@porulle/plugin-giftcards 0.8.0 → 0.9.0

package/dist/routes/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAG7D,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACtE,uBAAuB,EAAE,CAyG3B"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAG7D,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACtE,uBAAuB,EAAE,CA0G3B"}

package/dist/routes/admin.js

@@ -1,4 +1,4 @@
-import { router } from "@porulle/core";
+import { router, CommerceNotFoundError } from "@porulle/core";
 import { z } from "@hono/zod-openapi";
 import { formatCode } from "../code-generator.js";
 export function buildAdminRoutes(service, ctx) {
@@ -52,8 +52,9 @@ export function buildAdminRoutes(service, ctx) {
         .permission("gift-cards:admin")
         .handler(async ({ params, orgId }) => {
         const cardResult = await service.getById(orgId, params.id);
+        // Cross-tenant / missing card → safe 404, not a generic 500.
         if (!cardResult.ok)
-            throw new Error(cardResult.error);
+            throw new CommerceNotFoundError("Gift card not found.");
         const txnResult = await service.getTransactions(orgId, cardResult.value.id);
         return {
             ...cardResult.value,
@@ -68,7 +69,7 @@ export function buildAdminRoutes(service, ctx) {
         .handler(async ({ params, orgId }) => {
         const result = await service.disable(orgId, params.id);
         if (!result.ok)
-            throw new Error(result.error);
+            throw new CommerceNotFoundError("Gift card not found.");
         return result.value;
     });
     // ─── Manual Balance Adjustment ────────────────────────────────────
@@ -83,7 +84,7 @@ export function buildAdminRoutes(service, ctx) {
         const body = input;
         const result = await service.adjust(orgId, params.id, body.delta, body.note);
         if (!result.ok)
-            throw new Error(result.error);
+            throw new CommerceNotFoundError("Gift card not found.");
         return result.value;
     });
     return r.routes();

package/dist/services/gift-card-repository.d.ts

@@ -6,25 +6,25 @@ export declare class GiftCardRepository {
     create(data: GiftCardInsert, ctx?: {
         tx?: Db;
     }): Promise<GiftCard>;
-    findById(id: string, ctx?: {
+    findById(orgId: string, id: string, ctx?: {
         tx?: Db;
     }): Promise<GiftCard | undefined>;
-    findByCode(code: string, ctx?: {
+    findByCode(orgId: string, code: string, ctx?: {
         tx?: Db;
     }): Promise<GiftCard | undefined>;
-    list(filters?: {
+    list(orgId: string, filters?: {
         status?: GiftCardStatus;
         purchaserId?: string;
     }, ctx?: {
         tx?: Db;
     }): Promise<GiftCard[]>;
-    disable(id: string, ctx?: {
+    disable(orgId: string, id: string, ctx?: {
         tx?: Db;
     }): Promise<GiftCard | undefined>;
-    findByCodeForUpdate(code: string, tx: Db): Promise<GiftCard | undefined>;
-    findByIdForUpdate(id: string, tx: Db): Promise<GiftCard | undefined>;
-    updateBalance(id: string, balance: number, status: GiftCardStatus, currentVersion: number, tx: Db): Promise<GiftCard>;
-    adjustBalance(id: string, delta: number, tx: Db): Promise<GiftCard>;
+    findByCodeForUpdate(orgId: string, code: string, tx: Db): Promise<GiftCard | undefined>;
+    findByIdForUpdate(orgId: string, id: string, tx: Db): Promise<GiftCard | undefined>;
+    updateBalance(orgId: string, id: string, balance: number, status: GiftCardStatus, currentVersion: number, tx: Db): Promise<GiftCard>;
+    adjustBalance(orgId: string, id: string, delta: number, tx: Db): Promise<GiftCard>;
     recordTransaction(data: {
         giftCardId: string;
         type: TransactionType;

