medusa-plugin-ordinant 0.1.0

package/.medusa/server/src/api/store/ordinant/preview/route.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.POST = POST;
+const utils_1 = require("@medusajs/framework/utils");
+const ordinant_1 = require("../../../../modules/ordinant");
+/** A "nothing to check yet" answer — advisory previews always resolve to a
+ * clear result rather than an error, so a checkout step never breaks on them. */
+const clear = (skipped) => ({
+    preview: true,
+    disposition: "ALLOW",
+    items: [],
+    ...(skipped ? { skipped } : {}),
+});
+/**
+ * POST /store/ordinant/preview
+ *
+ * Advisory, non-logging compliance preview for the storefront. Given a cart id
+ * (and any buyer assertions gathered so far), it resolves the cart's items and
+ * destination server-side and returns what the checkout gate WOULD decide — so
+ * the UI can warn early (e.g. when the shipping state is entered) instead of
+ * only at "Place Order".
+ *
+ * `destination` may be passed to check a PROPOSED address that hasn't been
+ * saved to the cart yet — this lets the storefront reject a blocked address
+ * before it's ever persisted. When omitted, the cart's saved shipping address
+ * is used.
+ *
+ * Opt-in and advisory: it never blocks and fails open. The authoritative,
+ * non-bypassable gate is the completeCart hook (validate-cart-completion).
+ */
+async function POST(req, res) {
+    const { cart_id, buyer, destination } = req.validatedBody;
+    const ordinant = req.scope.resolve(ordinant_1.ORDINANT_MODULE);
+    if (!ordinant.configured) {
+        res.json(clear("not_configured"));
+        return;
+    }
+    const query = req.scope.resolve(utils_1.ContainerRegistrationKeys.QUERY);
+    const { data } = await query.graph({
+        entity: "cart",
+        filters: { id: cart_id },
+        fields: [
+            "id",
+            "metadata",
+            "shipping_address.country_code",
+            "shipping_address.province",
+            "shipping_address.postal_code",
+            "shipping_address.city",
+            "shipping_address.address_1",
+            "items.variant_sku",
+            "items.quantity",
+        ],
+    });
+    const cart = data?.[0];
+    if (!cart) {
+        res.json(clear("cart_not_found"));
+        return;
+    }
+    // Prefer the proposed destination (a not-yet-saved address) over the cart's
+    // saved one, so the storefront can vet an address before persisting it.
+    const sa = cart.shipping_address;
+    const country = (destination?.country_code ?? sa?.country_code ?? "").toLowerCase();
+    const state = (destination?.state ?? sa?.province ?? "").toUpperCase();
+    // US-only model; nothing to preview until a state is known.
+    if (country && country !== "us") {
+        res.json(clear("non_us"));
+        return;
+    }
+    if (!state) {
+        res.json(clear("no_state"));
+        return;
+    }
+    const items = (cart.items ?? [])
+        .filter((i) => i?.variant_sku)
+        .map((i) => ({
+        sku: i.variant_sku,
+        quantity: i.quantity ?? 1,
+        attributes: {},
+    }));
+    if (items.length === 0) {
+        res.json(clear());
+        return;
+    }
+    // Assertions already on the cart, overlaid with whatever the caller just
+    // gathered this step.
+    const cartBuyer = (cart.metadata?.ordinant_buyer ?? {});
+    const mergedBuyer = { ...cartBuyer, ...(buyer ?? {}) };
+    try {
+        const decision = await ordinant.client.previewDecision({
+            destination: {
+                state,
+                zip: destination?.zip ?? sa?.postal_code ?? undefined,
+                city: destination?.city ?? sa?.city ?? undefined,
+                line1: destination?.line1 ?? sa?.address_1 ?? undefined,
+            },
+            buyer: mergedBuyer,
+            items,
+        }, 
+        // Keyed per cart so a blocked attempt is counted once for the merchant's
+        // stopped-orders metric, no matter how many times the address step
+        // re-previews it.
+        `preview-block:${cart_id}`);
+        res.json(decision);
+    }
+    catch {
+        // Advisory only: never fail a checkout step because the preview is down.
+        res.json(clear("preview_unavailable"));
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm91dGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi8uLi9zcmMvYXBpL3N0b3JlL29yZGluYW50L3ByZXZpZXcvcm91dGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFpQ0Esb0JBc0ZDO0FBdEhELHFEQUFxRTtBQUNyRSwyREFBOEQ7QUFLOUQ7aUZBQ2lGO0FBQ2pGLE1BQU0sS0FBSyxHQUFHLENBQUMsT0FBZ0IsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNuQyxPQUFPLEVBQUUsSUFBYTtJQUN0QixXQUFXLEVBQUUsT0FBZ0I7SUFDN0IsS0FBSyxFQUFFLEVBQWU7SUFDdEIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0NBQ2hDLENBQUMsQ0FBQTtBQUVGOzs7Ozs7Ozs7Ozs7Ozs7O0dBZ0JHO0FBQ0ksS0FBSyxVQUFVLElBQUksQ0FBQyxHQUFpQyxFQUFFLEdBQW1CO0lBQy9FLE1BQU0sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxHQUFHLEdBQUcsQ0FBQyxhQUFhLENBQUE7SUFDekQsTUFBTSxRQUFRLