@mettlecast/domain-cli 0.2.59 → 0.2.61

package/src/builder/build-registry.ts

@@ -1,22 +1,123 @@
 import { relative, resolve } from 'node:path';
 import type {
   DomainRegistry,
-  ApiRegistryEntry,
-  ApiVersionSnapshot,
+  ActionRegistryEntry,
   SchemaSnapshot,
   WebhookRegistryEntry,
   SubscriberRegistryEntry,
   ScheduleRegistryEntry,
   JobRegistryEntry,
-  ActionRegistryEntry,
   IntegrationRegistryEntry,
   EventRegistryEntry,
   DomainRegistryEntry,
   SerialDeploymentConfig,
-} from '@mettlecast/domain-cdk-packer';
+} from '../types.js';
 import { walkDomainDir } from '../utils/file-helpers.js';
 import { loadModuleExports, type RawPrimitiveExport } from './load-module.js';
 
+// Issue #4689: the legacy `defineApi` primitive was removed from
+// `@mettlecast/domain-runtime`. The only HTTP endpoint surface in
+// the new registry is `actions[]` whose `exposure.type === 'api'`.
+
+type ActionBackendAccess = 'private' | 'domain' | 'platform';
+
+type ActionExposure =
+  | { type: 'internal' }
+  | {
+    type: 'api';
+    path: string;
+    method: string;
+    auth: 'required' | 'none' | 'service';
+    tenancy: 'required' | 'none' | 'system';
+    roles?: string[];
+    securityException?: { reason: string };
+    authDeclared?: boolean;
+    tenancyDeclared?: boolean;
+  };
+
+/**
+ * Coerce a raw value into a valid backendAccess scope, defaulting to
+ * 'private' when the value is missing or unrecognized. Used by the
+ * builder when reading the new-style `backendAccess` field directly.
+ */
+function toBackendAccess(raw: unknown): ActionBackendAccess {
+  return raw === 'domain' || raw === 'platform' ? raw : 'private';
+}
+
+/**
+ * Map a legacy `visibility` scope to a `backendAccess` scope for the
+ * action-first migration. The legacy `workspace` scope (which previously
+ * permitted unauthenticated Function URL exposure) collapses to `domain`
+ * so that all cross-domain callers must go through `ctx.actions`.
+ */
+function visibilityToBackendAccess(visibility: unknown): ActionBackendAccess {
+  if (visibility === 'workspace') return 'domain';
+  if (visibility === 'domain') return 'domain';
+  return 'private';
+}
+
+/**
+ * Best-effort reverse mapping from `backendAccess` to the legacy
+ * `visibility` field. Used to keep the deprecated field populated so
+ * existing CDK constructs that read it continue to behave the same way.
+ *
+ * - private  -> private
+ * - domain   -> domain
+ * - platform -> workspace (closest legacy equivalent for platform-level)
+ */
+function backendAccessToVisibility(backendAccess: ActionBackendAccess): 'private' | 'domain' | 'workspace' {
+  if (backendAccess === 'platform') return 'workspace';
+  return backendAccess;
+}
+
+/**
+ * Type guard + sanitizer for an action's `exposure` field. Returns a
+ * well-typed `ActionExposure` (extended with `authDeclared` /
+ * `tenancyDeclared` tracking flags) or the provided fallback when the
+ * raw value does not match a supported exposure shape.
+ *
+ * The `authDeclared` / `tenancyDeclared` flags record whether the source
+ * code explicitly declared each field, or whether the builder fell back
+ * to the safe default. They are validation-only and consumed by the
+ * domain CLI's validate command (Wave 6 Task 6.1) to enforce the
+ * action-first security model (#4619).
+ */
+function toExposure(raw: unknown, fallback: ActionExposure): ActionExposure {
+  if (!raw || typeof raw !== 'object') return fallback;
+  const candidate = raw as { type?: unknown };
+  if (candidate.type === 'internal') return { type: 'internal' };
+  if (candidate.type !== 'api') return fallback;
+  // Best-effort validation of api exposure fields; any missing required
+  // string field falls back to the supplied default exposure.
+  const api = raw as { path?: unknown; method?: unknown; auth?: unknown; tenancy?: unknown; roles?: unknown; securityException?: unknown };
+  if (typeof api.path !== 'string' || typeof api.method !== 'string') return fallback;
+  const authRaw = api.auth;
+  const tenancyRaw = api.tenancy;
+  const auth: 'required' | 'none' | 'service' =
+    authRaw === 'required' || authRaw === 'none' || authRaw === 'service' ? authRaw : 'required';
+  const tenancy: 'required' | 'none' | 'system' =
+    tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system' ? tenancyRaw : 'required';
+  const out: ActionExposure & { type: 'api'; authDeclared?: boolean; tenancyDeclared?: boolean } = {
+    type: 'api',
+    path: api.path,
+    method: api.method,
+    auth,
+    tenancy,
+    authDeclared: authRaw === 'required' || authRaw === 'none' || authRaw === 'service',
+    tenancyDeclared: tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system',
+  };
+  if (Array.isArray(api.roles)) {
+    out.roles = api.roles.filter((r): r is string => typeof r === 'string');
+  }
+  if (api.securityException && typeof api.securityException === 'object') {
+    const reason = (api.securityException as { reason?: unknown }).reason;
+    if (typeof reason === 'string') {
+      out.securityException = { reason };
+    }
+  }
+  return out;
+}
+
 /** Returns true if a value looks like a JSON Schema object (has a 'type' or '$schema' property). */
 function isJsonSchema(v: unknown): boolean {
   return v !== null && typeof v === 'object' && !Array.isArray(v) &&
@@ -79,7 +180,7 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
   const domainRaw = domainExports.find(e => e['_kind'] === 'domain');
   if (!domainRaw) {
     // Emit any suppressed tsx load errors to stderr before throwing so they appear in CI logs.
-    for (const w of warnings) process.stderr.write(`[tib validate] ${w}\n`);
+    for (const w of warnings) process.stderr.write(`[mc-domain-module validate] ${w}\n`);
     throw new Error(`buildRegistry: no 'domain' export found in ${paths.domain}`);
   }
 
