@porulle/core 0.7.0 → 0.9.0

package/src/interfaces/rest/routes/analytics.ts

@@ -0,0 +1,33 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { Kernel } from "../../../runtime/kernel.js";
+import { getReportRoute, listReportsRoute } from "../schemas/analytics.js";
+import { type AppEnv, mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils.js";
+
+export function analyticsRoutes(kernel: Kernel) {
+  const router = new OpenAPIHono<AppEnv>();
+
+  router.use("/reports", requirePerm("analytics:read"));
+  router.use("/reports/:name", requirePerm("analytics:read"));
+
+  router.openapi(listReportsRoute, (c) => {
+    return c.json({ data: kernel.services.analytics.listReports() });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(getReportRoute, async (c) => {
+    const { date, from, to } = c.req.valid("query");
+    const result = await kernel.services.analytics.getReport(
+      c.req.param("name"),
+      {
+        ...(date !== undefined ? { date } : {}),
+        ...(from !== undefined ? { from } : {}),
+        ...(to !== undefined ? { to } : {}),
+      },
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
+  return router;
+}

package/src/interfaces/rest/routes/carts.ts

@@ -1,8 +1,8 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import type { Kernel } from "../../../runtime/kernel.js";
 import type { CreateCartInput, AddCartItemInput } from "../../../modules/cart/schemas.js";
-import { createCartRoute, addCartItemRoute, updateCartItemQuantityRoute, getCartRoute, removeCartItemRoute } from "../schemas/carts.js";
-import { type AppEnv, mapErrorToResponse, mapErrorToStatus } from "../utils.js";
+import { createCartRoute, addCartItemRoute, updateCartItemQuantityRoute, getCartRoute, removeCartItemRoute, listCartsRoute, recoverCartRoute } from "../schemas/carts.js";
+import { type AppEnv, mapErrorToResponse, mapErrorToStatus, parsePagination } from "../utils.js";
 
 export function cartRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
@@ -21,6 +21,56 @@ export function cartRoutes(kernel: Kernel) {
     return c.json({ data: result.value }, 201);
   });
 
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(listCartsRoute, async (c) => {
+    const actor = c.get("actor");
+    const pagination = parsePagination(c.req.query());
+    const status = c.req.query("status");
+    const olderThanRaw = c.req.query("olderThan");
+    const hasCustomerRaw = c.req.query("hasCustomer");
+
+    let olderThan: Date | undefined;
+    if (olderThanRaw) {
+      const d = new Date(olderThanRaw);
+      if (Number.isNaN(d.getTime())) {
+        return c.json({ error: { code: "VALIDATION_FAILED", message: "olderThan must be an ISO timestamp." } }, 422);
+      }
+      olderThan = d;
+    }
+
+    const result = await kernel.services.cart.list(
+      {
+        page: pagination.page,
+        limit: pagination.limit,
+        ...(status !== undefined ? { status } : {}),
+        ...(olderThan !== undefined ? { olderThan } : {}),
+        ...(hasCustomerRaw === "true" ? { hasCustomer: true } : {}),
+        ...(hasCustomerRaw === "false" ? { hasCustomer: false } : {}),
+      },
+      actor,
+    );
+    if (!result.ok)
+      return c.json(
+        mapErrorToResponse(result.error),
+        mapErrorToStatus(result.error),
+      );
+    return c.json({
+      data: result.value.items,
+      meta: { pagination: result.value.pagination },
+    });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(recoverCartRoute, async (c) => {
+    const result = await kernel.services.cart.recover(c.req.param("id"), c.get("actor"));
+    if (!result.ok)
+      return c.json(
+        mapErrorToResponse(result.error),
+        mapErrorToStatus(result.error),
+      );
+    return c.json({ data: result.value });
+  });
+
   // @ts-expect-error -- openapi handler union return type
   router.openapi(getCartRoute, async (c) => {
     const actor = c.get("actor");

package/src/interfaces/rest/routes/catalog.ts

@@ -44,6 +44,8 @@ import {
   createOptionValueRoute,
   createVariantRoute,
   generateVariantsRoute,
+  quickVariantRoute,
+  bulkVariantsRoute,
 } from "../schemas/catalog.js";
 import {
   type AppEnv,
@@ -508,6 +510,38 @@ export function catalogRoutes(kernel: Kernel) {
     return c.json({ data: result.value }, 201);
   });
 
