@zaamx/netme-pos 0.0.16 → 0.0.18

package/.medusa/server/src/api/store/netme-pos/draft-orders/[id]/route.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+exports.POST = POST;
+exports.DELETE = DELETE;
+const utils_1 = require("@medusajs/framework/utils");
+const core_flows_1 = require("@medusajs/medusa/core-flows");
+/**
+ * `/store/netme-pos/draft-orders/:id` (spec §7.3–§7.5). Ownership is enforced
+ * upstream by the `ensureDraftOrderAgent` middleware.
+ */
+async function GET(req, res) {
+    const workflow = (0, core_flows_1.getOrderDetailWorkflow)(req.scope);
+    const { result } = await workflow.run({
+        input: {
+            fields: req.queryConfig.fields,
+            order_id: req.params.id,
+            version: req.validatedQuery?.version,
+            filters: {
+                is_draft_order: true,
+            },
+        },
+    });
+    res.status(200).json({ draft_order: result });
+}
+async function POST(req, res) {
+    const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    await (0, core_flows_1.updateDraftOrderWorkflow)(req.scope).run({
+        input: {
+            ...req.validatedBody,
+            user_id: req.auth_context.actor_id,
+            id: req.params.id,
+        },
+    });
+    const result = await query.graph({
+        entity: "order",
+        filters: { id: req.params.id },
+        fields: req.queryConfig.fields,
+    });
+    res.status(200).json({ draft_order: result.data[0] });
+}
+async function DELETE(req, res) {
+    const { id } = req.params;
+    await (0, core_flows_1.deleteDraftOrdersWorkflow)(req.scope).run({
+        input: {
+            order_ids: [id],
+        },
+    });
+    // Hygiene: drop the attribution row for this agent ↔ draft pair.
+    const link = req.scope.resolve(utils_1.ContainerRegistrationKeys.LINK);
+    await link
+        .dismiss({
+        [utils_1.Modules.CUSTOMER]: { customer_id: req.auth_context.actor_id },
+        [utils_1.Modules.ORDER]: { order_id: id },
+    })
+        .catch(() => void 0);
+    res.status(200).json({
+        id,
+        object: "draft-order",
+        deleted: true,
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL25ldG1lLXBvcy9kcmFmdC1vcmRlcnMvW2lkXS9yb3V0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQW9CQSxrQkFpQkM7QUFFRCxvQkFxQkM7QUFFRCx3QkEwQkM7QUFwRkQscURBR2tDO0FBQ2xDLDREQUlvQztBQUdwQzs7O0dBR0c7QUFFSSxLQUFLLFVBQVUsR0FBRyxDQUN2QixHQUErQixFQUMvQixHQUFtQjtJQUVuQixNQUFNLFFBQVEsR0FBRyxJQUFBLG1DQUFzQixFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUNsRCxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxRQUFRLENBQUMsR0FBRyxDQUFDO1FBQ3BDLEtBQUssRUFBRTtZQUNMLE1BQU0sRUFBRSxHQUFHLENBQUMsV0FBVyxDQUFDLE1BQU07WUFDOUIsUUFBUSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRTtZQUN2QixPQUFPLEVBQUcsR0FBRyxDQUFDLGNBQXNCLEVBQUUsT0FBTztZQUM3QyxPQUFPLEVBQUU7Z0JBQ1AsY0FBYyxFQUFFLElBQUk7YUFDckI7U0FDRjtLQUNGLENBQUMsQ0FBQTtJQUVGLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUE7QUFDL0MsQ0FBQztBQUVNLEtBQUssVUFBVSxJQUFJLENBQ3hCLEdBQTBELEVBQzFELEdBQW1CO0lBRW5CLE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBRWhFLE1BQU0sSUFBQSxxQ0FBd0IsRUFBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDO1FBQzVDLEtBQUssRUFBRTtZQUNMLEdBQUcsR0FBRyxDQUFDLGFBQWE7WUFDcEIsT0FBTyxFQUFFLEdBQUcsQ0FBQyxZQUFZLENBQUMsUUFBUTtZQUNsQyxFQUFFLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFO1NBQ1g7S0FDVCxDQUFDLENBQUE7SUFFRixNQUFNLE1BQU0sR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDL0IsTUFBTSxFQUFFLE9BQU87UUFDZixPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUU7UUFDOUIsTUFBTSxFQUFFLEdBQUcsQ0FBQyxXQUFXLENBQUMsTUFBTTtLQUMvQixDQUFDLENBQUE7SUFFRixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLFdBQVcsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQTtBQUN2RCxDQUFDO0FBRU0sS0FBSyxVQUFVLE1BQU0sQ0FDMUIsR0FBK0IsRUFDL0IsR0FBbUI7SUFFbkIsTUFBTSxFQUFFLEVBQUUsRUFBRSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUE7SUFFekIsTUFBTSxJQUFBLHNDQUF5QixFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUM7UUFDN0MsS0FBSyxFQUFFO1lBQ0wsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDO1NBQ2hCO0tBQ0YsQ0FBQyxDQUFBO0lBRUYsaUVBQWlFO0lBQ2pFLE1BQU0sSUFBSSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLElBQUksQ0FBQyxDQUFBO0lBQzlELE1BQU0sSUFBSTtTQUNQLE9BQU8sQ0FBQztRQUNQLENBQUMsZUFBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsV0FBVyxFQUFFLEdBQUcsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFO1FBQzlELENBQUMsZUFBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRTtLQUNsQyxDQUFDO1NBQ0QsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUE7SUFFdEIsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDbkIsRUFBRTtRQUNGLE1BQU0sRUFBRSxhQUFhO1FBQ3JCLE9BQU8sRUFBRSxJQUFJO0tBQ2QsQ0FBQyxDQUFBO0FBQ0osQ0FBQyJ9

package/.medusa/server/src/api/store/netme-pos/draft-orders/guards.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findAgentDraftOrder = findAgentDraftOrder;
+exports.assertAgentDraftOrder = assertAgentDraftOrder;
+exports.ensureDraftOrderAgent = ensureDraftOrderAgent;
+const utils_1 = require("@medusajs/framework/utils");
+const agent_draft_order_1 = __importDefault(require("../../../../links/agent-draft-order"));
+/**
+ * Ownership guard (spec §3.3): every `/store/netme-pos/draft-orders/:id*`
+ * request must come from the AGENT that created the draft (link table
+ * `mlm_agent_draft_order`), and the order must still be a draft.
