@biffo/cli 0.273.7 → 0.273.9

package/dist/index.js

@@ -8380,8 +8380,8 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync3, existsSync as existsSync28, mkdirSync as mkdirSync9, readFileSync as readFileSync21, statSync as statSync6 } from "fs";
-import { basename, join as join29, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync28, mkdirSync as mkdirSync10, readFileSync as readFileSync21, statSync as statSync6 } from "fs";
+import { join as join30, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
@@ -8427,9 +8427,61 @@ var PluginMigrationsAdapter = class {
   }
 };
 
+// src/lib/plugin-source-copy.ts
+import { copyFileSync as copyFileSync2, cpSync as cpSync3, mkdirSync as mkdirSync9 } from "fs";
+import { basename, dirname as dirname9, join as join28 } from "path";
+import { execa as execa5 } from "execa";
+var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
+  ".git",
+  ".venv",
+  "node_modules",
+  "__pycache__",
+  ".ruff_cache",
+  ".pytest_cache",
+  ".mypy_cache",
+  "dist",
+  ".terraform"
+]);
+async function copyPluginSource(sourceDir, targetDir) {
+  if (await isGitWorkingTree(sourceDir)) {
+    const files = await listGitFiles(sourceDir);
+    for (const relPath of files) {
+      const destPath = join28(targetDir, relPath);
+      mkdirSync9(dirname9(destPath), { recursive: true });
+      copyFileSync2(join28(sourceDir, relPath), destPath);
+    }
+    return { usedGitIgnoreRules: true };
+  }
+  log.warn(
+    `${sourceDir} is not a git working tree \u2014 cannot honour .gitignore. Falling back to a fixed exclude list (.git, .venv, node_modules, caches); anything else it does not know about (e.g. an unfamiliar cache directory) will be copied.`
+  );
+  mkdirSync9(targetDir, { recursive: true });
+  cpSync3(sourceDir, targetDir, {
+    recursive: true,
+    filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename(src))
+  });
+  return { usedGitIgnoreRules: false };
+}
+async function isGitWorkingTree(dir) {
+  try {
+    await execa5("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function listGitFiles(dir) {
+  const { stdout } = await execa5(
+    "git",
+    ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
+    { cwd: dir }
+  );
+  return stdout.split("\0").filter((p) => p.length > 0);
+}
+
 // src/lib/plugin-workspace-sources.ts
 import { existsSync as existsSync27, readdirSync as readdirSync12, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 function readTomlStringArray(text, key) {
   const open = new RegExp(`^${key}\\s*=\\s*\\[`, "m").exec(text);
   if (!open) return [];
@@ -8473,7 +8525,7 @@ function readDependencyNames(text) {
   return readTomlStringArray(text, "dependencies").map((dep) => /^\s*([A-Za-z0-9._-]+)/.exec(dep)?.[1] ?? "").filter(Boolean);
 }
 function workspaceMemberNames(instanceRoot) {
-  const rootPyproject = join28(instanceRoot, "pyproject.toml");
+  const rootPyproject = join29(instanceRoot, "pyproject.toml");
   if (!existsSync27(rootPyproject)) return /* @__PURE__ */ new Set();
   const text = readFileSync20(rootPyproject, "utf8");
   const members = readTomlStringArray(text, "members");
@@ -8484,7 +8536,7 @@ function workspaceMemberNames(instanceRoot) {
       const base = member.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync12(join28(instanceRoot, base), { withFileTypes: true });
+        entries = readdirSync12(join29(instanceRoot, base), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -8498,7 +8550,7 @@ function workspaceMemberNames(instanceRoot) {
   }
