@endora-commerce/platform 0.100.0

package/dist/lifecycle/services/manifest-loader.js

@@ -0,0 +1,210 @@
+import { readdirSync, statSync, existsSync } from 'node:fs';
+import { dirname, basename, resolve, join, sep } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { ModuleManifestSchema, } from '@endora-commerce/contracts';
+import { ModuleDepGraph } from './dep-graph.js';
+/**
+ * Collect the participants declared by a set of loaded entries.
+ *
+ * Sorted by module id so the order a projection is written in is a property of
+ * the platform rather than of whichever walk produced the map.
+ */
+export function collectLifecycleParticipants(entries) {
+    const found = [];
+    for (const entry of entries) {
+        if (entry.lifecycleParticipant) {
+            found.push({ moduleId: entry.manifest.id, participant: entry.lifecycleParticipant });
+        }
+    }
+    return found.sort((a, b) => a.moduleId.localeCompare(b.moduleId));
+}
+/**
+ * The manifest in one module folder, or `null` when the folder holds none.
+ *
+ * Two spellings for one file: `manifest.js` in a compiled tree,
+ * `manifest.ts` under `tsx` and `vitest`. This walk used to spell `.ts` into an
+ * `existsSync` and `continue` past a folder that failed it, so pointed at a
+ * built tree it discovered **nothing** and reported an empty registry — the
+ * absent-path-as-absent-feature shape this repository keeps finding (feature
+ * 080, D-165 step C). `null` still means "this folder is not a module", which is
+ * how a non-module directory under the root is skipped; what it no longer means
+ * is "this module was compiled".
+ *
+ * Compiled first, for the reason `manifest-locations.ts` gives about the same
+ * pair: the compiled tree is the one where picking up a stray source file
+ * beside it would be wrong.
+ */
+function moduleManifestIn(moduleDir) {
+    for (const extension of ['.js', '.ts']) {
+        const candidate = join(moduleDir, `manifest${extension}`);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+export class ManifestLoadError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+        this.name = 'ManifestLoadError';
+    }
+}
+/**
+ * Discover every `manifest.ts` under `modulesRoot/<id>/manifest.ts` and
+ * dynamically import each module. Returns the validated registry plus
+ * the dep graph derived from declarations.
+ *
+ * Production builds may swap this loader for a generated
+ * `manifest-index.ts` that imports the same modules eagerly — this
+ * runtime path is for dev/test where the file system is the source of
+ * truth.
+ *
+ * **Identity here is the directory name, and that scopes this loader** (feature
+ * 080, T032). It walks a tree this repository lays out, where Principle VI says
+ * `<id>/manifest.ts` — so the folder name is a claim about the id and a
+ * disagreement is a defect. An **installed package** has neither property: its
+ * directory is its npm name (`@endora-commerce/mod-blog`), and its identity is
+ * the `endora.id` field of its `package.json` (D-142), checked against its
+ * manifest by `src/packages/package-runtime.ts`. Pointing this loader at a
+ * `node_modules` is therefore refused outright rather than walked — see
+ * {@link ManifestLoadError} kind `package-root`. Without that refusal the walk
+ * happens to work and then reports `folder-id-mismatch`, which blames a vendor
+ * for naming their package correctly and sends the reader to fix the one thing
+ * that is right.
+ */
+export async function discoverManifests(opts) {
+    const root = resolve(opts.modulesRoot);
+    // Before the walk, not inside it: a `node_modules` must not be readable as a
+    // modules tree at all, whatever it happens to contain.
+    if (root.split(sep).includes('node_modules')) {
+        throw new ManifestLoadError('package-root', `${root} is inside a node_modules tree, and this loader derives a module's id from its ` +
+            `folder name. An installed package's folder is its npm name and its id is the ` +
+            `"endora.id" field of its package.json (D-142), so discovering one here would either ` +
+            `refuse it as a folder-id-mismatch or give it the wrong id. Use ` +
+            `loadPackageModuleEntries / discoverPackageModuleManifests (src/packages/) instead.`);
+    }
+    const exclude = new Set(opts.exclude ?? []);
+    const candidates = [];
+    if (opts.include && opts.include.length > 0) {
+        for (const sub of opts.include)
+            candidates.push(sub);
+    }
+    else {
+        for (const entry of readdirSync(root)) {
+            if (exclude.has(entry))
+                continue;
+            const full = join(root, entry);
+            if (!statSync(full).isDirectory())
+                continue;
+            candidates.push(entry);
+        }
+    }
+    const modules = new Map();
+    for (const folderName of candidates) {
+        const filePath = moduleManifestIn(join(root, folderName));
+        if (filePath === null)
+            continue;
+        let imported;
+        try {
+            imported = (await import(pathToFileURL(filePath).href));
+        }
