@open-mercato/cli 0.6.2-develop.3461.1.605f31c2c9 → 0.6.2

package/jest.config.cjs

@@ -10,6 +10,8 @@ module.exports = {
       {
         tsconfig: {
           jsx: 'react-jsx',
+          rootDir: '.',
+          ignoreDeprecations: '6.0',
         },
       },
     ],
@@ -21,7 +23,7 @@ module.exports = {
     '^@open-mercato/queue/(.*)$': '<rootDir>/../queue/src/$1',
   },
   transformIgnorePatterns: [
-    'node_modules/(?!(@mikro-orm)/)',
+    'node_modules/(?!(@mikro-orm|kysely)/)',
   ],
   testMatch: ['<rootDir>/src/**/__tests__/**/*.test.(ts|tsx)'],
   passWithNoTests: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.6.2-develop.3461.1.605f31c2c9",
+  "version": "0.6.2",
   "type": "module",
   "main": "./dist/index.js",
   "exports": {
@@ -55,25 +55,25 @@
     "node": "24.x"
   },
   "dependencies": {
-    "@mikro-orm/core": "^7.0.15",
-    "@mikro-orm/decorators": "^7.0.15",
-    "@mikro-orm/migrations": "^7.0.15",
-    "@mikro-orm/postgresql": "^7.0.15",
-    "@open-mercato/queue": "0.6.2-develop.3461.1.605f31c2c9",
-    "@open-mercato/shared": "0.6.2-develop.3461.1.605f31c2c9",
+    "@mikro-orm/core": "^7.0.17",
+    "@mikro-orm/decorators": "^7.0.17",
+    "@mikro-orm/migrations": "^7.0.17",
+    "@mikro-orm/postgresql": "^7.0.17",
+    "@open-mercato/queue": "0.6.2",
+    "@open-mercato/shared": "0.6.2",
     "cross-spawn": "^7.0.6",
-    "pg": "8.20.0",
+    "pg": "8.21.0",
     "semver": "^7.8.0",
     "testcontainers": "^11.14.0",
     "ts-morph": "^28.0.0",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3"
+    "tsx": "^4.22.2",
+    "typescript": "^6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.2-develop.3461.1.605f31c2c9"
+    "@open-mercato/shared": "0.6.2"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.2-develop.3461.1.605f31c2c9",
+    "@open-mercato/shared": "0.6.2",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.9"
@@ -85,6 +85,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/cli"
-  },
-  "stableVersion": "0.6.1"
+  }
 }

package/src/__tests__/mercato.test.ts

@@ -6,6 +6,7 @@ import {
   padByCodePointWidth,
   run,
 } from '../mercato'
+import { pathIncludes } from '../lib/__tests__/path-helpers'
 
 type MockChildAutoExit = { code: number | null; signal?: NodeJS.Signals | null } | undefined
 type MockChildSpawnRouter = (args: string[]) => MockChildAutoExit
@@ -674,7 +675,7 @@ describe('server dev managed process exits', () => {
       return {
         ...actual,
         existsSync: jest.fn((candidate: string) =>
-          candidate.includes('next/dist/bin/next') || candidate.includes('@open-mercato/cli/bin/mercato'),
+          pathIncludes(candidate, 'next/dist/bin/next') || pathIncludes(candidate, '@open-mercato/cli/bin/mercato'),
         ),
         unlinkSync: jest.fn(),
       }
@@ -691,7 +692,7 @@ describe('server dev managed process exits', () => {
     }))
     jest.doMock('child_process', () =>
       buildMockChildProcessModule((args) =>
-        args[0]?.includes('next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
+        pathIncludes(args[0] ?? '', 'next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
       ),
     )
 
