@mettlecast/domain-cli 0.2.61 → 0.2.63

package/dist/cli.js

@@ -13,6 +13,8 @@ import { runAddModule } from './commands/add-module.js';
 import { runBuildFlows } from './commands/build-flows.js';
 import { runDoctor } from './commands/doctor.js';
 import { runCheckHashes } from './commands/check-hashes.js';
+import { runUpdateAll } from './commands/update-all.js';
+import { runRegenerateModulesHashes } from './commands/regenerate-modules-hashes.js';
 import { runUpgradeBackend } from './commands/upgrade-backend.js';
 import { runAddPage } from './commands/add-page.js';
 import { runCreateProject } from './commands/create-project.js';
@@ -173,10 +175,26 @@ program
 program
     .command('check-hashes')
     .description('Verify infra/modules/ has not been hand-edited since last scaffold')
-    .action(async () => {
-    const result = await runCheckHashes({});
+    .option('--write', 'Regenerate modules-hashes.json from current disk state instead of verifying')
+    .action(async (opts) => {
+    const result = await runCheckHashes({ write: opts.write });
     process.exit(result.ok ? 0 : 1);
 });
+program
+    .command('update-all')
+    .description('Full refresh: build all domains, build catalog, build flows, build UI, regenerate hashes, run doctor')
+    .option('--project-root <path>', 'Root of the project (defaults to cwd)')
+    .action(async (opts) => {
+    const result = await runUpdateAll({ projectRoot: opts.projectRoot });
+    process.exit(result.success ? 0 : 1);
+});
+program
+    .command('regenerate-modules-hashes')
+    .description('Walk infra/modules/, compute SHA256 hashes, and write .mc/modules-hashes.json')
+    .option('--project-root <path>', 'Root of the project (defaults to cwd)')
+    .action(async (opts) => {
+    await runRegenerateModulesHashes({ projectRoot: opts.projectRoot });
+});
 program
     .command('upgrade-backend <target-major>')
     .description('Run jscodeshift/ts-morph migrations between major versions of domain-runtime')

package/dist/commands/check-hashes.d.ts

@@ -4,6 +4,8 @@
 export interface CheckHashesOptions {
     /** Root directory of the project (defaults to cwd). */
     projectRoot?: string;
+    /** If true, regenerate .mc/modules-hashes.json from current infra/modules/ before checking. */
+    write?: boolean;
 }
 /**
  * A single hash check result.

package/dist/commands/check-hashes.js

@@ -10,6 +10,14 @@ import { cliLogger } from '../utils/logger.js';
  */
 export async function runCheckHashes(opts = {}) {
     const root = opts.projectRoot ?? process.cwd();
+    // --write bootstraps the manifest from current infra/modules/ before verification.
+    // Must run before the manifest read below so it can create a missing manifest.
+    if (opts.write) {
+        const { runRegenerateModulesHashes } = await import('./regenerate-modules-hashes.js');
+        const outPath = await runRegenerateModulesHashes({ projectRoot: root });
+        cliLogger.info({ outPath }, 'modules-hashes.json regenerated');
+        return { ok: true, drifted: [], missing: [], unexpected: [] };
+    }
     const manifestPath = join(root, '.mc', 'modules-hashes.json');
     const modulesDir = join(root, 'infra', 'modules');
     let manifest;

package/dist/commands/doctor.js

@@ -520,9 +520,9 @@ async function checkScaffoldConfigMatchesDisk(projectRoot) {
         catch {
             return {
                 name: 'scaffold-config.json matches on-disk',
-                status: 'FAIL',
-                message: 'Could not read .mc/scaffold-config.json',
-                fixHint: 'Ensure .mc/scaffold-config.json exists and is valid JSON',
+                status: 'WARN',
+                message: '.mc/scaffold-config.json not found or unreadable — skipping domain list sync check (expected on fresh clones before first scaffold)',
+                fixHint: 'Run mc-domain-module update-all to regenerate scaffold metadata',
                 kNodeRef: 'K:runbook:add-domain',
             };
         }
@@ -634,7 +634,7 @@ async function checkRootLevelFlows(projectRoot) {
         }
         return {
             name: 'No root-level flows (deprecated)',
-            status: 'WARN',
+            status: 'FAIL',
             message: `${flowFiles.length} flow(s) still in root-level flows/: ${flowFiles.join(', ')}`,
             fixHint: 'Move these flows to domains/{owningDomain}/flows/ and delete the root-level copies.',
             kNodeRef: 'K:convention:flow-vs-subscriber-rule',