+        catch (err) {
+            throw new ManifestLoadError('parse-failed', `failed to import manifest at ${filePath}: ` +
+                (err instanceof Error ? err.message : String(err)));
+        }
+        const manifest = imported.manifest;
+        if (!manifest) {
+            throw new ManifestLoadError('parse-failed', `manifest.ts at ${filePath} does not export a "manifest" constant`);
+        }
+        // Re-parse defensively — `defineModuleManifest` already validates,
+        // but a hand-rolled export might not have used the helper.
+        const parsed = ModuleManifestSchema.parse(manifest);
+        if (parsed.id !== folderName) {
+            throw new ManifestLoadError('folder-id-mismatch', `manifest at ${filePath} declares id "${parsed.id}" but lives in ` +
+                `folder "${folderName}" — in a directory-named module tree they MUST match ` +
+                `(Principle VI). An installed package is the other case and never reaches here: ` +
+                `its id is its "endora.id" field, not its folder.`);
+        }
+        if (parsed.dependencies.includes(parsed.id)) {
+            throw new ManifestLoadError('self-dep', `manifest "${parsed.id}" depends on itself.`);
+        }
+        const existing = modules.get(parsed.id);
+        if (existing) {
+            throw new ManifestLoadError('duplicate-id', `manifest id "${parsed.id}" is declared by both ` +
+                `${existing.filePath} and ${filePath}.`);
+        }
+        if (parsed.settings && parsed.settings.moduleCode !== parsed.id) {
+            throw new ManifestLoadError('parse-failed', `manifest "${parsed.id}" carries a settings manifest with ` +
+                `moduleCode "${parsed.settings.moduleCode}" — must match.`);
+        }
+        modules.set(parsed.id, {
+            manifest: parsed,
+            filePath,
+            ...(imported.installHook ? { installHook: imported.installHook } : {}),
+            ...(imported.uninstallHook ? { uninstallHook: imported.uninstallHook } : {}),
+            ...(imported.lifecycleParticipant
+                ? { lifecycleParticipant: imported.lifecycleParticipant }
+                : {}),
+            ...(imported.recentActivity ? { recentActivity: imported.recentActivity } : {}),
+        });
+    }
+    // Verify every dependency points to a known module before building
+    // the graph (cycles in subgraphs of unknown nodes would mask).
+    for (const entry of modules.values()) {
+        for (const dep of entry.manifest.dependencies) {
+            if (!modules.has(dep)) {
+                throw new ManifestLoadError('orphan-dep', `manifest "${entry.manifest.id}" depends on "${dep}" but no ` +
+                    `manifest with that id was discovered under ${root}.`);
+            }
+        }
+    }
+    const graph = new ModuleDepGraph([...modules.values()].map((e) => e.manifest));
+    const cycle = graph.hasCycle();
+    if (cycle) {
+        throw new ManifestLoadError('cycle', `cycle detected in module dependency graph: [${cycle.cycle.join(' → ')}]`);
+    }
+    return { modules, graph, participants: collectLifecycleParticipants(modules.values()) };
+}
+/**
+ * Convenience for tests: resolve `modulesRoot` relative to a test file.
+ * Avoids hard-coding paths that break under different working dirs.
+ */
+export function resolveFromFile(metaUrl, relative) {
+    return resolve(dirname(fileURLToPath(metaUrl)), relative);
+}
+/** Test helper — assert that a value is one of the known load-error kinds. */
+export function isLoadError(err) {
+    return err instanceof ManifestLoadError;
+}
+/**
+ * Production loader entry point: scans the project's
+ * `backend/src/modules` for every `manifest.ts`. Skips the fixtures
+ * trees under `test/`. Used by `composition.ts` at boot.
+ */
+export async function loadProjectManifests(modulesRoot) {
+    return discoverManifests({
+        modulesRoot,
+        exclude: [],
+    });
+}
+/**
+ * The folder name a **directory-named** module's id comes from.
+ *
+ * It answers for the anchor {@link discoverManifests} produces — a
+ * `manifest.ts` under `<modules root>/<id>/`. It refuses a `package.json`
+ * anchor, which is what a resolved package entry's `filePath` is (feature 080,
+ * T032): `basename(dirname(...))` would answer `mod-blog`, the tail of an npm
+ * name, which is neither the module id nor even unique without the `@scope`
+ * this drops. A confident wrong answer is worse than a refusal — a package's id
+ * is its `endora.id`, and `resolvedManifestEntries()` already carries it.
+ */
+export function folderNameFromPath(filePath) {
+    if (basename(filePath) === 'package.json') {
+        throw new ManifestLoadError('package-root', `${filePath} is a package.json, so it anchors an installed package rather than a ` +
+            `directory-named module. A package's id is its "endora.id" field (D-142), not its ` +
+            `folder name; read it from the manifest entry instead of deriving it from the path.`);
+    }
+    return basename(dirname(filePath));
+}
+//# sourceMappingURL=manifest-loader.js.map

