@mettlecast/domain-cli 0.2.60 → 0.2.61

package/src/__tests__/commands/add-domain.test.ts

@@ -33,7 +33,7 @@ describe('add-domain command', () => {
 
     // Verify directory structure
     const domainDir = join(tmpDir, 'test-domain');
-    await stat(join(domainDir, 'api'));
+    await stat(join(domainDir, 'actions'));
     await stat(join(domainDir, 'subscribers'));
     await stat(join(domainDir, 'publishes'));
 
@@ -42,9 +42,10 @@ describe('add-domain command', () => {
     expect(configContent).toContain(`id: 'test-domain'`);
     expect(configContent).toContain(`tenancy: 'required'`);
 
-    const apiContent = await readFile(join(domainDir, 'api', 'example.ts'), 'utf8');
+    const apiContent = await readFile(join(domainDir, 'actions', 'example.ts'), 'utf8');
     expect(apiContent).toContain(`id: 'example'`);
-    expect(apiContent).toContain('defineApi');
+    expect(apiContent).toContain('defineAction');
+    expect(apiContent).toContain("type: 'api'");
 
     const eventsContent = await readFile(join(domainDir, 'publishes', 'events.ts'), 'utf8');
     expect(eventsContent).toContain(`id: 'test-domain.example'`);
@@ -154,10 +155,12 @@ describe('add-domain command', () => {
     const configContent = await readFile(join(tmpDir, 'system-domain', 'domain.config.ts'), 'utf8');
     expect(configContent).toContain(`tenancy: 'system'`);
 
-    const apiContent = await readFile(join(tmpDir, 'system-domain', 'api', 'example.ts'), 'utf8');
+    const apiContent = await readFile(join(tmpDir, 'system-domain', 'actions', 'example.ts'), 'utf8');
     expect(apiContent).toContain(`tenancy: 'system'`);
     // For 'system' tenancy, path should not include /v1/tenants/{tenantId}
     expect(apiContent).toContain(`path: '/v1/system-domain/example'`);
+    // System tenancy should default to service-to-service auth.
+    expect(apiContent).toContain(`auth: 'service'`);
   });
 
   it('should use correct path structure for required tenancy', async () => {
@@ -167,7 +170,7 @@ describe('add-domain command', () => {
       domainsDir: tmpDir,
     });
 
-    const apiContent = await readFile(join(tmpDir, 'tenant-domain', 'api', 'example.ts'), 'utf8');
+    const apiContent = await readFile(join(tmpDir, 'tenant-domain', 'actions', 'example.ts'), 'utf8');
     // For 'required' tenancy, path should include /v1/tenants/{tenantId}
     expect(apiContent).toContain(`path: '/v1/tenants/{tenantId}/tenant-domain/example'`);
   });

package/src/__tests__/commands/create-project.test.ts

@@ -263,7 +263,7 @@ describe('runCreateProject', () => {
     const coreTarball = await createTestTarball([
       {
         path: 'lib/domain-runtime.ts',
-        content: 'export const defineApi = () => {};',
+        content: 'export const defineAction = () => {};',
         isTemplate: false,
       },
       {
@@ -285,14 +285,14 @@ describe('runCreateProject', () => {
 
     const authTarball = await createTestTarball([
       {
-        path: 'domains/auth/api/login.ts',
-        content: 'import { defineApi } from "../../lib/domain-runtime";',
+        path: 'domains/auth/actions/login.ts',
+        content: 'import { defineAction } from "../../lib/domain-runtime";',
         isTemplate: false,
       },
       {
         path: 'MANIFEST.json',
         content: createTarballManifest([
-          { path: 'domains/auth/api/login.ts', isTemplate: false },
+          { path: 'domains/auth/actions/login.ts', isTemplate: false },
         ]),
         isTemplate: false,
       },
@@ -319,7 +319,7 @@ describe('runCreateProject', () => {
     await runCreateProject({ name: 'test-project', outDir: tempDir });
 