+ *
+ * Failure is always a 404 (never 403) so existence isn't leaked.
+ */
+const DRAFT_ORDER_ID_REGEX = /\/store\/netme-pos\/draft-orders\/([^/?#]+)/;
+const VERIFIED_KEY = "__netmePosVerifiedDraftOrderId";
+const notFound = (orderId) => new utils_1.MedusaError(utils_1.MedusaError.Types.NOT_FOUND, `Draft order with id ${orderId} was not found`);
+/**
+ * Resolve the draft order `orderId` ONLY if it belongs to agent `actorId`
+ * (link row exists) and is still a draft. Returns `null` otherwise.
+ */
+async function findAgentDraftOrder(scope, actorId, orderId) {
+    const query = scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    const [{ data: links }, { data: orders }] = await Promise.all([
+        query.graph({
+            entity: agent_draft_order_1.default.entryPoint,
+            filters: { customer_id: actorId, order_id: orderId },
+            fields: ["order_id"],
+        }),
+        query.graph({
+            entity: "order",
+            filters: { id: orderId },
+            fields: ["id", "customer_id", "region_id", "is_draft_order"],
+        }),
+    ]);
+    const order = orders?.[0];
+    if (!links?.length || !order?.is_draft_order) {
+        return null;
+    }
+    return order;
+}
+/** Same as `findAgentDraftOrder` but throws the standard 404. */
+async function assertAgentDraftOrder(scope, actorId, orderId) {
+    const order = await findAgentDraftOrder(scope, actorId, orderId);
+    if (!order) {
+        throw notFound(orderId);
+    }
+    return order;
+}
+async function ensureDraftOrderAgent(req, _res, next) {
+    try {
+        const orderId = req.originalUrl.match(DRAFT_ORDER_ID_REGEX)?.[1];
+        if (!orderId) {
+            // List / create — no :id to guard here.
+            return next();
+        }
+        const actorId = req.auth_context?.actor_id;
+        if (!actorId) {
+            throw new utils_1.MedusaError(utils_1.MedusaError.Types.UNAUTHORIZED, "Customer authentication required");
+        }
+        const decodedId = decodeURIComponent(orderId);
+        // The guard may be mounted more than once on nested matchers — dedupe.
+        if (req[VERIFIED_KEY] === decodedId) {
+            return next();
+        }
+        await assertAgentDraftOrder(req.scope, actorId, decodedId);
+        req[VERIFIED_KEY] = decodedId;
+        return next();
+    }
+    catch (e) {
+        return next(e);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ3VhcmRzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS9zdG9yZS9uZXRtZS1wb3MvZHJhZnQtb3JkZXJzL2d1YXJkcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQXlDQSxrREEwQkM7QUFHRCxzREFVQztBQUVELHNEQWtDQztBQTlHRCxxREFHa0M7QUFDbEMsNEZBQXFFO0FBRXJFOzs7Ozs7R0FNRztBQUVILE1BQU0sb0JBQW9CLEdBQUcsNkNBQTZDLENBQUE7QUFFMUUsTUFBTSxZQUFZLEdBQUcsZ0NBQWdDLENBQUE7QUFTckQsTUFBTSxRQUFRLEdBQUcsQ0FBQyxPQUFlLEVBQUUsRUFBRSxDQUNuQyxJQUFJLG1CQUFXLENBQ2IsbUJBQVcsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUMzQix1QkFBdUIsT0FBTyxnQkFBZ0IsQ0FDL0MsQ0FBQTtBQUVIOzs7R0FHRztBQUNJLEtBQUssVUFBVSxtQkFBbUIsQ0FDdkMsS0FBc0IsRUFDdEIsT0FBZSxFQUNmLE9BQWU7SUFFZixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBRTVELE1BQU0sQ0FBQyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxHQUFHLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUM1RCxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ1YsTUFBTSxFQUFFLDJCQUFtQixDQUFDLFVBQVU7WUFDdEMsT0FBTyxFQUFFLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFO1lBQ3BELE1BQU0sRUFBRSxDQUFDLFVBQVUsQ0FBQztTQUNyQixDQUFDO1FBQ0YsS0FBSyxDQUFDLEtBQUssQ0FBQztZQUNWLE1BQU0sRUFBRSxPQUFPO1lBQ2YsT0FBTyxFQUFFLEVBQUUsRUFBRSxFQUFFLE9BQU8sRUFBRTtZQUN4QixNQUFNLEVBQUUsQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQztTQUM3RCxDQUFDO0tBQ0gsQ0FBQyxDQUFBO0lBRUYsTUFBTSxLQUFLLEdBQUcsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFnQyxDQUFBO0lBQ3hELElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLGNBQWMsRUFBRSxDQUFDO1FBQzdDLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFBO0FBQ2QsQ0FBQztBQUVELGlFQUFpRTtBQUMxRCxLQUFLLFVBQVUscUJBQXFCLENBQ3pDLEtBQXNCLEVBQ3RCLE9BQWUsRUFDZixPQUFlO0lBRWYsTUFBTSxLQUFLLEdBQUcsTUFBTSxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBQ2hFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNYLE1BQU0sUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFBO0lBQ3pCLENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQTtBQUNkLENBQUM7QUFFTSxLQUFLLFVBQVUscUJBQXFCLENBQ3pDLEdBQStCLEVBQy9CLElBQW9CLEVBQ3BCLElBQXdCO0lBRXhCLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLEdBQUcsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQTtRQUNoRSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYix3Q0FBd0M7WUFDeEMsT0FBTyxJQUFJLEVBQUUsQ0FBQTtRQUNmLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxHQUFHLENBQUMsWUFBWSxFQUFFLFFBQVEsQ0FBQTtRQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5QixrQ0FBa0MsQ0FDbkMsQ0FBQTtRQUNILENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsQ0FBQTtRQUU3Qyx1RUFBdUU7UUFDdkUsSUFBSyxHQUFXLENBQUMsWUFBWSxDQUFDLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDN0MsT0FBTyxJQUFJLEVBQUUsQ0FBQTtRQUNmLENBQUM7UUFFRCxNQUFNLHFCQUFxQixDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUN6RDtRQUFDLEdBQVcsQ0FBQyxZQUFZLENBQUMsR0FBRyxTQUFTLENBQUE7UUFFdkMsT0FBTyxJQUFJLEVBQUUsQ0FBQTtJQUNmLENBQUM7SUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ1gsT0FBTyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDaEIsQ0FBQztBQUNILENBQUMifQ==

