@open-mercato/cli 0.10.1-develop.7983.1.fd91207efe → 0.10.1-develop.7994.1.c9f31972aa

package/dist/agentic/guides/modules/security/index.md

@@ -1,5 +1,5 @@
 # security — module facts (generated, do not edit)
-<!-- generated from @open-mercato/enterprise 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/enterprise 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/enterprise/src/modules/security
 
 ## Sections

package/dist/agentic/guides/modules/seeds/index.md

@@ -1,5 +1,5 @@
 # seeds — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/seeds
 
 ## Sections

package/dist/agentic/guides/modules/shipping_carriers/index.md

@@ -1,5 +1,5 @@
 # shipping_carriers — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/shipping_carriers
 
 ## Sections

package/dist/agentic/guides/modules/sso/index.md

@@ -1,5 +1,5 @@
 # sso — module facts (generated, do not edit)
-<!-- generated from @open-mercato/enterprise 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/enterprise 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/enterprise/src/modules/sso
 
 ## Sections

package/dist/agentic/guides/modules/staff/index.md

@@ -1,5 +1,5 @@
 # staff — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/staff
 
 ## Sections

package/dist/agentic/guides/modules/storage_s3/index.md

@@ -1,5 +1,5 @@
 # storage_s3 — module facts (generated, do not edit)
-<!-- generated from @open-mercato/storage-s3 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/storage-s3 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/storage-s3/src/modules/storage_s3
 
 ## Sections

package/dist/agentic/guides/modules/sync_akeneo/index.md

@@ -1,5 +1,5 @@
 # sync_akeneo — module facts (generated, do not edit)
-<!-- generated from @open-mercato/sync-akeneo 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/sync-akeneo 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/sync-akeneo/src/modules/sync_akeneo
 
 ## Sections

package/dist/agentic/guides/modules/sync_excel/index.md

@@ -1,5 +1,5 @@
 # sync_excel — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/sync_excel
 
 ## Sections

package/dist/agentic/guides/modules/system_status_overlays/index.md

@@ -1,5 +1,5 @@
 # system_status_overlays — module facts (generated, do not edit)
-<!-- generated from @open-mercato/enterprise 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/enterprise 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/enterprise/src/modules/system_status_overlays
 
 ## Sections

package/dist/agentic/guides/modules/telemetry/index.md

@@ -1,5 +1,5 @@
 # telemetry — module facts (generated, do not edit)
-<!-- generated from @open-mercato/telemetry 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/telemetry 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/telemetry/src/modules/telemetry
 
 ## Sections

package/dist/agentic/guides/modules/tillio/index.md

@@ -1,5 +1,5 @@
 # tillio — module facts (generated, do not edit)
-<!-- generated from @open-mercato/tillio 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/tillio 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/tillio/src/modules/tillio
 
 ## Sections

package/dist/agentic/guides/modules/translations/index.md

@@ -1,5 +1,5 @@
 # translations — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/translations
 
 ## Sections

package/dist/agentic/guides/modules/warranty_claims/index.md

@@ -1,5 +1,5 @@
 # warranty_claims — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/warranty_claims
 
 ## Sections

package/dist/agentic/guides/modules/webhooks/index.md

@@ -1,5 +1,5 @@
 # webhooks — module facts (generated, do not edit)
-<!-- generated from @open-mercato/webhooks 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/webhooks 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/webhooks/src/modules/webhooks
 
 ## Sections

package/dist/agentic/guides/modules/wms/index.md

@@ -1,5 +1,5 @@
 # wms — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/wms
 
 ## Sections

package/dist/agentic/guides/modules/workflows/index.md

@@ -1,5 +1,5 @@
 # workflows — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.10.1-develop.7983.1.fd91207efe; core 0.10.1-develop.7983.1.fd91207efe — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.10.1-develop.7994.1.c9f31972aa; core 0.10.1-develop.7994.1.c9f31972aa — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/workflows
 
