@mettlecast/domain-cli 0.2.60 → 0.2.62

package/src/__tests__/mount-routes.test.ts

@@ -16,43 +16,55 @@ vi.mock('../runtime-stubs/hydrate-local-ctx.js', () => ({
 
 import { mountRoutes } from '../server/mount-routes.js';
 
-function makeRegistry(apis: Array<Partial<DomainRegistry['apis'][0]>>): DomainRegistry {
+/**
+ * Build a minimal registry whose `actions[]` contains a single
+ * API-exposed entry per call. Issue #4689: the only HTTP endpoint
+ * surface is `actions[]` with `exposure.type === 'api'`.
+ */
+function makeRegistry(actions: Array<Partial<DomainRegistry['actions'][0]>>): DomainRegistry {
   return {
     schemaVersion: '1',
     domainRoot: '/fake/domain',
     domain: { id: 'test', kind: 'domain', name: 'Test', tenancy: 'none' },
-    apis: apis.map((a, i) => ({
-      id: `api-${i}`,
-      kind: 'api' as const,
-      handlerFile: `api/handler-${i}.ts`,
-      path: `/route-${i}`,
-      method: 'GET',
-      authType: 'none' as const,
-      ...a,
-    })),
     webhooks: [],
     subscribers: [],
     schedules: [],
     jobs: [],
-    actions: [],
+    actions: actions.map((a, i) => ({
+      id: `action-${i}`,
+      kind: 'action' as const,
+      handlerFile: `actions/handler-${i}.ts`,
+      backendAccess: 'domain' as const,
+      exposure: {
+        type: 'api' as const,
+        path: `/route-${i}`,
+        method: 'GET' as const,
+        auth: 'required' as const,
+        tenancy: 'required' as const,
+      },
+      idempotent: true,
+      ...a,
+    })) as DomainRegistry['actions'],
     integrations: [],
     events: [],
   };
 }
 
 describe('mountRoutes', () => {
-  it('registers one route per api entry', async () => {
+  it('registers one route per API-exposed action', async () => {
     const routes: Array<{ method: unknown; url: string }> = [];
     const server = {
       route: vi.fn((opts: { method: unknown; url: string }) => { routes.push(opts); }),
       log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
     };
 
-    vi.doMock('/fake/domain/api/handler-0.ts', () => ({
-      myApi: { id: 'api-0', _kind: 'api', handler: vi.fn().mockResolvedValue({ ok: true }) },
+    vi.doMock('/fake/domain/actions/handler-0.ts', () => ({
+      myAction: { id: 'action-0', _kind: 'action', handler: vi.fn().mockResolvedValue({ ok: true }) },
     }));
 
-    const registry = makeRegistry([{ id: 'api-0', handlerFile: 'api/handler-0.ts', path: '/route-0', method: 'GET' }]);
+    const registry = makeRegistry([
+      { id: 'action-0', handlerFile: 'actions/handler-0.ts', exposure: { type: 'api', path: '/route-0', method: 'GET', auth: 'required', tenancy: 'required' } },
+    ]);
 
     await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
 
@@ -67,13 +79,13 @@ describe('mountRoutes', () => {
       log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
     };
 
-    vi.doMock('/fake/domain/api/handler-1.ts', () => ({
-      myApi: { id: 'api-1', _kind: 'api', handler: vi.fn() },
+    vi.doMock('/fake/domain/actions/handler-1.ts', () => ({
+      myAction: { id: 'action-1', _kind: 'action', handler: vi.fn() },
     }));
 
-    const registry = makeRegistry([{
-      id: 'api-1', handlerFile: 'api/handler-1.ts', path: '/users/{id}/orders', method: 'GET',
-    }]);
+    const registry = makeRegistry([
+      { id: 'action-1', handlerFile: 'actions/handler-1.ts', exposure: { type: 'api', path: '/users/{id}/orders', method: 'GET', auth: 'required', tenancy: 'required' } },
+    ]);
 
     await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
 
@@ -86,15 +98,44 @@ describe('mountRoutes', () => {
       log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
     };
 
-    vi.doMock('/fake/domain/api/handler-2.ts', () => ({
-      noHandler: { id: 'api-2', _kind: 'api' },
+    vi.doMock('/fake/domain/actions/handler-2.ts', () => ({
+      noHandler: { id: 'action-2', _kind: 'action' },
     }));
 
