@endora-commerce/cli 0.100.0

package/dist/rules/transaction-context.js

@@ -0,0 +1,294 @@
+/**
+ * CI check — SQL written inside a transaction runs inside that transaction
+ * (issue #200).
+ *
+ * `SqlEntityManager.getKnex()` is `getConnection().getKnex()`, and a connection
+ * is not a transaction: the handle it returns takes its own pooled connection
+ * and knows nothing about the EntityManager's active transaction. So does
+ * `getConnection().execute(sql, params)` when it is not handed a transaction
+ * context as its fourth argument. Either one, written inside
+ * `em.transactional(...)`, **commits the moment it runs** — the enclosing
+ * rollback cannot reach it, and a read cannot see what the transaction has
+ * written.
+ *
+ * That is not a theoretical hazard. `PromotionUsageService.finalize` said in its
+ * own doc comment that its counter increments had to be co-transactional with
+ * order placement and issued them through `em.getKnex()`, so a usage cap hit
+ * rolled the order back and left the counter incremented and a redemption row
+ * pointing at an order that never existed (D-94). The sweep that produced this
+ * check found the same mechanism in sixty-five more places — fifty-one of them
+ * writes — none of them suspected: `BlogCategoryService.create` left a category with no channel scope
+ * behind a failed create, `CmsPageService.create` left a page, and
+ * `MegamenuItemService.setTree` — a delete-then-insert whose doc comment says
+ * "in one transaction" — **wiped an operator's whole menu** when the re-insert
+ * was refused.
+ *
+ * ## What is decidable, and what this check therefore looks at
+ *
+ * Whether an arbitrary method runs inside a transaction is a question about its
+ * callers, and not decidable here: services take an `em` that may or may not
+ * have one open. What *is* decidable is the lexical case — SQL written inside a
+ * scope that opens the transaction itself — and that is the whole population:
+ *
+ *   1. **`transactional-callback`** — the body of `<em>.transactional(cb)`.
+ *   2. **`command-run`** — the `run` of a Command literal (one that also carries
+ *      an `action`). `CommandBus.run` executes it inside `scoped.transactional`
+ *      (Principle XIII), so the transaction is as certain there as in (1).
+ *
+ * A guard reached one hop away — `this.replaceChannelScope(tx, …)` — is outside
+ * the population by construction, and deliberately: the check would have to
+ * guess at call sites to see it, and guessing is what gets a check switched off.
+ * The remedy does not need the check to see it, either, because it is safe
+ * everywhere: `em.execute(sql, params)` passes the EntityManager's transaction
+ * context when there is one and behaves exactly like the connection-level call
+ * when there is not.
+ *
+ * ## The two shapes refused
+ *
+ *   - **`knex-instance`** — a `getKnex()` call, whatever the receiver. The
+ *     predicate is shared with `check-module-boundary`'s builder path
+ *     (`lib/sql-tables.ts`), so the two cannot drift over what a knex handle
+ *     looks like.
+ *   - **`connection-execute`** — an `execute(...)` whose receiver reaches
+ *     `getConnection()`, directly or through a `const conn = …` binding in the
+ *     same file, with fewer than four arguments. The fourth argument is the
+ *     transaction context, and passing it is the house pattern
+ *     (`sales-channel-membership.service.ts`); an `execute` that has it is not a
+ *     finding.
+ *
+ * `em.execute(...)` is not in the population at all: the EntityManager's own
+ * `execute` fills the context in for you, which is why it is the recommended
+ * repair.
+ *
+ * ## One analysis, two hosts
+ *
+ * This file is the analysis (`specs/101-endora-check/contracts/package-scope-layout.md`
+ * §6). `backend/scripts/check-transaction-context.ts` hosts it over this
+ * repository's module walk roots and its ledger; `endora check` hosts it over
+ * one module package's declared source layer. Neither host re-derives the
+ * other's population, and neither holds a second copy of the predicate.
