@mettlecast/domain-cli 0.2.59 → 0.2.60

package/src/__tests__/doctor.test.ts

@@ -21,12 +21,12 @@ describe('runDoctor', () => {
 
   it('returns a DoctorReport with checks and exitCode', async () => {
     // Create minimal project structure
-    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await mkdir(join(tempDir, '.mc'), { recursive: true });
     await mkdir(join(tempDir, 'domains'), { recursive: true });
     await mkdir(join(tempDir, '.husky'), { recursive: true });
 
     await writeFile(
-      join(tempDir, '.tib', 'scaffold-config.json'),
+      join(tempDir, '.mc', 'scaffold-config.json'),
       JSON.stringify({ domainIds: [] })
     );
     await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh\necho "hook"');
@@ -42,9 +42,9 @@ describe('runDoctor', () => {
 
   it('reports FAIL when domain config is missing', async () => {
     await mkdir(join(tempDir, 'domains', 'test-domain'), { recursive: true });
-    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await mkdir(join(tempDir, '.mc'), { recursive: true });
     await writeFile(
-      join(tempDir, '.tib', 'scaffold-config.json'),
+      join(tempDir, '.mc', 'scaffold-config.json'),
       JSON.stringify({ domainIds: ['test-domain'] })
     );
 
@@ -56,9 +56,9 @@ describe('runDoctor', () => {
 
   it('exits with code 1 when FAIL present (always strict)', async () => {
     await mkdir(join(tempDir, 'domains', 'bad-domain'), { recursive: true });
-    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await mkdir(join(tempDir, '.mc'), { recursive: true });
     await writeFile(
-      join(tempDir, '.tib', 'scaffold-config.json'),
+      join(tempDir, '.mc', 'scaffold-config.json'),
       JSON.stringify({ domainIds: ['bad-domain'] })
     );
 
@@ -68,11 +68,11 @@ describe('runDoctor', () => {
   });
 
   it('reports PASS for Husky when hook exists', async () => {
-    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await mkdir(join(tempDir, '.mc'), { recursive: true });
     await mkdir(join(tempDir, '.husky'), { recursive: true });
     await mkdir(join(tempDir, 'domains'), { recursive: true });
     await writeFile(
-      join(tempDir, '.tib', 'scaffold-config.json'),
+      join(tempDir, '.mc', 'scaffold-config.json'),
       JSON.stringify({ domainIds: [] })
     );
     await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
@@ -84,11 +84,11 @@ describe('runDoctor', () => {
   });
 
   it('includes all 15 checks in the report', async () => {
-    await mkdir(join(tempDir, '.tib'), { recursive: true });
+    await mkdir(join(tempDir, '.mc'), { recursive: true });
     await mkdir(join(tempDir, 'domains'), { recursive: true });
     await mkdir(join(tempDir, '.husky'), { recursive: true });
     await writeFile(
-      join(tempDir, '.tib', 'scaffold-config.json'),
+      join(tempDir, '.mc', 'scaffold-config.json'),
       JSON.stringify({ domainIds: [] })
     );
     await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
@@ -112,16 +112,16 @@ describe('runDoctor', () => {
   });
 
   describe('layout validation checks', () => {
-    it('PASS when manifest has owned files in .mc/', async () => {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+    it('PASS when manifest has managed files in current installed locations', async () => {
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, 'domains'), { recursive: true });
       await mkdir(join(tempDir, '.husky'), { recursive: true });
-      await mkdir(join(tempDir, '.tib', 'infra', 'modules'), { recursive: true });
+      await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
 
-      await writeFile(join(tempDir, '.tib', 'infra', 'modules', 'app.ts'), '// @mc-scaffold: domain@1.0.0\n');
+      await writeFile(join(tempDir, 'infra', 'modules', 'app.ts'), '// @mc-scaffold: domain@1.0.0\n');
       await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
-      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+      await writeFile(join(tempDir, '.mc', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
 
