@mettlecast/domain-cli 0.2.59 → 0.2.61

package/dist/builder/build-registry.d.ts

@@ -1,4 +1,4 @@
-import type { DomainRegistry } from '@mettlecast/domain-cdk-packer';
+import type { DomainRegistry } from '../types.js';
 /**
  * Result of a registry build operation.
  */

package/dist/builder/build-registry.js

@@ -1,6 +1,90 @@
 import { relative, resolve } from 'node:path';
 import { walkDomainDir } from '../utils/file-helpers.js';
 import { loadModuleExports } from './load-module.js';
+/**
+ * Coerce a raw value into a valid backendAccess scope, defaulting to
+ * 'private' when the value is missing or unrecognized. Used by the
+ * builder when reading the new-style `backendAccess` field directly.
+ */
+function toBackendAccess(raw) {
+    return raw === 'domain' || raw === 'platform' ? raw : 'private';
+}
+/**
+ * Map a legacy `visibility` scope to a `backendAccess` scope for the
+ * action-first migration. The legacy `workspace` scope (which previously
+ * permitted unauthenticated Function URL exposure) collapses to `domain`
+ * so that all cross-domain callers must go through `ctx.actions`.
+ */
+function visibilityToBackendAccess(visibility) {
+    if (visibility === 'workspace')
+        return 'domain';
+    if (visibility === 'domain')
+        return 'domain';
+    return 'private';
+}
+/**
+ * Best-effort reverse mapping from `backendAccess` to the legacy
+ * `visibility` field. Used to keep the deprecated field populated so
+ * existing CDK constructs that read it continue to behave the same way.
+ *
+ * - private  -> private
+ * - domain   -> domain
+ * - platform -> workspace (closest legacy equivalent for platform-level)
+ */
+function backendAccessToVisibility(backendAccess) {
+    if (backendAccess === 'platform')
+        return 'workspace';
+    return backendAccess;
+}
+/**
+ * Type guard + sanitizer for an action's `exposure` field. Returns a
+ * well-typed `ActionExposure` (extended with `authDeclared` /
+ * `tenancyDeclared` tracking flags) or the provided fallback when the
+ * raw value does not match a supported exposure shape.
+ *
+ * The `authDeclared` / `tenancyDeclared` flags record whether the source
+ * code explicitly declared each field, or whether the builder fell back
+ * to the safe default. They are validation-only and consumed by the
+ * domain CLI's validate command (Wave 6 Task 6.1) to enforce the
+ * action-first security model (#4619).
+ */
+function toExposure(raw, fallback) {
+    if (!raw || typeof raw !== 'object')
+        return fallback;
+    const candidate = raw;
+    if (candidate.type === 'internal')
+        return { type: 'internal' };
+    if (candidate.type !== 'api')
+        return fallback;
+    // Best-effort validation of api exposure fields; any missing required
+    // string field falls back to the supplied default exposure.
+    const api = raw;
+    if (typeof api.path !== 'string' || typeof api.method !== 'string')
+        return fallback;
+    const authRaw = api.auth;
+    const tenancyRaw = api.tenancy;
+    const auth = authRaw === 'required' || authRaw === 'none' || authRaw === 'service' ? authRaw : 'required';
+    const tenancy = tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system' ? tenancyRaw : 'required';
+    const out = {
+        type: 'api',
+        path: api.path,
+        method: api.method,
+        auth,
+        tenancy,
+        authDeclared: authRaw === 'required' || authRaw === 'none' || authRaw === 'service',
+        tenancyDeclared: tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system',
+    };
+    if (Array.isArray(api.roles)) {
+        out.roles = api.roles.filter((r) => typeof r === 'string');
+    }
+    if (api.securityException && typeof api.securityException === 'object') {
+        const reason = api.securityException.reason;
+        if (typeof reason === 'string') {
+            out.securityException = { reason };
+        }
+    }
+    return out;
+}
 /** Returns true if a value looks like a JSON Schema object (has a 'type' or '$schema' property). */
 function isJsonSchema(v) {
     return v !== null && typeof v === 'object' && !Array.isArray(v) &&
@@ -47,7 +131,7 @@ export async function buildRegistry(domainRoot) {
     if (!domainRaw) {
         // Emit any suppressed tsx load errors to stderr before throwing so they appear in CI logs.
         for (const w of warnings)
-            process.stderr.write(`[tib validate] ${w}\n`);
+            process.stderr.write(`[mc-domain-module validate] ${w}\n`);
         throw new Error(`buildRegistry: no 'domain' export found in ${paths.domain}`);
     }
     const domain = {
@@ -57,8 +141,7 @@ export async function buildRegistry(domainRoot) {
         tenancy: String(domainRaw['tenancy']),
         defaultDeployment: deployment(domainRaw),
     };
-    const [apiExports, webhookExports, subscriberExports, actionExports, scheduleExports, jobExports, integrationExports, eventExports] = await Promise.all([
-        Promise.all(paths.apis.map(load)),
+    const [webhookExports, subscriberExports, actionExports, scheduleExports, jobExports, integrationExports, eventExports] = await Promise.all([
         Promise.all(paths.webhooks.map(load)),
         Promise.all(paths.subscribers.map(load)),
         Promise.all(paths.actions.map(load)),
@@ -67,39 +150,6 @@ export async function buildRegistry(domainRoot) {
         Promise.all(paths.integrations.map(load)),
         paths.publishes ? load(paths.publishes) : Promise.resolve([]),
     ]);
