@open-mercato/cli 0.10.1-develop.7990.1.82d0a183c5 → 0.10.1-develop.8004.1.a8a79ee43f

package/src/lib/__tests__/module-package.test.ts

@@ -3,6 +3,7 @@ import os from 'node:os'
 import path from 'node:path'
 import type { PackageResolver } from '../resolver'
 import {
+  assertModulePackageExports,
   discoverModulesInPackage,
   parsePackageNameFromSpec,
   readOfficialModulePackageFromRoot,
@@ -57,6 +58,39 @@ describe('module-package', () => {
     expect(modulePackage.distModuleDir).toContain(path.join('dist', 'modules', 'test_package'))
   })
 
+  it('reads static dependency ids from the module descriptor', () => {
+    const packageRoot = path.join(tmpDir, 'package-with-dependencies')
+    copyDir(fixturePackageRoot, packageRoot)
+    fs.writeFileSync(
+      path.join(packageRoot, 'src', 'modules', 'test_package', 'index.ts'),
+      [
+        'export const metadata = {',
+        "  title: 'Test Package',",
+        "  requires: ['customers', 'catalog'],",
+        '  ejectable: true,',
+        '} as const',
+        '',
+      ].join('\n'),
+    )
+
+    const modulePackage = readOfficialModulePackageFromRoot(packageRoot)
+
+    expect(modulePackage.moduleInfo.requires).toEqual(['customers', 'catalog'])
+  })
+
+  it('rejects a dynamic dependency declaration that cannot be checked safely', () => {
+    const packageRoot = path.join(tmpDir, 'package-with-dynamic-dependencies')
+    copyDir(fixturePackageRoot, packageRoot)
+    fs.writeFileSync(
+      path.join(packageRoot, 'src', 'modules', 'test_package', 'index.ts'),
+      "const dependencies = ['customers']\nexport const metadata = { requires: dependencies }\n",
+    )
+
+    expect(() => readOfficialModulePackageFromRoot(packageRoot)).toThrow(
+      'must declare "requires" as a static string array',
+    )
+  })
+
   it('validates a third-party (non-@open-mercato) module package by structure', () => {
     const packageRoot = path.join(tmpDir, 'node_modules', '@fast-white-cat', 'integration-ksef-direct')
     for (const base of ['src', 'dist']) {
@@ -104,6 +138,126 @@ describe('module-package', () => {
     expect(modulePackage.metadata.moduleId).toBe('test_package')
   })
 
