@mettlecast/domain-cli 0.2.89 → 0.2.90

package/dist/commands/update-all.js

@@ -33,88 +33,135 @@ const TOOLCHAIN_NPM_NAMES = {
  * Write exact toolchain versions into infra/modules/package.json.
  * Replaces the @mettlecast/* dependency versions with the pinned exact versions
  * from the toolchain manifest. Preserves all other fields unchanged.
+ * Only writes the file if at least one version actually changes.
  *
  * @param projectRoot - Project root directory.
  * @param manifest - The resolved toolchain manifest.
+ * @returns Whether any dependency version was actually changed.
  */
 async function pinInfraPackageVersions(projectRoot, manifest) {
     const infraPkgPath = join(projectRoot, 'infra', 'modules', 'package.json');
     if (!existsSync(infraPkgPath)) {
         cliLogger.warn({ path: infraPkgPath }, 'infra/modules/package.json not found — skipping version pinning');
-        return;
+        return { changed: false };
     }
     const raw = await readFile(infraPkgPath, 'utf-8');
     const pkg = JSON.parse(raw);
     const pkgDeps = (pkg.dependencies ?? {});
     const pkgDevDeps = (pkg.devDependencies ?? {});
+    let changed = false;
     // Pin @mettlecast/domain-cdk-packer
     if (TOOLCHAIN_NPM_NAMES.domainCdkPacker in pkgDeps) {
-        pkgDeps[TOOLCHAIN_NPM_NAMES.domainCdkPacker] = manifest.packages.domainCdkPacker;
+        if (pkgDeps[TOOLCHAIN_NPM_NAMES.domainCdkPacker] !== manifest.packages.domainCdkPacker) {
+            pkgDeps[TOOLCHAIN_NPM_NAMES.domainCdkPacker] = manifest.packages.domainCdkPacker;
+            changed = true;
+        }
     }
     // Pin @mettlecast/domain-runtime
     if (TOOLCHAIN_NPM_NAMES.domainRuntime in pkgDeps) {
-        pkgDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+        if (pkgDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] !== manifest.packages.domainRuntime) {
+            pkgDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+            changed = true;
+        }
     }
     // Pin @mettlecast/domain-cli
     if (TOOLCHAIN_NPM_NAMES.domainCli in pkgDevDeps) {
-        pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+        if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] !== manifest.packages.domainCli) {
+            pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+            changed = true;
+        }
     }
     // Pin @mettlecast/eslint-plugin-domain-module
     if (TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule in pkgDevDeps) {
-        pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+        if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] !== manifest.packages.eslintPluginDomainModule) {
+            pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+            changed = true;
+        }
     }
-    pkg.dependencies = pkgDeps;
-    pkg.devDependencies = pkgDevDeps;
-    await writeFile(infraPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
-    cliLogger.info({ path: infraPkgPath }, 'Pinned toolchain versions in infra/modules/package.json');
+    if (changed) {
+        pkg.dependencies = pkgDeps;
+        pkg.devDependencies = pkgDevDeps;
+        await writeFile(infraPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
+        cliLogger.info({ path: infraPkgPath }, 'Pinned toolchain versions in infra/modules/package.json');
+    }
+    else {
+        cliLogger.info({ path: infraPkgPath }, 'infra/modules/package.json already up-to-date');
+    }
+    return { changed };
 }
 /**
  * Write exact toolchain versions into root package.json.
  * Replaces the @mettlecast/* devDependency versions with the pinned exact versions
  * from the toolchain manifest. Preserves all other fields unchanged.
+ * Only writes the file if at least one version actually changes.
  *
  * @param projectRoot - Project root directory.
  * @param manifest - The resolved toolchain manifest.
+ * @returns Whether any devDependency version was actually changed.
  */
 async function pinRootPackageVersions(projectRoot, manifest) {
     const rootPkgPath = join(projectRoot, 'package.json');
     if (!existsSync(rootPkgPath)) {
         cliLogger.warn({ path: rootPkgPath }, 'root package.json not found — skipping version pinning');
-        return;
+        return { changed: false };
     }
     const raw = await readFile(rootPkgPath, 'utf-8');