-    const VALID_API_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
-    const apis = paths.apis.flatMap((filePath, i) => (apiExports[i] ?? [])
-        .filter(e => e['_kind'] === 'api')
-        .map(e => {
-        const rawMethod = typeof e['method'] === 'string' ? e['method'].toUpperCase() : '';
-        if (!rawMethod || !VALID_API_METHODS.has(rawMethod)) {
-            warnings.push(`${relPath(filePath)}: defineApi "${e['id']}" has invalid or missing method "${rawMethod || '(none)'}". Use one of: ${[...VALID_API_METHODS].join(', ')}.`);
-        }
-        const rawVersions = e['versions'];
-        const versionSnapshots = rawVersions
-            ? Object.entries(rawVersions).map(([ver, v]) => ({
-                version: ver,
-                requestSchema: isJsonSchema(v?.input) ? v.input : undefined,
-                responseSchema: isJsonSchema(v?.output) ? v.output : undefined,
-            }))
-            : [];
-        const latestVersion = versionSnapshots[versionSnapshots.length - 1];
-        return {
-            id: String(e['id']),
-            kind: 'api',
-            handlerFile: relPath(filePath),
-            path: String(e['path']),
-            method: VALID_API_METHODS.has(rawMethod) ? rawMethod : 'GET',
-            authType: e['auth']?.type ?? 'jwt',
-            description: typeof e['description'] === 'string' ? e['description'] : undefined,
-            deployment: deployment(e),
-            outboundAccess: outboundAccess(e),
-            requestSchema: latestVersion?.requestSchema,
-            responseSchema: latestVersion?.responseSchema,
-            versions: versionSnapshots.length > 0 ? versionSnapshots : undefined,
-            examples: e['examples'],
-        };
-    }));
     const webhooks = paths.webhooks.flatMap((filePath, i) => (webhookExports[i] ?? [])
         .filter(e => e['_kind'] === 'webhook')
         .map(e => ({
@@ -149,18 +199,49 @@ export async function buildRegistry(domainRoot) {
     })));
     const actions = paths.actions.flatMap((filePath, i) => (actionExports[i] ?? [])
         .filter(e => e['_kind'] === 'action')
-        .map(e => ({
-        id: String(e['id']),
-        kind: 'action',
-        handlerFile: relPath(filePath),
-        visibility: String(e['visibility']),
-        idempotent: Boolean(e['idempotent'] ?? false),
-        description: typeof e['description'] === 'string' ? e['description'] : undefined,
-        deployment: deployment(e),
-        outboundAccess: outboundAccess(e),
-        inputSchema: isJsonSchema(e['input']) ? e['input'] : undefined,
-        outputSchema: isJsonSchema(e['output']) ? e['output'] : undefined,
-    })));
+        .map(e => {
+        // Resolve backendAccess. New-style actions carry `backendAccess`
+        // directly. Legacy actions only carry `visibility`; in that case
+        // we collapse workspace -> domain per the migration spec, and we
+        // also remember the legacy flag so we can default exposure to
+        // `{ type: 'internal' }` for actions that have not opted in yet.
+        const hasBackendAccess = 'backendAccess' in e;
+        const rawBackendAccess = e['backendAccess'];
+        const rawVisibility = e['visibility'];
+        const backendAccess = hasBackendAccess
+            ? toBackendAccess(rawBackendAccess)
+            : visibilityToBackendAccess(rawVisibility);
+        const legacyVisibility = backendAccessToVisibility(backendAccess);
+        // Resolve exposure. New-style actions must declare their exposure;
+        // legacy actions that did not opt in default to `{ type: 'internal' }`
+        // so existing internal-only behavior is preserved during migration.
+        const rawExposure = e['exposure'];
+        const exposure = toExposure(rawExposure, { type: 'internal' });
+        // Record whether the source explicitly declared the `exposure` field.
+        // Validation-only; consumed by the domain CLI's validate command
+        // (Wave 6 Task 6.1) to enforce `ACTION_EXPOSURE_REQUIRED`.
+        const exposureDeclared = rawExposure !== undefined && rawExposure !== null
+            && typeof rawExposure === 'object';
+        return {
+            id: String(e['id']),
+            kind: 'action',
+            handlerFile: relPath(filePath),
+            backendAccess,
+            exposure,
+            exposureDeclared,
+            // Keep the legacy field populated so CDK constructs that still
+            // read `visibility` (e.g. action-construct.ts) keep working
+            // through the migration window. New constructs should read
+            // `backendAccess` and `exposure` instead.
+            visibility: legacyVisibility,
+            idempotent: Boolean(e['idempotent'] ?? false),
+            description: typeof e['description'] === 'string' ? e['description'] : undefined,
+            deployment: deployment(e),
+            outboundAccess: outboundAccess(e),
+            inputSchema: isJsonSchema(e['input']) ? e['input'] : undefined,
+            outputSchema: isJsonSchema(e['output']) ? e['output'] : undefined,
+        };
+    }));
     const integrations = paths.integrations.flatMap((_filePath, i) => (integrationExports[i] ?? [])
         .filter(e => e['_kind'] === 'integration')
         .map(e => ({
@@ -183,7 +264,6 @@ export async function buildRegistry(domainRoot) {
         schemaVersion: '1',
         domainRoot,
         domain,
-        apis,
         webhooks,
         subscribers,
         schedules,

