@mettlecast/domain-cli 0.2.0 → 0.2.1

package/src/templates/patterns/api/simple-crud.ts

@@ -44,7 +44,7 @@ export const ${varName} = defineApi({
       output: ${varName}Output,
       handler: async (input, ctx) => {
         // Create / Read / Update / Delete based on method
-        await ctx.auditLog({ action: '${id}.v1', tenantId: ctx.tenantId, input });
+        await ctx.audit.log('${id}.v1', ctx.tenant.id, { input });
         return {
           id: input.id ?? crypto.randomUUID(),
           createdAt: new Date().toISOString(),
@@ -90,7 +90,7 @@ export const ${varName}List = defineApi({
       input: ${varName}ListInput,
       output: ${varName}ListOutput,
       handler: async (input, ctx) => {
-        await ctx.auditLog({ action: '${id}-list.v1', tenantId: ctx.tenantId });
+        await ctx.audit.log('${id}-list.v1', ctx.tenant.id);
         return { items: [], nextCursor: undefined };
       },
     },

package/src/templates/patterns/api/system-admin.ts

@@ -48,10 +48,7 @@ export const ${varName} = defineApi({
       input: ${varName}Input,
       output: ${varName}Output,
       handler: async (input, ctx) => {
-        await ctx.auditLog({
-          action: '${id}.system',
-          meta: { command: input.command },
-        });
+        await ctx.audit.log('${id}.system', 'system', { command: input.command });
 
         switch (input.command) {
           case 'status':

package/src/templates/patterns/api/webhook-receiver-style.ts

@@ -12,7 +12,6 @@ export function webhookReceiverStyleTemplate(domain: string, id: string, tenancy
 
   return `import { z } from 'zod';
 import { defineApi } from '@mettlecast/domain-runtime';
-import crypto from 'crypto';
 
 // ── Supported webhook providers ───────────────────────────────
 
@@ -38,40 +37,6 @@ const ${varName}Output = z.object({
   provider: ProviderEnum,
 });
 
-// ── Signature verification ────────────────────────────────────
-
-function verifySignature(
-  provider: z.infer<typeof ProviderEnum>,
-  payload: string,
-  signatureHeader: string,
-  secret: string,
-): boolean {
-  switch (provider) {
-    case 'stripe':
-      // Stripe uses HMAC-SHA256
-      return crypto.timingSafeEqual(
-        Buffer.from(signatureHeader),
-        crypto.createHmac('sha256', secret).update(payload).digest(),
-      );
-    case 'github':
-      // GitHub uses HMAC-SHA256 with 'sha256=' prefix
-      const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(payload).digest('hex');
-      return crypto.timingSafeEqual(
-        Buffer.from(signatureHeader),
-        Buffer.from(expected),
-      );
-    case 'slack':
-      // Slack uses HMAC-SHA256 with 'v0=' prefix
-      const slackExpected = 'v0=' + crypto.createHmac('sha256', secret).update(payload).digest('hex');
-      return crypto.timingSafeEqual(
-        Buffer.from(signatureHeader),
-        Buffer.from(slackExpected),
-      );
-    default:
-      return true; // custom provider — verify externally
-  }
-}
-
 // ── API definition ───────────────────────────────────────────
 
 export const ${varName} = defineApi({
@@ -84,19 +49,8 @@ export const ${varName} = defineApi({
       input: ${varName}Input,
       output: ${varName}Output,
       handler: async (input, ctx) => {
-        // ── Retrieve webhook secret ───────────────────────────
-        const secret = await ctx.secrets.get(
-          '${domain.toUpperCase()}_WEBHOOK_SECRET',
-          { provider: input.provider },
-        );
-
-        // ── Verify signature ──────────────────────────────────
-        const signatureHeader = ctx.headers?.['x-webhook-signature'] ?? '';
-        const rawPayload = input.rawBody ?? JSON.stringify(input.payload);
-
-        if (!verifySignature(input.provider, rawPayload, signatureHeader, secret)) {
-          throw new Error('Invalid webhook signature');
-        }
+        // Signature verification belongs in a Lambda authorizer (x-webhook-signature header
+        // is not accessible here). Wire an HttpLambdaAuthorizer in DomainStack for production.
 
         const eventId = crypto.randomUUID();
 
@@ -106,13 +60,13 @@ export const ${varName} = defineApi({
           provider: input.provider,
           eventType: input.eventType,
           payload: input.payload,
-          tenantId: ctx.tenantId,
+          tenantId: ctx.tenant.id,
         }, 1);
 