package/dist/commands/regenerate-modules-hashes.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Options for the regenerate-modules-hashes command.
+ */
+export interface RegenerateModulesHashesOptions {
+    /** Root directory of the project (defaults to cwd). */
+    projectRoot?: string;
+}
+/**
+ * Manifest of infra/modules/ files with their SHA256 hashes.
+ */
+export interface ModulesHashesManifest {
+    /** Schema version. */
+    version: '1';
+    /** ISO timestamp when the manifest was generated. */
+    generatedAt: string;
+    /** Map of relative file path to SHA256 hex digest. */
+    files: Record<string, string>;
+}
+/**
+ * Walk infra/modules/, compute a SHA256 for every file, and write the result
+ * to .mc/modules-hashes.json. Used to refresh the scaffold drift baseline.
+ * @param opts Options including project root directory.
+ * @returns Absolute path to the written manifest file.
+ */
+export declare function runRegenerateModulesHashes(opts?: RegenerateModulesHashesOptions): Promise<string>;

package/dist/commands/regenerate-modules-hashes.js

@@ -0,0 +1,58 @@
+import { readFile, readdir, writeFile, mkdir } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { createHash } from 'node:crypto';
+import { cliLogger } from '../utils/logger.js';
+/**
+ * Walk infra/modules/, compute a SHA256 for every file, and write the result
+ * to .mc/modules-hashes.json. Used to refresh the scaffold drift baseline.
+ * @param opts Options including project root directory.
+ * @returns Absolute path to the written manifest file.
+ */
+export async function runRegenerateModulesHashes(opts = {}) {
+    const root = opts.projectRoot ?? process.cwd();
+    const mcDir = join(root, '.mc');
+    const manifestPath = join(mcDir, 'modules-hashes.json');
+    const modulesDir = join(root, 'infra', 'modules');
+    // Files/directories to skip when walking infra/modules/
+    const SKIP_NAMES = new Set(['node_modules', 'dist', 'cdk.out', 'package-lock.json', '.npmrc']);
+    /** Normalize CRLF → LF so hashes match across platforms (Windows vs Linux). */
+    function normalizeLineEndings(buf) {
+        const str = buf.toString('utf8');
+        if (!str.includes('\r\n'))
+            return buf;
+        return Buffer.from(str.replace(/\r\n/g, '\n'), 'utf8');
+    }
+    // Walk infra/modules/ and collect every file path
+    async function walk(dir) {
+        const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+        const files = [];
+        for (const entry of entries) {
+            if (SKIP_NAMES.has(entry.name))
+                continue;
+            const full = join(dir, entry.name);
+            if (entry.isDirectory())
+                files.push(...await walk(full));
+            else if (entry.isFile())
+                files.push(full);
+        }
+        return files;
+    }
+    const onDiskFiles = await walk(modulesDir);
+    // Compute SHA256 for each file (line-ending-normalised)
+    const files = {};
+    for (const absPath of onDiskFiles) {
+        const relPath = relative(root, absPath).replace(/\\/g, '/');
+        const content = await readFile(absPath);
+        const normalized = normalizeLineEndings(content);
+        files[relPath] = createHash('sha256').update(normalized).digest('hex');
+    }
+    const manifest = {
+        version: '1',
+        generatedAt: new Date().toISOString(),
+        files,
+    };
+    await mkdir(mcDir, { recursive: true });
+    await writeFile(manifestPath, JSON.stringify(manifest, null, 2), 'utf8');
+    cliLogger.info({ path: manifestPath, fileCount: Object.keys(files).length }, 'modules-hashes manifest regenerated');
+    return manifestPath;
+}

