@unifiedcommerce/core 0.4.4 → 0.5.0

package/dist/auth/auth-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-schema.d.ts","sourceRoot":"","sources":["../../src/auth/auth-schema.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaf,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAclB,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBlB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUvB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOvB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUjB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAarB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBjB,CAAC;AAEH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMf,CAAC"}

package/dist/auth/auth-schema.js

@@ -0,0 +1,124 @@
+import { pgTable, text, timestamp, boolean, integer, } from "drizzle-orm/pg-core";
+export const user = pgTable("user", {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").default(false).notNull(),
+    image: text("image"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .defaultNow()
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+    vendorId: text("vendor_id"),
+    posOperatorPin: text("pos_operator_pin"),
+});
+export const session = pgTable("session", {
+    id: text("id").primaryKey(),
+    expiresAt: timestamp("expires_at").notNull(),
+    token: text("token").notNull().unique(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    activeOrganizationId: text("active_organization_id"),
+});
+export const account = pgTable("account", {
+    id: text("id").primaryKey(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    password: text("password"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+});
+export const verification = pgTable("verification", {
+    id: text("id").primaryKey(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+        .defaultNow()
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+});
+export const organization = pgTable("organization", {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull().unique(),
+    logo: text("logo"),
+    createdAt: timestamp("created_at").notNull(),
+    metadata: text("metadata"),
+});
+export const member = pgTable("member", {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    userId: text("user_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+    role: text("role").default("member").notNull(),
+    createdAt: timestamp("created_at").notNull(),
+});
+export const invitation = pgTable("invitation", {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    email: text("email").notNull(),
+    role: text("role"),
+    status: text("status").default("pending").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    inviterId: text("inviter_id")
+        .notNull()
+        .references(() => user.id, { onDelete: "cascade" }),
+});
+export const apikey = pgTable("apikey", {
+    id: text("id").primaryKey(),
+    configId: text("config_id").default("default").notNull(),
+    name: text("name"),
+    start: text("start"),
+    referenceId: text("reference_id").notNull(),
+    prefix: text("prefix"),
+    key: text("key").notNull(),
+    refillInterval: integer("refill_interval"),
+    refillAmount: integer("refill_amount"),
+    lastRefillAt: timestamp("last_refill_at"),
+    enabled: boolean("enabled").default(true),
+    rateLimitEnabled: boolean("rate_limit_enabled").default(false),
+    rateLimitTimeWindow: integer("rate_limit_time_window").default(3600000),
+    rateLimitMax: integer("rate_limit_max").default(10000),
+    requestCount: integer("request_count").default(0),
+    remaining: integer("remaining"),
+    lastRequest: timestamp("last_request"),
+    expiresAt: timestamp("expires_at"),
+    createdAt: timestamp("created_at").notNull(),
+    updatedAt: timestamp("updated_at").notNull(),
+    permissions: text("permissions"),
+    metadata: text("metadata"),
+});
+export const jwks = pgTable("jwks", {
+    id: text("id").primaryKey(),
+    publicKey: text("public_key").notNull(),
+    privateKey: text("private_key").notNull(),
+    createdAt: timestamp("created_at").notNull(),
+    expiresAt: timestamp("expires_at"),
+});

package/dist/auth/middleware.d.ts

@@ -0,0 +1,5 @@
+import type { MiddlewareHandler } from "hono";
+import type { CommerceConfig } from "../config/types.js";
+import type { AuthInstance } from "./setup.js";
+export declare function authMiddleware(auth: AuthInstance, config: CommerceConfig): MiddlewareHandler;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA0B/C,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,cAAc,GACrB,iBAAiB,CAsInB"}

