spree-shipstation 5.0.0 → 6.0.0

data/app/views/spree/shipstation/export.xml.builder

@@ -1,8 +1,8 @@
 xml.instruct!
 
 xml.Orders(pages: @pagy.pages) do
-  @shipments.each do |shipment|
-    order = Spree::Shipstation::Export::OrderPresenter.new(shipment)
+  @fulfillments.each do |fulfillment|
+    order = Spree::Shipstation::Export::OrderPresenter.new(fulfillment)
 
     xml.Order do
       xml.OrderID order.order_id
@@ -27,13 +27,15 @@ xml.Orders(pages: @pagy.pages) do
       xml.Items do
         order.items.each do |item|
           weight = item.weight
-          image = item.image
+          # The thumbnail may be a video. Its still image is the poster, and is
+          # nil for an embedded video, which has no attachment to link to.
+          still_image = item.image&.still_image
 
           xml.Item do
             xml.SKU item.sku
             xml.Name item.name
 
-            image_url = image && url_for(image.attachment)
+            image_url = still_image && url_for(still_image)
             xml.ImageUrl image_url if image_url
 
             xml.Weight weight.value
@@ -43,10 +45,10 @@ xml.Orders(pages: @pagy.pages) do
 
             if item.option_values.present?
               xml.Options do
-                item.option_values.each do |value|
+                item.option_values.each do |name, value|
                   xml.Option do
-                    xml.Name value.option_type.presentation
-                    xml.Value value.name
+                    xml.Name name
+                    xml.Value value
                   end
                 end
               end

data/config/initializers/spree.rb

@@ -1,3 +1,7 @@
+# frozen_string_literal: true
+
+# Spree resolves registered entries to classes itself, so the class name string
+# avoids loading the model before the app has finished booting.
 Rails.application.config.after_initialize do
-  Rails.application.config.spree.integrations << Spree::Integrations::Shipstation
+  Spree.integrations << "Spree::Integrations::Shipstation"
 end

data/config/locales/en.yml

@@ -1,15 +1,14 @@
 ---
 en:
   spree:
+    integrations:
+      shipstation:
+        description: Integrate with ShipStation to automate your shipping workflows from a single dashboard.
     admin:
       integrations:
         shipstation:
+          brand_name: ShipStation
           must_contain_at_least_one_special_character: must contain at least one special character
           must_contain_at_least_one_uppercase_letter: must contain at least one uppercase letter
           must_contain_at_least_one_number: must contain at least one number
           username_chars_error: can only contain letters, numbers, and . _ @ + -
-          username: Username
-          password: Password
-          brand_name: ShipStation
-          description: Integrate with ShipStation to automate your shipping workflows from a single dashboard.
-          capture_at_notification: Capture payment when shipment notification received from ShipStation

data/config/routes.rb

@@ -1,6 +1,16 @@
 # frozen_string_literal: true
 
+# ShipStation pulls orders and posts ship notices to the same URL. The bare path
+# belongs to the default store. The path that names an integration (its prefixed
+# id) belongs to that integration's store, which is how a second store gets an
+# endpoint of its own.
+#
+# The export is XML whether or not the URL ends in +.xml+. Without the default,
+# a pull that sends a browser-like Accept header would be refused with a 406.
 Spree::Core::Engine.add_routes do
-  get "/shipstation", to: "shipstation#export"
-  post "/shipstation", to: "shipstation#shipnotify"
+  get "/shipstation(.:format)", to: "shipstation#export", defaults: {format: "xml"}
+  post "/shipstation(.:format)", to: "shipstation#shipnotify"
+
+  get "/shipstation/:integration_id(.:format)", to: "shipstation#export", defaults: {format: "xml"}
+  post "/shipstation/:integration_id(.:format)", to: "shipstation#shipnotify"
 end

data/lib/spree/shipstation/engine.rb

@@ -2,6 +2,10 @@
 
 module Spree
   module Shipstation
+    ##
+    # Rails engine for the ShipStation integration. It makes the gem's +app+ and
+    # +config+ directories part of the host application.
+    #
     class Engine < ::Rails::Engine
       require "spree/core"
       isolate_namespace Spree
@@ -14,19 +18,6 @@ module Spree
       config.generators do |g|
         g.test_framework :rspec
       end
-
-      initializer "spree_shipstation.assets" do |app|
-        app.config.assets.precompile += %w[spree_shipstation_manifest] if app.config.respond_to?(:assets)
-      end
-
-      def self.activate
-        # Three levels up from lib/spree/shipstation/ to reach the gem root.
-        Dir.glob(File.join(File.dirname(__FILE__), "../../../app/**/*_decorator*.rb")).sort.each do |c|
-          Rails.configuration.cache_classes ? require(c) : load(c)
-        end
-      end
-
-      config.to_prepare(&method(:activate).to_proc)
     end
   end
 end

