@porulle/core 0.9.0 → 0.10.1

package/src/kernel/plugin/manifest.ts

@@ -14,6 +14,7 @@ import type {
   CommercePlugin,
   PluginPermission,
 } from "../../config/types.js";
+import type { TaskDefinition } from "../jobs/types.js";
 
 // ─── Plugin Logger ────────────────────────────────────────────────────
 
@@ -147,6 +148,7 @@ export interface CommercePluginManifest {
   hooks?: () => PluginHookRegistration[];
   routes?: (ctx: PluginContext) => PluginRouteRegistration[];
   analyticsModels?: () => unknown[];
+  jobs?: () => TaskDefinition[];
   /**
    * Named API-key scopes this plugin mints credentials under (issue #51),
    * merged into `config.auth.apiKeyScopes`. User-defined scopes with the
@@ -344,6 +346,16 @@ export function defineCommercePlugin(
       };
     }
 
+    if (manifest.jobs) {
+      result = {
+        ...result,
+        jobs: {
+          ...(result.jobs ?? {}),
+          tasks: [...(result.jobs?.tasks ?? []), ...manifest.jobs()],
+        },
+      };
+    }
+
     return result;
   };
 }

package/src/modules/catalog/entity-service.ts

@@ -98,6 +98,10 @@ export class EntityService {
     }
   }
 
+  private assertEntityWritable(entity: SellableEntity, actor: Actor | null): void {
+    if (entity.sourceStoreId != null) assertPermission(actor, "catalog:sync");
+  }
+
   private async validateAndCreateCustomFields(entityId: string, entityType: string, customFields: Record<string, unknown> | undefined, ctx?: TxContext): Promise<Result<void>> {
     if (!customFields) return Ok(undefined);
     const entityConfig = this.deps.config.entities?.[entityType];
@@ -212,7 +216,8 @@ export class EntityService {
     const afterHooks = this.deps.hooks.resolve("catalog.afterCreate") as CatalogCreateAfterHook[];
     const context: HookContext = createHookContext({ actor, tx: ctx?.tx ?? null, logger: createLogger("catalog.create"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
     const processedInput = await runBeforeHooks(beforeHooks, input, "create", context);
-    const entity = await this.repo.createEntity({ organizationId: orgId, type: processedInput.type, slug: processedInput.slug, status: "draft", isVisible: false, ...(processedInput.taxClass !== undefined ? { taxClass: processedInput.taxClass } : {}), metadata: processedInput.metadata ?? {} }, ctx);
+    if (processedInput.sourceStoreId != null) assertPermission(actor, "catalog:sync");
+    const entity = await this.repo.createEntity({ organizationId: orgId, type: processedInput.type, slug: processedInput.slug, status: "draft", isVisible: false, ...(processedInput.sourceStoreId !== undefined ? { sourceStoreId: processedInput.sourceStoreId } : {}), ...(processedInput.taxClass !== undefined ? { taxClass: processedInput.taxClass } : {}), metadata: processedInput.metadata ?? {} }, ctx);
     if (processedInput.attributes) {
       await this.repo.createAttribute({ entityId: entity.id, locale: processedInput.attributes.locale ?? "en", title: processedInput.attributes.title, subtitle: processedInput.attributes.subtitle, description: processedInput.attributes.description, richDescription: processedInput.attributes.richDescription, seoTitle: processedInput.attributes.seoTitle, seoDescription: processedInput.attributes.seoDescription }, ctx);
     }
@@ -228,6 +233,7 @@ export class EntityService {
     const existing = await this.repo.findEntityById(id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Entity not found."));
     this.assertSameOrg(existing, actor);
+    this.assertEntityWritable(existing, actor);
     const beforeHooks = this.deps.hooks.resolve("catalog.beforeUpdate") as CatalogUpdateBeforeHook[];
     const afterHooks = this.deps.hooks.resolve("catalog.afterUpdate") as CatalogUpdateAfterHook[];
     const context: HookContext = createHookContext({ actor, tx: ctx?.tx ?? null, logger: createLogger("catalog.update"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
@@ -244,6 +250,7 @@ export class EntityService {
     const existing = await this.repo.findEntityById(id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Entity not found."));
     this.assertSameOrg(existing, actor);
+    this.assertEntityWritable(existing, actor);
     await this.repo.deleteAttributesByEntityId(id, ctx);
     await this.repo.deleteCustomFieldsByEntityId(id, ctx);
     await this.repo.deleteEntityCategoriesByEntityId(id, ctx);
@@ -382,6 +389,7 @@ export class EntityService {
     const entity = await this.repo.findEntityById(id, ctx);
     if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
     try { this.assertSameOrg(entity, actor); } catch (error) { return Err(toCommerceError(error)); }
+    try { this.assertEntityWritable(entity, actor); } catch (error) { return Err(toCommerceError(error)); }
     const updateData: Partial<SellableEntity> = { status };
     if (status === "active") { updateData.publishedAt = new Date(); updateData.isVisible = true; }
     const updated = await this.repo.updateEntity(id, updateData, ctx);

