@mercurjs/core 2.3.2-canary.4 → 2.3.2

package/.medusa/server/src/patches/jest-transformer.d.ts

@@ -0,0 +1,14 @@
+type TransformOutput = {
+    code: string;
+};
+export declare function process(sourceText: string, sourcePath: string): TransformOutput;
+/**
+ * Editing a patch has to invalidate Jest's transform cache, or a stale entry
+ * serves the unpatched source and the suite quietly tests the wrong code.
+ */
+export declare function getCacheKey(sourceText: string, sourcePath: string): string;
+declare const _default: {
+    process: typeof process;
+    getCacheKey: typeof getCacheKey;
+};
+export default _default;

package/.medusa/server/src/patches/jest-transformer.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.process = process;
+exports.getCacheKey = getCacheKey;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const apply_patch_1 = require("./apply-patch");
+const manifest_1 = require("./manifest");
+function patchesFingerprint() {
+    const hash = (0, crypto_1.createHash)("sha1");
+    for (const entry of manifest_1.PATCHES) {
+        const patchFilePath = (0, path_1.join)(__dirname, "patches", entry.file);
+        hash.update(entry.file);
+        if ((0, fs_1.existsSync)(patchFilePath)) {
+            hash.update((0, fs_1.readFileSync)(patchFilePath));
+        }
+    }
+    return hash.digest("hex");
+}
+function process(sourceText, sourcePath) {
+    return { code: (0, apply_patch_1.patchSourceForPath)(sourcePath, sourceText) ?? sourceText };
+}
+/**
+ * Editing a patch has to invalidate Jest's transform cache, or a stale entry
+ * serves the unpatched source and the suite quietly tests the wrong code.
+ */
+function getCacheKey(sourceText, sourcePath) {
+    return (0, crypto_1.createHash)("sha1")
+        .update(sourceText)
+        .update(sourcePath)
+        .update(patchesFingerprint())
+        .digest("hex");
+}
+exports.default = { process, getCacheKey };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiamVzdC10cmFuc2Zvcm1lci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9wYXRjaGVzL2plc3QtdHJhbnNmb3JtZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUF1Q0EsMEJBS0M7QUFNRCxrQ0FNQztBQXhERCxtQ0FBbUM7QUFDbkMsMkJBQTZDO0FBQzdDLCtCQUEyQjtBQUUzQiwrQ0FBa0Q7QUFDbEQseUNBQW9DO0FBb0JwQyxTQUFTLGtCQUFrQjtJQUN6QixNQUFNLElBQUksR0FBRyxJQUFBLG1CQUFVLEVBQUMsTUFBTSxDQUFDLENBQUE7SUFFL0IsS0FBSyxNQUFNLEtBQUssSUFBSSxrQkFBTyxFQUFFLENBQUM7UUFDNUIsTUFBTSxhQUFhLEdBQUcsSUFBQSxXQUFJLEVBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUE7UUFDNUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUE7UUFDdkIsSUFBSSxJQUFBLGVBQVUsRUFBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1lBQzlCLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBQSxpQkFBWSxFQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUE7UUFDMUMsQ0FBQztJQUNILENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUE7QUFDM0IsQ0FBQztBQUVELFNBQWdCLE9BQU8sQ0FDckIsVUFBa0IsRUFDbEIsVUFBa0I7SUFFbEIsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFBLGdDQUFrQixFQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQTtBQUMzRSxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsU0FBZ0IsV0FBVyxDQUFDLFVBQWtCLEVBQUUsVUFBa0I7SUFDaEUsT0FBTyxJQUFBLG1CQUFVLEVBQUMsTUFBTSxDQUFDO1NBQ3RCLE1BQU0sQ0FBQyxVQUFVLENBQUM7U0FDbEIsTUFBTSxDQUFDLFVBQVUsQ0FBQztTQUNsQixNQUFNLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztTQUM1QixNQUFNLENBQUMsS0FBSyxDQUFDLENBQUE7QUFDbEIsQ0FBQztBQUVELGtCQUFlLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxDQUFBIn0=

package/.medusa/server/src/patches/loader.d.ts

@@ -0,0 +1,21 @@
+import type { PatchedFile } from "./apply-patch";
+/**
+ * Files whose patched source was compiled in place of the original. Registering
+ * an override only takes effect if the module is required afterwards, so this
+ * is the difference between a patch being staged and a patch being live.
+ */
+export declare function compiledPaths(): string[];
+export declare function isAlreadyLoaded(absolutePath: string): boolean;
+export declare function isOverridden(absolutePath: string): boolean;
+export declare function registerOverrides(packageDir: string, files: PatchedFile[], resolve: (packageDir: string, relativePath: string) => string): void;
+export declare function purgeFiles(absolutePaths: string[]): void;
+/**
+ * Compiles the patched sources now, so the override is what the process holds.
+ *
+ * Re-running a module that calls `createWorkflow` hits Medusa's duplicate guard,
+ * which only lets a workflow re-register when its step definition is byte-equal
+ * — and step ids are generated, so a second load of the same file is not. The
+ * reload replays the same source, so replacing the previous definition is the
+ * correct outcome; `register` is swapped for the duration to say so.
+ */
+export declare function reload(packageDir: string, absolutePaths: string[]): void;