data/lib/spree/shipstation/errors.rb

@@ -2,20 +2,70 @@
 
 module Spree
   module Shipstation
+    ##
+    # Base error for ShipStation integration failures returned as HTTP 400.
+    #
     class Error < StandardError; end
 
+    ##
+    # Raised when the shipnotify payload names a shipment that does not exist.
+    #
     class ShipmentNotFoundError < Error
+      ##
+      # @param shipment_number [String] the shipment number from the payload
+      #
       def initialize(shipment_number, *args)
         super("Could not find shipment with number #{shipment_number}", *args)
       end
     end
 
+    ##
+    # Raised when the ship notice's +OrderID+ names a fulfillment of a different
+    # order from the one its order number names.
+    #
+    class ShipmentMismatchError < Error
+      ##
+      # @param shipment_number [String] the order number from the notice
+      # @param shipment_id [Integer] the +OrderID+ from the notice
+      #
+      def initialize(shipment_number, shipment_id, *args)
+        super("Shipment #{shipment_number} does not match order id #{shipment_id}", *args)
+      end
+    end
+
+    ##
+    # Raised when the shipnotify payload names a shipment Spree has canceled.
+    #
+    class FulfillmentCanceledError < Error
+      ##
+      # @param shipment_number [String] the number of the canceled shipment
+      #
+      def initialize(shipment_number, *args)
+        super("Shipment #{shipment_number} is canceled", *args)
+      end
+    end
+
+    ##
+    # Raised when Spree refuses to fulfil the shipment, for instance because the
+    # order is not paid or holds backordered items. The message is Spree's own.
+    #
+    class FulfillmentRefusedError < Error; end
+
+    ##
+    # Raised when a payment cannot be captured during shipnotify.
+    #
     class PaymentError < Error
-      def initialize(payment, *args)
-        super("Could not process payment #{payment.id}", *args)
+      ##
+      # @param message [String] why the capture failed, as the gateway reported it
+      #
+      def initialize(message, *args)
+        super("Could not capture payment: #{message}", *args)
       end
     end
 
+    ##
+    # Raised when shipnotify is called without a tracking number.
+    #
     class MissingTrackingNumberError < Error
       def initialize(*args)
         super("Tracking number is required", *args)

