@open-mercato/cli 0.6.8-develop.6930.1.1e5976efc3 → 0.6.8-develop.6940.1.177ea30c6e

package/src/lib/generators/module-override-targets.ts

@@ -9,7 +9,7 @@ import type {
   ModuleOwnedContractFact,
 } from './module-facts'
 import { buildFactSourceLookup, type FactSourceLookup } from './module-fact-sources'
-import { getFrameworkOverrideModes } from './module-extension-facts'
+import { getFrameworkOverrideHostOperations } from './module-extension-facts'
 
 /**
  * Exact module-specific unified override targets.
@@ -26,11 +26,26 @@ import { getFrameworkOverrideModes } from './module-extension-facts'
  * `nav.groupOrder` are never module targets.
  */
 
-export type ModuleOverrideMode = 'disable-replace' | 'replace' | 'additive'
+/**
+ * Closed mode/note/diagnostic sets, published as `as const` ledgers whose types
+ * derive from them. The `factCoverage` ledger enumerates these at runtime, so a
+ * value added here without a ledger row fails the coverage contract test instead
+ * of silently widening the public surface.
+ */
+export const MODULE_OVERRIDE_MODES = ['disable-replace', 'replace', 'additive'] as const
+
+export type ModuleOverrideMode = (typeof MODULE_OVERRIDE_MODES)[number]
+
+export const MODULE_OVERRIDE_TARGET_NOTES = [
+  'safe-metadata-only',
+  'page-middleware-not-mutation-guard',
+] as const
 
-export type ModuleOverrideTargetNote =
-  | 'safe-metadata-only'
-  | 'page-middleware-not-mutation-guard'
+export type ModuleOverrideTargetNote = (typeof MODULE_OVERRIDE_TARGET_NOTES)[number]
+
+function isModuleOverrideMode(value: string): value is ModuleOverrideMode {
+  return (MODULE_OVERRIDE_MODES as readonly string[]).includes(value)
+}
 
 export type ModuleOverrideTarget = {
   id: string
@@ -43,11 +58,15 @@ export type ModuleOverrideTarget = {
   notes?: ModuleOverrideTargetNote[]
 }
 
-export type ModuleOverrideTargetDiagnosticCode =
-  | 'missing-owned-fact'
-  | 'missing-source'
-  | 'unsupported-dynamic-key'
-  | 'unknown-framework-domain'
+export const MODULE_OVERRIDE_TARGET_DIAGNOSTIC_CODES = [
+  'missing-owned-fact',
+  'missing-source',
+  'unsupported-dynamic-key',
+  'unknown-framework-domain',
+  'unknown-framework-mode',
+] as const
+
+export type ModuleOverrideTargetDiagnosticCode = (typeof MODULE_OVERRIDE_TARGET_DIAGNOSTIC_CODES)[number]
 
 export type ModuleOverrideTargetDiagnostic = {
   code: ModuleOverrideTargetDiagnosticCode
@@ -82,17 +101,35 @@ type InternalAdapter = {
   run(moduleFacts: ModuleFactsJsonEntry, resolveFactSource: FactSourceLookup): AdapterResult
 }
 
-const OVERRIDE_MODES = getFrameworkOverrideModes()
+const OVERRIDE_HOST_OPERATIONS = getFrameworkOverrideHostOperations()
+
+/**
+ * Why a dotted host produced no modes. The two failure causes are distinct and a
+ * downstream app needs to tell them apart: an absent host means the catalog never
+ * described this override surface, while an unrecognized mode means the catalog
+ * *does* describe it but names an operation this generator cannot map to a public
+ * {@link ModuleOverrideMode}. Collapsing the second into the first would report a
+ * catalog the generator has fallen behind as a surface that does not exist.
+ */
+export type FrameworkOverrideModeResolution =
+  | { outcome: 'resolved'; modes: ModuleOverrideMode[] }
+  | { outcome: 'unknown-framework-domain' }
+  | { outcome: 'unknown-framework-mode'; operation: string }
 
