@mettlecast/domain-cli 0.2.0 → 0.2.2

package/dist/builder/build-registry.js

@@ -42,6 +42,9 @@ export async function buildRegistry(domainRoot) {
     const domainExports = await load(paths.domain);
     const domainRaw = domainExports.find(e => e['_kind'] === 'domain');
     if (!domainRaw) {
+        // Emit any suppressed tsx load errors to stderr before throwing so they appear in CI logs.
+        for (const w of warnings)
+            process.stderr.write(`[tib validate] ${w}\n`);
         throw new Error(`buildRegistry: no 'domain' export found in ${paths.domain}`);
     }
     const domain = {

package/dist/builder/load-module.js

@@ -87,12 +87,15 @@ export async function loadModuleExports(absoluteFilePath) {
         return await new Promise((resolve, reject) => {
             const tsxChild = spawn(process.execPath, [tsxCli, tempPath], {
                 stdio: ['ignore', 'pipe', 'pipe'],
-                env: { ...process.env },
             });
             let stdout = '';
             let stderr = '';
             tsxChild.stdout.on('data', (chunk) => { stdout += chunk.toString(); });
-            tsxChild.stderr.on('data', (chunk) => { stderr += chunk.toString(); });
+            // Pipe tsx stderr directly to our process stderr so errors are visible in CI logs.
+            tsxChild.stderr.on('data', (chunk) => {
+                stderr += chunk.toString();
+                process.stderr.write(chunk);
+            });
             tsxChild.on('close', (code) => {
                 if (code !== 0) {
                     reject(new Error(`loadModuleExports: tsx exited ${code} for ${absoluteFilePath}\n${stderr}`));

package/dist/commands/create-project.js

@@ -231,7 +231,7 @@ export async function runCreateProject(opts) {
                     sha256,
                     wasTemplate: fileEntry.isTemplate,
                     installedAt: new Date().toISOString(),
-                    policy: fileEntry.policy ?? 'tracked',
+                    policy: fileEntry.policy ?? 'editable',
                 });
             }
         }

package/dist/commands/doctor.js

@@ -1028,7 +1028,7 @@ async function checkLayoutPolicy(projectRoot) {
     }
     // Check 1: owned files in unexpected locations
     // Policy: owned files should be in .mc/ OR .github/workflows/tib-*
-    const ownedOutsideTib = manifest.files.filter(f => f.policy === 'owned' &&
+    const ownedOutsideTib = manifest.files.filter(f => f.policy === 'managed' &&
         !f.path.startsWith('.mc/') &&
         !/^\.github\/workflows\/tib-/.test(f.path));
     if (ownedOutsideTib.length === 0) {
@@ -1050,7 +1050,7 @@ async function checkLayoutPolicy(projectRoot) {
         }
     }
     // Check 2: tracked/seed files inside .mc/
-    const nonOwnedInsideTib = manifest.files.filter(f => (f.policy === 'tracked' || f.policy === 'seed') &&
+    const nonOwnedInsideTib = manifest.files.filter(f => (f.policy === 'editable' || f.policy === 'seed') &&
         f.path.startsWith('.mc/'));
     if (nonOwnedInsideTib.length === 0) {
         results.push({
@@ -1157,14 +1157,14 @@ async function checkLayoutPolicy(projectRoot) {
  * Old path → new path mapping for known scaffold files
  */
 const RELOCATION_MAP = [
-    { oldPath: 'infra/modules/app.ts', newPath: '.mc/infra/modules/app.ts', policy: 'owned' },
-    { oldPath: 'infra/modules/shared/SharedStack.ts', newPath: '.mc/infra/modules/shared/SharedStack.ts', policy: 'owned' },
-    { oldPath: 'infra/modules/domains/dispatch-middleware.ts', newPath: '.mc/infra/modules/domains/dispatch-middleware.ts', policy: 'owned' },
-    { oldPath: 'infra/modules/PowerTuningStack.ts', newPath: '.mc/infra/modules/PowerTuningStack.ts', policy: 'owned' },
-    { oldPath: 'infra/cdk.json', newPath: '.mc/infra/cdk.json', policy: 'owned' },
-    { oldPath: 'infra/tsconfig.json', newPath: '.mc/infra/tsconfig.json', policy: 'owned' },
-    { oldPath: 'infra/package.json', newPath: '.mc/infra/package.json', policy: 'owned' },
-    { oldPath: 'mc-deploy.yml', newPath: '.github/workflows/mc-deploy.yml', policy: 'owned' },
+    { oldPath: 'infra/modules/app.ts', newPath: '.mc/infra/modules/app.ts', policy: 'managed' },
+    { oldPath: 'infra/modules/shared/SharedStack.ts', newPath: '.mc/infra/modules/shared/SharedStack.ts', policy: 'managed' },
+    { oldPath: 'infra/modules/domains/dispatch-middleware.ts', newPath: '.mc/infra/modules/domains/dispatch-middleware.ts', policy: 'managed' },
+    { oldPath: 'infra/modules/PowerTuningStack.ts', newPath: '.mc/infra/modules/PowerTuningStack.ts', policy: 'managed' },
+    { oldPath: 'infra/cdk.json', newPath: '.mc/infra/cdk.json', policy: 'managed' },
+    { oldPath: 'infra/tsconfig.json', newPath: '.mc/infra/tsconfig.json', policy: 'managed' },
+    { oldPath: 'infra/package.json', newPath: '.mc/infra/package.json', policy: 'managed' },
+    { oldPath: 'mc-deploy.yml', newPath: '.github/workflows/mc-deploy.yml', policy: 'managed' },
 ];
 /**
  * Run relocation of old-layout scaffold files to new layout