     // Read the generated auth login file
-    const authPath = join(outputDir, 'domains/auth/api/login.ts');
+    const authPath = join(outputDir, 'domains/auth/actions/login.ts');
     const authContent = await readFile(authPath, 'utf-8');
 
     expect(authContent).toContain('../../lib/domain-runtime');

package/src/__tests__/commands/dev.test.ts

@@ -34,7 +34,6 @@ const mocks = vi.hoisted(() => {
     buildRegistry: vi.fn().mockResolvedValue({
       registry: {
         domain: { id: 'mock-domain' },
-        apis: [],
         webhooks: [],
         subscribers: [],
         schedules: [],

package/src/__tests__/mount-routes.test.ts

@@ -16,43 +16,55 @@ vi.mock('../runtime-stubs/hydrate-local-ctx.js', () => ({
 
 import { mountRoutes } from '../server/mount-routes.js';
 
-function makeRegistry(apis: Array<Partial<DomainRegistry['apis'][0]>>): DomainRegistry {
+/**
+ * Build a minimal registry whose `actions[]` contains a single
+ * API-exposed entry per call. Issue #4689: the only HTTP endpoint
+ * surface is `actions[]` with `exposure.type === 'api'`.
+ */
+function makeRegistry(actions: Array<Partial<DomainRegistry['actions'][0]>>): DomainRegistry {
   return {
     schemaVersion: '1',
     domainRoot: '/fake/domain',
     domain: { id: 'test', kind: 'domain', name: 'Test', tenancy: 'none' },
-    apis: apis.map((a, i) => ({
-      id: `api-${i}`,
-      kind: 'api' as const,
-      handlerFile: `api/handler-${i}.ts`,
-      path: `/route-${i}`,
-      method: 'GET',
-      authType: 'none' as const,
-      ...a,
-    })),
     webhooks: [],
     subscribers: [],
     schedules: [],
     jobs: [],
-    actions: [],
+    actions: actions.map((a, i) => ({
+      id: `action-${i}`,
+      kind: 'action' as const,
+      handlerFile: `actions/handler-${i}.ts`,
+      backendAccess: 'domain' as const,
+      exposure: {
+        type: 'api' as const,
+        path: `/route-${i}`,
+        method: 'GET' as const,
+        auth: 'required' as const,
+        tenancy: 'required' as const,
+      },
+      idempotent: true,
+      ...a,
+    })) as DomainRegistry['actions'],
     integrations: [],
     events: [],
   };
 }
 
 describe('mountRoutes', () => {
-  it('registers one route per api entry', async () => {
+  it('registers one route per API-exposed action', async () => {
     const routes: Array<{ method: unknown; url: string }> = [];
     const server = {
       route: vi.fn((opts: { method: unknown; url: string }) => { routes.push(opts); }),
       log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
     };
 
-    vi.doMock('/fake/domain/api/handler-0.ts', () => ({
-      myApi: { id: 'api-0', _kind: 'api', handler: vi.fn().mockResolvedValue({ ok: true }) },
+    vi.doMock('/fake/domain/actions/handler-0.ts', () => ({
+      myAction: { id: 'action-0', _kind: 'action', handler: vi.fn().mockResolvedValue({ ok: true }) },
     }));
 
-    const registry = makeRegistry([{ id: 'api-0', handlerFile: 'api/handler-0.ts', path: '/route-0', method: 'GET' }]);
+    const registry = makeRegistry([
+      { id: 'action-0', handlerFile: 'actions/handler-0.ts', exposure: { type: 'api', path: '/route-0', method: 'GET', auth: 'required', tenancy: 'required' } },
+    ]);
 
     await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
 
@@ -67,13 +79,13 @@ describe('mountRoutes', () => {
       log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
     };
 
-    vi.doMock('/fake/domain/api/handler-1.ts', () => ({
-      myApi: { id: 'api-1', _kind: 'api', handler: vi.fn() },
+    vi.doMock('/fake/domain/actions/handler-1.ts', () => ({
+      myAction: { id: 'action-1', _kind: 'action', handler: vi.fn() },
     }));
 
-    const registry = makeRegistry([{
-      id: 'api-1', handlerFile: 'api/handler-1.ts', path: '/users/{id}/orders', method: 'GET',
-    }]);
+    const registry = makeRegistry([
+      { id: 'action-1', handlerFile: 'actions/handler-1.ts', exposure: { type: 'api', path: '/users/{id}/orders', method: 'GET', auth: 'required', tenancy: 'required' } },
+    ]);
 
     await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
 
@@ -86,15 +98,44 @@ describe('mountRoutes', () => {
       log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
     };
 