package/dist/lifecycle/services/manifest-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-loader.js","sourceRoot":"","sources":["../../../src/lifecycle/services/manifest-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EACL,oBAAoB,GAOrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAoDhD;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA2C;IAE3C,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,SAAiB;IACzC,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,SAAS,EAAE,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAExB;IADlB,YACkB,IAOE,EAClB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAVC,SAAI,GAAJ,IAAI,CAOF;QAIlB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAkBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,6EAA6E;IAC7E,uDAAuD;IACvD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,GAAG,IAAI,iFAAiF;YACtF,+EAA+E;YAC/E,sFAAsF;YACtF,iEAAiE;YACjE,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC5C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE5D,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAEhC,IAAI,QAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAiC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,gCAAgC,QAAQ,IAAI;gBAC1C,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,kBAAkB,QAAQ,wCAAwC,CACnE,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,MAAM,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EACpB,eAAe,QAAQ,iBAAiB,MAAM,CAAC,EAAE,iBAAiB;gBAChE,WAAW,UAAU,uDAAuD;gBAC5E,iFAAiF;gBACjF,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,iBAAiB,CACzB,UAAU,EACV,aAAa,MAAM,CAAC,EAAE,sBAAsB,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,gBAAgB,MAAM,CAAC,EAAE,wBAAwB;gBAC/C,GAAG,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,GAAG,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,aAAa,MAAM,CAAC,EAAE,qCAAqC;gBACzD,eAAe,MAAM,CAAC,QAAQ,CAAC,UAAU,iBAAiB,CAC7D,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;YACrB,QAAQ,EAAE,MAAM;YAChB,QAAQ;YACR,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,QAAQ,CAAC,oBAAoB;gBAC/B,CAAC,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;IACL,CAAC;IAED,mEAAmE;IACnE,+DAA+D;IAC/D,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CACzB,YAAY,EACZ,aAAa,KAAK,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,WAAW;oBAC3D,8CAA8C,IAAI,GAAG,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,iBAAiB,CACzB,OAAO,EACP,+CAA+C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,4BAA4B,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,QAAgB;IAC/D,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CACzB,GAAY;IAEZ,OAAO,GAAG,YAAY,iBAAiB,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB;IAEnB,OAAO,iBAAiB,CAAQ;QAC9B,WAAW;QACX,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,cAAc,EAAE,CAAC;QAC1C,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,GAAG,QAAQ,uEAAuE;YAChF,mFAAmF;YACnF,oFAAoF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/lifecycle/services/migration-ownership.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Which module owns which migration — the question `uninstall --hard` reverts
+ * by, declared where the orchestrator that asks it lives (feature 080,
+ * D-160.11).
+ *
+ * The **answer** is the host application's: it is merged from the committed
+ * core registry plus whatever extension packages this instance installed, which
+ * only a composition root knows. That merge stays in
+ * `backend/src/db/configured-migrations.ts`, which re-exports this type so the
+ * host's callers keep one name for it. What moved here is the *shape*, because
+ * a platform file may not name a file the host owns (D-52/D-53) and the
+ * orchestrator's whole use of it is `deps.migrationOwnership`.
+ */
+/**
+ * Which module owns which migration, and — the part that has to be a separate
+ * question — whether this registry is in a position to answer at all.
+ *
+ * `null` from {@link MigrationOwnership.migrationNamesFor} means *"I cannot
+ * answer for that module"*, and an empty array means *"that module owns no
+ * migration"*. Collapsing the two is the fail-open the lifecycle orchestrator
+ * shipped: a package whose entries the orchestrator could not see
+ * hard-uninstalled to a **warning** and left its table in the database
+ * (D-155.3(c)). The return type is where the distinction lives, in the idiom
+ * `allowedIdsFor(): Promise<string[] | null>` already uses in this tree —
+ * a caller cannot forget to ask, because `null` is not a list of names.
+ */
+export interface MigrationOwnership {
+    /**
+     * Migration class names owned by `moduleId`, ascending by class name, or
+     * `null` when this registry covers no module of that name.
+     */
+    migrationNamesFor(moduleId: string): readonly string[] | null;
+    /** The modules this registry can answer for. Named in the refusal message. */
+    readonly coveredModuleIds: ReadonlySet<string>;
+}
+//# sourceMappingURL=migration-ownership.d.ts.map

