@open-mercato/cli 0.6.3-develop.3602.1.8287bc577d → 0.6.3-develop.3609.1.01983ef87a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.6.3-develop.3602.1.8287bc577d",
+  "version": "0.6.3-develop.3609.1.01983ef87a",
   "type": "module",
   "main": "./dist/index.js",
   "exports": {
@@ -59,8 +59,8 @@
     "@mikro-orm/decorators": "^7.0.17",
     "@mikro-orm/migrations": "^7.0.17",
     "@mikro-orm/postgresql": "^7.0.17",
-    "@open-mercato/queue": "0.6.3-develop.3602.1.8287bc577d",
-    "@open-mercato/shared": "0.6.3-develop.3602.1.8287bc577d",
+    "@open-mercato/queue": "0.6.3-develop.3609.1.01983ef87a",
+    "@open-mercato/shared": "0.6.3-develop.3609.1.01983ef87a",
     "cross-spawn": "^7.0.6",
     "pg": "8.21.0",
     "semver": "^7.8.0",
@@ -70,10 +70,10 @@
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.3-develop.3602.1.8287bc577d"
+    "@open-mercato/shared": "0.6.3-develop.3609.1.01983ef87a"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.3-develop.3602.1.8287bc577d",
+    "@open-mercato/shared": "0.6.3-develop.3609.1.01983ef87a",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.9"

package/src/lib/generators/__tests__/module-subset.test.ts

@@ -768,6 +768,148 @@ export function GET() {
     )
   })
 
