@biffo/cli 0.209.2 → 0.210.0

package/dist/index.js

@@ -321,8 +321,20 @@ function readCoreManifest(templateRoot) {
   return result.data;
 }
 function globToRegExp(pattern) {
-  const source = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
-  return new RegExp(`^${source}$`);
+  const isSubtree = pattern.endsWith("/");
+  const body = isSubtree ? pattern.slice(0, -1) : pattern;
+  const segments = body.split("/");
+  let source = "";
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i];
+    if (seg === "**") {
+      source += "(?:[^/]+/)*";
+      continue;
+    }
+    source += (seg ?? "").split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
+    if (i < segments.length - 1) source += "/";
+  }
+  return isSubtree ? new RegExp(`^${source}(?:/.*)?$`) : new RegExp(`^${source}$`);
 }
 var GLOB_CACHE = /* @__PURE__ */ new Map();
 function globMatches(relPath, pattern) {
@@ -585,6 +597,7 @@ import {
 import { tmpdir } from "os";
 import { dirname as dirname3, join as join5 } from "path";
 import { execa } from "execa";
+import { z as z4 } from "zod";
 
 // src/lib/core-ownership-guard.ts
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
@@ -764,14 +777,18 @@ async function planCoreUpgrade(options) {
   for (const e of entries) summary[e.status]++;
   const changes = entries.filter((e) => e.status !== "unchanged" && e.status !== "keep-ours");
   const conflicts = entries.filter((e) => e.conflicted);
-  return { entries, changes, conflicts, summary, divergenceSkips };
+  const oursTracked = gitTrackedFiles(options.oursDir, options.git);
+  const orphaned = entries.filter(
+    (e) => e.orphaned === true && (oursTracked === null || oursTracked.has(e.path))
+  );
+  return { entries, changes, conflicts, summary, divergenceSkips, orphaned };
 }
 async function classify(path, base, ours, theirs, opts, mergeFile, isDeclaredDivergent, noteDivergenceSkip) {
   const inBase = base.has(path);
   const inOurs = ours.has(path);
   const inTheirs = theirs.has(path);
   if (!inBase && !inTheirs) {
-    return { path, status: "keep-ours", conflicted: false };
+    return { path, status: "keep-ours", conflicted: false, orphaned: true };
   }
   if (!inBase && inTheirs) {
     const theirsContent2 = read(opts.theirsDir, path);
@@ -837,6 +854,38 @@ function applyUpgradePlan(instanceDir, plan, theirsDir) {
   }
   return { written, deleted };
 }
+var ORPHAN_BASELINE_FILE = "biffo.orphan-baseline.json";
+var OrphanBaselineSchema = z4.object({
+  count: z4.number().int().min(0)
+});
+function readOrphanBaseline(instanceRoot) {
+  const path = join5(instanceRoot, ORPHAN_BASELINE_FILE);
+  if (!existsSync5(path)) return null;
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync4(path, "utf8"));
+  } catch (err) {
+    throw new Error(`${ORPHAN_BASELINE_FILE} is not valid JSON: ${err.message}`);
+  }
+  const parsed = OrphanBaselineSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new Error(
+      `${ORPHAN_BASELINE_FILE} is invalid: ${parsed.error.issues[0]?.message ?? "unexpected shape"}`
+    );
+  }
+  return parsed.data;
+}
+function writeOrphanBaseline(instanceRoot, count) {
+  writeFileSync2(join5(instanceRoot, ORPHAN_BASELINE_FILE), `${JSON.stringify({ count }, null, 2)}
+`);
+}
+function checkOrphanRatchet(count, baseline) {
+  return {
+    count,
+    baseline: baseline?.count ?? null,
+    increased: baseline !== null && count > baseline.count
+  };
+}
 function parseGitHubRepo(remoteUrl) {
   const ssh = /^git@[^:]+:([^/]+)\/(.+?)(?:\.git)?\/?$/.exec(remoteUrl);
   if (ssh && ssh[1] && ssh[2]) return { owner: ssh[1], repo: ssh[2] };
@@ -3187,6 +3236,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     theirsDir,
     manifest
   });
+  const orphanRatchet = checkOrphanRatchet(plan.orphaned.length, readOrphanBaseline(options.cwd));
   const heading = options.apply ? "Biffo core upgrade" : "Biffo core upgrade (dry run)";
