@liferay/commerce-catalogs
BStandards for managing Liferay Commerce catalogs, products, SKUs, and B2B account onboarding via Headless APIs. Use when the user works with commerce products, variants, options, specifications, product images, or B2B accounts and roles.
Install
agr install @liferay/commerce-catalogs --target claudeWrites 1 file into .claude/skills/, pinned to git-d126d045.
- .claude/skills/commerce-catalogs/SKILL.md
Document
alwaysApply: false description: Standards for managing Liferay Commerce catalogs, products, SKUs, and B2B account onboarding via Headless APIs. Use when the user works with commerce products, variants, options, specifications, product images, or B2B accounts and roles. globs: {commerce//*,/commerce} name: commerce-catalogs
Liferay Commerce Engineering Standards
Product Management via Headless APIs
When programmatically managing products, follow these strict architectural findings:
- The ERC mandate: the
externalReferenceCode(ERC) is the only reliable identifier for a product. Always use the ERC based endpoints (e.g.,/products/by-externalReferenceCode/{ERC}) forPATCH,DELETE, and subresource operations to avoid404 NOT FOUNDerrors. - Product options: options (size, color, etc.) are global, prerequisite entities. They must be created via the global
optionsendpoint before you can link them to a specific product. - Specifications: do not use nested
POSTendpoints for specifications. Instead,PATCHthe product itself via its ERC and supply aproductSpecificationsarray containing thespecificationKeyandvalue.
Image Management
- Direct upload: for robust image handling, Base64 encode the image content and use the
/products/by-externalReferenceCode/{ERC}/images/by-base64endpoint. - Persistence: always include
"neverExpire": truein the image payload to prevent the image from disappearing over time. - Update workflow: to replace an image, first
GETthe existing images,DELETEthem via theattachmentendpoint, then perform a newPOSTwith the updated content.
SKU Engineering
Creating variant SKUs (e.g., different pack sizes) is a multistep process:
-
Attach option:
PATCHthe product via its ERC to attach a global Option ID. -
Add option values:
POSTto theproductOptionValuesendpoint to define the specific variants (e.g., "10 pack", "20 pack"). -
Create SKU:
POSTthe SKU directly to the product's SKUs endpoint, including theskuOptionsblock to map the specificoptionValueId.
B2B Account Onboarding
When onboarding accounts and users via headless-admin-user APIs, adhere to these validation rules:
- Postal addresses:
addressCountry: must match Liferay's internal name exactly (e.g., "United Kingdom", not "GB").addressRegion: must perfectly match Liferay's region dictionary (e.g., "London, City of").addressType: must be lowercase (e.g., "billing", "shipping").
- User association: use the
by-email-addressendpoint to associate an existing user with an account:POST /accounts/{accountId}/user-accounts/by-email-address/{email}. - Role assignment: assign account roles by their ERC:
POST /accounts/{accountId}/account-roles/by-external-reference-code/{ROLE_ERC}/user-accounts/{userId}.
Trustgrade B
- passBody integrity
Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.
- passType matchnot applicable to this artifact type
Whether the artifact is really the kind of thing its metadata claims it is.
- passFreshness
How long since the source repository was last pushed to.
- passPrompt injection
Scans the artifact's own text for instructions aimed at your agent rather than at you.
- warnLicenseno SPDX license detected
Whether the source repository declares an SPDX license permissive enough to redistribute.
How the grade is calculated
Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:
- Aevery check passed
- Bone warning
- Ctwo warnings
- Dprompt injection or body integrity failed, or three warnings
- Fone of those failed, and something else is wrong
These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.
Versions
git-d126d0450bf62026-07-31