@open-mercato/cli 0.10.1-develop.7836.1.0ef0f453c6 → 0.10.1-develop.7841.1.af87ac614d

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.10.1-develop.7836.1.0ef0f453c6",
+  "version": "0.10.1-develop.7841.1.af87ac614d",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.10.1-develop.7836.1.0ef0f453c6",
-    "@open-mercato/queue": "0.10.1-develop.7836.1.0ef0f453c6",
-    "@open-mercato/shared": "0.10.1-develop.7836.1.0ef0f453c6",
-    "@open-mercato/telemetry": "0.10.1-develop.7836.1.0ef0f453c6",
+    "@open-mercato/events": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/queue": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/telemetry": "0.10.1-develop.7841.1.af87ac614d",
     "cross-spawn": "^7.0.6",
     "minisearch": "7.2.0",
     "pg": "8.23.0",
@@ -75,10 +75,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7836.1.0ef0f453c6"
+    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7836.1.0ef0f453c6",
+    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"

package/src/lib/generators/__tests__/module-registry-requires-enforcement.test.ts

@@ -0,0 +1,130 @@
+/**
+ * `metadata.requires` must actually block `yarn generate` when the required module is
+ * not enabled — it is not advisory text.
+ *
+ * The CLI package is built as an ES module (`packages/cli/package.json` `"type": "module"`),
+ * where the bare `require()` this check used to read `metadata.requires` is undefined and
+ * throws a `ReferenceError` on every module, every time. That throw was swallowed by a
+ * `catch {}`, so the dependency map stayed empty and the check below it never found
+ * anything to report: a module could declare `requires: ['catalog']`, `catalog` could be
+ * disabled, and `yarn generate` would still succeed. Unit tests missed this because Jest
+ * runs the generator under CommonJS, where `require()` is defined and the bug cannot
+ * reproduce.
+ *
+ * The fix reads `metadata.requires` through `loadModuleExportsFromSource` (a real
+ * `import()`) with an AST-based static fallback — the same mechanism this file already
+ * uses for route metadata — so there is no `require()` left to break under ESM. This test
+ * drives the real generator against real fixture files on disk rather than asserting on
+ * the implementation, so it fails again if a future change reintroduces `require()`.
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import os from 'node:os'
+import type { PackageResolver, ModuleEntry } from '../../resolver'
+import { generateModuleRegistry } from '../module-registry'
+
+let tmpDir: string
+let outputDir: string
+
+function touchFile(filePath: string, content: string): void {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true })
+  fs.writeFileSync(filePath, content)
+}
+
+function pkgModulePath(modId: string, ...segments: string[]): string {
+  return path.join(tmpDir, 'packages', 'core', 'src', 'modules', modId, ...segments)
+}
+
+function createMockResolver(enabled: ModuleEntry[]): PackageResolver {
+  return {
+    isMonorepo: () => true,
+    getRootDir: () => tmpDir,
+    getAppDir: () => path.join(tmpDir, 'app'),
+    getOutputDir: () => outputDir,
+    getModulesConfigPath: () => path.join(tmpDir, 'app', 'src', 'modules.ts'),
+    discoverPackages: () => [],
+    loadEnabledModules: () => enabled,
+    getModulePaths: (entry: ModuleEntry) => ({
+      appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+      pkgBase: path.join(tmpDir, 'packages', 'core', 'src', 'modules', entry.id),
+    }),
+    getModuleImportBase: (entry: ModuleEntry) => ({
+      appBase: `@/modules/${entry.id}`,
+      pkgBase: `@open-mercato/core/modules/${entry.id}`,
+    }),
+    getPackageOutputDir: () => outputDir,
+    getPackageRoot: () => path.join(tmpDir, 'packages', 'core'),
+  } as unknown as PackageResolver
+}
+
+function scaffoldDependentFixture(): void {
+  touchFile(pkgModulePath('leaf', 'index.ts'), "export const metadata = { id: 'leaf', label: 'Leaf' }\n")
+  touchFile(
+    pkgModulePath('dependent', 'index.ts'),
+    "export const metadata = { id: 'dependent', label: 'Dependent', requires: ['leaf'] }\n",
+  )
+}
+
+function mockProcessExit(): jest.SpyInstance {
+  return jest.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    throw new Error(`process.exit(${code})`)
+  }) as unknown as typeof process.exit)
+}
+
+describe('module registry enforces metadata.requires', () => {
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'registry-requires-'))
+    outputDir = path.join(tmpDir, 'app', '.mercato', 'generated')
+    fs.mkdirSync(outputDir, { recursive: true })
+  })
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  it('refuses generation when a declared dependency is not enabled', async () => {
+    scaffoldDependentFixture()
+    const resolver = createMockResolver([{ id: 'dependent', from: '@open-mercato/core' }])
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
+    const exitSpy = mockProcessExit()
+
+    await expect(generateModuleRegistry({ resolver, quiet: true })).rejects.toThrow('process.exit(1)')
+
+    expect(exitSpy).toHaveBeenCalledWith(1)
+    expect(consoleErrorSpy.mock.calls.flat().join('\n')).toContain('Module "dependent" requires: leaf')
+
+    consoleErrorSpy.mockRestore()
+    exitSpy.mockRestore()
+  })
+
+  it('generates cleanly once the declared dependency is enabled', async () => {
+    scaffoldDependentFixture()
+    const resolver = createMockResolver([
+      { id: 'leaf', from: '@open-mercato/core' },
+      { id: 'dependent', from: '@open-mercato/core' },
+    ])
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
+    const exitSpy = mockProcessExit()
+
+    const result = await generateModuleRegistry({ resolver, quiet: true })
+
+    expect(result.errors).toEqual([])
+    expect(exitSpy).not.toHaveBeenCalled()
+
+    consoleErrorSpy.mockRestore()
+    exitSpy.mockRestore()
+  })
+})
+
+describe('module registry has no require() left to break under the ESM CLI build', () => {
+  it('reads metadata.requires without the CommonJS require() function', () => {
+    // Jest runs this generator under CommonJS, where `require()` is defined — the two
+    // tests above would pass even against the old, ESM-broken implementation. This
+    // static check is what actually guards against a regression: `@open-mercato/cli`
+    // is built as an ES module, so a bare `require()` call reintroduced here would throw
+    // under the real build regardless of what Jest reports.
+    const sourceFile = path.join(__dirname, '..', 'module-registry.ts')
+    const source = fs.readFileSync(sourceFile, 'utf8')
+    expect([...source.matchAll(/\brequire\(/g)]).toEqual([])
+  })
+})

