Can I vibe code TradeCentric?

Build an enterprise B2B PunchOut and Purchase Order integration gateway in Node.js (TypeScript) using Fastify and Prisma (PostgreSQL) that bridges a Shopify Plus store with eProcurement platforms (SAP Ariba and Coupa) using cXML and OCI protocols.

CORE DATA MODELS:
1. TradingPartner: ID, name, buyerSystem (ARIBA, COUPA, JAGGAER), protocol (CXML, OCI), sharedSecret, buyerCookie, inboundEndpointUrl, outboundEndpointUrl, status.
2. PunchOutSession: ID, tradingPartnerId, sessionToken (UUID), buyerUserEmail, buyerName, returnUrl, status (INITIATED, ACTIVE, COMMITTED, EXPIRED), expiresAt, createdAt.
3. PurchaseOrder: ID, tradingPartnerId, poNumber, cxmlPayload, parsedJson, status (RECEIVED, VALIDATED, PROCESSED_TO_SHOPIFY, FAILED), errorLog, createdAt.
4. Invoice: ID, purchaseOrderId, invoiceNumber, status (PENDING, SENT, ACCEPTED, REJECTED), payloadSent, responseReceived.

CORE WORKFLOWS:

1. PUNCHOUT SETUP REQUEST (cXML Inbound):
- Expose POST /api/punchout/cxml/setup
- Parse incoming cXML payload containing PunchOutSetupRequest.
- Validate SharedSecret against TradingPartner record. Extract BuyerCookie and BrowserFormPost (return URL).
- Generate a secure PunchOutSession with a 30-minute expiry and a sessionToken.
- Return cXML PunchOutSetupResponse containing Status code 200 and the StartPage URL: https://store.supplier.com/punchout/autologin?token={sessionToken}.

2. SESSION HANDSHAKE & CART RETURN:
- Expose GET /punchout/autologin?token={sessionToken}. Validate token and create a multipass or customer access token for Shopify, redirecting buyer into store with customer tags set to the TradingPartner ID.
- Provide a Node.js middleware/hook for cart checkout takeover: When buyer clicks "Transfer Cart to Procurement", intercept line items (SKU, Quantity, UnitPrice, Description, UnitOfMeasure).
- Generate a cXML PunchOutOrderMessage (or HTML form POST with POSR_DATA for OCI) containing line items, total amount, currency, and original BuyerCookie.
- Auto-submit an HTML form POST containing the cXML PunchOutOrderMessage payload back to the buyer's BrowserFormPost return URL. Mark session COMMITTED.

3. PURCHASE ORDER AUTOMATION (cXML OrderRequest Inbound):
- Expose POST /api/punchout/cxml/po
- Validate inbound payload, parse cXML OrderRequest. Extract PO Number, Line Items, Shipping Address, Billing Address, and Total Price.
- Perform Unit of Measure (UOM) normalization (e.g., convert "EA" to "Each", "BX" to "Box").
- Use Shopify Admin GraphQL API (draftOrderCreate & draftOrderComplete) to create and finalize an order in Shopify tagged with B2B-PUNCHOUT and the buyer's PO number.
- Respond to buyer's procurement system with cXML OrderRequestHeader Success (200 OK) response.

4. INVOICE DISPATCH (cXML InvoiceDetailRequest Outbound):
- Listen to Shopify webhooks for order fulfillment / payment capture.
- Construct cXML InvoiceDetailRequest payload referencing original PO Number, line items, taxes, and shipping costs.
- POST the cXML payload to the TradingPartner's inboundEndpointUrl with basic auth / shared secret headers. Log response status.

OUT OF SCOPE:
- B2C checkout handling or guest checkout flows.
- Custom storefront UI development.
- Non-cXML/OCI formats like raw EDIFACT without an EDI adapter layer.

FAILURE MODES TO HANDLE:
- Invalid SharedSecret: Return cXML status 401 Unauthorized instantly.
- Expired PunchOut tokens: Render a clean HTML error page instructing user to re-initiate session from their procurement portal.
- Cart item discrepancies (zero price or invalid SKU): Block return payload and log validation error in database.
- Shopify API downtime: Queue incoming POs in PostgreSQL with status RECEIVED for exponential-backoff retries.

$ each button prefixes agent-specific run instructions · build your own product, never copy proprietary code, trademarks or designs