-        await ctx.auditLog({
-          action: '${id}.webhook.received',
-          tenantId: ctx.tenantId,
-          meta: { provider: input.provider, eventType: input.eventType, eventId },
+        await ctx.audit.log('${id}.webhook.received', ctx.tenant.id, {
+          provider: input.provider,
+          eventType: input.eventType,
+          eventId,
         });
 
         return {

package/src/templates/patterns/subscriber/audit-relay.ts

@@ -23,31 +23,21 @@ export const ${varName} = defineSubscriber({
   event: '${event}',
   semverRange: '^1',
   handler: async (event, ctx) => {
-    const auditRecord = {
-      pk: 'AUDIT#' + event.data.tenantId,
-      sk: 'EVENT#' + event.id,
-      eventType: event.type,
-      eventVersion: event.version,
-      payload: event.data,
-      timestamp: event.timestamp,
-      source: event.source,
-      correlationId: event.correlationId,
-      ttl: Math.floor(Date.now() / 1000) + 90 * 86400, // 90-day retention
-    };
+    const ev = event as { id?: string; type?: string; version?: number; data?: unknown; timestamp?: string };
+    const eventId = ev.id ?? crypto.randomUUID();
 
-    // ── Write to audit store ─────────────────────────────────
-    await ctx.db.put(auditRecord);
-
-    // ── Optionally forward to external sink ──────────────────
-    if (ctx.integrations?.auditSink) {
-      await ctx.fetch(ctx.integrations.auditSink, {
-        method: 'POST',
-        body: JSON.stringify(auditRecord),
-        headers: { 'content-type': 'application/json' },
-      });
-    }
-
-    ctx.metrics?.putMetric('${id}.audit.relayed', 1, 'Count');
+    // ── Write immutable audit record ─────────────────────────
+    await ctx.store.put(
+      'AUDIT#' + eventId,
+      {
+        eventId,
+        eventType: ev.type,
+        eventVersion: ev.version,
+        payload: ev.data,
+        timestamp: ev.timestamp ?? new Date().toISOString(),
+      },
+      { ttl: Math.floor(Date.now() / 1000) + 90 * 86400 }, // 90-day retention
+    );
   },
 });
 `;

package/src/templates/patterns/subscriber/cascade-deletion.ts

@@ -25,38 +25,22 @@ export const ${varName} = defineSubscriber({
   event: '${event}',
   semverRange: '^1',
   handler: async (event, ctx) => {
-    const { entityId, tenantId } = event.data;
+    const data = (event as { data: { entityId: string; deletedBy?: string } }).data;
 
     // ── Find all children ────────────────────────────────────
-    const children = await ctx.db.query({
-      pk: 'TENANT#' + tenantId,
-      skPrefix: 'CHILD#' + entityId,
-    });
+    const { items: children } = await ctx.store.query({ skPrefix: 'CHILD#' + data.entityId });
 
     // ── Soft-delete each child ───────────────────────────────
     const now = new Date().toISOString();
     for (const child of children) {
-      await ctx.db.update({
-        key: { pk: child.pk, sk: child.sk },
-        updates: {
-          deletedAt: now,
-          deletedBy: event.data.deletedBy ?? 'system',
-        },
+      await ctx.store.update(child['sk'] as string, {
+        deletedAt: now,
+        deletedBy: data.deletedBy ?? 'system',
       });
     }
 
     // ── Audit log ────────────────────────────────────────────
-    await ctx.auditLog({
-      action: 'cascade.delete',
-      tenantId,
-      entityId,
-      meta: {
-        childrenDeleted: children.length,
-        triggeredBy: event.id,
-      },
-    });
-
-    ctx.metrics?.putMetric('${id}.cascade.deleted', children.length, 'Count');
+    await ctx.audit.log('cascade.delete', data.entityId, { childrenDeleted: children.length });
   },
 });
 `;

package/src/templates/patterns/subscriber/single-step-projection.ts

@@ -20,19 +20,15 @@ export const ${varName} = defineSubscriber({
   event: '${event}',
   semverRange: '^1',
   handler: async (event, ctx) => {
-    const { tenantId, ...eventData } = event.data;
+    const { tenantId: _tenantId, ...eventData } = (event as { data: Record<string, unknown> }).data;
+    const eventId = (event as { id?: string }).id ?? 'unknown';
 