package/.medusa/server/src/patches/loader.js

@@ -0,0 +1,124 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compiledPaths = compiledPaths;
+exports.isAlreadyLoaded = isAlreadyLoaded;
+exports.isOverridden = isOverridden;
+exports.registerOverrides = registerOverrides;
+exports.purgeFiles = purgeFiles;
+exports.reload = reload;
+const module_1 = __importDefault(require("module"));
+const path_1 = require("path");
+const internals = module_1.default;
+/** Absolute file path -> patched source, consulted on every `.js` load. */
+const overrides = new Map();
+/** Paths whose patched source was actually compiled, not merely registered. */
+const compiled = new Set();
+let installed = false;
+// Patches are applied in memory rather than written to `node_modules`: a server
+// boot has no business mutating installed packages, workers would race each
+// other doing it, and a file already required cannot be un-required cleanly.
+// Intercepting the loader keeps the change scoped to this process.
+function install() {
+    if (installed)
+        return;
+    const original = internals._extensions[".js"];
+    internals._extensions[".js"] = function (module, filename) {
+        const patched = overrides.get(filename);
+        if (patched !== undefined) {
+            module._compile(patched, filename);
+            compiled.add(filename);
+            return;
+        }
+        original(module, filename);
+    };
+    installed = true;
+}
+/**
+ * Files whose patched source was compiled in place of the original. Registering
+ * an override only takes effect if the module is required afterwards, so this
+ * is the difference between a patch being staged and a patch being live.
+ */
+function compiledPaths() {
+    return [...compiled];
+}
+function isAlreadyLoaded(absolutePath) {
+    return Object.prototype.hasOwnProperty.call(require.cache, absolutePath);
+}
+function isOverridden(absolutePath) {
+    return overrides.has(absolutePath);
+}
+function registerOverrides(packageDir, files, resolve) {
+    install();
+    for (const file of files) {
+        overrides.set(resolve(packageDir, file.relativePath), file.source);
+    }
+}
+// `withMercur()` runs from `medusa-config`, which is not always the first thing
+// to pull in a target package — `@medusajs/test-utils` requires core-flows
+// before it loads the config. A module already in the cache would keep its
+// unpatched source forever, so the patched files are evicted and required again
+// through the override above.
+//
+// Only the patched files are dropped, never the whole package: re-running an
+// arbitrary core-flows module re-enters `createWorkflow`, and workflows whose
+// step ids are generated rather than literal do not survive a second
+// registration ("step definition already exists").
+function purgeFiles(absolutePaths) {
+    for (const filename of absolutePaths) {
+        const cached = require.cache[filename];
+        if (!cached)
+            continue;
+        delete require.cache[filename];
+        // Parents keep `children` arrays pointing at the evicted module; leaving it
+        // there keeps the stale exports reachable through the module graph.
+        for (const parent of Object.values(require.cache)) {
+            const index = parent?.children?.indexOf(cached) ?? -1;
+            if (index !== -1)
+                parent.children.splice(index, 1);
+        }
+    }
+}
+/**
+ * Compiles the patched sources now, so the override is what the process holds.
+ *
+ * Re-running a module that calls `createWorkflow` hits Medusa's duplicate guard,
+ * which only lets a workflow re-register when its step definition is byte-equal
+ * — and step ids are generated, so a second load of the same file is not. The
+ * reload replays the same source, so replacing the previous definition is the
+ * correct outcome; `register` is swapped for the duration to say so.
+ */
+function reload(packageDir, absolutePaths) {
+    const manager = loadWorkflowManager(packageDir);
+    const original = manager?.register;
+    if (manager && original) {
+        manager.register = function register(workflowId, ...rest) {
+            manager.unregister(workflowId);
+            return original.call(this, workflowId, ...rest);
+        };
+    }
+    try {
+        for (const filename of absolutePaths) {
+            require(filename);
+        }
+    }
+    finally {
+        if (manager && original)
+            manager.register = original;
+    }
+}
+// Resolved from the patched package, not from `@mercurjs/core`: bun and pnpm
+// give each dependent its own copy, and a `WorkflowManager` from a different
+// copy holds a different registry than the one `createWorkflow` writes to.
+function loadWorkflowManager(packageDir) {
+    try {
+        const requireFrom = module_1.default.createRequire((0, path_1.join)(packageDir, "index.js"));
+        return requireFrom("@medusajs/orchestration").WorkflowManager;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9hZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3BhdGNoZXMvbG9hZGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBZ0RBLHNDQUVDO0FBRUQsMENBRUM7QUFFRCxvQ0FFQztBQUVELDhDQVVDO0FBWUQsZ0NBY0M7QUFnQkQsd0JBa0JDO0FBbElELG9EQUEyQjtBQUMzQiwrQkFBMkI7QUFVM0IsTUFBTSxTQUFTLEdBQUcsZ0JBQW9DLENBQUE7QUFFdEQsMkVBQTJFO0FBQzNFLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUFrQixDQUFBO0FBRTNDLCtFQUErRTtBQUMvRSxNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFBO0FBRWxDLElBQUksU0FBUyxHQUFHLEtBQUssQ0FBQTtBQUVyQixnRkFBZ0Y7QUFDaEYsNEVBQTRFO0FBQzVFLDZFQUE2RTtBQUM3RSxtRUFBbUU7QUFDbkUsU0FBUyxPQUFPO0lBQ2QsSUFBSSxTQUFTO1FBQUUsT0FBTTtJQUVyQixNQUFNLFFBQVEsR0FBRyxTQUFTLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBRTdDLFNBQVMsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLEdBQUcsVUFBVSxNQUFNLEVBQUUsUUFBUTtRQUN2RCxNQUFNLE9BQU8sR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFBO1FBQ3ZDLElBQUksT0FBTyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFBO1lBQ2xDLFFBQVEsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUE7WUFDdEIsT0FBTTtRQUNSLENBQUM7UUFDRCxRQUFRLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFBO0lBQzVCLENBQUMsQ0FBQTtJQUVELFNBQVMsR0FBRyxJQUFJLENBQUE7QUFDbEIsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxTQUFnQixhQUFhO0lBQzNCLE9BQU8sQ0FBQyxHQUFHLFFBQVEsQ0FBQyxDQUFBO0FBQ3RCLENBQUM7QUFFRCxTQUFnQixlQUFlLENBQUMsWUFBb0I7SUFDbEQsT0FBTyxNQUFNLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxZQUFZLENBQUMsQ0FBQTtBQUMxRSxDQUFDO0FBRUQsU0FBZ0IsWUFBWSxDQUFDLFlBQW9CO0lBQy9DLE9BQU8sU0FBUyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQTtBQUNwQyxDQUFDO0FBRUQsU0FBZ0IsaUJBQWlCLENBQy9CLFVBQWtCLEVBQ2xCLEtBQW9CLEVBQ3BCLE9BQTZEO0lBRTdELE9BQU8sRUFBRSxDQUFBO0lBRVQsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN6QixTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLFlBQVksQ0FBQyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUNwRSxDQUFDO0FBQ0gsQ0FBQztBQUVELGdGQUFnRjtBQUNoRiwyRUFBMkU7QUFDM0UsMkVBQTJFO0FBQzNFLGdGQUFnRjtBQUNoRiw4QkFBOEI7QUFDOUIsRUFBRTtBQUNGLDZFQUE2RTtBQUM3RSw4RUFBOEU7QUFDOUUscUVBQXFFO0FBQ3JFLG1EQUFtRDtBQUNuRCxTQUFnQixVQUFVLENBQUMsYUFBdUI7SUFDaEQsS0FBSyxNQUFNLFFBQVEsSUFBSSxhQUFhLEVBQUUsQ0FBQztRQUNyQyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBO1FBQ3RDLElBQUksQ0FBQyxNQUFNO1lBQUUsU0FBUTtRQUVyQixPQUFPLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUE7UUFFOUIsNEVBQTRFO1FBQzVFLG9FQUFvRTtRQUNwRSxLQUFLLE1BQU0sTUFBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDbEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUE7WUFDckQsSUFBSSxLQUFLLEtBQUssQ0FBQyxDQUFDO2dCQUFFLE1BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQTtRQUNyRCxDQUFDO0lBQ0gsQ0FBQztBQUNILENBQUM7QUFPRDs7Ozs7Ozs7R0FRRztBQUNILFNBQWdCLE1BQU0sQ0FBQyxVQUFrQixFQUFFLGFBQXVCO0lBQ2hFLE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUFDLFVBQVUsQ0FBQyxDQUFBO0lBQy9DLE1BQU0sUUFBUSxHQUFHLE9BQU8sRUFBRSxRQUFRLENBQUE7SUFFbEMsSUFBSSxPQUFPLElBQUksUUFBUSxFQUFFLENBQUM7UUFDeEIsT0FBTyxDQUFDLFFBQVEsR0FBRyxTQUFTLFFBQVEsQ0FBQyxVQUFVLEVBQUUsR0FBRyxJQUFJO1lBQ3RELE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUE7WUFDOUIsT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQTtRQUNqRCxDQUFDLENBQUE7SUFDSCxDQUFDO0lBRUQsSUFBSSxDQUFDO1FBQ0gsS0FBSyxNQUFNLFFBQVEsSUFBSSxhQUFhLEVBQUUsQ0FBQztZQUNyQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUE7UUFDbkIsQ0FBQztJQUNILENBQUM7WUFBUyxDQUFDO1FBQ1QsSUFBSSxPQUFPLElBQUksUUFBUTtZQUFFLE9BQU8sQ0FBQyxRQUFRLEdBQUcsUUFBUSxDQUFBO0lBQ3RELENBQUM7QUFDSCxDQUFDO0FBRUQsNkVBQTZFO0FBQzdFLDZFQUE2RTtBQUM3RSwyRUFBMkU7QUFDM0UsU0FBUyxtQkFBbUIsQ0FBQyxVQUFrQjtJQUM3QyxJQUFJLENBQUM7UUFDSCxNQUFNLFdBQVcsR0FBRyxnQkFBTSxDQUFDLGFBQWEsQ0FBQyxJQUFBLFdBQUksRUFBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQTtRQUN0RSxPQUNFLFdBQVcsQ0FBQyx5QkFBeUIsQ0FHdEMsQ0FBQyxlQUFlLENBQUE7SUFDbkIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxDQUFBO0lBQ2IsQ0FBQztBQUNILENBQUMifQ==