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQXdCLDBCQUFlLENBQUMsQ0FBQTtJQUUxRSxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ3pCLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQTtRQUNqQyxPQUFNO0lBQ1IsQ0FBQztJQUVELE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGlDQUF5QixDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ2hFLE1BQU0sRUFBRSxJQUFJLEVBQUUsR0FBRyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDakMsTUFBTSxFQUFFLE1BQU07UUFDZCxPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQUUsT0FBTyxFQUFFO1FBQ3hCLE1BQU0sRUFBRTtZQUNOLElBQUk7WUFDSixVQUFVO1lBQ1YsK0JBQStCO1lBQy9CLDJCQUEyQjtZQUMzQiw4QkFBOEI7WUFDOUIsdUJBQXVCO1lBQ3ZCLDRCQUE0QjtZQUM1QixtQkFBbUI7WUFDbkIsZ0JBQWdCO1NBQ2pCO0tBQ0YsQ0FBQyxDQUFBO0lBQ0YsTUFBTSxJQUFJLEdBQUcsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDdEIsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ1YsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFBO1FBQ2pDLE9BQU07SUFDUixDQUFDO0lBRUQsNEVBQTRFO0lBQzVFLHdFQUF3RTtJQUN4RSxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsZ0JBQWdCLENBQUE7SUFDaEMsTUFBTSxPQUFPLEdBQUcsQ0FBQyxXQUFXLEVBQUUsWUFBWSxJQUFJLEVBQUUsRUFBRSxZQUFZLElBQUksRUFBRSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUE7SUFDbkYsTUFBTSxLQUFLLEdBQUcsQ0FBQyxXQUFXLEVBQUUsS0FBSyxJQUFJLEVBQUUsRUFBRSxRQUFRLElBQUksRUFBRSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUE7SUFFdEUsNERBQTREO0lBQzVELElBQUksT0FBTyxJQUFJLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNoQyxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFBO1FBQ3pCLE9BQU07SUFDUixDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ1gsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQTtRQUMzQixPQUFNO0lBQ1IsQ0FBQztJQUVELE1BQU0sS0FBSyxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7U0FDN0IsTUFBTSxDQUFDLENBQUMsQ0FBMkIsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLFdBQVcsQ0FBQztTQUN2RCxHQUFHLENBQUMsQ0FBQyxDQUE2QyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZELEdBQUcsRUFBRSxDQUFDLENBQUMsV0FBVztRQUNsQixRQUFRLEVBQUUsQ0FBQyxDQUFDLFFBQVEsSUFBSSxDQUFDO1FBQ3pCLFVBQVUsRUFBRSxFQUFFO0tBQ2YsQ0FBQyxDQUFDLENBQUE7SUFDTCxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDdkIsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFBO1FBQ2pCLE9BQU07SUFDUixDQUFDO0lBRUQseUVBQXlFO0lBQ3pFLHNCQUFzQjtJQUN0QixNQUFNLFNBQVMsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsY0FBYyxJQUFJLEVBQUUsQ0FBVSxDQUFBO0lBQ2hFLE1BQU0sV0FBVyxHQUFVLEVBQUUsR0FBRyxTQUFTLEVBQUUsR0FBRyxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFBO0lBRTdELElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sUUFBUSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQ3BEO1lBQ0UsV0FBVyxFQUFFO2dCQUNYLEtBQUs7Z0JBQ0wsR0FBRyxFQUFFLFdBQVcsRUFBRSxHQUFHLElBQUksRUFBRSxFQUFFLFdBQVcsSUFBSSxTQUFTO2dCQUNyRCxJQUFJLEVBQUUsV0FBVyxFQUFFLElBQUksSUFBSSxFQUFFLEVBQUUsSUFBSSxJQUFJLFNBQVM7Z0JBQ2hELEtBQUssRUFBRSxXQUFXLEVBQUUsS0FBSyxJQUFJLEVBQUUsRUFBRSxTQUFTLElBQUksU0FBUzthQUN4RDtZQUNELEtBQUssRUFBRSxXQUFXO1lBQ2xCLEtBQUs7U0FDTjtRQUNELHlFQUF5RTtRQUN6RSxtRUFBbUU7UUFDbkUsa0JBQWtCO1FBQ2xCLGlCQUFpQixPQUFPLEVBQUUsQ0FDM0IsQ0FBQTtRQUNELEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUE7SUFDcEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLHlFQUF5RTtRQUN6RSxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLENBQUE7SUFDeEMsQ0FBQztBQUNILENBQUMifQ==

package/.medusa/server/src/api/store/ordinant/preview/validators.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PreviewSchema = void 0;
+const zod_1 = require("zod");
+/** Body for POST /store/ordinant/preview. `cart_id` identifies the cart to
+ * check; `buyer` carries any verification assertions gathered so far (merged
+ * over whatever is already on the cart). */
+exports.PreviewSchema = zod_1.z.object({
+    cart_id: zod_1.z.string().min(1),
+    /** A proposed destination to check before it's saved to the cart. When
+     * omitted, the cart's saved shipping address is used. */
+    destination: zod_1.z
+        .object({
+        state: zod_1.z.string(),
+        country_code: zod_1.z.string(),
+        zip: zod_1.z.string(),
+        city: zod_1.z.string(),
+        line1: zod_1.z.string(),
+    })
+        .partial()
+        .optional(),
+    buyer: zod_1.z
+        .object({
+        age_verified: zod_1.z.boolean(),
+        verified_age: zod_1.z.number(),
+        ffl_verified: zod_1.z.boolean(),
+        sot_verified: zod_1.z.boolean(),
+        permits: zod_1.z.array(zod_1.z.string()),
+        fulfillment_method: zod_1.z.enum(["ship", "in_store_pickup"]),
+    })
+        .partial()
+        .optional(),
