Medusa upgrade 2.17.2, security bump, pnpm optimizations, paykit bump & fixes - #516
Conversation
…isting vitest/vite, for medusa-be downgrade vite so it matches medusa-admin requirements, updated pnpm
… image URLs for localhost
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 29 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughThe changes update local Compose orchestration, Herbatika media and category hydration, PayKit Stripe handling, Medusa product and review workflows, plugin contracts, workspace dependencies, and development configuration. ChangesDevelopment runtime and Compose orchestration
Herbatika storefront data and media handling
Medusa payment and product workflows
Workspace dependencies and Medusa tooling
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR upgrades Medusa to 2.17.2, bumps PayKit, and makes several targeted bug fixes across the payment, CMS, seeding, and review-request flows. The lockfile churn is expected given the version bumps.
Confidence Score: 5/5Safe to merge — all functional paths have direct unit-test coverage and the behavioural changes are intentional and well-scoped. The payment, seeding, and review-URL changes are each covered by new or updated unit tests. The CMS media URL simplification removes an incorrect Medusa-backend fallback in exchange for a clean contract; the only risk is an unconfigured env var silently producing broken images rather than a startup error, which the updated .env.docker template mitigates. apps/herbatika/src/lib/storefront/cms-client.ts — the silent pass-through when NEXT_PUBLIC_PAYLOAD_BASE_URL is absent should be validated in every deployment environment that serves Payload rich-text content. Important Files Changed
Reviews (7): Last reviewed commit: "fix(medusa): lint" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.github.com/in/867647?s=60&v=4){kind=small}
Storybook A11y Report
Light
No changes detected against baseline. By group
New violations (0)No new violations. Resolved violations (0)No resolved violations. Dark
No changes detected against baseline. By group
New violations (0)No new violations. Resolved violations (0)No resolved violations. |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/herbatika/src/app/layout.tsx`:
- Around line 96-104: Make the category prefetch in the root layout best-effort
by handling failures from fetchServerCategories without rejecting layout
rendering. Wrap the fetchServerCategories call after getRegionServerContext in
localized error handling, allowing the layout and routes to continue so
client-side category loading can recover.
In `@apps/medusa-be/src/modules/payment-paykit/services/stripe.ts`:
- Around line 255-267: Update toPaykitPaymentFromStripeCheckoutSession’s
requires_action condition to also return true when paymentIntentStatus is
"requires_payment_method", while preserving the existing requires_action,
requires_confirmation, and open-session checks.
In `@apps/medusa-be/src/workflows/seed/steps/create-products.ts`:
- Around line 1417-1427: Replace the per-product loop around
batchProductsWorkflow with bounded chunks of updateProducts, invoking the
workflow once per chunk with that slice as update. Preserve collecting every
item from each updateResult.result.updated into updatedIds, and use the existing
batching convention or a small fixed chunk size to keep operation size bounded.
In
`@apps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.ts`:
- Line 336: Update the product update payload mapping around category_ids to
preserve an empty array instead of converting it to undefined, ensuring an
explicit empty categories input removes all associations. Mirror the seed
payload’s direct array mapping behavior while keeping non-empty category IDs
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9cc600f3-d545-47b2-8813-df1673779a0e
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (38)
.env.docker.gitignore.mise.tomlapps/frontend-demo/package.jsonapps/frontend-demo/src/types/generated-assets.d.tsapps/herbatika/next.config.tsapps/herbatika/package.jsonapps/herbatika/src/app/layout.tsxapps/herbatika/src/lib/storefront/cms-client.tsapps/herbatika/src/lib/storefront/runtime-env.tsapps/medusa-be/package.jsonapps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/config/project.tsapps/medusa-be/src/links/quote-links.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-order-dashboard-plugin/package.jsonapps/medusa-symmy-plugin/package.jsonapps/medusa-symmy-plugin/src/api/api/symmy/v1/auth/user/emailpass/route.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client.tsapps/n1/package.jsonapps/new-engine-ctl/package.jsonapps/payload/package.jsonapps/zane-operator/package.jsondocker-compose.dev-user.yamldocker-compose.yamldocker/development/pnpm/Dockerfilelibs/storefront-data/package.jsonlibs/storefront-data/tsconfig.build.tsbuildinfopackage.jsonpatches/medusa-plugin-content@0.2.0.patchpnpm-workspace.yamlscripts/dev/mise-dev-helpers.shscripts/dev/run-compose.sh
💤 Files with no reviewable changes (5)
- apps/medusa-be/src/config/project.ts
- docker-compose.yaml
- patches/medusa-plugin-content@0.2.0.patch
- .env.docker
- apps/medusa-symmy-plugin/src/api/api/symmy/v1/auth/user/emailpass/route.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: storybook-a11y / storybook-a11y
- GitHub Check: Greptile Review
- GitHub Check: main
⚠️ CI failures not shown inline (1)
GitHub Check: Kilo Code Review: Kilo Code Review failed
Conclusion: failure
Review failed: The message could not be delivered
🧰 Additional context used
📓 Path-based instructions (32)
apps/medusa-be/src/api/**/*
📄 CodeRabbit inference engine (CLAUDE.md)
Place custom Medusa backend API endpoints under apps/medusa-be/src/api
Files:
apps/medusa-be/src/api/admin/products/route.ts
apps/medusa-be/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
apps/medusa-be/**/*.{ts,tsx}: Use TypeScript for type checking - runnpx tsc --noEmitfor validation
Forbidden: Non-null assertions (!) - always use type guards and validation instead
Annotate generic field access with explicitunknowntype before type guards -const v: unknown = result[field]
Don't useas Typewithout validation - always validate before casting
UseModules.*andContainerRegistrationKeys.*constants instead of hardcoding strings
Batch operations with CHUNK_SIZE to avoid unbounded operations
Extract pure functions to separate files for testability without runtime dependencies
Files:
apps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/links/quote-links.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/medusa-be/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
apps/medusa-be/**/*.{ts,tsx,js,jsx}: Use Biome linter with ultracite preset - runbunx biome check --write .and always use braces in conditionals
Comments should explain 'why', never 'what' - use self-documenting code via clear naming
Always use const per declaration -const a = 1; const b = 2is correct, one variable per line
Use nullish coalescing (??) operator instead of logical OR (||) for default values
Files:
apps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/links/quote-links.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/medusa-be/src/{api,jobs}/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
Use Query service for data retrieval - access via
container.resolve<Query>(ContainerRegistrationKeys.QUERY)and usequery.graph()
Files:
apps/medusa-be/src/api/admin/products/route.ts
apps/medusa-be/src/api/admin/**/*.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
Admin routes are auto-protected - no auth middleware needed for admin endpoints
Files:
apps/medusa-be/src/api/admin/products/route.ts
apps/medusa-be/src/api/**/*.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
apps/medusa-be/src/api/**/*.ts: Colocate validators.ts, middlewares.ts, and route.ts together - export route middlewares asMiddlewareRoute[]array
Route handlers should access validated request data viareq.validatedBody- it is type-safe and pre-validated
Files:
apps/medusa-be/src/api/admin/products/route.ts
apps/medusa-be/src/{api,modules}/**/*.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
Use MedusaError with proper error types - INVALID_DATA(400), NOT_FOUND(404), UNAUTHORIZED(401), NOT_ALLOWED(400), DUPLICATE_ERROR(422), CONFLICT(409)
Files:
apps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/medusa-be/src/{modules,api}/**/*.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
Provider ID format in DB:
{identifier}_{id}(e.g.,my_shipping_default), in container:fp_{identifier}_{id}
Files:
apps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Import UI components using the
@techsio/ui-kitnamespace, not@libs/ui, for runtime apps
Files:
apps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/links/quote-links.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/herbatika/src/lib/storefront/runtime-env.tsapps/frontend-demo/src/types/generated-assets.d.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client.tsapps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsxapps/herbatika/src/lib/storefront/cms-client.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Run Biome linting and formatting only on changed files using 'bunx biome check --write path/to/file'
Files:
apps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/links/quote-links.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/herbatika/src/lib/storefront/runtime-env.tsapps/frontend-demo/src/types/generated-assets.d.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client.tsapps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsxapps/herbatika/src/lib/storefront/cms-client.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.ts
apps/medusa-be/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Medusa backend custom logic should be organized in api/, modules/, workflows/, admin/, subscribers/, and jobs/ directories under apps/medusa-be/src/
Files:
apps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/links/quote-links.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/**/!(medusa-be)/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use modern React patterns and React 19 for frontend applications in the monorepo
Files:
apps/medusa-be/src/api/admin/products/route.tsapps/medusa-be/src/links/quote-links.tsapps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/herbatika/src/lib/storefront/runtime-env.tsapps/frontend-demo/src/types/generated-assets.d.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client.tsapps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsxapps/herbatika/src/lib/storefront/cms-client.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.ts
**/package.json
📄 CodeRabbit inference engine (CLAUDE.md)
Use pnpm CLI to add dependencies; never edit package.json directly
Files:
apps/n1/package.jsonapps/frontend-demo/package.jsonpackage.jsonapps/zane-operator/package.jsonapps/herbatika/package.jsonapps/new-engine-ctl/package.jsonlibs/storefront-data/package.jsonapps/medusa-order-dashboard-plugin/package.jsonapps/medusa-symmy-plugin/package.jsonapps/payload/package.jsonapps/medusa-be/package.json
apps/n1/**/package.json
📄 CodeRabbit inference engine (apps/n1/CLAUDE.md)
Do NOT manually edit
package.json- usepnpm add <pkg>orpnpm add -D <pkg>commands instead
Files:
apps/n1/package.json
apps/medusa-be/src/links/*.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
Use
defineLinkfor module relationships with filterable/cascade options - always define linkables explicitly
Files:
apps/medusa-be/src/links/quote-links.ts
apps/herbatika/**
📄 CodeRabbit inference engine (AGENTS.md)
apps/herbatika/**: Read apps/herbatika/AGENTS.md before editing Herbatika app and follow its specific configuration which overrides root assumptions
Herbatika app runs on http://localhost:3001 and routes work through libs/ui/skills and libs/storefront-data/skills workflows
Files:
apps/herbatika/package.jsonapps/herbatika/src/lib/storefront/runtime-env.tsapps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsxapps/herbatika/src/lib/storefront/cms-client.ts
apps/medusa-be/src/modules/**/*
📄 CodeRabbit inference engine (CLAUDE.md)
Place custom Medusa modules under apps/medusa-be/src/modules
Files:
apps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/medusa-be/src/modules/**/*.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
apps/medusa-be/src/modules/**/*.ts: Module directories use hyphens (my-module/), module keys use underscores (my_module), and export module key as constant
Loaders cannot resolve cross-module dependencies - use__hooks.onApplicationStartfor deferred initialization instead
Files:
apps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/runtime.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/medusa-be/src/modules/**/__tests__/*.spec.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
apps/medusa-be/src/modules/**/__tests__/*.spec.ts: Module integration tests: UsemoduleIntegrationTestRunner()when mocking inherited MedusaService methods - test against real DB
Module integration tests: Inject mocked dependencies viainjectedDependencies- usevi.fn()for Caching, Locking modules
Files:
apps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts
**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Vitest for running tests in backend and UI library projects
Files:
apps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts
apps/herbatika/src/**
📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md)
apps/herbatika/src/**: Put Herbatika visual differences in src/styles/tokens/**; avoid JSX className overrides that duplicate UI-kit component props/tokens.