package/dist/lifecycle/services/migration-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-ownership.d.ts","sourceRoot":"","sources":["../../../src/lifecycle/services/migration-ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9D,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChD"}

package/dist/lifecycle/services/migration-ownership.js

@@ -0,0 +1,15 @@
+/**
+ * Which module owns which migration — the question `uninstall --hard` reverts
+ * by, declared where the orchestrator that asks it lives (feature 080,
+ * D-160.11).
+ *
+ * The **answer** is the host application's: it is merged from the committed
+ * core registry plus whatever extension packages this instance installed, which
+ * only a composition root knows. That merge stays in
+ * `backend/src/db/configured-migrations.ts`, which re-exports this type so the
+ * host's callers keep one name for it. What moved here is the *shape*, because
+ * a platform file may not name a file the host owns (D-52/D-53) and the
+ * orchestrator's whole use of it is `deps.migrationOwnership`.
+ */
+export {};
+//# sourceMappingURL=migration-ownership.js.map

package/dist/lifecycle/services/migration-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-ownership.js","sourceRoot":"","sources":["../../../src/lifecycle/services/migration-ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/lifecycle/services/module-id-claims.d.ts

@@ -0,0 +1,38 @@
+export type { ModuleIdClaimOrigin } from './module-origin.js';
+import type { ModuleIdClaimOrigin } from './module-origin.js';
+export interface ModuleIdClaim {
+    readonly id: string;
+    readonly origin: ModuleIdClaimOrigin;
+    /**
+     * The file that claims the id: `manifest.ts` for a core or overlay module,
+     * the resolved `package.json` for an installed package. It is the whole
+     * remedy — an operator can only act on a path.
+     */
+    readonly claimedBy: string;
+    /** The npm package name, where there is one. */
+    readonly name?: string;
+}
+export interface ModuleIdCollision {
+    readonly id: string;
+    /** Every claimant, in the order they were offered. */
+    readonly claims: readonly ModuleIdClaim[];
+}
+/**
+ * Every module id claimed by more than one source, whatever those sources are.
+ *
+ * There is no qualifier. There used to be one — *"where at least one of them is
+ * an installed package"* — and it excluded exactly the pair feature 103 is
+ * about: a core id and an overlay id, which had a shipped answer of its own
+ * (drop the overlay) resting on a shadowing reading D-201 retires. A module id
+ * is one identity with one owner, and which two sources happen to claim it says
+ * nothing about whether the platform can run.
+ */
+export declare function moduleIdCollisions(claims: readonly ModuleIdClaim[]): ModuleIdCollision[];
+/** The refusal. A distinct type, per D-101's rule that absence refusals stay distinct. */
+export declare class ModuleIdCollisionError extends Error {
+    readonly collisions: readonly ModuleIdCollision[];
+    constructor(collisions: readonly ModuleIdCollision[]);
+}
+/** {@link moduleIdCollisions}, as the refusal a composition root makes. */
+export declare function assertNoModuleIdCollisions(claims: readonly ModuleIdClaim[]): void;
+//# sourceMappingURL=module-id-claims.d.ts.map

package/dist/lifecycle/services/module-id-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-id-claims.d.ts","sourceRoot":"","sources":["../../../src/lifecycle/services/module-id-claims.ts"],"names":[],"mappings":"AAqEA,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;CAC3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,iBAAiB,EAAE,CAcxF;AAED,0FAA0F;AAC1F,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;gBAEtC,UAAU,EAAE,SAAS,iBAAiB,EAAE;CAKrD;AAkDD,2EAA2E;AAC3E,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAGjF"}