package/dist/services/gift-card-repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gift-card-repository.d.ts","sourceRoot":"","sources":["../../src/services/gift-card-repository.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtH,qBAAa,kBAAkB;IACjB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,EAAE;IAE1B,OAAO,CAAC,KAAK;IAMP,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAQlE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAQtE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAQ1E,IAAI,CACR,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,cAAc,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAC3D,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAChB,OAAO,CAAC,QAAQ,EAAE,CAAC;IAYhB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAWrE,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IASxE,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IASpE,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EACtB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,QAAQ,CAAC;IAcd,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,QAAQ,CAAC;IAYd,iBAAiB,CACrB,IAAI,EAAE;QACJ,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,eAAe,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,EACD,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAChB,OAAO,CAAC,mBAAmB,CAAC;IAQzB,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAChB,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAQ3B,yBAAyB,CAC7B,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAChB,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAOlC"}
+{"version":3,"file":"gift-card-repository.d.ts","sourceRoot":"","sources":["../../src/services/gift-card-repository.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtH,qBAAa,kBAAkB;IACjB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,EAAE;IAE1B,OAAO,CAAC,KAAK;IAMP,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAQlE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAQrF,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAYzF,IAAI,CACR,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,cAAc,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAC3D,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAChB,OAAO,CAAC,QAAQ,EAAE,CAAC;IAYhB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAWpF,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IASvF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IASnF,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EACtB,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,QAAQ,CAAC;IAcd,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,QAAQ,CAAC;IAYd,iBAAiB,CACrB,IAAI,EAAE;QACJ,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,eAAe,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,EACD,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAChB,OAAO,CAAC,mBAAmB,CAAC;IAQzB,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAChB,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAQ3B,yBAAyB,CAC7B,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,EAAE,CAAA;KAAE,GAChB,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAOlC"}

package/dist/services/gift-card-repository.js

@@ -16,22 +16,27 @@ export class GiftCardRepository {
             .returning();
         return rows[0];
     }
-    async findById(id, ctx) {
+    async findById(orgId, id, ctx) {
         const rows = await this.getDb(ctx)
             .select()
             .from(giftCards)
-            .where(eq(giftCards.id, id));
+            .where(and(eq(giftCards.id, id), eq(giftCards.organizationId, orgId)));
         return rows[0];
     }
-    async findByCode(code, ctx) {
+    async findByCode(orgId, code, ctx) {
+        const conditions = [eq(giftCards.code, code)];
+        // "_any" is the public bearer-token lookup (check-balance): a gift-card code
+        // is org-agnostic by design. Admin id-based lookups stay strictly org-scoped.
+        if (orgId !== "_any")
+            conditions.push(eq(giftCards.organizationId, orgId));
         const rows = await this.getDb(ctx)
             .select()
             .from(giftCards)
-            .where(eq(giftCards.code, code));
+            .where(and(...conditions));
         return rows[0];
     }
-    async list(filters, ctx) {
-        const conditions = [];
+    async list(orgId, filters, ctx) {
+        const conditions = [eq(giftCards.organizationId, orgId)];
         if (filters?.status)
             conditions.push(eq(giftCards.status, filters.status));
         if (filters?.purchaserId)
@@ -39,35 +44,35 @@ export class GiftCardRepository {
         return this.getDb(ctx)
             .select()
             .from(giftCards)
-            .where(conditions.length > 0 ? and(...conditions) : undefined)
+            .where(and(...conditions))
             .orderBy(desc(giftCards.createdAt));
     }
-    async disable(id, ctx) {
+    async disable(orgId, id, ctx) {
         const rows = await this.getDb(ctx)
             .update(giftCards)
             .set({ status: "disabled", updatedAt: new Date() })
-            .where(eq(giftCards.id, id))
+            .where(and(eq(giftCards.id, id), eq(giftCards.organizationId, orgId)))
             .returning();
         return rows[0];
     }
     // ─── SELECT FOR UPDATE (Concurrency-Safe Balance Operations) ───────
-    async findByCodeForUpdate(code, tx) {
+    async findByCodeForUpdate(orgId, code, tx) {
         const rows = await tx
             .select()
             .from(giftCards)
-            .where(eq(giftCards.code, code))
+            .where(and(eq(giftCards.code, code), eq(giftCards.organizationId, orgId)))
             .for("update");
         return rows[0];
     }
-    async findByIdForUpdate(id, tx) {
+    async findByIdForUpdate(orgId, id, tx) {
         const rows = await tx
             .select()
             .from(giftCards)
-            .where(eq(giftCards.id, id))
+            .where(and(eq(giftCards.id, id), eq(giftCards.organizationId, orgId)))
             .for("update");
         return rows[0];
     }
-    async updateBalance(id, balance, status, currentVersion, tx) {
+    async updateBalance(orgId, id, balance, status, currentVersion, tx) {
         const rows = await tx
             .update(giftCards)
             .set({
@@ -76,17 +81,17 @@ export class GiftCardRepository {
             version: currentVersion + 1,
             updatedAt: new Date(),
         })
-            .where(eq(giftCards.id, id))
+            .where(and(eq(giftCards.id, id), eq(giftCards.organizationId, orgId)))
             .returning();
         return rows[0];
     }
-    async adjustBalance(id, delta, tx) {
-        const card = await this.findByIdForUpdate(id, tx);
+    async adjustBalance(orgId, id, delta, tx) {
+        const card = await this.findByIdForUpdate(orgId, id, tx);
         if (!card)
             throw new Error("Gift card not found");
         const newBalance = Math.max(0, Math.min(card.initialAmount, card.balance + delta));
         const newStatus = newBalance === 0 ? "exhausted" : "active";
-        return this.updateBalance(id, newBalance, newStatus, card.version, tx);
+        return this.updateBalance(orgId, id, newBalance, newStatus, card.version, tx);
     }
     // ─── Transactions ───────────────────────────────────────────────────
     async recordTransaction(data, ctx) {