-    vi.doMock('/fake/domain/api/handler-2.ts', () => ({
-      noHandler: { id: 'api-2', _kind: 'api' },
+    vi.doMock('/fake/domain/actions/handler-2.ts', () => ({
+      noHandler: { id: 'action-2', _kind: 'action' },
     }));
 
-    const registry = makeRegistry([{ id: 'api-2', handlerFile: 'api/handler-2.ts', path: '/skip', method: 'GET' }]);
+    const registry = makeRegistry([
+      { id: 'action-2', handlerFile: 'actions/handler-2.ts', exposure: { type: 'api', path: '/skip', method: 'GET', auth: 'required', tenancy: 'required' } },
+    ]);
 
     await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
 
     expect(server.route).not.toHaveBeenCalled();
     expect(server.log.warn).toHaveBeenCalled();
   });
+
+  it('skips internal-only actions (exposure.type !== "api")', async () => {
+    const server = {
+      route: vi.fn(),
+      log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+    };
+
+    vi.doMock('/fake/domain/actions/handler-internal.ts', () => ({
+      internalAction: { id: 'internal-1', _kind: 'action', handler: vi.fn() },
+    }));
+
+    const registry: DomainRegistry = {
+      ...makeRegistry([]),
+      actions: [{
+        id: 'internal-1',
+        kind: 'action',
+        handlerFile: 'actions/handler-internal.ts',
+        backendAccess: 'domain',
+        exposure: { type: 'internal' },
+        idempotent: true,
+      } as unknown as DomainRegistry['actions'][0]],
+    };
+
+    await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
+
+    expect(server.route).not.toHaveBeenCalled();
+  });
 });

package/src/__tests__/package-freshness.test.ts

@@ -2,7 +2,6 @@ import { describe, it, expect } from 'vitest';
 import {
   ActionBackendAccess,
   type ActionApiExposure,
-  type ApiRegistryEntry,
   type DomainRegistry,
   type ActionRegistryEntry,
 } from '@mettlecast/domain-cdk-packer';
@@ -45,24 +44,6 @@ describe('CLI ↔ CDK packer type freshness (#4662 Task D)', () => {
     expect(exposure.securityException?.reason).toMatch(/OPS-123/);
   });
 
-  it('exposes the ApiRegistryEntry.securityException field added in #4662', () => {
-    // The build-registry does not populate this field for legacy
-    // `defineApi` entries (they don't carry securityException in
-    // source), but the registry type must declare it so that
-    // future migrations can attach it. This assertion pins the field
-    // shape so the CLI doesn't silently fall behind if a future
-    // packer refactor removes the declaration.
-    const api: ApiRegistryEntry = {
-      kind: 'api',
-      handlerFile: 'src/api.ts',
-      path: '/v1/health',
-      method: 'GET',
-      authType: 'none',
-      securityException: { reason: 'public liveness probe' },
-    };
-    expect(api.securityException?.reason).toMatch(/liveness/);
-  });
-
   it('exposes the ActionRegistryEntry shape with the latest exposure metadata flags', () => {
     const action: ActionRegistryEntry = {
       kind: 'action',
@@ -82,7 +63,6 @@ describe('CLI ↔ CDK packer type freshness (#4662 Task D)', () => {
       schemaVersion: '1',
       domainRoot: '/tmp/fake',
       domain: { kind: 'domain', id: 'test', name: 'Test', tenancy: 'required' },
-      apis: [],
       webhooks: [],
       subscribers: [],
       schedules: [],
@@ -111,4 +91,4 @@ describe('CLI ↔ CDK packer type freshness (#4662 Task D)', () => {
       ?? parsed.devDependencies?.['@mettlecast/domain-cdk-packer'];
     expect(['*', 'workspace:*']).toContain(range);
   });
-});
+});

package/src/__tests__/smoke/scaffold.test.ts

@@ -448,11 +448,10 @@ describe('scaffold smoke test (issue #3831)', () => {
     expect(tsconfig.compilerOptions.strict).toBe(true);
   });
 