+ */
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import ts from 'typescript';
+import { isGetKnexCall, sqlTableAccesses } from '../lib/sql-tables.js';
+/** `<file>#<shape>#<statement>` — the ledger key, and the identity of a site. */
+export function keyOf(found) {
+    return `${found.file}#${found.shape}#${found.statement}`;
+}
+/**
+ * Every TypeScript source under `dir`, with the rule's own prunes applied.
+ *
+ * Exported because the population is part of the rule, not part of a host: two
+ * hosts computing "which files this check reads" two ways is the shape that
+ * lets one of them go half-blind.
+ */
+export function collectTransactionSources(dir, out = []) {
+    if (!existsSync(dir))
+        return out;
+    for (const name of readdirSync(dir)) {
+        const full = join(dir, name);
+        if (statSync(full).isDirectory()) {
+            if (name === 'node_modules' || name === 'dist')
+                continue;
+            collectTransactionSources(full, out);
+        }
+        else if (name.endsWith('.ts') && !name.endsWith('.test.ts') && !name.endsWith('.d.ts')) {
+            out.push(full);
+        }
+    }
+    return out;
+}
+/** The identifiers a file binds to a `getConnection()` result. */
+function connectionBindings(sf) {
+    const bound = new Set();
+    const visit = (node) => {
+        if (ts.isVariableDeclaration(node) &&
+            ts.isIdentifier(node.name) &&
+            node.initializer !== undefined &&
+            isGetConnectionCall(node.initializer)) {
+            bound.add(node.name.text);
+        }
+        node.forEachChild(visit);
+    };
+    sf.forEachChild(visit);
+    return bound;
+}
+function isGetConnectionCall(node) {
+    return (ts.isCallExpression(node) &&
+        ts.isPropertyAccessExpression(node.expression) &&
+        node.expression.name.text === 'getConnection');
+}
+/**
+ * Whether the receiver of an `execute` is a connection.
+ *
+ * Two ways to be one, and both have to be read: the call chain names
+ * `getConnection()` itself (`tx.getConnection().execute(…)`), or it is an
+ * identifier the file bound to one (`const conn = tx.getConnection()`), which is
+ * how thirty-nine of the sites in the D-94 sweep were written.
+ */
+function receiverIsConnection(expression, bindings) {
+    let current = expression;
+    for (;;) {
+        if (ts.isCallExpression(current)) {
+            if (isGetConnectionCall(current))
+                return true;
+            current = current.expression;
+            continue;
+        }
+        if (ts.isPropertyAccessExpression(current)) {
+            current = current.expression;
+            continue;
+        }
+        if (ts.isParenthesizedExpression(current) ||
+            ts.isAsExpression(current) ||
+            ts.isNonNullExpression(current)) {
+            current = current.expression;
+            continue;
+        }
+        return ts.isIdentifier(current) && bindings.has(current.text);
+    }
+}
+/** The SQL a call's first argument spells out, as far as it is literal. */
+function statementText(node) {
+    if (node === undefined)
+        return null;
+    if (ts.isStringLiteralLike(node))
+        return node.text;
+    if (ts.isTemplateExpression(node)) {
+        return node.head.text + node.templateSpans.map((span) => span.literal.text).join(' ? ');
+    }
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+        return `${statementText(node.left) ?? ''}${statementText(node.right) ?? ''}`;
+    }
+    return null;
+}
+/** One line of SQL, collapsed, for a message and a stable ledger key. */
+function head(text) {
+    return text.replace(/\s+/g, ' ').trim().slice(0, 70);
+}
+/**
+ * A Command literal's `run`.
+ *
+ * `action` has to be there too: `run` on its own is a common enough property
+ * name (a worker's `run`, a script's `run`) and only the Command shape carries
+ * the Command Bus' transaction with it.
