@biffo/cli 0.258.0 → 0.258.2

package/dist/index.js

@@ -570,8 +570,8 @@ async function runCoreStatus(options) {
 
 // src/commands/core-upgrade.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync13, rmSync as rmSync5 } from "fs";
-import { join as join14, resolve as resolve3 } from "path";
+import { existsSync as existsSync14, rmSync as rmSync5 } from "fs";
+import { join as join15, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
 import { execa as execa3 } from "execa";
 import { Command as Command3 } from "commander";
@@ -2783,17 +2783,110 @@ function materializeTemplateAtTag(repo, version, git = defaultGit2) {
   return { dir, cleanup: () => rmSync3(dir, { recursive: true, force: true }) };
 }
 
-// src/lib/instance-seams.ts
+// src/lib/core-upgrade-target-fidelity.ts
+import { execFileSync as execFileSync4 } from "child_process";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 import { join as join9 } from "path";
+var VERBATIM_STATUSES = /* @__PURE__ */ new Set(["take-theirs", "added", "add-conflict", "restored"]);
+var DERIVED_STATUSES = /* @__PURE__ */ new Set(["merged", "conflict"]);
+var defaultGit3 = (args) => execFileSync4("git", args, { encoding: "utf8" });
+function blobId(content) {
+  const bytes = Buffer.from(content, "utf8");
+  return createHash2("sha1").update(`blob ${String(bytes.length)}\0`).update(bytes).digest("hex");
+}
+function tagBlobIds(repo, tag, git) {
+  const out = git(["-C", repo, "ls-tree", "-r", "-z", tag]);
+  const blobs = /* @__PURE__ */ new Map();
+  for (const record of out.split("\0")) {
+    if (record === "") continue;
+    const tab = record.indexOf("	");
+    if (tab === -1) continue;
+    const meta = record.slice(0, tab).split(" ");
+    const id = meta[2];
+    if (meta[1] !== "blob" || id === void 0) continue;
+    blobs.set(record.slice(tab + 1), id);
+  }
+  return blobs;
+}
+function assertTargetFidelity(options) {
+  const git = options.git ?? defaultGit3;
+  if (options.explicitTargetTree === true) {
+    return {
+      checked: 0,
+      findings: [],
+      unverifiable: "the target tree was supplied explicitly (--to-template), so there is no tag to compare against. Re-run with --to <version> to have the upgrade verify its own output."
+    };
+  }
+  const tag = coreTag(options.toVersion);
+  let blobs;
+  try {
+    blobs = tagBlobIds(options.templateRepo, tag, git);
+  } catch (err) {
+    return {
+      checked: 0,
+      findings: [],
+      unverifiable: `could not read ${tag} from ${options.templateRepo} to verify the upgrade's own output: ${err.message}`
+    };
+  }
+  const findings = [];
+  let checked = 0;
+  for (const entry of options.entries) {
+    let content;
+    let source;
+    if (VERBATIM_STATUSES.has(entry.status)) {
+      content = entry.content;
+      source = "output";
+    } else if (DERIVED_STATUSES.has(entry.status)) {
+      const abs = join9(options.theirsDir, entry.path);
+      content = existsSync8(abs) ? readFileSync6(abs, "utf8") : void 0;
+      source = "merge-input";
+    } else {
+      continue;
+    }
+    if (content === void 0) continue;
+    checked++;
+    const expected = blobs.get(entry.path);
+    if (expected === void 0) {
+      findings.push({ path: entry.path, reason: "absent-from-tag", source });
+      continue;
+    }
+    if (blobId(content) === expected) continue;
+    let tagText;
+    try {
+      tagText = git(["-C", options.templateRepo, "show", `${tag}:${entry.path}`]);
+    } catch {
+      findings.push({ path: entry.path, reason: "content-differs", source });
+      continue;
+    }
+    if (tagText !== content) {
+      findings.push({ path: entry.path, reason: "content-differs", source });
+    }
+  }
+  return { checked, findings, unverifiable: null };
+}
+function fidelityFailure(report, toVersion) {
+  const lines = report.findings.map((f) => {
+    const why = f.reason === "absent-from-tag" ? "resolved content for a path the tag does not contain" : "content differs from the tag";
+    return `  ${f.path} \u2014 ${why} (${f.source})`;
+  });
+  return `This upgrade resolved content that is not what core-v${toVersion} ships, for ${String(report.findings.length)} of ${String(report.checked)} checked path(s):
+${lines.join("\n")}
+
+An upgrade must be reproducible from a version number, so this is refused rather than distributed (#1399). The content came from somewhere other than the tag \u2014 a stale or wrong template checkout, or an unmerged branch. Verify the template repo is at the target tag and re-run; do not commit the plan as-is.`;
+}
+
+// src/lib/instance-seams.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { join as join10 } from "path";
 var INSTANCE_SEAM_PREFIX = "@/instance-";
 function readSeams(templateDir, portalRelDir) {
   const seams = /* @__PURE__ */ new Map();
-  const tsconfigPath = join9(templateDir, portalRelDir, "tsconfig.json");
-  if (!existsSync8(tsconfigPath)) return seams;
+  const tsconfigPath = join10(templateDir, portalRelDir, "tsconfig.json");
+  if (!existsSync9(tsconfigPath)) return seams;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync6(tsconfigPath, "utf8"));
+    parsed = JSON.parse(readFileSync7(tsconfigPath, "utf8"));
   } catch {
     return seams;
   }
@@ -2816,15 +2909,15 @@ function findNewUndeclaredSeams(baseDir, theirsDir, oursDir, portalRelDir = "app
   const undeclared = [];
   for (const [specifier, seam] of theirsSeams) {
     if (baseSeams.has(specifier)) continue;
-    if (existsSync8(join9(oursDir, seam.instanceFile))) continue;
+    if (existsSync9(join10(oursDir, seam.instanceFile))) continue;
     undeclared.push(seam);
   }
   return undeclared.sort((a, b) => a.specifier.localeCompare(b.specifier));
 }
 
 // src/lib/breaking-changes.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { join as join11 } from "path";
 var UPGRADE_GUIDE_PATH = "docs/guides/core-upgrade.md";
 var SECTION_HEADING = "## Breaking changes by version";
 var ENTRY_HEADING = /^###\s+(\d+\.\d+\.\d+)\s*[—-]\s*(.+?)\s*$/;
@@ -2849,9 +2942,9 @@ function parseBreakingChanges(guide) {
   return entries;
 }
 function readBreakingChanges(templateRoot) {
-  const path = join10(templateRoot, UPGRADE_GUIDE_PATH);
-  if (!existsSync9(path)) return [];
-  return parseBreakingChanges(readFileSync7(path, "utf8"));
+  const path = join11(templateRoot, UPGRADE_GUIDE_PATH);
+  if (!existsSync10(path)) return [];
+  return parseBreakingChanges(readFileSync8(path, "utf8"));
 }
 function breakingChangesBetween(from, to, entries) {
   parseCoreVersion(from);
@@ -2868,8 +2961,8 @@ var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
 ];
 