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    const pp = join28(instanceRoot, dir, "pyproject.toml");
+    const pp = join29(instanceRoot, dir, "pyproject.toml");
     if (!existsSync27(pp)) continue;
     const name = readProjectName(readFileSync20(pp, "utf8"));
     if (name) names.add(name);
@@ -8536,7 +8588,7 @@ ${lines.join("\n")}
   return toAdd;
 }
 function applyWorkspaceSources(targetDir, cwd, relTargetDir) {
-  const pluginPyproject = join28(targetDir, "pyproject.toml");
+  const pluginPyproject = join29(targetDir, "pyproject.toml");
   if (!existsSync27(pluginPyproject)) return;
   const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(cwd));
   if (sourced.length > 0) {
@@ -8576,17 +8628,6 @@ var pluginInstallCommand = new Command15("install").description(
     }
   }
 );
-var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
-  ".git",
-  ".venv",
-  "node_modules",
-  "__pycache__",
-  ".ruff_cache",
-  ".pytest_cache",
-  ".mypy_cache",
-  "dist",
-  ".terraform"
-]);
 function resolveLocalPlugin(localPath) {
   if (!existsSync28(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
@@ -8594,7 +8635,7 @@ function resolveLocalPlugin(localPath) {
   if (!statSync6(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join29(localPath, "biffo.plugin.json");
+  const manifestPath = join30(localPath, "biffo.plugin.json");
   if (!existsSync28(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
@@ -8621,7 +8662,7 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join29(tmpDir, "biffo.plugin.json");
+    const manifestPath = join30(tmpDir, "biffo.plugin.json");
     if (!existsSync28(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
@@ -8650,7 +8691,7 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join29(options.cwd, "services");
+  const servicesDir = join30(options.cwd, "services");
   if (!existsSync28(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
@@ -8669,8 +8710,8 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join29(options.cwd, relTargetDir);
-  const modulesDir = join29(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join30(options.cwd, relTargetDir);
+  const modulesDir = join30(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
   if (existsSync28(targetDir) && !inTreeSource) {
     throw new Error(
@@ -8707,19 +8748,16 @@ async function runPluginInstall(target, options, deps) {
     if (inTreeSource) {
       log.info(`${relTargetDir}/ is already in this checkout \u2014 installing in place.`);
     } else {
-      mkdirSync9(targetDir, { recursive: true });
-      cpSync3(source.sourceDir, targetDir, {
-        recursive: true,
-        filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename(src))
-      });
+      mkdirSync10(targetDir, { recursive: true });
+      await copyPluginSource(source.sourceDir, targetDir);
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
     applyWorkspaceSources(targetDir, options.cwd, relTargetDir);
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join29(targetDir, "terraform");
+    const tfSourceDir = join30(targetDir, "terraform");
     if (existsSync28(tfSourceDir)) {
-      mkdirSync9(modulesDir, { recursive: true });
-      cpSync3(tfSourceDir, modulesDir, { recursive: true });
+      mkdirSync10(modulesDir, { recursive: true });
+      cpSync4(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
       log.success(`Copied Terraform module to modules/plugins/${pluginName}/`);
       const wiring = syncPluginTerraform(options.cwd);
@@ -8812,7 +8850,7 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
 
