@mettlecast/domain-cli 0.2.0

package/src/__tests__/doctor.test.ts

@@ -0,0 +1,291 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, writeFile, mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runDoctor } from '../commands/doctor.js';
+
+describe('runDoctor', () => {
+  let tempDir: string;
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'doctor-test-'));
+  });
+
+  afterEach(async () => {
+    try {
+      await rm(tempDir, { recursive: true, force: true });
+    } catch {
+      // Cleanup best-effort
+    }
+  });
+
+  it('returns a DoctorReport with checks and exitCode', async () => {
+    // Create minimal project structure
+    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await mkdir(join(tempDir, 'domains'), { recursive: true });
+    await mkdir(join(tempDir, '.husky'), { recursive: true });
+
+    await writeFile(
+      join(tempDir, '.tib', 'scaffold-config.json'),
+      JSON.stringify({ domainIds: [] })
+    );
+    await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh\necho "hook"');
+
+    const report = await runDoctor({ projectRoot: tempDir });
+
+    expect(report.checks).toBeDefined();
+    expect(Array.isArray(report.checks)).toBe(true);
+    expect(report.checks.length).toBeGreaterThan(0);
+    expect(report.exitCode).toBeDefined();
+    expect(typeof report.exitCode).toBe('number');
+  });
+
+  it('reports FAIL when domain config is missing', async () => {
+    await mkdir(join(tempDir, 'domains', 'test-domain'), { recursive: true });
+    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await writeFile(
+      join(tempDir, '.tib', 'scaffold-config.json'),
+      JSON.stringify({ domainIds: ['test-domain'] })
+    );
+
+    const report = await runDoctor({ projectRoot: tempDir });
+
+    const domainCheck = report.checks.find(c => c.name === 'Domain configs valid');
+    expect(domainCheck?.status).toBe('FAIL');
+  });
+
+  it('exits with code 1 when FAIL present (always strict)', async () => {
+    await mkdir(join(tempDir, 'domains', 'bad-domain'), { recursive: true });
+    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await writeFile(
+      join(tempDir, '.tib', 'scaffold-config.json'),
+      JSON.stringify({ domainIds: ['bad-domain'] })
+    );
+
+    const report = await runDoctor({ projectRoot: tempDir });
+
+    expect(report.exitCode).toBe(1);
+  });
+
+  it('reports PASS for Husky when hook exists', async () => {
+    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await mkdir(join(tempDir, '.husky'), { recursive: true });
+    await mkdir(join(tempDir, 'domains'), { recursive: true });
+    await writeFile(
+      join(tempDir, '.tib', 'scaffold-config.json'),
+      JSON.stringify({ domainIds: [] })
+    );
+    await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+
+    const report = await runDoctor({ projectRoot: tempDir });
+
+    const huskyCheck = report.checks.find(c => c.name === 'Husky hooks installed');
+    expect(huskyCheck?.status).toMatch(/PASS|WARN/);
+  });
+
+  it('includes all 15 checks in the report', async () => {
+    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await mkdir(join(tempDir, 'domains'), { recursive: true });
+    await mkdir(join(tempDir, '.husky'), { recursive: true });
+    await writeFile(
+      join(tempDir, '.tib', 'scaffold-config.json'),
+      JSON.stringify({ domainIds: [] })
+    );
+    await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+
+    const report = await runDoctor({ projectRoot: tempDir });
+
+    const expectedChecks = [
+      'Domain configs valid',
+      'No raw AWS SDK in domains',
+      'No cross-domain imports',
+      'APIs declare versions',
+      'APIs declare tenancy',
+      'scaffold-config.json matches on-disk',
