@mettlecast/domain-cli 0.2.86 → 0.2.87

package/dist/builder/build-registry.d.ts

@@ -12,9 +12,15 @@ export interface BuildResult {
  * Build a DomainRegistry from a domain source directory.
  * Walks the conventional directory structure, loads each primitive definition
  * file via the tsx child-process loader, and assembles the registry snapshot.
- * Zod schema fields are omitted in Phase 1e (schema extraction is v1.x scope).
+ *
+ * Strict contract (#5090): every action must have `kind:'action'`, id,
+ * handlerFile, backendAccess, idempotent, and explicit exposure. API requires
+ * path/method/auth/tenancy; internal must be exactly `{type:'internal'}`.
+ * Missing or invalid fields cause a build failure with actionable diagnostics.
+ *
  * @param domainRoot - Absolute path to the domain root directory.
  * @returns BuildResult containing the assembled registry and any warnings.
- * @throws If domain.config.ts is missing or does not export a 'domain' primitive.
+ * @throws If domain.config.ts is missing or does not export a 'domain' primitive,
+ *         or if any action has missing/invalid required fields.
  */
 export declare function buildRegistry(domainRoot: string): Promise<BuildResult>;

package/dist/builder/build-registry.js

@@ -2,69 +2,69 @@ import { relative, resolve } from 'node:path';
 import { walkDomainDir } from '../utils/file-helpers.js';
 import { loadModuleExports } from './load-module.js';
 /**
- * Coerce a raw value into a valid backendAccess scope, defaulting to
- * 'private' when the value is missing or unrecognized. Used by the
- * builder when reading the new-style `backendAccess` field directly.
+ * Validate that a raw value is a valid backendAccess scope.
+ * Throws with diagnostics on invalid/missing values.
  */
-function toBackendAccess(raw) {
-    return raw === 'domain' || raw === 'platform' ? raw : 'private';
-}
-/**
- * Map a legacy `visibility` scope to a `backendAccess` scope for the
- * action-first migration. The legacy `workspace` scope (which previously
- * permitted unauthenticated Function URL exposure) collapses to `domain`
- * so that all cross-domain callers must go through `ctx.actions`.
- */
-function visibilityToBackendAccess(visibility) {
-    if (visibility === 'workspace')
-        return 'domain';
-    if (visibility === 'domain')
-        return 'domain';
-    return 'private';
-}
-/**
- * Best-effort reverse mapping from `backendAccess` to the legacy
- * `visibility` field. Used to keep the deprecated field populated so
- * existing CDK constructs that read it continue to behave the same way.
- *
- * - private  -> private
- * - domain   -> domain
- * - platform -> workspace (closest legacy equivalent for platform-level)
- */
-function backendAccessToVisibility(backendAccess) {
-    if (backendAccess === 'platform')
-        return 'workspace';
-    return backendAccess;
+function validateBackendAccess(raw, actionId) {
+    if (raw === 'domain' || raw === 'platform' || raw === 'private') {
+        return raw;
+    }
+    throw new Error(`Action '${actionId}' has invalid or missing \`backendAccess\`. ` +
+        `Must be one of: 'private', 'domain', 'platform'. Got: ${JSON.stringify(raw)}`);
 }
 /**
- * Type guard + sanitizer for an action's `exposure` field. Returns a
- * well-typed `ActionExposure` (extended with `authDeclared` /
- * `tenancyDeclared` tracking flags) or the provided fallback when the
- * raw value does not match a supported exposure shape.
- *
- * The `authDeclared` / `tenancyDeclared` flags record whether the source
- * code explicitly declared each field, or whether the builder fell back
- * to the safe default. They are validation-only and consumed by the
- * domain CLI's validate command (Wave 6 Task 6.1) to enforce the
- * action-first security model (#4619).
+ * Validate and parse an action's `exposure` field.
+ * Throws with actionable diagnostics when exposure is missing, null, or malformed.
