@mettlecast/domain-cli 0.2.61 → 0.2.62

package/src/__tests__/commands/update-all.test.ts

@@ -0,0 +1,322 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdtemp } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { rmSync } from 'node:fs';
+
+vi.mock('../../commands/build.js', () => ({
+  runBuild: vi.fn(),
+}));
+
+vi.mock('../../commands/build-catalog.js', () => ({
+  runBuildCatalog: vi.fn(),
+}));
+
+vi.mock('../../commands/build-flows.js', () => ({
+  runBuildFlows: vi.fn(),
+}));
+
+vi.mock('../../commands/build-ui.js', () => ({
+  runBuildUi: vi.fn(),
+}));
+
+vi.mock('../../commands/regenerate-modules-hashes.js', () => ({
+  runRegenerateModulesHashes: vi.fn(),
+}));
+
+vi.mock('../../commands/doctor.js', () => ({
+  runDoctor: vi.fn(),
+}));
+
+vi.mock('../../utils/scaffold-config.js', () => ({
+  readScaffoldConfig: vi.fn(),
+}));
+
+import { runUpdateAll } from '../../commands/update-all.js';
+import { runBuild } from '../../commands/build.js';
+import { runBuildCatalog } from '../../commands/build-catalog.js';
+import { runBuildFlows } from '../../commands/build-flows.js';
+import { runBuildUi } from '../../commands/build-ui.js';
+import { runRegenerateModulesHashes } from '../../commands/regenerate-modules-hashes.js';
+import { runDoctor } from '../../commands/doctor.js';
+import { readScaffoldConfig } from '../../utils/scaffold-config.js';
+
+const mockRunBuild = vi.mocked(runBuild);
+const mockRunBuildCatalog = vi.mocked(runBuildCatalog);
+const mockRunBuildFlows = vi.mocked(runBuildFlows);
+const mockRunBuildUi = vi.mocked(runBuildUi);
+const mockRunRegenerateModulesHashes = vi.mocked(runRegenerateModulesHashes);
+const mockRunDoctor = vi.mocked(runDoctor);
+const mockReadScaffoldConfig = vi.mocked(readScaffoldConfig);
+
+/** Build a minimal but valid DoctorReport. */
+function makeDoctorReport(pass: boolean) {
+  return {
+    checks: [
+      {
+        name: 'sample-check',
+        status: pass ? 'PASS' : 'FAIL',
+        message: pass ? 'all good' : 'something failed',
+      },
+    ],
+    exitCode: pass ? 0 : 1,
+    pass,
+  };
+}
+
+/** Build a minimal but valid ScaffoldConfig with the given domainIds. */
+function makeScaffoldConfig(domainIds: string[]) {
+  return {
+    scaffoldVersion: '1.0.0',
+    enabledModules: ['core'],
+    projectName: 'test-project',
+    awsRegion: 'eu-north-1',
+    awsAccountId: '123456789012',
+    domainIds,
+    flowIds: [],
+    scaffoldBucket: 'mc-scaffold',
+  };
+}
+
+describe('update-all command', () => {
+  let tempDir: string;
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'tib-update-all-'));
+    vi.clearAllMocks();
+
+    // Default mocks so each test only needs to override what's relevant.
+    mockRunBuild.mockResolvedValue('/tmp/.mc/domain-registry.json');
+    mockRunBuildCatalog.mockResolvedValue({
+      version: 2,
+      generatedAt: new Date().toISOString(),
+      domains: [],
+      actions: [],
+      events: [],
+      subscribers: [],
+      jobs: [],
+      schedules: [],
+      integrations: [],
+    });
+    mockRunBuildFlows.mockResolvedValue('/tmp/.mc/flows-registry.json');
+    mockRunBuildUi.mockResolvedValue(undefined);
+    mockRunRegenerateModulesHashes.mockResolvedValue('/tmp/.mc/modules-hashes.json');
+    mockRunDoctor.mockResolvedValue(makeDoctorReport(true));
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it('reads scaffold-config from the project root', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig([]));
+
+    await runUpdateAll({ projectRoot: tempDir });
+
+    expect(mockReadScaffoldConfig).toHaveBeenCalledTimes(1);
+    expect(mockReadScaffoldConfig).toHaveBeenCalledWith(tempDir);
+  });
+
+  it('builds all domains from scaffold-config', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(