@@ -715,7 +716,7 @@ describe('server dev managed process exits', () => {
       return {
         ...actual,
         existsSync: jest.fn((candidate: string) =>
-          candidate.includes('next/dist/bin/next') || candidate.includes('@open-mercato/cli/bin/mercato'),
+          pathIncludes(candidate, 'next/dist/bin/next') || pathIncludes(candidate, '@open-mercato/cli/bin/mercato'),
         ),
         unlinkSync: jest.fn(),
       }
@@ -763,7 +764,7 @@ describe('server dev managed process exits', () => {
       return {
         ...actual,
         existsSync: jest.fn((candidate: string) =>
-          candidate.includes('next/dist/bin/next') || candidate.includes('@open-mercato/cli/bin/mercato'),
+          pathIncludes(candidate, 'next/dist/bin/next') || pathIncludes(candidate, '@open-mercato/cli/bin/mercato'),
         ),
         unlinkSync: jest.fn(),
       }
@@ -792,7 +793,7 @@ describe('server dev managed process exits', () => {
 
     jest.doMock('child_process', () =>
       buildMockChildProcessModule((args) =>
-        args[0]?.includes('next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
+        pathIncludes(args[0] ?? '', 'next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
       ),
     )
 
@@ -830,7 +831,7 @@ describe('server dev managed process exits', () => {
       return {
         ...actual,
         existsSync: jest.fn((candidate: string) =>
-          candidate.includes('next/dist/bin/next') || candidate.includes('@open-mercato/cli/bin/mercato'),
+          pathIncludes(candidate, 'next/dist/bin/next') || pathIncludes(candidate, '@open-mercato/cli/bin/mercato'),
         ),
         unlinkSync: jest.fn(),
       }
@@ -859,7 +860,7 @@ describe('server dev managed process exits', () => {
 
     jest.doMock('child_process', () =>
       buildMockChildProcessModule((args) =>
-        args[0]?.includes('next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
+        pathIncludes(args[0] ?? '', 'next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
       ),
     )
 
@@ -932,7 +933,7 @@ describe('server start managed process exits', () => {
       return {
         ...actual,
         existsSync: jest.fn((candidate: string) =>
-          candidate.includes('next/dist/bin/next') || candidate.includes('@open-mercato/cli/bin/mercato'),
+          pathIncludes(candidate, 'next/dist/bin/next') || pathIncludes(candidate, '@open-mercato/cli/bin/mercato'),
         ),
       }
     })
@@ -949,7 +950,7 @@ describe('server start managed process exits', () => {
     }))
     jest.doMock('child_process', () =>
       buildMockChildProcessModule((args) =>
-        args[0]?.includes('next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
+        pathIncludes(args[0] ?? '', 'next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
       ),
     )
 
@@ -973,7 +974,7 @@ describe('server start managed process exits', () => {
       return {
         ...actual,
         existsSync: jest.fn((candidate: string) =>
-          candidate.includes('next/dist/bin/next') || candidate.includes('@open-mercato/cli/bin/mercato'),
+          pathIncludes(candidate, 'next/dist/bin/next') || pathIncludes(candidate, '@open-mercato/cli/bin/mercato'),
         ),
       }
     })
@@ -1022,7 +1023,7 @@ describe('server start managed process exits', () => {
       return {
         ...actual,
         existsSync: jest.fn((candidate: string) =>
-          candidate.includes('next/dist/bin/next') || candidate.includes('@open-mercato/cli/bin/mercato'),
+          pathIncludes(candidate, 'next/dist/bin/next') || pathIncludes(candidate, '@open-mercato/cli/bin/mercato'),
         ),
         unlinkSync: jest.fn(),
       }
@@ -1089,7 +1090,7 @@ describe('server start managed process exits', () => {
 
       return {
         spawn: jest.fn((_command: string, args: string[]) => {
-          if (args[0]?.includes('next/dist/bin/next')) {
+          if (pathIncludes(args[0] ?? '', 'next/dist/bin/next')) {
             nextSpawnCount += 1
             if (nextSpawnCount === 1) {
               queueMicrotask(() => envChangeCallback?.('/tmp/test-app/.env'))
@@ -1106,7 +1107,7 @@ describe('server start managed process exits', () => {
     const exitCode = await mercado.run(['node', 'mercato', 'server', 'dev'])
     const { spawn } = await import('child_process')
     const nextSpawns = (spawn as jest.Mock).mock.calls.filter((call) =>
-      call[1]?.[0]?.includes('next/dist/bin/next'),
+      pathIncludes(call[1]?.[0] ?? '', 'next/dist/bin/next'),
     )
 