data/lib/spree/shipstation/export_query.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+module Spree
+  module Shipstation
+    ##
+    # Selects the parcels ShipStation should pull: the store's fulfillments that
+    # Spree will let ship right now.
+    #
+    # Spree 6 keeps no "ready" status. A fulfillment is +unfulfilled+ until
+    # someone hands it over, and whether it can go out is decided when it is
+    # fulfilled. This query asks the same questions ahead of time, so ShipStation
+    # is not offered parcels that Spree would refuse at the ship notice. A parcel
+    # is exported when all of these hold:
+    #
+    # * it is one of the store's fulfillments and is still +unfulfilled+;
+    # * its order is placed, which leaves out drafts and canceled orders;
+    # * its order is paid: +paid+, +overcharged+ or +partially_refunded+, or it
+    #   owes nothing (+total = 0+, whose payment status stays +none+), or, on a
+    #   store that captures on dispatch or manually, it is +authorized+ or
+    #   +partially_paid+ (mixed tender: store credit captured at checkout, say,
+    #   and a card authorized for the rest). A payment method that overrides
+    #   the store's setting is not consulted;
+    # * none of its items is backordered;
+    # * its selected delivery method is not a pickup or a pickup point.
+    #
+    # These are most of Spree's fulfil checks, not all of them, so the ship
+    # notice may still be refused, with Spree's reason. Spree also checks, when
+    # the parcel is fulfilled, that the stock location has the units on hand,
+    # and it compares the net captured amount (net of refunds) with what was
+    # due: a partially refunded order is exported but may fall short, and a
+    # partially paid one ships only while the rest is authorized on payment
+    # methods that defer capture.
+    #
+    # @example
+    #   Spree::Shipstation::ExportQuery.new(store: store, from: 1.day.ago).call
+    #
+    class ExportQuery
+      PAID_STATUSES = %w[paid overcharged partially_refunded].freeze
+      private_constant :PAID_STATUSES
+
+      # Shippable as well when the store captures on dispatch or manually.
+      DEFERRED_CAPTURE_STATUSES = %w[authorized partially_paid].freeze
+      private_constant :DEFERRED_CAPTURE_STATUSES
+
+      PRELOADS = {
+        order: [:bill_address, :ship_address, :fulfillments],
+        selected_delivery_rate: :delivery_method,
+        fulfillment_items: {
+          line_item: {
+            variant: [{product: :primary_media}, :primary_media, {option_values: :option_type}]
+          }
+        }
+      }.freeze
+      private_constant :PRELOADS
+
+      ##
+      # @param store [Spree::Store] the store whose fulfillments are exported
+      # @param from [Time, NilClass] start of the date window
+      # @param to [Time, NilClass] end of the date window
+      #
+      def initialize(store:, from: nil, to: nil)
+        @store = store
+        @from = from
+        @to = to
+      end
+
+      ##
+      # The exportable parcels, oldest update first, with everything the export
+      # presenters read already loaded.
+      #
+      # A parcel falls in the window when its own +updated_at+ or its order's does.
+      # With neither +from+ nor +to+ there is no window, and with only one of them
+      # the window is open-ended.
+      #
+      # @return [ActiveRecord::Relation<Spree::Fulfillment>]
+      #
+      def call
+        within_window(shippable)
+          .reorder(updated_at: :asc, id: :asc)
+          .preload(PRELOADS)
+      end
+
+      private
+
+      attr_reader :store, :from, :to
+
+      def shippable
+        store.fulfillments
+          .unfulfilled
+          .merge(Spree::Order.placed_orders)
+          .merge(paid_orders)
+          .where.not(id: backordered_fulfillment_ids)
+          .where.not(id: pickup_fulfillment_ids)
+      end
+
+      # A free order's payment status stays +none+, but Spree ships it.
+      def paid_orders
+        Spree::Order.where(payment_status: paid_statuses).or(Spree::Order.where(total: 0))
+      end
+
+      # An order that is authorized, in full or for the part not captured at
+      # checkout, can ship when the store charges it at dispatch or leaves it to
+      # staff: Spree lets it through when every pending payment defers capture.
+      # On a store that captures at checkout, authorized money is not yet paid.
+      def paid_statuses
+        store.capture_at_checkout? ? PAID_STATUSES : PAID_STATUSES + DEFERRED_CAPTURE_STATUSES
+      end
+
+      # The +fulfillment_id IS NOT NULL+ guards matter: a single NULL in a +NOT IN+
+      # list makes the comparison unknown for every row, which would export nothing.
+      def backordered_fulfillment_ids
+        Spree::FulfillmentItem.backordered.where.not(fulfillment_id: nil).select(:fulfillment_id)
+      end
+
+      # Only the delivery method the customer chose counts. A parcel may carry a
+      # pickup rate among the options it was offered. Methods are read with
+      # deleted ones, since orders outlive the method they were placed with.
+      def pickup_fulfillment_ids
+        pickups = Spree::DeliveryMethod.with_deleted.with_provider(:pickup?)
+          .or(Spree::DeliveryMethod.with_deleted.with_provider(:pickup_point?))
+
+        Spree::DeliveryRate
+          .where(selected: true, delivery_method_id: pickups.select(:id))
+          .where.not(fulfillment_id: nil)
+          .select(:fulfillment_id)
+      end
+
+      def within_window(scope)
+        return scope if from.nil? && to.nil?
+
+        window = from..to
+        scope.where(updated_at: window).or(scope.where(Spree::Order.table_name => {updated_at: window}))
+      end
+    end
+  end
+end