Use kebab-case for file names and PascalCase for React component names in Herbatika.
Files:
apps/herbatika/src/lib/storefront/runtime-env.tsapps/herbatika/src/app/layout.tsxapps/herbatika/src/lib/storefront/cms-client.ts
apps/herbatika/src/lib/storefront/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md)
In Herbatika storefront composition, prefer the preset surface from
@techsio/storefront-data: shared hooks, flows, query keys, query options, cache policy, and SSR helpers.
Files:
apps/herbatika/src/lib/storefront/runtime-env.tsapps/herbatika/src/lib/storefront/cms-client.ts
apps/herbatika/src/lib/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md)
Keep app-local storefront code thin: SDK instance, field defaults, localized text, toasts, analytics, form DTOs, address adapters, and Herbatika-specific read models can stay in app code. Move repeated backend communication, query key construction, cache sync, and mutation invalidation into libs/storefront-data.
Files:
apps/herbatika/src/lib/storefront/runtime-env.tsapps/herbatika/src/lib/storefront/cms-client.ts
apps/herbatika/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md)
apps/herbatika/src/**/*.{ts,tsx}: Use explicit package subpath imports from@techsio/storefront-data. Do not import from package roots or dist/.
Keep server-only and client-only boundaries explicit in Herbatika app code; use 'server-only' and 'getServerQueryClient' for Server Component/SSR data paths.
Files:
apps/herbatika/src/lib/storefront/runtime-env.tsapps/herbatika/src/app/layout.tsxapps/herbatika/src/lib/storefront/cms-client.ts
apps/herbatika/src/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md)
Keep source files at a soft limit of ~200 lines; exceeding this should trigger refactor consideration.
Files:
apps/herbatika/src/lib/storefront/runtime-env.tsapps/herbatika/src/app/layout.tsxapps/herbatika/src/lib/storefront/cms-client.ts
apps/herbatika/src/**/*.{jsx,tsx}
📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md)
apps/herbatika/src/**/*.{jsx,tsx}: Use internal UI primitives/components from@techsio/ui-kitinstead of native controls in app code. Avoid raw , , , <textarea>, , inline SVG icons. For Next.js links/images, prefer the UI-kit component with next/link or next/image adapter support when that component exposes it. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/**/*.{jsx,tsx,css} 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) Use token-based utility classes instead of raw Tailwind palette/spacing values. Prefer tokenized classes like p-200, mt-300, gap-150, text-success, bg-danger over raw Tailwind values like p-4, mt-8, bg-red-600. Files: apps/herbatika/src/app/layout.tsx libs/** 📄 CodeRabbit inference engine (AGENTS.md) Use RSLib for building libraries in the monorepo Files: libs/storefront-data/package.json apps/medusa-order-dashboard-plugin/{src,package.json,medusa-config.ts} 📄 CodeRabbit inference engine (apps/medusa-order-dashboard-plugin/AGENTS.md) Plugin must export Admin customizations through the package ./admin export generated by medusa plugin:build Files: apps/medusa-order-dashboard-plugin/package.json apps/medusa-order-dashboard-plugin/{package.json,src/admin/**/*.{ts,tsx}} 📄 CodeRabbit inference engine (apps/medusa-order-dashboard-plugin/AGENTS.md) TanStack Table or VTable may be introduced only after documenting why Medusa UI primitives cannot support the required table behavior without fragile code, and must be added through package-manager commands with plugin build verification Files: apps/medusa-order-dashboard-plugin/package.json apps/payload/**/package.json 📄 CodeRabbit inference engine (apps/payload/.cursor/rules/components.md) Pin all @payloadcms/* packages to the exact same version to avoid dependency version mismatch errors with hooks like useConfig Files: apps/payload/package.json apps/medusa-be/src/workflows/**/* 📄 CodeRabbit inference engine (CLAUDE.md) Place business logic workflows under apps/medusa-be/src/workflows Files: apps/medusa-be/src/workflows/seed/steps/create-products.ts 🧠 Learnings (8) 📚 Learning: 2026-02-05T14:43:17.404Z Learnt from: KaiUweCZE Repo: NMIT-WR/new-engine PR: 324 File: apps/medusa-be/package.json:0-0 Timestamp: 2026-02-05T14:43:17.404Z Learning: Validate and enforce React 19 compatibility across monorepo workspaces. Since Medusa UI supports React 19 via root package.json overrides and Medusa Cloud prerequisites show React 19 overrides for npm workspaces, ensure workspace root and all relevant package.json files align with React 19 (18+ requirement is satisfied). When reviewing, verify that overrides exist in the root package.json and that dependent packages in apps or packages directories declare React 19 (or compatible) in their peerDependencies or dependencies as appropriate for workspace usage. Applied to files: apps/n1/package.json apps/frontend-demo/package.json package.json apps/zane-operator/package.json apps/herbatika/package.json apps/new-engine-ctl/package.json libs/storefront-data/package.json apps/medusa-order-dashboard-plugin/package.json apps/medusa-symmy-plugin/package.json apps/payload/package.json apps/medusa-be/package.json 📚 Learning: 2026-05-07T19:05:58.339Z Learnt from: redeyecz Repo: TechsioCZ/new-engine PR: 390 File: apps/medusa-be/package.json:78-81 Timestamp: 2026-05-07T19:05:58.339Z Learning: When reviewing changes to `package.json`, do not automatically flag dependency additions/removals as "manually edited" or as "bypassing the pnpm lockfile" just because the `package.json` diff shows only that file changed. First verify whether `pnpm-lock.yaml` is missing the corresponding entries. Since `pnpm add` updates both `package.json` and `pnpm-lock.yaml` together, legitimate changes can appear in the `package.json` diff while still being properly tracked in the lockfile. Applied to files: apps/n1/package.json apps/frontend-demo/package.json package.json apps/zane-operator/package.json apps/herbatika/package.json apps/new-engine-ctl/package.json libs/storefront-data/package.json apps/medusa-order-dashboard-plugin/package.json apps/medusa-symmy-plugin/package.json apps/payload/package.json apps/medusa-be/package.json 📚 Learning: 2026-05-20T15:58:53.048Z Learnt from: redeyecz Repo: TechsioCZ/new-engine PR: 413 File: apps/medusa-be/package.json:77-80 Timestamp: 2026-05-20T15:58:53.048Z Learning: When reviewing monorepo `package.json` files, treat any dependencies/devDependencies using the `paykit-sdk/*` scope (e.g., `paykit-sdk/core`, `paykit-sdk/stripe`, `paykit-sdk/comgate`, `paykit-sdk/gopay`) as coming from the TechsioCZ/new-engine private npm registry. Do not flag dependency