package/dist/commands/update-all.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Run the full scaffold update pipeline:
+ *   1. Build each domain registry from `.mc/scaffold-config.json`
+ *   2. Build the combined domain catalog
+ *   3. Build flows registry
+ *   4. Build UI manifests
+ *   5. Regenerate module hashes
+ *   6. Run doctor
+ *
+ * Per-domain build failures are logged and skipped so that one bad domain does
+ * not abort the whole pipeline. The remaining steps still run.
+ *
+ * @param opts - Optional projectRoot override. Defaults to cwd.
+ * @returns success derived from doctor pass/fail and a human-readable summary.
+ */
+export declare function runUpdateAll(opts?: {
+    projectRoot?: string;
+}): Promise<{
+    success: boolean;
+    summary: string;
+}>;

package/dist/commands/update-all.js

@@ -0,0 +1,62 @@
+import { join } from 'node:path';
+import { cliLogger } from '../utils/logger.js';
+import { readScaffoldConfig } from '../utils/scaffold-config.js';
+import { runBuild } from './build.js';
+import { runBuildCatalog } from './build-catalog.js';
+import { runBuildFlows } from './build-flows.js';
+import { runBuildUi } from './build-ui.js';
+import { runRegenerateModulesHashes } from './regenerate-modules-hashes.js';
+import { runDoctor } from './doctor.js';
+/**
+ * Run the full scaffold update pipeline:
+ *   1. Build each domain registry from `.mc/scaffold-config.json`
+ *   2. Build the combined domain catalog
+ *   3. Build flows registry
+ *   4. Build UI manifests
+ *   5. Regenerate module hashes
+ *   6. Run doctor
+ *
+ * Per-domain build failures are logged and skipped so that one bad domain does
+ * not abort the whole pipeline. The remaining steps still run.
+ *
+ * @param opts - Optional projectRoot override. Defaults to cwd.
+ * @returns success derived from doctor pass/fail and a human-readable summary.
+ */
+export async function runUpdateAll(opts) {
+    const projectRoot = opts?.projectRoot ?? process.cwd();
+    cliLogger.info({ projectRoot }, 'update-all: starting');
+    // 1. Read scaffold-config to discover domains
+    const scaffoldConfig = await readScaffoldConfig(projectRoot);
+    const domainIds = scaffoldConfig.domainIds ?? [];
+    cliLogger.info({ domainCount: domainIds.length }, 'update-all: building domain registries');
+    // 2. Build each domain. Per-domain failures are logged and skipped.
+    for (const domainId of domainIds) {
+        const domainRoot = join(projectRoot, 'domains', domainId);
+        try {
+            cliLogger.info({ domainId, domainRoot }, 'update-all: building domain');
+            await runBuild({ domainRoot });
+        }
+        catch (err) {
+            cliLogger.error({ domainId, err: err instanceof Error ? err.message : String(err) }, 'update-all: domain build failed — continuing');
+        }
+    }
+    // 3. Build catalog from .mc
+    const mcDir = join(projectRoot, '.mc');
+    cliLogger.info({ mcDir }, 'update-all: building domain catalog');
+    await runBuildCatalog(mcDir);
+    // 4. Build flows
+    cliLogger.info({ projectRoot }, 'update-all: building flows registry');
+    await runBuildFlows({ projectRoot });
+    // 5. Build UI manifests
+    cliLogger.info({ projectRoot }, 'update-all: building UI manifests');
+    await runBuildUi({ projectRoot });
+    // 6. Regenerate module hashes
+    cliLogger.info({ projectRoot }, 'update-all: regenerating module hashes');
+    await runRegenerateModulesHashes({ projectRoot });
+    // 7. Run doctor — final gate
+    cliLogger.info({ projectRoot }, 'update-all: running doctor');
+    const report = await runDoctor({ projectRoot });
+    cliLogger.info({ pass: report.pass, exitCode: report.exitCode, checkCount: report.checks.length }, 'update-all: doctor complete');
+    const summary = `Updated ${domainIds.length} domains; doctor ${report.pass ? 'PASS' : 'FAIL'}`;
+    return { success: report.pass, summary };
+}

package/dist/utils/manifest.d.ts

@@ -26,3 +26,4 @@ export declare function upsertManifestFile(manifest: TibManifest, entry: Manifes
 export declare function removeManifestFile(manifest: TibManifest, filePath: string): void;
 export declare function getManifestFile(manifest: TibManifest, filePath: string): ManifestFileEntry | undefined;
 export declare function isScaffoldManaged(manifest: TibManifest, filePath: string): boolean;
+export declare function pruneManifest(projectRoot: string, manifest: TibManifest): Promise<number>;