package/.medusa/server/src/patches/manifest.d.ts

@@ -0,0 +1,17 @@
+export interface PatchEntry {
+    /** Patch file under `patches/`, named `<package>@<generated-from-version>.patch`. */
+    file: string;
+    package: string;
+    /**
+     * Versions the patch is allowed to be attempted against. Applying is still
+     * gated on the diff's own context matching — this range only produces a
+     * clearer error than a failed hunk when a bump is known to be incompatible.
+     */
+    compatible: {
+        from: string;
+        to: string;
+    };
+    /** Surfaced in boot logs and in the error raised when the patch stops applying. */
+    reason: string;
+}
+export declare const PATCHES: PatchEntry[];

package/.medusa/server/src/patches/manifest.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PATCHES = void 0;
+exports.PATCHES = [
+    {
+        file: "@medusajs+core-flows@2.18.0.patch",
+        package: "@medusajs/core-flows",
+        // Both targeted files are byte-identical in 2.17.2 and 2.18.0.
+        compatible: { from: "2.17.0", to: "2.19.0" },
+        reason: "refreshCartShippingMethodsWorkflow deletes any shipping method whose " +
+            "profile is not required by a cart item, deriving that set from each " +
+            "item's master product. In Mercur the profile belongs to the offer — the " +
+            "product link is one-to-one and the first offerer wins it — so in a " +
+            "multi-seller cart holding a co-sold product every other seller's method " +
+            "is judged orphaned and checkout fails. The patch disables that cleanup. " +
+            "See mercurjs/mercur#1442.",
+    },
+];
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFuaWZlc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvcGF0Y2hlcy9tYW5pZmVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFjYSxRQUFBLE9BQU8sR0FBaUI7SUFDbkM7UUFDRSxJQUFJLEVBQUUsbUNBQW1DO1FBQ3pDLE9BQU8sRUFBRSxzQkFBc0I7UUFDL0IsK0RBQStEO1FBQy9ELFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRTtRQUM1QyxNQUFNLEVBQ0osdUVBQXVFO1lBQ3ZFLHNFQUFzRTtZQUN0RSwwRUFBMEU7WUFDMUUscUVBQXFFO1lBQ3JFLDBFQUEwRTtZQUMxRSwwRUFBMEU7WUFDMUUsMkJBQTJCO0tBQzlCO0NBQ0YsQ0FBQSJ9

