@geonosis/verify-arch 1.0.0

package/dist/chunk-2N2AFWCY.js

@@ -0,0 +1,940 @@
+// src/packs/composition-tree/index.ts
+import { readFileSync } from "fs";
+import { dirname, join, relative, resolve } from "path";
+
+// src/packs/composition-tree/options.ts
+var rung = (name, selfComposition) => ({
+  name,
+  pattern: `(?:^|/)(?:features/[^/]+/)?${name}/`,
+  selfComposition
+});
+var DEFAULT_TIERS = [
+  rung("atoms", false),
+  rung("molecules", true),
+  rung("compounds", true),
+  rung("organelles", true),
+  rung("cells", false),
+  rung("tissues", true)
+];
+var strings = (options, key, fallback) => {
+  const value = options[key];
+  if (value === void 0) return fallback;
+  if (!Array.isArray(value) || value.some((one) => typeof one !== "string")) {
+    throw new TypeError(
+      `verify-arch: composition-tree option \`${key}\` must be a list of strings.`
+    );
+  }
+  return value;
+};
+var tiers = (options) => {
+  const value = options.tiers;
+  if (value === void 0) return DEFAULT_TIERS;
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new TypeError("verify-arch: composition-tree option `tiers` must be a non-empty list.");
+  }
+  return value.map((one) => {
+    const tier = one;
+    if (typeof tier.name !== "string" || typeof tier.pattern !== "string") {
+      throw new TypeError("verify-arch: every `tiers` entry needs a `name` and a `pattern`.");
+    }
+    return {
+      name: tier.name,
+      pattern: tier.pattern,
+      selfComposition: tier.selfComposition === true
+    };
+  });
+};
+var aliases = (options) => {
+  const value = options.aliases;
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    throw new TypeError("verify-arch: composition-tree option `aliases` must be a list.");
+  }
+  return value.map((one) => {
+    const alias = one;
+    if (typeof alias.prefix !== "string" || typeof alias.to !== "string") {
+      throw new TypeError("verify-arch: every `aliases` entry needs a `prefix` and a `to`.");
+    }
+    return { prefix: alias.prefix, to: alias.to };
+  });
+};
+var readOptions = (options) => ({
+  aliases: aliases(options),
+  // Empty, and meant to be: orphan detection with no entry points would call every file dead.
+  entryPoints: strings(options, "entryPoints", []),
+  extensions: strings(options, "extensions", [".ts", ".tsx"]),
+  roots: strings(options, "roots", ["."]),
+  tiers: tiers(options)
+});
+
+// src/packs/composition-tree/index.ts
+var slashes = (path) => path.replaceAll("\\", "/");
+var SPECIFIER = /\bfrom\s*['"]([^'"]+)['"]|\bimport\s*\(\s*['"]([^'"]+)['"]|\brequire\s*\(\s*['"]([^'"]+)['"]|^\s*import\s+['"]([^'"]+)['"]/gm;
+var withoutComments = (source) => source.replaceAll(/\/\/[^\n]*/g, "").replaceAll(/\/\*[\s\S]*?\*\//g, "");
+var specifiersIn = (source) => {
+  const found = [];
+  const scanner = new RegExp(SPECIFIER.source, SPECIFIER.flags);
+  let match;
+  while ((match = scanner.exec(withoutComments(source))) !== null) {
+    const named = match[1] ?? match[2] ?? match[3] ?? match[4];
+    if (named !== void 0) found.push(named);
+  }
+  return found;
+};
+var tierOf = (rel, tiers2) => tiers2.findIndex((tier) => new RegExp(tier.pattern).test(rel));
+var build = ({ files, options, root }) => {
+  const read2 = readOptions(options);
+  const known = /* @__PURE__ */ new Set();
+  const inScope = [];
+  for (const file of files) {
+    const rel = slashes(relative(root, file));
+    if (!read2.extensions.some((one) => rel.endsWith(one))) continue;
+    if (!read2.roots.some((one) => one === "." || rel === one || rel.startsWith(`${one}/`))) continue;
+    known.add(rel);
+    inScope.push(rel);
+  }
+  const resolveTo = (from, specifier) => {
+    const aliased = read2.aliases.find((one) => specifier.startsWith(one.prefix));
+    const asPath = aliased === void 0 ? specifier.startsWith(".") ? slashes(join(dirname(from), specifier)) : void 0 : slashes(join(aliased.to, specifier.slice(aliased.prefix.length)));
+    if (asPath === void 0) return void 0;
+    if (known.has(asPath)) return asPath;
+    for (const extension of read2.extensions) {
+      if (known.has(`${asPath}${extension}`)) return `${asPath}${extension}`;
+      if (known.has(`${asPath}/index${extension}`)) return `${asPath}/index${extension}`;
+    }
+    return void 0;
+  };
+  const edges = /* @__PURE__ */ new Map();
+  const tier = /* @__PURE__ */ new Map();