package/dist/utils/manifest.js

@@ -1,4 +1,4 @@
-import { readFile, writeFile, mkdir } from 'fs/promises';
+import { readFile, writeFile, mkdir, access } from 'fs/promises';
 import path from 'path';
 import { cliLogger } from './logger.js';
 const MANIFEST_PATH = '.mc/manifest.json';
@@ -132,3 +132,18 @@ export function isScaffoldManaged(manifest, filePath) {
     // Returns true only when the file is in the manifest with policy 'managed'
     return entry != null && entry.policy === 'managed';
 }
+export async function pruneManifest(projectRoot, manifest) {
+    let pruned = 0;
+    const survivors = [];
+    for (const entry of manifest.files) {
+        try {
+            await access(path.join(projectRoot, entry.path));
+            survivors.push(entry);
+        }
+        catch {
+            pruned++;
+        }
+    }
+    manifest.files = survivors;
+    return pruned;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cli",
-  "version": "0.2.61",
+  "version": "0.2.63",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/__tests__/commands/build-flows.test.ts

@@ -151,4 +151,59 @@ describe('build-flows command', () => {
 
     expect(registry.flows[0]?.trigger?.eventId).toBe('domain.event');
   });
+
+  it('picks up flow from domains/auth/flows/ with owningDomain=\'auth\'', async () => {
+    const domainFlowsDir = join(tmpDir, 'domains', 'auth', 'flows');
+    await mkdir(domainFlowsDir, { recursive: true });
+
+    const flow = {
+      id: 'onboarding-flow',
+      name: 'Onboarding Flow',
+      steps: [
+        {
+          type: 'flow-control',
+          control: 'succeed',
+          name: 'End',
+        },
+      ],
+    };
+
+    await writeFile(join(domainFlowsDir, 'onboarding.json'), JSON.stringify(flow));
+
+    const outFile = await runBuildFlows({ projectRoot: tmpDir });
+    const content = await readFile(outFile, 'utf8');
+    const registry = JSON.parse(content) as FlowRegistry;
+
+    expect(registry.flows).toHaveLength(1);
+    expect(registry.flows[0]?.id).toBe('onboarding-flow');
+    expect(registry.flows[0]?.owningDomain).toBe('auth');
+  });
+
+  it('detects ID collision between root-level and domain-level flows (FlowIdCollisionError)', async () => {
+    // Same flow ID in BOTH root flows/ and a domain's flows/.
+    const rootFlowsDir = join(tmpDir, 'flows');
+    await mkdir(rootFlowsDir, { recursive: true });
+
+    const domainFlowsDir = join(tmpDir, 'domains', 'auth', 'flows');
+    await mkdir(domainFlowsDir, { recursive: true });
+
+    const flow = {
+      id: 'shared-flow',
+      name: 'Shared Flow',
+      steps: [
+        {
+          type: 'flow-control',
+          control: 'succeed',
+          name: 'End',
+        },
+      ],
+    };
+
+    await writeFile(join(rootFlowsDir, 'shared.json'), JSON.stringify(flow));
+    await writeFile(join(domainFlowsDir, 'shared.json'), JSON.stringify(flow));
+
+    await expect(runBuildFlows({ projectRoot: tmpDir }))
+      .rejects
+      .toThrow(FlowIdCollisionError);
+  });
 });

