@mettlecast/domain-cli 0.2.52 → 0.2.53

package/dist/builder/build-registry.js

@@ -39,6 +39,9 @@ export async function buildRegistry(domainRoot) {
     function deployment(raw) {
         return raw['deployment'];
     }
+    function outboundAccess(raw) {
+        return raw['outboundAccess'] === 'internet' ? 'internet' : 'internal';
+    }
     const domainExports = await load(paths.domain);
     const domainRaw = domainExports.find(e => e['_kind'] === 'domain');
     if (!domainRaw) {
@@ -90,6 +93,7 @@ export async function buildRegistry(domainRoot) {
             authType: e['auth']?.type ?? 'jwt',
             description: typeof e['description'] === 'string' ? e['description'] : undefined,
             deployment: deployment(e),
+            outboundAccess: outboundAccess(e),
             requestSchema: latestVersion?.requestSchema,
             responseSchema: latestVersion?.responseSchema,
             versions: versionSnapshots.length > 0 ? versionSnapshots : undefined,
@@ -107,6 +111,7 @@ export async function buildRegistry(domainRoot) {
         hmacAlgorithm: e['verification']?.type,
         hmacSecretRef: e['verification']?.secretRef,
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
     })));
     const subscribers = paths.subscribers.flatMap((filePath, i) => (subscriberExports[i] ?? [])
         .filter(e => e['_kind'] === 'subscriber')
@@ -118,6 +123,7 @@ export async function buildRegistry(domainRoot) {
         semverRange: String(e['semverRange']),
         concurrency: e['concurrency'],
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
     })));
     const schedules = paths.schedules.flatMap((filePath, i) => (scheduleExports[i] ?? [])
         .filter(e => e['_kind'] === 'schedule')
@@ -128,6 +134,7 @@ export async function buildRegistry(domainRoot) {
         cron: String(e['cron']),
         enabled: Boolean(e['enabled'] ?? true),
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
     })));
     const jobs = paths.jobs.flatMap((filePath, i) => (jobExports[i] ?? [])
         .filter(e => e['_kind'] === 'job')
@@ -138,6 +145,7 @@ export async function buildRegistry(domainRoot) {
         maxRetries: Number(e['maxRetries'] ?? 3),
         visibilityTimeoutSeconds: Number(e['visibilityTimeoutSeconds'] ?? 30),
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
     })));
     const actions = paths.actions.flatMap((filePath, i) => (actionExports[i] ?? [])
         .filter(e => e['_kind'] === 'action')
@@ -149,6 +157,7 @@ export async function buildRegistry(domainRoot) {
         idempotent: Boolean(e['idempotent'] ?? false),
         description: typeof e['description'] === 'string' ? e['description'] : undefined,
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
         inputSchema: isJsonSchema(e['input']) ? e['input'] : undefined,
         outputSchema: isJsonSchema(e['output']) ? e['output'] : undefined,
     })));

package/dist/templates/api-skeleton.js

@@ -42,6 +42,7 @@ export const ${camelCase(apiId)} = defineApi({
   path: '${tenantPath}/${domainId}/${apiId}',
   method: 'POST',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/dist/templates/patterns/api/create-with-event.js

@@ -37,6 +37,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '${tenantPath}/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/dist/templates/patterns/api/idempotent-mutation.js

@@ -42,6 +42,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '${tenantPath}/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/dist/templates/patterns/api/paginated-list.js

@@ -41,6 +41,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '${tenantPath}/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/dist/templates/patterns/api/simple-crud.js

@@ -43,6 +43,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '${tenantPath}/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',
@@ -92,6 +93,7 @@ export const ${varName}List = defineApi({
   id: '${id}-list',
   path: '${tenantPath}/${domain}/${id}-list',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/dist/templates/patterns/api/streaming-list.js

@@ -44,6 +44,7 @@ export const ${apiId.replace(/-/g, '_')} = defineApi({
   path: '/v1/${domain}/${apiId}',
   method: 'GET',
   tenancy: 'required',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/dist/templates/patterns/api/system-admin.js

@@ -44,6 +44,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '/system/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',
@@ -81,6 +82,7 @@ export const ${varName}Health = defineApi({
   id: '${id}-health',
   path: '/system/${domain}/${id}-health',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/dist/templates/patterns/api/webhook-receiver-style.js

