@mettlecast/domain-cli 0.2.58 → 0.2.60

package/src/builder/build-registry.ts

@@ -17,6 +17,105 @@ import type {
 import { walkDomainDir } from '../utils/file-helpers.js';
 import { loadModuleExports, type RawPrimitiveExport } from './load-module.js';
 
+type ActionBackendAccess = 'private' | 'domain' | 'platform';
+
+type ActionExposure =
+  | { type: 'internal' }
+  | {
+    type: 'api';
+    path: string;
+    method: string;
+    auth: 'required' | 'none' | 'service';
+    tenancy: 'required' | 'none' | 'system';
+    roles?: string[];
+    securityException?: { reason: string };
+    authDeclared?: boolean;
+    tenancyDeclared?: boolean;
+  };
+
+/**
+ * Coerce a raw value into a valid backendAccess scope, defaulting to
+ * 'private' when the value is missing or unrecognized. Used by the
+ * builder when reading the new-style `backendAccess` field directly.
+ */
+function toBackendAccess(raw: unknown): ActionBackendAccess {
+  return raw === 'domain' || raw === 'platform' ? raw : 'private';
+}
+
+/**
+ * Map a legacy `visibility` scope to a `backendAccess` scope for the
+ * action-first migration. The legacy `workspace` scope (which previously
+ * permitted unauthenticated Function URL exposure) collapses to `domain`
+ * so that all cross-domain callers must go through `ctx.actions`.
+ */
+function visibilityToBackendAccess(visibility: unknown): ActionBackendAccess {
+  if (visibility === 'workspace') return 'domain';
+  if (visibility === 'domain') return 'domain';
+  return 'private';
+}
+
+/**
+ * Best-effort reverse mapping from `backendAccess` to the legacy
+ * `visibility` field. Used to keep the deprecated field populated so
+ * existing CDK constructs that read it continue to behave the same way.
+ *
+ * - private  -> private
+ * - domain   -> domain
+ * - platform -> workspace (closest legacy equivalent for platform-level)
+ */
+function backendAccessToVisibility(backendAccess: ActionBackendAccess): 'private' | 'domain' | 'workspace' {
+  if (backendAccess === 'platform') return 'workspace';
+  return backendAccess;
+}
+
+/**
+ * Type guard + sanitizer for an action's `exposure` field. Returns a
+ * well-typed `ActionExposure` (extended with `authDeclared` /
+ * `tenancyDeclared` tracking flags) or the provided fallback when the
+ * raw value does not match a supported exposure shape.
+ *
+ * The `authDeclared` / `tenancyDeclared` flags record whether the source
+ * code explicitly declared each field, or whether the builder fell back
+ * to the safe default. They are validation-only and consumed by the
+ * domain CLI's validate command (Wave 6 Task 6.1) to enforce the
+ * action-first security model (#4619).
+ */
+function toExposure(raw: unknown, fallback: ActionExposure): ActionExposure {
+  if (!raw || typeof raw !== 'object') return fallback;
+  const candidate = raw as { type?: unknown };
+  if (candidate.type === 'internal') return { type: 'internal' };
+  if (candidate.type !== 'api') return fallback;
+  // Best-effort validation of api exposure fields; any missing required
+  // string field falls back to the supplied default exposure.
+  const api = raw as { path?: unknown; method?: unknown; auth?: unknown; tenancy?: unknown; roles?: unknown; securityException?: unknown };
+  if (typeof api.path !== 'string' || typeof api.method !== 'string') return fallback;
+  const authRaw = api.auth;
+  const tenancyRaw = api.tenancy;
+  const auth: 'required' | 'none' | 'service' =
+    authRaw === 'required' || authRaw === 'none' || authRaw === 'service' ? authRaw : 'required';
+  const tenancy: 'required' | 'none' | 'system' =
+    tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system' ? tenancyRaw : 'required';
+  const out: ActionExposure & { type: 'api'; authDeclared?: boolean; tenancyDeclared?: boolean } = {
+    type: 'api',
+    path: api.path,
+    method: api.method,
+    auth,
+    tenancy,
+    authDeclared: authRaw === 'required' || authRaw === 'none' || authRaw === 'service',
+    tenancyDeclared: tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system',
+  };
+  if (Array.isArray(api.roles)) {
+    out.roles = api.roles.filter((r): r is string => typeof r === 'string');
+  }
+  if (api.securityException && typeof api.securityException === 'object') {
+    const reason = (api.securityException as { reason?: unknown }).reason;
+    if (typeof reason === 'string') {
+      out.securityException = { reason };
+    }
+  }
+  return out;
+}
+
 /** Returns true if a value looks like a JSON Schema object (has a 'type' or '$schema' property). */
 function isJsonSchema(v: unknown): boolean {
   return v !== null && typeof v === 'object' && !Array.isArray(v) &&
@@ -79,7 +178,7 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
   const domainRaw = domainExports.find(e => e['_kind'] === 'domain');
   if (!domainRaw) {
     // Emit any suppressed tsx load errors to stderr before throwing so they appear in CI logs.
-    for (const w of warnings) process.stderr.write(`[tib validate] ${w}\n`);
+    for (const w of warnings) process.stderr.write(`[mc-domain-module validate] ${w}\n`);
     throw new Error(`buildRegistry: no 'domain' export found in ${paths.domain}`);
   }
 
