@unifiedcommerce/core 0.4.4 → 0.5.0

package/dist/modules/analytics/service.js

@@ -0,0 +1,196 @@
+/**
+ * AnalyticsService — thin delegation layer over AnalyticsAdapter.
+ *
+ * The service manages plugin model registration, custom schema loading,
+ * and delegates all query execution to the configured adapter
+ * (DrizzleAnalyticsAdapter — always on, built into core).
+ */
+import { CommerceValidationError } from "../../kernel/errors.js";
+import { Err, Ok } from "../../kernel/result.js";
+export class AnalyticsService {
+    deps;
+    pluginModels = [];
+    customSchemaModels = [];
+    customModelsLoaded = false;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * Register a plugin-contributed analytics model.
+     *
+     * If the model includes a `table` field and structured measures/dimensions,
+     * it is also registered as an AnalyticsModel on the adapter for SQL queries.
+     * Otherwise, it appears in getMeta() but queries return zero-value rows.
+     */
+    registerModel(model) {
+        if (!model || typeof model !== "object")
+            return;
+        const raw = model;
+        const name = typeof raw.name === "string"
+            ? raw.name
+            : `PluginModel_${this.pluginModels.length + 1}`;
+        const measures = Array.isArray(raw.measures)
+            ? raw.measures.filter((v) => typeof v === "string")
+            : [];
+        const dimensions = Array.isArray(raw.dimensions)
+            ? raw.dimensions.filter((v) => typeof v === "string")
+            : [];
+        const segments = Array.isArray(raw.segments)
+            ? raw.segments.filter((v) => typeof v === "string")
+            : [];
+        this.pluginModels.push({
+            name,
+            source: "plugin",
+            measures,
+            dimensions,
+            segments,
+            raw: model,
+        });
+        // If the model provides a table + structured definitions, register on the adapter
+        if (typeof raw.table === "string" && Array.isArray(raw.measures)) {
+            this.tryRegisterModel(name, raw);
+        }
+    }
+    /**
+     * Query analytics with scope-based filtering.
+     * Scope is REQUIRED — use buildAnalyticsScope(actor) to construct it.
+     */
+    async query(params, scope) {
+        return this.deps.adapter.query(params, scope);
+    }
+    async getDashboard(name, scope) {
+        const normalized = name.trim().toLowerCase();
+        if (normalized === "revenue" || normalized === "revenue-overview") {
+            return this.query({
+                measures: ["Orders.revenue", "Orders.count"],
+                timeDimensions: [{
+                        dimension: "Orders.placedAt",
+                        granularity: "month",
+                        dateRange: "this month",
+                    }],
+                order: { "Orders.placedAt": "asc" },
+            }, scope);
+        }
+        if (normalized === "inventory" || normalized === "inventory-health") {
+            return this.query({
+                measures: ["Inventory.totalAvailable", "Inventory.lowStockCount"],
+                dimensions: ["Inventory.warehouseId"],
+                order: { "Inventory.totalAvailable": "desc" },
+            }, scope);
+        }
+        return Err(new CommerceValidationError(`Unknown analytics dashboard: ${name}`));
+    }
+    async getMeta() {
+        await this.ensureCustomSchemaModelsLoaded();
+        // Meta returns model definitions, not data — always use admin scope
+        const adapterMeta = await this.deps.adapter.getMeta({ role: "admin" });
+        if (!adapterMeta.ok)
+            return adapterMeta;
+        // Merge with plugin and custom schema models
+        const allModels = [
+            ...adapterMeta.value.models,
+            ...this.pluginModels,
+            ...this.customSchemaModels,
+        ];
+        return Ok({
+            models: allModels,
+            measures: allModels.flatMap((m) => m.measures),