package/.medusa/server/src/api/store/netme-pos/draft-orders/helpers.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refetchOrder = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+/**
+ * Port of the admin draft-orders `refetchOrder` helper: reload the (draft)
+ * order with the request's resolved `fields` after a mutation.
+ */
+const refetchOrder = async (orderId, scope, fields) => {
+    const query = scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    const { data: orders } = await query.graph({
+        entity: "order",
+        filters: { id: orderId },
+        fields,
+    });
+    return orders[0];
+};
+exports.refetchOrder = refetchOrder;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uLy4uL3NyYy9hcGkvc3RvcmUvbmV0bWUtcG9zL2RyYWZ0LW9yZGVycy9oZWxwZXJzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHFEQUFxRTtBQUVyRTs7O0dBR0c7QUFDSSxNQUFNLFlBQVksR0FBRyxLQUFLLEVBQy9CLE9BQWUsRUFDZixLQUFzQixFQUN0QixNQUFnQixFQUNoQixFQUFFO0lBQ0YsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxpQ0FBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUU1RCxNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQztRQUN6QyxNQUFNLEVBQUUsT0FBTztRQUNmLE9BQU8sRUFBRSxFQUFFLEVBQUUsRUFBRSxPQUFPLEVBQUU7UUFDeEIsTUFBTTtLQUNQLENBQUMsQ0FBQTtJQUVGLE9BQU8sTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFBO0FBQ2xCLENBQUMsQ0FBQTtBQWRZLFFBQUEsWUFBWSxnQkFjeEIifQ==

package/.medusa/server/src/api/store/netme-pos/draft-orders/pricing.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveGroupPricingContext = resolveGroupPricingContext;
+exports.buildResolvedLineItems = buildResolvedLineItems;
+const http_1 = require("@medusajs/framework/http");
+const utils_1 = require("@medusajs/framework/utils");
+/**
+ * Build the pricing context for the TARGET customer of the draft order
+ * (port of `setPricingContextFromCustomer`, minus the middleware plumbing):
+ * region → currency, customer → customer-group ids (price lists per group).
+ */
+async function resolveGroupPricingContext(scope, { customerId, regionId }) {
+    const region = await (0, http_1.refetchEntity)({
+        entity: "region",
+        idOrFilter: regionId,
+        scope,
+        fields: ["id", "currency_code"],
+        options: { cache: { enable: true } },
+    });
+    if (!region) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Region with id ${regionId} not found when populating the pricing context`);
+    }
+    const pricingContext = {
+        region_id: region.id,
+        currency_code: region.currency_code,
+    };
+    if (customerId) {
+        const { data: customerGroups } = await (0, http_1.refetchEntities)({
+            entity: "customer_group",
+            idOrFilter: { customers: { id: customerId } },
+            scope,
+            fields: ["id"],
+        });
+        pricingContext.customer = {
+            groups: customerGroups.map((cg) => ({ id: cg.id })),
+        };
+    }
+    return pricingContext;
+}
+/**
+ * Resolve `calculated_price` for a set of variants under a pricing context.
+ * Returns a map `variant_id -> calculated_price` (may miss variants that
+ * don't exist / have no price).
+ */
+async function resolveVariantPrices(scope, variantIds, pricingContext) {
+    const query = scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    const { data: products } = await query.graph({
+        entity: "product",
+        fields: ["id", "variants.id", "variants.calculated_price.*"],
+        filters: { variants: { id: variantIds } },
+        context: {
+            variants: { calculated_price: (0, utils_1.QueryContext)(pricingContext) },
+        },
+    });
+    const priceByVariantId = new Map();
+    for (const product of products) {
+        for (const variant of product.variants ?? []) {
+            if (variant?.id) {
+                priceByVariantId.set(variant.id, variant.calculated_price ?? null);
+            }
+        }
+    }
+    return priceByVariantId;
+}
+/** The `variantOverridePrice` rule: price-list price or nothing. */
+const priceListUnitPrice = (calculatedPrice) => {
+    if (calculatedPrice?.is_calculated_price_price_list === true) {
+        return calculatedPrice.calculated_amount;
+    }
+    return undefined;
+};
+/**
+ * Build line items ready for `addDraftOrderItemsWorkflow` /
+ * `createOrderWorkflow` from the client's structural declaration (§5):
+ *
+ * - normal line:   `unit_price` = group price if price-list, else omitted.