+  const entries = [];
+  const isEntry = read2.entryPoints.map((pattern) => new RegExp(pattern));
+  for (const rel of inScope) {
+    const at = tierOf(rel, read2.tiers);
+    if (at !== -1) tier.set(rel, at);
+    if (isEntry.some((pattern) => pattern.test(`/${rel}`))) entries.push(rel);
+    let source;
+    try {
+      source = readFileSync(resolve(root, rel), "utf8");
+    } catch {
+      continue;
+    }
+    edges.set(
+      rel,
+      specifiersIn(source).map((specifier) => resolveTo(rel, specifier)).filter((one) => one !== void 0)
+    );
+  }
+  return { edges, entries, tier };
+};
+var ladderViolations = (graph, tiers2, root) => {
+  const found = [];
+  for (const [from, targets] of graph.edges) {
+    const at = graph.tier.get(from);
+    if (at === void 0) continue;
+    for (const to of targets) {
+      const landed = graph.tier.get(to);
+      if (landed === void 0 || to === from) continue;
+      const here = tiers2[at];
+      const there = tiers2[landed];
+      if (landed > at) {
+        found.push({
+          file: resolve(root, from),
+          message: `${here.name} composes ${there.name}: ${from} -> ${to}. A tier may only compose tiers at or below its own.`,
+          scanner: "direction"
+        });
+        continue;
+      }
+      if (landed === at && !here.selfComposition) {
+        found.push({
+          file: resolve(root, from),
+          message: `${here.name} composes another ${there.name}: ${from} -> ${to}. That tier is not self-composing.`,
+          scanner: "self-composition"
+        });
+      }
+    }
+  }
+  return found;
+};
+var orphans = (graph, root) => {
+  const reached = new Set(graph.entries);
+  const queue = [...graph.entries];
+  while (queue.length > 0) {
+    const at = queue.shift();
+    for (const to of graph.edges.get(at) ?? []) {
+      if (reached.has(to)) continue;
+      reached.add(to);
+      queue.push(to);
+    }
+  }
+  return [...graph.tier.keys()].filter((rel) => !reached.has(rel)).toSorted().map((rel) => ({
+    file: resolve(root, rel),
+    message: `Nothing reaches ${rel} from any entry point \u2014 it is dead code, or an entry point is missing from the config.`,
+    scanner: "orphan"
+  }));
+};
+var LADDER = [
+  { id: "direction", label: "direction" },
+  { id: "self-composition", label: "self-composition" }
+];
+var ORPHAN = { id: "orphan", label: "orphan" };
+var compositionTree = {
+  /**
+   * With no entry points declared there is nothing to be reachable FROM, so every classified file
+   * would be an orphan. The check is then neither run nor CLAIMED — a pass line naming a check that
+   * did nothing is exactly the silent green this package exists to refuse.
+   */
+  checks: (options) => readOptions(options).entryPoints.length === 0 ? LADDER : [...LADDER, ORPHAN],
+  id: "composition-tree",
+  scan: (context) => {
+    const read2 = readOptions(context.options);
+    const graph = build(context);
+    const ladder = ladderViolations(graph, read2.tiers, context.root);
+    return read2.entryPoints.length === 0 ? ladder : [...ladder, ...orphans(graph, context.root)];
+  }
+};
+
+// src/types.ts
+var VerifyArchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "VerifyArchError";
+  }
+};
+
+// src/walk.ts
+import { existsSync, readdirSync, statSync } from "fs";
+import { join as join2 } from "path";
+var DEFAULT_IGNORED = [
+  ".git",
+  ".medusa",
+  ".next",
+  ".turbo",
+  "__tests__",
+  "coverage",
+  "dist",
+  "node_modules",
+  "out"
+];
+var walkFiles = (root, ignored = DEFAULT_IGNORED) => {
+  if (!existsSync(root)) return [];
+  const skip = new Set(ignored);
+  const found = [];
+  const stack = [root];
+  while (stack.length > 0) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (skip.has(entry)) continue;
+      const full = join2(dir, entry);
+      try {
+        if (statSync(full).isDirectory()) stack.push(full);
+        else found.push(full);
+      } catch {
+        continue;
+      }
+    }
+  }
+  return found;
+};
+
+// src/packs/medusa/checks.ts
+import { basename } from "path";
+
+// src/packs/medusa/text.ts
+var lineAt = (source, index) => source.slice(0, index).split("\n").length;
+var balancedFrom = (source, open) => {
+  const opener = source[open];
+  const closer = opener === "(" ? ")" : "}";
+  let depth = 0;
+  for (let at = open; at < source.length; at++) {
