@unifiedcommerce/core 0.4.4 → 0.5.0

package/dist/modules/audit/service.js

@@ -0,0 +1,109 @@
+import { eq, and, desc, gte, lte } from "drizzle-orm";
+import { resolveOrgId } from "../../auth/org.js";
+import { auditLog } from "./schema.js";
+export function createNullAuditService() {
+    const entries = [];
+    return {
+        async record(args) {
+            entries.push({
+                id: crypto.randomUUID(),
+                organizationId: resolveOrgId(args.ctx.actor),
+                entityType: args.entityType,
+                entityId: args.entityId,
+                event: args.event,
+                payload: args.payload ?? {},
+                actorId: args.ctx.actor?.userId ?? null,
+                actorType: args.ctx.actor != null ? "user" : null,
+                requestId: args.ctx.requestId,
+                createdAt: new Date(),
+            });
+        },
+        async listForEntity(args) {
+            return entries
+                .filter((e) => e.entityType === args.entityType && e.entityId === args.entityId)
+                .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())
+                .slice(0, args.limit ?? 50);
+        },
+        async list(args) {
+            let result = entries;
+            if (args.entityType)
+                result = result.filter((e) => e.entityType === args.entityType);
+            if (args.entityId)
+                result = result.filter((e) => e.entityId === args.entityId);
+            if (args.event)
+                result = result.filter((e) => e.event === args.event);
+            if (args.actorId)
+                result = result.filter((e) => e.actorId === args.actorId);
+            if (args.from)
+                result = result.filter((e) => e.createdAt >= args.from);
+            if (args.to)
+                result = result.filter((e) => e.createdAt <= args.to);
+            return result
+                .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())
+                .slice(0, args.limit ?? 50);
+        },
+    };
+}
+export function createAuditService(db) {
+    return {
+        async record(args) {
+            const { entityType, entityId, event, payload, ctx } = args;
+            const dbOrTx = ctx.tx != null
+                ? ctx.tx
+                : db;
+            await dbOrTx.insert(auditLog).values({
+                organizationId: resolveOrgId(ctx.actor),
+                entityType,
+                entityId,
+                event,
+                payload: payload ?? {},
+                actorId: ctx.actor?.userId ?? null,
+                actorType: ctx.actor != null ? "user" : null,
+                requestId: ctx.requestId,
+            });
+        },
+        async listForEntity(args) {
+            const { organizationId, entityType, entityId, limit = 50, ctx } = args;
+            const dbOrTx = ctx?.tx != null
+                ? ctx.tx
+                : db;
+            const conditions = [
+                eq(auditLog.entityType, entityType),
+                eq(auditLog.entityId, entityId),
+            ];
+            if (organizationId) {
+                conditions.push(eq(auditLog.organizationId, organizationId));
+            }
+            return dbOrTx
+                .select()
+                .from(auditLog)
+                .where(and(...conditions))
+                .orderBy(desc(auditLog.createdAt))
+                .limit(limit);
+        },
+        async list(args) {
+            const conditions = [];
+            if (args.organizationId)
+                conditions.push(eq(auditLog.organizationId, args.organizationId));
+            if (args.entityType)
+                conditions.push(eq(auditLog.entityType, args.entityType));
+            if (args.entityId)
+                conditions.push(eq(auditLog.entityId, args.entityId));
+            if (args.event)
+                conditions.push(eq(auditLog.event, args.event));
+            if (args.actorId)
+                conditions.push(eq(auditLog.actorId, args.actorId));
+            if (args.from)
+                conditions.push(gte(auditLog.createdAt, args.from));
+            if (args.to)
+                conditions.push(lte(auditLog.createdAt, args.to));
+            let query = db.select().from(auditLog).$dynamic();
+            if (conditions.length > 0) {
+                query = query.where(conditions.length === 1 ? conditions[0] : and(...conditions));
+            }
+            return query
+                .orderBy(desc(auditLog.createdAt))
+                .limit(args.limit ?? 50);
+        },
+    };
+}

