npm - @open-mercato/cli - Versions diffs - 0.6.6-develop.6458.1.113a54fb91 → 0.6.6-develop.6465.1.019f0fb26f - Mend

@open-mercato/cli 0.6.6-develop.6458.1.113a54fb91 → 0.6.6-develop.6465.1.019f0fb26f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (79) hide show

package/.turbo/turbo-build.log +45 -1
package/build.mjs +25 -15
package/dist/agentic/guides/module-facts.json +3375 -349
package/dist/agentic/guides/modules/ai_assistant.md +57 -0
package/dist/agentic/guides/modules/api_docs.md +39 -0
package/dist/agentic/guides/modules/api_keys.md +41 -0
package/dist/agentic/guides/modules/attachments.md +46 -0
package/dist/agentic/guides/modules/audit_logs.md +42 -0
package/dist/agentic/guides/modules/auth.md +1 -1
package/dist/agentic/guides/modules/business_rules.md +44 -0
package/dist/agentic/guides/modules/catalog.md +1 -1
package/dist/agentic/guides/modules/channel_gmail.md +39 -0
package/dist/agentic/guides/modules/channel_imap.md +39 -0
package/dist/agentic/guides/modules/checkout.md +60 -0
package/dist/agentic/guides/modules/communication_channels.md +65 -0
package/dist/agentic/guides/modules/configs.md +42 -0
package/dist/agentic/guides/modules/content.md +39 -0
package/dist/agentic/guides/modules/currencies.md +1 -1
package/dist/agentic/guides/modules/customer_accounts.md +1 -1
package/dist/agentic/guides/modules/customers.md +1 -1
package/dist/agentic/guides/modules/dashboards.md +43 -0
package/dist/agentic/guides/modules/data_sync.md +1 -1
package/dist/agentic/guides/modules/dictionaries.md +46 -0
package/dist/agentic/guides/modules/directory.md +49 -0
package/dist/agentic/guides/modules/entities.md +46 -0
package/dist/agentic/guides/modules/events.md +39 -0
package/dist/agentic/guides/modules/feature_toggles.md +42 -0
package/dist/agentic/guides/modules/gateway_stripe.md +39 -0
package/dist/agentic/guides/modules/generators.md +39 -0
package/dist/agentic/guides/modules/inbox_ops.md +59 -0
package/dist/agentic/guides/modules/integrations.md +1 -1
package/dist/agentic/guides/modules/messages.md +55 -0
package/dist/agentic/guides/modules/notifications.md +41 -0
package/dist/agentic/guides/modules/onboarding.md +41 -0
package/dist/agentic/guides/modules/payment_gateways.md +52 -0
package/dist/agentic/guides/modules/perspectives.md +42 -0
package/dist/agentic/guides/modules/planner.md +49 -0
package/dist/agentic/guides/modules/portal.md +39 -0
package/dist/agentic/guides/modules/progress.md +48 -0
package/dist/agentic/guides/modules/query_index.md +46 -0
package/dist/agentic/guides/modules/record_locks.md +53 -0
package/dist/agentic/guides/modules/resources.md +62 -0
package/dist/agentic/guides/modules/sales.md +1 -1
package/dist/agentic/guides/modules/scheduler.md +46 -0
package/dist/agentic/guides/modules/search.md +39 -0
package/dist/agentic/guides/modules/security.md +67 -0
package/dist/agentic/guides/modules/shipping_carriers.md +51 -0
package/dist/agentic/guides/modules/sso.md +59 -0
package/dist/agentic/guides/modules/staff.md +88 -0
package/dist/agentic/guides/modules/storage_s3.md +39 -0
package/dist/agentic/guides/modules/sync_akeneo.md +39 -0
package/dist/agentic/guides/modules/sync_excel.md +41 -0
package/dist/agentic/guides/modules/system_status_overlays.md +39 -0
package/dist/agentic/guides/modules/translations.md +44 -0
package/dist/agentic/guides/modules/webhooks.md +54 -0
package/dist/agentic/guides/modules/workflows.md +1 -1
package/dist/lib/generators/index.js +0 -2
package/dist/lib/generators/index.js.map +2 -2
package/dist/lib/generators/module-facts-discovery.js +46 -0
package/dist/lib/generators/module-facts-discovery.js.map +7 -0
package/dist/lib/generators/module-facts.js +14 -8
package/dist/lib/generators/module-facts.js.map +2 -2
package/dist/lib/testing/integration.js +185 -5
package/dist/lib/testing/integration.js.map +2 -2
package/dist/mercato.js +1 -3
package/dist/mercato.js.map +2 -2
package/package.json +5 -5
package/src/__tests__/mercato.test.ts +0 -5
package/src/lib/generators/__tests__/module-facts.bc-guard.test.ts +36 -23
package/src/lib/generators/__tests__/module-facts.discovery.test.ts +88 -0
package/src/lib/generators/index.ts +0 -1
package/src/lib/generators/module-facts-discovery.ts +58 -0
package/src/lib/generators/module-facts.ts +50 -10
