@mettlecast/domain-cli 0.2.0

package/src/__tests__/commands/upgrade.test.ts

@@ -0,0 +1,762 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdtemp, rmdir, writeFile, readFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { gzipSync } from 'node:zlib';
+
+vi.mock('../../utils/s3-fetch.js', () => ({
+  fetchVersionsJson: vi.fn(),
+  fetchModulesJson: vi.fn(),
+  fetchModuleTarball: vi.fn(),
+  fetchScaffoldFile: vi.fn(),
+}));
+
+vi.mock('../../utils/manifest.js', async () => {
+  const actual = await vi.importActual<typeof import('../../utils/manifest.js')>('../../utils/manifest.js');
+  return {
+    readManifest: vi.fn(),
+    writeManifest: vi.fn(),
+    upsertManifestFile: vi.fn(),
+    removeManifestFile: vi.fn(),
+    inferPolicyFromPath: actual.inferPolicyFromPath,
+  };
+});
+
+vi.mock('../../utils/scaffold-config.js', () => ({
+  readScaffoldConfig: vi.fn(),
+  writeScaffoldConfig: vi.fn(),
+}));
+
+vi.mock('node:child_process', () => ({
+  execSync: vi.fn((cmd: string) => {
+    // Mock git operations without throwing
+    if (cmd.includes('git remote')) return 'https://github.com/test/repo.git';
+    if (cmd.includes('git status')) return '';
+    return '';
+  }),
+}));
+
+import { runUpgrade } from '../../commands/upgrade.js';
+import { fetchVersionsJson, fetchModulesJson, fetchModuleTarball } from '../../utils/s3-fetch.js';
+import { readManifest, writeManifest, upsertManifestFile } from '../../utils/manifest.js';
+import { readScaffoldConfig, writeScaffoldConfig } from '../../utils/scaffold-config.js';
+import { computeChecksumString } from '../../utils/checksum.js';
+
+const mockFetchVersionsJson = vi.mocked(fetchVersionsJson);
+const mockFetchModulesJson = vi.mocked(fetchModulesJson);
+const mockFetchModuleTarball = vi.mocked(fetchModuleTarball);
+const mockReadManifest = vi.mocked(readManifest);
+const mockWriteManifest = vi.mocked(writeManifest);
+const mockUpsertManifestFile = vi.mocked(upsertManifestFile);
+const mockReadScaffoldConfig = vi.mocked(readScaffoldConfig);
+const mockWriteScaffoldConfig = vi.mocked(writeScaffoldConfig);
+
+describe('upgrade command', () => {
+  let tmpDir: string;
+
+  beforeEach(async () => {
+    tmpDir = await mkdtemp(join(tmpdir(), 'tib-upgrade-test-'));
+    vi.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    try {
+      await rmdir(tmpDir, { recursive: true });
+    } catch {
+      // Ignore cleanup errors
+    }
+  });
+
+  describe('already at latest version', () => {
+    it('exits 0 with no file changes when currentVersion === targetVersion', async () => {
+      const currentVersion = '1.0.0';
+      const targetVersion = '1.0.0';
+
+      mockReadManifest.mockResolvedValue({
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: currentVersion,
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['core'],
+        files: [],
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue({
+        scaffoldVersion: currentVersion,
+        enabledModules: ['core'],
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        awsAccountId: '123456789012',
+        domainIds: [],
+        flowIds: [],
+        scaffoldBucket: 'mc-scaffold',
+      });
+
+      mockFetchVersionsJson.mockResolvedValue({
+        latest: targetVersion,
+        versions: [currentVersion, targetVersion],
+      });
+
+      // Should not throw and should return without further processing
+      await expect(runUpgrade(undefined, { dryRun: false, projectDir: tmpDir })).resolves.not.toThrow();
+
+      // Manifest should not be written
+      expect(mockWriteManifest).not.toHaveBeenCalled();
+      expect(mockWriteScaffoldConfig).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('applying diff to non-drifted files', () => {
+    it('applies diff when file content is not drifted', async () => {
+      const oldChecksum = computeChecksumString('old content');
+      const newContent = 'new content';
+      const newChecksum = computeChecksumString(newContent);
+      const filePath = 'infra/modules/app.ts';
+
+      // Create the file with old content matching the manifest checksum
