@biffo/cli 0.231.0 → 0.231.2

package/dist/index.js

@@ -570,8 +570,8 @@ async function runCoreStatus(options) {
 
 // src/commands/core-upgrade.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync11, rmSync as rmSync5 } from "fs";
-import { join as join12, resolve as resolve3 } from "path";
+import { existsSync as existsSync12, rmSync as rmSync5 } from "fs";
+import { join as join13, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
 import { execa as execa3 } from "execa";
 import { Command as Command3 } from "commander";
@@ -2774,9 +2774,48 @@ function materializeTemplateAtTag(repo, version, git = defaultGit2) {
   return { dir, cleanup: () => rmSync3(dir, { recursive: true, force: true }) };
 }
 
-// src/lib/breaking-changes.ts
+// src/lib/instance-seams.ts
 import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 import { join as join9 } from "path";
+var INSTANCE_SEAM_PREFIX = "@/instance-";
+function readSeams(templateDir, portalRelDir) {
+  const seams = /* @__PURE__ */ new Map();
+  const tsconfigPath = join9(templateDir, portalRelDir, "tsconfig.json");
+  if (!existsSync8(tsconfigPath)) return seams;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync6(tsconfigPath, "utf8"));
+  } catch {
+    return seams;
+  }
+  for (const [specifier, targets] of Object.entries(parsed.compilerOptions?.paths ?? {})) {
+    if (!specifier.startsWith(INSTANCE_SEAM_PREFIX)) continue;
+    const target = targets[0];
+    if (target === void 0) continue;
+    const name = specifier.slice("@/".length);
+    seams.set(specifier, {
+      specifier,
+      instanceFile: `${portalRelDir}/src/${name}.ts`,
+      defaultFile: `${portalRelDir}/${target.replace(/^\.\//, "")}`
+    });
+  }
+  return seams;
+}
+function findNewUndeclaredSeams(baseDir, theirsDir, oursDir, portalRelDir = "apps/portal") {
+  const baseSeams = readSeams(baseDir, portalRelDir);
+  const theirsSeams = readSeams(theirsDir, portalRelDir);
+  const undeclared = [];
+  for (const [specifier, seam] of theirsSeams) {
+    if (baseSeams.has(specifier)) continue;
+    if (existsSync8(join9(oursDir, seam.instanceFile))) continue;
+    undeclared.push(seam);
+  }
+  return undeclared.sort((a, b) => a.specifier.localeCompare(b.specifier));
+}
+
+// src/lib/breaking-changes.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join10 } from "path";
 var UPGRADE_GUIDE_PATH = "docs/guides/core-upgrade.md";
 var SECTION_HEADING = "## Breaking changes by version";
 var ENTRY_HEADING = /^###\s+(\d+\.\d+\.\d+)\s*[—-]\s*(.+?)\s*$/;
@@ -2801,9 +2840,9 @@ function parseBreakingChanges(guide) {
   return entries;
 }
 function readBreakingChanges(templateRoot) {
-  const path = join9(templateRoot, UPGRADE_GUIDE_PATH);
-  if (!existsSync8(path)) return [];
-  return parseBreakingChanges(readFileSync6(path, "utf8"));
+  const path = join10(templateRoot, UPGRADE_GUIDE_PATH);
+  if (!existsSync9(path)) return [];
+  return parseBreakingChanges(readFileSync7(path, "utf8"));
 }
 function breakingChangesBetween(from, to, entries) {
   parseCoreVersion(from);
@@ -2820,8 +2859,8 @@ var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
 ];
 
 // src/lib/plugin-terraform-wiring.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync7, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11 } from "path";
 var TEMPLATE_MODULE_DIR = "_template";
 var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
 var GENERATED_TF_FILE = "plugins.generated.tf";
@@ -2846,7 +2885,7 @@ function standardArguments(pluginName, handler) {
   ];
 }
 function listPluginModules(cwd) {
-  const dir = join10(cwd, "modules", "plugins");
+  const dir = join11(cwd, "modules", "plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -2858,7 +2897,7 @@ function listPluginModules(cwd) {
 var FIRST_PARTY_TERRAFORM = (name) => `../../../services/_plugins/${name}/terraform`;
 var THIRD_PARTY_TERRAFORM = (name) => `../../../modules/plugins/${name}`;
 function isFirstPartyPlugin(cwd, name) {
-  return existsSync9(join10(cwd, "services", "_plugins", name, "terraform", "main.tf"));
+  return existsSync10(join11(cwd, "services", "_plugins", name, "terraform", "main.tf"));
 }
 function pluginModuleSource(cwd, name) {
   return isFirstPartyPlugin(cwd, name) ? FIRST_PARTY_TERRAFORM(name) : THIRD_PARTY_TERRAFORM(name);
@@ -2867,7 +2906,7 @@ function listWireablePlugins(cwd) {
   return listPluginModules(cwd).filter((name) => !isFirstPartyPlugin(cwd, name)).sort();
 }
 function firstPartyPluginNames(cwd) {
-  const dir = join10(cwd, "services", "_plugins");
+  const dir = join11(cwd, "services", "_plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -2881,7 +2920,7 @@ function staleFirstPartyCopies(cwd) {
   return firstPartyPluginNames(cwd).filter((name) => copied.has(name));
 }
 function listEnvironments(cwd) {
-  const dir = join10(cwd, "infra", "environments");
+  const dir = join11(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -2889,12 +2928,12 @@ function listEnvironments(cwd) {
     return [];
   }
   return entries.filter((e) => {
-    if (!e.isDirectory() || !existsSync9(join10(dir, e.name, "main.tf"))) return false;
-    return declaredVariables(join10(dir, e.name)).has("enabled_plugins");
+    if (!e.isDirectory() || !existsSync10(join11(dir, e.name, "main.tf"))) return false;
+    return declaredVariables(join11(dir, e.name)).has("enabled_plugins");
   }).map((e) => e.name).sort();
 }
 function listUnwirableEnvironments(cwd) {
-  const dir = join10(cwd, "infra", "environments");
+  const dir = join11(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -2902,7 +2941,7 @@ function listUnwirableEnvironments(cwd) {
     return [];
   }
   return entries.filter(
-    (e) => e.isDirectory() && existsSync9(join10(dir, e.name, "main.tf")) && !declaredVariables(join10(dir, e.name)).has("enabled_plugins")
+    (e) => e.isDirectory() && existsSync10(join11(dir, e.name, "main.tf")) && !declaredVariables(join11(dir, e.name)).has("enabled_plugins")
   ).map((e) => e.name).sort();
 }
 function declaredVariables(moduleDir) {
@@ -2917,7 +2956,7 @@ function declaredVariables(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync7(join10(moduleDir, entry.name), "utf8");
+      contents = readFileSync8(join11(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -2939,7 +2978,7 @@ function declaredOutputs(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync7(join10(moduleDir, entry.name), "utf8");
+      contents = readFileSync8(join11(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -3021,7 +3060,7 @@ function syncPluginTerraform(cwd) {
   const skippedEnvironments = listUnwirableEnvironments(cwd);
   const changedPaths = [];
   const rendered = plugins.map((name) => {
-    const moduleDir = join10(cwd, "modules", "plugins", name);
+    const moduleDir = join11(cwd, "modules", "plugins", name);
     return {
       name,
       declaredVariables: declaredVariables(moduleDir),
@@ -3030,16 +3069,16 @@ function syncPluginTerraform(cwd) {
     };
   });
   for (const env of environments) {
-    const envDir = join10(cwd, "infra", "environments", env);
-    const tfPath = join10(envDir, GENERATED_TF_FILE);
-    const tfvarsPath = join10(envDir, GENERATED_TFVARS_FILE);
+    const envDir = join11(cwd, "infra", "environments", env);
+    const tfPath = join11(envDir, GENERATED_TF_FILE);
+    const tfvarsPath = join11(envDir, GENERATED_TFVARS_FILE);
     const relBase = `infra/environments/${env}`;
     if (plugins.length === 0) {
       for (const [abs, rel] of [
         [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
         [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
       ]) {
-        if (existsSync9(abs)) {
+        if (existsSync10(abs)) {
           rmSync4(abs);
           changedPaths.push(rel);
         }
@@ -3055,8 +3094,8 @@ function syncPluginTerraform(cwd) {
 }
 