package/src/modules/catalog/repository/index.ts

@@ -1,5 +1,6 @@
 import { eq, and, inArray, type SQL } from "drizzle-orm";
 import type { TxContext } from "../../../kernel/database/tx-context.js";
+import { CommerceNotFoundError } from "../../../kernel/errors.js";
 import type {
   DrizzleDatabase,
   DbOrTx,
@@ -698,15 +699,24 @@ export class CatalogRepository {
     return rows[0];
   }
 
-  async createVariant(data: VariantInsert, ctx?: TxContext): Promise<Variant> {
+  async createVariant(
+    data: Omit<VariantInsert, "organizationId" | "sourceStoreId">,
+    ctx?: TxContext,
+  ): Promise<Variant> {
     const db = this.getDb(ctx);
-    const rows = await db.insert(variants).values(data).returning();
+    const entity = await this.findEntityById(data.entityId, ctx);
+    if (!entity) throw new CommerceNotFoundError("Entity not found.");
+    const rows = await db.insert(variants).values({
+      ...data,
+      organizationId: entity.organizationId,
+      sourceStoreId: entity.sourceStoreId,
+    }).returning();
     return rows[0]!;
   }
 
   async updateVariant(
     id: string,
-    data: Partial<Omit<VariantInsert, "id">>,
+    data: Partial<Omit<VariantInsert, "id" | "organizationId" | "sourceStoreId">>,
     ctx?: TxContext,
   ): Promise<Variant | undefined> {
     const db = this.getDb(ctx);

package/src/modules/catalog/schema.ts

@@ -1,4 +1,5 @@
 import type { AnyPgColumn } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
 import {
   boolean,
   index,
@@ -17,6 +18,8 @@ export const sellableEntities = pgTable(
   {
     id: uuid("id").defaultRandom().primaryKey(),
     organizationId: text("organization_id").notNull().references(() => organization.id, { onDelete: "cascade" }),
+    // Connected-store id when externally sourced; null means platform-native.
+    sourceStoreId: text("source_store_id"),
     type: text("type").notNull(),
     slug: text("slug").notNull(),
     status: text("status", {
@@ -179,24 +182,36 @@ export const optionValues = pgTable("option_values", {
   metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}),
 });
 
