Headless commerce migration — off a platform, onto owned rails, without losing a record

Receipts

Proven in production.

• cbd.restaurant — Headless Hemp & THCa E-Commerce Rebuild

  Replaced a legacy BigCommerce storefront with a purpose-built Next.js headless e-commerce platform for hemp-derived CBD/THCa products. The rebuild emphasizes compliance-first design, dual-mode order fulfillment (card checkout for legal hemp/THCa; pay-on-delivery for future marijuana SKUs), real-time inventory, and multi-channel customer notifications (email/SMS/web-push). Achieves feature parity with BigCommerce while reducing compliance surface and enabling direct control over payment, fulfillment, and customer journeys.

  • 50 products live (6 hemp + 44 THCa)
  • 7,228 lines of TypeScript code
• Big Moose Hemp: Wix Platform Prison to Headless Medusa

  Big Moose Hemp migrated from a locked-in Wix storefront to a fully-owned headless architecture — Medusa 2.x commerce backend on Railway + Next.js 15 storefront on Vercel, live at new.bigmoosehemp.com. The rebuild was forced by a hard regulatory deadline: the November 12, 2026 federal hemp ban (P.L. 119-37) that outlaws ~86% of the current catalog, making Wix's V1 schema, deprecated APIs, and single payment rail a business blocker. A three-phase compliance strategy (Liquidation → Sunset → Post-ban) is baked into the schema so the cutoff is driven by per-SKU total-THC data, not a midnight content edit. The team shipped 551 TypeScript files across 229 commits with complete parity to legacy order/customer data (142 historical Wix orders materialized + a consent-stratified 23,924-contact archive), compliance automation (total-THC per SKU, state ship-block enforcement), real payment rails (Clover high-risk processor), an IMAP-verified transactional email + SMS chain, a live Medusa-backed mobile admin, and a 24/7 Slack-fed AI approval queue where agents draft and only the owner ships. The same backend that started as a survival migration is now the operating spine for the whole brand.

  • 229 commits from Apr 19 → Jun 30, 2026
  • 142 historical Wix orders + 16,881 customers migrated with consent
• BMH payment rails — Wix payments to a two-rail Medusa module with hard caps

  Big Moose Hemp ran customer payments through WIX-PAY-PRO + Square. Hemp/CBD is a high-risk MID category and the federal hemp ban (P.L. 119-37, effective Nov 12 2026) accelerates the need to move off a stack that doesn't expose payment-policy controls. The rebuild ships a two-rail payment provider abstraction inside the BMH Medusa 2.x backend — Clover (card, capped at $250) via Global Payments Solutions ISO for the high-risk MID, and Aeropay (ACH) for any purchase over the cap and for the 50% deposit on bulk clone orders. Hard caps are enforced at three levels — admin, API, and storefront — so no path can bypass them.

  • 2 payment rails (Clover card + Aeropay ACH) under one Medusa module
  • Hard $250 card cap enforced at admin + API + storefront

When to use it

Trigger phrases.

Any of these in the user's prompt should invoke this skill in Claude Code.

• Get us off Wix / Shopify / BigCommerce
• Headless rebuild for [store]
• Migrate the store and keep the order history
• We need our own payment rail
• Platform is banning our category

What it needs

Required inputs.

• 01Source-platform API access (orders, customers, catalog) or a scripted rip where APIs are locked
• 02The compliance facts per SKU (e.g. total-THC, ABV, age restrictions) — whatever the category's bright line is
• 03The payment story: processor, caps, fallback rail, and who's allowed to flip capture

The mechanism

Pipeline.

1. 01 · Audit + plan

   Inventory what the platform holds hostage before writing code.

   Catalog shape, order history depth, customer consent state, payment rail, URL structure. The hemp-migration-agent runs this as a CLI: audit a storefront, emit a phased migration plan, pull active products from the source admin, extract brand-scrubbed assets — 50 tests, worked example cbd.restaurant.

2. 02 · Materialize history

   Orders and customers become real records, consent becomes a column.

   Historical orders import as first-class records (BMH: 142 Wix orders, #10001–10142, exact payment/fulfillment history). Contacts are audited and stratified by legal marketability (BMH: 23,924 contacts → five tiers, 16,712 written CRM-only so no marketing sync ever touches them). A side-effect kill switch prevents double-notifies during import.

3. 03 · Payment abstraction

   A typed provider contract — swap rails without going dark.

   Payment providers implement one contract (initiate / authorize / capture / refund / cancel / retrieve / webhook). Clover rides it with auth-then-capture and a deliberate stub fallback for pre-credential launches; caps are enforced at module, API, and storefront so no path routes around policy; HMAC-verified webhooks reconcile settlement into one view.

4. 04 · Compliance as data

   Compute the bright line once, enforce it at the API.

   Whatever divides legal from not (total-THC ≤ 0.3%, 21+ attestation, state ship allowlists) is computed at migration time, stored on the product, and enforced server-side on every cart and checkout call. The catalog cutover becomes a query, not a midnight content sweep.

5. 05 · Cut over with the equity

   301 maps, ISR, and a transactional chain verified to a real inbox.

   Legacy URLs 301 to their new equivalents; ISR + RSC keep SEO parity; and the order lifecycle (confirmation / shipping / delivery emails, consent-gated SMS) is verified landing in a real IMAP inbox before the DNS flips. The legacy platform stays live at the apex until the owner approves cutover.

What lets it fan out

Connector stack.

With all of these MCP connectors wired, the mechanism runs end-to-end without human handoff. Without them, the handoff is a numbered Chrome checklist.

• Source platform APIs (Wix / BC / Shopify)

  Available

  Stages 1–2 — order, customer, and catalog extraction (Wix Contacts v4 + order APIs proven).

• Clover Ecommerce API

  Available

  Stage 3 — live auth-then-capture rail (proven on cbd.restaurant).

• AWS SES + AlpineIQ

  Available

  Stage 5 — the transactional email + compliant SMS chain.

• Registrar / DNS MCP

  Needed

  Stage 5 — programmatic apex cutover instead of a numbered human handoff.

Guardrails

Stop conditions.

The skill is predictable because it refuses to expand its own scope.

• stopNever sync a bulk-imported contact to a marketing surface — CRM-only until consent is proven.
• stopNever flip capture-to-live without the owner's explicit go — auth-then-capture exists for this.
• stopNever delete the legacy platform until the new stack has served real orders.
• stopThe side-effect kill switch stays ON for all historical imports.
• stopNo compliance rule lives only in the UI — server enforcement or it doesn't count.