 // src/lib/plugin-terraform-wiring.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join12 } from "path";
 var TEMPLATE_MODULE_DIR = "_template";
 var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
 var GENERATED_TF_FILE = "plugins.generated.tf";
@@ -2894,7 +2987,7 @@ function standardArguments(pluginName, handler) {
   ];
 }
 function listPluginModules(cwd) {
-  const dir = join11(cwd, "modules", "plugins");
+  const dir = join12(cwd, "modules", "plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -2906,7 +2999,7 @@ function listPluginModules(cwd) {
 var FIRST_PARTY_TERRAFORM = (name) => `../../../services/_plugins/${name}/terraform`;
 var THIRD_PARTY_TERRAFORM = (name) => `../../../modules/plugins/${name}`;
 function isFirstPartyPlugin(cwd, name) {
-  return existsSync10(join11(cwd, "services", "_plugins", name, "terraform", "main.tf"));
+  return existsSync11(join12(cwd, "services", "_plugins", name, "terraform", "main.tf"));
 }
 function pluginModuleSource(cwd, name) {
   return isFirstPartyPlugin(cwd, name) ? FIRST_PARTY_TERRAFORM(name) : THIRD_PARTY_TERRAFORM(name);
@@ -2915,7 +3008,7 @@ function listWireablePlugins(cwd) {
   return listPluginModules(cwd).filter((name) => !isFirstPartyPlugin(cwd, name)).sort();
 }
 function firstPartyPluginNames(cwd) {
-  const dir = join11(cwd, "services", "_plugins");
+  const dir = join12(cwd, "services", "_plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -2929,7 +3022,7 @@ function staleFirstPartyCopies(cwd) {
   return firstPartyPluginNames(cwd).filter((name) => copied.has(name));
 }
 function listEnvironments(cwd) {
-  const dir = join11(cwd, "infra", "environments");
+  const dir = join12(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -2937,12 +3030,12 @@ function listEnvironments(cwd) {
     return [];
   }
   return entries.filter((e) => {
-    if (!e.isDirectory() || !existsSync10(join11(dir, e.name, "main.tf"))) return false;
-    return declaredVariables(join11(dir, e.name)).has("enabled_plugins");
+    if (!e.isDirectory() || !existsSync11(join12(dir, e.name, "main.tf"))) return false;
+    return declaredVariables(join12(dir, e.name)).has("enabled_plugins");
   }).map((e) => e.name).sort();
 }
 function listUnwirableEnvironments(cwd) {
-  const dir = join11(cwd, "infra", "environments");
+  const dir = join12(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -2950,7 +3043,7 @@ function listUnwirableEnvironments(cwd) {
     return [];
   }
   return entries.filter(
-    (e) => e.isDirectory() && existsSync10(join11(dir, e.name, "main.tf")) && !declaredVariables(join11(dir, e.name)).has("enabled_plugins")
+    (e) => e.isDirectory() && existsSync11(join12(dir, e.name, "main.tf")) && !declaredVariables(join12(dir, e.name)).has("enabled_plugins")
   ).map((e) => e.name).sort();
 }
 function declaredVariables(moduleDir) {
@@ -2965,7 +3058,7 @@ function declaredVariables(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync8(join11(moduleDir, entry.name), "utf8");
+      contents = readFileSync9(join12(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -2987,7 +3080,7 @@ function declaredOutputs(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync8(join11(moduleDir, entry.name), "utf8");
+      contents = readFileSync9(join12(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -3069,7 +3162,7 @@ function syncPluginTerraform(cwd) {
   const skippedEnvironments = listUnwirableEnvironments(cwd);
   const changedPaths = [];
   const rendered = plugins.map((name) => {
-    const moduleDir = join11(cwd, "modules", "plugins", name);
+    const moduleDir = join12(cwd, "modules", "plugins", name);
     return {
       name,
       declaredVariables: declaredVariables(moduleDir),
@@ -3078,16 +3171,16 @@ function syncPluginTerraform(cwd) {
     };
   });
   for (const env of environments) {
-    const envDir = join11(cwd, "infra", "environments", env);
-    const tfPath = join11(envDir, GENERATED_TF_FILE);
-    const tfvarsPath = join11(envDir, GENERATED_TFVARS_FILE);
+    const envDir = join12(cwd, "infra", "environments", env);
+    const tfPath = join12(envDir, GENERATED_TF_FILE);
+    const tfvarsPath = join12(envDir, GENERATED_TFVARS_FILE);
     const relBase = `infra/environments/${env}`;
     if (plugins.length === 0) {
       for (const [abs, rel] of [
         [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
         [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
       ]) {
-        if (existsSync10(abs)) {
+        if (existsSync11(abs)) {
           rmSync4(abs);
           changedPaths.push(rel);
         }
@@ -3103,8 +3196,8 @@ function syncPluginTerraform(cwd) {
 }
 
 // src/lib/lockfile-refresh.ts
-import { existsSync as existsSync11 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { join as join13 } from "path";
 var LOCKFILE_TRIGGERS = [
   {
     manifest: "package.json",
@@ -3127,7 +3220,7 @@ function lockfilesNeedingRefresh(changedPaths, instanceDir, triggers = LOCKFILE_
   const locked = changedPaths.filter((p) => !isForeignManifest(p));
   return triggers.filter((t) => {
     const touched = locked.some((p) => p === t.manifest || p.endsWith(`/${t.manifest}`));
-    return touched && existsSync11(join12(instanceDir, t.lockfile));
+    return touched && existsSync12(join13(instanceDir, t.lockfile));
   });
 }
 async function refreshLockfiles(instanceDir, triggers, run) {
@@ -3147,11 +3240,11 @@ function describeFailures(outcomes) {
 }
 
 // src/lib/instance-dependency-install.ts
-import { existsSync as existsSync12 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { join as join14 } from "path";
 function dependencyInstallSteps(instanceDir) {
   const steps = [{ ecosystem: "pnpm", command: ["pnpm", "install"] }];
-  if (existsSync12(join13(instanceDir, "pyproject.toml"))) {
+  if (existsSync13(join14(instanceDir, "pyproject.toml"))) {
     steps.push({ ecosystem: "uv", command: ["uv", "sync"] });
   }
   return steps;
@@ -3363,6 +3456,13 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   });
   const orphanRatchet = checkOrphanRatchet(plan.orphaned.length, readOrphanBaseline(options.cwd));
   const newSeams = findNewUndeclaredSeams(baseDir, theirsDir, options.cwd);
+  const fidelity = assertTargetFidelity({
+    entries: plan.entries,
+    templateRepo,
+    toVersion,
+    theirsDir,
+    explicitTargetTree: options.theirsDir !== void 0
+  });
   const heading = options.apply ? "Biffo core upgrade" : "Biffo core upgrade (dry run)";
   console.log(chalk4.bold(`
   ${heading}
@@ -3371,6 +3471,10 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   console.log(`  merge base:      ${fromVersion}`);
   console.log(`  target:          ${toVersion}
 `);
+  printTargetFidelity(fidelity, toVersion);
+  if (fidelity.findings.length > 0) {
+    throw new Error(fidelityFailure(fidelity, toVersion));
+  }
   printNewInstanceSeams(newSeams);
   printOrphanReport(plan.orphaned, orphanRatchet);
   if (orphanRatchet.increased) {
@@ -3518,7 +3622,7 @@ async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion
     );
   }
   const cleanedCoreVersion = coreVersionCleanup?.action === "delete";
-  if (cleanedCoreVersion && existsSync13(coreVersionCleanup.path)) {
+  if (cleanedCoreVersion && existsSync14(coreVersionCleanup.path)) {
     rmSync5(coreVersionCleanup.path);
     log.info(
       coreVersionCleanup.stale ? `Deleted stale ${CORE_VERSION_FILE} (recorded ${coreVersionCleanup.found}, behind the version biffo.core.json records \u2014 this instance has moved past it) (#842).` : `Deleted orphaned ${CORE_VERSION_FILE} (inherited copy recording ${coreVersionCleanup.found}, superseded by biffo.core.json) \u2014 nothing reads it as an authority (#434).`
@@ -3863,6 +3967,29 @@ function printNewInstanceSeams(seams) {
   }
   console.log();
 }
+function printTargetFidelity(report, toVersion) {
+  if (report.unverifiable !== null) {
+    console.log(chalk4.yellow(`  Target fidelity: NOT VERIFIED \u2014 ${report.unverifiable}`));
+    console.log();
+    return;
+  }
+  if (report.findings.length === 0) {
+    console.log(
+      chalk4.dim(
+        `  Target fidelity: ${String(report.checked)} path(s) verified byte-identical to core-v${toVersion}.`
+      )
+    );
+    console.log();
+    return;
+  }
+  console.log(
+    chalk4.red(
+      `  Target fidelity: ${String(report.findings.length)} of ${String(report.checked)} checked path(s) are NOT core-v${toVersion} content (#1399):`
+    )
+  );
+  for (const f of report.findings) console.log(`    ${chalk4.red(f.path)} \u2014 ${f.reason}`);
+  console.log();
+}
 function printOrphanReport(orphaned, ratchet) {
   if (orphaned.length === 0 && ratchet.baseline === null) return;
   console.log(
@@ -3956,8 +4083,8 @@ function printBreakingChanges(breaking, applying) {
 }
 function versionOfCheckout(dir, explicit) {
   if (explicit) return explicit;
-  const file = join14(dir, CORE_VERSION_FILE);
-  if (existsSync13(file)) return readCoreVersionFile(file);
+  const file = join15(dir, CORE_VERSION_FILE);
+  if (existsSync14(file)) return readCoreVersionFile(file);
   throw new Error(
     `Cannot determine the core version of ${dir}: it has no ${CORE_VERSION_FILE}, and a checkout supplied explicitly is not resolved from a tag. Pass --to to state which version this tree is.`
   );
@@ -3965,8 +4092,8 @@ function versionOfCheckout(dir, explicit) {
 function latestCoreVersion(repo) {
   const fromTags = latestCoreVersionFromTags(repo);
   if (fromTags) return fromTags;
-  const file = join14(repo, CORE_VERSION_FILE);
-  if (existsSync13(file)) return readCoreVersionFile(file);
+  const file = join15(repo, CORE_VERSION_FILE);
+  if (existsSync14(file)) return readCoreVersionFile(file);
   throw new Error(
     `Cannot determine the template's core version: ${repo} has no core-v* tags and no ${CORE_VERSION_FILE}. Fetch tags (\`git fetch --tags\`) or pass --to explicitly.`
   );
@@ -3984,7 +4111,7 @@ coreCommand.addCommand(coreUpgradeCommand);
 import { Command as Command8 } from "commander";
 