-  it('seeds api handlers from auth that import defineApi from @mettlecast/domain-runtime', async () => {
+  it('seeds api handlers from auth that import defineAction + exposure from @mettlecast/domain-runtime', async () => {
     // The auth module ships a hand-written seed api/me.ts. We
     // confirm it parses (no obvious syntax errors) and uses the runtime
-    // primitive. This is a structural check; the wave-2 "import ky + call
-    // initOtel()" expectation is documented below as a separate soft gate.
+    // primitive. This is a structural check.
     const apiFile = join(projectDir, 'domains', 'auth', 'api', 'me.ts');
     const s = await stat(apiFile).catch(() => null);
     if (!s) {
@@ -462,7 +461,8 @@ describe('scaffold smoke test (issue #3831)', () => {
     }
     const content = await readFile(apiFile, 'utf-8');
     expect(content).toMatch(/from\s+['"]@mettlecast\/domain-runtime['"]/);
-    expect(content).toMatch(/defineApi\s*\(/);
+    expect(content).toMatch(/defineAction\s*\(/);
+    expect(content).toMatch(/type:\s*['"]api['"]/);
   });
 
   it('seeds initOtel() references in api handlers (wave-2 acceptance gate)', async () => {
@@ -499,20 +499,18 @@ describe('scaffold smoke test (issue #3831)', () => {
     }
   });
 
-  it('api-skeleton template (add-api) emits createKyClient + initOtel references', async () => {
-    // The add-api template now imports `createKyClient` and `initOtel`
-    // from @mettlecast/domain-runtime (the ky-backed runtime client),
-    // not a direct `ky` npm import.  Seed handlers may also import `ky`
-    // directly if they need a browser-friendly HTTP client.
+  it('api-skeleton template (add-api) emits defineAction + exposure.type=api references', async () => {
+    // The add-api template now emits defineAction + exposure.type='api' as
+    // the canonical action-first HTTP endpoint primitive (#4689).
     const out = apiSkeletonTemplateForTest('payments', 'charge-card', 'required');
-    const hasKy = /createKyClient/.test(out) || /from\s+['"]ky['"]/.test(out);
-    const hasInitOtel = /\binitOtel\s*\(/.test(out);
-    if (!hasKy || !hasInitOtel) {
+    const hasDefineAction = /defineAction\s*\(/.test(out);
+    const hasApiExposure = /type:\s*['"]api['"]/.test(out);
+    if (!hasDefineAction || !hasApiExposure) {
       throw new Error(
         'api-skeleton template (packages/domain-cli/src/templates/api-skeleton.ts) ' +
-          'does not emit createKyClient or initOtel()\n' +
-          `  hasKy=${hasKy} hasInitOtel=${hasInitOtel}\n` +
-          '  expected: import { createKyClient, initOtel } from "@mettlecast/domain-runtime" AND initOtel()',
+          'does not emit defineAction + exposure.type=api\n' +
+          `  hasDefineAction=${hasDefineAction} hasApiExposure=${hasApiExposure}\n` +
+          '  expected: import { defineAction } from "@mettlecast/domain-runtime" AND exposure: { type: "api", ... }',
       );
     }
   });

package/src/__tests__/validate.test.ts

@@ -49,7 +49,6 @@ describe('buildRegistry action mapping (action-first migration)', () => {
   it('reads backendAccess directly when raw action exposes it', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: [],
       webhooks: [],
       subscribers: [],
       actions: ['/fake/domains/billing/actions/charge-card.ts'],
@@ -97,7 +96,6 @@ describe('buildRegistry action mapping (action-first migration)', () => {
   it('falls back from legacy visibility to backendAccess and collapses workspace -> domain', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: [],
       webhooks: [],
       subscribers: [],
       actions: [
@@ -133,7 +131,6 @@ describe('buildRegistry action mapping (action-first migration)', () => {
   it('defaults missing exposure to { type: internal } for legacy actions', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: [],
       webhooks: [],
       subscribers: [],
       actions: ['/fake/domains/billing/actions/legacy.ts'],
@@ -159,7 +156,6 @@ describe('buildRegistry action mapping (action-first migration)', () => {
   it('preserves inputSchema and outputSchema extraction', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: [],
       webhooks: [],
       subscribers: [],
       actions: ['/fake/domains/billing/actions/charge-card.ts'],
@@ -210,20 +206,17 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
 