-    const registry = makeRegistry([{ id: 'api-2', handlerFile: 'api/handler-2.ts', path: '/skip', method: 'GET' }]);
+    const registry = makeRegistry([
+      { id: 'action-2', handlerFile: 'actions/handler-2.ts', exposure: { type: 'api', path: '/skip', method: 'GET', auth: 'required', tenancy: 'required' } },
+    ]);
 
     await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
 
     expect(server.route).not.toHaveBeenCalled();
     expect(server.log.warn).toHaveBeenCalled();
   });
+
+  it('skips internal-only actions (exposure.type !== "api")', async () => {
+    const server = {
+      route: vi.fn(),
+      log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+    };
+
+    vi.doMock('/fake/domain/actions/handler-internal.ts', () => ({
+      internalAction: { id: 'internal-1', _kind: 'action', handler: vi.fn() },
+    }));
+
+    const registry: DomainRegistry = {
+      ...makeRegistry([]),
+      actions: [{
+        id: 'internal-1',
+        kind: 'action',
+        handlerFile: 'actions/handler-internal.ts',
+        backendAccess: 'domain',
+        exposure: { type: 'internal' },
+        idempotent: true,
+      } as unknown as DomainRegistry['actions'][0]],
+    };
+
+    await mountRoutes({ server: server as never, registry, domainRoot: '/fake/domain' });
+
+    expect(server.route).not.toHaveBeenCalled();
+  });
 });

package/src/__tests__/package-freshness.test.ts

@@ -2,7 +2,6 @@ import { describe, it, expect } from 'vitest';
 import {
   ActionBackendAccess,
   type ActionApiExposure,
-  type ApiRegistryEntry,
   type DomainRegistry,
   type ActionRegistryEntry,
 } from '@mettlecast/domain-cdk-packer';
@@ -45,24 +44,6 @@ describe('CLI ↔ CDK packer type freshness (#4662 Task D)', () => {
     expect(exposure.securityException?.reason).toMatch(/OPS-123/);
   });
 
-  it('exposes the ApiRegistryEntry.securityException field added in #4662', () => {
-    // The build-registry does not populate this field for legacy
-    // `defineApi` entries (they don't carry securityException in
-    // source), but the registry type must declare it so that
-    // future migrations can attach it. This assertion pins the field
-    // shape so the CLI doesn't silently fall behind if a future
-    // packer refactor removes the declaration.
-    const api: ApiRegistryEntry = {
-      kind: 'api',
-      handlerFile: 'src/api.ts',
-      path: '/v1/health',
-      method: 'GET',
-      authType: 'none',
-      securityException: { reason: 'public liveness probe' },
-    };
-    expect(api.securityException?.reason).toMatch(/liveness/);
-  });
-
   it('exposes the ActionRegistryEntry shape with the latest exposure metadata flags', () => {
     const action: ActionRegistryEntry = {
       kind: 'action',
@@ -82,7 +63,6 @@ describe('CLI ↔ CDK packer type freshness (#4662 Task D)', () => {
       schemaVersion: '1',
       domainRoot: '/tmp/fake',
       domain: { kind: 'domain', id: 'test', name: 'Test', tenancy: 'required' },
-      apis: [],
       webhooks: [],
       subscribers: [],
       schedules: [],
@@ -111,4 +91,4 @@ describe('CLI ↔ CDK packer type freshness (#4662 Task D)', () => {
       ?? parsed.devDependencies?.['@mettlecast/domain-cdk-packer'];
     expect(['*', 'workspace:*']).toContain(range);
   });
-});
+});

package/src/__tests__/smoke/scaffold.test.ts

@@ -448,11 +448,10 @@ describe('scaffold smoke test (issue #3831)', () => {
     expect(tsconfig.compilerOptions.strict).toBe(true);
   });
 
