@mettlecast/domain-cli 0.2.60 → 0.2.61

package/src/commands/test.ts

@@ -38,7 +38,6 @@ export async function runTest(options: TestOptions): Promise<void> {
   const { registry } = await buildRegistry(domainRoot);
 
   const allEntries: RegistryEntry[] = [
-    ...registry.apis,
     ...registry.webhooks,
     ...registry.subscribers,
     ...registry.schedules,

package/src/commands/upgrade-backend.ts

@@ -22,10 +22,10 @@ const MIGRATIONS: Migration[] = [
   {
     fromMajor: 1,
     toMajor: 2,
-    description: 'Migrate defineApi from v1 to v2: rename `versions.v1.handler` shape',
+    description: 'Audit v1 domain backends for action-first API exposure requirements',
     transform(repoRoot: string, dryRun: boolean): void {
-      // Placeholder: real migration uses ts-morph to rewrite handler signatures
-      console.log(`[G20] Would apply: defineApi v1→v2 migration in ${repoRoot}/domains/**`);
+      // Placeholder: real migration uses ts-morph to rewrite handler signatures.
+      console.log(`[G20] Would audit action-first API exposure in ${repoRoot}/domains/**`);
       if (!dryRun) {
         console.log('[G20] ts-morph transform: (not yet implemented — add jscodeshift transforms here)');
       }

package/src/commands/validate.ts

@@ -149,44 +149,17 @@ async function checkRawPathViolations(
  * Each rule maps 1:1 to an aspect annotation code so downstream tooling
  * can correlate build-time and synth-time failures.
  *
- * NOTE on `SECURITY_MISSING_SECURITY_EXCEPTION` for legacy `defineApi`
- * entries: the registry builder does not propagate `securityException`
- * from legacy source — that field only exists on action-style API
- * exposures, which are covered by the existing `AUTH_NONE_REQUIRES_EXCEPTION`
- * rule in `checkActionFirstSecurity`. The aspect's corresponding check
- * (`assertAnonymousRoutesHaveException`) catches the legacy case at
- * synth time so a developer migrating to action-style APIs gets the
- * right guidance at the right layer.
+ * Issue #4689: the legacy `defineApi` factory and `registry.apis` field
+ * were removed. Deployment-time API invariants are enforced against the
+ * `actions[]` API-exposure surface — see `checkActionFirstSecurity`.
  */
-function checkDeploymentSecurity(
-  apis: import('@mettlecast/domain-cdk-packer').ApiRegistryEntry[],
-  actions: ActionRegistryEntry[],
-): ValidationError[] {
-  const errors: ValidationError[] = [];
-
-  for (const api of apis) {
-    // Non-anonymous APIs whose path lacks the tenant placeholder cannot
-    // bind `ctx.tenant.id` from the URL. The aspect surfaces this as
-    // `SECURITY_MISSING_TENANT_PATH`; the CLI version is a faster gate so
-    // CI doesn't pay the synth cost.
-    if (api.authType !== 'none' && !api.path.includes('/v1/tenants/{tenantId}/')) {
-      errors.push({
-        code: 'SECURITY_MISSING_TENANT_PATH',
-        message: `API '${api.id}' (${api.method} ${api.path}) is JWT-protected but its path does not include the canonical '/v1/tenants/{tenantId}/' placeholder. The runtime cannot bind ctx.tenant.id from a path that lacks the placeholder.`,
-      });
-    }
-  }
-
+function checkDeploymentSecurity(_actions: ActionRegistryEntry[]): ValidationError[] {
   // Action API exposures are already covered by `checkActionFirstSecurity`
   // for `tenancy: 'required'` paths and `auth: 'none'` exceptions. The
   // codes there (TENANT_API_PATH_REQUIRED, AUTH_NONE_REQUIRES_EXCEPTION)
   // are kept stable for back-compat — they map to the same aspect codes.
-
-  // Suppress the unused-actions lint while keeping the parameter shape
-  // for the future where actions gain new deployment-time invariants.
-  void actions;
-
-  return errors;
+  //
+  return [];
 }
 
 /**
@@ -308,28 +281,6 @@ function checkApiExposureSecurity(actionId: string, exposure: ActionApiExposureW
   return errors;
 }
 
