White-label commerce platform
A commerce platform for brands that want more built in and fewer plugins to manage. I was the architect and lead engineer: the storefront, the admin, the control plane that provisions stores, and the interfaces that let AI agents operate a shop.
One Worker per store
Each store runs as its own Cloudflare Worker with its own data. A separate control plane owns tenants, billing and provisioning. That split shaped the most interesting part of the design.
Plans as signed entitlements
The store never learns what a plan is called or what it costs. The control plane signs a document of entitlements (booleans and numeric limits such as staff seats, order allowance and admin build quota) into the store’s key-value storage. The store enforces the document and reports usage back. Entitlements flow down, usage flows up, nothing else crosses.
Because the store only sees capabilities, a set of invariants can be guaranteed no matter what billing does:
- Checkout and storefront serving are never blocked by plan state, usage or billing status.
- Order management (view, fulfil, refund, label) is never restricted.
- There are no count caps on products, variants, pages or coupons.
- Live shopper pricing never changes because of a billing event.
I wrote more about that in plans that never block checkout.
AI agents as first-class operators
Commerce operations are exposed over MCP with OAuth: single-entity operations, customer segmentation, cart-recovery workflows, capability discovery and controlled bulk change-sets with a preview step. Tools a plan doesn’t include are removed from the session’s registry rather than returned as a permission error, so an agent never sees an action it can’t take.
Zero-touch provisioning
A Python provisioning engine turns “create a store” into containers, reverse-proxy config, certificates, databases and migrations, object storage, DNS and a frontend deployment, with no manual steps.
Storefront SDK and CLI
Themes are Astro projects. A publishable SDK and CLI replace “download a full storefront ZIP and edit it beside the platform repo” with connect, dev, check, push and deploy --activate, so a developer can build a theme against real storefront-safe data without cloning the platform.
Stack
Cloudflare Workers, Workers KV and D1, React, Astro, FastAPI, PostgreSQL, Nginx, MCP, OAuth.