@open-mercato/cli 0.10.1-develop.7990.1.82d0a183c5 → 0.10.1-develop.8004.1.a8a79ee43f

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.10.1-develop.7990.1.82d0a183c5",
+  "version": "0.10.1-develop.8004.1.a8a79ee43f",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.10.1-develop.7990.1.82d0a183c5",
-    "@open-mercato/queue": "0.10.1-develop.7990.1.82d0a183c5",
-    "@open-mercato/shared": "0.10.1-develop.7990.1.82d0a183c5",
-    "@open-mercato/telemetry": "0.10.1-develop.7990.1.82d0a183c5",
+    "@open-mercato/events": "0.10.1-develop.8004.1.a8a79ee43f",
+    "@open-mercato/queue": "0.10.1-develop.8004.1.a8a79ee43f",
+    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f",
+    "@open-mercato/telemetry": "0.10.1-develop.8004.1.a8a79ee43f",
     "cross-spawn": "^7.0.6",
     "minisearch": "7.2.0",
     "pg": "8.23.0",
@@ -75,10 +75,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7990.1.82d0a183c5"
+    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7990.1.82d0a183c5",
+    "@open-mercato/shared": "0.10.1-develop.8004.1.a8a79ee43f",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"

package/src/__tests__/mercato.test.ts

@@ -1112,6 +1112,47 @@ describe('init command failure output', () => {
     )
   }
 
+  it.each(['--reinstall', '--no-demo-users'])('rejects unsafe production init before side effects with %s', async (flag) => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const authSetup = jest.fn().mockResolvedValue(undefined)
+    mockInitDependencies({ authSetup })
+    process.env.NODE_ENV = 'production'
+    process.env.OM_INIT_SUPERADMIN_PASSWORD = 'password'
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', flag, '--skip-password-policy'])).toBe(1)
+      const { Client } = await import('pg')
+      const { generateEntityIds } = await import('../lib/generators')
+      const { dbMigrate } = await import('../lib/db')
+      expect(Client).not.toHaveBeenCalled()
+      expect(generateEntityIds).not.toHaveBeenCalled()
+      expect(dbMigrate).not.toHaveBeenCalled()
+      expect(authSetup).not.toHaveBeenCalled()
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
+  it('passes valid production credentials to auth setup without bypassing policy', async () => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const authSetup = jest.fn().mockResolvedValue(undefined)
+    mockInitDependencies({ authSetup })
+    process.env.NODE_ENV = 'production'
+    process.env.OM_INIT_SUPERADMIN_PASSWORD = 'Unique-Owner-937!'
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', '--no-demo-users', '--skip-password-policy'])).toBe(0)
+      expect(authSetup).toHaveBeenCalledWith(expect.arrayContaining(['--password', 'Unique-Owner-937!']))
+      expect(authSetup.mock.calls[0][0]).not.toContain('--skip-password-policy')
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
   it('passes --include-demo-users to auth setup by default', async () => {
     const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
     const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
@@ -1125,8 +1166,8 @@ describe('init command failure output', () => {
     expect(authSetup).toHaveBeenCalledWith(expect.arrayContaining(['--include-demo-users']))
     expect(consoleLogSpy).toHaveBeenCalledWith('👤 Demo accounts (admin@/employee@): enabled')
     const loggedLines = consoleLogSpy.mock.calls.map((args) => args.join(' '))
-    expect(loggedLines.some((line) => line.includes('🧰 Admin:'))).toBe(true)
-    expect(loggedLines.some((line) => line.includes('👷 Employee:'))).toBe(true)
+    expect(loggedLines.some((line) => line.includes('🧰 Admin'))).toBe(true)
+    expect(loggedLines.some((line) => line.includes('👷 Employee'))).toBe(true)
 
     consoleErrorSpy.mockRestore()
     consoleLogSpy.mockRestore()
@@ -1148,8 +1189,8 @@ describe('init command failure output', () => {
       '👤 Demo accounts (admin@/employee@): skipped (--no-demo-users)',
     )
     const loggedLines = consoleLogSpy.mock.calls.map((args) => args.join(' '))
-    expect(loggedLines.some((line) => line.includes('🧰 Admin:'))).toBe(false)
-    expect(loggedLines.some((line) => line.includes('👷 Employee:'))).toBe(false)
+    expect(loggedLines.some((line) => line.includes('🧰 Admin'))).toBe(false)
+    expect(loggedLines.some((line) => line.includes('👷 Employee'))).toBe(false)
 
     consoleErrorSpy.mockRestore()
     consoleLogSpy.mockRestore()
@@ -1336,6 +1377,22 @@ describe('init on an already initialized database', () => {
     consoleLogSpy.mockRestore()
   })
 