  */
-function toExposure(raw, fallback) {
-    if (!raw || typeof raw !== 'object')
-        return fallback;
+function validateExposure(raw, actionId) {
+    if (!raw || typeof raw !== 'object') {
+        throw new Error(`Action '${actionId}' has missing or invalid \`exposure\`. ` +
+            `Every action must declare \`exposure\` explicitly. ` +
+            `Use \`exposure: { type: 'internal' }\` for internal-only actions, or ` +
+            `\`exposure: { type: 'api', path: '...', method: '...', auth: '...', tenancy: '...' }\` for API-exposed actions.`);
+    }
     const candidate = raw;
-    if (candidate.type === 'internal')
-        return { type: 'internal' };
-    if (candidate.type !== 'api')
-        return fallback;
-    // Best-effort validation of api exposure fields; any missing required
-    // string field falls back to the supplied default exposure.
+    if (candidate.type === 'internal') {
+        // Internal must be exactly { type: 'internal' } — no extra keys
+        const extraKeys = Object.keys(raw).filter(k => k !== 'type');
+        if (extraKeys.length > 0) {
+            throw new Error(`Action '${actionId}' has \`exposure.type: 'internal'\` with unexpected keys: ${extraKeys.join(', ')}. ` +
+                `Internal exposure must be exactly \`{ type: 'internal' }\`.`);
+        }
+        return { exposure: { type: 'internal' }, authDeclared: false, tenancyDeclared: false };
+    }
+    if (candidate.type !== 'api') {
+        throw new Error(`Action '${actionId}' has \`exposure.type\` set to ${JSON.stringify(candidate.type)}. ` +
+            `Must be 'api' or 'internal'.`);
+    }
+    // Validate API exposure
     const api = raw;
-    if (typeof api.path !== 'string' || typeof api.method !== 'string')
-        return fallback;
+    if (typeof api.path !== 'string' || api.path.trim().length === 0) {
+        throw new Error(`Action '${actionId}' has \`exposure.type: 'api'\` but \`exposure.path\` is missing or empty. ` +
+            `Provide a non-empty path string (e.g. '/v1/tenants/{tenantId}/users').`);
+    }
+    if (typeof api.method !== 'string' || api.method.trim().length === 0) {
+        throw new Error(`Action '${actionId}' has \`exposure.type: 'api'\` but \`exposure.method\` is missing or empty. ` +
+            `Provide an HTTP method (e.g. 'GET', 'POST', 'PUT', 'PATCH', 'DELETE').`);
+    }
     const authRaw = api.auth;
     const tenancyRaw = api.tenancy;
-    const auth = authRaw === 'required' || authRaw === 'none' || authRaw === 'service' ? authRaw : 'required';
-    const tenancy = tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system' ? tenancyRaw : 'required';
+    let auth;
+    if (authRaw === 'required' || authRaw === 'none' || authRaw === 'service') {
+        auth = authRaw;
+    }
+    else {
+        throw new Error(`Action '${actionId}' has \`exposure.type: 'api'\` but \`exposure.auth\` is missing or invalid. ` +
+            `Must be 'required', 'none', or 'service'. Got: ${JSON.stringify(authRaw)}`);
+    }
+    let tenancy;
+    if (tenancyRaw === 'required' || tenancyRaw === 'none' || tenancyRaw === 'system') {
+        tenancy = tenancyRaw;
+    }
+    else {
+        throw new Error(`Action '${actionId}' has \`exposure.type: 'api'\` but \`exposure.tenancy\` is missing or invalid. ` +
+            `Must be 'required', 'none', or 'system'. Got: ${JSON.stringify(tenancyRaw)}`);
+    }
     const out = {
         type: 'api',
         path: api.path,
@@ -83,7 +83,7 @@ function toExposure(raw, fallback) {
             out.securityException = { reason };
         }
     }
-    return out;
+    return { exposure: out, authDeclared: out.authDeclared ?? false, tenancyDeclared: out.tenancyDeclared ?? false };
 }
 /** Returns true if a value looks like a JSON Schema object (has a 'type' or '$schema' property). */
 function isJsonSchema(v) {
@@ -94,10 +94,16 @@ function isJsonSchema(v) {
  * Build a DomainRegistry from a domain source directory.
  * Walks the conventional directory structure, loads each primitive definition
  * file via the tsx child-process loader, and assembles the registry snapshot.
- * Zod schema fields are omitted in Phase 1e (schema extraction is v1.x scope).
