Start with a cart.
Build from there.

Get started

With access to the source checkout, use Node 24 and the pnpm version pinned in the repository. Start at the repository root:

pnpm install
pnpm check

The working reference integration is Nordgrat. The demo uses the same public SDKs a merchant would use, and shows what happens behind each step.

Run the reference storefront

Put ROOT_SECRET and the Stripe sandbox keys into the root .dev.vars, as examples/nordgrat/README.md describes. Then start Nordgrat's systems, the commerce Worker and the storefront, each in its own terminal:

pnpm --filter @orbcart/example-nordgrat systems
pnpm --filter @orbcart/demo commerce
pnpm --filter @orbcart/demo dev

For payment changes that arrive by webhook, also run the Stripe listener from apps/demo/README.md. The commerce command starts the Worker with orbcart dev and writes development keys for the storefront. Keep secret keys on the server; only publishable keys belong in the browser.

Use the client SDK

This example uses existing SDK methods. Replace the example URL and publishable key with your running commerce environment. Contact and delivery details below are illustrative.

import { createCommerce } from "@orbcart/client";

const commerce = createCommerce({
  url: "https://commerce.example.com",
  key: "pk_test_…",
});

const cart = await commerce.cart();
await cart.add("BACKPACK-30-GREEN", { quantity: 1 });

const quote = await cart.quote({
  contact: { email: "explorer@example.com" },
  shipTo: {
    name: "Example Buyer",
    line1: "12 Alpine Way",
    postalCode: "80331",
    city: "Munich",
    country: "DE",
  },
});

Your merchant integration must resolve the reference you add. Required contact and address fields depend on the channel. The server reports missing information; the SDK does not compute transaction rules.

Accept the quote

Choose an available method from quote.paymentMethods. With a channel configured with a Stripe-backed method named card, as in Nordgrat:

const result = await quote.accept({ payment: "card" });

// Handle result.status explicitly in your storefront.

Acceptance can report ordered, requires_action, pending, failed or quote_changed. An authentication step is not a completed order. A quote_changed answer carries the new quote for the buyer to review; never treat it as payment success. The Nordgrat demo shows Stripe.js handling and the reads that follow.

A complete checkout, on your terms

@orbcart/react is the frontend kit. <Checkout> takes the buyer from contact and address through shipping and payment to the order. <CartProvider> holds the buyer's cart and moves on to a fresh one after the order. <ExpressButton> puts Stripe's express checkout on a page. Hooks under the components let you write your own markup. The kit shows what the server decided; it never computes a price, tax or availability.

The Nordgrat shop at demo.orbcart.dev is built on the kit, in German and English, and runs in Stripe's test mode. A theming contract and default labels per language are being built.

Customer accounts and login remain with your identity system; OrbCart does not become a customer database. The APIs underneath the checkout are available for a completely custom experience.

Commerce primitives

Built around the edge

One Worker per environment serves the /v1 API, the payment providers' webhooks, the public keys that verify signed quotes and the order explorer. One SQLite-backed Durable Object per cart owns its state, and the order stays in it. Business rules live in a platform-independent TypeScript core.

Clients send intent, not binding prices. The server calculates and signs the quote. Mutations are idempotent, and external side effects follow persisted decisions through an outbox that Durable Object alarms drive. Unclear external results become unknown and are reconciled.

Everything runs in your own Cloudflare account, with objects in the EU jurisdiction by default. D1 holds an optional read projection, such as the order list; it never decides anything. An R2 archive is planned. OrbCart publishes no latency or throughput benchmark until it has measurements to support one.

Connect your existing systems

A merchant supplies small integration contracts through defineCommerce. The current Nordgrat example resolves references through its offers() contract, combining a pricing service and an SAP stand-in. This demonstrates the contract; it is not a production SAP connector.

Project status

Status as of 27 September 2026.

The project is pre-release: nothing is on npm yet and the repository is not public. This board lists what the source proves today, what is being built and what comes next.

Works today

• A purchase, end to end. @orbcart/client adds lines, quotes and accepts. Quotes are signed with ES256, and verifyQuote checks them in both SDKs. A price that moved before acceptance answers quote_changed instead of charging.
• Your systems stay the source. defineCommerce with an offers function prices every cart from your systems. The inventory contract holds stock, deliverOrder hands orders to your ERP, and admin.offers.invalidate voids tagged offers in every open cart at once.
• Tax and shipping. EU VAT by destination country for Germany, Austria, the Netherlands and France. Shipping rates and rules per channel and country, with exclusions.
• Payments with Stripe. Card with 3-D Secure, Apple Pay, Google Pay, Klarna, iDEAL, Bancontact, EPS, Przelewy24 and TWINT, plus an express button. Stripe's webhooks arrive at the environment's Worker.
• Retries are safe. Money-moving calls take an Idempotency-Key, side effects run after the commit through an outbox, and a payment with an unclear outcome becomes unknown until a follow-up resolves it. In Stripe's sandbox, a lost answer was resolved after 31 seconds with exactly one PaymentIntent.
• Orders. Every order is a frozen order/1 snapshot with an order number. @orbcart/admin reads, lists, fulfills and acknowledges orders and refunds single lines to the cent.
• In your Cloudflare account. One Worker per environment and one SQLite-backed Durable Object per cart, in the EU jurisdiction by default. D1 holds an optional read projection. No Queues, KV or Cron. Deploying is manual: wrangler deploy, D1 migrations and wrangler secret put.
• SDKs and the kit. @orbcart/client for storefronts, apps and agents, @orbcart/admin for merchant backends, and @orbcart/react with <Checkout>, <CartProvider>, <ExpressButton> and hooks. orbcart dev runs the runtime on your machine.
• Agents. An agent builds a cart, gets a quote and verifies its signature through the same /v1 API with @orbcart/client, under the same rules as a storefront. Paying on its own waits for AP2.
• The demo. The Nordgrat shop at demo.orbcart.dev runs on the kit against a deployed test environment, in Stripe's test mode.

Being built

• The merchant surface for the first release. A theming contract and default labels per language for the kit.
• The Nordgrat shop. The final checks on the deployed demo: purchases with 3-D Secure, accessibility and performance.
• PayPal. The adapter already runs against PayPal's sandbox; it becomes a built-in provider.
• The order explorer. An overview, the order list and order details, behind Cloudflare Access. It is not deployed for use yet.

Next

• Discount codes. Codes on the cart, with redemption limits. The core already calculates discounts.
• Identified buyers. Sign-in through your own identity system, customer prices and orders across devices. Accounts stay in your system.
• A legally complete checkout. Legal texts, an order confirmation email, an order page and a withdrawal button.
• Events to your systems. Signed events delivered to your webhooks.
• More payments. Adyen, invoice and bank payments, then Mollie, Unzer and PAYONE.
• Agent protocols. UCP checkout and order endpoints and AP2 merchant signatures. The mappings exist in code and tests; they are not served yet.
• Setup in one command. orbcart deploy sets up an environment with D1, an R2 archive, Access and the root secret; npm create orbcart starts a new project.

Licensed under Apache 2.0. A managed offering is a future direction; there are no cloud plans or pricing commitments today.