package/dist/commands/upgrade-frontend.js

@@ -2,7 +2,6 @@ import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { cliLogger } from '../utils/logger.js';
 const TIB_PACKAGES = [
-    '@mettlecast/design-system',
     '@mettlecast/dashboard-shell',
     '@mettlecast/sdk',
     '@mettlecast/observability',
@@ -10,7 +9,6 @@ const TIB_PACKAGES = [
     '@mettlecast/tsconfig-react',
 ];
 const REQUIRED_PACKAGES = [
-    '@mettlecast/design-system',
     '@mettlecast/dashboard-shell',
     '@mettlecast/sdk',
 ];

package/dist/commands/upgrade.js

@@ -369,6 +369,10 @@ export async function runUpgrade(packageSpec, opts) {
             }
             // Add to results
             allResults.push({ path: installPath, status: installResult.status, module: mod.id });
+            // update-available: do NOT update manifest (file was not written to disk)
+            if (installResult.status === 'update-available') {
+                continue;
+            }
             // Update manifest if file was not skipped
             const newChecksum = computeChecksumString(newContent);
             upsertManifestFile(updatedManifest, {

package/dist/templates/patterns/api/create-with-event.js

@@ -38,7 +38,7 @@ export const ${varName} = defineApi({
         const entityId = crypto.randomUUID();
 
         // ── Persist entity ────────────────────────────────────
-        // ctx.db.put({ ... })
+        await ctx.store.put(entityId, { id: entityId, name: input.name });
 
         // ── Publish domain event ──────────────────────────────
         await ctx.publish(
@@ -46,16 +46,12 @@ export const ${varName} = defineApi({
           {
             id: entityId,
             name: input.name,
-            tenantId: ctx.tenantId,
+            tenantId: ctx.tenant.id,
           },
           1,
         );
 
-        await ctx.auditLog({
-          action: '${id}.create',
-          tenantId: ctx.tenantId,
-          entityId,
-        });
+        await ctx.audit.log('${id}.create', entityId, { tenantId: ctx.tenant.id });
 
         return {
           id: entityId,

package/dist/templates/patterns/api/idempotent-mutation.js

@@ -11,10 +11,6 @@ export function idempotentMutationTemplate(domain, id, tenancy) {
     return `import { z } from 'zod';
 import { defineApi } from '@mettlecast/domain-runtime';
 
-// ── Idempotency key header ───────────────────────────────────
-
-const IdempotencyKey = z.string().min(1);
-
 // ── Zod schemas ──────────────────────────────────────────────
 
 const ${varName}Input = z.object({
@@ -40,56 +36,37 @@ export const ${varName} = defineApi({
       input: ${varName}Input,
       output: ${varName}Output,
       handler: async (input, ctx) => {
-        // ── Extract idempotency key from headers ──────────────
-        const idempotencyKey = ctx.headers?.['x-idempotency-key'];
-        if (!idempotencyKey) {
-          throw new Error('Missing x-idempotency-key header');
-        }
-        IdempotencyKey.parse(idempotencyKey);
-
-        // ── Check for duplicate ───────────────────────────────
-        const existing = await ctx.db.get({
-          key: { pk: 'IDEMPOTENCY', sk: idempotencyKey },
-        });
+        // ── Check for duplicate (idempotency key = input.id) ──
+        const existing = await ctx.store.get('IDEMPOTENT#' + input.id);
 
         if (existing) {
-          await ctx.auditLog({
-            action: '${id}.idempotent.duplicate',
-            tenantId: ctx.tenantId,
-            meta: { idempotencyKey },
-          });
+          await ctx.audit.log('${id}.idempotent.duplicate', input.id);
           return {
-            id: existing.entityId as string,
+            id: input.id,
             status: 'already-processed',
-            idempotencyKey,
+            idempotencyKey: input.id,
           };
         }
 