 ## Sections

package/dist/agentic/guides/reference-module-facts.json

@@ -1185,7 +1185,7 @@
     "facts": {
       "title": "Example Module",
       "description": "Demonstrates pages, APIs, entities and DI.",
-      "coreVersion": "0.10.1-develop.7983.1.fd91207efe",
+      "coreVersion": "0.10.1-develop.7994.1.c9f31972aa",
       "sourcePackage": null,
       "sourceVersion": null,
       "sourceRoot": "src/modules/example",

package/dist/agentic/guides/upstream/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generator": "@open-mercato/cli@0.10.1-develop.7983.1.fd91207efe",
+  "generator": "@open-mercato/cli@0.10.1-develop.7994.1.c9f31972aa",
   "files": {
     "AGENTS.md": "35c948a32e06ca64b4706970c55ec60946412b410938b22478233a2c5c43df56",
     "BACKWARD_COMPATIBILITY.md": "4fd70dbc9acff26540bb6f290996df23831583a48b025623b49761c42dddbc59"

package/dist/agentic/shared/ai/harness/cases.json

@@ -21696,13 +21696,15 @@
     "mode": "analysis",
     "evaluationKind": "routing",
     "risk": "medium",
-    "prompt": "I am already inside a create-mercato-app Cloud sandbox. Explain the supported npx tool commands to start a new visits module, or package an existing visits module, then publish it to npm and a dedicated GitHub repository. Include a local preview before remote publication and explain how to keep developing in this same app after publication, including the optional repository link and its portability. Distinguish npm login, environment token and trusted publishing requirements. Prepare the workflow only; do not publish or create remote resources.",
+    "prompt": "I am already inside a create-mercato-app Cloud sandbox. Explain the supported npx tool commands to start a new visits module, or package an existing visits module, then publish it to npm and a dedicated GitHub repository. Include a local preview before remote publication and explain how to keep developing in this same app after publication, including the optional repository link and its portability. Distinguish npm login, environment token and trusted publishing requirements. Prepare the workflow only; do not publish or create remote resources. For the receiving app, also explain installing under a dependency alias, rejecting two providers with the same runtime module ID, keeping npm and GitHub source identities distinct, explicitly disabling all consumers before replacing a binding, and preserving local source/provenance when ejecting. Explain resolving old-origin dependants and manual imports and successfully regenerating/building while the old provider remains installed, then replacing the binding and verifying generation/build again. Identify what disabling does not remove.",
     "tags": [
       "architecture",
       "module-package",
       "publication",
       "source-link",
-      "auth"
+      "auth",
+      "module-installation",
+      "source-identity"
     ],
     "owner": {
       "kind": "guide",
@@ -21722,15 +21724,22 @@
     "context": {
       "required": [
         "AGENTS.md",
-        ".ai/guides/module-tool.md"
+        ".ai/guides/module-tool.md",
+        "node_modules/@open-mercato/cli/src/lib/module-install.ts",
+        "node_modules/@open-mercato/cli/src/lib/module-identity.ts",
+        "node_modules/@open-mercato/cli/src/lib/eject.ts"
       ],
       "allowedExtra": [
         ".ai/guides/architecture.md"
       ],
       "forbidden": [
         ".env*",
-        ".git/**",
-        "node_modules/**"
+        ".git/**"
+      ],
+      "sourceReferenceIds": [
+        "guides/module-tool:node_modules/@open-mercato/cli/src/lib/module-install.ts",
+        "guides/module-tool:node_modules/@open-mercato/cli/src/lib/module-identity.ts",
+        "guides/module-tool:node_modules/@open-mercato/cli/src/lib/eject.ts"
       ]
     },
     "requiredDecisions": [
@@ -21739,7 +21748,12 @@
       "fresh-consumer-third-party",
       "app-source-preserved",
       "optional-repository-source-link",
-      "npm-auth-mode-boundaries"
+      "npm-auth-mode-boundaries",
+      "module-binding-is-not-runtime-id",
+      "npm-github-origins-distinct",
+      "one-enabled-provider-per-runtime-id",
+      "explicit-provider-replacement",
+      "eject-retains-source-provenance"
     ],
     "forbiddenPatterns": [
       "(?:print|display|commit).{0,30}(?:NPM_TOKEN|NODE_AUTH_TOKEN|raw token)",
@@ -21754,9 +21768,9 @@
       "context.forbidden",
       "patterns.forbidden"
     ],
-    "maxContextFiles": 3,
-    "maxInitialContextBytes": 32768,
-    "maxTotalContextBytes": 32768,
+    "maxContextFiles": 6,
+    "maxInitialContextBytes": 73728,
+    "maxTotalContextBytes": 81920,
     "relatedCases": [
       "OMH-002",
       "OMH-046",

