@mettlecast/domain-cli 0.2.59 → 0.2.60

package/dist/builder/build-registry.js

@@ -1,6 +1,90 @@
 import { relative, resolve } from 'node:path';
 import { walkDomainDir } from '../utils/file-helpers.js';
 import { loadModuleExports } from './load-module.js';
+/**
+ * Coerce a raw value into a valid backendAccess scope, defaulting to
+ * 'private' when the value is missing or unrecognized. Used by the
+ * builder when reading the new-style `backendAccess` field directly.
+ */
+function toBackendAccess(raw) {
+    return raw === 'domain' || raw === 'platform' ? raw : 'private';
+}
+/**
+ * Map a legacy `visibility` scope to a `backendAccess` scope for the
+ * action-first migration. The legacy `workspace` scope (which previously
+ * permitted unauthenticated Function URL exposure) collapses to `domain`
+ * so that all cross-domain callers must go through `ctx.actions`.
+ */
+function visibilityToBackendAccess(visibility) {
+    if (visibility === 'workspace')
+        return 'domain';
+    if (visibility === 'domain')
+        return 'domain';
+    return 'private';
+}
+/**
+ * Best-effort reverse mapping from `backendAccess` to the legacy
+ * `visibility` field. Used to keep the deprecated field populated so
+ * existing CDK constructs that read it continue to behave the same way.
+ *
+ * - private  -> private
+ * - domain   -> domain
+ * - platform -> workspace (closest legacy equivalent for platform-level)
+ */
+function backendAccessToVisibility(backendAccess) {
+    if (backendAccess === 'platform')
+        return 'workspace';
+    return backendAccess;
+}
+/**
+ * Type guard + sanitizer for an action's `exposure` field. Returns a
+ * well-typed `ActionExposure` (extended with `authDeclared` /
+ * `tenancyDeclared` tracking flags) or the provided fallback when the
+ * raw value does not match a supported exposure shape.
+ *
+ * The `authDeclared` / `tenancyDeclared` flags record whether the source
+ * code explicitly declared each field, or whether the builder fell back
+ * to the safe default. They are validation-only and consumed by the
+ * domain CLI's validate command (Wave 6 Task 6.1) to enforce the
+ * action-first security model (#4619).
+ */
+function toExposure(raw, fallback) {
+    if (!raw || typeof raw !== 'object')
+        return fallback;
+    const candidate = raw;
+    if (candidate.type === 'internal')
+        return { type: 'internal' };
+    if (candidate.type !== 'api')
+        return fallback;
+    // Best-effort validation of api exposure fields; any missing required
+    // string field falls back to the supplied default exposure.
+    const api = raw;
+    if (typeof api.path !== 'string' || typeof api.method !== 'string')
+        return fallback;
+    const authRaw = api.auth;
+    const tenancyRaw = api.tenancy;
+    const auth = authRaw === 'required' || authRaw === 'none' || authRaw === 'service' ? authRaw : 'required';
+    const tenancy = tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system' ? tenancyRaw : 'required';
+    const out = {
+        type: 'api',
+        path: api.path,
+        method: api.method,
+        auth,
+        tenancy,
+        authDeclared: authRaw === 'required' || authRaw === 'none' || authRaw === 'service',
+        tenancyDeclared: tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system',
+    };
+    if (Array.isArray(api.roles)) {
+        out.roles = api.roles.filter((r) => typeof r === 'string');
+    }
+    if (api.securityException && typeof api.securityException === 'object') {
+        const reason = api.securityException.reason;
+        if (typeof reason === 'string') {
+            out.securityException = { reason };
+        }
+    }
+    return out;
+}
 /** Returns true if a value looks like a JSON Schema object (has a 'type' or '$schema' property). */
 function isJsonSchema(v) {
     return v !== null && typeof v === 'object' && !Array.isArray(v) &&
@@ -47,7 +131,7 @@ export async function buildRegistry(domainRoot) {
     if (!domainRaw) {
         // Emit any suppressed tsx load errors to stderr before throwing so they appear in CI logs.
         for (const w of warnings)
-            process.stderr.write(`[tib validate] ${w}\n`);
+            process.stderr.write(`[mc-domain-module validate] ${w}\n`);
         throw new Error(`buildRegistry: no 'domain' export found in ${paths.domain}`);
     }
     const domain = {
@@ -149,18 +233,49 @@ export async function buildRegistry(domainRoot) {
     })));
     const actions = paths.actions.flatMap((filePath, i) => (actionExports[i] ?? [])
         .filter(e => e['_kind'] === 'action')
-        .map(e => ({
-        id: String(e['id']),
-        kind: 'action',
-        handlerFile: relPath(filePath),
-        visibility: String(e['visibility']),
-        idempotent: Boolean(e['idempotent'] ?? false),
-        description: typeof e['description'] === 'string' ? e['description'] : undefined,
-        deployment: deployment(e),
-        outboundAccess: outboundAccess(e),
-        inputSchema: isJsonSchema(e['input']) ? e['input'] : undefined,
-        outputSchema: isJsonSchema(e['output']) ? e['output'] : undefined,
-    })));
+        .map(e => {
+        // Resolve backendAccess. New-style actions carry `backendAccess`
+        // directly. Legacy actions only carry `visibility`; in that case
+        // we collapse workspace -> domain per the migration spec, and we
+        // also remember the legacy flag so we can default exposure to
+        // `{ type: 'internal' }` for actions that have not opted in yet.
+        const hasBackendAccess = 'backendAccess' in e;
+        const rawBackendAccess = e['backendAccess'];
+        const rawVisibility = e['visibility'];
+        const backendAccess = hasBackendAccess
+            ? toBackendAccess(rawBackendAccess)
+            : visibilityToBackendAccess(rawVisibility);
+        const legacyVisibility = backendAccessToVisibility(backendAccess);
+        // Resolve exposure. New-style actions must declare their exposure;
+        // legacy actions that did not opt in default to `{ type: 'internal' }`
+        // so existing internal-only behavior is preserved during migration.
+        const rawExposure = e['exposure'];
+        const exposure = toExposure(rawExposure, { type: 'internal' });
+        // Record whether the source explicitly declared the `exposure` field.
+        // Validation-only; consumed by the domain CLI's validate command
+        // (Wave 6 Task 6.1) to enforce `ACTION_EXPOSURE_REQUIRED`.
+        const exposureDeclared = rawExposure !== undefined && rawExposure !== null
+            && typeof rawExposure === 'object';
+        return {
+            id: String(e['id']),
+            kind: 'action',
+            handlerFile: relPath(filePath),
+            backendAccess,
+            exposure,
+            exposureDeclared,
+            // Keep the legacy field populated so CDK constructs that still
+            // read `visibility` (e.g. action-construct.ts) keep working
+            // through the migration window. New constructs should read
+            // `backendAccess` and `exposure` instead.
+            visibility: legacyVisibility,
+            idempotent: Boolean(e['idempotent'] ?? false),
+            description: typeof e['description'] === 'string' ? e['description'] : undefined,
+            deployment: deployment(e),
+            outboundAccess: outboundAccess(e),
+            inputSchema: isJsonSchema(e['input']) ? e['input'] : undefined,
+            outputSchema: isJsonSchema(e['output']) ? e['output'] : undefined,
+        };
+    }));
     const integrations = paths.integrations.flatMap((_filePath, i) => (integrationExports[i] ?? [])
         .filter(e => e['_kind'] === 'integration')
         .map(e => ({