+      'Husky hooks installed',
+      'No root-level flows (deprecated)',
+    ];
+
+    for (const expectedName of expectedChecks) {
+      expect(report.checks.some(c => c.name === expectedName)).toBe(true);
+    }
+  });
+
+  describe('layout validation checks', () => {
+    it('PASS when manifest has owned files in .mc/', async () => {
+      await mkdir(join(tempDir, '.tib'), { recursive: true });
+      await mkdir(join(tempDir, 'domains'), { recursive: true });
+      await mkdir(join(tempDir, '.husky'), { recursive: true });
+      await mkdir(join(tempDir, '.tib', 'infra', 'modules'), { recursive: true });
+
+      await writeFile(join(tempDir, '.tib', 'infra', 'modules', 'app.ts'), '// @mc-scaffold: backend-lambda@1.0.0\n');
+      await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+
+      const manifest = {
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['backend-lambda'],
+        files: [
+          { path: '.mc/infra/modules/app.ts', module: 'backend-lambda', moduleVersion: '1.0.0',
+            sha256: 'abc', wasTemplate: true, installedAt: '2026-01-01T00:00:00Z', policy: 'owned' as const }
+        ]
+      };
+      await writeFile(join(tempDir, '.tib', 'manifest.json'), JSON.stringify(manifest));
+
+      const report = await runDoctor({ projectRoot: tempDir });
+      const check = report.checks.find(c => c.name === 'Layout: owned files in .mc/');
+      expect(check?.status).toBe('PASS');
+    });
+
+    it('FAIL when owned file is outside .mc/ (old layout)', async () => {
+      await mkdir(join(tempDir, '.tib'), { recursive: true });
+      await mkdir(join(tempDir, 'domains'), { recursive: true });
+      await mkdir(join(tempDir, '.husky'), { recursive: true });
+      await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
+
+      await writeFile(join(tempDir, 'infra', 'modules', 'app.ts'), '// @mc-scaffold: backend-lambda@1.0.0\n');
+      await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+
+      const manifest = {
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['backend-lambda'],
+        files: [
+          { path: 'infra/modules/app.ts', module: 'backend-lambda', moduleVersion: '1.0.0',
+            sha256: 'abc', wasTemplate: true, installedAt: '2026-01-01T00:00:00Z', policy: 'owned' as const }
+        ]
+      };
+      await writeFile(join(tempDir, '.tib', 'manifest.json'), JSON.stringify(manifest));
+
+      const report = await runDoctor({ projectRoot: tempDir });
+      const check = report.checks.find(c => c.name === 'Layout: owned files in .mc/');
+      expect(check?.status).toBe('FAIL');
+    });
+
+    it('FAIL when manifest entry points at missing file', async () => {
+      await mkdir(join(tempDir, '.tib'), { recursive: true });
+      await mkdir(join(tempDir, 'domains'), { recursive: true });
+      await mkdir(join(tempDir, '.husky'), { recursive: true });
+
+      await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+
+      const manifest = {
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['backend-lambda'],
+        files: [
+          { path: '.mc/infra/missing-file.ts', module: 'backend-lambda', moduleVersion: '1.0.0',
+            sha256: 'abc', wasTemplate: false, installedAt: '2026-01-01T00:00:00Z', policy: 'owned' as const }
+        ]
+      };
+      await writeFile(join(tempDir, '.tib', 'manifest.json'), JSON.stringify(manifest));
+
+      const report = await runDoctor({ projectRoot: tempDir });
+      const check = report.checks.find(c => c.name === 'Layout: manifest entries exist on disk');
+      expect(check?.status).toBe('FAIL');
+    });
+  });
+
+  describe('--relocate flag', () => {
+    it('moves scaffold-owned files from old layout to .mc/', async () => {