     expect(exitCode).toBe(0)
@@ -1132,7 +1133,7 @@ describe('server start managed process exits', () => {
       return {
         ...actual,
         existsSync: jest.fn((candidate: string) =>
-          candidate.includes('next/dist/bin/next') || candidate.includes('@open-mercato/cli/bin/mercato'),
+          pathIncludes(candidate, 'next/dist/bin/next') || pathIncludes(candidate, '@open-mercato/cli/bin/mercato'),
         ),
       }
     })
@@ -1159,7 +1160,7 @@ describe('server start managed process exits', () => {
 
     jest.doMock('child_process', () =>
       buildMockChildProcessModule((args) =>
-        args[0]?.includes('next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
+        pathIncludes(args[0] ?? '', 'next/dist/bin/next') ? { code: null, signal: 'SIGTERM' } : undefined,
       ),
     )
 

package/src/lib/__tests__/dev-env-reload.test.ts

@@ -2,6 +2,7 @@ import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { createDevEnvReloader, resolveDevEnvFilePaths } from '../dev-env-reload'
+import { normalizeTestPath } from './path-helpers'
 
 describe('dev env reload helpers', () => {
   let appDir: string
@@ -15,7 +16,7 @@ describe('dev env reload helpers', () => {
   })
 
   it('resolves app env files in low-to-high dev precedence order', () => {
-    expect(resolveDevEnvFilePaths('/tmp/app')).toEqual([
+    expect(resolveDevEnvFilePaths('/tmp/app').map(normalizeTestPath)).toEqual([
       '/tmp/app/.env',
       '/tmp/app/.env.development',
       '/tmp/app/.env.local',

package/src/lib/__tests__/path-helpers.ts

@@ -0,0 +1,7 @@
+export function normalizeTestPath(value: string): string {
+  return value.replace(/\\/g, '/')
+}
+
+export function pathIncludes(value: string, needle: string): boolean {
+  return normalizeTestPath(value).includes(normalizeTestPath(needle))
+}

package/src/lib/db/__tests__/commands.test.ts

@@ -13,6 +13,7 @@ import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import type { ModuleEntry, PackageResolver } from '../../resolver'
+import { normalizeTestPath } from '../../__tests__/path-helpers'
 
 describe('db commands security', () => {
   describe('sanitizeModuleId', () => {
@@ -189,7 +190,7 @@ describe('resolveGeneratedMigrationPath', () => {
       '/repo/src/modules/example/migrations',
     )
 
-    expect(result).toBe('/repo/src/modules/example/migrations/Migration20260506101927.ts')
+    expect(normalizeTestPath(result)).toBe('/repo/src/modules/example/migrations/Migration20260506101927.ts')
   })
 
   it('keeps absolute MikroORM results unchanged', () => {

package/src/lib/generators/__tests__/module-subset.test.ts

@@ -768,6 +768,148 @@ export function GET() {
     )
   })
 