   /**
    * Helper that wires the two file-walker / module-loader mocks so
-   * `buildRegistry` returns the supplied actions (plus the canonical
-   * domain row) and the supplied apis list. Returns the ValidationResult
+   * `buildRegistry` returns the supplied actions plus the canonical
+   * domain row. Returns the ValidationResult
    * produced by `runValidate`.
    */
   async function runValidateWith({
     actions = [],
-    apis = [],
   }: {
     actions?: Record<string, unknown>[];
-    apis?: Record<string, unknown>[];
   }): Promise<{ errors: { code: string; message: string }[]; warnings: string[]; valid: boolean; }> {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: apis.map(() => '/fake/domains/billing/api/x.ts'),
       webhooks: [],
       subscribers: [],
       actions: actions.map(() => '/fake/domains/billing/actions/x.ts'),
@@ -234,19 +227,15 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
     });
     // Mock consumption order inside buildRegistry:
     //   1. domain (paths.domain)        -> mock #1
-    //   2. apis files (paths.apis)      -> mock #2 (if any)
-    //   3. webhooks/subscribers/schedules/jobs/integrations -> empty arrays, no calls
-    //   4. actions files (paths.actions)-> mock #N (if any)
-    //   5. publishes (paths.publishes)  -> undefined, no call
+    //   2. webhooks/subscribers/schedules/jobs/integrations -> empty arrays, no calls
+    //   3. actions files (paths.actions)-> mock #N (if any)
+    //   4. publishes (paths.publishes)  -> undefined, no call
     // Each non-empty slot consumes exactly one mock per file (we
     // generate one synthetic file path per item so the slot has length
     // equal to the supplied arrays).
     mockLoadModuleExports.mockResolvedValueOnce([
       { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
     ]);
-    if (apis.length > 0) {
-      mockLoadModuleExports.mockResolvedValueOnce(apis as never);
-    }
     if (actions.length > 0) {
       mockLoadModuleExports.mockResolvedValueOnce(actions as never);
     }
@@ -504,51 +493,6 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
     expect(errors.find(e => e.code === 'SYSTEM_API_REQUIRES_ROLE')).toBeUndefined();
   });
 
-  it('DEFINE_API_LEGACY_USAGE — fires once per legacy defineApi entry', async () => {
-    // Stub out the api builder checks (requestSchema, examples, etc.)
-    // because the test fixture intentionally provides a minimal api
-    // shape. We only assert on the new DEFINE_API_LEGACY_USAGE rule
-    // here; other rules are covered by build-registry.test.ts and the
-    // existing validate.test.ts suite.
-    const { errors } = await runValidateWith({
-      actions: [],
-      apis: [
-        {
-          _kind: 'api', _exportName: 'legacyList',
-          id: 'legacy-list', path: '/v1/list', method: 'GET',
-          auth: { type: 'jwt' },
-          versions: {
-            v1: {
-              status: 'stable',
-              input: { type: 'object', properties: {}, default: {} },
-              output: { type: 'object', properties: {}, default: {} },
-              handler: () => undefined,
-            },
-          },
-          examples: { request: {}, response: {} },
-        },
-      ],
-    });
-    const rules = errors.filter(e => e.code === 'DEFINE_API_LEGACY_USAGE');
-    expect(rules).toHaveLength(1);
-    expect(rules[0]?.message).toContain("'legacy-list'");
-  });
-
-  it('DEFINE_API_LEGACY_USAGE — silent when registry has no defineApi rows', async () => {
-    const { errors } = await runValidateWith({
-      actions: [
-        {
-          _kind: 'action', _exportName: 'internalOnly',
-          id: 'internal-only', backendAccess: 'domain',
-          exposure: { type: 'internal' },
-          idempotent: false,
-        },
-      ],
-      apis: [],
-    });
-    expect(errors.find(e => e.code === 'DEFINE_API_LEGACY_USAGE')).toBeUndefined();
-  });
-
   it('combined: well-formed api action passes every rule', async () => {
     const { errors } = await runValidateWith({
       actions: [
@@ -568,7 +512,6 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
       'ACTION_EXPOSURE_REQUIRED', 'API_EXPOSURE_AUTH_REQUIRED',
       'TENANT_API_PATH_REQUIRED', 'AUTH_NONE_REQUIRES_EXCEPTION',
       'TENANCY_NONE_REQUIRES_REASON_WHEN_PUBLIC', 'SYSTEM_API_REQUIRES_ROLE',
-      'DEFINE_API_LEGACY_USAGE',
     ];
     const firedSecurityRules = errors.filter(e => securityCodes.includes(e.code));
     expect(firedSecurityRules).toHaveLength(0);
@@ -579,12 +522,18 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
 });
 
