask } from "./modules/orders/stale-order-cleanup.js";
 export {

package/src/interfaces/rest/router.ts

@@ -28,7 +28,7 @@
 
 import { createRoute, z } from "@hono/zod-openapi";
 import { ErrorSchema } from "./schemas/shared.js";
-import { mapErrorToResponse, mapErrorToStatus, markRoutePermissionGuard } from "./utils.js";
+import { errorBody, mapErrorToStatus, markRoutePermissionGuard } from "./utils.js";
 import type { CommerceConfig } from "../../config/types.js";
 import type { PluginRouteRegistration } from "../../kernel/plugin/manifest.js";
 import { createScopedDb } from "../../kernel/database/scoped-db.js";
@@ -302,11 +302,11 @@ class RouteChain {
       } catch (error: unknown) {
         try {
           return ctx.json(
-            mapErrorToResponse(error),
+            errorBody(error),
             mapErrorToStatus(error) as number,
           );
         } catch {
-          // Fallback if mapErrorToResponse/mapErrorToStatus themselves throw
+          // Fallback if errorBody/mapErrorToStatus themselves throw
           return ctx.json(
             { error: { code: "INTERNAL_ERROR", message: "An unexpected error occurred." } },
             500,

package/src/interfaces/rest/routes/admin/compensation-failures.ts

@@ -9,7 +9,7 @@ import {
   listCompensationFailuresRoute,
   resolveCompensationFailureRoute,
 } from "../../schemas/compensation-failures.js";
-import { type AppEnv, mapErrorToResponse, mapErrorToStatus, requirePerm } from "../../utils.js";
+import { type AppEnv, errorBody, mapErrorToStatus, requirePerm } from "../../utils.js";
 
 function toIso(d: Date | null | undefined): string | null {
   if (d == null) return null;
@@ -78,7 +78,7 @@ export function compensationFailureAdminRoutes(kernel: Kernel) {
     const resolvedParsed = parseResolvedFilter(c.req.query("resolved"));
     if (!resolvedParsed.ok) {
       return c.json(
-        mapErrorToResponse(
+        errorBody(
           new CommerceValidationError(
             'Query "resolved" must be true, false, or all.',
           ),
@@ -105,7 +105,7 @@ export function compensationFailureAdminRoutes(kernel: Kernel) {
         : {}),
     });
     if (!listed.ok) {
-      return c.json(mapErrorToResponse(listed.error), mapErrorToStatus(listed.error));
+      return c.json(errorBody(listed.error), mapErrorToStatus(listed.error));
     }
     return c.json({
       items: listed.value.items.map(digestFailure),
@@ -125,7 +125,7 @@ export function compensationFailureAdminRoutes(kernel: Kernel) {
 
     const found = await kernel.services.compensationFailures.findById(id);
     if (!found.ok) {
-      return c.json(mapErrorToResponse(found.error), mapErrorToStatus(found.error));
+      return c.json(errorBody(found.error), mapErrorToStatus(found.error));
     }
     const row = found.value;
     if (!row) {
@@ -154,7 +154,7 @@ export function compensationFailureAdminRoutes(kernel: Kernel) {
       ...(body.notes !== undefined ? { notes: body.notes } : {}),
     });
     if (!resolved.ok) {
-      return c.json(mapErrorToResponse(resolved.error), mapErrorToStatus(resolved.error));
+      return c.json(errorBody(resolved.error), mapErrorToStatus(resolved.error));
     }
     return c.json({ failure: digestFailure(resolved.value) });
   });

package/src/interfaces/rest/routes/admin/entity-field-definitions.ts

@@ -12,7 +12,7 @@ import {
 } from "../../schemas/admin-entity-field-definitions.js";
 import {
   type AppEnv,
-  mapErrorToResponse,
+  errorBody,
   mapErrorToStatus,
   requirePerm,
 } from "../../utils.js";
@@ -35,7 +35,7 @@ export function adminEntityFieldDefinitionRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value }, 201);
@@ -50,7 +50,7 @@ export function adminEntityFieldDefinitionRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value });
@@ -65,7 +65,7 @@ export function adminEntityFieldDefinitionRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value });
@@ -79,7 +79,7 @@ export function adminEntityFieldDefinitionRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value });