@@ -199,22 +298,55 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
       }))
   );
 
-  const actions: ActionRegistryEntry[] = paths.actions.flatMap((filePath, i) =>
+  const actions = paths.actions.flatMap((filePath, i) =>
     (actionExports[i] ?? [])
       .filter(e => e['_kind'] === 'action')
-      .map(e => ({
-        id: String(e['id']),
-        kind: 'action' as const,
-        handlerFile: relPath(filePath),
-        visibility: String(e['visibility']) as 'private' | 'domain' | 'workspace',
-        idempotent: Boolean(e['idempotent'] ?? false),
-        description: typeof e['description'] === 'string' ? e['description'] : undefined,
-        deployment: deployment(e),
-        outboundAccess: outboundAccess(e),
-        inputSchema: isJsonSchema(e['input']) ? (e['input'] as SchemaSnapshot) : undefined,
-        outputSchema: isJsonSchema(e['output']) ? (e['output'] as SchemaSnapshot) : undefined,
-      }))
-  );
+      .map(e => {
+        // Resolve backendAccess. New-style actions carry `backendAccess`
+        // directly. Legacy actions only carry `visibility`; in that case
+        // we collapse workspace -> domain per the migration spec, and we
+        // also remember the legacy flag so we can default exposure to
+        // `{ type: 'internal' }` for actions that have not opted in yet.
+        const hasBackendAccess = 'backendAccess' in e;
+        const rawBackendAccess = e['backendAccess'];
+        const rawVisibility = e['visibility'];
+        const backendAccess: ActionBackendAccess = hasBackendAccess
+          ? toBackendAccess(rawBackendAccess)
+          : visibilityToBackendAccess(rawVisibility);
+        const legacyVisibility = backendAccessToVisibility(backendAccess);
+
+        // Resolve exposure. New-style actions must declare their exposure;
+        // legacy actions that did not opt in default to `{ type: 'internal' }`
+        // so existing internal-only behavior is preserved during migration.
+        const rawExposure = e['exposure'];
+        const exposure: ActionExposure = toExposure(rawExposure, { type: 'internal' });
+        // Record whether the source explicitly declared the `exposure` field.
+        // Validation-only; consumed by the domain CLI's validate command
+        // (Wave 6 Task 6.1) to enforce `ACTION_EXPOSURE_REQUIRED`.
+        const exposureDeclared = rawExposure !== undefined && rawExposure !== null
+          && typeof rawExposure === 'object';
+
+        return {
+          id: String(e['id']),
+          kind: 'action' as const,
+          handlerFile: relPath(filePath),
+          backendAccess,
+          exposure,
+          exposureDeclared,
+          // Keep the legacy field populated so CDK constructs that still
+          // read `visibility` (e.g. action-construct.ts) keep working
+          // through the migration window. New constructs should read
+          // `backendAccess` and `exposure` instead.
+          visibility: legacyVisibility,
+          idempotent: Boolean(e['idempotent'] ?? false),
+          description: typeof e['description'] === 'string' ? e['description'] : undefined,
+          deployment: deployment(e),
+          outboundAccess: outboundAccess(e),
+          inputSchema: isJsonSchema(e['input']) ? (e['input'] as SchemaSnapshot) : undefined,
+          outputSchema: isJsonSchema(e['output']) ? (e['output'] as SchemaSnapshot) : undefined,
+        };
+      })
+  ) as ActionRegistryEntry[];
 