package/dist/builder/load-module.js

@@ -95,9 +95,9 @@ process.stdout.write(JSON.stringify(results));
 export async function loadModuleExports(absoluteFilePath) {
     // Use a subdir of the project root rather than OS tmpdir so that ESM import
     // resolution can walk up and find node_modules packages like zod-to-json-schema.
-    const tibTmpDir = join(process.cwd(), '.tib', 'tmp');
-    await mkdir(tibTmpDir, { recursive: true }).catch(() => undefined);
-    const tempPath = join(tibTmpDir, `tib-load-${randomBytes(8).toString('hex')}.mts`);
+    const mcTmpDir = join(process.cwd(), '.mc', 'tmp');
+    await mkdir(mcTmpDir, { recursive: true }).catch(() => undefined);
+    const tempPath = join(mcTmpDir, `mc-load-${randomBytes(8).toString('hex')}.mts`);
     await writeFile(tempPath, makeEvalScript(absoluteFilePath), 'utf8');
     try {
         return await new Promise((resolve, reject) => {

package/dist/cli.js

@@ -75,9 +75,9 @@ program
 program
     .command('build-catalog')
     .description('Merge all per-domain registry files into .mc/domain-registry.json for TIB sync')
-    .option('--tib-dir <path>', 'Path to the .tib directory (defaults to .tib in cwd)')
+    .option('--mc-dir <path>', 'Path to the .mc registry directory (defaults to .mc in cwd)')
     .action(async (opts) => {
-    await runBuildCatalog(opts.tibDir);
+    await runBuildCatalog(opts.mcDir);
 });
 program
     .command('add-domain <id>')

package/dist/commands/build-catalog.d.ts

@@ -92,7 +92,7 @@ export interface DomainCatalog {
 /**
  * Build the combined domain catalog from all per-domain registry files.
  * Reads .mc/{domain}-registry.json files and merges them into .mc/domain-registry.json.
- * @param tibDir - Path to the .tib directory. Defaults to .tib in cwd.
+ * @param registryDir - Path to the .mc registry directory. Defaults to .mc in cwd.
  * @returns The written catalog.
  */
-export declare function runBuildCatalog(tibDir?: string): Promise<DomainCatalog>;
+export declare function runBuildCatalog(registryDir?: string): Promise<DomainCatalog>;

package/dist/commands/build-catalog.js

@@ -4,22 +4,22 @@ import { cliLogger } from '../utils/logger.js';
 /**
  * Build the combined domain catalog from all per-domain registry files.
  * Reads .mc/{domain}-registry.json files and merges them into .mc/domain-registry.json.
- * @param tibDir - Path to the .tib directory. Defaults to .tib in cwd.
+ * @param registryDir - Path to the .mc registry directory. Defaults to .mc in cwd.
  * @returns The written catalog.
  */
-export async function runBuildCatalog(tibDir) {
-    const dir = tibDir ? resolve(tibDir) : join(process.cwd(), '.tib');
+export async function runBuildCatalog(registryDir) {
+    const dir = registryDir ? resolve(registryDir) : join(process.cwd(), '.mc');
     // Find all per-domain registry files
     let files;
     try {
         files = await readdir(dir);
     }
     catch {
-        throw new Error(`build-catalog: .tib directory not found at ${dir}. Run tib build first.`);
+        throw new Error(`build-catalog: .mc registry directory not found at ${dir}. Run mc-domain-module build first.`);
     }
     const registryFiles = files.filter(f => f.endsWith('-registry.json') && f !== 'domain-registry.json');
     if (registryFiles.length === 0) {
-        throw new Error(`build-catalog: no domain registry files found in ${dir}. Run tib build <domain> first.`);
+        throw new Error(`build-catalog: no domain registry files found in ${dir}. Run mc-domain-module build <domain> first.`);
     }
     const catalog = {
         version: 2,

package/dist/commands/build-flows.js

@@ -253,7 +253,7 @@ async function loadFlowsFromDir(dir, owningDomainOverride) {
  */
 export async function runBuildFlows(options) {
     const projectRoot = options.projectRoot ?? process.cwd();
-    const outFile = options.outFile ?? join(projectRoot, '.tib', 'flows-registry.json');
+    const outFile = options.outFile ?? join(projectRoot, '.mc', 'flows-registry.json');
     cliLogger.info({ projectRoot }, 'Building flows registry');
     const allEntries = [];
     const seenIds = new Set();

package/dist/commands/build.js

@@ -15,7 +15,7 @@ export async function runBuild(options) {
     const domainId = basename(domainRoot);
     const outFile = options.outFile
         ? resolve(options.outFile)
-        : join(process.cwd(), '.tib', `${domainId}-registry.json`);
+        : join(process.cwd(), '.mc', `${domainId}-registry.json`);
     cliLogger.info({ domainRoot }, 'Building domain registry');
     const { registry, warnings } = await buildRegistry(domainRoot);
     for (const w of warnings) {
@@ -25,15 +25,15 @@ export async function runBuild(options) {
     await writeFile(outFile, JSON.stringify(registry), 'utf8');
     cliLogger.info({ outFile, apis: registry.apis.length, events: registry.events.length }, 'Registry written');
     // Discover all sibling registries and emit aggregated types
-    const tibDir = join(process.cwd(), '.tib');
-    const registryFiles = (await readdir(tibDir)).filter(f => f.endsWith('-registry.json'));
+    const registryDir = join(outFile, '..');
+    const registryFiles = (await readdir(registryDir)).filter(f => f.endsWith('-registry.json'));
     const allRegistries = [];
     for (const f of registryFiles) {
-        const raw = await readFile(join(tibDir, f), 'utf8');
+        const raw = await readFile(join(registryDir, f), 'utf8');
         allRegistries.push(JSON.parse(raw));
     }
     const typesContent = buildActionsTypes(allRegistries);
-    const typesFile = join(tibDir, 'actions-types.d.ts');
+    const typesFile = join(registryDir, 'actions-types.d.ts');
     await writeFile(typesFile, typesContent);
     cliLogger.info({ outFile: typesFile }, 'Types file written');
     return outFile;