version constraints (e.g., `^1.2.0`) as invalid merely because those packages/versions are not found on the public npm registry. Public-web/private-web availability checks against the public npm API are not applicable for these packages; if validation is needed, rely on the private registry/CI install behavior instead. Applied to files: apps/n1/package.json apps/frontend-demo/package.json apps/zane-operator/package.json apps/herbatika/package.json apps/new-engine-ctl/package.json apps/medusa-order-dashboard-plugin/package.json apps/medusa-symmy-plugin/package.json apps/payload/package.json apps/medusa-be/package.json 📚 Learning: 2026-05-07T22:45:20.745Z Learnt from: BleedingDev Repo: TechsioCZ/new-engine PR: 397 File: docker/development/medusa-be/Dockerfile:34-38 Timestamp: 2026-05-07T22:45:20.745Z Learning: For pnpm-based monorepo Dockerfiles that run `pnpm fetch --frozen-lockfile`, ensure the `patches/` directory is copied into the image (e.g., `COPY patches ./patches`) before running `pnpm fetch`. pnpm’s `fetch` reads `patchedDependencies` from the lockfile/workspace configuration and will fail (e.g., `ERR_PNPM_PATCH_NOT_FOUND`) if patch files aren’t present yet—do not move the `COPY patches` step to after `pnpm fetch`. Applied to files: docker/development/pnpm/Dockerfile 📚 Learning: 2026-05-07T22:45:38.566Z Learnt from: BleedingDev Repo: TechsioCZ/new-engine PR: 397 File: docker/development/n1/Dockerfile:40-44 Timestamp: 2026-05-07T22:45:38.566Z Learning: When building this repo in Docker, ensure the `patches/` directory is copied into the image (e.g., `COPY patches ./patches`) before running `pnpm fetch --frozen-lockfile`. `pnpm fetch` validates `patchedDependencies` patch file paths from `pnpm-workspace.yaml`/`package.json`, and if `./patches` doesn’t exist yet it will fail with `ERR_PNPM_PATCH_NOT_FOUND`. Place the `COPY patches` step before the `RUN pnpm fetch` step in the relevant service Dockerfiles; this ordering is intentional and should not be flagged as an unnecessary cache-busting change. Applied to files: docker/development/pnpm/Dockerfile 📚 Learning: 2026-06-14T17:05:00.817Z Learnt from: KaiUweCZE Repo: TechsioCZ/new-engine PR: 442 File: apps/herbatika/src/components/reviews/product-review-token-page.tsx:36-42 Timestamp: 2026-06-14T17:05:00.817Z Learning: When reviewing code in apps/herbatika that calls `useProducts(input: ProductListInput, options?)`, treat `enabled` provided inside the first argument (`input`) as intentional and valid. The `ProductListInput` type includes an optional `enabled?: boolean` (via `BaseStorefrontProductListInput & { enabled?: boolean }`), and the hook infrastructure strips `enabled` before constructing the HTTP request and query key (following the same `stripListInput` behavior used elsewhere). Therefore, do NOT flag `useProducts({ enabled: ... , ... }, options)` as a contract violation; `enabled` belongs in the input object, not in the `options` argument. Applied to files: apps/herbatika/src/lib/storefront/runtime-env.ts apps/herbatika/src/app/layout.tsx apps/herbatika/src/lib/storefront/cms-client.ts 📚 Learning: 2025-12-16T19:45:17.746Z Learnt from: BleedingDev Repo: NMIT-WR/new-engine PR: 207 File: libs/ui/src/molecules/select.tsx:50-50 Timestamp: 2025-12-16T19:45:17.746Z Learning: When reviewing Tailwind classes in TSX/TS files, prefer using square brackets for arbitrary CSS values and complex expressions. Specifically: - Do not use the parentheses syntax (z-(--z-index)) for anything beyond simple CSS variable references; this syntax auto-wraps in var() and cannot handle calc or complex functions. - Use the square brackets syntax (e.g., h-[calc(var(--available-height)-var(--spacing-content))]) for calc expressions, var with calc, and any complex CSS expressions. This rule applies broadly to Tailwind v4 usage in TSX code across the project. Applied to files: apps/herbatika/src/app/layout.tsx 📚 Learning: 2026-06-16T10:43:29.830Z Learnt from: Luko248 Repo: TechsioCZ/new-engine PR: 454 File: apps/frontend-demo/src/app/layout.tsx:23-23 Timestamp: 2026-06-16T10:43:29.830Z Learning: In Next.js App Router layout files (e.g., src/app/**/layout.tsx), if a synchronous inline theme-initialization script (or equivalent “theme/mode init” logic) is intentionally placed as the *first child inside* <body> (before the rest of the body content/children), do not flag it as a suspicious layout/body placement issue. This placement is correct because App Router layouts can’t freely inject arbitrary elements into <head>, and a synchronous inline script at the top of <body> runs during HTML parsing (before body content renders), preventing a flash of incorrect/unstyled theme. Applied to files: apps/herbatika/src/app/layout.tsx 🔇 Additional comments (35) apps/herbatika/src/lib/storefront/runtime-env.ts (1) 18-20: LGTM! apps/herbatika/src/lib/storefront/cms-client.ts (1) 4-13: LGTM! Also applies to: 79-81, 92-95 apps/herbatika/src/app/layout.tsx (1) 1-18: LGTM! Also applies to: 71-86 apps/herbatika/next.config.ts (1) 4-5: LGTM! Also applies to: 26-37, 69-72 apps/frontend-demo/src/types/generated-assets.d.ts (1) 1-57: LGTM! apps/frontend-demo/package.json (1) 20-21: LGTM! apps/herbatika/package.json (1) 27-28: LGTM! Also applies to: 44-44 pnpm-workspace.yaml (1) 10-31: LGTM! Also applies to: 61-77, 97-123 package.json (1) 31-31: LGTM! Also applies to: 54-54 apps/medusa-be/package.json (1) 64-128: LGTM! Also applies to: 140-141 apps/n1/package.json (1) 26-29: LGTM! apps/new-engine-ctl/package.json (1) 26-27: LGTM! apps/payload/package.json (1) 37-57: LGTM! apps/zane-operator/package.json (1) 18-19: LGTM! libs/storefront-data/package.json (1) 354-355: LGTM! Also applies to: 365-366 apps/medusa-order-dashboard-plugin/package.json (1) 46-53: LGTM! Also applies to: 66-80 apps/medusa-symmy-plugin/package.json (1) 55-81: LGTM! apps/medusa-be/src/api/admin/products/route.ts (1) 28-29: LGTM! apps/medusa-be/src/links/quote-links.ts (1) 1-1: LGTM! scripts/dev/run-compose.sh (1) 1-27: LGTM! docker-compose.dev-user.yaml (2) 5-7: 🩺 Stability & Availability Verify that the HOME override does not hide Playwright’s browser. Setting HOME=/tmp changes homeDirectory in apps/medusa-be/playwright.admin.config.ts (Lines 60–80), so its fallback browser paths become /tmp/.... If Chromium is installed under the image user’s normal home, admin Playwright runs will no longer resolve it. Preserve that home for medusa-be or configure PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, then verify the test flow. 1-4: LGTM! Also applies to: 9-19 scripts/dev/mise-dev-helpers.sh (1) 37-37: LGTM! .mise.toml (2) 94-96: 🎯 Functional