+  it('emits imports for third-party scoped npm packages registered via src/modules.ts', async () => {
+    // Simulate a third-party module package published at @dainamite/cpq
+    // (see issue #1998). The generator must accept @<vendor>/<package> specifiers
+    // and emit imports that point at the package's modules/<id> subtree.
+    const pkgModuleBase = path.join(
+      tmpDir,
+      'packages',
+      'thirdparty',
+      'src',
+      'modules',
+      'cpq',
+    )
+    touchFile(
+      path.join(pkgModuleBase, 'subscribers', 'on-event.ts'),
+      `export const metadata = { event: 'cpq.quote.created' }\nexport default async function handler() {}\n`,
+    )
+
+    const baseResolver = createMockResolver(tmpDir, [
+      { id: 'cpq', from: '@dainamite/cpq' },
+    ])
+    const resolver: PackageResolver = {
+      ...baseResolver,
+      getModulePaths: (entry: ModuleEntry) => ({
+        appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+        pkgBase: pkgModuleBase,
+      }),
+      getModuleImportBase: (entry: ModuleEntry) => ({
+        appBase: `@/modules/${entry.id}`,
+        pkgBase: `@dainamite/cpq/modules/${entry.id}`,
+      }),
+    }
+
+    const result = await generateModuleRegistry({ resolver, quiet: true })
+    expect(result.errors).toEqual([])
+
+    const output = readGenerated(tmpDir, 'modules.generated.ts')!
+    expect(output).toContain('id: "cpq"')
+    expect(output).toContain('@dainamite/cpq/modules/cpq/subscribers/on-event')
+  })
+
+  it('emits imports for bare (unscoped) third-party npm packages', async () => {
+    const pkgModuleBase = path.join(
+      tmpDir,
+      'packages',
+      'thirdparty-bare',
+      'src',
+      'modules',
+      'foo',
+    )
+    touchFile(
+      path.join(pkgModuleBase, 'subscribers', 'on-event.ts'),
+      `export const metadata = { event: 'foo.thing.created' }\nexport default async function handler() {}\n`,
+    )
+
+    const baseResolver = createMockResolver(tmpDir, [
+      { id: 'foo', from: 'acme-modules' },
+    ])
+    const resolver: PackageResolver = {
+      ...baseResolver,
+      getModulePaths: (entry: ModuleEntry) => ({
+        appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+        pkgBase: pkgModuleBase,
+      }),
+      getModuleImportBase: (entry: ModuleEntry) => ({
+        appBase: `@/modules/${entry.id}`,
+        pkgBase: `acme-modules/modules/${entry.id}`,
+      }),
+    }
+
+    const result = await generateModuleRegistry({ resolver, quiet: true })
+    expect(result.errors).toEqual([])
+
+    const output = readGenerated(tmpDir, 'modules.generated.ts')!
+    expect(output).toContain('id: "foo"')
+    expect(output).toContain('acme-modules/modules/foo/subscribers/on-event')
+  })
+
+  it('fails fast when a third-party module entry points at a package without the expected OM module shape', async () => {
+    // No files scaffolded — the package directory does not exist, so the
+    // entry is almost certainly not an Open Mercato module.
+    const enabled: ModuleEntry[] = [{ id: 'cpq', from: '@dainamite/cpq' }]
+    const baseResolver = createMockResolver(tmpDir, enabled)
+    const resolver: PackageResolver = {
+      ...baseResolver,
+      getModulePaths: (entry: ModuleEntry) => ({
+        appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+        pkgBase: path.join(
+          tmpDir,
+          'node_modules',
+          '@dainamite',
+          'cpq',
+          'dist',
+          'modules',
+          entry.id,
+        ),
+      }),
+      getModuleImportBase: (entry: ModuleEntry) => ({
+        appBase: `@/modules/${entry.id}`,
+        pkgBase: `@dainamite/cpq/modules/${entry.id}`,
+      }),
+    }
+
+    await expect(generateModuleRegistry({ resolver, quiet: true })).rejects.toThrow(
+      /no Open Mercato module shape was found/,
+    )
+  })
+
+  it('rejects third-party specifiers with path-traversal segments', async () => {
+    const pkgModuleBase = path.join(
+      tmpDir,
+      'packages',
+      'thirdparty-traversal',
+      'src',
+      'modules',
+      'evil',
+    )
+    touchFile(
+      path.join(pkgModuleBase, 'subscribers', 'on-event.ts'),
+      `export const metadata = { event: 'evil.x' }\nexport default async function handler() {}\n`,
+    )
+
+    const baseResolver = createMockResolver(tmpDir, [
+      { id: 'evil', from: '@vendor/pkg' },
+    ])
+    const resolver: PackageResolver = {
+      ...baseResolver,
+      getModulePaths: (entry: ModuleEntry) => ({
+        appBase: path.join(tmpDir, 'app', 'src', 'modules', entry.id),
+        pkgBase: pkgModuleBase,
+      }),
+      // Inject a malicious specifier with a ".." segment.
+      getModuleImportBase: (entry: ModuleEntry) => ({
+        appBase: `@/modules/${entry.id}`,
+        pkgBase: `@vendor/pkg/../escape/modules/${entry.id}`,
+      }),
+    }
+
+    await expect(generateModuleRegistry({ resolver, quiet: true })).rejects.toThrow(
+      /Unsafe generated module specifier/,
+    )
+  })
+
   it('mixed subset: core module + app module, then remove core module', async () => {
     scaffoldModule(tmpDir, 'core_mod', 'pkg', [
       'backend/page.tsx',