   console.log(chalk4.bold(`
   ${heading}
@@ -3195,6 +3245,12 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   console.log(`  merge base:      ${fromVersion}`);
   console.log(`  target:          ${toVersion}
 `);
+  printOrphanReport(plan.orphaned, orphanRatchet);
+  if (orphanRatchet.increased) {
+    throw new Error(
+      `${String(plan.orphaned.length)} unsanctioned instance file(s) under a template-owned path (baseline ${String(orphanRatchet.baseline)}) \u2014 see the list above (#1026). Move new instance-written files under a sanctioned carve-out (services/api/tests/instance/, modules/**/instance/) or otherwise reduce the count, then re-run.`
+    );
+  }
   const migrations = planMigrationCarry({
     templateDir: theirsDir,
     instanceDir: options.cwd,
@@ -3250,10 +3306,11 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     toVersion,
     breaking,
     theirsDir,
-    coreVersionCleanup
+    coreVersionCleanup,
+    orphanRatchet
   );
 }
-async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup) {
+async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet) {
   if (breaking.length > 0 && !options.acknowledgeBreaking) {
     throw new Error(
       `This upgrade crosses ${breaking.length} documented breaking change(s): ${breaking.map((b) => b.version).join(", ")}. They are printed above and in ${UPGRADE_GUIDE_PATH}. Read what each one requires \u2014 some destroy data or need manual work after the deploy \u2014 then re-run with --acknowledge-breaking.`
@@ -3284,6 +3341,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
       breaking,
       theirsDir,
       coreVersionCleanup,
+      orphanRatchet,
       branch,
       token
     );
@@ -3306,11 +3364,18 @@ async function restoreCallerBranch(git, cwd, callerBranch, upgradeBranch) {
     );
   }
 }
-async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, branch, token) {
+async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet, branch, token) {
   const { git } = deps;
   const applied = applyUpgradePlan(options.cwd, plan, theirsDir);
   const carried = applyMigrationCarry(options.cwd, migrations);
   writeInstanceCoreVersion(options.cwd, toVersion);
+  const establishedOrphanBaseline = orphanRatchet.baseline === null;
+  if (establishedOrphanBaseline) {
+    writeOrphanBaseline(options.cwd, orphanRatchet.count);
+    log.info(
+      `Recorded ${ORPHAN_BASELINE_FILE} with a baseline of ${String(orphanRatchet.count)} unsanctioned instance file(s) under template-owned paths. Future upgrades fail only if this count increases (#1026).`
+    );
+  }
   const cleanedCoreVersion = coreVersionCleanup?.action === "delete";
   if (cleanedCoreVersion && existsSync11(coreVersionCleanup.path)) {
     rmSync5(coreVersionCleanup.path);
@@ -3574,6 +3639,35 @@ function printCoreVersionCleanup(cleanup, applying) {
   const why = cleanup.reason === "repurposed" ? `does not match biffo.core.json \u2014 looks repurposed, keeping ${CORE_VERSION_FILE}` : `biffo.core.json absent or unparseable \u2014 no authority to check, keeping ${CORE_VERSION_FILE}`;
   console.log(`  ${chalk4.dim("cleanup".padEnd(15))} ${chalk4.dim(`${cleanup.found}: ${why}`)}`);
 }
+function printOrphanReport(orphaned, ratchet) {
+  if (orphaned.length === 0 && ratchet.baseline === null) return;
+  console.log(
+    chalk4.bold(
+      `  ${String(orphaned.length)} unsanctioned instance file(s) under a template-owned path (#1026):`
+    )
+  );
+  for (const e of orphaned) console.log(`    ${chalk4.yellow(e.path)}`);
+  if (ratchet.baseline === null) {
+    console.log(
+      chalk4.dim(
+        `  No ${ORPHAN_BASELINE_FILE} yet \u2014 an --apply run will record ${String(ratchet.count)} as the baseline.`
+      )
+    );
+  } else if (ratchet.increased) {
+    console.log(
+      chalk4.red(