Correctness Verify the workspace pnpm version before relying on this task. The pnpm documentation marks pnpm peers check as added in pnpm v11.0.0. Confirm that the repository’s declared packageManager and toolchain resolve pnpm 11 or newer; otherwise this task will fail with an unknown command. (pnpm.io) 23-24: LGTM! Also applies to: 98-100, 116-124, 136-152, 253-258, 273-278, 288-298 .gitignore (1) 37-37: LGTM! docker/development/pnpm/Dockerfile (1) 5-7: LGTM! apps/medusa-be/src/workflows/seed/steps/create-products.ts (1) 17-20: LGTM! Also applies to: 635-635, 647-649 apps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.ts (1) 1-4: LGTM! Also applies to: 218-218, 269-269, 278-278 apps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client.ts (1) 150-157: LGTM! apps/medusa-be/src/modules/payment-paykit/runtime.ts (1) 29-32: LGTM! Also applies to: 190-190 apps/medusa-be/src/modules/payment-paykit/__tests__/runtime.unit.spec.ts (1) 59-59: LGTM! Also applies to: 71-71 apps/medusa-be/src/modules/payment-paykit/services/stripe.ts (2) 54-56: LGTM! Also applies to: 93-93, 165-184, 237-241, 269-314 14-14: 🗄️ Data Integrity & Integration verify the PayKit SDK import before merge. Confirm that @paykit-sdk/core@1.3.3 actually re-exports PAYKIT_METADATA_KEY and omitInternalMetadata; otherwise this import can fail at installation/build time. apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts (1) 133-154: LGTM! Also applies to: 187-237, 279-332
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@apps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.ts`:
- Around line 290-296: Add Vitest regression coverage for the category mapping
logic in the helper containing categoryIdsForUpdate, verifying explicit empty
categories produce [], populated categories replace associations with their IDs,
and omitted categories leave categoryIdsForUpdate undefined. Use the existing
TypeScript test conventions and avoid changing the intended mapping behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 72ff5747-ae4d-48c0-8142-cb33866fb4ac
📒 Files selected for processing (5)
apps/herbatika/src/app/layout.tsxapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: storybook-a11y / storybook-a11y
- GitHub Check: Greptile Review
⚠️ CI failures not shown inline (2)
GitHub Actions: CI / main: Medusa upgrade 2.17.2, security bump, pnpm optimizations, paykit bump & fixes
Conclusion: failure
##[group]✅ > nx run medusa-be:test
> cross-env TEST_TYPE=unit node ./scripts/run-vitest.mjs run --config vitest.config.ts
�[33mThe CJS build of Vite's Node API is deprecated. See https://vite.dev/guide/troubleshooting.html#vite-cjs-node-api-deprecated for more details.�[39m
�[1m�[46m RUN �[49m�[22m �[36mv3.2.7 �[39m�[90m/home/runner/work/new-engine/new-engine/apps/medusa-be�[39m
�[32m✓�[39m tests/unit/src/workflows/customer-group-sync-steps.unit.spec.ts �[2m(�[22m�[2m15 tests�[22m�[2m)�[22m�[33m 309�[2mms�[22m�[39m
�[32m✓�[39m src/modules/payment-paykit/__tests__/stripe.unit.spec.ts �[2m(�[22m�[2m25 tests�[22m�[2m)�[22m�[32m 111�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/modules/order-receipt/service.unit.spec.ts �[2m(�[22m�[2m33 tests�[22m�[2m)�[22m�[33m 348�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/api/admin/orders/[id]/commercial-values/utils.unit.spec.ts �[2m(�[22m�[2m20 tests�[22m�[2m)�[22m�[32m 42�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/herbatica/herbatica-seed.unit.spec.ts �[2m(�[22m�[2m16 tests�[22m�[2m)�[22m�[32m 292�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/modules/payload/service.unit.spec.ts �[2m(�[22m�[2m34 tests�[22m�[2m)�[22m�[32m 148�[2mms�[22m�[39m
�[32m✓�[39m src/modules/payment-paykit/__tests__/base.unit.spec.ts �[2m(�[22m�[2m24 tests�[22m�[2m)�[22m�[32m 96�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/modules/ppl-client/service.unit.spec.ts �[2m(�[22m�[2m19 tests�[22m�[2m)�[22m�[32m 68�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/api/store/product-lists/routes.unit.spec.ts �[2m(�[22m�[2m10 tests�[22m�[2m)�[22m�[33m 3982�[2mms�[22m�[39m
�[33m�[2m✓�[22m�[39m Store product-list routes�[2m > �[22mGET /store/product-lists/:id�[2m > �[22mallows unauthenticated access to public lists �[33m 3741�[2mms�[22m�[39m
�[32m✓�[39m src/api/admin/promotions/__tests__/utils.unit.spec.ts �[2m(�[22m�[2m41 tests�[22m�[2m)�[22m�[32m 56�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/catalog/catalog-products-route.unit.spec.ts �[2m(�[22m�[2m8 tests�[2...
GitHub Actions: CI / 0_main.txt: Medusa upgrade 2.17.2, security bump, pnpm optimizations, paykit bump & fixes
Conclusion: failure
##[group]✅ > nx run medusa-be:test
> cross-env TEST_TYPE=unit node ./scripts/run-vitest.mjs run --config vitest.config.ts
�[33mThe CJS build of Vite's Node API is deprecated. See https://vite.dev/guide/troubleshooting.html#vite-cjs-node-api-deprecated for more details.�[39m
�[1m�[46m RUN �[49m�[22m �[36mv3.2.7 �[39m�[90m/home/runner/work/new-engine/new-engine/apps/medusa-be�[39m
�[32m✓�[39m tests/unit/src/workflows/customer-group-sync-steps.unit.spec.ts �[2m(�[22m�[2m15 tests�[22m�[2m)�[22m�[33m 309�[2mms�[22m�[39m
�[32m✓�[39m src/modules/payment-paykit/__tests__/stripe.unit.spec.ts �[2m(�[22m�[2m25 tests�[22m�[2m)�[22m�[32m 111�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/modules/order-receipt/service.unit.spec.ts �[2m(�[22m�[2m33 tests�[22m�[2m)�[22m�[33m 348�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/api/admin/orders/[id]/commercial-values/utils.unit.spec.ts �[2m(�[22m�[2m20 tests�[22m�[2m)�[22m�[32m 42�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/herbatica/herbatica-seed.unit.spec.ts �[2m(�[22m�[2m16 tests�[22m�[2m)�[22m�[32m 292�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/modules/payload/service.unit.spec.ts �[2m(�[22m�[2m34 tests�[22m�[2m)�[22m�[32m 148�[2mms�[22m�[39m
�[32m✓�[39m src/modules/payment-paykit/__tests__/base.unit.spec.ts �[2m(�[22m�[2m24 tests�[22m�[2m)�[22m�[32m 96�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/modules/ppl-client/service.unit.spec.ts �[2m(�[22m�[2m19 tests�[22m�[2m)�[22m�[32m 68�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/src/api/store/product-lists/routes.unit.spec.ts �[2m(�[22m�[2m10 tests�[22m�[2m)�[22m�[33m 3982�[2mms�[22m�[39m
�[33m�[2m✓�[22m�[39m Store product-list routes�[2m > �[22mGET /store/product-lists/:id�[2m > �[22mallows unauthenticated access to public lists �[33m 3741�[2mms�[22m�[39m
�[32m✓�[39m src/api/admin/promotions/__tests__/utils.unit.spec.ts �[2m(�[22m�[2m41 tests�[22m�[2m)�[22m�[32m 56�[2mms�[22m�[39m
�[32m✓�[39m tests/unit/catalog/catalog-products-route.unit.spec.ts �[2m(�[22m�[2m8 tests�[2...