+            dimensions: allModels.flatMap((m) => m.dimensions),
+            segments: allModels.flatMap((m) => m.segments ?? []),
+        });
+    }
+    async meta() {
+        const meta = await this.getMeta();
+        if (!meta.ok)
+            return meta;
+        return Ok({
+            measures: meta.value.measures,
+            dimensions: meta.value.dimensions,
+            segments: meta.value.segments,
+        });
+    }
+    // ─── Private ─────────────────────────────────────────────────────────────
+    tryRegisterModel(name, raw) {
+        try {
+            const table = raw.table;
+            const measuresArray = raw.measures;
+            const dimensionsArray = (raw.dimensions ?? []);
+            const modelDef = {
+                name,
+                table,
+                measures: {},
+                dimensions: {},
+            };
+            for (const m of measuresArray) {
+                if (typeof m === "string")
+                    continue;
+                if (typeof m.name === "string" && typeof m.type === "string") {
+                    modelDef.measures[m.name] = {
+                        type: m.type,
+                        sql: typeof m.sql === "string" ? m.sql : undefined,
+                        filter: typeof m.filter === "string" ? m.filter : undefined,
+                    };
+                }
+            }
+            for (const d of dimensionsArray) {
+                if (typeof d === "string")
+                    continue;
+                if (typeof d.name === "string" && typeof d.sql === "string") {
+                    modelDef.dimensions[d.name] = {
+                        sql: d.sql,
+                        type: (typeof d.type === "string" ? d.type : "string"),
+                    };
+                }
+            }
+            if (Object.keys(modelDef.measures).length > 0) {
+                this.deps.adapter.registerModel(modelDef);
+            }
+        }
+        catch {
+            // Silently skip malformed plugin models
+        }
+    }
+    async ensureCustomSchemaModelsLoaded() {
+        if (this.customModelsLoaded)
+            return;
+        this.customModelsLoaded = true;
+        const customSchemaPath = this.deps.config.analytics?.customSchemaPath;
+        if (!customSchemaPath)
+            return;
+        try {
+            const fs = await import("node:fs/promises");
+            const path = await import("node:path");
+            const entries = await fs.readdir(customSchemaPath);
+            for (const entry of entries) {
+                if (!entry.endsWith(".js"))
+                    continue;
+                const filePath = path.join(customSchemaPath, entry);
+                const content = await fs.readFile(filePath, "utf8");
+                const nameMatch = content.match(/cube\s*\(\s*["'`]([\w-]+)["'`]/);
+                const name = nameMatch?.[1] ?? entry.replace(/\.js$/, "");
+                const measures = [
+                    ...content.matchAll(/measures\s*:\s*{([\s\S]*?)}\s*,/g),
+                ].flatMap((match) => {
+                    const block = match[1] ?? "";
+                    return [...block.matchAll(/([A-Za-z_][A-Za-z0-9_]*)\s*:\s*{/g)].map((x) => `${name}.${x[1]}`);
+                });
+                const dimensions = [
+                    ...content.matchAll(/dimensions\s*:\s*{([\s\S]*?)}\s*,/g),
+                ].flatMap((match) => {
+                    const block = match[1] ?? "";
+                    return [...block.matchAll(/([A-Za-z_][A-Za-z0-9_]*)\s*:\s*{/g)].map((x) => `${name}.${x[1]}`);
+                });
+                this.customSchemaModels.push({
+                    name,
+                    source: "custom-schema",
+                    measures,
+                    dimensions,
+                    raw: { path: filePath },
+                });
+            }
+        }
+        catch {
+            // Optional extension path: ignore file-system issues
+        }
+    }
+}