-/**
- * DEFINE_API_LEGACY_USAGE — the action-first migration replaces
- * standalone `defineApi` calls with `defineAction` + `exposure.type:
- * 'api'`. Every `defineApi` call still in the source produces a row in
- * `registry.apis`; the validator emits one error per legacy API to
- * enforce the alpha breaking migration. The validate command's fixture
- * suite intentionally does not use `defineApi`, so this rule does not
- * break existing unit tests.
- */
-function checkDefineApiLegacyUsage(apiCount: number, apis: RegistryEntry[]): ValidationError[] {
-  if (apiCount === 0) return [];
-  const errors: ValidationError[] = [];
-  for (const api of apis) {
-    if (api.kind !== 'api') continue;
-    errors.push({
-      code: 'DEFINE_API_LEGACY_USAGE',
-      message: `API '${api.id}' uses legacy \`defineApi\`. Migrate to \`defineAction\` with \`exposure: { type: 'api', path, method, auth, tenancy }\` (#4619).`,
-    });
-  }
-  return errors;
-}
-
 /**
  * Run the validate command: build the registry and perform structural validation.
  * Exits the process with code 1 if validation fails (CI gate usage).
@@ -352,7 +303,6 @@ export async function runValidate(
   }
 
   errors.push(
-    ...checkDuplicateIds(registry.apis, 'api'),
     ...checkDuplicateIds(registry.webhooks, 'webhook'),
     ...checkDuplicateIds(registry.subscribers, 'subscriber'),
     ...checkDuplicateIds(registry.schedules, 'schedule'),
@@ -363,7 +313,6 @@ export async function runValidate(
   );
 
   const entriesWithFiles = [
-    ...registry.apis,
     ...registry.webhooks,
     ...registry.subscribers,
     ...registry.schedules,
@@ -387,42 +336,9 @@ export async function runValidate(
 
   errors.push(...checkSubscriberSemverRanges(registry.subscribers));
 
-  const VALID_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
-  for (const api of registry.apis) {
-    const entry = api as unknown as { deprecatedAt?: string; sunsetAt?: string };
-    errors.push(...checkLifecycleConsistency(entry, `api '${api.id}'`));
-    if (!api.requestSchema) {
-      errors.push({
-        code: 'MISSING_API_REQUEST_SCHEMA',
-        message: `API '${api.id}' (${api.method} ${api.path}) has no request schema. Define input/output in defineApi versions.`,
-      });
-    }
-    if (!api.responseSchema) {
-      errors.push({
-        code: 'MISSING_API_RESPONSE_SCHEMA',
-        message: `API '${api.id}' (${api.method} ${api.path}) has no response schema. Define input/output in defineApi versions.`,
-      });
-    }
-    if (!VALID_METHODS.has(api.method)) {
-      errors.push({
-        code: 'INVALID_API_METHOD',
-        message: `API '${api.id}' (${api.method} ${api.path}) has invalid method "${api.method}". Use one of: ${[...VALID_METHODS].join(', ')}.`,
-      });
-    }
-    const isVoidInput = api.requestSchema?.type === 'null';
-    if (!isVoidInput && !api.examples?.request) {
-      errors.push({
-        code: 'MISSING_API_REQUEST_EXAMPLE',
-        message: `API '${api.id}' (${api.method} ${api.path}) has no request example. Add examples: { request: {...}, response: {...} } to the defineApi config.`,
-      });
-    }
-    if (!api.examples?.response) {
-      errors.push({
-        code: 'MISSING_API_RESPONSE_EXAMPLE',
-        message: `API '${api.id}' (${api.method} ${api.path}) has no response example. Add examples: { request: {...}, response: {...} } to the defineApi config.`,
-      });
-    }
-  }
+  // Issue #4689: defineApi and registry.apis were removed. The action-first
+  // validation rules in `checkActionFirstSecurity` cover the action surface
+  // that now owns all HTTP endpoints.
 
   const rawPathErrors = await checkRawPathViolations(registry.domainRoot, config);
   errors.push(...rawPathErrors);
@@ -431,14 +347,13 @@ export async function runValidate(
   // Runs against the registry built above so the rules see the same
   // shape the CDK packer will eventually consume.
   errors.push(...checkActionFirstSecurity(registry.actions));
-  errors.push(...checkDefineApiLegacyUsage(registry.apis.length, registry.apis));
 
   // Issue #4662 Task D — deployment-time security gates. These mirror
   // the CDK synth-time `SecurityAssertionAspect` so violations are
   // caught before any AWS deployment is attempted.
-  errors.push(...checkDeploymentSecurity(registry.apis, registry.actions));
+  errors.push(...checkDeploymentSecurity(registry.actions));
 