       const manifest = {
         $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
@@ -132,19 +132,19 @@ describe('runDoctor', () => {
         awsRegion: 'eu-north-1',
         enabledModules: ['domain'],
         files: [
-          { path: '.mc/infra/modules/app.ts', module: 'domain', moduleVersion: '1.0.0',
+          { path: 'infra/modules/app.ts', module: 'domain', moduleVersion: '1.0.0',
             sha256: 'abc', wasTemplate: true, installedAt: '2026-01-01T00:00:00Z', policy: 'managed' as const }
         ]
       };
       await writeFile(join(tempDir, '.mc', 'manifest.json'), JSON.stringify(manifest));
 
       const report = await runDoctor({ projectRoot: tempDir });
-      const check = report.checks.find(c => c.name === 'Layout: owned files in .mc/');
+      const check = report.checks.find(c => c.name === 'Layout: no managed files in legacy locations');
       expect(check?.status).toBe('PASS');
     });
 
-    it('FAIL when owned file is outside .mc/ (old layout)', async () => {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+    it('FAIL when managed file is registered in a legacy location', async () => {
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, 'domains'), { recursive: true });
       await mkdir(join(tempDir, '.husky'), { recursive: true });
@@ -152,7 +152,7 @@ describe('runDoctor', () => {
 
       await writeFile(join(tempDir, 'infra', 'modules', 'app.ts'), '// @mc-scaffold: domain@1.0.0\n');
       await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
-      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+      await writeFile(join(tempDir, '.mc', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
 
       const manifest = {
         $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
@@ -163,25 +163,25 @@ describe('runDoctor', () => {
         awsRegion: 'eu-north-1',
         enabledModules: ['domain'],
         files: [
-          { path: 'infra/modules/app.ts', module: 'domain', moduleVersion: '1.0.0',
+          { path: '.mc/infra/modules/app.ts', module: 'domain', moduleVersion: '1.0.0',
             sha256: 'abc', wasTemplate: true, installedAt: '2026-01-01T00:00:00Z', policy: 'managed' as const }
         ]
       };
       await writeFile(join(tempDir, '.mc', 'manifest.json'), JSON.stringify(manifest));
 
       const report = await runDoctor({ projectRoot: tempDir });
-      const check = report.checks.find(c => c.name === 'Layout: owned files in .mc/');
+      const check = report.checks.find(c => c.name === 'Layout: no managed files in legacy locations');
       expect(check?.status).toBe('FAIL');
     });
 
     it('FAIL when manifest entry points at missing file', async () => {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, 'domains'), { recursive: true });
       await mkdir(join(tempDir, '.husky'), { recursive: true });
 
       await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
-      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+      await writeFile(join(tempDir, '.mc', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
 
       const manifest = {
         $schema: 'https://mc-scaffold.s3.amazonaws.com/schema/manifest.v2.json',
@@ -205,8 +205,8 @@ describe('runDoctor', () => {
   });
 
   describe('--relocate flag', () => {
-    it('moves scaffold-owned files from old layout to .mc/', async () => {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+    it('does not move scaffold-owned files from the current layout', async () => {
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
       await mkdir(join(tempDir, 'domains'), { recursive: true });
@@ -215,7 +215,7 @@ describe('runDoctor', () => {
       const appContent = '// @mc-scaffold: domain@1.0.0\nimport * as cdk from "aws-cdk-lib";\n';
       await writeFile(join(tempDir, 'infra', 'modules', 'app.ts'), appContent);
       await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
-      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+      await writeFile(join(tempDir, '.mc', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
 
       const { computeChecksumString } = await import('../utils/checksum.js');
       const sha256 = computeChecksumString(appContent);
@@ -237,25 +237,25 @@ describe('runDoctor', () => {
 
       const report = await runDoctor({ projectRoot: tempDir, relocate: true });
 
-      // File moved
+      // File left in its current installed location
       const { existsSync } = await import('node:fs');
-      expect(existsSync(join(tempDir, '.mc', 'infra', 'modules', 'app.ts'))).toBe(true);
-      expect(existsSync(join(tempDir, 'infra', 'modules', 'app.ts'))).toBe(false);
+      expect(existsSync(join(tempDir, 'infra', 'modules', 'app.ts'))).toBe(true);
+      expect(existsSync(join(tempDir, '.mc', 'infra', 'modules', 'app.ts'))).toBe(false);
 