data/lib/spree/shipstation/shipment_notice.rb

@@ -2,67 +2,218 @@
 
 module Spree
   module Shipstation
+    ##
+    # Applies a ShipStation shipnotify payload to a Spree fulfillment.
+    #
+    # The payload's order number is the +OrderNumber+ the export sent, which is a
+    # fulfillment's number, and its order id, when ShipStation sends one, is the
+    # +OrderID+ the export sent, which is the fulfillment's id. The notice
+    # resolves the fulfillment within the store:
+    #
+    # * without an order id, by its number: the number stored on a fulfillment
+    #   from before Spree 6, else the number Spree derives from its order;
+    # * with one, by that id, which is authoritative. A derived number is the
+    #   parcel's position in its order, so when Spree destroys an earlier parcel
+    #   (every item moved out of it) the later ones take new numbers, and an old
+    #   number may now name a sibling. The number still has to name the
+    #   fulfillment's order; a fulfillment that no longer exists is not found,
+    #   never matched on its number instead.
+    #
+    # Then, under the order's row lock (which serializes ShipStation's retries):
+    #
+    # * a fulfillment that is already fulfilled or delivered (or still carries
+    #   the 5.x +shipped+ status) only has its tracking recorded, so a retry or
+    #   a re-label does not fulfil it or publish the event again;
+    # * a canceled one is refused;
+    # * any other goes through Spree's fulfil workflow, which checks the order is
+    #   paid and in stock, records the tracking and carrier, captures payments
+    #   that capture on dispatch, and publishes +fulfillment.fulfilled+ with
+    #   +notify_customer+ set. The host app's subscriber to that event decides
+    #   whether, and how, to tell the customer.
+    #
+    # @example
+    #   Spree::Shipstation::ShipmentNotice.from_payload(
+    #     {order_number: "R1001-F1", order_id: 1001, tracking_number: "1Z999AA10123456784", carrier: "UPS"},
+    #     store: store
+    #   ).apply
+    #
     class ShipmentNotice
-      attr_reader :shipment_number, :shipment_tracking, :store
+      # Splits a derived fulfillment number into its order's number and its
+      # position. The order part is greedy, so an order number that itself ends
+      # in "-F9" still parses. Only the order is used: the parcel is matched on
+      # Spree's own derived number rather than on the position.
+      DERIVED_NUMBER = /\A(?<order>.+)-F(?<position>\d+)\z/
+      private_constant :DERIVED_NUMBER
+
+      attr_reader :shipment_number, :shipment_id, :shipment_tracking, :shipment_carrier, :store
 
       class << self
+        ##
+        # Builds a notice from the shipnotify webhook params.
+        #
+        # ShipStation's webhook param is named +order_number+ but its value is
+        # the fulfillment number — it mirrors the +<OrderNumber>+ field from the
+        # export XML. Likewise +order_id+ is the +<OrderID>+ field, the
+        # fulfillment's id, which ShipStation sends in the notice's XML body.
+        #
+        # @param params [Hash] webhook params: +:order_number+, +:tracking_number+,
+        #   and optionally +:carrier+ and +:order_id+
+        # @param store [Spree::Store] store that owns the fulfillment
+        # @return [Spree::Shipstation::ShipmentNotice]
+        #
         def from_payload(params, store:)
           new(
-            # ShipStation's webhook param is named `order_number` but its value is the
-            # shipment number — it mirrors the <OrderNumber> field from the export XML.
             shipment_number: params[:order_number],
+            shipment_id: params[:order_id],
             shipment_tracking: params[:tracking_number],
+            shipment_carrier: params[:carrier],
             store: store
           )
         end
       end
 
-      def initialize(shipment_number:, shipment_tracking:, store:)
+      ##
+      # @param shipment_number [String] Spree fulfillment number
+      # @param shipment_tracking [String] carrier tracking number
+      # @param store [Spree::Store] store that owns the fulfillment
+      # @param shipment_carrier [String, NilClass] ShipStation's carrier name
+      # @param shipment_id [Integer, NilClass] ShipStation's +OrderID+, the
+      #   fulfillment's id; when given, it decides which fulfillment is meant
+      #
+      def initialize(shipment_number:, shipment_tracking:, store:, shipment_carrier: nil, shipment_id: nil)
         @shipment_number = shipment_number
+        @shipment_id = shipment_id
         @shipment_tracking = shipment_tracking
+        @shipment_carrier = shipment_carrier
         @store = store
       end
 