+  it('resolves an installed alias while retaining the canonical manifest name', () => {
+    const appDir = path.join(tmpDir, 'app')
+    const packageRoot = path.join(appDir, 'node_modules', 'candidate_consents')
+    fs.mkdirSync(appDir, { recursive: true })
+    copyDir(fixturePackageRoot, packageRoot)
+    fs.writeFileSync(path.join(appDir, 'package.json'), JSON.stringify({ dependencies: { candidate_consents: 'npm:@open-mercato/test-package@1.0.0' } }))
+    fs.writeFileSync(path.join(packageRoot, 'package.json'), JSON.stringify({ name: '@open-mercato/test-package', exports: { '.': './dist/modules/test_package/index.js', './modules/*': { import: './dist/modules/*.js' } } }))
+    const resolver = { getAppDir: () => appDir, getPackageRoot: () => packageRoot } as unknown as PackageResolver
+
+    const result = resolveInstalledOfficialModulePackage(resolver, 'candidate_consents')
+
+    expect(result.packageName).toBe('@open-mercato/test-package')
+    expect(fs.realpathSync(result.packageRoot)).toBe(fs.realpathSync(packageRoot))
+    expect(result.metadata.moduleId).toBe('test_package')
+  })
+
+  it('rejects an unrelated package root returned for an unobserved binding', () => {
+    const packageRoot = path.join(tmpDir, 'unrelated-package')
+    copyDir(fixturePackageRoot, packageRoot)
+    const resolver = { getAppDir: () => tmpDir, getPackageRoot: () => packageRoot } as unknown as PackageResolver
+
+    expect(() => resolveInstalledOfficialModulePackage(resolver, 'uninstalled_binding')).toThrow('does not match requested package binding')
+    expect(() => readOfficialModulePackageFromRoot(packageRoot, 'uninstalled_binding')).toThrow('does not match requested package')
+  })
+
+  it('rejects module subpaths hidden by package exports before enabling an alias', () => {
+    const appDir = path.join(tmpDir, 'app')
+    const packageRoot = path.join(appDir, 'node_modules', 'candidate_consents')
+    copyDir(fixturePackageRoot, packageRoot)
+    fs.writeFileSync(path.join(packageRoot, 'package.json'), JSON.stringify({ name: '@open-mercato/test-package', exports: { '.': './dist/modules/test_package/index.js' } }))
+    const resolver = { getAppDir: () => appDir, getPackageRoot: () => packageRoot } as unknown as PackageResolver
+
+    expect(() => resolveInstalledOfficialModulePackage(resolver, 'candidate_consents')).toThrow('candidate_consents/modules/test_package/index')
+  })
+
+  it('rejects an installed package whose generated source entrypoint has no runtime artifact', () => {
+    const appDir = path.join(tmpDir, 'app')
+    const packageRoot = path.join(appDir, 'node_modules', 'candidate_consents')
+    copyDir(fixturePackageRoot, packageRoot)
+    fs.writeFileSync(path.join(packageRoot, 'src', 'modules', 'test_package', 'di.ts'), 'export const register = () => undefined\n')
+    fs.writeFileSync(path.join(packageRoot, 'package.json'), JSON.stringify({ name: '@open-mercato/test-package', exports: { './modules/test_package/*': './dist/modules/test_package/*.js' } }))
+    const resolver = { getAppDir: () => appDir, getPackageRoot: () => packageRoot } as unknown as PackageResolver
+
+    expect(() => resolveInstalledOfficialModulePackage(resolver, 'candidate_consents')).toThrow('candidate_consents/modules/test_package/di')
+  })
+
+  it('accepts ESM import-only and nested node conditions without requiring CommonJS exports', () => {
+    const files = ['dist/modules/consents/index.js', 'dist/modules/consents/di.js', 'esm/consents/index.mjs', 'esm/consents/di.mjs']
+    const manifest = { exports: { './modules/consents/*': { types: './types/*.d.ts', node: { import: './esm/consents/*.mjs', require: null }, default: './dist/modules/consents/*.js' } } }
+
+    expect(() => assertModulePackageExports(manifest, 'consents_candidate', 'consents', files)).not.toThrow()
+  })
+
+  it('honors an explicit blocked subpath over a wildcard and rejects missing mapped targets', () => {
+    const files = ['dist/modules/consents/index.js', 'dist/modules/consents/di.js']
+    const blocked = { exports: { './modules/*': './dist/modules/*.js', './modules/consents/di': null } }
+    const missing = { exports: { './modules/*': { import: './missing/*.js' } } }
+
+    expect(() => assertModulePackageExports(blocked, 'consents_candidate', 'consents', files)).toThrow('consents_candidate/modules/consents/di')
+    expect(() => assertModulePackageExports(missing, 'consents_candidate', 'consents', files)).toThrow('consents_candidate/modules/consents/index')
+  })
+
+  it('rejects a source-discovered generated entrypoint without a compiled runtime artifact', () => {
+    const files = [
+      'src/modules/consents/index.ts',
+      'src/modules/consents/di.ts',
+      'dist/modules/consents/index.js',
+    ]
+    const manifest = { exports: { './modules/consents/*': './dist/modules/consents/*.js' } }
+
+    expect(() => assertModulePackageExports(manifest, 'consents_candidate', 'consents', files)).toThrow('missing the compiled runtime entrypoint')
+  })
+
+  it('keeps private helper files private while validating generated convention imports', () => {
+    const files = ['dist/modules/consents/index.js', 'dist/modules/consents/lib/private.js']
+    const manifest = { exports: { './modules/consents/index': './dist/modules/consents/index.js' } }
+
+    expect(() => assertModulePackageExports(manifest, 'consents_candidate', 'consents', files)).not.toThrow()
+  })
+
+  it('validates selective exports only for discovered entry points and leaves their private helpers private', () => {
+    const publicFiles = ['index', 'backend/tasks/page', 'frontend/consents/page', 'widgets/injection/consents/widget', 'commands/create']
+    const privateFiles = ['backend/tasks/TaskForm', 'backend/tasks/helpers', 'frontend/consents/ConsentForm', 'widgets/injection/consents/ConsentField', 'commands/index', 'commands/shared', 'commands/factory', 'commands/create.test', 'backend/__tests__/page', 'widgets/__mocks__/injection/consents/widget', 'workers/__tests__/handler', 'subscribers/__mocks__/handler']
+    const files = [...publicFiles, ...privateFiles].flatMap((file) => [
+      `src/modules/consents/${file}${file.endsWith('/page') || /TaskForm|ConsentForm|ConsentField/.test(file) ? '.tsx' : '.ts'}`,
+      `dist/modules/consents/${file}.js`,
+    ])
+    const exports = Object.fromEntries(publicFiles.map((file) => [`./modules/consents/${file}`, `./dist/modules/consents/${file}.js`]))
+
+    expect(() => assertModulePackageExports({ exports }, 'consents_candidate', 'consents', files)).not.toThrow()
+    const missingPageExport = { ...exports, './modules/consents/backend/tasks/page': null }
+    expect(() => assertModulePackageExports({ exports: missingPageExport }, 'consents_candidate', 'consents', files, () => 'export default function Page() {}')).toThrow('consents_candidate/modules/consents/backend/tasks/page')
+  })
+
+  it('uses source exports to distinguish private lowercase helpers from generated pages and HTTP handlers', () => {
+    const source = {
+      'index.ts': 'export const metadata = {}',
+      'backend/tasks/page.tsx': 'export default function Page() {}',
+      'backend/tasks/form-utils.tsx': 'export function renderLabel() {}',
+      'backend/tasks/form-utils.meta.ts': 'export const metadata = {}',
+      'api/helpers.ts': 'export function parseInput() {}',
+      'api/orders.ts': 'export { listOrders as GET }',
+    }
+    const files = Object.keys(source).flatMap((file) => [`src/modules/consents/${file}`, `dist/modules/consents/${file.replace(/\.tsx?$/, '.js')}`])
+    const exports = Object.fromEntries(['index', 'backend/tasks/page', 'api/orders'].map((file) => [`./modules/consents/${file}`, `./dist/modules/consents/${file}.js`]))
+    const readSource = jest.fn((file: string) => source[file.replace('src/modules/consents/', '') as keyof typeof source])
+    expect(() => assertModulePackageExports({ exports }, 'candidate', 'consents', files, readSource)).not.toThrow()
+    expect(() => assertModulePackageExports({ exports: { ...exports, './modules/consents/backend/tasks/page': null } }, 'candidate', 'consents', files, readSource)).toThrow('backend/tasks/page')
+    expect(() => assertModulePackageExports({ exports: { ...exports, './modules/consents/api/orders': null } }, 'candidate', 'consents', files, readSource)).toThrow('api/orders')
+    expect(() => assertModulePackageExports({ exports: { './modules/consents/index': './dist/modules/consents/index.js' } }, 'candidate', 'consents', files)).not.toThrow()
+  })
+
+  it('rejects invalid manifest names instead of attributing them to an import binding', () => {
+    const packageRoot = path.join(tmpDir, 'invalid-name')
+    copyDir(fixturePackageRoot, packageRoot)
+    fs.writeFileSync(path.join(packageRoot, 'package.json'), JSON.stringify({ name: 'invalid package' }))
+
+    expect(() => readOfficialModulePackageFromRoot(packageRoot)).toThrow('invalid "name" field')
+  })
+
   it('discovers all modules in a multi-module package', () => {
     const packageRoot = path.join(tmpDir, 'multi-module-package')
     fs.mkdirSync(path.join(packageRoot, 'src', 'modules', 'alpha'), { recursive: true })