package/dist/agentic/shared/ai/harness/source-link-inventory.json

@@ -2,10 +2,10 @@
   "version": 1,
   "generatedNote": "Derived asset — the app-facing projection of the repository source-link inventory, regenerated with `yarn workspace create-mercato-app harness:generate-source-link-inventory`. Never hand-edit. Harness cases resolve `context.sourceReferenceIds` against `referenceId` here; a record with `readStatus: \"qa-only\"` is validation evidence only and is refused as a case reference.",
   "derived": {
-    "ownerCount": 32,
-    "recordCount": 155,
-    "sourceRequiredCount": 130,
-    "readableCount": 155,
+    "ownerCount": 33,
+    "recordCount": 159,
+    "sourceRequiredCount": 133,
+    "readableCount": 159,
     "baselineSha": "f7c941570003f3abe920b1765995cbef98dcad0b"
   },
   "notCovered": [
@@ -615,6 +615,81 @@
         "migration"
       ]
     },
+    {
+      "referenceId": "guides/module-tool:node_modules/@open-mercato/cli/src/lib/eject.ts",
+      "requirement": "source-required",
+      "originAsset": ".ai/guides/module-tool.md",
+      "heading": "Receiving app: installation, aliases, and replacement",
+      "href": "../../node_modules/@open-mercato/cli/src/lib/eject.ts",
+      "targetKind": "installed-package",
+      "readStatus": "readable",
+      "resolvedPath": "node_modules/@open-mercato/cli/src/lib/eject.ts",
+      "moduleId": null,
+      "capabilityIds": [],
+      "packageName": "@open-mercato/cli",
+      "packageRelativePath": "src/lib/eject.ts",
+      "presets": [
+        "classic",
+        "crm",
+        "empty",
+        "wms"
+      ],
+      "tiers": [
+        "automation",
+        "core",
+        "migration"
+      ]
+    },
+    {
+      "referenceId": "guides/module-tool:node_modules/@open-mercato/cli/src/lib/module-identity.ts",
+      "requirement": "source-required",
+      "originAsset": ".ai/guides/module-tool.md",
+      "heading": "Receiving app: installation, aliases, and replacement",
+      "href": "../../node_modules/@open-mercato/cli/src/lib/module-identity.ts",
+      "targetKind": "installed-package",
+      "readStatus": "readable",
+      "resolvedPath": "node_modules/@open-mercato/cli/src/lib/module-identity.ts",
+      "moduleId": null,
+      "capabilityIds": [],
+      "packageName": "@open-mercato/cli",
+      "packageRelativePath": "src/lib/module-identity.ts",
+      "presets": [
+        "classic",
+        "crm",
+        "empty",
+        "wms"
+      ],
+      "tiers": [
+        "automation",
+        "core",
+        "migration"
+      ]
+    },
+    {
+      "referenceId": "guides/module-tool:node_modules/@open-mercato/cli/src/lib/module-install.ts",
+      "requirement": "source-required",
+      "originAsset": ".ai/guides/module-tool.md",
+      "heading": "Receiving app: installation, aliases, and replacement",
+      "href": "../../node_modules/@open-mercato/cli/src/lib/module-install.ts",
+      "targetKind": "installed-package",
+      "readStatus": "readable",
+      "resolvedPath": "node_modules/@open-mercato/cli/src/lib/module-install.ts",
+      "moduleId": null,
+      "capabilityIds": [],
+      "packageName": "@open-mercato/cli",
+      "packageRelativePath": "src/lib/module-install.ts",
+      "presets": [
+        "classic",
+        "crm",
+        "empty",
+        "wms"
+      ],
+      "tiers": [
+        "automation",
+        "core",
+        "migration"
+      ]
+    },
     {
       "referenceId": "om-backend-ui-design/crud-surfaces:README.md",
       "requirement": "source-required",
@@ -3913,6 +3988,17 @@
         "core"
       ]
     },
+    {
+      "referenceId": "rule:guides/module-tool#file-artifact-unknown-origin",
+      "requirement": "retained-normative-snippet",
+      "originAsset": ".ai/guides/module-tool.md",
+      "heading": null,
+      "targetKind": "local-owner",
+      "readStatus": "readable",
+      "resolvedPath": ".ai/guides/module-tool.md",
+      "moduleId": null,
+      "capabilityIds": []
+    },
     {
       "referenceId": "rule:guides/testing-debugging#generated-output-is-not-a-patch-target",
       "requirement": "retained-normative-snippet",