package/src/lib/generators/extensions/notifications.ts

@@ -123,6 +123,7 @@ export function createNotificationsExtension(): GeneratorExtension {
         fileName: 'notifications.generated.ts',
         imports: [
           { namedImports: [{ name: 'NotificationTypeDefinition', isTypeOnly: true }], moduleSpecifier: '@open-mercato/shared/modules/notifications/types' },
+          { namedImports: [{ name: 'applyNotificationTypeOverridesToEntries' }], moduleSpecifier: '@open-mercato/shared/modules/overrides' },
           ...notificationImports,
         ],
         build(sourceFile) {
@@ -138,9 +139,13 @@ export function createNotificationsExtension(): GeneratorExtension {
                 type: 'NotificationTypeEntry[]',
                 initializer: arrayLiteral(notificationTypeEntries, writeValue),
               },
+              {
+                name: 'entries',
+                initializer: callExpression(identifier('applyNotificationTypeOverridesToEntries'), [identifier('entriesRaw')]),
+              },
               {
                 name: 'allTypes',
-                initializer: methodCall(identifier('entriesRaw'), 'flatMap', [
+                initializer: methodCall(identifier('entries'), 'flatMap', [
                   arrowFunction({
                     parameters: ['entry'],
                     body: propertyAccess(identifier('entry'), 'types'),
@@ -153,7 +158,7 @@ export function createNotificationsExtension(): GeneratorExtension {
             declarationKind: VariableDeclarationKind.Const,
             isExported: true,
             declarations: [
-              { name: 'notificationTypeEntries', initializer: identifier('entriesRaw') },
+              { name: 'notificationTypeEntries', initializer: identifier('entries') },
               { name: 'notificationTypes', initializer: identifier('allTypes') },
             ],
           })
@@ -193,6 +198,7 @@ export function createNotificationsExtension(): GeneratorExtension {
             ],
             moduleSpecifier: '@open-mercato/shared/modules/notifications/types',
           },
+          { namedImports: [{ name: 'applyNotificationTypeOverridesToEntries' }], moduleSpecifier: '@open-mercato/shared/modules/overrides' },
           ...notificationClientImports,
         ],
         build(sourceFile) {
@@ -213,9 +219,13 @@ export function createNotificationsExtension(): GeneratorExtension {
                 type: 'NotificationTypeEntry[]',
                 initializer: arrayLiteral(notificationClientTypeEntries, writeValue),
               },
+              {
+                name: 'entries',
+                initializer: callExpression(identifier('applyNotificationTypeOverridesToEntries'), [identifier('entriesRaw')]),
+              },
               {
                 name: 'allTypes',
-                initializer: methodCall(identifier('entriesRaw'), 'flatMap', [
+                initializer: methodCall(identifier('entries'), 'flatMap', [
                   arrowFunction({
                     parameters: ['entry'],
                     body: propertyAccess(identifier('entry'), 'types'),
@@ -255,7 +265,7 @@ export function createNotificationsExtension(): GeneratorExtension {
             declarationKind: VariableDeclarationKind.Const,
             isExported: true,
             declarations: [
-              { name: 'notificationClientTypeEntries', initializer: identifier('entriesRaw') },
+              { name: 'notificationClientTypeEntries', initializer: identifier('entries') },
               { name: 'notificationClientTypes', initializer: identifier('allTypes') },
               { name: 'notificationRenderers', initializer: identifier('renderers') },
             ],