@@ -91,9 +192,8 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
     defaultDeployment: deployment(domainRaw),
   };
 
-  const [apiExports, webhookExports, subscriberExports, actionExports,
+const [webhookExports, subscriberExports, actionExports,
          scheduleExports, jobExports, integrationExports, eventExports] = await Promise.all([
-    Promise.all(paths.apis.map(load)),
     Promise.all(paths.webhooks.map(load)),
     Promise.all(paths.subscribers.map(load)),
     Promise.all(paths.actions.map(load)),
@@ -103,43 +203,6 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
     paths.publishes ? load(paths.publishes) : Promise.resolve([]),
   ]);
 
-  const VALID_API_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
-
-  const apis: ApiRegistryEntry[] = paths.apis.flatMap((filePath, i) =>
-    (apiExports[i] ?? [])
-      .filter(e => e['_kind'] === 'api')
-      .map(e => {
-        const rawMethod = typeof e['method'] === 'string' ? e['method'].toUpperCase() : '';
-        if (!rawMethod || !VALID_API_METHODS.has(rawMethod)) {
-          warnings.push(`${relPath(filePath)}: defineApi "${e['id']}" has invalid or missing method "${rawMethod || '(none)'}". Use one of: ${[...VALID_API_METHODS].join(', ')}.`);
-        }
-        const rawVersions = e['versions'] as Record<string, { input?: unknown; output?: unknown }> | undefined;
-        const versionSnapshots: ApiVersionSnapshot[] = rawVersions
-          ? Object.entries(rawVersions).map(([ver, v]) => ({
-              version: ver,
-              requestSchema: isJsonSchema(v?.input) ? (v.input as SchemaSnapshot) : undefined,
-              responseSchema: isJsonSchema(v?.output) ? (v.output as SchemaSnapshot) : undefined,
-            }))
-          : [];
-        const latestVersion = versionSnapshots[versionSnapshots.length - 1];
-        return {
-          id: String(e['id']),
-          kind: 'api' as const,
-          handlerFile: relPath(filePath),
-          path: String(e['path']),
-          method: VALID_API_METHODS.has(rawMethod) ? rawMethod : 'GET',
-          authType: ((e['auth'] as { type?: string } | undefined)?.type as 'jwt' | 'api-key' | 'none' | undefined) ?? 'jwt',
-          description: typeof e['description'] === 'string' ? e['description'] : undefined,
-          deployment: deployment(e),
-          outboundAccess: outboundAccess(e),
-          requestSchema: latestVersion?.requestSchema,
-          responseSchema: latestVersion?.responseSchema,
-          versions: versionSnapshots.length > 0 ? versionSnapshots : undefined,
-          examples: (e['examples'] as { request?: Record<string, unknown>; response?: Record<string, unknown> } | undefined),
-        };
-      })
-  );
-
   const webhooks: WebhookRegistryEntry[] = paths.webhooks.flatMap((filePath, i) =>
     (webhookExports[i] ?? [])
       .filter(e => e['_kind'] === 'webhook')
@@ -199,22 +262,55 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
       }))
   );
 
