@porulle/core 0.8.0 → 0.9.0

package/dist/modules/orders/service.js

@@ -7,6 +7,7 @@ import { canTransition, orderStateMachine, } from "../../kernel/state-machine/ma
 import { Err, Ok } from "../../kernel/result.js";
 import { createLogger } from "../../utils/logger.js";
 import { paginate } from "../../utils/pagination.js";
+import { withTransaction, } from "../../kernel/database/tx-context.js";
 function context(actor, services, database, tx = null) {
     return createHookContext({
         actor,
@@ -30,7 +31,70 @@ export class OrderService {
         const lineItems = await this.repo.findLineItemsByOrderId(order.id, ctx);
         return { ...order, lineItems };
     }
-    async create(input, actor, ctx) {
+    /**
+     * Resolve every line item's price with org-integrity + price provenance,
+     * mirroring how our forefathers handle this (Vendure: order lines are always
+     * server-priced from the variant; Medusa: an admin override is honored but
+     * flagged `is_custom_price`). Three modes:
+     *   - trusted caller (checkout / POS exchange, already server-priced) → prices honored as-is.
+     *   - actor with `orders:manage` → explicit price honored as a manual override, flagged isCustomPrice.
+     *   - otherwise → price re-derived server-side from the catalog; client prices ignored.
+     * The referenced entity MUST belong to the order's org in every mode.
+     */
+    async resolveLines(input, actor, trusted, ctx) {
+        let canOverride = trusted;
+        if (!canOverride) {
+            try {
+                assertPermission(actor, "orders:manage");
+                canOverride = true;
+            }
+            catch {
+                canOverride = false;
+            }
+        }
+        const catalog = this.deps.services.catalog;
+        const pricing = this.deps.services.pricing;
+        const resolved = [];
+        for (const item of input.lineItems) {
+            // Org-integrity — the referenced entity must belong to this order's org.
+            const owned = await catalog.getById(item.entityId, { includeVariants: item.variantId !== undefined }, actor, ctx);
+            if (!owned.ok) {
+                return Err(new CommerceValidationError(`Line item entity ${item.entityId} does not belong to this organization.`));
+            }
+            if (item.variantId !== undefined &&
+                !owned.value?.variants?.some((variant) => variant.id === item.variantId)) {
+                return Err(new CommerceValidationError(`Line item variant ${item.variantId} does not belong to entity ${item.entityId}.`));
+            }
+            if (trusted || canOverride) {
+                // Trusted pipeline totals, or a staff manual/negotiated override.
+                resolved.push({ ...item, isCustomPrice: !trusted && canOverride });
+                continue;
+            }
+            // Server-derive the price; the client-supplied unitPrice/totalPrice is ignored.
+            const priced = await pricing.resolve({
+                entityId: item.entityId,
+                currency: input.currency,
+                quantity: item.quantity,
+                ...(item.variantId ? { variantId: item.variantId } : {}),
+                ...(input.customerId ? { customerId: input.customerId } : {}),
+            }, actor, ctx);
+            if (!priced.ok || !priced.value) {
+                return Err(new CommerceValidationError(`Cannot resolve price for ${item.entityId}.`));
+            }
+            const unitPrice = priced.value.finalAmount;
+            resolved.push({
+                ...item,
+                unitPrice,
+                totalPrice: unitPrice * item.quantity,
+                isCustomPrice: false,
+            });
+        }
+        return Ok(resolved);
+    }
+    async create(input, actor, ctx, opts) {
+        if (opts?.stockPolicy === "reserve" && !ctx) {
+            return withTransaction(this.deps.database, { actor }, (txCtx) => this.create(input, actor, txCtx, opts));
+        }
         try {
             assertPermission(actor, "orders:create");
         }
@@ -53,6 +117,38 @@ export class OrderService {
                 return Ok(await this.hydrateOrder(existing, ctx));
             }
         }
+        // Resolve line prices with org-integrity + provenance (see resolveLines).
+        const trusted = opts?.trustedPricing === true;
+        const resolvedResult = await this.resolveLines(processed, actor, trusted, ctx);
+        if (!resolvedResult.ok)
+            return Err(resolvedResult.error);
+        const resolvedLines = resolvedResult.value;
+        // Order totals: trusted callers (checkout / exchange) supply rich totals
+        // (promotions, tax, shipping); otherwise derive from the server-priced lines.
+        const computedSubtotal = trusted
+            ? processed.subtotal
+            : resolvedLines.reduce((sum, l) => sum + (l.totalPrice ?? l.unitPrice * l.quantity), 0);
+        const computedGrandTotal = trusted
+            ? processed.grandTotal
+            : computedSubtotal +
+                processed.taxTotal +
+                processed.shippingTotal -
+                (processed.discountTotal ?? 0);
