fix(bundle): reject conflicting catalog entry IDs

Reject declared IDs that disagree with mapping keys before bundle release selection. Cover all four component catalogs, preserve matching or omitted IDs, and order test imports consistently.

Assisted-by: GitHub Copilot (model: GPT-6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: mnriem

src/specify_cli/bundles/component_catalog.py

@@ -51,6 +51,11 @@ def _matching_entry(entries: dict | list, component: ComponentRef, url: str) ->
                 f"Invalid {component.kind[:-1]} catalog entry for '{component.id}' "
                 f"from {url}: expected an object."
             )
+        if "id" in found and found["id"] != component.id:
+            raise BundlerError(
+                f"Invalid {component.kind[:-1]} catalog entry for '{component.id}' "
+                f"from {url}: declared ID {found['id']!r} does not match the catalog key."
+            )
         return {**found, "id": component.id}
 
     seen: set[str] = set()

tests/specify_cli/bundles/test_command_list.py

@@ -5,8 +5,8 @@
 from pathlib import Path
 from unittest.mock import patch  # noqa: F401
 
-import yaml  # noqa: F401
 import pytest
+import yaml  # noqa: F401
 from typer.testing import CliRunner
 
 from specify_cli import app

tests/specify_cli/bundles/test_references.py

@@ -1219,6 +1219,49 @@ def fetch(self, source, force_refresh=False):
     assert warnings == []
 
 
+@pytest.mark.parametrize("kind", ["extensions", "presets", "workflows", "steps"])
+def test_bundle_rejects_conflicting_declared_catalog_id(tmp_path, monkeypatch, kind):
+    from specify_cli.extensions import ExtensionCatalog
+    from specify_cli.presets import PresetCatalog
+    from specify_cli.workflows.catalog import StepCatalog, WorkflowCatalog
+
+    catalog = {
+        "extensions": ExtensionCatalog,
+        "presets": PresetCatalog,
+        "workflows": WorkflowCatalog,
+        "steps": StepCatalog,
+    }[kind]
+    _mock_catalog(
+        monkeypatch, catalog, kind, "requested",
+        {**_installable_current(kind), "id": "other"},
+    )
+    warnings = []
+    check = make_reference_checker(tmp_path, allow_network=True, warnings=warnings)
+
+    problem = check(ComponentRef(
+        kind=kind, id="requested", version="1.0.0", source="trusted"
+    ))
+    assert problem is not None and "other" in problem and "requested" in problem
+    assert warnings == []
+
+
+@pytest.mark.parametrize("declared_id", ["requested", None])
+def test_bundle_accepts_matching_or_omitted_catalog_id(tmp_path, monkeypatch, declared_id):
+    from specify_cli.extensions import ExtensionCatalog
+
+    record = _installable_current("extensions")
+    if declared_id is not None:
+        record["id"] = declared_id
+    _mock_catalog(monkeypatch, ExtensionCatalog, "extensions", "requested", record)
+    warnings = []
+    check = make_reference_checker(tmp_path, allow_network=True, warnings=warnings)
+
+    assert check(ComponentRef(
+        kind="extensions", id="requested", version="1.0.0", source="trusted"
+    )) is None
+    assert warnings == []
+
+
 @pytest.mark.parametrize("kind", ["workflows", "steps"])
 @pytest.mark.parametrize("duplicate_id", ["requested", "other"])
 def test_bundle_rejects_duplicate_list_ids_before_lower_source(