-export const variants = pgTable("variants", {
-  id: uuid("id").defaultRandom().primaryKey(),
-  entityId: uuid("entity_id")
-    .references(() => sellableEntities.id, { onDelete: "cascade" })
-    .notNull(),
-  sku: text("sku").unique(),
-  barcode: text("barcode"),
-  // Overrides the entity's taxClass when set (issue #57).
-  taxClass: text("tax_class"),
-  status: text("status", { enum: ["active", "discontinued"] })
-    .notNull()
-    .default("active"),
-  sortOrder: integer("sort_order").notNull().default(0),
-  metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}),
-}, (table) => ({
-  barcodeIdx: index("idx_variants_barcode").on(table.barcode),
-  skuIdx: index("idx_variants_sku").on(table.sku),
-}));
+export const variants = pgTable(
+  "variants",
+  {
+    id: uuid("id").defaultRandom().primaryKey(),
+    entityId: uuid("entity_id")
+      .references(() => sellableEntities.id, { onDelete: "cascade" })
+      .notNull(),
+    organizationId: text("organization_id").notNull().references(() => organization.id, { onDelete: "cascade" }),
+    sourceStoreId: text("source_store_id"),
+    sku: text("sku"),
+    barcode: text("barcode"),
+    // Overrides the entity's taxClass when set (issue #57).
+    taxClass: text("tax_class"),
+    status: text("status", { enum: ["active", "discontinued"] })
+      .notNull()
+      .default("active"),
+    sortOrder: integer("sort_order").notNull().default(0),
+    metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}),
+  },
+  (table) => ({
+    barcodeIdx: index("idx_variants_barcode").on(table.barcode),
+    skuIdx: index("idx_variants_sku").on(table.sku),
+    nativeSkuUnique: uniqueIndex("variants_native_org_sku_unique")
+      .on(table.organizationId, table.sku)
+      .where(sql`${table.sourceStoreId} IS NULL AND ${table.sku} IS NOT NULL`),
+    sourceSkuUnique: uniqueIndex("variants_source_store_sku_unique")
+      .on(table.sourceStoreId, table.sku)
+      .where(sql`${table.sourceStoreId} IS NOT NULL AND ${table.sku} IS NOT NULL`),
+  }),
+);
 
 export const variantOptionValues = pgTable("variant_option_values", {
   variantId: uuid("variant_id")

package/src/modules/catalog/schemas.ts

@@ -92,7 +92,9 @@ export const GenerateVariantsBodySchema = z
 
 // ─── Derived Input Types ─────────────────────────────────────────────────────
 
-export type CreateEntityInput = z.infer<typeof CreateEntityBodySchema>;
+export type CreateEntityInput = z.infer<typeof CreateEntityBodySchema> & {
+  sourceStoreId?: string;
+};
 
 export type UpdateEntityInput = z.infer<typeof UpdateEntityBodySchema>;
 