package/dist/auth/middleware.js

@@ -0,0 +1,141 @@
+import { DEFAULT_ORG_ID } from "./org.js";
+function resolvePermissions(session, config) {
+    const role = session.session.activeOrganizationRole;
+    if (!role) {
+        return (config.auth?.customerPermissions ?? [
+            "catalog:read",
+            "cart:create",
+            "cart:read",
+            "cart:update",
+            "orders:create",
+            "orders:read:own",
+            "customers:read:self",
+            "customers:update:self",
+        ]);
+    }
+    const roleConfig = config.auth?.roles?.[role];
+    return roleConfig ? roleConfig.permissions : [];
+}
+export function authMiddleware(auth, config) {
+    return async (c, next) => {
+        const session = (await auth.api.getSession({
+            headers: c.req.raw.headers,
+        }));
+        if (session) {
+            // Better Auth's session stores activeOrganizationId, but often not the role.
+            // For single-store apps (org_default), users may never call set-active,
+            // so activeOrganizationId can be null even for valid org members.
+            let role = session.session.activeOrganizationRole;
+            let orgId = session.session.activeOrganizationId;
+            // If no active org, try to resolve the user's membership in org_default.
+            // This handles the common case where the user is a member but hasn't
+            // called organization/set-active (single-store apps, seed scripts, tests).
+            if (!role && auth.api.getFullOrganization) {
+                try {
+                    const org = await auth.api.getFullOrganization({
+                        query: { organizationId: orgId ?? DEFAULT_ORG_ID },
+                        headers: c.req.raw.headers,
+                    });
+                    if (org?.members) {
+                        const membership = org.members.find((m) => m.userId === session.user.id);
+                        if (membership) {
+                            role = membership.role;
+                            orgId = orgId ?? DEFAULT_ORG_ID;
+                        }
+                    }
+                }
+                catch {
+                    // fall through — treat as customer
+                }
+            }
+            // Also try getActiveMemberRole if active org is set
+            if (!role && orgId && auth.api.getActiveMemberRole) {
+                try {
+                    const roleResult = await auth.api.getActiveMemberRole({
+                        headers: c.req.raw.headers,
+                    });
+                    role = roleResult?.role;
+                }
+                catch {
+                    // fall through — treat as customer
+                }
+            }
+            const enrichedSession = {
+                ...session,
+                session: { ...session.session, activeOrganizationRole: role ?? null },
+            };
+            c.set("actor", {
+                type: "user",
+                userId: session.user.id,
+                email: session.user.email ?? null,
+                name: session.user.name ?? "User",
+                vendorId: session.user.vendorId ?? null,
+                organizationId: orgId ?? DEFAULT_ORG_ID,
+                role: role ?? "customer",
+                permissions: resolvePermissions(enrichedSession, config),
+            });
+            await next();
+            return;
+        }
+        // Extract API key from headers
+        const apiKeyHeader = c.req.header("x-api-key") ??
+            c.req.header("authorization")?.replace("Bearer ", "");
+        if (apiKeyHeader &&
+            config.auth?.apiKeys?.enabled &&
+            auth.api.verifyApiKey) {
+            try {
+                // Better Auth server-side calls require { body: { ... } } wrapper.
+                // Returns { valid, error, key: Omit<ApiKey,"key"> | null }.
+                // See: https://better-auth.com/docs/plugins/api-key/reference
+                const result = await auth.api.verifyApiKey({
+                    body: { key: apiKeyHeader },
+                });
+                if (result?.valid && result.key) {
+                    const apiKey = result.key;
+                    // v1.5+ renamed userId → referenceId on the apikey table.
+                    const userId = (apiKey.referenceId ?? "");
+                    const name = (apiKey.name ?? "API Key");
+                    const orgId = (apiKey.organizationId ?? DEFAULT_ORG_ID);
+                    // Better Auth stores permissions as Record<string, string[]>
+                    // (e.g. {"catalog":["read","create"]}).  Flatten to the
+                    // "resource:action" string[] format the engine expects.
+                    let permissions;
+                    const rawPerms = apiKey.permissions;
+                    if (Array.isArray(rawPerms)) {
+                        permissions = rawPerms;
+                    }
+                    else if (rawPerms && typeof rawPerms === "object") {
+                        permissions = [];
+                        for (const [resource, actions] of Object.entries(rawPerms)) {
+                            for (const action of actions) {
+                                permissions.push(`${resource}:${action}`);
+                            }
+                        }
+                    }
+                    else {
+                        permissions = config.auth?.apiKeys?.defaultPermissions ?? [];
+                    }
+                    c.set("actor", {
+                        type: "api_key",
+                        userId,
+                        email: null,
+                        name,
+                        vendorId: null,
+                        organizationId: orgId,
+                        role: "api_key",
+                        permissions,
+                    });
+                    await next();
+                    return;
+                }
+            }
+            catch {
+                // invalid, expired, or rate-limited key — fall through
+            }
+        }
+        if (!c.get("actor")) {
+            c.set("actor", null);
+        }
+        await next();
+    };
+}

