@open-mercato/cli 0.6.6-develop.6493.1.333455a884 → 0.6.6-develop.6505.1.6f6b83559f

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.6.6-develop.6493.1.333455a884",
+  "version": "0.6.6-develop.6505.1.6f6b83559f",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,8 +60,8 @@
     "@mikro-orm/decorators": "^7.1.5",
     "@mikro-orm/migrations": "^7.1.5",
     "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/queue": "0.6.6-develop.6493.1.333455a884",
-    "@open-mercato/shared": "0.6.6-develop.6493.1.333455a884",
+    "@open-mercato/queue": "0.6.6-develop.6505.1.6f6b83559f",
+    "@open-mercato/shared": "0.6.6-develop.6505.1.6f6b83559f",
     "cross-spawn": "^7.0.6",
     "pg": "8.22.0",
     "semver": "^7.8.5",
@@ -71,10 +71,10 @@
     "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.6-develop.6493.1.333455a884"
+    "@open-mercato/shared": "0.6.6-develop.6505.1.6f6b83559f"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.6-develop.6493.1.333455a884",
+    "@open-mercato/shared": "0.6.6-develop.6505.1.6f6b83559f",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11"

package/src/lib/__integration__/TC-INT-008.spec.ts

@@ -4,7 +4,6 @@ import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { MODULE_FACTS_ALLOWLIST } from '../generators/module-facts'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const repoRoot = path.resolve(__dirname, '..', '..', '..', '..', '..')
@@ -213,19 +212,13 @@ function expectedGuideOutputNames(): string[] {
   }
 
   // Generated fact-sheet artifacts (spec 2026-06-27-ts-morph-module-fact-sheets):
-  // the module-facts.json sidecar is copied as-is, fact-sheets are filtered to the
-  // fixture's enabled modules, and every allowlisted module whose hand-written
-  // core.<module>.md guide no longer exists gets a legacy redirect stub.
+  // the module-facts.json sidecar is copied as-is and fact-sheets are filtered to the
+  // fixture's enabled modules. The legacy core.<module>.md redirect stubs are no longer
+  // emitted (#3754).
   collected.add('module-facts.json')
   for (const moduleId of FIXTURE_ENABLED_MODULES) {
     collected.add(normalizePath(path.join('modules', `${moduleId}.md`)))
   }
-  for (const moduleId of MODULE_FACTS_ALLOWLIST) {
-    const legacyGuideSource = path.join(packagesRoot, 'core', 'src', 'modules', moduleId, 'agentic', 'standalone-guide.md')
-    if (!fs.existsSync(legacyGuideSource)) {
-      collected.add(`core.${moduleId}.md`)
-    }
-  }
 
   return Array.from(collected).sort()
 }

package/src/lib/db/__tests__/commands.test.ts

@@ -228,6 +228,57 @@ describe('db commands', () => {
       mockConsoleError.mockRestore()
       mockExit.mockRestore()
     })
+
+    it('quotes discovered table names as single PostgreSQL identifiers', async () => {
+      const dangerousTableName = 'orders"; SELECT pg_sleep(10); --'
+      const migrationQuery = jest.fn().mockResolvedValue({ rows: [] })
+      const discoveredTableQuery = jest.fn().mockImplementation(async (sql: string) => {
+        if (sql.includes('FROM pg_tables')) {
+          return { rows: [{ tablename: dangerousTableName }] }
+        }
+        return { rows: [] }
+      })
+
+      const Client = jest
+        .fn()
+        .mockImplementationOnce(() => ({
+          connect: jest.fn().mockResolvedValue(undefined),
+          query: migrationQuery,
+          end: jest.fn().mockResolvedValue(undefined),
+        }))
+        .mockImplementationOnce(() => ({
+          connect: jest.fn().mockResolvedValue(undefined),
+          query: discoveredTableQuery,
+          end: jest.fn().mockResolvedValue(undefined),
+        }))
+      jest.doMock('pg', () => ({ Client }))
+
+      const originalDatabaseUrl = process.env.DATABASE_URL
+      process.env.DATABASE_URL = 'postgres://postgres:secret@127.0.0.1:5432/open_mercato'
+      const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
+      const resolver = {
+        loadEnabledModules: () => [],
+        getOutputDir: () => '/definitely/missing/generated',
+        getRootDir: () => '/definitely/missing',
+        getModulePaths: () => ({ appBase: '', pkgBase: '' }),
+      } as any
+
+      try {
+        await dbGreenfield(resolver, { yes: true })
+      } finally {
+        if (originalDatabaseUrl === undefined) {
+          delete process.env.DATABASE_URL
+        } else {
+          process.env.DATABASE_URL = originalDatabaseUrl
+        }
+        consoleLogSpy.mockRestore()
+        jest.dontMock('pg')
+      }
+
+      expect(discoveredTableQuery).toHaveBeenCalledWith(
+        'DROP TABLE IF EXISTS "orders""; SELECT pg_sleep(10); --" CASCADE',
+      )
+    })
   })
 