package/src/lib/testing/__tests__/integration.test.ts +228 -6
package/src/lib/testing/integration.ts +231 -3
package/src/mercato.ts +0 -2
package/dist/lib/generators/module-facts-generate.js +0 -52
package/dist/lib/generators/module-facts-generate.js.map +0 -7
package/src/lib/generators/module-facts-generate.ts +0 -68

package/src/lib/testing/__tests__/integration.test.ts CHANGED Viewed

@@ -33,6 +33,11 @@ const projectRootDirectory = resolver.getRootDir()
 const appDirectory = path.join(projectRootDirectory, 'apps', 'mercato')
 const defaultPrivateAttachmentsRoot = path.join(appDirectory, 'storage', 'attachments', 'privateAttachments')
+const makeSetCookieHeaders = (cookies: string[]): Headers => ({
+  get: (name: string) => (name.toLowerCase() === 'set-cookie' ? cookies.join(', ') : null),
+  getSetCookie: () => cookies,
+}) as unknown as Headers
 const mockHealthyReadinessFetch = (
   overrides: {
     loginPageResponse?: { status: number; text?: string }
@@ -45,6 +50,10 @@ const mockHealthyReadinessFetch = (
       return {
         status: 200,
         ok: true,
+        headers: makeSetCookieHeaders([
+          'auth_token=test-auth-token; Path=/; HttpOnly; SameSite=Lax',
+          'session_token=test-session-token; Path=/; HttpOnly; SameSite=Lax',
+        ]),
         text: async () => JSON.stringify({ token: 'test-admin-token' }),
       } as unknown as Response
     }
@@ -68,6 +77,9 @@ const mockHealthyReadinessFetch = (
       text: async () => '<!doctype html><script src="/_next/static/chunks/app-healthcheck.js"></script>',
     } as unknown as Response
   }
+  if (url.endsWith('/backend')) {
+    return { status: 200, ok: true, text: async () => '' } as unknown as Response
+  }
   if (url.includes('/_next/static/chunks/app-healthcheck.js')) {
     return { status: 200, ok: true, text: async () => '' } as unknown as Response
   }
@@ -515,7 +527,7 @@ describe('integration cache and options', () => {
       ).resolves.toBe(false)
       await writeFile(sourceFile, 'const value = 1')
-      await writeFile(sourceFile, 'const value = 2')
+      await writeFile(sourceFile, 'const value = 22')
       await expect(
         shouldReuseBuildArtifacts(120, 'integration', {
           inputPaths: [sourceFile],
@@ -628,6 +640,204 @@ describe('waitForApplicationReadiness', () => {
   const makeFakeProcess = (): ChildProcess => new EventEmitter() as unknown as ChildProcess
   const sleep = (ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms))
+  it('verifies backend browser navigation with cookies returned by login', async () => {
+    let backendCookieHeader: string | null = null
+    const fetchSpy = jest.spyOn(global, 'fetch').mockImplementation(async (input, init) => {
+      const url = typeof input === 'string' ? input : String(input)
+      const body = typeof init?.body === 'string' ? init.body : ''
+      if (url.endsWith('/api/auth/login')) {
+        if (body.includes('email=admin%40acme.com')) {
+          return {
+            status: 200,
+            ok: true,
+            headers: makeSetCookieHeaders([
+              'auth_token=secret-auth-value; Path=/; HttpOnly; SameSite=Lax',
+              'session_token=secret-session-value; Path=/; HttpOnly; SameSite=Lax',
+            ]),
+            text: async () => JSON.stringify({ token: 'token' }),
+          } as unknown as Response
+        }
+        return { status: 401, ok: false, text: async () => '' } as unknown as Response
+      }
+      if (url.endsWith('/login')) {
+        return {
+          status: 200,
+          ok: true,
+          text: async () => '<!doctype html><script src="/_next/static/chunks/app.js"></script>',
+        } as unknown as Response
+      }
+      if (url.includes('/api/customers/people')) {
+        return { status: 200, ok: true, text: async () => JSON.stringify({ items: [] }) } as unknown as Response
+      }
+      if (url.endsWith('/backend')) {
+        backendCookieHeader = typeof init?.headers === 'object'
+          && init.headers !== null
+          && !Array.isArray(init.headers)
+          ? String((init.headers as Record<string, unknown>).Cookie ?? '')
+          : ''
+        return { status: backendCookieHeader ? 200 : 307, ok: Boolean(backendCookieHeader), text: async () => '' } as unknown as Response