 // src/commands/plugin-list.ts
 import { existsSync as existsSync29, readFileSync as readFileSync22 } from "fs";
-import { join as join30, resolve as resolve13 } from "path";
+import { join as join31, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -8825,7 +8863,7 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join30(options.cwd, "services");
+  const servicesDir = join31(options.cwd, "services");
   if (!existsSync29(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
@@ -8872,7 +8910,7 @@ async function runPluginList(options) {
 
 // src/commands/plugin-sync-migrations.ts
 import { existsSync as existsSync30 } from "fs";
-import { join as join31, relative as relative4, resolve as resolve14 } from "path";
+import { join as join32, relative as relative4, resolve as resolve14 } from "path";
 import chalk17 from "chalk";
 import { Command as Command17 } from "commander";
 var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
@@ -8893,11 +8931,11 @@ var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join31(options.cwd, "services");
+  const servicesDir = join32(options.cwd, "services");
   if (!existsSync30(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync30(join31(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync30(join32(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -8934,7 +8972,7 @@ async function runPluginSyncMigrations(name, options, deps) {
 
 // src/commands/plugin-uninstall.ts
 import { existsSync as existsSync31, readFileSync as readFileSync23, rmSync as rmSync8 } from "fs";
-import { join as join32, resolve as resolve15 } from "path";
+import { join as join33, resolve as resolve15 } from "path";
 import chalk18 from "chalk";
 import { Command as Command18 } from "commander";
 import inquirer6 from "inquirer";
@@ -8966,15 +9004,15 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join32(options.cwd, "services");
+  const servicesDir = join33(options.cwd, "services");
   if (!existsSync31(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join32(servicesDir, name);
+  const targetDir = join33(servicesDir, name);
   if (!existsSync31(targetDir)) {
-    const firstParty = join32(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    const firstParty = join33(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
     if (existsSync31(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
@@ -8983,7 +9021,7 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join32(options.cwd, "modules", "plugins", name);
+  const modulesDir = join33(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
   if (existsSync31(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
@@ -9044,7 +9082,7 @@ async function runPluginUninstall(name, options, deps) {
   }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join32(targetDir, "biffo.plugin.json");
+  const manifestPath = join33(targetDir, "biffo.plugin.json");
   if (!existsSync31(manifestPath)) return void 0;
   try {
     return validateManifest(JSON.parse(readFileSync23(manifestPath, "utf8"))).version;
@@ -9080,8 +9118,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync4, existsSync as existsSync32, mkdirSync as mkdirSync10, readFileSync as readFileSync24, rmSync as rmSync9 } from "fs";
-import { basename as basename2, join as join33, relative as relative5, resolve as resolve16 } from "path";
+import { cpSync as cpSync5, existsSync as existsSync32, mkdirSync as mkdirSync11, readFileSync as readFileSync24, rmSync as rmSync9 } from "fs";
+import { join as join34, relative as relative5, resolve as resolve16 } from "path";
 import chalk19 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer7 from "inquirer";
@@ -9128,7 +9166,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Nothing to upgrade. Pass a registry target (e.g. \`biffo plugin upgrade acme-crm@1.1\`) or a local checkout to refresh from (\`biffo plugin upgrade --local ../acme-crm\`).`
     );
   }
-  const servicesDir = join33(options.cwd, "services");
+  const servicesDir = join34(options.cwd, "services");
   if (!existsSync32(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
@@ -9138,7 +9176,7 @@ async function runPluginUpgrade(target, options, deps) {
     return runLocalPluginRefresh(options.local, options, deps);
   }
   const { name, minor } = parsePluginTarget(target);
-  const targetDir = join33(servicesDir, name);
+  const targetDir = join34(servicesDir, name);
   if (!existsSync32(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
@@ -9153,7 +9191,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join33(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join34(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -9182,18 +9220,18 @@ async function runPluginUpgrade(target, options, deps) {
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
     rmSync9(targetDir, { recursive: true, force: true });
-    mkdirSync10(targetDir, { recursive: true });
-    cpSync4(tmpDir, targetDir, { recursive: true });