         // ── Apply mutation ────────────────────────────────────
-        const result = await ctx.db.put({
-          pk: '${id.toUpperCase()}',
-          sk: input.id,
-          payload: input.payload,
-        });
+        await ctx.store.put(
+          '${id.toUpperCase()}#' + input.id,
+          { id: input.id, payload: input.payload, createdAt: new Date().toISOString() },
+        );
 
-        // ── Record idempotency token ──────────────────────────
-        await ctx.db.put({
-          key: { pk: 'IDEMPOTENCY', sk: idempotencyKey },
-          entityId: input.id,
-          ttl: Math.floor(Date.now() / 1000) + 86400, // 24h TTL
-        });
+        // ── Record idempotency token with 24h TTL ─────────────
+        await ctx.store.put(
+          'IDEMPOTENT#' + input.id,
+          { entityId: input.id },
+          { ttl: Math.floor(Date.now() / 1000) + 86400 },
+        );
 
-        await ctx.auditLog({
-          action: '${id}.idempotent.applied',
-          tenantId: ctx.tenantId,
-          entityId: input.id,
-          meta: { idempotencyKey },
-        });
+        await ctx.audit.log('${id}.idempotent.applied', input.id, { tenantId: ctx.tenant.id });
 
         return {
           id: input.id,
           status: 'applied',
-          idempotencyKey,
+          idempotencyKey: input.id,
         };
       },
     },

package/dist/templates/patterns/api/paginated-list.js

@@ -44,15 +44,7 @@ export const ${varName} = defineApi({
       handler: async (input, ctx) => {
         const { cursor, limit, filter } = input;
 
-        // Emit EMF (Embedded Metric Format) metrics
-        ctx.metrics?.putMetric('${id}.pageRequest', 1, 'Count');
-        ctx.metrics?.putMetric('${id}.pageSize', limit, 'Count');
-
-        await ctx.auditLog({
-          action: '${id}.list',
-          tenantId: ctx.tenantId,
-          meta: { cursor, limit },
-        });
+        await ctx.audit.log('${id}.list', ctx.tenant.id, { cursor, limit });
 
         // ── paginated data fetch ──────────────────────────────
         const items: Array<{ id: string }> = [];

package/dist/templates/patterns/api/simple-crud.js

@@ -41,7 +41,7 @@ export const ${varName} = defineApi({
       output: ${varName}Output,
       handler: async (input, ctx) => {
         // Create / Read / Update / Delete based on method
-        await ctx.auditLog({ action: '${id}.v1', tenantId: ctx.tenantId, input });
+        await ctx.audit.log('${id}.v1', ctx.tenant.id, { input });
         return {
           id: input.id ?? crypto.randomUUID(),
           createdAt: new Date().toISOString(),
@@ -85,7 +85,7 @@ export const ${varName}List = defineApi({
       input: ${varName}ListInput,
       output: ${varName}ListOutput,
       handler: async (input, ctx) => {
-        await ctx.auditLog({ action: '${id}-list.v1', tenantId: ctx.tenantId });
+        await ctx.audit.log('${id}-list.v1', ctx.tenant.id);
         return { items: [], nextCursor: undefined };
       },
     },

package/dist/templates/patterns/api/system-admin.js

@@ -45,10 +45,7 @@ export const ${varName} = defineApi({
       input: ${varName}Input,
       output: ${varName}Output,
       handler: async (input, ctx) => {
-        await ctx.auditLog({
-          action: '${id}.system',
-          meta: { command: input.command },
-        });
+        await ctx.audit.log('${id}.system', 'system', { command: input.command });
 
         switch (input.command) {
           case 'status':

package/dist/templates/patterns/api/webhook-receiver-style.js

@@ -9,7 +9,6 @@ export function webhookReceiverStyleTemplate(domain, id, tenancy) {
     const varName = camelCase(id);
     return `import { z } from 'zod';
 import { defineApi } from '@mettlecast/domain-runtime';
-import crypto from 'crypto';
 