+      await mkdir(join(tempDir, '.tib'), { recursive: true });
+      await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
+      await mkdir(join(tempDir, 'domains'), { recursive: true });
+      await mkdir(join(tempDir, '.husky'), { recursive: true });
+
+      const appContent = '// @mc-scaffold: backend-lambda@1.0.0\nimport * as cdk from "aws-cdk-lib";\n';
+      await writeFile(join(tempDir, 'infra', 'modules', 'app.ts'), appContent);
+      await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+
+      const { computeChecksumString } = await import('../utils/checksum.js');
+      const sha256 = computeChecksumString(appContent);
+
+      const manifest = {
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['backend-lambda'],
+        files: [
+          { path: 'infra/modules/app.ts', module: 'backend-lambda', moduleVersion: '1.0.0',
+            sha256, wasTemplate: true, installedAt: '2026-01-01T00:00:00Z', policy: 'owned' as const }
+        ]
+      };
+      await writeFile(join(tempDir, '.tib', 'manifest.json'), JSON.stringify(manifest));
+
+      const report = await runDoctor({ projectRoot: tempDir, relocate: true });
+
+      // File moved
+      const { existsSync } = await import('node:fs');
+      expect(existsSync(join(tempDir, '.tib', 'infra', 'modules', 'app.ts'))).toBe(true);
+      expect(existsSync(join(tempDir, 'infra', 'modules', 'app.ts'))).toBe(false);
+
+      // Summary pass
+      const summary = report.checks.find(c => c.name === 'Relocate: summary');
+      expect(summary?.status).toMatch(/PASS|WARN/);
+    });
+
+    it('leaves hand-edited files in place with warning on --relocate', async () => {
+      await mkdir(join(tempDir, '.tib'), { recursive: true });
+      await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
+
+      const originalContent = '// @mc-scaffold: backend-lambda@1.0.0\noriginal\n';
+      const modifiedContent = '// @mc-scaffold: backend-lambda@1.0.0\nmodified by user\n';
+      await writeFile(join(tempDir, 'infra', 'modules', 'app.ts'), modifiedContent);
+      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+
+      const { computeChecksumString } = await import('../utils/checksum.js');
+      const originalSha = computeChecksumString(originalContent); // manifest has original sha
+
+      const manifest = {
+        $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
+        scaffoldVersion: '1.0.0',
+        createdAt: '2026-01-01T00:00:00Z',
+        updatedAt: '2026-01-01T00:00:00Z',
+        projectName: 'test',
+        awsRegion: 'eu-north-1',
+        enabledModules: ['backend-lambda'],
+        files: [
+          { path: 'infra/modules/app.ts', module: 'backend-lambda', moduleVersion: '1.0.0',
+            sha256: originalSha, wasTemplate: true, installedAt: '2026-01-01T00:00:00Z', policy: 'owned' as const }
+        ]
+      };
+      await writeFile(join(tempDir, '.tib', 'manifest.json'), JSON.stringify(manifest));
+
+      await runDoctor({ projectRoot: tempDir, relocate: true });
+
+      // File left in place
+      const { existsSync } = await import('node:fs');
+      expect(existsSync(join(tempDir, 'infra', 'modules', 'app.ts'))).toBe(true);
+      expect(existsSync(join(tempDir, '.tib', 'infra', 'modules', 'app.ts'))).toBe(false);
+    });
+
+    it('FAIL when no manifest present on --relocate', async () => {
+      await mkdir(join(tempDir, '.tib'), { recursive: true });
+
+      const report = await runDoctor({ projectRoot: tempDir, relocate: true });
+
+      expect(report.exitCode).toBe(1);
+      const check = report.checks.find(c => c.name === 'Relocate: manifest present');
+      expect(check?.status).toBe('FAIL');
+    });
+  });
+});

