@unifiedcommerce/core 0.4.3 → 0.4.4

package/dist/auth/auth-schema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../../src/auth/auth-schema.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaf,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAclB,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBlB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUvB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOvB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAarB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBjB,CAAC;AAEH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMf,CAAC"}

package/dist/auth/auth-schema.js

@@ -1,124 +0,0 @@
-import { pgTable, text, timestamp, boolean, integer, } from "drizzle-orm/pg-core";
-export const user = pgTable("user", {
-    id: text("id").primaryKey(),
-    name: text("name").notNull(),
-    email: text("email").notNull().unique(),
-    emailVerified: boolean("email_verified").default(false).notNull(),
-    image: text("image"),
-    createdAt: timestamp("created_at").defaultNow().notNull(),
-    updatedAt: timestamp("updated_at")
-        .defaultNow()
-        .$onUpdate(() => /* @__PURE__ */ new Date())
-        .notNull(),
-    vendorId: text("vendor_id"),
-    posOperatorPin: text("pos_operator_pin"),
-});
-export const session = pgTable("session", {
-    id: text("id").primaryKey(),
-    expiresAt: timestamp("expires_at").notNull(),
-    token: text("token").notNull().unique(),
-    createdAt: timestamp("created_at").defaultNow().notNull(),
-    updatedAt: timestamp("updated_at")
-        .$onUpdate(() => /* @__PURE__ */ new Date())
-        .notNull(),
-    ipAddress: text("ip_address"),
-    userAgent: text("user_agent"),
-    userId: text("user_id")
-        .notNull()
-        .references(() => user.id, { onDelete: "cascade" }),
-    activeOrganizationId: text("active_organization_id"),
-});
-export const account = pgTable("account", {
-    id: text("id").primaryKey(),
-    accountId: text("account_id").notNull(),
-    providerId: text("provider_id").notNull(),
-    userId: text("user_id")
-        .notNull()
-        .references(() => user.id, { onDelete: "cascade" }),
-    accessToken: text("access_token"),
-    refreshToken: text("refresh_token"),
-    idToken: text("id_token"),
-    accessTokenExpiresAt: timestamp("access_token_expires_at"),
-    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
-    scope: text("scope"),
-    password: text("password"),
-    createdAt: timestamp("created_at").defaultNow().notNull(),
-    updatedAt: timestamp("updated_at")
-        .$onUpdate(() => /* @__PURE__ */ new Date())
-        .notNull(),
-});
-export const verification = pgTable("verification", {
-    id: text("id").primaryKey(),
-    identifier: text("identifier").notNull(),
-    value: text("value").notNull(),
-    expiresAt: timestamp("expires_at").notNull(),
-    createdAt: timestamp("created_at").defaultNow().notNull(),
-    updatedAt: timestamp("updated_at")
-        .defaultNow()
-        .$onUpdate(() => /* @__PURE__ */ new Date())
-        .notNull(),
-});
-export const organization = pgTable("organization", {
-    id: text("id").primaryKey(),
-    name: text("name").notNull(),
-    slug: text("slug").notNull().unique(),
-    logo: text("logo"),
-    createdAt: timestamp("created_at").notNull(),
-    metadata: text("metadata"),
-});
-export const member = pgTable("member", {
-    id: text("id").primaryKey(),
-    organizationId: text("organization_id")
-        .notNull()
-        .references(() => organization.id, { onDelete: "cascade" }),
-    userId: text("user_id")
-        .notNull()
-        .references(() => user.id, { onDelete: "cascade" }),
-    role: text("role").default("member").notNull(),
-    createdAt: timestamp("created_at").notNull(),
-});
-export const invitation = pgTable("invitation", {
-    id: text("id").primaryKey(),
-    organizationId: text("organization_id")
-        .notNull()
-        .references(() => organization.id, { onDelete: "cascade" }),
-    email: text("email").notNull(),
-    role: text("role"),
-    status: text("status").default("pending").notNull(),
-    expiresAt: timestamp("expires_at").notNull(),
-    createdAt: timestamp("created_at").defaultNow().notNull(),
-    inviterId: text("inviter_id")
-        .notNull()
-        .references(() => user.id, { onDelete: "cascade" }),
-});
-export const apikey = pgTable("apikey", {
-    id: text("id").primaryKey(),
-    configId: text("config_id").default("default").notNull(),
-    name: text("name"),
-    start: text("start"),
-    referenceId: text("reference_id").notNull(),
-    prefix: text("prefix"),
-    key: text("key").notNull(),
-    refillInterval: integer("refill_interval"),
-    refillAmount: integer("refill_amount"),
-    lastRefillAt: timestamp("last_refill_at"),
-    enabled: boolean("enabled").default(true),
-    rateLimitEnabled: boolean("rate_limit_enabled").default(false),
-    rateLimitTimeWindow: integer("rate_limit_time_window").default(3600000),
-    rateLimitMax: integer("rate_limit_max").default(10000),
-    requestCount: integer("request_count").default(0),
-    remaining: integer("remaining"),
-    lastRequest: timestamp("last_request"),
-    expiresAt: timestamp("expires_at"),
-    createdAt: timestamp("created_at").notNull(),
-    updatedAt: timestamp("updated_at").notNull(),
-    permissions: text("permissions"),
-    metadata: text("metadata"),
-});
-export const jwks = pgTable("jwks", {
-    id: text("id").primaryKey(),
-    publicKey: text("public_key").notNull(),
-    privateKey: text("private_key").notNull(),
-    createdAt: timestamp("created_at").notNull(),
-    expiresAt: timestamp("expires_at"),
-});