+    const char = source[at];
+    if (char === opener) depth++;
+    else if (char === closer) {
+      depth--;
+      if (depth === 0) return source.slice(open, at + 1);
+    }
+  }
+  return null;
+};
+var afterCall = (source, open) => {
+  const call = balancedFrom(source, open);
+  return call === null ? -1 : open + call.length;
+};
+var commentEnd = (text2, at) => {
+  if (text2[at] !== "/") return null;
+  if (text2[at + 1] === "/") {
+    const newline = text2.indexOf("\n", at);
+    return newline === -1 ? text2.length : newline;
+  }
+  if (text2[at + 1] === "*") {
+    const end = text2.indexOf("*/", at + 2);
+    return end === -1 ? text2.length : end + 1;
+  }
+  return null;
+};
+var skipLeadingComments = (text2) => {
+  let at = 0;
+  for (; ; ) {
+    while (at < text2.length && /\s/.test(text2[at])) at++;
+    const end = commentEnd(text2, at);
+    if (end === null) return text2.slice(at);
+    at = end + 1;
+  }
+};
+var countTopLevelArgs = (call) => {
+  let depth = 0;
+  let args = 1;
+  let inString = null;
+  let lastMeaningful = "";
+  for (let at = 0; at < call.length; at++) {
+    const char = call[at];
+    if (inString !== null) {
+      if (char === inString && call[at - 1] !== "\\") inString = null;
+      continue;
+    }
+    const skipTo = commentEnd(call, at);
+    if (skipTo !== null) {
+      at = skipTo;
+      continue;
+    }
+    if (char === "'" || char === '"' || char === "`") inString = char;
+    else if (char === "(" || char === "{" || char === "[") depth++;
+    else if (char === ")" || char === "}" || char === "]") {
+      depth--;
+      if (depth === 0 && lastMeaningful === ",") args--;
+    } else if (char === "," && depth === 1) args++;
+    if (!/\s/.test(char)) lastMeaningful = char;
+  }
+  return args;
+};
+var withoutComments2 = (source) => {
+  const out = [...source];
+  let inString = null;
+  for (let at = 0; at < source.length; at++) {
+    const char = source[at];
+    if (inString !== null) {
+      if (char === "\\") at++;
+      else if (char === inString) inString = null;
+      continue;
+    }
+    if (char === "'" || char === '"' || char === "`") {
+      inString = char;
+      continue;
+    }
+    const end = commentEnd(source, at);
+    if (end === null) continue;
+    for (let blank = at; blank <= end && blank < source.length; blank++) {
+      if (out[blank] !== "\n") out[blank] = " ";
+    }
+    at = end;
+  }
+  return out.join("");
+};
+var matchesOf = (source, pattern) => {
+  const scanner = new RegExp(
+    pattern.source,
+    pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`
+  );
+  const found = [];
+  let match;
+  while ((match = scanner.exec(source)) !== null) {
+    found.push(match);
+    if (match[0] === "") scanner.lastIndex++;
+  }
+  return found;
+};
+var anyOf = (names) => names.map((one) => one.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)).join("|");
+
+// src/packs/medusa/checks.ts
+var mutationCall = (options) => new RegExp(String.raw`\.\s*(?:${anyOf(options.mutationPrefixes)})[A-Z][A-Za-z]*\s*\(`, "g");
+var stepFactory = (options) => new RegExp(String.raw`\b(?:${anyOf(options.stepFactories)})\s*\(`, "g");
+var serviceNameUnique = (modules) => {
+  const byName = /* @__PURE__ */ new Map();
+  for (const one of modules) {
+    byName.set(one.serviceName, [...byName.get(one.serviceName) ?? [], one]);
+  }
+  const found = [];
+  for (const [serviceName, group] of byName) {
+    if (group.length < 2) continue;
+    for (const one of group) {
+      const others = group.filter((other) => other.file !== one.file).map((other) => other.rel).join(", ");
+      found.push({
+        file: one.file,
+        message: `Module serviceName '${serviceName}' is not globally unique \u2014 also declared in: ${others}. Colliding serviceNames silently last-win at config merge; rename one.`,
+        scanner: "R3.7"
+      });
+    }
+  }
+  return found;
+};
+var routeNamespacing = (routes) => {
+  const found = [];
+  for (const route of routes) {
+    if (!route.namespaced) continue;
+    const segments2 = route.routePath.split("/").filter(Boolean);
+    const scope = segments2[0];
+    if (scope !== "store" && scope !== "admin") {
+      found.push({
+        file: route.file,
+        message: `Plugin route '${route.routePath}' must be scoped under /store or /admin.`,
+        scanner: "R3.8"