       // Summary pass
-      const summary = report.checks.find(c => c.name === 'Relocate: summary');
-      expect(summary?.status).toMatch(/PASS|WARN/);
+      const summary = report.checks.find(c => c.name === 'Relocate: deprecated no-op');
+      expect(summary?.status).toBe('PASS');
     });
 
     it('leaves hand-edited files in place with warning on --relocate', async () => {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
 
       const originalContent = '// @mc-scaffold: domain@1.0.0\noriginal\n';
       const modifiedContent = '// @mc-scaffold: domain@1.0.0\nmodified by user\n';
       await writeFile(join(tempDir, 'infra', 'modules', 'app.ts'), modifiedContent);
-      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+      await writeFile(join(tempDir, '.mc', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
 
       const { computeChecksumString } = await import('../utils/checksum.js');
       const originalSha = computeChecksumString(originalContent); // manifest has original sha
@@ -280,17 +280,17 @@ describe('runDoctor', () => {
       // File left in place
       const { existsSync } = await import('node:fs');
       expect(existsSync(join(tempDir, 'infra', 'modules', 'app.ts'))).toBe(true);
-      expect(existsSync(join(tempDir, '.tib', 'infra', 'modules', 'app.ts'))).toBe(false);
+      expect(existsSync(join(tempDir, '.mc', 'infra', 'modules', 'app.ts'))).toBe(false);
     });
 
-    it('FAIL when no manifest present on --relocate', async () => {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+    it('returns PASS when no manifest present on --relocate', async () => {
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
 
       const report = await runDoctor({ projectRoot: tempDir, relocate: true });
 
-      expect(report.exitCode).toBe(1);
-      const check = report.checks.find(c => c.name === 'Relocate: manifest present');
-      expect(check?.status).toBe('FAIL');
+      expect(report.exitCode).toBe(0);
+      const check = report.checks.find(c => c.name === 'Relocate: deprecated no-op');
+      expect(check?.status).toBe('PASS');
     });
   });
 
@@ -299,8 +299,8 @@ describe('runDoctor', () => {
       expect(DOCTOR_FIX_FLAG).toBe('--fix');
     });
 
-    it('moves scaffold-owned files from old layout to .mc/ and updates manifest', async () => {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+    it('keeps scaffold-owned files in current layout and leaves manifest paths unchanged', async () => {
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
       await mkdir(join(tempDir, 'domains'), { recursive: true });
@@ -309,7 +309,7 @@ describe('runDoctor', () => {
       const appContent = '// @mc-scaffold: domain@1.0.0\nimport * as cdk from "aws-cdk-lib";\n';
       await writeFile(join(tempDir, 'infra', 'modules', 'app.ts'), appContent);
       await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
-      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+      await writeFile(join(tempDir, '.mc', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
 
       const { computeChecksumString } = await import('../utils/checksum.js');
       const sha256 = computeChecksumString(appContent);
@@ -331,41 +331,35 @@ describe('runDoctor', () => {
 
       const report = await runDoctor({ projectRoot: tempDir, fix: true });
 
-      // File moved from old layout to .mc/
+      // File remains in its current installed location
       const { existsSync } = await import('node:fs');
-      expect(existsSync(join(tempDir, '.mc', 'infra', 'modules', 'app.ts'))).toBe(true);
-      expect(existsSync(join(tempDir, 'infra', 'modules', 'app.ts'))).toBe(false);
+      expect(existsSync(join(tempDir, 'infra', 'modules', 'app.ts'))).toBe(true);
+      expect(existsSync(join(tempDir, '.mc', 'infra', 'modules', 'app.ts'))).toBe(false);
 
-      // Manifest updated: old path removed, new path added
+      // Manifest remains on current installed path
       const manifestOnDisk = JSON.parse(
         await (await import('node:fs/promises')).readFile(join(tempDir, '.mc', 'manifest.json'), 'utf-8')
       );
       const paths = manifestOnDisk.files.map((f: { path: string }) => f.path);
-      expect(paths).toContain('.mc/infra/modules/app.ts');
-      expect(paths).not.toContain('infra/modules/app.ts');
+      expect(paths).toContain('infra/modules/app.ts');
+      expect(paths).not.toContain('.mc/infra/modules/app.ts');
 