package/dist/builder/build-types.d.ts

@@ -1,4 +1,4 @@
-import type { DomainRegistry } from '@mettlecast/domain-cdk-packer';
+import type { DomainRegistry } from '../types.js';
 /**
  * Generate a .d.ts file declaring typed `ctx.actions.call(actionId, input)`
  * overrides for the union of actions across all registries. The generated

package/dist/builder/load-module.d.ts

@@ -1,7 +1,7 @@
 /**
  * The set of `_kind` discriminant values that identify a domain primitive export.
  */
-export declare const PRIMITIVE_KINDS: Set<"api" | "domain" | "webhook" | "subscriber" | "schedule" | "job" | "action" | "integration" | "event">;
+export declare const PRIMITIVE_KINDS: Set<"domain" | "api" | "webhook" | "subscriber" | "schedule" | "job" | "action" | "integration" | "event">;
 /**
  * A raw primitive export extracted from a domain source file.
  * Functions (handler) and Zod schemas (input/output/versions) are stripped

package/dist/builder/load-module.js

@@ -95,9 +95,9 @@ process.stdout.write(JSON.stringify(results));
 export async function loadModuleExports(absoluteFilePath) {
     // Use a subdir of the project root rather than OS tmpdir so that ESM import
     // resolution can walk up and find node_modules packages like zod-to-json-schema.
-    const tibTmpDir = join(process.cwd(), '.tib', 'tmp');
-    await mkdir(tibTmpDir, { recursive: true }).catch(() => undefined);
-    const tempPath = join(tibTmpDir, `tib-load-${randomBytes(8).toString('hex')}.mts`);
+    const mcTmpDir = join(process.cwd(), '.mc', 'tmp');
+    await mkdir(mcTmpDir, { recursive: true }).catch(() => undefined);
+    const tempPath = join(mcTmpDir, `mc-load-${randomBytes(8).toString('hex')}.mts`);
     await writeFile(tempPath, makeEvalScript(absoluteFilePath), 'utf8');
     try {
         return await new Promise((resolve, reject) => {