package/dist/lib/__integration__/TC-INT-007.spec.js

@@ -19,21 +19,34 @@ const fixtureModulePackage = path.join(
 function yarnBinary() {
   return process.platform === "win32" ? "yarn.cmd" : "yarn";
 }
-function runCommand(command, args, cwd) {
+function runCommand(command, args, cwd, environment = {}) {
   const yarnCacheFolder = path.join(cwd, ".yarn", "cache");
-  return execFileSync(command, args, {
-    cwd,
-    encoding: "utf8",
-    env: {
-      ...process.env,
-      FORCE_COLOR: "0",
-      NODE_NO_WARNINGS: "1",
-      YARN_CACHE_FOLDER: yarnCacheFolder,
-      YARN_ENABLE_GLOBAL_CACHE: "0",
-      YARN_ENABLE_IMMUTABLE_INSTALLS: "0",
-      YARN_NODE_LINKER: "node-modules"
-    }
-  });
+  try {
+    return execFileSync(command, args, {
+      cwd,
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        FORCE_COLOR: "0",
+        NODE_NO_WARNINGS: "1",
+        YARN_CACHE_FOLDER: yarnCacheFolder,
+        YARN_ENABLE_GLOBAL_CACHE: "0",
+        YARN_ENABLE_IMMUTABLE_INSTALLS: "0",
+        YARN_NODE_LINKER: "node-modules",
+        ...environment
+      }
+    });
+  } catch (error) {
+    if (!error || typeof error !== "object") throw error;
+    const errorRecord = error;
+    const outputs = ["stdout", "stderr"].flatMap((streamName) => {
+      const output = errorRecord[streamName];
+      return typeof output === "string" || Buffer.isBuffer(output) ? [output.toString().trim()] : [];
+    }).filter(Boolean);
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(outputs.length > 0 ? `${message}
+${outputs.join("\n")}` : message);
+  }
 }
 function runMercato(args, cwd) {
   return runCommand(process.execPath, [cliBin, ...args], cwd);
@@ -69,6 +82,7 @@ const commentedModulesSource = [
   ""
 ].join("\n");
 function createMonorepoFixture(rootDir) {
+  writeFile(path.join(rootDir, "yarn.lock"), "");
   writeFile(
     path.join(rootDir, "package.json"),
     JSON.stringify(
@@ -103,6 +117,7 @@ function createMonorepoFixture(rootDir) {
   return appDir;
 }
 function createStandaloneFixture(rootDir) {
+  writeFile(path.join(rootDir, "yarn.lock"), "");
   writeFile(
     path.join(rootDir, ".yarnrc.yml"),
     ["nodeLinker: node-modules", "enableGlobalCache: false", "cacheFolder: ./.yarn/cache", ""].join("\n")
@@ -173,13 +188,182 @@ test.describe("TC-INT-007: CLI official module install and eject flows", () => {
       );
       const modulesSource = readFile(path.join(appDir, "src", "modules.ts"));
       const cssSource = readFile(path.join(appDir, ".mercato", "generated", "module-package-sources.css"));
-      expect(modulesSource).toContain("{ id: 'test_package', from: '@app' }");
+      expect(modulesSource).toMatch(/id: 'test_package', from: '@app'/);
+      expect(modulesSource).not.toContain("locator:");
+      expect(modulesSource).toContain("packageName: '@open-mercato/test-package'");
       expect(fs.existsSync(path.join(appDir, "src", "modules", "test_package", "index.ts"))).toBe(true);
+      expect(readFile(path.join(appDir, "src", "modules", "test_package", "index.ts"))).toBe(readFile(path.join(fixtureModulePackage, "src", "modules", "test_package", "index.ts")));
       expect(cssSource).toBe("");
     } finally {
       fs.rmSync(appDir, { recursive: true, force: true });
     }
   });
+  test("module add reports dependencies that must be enabled before registration", () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), "mercato-cli-standalone-dependencies-"));
+    try {
+      createStandaloneFixture(appDir);
+      const packageDir = path.join(appDir, "fixture-module-package");
+      fs.cpSync(fixtureModulePackage, packageDir, { recursive: true });
+      writeFile(
+        path.join(packageDir, "src", "modules", "test_package", "index.ts"),
+        "export const metadata = { id: 'test_package', requires: ['customers'], ejectable: true }\n"
+      );
+      runCommand(yarnBinary(), ["install"], appDir);
