@revenexx/cover 0.1.0

package/server/data/themes.json

@@ -0,0 +1,8 @@
+[
+  { "id": "midnight", "name": "Midnight", "colors": { "primary": "indigo", "neutral": "zinc" }, "tokens": { "radius": "0.375rem" } },
+  { "id": "aurora", "name": "Aurora", "colors": { "primary": "violet", "neutral": "slate" }, "tokens": { "radius": "0.5rem" } },
+  { "id": "ember", "name": "Ember", "colors": { "primary": "orange", "neutral": "stone" }, "tokens": { "radius": "0.375rem" } },
+  { "id": "ocean", "name": "Ocean", "colors": { "primary": "sky", "neutral": "slate" }, "tokens": { "radius": "0.5rem" } },
+  { "id": "forest", "name": "Forest", "colors": { "primary": "emerald", "neutral": "zinc" }, "tokens": { "radius": "0.25rem" } },
+  { "id": "blossom", "name": "Blossom", "colors": { "primary": "rose", "neutral": "zinc" }, "tokens": { "radius": "0.75rem" } }
+]

package/server/interfaces/account.ts

@@ -0,0 +1,20 @@
+import type { H3Event } from "h3";
+
+export interface AccountUser {
+	readonly id: number | string;
+	readonly name: string;
+	readonly email: string;
+	readonly initials: string;
+}
+
+/**
+ * Service contract for resolving the current authenticated user.
+ * Implementations may read from a session, identity provider, or mock source.
+ * Register the active implementation via app.config → accountService.
+ *
+ * The H3 event carries the request context (session cookie) that live
+ * implementations need; mock implementations may ignore it.
+ */
+export interface IAccountService {
+	getUser(event?: H3Event): Promise<AccountUser>;
+}

package/server/interfaces/auth.ts

@@ -0,0 +1,32 @@
+import type { H3Event } from "h3";
+
+import type { AuthRole, AuthUser } from "../../app/interfaces/auth";
+
+export interface AuthPersona {
+	readonly id: string;
+	readonly name: string;
+	readonly email: string;
+	readonly role: AuthRole;
+	readonly description: string;
+}
+
+export interface AuthLoginResult {
+	user: AuthUser;
+	session: { id: string; expire: string };
+	/** Public-API logins: the customers-app contact behind the user (cart owner). */
+	contactId?: string;
+}
+
+/**
+ * Service contract for authentication.
+ * - "mock" signs B2B demo personas in without any external dependency
+ *   (see server/config/account/personas.json)
+ * - "sdk" authenticates against the platform via the revenexx web SDK
+ * Both implementations manage the same session cookie, so the client-side
+ * auth flow (store, guards, middleware) is identical.
+ */
+export interface IAuthService {
+	login(event: H3Event, email: string, password: string): Promise<AuthLoginResult>;
+	me(event: H3Event): Promise<AuthUser | null>;
+	logout(event: H3Event): Promise<void>;
+}

package/server/interfaces/b2bContext.ts

@@ -0,0 +1,23 @@
+import type { B2BContext, Requisition } from "../../app/interfaces/b2b";
+
+/**
+ * Service contract for the per-user B2B context: organization settings,
+ * cost centers, spending limits and workflow memberships.
+ *
+ * Register the active implementation via app.config → b2bService.
+ */
+export interface IB2BContextService {
+	/** Context for a user; `null` userId returns the guest context. */
+	getContext(userId: string | null): Promise<B2BContext>;
+}
+
+/**
+ * Service contract for requisitions (order requests traveling through
+ * approval workflows).
+ */
+export interface IRequisitionService {
+	/** Open requisitions the given user may load into the cart. */
+	listOpen(userId: string): Promise<Requisition[]>;
+	/** All requisitions visible to the user (any status, incl. audit trail). */
+	list(userId: string): Promise<Requisition[]>;
+}