+ *
+ * Strict contract (#5090): every action must have `kind:'action'`, id,
+ * handlerFile, backendAccess, idempotent, and explicit exposure. API requires
+ * path/method/auth/tenancy; internal must be exactly `{type:'internal'}`.
+ * Missing or invalid fields cause a build failure with actionable diagnostics.
+ *
  * @param domainRoot - Absolute path to the domain root directory.
  * @returns BuildResult containing the assembled registry and any warnings.
- * @throws If domain.config.ts is missing or does not export a 'domain' primitive.
+ * @throws If domain.config.ts is missing or does not export a 'domain' primitive,
+ *         or if any action has missing/invalid required fields.
  */
 export async function buildRegistry(domainRoot) {
     // Resolve to absolute path so downstream fs operations and tsx eval imports
@@ -200,41 +206,27 @@ export async function buildRegistry(domainRoot) {
     const actions = paths.actions.flatMap((filePath, i) => (actionExports[i] ?? [])
         .filter(e => e['_kind'] === 'action')
         .map(e => {
-        // Resolve backendAccess. New-style actions carry `backendAccess`
-        // directly. Legacy actions only carry `visibility`; in that case
-        // we collapse workspace -> domain per the migration spec, and we
-        // also remember the legacy flag so we can default exposure to
-        // `{ type: 'internal' }` for actions that have not opted in yet.
-        const hasBackendAccess = 'backendAccess' in e;
-        const rawBackendAccess = e['backendAccess'];
-        const rawVisibility = e['visibility'];
-        const backendAccess = hasBackendAccess
-            ? toBackendAccess(rawBackendAccess)
-            : visibilityToBackendAccess(rawVisibility);
-        const legacyVisibility = backendAccessToVisibility(backendAccess);
-        // Resolve exposure. New-style actions must declare their exposure;
-        // legacy actions that did not opt in default to `{ type: 'internal' }`
-        // so existing internal-only behavior is preserved during migration.
-        const rawExposure = e['exposure'];
-        const exposure = toExposure(rawExposure, { type: 'internal' });
-        // Record whether the source explicitly declared the `exposure` field.
-        // Validation-only; consumed by the domain CLI's validate command
-        // (Wave 6 Task 6.1) to enforce `ACTION_EXPOSURE_REQUIRED`.
-        const exposureDeclared = rawExposure !== undefined && rawExposure !== null
-            && typeof rawExposure === 'object';
+        const actionId = String(e['id']);
+        // Validate required fields — strict contract (#5090)
+        if (!actionId) {
+            throw new Error(`Action in ${relPath(filePath)} has missing or empty \`id\`.`);
+        }
+        // Validate backendAccess — required, no legacy default
+        const backendAccess = validateBackendAccess(e['backendAccess'], actionId);
+        // Validate exposure — required, no legacy default
+        const { exposure } = validateExposure(e['exposure'], actionId);
+        // Validate idempotent — required boolean
+        if (typeof e['idempotent'] !== 'boolean') {
+            throw new Error(`Action '${actionId}' has missing or invalid \`idempotent\`. ` +
+                `Must be a boolean (true or false). Got: ${JSON.stringify(e['idempotent'])}`);
+        }
         return {
-            id: String(e['id']),
+            id: actionId,
             kind: 'action',
             handlerFile: relPath(filePath),
             backendAccess,
             exposure,
-            exposureDeclared,
-            // Keep the legacy field populated so CDK constructs that still
-            // read `visibility` (e.g. action-construct.ts) keep working
-            // through the migration window. New constructs should read
-            // `backendAccess` and `exposure` instead.