package/dist/auth/middleware.d.ts

@@ -1,5 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import type { CommerceConfig } from "../config/types.js";
-import type { AuthInstance } from "./setup.js";
-export declare function authMiddleware(auth: AuthInstance, config: CommerceConfig): MiddlewareHandler;
-//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA0B/C,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAsInB"}

package/dist/auth/middleware.js

@@ -1,141 +0,0 @@
-import { DEFAULT_ORG_ID } from "./org.js";
-function resolvePermissions(session, config) {
-    const role = session.session.activeOrganizationRole;
-    if (!role) {
-        return (config.auth?.customerPermissions ?? [
-            "catalog:read",
-            "cart:create",
-            "cart:read",
-            "cart:update",
-            "orders:create",
-            "orders:read:own",
-            "customers:read:self",
-            "customers:update:self",
-        ]);
-    }
-    const roleConfig = config.auth?.roles?.[role];
-    return roleConfig ? roleConfig.permissions : [];
-}
-export function authMiddleware(auth, config) {
-    return async (c, next) => {
-        const session = (await auth.api.getSession({
-            headers: c.req.raw.headers,
-        }));
-        if (session) {
-            // Better Auth's session stores activeOrganizationId, but often not the role.
-            // For single-store apps (org_default), users may never call set-active,
-            // so activeOrganizationId can be null even for valid org members.
-            let role = session.session.activeOrganizationRole;
-            let orgId = session.session.activeOrganizationId;
-            // If no active org, try to resolve the user's membership in org_default.
-            // This handles the common case where the user is a member but hasn't
-            // called organization/set-active (single-store apps, seed scripts, tests).
-            if (!role && auth.api.getFullOrganization) {
-                try {
-                    const org = await auth.api.getFullOrganization({
-                        query: { organizationId: orgId ?? DEFAULT_ORG_ID },
-                        headers: c.req.raw.headers,
-                    });
-                    if (org?.members) {
-                        const membership = org.members.find((m) => m.userId === session.user.id);
-                        if (membership) {
-                            role = membership.role;
-                            orgId = orgId ?? DEFAULT_ORG_ID;
-                        }
-                    }
-                }
-                catch {
-                    // fall through — treat as customer
-                }
-            }
-            // Also try getActiveMemberRole if active org is set
-            if (!role && orgId && auth.api.getActiveMemberRole) {
-                try {
-                    const roleResult = await auth.api.getActiveMemberRole({
-                        headers: c.req.raw.headers,
-                    });
-                    role = roleResult?.role;
-                }
-                catch {
-                    // fall through — treat as customer
-                }
-            }
-            const enrichedSession = {
-                ...session,
-                session: { ...session.session, activeOrganizationRole: role ?? null },
-            };
-            c.set("actor", {
-                type: "user",
-                userId: session.user.id,
-                email: session.user.email ?? null,
-                name: session.user.name ?? "User",
-                vendorId: session.user.vendorId ?? null,
-                organizationId: orgId ?? DEFAULT_ORG_ID,
-                role: role ?? "customer",
-                permissions: resolvePermissions(enrichedSession, config),
-            });
-            await next();
-            return;
-        }
-        // Extract API key from headers
-        const apiKeyHeader = c.req.header("x-api-key") ??
-            c.req.header("authorization")?.replace("Bearer ", "");
-        if (apiKeyHeader &&
-            config.auth?.apiKeys?.enabled &&
-            auth.api.verifyApiKey) {
-            try {
-                // Better Auth server-side calls require { body: { ... } } wrapper.
-                // Returns { valid, error, key: Omit<ApiKey,"key"> | null }.
-                // See: https://better-auth.com/docs/plugins/api-key/reference
-                const result = await auth.api.verifyApiKey({
-                    body: { key: apiKeyHeader },
-                });
-                if (result?.valid && result.key) {
-                    const apiKey = result.key;
-                    // v1.5+ renamed userId → referenceId on the apikey table.
-                    const userId = (apiKey.referenceId ?? "");
-                    const name = (apiKey.name ?? "API Key");
-                    const orgId = (apiKey.organizationId ?? DEFAULT_ORG_ID);
-                    // Better Auth stores permissions as Record<string, string[]>
-                    // (e.g. {"catalog":["read","create"]}).  Flatten to the
-                    // "resource:action" string[] format the engine expects.
-                    let permissions;
-                    const rawPerms = apiKey.permissions;
-                    if (Array.isArray(rawPerms)) {
-                        permissions = rawPerms;
-                    }
-                    else if (rawPerms && typeof rawPerms === "object") {
-                        permissions = [];
-                        for (const [resource, actions] of Object.entries(rawPerms)) {
-                            for (const action of actions) {
-                                permissions.push(`${resource}:${action}`);
-                            }
-                        }
-                    }
-                    else {
-                        permissions = config.auth?.apiKeys?.defaultPermissions ?? [];
-                    }
-                    c.set("actor", {
-                        type: "api_key",
-                        userId,
-                        email: null,
-                        name,
-                        vendorId: null,
-                        organizationId: orgId,
-                        role: "api_key",
-                        permissions,
-                    });
-                    await next();
-                    return;
-                }
-            }
-            catch {
-                // invalid, expired, or rate-limited key — fall through
-            }
-        }
-        if (!c.get("actor")) {
-            c.set("actor", null);
-        }
-        await next();
-    };
-}

