@thebes/cadmea-plugin-printful 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BowenLabs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,46 @@
+# @thebes/cadmea-plugin-printful
+
+Printful `FulfillmentProvider` for [`@thebes/cadmea-plugin-ecommerce`](../cadmea-plugin-ecommerce) — raw `fetch()` + `crypto.subtle`, no Printful Node SDK.
+
+## Usage
+
+```ts
+import { createWebhookHandler } from "@thebes/cadmea-plugin-ecommerce";
+import { createPrintfulProvider } from "@thebes/cadmea-plugin-printful";
+import { createFulfillmentOrder } from "@thebes/cadmea-plugin-ecommerce";
+
+const printful = createPrintfulProvider({ apiKey: env.PRINTFUL_API_KEY });
+
+app.post(
+  "/api/webhooks/stripe",
+  createWebhookHandler({
+    provider: stripeProvider,
+    orders,
+    payments,
+    webhookEvents,
+    secret: env.STRIPE_WEBHOOK_SECRET,
+    context,
+    onOrderPaid: (order) =>
+      createFulfillmentOrder(order, { provider: printful, orders, context }),
+  }),
+);
+```
+
+```ts
+import { createFulfillmentWebhookHandler } from "@thebes/cadmea-plugin-ecommerce";
+
+app.post(
+  "/api/webhooks/printful",
+  createFulfillmentWebhookHandler({
+    provider: printful,
+    orders,
+    webhookEvents,
+    secret: env.PRINTFUL_WEBHOOKS_SECRET,
+    context,
+  }),
+);
+```
+
+## `catalogRef` format
+
+A Printful order line needs both a catalog variant id and a file id; `FulfillmentLineItem.catalogRef` is a single opaque string, so this provider expects it in `"{catalogVariantId}:{fileId}"` form — set directly on each `products` variant's `catalogRef` field once the print file has been uploaded to Printful. See `provider.ts`'s top-of-file note for the reasoning and what a future real catalog-sync collection would replace this with.

package/dist/index.cjs

@@ -0,0 +1,150 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/provider.ts
+const BASE_URL = "https://api.printful.com";
+var PrintfulApiError = class extends Error {
+	status;
+	body;
+	constructor(message, status, body) {
+		super(message);
+		this.status = status;
+		this.body = body;
+		this.name = "PrintfulApiError";
+	}
+};
+async function printfulFetch(config, path, init) {
+	const response = await fetch(`${BASE_URL}${path}`, {
+		...init,
+		headers: {
+			Authorization: `Bearer ${config.apiKey}`,
+			"Content-Type": "application/json",
+			...init?.headers
+		}
+	});
+	const text = await response.text();
+	const parsed = text ? JSON.parse(text) : {};
+	if (!response.ok) throw new PrintfulApiError(`Printful API request to "${path}" failed with status ${response.status}`, response.status, parsed);
+	return parsed;
+}
+/** Splits a `"{catalogVariantId}:{fileId}"` catalogRef — see provider.ts's top-of-file design note. */
+function parseCatalogRef(catalogRef) {
+	const [variantPart, filePart] = catalogRef.split(":");
+	const catalogVariantId = Number(variantPart);
+	const fileId = Number(filePart);
+	if (!Number.isFinite(catalogVariantId) || !Number.isFinite(fileId)) throw new Error(`Printful catalogRef "${catalogRef}" must be in "{catalogVariantId}:{fileId}" form`);
+	return {
+		catalogVariantId,
+		fileId
+	};
+}
+async function createFulfillmentOrder(config, request) {
+	const orderItems = request.lineItems.map((item) => {
+		const { catalogVariantId, fileId } = parseCatalogRef(item.catalogRef);
+		return {
+			source: "catalog",
+			catalog_variant_id: catalogVariantId,
+			quantity: item.quantity,
+			placements: [{
+				placement: "default",
+				technique: "digital",
+				layers: [{
+					type: "file",
+					id: fileId
+				}]
+			}]
+		};
+	});
+	if (!orderItems.length) throw new Error(`Fulfillment order for orderId ${request.orderId} has no valid line items`);
+	const address = request.shippingAddress;
+	const order = (await printfulFetch(config, "/orders", {
+		method: "POST",
+		body: JSON.stringify({
+			external_id: `cadmea-order-${request.orderId}`,
+			recipient: {
+				name: [address.firstName, address.lastName].filter(Boolean).join(" "),
+				address1: address.address1 ?? "",
+				address2: address.address2,
+				city: address.city ?? "",
+				state_code: address.state ?? "",
+				country_code: address.country ?? "US",
+				zip: address.zip ?? "",
+				phone: address.phone,
+				email: request.customerEmail
+			},
+			order_items: orderItems
+		})
+	})).data;
+	if (config.autoConfirm) await printfulFetch(config, `/orders/${order.id}/confirmation`, { method: "POST" }).catch((error) => {
+		console.error(`[cadmea-plugin-printful] order ${order.id} confirmation failed — manual confirmation required`, error);
+	});
+	return {
+		providerFulfillmentRef: String(order.id),
+		status: "pending"
+	};
+}
+async function hmacSha256Hex(message, keyHex) {
+	const keyBytes = new Uint8Array(keyHex.match(/.{1,2}/g)?.map((byte) => Number.parseInt(byte, 16)) ?? []);
+	const key = await crypto.subtle.importKey("raw", keyBytes, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
+	return Array.from(new Uint8Array(signature), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let i = 0; i < a.length; i++) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return mismatch === 0;
+}
+/**
+* Verifies Printful's webhook signature: `x-pf-webhook-signature` is a hex
+* HMAC-SHA256 of the raw body, keyed by the webhook config's secret (itself
+* a hex string, decoded to bytes before use — Printful's own documented
+* format, ported from the source app's Node `crypto.createHmac` version).