 // src/lib/lockfile-refresh.ts
-import { existsSync as existsSync10 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join12 } from "path";
 var LOCKFILE_TRIGGERS = [
   {
     manifest: "package.json",
@@ -3079,7 +3118,7 @@ function lockfilesNeedingRefresh(changedPaths, instanceDir, triggers = LOCKFILE_
   const locked = changedPaths.filter((p) => !isForeignManifest(p));
   return triggers.filter((t) => {
     const touched = locked.some((p) => p === t.manifest || p.endsWith(`/${t.manifest}`));
-    return touched && existsSync10(join11(instanceDir, t.lockfile));
+    return touched && existsSync11(join12(instanceDir, t.lockfile));
   });
 }
 async function refreshLockfiles(instanceDir, triggers, run) {
@@ -3288,6 +3327,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     manifest
   });
   const orphanRatchet = checkOrphanRatchet(plan.orphaned.length, readOrphanBaseline(options.cwd));
+  const newSeams = findNewUndeclaredSeams(baseDir, theirsDir, options.cwd);
   const heading = options.apply ? "Biffo core upgrade" : "Biffo core upgrade (dry run)";
   console.log(chalk4.bold(`
   ${heading}
@@ -3296,6 +3336,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   console.log(`  merge base:      ${fromVersion}`);
   console.log(`  target:          ${toVersion}
 `);
+  printNewInstanceSeams(newSeams);
   printOrphanReport(plan.orphaned, orphanRatchet);
   if (orphanRatchet.increased) {
     throw new Error(
@@ -3358,10 +3399,11 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     breaking,
     theirsDir,
     coreVersionCleanup,
-    orphanRatchet
+    orphanRatchet,
+    newSeams
   );
 }
-async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet) {
+async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet, newSeams) {
   if (breaking.length > 0 && !options.acknowledgeBreaking) {
     throw new Error(
       `This upgrade crosses ${breaking.length} documented breaking change(s): ${breaking.map((b) => b.version).join(", ")}. They are printed above and in ${UPGRADE_GUIDE_PATH}. Read what each one requires \u2014 some destroy data or need manual work after the deploy \u2014 then re-run with --acknowledge-breaking.`
@@ -3393,6 +3435,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
       theirsDir,
       coreVersionCleanup,
       orphanRatchet,
+      newSeams,
       branch,
       token
     );
@@ -3427,7 +3470,7 @@ async function restoreCallerBranch(git, cwd, callerBranch, upgradeBranch) {
     );
   }
 }
-async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet, branch, token) {
+async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet, newSeams, branch, token) {
   const { git } = deps;
   const applied = applyUpgradePlan(options.cwd, plan, theirsDir);
   const carried = applyMigrationCarry(options.cwd, migrations);
@@ -3440,7 +3483,7 @@ async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion
     );
   }
   const cleanedCoreVersion = coreVersionCleanup?.action === "delete";
-  if (cleanedCoreVersion && existsSync11(coreVersionCleanup.path)) {
+  if (cleanedCoreVersion && existsSync12(coreVersionCleanup.path)) {
     rmSync5(coreVersionCleanup.path);
     log.info(
       coreVersionCleanup.stale ? `Deleted stale ${CORE_VERSION_FILE} (recorded ${coreVersionCleanup.found}, behind the version biffo.core.json records \u2014 this instance has moved past it) (#842).` : `Deleted orphaned ${CORE_VERSION_FILE} (inherited copy recording ${coreVersionCleanup.found}, superseded by biffo.core.json) \u2014 nothing reads it as an authority (#434).`
@@ -3479,7 +3522,8 @@ async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion
       lockfiles,
       breaking,
       cleanedCoreVersion ? coreVersionCleanup : null,
-      carriedPrs
+      carriedPrs,
+      newSeams
     )
   });
   if (plan.conflicts.length > 0) {
@@ -3535,7 +3579,7 @@ function carriedPrNumbers(subjects) {
   }
   return [...new Set(numbers)].sort((a, b) => a - b);
 }
-function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, lockfiles = [], breaking = [], coreVersionCleanup = null, carriedPrs = []) {
+function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, lockfiles = [], breaking = [], coreVersionCleanup = null, carriedPrs = [], newSeams = []) {
   const lines = [];
   if (breaking.length > 0) {
     lines.push(
@@ -3548,6 +3592,25 @@ function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, loc
       ""
     );
   }
+  if (newSeams.length > 0) {
+    lines.push(
+      `## \u26A0 ${newSeams.length} new instance seam(s) \u2014 no declaration yet (#1188)`,
+      "",
+      "This upgrade introduces a new optional `@/instance-*` module the portal can resolve to an instance-owned override. **This instance has not declared one**, so until it does, it silently gets the template-owned generic default listed below \u2014 not necessarily the behaviour this instance actually wants.",
+      "",
+      ...newSeams.flatMap((s) => [
+        `### \`${s.specifier}\``,
+        "",
+        `- Add \`${s.instanceFile}\` to declare this instance's own behaviour.`,
+        `- Until then, this instance uses the template default: \`${s.defaultFile}\`.`,
+        ""
+      ]),
+      "The contract this module implements is part of THIS upgrade, so it does not exist yet anywhere the instance could have written the file in advance \u2014 add it as a follow-up commit on this PR, before merging, once the files above have landed on this branch.",
+      "",
+      "---",
+      ""
+    );
+  }
   lines.push(
     "Automated core upgrade generated by `biffo core upgrade` (ADR-0006).",
     "",
@@ -3723,6 +3786,21 @@ function printCoreVersionCleanup(cleanup, applying) {
   const why = cleanup.reason === "repurposed" ? `does not match biffo.core.json \u2014 looks repurposed, keeping ${CORE_VERSION_FILE}` : `biffo.core.json absent or unparseable \u2014 no authority to check, keeping ${CORE_VERSION_FILE}`;
   console.log(`  ${chalk4.dim("cleanup".padEnd(15))} ${chalk4.dim(`${cleanup.found}: ${why}`)}`);
 }
+function printNewInstanceSeams(seams) {
+  if (seams.length === 0) return;
+  console.log(
+    chalk4.red.bold(
+      `  \u26A0 ${String(seams.length)} new instance seam(s) introduced with no declaration (#1188):`
+    )
+  );
+  for (const s of seams) {
+    console.log(`    ${chalk4.bold(s.specifier)} \u2192 add ${chalk4.yellow(s.instanceFile)}`);
+    console.log(
+      chalk4.dim(`      Until then, this instance gets the template default: ${s.defaultFile}`)
+    );
+  }
+  console.log();
+}
 function printOrphanReport(orphaned, ratchet) {
   if (orphaned.length === 0 && ratchet.baseline === null) return;
   console.log(
@@ -3816,8 +3894,8 @@ function printBreakingChanges(breaking, applying) {
 }
 function versionOfCheckout(dir, explicit) {
   if (explicit) return explicit;
-  const file = join12(dir, CORE_VERSION_FILE);
-  if (existsSync11(file)) return readCoreVersionFile(file);
+  const file = join13(dir, CORE_VERSION_FILE);
+  if (existsSync12(file)) return readCoreVersionFile(file);
   throw new Error(
     `Cannot determine the core version of ${dir}: it has no ${CORE_VERSION_FILE}, and a checkout supplied explicitly is not resolved from a tag. Pass --to to state which version this tree is.`
   );
@@ -3825,8 +3903,8 @@ function versionOfCheckout(dir, explicit) {
 function latestCoreVersion(repo) {
   const fromTags = latestCoreVersionFromTags(repo);
   if (fromTags) return fromTags;
-  const file = join12(repo, CORE_VERSION_FILE);
-  if (existsSync11(file)) return readCoreVersionFile(file);
+  const file = join13(repo, CORE_VERSION_FILE);
+  if (existsSync12(file)) return readCoreVersionFile(file);
   throw new Error(
     `Cannot determine the template's core version: ${repo} has no core-v* tags and no ${CORE_VERSION_FILE}. Fetch tags (\`git fetch --tags\`) or pass --to explicitly.`
   );
@@ -3844,7 +3922,7 @@ coreCommand.addCommand(coreUpgradeCommand);
 import { Command as Command8 } from "commander";
 