package/dist/modules/analytics/types.d.ts

@@ -0,0 +1,119 @@
+import type { Result } from "../../kernel/result.js";
+export interface AnalyticsTimeDimension {
+    dimension: string;
+    granularity?: "day" | "week" | "month" | "year";
+    dateRange?: [string, string] | string;
+}
+export interface AnalyticsFilter {
+    member: string;
+    operator: "equals" | "notEquals" | "contains" | "in" | "notIn" | "gt" | "gte" | "lt" | "lte" | "beforeDate" | "afterDate" | "inDateRange";
+    values?: string[];
+}
+export interface AnalyticsQueryParams {
+    measures: string[];
+    dimensions?: string[];
+    timeDimensions?: AnalyticsTimeDimension[];
+    filters?: AnalyticsFilter[];
+    order?: Record<string, "asc" | "desc">;
+    limit?: number;
+}
+export interface AnalyticsQueryResult {
+    query: AnalyticsQueryParams;
+    rows: Record<string, unknown>[];
+    source: string;
+}
+export interface AnalyticsModelDefinition {
+    name: string;
+    measures: string[];
+    dimensions: string[];
+    segments?: string[];
+    source: "builtin" | "plugin" | "custom-schema";
+    raw?: unknown;
+}
+export interface AnalyticsMeta {
+    models: AnalyticsModelDefinition[];
+    measures: string[];
+    dimensions: string[];
+    segments: string[];
+}
+export type MeasureType = "count" | "sum" | "avg" | "min" | "max" | "countDistinct";
+export interface AnalyticsMeasure {
+    type: MeasureType;
+    /** SQL column or expression (e.g., "grand_total" or "quantity_on_hand * COALESCE(unit_cost, 0)") */
+    sql?: string | undefined;
+    /** SQL filter expression that must be true for this measure to count a row */
+    filter?: string | undefined;
+}
+export type DimensionType = "string" | "number" | "time" | "boolean";
+export interface AnalyticsDimension {
+    /** SQL column or expression */
+    sql: string;
+    type: DimensionType;
+}
+export interface AnalyticsJoin {
+    table: string;
+    type: "left" | "inner";
+    on: string;
+}
+export interface AnalyticsModel {
+    name: string;
+    table: string;
+    joins?: AnalyticsJoin[];
+    measures: Record<string, AnalyticsMeasure>;
+    dimensions: Record<string, AnalyticsDimension>;
+    segments?: Record<string, {
+        sql: string;
+    }>;
+    /**
+     * Scope rules define how this model is filtered by role.
+     * The filter SQL uses :vendorId or :customerId as placeholders.
+     *
+     * Example: { role: "vendor", filter: "vendor_id = :vendorId" }
+     */
+    scopeRules?: AnalyticsScopeRule[];
+}
+export interface AnalyticsScope {
+    role: "admin" | "staff" | "vendor" | "customer" | "public";
+    vendorId?: string | undefined;
+    customerId?: string | undefined;
+}
+/**
+ * Scope rule: defines how an analytics model is filtered for a given role.
+ * Registered alongside model definitions.
+ */
+export interface AnalyticsScopeRule {
+    /** Which role this rule applies to */
+    role: "vendor" | "customer";
+    /** SQL WHERE clause fragment. Use :vendorId or :customerId as placeholders. */
+    filter: string;
+}
+/**
+ * Build an AnalyticsScope from an actor (or null for public).
+ *
+ * This is the ONLY way scopes should be created. Every call site that
+ * invokes analytics.query() MUST use this function — never construct
+ * a scope manually. This ensures the scope always reflects the
+ * authenticated actor's actual role and identity.
+ */
+export declare function buildAnalyticsScope(actor: {
+    role?: string;
+    vendorId?: string | null;
+    userId?: string;
+} | null): AnalyticsScope;
+export interface AnalyticsAdapter {
+    /** Scope is REQUIRED. Use buildAnalyticsScope(actor) to construct it. */
+    query(params: AnalyticsQueryParams, scope: AnalyticsScope): Promise<Result<AnalyticsQueryResult>>;
+    getMeta(scope: AnalyticsScope): Promise<Result<AnalyticsMeta>>;
+    registerModel(model: AnalyticsModel): void;
+}
+/** @deprecated Use AnalyticsModel instead */
+export type CubeDefinition = AnalyticsModel;
+/** @deprecated Use AnalyticsScopeRule instead */
+export type CubeScopeRule = AnalyticsScopeRule;
+/** @deprecated Use AnalyticsMeasure instead */
+export type MeasureDefinition = AnalyticsMeasure;
+/** @deprecated Use AnalyticsDimension instead */
+export type DimensionDefinition = AnalyticsDimension;
+/** @deprecated Use AnalyticsJoin instead */
+export type JoinDefinition = AnalyticsJoin;
+//# sourceMappingURL=types.d.ts.map