   const integrations: IntegrationRegistryEntry[] = paths.integrations.flatMap((_filePath, i) =>
     (integrationExports[i] ?? [])

package/src/builder/load-module.ts

@@ -113,9 +113,9 @@ process.stdout.write(JSON.stringify(results));
 export async function loadModuleExports(absoluteFilePath: string): Promise<RawPrimitiveExport[]> {
   // Use a subdir of the project root rather than OS tmpdir so that ESM import
   // resolution can walk up and find node_modules packages like zod-to-json-schema.
-  const tibTmpDir = join(process.cwd(), '.tib', 'tmp');
-  await mkdir(tibTmpDir, { recursive: true }).catch(() => undefined);
-  const tempPath = join(tibTmpDir, `tib-load-${randomBytes(8).toString('hex')}.mts`);
+  const mcTmpDir = join(process.cwd(), '.mc', 'tmp');
+  await mkdir(mcTmpDir, { recursive: true }).catch(() => undefined);
+  const tempPath = join(mcTmpDir, `mc-load-${randomBytes(8).toString('hex')}.mts`);
   await writeFile(tempPath, makeEvalScript(absoluteFilePath), 'utf8');
 
   try {

package/src/cli.ts

@@ -82,9 +82,9 @@ program
 program
   .command('build-catalog')
   .description('Merge all per-domain registry files into .mc/domain-registry.json for TIB sync')
-  .option('--tib-dir <path>', 'Path to the .tib directory (defaults to .tib in cwd)')
-  .action(async (opts: { tibDir?: string }) => {
-    await runBuildCatalog(opts.tibDir);
+  .option('--mc-dir <path>', 'Path to the .mc registry directory (defaults to .mc in cwd)')
+  .action(async (opts: { mcDir?: string }) => {
+    await runBuildCatalog(opts.mcDir);
   });
 
 program

package/src/commands/build-catalog.ts

@@ -95,23 +95,23 @@ export interface DomainCatalog {
 /**
  * Build the combined domain catalog from all per-domain registry files.
  * Reads .mc/{domain}-registry.json files and merges them into .mc/domain-registry.json.
- * @param tibDir - Path to the .tib directory. Defaults to .tib in cwd.
+ * @param registryDir - Path to the .mc registry directory. Defaults to .mc in cwd.
  * @returns The written catalog.
  */
-export async function runBuildCatalog(tibDir?: string): Promise<DomainCatalog> {
-  const dir = tibDir ? resolve(tibDir) : join(process.cwd(), '.tib');
+export async function runBuildCatalog(registryDir?: string): Promise<DomainCatalog> {
+  const dir = registryDir ? resolve(registryDir) : join(process.cwd(), '.mc');
 