+        `  Baseline is ${String(ratchet.baseline)} \u2014 this run found ${String(ratchet.count)}, an increase.`
+      )
+    );
+  } else {
+    console.log(
+      chalk4.dim(
+        `  Baseline is ${String(ratchet.baseline)} \u2014 no increase (${String(ratchet.count)} now).`
+      )
+    );
+  }
+  console.log();
+}
 function printPlan(plan) {
   const ordered = [...plan.conflicts, ...plan.changes.filter((c) => !c.conflicted)];
   for (const e of ordered) {
@@ -4026,62 +4120,62 @@ var AwsAdapter = class {
 };
 
 // src/config/schema.ts
-import { z as z4 } from "zod";
-var AwsConfigSchema = z4.object({
-  account_id: z4.string().regex(/^\d{12}$/, "AWS account ID must be 12 digits").describe("12-digit AWS account ID"),
-  region: z4.string().default("us-east-1"),
-  profile: z4.string().optional(),
-  oidc_role_arn: z4.string().regex(/^arn:aws:iam::\d{12}:role\/.+/, "Must be a valid IAM role ARN").optional(),
-  tf_state_bucket: z4.string().optional()
+import { z as z5 } from "zod";
+var AwsConfigSchema = z5.object({
+  account_id: z5.string().regex(/^\d{12}$/, "AWS account ID must be 12 digits").describe("12-digit AWS account ID"),
+  region: z5.string().default("us-east-1"),
+  profile: z5.string().optional(),
+  oidc_role_arn: z5.string().regex(/^arn:aws:iam::\d{12}:role\/.+/, "Must be a valid IAM role ARN").optional(),
+  tf_state_bucket: z5.string().optional()
 });
-var GitHubConfigSchema = z4.object({
-  org: z4.string().min(1).describe("GitHub organisation or username"),
-  repo: z4.string().min(1).describe("Repository name (will be created)")
+var GitHubConfigSchema = z5.object({
+  org: z5.string().min(1).describe("GitHub organisation or username"),
+  repo: z5.string().min(1).describe("Repository name (will be created)")
 });
-var SourceControlConfigSchema = z4.discriminatedUnion("provider", [
-  z4.object({ provider: z4.literal("github"), config: GitHubConfigSchema })
+var SourceControlConfigSchema = z5.discriminatedUnion("provider", [
+  z5.object({ provider: z5.literal("github"), config: GitHubConfigSchema })
 ]);
-var CloudConfigSchema = z4.discriminatedUnion("provider", [
-  z4.object({ provider: z4.literal("aws"), config: AwsConfigSchema })
+var CloudConfigSchema = z5.discriminatedUnion("provider", [
+  z5.object({ provider: z5.literal("aws"), config: AwsConfigSchema })
 ]);
-var ModulesSchema = z4.object({
-  auth: z4.enum(["cognito"]).default("cognito"),
-  events: z4.enum(["eventbridge"]).default("eventbridge"),
-  storage: z4.enum(["s3"]).default("s3"),
-  database: z4.enum(["postgresql"]).default("postgresql"),
-  compute: z4.enum(["lambda"]).default("lambda"),
-  cdn: z4.enum(["cloudfront"]).default("cloudfront")
+var ModulesSchema = z5.object({
+  auth: z5.enum(["cognito"]).default("cognito"),
+  events: z5.enum(["eventbridge"]).default("eventbridge"),
+  storage: z5.enum(["s3"]).default("s3"),
+  database: z5.enum(["postgresql"]).default("postgresql"),
+  compute: z5.enum(["lambda"]).default("lambda"),
+  cdn: z5.enum(["cloudfront"]).default("cloudfront")
 });
-var DnsSchema = z4.object({
-  mode: z4.enum(["managed-route53", "external", "none"]).default("managed-route53"),
-  domain: z4.string().min(1).optional()
+var DnsSchema = z5.object({
+  mode: z5.enum(["managed-route53", "external", "none"]).default("managed-route53"),
+  domain: z5.string().min(1).optional()
 });
-var BiffoConfigSchema = z4.object({
-  $schema: z4.string().optional(),
-  project: z4.object({
-    name: z4.string().min(1).regex(/^[a-z0-9-]+$/, "Must be lowercase kebab-case"),
-    description: z4.string().default(""),
+var BiffoConfigSchema = z5.object({
+  $schema: z5.string().optional(),
+  project: z5.object({
+    name: z5.string().min(1).regex(/^[a-z0-9-]+$/, "Must be lowercase kebab-case"),
+    description: z5.string().default(""),
     // Backward compatibility for existing configs. New configs should use dns.domain.