     const pkg = JSON.parse(raw);
     const pkgDevDeps = (pkg.devDependencies ?? {});
+    let changed = false;
     // Pin @mettlecast/domain-cli (root devDependency)
     if (TOOLCHAIN_NPM_NAMES.domainCli in pkgDevDeps) {
-        pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+        if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] !== manifest.packages.domainCli) {
+            pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+            changed = true;
+        }
     }
     // Pin @mettlecast/domain-runtime (root devDependency)
     if (TOOLCHAIN_NPM_NAMES.domainRuntime in pkgDevDeps) {
-        pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+        if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] !== manifest.packages.domainRuntime) {
+            pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+            changed = true;
+        }
     }
     // Pin @mettlecast/eslint-plugin-domain-module (root devDependency)
     if (TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule in pkgDevDeps) {
-        pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+        if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] !== manifest.packages.eslintPluginDomainModule) {
+            pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+            changed = true;
+        }
+    }
+    if (changed) {
+        pkg.devDependencies = pkgDevDeps;
+        await writeFile(rootPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
+        cliLogger.info({ path: rootPkgPath }, 'Pinned toolchain versions in root package.json');
     }
-    pkg.devDependencies = pkgDevDeps;
-    await writeFile(rootPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
-    cliLogger.info({ path: rootPkgPath }, 'Pinned toolchain versions in root package.json');
+    else {
+        cliLogger.info({ path: rootPkgPath }, 'root package.json already up-to-date');
+    }
+    return { changed };
 }
 /**
- * Regenerate lockfiles for root and infra/modules after version pinning.
- * Runs `npm install --package-lock-only --package-lock` (without modifying
- * package.json) to produce deterministic package-lock.json files that match
- * the pinned exact versions. The explicit `--package-lock` ensures lockfiles
- * are always generated regardless of .npmrc settings.
+ * Regenerate lockfiles after version pinning.
+ * Always regenerates the root package-lock.json on every run to ensure it
+ * fully reconciles with the pinned versions (not just on manifest changes).
+ * Infra/modules lockfile is regenerated only when infra deps actually changed.
+ *
+ * Uses normal npm semantics (`npm install --package-lock-only --package-lock --no-save`)
+ * — no forced, legacy-peer-deps, or override flags — to produce deterministic
+ * lockfiles that match the pinned exact versions.
+ *
+ * Root lockfile failure is fatal (deploy blocker); infra/modules lockfile
+ * failure is logged as a warning but does not abort the pipeline.
  *
  * @param projectRoot - Project root directory.
+ * @param options - Options with infraChanged flag.
+ * @throws When root lockfile regeneration fails.
  */
-async function regenerateLockfiles(projectRoot) {
-    const rootPkgPath = join(projectRoot, 'package.json');
-    const infraPkgPath = join(projectRoot, 'infra', 'modules', 'package.json');
+async function regenerateLockfiles(projectRoot, options) {
     const npmLockCmd = 'npm install --package-lock-only --package-lock --no-save';
-    // Regenerate root lockfile if root package.json exists
+    // Root lockfile is always regenerated to ensure it is fully reconciled
+    // with the pinned exact versions on every update-all run.
+    const rootPkgPath = join(projectRoot, 'package.json');
     if (existsSync(rootPkgPath)) {
         try {
             cliLogger.info({ projectRoot }, 'Regenerating root package-lock.json');
@@ -127,24 +174,28 @@ async function regenerateLockfiles(projectRoot) {
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
-            cliLogger.warn({ err: message }, 'Root lockfile regeneration failed (non-fatal — continuing)');
+            cliLogger.error({ err: message }, 'Root lockfile regeneration FAILED');
+            throw new Error(`Root lockfile regeneration FAILED: ${message}`);
         }
     }
