@open-mercato/cli 0.10.1-develop.8004.1.a8a79ee43f → 0.10.1-develop.8022.1.b6753de892

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.10.1-develop.8004.1.a8a79ee43f",
+  "version": "0.10.1-develop.8022.1.b6753de892",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.10.1-develop.8004.1.a8a79ee43f",
-    "@open-mercato/queue": "0.10.1-develop.8004.1.a8a79ee43f",
-    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f",
-    "@open-mercato/telemetry": "0.10.1-develop.8004.1.a8a79ee43f",
+    "@open-mercato/events": "0.10.1-develop.8022.1.b6753de892",
+    "@open-mercato/queue": "0.10.1-develop.8022.1.b6753de892",
+    "@open-mercato/shared": "0.10.1-develop.8022.1.b6753de892",
+    "@open-mercato/telemetry": "0.10.1-develop.8022.1.b6753de892",
     "cross-spawn": "^7.0.6",
     "minisearch": "7.2.0",
     "pg": "8.23.0",
@@ -75,10 +75,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f"
+    "@open-mercato/shared": "0.10.1-develop.8022.1.b6753de892"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f",
+    "@open-mercato/shared": "0.10.1-develop.8022.1.b6753de892",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"

package/src/lib/__tests__/telemetry-init.test.ts

@@ -164,7 +164,7 @@ describe('mercato telemetry init', () => {
 
     const pkg = JSON.parse(read('package.json'))
     expect(pkg.dependencies['@open-mercato/telemetry']).toBe('1.2.3')
-    expect(pkg.optionalDependencies['bullmq-otel']).toBe('^1.3.1')
+    expect(pkg.optionalDependencies['bullmq-otel']).toBe('^2.0.1')
 
     expect(read('.env.example')).toContain('TELEMETRY_BACKEND')
     expect(read('.env.example')).toContain('OTEL_EXPORTER_OTLP_ENDPOINT')

package/src/lib/generators/__tests__/openapi.test.ts

@@ -160,6 +160,30 @@ export function buildOpenApiDocument(modules: any[], options: any) {
     expect(openApiDoc.paths['/api/demo/details']?.get?.summary).toBe('package details')
   })
 
+  it('bundles into a per-run file and leaves no bundle behind', async () => {
+    touchFile(
+      path.join(tmpDir, 'packages', 'core', 'src', 'modules', 'demo', 'api', 'health', 'route.ts'),
+      [
+        'export async function GET() { return new Response("pkg-health") }',
+        'export const openApi = {',
+        "  GET: { summary: 'package health' }",
+        '}',
+        '',
+      ].join('\n'),
+    )
+    const cacheDir = path.join(tmpDir, 'node_modules', '.cache')
+    touchFile(path.join(cacheDir, '_openapi-bundle.mjs'), 'export {}\n')
+
+    const result = await generateOpenApi({ resolver: createMockResolver([{ id: 'demo', from: '@open-mercato/core' }]), quiet: true })
+
+    expect(result.errors).toEqual([])
+    const openApiDoc = JSON.parse(
+      fs.readFileSync(path.join(tmpDir, 'output', 'generated', 'openapi.generated.json'), 'utf8'),
+    ) as { paths: Record<string, { get?: { summary?: string } }> }
+    expect(openApiDoc.paths['/api/demo/health']?.get?.summary).toBe('package health')
+    expect(fs.readdirSync(cacheDir).filter((name) => name.startsWith('_openapi-bundle'))).toEqual([])
+  })
+
   it('skips route discovery and bundling when all tracked inputs are unchanged', async () => {
     touchFile(
       path.join(tmpDir, 'packages', 'core', 'src', 'modules', 'demo', 'api', 'health', 'route.ts'),

package/src/lib/generators/openapi.ts

@@ -7,6 +7,7 @@
  */
 
 import * as fs from 'node:fs'
+import { randomBytes } from 'node:crypto'
 import * as path from 'node:path'
 import type { ModuleEntry, PackageResolver } from '../resolver'
 import { getEnabledModuleIdentities } from '../module-identity'
@@ -340,7 +341,10 @@ async function generateOpenApiViaBundle(
   const cacheDir = path.join(rootDir, 'node_modules', '.cache')
   if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true })
 