+*/
+async function verifyWebhookSignature({ rawBody, headers, secret }) {
+	const signature = headers.get("x-pf-webhook-signature");
+	if (!signature) return false;
+	return timingSafeEqual(await hmacSha256Hex(rawBody, secret), signature);
+}
+function parseWebhookEvent(rawBody) {
+	const payload = JSON.parse(rawBody);
+	const eventId = `${payload.data.order.id}:${payload.type}`;
+	if (payload.type === "shipment_sent" && payload.data.shipment) return {
+		eventId,
+		event: {
+			kind: "fulfillment.updated",
+			providerFulfillmentRef: String(payload.data.order.id),
+			status: "shipped",
+			trackingNumber: payload.data.shipment.tracking_number,
+			trackingCarrier: payload.data.shipment.service,
+			trackingUrl: payload.data.shipment.tracking_url
+		}
+	};
+	return {
+		eventId,
+		event: {
+			kind: "unhandled",
+			rawType: payload.type
+		}
+	};
+}
+/**
+* Creates a `FulfillmentProvider` backed by Printful's REST API — raw
+* `fetch()` + `crypto.subtle`, no Printful Node SDK. Implements
+* `createFulfillmentOrder`/`verifyWebhookSignature`/`parseWebhookEvent`,
+* the full `FulfillmentProvider` surface (no optional capabilities are
+* defined on that interface yet).
+*/
+function createPrintfulProvider(config) {
+	return {
+		name: "printful",
+		createFulfillmentOrder: (request) => createFulfillmentOrder(config, request),
+		verifyWebhookSignature,
+		parseWebhookEvent
+	};
+}
+//#endregion
+exports.createPrintfulProvider = createPrintfulProvider;
+
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../src/provider.ts"],"sourcesContent":["// Copyright (c) 2026 BowenLabs. All rights reserved.\n// MIT licensed. See LICENSE in the repo root.\n//\n// Printful's REST API (v2 for orders, v1 for shipping rates) directly via\n// fetch() — never a Node-targeted Printful SDK. Webhook signature\n// verification uses crypto.subtle, mirroring\n// @thebes/cadmea-plugin-ecommerce-stripe's provider.ts.\n//\n// Design note on `catalogRef`: `FulfillmentLineItem.catalogRef` is one\n// opaque string per the FulfillmentProvider contract, but a Printful order\n// item needs two independent ids — a `catalog_variant_id` (which blank\n// product/size) and a `file id` (which artwork file gets printed on it).\n// The source app modeled this as two linked Payload collections\n// (PrintfulProducts + PrintAssets with a manual sync step uploading files to\n// Printful ahead of checkout). That collection pair has no Cadmea analog\n// yet and is out of scope for this port (see project plan's flagged\n// architecture changes). Instead, `catalogRef` here is the two ids joined\n// with a colon — `\"{catalogVariantId}:{fileId}\"` — set directly on each\n// `products` variant's `catalogRef` field in the Cadmea admin once a file is\n// uploaded to Printful by hand or via Printful's own dashboard. Revisit with\n// a real sync collection only once manual catalogRef entry is a measured\n// operational problem, not a theoretical one.\n\nimport type {\n  FulfillmentOrderRequest,\n  FulfillmentOrderResult,\n  FulfillmentProvider,\n  NormalizedFulfillmentWebhookEvent,\n} from \"@thebes/cadmea-plugin-ecommerce\";\n\nexport interface PrintfulProviderConfig {\n  apiKey: string;\n  /**\n   * Printful orders are created as drafts by default — call\n   * `/confirmation` to submit them for production. Default: false, same\n   * \"explicit opt-in\" reasoning as the source app's\n   * `PRINTFUL_CONFIRM_ORDERS` env var — a misconfigured store should fail\n   * safe into \"drafts piling up for manual review,\" not \"real money spent\n   * printing untested orders.\"\n   */\n  autoConfirm?: boolean;\n}\n\nconst BASE_URL = \"https://api.printful.com\";\n\nclass PrintfulApiError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: unknown,\n  ) {\n    super(message);\n    this.name = \"PrintfulApiError\";\n  }\n}\n\nasync function printfulFetch(\n  config: PrintfulProviderConfig,\n  path: string,\n  init?: RequestInit,\n): Promise<Record<string, unknown>> {\n  const response = await fetch(`${BASE_URL}${path}`, {\n    ...init,\n    headers: {\n      Authorization: `Bearer ${config.apiKey}`,\n      \"Content-Type\": \"application/json\",\n      ...init?.headers,\n    },\n  });\n  const text = await response.text();\n  const parsed = text ? JSON.parse(text) : {};\n  if (!response.ok) {\n    throw new PrintfulApiError(\n      `Printful API request to \"${path}\" failed with status ${response.status}`,\n      response.status,\n      parsed,\n    );\n  }\n  return parsed;\n}\n\n/** Splits a `\"{catalogVariantId}:{fileId}\"` catalogRef — see provider.ts's top-of-file design note. */\nfunction parseCatalogRef(catalogRef: string): {\n  catalogVariantId: number;\n  fileId: number;\n} {\n  const [variantPart, filePart] = catalogRef.split(\":\");\n  const catalogVariantId = Number(variantPart);\n  const fileId = Number(filePart);\n  if (!Number.isFinite(catalogVariantId) || !Number.isFinite(fileId)) {\n    throw new