-      // Report includes the relocation summary
-      const summary = report.checks.find(c => c.name === 'Relocate: summary');
+      // Report includes the relocation no-op check
+      const summary = report.checks.find(c => c.name === 'Relocate: deprecated no-op');
       expect(summary).toBeDefined();
-      expect(summary?.message).toMatch(/1 file\(s\) moved/);
-
-      // Per-file move check
-      const moveCheck = report.checks.find(
-        c => c.name === 'Relocate: infra/modules/app.ts'
-      );
-      expect(moveCheck?.status).toBe('PASS');
+      expect(summary?.status).toBe('PASS');
 
       // Doctor's full report still ran (superset of --relocate)
       expect(report.checks.some(c => c.name === 'Domain configs valid')).toBe(true);
     });
 
-    it('is a no-op on a clean project (exit 0, 0 files moved)', async () => {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+    it('runs the relocation no-op before the full strict report', async () => {
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, 'domains'), { recursive: true });
       await mkdir(join(tempDir, '.husky'), { recursive: true });
 
-      await writeFile(join(tempDir, '.tib', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
+      await writeFile(join(tempDir, '.mc', 'scaffold-config.json'), JSON.stringify({ domainIds: [] }));
       await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
 
       const manifest = {
@@ -383,13 +377,12 @@ describe('runDoctor', () => {
       const report = await runDoctor({ projectRoot: tempDir, fix: true });
 
       // No files moved
-      const summary = report.checks.find(c => c.name === 'Relocate: summary');
+      const summary = report.checks.find(c => c.name === 'Relocate: deprecated no-op');
       expect(summary).toBeDefined();
-      expect(summary?.message).toMatch(/0 file\(s\) moved/);
       expect(summary?.status).toBe('PASS');
 
-      // Clean exit (no FAIL anywhere in the report)
-      expect(report.exitCode).toBe(0);
+      // Full strict doctor still runs after the no-op preflight.
+      expect(report.checks.some(c => c.name === 'Domain configs valid')).toBe(true);
     });
   });
 
@@ -397,11 +390,11 @@ describe('runDoctor', () => {
     /** Build a minimal temp project that passes the W1/W2 baseline checks
      *  so the new W5 checks can be evaluated in isolation. */
     async function buildBaseProject(): Promise<void> {
-      await mkdir(join(tempDir, '.tib'), { recursive: true });
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
       await mkdir(join(tempDir, 'domains'), { recursive: true });
       await mkdir(join(tempDir, '.husky'), { recursive: true });
       await writeFile(
-        join(tempDir, '.tib', 'scaffold-config.json'),
+        join(tempDir, '.mc', 'scaffold-config.json'),
         JSON.stringify({ domainIds: [] })
       );
       await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');