-    // Regenerate infra/modules lockfile if infra/modules/package.json exists
-    if (existsSync(infraPkgPath)) {
-        try {
-            const infraDir = join(projectRoot, 'infra', 'modules');
-            cliLogger.info({ path: infraDir }, 'Regenerating infra/modules package-lock.json');
-            execSync(npmLockCmd, {
-                cwd: infraDir,
-                stdio: 'pipe',
-                timeout: 120_000,
-            });
-            cliLogger.info({ path: infraDir }, 'infra/modules package-lock.json regenerated');
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            cliLogger.warn({ err: message }, 'infra/modules lockfile regeneration failed (non-fatal — continuing)');
+    // Infra/modules lockfile is regenerated only when infra deps actually changed.
+    if (options.infraChanged) {
+        const infraPkgPath = join(projectRoot, 'infra', 'modules', 'package.json');
+        if (existsSync(infraPkgPath)) {
+            try {
+                const infraDir = join(projectRoot, 'infra', 'modules');
+                cliLogger.info({ path: infraDir }, 'Regenerating infra/modules package-lock.json');
+                execSync(npmLockCmd, {
+                    cwd: infraDir,
+                    stdio: 'pipe',
+                    timeout: 120_000,
+                });
+                cliLogger.info({ path: infraDir }, 'infra/modules package-lock.json regenerated');
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                cliLogger.warn({ err: message }, 'infra/modules lockfile regeneration failed (non-fatal — continuing)');
+            }
         }
     }
 }
@@ -185,20 +236,31 @@ export async function runUpdateAll(opts) {
         cliLogger.error({ err: message }, 'update-all: toolchain resolution failed — aborting');
         return { success: false, summary: `Toolchain resolution FAIL: ${message}` };
     }
-    // Pin exact versions from manifest into infra/modules/package.json and root package.json
+    // Pin exact versions from manifest into infra/modules/package.json and root package.json.
+    // Returns whether each manifest actually changed.
+    let infraChanged = false;
     try {
-        await pinInfraPackageVersions(projectRoot, manifest);
+        const infraResult = await pinInfraPackageVersions(projectRoot, manifest);
         await pinRootPackageVersions(projectRoot, manifest);
+        infraChanged = infraResult.changed;
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         cliLogger.error({ err: message }, 'update-all: version pinning failed — aborting');
         return { success: false, summary: `Version pinning FAIL: ${message}` };
     }
-    // Regenerate lockfiles so that root and infra/modules lockfiles exist
-    // and match the pinned exact versions before generated CI uses `npm ci`.
-    cliLogger.info({ projectRoot }, 'update-all: regenerating lockfiles');
-    await regenerateLockfiles(projectRoot);
+    // Regenerate lockfiles. Root lockfile is always regenerated (every run) to ensure
+    // full reconciliation. Infra/modules lockfile is regenerated only when its deps changed.
+    // Root lockfile failure is fatal (deploy blocker); infra/modules failure is not.
+    cliLogger.info({ projectRoot, infraChanged }, 'update-all: regenerating root package-lock.json');
+    try {
+        await regenerateLockfiles(projectRoot, { infraChanged });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        cliLogger.error({ err: message }, 'update-all: root lockfile regeneration failed — aborting');
+        return { success: false, summary: `Lockfile regeneration FAIL: ${message}` };
+    }
     // 1. Read scaffold-config to discover domains
     const scaffoldConfig = await readScaffoldConfig(projectRoot);
     const domainIds = scaffoldConfig.domainIds ?? [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cli",
-  "version": "0.2.89",
+  "version": "0.2.90",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -22,8 +22,8 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.0.0",
     "@aws-sdk/client-sfn": "^3.0.0",
-    "@mettlecast/domain-cdk-packer": "0.2.90",
-    "@mettlecast/domain-runtime": "0.2.89",
+    "@mettlecast/domain-cdk-packer": "0.2.91",
+    "@mettlecast/domain-runtime": "0.2.90",
     "commander": "^12.0.0",
     "dotenv": "^16.0.0",
     "fastify": "^5.0.0",