+      });
+      continue;
+    }
+    if (segments2.length < 2) {
+      found.push({
+        file: route.file,
+        message: `Plugin route '${route.routePath}' has no namespace segment \u2014 it must be /${scope}/<plugin-namespace>/*; a bare /${scope}/<leaf> collides cross-package.`,
+        scanner: "R3.8"
+      });
+    }
+  }
+  for (const [routePath, group] of groupBy(routes, (route) => route.routePath)) {
+    if (group.length < 2) continue;
+    for (const route of group) {
+      const others = group.filter((other) => other.file !== route.file).map((other) => `${other.pkg} (${other.rel})`).join(", ");
+      found.push({
+        file: route.file,
+        message: `Route path '${routePath}' collides across packages \u2014 also defined by: ${others}. The routes-loader map is last-write-wins; one handler silently clobbers the other.`,
+        scanner: "R3.8"
+      });
+    }
+  }
+  return found;
+};
+var SIDE_EFFECT = {
+  job: /\bconfig\b[\s\S]{0,80}\bschedule\s*:/,
+  subscriber: /\bSubscriberConfig\b|\bconfig\b[\s\S]{0,80}\bevent\s*:/,
+  workflow: /\b(?:createWorkflow|createStep|createHook|createScheduledWorkflow|createCartMutatingWorkflow)\s*\(|\.hooks\.[A-Za-z_$]/
+};
+var loaderIndexSideEffects = (files, options) => {
+  const kinds2 = new Set(options.kinds);
+  return files.filter((one) => {
+    const name = basename(one.file);
+    return (name === "index.ts" || name === "index.js") && kinds2.has(one.kind) && SIDE_EFFECT[one.kind].test(one.code);
+  }).map((one) => ({
+    file: one.file,
+    message: `${one.kind} file named '${basename(one.file)}' carries a loader side-effect but is SKIPPED by Medusa's ResourceLoader auto-discovery (it filters parsedName.name !== "index"). Rename it to a descriptive sibling and keep a re-export barrel at index.ts.`,
+    scanner: "#15442"
+  }));
+};
+var duplicateQueryStep = (sources, options) => {
+  const factory = new RegExp(String.raw`\b(?:${anyOf(options.workflowFactories)})\s*\(`, "g");
+  const step = new RegExp(String.raw`\b(${anyOf(options.queryStepCalls)})\s*\(`, "g");
+  const found = [];
+  for (const source of sources) {
+    for (const match of matchesOf(source.code, factory)) {
+      const open = source.code.indexOf("{", match.index);
+      if (open === -1) continue;
+      const body = balancedFrom(source.code, open);
+      if (body === null) continue;
+      const steps = matchesOf(body, step).map((one) => {
+        const closed = afterCall(body, one.index + one[0].length - 1);
+        if (closed === -1) return { at: open + one.index, kind: one[1], name: void 0 };
+        const chained = /^\s*\.config\s*\(\s*\{[^}]*?\bname\s*:\s*['"`]([^'"`]+)['"`]/.exec(
+          body.slice(closed, closed + 200)
+        );
+        return {
+          at: open + one.index,
+          kind: one[1],
+          name: chained === null ? void 0 : chained[1]
+        };
+      });
+      if (steps.length < 2) continue;
+      const seen = /* @__PURE__ */ new Set();
+      for (const one of steps) {
+        if (one.name === void 0) {
+          found.push({
+            file: source.file,
+            line: lineAt(source.source, one.at),
+            message: `A workflow body has ${steps.length} ${one.kind} calls but at least one has no .config({ name }) \u2014 duplicate steps silently last-win. Give every duplicate query step a unique .config({ name }).`,
+            scanner: "R4.3"
+          });
+          continue;
+        }
+        if (seen.has(one.name)) {
+          found.push({
+            file: source.file,
+            line: lineAt(source.source, one.at),
+            message: `Two query steps in one workflow share .config({ name: '${one.name}' }) \u2014 names must be unique.`,
+            scanner: "R4.3"
+          });
+        }
+        seen.add(one.name);
+      }
+    }
+  }
+  return found;
+};
+var routeMutationsViaWorkflows = (routes, options) => {
+  const mutation = mutationCall(options);
+  const found = [];
+  for (const route of routes) {
+    const lines = route.source.split("\n");
+    const code = route.code.split("\n");
+    for (const [at, line] of lines.entries()) {
+      if (!new RegExp(mutation.source).test(code[at])) continue;
+      if (line.includes(options.inlineMutationOk) || at > 0 && lines[at - 1].includes(options.inlineMutationOk)) {
+        continue;
+      }
+      found.push({