package/dist/commands/check-hashes.js

@@ -10,14 +10,14 @@ import { cliLogger } from '../utils/logger.js';
  */
 export async function runCheckHashes(opts = {}) {
     const root = opts.projectRoot ?? process.cwd();
-    const manifestPath = join(root, '.tib', 'modules-hashes.json');
+    const manifestPath = join(root, '.mc', 'modules-hashes.json');
     const modulesDir = join(root, 'infra', 'modules');
     let manifest;
     try {
         manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
     }
     catch (err) {
-        throw new Error(`tib check-hashes: cannot read ${manifestPath} (${err.message}). Re-scaffold to regenerate the manifest.`);
+        throw new Error(`mc-domain-module check-hashes: cannot read ${manifestPath} (${err.message}). Re-scaffold to regenerate the manifest.`);
     }
     const drifted = [];
     const missing = [];

package/dist/commands/create-project.js

@@ -160,7 +160,7 @@ export async function runCreateProject(opts) {
         const orderedModules = topoSort(modulesJson.modules, selectedIds);
         // 5. Prepare output directory
         await mkdir(outputDir, { recursive: true });
-        await mkdir(join(outputDir, '.tib'), { recursive: true });
+        await mkdir(join(outputDir, '.mc'), { recursive: true });
         // 6. Get CLI version from package.json
         let cliVersion = '0.0.0';
         try {

package/dist/commands/doctor.d.ts

@@ -11,15 +11,13 @@ export declare const DOCTOR_FIX_FLAG = "--fix";
 export interface DoctorOptions {
     /** Root directory of the project (defaults to cwd). */
     projectRoot?: string;
-    /** Flag to run relocation of old-layout scaffold files to new layout. */
+    /** Deprecated legacy flag retained as a no-op for older automation. */
     relocate?: boolean;
     /**
-     * Auto-remediate before reporting. --fix is a superset of --relocate: it
-     * first runs the relocation routine (auto-moves owned scaffold files outside
-     * .mc/ into .mc/ and updates .mc/manifest.json), then continues with the
-     * full doctor report. On a project that is already clean, --fix is a no-op
-     * (0 files moved, exit 0). Does NOT auto-generate missing fixtures
-     * (deferred).
+     * Auto-remediate before reporting. The legacy relocation routine is now a
+     * no-op because current scaffold manifests intentionally track managed files
+     * in their installed project locations (infra/modules, domains, .github, etc.).
+     * Does NOT auto-generate missing fixtures (deferred).
      */
     fix?: boolean;
     /**