+      }
+      return { status: 200, ok: true, text: async () => '' } as unknown as Response
+    })
+    try {
+      await waitForApplicationReadiness('http://127.0.0.1:5001', makeFakeProcess(), {
+        timeoutMs: 1_000,
+        intervalMs: 5,
+        stabilizationMs: 10,
+      })
+      expect(backendCookieHeader).toContain('auth_token=secret-auth-value')
+      expect(backendCookieHeader).toContain('session_token=secret-session-value')
+    } finally {
+      fetchSpy.mockRestore()
+    }
+  })
+  it('reports backend auth redirect loops without leaking cookie values', async () => {
+    const fetchSpy = jest.spyOn(global, 'fetch').mockImplementation(async (input, init) => {
+      const url = typeof input === 'string' ? input : String(input)
+      const body = typeof init?.body === 'string' ? init.body : ''
+      if (url.endsWith('/api/auth/login')) {
+        if (body.includes('email=admin%40acme.com')) {
+          return {
+            status: 200,
+            ok: true,
+            headers: makeSetCookieHeaders([
+              'auth_token=secret-auth-value; Path=/; HttpOnly; SameSite=Lax',
+              'session_token=secret-session-value; Path=/; HttpOnly; SameSite=Lax',
+            ]),
+            text: async () => JSON.stringify({ token: 'token' }),
+          } as unknown as Response
+        }
+        return { status: 401, ok: false, text: async () => '' } as unknown as Response
+      }
+      if (url.endsWith('/login')) {
+        return {
+          status: 200,
+          ok: true,
+          text: async () => '<!doctype html><script src="/_next/static/chunks/app.js"></script>',
+        } as unknown as Response
+      }
+      if (url.includes('/api/customers/people')) {
+        return { status: 200, ok: true, text: async () => JSON.stringify({ items: [] }) } as unknown as Response
+      }
+      if (url.endsWith('/backend')) {
+        return {
+          status: 307,
+          ok: false,
+          headers: {
+            get: (name: string) => (name.toLowerCase() === 'location' ? '/api/auth/session/refresh' : null),
+            getSetCookie: () => [],
+          },
+          text: async () => '',
+        } as unknown as Response
+      }
+      if (url.endsWith('/api/auth/session/refresh')) {
+        return {
+          status: 307,
+          ok: false,
+          headers: {
+            get: (name: string) => (name.toLowerCase() === 'location' ? '/backend' : null),
+            getSetCookie: () => ['auth_token=rotated-secret-value; Path=/; HttpOnly; SameSite=Lax'],
+          },
+          text: async () => '',
+        } as unknown as Response
+      }
+      return { status: 200, ok: true, text: async () => '' } as unknown as Response
+    })
+    try {
+      let error: Error | null = null
+      try {
+        await waitForApplicationReadiness('http://127.0.0.1:5001', makeFakeProcess(), {
+          timeoutMs: 50,
+          intervalMs: 5,
+          stabilizationMs: 10,
+        })
+      } catch (caught) {
+        error = caught instanceof Error ? caught : new Error(String(caught))
+      }
+      expect(error).not.toBeNull()
+      expect(error?.message).toMatch(/Backend browser auth probe detected redirect loop/)
+      expect(error?.message).not.toMatch(/secret-(auth|session)|rotated-secret/)
+    } finally {
+      fetchSpy.mockRestore()
+    }
+  })
+  it('rejects unsafe backend auth redirects without following them', async () => {
+    let externalRedirectFetches = 0
+    const fetchSpy = jest.spyOn(global, 'fetch').mockImplementation(async (input, init) => {
+      const url = typeof input === 'string' ? input : String(input)
+      const body = typeof init?.body === 'string' ? init.body : ''
+      if (url.includes('evil.example')) {
+        externalRedirectFetches += 1
+        return { status: 200, ok: true, text: async () => '' } as unknown as Response
+      }
+      if (url.endsWith('/api/auth/login')) {
+        if (body.includes('email=admin%40acme.com')) {
+          return {
+            status: 200,
+            ok: true,
+            headers: makeSetCookieHeaders([
+              'auth_token=secret-auth-value; Path=/; HttpOnly; SameSite=Lax',