package/dist/lifecycle/services/module-id-claims.js

@@ -0,0 +1,123 @@
+// Module id collisions (T030c, D-155.7; widened to the overlay by feature 103).
+//
+// A module id is the platform's identity for a module: migrations are ordered
+// and reverted by it, permissions and settings are namespaced by it, and the
+// lifecycle registry is keyed on it. Nothing refused a second claimant on the
+// path a package takes, and the consequences were not theoretical:
+//
+//   - `composeModules` had no id-uniqueness assertion, so both entries
+//     composed. What surfaced — if anything did — was a
+//     `DuplicateRegistrationError` naming the registration key and the module
+//     id twice, and neither vendor. Two claimants registering disjoint names
+//     collided on nothing at all.
+//   - `resolvedManifestEntries` is a `Map` keyed by id: core won silently and
+//     among the rest the last writer won, silently. So the manifest set carried
+//     one module while the container ran two.
+//   - `buildStaticRegistry` does throw the right refusal, and was reached only
+//     by the `module:*` CLI scripts, each of which fed bare-core
+//     `REGISTERED_MANIFESTS`. The right refusal, wired where a package could not
+//     reach it. Since T036 those five read the resolved set — but they reach
+//     *this* file's refusal, not that one, because the resolver keys a `Map` by
+//     id and no duplicate survives to `buildStaticRegistry`. That is the better
+//     of the two: this one still holds both vendors and can name them.
+//
+// Two vendors' `blog` packages therefore produced correctly-scoped,
+// differently-stamped migration class names — no `duplicate-name`, no
+// `unscoped-name` — and `orderMigrations` merged two strangers' chains into one
+// contiguous block under one id. A hard uninstall of `blog` reverted both,
+// because `revertMigrationsFor` filters on `moduleId` and nothing downstream
+// can tell the two apart.
+//
+// `specs/081-per-module-migration-order/contracts/migration-identity.md` §2
+// already argues its sufficiency from *"the lifecycle refuses a second module
+// claiming an id"*. This file, and `kernel/lifecycle/unique-module-ids.ts`, are
+// what make that sentence true.
+//
+// **Why the refusal is placed twice.** Discovery is the only layer that still
+// holds both vendors — by `composeModules` an entry is an id, a version and a
+// function — so this is where the message that names both `package.json` paths
+// can be written. The composition seam is where the guarantee becomes
+// structural for *any* entry source rather than a property of one loader.
+//
+// **The population is every claimant, not only a package's** (feature 103,
+// FR-004). It used to be "at least one claimant is an installed package",
+// because an overlay claiming a core id had a different, shipped answer: the
+// overlay was dropped, on the reading that a deployment shadowing a module it
+// authored is what the overlay mechanism is for. File shadowing is retired
+// (D-201), so that reading has no referent left — and the drop was never the
+// whole answer anyway. `resolvedManifestEntries` dropped the manifest while
+// `overlayModuleEntriesUnder` composed the module, so a deployment could run a
+// module the resolved registry did not know about: no `module_registrations`
+// row, no permission-catalogue entry, and routes gated on the effective state
+// of somebody else's module of the same id. One rule, reached by both readers,
+// is what replaces it.
+/**