package/src/interfaces/rest/routes/admin/staff.ts

@@ -5,7 +5,6 @@ import type { CommerceConfig } from "../../../../config/types.js";
 import type { DrizzleDatabase } from "../../../../kernel/database/drizzle-db.js";
 import { member, user, invitation } from "../../../../auth/auth-schema.js";
 import { resolveOrgIdForCommerce } from "../../../../auth/org.js";
-import { makeId } from "../../../../utils/id.js";
 import {
   listStaffRoute,
   createStaffRoute,
@@ -200,7 +199,7 @@ export function adminStaffRoutes(kernel: Kernel) {
     const rows = await db
       .insert(member)
       .values({
-        id: makeId(),
+        id: crypto.randomUUID(),
         organizationId: orgId,
         userId: body.userId,
         role: body.role,
@@ -221,7 +220,7 @@ export function adminStaffRoutes(kernel: Kernel) {
     const rows = await db
       .insert(invitation)
       .values({
-        id: makeId(),
+        id: crypto.randomUUID(),
         organizationId: orgId,
         email: body.email,
         role: body.role,

package/src/interfaces/rest/routes/analytics.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import type { Kernel } from "../../../runtime/kernel.js";
 import { getReportRoute, listReportsRoute } from "../schemas/analytics.js";
-import { type AppEnv, mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils.js";
+import { type AppEnv, errorBody, mapErrorToStatus, requirePerm } from "../utils.js";
 
 export function analyticsRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
@@ -25,7 +25,7 @@ export function analyticsRoutes(kernel: Kernel) {
       },
       c.get("actor"),
     );
-    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    if (!result.ok) return c.json(errorBody(result.error), mapErrorToStatus(result.error));
     return c.json({ data: result.value });
   });
 

package/src/interfaces/rest/routes/carts.ts

@@ -2,7 +2,7 @@ import { OpenAPIHono } from "@hono/zod-openapi";
 import type { Kernel } from "../../../runtime/kernel.js";
 import type { CreateCartInput, AddCartItemInput } from "../../../modules/cart/schemas.js";
 import { createCartRoute, addCartItemRoute, updateCartItemQuantityRoute, getCartRoute, removeCartItemRoute, listCartsRoute, recoverCartRoute } from "../schemas/carts.js";
-import { type AppEnv, mapErrorToResponse, mapErrorToStatus, parsePagination, requireMethodPerm, requirePerm } from "../utils.js";
+import { type AppEnv, errorBody, mapErrorToStatus, parsePagination, requireMethodPerm, requirePerm } from "../utils.js";
 
 export function cartRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
@@ -21,7 +21,7 @@ export function cartRoutes(kernel: Kernel) {
     const result = await kernel.services.cart.create(c.req.valid("json") as CreateCartInput, actor);
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value }, 201);
@@ -57,7 +57,7 @@ export function cartRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({
@@ -71,7 +71,7 @@ export function cartRoutes(kernel: Kernel) {
     const result = await kernel.services.cart.recover(c.req.param("id"), c.get("actor"));
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value });
@@ -80,7 +80,7 @@ export function cartRoutes(kernel: Kernel) {
   // @ts-expect-error -- openapi handler union return type
   router.openapi(getCartRoute, async (c) => {
     const actor = c.get("actor");
-    const secretHeader = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret");
+    const secretHeader = c.req.header("x-cart-secret");
     const result = await kernel.services.cart.getById(
       c.req.param("id"),
       actor,
@@ -89,7 +89,7 @@ export function cartRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value });
@@ -99,7 +99,7 @@ export function cartRoutes(kernel: Kernel) {
   // returns union responses (201 | 400 | 422). The route definition documents the
   // contract; the handler returns dynamic status.
   router.openapi(addCartItemRoute, async (c) => {
-    const secret = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
+    const secret = c.req.header("x-cart-secret") ?? undefined;
     const result = await kernel.services.cart.addItem(
       { ...c.req.valid("json"), cartId: c.req.param("id") } as AddCartItemInput,
       c.get("actor"),
@@ -108,7 +108,7 @@ export function cartRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value }, 201);
@@ -119,7 +119,7 @@ export function cartRoutes(kernel: Kernel) {
   // contract; the handler returns dynamic status.
   router.openapi(updateCartItemQuantityRoute, async (c) => {
     const body = c.req.valid("json");
-    const secret = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
+    const secret = c.req.header("x-cart-secret") ?? undefined;
     const result = await kernel.services.cart.updateQuantity(
       {
         cartId: c.req.param("id"),
@@ -132,7 +132,7 @@ export function cartRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: result.value });
@@ -140,7 +140,7 @@ export function cartRoutes(kernel: Kernel) {
 
   // @ts-expect-error -- openapi handler union return type
   router.openapi(removeCartItemRoute, async (c) => {
-    const secret = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
+    const secret = c.req.header("x-cart-secret") ?? undefined;
     const result = await kernel.services.cart.removeItem(
       c.req.param("id"),
       c.req.param("itemId"),
@@ -150,7 +150,7 @@ export function cartRoutes(kernel: Kernel) {
     );
     if (!result.ok)
       return c.json(
-        mapErrorToResponse(result.error),
+        errorBody(result.error),
         mapErrorToStatus(result.error),
       );
     return c.json({ data: { deleted: true } });