State-by-state restrictions enforcement at checkout — how?

US pharma is federal + 50 state regimes layered. Magento handles state-level restrictions via a per-product / per-buyer / per-state rule engine:

• Pseudoephedrine (CMEA, Combat Methamphetamine Epidemic Act) — daily 3.6g / 30-day 9g per buyer cap, ID logging, state PSE registry pings (Illinois, Oregon, Mississippi require Rx; most others — behind-the-counter logbook). Magento checkout queries a per-state ruleset; refuses cart line if buyer is over cap.
• Naloxone (Narcan) — OTC since 2023, but some states still require pharmacist counsel pre-dispense. Magento adds a counsel-acknowledgement step in those states.
• Buprenorphine (Suboxone) — MAT-prescriber-only, X-DEA waiver was eliminated 2023 but state rules vary. Validate prescriber NPI × state license × specialty.
• Cannabis-derived (CBD, low-THC products) — 18 states explicitly allow online sale, 12 prohibit, rest are grey. Per-product / per-state shippability matrix gates the cart.
• Compounded medications — 503A pharmacies can’t ship across state lines >5% of total prescriptions; 503B outsourcing facilities can. Compliance gate at checkout based on shipping state vs facility status.

Implementation pattern: per-product attribute × per-state config table. Cart calculates shippability + quantity-cap per line item against the buyer’s state and prior 30-day purchase history. Out-of-bounds line items → cart message + alternative-product suggestion. Buyer 30-day rolling history lives in a custom Magento table, indexed by buyer + drug + state, queried at every checkout.