package/dist/services/gift-card-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gift-card-service.d.ts","sourceRoot":"","sources":["../../src/services/gift-card-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EACV,EAAE,EACF,QAAQ,EACR,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EAEf,MAAM,aAAa,CAAC;AAErB,qBAAa,eAAe;IAOxB,OAAO,CAAC,OAAO;IANjB,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAAyD;gBAG1E,EAAE,EAAE,EAAE,EACN,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,EAC7D,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC;IAQ5C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QACjC,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAuD7B,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAMnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAMvE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAClC,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;IAK/B,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAOzC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;QACpE,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IAaH;;;OAGG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAwC3C;;;OAGG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAsC5C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAMnE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;CAoCnC"}
+{"version":3,"file":"gift-card-service.d.ts","sourceRoot":"","sources":["../../src/services/gift-card-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EACV,EAAE,EACF,QAAQ,EACR,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EAEf,MAAM,aAAa,CAAC;AAErB,qBAAa,eAAe;IAOxB,OAAO,CAAC,OAAO;IANjB,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,WAAW,CAAyD;gBAG1E,EAAE,EAAE,EAAE,EACN,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,EAC7D,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC;IAQ5C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;QACjC,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAuD7B,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAMnE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAMvE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAClC,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;IAK/B,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAOzC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;QACpE,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IAaH;;;OAGG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAwC3C;;;OAGG;IACG,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAsC5C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAMnE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;CAqCnC"}