+      ##
+      # Records the tracking number and fulfils the parcel, unless it already is.
+      #
+      # A gateway decline rolls back everything Spree wrote under the order lock,
+      # so the parcel stays unfulfilled, its payment stays pending and the retry
+      # starts from the same place.
+      #
+      # @return [Spree::Fulfillment] the updated fulfillment
+      # @raise [Spree::Shipstation::ShipmentNotFoundError] when the fulfillment is missing
+      # @raise [Spree::Shipstation::ShipmentMismatchError] when the order id names
+      #   a fulfillment of another order than the number does
+      # @raise [Spree::Shipstation::MissingTrackingNumberError] when tracking is blank
+      # @raise [Spree::Shipstation::FulfillmentCanceledError] when the fulfillment is canceled
+      # @raise [Spree::Shipstation::FulfillmentRefusedError] when Spree refuses to fulfil it
+      # @raise [Spree::Shipstation::PaymentError] when a payment cannot be captured
+      #
       def apply
-        raise ShipmentNotFoundError, shipment_number unless shipment
+        fulfillment = find_fulfillment
+        raise MissingTrackingNumberError if shipment_tracking.blank?
 
-        ::Spree::Shipment.transaction do
-          ship_shipment
+        fulfillment.order.with_lock do
+          # Reloaded under the lock: a retry that waited for it sees what the
+          # first request did.
+          fulfillment.reload
+          apply_to(fulfillment)
         end
-
-        shipment
+      rescue ::Spree::Core::GatewayError => e
+        # Rescued outside the lock, as Spree's own fulfil endpoint does. Inside
+        # it, the transaction would commit a fulfilled parcel whose capture failed.
+        raise PaymentError, e.message
       end
 
       private
 
-      def shipment
-        @shipment ||= store.shipments.find_by(number: shipment_number)
+      def find_fulfillment
+        # New fulfillments store no number, so looking up a blank one would match
+        # every one of them and fulfil an arbitrary parcel.
+        raise ShipmentNotFoundError, shipment_number if shipment_number.blank?
+        return find_by_shipment_id if shipment_id
+
+        find_by_stored_number || find_by_derived_number || raise(ShipmentNotFoundError, shipment_number)
       end
 
-      def ship_shipment
-        raise MissingTrackingNumberError if shipment_tracking.blank?
+      # The id is checked against the order the number names, which survives a
+      # renumbering even when the parcel's own derived number does not. It never
+      # falls back to the number: the parcel the id named may have been destroyed,
+      # and its number handed to a sibling.
+      def find_by_shipment_id
+        order = find_by_stored_number&.order || order_of_derived_number
+        raise ShipmentNotFoundError, shipment_number unless order
+
+        fulfillment = store.fulfillments.find_by(id: shipment_id)
+        raise ShipmentNotFoundError, shipment_number unless fulfillment
+        raise ShipmentMismatchError.new(shipment_number, shipment_id) unless fulfillment.order_id == order.id
+
+        fulfillment
+      end
+
+      # Parcels created before Spree 6 keep the number stored on them. Spree
+      # keeps the column only as legacy data, to be dropped in 6.1, which this
+      # gem's +~> 6.0+ admits; once it is gone, numbers are only derived.
+      def find_by_stored_number
+        return unless ::Spree::Fulfillment.column_names.include?("number")
+
+        store.fulfillments.find_by(number: shipment_number)
+      end
 
-        # Payment capture is performed synchronously, inside the webhook request and
-        # the surrounding transaction, so a capture failure aborts the ship and is
-        # reported back to ShipStation as an error (HTTP 400) rather than silently
-        # shipping an uncaptured order. ShipStation retries failed webhooks, so the
-        # operation is written to be safe to repeat: an already-shipped shipment is
-        # not re-shipped (see below) and capture only targets still-pending payments.
-        capture_pending_payments! if ::Spree::Config.auto_capture_on_dispatch
+      def find_by_derived_number
+        order_of_derived_number&.fulfillments&.detect { |fulfillment| fulfillment.number == shipment_number }
+      end
 
-        shipment.tracking = shipment_tracking
-        shipment.save!
+      # The store's order a derived number names, whether or not any of its
+      # parcels derives that number now.
+      def order_of_derived_number
+        match = DERIVED_NUMBER.match(shipment_number.to_s)
+        return unless match
 
-        shipment.ship! unless shipment.shipped?
+        store.orders.find_by(number: match[:order])
       end
 