+    mkdirSync11(targetDir, { recursive: true });
+    cpSync5(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
     applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
     const stagePaths = [`services/${entry.name}`];
     if (existsSync32(modulesDir)) {
       rmSync9(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join33(targetDir, "terraform");
+    const tfSourceDir = join34(targetDir, "terraform");
     if (existsSync32(tfSourceDir)) {
-      mkdirSync10(modulesDir, { recursive: true });
-      cpSync4(tfSourceDir, modulesDir, { recursive: true });
+      mkdirSync11(modulesDir, { recursive: true });
+      cpSync5(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
       log.success(`Copied Terraform module to modules/plugins/${entry.name}/`);
     }
@@ -9227,8 +9265,8 @@ async function runPluginUpgrade(target, options, deps) {
 async function runLocalPluginRefresh(localPath, options, deps) {
   const source = resolveLocalPlugin(localPath);
   log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
-  const servicesDir = join33(options.cwd, "services");
-  const targetDir = join33(servicesDir, source.name);
+  const servicesDir = join34(options.cwd, "services");
+  const targetDir = join34(servicesDir, source.name);
   if (!existsSync32(targetDir)) {
     throw new Error(
       `Plugin '${source.name}' is not installed at services/${source.name}/. Use 'biffo plugin install --local ${localPath}' instead.`
@@ -9236,7 +9274,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
   }
   const inTreeSource = resolve16(source.sourceDir) === resolve16(targetDir);
   const currentVersion = readInstalledVersion2(targetDir);
-  const modulesDir = join33(options.cwd, "modules", "plugins", source.name);
+  const modulesDir = join34(options.cwd, "modules", "plugins", source.name);
   if (options.dryRun) {
     printLocalDryRun(source, currentVersion, inTreeSource);
     return;
@@ -9265,11 +9303,8 @@ async function runLocalPluginRefresh(localPath, options, deps) {
       );
     } else {
       rmSync9(targetDir, { recursive: true, force: true });
-      mkdirSync10(targetDir, { recursive: true });
-      cpSync4(source.sourceDir, targetDir, {
-        recursive: true,
-        filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename2(src))
-      });
+      mkdirSync11(targetDir, { recursive: true });
+      await copyPluginSource(source.sourceDir, targetDir);
       log.success(`Refreshed plugin source at services/${source.name}/ from ${source.origin}`);
     }
     applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
@@ -9277,10 +9312,10 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     if (existsSync32(modulesDir)) {
       rmSync9(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join33(targetDir, "terraform");
+    const tfSourceDir = join34(targetDir, "terraform");
     if (existsSync32(tfSourceDir)) {
-      mkdirSync10(modulesDir, { recursive: true });
-      cpSync4(tfSourceDir, modulesDir, { recursive: true });
+      mkdirSync11(modulesDir, { recursive: true });
+      cpSync5(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${source.name}`);
       log.success(`Refreshed Terraform module at modules/plugins/${source.name}/`);
     }
@@ -9319,7 +9354,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join33(targetDir, "biffo.plugin.json");
+  const manifestPath = join34(targetDir, "biffo.plugin.json");
   if (!existsSync32(manifestPath)) return void 0;
   try {
     return validateManifest(JSON.parse(readFileSync24(manifestPath, "utf8"))).version;
@@ -9656,17 +9691,17 @@ import { Command as Command23 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
 import { existsSync as existsSync35 } from "fs";
-import { join as join35 } from "path";
-import { execa as execa5 } from "execa";
+import { join as join36 } from "path";
+import { execa as execa6 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
 import { existsSync as existsSync34, readdirSync as readdirSync13, readFileSync as readFileSync26 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join34(adrDir, ALLOWLIST_FILENAME);
+  const path = join35(adrDir, ALLOWLIST_FILENAME);
   if (!existsSync34(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
   for (const rawLine of readFileSync26(path, "utf8").split("\n")) {
@@ -9731,8 +9766,8 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
-  const root = (await execa5("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join35(root, "docs", "ADR");
+  const root = (await execa6("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const adrDir = join36(root, "docs", "ADR");
   if (!existsSync35(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
@@ -9772,7 +9807,7 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 
 // src/scripts/check-branch-protection.ts
 import { Octokit as Octokit2 } from "@octokit/rest";
-import { execa as execa6 } from "execa";
+import { execa as execa7 } from "execa";
 