+ * Every module id claimed by more than one source, whatever those sources are.
+ *
+ * There is no qualifier. There used to be one — *"where at least one of them is
+ * an installed package"* — and it excluded exactly the pair feature 103 is
+ * about: a core id and an overlay id, which had a shipped answer of its own
+ * (drop the overlay) resting on a shadowing reading D-201 retires. A module id
+ * is one identity with one owner, and which two sources happen to claim it says
+ * nothing about whether the platform can run.
+ */
+export function moduleIdCollisions(claims) {
+    const byId = new Map();
+    for (const claim of claims) {
+        const existing = byId.get(claim.id);
+        if (existing)
+            existing.push(claim);
+        else
+            byId.set(claim.id, [claim]);
+    }
+    const collisions = [];
+    for (const [id, claimants] of byId) {
+        if (claimants.length < 2)
+            continue;
+        collisions.push({ id, claims: claimants });
+    }
+    return collisions;
+}
+/** The refusal. A distinct type, per D-101's rule that absence refusals stay distinct. */
+export class ModuleIdCollisionError extends Error {
+    collisions;
+    constructor(collisions) {
+        super(refusalMessage(collisions));
+        this.name = 'ModuleIdCollisionError';
+        this.collisions = collisions;
+    }
+}
+const ORIGIN_LABEL = {
+    core: 'a core module',
+    overlay: "this deployment's overlay",
+    package: 'an installed package',
+};
+function refusalMessage(collisions) {
+    const lines = [
+        'This instance will not start: more than one module claims the same module id.',
+        '',
+    ];
+    for (const collision of collisions) {
+        lines.push(`  ${collision.id} — claimed by ${collision.claims.length}:`);
+        for (const claim of collision.claims) {
+            lines.push(`      ${ORIGIN_LABEL[claim.origin]}${claim.name ? ` (${claim.name})` : ''}`, `          ${claim.claimedBy}`);
+        }
+        lines.push('');
+    }
+    lines.push('A module id is the platform\'s identity for a module: migrations are ordered and reverted', 'by it, settings and permissions are namespaced by it, and the lifecycle registry is keyed', 'on it. Two claimants cannot be told apart afterwards — a hard uninstall of the id would', 'revert both vendors\' migrations — so this is refused rather than resolved by picking one.', '');
+    const origins = new Set(collisions.flatMap((collision) => collision.claims.map((claim) => claim.origin)));
+    if (origins.has('package')) {
+        lines.push('remedy: `pnpm remove` one of the packages above, or ask its author to change `endora.id`.', 'The npm package name is not the identity (D-142) and renaming it changes nothing here.');
+    }
+    if (origins.has('overlay')) {
+        lines.push("remedy: give the overlay module above an id of this deployment's own. An overlay module", 'is an additive, client-only module (D-103); it does not replace, extend or shadow the', 'module whose id it took — file shadowing is retired (D-201) — so sharing an id buys it', 'nothing and costs it its registry row, its settings and its permissions.');
+    }
+    return lines.join('\n');
+}
+/** {@link moduleIdCollisions}, as the refusal a composition root makes. */
+export function assertNoModuleIdCollisions(claims) {
+    const collisions = moduleIdCollisions(claims);
+    if (collisions.length > 0)
+        throw new ModuleIdCollisionError(collisions);
+}
+//# sourceMappingURL=module-id-claims.js.map