🧰 Additional context used
📓 Path-based instructions (19)
apps/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Import UI components using the
@techsio/ui-kitnamespace, not@libs/ui, for runtime apps
Files:
apps/herbatika/src/app/layout.tsxapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Run Biome linting and formatting only on changed files using 'bunx biome check --write path/to/file'
Files:
apps/herbatika/src/app/layout.tsxapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/herbatika/**
📄 CodeRabbit inference engine (AGENTS.md)
apps/herbatika/**: Read apps/herbatika/AGENTS.md before editing Herbatika app and follow its specific configuration which overrides root assumptions
Herbatika app runs on http://localhost:3001 and routes work through libs/ui/skills and libs/storefront-data/skills workflows
Files:
apps/herbatika/src/app/layout.tsx
apps/**/!(medusa-be)/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use modern React patterns and React 19 for frontend applications in the monorepo
Files:
apps/herbatika/src/app/layout.tsxapps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.tsapps/medusa-be/src/workflows/seed/steps/create-products.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.tsapps/medusa-be/src/modules/payment-paykit/services/stripe.ts
apps/herbatika/src/**/*.{jsx,tsx}
📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md)
apps/herbatika/src/**/*.{jsx,tsx}: Use internal UI primitives/components from@techsio/ui-kitinstead of native controls in app code. Avoid raw , , , <textarea>, , inline SVG icons. For Next.js links/images, prefer the UI-kit component with next/link or next/image adapter support when that component exposes it. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/**/*.{jsx,tsx,css} 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) Use token-based utility classes instead of raw Tailwind palette/spacing values. Prefer tokenized classes like p-200, mt-300, gap-150, text-success, bg-danger over raw Tailwind values like p-4, mt-8, bg-red-600. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/** 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) apps/herbatika/src/**: Put Herbatika visual differences in src/styles/tokens/**; avoid JSX className overrides that duplicate UI-kit component props/tokens. Use kebab-case for file names and PascalCase for React component names in Herbatika. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/**/*.{ts,tsx} 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) apps/herbatika/src/**/*.{ts,tsx}: Use explicit package subpath imports from @techsio/storefront-data. Do not import from package roots or dist/. Keep server-only and client-only boundaries explicit in Herbatika app code; use 'server-only' and 'getServerQueryClient' for Server Component/SSR data paths. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/**/*.{ts,tsx,js,jsx} 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) Keep source files at a soft limit of ~200 lines; exceeding this should trigger refactor consideration. Files: apps/herbatika/src/app/layout.tsx apps/medusa-be/src/modules/**/* 📄 CodeRabbit inference engine (CLAUDE.md) Place custom Medusa modules under apps/medusa-be/src/modules Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts apps/medusa-be/src/modules/payment-paykit/services/stripe.ts apps/medusa-be/**/*.{ts,tsx} 📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md) apps/medusa-be/**/*.{ts,tsx}: Use TypeScript for type checking - run npx tsc --noEmit for validation Forbidden: Non-null assertions (!) - always use type guards and validation instead Annotate generic field access with explicit unknown type before type guards - const v: unknown = result[field] Don't use as Type without validation - always validate before casting Use Modules.* and ContainerRegistrationKeys.* constants instead of hardcoding strings Batch operations with CHUNK_SIZE to avoid unbounded operations Extract pure functions to separate files for testability without runtime dependencies Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts apps/medusa-be/src/workflows/seed/steps/create-products.ts apps/medusa-be/src/modules/payment-paykit/services/stripe.ts apps/medusa-be/**/*.{ts,tsx,js,jsx} 📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md) apps/medusa-be/**/*.{ts,tsx,js,jsx}: Use Biome linter with ultracite preset - run bunx biome check --write . and always use braces in conditionals Comments should explain 'why', never 'what' - use self-documenting code via clear naming Always use const per declaration - const a = 1; const b = 2 is correct, one variable per line Use nullish coalescing (??) operator instead of logical OR (||) for default values Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts apps/medusa-be/src/workflows/seed/steps/create-products.ts apps/medusa-be/src/modules/payment-paykit/services/stripe.ts apps/medusa-be/src/modules/**/*.ts 📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md) apps/medusa-be/src/modules/**/*.ts: Module directories use hyphens (my-module/), module keys use underscores (my_module), and export module key as constant Loaders cannot resolve cross-module dependencies - use __hooks.onApplicationStart for deferred initialization instead Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts apps/medusa-be/src/modules/payment-paykit/services/stripe.ts apps/medusa-be/src/{api,modules}/**/*.ts 📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md) Use MedusaError with proper error types - INVALID_DATA(400), NOT_FOUND(404), UNAUTHORIZED(401), NOT_ALLOWED(400), DUPLICATE_ERROR(422), CONFLICT(409) Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts apps/medusa-be/src/modules/payment-paykit/services/stripe.ts apps/medusa-be/src/{modules,api}/**/*.ts 📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md) Provider ID format in DB: {identifier}_{id} (e.g., my_shipping_default), in container: fp_{identifier}_{id} Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts apps/medusa-be/src/modules/payment-paykit/services/stripe.ts apps/medusa-be/src/modules/**/__tests__/*.spec.ts 📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md) apps/medusa-be/src/modules/**/__tests__/*.spec.ts: Module integration tests: Use moduleIntegrationTestRunner() when mocking inherited MedusaService methods - test against real DB Module integration tests: Inject mocked dependencies via injectedDependencies - use vi.fn() for Caching, Locking modules Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts **/*.{test,spec}.{ts,tsx} 📄 CodeRabbit inference engine (AGENTS.md) Use Vitest for running tests in backend and UI library projects Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts apps/medusa-be/src/**/*.{ts,tsx} 📄 CodeRabbit inference engine (AGENTS.md) Medusa backend custom logic should be organized in api/, modules/, workflows/, admin/, subscribers/, and jobs/ directories under apps/medusa-be/src/ Files: apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts apps/medusa-be/src/workflows/seed/steps/create-products.ts apps/medusa-be/src/modules/payment-paykit/services/stripe.ts apps/medusa-be/src/workflows/**/* 📄 CodeRabbit inference engine (CLAUDE.md) Place business logic workflows under apps/medusa-be/src/workflows Files: apps/medusa-be/src/workflows/seed/steps/create-products.ts 🧠 Learnings (3) 📚 Learning: 2025-12-16T19:45:17.746Z Learnt from: BleedingDev Repo: NMIT-WR/new-engine PR: 207 File: libs/ui/src/molecules/select.tsx:50-50 Timestamp: 2025-12-16T19:45:17.746Z Learning: When reviewing Tailwind classes in TSX/TS files, prefer using square brackets for arbitrary CSS values and complex expressions. Specifically: - Do not use the parentheses syntax (z-(--z-index)) for anything beyond simple CSS variable references; this syntax auto-wraps in var() and cannot handle calc or complex functions. - Use the square brackets syntax (e.g., h-[calc(var(--available-height)-var(--spacing-content))]) for calc expressions, var with calc, and any complex CSS expressions. This rule applies broadly to Tailwind v4 usage in TSX code across the project. Applied to files: apps/herbatika/src/app/layout.tsx 📚 Learning: 2026-06-14T17:05:00.817Z Learnt from: KaiUweCZE Repo: TechsioCZ/new-engine PR: 442 File: apps/herbatika/src/components/reviews/product-review-token-page.tsx:36-42 Timestamp: 2026-06-14T17:05:00.817Z Learning: When reviewing code in apps/herbatika that calls `useProducts(input: ProductListInput, options?)`, treat `enabled` provided inside the first argument (`input`) as intentional and valid. The `ProductListInput` type includes an optional `enabled?: boolean` (via `BaseStorefrontProductListInput & { enabled?: boolean }`), and the hook infrastructure strips `enabled` before constructing the HTTP request and query key (following the same `stripListInput` behavior used elsewhere). Therefore, do NOT flag `useProducts({ enabled: ... , ... }, options)` as a contract violation; `enabled` belongs in the input object, not in the `options` argument. Applied to files: apps/herbatika/src/app/layout.tsx 📚 Learning: 2026-06-16T10:43:29.830Z Learnt from: Luko248 Repo: TechsioCZ/new-engine PR: 454 File: apps/frontend-demo/src/app/layout.tsx:23-23 Timestamp: 2026-06-16T10:43:29.830Z Learning: In Next.js App Router layout files (e.g., src/app/**/layout.tsx), if a synchronous inline theme-initialization script (or equivalent “theme/mode init” logic) is intentionally placed as the *first child inside* <body> (before the rest of the body content/children), do not flag it as a suspicious layout/body placement issue. This placement is correct because App Router layouts can’t freely inject arbitrary elements into <head>, and a synchronous inline script at the top of <body> runs during HTML parsing (before body content renders), preventing a flash of incorrect/unstyled theme. Applied to files: apps/herbatika/src/app/layout.tsx 🔇 Additional comments (7) apps/medusa-be/src/modules/payment-paykit/services/stripe.ts (2) 54-55: LGTM! Also applies to: 286-312 165-183: LGTM! Also applies to: 238-267 apps/medusa-be/src/modules/payment-paykit/__tests__/stripe.unit.spec.ts (2) 133-198: LGTM! Also applies to: 200-236 279-398: LGTM! apps/herbatika/src/app/layout.tsx (1) 97-108: LGTM! apps/medusa-be/src/workflows/seed/steps/create-products.ts (1) 17-20: LGTM! Also applies to: 635-635, 647-648, 1417-1427 apps/medusa-symmy-plugin/src/workflows/upsert-products-batch/client-mapper-helper.ts (1) 1-4: LGTM! Also applies to: 205-205, 218-218, 269-269, 278-278, 343-343
…ctors to a different scope, added missing ENVs
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/medusa-symmy-plugin/package.json (1)
82-83: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winBroaden the React peer ranges.
apps/medusa-symmy-plugindeclares exactreactandreact-dompeers at19.2.3, which can cause peer conflicts for consuming workspaces allowed to use other compatible React 19 versions. Use a documented semver support range such as^19.2.3, or update the supported React range consistently.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/medusa-symmy-plugin/package.json` around lines 82 - 83, Update the react and react-dom peer dependency declarations in the package manifest from exact 19.2.3 versions to the documented compatible React 19 semver range, such as ^19.2.3, applying the same range consistently to both packages.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.env.docker:
- Around line 51-54: Remove https://docs.medusajs.com from the DC_STORE_CORS,
DC_ADMIN_CORS, and DC_AUTH_CORS default allowlists. Keep the existing localhost
and trusted local Medusa origins unchanged; only add the public docs origin
through an explicit opt-in mechanism after validating credential and cookie
trust.
In `@apps/herbatika/next.config.ts`:
- Around line 69-70: Remove the global images.unoptimized assignment derived
from resolvesToLoopback in the Next.js configuration. Apply loopback handling
only at Payload image call sites or through a source-aware loader, while
preserving optimisation for CDN, Unsplash, and Medusa image sources.
In `@apps/medusa-be/.env.template`:
- Around line 55-69: Reorder the newly added environment keys in .env.template
to satisfy dotenv-linter’s alphabetical ordering within each section,
specifically the product/workflow settings and Herbatica seed source variables.
Keep all values, comments, section boundaries, and runtime behavior unchanged.
In `@apps/medusa-be/src/scripts/seed-files/README.md`:
- Around line 26-27: Update the seed instructions in README.md to change “The
manufacturers source” to “The manufacturers' source,” preserving the surrounding
requirement text and formatting.