   // Find all per-domain registry files
   let files: string[];
   try {
     files = await readdir(dir);
   } catch {
-    throw new Error(`build-catalog: .tib directory not found at ${dir}. Run tib build first.`);
+    throw new Error(`build-catalog: .mc registry directory not found at ${dir}. Run mc-domain-module build first.`);
   }
 
   const registryFiles = files.filter(f => f.endsWith('-registry.json') && f !== 'domain-registry.json');
   if (registryFiles.length === 0) {
-    throw new Error(`build-catalog: no domain registry files found in ${dir}. Run tib build <domain> first.`);
+    throw new Error(`build-catalog: no domain registry files found in ${dir}. Run mc-domain-module build <domain> first.`);
   }
 
   const catalog: DomainCatalog = {

package/src/commands/build-flows.ts

@@ -285,7 +285,7 @@ async function loadFlowsFromDir(dir: string, owningDomainOverride?: string): Pro
  */
 export async function runBuildFlows(options: BuildFlowsOptions): Promise<string> {
   const projectRoot = options.projectRoot ?? process.cwd();
-  const outFile = options.outFile ?? join(projectRoot, '.tib', 'flows-registry.json');
+  const outFile = options.outFile ?? join(projectRoot, '.mc', 'flows-registry.json');
 
   cliLogger.info({ projectRoot }, 'Building flows registry');
 

package/src/commands/build.ts

@@ -27,7 +27,7 @@ export async function runBuild(options: BuildOptions): Promise<string> {
   const domainId = basename(domainRoot);
   const outFile = options.outFile
     ? resolve(options.outFile)
-    : join(process.cwd(), '.tib', `${domainId}-registry.json`);
+    : join(process.cwd(), '.mc', `${domainId}-registry.json`);
 
   cliLogger.info({ domainRoot }, 'Building domain registry');
 
@@ -43,15 +43,15 @@ export async function runBuild(options: BuildOptions): Promise<string> {
   cliLogger.info({ outFile, apis: registry.apis.length, events: registry.events.length }, 'Registry written');
 
   // Discover all sibling registries and emit aggregated types
-  const tibDir = join(process.cwd(), '.tib');
-  const registryFiles = (await readdir(tibDir)).filter(f => f.endsWith('-registry.json'));
+  const registryDir = join(outFile, '..');
+  const registryFiles = (await readdir(registryDir)).filter(f => f.endsWith('-registry.json'));
   const allRegistries: DomainRegistry[] = [];
   for (const f of registryFiles) {
-    const raw = await readFile(join(tibDir, f), 'utf8');
+    const raw = await readFile(join(registryDir, f), 'utf8');
     allRegistries.push(JSON.parse(raw) as DomainRegistry);
   }
   const typesContent = buildActionsTypes(allRegistries);
-  const typesFile = join(tibDir, 'actions-types.d.ts');
+  const typesFile = join(registryDir, 'actions-types.d.ts');
   await writeFile(typesFile, typesContent);
 
   cliLogger.info({ outFile: typesFile }, 'Types file written');

package/src/commands/check-hashes.ts

@@ -57,14 +57,14 @@ interface ModulesHashesManifest {
  */
 export async function runCheckHashes(opts: CheckHashesOptions = {}): Promise<CheckHashesResult> {
   const root = opts.projectRoot ?? process.cwd();
-  const manifestPath = join(root, '.tib', 'modules-hashes.json');
+  const manifestPath = join(root, '.mc', 'modules-hashes.json');
   const modulesDir = join(root, 'infra', 'modules');
 
   let manifest: ModulesHashesManifest;
   try {
     manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as ModulesHashesManifest;
   } catch (err) {
-    throw new Error(`tib check-hashes: cannot read ${manifestPath} (${(err as Error).message}). Re-scaffold to regenerate the manifest.`);
+    throw new Error(`mc-domain-module check-hashes: cannot read ${manifestPath} (${(err as Error).message}). Re-scaffold to regenerate the manifest.`);
   }
 
   const drifted: DriftedFile[] = [];

package/src/commands/create-project.ts

@@ -217,7 +217,7 @@ export async function runCreateProject(opts: CreateProjectOptions): Promise<void
 
     // 5. Prepare output directory
     await mkdir(outputDir, { recursive: true });
-    await mkdir(join(outputDir, '.tib'), { recursive: true });
+    await mkdir(join(outputDir, '.mc'), { recursive: true });
 