-  const bundlePath = path.join(cacheDir, '_openapi-bundle.mjs')
+  // Per-run file: `yarn dev`'s watcher and a CLI `generate` (e.g. after
+  // create-mercato-module init) can bundle concurrently, and a shared path let
+  // one process execute the other's half-written bundle ("Unexpected end of input").
+  const bundlePath = path.join(cacheDir, `_openapi-bundle-${process.pid}-${randomBytes(6).toString('hex')}.mjs`)
   let inputPaths: string[] = []
 
   // Build the entry script that imports all routes and calls buildOpenApiDocument
@@ -607,7 +611,8 @@ process.stdout.write(JSON.stringify(deepClone(doc), (_, v) =>
     // process exit when a plugin request is still in flight.
     try { await esbuild.stop() } catch {}
     // Clean up old files from previous tsx-based approach
-    for (const file of ['_openapi-register.mjs', '_openapi-loader.mjs', '_next-stub.cjs']) {
+    try { fs.unlinkSync(bundlePath) } catch {}
+    for (const file of ['_openapi-bundle.mjs', '_openapi-register.mjs', '_openapi-loader.mjs', '_next-stub.cjs']) {
       try { fs.unlinkSync(path.join(cacheDir, file)) } catch {}
     }
   }

package/src/lib/telemetry-init.ts

@@ -23,7 +23,7 @@ import { dirname, join, resolve } from 'node:path'
  * `@open-mercato/cli`'s telemetry dependency once the app updates its packages.
  */
 
-const BULLMQ_OTEL_VERSION = '^1.3.1'
+const BULLMQ_OTEL_VERSION = '^2.0.1'
 
 type StepStatus = 'created' | 'patched' | 'skipped' | 'manual'
 

package/src/lib/testing/__tests__/integration.test.ts

@@ -17,6 +17,7 @@ import {
   resolveAppReadyTimeoutMs,
   resolveEphemeralPostgresImage,
   resolveEphemeralJwtSecret,
+  resolveEphemeralSuperadminPassword,
   ephemeralPostgresInitSql,
   shouldReuseBuildArtifacts,
   acquireEphemeralRuntimeLock,
@@ -30,6 +31,7 @@ import {
 } from '../integration'
 import type { CapturedOutputProcess, ShutdownProcessRef } from '../integration'
 import { resolveSpawnCommand } from '../../spawn'
+import { resolveInitSuperadminCredentials } from '../../init-secrets'
 import { EventEmitter } from 'node:events'
 import { spawn } from 'node:child_process'
 import type { ChildProcess } from 'node:child_process'
@@ -510,6 +512,28 @@ describe('integration cache and options', () => {
     )
   })
 
+  it('supplies a production-valid superadmin password when the inherited one is missing or a placeholder', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => undefined)
+    try {
+      const fallback = resolveEphemeralSuperadminPassword({})
+      expect(fallback).toBe('Om-Ephemeral-Superadmin-2026!')
+      expect(() =>
+        resolveInitSuperadminCredentials([], { NODE_ENV: 'production', OM_INIT_SUPERADMIN_PASSWORD: fallback }),
+      ).not.toThrow()
+      expect(warnSpy).not.toHaveBeenCalled()
+      expect(resolveEphemeralSuperadminPassword({ OM_INIT_SUPERADMIN_PASSWORD: 'secret' })).toBe(fallback)
+      expect(warnSpy).toHaveBeenCalledTimes(1)
+    } finally {
+      warnSpy.mockRestore()
+    }
+  })
+
+  it('keeps a production-valid operator-provided superadmin password', () => {
+    expect(resolveEphemeralSuperadminPassword({ OM_INIT_SUPERADMIN_PASSWORD: 'Operator-Chosen-Pass-42!' })).toBe(
+      'Operator-Chosen-Pass-42!',
+    )
+  })
+
   it('creates the vector and pgcrypto extensions in the ephemeral init SQL', () => {
     const sql = ephemeralPostgresInitSql()
     expect(sql).toContain('CREATE EXTENSION IF NOT EXISTS vector')