 /**
  * Supported modes come from the framework catalog only. A host the catalog does not
- * describe is never guessed: the caller emits an `unknown-framework-domain`
- * diagnostic and no target, so a downstream app is not told a key is overridable in
- * a mode the runtime may not support.
+ * describe is never guessed, and neither is a host whose declared operation is not a
+ * known mode: both produce no target, so a downstream app is never told a key is
+ * overridable in a mode the runtime may not support.
  */
-function modesFor(dottedHost: string): ModuleOverrideMode[] | null {
-  const mode = OVERRIDE_MODES[dottedHost]
-  return mode ? [mode] : null
+export function resolveFrameworkOverrideModes(operation: string | undefined): FrameworkOverrideModeResolution {
+  if (operation === undefined) return { outcome: 'unknown-framework-domain' }
+  if (!isModuleOverrideMode(operation)) return { outcome: 'unknown-framework-mode', operation }
+  return { outcome: 'resolved', modes: [operation] }
+}
+
+function modesFor(dottedHost: string): FrameworkOverrideModeResolution {
+  return resolveFrameworkOverrideModes(OVERRIDE_HOST_OPERATIONS[dottedHost])
 }
 
 /**
@@ -146,9 +183,13 @@ type MakeTargetInput = {
   notes?: ModuleOverrideTargetNote[]
 }
 
-function makeTarget(input: MakeTargetInput): ModuleOverrideTarget | null {
-  const modes = modesFor(input.dottedHost)
-  if (!modes) return null
+/** The resolution outcomes that yield no target; each names its own diagnostic code. */
+type UnresolvedOverrideMode = Exclude<FrameworkOverrideModeResolution, { outcome: 'resolved' }>
+
+function makeTarget(input: MakeTargetInput): ModuleOverrideTarget | UnresolvedOverrideMode {
+  const resolution = modesFor(input.dottedHost)
+  if (resolution.outcome !== 'resolved') return resolution
+  const { modes } = resolution
   const target: ModuleOverrideTarget = {
     id: computeOverrideTargetId(input.moduleId, input.domain, input.path),
     domain: input.domain,
@@ -163,21 +204,24 @@ function makeTarget(input: MakeTargetInput): ModuleOverrideTarget | null {
 }
 
 /**
- * Emits the target, or an `unknown-framework-domain` diagnostic when the framework
- * catalog does not describe the target's dotted host.
+ * Emits the target, or the diagnostic matching why the framework catalog yielded no
+ * modes: `unknown-framework-domain` when the catalog does not describe the target's
+ * dotted host at all, `unknown-framework-mode` when it describes the host but names
+ * an operation that is not a public {@link ModuleOverrideMode}. Neither case guesses
+ * a target.
  */
 function pushTarget(
   targets: ModuleOverrideTarget[],
   diagnostics: ModuleOverrideTargetDiagnostic[],
   input: MakeTargetInput,
 ): void {
-  const target = makeTarget(input)
-  if (target) {
-    targets.push(target)
+  const result = makeTarget(input)
+  if (!('outcome' in result)) {
+    targets.push(result)
     return
   }
   diagnostics.push({
-    code: 'unknown-framework-domain',
+    code: result.outcome,
     moduleId: input.moduleId,
     domain: input.domain,
     candidatePath: input.path,

package/src/lib/generators/module-registry.ts

@@ -301,6 +301,131 @@ function buildCacheBustedSourceImportUrl(sourceFile: string): string {
   return url.href
 }
 