package/.medusa/server/src/patches/patches/@medusajs+core-flows@2.18.0.patch

@@ -0,0 +1,21 @@
+diff --git a/dist/cart/workflows/refresh-cart-shipping-methods.js b/dist/cart/workflows/refresh-cart-shipping-methods.js
+index 74e27fb..016edc9 100644
+--- a/dist/cart/workflows/refresh-cart-shipping-methods.js
++++ b/dist/cart/workflows/refresh-cart-shipping-methods.js
+@@ -107,7 +107,15 @@ exports.refreshCartShippingMethodsWorkflow = (0, workflows_sdk_1.createWorkflow)
+             // Collect profile IDs still required by remaining cart items so that
+             // shipping methods for profiles with no matching items can be dropped.
+             // Avoid clearing shipping methods for single-method carts.
+-            const shouldCleanupOrphanProfiles = shippingMethods.length > 1;
++            // MERCUR: upstream drops a shipping method whose profile is not
++            // required by any cart item, deriving that set from each item's
++            // master product. Mercur's shipping profile belongs to the offer:
++            // the product link is one-to-one and the first offerer wins it, so
++            // in a multi-seller cart holding a co-sold product every other
++            // seller's method is judged orphaned and checkout fails. The
++            // cleanup is disabled rather than re-derived because the offer is
++            // not on the cart this workflow is handed.
++            const shouldCleanupOrphanProfiles = false;
+             const requiredProfileIds = new Set(items
+                 .filter((item) => item.requires_shipping)
+                 .map((item) => item.variant?.product?.shipping_profile?.id)

package/.medusa/server/src/patches/resolve-package-dirs.d.ts

@@ -0,0 +1,7 @@
+export type PackageCopy = {
+    dir: string;
+    version: string | null;
+    /** The copy `require()` resolves from the project — the one that must work. */
+    primary: boolean;
+};
+export declare function resolvePackageCopies(packageName: string): PackageCopy[];