+ * - bundle parent: same price rule + bundle metadata (`bundle_id`,
+ *   `bundle_type: "parent"`, `bundle_meta`, `bundle_sticks_price`).
+ * - bundle child:  `unit_price` = 0 ALWAYS + `bundled_by` / `bundle_type: "child"`.
+ *
+ * Client metadata is merged but can never override the bundle keys.
+ */
+async function buildResolvedLineItems(scope, { customerId, regionId, items, }) {
+    const variantIds = [...new Set(items.map((i) => i.variant_id))];
+    const pricingContext = await resolveGroupPricingContext(scope, {
+        customerId,
+        regionId,
+    });
+    const priceByVariantId = await resolveVariantPrices(scope, variantIds, pricingContext);
+    const missing = variantIds.filter((id) => !priceByVariantId.has(id));
+    if (missing.length) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Variants not found: ${missing.join(", ")}`);
+    }
+    return items.map((item) => {
+        const calculatedPrice = priceByVariantId.get(item.variant_id);
+        const resolved = {
+            variant_id: item.variant_id,
+            quantity: item.quantity,
+        };
+        if (item.allow_backorder !== undefined) {
+            resolved.allow_backorder = item.allow_backorder;
+        }
+        // Client metadata first: bundle keys below always win.
+        const metadata = { ...(item.metadata ?? {}) };
+        delete metadata.bundle_id;
+        delete metadata.bundled_by;
+        delete metadata.bundle_type;
+        if (item.bundle?.role === "child") {
+            // Children are ALWAYS free; the parent carries the package price.
+            resolved.unit_price = 0;
+            metadata.bundled_by = item.bundle.bundle_id;
+            metadata.bundle_type = "child";
+        }
+        else {
+            const unitPrice = priceListUnitPrice(calculatedPrice);
+            if (unitPrice !== undefined) {
+                resolved.unit_price = unitPrice;
+            }
+            if (item.bundle?.role === "parent") {
+                metadata.bundle_id = item.bundle.bundle_id;
+                metadata.bundle_type = "parent";
+                if (item.bundle.bundle_meta !== undefined) {
+                    metadata.bundle_meta = item.bundle.bundle_meta;
+                }
+                if (item.bundle.bundle_sticks_price !== undefined) {
+                    metadata.bundle_sticks_price = item.bundle.bundle_sticks_price;
+                }
+            }
+        }
+        if (Object.keys(metadata).length) {
+            resolved.metadata = metadata;
+        }
+        return resolved;
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpY2luZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uLy4uL3NyYy9hcGkvc3RvcmUvbmV0bWUtcG9zL2RyYWZ0LW9yZGVycy9wcmljaW5nLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBZ0RBLGdFQXNDQztBQXNERCx3REFnRkM7QUE1TkQsbURBQXlFO0FBRXpFLHFEQUlrQztBQXFDbEM7Ozs7R0FJRztBQUNJLEtBQUssVUFBVSwwQkFBMEIsQ0FDOUMsS0FBc0IsRUFDdEIsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUE0QztJQUVsRSxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUEsb0JBQWEsRUFBQztRQUNqQyxNQUFNLEVBQUUsUUFBUTtRQUNoQixVQUFVLEVBQUUsUUFBUTtRQUNwQixLQUFLO1FBQ0wsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLGVBQWUsQ0FBQztRQUMvQixPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUU7S0FDckMsQ0FBQyxDQUFBO0lBRUYsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ1osTUFBTSxJQUFJLG1CQUFXLENBQ25CLG1CQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksRUFDOUIsa0JBQWtCLFFBQVEsZ0RBQWdELENBQzNFLENBQUE7SUFDSCxDQUFDO0lBRUQsTUFBTSxjQUFjLEdBQW1CO1FBQ3JDLFNBQVMsRUFBRSxNQUFNLENBQUMsRUFBRTtRQUNwQixhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWE7S0FDcEMsQ0FBQTtJQUVELElBQUksVUFBVSxFQUFFLENBQUM7UUFDZixNQUFNLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxHQUFHLE1BQU0sSUFBQSxzQkFBZSxFQUFDO1lBQ3JELE1BQU0sRUFBRSxnQkFBZ0I7WUFDeEIsVUFBVSxFQUFFLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxFQUFFO1lBQzdDLEtBQUs7WUFDTCxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUM7U0FDZixDQUFDLENBQUE7UUFFRixjQUFjLENBQUMsUUFBUSxHQUFHO1lBQ3hCLE1BQU0sRUFBRSxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBa0IsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztTQUNwRSxDQUFBO0lBQ0gsQ0FBQztJQUVELE9BQU8sY0FBYyxDQUFBO0FBQ3ZCLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsS0FBSyxVQUFVLG9CQUFvQixDQUNqQyxLQUFzQixFQUN0QixVQUFvQixFQUNwQixjQUE4QjtJQUU5QixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBRTVELE1BQU0sRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1FBQzNDLE1BQU0sRUFBRSxTQUFTO1FBQ2pCLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxhQUFhLEVBQUUsNkJBQTZCLENBQUM7UUFDNUQsT0FBTyxFQUFFLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxFQUFFO1FBQ3pDLE9BQU8sRUFBRTtZQUNQLFFBQVEsRUFBRSxFQUFFLGdCQUFnQixFQUFFLElBQUEsb0JBQVksRUFBQyxjQUFjLENBQUMsRUFBRTtTQUM3RDtLQUNGLENBQUMsQ0FBQTtJQUVGLE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxHQUFHLEVBQWUsQ0FBQTtJQUMvQyxLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQy9CLEtBQUssTUFBTSxPQUFPLElBQUksT0FBTyxDQUFDLFFBQVEsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUM3QyxJQUFJLE9BQU8sRUFBRSxFQUFFLEVBQUUsQ0FBQztnQkFDaEIsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsT0FBTyxDQUFDLGdCQUFnQixJQUFJLElBQUksQ0FBQyxDQUFBO1lBQ3BFLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVELE9BQU8sZ0JBQWdCLENBQUE7QUFDekIsQ0FBQztBQUVELG9FQUFvRTtBQUNwRSxNQUFNLGtCQUFrQixHQUFHLENBQUMsZUFBb0IsRUFBc0IsRUFBRTtJQUN0RSxJQUFJLGVBQWUsRUFBRSw4QkFBOEIsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUM3RCxPQUFPLGVBQWUsQ0FBQyxpQkFBMkIsQ0FBQTtJQUNwRCxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUE7QUFDbEIsQ0FBQyxDQUFBO0FBRUQ7Ozs7Ozs7Ozs7R0FVRztBQUNJLEtBQUssVUFBVSxzQkFBc0IsQ0FDMUMsS0FBc0IsRUFDdEIsRUFDRSxVQUFVLEVBQ1YsUUFBUSxFQUNSLEtBQUssR0FLTjtJQUVELE1BQU0sVUFBVSxHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFBO0lBRS9ELE1BQU0sY0FBYyxHQUFHLE1BQU0sMEJBQTBCLENBQUMsS0FBSyxFQUFFO1FBQzdELFVBQVU7UUFDVixRQUFRO0tBQ1QsQ0FBQyxDQUFBO0lBRUYsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLG9CQUFvQixDQUNqRCxLQUFLLEVBQ0wsVUFBVSxFQUNWLGNBQWMsQ0FDZixDQUFBO0lBRUQsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQTtJQUNwRSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNuQixNQUFNLElBQUksbUJBQVcsQ0FDbkIsbUJBQVcsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUM5Qix1QkFBdUIsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUM1QyxDQUFBO0lBQ0gsQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFO1FBQ3hCLE1BQU0sZUFBZSxHQUFHLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUE7UUFFN0QsTUFBTSxRQUFRLEdBQTJCO1lBQ3ZDLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVTtZQUMzQixRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVE7U0FDeEIsQ0FBQTtRQUVELElBQUksSUFBSSxDQUFDLGVBQWUsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN2QyxRQUFRLENBQUMsZUFBZSxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUE7UUFDakQsQ0FBQztRQUVELHVEQUF1RDtRQUN2RCxNQUFNLFFBQVEsR0FBNEIsRUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFBO1FBQ3RFLE9BQU8sUUFBUSxDQUFDLFNBQVMsQ0FBQTtRQUN6QixPQUFPLFFBQVEsQ0FBQyxVQUFVLENBQUE7UUFDMUIsT0FBTyxRQUFRLENBQUMsV0FBVyxDQUFBO1FBRTNCLElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDbEMsa0VBQWtFO1lBQ2xFLFFBQVEsQ0FBQyxVQUFVLEdBQUcsQ0FBQyxDQUFBO1lBQ3ZCLFFBQVEsQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUE7WUFDM0MsUUFBUSxDQUFDLFdBQVcsR0FBRyxPQUFPLENBQUE7UUFDaEMsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQyxlQUFlLENBQUMsQ0FBQTtZQUNyRCxJQUFJLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDNUIsUUFBUSxDQUFDLFVBQVUsR0FBRyxTQUFTLENBQUE7WUFDakMsQ0FBQztZQUVELElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQ25DLFFBQVEsQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUE7Z0JBQzFDLFFBQVEsQ0FBQyxXQUFXLEdBQUcsUUFBUSxDQUFBO2dCQUMvQixJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO29CQUMxQyxRQUFRLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFBO2dCQUNoRCxDQUFDO2dCQUNELElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxtQkFBbUIsS0FBSyxTQUFTLEVBQUUsQ0FBQztvQkFDbEQsUUFBUSxDQUFDLG1CQUFtQixHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsbUJBQW1CLENBQUE7Z0JBQ2hFLENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztRQUVELElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNqQyxRQUFRLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQTtRQUM5QixDQUFDO1FBRUQsT0FBTyxRQUFRLENBQUE7SUFDakIsQ0FBQyxDQUFDLENBQUE7QUFDSixDQUFDIn0=

package/.medusa/server/src/api/store/netme-pos/draft-orders/query-config.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Mirror of the admin draft-orders query config (2.14.2). Same entity
+ * (`order`), same default fields — the responses are meant to be identical to
+ * the admin set so the POS front can reuse its parsing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listTransformQueryConfig = exports.retrieveTransformQueryConfig = exports.defaultStoreDraftOrderFields = exports.defaultStoreDraftOrderListFields = void 0;
+exports.defaultStoreDraftOrderListFields = [
+    "id",
+    "display_id",
+    "custom_display_id",
+    "status",
+    "version",
+    "email",
+    "region_id",
+    "customer_id",
+    "*items",
+    "summary",
+    "total",
+    "metadata",
+    "created_at",
+    "updated_at",
+];
+exports.defaultStoreDraftOrderFields = [
+    "id",
+    "display_id",
+    "custom_display_id",
+    "status",
+    "version",
+    "email",
+    "region_id",
+    "customer_id",
+    "*items",
+    "*items.tax_lines",
+    "*items.adjustments",
+    "*items.detail",
+    "*items.variant",
+    "*items.variant.product",