package/dist/lifecycle/services/module-id-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-id-claims.js","sourceRoot":"","sources":["../../../src/lifecycle/services/module-id-claims.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,wDAAwD;AACxD,8EAA8E;AAC9E,6EAA6E;AAC7E,kCAAkC;AAClC,8EAA8E;AAC9E,gFAAgF;AAChF,8CAA8C;AAC9C,+EAA+E;AAC/E,iEAAiE;AACjE,iFAAiF;AACjF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,uEAAuE;AACvE,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,gFAAgF;AAChF,2EAA2E;AAC3E,6EAA6E;AAC7E,0BAA0B;AAC1B,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,gCAAgC;AAChC,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,sEAAsE;AACtE,0EAA0E;AAC1E,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,uBAAuB;AAuCvB;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAgC;IACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACnC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,0FAA0F;AAC1F,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,UAAU,CAA+B;IAElD,YAAY,UAAwC;QAClD,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,YAAY,GAAwC;IACxD,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,2BAA2B;IACpC,OAAO,EAAE,sBAAsB;CAChC,CAAC;AAEF,SAAS,cAAc,CAAC,UAAwC;IAC9D,MAAM,KAAK,GAAa;QACtB,+EAA+E;QAC/E,EAAE;KACH,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,EAAE,iBAAiB,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CACR,SAAS,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5E,aAAa,KAAK,CAAC,SAAS,EAAE,CAC/B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CACR,2FAA2F,EAC3F,2FAA2F,EAC3F,yFAAyF,EACzF,4FAA4F,EAC5F,EAAE,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CACjF,CAAC;IACF,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,2FAA2F,EAC3F,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,yFAAyF,EACzF,uFAAuF,EACvF,wFAAwF,EACxF,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,0BAA0B,CAAC,MAAgC;IACzE,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC1E,CAAC"}

package/dist/lifecycle/services/module-origin.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Which discovery produced a module entry, and the one split that is taken from
+ * it (feature 080, D-160.11).
+ *
+ * It was declared in `backend/src/packages/module-id-claims.ts` and re-exported
+ * through the host's manifest registry, which is a reach out of the platform
+ * into the host application: the presence load types
+ * `ShippedModuleEntry.origin` on it and narrows the first-boot insert
+ * population with {@link deploymentShippedEntries}, and both of those are the
+ * platform's. The **claims** machinery — who claimed an id, from which
+ * `package.json`, and the refusal naming both — stays host-side, because it is
+ * about runtime package discovery, which the host owns (D-119/D-155).
+ *
+ * There is deliberately no `'installed'` beside `'package'` and no containment
+ * test that could produce one. A workspace module package and an installed one
+ * are the same directory shape, and in a deployed build both resolve under
+ * `node_modules`; what separates them is which discovery produced the entry,
+ * which is known at construction and nowhere else.
+ */
+import type { ModuleManifest } from '@endora-commerce/contracts';
+/** Where a claim on a module id came from. */
+export type ModuleIdClaimOrigin = 'core' | 'overlay' | 'package';
+/**
+ * The entries **this build ships**: core plus the deployment's overlay modules,
+ * never an installed package.
+ *
+ * The single spelling of D-157.6(b)'s split, because it has two readers and a
+ * derived fact written down twice is two answers waiting to disagree (D-100).
+ * Both readers converge state at boot for a module nobody ran a command for,
+ * and both must stop at the same line:
+ *
+ *   - `firstBootInsertPopulation` — the `module_registrations` insert. A package
+ *     converged here is a package `module:install` will answer
+ *     `already-installed` about, having applied none of its migrations.
+ *   - the **boot settings reconcile** (`composition.ts`, and the harness beside
+ *     it). An overlay module has no `install` at all, so boot is the only author
+ *     its activation Setting can have; a package has exactly one author,
+ *     `install`, which reconciles its settings inside the operation that also
+ *     runs its migrations. Reconciling a package's manifest at boot would let a
+ *     `SettingCodeConflict` in something an operator merely `pnpm add`ed abort
+ *     the platform's start.
+ *
+ * Generic over the entry, so a caller keeps whatever fields it had: the presence
+ * load hands it `{ manifest, filePath }` and a composition root hands it whole
+ * `RegisteredManifestEntry` values.
+ */
+export declare function deploymentShippedEntries<E extends {
+    readonly origin: ModuleIdClaimOrigin;
+}>(entries: readonly E[]): E[];
+/** A manifest plus where it came from — the minimum both readers above need. */
+export interface OriginatedManifestEntry {
+    readonly manifest: ModuleManifest;
+    readonly origin: ModuleIdClaimOrigin;
+}
+//# sourceMappingURL=module-origin.d.ts.map