@@ -53,6 +53,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '/webhooks/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/dist/templates/patterns/subscriber/audit-relay.js

@@ -19,6 +19,7 @@ export const ${varName} = defineSubscriber({
   id: '${domain}.${id}',
   event: '${event}',
   semverRange: '^1',
+  outboundAccess: 'internet',
   handler: async (event, ctx) => {
     const ev = event as { id?: string; type?: string; version?: number; data?: unknown; timestamp?: string };
     const eventId = ev.id ?? crypto.randomUUID();
@@ -35,6 +36,20 @@ export const ${varName} = defineSubscriber({
       },
       { ttl: Math.floor(Date.now() / 1000) + 90 * 86400 }, // 90-day retention
     );
+
+    if (process.env.AUDIT_RELAY_URL) {
+      await ctx.fetch.fetch(process.env.AUDIT_RELAY_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          eventId,
+          eventType: ev.type,
+          eventVersion: ev.version,
+          payload: ev.data,
+          timestamp: ev.timestamp ?? new Date().toISOString(),
+        }),
+      });
+    }
   },
 });
 `;

package/dist/templates/patterns/subscriber/cascade-deletion.js

@@ -21,6 +21,7 @@ export const ${varName} = defineSubscriber({
   id: '${domain}.${id}',
   event: '${event}',
   semverRange: '^1',
+  outboundAccess: 'internal',
   handler: async (event, ctx) => {
     const data = (event as { data: { entityId: string; deletedBy?: string } }).data;
 

package/dist/templates/patterns/subscriber/single-step-projection.js

@@ -16,6 +16,7 @@ export const ${varName} = defineSubscriber({
   id: '${domain}.${id}',
   event: '${event}',
   semverRange: '^1',
+  outboundAccess: 'internal',
   handler: async (event, ctx) => {
     const { tenantId: _tenantId, ...eventData } = (event as { data: Record<string, unknown> }).data;
     const eventId = (event as { id?: string }).id ?? 'unknown';

package/dist/templates/subscriber-skeleton.js

@@ -15,6 +15,7 @@ export const ${subscriberId.replace(/-([a-z])/g, (_, c) => c.toUpperCase())} = d
   id: '${domainId}.${subscriberId}',
   event: '${eventId}',
   semverRange: '*',
+  outboundAccess: 'internal',
   handler: async (_event, _ctx) => {
     // receive _event.data (typed payload) and use _ctx.store, _ctx.publish, _ctx.audit
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cli",
-  "version": "0.2.52",
+  "version": "0.2.53",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/__tests__/build-registry.test.ts

@@ -72,7 +72,7 @@ describe('buildRegistry', () => {
         { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
       ])
       .mockResolvedValueOnce([
-        { _kind: 'api', _exportName: 'getInvoice', id: 'get-invoice', path: '/invoices/:id', auth: { type: 'jwt' } },
+        { _kind: 'api', _exportName: 'getInvoice', id: 'get-invoice', path: '/invoices/:id', method: 'GET', auth: { type: 'jwt' } },
       ]);
 
     const { registry, warnings } = await buildRegistry(DOMAIN_ROOT);
@@ -84,7 +84,34 @@ describe('buildRegistry', () => {
     expect(registry.apis[0]!.id).toBe('get-invoice');
     expect(registry.apis[0]!.path).toBe('/invoices/:id');
     expect(registry.apis[0]!.authType).toBe('jwt');
-    expect(registry.apis[0]!.handlerFile).toBe('api/get-invoice.ts');
+    expect(registry.apis[0]!.handlerFile.replaceAll('\\', '/')).toBe('api/get-invoice.ts');
+    expect(registry.apis[0]!.outboundAccess).toBe('internal');
+  });
+
+  it('preserves explicit outboundAccess on primitives', async () => {
+    mockWalkDomainDir.mockResolvedValue({
+      domain: '/fake/domains/billing/domain.config.ts',
+      apis: ['/fake/domains/billing/api/sync-invoice.ts'],
+      webhooks: [],
+      subscribers: [],
+      actions: [],
+      schedules: [],
+      jobs: [],
+      integrations: [],
+      publishes: undefined,
+    });
+
+    mockLoadModuleExports
+      .mockResolvedValueOnce([
+        { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
+      ])
+      .mockResolvedValueOnce([
+        { _kind: 'api', _exportName: 'syncInvoice', id: 'sync-invoice', path: '/invoices/sync', method: 'POST', auth: { type: 'jwt' }, outboundAccess: 'internet' },
+      ]);
+
+    const { registry } = await buildRegistry(DOMAIN_ROOT);
+
+    expect(registry.apis[0]!.outboundAccess).toBe('internet');
   });
 
   it('collects warnings when a file fails to load', async () => {

package/src/__tests__/smoke/scaffold.test.ts

@@ -517,6 +517,11 @@ describe('scaffold smoke test (issue #3831)', () => {
     }
   });
 