+        // Stock: order creation does NOT reserve by default. Stock is allocated at
+        // the lifecycle transition to a committed state — checkout reserves in its
+        // own pipeline, mirroring Vendure's StockAllocationStrategy (allocate on
+        // PaymentAuthorized, not on creation). A caller that represents an immediate
+        // committed sale (e.g. a POS exchange) opts in with stockPolicy: "reserve".
+        const stockPolicy = opts?.stockPolicy;
+        if (stockPolicy === "reserve") {
+            const inventory = this.deps.services.inventory;
+            for (const line of resolvedLines) {
+                const avail = await inventory.getAvailable(line.entityId, line.variantId, ctx, actor);
+                if (!avail.ok || (avail.value ?? 0) < line.quantity) {
+                    return Err(new CommerceValidationError(`Insufficient stock for ${line.title ?? line.entityId}. Available: ${avail.ok ? (avail.value ?? 0) : 0}, requested: ${line.quantity}.`));
+                }
+            }
+        }
         const orderNumber = await this.repo.getNextOrderNumber(ctx);
         let order;
         try {
@@ -61,11 +157,11 @@ export class OrderService {
                 orderNumber,
                 status: "pending",
                 currency: processed.currency,
-                subtotal: processed.subtotal,
+                subtotal: computedSubtotal,
                 taxTotal: processed.taxTotal,
                 shippingTotal: processed.shippingTotal,
                 discountTotal: processed.discountTotal ?? 0,
-                grandTotal: processed.grandTotal,
+                grandTotal: computedGrandTotal,
                 ...(processed.paymentIntentId != null ? { paymentIntentId: processed.paymentIntentId } : {}),
                 ...(processed.paymentMethodId != null ? { paymentMethodId: processed.paymentMethodId } : {}),
                 ...(processed.idempotencyKey != null ? { idempotencyKey: processed.idempotencyKey } : {}),
@@ -85,14 +181,15 @@ export class OrderService {
             }
             throw error;
         }
-        const lineItemsData = processed.lineItems.map((item) => ({
+        const lineItemsData = resolvedLines.map((item) => ({
             orderId: order.id,
             entityId: item.entityId,
             entityType: item.entityType,
             title: item.title,
             quantity: item.quantity,
             unitPrice: item.unitPrice,
-            totalPrice: item.totalPrice,
+            totalPrice: item.totalPrice ?? item.unitPrice * item.quantity,
+            isCustomPrice: item.isCustomPrice,
             taxAmount: item.taxAmount ?? 0,
             discountAmount: item.discountAmount ?? 0,
             fulfillmentStatus: "unfulfilled",
@@ -101,6 +198,23 @@ export class OrderService {
             ...(item.sku !== undefined ? { sku: item.sku } : {}),
         }));
         await this.repo.createLineItems(lineItemsData, ctx);
+        // Reserve stock for the resolved lines when the reserve policy is active
+        // (availability was verified above). Trusted callers reserve themselves.
+        if (stockPolicy === "reserve") {
+            const inventory = this.deps.services.inventory;
+            for (const line of resolvedLines) {
+                const reserved = await inventory.reserve({
+                    entityId: line.entityId,
+                    quantity: line.quantity,
+                    orderId: order.id,
+                    ...(line.variantId ? { variantId: line.variantId } : {}),
+                }, actor, ctx);
+                if (!reserved.ok) {
+                    return Err(toCommerceError(reserved.error ??
+                        new CommerceValidationError(`Unable to reserve stock for ${line.title ?? line.entityId}.`)));
+                }
+            }
+        }
         await this.repo.createStatusHistory({
             orderId: order.id,
             fromStatus: "pending",
@@ -270,6 +384,12 @@ export class OrderService {
         await runBeforeHooks(beforeHooks, statusHookInput, "statusChange", hookCtx);
         const previous = order.status;
         const lineItems = await this.repo.findLineItemsByOrderId(order.id, ctx);
+        // R-04: goods must not ship against refunded lines. Reject the fulfilled
+        // transition if any line has been (partially) refunded.
+        if (input.newStatus === "fulfilled" &&
+            lineItems.some((li) => li.refundedQuantity > 0)) {
+            return Err(new CommerceValidationError("Cannot fulfill an order that has refunded line items."));
+        }
         // VAPT r2 (codex) finding: side effects (inventory release, payment
         // refund, tax void) used to run BEFORE the atomic compare-and-swap on
         // updateStatus. Two parallel cancel/refund requests on the same order
@@ -294,7 +414,7 @@ export class OrderService {
                     // Fulfilled items had their reservation released during the
                     // fulfilled transition — releasing again would double-release.
                     if (lineItem.fulfillmentStatus === "unfulfilled") {
-                        await inventory.release({
+                        const releaseResult = await inventory.release({
                             entityId: lineItem.entityId,