+      await mkdir(join(tmpDir, 'infra', 'modules'), { recursive: true });
+      await writeFile(join(tmpDir, filePath), 'old content', 'utf-8');
+
+      mockReadManifest.mockResolvedValue({
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['core'],
+        files: [
+          {
+            path: filePath,
+            module: 'core',
+            moduleVersion: '1.0.0',
+            sha256: oldChecksum,
+            wasTemplate: false,
+            installedAt: '2026-01-01T00:00:00Z',
+            policy: 'tracked',
+          },
+        ],
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue({
+        scaffoldVersion: '1.0.0',
+        enabledModules: ['core'],
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        awsAccountId: '123456789012',
+        domainIds: [],
+        flowIds: [],
+        scaffoldBucket: 'mc-scaffold',
+      });
+
+      mockFetchVersionsJson.mockResolvedValue({
+        latest: '1.1.0',
+        versions: ['1.0.0', '1.1.0'],
+      });
+
+      mockFetchModulesJson.mockImplementation(async (bucket: string, version: string) => {
+        if (version === '1.0.0') {
+          return {
+            scaffoldVersion: '1.0.0',
+            releasedAt: '2026-01-01T00:00:00Z',
+            modules: [
+              {
+                id: 'core',
+                version: '1.0.0',
+                description: 'Core scaffold',
+                dependencies: [],
+                tarball: 'core-1.0.0.tar.gz',
+                sha256: 'old123',
+              },
+            ],
+            compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+          };
+        }
+        return {
+          scaffoldVersion: '1.1.0',
+          releasedAt: '2026-02-01T00:00:00Z',
+          modules: [
+            {
+              id: 'core',
+              version: '1.1.0',
+              description: 'Core scaffold',
+              dependencies: [],
+              tarball: 'core-1.1.0.tar.gz',
+              sha256: 'abc123',
+            },
+          ],
+          compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+        };
+      });
+
+      // Mock tarball with MANIFEST.json and the file
+      const tarballContent = createMockTarball([
+        { path: 'MANIFEST.json', content: JSON.stringify([
+          { path: filePath, sha256: newChecksum, isTemplate: false },
+        ]) },
+        { path: filePath, content: newContent },
+      ]);
+
+      mockFetchModuleTarball.mockResolvedValue(Buffer.from(tarballContent));
+
+      await runUpgrade('1.1.0', { dryRun: false, projectDir: tmpDir });
+
+      // Assert file was updated
+      const fileContent = await readFile(join(tmpDir, filePath), 'utf-8');
+      expect(fileContent).toContain(newContent);
+
+      // Assert manifest was updated
+      expect(mockWriteManifest).toHaveBeenCalled();
+      expect(mockWriteScaffoldConfig).toHaveBeenCalled();
+    });
+  });
+
+  describe('drift detection and .tib-upgrade conflict files', () => {
+    it('writes .tib-upgrade file when file is drifted', async () => {
+      const manifestChecksum = computeChecksumString('original content');
+      const driftedContent = 'locally modified content by user';
+      const driftedChecksum = computeChecksumString(driftedContent);
+      const newContent = 'new content from upgrade';
+      const newChecksum = computeChecksumString(newContent);
+      const filePath = 'mc-deploy.yml';
+
+      // Create file with drifted (locally modified) content
+      await mkdir(join(tmpDir), { recursive: true });
+      await writeFile(join(tmpDir, filePath), driftedContent, 'utf-8');
+
+      mockReadManifest.mockResolvedValue({
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['core'],
+        files: [
+          {
+            path: filePath,
+            module: 'core',
+            moduleVersion: '1.0.0',
+            sha256: manifestChecksum, // Original checksum in manifest
+            wasTemplate: false,
+            installedAt: '2026-01-01T00:00:00Z',
+            policy: 'tracked',
+          },
+        ],
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue({