package/dist/cli.js

@@ -67,7 +67,7 @@ program
 });
 program
     .command('dev <domain>')
-    .description('Start a local HTTP server simulating API Gateway for all defineApi handlers')
+    .description('Start a local HTTP server simulating API Gateway for all API-exposed defineAction handlers')
     .option('--port <n>', 'Port to listen on', '3000')
     .action(async (domain, opts) => {
     await runDev({ domainRoot: domain, port: opts.port ? parseInt(opts.port, 10) : 3000 });
@@ -75,9 +75,9 @@ program
 program
     .command('build-catalog')
     .description('Merge all per-domain registry files into .mc/domain-registry.json for TIB sync')
-    .option('--tib-dir <path>', 'Path to the .tib directory (defaults to .tib in cwd)')
+    .option('--mc-dir <path>', 'Path to the .mc registry directory (defaults to .mc in cwd)')
     .action(async (opts) => {
-    await runBuildCatalog(opts.tibDir);
+    await runBuildCatalog(opts.mcDir);
 });
 program
     .command('add-domain <id>')

package/dist/commands/add-api.js

@@ -48,7 +48,7 @@ export async function runAddApi(opts) {
     catch {
         throw new Error(`Domain "${opts.domain}" not found at ${domainDir}`);
     }
-    const apiFilePath = join(domainDir, 'api', `${opts.id}.ts`);
+    const apiFilePath = join(domainDir, 'actions', `${opts.id}.ts`);
     // Refuse if API already exists
     try {
         await access(apiFilePath);
@@ -74,7 +74,7 @@ export async function runAddApi(opts) {
     // Write API file
     await writeFile(apiFilePath, apiContent);
     // Create fixture with the input schema's default shape as the example payload
-    const apiTestDir = join(domainDir, 'api', '__tests__');
+    const apiTestDir = join(domainDir, 'actions', '__tests__');
     await mkdir(apiTestDir, { recursive: true });
     await writeFile(join(apiTestDir, `${opts.id}.fixture.json`), apiFixtureSkeleton(opts.domain, opts.id, exampleBody));
     cliLogger.info({ domain: opts.domain, api: opts.id, method: opts.method ?? 'GET', pattern: opts.pattern ?? 'skeleton' }, 'API added');

package/dist/commands/add-domain.js

@@ -34,13 +34,13 @@ export async function runAddDomain(opts) {
         }
     }
     // Create directory structure
-    await mkdir(join(domainDir, 'api', '__tests__'), { recursive: true });
+    await mkdir(join(domainDir, 'actions', '__tests__'), { recursive: true });
     await mkdir(join(domainDir, 'subscribers'), { recursive: true });
     await mkdir(join(domainDir, 'publishes'), { recursive: true });
     // Write skeleton files
     await writeFile(join(domainDir, 'domain.config.ts'), domainConfigTemplate(opts.id, opts.tenancy));
-    await writeFile(join(domainDir, 'api', 'example.ts'), apiSkeletonTemplate(opts.id, 'example', opts.tenancy));
-    await writeFile(join(domainDir, 'api', '__tests__', 'example.fixture.json'), apiFixtureSkeleton(opts.id, 'example'));
+    await writeFile(join(domainDir, 'actions', 'example.ts'), apiSkeletonTemplate(opts.id, 'example', opts.tenancy));
+    await writeFile(join(domainDir, 'actions', '__tests__', 'example.fixture.json'), apiFixtureSkeleton(opts.id, 'example'));
     await writeFile(join(domainDir, 'publishes', 'events.ts'), eventsSkeletonTemplate(opts.id));
     await writeFile(join(domainDir, 'CLAUDE.md'), claudeMdTemplate(opts.id));
     await writeFile(join(domainDir, 'README.md'), readmeTemplate(opts.id));
@@ -66,6 +66,6 @@ export async function runAddDomain(opts) {
     await addDomainToScaffoldConfig(opts.id, configRoot);
     cliLogger.info({ id: opts.id, dir: domainDir }, 'Domain scaffolded');
     // eslint-disable-next-line no-console
-    console.log(`\n✓ Domain "${opts.id}" added at ${domainDir}\nNext: edit api/example.ts, ` +
+    console.log(`\n✓ Domain "${opts.id}" added at ${domainDir}\nNext: edit actions/example.ts, ` +
         `then run \`mc-domain-module build ${opts.id}\` to generate the registry.`);
 }