                             quantity: lineItem.quantity,
                             orderId: order.id,
@@ -302,7 +422,14 @@ export class OrderService {
                             ...(lineItem.variantId != null
                                 ? { variantId: lineItem.variantId }
                                 : {}),
-                        });
+                        }, actor, ctx);
+                        if (!releaseResult.ok) {
+                            const err = toCommerceError(releaseResult.error);
+                            if (!(err instanceof CommerceValidationError &&
+                                err.message === "No inventory record found for this entity.")) {
+                                return Err(err);
+                            }
+                        }
                     }
                 }
             }
@@ -312,11 +439,19 @@ export class OrderService {
             if (paymentIntentId) {
                 const payments = this.deps.services.payments;
                 if (payments?.refund) {
-                    const maxRefund = Math.min(order.grandTotal, order.amountCaptured ?? order.grandTotal);
+                    // R-01: subtract prior gateway refunds (line-level refundLines, and
+                    // undone refunds — the gateway was never reversed) so this order-level
+                    // refund can't double-pay on top of what has already been refunded.
+                    const priorRefunds = await this.repo.findRefundsByOrderId(order.id, ctx);
+                    const alreadyRefunded = priorRefunds.reduce((sum, r) => sum + r.amount, 0);
+                    const maxRefund = Math.max(0, Math.min(order.grandTotal, order.amountCaptured ?? order.grandTotal) -
+                        alreadyRefunded);
                     const refundAmount = input.refundAmount != null
                         ? Math.min(input.refundAmount, maxRefund)
                         : maxRefund;
-                    await payments.refund(paymentIntentId, refundAmount, input.reason ?? `order_${input.newStatus}`);
+                    if (refundAmount > 0) {
+                        await payments.refund(paymentIntentId, refundAmount, input.reason ?? `order_${input.newStatus}`);
+                    }
                 }
             }
             // 3. Void tax transaction
@@ -349,7 +484,7 @@ export class OrderService {
                                 : {}),
                         });
                         // Release reservation (no longer needed)
-                        await inventory.release({
+                        const releaseResult = await inventory.release({
                             entityId: lineItem.entityId,
                             quantity: lineItem.quantity,
                             orderId: order.id,
@@ -357,7 +492,14 @@ export class OrderService {
                             ...(lineItem.variantId != null
                                 ? { variantId: lineItem.variantId }
                                 : {}),
-                        });
+                        }, actor, ctx);
+                        if (!releaseResult.ok) {
+                            const err = toCommerceError(releaseResult.error);
+                            if (!(err instanceof CommerceValidationError &&
+                                err.message === "No inventory record found for this entity.")) {
+                                return Err(err);
+                            }
+                        }
                         // Mark line item as fulfilled
                         await this.repo.updateLineItem(lineItem.id, { fulfillmentStatus: "fulfilled" }, ctx);
                     }
@@ -423,6 +565,18 @@ export class OrderService {
         if (input.lines.length === 0) {
             return Err(new CommerceValidationError("At least one line is required."));
         }
+        // R-02: a terminal order (cancelled / fully refunded) cannot be line-refunded.
+        if (this.machine.terminal.includes(found.order.status)) {
+            return Err(new CommerceValidationError(`Cannot refund an order in terminal status "${found.order.status}".`));
+        }
+        // R-03: a refund moves collected money — reject an unpaid order (otherwise a
+        // "refund" is recorded against funds never taken). "Paid" is either a core
+        // captured payment (checkout: amountCaptured > 0) or the order having left
+        // the initial pending state (e.g. a completed POS/in-store sale). Only a
+        // still-pending, uncaptured order is treated as unpaid.
+        if ((found.order.amountCaptured ?? 0) <= 0 && found.order.status === "pending") {
+            return Err(new CommerceValidationError("Cannot refund an unpaid order (no captured payment and still pending)."));
+        }
         const byId = new Map(found.lineItems.map((li) => [li.id, li]));
         const refundLines = [];
         for (const line of input.lines) {
@@ -456,11 +610,16 @@ export class OrderService {
             const payments = this.deps.services.payments;
             if (payments?.refund) {
                 const priorRefunds = await this.repo.findRefundsByOrderId(orderId, ctx);