package/server/interfaces/cart.ts

@@ -0,0 +1,46 @@
+import type { H3Event } from "h3";
+
+import type { CartItem } from "../../app/interfaces/cart-item";
+
+/** Summary row for the cart switcher / account page. */
+export interface CartSummaryRow {
+	id: string;
+	name: string;
+	itemCount: number;
+	positions: number;
+	value: number;
+	updatedAt: string;
+	active: boolean;
+}
+
+/**
+ * Service contract for the ACTIVE cart — what the storefront syncs.
+ * Implementations resolve the owner from the request themselves:
+ * - "mock" keys an in-memory store by the cart session cookie
+ * - "api"  persists into the carts app (guest = session cart, logged-in =
+ *   the contact's current cart)
+ */
+export interface ICartService {
+	getItems(event: H3Event): Promise<CartItem[]>;
+	saveItems(event: H3Event, items: CartItem[]): Promise<void>;
+	clearItems(event: H3Event): Promise<void>;
+}
+
+/**
+ * Multi-cart management — live mode only (the carts app is the source of
+ * truth). Mock mode keeps the demo shop's local multi-cart behaviour.
+ */
+export interface ICartManager {
+	listCarts(event: H3Event): Promise<{ carts: CartSummaryRow[]; activeCartId: string | null }>;
+	createCart(event: H3Event, name: string, activate: boolean): Promise<CartSummaryRow>;
+	renameCart(event: H3Event, id: string, name: string): Promise<void>;
+	deleteCart(event: H3Event, id: string): Promise<void>;
+	/** Activates the cart and answers its items (the new active cart). */
+	activateCart(event: H3Event, id: string): Promise<CartItem[]>;
+	/** Adds one line to a non-active cart (the target-cart dialog). */
+	addItemToCart(event: H3Event, id: string, item: CartItem): Promise<void>;
+	/** Login hand-over: session carts adopt the contact or merge into the current cart. */
+	claimSession(event: H3Event, contactId: string): Promise<void>;
+	/** Order hand-over: freeze the owner's current cart as ordered (+order_ref). */
+	orderActiveCart(event: H3Event, orderRef: string): Promise<string | null>;
+}

package/server/interfaces/cartCalculation.ts

@@ -0,0 +1,17 @@
+import type { B2BContext } from "../../app/interfaces/b2b";
+import type { CartCalculation, CartCalculationRequest } from "../../app/interfaces/cart-calculation";
+
+/**
+ * Service contract for cart calculation. ERP-backed implementations send
+ * the cart downstream and map the document response into the generic
+ * CartCalculation shape; the mock computes the non-ERP subset.
+ *
+ * Register the active implementation via app.config → cartService.
+ */
+export interface ICartCalculationService {
+	calculate(
+		request: CartCalculationRequest,
+		context: B2BContext,
+		locale: string,
+	): Promise<CartCalculation>;
+}

package/server/interfaces/category.ts

@@ -0,0 +1,12 @@
+import type { ProductCategory } from "../../app/config/navigation";
+import type { Locale } from "../utils/locale";
+
+/**
+ * Service contract for category data access.
+ * Implementations may read from local JSON, a database, or a remote API.
+ * Register the active implementation via app.config → categoryService.
+ */
+export interface ICategoryService {
+	listCategories(locale?: Locale): Promise<ProductCategory[]>;
+	getCategoryBySlug(slug: string, locale?: Locale): Promise<ProductCategory | null>;
+}

package/server/interfaces/checkoutProfile.ts

@@ -0,0 +1,5 @@
+import type { CheckoutProfile } from "../../app/interfaces/checkout";
+
+export interface ICheckoutProfileService {
+	getProfile(userId: string | null): Promise<CheckoutProfile>;
+}

package/server/interfaces/log.ts

@@ -0,0 +1,3 @@
+export interface ILogService {
+	error(message: string, context?: Record<string, unknown>): void;
+}