package/dist/services/gift-card-service.js

@@ -23,7 +23,7 @@ export class GiftCardService {
         let attempts = 0;
         do {
             code = normalizeCode(generateGiftCardCode(this.options.codeFormat));
-            const existing = await this.repo.findByCode(code);
+            const existing = await this.repo.findByCode(orgId, code);
             if (!existing)
                 break;
             attempts++;
@@ -60,19 +60,19 @@ export class GiftCardService {
     }
     // ─── Query ───────────────────────────────────────────────────────────
     async getById(orgId, id) {
-        const card = await this.repo.findById(id);
+        const card = await this.repo.findById(orgId, id);
         if (!card)
             return Err("Gift card not found");
         return Ok(card);
     }
     async getByCode(orgId, code) {
-        const card = await this.repo.findByCode(normalizeCode(code));
+        const card = await this.repo.findByCode(orgId, normalizeCode(code));
         if (!card)
             return Err("Gift card not found");
         return Ok(card);
     }
     async list(orgId, filters) {
-        const cards = await this.repo.list(filters);
+        const cards = await this.repo.list(orgId, filters);
         return Ok(cards);
     }
     async getTransactions(orgId, giftCardId) {
@@ -81,7 +81,7 @@ export class GiftCardService {
     }
     // ─── Balance Check (Public) ──────────────────────────────────────────
     async checkBalance(orgId, code) {
-        const card = await this.repo.findByCode(normalizeCode(code));
+        const card = await this.repo.findByCode(orgId, normalizeCode(code));
         if (!card)
             return Err("Gift card not found");
         return Ok({
@@ -99,7 +99,7 @@ export class GiftCardService {
         if (amount <= 0)
             return Err("Debit amount must be positive");
         const result = await this.transaction(async (tx) => {
-            const card = await this.repo.findByCodeForUpdate(normalizeCode(code), tx);
+            const card = await this.repo.findByCodeForUpdate(orgId, normalizeCode(code), tx);
             if (!card)
                 return Err("GIFT_CARD_NOT_FOUND");
             if (card.status === "disabled")
@@ -114,7 +114,7 @@ export class GiftCardService {
                 return Err("INSUFFICIENT_BALANCE");
             const balanceAfter = card.balance - amount;
             const newStatus = balanceAfter === 0 ? "exhausted" : "active";
-            await this.repo.updateBalance(card.id, balanceAfter, newStatus, card.version, tx);
+            await this.repo.updateBalance(orgId, card.id, balanceAfter, newStatus, card.version, tx);
             await this.repo.recordTransaction({
                 giftCardId: card.id,
                 type: "debit",
@@ -140,7 +140,7 @@ export class GiftCardService {
         if (amount <= 0)
             return Err("Credit amount must be positive");
         const result = await this.transaction(async (tx) => {
-            const card = await this.repo.findByCodeForUpdate(normalizeCode(code), tx);
+            const card = await this.repo.findByCodeForUpdate(orgId, normalizeCode(code), tx);
             if (!card)
                 return Err("GIFT_CARD_NOT_FOUND");
             // Cap credit at initial amount (prevent inflation attack)
@@ -150,7 +150,7 @@ export class GiftCardService {
                 return Ok({ balanceAfter: card.balance });
             }
             const newStatus = balanceAfter > 0 ? "active" : card.status;
-            await this.repo.updateBalance(card.id, balanceAfter, newStatus, card.version, tx);
+            await this.repo.updateBalance(orgId, card.id, balanceAfter, newStatus, card.version, tx);
             await this.repo.recordTransaction({
                 giftCardId: card.id,
                 type: "refund",
@@ -165,20 +165,20 @@ export class GiftCardService {
     }
     // ─── Admin Operations ────────────────────────────────────────────────
     async disable(orgId, id) {
-        const card = await this.repo.disable(id);
+        const card = await this.repo.disable(orgId, id);
         if (!card)
             return Err("Gift card not found");
         return Ok(card);
     }
     async adjust(orgId, id, delta, note) {
         const result = await this.transaction(async (tx) => {
-            const card = await this.repo.findByIdForUpdate(id, tx);
+            const card = await this.repo.findByIdForUpdate(orgId, id, tx);
             if (!card)
                 return Err("Gift card not found");
             const newBalance = Math.max(0, Math.min(card.initialAmount, card.balance + delta));
             const actualDelta = newBalance - card.balance;
             const newStatus = newBalance === 0 ? "exhausted" : "active";
-            const updated = await this.repo.updateBalance(card.id, newBalance, newStatus, card.version, tx);
+            const updated = await this.repo.updateBalance(orgId, card.id, newBalance, newStatus, card.version, tx);
             if (actualDelta !== 0) {
                 const txnType = actualDelta > 0 ? "credit" : "debit";
                 await this.repo.recordTransaction({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@porulle/plugin-giftcards",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -19,7 +19,7 @@
   "dependencies": {
     "@hono/zod-openapi": "^1.2.2",
     "hono": "^4.12.5",
-    "@porulle/core": "0.8.0"
+    "@porulle/core": "0.9.0"
   },
   "devDependencies": {
     "@types/node": "^24.5.2",