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdG9ycy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uLy4uL3NyYy9hcGkvc3RvcmUvb3JkaW5hbnQvcHJldmlldy92YWxpZGF0b3JzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDZCQUF1QjtBQUV2Qjs7NENBRTRDO0FBQy9CLFFBQUEsYUFBYSxHQUFHLE9BQUMsQ0FBQyxNQUFNLENBQUM7SUFDcEMsT0FBTyxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzFCOzZEQUN5RDtJQUN6RCxXQUFXLEVBQUUsT0FBQztTQUNYLE1BQU0sQ0FBQztRQUNOLEtBQUssRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFO1FBQ2pCLFlBQVksRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFO1FBQ3hCLEdBQUcsRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFO1FBQ2YsSUFBSSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUU7UUFDaEIsS0FBSyxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUU7S0FDbEIsQ0FBQztTQUNELE9BQU8sRUFBRTtTQUNULFFBQVEsRUFBRTtJQUNiLEtBQUssRUFBRSxPQUFDO1NBQ0wsTUFBTSxDQUFDO1FBQ04sWUFBWSxFQUFFLE9BQUMsQ0FBQyxPQUFPLEVBQUU7UUFDekIsWUFBWSxFQUFFLE9BQUMsQ0FBQyxNQUFNLEVBQUU7UUFDeEIsWUFBWSxFQUFFLE9BQUMsQ0FBQyxPQUFPLEVBQUU7UUFDekIsWUFBWSxFQUFFLE9BQUMsQ0FBQyxPQUFPLEVBQUU7UUFDekIsT0FBTyxFQUFFLE9BQUMsQ0FBQyxLQUFLLENBQUMsT0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzVCLGtCQUFrQixFQUFFLE9BQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztLQUN4RCxDQUFDO1NBQ0QsT0FBTyxFQUFFO1NBQ1QsUUFBUSxFQUFFO0NBQ2QsQ0FBQyxDQUFBIn0=

package/.medusa/server/src/lib/client.js

@@ -0,0 +1,136 @@
+"use strict";
+/**
+ * Thin typed client for the Ordinant decision API. The plugin never
+ * interprets compliance logic itself — determinism lives server-side; this
+ * client just carries requests and citations.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrdinantClient = exports.OrdinantApiError = void 0;
+class OrdinantApiError extends Error {
+    constructor(message, code, status) {
+        super(message);
+        this.name = "OrdinantApiError";
+        this.code = code;
+        this.status = status;
+    }
+}
+exports.OrdinantApiError = OrdinantApiError;
+class OrdinantClient {
+    constructor(options) {
+        this.configured = Boolean(options.baseUrl && options.apiKey);
+        this.baseUrl = (options.baseUrl ?? "").replace(/\/+$/, "");
+        this.apiKey = options.apiKey ?? "";
+        this.timeoutMs = options.timeoutMs ?? 5000;
+        this.catalogTimeoutMs = options.catalogTimeoutMs ?? 120_000;
+    }
+    /** Blocked-order metrics for the merchant tied to this API key. */
+    async blockStats() {
+        return this.call("GET", "/v1/stats/blocks");
+    }
+    /** Current ruleset summary — a cheap authenticated probe used by the
+     * dashboard's readiness check. */
+    async currentRuleset() {
+        return this.call("GET", "/v1/rulesets/current");
+    }
+    async decide(request, idempotencyKey) {
+        const headers = {};
+        if (idempotencyKey) {
+            headers["Idempotency-Key"] = idempotencyKey;
+        }
+        return this.call("POST", "/v1/decisions", request, headers);
+    }
+    /** Preview a decision without logging it — for surfacing compliance early in
+     * checkout (advisory). Never use this to gate an order; the authoritative,
+     * logged decision is `decide()`. Passing `idempotencyKey` (keyed per cart)
+     * records a BLOCK once, so a stopped attempt counts toward the merchant's
+     * blocked-order metric without repeat previews inflating it. */
+    async previewDecision(request, idempotencyKey) {
+        const headers = {};
+        if (idempotencyKey) {
+            headers["Idempotency-Key"] = idempotencyKey;
+        }
+        return this.call("POST", "/v1/decisions/preview", request, headers);
+    }
+    async classifyCatalog(items) {
+        // Classification makes one LLM call per item (6-way concurrent
+        // server-side); a batch legitimately outlasts the checkout timeout.
+        return this.call("POST", "/v1/catalog/classify", { items }, {}, this.catalogTimeoutMs);
+    }
+    /** The attribute dictionary the current ruleset decides against — the
+     * schema the classification editor renders its dropdowns from. */
+    async getDictionary() {
+        const snapshot = await this.call("GET", "/v1/rulesets/current/full");
+        return snapshot.dictionary;
+    }
+    async listClassifications(status, limit) {
+        const params = new URLSearchParams();
+        if (status) {
+            params.set("status", status);
+        }
+        if (limit) {
+            params.set("limit", String(limit));
+        }
+        const qs = params.size > 0 ? `?${params}` : "";
+        return this.call("GET", `/v1/catalog/classifications${qs}`);
+    }
+    async confirmClassification(sku, attributes) {
+        return this.call("POST", `/v1/catalog/classifications/${encodeURIComponent(sku)}/confirm`, { attributes });
+    }
+    async call(method, path, body, extraHeaders = {}, timeoutMs = this.timeoutMs) {
+        if (!this.configured) {
+            throw new OrdinantApiError("Ordinant is not configured — set ORDINANT_BASE_URL and ORDINANT_API_KEY", "not_configured");
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(this.baseUrl + path, {
+                method,
+                headers: {
+                    authorization: `Bearer ${this.apiKey}`,
+                    "content-type": "application/json",
+                    ...extraHeaders,
+                },
+                body: body === undefined ? null : JSON.stringify(body),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            const aborted = err instanceof Error && err.name === "AbortError";