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(quickVariantRoute, async (c) => {
+    const body = c.req.valid("json") as { options: Record<string, string>; sku?: string; barcode?: string };
+    const result = await kernel.services.catalog.quickCreateVariant(
+      c.req.param("id"),
+      body,
+      c.get("actor"),
+    );
+    if (!result.ok)
+      return c.json(
+        mapErrorToResponse(result.error),
+        mapErrorToStatus(result.error),
+      );
+    return c.json({ data: result.value }, result.value.created ? 201 : 200);
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(bulkVariantsRoute, async (c) => {
+    const body = c.req.valid("json") as { axes: Array<{ name: string; values: string[] }>; skuPrefix?: string };
+    const result = await kernel.services.catalog.bulkCreateVariants(
+      c.req.param("id"),
+      body,
+      c.get("actor"),
+    );
+    if (!result.ok)
+      return c.json(
+        mapErrorToResponse(result.error),
+        mapErrorToStatus(result.error),
+      );
+    return c.json({ data: result.value }, 201);
+  });
+
   // @ts-expect-error -- openapi handler union return type
   router.openapi(generateVariantsRoute, async (c) => {
     const body = c.req.valid("json") as VariantGenerationStrategy;

package/src/interfaces/rest/routes/checkout.ts

@@ -21,8 +21,58 @@ import type { AfterHook, BeforeHook, ServiceContainer } from "../../../kernel/ho
 import type { PluginDb } from "../../../kernel/database/plugin-types.js";
 import { type AppEnv, mapErrorToResponse, mapErrorToStatus } from "../utils.js";
 import { isCommerceError } from "../../../kernel/errors.js";
+import { assertPermission } from "../../../auth/permissions.js";
 import { makeId } from "../../../utils/id.js";
 import type { ShippingAddress } from "../../../modules/shipping/calculator.js";
+import type { Actor } from "../../../auth/types.js";
+
+/**
+ * SEC-07 — resolve the customer profile a checkout order is attributed to.
+ * A self-service actor may ONLY attribute the order to its own customer
+ * profile; only actors with org-level `customers:read` (staff/clienteling) may
+ * name an arbitrary `customerId`. Returns undefined for guests / unresolved
+ * (guest checkout). Exported for unit testing.
+ */
+export async function resolveCheckoutCustomerUuid(
+  customers: Kernel["services"]["customers"],
+  actor: Actor | null,
+  customerId: string | undefined,
+): Promise<string | undefined> {
+  const actorUserId = actor?.userId;
+  let canActForOthers = false;
+  if (actorUserId) {
+    try {
+      assertPermission(actor, "customers:read");
+      canActForOthers = true;
+    } catch {
+      canActForOthers = false;
+    }
+  }
+
+  if (customerId) {
+    const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (uuidRe.test(customerId)) {
+      const byId = await customers.getById(customerId, actor);
+      // Honor a profile UUID only if it is the actor's own, or the actor may
+      // act for other customers.
+      if (byId.ok && (canActForOthers || byId.value.userId === actorUserId)) {
+        return byId.value.id;
+      }
+    }
+    if (canActForOthers) {
+      // Staff may resolve/create a customer by a supplied user_id.
+      const byUser = await customers.getByUserId(customerId, actor);
+      if (byUser.ok) return byUser.value.id;
+    }
+  }
+
+  // Self-service default: the authenticated actor's own customer profile.
+  if (actorUserId && !canActForOthers) {
+    const own = await customers.getByUserId(actorUserId, actor);
+    if (own.ok) return own.value.id;
+  }
+  return undefined;
+}
 
 export function checkoutRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
@@ -34,6 +84,48 @@ export function checkoutRoutes(kernel: Kernel) {
     const body = c.req.valid("json");
 