package/server/interfaces/market.ts

@@ -0,0 +1,10 @@
+import type { ShopMarket } from "../../app/interfaces/market";
+
+/**
+ * Service contract for market data — the storefront's market backbone
+ * (markets app): which markets exist, their currency and their locales.
+ * Register the active implementation via app.config → marketService.
+ */
+export interface IMarketService {
+	listMarkets(): Promise<ShopMarket[]>;
+}

package/server/interfaces/product.ts

@@ -0,0 +1,21 @@
+import type { Product } from "../../app/composables/useProducts";
+import type { ProductDetail } from "../../app/interfaces/product-detail";
+import type { Locale } from "../utils/locale";
+
+export interface ProductListFilter {
+	category?: string;
+	subcategory?: string;
+	/** Request locale — live implementations serve locale-scoped documents. */
+	locale?: Locale;
+}
+
+/**
+ * Service contract for product data access.
+ * Implementations may read from local JSON, a database, or a remote API.
+ * Register the active implementation via app.config → productService.
+ */
+export interface IProductService {
+	listProducts(filter?: ProductListFilter): Promise<Product[]>;
+	getProductById(id: string, locale?: Locale): Promise<Product | null>;
+	getProductDetail(id: string, locale?: Locale): Promise<ProductDetail | null>;
+}

package/server/interfaces/schema.ts

@@ -0,0 +1,20 @@
+export type SchemaValue = string | boolean | number | null | SchemaObject | SchemaValue[];
+export interface SchemaObject { [key: string]: SchemaValue }
+
+/**
+ * Service contract for loading and translating form schemas by key.
+ * Implementations may read from local JSON files, a remote CMS, a database, etc.
+ * Register the active implementation via app.config → schemaService.
+ */
+export interface ISchemaService {
+	getSchema(key: string, locale: string): Promise<SchemaObject>;
+}
+
+/**
+ * Capability contract for translating schema i18n keys in-place.
+ * A class may implement both ISchemaService and ISchemaTranslator,
+ * with getSchema() delegating to translateSchema() internally.
+ */
+export interface ISchemaTranslator {
+	translateSchema(schema: SchemaValue, locale: string): SchemaValue;
+}

package/server/interfaces/theme.ts

@@ -0,0 +1,10 @@
+import type { Theme } from "../../app/config/themes";
+
+/**
+ * Service contract for theme data access.
+ * Implementations may read from local JSON, a database, or a remote API.
+ * Register the active implementation via app.config → themeService.
+ */
+export interface IThemeService {
+	listThemes(): Promise<Theme[]>;
+}