package/src/__tests__/package-freshness.test.ts

@@ -0,0 +1,114 @@
+import { describe, it, expect } from 'vitest';
+import {
+  ActionBackendAccess,
+  type ActionApiExposure,
+  type ApiRegistryEntry,
+  type DomainRegistry,
+  type ActionRegistryEntry,
+} from '@mettlecast/domain-cdk-packer';
+
+/**
+ * Issue #4662 Task D — package freshness self-test.
+ *
+ * This file is the runtime-side companion to `scripts/check-package-freshness.mjs`.
+ * Where the script audits every workspace that consumes a `@mettlecast/*`
+ * package, this file pins the CLI's own expectations against the linked
+ * `@mettlecast/domain-cdk-packer` types. If a developer hand-edits the
+ * linked `dist/` and forgets to rebuild, one of these assertions will
+ * fail at `tsc --noEmit` time — long before the published CLI ends up
+ * in a scaffolded project.
+ *
+ * The test also pins every release-blocker field added by the action-first
+ * hardening work (#4619 → #4662). Adding a new field to the CDK packer
+ * types should make this test fail until the CLI is updated and rebuilt.
+ */
+
+describe('CLI ↔ CDK packer type freshness (#4662 Task D)', () => {
+  it('exposes the canonical ActionBackendAccess union', () => {
+    // If the linked packer drops or renames a backendAccess variant
+    // the assignment below will fail to typecheck. Adding a new variant
+    // (e.g. 'workspace' being reintroduced) is a release-blocker for the
+    // CLI until the linked packer is rebuilt and re-installed.
+    const variants: ActionBackendAccess[] = ['private', 'domain', 'platform'];
+    expect(variants).toHaveLength(3);
+  });
+
+  it('exposes the ActionApiExposure.securityException field added for anonymous routes', () => {
+    const exposure: ActionApiExposure = {
+      type: 'api',
+      path: '/v1/health',
+      method: 'GET',
+      auth: 'none',
+      tenancy: 'none',
+      securityException: { reason: 'public liveness probe; ticket OPS-123' },
+    };
+    expect(exposure.securityException?.reason).toMatch(/OPS-123/);
+  });
+
+  it('exposes the ApiRegistryEntry.securityException field added in #4662', () => {
+    // The build-registry does not populate this field for legacy
+    // `defineApi` entries (they don't carry securityException in
+    // source), but the registry type must declare it so that
+    // future migrations can attach it. This assertion pins the field
+    // shape so the CLI doesn't silently fall behind if a future
+    // packer refactor removes the declaration.
+    const api: ApiRegistryEntry = {
+      kind: 'api',
+      handlerFile: 'src/api.ts',
+      path: '/v1/health',
+      method: 'GET',
+      authType: 'none',
+      securityException: { reason: 'public liveness probe' },
+    };
+    expect(api.securityException?.reason).toMatch(/liveness/);
+  });
+
+  it('exposes the ActionRegistryEntry shape with the latest exposure metadata flags', () => {
+    const action: ActionRegistryEntry = {
+      kind: 'action',
+      handlerFile: 'src/actions/do-thing.ts',
+      backendAccess: 'domain',
+      exposure: { type: 'internal' },
+      idempotent: false,
+    };
+    // The new optional `exposureDeclared` flag carried over from the
+    // CLI validator must be present on the type — otherwise the CLI's
+    // own `runValidate` cannot detect defaulting regressions.
+    expect(action).toHaveProperty('exposure');
+  });
+
+  it('exposes the DomainRegistry schema with the latest fields', () => {
+    const registry: DomainRegistry = {
+      schemaVersion: '1',
+      domainRoot: '/tmp/fake',
+      domain: { kind: 'domain', id: 'test', name: 'Test', tenancy: 'required' },
+      apis: [],
+      webhooks: [],
+      subscribers: [],
+      schedules: [],
+      jobs: [],
+      actions: [],
+      integrations: [],
+      events: [],
+    };
+    expect(registry.schemaVersion).toBe('1');
+  });
+
+  it('does not pin to a fixed @mettlecast/domain-cdk-packer version in package.json', async () => {
+    // Read the CLI's own package.json and assert that the reference to
+    // `@mettlecast/domain-cdk-packer` is a workspace / `*` range. The
+    // publish workflow copies the freshly built packer `dist/` into the
+    // CLI's node_modules before compile, so the CLI must not depend on
+    // a published version.
+    const fs = await import('node:fs/promises');
+    const path = await import('node:path');
+    const url = await import('node:url');
+    const here = url.fileURLToPath(import.meta.url);
+    const cliPkgJsonPath = path.join(path.dirname(here), '..', '..', 'package.json');
+    const raw = await fs.readFile(cliPkgJsonPath, 'utf8');
+    const parsed = JSON.parse(raw);
+    const range = parsed.dependencies?.['@mettlecast/domain-cdk-packer']
+      ?? parsed.devDependencies?.['@mettlecast/domain-cdk-packer'];
+    expect(['*', 'workspace:*']).toContain(range);
+  });
+});

package/src/__tests__/scaffold-src/part-a-layout.test.ts

@@ -10,11 +10,11 @@ const backendLambdaDir = join(repoRoot, 'scaffold-src', 'modules', 'domain');
 const coreDir = join(repoRoot, 'scaffold-src', 'modules', 'core');
 
 describe('scaffold-src layout (Part A)', () => {
-  it('domain has app.ts.tpl under .mc/infra/modules/', () => {
-    expect(existsSync(join(backendLambdaDir, '.mc/infra/modules/app.ts.tpl'))).toBe(true);
+  it('domain does not carry removed .mc/infra scaffold files', () => {
+    expect(existsSync(join(backendLambdaDir, '.mc/infra'))).toBe(false);
   });
 
