@biffo/cli 0.108.3 → 0.108.5

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command26 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/commands/core.ts
 import { Command as Command4 } from "commander";
@@ -819,7 +819,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -834,7 +834,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1039,7 +1039,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
+          await new Promise((resolve18) => setTimeout(resolve18, protectionIntervalMs));
         }
       }
     }
@@ -1265,7 +1265,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
       }
     }
   }
@@ -1284,7 +1284,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
       }
     }
   }
@@ -1308,7 +1308,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -1998,15 +1998,6 @@ function standardArguments(pluginName, handler) {
     ["event_bus_name", "module.events.event_bus_name"],
     ["core_api_url", "module.api_gateway.api_endpoint"],
     ["core_api_execution_arn", "module.api_gateway.execution_arn"],
-    // User-facing plugin inputs (ADR-0018 §1): the shared-Cognito coordinates its
-    // Lambda verifies the founder's JWT against, and the CloudFront distribution
-    // ARN its frontend bucket policy grants read to. Emitted ONLY for a plugin whose
-    // module declares them (declaredVariables gate), so an event-only plugin is
-    // unaffected — same graceful-degradation contract as core_api_execution_arn.
-    ["cognito_user_pool_id", "module.auth.user_pool_id"],
-    ["cognito_client_id", "module.auth.client_id"],
-    ["cognito_region", "var.aws_region"],
-    ["cdn_distribution_arn", "module.cdn.distribution_arn"],
     ["tags", "local.tags"]
   ];
 }
@@ -2092,58 +2083,13 @@ function declaredVariables(moduleDir) {
   }
   return names;
 }
-var USER_FACING_PLUGIN_OUTPUTS = [
-  "function_url_domain",
-  "frontend_bucket_regional_domain",
-  "frontend_bucket_name"
-];
-function rootPluginOutputName(pluginName, output) {
-  return `plugin_${pluginName}_${output}`;
-}
-function pluginOutputsFromRoot(pluginName, rootOutputs) {
-  const flat = {};
-  for (const key of USER_FACING_PLUGIN_OUTPUTS) {
-    const value = rootOutputs[rootPluginOutputName(pluginName, key)];
-    if (value !== void 0) flat[key] = value;
-  }
-  return flat;
-}
-function declaredOutputs(moduleDir) {
-  const names = /* @__PURE__ */ new Set();
-  let entries;
-  try {
-    entries = readdirSync3(moduleDir, { withFileTypes: true });
-  } catch {
-    return names;
-  }
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
-    let contents;
-    try {
-      contents = readFileSync7(join10(moduleDir, entry.name), "utf8");
-    } catch {
-      continue;
-    }
-    for (const match of contents.matchAll(/^\s*output\s+"([^"]+)"/gm)) {
-      names.add(match[1]);
-    }
-  }
-  return names;
-}
 function renderArguments(args, indent) {
   const width = Math.max(...args.map(([key]) => key.length));
   return args.map(([key, value]) => `${indent}${key.padEnd(width)} = ${value}`).join("\n");
 }
-function renderModuleBlock(pluginName, declared, handler, source, declaredOutputNames) {
+function renderModuleBlock(pluginName, declared, handler, source) {
   const args = standardArguments(pluginName, handler).filter(([key]) => declared.has(key));
   const quoted = JSON.stringify(pluginName);
-  const outputBlock = (name, description, attr) => [
-    "",
-    `output "${name}" {`,
-    `  description = "${description}"`,
-    `  value       = try(module.plugin_${pluginName}[${quoted}].${attr}, null)`,
-    "}"
-  ];
   const lines = [
     `module "plugin_${pluginName}" {`,
     `  source   = "${source}"`,
@@ -2151,22 +2097,12 @@ function renderModuleBlock(pluginName, declared, handler, source, declaredOutput
     "",
     renderArguments(args, "  "),
     "}",
-    ...outputBlock(
-      `plugin_${pluginName}_function_arn`,
-      `Lambda ARN of the ${pluginName} plugin, or null when it is not in enabled_plugins.`,
-      "function_arn"
-    )
+    "",
+    `output "plugin_${pluginName}_function_arn" {`,
+    `  description = "Lambda ARN of the ${pluginName} plugin, or null when it is not in enabled_plugins."`,
+    `  value       = try(module.plugin_${pluginName}[${quoted}].function_arn, null)`,