+      expect(() => runMercato(
+        ["module", "add", "@open-mercato/test-package@file:./fixture-module-package"],
+        appDir
+      )).toThrow(/requires module\(s\) that are not enabled: customers/);
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toBe("export const enabledModules = []\n");
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true });
+    }
+  });
+  test("module add resolves canonical requirements from retained ejected origins", () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), "mercato-cli-canonical-requires-"));
+    try {
+      createStandaloneFixture(appDir);
+      const packageDir = path.join(appDir, "fixture-module-package");
+      fs.cpSync(fixtureModulePackage, packageDir, { recursive: true });
+      const requirements = [
+        "@pkarw/marketing_consents@preview",
+        "npm:@pkarw/marketing_consents@1.0.0",
+        "github:pkarw/marketing-consents",
+        "npm:consent-helper@next",
+        "github:pkarw/consent-tools#main",
+        "pkarw/consent-tools",
+        "https://github.com/pkarw/consent-tools.git#release",
+        "ssh://git@github.com/pkarw/consent-tools.git#main",
+        "git@github.com:pkarw/consent-tools.git",
+        "github:pkarw/installed-tools",
+        "npm:@open-mercato/core@preview"
+      ];
+      writeFile(
+        path.join(packageDir, "src", "modules", "test_package", "index.ts"),
+        `export const metadata = { id: 'test_package', requires: ${JSON.stringify(requirements)}, ejectable: true }
+`
+      );
+      const entries = [
+        { id: "marketing_consents", from: "@app", locator: "github:pkarw/marketing-consents", packageName: "@pkarw/marketing_consents" },
+        { id: "npm_consents", from: "@app", locator: "npm:@pkarw/marketing_consents", packageName: "@pkarw/marketing_consents" },
+        { id: "npm_core", from: "@app", locator: "npm:@open-mercato/core", packageName: "@open-mercato/core" },
+        { id: "consent_helper", from: "@app", locator: "npm:consent-helper" },
+        { id: "consent_tools", from: "@app", locator: "github:pkarw/consent-tools" }
+      ];
+      for (const entry of entries) {
+        writeFile(
+          path.join(appDir, "src", "modules", entry.id, "index.ts"),
+          `export const metadata = { id: '${entry.id}' }
+`
+        );
+      }
+      const corePackageDir = path.join(appDir, "vendor", "core");
+      writeFile(
+        path.join(corePackageDir, "package.json"),
+        JSON.stringify({ name: "@open-mercato/core", version: "0.4.7", type: "module", repository: { type: "git", url: "https://github.com/pkarw/installed-tools.git" } })
+      );
+      writeFile(
+        path.join(corePackageDir, "src", "modules", "repository_tools", "index.ts"),
+        "export const metadata = { id: 'repository_tools' }\n"
+      );
+      writeFile(
+        path.join(corePackageDir, "dist", "modules", "repository_tools", "index.js"),
+        "export const metadata = { id: 'repository_tools' }\n"
+      );
+      const enabledEntries = [...entries, { id: "repository_tools", from: "@open-mercato/core", locator: "github:pkarw/installed-tools" }];
+      writeFile(path.join(appDir, "src", "modules.ts"), `export const enabledModules = ${JSON.stringify(enabledEntries)}
+`);
+      runCommand(yarnBinary(), ["install"], appDir);
+      runMercato(["module", "add", "npm:@open-mercato/test-package@file:./fixture-module-package"], appDir);
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("id: 'test_package'");
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true });
+    }
+  });
+  test("same-name modules from different origins do not satisfy canonical requirements", () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), "mercato-cli-wrong-origin-"));
+    try {
+      createStandaloneFixture(appDir);
+      const packageDir = path.join(appDir, "fixture-module-package");