package/src/modules/channels/adapter.ts

@@ -0,0 +1,139 @@
+import type { Result } from "../../kernel/result.js";
+
+export interface ChannelConnectorError {
+  code: string;
+  message: string;
+  retriable?: boolean;
+}
+
+export interface ChannelConnectorCapabilities {
+  readonly importCatalog: boolean;
+  readonly importInventory: boolean;
+  readonly pushOrder: boolean;
+  readonly receiveWebhooks: boolean;
+  readonly reserve?: boolean;
+}
+
+export interface ChannelStore {
+  id: string;
+  organizationId: string;
+  provider: string;
+  credentials: Record<string, unknown>;
+  storeDomain: string;
+  status: "connected" | "disconnected" | "error";
+  webhookSecret: string | null;
+}
+
+export interface ChannelCatalogVariant {
+  externalId: string;
+  sku?: string;
+  barcode?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface ChannelCatalogItem {
+  externalId: string;
+  slug: string;
+  title: string;
+  description?: string;
+  variants: ChannelCatalogVariant[];
+  metadata?: Record<string, unknown>;
+}
+
+export interface ChannelCatalogPage {
+  items: ChannelCatalogItem[];
+  nextCursor?: string | null;
+}
+
+export interface ChannelInventoryLevel {
+  externalId: string;
+  available: number;
+}
+
+export interface ChannelOrderLine {
+  externalVariantId: string;
+  sku?: string;
+  title: string;
+  quantity: number;
+  unitPrice: number;
+  totalPrice: number;
+}
+
+export interface ChannelOrderSlice {
+  orderId: string;
+  currency: string;
+  grandTotal: number;
+  lines: ChannelOrderLine[];
+  customer: {
+    name: string;
+    email: string;
+    shippingAddress: Record<string, unknown>;
+  };
+}
+
+export interface ChannelPushOrderResult {
+  remoteOrderId: string;
+  remoteUrl?: string;
+}
+
+export interface ChannelOrderStatus {
+  status: "pending" | "confirmed" | "failed" | "cancelled" | "fulfilled";
+}
+
+export interface ChannelWebhookEvent {
+  id: string;
+  type: string;
+  data: unknown;
+}
+
+export interface ChannelReservation {
+  id: string;
+  expiresAt?: Date;
+}
+
+export interface ChannelRefundResult {
+  remoteRefundId: string;
+  status: string;
+}
+
+export interface ChannelConnector {
+  readonly providerId: string;
+  readonly capabilities: ChannelConnectorCapabilities;
+  buildAuthUrl?(params: {
+    storeDomain: string;
+    state: string;
+    redirectUri: string;
+    callbackUri: string;
+    scopes: string[];
+  }): Result<string, ChannelConnectorError>;
+  completeAuth?(
+    request: Request,
+    ctx: { storeDomain: string },
+  ): Promise<Result<{ credentials: Record<string, unknown>; storeDomain: string }, ChannelConnectorError>>;
+  importCatalog(store: ChannelStore, cursor?: string): Promise<Result<ChannelCatalogPage>>;
+  fetchInventory(store: ChannelStore, ids?: string[]): Promise<Result<ChannelInventoryLevel[]>>;
+  pushOrder(store: ChannelStore, slice: ChannelOrderSlice): Promise<Result<ChannelPushOrderResult, ChannelConnectorError>>;
+  fetchOrderStatus(store: ChannelStore, remoteId: string): Promise<Result<ChannelOrderStatus, ChannelConnectorError>>;
+  verifyWebhook(store: ChannelStore, request: Request): Promise<Result<ChannelWebhookEvent>>;
+  verifyAppWebhook?(
+    request: Request,
+  ): Promise<Result<{ topic: string; shopDomain: string; data: unknown }, ChannelConnectorError>>;
+  registerWebhooks?(
+    store: ChannelStore,
+    topics: string[],
+    callbackUrl: string,
+  ): Promise<Result<{ registered: number }, ChannelConnectorError>>;
+  reserve?(
+    store: ChannelStore,
+    lines: ChannelOrderLine[],
+  ): Promise<Result<ChannelReservation>>;
+  refundExecute(
+    store: ChannelStore,
+    slice: ChannelOrderSlice,
+    amount: number,
+  ): Promise<Result<ChannelRefundResult>>;
+}
+
+export function defineChannelConnector<T extends ChannelConnector>(connector: T): T {
+  return connector;
+}

package/src/modules/inventory/repository/index.ts

@@ -1,5 +1,5 @@
 import { eq, and, inArray, isNull, sql } from "drizzle-orm";
-import { CommerceValidationError } from "../../../kernel/errors.js";
+import { CommerceValidationError, INVENTORY_RECORD_NOT_FOUND_MESSAGE } from "../../../kernel/errors.js";
 import type { TxContext } from "../../../kernel/database/tx-context.js";
 import type {
   DrizzleDatabase,
@@ -495,7 +495,7 @@ export class InventoryRepository {
     if (!level) {
       return {
         ok: false,
-        reason: "No inventory record found for this entity.",
+        reason: INVENTORY_RECORD_NOT_FOUND_MESSAGE,
       };
     }
 
@@ -550,7 +550,7 @@ export class InventoryRepository {
     if (!level) {
       return {
         ok: false,
-        reason: "No inventory record found for this entity.",
+        reason: INVENTORY_RECORD_NOT_FOUND_MESSAGE,
       };
     }
 