+    "}"
   ];
-  for (const output of USER_FACING_PLUGIN_OUTPUTS) {
-    if (!declaredOutputNames.has(output)) continue;
-    lines.push(
-      ...outputBlock(
-        rootPluginOutputName(pluginName, output),
-        `${output.replace(/_/g, " ")} of the ${pluginName} plugin (ADR-0018 register step), or null when it is not enabled.`,
-        output
-      )
-    );
-  }
   return lines.join("\n");
 }
 var GENERATED_HEADER = `# ---------------------------------------------------------------------------
@@ -2197,8 +2133,7 @@ function renderGeneratedTerraform(plugins) {
       p.name,
       p.declaredVariables,
       p.handler ?? DEFAULT_PLUGIN_HANDLER,
-      p.source ?? THIRD_PARTY_TERRAFORM(p.name),
-      p.declaredOutputs ?? /* @__PURE__ */ new Set()
+      p.source ?? THIRD_PARTY_TERRAFORM(p.name)
     )
   );
   return `${GENERATED_HEADER}
@@ -2219,7 +2154,6 @@ function syncPluginTerraform(cwd) {
     return {
       name,
       declaredVariables: declaredVariables(moduleDir),
-      declaredOutputs: declaredOutputs(moduleDir),
       source: pluginModuleSource(cwd, name)
     };
   });
@@ -2917,7 +2851,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve19) => setTimeout(resolve19, retryDelayMs));
+          await new Promise((resolve18) => setTimeout(resolve18, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -6032,7 +5966,7 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 }
 
 // src/commands/plugin.ts
-import { Command as Command21 } from "commander";
+import { Command as Command20 } from "commander";
 
 // src/commands/plugin-create.ts
 import { existsSync as existsSync23, readFileSync as readFileSync17 } from "fs";
@@ -6190,19 +6124,13 @@ var RouteDefSchema = z6.object({
     });
   }
 });
-var USER_PATH_SEGMENT = /^[a-z][a-z0-9_-]*$/;
-var HANDLER_IMPORT_PATH = /^[a-zA-Z_]\w*(\.[a-zA-Z_]\w*)+$/;
 var REL_DIR = /^[\w][\w./-]*$/;
 var NON_EMPTY_GROUP = "required_group must be a non-empty Cognito group name.";
 var APP_REF = /^[a-zA-Z_]\w*(\.[a-zA-Z_]\w*)*:[a-zA-Z_]\w*$/;
 var UserIngressSchema = z6.object({
   required_group: z6.string().min(1, NON_EMPTY_GROUP),
-  app: z6.string().regex(APP_REF, "must be an ASGI app reference '<module>:<attr>', e.g. 'ideation.app:app'").optional(),
-  handler: z6.string().regex(HANDLER_IMPORT_PATH, "must be a dotted import path, e.g. 'ideation.app.handler'").optional(),
-  path: z6.string().regex(USER_PATH_SEGMENT, "must be a single lowercase path segment, e.g. api").default("api")
-}).strict().refine((ui) => Boolean(ui.app ?? ui.handler), {
-  message: "user_ingress must declare `app` (ADR-0021, preferred) or `handler` (legacy)"
-});
+  app: z6.string().regex(APP_REF, "must be an ASGI app reference '<module>:<attr>', e.g. 'ideation.app:app'")
+}).strict();
 var UserFrontendSchema = z6.object({
   dir: z6.string().regex(
     REL_DIR,
@@ -7027,28 +6955,6 @@ async function runPluginInstall(target, options, deps) {
     console.log(chalk15.dim(`    git push`));
     console.log(chalk15.dim(`    biffo deploy <environment> --app-only
 `));
-    if (manifest.user_ingress || manifest.user_frontend) {
-      const group = manifest.user_ingress?.required_group ?? manifest.user_frontend?.required_group;
-      console.log(chalk15.bold(`  "${pluginName}" is a user-facing plugin (ADR-0018).`));
-      console.log(
-        `  It serves an authenticated${group ? ` ${group}-gated` : ""} app at <base>/${pluginName}/ and an api at <base>/${pluginName}/api/*.`
-      );
-      console.log(
-        "  Two more steps route it onto the shared CloudFront (apply is pipeline-only):\n"
-      );
-      console.log(
-        "    1. After the deploy above applies, register its CDN origins from the plugin module outputs, then redeploy so the CDN gains its behaviours:"
-      );
-      console.log(chalk15.dim(`         biffo plugin wire ${pluginName} <environment>`));
-      console.log(chalk15.dim(`         git push  &&  biffo deploy <environment>`));
-      console.log("    2. Build and sync its frontend to the bucket that first apply created");
-      console.log(
-        chalk15.dim(
-          `         (the plugin's own deploy workflow does this \u2014 see ${relTargetDir}/.github/workflows/).