package/src/lib/__tests__/modules-config.test.ts

@@ -6,7 +6,10 @@ import {
   ensureModuleRegistration,
   ModuleGatedOffError,
   setModuleRegistrationSource,
+  prepareModuleRegistration,
+  prepareModuleRegistrationSource,
 } from '../modules-config'
+import { readEnabledModulesFromConfig } from '../resolver'
 
 describe('modules-config', () => {
   let tmpDir: string
@@ -19,6 +22,41 @@ describe('modules-config', () => {
     fs.rmSync(tmpDir, { recursive: true, force: true })
   })
 
+  it('preserves module locator when registering and ejecting', () => {
+    const filePath = path.join(tmpDir, 'modules.ts')
+    fs.writeFileSync(filePath, 'export const enabledModules = []\n')
+    ensureModuleRegistration(filePath, { id: 'consents', from: '@pkarw/consents', locator: 'github:pkarw/consents', packageName: '@pkarw/consents' })
+    expect(fs.readFileSync(filePath, 'utf8')).toContain("locator: 'github:pkarw/consents'")
+    setModuleRegistrationSource(filePath, 'consents', '@app')
+    expect(fs.readFileSync(filePath, 'utf8')).toContain("packageName: '@pkarw/consents'")
+    expect(fs.readFileSync(filePath, 'utf8')).toContain("locator: 'github:pkarw/consents'")
+  })
+
+  it('prepares add and eject config edits without writing the existing configuration', () => {
+    const filePath = path.join(tmpDir, 'modules.ts')
+    const source = 'export const enabledModules = []\n'
+    fs.writeFileSync(filePath, source)
+
+    const added = prepareModuleRegistration(source, { id: 'consents', from: 'consents_candidate' })
+    const ejected = prepareModuleRegistrationSource(added.source, 'consents', '@app', { packageName: '@publisher/consents', locator: 'npm:@publisher/consents' })
+
+    expect(added).toMatchObject({ changed: true, registeredAs: 'consents_candidate' })
+    expect(ejected).toContain("from: '@app'")
+    expect(ejected).toContain("packageName: '@publisher/consents'")
+    expect(ejected).toContain("locator: 'npm:@publisher/consents'")
+    expect(fs.readFileSync(filePath, 'utf8')).toBe(source)
+    expect(prepareModuleRegistration(added.source, { id: 'consents', from: 'consents_candidate' })).toEqual({ source: added.source, changed: false, registeredAs: 'consents_candidate' })
+  })
+
+  it('accepts quoted property names when preparing an existing registration update', () => {
+    const source = 'export const enabledModules = [{ "id": "consents", "from": "consents_candidate" }]\n'
+
+    const updated = prepareModuleRegistrationSource(source, 'consents', '@app')
+
+    expect(updated).toContain('"from": "@app"')
+    expect(updated).toContain('"id": "consents"')
+  })
+
   it('adds a package-backed module without touching conditional pushes', () => {
     const filePath = path.join(tmpDir, 'modules.ts')
     fs.writeFileSync(
@@ -530,3 +568,20 @@ describe('modules-config', () => {
     })
   })
 })
+
+
+describe('module provenance updates', () => {
+  it('updates only top-level origin properties and preserves nested overrides', () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'module-config-provenance-'))
+    const modulesPath = path.join(root, 'modules.ts')
+    try {
+      fs.writeFileSync(modulesPath, "export const enabledModules = [{ id: 'consents', overrides: { custom: { from: 'nested', locator: 'keep-locator', packageName: 'keep-package' } } }]\n")
+      setModuleRegistrationSource(modulesPath, 'consents', '@app', { locator: 'github:pkarw/consents', packageName: '@pkarw/consents' })
+      const source = fs.readFileSync(modulesPath, 'utf8')
+      expect(source).toContain("custom: { from: 'nested', locator: 'keep-locator', packageName: 'keep-package' }")
+      expect(readEnabledModulesFromConfig(modulesPath)).toEqual([{ id: 'consents', from: '@app', locator: 'github:pkarw/consents', packageName: '@pkarw/consents' }])
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true })
+    }
+  })
+})