+function assertGeneratorPluginUsesTypeOnlyImports(sourceFile: string): void {
+  const source = fs.readFileSync(sourceFile, 'utf8')
+  const scriptKind = sourceFile.endsWith('.js') || sourceFile.endsWith('.mjs') || sourceFile.endsWith('.cjs')
+    ? ts.ScriptKind.JS
+    : ts.ScriptKind.TS
+  const parsed = ts.createSourceFile(sourceFile, source, ts.ScriptTarget.Latest, true, scriptKind)
+  const violations: string[] = []
+
+  for (const statement of parsed.statements) {
+    if (ts.isImportDeclaration(statement) && !statement.importClause?.isTypeOnly) {
+      violations.push(statement.getText(parsed))
+    }
+    if (ts.isImportEqualsDeclaration(statement)) {
+      violations.push(statement.getText(parsed))
+    }
+    if (ts.isExportDeclaration(statement) && statement.moduleSpecifier && !statement.isTypeOnly) {
+      violations.push(statement.getText(parsed))
+    }
+  }
+
+  const visit = (node: ts.Node): void => {
+    if (
+      ts.isCallExpression(node)
+      && (node.expression.kind === ts.SyntaxKind.ImportKeyword
+        || (ts.isIdentifier(node.expression) && node.expression.text === 'require'))
+    ) {
+      violations.push(node.getText(parsed))
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(parsed)
+
+  if (violations.length > 0) {
+    throw new Error(
+      `Generator plugin ${sourceFile} contains runtime imports. generators.ts may use only \`import type\`: ${violations.join('; ')}`,
+    )
+  }
+}
+
+const GENERATOR_PLUGIN_OUTPUT_MANIFEST = '.generator-plugin-outputs.json'
+
+function normalizeGeneratorPluginOutputFileName(pluginId: string, outputFileName: string): string {
+  const normalized = outputFileName.replace(/\\/g, '/')
+  if (
+    path.isAbsolute(outputFileName)
+    || outputFileName.includes('\\')
+    || normalized.startsWith('/')
+    || normalized.startsWith('../')
+    || normalized.includes('/../')
+    || !normalized.endsWith('.ts')
+  ) {
+    throw new Error(
+      `Generator plugin '${pluginId}' has an invalid outputFileName '${outputFileName}'; expected a relative .ts path inside the generated directory.`,
+    )
+  }
+  return normalized
+}
+
+function resolveGeneratorPluginOutputNames(
+  plugins: ReadonlyMap<string, import('@open-mercato/shared/modules/generators').GeneratorPlugin>,
+): Map<string, string> {
+  const outputNames = new Map<string, string>()
+  const ownersByOutput = new Map<string, string>()
+  for (const [pluginId, plugin] of plugins) {
+    const outputName = normalizeGeneratorPluginOutputFileName(pluginId, plugin.outputFileName)
+    const existingOwner = ownersByOutput.get(outputName)
+    if (existingOwner) {
+      throw new Error(
+        `Generator plugins '${existingOwner}' and '${pluginId}' declare the same output file '${outputName}'.`,
+      )
+    }
+    ownersByOutput.set(outputName, pluginId)
+    outputNames.set(pluginId, outputName)
+  }
+  return outputNames
+}
+
+function reconcileGeneratorPluginOutputs(options: {
+  outputDir: string
+  outputNames: Iterable<string>
+  result: GeneratorResult
+}): void {
+  const manifestPath = path.join(options.outputDir, GENERATOR_PLUGIN_OUTPUT_MANIFEST)
+  let previousOutputs: string[] = []
+  if (fs.existsSync(manifestPath)) {
+    const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8')) as unknown
+    if (!Array.isArray(parsed) || parsed.some((entry) => typeof entry !== 'string')) {
+      throw new Error(`Invalid generator plugin output manifest: ${manifestPath}`)
+    }
+    previousOutputs = parsed.map((entry) => normalizeGeneratorPluginOutputFileName('manifest', entry))
+  }
+
+  const currentOutputs = new Set(options.outputNames)
+  for (const staleOutput of previousOutputs) {
+    if (currentOutputs.has(staleOutput)) continue
+    for (const stalePath of [
+      path.join(options.outputDir, staleOutput),
+      path.join(options.outputDir, staleOutput.replace(/\.ts$/, '.checksum')),
+    ]) {
+      if (!fs.existsSync(stalePath)) continue
+      fs.unlinkSync(stalePath)
+      options.result.filesWritten.push(stalePath)
+    }
+  }
+
+  if (currentOutputs.size === 0) {
+    if (fs.existsSync(manifestPath)) {
+      fs.unlinkSync(manifestPath)
+      options.result.filesWritten.push(manifestPath)
+    }
+    return
+  }
+
+  const manifestContent = `${JSON.stringify(
+    [...currentOutputs].sort((left, right) => left.localeCompare(right)),
+    null,
+    2,
+  )}\n`
+  if (!fs.existsSync(manifestPath) || fs.readFileSync(manifestPath, 'utf8') !== manifestContent) {
+    fs.mkdirSync(path.dirname(manifestPath), { recursive: true })
+    fs.writeFileSync(manifestPath, manifestContent)
+    options.result.filesWritten.push(manifestPath)
+  }
+}
+
 function unwrapObjectLiteralExpression(
   expression: ts.Expression | undefined,
 ): ts.ObjectLiteralExpression | undefined {
@@ -3143,6 +3268,7 @@ async function generateModuleRegistryFromDiscovery(options: ModuleRegistryRender
   for (const discovered of discovery.modules) {
     const resolved = discovered.resolve('generators.ts')
     if (!resolved) continue
+    assertGeneratorPluginUsesTypeOnlyImports(resolved.absolutePath)
     try {
       const pluginMod = await import(buildCacheBustedSourceImportUrl(resolved.absolutePath))
       const plugins: import('@open-mercato/shared/modules/generators').GeneratorPlugin[] =
@@ -3156,6 +3282,8 @@ async function generateModuleRegistryFromDiscovery(options: ModuleRegistryRender
     } catch {}
   }
 