+      makeScaffoldConfig(['auth', 'data-management', 'orgs']),
+    );
+
+    await runUpdateAll({ projectRoot: tempDir });
+
+    expect(mockRunBuild).toHaveBeenCalledTimes(3);
+    expect(mockRunBuild).toHaveBeenCalledWith({
+      domainRoot: join(tempDir, 'domains', 'auth'),
+    });
+    expect(mockRunBuild).toHaveBeenCalledWith({
+      domainRoot: join(tempDir, 'domains', 'data-management'),
+    });
+    expect(mockRunBuild).toHaveBeenCalledWith({
+      domainRoot: join(tempDir, 'domains', 'orgs'),
+    });
+  });
+
+  it('runs build-catalog after all domains are built', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig(['auth', 'orgs']));
+
+    await runUpdateAll({ projectRoot: tempDir });
+
+    expect(mockRunBuildCatalog).toHaveBeenCalledTimes(1);
+    expect(mockRunBuildCatalog).toHaveBeenCalledWith(join(tempDir, '.mc'));
+
+    // build-catalog must come after every runBuild call.
+    const catalogOrder = mockRunBuildCatalog.mock.invocationCallOrder[0]!;
+    for (const order of mockRunBuild.mock.invocationCallOrder) {
+      expect(order).toBeLessThan(catalogOrder);
+    }
+  });
+
+  it('runs build-flows after build-catalog', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig(['auth']));
+
+    await runUpdateAll({ projectRoot: tempDir });
+
+    expect(mockRunBuildFlows).toHaveBeenCalledTimes(1);
+    expect(mockRunBuildFlows).toHaveBeenCalledWith({ projectRoot: tempDir });
+
+    const flowsOrder = mockRunBuildFlows.mock.invocationCallOrder[0]!;
+    const catalogOrder = mockRunBuildCatalog.mock.invocationCallOrder[0]!;
+    expect(catalogOrder).toBeLessThan(flowsOrder);
+  });
+
+  it('runs build-ui after build-flows', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig(['auth']));
+
+    await runUpdateAll({ projectRoot: tempDir });
+
+    expect(mockRunBuildUi).toHaveBeenCalledTimes(1);
+    expect(mockRunBuildUi).toHaveBeenCalledWith({ projectRoot: tempDir });
+
+    const uiOrder = mockRunBuildUi.mock.invocationCallOrder[0]!;
+    const flowsOrder = mockRunBuildFlows.mock.invocationCallOrder[0]!;
+    expect(flowsOrder).toBeLessThan(uiOrder);
+  });
+
+  it('runs regenerate-modules-hashes after build-ui', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig(['auth']));
+
+    await runUpdateAll({ projectRoot: tempDir });
+
+    expect(mockRunRegenerateModulesHashes).toHaveBeenCalledTimes(1);
+    expect(mockRunRegenerateModulesHashes).toHaveBeenCalledWith({
+      projectRoot: tempDir,
+    });
+
+    const hashesOrder = mockRunRegenerateModulesHashes.mock.invocationCallOrder[0]!;
+    const uiOrder = mockRunBuildUi.mock.invocationCallOrder[0]!;
+    expect(uiOrder).toBeLessThan(hashesOrder);
+  });
+
+  it('runs doctor as the final step and returns success when doctor passes', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig(['auth']));
+    mockRunDoctor.mockResolvedValue(makeDoctorReport(true));
+
+    const result = await runUpdateAll({ projectRoot: tempDir });
+
+    expect(mockRunDoctor).toHaveBeenCalledTimes(1);
+    expect(mockRunDoctor).toHaveBeenCalledWith({ projectRoot: tempDir });
+
+    // doctor must be the last command invoked.
+    const doctorOrder = mockRunDoctor.mock.invocationCallOrder[0]!;
+    for (const call of [
+      mockRunBuild,
+      mockRunBuildCatalog,
+      mockRunBuildFlows,
+      mockRunBuildUi,
+      mockRunRegenerateModulesHashes,
+    ]) {
+      const order = call.mock.invocationCallOrder[0];
+      if (order !== undefined) {
+        expect(order).toBeLessThan(doctorOrder);
+      }
+    }
+
+    expect(result.success).toBe(true);
+  });
+
+  it('returns success: false when doctor fails', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig(['auth']));