-                const alreadyRefunded = priorRefunds
-                    .filter((r) => r.status === "completed")
-                    .reduce((sum, r) => sum + r.amount, 0);
+                // Gross total incl. UNDONE refunds: undoRefund reverses the local ledger
+                // but not the payment gateway, so that money already left. Counting only
+                // "completed" would let refund → undo → refund re-issue a gateway refund
+                // (F-04 / R-05 / R-07). Capping on gross keeps total payout ≤ captured.
+                const alreadyRefunded = priorRefunds.reduce((sum, r) => sum + r.amount, 0);
                 const refundable = Math.max(0, (found.order.amountCaptured ?? 0) - alreadyRefunded);
-                await payments.refund(found.order.paymentIntentId, Math.min(totalAmount, refundable), input.reason ?? "line_refund");
+                const payAmount = Math.min(totalAmount, refundable);
+                if (payAmount > 0) {
+                    await payments.refund(found.order.paymentIntentId, payAmount, input.reason ?? "line_refund");
+                }
             }
         }
         for (const line of refundLines) {
@@ -718,6 +877,12 @@ export class OrderService {
             order.amountCaptured >= order.grandTotal) {
             return new CommerceValidationError("Order payment is fully captured; line items cannot be edited.");
         }
+        // R-06: a checkout order carries a paymentIntentId. If amountCaptured is null
+        // (auth-only capture, or a mock adapter reporting 0), treat it as authorized —
+        // an order with a live payment must not have its lines silently edited/inflated.
+        if (order.paymentIntentId != null && order.amountCaptured == null) {
+            return new CommerceValidationError("Order has an authorized payment; line items cannot be edited.");
+        }
         return null;
     }
     /**
@@ -754,21 +919,53 @@ export class OrderService {
         const guard = this.lineItemEditGuard(order);
         if (guard)
             return Err(guard);
+        // Org-integrity + price provenance for the added line (same rules as create):
+        // the entity must belong to the order's org, and the price is server-derived
+        // unless the actor holds `orders:manage` (then honored + flagged isCustomPrice).
+        const resolvedResult = await this.resolveLines({
+            currency: order.currency,
+            subtotal: 0,
+            taxTotal: 0,
+            shippingTotal: 0,
+            grandTotal: 0,
+            lineItems: [
+                {
+                    entityId: input.entityId,
+                    entityType: input.entityType,
+                    title: input.title,
+                    quantity: input.quantity,
+                    unitPrice: input.unitPrice,
+                    totalPrice: input.totalPrice ?? input.unitPrice * input.quantity,
+                    ...(input.variantId !== undefined ? { variantId: input.variantId } : {}),
+                    ...(input.sku !== undefined ? { sku: input.sku } : {}),
+                    ...(input.taxAmount !== undefined ? { taxAmount: input.taxAmount } : {}),
+                    ...(input.discountAmount !== undefined
+                        ? { discountAmount: input.discountAmount }
+                        : {}),
+                    ...(input.metadata !== undefined ? { metadata: input.metadata } : {}),
+                },
+            ],
+            ...(order.customerId ? { customerId: order.customerId } : {}),
+        }, actor, false, ctx);
+        if (!resolvedResult.ok)
+            return Err(resolvedResult.error);
+        const line = resolvedResult.value[0];
         await this.repo.createLineItems([
             {
                 orderId: order.id,
-                entityId: input.entityId,
-                entityType: input.entityType,
-                title: input.title,
-                quantity: input.quantity,
-                unitPrice: input.unitPrice,
-                totalPrice: input.totalPrice ?? input.unitPrice * input.quantity,
-                taxAmount: input.taxAmount ?? 0,
-                discountAmount: input.discountAmount ?? 0,
+                entityId: line.entityId,
+                entityType: line.entityType,
+                title: line.title,
+                quantity: line.quantity,
+                unitPrice: line.unitPrice,
+                totalPrice: line.totalPrice ?? line.unitPrice * line.quantity,
+                isCustomPrice: line.isCustomPrice,
+                taxAmount: line.taxAmount ?? 0,
+                discountAmount: line.discountAmount ?? 0,
                 fulfillmentStatus: "unfulfilled",
-                metadata: input.metadata ?? {},
-                ...(input.variantId !== undefined ? { variantId: input.variantId } : {}),
-                ...(input.sku !== undefined ? { sku: input.sku } : {}),
+                metadata: line.metadata ?? {},
+                ...(line.variantId !== undefined ? { variantId: line.variantId } : {}),
+                ...(line.sku !== undefined ? { sku: line.sku } : {}),
             },
         ], ctx);
         return Ok(await this.recalcOrderTotals(order, actor, "line_item_added", ctx));