+  it('api-skeleton template emits explicit outboundAccess default', async () => {
+    const out = apiSkeletonTemplateForTest('payments', 'charge-card', 'required');
+    expect(out).toContain("outboundAccess: 'internal'");
+  });
+
   // ── npm install / build / test (gated on npm availability) ───────────
   // These three steps are the heart of the smoke test. On environments
   // without npm (e.g. some sandboxes) they're recorded as soft skips so

package/src/__tests__/template-outbound-access.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest';
+import { apiSkeletonTemplate } from '../templates/api-skeleton.js';
+import { subscriberSkeletonTemplate } from '../templates/subscriber-skeleton.js';
+import { auditRelayTemplate } from '../templates/patterns/subscriber/audit-relay.js';
+
+describe('domain-cli templates emit outboundAccess', () => {
+  it('adds explicit internal outbound access to API skeletons', () => {
+    const output = apiSkeletonTemplate('payments', 'charge-card', 'required');
+
+    expect(output).toContain("outboundAccess: 'internal'");
+  });
+
+  it('adds explicit internal outbound access to subscriber skeletons', () => {
+    const output = subscriberSkeletonTemplate('payments', 'on-charge-created', 'payments.charge.created');
+
+    expect(output).toContain("outboundAccess: 'internal'");
+  });
+
+  it('documents internet egress in the audit relay pattern', () => {
+    const output = auditRelayTemplate('payments', 'relay-audit', 'payments.charge.created');
+
+    expect(output).toContain("outboundAccess: 'internet'");
+    expect(output).toContain('AUDIT_RELAY_URL');
+    expect(output).toContain('ctx.fetch.fetch');
+  });
+});

package/src/builder/build-registry.ts

@@ -71,6 +71,10 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
     return raw['deployment'] as SerialDeploymentConfig | undefined;
   }
 
+  function outboundAccess(raw: RawPrimitiveExport): 'internal' | 'internet' {
+    return raw['outboundAccess'] === 'internet' ? 'internet' : 'internal';
+  }
+
   const domainExports = await load(paths.domain);
   const domainRaw = domainExports.find(e => e['_kind'] === 'domain');
   if (!domainRaw) {
@@ -127,6 +131,7 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
           authType: ((e['auth'] as { type?: string } | undefined)?.type as 'jwt' | 'api-key' | 'none' | undefined) ?? 'jwt',
           description: typeof e['description'] === 'string' ? e['description'] : undefined,
           deployment: deployment(e),
+          outboundAccess: outboundAccess(e),
           requestSchema: latestVersion?.requestSchema,
           responseSchema: latestVersion?.responseSchema,
           versions: versionSnapshots.length > 0 ? versionSnapshots : undefined,
@@ -147,6 +152,7 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
         hmacAlgorithm: (e['verification'] as { type?: string } | undefined)?.type,
         hmacSecretRef: (e['verification'] as { secretRef?: string } | undefined)?.secretRef,
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
       }))
   );
 
@@ -161,6 +167,7 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
         semverRange: String(e['semverRange']),
         concurrency: e['concurrency'] as number | undefined,
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
       }))
   );
 
@@ -174,6 +181,7 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
         cron: String(e['cron']),
         enabled: Boolean(e['enabled'] ?? true),
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
       }))
   );
 
@@ -187,6 +195,7 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
         maxRetries: Number(e['maxRetries'] ?? 3),
         visibilityTimeoutSeconds: Number(e['visibilityTimeoutSeconds'] ?? 30),
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
       }))
   );
 