+    mockRunDoctor.mockResolvedValue(makeDoctorReport(false));
+
+    const result = await runUpdateAll({ projectRoot: tempDir });
+
+    expect(result.success).toBe(false);
+  });
+
+  it('continues building remaining domains after one domain build fails', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(
+      makeScaffoldConfig(['auth', 'broken', 'orgs']),
+    );
+
+    // The middle domain throws; the others should still be built.
+    mockRunBuild.mockImplementation(async (options: { domainRoot: string }) => {
+      if (options.domainRoot.endsWith('broken')) {
+        throw new Error('synthetic build failure');
+      }
+      return '/tmp/.mc/domain-registry.json';
+    });
+
+    const result = await runUpdateAll({ projectRoot: tempDir });
+
+    // All three domains are attempted even though one throws.
+    expect(mockRunBuild).toHaveBeenCalledTimes(3);
+    expect(mockRunBuild).toHaveBeenCalledWith({
+      domainRoot: join(tempDir, 'domains', 'auth'),
+    });
+    expect(mockRunBuild).toHaveBeenCalledWith({
+      domainRoot: join(tempDir, 'domains', 'broken'),
+    });
+    expect(mockRunBuild).toHaveBeenCalledWith({
+      domainRoot: join(tempDir, 'domains', 'orgs'),
+    });
+
+    // The remaining pipeline still runs to completion.
+    expect(mockRunBuildCatalog).toHaveBeenCalledTimes(1);
+    expect(mockRunBuildFlows).toHaveBeenCalledTimes(1);
+    expect(mockRunBuildUi).toHaveBeenCalledTimes(1);
+    expect(mockRunRegenerateModulesHashes).toHaveBeenCalledTimes(1);
+    expect(mockRunDoctor).toHaveBeenCalledTimes(1);
+    expect(result.success).toBe(true);
+  });
+
+  it('propagates upstream failures (catalog/flows/ui/hashes) instead of swallowing them', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig(['auth']));
+    mockRunBuildCatalog.mockRejectedValue(new Error('catalog boom'));
+
+    await expect(runUpdateAll({ projectRoot: tempDir })).rejects.toThrow(
+      /catalog boom/,
+    );
+    // Pipeline stops before later stages.
+    expect(mockRunBuildFlows).not.toHaveBeenCalled();
+    expect(mockRunBuildUi).not.toHaveBeenCalled();
+    expect(mockRunRegenerateModulesHashes).not.toHaveBeenCalled();
+    expect(mockRunDoctor).not.toHaveBeenCalled();
+  });
+
+  it('handles empty domainIds gracefully', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig([]));
+
+    const result = await runUpdateAll({ projectRoot: tempDir });
+
+    // No per-domain builds run.
+    expect(mockRunBuild).not.toHaveBeenCalled();
+
+    // Downstream pipeline still completes.
+    expect(mockRunBuildCatalog).toHaveBeenCalledTimes(1);
+    expect(mockRunBuildFlows).toHaveBeenCalledTimes(1);
+    expect(mockRunBuildUi).toHaveBeenCalledTimes(1);
+    expect(mockRunRegenerateModulesHashes).toHaveBeenCalledTimes(1);
+    expect(mockRunDoctor).toHaveBeenCalledTimes(1);
+
+    expect(result.success).toBe(true);
+  });
+
+  it('returns a structured summary that includes the domain count and doctor result', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(
+      makeScaffoldConfig(['auth', 'data-management', 'orgs']),
+    );
+    mockRunDoctor.mockResolvedValue(makeDoctorReport(true));
+
+    const result = await runUpdateAll({ projectRoot: tempDir });
+
+    expect(result).toEqual({
+      success: true,
+      summary: 'Updated 3 domains; doctor PASS',
+    });
+  });
+
+  it('reports zero domains in the summary when scaffold-config has none', async () => {
+    mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig([]));
+    mockRunDoctor.mockResolvedValue(makeDoctorReport(false));
+
+    const result = await runUpdateAll({ projectRoot: tempDir });
+
+    expect(result.summary).toBe('Updated 0 domains; doctor FAIL');
+    expect(result.success).toBe(false);
+  });
+});