+ */
+function commandRunBody(node) {
+    if (!ts.isObjectLiteralExpression(node))
+        return null;
+    const named = (name) => node.properties.find((property) => ts.isPropertyAssignment(property) &&
+        ts.isIdentifier(property.name) &&
+        property.name.text === name);
+    if (named('action') === undefined)
+        return null;
+    const run = named('run');
+    if (run === undefined)
+        return null;
+    if (!ts.isArrowFunction(run.initializer) && !ts.isFunctionExpression(run.initializer))
+        return null;
+    return run.initializer.body;
+}
+/** The body of an `<em>.transactional(cb)` call. */
+function transactionalCallbackBody(node) {
+    if (!ts.isCallExpression(node))
+        return null;
+    if (!ts.isPropertyAccessExpression(node.expression))
+        return null;
+    if (node.expression.name.text !== 'transactional')
+        return null;
+    const [callback] = node.arguments;
+    if (callback === undefined)
+        return null;
+    if (!ts.isArrowFunction(callback) && !ts.isFunctionExpression(callback))
+        return null;
+    return callback.body;
+}
+/** Every statement written inside a transaction that does not run inside it. */
+export function findTransactionEscapes(input) {
+    const found = [];
+    for (const [file, text] of input.sources) {
+        if (!text.includes('transactional(') && !text.includes('run:'))
+            continue;
+        const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+        const bindings = connectionBindings(sf);
+        // The direction of the statement on a line, from the predicate
+        // `check-module-boundary` reads tables with — so "write" means here what it
+        // means there, rather than a second opinion maintained next to it.
+        const writeLines = new Set(sqlTableAccesses(text, file)
+            .filter((access) => access.direction === 'write')
+            .map((access) => access.line));
+        const readLines = new Set(sqlTableAccesses(text, file)
+            .filter((access) => access.direction === 'read')
+            .map((access) => access.line));
+        const inspect = (body, scope) => {
+            const visit = (node) => {
+                // A nested transactional callback or Command literal is the same scope
+                // for this purpose, so recursion into it needs no special case.
+                if (ts.isCallExpression(node) && isGetKnexCall(node)) {
+                    found.push({
+                        file,
+                        line: sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1,
+                        scope,
+                        shape: 'knex-instance',
+                        direction: 'unknown',
+                        statement: head(node.getText(sf)),
+                    });
+                }
+                else if (ts.isCallExpression(node) &&
+                    ts.isPropertyAccessExpression(node.expression) &&
+                    node.expression.name.text === 'execute' &&
+                    node.arguments.length < 4 &&
+                    receiverIsConnection(node.expression.expression, bindings)) {
+                    const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+                    const argument = node.arguments[0];
+                    const sql = statementText(argument);
+                    // The direction is looked up by the **literal's** line, not the
+                    // call's: `await em\n  .getConnection()\n  .execute(\n    'select …'`
+                    // puts four lines between them, and keying on the call's line reported
+                    // every one of those as `unknown`.
+                    const sqlLine = argument === undefined
+                        ? line
+                        : sf.getLineAndCharacterOfPosition(argument.getStart(sf)).line + 1;
+                    found.push({
+                        file,
+                        line,
+                        scope,
+                        shape: 'connection-execute',
+                        direction: writeLines.has(sqlLine)
+                            ? 'write'
+                            : readLines.has(sqlLine)
+                                ? 'read'
+                                : 'unknown',
+                        statement: sql === null ? head(node.getText(sf)) : head(sql),
+                    });
+                }
+                node.forEachChild(visit);
+            };
+            body.forEachChild(visit);
+        };
+        const visitTop = (node) => {
+            const transactional = transactionalCallbackBody(node);
+            if (transactional !== null)
+                inspect(transactional, 'transactional-callback');
+            const commandRun = commandRunBody(node);
+            if (commandRun !== null)
+                inspect(commandRun, 'command-run');
+            node.forEachChild(visitTop);
+        };
+        sf.forEachChild(visitTop);
+    }
+    found.sort((a, b) => (a.file === b.file ? a.line - b.line : a.file.localeCompare(b.file)));
+    return found;
+}
+export function checkTransactionContext(input, ledger) {
+    const all = findTransactionEscapes(input);
+    const keys = new Set(all.map(keyOf));
+    return {
+        total: all.length,
+        violations: all.filter((entry) => ledger[keyOf(entry)] === undefined),
+        ledgered: all.filter((entry) => ledger[keyOf(entry)] !== undefined),
+        stale: Object.keys(ledger).filter((key) => !keys.has(key)),
+    };
+}
+//# sourceMappingURL=transaction-context.js.map