@@ -201,6 +210,7 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
         idempotent: Boolean(e['idempotent'] ?? false),
         description: typeof e['description'] === 'string' ? e['description'] : undefined,
         deployment: deployment(e),
+        outboundAccess: outboundAccess(e),
         inputSchema: isJsonSchema(e['input']) ? (e['input'] as SchemaSnapshot) : undefined,
         outputSchema: isJsonSchema(e['output']) ? (e['output'] as SchemaSnapshot) : undefined,
       }))

package/src/templates/api-skeleton.ts

@@ -44,6 +44,7 @@ export const ${camelCase(apiId)} = defineApi({
   path: '${tenantPath}/${domainId}/${apiId}',
   method: 'POST',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/src/templates/patterns/api/create-with-event.ts

@@ -40,6 +40,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '${tenantPath}/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/src/templates/patterns/api/idempotent-mutation.ts

@@ -45,6 +45,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '${tenantPath}/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/src/templates/patterns/api/paginated-list.ts

@@ -44,6 +44,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '${tenantPath}/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/src/templates/patterns/api/simple-crud.ts

@@ -46,6 +46,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '${tenantPath}/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',
@@ -97,6 +98,7 @@ export const ${varName}List = defineApi({
   id: '${id}-list',
   path: '${tenantPath}/${domain}/${id}-list',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/src/templates/patterns/api/streaming-list.ts

@@ -44,6 +44,7 @@ export const ${apiId.replace(/-/g, '_')} = defineApi({
   path: '/v1/${domain}/${apiId}',
   method: 'GET',
   tenancy: 'required',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/src/templates/patterns/api/system-admin.ts

@@ -47,6 +47,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '/system/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',
@@ -84,6 +85,7 @@ export const ${varName}Health = defineApi({
   id: '${id}-health',
   path: '/system/${domain}/${id}-health',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/src/templates/patterns/api/webhook-receiver-style.ts

@@ -56,6 +56,7 @@ export const ${varName} = defineApi({
   id: '${id}',
   path: '/webhooks/${domain}/${id}',
   tenancy: '${tenancy}',
+  outboundAccess: 'internal',
   versions: {
     v1: {
       status: 'stable',

package/src/templates/patterns/subscriber/audit-relay.ts

@@ -22,6 +22,7 @@ export const ${varName} = defineSubscriber({
   id: '${domain}.${id}',
   event: '${event}',
   semverRange: '^1',
+  outboundAccess: 'internet',
   handler: async (event, ctx) => {
     const ev = event as { id?: string; type?: string; version?: number; data?: unknown; timestamp?: string };
     const eventId = ev.id ?? crypto.randomUUID();
@@ -38,6 +39,20 @@ export const ${varName} = defineSubscriber({
       },
       { ttl: Math.floor(Date.now() / 1000) + 90 * 86400 }, // 90-day retention
     );
+
+    if (process.env.AUDIT_RELAY_URL) {
+      await ctx.fetch.fetch(process.env.AUDIT_RELAY_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          eventId,
+          eventType: ev.type,
+          eventVersion: ev.version,
+          payload: ev.data,
+          timestamp: ev.timestamp ?? new Date().toISOString(),
+        }),
+      });
+    }
   },
 });
 `;

package/src/templates/patterns/subscriber/cascade-deletion.ts

@@ -24,6 +24,7 @@ export const ${varName} = defineSubscriber({
   id: '${domain}.${id}',
   event: '${event}',
   semverRange: '^1',
+  outboundAccess: 'internal',
   handler: async (event, ctx) => {
     const data = (event as { data: { entityId: string; deletedBy?: string } }).data;
 

package/src/templates/patterns/subscriber/single-step-projection.ts

@@ -19,6 +19,7 @@ export const ${varName} = defineSubscriber({
   id: '${domain}.${id}',
   event: '${event}',
   semverRange: '^1',
+  outboundAccess: 'internal',
   handler: async (event, ctx) => {
     const { tenantId: _tenantId, ...eventData } = (event as { data: Record<string, unknown> }).data;
     const eventId = (event as { id?: string }).id ?? 'unknown';

package/src/templates/subscriber-skeleton.ts

@@ -20,6 +20,7 @@ export const ${subscriberId.replace(/-([a-z])/g, (_, c) => c.toUpperCase())} = d
   id: '${domainId}.${subscriberId}',
   event: '${eventId}',
   semverRange: '*',
+  outboundAccess: 'internal',
   handler: async (_event, _ctx) => {
     // receive _event.data (typed payload) and use _ctx.store, _ctx.publish, _ctx.audit
   },