+  it('emits imports for third-party scoped npm packages registered via src/modules.ts', async () => {
+    // Simulate a third-party module package published at @dainamite/cpq
+    // (see issue #1998). The generator must accept @<vendor>/<package> specifiers
+    // and emit imports that point at the package's modules/<id> subtree.
+    const pkgModuleBase = path.join(
+      tmpDir,
+      'packages',
+      'thirdparty',
+      'src',
+      'modules',
+      'cpq',
+    )
+    touchFile(
+      path.join(pkgModuleBase, 'subscribers', 'on-event.ts'),
+      `export const metadata = { event: 'cpq.quote.created' }\nexport default async function handler() {}\n`,
+    )
+
+    const baseResolver = createMockResolver(tmpDir, [
+      { id: 'cpq', from: '@dainamite/cpq' },
+    ])
+    const resolver: PackageResolver = {
+      ...baseResolver,
+      getModulePaths: (entry: ModuleEntry) => ({
+        appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+        pkgBase: pkgModuleBase,
+      }),
+      getModuleImportBase: (entry: ModuleEntry) => ({
+        appBase: `@/modules/${entry.id}`,
+        pkgBase: `@dainamite/cpq/modules/${entry.id}`,
+      }),
+    }
+
+    const result = await generateModuleRegistry({ resolver, quiet: true })
+    expect(result.errors).toEqual([])
+
+    const output = readGenerated(tmpDir, 'modules.generated.ts')!
+    expect(output).toContain('id: "cpq"')
+    expect(output).toContain('@dainamite/cpq/modules/cpq/subscribers/on-event')
+  })
+
+  it('emits imports for bare (unscoped) third-party npm packages', async () => {
+    const pkgModuleBase = path.join(
+      tmpDir,
+      'packages',
+      'thirdparty-bare',
+      'src',
+      'modules',
+      'foo',
+    )
+    touchFile(
+      path.join(pkgModuleBase, 'subscribers', 'on-event.ts'),
+      `export const metadata = { event: 'foo.thing.created' }\nexport default async function handler() {}\n`,
+    )
+
+    const baseResolver = createMockResolver(tmpDir, [
+      { id: 'foo', from: 'acme-modules' },
+    ])
+    const resolver: PackageResolver = {
+      ...baseResolver,
+      getModulePaths: (entry: ModuleEntry) => ({
+        appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+        pkgBase: pkgModuleBase,
+      }),
+      getModuleImportBase: (entry: ModuleEntry) => ({
+        appBase: `@/modules/${entry.id}`,
+        pkgBase: `acme-modules/modules/${entry.id}`,
+      }),
+    }
+
+    const result = await generateModuleRegistry({ resolver, quiet: true })
+    expect(result.errors).toEqual([])
+
+    const output = readGenerated(tmpDir, 'modules.generated.ts')!
+    expect(output).toContain('id: "foo"')
+    expect(output).toContain('acme-modules/modules/foo/subscribers/on-event')
+  })
+
+  it('fails fast when a third-party module entry points at a package without the expected OM module shape', async () => {
+    // No files scaffolded — the package directory does not exist, so the
+    // entry is almost certainly not an Open Mercato module.
+    const enabled: ModuleEntry[] = [{ id: 'cpq', from: '@dainamite/cpq' }]
+    const baseResolver = createMockResolver(tmpDir, enabled)
+    const resolver: PackageResolver = {
+      ...baseResolver,
+      getModulePaths: (entry: ModuleEntry) => ({
+        appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+        pkgBase: path.join(
+          tmpDir,
+          'node_modules',
+          '@dainamite',
+          'cpq',
+          'dist',
+          'modules',
+          entry.id,
+        ),
+      }),
+      getModuleImportBase: (entry: ModuleEntry) => ({
+        appBase: `@/modules/${entry.id}`,
+        pkgBase: `@dainamite/cpq/modules/${entry.id}`,
+      }),
+    }
+
+    await expect(generateModuleRegistry({ resolver, quiet: true })).rejects.toThrow(
+      /no Open Mercato module shape was found/,
+    )
+  })
+
+  it('rejects third-party specifiers with path-traversal segments', async () => {
+    const pkgModuleBase = path.join(
+      tmpDir,
+      'packages',
+      'thirdparty-traversal',
+      'src',
+      'modules',
+      'evil',
+    )
+    touchFile(
+      path.join(pkgModuleBase, 'subscribers', 'on-event.ts'),
+      `export const metadata = { event: 'evil.x' }\nexport default async function handler() {}\n`,
+    )
+
+    const baseResolver = createMockResolver(tmpDir, [
+      { id: 'evil', from: '@vendor/pkg' },
+    ])
+    const resolver: PackageResolver = {
+      ...baseResolver,
+      getModulePaths: (entry: ModuleEntry) => ({
+        appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+        pkgBase: pkgModuleBase,
+      }),
+      // Inject a malicious specifier with a ".." segment.
+      getModuleImportBase: (entry: ModuleEntry) => ({
+        appBase: `@/modules/${entry.id}`,
+        pkgBase: `@vendor/pkg/../escape/modules/${entry.id}`,
+      }),
+    }
+
+    await expect(generateModuleRegistry({ resolver, quiet: true })).rejects.toThrow(
+      /Unsafe generated module specifier/,
+    )
+  })
+
   it('mixed subset: core module + app module, then remove core module', async () => {
     scaffoldModule(tmpDir, 'core_mod', 'pkg', [
       'backend/page.tsx',

package/src/lib/generators/module-registry.ts

@@ -925,8 +925,12 @@ function toLiteral(value: unknown): string {
     .replace(/\u2029/g, '\\u2029')
 }
 
-const GENERATED_MODULE_SPECIFIER_PREFIXES = ['@/', '@open-mercato/', '../../src/modules/', './'] as const
+const GENERATED_MODULE_RELATIVE_PREFIXES = ['@/', '../../src/modules/', './'] as const
 const GENERATED_MODULE_SPECIFIER_SEGMENT = /^[A-Za-z0-9_.\-[\]()']+$/
+// Lenient npm package name matcher. Accepts legacy uppercase packages and
+// tilde-prefixed names, bans leading "." / "_", and reserves "@" for scope
+// markers so the dispatcher below can split scope-vs-bare unambiguously.
+const NPM_PACKAGE_NAME_SEGMENT = /^[A-Za-z0-9~][A-Za-z0-9_.~-]*$/
 
 function sanitizeGeneratedModuleSpecifierSegment(segment: string, importPath: string): string {
   const match = GENERATED_MODULE_SPECIFIER_SEGMENT.exec(segment)
@@ -936,22 +940,83 @@ function sanitizeGeneratedModuleSpecifierSegment(segment: string, importPath: st
   return match[0]
 }
 