In `@apps/medusa-be/src/workflows/send-product-review-request.ts`:
- Line 26: Update the import of buildProductReviewRequestUrl in
send-product-review-request.ts to reference its defining order-review-requests
module instead of order-payment-reminders. Keep the existing imports from
order-payment-reminders unchanged.
---
Outside diff comments:
In `@apps/medusa-symmy-plugin/package.json`:
- Around line 82-83: Update the react and react-dom peer dependency declarations
in the package manifest from exact 19.2.3 versions to the documented compatible
React 19 semver range, such as ^19.2.3, applying the same range consistently to
both packages.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fddae928-91c7-4ea8-a175-ecf81a1e5585
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (12)
.env.dockerapps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsxapps/medusa-be/.env.templateapps/medusa-be/src/scripts/seed-files/README.mdapps/medusa-be/src/utils/order-review-requests.tsapps/medusa-be/src/workflows/send-product-review-request.tsapps/medusa-be/tests/unit/product-review-request-url.unit.spec.tsapps/medusa-symmy-plugin/package.jsonapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/__tests__/client-mapper-helper.unit.spec.tsbiome.jsondocker-compose.yaml
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: storybook-a11y / storybook-a11y
- GitHub Check: Greptile Review
- GitHub Check: main
⚠️ CI failures not shown inline (1)
GitHub Check: Kilo Code Review: Kilo Code Review failed
Conclusion: failure
Review failed: The message could not be delivered
🧰 Additional context used
📓 Path-based instructions (18)
apps/medusa-be/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
apps/medusa-be/**/*.{ts,tsx}: Use TypeScript for type checking - runnpx tsc --noEmitfor validation
Forbidden: Non-null assertions (!) - always use type guards and validation instead
Annotate generic field access with explicitunknowntype before type guards -const v: unknown = result[field]
Don't useas Typewithout validation - always validate before casting
UseModules.*andContainerRegistrationKeys.*constants instead of hardcoding strings
Batch operations with CHUNK_SIZE to avoid unbounded operations
Extract pure functions to separate files for testability without runtime dependencies
Files:
apps/medusa-be/tests/unit/product-review-request-url.unit.spec.tsapps/medusa-be/src/utils/order-review-requests.tsapps/medusa-be/src/workflows/send-product-review-request.ts
apps/medusa-be/**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
apps/medusa-be/**/*.{ts,tsx,js,jsx}: Use Biome linter with ultracite preset - runbunx biome check --write .and always use braces in conditionals
Comments should explain 'why', never 'what' - use self-documenting code via clear naming
Always use const per declaration -const a = 1; const b = 2is correct, one variable per line
Use nullish coalescing (??) operator instead of logical OR (||) for default values
Files:
apps/medusa-be/tests/unit/product-review-request-url.unit.spec.tsapps/medusa-be/src/utils/order-review-requests.tsapps/medusa-be/src/workflows/send-product-review-request.ts
apps/medusa-be/tests/unit/**/*.unit.spec.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
apps/medusa-be/tests/unit/**/*.unit.spec.ts: Unit tests use factory functions for mocks -createMockEntity(overrides)pattern - use Vitest APIs explicitly
Usevi.useFakeTimers()for time-dependent tests - usevi.advanceTimersByTimeAsync()andvi.setSystemTime()for deterministic behavior
Clear mocks withmockFn.mockReset()notvi.clearAllMocks()when usingmockResolvedValueOnce()
Files:
apps/medusa-be/tests/unit/product-review-request-url.unit.spec.ts
apps/medusa-be/tests/**/*.spec.ts
📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md)
Mock Medusa loaders in tests: Use
vi.mock('../loaders/x', () => ({ __esModule: true, default: vi.fn() }))
Files:
apps/medusa-be/tests/unit/product-review-request-url.unit.spec.ts
apps/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Import UI components using the
@techsio/ui-kitnamespace, not@libs/ui, for runtime apps
Files:
apps/medusa-be/tests/unit/product-review-request-url.unit.spec.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/__tests__/client-mapper-helper.unit.spec.tsapps/medusa-be/src/utils/order-review-requests.tsapps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsxapps/medusa-be/src/workflows/send-product-review-request.ts
**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Vitest for running tests in backend and UI library projects
Files:
apps/medusa-be/tests/unit/product-review-request-url.unit.spec.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/__tests__/client-mapper-helper.unit.spec.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Run Biome linting and formatting only on changed files using 'bunx biome check --write path/to/file'
Files:
apps/medusa-be/tests/unit/product-review-request-url.unit.spec.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/__tests__/client-mapper-helper.unit.spec.tsapps/medusa-be/src/utils/order-review-requests.tsapps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsxapps/medusa-be/src/workflows/send-product-review-request.ts
apps/**/!(medusa-be)/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use modern React patterns and React 19 for frontend applications in the monorepo
Files:
apps/medusa-be/tests/unit/product-review-request-url.unit.spec.tsapps/medusa-symmy-plugin/src/workflows/upsert-products-batch/__tests__/client-mapper-helper.unit.spec.tsapps/medusa-be/src/utils/order-review-requests.tsapps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsxapps/medusa-be/src/workflows/send-product-review-request.ts
apps/medusa-be/src/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Medusa backend custom logic should be organized in api/, modules/, workflows/, admin/, subscribers/, and jobs/ directories under apps/medusa-be/src/
Files:
apps/medusa-be/src/utils/order-review-requests.tsapps/medusa-be/src/workflows/send-product-review-request.ts
apps/herbatika/**
📄 CodeRabbit inference engine (AGENTS.md)
apps/herbatika/**: Read apps/herbatika/AGENTS.md before editing Herbatika app and follow its specific configuration which overrides root assumptions
Herbatika app runs on http://localhost:3001 and routes work through libs/ui/skills and libs/storefront-data/skills workflows
Files:
apps/herbatika/next.config.tsapps/herbatika/src/app/layout.tsx
apps/herbatika/src/**/*.{jsx,tsx}
📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md)
apps/herbatika/src/**/*.{jsx,tsx}: Use internal UI primitives/components from@techsio/ui-kitinstead of native controls in app code. Avoid raw , , , <textarea>, , inline SVG icons. For Next.js links/images, prefer the UI-kit component with next/link or next/image adapter support when that component exposes it. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/**/*.{jsx,tsx,css} 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) Use token-based utility classes instead of raw Tailwind palette/spacing values. Prefer tokenized classes like p-200, mt-300, gap-150, text-success, bg-danger over raw Tailwind values like p-4, mt-8, bg-red-600. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/** 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) apps/herbatika/src/**: Put Herbatika visual differences in src/styles/tokens/**; avoid JSX className overrides that duplicate UI-kit component props/tokens. Use kebab-case for file names and PascalCase for React component names in Herbatika. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/**/*.{ts,tsx} 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) apps/herbatika/src/**/*.{ts,tsx}: Use explicit package subpath imports from @techsio/storefront-data. Do not import from package roots or dist/. Keep server-only and client-only boundaries explicit in Herbatika app code; use 'server-only' and 'getServerQueryClient' for Server Component/SSR data paths. Files: apps/herbatika/src/app/layout.tsx apps/herbatika/src/**/*.{ts,tsx,js,jsx} 📄 CodeRabbit inference engine (apps/herbatika/AGENTS.md) Keep source files at a soft limit of ~200 lines; exceeding this should trigger refactor consideration. Files: apps/herbatika/src/app/layout.tsx **/package.json 📄 CodeRabbit inference engine (CLAUDE.md) Use pnpm CLI to add dependencies; never edit package.json directly Files: apps/medusa-symmy-plugin/package.json apps/medusa-be/src/workflows/**/* 📄 CodeRabbit inference engine (CLAUDE.md) Place business logic workflows under apps/medusa-be/src/workflows Files: apps/medusa-be/src/workflows/send-product-review-request.ts apps/medusa-be/src/workflows/*.ts 📄 CodeRabbit inference engine (apps/medusa-be/CLAUDE.md) apps/medusa-be/src/workflows/*.ts: Workflows: Use createWorkflow() and createStep() for multi-step business logic - cannot reassign/iterate variables in workflow body Use transform() for data manipulation in workflows - limit to data transformations, not external side effects Use when().then() for conditionals in workflows instead of imperative logic Use useQueryGraphStep() for Query operations within workflows Workflows using locks: Use acquireLockStep() and releaseLockStep() - auto-releases on error Files: apps/medusa-be/src/workflows/send-product-review-request.ts 🧠 Learnings (7) 📚 Learning: 2025-12-16T19:45:17.746Z Learnt from: BleedingDev Repo: NMIT-WR/new-engine PR: 207 File: libs/ui/src/molecules/select.tsx:50-50 Timestamp: 2025-12-16T19:45:17.746Z Learning: When reviewing Tailwind classes in TSX/TS files, prefer using square brackets for arbitrary CSS values and complex expressions. Specifically: - Do not use the parentheses syntax (z-(--z-index)) for anything beyond simple CSS variable references; this syntax auto-wraps in var() and cannot handle calc or complex functions. - Use the square brackets syntax (e.g., h-[calc(var(--available-height)-var(--spacing-content))]) for calc expressions, var with calc, and any complex CSS expressions. This rule applies broadly to Tailwind v4 usage in TSX code across the project. Applied to files: apps/herbatika/src/app/layout.tsx 📚 Learning: 2026-06-14T17:05:00.817Z Learnt from: KaiUweCZE Repo: TechsioCZ/new-engine PR: 442 File: apps/herbatika/src/components/reviews/product-review-token-page.tsx:36-42 Timestamp: 2026-06-14T17:05:00.817Z Learning: When reviewing code in apps/herbatika that calls `useProducts(input: ProductListInput, options?)