 // src/commands/data-apply.ts
-import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
 import { resolve as resolve4 } from "path";
 import chalk5 from "chalk";
 import { Command as Command5 } from "commander";
@@ -4295,16 +4373,16 @@ function isTemplatePlaceholderConfig(raw) {
 
 // src/lib/session.ts
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   rmSync as rmSync6,
   statSync as statSync2,
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var LEGACY_STEP_ALIASES = {
   github_config: ["github_branches", "github_instance_files", "github_settings"]
 };
@@ -4313,39 +4391,39 @@ function hasCompleted(session, step) {
   return session.completedSteps.some((done) => LEGACY_STEP_ALIASES[done]?.includes(step) ?? false);
 }
 function sessionsDir() {
-  return process.env["BIFFO_SESSIONS_DIR"] ?? join13(homedir(), ".biffo", "sessions");
+  return process.env["BIFFO_SESSIONS_DIR"] ?? join14(homedir(), ".biffo", "sessions");
 }
 function sessionPath(projectName) {
-  return join13(sessionsDir(), `${projectName}.json`);
+  return join14(sessionsDir(), `${projectName}.json`);
 }
 function loadSession(projectName) {
   const path = sessionPath(projectName);
-  if (!existsSync12(path)) return null;
+  if (!existsSync13(path)) return null;
   try {
-    return JSON.parse(readFileSync8(path, "utf8"));
+    return JSON.parse(readFileSync9(path, "utf8"));
   } catch {
     return null;
   }
 }
 function findLatestSession() {
   const dir = sessionsDir();
-  if (!existsSync12(dir)) return null;
+  if (!existsSync13(dir)) return null;
   const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return null;
   const sorted = files.map((f) => {
-    const fullPath = join13(dir, f);
-    const mtime = existsSync12(fullPath) ? statSync2(fullPath).mtimeMs : -1;
+    const fullPath = join14(dir, f);
+    const mtime = existsSync13(fullPath) ? statSync2(fullPath).mtimeMs : -1;
     return { f, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   try {
-    return JSON.parse(readFileSync8(join13(dir, sorted[0].f), "utf8"));
+    return JSON.parse(readFileSync9(join14(dir, sorted[0].f), "utf8"));
   } catch {
     return null;
   }
 }
 function saveSession(session) {
   const dir = sessionsDir();
-  if (!existsSync12(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync13(dir)) mkdirSync4(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSession(name);
   if (prior) {
@@ -4367,36 +4445,36 @@ function markStepComplete(session, step) {
 }
 function deleteSession(projectName) {
   const path = sessionPath(projectName);
-  if (existsSync12(path)) rmSync6(path);
+  if (existsSync13(path)) rmSync6(path);
 }
 function projectsDir() {
-  return process.env["BIFFO_PROJECTS_DIR"] ?? join13(homedir(), ".biffo", "projects");
+  return process.env["BIFFO_PROJECTS_DIR"] ?? join14(homedir(), ".biffo", "projects");
 }
 function saveProjectConfig(config) {
   const dir = projectsDir();
-  if (!existsSync12(dir)) mkdirSync4(dir, { recursive: true });
-  writeFileSync5(join13(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
+  if (!existsSync13(dir)) mkdirSync4(dir, { recursive: true });
+  writeFileSync5(join14(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
 }
 function loadProjectConfig(name) {
-  const path = join13(projectsDir(), `${name}.json`);
-  if (!existsSync12(path)) return null;
+  const path = join14(projectsDir(), `${name}.json`);
+  if (!existsSync13(path)) return null;
   try {
-    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync8(path, "utf8")));
+    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync9(path, "utf8")));
     return result.success ? result.data : null;
   } catch {
     return null;
   }
 }
 function deleteProjectConfig(name) {
-  const path = join13(projectsDir(), `${name}.json`);
-  if (existsSync12(path)) rmSync6(path);
+  const path = join14(projectsDir(), `${name}.json`);
+  if (existsSync13(path)) rmSync6(path);
 }
 function listProjectConfigs() {
   const dir = projectsDir();
-  if (!existsSync12(dir)) return [];
+  if (!existsSync13(dir)) return [];
   return readdirSync4(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
     try {
-      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync8(join13(dir, f), "utf8")));
+      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync9(join14(dir, f), "utf8")));
       return result.success ? [result.data] : [];
     } catch {
       return [];
@@ -4465,7 +4543,7 @@ async function runDataApply(name, environment, config, aws) {
 }
 async function resolveConfig(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync9(resolve4(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync10(resolve4(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -4485,8 +4563,8 @@ async function resolveConfig(options) {
     return cfg;
   }
   const localConfigPath = resolve4(process.cwd(), "biffo.config.json");
-  if (existsSync13(localConfigPath)) {
-    const raw = JSON.parse(readFileSync9(localConfigPath, "utf8"));
+  if (existsSync14(localConfigPath)) {
+    const raw = JSON.parse(readFileSync10(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -4532,8 +4610,8 @@ async function resolveConfig(options) {
 
 // src/commands/data-import.ts
 import { execSync as execSync3 } from "child_process";
-import { cpSync, existsSync as existsSync14, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
-import { join as join14, resolve as resolve5 } from "path";
+import { cpSync, existsSync as existsSync15, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { join as join15, resolve as resolve5 } from "path";
 import chalk6 from "chalk";
 import { Command as Command6 } from "commander";
 import inquirer2 from "inquirer";
@@ -4573,23 +4651,23 @@ async function runDataImport(name, options, deps) {
       `Invalid import name '${name}'. Use lowercase letters, numbers, and hyphens, starting with a letter.`
     );
   }
-  const servicesDir = join14(options.cwd, "services");
-  if (!existsSync14(servicesDir)) {
+  const servicesDir = join15(options.cwd, "services");
+  if (!existsSync15(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join14(options.cwd, "db", "imports", name);
-  if (existsSync14(targetDir)) {
+  const targetDir = join15(options.cwd, "db", "imports", name);
+  if (existsSync15(targetDir)) {
     throw new Error(
       `DDL import '${name}' is already present at db/imports/${name}/. Remove it first to re-import.`
     );
   }
-  const isLocalDir = existsSync14(options.source) && statSync3(options.source).isDirectory();
+  const isLocalDir = existsSync15(options.source) && statSync3(options.source).isDirectory();
   let sourceDir;
   let cleanupClone = null;
   if (isLocalDir) {
-    sourceDir = options.path ? join14(options.source, options.path) : options.source;
+    sourceDir = options.path ? join15(options.source, options.path) : options.source;
   } else {
     const token = options.token ?? await resolveDdlImportToken();
     log.info(`Cloning ${options.source}...`);
@@ -4597,10 +4675,10 @@ async function runDataImport(name, options, deps) {
     cleanupClone = () => {
       deps.git.cleanup(tmpDir);
     };
-    sourceDir = options.path ? join14(tmpDir, options.path) : tmpDir;
+    sourceDir = options.path ? join15(tmpDir, options.path) : tmpDir;
   }
   try {
-    if (!existsSync14(sourceDir)) {
+    if (!existsSync15(sourceDir)) {
       throw new Error(`Source directory does not exist: ${sourceDir}`);
     }
     const sqlFiles = readdirSync5(sourceDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name).sort();
@@ -4625,7 +4703,7 @@ async function runDataImport(name, options, deps) {
     }
     mkdirSync5(targetDir, { recursive: true });
     for (const file of sqlFiles) {
-      cpSync(join14(sourceDir, file), join14(targetDir, file));
+      cpSync(join15(sourceDir, file), join15(targetDir, file));
     }
     log.success(`Imported ${String(sqlFiles.length)} .sql file(s) to db/imports/${name}/`);
     const commitMessage = `feat(data): import ${name} (${String(sqlFiles.length)} SQL file(s))`;
@@ -4677,8 +4755,8 @@ function printDryRun(name, sqlFiles) {
 }
 