-`
-        )
-      );
-    }
   } finally {
     source.cleanup();
   }
@@ -7510,187 +7416,24 @@ function printDryRun6(entry, currentVersion) {
 `);
 }
 
-// src/commands/plugin-wire.ts
-import { existsSync as existsSync31, readFileSync as readFileSync24 } from "fs";
-import { resolve as resolve17 } from "path";
-import chalk20 from "chalk";
-import { Command as Command20 } from "commander";
-
-// src/lib/plugin-origin.ts
-import { existsSync as existsSync30, readFileSync as readFileSync23, writeFileSync as writeFileSync10 } from "fs";
-import { join as join31 } from "path";
-var PLUGIN_API_TFVARS = "plugin-apis.auto.tfvars.json";
-var SIBLINGS_TFVARS = "siblings.auto.tfvars.json";
-function upsertPluginApiOrigin(existing, entry) {
-  return [...existing.filter((p) => p.name !== entry.name), entry];
-}
-function serializePluginApiRegistry(origins) {
-  return JSON.stringify({ plugin_api_origins: origins }, null, 2) + "\n";
-}
-function readArray(path, key) {
-  if (!existsSync30(path)) return [];
-  try {
-    const parsed = JSON.parse(readFileSync23(path, "utf8"));
-    const arr = parsed[key];
-    return Array.isArray(arr) ? arr : [];
-  } catch {
-    return [];
-  }
-}
-function registerUserFacingPlugin(cwd, environment, reg) {
-  const envDir = join31(cwd, "infra", "environments", environment);
-  const apiPath = join31(envDir, PLUGIN_API_TFVARS);
-  const siblingPath = join31(envDir, SIBLINGS_TFVARS);
-  const apis = upsertPluginApiOrigin(readArray(apiPath, "plugin_api_origins"), {
-    name: reg.name,
-    function_url_domain: reg.functionUrlDomain
-  });
-  writeFileSync10(apiPath, serializePluginApiRegistry(apis));
-  const siblings = upsertSiblingOrigin(readArray(siblingPath, "sibling_origins"), {
-    name: reg.name,
-    bucket_regional_domain: reg.bucketRegionalDomain
-  });
-  writeFileSync10(siblingPath, serializeRegistry(siblings));
-  return [
-    `infra/environments/${environment}/${PLUGIN_API_TFVARS}`,
-    `infra/environments/${environment}/${SIBLINGS_TFVARS}`
-  ];
-}
-var REQUIRED_PLUGIN_OUTPUTS = [
-  "function_url_domain",
-  "frontend_bucket_regional_domain",
-  "frontend_bucket_name"
-];
-function wireUserFacingPluginFromOutputs(cwd, environment, name, outputs) {
-  const missing = REQUIRED_PLUGIN_OUTPUTS.filter((k) => !outputs[k]?.trim());
-  if (missing.length > 0) {
-    throw new Error(
-      `Cannot register the user-facing plugin "${name}" for ${environment}: its Terraform apply did not expose ${missing.join(", ")}. A registration written without these would route ${name}/api/* and ${name}/* at nothing (the frontend 403s, the api 502s). Confirm the plugin module applied for ${environment} before wiring.`
-    );
-  }
-  const registeredPaths = registerUserFacingPlugin(cwd, environment, {
-    name,
-    functionUrlDomain: outputs["function_url_domain"],
-    bucketRegionalDomain: outputs["frontend_bucket_regional_domain"]
-  });
-  return { registeredPaths, frontendBucketName: outputs["frontend_bucket_name"] };
-}
-
-// src/commands/plugin-wire.ts
-var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
-async function runPluginWire(pluginName, environment, config, deps, cwd = process.cwd()) {
-  const awsConfig2 = config.cloud.config;
-  const stateBucket = awsConfig2.tf_state_bucket ?? `${config.project.name}-terraform-state-${awsConfig2.account_id}`;
-  const stateKey = `${environment}/terraform.tfstate`;
-  log.info(`Reading Terraform outputs from s3://${stateBucket}/${stateKey}...`);
-  const outputs = await deps.readOutputs(stateBucket, stateKey);
-  const pluginOutputs = pluginOutputsFromRoot(pluginName, outputs);