     // 6. Get CLI version from package.json
     let cliVersion = '0.0.0';

package/src/commands/doctor.ts

@@ -18,15 +18,13 @@ export const DOCTOR_FIX_FLAG = '--fix';
 export interface DoctorOptions {
   /** Root directory of the project (defaults to cwd). */
   projectRoot?: string;
-  /** Flag to run relocation of old-layout scaffold files to new layout. */
+  /** Deprecated legacy flag retained as a no-op for older automation. */
   relocate?: boolean;
   /**
-   * Auto-remediate before reporting. --fix is a superset of --relocate: it
-   * first runs the relocation routine (auto-moves owned scaffold files outside
-   * .mc/ into .mc/ and updates .mc/manifest.json), then continues with the
-   * full doctor report. On a project that is already clean, --fix is a no-op
-   * (0 files moved, exit 0). Does NOT auto-generate missing fixtures
-   * (deferred).
+   * Auto-remediate before reporting. The legacy relocation routine is now a
+   * no-op because current scaffold manifests intentionally track managed files
+   * in their installed project locations (infra/modules, domains, .github, etc.).
+   * Does NOT auto-generate missing fixtures (deferred).
    */
   fix?: boolean;
   /**
@@ -224,16 +222,15 @@ async function checkGeneratedClientsFresh(projectRoot: string): Promise<DoctorCh
 export async function runDoctor(opts: DoctorOptions = {}): Promise<DoctorReport> {
   const projectRoot = opts.projectRoot ?? process.cwd();
 
-  // --relocate runs ONLY the relocation routine (existing behaviour).
-  // --fix is a superset: it runs relocation first, then the full report.
+  // --relocate is retained as a safe no-op for older automation.
+  // --fix runs that no-op preflight first, then the full report.
   // When both are set, --fix takes precedence so the report still runs.
   if (opts.relocate && !opts.fix) {
     return runRelocate(projectRoot);
   }
 
-  // --fix preflight: run the relocation routine and merge its checks into
-  // the doctor report. On a clean project (no files outside .mc/ to move)
-  // runRelocate returns a no-op summary check (0 moved, 0 warned, 8 skipped).
+  // --fix preflight: run the legacy relocation no-op and merge its check into
+  // the doctor report.
   let preflightChecks: DoctorCheck[] = [];
   if (opts.fix) {
     const relocationReport = await runRelocate(projectRoot);
@@ -568,14 +565,22 @@ async function checkApisHaveTenancy(projectRoot: string): Promise<DoctorCheck> {
 
 async function checkScaffoldConfigMatchesDisk(projectRoot: string): Promise<DoctorCheck> {
   try {
-    const configPath = join(projectRoot, '.tib', 'scaffold-config.json');
+    const configPath = join(projectRoot, '.mc', 'scaffold-config.json');
     const domainsDir = join(projectRoot, 'domains');
 
     let configDomains: string[] = [];
     try {
       const configContent = await readFile(configPath, 'utf8');
       const config = JSON.parse(configContent) as { domainIds?: string[] };
-      configDomains = config.domainIds ?? [];
+      if (!Array.isArray(config.domainIds)) {
+        return {
+          name: 'scaffold-config.json matches on-disk',
+          status: 'PASS',
+          message: '.mc/scaffold-config.json has no domainIds array — domain list sync check skipped',
+          kNodeRef: 'K:runbook:add-domain',
+        };
+      }
+      configDomains = config.domainIds;
     } catch {
       return {
         name: 'scaffold-config.json matches on-disk',
@@ -1205,7 +1210,7 @@ async function checkDomainBrainReachable(projectRoot: string): Promise<DoctorChe
  */
 async function checkActionsHaveTypes(projectRoot: string): Promise<DoctorCheck> {
   try {
-    const typesPath = join(projectRoot, '.tib', 'actions-types.d.ts');
+    const typesPath = join(projectRoot, '.mc', 'actions-types.d.ts');
     const domainsDir = join(projectRoot, 'domains');
     const discoveredActions: string[] = [];
 