package/dist/rules/transaction-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-context.js","sourceRoot":"","sources":["../../src/rules/transaction-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAoBvE,iFAAiF;AACjF,MAAM,UAAU,KAAK,CAAC,KAAwB;IAC5C,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AAC3D,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,MAAgB,EAAE;IACvE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,MAAM;gBAAE,SAAS;YACzD,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,EAAiB;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IACE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;YAC9B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,WAAW,KAAK,SAAS;YAC9B,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,EACrC,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;IACF,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAmB;IAC9C,OAAO,CACL,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACzB,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,UAAyB,EAAE,QAA6B;IACpF,IAAI,OAAO,GAAY,UAAU,CAAC;IAClC,SAAS,CAAC;QACR,IAAI,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAI,mBAAmB,CAAC,OAAwB,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IACE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;YACrC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;YAC1B,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAC/B,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACnD,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QACvF,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAqC,EAAE,CAChE,IAAI,CAAC,UAAU,CAAC,IAAI,CAClB,CAAC,QAAQ,EAAqC,EAAE,CAC9C,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QACjC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAC9B,CAAC;IACJ,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,OAAO,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED,oDAAoD;AACpD,SAAS,yBAAyB,CAAC,IAAa;IAC9C,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,KAA8B;IACnE,MAAM,KAAK,GAAwB,EAAE,CAAC;IAEtC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACzE,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACxC,+DAA+D;QAC/D,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC;aACzB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC;aAChD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC;aACzB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC;aAC/C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAChC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,KAAuB,EAAQ,EAAE;YAC/D,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;gBACpC,uEAAuE;gBACvE,gEAAgE;gBAChE,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrD,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI;wBACJ,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;wBAClE,KAAK;wBACL,KAAK,EAAE,eAAe;wBACtB,SAAS,EAAE,SAAS;wBACpB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;qBAClC,CAAC,CAAC;gBACL,CAAC;qBAAM,IACL,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;oBACzB,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;oBACvC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;oBACzB,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,EAC1D,CAAC;oBACD,MAAM,IAAI,GAAG,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;oBAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBACnC,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACpC,gEAAgE;oBAChE,sEAAsE;oBACtE,uEAAuE;oBACvE,mCAAmC;oBACnC,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;wBACpB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;oBACvE,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI;wBACJ,IAAI;wBACJ,KAAK;wBACL,KAAK,EAAE,oBAAoB;wBAC3B,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;4BAChC,CAAC,CAAC,OAAO;4BACT,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gCACtB,CAAC,CAAC,MAAM;gCACR,CAAC,CAAC,SAAS;wBACf,SAAS,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;qBAC7D,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAQ,EAAE;YACvC,MAAM,aAAa,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,aAAa,KAAK,IAAI;gBAAE,OAAO,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAC;YAC7E,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC;AAUD,MAAM,UAAU,uBAAuB,CACrC,KAA8B,EAC9B,MAAwC;IAExC,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC;QACrE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC;QACnE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KAC3D,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@endora-commerce/cli",
+  "version": "0.100.0",
+  "type": "module",
+  "description": "The `endora` command line: scaffolding and conformance tooling for Endora Commerce modules and integrations.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/cli"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "endora": "./dist/bin/endora.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./lib/*.js": {
+      "types": "./dist/lib/*.d.ts",
+      "default": "./dist/lib/*.js"
+    },
+    "./rules/*.js": {
+      "types": "./dist/rules/*.d.ts",
+      "default": "./dist/rules/*.js"
+    },
+    "./checks": {
+      "types": "./dist/checks.d.ts",
+      "default": "./dist/checks.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "dependencies": {
+    "typescript": "^5.9.3",
+    "@endora-commerce/contracts": "0.100.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.9.0",
+    "vitest": "^4.1.11"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/write-release-index.mjs",
+    "typecheck": "tsc -p tsconfig.json",
+    "lint": "eslint src test",
+    "test": "vitest run"
+  }
+}