@porulle/core 0.64.0 → 0.65.0

package/dist/test-utils/rest-api-test-utils.d.ts

@@ -28,18 +28,6 @@ export declare function createTestServer(overrides?: Partial<CommerceConfig>): P
  * Helper to parse JSON response from Hono Response
  */
 export declare function parseJsonResponse<T = unknown>(response: Response): Promise<T>;
-/**
- * Common test actor with staff permissions
- */
-export declare const testActor: Actor;
-/**
- * Test actor with read-only permissions
- */
-export declare const readonlyActor: Actor;
-/**
- * Test actor with no permissions
- */
-export declare const noPermActor: Actor;
 /**
  * Helper to create a mock request with actor context
  */

package/dist/test-utils/rest-api-test-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAsCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}
+{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAKD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}

package/dist/test-utils/rest-api-test-utils.js

@@ -12,6 +12,7 @@ import { createRestRoutes } from "../interfaces/rest/index.js";
 import { createPGliteTestConfig } from "./create-test-config.js";
 import { CommerceValidationError } from "../kernel/errors.js";
 import { Ok, Err } from "../kernel/result.js";
+import { testActor } from "./test-actors.js";
 const mockPaymentAdapter = {
     providerId: "test-payments",
     async createPaymentIntent(params) {
@@ -96,8 +97,8 @@ export async function createTestServer(overrides = {}) {
         }
         catch (error) {
             // Import error handling utilities
-            const { mapErrorToResponse, mapErrorToStatus } = await import("../interfaces/rest/utils.js");
-            return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+            const { errorBody, mapErrorToStatus } = await import("../interfaces/rest/utils.js");
+            return c.json(errorBody(error), mapErrorToStatus(error));
         }
     });
     // Add REST routes
@@ -110,74 +111,6 @@ export async function createTestServer(overrides = {}) {
 export async function parseJsonResponse(response) {
     return response.json();
 }
-/**
- * Common test actor with staff permissions
- */
-export const testActor = {
-    type: "user",
-    userId: "00000000-0000-0000-0000-000000000001",
-    email: "test@example.com",
-    name: "Test Staff",
-    vendorId: null,
-    organizationId: "org_default",
-    role: "staff",
-    permissions: [
-        "catalog:create",
-        "catalog:update",
-        "catalog:read",
-        "catalog:read:unpublished",
-        "inventory:adjust",
-        "inventory:read",
-        "orders:create",
-        "orders:create:on-behalf",
-        "orders:read",
-        "orders:update",
-        "orders:manage",
-        "cart:create",
-        "cart:update",
-        "cart:read",
-        "cart:manage",
-        "customers:update:self",
-        "webhooks:manage",
-        "pricing:manage",
-        "shipping:manage",
-        "tax:manage",
-        "settings:manage",
-        "analytics:read",
-        "staff:manage",
-        "promotions:manage",
-        "promotions:read",
-        "audit:read",
-        "media:write",
-        "compensation:admin",
-    ],
-};
-/**
- * Test actor with read-only permissions
- */
-export const readonlyActor = {
-    type: "user",
-    userId: "00000000-0000-0000-0000-000000000002",
-    email: "readonly@example.com",
-    name: "Read Only User",
-    vendorId: null,
-    organizationId: "org_default",
-    role: "customer",
-    permissions: ["catalog:read", "cart:read", "orders:read:own"],
-};
-/**
- * Test actor with no permissions
- */
-export const noPermActor = {
-    type: "user",
-    userId: "00000000-0000-0000-0000-000000000003",
-    email: "noperm@example.com",
-    name: "No Perm",
-    vendorId: null,
-    organizationId: "org_default",
-    role: "customer",
-    permissions: [],
-};
 /**
  * Helper to create a mock request with actor context
  */