@@ -600,7 +600,7 @@ export class InventoryRepository {
     if (!level) {
       return {
         ok: false,
-        reason: "No inventory record found for this entity.",
+        reason: INVENTORY_RECORD_NOT_FOUND_MESSAGE,
       };
     }
 

package/src/modules/inventory/service.ts

@@ -3,8 +3,10 @@ import { assertPermission } from "../../auth/permissions.js";
 import type { Actor } from "../../auth/types.js";
 import type { CommerceConfig } from "../../config/types.js";
 import {
+  CommerceInventoryRecordNotFoundError,
   CommerceNotFoundError,
   CommerceValidationError,
+  INVENTORY_RECORD_NOT_FOUND_MESSAGE,
   toCommerceError,
 } from "../../kernel/errors.js";
 import { runAfterHooks } from "../../kernel/hooks/executor.js";
@@ -232,7 +234,11 @@ export class InventoryService {
       );
 
       if (!reserveResult.ok) {
-        return Err(new CommerceValidationError(reserveResult.reason));
+        return Err(
+          reserveResult.reason === INVENTORY_RECORD_NOT_FOUND_MESSAGE
+            ? new CommerceInventoryRecordNotFoundError()
+            : new CommerceValidationError(reserveResult.reason),
+        );
       }
 
       await this.repo.createMovement(
@@ -281,7 +287,11 @@ export class InventoryService {
       );
 
       if (!releaseResult.ok) {
-        return Err(new CommerceValidationError(releaseResult.reason));
+        return Err(
+          releaseResult.reason === INVENTORY_RECORD_NOT_FOUND_MESSAGE
+            ? new CommerceInventoryRecordNotFoundError()
+            : new CommerceValidationError(releaseResult.reason),
+        );
       }
 
       await this.repo.createMovement(

package/src/modules/orders/service.ts

@@ -10,6 +10,7 @@ import {
 } from "../../kernel/errors.js";
 import { runAfterHooks, runBeforeHooks } from "../../kernel/hooks/executor.js";
 import { createHookContext } from "../../kernel/hooks/create-context.js";
+import type { JobsAdapter } from "../../kernel/jobs/adapter.js";
 import type {
   AfterHook,
   BeforeHook,
@@ -130,6 +131,7 @@ function context(
     tx,
     logger: createLogger("orders"),
     services,
+    ...(services.jobs ? { jobs: services.jobs as JobsAdapter } : {}),
     context: { moduleName: "orders" },
     database: { db: database.db as PluginDb },
   });
@@ -808,12 +810,9 @@ export class OrderService {
             );
             if (!releaseResult.ok) {
               const err = toCommerceError(releaseResult.error);
-              if (
-                !(
-                  err instanceof CommerceValidationError &&
-                  err.message === "No inventory record found for this entity."
-                )
-              ) {
+              // Tolerate a missing inventory record (nothing to release); surface
+              // any other inventory error. Check the typed code, not the message.
+              if (err.code !== "INVENTORY_RECORD_NOT_FOUND") {
                 return Err(err);
               }
             }
@@ -935,12 +934,9 @@ export class OrderService {
             );
             if (!releaseResult.ok) {
               const err = toCommerceError(releaseResult.error);
-              if (
-                !(
-                  err instanceof CommerceValidationError &&
-                  err.message === "No inventory record found for this entity."
-                )
-              ) {
+              // Tolerate a missing inventory record (nothing to release); surface
+              // any other inventory error. Check the typed code, not the message.
+              if (err.code !== "INVENTORY_RECORD_NOT_FOUND") {
                 return Err(err);
               }
             }

package/src/modules/orders/stale-order-cleanup.ts

@@ -45,17 +45,6 @@ export const staleOrderCleanupTask: TaskDefinition<
     const thresholdHours = input.thresholdHours ?? 48;
     const cutoff = new Date(Date.now() - thresholdHours * 60 * 60 * 1000);
 