 // ── Supported webhook providers ───────────────────────────────
 
@@ -35,40 +34,6 @@ const ${varName}Output = z.object({
   provider: ProviderEnum,
 });
 
-// ── Signature verification ────────────────────────────────────
-
-function verifySignature(
-  provider: z.infer<typeof ProviderEnum>,
-  payload: string,
-  signatureHeader: string,
-  secret: string,
-): boolean {
-  switch (provider) {
-    case 'stripe':
-      // Stripe uses HMAC-SHA256
-      return crypto.timingSafeEqual(
-        Buffer.from(signatureHeader),
-        crypto.createHmac('sha256', secret).update(payload).digest(),
-      );
-    case 'github':
-      // GitHub uses HMAC-SHA256 with 'sha256=' prefix
-      const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(payload).digest('hex');
-      return crypto.timingSafeEqual(
-        Buffer.from(signatureHeader),
-        Buffer.from(expected),
-      );
-    case 'slack':
-      // Slack uses HMAC-SHA256 with 'v0=' prefix
-      const slackExpected = 'v0=' + crypto.createHmac('sha256', secret).update(payload).digest('hex');
-      return crypto.timingSafeEqual(
-        Buffer.from(signatureHeader),
-        Buffer.from(slackExpected),
-      );
-    default:
-      return true; // custom provider — verify externally
-  }
-}
-
 // ── API definition ───────────────────────────────────────────
 
 export const ${varName} = defineApi({
@@ -81,19 +46,8 @@ export const ${varName} = defineApi({
       input: ${varName}Input,
       output: ${varName}Output,
       handler: async (input, ctx) => {
-        // ── Retrieve webhook secret ───────────────────────────
-        const secret = await ctx.secrets.get(
-          '${domain.toUpperCase()}_WEBHOOK_SECRET',
-          { provider: input.provider },
-        );
-
-        // ── Verify signature ──────────────────────────────────
-        const signatureHeader = ctx.headers?.['x-webhook-signature'] ?? '';
-        const rawPayload = input.rawBody ?? JSON.stringify(input.payload);
-
-        if (!verifySignature(input.provider, rawPayload, signatureHeader, secret)) {
-          throw new Error('Invalid webhook signature');
-        }
+        // Signature verification belongs in a Lambda authorizer (x-webhook-signature header
+        // is not accessible here). Wire an HttpLambdaAuthorizer in DomainStack for production.
 
         const eventId = crypto.randomUUID();
 
@@ -103,13 +57,13 @@ export const ${varName} = defineApi({
           provider: input.provider,
           eventType: input.eventType,
           payload: input.payload,
-          tenantId: ctx.tenantId,
+          tenantId: ctx.tenant.id,
         }, 1);
 
-        await ctx.auditLog({
-          action: '${id}.webhook.received',
-          tenantId: ctx.tenantId,
-          meta: { provider: input.provider, eventType: input.eventType, eventId },
+        await ctx.audit.log('${id}.webhook.received', ctx.tenant.id, {
+          provider: input.provider,
+          eventType: input.eventType,
+          eventId,
         });
 
         return {

package/dist/templates/patterns/subscriber/audit-relay.js

@@ -20,31 +20,21 @@ export const ${varName} = defineSubscriber({
   event: '${event}',
   semverRange: '^1',
   handler: async (event, ctx) => {
-    const auditRecord = {
-      pk: 'AUDIT#' + event.data.tenantId,
-      sk: 'EVENT#' + event.id,
-      eventType: event.type,
-      eventVersion: event.version,
-      payload: event.data,
-      timestamp: event.timestamp,
-      source: event.source,
-      correlationId: event.correlationId,
-      ttl: Math.floor(Date.now() / 1000) + 90 * 86400, // 90-day retention
-    };
+    const ev = event as { id?: string; type?: string; version?: number; data?: unknown; timestamp?: string };
+    const eventId = ev.id ?? crypto.randomUUID();
 