package/dist/modules/orders/stale-order-cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stale-order-cleanup.d.ts","sourceRoot":"","sources":["../../../src/modules/orders/stale-order-cleanup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,4BAA4B,CAAC;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAChD;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3B;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkD/C,CAAC"}
+{"version":3,"file":"stale-order-cleanup.d.ts","sourceRoot":"","sources":["../../../src/modules/orders/stale-order-cleanup.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAejE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAChD;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3B;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAkD/C,CAAC"}

package/dist/modules/orders/stale-order-cleanup.js

@@ -1,5 +1,17 @@
 import { eq, and, lt } from "drizzle-orm";
 import { orders } from "./schema.js";
+function systemActorForOrg(organizationId) {
+    return {
+        type: "user",
+        userId: "system",
+        email: null,
+        name: "System",
+        vendorId: null,
+        organizationId,
+        role: "admin",
+        permissions: ["*:*"],
+    };
+}
 /**
  * Stale Order Cleanup Task
  *
@@ -34,7 +46,7 @@ export const staleOrderCleanupTask = {
         const orderService = ctx.services.orders;
         for (const order of staleOrders) {
             try {
-                await orderService.cancel(order.id, null, `Auto-cancelled: pending for >${thresholdHours}h`);
+                await orderService.cancel(order.id, systemActorForOrg(order.organizationId), `Auto-cancelled: pending for >${thresholdHours}h`);
                 cancelledIds.push(order.id);
                 ctx.logger.info(`Stale order ${order.orderNumber} auto-cancelled`, {
                     orderId: order.id,