+            throw new OrdinantApiError(aborted
+                ? `Ordinant request timed out after ${timeoutMs}ms`
+                : `Ordinant transport error: ${String(err)}`, aborted ? "timeout" : "transport");
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const text = await res.text();
+        if (!res.ok) {
+            let code = "http_error";
+            let message = `HTTP ${res.status}`;
+            try {
+                const parsed = JSON.parse(text);
+                if (parsed.error?.code) {
+                    code = parsed.error.code;
+                }
+                if (parsed.error?.message) {
+                    message = parsed.error.message;
+                }
+            }
+            catch {
+                if (text) {
+                    message = `${message}: ${text.slice(0, 200)}`;
+                }
+            }
+            throw new OrdinantApiError(message, code, res.status);
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new OrdinantApiError("invalid JSON from Ordinant", "bad_response", res.status);
+        }
+    }
+}
+exports.OrdinantClient = OrdinantClient;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2xpYi9jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBOzs7O0dBSUc7OztBQWtLSCxNQUFhLGdCQUFpQixTQUFRLEtBQUs7SUFJekMsWUFBWSxPQUFlLEVBQUUsSUFBWSxFQUFFLE1BQWU7UUFDeEQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFBO1FBQ2QsSUFBSSxDQUFDLElBQUksR0FBRyxrQkFBa0IsQ0FBQTtRQUM5QixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQTtRQUNoQixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQTtJQUN0QixDQUFDO0NBQ0Y7QUFWRCw0Q0FVQztBQWlCRCxNQUFhLGNBQWM7SUFVekIsWUFBWSxPQUE4QjtRQUN4QyxJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQTtRQUM1RCxJQUFJLENBQUMsT0FBTyxHQUFHLENBQUMsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQzFELElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUE7UUFDbEMsSUFBSSxDQUFDLFNBQVMsR0FBRyxPQUFPLENBQUMsU0FBUyxJQUFJLElBQUksQ0FBQTtRQUMxQyxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsT0FBTyxDQUFDLGdCQUFnQixJQUFJLE9BQU8sQ0FBQTtJQUM3RCxDQUFDO0lBRUQsbUVBQW1FO0lBQ25FLEtBQUssQ0FBQyxVQUFVO1FBQ2QsT0FBTyxJQUFJLENBQUMsSUFBSSxDQUFhLEtBQUssRUFBRSxrQkFBa0IsQ0FBQyxDQUFBO0lBQ3pELENBQUM7SUFFRDtzQ0FDa0M7SUFDbEMsS0FBSyxDQUFDLGNBQWM7UUFDbEIsT0FBTyxJQUFJLENBQUMsSUFBSSxDQUFpQixLQUFLLEVBQUUsc0JBQXNCLENBQUMsQ0FBQTtJQUNqRSxDQUFDO0lBRUQsS0FBSyxDQUFDLE1BQU0sQ0FBQyxPQUlaLEVBQUUsY0FBdUI7UUFDeEIsTUFBTSxPQUFPLEdBQTJCLEVBQUUsQ0FBQTtRQUMxQyxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLGNBQWMsQ0FBQTtRQUM3QyxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsSUFBSSxDQUFXLE1BQU0sRUFBRSxlQUFlLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBQ3ZFLENBQUM7SUFFRDs7OztvRUFJZ0U7SUFDaEUsS0FBSyxDQUFDLGVBQWUsQ0FDbkIsT0FJQyxFQUNELGNBQXVCO1FBRXZCLE1BQU0sT0FBTyxHQUEyQixFQUFFLENBQUE7UUFDMUMsSUFBSSxjQUFjLEVBQUUsQ0FBQztZQUNuQixPQUFPLENBQUMsaUJBQWlCLENBQUMsR0FBRyxjQUFjLENBQUE7UUFDN0MsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBa0IsTUFBTSxFQUFFLHVCQUF1QixFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQTtJQUN0RixDQUFDO0lBRUQsS0FBSyxDQUFDLGVBQWUsQ0FBQyxLQUFxQjtRQUl6QywrREFBK0Q7UUFDL0Qsb0VBQW9FO1FBQ3BFLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsc0JBQXNCLEVBQUUsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUE7SUFDeEYsQ0FBQztJQUVEO3NFQUNrRTtJQUNsRSxLQUFLLENBQUMsYUFBYTtRQUNqQixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQzlCLEtBQUssRUFDTCwyQkFBMkIsQ0FDNUIsQ0FBQTtRQUNELE9BQU8sUUFBUSxDQUFDLFVBQVUsQ0FBQTtJQUM1QixDQUFDO0lBRUQsS0FBSyxDQUFDLG1CQUFtQixDQUN2QixNQUFpQyxFQUNqQyxLQUFjO1FBRWQsTUFBTSxNQUFNLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQTtRQUNwQyxJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQ1gsTUFBTSxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUE7UUFDOUIsQ0FBQztRQUNELElBQUksS0FBSyxFQUFFLENBQUM7WUFDVixNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQTtRQUNwQyxDQUFDO1FBQ0QsTUFBTSxFQUFFLEdBQUcsTUFBTSxDQUFDLElBQUksR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQTtRQUM5QyxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLDhCQUE4QixFQUFFLEVBQUUsQ0FBQyxDQUFBO0lBQzdELENBQUM7SUFFRCxLQUFLLENBQUMscUJBQXFCLENBQ3pCLEdBQVcsRUFDWCxVQUFtQztRQUVuQyxPQUFPLElBQUksQ0FBQyxJQUFJLENBQ2QsTUFBTSxFQUNOLCtCQUErQixrQkFBa0IsQ0FBQyxHQUFHLENBQUMsVUFBVSxFQUNoRSxFQUFFLFVBQVUsRUFBRSxDQUNmLENBQUE7SUFDSCxDQUFDO0lBRU8sS0FBSyxDQUFDLElBQUksQ0FDaEIsTUFBYyxFQUNkLElBQVksRUFDWixJQUFjLEVBQ2QsZUFBdUMsRUFBRSxFQUN6QyxZQUFvQixJQUFJLENBQUMsU0FBUztRQUVsQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSxnQkFBZ0IsQ0FDeEIseUVBQXlFLEVBQ3pFLGdCQUFnQixDQUNqQixDQUFBO1FBQ0gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLElBQUksZUFBZSxFQUFFLENBQUE7UUFDeEMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxTQUFTLENBQUMsQ0FBQTtRQUM3RCxJQUFJLEdBQWEsQ0FBQTtRQUNqQixJQUFJLENBQUM7WUFDSCxHQUFHLEdBQUcsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLEVBQUU7Z0JBQ3JDLE1BQU07Z0JBQ04sT0FBTyxFQUFFO29CQUNQLGFBQWEsRUFBRSxVQUFVLElBQUksQ0FBQyxNQUFNLEVBQUU7b0