package/src/__tests__/hydrate-local-ctx.test.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect, vi } from 'vitest';
+
+vi.mock('../runtime-stubs/load-secrets.js', () => ({
+  loadLocalSecrets: vi.fn().mockResolvedValue(Object.freeze({ MY_SECRET: 'test-value' })),
+}));
+
+vi.mock('../utils/logger.js', () => ({
+  createCliLogger: vi.fn().mockReturnValue({
+    info: vi.fn(),
+    debug: vi.fn(),
+    error: vi.fn(),
+    warn: vi.fn(),
+  }),
+}));
+
+import { hydrateLocalCtx } from '../runtime-stubs/hydrate-local-ctx.js';
+
+describe('hydrateLocalCtx', () => {
+  const DOMAIN_ROOT = '/fake/domain';
+
+  it('returns a ctx with all 14 DomainContext fields populated', async () => {
+    const { ctx } = await hydrateLocalCtx({ domainRoot: DOMAIN_ROOT });
+
+    expect(ctx.db).toBeDefined();
+    expect(ctx.publish).toBeTypeOf('function');
+    expect(ctx.actions).toBeDefined();
+    expect(ctx.integrations).toBeDefined();
+    expect(ctx.jobs).toBeDefined();
+    expect(ctx.flows).toBeDefined();
+    expect(ctx.idempotency).toBeDefined();
+    expect(ctx.cache).toBeDefined();
+    expect(ctx.secrets).toBeDefined();
+    expect(ctx.actor).toBeDefined();
+    expect(ctx.tenant).toBeDefined();
+    expect(ctx.logger).toBeDefined();
+    expect(ctx.tracer).toBeDefined();
+    expect(ctx.fetch).toBeDefined();
+  });
+
+  it('uses the provided tenantId', async () => {
+    const { ctx } = await hydrateLocalCtx({ domainRoot: DOMAIN_ROOT, tenantId: 'tenant-abc' });
+    expect(ctx.tenant.id).toBe('tenant-abc');
+  });
+
+  it('uses the provided actorSub', async () => {
+    const { ctx } = await hydrateLocalCtx({ domainRoot: DOMAIN_ROOT, actorSub: 'my-user' });
+    expect(ctx.actor.sub).toBe('my-user');
+  });
+
+  it('captures start empty', async () => {
+    const { captures } = await hydrateLocalCtx({ domainRoot: DOMAIN_ROOT });
+    expect(captures.events).toHaveLength(0);
+    expect(captures.jobs).toHaveLength(0);
+    expect(captures.executions).toHaveLength(0);
+  });
+
+  it('captures events published via ctx.publish', async () => {
+    const { ctx, captures } = await hydrateLocalCtx({ domainRoot: DOMAIN_ROOT });
+    await ctx.publish('test.event', { foo: 'bar' });
+    expect(captures.events).toHaveLength(1);
+    expect(captures.events[0]!.eventType).toBe('test.event');
+    expect(captures.events[0]!.data).toEqual({ foo: 'bar' });
+  });
+
+  it('captures jobs enqueued via ctx.jobs.enqueue', async () => {
+    const { ctx, captures } = await hydrateLocalCtx({ domainRoot: DOMAIN_ROOT });
+    await ctx.jobs.enqueue('send-email', { to: 'a@b.com' });
+    expect(captures.jobs).toHaveLength(1);
+    expect(captures.jobs[0]!.jobName).toBe('send-email');
+  });
+});