package/src/lib/__tests__/resolver.packages.test.ts

@@ -0,0 +1,29 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { createResolver } from '../resolver'
+
+describe('installed package paths in monorepos', () => {
+  let root: string
+  beforeEach(() => {
+    root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'resolver-packages-')))
+    fs.mkdirSync(path.join(root, 'packages', 'core', 'src', 'modules'), { recursive: true })
+    fs.writeFileSync(path.join(root, 'packages', 'core', 'package.json'), JSON.stringify({ name: '@open-mercato/core' }))
+    fs.mkdirSync(path.join(root, 'node_modules', '@open-mercato'), { recursive: true })
+    fs.symlinkSync(path.join(root, 'packages', 'core'), path.join(root, 'node_modules', '@open-mercato', 'core'))
+    fs.mkdirSync(path.join(root, 'apps', 'mercato', 'src'), { recursive: true })
+    fs.writeFileSync(path.join(root, 'apps', 'mercato', 'package.json'), JSON.stringify({ name: 'app' }))
+  })
+  afterEach(() => fs.rmSync(root, { recursive: true, force: true }))
+
+  it.each(['@pkarw/consents', '@open-mercato/consents', 'consents'])('resolves installed package %s without falling back to core', (packageName) => {
+    const packageRoot = path.join(root, 'node_modules', packageName)
+    fs.mkdirSync(path.join(packageRoot, 'dist', 'modules', 'consents'), { recursive: true })
+    fs.writeFileSync(path.join(packageRoot, 'package.json'), JSON.stringify({ name: packageName }))
+    const resolver = createResolver(path.join(root, 'apps', 'mercato'))
+    expect(resolver.isMonorepo()).toBe(true)
+    expect(resolver.getPackageRoot(packageName)).toBe(packageRoot)
+    expect(resolver.getModulePaths({ id: 'consents', from: packageName }).pkgBase).toBe(path.join(packageRoot, 'dist', 'modules', 'consents'))
+    expect(resolver.getModulePaths({ id: 'customers', from: '@open-mercato/core' }).pkgBase).toBe(path.join(root, 'packages', 'core', 'src', 'modules', 'customers'))
+  })
+})

package/src/lib/eject.ts

@@ -1,8 +1,10 @@
 import path from 'node:path'
 import fs from 'node:fs'
-import { setModuleRegistrationSource } from './modules-config'
+import { prepareModuleRegistrationSource, setModuleRegistrationSource } from './modules-config'
 import type { PackageResolver, ModuleEntry } from './resolver'
-import { resolveInstalledOfficialModulePackage } from './module-package'
+import { isModulePackageExportError, resolveInstalledOfficialModulePackage, resolveInstalledPackageRoot } from './module-package'
+import { normalizeModuleLocator } from '@open-mercato/shared/modules/module-locators'
+import { getEnabledModuleIdentities } from './module-identity'
 
 type ModuleMetadata = {
   ejectable?: boolean
@@ -178,8 +180,8 @@ export function copyDirRecursive(src: string, dest: string): void {
   }
 }
 
-export function updateModulesTs(modulesPath: string, moduleId: string): void {
-  setModuleRegistrationSource(modulesPath, moduleId, '@app')
+export function updateModulesTs(modulesPath: string, moduleId: string, provenance?: Pick<ModuleEntry, 'locator' | 'packageName'>): void {
+  setModuleRegistrationSource(modulesPath, moduleId, '@app', provenance)
 }
 
 export type EjectableModule = {
@@ -239,7 +241,8 @@ function resolveModuleSource(
         description: modulePackage.moduleInfo.description,
       },
     }
-  } catch {
+  } catch (error) {
+    if (isModulePackageExportError(error)) throw error
     return { pkgBase, metadata: fallbackMetadata }
   }
 }
@@ -268,7 +271,9 @@ export function listEjectableModules(resolver: PackageResolver): EjectableModule
 