+        file: route.file,
+        line: at + 1,
+        message: `Route handler mutates a service directly (\`${line.trim().slice(0, 90)}\`) \u2014 mutations go through a workflow, where compensation and retry live. Wrap it, or annotate \`// ${options.inlineMutationOk}(<reason>)\` if the write is deliberately bare.`,
+        scanner: "R5.1"
+      });
+    }
+  }
+  return found;
+};
+var mutatingSteps = (source, options) => {
+  const mutation = mutationCall(options);
+  return matchesOf(source.code, stepFactory(options)).map((match) => {
+    const open = match.index + match[0].length - 1;
+    const call = balancedFrom(source.code, open);
+    return call === null ? null : { at: match.index, call, firstArg: skipLeadingComments(call.slice(1)) };
+  }).filter((one) => one !== null && new RegExp(mutation.source).test(one.call));
+};
+var configObject = (firstArg) => firstArg.startsWith("{") ? balancedFrom(firstArg, 0) : null;
+var nameIn = (firstArg) => /['"`]([^'"`]+)['"`]/.exec(firstArg)?.[1] ?? "<unnamed>";
+var mutatingStepsDeclareRetry = (sources, options) => {
+  const retry = new RegExp(
+    options.retrySpreads.length === 0 ? String.raw`maxRetries\s*:` : String.raw`\.\.\.\s*(?:${anyOf(options.retrySpreads)})[A-Za-z0-9_]*|maxRetries\s*:`
+  );
+  return sources.flatMap(
+    (source) => mutatingSteps(source, options).filter((step) => {
+      const config = configObject(step.firstArg);
+      return config === null || !retry.test(config);
+    }).map((step) => ({
+      file: source.file,
+      line: lineAt(source.source, step.at),
+      message: `Mutating step '${nameIn(step.firstArg)}' declares no retry class \u2014 steps default to maxRetries: 0, so a transient failure reverts real state. Give it a retry class in the step config object.`,
+      scanner: "R5.2"
+    }))
+  );
+};
+var METHOD = /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)\b|export\s+const\s+(GET|POST|PUT|PATCH|DELETE|OPTIONS|HEAD)\s*=/g;
+var routeShadowing = (routes, options) => {
+  const found = [];
+  for (const [path, group] of groupBy(routes, (route) => route.routePath)) {
+    if (group.length < 2) continue;
+    const withMethods = group.map((route) => ({
+      methods: new Set(matchesOf(route.code, METHOD).map((one) => one[1] ?? one[2])),
+      route
+    }));
+    for (let left = 0; left < withMethods.length; left++) {
+      for (let right = left + 1; right < withMethods.length; right++) {
+        const one = withMethods[left];
+        const other = withMethods[right];
+        if (one.route.pkg === other.route.pkg) continue;
+        const shared = [...one.methods].filter((method) => other.methods.has(method));
+        if (shared.length === 0) continue;
+        if (one.route.source.includes(options.routeOverrideOk) || other.route.source.includes(options.routeOverrideOk)) {
+          continue;
+        }
+        found.push({
+          file: other.route.file,
+          message: `Route ${shared.join("/")} ${path} is defined by BOTH ${one.route.pkg} and ${other.route.pkg} \u2014 the loader silently last-wins. Rename one, or annotate the deliberate override with // ${options.routeOverrideOk}(<reason>).`,
+          scanner: "R5.3"
+        });
+      }
+    }
+  }
+  return found;
+};
+var subscriberIds = (files) => files.filter(
+  (one) => one.kind === "subscriber" && /export\s+const\s+config\s*[:=]/.test(one.code) && !/subscriberId\s*:/.test(one.code)
+).map((one) => ({
+  file: one.file,
+  message: "Subscriber has no explicit config.context.subscriberId \u2014 Medusa infers ids from function/file names, which collide silently across a plugin fleet.",
+  scanner: "R5.4"
+}));
+var namedWhen = (sources) => sources.flatMap((source) => {
+  const code = source.code;
+  return matchesOf(code, /\bwhen\s*\(\s*([^)]?)/g).filter((match) => !["'", '"', "`"].includes(match[1] ?? "")).map((match) => ({
+    file: source.file,
+    line: lineAt(code, match.index),
+    message: "when() without a name derives a nondeterministic when-then-{ulid} step name \u2014 checkpoint identity drifts across processes and releases. Use when('stable-name', values, condition).",
+    scanner: "R5.5"
+  }));
+});
+var mutatingStepsCompensation = (sources, options) => sources.flatMap(
+  (source) => mutatingSteps(source, options).filter((step) => {
+    const config = configObject(step.firstArg);