-    domain: z4.string().min(1).optional().describe("Primary domain, e.g. myapp.com")
+    domain: z5.string().min(1).optional().describe("Primary domain, e.g. myapp.com")
   }),
   dns: DnsSchema.optional(),
   source_control: SourceControlConfigSchema,
   cloud: CloudConfigSchema,
-  environments: z4.array(z4.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
-  admin: z4.object({
-    email: z4.string().email(),
-    username: z4.string().min(1)
+  environments: z5.array(z5.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
+  admin: z5.object({
+    email: z5.string().email(),
+    username: z5.string().min(1)
   }),
-  database: z4.object({
-    schema_path: z4.string().nullable().default(null),
-    migrations_path: z4.string().default("services/api/migrations")
+  database: z5.object({
+    schema_path: z5.string().nullable().default(null),
+    migrations_path: z5.string().default("services/api/migrations")
   }).default({}),
   modules: ModulesSchema.default({})
 }).superRefine((config, ctx) => {
   const dns = resolveDnsConfig(config);
   if (dns.mode !== "none" && !dns.domain) {
     ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
+      code: z5.ZodIssueCode.custom,
       path: ["dns", "domain"],
       message: 'DNS domain is required unless dns.mode is "none"'
     });
@@ -5797,15 +5891,15 @@ async function resolveRepoIds(github, config) {
 }
 
 // src/config/sibling-schema.ts
-import { z as z5 } from "zod";
-var SiblingConfigSchema = z5.object({
-  $schema: z5.string().optional(),
-  project: z5.object({
-    name: z5.string().min(1).regex(
+import { z as z6 } from "zod";
+var SiblingConfigSchema = z6.object({
+  $schema: z6.string().optional(),
+  project: z6.object({
+    name: z6.string().min(1).regex(
       /^[a-z][a-z0-9-]*$/,
       "Must be lowercase kebab-case, starting with a letter (it becomes a URL path segment)"
     ),
-    description: z5.string().default(""),
+    description: z6.string().default(""),
     // Notable routes this sibling exposes, shown as labelled links on the
     // core project's Microservices tab (ADR-0007). Each `path` is relative to
     // the sibling's own path_prefix (so "demo" renders as /<prefix>/demo), and
@@ -5813,26 +5907,26 @@ var SiblingConfigSchema = z5.object({
     // routes just shows its single root link. Declare real routes here as you
     // build the sibling's pages; the values flow to the core's
     // siblings.auto.tfvars.json at registration and into siblings.json at deploy.
-    routes: z5.array(
-      z5.object({
-        path: z5.string().min(1).regex(
+    routes: z6.array(
+      z6.object({
+        path: z6.string().min(1).regex(
           /^[a-z0-9][a-z0-9/-]*$/,
           'Sub-path relative to the sibling prefix, no leading slash (e.g. "demo" or "apply")'
         ),
-        label: z5.string().min(1)
+        label: z6.string().min(1)
       })
     ).default([])
   }),
   source_control: SourceControlConfigSchema,
   cloud: CloudConfigSchema,
-  environments: z5.array(z5.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
+  environments: z6.array(z6.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
   // The core project this sibling is paired with (ADR-0007) — never
   // provisions its own Cognito pool or CloudFront distribution, always
   // plugs into the core project's.