package/src/lib/generators/module-registry.ts

@@ -925,8 +925,12 @@ function toLiteral(value: unknown): string {
     .replace(/\u2029/g, '\\u2029')
 }
 
-const GENERATED_MODULE_SPECIFIER_PREFIXES = ['@/', '@open-mercato/', '../../src/modules/', './'] as const
+const GENERATED_MODULE_RELATIVE_PREFIXES = ['@/', '../../src/modules/', './'] as const
 const GENERATED_MODULE_SPECIFIER_SEGMENT = /^[A-Za-z0-9_.\-[\]()']+$/
+// Lenient npm package name matcher. Accepts legacy uppercase packages and
+// tilde-prefixed names, bans leading "." / "_", and reserves "@" for scope
+// markers so the dispatcher below can split scope-vs-bare unambiguously.
+const NPM_PACKAGE_NAME_SEGMENT = /^[A-Za-z0-9~][A-Za-z0-9_.~-]*$/
 
 function sanitizeGeneratedModuleSpecifierSegment(segment: string, importPath: string): string {
   const match = GENERATED_MODULE_SPECIFIER_SEGMENT.exec(segment)
@@ -936,22 +940,83 @@ function sanitizeGeneratedModuleSpecifierSegment(segment: string, importPath: st
   return match[0]
 }
 
-function sanitizeGeneratedModuleSpecifier(importPath: string): string {
-  const prefix = GENERATED_MODULE_SPECIFIER_PREFIXES.find((candidate) => importPath.startsWith(candidate))
-  if (!prefix) {
-    throw new Error(`Unsafe generated module specifier prefix: ${importPath}`)
+function sanitizeNpmPackageNameSegment(segment: string, importPath: string): void {
+  if (!NPM_PACKAGE_NAME_SEGMENT.test(segment) || segment === '.' || segment === '..') {
+    throw new Error(`Unsafe generated module specifier: ${importPath}`)
   }
+}
 
-  const suffix = importPath.slice(prefix.length)
-  if (!suffix) {
+function sanitizeGeneratedModuleSpecifier(importPath: string): string {
+  if (!importPath) {
     throw new Error(`Unsafe generated module specifier: ${importPath}`)
   }
 