-    // Find stale pending orders
-    const staleOrders = await ctx.db
-      .select()
-      .from(orders)
-      .where(
-        and(
-          eq(orders.status, "pending"),
-          lt(orders.placedAt, cutoff),
-        ),
-      );
-
     const cancelledIds: string[] = [];
 
     // Cancel each stale order via the service (triggers inventory release + payment refund)
@@ -63,20 +52,42 @@ export const staleOrderCleanupTask: TaskDefinition<
       cancel(orderId: string, actor: Actor | null, reason: string): Promise<unknown>;
     };
 
-    for (const order of staleOrders) {
-      try {
-        await orderService.cancel(
-          order.id,
-          systemActorForOrg(order.organizationId),
-          `Auto-cancelled: pending for >${thresholdHours}h`,
+    // This is a cross-org system sweep, but the row reads stay org-scoped: first
+    // enumerate the orgs that have stale orders (id-only projection), then read
+    // each org's stale orders under an explicit organizationId predicate. No
+    // query returns another tenant's order rows.
+    const staleOrgs = await ctx.db
+      .selectDistinct({ organizationId: orders.organizationId })
+      .from(orders)
+      .where(and(eq(orders.status, "pending"), lt(orders.placedAt, cutoff)));
+
+    for (const { organizationId } of staleOrgs) {
+      const staleOrders = await ctx.db
+        .select()
+        .from(orders)
+        .where(
+          and(
+            eq(orders.organizationId, organizationId),
+            eq(orders.status, "pending"),
+            lt(orders.placedAt, cutoff),
+          ),
         );
-        cancelledIds.push(order.id);
-        ctx.logger.info(`Stale order ${order.orderNumber} auto-cancelled`, {
-          orderId: order.id,
-          placedAt: order.placedAt,
-        });
-      } catch (error) {
-        ctx.logger.error(`Failed to cancel stale order ${order.orderNumber}`, { error });
+
+      for (const order of staleOrders) {
+        try {
+          await orderService.cancel(
+            order.id,
+            systemActorForOrg(order.organizationId),
+            `Auto-cancelled: pending for >${thresholdHours}h`,
+          );
+          cancelledIds.push(order.id);
+          ctx.logger.info(`Stale order ${order.orderNumber} auto-cancelled`, {
+            orderId: order.id,
+            placedAt: order.placedAt,
+          });
+        } catch (error) {
+          ctx.logger.error(`Failed to cancel stale order ${order.orderNumber}`, { error });
+        }
       }
     }
 

package/src/modules/promotions/repository/index.ts

@@ -182,6 +182,7 @@ export class PromotionsRepository {
 
   async createUsage(
     data: PromotionUsageInsert,
+    orgId: string,
     ctx?: TxContext,
   ): Promise<PromotionUsage> {
     const db = this.getDb(ctx);
@@ -190,10 +191,13 @@ export class PromotionsRepository {
     // race conditions between concurrent checkouts using the same coupon.
     // A plain count-then-insert has a TOCTOU gap; this single statement
     // ensures the insert only succeeds if the limit has not been reached.
+    // Both reads are scoped by organizationId: these are raw/lock queries that
+    // bypass the scoped-db proxy, so a promotionId from another tenant must
+    // resolve to no row rather than reading/locking a foreign promotion.
     const promo = await db
       .select({ usageLimitTotal: promotions.usageLimitTotal })
       .from(promotions)
-      .where(eq(promotions.id, data.promotionId));
+      .where(and(eq(promotions.id, data.promotionId), eq(promotions.organizationId, orgId)));
 
     const limit = promo[0]?.usageLimitTotal;
 