-  const totalPrimitives = registry.apis.length + registry.webhooks.length +
+  const totalPrimitives = registry.webhooks.length +
     registry.subscribers.length + registry.schedules.length +
     registry.jobs.length + registry.actions.length;
   if (totalPrimitives === 0) {

package/src/server/api-server.ts

@@ -1,5 +1,5 @@
 import Fastify, { type FastifyInstance } from 'fastify';
-import type { DomainRegistry } from '@mettlecast/domain-cdk-packer';
+import type { DomainRegistry } from '../types.js';
 import { mountRoutes } from './mount-routes.js';
 
 /**

package/src/server/mount-routes.ts

@@ -1,6 +1,6 @@
 import { join } from 'node:path';
 import type { FastifyInstance } from 'fastify';
-import type { DomainRegistry } from '@mettlecast/domain-cdk-packer';
+import type { DomainRegistry } from '../types.js';
 import { hydrateLocalCtx } from '../runtime-stubs/hydrate-local-ctx.js';
 
 /**
@@ -21,30 +21,41 @@ function toFastifyPath(path: string): string {
 
 /**
  * Mount all API routes from the DomainRegistry onto the Fastify server.
- * Each route dynamically imports its handler file and hydrates a local dev ctx per request.
+ *
+ * Issue #4689: the only HTTP endpoint surface in the new registry is
+ * `actions[]` whose `exposure.type === 'api'`. `defineApi` was removed
+ * and `registry.apis` is always empty in fresh registries, so the
+ * dev server iterates the action array and mounts each API exposure
+ * directly. Internal-only actions are intentionally skipped — they
+ * are reachable only through `ctx.actions`.
+ *
+ * Each route dynamically imports its handler file and hydrates a local
+ * dev ctx per request.
  * @param options - MountRoutesOptions.
  */
 export async function mountRoutes(options: MountRoutesOptions): Promise<void> {
   const { server, registry, domainRoot } = options;
 
-  for (const api of registry.apis) {
-    const handlerAbsPath = join(domainRoot, api.handlerFile);
-    const fastifyPath = toFastifyPath(api.path);
+  for (const action of registry.actions) {
+    if (action.exposure?.type !== 'api') continue;
+    const exposure = action.exposure;
+    const handlerAbsPath = join(domainRoot, action.handlerFile);
+    const fastifyPath = toFastifyPath(exposure.path);
 
     const mod = await import(handlerAbsPath) as Record<string, unknown>;
     const def = Object.values(mod).find(
-      v => v && typeof v === 'object' && (v as Record<string, unknown>)['id'] === api.id
+      v => v && typeof v === 'object' && (v as Record<string, unknown>)['id'] === action.id
     ) as Record<string, unknown> | undefined;
 
     if (!def || typeof def['handler'] !== 'function') {
-      server.log.warn({ apiId: api.id, handlerAbsPath }, 'No handler function found, skipping route');
+      server.log.warn({ actionId: action.id, handlerAbsPath }, 'No handler function found, skipping route');
       continue;
     }
 
     const handler = def['handler'] as (event: unknown, ctx: unknown) => Promise<unknown>;
 
     server.route({
-      method: api.method === 'ANY' ? ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] : [api.method as never],
+      method: [exposure.method as never],
       url: fastifyPath,
       handler: async (request, reply) => {
         const { ctx } = await hydrateLocalCtx({ domainRoot });
@@ -63,6 +74,6 @@ export async function mountRoutes(options: MountRoutesOptions): Promise<void> {
       },
     });
 
-    server.log.info({ method: api.method, path: fastifyPath, apiId: api.id }, 'Route mounted');
+    server.log.info({ method: exposure.method, path: fastifyPath, actionId: action.id }, 'Route mounted');
   }
-}
+}

package/src/templates/api-skeleton.ts

@@ -1,5 +1,10 @@
 /**
  * Template for generating API handler skeleton.
+ *
+ * Action-first contract: HTTP endpoints are declared with `defineAction`
+ * + `exposure: { type: 'api', ... }`. The legacy `defineApi` factory was
+ * removed in #4689 — the only public HTTP endpoint primitive is now an
+ * action whose exposure type is `'api'`.
  */
 