 /**
- * Deployment-time security rules (#4662 Task D).
+ * Deployment-time security rules (#4662 Task D, #4689).
  *
  * These mirror the CDK aspect's synth-time checks so CI can gate the
  * build BEFORE synth is attempted. Each rule emits a structured
  * `ValidationError` whose `code` matches the aspect annotation code,
  * making the two layers correlatable.
+ *
+ * Issue #4689: defineApi and registry.apis were removed. The action-first
+ * `TENANT_API_PATH_REQUIRED` rule in the `#4619 / Wave 6` suite now owns
+ * the placeholder invariant. The deployment-time rules below assert that
+ * no duplicate `SECURITY_MISSING_TENANT_PATH` codes are emitted for the
+ * action surface.
  */
 describe('runValidate deployment-time security rules (#4662 Task D)', () => {
   const DOMAIN_ROOT = '/fake/domains/billing';
@@ -595,14 +544,11 @@ describe('runValidate deployment-time security rules (#4662 Task D)', () => {
 
   async function runValidateWith({
     actions = [],
-    apis = [],
   }: {
     actions?: Record<string, unknown>[];
-    apis?: Record<string, unknown>[];
   }): Promise<{ errors: { code: string; message: string }[]; warnings: string[]; valid: boolean; }> {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: apis.map(() => '/fake/domains/billing/api/x.ts'),
       webhooks: [],
       subscribers: [],
       actions: actions.map(() => '/fake/domains/billing/actions/x.ts'),
@@ -614,9 +560,6 @@ describe('runValidate deployment-time security rules (#4662 Task D)', () => {
     mockLoadModuleExports.mockResolvedValueOnce([
       { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
     ]);
-    if (apis.length > 0) {
-      mockLoadModuleExports.mockResolvedValueOnce(apis as never);
-    }
     if (actions.length > 0) {
       mockLoadModuleExports.mockResolvedValueOnce(actions as never);
     }
@@ -625,42 +568,17 @@ describe('runValidate deployment-time security rules (#4662 Task D)', () => {
     return { errors: result.errors, warnings: result.warnings, valid: result.valid };
   }
 
-  it('SECURITY_MISSING_TENANT_PATH — fires for an API whose path lacks the tenant placeholder', async () => {
+  it('does NOT emit SECURITY_MISSING_TENANT_PATH for an action that already includes the tenant placeholder', async () => {
     const { errors } = await runValidateWith({
-      apis: [
-        {
-          _kind: 'api', _exportName: 'listUsers',
-          id: 'list-users', path: '/v1/users', method: 'GET',
-          authType: 'jwt',
-        },
-      ],
-    });
-    const rule = errors.find(e => e.code === 'SECURITY_MISSING_TENANT_PATH');
-    expect(rule).toBeDefined();
-    expect(rule?.message).toContain("'list-users'");
-    expect(rule?.message).toContain('/v1/tenants/{tenantId}/');
-  });
-
-  it('SECURITY_MISSING_TENANT_PATH — silent when the API path includes the placeholder', async () => {
-    const { errors } = await runValidateWith({
-      apis: [
-        {
-          _kind: 'api', _exportName: 'listUsers',
-          id: 'list-users', path: '/v1/tenants/{tenantId}/users', method: 'GET',
-          authType: 'jwt',
-        },
-      ],
-    });
-    expect(errors.find(e => e.code === 'SECURITY_MISSING_TENANT_PATH')).toBeUndefined();
-  });
-
-  it('SECURITY_MISSING_TENANT_PATH — silent for anonymous (authType=none) APIs', async () => {
-    const { errors } = await runValidateWith({
-      apis: [
+      actions: [
         {
-          _kind: 'api', _exportName: 'health',
-          id: 'health', path: '/v1/health', method: 'GET',
-          auth: { type: 'none' },
+          _kind: 'action', _exportName: 'listUsers',
+          id: 'list-users', backendAccess: 'domain',
+          exposure: {
+            type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET',
+            auth: 'required', tenancy: 'required',
+          },
+          idempotent: true,
         },
       ],
     });

package/src/builder/build-registry.ts

@@ -1,22 +1,24 @@
 import { relative, resolve } from 'node:path';
 import type {
   DomainRegistry,
-  ApiRegistryEntry,
-  ApiVersionSnapshot,
+  ActionRegistryEntry,
   SchemaSnapshot,
   WebhookRegistryEntry,
   SubscriberRegistryEntry,
   ScheduleRegistryEntry,
   JobRegistryEntry,
-  ActionRegistryEntry,
   IntegrationRegistryEntry,
   EventRegistryEntry,
   DomainRegistryEntry,
   SerialDeploymentConfig,
-} from '@mettlecast/domain-cdk-packer';
+} from '../types.js';
 import { walkDomainDir } from '../utils/file-helpers.js';
 import { loadModuleExports, type RawPrimitiveExport } from './load-module.js';
 