package/src/__tests__/load-domain-module-config.test.ts

@@ -0,0 +1,10 @@
+import { describe, it, expect } from 'vitest';
+import { loadDomainModuleConfig } from '../builder/load-domain-module-config.js';
+
+describe('loadDomainModuleConfig', () => {
+  it('returns default optional config when config file is absent', async () => {
+    const result = await loadDomainModuleConfig('/nonexistent-project-root');
+    expect(result.mode).toBe('optional');
+    expect(result.legacyAllowlist).toBeUndefined();
+  });
+});

package/src/__tests__/mount-routes.test.ts

@@ -0,0 +1,100 @@
+import { describe, it, expect, vi } from 'vitest';
+import type { DomainRegistry } from '@mettlecast/domain-cdk-packer';
+
+vi.mock('../runtime-stubs/hydrate-local-ctx.js', () => ({
+  hydrateLocalCtx: vi.fn().mockResolvedValue({
+    ctx: {
+      db: {}, publish: vi.fn(), actions: {}, integrations: {},
+      jobs: { enqueue: vi.fn() }, flows: { start: vi.fn() },
+      idempotency: {}, cache: {}, secrets: {}, actor: {}, tenant: {},
+      logger: { info: vi.fn(), error: vi.fn(), warn: vi.fn(), debug: vi.fn() },
+      tracer: {}, fetch: vi.fn(),
+    },
+    captures: { events: [], jobs: [], executions: [] },
+  }),
+}));
+
+import { mountRoutes } from '../server/mount-routes.js';
+
+function makeRegistry(apis: Array<Partial<DomainRegistry['apis'][0]>>): DomainRegistry {
+  return {
+    schemaVersion: '1',
+    domainRoot: '/fake/domain',
+    domain: { id: 'test', kind: 'domain', name: 'Test', tenancy: 'none' },
+    apis: apis.map((a, i) => ({
+      id: `api-${i}`,
+      kind: 'api' as const,
+      handlerFile: `api/handler-${i}.ts`,
+      path: `/route-${i}`,
+      method: 'GET',
+      authType: 'none' as const,
+      ...a,
+    })),
+    webhooks: [],
+    subscribers: [],
+    schedules: [],
+    jobs: [],
+    actions: [],
+    integrations: [],
+    events: [],
+  };
+}
+
+describe('mountRoutes', () => {
+  it('registers one route per api entry', async () => {
+    const routes: Array<{ method: unknown; url: string }> = [];
+    const server = {
+      route: vi.fn((opts: { method: unknown; url: string }) => { routes.push(opts); }),
+      log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+    };
+
+    vi.doMock('/fake/domain/api/handler-0.ts', () => ({
+      myApi: { id: 'api-0', _kind: 'api', handler: vi.fn().mockResolvedValue({ ok: true }) },
+    }));
+
+    const registry = makeRegistry([{ id: 'api-0', handlerFile: 'api/handler-0.ts', path: '/route-0', method: 'GET' }]);
+
+    await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
+
+    expect(server.route).toHaveBeenCalledTimes(1);
+    expect(routes[0]!.url).toBe('/route-0');
+  });
+
+  it('converts {param} path syntax to :param for Fastify', async () => {
+    const routes: Array<{ url: string }> = [];
+    const server = {
+      route: vi.fn((opts: { url: string }) => { routes.push(opts); }),
+      log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+    };
+
+    vi.doMock('/fake/domain/api/handler-1.ts', () => ({
+      myApi: { id: 'api-1', _kind: 'api', handler: vi.fn() },
+    }));
+
+    const registry = makeRegistry([{
+      id: 'api-1', handlerFile: 'api/handler-1.ts', path: '/users/{id}/orders', method: 'GET',
+    }]);
+
+    await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
+
+    expect(routes[0]!.url).toBe('/users/:id/orders');
+  });
+
+  it('skips entries where handler function is not found', async () => {
+    const server = {
+      route: vi.fn(),
+      log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+    };
+
+    vi.doMock('/fake/domain/api/handler-2.ts', () => ({
+      noHandler: { id: 'api-2', _kind: 'api' },
+    }));
+
+    const registry = makeRegistry([{ id: 'api-2', handlerFile: 'api/handler-2.ts', path: '/skip', method: 'GET' }]);
+
+    await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
+
+    expect(server.route).not.toHaveBeenCalled();
+    expect(server.log.warn).toHaveBeenCalled();
+  });
+});