 // src/commands/data-list.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6 } from "fs";
-import { join as join15, resolve as resolve6 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync6 } from "fs";
+import { join as join16, resolve as resolve6 } from "path";
 import chalk7 from "chalk";
 import { Command as Command7 } from "commander";
 var dataListCommand = new Command7("list").description("List DDL imports vendored in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -4691,15 +4769,15 @@ var dataListCommand = new Command7("list").description("List DDL imports vendore
   }
 });
 async function runDataList(options) {
-  const importsDir = join15(options.cwd, "db", "imports");
-  if (!existsSync15(importsDir)) {
+  const importsDir = join16(options.cwd, "db", "imports");
+  if (!existsSync16(importsDir)) {
     console.log(chalk7.dim("\n  No DDL imports in this checkout.\n"));
     return;
   }
   const candidates = readdirSync6(importsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
   const imports = [];
   for (const name of candidates) {
-    const fileCount = readdirSync6(join15(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
+    const fileCount = readdirSync6(join16(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
     if (fileCount > 0) imports.push({ name, fileCount });
   }
   if (imports.length === 0) {
@@ -4729,7 +4807,7 @@ dataCommand.addCommand(dataListCommand);
 
 // src/commands/deploy.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync11 } from "fs";
 import { resolve as resolve7 } from "path";
 import chalk8 from "chalk";
 import { Command as Command9 } from "commander";
@@ -5086,7 +5164,7 @@ var deployCommand = new Command9("deploy").description("Deploy infrastructure an
 );
 async function resolveConfig2(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync10(resolve7(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync11(resolve7(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -5106,8 +5184,8 @@ async function resolveConfig2(options) {
     return cfg;
   }
   const localConfigPath = resolve7(process.cwd(), "biffo.config.json");
-  if (existsSync16(localConfigPath)) {
-    const raw = JSON.parse(readFileSync10(localConfigPath, "utf8"));
+  if (existsSync17(localConfigPath)) {
+    const raw = JSON.parse(readFileSync11(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -5503,7 +5581,7 @@ function resolveGithubToken() {
 
 // src/commands/destroy.ts
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { resolve as resolve8 } from "path";
 import chalk9 from "chalk";
 import { Command as Command10 } from "commander";
@@ -5593,7 +5671,7 @@ var destroyCommand = new Command10("destroy").description("Destroy infrastructur
 });
 async function resolveConfig3(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync11(resolve8(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync12(resolve8(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -5613,7 +5691,7 @@ async function resolveConfig3(options) {
     return cfg;
   }
   try {
-    const raw = JSON.parse(readFileSync11(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
+    const raw = JSON.parse(readFileSync12(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
   } catch {
@@ -5663,15 +5741,15 @@ function resolveGithubToken2() {
 }
 
 // src/commands/init.ts
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 import { resolve as resolve10 } from "path";
 import chalk12 from "chalk";
 import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
-import { existsSync as existsSync17, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
-import { dirname as dirname5, join as join16, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync18, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
+import { dirname as dirname5, join as join17, relative as relative2, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SKIP_ENV_VAR = "BIFFO_SKIP_BUILD_FRESHNESS_CHECK";
 function checkBuildFreshness(options = {}) {
@@ -5685,7 +5763,7 @@ function checkBuildFreshness(options = {}) {
   if (!packageRoot) {
     return { status: "skipped", reason: `no package.json above ${moduleDir}`, newerSources: [] };
   }
-  const distDir = join16(packageRoot, "dist");
+  const distDir = join17(packageRoot, "dist");
   if (!isInside(distDir, moduleDir)) {
     return {
       status: "skipped",
@@ -5693,16 +5771,16 @@ function checkBuildFreshness(options = {}) {
       newerSources: []
     };
   }
-  const srcDir = join16(packageRoot, "src");
-  if (!existsSync17(srcDir)) {
+  const srcDir = join17(packageRoot, "src");
+  if (!existsSync18(srcDir)) {
     return {
       status: "skipped",
       reason: "no src/ alongside dist/ \u2014 this is a shipped package",
       newerSources: []
     };
   }
-  const entry = join16(distDir, "index.js");
-  if (!existsSync17(entry)) {
+  const entry = join17(distDir, "index.js");
+  if (!existsSync18(entry)) {
     return { status: "skipped", reason: `${entry} not found`, newerSources: [] };
   }
   const builtAt = statSync4(entry).mtimeMs;
@@ -5746,7 +5824,7 @@ function collectSourceFiles(srcDir) {
   const found = [];
   const walk = (dir) => {
     for (const entry of readdirSync7(dir, { withFileTypes: true })) {
-      const full = join16(dir, entry.name);
+      const full = join17(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules") continue;
         walk(full);
@@ -5765,7 +5843,7 @@ function collectSourceFiles(srcDir) {
 function findPackageRoot(from) {
   let dir = from;
   for (; ; ) {
-    if (existsSync17(join16(dir, "package.json"))) return dir;
+    if (existsSync18(join17(dir, "package.json"))) return dir;
     const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -5779,9 +5857,9 @@ function isInside(parent, child) {
 
 // src/lib/credentials.ts
 import { execSync as execSync6 } from "child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync13 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand2, STSClient as STSClient2 } from "@aws-sdk/client-sts";
 import chalk10 from "chalk";
 import inquirer4 from "inquirer";
@@ -5960,11 +6038,11 @@ async function verifySelectedAwsCredentials(profile, region) {
   return sts.send(new GetCallerIdentityCommand2({}));
 }
 function discoverAwsProfiles() {
-  const files = [join17(homedir2(), ".aws", "credentials"), join17(homedir2(), ".aws", "config")];
+  const files = [join18(homedir2(), ".aws", "credentials"), join18(homedir2(), ".aws", "config")];
   const profiles = /* @__PURE__ */ new Set();
   for (const file of files) {
-    if (!existsSync18(file)) continue;
-    const content = readFileSync12(file, "utf8");
+    if (!existsSync19(file)) continue;
+    const content = readFileSync13(file, "utf8");
     for (const match of content.matchAll(/^\s*\[([^\]]+)\]\s*$/gm)) {
       const section = match[1]?.trim();
       if (!section) continue;
@@ -6054,34 +6132,34 @@ var SiblingConfigSchema = z6.object({
 
 // src/lib/sibling-session.ts
 import {
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   mkdirSync as mkdirSync6,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   rmSync as rmSync7,
   statSync as statSync5,
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function sessionsDir2() {
-  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join18(homedir3(), ".biffo", "sibling-sessions");
+  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join19(homedir3(), ".biffo", "sibling-sessions");
 }
 function sessionPath2(projectName) {
-  return join18(sessionsDir2(), `${projectName}.json`);
+  return join19(sessionsDir2(), `${projectName}.json`);
 }
 function loadSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (!existsSync19(path)) return null;
+  if (!existsSync20(path)) return null;
   try {
-    return JSON.parse(readFileSync13(path, "utf8"));
+    return JSON.parse(readFileSync14(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveSiblingSession(session) {
   const dir = sessionsDir2();
-  if (!existsSync19(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync20(dir)) mkdirSync6(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSiblingSession(name);
   if (prior) {
@@ -6103,30 +6181,30 @@ function markSiblingStepComplete(session, step) {
 }
 function deleteSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (existsSync19(path)) rmSync7(path);
+  if (existsSync20(path)) rmSync7(path);
 }
 
 // src/commands/sibling-create.ts
-import { cpSync as cpSync2, existsSync as existsSync20, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync21, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname6, join as join20, resolve as resolve9 } from "path";
+import { dirname as dirname6, join as join21, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import chalk11 from "chalk";
 import { Command as Command11 } from "commander";
 