package/dist/test-utils/test-actors.d.ts

@@ -6,6 +6,15 @@ import type { Actor } from "../auth/types.js";
  * Better Auth API instead.
  */
 export declare const TEST_ORG_ID = "org_default";
+/**
+ * A test actor in {@link TEST_ORG_ID}. Pass only what the test is about —
+ * usually `permissions` (and `role`); everything else has a stable default.
+ */
+export declare function createTestActor(overrides?: Partial<Actor>): Actor;
+/** Staff with the permissions the REST suites exercise. */
+export declare const testActor: Actor;
+/** Read-only shopper: browses and reads its own orders, cannot create a cart. */
+export declare const readonlyActor: Actor;
 /** Admin with wildcard permissions. Use for setup operations in beforeAll. */
 export declare const testAdminActor: Actor;
 /** Staff with common operational permissions. */

package/dist/test-utils/test-actors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-actors.d.ts","sourceRoot":"","sources":["../../src/test-utils/test-actors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,gBAAiB,CAAC;AAE1C,8EAA8E;AAC9E,eAAO,MAAM,cAAc,EAAE,KAS5B,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,cAAc,EAAE,KAY5B,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,KAS/B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,eAAe,EAAE,KAS7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIjE"}
+{"version":3,"file":"test-actors.d.ts","sourceRoot":"","sources":["../../src/test-utils/test-actors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C;;;;;GAKG;AACH,eAAO,MAAM,WAAW,gBAAiB,CAAC;AAE1C;;;GAGG;AACH,wBAAgB,eAAe,CAAC,SAAS,GAAE,OAAO,CAAC,KAAK,CAAM,GAAG,KAAK,CAYrE;AAED,2DAA2D;AAC3D,eAAO,MAAM,SAAS,EAAE,KAmCtB,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,aAAa,EAAE,KAO1B,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,cAAc,EAAE,KAS5B,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,cAAc,EAAE,KAY5B,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,KAS/B,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,eAAe,EAAE,KAS7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIjE"}

package/dist/test-utils/test-actors.js

@@ -6,6 +6,68 @@ import { DEFAULT_ORG_ID } from "../auth/org.js";
  * Better Auth API instead.
  */
 export const TEST_ORG_ID = DEFAULT_ORG_ID;
+/**
+ * A test actor in {@link TEST_ORG_ID}. Pass only what the test is about —
+ * usually `permissions` (and `role`); everything else has a stable default.
+ */
+export function createTestActor(overrides = {}) {
+    return {
+        type: "user",
+        userId: "test-user-1",
+        email: "user@test.local",
+        name: "Test User",
+        vendorId: null,
+        organizationId: TEST_ORG_ID,
+        role: "staff",
+        permissions: [],
+        ...overrides,
+    };
+}
+/** Staff with the permissions the REST suites exercise. */
+export const testActor = createTestActor({
+    userId: "00000000-0000-0000-0000-000000000001",
+    email: "test@example.com",
+    name: "Test Staff",
+    role: "staff",
+    permissions: [
+        "catalog:create",
+        "catalog:update",
+        "catalog:read",
+        "catalog:read:unpublished",
+        "inventory:adjust",
+        "inventory:read",
+        "orders:create",
+        "orders:create:on-behalf",
+        "orders:read",
+        "orders:update",
+        "orders:manage",
+        "cart:create",
+        "cart:update",
+        "cart:read",
+        "cart:manage",
+        "customers:update:self",
+        "webhooks:manage",
+        "pricing:manage",
+        "shipping:manage",
+        "tax:manage",
+        "settings:manage",
+        "analytics:read",
+        "staff:manage",
+        "promotions:manage",
+        "promotions:read",
+        "audit:read",
+        "media:write",
+        "compensation:admin",
+    ],
+});
+/** Read-only shopper: browses and reads its own orders, cannot create a cart. */
+export const readonlyActor = createTestActor({
+    userId: "00000000-0000-0000-0000-000000000002",
+    email: "readonly@example.com",
+    name: "Read Only User",
+    role: "customer",
+    permissions: ["catalog:read", "cart:read", "orders:read:own"],
+});
 /** Admin with wildcard permissions. Use for setup operations in beforeAll. */
 export const testAdminActor = {
     type: "user",