package/src/lib/generators/module-registry.ts

@@ -1722,6 +1722,20 @@ function resolveApiPathFromMetadata(metadata: unknown, fallbackPath: string): st
   return typeof candidate === 'string' && candidate.length > 0 ? candidate : fallbackPath
 }
 
+function resolveModuleRequiresFromMetadata(metadata: unknown): string[] | undefined {
+  if (!metadata || typeof metadata !== 'object') return undefined
+  const requires = (metadata as Record<string, unknown>).requires
+  if (!Array.isArray(requires)) return undefined
+  const resolved = requires.filter((value): value is string => typeof value === 'string')
+  return resolved.length > 0 ? resolved : undefined
+}
+
+async function resolveModuleRequiresFromIndexFile(indexFileAbsolutePath: string): Promise<string[] | undefined> {
+  const loadedModule = await loadModuleExportsFromSource<Record<string, unknown>>(indexFileAbsolutePath)
+  const metadata = loadedModule?.metadata ?? extractNamedObjectLiteralExport(indexFileAbsolutePath, 'metadata')
+  return resolveModuleRequiresFromMetadata(metadata)
+}
+
 function detectExportedHttpMethods(sourceFile: string): HttpMethod[] {
   let source = ''
   try {
@@ -3691,13 +3705,8 @@ async function generateModuleRegistryFromDiscovery(options: ModuleRegistryRender
       const importPath = sanitizeGeneratedModuleSpecifier(indexResolved.importPath)
       imports.push(buildImportStatement(`* as ${infoImportName}`, importPath))
       runtimeImports.push(buildImportStatement(`* as ${infoImportName}`, importPath))
-      try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const mod = require(indexResolved.absolutePath)
-        const reqs: string[] | undefined =
-          mod?.metadata && Array.isArray(mod.metadata.requires) ? mod.metadata.requires : undefined
-        if (reqs && reqs.length) requiresByModule.set(modId, reqs)
-      } catch {}
+      const reqs = await resolveModuleRequiresFromIndexFile(indexResolved.absolutePath)
+      if (reqs && reqs.length) requiresByModule.set(modId, reqs)
     }
 
     // 2. Pages: frontend
@@ -4414,13 +4423,8 @@ async function generateModuleRegistryAppFromDiscovery(options: ModuleRegistryRen
       const importPath = sanitizeGeneratedModuleSpecifier(indexResolved.importPath)
       imports.push(buildImportStatement(`* as ${infoImportName}`, importPath))
       bootstrapImports.push(buildImportStatement(`* as ${infoImportName}`, importPath))
-      try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const mod = require(indexResolved.absolutePath)
-        const reqs: string[] | undefined =
-          mod?.metadata && Array.isArray(mod.metadata.requires) ? mod.metadata.requires : undefined
-        if (reqs && reqs.length) requiresByModule.set(modId, reqs)
-      } catch {}
+      const reqs = await resolveModuleRequiresFromIndexFile(indexResolved.absolutePath)
+      if (reqs && reqs.length) requiresByModule.set(modId, reqs)
     }
 
     {
@@ -4849,13 +4853,8 @@ async function generateModuleRegistryCliFromDiscovery(options: ModuleRegistryRen
       infoImportName = `I${importIdRef.value++}_${toVar(modId)}`
       const importPath = sanitizeGeneratedModuleSpecifier(indexResolved.importPath)
       imports.push(buildImportStatement(`* as ${infoImportName}`, importPath))
-      try {
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const mod = require(indexResolved.absolutePath)
-        const reqs: string[] | undefined =
-          mod?.metadata && Array.isArray(mod.metadata.requires) ? mod.metadata.requires : undefined
-        if (reqs && reqs.length) requiresByModule.set(modId, reqs)
-      } catch {}
+      const reqs = await resolveModuleRequiresFromIndexFile(indexResolved.absolutePath)
+      if (reqs && reqs.length) requiresByModule.set(modId, reqs)
     }
 
     // Module setup configuration: setup.ts