@@ -206,7 +210,7 @@ export class PromotionsRepository {
       // concurrent callers. If the caller is already inside a transaction
       // (ctx.tx), the lock is held until that transaction commits.
       await db.execute(
-        sql`SELECT id FROM promotions WHERE id = ${data.promotionId} FOR UPDATE`,
+        sql`SELECT id FROM promotions WHERE id = ${data.promotionId} AND organization_id = ${orgId} FOR UPDATE`,
       );
 
       const currentCount = await this.countUsages(data.promotionId, ctx);

package/src/modules/promotions/service.ts

@@ -500,6 +500,7 @@ export class PromotionService {
   async recordUsage(
     input: {
       promotions: AppliedPromotion[];
+      organizationId: string;
       customerId?: string;
       orderId?: string;
     },
@@ -513,6 +514,7 @@ export class PromotionService {
           customerId: input.customerId ?? null,
           orderId: input.orderId ?? null,
         },
+        input.organizationId,
         ctx,
       );
       usages.push(usage);

package/src/modules/webhooks/repository/index.ts

@@ -1,4 +1,4 @@
-import { eq, and, lte, isNull, or, desc, sql } from "drizzle-orm";
+import { eq, and, lte, isNull, or, desc, sql, inArray } from "drizzle-orm";
 import type { TxContext } from "../../../kernel/database/tx-context.js";
 import type {
   DrizzleDatabase,
@@ -195,28 +195,30 @@ export class WebhooksRepository {
   }
 
   async findFailedDeliveries(
+    orgId: string,
     endpointId?: string,
     ctx?: TxContext,
   ): Promise<WebhookDelivery[]> {
     const db = this.getDb(ctx);
 
-    if (endpointId) {
-      return db
-        .select()
-        .from(webhookDeliveries)
-        .where(
-          and(
-            eq(webhookDeliveries.endpointId, endpointId),
-            sql`${webhookDeliveries.failedAt} IS NOT NULL`,
-          ),
-        )
-        .orderBy(desc(webhookDeliveries.failedAt));
-    }
+    // webhook_deliveries has no organizationId column — org lives on the parent
+    // endpoint. Scope failed deliveries to endpoints owned by orgId so this can
+    // never read another tenant's deliveries.
+    const orgEndpointIds = db
+      .select({ id: webhookEndpoints.id })
+      .from(webhookEndpoints)
+      .where(eq(webhookEndpoints.organizationId, orgId));
+
+    const conditions = [
+      sql`${webhookDeliveries.failedAt} IS NOT NULL`,
+      inArray(webhookDeliveries.endpointId, orgEndpointIds),
+    ];
+    if (endpointId) conditions.push(eq(webhookDeliveries.endpointId, endpointId));
 
     return db
       .select()
       .from(webhookDeliveries)
-      .where(sql`${webhookDeliveries.failedAt} IS NOT NULL`)
+      .where(and(...conditions))
       .orderBy(desc(webhookDeliveries.failedAt));
   }
 

package/src/runtime/commerce.ts

@@ -2,6 +2,7 @@ import type { Actor } from "../auth/types.js";
 import type { CommerceConfig } from "../config/types.js";
 import type { Kernel } from "./kernel.js";
 import { createKernel } from "./kernel.js";
+import { pushSchema } from "../kernel/database/migrate.js";
 import { ensureDefaultOrg, setBootDefaultOrgId } from "../auth/org.js";
 import { setBootStrictOrgResolution } from "../auth/strict-org-resolution.js";
 import { createAuth, type AuthInstance } from "../auth/setup.js";
@@ -122,6 +123,15 @@ export async function createCommerce(
 ): Promise<CommerceInstance> {
   const kernel = createKernel(config);
 
+  // Zero-migration adapters (PGlite) push core schema at construction, but a
+  // plugin's own tables live in `config.customSchemas`, which only exist after
+  // plugins run in `defineConfig` — i.e. after the adapter was constructed.
+  // Create them now so plugin routes have their tables. Guarded on both signals
+  // so plugin-less stores and migration-managed adapters (Postgres) are untouched.
+  if (config.databaseAdapter?.autoMigrate && config.customSchemas?.length) {
+    await pushSchema(kernel.database.db, config);
+  }
+
   setBootStrictOrgResolution(config.auth?.strictOrgResolution === true);
 
   // Register the config-driven org ID so resolveOrgId() can use it