package/dist/auth/org.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Deterministic ID for the default organization.
+ * Auto-created on kernel boot / test setup for single-tenant deployments.
+ */
+export declare const DEFAULT_ORG_ID = "org_default";
+/**
+ * Extracts the organization ID from an actor.
+ * Falls back to the default org when the actor is null or has no org set.
+ */
+export declare function resolveOrgId(actor: unknown): string;
+/**
+ * Ensures the default organization row exists in the database.
+ * Idempotent — safe to call multiple times (no-ops if the row exists).
+ *
+ * Uses OrganizationService which creates both the org row and
+ * (when auth is available) a member record for the creator.
+ *
+ * Accepts `unknown` so callers never need casts — the function
+ * handles the Drizzle type narrowing internally.
+ */
+export declare function ensureDefaultOrg(db: unknown, storeName?: string): Promise<void>;
+//# sourceMappingURL=org.d.ts.map

package/dist/auth/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../src/auth/org.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMnD;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,OAAO,EACX,SAAS,SAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/auth/org.js

@@ -0,0 +1,36 @@
+import { OrganizationService } from "../modules/organization/service.js";
+/**
+ * Deterministic ID for the default organization.
+ * Auto-created on kernel boot / test setup for single-tenant deployments.
+ */
+export const DEFAULT_ORG_ID = "org_default";
+/**
+ * Extracts the organization ID from an actor.
+ * Falls back to the default org when the actor is null or has no org set.
+ */
+export function resolveOrgId(actor) {
+    if (actor != null && typeof actor === "object" && "organizationId" in actor) {
+        const orgId = actor.organizationId;
+        if (typeof orgId === "string")
+            return orgId;
+    }
+    return DEFAULT_ORG_ID;
+}
+/**
+ * Ensures the default organization row exists in the database.
+ * Idempotent — safe to call multiple times (no-ops if the row exists).
+ *
+ * Uses OrganizationService which creates both the org row and
+ * (when auth is available) a member record for the creator.
+ *
+ * Accepts `unknown` so callers never need casts — the function
+ * handles the Drizzle type narrowing internally.
+ */
+export async function ensureDefaultOrg(db, storeName = "Default Store") {
+    const orgService = new OrganizationService(db);
+    await orgService.create({
+        id: DEFAULT_ORG_ID,
+        name: storeName,
+        slug: "default",
+    });
+}

package/dist/auth/permissions.d.ts

@@ -0,0 +1,4 @@
+import type { Actor } from "./types.js";
+export declare function assertPermission(actor: Actor | null, required: string): void;
+export declare function assertOwnership(actor: Actor | null, resourceOwnerId: string | null): void;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/auth/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAc5E;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAQzF"}

package/dist/auth/permissions.js

@@ -0,0 +1,24 @@
+import { CommerceForbiddenError } from "../kernel/errors.js";
+export function assertPermission(actor, required) {
+    if (!actor) {
+        throw new CommerceForbiddenError("Authentication required.");
+    }
+    if (actor.permissions.includes("*:*"))
+        return;
+    const [resource] = required.split(":");
+    if (resource && actor.permissions.includes(`${resource}:*`))
+        return;
+    if (actor.permissions.includes(required))
+        return;
+    throw new CommerceForbiddenError(`Permission "${required}" is required. Your role "${actor.role}" does not include this permission.`);
+}
+export function assertOwnership(actor, resourceOwnerId) {
+    if (!actor) {
+        throw new CommerceForbiddenError("Authentication required.");
+    }
+    if (actor.permissions.includes("*:*"))
+        return;
+    if (actor.userId !== resourceOwnerId) {
+        throw new CommerceForbiddenError("You do not have access to this resource.");
+    }
+}