 export function ejectModule(resolver: PackageResolver, moduleId: string): void {
   const modules = resolver.loadEnabledModules()
-  const entry = modules.find((m: ModuleEntry) => m.id === moduleId)
+  const identities = getEnabledModuleIdentities(resolver, modules)
+  const matches = modules.filter((module: ModuleEntry) => module.id === moduleId)
+  const entry = matches[0]
 
   if (!entry) {
     throw new Error(
@@ -302,13 +307,26 @@ export function ejectModule(resolver: PackageResolver, moduleId: string): void {
   if (fs.existsSync(appBase)) {
     throw new Error(
       `Destination directory already exists: ${appBase}. ` +
-      `Remove it first or resolve the conflict manually.`,
+      `Keep the existing local source and review the destination conflict before ejecting.`,
     )
   }
 
+  const locators = identities.find((identity) => identity.id === moduleId)?.locators ?? []
+  const packageRoot = resolveInstalledPackageRoot(resolver, entry.from || '@open-mercato/core')
+  const manifest: unknown = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'))
+  const packageName = manifest && typeof manifest === 'object' && 'name' in manifest && typeof manifest.name === 'string'
+    ? manifest.name
+    : undefined
+  if (!packageName || normalizeModuleLocator(`npm:${packageName}`) !== `npm:${packageName}`) {
+    throw new Error(`Cannot retain source provenance for module "${moduleId}": the installed package manifest has no valid name.`)
+  }
+  const locator = locators.find((identity) => identity.startsWith('github:')) ?? locators.find((identity) => identity.startsWith('npm:'))
+  const provenance = { ...(packageName ? { packageName } : {}), ...(locator ? { locator } : {}) }
+  const modulesPath = resolver.getModulesConfigPath()
+  const originalConfig = fs.readFileSync(modulesPath, 'utf8')
+  const updatedConfig = prepareModuleRegistrationSource(originalConfig, moduleId, '@app', provenance)
+
   copyDirRecursive(pkgBase, appBase)
   rewriteCrossModuleImports(pkgBase, appBase, moduleId, entry.from || '@open-mercato/core')
-
-  const modulesPath = resolver.getModulesConfigPath()
-  updateModulesTs(modulesPath, moduleId)
+  fs.writeFileSync(modulesPath, updatedConfig)
 }