 // src/lib/skeleton-dotfiles.ts
 import { readdirSync as readdirSync9, renameSync } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 var PACKAGED_GITIGNORE = "_gitignore";
 var REAL_GITIGNORE = ".gitignore";
 function restorePackagedDotfiles(dir) {
   const restored = [];
   for (const entry of readdirSync9(dir, { withFileTypes: true })) {
-    const full = join19(dir, entry.name);
+    const full = join20(dir, entry.name);
     if (entry.isDirectory()) {
       restored.push(...restorePackagedDotfiles(full));
     } else if (entry.name === PACKAGED_GITIGNORE) {
-      const target = join19(dir, REAL_GITIGNORE);
+      const target = join20(dir, REAL_GITIGNORE);
       renameSync(full, target);
       restored.push(target);
     }
@@ -6171,7 +6249,7 @@ async function runSiblingCreateCommand(name, options) {
     printDryRun2(config, coreConfig, options.templateRoot);
     return;
   }
-  if (!existsSync20(options.templateRoot)) {
+  if (!existsSync21(options.templateRoot)) {
     throw new Error(`Sibling template not found at ${options.templateRoot}`);
   }
   let session = null;
@@ -6388,7 +6466,7 @@ function assertPathPrefixIsAllowed(pathPrefix) {
   }
 }
 function readSiblingConfig(path, root = false) {
-  const raw = JSON.parse(readFileSync14(path, "utf8"));
+  const raw = JSON.parse(readFileSync15(path, "utf8"));
   const withDefaults = raw && typeof raw === "object" && "project" in raw && "core" in raw ? {
     ...raw,
     core: {
@@ -6422,7 +6500,7 @@ function resolveCoreConfig(config, configPath) {
   throw new Error("Either core.project_name or core.config_path is required.");
 }
 function parseCoreConfig(path) {
-  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync14(path, "utf8")));
+  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync15(path, "utf8")));
   if (!result.success) {
     throw new Error(
       `Invalid core configuration at ${path}:
@@ -6461,7 +6539,7 @@ async function resolveCoreIdentity(coreAws, coreConfig, environments) {
   return coreIdentity;
 }
 async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
-  const workDir = mkdtempSync4(join20(tmpdir4(), `biffo-sibling-${config.project.name}-`));
+  const workDir = mkdtempSync4(join21(tmpdir4(), `biffo-sibling-${config.project.name}-`));
   try {
     writeSiblingTemplate(skeletonRoot, workDir, config, {
       coreProjectName: coreConfig.project.name,
@@ -6486,13 +6564,13 @@ async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, git
   }
 }
 function writeSiblingTemplate(templateRoot, targetDir, config, context) {
-  if (!existsSync20(templateRoot)) {
+  if (!existsSync21(templateRoot)) {
     throw new Error(`Sibling template not found at ${templateRoot}`);
   }
   cpSync2(templateRoot, targetDir, { recursive: true });
   restorePackagedDotfiles(targetDir);
   writeFileSync7(
-    join20(targetDir, "biffo.sibling.json"),
+    join21(targetDir, "biffo.sibling.json"),
     JSON.stringify(
       {
         name: config.project.name,
@@ -6510,10 +6588,10 @@ function writeSiblingTemplate(templateRoot, targetDir, config, context) {
       2
     ) + "\n"
   );
-  const envPath = join20(targetDir, "apps", "frontend", ".env.example");
+  const envPath = join21(targetDir, "apps", "frontend", ".env.example");
   try {
     const path = basePathFor(context.pathPrefix);
-    const content = readFileSync14(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
+    const content = readFileSync15(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
     writeFileSync7(envPath, content);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
@@ -6560,7 +6638,7 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
 }
 function readExistingSiblingOrigins(filePath) {
   try {
-    return JSON.parse(readFileSync14(filePath, "utf8"));
+    return JSON.parse(readFileSync15(filePath, "utf8"));
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw err;
@@ -6579,10 +6657,10 @@ function assertGitIdentity(identity) {
   );
 }
 function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
-  const cdnVarsPath = join20(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
+  const cdnVarsPath = join21(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
   let declaresSiblingOrigins = false;
   try {
-    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync14(cdnVarsPath, "utf8"));
+    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync15(cdnVarsPath, "utf8"));
   } catch {
     declaresSiblingOrigins = false;
   }
@@ -6592,10 +6670,10 @@ function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x")
     );
   }
   if (!isRootPathPrefix(pathPrefix)) return;
-  const cdnMainPath = join20(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
+  const cdnMainPath = join21(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
   let supportsRoot = false;
   try {
-    supportsRoot = /root_sibling_registered/.test(readFileSync14(cdnMainPath, "utf8"));
+    supportsRoot = /root_sibling_registered/.test(readFileSync15(cdnMainPath, "utf8"));
   } catch {
     supportsRoot = false;
   }
@@ -6625,8 +6703,8 @@ async function registerWithCore(git, github, config, coreConfig, pathPrefix, git
     for (const env of config.environments) {
       const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
       const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
-      const relativePath = join20("infra", "environments", env, "siblings.auto.tfvars.json");
-      const filePath = join20(cloneDir, relativePath);
+      const relativePath = join21("infra", "environments", env, "siblings.auto.tfvars.json");
+      const filePath = join21(cloneDir, relativePath);
       const existing = readExistingSiblingOrigins(filePath);
       const siblings = upsertSiblingOrigin(existing.sibling_origins ?? [], {
         name,
@@ -6706,8 +6784,8 @@ function defaultSiblingTemplateRoot() {
   const start = dirname6(fileURLToPath4(import.meta.url));
   let dir = start;
   for (; ; ) {
-    const candidate = join20(dir, "_skeletons", "sibling-template");
-    if (existsSync20(candidate)) return candidate;
+    const candidate = join21(dir, "_skeletons", "sibling-template");
+    if (existsSync21(candidate)) return candidate;
     const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
@@ -6731,7 +6809,7 @@ var initCommand = new Command12("init").description("Scaffold a new project from
     let config;
     let githubToken;
     if (options.config) {
-      const rawConfig = JSON.parse(readFileSync15(resolve10(options.config), "utf8"));
+      const rawConfig = JSON.parse(readFileSync16(resolve10(options.config), "utf8"));
       config = parseConfig(rawConfig);
       const { account_id: accountId, region } = config.cloud.config;
       session = resolveConfigFileSession(config, accountId, region, options.fresh === true);
@@ -7176,8 +7254,8 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 import { Command as Command20 } from "commander";
 
 // src/commands/plugin-create.ts
-import { existsSync as existsSync23, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname8, join as join23, resolve as resolve11 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join24, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
@@ -7241,21 +7319,21 @@ function workflowCheckContexts(workflow) {
 }
 