+      fs.cpSync(fixtureModulePackage, packageDir, { recursive: true });
+      writeFile(
+        path.join(packageDir, "src", "modules", "test_package", "index.ts"),
+        "export const metadata = { id: 'test_package', requires: ['@pkarw/marketing_consents', 'github:pkarw/consent-tools'], ejectable: true }\n"
+      );
+      const modulesSource = `export const enabledModules = [
+        { id: 'marketing_consents', from: '@app', locator: 'npm:@open-mercato/marketing_consents' },
+        { id: 'consent_tools', from: '@app', locator: 'github:another-owner/consent-tools' },
+      ]
+`;
+      writeFile(path.join(appDir, "src", "modules.ts"), modulesSource);
+      runCommand(yarnBinary(), ["install"], appDir);
+      expect(() => runMercato(
+        ["module", "add", "@open-mercato/test-package@file:./fixture-module-package", "--eject"],
+        appDir
+      )).toThrow(/@pkarw\/marketing_consents[\s\S]*github:pkarw\/consent-tools[\s\S]*npx create-mercato-module install/);
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toBe(modulesSource);
+      expect(fs.existsSync(path.join(appDir, "src", "modules", "test_package"))).toBe(false);
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true });
+    }
+  });
+  test("module add rejects a same-ID source collision before ejecting", () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), "mercato-cli-module-collision-"));
+    try {
+      createStandaloneFixture(appDir);
+      const modulesSource = "export const enabledModules = [{ id: 'test_package', from: '@app', locator: 'github:another-owner/test-package' }]\n";
+      const localSource = "export const metadata = { id: 'test_package', locator: 'github:another-owner/test-package' }\n";
+      writeFile(path.join(appDir, "src", "modules.ts"), modulesSource);
+      writeFile(path.join(appDir, "src", "modules", "test_package", "index.ts"), localSource);
+      runCommand(yarnBinary(), ["install"], appDir);
+      expect(() => runMercato(
+        ["module", "add", `@open-mercato/test-package@file:${fixtureModulePackage}`, "--eject"],
+        appDir
+      )).toThrow(/(?=[\s\S]*test_package)(?=[\s\S]*(?:collision|already|conflict))(?=[\s\S]*another-owner)(?=[\s\S]*@open-mercato\/test-package)/i);
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toBe(modulesSource);
+      expect(readFile(path.join(appDir, "src", "modules", "test_package", "index.ts"))).toBe(localSource);
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true });
+    }
+  });
+  test("GitHub locators detect a runtime ID collision before invoking Yarn", () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), "mercato-cli-github-collision-"));
+    try {
+      createStandaloneFixture(appDir);
+      const modulesSource = "export const enabledModules = [{ id: 'test_package', from: '@app', locator: 'github:other/test-package' }]\n";
+      writeFile(path.join(appDir, "src", "modules.ts"), modulesSource);
+      const originalManifest = readFile(path.join(appDir, "package.json"));
+      const executableDir = path.join(appDir, "bin");
+      const packageManifest = Buffer.from(JSON.stringify({ name: "@pkarw/test-package" })).toString("base64");
+      const ghPath = path.join(executableDir, "gh");
+      writeFile(ghPath, `#!/usr/bin/env node
+const endpoint = process.argv[3]
+const sha = 'a'.repeat(40)
+const value = endpoint === 'user' ? { login: 'pkarw' }
+  : endpoint.includes('/commits/') ? { sha }
+  : endpoint.includes('/contents/') ? { encoding: 'base64', content: ${JSON.stringify(packageManifest)} }
+  : endpoint.includes('/git/trees/') ? { tree: [{ path: 'src/modules/test_package/index.ts' }] }
+  : { default_branch: 'main' }
+process.stdout.write(JSON.stringify(value))
+`);
+      const yarnPath = path.join(executableDir, "yarn");
+      const marker = path.join(appDir, "yarn-invoked");
+      writeFile(yarnPath, "#!/usr/bin/env node\nrequire('node:fs').writeFileSync(process.env.COLLISION_YARN_MARKER, 'invoked')\nprocess.exit(1)\n");