package/src/__tests__/commands/check-hashes.test.ts

@@ -139,4 +139,35 @@ describe('check-hashes', () => {
       /cannot read.*modules-hashes\.json/
     );
   });
+
+  it('--write regenerates manifest from disk (even if manifest was missing)', async () => {
+    // Set up infra/modules/ with a file, but NO .mc/modules-hashes.json.
+    await mkdir(join(tempDir, '.mc'), { recursive: true });
+    await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
+
+    const content = 'export const MyStack = {};';
+    await writeFile(join(tempDir, 'infra', 'modules', 'fresh.ts'), content);
+
+    // Confirm the manifest doesn't exist yet.
+    const { existsSync } = await import('node:fs');
+    expect(existsSync(join(tempDir, '.mc', 'modules-hashes.json'))).toBe(false);
+
+    // --write should bootstrap the manifest from disk and succeed.
+    const result = await runCheckHashes({ projectRoot: tempDir, write: true });
+    expect(result.ok).toBe(true);
+    expect(result.drifted).toHaveLength(0);
+    expect(result.missing).toHaveLength(0);
+    expect(result.unexpected).toHaveLength(0);
+
+    // The manifest should now exist on disk with the file's hash.
+    expect(existsSync(join(tempDir, '.mc', 'modules-hashes.json'))).toBe(true);
+    const manifestContent = JSON.parse(
+      await (await import('node:fs/promises')).readFile(
+        join(tempDir, '.mc', 'modules-hashes.json'),
+        'utf8'
+      )
+    );
+    const expectedHash = createHash('sha256').update(content).digest('hex');
+    expect(manifestContent.files['infra/modules/fresh.ts']).toBe(expectedHash);
+  });
 });