 // src/lib/branch-protection-apply.ts
 var CONTEXT_CONSISTENCY_THRESHOLD = 2 / 3;
@@ -9899,7 +9934,7 @@ async function resolveRepo(explicit) {
     }
     return { owner, repo };
   }
-  const { stdout } = await execa6("git", ["remote", "get-url", "origin"]);
+  const { stdout } = await execa7("git", ["remote", "get-url", "origin"]);
   const m = /github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/.exec(stdout.trim());
   if (!m?.[1] || !m[2]) {
     console.error(
@@ -10031,11 +10066,11 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 }
 
 // src/scripts/check-cognito-invite-template.ts
-import { execa as execa7 } from "execa";
+import { execa as execa8 } from "execa";
 
 // src/lib/cognito-invite-template-guard.ts
 import { readdirSync as readdirSync14, readFileSync as readFileSync27, statSync as statSync7 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -10118,7 +10153,7 @@ function findModuleTerraformFiles(repoRoot) {
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join36(dir, entry);
+      const full = join37(dir, entry);
       const rel = `${relative8}/${entry}`;
       if (statSync7(full).isDirectory()) {
         walk2(full, rel);
@@ -10127,18 +10162,18 @@ function findModuleTerraformFiles(repoRoot) {
       }
     }
   };
-  walk2(join36(repoRoot, "modules"), "modules");
+  walk2(join37(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync27(join36(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync27(join37(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-cognito-invite-template.ts
 async function runCognitoInviteTemplateCheck() {
-  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
@@ -10160,12 +10195,12 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join38 } from "path";
-import { execa as execa8 } from "execa";
+import { join as join39 } from "path";
+import { execa as execa9 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
 import { existsSync as existsSync36, readFileSync as readFileSync28, readdirSync as readdirSync15, statSync as statSync8 } from "fs";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -10329,7 +10364,7 @@ function walkFiles(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join37(dir, entry);
+      const p = join38(dir, entry);
       let st;
       try {
         st = statSync8(p);
@@ -10424,7 +10459,7 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join37(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join38(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
     raw = readFileSync28(configPath, "utf8");
@@ -10447,7 +10482,7 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join37(estateDir, coreProject, "services", "api", "src");
+  const coreApiSrcDir = join38(estateDir, coreProject, "services", "api", "src");
   if (!existsSync36(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
@@ -10489,9 +10524,9 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join38(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join39(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -10507,7 +10542,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join38(root, "services", "api", "src");
+    coreApiSrcDir = join39(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -10543,7 +10578,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa9 } from "execa";
+import { execa as execa10 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -10554,7 +10589,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -10570,7 +10605,7 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa9("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa10("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
       const { readFileSync: readFileSync37, existsSync: existsSync45 } = await import("fs");
@@ -10582,18 +10617,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa9("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa9("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa10("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa10("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa9("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa10("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa9("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa10("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -10675,11 +10710,11 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa10 } from "execa";
+import { execa as execa11 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
 import { readFileSync as readFileSync29, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -10756,7 +10791,7 @@ function walkTerraformFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join39(dir, entry);
+      const p = join40(dir, entry);
       let st;
       try {
         st = statSync9(p);
@@ -10852,7 +10887,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -10889,15 +10924,15 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-lambda-output.ts
-import { execa as execa11 } from "execa";
+import { execa as execa12 } from "execa";
 
 // src/lib/lambda-output-guard.ts
 import { readFileSync as readFileSync31 } from "fs";
-import { join as join41 } from "path";
+import { join as join42 } from "path";
 
 // src/lib/terraform-input-guard.ts
 import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync10 } from "fs";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -10921,7 +10956,7 @@ function findWorkflowFiles(repoRoot) {
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join40(dir, entry);
+      const full = join41(dir, entry);
       const rel = relative8 ? `${relative8}/${entry}` : entry;
       if (statSync10(full).isDirectory()) {
         walk2(full, rel);
@@ -10965,7 +11000,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync30(join40(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync30(join41(repoRoot, file), "utf8"))
   );
 }
 
@@ -11023,13 +11058,13 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync31(join41(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync31(join42(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -11052,8 +11087,8 @@ async function runLambdaOutputCheck() {
 
