Next.js Commerce + Medusa ecosystem study (2026-10-13)

All repo stats pulled live from the GitHub API on 2026-10-13; blog + docs pages fetched live. Extends saleor-study (technical half) into the Medusa stack and the extension/auth model.

Summary

• Two viable, actively-maintained headless stacks verified: Saleor (Python/GraphQL core, BSD-3) with the Paper Next.js storefront, and Medusa v2 (TypeScript end-to-end, MIT open-core). Both cores pushed commits the day of this study.
• Two of the linked starters are dead ends: saleor/nextjs-commerce is archived (last commit 2023-12, README redirects to saleor/storefront), and medusajs/nextjs-starter-medusa was deprecated 2026-04 (README: "Use the dtc-starter instead"). Current paths: saleor/storefront (Paper) and medusajs/dtc-starter.
• The stacks extend differently: Saleor Apps are separate services (webhooks + APL auth storage), Medusa extensions are in-process (modules, workflows, subscribers inside the one Node app).

Verified repo state (GitHub API, 2026-10-13)

Saleor side

• Core: Python, GraphQL-first, BSD-3-Clause. Paper storefront requires Saleor ≥ 3.23 (currently 3.23.41).
• Paper (saleor/storefront) is the official production storefront: Next.js App Router + TypeScript + GraphQL + Tailwind, next-intl locales, channel-scoped routing ([locale]/[channel]/), a separate checkout app with a session bridge, and a payment registry (Stripe / Adyen apps). Caching uses Next.js 16 Cache Components ("use cache", PPR) with webhook-driven revalidation (PRODUCT_UPDATED etc. → /api/revalidate).
• License flag: Paper is FSL-1.1-ALv2 — free to use, modify, and self-host; converts to Apache-2.0 after 2 years; the restriction is on offering it as a competing managed service. Fine for our use, worth knowing if commerce ever becomes a SaaS line.
• The old saleor/nextjs-commerce (the Vercel "Next.js Commerce" Saleor fork) is archived. Its remaining value is pedagogy: the webhook→ISR revalidation pattern and Saleor-as-CMS conventions (collections named Featured / hidden… drive homepage slots; navbar/footer menus; dashboard Pages). The Vercel template page now deploys saleor/storefront.
• Apps + APL (docs.saleor.io, App SDK): Apps are standalone Next.js services registered via a manifest and given AuthData {token, saleorApiUrl, appId, jwks}. The Auth Persistence Layer (APL) abstracts storage behind get/set/delete/getAll; built-ins: FileAPL (dev only, single-tenant), RedisAPL, UpstashAPL, VercelKvApl, DynamoAPL; EnvAPL explicitly discouraged for production. APL is read-on-every-request → fast-read store (Redis/DynamoDB) recommended. Webhooks are verified via JWKS/HMAC.
• saleor-app-template: boilerplate for Apps (Node 22, pnpm 9, Next 16.4, Macaw UI v2, manifest at /api/manifest).

Medusa side

• Core: TypeScript monorepo, MIT open-core (RBAC/EE features under ENTERPRISE-LICENSE.md), v2.21.2, Postgres-only datastore.
• Architecture (4 layers): API routes (Express) → Workflows (opinionated business logic, orchestrated by the Workflow Engine module) → Modules (domain logic: cart, order, pricing, inventory…) → PostgreSQL. Commerce modules integrate providers (Stripe payments, ShipStation fulfillment); Infrastructure modules are swappable providers for cache/event/file/locking/notification/analytics (Redis, S3, SendGrid, PostHog). Plugins can bundle all layers.
• Extension model contrast: everything runs in-process in the one Medusa Node app — no network hop, TS end-to-end, single deployable + Postgres. Saleor's out-of-process Apps are language-agnostic and isolated but add webhook plumbing, APL storage, and app hosting.
• Storefront: the old official nextjs-starter-medusa (Next 15) is deprecated → medusajs/dtc-starter is the current starting point.
• POS (Agilo starter): Expo/React Native, MIT, connects to the Admin REST API over HTTPS only (no backend changes). Features: staff auth with Admin credentials, setup wizard (regions/sales channels/stock locations), barcode scan via device camera, cart → draft orders that sync to Admin, order history. Works alongside online channels via the sales-channel + inventory modules, so products/orders/customers stay unified. MVP gaps (per repo FAQ): no integrated payment processing yet (manual payment plugin planned; Stripe/Adyen terminal integrations on roadmap), no offline mode (cached browse only), app-store distribution "soon".
• Provenance: built by Agilo, a Medusa Expert Partner, from their TEKLA retail deployment; featured on the Medusa blog 2025-10-09; Agilo runs it in client projects.

Implications for us

1. If the commerce lane stays Next.js-centric, Paper is the actively-maintained Saleor reference implementation — and the closest thing to a "current" nextjs-commerce. saleor/nextjs-commerce and medusajs/nextjs-starter-medusa should be dropped from the active doc set (archived/deprecated), noted as background in saleor-study and saleor-commercial-review.
2. Medusa v2 is the stronger fit if we want TS end-to-end and simple self-hosting (one Node app + Postgres, MIT core, in-process customization). Saleor wins on language-agnostic core and isolated extension security boundary.
3. Fleet architecture mapping: Saleor's App model (standalone service + signed webhooks + APL auth storage) maps neatly onto our A2A service pattern — APL is effectively a per-integration credential vault, the same discipline as our 0600 key handling. Medusa's workflows/subscribers map onto the single-app pattern. Either integrates with SolOS via events.
4. vercel/commerce itself is now Shopify-first (featured integration, June 2026) — its provider-swap pattern (lib/… swap) remains useful for comparing stacks, but each platform now owns its official starter.

Sources

• GitHub API repos/… + commits + releases/latest for all 9 repos (2026-10-13, ~09:00 UTC) — stars, forks, licenses, push dates, archived flags, versions.
• medusajs.com blog "New POS Starter" (2025-10-09) — Agilo POS feature, feature list, roadmap.
• Agilo/medusa-pos-starter README — HTTPS-only Admin API, MVP payment/offline gaps, MIT.
• medusajs/nextjs-starter-medusa README (raw, 2026-10-13) — deprecation banner → dtc-starter.
• docs.medusajs.com "Medusa's Architecture" — 4-layer stack, module/provider lists.
• saleor/storefront README + Vercel template page — Paper stack, FSL license, Saleor ≥3.23 requirement, caching architecture.
• saleor/nextjs-commerce README — archived status, production recommendation, webhook list, CMS conventions.
• docs.saleor.io APL page — AuthData shape, APL interface, storage implementations, read-heavy guidance.
• saleor/saleor-app-template README — Node 22/pnpm 9/Next 16.4 stack, manifest endpoint.