-  core: z5.object({
+  core: z6.object({
     // Exactly one of these two must be set — see the superRefine below.
-    project_name: z5.string().min(1).optional().describe("Name of a project previously scaffolded with `biffo init` on this machine"),
-    config_path: z5.string().min(1).optional().describe(
+    project_name: z6.string().min(1).optional().describe("Name of a project previously scaffolded with `biffo init` on this machine"),
+    config_path: z6.string().min(1).optional().describe(
       "Path to the core project's biffo.config.json, for when it wasn't scaffolded here"
     ),
     // Defaults to project.name at parse time by the caller (sibling-create.ts),
@@ -5845,7 +5939,7 @@ var SiblingConfigSchema = z5.object({
     // CDN's default_cache_behavior instead of a pair of ordered behaviours.
     // It still registers under a non-empty reserved name ("app") — see
     // lib/root-sibling.ts for why the two must not be conflated.
-    path_prefix: z5.string().regex(
+    path_prefix: z6.string().regex(
       /^$|^[a-z][a-z0-9-]*$/,
       "Must be lowercase kebab-case, or empty for the root sibling"
     ).optional()
@@ -5853,7 +5947,7 @@ var SiblingConfigSchema = z5.object({
 }).superRefine((config, ctx) => {
   if (!config.core.project_name && !config.core.config_path) {
     ctx.addIssue({
-      code: z5.ZodIssueCode.custom,
+      code: z6.ZodIssueCode.custom,
       path: ["core"],
       message: "Either core.project_name or core.config_path is required"
     });
@@ -7055,46 +7149,46 @@ function findInstalledPlugins(cwd) {
 }
 
 // src/lib/plugin-manifest.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["id", "tenant_id", "created_at", "updated_at"]);
 var COLUMN_TYPE_PATTERN = /^(String|Integer|Text|Boolean|Float|DateTime)(\(.*\))?$/;
-var ColumnDefinitionSchema = z6.object({
-  name: z6.string().refine(
+var ColumnDefinitionSchema = z7.object({
+  name: z7.string().refine(
     (n) => !RESERVED_COLUMN_NAMES.has(n),
     (n) => ({
       message: `Column '${n}' is reserved and added automatically; it must not be declared in the manifest.`
     })
   ),
-  type: z6.string().regex(
+  type: z7.string().regex(
     COLUMN_TYPE_PATTERN,
     "must be one of String, Integer, Text, Boolean, Float, DateTime (e.g. 'String(255)')"
   ),
-  primary_key: z6.boolean().default(false),
-  nullable: z6.boolean().default(false),
-  index: z6.boolean().default(false),
-  default: z6.string().optional(),
-  description: z6.string().default("")
+  primary_key: z7.boolean().default(false),
+  nullable: z7.boolean().default(false),
+  index: z7.boolean().default(false),
+  default: z7.string().optional(),
+  description: z7.string().default("")
 });
-var IndexDefinitionSchema = z6.object({
-  name: z6.string(),
-  columns: z6.array(z6.string()).min(1),
-  unique: z6.boolean().default(false)
+var IndexDefinitionSchema = z7.object({
+  name: z7.string(),
+  columns: z7.array(z7.string()).min(1),
+  unique: z7.boolean().default(false)
 });
-var PermissionRuleSchema = z6.object({
-  allowed: z6.boolean().default(false),
-  required_role: z6.array(z6.string()).default([])
+var PermissionRuleSchema = z7.object({
+  allowed: z7.boolean().default(false),
+  required_role: z7.array(z7.string()).default([])
 }).strict();
-var TablePermissionsSchema = z6.object({
+var TablePermissionsSchema = z7.object({
   list: PermissionRuleSchema.default({}),
   read: PermissionRuleSchema.default({}),
   create: PermissionRuleSchema.default({}),
