@unifiedcommerce/core 0.0.1

package/dist/auth/auth-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../../src/auth/auth-schema.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaf,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAclB,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBlB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUvB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOvB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAarB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBjB,CAAC"}

package/dist/auth/auth-schema.js

@@ -0,0 +1,117 @@
+import { pgTable, text, timestamp, boolean, integer, } from "drizzle-orm/pg-core";
+export const user = pgTable("user", {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").default(false).notNull(),
+    image: text("image"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .defaultNow()
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+    vendorId: text("vendor_id"),
+    posOperatorPin: text("pos_operator_pin"),
+});
+export const session = pgTable("session", {
+    id: text("id").primaryKey(),
+    expiresAt: timestamp("expires_at").notNull(),
+    token: text("token").notNull().unique(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    activeOrganizationId: text("active_organization_id"),
+});
+export const account = pgTable("account", {
+    id: text("id").primaryKey(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    password: text("password"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+});
+export const verification = pgTable("verification", {
+    id: text("id").primaryKey(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .defaultNow()
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+});
+export const organization = pgTable("organization", {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull().unique(),
+    logo: text("logo"),
+    createdAt: timestamp("created_at").notNull(),
+    metadata: text("metadata"),
+});
+export const member = pgTable("member", {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    role: text("role").default("member").notNull(),
+    createdAt: timestamp("created_at").notNull(),
+});
+export const invitation = pgTable("invitation", {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    email: text("email").notNull(),
+    role: text("role"),
+    status: text("status").default("pending").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    inviterId: text("inviter_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+});
+export const apikey = pgTable("apikey", {
+    id: text("id").primaryKey(),
+    configId: text("config_id").default("default").notNull(),
+    name: text("name"),
+    start: text("start"),
+    referenceId: text("reference_id").notNull(),
+    prefix: text("prefix"),
+    key: text("key").notNull(),
+    refillInterval: integer("refill_interval"),
+    refillAmount: integer("refill_amount"),
+    lastRefillAt: timestamp("last_refill_at"),
+    enabled: boolean("enabled").default(true),
+    rateLimitEnabled: boolean("rate_limit_enabled").default(true),
+    rateLimitTimeWindow: integer("rate_limit_time_window").default(86400000),
+    rateLimitMax: integer("rate_limit_max").default(10),
+    requestCount: integer("request_count").default(0),
+    remaining: integer("remaining"),
+    lastRequest: timestamp("last_request"),
+    expiresAt: timestamp("expires_at"),
+    createdAt: timestamp("created_at").notNull(),
+    updatedAt: timestamp("updated_at").notNull(),
+    permissions: text("permissions"),
+    metadata: text("metadata"),
+});

package/dist/auth/middleware.d.ts

@@ -0,0 +1,5 @@
+import type { MiddlewareHandler } from "hono";
+import type { CommerceConfig } from "../config/types";
+import type { AuthInstance } from "./setup";
+export declare function authMiddleware(auth: AuthInstance, config: CommerceConfig): MiddlewareHandler;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA0B5C,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAiFnB"}