package/src/__tests__/commands/update-all.test.ts

@@ -32,6 +32,12 @@ vi.mock('../../utils/scaffold-config.js', () => ({
   readScaffoldConfig: vi.fn(),
 }));
 
+vi.mock('node:child_process', () => ({
+  execSync: vi.fn(),
+}));
+
+import { execSync } from 'node:child_process';
+
 import { runUpdateAll } from '../../commands/update-all.js';
 import { runBuild } from '../../commands/build.js';
 import { runBuildCatalog } from '../../commands/build-catalog.js';
@@ -48,6 +54,7 @@ const mockRunBuildUi = vi.mocked(runBuildUi);
 const mockRunRegenerateModulesHashes = vi.mocked(runRegenerateModulesHashes);
 const mockRunDoctor = vi.mocked(runDoctor);
 const mockReadScaffoldConfig = vi.mocked(readScaffoldConfig);
+const mockExecSync = vi.mocked(execSync);
 
 /** Build a minimal but valid DoctorReport. */
 function makeDoctorReport(pass: boolean) {
@@ -616,45 +623,112 @@ describe('update-all command', () => {
     it('regenerates root package-lock.json after version pinning', async () => {
       mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig([]));
 
-      // Create a root package.json but no lockfile
-      const rootPkgPath = join(tempDir, 'package.json');
-      const rootExists = existsSync(rootPkgPath);
-      expect(rootExists).toBe(true);
+      // Since root package.json has '*' versions and manifest has '0.2.53',
+      // pinning WILL change root — execSync should be called for root.
 
-      // Remove any existing lockfile
-      const rootLockPath = join(tempDir, 'package-lock.json');
-      if (existsSync(rootLockPath)) {
-        rmSync(rootLockPath, { force: true });
-      }
-      const infraLockPath = join(tempDir, 'infra', 'modules', 'package-lock.json');
-      if (existsSync(infraLockPath)) {
-        rmSync(infraLockPath, { force: true });
-      }
-
-      // Run update-all which should regenerate lockfiles
       const result = await runUpdateAll({ projectRoot: tempDir });
 
       // update-all should succeed (doctor mock passes)
       expect(result.success).toBe(true);
 