package/dist/auth/setup.d.ts

@@ -0,0 +1,29 @@
+import { betterAuth } from "better-auth";
+import { apiKey } from "@better-auth/api-key";
+import { organization, twoFactor, phoneNumber, jwt, bearer } from "better-auth/plugins";
+import type { CommerceConfig } from "../config/types.js";
+import type { DatabaseAdapter } from "../kernel/database/adapter.js";
+/**
+ * The auth type is inferred from `typeof betterAuth(...)` with all plugins enabled.
+ * This gives us the full API surface without manual interface maintenance.
+ *
+ * We use a type-level-only reference (never executed) to capture the complete type.
+ */
+type FullBetterAuth = ReturnType<typeof betterAuth<{
+    plugins: [
+        ReturnType<typeof organization>,
+        ReturnType<typeof bearer>,
+        ReturnType<typeof jwt>,
+        ReturnType<typeof twoFactor>,
+        ReturnType<typeof apiKey>,
+        ReturnType<typeof phoneNumber>
+    ];
+}>>;
+/**
+ * AuthInstance — inferred from Better Auth with all plugins.
+ * No manual type maintenance needed.
+ */
+export type AuthInstance = FullBetterAuth;
+export declare function createAuth(db: DatabaseAdapter, config: CommerceConfig): AuthInstance;
+export {};
+//# sourceMappingURL=setup.d.ts.map

package/dist/auth/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/auth/setup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAiBrE;;;;;GAKG;AACH,KAAK,cAAc,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC;IACjD,OAAO,EAAE;QACP,UAAU,CAAC,OAAO,YAAY,CAAC;QAC/B,UAAU,CAAC,OAAO,MAAM,CAAC;QACzB,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,UAAU,CAAC,OAAO,SAAS,CAAC;QAC5B,UAAU,CAAC,OAAO,MAAM,CAAC;QACzB,UAAU,CAAC,OAAO,WAAW,CAAC;KAC/B,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC;AAE1C,wBAAgB,UAAU,CACxB,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,cAAc,GACrB,YAAY,CAyId"}

package/dist/auth/setup.js

@@ -0,0 +1,144 @@
+import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+import { betterAuth } from "better-auth";
+import { apiKey } from "@better-auth/api-key";
+import { organization, twoFactor, phoneNumber, jwt, bearer } from "better-auth/plugins";
+import * as authSchema from "./auth-schema.js";
+function resolveAuthDbProvider(provider) {
+    if (provider === "postgres" || provider === "postgresql" || provider === "pg")
+        return "pg";
+    if (provider === "mysql")
+        return "mysql";
+    if (provider === "sqlite")
+        return "sqlite";
+    throw new Error(`Unsupported auth database provider "${provider}".`);
+}
+export function createAuth(db, config) {
+    const plugins = [
+        organization({
+            roles: (config.auth?.roles ?? {}),
+        }),
+        bearer(),
+        jwt(),
+    ];
+    if (config.auth?.twoFactor?.enabled) {
+        plugins.push(twoFactor({ issuer: config.storeName ?? "UnifiedCommerce" }));
+    }
+    const scopes = config.auth?.apiKeyScopes;
+    if (scopes && Object.keys(scopes).length > 0) {
+        const apiKeyConfigs = Object.entries(scopes).map(([scopeId, scope]) => ({
+            configId: scopeId,
+            defaultPrefix: scope.prefix,
+            ...(scope.rateLimit
+                ? {
+                    rateLimit: {
+                        enabled: true,
+                        maxRequests: scope.rateLimit.maxRequests,
+                        timeWindow: scope.rateLimit.timeWindow,
+                    },
+                }
+                : {}),
+        }));
+        plugins.push(apiKey(apiKeyConfigs));
+    }
+    else if (config.auth?.apiKeys?.enabled) {
+        plugins.push(apiKey());
+    }
+    if (config.auth?.phoneAuth) {
+        plugins.push(phoneNumber({
+            sendOTP: config.auth.phoneAuth.sendOTP,
+            verifyOTP: config.auth.phoneAuth.verifyOTP,
+            otpLength: config.auth.phoneAuth.otpLength ?? 6,
+            expiresIn: config.auth.phoneAuth.expiresIn ?? 300,
+            signUpOnVerification: config.auth.phoneAuth.signUpOnVerification ?? {
+                getTempEmail: (phone) => `${phone.replace(/\+/g, "")}@phone.local`,
+            },
+        }));
+    }
+    try {
+        const auth = betterAuth({
+            database: drizzleAdapter(db.db, {
+                provider: resolveAuthDbProvider(db.provider),
+                schema: authSchema,
+            }),
+            databaseHooks: {
+                user: {
+                    create: {
+                        after: async (user) => {
+                            // Auto-create customer record on signup. Uses the Drizzle db
+                            // directly because the kernel isn't fully initialized yet during
+                            // auth setup. Best-effort — getByUserId() lazy-creates as fallback.
+                            try {
+                                const { customers } = await import("../kernel/database/schema.js");
+                                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                                const drizzle = db.db;
+                                await drizzle.insert(customers).values({
+                                    organizationId: "org_default",
+                                    userId: user.id,
+                                    email: user.email ?? null,
+                                    firstName: user.name?.split(" ")[0] ?? null,
+                                    lastName: user.name?.split(" ").slice(1).join(" ") ?? null,
+                                    metadata: {},
+                                }).onConflictDoNothing();
+                            }
+                            catch {
+                                // Silent — lazy creation in getByUserId() is the fallback
+                            }
+                        },
+                    },
+                },
+            },
+            trustedOrigins: config.auth?.trustedOrigins ?? [],
+            emailAndPassword: {
+                enabled: true,
+                requireEmailVerification: config.auth?.requireEmailVerification ?? true,
+                sendResetPassword: async ({ user, url }) => {
+                    if (!config.email)
+                        return;
+                    await config.email.send({
+                        template: "password-reset",
+                        to: user.email,
+                        data: { resetUrl: url, userName: user.name },
+                    });
+                },
+                sendVerificationEmail: async ({ user, url }) => {
+                    if (!config.email)
+                        return;
+                    await config.email.send({
+                        template: "email-verification",
+                        to: user.email,
+                        data: { verifyUrl: url, userName: user.name },
+                    });
+                },
+            },
+            socialProviders: config.auth?.socialProviders ?? {},
+            session: {
+                expiresIn: config.auth?.sessionDuration ?? 60 * 60 * 24 * 7,
+                updateAge: 60 * 60 * 24,
+                cookieCache: {
+                    enabled: true,
+                    maxAge: 60 * 5,
+                },
+            },
+            advanced: {
+                cookiePrefix: "uc",
+                useSecureCookies: process.env.NODE_ENV === "production",
+            },
+            plugins,
+            user: {
+                additionalFields: {
+                    vendorId: { type: "string", required: false },
+                    posOperatorPin: { type: "string", required: false },
+                },
+            },
+        });
+        // The runtime return matches FullBetterAuth structurally — plugins may differ
+        // at runtime (conditional) but the API surface is a superset.
+        return auth;
+    }
+    catch (error) {
+        const message = error instanceof Error
+            ? error.message
+            : "Unknown better-auth initialization error.";
+        throw new Error(`Failed to initialize authentication: ${message}`);
+    }
+}