package/dist/auth/middleware.js

@@ -0,0 +1,91 @@
+import { timingSafeEqual } from "node:crypto";
+import { DEFAULT_ORG_ID } from "./org";
+function resolvePermissions(session, config) {
+    const role = session.session.activeOrganizationRole;
+    if (!role) {
+        return (config.auth?.customerPermissions ?? [
+            "catalog:read",
+            "cart:create",
+            "cart:read",
+            "cart:update",
+            "orders:create",
+            "orders:read:own",
+            "customers:read:self",
+            "customers:update:self",
+        ]);
+    }
+    const roleConfig = config.auth?.roles?.[role];
+    return roleConfig ? roleConfig.permissions : [];
+}
+export function authMiddleware(auth, config) {
+    return async (c, next) => {
+        const session = (await auth.api.getSession({
+            headers: c.req.raw.headers,
+        }));
+        if (session) {
+            c.set("actor", {
+                type: "user",
+                userId: session.user.id,
+                email: session.user.email ?? null,
+                name: session.user.name ?? "User",
+                vendorId: session.user.vendorId ?? null,
+                organizationId: session.session.activeOrganizationId ?? null,
+                role: session.session.activeOrganizationRole ?? "customer",
+                permissions: resolvePermissions(session, config),
+            });
+            await next();
+            return;
+        }
+        // Extract API key from headers
+        const apiKeyHeader = c.req.header("x-api-key") ??
+            c.req.header("authorization")?.replace("Bearer ", "");
+        if (apiKeyHeader &&
+            config.auth?.apiKeys?.enabled &&
+            auth.api.verifyApiKey) {
+            try {
+                const keyResult = await auth.api.verifyApiKey({ key: apiKeyHeader });
+                if (keyResult) {
+                    c.set("actor", {
+                        type: "api_key",
+                        userId: keyResult.userId,
+                        email: null,
+                        name: keyResult.name ?? "API Key",
+                        vendorId: null,
+                        organizationId: keyResult.organizationId ?? DEFAULT_ORG_ID,
+                        role: "api_key",
+                        permissions: keyResult.permissions ??
+                            config.auth?.apiKeys?.defaultPermissions ??
+                            [],
+                    });
+                    await next();
+                    return;
+                }
+            }
+            catch {
+                // ignore invalid key
+            }
+        }
+        // Config-driven dev key (OFF by default, must be explicitly enabled)
+        if (!c.get("actor") &&
+            apiKeyHeader &&
+            config.auth?.enableDevKey &&
+            config.auth.devKey &&
+            apiKeyHeader.length === config.auth.devKey.length &&
+            timingSafeEqual(Buffer.from(apiKeyHeader), Buffer.from(config.auth.devKey))) {
+            c.set("actor", {
+                type: "api_key",
+                userId: "dev-staff",
+                email: "dev@local",
+                name: "Dev Admin (dev key)",
+                vendorId: null,
+                organizationId: DEFAULT_ORG_ID,
+                role: "owner",
+                permissions: ["*:*"],
+            });
+        }
+        if (!c.get("actor")) {
+            c.set("actor", null);
+        }
+        await next();
+    };
+}

package/dist/auth/org.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Deterministic ID for the default organization.
+ * Auto-created on kernel boot / test setup for single-tenant deployments.
+ */
+export declare const DEFAULT_ORG_ID = "org_default";
+/**
+ * Extracts the organization ID from an actor.
+ * Falls back to the default org when the actor is null or has no org set.
+ */
+export declare function resolveOrgId(actor: unknown): string;
+/**
+ * Ensures the default organization row exists in the database.
+ * Idempotent — safe to call multiple times (no-ops if the row exists).
+ *
+ * Uses OrganizationService which creates both the org row and
+ * (when auth is available) a member record for the creator.
+ *
+ * Accepts `unknown` so callers never need casts — the function
+ * handles the Drizzle type narrowing internally.
+ */
+export declare function ensureDefaultOrg(db: unknown, storeName?: string): Promise<void>;
+//# sourceMappingURL=org.d.ts.map

package/dist/auth/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../src/auth/org.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMnD;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,OAAO,EACX,SAAS,SAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/auth/org.js