     // ── Upsert projection ────────────────────────────────────
     // Each event updates the projection row for fast reads.
-    await ctx.db.put({
-      pk: 'TENANT#' + tenantId,
-      sk: 'PROJECTION#' + event.id,
-      ...eventData,
-      lastEventId: event.id,
-      projectedAt: new Date().toISOString(),
-    });
-
-    ctx.metrics?.putMetric('${id}.projection.applied', 1, 'Count');
+    await ctx.store.put(
+      'PROJECTION#' + eventId,
+      { ...eventData, lastEventId: eventId, projectedAt: new Date().toISOString() },
+    );
   },
 });
 `;

package/src/templates/subscriber-skeleton.ts

@@ -21,7 +21,7 @@ export const ${subscriberId.replace(/-([a-z])/g, (_, c) => c.toUpperCase())} = d
   event: '${eventId}',
   semverRange: '*',
   handler: async (_event, _ctx) => {
-    // TODO: Implement subscriber handler
+    // receive _event.data (typed payload) and use _ctx.store, _ctx.publish, _ctx.audit
   },
 });
 `;

package/src/utils/install-file.ts

@@ -1,21 +1,20 @@
 import { writeFile, mkdir, access } from 'node:fs/promises';
 import { dirname } from 'node:path';
-import { computeChecksumString, computeChecksumFile } from './checksum.js';
+import { computeChecksumString } from './checksum.js';
 import type { ManifestFileEntry } from './manifest.js';
 
-export type FilePolicy = 'owned' | 'tracked' | 'seed';
+export type FilePolicy = 'managed' | 'editable' | 'seed';
 
 export interface InstallResult {
-  status: 'added' | 'updated' | 'conflict' | 'skipped' | 'unchanged';
+  status: 'added' | 'updated' | 'conflict' | 'skipped' | 'unchanged' | 'update-available';
 }
 
 /**
  * Install a scaffold file according to its policy.
  *
- * - owned: always overwrite. Return 'added' if new, 'updated' if existed.
- * - tracked: check sha256. If same → 'unchanged'. If different, check disk for drift.
- *   If drifted → write .tib-upgrade file → 'conflict'. If not drifted → overwrite → 'updated'.
- *   If no currentEntry → write new → 'added'.
+ * - managed: always overwrite. Return 'added' if new, 'updated' if existed.
+ * - editable: check sha256. If same → 'unchanged'. If different → 'update-available'
+ *   (does not write .tib-upgrade or overwrite — user opts in via Updates tab).
  * - seed: if file exists → 'skipped'. Else write → 'added'.
  */
 export async function installScaffoldFile(
@@ -38,8 +37,8 @@ export async function installScaffoldFile(
     }
   };
 
-  if (policy === 'owned') {
-    // owned: always overwrite, no sha256 check
+  if (policy === 'managed') {
+    // managed: always overwrite, no sha256 check
     const exists = await fileExists(absPath);
     if (!dryRun) {
       await mkdir(dirname(absPath), { recursive: true });
@@ -61,7 +60,7 @@ export async function installScaffoldFile(
     return { status: 'added' };
   }
 
-  // policy === 'tracked'
+  // policy === 'editable'
   if (!currentEntry) {
     // New file: write it
     if (!dryRun) {
@@ -77,23 +76,6 @@ export async function installScaffoldFile(
     return { status: 'unchanged' };
   }
 
-  // Content changed: check for drift
-  const diskChecksum = await computeChecksumFile(absPath);
-  const drifted = diskChecksum !== null && diskChecksum !== currentEntry.sha256;
-
-  if (drifted) {
-    // Drift detected: write .tib-upgrade file, don't touch original
-    if (!dryRun) {
-      await mkdir(dirname(absPath), { recursive: true });
-      await writeFile(`${absPath}.tib-upgrade`, content, 'utf-8');
-    }
-    return { status: 'conflict' };
-  }
-
-  // No drift: safe to overwrite
-  if (!dryRun) {
-    await mkdir(dirname(absPath), { recursive: true });
-    await writeFile(absPath, content, 'utf-8');
-  }
-  return { status: 'updated' };
+  // Content changed: report update available, do NOT modify disk
+  return { status: 'update-available' };
 }

package/src/utils/manifest.ts

@@ -2,7 +2,7 @@ import { readFile, writeFile, mkdir } from 'fs/promises';
 import path from 'path';
 import { cliLogger } from './logger.js';
 