-  const actions: ActionRegistryEntry[] = paths.actions.flatMap((filePath, i) =>
+  const actions = paths.actions.flatMap((filePath, i) =>
     (actionExports[i] ?? [])
       .filter(e => e['_kind'] === 'action')
-      .map(e => ({
-        id: String(e['id']),
-        kind: 'action' as const,
-        handlerFile: relPath(filePath),
-        visibility: String(e['visibility']) as 'private' | 'domain' | 'workspace',
-        idempotent: Boolean(e['idempotent'] ?? false),
-        description: typeof e['description'] === 'string' ? e['description'] : undefined,
-        deployment: deployment(e),
-        outboundAccess: outboundAccess(e),
-        inputSchema: isJsonSchema(e['input']) ? (e['input'] as SchemaSnapshot) : undefined,
-        outputSchema: isJsonSchema(e['output']) ? (e['output'] as SchemaSnapshot) : undefined,
-      }))
-  );
+      .map(e => {
+        // Resolve backendAccess. New-style actions carry `backendAccess`
+        // directly. Legacy actions only carry `visibility`; in that case
+        // we collapse workspace -> domain per the migration spec, and we
+        // also remember the legacy flag so we can default exposure to
+        // `{ type: 'internal' }` for actions that have not opted in yet.
+        const hasBackendAccess = 'backendAccess' in e;
+        const rawBackendAccess = e['backendAccess'];
+        const rawVisibility = e['visibility'];
+        const backendAccess: ActionBackendAccess = hasBackendAccess
+          ? toBackendAccess(rawBackendAccess)
+          : visibilityToBackendAccess(rawVisibility);
+        const legacyVisibility = backendAccessToVisibility(backendAccess);
+
+        // Resolve exposure. New-style actions must declare their exposure;
+        // legacy actions that did not opt in default to `{ type: 'internal' }`
+        // so existing internal-only behavior is preserved during migration.
+        const rawExposure = e['exposure'];
+        const exposure: ActionExposure = toExposure(rawExposure, { type: 'internal' });
+        // Record whether the source explicitly declared the `exposure` field.
+        // Validation-only; consumed by the domain CLI's validate command
+        // (Wave 6 Task 6.1) to enforce `ACTION_EXPOSURE_REQUIRED`.
+        const exposureDeclared = rawExposure !== undefined && rawExposure !== null
+          && typeof rawExposure === 'object';
+
+        return {
+          id: String(e['id']),
+          kind: 'action' as const,
+          handlerFile: relPath(filePath),
+          backendAccess,
+          exposure,
+          exposureDeclared,
+          // Keep the legacy field populated so CDK constructs that still
+          // read `visibility` (e.g. action-construct.ts) keep working
+          // through the migration window. New constructs should read
+          // `backendAccess` and `exposure` instead.
+          visibility: legacyVisibility,
+          idempotent: Boolean(e['idempotent'] ?? false),
+          description: typeof e['description'] === 'string' ? e['description'] : undefined,
+          deployment: deployment(e),
+          outboundAccess: outboundAccess(e),
+          inputSchema: isJsonSchema(e['input']) ? (e['input'] as SchemaSnapshot) : undefined,
+          outputSchema: isJsonSchema(e['output']) ? (e['output'] as SchemaSnapshot) : undefined,
+        };
+      })
+  ) as ActionRegistryEntry[];
 
   const integrations: IntegrationRegistryEntry[] = paths.integrations.flatMap((_filePath, i) =>
     (integrationExports[i] ?? [])
@@ -242,7 +338,6 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
     schemaVersion: '1',
     domainRoot,
     domain,
-    apis,
     webhooks,
     subscribers,
     schedules,

package/src/builder/build-types.ts

@@ -1,4 +1,4 @@
-import type { DomainRegistry } from '@mettlecast/domain-cdk-packer';
+import type { DomainRegistry } from '../types.js';
 