Error(\n      `Printful catalogRef \"${catalogRef}\" must be in \"{catalogVariantId}:{fileId}\" form`,\n    );\n  }\n  return { catalogVariantId, fileId };\n}\n\ninterface PrintfulOrderItem {\n  source: \"catalog\";\n  catalog_variant_id: number;\n  quantity: number;\n  placements: Array<{\n    placement: string;\n    technique: string;\n    layers: Array<{ type: \"file\"; id: number }>;\n  }>;\n}\n\nasync function createFulfillmentOrder(\n  config: PrintfulProviderConfig,\n  request: FulfillmentOrderRequest,\n): Promise<FulfillmentOrderResult> {\n  const orderItems: PrintfulOrderItem[] = request.lineItems.map((item) => {\n    const { catalogVariantId, fileId } = parseCatalogRef(item.catalogRef);\n    return {\n      source: \"catalog\",\n      catalog_variant_id: catalogVariantId,\n      quantity: item.quantity,\n      placements: [\n        {\n          placement: \"default\",\n          technique: \"digital\",\n          layers: [{ type: \"file\", id: fileId }],\n        },\n      ],\n    };\n  });\n\n  if (!orderItems.length) {\n    throw new Error(\n      `Fulfillment order for orderId ${request.orderId} has no valid line items`,\n    );\n  }\n\n  const address = request.shippingAddress;\n  const response = await printfulFetch(config, \"/orders\", {\n    method: \"POST\",\n    body: JSON.stringify({\n      external_id: `cadmea-order-${request.orderId}`,\n      recipient: {\n        name: [address.firstName, address.lastName].filter(Boolean).join(\" \"),\n        address1: address.address1 ?? \"\",\n        address2: address.address2,\n        city: address.city ?? \"\",\n        state_code: address.state ?? \"\",\n        country_code: address.country ?? \"US\",\n        zip: address.zip ?? \"\",\n        phone: address.phone,\n        email: request.customerEmail,\n      },\n      order_items: orderItems,\n    }),\n  });\n\n  const order = response.data as { id: number; status: string };\n\n  if (config.autoConfirm) {\n    // A confirmation failure is logged, never thrown — the draft order\n    // already exists at Printful and is visible for manual confirmation;\n    // surfacing this as a fulfillment-creation failure would cause the\n    // order-paid hook's caller to retry order creation and risk a\n    // duplicate Printful order for the same Cadmea order.\n    await printfulFetch(config, `/orders/${order.id}/confirmation`, {\n      method: \"POST\",\n    }).catch((error) => {\n      console.error(\n        `[cadmea-plugin-printful] order ${order.id} confirmation failed — manual confirmation required`,\n        error,\n      );\n    });\n  }\n\n  return {\n    providerFulfillmentRef: String(order.id),\n    status: \"pending\",\n  };\n}\n\nasync function hmacSha256Hex(message: string, keyHex: string): Promise<string> {\n  const keyBytes = new Uint8Array(\n    keyHex.match(/.{1,2}/g)?.map((byte) => Number.parseInt(byte, 16)) ?? [],\n  );\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    keyBytes,\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = await crypto.subtle.sign(\n    \"HMAC\",\n    key,\n    new TextEncoder().encode(message),\n  );\n  return Array.from(new Uint8Array(signature), (b) =>\n    b.toString(16).padStart(2, \"0\"),\n  ).join(\"\");\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\n/**\n * Verifies Printful's webhook signature: `x-pf-webhook-signature` is a hex\n * HMAC-SHA256 of the raw body, keyed by the webhook config's secret (itself\n * a hex string, decoded to bytes before use — Printful's own documented\n * format, ported from the source app's Node `crypto.createHmac` version).\n */\nasync function verifyWebhookSignature({\n  rawBody,\n  headers,\n  secret,\n}: {\n  rawBody: string;\n  headers: Headers;\n  secret: string;\n}): Promise<boolean> {\n  const signature = headers.get(\"x-pf-webhook-signature\");\n  if (!signature) return false;\n  const expected = await hmacSha256Hex(rawBody, secret);\n  return timingSafeEqual(expected, signature);\n}\n\ninterface ShipmentSentPayload {\n  type: string;\n  data: {\n    order: { id: number };\n    shipment?: {\n      tracking_number: string;\n      tracking_url: string;\n      service: string;\n    };\n  };\n}\n\nfunction parseWebhookEvent(rawBody: string): {\n  eventId: string;\n  event: NormalizedFulfillmentWebhookEvent;\n} {\n  const payload = JSON.parse(rawBody) as ShipmentSentPayload;\n  // Printful doesn't include a stable webhook event id in its payload (no\n  // `id` field, unlike Stripe) — the order id + type pair is unique enough\n  // for this plugin's dedup purposes, since a real duplicate delivery\n  // re-sends the exact same order/type combination.