 /**
@@ -21,45 +26,41 @@ function camelCase(s: string): string {
 export function apiSkeletonTemplate(domainId: string, apiId: string, tenancy: string): string {
   const tenantPath = tenancy === 'required' ? '/v1/tenants/{tenantId}' : '/v1';
   const outputType = `${camelCase(domainId)}${camelCase(apiId)}Output`;
+  // The `auth` posture must be set explicitly per the action-first contract:
+  //   - 'required' for tenant-scoped or any authenticated endpoint.
+  //   - 'none' for anonymous endpoints (then add `securityException`).
+  //   - 'service' for service-to-service only.
+  const authPosture = tenancy === 'system' ? 'service' : 'required';
   return `import { z } from 'zod';
-import { defineApi } from '@mettlecast/domain-runtime';
-import { createKyClient, initOtel } from '@mettlecast/domain-runtime';
+import { defineAction, initOtel } from '@mettlecast/domain-runtime';
 import type { Result, AppError } from '@mettlecast/domain-runtime';
 import { ok, err, notFound } from '@mettlecast/domain-runtime';
 
 // Initialise OpenTelemetry tracing for the process.  Idempotent —
 // safe to call at module scope.  Sets up OTLP export (when
-// OTEL_EXPORTER_OTLP_ENDPOINT is set) or console-export for
-// local dev.  Auto-instruments outbound HTTP calls via ky.
+// OTEL_EXPORTER_OTLP_ENDPOINT is set) or console-export for local dev.
 initOtel();
 
-// Shared HTTP client with retry on 503/429.  Replace this with
-// your own client if you need custom headers or auth.
-const http = createKyClient();
-
 const outputSchema = z.object({ ok: z.boolean() }).default({ ok: true });
 
-export const ${camelCase(apiId)} = defineApi({
+export const ${camelCase(apiId)} = defineAction({
   id: '${apiId}',
-  path: '${tenantPath}/${domainId}/${apiId}',
-  method: 'POST',
-  tenancy: '${tenancy}',
-  outboundAccess: 'internal',
-  versions: {
-    v1: {
-      status: 'stable',
-      input: z.object({}).default({}),
-      output: outputSchema,
-      handler: async (_input, _ctx): Promise<Result<z.infer<typeof outputSchema>, AppError>> => {
-        // Replace this with your handler logic.
-        // Return ok(value) on success, err({ ... }) on failure.
-        return ok({ ok: true });
-      },
-    },
+  backendAccess: 'domain',
+  exposure: {
+    type: 'api',
+    path: '${tenantPath}/${domainId}/${apiId}',
+    method: 'POST',
+    auth: '${authPosture}',
+    tenancy: '${tenancy}',
   },
-  examples: {
-    request: {},
-    response: { ok: true },
+  outboundAccess: 'internal',
+  idempotent: false,
+  input: z.object({}).default({}),
+  output: outputSchema,
+  handler: async (_input, _ctx): Promise<Result<z.infer<typeof outputSchema>, AppError>> => {
+    // Replace this with your handler logic.
+    // Return ok(value) on success, err({ ... }) on failure.
+    return ok({ ok: true });
   },
 });
 `;
@@ -101,4 +102,4 @@ export function apiFixtureSkeleton(
       body: exampleBody,
     },
   }, null, 2) + '\n';
-}
+}

package/src/templates/claude-md.ts

@@ -3,5 +3,5 @@
  */
 export function claudeMdTemplate(id: string): string {
   const titleName = id.replace(/-/g, ' ').replace(/\b\w/g, c => c.toUpperCase());
-  return `# ${titleName} Domain — Ownership\n\nYou are the domain owner for \`${id}\`.\n\n## Responsibilities\n\n- All source files under \`domains/${id}/\` are owned by you.\n- API handlers must use \`defineApi\` from \`@mettlecast/domain-runtime\`.\n- Cross-domain calls must use \`ctx.actions.call()\`, never direct imports.\n- AWS SDK must never be imported directly — use \`ctx\` helpers.\n\n## Scaffold Rules\n\nSee the root \`CLAUDE.md\` for full scaffold rules, anti-patterns, and workflow commands.\n\n## Domain Config\n\nSee \`domains/${id}/domain.config.ts\` for the domain definition.\n`;
+  return `# ${titleName} Domain — Ownership\n\nYou are the domain owner for \`${id}\`.\n\n## Responsibilities\n\n- All source files under \`domains/${id}/\` are owned by you.\n- Public HTTP endpoints must use \`defineAction({ exposure: { type: 'api', ... } })\` from \`@mettlecast/domain-runtime\`. The legacy \`defineApi\` factory is no longer scaffolded for public handlers.\n- Internal-only callable handlers must use \`defineAction({ exposure: { type: 'internal' } })\`.\n- Cross-domain calls must use \`ctx.actions.call()\`, never direct imports.\n- AWS SDK must never be imported directly — use \`ctx\` helpers.\n\n## Scaffold Rules\n\nSee the root \`CLAUDE.md\` for full scaffold rules, anti-patterns, and workflow commands.\n\n## Domain Config\n\nSee \`domains/${id}/domain.config.ts\` for the domain definition.\n`;
 }