 /**
  * Generate a .d.ts file declaring typed `ctx.actions.call(actionId, input)`

package/src/builder/load-module.ts

@@ -113,9 +113,9 @@ process.stdout.write(JSON.stringify(results));
 export async function loadModuleExports(absoluteFilePath: string): Promise<RawPrimitiveExport[]> {
   // Use a subdir of the project root rather than OS tmpdir so that ESM import
   // resolution can walk up and find node_modules packages like zod-to-json-schema.
-  const tibTmpDir = join(process.cwd(), '.tib', 'tmp');
-  await mkdir(tibTmpDir, { recursive: true }).catch(() => undefined);
-  const tempPath = join(tibTmpDir, `tib-load-${randomBytes(8).toString('hex')}.mts`);
+  const mcTmpDir = join(process.cwd(), '.mc', 'tmp');
+  await mkdir(mcTmpDir, { recursive: true }).catch(() => undefined);
+  const tempPath = join(mcTmpDir, `mc-load-${randomBytes(8).toString('hex')}.mts`);
   await writeFile(tempPath, makeEvalScript(absoluteFilePath), 'utf8');
 
   try {

package/src/cli.ts

@@ -73,7 +73,7 @@ program
 
 program
   .command('dev <domain>')
-  .description('Start a local HTTP server simulating API Gateway for all defineApi handlers')
+  .description('Start a local HTTP server simulating API Gateway for all API-exposed defineAction handlers')
   .option('--port <n>', 'Port to listen on', '3000')
   .action(async (domain: string, opts: { port?: string }) => {
     await runDev({ domainRoot: domain, port: opts.port ? parseInt(opts.port, 10) : 3000 });
@@ -82,9 +82,9 @@ program
 program
   .command('build-catalog')
   .description('Merge all per-domain registry files into .mc/domain-registry.json for TIB sync')
-  .option('--tib-dir <path>', 'Path to the .tib directory (defaults to .tib in cwd)')
-  .action(async (opts: { tibDir?: string }) => {
-    await runBuildCatalog(opts.tibDir);
+  .option('--mc-dir <path>', 'Path to the .mc registry directory (defaults to .mc in cwd)')
+  .action(async (opts: { mcDir?: string }) => {
+    await runBuildCatalog(opts.mcDir);
   });
 
 program

package/src/commands/add-api.ts

@@ -96,7 +96,7 @@ export async function runAddApi(opts: AddApiOptions): Promise<void> {
     throw new Error(`Domain "${opts.domain}" not found at ${domainDir}`);
   }
 
-  const apiFilePath = join(domainDir, 'api', `${opts.id}.ts`);
+  const apiFilePath = join(domainDir, 'actions', `${opts.id}.ts`);
 
   // Refuse if API already exists
   try {
@@ -124,7 +124,7 @@ export async function runAddApi(opts: AddApiOptions): Promise<void> {
   await writeFile(apiFilePath, apiContent);
 
   // Create fixture with the input schema's default shape as the example payload
-  const apiTestDir = join(domainDir, 'api', '__tests__');
+  const apiTestDir = join(domainDir, 'actions', '__tests__');
   await mkdir(apiTestDir, { recursive: true });
   await writeFile(
     join(apiTestDir, `${opts.id}.fixture.json`),

package/src/commands/add-domain.ts

@@ -51,18 +51,18 @@ export async function runAddDomain(opts: AddDomainOptions): Promise<void> {
   }
 
   // Create directory structure
-  await mkdir(join(domainDir, 'api', '__tests__'), { recursive: true });
+  await mkdir(join(domainDir, 'actions', '__tests__'), { recursive: true });
   await mkdir(join(domainDir, 'subscribers'), { recursive: true });
   await mkdir(join(domainDir, 'publishes'), { recursive: true });
 