package/src/__tests__/scaffold-src/part-a-layout.test.ts

@@ -0,0 +1,46 @@
+import { describe, it, expect } from 'vitest';
+import { existsSync, readFileSync } from 'fs';
+import { join, resolve, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const repoRoot = resolve(__dirname, '../../../../..');
+const backendLambdaDir = join(repoRoot, 'scaffold-src', 'modules', 'backend-lambda');
+const coreDir = join(repoRoot, 'scaffold-src', 'modules', 'core');
+
+describe('scaffold-src layout (Part A)', () => {
+  it('backend-lambda has app.ts.tpl under .mc/infra/modules/', () => {
+    expect(existsSync(join(backendLambdaDir, '.mc/infra/modules/app.ts.tpl'))).toBe(true);
+  });
+
+  it('backend-lambda infra/ directory is removed', () => {
+    expect(existsSync(join(backendLambdaDir, 'infra'))).toBe(false);
+  });
+
+  it('backend-lambda has root cdk.json.tpl seed', () => {
+    expect(existsSync(join(backendLambdaDir, 'cdk.json.tpl'))).toBe(true);
+    const content = readFileSync(join(backendLambdaDir, 'cdk.json.tpl'), 'utf-8');
+    const parsed = JSON.parse(content);
+    expect(parsed.app).toContain('.mc/infra/modules/app.ts');
+  });
+
+  it('core has .mc/workflows/ci.yml.tpl', () => {
+    expect(existsSync(join(coreDir, '.mc/workflows/ci.yml.tpl'))).toBe(true);
+  });
+
+  it('core has .github/workflows/ci.yml seed stub', () => {
+    expect(existsSync(join(coreDir, '.github/workflows/ci.yml'))).toBe(true);
+    const content = readFileSync(join(coreDir, '.github/workflows/ci.yml'), 'utf-8');
+    expect(content).toContain('tib-ci.yml');
+  });
+
+  it('backend-lambda tarball-manifest.json maps .mc/deploy.yml.tpl to .github/workflows/mc-deploy.yml', () => {
+    const tmPath = join(backendLambdaDir, 'tarball-manifest.json');
+    expect(existsSync(tmPath)).toBe(true);
+    const tm = JSON.parse(readFileSync(tmPath, 'utf-8'));
+    const deployOverride = tm.fileOverrides.find((e: { path: string }) => e.path === '.mc/deploy.yml.tpl');
+    expect(deployOverride?.installedAs).toBe('.github/workflows/mc-deploy.yml');
+    expect(deployOverride?.policy).toBe('owned');
+  });
+});

package/src/__tests__/scripts/package-scaffold.test.ts

@@ -0,0 +1,45 @@
+import { describe, it, expect } from 'vitest';
+
+describe('package-scaffold policy inference', () => {
+  function inferPolicyFromPath(filePath: string): string {
+    if (/^infra\//.test(filePath) || /^\.tib\/infra\//.test(filePath) ||
+        filePath === 'mc-deploy.yml' || /^\.github\/workflows\//.test(filePath)) {
+      return 'owned';
+    }
+    const seedPatterns = [
+      /^frontend\/src\/pages\/auth\//,
+      /^frontend\/src\/pages\/account\//,
+      /^frontend\/src\/pages\/shell\//,
+      /^frontend\/src\/pages\/_errors\//,
+      /^frontend\/src\/layouts\//,
+      /^frontend\/src\/styles\/brand\.css$/,
+    ];
+    if (seedPatterns.some(p => p.test(filePath))) return 'seed';
+    return 'tracked';
+  }
+
+  it('returns owned for .mc/infra/ paths', () => {
+    expect(inferPolicyFromPath('.mc/infra/modules/app.ts')).toBe('owned');
+    expect(inferPolicyFromPath('.mc/infra/cdk.json')).toBe('owned');
+    expect(inferPolicyFromPath('.mc/infra/tsconfig.json')).toBe('owned');
+  });
+
+  it('returns owned for .github/workflows/ paths', () => {
+    expect(inferPolicyFromPath('.github/workflows/tib-ci.yml')).toBe('owned');
+    expect(inferPolicyFromPath('.github/workflows/mc-deploy.yml')).toBe('owned');
+  });
+
+  it('returns seed for frontend page paths', () => {
+    expect(inferPolicyFromPath('frontend/src/pages/auth/login.tsx')).toBe('seed');
+    expect(inferPolicyFromPath('frontend/src/styles/brand.css')).toBe('seed');
+  });
+
+  it('returns tracked for domain files', () => {
+    expect(inferPolicyFromPath('domains/payments/api/charge.ts')).toBe('tracked');
+    expect(inferPolicyFromPath('packages/domain-cli/src/utils/manifest.ts')).toBe('tracked');
+  });
+
+  it('returns owned for mc-deploy.yml', () => {
+    expect(inferPolicyFromPath('mc-deploy.yml')).toBe('owned');
+  });
+});