package/dist/commands/doctor.js

@@ -157,15 +157,14 @@ async function checkGeneratedClientsFresh(projectRoot) {
  */
 export async function runDoctor(opts = {}) {
     const projectRoot = opts.projectRoot ?? process.cwd();
-    // --relocate runs ONLY the relocation routine (existing behaviour).
-    // --fix is a superset: it runs relocation first, then the full report.
+    // --relocate is retained as a safe no-op for older automation.
+    // --fix runs that no-op preflight first, then the full report.
     // When both are set, --fix takes precedence so the report still runs.
     if (opts.relocate && !opts.fix) {
         return runRelocate(projectRoot);
     }
-    // --fix preflight: run the relocation routine and merge its checks into
-    // the doctor report. On a clean project (no files outside .mc/ to move)
-    // runRelocate returns a no-op summary check (0 moved, 0 warned, 8 skipped).
+    // --fix preflight: run the legacy relocation no-op and merge its check into
+    // the doctor report.
     let preflightChecks = [];
     if (opts.fix) {
         const relocationReport = await runRelocate(projectRoot);
@@ -475,13 +474,21 @@ async function checkApisHaveTenancy(projectRoot) {
 }
 async function checkScaffoldConfigMatchesDisk(projectRoot) {
     try {
-        const configPath = join(projectRoot, '.tib', 'scaffold-config.json');
+        const configPath = join(projectRoot, '.mc', 'scaffold-config.json');
         const domainsDir = join(projectRoot, 'domains');
         let configDomains = [];
         try {
             const configContent = await readFile(configPath, 'utf8');
             const config = JSON.parse(configContent);
-            configDomains = config.domainIds ?? [];
+            if (!Array.isArray(config.domainIds)) {
+                return {
+                    name: 'scaffold-config.json matches on-disk',
+                    status: 'PASS',
+                    message: '.mc/scaffold-config.json has no domainIds array — domain list sync check skipped',
+                    kNodeRef: 'K:runbook:add-domain',
+                };
+            }
+            configDomains = config.domainIds;
         }
         catch {
             return {
@@ -1114,7 +1121,7 @@ async function checkDomainBrainReachable(projectRoot) {
  */
 async function checkActionsHaveTypes(projectRoot) {
     try {
-        const typesPath = join(projectRoot, '.tib', 'actions-types.d.ts');
+        const typesPath = join(projectRoot, '.mc', 'actions-types.d.ts');
         const domainsDir = join(projectRoot, 'domains');
         const discoveredActions = [];
         try {
@@ -1347,7 +1354,7 @@ async function checkSeedPagesHaveNoHeaders(projectRoot) {
 }
 /**
  * Check Part C: Layout validation checks
- * 1. owned files in unexpected locations
+ * 1. managed files are not registered in obsolete legacy locations
  * 2. tracked/seed files inside .mc/
  * 3. manifest entries pointing at missing files
  * 4. scaffold-tracked files (with @mc-scaffold: header) that lack manifest entries
@@ -1361,25 +1368,26 @@ async function checkLayoutPolicy(projectRoot) {
         // No manifest — skip layout checks
         return [];
     }
-    // Check 1: owned files in unexpected locations
-    // Policy: owned files should be in .mc/ OR .github/workflows/tib-*
-    const ownedOutsideTib = manifest.files.filter(f => f.policy === 'managed' &&
-        !f.path.startsWith('.mc/') &&
-        !/^\.github\/workflows\/tib-/.test(f.path));
-    if (ownedOutsideTib.length === 0) {
+    // Check 1: managed files should not be registered in obsolete legacy
+    // locations. Current scaffold manifests intentionally track managed files at
+    // their installed paths (infra/modules, domains, .github, CLAUDE.md, etc.).
+    const legacyManagedLocations = manifest.files.filter(f => f.policy === 'managed' && (f.path.startsWith('.tib/') ||
+        f.path.startsWith('.mc/infra/') ||
+        f.path === 'mc-deploy.yml'));
+    if (legacyManagedLocations.length === 0) {
         results.push({
-            name: 'Layout: owned files in .mc/',
+            name: 'Layout: no managed files in legacy locations',
             status: 'PASS',
-            message: 'All owned scaffold files are under .mc/ or .github/workflows/tib-*',
+            message: 'Managed scaffold files use current manifest paths',
         });
     }
     else {
-        for (const f of ownedOutsideTib) {