   describe('integration with sanitization', () => {

package/src/lib/db/commands.ts

@@ -8,6 +8,7 @@ import { Migrator } from '@mikro-orm/migrations'
 import { PostgreSqlDriver } from '@mikro-orm/postgresql'
 import { getSslConfig } from '@open-mercato/shared/lib/db/ssl'
 import type { PackageResolver, ModuleEntry } from '../resolver'
+import { quotePostgresIdentifier } from './identifiers'
 
 const QUIET_MODE = process.env.OM_CLI_QUIET === '1' || process.env.MERCATO_QUIET === '1'
 const PROGRESS_EMOJI = ''
@@ -528,7 +529,7 @@ export async function dbGreenfield(resolver: PackageResolver, options: Greenfiel
         try {
           await client.query("SET session_replication_role = 'replica'")
           for (const t of tables) {
-            await client.query(`DROP TABLE IF EXISTS "${t}" CASCADE`)
+            await client.query(`DROP TABLE IF EXISTS ${quotePostgresIdentifier(t)} CASCADE`)
           }
           await client.query("SET session_replication_role = 'origin'")
           await client.query('COMMIT')

package/src/lib/db/identifiers.ts

@@ -0,0 +1,3 @@
+export function quotePostgresIdentifier(identifier: string): string {
+  return `"${identifier.replace(/"/g, '""')}"`
+}

package/src/lib/generators/__tests__/example-public-route-safety.test.ts

@@ -0,0 +1,16 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+const repoRoot = join(__dirname, '..', '..', '..', '..', '..', '..')
+const probeRoutes = [
+  'apps/mercato/src/modules/example/api/override-probe/route.ts',
+  'packages/create-app/template/src/modules/example/api/override-probe/route.ts',
+]
+
+describe('example public route safety guidance (#3864)', () => {
+  it.each(probeRoutes)('%s warns against copying unauthenticated metadata to data-bearing routes', (route) => {
+    const source = readFileSync(join(repoRoot, route), 'utf8')
+
+    expect(source).toContain('Test-only public probe: do not copy `requireAuth: false` to data-bearing routes.')
+  })
+})

package/src/lib/generators/module-facts.ts

@@ -75,26 +75,6 @@ export interface ModuleFactSource {
   from?: string
 }
 
-/**
- * @deprecated Superseded by auto-discovery (`discoverPackageModuleSources` in
- * `module-facts-discovery.ts`). Retained as a stable export for one minor; no
- * longer gates which modules receive fact-sheets.
- */
-export const MODULE_FACTS_ALLOWLIST = [
-  'auth',
-  'catalog',
-  'currencies',
-  'customer_accounts',
-  'customers',
-  'data_sync',
-  'integrations',
-  'sales',
-  'workflows',
-] as const
-
-/** @deprecated See {@link MODULE_FACTS_ALLOWLIST}. */
-export type ModuleFactsModuleId = (typeof MODULE_FACTS_ALLOWLIST)[number]
-
 function readSourceFile(filePath: string): ts.SourceFile | null {
   if (!fs.existsSync(filePath)) return null
   const source = fs.readFileSync(filePath, 'utf8')
@@ -959,7 +939,7 @@ export interface ExtractAllModuleFactsOptions {
   registryPath?: string | null
   registrySource?: string | null
   coreVersion?: string | null
-  /** @deprecated Legacy allowlist iteration; only consulted when `sources` is absent. */
+  /** @deprecated Legacy explicit module-id list; only consulted when `sources` is absent. */
   moduleIds?: readonly string[]
 }
 