package/server/services/ApiAuthService.ts

@@ -0,0 +1,138 @@
+import type { H3Event } from "h3";
+
+import type { AuthRole, AuthUser, StoredSession } from "../../app/interfaces/auth";
+import type { AuthLoginResult, IAuthService } from "../interfaces/auth";
+
+/** Session payload of the customers app's auth passthrough. */
+interface ApiSession {
+	$id: string;
+	userId: string;
+	secret?: string;
+	expire: string;
+}
+
+/** Contact row mirrored by the customers app (system of record). */
+interface ApiContact {
+	id: string;
+	email: string;
+	first_name?: string | null;
+	last_name?: string | null;
+	role?: string | null;
+	organization_id?: string | null;
+}
+
+const KNOWN_ROLES = new Set<AuthRole>(["buyer", "approver", "admin", "requester"]);
+
+function toAuthRole(role?: string | null): AuthRole | undefined {
+	return role && KNOWN_ROLES.has(role as AuthRole) ? (role as AuthRole) : undefined;
+}
+
+function contactName(contact: ApiContact | null, fallback: string): string {
+	const name = [contact?.first_name, contact?.last_name].filter(Boolean).join(" ").trim();
+	return name || fallback;
+}
+
+/**
+ * Live authentication via the public revenexx API (customers app):
+ *   POST /v1/customers/auth/login   → platform session (incl. secret) + contact
+ *   POST /v1/customers/auth/me      → platform user + contact
+ *   POST /v1/customers/auth/logout  → revokes the platform session
+ *
+ * Session state lives in the same cookie as the other implementations, so
+ * the client-side auth flow (store, guards, middleware) is identical. The
+ * session secret stays server-side only — the BFF never forwards it.
+ */
+export class ApiAuthService implements IAuthService {
+	async login(event: H3Event, email: string, password: string): Promise<AuthLoginResult> {
+		const api = useRevenexxApi();
+		const { session, contact } = await api.post<{ session: ApiSession; contact: ApiContact | null }>(
+			"/v1/customers/auth/login",
+			{ email, password },
+		);
+
+		const storedSession: StoredSession = {
+			id: session.$id,
+			expire: session.expire,
+			userId: session.userId,
+			...(contact?.id ? { contactId: contact.id } : {}),
+			...(contact?.organization_id ? { organizationId: contact.organization_id } : {}),
+		};
+		setCookie(event, SESSION_COOKIE_NAME, JSON.stringify(storedSession), sessionCookieOptions(session.expire));
+
+		return {
+			user: {
+				$id: session.userId,
+				name: contactName(contact, email),
+				email: contact?.email ?? email,
+				role: toAuthRole(contact?.role),
+			},
+			session: { id: session.$id, expire: session.expire },
+			...(contact?.id ? { contactId: contact.id } : {}),
+		};
+	}
+
+	async me(event: H3Event): Promise<AuthUser | null> {
+		const raw = getCookie(event, SESSION_COOKIE_NAME);
+		if (!raw) {
+			return null;
+		}
+
+		let parsed: StoredSession;
+		try {
+			parsed = JSON.parse(raw) as StoredSession;
+		}
+		catch (err) {
+			getLogService().error("Failed to parse session cookie", toErrorContext(err));
+			deleteCookie(event, SESSION_COOKIE_NAME, sessionCookieOptions());
+			return null;
+		}
+
+		if (!parsed.userId) {
+			deleteCookie(event, SESSION_COOKIE_NAME, sessionCookieOptions());
+			return null;
+		}
+
+		try {
+			// session_id makes the customers app validate the session is still
+			// alive — a logged-out/revoked session answers 401 here.
+			const { user, contact } = await useRevenexxApi().post<{
+				user: { $id: string; name?: string; email: string };
+				contact: ApiContact | null;
+			}>("/v1/customers/auth/me", { user_id: parsed.userId, session_id: parsed.id });
+
+			return {
+				$id: user.$id,
+				name: contactName(contact, user.name ?? user.email),
+				email: user.email,
+				role: toAuthRole(contact?.role),
+			};
+		}
+		catch (err) {
+			if (!isApiUserError(err)) {
+				getLogService().error("API request failed: auth/me", apiErrorContext(err));
+			}
+			deleteCookie(event, SESSION_COOKIE_NAME, sessionCookieOptions());
+			return null;
+		}
+	}
+
+	async logout(event: H3Event): Promise<void> {
+		const raw = getCookie(event, SESSION_COOKIE_NAME);
+		if (raw) {
+			try {
+				const parsed = JSON.parse(raw) as StoredSession;
+				if (parsed.userId && parsed.id) {
+					await useRevenexxApi().post("/v1/customers/auth/logout", {
+						user_id: parsed.userId,
+						session_id: parsed.id,
+					});
+				}
+			}
+			catch (err) {
+				getLogService().error("API request failed: auth/logout", apiErrorContext(err));
+				// always clear the cookie regardless of API result
+			}
+		}
+		deleteCookie(event, SESSION_COOKIE_NAME, sessionCookieOptions());
+	}
+}