+              'session_token=secret-session-value; Path=/; HttpOnly; SameSite=Lax',
+            ]),
+            text: async () => JSON.stringify({ token: 'token' }),
+          } as unknown as Response
+        }
+        return { status: 401, ok: false, text: async () => '' } as unknown as Response
+      }
+      if (url.endsWith('/login')) {
+        return {
+          status: 200,
+          ok: true,
+          text: async () => '<!doctype html><script src="/_next/static/chunks/app.js"></script>',
+        } as unknown as Response
+      }
+      if (url.includes('/api/customers/people')) {
+        return { status: 200, ok: true, text: async () => JSON.stringify({ items: [] }) } as unknown as Response
+      }
+      if (url.endsWith('/backend')) {
+        return {
+          status: 307,
+          ok: false,
+          headers: {
+            get: (name: string) => (name.toLowerCase() === 'location' ? '//evil.example/session' : null),
+            getSetCookie: () => [],
+          },
+          text: async () => '',
+        } as unknown as Response
+      }
+      return { status: 200, ok: true, text: async () => '' } as unknown as Response
+    })
+    try {
+      let error: Error | null = null
+      try {
+        await waitForApplicationReadiness('http://127.0.0.1:5001', makeFakeProcess(), {
+          timeoutMs: 50,
+          intervalMs: 5,
+          stabilizationMs: 10,
+        })
+      } catch (caught) {
+        error = caught instanceof Error ? caught : new Error(String(caught))
+      }
+      expect(error).not.toBeNull()
+      expect(error?.message).toMatch(/unsafe redirect: protocol-relative redirect/)
+      expect(error?.message).not.toMatch(/secret-(auth|session)/)
+      expect(externalRedirectFetches).toBe(0)
+    } finally {
+      fetchSpy.mockRestore()
+    }
+  })
   it('serializes probe cycles so slow probes never pile up concurrent login attempts', async () => {
     let inFlight = 0
     let maxInFlight = 0
@@ -639,7 +849,7 @@ describe('waitForApplicationReadiness', () => {
       maxInFlight = Math.max(maxInFlight, inFlight)
       try {
         // Each probe fetch is slower than the retry interval; the old race-against-a-tick loop
-        // would launch overlapping cycles here and blow past 3 concurrent in-flight requests.
+        // would launch overlapping cycles here and blow past one cycle's concurrent requests.
         await sleep(40)
         const isLoginPage = url.endsWith('/login') && !url.endsWith('/api/auth/login')
         if (isLoginPage) {
@@ -654,11 +864,22 @@ describe('waitForApplicationReadiness', () => {
           } as unknown as Response
         }
         if (url.endsWith('/api/auth/login')) {
-          return { status: 200, ok: true, text: async () => JSON.stringify({ token: 'token' }) } as unknown as Response
+          return {
+            status: 200,
+            ok: true,
+            headers: makeSetCookieHeaders([
+              'auth_token=test-auth-token; Path=/; HttpOnly; SameSite=Lax',
+              'session_token=test-session-token; Path=/; HttpOnly; SameSite=Lax',
+            ]),
+            text: async () => JSON.stringify({ token: 'token' }),
+          } as unknown as Response
         }
         if (url.includes('/api/customers/people')) {
           return { status: 200, ok: true, text: async () => JSON.stringify({ items: [] }) } as unknown as Response
         }
+        if (url.endsWith('/backend')) {
+          return { status: 200, ok: true, text: async () => '' } as unknown as Response
+        }
         return { status: 200, ok: true, text: async () => '' } as unknown as Response
       } finally {
         inFlight -= 1
@@ -671,9 +892,10 @@ describe('waitForApplicationReadiness', () => {
         intervalMs: 5,
         stabilizationMs: 10,
       })
-      // One cycle issues exactly three parallel probe fetches (login page, backend login,
-      // authenticated login). Serialized cycles keep the peak at three; overlap would exceed it.
-      expect(maxInFlight).toBeLessThanOrEqual(3)
+      // One cycle issues exactly four parallel probe fetches (login page, backend login,
+      // authenticated API, and backend browser-cookie navigation). Serialized cycles keep the
+      // peak at four; overlap would exceed it.