-  const targets = wireUserFacingPluginFromOutputs(cwd, environment, pluginName, pluginOutputs);
-  console.log(chalk20.bold(`
-  Registered "${pluginName}" CDN origins for ${environment}
-`));
-  for (const path of targets.registeredPaths) console.log(`    ${chalk20.green("~")} ${path}`);
-  console.log(
-    "\n  Commit these and redeploy so the CDN gains its behaviours (apply is pipeline-only):"
-  );
-  console.log(chalk20.dim(`    git add ${targets.registeredPaths.join(" ")}`));
-  console.log(chalk20.dim(`    git commit -m "infra(cdn): route ${pluginName} (${environment})"`));
-  console.log(chalk20.dim(`    git push  &&  biffo deploy ${environment}
-`));
-  console.log(
-    `  Then build and sync the frontend to its bucket: ${chalk20.bold(targets.frontendBucketName)}`
-  );
-  console.log(
-    chalk20.dim(
-      "  (the plugin's own deploy workflow does this \u2014 it reads the bucket from the same outputs.)\n"
-    )
-  );
-  return targets;
-}
-var pluginWireCommand = new Command20("wire").description(
-  "Register a user-facing plugin's CDN origins from its deployed outputs (ADR-0018 register step): biffo plugin wire <name> <environment>"
-).argument("<name>", "Plugin name, e.g. ideation").argument("<environment>", "Target environment: dev | staging | prod").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(
-  async (name, environment, options) => {
-    if (!VALID_ENVIRONMENTS2.includes(environment)) {
-      log.error(
-        `Unknown environment: ${environment}. Must be one of: ${VALID_ENVIRONMENTS2.join(", ")}`
-      );
-      process.exit(1);
-    }
-    const config = await resolveConfig4(options);
-    const aws = new AwsAdapter(config);
-    try {
-      await runPluginWire(name, environment, config, {
-        readOutputs: (bucket, key) => aws.readTerraformOutputs(bucket, key)
-      });
-    } catch (err) {
-      log.error(err.message);
-      process.exit(1);
-    }
-  }
-);
-async function resolveConfig4(options) {
-  if (options.config) {
-    const raw = JSON.parse(readFileSync24(resolve17(options.config), "utf8"));
-    const result = BiffoConfigSchema.safeParse(raw);
-    if (!result.success) {
-      log.error(`Invalid config at ${options.config}:`);
-      result.error.issues.forEach((i) => log.error(`  ${i.path.join(".")} \u2014 ${i.message}`));
-      process.exit(1);
-    }
-    return result.data;
-  }
-  if (options.project) {
-    const cfg = loadProjectConfig(options.project);
-    if (!cfg) {
-      log.error(
-        `Project "${options.project}" not found in ~/.biffo/projects/. Run biffo init first or pass --config <path>.`
-      );
-      process.exit(1);
-    }
-    return cfg;
-  }
-  const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
-  if (existsSync31(localConfigPath)) {
-    const raw = JSON.parse(readFileSync24(localConfigPath, "utf8"));
-    const result = BiffoConfigSchema.safeParse(raw);
-    if (result.success) return result.data;
-    if (isTemplatePlaceholderConfig(raw)) {
-      log.warn(
-        `Ignoring ${localConfigPath} \u2014 it is the unsubstituted Biffo template placeholder, not this project's config.`
-      );
-    } else {
-      log.error(`Invalid config at ${localConfigPath}:`);
-      result.error.issues.forEach((i) => log.error(`  ${i.path.join(".")} \u2014 ${i.message}`));
-      log.error("Refusing to fall back to a saved project while a local config file is present.");
-      process.exit(1);
-    }
-  }
-  log.error(
-    "No config found. Run inside a Biffo project, or pass --project <name> / --config <path>."