package/dist/modules/pricing/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAOrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EACV,iBAAiB,EACjB,KAAK,EACL,aAAa,EAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,gBAAgB,GAChB,QAAQ,GACR,UAAU,CAAC;AAEf,UAAU,kBAAkB;IAC1B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAkBD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,KAAK,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,iBAAiB,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAuGhF,qBAAa,cAAc;IAIb,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,kBAAkB;IAKtC,YAAY,CAChB,KAAK,EAAE,iBAAiB,EACxB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAqEnB,cAAc,CAClB,KAAK,EAAE,wBAAwB,EAC/B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAwD3B,aAAa,CACjB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACnE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAgB7B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;QACpC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAChD,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAuB3B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAU/B,UAAU,CACd,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,SAAS,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC,CAAC;IAuD7D,OAAO,CACX,KAAK,EAAE,sBAAsB,EAC7B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAqLlC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/pricing/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAOrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EACV,iBAAiB,EACjB,KAAK,EACL,aAAa,EAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGxE,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,gBAAgB,GAChB,QAAQ,GACR,UAAU,CAAC;AAEf,UAAU,kBAAkB;IAC1B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAkBD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,KAAK,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,iBAAiB,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAuGhF,qBAAa,cAAc;IAIb,OAAO,CAAC,IAAI;IAHxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;gBAE5B,IAAI,EAAE,kBAAkB;IAKtC,YAAY,CAChB,KAAK,EAAE,iBAAiB,EACxB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAoEnB,cAAc,CAClB,KAAK,EAAE,wBAAwB,EAC/B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAwD3B,aAAa,CACjB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,EACnE,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAgB7B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;QACpC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QACxC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;KAChD,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAuB3B,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAU/B,UAAU,CACd,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,EACD,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,SAAS,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC,CAAC;IAuD7D,OAAO,CACX,KAAK,EAAE,sBAAsB,EAC7B,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,EACpB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;CAqLlC"}

package/dist/modules/pricing/service.js

@@ -103,11 +103,11 @@ export class PricingService {
         if (input.amount < 0) {
             return Err(new CommerceValidationError("Base price amount cannot be negative."));
         }
-        const entity = await this.catalogRepo.findEntityById(input.entityId, ctx);
+        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
         if (!entity) {
             return Err(new CommerceNotFoundError("Entity not found for price assignment."));
         }
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
         const priceData = {
             organizationId: orgId,
             entityId: input.entityId,
@@ -256,7 +256,8 @@ export class PricingService {
         return Ok({ prices, modifiers });
     }
     async resolve(input, actor, ctx) {
-        const entity = await this.catalogRepo.findEntityById(input.entityId, ctx);
+        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
         if (!entity) {
             return Err(new CommerceNotFoundError(`Entity ${input.entityId} not found.`));
         }
@@ -266,8 +267,7 @@ export class PricingService {
         const timestamp = input.timestamp ?? new Date();
         const currency = normalizeCurrency(input.currency);
         const groupSet = toGroupSet(input);
-        // Get matching prices from repository
-        const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+        // Get matching prices from repository (orgId resolved above)
         const allPrices = await this.repo.findPricesByEntityId(orgId, input.entityId, ctx);
         const matchingPrices = allPrices.filter((price) => {
             if (input.variantId !== undefined) {