package/src/lib/generators/__tests__/module-id-collisions.test.ts

@@ -0,0 +1,146 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { createResolver, type ModuleEntry, type PackageResolver } from '../../resolver'
+import { generateEntityIds } from '../entity-ids'
+import { generateModuleDi } from '../module-di'
+import { generateModuleEntities } from '../module-entities'
+import { generateModulePackageSources } from '../module-package-sources'
+import { generateModuleRegistries, generateModuleRegistry, generateModuleRegistryApp, generateModuleRegistryCli } from '../module-registry'
+import { generateOpenApi } from '../openapi'
+
+const generators = [
+  generateEntityIds,
+  generateModuleDi,
+  generateModuleEntities,
+  generateModulePackageSources,
+  generateModuleRegistry,
+  generateModuleRegistryApp,
+  generateModuleRegistryCli,
+  generateModuleRegistries,
+  generateOpenApi,
+]
+
+describe('effective module ID preflight', () => {
+  let root: string
+  beforeEach(() => { root = fs.mkdtempSync(path.join(os.tmpdir(), 'module-id-collisions-')) })
+  afterEach(() => { fs.rmSync(root, { recursive: true, force: true }) })
+
+  function resolverFor(entries: ModuleEntry[]): PackageResolver {
+    const outputDir = path.join(root, '.mercato', 'generated')
+    return {
+      isMonorepo: () => true,
+      getRootDir: () => root,
+      getAppDir: () => root,
+      getOutputDir: () => outputDir,
+      getModulesConfigPath: () => path.join(root, 'src', 'modules.ts'),
+      discoverPackages: () => [],
+      loadEnabledModules: () => entries,
+      getModulePaths: (entry) => ({ appBase: path.join(root, 'src', 'modules', entry.id), pkgBase: path.join(root, 'packages', 'core', 'src', 'modules', entry.id) }),
+      getModuleImportBase: (entry) => ({ appBase: `@/modules/${entry.id}`, pkgBase: `@open-mercato/core/modules/${entry.id}` }),
+      getPackageRoot: () => path.join(root, 'packages', 'core'),
+      getPackageOutputDir: () => path.join(root, 'packages', 'core', 'generated'),
+    }
+  }
+
+  it.each(generators)('rejects separate providers before any output write in %p', async (generate) => {
+    const resolver = resolverFor([
+      { id: 'consents', from: '@publisher/consents', locator: 'npm:@publisher/consents' },
+      { id: 'consents', from: '@alias/consents', locator: 'github:other/consents' },
+    ])
+    fs.mkdirSync(resolver.getOutputDir(), { recursive: true })
+    const sentinel = path.join(resolver.getOutputDir(), 'existing.generated.ts')
+    fs.writeFileSync(sentinel, 'existing output\n')
+    const timestamp = fs.statSync(sentinel).mtimeMs
+    await expect(generate({ resolver, quiet: true })).rejects.toThrow(/Duplicate enabled module ID 'consents'.*@publisher\/consents.*@alias\/consents/)
+    expect(fs.readdirSync(resolver.getOutputDir())).toEqual(['existing.generated.ts'])
+    expect(fs.readFileSync(sentinel, 'utf8')).toBe('existing output\n')
+    expect(fs.statSync(sentinel).mtimeMs).toBe(timestamp)
+    expect(fs.existsSync(resolver.getPackageOutputDir('@open-mercato/core'))).toBe(false)
+  })
+
+  it.each(generators)('rejects exact repeated registrations without creating output directories in %p', async (generate) => {
+    const resolver = resolverFor([{ id: 'consents', from: '@app' }, { id: 'consents', from: '@app' }])
+    await expect(generate({ resolver, quiet: true })).rejects.toThrow(/Duplicate enabled module ID 'consents'.*@app/)
+    expect(fs.existsSync(resolver.getOutputDir())).toBe(false)
+  })
+
+  it.each(generators)('rejects duplicate source registrations after runtime resolver deduplication in %p', async (generate) => {
+    fs.mkdirSync(path.join(root, 'src'), { recursive: true })
+    fs.writeFileSync(path.join(root, 'package.json'), '{"name":"module-fixture"}')
+    fs.writeFileSync(path.join(root, 'src', 'modules.ts'), "export const enabledModules = [{ id: 'consents', from: '@app' }, { id: 'consents', from: '@app' }]\n")
+    const warning = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      const resolver = createResolver(root)
+      expect(resolver.loadEnabledModules()).toHaveLength(1)
+      fs.mkdirSync(resolver.getOutputDir(), { recursive: true })
+      const sentinel = path.join(resolver.getOutputDir(), 'existing.generated.ts')
+      fs.writeFileSync(sentinel, 'existing output\n')
+      const timestamp = fs.statSync(sentinel).mtimeMs
+      await expect(generate({ resolver, quiet: true })).rejects.toThrow(/Duplicate enabled module ID 'consents'/)
+      expect(fs.readdirSync(resolver.getOutputDir())).toEqual(['existing.generated.ts'])
+      expect(fs.readFileSync(sentinel, 'utf8')).toBe('existing output\n')
+      expect(fs.statSync(sentinel).mtimeMs).toBe(timestamp)
+    } finally {
+      warning.mockRestore()
+    }
+  })
+
+  it.each(generators)('rejects contradictory retained origin before any output write in %p', async (generate) => {
+    const resolver = resolverFor([{ id: 'consents', from: '@publisher/consents', locator: 'github:publisher/consents' }])
+    fs.mkdirSync(resolver.getPackageRoot('@publisher/consents'), { recursive: true })
+    fs.writeFileSync(path.join(resolver.getPackageRoot('@publisher/consents'), 'package.json'), JSON.stringify({ name: '@publisher/consents' }))
+    fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ dependencies: { '@publisher/consents': '1.0.0' } }))
+    await expect(generate({ resolver, quiet: true })).rejects.toThrow(/declared origin.*disagrees with observed origin/)
+    expect(fs.existsSync(resolver.getOutputDir())).toBe(false)
+  })
+
+  it('preserves one registration with local entity and DI overlays', async () => {
+    const resolver = resolverFor([{ id: 'customers', from: '@open-mercato/core' }])
+    const roots = resolver.getModulePaths(resolver.loadEnabledModules()[0])
+    for (const base of [roots.appBase, roots.pkgBase]) fs.mkdirSync(path.join(base, 'data'), { recursive: true })
+    fs.writeFileSync(path.join(roots.appBase, 'data', 'entities.ts'), 'export class LocalCustomer {}')
+    fs.writeFileSync(path.join(roots.pkgBase, 'data', 'entities.ts'), 'export class PackageCustomer {}')
+    fs.writeFileSync(path.join(roots.appBase, 'di.ts'), 'export function register() {}')
+    fs.writeFileSync(path.join(roots.pkgBase, 'di.ts'), 'export function register() {}')
+    await generateModuleEntities({ resolver, quiet: true })
+    await generateModuleDi({ resolver, quiet: true })
+    expect(fs.readFileSync(path.join(resolver.getOutputDir(), 'entities.generated.ts'), 'utf8')).toContain('@/modules/customers/data/entities')
+    const di = fs.readFileSync(path.join(resolver.getOutputDir(), 'di.generated.ts'), 'utf8')
+    expect(di).toContain('@/modules/customers/di')
+    expect(di).not.toContain('@open-mercato/core/modules/customers/di')
+  })
+
+  it.each(['npm', 'github'])('validates only the effective %s provider in mutually exclusive branches', async (provider) => {
+    fs.mkdirSync(path.join(root, 'src'), { recursive: true })
+    fs.writeFileSync(path.join(root, 'package.json'), '{"name":"module-fixture"}')
+    fs.writeFileSync(path.join(root, 'src', 'modules.ts'), `
+export const enabledModules = []
+if (process.env.MODULE_PROVIDER === 'npm') {
+  enabledModules.push({ id: 'consents', from: '@app', locator: 'npm:@publisher/consents' })
+} else {
+  enabledModules.push({ id: 'consents', from: '@app', locator: 'github:publisher/consents' })
+}
+`)
+    const previousProvider = process.env.MODULE_PROVIDER
+    process.env.MODULE_PROVIDER = provider
+    try {
+      const resolver = createResolver(root)
+      expect(resolver.loadEnabledModules()).toEqual([{ id: 'consents', from: '@app', locator: provider === 'npm' ? 'npm:@publisher/consents' : 'github:publisher/consents' }])
+      await expect(generateModulePackageSources({ resolver, quiet: true })).resolves.toMatchObject({ errors: [] })
+    } finally {
+      if (previousProvider === undefined) delete process.env.MODULE_PROVIDER
+      else process.env.MODULE_PROVIDER = previousProvider
+    }
+  })
+
+  it('keeps explicitly disabled local modules out of an empty effective configuration', async () => {
+    fs.mkdirSync(path.join(root, 'src', 'modules', 'parked'), { recursive: true })
+    fs.writeFileSync(path.join(root, 'package.json'), '{"name":"module-fixture"}')
+    fs.writeFileSync(path.join(root, 'src', 'modules.ts'), 'export const enabledModules = []')
+    const resolver = createResolver(root)
+    expect(resolver.loadEnabledModules()).toEqual([])
+    await generateModuleDi({ resolver, quiet: true })
+    expect(fs.readFileSync(path.join(resolver.getOutputDir(), 'di.generated.ts'), 'utf8')).not.toContain('parked')
+  })
+})