 // src/lib/plugin-locations.ts
-import { existsSync as existsSync21, readdirSync as readdirSync10 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync22, readdirSync as readdirSync10 } from "fs";
+import { join as join22 } from "path";
 var FIRST_PARTY_PLUGINS_DIR = "_plugins";
 var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
 function pluginDir(name, channel) {
   return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
 }
 function scanDir(absDir, relDir, channel) {
-  if (!existsSync21(absDir)) return [];
+  if (!existsSync22(absDir)) return [];
   const found = [];
   for (const entry of readdirSync10(absDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
-    const manifestPath = join21(absDir, entry.name, PLUGIN_MANIFEST_FILE);
-    if (!existsSync21(manifestPath)) continue;
+    const manifestPath = join22(absDir, entry.name, PLUGIN_MANIFEST_FILE);
+    if (!existsSync22(manifestPath)) continue;
     found.push({
       dirName: entry.name,
       relDir: `${relDir}/${entry.name}`,
@@ -7266,11 +7344,11 @@ function scanDir(absDir, relDir, channel) {
   return found;
 }
 function findInstalledPlugins(cwd) {
-  const servicesDir = join21(cwd, "services");
+  const servicesDir = join22(cwd, "services");
   return [
     ...scanDir(servicesDir, "services", "third-party"),
     ...scanDir(
-      join21(servicesDir, FIRST_PARTY_PLUGINS_DIR),
+      join22(servicesDir, FIRST_PARTY_PLUGINS_DIR),
       `services/${FIRST_PARTY_PLUGINS_DIR}`,
       "first-party"
     )
@@ -7473,13 +7551,13 @@ function validateManifest(raw) {
 // src/lib/plugin-scaffold.ts
 import {
   copyFileSync,
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   readdirSync as readdirSync11,
   writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname7, join as join22 } from "path";
+import { dirname as dirname7, join as join23 } from "path";
 var STANDALONE_ONLY_ENTRIES = {
   ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
   "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
@@ -7533,10 +7611,10 @@ function applySubstitutions(text, names) {
 var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
 function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
   const layout = options.layout ?? "in-tree";
-  if (!existsSync22(skeletonRoot)) {
+  if (!existsSync23(skeletonRoot)) {
     throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
   }
-  if (!existsSync22(join22(skeletonRoot, "terraform"))) {
+  if (!existsSync23(join23(skeletonRoot, "terraform"))) {
     throw new Error(
       `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
     );
@@ -7544,7 +7622,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
   const skipped = [];
   const files = [];
   const walk = (relDir) => {
-    const absDir = join22(skeletonRoot, relDir);
+    const absDir = join23(skeletonRoot, relDir);
     for (const entry of readdirSync11(absDir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     )) {
@@ -7559,14 +7637,14 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
         continue;
       }
       const destRel = applySubstitutions(relPath, names);
-      const destPath = join22(destDir, destRel);
+      const destPath = join23(destDir, destRel);
       mkdirSync8(dirname7(destPath), { recursive: true });
       if (BINARY_EXTENSIONS.test(entry.name)) {
-        copyFileSync(join22(skeletonRoot, relPath), destPath);
+        copyFileSync(join23(skeletonRoot, relPath), destPath);
       } else {
         writeFileSync8(
           destPath,
-          applySubstitutions(readFileSync16(join22(skeletonRoot, relPath), "utf8"), names)
+          applySubstitutions(readFileSync17(join23(skeletonRoot, relPath), "utf8"), names)
         );
       }
       files.push(destRel);
@@ -7583,8 +7661,8 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
 function findSkeletonRoot(startDir, skeleton) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join22(dir, "_skeletons", skeleton);
-    if (existsSync22(candidate)) return candidate;
+    const candidate = join23(dir, "_skeletons", skeleton);
+    if (existsSync23(candidate)) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -7652,7 +7730,7 @@ async function runPluginCreate(name, options, deps) {
     reportBranchProtectionSummary();
     return;
   }
-  const isInstance = existsSync23(join23(options.cwd, INSTANCE_CORE_FILE));
+  const isInstance = existsSync24(join24(options.cwd, INSTANCE_CORE_FILE));
   if (options.firstParty && isInstance) {
     throw new Error(
       `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
@@ -7660,19 +7738,19 @@ async function runPluginCreate(name, options, deps) {
   }
   const channel = options.firstParty ? "first-party" : "third-party";
   const relDir = pluginDir(names.slug, channel);
-  const destDir = join23(options.cwd, relDir);
-  const servicesDir = join23(options.cwd, "services");
-  if (!existsSync23(servicesDir)) {
+  const destDir = join24(options.cwd, relDir);
+  const servicesDir = join24(options.cwd, "services");
+  if (!existsSync24(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  if (existsSync23(destDir)) {
+  if (existsSync24(destDir)) {
     throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
   }
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join23(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync23(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join24(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync24(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -7687,8 +7765,8 @@ async function runPluginCreate(name, options, deps) {
   for (const { entry, reason } of skipped) {
     log.info(`Skipped ${entry} \u2014 ${reason}`);
   }
-  const manifestPath = join23(destDir, "biffo.plugin.json");
-  const manifest = validateManifest(JSON.parse(readFileSync17(manifestPath, "utf8")));
+  const manifestPath = join24(destDir, "biffo.plugin.json");
+  const manifest = validateManifest(JSON.parse(readFileSync18(manifestPath, "utf8")));
   if (manifest.name !== names.slug) {
     throw new Error(
       `Scaffolded manifest declares name '${manifest.name}', expected '${names.slug}'. The skeleton's manifest name may have diverged from 'example-plugin'.`
@@ -7711,8 +7789,8 @@ async function runPluginCreate(name, options, deps) {
   printNextSteps(names, relDir, channel);
 }
 async function runStandaloneCreate(names, options, deps) {
-  const destDir = join23(options.cwd, names.dist);
-  if (existsSync23(destDir)) {
+  const destDir = join24(options.cwd, names.dist);
+  if (existsSync24(destDir)) {
     throw new Error(`${names.dist}/ already exists. Choose a different name, or remove it first.`);
   }
   const skeletonRoot = resolveSkeletonRoot(options);
@@ -7730,7 +7808,7 @@ async function runStandaloneCreate(names, options, deps) {
   restorePackagedDotfiles(destDir);
   log.success(`Scaffolded ${String(files.length)} file(s) into ${names.dist}/`);
   const manifest = validateManifest(
-    JSON.parse(readFileSync17(join23(destDir, "biffo.plugin.json"), "utf8"))
+    JSON.parse(readFileSync18(join24(destDir, "biffo.plugin.json"), "utf8"))
   );
   if (manifest.name !== names.slug) {
     throw new Error(
@@ -7769,8 +7847,8 @@ async function createAndPushStandaloneRepo(org, names, destDir, options, deps) {
   await deps.git.push(destDir, "dev", { token });
   log.success(`Pushed dev to ${org}/${names.dist}`);
   await github.setDefaultBranch(org, names.dist, "dev");
-  const ciPath = join23(destDir, ".github", "workflows", "ci.yml");
-  const contexts = existsSync23(ciPath) ? workflowCheckContexts(readFileSync17(ciPath, "utf8")) : [];
+  const ciPath = join24(destDir, ".github", "workflows", "ci.yml");
+  const contexts = existsSync24(ciPath) ? workflowCheckContexts(readFileSync18(ciPath, "utf8")) : [];
   if (contexts.length === 0) {
     log.warn(
       `Could not determine required status checks from ${ciPath} \u2014 skipping branch protection. Configure it manually on dev once you know the CI job names.`
@@ -7796,8 +7874,8 @@ async function registerInRegistrySources(names, cloneUrl, token, deps) {
   let dir;
   try {
     dir = await deps.git.cloneForEditing(REGISTRY_REPO, "biffo-registry", token);
-    const path = join23(dir, "sources.json");
-    const file = JSON.parse(readFileSync17(path, "utf8"));
+    const path = join24(dir, "sources.json");
+    const file = JSON.parse(readFileSync18(path, "utf8"));
     const next = addSource(file, {
       name: names.slug,
       repo: cloneUrl.replace(/\.git$/, ""),
@@ -7905,8 +7983,8 @@ function printStandaloneNextSteps(names, minor) {
 }
 function resolveSkeletonRoot(options) {
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join23(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync23(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join24(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync24(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -8081,14 +8159,14 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync3, existsSync as existsSync25, mkdirSync as mkdirSync9, readFileSync as readFileSync19, statSync as statSync6 } from "fs";
-import { basename, join as join26, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync26, mkdirSync as mkdirSync9, readFileSync as readFileSync20, statSync as statSync6 } from "fs";
+import { basename, join as join27, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
 import { execa as execa4 } from "execa";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var PluginMigrationsAdapter = class {
   /**
    * Generates migration file(s) for `pluginNames` (every discovered
@@ -8097,22 +8175,22 @@ var PluginMigrationsAdapter = class {
    * or declared no tables.
    */
   async generate(cwd, pluginNames) {
-    const scriptPath = join24(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
+    const scriptPath = join25(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
     const args = [
       "run",
       "python",
       scriptPath,
       "--services-root",
-      join24(cwd, "services"),
+      join25(cwd, "services"),
       "--versions-dir",
-      join24(cwd, "services", "api", "migrations", "versions")
+      join25(cwd, "services", "api", "migrations", "versions")
     ];
     for (const name of pluginNames ?? []) {
       args.push("--plugin", name);
     }
     let result;
     try {
-      result = await execa4("uv", args, { cwd: join24(cwd, "services", "api") });
+      result = await execa4("uv", args, { cwd: join25(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -8129,8 +8207,8 @@ var PluginMigrationsAdapter = class {
 };
 