+        scaffoldVersion: '1.0.0',
+        enabledModules: ['core'],
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        awsAccountId: '123456789012',
+        domainIds: [],
+        flowIds: [],
+        scaffoldBucket: 'mc-scaffold',
+      });
+
+      mockFetchVersionsJson.mockResolvedValue({
+        latest: '1.1.0',
+        versions: ['1.0.0', '1.1.0'],
+      });
+
+      mockFetchModulesJson.mockImplementation(async (bucket: string, version: string) => {
+        if (version === '1.0.0') {
+          return {
+            scaffoldVersion: '1.0.0',
+            releasedAt: '2026-01-01T00:00:00Z',
+            modules: [
+              {
+                id: 'core',
+                version: '1.0.0',
+                description: 'Core scaffold',
+                dependencies: [],
+                tarball: 'core-1.0.0.tar.gz',
+                sha256: 'old123',
+              },
+            ],
+            compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+          };
+        }
+        return {
+          scaffoldVersion: '1.1.0',
+          releasedAt: '2026-02-01T00:00:00Z',
+          modules: [
+            {
+              id: 'core',
+              version: '1.1.0',
+              description: 'Core scaffold',
+              dependencies: [],
+              tarball: 'core-1.1.0.tar.gz',
+              sha256: 'abc123',
+            },
+          ],
+          compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+        };
+      });
+
+      const tarballContent = createMockTarball([
+        { path: 'MANIFEST.json', content: JSON.stringify([
+          { path: filePath, sha256: newChecksum, isTemplate: false, policy: 'tracked' },
+        ]) },
+        { path: filePath, content: newContent },
+      ]);
+
+      mockFetchModuleTarball.mockResolvedValue(Buffer.from(tarballContent));
+
+      await runUpgrade('1.1.0', { dryRun: false, projectDir: tmpDir });
+
+      // Assert original file is NOT overwritten
+      const originalContent = await readFile(join(tmpDir, filePath), 'utf-8');
+      expect(originalContent).toBe(driftedContent);
+
+      // Assert .tib-upgrade file was created with new content
+      const conflictFile = await readFile(join(tmpDir, `${filePath}.tib-upgrade`), 'utf-8');
+      expect(conflictFile).toContain(newContent);
+    });
+  });
+
+  describe('dry-run mode', () => {
+    it('does not write files when --dry-run is set', async () => {
+      const oldChecksum = computeChecksumString('old content');
+      const newContent = 'new content';
+      const newChecksum = computeChecksumString(newContent);
+      const filePath = 'infra/modules/app.ts';
+
+      // Create the file with old content
+      await mkdir(join(tmpDir, 'infra', 'modules'), { recursive: true });
+      await writeFile(join(tmpDir, filePath), 'old content', 'utf-8');
+
+      mockReadManifest.mockResolvedValue({
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v1.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['core'],
+        files: [
+          {
+            path: filePath,
+            module: 'core',
+            moduleVersion: '1.0.0',
+            sha256: oldChecksum,
+            wasTemplate: false,
+            installedAt: '2026-01-01T00:00:00Z',
+            policy: 'owned',
+          },
+        ],
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue({
+        scaffoldVersion: '1.0.0',
+        enabledModules: ['core'],
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        awsAccountId: '123456789012',
+        domainIds: [],
+        flowIds: [],
+        scaffoldBucket: 'mc-scaffold',
+      });
+
+      mockFetchVersionsJson.mockResolvedValue({
+        latest: '1.1.0',
+        versions: ['1.0.0', '1.1.0'],
+      });
+
+      mockFetchModulesJson.mockImplementation(async (bucket: string, version: string) => {
+        if (version === '1.0.0') {
+          return {
+            scaffoldVersion: '1.0.0',
+            releasedAt: '2026-01-01T00:00:00Z',
+            modules: [
+              {
+                id: 'core',
+                version: '1.0.0',