     const actor = c.get("actor");
+
+    // Idempotent replay: a re-submitted checkout (offline POS queue, network
+    // retry) returns the already-created order BEFORE the pipeline runs — no
+    // double payment authorization, no duplicate order.
+    if (body.idempotencyKey) {
+      const replay = await kernel.services.orders.getByIdempotencyKey(
+        body.idempotencyKey,
+        actor,
+      );
+      if (replay.ok && replay.value) {
+        // IDOR guard: an idempotency key must only replay the requester's OWN
+        // order. Without this, a same-org customer who supplies/guesses another
+        // customer's key would receive that customer's order (PII, totals, lines).
+        let canActForOthers = false;
+        try {
+          assertPermission(actor, "customers:read");
+          canActForOthers = true;
+        } catch {
+          canActForOthers = false;
+        }
+        const ownCustomer = actor
+          ? await resolveCheckoutCustomerUuid(kernel.services.customers, actor, undefined)
+          : undefined;
+        const replayCustomer = replay.value.customerId ?? null;
+        const ownsOrder =
+          (replayCustomer !== null && replayCustomer === ownCustomer) ||
+          (replayCustomer === null && !ownCustomer);
+        if (canActForOthers || ownsOrder) {
+          return c.json({ data: replay.value }, 201);
+        }
+        return c.json(
+          {
+            error: {
+              code: "IDEMPOTENCY_CONFLICT",
+              message: "Idempotency key does not belong to this account.",
+            },
+          },
+          409,
+        );
+      }
+    }
+
     const checkoutData: CheckoutData = {
       checkoutId: makeId(),
       cartId: body.cartId,
@@ -121,34 +213,19 @@ export function checkoutRoutes(kernel: Kernel) {
         context,
       );
 
-      // Resolve customer profile UUID from customerId (may be a profile UUID or a Better Auth user_id)
-      let customerUuid: string | undefined = undefined;
-      if (processed.customerId) {
-        const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-        if (uuidRe.test(processed.customerId)) {
-          // Looks like a profile UUID — try direct lookup (no auto-create)
-          const byIdResult = await kernel.services.customers.getById(
-            processed.customerId,
-            actor,
-          );
-          if (byIdResult.ok) {
-            customerUuid = byIdResult.value.id;
-          }
-        }
-        if (!customerUuid) {
-          // Fall back to user_id lookup (auto-creates customer profile if needed)
-          const byUserIdResult = await kernel.services.customers.getByUserId(
-            processed.customerId,
-            actor,
-          );
-          if (byUserIdResult.ok) {
-            customerUuid = byUserIdResult.value.id;
-          }
-        }
-        // If both lookups fail, we still allow guest checkout (customerUuid remains undefined)
-      }
+      // SEC-07: resolve the order's customer server-side. A self-service actor
+      // can only attribute the order to its own profile; a client-supplied
+      // foreign customerId is ignored unless the actor is staff.
+      const customerUuid = await resolveCheckoutCustomerUuid(
+        kernel.services.customers,
+        actor,
+        processed.customerId,
+      );
 
       const orderPayload = {
+        ...(body.idempotencyKey !== undefined
+          ? { idempotencyKey: body.idempotencyKey }
+          : {}),
         currency: processed.currency,
         subtotal: processed.subtotal,
         taxTotal: processed.taxTotal,
@@ -177,6 +254,11 @@ export function checkoutRoutes(kernel: Kernel) {
             quantity: lineItem.quantity,
             unitPrice: lineItem.resolvedUnitPrice ?? 0,
             totalPrice: lineItem.resolvedTotal ?? 0,
+            // Per-line tax from product tax classes (issue #57)
+            taxAmount: lineItem.taxAmount ?? 0,
+            ...(lineItem.discountAmount !== undefined
+              ? { discountAmount: lineItem.discountAmount }
+              : {}),
           };
           return lineItem.variantId !== undefined
             ? { ...payload, variantId: lineItem.variantId }
@@ -187,7 +269,12 @@ export function checkoutRoutes(kernel: Kernel) {
           : {}),
       };
 