+  const pluginOutputNames = resolveGeneratorPluginOutputNames(pluginRegistry)
+
   const imports: string[] = []
   const runtimeImports: string[] = []
   const frontendRouteManifestImports: string[] = []
@@ -3716,10 +3844,15 @@ async function generateModuleRegistryFromDiscovery(options: ModuleRegistryRender
     const importSection = state.imports.join('\n')
     const entriesLiteral = state.configs.join(',\n  ')
     const content = plugin.buildOutput({ importSection, entriesLiteral })
-    const outFile = path.join(outputDir, plugin.outputFileName)
-    const checksumFile = outFile.replace('.ts', '.checksum')
+    const outFile = path.join(outputDir, pluginOutputNames.get(pluginId)!)
+    const checksumFile = outFile.replace(/\.ts$/, '.checksum')
     writeGeneratedFile({ outFile, checksumFile, content, structureChecksum, result, quiet })
   }
+  reconcileGeneratorPluginOutputs({
+    outputDir,
+    outputNames: pluginOutputNames.values(),
+    result,
+  })
 
   // Bootstrap registrations: aggregate core registrations + plugin bootstrap-registration hooks
   // into one file. Always written (with at least the core backend route registration) so bootstrap.ts

package/src/lib/resolver.ts

@@ -334,7 +334,7 @@ function parseModulesFromSource(source: string, env: NodeJS.ProcessEnv = process
   return modules
 }
 
-function readEnabledModulesFromConfig(cfgPath: string): ModuleEntry[] {
+export function readEnabledModulesFromConfig(cfgPath: string): ModuleEntry[] {
   const source = fs.readFileSync(cfgPath, 'utf8')
   return parseModulesFromSource(source)
 }
@@ -489,6 +489,11 @@ function detectMonorepoFromNodeModules(appDir: string): { isMonorepo: boolean; m
 
   const corePkgPath = path.join(nodeModulesRoot, 'node_modules', '@open-mercato', 'core')
 
+  const workspaceCoreModules = path.join(nodeModulesRoot, 'packages', 'core', 'src', 'modules')
+  if (fs.existsSync(workspaceCoreModules)) {
+    return { isMonorepo: true, monorepoRoot: nodeModulesRoot, nodeModulesRoot }
+  }
+
   try {
     const stat = fs.lstatSync(corePkgPath)
     if (stat.isSymbolicLink()) {

package/src/lib/testing/__tests__/integration-discovery.test.ts

@@ -16,6 +16,7 @@ describe('integration discovery', () => {
     'OM_TEST_DISCOVERY_AI_KEY',
     'OM_TEST_DISCOVERY_FALLBACK_AI_KEY',
     'OM_TEST_DISCOVERY_REQUIRED_KEY',
+    'OM_TEST_APP_ROOT',
   ] as const
   const previousTestEnvValues = new Map<string, string | undefined>()
 
@@ -159,6 +160,40 @@ describe('integration discovery', () => {
     ])
   })
 