-      // Lockfiles should now exist after regeneration
-      // (execSync runs 'npm install --package-lock-only' which may fail
-      //  in test environment without actual npm packages, but the function
-      //  should attempt regeneration without crashing)
-      expect(existsSync(rootLockPath) || existsSync(infraLockPath)).toBeDefined();
+      // execSync must be called at least for root lockfile regeneration
+      expect(mockExecSync).toHaveBeenCalledWith(
+        'npm install --package-lock-only --package-lock --no-save',
+        expect.objectContaining({ cwd: tempDir }),
+      );
+      // Both root and infra changed (both had wildcard versions)
+      expect(mockExecSync).toHaveBeenCalledTimes(2);
+    });
+
+    it('always regenerates root lockfile even when root package.json already has exact versions', async () => {
+      // Overwrite root package.json with already-pinned versions
+      await createRootPackageJson(tempDir, {
+        '@mettlecast/domain-cli': '0.2.53',
+        '@mettlecast/domain-runtime': '0.2.53',
+        '@mettlecast/eslint-plugin-domain-module': '0.2.53',
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig([]));
+
+      const result = await runUpdateAll({ projectRoot: tempDir });
+
+      expect(result.success).toBe(true);
+
+      // Root lockfile is regenerated unconditionally on every run.
+      expect(mockExecSync).toHaveBeenCalledWith(
+        'npm install --package-lock-only --package-lock --no-save',
+        expect.objectContaining({ cwd: tempDir }),
+      );
+      // Infra lockfile is regenerated only when infra deps changed (it still has '*' wildcards)
+      const infraDir = join(tempDir, 'infra', 'modules');
+      expect(mockExecSync).toHaveBeenCalledWith(
+        'npm install --package-lock-only --package-lock --no-save',
+        expect.objectContaining({ cwd: infraDir }),
+      );
+      expect(mockExecSync).toHaveBeenCalledTimes(2);
+    });
+
+    it('always regenerates root lockfile even when no manifests changed', async () => {
+      // Overwrite both package.json files with already-pinned versions
+      await createRootPackageJson(tempDir, {
+        '@mettlecast/domain-cli': '0.2.53',
+        '@mettlecast/domain-runtime': '0.2.53',
+        '@mettlecast/eslint-plugin-domain-module': '0.2.53',
+      });
+      await createInfraPackageJson(tempDir, {
+        '@mettlecast/domain-cdk-packer': '0.2.53',
+        '@mettlecast/domain-runtime': '0.2.53',
+      }, {
+        '@mettlecast/domain-cli': '0.2.53',
+        '@mettlecast/eslint-plugin-domain-module': '0.2.53',
+      });
+
+      mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig([]));
+
+      const result = await runUpdateAll({ projectRoot: tempDir });
+
+      expect(result.success).toBe(true);
+
+      // Root lockfile is always regenerated even with no manifest changes.
+      expect(mockExecSync).toHaveBeenCalledTimes(1);
+      expect(mockExecSync).toHaveBeenCalledWith(
+        'npm install --package-lock-only --package-lock --no-save',
+        expect.objectContaining({ cwd: tempDir }),
+      );
+      // Infra lockfile is NOT regenerated because infra deps already match.
+    });
+
+    it('fails explicitly when root lockfile regeneration fails', async () => {
+      mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig([]));
+
+      // Make execSync throw on first call (root lockfile)
+      mockExecSync.mockImplementationOnce(() => {
+        throw new Error('npm install failed');
+      });
+
+      const result = await runUpdateAll({ projectRoot: tempDir });
+
+      // update-all should fail with lockfile error
+      expect(result.success).toBe(false);
+      expect(result.summary).toContain('Lockfile regeneration FAIL');
+      expect(result.summary).toContain('npm install failed');
     });
 
-    it('continues gracefully when lockfile regeneration partially fails', async () => {
+    it('continues when infra lockfile fails but root succeeds', async () => {
       mockReadScaffoldConfig.mockResolvedValue(makeScaffoldConfig([]));
 
-      // Remove infra/modules/package.json to simulate partial failure
-      const infraPkgPath = join(tempDir, 'infra', 'modules', 'package.json');
-      rmSync(infraPkgPath, { force: true });
+      // execSync: first call succeeds (root), second call throws (infra)
+      mockExecSync
+        .mockImplementationOnce(() => Buffer.from(''))
+        .mockImplementationOnce(() => {
+          throw new Error('infra npm install failed');
+        });
 
-      // Should not throw — lockfile regeneration for missing infra dir is graceful
       const result = await runUpdateAll({ projectRoot: tempDir });
 
+      // update-all should succeed — infra failure is non-fatal
       expect(result.success).toBe(true);
+      expect(mockExecSync).toHaveBeenCalledTimes(2);
     });
   });
 });

package/src/commands/update-all.ts

@@ -39,19 +39,21 @@ const TOOLCHAIN_NPM_NAMES: Record<string, string> = {
  * Write exact toolchain versions into infra/modules/package.json.
  * Replaces the @mettlecast/* dependency versions with the pinned exact versions
  * from the toolchain manifest. Preserves all other fields unchanged.
+ * Only writes the file if at least one version actually changes.
  *
  * @param projectRoot - Project root directory.
  * @param manifest - The resolved toolchain manifest.
+ * @returns Whether any dependency version was actually changed.
  */
 async function pinInfraPackageVersions(
   projectRoot: string,
   manifest: ToolchainManifest,
-): Promise<void> {
+): Promise<{ changed: boolean }> {
   const infraPkgPath = join(projectRoot, 'infra', 'modules', 'package.json');
 
   if (!existsSync(infraPkgPath)) {
     cliLogger.warn({ path: infraPkgPath }, 'infra/modules/package.json not found — skipping version pinning');
-    return;
+    return { changed: false };
   }
 
   const raw = await readFile(infraPkgPath, 'utf-8');
@@ -60,50 +62,72 @@ async function pinInfraPackageVersions(
   const pkgDeps = (pkg.dependencies ?? {}) as Record<string, string>;
   const pkgDevDeps = (pkg.devDependencies ?? {}) as Record<string, string>;
 