package/src/templates/patterns/api/create-with-event.ts

@@ -1,6 +1,10 @@
 /**
  * Create-with-event API pattern template.
  * Produces: POST handler + publishes a domain event after mutation.
+ *
+ * Action-first: HTTP endpoints are declared with `defineAction` +
+ * `exposure: { type: 'api', ... }`. The legacy `defineApi` factory was
+ * removed in #4689.
  */
 
 function camelCase(s: string): string {
@@ -10,10 +14,10 @@ function camelCase(s: string): string {
 export function createWithEventTemplate(domain: string, id: string, tenancy: string): string {
   const varName = camelCase(id);
   const tenantPath = tenancy === 'required' ? '/v1/tenants/{tenantId}' : '/v1';
+  const authPosture = tenancy === 'system' ? 'service' : 'required';
 
   return `import { z } from 'zod';
-import { defineApi } from '@mettlecast/domain-runtime';
-import { createKyClient, initOtel } from '@mettlecast/domain-runtime';
+import { defineAction, initOtel } from '@mettlecast/domain-runtime';
 import type { Result, AppError } from '@mettlecast/domain-runtime';
 import { ok, err, notFound } from '@mettlecast/domain-runtime';
 
@@ -34,43 +38,45 @@ const ${varName}Output = z.object({
   status: 'created',
 });
 
-// ── API definition ───────────────────────────────────────────
+// ── Action definition (API exposure) ─────────────────────────
 
-export const ${varName} = defineApi({
+export const ${varName} = defineAction({
   id: '${id}',
-  path: '${tenantPath}/${domain}/${id}',
-  tenancy: '${tenancy}',
+  backendAccess: 'domain',
+  exposure: {
+    type: 'api',
+    path: '${tenantPath}/${domain}/${id}',
+    method: 'POST',
+    auth: '${authPosture}',
+    tenancy: '${tenancy}',
+  },
   outboundAccess: 'internal',
-  versions: {
-    v1: {
-      status: 'stable',
-      input: ${varName}Input,
-      output: ${varName}Output,
-      handler: async (input, ctx) => {
-        const entityId = crypto.randomUUID();
+  idempotent: false,
+  input: ${varName}Input,
+  output: ${varName}Output,
+  handler: async (input, ctx) => {
+    const entityId = crypto.randomUUID();
 
-        // ── Persist entity ────────────────────────────────────
-        await ctx.store.put(entityId, { id: entityId, name: input.name });
+    // ── Persist entity ────────────────────────────────────
+    await ctx.store.put(entityId, { id: entityId, name: input.name });
 
-        // ── Publish domain event ──────────────────────────────
-        await ctx.publish(
-          '${domain}.${id}.created',
-          {
-            id: entityId,
-            name: input.name,
-            tenantId: ctx.tenant.id,
-          },
-          1,
-        );
+    // ── Publish domain event ──────────────────────────────
+    await ctx.publish(
+      '${domain}.${id}.created',
+      {
+        id: entityId,
+        name: input.name,
+        tenantId: ctx.tenant.id,
+      },
+      1,
+    );
 
-        await ctx.audit.log('${id}.create', entityId, { tenantId: ctx.tenant.id });
+    await ctx.audit.log('${id}.create', entityId, { tenantId: ctx.tenant.id });
 
-        return {
-          id: entityId,
-          status: 'created',
-        };
-      },
-    },
+    return {
+      id: entityId,
+      status: 'created',
+    };
   },
 });
 `;
@@ -80,4 +86,4 @@ export const ${varName} = defineApi({
  * Example body string used as the event body in the add-api fixture for the
  * create-with-event pattern. Mirrors the default shape of the input schema.
  */
-export const createWithEventExampleBody = JSON.stringify({ name: 'Example' });
+export const createWithEventExampleBody = JSON.stringify({ name: 'Example' });

package/src/templates/patterns/api/idempotent-mutation.ts

@@ -1,6 +1,10 @@
 /**
  * Idempotent-mutation API pattern template.
  * Produces: PUT with idempotency key middleware.
+ *
+ * Action-first: HTTP endpoints are declared with `defineAction` +
+ * `exposure: { type: 'api', ... }`. The legacy `defineApi` factory was
+ * removed in #4689.
  */
 