-  it('seeds api handlers from auth that import defineApi from @mettlecast/domain-runtime', async () => {
+  it('seeds api handlers from auth that import defineAction + exposure from @mettlecast/domain-runtime', async () => {
     // The auth module ships a hand-written seed api/me.ts. We
     // confirm it parses (no obvious syntax errors) and uses the runtime
-    // primitive. This is a structural check; the wave-2 "import ky + call
-    // initOtel()" expectation is documented below as a separate soft gate.
+    // primitive. This is a structural check.
     const apiFile = join(projectDir, 'domains', 'auth', 'api', 'me.ts');
     const s = await stat(apiFile).catch(() => null);
     if (!s) {
@@ -462,7 +461,8 @@ describe('scaffold smoke test (issue #3831)', () => {
     }
     const content = await readFile(apiFile, 'utf-8');
     expect(content).toMatch(/from\s+['"]@mettlecast\/domain-runtime['"]/);
-    expect(content).toMatch(/defineApi\s*\(/);
+    expect(content).toMatch(/defineAction\s*\(/);
+    expect(content).toMatch(/type:\s*['"]api['"]/);
   });
 
   it('seeds initOtel() references in api handlers (wave-2 acceptance gate)', async () => {
@@ -499,20 +499,18 @@ describe('scaffold smoke test (issue #3831)', () => {
     }
   });
 
-  it('api-skeleton template (add-api) emits createKyClient + initOtel references', async () => {
-    // The add-api template now imports `createKyClient` and `initOtel`
-    // from @mettlecast/domain-runtime (the ky-backed runtime client),
-    // not a direct `ky` npm import.  Seed handlers may also import `ky`
-    // directly if they need a browser-friendly HTTP client.
+  it('api-skeleton template (add-api) emits defineAction + exposure.type=api references', async () => {
+    // The add-api template now emits defineAction + exposure.type='api' as
+    // the canonical action-first HTTP endpoint primitive (#4689).
     const out = apiSkeletonTemplateForTest('payments', 'charge-card', 'required');
-    const hasKy = /createKyClient/.test(out) || /from\s+['"]ky['"]/.test(out);
-    const hasInitOtel = /\binitOtel\s*\(/.test(out);
-    if (!hasKy || !hasInitOtel) {
+    const hasDefineAction = /defineAction\s*\(/.test(out);
+    const hasApiExposure = /type:\s*['"]api['"]/.test(out);
+    if (!hasDefineAction || !hasApiExposure) {
       throw new Error(
         'api-skeleton template (packages/domain-cli/src/templates/api-skeleton.ts) ' +
-          'does not emit createKyClient or initOtel()\n' +
-          `  hasKy=${hasKy} hasInitOtel=${hasInitOtel}\n` +
-          '  expected: import { createKyClient, initOtel } from "@mettlecast/domain-runtime" AND initOtel()',
+          'does not emit defineAction + exposure.type=api\n' +
+          `  hasDefineAction=${hasDefineAction} hasApiExposure=${hasApiExposure}\n` +
+          '  expected: import { defineAction } from "@mettlecast/domain-runtime" AND exposure: { type: "api", ... }',
       );
     }
   });