package/server/services/ApiCartService.ts

@@ -0,0 +1,254 @@
+import type { H3Event } from "h3";
+
+import type { CartItem } from "../../app/interfaces/cart-item";
+import type { StoredSession } from "../../app/interfaces/auth";
+import type { CartSummaryRow, ICartManager, ICartService } from "../interfaces/cart";
+
+/** Cart row of the carts app. */
+interface ApiCart {
+	id: string;
+	name: string;
+	status: string;
+	contact_id: string | null;
+	session_key: string | null;
+	currency: string;
+	is_current: boolean;
+	item_count: number;
+	subtotal: number | string;
+	updated_at: string;
+}
+
+/** Line item row of the carts app. */
+interface ApiCartLine {
+	id: string;
+	type: string;
+	product_id: string | null;
+	sku: string | null;
+	name: string;
+	quantity: number | string;
+	unit: string | null;
+	unit_price: number | string;
+	tax_rate: number | string;
+	snapshot: Record<string, unknown> | null;
+	configuration: Record<string, unknown> | null;
+	position: number;
+	metadata: Record<string, unknown> | null;
+}
+
+interface CartOwner {
+	contactId: string | null;
+	sessionKey: string;
+}
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const DEFAULT_CART_NAME = "Mein Warenkorb";
+
+/** The request's cart owner: the logged-in contact, else the guest session. */
+function resolveOwner(event: H3Event): CartOwner {
+	let contactId: string | null = null;
+	const raw = getCookie(event, SESSION_COOKIE_NAME);
+	if (raw) {
+		try {
+			const parsed = JSON.parse(raw) as StoredSession;
+			contactId = parsed.contactId ?? null;
+		}
+		catch { /* guest */ }
+	}
+	return { contactId, sessionKey: getOrCreateCartSessionId(event) };
+}
+
+function ownerQuery(owner: CartOwner): Record<string, string> {
+	return owner.contactId ? { contact_id: owner.contactId } : { session_key: owner.sessionKey };
+}
+
+/** Storefront CartItem → carts-app line. The snapshot is the loose product copy. */
+function toApiLine(item: CartItem, position: number): Record<string, unknown> {
+	return {
+		type: "product",
+		product_id: UUID.test(item.id) ? item.id : null,
+		sku: item.sku,
+		name: item.name,
+		quantity: item.quantity,
+		unit: item.unit ?? null,
+		unit_price: item.price,
+		tax_rate: item.taxRate ?? 0,
+		position,
+		snapshot: {
+			id: item.id,
+			image: item.image,
+			...(item.name2 !== undefined ? { name2: item.name2 } : {}),
+			...(item.priceTiers !== undefined ? { priceTiers: item.priceTiers } : {}),
+			...(item.maxOrderQuantity !== undefined ? { maxOrderQuantity: item.maxOrderQuantity } : {}),
+		},
+		metadata: {
+			...(item.lineKey !== undefined ? { lineKey: item.lineKey } : {}),
+			...(item.customSku !== undefined ? { customSku: item.customSku } : {}),
+			...(item.costCenterId !== undefined ? { costCenterId: item.costCenterId } : {}),
+			...(item.positionTexts !== undefined ? { positionTexts: item.positionTexts } : {}),
+			...(item.nonCatalog !== undefined ? { nonCatalog: item.nonCatalog } : {}),
+			...(item.requisitionId !== undefined ? { requisitionId: item.requisitionId } : {}),
+		},
+	};
+}
+
+/** carts-app line → storefront CartItem (snapshot/metadata restore the extras). */
+function toCartItem(line: ApiCartLine): CartItem {
+	// The snapshot/metadata blobs were written by toApiLine — restoring the
+	// original field types is safe by construction.
+	const snapshot = (line.snapshot ?? {}) as Partial<CartItem> & { id?: string; image?: string };
+	const metadata = (line.metadata ?? {}) as Partial<CartItem>;
+	return {
+		id: String(snapshot.id ?? line.product_id ?? line.sku ?? line.id),