package/dist/modules/analytics/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/modules/analytics/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAChD,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EACJ,QAAQ,GACR,WAAW,GACX,UAAU,GACV,IAAI,GACJ,OAAO,GACP,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,YAAY,GACZ,WAAW,GACX,aAAa,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC1C,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB;AAID,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,eAAe,CAAC;IAC/C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,eAAe,CAAC;AAEpF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAErE,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAID,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC3D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC5B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CAChB;AAID;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,IAAI,GAAG,cAAc,CAmBxB;AAID,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAClG,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;CAC5C;AAID,6CAA6C;AAC7C,MAAM,MAAM,cAAc,GAAG,cAAc,CAAC;AAC5C,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAC/C,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AACjD,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AACrD,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,aAAa,CAAC"}

package/dist/modules/analytics/types.js

@@ -0,0 +1,25 @@
+// ─── Scope Builder ───────────────────────────────────────────────────────────
+/**
+ * Build an AnalyticsScope from an actor (or null for public).
+ *
+ * This is the ONLY way scopes should be created. Every call site that
+ * invokes analytics.query() MUST use this function — never construct
+ * a scope manually. This ensures the scope always reflects the
+ * authenticated actor's actual role and identity.
+ */
+export function buildAnalyticsScope(actor) {
+    if (!actor)
+        return { role: "public" };
+    const role = actor.role ?? "public";
+    if (role === "admin" || role === "owner" || role === "staff" || role === "ai_agent") {
+        return { role: "admin" };
+    }
+    if (actor.vendorId) {
+        return { role: "vendor", vendorId: actor.vendorId };
+    }
+    if (role === "customer" && actor.userId) {
+        return { role: "customer", customerId: actor.userId };
+    }
+    // Unknown role — deny access
+    return { role: "public" };
+}

package/dist/modules/audit/hooks.d.ts

@@ -0,0 +1,7 @@
+import type { HookHandler } from "../../kernel/hooks/registry.js";
+/**
+ * All audit hooks, keyed by hook registration key.
+ * Registered in kernel boot via hooks.append().
+ */
+export declare const auditHooks: Record<string, HookHandler>;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/modules/audit/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/hooks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAiDlE;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAuBlD,CAAC"}

package/dist/modules/audit/hooks.js

@@ -0,0 +1,67 @@
+/**
+ * Creates an after-hook that records an audit entry for the operation.
+ *
+ * The audit entry is written using the same transaction context as the
+ * business operation (via ctx.tx). If the operation rolls back, the
+ * audit entry rolls back too.
+ */
+function createAuditAfterHook(entityType, event) {
+    return async ({ result, context }) => {
+        const audit = context.services.audit;
+        if (!audit?.record)
+            return;
+        const entityId = result?.id ?? "unknown";
+        await audit.record({
+            entityType,
+            entityId,
+            event,
+            payload: safePayload(result),
+            ctx: context,
+        });
+    };
+}
+/**
+ * Strips the result to a safe subset for audit logging.
+ * Avoids storing sensitive fields or excessively large payloads.
+ */
+function safePayload(result) {
+    if (result == null || typeof result !== "object")
+        return {};
+    const obj = result;
+    // Shallow copy, exclude fields that could be huge
+    const safe = {};
+    for (const [key, value] of Object.entries(obj)) {
+        // Skip binary data, nested arrays > 10 items, and known sensitive fields
+        if (key === "password" || key === "secret" || key === "bankAccount")
+            continue;
+        if (Array.isArray(value) && value.length > 10) {
+            safe[key] = `[${value.length} items]`;
+            continue;
+        }
+        safe[key] = value;
+    }
+    return safe;
+}
+/**
+ * All audit hooks, keyed by hook registration key.
+ * Registered in kernel boot via hooks.append().
+ */
+export const auditHooks = {
+    // Catalog
+    "catalog.afterCreate": createAuditAfterHook("catalog_entity", "created"),
+    "catalog.afterUpdate": createAuditAfterHook("catalog_entity", "updated"),
+    // Orders
+    "orders.afterCreate": createAuditAfterHook("order", "created"),
+    "orders.afterStatusChange": createAuditAfterHook("order", "status_changed"),
+    // Inventory
+    "inventory.afterAdjust": createAuditAfterHook("inventory", "adjusted"),
+    // Customers
+    "customers.afterCreate": createAuditAfterHook("customer", "created"),
+    "customers.afterUpdate": createAuditAfterHook("customer", "updated"),
+    // Pricing
+    "pricing.afterCreate": createAuditAfterHook("price", "created"),
+    "pricing.afterUpdate": createAuditAfterHook("price", "updated"),
+    // Promotions
+    "promotions.afterCreate": createAuditAfterHook("promotion", "created"),
+    "promotions.afterUpdate": createAuditAfterHook("promotion", "updated"),
+};