package/src/__tests__/utils/checksum.test.ts

@@ -0,0 +1,90 @@
+import { describe, it, expect } from 'vitest';
+import { writeFile, unlink } from 'fs/promises';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { computeChecksumBuffer, computeChecksumString, computeChecksumFile, isDrifted } from '../../utils/checksum.js';
+
+describe('computeChecksumBuffer', () => {
+  it('returns lowercase hex sha256', () => {
+    const buf = Buffer.from('hello world', 'utf-8');
+    const result = computeChecksumBuffer(buf);
+    expect(result).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it('is deterministic for same input', () => {
+    const buf = Buffer.from('test content', 'utf-8');
+    expect(computeChecksumBuffer(buf)).toBe(computeChecksumBuffer(buf));
+  });
+
+  it('differs for different input', () => {
+    const a = computeChecksumBuffer(Buffer.from('aaa'));
+    const b = computeChecksumBuffer(Buffer.from('bbb'));
+    expect(a).not.toBe(b);
+  });
+
+  it('matches known SHA-256 value', () => {
+    // echo -n "hello" | sha256sum = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
+    const buf = Buffer.from('hello', 'utf-8');
+    expect(computeChecksumBuffer(buf)).toBe('2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824');
+  });
+});
+
+describe('computeChecksumString', () => {
+  it('returns same result as buffer version for UTF-8 string', () => {
+    const content = 'test string content';
+    const fromStr = computeChecksumString(content);
+    const fromBuf = computeChecksumBuffer(Buffer.from(content, 'utf-8'));
+    expect(fromStr).toBe(fromBuf);
+  });
+});
+
+describe('computeChecksumFile', () => {
+  it('returns correct checksum for a file', async () => {
+    const tmpFile = join(tmpdir(), `checksum-test-${Date.now()}.txt`);
+    const content = 'file content for checksum';
+    await writeFile(tmpFile, content, 'utf-8');
+    try {
+      const result = await computeChecksumFile(tmpFile);
+      const expected = computeChecksumString(content);
+      expect(result).toBe(expected);
+    } finally {
+      await unlink(tmpFile).catch(() => undefined);
+    }
+  });
+
+  it('returns null for non-existent file', async () => {
+    const result = await computeChecksumFile('/non/existent/path/file.txt');
+    expect(result).toBeNull();
+  });
+});
+
+describe('isDrifted', () => {
+  it('returns false when file matches expected checksum', async () => {
+    const tmpFile = join(tmpdir(), `drift-test-${Date.now()}.txt`);
+    const content = 'unchanged content';
+    await writeFile(tmpFile, content, 'utf-8');
+    const expected = computeChecksumString(content);
+    try {
+      const result = await isDrifted(tmpFile, expected);
+      expect(result).toBe(false);
+    } finally {
+      await unlink(tmpFile).catch(() => undefined);
+    }
+  });
+
+  it('returns true when file has been modified', async () => {
+    const tmpFile = join(tmpdir(), `drift-test-${Date.now()}.txt`);
+    await writeFile(tmpFile, 'modified content', 'utf-8');
+    try {
+      const result = await isDrifted(tmpFile, 'deadbeef'.repeat(8));
+      expect(result).toBe(true);
+    } finally {
+      await unlink(tmpFile).catch(() => undefined);
+    }
+  });
+
+  it('returns null when file does not exist', async () => {
+    const result = await isDrifted('/non/existent/file.txt', 'abc123');
+    expect(result).toBeNull();
+  });
+});