@biffo/cli 0.282.0 → 0.283.1

package/dist/index.js

@@ -7744,6 +7744,10 @@ var UserIngressSchema = z7.object({
   required_group: z7.string().min(1, NON_EMPTY_GROUP),
   app: z7.string().regex(APP_REF, "must be an ASGI app reference '<module>:<attr>', e.g. 'ideation.app:app'")
 }).strict();
+var AdminIngressSchema = z7.object({
+  required_group: z7.string().min(1, NON_EMPTY_GROUP),
+  app: z7.string().regex(APP_REF, "must be an ASGI app reference '<module>:<attr>', e.g. 'ideation.admin:app'")
+}).strict();
 var UserFrontendSchema = z7.object({
   dir: z7.string().regex(
     REL_DIR,
@@ -7788,9 +7792,10 @@ var PluginManifestSchema = z7.object({
   // schema is the registry's, and this consumer only needs to count them.
   event_subscriptions: z7.array(z7.object({ source: z7.string(), detail_type: z7.string() }).passthrough()).default([]),
   required_core_version: z7.string().default(">=0.0.0"),
-  // ADR-0018 user-facing surfaces. Optional: a plugin without them is an
-  // ordinary (data/event/CRUD) plugin.
+  // ADR-0018/0021 user-facing and admin-facing surfaces. Optional: a plugin
+  // without them is an ordinary (data/event/CRUD) plugin.
   user_ingress: UserIngressSchema.optional(),
+  admin_ingress: AdminIngressSchema.optional(),
   user_frontend: UserFrontendSchema.optional(),
   // Tools the plugin's runtime exposes to an agentic worker (ADR-0014 §7,
   // #569). Default empty — an ordinary plugin declares none. Parsing this
@@ -11230,8 +11235,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa12("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync41, existsSync: existsSync49 } = await import("fs");
-      if (existsSync49(messageFile)) commitMessage = readFileSync41(messageFile, "utf8");
+      const { readFileSync: readFileSync41, existsSync: existsSync50 } = await import("fs");
+      if (existsSync50(messageFile)) commitMessage = readFileSync41(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -11553,7 +11558,7 @@ import { readFileSync as readFileSync34 } from "fs";
 import { join as join47 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync12 } from "fs";
+import { existsSync as existsSync41, readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync12 } from "fs";
 import { join as join46 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
@@ -11567,8 +11572,27 @@ var IGNORED_SUBCOMMANDS = ["output", "state", "fmt", "validate", "version", "wor
 function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
+function vendoredPluginServiceDirs(repoRoot) {
+  const servicesDir = join46(repoRoot, "services");
+  const result = /* @__PURE__ */ new Set();
+  let entries;
+  try {
+    entries = readdirSync20(servicesDir);
+  } catch {
+    return result;
+  }
+  for (const entry of entries) {
+    const full = join46(servicesDir, entry);
+    if (!existsSync41(full) || !statSync12(full).isDirectory()) continue;
+    if (existsSync41(join46(full, "biffo.plugin.json"))) {
+      result.add(entry);
+    }
+  }
+  return result;
+}
 function findWorkflowFiles(repoRoot) {
   const found = [];
+  const vendoredPluginDirs = vendoredPluginServiceDirs(repoRoot);
   const walk2 = (dir, relative10) => {
     let entries;
     try {
@@ -11578,6 +11602,9 @@ function findWorkflowFiles(repoRoot) {
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
+      if (entry === ".github" && relative10.startsWith("services/") && vendoredPluginDirs.has(relative10.slice("services/".length))) {
+        continue;
+      }
       const full = join46(dir, entry);
       const rel = relative10 ? `${relative10}/${entry}` : entry;
       if (statSync12(full).isDirectory()) {
@@ -11985,17 +12012,17 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync42 } from "fs";
+import { existsSync as existsSync43 } from "fs";
 import { join as join51 } from "path";
 import { execa as execa17 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync41, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { existsSync as existsSync42, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
 import { join as join50 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync41(dir)) return [];
+  if (!existsSync42(dir)) return [];
   return readdirSync22(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
@@ -12006,12 +12033,12 @@ function subdirectories(dir) {
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync41(join50(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync42(join50(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
   const testsDir = join50(pluginDir2, "tests");
-  if (!existsSync41(testsDir)) return [];
-  if (existsSync41(join50(testsDir, "__init__.py"))) return [];
+  if (!existsSync42(testsDir)) return [];
+  if (existsSync42(join50(testsDir, "__init__.py"))) return [];
   return readdirSync22(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -12059,7 +12086,7 @@ function formatCollisions(collisions) {
 async function runPluginCollisionCheck() {
   const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const servicesDir = join51(root, "services");
-  if (!existsSync42(servicesDir)) {
+  if (!existsSync43(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -12079,7 +12106,7 @@ async function runPluginCollisionCheck() {
 import { execa as execa18 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync43, readFileSync as readFileSync37, readdirSync as readdirSync23 } from "fs";
+import { existsSync as existsSync44, readFileSync as readFileSync37, readdirSync as readdirSync23 } from "fs";
 import { dirname as dirname10, join as join52, relative as relative9, sep as sep3 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
@@ -12122,14 +12149,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync43(join52(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync44(join52(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
     const absManifest = join52(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync43(join52(pluginDir2, "terraform"))) continue;
+    if (existsSync44(join52(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative9(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -12160,12 +12187,12 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync45 } from "fs";
+import { existsSync as existsSync46 } from "fs";
 import { join as join54 } from "path";
 import { execa as execa19 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync44, readFileSync as readFileSync38, readdirSync as readdirSync24, statSync as statSync14 } from "fs";
+import { existsSync as existsSync45, readFileSync as readFileSync38, readdirSync as readdirSync24, statSync as statSync14 } from "fs";
 import { join as join53 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
@@ -12899,8 +12926,8 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const now = options.now ?? /* @__PURE__ */ new Date();
   const configPath = join53(repoRoot, CONFIG_PY_PATH);
   const orchestrationPath = join53(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync44(configPath);
-  const orchestrationSchemaMissing = !existsSync44(orchestrationPath);
+  const configMissing = !existsSync45(configPath);
+  const orchestrationSchemaMissing = !existsSync45(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -13117,7 +13144,7 @@ async function runPluginToolSupplyCheck() {
   const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
   const pluginsRoot = join54(root, "services", "_plugins");
-  if (!existsSync45(pluginsRoot)) {
+  if (!existsSync46(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -13148,7 +13175,7 @@ async function runPluginToolSupplyCheck() {
     }
   }
   const servicesApiRoot = join54(root, "services", "api");
-  if (!existsSync45(servicesApiRoot)) {
+  if (!existsSync46(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -13325,7 +13352,7 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync46, readdirSync as readdirSync26 } from "fs";
+import { existsSync as existsSync47, readdirSync as readdirSync26 } from "fs";
 import { join as join56 } from "path";
 import { execa as execa21 } from "execa";
 