@@ -1435,7 +1440,7 @@ async function checkSeedPagesHaveNoHeaders(projectRoot: string): Promise<DoctorC
 
 /**
  * Check Part C: Layout validation checks
- * 1. owned files in unexpected locations
+ * 1. managed files are not registered in obsolete legacy locations
  * 2. tracked/seed files inside .mc/
  * 3. manifest entries pointing at missing files
  * 4. scaffold-tracked files (with @mc-scaffold: header) that lack manifest entries
@@ -1452,26 +1457,29 @@ async function checkLayoutPolicy(projectRoot: string): Promise<DoctorCheck[]> {
     return [];
   }
 
-  // Check 1: owned files in unexpected locations
-  // Policy: owned files should be in .mc/ OR .github/workflows/tib-*
-  const ownedOutsideTib = manifest.files.filter(f =>
-    f.policy === 'managed' &&
-    !f.path.startsWith('.mc/') &&
-    !/^\.github\/workflows\/tib-/.test(f.path)
+  // Check 1: managed files should not be registered in obsolete legacy
+  // locations. Current scaffold manifests intentionally track managed files at
+  // their installed paths (infra/modules, domains, .github, CLAUDE.md, etc.).
+  const legacyManagedLocations = manifest.files.filter(f =>
+    f.policy === 'managed' && (
+      f.path.startsWith('.tib/') ||
+      f.path.startsWith('.mc/infra/') ||
+      f.path === 'mc-deploy.yml'
+    )
   );
-  if (ownedOutsideTib.length === 0) {
+  if (legacyManagedLocations.length === 0) {
     results.push({
-      name: 'Layout: owned files in .mc/',
+      name: 'Layout: no managed files in legacy locations',
       status: 'PASS',
-      message: 'All owned scaffold files are under .mc/ or .github/workflows/tib-*',
+      message: 'Managed scaffold files use current manifest paths',
     });
   } else {
-    for (const f of ownedOutsideTib) {
+    for (const f of legacyManagedLocations) {
       results.push({
-        name: 'Layout: owned files in .mc/',
+        name: 'Layout: no managed files in legacy locations',
         status: 'FAIL',
-        message: `Owned scaffold file outside .mc/: ${f.path}`,
-        fixHint: `Run 'tib doctor --relocate' to migrate ${f.path} to .mc/`,
+        message: `Managed scaffold file registered in legacy location: ${f.path}`,
+        fixHint: 'Run `npx mc-domain-module upgrade` to refresh scaffold metadata',
         file: f.path,
       });
     }
@@ -1521,7 +1529,7 @@ async function checkLayoutPolicy(projectRoot: string): Promise<DoctorCheck[]> {
       name: 'Layout: manifest entries exist on disk',
       status: 'FAIL',
       message: `${missingFiles.length} manifest entry/entries point to missing files:\n  ${missingFiles.join('\n  ')}`,
-      fixHint: 'Run tib doctor --relocate or tib upgrade to fix missing files',
+      fixHint: 'Run `npx mc-domain-module upgrade` to refresh scaffold metadata, or restore the missing files',
     });
   }
 
@@ -1566,7 +1574,7 @@ async function checkLayoutPolicy(projectRoot: string): Promise<DoctorCheck[]> {
       name: 'Layout: scaffold-tracked files have manifest entries',
       status: 'WARN',
       message: `${untracked.length} file(s) with @mc-scaffold: header not in manifest:\n  ${untracked.join('\n  ')}`,
-      fixHint: 'Run tib upgrade or tib doctor --relocate to register these files',
+      fixHint: 'Run `npx mc-domain-module upgrade` to refresh scaffold metadata',
     });
   }
 
@@ -1574,156 +1582,19 @@ async function checkLayoutPolicy(projectRoot: string): Promise<DoctorCheck[]> {
 }
 