 // src/lib/plugin-workspace-sources.ts
-import { existsSync as existsSync24, readdirSync as readdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync10 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync25, readdirSync as readdirSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync10 } from "fs";
+import { join as join26 } from "path";
 function readTomlStringArray(text, key) {
   const open = new RegExp(`^${key}\\s*=\\s*\\[`, "m").exec(text);
   if (!open) return [];
@@ -8174,9 +8252,9 @@ function readDependencyNames(text) {
   return readTomlStringArray(text, "dependencies").map((dep) => /^\s*([A-Za-z0-9._-]+)/.exec(dep)?.[1] ?? "").filter(Boolean);
 }
 function workspaceMemberNames(instanceRoot) {
-  const rootPyproject = join25(instanceRoot, "pyproject.toml");
-  if (!existsSync24(rootPyproject)) return /* @__PURE__ */ new Set();
-  const text = readFileSync18(rootPyproject, "utf8");
+  const rootPyproject = join26(instanceRoot, "pyproject.toml");
+  if (!existsSync25(rootPyproject)) return /* @__PURE__ */ new Set();
+  const text = readFileSync19(rootPyproject, "utf8");
   const members = readTomlStringArray(text, "members");
   const excluded = new Set(readTomlStringArray(text, "exclude"));
   const dirs = [];
@@ -8185,7 +8263,7 @@ function workspaceMemberNames(instanceRoot) {
       const base = member.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync12(join25(instanceRoot, base), { withFileTypes: true });
+        entries = readdirSync12(join26(instanceRoot, base), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -8199,9 +8277,9 @@ function workspaceMemberNames(instanceRoot) {
   }
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    const pp = join25(instanceRoot, dir, "pyproject.toml");
-    if (!existsSync24(pp)) continue;
-    const name = readProjectName(readFileSync18(pp, "utf8"));
+    const pp = join26(instanceRoot, dir, "pyproject.toml");
+    if (!existsSync25(pp)) continue;
+    const name = readProjectName(readFileSync19(pp, "utf8"));
     if (name) names.add(name);
   }
   return names;
@@ -8212,8 +8290,8 @@ function existingWorkspaceSources(text) {
   );
 }
 function ensureWorkspaceSources(pluginPyprojectPath, memberNames) {
-  if (!existsSync24(pluginPyprojectPath) || memberNames.size === 0) return [];
-  const text = readFileSync18(pluginPyprojectPath, "utf8");
+  if (!existsSync25(pluginPyprojectPath) || memberNames.size === 0) return [];
+  const text = readFileSync19(pluginPyprojectPath, "utf8");
   const already = existingWorkspaceSources(text);
   const toAdd = readDependencyNames(text).filter((n) => memberNames.has(n) && !already.has(n));
   if (toAdd.length === 0) return [];
@@ -8279,14 +8357,14 @@ var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".terraform"
 ]);
 function resolveLocalPlugin(localPath) {
-  if (!existsSync25(localPath)) {
+  if (!existsSync26(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync6(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join26(localPath, "biffo.plugin.json");
-  if (!existsSync25(manifestPath)) {
+  const manifestPath = join27(localPath, "biffo.plugin.json");
+  if (!existsSync26(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -8312,8 +8390,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join26(tmpDir, "biffo.plugin.json");
-    if (!existsSync25(manifestPath)) {
+    const manifestPath = join27(tmpDir, "biffo.plugin.json");
+    if (!existsSync26(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -8341,8 +8419,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join26(options.cwd, "services");
-  if (!existsSync25(servicesDir)) {
+  const servicesDir = join27(options.cwd, "services");
+  if (!existsSync26(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8360,10 +8438,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join26(options.cwd, relTargetDir);
-  const modulesDir = join26(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join27(options.cwd, relTargetDir);
+  const modulesDir = join27(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync25(targetDir) && !inTreeSource) {
+  if (existsSync26(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -8405,8 +8483,8 @@ async function runPluginInstall(target, options, deps) {
       });
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
-    const pluginPyproject = join26(targetDir, "pyproject.toml");
-    if (existsSync25(pluginPyproject)) {
+    const pluginPyproject = join27(targetDir, "pyproject.toml");
+    if (existsSync26(pluginPyproject)) {
       const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(options.cwd));
       if (sourced.length > 0) {
         log.info(
@@ -8415,8 +8493,8 @@ async function runPluginInstall(target, options, deps) {
       }
     }
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join26(targetDir, "terraform");
-    if (existsSync25(tfSourceDir)) {
+    const tfSourceDir = join27(targetDir, "terraform");
+    if (existsSync26(tfSourceDir)) {
       mkdirSync9(modulesDir, { recursive: true });
       cpSync3(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
@@ -8473,7 +8551,7 @@ async function runPluginInstall(target, options, deps) {
 }
 function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync19(path, "utf8"));
+    return JSON.parse(readFileSync20(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
@@ -8510,8 +8588,8 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync26, readFileSync as readFileSync20 } from "fs";
-import { join as join27, resolve as resolve13 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync21 } from "fs";
+import { join as join28, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -8524,8 +8602,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join27(options.cwd, "services");
-  if (!existsSync26(servicesDir)) {
+  const servicesDir = join28(options.cwd, "services");
+  if (!existsSync27(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8533,7 +8611,7 @@ async function runPluginList(options) {
   const plugins = [];
   for (const location of findInstalledPlugins(options.cwd)) {
     try {
-      const manifest = validateManifest(JSON.parse(readFileSync20(location.manifestPath, "utf8")));
+      const manifest = validateManifest(JSON.parse(readFileSync21(location.manifestPath, "utf8")));
       plugins.push({
         name: manifest.name,
         version: manifest.version,
@@ -8570,8 +8648,8 @@ async function runPluginList(options) {
 }
 