+    if (config !== null && /noCompensation\s*:\s*true/.test(config)) return false;
+    return countTopLevelArgs(step.call) < 3;
+  }).map((step) => ({
+    file: source.file,
+    line: lineAt(source.source, step.at),
+    message: `Mutating step '${nameIn(step.firstArg)}' has neither a compensation function nor noCompensation: true \u2014 every write is revertable or honestly flagged.`,
+    scanner: "R5.6"
+  }))
+);
+var groupBy = (items, key) => {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const at = key(item);
+    grouped.set(at, [...grouped.get(at) ?? [], item]);
+  }
+  return grouped;
+};
+var CHECKS = [
+  { id: "R3.7", label: "serviceName", run: (collected) => serviceNameUnique(collected.modules) },
+  { id: "R3.8", label: "routes", run: (collected) => routeNamespacing(collected.routes) },
+  {
+    id: "#15442",
+    label: "loader-index",
+    run: (collected, options) => loaderIndexSideEffects(collected.loaderFiles, options)
+  },
+  {
+    id: "R4.3",
+    label: "query-step",
+    run: (collected, options) => duplicateQueryStep(collected.workflows, options)
+  },
+  {
+    id: "R5.1",
+    label: "route-mutations",
+    run: (collected, options) => routeMutationsViaWorkflows(collected.routes, options)
+  },
+  {
+    id: "R5.2",
+    label: "step-retry",
+    run: (collected, options) => mutatingStepsDeclareRetry(collected.workflows, options)
+  },
+  {
+    id: "R5.3",
+    label: "route-shadow",
+    run: (collected, options) => routeShadowing(collected.routes, options)
+  },
+  {
+    id: "R5.4",
+    label: "subscriber-ids",
+    run: (collected) => subscriberIds(collected.loaderFiles)
+  },
+  { id: "R5.5", label: "named-when", run: (collected) => namedWhen(collected.workflows) },
+  {
+    id: "R5.6",
+    label: "compensation-or-flag",
+    run: (collected, options) => mutatingStepsCompensation(collected.workflows, options)
+  }
+];
+
+// src/packs/medusa/collect.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { basename as basename2, relative as relative2 } from "path";
+var KIND_DIRS = {
+  jobs: "job",
+  subscribers: "subscriber",
+  workflows: "workflow"
+};
+var slashes2 = (path) => path.replaceAll("\\", "/");
+var isTest = (path) => /\.(?:spec|test)\.[cm]?[jt]sx?$/.test(path);
+var isSource = (path) => /\.[cm]?[jt]s$/.test(path) && !path.endsWith(".d.ts");
+var under = (rel, roots) => roots.some((root) => root === "." || root === "" || rel === root || rel.startsWith(`${root}/`));
+var segments = (rel) => rel.split("/");
+var hasSegment = (rel, name) => segments(rel).includes(name);
+var deriveRoutePath = (apiRelative) => {
+  const derived = slashes2(apiRelative).replace(/route\.[cm]?[jt]s$/, "").split("/").filter(Boolean).map((one) => one.startsWith("[") ? `:${one.slice(1, -1)}` : one);
+  return `/${derived.join("/")}`;
+};
+var packageOf = (rel, rules) => {
+  for (const rule of rules) {
+    const prefix = `${rule.under}/`;
+    if (!rel.startsWith(prefix)) continue;
+    const dir = rel.slice(prefix.length).split("/")[0];
+    if (dir === void 0 || dir === "") continue;
+    return { name: rule.name.replaceAll("{dir}", dir), namespaced: rule.namespaced === true };
+  }
+  return { name: rel, namespaced: false };
+};
+var read = (file) => {
+  try {
+    return readFileSync2(file, "utf8");
+  } catch {
+    return null;
+  }
+};
+var loaderKindOf = (rel) => {
+  const parts = rel.split("/");
+  for (let at = parts.length - 2; at >= 0; at--) {
+    const kind = KIND_DIRS[parts[at]];
+    if (kind !== void 0) return kind;
+  }
+  return void 0;
+};
+var collect = (root, files, options) => {
+  const collected = { loaderFiles: [], modules: [], routes: [], workflows: [] };
+  const declaresWork = new RegExp(
+    `\\b(?:${[...options.workflowFactories, ...options.stepFactories].join("|")})\\s*\\(`
+  );
+  for (const file of files) {
+    const rel = slashes2(relative2(root, file));
+    if (isTest(rel) || !isSource(rel)) continue;
+    const name = basename2(rel);
+    let cached;
+    const contents = () => {
+      if (cached === void 0) {
+        const source = read(file);
+        cached = source === null ? null : { code: withoutComments2(source), source };
+      }
+      return cached;
+    };
+    if ((name === "index.ts" || name === "index.js") && hasSegment(rel, "modules") && !hasSegment(rel, "models") && under(rel, options.moduleRoots)) {
+      const text2 = contents();