package/dist/commands/add-fixture-factory.js

@@ -37,18 +37,17 @@ export async function runAddFixtureFactory(options) {
     const projectRoot = options.projectRoot ?? process.cwd();
     const domain = options.domain;
     const apiId = options.apiId;
-    const apiFile = join(projectRoot, 'domains', domain, 'api', `${apiId}.ts`);
+    const apiFile = join(projectRoot, 'domains', domain, 'actions', `${apiId}.ts`);
     await access(apiFile).catch(() => {
-        throw new Error(`API file not found: ${apiFile}. Run add-api first.`);
+        throw new Error(`Action file not found: ${apiFile}. Run add-api first.`);
     });
-    // Read the API file to extract the input type name
+    // Read the action file to extract the input type name
     const content = await readFile(apiFile, 'utf8');
-    const outputTypeArg = content.match(/import\s+\{\s*[\w\s,]*\s*\}\s+from\s+['"]@mettlecast/);
-    const factoryFile = join(projectRoot, 'domains', domain, 'api', '__tests__', `${apiId}.factory.ts`);
+    const factoryFile = join(projectRoot, 'domains', domain, 'actions', '__tests__', `${apiId}.factory.ts`);
     const factoryContent = FACTORY_TEMPLATE
         .replace(/\{domain\}/g, domain)
         .replace(/\{apiId\}/g, apiId);
-    await mkdir(join(projectRoot, 'domains', domain, 'api', '__tests__'), { recursive: true });
+    await mkdir(join(projectRoot, 'domains', domain, 'actions', '__tests__'), { recursive: true });
     await writeFile(factoryFile, factoryContent, 'utf8');
     cliLogger.info({ factoryFile }, 'add-fixture-factory: factory written');
     return factoryFile;

package/dist/commands/build-catalog.d.ts

@@ -1,30 +1,15 @@
-/** A single API entry in the catalog. */
-export interface CatalogApi {
-    id: string;
-    domainId: string;
-    path: string;
-    method: string;
-    authType: string;
-    description?: string;
-    requestSchema?: Record<string, unknown>;
-    responseSchema?: Record<string, unknown>;
-    versions?: Array<{
-        version: string;
-        requestSchema?: Record<string, unknown>;
-        responseSchema?: Record<string, unknown>;
-    }>;
-    examples?: {
-        request?: Record<string, unknown>;
-        response?: Record<string, unknown>;
-    };
-}
 /** A single action entry in the catalog. */
 export interface CatalogAction {
     id: string;
     domainId: string;
-    visibility: string;
+    backendAccess: string;
+    exposure: Record<string, unknown>;
+    exposureDeclared?: boolean;
     idempotent: boolean;
     description?: string;
+    handlerFile?: string;
+    deployment?: Record<string, unknown>;
+    outboundAccess?: string;
     inputSchema?: Record<string, unknown>;
     outputSchema?: Record<string, unknown>;
 }
@@ -81,7 +66,6 @@ export interface DomainCatalog {
     version: 2;
     generatedAt: string;
     domains: CatalogDomain[];
-    apis: CatalogApi[];
     actions: CatalogAction[];
     events: CatalogEvent[];
     subscribers: CatalogSubscriber[];
@@ -92,7 +76,7 @@ export interface DomainCatalog {
 /**
  * Build the combined domain catalog from all per-domain registry files.
  * Reads .mc/{domain}-registry.json files and merges them into .mc/domain-registry.json.
- * @param tibDir - Path to the .tib directory. Defaults to .tib in cwd.
+ * @param registryDir - Path to the .mc registry directory. Defaults to .mc in cwd.
  * @returns The written catalog.
  */
-export declare function runBuildCatalog(tibDir?: string): Promise<DomainCatalog>;
+export declare function runBuildCatalog(registryDir?: string): Promise<DomainCatalog>;