@@ -0,0 +1,36 @@
+import { OrganizationService } from "../modules/organization/service";
+/**
+ * Deterministic ID for the default organization.
+ * Auto-created on kernel boot / test setup for single-tenant deployments.
+ */
+export const DEFAULT_ORG_ID = "org_default";
+/**
+ * Extracts the organization ID from an actor.
+ * Falls back to the default org when the actor is null or has no org set.
+ */
+export function resolveOrgId(actor) {
+    if (actor != null && typeof actor === "object" && "organizationId" in actor) {
+        const orgId = actor.organizationId;
+        if (typeof orgId === "string")
+            return orgId;
+    }
+    return DEFAULT_ORG_ID;
+}
+/**
+ * Ensures the default organization row exists in the database.
+ * Idempotent — safe to call multiple times (no-ops if the row exists).
+ *
+ * Uses OrganizationService which creates both the org row and
+ * (when auth is available) a member record for the creator.
+ *
+ * Accepts `unknown` so callers never need casts — the function
+ * handles the Drizzle type narrowing internally.
+ */
+export async function ensureDefaultOrg(db, storeName = "Default Store") {
+    const orgService = new OrganizationService(db);
+    await orgService.create({
+        id: DEFAULT_ORG_ID,
+        name: storeName,
+        slug: "default",
+    });
+}

package/dist/auth/permissions.d.ts

@@ -0,0 +1,4 @@
+import type { Actor } from "./types";
+export declare function assertPermission(actor: Actor | null, required: string): void;
+export declare function assertOwnership(actor: Actor | null, resourceOwnerId: string | null): void;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/auth/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAc5E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAQzF"}

package/dist/auth/permissions.js

@@ -0,0 +1,24 @@
+import { CommerceForbiddenError } from "../kernel/errors";
+export function assertPermission(actor, required) {
+    if (!actor) {
+        throw new CommerceForbiddenError("Authentication required.");
+    }
+    if (actor.permissions.includes("*:*"))
+        return;
+    const [resource] = required.split(":");
+    if (resource && actor.permissions.includes(`${resource}:*`))
+        return;
+    if (actor.permissions.includes(required))
+        return;
+    throw new CommerceForbiddenError(`Permission "${required}" is required. Your role "${actor.role}" does not include this permission.`);
+}
+export function assertOwnership(actor, resourceOwnerId) {
+    if (!actor) {
+        throw new CommerceForbiddenError("Authentication required.");
+    }
+    if (actor.permissions.includes("*:*"))
+        return;
+    if (actor.userId !== resourceOwnerId) {
+        throw new CommerceForbiddenError("You do not have access to this resource.");
+    }
+}

package/dist/auth/pos.d.ts

@@ -0,0 +1,3 @@
+import { Hono } from "hono";
+export declare function createPOSAuthRoutes(auth: any, kernel: any): Hono<any, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=pos.d.ts.map

package/dist/auth/pos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pos.d.ts","sourceRoot":"","sources":["../../src/auth/pos.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,oDA6EzD"}

package/dist/auth/pos.js

@@ -0,0 +1,62 @@
+import { createHash } from "node:crypto";
+import { Hono } from "hono";
+import { CommerceForbiddenError, CommerceValidationError } from "../kernel/errors";
+function hashPin(pin) {
+    return createHash("sha256").update(pin).digest("hex");
+}
+export function createPOSAuthRoutes(auth, kernel) {
+    const router = new Hono();
+    router.post("/pin", async (c) => {
+        try {
+            const { pin, terminalId } = await c.req.json();
+            if (!pin || !terminalId) {
+                throw new CommerceValidationError("PIN and terminal ID are required.");
+            }
+            const operator = await kernel.services.customers.findPOSOperatorByPin(hashPin(pin));
+            if (!operator) {
+                throw new CommerceForbiddenError("Invalid credentials.");
+            }
+            const session = await auth.api.createSession({
+                userId: operator.id,
+                expiresIn: 60 * 60 * 8,
+            });
+            return c.json({
+                data: {
+                    session: {
+                        token: session.token,
+                        expiresAt: session.expiresAt,
+                    },
+                    operator: {
+                        id: operator.id,
+                        name: operator.name,
+                        role: "pos_operator",
+                    },
+                    terminalId,
+                },
+            });
+        }
+        catch (error) {
+            if (error instanceof CommerceValidationError) {
+                return c.json({ error: { code: error.code, message: error.message } }, 422);
+            }
+            if (error instanceof CommerceForbiddenError) {
+                return c.json({ error: { code: error.code, message: error.message } }, 401);
+            }
+            return c.json({ error: { code: "INTERNAL_ERROR", message: "POS auth failed." } }, 500);
+        }
+    });
+    router.post("/clock-out", async (c) => {
+        const actor = c.get("actor");
+        if (!actor) {
+            return c.json({
+                error: { code: "FORBIDDEN", message: "Not authenticated." },
+            }, 401);
+        }
+        const token = c.req.header("authorization")?.replace("Bearer ", "");
+        if (token) {
+            await auth.api.revokeSession({ token });
+        }
+        return c.json({ data: { clockedOut: true } });
+    });
+    return router;
+}