@@ -13453,7 +13480,7 @@ function discoverSkeletons(root) {
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync46(join56(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync47(join56(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
@@ -13462,7 +13489,7 @@ async function runSkeletonDriftCheck() {
   for (const name of skeletons) {
     const skeletonRoot = join56(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync46(join56(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync47(join56(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -13614,7 +13641,7 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync47, readFileSync as readFileSync40 } from "fs";
+import { existsSync as existsSync48, readFileSync as readFileSync40 } from "fs";
 import { join as join57, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
@@ -13795,7 +13822,7 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
 }
 function readLocalCoreVersion(cwd) {
   const path = join57(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync47(path)) return null;
+  if (!existsSync48(path)) return null;
   try {
     return extractVersionField(readFileSync40(path, "utf8"));
   } catch {
@@ -13818,7 +13845,7 @@ function extractVersionField(contents) {
 }
 function readFossil(cwd) {
   const path = join57(cwd, CORE_VERSION_FILE);
-  if (!existsSync47(path)) return null;
+  if (!existsSync48(path)) return null;
   try {
     const value = readFileSync40(path, "utf8").trim();
     return value === "" ? null : value;
@@ -14269,13 +14296,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync48 } from "fs";
+import { existsSync as existsSync49 } from "fs";
 import { dirname as dirname11, join as join58 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
     const candidate = join58(dir, relativePath);
-    if (existsSync48(candidate)) return candidate;
+    if (existsSync49(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.282.0",
+  "version": "0.283.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",