+  it('skips an initialized production database without bootstrap credentials', async () => {
+    const previousEnv = { ...process.env }
+    jest.spyOn(console, 'error').mockImplementation()
+    jest.spyOn(console, 'log').mockImplementation()
+    const { generateEntityIds } = mockSeededDatabase('3')
+    process.env.NODE_ENV = 'production'
+    delete process.env.OM_INIT_SUPERADMIN_PASSWORD
+    try {
+      const mercato = await import('../mercato')
+      expect(await mercato.run(['node', 'mercato', 'init', '--skip-if-initialized'])).toBe(0)
+      expect(generateEntityIds).not.toHaveBeenCalled()
+    } finally {
+      process.env = previousEnv
+    }
+  })
+
   it('keeps the data, names the target database and exits 0 with --skip-if-initialized', async () => {
     const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
     const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
@@ -1735,6 +1792,11 @@ describe('server dev managed process exits', () => {
     expect(exitCode).toBe(0)
     expect(consoleErrorSpy).not.toHaveBeenCalled()
     expect(consoleLogSpy).toHaveBeenCalledWith('[server] Skipping scheduler auto-start — module not enabled')
+    const { spawn } = await import('child_process')
+    const nextSpawn = (spawn as jest.Mock).mock.calls.find((call) =>
+      pathIncludes(call[1]?.[0] ?? '', 'next/dist/bin/next') && call[1]?.includes('dev'),
+    )
+    expect(nextSpawn?.[2]?.env.NODE_ENV).toBe('development')
 
     consoleErrorSpy.mockRestore()
     consoleLogSpy.mockRestore()
@@ -2477,6 +2539,11 @@ describe('server start managed process exits', () => {
     expect(exitCode).toBe(0)
     expect(consoleErrorSpy).not.toHaveBeenCalled()
     expect(consoleLogSpy).toHaveBeenCalledWith('[server] Skipping scheduler auto-start — module not enabled')
+    const { spawn } = await import('child_process')
+    const nextSpawn = (spawn as jest.Mock).mock.calls.find((call) =>
+      pathIncludes(call[1]?.[0] ?? '', 'next/dist/bin/next') && call[1]?.includes('start'),
+    )
+    expect(nextSpawn?.[2]?.env.NODE_ENV).toBe('production')
 
     consoleErrorSpy.mockRestore()
     consoleLogSpy.mockRestore()

package/src/i18n/de.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Das Superadmin-Passwort für die Produktion erfüllt die konfigurierte Passwortrichtlinie nicht. Flags zum Umgehen der Passwortrichtlinie gelten nur außerhalb der Produktion.",
+  "cli.init.errors.superadminPasswordRequired": "Die Produktionsinitialisierung erfordert ein eindeutiges Superadmin-Passwort über OM_INIT_SUPERADMIN_PASSWORD oder --password; integrierte Platzhalter sind nicht zulässig."
+}

package/src/i18n/en.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Production superadmin password does not meet the configured password policy. Password-policy bypass flags apply only outside production.",
+  "cli.init.errors.superadminPasswordRequired": "Production initialization requires a unique superadmin password via OM_INIT_SUPERADMIN_PASSWORD or --password; built-in placeholders are not allowed."
+}

package/src/i18n/es.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "La contraseña de superadministrador en producción no cumple la política de contraseñas configurada. Las opciones para omitir la política solo se aplican fuera de producción.",
+  "cli.init.errors.superadminPasswordRequired": "La inicialización en producción requiere una contraseña única de superadministrador mediante OM_INIT_SUPERADMIN_PASSWORD o --password; no se permiten los valores predeterminados de ejemplo."
+}

package/src/i18n/ko.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "프로덕션 슈퍼관리자 비밀번호가 설정된 비밀번호 정책을 충족하지 않습니다. 비밀번호 정책 우회 플래그는 프로덕션 외 환경에서만 적용됩니다.",
+  "cli.init.errors.superadminPasswordRequired": "프로덕션 초기화에는 OM_INIT_SUPERADMIN_PASSWORD 또는 --password로 지정한 고유한 슈퍼관리자 비밀번호가 필요합니다. 기본 예시 비밀번호는 사용할 수 없습니다."
+}