package/dist/modules/audit/schema.d.ts

@@ -0,0 +1,178 @@
+export declare const auditLog: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "commerce_audit_log";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "commerce_audit_log";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        organizationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "organization_id";
+            tableName: "commerce_audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entityType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entity_type";
+            tableName: "commerce_audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entityId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entity_id";
+            tableName: "commerce_audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        event: import("drizzle-orm/pg-core").PgColumn<{
+            name: "event";
+            tableName: "commerce_audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        payload: import("drizzle-orm/pg-core").PgColumn<{
+            name: "payload";
+            tableName: "commerce_audit_log";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_id";
+            tableName: "commerce_audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_type";
+            tableName: "commerce_audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_id";
+            tableName: "commerce_audit_log";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "commerce_audit_log";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/modules/audit/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/schema.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBpB,CAAC"}

package/dist/modules/audit/schema.js

@@ -0,0 +1,21 @@
+import { pgTable, uuid, text, jsonb, timestamp, index, } from "drizzle-orm/pg-core";
+import { organization } from "../../auth/auth-schema.js";
+export const auditLog = pgTable("commerce_audit_log", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    organizationId: text("organization_id")
+        .notNull()
+        .references(() => organization.id, { onDelete: "cascade" }),
+    entityType: text("entity_type").notNull(),
+    entityId: text("entity_id").notNull(),
+    event: text("event").notNull(),
+    payload: jsonb("payload").notNull().default("{}"),
+    actorId: text("actor_id"),
+    actorType: text("actor_type"),
+    requestId: text("request_id"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+        .notNull()
+        .defaultNow(),
+}, (table) => ({
+    entityIdx: index("idx_audit_entity").on(table.entityType, table.entityId),
+    orgIdx: index("idx_audit_org").on(table.organizationId),
+}));

package/dist/modules/audit/service.d.ts

@@ -0,0 +1,38 @@
+import type { InferSelectModel } from "drizzle-orm";
+import type { DrizzleDatabase } from "../../kernel/database/drizzle-db.js";
+import type { TxContext } from "../../kernel/database/tx-context.js";
+import type { HookContext } from "../../kernel/hooks/types.js";
+import { auditLog } from "./schema.js";
+export type AuditEntry = InferSelectModel<typeof auditLog>;
+export interface RecordArgs {
+    entityType: string;
+    entityId: string;
+    event: string;
+    payload?: Record<string, unknown>;
+    ctx: HookContext;
+}
+export interface ListForEntityArgs {
+    organizationId?: string;
+    entityType: string;
+    entityId: string;
+    limit?: number;
+    ctx?: TxContext;
+}
+export interface ListArgs {
+    organizationId?: string | undefined;
+    entityType?: string | undefined;
+    entityId?: string | undefined;
+    event?: string | undefined;
+    actorId?: string | undefined;
+    from?: Date | undefined;
+    to?: Date | undefined;
+    limit?: number | undefined;
+}
+export interface AuditService {
+    record(args: RecordArgs): Promise<void>;
+    listForEntity(args: ListForEntityArgs): Promise<AuditEntry[]>;
+    list(args: ListArgs): Promise<AuditEntry[]>;
+}
+export declare function createNullAuditService(): AuditService;
+export declare function createAuditService(db: DrizzleDatabase): AuditService;
+//# sourceMappingURL=service.d.ts.map

package/dist/modules/audit/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,QAAQ,CAAC,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,GAAG,EAAE,WAAW,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACxB,EAAE,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,IAAI,YAAY,CAyCrD;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,eAAe,GAAG,YAAY,CAgEpE"}