package/src/__tests__/doctor.test.ts

@@ -621,4 +621,77 @@ describe('runDoctor', () => {
       expect(reportPlain.exitCode).toBe(1);
     });
   });
+
+  describe('scaffold-config.json missing and root-level flows', () => {
+    it('reports WARN when scaffold-config.json is missing (friendly skip, not FAIL)', async () => {
+      // Set up minimal project but omit .mc/scaffold-config.json.
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
+      await mkdir(join(tempDir, 'domains'), { recursive: true });
+      await mkdir(join(tempDir, '.husky'), { recursive: true });
+      await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+
+      const report = await runDoctor({ projectRoot: tempDir });
+
+      const check = report.checks.find(c => c.name === 'scaffold-config.json matches on-disk');
+      expect(check).toBeDefined();
+      expect(check?.status).toBe('WARN');
+      expect(check?.status).not.toBe('FAIL');
+      // Doctor exits 0 — WARNs are non-fatal.
+      // (Other checks may FAIL on this minimal scaffold, so we don't assert
+      // exitCode === 0 — we only assert that THIS check is a WARN, not FAIL.)
+    });
+
+    it('reports FAIL when root-level flows/ contains .ts files', async () => {
+      // Create root-level flows/ with a .ts file (and a .json file for
+      // completeness — both should be detected).
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
+      await mkdir(join(tempDir, 'domains'), { recursive: true });
+      await mkdir(join(tempDir, '.husky'), { recursive: true });
+      await writeFile(
+        join(tempDir, '.mc', 'scaffold-config.json'),
+        JSON.stringify({ domainIds: [] })
+      );
+      await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+
+      const flowsDir = join(tempDir, 'flows');
+      await mkdir(flowsDir, { recursive: true });
+      // Minimal but valid TS file. Content is irrelevant — the check just
+      // looks for the file extension.
+      await writeFile(
+        join(flowsDir, 'legacy-flow.ts'),
+        'export const legacy = {};\n'
+      );
+
+      const report = await runDoctor({ projectRoot: tempDir });
+
+      const check = report.checks.find(c => c.name === 'No root-level flows (deprecated)');
+      expect(check).toBeDefined();
+      expect(check?.status).toBe('FAIL');
+      expect(check?.message).toMatch(/legacy-flow\.ts/);
+      expect(report.exitCode).toBe(1);
+    });
+
+    it('reports PASS when no root-level flows/ directory exists', async () => {
+      // Default project — no flows/ at the root.
+      await mkdir(join(tempDir, '.mc'), { recursive: true });
+      await mkdir(join(tempDir, 'domains'), { recursive: true });
+      await mkdir(join(tempDir, '.husky'), { recursive: true });
+      await writeFile(
+        join(tempDir, '.mc', 'scaffold-config.json'),
+        JSON.stringify({ domainIds: [] })
+      );
+      await writeFile(join(tempDir, '.husky', 'pre-commit'), '#!/bin/sh');
+
+      // Do NOT create flows/.
+      const flowsDir = join(tempDir, 'flows');
+      const { existsSync } = await import('node:fs');
+      expect(existsSync(flowsDir)).toBe(false);
+
+      const report = await runDoctor({ projectRoot: tempDir });
+
+      const check = report.checks.find(c => c.name === 'No root-level flows (deprecated)');
+      expect(check).toBeDefined();
+      expect(check?.status).toBe('PASS');
+    });
+  });
 });