+                description: 'Core scaffold',
+                dependencies: [],
+                tarball: 'core-1.0.0.tar.gz',
+                sha256: 'old123',
+              },
+            ],
+            compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+          };
+        }
+        return {
+          scaffoldVersion: '1.1.0',
+          releasedAt: '2026-02-01T00:00:00Z',
+          modules: [
+            {
+              id: 'core',
+              version: '1.1.0',
+              description: 'Core scaffold',
+              dependencies: [],
+              tarball: 'core-1.1.0.tar.gz',
+              sha256: 'abc123',
+            },
+          ],
+          compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+        };
+      });
+
+      const tarballContent = createMockTarball([
+        { path: 'MANIFEST.json', content: JSON.stringify([
+          { path: filePath, sha256: newChecksum, isTemplate: false },
+        ]) },
+        { path: filePath, content: newContent },
+      ]);
+
+      mockFetchModuleTarball.mockResolvedValue(Buffer.from(tarballContent));
+
+      await runUpgrade('1.1.0', { dryRun: true, projectDir: tmpDir });
+
+      // Assert file was NOT updated
+      const fileContent = await readFile(join(tmpDir, filePath), 'utf-8');
+      expect(fileContent).toBe('old content');
+
+      // Assert manifest was NOT written
+      expect(mockWriteManifest).not.toHaveBeenCalled();
+      expect(mockWriteScaffoldConfig).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('policy-based file handling', () => {
+    it('owned policy file always overwrites even when sha256 unchanged', async () => {
+      const content = 'content';
+      const checksum = computeChecksumString(content);
+      const filePath = 'infra/main.tf';
+
+      // Create file with exact same content as will be installed
+      await mkdir(join(tmpDir, 'infra'), { recursive: true });
+      await writeFile(join(tmpDir, filePath), content, 'utf-8');
+
+      mockReadManifest.mockResolvedValue({
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['core'],
+        files: [
+          {
+            path: filePath,
+            module: 'core',
+            moduleVersion: '1.0.0',
+            sha256: checksum,
+            wasTemplate: false,
+            installedAt: '2026-01-01T00:00:00Z',
+            policy: 'owned',
+          },
+        ],
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue({
+        scaffoldVersion: '1.0.0',
+        enabledModules: ['core'],
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        awsAccountId: '123456789012',
+        domainIds: [],
+        flowIds: [],
+        scaffoldBucket: 'mc-scaffold',
+      });
+
+      mockFetchVersionsJson.mockResolvedValue({
+        latest: '1.1.0',
+        versions: ['1.0.0', '1.1.0'],
+      });
+
+      mockFetchModulesJson.mockImplementation(async (bucket: string, version: string) => {
+        if (version === '1.0.0') {
+          return {
+            scaffoldVersion: '1.0.0',
+            releasedAt: '2026-01-01T00:00:00Z',
+            modules: [
+              {
+                id: 'core',
+                version: '1.0.0',
+                description: 'Core scaffold',
+                dependencies: [],
+                tarball: 'core-1.0.0.tar.gz',
+                sha256: 'old123',
+              },
+            ],
+            compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+          };
+        }
+        return {
+          scaffoldVersion: '1.1.0',
+          releasedAt: '2026-02-01T00:00:00Z',
+          modules: [
+            {
+              id: 'core',
+              version: '1.1.0',
+              description: 'Core scaffold',
+              dependencies: [],
+              tarball: 'core-1.1.0.tar.gz',
+              sha256: 'abc123',
+            },
+          ],
+          compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+        };
+      });
+
+      const tarballContent = createMockTarball([
+        { path: 'MANIFEST.json', content: JSON.stringify([