package/dist/modules/cart/access.d.ts

@@ -0,0 +1,11 @@
+import type { Actor } from "../../auth/types.js";
+import type { Cart } from "./repository/index.js";
+/**
+ * Determines whether an actor can access a cart.
+ *
+ * Access is granted if:
+ * 1. The actor is authenticated and owns the cart (customerId match)
+ * 2. The provided secret matches the cart's secret (guest access)
+ */
+export declare function canAccessCart(actor: Actor | null, cart: Cart, providedSecret?: string): boolean;
+//# sourceMappingURL=access.d.ts.map

package/dist/modules/cart/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/modules/cart/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,IAAI,EAAE,IAAI,EACV,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAYT"}

package/dist/modules/cart/access.js

@@ -0,0 +1,18 @@
+/**
+ * Determines whether an actor can access a cart.
+ *
+ * Access is granted if:
+ * 1. The actor is authenticated and owns the cart (customerId match)
+ * 2. The provided secret matches the cart's secret (guest access)
+ */
+export function canAccessCart(actor, cart, providedSecret) {
+    // Authenticated owner
+    if (actor && cart.customerId && actor.userId === cart.customerId) {
+        return true;
+    }
+    // Valid secret (guest access)
+    if (providedSecret && cart.secret && providedSecret === cart.secret) {
+        return true;
+    }
+    return false;
+}

package/dist/modules/cart/matcher.d.ts

@@ -0,0 +1,20 @@
+import type { CartLineItem } from "./repository/index.js";
+/**
+ * Determines whether a new item matches an existing cart line item.
+ * Used by addItem to decide whether to increment quantity (match)
+ * or insert a new line (no match).
+ *
+ * The default matcher compares entityId + variantId.
+ * Developers selling customizable products (engraving, gift notes)
+ * can provide a custom matcher that includes metadata fields.
+ */
+export type CartItemMatcher = (args: {
+    existingItem: CartLineItem;
+    newItem: {
+        entityId: string;
+        variantId: string | null;
+        [key: string]: unknown;
+    };
+}) => boolean;
+export declare const defaultCartItemMatcher: CartItemMatcher;
+//# sourceMappingURL=matcher.d.ts.map

package/dist/modules/cart/matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.d.ts","sourceRoot":"","sources":["../../../src/modules/cart/matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH,KAAK,OAAO,CAAC;AAEd,eAAO,MAAM,sBAAsB,EAAE,eAKmB,CAAC"}

package/dist/modules/cart/matcher.js

@@ -0,0 +1,2 @@
+export const defaultCartItemMatcher = ({ existingItem, newItem, }) => existingItem.entityId === newItem.entityId &&
+    existingItem.variantId === (newItem.variantId ?? null);