package/dist/test-utils/create-test-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CA+GzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}
+{"version":3,"file":"create-test-config.d.ts","sourceRoot":"","sources":["../../src/test-utils/create-test-config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgDzD,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC,cAAc,CAAC,CAiHzB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAUnE"}

package/dist/test-utils/create-test-config.js

@@ -53,6 +53,7 @@ export async function createTestConfig(overrides = {}) {
             provider: "postgresql",
         },
         auth: {
+            allowTestActor: true,
             defaultOrganizationId: "org_default",
             requireEmailVerification: false,
             apiKeys: { enabled: true, defaultPermissions: ["catalog:read"] },
@@ -70,6 +71,7 @@ export async function createTestConfig(overrides = {}) {
                         "orders:create",
                         "orders:read",
                         "orders:update",
+                        "orders:manage",
                         "cart:create",
                         "cart:update",
                         "customers:update:self",

package/dist/test-utils/order-test-helpers.d.ts

@@ -0,0 +1,12 @@
+import type { Kernel } from "../runtime/kernel.js";
+/**
+ * Mark an order as paid (captured) for tests.
+ *
+ * Refund and return flows require a paid order — a refund moves collected money,
+ * and the order primitive rejects refunds on unpaid/pending orders. There is no
+ * public "set captured amount" service (capture() needs a live payment intent),
+ * so tests set the column here through a single typed helper rather than
+ * scattering raw SQL / `as any` casts across test files.
+ */
+export declare function markOrderPaidForTest(kernel: Kernel, orderId: string, amountCaptured: number, paymentIntentId?: string): Promise<void>;
+//# sourceMappingURL=order-test-helpers.d.ts.map

package/dist/test-utils/order-test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"order-test-helpers.d.ts","sourceRoot":"","sources":["../../src/test-utils/order-test-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/test-utils/order-test-helpers.js

@@ -0,0 +1,18 @@
+import { eq } from "drizzle-orm";
+import { orders } from "../modules/orders/schema.js";
+/**
+ * Mark an order as paid (captured) for tests.
+ *
+ * Refund and return flows require a paid order — a refund moves collected money,
+ * and the order primitive rejects refunds on unpaid/pending orders. There is no
+ * public "set captured amount" service (capture() needs a live payment intent),
+ * so tests set the column here through a single typed helper rather than
+ * scattering raw SQL / `as any` casts across test files.
+ */
+export async function markOrderPaidForTest(kernel, orderId, amountCaptured, paymentIntentId) {
+    const db = kernel.database.db;
+    await db
+        .update(orders)
+        .set({ amountCaptured, ...(paymentIntentId ? { paymentIntentId } : {}) })
+        .where(eq(orders.id, orderId));
+}

package/dist/test-utils/rest-api-test-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAmCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}
+{"version":3,"file":"rest-api-test-utils.d.ts","sourceRoot":"","sources":["../../src/test-utils/rest-api-test-utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAOpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;KACrB,CAAC;CACH,CAAC;AAiDF;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,OAAO,CAAC;IACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAqDD;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnF;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,KAoCvB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,KAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,KASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,WAwBA;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EACvB,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,qBAYF"}

package/dist/test-utils/rest-api-test-utils.js

@@ -130,6 +130,7 @@ export const testActor = {
         "orders:create",
         "orders:read",
         "orders:update",
+        "orders:manage",
         "cart:create",
         "cart:update",
         "cart:read",

package/dist/test-utils/test-actors.js

@@ -28,7 +28,7 @@ export const testStaffActor = {
     role: "staff",
     permissions: [
         "catalog:read", "catalog:create", "catalog:update",
-        "inventory:adjust", "orders:read", "orders:create", "orders:update",
+        "inventory:adjust", "orders:read", "orders:create", "orders:update", "orders:manage",
     ],
 };
 /** Customer with minimal read/write-own permissions. */