 // src/commands/data-apply.ts
-import { existsSync as existsSync15, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync11 } from "fs";
 import { resolve as resolve4 } from "path";
 import chalk5 from "chalk";
 import { Command as Command5 } from "commander";
@@ -4435,16 +4562,16 @@ function isTemplatePlaceholderConfig(raw) {
 
 // src/lib/session.ts
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   rmSync as rmSync6,
   statSync as statSync2,
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var LEGACY_STEP_ALIASES = {
   github_config: ["github_branches", "github_instance_files", "github_settings"]
 };
@@ -4453,39 +4580,39 @@ function hasCompleted(session, step) {
   return session.completedSteps.some((done) => LEGACY_STEP_ALIASES[done]?.includes(step) ?? false);
 }
 function sessionsDir() {
-  return process.env["BIFFO_SESSIONS_DIR"] ?? join15(homedir(), ".biffo", "sessions");
+  return process.env["BIFFO_SESSIONS_DIR"] ?? join16(homedir(), ".biffo", "sessions");
 }
 function sessionPath(projectName) {
-  return join15(sessionsDir(), `${projectName}.json`);
+  return join16(sessionsDir(), `${projectName}.json`);
 }
 function loadSession(projectName) {
   const path = sessionPath(projectName);
-  if (!existsSync14(path)) return null;
+  if (!existsSync15(path)) return null;
   try {
-    return JSON.parse(readFileSync9(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch {
     return null;
   }
 }
 function findLatestSession() {
   const dir = sessionsDir();
-  if (!existsSync14(dir)) return null;
+  if (!existsSync15(dir)) return null;
   const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return null;
   const sorted = files.map((f) => {
-    const fullPath = join15(dir, f);
-    const mtime = existsSync14(fullPath) ? statSync2(fullPath).mtimeMs : -1;
+    const fullPath = join16(dir, f);
+    const mtime = existsSync15(fullPath) ? statSync2(fullPath).mtimeMs : -1;
     return { f, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   try {
-    return JSON.parse(readFileSync9(join15(dir, sorted[0].f), "utf8"));
+    return JSON.parse(readFileSync10(join16(dir, sorted[0].f), "utf8"));
   } catch {
     return null;
   }
 }
 function saveSession(session) {
   const dir = sessionsDir();
-  if (!existsSync14(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync15(dir)) mkdirSync4(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSession(name);
   if (prior) {
@@ -4507,36 +4634,36 @@ function markStepComplete(session, step) {
 }
 function deleteSession(projectName) {
   const path = sessionPath(projectName);
-  if (existsSync14(path)) rmSync6(path);
+  if (existsSync15(path)) rmSync6(path);
 }
 function projectsDir() {
-  return process.env["BIFFO_PROJECTS_DIR"] ?? join15(homedir(), ".biffo", "projects");
+  return process.env["BIFFO_PROJECTS_DIR"] ?? join16(homedir(), ".biffo", "projects");
 }
 function saveProjectConfig(config) {
   const dir = projectsDir();
-  if (!existsSync14(dir)) mkdirSync4(dir, { recursive: true });
-  writeFileSync5(join15(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
+  if (!existsSync15(dir)) mkdirSync4(dir, { recursive: true });
+  writeFileSync5(join16(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
 }
 function loadProjectConfig(name) {
-  const path = join15(projectsDir(), `${name}.json`);
-  if (!existsSync14(path)) return null;
+  const path = join16(projectsDir(), `${name}.json`);
+  if (!existsSync15(path)) return null;
   try {
-    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync9(path, "utf8")));
+    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync10(path, "utf8")));
     return result.success ? result.data : null;
   } catch {
     return null;
   }
 }
 function deleteProjectConfig(name) {
-  const path = join15(projectsDir(), `${name}.json`);
-  if (existsSync14(path)) rmSync6(path);
+  const path = join16(projectsDir(), `${name}.json`);
+  if (existsSync15(path)) rmSync6(path);
 }
 function listProjectConfigs() {
   const dir = projectsDir();
-  if (!existsSync14(dir)) return [];
+  if (!existsSync15(dir)) return [];
   return readdirSync4(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
     try {
-      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync9(join15(dir, f), "utf8")));
+      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync10(join16(dir, f), "utf8")));
       return result.success ? [result.data] : [];
     } catch {
       return [];
@@ -4605,7 +4732,7 @@ async function runDataApply(name, environment, config, aws) {
 }
 async function resolveConfig(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync10(resolve4(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync11(resolve4(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -4625,8 +4752,8 @@ async function resolveConfig(options) {
     return cfg;
   }
   const localConfigPath = resolve4(process.cwd(), "biffo.config.json");
-  if (existsSync15(localConfigPath)) {
-    const raw = JSON.parse(readFileSync10(localConfigPath, "utf8"));
+  if (existsSync16(localConfigPath)) {
+    const raw = JSON.parse(readFileSync11(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -4672,8 +4799,8 @@ async function resolveConfig(options) {
 
 // src/commands/data-import.ts
 import { execSync as execSync3 } from "child_process";
-import { cpSync, existsSync as existsSync16, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
-import { join as join16, resolve as resolve5 } from "path";
+import { cpSync, existsSync as existsSync17, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { join as join17, resolve as resolve5 } from "path";
 import chalk6 from "chalk";
 import { Command as Command6 } from "commander";
 import inquirer2 from "inquirer";
@@ -4713,23 +4840,23 @@ async function runDataImport(name, options, deps) {
       `Invalid import name '${name}'. Use lowercase letters, numbers, and hyphens, starting with a letter.`
     );
   }
-  const servicesDir = join16(options.cwd, "services");
-  if (!existsSync16(servicesDir)) {
+  const servicesDir = join17(options.cwd, "services");
+  if (!existsSync17(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join16(options.cwd, "db", "imports", name);
-  if (existsSync16(targetDir)) {
+  const targetDir = join17(options.cwd, "db", "imports", name);
+  if (existsSync17(targetDir)) {
     throw new Error(
       `DDL import '${name}' is already present at db/imports/${name}/. Remove it first to re-import.`
     );
   }
-  const isLocalDir = existsSync16(options.source) && statSync3(options.source).isDirectory();
+  const isLocalDir = existsSync17(options.source) && statSync3(options.source).isDirectory();
   let sourceDir;
   let cleanupClone = null;
   if (isLocalDir) {
-    sourceDir = options.path ? join16(options.source, options.path) : options.source;
+    sourceDir = options.path ? join17(options.source, options.path) : options.source;
   } else {
     const token = options.token ?? await resolveDdlImportToken();
     log.info(`Cloning ${options.source}...`);
@@ -4737,10 +4864,10 @@ async function runDataImport(name, options, deps) {
     cleanupClone = () => {
       deps.git.cleanup(tmpDir);
     };
-    sourceDir = options.path ? join16(tmpDir, options.path) : tmpDir;
+    sourceDir = options.path ? join17(tmpDir, options.path) : tmpDir;
   }
   try {
-    if (!existsSync16(sourceDir)) {
+    if (!existsSync17(sourceDir)) {
       throw new Error(`Source directory does not exist: ${sourceDir}`);
     }
     const sqlFiles = readdirSync5(sourceDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name).sort();
@@ -4765,7 +4892,7 @@ async function runDataImport(name, options, deps) {
     }
     mkdirSync5(targetDir, { recursive: true });
     for (const file of sqlFiles) {
-      cpSync(join16(sourceDir, file), join16(targetDir, file));
+      cpSync(join17(sourceDir, file), join17(targetDir, file));
     }
     log.success(`Imported ${String(sqlFiles.length)} .sql file(s) to db/imports/${name}/`);
     const commitMessage = `feat(data): import ${name} (${String(sqlFiles.length)} SQL file(s))`;
@@ -4817,8 +4944,8 @@ function printDryRun(name, sqlFiles) {
 }
 