-      const order = await kernel.services.orders.create(orderPayload, actor);
+      // Checkout is a trusted, already-server-priced pipeline (resolveCurrentPrices
+      // + promotions/tax) and reserves stock in its own after-hooks — so it hands
+      // the order primitive precomputed totals rather than re-deriving them.
+      const order = await kernel.services.orders.create(orderPayload, actor, undefined, {
+        trustedPricing: true,
+      });
 
       if (!order.ok) {
         return c.json(

package/src/interfaces/rest/routes/documents.ts

@@ -0,0 +1,61 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import type { Kernel } from "../../../runtime/kernel.js";
+import {
+  emailInvoiceRoute,
+  invoiceHtmlRoute,
+  invoicePdfRoute,
+  receiptHtmlRoute,
+} from "../schemas/documents.js";
+import { type AppEnv, mapErrorToResponse, mapErrorToStatus } from "../utils.js";
+
+/**
+ * Order document rendering (issue #47). Mounted under /orders. Access
+ * control rides on OrderService.getById (orders:read, or orders:read:own
+ * for the order's customer), so no extra scope is needed here.
+ */
+export function documentRoutes(kernel: Kernel) {
+  const router = new OpenAPIHono<AppEnv>();
+
+  router.openapi(invoicePdfRoute, async (c) => {
+    const result = await kernel.services.documents.renderInvoicePdf(
+      c.req.param("id"),
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.body(result.value.pdf.slice().buffer as ArrayBuffer, 200, {
+      "content-type": "application/pdf",
+      "content-disposition": `inline; filename="invoice-${result.value.invoiceNumber}.pdf"`,
+    });
+  });
+
+  router.openapi(invoiceHtmlRoute, async (c) => {
+    const result = await kernel.services.documents.renderInvoiceHtml(
+      c.req.param("id"),
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.html(result.value.html);
+  });
+
+  router.openapi(receiptHtmlRoute, async (c) => {
+    const result = await kernel.services.documents.renderReceiptHtml(
+      c.req.param("id"),
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.html(result.value.html);
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(emailInvoiceRoute, async (c) => {
+    const result = await kernel.services.documents.emailInvoice(
+      c.req.param("id"),
+      c.req.valid("json").to,
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
+  return router;
+}

package/src/interfaces/rest/routes/inventory.ts

@@ -17,6 +17,14 @@ export function inventoryRoutes(kernel: Kernel) {
   // Inventory levels listing requires inventory:read
   router.use("/levels", requirePerm("inventory:read"));
 
+  // Warehouse config + reservation are staff operations, never public. Gate them
+  // at the route (reserve/release are also called internally by checkout with the
+  // customer's actor, so the service itself must stay callable — the boundary is
+  // the HTTP route). Blocks anonymous (401) and customers lacking the perm (403).
+  router.use("/warehouses", requirePerm("inventory:read"));
+  router.use("/reserve", requirePerm("inventory:adjust"));
+  router.use("/release", requirePerm("inventory:adjust"));
+
   // @ts-expect-error -- openapi handler union return type
   router.openapi(listInventoryLevelsRoute, async (c) => {
     const actor = c.get("actor");
@@ -78,6 +86,12 @@ export function inventoryRoutes(kernel: Kernel) {
   router.openapi(createWarehouseRoute, async (c) => {
     const body = c.req.valid("json") as Parameters<typeof kernel.services.inventory.createWarehouse>[0];
     const actor = c.get("actor");
+    // Creating a warehouse (write) needs the higher inventory:adjust perm; the
+    // router.use above already requires inventory:read for the /warehouses path.
+    const perms = (actor as { permissions?: string[] } | null)?.permissions ?? [];
+    if (!(perms.includes("inventory:adjust") || perms.includes("inventory:*") || perms.includes("*:*"))) {
+      return c.json({ error: { code: "FORBIDDEN", message: "Permission 'inventory:adjust' is required." } }, 403);
+    }
     const result = await kernel.services.inventory.createWarehouse(body, actor);
     if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
     return c.json({ data: result.value }, 201);