   // Write skeleton files
   await writeFile(join(domainDir, 'domain.config.ts'), domainConfigTemplate(opts.id, opts.tenancy));
   await writeFile(
-    join(domainDir, 'api', 'example.ts'),
+    join(domainDir, 'actions', 'example.ts'),
     apiSkeletonTemplate(opts.id, 'example', opts.tenancy)
   );
   await writeFile(
-    join(domainDir, 'api', '__tests__', 'example.fixture.json'),
+    join(domainDir, 'actions', '__tests__', 'example.fixture.json'),
     apiFixtureSkeleton(opts.id, 'example')
   );
   await writeFile(join(domainDir, 'publishes', 'events.ts'), eventsSkeletonTemplate(opts.id));
@@ -94,7 +94,7 @@ export async function runAddDomain(opts: AddDomainOptions): Promise<void> {
   cliLogger.info({ id: opts.id, dir: domainDir }, 'Domain scaffolded');
   // eslint-disable-next-line no-console
   console.log(
-    `\n✓ Domain "${opts.id}" added at ${domainDir}\nNext: edit api/example.ts, ` +
+    `\n✓ Domain "${opts.id}" added at ${domainDir}\nNext: edit actions/example.ts, ` +
       `then run \`mc-domain-module build ${opts.id}\` to generate the registry.`
   );
 }

package/src/commands/add-fixture-factory.ts

@@ -47,21 +47,20 @@ export async function runAddFixtureFactory(options: AddFixtureFactoryOptions): P
   const domain = options.domain;
   const apiId = options.apiId;
 
-  const apiFile = join(projectRoot, 'domains', domain, 'api', `${apiId}.ts`);
+  const apiFile = join(projectRoot, 'domains', domain, 'actions', `${apiId}.ts`);
   await access(apiFile).catch(() => {
-    throw new Error(`API file not found: ${apiFile}. Run add-api first.`);
+    throw new Error(`Action file not found: ${apiFile}. Run add-api first.`);
   });
 
-  // Read the API file to extract the input type name
+  // Read the action file to extract the input type name
   const content = await readFile(apiFile, 'utf8');
-  const outputTypeArg = content.match(/import\s+\{\s*[\w\s,]*\s*\}\s+from\s+['"]@mettlecast/);
 
-  const factoryFile = join(projectRoot, 'domains', domain, 'api', '__tests__', `${apiId}.factory.ts`);
+  const factoryFile = join(projectRoot, 'domains', domain, 'actions', '__tests__', `${apiId}.factory.ts`);
   const factoryContent = FACTORY_TEMPLATE
     .replace(/\{domain\}/g, domain)
     .replace(/\{apiId\}/g, apiId);
 
-  await mkdir(join(projectRoot, 'domains', domain, 'api', '__tests__'), { recursive: true });
+  await mkdir(join(projectRoot, 'domains', domain, 'actions', '__tests__'), { recursive: true });
   await writeFile(factoryFile, factoryContent, 'utf8');
 
   cliLogger.info({ factoryFile }, 'add-fixture-factory: factory written');

package/src/commands/build-catalog.ts

@@ -2,27 +2,18 @@ import { readFile, writeFile, readdir, mkdir } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { cliLogger } from '../utils/logger.js';
 
-/** A single API entry in the catalog. */
-export interface CatalogApi {
-  id: string;
-  domainId: string;
-  path: string;
-  method: string;
-  authType: string;
-  description?: string;
-  requestSchema?: Record<string, unknown>;
-  responseSchema?: Record<string, unknown>;
-  versions?: Array<{ version: string; requestSchema?: Record<string, unknown>; responseSchema?: Record<string, unknown> }>;
-  examples?: { request?: Record<string, unknown>; response?: Record<string, unknown> };
-}
-
 /** A single action entry in the catalog. */
 export interface CatalogAction {
   id: string;
   domainId: string;
-  visibility: string;
+  backendAccess: string;
+  exposure: Record<string, unknown>;
+  exposureDeclared?: boolean;
   idempotent: boolean;
   description?: string;
+  handlerFile?: string;
+  deployment?: Record<string, unknown>;
+  outboundAccess?: string;
   inputSchema?: Record<string, unknown>;
   outputSchema?: Record<string, unknown>;
 }
@@ -83,7 +74,6 @@ export interface DomainCatalog {
   version: 2;
   generatedAt: string;
   domains: CatalogDomain[];
-  apis: CatalogApi[];
   actions: CatalogAction[];
   events: CatalogEvent[];
   subscribers: CatalogSubscriber[];
@@ -95,30 +85,29 @@ export interface DomainCatalog {
 /**
  * Build the combined domain catalog from all per-domain registry files.
  * Reads .mc/{domain}-registry.json files and merges them into .mc/domain-registry.json.
- * @param tibDir - Path to the .tib directory. Defaults to .tib in cwd.
+ * @param registryDir - Path to the .mc registry directory. Defaults to .mc in cwd.
  * @returns The written catalog.
  */
-export async function runBuildCatalog(tibDir?: string): Promise<DomainCatalog> {
-  const dir = tibDir ? resolve(tibDir) : join(process.cwd(), '.tib');
+export async function runBuildCatalog(registryDir?: string): Promise<DomainCatalog> {
+  const dir = registryDir ? resolve(registryDir) : join(process.cwd(), '.mc');
 