-      def capture_pending_payments!
-        shipment.order.payments.pending.each do |payment|
-          payment.capture!
-        rescue ::Spree::Core::GatewayError
-          raise PaymentError.new(payment)
+      def apply_to(fulfillment)
+        if already_shipped?(fulfillment)
+          record_tracking(fulfillment)
+        elsif fulfillment.canceled?
+          raise FulfillmentCanceledError, fulfillment.number
+        else
+          fulfil(fulfillment)
         end
       end
+
+      # "shipped" is a 5.x status, left on a parcel until Spree's upgrade task
+      # (+spree:upgrade+) renames it "fulfilled". Such a parcel has gone out.
+      def already_shipped?(fulfillment)
+        fulfillment.fulfilled_or_delivered? || fulfillment.status == "shipped"
+      end
+
+      def record_tracking(fulfillment)
+        result = ::Spree.delivery_upsert_primary_service.call(
+          fulfillment: fulfillment, tracking: shipment_tracking, carrier: tracking_carrier
+        )
+        raise FulfillmentRefusedError, result.error.to_s if result.failure?
+
+        fulfillment.reload
+      end
+
+      # Never passes +items:+ or +force:+: a partial list would split the parcel
+      # and ship a new fulfillment under a different number, and forcing would
+      # ship an unpaid or backordered one.
+      def fulfil(fulfillment)
+        result = ::Spree.fulfillment_fulfill_workflow.call(
+          fulfillment: fulfillment,
+          tracking: shipment_tracking,
+          tracking_carrier: tracking_carrier,
+          notify_customer: true
+        )
+        raise FulfillmentRefusedError, result.error.to_s if result.failure?
+
+        result.value
+      end
+
+      # ShipStation's carrier name as a Spree.tracking_carriers key, or nil when
+      # Spree has no such carrier, in which case it detects one from the number.
+      def tracking_carrier
+        key = shipment_carrier.to_s.downcase.gsub(/[^a-z0-9]+/, "_").gsub(/\A_|_\z/, "")
+        key if ::Spree.tracking_carriers.key?(key)
+      end
     end
   end
 end

data/lib/spree/shipstation/testing_support/factories/shipstation_integration.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 FactoryBot.define do
   factory :shipstation_integration, class: Spree::Integrations::Shipstation do
     active { true }

data/lib/spree/shipstation/version.rb

@@ -2,9 +2,15 @@
 
 module Spree
   module Shipstation
-    # Major version tracks Spree's major version: 5.x supports Spree 5.x.
-    VERSION = "5.0.0"
+    # Major version tracks Spree's major version: 6.x supports Spree 6; 5.0.x
+    # lives on +5-0-stable+.
+    VERSION = "6.0.0"
 
+    ##
+    # Gem version as a comparable +Gem::Version+.
+    #
+    # @return [Gem::Version]
+    #
     def self.version
       Gem::Version.new(VERSION)
     end

data/lib/spree/shipstation.rb

@@ -3,9 +3,9 @@
 require "pagy"
 
 require "spree_core"
-require "spree_extension"
 
 require "spree/shipstation/version"
 require "spree/shipstation/engine"
 require "spree/shipstation/errors"
+require "spree/shipstation/export_query"
 require "spree/shipstation/shipment_notice"

data/spree-shipstation.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.version = Spree::Shipstation.version
   s.summary = "ShipStation integration for Spree e-commerce"
   s.description = "Connects Spree stores to ShipStation via an XML export endpoint and shipnotify webhook, enabling automated label creation and shipment tracking."
-  s.required_ruby_version = ">= 3.1"
+  s.required_ruby_version = ">= 3.3"
 
   s.author = "Matthew Kennedy"
   s.email = "m.kennedy@me.com"
@@ -25,12 +25,13 @@ Gem::Specification.new do |s|
     "rubygems_mfa_required" => "true"
   }
 
-  s.files = `git ls-files`.split("\n").reject { |f| f.match(/^spec/) && !f.match(%r{^spec/fixtures}) }
+  # The specs (all but their fixtures), the design docs, CI config and the agent
+  # guide stay in the repository, out of the gem.
+  s.files = `git ls-files`.split("\n").reject do |f|
+    (f.match(/^spec/) && !f.match(%r{^spec/fixtures})) || f.match(%r{^(docs|\.github)/}) || f == "CLAUDE.md"
+  end
   s.require_path = "lib"
 
-  spree_version = ">= 5.0", "< 6.0"
-
-  s.add_dependency "pagy", ">= 43.0", "< 45.0"
-  s.add_dependency "spree", spree_version
-  s.add_dependency "spree_extension"
+  s.add_dependency "pagy", ">= 43.6", "< 45"
+  s.add_dependency "spree", "~> 6.0"
 end