 function camelCase(s: string): string {
@@ -10,10 +14,10 @@ function camelCase(s: string): string {
 export function idempotentMutationTemplate(domain: string, id: string, tenancy: string): string {
   const varName = camelCase(id);
   const tenantPath = tenancy === 'required' ? '/v1/tenants/{tenantId}' : '/v1';
+  const authPosture = tenancy === 'system' ? 'service' : 'required';
 
   return `import { z } from 'zod';
-import { defineApi } from '@mettlecast/domain-runtime';
-import { createKyClient, initOtel } from '@mettlecast/domain-runtime';
+import { defineAction, initOtel } from '@mettlecast/domain-runtime';
 import type { Result, AppError } from '@mettlecast/domain-runtime';
 import { ok, err, notFound } from '@mettlecast/domain-runtime';
 
@@ -39,53 +43,55 @@ const ${varName}Output = z.object({
   idempotencyKey: '00000000-0000-0000-0000-000000000000',
 });
 
-// ── API definition ───────────────────────────────────────────
+// ── Action definition (API exposure) ─────────────────────────
 
-export const ${varName} = defineApi({
+export const ${varName} = defineAction({
   id: '${id}',
-  path: '${tenantPath}/${domain}/${id}',
-  tenancy: '${tenancy}',
+  backendAccess: 'domain',
+  exposure: {
+    type: 'api',
+    path: '${tenantPath}/${domain}/${id}',
+    method: 'PUT',
+    auth: '${authPosture}',
+    tenancy: '${tenancy}',
+  },
   outboundAccess: 'internal',
-  versions: {
-    v1: {
-      status: 'stable',
-      input: ${varName}Input,
-      output: ${varName}Output,
-      handler: async (input, ctx) => {
-        // ── Check for duplicate (idempotency key = input.id) ──
-        const existing = await ctx.store.get('IDEMPOTENT#' + input.id);
+  idempotent: true,
+  input: ${varName}Input,
+  output: ${varName}Output,
+  handler: async (input, ctx) => {
+    // ── Check for duplicate (idempotency key = input.id) ──
+    const existing = await ctx.store.get('IDEMPOTENT#' + input.id);
 
-        if (existing) {
-          await ctx.audit.log('${id}.idempotent.duplicate', input.id);
-          return {
-            id: input.id,
-            status: 'already-processed',
-            idempotencyKey: input.id,
-          };
-        }
+    if (existing) {
+      await ctx.audit.log('${id}.idempotent.duplicate', input.id);
+      return {
+        id: input.id,
+        status: 'already-processed',
+        idempotencyKey: input.id,
+      };
+    }
 
-        // ── Apply mutation ────────────────────────────────────
-        await ctx.store.put(
-          '${id.toUpperCase()}#' + input.id,
-          { id: input.id, payload: input.payload, createdAt: new Date().toISOString() },
-        );
+    // ── Apply mutation ────────────────────────────────────
+    await ctx.store.put(
+      '${id.toUpperCase()}#' + input.id,
+      { id: input.id, payload: input.payload, createdAt: new Date().toISOString() },
+    );
 
-        // ── Record idempotency token with 24h TTL ─────────────
-        await ctx.store.put(
-          'IDEMPOTENT#' + input.id,
-          { entityId: input.id },
-          { ttl: Math.floor(Date.now() / 1000) + 86400 },
-        );
+    // ── Record idempotency token with 24h TTL ─────────────
+    await ctx.store.put(
+      'IDEMPOTENT#' + input.id,
+      { entityId: input.id },
+      { ttl: Math.floor(Date.now() / 1000) + 86400 },
+    );
 
-        await ctx.audit.log('${id}.idempotent.applied', input.id, { tenantId: ctx.tenant.id });
+    await ctx.audit.log('${id}.idempotent.applied', input.id, { tenantId: ctx.tenant.id });
 
-        return {
-          id: input.id,
-          status: 'applied',
-          idempotencyKey: input.id,
-        };
-      },
-    },
+    return {
+      id: input.id,
+      status: 'applied',
+      idempotencyKey: input.id,
+    };
   },
 });
 `;
@@ -98,4 +104,4 @@ export const ${varName} = defineApi({
 export const idempotentMutationExampleBody = JSON.stringify({
   id: '00000000-0000-0000-0000-000000000000',
   payload: {},
-});
+});