package/dist/auth/setup.d.ts

@@ -0,0 +1,31 @@
+import type { CommerceConfig } from "../config/types";
+import type { DatabaseAdapter } from "../kernel/database/adapter";
+export interface AuthInstance {
+    handler(request: Request): Promise<Response>;
+    api: {
+        getSession(input: {
+            headers: Headers;
+        }): Promise<unknown>;
+        verifyApiKey?: (input: {
+            key: string;
+        }) => Promise<{
+            userId: string;
+            name?: string | null;
+            permissions?: string[];
+        } | null>;
+        createApiKey?: (input: {
+            userId: string;
+            name?: string;
+            permissions?: string[];
+        }) => Promise<{
+            key: string;
+            id: string;
+        }>;
+        /** Allow access to other Better Auth API methods added by plugins */
+        [key: string]: unknown;
+    };
+    options?: Record<string, unknown>;
+    $context?: Promise<unknown>;
+}
+export declare function createAuth(db: DatabaseAdapter, config: CommerceConfig): AuthInstance;
+//# sourceMappingURL=setup.d.ts.map

package/dist/auth/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/auth/setup.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAgClE,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,EAAE;QACH,UAAU,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1D,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC;YACjD,MAAM,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;SACxB,GAAG,IAAI,CAAC,CAAC;QACV,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;YACrB,MAAM,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;SACxB,KAAK,OAAO,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC3C,qEAAqE;QACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7B;AAED,wBAAgB,UAAU,CACxB,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,cAAc,GACrB,YAAY,CAiGd"}