package/dist/auth/system-actor.d.ts

@@ -0,0 +1,7 @@
+import type { Actor } from "./types.js";
+/**
+ * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
+ * System actors have full permissions and are scoped to a specific organization.
+ */
+export declare function createSystemActor(orgId?: string): Actor;
+//# sourceMappingURL=system-actor.d.ts.map

package/dist/auth/system-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-actor.d.ts","sourceRoot":"","sources":["../../src/auth/system-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,MAAuB,GAAG,KAAK,CAWvE"}

package/dist/auth/system-actor.js

@@ -0,0 +1,17 @@
+import { DEFAULT_ORG_ID } from "./org.js";
+/**
+ * Creates a system actor for internal operations (webhooks, jobs, compensation chains).
+ * System actors have full permissions and are scoped to a specific organization.
+ */
+export function createSystemActor(orgId = DEFAULT_ORG_ID) {
+    return {
+        type: "api_key",
+        userId: "system:internal",
+        email: null,
+        name: "System",
+        vendorId: null,
+        organizationId: orgId,
+        role: "system",
+        permissions: ["*:*"],
+    };
+}

package/dist/auth/types.d.ts

@@ -0,0 +1,11 @@
+export interface Actor {
+    type: "user" | "api_key";
+    userId: string;
+    email: string | null;
+    name: string;
+    vendorId: string | null;
+    organizationId: string | null;
+    role: string;
+    permissions: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB"}

package/dist/auth/types.js

@@ -0,0 +1 @@
+export {};

package/dist/config/defaults.d.ts

@@ -0,0 +1,3 @@
+import type { CommerceConfig } from "./types.js";
+export declare const defaultConfig: Partial<CommerceConfig>;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/config/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,cAAc,CA+EjD,CAAC"}