+// Issue #4689: the legacy `defineApi` primitive was removed from
+// `@mettlecast/domain-runtime`. The only HTTP endpoint surface in
+// the new registry is `actions[]` whose `exposure.type === 'api'`.
+
 type ActionBackendAccess = 'private' | 'domain' | 'platform';
 
 type ActionExposure =
@@ -190,9 +192,8 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
     defaultDeployment: deployment(domainRaw),
   };
 
-  const [apiExports, webhookExports, subscriberExports, actionExports,
+const [webhookExports, subscriberExports, actionExports,
          scheduleExports, jobExports, integrationExports, eventExports] = await Promise.all([
-    Promise.all(paths.apis.map(load)),
     Promise.all(paths.webhooks.map(load)),
     Promise.all(paths.subscribers.map(load)),
     Promise.all(paths.actions.map(load)),
@@ -202,43 +203,6 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
     paths.publishes ? load(paths.publishes) : Promise.resolve([]),
   ]);
 
-  const VALID_API_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
-
-  const apis: ApiRegistryEntry[] = paths.apis.flatMap((filePath, i) =>
-    (apiExports[i] ?? [])
-      .filter(e => e['_kind'] === 'api')
-      .map(e => {
-        const rawMethod = typeof e['method'] === 'string' ? e['method'].toUpperCase() : '';
-        if (!rawMethod || !VALID_API_METHODS.has(rawMethod)) {
-          warnings.push(`${relPath(filePath)}: defineApi "${e['id']}" has invalid or missing method "${rawMethod || '(none)'}". Use one of: ${[...VALID_API_METHODS].join(', ')}.`);
-        }
-        const rawVersions = e['versions'] as Record<string, { input?: unknown; output?: unknown }> | undefined;
-        const versionSnapshots: ApiVersionSnapshot[] = rawVersions
-          ? Object.entries(rawVersions).map(([ver, v]) => ({
-              version: ver,
-              requestSchema: isJsonSchema(v?.input) ? (v.input as SchemaSnapshot) : undefined,
-              responseSchema: isJsonSchema(v?.output) ? (v.output as SchemaSnapshot) : undefined,
-            }))
-          : [];
-        const latestVersion = versionSnapshots[versionSnapshots.length - 1];
-        return {
-          id: String(e['id']),
-          kind: 'api' as const,
-          handlerFile: relPath(filePath),
-          path: String(e['path']),
-          method: VALID_API_METHODS.has(rawMethod) ? rawMethod : 'GET',
-          authType: ((e['auth'] as { type?: string } | undefined)?.type as 'jwt' | 'api-key' | 'none' | undefined) ?? 'jwt',
-          description: typeof e['description'] === 'string' ? e['description'] : undefined,
-          deployment: deployment(e),
-          outboundAccess: outboundAccess(e),
-          requestSchema: latestVersion?.requestSchema,
-          responseSchema: latestVersion?.responseSchema,
-          versions: versionSnapshots.length > 0 ? versionSnapshots : undefined,
-          examples: (e['examples'] as { request?: Record<string, unknown>; response?: Record<string, unknown> } | undefined),
-        };
-      })
-  );
-
   const webhooks: WebhookRegistryEntry[] = paths.webhooks.flatMap((filePath, i) =>
     (webhookExports[i] ?? [])
       .filter(e => e['_kind'] === 'webhook')
@@ -374,7 +338,6 @@ export async function buildRegistry(domainRoot: string): Promise<BuildResult> {
     schemaVersion: '1',
     domainRoot,
     domain,
-    apis,
     webhooks,
     subscribers,
     schedules,

package/src/builder/build-types.ts

@@ -1,4 +1,4 @@
-import type { DomainRegistry } from '@mettlecast/domain-cdk-packer';
+import type { DomainRegistry } from '../types.js';
 
 /**
  * Generate a .d.ts file declaring typed `ctx.actions.call(actionId, input)`