package/dist/commands/build-catalog.js

@@ -4,28 +4,27 @@ import { cliLogger } from '../utils/logger.js';
 /**
  * Build the combined domain catalog from all per-domain registry files.
  * Reads .mc/{domain}-registry.json files and merges them into .mc/domain-registry.json.
- * @param tibDir - Path to the .tib directory. Defaults to .tib in cwd.
+ * @param registryDir - Path to the .mc registry directory. Defaults to .mc in cwd.
  * @returns The written catalog.
  */
-export async function runBuildCatalog(tibDir) {
-    const dir = tibDir ? resolve(tibDir) : join(process.cwd(), '.tib');
+export async function runBuildCatalog(registryDir) {
+    const dir = registryDir ? resolve(registryDir) : join(process.cwd(), '.mc');
     // Find all per-domain registry files
     let files;
     try {
         files = await readdir(dir);
     }
     catch {
-        throw new Error(`build-catalog: .tib directory not found at ${dir}. Run tib build first.`);
+        throw new Error(`build-catalog: .mc registry directory not found at ${dir}. Run mc-domain-module build first.`);
     }
     const registryFiles = files.filter(f => f.endsWith('-registry.json') && f !== 'domain-registry.json');
     if (registryFiles.length === 0) {
-        throw new Error(`build-catalog: no domain registry files found in ${dir}. Run tib build <domain> first.`);
+        throw new Error(`build-catalog: no domain registry files found in ${dir}. Run mc-domain-module build <domain> first.`);
     }
     const catalog = {
         version: 2,
         generatedAt: new Date().toISOString(),
         domains: [],
-        apis: [],
         actions: [],
         events: [],
         subscribers: [],
@@ -55,29 +54,19 @@ export async function runBuildCatalog(tibDir) {
             tenancy: String(domainEntry['tenancy'] ?? 'none'),
             description: domainEntry['description'],
         });
-        const apis = registry['apis'] ?? [];
-        for (const api of apis) {
-            catalog.apis.push({
-                id: String(api['id']),
-                domainId,
-                path: String(api['path']),
-                method: String(api['method'] ?? 'ANY'),
-                authType: String(api['authType'] ?? 'jwt'),
-                description: api['description'],
-                requestSchema: api['requestSchema'],
-                responseSchema: api['responseSchema'],
-                versions: api['versions'],
-                examples: api['examples'],
-            });
-        }
         const actions = registry['actions'] ?? [];
         for (const action of actions) {
             catalog.actions.push({
                 id: String(action['id']),
                 domainId,
-                visibility: String(action['visibility'] ?? 'private'),
+                backendAccess: String(action['backendAccess'] ?? 'private'),
+                exposure: action['exposure'] ?? { type: 'internal' },
+                exposureDeclared: action['exposureDeclared'],
                 idempotent: Boolean(action['idempotent'] ?? false),
                 description: action['description'],
+                handlerFile: action['handlerFile'],
+                deployment: action['deployment'],
+                outboundAccess: action['outboundAccess'],
                 inputSchema: action['inputSchema'],
                 outputSchema: action['outputSchema'],
             });
@@ -135,6 +124,6 @@ export async function runBuildCatalog(tibDir) {
     await mkdir(mcDir, { recursive: true });
     const outPath = join(mcDir, 'domain-registry.json');
     await writeFile(outPath, JSON.stringify(catalog), 'utf8');
-    cliLogger.info({ outPath, domains: catalog.domains.length, apis: catalog.apis.length, actions: catalog.actions.length, events: catalog.events.length, jobs: catalog.jobs.length, schedules: catalog.schedules.length, integrations: catalog.integrations.length }, 'Domain catalog written');
+    cliLogger.info({ outPath, domains: catalog.domains.length, actions: catalog.actions.length, events: catalog.events.length, jobs: catalog.jobs.length, schedules: catalog.schedules.length, integrations: catalog.integrations.length }, 'Domain catalog written');
     return catalog;
 }

package/dist/commands/build-flows.js

@@ -253,7 +253,7 @@ async function loadFlowsFromDir(dir, owningDomainOverride) {
  */
 export async function runBuildFlows(options) {
     const projectRoot = options.projectRoot ?? process.cwd();
-    const outFile = options.outFile ?? join(projectRoot, '.tib', 'flows-registry.json');
+    const outFile = options.outFile ?? join(projectRoot, '.mc', 'flows-registry.json');
     cliLogger.info({ projectRoot }, 'Building flows registry');
     const allEntries = [];
     const seenIds = new Set();