package/.medusa/server/src/patches/resolve-package-dirs.js

@@ -0,0 +1,80 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePackageCopies = resolvePackageCopies;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const pkg_dir_1 = __importDefault(require("pkg-dir"));
+const resolve_cwd_1 = __importDefault(require("resolve-cwd"));
+function readVersion(dir) {
+    try {
+        const raw = (0, fs_1.readFileSync)((0, path_1.join)(dir, "package.json"), "utf8");
+        return JSON.parse(raw).version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function canonical(dir) {
+    try {
+        return (0, fs_1.realpathSync)(dir);
+    }
+    catch {
+        return dir;
+    }
+}
+function sweepStore(storeDir, packageName, found) {
+    if (!(0, fs_1.existsSync)(storeDir))
+        return;
+    const prefix = `${packageName.replace("/", "+")}@`;
+    for (const entry of (0, fs_1.readdirSync)(storeDir)) {
+        if (!entry.startsWith(prefix))
+            continue;
+        const inner = (0, path_1.join)(storeDir, entry, "node_modules", ...packageName.split("/"));
+        if ((0, fs_1.existsSync)((0, path_1.join)(inner, "package.json")))
+            found.add(canonical(inner));
+    }
+}
+function resolvePackageCopies(packageName) {
+    let primary = null;
+    // Resolve the package entry point, not `<name>/package.json`: packages that
+    // declare `exports` without a `./package.json` entry — core-flows is one —
+    // make the subpath unresolvable, which would silently leave every copy
+    // non-primary and drop the guarantee that the copy this project loads is the
+    // one that must accept the patch.
+    try {
+        const entry = (0, resolve_cwd_1.default)(packageName);
+        const resolved = pkg_dir_1.default.sync((0, path_1.dirname)(entry));
+        if (resolved)
+            primary = canonical(resolved);
+    }
+    catch {
+        // Not resolvable from cwd; the sweeps below may still find copies.
+    }
+    const found = new Set();
+    if (primary)
+        found.add(primary);
+    let cursor = process.cwd();
+    while (true) {
+        const nodeModules = (0, path_1.join)(cursor, "node_modules");
+        if ((0, fs_1.existsSync)(nodeModules)) {
+            sweepStore((0, path_1.join)(nodeModules, ".bun"), packageName, found);
+            sweepStore((0, path_1.join)(nodeModules, ".pnpm"), packageName, found);
+            const hoisted = (0, path_1.join)(nodeModules, ...packageName.split("/"));
+            if ((0, fs_1.existsSync)((0, path_1.join)(hoisted, "package.json")))
+                found.add(canonical(hoisted));
+        }
+        const parent = (0, path_1.dirname)(cursor);
+        if (parent === cursor)
+            break;
+        cursor = parent;
+    }
+    return [...found].map((dir) => ({
+        dir,
+        version: readVersion(dir),
+        primary: dir === primary,
+    }));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS1wYWNrYWdlLWRpcnMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvcGF0Y2hlcy9yZXNvbHZlLXBhY2thZ2UtZGlycy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQXVEQSxvREF3Q0M7QUEvRkQsMkJBQXdFO0FBQ3hFLCtCQUFvQztBQUNwQyxzREFBNEI7QUFDNUIsOERBQW9DO0FBb0JwQyxTQUFTLFdBQVcsQ0FBQyxHQUFXO0lBQzlCLElBQUksQ0FBQztRQUNILE1BQU0sR0FBRyxHQUFHLElBQUEsaUJBQVksRUFBQyxJQUFBLFdBQUksRUFBQyxHQUFHLEVBQUUsY0FBYyxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUE7UUFDM0QsT0FBUSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBMEIsQ0FBQyxPQUFPLElBQUksSUFBSSxDQUFBO0lBQ2xFLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLElBQUksQ0FBQTtJQUNiLENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxTQUFTLENBQUMsR0FBVztJQUM1QixJQUFJLENBQUM7UUFDSCxPQUFPLElBQUEsaUJBQVksRUFBQyxHQUFHLENBQUMsQ0FBQTtJQUMxQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxHQUFHLENBQUE7SUFDWixDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsVUFBVSxDQUNqQixRQUFnQixFQUNoQixXQUFtQixFQUNuQixLQUFrQjtJQUVsQixJQUFJLENBQUMsSUFBQSxlQUFVLEVBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTTtJQUVqQyxNQUFNLE1BQU0sR0FBRyxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUE7SUFDbEQsS0FBSyxNQUFNLEtBQUssSUFBSSxJQUFBLGdCQUFXLEVBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUMxQyxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7WUFBRSxTQUFRO1FBQ3ZDLE1BQU0sS0FBSyxHQUFHLElBQUEsV0FBSSxFQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsY0FBYyxFQUFFLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFBO1FBQzlFLElBQUksSUFBQSxlQUFVLEVBQUMsSUFBQSxXQUFJLEVBQUMsS0FBSyxFQUFFLGNBQWMsQ0FBQyxDQUFDO1lBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQTtJQUMxRSxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQWdCLG9CQUFvQixDQUFDLFdBQW1CO0lBQ3RELElBQUksT0FBTyxHQUFrQixJQUFJLENBQUE7SUFFakMsNEVBQTRFO0lBQzVFLDJFQUEyRTtJQUMzRSx1RUFBdUU7SUFDdkUsNkVBQTZFO0lBQzdFLGtDQUFrQztJQUNsQyxJQUFJLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxJQUFBLHFCQUFVLEVBQUMsV0FBVyxDQUFDLENBQUE7UUFDckMsTUFBTSxRQUFRLEdBQUcsaUJBQU0sQ0FBQyxJQUFJLENBQUMsSUFBQSxjQUFPLEVBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQTtRQUM1QyxJQUFJLFFBQVE7WUFBRSxPQUFPLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQzdDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxtRUFBbUU7SUFDckUsQ0FBQztJQUVELE1BQU0sS0FBSyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUE7SUFDL0IsSUFBSSxPQUFPO1FBQUUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQTtJQUUvQixJQUFJLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUE7SUFDMUIsT0FBTyxJQUFJLEVBQUUsQ0FBQztRQUNaLE1BQU0sV0FBVyxHQUFHLElBQUEsV0FBSSxFQUFDLE1BQU0sRUFBRSxjQUFjLENBQUMsQ0FBQTtRQUNoRCxJQUFJLElBQUEsZUFBVSxFQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDNUIsVUFBVSxDQUFDLElBQUEsV0FBSSxFQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLENBQUE7WUFDekQsVUFBVSxDQUFDLElBQUEsV0FBSSxFQUFDLFdBQVcsRUFBRSxPQUFPLENBQUMsRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLENBQUE7WUFFMUQsTUFBTSxPQUFPLEdBQUcsSUFBQSxXQUFJLEVBQUMsV0FBVyxFQUFFLEdBQUcsV0FBVyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFBO1lBQzVELElBQUksSUFBQSxlQUFVLEVBQUMsSUFBQSxXQUFJLEVBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxDQUFDO2dCQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUE7UUFDOUUsQ0FBQztRQUVELE1BQU0sTUFBTSxHQUFHLElBQUEsY0FBTyxFQUFDLE1BQU0sQ0FBQyxDQUFBO1FBQzlCLElBQUksTUFBTSxLQUFLLE1BQU07WUFBRSxNQUFLO1FBQzVCLE1BQU0sR0FBRyxNQUFNLENBQUE7SUFDakIsQ0FBQztJQUVELE9BQU8sQ0FBQyxHQUFHLEtBQUssQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM5QixHQUFHO1FBQ0gsT0FBTyxFQUFFLFdBQVcsQ0FBQyxHQUFHLENBQUM7UUFDekIsT0FBTyxFQUFFLEdBQUcsS0FBSyxPQUFPO0tBQ3pCLENBQUMsQ0FBQyxDQUFBO0FBQ0wsQ0FBQyJ9

package/.medusa/server/src/patches/unified-diff.d.ts

@@ -0,0 +1,25 @@
+export type Hunk = {
+    /** Context + removed lines: what the file must contain for the hunk to apply. */
+    before: string[];
+    /** Context + added lines: what replaces it. */
+    after: string[];
+    /** 1-based line the hunk was generated at, used as the first place to look. */
+    oldStart: number;
+};
+export type FilePatch = {
+    /** Path relative to the package root. */
+    path: string;
+    hunks: Hunk[];
+};
+/**
+ * Parses the subset of unified diff that `git diff --no-index` emits for text
+ * files: file headers, hunk headers, and ` `/`-`/`+` body lines. Anything else
+ * (rename, mode, binary) is unsupported on purpose — patches here are expected
+ * to be small edits to shipped JavaScript.
+ */
+export declare function parseUnifiedDiff(patch: string): FilePatch[];
+/**
+ * Applies every hunk, or returns `null`. A patch is never partially applied.
+ */
+export declare function applyHunks(source: string, hunks: Hunk[]): string | null;
+export declare function reverse(hunks: Hunk[]): Hunk[];