package/src/__tests__/utils/manifest.test.ts

@@ -19,6 +19,7 @@ import {
   upsertManifestFile,
   inferPolicyFromPath,
   getManifestFile,
+  pruneManifest,
   type ManifestFileEntry,
   type TibManifest,
 } from '../../utils/manifest.js';
@@ -271,4 +272,131 @@ describe('manifest utilities', () => {
       await rm(tmpDir, { recursive: true, force: true });
     });
   });
+
+  describe('pruneManifest', () => {
+    it('removes entries for files that do not exist on disk', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      // Two entries: one file exists, one does not.
+      const existingPath = 'infra/main.tf';
+      const missingPath = 'infra/deleted.ts';
+      await mkdir(join(tmpDir, 'infra'), { recursive: true });
+      await writeFile(join(tmpDir, existingPath), 'content');
+
+      upsertManifestFile(manifest, {
+        path: existingPath,
+        module: 'core',
+        moduleVersion: '1.0.0',
+        sha256: 'abc',
+        wasTemplate: false,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'managed',
+      });
+      upsertManifestFile(manifest, {
+        path: missingPath,
+        module: 'core',
+        moduleVersion: '1.0.0',
+        sha256: 'def',
+        wasTemplate: false,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'managed',
+      });
+
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      expect(pruned).toBe(1);
+      expect(manifest.files).toHaveLength(1);
+      expect(manifest.files[0]?.path).toBe(existingPath);
+    });
+
+    it('keeps entries for files that exist on disk', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      const filePath = 'infra/modules/app.ts';
+      await mkdir(join(tmpDir, 'infra', 'modules'), { recursive: true });
+      await writeFile(join(tmpDir, filePath), '// app');
+
+      upsertManifestFile(manifest, {
+        path: filePath,
+        module: 'core',
+        moduleVersion: '1.0.0',
+        sha256: 'ghi',
+        wasTemplate: true,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'managed',
+      });
+
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      expect(pruned).toBe(0);
+      expect(manifest.files).toHaveLength(1);
+      expect(manifest.files[0]?.path).toBe(filePath);
+    });
+
+    it('returns count of pruned entries', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      // Three entries, all missing on disk.
+      const paths = ['a/missing1.ts', 'b/missing2.ts', 'c/missing3.ts'];
+      for (const path of paths) {
+        upsertManifestFile(manifest, {
+          path,
+          module: 'core',
+          moduleVersion: '1.0.0',
+          sha256: 'x',
+          wasTemplate: false,
+          installedAt: '2026-01-01T00:00:00Z',
+          policy: 'managed',
+        });
+      }
+
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      expect(pruned).toBe(3);
+      expect(manifest.files).toHaveLength(0);
+    });
+
+    it('handles empty manifest.files array', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      // manifest.files is [] by default.
+
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      expect(pruned).toBe(0);
+      expect(manifest.files).toEqual([]);
+    });
+
+    it('mutates manifest.files in place', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      const survivor = 'frontend/src/pages/auth/login.tsx';
+      await mkdir(join(tmpDir, 'frontend', 'src', 'pages', 'auth'), { recursive: true });
+      await writeFile(join(tmpDir, survivor), '// login');
+
+      upsertManifestFile(manifest, {
+        path: survivor,
+        module: 'frontend',
+        moduleVersion: '1.0.0',
+        sha256: 'kept',
+        wasTemplate: true,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'seed',
+      });
+      upsertManifestFile(manifest, {
+        path: 'frontend/src/pages/gone.tsx',
+        module: 'frontend',
+        moduleVersion: '1.0.0',
+        sha256: 'gone',
+        wasTemplate: true,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'seed',
+      });
+
+      const initialLength = manifest.files.length;
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      // Mutation is observable through the same manifest reference — caller
+      // does not need a return value to update its own copy.
+      expect(manifest.files).not.toHaveLength(initialLength);
+      expect(manifest.files).toHaveLength(1);
+      expect(manifest.files[0]?.path).toBe(survivor);
+      expect(pruned).toBe(1);
+    });
+  });
 });

package/src/__tests__/validate.test.ts

@@ -49,7 +49,6 @@ describe('buildRegistry action mapping (action-first migration)', () => {
   it('reads backendAccess directly when raw action exposes it', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: [],
       webhooks: [],
       subscribers: [],
       actions: ['/fake/domains/billing/actions/charge-card.ts'],
@@ -97,7 +96,6 @@ describe('buildRegistry action mapping (action-first migration)', () => {
   it('falls back from legacy visibility to backendAccess and collapses workspace -> domain', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: [],
       webhooks: [],
       subscribers: [],
       actions: [
@@ -133,7 +131,6 @@ describe('buildRegistry action mapping (action-first migration)', () => {
   it('defaults missing exposure to { type: internal } for legacy actions', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: [],
       webhooks: [],
       subscribers: [],
       actions: ['/fake/domains/billing/actions/legacy.ts'],
@@ -159,7 +156,6 @@ describe('buildRegistry action mapping (action-first migration)', () => {
   it('preserves inputSchema and outputSchema extraction', async () => {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: [],
       webhooks: [],
       subscribers: [],
       actions: ['/fake/domains/billing/actions/charge-card.ts'],
@@ -210,20 +206,17 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
 