package/dist/modules/cart/repository/index.d.ts

@@ -0,0 +1,45 @@
+import type { TxContext } from "../../../kernel/database/tx-context.js";
+import type { DrizzleDatabase } from "../../../kernel/database/drizzle-db.js";
+import { carts, cartLineItems } from "../schema.js";
+export type Cart = typeof carts.$inferSelect;
+export type CartInsert = typeof carts.$inferInsert;
+export type CartLineItem = typeof cartLineItems.$inferSelect;
+export type CartLineItemInsert = typeof cartLineItems.$inferInsert;
+/**
+ * CartRepository provides type-safe database operations for shopping carts.
+ *
+ * This repository manages carts and cart line items.
+ * All methods support an optional TxContext parameter for transaction participation.
+ */
+export declare class CartRepository {
+    private readonly db;
+    constructor(db: DrizzleDatabase);
+    private getDb;
+    findById(orgId: string, id: string, ctx?: TxContext): Promise<Cart | undefined>;
+    findByCustomerId(orgId: string, customerId: string, ctx?: TxContext): Promise<Cart | undefined>;
+    findActiveByCustomerId(orgId: string, customerId: string, ctx?: TxContext): Promise<Cart | undefined>;
+    findExpiredCarts(ctx?: TxContext): Promise<Cart[]>;
+    create(data: CartInsert, ctx?: TxContext): Promise<Cart>;
+    update(id: string, data: Partial<Omit<CartInsert, "id">>, ctx?: TxContext): Promise<Cart | undefined>;
+    updateStatus(id: string, status: Cart["status"], ctx?: TxContext): Promise<Cart | undefined>;
+    /**
+     * Atomically transitions a cart from "active" to "checking_out".
+     * Returns the updated cart if the transition succeeded, or undefined if
+     * the cart was not in "active" status (e.g., a concurrent checkout already
+     * claimed it). This prevents TOCTOU race conditions on double-checkout.
+     */
+    transitionToCheckingOut(id: string, ctx?: TxContext): Promise<Cart | undefined>;
+    delete(id: string, ctx?: TxContext): Promise<boolean>;
+    findLineItemById(id: string, ctx?: TxContext): Promise<CartLineItem | undefined>;
+    findLineItemsByCartId(cartId: string, ctx?: TxContext): Promise<CartLineItem[]>;
+    findLineItemByEntity(cartId: string, entityId: string, variantId?: string, ctx?: TxContext): Promise<CartLineItem | undefined>;
+    createLineItem(data: CartLineItemInsert, ctx?: TxContext): Promise<CartLineItem>;
+    updateLineItem(id: string, data: Partial<Omit<CartLineItemInsert, "id">>, ctx?: TxContext): Promise<CartLineItem | undefined>;
+    deleteLineItem(id: string, ctx?: TxContext): Promise<boolean>;
+    deleteLineItemsByCartId(cartId: string, ctx?: TxContext): Promise<void>;
+    findWithLineItems(orgId: string, id: string, ctx?: TxContext): Promise<{
+        cart: Cart;
+        lineItems: CartLineItem[];
+    } | undefined>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/cart/repository/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/cart/repository/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAC7C,MAAM,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AACnD,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC7D,MAAM,MAAM,kBAAkB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAEnE;;;;;GAKG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,eAAe;IAEhD,OAAO,CAAC,KAAK;IAQP,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAS/E,gBAAgB,CACpB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAStB,sBAAsB,CAC1B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAStB,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAQlD,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxD,MAAM,CACV,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EACrC,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAUtB,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EACtB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI5B;;;;;OAKG;IACG,uBAAuB,CAC3B,EAAE,EAAE,MAAM,EACV,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAUtB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAUrD,gBAAgB,CACpB,EAAE,EAAE,MAAM,EACV,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAS9B,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,YAAY,EAAE,CAAC;IAQpB,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAoB9B,cAAc,CAClB,IAAI,EAAE,kBAAkB,EACxB,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,YAAY,CAAC;IAMlB,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,EAC7C,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAU9B,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAS7D,uBAAuB,CAC3B,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC,IAAI,CAAC;IASV,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,GAAG,CAAC,EAAE,SAAS,GACd,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,GAAG,SAAS,CAAC;CAMlE"}