package/dist/testing.d.ts

@@ -11,5 +11,6 @@ export { createRepositoryTestHarness } from "./test-utils/create-repository-test
 export { createPluginTestApp, type PluginTestApp, type TestAppEnv } from "./test-utils/create-plugin-test-app.js";
 export { TEST_ORG_ID, testAdminActor, testStaffActor, testCustomerActor, testNoPermActor, jsonHeaders, } from "./test-utils/test-actors.js";
 export { beforeHook, afterHook } from "./test-utils/typed-hooks.js";
+export { markOrderPaidForTest } from "./test-utils/order-test-helpers.js";
 export type { Actor } from "./auth/types.js";
 //# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAClH,OAAO,EACL,WAAW,EACX,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAClE,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAGpE,YAAY,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,gDAAgD,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAClH,OAAO,EACL,WAAW,EACX,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAClE,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAG1E,YAAY,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/testing.js

@@ -11,3 +11,4 @@ export { createRepositoryTestHarness } from "./test-utils/create-repository-test
 export { createPluginTestApp } from "./test-utils/create-plugin-test-app.js";
 export { TEST_ORG_ID, testAdminActor, testStaffActor, testCustomerActor, testNoPermActor, jsonHeaders, } from "./test-utils/test-actors.js";
 export { beforeHook, afterHook } from "./test-utils/typed-hooks.js";
+export { markOrderPaidForTest } from "./test-utils/order-test-helpers.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/core",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/auth/middleware.ts

@@ -43,10 +43,10 @@ export function authMiddleware(
     // Resolve the default org from config, falling back to deprecated constant
     const defaultOrgId = config.auth?.defaultOrganizationId ?? DEFAULT_ORG_ID;
 
-    // Test-only actor injection: NODE_ENV === "test" honors x-test-actor for
-    // route-level integration tests that bypass the Better Auth session
-    // round-trip. Production/non-test environments ignore this header entirely.
-    if (process.env.NODE_ENV === "test") {
+    // Test-only actor injection: requires NODE_ENV === "test" AND an explicit
+    // config opt-in so staging/preview deployments left as NODE_ENV=test do not
+    // silently become a full auth bypass.
+    if (process.env.NODE_ENV === "test" && config.auth?.allowTestActor) {
       const testActorHeader = c.req.header("x-test-actor");
       if (testActorHeader) {
         try {
@@ -172,10 +172,29 @@ export function authMiddleware(
         if (result?.valid && result.key) {
           const apiKey = result.key as Record<string, unknown>;
 
-          // v1.5+ renamed userId → referenceId on the apikey table.
-          const userId = (apiKey.referenceId ?? "") as string;
           const name = (apiKey.name ?? "API Key") as string;
-          const orgId = (apiKey.organizationId ?? defaultOrgId) as string;
+          // Read the org (and operator identity) from key metadata when present.
+          // POS shift keys carry { organizationId, operatorId } in metadata so the
+          // operator is scoped to their store WITHOUT any org membership/role
+          // (SEC-16 / R-01). Other keys fall back to the key's organizationId.
+          const rawMeta = apiKey.metadata;
+          const meta =
+            rawMeta && typeof rawMeta === "object"
+              ? (rawMeta as Record<string, unknown>)
+              : typeof rawMeta === "string"
+                ? (() => {
+                    try {
+                      return JSON.parse(rawMeta) as Record<string, unknown>;
+                    } catch {
+                      return null;
+                    }
+                  })()
+                : null;
+          const metaOrg = typeof meta?.organizationId === "string" ? meta.organizationId : undefined;
+          const orgId = (metaOrg ?? apiKey.organizationId ?? defaultOrgId) as string;
+          const userId = ((typeof meta?.operatorId === "string" ? meta.operatorId : undefined)
+            ?? apiKey.referenceId
+            ?? "") as string;
 
           // Better Auth stores permissions as Record<string, string[]>
           // (e.g. {"catalog":["read","create"]}).  Flatten to the