package/src/__tests__/utils/manifest.test.ts

@@ -19,6 +19,7 @@ import {
   upsertManifestFile,
   inferPolicyFromPath,
   getManifestFile,
+  pruneManifest,
   type ManifestFileEntry,
   type TibManifest,
 } from '../../utils/manifest.js';
@@ -271,4 +272,131 @@ describe('manifest utilities', () => {
       await rm(tmpDir, { recursive: true, force: true });
     });
   });
+
+  describe('pruneManifest', () => {
+    it('removes entries for files that do not exist on disk', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      // Two entries: one file exists, one does not.
+      const existingPath = 'infra/main.tf';
+      const missingPath = 'infra/deleted.ts';
+      await mkdir(join(tmpDir, 'infra'), { recursive: true });
+      await writeFile(join(tmpDir, existingPath), 'content');
+
+      upsertManifestFile(manifest, {
+        path: existingPath,
+        module: 'core',
+        moduleVersion: '1.0.0',
+        sha256: 'abc',
+        wasTemplate: false,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'managed',
+      });
+      upsertManifestFile(manifest, {
+        path: missingPath,
+        module: 'core',
+        moduleVersion: '1.0.0',
+        sha256: 'def',
+        wasTemplate: false,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'managed',
+      });
+
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      expect(pruned).toBe(1);
+      expect(manifest.files).toHaveLength(1);
+      expect(manifest.files[0]?.path).toBe(existingPath);
+    });
+
+    it('keeps entries for files that exist on disk', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      const filePath = 'infra/modules/app.ts';
+      await mkdir(join(tmpDir, 'infra', 'modules'), { recursive: true });
+      await writeFile(join(tmpDir, filePath), '// app');
+
+      upsertManifestFile(manifest, {
+        path: filePath,
+        module: 'core',
+        moduleVersion: '1.0.0',
+        sha256: 'ghi',
+        wasTemplate: true,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'managed',
+      });
+
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      expect(pruned).toBe(0);
+      expect(manifest.files).toHaveLength(1);
+      expect(manifest.files[0]?.path).toBe(filePath);
+    });
+
+    it('returns count of pruned entries', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      // Three entries, all missing on disk.
+      const paths = ['a/missing1.ts', 'b/missing2.ts', 'c/missing3.ts'];
+      for (const path of paths) {
+        upsertManifestFile(manifest, {
+          path,
+          module: 'core',
+          moduleVersion: '1.0.0',
+          sha256: 'x',
+          wasTemplate: false,
+          installedAt: '2026-01-01T00:00:00Z',
+          policy: 'managed',
+        });
+      }
+
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      expect(pruned).toBe(3);
+      expect(manifest.files).toHaveLength(0);
+    });
+
+    it('handles empty manifest.files array', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      // manifest.files is [] by default.
+
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      expect(pruned).toBe(0);
+      expect(manifest.files).toEqual([]);
+    });
+
+    it('mutates manifest.files in place', async () => {
+      const manifest = createManifest('1.0.0', 'test-project', 'eu-north-1', ['core']);
+      const survivor = 'frontend/src/pages/auth/login.tsx';
+      await mkdir(join(tmpDir, 'frontend', 'src', 'pages', 'auth'), { recursive: true });
+      await writeFile(join(tmpDir, survivor), '// login');
+
+      upsertManifestFile(manifest, {
+        path: survivor,
+        module: 'frontend',
+        moduleVersion: '1.0.0',
+        sha256: 'kept',
+        wasTemplate: true,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'seed',
+      });
+      upsertManifestFile(manifest, {
+        path: 'frontend/src/pages/gone.tsx',
+        module: 'frontend',
+        moduleVersion: '1.0.0',
+        sha256: 'gone',
+        wasTemplate: true,
+        installedAt: '2026-01-01T00:00:00Z',
+        policy: 'seed',
+      });
+
+      const initialLength = manifest.files.length;
+      const pruned = await pruneManifest(tmpDir, manifest);
+
+      // Mutation is observable through the same manifest reference — caller
+      // does not need a return value to update its own copy.
+      expect(manifest.files).not.toHaveLength(initialLength);
+      expect(manifest.files).toHaveLength(1);
+      expect(manifest.files[0]?.path).toBe(survivor);
+      expect(pruned).toBe(1);
+    });
+  });
 });