+          { path: filePath, sha256: checksum, isTemplate: false, policy: 'owned' },
+        ]) },
+        { path: filePath, content },
+      ]);
+
+      mockFetchModuleTarball.mockResolvedValue(Buffer.from(tarballContent));
+
+      await runUpgrade('1.1.0', { dryRun: false, projectDir: tmpDir });
+
+      // For owned policy, even with unchanged checksum, result should be 'updated'
+      expect(mockUpsertManifestFile).toHaveBeenCalled();
+      const calls = mockUpsertManifestFile.mock.calls;
+      const fileResultCall = calls.find((call) => call[1]?.path === filePath);
+      expect(fileResultCall).toBeDefined();
+    });
+
+    it('tracked policy file detects drift and writes conflict file', async () => {
+      const manifestChecksum = computeChecksumString('original content');
+      const driftedContent = 'user modified content';
+      const newContent = 'new content from upgrade';
+      const newChecksum = computeChecksumString(newContent);
+      const filePath = 'package.json';
+
+      // Create file with drifted content
+      await writeFile(join(tmpDir, filePath), driftedContent, 'utf-8');
+
+      mockReadManifest.mockResolvedValue({
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['core'],
+        files: [
+          {
+            path: filePath,
+            module: 'core',
+            moduleVersion: '1.0.0',
+            sha256: manifestChecksum,
+            wasTemplate: false,
+            installedAt: '2026-01-01T00:00:00Z',
+            policy: 'tracked',
+          },
+        ],
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue({
+        scaffoldVersion: '1.0.0',
+        enabledModules: ['core'],
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        awsAccountId: '123456789012',
+        domainIds: [],
+        flowIds: [],
+        scaffoldBucket: 'mc-scaffold',
+      });
+
+      mockFetchVersionsJson.mockResolvedValue({
+        latest: '1.1.0',
+        versions: ['1.0.0', '1.1.0'],
+      });
+
+      mockFetchModulesJson.mockImplementation(async (bucket: string, version: string) => {
+        if (version === '1.0.0') {
+          return {
+            scaffoldVersion: '1.0.0',
+            releasedAt: '2026-01-01T00:00:00Z',
+            modules: [
+              {
+                id: 'core',
+                version: '1.0.0',
+                description: 'Core scaffold',
+                dependencies: [],
+                tarball: 'core-1.0.0.tar.gz',
+                sha256: 'old123',
+              },
+            ],
+            compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+          };
+        }
+        return {
+          scaffoldVersion: '1.1.0',
+          releasedAt: '2026-02-01T00:00:00Z',
+          modules: [
+            {
+              id: 'core',
+              version: '1.1.0',
+              description: 'Core scaffold',
+              dependencies: [],
+              tarball: 'core-1.1.0.tar.gz',
+              sha256: 'abc123',
+            },
+          ],
+          compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+        };
+      });
+
+      const tarballContent = createMockTarball([
+        { path: 'MANIFEST.json', content: JSON.stringify([
+          { path: filePath, sha256: newChecksum, isTemplate: false, policy: 'tracked' },
+        ]) },
+        { path: filePath, content: newContent },
+      ]);
+
+      mockFetchModuleTarball.mockResolvedValue(Buffer.from(tarballContent));
+
+      await runUpgrade('1.1.0', { dryRun: false, projectDir: tmpDir });
+
+      // Original file should not be modified
+      const originalContent = await readFile(join(tmpDir, filePath), 'utf-8');
+      expect(originalContent).toBe(driftedContent);
+
+      // .tib-upgrade file should be created
+      const conflictFile = await readFile(join(tmpDir, `${filePath}.tib-upgrade`), 'utf-8');
+      expect(conflictFile).toContain(newContent);
+    });
+
+    it('seed policy file is skipped when already exists (not in --frontend-components mode)', async () => {
+      const existingContent = 'existing seed page';
+      const newContent = 'new seed page';