-  );
-  return process.exit(1);
-}
-
 // src/commands/plugin.ts
-var pluginCommand = new Command21("plugin").description("Manage Biffo plugins");
+var pluginCommand = new Command20("plugin").description("Manage Biffo plugins");
 pluginCommand.addCommand(pluginCreateCommand);
 pluginCommand.addCommand(pluginListCommand);
 pluginCommand.addCommand(pluginInstallCommand);
-pluginCommand.addCommand(pluginWireCommand);
 pluginCommand.addCommand(pluginUninstallCommand);
 pluginCommand.addCommand(pluginUpgradeCommand);
 pluginCommand.addCommand(pluginSyncMigrationsCommand);
 pluginCommand.addCommand(pluginInfoCommand);
 
 // src/commands/sibling.ts
-import { Command as Command23 } from "commander";
+import { Command as Command22 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync32, readFileSync as readFileSync25 } from "fs";
-import { resolve as resolve18 } from "path";
-import chalk21 from "chalk";
-import { Command as Command22 } from "commander";
+import { existsSync as existsSync30, readFileSync as readFileSync23 } from "fs";
+import { resolve as resolve17 } from "path";
+import chalk20 from "chalk";
+import { Command as Command21 } from "commander";
 
 // src/lib/sibling-identity-check.ts
 function checkSiblingIdentity(envs) {
@@ -7740,19 +7483,19 @@ function checkSiblingIdentity(envs) {
 }
 
 // src/commands/sibling-check-identity.ts
-var VALID_ENVIRONMENTS3 = ["dev", "staging", "prod"];
+var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
 var SIBLING_CORE_POOL_VAR = "CORE_COGNITO_USER_POOL_ID";
-var siblingCheckIdentityCommand = new Command22("check-identity").description(
+var siblingCheckIdentityCommand = new Command21("check-identity").description(
   "Detect when a core's Cognito pool has drifted from its published identity document or any sibling's baked-in CORE_COGNITO_USER_POOL_ID (#400). Run from the core repo; exits non-zero on drift so a scheduled/CI run goes red."
 ).option("--env <environment>", "Only check this environment (default: dev, staging, prod)").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(async (options) => {
-  if (options.env && !VALID_ENVIRONMENTS3.includes(options.env)) {
+  if (options.env && !VALID_ENVIRONMENTS2.includes(options.env)) {
     log.error(
-      `Unknown environment: ${options.env}. Must be one of: ${VALID_ENVIRONMENTS3.join(", ")}`
+      `Unknown environment: ${options.env}. Must be one of: ${VALID_ENVIRONMENTS2.join(", ")}`
     );
     process.exit(1);
   }
-  const environments = options.env ? [options.env] : [...VALID_ENVIRONMENTS3];
-  const config = await resolveConfig5(options);
+  const environments = options.env ? [options.env] : [...VALID_ENVIRONMENTS2];
+  const config = await resolveConfig4(options);
   const { org, repo } = config.source_control.config;
   const awsConfig2 = config.cloud.config;
   const stateBucket = awsConfig2.tf_state_bucket ?? `${config.project.name}-terraform-state-${awsConfig2.account_id}`;
@@ -7762,7 +7505,7 @@ var siblingCheckIdentityCommand = new Command22("check-identity").description(
     github: new GitHubAdapter(token),
     fetchIdentityDoc: fetchPublishedIdentity
   };
-  console.log(chalk21.bold(`
+  console.log(chalk20.bold(`
   Biffo \u2014 Sibling identity check (${config.project.name})
 `));
   let result;
@@ -7849,16 +7592,16 @@ function printIdentityReport(result) {
   }
   if (result.ok) {
     log.success(
-      chalk21.green(
+      chalk20.green(
         "\u2713 identity consistent \u2014 every published document and sibling backend matches the live pool"
       )
     );
     return;
   }
-  log.error(chalk21.red(`\u2718 ${String(result.findings.length)} identity drift finding(s):`));
+  log.error(chalk20.red(`\u2718 ${String(result.findings.length)} identity drift finding(s):`));
   for (const f of result.findings) {
     console.error(
-      chalk21.red(
+      chalk20.red(
         `  [${f.environment}] ${f.subject}: ${FINDING_LABEL[f.kind]}
       expected (live pool): ${f.expected}
       found:                ${f.actual ?? "(unset)"}`
@@ -7879,9 +7622,9 @@ async function fetchPublishedIdentity(portalUrl) {
     return null;
   }
 }
-async function resolveConfig5(options) {
+async function resolveConfig4(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync25(resolve18(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync23(resolve17(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -7900,9 +7643,9 @@ async function resolveConfig5(options) {
     }
     return cfg;
   }
-  const localConfigPath = resolve18(process.cwd(), "biffo.config.json");
-  if (existsSync32(localConfigPath)) {
-    const raw = JSON.parse(readFileSync25(localConfigPath, "utf8"));
+  const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
+  if (existsSync30(localConfigPath)) {
+    const raw = JSON.parse(readFileSync23(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -7938,14 +7681,14 @@ async function resolveConfig5(options) {
 }
 