JBQ3RDLGNBQWMsRUFBRSxrQkFBa0I7b0JBQ2xDLEdBQUcsWUFBWTtpQkFDaEI7Z0JBQ0QsSUFBSSxFQUFFLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUM7Z0JBQ3RELE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTTthQUMxQixDQUFDLENBQUE7UUFDSixDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLE1BQU0sT0FBTyxHQUFHLEdBQUcsWUFBWSxLQUFLLElBQUksR0FBRyxDQUFDLElBQUksS0FBSyxZQUFZLENBQUE7WUFDakUsTUFBTSxJQUFJLGdCQUFnQixDQUN4QixPQUFPO2dCQUNMLENBQUMsQ0FBQyxvQ0FBb0MsU0FBUyxJQUFJO2dCQUNuRCxDQUFDLENBQUMsNkJBQTZCLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUM5QyxPQUFPLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUNsQyxDQUFBO1FBQ0gsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBQ3JCLENBQUM7UUFFRCxNQUFNLElBQUksR0FBRyxNQUFNLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQTtRQUM3QixJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ1osSUFBSSxJQUFJLEdBQUcsWUFBWSxDQUFBO1lBQ3ZCLElBQUksT0FBTyxHQUFHLFFBQVEsR0FBRyxDQUFDLE1BQU0sRUFBRSxDQUFBO1lBQ2xDLElBQUksQ0FBQztnQkFDSCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FFN0IsQ0FBQTtnQkFDRCxJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUM7b0JBQ3ZCLElBQUksR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQTtnQkFDMUIsQ0FBQztnQkFDRCxJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUM7b0JBQzFCLE9BQU8sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQTtnQkFDaEMsQ0FBQztZQUNILENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ1AsSUFBSSxJQUFJLEVBQUUsQ0FBQztvQkFDVCxPQUFPLEdBQUcsR0FBRyxPQUFPLEtBQUssSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLEVBQUUsQ0FBQTtnQkFDL0MsQ0FBQztZQUNILENBQUM7WUFDRCxNQUFNLElBQUksZ0JBQWdCLENBQUMsT0FBTyxFQUFFLElBQUksRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUE7UUFDdkQsQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQU0sQ0FBQTtRQUM5QixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsTUFBTSxJQUFJLGdCQUFnQixDQUFDLDRCQUE0QixFQUFFLGNBQWMsRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUE7UUFDdEYsQ0FBQztJQUNILENBQUM7Q0FDRjtBQTVLRCx3Q0E0S0MifQ==

package/.medusa/server/src/modules/ordinant/index.js

@@ -0,0 +1,14 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrdinantModuleService = exports.ORDINANT_MODULE = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const service_1 = __importDefault(require("./service"));
+exports.OrdinantModuleService = service_1.default;
+exports.ORDINANT_MODULE = "ordinant";
+exports.default = (0, utils_1.Module)(exports.ORDINANT_MODULE, {
+    service: service_1.default,
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi9zcmMvbW9kdWxlcy9vcmRpbmFudC9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSxxREFBa0Q7QUFDbEQsd0RBQTZDO0FBUXBDLGdDQVJGLGlCQUFxQixDQVFFO0FBTmpCLFFBQUEsZUFBZSxHQUFHLFVBQVUsQ0FBQTtBQUV6QyxrQkFBZSxJQUFBLGNBQU0sRUFBQyx1QkFBZSxFQUFFO0lBQ3JDLE9BQU8sRUFBRSxpQkFBcUI7Q0FDL0IsQ0FBQyxDQUFBIn0=

package/.medusa/server/src/modules/ordinant/service.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const client_1 = require("../../lib/client");
+/**
+ * OrdinantModuleService wraps the Ordinant API client so workflows,
+ * subscribers, and API routes resolve one configured instance from the
+ * container. It holds no state and performs no compliance logic — decisions
+ * are made (and logged, and replayable) server-side.
+ */
+class OrdinantModuleService {
+    constructor(_container, options) {
+        this.client = new client_1.OrdinantClient({
+            baseUrl: options?.baseUrl ?? "",
+            apiKey: options?.apiKey ?? "",
+            timeoutMs: options?.timeoutMs,
+        });
+        this.failMode = options?.failMode === "open" ? "open" : "closed";
+        this.skuMode = options?.skuMode === "allow" ? "allow" : "block";
+    }
+    /** Whether the merchant has activated Ordinant (URL + API key set). The
+     * admin dashboard gates itself on this. */
+    get configured() {
+        return this.client.configured;
+    }
+}
+exports.default = OrdinantModuleService;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uL3NyYy9tb2R1bGVzL29yZGluYW50L3NlcnZpY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSw2Q0FBaUQ7QUFpQ2pEOzs7OztHQUtHO0FBQ0gsTUFBcUIscUJBQXFCO0lBS3hDLFlBQVksVUFBbUMsRUFBRSxPQUErQjtRQUM5RSxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksdUJBQWMsQ0FBQztZQUMvQixPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sSUFBSSxFQUFFO1lBQy9CLE1BQU0sRUFBRSxPQUFPLEVBQUUsTUFBTSxJQUFJLEVBQUU7WUFDN0IsU0FBUyxFQUFFLE9BQU8sRUFBRSxTQUFTO1NBQzlCLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxRQUFRLEdBQUcsT0FBTyxFQUFFLFFBQVEsS0FBSyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFBO1FBQ2hFLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxFQUFFLE9BQU8sS0FBSyxPQUFPLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFBO0lBQ2pFLENBQUM7SUFFRDsrQ0FDMkM7SUFDM0MsSUFBSSxVQUFVO1FBQ1osT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQTtJQUMvQixDQUFDO0NBQ0Y7QUFwQkQsd0NBb0JDIn0=

package/.medusa/server/src/storefront.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Storefront helper for the Ordinant early compliance preview.