+    "*shipping_address",
+    "*billing_address",
+    "*shipping_methods",
+    "*shipping_methods.tax_lines",
+    "*shipping_methods.adjustments",
+    "summary",
+    "total",
+    "metadata",
+    "created_at",
+    "updated_at",
+];
+exports.retrieveTransformQueryConfig = {
+    defaults: exports.defaultStoreDraftOrderFields,
+    isList: false,
+};
+exports.listTransformQueryConfig = {
+    defaults: exports.defaultStoreDraftOrderListFields,
+    defaultLimit: 20,
+    isList: true,
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicXVlcnktY29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vLi4vLi4vc3JjL2FwaS9zdG9yZS9uZXRtZS1wb3MvZHJhZnQtb3JkZXJzL3F1ZXJ5LWNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQUE7Ozs7R0FJRzs7O0FBRVUsUUFBQSxnQ0FBZ0MsR0FBRztJQUM5QyxJQUFJO0lBQ0osWUFBWTtJQUNaLG1CQUFtQjtJQUNuQixRQUFRO0lBQ1IsU0FBUztJQUNULE9BQU87SUFDUCxXQUFXO0lBQ1gsYUFBYTtJQUNiLFFBQVE7SUFDUixTQUFTO0lBQ1QsT0FBTztJQUNQLFVBQVU7SUFDVixZQUFZO0lBQ1osWUFBWTtDQUNiLENBQUE7QUFFWSxRQUFBLDRCQUE0QixHQUFHO0lBQzFDLElBQUk7SUFDSixZQUFZO0lBQ1osbUJBQW1CO0lBQ25CLFFBQVE7SUFDUixTQUFTO0lBQ1QsT0FBTztJQUNQLFdBQVc7SUFDWCxhQUFhO0lBQ2IsUUFBUTtJQUNSLGtCQUFrQjtJQUNsQixvQkFBb0I7SUFDcEIsZUFBZTtJQUNmLGdCQUFnQjtJQUNoQix3QkFBd0I7SUFDeEIsbUJBQW1CO0lBQ25CLGtCQUFrQjtJQUNsQixtQkFBbUI7SUFDbkIsNkJBQTZCO0lBQzdCLCtCQUErQjtJQUMvQixTQUFTO0lBQ1QsT0FBTztJQUNQLFVBQVU7SUFDVixZQUFZO0lBQ1osWUFBWTtDQUNiLENBQUE7QUFFWSxRQUFBLDRCQUE0QixHQUFHO0lBQzFDLFFBQVEsRUFBRSxvQ0FBNEI7SUFDdEMsTUFBTSxFQUFFLEtBQUs7Q0FDZCxDQUFBO0FBRVksUUFBQSx3QkFBd0IsR0FBRztJQUN0QyxRQUFRLEVBQUUsd0NBQWdDO0lBQzFDLFlBQVksRUFBRSxFQUFFO0lBQ2hCLE1BQU0sRUFBRSxJQUFJO0NBQ2IsQ0FBQSJ9

package/.medusa/server/src/api/store/netme-pos/draft-orders/route.js

@@ -0,0 +1,140 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET = GET;
+exports.POST = POST;
+const utils_1 = require("@medusajs/framework/utils");
+const core_flows_1 = require("@medusajs/medusa/core-flows");
+const agent_draft_order_1 = __importDefault(require("../../../../links/agent-draft-order"));
+const ensure_agent_can_act_for_1 = require("../../../../workflows/ensure-agent-can-act-for");
+const helpers_1 = require("./helpers");
+/**
+ * `/store/netme-pos/draft-orders` — store mirror of `GET/POST /admin/draft-orders`
+ * (spec §7.1–§7.2). Same core-flows workflows; auth is the AGENT customer and
+ * every listing is scoped to the agent's own drafts via `mlm_agent_draft_order`.
+ */
+async function GET(req, res) {
+    const actorId = req.auth_context.actor_id;
+    const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    const pagination = req.queryConfig.pagination;
+    // Agent scoping (never list without it — spec §7.2): resolve the agent's
+    // order ids from the link table and intersect with any client `id` filter.
+    const { data: linkRows } = await query.graph({
+        entity: agent_draft_order_1.default.entryPoint,
+        filters: { customer_id: actorId },
+        fields: ["order_id"],
+    });
+    let orderIds = [
+        ...new Set(linkRows.map((row) => row.order_id).filter(Boolean)),
+    ];
+    const requestedId = req.filterableFields.id;
+    if ((0, utils_1.isPresent)(requestedId)) {
+        const requested = Array.isArray(requestedId) ? requestedId : [requestedId];
+        orderIds = orderIds.filter((id) => requested.includes(id));
+    }
+    if (!orderIds.length) {
+        res.json({
+            draft_orders: [],
+            count: 0,
+            offset: pagination.skip ?? 0,
+            limit: pagination.take ?? 20,
+        });
+        return;
+    }
+    const variables = {
+        filters: {
+            ...req.filterableFields,
+            id: orderIds,
+            is_draft_order: true,
+        },
+        ...req.queryConfig.pagination,
+    };
+    const workflow = (0, core_flows_1.getOrdersListWorkflow)(req.scope);
+    const { result } = await workflow.run({
+        input: {
+            fields: req.queryConfig.fields,
+            variables,
+        },
+    });
+    const { rows, metadata } = result;
+    res.json({
+        draft_orders: rows,
+        count: metadata.count,
+        offset: metadata.skip,
+        limit: metadata.take,
+    });
+}
+async function POST(req, res) {
+    const actorId = req.auth_context.actor_id;
+    const input = req.validatedBody;
+    const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    // MLM policy (§3.2) — also resolves the target's email for the order.
+    const { result: policy } = await (0, ensure_agent_can_act_for_1.ensureAgentCanActForWorkflow)(req.scope).run({
+        input: {
+            agent_customer_id: actorId,
+            target_customer_id: input.customer_id,
+        },
+    });
+    // Currency from the region (same fallback the admin route performs).