package/dist/modules/cart/repository/index.js

@@ -0,0 +1,158 @@
+import { eq, and, lt } from "drizzle-orm";
+import { carts, cartLineItems } from "../schema.js";
+/**
+ * CartRepository provides type-safe database operations for shopping carts.
+ *
+ * This repository manages carts and cart line items.
+ * All methods support an optional TxContext parameter for transaction participation.
+ */
+export class CartRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    getDb(ctx) {
+        return ctx?.tx ?? this.db;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Carts
+    // ─────────────────────────────────────────────────────────────────────────────
+    async findById(orgId, id, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db
+            .select()
+            .from(carts)
+            .where(and(eq(carts.organizationId, orgId), eq(carts.id, id)));
+        return rows[0];
+    }
+    async findByCustomerId(orgId, customerId, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db
+            .select()
+            .from(carts)
+            .where(and(eq(carts.organizationId, orgId), eq(carts.customerId, customerId), eq(carts.status, "active")));
+        return rows[0];
+    }
+    async findActiveByCustomerId(orgId, customerId, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db
+            .select()
+            .from(carts)
+            .where(and(eq(carts.organizationId, orgId), eq(carts.customerId, customerId), eq(carts.status, "active")));
+        return rows[0];
+    }
+    async findExpiredCarts(ctx) {
+        const db = this.getDb(ctx);
+        return db
+            .select()
+            .from(carts)
+            .where(and(eq(carts.status, "active"), lt(carts.expiresAt, new Date())));
+    }
+    async create(data, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db.insert(carts).values(data).returning();
+        return rows[0];
+    }
+    async update(id, data, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db
+            .update(carts)
+            .set({ ...data, updatedAt: new Date() })
+            .where(eq(carts.id, id))
+            .returning();
+        return rows[0];
+    }
+    async updateStatus(id, status, ctx) {
+        return this.update(id, { status }, ctx);
+    }
+    /**
+     * Atomically transitions a cart from "active" to "checking_out".
+     * Returns the updated cart if the transition succeeded, or undefined if
+     * the cart was not in "active" status (e.g., a concurrent checkout already
+     * claimed it). This prevents TOCTOU race conditions on double-checkout.
+     */
+    async transitionToCheckingOut(id, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db
+            .update(carts)
+            .set({ status: "checking_out", updatedAt: new Date() })
+            .where(and(eq(carts.id, id), eq(carts.status, "active")))
+            .returning();
+        return rows[0];
+    }
+    async delete(id, ctx) {
+        const db = this.getDb(ctx);
+        const result = await db.delete(carts).where(eq(carts.id, id)).returning();
+        return result.length > 0;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Cart Line Items
+    // ─────────────────────────────────────────────────────────────────────────────
+    async findLineItemById(id, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db
+            .select()
+            .from(cartLineItems)
+            .where(eq(cartLineItems.id, id));
+        return rows[0];
+    }
+    async findLineItemsByCartId(cartId, ctx) {
+        const db = this.getDb(ctx);
+        return db
+            .select()
+            .from(cartLineItems)
+            .where(eq(cartLineItems.cartId, cartId));
+    }
+    async findLineItemByEntity(cartId, entityId, variantId, ctx) {
+        const db = this.getDb(ctx);
+        const conditions = [
+            eq(cartLineItems.cartId, cartId),
+            eq(cartLineItems.entityId, entityId),
+        ];
+        if (variantId !== undefined) {
+            conditions.push(eq(cartLineItems.variantId, variantId));
+        }
+        const rows = await db
+            .select()
+            .from(cartLineItems)
+            .where(and(...conditions));
+        // Filter for exact variantId match
+        return rows.find((r) => r.variantId === (variantId ?? null));
+    }
+    async createLineItem(data, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db.insert(cartLineItems).values(data).returning();
+        return rows[0];
+    }
+    async updateLineItem(id, data, ctx) {
+        const db = this.getDb(ctx);
+        const rows = await db
+            .update(cartLineItems)
+            .set(data)
+            .where(eq(cartLineItems.id, id))
+            .returning();
+        return rows[0];
+    }
+    async deleteLineItem(id, ctx) {
+        const db = this.getDb(ctx);
+        const result = await db
+            .delete(cartLineItems)
+            .where(eq(cartLineItems.id, id))
+            .returning();
+        return result.length > 0;
+    }
+    async deleteLineItemsByCartId(cartId, ctx) {
+        const db = this.getDb(ctx);
+        await db.delete(cartLineItems).where(eq(cartLineItems.cartId, cartId));
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // Cart with Line Items (Aggregate)
+    // ─────────────────────────────────────────────────────────────────────────────
+    async findWithLineItems(orgId, id, ctx) {
+        const cart = await this.findById(orgId, id, ctx);
+        if (!cart)
+            return undefined;
+        const lineItems = await this.findLineItemsByCartId(id, ctx);
+        return { cart, lineItems };
+    }
+}