+  it('uses OM_TEST_APP_ROOT and its actual modules.ts for dependency filtering', async () => {
+    const standaloneRoot = path.join(tempRoot, 'standalone-app')
+    await writeTestFile(
+      tempRoot,
+      'apps/mercato/src/modules/example/__integration__/meta.ts',
+      "export const integrationMeta = { requiredModules: ['example'] }\n",
+    )
+    await writeTestFile(
+      tempRoot,
+      'apps/mercato/src/modules/example/__integration__/TC-EXAMPLE-016.spec.ts',
+    )
+    await writeTestFile(
+      tempRoot,
+      'apps/mercato/src/modules/example/__integration__/TC-EXAMPLE-018.meta.ts',
+      "export const integrationMeta = { requiredModules: ['design_system'] }\n",
+    )
+    await writeTestFile(
+      tempRoot,
+      'apps/mercato/src/modules/example/__integration__/TC-EXAMPLE-018.spec.ts',
+    )
+    await writeTestFile(
+      tempRoot,
+      'standalone-app/src/modules.ts',
+      `const moduleOverrideExamples = [{ id: 'design_system', from: '@open-mercato/core' }]\n\nexport const enabledModules = [{\n  id: 'example',\n  from: '@app',\n  overrides: { routes: { api: { 'GET /api/example/probe': null } } },\n}]\n`,
+    )
+    await writeTestFile(tempRoot, 'standalone-app/src/modules/design_system/.gitkeep')
+    process.env.OM_TEST_APP_ROOT = standaloneRoot
+
+    const discovered = discoverIntegrationSpecFiles(tempRoot, path.join(tempRoot, '.ai', 'qa', 'tests'))
+    expect(discovered.map((entry) => entry.path)).toEqual([
+      'apps/mercato/src/modules/example/__integration__/TC-EXAMPLE-016.spec.ts',
+    ])
+  })
+
   it('applies folder and per-test metadata environment requirements', async () => {
     await writeTestFile(tempRoot, 'packages/ai-assistant/src/modules/ai_assistant/.gitkeep')
     await writeTestFile(

package/src/lib/testing/integration-discovery.ts

@@ -1,5 +1,6 @@
 import { readFileSync, readdirSync } from 'node:fs'
 import path from 'node:path'
+import ts from 'typescript-js'
 
 export type IntegrationSpecDiscoveryItem = {
   path: string
@@ -106,7 +107,56 @@ function collectModuleIdsFromModulesRoot(modulesRoot: string, enabledModules: Se
   }
 }
 
+function readDeclaredModuleIdsFromConfig(registryPath: string): string[] {
+  const source = readFileSync(registryPath, 'utf8')
+  const sourceFile = ts.createSourceFile(
+    registryPath,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TS,
+  )
+
+  for (const statement of sourceFile.statements) {
+    if (!ts.isVariableStatement(statement)) continue
+    for (const declaration of statement.declarationList.declarations) {
+      if (
+        !ts.isIdentifier(declaration.name)
+        || declaration.name.text !== 'enabledModules'
+        || !declaration.initializer
+        || !ts.isArrayLiteralExpression(declaration.initializer)
+      ) {
+        continue
+      }
+
+      return declaration.initializer.elements.flatMap((element) => {
+        if (!ts.isObjectLiteralExpression(element)) return []
+        const idProperty = element.properties.find((property): property is ts.PropertyAssignment =>
+          ts.isPropertyAssignment(property)
+          && (
+            (ts.isIdentifier(property.name) && property.name.text === 'id')
+            || (ts.isStringLiteralLike(property.name) && property.name.text === 'id')
+          ),
+        )
+        return idProperty && ts.isStringLiteralLike(idProperty.initializer)
+          ? [idProperty.initializer.text]
+          : []
+      })
+    }
+  }
+
+  return []
+}
+
 function resolveEnabledModuleIds(projectRoot: string): Set<string> {
+  const configuredTestAppRoot = process.env.OM_TEST_APP_ROOT?.trim()
+  if (configuredTestAppRoot) {
+    const registryPath = path.join(path.resolve(configuredTestAppRoot), 'src', 'modules.ts')
+    return new Set(
+      readDeclaredModuleIdsFromConfig(registryPath).map(normalizeModuleId),
+    )
+  }
+
   const enabledModules = new Set<string>()
   const appModulesRoot = path.join(projectRoot, 'src', 'modules')
   const appsRoot = path.join(projectRoot, 'apps')