package/src/interfaces/rest/routes/orders.ts

@@ -1,8 +1,9 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import type { Kernel } from "../../../runtime/kernel.js";
-import { changeOrderStatusRoute, listOrdersRoute, orderLookupRoute, getOrderRoute, getOrderFulfillmentsRoute, createOrderRoute, refundOrderRoute, captureOrderRoute } from "../schemas/orders.js";
+import { changeOrderStatusRoute, listOrdersRoute, orderLookupRoute, getOrderRoute, getOrderFulfillmentsRoute, createOrderRoute, refundOrderRoute, captureOrderRoute, createOrderFulfillmentRoute, addOrderLineItemRoute, updateOrderLineItemRoute, removeOrderLineItemRoute, refundOrderLinesRoute, undoOrderRefundRoute, listOrderRefundsRoute, refundCapStatusRoute, createOrderNoteRoute, listOrderNotesRoute, deleteOrderNoteRoute, orderTimelineRoute } from "../schemas/orders.js";
 import { type AppEnv, isUUID, mapErrorToResponse, mapErrorToStatus, parsePagination } from "../utils.js";
 import type { CreateOrderInput } from "../../../modules/orders/service.js";
+import { assertPermission } from "../../../auth/permissions.js";
 
 export function orderRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
@@ -62,6 +63,11 @@ export function orderRoutes(kernel: Kernel) {
 
   // @ts-expect-error -- openapi handler union return type
   router.openapi(createOrderRoute, async (c) => {
+    try {
+      assertPermission(c.get("actor"), "orders:manage");
+    } catch (error) {
+      return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+    }
     const body = c.req.valid("json") as CreateOrderInput;
     const result = await kernel.services.orders.create(body, c.get("actor"));
     if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
@@ -82,6 +88,80 @@ export function orderRoutes(kernel: Kernel) {
     return c.json({ data: result.value });
   });
 
+  // ── Notes + activity timeline (issue #56) ──────────────────────────
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(createOrderNoteRoute, async (c) => {
+    const body = c.req.valid("json") as { body: string; pinned?: boolean };
+    const result = await kernel.services.orders.addNote(c.req.param("id"), body, c.get("actor"));
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value }, 201);
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(listOrderNotesRoute, async (c) => {
+    const result = await kernel.services.orders.listNotes(c.req.param("id"), c.get("actor"));
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(deleteOrderNoteRoute, async (c) => {
+    const result = await kernel.services.orders.deleteNote(
+      c.req.param("id"),
+      c.req.param("noteId"),
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(orderTimelineRoute, async (c) => {
+    const result = await kernel.services.orders.timeline(c.req.param("id"), c.get("actor"));
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
+  // ── Line-level refunds (issue #52) ─────────────────────────────────
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(refundCapStatusRoute, async (c) => {
+    const result = await kernel.services.orders.refundCapStatus(c.get("actor"));
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(refundOrderLinesRoute, async (c) => {
+    const body = c.req.valid("json") as { lines: Array<{ lineItemId: string; quantity: number }>; reason?: string };
+    const result = await kernel.services.orders.refundLines(
+      c.req.param("id"),
+      body,
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value }, 201);
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(undoOrderRefundRoute, async (c) => {
+    const result = await kernel.services.orders.undoRefund(
+      c.req.param("id"),
+      c.req.param("refundId"),
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(listOrderRefundsRoute, async (c) => {
+    const result = await kernel.services.orders.listRefunds(c.req.param("id"), c.get("actor"));
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
   // @ts-expect-error -- openapi handler union return type
   router.openapi(captureOrderRoute, async (c) => {
     const body = c.req.valid("json") as { amount?: number } | undefined;
@@ -94,6 +174,47 @@ export function orderRoutes(kernel: Kernel) {
     return c.json({ data: result.value });
   });
 