\n  const eventId = `${payload.data.order.id}:${payload.type}`;\n\n  if (payload.type === \"shipment_sent\" && payload.data.shipment) {\n    return {\n      eventId,\n      event: {\n        kind: \"fulfillment.updated\",\n        providerFulfillmentRef: String(payload.data.order.id),\n        status: \"shipped\",\n        trackingNumber: payload.data.shipment.tracking_number,\n        trackingCarrier: payload.data.shipment.service,\n        trackingUrl: payload.data.shipment.tracking_url,\n      },\n    };\n  }\n\n  return { eventId, event: { kind: \"unhandled\", rawType: payload.type } };\n}\n\n/**\n * Creates a `FulfillmentProvider` backed by Printful's REST API — raw\n * `fetch()` + `crypto.subtle`, no Printful Node SDK. Implements\n * `createFulfillmentOrder`/`verifyWebhookSignature`/`parseWebhookEvent`,\n * the full `FulfillmentProvider` surface (no optional capabilities are\n * defined on that interface yet).\n */\nexport function createPrintfulProvider(\n  config: PrintfulProviderConfig,\n): FulfillmentProvider {\n  return {\n    name: \"printful\",\n    createFulfillmentOrder: (request) =>\n      createFulfillmentOrder(config, request),\n    verifyWebhookSignature,\n    parseWebhookEvent,\n  };\n}\n"],"mappings":";;AA2CA,MAAM,WAAW;AAEjB,IAAM,mBAAN,cAA+B,MAAM;CAGjB;CACA;CAHlB,YACE,SACA,QACA,MACA;EACA,MAAM,OAAO;EAHG,KAAA,SAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;AAEA,eAAe,cACb,QACA,MACA,MACkC;CAClC,MAAM,WAAW,MAAM,MAAM,GAAG,WAAW,QAAQ;EACjD,GAAG;EACH,SAAS;GACP,eAAe,UAAU,OAAO;GAChC,gBAAgB;GAChB,GAAG,MAAM;EACX;CACF,CAAC;CACD,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;CAC1C,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,iBACR,4BAA4B,KAAK,uBAAuB,SAAS,UACjE,SAAS,QACT,MACF;CAEF,OAAO;AACT;;AAGA,SAAS,gBAAgB,YAGvB;CACA,MAAM,CAAC,aAAa,YAAY,WAAW,MAAM,GAAG;CACpD,MAAM,mBAAmB,OAAO,WAAW;CAC3C,MAAM,SAAS,OAAO,QAAQ;CAC9B,IAAI,CAAC,OAAO,SAAS,gBAAgB,KAAK,CAAC,OAAO,SAAS,MAAM,GAC/D,MAAM,IAAI,MACR,wBAAwB,WAAW,gDACrC;CAEF,OAAO;EAAE;EAAkB;CAAO;AACpC;AAaA,eAAe,uBACb,QACA,SACiC;CACjC,MAAM,aAAkC,QAAQ,UAAU,KAAK,SAAS;EACtE,MAAM,EAAE,kBAAkB,WAAW,gBAAgB,KAAK,UAAU;EACpE,OAAO;GACL,QAAQ;GACR,oBAAoB;GACpB,UAAU,KAAK;GACf,YAAY,CACV;IACE,WAAW;IACX,WAAW;IACX,QAAQ,CAAC;KAAE,MAAM;KAAQ,IAAI;IAAO,CAAC;GACvC,CACF;EACF;CACF,CAAC;CAED,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,MACR,iCAAiC,QAAQ,QAAQ,yBACnD;CAGF,MAAM,UAAU,QAAQ;CAoBxB,MAAM,SAAQ,MAnBS,cAAc,QAAQ,WAAW;EACtD,QAAQ;EACR,MAAM,KAAK,UAAU;GACnB,aAAa,gBAAgB,QAAQ;GACrC,WAAW;IACT,MAAM,CAAC,QAAQ,WAAW,QAAQ,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;IACpE,UAAU,QAAQ,YAAY;IAC9B,UAAU,QAAQ;IAClB,MAAM,QAAQ,QAAQ;IACtB,YAAY,QAAQ,SAAS;IAC7B,cAAc,QAAQ,WAAW;IACjC,KAAK,QAAQ,OAAO;IACpB,OAAO,QAAQ;IACf,OAAO,QAAQ;GACjB;GACA,aAAa;EACf,CAAC;CACH,CAAC,EAAA,CAEsB;CAEvB,IAAI,OAAO,aAMT,MAAM,cAAc,QAAQ,WAAW,MAAM,GAAG,gBAAgB,EAC9D,QAAQ,OACV,CAAC,CAAC,CAAC,OAAO,UAAU;EAClB,QAAQ,MACN,kCAAkC,MAAM,GAAG,sDAC3C,KACF;CACF,CAAC;CAGH,OAAO;EACL,wBAAwB,OAAO,MAAM,EAAE;EACvC,QAAQ;CACV;AACF;AAEA,eAAe,cAAc,SAAiB,QAAiC;CAC7E,MAAM,WAAW,IAAI,WACnB,OAAO,MAAM,SAAS,CAAC,EAAE,KAAK,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC,KAAK,CAAC,CACxE;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,UACA;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,QACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAClC;CACA,OAAO,MAAM,KAAK,IAAI,WAAW,SAAS,IAAI,MAC5C,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAChC,CAAC,CAAC,KAAK,EAAE;AACX;AAEA,SAAS,gBAAgB,GAAW,GAAoB;CACtD,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,IAAI,WAAW;CACf,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAC5B,YAAY,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;CAE9C,OAAO,aAAa;AACtB;;;;;;;AAQA,eAAe,uBAAuB,EACpC,SACA,SACA,UAKmB;CACnB,MAAM,YAAY,QAAQ,IAAI,wBAAwB;CACtD,IAAI,CAAC,WAAW,OAAO;CAEvB,OAAO,gBAAgB,MADA,cAAc,SAAS,MAAM,GACnB,SAAS;AAC5C;AAcA,SAAS,kBAAkB,SAGzB;CACA,MAAM,UAAU,KAAK,MAAM,OAAO;CAKlC,MAAM,UAAU,GAAG,QAAQ,KAAK,MAAM,GAAG,GAAG,QAAQ;CAEpD,IAAI,QAAQ,SAAS,mBAAmB,QAAQ,KAAK,UACnD,OAAO;EACL;EACA,OAAO;GACL,MAAM;GACN,wBAAwB,OAAO,QAAQ,KAAK,MAAM,EAAE;GACpD,QAAQ;GACR,gBAAgB,QAAQ,KAAK,SAAS;GACtC,iBAAiB,QAAQ,KAAK,SAAS;GACvC,aAAa,QAAQ,KAAK,SAAS;EACrC;CACF;CAGF,OAAO;EAAE;EAAS,OAAO;GAAE,MAAM;GAAa,SAAS,QAAQ;EAAK;CAAE;AACxE;;;;;;;;AASA,SAAgB,uBACd,QACqB;CACrB,OAAO;EACL,MAAM;EACN,yBAAyB,YACvB,uBAAuB,QAAQ,OAAO;EACxC;EACA;CACF;AACF"}

package/dist/index.d.cts

@@ -0,0 +1,26 @@
+import { FulfillmentProvider } from "@thebes/cadmea-plugin-ecommerce";
+
+//#region src/provider.d.ts
+interface PrintfulProviderConfig {
+  apiKey: string;
+  /**
+   * Printful orders are created as drafts by default — call
+   * `/confirmation` to submit them for production. Default: false, same
+   * "explicit opt-in" reasoning as the source app's
+   * `PRINTFUL_CONFIRM_ORDERS` env var — a misconfigured store should fail
+   * safe into "drafts piling up for manual review," not "real money spent
+   * printing untested orders."
+   */
+  autoConfirm?: boolean;
+}
+/**
+ * Creates a `FulfillmentProvider` backed by Printful's REST API — raw
+ * `fetch()` + `crypto.subtle`, no Printful Node SDK. Implements
+ * `createFulfillmentOrder`/`verifyWebhookSignature`/`parseWebhookEvent`,
+ * the full `FulfillmentProvider` surface (no optional capabilities are
+ * defined on that interface yet).