package/dist/testing.d.ts

@@ -7,11 +7,8 @@
  */
 export { createTestKernel } from "./test-utils/create-test-kernel.js";
 export { createPGliteTestAdapter, type PGliteTestAdapter, type QueryLog } from "./test-utils/create-pglite-adapter.js";
-export { createTestPluginContext } from "./test-utils/create-test-plugin-context.js";
-export { createRepositoryTestHarness } from "./test-utils/create-repository-test-harness.js";
 export { createPluginTestApp, type PluginTestApp, type TestAppEnv } from "./test-utils/create-plugin-test-app.js";
-export { TEST_ORG_ID, testAdminActor, testStaffActor, testCustomerActor, testNoPermActor, jsonHeaders, } from "./test-utils/test-actors.js";
-export { beforeHook, afterHook } from "./test-utils/typed-hooks.js";
+export { TEST_ORG_ID, createTestActor, testAdminActor, testStaffActor, testCustomerActor, testNoPermActor, jsonHeaders, } from "./test-utils/test-actors.js";
 export { markOrderPaidForTest } from "./test-utils/order-test-helpers.js";
 export { isInsideTransaction } from "./kernel/hooks/deferred.js";
 export { allowHookFailure, recordedHookFailures } from "./test-utils/hook-failures.js";

package/dist/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAGtE,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,KAAK,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAClH,OAAO,EACL,WAAW,EACX,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAClE,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAQ1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAMjE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACvF,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG9D,YAAY,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAGtE,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,KAAK,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACvH,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAClH,OAAO,EACL,WAAW,EACX,eAAe,EACf,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAClE,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAQ1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAMjE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACvF,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG9D,YAAY,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/testing.js

@@ -9,11 +9,8 @@ export { createTestKernel } from "./test-utils/create-test-kernel.js";
 // The query log is the only honest statement counter: the PGlite logger sees every statement core
 // issues, which a proxy around a plugin's own handle cannot.
 export { createPGliteTestAdapter } from "./test-utils/create-pglite-adapter.js";
-export { createTestPluginContext } from "./test-utils/create-test-plugin-context.js";
-export { createRepositoryTestHarness } from "./test-utils/create-repository-test-harness.js";
 export { createPluginTestApp } from "./test-utils/create-plugin-test-app.js";
-export { TEST_ORG_ID, testAdminActor, testStaffActor, testCustomerActor, testNoPermActor, jsonHeaders, } from "./test-utils/test-actors.js";
-export { beforeHook, afterHook } from "./test-utils/typed-hooks.js";
+export { TEST_ORG_ID, createTestActor, testAdminActor, testStaffActor, testCustomerActor, testNoPermActor, jsonHeaders, } from "./test-utils/test-actors.js";
 export { markOrderPaidForTest } from "./test-utils/order-test-helpers.js";
 // The after-commit boundary predicate, so a suite can assert that the code under test really is
 // inside one. A plugin reaches the database through the `ctx.db` HANDLE, not the adapter, and the

package/dist/utils/escape-html.d.ts

@@ -0,0 +1,3 @@
+/** Escape a value for interpolation into HTML text or a quoted attribute. */
+export declare function escapeHtml(value: unknown): string;
+//# sourceMappingURL=escape-html.d.ts.map

package/dist/utils/escape-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape-html.d.ts","sourceRoot":"","sources":["../../src/utils/escape-html.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjD"}

package/dist/utils/escape-html.js

@@ -0,0 +1,9 @@
+/** Escape a value for interpolation into HTML text or a quoted attribute. */
+export function escapeHtml(value) {
+    return String(value ?? "")
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}

package/dist/utils/id.d.ts

@@ -1,5 +1,4 @@
 import type { Actor } from "../auth/types.js";
-export declare function makeId(): string;
 export declare function makeDeterministicId(value: string): Promise<string>;
 export declare function makeIdempotencyScope(actor: Actor | null | undefined, guestCredential?: string, fallbackBinding?: string): Promise<string>;
 //# sourceMappingURL=id.d.ts.map

package/dist/utils/id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,SAAS,EAC/B,eAAe,CAAC,EAAE,MAAM,EACxB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAYjB"}
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,SAAS,EAC/B,eAAe,CAAC,EAAE,MAAM,EACxB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/dist/utils/id.js