 /**
- * Old path → new path mapping for known scaffold files
- */
-const RELOCATION_MAP: Array<{ oldPath: string; newPath: string; policy: 'managed' | 'editable' | 'seed' }> = [
-  { oldPath: 'infra/modules/app.ts', newPath: '.mc/infra/modules/app.ts', policy: 'managed' },
-  { oldPath: 'infra/modules/shared/SharedStack.ts', newPath: '.mc/infra/modules/shared/SharedStack.ts', policy: 'managed' },
-  { oldPath: 'infra/modules/domains/dispatch-middleware.ts', newPath: '.mc/infra/modules/domains/dispatch-middleware.ts', policy: 'managed' },
-  { oldPath: 'infra/modules/PowerTuningStack.ts', newPath: '.mc/infra/modules/PowerTuningStack.ts', policy: 'managed' },
-  { oldPath: 'infra/cdk.json', newPath: '.mc/infra/cdk.json', policy: 'managed' },
-  { oldPath: 'infra/tsconfig.json', newPath: '.mc/infra/tsconfig.json', policy: 'managed' },
-  { oldPath: 'infra/package.json', newPath: '.mc/infra/package.json', policy: 'managed' },
-  { oldPath: 'mc-deploy.yml', newPath: '.github/workflows/mc-deploy.yml', policy: 'managed' },
-];
-
-/**
- * Run relocation of old-layout scaffold files to new layout
+ * Legacy relocation entrypoint retained for older automation.
+ *
+ * Earlier scaffold versions tried to move generated infra into .mc/infra. The
+ * current scaffold contract keeps generated infra under infra/modules and uses
+ * .mc/manifest.json plus .mc/modules-hashes.json for ownership/drift tracking.
+ * Moving files here would corrupt modern projects, so relocation is now a no-op.
  */
 async function runRelocate(projectRoot: string): Promise<DoctorReport> {
-  const checks: DoctorCheck[] = [];
-
-  const { readManifest, writeManifest, upsertManifestFile } = await import('../utils/manifest.js');
-  const { readFile, writeFile, mkdir, unlink } = await import('node:fs/promises');
-  const { computeChecksumFile, computeChecksumString } = await import('../utils/checksum.js');
-  const { join, dirname } = await import('node:path');
-
-  const manifest = await readManifest(projectRoot);
-  if (!manifest) {
-    checks.push({
-      name: 'Relocate: manifest present',
-      status: 'FAIL',
-      message: '.mc/manifest.json not found — cannot relocate without a manifest',
-      fixHint: 'This project may not be a TIB scaffold project',
-    });
-    return { checks, exitCode: 1, pass: false };
-  }
-
-  let moved = 0;
-  let warned = 0;
-  let skipped = 0;
-
-  for (const { oldPath, newPath, policy } of RELOCATION_MAP) {
-    const oldAbsPath = join(projectRoot, oldPath);
-    const newAbsPath = join(projectRoot, newPath);
-
-    // Check if old file exists
-    const { access: fsAccess } = await import('node:fs/promises');
-    try { await fsAccess(oldAbsPath); } catch { skipped++; continue; }
-
-    // Check if it has the scaffold header (confirm it's scaffold-owned)
-    let content: string;
-    try {
-      content = await readFile(oldAbsPath, 'utf-8');
-    } catch {
-      skipped++;
-      continue;
-    }
-
-    if (!content.includes('@mc-scaffold:')) {
-      // File exists but no header — user-owned, leave it
-      checks.push({
-        name: 'Relocate: checking ' + oldPath,
-        status: 'WARN',
-        message: `${oldPath} has no @mc-scaffold: header — left in place (user-owned)`,
-        file: oldPath,
-      });
-      warned++;
-      continue;
-    }
-
-    // Check for user drift
-    const manifestEntry = manifest.files.find(f => f.path === oldPath);
-    if (manifestEntry) {
-      const diskSha = await computeChecksumFile(oldAbsPath);
-      if (diskSha && diskSha !== manifestEntry.sha256) {
-        // File has been modified — leave with warning