+      expect(maxInFlight).toBeLessThanOrEqual(4)
       expect(loginPageCycles).toBeGreaterThanOrEqual(3)
     } finally {
       fetchSpy.mockRestore()

package/src/lib/testing/integration.ts CHANGED Viewed

@@ -318,6 +318,7 @@ const FOLDER_TO_CATEGORY_CODE: Record<string, string> = {
   api: 'API',
   integration: 'INT',
 }
+const BACKEND_BROWSER_AUTH_REDIRECT_LIMIT = 6
 const BUILD_CACHE_STATE_VERSION = 2
 const BUILD_CACHE_ENV_KEYS = [
   'NODE_ENV',
@@ -393,11 +394,19 @@ type AuthenticatedApiProbeResult = {
   detail: string
 }
+type BackendBrowserAuthProbeResult = {
+  loginStatus: number | null
+  backendStatus: number | null
+  healthy: boolean
+  detail: string
+}
 type ApplicationReadinessProbeResult = {
   ready: boolean
   frontend: LoginPageProbeResult
   backend: BackendLoginProbeResult
   authenticated: AuthenticatedApiProbeResult
+  backendBrowserAuth: BackendBrowserAuthProbeResult
 }
 type PlaywrightFailureHealthCheckOptions = {
@@ -1473,18 +1482,236 @@ async function probeAuthenticatedApi(baseUrl: string): Promise<AuthenticatedApiP
   }
 }
+type HeadersWithSetCookie = Headers & {
+  getSetCookie?: () => string[]
+}
+function splitSetCookieHeader(header: string): string[] {
+  return header
+    .split(/,(?=\s*[^;,\s=]+=)/)
+    .map((value) => value.trim())
+    .filter((value) => value.length > 0)
+}
+function getSetCookieHeaders(headers: Headers | undefined): string[] {
+  if (!headers) {
+    return []
+  }
+  const setCookieGetter = (headers as HeadersWithSetCookie).getSetCookie
+  if (typeof setCookieGetter === 'function') {
+    return setCookieGetter.call(headers)
+      .map((value) => value.trim())
+      .filter((value) => value.length > 0)
+  }
+  const combined = headers.get('set-cookie')
+  return combined ? splitSetCookieHeader(combined) : []
+}
+function parseSetCookiePair(header: string): { name: string; value: string } | null {
+  const pair = header.split(';', 1)[0]?.trim()
+  if (!pair) {
+    return null
+  }
+  const equalsIndex = pair.indexOf('=')
+  if (equalsIndex <= 0) {
+    return null
+  }
+  const name = pair.slice(0, equalsIndex).trim()
+  if (!name) {
+    return null
+  }
+  return {
+    name,
+    value: pair.slice(equalsIndex + 1),
+  }
+}
+function addSetCookieHeadersToJar(jar: Map<string, string>, headers: Headers | undefined): void {
+  for (const setCookieHeader of getSetCookieHeaders(headers)) {
+    const pair = parseSetCookiePair(setCookieHeader)
+    if (pair) {
+      jar.set(pair.name, pair.value)
+    }
+  }
+}
+function serializeCookieJar(jar: Map<string, string>): string {
+  return [...jar.entries()].map(([name, value]) => `${name}=${value}`).join('; ')
+}
+function formatCookieNames(jar: Map<string, string>): string {
+  const names = [...jar.keys()].sort((left, right) => left.localeCompare(right))
+  return names.length > 0 ? names.join(', ') : 'none'
+}
+function toReadinessPath(url: URL): string {
+  return url.pathname || '/'
+}
+function resolveReadinessRedirect(
+  baseUrl: URL,
+  currentUrl: URL,
+  rawLocation: string | null,
+): { url: URL; path: string } | { error: string } {
+  const location = rawLocation?.trim()
+  if (!location) {
+    return { error: 'missing Location header' }
+  }
+  if (location.startsWith('//')) {
+    return { error: 'protocol-relative redirect' }
+  }
+  let nextUrl: URL
+  try {
+    nextUrl = new URL(location, currentUrl)
+  } catch {
+    return { error: 'invalid Location header' }
+  }
+  if (nextUrl.origin !== baseUrl.origin) {
+    return { error: 'cross-origin redirect' }
+  }
+  return {
+    url: nextUrl,
+    path: toReadinessPath(nextUrl),
+  }
+}
+async function probeBackendBrowserAuth(baseUrl: string): Promise<BackendBrowserAuthProbeResult> {
+  try {
+    const base = new URL(baseUrl)
+    const form = new URLSearchParams()
+    form.set('email', 'admin@acme.com')
+    form.set('password', 'secret')
+    const loginResponse = await probeFetch(`${baseUrl}/api/auth/login`, {
+      method: 'POST',