package/src/routes/admin.ts

@@ -1,4 +1,4 @@
-import { router } from "@porulle/core";
+import { router, CommerceNotFoundError } from "@porulle/core";
 import { z } from "@hono/zod-openapi";
 import type { GiftCardService } from "../services/gift-card-service.js";
 import type { PluginRouteRegistration } from "@porulle/core";
@@ -72,7 +72,8 @@ export function buildAdminRoutes(
     .permission("gift-cards:admin")
     .handler(async ({ params, orgId }) => {
       const cardResult = await service.getById(orgId, params.id!);
-      if (!cardResult.ok) throw new Error(cardResult.error);
+      // Cross-tenant / missing card → safe 404, not a generic 500.
+      if (!cardResult.ok) throw new CommerceNotFoundError("Gift card not found.");
 
       const txnResult = await service.getTransactions(orgId, cardResult.value.id);
       return {
@@ -89,7 +90,7 @@ export function buildAdminRoutes(
     .permission("gift-cards:admin")
     .handler(async ({ params, orgId }) => {
       const result = await service.disable(orgId, params.id!);
-      if (!result.ok) throw new Error(result.error);
+      if (!result.ok) throw new CommerceNotFoundError("Gift card not found.");
       return result.value;
     });
 
@@ -107,7 +108,7 @@ export function buildAdminRoutes(
     .handler(async ({ params, input, orgId }) => {
       const body = input as { delta: number; note: string };
       const result = await service.adjust(orgId, params.id!, body.delta, body.note);
-      if (!result.ok) throw new Error(result.error);
+      if (!result.ok) throw new CommerceNotFoundError("Gift card not found.");
       return result.value;
     });
 

package/src/services/gift-card-repository.ts

@@ -19,67 +19,73 @@ export class GiftCardRepository {
     return rows[0]!;
   }
 
-  async findById(id: string, ctx?: { tx?: Db }): Promise<GiftCard | undefined> {
+  async findById(orgId: string, id: string, ctx?: { tx?: Db }): Promise<GiftCard | undefined> {
     const rows = await this.getDb(ctx)
       .select()
       .from(giftCards)
-      .where(eq(giftCards.id, id));
+      .where(and(eq(giftCards.id, id), eq(giftCards.organizationId, orgId)));
     return rows[0];
   }
 
-  async findByCode(code: string, ctx?: { tx?: Db }): Promise<GiftCard | undefined> {
+  async findByCode(orgId: string, code: string, ctx?: { tx?: Db }): Promise<GiftCard | undefined> {
+    const conditions = [eq(giftCards.code, code)];
+    // "_any" is the public bearer-token lookup (check-balance): a gift-card code
+    // is org-agnostic by design. Admin id-based lookups stay strictly org-scoped.
+    if (orgId !== "_any") conditions.push(eq(giftCards.organizationId, orgId));
     const rows = await this.getDb(ctx)
       .select()
       .from(giftCards)
-      .where(eq(giftCards.code, code));
+      .where(and(...conditions));
     return rows[0];
   }
 
   async list(
+    orgId: string,
     filters?: { status?: GiftCardStatus; purchaserId?: string },
     ctx?: { tx?: Db },
   ): Promise<GiftCard[]> {
-    const conditions = [];
+    const conditions = [eq(giftCards.organizationId, orgId)];
     if (filters?.status) conditions.push(eq(giftCards.status, filters.status));
     if (filters?.purchaserId) conditions.push(eq(giftCards.purchaserId, filters.purchaserId));
 
     return this.getDb(ctx)
       .select()
       .from(giftCards)
-      .where(conditions.length > 0 ? and(...conditions) : undefined)
+      .where(and(...conditions))
       .orderBy(desc(giftCards.createdAt));
   }
 