-function sanitizeGeneratedModuleSpecifier(importPath: string): string {
-  const prefix = GENERATED_MODULE_SPECIFIER_PREFIXES.find((candidate) => importPath.startsWith(candidate))
-  if (!prefix) {
-    throw new Error(`Unsafe generated module specifier prefix: ${importPath}`)
+function sanitizeNpmPackageNameSegment(segment: string, importPath: string): void {
+  if (!NPM_PACKAGE_NAME_SEGMENT.test(segment) || segment === '.' || segment === '..') {
+    throw new Error(`Unsafe generated module specifier: ${importPath}`)
   }
+}
 
-  const suffix = importPath.slice(prefix.length)
-  if (!suffix) {
+function sanitizeGeneratedModuleSpecifier(importPath: string): string {
+  if (!importPath) {
     throw new Error(`Unsafe generated module specifier: ${importPath}`)
   }
 
-  const segments = suffix
+  const relativePrefix = GENERATED_MODULE_RELATIVE_PREFIXES.find((candidate) =>
+    importPath.startsWith(candidate),
+  )
+  if (relativePrefix) {
+    const suffix = importPath.slice(relativePrefix.length)
+    if (!suffix) {
+      throw new Error(`Unsafe generated module specifier: ${importPath}`)
+    }
+    const segments = suffix
+      .split('/')
+      .map((segment) => sanitizeGeneratedModuleSpecifierSegment(segment, importPath))
+    return `${relativePrefix}${segments.join('/')}`
+  }
+
+  if (importPath.startsWith('@')) {
+    // Scoped npm package: @scope/name[/subpath]
+    const firstSlash = importPath.indexOf('/')
+    if (firstSlash < 2) {
+      throw new Error(`Unsafe generated module specifier prefix: ${importPath}`)
+    }
+    const scope = importPath.slice(1, firstSlash)
+    sanitizeNpmPackageNameSegment(scope, importPath)
+    const rest = importPath.slice(firstSlash + 1)
+    if (!rest) {
+      throw new Error(`Unsafe generated module specifier: ${importPath}`)
+    }
+    const secondSlash = rest.indexOf('/')
+    const name = secondSlash >= 0 ? rest.slice(0, secondSlash) : rest
+    sanitizeNpmPackageNameSegment(name, importPath)
+    const subpath = secondSlash >= 0 ? rest.slice(secondSlash + 1) : ''
+    if (!subpath) {
+      return `@${scope}/${name}`
+    }
+    const segments = subpath
+      .split('/')
+      .map((segment) => sanitizeGeneratedModuleSpecifierSegment(segment, importPath))
+    return `@${scope}/${name}/${segments.join('/')}`
+  }
+
+  // Bare npm package: name[/subpath]
+  const firstSlash = importPath.indexOf('/')
+  const name = firstSlash >= 0 ? importPath.slice(0, firstSlash) : importPath
+  sanitizeNpmPackageNameSegment(name, importPath)
+  const subpath = firstSlash >= 0 ? importPath.slice(firstSlash + 1) : ''
+  if (!subpath) {
+    return name
+  }
+  const segments = subpath
     .split('/')
     .map((segment) => sanitizeGeneratedModuleSpecifierSegment(segment, importPath))
-
-  return `${prefix}${segments.join('/')}`
+  return `${name}/${segments.join('/')}`
+}
+
+// Defense in depth: when src/modules.ts registers a module from a third-party
+// npm scope (anything outside @app / @open-mercato/*), verify the resolved
+// pkgBase directory exists. If it doesn't, the package referenced via `from:`
+// is almost certainly not an Open Mercato module (or the id is wrong), and
+// silently emitting an empty module registration would hide the misconfig.
+function verifyThirdPartyModuleShape(entry: { id: string; from?: string }, pkgBase: string): void {
+  const from = entry.from
+  if (!from || from === '@app' || from.startsWith('@open-mercato/')) return
+  if (fs.existsSync(pkgBase)) return
+  throw new Error(
+    `Module '${entry.id}' is registered with from: '${from}' but no Open Mercato module shape was found at '${pkgBase}'. ` +
+      `Ensure the package ships a 'modules/${entry.id}' subtree (either under 'dist/modules/' or 'src/modules/'), or correct the 'from' value in src/modules.ts.`,
+  )
 }
 