package/.medusa/server/src/patches/unified-diff.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseUnifiedDiff = parseUnifiedDiff;
+exports.applyHunks = applyHunks;
+exports.reverse = reverse;
+const HUNK_HEADER = /^@@ -(\d+)(?:,\d+)? \+\d+(?:,\d+)? @@/;
+function stripPrefix(path) {
+    return path.replace(/^[ab]\//, "").trim();
+}
+/**
+ * Parses the subset of unified diff that `git diff --no-index` emits for text
+ * files: file headers, hunk headers, and ` `/`-`/`+` body lines. Anything else
+ * (rename, mode, binary) is unsupported on purpose — patches here are expected
+ * to be small edits to shipped JavaScript.
+ */
+function parseUnifiedDiff(patch) {
+    const files = [];
+    const lines = patch.split("\n");
+    let current = null;
+    let hunk = null;
+    const closeHunk = () => {
+        if (current && hunk)
+            current.hunks.push(hunk);
+        hunk = null;
+    };
+    for (const line of lines) {
+        if (line.startsWith("+++ ")) {
+            closeHunk();
+            const path = stripPrefix(line.slice(4));
+            if (path === "/dev/null") {
+                throw new Error("Unified diff deletes a file, which is not supported");
+            }
+            current = { path, hunks: [] };
+            files.push(current);
+            continue;
+        }
+        if (line.startsWith("--- ") || line.startsWith("diff --git ")) {
+            closeHunk();
+            continue;
+        }
+        const header = HUNK_HEADER.exec(line);
+        if (header) {
+            closeHunk();
+            hunk = { before: [], after: [], oldStart: Number.parseInt(header[1], 10) };
+            continue;
+        }
+        if (!hunk)
+            continue;
+        const marker = line[0];
+        const content = line.slice(1);
+        if (marker === " ") {
+            hunk.before.push(content);
+            hunk.after.push(content);
+        }
+        else if (marker === "-") {
+            hunk.before.push(content);
+        }
+        else if (marker === "+") {
+            hunk.after.push(content);
+        }
+        // "" and blank separators are ignored.
+    }
+    closeHunk();
+    return files.filter((file) => file.hunks.length);
+}
+function matchesAt(source, block, at) {
+    if (at < 0 || at + block.length > source.length)
+        return false;
+    return block.every((line, i) => source[at + i] === line);
+}
+/**
+ * How far from the recorded line a hunk may drift and still be considered the
+ * same code. Unbounded searching is unsafe: the same few lines of context can
+ * legitimately appear elsewhere in a file — cartFieldsForRefreshSteps and
+ * completeCartFields share several — and relocating a hunk that far would
+ * silently patch the wrong site.
+ */
+const MAX_DRIFT_LINES = 50;
+/**
+ * Locates a hunk by content, preferring the line it was generated at and
+ * otherwise accepting a single unambiguous match nearby. Returns -1 when the
+ * hunk does not apply, or could apply in more than one place — both mean the
+ * patch is stale and must be regenerated rather than guessed at.
+ */
+function locate(source, block, oldStart) {
+    if (!block.length)
+        return -1;
+    const expected = oldStart - 1;
+    if (matchesAt(source, block, expected))
+        return expected;
+    const from = Math.max(0, expected - MAX_DRIFT_LINES);
+    const to = Math.min(source.length - block.length, expected + MAX_DRIFT_LINES);
+    let found = -1;
+    for (let i = from; i <= to; i++) {
+        if (!matchesAt(source, block, i))
+            continue;
+        if (found !== -1)
+            return -1;
+        found = i;
+    }
+    return found;
+}
+/**
+ * Applies every hunk, or returns `null`. A patch is never partially applied.
+ */
+function applyHunks(source, hunks) {
+    let lines = source.split("\n");
+    for (const hunk of hunks) {
+        const at = locate(lines, hunk.before, hunk.oldStart);
+        if (at === -1)
+            return null;
+        lines = [
+            ...lines.slice(0, at),
+            ...hunk.after,
+            ...lines.slice(at + hunk.before.length),
+        ];
+    }
+    return lines.join("\n");
+}
+function reverse(hunks) {
+    return hunks.map((hunk) => ({
+        before: hunk.after,
+        after: hunk.before,
+        oldStart: hunk.oldStart,
+    }));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidW5pZmllZC1kaWZmLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3BhdGNoZXMvdW5pZmllZC1kaWZmLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBMkJBLDRDQXVEQztBQTRDRCxnQ0FlQztBQUVELDBCQU1DO0FBdElELE1BQU0sV0FBVyxHQUFHLHVDQUF1QyxDQUFBO0FBRTNELFNBQVMsV0FBVyxDQUFDLElBQVk7SUFDL0IsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQTtBQUMzQyxDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxTQUFnQixnQkFBZ0IsQ0FBQyxLQUFhO0lBQzVDLE1BQU0sS0FBSyxHQUFnQixFQUFFLENBQUE7SUFDN0IsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQTtJQUUvQixJQUFJLE9BQU8sR0FBcUIsSUFBSSxDQUFBO0lBQ3BDLElBQUksSUFBSSxHQUFnQixJQUFJLENBQUE7SUFFNUIsTUFBTSxTQUFTLEdBQUcsR0FBRyxFQUFFO1FBQ3JCLElBQUksT0FBTyxJQUFJLElBQUk7WUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQTtRQUM3QyxJQUFJLEdBQUcsSUFBSSxDQUFBO0lBQ2IsQ0FBQyxDQUFBO0lBRUQsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN6QixJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUM1QixTQUFTLEVBQUUsQ0FBQTtZQUNYLE1BQU0sSUFBSSxHQUFHLFdBQVcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUE7WUFDdkMsSUFBSSxJQUFJLEtBQUssV0FBVyxFQUFFLENBQUM7Z0JBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMscURBQXFELENBQUMsQ0FBQTtZQUN4RSxDQUFDO1lBQ0QsT0FBTyxHQUFHLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsQ0FBQTtZQUM3QixLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFBO1lBQ25CLFNBQVE7UUFDVixDQUFDO1FBRUQsSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztZQUM5RCxTQUFTLEVBQUUsQ0FBQTtZQUNYLFNBQVE7UUFDVixDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQTtRQUNyQyxJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQ1gsU0FBUyxFQUFFLENBQUE7WUFDWCxJQUFJLEdBQUcsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUE7WUFDMUUsU0FBUTtRQUNWLENBQUM7UUFFRCxJQUFJLENBQUMsSUFBSTtZQUFFLFNBQVE7UUFFbkIsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFBO1FBQ3RCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUE7UUFFN0IsSUFBSSxNQUFNLEtBQUssR0FBRyxFQUFFLENBQUM7WUFDbkIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUE7WUFDekIsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUE7UUFDMUIsQ0FBQzthQUFNLElBQUksTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDO1lBQzFCLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFBO1FBQzNCLENBQUM7YUFBTSxJQUFJLE1BQU0sS0FBSyxHQUFHLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQTtRQUMxQixDQUFDO1FBQ0Qsa0VBQWtFO0lBQ3BFLENBQUM7SUFFRCxTQUFTLEVBQUUsQ0FBQTtJQUVYLE9BQU8sS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQTtBQUNsRCxDQUFDO0FBRUQsU0FBUyxTQUFTLENBQUMsTUFBZ0IsRUFBRSxLQUFlLEVBQUUsRUFBVTtJQUM5RCxJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUksRUFBRSxHQUFHLEtBQUssQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU07UUFBRSxPQUFPLEtBQUssQ0FBQTtJQUM3RCxPQUFPLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUFBO0FBQzFELENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLGVBQWUsR0FBRyxFQUFFLENBQUE7QUFFMUI7Ozs7O0dBS0c7QUFDSCxTQUFTLE1BQU0sQ0FBQyxNQUFnQixFQUFFLEtBQWUsRUFBRSxRQUFnQjtJQUNqRSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU07UUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFBO0lBRTVCLE1BQU0sUUFBUSxHQUFHLFFBQVEsR0FBRyxDQUFDLENBQUE7SUFDN0IsSUFBSSxTQUFTLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUM7UUFBRSxPQUFPLFFBQVEsQ0FBQTtJQUV2RCxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxRQUFRLEdBQUcsZUFBZSxDQUFDLENBQUE7SUFDcEQsTUFBTSxFQUFFLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsUUFBUSxHQUFHLGVBQWUsQ0FBQyxDQUFBO0lBRTdFLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFBO0lBQ2QsS0FBSyxJQUFJLENBQUMsR0FBRyxJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2hDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFBRSxTQUFRO1FBQzFDLElBQUksS0FBSyxLQUFLLENBQUMsQ0FBQztZQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUE7UUFDM0IsS0FBSyxHQUFHLENBQUMsQ0FBQTtJQUNYLENBQUM7SUFFRCxPQUFPLEtBQUssQ0FBQTtBQUNkLENBQUM7QUFFRDs7R0FFRztBQUNILFNBQWdCLFVBQVUsQ0FBQyxNQUFjLEVBQUUsS0FBYTtJQUN0RCxJQUFJLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFBO0lBRTlCLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7UUFDekIsTUFBTSxFQUFFLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUNwRCxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQTtRQUUxQixLQUFLLEdBQUc7WUFDTixHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNyQixHQUFHLElBQUksQ0FBQyxLQUFLO1lBQ2IsR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztTQUN4QyxDQUFBO0lBQ0gsQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQTtBQUN6QixDQUFDO0FBRUQsU0FBZ0IsT0FBTyxDQUFDLEtBQWE7SUFDbkMsT0FBTyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzFCLE1BQU0sRUFBRSxJQUFJLENBQUMsS0FBSztRQUNsQixLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU07UUFDbEIsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO0tBQ3hCLENBQUMsQ0FBQyxDQUFBO0FBQ0wsQ0FBQyJ9