-export type FilePolicy = 'owned' | 'tracked' | 'seed';
+export type FilePolicy = 'managed' | 'editable' | 'seed';
 
 export interface ManifestFileEntry {
   path: string;
@@ -36,7 +36,34 @@ export function inferPolicyFromPath(filePath: string): FilePolicy {
     filePath === 'mc-deploy.yml' ||
     filePath.match(/^\.github\/workflows\//)
   ) {
-    return 'owned';
+    return 'managed';
+  }
+
+  // managed: core scaffold files not prefixed with infra/
+  const managedFilePatterns = [
+    /^CLAUDE\.md$/,
+    /^\.husky\//,
+    /^\.mc\/scaffold-config\.json$/,
+    /^\.mc\/modules-hashes\.json$/,
+    /^\.npmrc$/,
+    /^cdk\.json$/,
+    /^\.gitignore$/,
+    /^eslint\.config\.js$/,
+    /^package\.json$/,
+    /^publish-knowledge\.(yml|mjs)$/,
+    /^mc-destroy\.yml$/,
+  ];
+  if (managedFilePatterns.some((p) => p.test(filePath))) {
+    return 'managed';
+  }
+
+  // editable: user-customisable config files
+  const editableFilePatterns = [
+    /^vite\.config\.ts$/,
+    /^tailwind\.config\.ts$/,
+  ];
+  if (editableFilePatterns.some((p) => p.test(filePath))) {
+    return 'editable';
   }
 
   // seed: specific frontend paths
@@ -53,7 +80,7 @@ export function inferPolicyFromPath(filePath: string): FilePolicy {
   }
 
   // tracked: everything else
-  return 'tracked';
+  return 'editable';
 }
 
 export async function readManifest(projectRoot: string): Promise<TibManifest | null> {
@@ -76,6 +103,24 @@ export async function readManifest(projectRoot: string): Promise<TibManifest | n
       await writeManifest(projectRoot, manifest);
     }
 
+    // v2→v3 migration: rename 'owned'→'managed', 'tracked'→'editable'
+    let needsV3Migration = false;
+    for (const entry of manifest.files as unknown as Array<Record<string, unknown>>) {
+      const rawPolicy = entry['policy'] as string | undefined;
+      if (rawPolicy === 'owned') {
+        entry['policy'] = 'managed';
+        needsV3Migration = true;
+      } else if (rawPolicy === 'tracked') {
+        entry['policy'] = 'editable';
+        needsV3Migration = true;
+      }
+    }
+
+    if (needsV3Migration) {
+      cliLogger.info('manifest: migrating v2→v3 with renamed policies');
+      await writeManifest(projectRoot, manifest);
+    }
+
     return manifest;
   } catch (err: unknown) {
     if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
@@ -130,8 +175,8 @@ export function getManifestFile(
   return manifest.files.find((f) => f.path === filePath);
 }
 
-export function isScaffoldOwned(manifest: TibManifest, filePath: string): boolean {
+export function isScaffoldManaged(manifest: TibManifest, filePath: string): boolean {
   const entry = manifest.files.find((f) => f.path === filePath);
-  // Scaffold-managed means in manifest AND policy is not 'seed'
-  return entry != null && entry.policy !== 'seed';
+  // Returns true only when the file is in the manifest with policy 'managed'
+  return entry != null && entry.policy === 'managed';
 }

package/src/utils/scaffold-config.ts

@@ -43,6 +43,12 @@ export interface CostOptions {
   reservedConcurrencyPerDomain?: Record<string, number>;
 }
 
+/** Monitoring / observability feature opt-ins. */
+export interface MonitoringOptions {
+  /** Replace basic MonitoringStack with full ObservabilityStack (Grafana + Cost Explorer + CloudWatch). ~$9–18/month */
+  enhanced: boolean;
+}
+
 /** Lifecycle tunables — Phase B. Schema only in Phase A. */
 export interface LifecycleOptions {
   dlqRetentionDays?: 7 | 14;
@@ -95,6 +101,8 @@ export interface ScaffoldConfig {
   costOptions?: CostOptions;
   /** Lifecycle tunables. Phase B — schema present, CDK not yet wired. */
   lifecycleOptions?: LifecycleOptions;
+  /** Monitoring feature opt-ins. All default false. */
+  monitoringOptions?: MonitoringOptions;
   /** Per-environment URL configuration for custom domains. */
   environments?: EnvironmentsConfig;
   /** When true, CORS responses include Allow-Credentials: true (requires non-wildcard origins). */
@@ -117,6 +125,9 @@ const DEFAULT_SCAFFOLD_CONFIG: Omit<ScaffoldConfig, 'domainIds' | 'flowIds'> = {
   },
   firstDeployedAt: {},
   logRetentionDays: 30,
+  monitoringOptions: {
+    enhanced: false,
+  },
 };
 
 const CONFIG_PATH = '.mc/scaffold-config.json';