-            visibility: legacyVisibility,
-            idempotent: Boolean(e['idempotent'] ?? false),
+            idempotent: Boolean(e['idempotent']),
             description: typeof e['description'] === 'string' ? e['description'] : undefined,
             deployment: deployment(e),
             outboundAccess: outboundAccess(e),

package/dist/commands/update-all.d.ts

@@ -1,5 +1,6 @@
 /**
  * Run the full scaffold update pipeline:
+ *   0. Resolve toolchain manifest and pin exact versions + regenerate lockfiles
  *   1. Build each domain registry from `.mc/scaffold-config.json`
  *   2. Build the combined domain catalog
  *   3. Build flows registry

package/dist/commands/update-all.js

@@ -1,14 +1,156 @@
 import { join } from 'node:path';
+import { readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { execSync } from 'node:child_process';
 import { cliLogger } from '../utils/logger.js';
 import { readScaffoldConfig } from '../utils/scaffold-config.js';
+import { loadToolchainManifest, } from '../utils/toolchain-manifest.js';
 import { runBuild } from './build.js';
 import { runBuildCatalog } from './build-catalog.js';
 import { runBuildFlows } from './build-flows.js';
 import { runBuildUi } from './build-ui.js';
 import { runRegenerateModulesHashes } from './regenerate-modules-hashes.js';
 import { runDoctor } from './doctor.js';
+/**
+ * Expected packages in the toolchain manifest.
+ */
+const TOOLCHAIN_PACKAGE_KEYS = [
+    'domainCli',
+    'domainCdkPacker',
+    'domainRuntime',
+    'eslintPluginDomainModule',
+];
+/**
+ * Map from toolchain key to npm package name.
+ */
+const TOOLCHAIN_NPM_NAMES = {
+    domainCli: '@mettlecast/domain-cli',
+    domainCdkPacker: '@mettlecast/domain-cdk-packer',
+    domainRuntime: '@mettlecast/domain-runtime',
+    eslintPluginDomainModule: '@mettlecast/eslint-plugin-domain-module',
+};
+/**
+ * Write exact toolchain versions into infra/modules/package.json.
+ * Replaces the @mettlecast/* dependency versions with the pinned exact versions
+ * from the toolchain manifest. Preserves all other fields unchanged.
+ *
+ * @param projectRoot - Project root directory.
+ * @param manifest - The resolved toolchain manifest.
+ */
+async function pinInfraPackageVersions(projectRoot, manifest) {
+    const infraPkgPath = join(projectRoot, 'infra', 'modules', 'package.json');
+    if (!existsSync(infraPkgPath)) {
+        cliLogger.warn({ path: infraPkgPath }, 'infra/modules/package.json not found — skipping version pinning');
+        return;
+    }
+    const raw = await readFile(infraPkgPath, 'utf-8');
+    const pkg = JSON.parse(raw);
+    const pkgDeps = (pkg.dependencies ?? {});
+    const pkgDevDeps = (pkg.devDependencies ?? {});
+    // Pin @mettlecast/domain-cdk-packer
+    if (TOOLCHAIN_NPM_NAMES.domainCdkPacker in pkgDeps) {
+        pkgDeps[TOOLCHAIN_NPM_NAMES.domainCdkPacker] = manifest.packages.domainCdkPacker;
+    }
+    // Pin @mettlecast/domain-runtime
+    if (TOOLCHAIN_NPM_NAMES.domainRuntime in pkgDeps) {
+        pkgDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+    }
+    // Pin @mettlecast/domain-cli
+    if (TOOLCHAIN_NPM_NAMES.domainCli in pkgDevDeps) {
+        pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+    }
+    // Pin @mettlecast/eslint-plugin-domain-module
+    if (TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule in pkgDevDeps) {
+        pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+    }
+    pkg.dependencies = pkgDeps;
+    pkg.devDependencies = pkgDevDeps;
+    await writeFile(infraPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
+    cliLogger.info({ path: infraPkgPath }, 'Pinned toolchain versions in infra/modules/package.json');
+}
+/**
+ * Write exact toolchain versions into root package.json.
+ * Replaces the @mettlecast/* devDependency versions with the pinned exact versions
+ * from the toolchain manifest. Preserves all other fields unchanged.
+ *
+ * @param projectRoot - Project root directory.
+ * @param manifest - The resolved toolchain manifest.