`, treat `enabled` provided inside the first argument (`input`) as intentional and valid. The `ProductListInput` type includes an optional `enabled?: boolean` (via `BaseStorefrontProductListInput & { enabled?: boolean }`), and the hook infrastructure strips `enabled` before constructing the HTTP request and query key (following the same `stripListInput` behavior used elsewhere). Therefore, do NOT flag `useProducts({ enabled: ... , ... }, options)` as a contract violation; `enabled` belongs in the input object, not in the `options` argument. Applied to files: apps/herbatika/src/app/layout.tsx 📚 Learning: 2026-06-16T10:43:29.830Z Learnt from: Luko248 Repo: TechsioCZ/new-engine PR: 454 File: apps/frontend-demo/src/app/layout.tsx:23-23 Timestamp: 2026-06-16T10:43:29.830Z Learning: In Next.js App Router layout files (e.g., src/app/**/layout.tsx), if a synchronous inline theme-initialization script (or equivalent “theme/mode init” logic) is intentionally placed as the *first child inside* <body> (before the rest of the body content/children), do not flag it as a suspicious layout/body placement issue. This placement is correct because App Router layouts can’t freely inject arbitrary elements into <head>, and a synchronous inline script at the top of <body> runs during HTML parsing (before body content renders), preventing a flash of incorrect/unstyled theme. Applied to files: apps/herbatika/src/app/layout.tsx 📚 Learning: 2026-02-25T14:46:02.729Z Learnt from: redeyecz Repo: TechsioCZ/new-engine PR: 335 File: apps/zane-operator/src/db.ts:205-207 Timestamp: 2026-02-25T14:46:02.729Z Learning: Enforce PostgreSQL 18+ as the minimum version across docker-compose files. Since the repo uses postgres:18.1-alpine (evidence in docker-compose.yaml), ensure all docker-compose service images for PostgreSQL use 18.1-alpine or newer. When reviewing, look for postgres images with a tag below 18 (e.g., postgres:<older-version>) and update to 18.1-alpine or a newer compatible tag. This guideline applies to all docker-compose YAML files that define PostgreSQL services. Applied to files: docker-compose.yaml 📚 Learning: 2026-02-05T14:43:17.404Z Learnt from: KaiUweCZE Repo: NMIT-WR/new-engine PR: 324 File: apps/medusa-be/package.json:0-0 Timestamp: 2026-02-05T14:43:17.404Z Learning: Validate and enforce React 19 compatibility across monorepo workspaces. Since Medusa UI supports React 19 via root package.json overrides and Medusa Cloud prerequisites show React 19 overrides for npm workspaces, ensure workspace root and all relevant package.json files align with React 19 (18+ requirement is satisfied). When reviewing, verify that overrides exist in the root package.json and that dependent packages in apps or packages directories declare React 19 (or compatible) in their peerDependencies or dependencies as appropriate for workspace usage. Applied to files: apps/medusa-symmy-plugin/package.json 📚 Learning: 2026-05-07T19:05:58.339Z Learnt from: redeyecz Repo: TechsioCZ/new-engine PR: 390 File: apps/medusa-be/package.json:78-81 Timestamp: 2026-05-07T19:05:58.339Z Learning: When reviewing changes to `package.json`, do not automatically flag dependency additions/removals as "manually edited" or as "bypassing the pnpm lockfile" just because the `package.json` diff shows only that file changed. First verify whether `pnpm-lock.yaml` is missing the corresponding entries. Since `pnpm add` updates both `package.json` and `pnpm-lock.yaml` together, legitimate changes can appear in the `package.json` diff while still being properly tracked in the lockfile. Applied to files: apps/medusa-symmy-plugin/package.json 📚 Learning: 2026-05-20T15:58:53.048Z Learnt from: redeyecz Repo: TechsioCZ/new-engine PR: 413 File: apps/medusa-be/package.json:77-80 Timestamp: 2026-05-20T15:58:53.048Z Learning: When reviewing monorepo `package.json` files, treat any dependencies/devDependencies using the `paykit-sdk/*` scope (e.g., `paykit-sdk/core`, `paykit-sdk/stripe`, `paykit-sdk/comgate`, `paykit-sdk/gopay`) as coming from the TechsioCZ/new-engine private npm registry. Do not flag dependency version constraints (e.g., `^1.2.0`) as invalid merely because those packages/versions are not found on the public npm registry. Public-web/private-web availability checks against the public npm API are not applicable for these packages; if validation is needed, rely on the private registry/CI install behavior instead. Applied to files: apps/medusa-symmy-plugin/package.json 🪛 dotenv-linter (4.0.0) apps/medusa-be/.env.template [warning] 57-57: [UnorderedKey] The PRODUCT_REVIEW_REQUEST_DELAY_MINUTES key should go before the PRODUCT_REVIEW_REQUEST_MESSAGE key (UnorderedKey) [warning] 66-66: [UnorderedKey] The HERBATICA_CATEGORIES_XML_PATH key should go before the HERBATICA_XML_PATH key (UnorderedKey) [warning] 67-67: [UnorderedKey] The HERBATICA_REVIEWS_XML_PATH key should go before the HERBATICA_XML_PATH key (UnorderedKey) [warning] 68-68: [UnorderedKey] The HERBATICA_MANUFACTURERS_CSV_PATH key should go before the HERBATICA_REVIEWS_XML_PATH key (UnorderedKey) .env.docker [warning] 26-26: [UnorderedKey] The DC_N1_RESEND_API_KEY key should go before the DC_NEXT_PUBLIC_PACKETA_WIDGET_API_KEY key (UnorderedKey) [warning] 27-27: [UnorderedKey] The DC_N1_RESEND_FROM_EMAIL key should go before the DC_NEXT_PUBLIC_PACKETA_WIDGET_API_KEY key (UnorderedKey) [warning] 28-28: [UnorderedKey] The DC_N1_CONTACT_EMAIL key should go before the DC_N1_MEDUSA_BACKEND_URL_INTERNAL key (UnorderedKey) [warning] 52-52: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 52-52: [UnorderedKey] The DC_STORE_CORS key should go before the DC_STORE_NAME key (UnorderedKey) [warning] 53-53: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 53-53: [UnorderedKey] The DC_ADMIN_CORS key should go before the DC_COOKIE_SECRET key (UnorderedKey) [warning] 54-54: [QuoteCharacter] The value has quote characters (', ") (QuoteCharacter) [warning] 54-54: [UnorderedKey] The DC_AUTH_CORS key should go before the DC_COOKIE_SECRET key (UnorderedKey) [warning] 55-55: [UnorderedKey] The DC_PRODUCT_REVIEW_REQUEST_MESSAGE key should go before the DC_STOREFRONT_URL key (UnorderedKey) [warning] 56-56: [UnorderedKey] The DC_PRODUCT_REVIEW_REQUEST_DELAY_MINUTES key should go before the DC_PRODUCT_REVIEW_REQUEST_MESSAGE key (UnorderedKey) [warning] 57-57: [UnorderedKey] The DC_PRODUCT_REVIEW_TOKEN_EXPIRY_DAYS key should go before the DC_STOREFRONT_URL key (UnorderedKey) [warning] 74-74: [UnorderedKey] The DC_MEDUSA_BE_RESEND_API_KEY key should go before the DC_MEDUSA_COOKIE_SAME_SITE key (UnorderedKey) [warning] 75-75: [UnorderedKey] The DC_MEDUSA_BE_RESEND_FROM_EMAIL key should go before the DC_MEDUSA_COOKIE_SAME_SITE key (UnorderedKey) [warning] 76-76: [UnorderedKey] The DC_MEDUSA_BE_RESEND_WEBHOOK_SECRET key should go before the DC_MEDUSA_COOKIE_SAME_SITE key (UnorderedKey) 🪛 LanguageTool apps/medusa-be/src/scripts/seed-files/README.md [uncategorized] ~26-~26: It seems likely that a singular genitive (’s) apostrophe is missing. Context: ...use an empty third argument (""). The manufacturers source is required and should be an exp... (AI_HYDRA_LEO_APOSTROPHE_S_XS) 🔇 Additional comments (14) apps/herbatika/src/app/layout.tsx (1) 3-3: LGTM! Also applies to: 71-88, 96-117 apps/herbatika/next.config.ts (1) 4-5: LGTM! Also applies to: 26-37 biome.json (1) 52-52: LGTM! apps/medusa-symmy-plugin/package.json (1) 49-49: LGTM! Also applies to: 55-72 apps/medusa-symmy-plugin/src/workflows/upsert-products-batch/__tests__/client-mapper-helper.unit.spec.ts (1) 1-58: LGTM! apps/medusa-be/src/utils/order-review-requests.ts (1) 22-40: LGTM! apps/medusa-be/src/workflows/send-product-review-request.ts (1) 136-137: LGTM! Also applies to: 156-157, 337-341 apps/medusa-be/tests/unit/product-review-request-url.unit.spec.ts (1) 1-28: LGTM! apps/medusa-be/.env.template (1) 35-35: LGTM! apps/medusa-be/src/scripts/seed-files/README.md (1) 10-10: LGTM! Also applies to: 19-25 .env.docker (3) 25-28: 🎯 Functional Correctness Verify that empty overrides do not suppress shared values. These variables are present as empty strings. If bootstrap logic uses process.env.X ?? fallback, '' will not trigger the fallback, so the shared email configuration may be replaced with an empty value. Normalise blank values as unset, or omit these keys from the template if that is the intended behaviour. Also applies to: 73-76 51-51: LGTM! Also applies to: 55-59 103-107: LGTM! docker-compose.yaml (1) 29-29: LGTM! Also applies to: 43-43, 217-217
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.env.docker:
- Line 54: Update DC_AUTH_CORS to include the union of all origins currently
listed in DC_STORE_CORS and the existing admin origins, preserving the existing
origins while allowing storefront authentication.