package/src/__tests__/commands/regenerate-modules-hashes.test.ts

@@ -0,0 +1,170 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, writeFile, mkdir } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { rmSync } from 'node:fs';
+import { runRegenerateModulesHashes } from '../../commands/regenerate-modules-hashes.js';
+
+describe('regenerate-modules-hashes', () => {
+  let tempDir: string;
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'tib-regenerate-modules-hashes-'));
+  });
+
+  afterEach(() => {
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it('writes modules-hashes.json with correct version and structure', async () => {
+    await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
+
+    const content = 'export const MyStack = {};';
+    await writeFile(join(tempDir, 'infra', 'modules', 'test.ts'), content);
+
+    const manifestPath = await runRegenerateModulesHashes({ projectRoot: tempDir });
+
+    expect(manifestPath).toBe(join(tempDir, '.mc', 'modules-hashes.json'));
+
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    expect(manifest.version).toBe('1');
+    expect(typeof manifest.generatedAt).toBe('string');
+    expect(new Date(manifest.generatedAt).toISOString()).toBe(manifest.generatedAt);
+    expect(manifest.files).toEqual({
+      'infra/modules/test.ts': createHash('sha256').update(content).digest('hex'),
+    });
+  });
+
+  it('computes correct SHA-256 hashes for every file', async () => {
+    await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
+
+    const files: Record<string, string> = {
+      'infra/modules/a.ts': 'export const a = 1;',
+      'infra/modules/b.ts': 'export const b = 2;\nexport const c = 3;',
+      'infra/modules/nested/c.ts': 'export const c = "hello world";',
+    };
+
+    await mkdir(join(tempDir, 'infra', 'modules', 'nested'), { recursive: true });
+    for (const [rel, content] of Object.entries(files)) {
+      await writeFile(join(tempDir, rel), content);
+    }
+
+    const manifestPath = await runRegenerateModulesHashes({ projectRoot: tempDir });
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+
+    expect(Object.keys(manifest.files).sort()).toEqual(Object.keys(files).sort());
+    for (const [rel, content] of Object.entries(files)) {
+      const expected = createHash('sha256').update(content).digest('hex');
+      expect(manifest.files[rel]).toBe(expected);
+    }
+  });
+
+  it('skips node_modules, dist, cdk.out, package-lock.json, and .npmrc', async () => {
+    const root = tempDir;
+    const modules = join(root, 'infra', 'modules');
+    await mkdir(modules, { recursive: true });
+
+    // Real file we want hashed
+    await writeFile(join(modules, 'real.ts'), 'export const real = true;');
+
+    // Files/dirs that must be excluded
+    await mkdir(join(modules, 'node_modules', 'pkg'), { recursive: true });
+    await writeFile(join(modules, 'node_modules', 'pkg', 'index.js'), 'module.exports = {};');
+
+    await mkdir(join(modules, 'dist'), { recursive: true });
+    await writeFile(join(modules, 'dist', 'bundle.js'), 'var x = 1;');
+
+    await mkdir(join(modules, 'cdk.out'), { recursive: true });
+    await writeFile(join(modules, 'cdk.out', 'template.json'), '{}');
+
+    await writeFile(join(modules, 'package-lock.json'), '{}');
+    await writeFile(join(modules, '.npmrc'), 'registry=https://example.com');
+
+    // Also nested exclude
+    await mkdir(join(modules, 'sub', 'node_modules'), { recursive: true });
+    await writeFile(join(modules, 'sub', 'node_modules', 'dep.js'), '// skip');
+
+    await writeFile(join(modules, 'sub', 'kept.ts'), 'export const kept = 1;');
+
+    const manifestPath = await runRegenerateModulesHashes({ projectRoot: root });
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+
+    expect(manifest.files).toEqual({
+      'infra/modules/real.ts': createHash('sha256').update('export const real = true;').digest('hex'),
+      'infra/modules/sub/kept.ts': createHash('sha256').update('export const kept = 1;').digest('hex'),
+    });
+
+    // None of the excluded entries appear
+    const keys = Object.keys(manifest.files);
+    expect(keys.some((k) => k.includes('node_modules'))).toBe(false);
+    expect(keys.some((k) => k.includes('dist/'))).toBe(false);
+    expect(keys.some((k) => k.includes('cdk.out/'))).toBe(false);
+    expect(keys.some((k) => k.endsWith('package-lock.json'))).toBe(false);
+    expect(keys.some((k) => k.endsWith('.npmrc'))).toBe(false);
+  });
+
+  it('handles empty infra/modules/ directory by emitting empty files map', async () => {
+    await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
+
+    const manifestPath = await runRegenerateModulesHashes({ projectRoot: tempDir });
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+
+    expect(manifest.version).toBe('1');
+    expect(typeof manifest.generatedAt).toBe('string');
+    expect(manifest.files).toEqual({});
+  });
+
+  it('handles missing infra/modules/ directory gracefully', async () => {
+    // Do NOT create infra/modules/ — only the project root exists
+    const manifestPath = await runRegenerateModulesHashes({ projectRoot: tempDir });
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+
+    expect(manifestPath).toBe(join(tempDir, '.mc', 'modules-hashes.json'));
+    expect(manifest.version).toBe('1');
+    expect(typeof manifest.generatedAt).toBe('string');
+    expect(manifest.files).toEqual({});
+  });
+
+  it('is idempotent — second run produces identical file map and structure', async () => {
+    await mkdir(join(tempDir, 'infra', 'modules'), { recursive: true });
+
+    await writeFile(join(tempDir, 'infra', 'modules', 'a.ts'), 'export const a = 1;');
+    await mkdir(join(tempDir, 'infra', 'modules', 'sub'), { recursive: true });
+    await writeFile(join(tempDir, 'infra', 'modules', 'sub', 'b.ts'), 'export const b = 2;');
+
+    const firstPath = await runRegenerateModulesHashes({ projectRoot: tempDir });
+    const first = JSON.parse(readFileSync(firstPath, 'utf8'));
+
+    // Wait long enough that a fresh ISO timestamp would differ
+    await new Promise((r) => setTimeout(r, 10));
+
+    const secondPath = await runRegenerateModulesHashes({ projectRoot: tempDir });
+    const second = JSON.parse(readFileSync(secondPath, 'utf8'));
+
+    expect(secondPath).toBe(firstPath);
+    expect(second.version).toBe(first.version);
+    expect(second.files).toEqual(first.files);
+
+    // Timestamps may differ, but the structure (ignoring generatedAt) is identical
+    const { generatedAt: _g1, ...firstRest } = first;
+    const { generatedAt: _g2, ...secondRest } = second;
+    expect(secondRest).toEqual(firstRest);
+  });
+
+  it('includes deeply nested files under infra/modules/', async () => {
+    await mkdir(join(tempDir, 'infra', 'modules', 'flows', 'sub'), { recursive: true });
+
+    const nestedContent = 'export const nested = true;';
+    const nestedPath = join(tempDir, 'infra', 'modules', 'flows', 'sub', 'nested.ts');
+    await writeFile(nestedPath, nestedContent);
+
+    const manifestPath = await runRegenerateModulesHashes({ projectRoot: tempDir });
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+
+    expect(manifest.files['infra/modules/flows/sub/nested.ts']).toBe(
+      createHash('sha256').update(nestedContent).digest('hex'),
+    );
+  });
+});