+    const { data: regions } = await query.graph({
+        entity: "region",
+        filters: { id: input.region_id },
+        fields: ["id", "currency_code"],
+    });
+    const region = regions[0];
+    if (!region) {
+        throw new utils_1.MedusaError(utils_1.MedusaError.Types.INVALID_DATA, `Region with id ${input.region_id} was not found`);
+    }
+    // Sales channel comes from the publishable key (never from the client);
+    // fall back to the store default when the key isn't channel-scoped.
+    let salesChannelId = req.publishable_key_context?.sales_channel_ids?.[0];
+    if (!salesChannelId) {
+        const { data: stores } = await query.graph({
+            entity: "store",
+            fields: ["id", "default_sales_channel_id"],
+        });
+        salesChannelId = stores[0]?.default_sales_channel_id ?? undefined;
+    }
+    const workflowInput = {
+        ...input,
+        email: policy.target.email,
+        currency_code: region.currency_code,
+        sales_channel_id: salesChannelId,
+        no_notification: true,
+        status: utils_1.OrderStatus.DRAFT,
+        is_draft_order: true,
+    };
+    // Address ids may arrive as plain strings (same contract as admin).
+    if (typeof input.billing_address === "string") {
+        workflowInput.billing_address_id = input.billing_address;
+        delete workflowInput.billing_address;
+    }
+    if (typeof input.shipping_address === "string") {
+        workflowInput.shipping_address_id = input.shipping_address;
+        delete workflowInput.shipping_address;
+    }
+    const { result } = await (0, core_flows_1.createOrderWorkflow)(req.scope).run({
+        input: workflowInput,
+    });
+    // Attribution (§3.1 option B): agent ↔ draft order. If the link cannot be
+    // created the draft would be orphaned (invisible to every agent), so roll
+    // the order back and surface the error.
+    const link = req.scope.resolve(utils_1.ContainerRegistrationKeys.LINK);
+    try {
+        await link.create({
+            [utils_1.Modules.CUSTOMER]: { customer_id: actorId },
+            [utils_1.Modules.ORDER]: { order_id: result.id },
+        });
+    }
+    catch (e) {
+        await (0, core_flows_1.deleteDraftOrdersWorkflow)(req.scope)
+            .run({ input: { order_ids: [result.id] } })
+            .catch(() => void 0);
+        throw e;
+    }
+    const draftOrder = await (0, helpers_1.refetchOrder)(result.id, req.scope, req.queryConfig.fields);
+    res.status(200).json({ draft_order: draftOrder });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL25ldG1lLXBvcy9kcmFmdC1vcmRlcnMvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUEyQkEsa0JBZ0VDO0FBRUQsb0JBd0ZDO0FBakxELHFEQU1rQztBQUNsQyw0REFJb0M7QUFDcEMsNEZBQXFFO0FBQ3JFLDZGQUE2RjtBQUM3Rix1Q0FBd0M7QUFHeEM7Ozs7R0FJRztBQUVJLEtBQUssVUFBVSxHQUFHLENBQ3ZCLEdBQStCLEVBQy9CLEdBQW1CO0lBRW5CLE1BQU0sT0FBTyxHQUFHLEdBQUcsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFBO0lBQ3pDLE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ2hFLE1BQU0sVUFBVSxHQUFHLEdBQUcsQ0FBQyxXQUFXLENBQUMsVUFHbEMsQ0FBQTtJQUVELHlFQUF5RTtJQUN6RSwyRUFBMkU7SUFDM0UsTUFBTSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDM0MsTUFBTSxFQUFFLDJCQUFtQixDQUFDLFVBQVU7UUFDdEMsT0FBTyxFQUFFLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRTtRQUNqQyxNQUFNLEVBQUUsQ0FBQyxVQUFVLENBQUM7S0FDckIsQ0FBQyxDQUFBO0lBRUYsSUFBSSxRQUFRLEdBQUc7UUFDYixHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFRLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7S0FDekQsQ0FBQTtJQUViLE1BQU0sV0FBVyxHQUFHLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFtQyxDQUFBO0lBQzVFLElBQUksSUFBQSxpQkFBUyxFQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDM0IsTUFBTSxTQUFTLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxDQUFBO1FBQzFFLFFBQVEsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUE7SUFDNUQsQ0FBQztJQUVELElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDckIsR0FBRyxDQUFDLElBQUksQ0FBQztZQUNQLFlBQVksRUFBRSxFQUFFO1lBQ2hCLEtBQUssRUFBRSxDQUFDO1lBQ1IsTUFBTSxFQUFFLFVBQVUsQ0FBQyxJQUFJLElBQUksQ0FBQztZQUM1QixLQUFLLEVBQUUsVUFBVSxDQUFDLElBQUksSUFBSSxFQUFFO1NBQzdCLENBQUMsQ0FBQTtRQUNGLE9BQU07SUFDUixDQUFDO0lBRUQsTUFBTSxTQUFTLEdBQUc7UUFDaEIsT0FBTyxFQUFFO1lBQ1AsR0FBRyxHQUFHLENBQUMsZ0JBQWdCO1lBQ3ZCLEVBQUUsRUFBRSxRQUFRO1lBQ1osY0FBYyxFQUFFLElBQUk7U0FDckI7UUFDRCxHQUFHLEdBQUcsQ0FBQyxXQUFXLENBQUMsVUFBVTtLQUM5QixDQUFBO0lBRUQsTUFBTSxRQUFRLEdBQUcsSUFBQSxrQ0FBcUIsRUFBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDakQsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sUUFBUSxDQUFDLEdBQUcsQ0FBQztRQUNwQyxLQUFLLEVBQUU7WUFDTCxNQUFNLEVBQUUsR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNO1lBQzlCLFNBQVM7U0FDVjtLQUNGLENBQUMsQ0FBQTtJQUVGLE1BQU0sRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLEdBQUcsTUFBYSxDQUFBO0lBRXhDLEdBQUcsQ0FBQyxJQUFJLENBQUM7UUFDUCxZQUFZLEVBQUUsSUFBSTtRQUNsQixLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUs7UUFDckIsTUFBTSxFQUFFLFFBQVEsQ0FBQyxJQUFJO1FBQ3JCLEtBQUssRUFBRSxRQUFRLENBQUMsSUFBSTtLQUNyQixDQUFDLENBQUE7QUFDSixDQUFDO0FBRU0sS0FBSyxVQUFVLElBQUksQ0FDeEIsR0FBMEQsRUFDMUQsR0FBbUI7SUFFbkIsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUE7SUFDekMsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLGFBQWEsQ0FBQTtJQUMvQixNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxpQ0FBeUIsQ0FBQyxLQUFLLENBQUMsQ0FBQTtJQUVoRSxzRUFBc0U7SUFDdEUsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLElBQUEsdURBQTRCLEVBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsQ0FBQztRQUMzRSxLQUFLLEVBQUU7WUFDTCxpQkFBaUIsRUFBRSxPQUFPO1lBQzFCLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxXQUFXO1NBQ3RDO0tBQ0YsQ0FBQyxDQUFBO0lBRUYscUVBQXFFO0lBQ3JFLE1BQU0sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxDQUFDO1FBQzFDLE1BQU0sRUFBRSxRQUFRO1FBQ2hCLE9BQU8sRUFBRSxFQUFFLEVBQUUsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFO1FBQ2hDLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSxlQUFlLENBQUM7S0FDaEMsQ0FBQyxDQUFBO0lBQ0YsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFBO0lBQ3pCLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNaLE1BQU0sSUFBSSxtQkFBVyxDQUNuQixtQkFBVyxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQzlCLGtCQUFrQixLQUFLLENBQUMsU0FBUyxnQkFBZ0IsQ0FDbEQsQ0FBQTtJQUNILENBQUM7SUFFRCx3RUFBd0U7SUFDeEUsb0VBQW9FO0lBQ3BFLElBQUksY0FBYyxHQUFHLEdBQUcsQ0FBQyx1QkFBdUIsRUFBRSxpQkFBaUIsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFBO0lBQ3hFLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNwQixNQUFNLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQztZQUN6QyxNQUFNLEVBQUUsT0FBTztZQUNmLE1BQU0sRUFBRSxDQUFDLElBQUksRUFBRSwwQkFBMEIsQ0FBQztTQUMzQyxDQUFDLENBQUE7UUFDRixjQUFjLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLHdCQUF3QixJQUFJLFNBQVMsQ0FBQTtJQUNuRSxDQUFDO0lBRUQsTUFBTSxhQUFhLEdBQTRCO1FBQzdDLEdBQUcsS0FBSztRQUNSLEtBQUssRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUs7UUFDMUIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxhQUFhO1FBQ25DLGdCQUFnQixFQUFFLGNBQWM7UUFDaEMsZUFBZSxFQUFFLElBQUk7UUFDckIsTUFBTSxFQUFFLG1CQUFXLENBQUMsS0FBSztRQUN6QixjQUFjLEVBQUUsSUFBSTtLQUNyQixDQUFBO0lBRUQsb0VBQW9FO0lBQ3BFLElBQUksT0FBTyxLQUFLLENBQUMsZUFBZSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzlDLGFBQWEsQ0FBQyxrQkFBa0IsR0FBRyxLQUFLLENBQUMsZUFBZSxDQUFBO1FBQ3hELE9BQU8sYUFBYSxDQUFDLGVBQWUsQ0FBQTtJQUN0QyxDQUFDO0lBQ0QsSUFBSSxPQUFPLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMvQyxhQUFhLENBQUMsbUJBQW1CLEdBQUcsS0FBSyxDQUFDLGdCQUFnQixDQUFBO1FBQzFELE9BQU8sYUFBYSxDQUFDLGdCQUFnQixDQUFBO0lBQ3ZDLENBQUM7SUFFRCxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsTUFBTSxJQUFBLGdDQUFtQixFQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUM7UUFDMUQsS0FBSyxFQUFFLGFBQW9CO0tBQzVCLENBQUMsQ0FBQTtJQUVGLDBFQUEwRTtJQUMxRSwwRUFBMEU7SUFDMUUsd0NBQXdDO0lBQ3hDLE1BQU0sSUFBSSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLElBQUksQ0FBQyxDQUFBO0lBQzlELElBQUksQ0FBQztRQUNILE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQztZQUNoQixDQUFDLGVBQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUU7WUFDNUMsQ0FBQyxlQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsRUFBRTtTQUN6QyxDQUFDLENBQUE7SUFDSixDQUFDO0lBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNYLE1BQU0sSUFBQSxzQ0FBeUIsRUFBQyxHQUFHLENBQUMsS0FBSyxDQUFDO2FBQ3ZDLEdBQUcsQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLFNBQVMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7YUFDMUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUE7UUFDdEIsTUFBTSxDQUFDLENBQUE7SUFDVCxDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsTUFBTSxJQUFBLHNCQUFZLEVBQ25DLE1BQU0sQ0FBQyxFQUFFLEVBQ1QsR0FBRyxDQUFDLEtBQUssRUFDVCxHQUFHLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FDdkIsQ0FBQTtJQUVELEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsV0FBVyxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUE7QUFDbkQsQ0FBQyJ9