   /**
    * Helper that wires the two file-walker / module-loader mocks so
-   * `buildRegistry` returns the supplied actions (plus the canonical
-   * domain row) and the supplied apis list. Returns the ValidationResult
+   * `buildRegistry` returns the supplied actions plus the canonical
+   * domain row. Returns the ValidationResult
    * produced by `runValidate`.
    */
   async function runValidateWith({
     actions = [],
-    apis = [],
   }: {
     actions?: Record<string, unknown>[];
-    apis?: Record<string, unknown>[];
   }): Promise<{ errors: { code: string; message: string }[]; warnings: string[]; valid: boolean; }> {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: apis.map(() => '/fake/domains/billing/api/x.ts'),
       webhooks: [],
       subscribers: [],
       actions: actions.map(() => '/fake/domains/billing/actions/x.ts'),
@@ -234,19 +227,15 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
     });
     // Mock consumption order inside buildRegistry:
     //   1. domain (paths.domain)        -> mock #1
-    //   2. apis files (paths.apis)      -> mock #2 (if any)
-    //   3. webhooks/subscribers/schedules/jobs/integrations -> empty arrays, no calls
-    //   4. actions files (paths.actions)-> mock #N (if any)
-    //   5. publishes (paths.publishes)  -> undefined, no call
+    //   2. webhooks/subscribers/schedules/jobs/integrations -> empty arrays, no calls
+    //   3. actions files (paths.actions)-> mock #N (if any)
+    //   4. publishes (paths.publishes)  -> undefined, no call
     // Each non-empty slot consumes exactly one mock per file (we
     // generate one synthetic file path per item so the slot has length
     // equal to the supplied arrays).
     mockLoadModuleExports.mockResolvedValueOnce([
       { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
     ]);
-    if (apis.length > 0) {
-      mockLoadModuleExports.mockResolvedValueOnce(apis as never);
-    }
     if (actions.length > 0) {
       mockLoadModuleExports.mockResolvedValueOnce(actions as never);
     }
@@ -504,51 +493,6 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
     expect(errors.find(e => e.code === 'SYSTEM_API_REQUIRES_ROLE')).toBeUndefined();
   });
 
-  it('DEFINE_API_LEGACY_USAGE — fires once per legacy defineApi entry', async () => {
-    // Stub out the api builder checks (requestSchema, examples, etc.)
-    // because the test fixture intentionally provides a minimal api
-    // shape. We only assert on the new DEFINE_API_LEGACY_USAGE rule
-    // here; other rules are covered by build-registry.test.ts and the
-    // existing validate.test.ts suite.
-    const { errors } = await runValidateWith({
-      actions: [],
-      apis: [
-        {
-          _kind: 'api', _exportName: 'legacyList',
-          id: 'legacy-list', path: '/v1/list', method: 'GET',
-          auth: { type: 'jwt' },
-          versions: {
-            v1: {
-              status: 'stable',
-              input: { type: 'object', properties: {}, default: {} },
-              output: { type: 'object', properties: {}, default: {} },
-              handler: () => undefined,
-            },
-          },
-          examples: { request: {}, response: {} },
-        },
-      ],
-    });
-    const rules = errors.filter(e => e.code === 'DEFINE_API_LEGACY_USAGE');
-    expect(rules).toHaveLength(1);
-    expect(rules[0]?.message).toContain("'legacy-list'");
-  });
-
-  it('DEFINE_API_LEGACY_USAGE — silent when registry has no defineApi rows', async () => {
-    const { errors } = await runValidateWith({
-      actions: [
-        {
-          _kind: 'action', _exportName: 'internalOnly',
-          id: 'internal-only', backendAccess: 'domain',
-          exposure: { type: 'internal' },
-          idempotent: false,
-        },
-      ],
-      apis: [],
-    });
-    expect(errors.find(e => e.code === 'DEFINE_API_LEGACY_USAGE')).toBeUndefined();
-  });
-
   it('combined: well-formed api action passes every rule', async () => {
     const { errors } = await runValidateWith({
       actions: [
@@ -568,7 +512,6 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
       'ACTION_EXPOSURE_REQUIRED', 'API_EXPOSURE_AUTH_REQUIRED',
       'TENANT_API_PATH_REQUIRED', 'AUTH_NONE_REQUIRES_EXCEPTION',
       'TENANCY_NONE_REQUIRES_REASON_WHEN_PUBLIC', 'SYSTEM_API_REQUIRES_ROLE',
-      'DEFINE_API_LEGACY_USAGE',
     ];
     const firedSecurityRules = errors.filter(e => securityCodes.includes(e.code));
     expect(firedSecurityRules).toHaveLength(0);
@@ -579,12 +522,18 @@ describe('runValidate action-first security rules (#4619 / Wave 6)', () => {
 });
 