   // Find all per-domain registry files
   let files: string[];
   try {
     files = await readdir(dir);
   } catch {
-    throw new Error(`build-catalog: .tib directory not found at ${dir}. Run tib build first.`);
+    throw new Error(`build-catalog: .mc registry directory not found at ${dir}. Run mc-domain-module build first.`);
   }
 
   const registryFiles = files.filter(f => f.endsWith('-registry.json') && f !== 'domain-registry.json');
   if (registryFiles.length === 0) {
-    throw new Error(`build-catalog: no domain registry files found in ${dir}. Run tib build <domain> first.`);
+    throw new Error(`build-catalog: no domain registry files found in ${dir}. Run mc-domain-module build <domain> first.`);
   }
 
   const catalog: DomainCatalog = {
     version: 2,
     generatedAt: new Date().toISOString(),
     domains: [],
-    apis: [],
     actions: [],
     events: [],
     subscribers: [],
@@ -152,30 +141,19 @@ export async function runBuildCatalog(tibDir?: string): Promise<DomainCatalog> {
       description: domainEntry['description'] as string | undefined,
     });
 
-    const apis = (registry['apis'] as Record<string, unknown>[] | undefined) ?? [];
-    for (const api of apis) {
-      catalog.apis.push({
-        id: String(api['id']),
-        domainId,
-        path: String(api['path']),
-        method: String(api['method'] ?? 'ANY'),
-        authType: String(api['authType'] ?? 'jwt'),
-        description: api['description'] as string | undefined,
-        requestSchema: api['requestSchema'] as Record<string, unknown> | undefined,
-        responseSchema: api['responseSchema'] as Record<string, unknown> | undefined,
-        versions: api['versions'] as CatalogApi['versions'],
-        examples: api['examples'] as CatalogApi['examples'],
-      });
-    }
-
     const actions = (registry['actions'] as Record<string, unknown>[] | undefined) ?? [];
     for (const action of actions) {
       catalog.actions.push({
         id: String(action['id']),
         domainId,
-        visibility: String(action['visibility'] ?? 'private'),
+        backendAccess: String(action['backendAccess'] ?? 'private'),
+        exposure: (action['exposure'] as Record<string, unknown> | undefined) ?? { type: 'internal' },
+        exposureDeclared: action['exposureDeclared'] as boolean | undefined,
         idempotent: Boolean(action['idempotent'] ?? false),
         description: action['description'] as string | undefined,
+        handlerFile: action['handlerFile'] as string | undefined,
+        deployment: action['deployment'] as Record<string, unknown> | undefined,
+        outboundAccess: action['outboundAccess'] as string | undefined,
         inputSchema: action['inputSchema'] as Record<string, unknown> | undefined,
         outputSchema: action['outputSchema'] as Record<string, unknown> | undefined,
       });
@@ -241,7 +219,7 @@ export async function runBuildCatalog(tibDir?: string): Promise<DomainCatalog> {
   await writeFile(outPath, JSON.stringify(catalog), 'utf8');
 
   cliLogger.info(
-    { outPath, domains: catalog.domains.length, apis: catalog.apis.length, actions: catalog.actions.length, events: catalog.events.length, jobs: catalog.jobs.length, schedules: catalog.schedules.length, integrations: catalog.integrations.length },
+    { outPath, domains: catalog.domains.length, actions: catalog.actions.length, events: catalog.events.length, jobs: catalog.jobs.length, schedules: catalog.schedules.length, integrations: catalog.integrations.length },
     'Domain catalog written'
   );
 

package/src/commands/build-flows.ts

@@ -285,7 +285,7 @@ async function loadFlowsFromDir(dir: string, owningDomainOverride?: string): Pro
  */
 export async function runBuildFlows(options: BuildFlowsOptions): Promise<string> {
   const projectRoot = options.projectRoot ?? process.cwd();
-  const outFile = options.outFile ?? join(projectRoot, '.tib', 'flows-registry.json');
+  const outFile = options.outFile ?? join(projectRoot, '.mc', 'flows-registry.json');
 
   cliLogger.info({ projectRoot }, 'Building flows registry');
 