package/dist/auth/org.d.ts

@@ -1,22 +0,0 @@
-/**
- * Deterministic ID for the default organization.
- * Auto-created on kernel boot / test setup for single-tenant deployments.
- */
-export declare const DEFAULT_ORG_ID = "org_default";
-/**
- * Extracts the organization ID from an actor.
- * Falls back to the default org when the actor is null or has no org set.
- */
-export declare function resolveOrgId(actor: unknown): string;
-/**
- * Ensures the default organization row exists in the database.
- * Idempotent — safe to call multiple times (no-ops if the row exists).
- *
- * Uses OrganizationService which creates both the org row and
- * (when auth is available) a member record for the creator.
- *
- * Accepts `unknown` so callers never need casts — the function
- * handles the Drizzle type narrowing internally.
- */
-export declare function ensureDefaultOrg(db: unknown, storeName?: string): Promise<void>;
-//# sourceMappingURL=org.d.ts.map

package/dist/auth/org.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../src/auth/org.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMnD;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,OAAO,EACX,SAAS,SAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/auth/org.js

@@ -1,36 +0,0 @@
-import { OrganizationService } from "../modules/organization/service.js";
-/**
- * Deterministic ID for the default organization.
- * Auto-created on kernel boot / test setup for single-tenant deployments.
- */
-export const DEFAULT_ORG_ID = "org_default";
-/**
- * Extracts the organization ID from an actor.
- * Falls back to the default org when the actor is null or has no org set.
- */
-export function resolveOrgId(actor) {
-    if (actor != null && typeof actor === "object" && "organizationId" in actor) {
-        const orgId = actor.organizationId;
-        if (typeof orgId === "string")
-            return orgId;
-    }
-    return DEFAULT_ORG_ID;
-}
-/**
- * Ensures the default organization row exists in the database.
- * Idempotent — safe to call multiple times (no-ops if the row exists).
- *
- * Uses OrganizationService which creates both the org row and
- * (when auth is available) a member record for the creator.
- *
- * Accepts `unknown` so callers never need casts — the function
- * handles the Drizzle type narrowing internally.
- */
-export async function ensureDefaultOrg(db, storeName = "Default Store") {
-    const orgService = new OrganizationService(db);
-    await orgService.create({
-        id: DEFAULT_ORG_ID,
-        name: storeName,
-        slug: "default",
-    });
-}

package/dist/auth/permissions.d.ts

@@ -1,4 +0,0 @@
-import type { Actor } from "./types.js";
-export declare function assertPermission(actor: Actor | null, required: string): void;
-export declare function assertOwnership(actor: Actor | null, resourceOwnerId: string | null): void;
-//# sourceMappingURL=permissions.d.ts.map

package/dist/auth/permissions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAc5E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAQzF"}