@@ -1,6 +1,3 @@
-export function makeId() {
-    return crypto.randomUUID();
-}
 export async function makeDeterministicId(value) {
     const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)));
     const bytes = digest.slice(0, 16);

package/dist/utils/logger.d.ts

@@ -1,3 +1,3 @@
 import type { Logger } from "../kernel/hooks/types.js";
-export declare function createLogger(scope: string): Logger;
+export declare function createConsoleLogger(scope: string): Logger;
 //# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAelD"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAezD"}

package/dist/utils/logger.js

@@ -1,4 +1,4 @@
-export function createLogger(scope) {
+export function createConsoleLogger(scope) {
     return {
         info(message, data) {
             // eslint-disable-next-line no-console

package/dist/utils/money.d.ts

@@ -0,0 +1,13 @@
+/** Number of minor-unit digits for an ISO 4217 code: 0 for JPY, 2 for USD. */
+export declare function currencyExponent(currency: string): number;
+/**
+ * A major-unit amount ("15.00", 15) as integer minor units in `currency`.
+ * Blank or non-numeric input answers `undefined` rather than 0, so a missing
+ * price is never mistaken for a free one.
+ */
+export declare function toMinorUnits(amount: string | number | null | undefined, currency: string): number | undefined;
+/** Minor units → "1,234.50 LKR" (or "1,500 JPY"). */
+export declare function formatAmount(minor: number, currency: string): string;
+/** An ISO 4217 code as stored: trimmed and upper-cased. */
+export declare function normalizeCurrency(currency: string): string;
+//# sourceMappingURL=money.d.ts.map

package/dist/utils/money.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.d.ts","sourceRoot":"","sources":["../../src/utils/money.ts"],"names":[],"mappings":"AA2BA,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,SAAS,CAMpB;AAED,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/utils/money.js

@@ -0,0 +1,58 @@
+/**
+ * Currencies whose minor unit IS the major unit (ISO 4217 exponent 0), so an
+ * amount of 1500 JPY is stored as 1500, not 150000.
+ *
+ * ponytail: zero- vs two-decimal only. Three-decimal currencies (KWD, BHD, OMR,
+ * JOD, TND) are treated as two-decimal everywhere in core; give them exponent 3
+ * here once pricing and documents are audited for it.
+ */
+const ZERO_DECIMAL_CURRENCIES = new Set([
+    "BIF",
+    "CLP",
+    "DJF",
+    "GNF",
+    "ISK",
+    "JPY",
+    "KMF",
+    "KRW",
+    "PYG",
+    "RWF",
+    "UGX",
+    "VND",
+    "VUV",
+    "XAF",
+    "XOF",
+    "XPF",
+]);
+/** Number of minor-unit digits for an ISO 4217 code: 0 for JPY, 2 for USD. */
+export function currencyExponent(currency) {
+    return ZERO_DECIMAL_CURRENCIES.has(currency.trim().toUpperCase()) ? 0 : 2;
+}
+/**
+ * A major-unit amount ("15.00", 15) as integer minor units in `currency`.
+ * Blank or non-numeric input answers `undefined` rather than 0, so a missing
+ * price is never mistaken for a free one.
+ */
+export function toMinorUnits(amount, currency) {
+    if (amount == null)
+        return undefined;
+    if (typeof amount === "string" && amount.trim() === "")
+        return undefined;
+    const parsed = Number(amount);
+    if (!Number.isFinite(parsed))
+        return undefined;
+    return Math.round(parsed * 10 ** currencyExponent(currency));
+}
+/** Minor units → "1,234.50 LKR" (or "1,500 JPY"). */
+export function formatAmount(minor, currency) {
+    const exponent = currencyExponent(currency);
+    const formatted = (minor / 10 ** exponent).toLocaleString("en-US", {
+        minimumFractionDigits: exponent,
+        maximumFractionDigits: exponent,
+    });
+    return `${formatted} ${currency}`;
+}
+/** An ISO 4217 code as stored: trimmed and upper-cased. */
+export function normalizeCurrency(currency) {
+    return currency.trim().toUpperCase();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -62,8 +62,8 @@
     "eslint": "^9.39.1",
     "typescript": "5.9.2",
     "vitest": "^3.2.4",
-    "@porulle/eslint-config": "0.1.0",
-    "@porulle/typescript-config": "0.1.0"
+    "@porulle/typescript-config": "0.1.0",
+    "@porulle/eslint-config": "0.1.0"
   },
   "publishConfig": {
     "access": "public"
@@ -85,11 +85,10 @@
   },
   "author": "Porulle contributors",
   "scripts": {
-    "generate:plugins": "node ./scripts/generate-plugin-types.mjs",
     "check:store-guard": "node ./scripts/check-store-guard.mjs",
     "check:auth-schema": "vitest run test/auth-schema-better-auth-parity.test.ts",
-    "build": "rm -rf dist tsconfig.build.tsbuildinfo && npm run generate:plugins && npm run check:store-guard && npm run check:auth-schema && tsc -p tsconfig.build.json",
-    "check-types": "npm run generate:plugins && npm run check:store-guard && tsc --noEmit",
+    "build": "rm -rf dist tsconfig.build.tsbuildinfo && npm run check:store-guard && npm run check:auth-schema && tsc -p tsconfig.build.json",
+    "check-types": "npm run check:store-guard && tsc --noEmit",
     "lint": "eslint . --max-warnings 1000",
     "test": "vitest run"
   }