+        for (const f of legacyManagedLocations) {
             results.push({
-                name: 'Layout: owned files in .mc/',
+                name: 'Layout: no managed files in legacy locations',
                 status: 'FAIL',
-                message: `Owned scaffold file outside .mc/: ${f.path}`,
-                fixHint: `Run 'tib doctor --relocate' to migrate ${f.path} to .mc/`,
+                message: `Managed scaffold file registered in legacy location: ${f.path}`,
+                fixHint: 'Run `npx mc-domain-module upgrade` to refresh scaffold metadata',
                 file: f.path,
             });
         }
@@ -1428,7 +1436,7 @@ async function checkLayoutPolicy(projectRoot) {
             name: 'Layout: manifest entries exist on disk',
             status: 'FAIL',
             message: `${missingFiles.length} manifest entry/entries point to missing files:\n  ${missingFiles.join('\n  ')}`,
-            fixHint: 'Run tib doctor --relocate or tib upgrade to fix missing files',
+            fixHint: 'Run `npx mc-domain-module upgrade` to refresh scaffold metadata, or restore the missing files',
         });
     }
     // Check 4: scaffold-tracked files (with @mc-scaffold: header) that lack manifest entries
@@ -1483,154 +1491,25 @@ async function checkLayoutPolicy(projectRoot) {
             name: 'Layout: scaffold-tracked files have manifest entries',
             status: 'WARN',
             message: `${untracked.length} file(s) with @mc-scaffold: header not in manifest:\n  ${untracked.join('\n  ')}`,
-            fixHint: 'Run tib upgrade or tib doctor --relocate to register these files',
+            fixHint: 'Run `npx mc-domain-module upgrade` to refresh scaffold metadata',
         });
     }
     return results;
 }
 /**
- * Old path → new path mapping for known scaffold files
- */
-const RELOCATION_MAP = [
-    { oldPath: 'infra/modules/app.ts', newPath: '.mc/infra/modules/app.ts', policy: 'managed' },
-    { oldPath: 'infra/modules/shared/SharedStack.ts', newPath: '.mc/infra/modules/shared/SharedStack.ts', policy: 'managed' },
-    { oldPath: 'infra/modules/domains/dispatch-middleware.ts', newPath: '.mc/infra/modules/domains/dispatch-middleware.ts', policy: 'managed' },
-    { oldPath: 'infra/modules/PowerTuningStack.ts', newPath: '.mc/infra/modules/PowerTuningStack.ts', policy: 'managed' },
-    { oldPath: 'infra/cdk.json', newPath: '.mc/infra/cdk.json', policy: 'managed' },
-    { oldPath: 'infra/tsconfig.json', newPath: '.mc/infra/tsconfig.json', policy: 'managed' },
-    { oldPath: 'infra/package.json', newPath: '.mc/infra/package.json', policy: 'managed' },
-    { oldPath: 'mc-deploy.yml', newPath: '.github/workflows/mc-deploy.yml', policy: 'managed' },
-];
-/**
- * Run relocation of old-layout scaffold files to new layout
+ * Legacy relocation entrypoint retained for older automation.
+ *
+ * Earlier scaffold versions tried to move generated infra into .mc/infra. The
+ * current scaffold contract keeps generated infra under infra/modules and uses
+ * .mc/manifest.json plus .mc/modules-hashes.json for ownership/drift tracking.
+ * Moving files here would corrupt modern projects, so relocation is now a no-op.
  */
 async function runRelocate(projectRoot) {
-    const checks = [];
-    const { readManifest, writeManifest, upsertManifestFile } = await import('../utils/manifest.js');
-    const { readFile, writeFile, mkdir, unlink } = await import('node:fs/promises');
-    const { computeChecksumFile, computeChecksumString } = await import('../utils/checksum.js');
-    const { join, dirname } = await import('node:path');
-    const manifest = await readManifest(projectRoot);
-    if (!manifest) {
-        checks.push({
-            name: 'Relocate: manifest present',
-            status: 'FAIL',
-            message: '.mc/manifest.json not found — cannot relocate without a manifest',
-            fixHint: 'This project may not be a TIB scaffold project',
-        });
-        return { checks, exitCode: 1, pass: false };
-    }
-    let moved = 0;
-    let warned = 0;
-    let skipped = 0;
-    for (const { oldPath, newPath, policy } of RELOCATION_MAP) {
-        const oldAbsPath = join(projectRoot, oldPath);
-        const newAbsPath = join(projectRoot, newPath);
-        // Check if old file exists
-        const { access: fsAccess } = await import('node:fs/promises');
-        try {