-  async disable(id: string, ctx?: { tx?: Db }): Promise<GiftCard | undefined> {
+  async disable(orgId: string, id: string, ctx?: { tx?: Db }): Promise<GiftCard | undefined> {
     const rows = await this.getDb(ctx)
       .update(giftCards)
       .set({ status: "disabled" as const, updatedAt: new Date() })
-      .where(eq(giftCards.id, id))
+      .where(and(eq(giftCards.id, id), eq(giftCards.organizationId, orgId)))
       .returning();
     return rows[0];
   }
 
   // ─── SELECT FOR UPDATE (Concurrency-Safe Balance Operations) ───────
 
-  async findByCodeForUpdate(code: string, tx: Db): Promise<GiftCard | undefined> {
+  async findByCodeForUpdate(orgId: string, code: string, tx: Db): Promise<GiftCard | undefined> {
     const rows = await tx
       .select()
       .from(giftCards)
-      .where(eq(giftCards.code, code))
+      .where(and(eq(giftCards.code, code), eq(giftCards.organizationId, orgId)))
       .for("update");
     return rows[0];
   }
 
-  async findByIdForUpdate(id: string, tx: Db): Promise<GiftCard | undefined> {
+  async findByIdForUpdate(orgId: string, id: string, tx: Db): Promise<GiftCard | undefined> {
     const rows = await tx
       .select()
       .from(giftCards)
-      .where(eq(giftCards.id, id))
+      .where(and(eq(giftCards.id, id), eq(giftCards.organizationId, orgId)))
       .for("update");
     return rows[0];
   }
 
   async updateBalance(
+    orgId: string,
     id: string,
     balance: number,
     status: GiftCardStatus,
@@ -94,23 +100,24 @@ export class GiftCardRepository {
         version: currentVersion + 1,
         updatedAt: new Date(),
       })
-      .where(eq(giftCards.id, id))
+      .where(and(eq(giftCards.id, id), eq(giftCards.organizationId, orgId)))
       .returning();
     return rows[0]!;
   }
 
   async adjustBalance(
+    orgId: string,
     id: string,
     delta: number,
     tx: Db,
   ): Promise<GiftCard> {
-    const card = await this.findByIdForUpdate(id, tx);
+    const card = await this.findByIdForUpdate(orgId, id, tx);
     if (!card) throw new Error("Gift card not found");
 
     const newBalance = Math.max(0, Math.min(card.initialAmount, card.balance + delta));
     const newStatus: GiftCardStatus = newBalance === 0 ? "exhausted" : "active";
 
-    return this.updateBalance(id, newBalance, newStatus, card.version, tx);
+    return this.updateBalance(orgId, id, newBalance, newStatus, card.version, tx);
   }
 
   // ─── Transactions ───────────────────────────────────────────────────

package/src/services/gift-card-service.ts

@@ -49,7 +49,7 @@ export class GiftCardService {
     let attempts = 0;
     do {
       code = normalizeCode(generateGiftCardCode(this.options.codeFormat));
-      const existing = await this.repo.findByCode(code);
+      const existing = await this.repo.findByCode(orgId, code);
       if (!existing) break;
       attempts++;
     } while (attempts < 10);
@@ -92,13 +92,13 @@ export class GiftCardService {
   // ─── Query ───────────────────────────────────────────────────────────
 
   async getById(orgId: string, id: string): Promise<PluginResult<GiftCard>> {
-    const card = await this.repo.findById(id);
+    const card = await this.repo.findById(orgId, id);
     if (!card) return Err("Gift card not found");
     return Ok(card);
   }
 
   async getByCode(orgId: string, code: string): Promise<PluginResult<GiftCard>> {
-    const card = await this.repo.findByCode(normalizeCode(code));
+    const card = await this.repo.findByCode(orgId, normalizeCode(code));
     if (!card) return Err("Gift card not found");
     return Ok(card);
   }
@@ -107,7 +107,7 @@ export class GiftCardService {
     status?: GiftCardStatus;
     purchaserId?: string;
   }): Promise<PluginResult<GiftCard[]>> {
-    const cards = await this.repo.list(filters);
+    const cards = await this.repo.list(orgId, filters);
     return Ok(cards);
   }
 