package/src/lib/generators/__tests__/module-package-sources.test.ts

@@ -76,6 +76,23 @@ describe('generateModulePackageSources', () => {
     expect(output).toContain('node_modules/@open-mercato/test-package/src/**/*.{ts,tsx}')
   })
 
+  it('includes source paths through the selected installed npm alias binding', async () => {
+    const packageRoot = path.join(tmpDir, 'app', 'node_modules', 'consents_candidate')
+    copyDir(fixturePackageRoot, packageRoot)
+    const packageJsonPath = path.join(packageRoot, 'package.json')
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')) as Record<string, unknown>
+    packageJson.name = '@publisher/consents'
+    fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson))
+    const resolver = createResolver(tmpDir, packageRoot, 'consents_candidate')
+    fs.writeFileSync(path.join(resolver.getAppDir(), 'package.json'), JSON.stringify({ dependencies: { consents_candidate: 'npm:@publisher/consents@1.0.0' } }))
+
+    await generateModulePackageSources({ resolver, quiet: true })
+
+    const output = fs.readFileSync(path.join(resolver.getOutputDir(), 'module-package-sources.css'), 'utf8')
+    expect(output).toContain('node_modules/consents_candidate/src/**/*.{ts,tsx}')
+    expect(output).not.toContain('node_modules/@publisher/consents')
+  })
+
   it('does not checksum unrelated files below the installed package root', async () => {
     const packageRoot = path.join(tmpDir, 'node_modules', '@open-mercato', 'test-package')
     copyDir(fixturePackageRoot, packageRoot)
@@ -146,12 +163,12 @@ describe('generateModulePackageSources', () => {
     expect(fs.statSync(outFile).mtimeMs).toBe(outputMtimeBefore)
   })
 
-  it('keeps official package validation as the source inclusion gate', async () => {
+  it('keeps package manifest validation as the source inclusion gate', async () => {
     const packageRoot = path.join(tmpDir, 'node_modules', '@open-mercato', 'test-package')
     copyDir(fixturePackageRoot, packageRoot)
     const packageJsonPath = path.join(packageRoot, 'package.json')
     const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')) as Record<string, unknown>
-    packageJson.name = '@open-mercato/different-package'
+    packageJson.name = 'invalid package name'
     fs.writeFileSync(packageJsonPath, `${JSON.stringify(packageJson, null, 2)}\n`)
     const resolver = createResolver(tmpDir, packageRoot, '@open-mercato/test-package')
 