-            await fsAccess(oldAbsPath);
-        }
-        catch {
-            skipped++;
-            continue;
-        }
-        // Check if it has the scaffold header (confirm it's scaffold-owned)
-        let content;
-        try {
-            content = await readFile(oldAbsPath, 'utf-8');
-        }
-        catch {
-            skipped++;
-            continue;
-        }
-        if (!content.includes('@mc-scaffold:')) {
-            // File exists but no header — user-owned, leave it
-            checks.push({
-                name: 'Relocate: checking ' + oldPath,
-                status: 'WARN',
-                message: `${oldPath} has no @mc-scaffold: header — left in place (user-owned)`,
-                file: oldPath,
-            });
-            warned++;
-            continue;
-        }
-        // Check for user drift
-        const manifestEntry = manifest.files.find(f => f.path === oldPath);
-        if (manifestEntry) {
-            const diskSha = await computeChecksumFile(oldAbsPath);
-            if (diskSha && diskSha !== manifestEntry.sha256) {
-                // File has been modified — leave with warning
-                checks.push({
-                    name: 'Relocate: checking ' + oldPath,
-                    status: 'WARN',
-                    message: `${oldPath} has local modifications — left in place. Migrate manually: move to ${newPath}`,
-                    file: oldPath,
-                });
-                warned++;
-                continue;
-            }
-        }
-        // Check if destination already exists
-        try {
-            await fsAccess(newAbsPath);
-            checks.push({
-                name: 'Relocate: ' + oldPath,
-                status: 'WARN',
-                message: `${newPath} already exists — skipping move of ${oldPath}`,
-                file: newPath,
-            });
-            warned++;
-            continue;
-        }
-        catch { /* destination doesn't exist, good */ }
-        // Move the file
-        try {
-            await mkdir(dirname(newAbsPath), { recursive: true });
-            // Copy + delete (rename may fail across filesystems)
-            await writeFile(newAbsPath, content, 'utf-8');
-            // Update manifest: remove old entry, add new with new path + policy
-            manifest.files = manifest.files.filter(f => f.path !== oldPath);
-            const sha256 = manifestEntry?.sha256 ?? computeChecksumString(content);
-            upsertManifestFile(manifest, {
-                path: newPath,
-                module: manifestEntry?.module ?? 'domain',
-                moduleVersion: manifestEntry?.moduleVersion ?? '1.0.0',
-                sha256,
-                wasTemplate: manifestEntry?.wasTemplate ?? false,
-                installedAt: manifestEntry?.installedAt ?? new Date().toISOString(),
-                policy,
-            });
-            // Delete old file
-            await unlink(oldAbsPath);
-            checks.push({
-                name: 'Relocate: ' + oldPath,
-                status: 'PASS',
-                message: `Moved ${oldPath} → ${newPath} (policy: ${policy})`,
-                file: newPath,
-            });
-            moved++;
-        }
-        catch (err) {
-            checks.push({
-                name: 'Relocate: ' + oldPath,
-                status: 'FAIL',
-                message: `Failed to move ${oldPath} → ${newPath}: ${String(err)}`,
-                file: oldPath,
-            });
-        }
-    }
-    // Write updated manifest
-    if (moved > 0) {
-        await writeManifest(projectRoot, manifest);
-    }
-    // Summary check
-    checks.push({
-        name: 'Relocate: summary',
-        status: warned > 0 ? 'WARN' : 'PASS',
-        message: `Relocation complete: ${moved} file(s) moved, ${warned} warning(s), ${skipped} skipped (not present)`,
-    });
-    const hasFail = checks.some(c => c.status === 'FAIL');
-    const exitCode = hasFail ? 1 : 0;
-    return { checks, exitCode, pass: exitCode === 0 };
+    void projectRoot;
+    const checks = [{
+            name: 'Relocate: deprecated no-op',
+            status: 'PASS',
+            message: 'No files moved. Current scaffold layout keeps generated files at their installed paths and tracks ownership via .mc/manifest.json.',
+        }];
+    return { checks, exitCode: 0, pass: true };
 }