+  let changed = false;
+
   // Pin @mettlecast/domain-cdk-packer
   if (TOOLCHAIN_NPM_NAMES.domainCdkPacker in pkgDeps) {
-    pkgDeps[TOOLCHAIN_NPM_NAMES.domainCdkPacker] = manifest.packages.domainCdkPacker;
+    if (pkgDeps[TOOLCHAIN_NPM_NAMES.domainCdkPacker] !== manifest.packages.domainCdkPacker) {
+      pkgDeps[TOOLCHAIN_NPM_NAMES.domainCdkPacker] = manifest.packages.domainCdkPacker;
+      changed = true;
+    }
   }
 
   // Pin @mettlecast/domain-runtime
   if (TOOLCHAIN_NPM_NAMES.domainRuntime in pkgDeps) {
-    pkgDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+    if (pkgDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] !== manifest.packages.domainRuntime) {
+      pkgDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+      changed = true;
+    }
   }
 
   // Pin @mettlecast/domain-cli
   if (TOOLCHAIN_NPM_NAMES.domainCli in pkgDevDeps) {
-    pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+    if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] !== manifest.packages.domainCli) {
+      pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+      changed = true;
+    }
   }
 
   // Pin @mettlecast/eslint-plugin-domain-module
   if (TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule in pkgDevDeps) {
-    pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+    if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] !== manifest.packages.eslintPluginDomainModule) {
+      pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+      changed = true;
+    }
   }
 
-  pkg.dependencies = pkgDeps;
-  pkg.devDependencies = pkgDevDeps;
+  if (changed) {
+    pkg.dependencies = pkgDeps;
+    pkg.devDependencies = pkgDevDeps;
+
+    await writeFile(infraPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
+    cliLogger.info({ path: infraPkgPath }, 'Pinned toolchain versions in infra/modules/package.json');
+  } else {
+    cliLogger.info({ path: infraPkgPath }, 'infra/modules/package.json already up-to-date');
+  }
 
-  await writeFile(infraPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
-  cliLogger.info({ path: infraPkgPath }, 'Pinned toolchain versions in infra/modules/package.json');
+  return { changed };
 }
 
 /**
  * Write exact toolchain versions into root package.json.
  * Replaces the @mettlecast/* devDependency versions with the pinned exact versions
  * from the toolchain manifest. Preserves all other fields unchanged.
+ * Only writes the file if at least one version actually changes.
  *
  * @param projectRoot - Project root directory.
  * @param manifest - The resolved toolchain manifest.
+ * @returns Whether any devDependency version was actually changed.
  */
 async function pinRootPackageVersions(
   projectRoot: string,
   manifest: ToolchainManifest,
-): Promise<void> {
+): Promise<{ changed: boolean }> {
   const rootPkgPath = join(projectRoot, 'package.json');
 
   if (!existsSync(rootPkgPath)) {
     cliLogger.warn({ path: rootPkgPath }, 'root package.json not found — skipping version pinning');
-    return;
+    return { changed: false };
   }
 
   const raw = await readFile(rootPkgPath, 'utf-8');
@@ -111,43 +135,70 @@ async function pinRootPackageVersions(
 
   const pkgDevDeps = (pkg.devDependencies ?? {}) as Record<string, string>;
 
+  let changed = false;
+
   // Pin @mettlecast/domain-cli (root devDependency)
   if (TOOLCHAIN_NPM_NAMES.domainCli in pkgDevDeps) {
-    pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+    if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] !== manifest.packages.domainCli) {
+      pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainCli] = manifest.packages.domainCli;
+      changed = true;
+    }
   }
 