+ *
+ * Import it in your checkout code:
+ *
+ *   import { checkAddressCompliance } from "medusa-plugin-ordinant/storefront"
+ *
+ *   // when the shipping address is submitted, BEFORE you save it:
+ *   const block = await checkAddressCompliance(sdk, { cartId, destination })
+ *   if (block) return block   // show `block`; don't save the address
+ *
+ * It's framework-agnostic (pass your Medusa JS SDK, or anything with a
+ * `client.fetch`) and FAIL-OPEN: any error returns null so it can never break
+ * checkout. It returns a human-readable message (with statute citations) only
+ * for a hard BLOCK; CONDITIONAL requirements (age/FFL not yet gathered) return
+ * null and surface at their own later steps. The authoritative, non-bypassable
+ * gate still runs at cart completion — this is purely the early-warning UX.
+ *
+ * Checking the *proposed* destination before persisting it means a blocked
+ * address is never written to the cart.
+ */
+export type ComplianceDestination = {
+    state?: string;
+    country_code?: string;
+    zip?: string;
+    city?: string;
+    line1?: string;
+};
+export type ComplianceBuyer = {
+    age_verified?: boolean;
+    verified_age?: number;
+    ffl_verified?: boolean;
+    sot_verified?: boolean;
+    permits?: string[];
+    fulfillment_method?: "ship" | "in_store_pickup";
+};
+/** The slice of the Medusa JS SDK this helper needs. */
+export type ComplianceFetcher = {
+    client: {
+        fetch: <T>(path: string, init: {
+            method: string;
+            body?: unknown;
+        }) => Promise<T>;
+    };
+};
+export type CheckAddressComplianceOptions = {
+    /** The cart being checked out. */
+    cartId: string;
+    /** The PROPOSED address to vet before it's saved. Omit to use the cart's
+     * already-saved shipping address. */
+    destination?: ComplianceDestination;
+    /** Verification assertions gathered so far (age, FFL, …), if any. */
+    buyer?: ComplianceBuyer;
+    /** Message used when a block has no itemized reason. */
+    fallbackMessage?: string;
+};
+/**
+ * Returns a block message when the destination is prohibited, or null when it's
+ * fine (or when anything goes wrong — fail-open). Never throws.
+ */
+export declare function checkAddressCompliance(sdk: ComplianceFetcher, options: CheckAddressComplianceOptions): Promise<string | null>;

package/.medusa/server/src/storefront.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Storefront helper for the Ordinant early compliance preview.
+ *
+ * Import it in your checkout code:
+ *
+ *   import { checkAddressCompliance } from "medusa-plugin-ordinant/storefront"
+ *
+ *   // when the shipping address is submitted, BEFORE you save it:
+ *   const block = await checkAddressCompliance(sdk, { cartId, destination })
+ *   if (block) return block   // show `block`; don't save the address
+ *
+ * It's framework-agnostic (pass your Medusa JS SDK, or anything with a
+ * `client.fetch`) and FAIL-OPEN: any error returns null so it can never break
+ * checkout. It returns a human-readable message (with statute citations) only
+ * for a hard BLOCK; CONDITIONAL requirements (age/FFL not yet gathered) return
+ * null and surface at their own later steps. The authoritative, non-bypassable
+ * gate still runs at cart completion — this is purely the early-warning UX.
+ *
+ * Checking the *proposed* destination before persisting it means a blocked
+ * address is never written to the cart.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAddressCompliance = checkAddressCompliance;
+const DEFAULT_MESSAGE = "This order can’t be completed to that address.";
+/**
+ * Returns a block message when the destination is prohibited, or null when it's
+ * fine (or when anything goes wrong — fail-open). Never throws.
+ */
+async function checkAddressCompliance(sdk, options) {
+    const { cartId, destination, buyer, fallbackMessage } = options;
+    try {
+        const preview = await sdk.client.fetch("/store/ordinant/preview", {
+            method: "POST",
+            body: { cart_id: cartId, destination, buyer },
+        });
+        if (preview.disposition !== "BLOCK") {
+            return null;
+        }
+        const reasons = [];
+        for (const item of preview.items ?? []) {
+            for (const eff of item.effects ?? []) {
+                if (eff.satisfied || eff.effect?.type !== "BLOCK" || !eff.description) {
+                    continue;
+                }
+                const cite = (eff.citations ?? [])
+                    .map((c) => c.source)
+                    .filter(Boolean)
+                    .join("; ");
+                reasons.push(cite ? `${eff.description} [${cite}]` : eff.description);
+            }
+        }
+        const base = fallbackMessage ?? DEFAULT_MESSAGE;
+        return reasons.length ? `${base} ${reasons.join(" ")}` : base;
+    }
+    catch {
+        // Fail-open: never break checkout because the advisory preview is down.