package/src/lib/generators/__tests__/module-requirements.test.ts

@@ -0,0 +1,56 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { generateModuleRegistry, generateModuleRegistryApp, generateModuleRegistryCli } from '../module-registry'
+import type { ModuleEntry, PackageResolver } from '../../resolver'
+
+describe('canonical module dependencies across registries', () => {
+  let root: string
+  beforeEach(() => { root = fs.mkdtempSync(path.join(os.tmpdir(), 'module-requires-')) })
+  afterEach(() => { fs.rmSync(root, { recursive: true, force: true }); jest.restoreAllMocks() })
+
+  function fixture(requirement: string): PackageResolver {
+    const enabled: ModuleEntry[] = [
+      { id: 'dependent', from: '@app' },
+      { id: 'consents', from: '@app', locator: 'github:pkarw/marketing-consents', packageName: '@pkarw/marketing_consents' },
+    ]
+    const moduleBase = (moduleId: string) => path.join(root, 'src', 'modules', moduleId)
+    for (const entry of enabled) fs.mkdirSync(moduleBase(entry.id), { recursive: true })
+    fs.writeFileSync(path.join(moduleBase('dependent'), 'index.ts'), `exports.metadata = { requires: [${JSON.stringify(requirement)}] }`)
+    fs.writeFileSync(path.join(moduleBase('consents'), 'index.ts'), 'exports.metadata = {}')
+    return {
+      isMonorepo: () => true,
+      getRootDir: () => root,
+      getAppDir: () => root,
+      getOutputDir: () => path.join(root, '.mercato', 'generated'),
+      getModulesConfigPath: () => path.join(root, 'src', 'modules.ts'),
+      discoverPackages: () => [],
+      loadEnabledModules: () => enabled,
+      getModulePaths: (entry) => ({ appBase: moduleBase(entry.id), pkgBase: path.join(root, 'empty', entry.id) }),
+      getModuleImportBase: (entry) => ({ appBase: `@/modules/${entry.id}`, pkgBase: `@unused/modules/${entry.id}` }),
+      getPackageOutputDir: () => path.join(root, '.mercato', 'generated'),
+      getPackageRoot: () => root,
+    }
+  }
+
+  it.each([generateModuleRegistry, generateModuleRegistryApp, generateModuleRegistryCli])('satisfies canonical source dependencies in %p', async (generate) => {
+    const resolver = fixture('https://github.com/PKARW/marketing-consents.git#main')
+    const result = await generate({ resolver, quiet: true })
+    expect(result.errors).toEqual([])
+  })
+
+  it.each([generateModuleRegistry, generateModuleRegistryApp, generateModuleRegistryCli])('satisfies retained npm identity after npm module ejection in %p', async (generate) => {
+    const resolver = fixture('npm:@pkarw/marketing_consents@next')
+    resolver.loadEnabledModules()[1].locator = 'npm:@pkarw/marketing_consents'
+    const result = await generate({ resolver, quiet: true })
+    expect(result.errors).toEqual([])
+  })
+
+  it.each([generateModuleRegistry, generateModuleRegistryApp, generateModuleRegistryCli])('rejects wrong publisher despite matching module name in %p', async (generate) => {
+    const resolver = fixture('github:other/marketing-consents')
+    const errors = jest.spyOn(console, 'error').mockImplementation(() => {})
+    jest.spyOn(process, 'exit').mockImplementation(() => { throw new Error('dependency failure') })
+    await expect(generate({ resolver, quiet: true })).rejects.toThrow('dependency failure')
+    expect(errors).toHaveBeenCalledWith("Fix: npx create-mercato-module install 'github:other/marketing-consents'")
+  })
+})

package/src/lib/generators/entity-ids.ts

@@ -1,3 +1,4 @@
+import { getEnabledModuleIdentities } from '../module-identity'
 import fs from 'node:fs'
 import path from 'node:path'
 import ts from 'typescript-js'
@@ -331,6 +332,7 @@ export async function generateEntityIds(options: EntityIdsOptions): Promise<Gene
   const checksumFile = path.join(outputDir, 'entities.ids.generated.checksum')
 
   const entries = resolver.loadEnabledModules()
+  getEnabledModuleIdentities(resolver, entries)
 
   const consolidated: Record<string, Record<string, string>> = {}
   const grouped: Record<GroupKey, Record<string, Record<string, string>>> = {}

package/src/lib/generators/module-di.ts

@@ -1,3 +1,4 @@
+import { getEnabledModuleIdentities } from '../module-identity'
 import fs from 'node:fs'
 import path from 'node:path'
 import { VariableDeclarationKind } from 'ts-morph'
@@ -34,6 +35,7 @@ export async function generateModuleDi(options: ModuleDiOptions): Promise<Genera
   const checksumFile = path.join(outputDir, 'di.generated.checksum')
 
   const mods = resolver.loadEnabledModules()
+  getEnabledModuleIdentities(resolver, mods)
   const imports: Array<{ name: string; moduleSpecifier: string }> = []
   const registrars: string[] = []
   let i = 0

package/src/lib/generators/module-entities.ts

@@ -1,3 +1,4 @@
+import { getEnabledModuleIdentities } from '../module-identity'
 import fs from 'node:fs'
 import path from 'node:path'
 import { VariableDeclarationKind } from 'ts-morph'
@@ -54,6 +55,7 @@ export async function generateModuleEntities(options: ModuleEntitiesOptions): Pr
   const checksumFile = path.join(outputDir, 'entities.generated.checksum')
 
   const mods = resolver.loadEnabledModules()
+  getEnabledModuleIdentities(resolver, mods)
   const imports: Array<{ name: string; moduleSpecifier: string }> = []
   const entitySources: Array<{ importName: string; moduleId: string }> = []
   const classNameEntries: EntityClassNameEntry[] = []