+      const filePath = 'frontend/src/pages/auth/login.tsx';
+
+      // Create existing seed file
+      await mkdir(join(tmpDir, 'frontend', 'src', 'pages', 'auth'), { recursive: true });
+      await writeFile(join(tmpDir, filePath), existingContent, 'utf-8');
+
+      mockReadManifest.mockResolvedValue({
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['core', 'frontend'],
+        files: [
+          {
+            path: filePath,
+            module: 'frontend',
+            moduleVersion: '1.0.0',
+            sha256: computeChecksumString(existingContent),
+            wasTemplate: true,
+            installedAt: '2026-01-01T00:00:00Z',
+            policy: 'seed',
+          },
+        ],
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue({
+        scaffoldVersion: '1.0.0',
+        enabledModules: ['core', 'frontend'],
+        projectName: 'test-project',
+        awsRegion: 'eu-north-1',
+        awsAccountId: '123456789012',
+        domainIds: [],
+        flowIds: [],
+        scaffoldBucket: 'mc-scaffold',
+      });
+
+      mockFetchVersionsJson.mockResolvedValue({
+        latest: '1.1.0',
+        versions: ['1.0.0', '1.1.0'],
+      });
+
+      const frontendModule = {
+        id: 'frontend',
+        version: '1.1.0',
+        description: 'Frontend scaffold',
+        dependencies: ['core'],
+        tarball: 'frontend-1.1.0.tar.gz',
+        sha256: 'def456',
+      };
+
+      mockFetchModulesJson.mockResolvedValue({
+        scaffoldVersion: '1.1.0',
+        releasedAt: '2026-02-01T00:00:00Z',
+        modules: [
+          {
+            id: 'core',
+            version: '1.1.0',
+            description: 'Core scaffold',
+            dependencies: [],
+            tarball: 'core-1.1.0.tar.gz',
+            sha256: 'abc123',
+          },
+          frontendModule,
+        ],
+        compatibility: { cliMinVersion: '0.1.0', nodeMinVersion: '20.0.0' },
+      });
+
+      const tarballContent = createMockTarball([
+        { path: 'MANIFEST.json', content: JSON.stringify([
+          { path: filePath, sha256: computeChecksumString(newContent), isTemplate: true, policy: 'seed' },
+        ]) },
+        { path: filePath, content: newContent },
+      ]);
+
+      mockFetchModuleTarball.mockResolvedValue(Buffer.from(tarballContent));
+
+      // NOT using --frontend-components, so seed file should be skipped
+      await runUpgrade('1.1.0', { dryRun: false, projectDir: tmpDir });
+
+      // Seed file should not be modified
+      const content = await readFile(join(tmpDir, filePath), 'utf-8');
+      expect(content).toBe(existingContent);
+    });
+  });
+});
+
+// Helper to create a minimal gzip-compressed tarball for testing
+function createMockTarball(files: Array<{ path: string; content: string }>): Buffer {
+  const tarEntries: Buffer[] = [];
+
+  for (const file of files) {
+    const content = Buffer.from(file.content, 'utf-8');
+    const header = Buffer.alloc(512);
+
+    // Set filename (0-100)
+    const nameBuffer = Buffer.from(file.path, 'utf-8');
+    nameBuffer.copy(header, 0);
+
+    // Set file size (124-136) in octal
+    const size = content.length;
+    const sizeOctal = size.toString(8).padStart(11, '0');
+    Buffer.from(sizeOctal).copy(header, 124);
+
+    // Set type flag for regular file (156) = 0x30
+    header[156] = 0x30;
+
+    // Set checksum (148-156) to 8 spaces initially for calculation
+    header.fill(0x20, 148, 156);
+    const checksum = header.reduce((sum, byte) => sum + byte, 0);
+    const checksumOctal = checksum.toString(8).padStart(6, '0');
+    Buffer.from(checksumOctal).copy(header, 148);
+
+    tarEntries.push(header);
+    tarEntries.push(content);
+
+    // Pad to 512 byte boundary
+    const padding = (512 - (content.length % 512)) % 512;
+    if (padding > 0) {
+      tarEntries.push(Buffer.alloc(padding));
+    }
+  }
+
+  // Add end-of-archive marker (two 512-byte zero blocks)
+  tarEntries.push(Buffer.alloc(512));
+  tarEntries.push(Buffer.alloc(512));
+
+  const tarBuffer = Buffer.concat(tarEntries);
+  // Gzip compress the tarball
+  return gzipSync(tarBuffer);
+}