In `@apps/herbatika/next.config.ts`:
- Around line 41-57: Update imageRemotePatterns to include the browser-facing
Medusa image remote pattern using the same localhost fallback as
resolveMedusaBackendUrl(), rather than relying only on
NEXT_PUBLIC_MEDUSA_BACKEND_URL. Ensure http://localhost:9000 is allowed when the
environment variable is unset, and add a configuration-only test covering that
unset-environment case.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 3f8739e9-017c-4730-94fd-32ca815e2a3a
📒 Files selected for processing (4)
.env.dockerapps/herbatika/next.config.tsapps/medusa-be/src/scripts/seed-files/README.mdapps/medusa-symmy-plugin/package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: storybook-a11y / storybook-a11y
- GitHub Check: Analyze (javascript-typescript)
⚠️ CI failures not shown inline (2)
GitHub Actions: CI / 0_main.txt: Medusa upgrade 2.17.2, security bump, pnpm optimizations, paykit bump & fixes
Conclusion: failure
##[group]✅ > nx run medusa-be:lint
�[2m$ pnpm lint:biome && pnpm lint:medusa�[22m
�[2m$ pnpm -w exec biome check apps/medusa-be�[22m
Checked 844 files in 29s. No fixes applied.
�[2m$ medusa lint --quiet�[22m
�[32minfo�[39m: Linting project...
�[32minfo�[39m: No lint issues found.
##[endgroup]
NX Running targets lint, test for 10 projects failed
Failed tasks:
- herbatika:lint
##[error]Process completed with exit code 1.
GitHub Actions: CI / main: Medusa upgrade 2.17.2, security bump, pnpm optimizations, paykit bump & fixes
Conclusion: failure
##[group]✅ > nx run medusa-be:lint
�[2m$ pnpm lint:biome && pnpm lint:medusa�[22m
�[2m$ pnpm -w exec biome check apps/medusa-be�[22m
Checked 844 files in 29s. No fixes applied.
�[2m$ medusa lint --quiet�[22m
�[32minfo�[39m: Linting project...
�[32minfo�[39m: No lint issues found.
##[endgroup]
NX Running targets lint, test for 10 projects failed
Failed tasks:
- herbatika:lint
##[error]Process completed with exit code 1.
🧰 Additional context used
📓 Path-based instructions (5)
**/package.json
📄 CodeRabbit inference engine (CLAUDE.md)
Use pnpm CLI to add dependencies; never edit package.json directly
Files:
apps/medusa-symmy-plugin/package.json
apps/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Import UI components using the
@techsio/ui-kitnamespace, not@libs/ui, for runtime apps
Files:
apps/herbatika/next.config.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Run Biome linting and formatting only on changed files using 'bunx biome check --write path/to/file'
Files:
apps/herbatika/next.config.ts
apps/herbatika/**
📄 CodeRabbit inference engine (AGENTS.md)
apps/herbatika/**: Read apps/herbatika/AGENTS.md before editing Herbatika app and follow its specific configuration which overrides root assumptions
Herbatika app runs on http://localhost:3001 and routes work through libs/ui/skills and libs/storefront-data/skills workflows
Files:
apps/herbatika/next.config.ts
apps/**/!(medusa-be)/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use modern React patterns and React 19 for frontend applications in the monorepo
Files:
apps/herbatika/next.config.ts
🧠 Learnings (3)
📚 Learning: 2026-02-05T14:43:17.404Z
Learnt from: KaiUweCZE
Repo: NMIT-WR/new-engine PR: 324
File: apps/medusa-be/package.json:0-0
Timestamp: 2026-02-05T14:43:17.404Z
Learning: Validate and enforce React 19 compatibility across monorepo workspaces. Since Medusa UI supports React 19 via root package.json overrides and Medusa Cloud prerequisites show React 19 overrides for npm workspaces, ensure workspace root and all relevant package.json files align with React 19 (18+ requirement is satisfied). When reviewing, verify that overrides exist in the root package.json and that dependent packages in apps or packages directories declare React 19 (or compatible) in their peerDependencies or dependencies as appropriate for workspace usage.
Applied to files:
apps/medusa-symmy-plugin/package.json
📚 Learning: 2026-05-07T19:05:58.339Z
Learnt from: redeyecz
Repo: TechsioCZ/new-engine PR: 390
File: apps/medusa-be/package.json:78-81
Timestamp: 2026-05-07T19:05:58.339Z
Learning: When reviewing changes to `package.json`, do not automatically flag dependency additions/removals as "manually edited" or as "bypassing the pnpm lockfile" just because the `package.json` diff shows only that file changed. First verify whether `pnpm-lock.yaml` is missing the corresponding entries. Since `pnpm add` updates both `package.json` and `pnpm-lock.yaml` together, legitimate changes can appear in the `package.json` diff while still being properly tracked in the lockfile.
Applied to files:
apps/medusa-symmy-plugin/package.json
📚 Learning: 2026-05-20T15:58:53.048Z
Learnt from: redeyecz
Repo: TechsioCZ/new-engine PR: 413
File: apps/medusa-be/package.json:77-80
Timestamp: 2026-05-20T15:58:53.048Z
Learning: When reviewing monorepo `package.json` files, treat any dependencies/devDependencies using the `paykit-sdk/*` scope (e.g., `paykit-sdk/core`, `paykit-sdk/stripe`, `paykit-sdk/comgate`, `paykit-sdk/gopay`) as coming from the TechsioCZ/new-engine private npm registry. Do not flag dependency version constraints (e.g., `^1.2.0`) as invalid merely because those packages/versions are not found on the public npm registry. Public-web/private-web availability checks against the public npm API are not applicable for these packages; if validation is needed, rely on the private registry/CI install behavior instead.
Applied to files:
apps/medusa-symmy-plugin/package.json
🪛 dotenv-linter (4.0.0)
.env.docker
[warning] 52-52: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 52-52: [UnorderedKey] The DC_STORE_CORS key should go before the DC_STORE_NAME key
(UnorderedKey)
[warning] 53-53: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 53-53: [UnorderedKey] The DC_ADMIN_CORS key should go before the DC_COOKIE_SECRET key
(UnorderedKey)
[warning] 54-54: [QuoteCharacter] The value has quote characters (', ")
(QuoteCharacter)
[warning] 54-54: [UnorderedKey] The DC_AUTH_CORS key should go before the DC_COOKIE_SECRET key
(UnorderedKey)
🔇 Additional comments (6)
.env.docker (1)
25-28: LGTM!Also applies to: 38-40, 55-59, 73-76, 103-107
apps/medusa-symmy-plugin/package.json (1)
49-50: LGTM!Also applies to: 55-73, 74-83
apps/medusa-be/src/scripts/seed-files/README.md (1)
10-10: LGTM!Also applies to: 19-28
apps/herbatika/next.config.ts (3)
4-13: LGTM!
83-86: LGTM!
4-13: 📐 Maintainability & Code QualityVerify the required Biome check before merging.
Please run
bunx biome check --write apps/herbatika/next.config.ts. As per coding guidelines, changed TypeScript files must be checked and formatted with Biome using that command.Also applies to: 41-57, 83-86
Source: Coding guidelines
|
🎉 This PR is included in version 0.26.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
1 participant
Summary by CodeRabbit