 function buildImportStatement(importClause: string, importPath: string): string {
@@ -2502,6 +2567,9 @@ export async function generateModuleRegistry(options: ModuleRegistryOptions): Pr
   const legacySubscribersChecksumFile = path.join(outputDir, 'subscribers.generated.checksum')
 
   const enabled = resolver.loadEnabledModules()
+  for (const entry of enabled) {
+    verifyThirdPartyModuleShape(entry, resolver.getModulePaths(entry).pkgBase)
+  }
   const extensions = loadGeneratorExtensions()
 
   // Pre-pass: collect generator plugins from each enabled module's generators.ts
@@ -3118,6 +3186,9 @@ export async function generateModuleRegistryApp(options: ModuleRegistryOptions):
   const enabledIdsChecksumFile = path.join(outputDir, 'enabled-module-ids.generated.checksum')
 
   const enabled = resolver.loadEnabledModules()
+  for (const entry of enabled) {
+    verifyThirdPartyModuleShape(entry, resolver.getModulePaths(entry).pkgBase)
+  }
   const imports: string[] = []
   const moduleDecls: WriterFunction[] = []
   const importIdRef = { value: 0 }
@@ -3449,6 +3520,9 @@ export async function generateModuleRegistryCli(options: ModuleRegistryOptions):
   const legacyChecksumFile = path.join(outputDir, 'cli-modules.generated.checksum')
 
   const enabled = resolver.loadEnabledModules()
+  for (const entry of enabled) {
+    verifyThirdPartyModuleShape(entry, resolver.getModulePaths(entry).pkgBase)
+  }
   const imports: string[] = []
   const moduleDecls: WriterFunction[] = []
   // Mutable ref so extracted helper functions can increment the shared counter

package/src/lib/testing/integration.ts

@@ -2906,10 +2906,19 @@ export async function startEphemeralEnvironment(options: EphemeralRuntimeOptions
       JWT_SECRET: process.env.JWT_SECRET ?? 'om-ephemeral-integration-jwt-secret',
       OM_SECURITY_MFA_SETUP_SECRET: process.env.OM_SECURITY_MFA_SETUP_SECRET ?? 'om-ephemeral-integration-mfa-setup-secret',
       NODE_ENV: 'production',
-      DB_POOL_MIN: '0',
-      DB_POOL_MAX: '5',
-      DB_POOL_IDLE_TIMEOUT: '1000',
-      DB_POOL_ACQUIRE_TIMEOUT: '10000',
+      // Pool sizing for the ephemeral integration runtime. Defaults were once
+      // very aggressive (max=5, idle=1000) which exposed flaky 'timeout exceeded
+      // when trying to connect' errors on `progressService.createJob`-backed
+      // endpoints (sync_excel.import, data_sync.run, progress.jobs) — each
+      // request acquires a transaction connection plus a separate connection
+      // for the encryption subscriber's fetchMap probe, and with 1s idle close
+      // the pool thrashes faster than pg-pool can repopulate. These values
+      // still keep the pool tighter than production but give enough headroom
+      // for the legitimate query bursts.
+      DB_POOL_MIN: '2',
+      DB_POOL_MAX: '20',
+      DB_POOL_IDLE_TIMEOUT: '10000',
+      DB_POOL_ACQUIRE_TIMEOUT: '15000',
       DB_IDLE_SESSION_TIMEOUT_MS: '30000',
       DB_IDLE_IN_TRANSACTION_TIMEOUT_MS: '30000',
       OM_INTEGRATION_TEST: 'true',