package/src/adapters/email-render.ts

@@ -0,0 +1,63 @@
+import { escapeHtml } from "../utils/escape-html.js";
+
+export type EmailData = Record<string, unknown>;
+export type EmailTemplateMap = Record<string, (data: EmailData) => string>;
+
+export interface RenderEmailOptions {
+  /** Subject line per template name; overrides the defaults below. Plain text, not HTML. */
+  subjects?: EmailTemplateMap;
+  /** HTML body per template name; overrides the defaults. Escape caller data with `escapeHtml`. */
+  templates?: EmailTemplateMap;
+}
+
+const shortId = (value: unknown) => escapeHtml(String(value).slice(0, 8));
+
+const DEFAULT_SUBJECTS: EmailTemplateMap = {
+  "order-confirmation": (d) => `Order Confirmed${d.orderId ? ` - #${String(d.orderId).slice(0, 8)}` : ""}`,
+  "order-status-change": (d) => `Order Update - ${String(d.newStatus ?? "Status Changed")}`,
+  "password-reset": () => "Reset Your Password",
+  "email-verification": () => "Verify Your Email Address",
+  "appointment:reminder": (d) => `Appointment Reminder${d.reminderType === "1h" ? " - Starting Soon" : ""}`,
+  "appointment:confirmation-notice": () => "Appointment Confirmed",
+  "appointment:cancellation-notice": () => "Appointment Cancelled",
+  "appointment:no-show-notice": () => "Missed Appointment",
+};
+
+const DEFAULT_TEMPLATES: EmailTemplateMap = {
+  "order-confirmation": (d) =>
+    `<h2>Order Confirmed</h2><p>Thank you for your order${d.orderId ? ` <strong>#${shortId(d.orderId)}</strong>` : ""}.</p>${d.total ? `<p>Total: ${escapeHtml(d.currency ?? "USD")} ${escapeHtml(d.total)}</p>` : ""}`,
+  "order-status-change": (d) =>
+    `<h2>Order Update</h2><p>Your order${d.orderId ? ` <strong>#${shortId(d.orderId)}</strong>` : ""} status has been updated to <strong>${escapeHtml(d.newStatus ?? "unknown")}</strong>.</p>`,
+  "password-reset": (d) =>
+    `<h2>Reset Your Password</h2><p>Click the link below to reset your password:</p><p><a href="${escapeHtml(d.url ?? "#")}">Reset Password</a></p>`,
+  "email-verification": (d) =>
+    `<h2>Verify Your Email</h2><p>Click the link below to verify your email address:</p><p><a href="${escapeHtml(d.url ?? "#")}">Verify Email</a></p>`,
+  "appointment:reminder": (d) =>
+    `<h2>Appointment Reminder</h2><p>This is a${d.reminderType === "1h" ? " 1-hour" : " 24-hour"} reminder for your upcoming appointment.</p><p>Booking ID: ${escapeHtml(d.bookingId ?? "N/A")}</p>`,
+  "appointment:confirmation-notice": (d) =>
+    `<h2>Appointment Confirmed</h2><p>Your appointment has been confirmed.</p><p>Booking ID: ${escapeHtml(d.bookingId ?? "N/A")}</p>`,
+  "appointment:cancellation-notice": (d) =>
+    `<h2>Appointment Cancelled</h2><p>Your appointment has been cancelled.</p><p>Booking ID: ${escapeHtml(d.bookingId ?? "N/A")}</p>`,
+  "appointment:no-show-notice": (d) =>
+    `<h2>Missed Appointment</h2><p>You missed your appointment. Please contact us to rebook.</p><p>Booking ID: ${escapeHtml(d.bookingId ?? "N/A")}</p>`,
+};
+
+/**
+ * Subject and HTML body for a `config.email.send({ template, data })` call — the
+ * part every transport adapter (Resend, SES, …) shares. A template with no
+ * renderer falls back to a body listing its data.
+ */
+export function renderEmail(
+  template: string,
+  data: EmailData,
+  options: RenderEmailOptions = {},
+): { subject: string; html: string } {
+  const subject = options.subjects?.[template] ?? DEFAULT_SUBJECTS[template];
+  const body = options.templates?.[template] ?? DEFAULT_TEMPLATES[template];
+  return {
+    subject: subject ? subject(data) : template,
+    html: body
+      ? body(data)
+      : `<p>Notification: ${escapeHtml(template)}</p><pre>${escapeHtml(JSON.stringify(data, null, 2))}</pre>`,
+  };
+}