-  it('domain infra/ directory is removed', () => {
+  it('domain does not carry module-local infra/ files', () => {
     expect(existsSync(join(backendLambdaDir, 'infra'))).toBe(false);
   });
 
@@ -22,17 +22,17 @@ describe('scaffold-src layout (Part A)', () => {
     expect(existsSync(join(backendLambdaDir, 'cdk.json.tpl'))).toBe(true);
     const content = readFileSync(join(backendLambdaDir, 'cdk.json.tpl'), 'utf-8');
     const parsed = JSON.parse(content);
-    expect(parsed.app).toContain('.mc/infra/modules/app.ts');
+    expect(parsed.app).toContain('infra/modules/app.ts');
   });
 
-  it('core has .mc/workflows/ci.yml.tpl', () => {
-    expect(existsSync(join(coreDir, '.mc/workflows/ci.yml.tpl'))).toBe(true);
+  it('core does not carry removed .mc workflow templates', () => {
+    expect(existsSync(join(coreDir, '.mc/workflows'))).toBe(false);
   });
 
-  it('core has .github/workflows/ci.yml seed stub', () => {
-    expect(existsSync(join(coreDir, '.github/workflows/ci.yml'))).toBe(true);
-    const content = readFileSync(join(coreDir, '.github/workflows/ci.yml'), 'utf-8');
-    expect(content).toContain('tib-ci.yml');
+  it('core has current validate-domain workflow', () => {
+    expect(existsSync(join(coreDir, '.github/workflows/validate-domain.yml'))).toBe(true);
+    const content = readFileSync(join(coreDir, '.github/workflows/validate-domain.yml'), 'utf-8');
+    expect(content).toContain('Validate domain primitives');
   });
 
 });

package/src/__tests__/scripts/package-scaffold.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect } from 'vitest';
 
 describe('package-scaffold policy inference', () => {
   function inferPolicyFromPath(filePath: string): string {
-    if (/^infra\//.test(filePath) || /^\.tib\/infra\//.test(filePath) ||
+    if (/^infra\//.test(filePath) ||
         filePath === 'mc-deploy.yml' || /^\.github\/workflows\//.test(filePath)) {
       return 'managed';
     }
@@ -18,10 +18,10 @@ describe('package-scaffold policy inference', () => {
     return 'editable';
   }
 
-  it('returns managed for .mc/infra/ paths', () => {
-    expect(inferPolicyFromPath('.mc/infra/modules/app.ts')).toBe('managed');
-    expect(inferPolicyFromPath('.mc/infra/cdk.json')).toBe('managed');
-    expect(inferPolicyFromPath('.mc/infra/tsconfig.json')).toBe('managed');
+  it('returns managed for infra/ paths', () => {
+    expect(inferPolicyFromPath('infra/modules/app.ts')).toBe('managed');
+    expect(inferPolicyFromPath('infra/cdk.json')).toBe('managed');
+    expect(inferPolicyFromPath('infra/tsconfig.json')).toBe('managed');
   });
 
   it('returns managed for .github/workflows/ paths', () => {

package/src/__tests__/utils/install-file.test.ts

@@ -157,8 +157,8 @@ describe('installScaffoldFile', () => {
 
       const result = await installScaffoldFile(filePath, newContent, 'editable', currentEntry);
       expect(result.status).toBe('update-available');
-      // Verify NO .tib-upgrade file written
-      await expect(access(filePath + '.tib-upgrade')).rejects.toThrow();
+      // Verify NO .mc-upgrade file written
+      await expect(access(filePath + '.mc-upgrade')).rejects.toThrow();
       // Verify original file NOT overwritten
       const diskContent = await readFile(filePath, 'utf-8');
       expect(diskContent).toBe(existingContent);

package/src/__tests__/utils/manifest.test.ts

@@ -57,8 +57,8 @@ describe('manifest utilities', () => {
       expect(inferPolicyFromPath('infra/main.tf')).toBe('managed');
     });
 
-    it('returns editable for .mc/infra/ paths', () => {
-      expect(inferPolicyFromPath('.mc/infra/stack.ts')).toBe('editable');
+    it('returns editable for unrecognised .mc paths', () => {
+      expect(inferPolicyFromPath('.mc/custom/stack.ts')).toBe('editable');
     });
 
     it('returns managed for mc-deploy.yml', () => {