+        return null;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmVmcm9udC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zdG9yZWZyb250LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FvQkc7O0FBd0RILHdEQWdDQztBQXRDRCxNQUFNLGVBQWUsR0FBRyxnREFBZ0QsQ0FBQTtBQUV4RTs7O0dBR0c7QUFDSSxLQUFLLFVBQVUsc0JBQXNCLENBQzFDLEdBQXNCLEVBQ3RCLE9BQXNDO0lBRXRDLE1BQU0sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxlQUFlLEVBQUUsR0FBRyxPQUFPLENBQUE7SUFDL0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsTUFBTSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBa0IseUJBQXlCLEVBQUU7WUFDakYsTUFBTSxFQUFFLE1BQU07WUFDZCxJQUFJLEVBQUUsRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUU7U0FDOUMsQ0FBQyxDQUFBO1FBQ0YsSUFBSSxPQUFPLENBQUMsV0FBVyxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ3BDLE9BQU8sSUFBSSxDQUFBO1FBQ2IsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFhLEVBQUUsQ0FBQTtRQUM1QixLQUFLLE1BQU0sSUFBSSxJQUFJLE9BQU8sQ0FBQyxLQUFLLElBQUksRUFBRSxFQUFFLENBQUM7WUFDdkMsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsT0FBTyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUNyQyxJQUFJLEdBQUcsQ0FBQyxTQUFTLElBQUksR0FBRyxDQUFDLE1BQU0sRUFBRSxJQUFJLEtBQUssT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUN0RSxTQUFRO2dCQUNWLENBQUM7Z0JBQ0QsTUFBTSxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQztxQkFDL0IsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDO3FCQUNwQixNQUFNLENBQUMsT0FBTyxDQUFDO3FCQUNmLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQTtnQkFDYixPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxHQUFHLENBQUMsV0FBVyxLQUFLLElBQUksR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUE7WUFDdkUsQ0FBQztRQUNILENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxlQUFlLElBQUksZUFBZSxDQUFBO1FBQy9DLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7SUFDL0QsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLHdFQUF3RTtRQUN4RSxPQUFPLElBQUksQ0FBQTtJQUNiLENBQUM7QUFDSCxDQUFDIn0=

package/.medusa/server/src/subscribers/product-upsert.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.config = void 0;
+exports.default = ordinantProductUpsertHandler;
+const classify_product_1 = require("../workflows/classify-product");
+/**
+ * When a product is created or updated, send its variants to Ordinant for
+ * attribute classification. This produces PROPOSALS the merchant confirms
+ * in the product page's Ordinant widget — nothing is auto-attested, and a
+ * classification failure never blocks catalog work (the SKU simply stays
+ * unclassified, which fails closed at checkout).
+ *
+ * Firing on `product.updated` is safe because Ordinant dedups on a content
+ * signature of the classification-relevant fields (title, description, type,
+ * specs). Medusa's `product.updated` fires for price/inventory/image/status
+ * edits too, but those reach Ordinant with an unchanged signature and are a
+ * true no-op — a confirmed attestation is never reset by an edit that didn't
+ * change what the product legally is. Only a title/description/spec change
+ * re-classifies and (correctly) invalidates the prior attestation.
+ */
+async function ordinantProductUpsertHandler({ event: { name: eventName, data }, container, }) {
+    const logger = container.resolve("logger");
+    try {
+        const { result } = await (0, classify_product_1.classifyProductWorkflow)(container).run({
+            input: { product_id: data.id },
+        });
+        const failed = result.filter((r) => r.error).length;
+        logger.info(`[ordinant] ${eventName}: proposed classifications for product ${data.id} ` +
+            `(${result.length - failed} proposed, ${failed} failed)`);
+    }
+    catch (error) {
+        // Workflow failures can surface as plain objects; stringify for a
+        // readable log line either way.
+        const message = error instanceof Error
+            ? error.message
+            : (() => {
+                try {
+                    return JSON.stringify(error);
+                }
+                catch {
+                    return String(error);
+                }
+            })();
+        logger.error(`[ordinant] ${eventName}: classification failed for product ${data.id}: ${message}`);
+        // Swallow: subscribers must not disrupt product management. Unclassified
+        // SKUs fail closed at checkout, so nothing unsafe slips through.
+    }
+}
+exports.config = {
+    event: ["product.created", "product.updated"],
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvZHVjdC11cHNlcnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvc3Vic2NyaWJlcnMvcHJvZHVjdC11cHNlcnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBa0JBLCtDQWtDQztBQW5ERCxvRUFBdUU7QUFFdkU7Ozs7Ozs7Ozs7Ozs7O0dBY0c7QUFDWSxLQUFLLFVBQVUsNEJBQTRCLENBQUMsRUFDekQsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsRUFDaEMsU0FBUyxHQUNzQjtJQUMvQixNQUFNLE1BQU0sR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBRTFDLElBQUksQ0FBQztRQUNILE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxNQUFNLElBQUEsMENBQXVCLEVBQUMsU0FBUyxDQUFDLENBQUMsR0FBRyxDQUFDO1lBQzlELEtBQUssRUFBRSxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsRUFBRSxFQUFFO1NBQy9CLENBQUMsQ0FBQTtRQUNGLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLENBQUE7UUFDbkQsTUFBTSxDQUFDLElBQUksQ0FDVCxjQUFjLFNBQVMsMENBQTBDLElBQUksQ0FBQyxFQUFFLEdBQUc7WUFDekUsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLE1BQU0sY0FBYyxNQUFNLFVBQVUsQ0FDM0QsQ0FBQTtJQUNILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2Ysa0VBQWtFO1FBQ2xFLGdDQUFnQztRQUNoQyxNQUFNLE9BQU8sR0FDWCxLQUFLLFlBQVksS0FBSztZQUNwQixDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU87WUFDZixDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUU7Z0JBQ0osSUFBSSxDQUFDO29CQUNILE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQTtnQkFDOUIsQ0FBQztnQkFBQyxNQUFNLENBQUM7b0JBQ1AsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUE7Z0JBQ3RCLENBQUM7WUFDSCxDQUFDLENBQUMsRUFBRSxDQUFBO1FBQ1YsTUFBTSxDQUFDLEtBQUssQ0FDVixjQUFjLFNBQVMsdUNBQXVDLElBQUksQ0FBQyxFQUFFLEtBQUssT0FBTyxFQUFFLENBQ3BGLENBQUE7UUFDRCx5RUFBeUU7UUFDekUsaUVBQWlFO0lBQ25FLENBQUM7QUFDSCxDQUFDO0FBRVksUUFBQSxNQUFNLEdBQXFCO0lBQ3RDLEtBQUssRUFBRSxDQUFDLGlCQUFpQixFQUFFLGlCQUFpQixDQUFDO0NBQzlDLENBQUEifQ==

package/.medusa/server/src/workflows/bulk-operations.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bulkConfirmWorkflow = exports.bulkConfirmStep = exports.bulkClassifyWorkflow = void 0;
+const workflows_sdk_1 = require("@medusajs/framework/workflows-sdk");
+const ordinant_1 = require("../modules/ordinant");
+const classify_product_1 = require("./classify-product");
+/**
+ * bulkClassifyWorkflow submits a pre-gathered batch of catalog items for
+ * classification (the Ordinant admin page's "Classify unclassified"
+ * action). Batches are capped by the API route; the page loops until the
+ * backlog is empty.