   // Pin @mettlecast/domain-runtime (root devDependency)
   if (TOOLCHAIN_NPM_NAMES.domainRuntime in pkgDevDeps) {
-    pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+    if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] !== manifest.packages.domainRuntime) {
+      pkgDevDeps[TOOLCHAIN_NPM_NAMES.domainRuntime] = manifest.packages.domainRuntime;
+      changed = true;
+    }
   }
 
   // Pin @mettlecast/eslint-plugin-domain-module (root devDependency)
   if (TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule in pkgDevDeps) {
-    pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+    if (pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] !== manifest.packages.eslintPluginDomainModule) {
+      pkgDevDeps[TOOLCHAIN_NPM_NAMES.eslintPluginDomainModule] = manifest.packages.eslintPluginDomainModule;
+      changed = true;
+    }
   }
 
-  pkg.devDependencies = pkgDevDeps;
+  if (changed) {
+    pkg.devDependencies = pkgDevDeps;
 
-  await writeFile(rootPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
-  cliLogger.info({ path: rootPkgPath }, 'Pinned toolchain versions in root package.json');
+    await writeFile(rootPkgPath, JSON.stringify(pkg, null, 2) + '\n', 'utf-8');
+    cliLogger.info({ path: rootPkgPath }, 'Pinned toolchain versions in root package.json');
+  } else {
+    cliLogger.info({ path: rootPkgPath }, 'root package.json already up-to-date');
+  }
+
+  return { changed };
 }
 
 /**
- * Regenerate lockfiles for root and infra/modules after version pinning.
- * Runs `npm install --package-lock-only --package-lock` (without modifying
- * package.json) to produce deterministic package-lock.json files that match
- * the pinned exact versions. The explicit `--package-lock` ensures lockfiles
- * are always generated regardless of .npmrc settings.
+ * Regenerate lockfiles after version pinning.
+ * Always regenerates the root package-lock.json on every run to ensure it
+ * fully reconciles with the pinned versions (not just on manifest changes).
+ * Infra/modules lockfile is regenerated only when infra deps actually changed.
+ *
+ * Uses normal npm semantics (`npm install --package-lock-only --package-lock --no-save`)
+ * — no forced, legacy-peer-deps, or override flags — to produce deterministic
+ * lockfiles that match the pinned exact versions.
+ *
+ * Root lockfile failure is fatal (deploy blocker); infra/modules lockfile
+ * failure is logged as a warning but does not abort the pipeline.
  *
  * @param projectRoot - Project root directory.
+ * @param options - Options with infraChanged flag.
+ * @throws When root lockfile regeneration fails.
  */
-async function regenerateLockfiles(projectRoot: string): Promise<void> {
-  const rootPkgPath = join(projectRoot, 'package.json');
-  const infraPkgPath = join(projectRoot, 'infra', 'modules', 'package.json');
-
+async function regenerateLockfiles(
+  projectRoot: string,
+  options: { infraChanged: boolean },
+): Promise<void> {
   const npmLockCmd = 'npm install --package-lock-only --package-lock --no-save';
 
-  // Regenerate root lockfile if root package.json exists
+  // Root lockfile is always regenerated to ensure it is fully reconciled
+  // with the pinned exact versions on every update-all run.
+  const rootPkgPath = join(projectRoot, 'package.json');
   if (existsSync(rootPkgPath)) {
     try {
       cliLogger.info({ projectRoot }, 'Regenerating root package-lock.json');
@@ -159,30 +210,31 @@ async function regenerateLockfiles(projectRoot: string): Promise<void> {
       cliLogger.info({ projectRoot }, 'Root package-lock.json regenerated');
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      cliLogger.warn(
-        { err: message },
-        'Root lockfile regeneration failed (non-fatal — continuing)',
-      );
+      cliLogger.error({ err: message }, 'Root lockfile regeneration FAILED');
+      throw new Error(`Root lockfile regeneration FAILED: ${message}`);
     }
   }
 