 // src/commands/sibling.ts
-var siblingCommand = new Command23("sibling").description(
+var siblingCommand = new Command22("sibling").description(
   "Create and manage sibling apps that share a Biffo core project (ADR-0007)"
 );
 siblingCommand.addCommand(siblingCreateCommand);
 siblingCommand.addCommand(siblingCheckIdentityCommand);
 
 // src/commands/check.ts
-import { Command as Command24 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/scripts/check-core-ownership.ts
 import { execa as execa5 } from "execa";
@@ -7971,8 +7714,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa5("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync27, existsSync: existsSync34 } = await import("fs");
-      if (existsSync34(messageFile)) commitMessage = readFileSync27(messageFile, "utf8");
+      const { readFileSync: readFileSync25, existsSync: existsSync32 } = await import("fs");
+      if (existsSync32(messageFile)) commitMessage = readFileSync25(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -8076,8 +7819,8 @@ ${BOLD}If the divergence is deliberate${OFF}
 import { execa as execa6 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync33, readFileSync as readFileSync26, readdirSync as readdirSync13 } from "fs";
-import { dirname as dirname9, join as join32, relative as relative6, sep as sep3 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync24, readdirSync as readdirSync13 } from "fs";
+import { dirname as dirname9, join as join31, relative as relative6, sep as sep3 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -8092,9 +7835,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
-        walk(join32(dir, entry.name));
+        walk(join31(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative6(root, join32(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative6(root, join31(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -8104,7 +7847,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync26(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync24(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -8119,14 +7862,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync33(join32(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync31(join31(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join32(root, manifest);
+    const absManifest = join31(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync33(join32(pluginDir2, "terraform"))) continue;
+    if (existsSync31(join31(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative6(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -8245,7 +7988,7 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/commands/check.ts
-var checkCommand = new Command24("check").description(
+var checkCommand = new Command23("check").description(
   "Repo guards (ownership, release subject, plugin terraform) \u2014 run in CI and git hooks"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
@@ -8265,17 +8008,17 @@ function rawArgsAfter(subcommand) {
 // src/commands/teardown.ts
 import { execSync as execSync7 } from "child_process";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STSClient3 } from "@aws-sdk/client-sts";
-import chalk22 from "chalk";
-import { Command as Command25 } from "commander";
+import chalk21 from "chalk";
+import { Command as Command24 } from "commander";
 import inquirer8 from "inquirer";
-var teardownCommand = new Command25("teardown").description(
+var teardownCommand = new Command24("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
   "--confirm <name>",
   "Pre-confirm by supplying the project name (the scriptable form of the typed confirmation)"
 ).option("-y, --yes", "Skip the typed project-name confirmation entirely").action(
   async (options) => {
-    console.log(chalk22.bold("\n  Biffo \u2014 Teardown\n"));
+    console.log(chalk21.bold("\n  Biffo \u2014 Teardown\n"));
     const githubToken = resolveGithubToken4();
     const sts = new STSClient3({});
     const { Account: accountId } = await sts.send(new GetCallerIdentityCommand3({}));
@@ -8297,7 +8040,7 @@ var teardownCommand = new Command25("teardown").description(
       adminEmail = session.config.admin?.email ?? "noop@example.com";
       adminUsername = session.config.admin?.username ?? "noop";
       domain = session.config.project.domain ?? "";
-      console.log(chalk22.yellow("  Loaded session for: ") + chalk22.bold(projectName));
+      console.log(chalk21.yellow("  Loaded session for: ") + chalk21.bold(projectName));
       if (org && repo) console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else if (savedConfig) {
@@ -8310,7 +8053,7 @@ var teardownCommand = new Command25("teardown").description(
       adminEmail = savedConfig.admin.email;
       adminUsername = savedConfig.admin.username;
       domain = resolveDnsConfig(savedConfig).domain;
-      console.log(chalk22.yellow("  Loaded config for: ") + chalk22.bold(projectName));