   update: PermissionRuleSchema.default({}),
   delete: PermissionRuleSchema.default({})
 }).strict();
-var TableDefinitionSchema = z6.object({
-  name: z6.string().regex(/^[a-z][a-z0-9_]*$/, "table name must be snake_case, e.g. rbac_roles"),
-  columns: z6.array(ColumnDefinitionSchema).default([]),
-  indexes: z6.array(IndexDefinitionSchema).default([]),
+var TableDefinitionSchema = z7.object({
+  name: z7.string().regex(/^[a-z][a-z0-9_]*$/, "table name must be snake_case, e.g. rbac_roles"),
+  columns: z7.array(ColumnDefinitionSchema).default([]),
+  indexes: z7.array(IndexDefinitionSchema).default([]),
   permissions: TablePermissionsSchema.default({})
 }).superRefine((table, ctx) => {
   const colCounts = /* @__PURE__ */ new Map();
@@ -7102,7 +7196,7 @@ var TableDefinitionSchema = z6.object({
   for (const [name, count] of colCounts) {
     if (count > 1) {
       ctx.addIssue({
-        code: z6.ZodIssueCode.custom,
+        code: z7.ZodIssueCode.custom,
         message: `Duplicate column name '${name}' in table '${table.name}'`
       });
     }
@@ -7112,7 +7206,7 @@ var TableDefinitionSchema = z6.object({
   for (const [name, count] of idxCounts) {
     if (count > 1) {
       ctx.addIssue({
-        code: z6.ZodIssueCode.custom,
+        code: z7.ZodIssueCode.custom,
         message: `Duplicate index name '${name}' in table '${table.name}'`
       });
     }
@@ -7122,7 +7216,7 @@ var TableDefinitionSchema = z6.object({
     for (const col of idx.columns) {
       if (!validColumns.has(col)) {
         ctx.addIssue({
-          code: z6.ZodIssueCode.custom,
+          code: z7.ZodIssueCode.custom,
           message: `Index '${idx.name}' on table '${table.name}' references unknown column '${col}'`
         });
       }
@@ -7137,17 +7231,17 @@ var OPERATION_METHODS = {
   delete: /* @__PURE__ */ new Set(["DELETE"])
 };
 var SINGLE_ROW_OPERATIONS = /* @__PURE__ */ new Set(["read", "update", "delete"]);
-var RouteDefSchema = z6.object({
-  method: z6.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
-  path: z6.string().startsWith("/", "path must start with '/'"),
-  table: z6.string(),
-  operation: z6.enum(["list", "read", "create", "update", "delete"]),
-  description: z6.string().default("")
+var RouteDefSchema = z7.object({
+  method: z7.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
+  path: z7.string().startsWith("/", "path must start with '/'"),
+  table: z7.string(),
+  operation: z7.enum(["list", "read", "create", "update", "delete"]),
+  description: z7.string().default("")
 }).superRefine((route, ctx) => {
   const allowed = OPERATION_METHODS[route.operation];
   if (allowed && !allowed.has(route.method)) {
     ctx.addIssue({
-      code: z6.ZodIssueCode.custom,
+      code: z7.ZodIssueCode.custom,
       message: `operation '${route.operation}' requires method in [${[...allowed].sort().join(", ")}], got '${route.method}'`
     });
   }
@@ -7155,13 +7249,13 @@ var RouteDefSchema = z6.object({
   const needsId = SINGLE_ROW_OPERATIONS.has(route.operation);
   if (needsId && !hasId) {
     ctx.addIssue({
-      code: z6.ZodIssueCode.custom,
+      code: z7.ZodIssueCode.custom,
       message: `operation '${route.operation}' addresses a single row and requires an '{id}' path parameter: ${route.path}`
     });
   }
   if (!needsId && hasId) {
     ctx.addIssue({
-      code: z6.ZodIssueCode.custom,
+      code: z7.ZodIssueCode.custom,
       message: `operation '${route.operation}' is collection-level and must not have an '{id}' path parameter: ${route.path}`