+ */
+async function pinRootPackageVersions(projectRoot, manifest) {
+    const rootPkgPath = join(projectRoot, 'package.json');
+    if (!existsSync(rootPkgPath)) {
+        cliLogger.warn({ path: rootPkgPath }, 'root package.json not found — skipping version pinning');
+        return;
+    }
+    const raw = await readFile(rootPkgPath, 'utf-8');
+    const pkg = JSON.parse(raw);
+    const pkgDevDeps = (pkg.devDependencies ?? {});
+    // Pin @mettlecast/domain-cli (root devDependency)
+    if (TOOLCHAIN_NPM_NAMES.domainCli in pkgDevDeps) {
+        pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+    }
+    // Pin @mettlecast/domain-runtime (root devDependency)
+    if (TOOLCHAIN_NPM_NAMES.domainRuntime in pkgDevDeps) {
+        pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+    }
+    // Pin @mettlecast/eslint-plugin-domain-module (root devDependency)
+    if (TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule in pkgDevDeps) {
+        pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+    }
+    pkg.devDependencies = pkgDevDeps;
+    await writeFile(rootPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
+    cliLogger.info({ path: rootPkgPath }, 'Pinned toolchain versions in root package.json');
+}
+/**
+ * Regenerate lockfiles for root and infra/modules after version pinning.
+ * Runs `npm install --package-lock-only` (without modifying package.json) to
+ * produce deterministic package-lock.json files that match the pinned exact
+ * versions. The `--package-lock` flag overrides any `package-lock=false` in
+ * the project's .npmrc so lockfiles are always generated.
+ *
+ * @param projectRoot - Project root directory.
+ */
+async function regenerateLockfiles(projectRoot) {
+    const rootPkgPath = join(projectRoot, 'package.json');
+    const infraPkgPath = join(projectRoot, 'infra', 'modules', 'package.json');
+    const npmLockCmd = 'npm install --package-lock-only --package-lock --no-save';
+    // Regenerate root lockfile if root package.json exists
+    if (existsSync(rootPkgPath)) {
+        try {
+            cliLogger.info({ projectRoot }, 'Regenerating root package-lock.json');
+            execSync(npmLockCmd, {
+                cwd: projectRoot,
+                stdio: 'pipe',
+                timeout: 120_000,
+            });
+            cliLogger.info({ projectRoot }, 'Root package-lock.json regenerated');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            cliLogger.warn({ err: message }, 'Root lockfile regeneration failed (non-fatal — continuing)');
+        }
+    }
+    // Regenerate infra/modules lockfile if infra/modules/package.json exists
+    if (existsSync(infraPkgPath)) {
+        try {
+            const infraDir = join(projectRoot, 'infra', 'modules');
+            cliLogger.info({ path: infraDir }, 'Regenerating infra/modules package-lock.json');
+            execSync(npmLockCmd, {
+                cwd: infraDir,
+                stdio: 'pipe',
+                timeout: 120_000,
+            });
+            cliLogger.info({ path: infraDir }, 'infra/modules package-lock.json regenerated');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            cliLogger.warn({ err: message }, 'infra/modules lockfile regeneration failed (non-fatal — continuing)');
+        }
+    }
+}
 /**
  * Run the full scaffold update pipeline:
+ *   0. Resolve toolchain manifest and pin exact versions + regenerate lockfiles
  *   1. Build each domain registry from `.mc/scaffold-config.json`
  *   2. Build the combined domain catalog
  *   3. Build flows registry
@@ -25,6 +167,38 @@ import { runDoctor } from './doctor.js';
 export async function runUpdateAll(opts) {
     const projectRoot = opts?.projectRoot ?? process.cwd();
     cliLogger.info({ projectRoot }, 'update-all: starting');
+    // 0. Resolve toolchain manifest and pin exact versions
+    cliLogger.info({ projectRoot }, 'update-all: resolving toolchain manifest');
+    let manifest;
+    try {
+        manifest = await loadToolchainManifest(projectRoot);
+        cliLogger.info({
+            domainCli: manifest.packages.domainCli,
+            domainRuntime: manifest.packages.domainRuntime,
+            domainCdkPacker: manifest.packages.domainCdkPacker,
+            eslintPluginDomainModule: manifest.packages.eslintPluginDomainModule,
+            registrySchemaVersion: manifest.registrySchemaVersion,
+        }, 'update-all: toolchain manifest resolved');
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        cliLogger.error({ err: message }, 'update-all: toolchain resolution failed — aborting');
+        return { success: false, summary: `Toolchain resolution FAIL: ${message}` };
+    }
+    // Pin exact versions from manifest into infra/modules/package.json and root package.json
+    try {
+        await pinInfraPackageVersions(projectRoot, manifest);
+        await pinRootPackageVersions(projectRoot, manifest);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        cliLogger.error({ err: message }, 'update-all: version pinning failed — aborting');
+        return { success: false, summary: `Version pinning FAIL: ${message}` };
+    }
+    // Regenerate lockfiles so that root and infra/modules lockfiles exist
+    // and match the pinned exact versions before generated CI uses `npm ci`.