+      redirect: 'manual',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: form.toString(),
+    })
+    if (!loginResponse.ok) {
+      return {
+        loginStatus: loginResponse.status,
+        backendStatus: null,
+        healthy: false,
+        detail: `Backend browser auth login returned ${loginResponse.status}`,
+      }
+    }
+    const cookieJar = new Map<string, string>()
+    addSetCookieHeadersToJar(cookieJar, loginResponse.headers)
+    if (cookieJar.size === 0) {
+      return {
+        loginStatus: loginResponse.status,
+        backendStatus: null,
+        healthy: false,
+        detail: 'Backend browser auth login returned no cookies',
+      }
+    }
+    let currentUrl = new URL('/backend', base)
+    let backendStatus: number | null = null
+    const visitedPaths = new Set<string>()
+    const trace: string[] = []
+    for (let redirectCount = 0; redirectCount <= BACKEND_BROWSER_AUTH_REDIRECT_LIMIT; redirectCount += 1) {
+      const currentPath = toReadinessPath(currentUrl)
+      visitedPaths.add(currentPath)
+      const response = await probeFetch(currentUrl.toString(), {
+        method: 'GET',
+        redirect: 'manual',
+        headers: {
+          Cookie: serializeCookieJar(cookieJar),
+        },
+      })
+      backendStatus = response.status
+      addSetCookieHeadersToJar(cookieJar, response.headers)
+      const location = response.headers?.get('location') ?? null
+      const traceRedirect = location ? resolveReadinessRedirect(base, currentUrl, location) : null
+      const statusAndLocation = traceRedirect && !('error' in traceRedirect)
+        ? `${currentPath} ${response.status} -> ${traceRedirect.path}`
+        : `${currentPath} ${response.status}${location ? ' -> [unsafe]' : ''}`
+      trace.push(statusAndLocation)
+      if (response.status === 200 && currentPath === '/backend') {
+        return {
+          loginStatus: loginResponse.status,
+          backendStatus,
+          healthy: true,
+          detail: `Cookie-backed GET /backend returned 200 (cookies: ${formatCookieNames(cookieJar)})`,
+        }
+      }
+      if (response.status < 300 || response.status >= 400) {
+        return {
+          loginStatus: loginResponse.status,
+          backendStatus,
+          healthy: false,
+          detail: `Cookie-backed GET ${currentPath} returned ${response.status} (cookies: ${formatCookieNames(cookieJar)}; trace: ${trace.join(' | ')})`,
+        }
+      }
+      const redirect = traceRedirect ?? resolveReadinessRedirect(base, currentUrl, location)
+      if ('error' in redirect) {
+        return {
+          loginStatus: loginResponse.status,
+          backendStatus,
+          healthy: false,
+          detail: `Backend browser auth probe followed unsafe redirect: ${redirect.error} (cookies: ${formatCookieNames(cookieJar)}; trace: ${trace.join(' | ')})`,
+        }
+      }
+      if (visitedPaths.has(redirect.path)) {
+        trace.push(redirect.path)
+        return {
+          loginStatus: loginResponse.status,
+          backendStatus,
+          healthy: false,
+          detail: `Backend browser auth probe detected redirect loop: ${trace.join(' | ')} (cookies: ${formatCookieNames(cookieJar)})`,
+        }
+      }
+      currentUrl = redirect.url
+    }
+    return {
+      loginStatus: loginResponse.status,
+      backendStatus,
+      healthy: false,
+      detail: `Backend browser auth probe exceeded ${BACKEND_BROWSER_AUTH_REDIRECT_LIMIT} redirects (cookies: ${formatCookieNames(cookieJar)}; trace: ${trace.join(' | ')})`,
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    return {
+      loginStatus: null,
+      backendStatus: null,
+      healthy: false,
+      detail: `Backend browser auth probe failed: ${message}`,
+    }
+  }
+}
 async function probeApplicationReadiness(baseUrl: string): Promise<ApplicationReadinessProbeResult> {
-  const [frontend, backend, authenticated] = await Promise.all([