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync32, readdirSync as readdirSync18 } from "fs";
-import { join as join42, relative as relative6 } from "path";
-import { execa as execa12 } from "execa";
+import { join as join43, relative as relative6 } from "path";
+import { execa as execa13 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -11149,7 +11184,7 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join42(root, dir);
+    const full = join43(root, dir);
     let entries;
     try {
       entries = readdirSync18(full, { withFileTypes: true });
@@ -11159,13 +11194,13 @@ function shellFiles(root) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join42(full, entry.name));
+      out.push(join43(full, entry.name));
     }
   }
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -11193,12 +11228,12 @@ async function runPipeTrapCheck() {
 
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync38 } from "fs";
-import { join as join44 } from "path";
-import { execa as execa13 } from "execa";
+import { join as join45 } from "path";
+import { execa as execa14 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
 import { existsSync as existsSync37, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
@@ -11206,19 +11241,19 @@ function subdirectories(dir) {
   return readdirSync19(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync11(join43(dir, entry)).isDirectory();
+      return statSync11(join44(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync37(join43(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync37(join44(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join43(pluginDir2, "tests");
+  const testsDir = join44(pluginDir2, "tests");
   if (!existsSync37(testsDir)) return [];
-  if (existsSync37(join43(testsDir, "__init__.py"))) return [];
+  if (existsSync37(join44(testsDir, "__init__.py"))) return [];
   return readdirSync19(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -11227,7 +11262,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join43(servicesDir, plugin))) {
+      for (const name of namesOf(join44(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -11264,8 +11299,8 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join44(root, "services");
+  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join45(root, "services");
   if (!existsSync38(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
@@ -11283,11 +11318,11 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa14 } from "execa";
+import { execa as execa15 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
 import { existsSync as existsSync39, readFileSync as readFileSync33, readdirSync as readdirSync20 } from "fs";
-import { dirname as dirname9, join as join45, relative as relative7, sep as sep3 } from "path";
+import { dirname as dirname10, join as join46, relative as relative7, sep as sep3 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -11302,9 +11337,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS2.has(entry.name)) continue;
-        walk2(join45(dir, entry.name));
+        walk2(join46(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative7(root, join45(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative7(root, join46(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -11329,14 +11364,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync39(join45(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync39(join46(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join45(root, manifest);
+    const absManifest = join46(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
-    const pluginDir2 = dirname9(absManifest);
-    if (existsSync39(join45(pluginDir2, "terraform"))) continue;
+    const pluginDir2 = dirname10(absManifest);
+    if (existsSync39(join46(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative7(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -11356,7 +11391,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -11368,12 +11403,12 @@ async function runPluginTerraformCheck() {
 
 // src/scripts/check-plugin-tool-supply.ts
 import { existsSync as existsSync41 } from "fs";
-import { join as join47 } from "path";
-import { execa as execa15 } from "execa";
+import { join as join48 } from "path";
+import { execa as execa16 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
 import { existsSync as existsSync40, readFileSync as readFileSync34, readdirSync as readdirSync21, statSync as statSync12 } from "fs";
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -11790,7 +11825,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync12(join46(root, e)).isDirectory();
+      return statSync12(join47(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -11806,7 +11841,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join46(dir, entry);
+      const p = join47(dir, entry);
       let st;
       try {
         st = statSync12(p);
@@ -11832,14 +11867,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join46(pluginDir2, "terraform");
+  const tfDir = join47(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync21(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join46(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join47(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -12091,8 +12126,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join46("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join46(
+var CONFIG_PY_PATH = join47("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join47(
   "services",
   "api",
   "src",
@@ -12104,8 +12139,8 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join46(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join46(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configPath = join47(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join47(repoRoot, ORCHESTRATION_SCHEMA_PATH);
   const configMissing = !existsSync40(configPath);
   const orchestrationSchemaMissing = !existsSync40(orchestrationPath);
   const knownSet = new Set(knownModelIds);
@@ -12178,7 +12213,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync12(join46(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync12(join47(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -12191,8 +12226,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join46(pluginsRoot, name);
-    const manifestText = readFileSync34(join46(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join47(pluginsRoot, name);
+    const manifestText = readFileSync34(join47(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -12290,7 +12325,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join46(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join47(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -12321,9 +12356,9 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join47(root, "services", "_plugins");
+  const pluginsRoot = join48(root, "services", "_plugins");
   if (!existsSync41(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
@@ -12354,7 +12389,7 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join47(root, "services", "api");
+  const servicesApiRoot = join48(root, "services", "api");
   if (!existsSync41(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
@@ -12401,7 +12436,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa16 } from "execa";
+import { execa as execa17 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -12438,7 +12473,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa16(
+  const { stdout } = await execa17(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -12474,7 +12509,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa16("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa17("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -12482,9 +12517,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa16("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa16("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa17("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa17("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -12533,12 +12568,12 @@ async function runReleaseSubjectCheck(argv) {
 