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync27 } from "fs";
-import { join as join28, relative as relative4, resolve as resolve14 } from "path";
+import { existsSync as existsSync28 } from "fs";
+import { join as join29, relative as relative4, resolve as resolve14 } from "path";
 import chalk17 from "chalk";
 import { Command as Command17 } from "commander";
 var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
@@ -8592,11 +8670,11 @@ var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join28(options.cwd, "services");
-  if (!existsSync27(servicesDir)) {
+  const servicesDir = join29(options.cwd, "services");
+  if (!existsSync28(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync27(join28(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync28(join29(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -8632,8 +8710,8 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync28, readFileSync as readFileSync21, rmSync as rmSync8 } from "fs";
-import { join as join29, resolve as resolve15 } from "path";
+import { existsSync as existsSync29, readFileSync as readFileSync22, rmSync as rmSync8 } from "fs";
+import { join as join30, resolve as resolve15 } from "path";
 import chalk18 from "chalk";
 import { Command as Command18 } from "commander";
 import inquirer6 from "inquirer";
@@ -8665,16 +8743,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join29(options.cwd, "services");
-  if (!existsSync28(servicesDir)) {
+  const servicesDir = join30(options.cwd, "services");
+  if (!existsSync29(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join29(servicesDir, name);
-  if (!existsSync28(targetDir)) {
-    const firstParty = join29(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync28(firstParty)) {
+  const targetDir = join30(servicesDir, name);
+  if (!existsSync29(targetDir)) {
+    const firstParty = join30(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync29(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -8682,9 +8760,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join29(options.cwd, "modules", "plugins", name);
+  const modulesDir = join30(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync28(modulesDir)) {
+  if (existsSync29(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -8706,7 +8784,7 @@ async function runPluginUninstall(name, options, deps) {
   }
   rmSync8(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync28(modulesDir)) {
+  if (existsSync29(modulesDir)) {
     rmSync8(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
@@ -8743,10 +8821,10 @@ async function runPluginUninstall(name, options, deps) {
   }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join29(targetDir, "biffo.plugin.json");
-  if (!existsSync28(manifestPath)) return void 0;
+  const manifestPath = join30(targetDir, "biffo.plugin.json");
+  if (!existsSync29(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync21(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync22(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -8779,8 +8857,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync4, existsSync as existsSync29, mkdirSync as mkdirSync10, readFileSync as readFileSync22, rmSync as rmSync9 } from "fs";
-import { join as join30, relative as relative5, resolve as resolve16 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync30, mkdirSync as mkdirSync10, readFileSync as readFileSync23, rmSync as rmSync9 } from "fs";
+import { join as join31, relative as relative5, resolve as resolve16 } from "path";
 import chalk19 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer7 from "inquirer";
@@ -8805,14 +8883,14 @@ var pluginUpgradeCommand = new Command19("upgrade").description(
 });
 async function runPluginUpgrade(target, options, deps) {
   const { name, minor } = parsePluginTarget(target);
-  const servicesDir = join30(options.cwd, "services");
-  if (!existsSync29(servicesDir)) {
+  const servicesDir = join31(options.cwd, "services");
+  if (!existsSync30(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join30(servicesDir, name);
-  if (!existsSync29(targetDir)) {
+  const targetDir = join31(servicesDir, name);
+  if (!existsSync30(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -8826,7 +8904,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join30(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join31(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -8859,11 +8937,11 @@ async function runPluginUpgrade(target, options, deps) {
     cpSync4(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync29(modulesDir)) {
+    if (existsSync30(modulesDir)) {
       rmSync9(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join30(targetDir, "terraform");
-    if (existsSync29(tfSourceDir)) {
+    const tfSourceDir = join31(targetDir, "terraform");
+    if (existsSync30(tfSourceDir)) {
       mkdirSync10(modulesDir, { recursive: true });
       cpSync4(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
@@ -8897,10 +8975,10 @@ async function runPluginUpgrade(target, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join30(targetDir, "biffo.plugin.json");
-  if (!existsSync29(manifestPath)) return void 0;
+  const manifestPath = join31(targetDir, "biffo.plugin.json");
+  if (!existsSync30(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync22(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync23(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -8942,7 +9020,7 @@ pluginCommand.addCommand(pluginInfoCommand);
 import { Command as Command22 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync30, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync31, readFileSync as readFileSync24 } from "fs";
 import { resolve as resolve17 } from "path";
 import chalk20 from "chalk";
 import { Command as Command21 } from "commander";
@@ -9136,7 +9214,7 @@ async function fetchPublishedIdentity(portalUrl) {
 }
 async function resolveConfig4(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync23(resolve17(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync24(resolve17(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -9156,8 +9234,8 @@ async function resolveConfig4(options) {
     return cfg;
   }
   const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
-  if (existsSync30(localConfigPath)) {
-    const raw = JSON.parse(readFileSync23(localConfigPath, "utf8"));
+  if (existsSync31(localConfigPath)) {
+    const raw = JSON.parse(readFileSync24(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -9203,21 +9281,21 @@ siblingCommand.addCommand(siblingCheckIdentityCommand);
 import { Command as Command23 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
-import { existsSync as existsSync32 } from "fs";
-import { join as join32 } from "path";
+import { existsSync as existsSync33 } from "fs";
+import { join as join33 } from "path";
 import { execa as execa5 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
-import { existsSync as existsSync31, readdirSync as readdirSync13, readFileSync as readFileSync24 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync32, readdirSync as readdirSync13, readFileSync as readFileSync25 } from "fs";
+import { join as join32 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join31(adrDir, ALLOWLIST_FILENAME);
-  if (!existsSync31(path)) return /* @__PURE__ */ new Set();
+  const path = join32(adrDir, ALLOWLIST_FILENAME);
+  if (!existsSync32(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
-  for (const rawLine of readFileSync24(path, "utf8").split("\n")) {
+  for (const rawLine of readFileSync25(path, "utf8").split("\n")) {
     const line = rawLine.split("#")[0].trim();
     if (line) numbers.add(line);
   }
@@ -9225,7 +9303,7 @@ function readAdrNumberingAllowlist(adrDir) {
 }
 function adrNumbersIn(adrDir) {
   const claims = /* @__PURE__ */ new Map();
-  if (!existsSync31(adrDir)) return claims;
+  if (!existsSync32(adrDir)) return claims;
   for (const entry of readdirSync13(adrDir).sort()) {
     const match = ADR_FILENAME.exec(entry);
     if (!match) continue;
@@ -9280,8 +9358,8 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
   const root = (await execa5("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join32(root, "docs", "ADR");
-  if (!existsSync32(adrDir)) {
+  const adrDir = join33(root, "docs", "ADR");
+  if (!existsSync33(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
   }
@@ -9602,8 +9680,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa7("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync27, existsSync: existsSync37 } = await import("fs");
-      if (existsSync37(messageFile)) commitMessage = readFileSync27(messageFile, "utf8");
+      const { readFileSync: readFileSync28, existsSync: existsSync38 } = await import("fs");
+      if (existsSync38(messageFile)) commitMessage = readFileSync28(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -9704,33 +9782,33 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync34 } from "fs";
-import { join as join34 } from "path";
+import { existsSync as existsSync35 } from "fs";
+import { join as join35 } from "path";
 import { execa as execa8 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync33, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
-import { join as join33 } from "path";
+import { existsSync as existsSync34, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
+import { join as join34 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync33(dir)) return [];
+  if (!existsSync34(dir)) return [];
   return readdirSync14(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync7(join33(dir, entry)).isDirectory();
+      return statSync7(join34(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync33(join33(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync34(join34(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join33(pluginDir2, "tests");
-  if (!existsSync33(testsDir)) return [];
-  if (existsSync33(join33(testsDir, "__init__.py"))) return [];
+  const testsDir = join34(pluginDir2, "tests");
+  if (!existsSync34(testsDir)) return [];
+  if (existsSync34(join34(testsDir, "__init__.py"))) return [];
   return readdirSync14(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -9739,7 +9817,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join33(servicesDir, plugin))) {
+      for (const name of namesOf(join34(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -9777,8 +9855,8 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join34(root, "services");
-  if (!existsSync34(servicesDir)) {
+  const servicesDir = join35(root, "services");
+  if (!existsSync35(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -9798,8 +9876,8 @@ async function runPluginCollisionCheck() {
 import { execa as execa9 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync35, readFileSync as readFileSync25, readdirSync as readdirSync15 } from "fs";
-import { dirname as dirname9, join as join35, relative as relative6, sep as sep3 } from "path";
+import { existsSync as existsSync36, readFileSync as readFileSync26, readdirSync as readdirSync15 } from "fs";
+import { dirname as dirname9, join as join36, relative as relative6, sep as sep3 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -9814,9 +9892,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
-        walk(join35(dir, entry.name));
+        walk(join36(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative6(root, join35(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative6(root, join36(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -9826,7 +9904,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync25(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync26(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -9841,14 +9919,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync35(join35(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync36(join36(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join35(root, manifest);
+    const absManifest = join36(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync35(join35(pluginDir2, "terraform"))) continue;
+    if (existsSync36(join36(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative6(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -10044,8 +10122,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync36, readFileSync as readFileSync26 } from "fs";
-import { join as join36, resolve as resolve18 } from "path";
+import { existsSync as existsSync37, readFileSync as readFileSync27 } from "fs";
+import { join as join37, resolve as resolve18 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
 
@@ -10220,10 +10298,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join36(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync36(path)) return null;
+  const path = join37(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync37(path)) return null;
   try {
-    return parseCoreRecord(readFileSync26(path, "utf8"));
+    return parseCoreRecord(readFileSync27(path, "utf8"));
   } catch {
     return null;
   }
@@ -10238,10 +10316,10 @@ function parseCoreRecord(contents) {
   }
 }
 function readFossil(cwd) {
-  const path = join36(cwd, CORE_VERSION_FILE);
-  if (!existsSync36(path)) return null;
+  const path = join37(cwd, CORE_VERSION_FILE);
+  if (!existsSync37(path)) return null;
   try {
-    const value = readFileSync26(path, "utf8").trim();
+    const value = readFileSync27(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;