-    // ── Write to audit store ─────────────────────────────────
-    await ctx.db.put(auditRecord);
-
-    // ── Optionally forward to external sink ──────────────────
-    if (ctx.integrations?.auditSink) {
-      await ctx.fetch(ctx.integrations.auditSink, {
-        method: 'POST',
-        body: JSON.stringify(auditRecord),
-        headers: { 'content-type': 'application/json' },
-      });
-    }
-
-    ctx.metrics?.putMetric('${id}.audit.relayed', 1, 'Count');
+    // ── Write immutable audit record ─────────────────────────
+    await ctx.store.put(
+      'AUDIT#' + eventId,
+      {
+        eventId,
+        eventType: ev.type,
+        eventVersion: ev.version,
+        payload: ev.data,
+        timestamp: ev.timestamp ?? new Date().toISOString(),
+      },
+      { ttl: Math.floor(Date.now() / 1000) + 90 * 86400 }, // 90-day retention
+    );
   },
 });
 `;

package/dist/templates/patterns/subscriber/cascade-deletion.js

@@ -22,38 +22,22 @@ export const ${varName} = defineSubscriber({
   event: '${event}',
   semverRange: '^1',
   handler: async (event, ctx) => {
-    const { entityId, tenantId } = event.data;
+    const data = (event as { data: { entityId: string; deletedBy?: string } }).data;
 
     // ── Find all children ────────────────────────────────────
-    const children = await ctx.db.query({
-      pk: 'TENANT#' + tenantId,
-      skPrefix: 'CHILD#' + entityId,
-    });
+    const { items: children } = await ctx.store.query({ skPrefix: 'CHILD#' + data.entityId });
 
     // ── Soft-delete each child ───────────────────────────────
     const now = new Date().toISOString();
     for (const child of children) {
-      await ctx.db.update({
-        key: { pk: child.pk, sk: child.sk },
-        updates: {
-          deletedAt: now,
-          deletedBy: event.data.deletedBy ?? 'system',
-        },
+      await ctx.store.update(child['sk'] as string, {
+        deletedAt: now,
+        deletedBy: data.deletedBy ?? 'system',
       });
     }
 
     // ── Audit log ────────────────────────────────────────────
-    await ctx.auditLog({
-      action: 'cascade.delete',
-      tenantId,
-      entityId,
-      meta: {
-        childrenDeleted: children.length,
-        triggeredBy: event.id,
-      },
-    });
-
-    ctx.metrics?.putMetric('${id}.cascade.deleted', children.length, 'Count');
+    await ctx.audit.log('cascade.delete', data.entityId, { childrenDeleted: children.length });
   },
 });
 `;

package/dist/templates/patterns/subscriber/single-step-projection.js

@@ -17,19 +17,15 @@ export const ${varName} = defineSubscriber({
   event: '${event}',
   semverRange: '^1',
   handler: async (event, ctx) => {
-    const { tenantId, ...eventData } = event.data;
+    const { tenantId: _tenantId, ...eventData } = (event as { data: Record<string, unknown> }).data;
+    const eventId = (event as { id?: string }).id ?? 'unknown';
 
     // ── Upsert projection ────────────────────────────────────
     // Each event updates the projection row for fast reads.
-    await ctx.db.put({
-      pk: 'TENANT#' + tenantId,
-      sk: 'PROJECTION#' + event.id,
-      ...eventData,
-      lastEventId: event.id,
-      projectedAt: new Date().toISOString(),
-    });
-
-    ctx.metrics?.putMetric('${id}.projection.applied', 1, 'Count');
+    await ctx.store.put(
+      'PROJECTION#' + eventId,
+      { ...eventData, lastEventId: eventId, projectedAt: new Date().toISOString() },
+    );
   },
 });
 `;

package/dist/templates/subscriber-skeleton.js

@@ -16,7 +16,7 @@ export const ${subscriberId.replace(/-([a-z])/g, (_, c) => c.toUpperCase())} = d
   event: '${eventId}',
   semverRange: '*',
   handler: async (_event, _ctx) => {
-    // TODO: Implement subscriber handler
+    // receive _event.data (typed payload) and use _ctx.store, _ctx.publish, _ctx.audit
   },
 });
 `;