+ */
+declare function createPrintfulProvider(config: PrintfulProviderConfig): FulfillmentProvider;
+//#endregion
+export { PrintfulProviderConfig, createPrintfulProvider };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/provider.ts"],"mappings":";;;UA8BiB,sBAAA;EACf,MAAA;EADe;;;;AAUJ;AA4Ob;;;EA5OE,WAAW;AAAA;;;;AA8OS;;;;iBAFN,sBAAA,CACd,MAAA,EAAQ,sBAAA,GACP,mBAAmB"}

package/dist/index.d.ts

@@ -0,0 +1,26 @@
+import { FulfillmentProvider } from "@thebes/cadmea-plugin-ecommerce";
+
+//#region src/provider.d.ts
+interface PrintfulProviderConfig {
+  apiKey: string;
+  /**
+   * Printful orders are created as drafts by default — call
+   * `/confirmation` to submit them for production. Default: false, same
+   * "explicit opt-in" reasoning as the source app's
+   * `PRINTFUL_CONFIRM_ORDERS` env var — a misconfigured store should fail
+   * safe into "drafts piling up for manual review," not "real money spent
+   * printing untested orders."
+   */
+  autoConfirm?: boolean;
+}
+/**
+ * Creates a `FulfillmentProvider` backed by Printful's REST API — raw
+ * `fetch()` + `crypto.subtle`, no Printful Node SDK. Implements
+ * `createFulfillmentOrder`/`verifyWebhookSignature`/`parseWebhookEvent`,
+ * the full `FulfillmentProvider` surface (no optional capabilities are
+ * defined on that interface yet).
+ */
+declare function createPrintfulProvider(config: PrintfulProviderConfig): FulfillmentProvider;
+//#endregion
+export { PrintfulProviderConfig, createPrintfulProvider };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/provider.ts"],"mappings":";;;UA8BiB,sBAAA;EACf,MAAA;EADe;;;;AAUJ;AA4Ob;;;EA5OE,WAAW;AAAA;;;;AA8OS;;;;iBAFN,sBAAA,CACd,MAAA,EAAQ,sBAAA,GACP,mBAAmB"}

package/dist/index.js

@@ -0,0 +1,149 @@
+//#region src/provider.ts
+const BASE_URL = "https://api.printful.com";
+var PrintfulApiError = class extends Error {
+	status;
+	body;
+	constructor(message, status, body) {
+		super(message);
+		this.status = status;
+		this.body = body;
+		this.name = "PrintfulApiError";
+	}
+};
+async function printfulFetch(config, path, init) {
+	const response = await fetch(`${BASE_URL}${path}`, {
+		...init,
+		headers: {
+			Authorization: `Bearer ${config.apiKey}`,
+			"Content-Type": "application/json",
+			...init?.headers
+		}
+	});
+	const text = await response.text();
+	const parsed = text ? JSON.parse(text) : {};
+	if (!response.ok) throw new PrintfulApiError(`Printful API request to "${path}" failed with status ${response.status}`, response.status, parsed);
+	return parsed;
+}
+/** Splits a `"{catalogVariantId}:{fileId}"` catalogRef — see provider.ts's top-of-file design note. */
+function parseCatalogRef(catalogRef) {
+	const [variantPart, filePart] = catalogRef.split(":");
+	const catalogVariantId = Number(variantPart);
+	const fileId = Number(filePart);
+	if (!Number.isFinite(catalogVariantId) || !Number.isFinite(fileId)) throw new Error(`Printful catalogRef "${catalogRef}" must be in "{catalogVariantId}:{fileId}" form`);
+	return {
+		catalogVariantId,
+		fileId
+	};
+}
+async function createFulfillmentOrder(config, request) {
+	const orderItems = request.lineItems.map((item) => {
+		const { catalogVariantId, fileId } = parseCatalogRef(item.catalogRef);
+		return {
+			source: "catalog",
+			catalog_variant_id: catalogVariantId,
+			quantity: item.quantity,
+			placements: [{
+				placement: "default",
+				technique: "digital",
+				layers: [{
+					type: "file",
+					id: fileId
+				}]
+			}]
+		};
+	});
+	if (!orderItems.length) throw new Error(`Fulfillment order for orderId ${request.orderId} has no valid line items`);
+	const address = request.shippingAddress;
+	const order = (await printfulFetch(config, "/orders", {
+		method: "POST",
+		body: JSON.stringify({
+			external_id: `cadmea-order-${request.orderId}`,
+			recipient: {
+				name: [address.firstName, address.lastName].filter(Boolean).join(" "),
+				address1: address.address1 ?? "",
+				address2: address.address2,
+				city: address.city ?? "",
+				state_code: address.state ?? "",
+				country_code: address.country ?? "US",
+				zip: address.zip ?? "",
+				phone: address.phone,
+				email: request.customerEmail
+			},
+			order_items: orderItems
+		})
+	})).data;
+	if (config.autoConfirm) await printfulFetch(config, `/orders/${order.id}/confirmation`, { method: "POST" }).catch((error) => {
+		console.error(`[cadmea-plugin-printful] order ${order.id} confirmation failed — manual confirmation required`, error);
+	});
+	return {
+		providerFulfillmentRef: String(order.id),
+		status: "pending"
+	};
+}
+async function hmacSha256Hex(message, keyHex) {
+	const keyBytes = new Uint8Array(keyHex.match(/.{1,2}/g)?.map((byte) => Number.parseInt(byte, 16)) ?? []);
+	const key = await crypto.subtle.importKey("raw", keyBytes, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
+	return Array.from(new Uint8Array(signature), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let i = 0; i < a.length; i++) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return mismatch === 0;
+}
+/**
+* Verifies Printful's webhook signature: `x-pf-webhook-signature` is a hex
+* HMAC-SHA256 of the raw body, keyed by the webhook config's secret (itself
+* a hex string, decoded to bytes before use — Printful's own documented
+* format, ported from the source app's Node `crypto.createHmac` version).