     });
   }
@@ -7169,47 +7263,47 @@ var RouteDefSchema = z6.object({
 var REL_DIR = /^[\w][\w./-]*$/;
 var NON_EMPTY_GROUP = "required_group must be a non-empty Cognito group name.";
 var APP_REF = /^[a-zA-Z_]\w*(\.[a-zA-Z_]\w*)*:[a-zA-Z_]\w*$/;
-var UserIngressSchema = z6.object({
-  required_group: z6.string().min(1, NON_EMPTY_GROUP),
-  app: z6.string().regex(APP_REF, "must be an ASGI app reference '<module>:<attr>', e.g. 'ideation.app:app'")
+var UserIngressSchema = z7.object({
+  required_group: z7.string().min(1, NON_EMPTY_GROUP),
+  app: z7.string().regex(APP_REF, "must be an ASGI app reference '<module>:<attr>', e.g. 'ideation.app:app'")
 }).strict();
-var UserFrontendSchema = z6.object({
-  dir: z6.string().regex(
+var UserFrontendSchema = z7.object({
+  dir: z7.string().regex(
     REL_DIR,
     "must be a repo-relative path with no leading slash or traversal, e.g. web/dist"
   ),
-  required_group: z6.string().min(1, NON_EMPTY_GROUP)
+  required_group: z7.string().min(1, NON_EMPTY_GROUP)
 }).strict();
-var ToolDeclarationSchema = z6.object({
-  name: z6.string(),
-  description: z6.string(),
-  parameters: z6.record(z6.string(), z6.unknown()).default({})
+var ToolDeclarationSchema = z7.object({
+  name: z7.string(),
+  description: z7.string(),
+  parameters: z7.record(z7.string(), z7.unknown()).default({})
 });
-var ChatAgentDeclarationSchema = z6.object({
-  key: z6.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
-  agent_name: z6.string().optional(),
-  system_prompt: z6.string().min(1),
-  model: z6.string().min(1),
-  required_group: z6.string().min(1),
-  max_history_messages: z6.number().int().positive().default(40),
-  max_output_tokens: z6.number().int().positive().default(1024),
-  timeout_seconds: z6.number().positive().default(20)
+var ChatAgentDeclarationSchema = z7.object({
+  key: z7.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
+  agent_name: z7.string().optional(),
+  system_prompt: z7.string().min(1),
+  model: z7.string().min(1),
+  required_group: z7.string().min(1),
+  max_history_messages: z7.number().int().positive().default(40),
+  max_output_tokens: z7.number().int().positive().default(1024),
+  timeout_seconds: z7.number().positive().default(20)
 }).strict();
-var PluginManifestSchema = z6.object({
-  name: z6.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
-  version: z6.string().regex(/^\d+\.\d+\.\d+$/, "must be a full semver, e.g. 1.2.3"),
-  description: z6.string().default(""),
-  author: z6.string().default("Biffo Team"),
-  tags: z6.array(z6.string()).default([]),
-  tables: z6.array(TableDefinitionSchema).default([]),
-  api_routes: z6.array(RouteDefSchema).default([]),
+var PluginManifestSchema = z7.object({
+  name: z7.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
+  version: z7.string().regex(/^\d+\.\d+\.\d+$/, "must be a full semver, e.g. 1.2.3"),
+  description: z7.string().default(""),
+  author: z7.string().default("Biffo Team"),
+  tags: z7.array(z7.string()).default([]),
+  tables: z7.array(TableDefinitionSchema).default([]),
+  api_routes: z7.array(RouteDefSchema).default([]),
   // Events the plugin reacts to. Parsed (rather than dropped as an unknown
   // key) so `biffo plugin install` can warn when a plugin declares
   // subscriptions but ships no terraform/ to route them — see #194 and
   // lib/plugin-terraform-guard.ts. Kept loose deliberately: the authoritative
   // schema is the registry's, and this consumer only needs to count them.