package/dist/utils/install-file.d.ts

@@ -1,15 +1,14 @@
 import type { ManifestFileEntry } from './manifest.js';
-export type FilePolicy = 'owned' | 'tracked' | 'seed';
+export type FilePolicy = 'managed' | 'editable' | 'seed';
 export interface InstallResult {
-    status: 'added' | 'updated' | 'conflict' | 'skipped' | 'unchanged';
+    status: 'added' | 'updated' | 'conflict' | 'skipped' | 'unchanged' | 'update-available';
 }
 /**
  * Install a scaffold file according to its policy.
  *
- * - owned: always overwrite. Return 'added' if new, 'updated' if existed.
- * - tracked: check sha256. If same → 'unchanged'. If different, check disk for drift.
- *   If drifted → write .tib-upgrade file → 'conflict'. If not drifted → overwrite → 'updated'.
- *   If no currentEntry → write new → 'added'.
+ * - managed: always overwrite. Return 'added' if new, 'updated' if existed.
+ * - editable: check sha256. If same → 'unchanged'. If different → 'update-available'
+ *   (does not write .tib-upgrade or overwrite — user opts in via Updates tab).
  * - seed: if file exists → 'skipped'. Else write → 'added'.
  */
 export declare function installScaffoldFile(absPath: string, content: string, policy: FilePolicy, currentEntry: ManifestFileEntry | undefined, opts?: {

package/dist/utils/install-file.js

@@ -1,13 +1,12 @@
 import { writeFile, mkdir, access } from 'node:fs/promises';
 import { dirname } from 'node:path';
-import { computeChecksumString, computeChecksumFile } from './checksum.js';
+import { computeChecksumString } from './checksum.js';
 /**
  * Install a scaffold file according to its policy.
  *
- * - owned: always overwrite. Return 'added' if new, 'updated' if existed.
- * - tracked: check sha256. If same → 'unchanged'. If different, check disk for drift.
- *   If drifted → write .tib-upgrade file → 'conflict'. If not drifted → overwrite → 'updated'.
- *   If no currentEntry → write new → 'added'.
+ * - managed: always overwrite. Return 'added' if new, 'updated' if existed.
+ * - editable: check sha256. If same → 'unchanged'. If different → 'update-available'
+ *   (does not write .tib-upgrade or overwrite — user opts in via Updates tab).
  * - seed: if file exists → 'skipped'. Else write → 'added'.
  */
 export async function installScaffoldFile(absPath, content, policy, currentEntry, opts) {
@@ -23,8 +22,8 @@ export async function installScaffoldFile(absPath, content, policy, currentEntry
             return false;
         }
     };
-    if (policy === 'owned') {
-        // owned: always overwrite, no sha256 check
+    if (policy === 'managed') {
+        // managed: always overwrite, no sha256 check
         const exists = await fileExists(absPath);
         if (!dryRun) {
             await mkdir(dirname(absPath), { recursive: true });
@@ -44,7 +43,7 @@ export async function installScaffoldFile(absPath, content, policy, currentEntry
         }
         return { status: 'added' };
     }
-    // policy === 'tracked'
+    // policy === 'editable'
     if (!currentEntry) {
         // New file: write it
         if (!dryRun) {
@@ -58,21 +57,6 @@ export async function installScaffoldFile(absPath, content, policy, currentEntry
         // Content unchanged
         return { status: 'unchanged' };
     }
-    // Content changed: check for drift
-    const diskChecksum = await computeChecksumFile(absPath);
-    const drifted = diskChecksum !== null && diskChecksum !== currentEntry.sha256;
-    if (drifted) {
-        // Drift detected: write .tib-upgrade file, don't touch original
-        if (!dryRun) {
-            await mkdir(dirname(absPath), { recursive: true });
-            await writeFile(`${absPath}.tib-upgrade`, content, 'utf-8');
-        }
-        return { status: 'conflict' };
-    }
-    // No drift: safe to overwrite
-    if (!dryRun) {
-        await mkdir(dirname(absPath), { recursive: true });
-        await writeFile(absPath, content, 'utf-8');
-    }
-    return { status: 'updated' };
+    // Content changed: report update available, do NOT modify disk
+    return { status: 'update-available' };
 }

package/dist/utils/manifest.d.ts

@@ -1,4 +1,4 @@
-export type FilePolicy = 'owned' | 'tracked' | 'seed';
+export type FilePolicy = 'managed' | 'editable' | 'seed';
 export interface ManifestFileEntry {
     path: string;
     module: string;
@@ -25,4 +25,4 @@ export declare function createManifest(scaffoldVersion: string, projectName: str
 export declare function upsertManifestFile(manifest: TibManifest, entry: ManifestFileEntry): void;
 export declare function removeManifestFile(manifest: TibManifest, filePath: string): void;
 export declare function getManifestFile(manifest: TibManifest, filePath: string): ManifestFileEntry | undefined;
-export declare function isScaffoldOwned(manifest: TibManifest, filePath: string): boolean;
+export declare function isScaffoldManaged(manifest: TibManifest, filePath: string): boolean;