 // src/commands/data-list.ts
-import { existsSync as existsSync17, readdirSync as readdirSync6 } from "fs";
-import { join as join17, resolve as resolve6 } from "path";
+import { existsSync as existsSync18, readdirSync as readdirSync6 } from "fs";
+import { join as join18, resolve as resolve6 } from "path";
 import chalk7 from "chalk";
 import { Command as Command7 } from "commander";
 var dataListCommand = new Command7("list").description("List DDL imports vendored in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -4831,15 +4958,15 @@ var dataListCommand = new Command7("list").description("List DDL imports vendore
   }
 });
 async function runDataList(options) {
-  const importsDir = join17(options.cwd, "db", "imports");
-  if (!existsSync17(importsDir)) {
+  const importsDir = join18(options.cwd, "db", "imports");
+  if (!existsSync18(importsDir)) {
     console.log(chalk7.dim("\n  No DDL imports in this checkout.\n"));
     return;
   }
   const candidates = readdirSync6(importsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
   const imports = [];
   for (const name of candidates) {
-    const fileCount = readdirSync6(join17(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
+    const fileCount = readdirSync6(join18(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
     if (fileCount > 0) imports.push({ name, fileCount });
   }
   if (imports.length === 0) {
@@ -4869,7 +4996,7 @@ dataCommand.addCommand(dataListCommand);
 
 // src/commands/deploy.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync12 } from "fs";
 import { resolve as resolve7 } from "path";
 import chalk8 from "chalk";
 import { Command as Command9 } from "commander";
@@ -5226,7 +5353,7 @@ var deployCommand = new Command9("deploy").description("Deploy infrastructure an
 );
 async function resolveConfig2(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync11(resolve7(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync12(resolve7(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -5246,8 +5373,8 @@ async function resolveConfig2(options) {
     return cfg;
   }
   const localConfigPath = resolve7(process.cwd(), "biffo.config.json");
-  if (existsSync18(localConfigPath)) {
-    const raw = JSON.parse(readFileSync11(localConfigPath, "utf8"));
+  if (existsSync19(localConfigPath)) {
+    const raw = JSON.parse(readFileSync12(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -5643,7 +5770,7 @@ function resolveGithubToken() {
 
 // src/commands/destroy.ts
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { resolve as resolve8 } from "path";
 import chalk9 from "chalk";
 import { Command as Command10 } from "commander";
@@ -5733,7 +5860,7 @@ var destroyCommand = new Command10("destroy").description("Destroy infrastructur
 });
 async function resolveConfig3(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync12(resolve8(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync13(resolve8(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -5753,7 +5880,7 @@ async function resolveConfig3(options) {
     return cfg;
   }
   try {
-    const raw = JSON.parse(readFileSync12(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
+    const raw = JSON.parse(readFileSync13(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
   } catch {
@@ -5803,15 +5930,15 @@ function resolveGithubToken2() {
 }
 
 // src/commands/init.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 import { resolve as resolve10 } from "path";
 import chalk12 from "chalk";
 import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
-import { existsSync as existsSync19, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
-import { dirname as dirname5, join as join18, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
+import { dirname as dirname5, join as join19, relative as relative2, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SKIP_ENV_VAR = "BIFFO_SKIP_BUILD_FRESHNESS_CHECK";
 function checkBuildFreshness(options = {}) {
@@ -5825,7 +5952,7 @@ function checkBuildFreshness(options = {}) {
   if (!packageRoot) {
     return { status: "skipped", reason: `no package.json above ${moduleDir}`, newerSources: [] };
   }
-  const distDir = join18(packageRoot, "dist");
+  const distDir = join19(packageRoot, "dist");
   if (!isInside(distDir, moduleDir)) {
     return {
       status: "skipped",
@@ -5833,16 +5960,16 @@ function checkBuildFreshness(options = {}) {
       newerSources: []
     };
   }
-  const srcDir = join18(packageRoot, "src");
-  if (!existsSync19(srcDir)) {
+  const srcDir = join19(packageRoot, "src");
+  if (!existsSync20(srcDir)) {
     return {
       status: "skipped",
       reason: "no src/ alongside dist/ \u2014 this is a shipped package",
       newerSources: []
     };
   }
-  const entry = join18(distDir, "index.js");
-  if (!existsSync19(entry)) {
+  const entry = join19(distDir, "index.js");
+  if (!existsSync20(entry)) {
     return { status: "skipped", reason: `${entry} not found`, newerSources: [] };
   }
   const builtAt = statSync4(entry).mtimeMs;
@@ -5886,7 +6013,7 @@ function collectSourceFiles(srcDir) {
   const found = [];
   const walk = (dir) => {
     for (const entry of readdirSync7(dir, { withFileTypes: true })) {
-      const full = join18(dir, entry.name);
+      const full = join19(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules") continue;
         walk(full);
@@ -5905,7 +6032,7 @@ function collectSourceFiles(srcDir) {
 function findPackageRoot(from) {
   let dir = from;
   for (; ; ) {
-    if (existsSync19(join18(dir, "package.json"))) return dir;
+    if (existsSync20(join19(dir, "package.json"))) return dir;
     const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -5919,9 +6046,9 @@ function isInside(parent, child) {
 
 // src/lib/credentials.ts
 import { execSync as execSync6 } from "child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync14 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand2, STSClient as STSClient2 } from "@aws-sdk/client-sts";
 import chalk10 from "chalk";
 import inquirer4 from "inquirer";
@@ -6100,11 +6227,11 @@ async function verifySelectedAwsCredentials(profile, region) {
   return sts.send(new GetCallerIdentityCommand2({}));
 }
 function discoverAwsProfiles() {
-  const files = [join19(homedir2(), ".aws", "credentials"), join19(homedir2(), ".aws", "config")];
+  const files = [join20(homedir2(), ".aws", "credentials"), join20(homedir2(), ".aws", "config")];
   const profiles = /* @__PURE__ */ new Set();
   for (const file of files) {
-    if (!existsSync20(file)) continue;
-    const content = readFileSync13(file, "utf8");
+    if (!existsSync21(file)) continue;
+    const content = readFileSync14(file, "utf8");
     for (const match of content.matchAll(/^\s*\[([^\]]+)\]\s*$/gm)) {
       const section = match[1]?.trim();
       if (!section) continue;
@@ -6194,34 +6321,34 @@ var SiblingConfigSchema = z6.object({
 
 // src/lib/sibling-session.ts
 import {
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync6,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   rmSync as rmSync7,
   statSync as statSync5,
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 function sessionsDir2() {
-  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join20(homedir3(), ".biffo", "sibling-sessions");
+  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join21(homedir3(), ".biffo", "sibling-sessions");
 }
 function sessionPath2(projectName) {
-  return join20(sessionsDir2(), `${projectName}.json`);
+  return join21(sessionsDir2(), `${projectName}.json`);
 }
 function loadSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (!existsSync21(path)) return null;
+  if (!existsSync22(path)) return null;
   try {
-    return JSON.parse(readFileSync14(path, "utf8"));
+    return JSON.parse(readFileSync15(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveSiblingSession(session) {
   const dir = sessionsDir2();
-  if (!existsSync21(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync22(dir)) mkdirSync6(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSiblingSession(name);
   if (prior) {
@@ -6243,30 +6370,30 @@ function markSiblingStepComplete(session, step) {
 }
 function deleteSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (existsSync21(path)) rmSync7(path);
+  if (existsSync22(path)) rmSync7(path);
 }
 