+  const [frontend, backend, authenticated, backendBrowserAuth] = await Promise.all([
     probeLoginPage(baseUrl),
     probeBackendLoginEndpoint(baseUrl),
     probeAuthenticatedApi(baseUrl),
+    probeBackendBrowserAuth(baseUrl),
   ])
   return {
-    ready: frontend.healthy && backend.healthy && authenticated.healthy,
+    ready: frontend.healthy && backend.healthy && authenticated.healthy && backendBrowserAuth.healthy,
     frontend,
     backend,
     authenticated,
+    backendBrowserAuth,
   }
 }
@@ -1904,9 +2131,10 @@ export async function waitForApplicationReadiness(
   const lastFrontendDetail = lastProbe?.frontend.detail ?? 'GET /login was never observed'
   const lastBackendDetail = lastProbe?.backend.detail ?? 'POST /api/auth/login was never observed'
   const lastAuthenticatedDetail = lastProbe?.authenticated.detail ?? 'Authenticated API probe was never observed'
+  const lastBackendBrowserAuthDetail = lastProbe?.backendBrowserAuth.detail ?? 'Backend browser auth probe was never observed'
   throw new Error(
     `Application did not become ready within ${options.timeoutMs / 1000} seconds. ` +
-    `Last probe: ${lastFrontendDetail}; ${lastBackendDetail}; ${lastAuthenticatedDetail}`,
+    `Last probe: ${lastFrontendDetail}; ${lastBackendDetail}; ${lastAuthenticatedDetail}; ${lastBackendBrowserAuthDetail}`,
   )
 }

package/src/mercato.ts CHANGED Viewed

@@ -756,7 +756,6 @@ async function runGeneratorSuite(quiet: boolean): Promise<void> {
     generateModuleDi,
     generateModulePackageSources,
     generateOpenApi,
-    generateModuleFacts,
   } = await import('./lib/generators')
   const resolver = createResolver()
   await generateEntityIds({ resolver, quiet })
@@ -767,7 +766,6 @@ async function runGeneratorSuite(quiet: boolean): Promise<void> {
   await generateModuleDi({ resolver, quiet })
   await generateModulePackageSources({ resolver, quiet })
   await generateOpenApi({ resolver, quiet })
-  await generateModuleFacts({ resolver, quiet })
 }
 /**

package/dist/lib/generators/module-facts-generate.js DELETED Viewed

@@ -1,52 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import {
-  createGeneratorResult,
-  ensureDir,
-  logGenerationResult
-} from "../utils.js";
-import { extractAllModuleFacts, renderModuleFactsJson } from "./module-facts.js";
-function readCoreVersion(coreSrcRoot) {
-  const corePackageJsonPath = path.resolve(coreSrcRoot, "..", "..", "package.json");
-  if (!fs.existsSync(corePackageJsonPath)) return null;
-  try {
-    const parsed = JSON.parse(fs.readFileSync(corePackageJsonPath, "utf8"));
-    return typeof parsed.version === "string" ? parsed.version : null;
-  } catch {
-    return null;
-  }
-}
-async function generateModuleFacts(options) {
-  const { resolver, quiet } = options;
-  const result = createGeneratorResult();
-  const rootDir = resolver.getRootDir();
-  const coreSrcRoot = path.join(rootDir, "packages", "core", "src", "modules");
-  if (!fs.existsSync(coreSrcRoot)) {
-    if (!quiet) {
-      console.warn(`[module-facts] core module sources not found at ${coreSrcRoot}; skipping module-facts generation`);
-    }
-    return result;
-  }
-  const registryPath = path.join(resolver.getOutputDir(), "modules.runtime.generated.ts");
-  const coreVersion = readCoreVersion(coreSrcRoot);
-  const { factsByModule, warnings } = extractAllModuleFacts({ coreSrcRoot, registryPath, coreVersion });
-  for (const warning of warnings) {
-    console.warn(warning);
-  }
-  const content = renderModuleFactsJson(factsByModule);
-  const outFile = path.join(resolver.getAppDir(), "src", "module-facts.generated.json");
-  const existing = fs.existsSync(outFile) ? fs.readFileSync(outFile, "utf8") : null;
-  if (existing === content) {
-    result.filesUnchanged.push(outFile);
-    return result;
-  }
-  ensureDir(outFile);
-  fs.writeFileSync(outFile, content);
-  result.filesWritten.push(outFile);
-  logGenerationResult(path.relative(process.cwd(), outFile), true);
-  return result;
-}
-export {
-  generateModuleFacts
-};