package/src/cli.ts

@@ -13,6 +13,8 @@ import { runAddModule } from './commands/add-module.js';
 import { runBuildFlows } from './commands/build-flows.js';
 import { runDoctor } from './commands/doctor.js';
 import { runCheckHashes } from './commands/check-hashes.js';
+import { runUpdateAll } from './commands/update-all.js';
+import { runRegenerateModulesHashes } from './commands/regenerate-modules-hashes.js';
 import { runUpgradeBackend } from './commands/upgrade-backend.js';
 import { runAddPage } from './commands/add-page.js';
 import { runCreateProject } from './commands/create-project.js';
@@ -195,11 +197,29 @@ program
 program
   .command('check-hashes')
   .description('Verify infra/modules/ has not been hand-edited since last scaffold')
-  .action(async () => {
-    const result = await runCheckHashes({});
+  .option('--write', 'Regenerate modules-hashes.json from current disk state instead of verifying')
+  .action(async (opts: { write?: boolean }) => {
+    const result = await runCheckHashes({ write: opts.write });
     process.exit(result.ok ? 0 : 1);
   });
 
+program
+  .command('update-all')
+  .description('Full refresh: build all domains, build catalog, build flows, build UI, regenerate hashes, run doctor')
+  .option('--project-root <path>', 'Root of the project (defaults to cwd)')
+  .action(async (opts: { projectRoot?: string }) => {
+    const result = await runUpdateAll({ projectRoot: opts.projectRoot });
+    process.exit(result.success ? 0 : 1);
+  });
+
+program
+  .command('regenerate-modules-hashes')
+  .description('Walk infra/modules/, compute SHA256 hashes, and write .mc/modules-hashes.json')
+  .option('--project-root <path>', 'Root of the project (defaults to cwd)')
+  .action(async (opts: { projectRoot?: string }) => {
+    await runRegenerateModulesHashes({ projectRoot: opts.projectRoot });
+  });
+
 program
   .command('upgrade-backend <target-major>')
   .description('Run jscodeshift/ts-morph migrations between major versions of domain-runtime')

package/src/commands/check-hashes.ts

@@ -9,6 +9,8 @@ import { cliLogger } from '../utils/logger.js';
 export interface CheckHashesOptions {
   /** Root directory of the project (defaults to cwd). */
   projectRoot?: string;
+  /** If true, regenerate .mc/modules-hashes.json from current infra/modules/ before checking. */
+  write?: boolean;
 }
 
 /**
@@ -57,6 +59,16 @@ interface ModulesHashesManifest {
  */
 export async function runCheckHashes(opts: CheckHashesOptions = {}): Promise<CheckHashesResult> {
   const root = opts.projectRoot ?? process.cwd();
+
+  // --write bootstraps the manifest from current infra/modules/ before verification.
+  // Must run before the manifest read below so it can create a missing manifest.
+  if (opts.write) {
+    const { runRegenerateModulesHashes } = await import('./regenerate-modules-hashes.js');
+    const outPath = await runRegenerateModulesHashes({ projectRoot: root });
+    cliLogger.info({ outPath }, 'modules-hashes.json regenerated');
+    return { ok: true, drifted: [], missing: [], unexpected: [] };
+  }
+
   const manifestPath = join(root, '.mc', 'modules-hashes.json');
   const modulesDir = join(root, 'infra', 'modules');
 

package/src/commands/doctor.ts

@@ -613,9 +613,9 @@ async function checkScaffoldConfigMatchesDisk(projectRoot: string): Promise<Doct
     } catch {
       return {
         name: 'scaffold-config.json matches on-disk',
-        status: 'FAIL',
-        message: 'Could not read .mc/scaffold-config.json',
-        fixHint: 'Ensure .mc/scaffold-config.json exists and is valid JSON',
+        status: 'WARN',
+        message: '.mc/scaffold-config.json not found or unreadable — skipping domain list sync check (expected on fresh clones before first scaffold)',
+        fixHint: 'Run mc-domain-module update-all to regenerate scaffold metadata',
         kNodeRef: 'K:runbook:add-domain',
       };
     }
@@ -728,7 +728,7 @@ async function checkRootLevelFlows(projectRoot: string): Promise<DoctorCheck> {
     }
     return {
       name: 'No root-level flows (deprecated)',
-      status: 'WARN',
+      status: 'FAIL',
       message: `${flowFiles.length} flow(s) still in root-level flows/: ${flowFiles.join(', ')}`,
       fixHint: 'Move these flows to domains/{owningDomain}/flows/ and delete the root-level copies.',
       kNodeRef: 'K:convention:flow-vs-subscriber-rule',