+      const serviceName = text2 === null ? null : serviceNameIn(text2.code);
+      if (serviceName !== null) collected.modules.push({ file, rel, serviceName });
+    }
+    if ((name === "route.ts" || name === "route.js") && hasSegment(rel, "api") && under(rel, options.sourceRoots)) {
+      const text2 = contents();
+      if (text2 !== null) {
+        const parts = segments(rel);
+        const owner = packageOf(rel, options.packages);
+        collected.routes.push({
+          code: text2.code,
+          file,
+          namespaced: owner.namespaced,
+          pkg: owner.name,
+          rel,
+          routePath: deriveRoutePath(parts.slice(parts.lastIndexOf("api") + 1).join("/")),
+          source: text2.source
+        });
+      }
+    }
+    const kind = loaderKindOf(rel);
+    if (kind !== void 0 && under(rel, options.sourceRoots)) {
+      const text2 = contents();
+      if (text2 !== null) {
+        collected.loaderFiles.push({ code: text2.code, file, kind, source: text2.source });
+      }
+    }
+    if (hasSegment(rel, "workflows") && under(rel, options.workflowRoots)) {
+      const text2 = contents();
+      if (text2 !== null && declaresWork.test(text2.code)) {
+        collected.workflows.push({ code: text2.code, file, source: text2.source });
+      }
+    }
+  }
+  return collected;
+};
+var serviceNameIn = (source) => {
+  const call = /\bModule\s*\(\s*([A-Za-z_$][\w$]*)\s*,/.exec(source);
+  if (call === null) return null;
+  const ident = call[1];
+  const literal = new RegExp(`\\b${ident}\\s*=\\s*['"\`]([^'"\`]+)['"\`]`).exec(source);
+  return literal === null ? null : literal[1];
+};
+
+// src/packs/medusa/options.ts
+var EVERYWHERE = ["."];
+var LOADER_KINDS_STILL_SKIPPED = ["subscriber", "job"];
+var KNOWN_KINDS = /* @__PURE__ */ new Set(["job", "subscriber", "workflow"]);
+var strings2 = (options, key, fallback) => {
+  const value = options[key];
+  if (value === void 0) return fallback;
+  if (!Array.isArray(value) || value.some((one) => typeof one !== "string")) {
+    throw new TypeError(`verify-arch: medusa option \`${key}\` must be a list of strings.`);
+  }
+  return value;
+};
+var text = (options, key, fallback) => {
+  const value = options[key];
+  if (value === void 0) return fallback;
+  if (typeof value !== "string") {
+    throw new TypeError(`verify-arch: medusa option \`${key}\` must be a string.`);
+  }
+  return value;
+};
+var packageRules = (options) => {
+  const value = options.packages;
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    throw new TypeError("verify-arch: medusa option `packages` must be a list.");
+  }
+  return value.map((one) => {
+    const rule = one;
+    if (typeof rule.under !== "string" || typeof rule.name !== "string") {
+      throw new TypeError(
+        "verify-arch: every `packages` entry needs `under` (a directory) and `name` (a template using {dir})."
+      );
+    }
+    return { name: rule.name, namespaced: rule.namespaced === true, under: rule.under };
+  });
+};
+var kinds = (options) => {
+  const named = strings2(options, "kinds", LOADER_KINDS_STILL_SKIPPED);
+  const unknown = named.filter((one) => !KNOWN_KINDS.has(one));
+  if (unknown.length > 0) {
+    throw new TypeError(
+      `verify-arch: medusa option \`kinds\` names ${unknown.join(", ")}; the loader kinds are workflow, subscriber, job.`
+    );
+  }
+  return named;
+};
+var readOptions2 = (options) => {
+  const sourceRoots = strings2(options, "sourceRoots", EVERYWHERE);
+  return {
+    checks: options.checks === void 0 ? void 0 : strings2(options, "checks", []),
+    ignoreDirs: strings2(options, "ignoreDirs", DEFAULT_IGNORED),
+    inlineMutationOk: text(options, "inlineMutationOk", "arch:inline-mutation-ok"),
+    kinds: kinds(options),
+    moduleRoots: strings2(options, "moduleRoots", sourceRoots),
+    // The CRUD names `MedusaService` generates. A framework fact, so a default rather than a blank.
+    mutationPrefixes: strings2(options, "mutationPrefixes", [
+      "create",
+      "update",
+      "upsert",
+      "delete",
+      "softDelete",
+      "restore"
+    ]),
+    packages: packageRules(options),
+    queryStepCalls: strings2(options, "queryStepCalls", ["useQueryGraphStep", "useRemoteQueryStep"]),
+    // `...RETRY_DB` is one repo's constant; `maxRetries:` is the framework's key and is always read.