+    cliLogger.info({ projectRoot }, 'update-all: regenerating lockfiles');
+    await regenerateLockfiles(projectRoot);
     // 1. Read scaffold-config to discover domains
     const scaffoldConfig = await readScaffoldConfig(projectRoot);
     const domainIds = scaffoldConfig.domainIds ?? [];

package/dist/commands/validate.js

@@ -79,31 +79,7 @@ async function checkRawPathViolations(_repoRoot, config) {
     return [];
 }
 /**
- * Deployment-time security checks (#4662 Task D).
- *
- * Mirrors the invariants enforced at CDK synth time by
- * `SecurityAssertionAspect` in `@mettlecast/domain-cdk-packer`. Running
- * them at the CLI stage means developers get a structured error code in
- * their terminal and CI fails on `mc-domain-module validate` BEFORE a
- * (potentially expensive) `cdk synth` is attempted.
- *
- * Each rule maps 1:1 to an aspect annotation code so downstream tooling
- * can correlate build-time and synth-time failures.
- *
- * Issue #4689: the legacy `defineApi` factory and `registry.apis` field
- * were removed. Deployment-time API invariants are enforced against the
- * `actions[]` API-exposure surface — see `checkActionFirstSecurity`.
- */
-function checkDeploymentSecurity(_actions) {
-    // Action API exposures are already covered by `checkActionFirstSecurity`
-    // for `tenancy: 'required'` paths and `auth: 'none'` exceptions. The
-    // codes there (TENANT_API_PATH_REQUIRED, AUTH_NONE_REQUIRES_EXCEPTION)
-    // are kept stable for back-compat — they map to the same aspect codes.
-    //
-    return [];
-}
-/**
- * Action-first security validation rules (#4619, Wave 6 Task 6.1).
+ * Check action-first security invariants.
  *
  * These checks enforce the action-first security model on the
  * serialised DomainRegistry produced by `buildRegistry`. The rules
@@ -113,33 +89,38 @@ function checkDeploymentSecurity(_actions) {
  *
  * Each rule emits a structured `ValidationError` whose `code` is the
  * rule ID listed in the spec (e.g. `ACTION_EXPOSURE_REQUIRED`,
- * `TENANT_API_PATH_REQUIRED`). Messages include the offending action
- * or API id and the actionable fix.
+ * `TENANT_API_PATH_REQUIRED`, `API_INPUT_SCHEMA_REQUIRED`).
  */
 function checkActionFirstSecurity(actions) {
     const errors = [];
     for (const action of actions) {
         const id = action.id;
         // ACTION_EXPOSURE_REQUIRED — every action registry entry must have
-        // `exposure` declared in source. The builder defaults missing
-        // exposure to `{ type: 'internal' }` for backwards compatibility,
-        // and flags the entry with `exposureDeclared: false` so the validator
-        // can surface it. Legacy actions that use `visibility` only (no
-        // `backendAccess`) are also allowed to default during migration.
-        if (action.exposureDeclared === false && action.backendAccess !== 'private') {
-            // Only fire for non-private actions: a private action with no
-            // exposure is the natural migration state for legacy
-            // visibility:'private' handlers, and forcing exposure would
-            // produce noisy errors during the migration window.
-            // (When Wave 7+ removes the legacy visibility alias this branch
-            // becomes a hard error for every action.)
+        // `exposure` declared and valid. The buildRegistry now rejects
+        // missing/invalid exposure at build time, but we also verify here
+        // for belt-and-suspenders.