+		name: line.name,
+		sku: line.sku ?? "",
+		image: String(snapshot.image ?? ""),
+		price: Number(line.unit_price),
+		quantity: Number(line.quantity),
+		...(line.unit ? { unit: line.unit } : {}),
+		taxRate: Number(line.tax_rate),
+		...(snapshot.name2 !== undefined ? { name2: snapshot.name2 } : {}),
+		...(snapshot.priceTiers !== undefined ? { priceTiers: snapshot.priceTiers } : {}),
+		...(snapshot.maxOrderQuantity !== undefined ? { maxOrderQuantity: snapshot.maxOrderQuantity } : {}),
+		...(metadata.lineKey !== undefined ? { lineKey: metadata.lineKey } : {}),
+		...(metadata.customSku !== undefined ? { customSku: metadata.customSku } : {}),
+		...(metadata.costCenterId !== undefined ? { costCenterId: metadata.costCenterId } : {}),
+		...(metadata.positionTexts !== undefined ? { positionTexts: metadata.positionTexts } : {}),
+		...(metadata.nonCatalog !== undefined ? { nonCatalog: metadata.nonCatalog } : {}),
+		...(metadata.requisitionId !== undefined ? { requisitionId: metadata.requisitionId } : {}),
+	};
+}
+
+function toSummary(cart: ApiCart): CartSummaryRow {
+	return {
+		id: cart.id,
+		name: cart.name,
+		itemCount: Number(cart.item_count),
+		positions: Number(cart.item_count), // distinct lines are not denormalized — itemCount is the honest figure
+		value: Number(cart.subtotal),
+		updatedAt: cart.updated_at,
+		active: cart.is_current,
+	};
+}
+
+/**
+ * Live carts via the public revenexx API (carts app). The active cart of
+ * the owner (guest session or logged-in contact) carries the storefront
+ * cart; any number of further named carts is managed server-side.
+ */
+export class ApiCartService implements ICartService, ICartManager {
+	private async listActive(owner: CartOwner): Promise<ApiCart[]> {
+		const { items } = await useRevenexxApi().get<{ items: ApiCart[] }>("/v1/carts", {
+			...ownerQuery(owner),
+			status: "active",
+			limit: 100,
+			order: "updated_at.desc",
+		});
+		return items;
+	}
+
+	private async ensureActiveCart(owner: CartOwner): Promise<ApiCart> {
+		const carts = await this.listActive(owner);
+		const current = carts.find(c => c.is_current) ?? carts[0];
+		if (current) {
+			return current;
+		}
+		return useRevenexxApi().post<ApiCart>("/v1/carts", {
+			name: DEFAULT_CART_NAME,
+			...(owner.contactId ? { contact_id: owner.contactId } : { session_key: owner.sessionKey }),
+			is_current: true,
+		});
+	}
+
+	// ---- ICartService (the active cart) --------------------------------
+
+	async getItems(event: H3Event): Promise<CartItem[]> {
+		const owner = resolveOwner(event);
+		const carts = await this.listActive(owner);
+		const current = carts.find(c => c.is_current) ?? carts[0];
+		if (!current) {
+			return [];
+		}
+		const { items } = await useRevenexxApi().get<{ items: ApiCartLine[] }>(`/v1/carts/${current.id}/items`);
+		return items.map(toCartItem);
+	}
+
+	async saveItems(event: H3Event, items: CartItem[]): Promise<void> {
+		const owner = resolveOwner(event);
+		const cart = await this.ensureActiveCart(owner);
+		await useRevenexxApi().request(`/v1/carts/${cart.id}/items`, {
+			method: "PUT",
+			body: { items: items.map((item, index) => toApiLine(item, index)) },
+		});
+	}
+
+	async clearItems(event: H3Event): Promise<void> {
+		await this.saveItems(event, []);
+	}
+
+	// ---- ICartManager (multi-cart) --------------------------------------
+
+	async listCarts(event: H3Event): Promise<{ carts: CartSummaryRow[]; activeCartId: string | null }> {
+		const owner = resolveOwner(event);