package/src/i18n/pl.json

@@ -0,0 +1,4 @@
+{
+  "cli.init.errors.superadminPasswordPolicy": "Hasło superadministratora w środowisku produkcyjnym nie spełnia skonfigurowanej polityki haseł. Flagi pomijające politykę haseł działają tylko poza środowiskiem produkcyjnym.",
+  "cli.init.errors.superadminPasswordRequired": "Inicjalizacja produkcyjna wymaga unikalnego hasła superadministratora podanego przez OM_INIT_SUPERADMIN_PASSWORD lub --password; wbudowane hasła przykładowe są niedozwolone."
+}

package/src/lib/__fixtures__/official-module-package/dist/modules/test_package/widgets/injection/test/widget.js

@@ -0,0 +1 @@
+export default function widget() {}

package/src/lib/__integration__/TC-INT-007.spec.ts

@@ -22,21 +22,33 @@ function yarnBinary(): string {
   return process.platform === 'win32' ? 'yarn.cmd' : 'yarn'
 }
 
-function runCommand(command: string, args: string[], cwd: string): string {
+function runCommand(command: string, args: string[], cwd: string, environment: NodeJS.ProcessEnv = {}): string {
   const yarnCacheFolder = path.join(cwd, '.yarn', 'cache')
-  return execFileSync(command, args, {
-    cwd,
-    encoding: 'utf8',
-    env: {
-      ...process.env,
-      FORCE_COLOR: '0',
-      NODE_NO_WARNINGS: '1',
-      YARN_CACHE_FOLDER: yarnCacheFolder,
-      YARN_ENABLE_GLOBAL_CACHE: '0',
-      YARN_ENABLE_IMMUTABLE_INSTALLS: '0',
-      YARN_NODE_LINKER: 'node-modules',
-    },
-  })
+  try {
+    return execFileSync(command, args, {
+      cwd,
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        FORCE_COLOR: '0',
+        NODE_NO_WARNINGS: '1',
+        YARN_CACHE_FOLDER: yarnCacheFolder,
+        YARN_ENABLE_GLOBAL_CACHE: '0',
+        YARN_ENABLE_IMMUTABLE_INSTALLS: '0',
+        YARN_NODE_LINKER: 'node-modules',
+        ...environment,
+      },
+    })
+  } catch (error) {
+    if (!error || typeof error !== 'object') throw error
+    const errorRecord = error as Record<string, unknown>
+    const outputs = ['stdout', 'stderr'].flatMap((streamName) => {
+      const output = errorRecord[streamName]
+      return typeof output === 'string' || Buffer.isBuffer(output) ? [output.toString().trim()] : []
+    }).filter(Boolean)
+    const message = error instanceof Error ? error.message : String(error)
+    throw new Error(outputs.length > 0 ? `${message}\n${outputs.join('\n')}` : message)
+  }
 }
 
 function runMercato(args: string[], cwd: string): string {
@@ -77,6 +89,7 @@ const commentedModulesSource = [
 ].join('\n')
 
 function createMonorepoFixture(rootDir: string): string {
+  writeFile(path.join(rootDir, 'yarn.lock'), '')
   writeFile(
     path.join(rootDir, 'package.json'),
     JSON.stringify(
@@ -113,6 +126,7 @@ function createMonorepoFixture(rootDir: string): string {
 }
 
 function createStandaloneFixture(rootDir: string): string {
+  writeFile(path.join(rootDir, 'yarn.lock'), '')
   writeFile(
     path.join(rootDir, '.yarnrc.yml'),
     ['nodeLinker: node-modules', 'enableGlobalCache: false', 'cacheFolder: ./.yarn/cache', ''].join('\n'),
@@ -196,14 +210,196 @@ test.describe('TC-INT-007: CLI official module install and eject flows', () => {
       const modulesSource = readFile(path.join(appDir, 'src', 'modules.ts'))
       const cssSource = readFile(path.join(appDir, '.mercato', 'generated', 'module-package-sources.css'))
 