+        if (!action.exposure) {
             errors.push({
                 code: 'ACTION_EXPOSURE_REQUIRED',
-                message: `Action '${id}' has no explicit \`exposure\`. New-style actions must declare \`exposure\` (e.g. \`{ type: 'api', path: '...', method: 'POST', auth: 'required', tenancy: 'required' }\`) or \`{ type: 'internal' }\` to opt out of API exposure.`,
+                message: `Action '${id}' has no \`exposure\`. Every action must declare \`exposure\` explicitly.`,
             });
+            continue;
         }
         if (action.exposure.type === 'api') {
             errors.push(...checkApiExposureSecurity(action.id, action.exposure));
+            // API actions must have input/output schema snapshots
+            if (!action.inputSchema) {
+                errors.push({
+                    code: 'API_INPUT_SCHEMA_REQUIRED',
+                    message: `Action '${id}' is API-exposed but has no \`inputSchema\`. API-exposed actions must declare input/output Zod schemas.`,
+                });
+            }
+            if (!action.outputSchema) {
+                errors.push({
+                    code: 'API_OUTPUT_SCHEMA_REQUIRED',
+                    message: `Action '${id}' is API-exposed but has no \`outputSchema\`. API-exposed actions must declare input/output Zod schemas.`,
+                });
+            }
         }
     }
     return errors;
@@ -151,9 +132,8 @@ function checkActionFirstSecurity(actions) {
 function checkApiExposureSecurity(actionId, exposure) {
     const errors = [];
     // API_EXPOSURE_AUTH_REQUIRED — API-exposed actions must declare auth
-    // explicitly. The builder defaults auth to 'required' when the source
-    // omits it; the validator surfaces the omission so developers are not
-    // silently relying on the safe-default.
+    // explicitly. The builder now rejects missing auth, but we validate
+    // here too for completeness.
     if (exposure.authDeclared === false) {
         errors.push({
             code: 'API_EXPOSURE_AUTH_REQUIRED',
@@ -182,10 +162,7 @@ function checkApiExposureSecurity(actionId, exposure) {
         }
     }
     // TENANCY_NONE_REQUIRES_REASON_WHEN_PUBLIC — `tenancy: 'none'` on a
-    // public API route must justify the missing tenant context. If the
-    // route is already justified as anonymous via `auth: 'none'` the
-    // same `securityException` may be reused; otherwise an exception is
-    // required for tenancy: 'none' on its own.
+    // public API route must justify the missing tenant context.
     if (exposure.tenancy === 'none') {
         const reason = exposure.securityException?.reason;
         if (!reason || reason.trim().length === 0) {
@@ -197,8 +174,7 @@ function checkApiExposureSecurity(actionId, exposure) {
     }
     // SYSTEM_API_REQUIRES_ROLE — `tenancy: 'system'` combined with
     // `auth: 'required'` must declare non-empty `roles` so the JWT
-    // authorizer can scope the call. Routes that use `auth: 'service'`
-    // are service-only and do not require role narrowing.
+    // authorizer can scope the call.
     if (exposure.tenancy === 'system' && exposure.auth === 'required') {
         if (!Array.isArray(exposure.roles) || exposure.roles.length === 0) {
             errors.push({
@@ -247,19 +223,10 @@ export async function runValidate(domainRoot, exitOnFailure = true, config = { m
         }
     }));
     errors.push(...checkSubscriberSemverRanges(registry.subscribers));
-    // Issue #4689: defineApi and registry.apis were removed. The action-first
-    // validation rules in `checkActionFirstSecurity` cover the action surface
-    // that now owns all HTTP endpoints.
     const rawPathErrors = await checkRawPathViolations(registry.domainRoot, config);
     errors.push(...rawPathErrors);
-    // Wave 6 Task 6.1: action-first security validation gates (#4619).
-    // Runs against the registry built above so the rules see the same
-    // shape the CDK packer will eventually consume.
+    // Action-first security validation gates (#5090).
     errors.push(...checkActionFirstSecurity(registry.actions));
-    // Issue #4662 Task D — deployment-time security gates. These mirror
-    // the CDK synth-time `SecurityAssertionAspect` so violations are
-    // caught before any AWS deployment is attempted.
-    errors.push(...checkDeploymentSecurity(registry.actions));
     const totalPrimitives = registry.webhooks.length +
         registry.subscribers.length + registry.schedules.length +
         registry.jobs.length + registry.actions.length;