package/src/auth/actor.ts

@@ -3,6 +3,8 @@ import type { Actor } from "./types.js";
 import type { AuthInstance } from "./setup.js";
 import { DEFAULT_ORG_ID } from "./org.js";
 import { isCredentialRejection } from "./auth-failure.js";
+import { CommerceTwoFactorRequiredError } from "../kernel/errors.js";
+import { roleParts } from "./role-authority.js";
 
 /**
  * The slice of Better Auth's internal context this file uses. Declared here
@@ -137,6 +139,18 @@ export async function resolveActor(
     }
   }
 
+  // A role that must prove a second factor gets nothing until the member has
+  // enrolled. Refused outright rather than served as a customer, so the client
+  // can tell the member why and where to enrol.
+  // Better Auth stores a member's role as a comma-separated list, so "owner,admin"
+  // holds "owner": any listed part requires the second factor.
+  const requiredForRoles = config.auth?.twoFactor?.requiredForRoles ?? [];
+  if (roleParts(role).some((part) => requiredForRoles.includes(part)) && session.user.twoFactorEnabled !== true) {
+    throw new CommerceTwoFactorRequiredError(
+      `The "${role}" role requires two-factor authentication. Enable it at /api/auth/two-factor/enable, then sign in again.`,
+    );
+  }
+
   return {
     type: "user",
     userId: session.user.id,

package/src/auth/auth-failure.ts

@@ -16,8 +16,3 @@ export function isCredentialRejection(err: unknown): err is { name: "APIError";
   const { name, statusCode } = err as { name?: unknown; statusCode?: unknown };
   return name === "APIError" && typeof statusCode === "number";
 }
-
-/** The HTTP status better-auth attached to a credential rejection, or null for anything else. */
-export function credentialRejectionStatus(err: unknown): number | null {
-  return isCredentialRejection(err) ? err.statusCode : null;
-}

package/src/auth/middleware.ts

@@ -4,18 +4,15 @@ import type { Actor } from "./types.js";
 import type { AuthInstance } from "./setup.js";
 import { getCustomerPermissions, resolveActor } from "./actor.js";
 import { DEFAULT_ORG_ID } from "./org.js";
-import { credentialRejectionStatus, isCredentialRejection } from "./auth-failure.js";
+import { isCredentialRejection } from "./auth-failure.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 import { isIdentityFreeRoute } from "./identity-free-routes.js";
+import { CommerceTwoFactorRequiredError } from "../kernel/errors.js";
 
 function emptyToNull(value: string | null | undefined): string | null {
   return value == null || value === "" ? null : value;
 }
 