@@ -973,7 +953,7 @@ export function extractAllModuleFacts(options: ExtractAllModuleFactsOptions): Ex
   const sources: ModuleFactSource[] = options.sources
     ? [...options.sources]
     : (options.coreSrcRoot
-        ? (options.moduleIds ?? MODULE_FACTS_ALLOWLIST).map((moduleId) => ({
+        ? (options.moduleIds ?? []).map((moduleId) => ({
             moduleId,
             moduleRoot: path.join(options.coreSrcRoot as string, moduleId),
           }))

package/src/mercato.ts

@@ -42,6 +42,7 @@ import { resolveNextBuildIdCandidate } from './lib/next-build-id'
 import { acquireServerStartLock } from './lib/server-start-lock'
 import { assertSingleInstanceStrategies } from './lib/single-instance-strategy-guard'
 import { createDevEnvReloader, watchDevEnvFiles } from './lib/dev-env-reload'
+import { quotePostgresIdentifier } from './lib/db/identifiers'
 // Lazy-imported to avoid pulling in `testcontainers` (devDependency) at startup
 const lazyIntegration = () => import('./lib/testing/integration')
 import type { ChildProcess } from 'node:child_process'
@@ -913,7 +914,7 @@ export async function run(argv = process.argv) {
             await client.query('BEGIN')
             try {
               for (const t of dropTargets) {
-                await client.query(`DROP TABLE IF EXISTS "${t}" CASCADE`)
+                await client.query(`DROP TABLE IF EXISTS ${quotePostgresIdentifier(t)} CASCADE`)
                 dropped += 1
               }
               await client.query('COMMIT')

package/dist/agentic/guides/core.auth.md

@@ -1,3 +0,0 @@
-# core.auth — moved
-
-> This guide has moved. See [`modules/auth.md`](modules/auth.md) for the generated `auth` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.

package/dist/agentic/guides/core.catalog.md

@@ -1,3 +0,0 @@
-# core.catalog — moved
-
-> This guide has moved. See [`modules/catalog.md`](modules/catalog.md) for the generated `catalog` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.

package/dist/agentic/guides/core.currencies.md

@@ -1,3 +0,0 @@
-# core.currencies — moved
-
-> This guide has moved. See [`modules/currencies.md`](modules/currencies.md) for the generated `currencies` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.

package/dist/agentic/guides/core.customer_accounts.md

@@ -1,3 +0,0 @@
-# core.customer_accounts — moved
-
-> This guide has moved. See [`modules/customer_accounts.md`](modules/customer_accounts.md) for the generated `customer_accounts` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.

package/dist/agentic/guides/core.customers.md

@@ -1,3 +0,0 @@
-# core.customers — moved
-
-> This guide has moved. See [`modules/customers.md`](modules/customers.md) for the generated `customers` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.

package/dist/agentic/guides/core.data_sync.md

@@ -1,3 +0,0 @@
-# core.data_sync — moved
-
-> This guide has moved. See [`modules/data_sync.md`](modules/data_sync.md) for the generated `data_sync` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.

package/dist/agentic/guides/core.integrations.md

@@ -1,3 +0,0 @@
-# core.integrations — moved
-
-> This guide has moved. See [`modules/integrations.md`](modules/integrations.md) for the generated `integrations` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.

package/dist/agentic/guides/core.sales.md

@@ -1,3 +0,0 @@
-# core.sales — moved
-
-> This guide has moved. See [`modules/sales.md`](modules/sales.md) for the generated `sales` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.

package/dist/agentic/guides/core.workflows.md

@@ -1,3 +0,0 @@
-# core.workflows — moved
-
-> This guide has moved. See [`modules/workflows.md`](modules/workflows.md) for the generated `workflows` fact-sheet, and [`module-system.md`](module-system.md) for conceptual module guidance.