package/dist/lifecycle/services/module-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-origin.d.ts","sourceRoot":"","sources":["../../../src/lifecycle/services/module-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,8CAA8C;AAC9C,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,EACzF,OAAO,EAAE,SAAS,CAAC,EAAE,GACpB,CAAC,EAAE,CAEL;AAED,gFAAgF;AAChF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC"}

package/dist/lifecycle/services/module-origin.js

@@ -0,0 +1,47 @@
+/**
+ * Which discovery produced a module entry, and the one split that is taken from
+ * it (feature 080, D-160.11).
+ *
+ * It was declared in `backend/src/packages/module-id-claims.ts` and re-exported
+ * through the host's manifest registry, which is a reach out of the platform
+ * into the host application: the presence load types
+ * `ShippedModuleEntry.origin` on it and narrows the first-boot insert
+ * population with {@link deploymentShippedEntries}, and both of those are the
+ * platform's. The **claims** machinery — who claimed an id, from which
+ * `package.json`, and the refusal naming both — stays host-side, because it is
+ * about runtime package discovery, which the host owns (D-119/D-155).
+ *
+ * There is deliberately no `'installed'` beside `'package'` and no containment
+ * test that could produce one. A workspace module package and an installed one
+ * are the same directory shape, and in a deployed build both resolve under
+ * `node_modules`; what separates them is which discovery produced the entry,
+ * which is known at construction and nowhere else.
+ */
+/**
+ * The entries **this build ships**: core plus the deployment's overlay modules,
+ * never an installed package.
+ *
+ * The single spelling of D-157.6(b)'s split, because it has two readers and a
+ * derived fact written down twice is two answers waiting to disagree (D-100).
+ * Both readers converge state at boot for a module nobody ran a command for,
+ * and both must stop at the same line:
+ *
+ *   - `firstBootInsertPopulation` — the `module_registrations` insert. A package
+ *     converged here is a package `module:install` will answer
+ *     `already-installed` about, having applied none of its migrations.
+ *   - the **boot settings reconcile** (`composition.ts`, and the harness beside
+ *     it). An overlay module has no `install` at all, so boot is the only author
+ *     its activation Setting can have; a package has exactly one author,
+ *     `install`, which reconciles its settings inside the operation that also
+ *     runs its migrations. Reconciling a package's manifest at boot would let a
+ *     `SettingCodeConflict` in something an operator merely `pnpm add`ed abort
+ *     the platform's start.
+ *
+ * Generic over the entry, so a caller keeps whatever fields it had: the presence
+ * load hands it `{ manifest, filePath }` and a composition root hands it whole
+ * `RegisteredManifestEntry` values.
+ */
+export function deploymentShippedEntries(entries) {
+    return entries.filter((entry) => entry.origin !== 'package');
+}
+//# sourceMappingURL=module-origin.js.map

package/dist/lifecycle/services/module-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-origin.js","sourceRoot":"","sources":["../../../src/lifecycle/services/module-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAqB;IAErB,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;AAC/D,CAAC"}