 // src/commands/sibling-create.ts
-import { cpSync as cpSync2, existsSync as existsSync22, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync23, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname6, join as join22, resolve as resolve9 } from "path";
+import { dirname as dirname6, join as join23, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import chalk11 from "chalk";
 import { Command as Command11 } from "commander";
 
 // src/lib/skeleton-dotfiles.ts
 import { readdirSync as readdirSync9, renameSync } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var PACKAGED_GITIGNORE = "_gitignore";
 var REAL_GITIGNORE = ".gitignore";
 function restorePackagedDotfiles(dir) {
   const restored = [];
   for (const entry of readdirSync9(dir, { withFileTypes: true })) {
-    const full = join21(dir, entry.name);
+    const full = join22(dir, entry.name);
     if (entry.isDirectory()) {
       restored.push(...restorePackagedDotfiles(full));
     } else if (entry.name === PACKAGED_GITIGNORE) {
-      const target = join21(dir, REAL_GITIGNORE);
+      const target = join22(dir, REAL_GITIGNORE);
       renameSync(full, target);
       restored.push(target);
     }
@@ -6311,7 +6438,7 @@ async function runSiblingCreateCommand(name, options) {
     printDryRun2(config, coreConfig, options.templateRoot);
     return;
   }
-  if (!existsSync22(options.templateRoot)) {
+  if (!existsSync23(options.templateRoot)) {
     throw new Error(`Sibling template not found at ${options.templateRoot}`);
   }
   let session = null;
@@ -6528,7 +6655,7 @@ function assertPathPrefixIsAllowed(pathPrefix) {
   }
 }
 function readSiblingConfig(path, root = false) {
-  const raw = JSON.parse(readFileSync15(path, "utf8"));
+  const raw = JSON.parse(readFileSync16(path, "utf8"));
   const withDefaults = raw && typeof raw === "object" && "project" in raw && "core" in raw ? {
     ...raw,
     core: {
@@ -6562,7 +6689,7 @@ function resolveCoreConfig(config, configPath) {
   throw new Error("Either core.project_name or core.config_path is required.");
 }
 function parseCoreConfig(path) {
-  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync15(path, "utf8")));
+  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync16(path, "utf8")));
   if (!result.success) {
     throw new Error(
       `Invalid core configuration at ${path}:
@@ -6601,7 +6728,7 @@ async function resolveCoreIdentity(coreAws, coreConfig, environments) {
   return coreIdentity;
 }
 async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
-  const workDir = mkdtempSync4(join22(tmpdir4(), `biffo-sibling-${config.project.name}-`));
+  const workDir = mkdtempSync4(join23(tmpdir4(), `biffo-sibling-${config.project.name}-`));
   try {
     writeSiblingTemplate(skeletonRoot, workDir, config, {
       coreProjectName: coreConfig.project.name,
@@ -6626,13 +6753,13 @@ async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, git
   }
 }
 function writeSiblingTemplate(templateRoot, targetDir, config, context) {
-  if (!existsSync22(templateRoot)) {
+  if (!existsSync23(templateRoot)) {
     throw new Error(`Sibling template not found at ${templateRoot}`);
   }
   cpSync2(templateRoot, targetDir, { recursive: true });
   restorePackagedDotfiles(targetDir);
   writeFileSync7(
-    join22(targetDir, "biffo.sibling.json"),
+    join23(targetDir, "biffo.sibling.json"),
     JSON.stringify(
       {
         name: config.project.name,
@@ -6651,14 +6778,14 @@ function writeSiblingTemplate(templateRoot, targetDir, config, context) {
     ) + "\n"
   );
   writeFileSync7(
-    join22(targetDir, ".biffo-shared-version"),
+    join23(targetDir, ".biffo-shared-version"),
     `core-v${context.templateVersion.replace(/^core-v/, "")}
 `
   );
-  const envPath = join22(targetDir, "apps", "frontend", ".env.example");
+  const envPath = join23(targetDir, "apps", "frontend", ".env.example");
   try {
     const path = basePathFor(context.pathPrefix);
-    const content = readFileSync15(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
+    const content = readFileSync16(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
     writeFileSync7(envPath, content);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
@@ -6705,7 +6832,7 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
 }
 function readExistingSiblingOrigins(filePath) {
   try {
-    return JSON.parse(readFileSync15(filePath, "utf8"));
+    return JSON.parse(readFileSync16(filePath, "utf8"));
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw err;
@@ -6724,10 +6851,10 @@ function assertGitIdentity(identity) {
   );
 }
 function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
-  const cdnVarsPath = join22(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
+  const cdnVarsPath = join23(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
   let declaresSiblingOrigins = false;
   try {
-    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync15(cdnVarsPath, "utf8"));
+    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync16(cdnVarsPath, "utf8"));
   } catch {
     declaresSiblingOrigins = false;
   }
@@ -6737,10 +6864,10 @@ function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x")
     );
   }
   if (!isRootPathPrefix(pathPrefix)) return;
-  const cdnMainPath = join22(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
+  const cdnMainPath = join23(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
   let supportsRoot = false;
   try {
-    supportsRoot = /root_sibling_registered/.test(readFileSync15(cdnMainPath, "utf8"));
+    supportsRoot = /root_sibling_registered/.test(readFileSync16(cdnMainPath, "utf8"));
   } catch {
     supportsRoot = false;
   }
@@ -6770,8 +6897,8 @@ async function registerWithCore(git, github, config, coreConfig, pathPrefix, git
     for (const env of config.environments) {
       const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
       const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
-      const relativePath = join22("infra", "environments", env, "siblings.auto.tfvars.json");
-      const filePath = join22(cloneDir, relativePath);
+      const relativePath = join23("infra", "environments", env, "siblings.auto.tfvars.json");
+      const filePath = join23(cloneDir, relativePath);
       const existing = readExistingSiblingOrigins(filePath);
       const siblings = upsertSiblingOrigin(existing.sibling_origins ?? [], {
         name,
@@ -6851,8 +6978,8 @@ function defaultSiblingTemplateRoot() {
   const start = dirname6(fileURLToPath4(import.meta.url));
   let dir = start;
   for (; ; ) {
-    const candidate = join22(dir, "_skeletons", "sibling-template");
-    if (existsSync22(candidate)) return candidate;
+    const candidate = join23(dir, "_skeletons", "sibling-template");
+    if (existsSync23(candidate)) return candidate;
     const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
@@ -6876,7 +7003,7 @@ var initCommand = new Command12("init").description("Scaffold a new project from
     let config;
     let githubToken;
     if (options.config) {
-      const rawConfig = JSON.parse(readFileSync16(resolve10(options.config), "utf8"));
+      const rawConfig = JSON.parse(readFileSync17(resolve10(options.config), "utf8"));
       config = parseConfig(rawConfig);
       const { account_id: accountId, region } = config.cloud.config;
       session = resolveConfigFileSession(config, accountId, region, options.fresh === true);
@@ -7321,8 +7448,8 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 import { Command as Command20 } from "commander";
 
 // src/commands/plugin-create.ts
-import { existsSync as existsSync25, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname8, join as join25, resolve as resolve11 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join26, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
@@ -7386,21 +7513,21 @@ function workflowCheckContexts(workflow) {
 }
 