-  const segments = suffix
+  const relativePrefix = GENERATED_MODULE_RELATIVE_PREFIXES.find((candidate) =>
+    importPath.startsWith(candidate),
+  )
+  if (relativePrefix) {
+    const suffix = importPath.slice(relativePrefix.length)
+    if (!suffix) {
+      throw new Error(`Unsafe generated module specifier: ${importPath}`)
+    }
+    const segments = suffix
+      .split('/')
+      .map((segment) => sanitizeGeneratedModuleSpecifierSegment(segment, importPath))
+    return `${relativePrefix}${segments.join('/')}`
+  }
+
+  if (importPath.startsWith('@')) {
+    // Scoped npm package: @scope/name[/subpath]
+    const firstSlash = importPath.indexOf('/')
+    if (firstSlash < 2) {
+      throw new Error(`Unsafe generated module specifier prefix: ${importPath}`)
+    }
+    const scope = importPath.slice(1, firstSlash)
+    sanitizeNpmPackageNameSegment(scope, importPath)
+    const rest = importPath.slice(firstSlash + 1)
+    if (!rest) {
+      throw new Error(`Unsafe generated module specifier: ${importPath}`)
+    }
+    const secondSlash = rest.indexOf('/')
+    const name = secondSlash >= 0 ? rest.slice(0, secondSlash) : rest
+    sanitizeNpmPackageNameSegment(name, importPath)
+    const subpath = secondSlash >= 0 ? rest.slice(secondSlash + 1) : ''
+    if (!subpath) {
+      return `@${scope}/${name}`
+    }
+    const segments = subpath
+      .split('/')
+      .map((segment) => sanitizeGeneratedModuleSpecifierSegment(segment, importPath))
+    return `@${scope}/${name}/${segments.join('/')}`
+  }
+
+  // Bare npm package: name[/subpath]
+  const firstSlash = importPath.indexOf('/')
+  const name = firstSlash >= 0 ? importPath.slice(0, firstSlash) : importPath
+  sanitizeNpmPackageNameSegment(name, importPath)
+  const subpath = firstSlash >= 0 ? importPath.slice(firstSlash + 1) : ''
+  if (!subpath) {
+    return name
+  }
+  const segments = subpath
     .split('/')
     .map((segment) => sanitizeGeneratedModuleSpecifierSegment(segment, importPath))
-
-  return `${prefix}${segments.join('/')}`
+  return `${name}/${segments.join('/')}`
+}
+
+// Defense in depth: when src/modules.ts registers a module from a third-party
+// npm scope (anything outside @app / @open-mercato/*), verify the resolved
+// pkgBase directory exists. If it doesn't, the package referenced via `from:`
+// is almost certainly not an Open Mercato module (or the id is wrong), and
+// silently emitting an empty module registration would hide the misconfig.
+function verifyThirdPartyModuleShape(entry: { id: string; from?: string }, pkgBase: string): void {
+  const from = entry.from
+  if (!from || from === '@app' || from.startsWith('@open-mercato/')) return
+  if (fs.existsSync(pkgBase)) return
+  throw new Error(
+    `Module '${entry.id}' is registered with from: '${from}' but no Open Mercato module shape was found at '${pkgBase}'. ` +
+      `Ensure the package ships a 'modules/${entry.id}' subtree (either under 'dist/modules/' or 'src/modules/'), or correct the 'from' value in src/modules.ts.`,
+  )
 }
 
 function buildImportStatement(importClause: string, importPath: string): string {
@@ -2502,6 +2567,9 @@ export async function generateModuleRegistry(options: ModuleRegistryOptions): Pr
   const legacySubscribersChecksumFile = path.join(outputDir, 'subscribers.generated.checksum')
 
   const enabled = resolver.loadEnabledModules()
+  for (const entry of enabled) {
+    verifyThirdPartyModuleShape(entry, resolver.getModulePaths(entry).pkgBase)
+  }
   const extensions = loadGeneratorExtensions()
 
   // Pre-pass: collect generator plugins from each enabled module's generators.ts
@@ -3118,6 +3186,9 @@ export async function generateModuleRegistryApp(options: ModuleRegistryOptions):
   const enabledIdsChecksumFile = path.join(outputDir, 'enabled-module-ids.generated.checksum')
 
   const enabled = resolver.loadEnabledModules()
+  for (const entry of enabled) {
+    verifyThirdPartyModuleShape(entry, resolver.getModulePaths(entry).pkgBase)
+  }
   const imports: string[] = []
   const moduleDecls: WriterFunction[] = []
   const importIdRef = { value: 0 }
@@ -3449,6 +3520,9 @@ export async function generateModuleRegistryCli(options: ModuleRegistryOptions):
   const legacyChecksumFile = path.join(outputDir, 'cli-modules.generated.checksum')
 
   const enabled = resolver.loadEnabledModules()
+  for (const entry of enabled) {
+    verifyThirdPartyModuleShape(entry, resolver.getModulePaths(entry).pkgBase)
+  }
   const imports: string[] = []
   const moduleDecls: WriterFunction[] = []
   // Mutable ref so extracted helper functions can increment the shared counter