 // src/scripts/check-skeleton-drift.ts
 import { existsSync as existsSync42, readdirSync as readdirSync23 } from "fs";
-import { join as join49 } from "path";
-import { execa as execa17 } from "execa";
+import { join as join50 } from "path";
+import { execa as execa18 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
 import { readFileSync as readFileSync35, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -12602,7 +12637,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join48(dir, entry);
+    const abs = join49(dir, entry);
     let isDir;
     try {
       isDir = statSync13(abs).isDirectory();
@@ -12624,7 +12659,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync35(join48(skeletonRoot, rel), "utf8");
+        contents = readFileSync35(join49(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -12653,23 +12688,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join49(root, "_skeletons");
+  const skeletonsDir = join50(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync23(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync42(join49(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync42(join50(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join49(root, "_skeletons", name);
+    const skeletonRoot = join50(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync42(join49(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync42(join50(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -12683,7 +12718,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join49(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join50(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -12695,9 +12730,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa18 } from "execa";
+import { execa as execa19 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -12802,7 +12837,7 @@ function rawArgsAfter(subcommand) {
 
 // src/commands/doctor.ts
 import { existsSync as existsSync43, readFileSync as readFileSync36 } from "fs";
-import { join as join50, resolve as resolve18 } from "path";
+import { join as join51, resolve as resolve18 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
 
@@ -12977,7 +13012,7 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join50(cwd, INSTANCE_CORE_FILE);
+  const path = join51(cwd, INSTANCE_CORE_FILE);
   if (!existsSync43(path)) return null;
   try {
     return parseCoreRecord(readFileSync36(path, "utf8"));
@@ -12995,7 +13030,7 @@ function parseCoreRecord(contents) {
   }
 }
 function readFossil(cwd) {
-  const path = join50(cwd, CORE_VERSION_FILE);
+  const path = join51(cwd, CORE_VERSION_FILE);
   if (!existsSync43(path)) return null;
   try {
     const value = readFileSync36(path, "utf8").trim();
@@ -13442,19 +13477,19 @@ function resolveGithubToken4() {
 
 // src/lib/packaged-script-command.ts
 import { spawnSync } from "child_process";
-import { dirname as dirname11 } from "path";
+import { dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command26 } from "commander";
 
 // src/lib/packaged-scripts.ts
 import { existsSync as existsSync44 } from "fs";
-import { dirname as dirname10, join as join51 } from "path";
+import { dirname as dirname11, join as join52 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join51(dir, relativePath);
+    const candidate = join52(dir, relativePath);
     if (existsSync44(candidate)) return candidate;
-    const parent = dirname10(dir);
+    const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -13476,7 +13511,7 @@ function packagedScriptCommand(spec) {
   const command = new Command26(spec.name).description(spec.description).allowExcessArguments(true).allowUnknownOption(true);
   if (spec.argument) command.argument(`<${spec.argument.name}>`, spec.argument.description);
   return command.action(() => {
-    const here = dirname11(fileURLToPath6(import.meta.url));
+    const here = dirname12(fileURLToPath6(import.meta.url));
     const script = findPackagedScript(here, spec.script);
     if (!script) {
       process.stderr.write(`${packagedScriptMissing(spec.script)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.273.7",
+  "version": "0.273.9",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",