 /**
- * Deployment-time security rules (#4662 Task D).
+ * Deployment-time security rules (#4662 Task D, #4689).
  *
  * These mirror the CDK aspect's synth-time checks so CI can gate the
  * build BEFORE synth is attempted. Each rule emits a structured
  * `ValidationError` whose `code` matches the aspect annotation code,
  * making the two layers correlatable.
+ *
+ * Issue #4689: defineApi and registry.apis were removed. The action-first
+ * `TENANT_API_PATH_REQUIRED` rule in the `#4619 / Wave 6` suite now owns
+ * the placeholder invariant. The deployment-time rules below assert that
+ * no duplicate `SECURITY_MISSING_TENANT_PATH` codes are emitted for the
+ * action surface.
  */
 describe('runValidate deployment-time security rules (#4662 Task D)', () => {
   const DOMAIN_ROOT = '/fake/domains/billing';
@@ -595,14 +544,11 @@ describe('runValidate deployment-time security rules (#4662 Task D)', () => {
 
   async function runValidateWith({
     actions = [],
-    apis = [],
   }: {
     actions?: Record<string, unknown>[];
-    apis?: Record<string, unknown>[];
   }): Promise<{ errors: { code: string; message: string }[]; warnings: string[]; valid: boolean; }> {
     mockWalkDomainDir.mockResolvedValue({
       domain: '/fake/domains/billing/domain.config.ts',
-      apis: apis.map(() => '/fake/domains/billing/api/x.ts'),
       webhooks: [],
       subscribers: [],
       actions: actions.map(() => '/fake/domains/billing/actions/x.ts'),
@@ -614,9 +560,6 @@ describe('runValidate deployment-time security rules (#4662 Task D)', () => {
     mockLoadModuleExports.mockResolvedValueOnce([
       { _kind: 'domain', _exportName: 'default', id: 'billing', name: 'Billing', tenancy: 'required' },
     ]);
-    if (apis.length > 0) {
-      mockLoadModuleExports.mockResolvedValueOnce(apis as never);
-    }
     if (actions.length > 0) {
       mockLoadModuleExports.mockResolvedValueOnce(actions as never);
     }
@@ -625,42 +568,17 @@ describe('runValidate deployment-time security rules (#4662 Task D)', () => {
     return { errors: result.errors, warnings: result.warnings, valid: result.valid };
   }
 
-  it('SECURITY_MISSING_TENANT_PATH — fires for an API whose path lacks the tenant placeholder', async () => {
+  it('does NOT emit SECURITY_MISSING_TENANT_PATH for an action that already includes the tenant placeholder', async () => {
     const { errors } = await runValidateWith({
-      apis: [
-        {
-          _kind: 'api', _exportName: 'listUsers',
-          id: 'list-users', path: '/v1/users', method: 'GET',
-          authType: 'jwt',
-        },
-      ],
-    });
-    const rule = errors.find(e => e.code === 'SECURITY_MISSING_TENANT_PATH');
-    expect(rule).toBeDefined();
-    expect(rule?.message).toContain("'list-users'");
-    expect(rule?.message).toContain('/v1/tenants/{tenantId}/');
-  });
-
-  it('SECURITY_MISSING_TENANT_PATH — silent when the API path includes the placeholder', async () => {
-    const { errors } = await runValidateWith({
-      apis: [
-        {
-          _kind: 'api', _exportName: 'listUsers',
-          id: 'list-users', path: '/v1/tenants/{tenantId}/users', method: 'GET',
-          authType: 'jwt',
-        },
-      ],
-    });
-    expect(errors.find(e => e.code === 'SECURITY_MISSING_TENANT_PATH')).toBeUndefined();
-  });
-
-  it('SECURITY_MISSING_TENANT_PATH — silent for anonymous (authType=none) APIs', async () => {
-    const { errors } = await runValidateWith({
-      apis: [
+      actions: [
         {
-          _kind: 'api', _exportName: 'health',
-          id: 'health', path: '/v1/health', method: 'GET',
-          auth: { type: 'none' },
+          _kind: 'action', _exportName: 'listUsers',
+          id: 'list-users', backendAccess: 'domain',
+          exposure: {
+            type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET',
+            auth: 'required', tenancy: 'required',
+          },
+          idempotent: true,
         },
       ],
     });