package/dist/auth/permissions.js

@@ -1,24 +0,0 @@
-import { CommerceForbiddenError } from "../kernel/errors.js";
-export function assertPermission(actor, required) {
-    if (!actor) {
-        throw new CommerceForbiddenError("Authentication required.");
-    }
-    if (actor.permissions.includes("*:*"))
-        return;
-    const [resource] = required.split(":");
-    if (resource && actor.permissions.includes(`${resource}:*`))
-        return;
-    if (actor.permissions.includes(required))
-        return;
-    throw new CommerceForbiddenError(`Permission "${required}" is required. Your role "${actor.role}" does not include this permission.`);
-}
-export function assertOwnership(actor, resourceOwnerId) {
-    if (!actor) {
-        throw new CommerceForbiddenError("Authentication required.");
-    }
-    if (actor.permissions.includes("*:*"))
-        return;
-    if (actor.userId !== resourceOwnerId) {
-        throw new CommerceForbiddenError("You do not have access to this resource.");
-    }
-}

package/dist/auth/setup.d.ts

@@ -1,29 +0,0 @@
-import { betterAuth } from "better-auth";
-import { apiKey } from "@better-auth/api-key";
-import { organization, twoFactor, phoneNumber, jwt, bearer } from "better-auth/plugins";
-import type { CommerceConfig } from "../config/types.js";
-import type { DatabaseAdapter } from "../kernel/database/adapter.js";
-/**
- * The auth type is inferred from `typeof betterAuth(...)` with all plugins enabled.
- * This gives us the full API surface without manual interface maintenance.
- *
- * We use a type-level-only reference (never executed) to capture the complete type.
- */
-type FullBetterAuth = ReturnType<typeof betterAuth<{
-    plugins: [
-        ReturnType<typeof organization>,
-        ReturnType<typeof bearer>,
-        ReturnType<typeof jwt>,
-        ReturnType<typeof twoFactor>,
-        ReturnType<typeof apiKey>,
-        ReturnType<typeof phoneNumber>
-    ];
-}>>;
-/**
- * AuthInstance — inferred from Better Auth with all plugins.
- * No manual type maintenance needed.
- */
-export type AuthInstance = FullBetterAuth;
-export declare function createAuth(db: DatabaseAdapter, config: CommerceConfig): AuthInstance;
-export {};
-//# sourceMappingURL=setup.d.ts.map

package/dist/auth/setup.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/auth/setup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAiBrE;;;;;GAKG;AACH,KAAK,cAAc,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC;IACjD,OAAO,EAAE;QACP,UAAU,CAAC,OAAO,YAAY,CAAC;QAC/B,UAAU,CAAC,OAAO,MAAM,CAAC;QACzB,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,OAAO,SAAS,CAAC;QAC5B,UAAU,CAAC,OAAO,MAAM,CAAC;QACzB,UAAU,CAAC,OAAO,WAAW,CAAC;KAC/B,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC;AAE1C,wBAAgB,UAAU,CACxB,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,cAAc,GACrB,YAAY,CA+Gd"}