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(addOrderLineItemRoute, async (c) => {
+    try {
+      assertPermission(c.get("actor"), "orders:manage");
+    } catch (error) {
+      return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+    }
+    const body = c.req.valid("json");
+    const result = await kernel.services.orders.addLineItem(
+      c.req.param("id"),
+      body,
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value }, 201);
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(updateOrderLineItemRoute, async (c) => {
+    const body = c.req.valid("json");
+    const result = await kernel.services.orders.updateOrderLineItem(
+      c.req.param("id"),
+      c.req.param("lineItemId"),
+      body,
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(removeOrderLineItemRoute, async (c) => {
+    const result = await kernel.services.orders.removeLineItem(
+      c.req.param("id"),
+      c.req.param("lineItemId"),
+      c.get("actor"),
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value });
+  });
+
   // @ts-expect-error -- openapi() enforces strict response typing but our handler
   // returns union responses (200 | 400 | 404). The route definition documents the
   // contract; the handler returns dynamic status.
@@ -112,6 +233,32 @@ export function orderRoutes(kernel: Kernel) {
     return c.json({ data: result.value });
   });
 
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(createOrderFulfillmentRoute, async (c) => {
+    const actor = c.get("actor");
+    const orderId = c.req.param("id");
+
+    // Verify the order exists and the actor has access before recording
+    const orderResult = await kernel.services.orders.getById(orderId, actor);
+    if (!orderResult.ok) return c.json(mapErrorToResponse(orderResult.error), mapErrorToStatus(orderResult.error));
+
+    const body = c.req.valid("json") as {
+      lineItems: Array<{ orderLineItemId: string; quantity: number }>;
+      carrier?: string;
+      trackingNumber?: string;
+      trackingUrl?: string;
+      type?: string;
+      status?: string;
+      metadata?: Record<string, unknown>;
+    };
+    const result = await kernel.services.fulfillment.createFulfillment(
+      { ...body, orderId: orderResult.value.id },
+      actor,
+    );
+    if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    return c.json({ data: result.value }, 201);
+  });
+
   // @ts-expect-error -- openapi handler union return type
   router.openapi(getOrderFulfillmentsRoute, async (c) => {
     const orderId = c.req.param("id");

package/src/interfaces/rest/routes/pricing.ts

@@ -4,7 +4,7 @@ import { CommerceValidationError } from "../../../kernel/errors.js";
 import type { DrizzleDatabase } from "../../../kernel/database/drizzle-db.js";
 import { CatalogRepository } from "../../../modules/catalog/repository/index.js";
 import type { Kernel } from "../../../runtime/kernel.js";
-import { setBasePriceRoute, createModifierRoute, listPricesRoute } from "../schemas/pricing.js";
+import { setBasePriceRoute, createModifierRoute, listPricesRoute, listModifiersRoute, updateModifierRoute, deleteModifierRoute } from "../schemas/pricing.js";
 import { type AppEnv, mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils.js";
 
 export function pricingRoutes(kernel: Kernel) {
@@ -45,6 +45,49 @@ export function pricingRoutes(kernel: Kernel) {
   });
 
   router.use("/modifiers", requirePerm("pricing:manage"));
+  router.use("/modifiers/:id", requirePerm("pricing:manage"));
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(listModifiersRoute, async (c) => {
+    const actor = c.get("actor");
+    const entityId = c.req.query("entityId");
+    const currency = c.req.query("currency");
+    const active = c.req.query("active");
+
+    const result = await kernel.services.pricing.listModifiers({
+      ...(entityId !== undefined ? { entityId } : {}),
+      ...(currency !== undefined ? { currency } : {}),
+      ...(active === "true" ? { active: true } : {}),
+    }, actor);
+    if (!result.ok) {
+      return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    }
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(updateModifierRoute, async (c) => {
+    const actor = c.get("actor");
+    const result = await kernel.services.pricing.updateModifier(
+      c.req.param("id"),
+      c.req.valid("json"),
+      actor,
+    );
+    if (!result.ok) {
+      return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    }
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(deleteModifierRoute, async (c) => {
+    const actor = c.get("actor");
+    const result = await kernel.services.pricing.deleteModifier(c.req.param("id"), actor);
+    if (!result.ok) {
+      return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
+    }
+    return c.json({ data: result.value });
+  });
 
   // @ts-expect-error -- openapi() enforces strict response typing but our handler
   // returns union responses (201 | 400 | 422). The route definition documents the