-  // Regenerate infra/modules lockfile if infra/modules/package.json exists
-  if (existsSync(infraPkgPath)) {
-    try {
-      const infraDir = join(projectRoot, 'infra', 'modules');
-      cliLogger.info({ path: infraDir }, 'Regenerating infra/modules package-lock.json');
-      execSync(npmLockCmd, {
-        cwd: infraDir,
-        stdio: 'pipe',
-        timeout: 120_000,
-      });
-      cliLogger.info({ path: infraDir }, 'infra/modules package-lock.json regenerated');
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      cliLogger.warn(
-        { err: message },
-        'infra/modules lockfile regeneration failed (non-fatal — continuing)',
-      );
+  // Infra/modules lockfile is regenerated only when infra deps actually changed.
+  if (options.infraChanged) {
+    const infraPkgPath = join(projectRoot, 'infra', 'modules', 'package.json');
+    if (existsSync(infraPkgPath)) {
+      try {
+        const infraDir = join(projectRoot, 'infra', 'modules');
+        cliLogger.info({ path: infraDir }, 'Regenerating infra/modules package-lock.json');
+        execSync(npmLockCmd, {
+          cwd: infraDir,
+          stdio: 'pipe',
+          timeout: 120_000,
+        });
+        cliLogger.info({ path: infraDir }, 'infra/modules package-lock.json regenerated');
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        cliLogger.warn(
+          { err: message },
+          'infra/modules lockfile regeneration failed (non-fatal — continuing)',
+        );
+      }
     }
   }
 }
@@ -229,20 +281,30 @@ export async function runUpdateAll(opts?: { projectRoot?: string }): Promise<{ s
     return { success: false, summary: `Toolchain resolution FAIL: ${message}` };
   }
 
-  // Pin exact versions from manifest into infra/modules/package.json and root package.json
+  // Pin exact versions from manifest into infra/modules/package.json and root package.json.
+  // Returns whether each manifest actually changed.
+  let infraChanged = false;
   try {
-    await pinInfraPackageVersions(projectRoot, manifest);
+    const infraResult = await pinInfraPackageVersions(projectRoot, manifest);
     await pinRootPackageVersions(projectRoot, manifest);
+    infraChanged = infraResult.changed;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     cliLogger.error({ err: message }, 'update-all: version pinning failed — aborting');
     return { success: false, summary: `Version pinning FAIL: ${message}` };
   }
 
-  // Regenerate lockfiles so that root and infra/modules lockfiles exist
-  // and match the pinned exact versions before generated CI uses `npm ci`.
-  cliLogger.info({ projectRoot }, 'update-all: regenerating lockfiles');
-  await regenerateLockfiles(projectRoot);
+  // Regenerate lockfiles. Root lockfile is always regenerated (every run) to ensure
+  // full reconciliation. Infra/modules lockfile is regenerated only when its deps changed.
+  // Root lockfile failure is fatal (deploy blocker); infra/modules failure is not.
+  cliLogger.info({ projectRoot, infraChanged }, 'update-all: regenerating root package-lock.json');
+  try {
+    await regenerateLockfiles(projectRoot, { infraChanged });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    cliLogger.error({ err: message }, 'update-all: root lockfile regeneration failed — aborting');
+    return { success: false, summary: `Lockfile regeneration FAIL: ${message}` };
+  }
 
   // 1. Read scaffold-config to discover domains
   const scaffoldConfig = await readScaffoldConfig(projectRoot);

package/toolchain-manifest.json

@@ -2,9 +2,9 @@
   "schemaVersion": 1,
   "registrySchemaVersion": "1",
   "packages": {
-    "domainCli": "0.2.89",
-    "domainCdkPacker": "0.2.90",
-    "domainRuntime": "0.2.89",
-    "eslintPluginDomainModule": "0.2.89"
+    "domainCli": "0.2.90",
+    "domainCdkPacker": "0.2.91",
+    "domainRuntime": "0.2.90",
+    "eslintPluginDomainModule": "0.2.90"
   }
 }