package/dist/commands/power-tune.js

@@ -4,13 +4,13 @@ import path from 'path';
 import { cliLogger } from '../utils/logger.js';
 export async function runPowerTune(domain, primitive) {
     // Load registry to find Lambda ARN
-    const registryPath = path.join(process.cwd(), '.tib', `${domain}-registry.json`);
+    const registryPath = path.join(process.cwd(), '.mc', `${domain}-registry.json`);
     let registry;
     try {
         registry = JSON.parse(readFileSync(registryPath, 'utf8'));
     }
     catch {
-        cliLogger.error({}, `Registry not found at ${registryPath}. Run: tib build domains/${domain}`);
+        cliLogger.error({}, `Registry not found at ${registryPath}. Run: npx mc-domain-module build domains/${domain}`);
         process.exit(1);
     }
     // Find Lambda ARN for the primitive

package/dist/commands/show-dns.d.ts

@@ -3,7 +3,7 @@ export interface ShowDnsOptions {
     projectDir?: string;
 }
 /**
- * tib show-dns [--env dev|staging|prod] [--project-dir <path>]
+ * mc-domain-module show-dns [--env dev|staging|prod] [--project-dir <path>]
  *
  * Reads the scaffold-config.json and prints DNS records that must be added for
  * custom domain wiring: certificate validation CNAMEs (step 1) and traffic