package/dist/auth/setup.js

@@ -0,0 +1,106 @@
+import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+import { betterAuth } from "better-auth";
+import { apiKey } from "@better-auth/api-key";
+import { organization, twoFactor, phoneNumber } from "better-auth/plugins";
+import * as authSchema from "./auth-schema";
+function resolveAuthDbProvider(provider) {
+    if (provider === "postgres" ||
+        provider === "postgresql" ||
+        provider === "pg") {
+        return "pg";
+    }
+    if (provider === "mysql") {
+        return "mysql";
+    }
+    if (provider === "sqlite") {
+        return "sqlite";
+    }
+    throw new Error(`Unsupported auth database provider "${provider}". Expected one of: postgres, mysql, sqlite.`);
+}
+export function createAuth(db, config) {
+    const plugins = [
+        organization({
+            roles: (config.auth?.roles ?? {}),
+        }),
+    ];
+    if (config.auth?.twoFactor?.enabled) {
+        plugins.push(twoFactor({ issuer: config.storeName ?? "UnifiedCommerce" }));
+    }
+    if (config.auth?.apiKeys?.enabled) {
+        plugins.push(apiKey());
+    }
+    if (config.auth?.phoneAuth) {
+        plugins.push(phoneNumber({
+            sendOTP: config.auth.phoneAuth.sendOTP,
+            verifyOTP: config.auth.phoneAuth.verifyOTP,
+            otpLength: config.auth.phoneAuth.otpLength ?? 6,
+            expiresIn: config.auth.phoneAuth.expiresIn ?? 300,
+            signUpOnVerification: config.auth.phoneAuth.signUpOnVerification ?? {
+                getTempEmail: (phone) => `${phone.replace(/\+/g, "")}@phone.local`,
+            },
+        }));
+    }
+    // API key support can be attached via external plugin package in newer better-auth versions.
+    try {
+        const auth = betterAuth({
+            database: drizzleAdapter(db.db, {
+                provider: resolveAuthDbProvider(db.provider),
+                schema: authSchema,
+            }),
+            trustedOrigins: config.auth?.trustedOrigins ?? [],
+            emailAndPassword: {
+                enabled: true,
+                requireEmailVerification: config.auth?.requireEmailVerification ?? true,
+                sendResetPassword: async ({ user, url }) => {
+                    if (!config.email)
+                        return;
+                    await config.email.send({
+                        template: "password-reset",
+                        to: user.email,
+                        data: { resetUrl: url, userName: user.name },
+                    });
+                },
+                sendVerificationEmail: async ({ user, url }) => {
+                    if (!config.email)
+                        return;
+                    await config.email.send({
+                        template: "email-verification",
+                        to: user.email,
+                        data: { verifyUrl: url, userName: user.name },
+                    });
+                },
+            },
+            socialProviders: config.auth?.socialProviders ?? {},
+            session: {
+                expiresIn: config.auth?.sessionDuration ?? 60 * 60 * 24 * 7,
+                updateAge: 60 * 60 * 24,
+                cookieCache: {
+                    enabled: true,
+                    maxAge: 60 * 5, // 5 minute cookie cache for performance
+                },
+            },
+            advanced: {
+                cookiePrefix: "uc",
+                useSecureCookies: process.env.NODE_ENV === "production",
+            },
+            plugins,
+            user: {
+                additionalFields: {
+                    vendorId: { type: "string", required: false },
+                    posOperatorPin: { type: "string", required: false },
+                },
+            },
+        });
+        // Better Auth's plugin-extended return type doesn't structurally overlap
+        // with our simplified AuthInstance interface (e.g., verifyApiKey expects
+        // { body: { key } } internally but we expose { key } for ergonomics).
+        // The double-cast is intentional and unavoidable without forking the types.
+        return auth;
+    }
+    catch (error) {
+        const message = error instanceof Error
+            ? error.message
+            : "Unknown better-auth initialization error.";
+        throw new Error(`Failed to initialize authentication: ${message}`);
+    }
+}

package/dist/auth/system-actor.d.ts

@@ -0,0 +1,7 @@
+import type { Actor } from "./types";
+/**
+ * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
+ * System actors have full permissions and are scoped to a specific organization.
+ */
+export declare function createSystemActor(orgId?: string): Actor;
+//# sourceMappingURL=system-actor.d.ts.map

package/dist/auth/system-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-actor.d.ts","sourceRoot":"","sources":["../../src/auth/system-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAGrC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,MAAuB,GAAG,KAAK,CAWvE"}

package/dist/auth/system-actor.js

@@ -0,0 +1,17 @@
+import { DEFAULT_ORG_ID } from "./org";
+/**
+ * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
+ * System actors have full permissions and are scoped to a specific organization.
+ */
+export function createSystemActor(orgId = DEFAULT_ORG_ID) {
+    return {
+        type: "api_key",
+        userId: "system:internal",
+        email: null,
+        name: "System",
+        vendorId: null,
+        organizationId: orgId,
+        role: "system",
+        permissions: ["*:*"],
+    };
+}

package/dist/auth/types.d.ts

@@ -0,0 +1,11 @@
+export interface Actor {
+    type: "user" | "api_key";
+    userId: string;
+    email: string | null;
+    name: string;
+    vendorId: string | null;
+    organizationId: string | null;
+    role: string;
+    permissions: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB"}

package/dist/auth/types.js

@@ -0,0 +1 @@
+export {};

package/dist/config/defaults.d.ts

@@ -0,0 +1,3 @@
+import type { CommerceConfig } from "./types";
+export declare const defaultConfig: Partial<CommerceConfig>;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/config/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,cAAc,CA+EjD,CAAC"}