+    retrySpreads: strings2(options, "retrySpreads", []),
+    routeOverrideOk: text(options, "routeOverrideOk", "arch:route-override-ok"),
+    sourceRoots,
+    stepFactories: strings2(options, "stepFactories", ["createStep"]),
+    workflowFactories: strings2(options, "workflowFactories", ["createWorkflow"]),
+    workflowRoots: strings2(options, "workflowRoots", sourceRoots)
+  };
+};
+
+// src/packs/medusa/index.ts
+var selected = (options) => {
+  const asked = readOptions2(options).checks;
+  if (asked === void 0) return CHECKS;
+  const known = new Set(CHECKS.map((one) => one.id));
+  const unknown = asked.filter((id) => !known.has(id));
+  if (unknown.length > 0) {
+    throw new VerifyArchError(
+      `verify-arch: the medusa pack has no check named ${unknown.join(", ")}. It runs ${[...known].join(", ")}.`
+    );
+  }
+  return CHECKS.filter((one) => asked.includes(one.id));
+};
+var medusa = {
+  checks: (options) => selected(options).map(({ id, label }) => ({ id, label })),
+  id: "medusa",
+  scan: ({ files, options, root }) => {
+    const read2 = readOptions2(options);
+    const collected = collect(root, files, read2);
+    return selected(options).flatMap((check) => check.run(collected, read2));
+  }
+};
+
+// src/packs/index.ts
+var PACKS = {
+  "composition-tree": compositionTree,
+  medusa
+};
+var PACK_NAMES = Object.keys(PACKS).toSorted();
+
+// src/config.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+var CONFIG_FILE = "geonosis.verify-arch.json";
+var DEFAULT_LABEL = "verify-arch";
+var packOf = (entry, at) => {
+  const named = entry;
+  if (typeof named?.pack !== "string") {
+    throw new VerifyArchError(`${CONFIG_FILE}: packs[${at}] has no \`pack\` name.`);
+  }
+  if (PACKS[named.pack] === void 0) {
+    throw new VerifyArchError(
+      `${CONFIG_FILE}: no pack named "${named.pack}". This build ships ${PACK_NAMES.join(", ")}.`
+    );
+  }
+  return { options: named.options ?? {}, pack: named.pack };
+};
+var readConfig = (root) => {
+  const path = join3(root, CONFIG_FILE);
+  if (!existsSync2(path)) {
+    throw new VerifyArchError(
+      `${CONFIG_FILE} not found in ${root}. Write one naming the packs this repo runs \u2014 a scanner with no packs would report PASS having looked at nothing.`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync3(path, "utf8"));
+  } catch (error) {
+    throw new VerifyArchError(`${CONFIG_FILE} is not valid JSON: ${error.message}`);
+  }
+  const config = parsed;
+  if (!Array.isArray(config.packs) || config.packs.length === 0) {
+    throw new VerifyArchError(`${CONFIG_FILE}: \`packs\` must name at least one pack to run.`);
+  }
+  return {
+    label: typeof config.label === "string" && config.label !== "" ? config.label : DEFAULT_LABEL,
+    packs: config.packs.map(packOf)
+  };
+};
+
+// src/report.ts
+import { relative as relative3 } from "path";
+var MARK = "\u2717";
+var shortPath = (root, file) => relative3(root, file).replaceAll("\\", "/") || file;
+var formatHuman = ({
+  checks,
+  label,
+  root,
+  violations
+}) => {
+  if (violations.length === 0) {
+    const ran = checks.map((check) => `${check.id} ${check.label}`).join(", ");
+    return `${label} \u2014 PASS (${ran})
+`;
+  }
+  const detail = violations.map((one) => `${MARK} [${one.scanner}] ${shortPath(root, one.file)}
+    ${one.message}
+`).join("\n");
+  return `${label} \u2014 FAIL: ${violations.length} violation(s)
+
+${detail}`;
+};
+var formatRatchet = ({
+  root,
+  violations
+}) => violations.map((one) => {
+  const at = one.line === void 0 ? "" : `:${one.line}`;
+  const said = one.message.replaceAll(/\s+/g, " ").trim();
+  return `${MARK} ${shortPath(root, one.file)}${at} ${one.scanner} ${said}
+`;
+}).join("");
+
+// src/run.ts
+var runPacks = (root, packs) => {
+  const files = walkFiles(root);
+  const checks = [];
+  const violations = [];
+  for (const configured of packs) {
+    const pack = PACKS[configured.pack];
+    if (pack === void 0) {
+      throw new VerifyArchError(
+        `No pack named "${configured.pack}". This build ships ${PACK_NAMES.join(", ")}.`
+      );
+    }
+    const options = configured.options ?? {};
+    checks.push(...pack.checks(options));
+    violations.push(...pack.scan({ files, options, root }));
+  }
+  return { checks, violations };
+};
+
+export {
+  compositionTree,
+  VerifyArchError,
+  DEFAULT_IGNORED,
+  walkFiles,
+  medusa,
+  PACKS,
+  PACK_NAMES,
+  CONFIG_FILE,
+  readConfig,
+  formatHuman,
+  formatRatchet,
+  runPacks
+};