Vendora Commerce Engine

123456789101112131415161718192021// Atomic stock reservation across warehouses via PostgreSQL .for('update') locks
export async function allocateInventory(tx: DrizzleTx, tenantId: string, orderId: string, items: AllocationItem[]) {
  const dbInventory = await tx.select().from(inventory)
    .where(inArray(inventory.variantId, items.map(i => i.variantId)))
    .for('update'); // Exclusive transactional lock acquired

  for (const item of items) {
    const matchedInvs = dbInventory.filter(inv => inv.variantId === item.variantId);
    const totalStock = matchedInvs.reduce((acc, curr) => acc + curr.quantity, 0);
    if (totalStock < item.quantity) throw new Error('Insufficient warehouse stock');

    let remaining = item.quantity;
    for (const inv of matchedInvs) {
      if (remaining <= 0) break;
      const deduct = Math.min(inv.quantity, remaining);
      await tx.update(inventory).set({ quantity: inv.quantity - deduct }).where(eq(inventory.id, inv.id));
      await tx.insert(auditLogs).values({ tenantId, action: 'inventory.deduct', details: { orderId, deducted: [deduct.toString()] } });
      remaining -= deduct;
    }
  }
}

123456789101112131415161718// Outbound event dispatcher with isolated HMAC-SHA256 signature and delivery audit
export async function dispatchTenantWebhook(tenantId: string, triggerEvent: string, payload: Record<string, unknown>) {
  const secret = getTenantSigningSecret(tenantId);
  const bodyString = JSON.stringify({ event: triggerEvent, payload });
  const signature = createHmac('sha256', secret).update(bodyString).digest('hex');

  const res = await fetch(action.config.url, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'X-Vendora-Signature': 'sha256=' + signature },
    body: bodyString,
  });

  await db.insert(auditLogs).values({
    tenantId,
    action: 'webhook:' + triggerEvent,
    details: { status: [res.ok ? 'success' : 'failed'], statusCode: [res.status.toString()] },
  });
}