-      expect(modulesSource).toContain("{ id: 'test_package', from: '@app' }")
+      expect(modulesSource).toMatch(/id: 'test_package', from: '@app'/)
+      expect(modulesSource).not.toContain('locator:')
+      expect(modulesSource).toContain("packageName: '@open-mercato/test-package'")
       expect(fs.existsSync(path.join(appDir, 'src', 'modules', 'test_package', 'index.ts'))).toBe(true)
+      expect(readFile(path.join(appDir, 'src', 'modules', 'test_package', 'index.ts'))).toBe(readFile(path.join(fixtureModulePackage, 'src', 'modules', 'test_package', 'index.ts')))
       expect(cssSource).toBe('')
     } finally {
       fs.rmSync(appDir, { recursive: true, force: true })
     }
   })
 
+  test('module add reports dependencies that must be enabled before registration', () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mercato-cli-standalone-dependencies-'))
+
+    try {
+      createStandaloneFixture(appDir)
+      const packageDir = path.join(appDir, 'fixture-module-package')
+      fs.cpSync(fixtureModulePackage, packageDir, { recursive: true })
+      writeFile(
+        path.join(packageDir, 'src', 'modules', 'test_package', 'index.ts'),
+        "export const metadata = { id: 'test_package', requires: ['customers'], ejectable: true }\n",
+      )
+      runCommand(yarnBinary(), ['install'], appDir)
+
+      expect(() => runMercato(
+        ['module', 'add', '@open-mercato/test-package@file:./fixture-module-package'],
+        appDir,
+      )).toThrow(/requires module\(s\) that are not enabled: customers/)
+
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toBe('export const enabledModules = []\n')
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true })
+    }
+  })
+
+  test('module add resolves canonical requirements from retained ejected origins', () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mercato-cli-canonical-requires-'))
+
+    try {
+      createStandaloneFixture(appDir)
+      const packageDir = path.join(appDir, 'fixture-module-package')
+      fs.cpSync(fixtureModulePackage, packageDir, { recursive: true })
+      const requirements = [
+        '@pkarw/marketing_consents@preview',
+        'npm:@pkarw/marketing_consents@1.0.0',
+        'github:pkarw/marketing-consents',
+        'npm:consent-helper@next',
+        'github:pkarw/consent-tools#main',
+        'pkarw/consent-tools',
+        'https://github.com/pkarw/consent-tools.git#release',
+        'ssh://git@github.com/pkarw/consent-tools.git#main',
+        'git@github.com:pkarw/consent-tools.git',
+        'github:pkarw/installed-tools',
+        'npm:@open-mercato/core@preview',
+      ]
+      writeFile(
+        path.join(packageDir, 'src', 'modules', 'test_package', 'index.ts'),
+        `export const metadata = { id: 'test_package', requires: ${JSON.stringify(requirements)}, ejectable: true }\n`,
+      )
+      const entries = [
+        { id: 'marketing_consents', from: '@app', locator: 'github:pkarw/marketing-consents', packageName: '@pkarw/marketing_consents' },
+        { id: 'npm_consents', from: '@app', locator: 'npm:@pkarw/marketing_consents', packageName: '@pkarw/marketing_consents' },
+        { id: 'npm_core', from: '@app', locator: 'npm:@open-mercato/core', packageName: '@open-mercato/core' },
+        { id: 'consent_helper', from: '@app', locator: 'npm:consent-helper' },
+        { id: 'consent_tools', from: '@app', locator: 'github:pkarw/consent-tools' },
+      ]
+      for (const entry of entries) {
+        writeFile(
+          path.join(appDir, 'src', 'modules', entry.id, 'index.ts'),
+          `export const metadata = { id: '${entry.id}' }\n`,
+        )
+      }
+      const corePackageDir = path.join(appDir, 'vendor', 'core')
+      writeFile(
+        path.join(corePackageDir, 'package.json'),
+        JSON.stringify({ name: '@open-mercato/core', version: '0.4.7', type: 'module', repository: { type: 'git', url: 'https://github.com/pkarw/installed-tools.git' } }),
+      )
+      writeFile(
+        path.join(corePackageDir, 'src', 'modules', 'repository_tools', 'index.ts'),
+        "export const metadata = { id: 'repository_tools' }\n",
+      )
+      writeFile(
+        path.join(corePackageDir, 'dist', 'modules', 'repository_tools', 'index.js'),
+        "export const metadata = { id: 'repository_tools' }\n",
+      )
+      const enabledEntries = [...entries, { id: 'repository_tools', from: '@open-mercato/core', locator: 'github:pkarw/installed-tools' }]
+      writeFile(path.join(appDir, 'src', 'modules.ts'), `export const enabledModules = ${JSON.stringify(enabledEntries)}\n`)
+      runCommand(yarnBinary(), ['install'], appDir)
+
+      runMercato(['module', 'add', 'npm:@open-mercato/test-package@file:./fixture-module-package'], appDir)
+
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("id: 'test_package'")
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true })
+    }
+  })
+
+  test('same-name modules from different origins do not satisfy canonical requirements', () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mercato-cli-wrong-origin-'))
+
+    try {
+      createStandaloneFixture(appDir)
+      const packageDir = path.join(appDir, 'fixture-module-package')