package/src/lib/testing/integration.ts

@@ -1977,6 +1977,12 @@ function buildReusableEnvironment(
     // not have to call flushPendingCrudAccessLogs() explicitly.
     OM_CRUD_ACCESS_LOG_BLOCKING: process.env.OM_CRUD_ACCESS_LOG_BLOCKING ?? '1',
     OM_WEBHOOKS_ALLOW_PRIVATE_URLS: process.env.OM_WEBHOOKS_ALLOW_PRIVATE_URLS ?? '1',
+    // TC-ONB-001/002 drive the self-service signup flow, whose routes are not
+    // mounted while the feature is off. `apps/mercato/.env` ships it disabled,
+    // so both specs 404'd on every local run while CI stayed green — it exports
+    // the var at the workflow level, the same gap the MOCK_INBOUND_WEBHOOK_SECRET
+    // note below describes. Keep in sync with the app-server env block.
+    SELF_SERVICE_ONBOARDING_ENABLED: process.env.SELF_SERVICE_ONBOARDING_ENABLED ?? 'true',
     // Keep the bus in the Playwright process (used by in-test queue-drain helpers)
     // on the same delivery mode as the app server it drives: inline persistent
     // delivery so event side effects are deterministic for assertions. See the
@@ -1986,7 +1992,6 @@ function buildReusableEnvironment(
     MOCK_GATEWAY_WEBHOOK_SECRET: 'open-mercato-mock-dev-webhook-secret',
     MOCK_CARRIER_WEBHOOK_SECRET: 'open-mercato-mock-dev-carrier-webhook-secret',
     MOCK_INBOUND_WEBHOOK_SECRET: 'open-mercato-mock-dev-inbound-webhook-secret',
-    NEXT_PUBLIC_OM_EXAMPLE_INJECTION_WIDGETS_ENABLED: 'true',
     NEXT_PUBLIC_UMES_DEVTOOLS: 'true',
     CI: 'true',
     TENANT_DATA_ENCRYPTION_FALLBACK_KEY: process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY ?? 'om-ephemeral-integration-fallback-key',
@@ -3329,6 +3334,10 @@ export async function startEphemeralEnvironment(options: EphemeralRuntimeOptions
       OM_TEST_AUTH_RATE_LIMIT_MODE: 'opt-in',
       OM_DISABLE_EMAIL_DELIVERY: '1',
       OM_WEBHOOKS_ALLOW_PRIVATE_URLS: process.env.OM_WEBHOOKS_ALLOW_PRIVATE_URLS ?? '1',
+      // Read at build time as well as at runtime, so this block has to carry it:
+      // the app build and `yarn start` both run with this environment. See the
+      // matching note on the Playwright-process env block above.
+      SELF_SERVICE_ONBOARDING_ENABLED: process.env.SELF_SERVICE_ONBOARDING_ENABLED ?? 'true',
       ENABLE_CRUD_API_CACHE: 'true',
       MOCK_GATEWAY_WEBHOOK_SECRET: 'open-mercato-mock-dev-webhook-secret',
       MOCK_CARRIER_WEBHOOK_SECRET: 'open-mercato-mock-dev-carrier-webhook-secret',
@@ -3338,7 +3347,6 @@ export async function startEphemeralEnvironment(options: EphemeralRuntimeOptions
       // var at the workflow level, masking the gap). Keep in sync with the
       // Playwright-process env block above.
       MOCK_INBOUND_WEBHOOK_SECRET: 'open-mercato-mock-dev-inbound-webhook-secret',
-      NEXT_PUBLIC_OM_EXAMPLE_INJECTION_WIDGETS_ENABLED: 'true',
       NEXT_PUBLIC_UMES_DEVTOOLS: 'true',
       CI: 'true',
       TENANT_DATA_ENCRYPTION_FALLBACK_KEY: process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY ?? 'om-ephemeral-integration-fallback-key',

package/src/mercato.ts

@@ -7,7 +7,7 @@ import { getCliModules, hasCliModules, registerCliModules } from './registry'
 export { getCliModules, hasCliModules, registerCliModules }
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { getSslConfig } from '@open-mercato/shared/lib/db/ssl'
-import { getRedisUrl, getRedisUrlOrThrow, REDIS_WIRE_PROTOCOL } from '@open-mercato/shared/lib/redis/connection'
+import { getRedisUrl, getRedisUrlOrThrow, parseRedisUrl } from '@open-mercato/shared/lib/redis/connection'
 import { resolveInitDerivedSecrets } from './lib/init-secrets'
 import {
   resolveAutoSpawnWorkersMode,
@@ -994,13 +994,13 @@ export async function run(argv = process.argv) {
         const redisUrl = getRedisUrl()
         if (redisUrl) {
           const Redis = (await import('ioredis')).default
-          const redis = new Redis(redisUrl, {
+          const redis = new Redis({
+            ...parseRedisUrl(redisUrl),
             lazyConnect: true,
             connectTimeout: 3000,
             maxRetriesPerRequest: 1,
             retryStrategy: () => null,
             enableOfflineQueue: false,
-            protocol: REDIS_WIRE_PROTOCOL,
           })
           redis.on('error', () => {})
           try {