package/src/commands/build.ts

@@ -1,6 +1,6 @@
 import { writeFile, mkdir, readdir, readFile } from 'node:fs/promises';
 import { join, resolve, basename } from 'node:path';
-import type { DomainRegistry } from '@mettlecast/domain-cdk-packer';
+import type { DomainRegistry } from '../types.js';
 import { buildRegistry } from '../builder/build-registry.js';
 import { buildActionsTypes } from '../builder/build-types.js';
 import { cliLogger } from '../utils/logger.js';
@@ -27,7 +27,7 @@ export async function runBuild(options: BuildOptions): Promise<string> {
   const domainId = basename(domainRoot);
   const outFile = options.outFile
     ? resolve(options.outFile)
-    : join(process.cwd(), '.tib', `${domainId}-registry.json`);
+    : join(process.cwd(), '.mc', `${domainId}-registry.json`);
 
   cliLogger.info({ domainRoot }, 'Building domain registry');
 
@@ -40,18 +40,19 @@ export async function runBuild(options: BuildOptions): Promise<string> {
   await mkdir(join(outFile, '..'), { recursive: true });
   await writeFile(outFile, JSON.stringify(registry), 'utf8');
 
-  cliLogger.info({ outFile, apis: registry.apis.length, events: registry.events.length }, 'Registry written');
+  const apiExposedActions = registry.actions.filter(action => action.exposure.type === 'api').length;
+  cliLogger.info({ outFile, apiExposedActions, events: registry.events.length }, 'Registry written');
 
   // Discover all sibling registries and emit aggregated types
-  const tibDir = join(process.cwd(), '.tib');
-  const registryFiles = (await readdir(tibDir)).filter(f => f.endsWith('-registry.json'));
+  const registryDir = join(outFile, '..');
+  const registryFiles = (await readdir(registryDir)).filter(f => f.endsWith('-registry.json'));
   const allRegistries: DomainRegistry[] = [];
   for (const f of registryFiles) {
-    const raw = await readFile(join(tibDir, f), 'utf8');
+    const raw = await readFile(join(registryDir, f), 'utf8');
     allRegistries.push(JSON.parse(raw) as DomainRegistry);
   }
   const typesContent = buildActionsTypes(allRegistries);
-  const typesFile = join(tibDir, 'actions-types.d.ts');
+  const typesFile = join(registryDir, 'actions-types.d.ts');
   await writeFile(typesFile, typesContent);
 
   cliLogger.info({ outFile: typesFile }, 'Types file written');

package/src/commands/check-hashes.ts

@@ -57,14 +57,14 @@ interface ModulesHashesManifest {
  */
 export async function runCheckHashes(opts: CheckHashesOptions = {}): Promise<CheckHashesResult> {
   const root = opts.projectRoot ?? process.cwd();
-  const manifestPath = join(root, '.tib', 'modules-hashes.json');
+  const manifestPath = join(root, '.mc', 'modules-hashes.json');
   const modulesDir = join(root, 'infra', 'modules');
 
   let manifest: ModulesHashesManifest;
   try {
     manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as ModulesHashesManifest;
   } catch (err) {
-    throw new Error(`tib check-hashes: cannot read ${manifestPath} (${(err as Error).message}). Re-scaffold to regenerate the manifest.`);
+    throw new Error(`mc-domain-module check-hashes: cannot read ${manifestPath} (${(err as Error).message}). Re-scaffold to regenerate the manifest.`);
   }
 
   const drifted: DriftedFile[] = [];

package/src/commands/create-project.ts

@@ -217,7 +217,7 @@ export async function runCreateProject(opts: CreateProjectOptions): Promise<void
 
     // 5. Prepare output directory
     await mkdir(outputDir, { recursive: true });
-    await mkdir(join(outputDir, '.tib'), { recursive: true });
+    await mkdir(join(outputDir, '.mc'), { recursive: true });
 
     // 6. Get CLI version from package.json
     let cliVersion = '0.0.0';

package/src/commands/dev.ts

@@ -55,7 +55,7 @@ export async function startDev(options: DevOptions): Promise<DevHandle> {
   }
 
   cliLogger.info(
-    { domain: registry.domain.id, apis: registry.apis.length, port },
+    { domain: registry.domain.id, apiActions: registry.actions.filter(a => a.exposure?.type === 'api').length, port },
     'Starting local dev server'
   );