package/dist/commands/build.js

@@ -15,7 +15,7 @@ export async function runBuild(options) {
     const domainId = basename(domainRoot);
     const outFile = options.outFile
         ? resolve(options.outFile)
-        : join(process.cwd(), '.tib', `${domainId}-registry.json`);
+        : join(process.cwd(), '.mc', `${domainId}-registry.json`);
     cliLogger.info({ domainRoot }, 'Building domain registry');
     const { registry, warnings } = await buildRegistry(domainRoot);
     for (const w of warnings) {
@@ -23,17 +23,18 @@ export async function runBuild(options) {
     }
     await mkdir(join(outFile, '..'), { recursive: true });
     await writeFile(outFile, JSON.stringify(registry), 'utf8');
-    cliLogger.info({ outFile, apis: registry.apis.length, events: registry.events.length }, 'Registry written');
+    const apiExposedActions = registry.actions.filter(action => action.exposure.type === 'api').length;
+    cliLogger.info({ outFile, apiExposedActions, events: registry.events.length }, 'Registry written');
     // Discover all sibling registries and emit aggregated types
-    const tibDir = join(process.cwd(), '.tib');
-    const registryFiles = (await readdir(tibDir)).filter(f => f.endsWith('-registry.json'));
+    const registryDir = join(outFile, '..');
+    const registryFiles = (await readdir(registryDir)).filter(f => f.endsWith('-registry.json'));
     const allRegistries = [];
     for (const f of registryFiles) {
-        const raw = await readFile(join(tibDir, f), 'utf8');
+        const raw = await readFile(join(registryDir, f), 'utf8');
         allRegistries.push(JSON.parse(raw));
     }
     const typesContent = buildActionsTypes(allRegistries);
-    const typesFile = join(tibDir, 'actions-types.d.ts');
+    const typesFile = join(registryDir, 'actions-types.d.ts');
     await writeFile(typesFile, typesContent);
     cliLogger.info({ outFile: typesFile }, 'Types file written');
     return outFile;

package/dist/commands/check-hashes.js

@@ -10,14 +10,14 @@ import { cliLogger } from '../utils/logger.js';
  */
 export async function runCheckHashes(opts = {}) {
     const root = opts.projectRoot ?? process.cwd();
-    const manifestPath = join(root, '.tib', 'modules-hashes.json');
+    const manifestPath = join(root, '.mc', 'modules-hashes.json');
     const modulesDir = join(root, 'infra', 'modules');
     let manifest;
     try {
         manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
     }
     catch (err) {
-        throw new Error(`tib check-hashes: cannot read ${manifestPath} (${err.message}). Re-scaffold to regenerate the manifest.`);
+        throw new Error(`mc-domain-module check-hashes: cannot read ${manifestPath} (${err.message}). Re-scaffold to regenerate the manifest.`);
     }
     const drifted = [];
     const missing = [];

package/dist/commands/create-project.js

@@ -160,7 +160,7 @@ export async function runCreateProject(opts) {
         const orderedModules = topoSort(modulesJson.modules, selectedIds);
         // 5. Prepare output directory
         await mkdir(outputDir, { recursive: true });
-        await mkdir(join(outputDir, '.tib'), { recursive: true });
+        await mkdir(join(outputDir, '.mc'), { recursive: true });
         // 6. Get CLI version from package.json
         let cliVersion = '0.0.0';
         try {

package/dist/commands/dev.js

@@ -21,7 +21,7 @@ export async function startDev(options) {
     for (const w of warnings) {
         cliLogger.warn(w);
     }
-    cliLogger.info({ domain: registry.domain.id, apis: registry.apis.length, port }, 'Starting local dev server');
+    cliLogger.info({ domain: registry.domain.id, apiActions: registry.actions.filter(a => a.exposure?.type === 'api').length, port }, 'Starting local dev server');
     const server = await createApiServer({ port, registry, domainRoot });
     // Spawn Vite if frontend/ exists; skip with warning otherwise.
     const frontendDir = join(projectRoot, 'frontend');

package/dist/commands/doctor.d.ts

@@ -11,15 +11,13 @@ export declare const DOCTOR_FIX_FLAG = "--fix";
 export interface DoctorOptions {
     /** Root directory of the project (defaults to cwd). */
     projectRoot?: string;
-    /** Flag to run relocation of old-layout scaffold files to new layout. */
+    /** Deprecated legacy flag retained as a no-op for older automation. */
     relocate?: boolean;
     /**
-     * Auto-remediate before reporting. --fix is a superset of --relocate: it
-     * first runs the relocation routine (auto-moves owned scaffold files outside
-     * .mc/ into .mc/ and updates .mc/manifest.json), then continues with the
-     * full doctor report. On a project that is already clean, --fix is a no-op
-     * (0 files moved, exit 0). Does NOT auto-generate missing fixtures
-     * (deferred).
+     * Auto-remediate before reporting. The legacy relocation routine is now a
+     * no-op because current scaffold manifests intentionally track managed files
+     * in their installed project locations (infra/modules, domains, .github, etc.).
+     * Does NOT auto-generate missing fixtures (deferred).
      */
     fix?: boolean;
     /**