+      fs.cpSync(fixtureModulePackage, packageDir, { recursive: true })
+      writeFile(
+        path.join(packageDir, 'src', 'modules', 'test_package', 'index.ts'),
+        "export const metadata = { id: 'test_package', requires: ['@pkarw/marketing_consents', 'github:pkarw/consent-tools'], ejectable: true }\n",
+      )
+      const modulesSource = `export const enabledModules = [
+        { id: 'marketing_consents', from: '@app', locator: 'npm:@open-mercato/marketing_consents' },
+        { id: 'consent_tools', from: '@app', locator: 'github:another-owner/consent-tools' },
+      ]\n`
+      writeFile(path.join(appDir, 'src', 'modules.ts'), modulesSource)
+      runCommand(yarnBinary(), ['install'], appDir)
+
+      expect(() => runMercato(
+        ['module', 'add', '@open-mercato/test-package@file:./fixture-module-package', '--eject'],
+        appDir,
+      )).toThrow(/@pkarw\/marketing_consents[\s\S]*github:pkarw\/consent-tools[\s\S]*npx create-mercato-module install/)
+
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toBe(modulesSource)
+      expect(fs.existsSync(path.join(appDir, 'src', 'modules', 'test_package'))).toBe(false)
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true })
+    }
+  })
+
+  test('module add rejects a same-ID source collision before ejecting', () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mercato-cli-module-collision-'))
+
+    try {
+      createStandaloneFixture(appDir)
+      const modulesSource = "export const enabledModules = [{ id: 'test_package', from: '@app', locator: 'github:another-owner/test-package' }]\n"
+      const localSource = "export const metadata = { id: 'test_package', locator: 'github:another-owner/test-package' }\n"
+      writeFile(path.join(appDir, 'src', 'modules.ts'), modulesSource)
+      writeFile(path.join(appDir, 'src', 'modules', 'test_package', 'index.ts'), localSource)
+      runCommand(yarnBinary(), ['install'], appDir)
+
+      expect(() => runMercato(
+        ['module', 'add', `@open-mercato/test-package@file:${fixtureModulePackage}`, '--eject'],
+        appDir,
+      )).toThrow(/(?=[\s\S]*test_package)(?=[\s\S]*(?:collision|already|conflict))(?=[\s\S]*another-owner)(?=[\s\S]*@open-mercato\/test-package)/i)
+
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toBe(modulesSource)
+      expect(readFile(path.join(appDir, 'src', 'modules', 'test_package', 'index.ts'))).toBe(localSource)
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true })
+    }
+  })
+
+  test('GitHub locators detect a runtime ID collision before invoking Yarn', () => {
+    const appDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mercato-cli-github-collision-'))
+    try {
+      createStandaloneFixture(appDir)
+      const modulesSource = "export const enabledModules = [{ id: 'test_package', from: '@app', locator: 'github:other/test-package' }]\n"
+      writeFile(path.join(appDir, 'src', 'modules.ts'), modulesSource)
+      const originalManifest = readFile(path.join(appDir, 'package.json'))
+      const executableDir = path.join(appDir, 'bin')
+      const packageManifest = Buffer.from(JSON.stringify({ name: '@pkarw/test-package' })).toString('base64')
+      const ghPath = path.join(executableDir, 'gh')
+      writeFile(ghPath, `#!/usr/bin/env node
+const endpoint = process.argv[3]
+const sha = 'a'.repeat(40)
+const value = endpoint === 'user' ? { login: 'pkarw' }
+  : endpoint.includes('/commits/') ? { sha }
+  : endpoint.includes('/contents/') ? { encoding: 'base64', content: ${JSON.stringify(packageManifest)} }
+  : endpoint.includes('/git/trees/') ? { tree: [{ path: 'src/modules/test_package/index.ts' }] }
+  : { default_branch: 'main' }
+process.stdout.write(JSON.stringify(value))
+`)
+      const yarnPath = path.join(executableDir, 'yarn')
+      const marker = path.join(appDir, 'yarn-invoked')
+      writeFile(yarnPath, "#!/usr/bin/env node\nrequire('node:fs').writeFileSync(process.env.COLLISION_YARN_MARKER, 'invoked')\nprocess.exit(1)\n")
+      fs.chmodSync(ghPath, 0o755)
+      fs.chmodSync(yarnPath, 0o755)
+      for (const locator of ['github:pkarw/test-package', 'https://github.com/pkarw/test-package.git', 'git@github.com:pkarw/test-package.git', 'github:test-package']) {
+        expect(() => runCommand(process.execPath, [cliBin, 'module', 'add', locator, '--allow-third-party'], appDir, {
+          PATH: executableDir + path.delimiter + process.env.PATH,
+          COLLISION_YARN_MARKER: marker,
+        })).toThrow(/Module name collision[\s\S]*test_package[\s\S]*github:other\/test-package[\s\S]*github:pkarw\/test-package/)
+      }
+      expect(fs.existsSync(marker)).toBe(false)
+      expect(readFile(path.join(appDir, 'package.json'))).toBe(originalManifest)
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toBe(modulesSource)
+      expect(fs.existsSync(path.join(appDir, 'src', 'modules', 'test_package'))).toBe(false)
+    } finally {
+      fs.rmSync(appDir, { recursive: true, force: true })
+    }
+  })
+
   test('module enable supports package-backed and ejected flows plus both eject entrypoints', () => {
     const appDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mercato-cli-standalone-eject-'))
 