+      console.log(chalk21.yellow("  Loaded config for: ") + chalk21.bold(projectName));
       console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else {
@@ -8381,35 +8124,35 @@ var teardownCommand = new Command25("teardown").description(
         throw err;
       }
     }
-    console.log(chalk22.red.bold("  This will permanently delete:\n"));
+    console.log(chalk21.red.bold("  This will permanently delete:\n"));
     if (deployedEnvs.length > 0 || hasGlobal) {
-      console.log(chalk22.red("  Infrastructure (via GitHub Actions terraform destroy):"));
+      console.log(chalk21.red("  Infrastructure (via GitHub Actions terraform destroy):"));
       for (const env of deployedEnvs) {
         console.log(
-          `    ${chalk22.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
+          `    ${chalk21.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
         );
       }
       if (hasGlobal) {
-        console.log(`    ${chalk22.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
+        console.log(`    ${chalk21.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
       }
       console.log();
     }
     for (const line of formatSiblingPlan(siblings, options.skipDestroy === true)) {
       console.log(line);
     }
-    console.log(chalk22.red("  Biffo resources:"));
-    console.log(`    ${chalk22.red("\u2717")} GitHub repository  ${chalk22.bold(`${org}/${repo}`)}`);
+    console.log(chalk21.red("  Biffo resources:"));
+    console.log(`    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${org}/${repo}`)}`);
     console.log(
-      `    ${chalk22.red("\u2717")} IAM role           ${chalk22.bold(`biffo-github-actions-${projectName}`)}`
+      `    ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${projectName}`)}`
     );
     console.log(
-      `    ${chalk22.red("\u2717")} S3 bucket          ${chalk22.bold(stateBucket)} (all versions)`
+      `    ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(stateBucket)} (all versions)`
     );
-    console.log(`    ${chalk22.red("\u2717")} Local session file`);
+    console.log(`    ${chalk21.red("\u2717")} Local session file`);
     if (options.skipDestroy) {
       console.log();
       console.log(
-        chalk22.yellow(
+        chalk21.yellow(
           "  --skip-destroy: NO terraform destroy runs, for this project or any sibling.\n  Everything above is deleted, but any infrastructure still standing is left\n  standing \u2014 and, with the state buckets gone, orphaned."
         )
       );
@@ -8597,30 +8340,30 @@ async function assertSiblingsAreDestroyable(github, siblings) {
 }
 function formatSiblingPlan(siblings, skipDestroy) {
   if (siblings.length === 0) return [];
-  const lines = [chalk22.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
+  const lines = [chalk21.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
   for (const s of siblings) {
     const envs = s.environments.join(", ");
     if (s.repoState === "gone") {
       lines.push(
-        `    ${chalk22.yellow("!")} ${chalk22.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
+        `    ${chalk21.yellow("!")} ${chalk21.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
       );
       continue;
     }
     lines.push(
-      `    ${chalk22.red("\u2717")} GitHub repository  ${chalk22.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
+      `    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
     );
     lines.push(
-      `      ${chalk22.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
+      `      ${chalk21.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
     );
     lines.push(
-      `      ${chalk22.red("\u2717")} IAM role           ${chalk22.bold(`biffo-github-actions-${s.projectName}`)}`
+      `      ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${s.projectName}`)}`
     );
     lines.push(
-      `      ${chalk22.red("\u2717")} S3 bucket          ${chalk22.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
+      `      ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
     );
     if (s.pendingRegistrationPr !== void 0) {
       lines.push(
-        chalk22.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
+        chalk21.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
       );
     }
   }
@@ -8658,7 +8401,7 @@ async function confirmTeardown(projectName, options) {
     {
       type: "input",
       name: "confirm",
-      message: `Type ${chalk22.bold(projectName)} to confirm:`
+      message: `Type ${chalk21.bold(projectName)} to confirm:`
     }
   ]);
   return confirm === projectName;
@@ -8676,7 +8419,7 @@ function resolveGithubToken4() {
 }
 
 // src/index.ts
-var program = new Command26();
+var program = new Command25();
 function cliVersion() {
   try {
     return getLatestCoreVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.108.3",
+  "version": "0.108.5",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",