+*/
+async function verifyWebhookSignature({ rawBody, headers, secret }) {
+	const signature = headers.get("x-pf-webhook-signature");
+	if (!signature) return false;
+	return timingSafeEqual(await hmacSha256Hex(rawBody, secret), signature);
+}
+function parseWebhookEvent(rawBody) {
+	const payload = JSON.parse(rawBody);
+	const eventId = `${payload.data.order.id}:${payload.type}`;
+	if (payload.type === "shipment_sent" && payload.data.shipment) return {
+		eventId,
+		event: {
+			kind: "fulfillment.updated",
+			providerFulfillmentRef: String(payload.data.order.id),
+			status: "shipped",
+			trackingNumber: payload.data.shipment.tracking_number,
+			trackingCarrier: payload.data.shipment.service,
+			trackingUrl: payload.data.shipment.tracking_url
+		}
+	};
+	return {
+		eventId,
+		event: {
+			kind: "unhandled",
+			rawType: payload.type
+		}
+	};
+}
+/**
+* Creates a `FulfillmentProvider` backed by Printful's REST API — raw
+* `fetch()` + `crypto.subtle`, no Printful Node SDK. Implements
+* `createFulfillmentOrder`/`verifyWebhookSignature`/`parseWebhookEvent`,
+* the full `FulfillmentProvider` surface (no optional capabilities are
+* defined on that interface yet).
+*/
+function createPrintfulProvider(config) {
+	return {
+		name: "printful",
+		createFulfillmentOrder: (request) => createFulfillmentOrder(config, request),
+		verifyWebhookSignature,
+		parseWebhookEvent
+	};
+}
+//#endregion
+export { createPrintfulProvider };
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/provider.ts"],"sourcesContent":["// Copyright (c) 2026 BowenLabs. All rights reserved.\n// MIT licensed. See LICENSE in the repo root.\n//\n// Printful's REST API (v2 for orders, v1 for shipping rates) directly via\n// fetch() — never a Node-targeted Printful SDK. Webhook signature\n// verification uses crypto.subtle, mirroring\n// @thebes/cadmea-plugin-ecommerce-stripe's provider.ts.\n//\n// Design note on `catalogRef`: `FulfillmentLineItem.catalogRef` is one\n// opaque string per the FulfillmentProvider contract, but a Printful order\n// item needs two independent ids — a `catalog_variant_id` (which blank\n// product/size) and a `file id` (which artwork file gets printed on it).\n// The source app modeled this as two linked Payload collections\n// (PrintfulProducts + PrintAssets with a manual sync step uploading files to\n// Printful ahead of checkout). That collection pair has no Cadmea analog\n// yet and is out of scope for this port (see project plan's flagged\n// architecture changes). Instead, `catalogRef` here is the two ids joined\n// with a colon — `\"{catalogVariantId}:{fileId}\"` — set directly on each\n// `products` variant's `catalogRef` field in the Cadmea admin once a file is\n// uploaded to Printful by hand or via Printful's own dashboard. Revisit with\n// a real sync collection only once manual catalogRef entry is a measured\n// operational problem, not a theoretical one.\n\nimport type {\n  FulfillmentOrderRequest,\n  FulfillmentOrderResult,\n  FulfillmentProvider,\n  NormalizedFulfillmentWebhookEvent,\n} from \"@thebes/cadmea-plugin-ecommerce\";\n\nexport interface PrintfulProviderConfig {\n  apiKey: string;\n  /**\n   * Printful orders are created as drafts by default — call\n   * `/confirmation` to submit them for production. Default: false, same\n   * \"explicit opt-in\" reasoning as the source app's\n   * `PRINTFUL_CONFIRM_ORDERS` env var — a misconfigured store should fail\n   * safe into \"drafts piling up for manual review,\" not \"real money spent\n   * printing untested orders.\"\n   */\n  autoConfirm?: boolean;\n}\n\nconst BASE_URL = \"https://api.printful.com\";\n\nclass PrintfulApiError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: unknown,\n  ) {\n    super(message);\n    this.name = \"PrintfulApiError\";\n  }\n}\n\nasync function printfulFetch(\n  config: PrintfulProviderConfig,\n  path: string,\n  init?: RequestInit,\n): Promise<Record<string, unknown>> {\n  const response = await fetch(`${BASE_URL}${path}`, {\n    ...init,\n    headers: {\n      Authorization: `Bearer ${config.apiKey}`,\n      \"Content-Type\": \"application/json\",\n      ...init?.headers,\n    },\n  });\n  const text = await response.text();\n  const parsed = text ? JSON.parse(text) : {};\n  if (!response.ok) {\n    throw new PrintfulApiError(\n      `Printful API request to \"${path}\" failed with status ${response.status}`,\n      response.status,\n      parsed,\n    );\n  }\n  return parsed;\n}\n\n/** Splits a `\"{catalogVariantId}:{fileId}\"` catalogRef — see provider.ts's top-of-file design note. */\nfunction parseCatalogRef(catalogRef: string): {\n  catalogVariantId: number;\n  fileId: number;\n} {\n  const [variantPart, filePart] = catalogRef.split(\":\");\n  const catalogVariantId = Number(variantPart);\n  const fileId = Number(filePart);\n  if (!Number.isFinite(catalogVariantId) || !Number.isFinite(fileId)) {\n    throw new Error(\n      `Printful catalogRef \"${catalogRef}\" must be in \"{catalogVariantId}:{fileId}\" form`,\n    );\n  }\n  return { catalogVariantId, fileId };\n}\n\ninterface PrintfulOrderItem {\n  source: \"catalog\";\n  catalog_variant_id: number;\n  quantity: number;\n  placements: Array<{\n    placement: string;\n    technique: string;\n    layers: Array<{ type: \"file\"; id: number }>;\n  }>;\n}\n\nasync function createFulfillmentOrder(\n  config: PrintfulProviderConfig,\n  request: FulfillmentOrderRequest,\n): Promise<FulfillmentOrderResult> {\n  const orderItems: PrintfulOrderItem[] = request.lineItems.map((item) => {\n    const { catalogVariantId, fileId } = parseCatalogRef(item.catalogRef);\n    return {\n      source: \"catalog\",\n      catalog_variant_id: catalogVariantId,\n      quantity: item.quantity,\n      placements: [\n        {\n          placement: \"default\",\n          technique: \"digital\",\n          layers: [{ type: \"file\", id: fileId }],\n        },\n      ],\n    };\n  });\n\n  if (!orderItems.length) {\n    throw new Error(\n      `Fulfillment order for orderId ${request.orderId} has no valid line items`,\n    );\n  }\n\n  const address = request.shippingAddress;\n  const response = await printfulFetch(config, \"/orders\", {\n    method: \"POST\",\n    body: JSON.stringify({\n      external_id: `cadmea-order-${request.orderId}`,\n      recipient: {\n        name: [address.firstName, address.lastName].filter(Boolean).join(\" \"),\n        address1: address.address1 ?? \"\",\n        address2: address.address2,\n        city: address.city ?? \"\",\n        state_code: address.state ?? \"\",\n        country_code: address.country ?? \"US\",\n        zip: address.zip ?? \"\",\n        phone: address.phone,\n        email: request.customerEmail,\n      },\n      order_items: orderItems,\n    }),\n  });\n\n  const order = response.data as { id: number; status: string };\n\n  if (config.autoConfirm) {\n    // A confirmation failure is logged, never thrown — the draft order\n    // already exists at Printful and is visible for manual confirmation;\n    // surfacing this as a fulfillment-creation failure would cause the\n    // order-paid hook's caller to retry order creation and risk a\n    // duplicate Printful order for the same Cadmea order.\n    await printfulFetch(config, `/orders/${order.id}/confirmation`, {\n      method: \"POST\",\n    }).catch((error) => {\n      console.error(\n        `[cadmea-plugin-printful] order ${order.id} confirmation failed — manual confirmation required`,\n        error,\n      );\n    });\n  }\n\n  return {\n    providerFulfillmentRef: String(order.id),\n    status: \"pending\",\n  };\n}\n\nasync function hmacSha256Hex(message: string, keyHex: string): Promise<string> {\n  const keyBytes = new Uint8Array(\n    keyHex.match(/.{1,2}/g)?.map((byte) => Number.parseInt(byte, 16)) ?? [],\n  );\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    keyBytes,\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = await crypto.subtle.sign(\n    \"HMAC\",\n    key,\n    new TextEncoder().encode(message),\n  );\n  return Array.from(new Uint8Array(signature), (b) =>\n    b.toString(16).padStart(2, \"0\"),\n  ).join(\"\");\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\n/**\n * Verifies Printful's webhook signature: `x-pf-webhook-signature` is a hex\n * HMAC-SHA256 of the raw body, keyed by the webhook config's secret (itself\n * a hex string, decoded to bytes before use — Printful's own documented\n * format, ported from the source app's Node `crypto.createHmac` version).\n */\nasync function verifyWebhookSignature({\n  rawBody,\n  headers,\n  secret,\n}: {\n  rawBody: string;\n  headers: Headers;\n  secret: string;\n}): Promise<boolean> {\n  const signature = headers.get(\"x-pf-webhook-signature\");\n  if (!signature) return false;\n  const expected = await hmacSha256Hex(rawBody, secret);\n  return timingSafeEqual(expected, signature);\n}\n\ninterface ShipmentSentPayload {\n  type: string;\n  data: {\n    order: { id: number };\n    shipment?: {\n      tracking_number: string;\n      tracking_url: string;\n      service: string;\n    };\n  };\n}\n\nfunction parseWebhookEvent(rawBody: string): {\n  eventId: string;\n  event: NormalizedFulfillmentWebhookEvent;\n} {\n  const payload = JSON.parse(rawBody) as ShipmentSentPayload;\n  // Printful doesn't include a stable webhook event id in its payload (no\n  // `id` field, unlike Stripe) — the order id + type pair is unique enough\n  // for this plugin's dedup purposes, since a real duplicate delivery\n  // re-sends the exact same order/type combination.\n  const eventId = `${payload.data.order.id}:${payload.type}`;\n\n  if (payload.type === \"shipment_sent\" && payload.data.shipment) {\n    return {\n      eventId,\n      event: {\n        kind: \"fulfillment.updated\",\n        providerFulfillmentRef: String(payload.data.order.id),\n        status: \"shipped\",\n        trackingNumber: payload.data.shipment.tracking_number,\n        trackingCarrier: payload.data.shipment.service,\n        trackingUrl: payload.data.shipment.tracking_url,\n      },\n    };\n  }\n\n  return { eventId, event: { kind: \"unhandled\", rawType: payload.type } };\n}\n\n/**\n * Creates a `FulfillmentProvider` backed by Printful's REST API — raw\n * `fetch()` + `crypto.subtle`, no Printful Node SDK. Implements\n * `createFulfillmentOrder`/`verifyWebhookSignature`/`parseWebhookEvent`,\n * the full `FulfillmentProvider` surface (no optional capabilities are\n * defined on that interface yet).