Vape integrations and boundaries
Payment and shipping adapters, regulated provider contracts, S3 storage, email, MCP, OAuth, webhooks, and what each one does not prove.
A ProviderApproval, PaymentProvider, or ShippingProvider record describes a configuration an operator entered. It is not proof that credentials work, a contract exists, or a provider, carrier, or regulator accepted anything.
Payment adapters
features/integrations/payment contains stripe, paypal, and manual adapters. Each exposes create, capture, refund, status, payment-link, and webhook functions, loaded through a code-owned registry from the PaymentProvider record.
| Provider | Environment variables |
|---|---|
| Stripe | NEXT_PUBLIC_STRIPE_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET |
| PayPal | NEXT_PUBLIC_PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET, PAYPAL_WEBHOOK_ID, NEXT_PUBLIC_PAYPAL_SANDBOX |
| Manual | none; seeded by onboarding and refused by storefront checkout |
Provider webhooks arrive at /api/payment-webhooks/[providerId], which caps the body at 1 MB and passes the raw body and headers to handlePaymentProviderWebhook. For regulated carts, a payment provider is usable only with an active payment ProviderApproval bound to it that covers the destination jurisdiction and product categories. The payment loader is not, by itself, an approved regulated provider stack.
Shipping adapters
features/integrations/shipping contains shippo, shipengine, and manual adapters for rates, labels, cancellation, tracking, and address validation. Credentials are stored on the ShippingProvider record rather than in environment variables. For regulated orders, rates are limited to the exact approved carrier rate and labels require order-bound adult-signature CarrierEligibilityDecision evidence plus an active carrier approval bound to the provider.
Regulated provider contracts
features/regulated-commerce/providers/contracts.ts defines adapter interfaces only:
IdentityProviderAdapter: create a verification session, retrieve the verified result (age, address match, evidence digest), verify webhooks, health.RegulatedTaxAdapter: quote, commit, and reverse sales, excise, and local fee amounts.CarrierEligibilityAdapter: eligibility, create and cancel label, delivery evidence.ProductRegistryAdapter: resolve and snapshot authorization registries.
No implementation exists; unconfiguredProvider throws "provider is unconfigured; regulated transactions remain disabled". The internal recording functions (recordVerifiedIdentityResult, recordRegulatedTaxQuote, commitRegulatedTaxQuote, recordCarrierEligibility, reverseRegulatedTaxCommit) are not exposed through GraphQL, a webhook, or a route. Wiring a provider means implementing one of these interfaces, authenticating its callbacks from the raw body, recording evidence for the exact cart fingerprint, and keeping failures closed.
features/regulated-commerce/import/shopify.ts plans a Shopify product import deterministically and quarantines items with missing evidence; it never treats Shopify tags or publication status as legal authority. The us-ends policy pack (0.1.0-draft) supplies rule vocabulary and federal templates (minimum age 21, adult signature, package marking) with no jurisdiction active by default.
Storage and email
Images are stored with Keystone's S3 storage using S3_BUCKET_NAME, S3_REGION, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, and S3_ENDPOINT (path-style addressing is chosen from the endpoint). Email uses SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD, SMTP_FROM, and SMTP_STORE_LINK.
MCP, AI chat, OAuth, and API keys
/api/mcp-transport/[transport]is a JSON-RPC MCP server that forwards the caller's cookie to/api/graphql, so every tool runs with the caller's permissions. Tools include generic schema tools (listModels,queryData,searchModels,getFieldsForType,lookupInputType,createData,updateData,deleteData,modelSpecificSearch) and commerce tools (searchProducts,getProduct, cart tools,setShippingAddress,getShippingOptions,setShippingMethod,setPaymentMethod,placeOrder,getOrder,getAvailableRegions,getAvailableCountries,getPaymentProviders,createPaymentSessions,getCheckoutLink). Agent checkout is subject to the same compliance gate./api/completionis the dashboard AI chat using OpenRouter (OPENROUTER_API_KEY,OPENROUTER_MODEL) and a scoped MCP fetch./api/oauth/authorizeand/api/oauth/tokenserveOAuthAppintegrations such as the OMS connection;ApiKeyprovides scoped machine credentials. Both require the credential scope and the owner's current role permission.
Webhooks
WebhookEndpoint records subscribe to events with STORE or USER scope; customer tokens may subscribe only to fulfillment.created. Events are written to the WebhookEvent outbox with delivery attempts and dead-lettering, and retryWebhookDeliveries redelivers them. There is no persistent worker in the source.
Out of scope in current source: identity and age verification providers, regulated tax engines, adult-signature carrier eligibility, product registry lookups, PACT reporting transmission, state directory feeds, and any jurisdiction filing channel.