 // src/lib/plugin-locations.ts
-import { existsSync as existsSync23, readdirSync as readdirSync10 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync10 } from "fs";
+import { join as join24 } from "path";
 var FIRST_PARTY_PLUGINS_DIR = "_plugins";
 var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
 function pluginDir(name, channel) {
   return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
 }
 function scanDir(absDir, relDir, channel) {
-  if (!existsSync23(absDir)) return [];
+  if (!existsSync24(absDir)) return [];
   const found = [];
   for (const entry of readdirSync10(absDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
-    const manifestPath = join23(absDir, entry.name, PLUGIN_MANIFEST_FILE);
-    if (!existsSync23(manifestPath)) continue;
+    const manifestPath = join24(absDir, entry.name, PLUGIN_MANIFEST_FILE);
+    if (!existsSync24(manifestPath)) continue;
     found.push({
       dirName: entry.name,
       relDir: `${relDir}/${entry.name}`,
@@ -7411,11 +7538,11 @@ function scanDir(absDir, relDir, channel) {
   return found;
 }
 function findInstalledPlugins(cwd) {
-  const servicesDir = join23(cwd, "services");
+  const servicesDir = join24(cwd, "services");
   return [
     ...scanDir(servicesDir, "services", "third-party"),
     ...scanDir(
-      join23(servicesDir, FIRST_PARTY_PLUGINS_DIR),
+      join24(servicesDir, FIRST_PARTY_PLUGINS_DIR),
       `services/${FIRST_PARTY_PLUGINS_DIR}`,
       "first-party"
     )
@@ -7618,13 +7745,13 @@ function validateManifest(raw) {
 // src/lib/plugin-scaffold.ts
 import {
   copyFileSync,
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   readdirSync as readdirSync11,
   writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname7, join as join24 } from "path";
+import { dirname as dirname7, join as join25 } from "path";
 var STANDALONE_ONLY_ENTRIES = {
   ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
   "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
@@ -7678,10 +7805,10 @@ function applySubstitutions(text, names) {
 var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
 function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
   const layout = options.layout ?? "in-tree";
-  if (!existsSync24(skeletonRoot)) {
+  if (!existsSync25(skeletonRoot)) {
     throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
   }
-  if (!existsSync24(join24(skeletonRoot, "terraform"))) {
+  if (!existsSync25(join25(skeletonRoot, "terraform"))) {
     throw new Error(
       `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
     );
@@ -7689,7 +7816,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
   const skipped = [];
   const files = [];
   const walk = (relDir) => {
-    const absDir = join24(skeletonRoot, relDir);
+    const absDir = join25(skeletonRoot, relDir);
     for (const entry of readdirSync11(absDir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     )) {
@@ -7704,14 +7831,14 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
         continue;
       }
       const destRel = applySubstitutions(relPath, names);
-      const destPath = join24(destDir, destRel);
+      const destPath = join25(destDir, destRel);
       mkdirSync8(dirname7(destPath), { recursive: true });
       if (BINARY_EXTENSIONS.test(entry.name)) {
-        copyFileSync(join24(skeletonRoot, relPath), destPath);
+        copyFileSync(join25(skeletonRoot, relPath), destPath);
       } else {
         writeFileSync8(
           destPath,
-          applySubstitutions(readFileSync17(join24(skeletonRoot, relPath), "utf8"), names)
+          applySubstitutions(readFileSync18(join25(skeletonRoot, relPath), "utf8"), names)
         );
       }
       files.push(destRel);
@@ -7728,8 +7855,8 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
 function findSkeletonRoot(startDir, skeleton) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join24(dir, "_skeletons", skeleton);
-    if (existsSync24(candidate)) return candidate;
+    const candidate = join25(dir, "_skeletons", skeleton);
+    if (existsSync25(candidate)) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -7797,7 +7924,7 @@ async function runPluginCreate(name, options, deps) {
     reportBranchProtectionSummary();
     return;
   }
-  const isInstance = existsSync25(join25(options.cwd, INSTANCE_CORE_FILE));
+  const isInstance = existsSync26(join26(options.cwd, INSTANCE_CORE_FILE));
   if (options.firstParty && isInstance) {
     throw new Error(
       `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
@@ -7805,19 +7932,19 @@ async function runPluginCreate(name, options, deps) {
   }
   const channel = options.firstParty ? "first-party" : "third-party";
   const relDir = pluginDir(names.slug, channel);
-  const destDir = join25(options.cwd, relDir);
-  const servicesDir = join25(options.cwd, "services");
-  if (!existsSync25(servicesDir)) {
+  const destDir = join26(options.cwd, relDir);
+  const servicesDir = join26(options.cwd, "services");
+  if (!existsSync26(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  if (existsSync25(destDir)) {
+  if (existsSync26(destDir)) {
     throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
   }
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join25(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync25(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join26(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync26(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -7832,8 +7959,8 @@ async function runPluginCreate(name, options, deps) {
   for (const { entry, reason } of skipped) {
     log.info(`Skipped ${entry} \u2014 ${reason}`);
   }
-  const manifestPath = join25(destDir, "biffo.plugin.json");
-  const manifest = validateManifest(JSON.parse(readFileSync18(manifestPath, "utf8")));
+  const manifestPath = join26(destDir, "biffo.plugin.json");
+  const manifest = validateManifest(JSON.parse(readFileSync19(manifestPath, "utf8")));
   if (manifest.name !== names.slug) {
     throw new Error(
       `Scaffolded manifest declares name '${manifest.name}', expected '${names.slug}'. The skeleton's manifest name may have diverged from 'example-plugin'.`
@@ -7856,8 +7983,8 @@ async function runPluginCreate(name, options, deps) {
   printNextSteps(names, relDir, channel);
 }
 async function runStandaloneCreate(names, options, deps) {
-  const destDir = join25(options.cwd, names.dist);
-  if (existsSync25(destDir)) {
+  const destDir = join26(options.cwd, names.dist);
+  if (existsSync26(destDir)) {
     throw new Error(`${names.dist}/ already exists. Choose a different name, or remove it first.`);
   }
   const skeletonRoot = resolveSkeletonRoot(options);
@@ -7875,7 +8002,7 @@ async function runStandaloneCreate(names, options, deps) {
   restorePackagedDotfiles(destDir);
   log.success(`Scaffolded ${String(files.length)} file(s) into ${names.dist}/`);
   const manifest = validateManifest(
-    JSON.parse(readFileSync18(join25(destDir, "biffo.plugin.json"), "utf8"))
+    JSON.parse(readFileSync19(join26(destDir, "biffo.plugin.json"), "utf8"))
   );
   if (manifest.name !== names.slug) {
     throw new Error(
@@ -7914,8 +8041,8 @@ async function createAndPushStandaloneRepo(org, names, destDir, options, deps) {
   await deps.git.push(destDir, "dev", { token });
   log.success(`Pushed dev to ${org}/${names.dist}`);
   await github.setDefaultBranch(org, names.dist, "dev");
-  const ciPath = join25(destDir, ".github", "workflows", "ci.yml");
-  const contexts = existsSync25(ciPath) ? workflowCheckContexts(readFileSync18(ciPath, "utf8")) : [];
+  const ciPath = join26(destDir, ".github", "workflows", "ci.yml");
+  const contexts = existsSync26(ciPath) ? workflowCheckContexts(readFileSync19(ciPath, "utf8")) : [];
   if (contexts.length === 0) {
     log.warn(
       `Could not determine required status checks from ${ciPath} \u2014 skipping branch protection. Configure it manually on dev once you know the CI job names.`
@@ -7944,8 +8071,8 @@ async function registerInRegistrySources(names, cloneUrl, token, deps) {
   let dir;
   try {
     dir = await deps.git.cloneForEditing(REGISTRY_REPO, "biffo-registry", token);
-    const path = join25(dir, "sources.json");
-    const file = JSON.parse(readFileSync18(path, "utf8"));
+    const path = join26(dir, "sources.json");
+    const file = JSON.parse(readFileSync19(path, "utf8"));
     const next = addSource(file, {
       name: names.slug,
       repo: cloneUrl.replace(/\.git$/, ""),
@@ -8053,8 +8180,8 @@ function printStandaloneNextSteps(names, minor) {
 }
 function resolveSkeletonRoot(options) {
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join25(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync25(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join26(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync26(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -8229,14 +8356,14 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync3, existsSync as existsSync27, mkdirSync as mkdirSync9, readFileSync as readFileSync20, statSync as statSync6 } from "fs";
-import { basename, join as join28, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync28, mkdirSync as mkdirSync9, readFileSync as readFileSync21, statSync as statSync6 } from "fs";
+import { basename, join as join29, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
 import { execa as execa4 } from "execa";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var PluginMigrationsAdapter = class {
   /**
    * Generates migration file(s) for `pluginNames` (every discovered
@@ -8245,22 +8372,22 @@ var PluginMigrationsAdapter = class {
    * or declared no tables.
    */
   async generate(cwd, pluginNames) {
-    const scriptPath = join26(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
+    const scriptPath = join27(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
     const args = [
       "run",
       "python",
       scriptPath,
       "--services-root",
-      join26(cwd, "services"),
+      join27(cwd, "services"),
       "--versions-dir",
-      join26(cwd, "services", "api", "migrations", "versions")
+      join27(cwd, "services", "api", "migrations", "versions")
     ];
     for (const name of pluginNames ?? []) {
       args.push("--plugin", name);
     }
     let result;
     try {
-      result = await execa4("uv", args, { cwd: join26(cwd, "services", "api") });
+      result = await execa4("uv", args, { cwd: join27(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -8277,8 +8404,8 @@ var PluginMigrationsAdapter = class {
 };
 