\n */\nexport function createPrintfulProvider(\n  config: PrintfulProviderConfig,\n): FulfillmentProvider {\n  return {\n    name: \"printful\",\n    createFulfillmentOrder: (request) =>\n      createFulfillmentOrder(config, request),\n    verifyWebhookSignature,\n    parseWebhookEvent,\n  };\n}\n"],"mappings":";AA2CA,MAAM,WAAW;AAEjB,IAAM,mBAAN,cAA+B,MAAM;CAGjB;CACA;CAHlB,YACE,SACA,QACA,MACA;EACA,MAAM,OAAO;EAHG,KAAA,SAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;AAEA,eAAe,cACb,QACA,MACA,MACkC;CAClC,MAAM,WAAW,MAAM,MAAM,GAAG,WAAW,QAAQ;EACjD,GAAG;EACH,SAAS;GACP,eAAe,UAAU,OAAO;GAChC,gBAAgB;GAChB,GAAG,MAAM;EACX;CACF,CAAC;CACD,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,MAAM,SAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;CAC1C,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,iBACR,4BAA4B,KAAK,uBAAuB,SAAS,UACjE,SAAS,QACT,MACF;CAEF,OAAO;AACT;;AAGA,SAAS,gBAAgB,YAGvB;CACA,MAAM,CAAC,aAAa,YAAY,WAAW,MAAM,GAAG;CACpD,MAAM,mBAAmB,OAAO,WAAW;CAC3C,MAAM,SAAS,OAAO,QAAQ;CAC9B,IAAI,CAAC,OAAO,SAAS,gBAAgB,KAAK,CAAC,OAAO,SAAS,MAAM,GAC/D,MAAM,IAAI,MACR,wBAAwB,WAAW,gDACrC;CAEF,OAAO;EAAE;EAAkB;CAAO;AACpC;AAaA,eAAe,uBACb,QACA,SACiC;CACjC,MAAM,aAAkC,QAAQ,UAAU,KAAK,SAAS;EACtE,MAAM,EAAE,kBAAkB,WAAW,gBAAgB,KAAK,UAAU;EACpE,OAAO;GACL,QAAQ;GACR,oBAAoB;GACpB,UAAU,KAAK;GACf,YAAY,CACV;IACE,WAAW;IACX,WAAW;IACX,QAAQ,CAAC;KAAE,MAAM;KAAQ,IAAI;IAAO,CAAC;GACvC,CACF;EACF;CACF,CAAC;CAED,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,MACR,iCAAiC,QAAQ,QAAQ,yBACnD;CAGF,MAAM,UAAU,QAAQ;CAoBxB,MAAM,SAAQ,MAnBS,cAAc,QAAQ,WAAW;EACtD,QAAQ;EACR,MAAM,KAAK,UAAU;GACnB,aAAa,gBAAgB,QAAQ;GACrC,WAAW;IACT,MAAM,CAAC,QAAQ,WAAW,QAAQ,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;IACpE,UAAU,QAAQ,YAAY;IAC9B,UAAU,QAAQ;IAClB,MAAM,QAAQ,QAAQ;IACtB,YAAY,QAAQ,SAAS;IAC7B,cAAc,QAAQ,WAAW;IACjC,KAAK,QAAQ,OAAO;IACpB,OAAO,QAAQ;IACf,OAAO,QAAQ;GACjB;GACA,aAAa;EACf,CAAC;CACH,CAAC,EAAA,CAEsB;CAEvB,IAAI,OAAO,aAMT,MAAM,cAAc,QAAQ,WAAW,MAAM,GAAG,gBAAgB,EAC9D,QAAQ,OACV,CAAC,CAAC,CAAC,OAAO,UAAU;EAClB,QAAQ,MACN,kCAAkC,MAAM,GAAG,sDAC3C,KACF;CACF,CAAC;CAGH,OAAO;EACL,wBAAwB,OAAO,MAAM,EAAE;EACvC,QAAQ;CACV;AACF;AAEA,eAAe,cAAc,SAAiB,QAAiC;CAC7E,MAAM,WAAW,IAAI,WACnB,OAAO,MAAM,SAAS,CAAC,EAAE,KAAK,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC,KAAK,CAAC,CACxE;CACA,MAAM,MAAM,MAAM,OAAO,OAAO,UAC9B,OACA,UACA;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;CACA,MAAM,YAAY,MAAM,OAAO,OAAO,KACpC,QACA,KACA,IAAI,YAAY,CAAC,CAAC,OAAO,OAAO,CAClC;CACA,OAAO,MAAM,KAAK,IAAI,WAAW,SAAS,IAAI,MAC5C,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAChC,CAAC,CAAC,KAAK,EAAE;AACX;AAEA,SAAS,gBAAgB,GAAW,GAAoB;CACtD,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,IAAI,WAAW;CACf,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAC5B,YAAY,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;CAE9C,OAAO,aAAa;AACtB;;;;;;;AAQA,eAAe,uBAAuB,EACpC,SACA,SACA,UAKmB;CACnB,MAAM,YAAY,QAAQ,IAAI,wBAAwB;CACtD,IAAI,CAAC,WAAW,OAAO;CAEvB,OAAO,gBAAgB,MADA,cAAc,SAAS,MAAM,GACnB,SAAS;AAC5C;AAcA,SAAS,kBAAkB,SAGzB;CACA,MAAM,UAAU,KAAK,MAAM,OAAO;CAKlC,MAAM,UAAU,GAAG,QAAQ,KAAK,MAAM,GAAG,GAAG,QAAQ;CAEpD,IAAI,QAAQ,SAAS,mBAAmB,QAAQ,KAAK,UACnD,OAAO;EACL;EACA,OAAO;GACL,MAAM;GACN,wBAAwB,OAAO,QAAQ,KAAK,MAAM,EAAE;GACpD,QAAQ;GACR,gBAAgB,QAAQ,KAAK,SAAS;GACtC,iBAAiB,QAAQ,KAAK,SAAS;GACvC,aAAa,QAAQ,KAAK,SAAS;EACrC;CACF;CAGF,OAAO;EAAE;EAAS,OAAO;GAAE,MAAM;GAAa,SAAS,QAAQ;EAAK;CAAE;AACxE;;;;;;;;AASA,SAAgB,uBACd,QACqB;CACrB,OAAO;EACL,MAAM;EACN,yBAAyB,YACvB,uBAAuB,QAAQ,OAAO;EACxC;EACA;CACF;AACF"}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@thebes/cadmea-plugin-printful",
+  "version": "1.0.0",
+  "description": "Printful FulfillmentProvider for @thebes/cadmea-plugin-ecommerce — raw fetch() + crypto.subtle, no Printful Node SDK",
+  "author": "BowenLabs <hello@bowenlabs.io>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bowenlabs/project-thebes",
+    "directory": "packages/cadmea-plugin-printful"
+  },
+  "homepage": "https://github.com/bowenlabs/project-thebes/tree/main/packages/cadmea-plugin-printful#readme",
+  "bugs": {
+    "url": "https://github.com/bowenlabs/project-thebes/issues"
+  },
+  "keywords": [
+    "cadmea",
+    "cadmus",
+    "cms",
+    "ecommerce",
+    "printful",
+    "fulfillment",
+    "print-on-demand",
+    "cloudflare"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@thebes/cadmea-plugin-ecommerce": "^1.1.0",
+    "@thebes/cadmus": "^0.2.1"
+  },
+  "devDependencies": {
+    "typescript": "latest",
+    "vite-plus": "latest",
+    "vitest": "latest",
+    "@thebes/cadmea-plugin-ecommerce": "^1.1.0",
+    "@thebes/cadmus": "^0.2.1"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "vp pack",
+    "dev": "vp pack --watch",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}