@@ -126,7 +126,7 @@ export class GiftCardService {
     currency: string;
     status: string;
   }>> {
-    const card = await this.repo.findByCode(normalizeCode(code));
+    const card = await this.repo.findByCode(orgId, normalizeCode(code));
     if (!card) return Err("Gift card not found");
 
     return Ok({
@@ -152,7 +152,7 @@ export class GiftCardService {
     if (amount <= 0) return Err("Debit amount must be positive");
 
     const result = await this.transaction(async (tx) => {
-      const card = await this.repo.findByCodeForUpdate(normalizeCode(code), tx);
+      const card = await this.repo.findByCodeForUpdate(orgId, normalizeCode(code), tx);
       if (!card) return Err("GIFT_CARD_NOT_FOUND");
       if (card.status === "disabled") return Err("GIFT_CARD_INACTIVE");
       if (card.status === "exhausted") return Err("GIFT_CARD_EXHAUSTED");
@@ -163,7 +163,7 @@ export class GiftCardService {
       const balanceAfter = card.balance - amount;
       const newStatus: GiftCardStatus = balanceAfter === 0 ? "exhausted" : "active";
 
-      await this.repo.updateBalance(card.id, balanceAfter, newStatus, card.version, tx);
+      await this.repo.updateBalance(orgId, card.id, balanceAfter, newStatus, card.version, tx);
       await this.repo.recordTransaction(
         {
           giftCardId: card.id,
@@ -202,7 +202,7 @@ export class GiftCardService {
     if (amount <= 0) return Err("Credit amount must be positive");
 
     const result = await this.transaction(async (tx) => {
-      const card = await this.repo.findByCodeForUpdate(normalizeCode(code), tx);
+      const card = await this.repo.findByCodeForUpdate(orgId, normalizeCode(code), tx);
       if (!card) return Err("GIFT_CARD_NOT_FOUND");
 
       // Cap credit at initial amount (prevent inflation attack)
@@ -215,7 +215,7 @@ export class GiftCardService {
 
       const newStatus: GiftCardStatus = balanceAfter > 0 ? "active" : card.status;
 
-      await this.repo.updateBalance(card.id, balanceAfter, newStatus, card.version, tx);
+      await this.repo.updateBalance(orgId, card.id, balanceAfter, newStatus, card.version, tx);
       await this.repo.recordTransaction(
         {
           giftCardId: card.id,
@@ -237,7 +237,7 @@ export class GiftCardService {
   // ─── Admin Operations ────────────────────────────────────────────────
 
   async disable(orgId: string, id: string): Promise<PluginResult<GiftCard>> {
-    const card = await this.repo.disable(id);
+    const card = await this.repo.disable(orgId, id);
     if (!card) return Err("Gift card not found");
     return Ok(card);
   }
@@ -249,7 +249,7 @@ export class GiftCardService {
     note: string,
   ): Promise<PluginResult<GiftCard>> {
     const result = await this.transaction(async (tx) => {
-      const card = await this.repo.findByIdForUpdate(id, tx);
+      const card = await this.repo.findByIdForUpdate(orgId, id, tx);
       if (!card) return Err("Gift card not found");
 
       const newBalance = Math.max(0, Math.min(card.initialAmount, card.balance + delta));
@@ -257,6 +257,7 @@ export class GiftCardService {
       const newStatus: GiftCardStatus = newBalance === 0 ? "exhausted" : "active";
 
       const updated = await this.repo.updateBalance(
+        orgId,
         card.id,
         newBalance,
         newStatus,