-  event_subscriptions: z6.array(z6.object({ source: z6.string(), detail_type: z6.string() }).passthrough()).default([]),
-  required_core_version: z6.string().default(">=0.0.0"),
+  event_subscriptions: z7.array(z7.object({ source: z7.string(), detail_type: z7.string() }).passthrough()).default([]),
+  required_core_version: z7.string().default(">=0.0.0"),
   // ADR-0018 user-facing surfaces. Optional: a plugin without them is an
   // ordinary (data/event/CRUD) plugin.
   user_ingress: UserIngressSchema.optional(),
@@ -7220,16 +7314,16 @@ var PluginManifestSchema = z6.object({
   // object and get silently dropped) is the fix for the parity gap: before
   // this, a manifest declaring `tools` validated with no error and lost the
   // field entirely.
-  tools: z6.array(ToolDeclarationSchema).default([]),
+  tools: z7.array(ToolDeclarationSchema).default([]),
   // Chat agents the plugin registers with Core (ADR-0017). Default empty — an
   // ordinary plugin declares none.
-  chat_agents: z6.array(ChatAgentDeclarationSchema).default([])
+  chat_agents: z7.array(ChatAgentDeclarationSchema).default([])
 }).superRefine((manifest, ctx) => {
   const tableNames = new Set(manifest.tables.map((t) => t.name));
   for (const route of manifest.api_routes) {
     if (!tableNames.has(route.table)) {
       ctx.addIssue({
-        code: z6.ZodIssueCode.custom,
+        code: z7.ZodIssueCode.custom,
         message: `Route ${route.method} ${route.path} references table '${route.table}', which is not declared in this manifest's 'tables' (${[...tableNames].sort().join(", ") || "none"})`
       });
     }
@@ -7724,25 +7818,25 @@ import chalk14 from "chalk";
 import { Command as Command14 } from "commander";
 
 // src/adapters/registry/index.ts
-import { z as z7 } from "zod";
-var RegistryPluginEntrySchema = z7.object({
-  name: z7.string().regex(/^[a-z][a-z0-9-]*$/),
-  version: z7.string().regex(/^\d+\.\d+\.\d+$/),
-  minor_version: z7.string().regex(/^\d+\.\d+$/),
-  repo: z7.string().url(),
-  description: z7.string().optional(),
-  author: z7.string().optional(),
-  tags: z7.array(z7.string()).optional(),
-  required_core_version: z7.string().optional(),
-  infra_modules: z7.array(z7.string()).optional(),
-  api_routes: z7.array(z7.string()).optional(),
-  ui_components: z7.array(z7.string()).optional(),
-  status: z7.enum(["active", "disabled"])
+import { z as z8 } from "zod";
+var RegistryPluginEntrySchema = z8.object({
+  name: z8.string().regex(/^[a-z][a-z0-9-]*$/),
+  version: z8.string().regex(/^\d+\.\d+\.\d+$/),
+  minor_version: z8.string().regex(/^\d+\.\d+$/),
+  repo: z8.string().url(),
+  description: z8.string().optional(),
+  author: z8.string().optional(),
+  tags: z8.array(z8.string()).optional(),
+  required_core_version: z8.string().optional(),
+  infra_modules: z8.array(z8.string()).optional(),
+  api_routes: z8.array(z8.string()).optional(),
+  ui_components: z8.array(z8.string()).optional(),
+  status: z8.enum(["active", "disabled"])
 });
-var PluginRegistrySchema = z7.object({
-  schema_version: z7.string(),
-  last_updated: z7.string(),
-  plugins: z7.array(RegistryPluginEntrySchema)
+var PluginRegistrySchema = z8.object({
+  schema_version: z8.string(),
+  last_updated: z8.string(),
+  plugins: z8.array(RegistryPluginEntrySchema)
 });
 var DEFAULT_REGISTRY_URL = "https://raw.githubusercontent.com/keiranholloway/biffo-plugins-registry/main/plugins.json";
 var RegistryAdapter = class {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.209.2",
+  "version": "0.210.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",