-// Exported so the storefront contract can be pinned by a test: an anonymous
-// visitor resolved by `storeResolver` gets these permissions, so dropping
-// `catalog:read` here would 401 every public storefront read.
-export { DEFAULT_CUSTOMER_PERMISSIONS } from "./actor.js";
 
 /**
  * The challenge RFC 9110 §15.5.2 requires on a 401: it "MUST include a WWW-Authenticate header
@@ -100,6 +97,10 @@ export function authMiddleware(
     try {
       actor = await resolveActor(c.req.raw.headers, auth, config, c.req.raw);
     } catch (err) {
+      // An evaluated credential that the role policy refuses — not a fault.
+      if (err instanceof CommerceTwoFactorRequiredError) {
+        return c.json({ error: { code: err.code, message: err.message } }, 403);
+      }
       reportAuthCheckFault(err, "session");
       throw err;
     }
@@ -214,7 +215,7 @@ export function authMiddleware(
           reportAuthCheckFault(err, "api_key");
           throw err;
         }
-        if (credentialRejectionStatus(err) === 429) {
+        if (err.statusCode === 429) {
           return c.json({ error: { code: "RATE_LIMITED", message: "Too many requests for this credential." } }, 429);
         }
       }

package/src/auth/permissions.ts

@@ -17,13 +17,19 @@ export function isUnauthenticatedActor(
   return actor === null || (actor.type === "user" && actor.userId === null);
 }
 
-export function hasPermission(actor: Actor | null, required: string): boolean {
-  if (!actor) return false;
-  if (actor.permissions.includes("*:*")) return true;
-
+/** Whether a permission list grants `required`: an exact entry, `resource:*`, or `*:*`. */
+export function hasPermissionFromList(
+  granted: readonly string[],
+  required: string,
+): boolean {
+  if (granted.includes("*:*")) return true;
   const [resource] = required.split(":");
-  if (resource && actor.permissions.includes(`${resource}:*`)) return true;
-  return actor.permissions.includes(required);
+  if (resource && granted.includes(`${resource}:*`)) return true;
+  return granted.includes(required);
+}
+
+export function hasPermission(actor: Actor | null, required: string): boolean {
+  return actor !== null && hasPermissionFromList(actor.permissions, required);
 }
 
 export function assertPermission(actor: Actor | null, required: string): void {

package/src/auth/role-authority.ts

@@ -1,4 +1,5 @@
 import type { CommerceConfig } from "../config/types.js";
+import { hasPermissionFromList } from "./permissions.js";
 
 const BUILTIN_ROLE_RANK: Record<string, number> = {
   owner: 3,
@@ -42,16 +43,6 @@ export function permissionsForRole(config: CommerceConfig, role: string): string
   return config.auth?.roles?.[role]?.permissions ?? [];
 }
 
-export function hasPermissionFromList(
-  actorPermissions: readonly string[],
-  required: string,
-): boolean {
-  if (actorPermissions.includes("*:*")) return true;
-
-  const [resource] = required.split(":");
-  if (resource && actorPermissions.includes(`${resource}:*`)) return true;
-  return actorPermissions.includes(required);
-}
 
 /**
  * The role's privilege rank. A composite role ranks as its strongest part, so

package/src/auth/setup.ts

@@ -91,6 +91,14 @@ export function createAuth(
     jwt(),
   ];
 
+  // Requiring a second factor while the plugin that enrols one is off would lock
+  // every listed role out with no way back in.
+  if ((config.auth?.twoFactor?.requiredForRoles?.length ?? 0) > 0 && !config.auth?.twoFactor?.enabled) {
+    throw new Error(
+      "auth.twoFactor.requiredForRoles needs auth.twoFactor.enabled: true — members of those roles could never enrol.",
+    );
+  }
+
   if (config.auth?.twoFactor?.enabled) {
     plugins.push(twoFactor({ issuer: config.storeName ?? "UnifiedCommerce" }));
   }