@@ -218,25 +414,29 @@ test.describe('TC-INT-007: CLI official module install and eject flows', () => {
 
       runMercato(['module', 'enable', '@open-mercato/test-package'], appDir)
       expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain(
-        "{ id: 'test_package', from: '@open-mercato/test-package' }",
+        "id: 'test_package', from: '@open-mercato/test-package'",
       )
 
       writeFile(path.join(appDir, 'src', 'modules.ts'), 'export const enabledModules = []\n')
       fs.rmSync(path.join(appDir, 'src', 'modules', 'test_package'), { recursive: true, force: true })
       runMercato(['module', 'enable', '@open-mercato/test-package', '--eject'], appDir)
-      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("{ id: 'test_package', from: '@app' }")
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("id: 'test_package', from: '@app'")
       expect(fs.existsSync(path.join(appDir, 'src', 'modules', 'test_package', 'index.ts'))).toBe(true)
       expect(readFile(path.join(appDir, '.mercato', 'generated', 'module-package-sources.css'))).toBe('')
 
       writeFile(path.join(appDir, 'src', 'modules.ts'), "export const enabledModules = [{ id: 'test_package', from: '@open-mercato/test-package' }]\n")
       fs.rmSync(path.join(appDir, 'src', 'modules', 'test_package'), { recursive: true, force: true })
       runMercato(['module', 'eject', 'test_package'], appDir)
-      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("{ id: 'test_package', from: '@app' }")
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("packageName: '@open-mercato/test-package'")
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).not.toContain("locator: 'npm:@open-mercato/test-package'")
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("id: 'test_package', from: '@app'")
 
       writeFile(path.join(appDir, 'src', 'modules.ts'), "export const enabledModules = [{ id: 'test_package', from: '@open-mercato/test-package' }]\n")
       fs.rmSync(path.join(appDir, 'src', 'modules', 'test_package'), { recursive: true, force: true })
       runMercato(['eject', 'test_package'], appDir)
-      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("{ id: 'test_package', from: '@app' }")
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("packageName: '@open-mercato/test-package'")
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).not.toContain("locator: 'npm:@open-mercato/test-package'")
+      expect(readFile(path.join(appDir, 'src', 'modules.ts'))).toContain("id: 'test_package', from: '@app'")
     } finally {
       fs.rmSync(appDir, { recursive: true, force: true })
     }