 // src/lib/plugin-workspace-sources.ts
-import { existsSync as existsSync26, readdirSync as readdirSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync10 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync12, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
+import { join as join28 } from "path";
 function readTomlStringArray(text, key) {
   const open = new RegExp(`^${key}\\s*=\\s*\\[`, "m").exec(text);
   if (!open) return [];
@@ -8322,9 +8449,9 @@ function readDependencyNames(text) {
   return readTomlStringArray(text, "dependencies").map((dep) => /^\s*([A-Za-z0-9._-]+)/.exec(dep)?.[1] ?? "").filter(Boolean);
 }
 function workspaceMemberNames(instanceRoot) {
-  const rootPyproject = join27(instanceRoot, "pyproject.toml");
-  if (!existsSync26(rootPyproject)) return /* @__PURE__ */ new Set();
-  const text = readFileSync19(rootPyproject, "utf8");
+  const rootPyproject = join28(instanceRoot, "pyproject.toml");
+  if (!existsSync27(rootPyproject)) return /* @__PURE__ */ new Set();
+  const text = readFileSync20(rootPyproject, "utf8");
   const members = readTomlStringArray(text, "members");
   const excluded = new Set(readTomlStringArray(text, "exclude"));
   const dirs = [];
@@ -8333,7 +8460,7 @@ function workspaceMemberNames(instanceRoot) {
       const base = member.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync12(join27(instanceRoot, base), { withFileTypes: true });
+        entries = readdirSync12(join28(instanceRoot, base), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -8347,9 +8474,9 @@ function workspaceMemberNames(instanceRoot) {
   }
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    const pp = join27(instanceRoot, dir, "pyproject.toml");
-    if (!existsSync26(pp)) continue;
-    const name = readProjectName(readFileSync19(pp, "utf8"));
+    const pp = join28(instanceRoot, dir, "pyproject.toml");
+    if (!existsSync27(pp)) continue;
+    const name = readProjectName(readFileSync20(pp, "utf8"));
     if (name) names.add(name);
   }
   return names;
@@ -8360,8 +8487,8 @@ function existingWorkspaceSources(text) {
   );
 }
 function ensureWorkspaceSources(pluginPyprojectPath, memberNames) {
-  if (!existsSync26(pluginPyprojectPath) || memberNames.size === 0) return [];
-  const text = readFileSync19(pluginPyprojectPath, "utf8");
+  if (!existsSync27(pluginPyprojectPath) || memberNames.size === 0) return [];
+  const text = readFileSync20(pluginPyprojectPath, "utf8");
   const already = existingWorkspaceSources(text);
   const toAdd = readDependencyNames(text).filter((n) => memberNames.has(n) && !already.has(n));
   if (toAdd.length === 0) return [];
@@ -8427,14 +8554,14 @@ var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".terraform"
 ]);
 function resolveLocalPlugin(localPath) {
-  if (!existsSync27(localPath)) {
+  if (!existsSync28(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync6(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join28(localPath, "biffo.plugin.json");
-  if (!existsSync27(manifestPath)) {
+  const manifestPath = join29(localPath, "biffo.plugin.json");
+  if (!existsSync28(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -8460,8 +8587,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join28(tmpDir, "biffo.plugin.json");
-    if (!existsSync27(manifestPath)) {
+    const manifestPath = join29(tmpDir, "biffo.plugin.json");
+    if (!existsSync28(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -8489,8 +8616,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join28(options.cwd, "services");
-  if (!existsSync27(servicesDir)) {
+  const servicesDir = join29(options.cwd, "services");
+  if (!existsSync28(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8508,10 +8635,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join28(options.cwd, relTargetDir);
-  const modulesDir = join28(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join29(options.cwd, relTargetDir);
+  const modulesDir = join29(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync27(targetDir) && !inTreeSource) {
+  if (existsSync28(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -8553,8 +8680,8 @@ async function runPluginInstall(target, options, deps) {
       });
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
-    const pluginPyproject = join28(targetDir, "pyproject.toml");
-    if (existsSync27(pluginPyproject)) {
+    const pluginPyproject = join29(targetDir, "pyproject.toml");
+    if (existsSync28(pluginPyproject)) {
       const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(options.cwd));
       if (sourced.length > 0) {
         log.info(
@@ -8563,8 +8690,8 @@ async function runPluginInstall(target, options, deps) {
       }
     }
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join28(targetDir, "terraform");
-    if (existsSync27(tfSourceDir)) {
+    const tfSourceDir = join29(targetDir, "terraform");
+    if (existsSync28(tfSourceDir)) {
       mkdirSync9(modulesDir, { recursive: true });
       cpSync3(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
@@ -8621,7 +8748,7 @@ async function runPluginInstall(target, options, deps) {
 }
 function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync20(path, "utf8"));
+    return JSON.parse(readFileSync21(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
@@ -8658,8 +8785,8 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync28, readFileSync as readFileSync21 } from "fs";
-import { join as join29, resolve as resolve13 } from "path";
+import { existsSync as existsSync29, readFileSync as readFileSync22 } from "fs";
+import { join as join30, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -8672,8 +8799,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join29(options.cwd, "services");
-  if (!existsSync28(servicesDir)) {
+  const servicesDir = join30(options.cwd, "services");
+  if (!existsSync29(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8681,7 +8808,7 @@ async function runPluginList(options) {
   const plugins = [];
   for (const location of findInstalledPlugins(options.cwd)) {
     try {
-      const manifest = validateManifest(JSON.parse(readFileSync21(location.manifestPath, "utf8")));
+      const manifest = validateManifest(JSON.parse(readFileSync22(location.manifestPath, "utf8")));
       plugins.push({
         name: manifest.name,
         version: manifest.version,
@@ -8718,8 +8845,8 @@ async function runPluginList(options) {
 }
 