+ */
+exports.bulkClassifyWorkflow = (0, workflows_sdk_1.createWorkflow)("ordinant-bulk-classify", function (input) {
+    const results = (0, classify_product_1.classifyItemsStep)(input.items);
+    return new workflows_sdk_1.WorkflowResponse(results);
+});
+/**
+ * bulkConfirmStep confirms each SKU's classification AS PROPOSED — the
+ * merchant reviewed the summary in the admin page and is attesting to the
+ * model's proposals in bulk. SKUs that are not in `proposed` status are
+ * skipped, and per-SKU failures never abort the batch.
+ */
+exports.bulkConfirmStep = (0, workflows_sdk_1.createStep)("ordinant-bulk-confirm", async (input, { container }) => {
+    const ordinant = container.resolve(ordinant_1.ORDINANT_MODULE);
+    const { items } = await ordinant.client.listClassifications("proposed", 5000);
+    const proposals = new Map(items.map((c) => [c.sku, c]));
+    const results = [];
+    for (const sku of input.skus) {
+        const proposal = proposals.get(sku);
+        if (!proposal) {
+            results.push({
+                sku,
+                status: "skipped",
+                detail: "no proposal awaiting confirmation",
+            });
+            continue;
+        }
+        try {
+            await ordinant.client.confirmClassification(sku, proposal.attributes);
+            results.push({ sku, status: "confirmed" });
+        }
+        catch (error) {
+            results.push({
+                sku,
+                status: "failed",
+                detail: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return new workflows_sdk_1.StepResponse(results);
+});
+/**
+ * bulkConfirmWorkflow records bulk attestations from the admin page.
+ */
+exports.bulkConfirmWorkflow = (0, workflows_sdk_1.createWorkflow)("ordinant-bulk-confirm", function (input) {
+    const results = (0, exports.bulkConfirmStep)(input);
+    return new workflows_sdk_1.WorkflowResponse(results);
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVsay1vcGVyYXRpb25zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL3dvcmtmbG93cy9idWxrLW9wZXJhdGlvbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEscUVBSzBDO0FBQzFDLGtEQUFxRDtBQUdyRCx5REFBc0Q7QUFNdEQ7Ozs7O0dBS0c7QUFDVSxRQUFBLG9CQUFvQixHQUFHLElBQUEsOEJBQWMsRUFDaEQsd0JBQXdCLEVBQ3hCLFVBQVUsS0FBd0I7SUFDaEMsTUFBTSxPQUFPLEdBQUcsSUFBQSxvQ0FBaUIsRUFBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDOUMsT0FBTyxJQUFJLGdDQUFnQixDQUFDLE9BQU8sQ0FBQyxDQUFBO0FBQ3RDLENBQUMsQ0FDRixDQUFBO0FBWUQ7Ozs7O0dBS0c7QUFDVSxRQUFBLGVBQWUsR0FBRyxJQUFBLDBCQUFVLEVBQ3ZDLHVCQUF1QixFQUN2QixLQUFLLEVBQUUsS0FBdUIsRUFBRSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUU7SUFDL0MsTUFBTSxRQUFRLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBd0IsMEJBQWUsQ0FBQyxDQUFBO0lBQzFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxNQUFNLENBQUMsbUJBQW1CLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxDQUFBO0lBQzdFLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFFdkQsTUFBTSxPQUFPLEdBQXdCLEVBQUUsQ0FBQTtJQUN2QyxLQUFLLE1BQU0sR0FBRyxJQUFJLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUM3QixNQUFNLFFBQVEsR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1FBQ25DLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE9BQU8sQ0FBQyxJQUFJLENBQUM7Z0JBQ1gsR0FBRztnQkFDSCxNQUFNLEVBQUUsU0FBUztnQkFDakIsTUFBTSxFQUFFLG1DQUFtQzthQUM1QyxDQUFDLENBQUE7WUFDRixTQUFRO1FBQ1YsQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE1BQU0sUUFBUSxDQUFDLE1BQU0sQ0FBQyxxQkFBcUIsQ0FBQyxHQUFHLEVBQUUsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFBO1lBQ3JFLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUE7UUFDNUMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixPQUFPLENBQUMsSUFBSSxDQUFDO2dCQUNYLEdBQUc7Z0JBQ0gsTUFBTSxFQUFFLFFBQVE7Z0JBQ2hCLE1BQU0sRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2FBQy9ELENBQUMsQ0FBQTtRQUNKLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxJQUFJLDRCQUFZLENBQUMsT0FBTyxDQUFDLENBQUE7QUFDbEMsQ0FBQyxDQUNGLENBQUE7QUFFRDs7R0FFRztBQUNVLFFBQUEsbUJBQW1CLEdBQUcsSUFBQSw4QkFBYyxFQUMvQyx1QkFBdUIsRUFDdkIsVUFBVSxLQUF1QjtJQUMvQixNQUFNLE9BQU8sR0FBRyxJQUFBLHVCQUFlLEVBQUMsS0FBSyxDQUFDLENBQUE7SUFDdEMsT0FBTyxJQUFJLGdDQUFnQixDQUFDLE9BQU8sQ0FBQyxDQUFBO0FBQ3RDLENBQUMsQ0FDRixDQUFBIn0=