package/.medusa/server/src/patches/version.d.ts

@@ -0,0 +1,5 @@
+export declare function compareVersions(a: string, b: string): number;
+export declare function isWithinRange(version: string, range: {
+    from: string;
+    to: string;
+}): boolean;

package/.medusa/server/src/patches/version.js

@@ -0,0 +1,26 @@
+"use strict";
+// Deliberately not semver: the range a patch declares is always a plain
+// "verified from this version, up to that one" pair, and pulling a resolver in
+// for that would be more machinery than the check deserves.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareVersions = compareVersions;
+exports.isWithinRange = isWithinRange;
+function parse(version) {
+    const core = version.split("-")[0];
+    return core.split(".").map((part) => Number.parseInt(part, 10) || 0);
+}
+function compareVersions(a, b) {
+    const left = parse(a);
+    const right = parse(b);
+    for (let i = 0; i < 3; i++) {
+        const diff = (left[i] ?? 0) - (right[i] ?? 0);
+        if (diff !== 0)
+            return diff > 0 ? 1 : -1;
+    }
+    return 0;
+}
+function isWithinRange(version, range) {
+    return (compareVersions(version, range.from) >= 0 &&
+        compareVersions(version, range.to) < 0);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9wYXRjaGVzL3ZlcnNpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLHdFQUF3RTtBQUN4RSwrRUFBK0U7QUFDL0UsNERBQTREOztBQU81RCwwQ0FVQztBQUVELHNDQVFDO0FBekJELFNBQVMsS0FBSyxDQUFDLE9BQWU7SUFDNUIsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUNsQyxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQTtBQUN0RSxDQUFDO0FBRUQsU0FBZ0IsZUFBZSxDQUFDLENBQVMsRUFBRSxDQUFTO0lBQ2xELE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQTtJQUNyQixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFFdEIsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQzNCLE1BQU0sSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFBO1FBQzdDLElBQUksSUFBSSxLQUFLLENBQUM7WUFBRSxPQUFPLElBQUksR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDMUMsQ0FBQztJQUVELE9BQU8sQ0FBQyxDQUFBO0FBQ1YsQ0FBQztBQUVELFNBQWdCLGFBQWEsQ0FDM0IsT0FBZSxFQUNmLEtBQW1DO0lBRW5DLE9BQU8sQ0FDTCxlQUFlLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO1FBQ3pDLGVBQWUsQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FDdkMsQ0FBQTtBQUNILENBQUMifQ==