+		const carts = await this.listActive(owner);
+		const active = carts.find(c => c.is_current) ?? carts[0] ?? null;
+		return {
+			carts: carts.map(c => ({ ...toSummary(c), active: c.id === active?.id })),
+			activeCartId: active?.id ?? null,
+		};
+	}
+
+	async createCart(event: H3Event, name: string, activate: boolean): Promise<CartSummaryRow> {
+		const owner = resolveOwner(event);
+		const cart = await useRevenexxApi().post<ApiCart>("/v1/carts", {
+			name: name.trim() || DEFAULT_CART_NAME,
+			...(owner.contactId ? { contact_id: owner.contactId } : { session_key: owner.sessionKey }),
+			is_current: activate,
+		});
+		return { ...toSummary(cart), active: activate };
+	}
+
+	async renameCart(event: H3Event, id: string, name: string): Promise<void> {
+		await useRevenexxApi().put(`/v1/carts/${id}`, { name: name.trim() });
+	}
+
+	async deleteCart(event: H3Event, id: string): Promise<void> {
+		await useRevenexxApi().request(`/v1/carts/${id}`, { method: "DELETE" });
+	}
+
+	async activateCart(event: H3Event, id: string): Promise<CartItem[]> {
+		await useRevenexxApi().post(`/v1/carts/${id}/activate`, {});
+		const { items } = await useRevenexxApi().get<{ items: ApiCartLine[] }>(`/v1/carts/${id}/items`);
+		return items.map(toCartItem);
+	}
+
+	async addItemToCart(event: H3Event, id: string, item: CartItem): Promise<void> {
+		await useRevenexxApi().post(`/v1/carts/${id}/items`, toApiLine(item, 0));
+	}
+
+	async orderActiveCart(event: H3Event, orderRef: string): Promise<string | null> {
+		const owner = resolveOwner(event);
+		const carts = await this.listActive(owner);
+		const current = carts.find(c => c.is_current) ?? carts[0];
+		if (!current) {
+			return null;
+		}
+		await useRevenexxApi().post(`/v1/carts/${current.id}/order`, { order_ref: orderRef });
+		return current.id;
+	}
+
+	async claimSession(event: H3Event, contactId: string): Promise<void> {
+		const sessionKey = getCookie(event, "cover-cart-session");
+		if (!sessionKey) {
+			return;
+		}
+		// Merge into the customer's current cart when one exists — otherwise
+		// the session cart is adopted as the customer's cart.
+		const customerCarts = await this.listActive({ contactId, sessionKey: "" });
+		const target = customerCarts.find(c => c.is_current) ?? customerCarts[0];
+		await useRevenexxApi().post("/v1/carts/claim", {
+			session_key: sessionKey,
+			contact_id: contactId,
+			...(target ? { target_cart_id: target.id } : {}),
+		});
+	}
+}

package/server/services/ApiCategoryService.ts

@@ -0,0 +1,25 @@
+import type { ProductCategory } from "../../app/config/navigation";
+import type { ICategoryService } from "../interfaces/category";
+import type { Locale } from "../utils/locale";
+
+/**
+ * Live categories via the public revenexx API — the products app's category
+ * tree, flattened rows turned into the storefront's two-level navigation
+ * (see liveCatalog.ts for the tree building and caching).
+ */
+export class ApiCategoryService implements ICategoryService {
+	async listCategories(locale: Locale = "de"): Promise<ProductCategory[]> {
+		return getLiveCategories(locale);
+	}
+
+	async getCategoryBySlug(slug: string, locale: Locale = "de"): Promise<ProductCategory | null> {
+		const categories = await this.listCategories(locale);
+		const direct = categories.find(c => c.slug === slug);
+		if (direct) {
+			return direct;
+		}
+		// Subcategory slugs resolve to their parent so breadcrumbs still work.
+		const parent = categories.find(c => c.subcategories.some(s => s.slug === slug));
+		return parent ?? null;
+	}
+}