package/dist/auth/setup.js

@@ -1,117 +0,0 @@
-import { drizzleAdapter } from "@better-auth/drizzle-adapter";
-import { betterAuth } from "better-auth";
-import { apiKey } from "@better-auth/api-key";
-import { organization, twoFactor, phoneNumber, jwt, bearer } from "better-auth/plugins";
-import * as authSchema from "./auth-schema.js";
-function resolveAuthDbProvider(provider) {
-    if (provider === "postgres" || provider === "postgresql" || provider === "pg")
-        return "pg";
-    if (provider === "mysql")
-        return "mysql";
-    if (provider === "sqlite")
-        return "sqlite";
-    throw new Error(`Unsupported auth database provider "${provider}".`);
-}
-export function createAuth(db, config) {
-    const plugins = [
-        organization({
-            roles: (config.auth?.roles ?? {}),
-        }),
-        bearer(),
-        jwt(),
-    ];
-    if (config.auth?.twoFactor?.enabled) {
-        plugins.push(twoFactor({ issuer: config.storeName ?? "UnifiedCommerce" }));
-    }
-    const scopes = config.auth?.apiKeyScopes;
-    if (scopes && Object.keys(scopes).length > 0) {
-        const apiKeyConfigs = Object.entries(scopes).map(([scopeId, scope]) => ({
-            configId: scopeId,
-            defaultPrefix: scope.prefix,
-            ...(scope.rateLimit
-                ? {
-                    rateLimit: {
-                        enabled: true,
-                        maxRequests: scope.rateLimit.maxRequests,
-                        timeWindow: scope.rateLimit.timeWindow,
-                    },
-                }
-                : {}),
-        }));
-        plugins.push(apiKey(apiKeyConfigs));
-    }
-    else if (config.auth?.apiKeys?.enabled) {
-        plugins.push(apiKey());
-    }
-    if (config.auth?.phoneAuth) {
-        plugins.push(phoneNumber({
-            sendOTP: config.auth.phoneAuth.sendOTP,
-            verifyOTP: config.auth.phoneAuth.verifyOTP,
-            otpLength: config.auth.phoneAuth.otpLength ?? 6,
-            expiresIn: config.auth.phoneAuth.expiresIn ?? 300,
-            signUpOnVerification: config.auth.phoneAuth.signUpOnVerification ?? {
-                getTempEmail: (phone) => `${phone.replace(/\+/g, "")}@phone.local`,
-            },
-        }));
-    }
-    try {
-        const auth = betterAuth({
-            database: drizzleAdapter(db.db, {
-                provider: resolveAuthDbProvider(db.provider),
-                schema: authSchema,
-            }),
-            trustedOrigins: config.auth?.trustedOrigins ?? [],
-            emailAndPassword: {
-                enabled: true,
-                requireEmailVerification: config.auth?.requireEmailVerification ?? true,
-                sendResetPassword: async ({ user, url }) => {
-                    if (!config.email)
-                        return;
-                    await config.email.send({
-                        template: "password-reset",
-                        to: user.email,
-                        data: { resetUrl: url, userName: user.name },
-                    });
-                },
-                sendVerificationEmail: async ({ user, url }) => {
-                    if (!config.email)
-                        return;
-                    await config.email.send({
-                        template: "email-verification",
-                        to: user.email,
-                        data: { verifyUrl: url, userName: user.name },
-                    });
-                },
-            },
-            socialProviders: config.auth?.socialProviders ?? {},
-            session: {
-                expiresIn: config.auth?.sessionDuration ?? 60 * 60 * 24 * 7,
-                updateAge: 60 * 60 * 24,
-                cookieCache: {
-                    enabled: true,
-                    maxAge: 60 * 5,
-                },
-            },
-            advanced: {
-                cookiePrefix: "uc",
-                useSecureCookies: process.env.NODE_ENV === "production",
-            },
-            plugins,
-            user: {
-                additionalFields: {
-                    vendorId: { type: "string", required: false },
-                    posOperatorPin: { type: "string", required: false },
-                },
-            },
-        });
-        // The runtime return matches FullBetterAuth structurally — plugins may differ
-        // at runtime (conditional) but the API surface is a superset.
-        return auth;
-    }
-    catch (error) {
-        const message = error instanceof Error
-            ? error.message
-            : "Unknown better-auth initialization error.";
-        throw new Error(`Failed to initialize authentication: ${message}`);
-    }
-}

package/dist/auth/system-actor.d.ts

@@ -1,7 +0,0 @@
-import type { Actor } from "./types.js";
-/**
- * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
- * System actors have full permissions and are scoped to a specific organization.
- */
-export declare function createSystemActor(orgId?: string): Actor;
-//# sourceMappingURL=system-actor.d.ts.map

package/dist/auth/system-actor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"system-actor.d.ts","sourceRoot":"","sources":["../../src/auth/system-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,MAAuB,GAAG,KAAK,CAWvE"}

package/dist/auth/system-actor.js

@@ -1,17 +0,0 @@
-import { DEFAULT_ORG_ID } from "./org.js";
-/**
- * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
- * System actors have full permissions and are scoped to a specific organization.
- */
-export function createSystemActor(orgId = DEFAULT_ORG_ID) {
-    return {
-        type: "api_key",
-        userId: "system:internal",
-        email: null,
-        name: "System",
-        vendorId: null,
-        organizationId: orgId,
-        role: "system",
-        permissions: ["*:*"],
-    };
-}

package/dist/auth/types.d.ts

@@ -1,11 +0,0 @@
-export interface Actor {
-    type: "user" | "api_key";
-    userId: string;
-    email: string | null;
-    name: string;
-    vendorId: string | null;
-    organizationId: string | null;
-    role: string;
-    permissions: string[];
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB"}

package/dist/auth/types.js

@@ -1 +0,0 @@
-export {};

package/dist/config/defaults.d.ts

@@ -1,3 +0,0 @@
-import type { CommerceConfig } from "./types.js";
-export declare const defaultConfig: Partial<CommerceConfig>;
-//# sourceMappingURL=defaults.d.ts.map

package/dist/config/defaults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,cAAc,CA+EjD,CAAC"}