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync29 } from "fs";
-import { join as join30, relative as relative4, resolve as resolve14 } from "path";
+import { existsSync as existsSync30 } from "fs";
+import { join as join31, relative as relative4, resolve as resolve14 } from "path";
 import chalk17 from "chalk";
 import { Command as Command17 } from "commander";
 var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
@@ -8740,11 +8867,11 @@ var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join30(options.cwd, "services");
-  if (!existsSync29(servicesDir)) {
+  const servicesDir = join31(options.cwd, "services");
+  if (!existsSync30(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync29(join30(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync30(join31(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -8780,8 +8907,8 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync30, readFileSync as readFileSync22, rmSync as rmSync8 } from "fs";
-import { join as join31, resolve as resolve15 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync23, rmSync as rmSync8 } from "fs";
+import { join as join32, resolve as resolve15 } from "path";
 import chalk18 from "chalk";
 import { Command as Command18 } from "commander";
 import inquirer6 from "inquirer";
@@ -8813,16 +8940,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join31(options.cwd, "services");
-  if (!existsSync30(servicesDir)) {
+  const servicesDir = join32(options.cwd, "services");
+  if (!existsSync31(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join31(servicesDir, name);
-  if (!existsSync30(targetDir)) {
-    const firstParty = join31(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync30(firstParty)) {
+  const targetDir = join32(servicesDir, name);
+  if (!existsSync31(targetDir)) {
+    const firstParty = join32(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync31(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -8830,9 +8957,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join31(options.cwd, "modules", "plugins", name);
+  const modulesDir = join32(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync30(modulesDir)) {
+  if (existsSync31(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -8854,7 +8981,7 @@ async function runPluginUninstall(name, options, deps) {
   }
   rmSync8(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync30(modulesDir)) {
+  if (existsSync31(modulesDir)) {
     rmSync8(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
@@ -8891,10 +9018,10 @@ async function runPluginUninstall(name, options, deps) {
   }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join31(targetDir, "biffo.plugin.json");
-  if (!existsSync30(manifestPath)) return void 0;
+  const manifestPath = join32(targetDir, "biffo.plugin.json");
+  if (!existsSync31(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync22(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync23(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -8927,8 +9054,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync4, existsSync as existsSync31, mkdirSync as mkdirSync10, readFileSync as readFileSync23, rmSync as rmSync9 } from "fs";
-import { join as join32, relative as relative5, resolve as resolve16 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync32, mkdirSync as mkdirSync10, readFileSync as readFileSync24, rmSync as rmSync9 } from "fs";
+import { join as join33, relative as relative5, resolve as resolve16 } from "path";
 import chalk19 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer7 from "inquirer";
@@ -8953,14 +9080,14 @@ var pluginUpgradeCommand = new Command19("upgrade").description(
 });
 async function runPluginUpgrade(target, options, deps) {
   const { name, minor } = parsePluginTarget(target);
-  const servicesDir = join32(options.cwd, "services");
-  if (!existsSync31(servicesDir)) {
+  const servicesDir = join33(options.cwd, "services");
+  if (!existsSync32(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join32(servicesDir, name);
-  if (!existsSync31(targetDir)) {
+  const targetDir = join33(servicesDir, name);
+  if (!existsSync32(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -8974,7 +9101,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join32(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join33(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -9007,11 +9134,11 @@ async function runPluginUpgrade(target, options, deps) {
     cpSync4(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync31(modulesDir)) {
+    if (existsSync32(modulesDir)) {
       rmSync9(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join32(targetDir, "terraform");
-    if (existsSync31(tfSourceDir)) {
+    const tfSourceDir = join33(targetDir, "terraform");
+    if (existsSync32(tfSourceDir)) {
       mkdirSync10(modulesDir, { recursive: true });
       cpSync4(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
@@ -9045,10 +9172,10 @@ async function runPluginUpgrade(target, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join32(targetDir, "biffo.plugin.json");
-  if (!existsSync31(manifestPath)) return void 0;
+  const manifestPath = join33(targetDir, "biffo.plugin.json");
+  if (!existsSync32(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync23(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync24(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -9090,7 +9217,7 @@ pluginCommand.addCommand(pluginInfoCommand);
 import { Command as Command22 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync32, readFileSync as readFileSync24 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync25 } from "fs";
 import { resolve as resolve17 } from "path";
 import chalk20 from "chalk";
 import { Command as Command21 } from "commander";
@@ -9284,7 +9411,7 @@ async function fetchPublishedIdentity(portalUrl) {
 }
 async function resolveConfig4(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync24(resolve17(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync25(resolve17(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -9304,8 +9431,8 @@ async function resolveConfig4(options) {
     return cfg;
   }
   const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
-  if (existsSync32(localConfigPath)) {
-    const raw = JSON.parse(readFileSync24(localConfigPath, "utf8"));
+  if (existsSync33(localConfigPath)) {
+    const raw = JSON.parse(readFileSync25(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -9351,21 +9478,21 @@ siblingCommand.addCommand(siblingCheckIdentityCommand);
 import { Command as Command23 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
-import { existsSync as existsSync34 } from "fs";
-import { join as join34 } from "path";
+import { existsSync as existsSync35 } from "fs";
+import { join as join35 } from "path";
 import { execa as execa5 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
-import { existsSync as existsSync33, readdirSync as readdirSync13, readFileSync as readFileSync25 } from "fs";
-import { join as join33 } from "path";
+import { existsSync as existsSync34, readdirSync as readdirSync13, readFileSync as readFileSync26 } from "fs";
+import { join as join34 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join33(adrDir, ALLOWLIST_FILENAME);
-  if (!existsSync33(path)) return /* @__PURE__ */ new Set();
+  const path = join34(adrDir, ALLOWLIST_FILENAME);
+  if (!existsSync34(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
-  for (const rawLine of readFileSync25(path, "utf8").split("\n")) {
+  for (const rawLine of readFileSync26(path, "utf8").split("\n")) {
     const line = rawLine.split("#")[0].trim();
     if (line) numbers.add(line);
   }
@@ -9373,7 +9500,7 @@ function readAdrNumberingAllowlist(adrDir) {
 }
 function adrNumbersIn(adrDir) {
   const claims = /* @__PURE__ */ new Map();
-  if (!existsSync33(adrDir)) return claims;
+  if (!existsSync34(adrDir)) return claims;
   for (const entry of readdirSync13(adrDir).sort()) {
     const match = ADR_FILENAME.exec(entry);
     if (!match) continue;
@@ -9428,8 +9555,8 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
   const root = (await execa5("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join34(root, "docs", "ADR");
-  if (!existsSync34(adrDir)) {
+  const adrDir = join35(root, "docs", "ADR");
+  if (!existsSync35(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
   }
@@ -9757,8 +9884,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa7("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync28, existsSync: existsSync40 } = await import("fs");
-      if (existsSync40(messageFile)) commitMessage = readFileSync28(messageFile, "utf8");
+      const { readFileSync: readFileSync29, existsSync: existsSync41 } = await import("fs");
+      if (existsSync41(messageFile)) commitMessage = readFileSync29(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -9859,33 +9986,33 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync36 } from "fs";
-import { join as join36 } from "path";
+import { existsSync as existsSync37 } from "fs";
+import { join as join37 } from "path";
 import { execa as execa8 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync35, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync36, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
+import { join as join36 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync35(dir)) return [];
+  if (!existsSync36(dir)) return [];
   return readdirSync14(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync7(join35(dir, entry)).isDirectory();
+      return statSync7(join36(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync35(join35(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync36(join36(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join35(pluginDir2, "tests");
-  if (!existsSync35(testsDir)) return [];
-  if (existsSync35(join35(testsDir, "__init__.py"))) return [];
+  const testsDir = join36(pluginDir2, "tests");
+  if (!existsSync36(testsDir)) return [];
+  if (existsSync36(join36(testsDir, "__init__.py"))) return [];
   return readdirSync14(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -9894,7 +10021,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join35(servicesDir, plugin))) {
+      for (const name of namesOf(join36(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -9932,8 +10059,8 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join36(root, "services");
-  if (!existsSync36(servicesDir)) {
+  const servicesDir = join37(root, "services");
+  if (!existsSync37(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -9953,8 +10080,8 @@ async function runPluginCollisionCheck() {
 import { execa as execa9 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync37, readFileSync as readFileSync26, readdirSync as readdirSync15 } from "fs";
-import { dirname as dirname9, join as join37, relative as relative6, sep as sep3 } from "path";
+import { existsSync as existsSync38, readFileSync as readFileSync27, readdirSync as readdirSync15 } from "fs";
+import { dirname as dirname9, join as join38, relative as relative6, sep as sep3 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -9969,9 +10096,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
-        walk(join37(dir, entry.name));
+        walk(join38(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative6(root, join37(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative6(root, join38(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -9981,7 +10108,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync26(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync27(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -9996,14 +10123,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync37(join37(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync38(join38(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join37(root, manifest);
+    const absManifest = join38(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync37(join37(pluginDir2, "terraform"))) continue;
+    if (existsSync38(join38(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative6(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -10199,8 +10326,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync38, readFileSync as readFileSync27 } from "fs";
-import { join as join38, resolve as resolve18 } from "path";
+import { existsSync as existsSync39, readFileSync as readFileSync28 } from "fs";
+import { join as join39, resolve as resolve18 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
 
@@ -10375,10 +10502,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join38(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync38(path)) return null;
+  const path = join39(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync39(path)) return null;
   try {
-    return parseCoreRecord(readFileSync27(path, "utf8"));
+    return parseCoreRecord(readFileSync28(path, "utf8"));
   } catch {
     return null;
   }
@@ -10393,10 +10520,10 @@ function parseCoreRecord(contents) {
   }
 }
 function readFossil(cwd) {
-  const path = join38(cwd, CORE_VERSION_FILE);
-  if (!existsSync38(path)) return null;
+  const path = join39(cwd, CORE_VERSION_FILE);
+  if (!existsSync39(path)) return null;
   try {
-    const value = readFileSync27(path, "utf8").trim();
+    const value = readFileSync28(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -10845,13 +10972,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command26 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync39 } from "fs";
-import { dirname as dirname10, join as join39 } from "path";
+import { existsSync as existsSync40 } from "fs";
+import { dirname as dirname10, join as join40 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join39(dir, relativePath);
-    if (existsSync39(candidate)) return candidate;
+    const candidate = join40(dir, relativePath);
+    if (existsSync40(candidate)) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;