-//# sourceMappingURL=module-facts-generate.js.map

package/dist/lib/generators/module-facts-generate.js.map DELETED Viewed

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/generators/module-facts-generate.ts"],
-  "sourcesContent": ["import fs from 'node:fs'\nimport path from 'node:path'\nimport type { PackageResolver } from '../resolver'\nimport {\n  createGeneratorResult,\n  ensureDir,\n  logGenerationResult,\n  type GeneratorResult,\n} from '../utils'\nimport { extractAllModuleFacts, renderModuleFactsJson } from './module-facts'\n\nexport interface ModuleFactsOptions {\n  resolver: PackageResolver\n  quiet?: boolean\n}\n\nfunction readCoreVersion(coreSrcRoot: string): string | null {\n  const corePackageJsonPath = path.resolve(coreSrcRoot, '..', '..', 'package.json')\n  if (!fs.existsSync(corePackageJsonPath)) return null\n  try {\n    const parsed = JSON.parse(fs.readFileSync(corePackageJsonPath, 'utf8')) as { version?: unknown }\n    return typeof parsed.version === 'string' ? parsed.version : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Emits the versioned `apps/mercato/src/module-facts.generated.json` artifact from\n * monorepo core module sources. Must run AFTER `generateModuleRegistry` because\n * per-route API auth is read from the generated `modules.runtime.generated.ts`\n * registry (`apis[].metadata`). Registry-derived warnings are non-fatal.\n */\nexport async function generateModuleFacts(options: ModuleFactsOptions): Promise<GeneratorResult> {\n  const { resolver, quiet } = options\n  const result = createGeneratorResult()\n\n  const rootDir = resolver.getRootDir()\n  const coreSrcRoot = path.join(rootDir, 'packages', 'core', 'src', 'modules')\n  if (!fs.existsSync(coreSrcRoot)) {\n    if (!quiet) {\n      console.warn(`[module-facts] core module sources not found at ${coreSrcRoot}; skipping module-facts generation`)\n    }\n    return result\n  }\n\n  const registryPath = path.join(resolver.getOutputDir(), 'modules.runtime.generated.ts')\n  const coreVersion = readCoreVersion(coreSrcRoot)\n\n  const { factsByModule, warnings } = extractAllModuleFacts({ coreSrcRoot, registryPath, coreVersion })\n  for (const warning of warnings) {\n    console.warn(warning)\n  }\n\n  const content = renderModuleFactsJson(factsByModule)\n  const outFile = path.join(resolver.getAppDir(), 'src', 'module-facts.generated.json')\n  const existing = fs.existsSync(outFile) ? fs.readFileSync(outFile, 'utf8') : null\n  if (existing === content) {\n    result.filesUnchanged.push(outFile)\n    return result\n  }\n\n  ensureDir(outFile)\n  fs.writeFileSync(outFile, content)\n  result.filesWritten.push(outFile)\n  logGenerationResult(path.relative(process.cwd(), outFile), true)\n  return result\n}\n"],
-  "mappings": "AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAEjB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,uBAAuB,6BAA6B;AAO7D,SAAS,gBAAgB,aAAoC;AAC3D,QAAM,sBAAsB,KAAK,QAAQ,aAAa,MAAM,MAAM,cAAc;AAChF,MAAI,CAAC,GAAG,WAAW,mBAAmB,EAAG,QAAO;AAChD,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG,aAAa,qBAAqB,MAAM,CAAC;AACtE,WAAO,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,oBAAoB,SAAuD;AAC/F,QAAM,EAAE,UAAU,MAAM,IAAI;AAC5B,QAAM,SAAS,sBAAsB;AAErC,QAAM,UAAU,SAAS,WAAW;AACpC,QAAM,cAAc,KAAK,KAAK,SAAS,YAAY,QAAQ,OAAO,SAAS;AAC3E,MAAI,CAAC,GAAG,WAAW,WAAW,GAAG;AAC/B,QAAI,CAAC,OAAO;AACV,cAAQ,KAAK,mDAAmD,WAAW,oCAAoC;AAAA,IACjH;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,KAAK,KAAK,SAAS,aAAa,GAAG,8BAA8B;AACtF,QAAM,cAAc,gBAAgB,WAAW;AAE/C,QAAM,EAAE,eAAe,SAAS,IAAI,sBAAsB,EAAE,aAAa,cAAc,YAAY,CAAC;AACpG,aAAW,WAAW,UAAU;AAC9B,YAAQ,KAAK,OAAO;AAAA,EACtB;AAEA,QAAM,UAAU,sBAAsB,aAAa;AACnD,QAAM,UAAU,KAAK,KAAK,SAAS,UAAU,GAAG,OAAO,6BAA6B;AACpF,QAAM,WAAW,GAAG,WAAW,OAAO,IAAI,GAAG,aAAa,SAAS,MAAM,IAAI;AAC7E,MAAI,aAAa,SAAS;AACxB,WAAO,eAAe,KAAK,OAAO;AAClC,WAAO;AAAA,EACT;AAEA,YAAU,OAAO;AACjB,KAAG,cAAc,SAAS,OAAO;AACjC,SAAO,aAAa,KAAK,OAAO;AAChC,sBAAoB,KAAK,SAAS,QAAQ,IAAI,GAAG,OAAO,GAAG,IAAI;AAC/D,SAAO;AACT;",
-  "names": []
-}