-        checks.push({
-          name: 'Relocate: checking ' + oldPath,
-          status: 'WARN',
-          message: `${oldPath} has local modifications — left in place. Migrate manually: move to ${newPath}`,
-          file: oldPath,
-        });
-        warned++;
-        continue;
-      }
-    }
-
-    // Check if destination already exists
-    try {
-      await fsAccess(newAbsPath);
-      checks.push({
-        name: 'Relocate: ' + oldPath,
-        status: 'WARN',
-        message: `${newPath} already exists — skipping move of ${oldPath}`,
-        file: newPath,
-      });
-      warned++;
-      continue;
-    } catch { /* destination doesn't exist, good */ }
-
-    // Move the file
-    try {
-      await mkdir(dirname(newAbsPath), { recursive: true });
-      // Copy + delete (rename may fail across filesystems)
-      await writeFile(newAbsPath, content, 'utf-8');
-
-      // Update manifest: remove old entry, add new with new path + policy
-      manifest.files = manifest.files.filter(f => f.path !== oldPath);
-      const sha256 = manifestEntry?.sha256 ?? computeChecksumString(content);
-      upsertManifestFile(manifest, {
-        path: newPath,
-        module: manifestEntry?.module ?? 'domain',
-        moduleVersion: manifestEntry?.moduleVersion ?? '1.0.0',
-        sha256,
-        wasTemplate: manifestEntry?.wasTemplate ?? false,
-        installedAt: manifestEntry?.installedAt ?? new Date().toISOString(),
-        policy,
-      });
-
-      // Delete old file
-      await unlink(oldAbsPath);
-
-      checks.push({
-        name: 'Relocate: ' + oldPath,
-        status: 'PASS',
-        message: `Moved ${oldPath} → ${newPath} (policy: ${policy})`,
-        file: newPath,
-      });
-      moved++;
-    } catch (err) {
-      checks.push({
-        name: 'Relocate: ' + oldPath,
-        status: 'FAIL',
-        message: `Failed to move ${oldPath} → ${newPath}: ${String(err)}`,
-        file: oldPath,
-      });
-    }
-  }
-
-  // Write updated manifest
-  if (moved > 0) {
-    await writeManifest(projectRoot, manifest);
-  }
-
-  // Summary check
-  checks.push({
-    name: 'Relocate: summary',
-    status: warned > 0 ? 'WARN' : 'PASS',
-    message: `Relocation complete: ${moved} file(s) moved, ${warned} warning(s), ${skipped} skipped (not present)`,
-  });
-
-  const hasFail = checks.some(c => c.status === 'FAIL');
-  const exitCode = hasFail ? 1 : 0;
-  return { checks, exitCode, pass: exitCode === 0 };
+  void projectRoot;
+  const checks: DoctorCheck[] = [{
+    name: 'Relocate: deprecated no-op',
+    status: 'PASS',
+    message: 'No files moved. Current scaffold layout keeps generated files at their installed paths and tracks ownership via .mc/manifest.json.',
+  }];
+  return { checks, exitCode: 0, pass: true };
 }

package/src/commands/power-tune.ts

@@ -5,13 +5,13 @@ import { cliLogger } from '../utils/logger.js';
 
 export async function runPowerTune(domain: string, primitive: string): Promise<void> {
   // Load registry to find Lambda ARN
-  const registryPath = path.join(process.cwd(), '.tib', `${domain}-registry.json`);
+  const registryPath = path.join(process.cwd(), '.mc', `${domain}-registry.json`);
 
   let registry: { domain: { id: string }; functionArns?: Record<string, string> };
   try {
     registry = JSON.parse(readFileSync(registryPath, 'utf8'));
   } catch {
-    cliLogger.error({}, `Registry not found at ${registryPath}. Run: tib build domains/${domain}`);
+    cliLogger.error({}, `Registry not found at ${registryPath}. Run: npx mc-domain-module build domains/${domain}`);
     process.exit(1);
   }