package/.medusa/server/src/subscribers/payment-webhook.d.ts

@@ -0,0 +1,4 @@
+import { SubscriberArgs, SubscriberConfig } from "@medusajs/framework";
+import { ProviderWebhookPayload } from "@medusajs/framework/types";
+export default function paymentWebhookHandler({ event, container, }: SubscriberArgs<ProviderWebhookPayload>): Promise<void>;
+export declare const config: SubscriberConfig;

package/.medusa/server/src/subscribers/payment-webhook.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.config = void 0;
+exports.default = paymentWebhookHandler;
+const utils_1 = require("@medusajs/framework/utils");
+const events_1 = require("../workflows/events");
+const payment_1 = require("../workflows/payment");
+const IGNORED_ACTIONS = [
+    utils_1.PaymentActions.NOT_SUPPORTED,
+    utils_1.PaymentActions.CANCELED,
+    utils_1.PaymentActions.FAILED,
+    utils_1.PaymentActions.REQUIRES_MORE,
+    utils_1.PaymentActions.PENDING_AUTHORIZATION,
+    // Intermediate provider events (e.g. Stripe `payment_intent.created`) must
+    // not trigger cart completion.
+    utils_1.PaymentActions.PENDING,
+];
+async function paymentWebhookHandler({ event, container, }) {
+    const paymentService = container.resolve(utils_1.Modules.PAYMENT);
+    const input = event.data;
+    if (input.payload?.rawData?.type === "Buffer") {
+        input.payload.rawData = Buffer.from(input.payload.rawData.data);
+    }
+    const processedEvent = await paymentService.getWebhookActionAndData(input);
+    // Without a session id the event cannot be tied to a payment session, and
+    // the workflow's filters would resolve to an arbitrary unrelated cart.
+    if (!processedEvent.data?.session_id) {
+        return;
+    }
+    if (IGNORED_ACTIONS.includes(processedEvent.action)) {
+        return;
+    }
+    const wfEngine = container.resolve(utils_1.Modules.WORKFLOW_ENGINE);
+    await wfEngine.run(payment_1.processPaymentWorkflowId, { input: processedEvent });
+}
+exports.config = {
+    event: events_1.PaymentWebhookEvents.WEBHOOK_RECEIVED,
+    context: {
+        subscriberId: "mercur-payment-webhook-handler",
+    },
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGF5bWVudC13ZWJob29rLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3N1YnNjcmliZXJzL3BheW1lbnQtd2ViaG9vay50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUF1QkEsd0NBNEJDO0FBakRELHFEQUFtRTtBQUVuRSxnREFBMEQ7QUFDMUQsa0RBQStEO0FBTy9ELE1BQU0sZUFBZSxHQUFhO0lBQ2hDLHNCQUFjLENBQUMsYUFBYTtJQUM1QixzQkFBYyxDQUFDLFFBQVE7SUFDdkIsc0JBQWMsQ0FBQyxNQUFNO0lBQ3JCLHNCQUFjLENBQUMsYUFBYTtJQUM1QixzQkFBYyxDQUFDLHFCQUFxQjtJQUNwQywyRUFBMkU7SUFDM0UsK0JBQStCO0lBQy9CLHNCQUFjLENBQUMsT0FBTztDQUN2QixDQUFBO0FBRWMsS0FBSyxVQUFVLHFCQUFxQixDQUFDLEVBQ2xELEtBQUssRUFDTCxTQUFTLEdBQzhCO0lBQ3ZDLE1BQU0sY0FBYyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsZUFBTyxDQUFDLE9BQU8sQ0FBQyxDQUFBO0lBRXpELE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUE7SUFFeEIsSUFBSyxLQUFLLENBQUMsT0FBTyxFQUFFLE9BQXVDLEVBQUUsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQy9FLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQ2hDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBdUMsQ0FBQyxJQUFJLENBQzVELENBQUE7SUFDSCxDQUFDO0lBRUQsTUFBTSxjQUFjLEdBQUcsTUFBTSxjQUFjLENBQUMsdUJBQXVCLENBQUMsS0FBSyxDQUFDLENBQUE7SUFFMUUsMEVBQTBFO0lBQzFFLHVFQUF1RTtJQUN2RSxJQUFJLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsQ0FBQztRQUNyQyxPQUFNO0lBQ1IsQ0FBQztJQUVELElBQUksZUFBZSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUNwRCxPQUFNO0lBQ1IsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsZUFBTyxDQUFDLGVBQWUsQ0FBQyxDQUFBO0lBQzNELE1BQU0sUUFBUSxDQUFDLEdBQUcsQ0FBQyxrQ0FBd0IsRUFBRSxFQUFFLEtBQUssRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFBO0FBQ3pFLENBQUM7QUFFWSxRQUFBLE1BQU0sR0FBcUI7SUFDdEMsS0FBSyxFQUFFLDZCQUFvQixDQUFDLGdCQUFnQjtJQUM1QyxPQUFPLEVBQUU7UUFDUCxZQUFZLEVBQUUsZ0NBQWdDO0tBQy9DO0NBQ0YsQ0FBQSJ9

package/.medusa/server/src/with-mercur.d.ts

@@ -5,6 +5,14 @@ export type MercurInputConfig = Omit<InputConfigWithArrayModules, "projectConfig
         http?: HttpConfig & {
             vendorCors?: string;
         };
+        mercur?: {
+            /**
+             * Patch file names to skip, e.g. "@medusajs+core-flows@2.18.0.patch".
+             * Each one restores an upstream bug, so only reach for this when a patch
+             * conflicts with your own override.
+             */
+            disabledPatches?: string[];
+        };
     };
 };
 export declare function withMercur(config?: MercurInputConfig): InputConfigWithArrayModules;