package/src/lib/testing/integration.ts

@@ -11,6 +11,7 @@ import spawn from 'cross-spawn'
 import { fetchWithTimeout, type FetchWithTimeoutInit } from '@open-mercato/shared/lib/http/fetchWithTimeout'
 import { isUnsafeJwtSecret } from '@open-mercato/shared/lib/auth/jwt'
 import { resolveEnvironment } from '../resolver'
+import { resolveInitSuperadminCredentials } from '../init-secrets'
 import { resolveSpawnCommand } from '../spawn'
 import { discoverIntegrationSpecFiles as discoverIntegrationSpecFilesShared } from './integration-discovery'
 import { resolveDockerHostFromContext, runCommandAndCapture } from './runtime-utils'
@@ -202,6 +203,23 @@ export function resolveEphemeralJwtSecret(env: NodeJS.ProcessEnv = process.env):
   }
   return DEFAULT_EPHEMERAL_JWT_SECRET
 }
+const DEFAULT_EPHEMERAL_SUPERADMIN_PASSWORD = 'Om-Ephemeral-Superadmin-2026!'
+
+export function resolveEphemeralSuperadminPassword(env: NodeJS.ProcessEnv = process.env): string {
+  const inherited = env.OM_INIT_SUPERADMIN_PASSWORD
+  if (inherited !== undefined && inherited.trim().length > 0) {
+    try {
+      resolveInitSuperadminCredentials([], { ...env, NODE_ENV: 'production', OM_INIT_SUPERADMIN_PASSWORD: inherited })
+      return inherited
+    } catch {
+      console.warn(
+        '[integration] Ignoring the inherited OM_INIT_SUPERADMIN_PASSWORD: it is a placeholder or fails the password policy and the ephemeral app initializes with NODE_ENV=production. Using the ephemeral default instead.',
+      )
+    }
+  }
+  return DEFAULT_EPHEMERAL_SUPERADMIN_PASSWORD
+}
+
 const PLAYWRIGHT_ENV_UNAVAILABLE_PATTERNS: RegExp[] = [
   /net::ERR_CONNECTION_REFUSED/i,
   /Failed to connect to .* (localhost|127\.0\.0\.1)/i,
@@ -2197,6 +2215,7 @@ function buildReusableEnvironment(
     // OM_INIT_*_PASSWORD to fix the seeded credential.
     OM_INIT_ADMIN_PASSWORD: process.env.OM_INIT_ADMIN_PASSWORD ?? 'secret',
     OM_INIT_EMPLOYEE_PASSWORD: process.env.OM_INIT_EMPLOYEE_PASSWORD ?? 'secret',
+    OM_INIT_SUPERADMIN_PASSWORD: resolveEphemeralSuperadminPassword(),
     OM_INTEGRATION_TEST: 'true',
     OM_ENABLE_ENTERPRISE_MODULES: enterpriseModulesFlag,
     OM_ENABLE_ENTERPRISE_MODULES_SSO: process.env.OM_ENABLE_ENTERPRISE_MODULES_SSO ?? enterpriseModulesFlag,
@@ -3585,6 +3604,10 @@ export async function startEphemeralEnvironment(options: EphemeralRuntimeOptions
       // NODE_ENV=production.
       OM_INIT_ADMIN_PASSWORD: process.env.OM_INIT_ADMIN_PASSWORD ?? 'secret',
       OM_INIT_EMPLOYEE_PASSWORD: process.env.OM_INIT_EMPLOYEE_PASSWORD ?? 'secret',
+      // Production init refuses a missing or placeholder superadmin password
+      // (#8896). Integration auth helpers read OM_INIT_SUPERADMIN_PASSWORD, so
+      // the Playwright runner logs in with the same value.
+      OM_INIT_SUPERADMIN_PASSWORD: resolveEphemeralSuperadminPassword(),
       // Pool sizing for the ephemeral integration runtime. Defaults were once
       // very aggressive (max=5, idle=1000) which exposed flaky 'timeout exceeded
       // when trying to connect' errors on `progressService.createJob`-backed