+      fs.chmodSync(ghPath, 493);
+      fs.chmodSync(yarnPath, 493);
+      for (const locator of ["github:pkarw/test-package", "https://github.com/pkarw/test-package.git", "git@github.com:pkarw/test-package.git", "github:test-package"]) {
+        expect(() => runCommand(process.execPath, [cliBin, "module", "add", locator, "--allow-third-party"], appDir, {
+          PATH: executableDir + path.delimiter + process.env.PATH,
+          COLLISION_YARN_MARKER: marker
+        })).toThrow(/Module name collision[\s\S]*test_package[\s\S]*github:other\/test-package[\s\S]*github:pkarw\/test-package/);
+      }
+      expect(fs.existsSync(marker)).toBe(false);
+      expect(readFile(path.join(appDir, "package.json"))).toBe(originalManifest);
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toBe(modulesSource);
+      expect(fs.existsSync(path.join(appDir, "src", "modules", "test_package"))).toBe(false);
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true });
+    }
+  });
   test("module enable supports package-backed and ejected flows plus both eject entrypoints", () => {
     const appDir = fs.mkdtempSync(path.join(os.tmpdir(), "mercato-cli-standalone-eject-"));
     try {
@@ -192,22 +376,26 @@ test.describe("TC-INT-007: CLI official module install and eject flows", () => {
       );
       runMercato(["module", "enable", "@open-mercato/test-package"], appDir);
       expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain(
-        "{ id: 'test_package', from: '@open-mercato/test-package' }"
+        "id: 'test_package', from: '@open-mercato/test-package'"
       );
       writeFile(path.join(appDir, "src", "modules.ts"), "export const enabledModules = []\n");
       fs.rmSync(path.join(appDir, "src", "modules", "test_package"), { recursive: true, force: true });
       runMercato(["module", "enable", "@open-mercato/test-package", "--eject"], appDir);
-      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("{ id: 'test_package', from: '@app' }");
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("id: 'test_package', from: '@app'");
       expect(fs.existsSync(path.join(appDir, "src", "modules", "test_package", "index.ts"))).toBe(true);
       expect(readFile(path.join(appDir, ".mercato", "generated", "module-package-sources.css"))).toBe("");
       writeFile(path.join(appDir, "src", "modules.ts"), "export const enabledModules = [{ id: 'test_package', from: '@open-mercato/test-package' }]\n");
       fs.rmSync(path.join(appDir, "src", "modules", "test_package"), { recursive: true, force: true });
       runMercato(["module", "eject", "test_package"], appDir);
-      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("{ id: 'test_package', from: '@app' }");
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("packageName: '@open-mercato/test-package'");
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).not.toContain("locator: 'npm:@open-mercato/test-package'");
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("id: 'test_package', from: '@app'");
       writeFile(path.join(appDir, "src", "modules.ts"), "export const enabledModules = [{ id: 'test_package', from: '@open-mercato/test-package' }]\n");
       fs.rmSync(path.join(appDir, "src", "modules", "test_package"), { recursive: true, force: true });
       runMercato(["eject", "test_package"], appDir);
-      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("{ id: 'test_package', from: '@app' }");
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("packageName: '@open-mercato/test-package'");
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).not.toContain("locator: 'npm:@open-mercato/test-package'");
+      expect(readFile(path.join(appDir, "src", "modules.ts"))).toContain("id: 'test_package', from: '@app'");
     } finally {
       fs.rmSync(appDir, { recursive: true, force: true });
     }