fix: for exact metada match for multiple items with same variant_id

[jbrigbyjs]

Summary

What — What changes are introduced in this PR?

Updated the cart line-item action resolution logic to correctly handle cases where multiple cart line items share the same variant_id but differ in metadata.

The step now:

• Groups existing cart items by variant_id (as an array, not a single item).
• Matches items using deep metadata equality.
• Accumulates updates per existing line-item id to avoid emitting duplicate updates for the same record.

Why — Why are these changes relevant or necessary?

The previous approach implicitly assumed variant_id is unique per cart line item. In real scenarios, the same variant can exist multiple times in the cart with different metadata (e.g., different dates, room details, bundle context).

Using a Map<variant_id, item> causes overwriting and can result in:

• Updating the wrong line item,
• Incorrect quantity merges,
• Or creating duplicates instead of updating the intended line.

How — How have these changes been implemented?

• Fetch existing cart line items for the relevant variant_ids.
• Build a structure: variant_id -> CartLineItemDTO[] (list of candidates).
• For each incoming item:
  • Find a candidate with matching metadata (deepEqualObj, with proper handling of missing metadata).
  • If found, compute the new quantity and store a single update entry per line_item.id in updatesById.
  • If not found, add the item to itemsToCreate.
• Return { itemsToCreate, itemsToUpdate }, where itemsToUpdate is derived from updatesById.values().

ISSUE

#14731

---

Note

Medium Risk
Changes cart line-item merge/update behavior in the add-to-cart workflow, which can affect quantities and pricing for existing carts. Scope is contained to action resolution logic and includes safeguards for per-item update aggregation.

Overview
Fixes cart add-to-cart line-item resolution when multiple existing items share the same variant_id but differ in metadata. The step now groups existing items by variant_id, matches using deep metadata equality, and accumulates quantity/price updates per line-item id to avoid incorrect merges or duplicate updates.

Also deduplicates queried variant_ids, makes the empty-items guard null-safe, and adds a patch changeset for @medusajs/core-flows.

^{Written by Cursor Bugbot for commit aac390d. This will update automatically on new commits. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: aac390d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 76 packages

Name	Type
@medusajs/core-flows	Patch
@medusajs/medusa	Patch
@medusajs/test-utils	Patch
integration-tests-http	Patch
@medusajs/medusa-oas-cli	Patch
@medusajs/analytics	Patch
@medusajs/api-key	Patch
@medusajs/auth	Patch
@medusajs/caching	Patch
@medusajs/cart	Patch
@medusajs/currency	Patch
@medusajs/customer	Patch
@medusajs/file	Patch
@medusajs/fulfillment	Patch
@medusajs/index	Patch
@medusajs/inventory	Patch
@medusajs/link-modules	Patch
@medusajs/locking	Patch
@medusajs/notification	Patch
@medusajs/order	Patch
@medusajs/payment	Patch
@medusajs/pricing	Patch
@medusajs/product	Patch
@medusajs/promotion	Patch
@medusajs/rbac	Patch
@medusajs/region	Patch
@medusajs/sales-channel	Patch
@medusajs/settings	Patch
@medusajs/stock-location	Patch
@medusajs/store	Patch
@medusajs/tax	Patch
@medusajs/translation	Patch
@medusajs/user	Patch
@medusajs/workflow-engine-inmemory	Patch
@medusajs/workflow-engine-redis	Patch
@medusajs/draft-order	Patch
@medusajs/oas-github-ci	Patch
@medusajs/cache-inmemory	Patch
@medusajs/cache-redis	Patch
@medusajs/event-bus-local	Patch
@medusajs/event-bus-redis	Patch
@medusajs/analytics-local	Patch
@medusajs/analytics-posthog	Patch
@medusajs/auth-emailpass	Patch
@medusajs/auth-github	Patch
@medusajs/auth-google	Patch
@medusajs/caching-redis	Patch
@medusajs/file-local	Patch
@medusajs/file-s3	Patch
@medusajs/fulfillment-manual	Patch
@medusajs/locking-postgres	Patch
@medusajs/locking-redis	Patch
@medusajs/notification-local	Patch
@medusajs/notification-sendgrid	Patch
@medusajs/payment-stripe	Patch
@medusajs/framework	Patch
@medusajs/js-sdk	Patch
@medusajs/modules-sdk	Patch
@medusajs/orchestration	Patch
@medusajs/types	Patch
@medusajs/utils	Patch
@medusajs/workflows-sdk	Patch
@medusajs/cli	Patch
@medusajs/deps	Patch
@medusajs/telemetry	Patch
@medusajs/admin-bundler	Patch
@medusajs/admin-sdk	Patch
@medusajs/admin-shared	Patch
@medusajs/admin-vite-plugin	Patch
@medusajs/dashboard	Patch
@medusajs/icons	Patch
@medusajs/toolbox	Patch
@medusajs/ui-preset	Patch
create-medusa-app	Patch
medusa-dev-cli	Patch
@medusajs/ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@jbrigbyjs is attempting to deploy a commit to the medusajs Team on Vercel.

A member of the Team first needs to authorize it.

[carlos-r-l-rodrigues]

Hi @jbrigbyjs,
Thanks for the PR.
would you mind creating a new test case for that here: integration-tests/modules/__tests__/cart/store/carts.spec.ts