Vape current limitations

No regulatory status is supplied

The repository does not license a retailer, register it under the PACT Act, obtain FDA marketing orders, list products in state directories, certify age verification, or approve any provider. Fields such as pactRegistered, license numbers, authorization identifiers, and evidence digests are operator-entered records. Required warning statements and other regulatory copy are not supplied; that text is an owner decision.

Regulated checkout cannot complete today

• No GraphQL operation, webhook, or adapter writes AgeVerificationAttempt, RegulatedTaxQuote, or CarrierEligibilityDecision. The adapter interfaces exist, but every implementation is unconfigured, so a regulated cart is denied at payment and checkout.
• The storefront age gate and the sign-up 21+ box are self-attestation only and do not count as verification evidence.
• The seeded Manual payment provider is refused by storefront checkout.

Missing or partial workflows

• Customer returns and claims: no customer-callable mutation; staff create returns and claims.
• Tax reversal: processReturnRefund raises a TAX_AND_REPORTING_REVERSAL_REVIEW_REQUIRED event, but reverseRegulatedTaxCommit has no GraphQL or UI entry point.
• Reports: only the evidence_inventory report type is implemented, for periods of 93 days or less. It is not a jurisdiction filing. The reviewed and corrected report statuses exist but nothing sets them.
• In-flight review after a stop: the emergency stop records inFlightReviewRequired, but nothing lists orders placed before the stop.
• Finance close: getFinanceClose has no UI.
• Inventory import: importInventory throws; use adjustInventory for stock changes.
• Evidence expiry: nothing expires records on a schedule; lapsed evidence simply stops counting when read, and lapse by date does not move a published product back to draft.
• Generic lists: Invoice, Role, Team, Invite, WebhookEndpoint, WebhookEvent, BatchJob, Notification, PriceSet, PriceRule, ReturnReason, Swap, TaxRate, TaxProvider, and SalesChannel are managed only through the generic model pages. Privacy requests land as notifications with no dedicated operator queue.

Tenancy and scale

One deployment serves one store; there is no multi-tenant organization or location scoping. The us-ends policy pack is a draft vocabulary for US destinations and no jurisdiction is active by default. There is no background worker: webhook redelivery and any scheduled work must be triggered externally. The package.json scripts do not include a test or typecheck command.

Deployment responsibilities

Before any real deployment, the operator must supply licensed status, counsel review, identity, tax, carrier, and registry providers with tested adapters, required warning copy, backups, monitoring, secret management, and an incident and stop-sale procedure. Passing builds and rendering pages show only that the exercised code runs.