@biffo/cli 0.287.11 → 0.288.0

package/dist/index.js

@@ -570,8 +570,8 @@ async function runCoreStatus(options) {
 
 // src/commands/core-upgrade.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync14, rmSync as rmSync5 } from "fs";
-import { join as join15, resolve as resolve3 } from "path";
+import { existsSync as existsSync15, rmSync as rmSync5 } from "fs";
+import { join as join16, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
 import { execa as execa3 } from "execa";
 import { Command as Command3 } from "commander";
@@ -2961,9 +2961,48 @@ function findNewUndeclaredSeams(baseDir, theirsDir, oursDir, portalRelDir = "app
   return undeclared.sort((a, b) => a.specifier.localeCompare(b.specifier));
 }
 
-// src/lib/breaking-changes.ts
+// src/lib/instance-adoption.ts
 import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
 import { join as join11 } from "path";
+var REGISTERED_ADOPTION_PAIRS = [
+  {
+    id: "core-api-environment",
+    description: '`infra/environments/dev/core-api-environment.core.tf` declares `local.core_api_environment` (BIFFO_PLUGIN_MEDIA_BUCKET, BIFFO_PR_SIGNER_FUNCTION_NAME, ...), but `module "core_api"` is a user-owned block Terraform cannot inject an argument into from another file \u2014 so the channel only takes effect once `main.tf` itself merges it in (#1538/#1540/#1579).',
+    templateFile: "infra/environments/dev/core-api-environment.core.tf",
+    userFile: "infra/environments/dev/main.tf",
+    adoptedPattern: /environment_variables\s*=\s*merge\(\s*local\.core_api_environment\s*,/,
+    remedy: 'In `module "core_api"` (infra/environments/dev/main.tf), change `environment_variables = {` to `environment_variables = merge(local.core_api_environment, {` and close the extra paren on the block\u2019s closing `}` \u2014 then `terraform apply`.'
+  }
+];
+function isAdopted(pair, userFileContent) {
+  if (userFileContent === null) return false;
+  return pair.adoptedPattern.test(userFileContent);
+}
+function checkInstanceAdoption(theirsDir, oursDir, pairs = REGISTERED_ADOPTION_PAIRS) {
+  const findings = [];
+  let applicablePairs = 0;
+  for (const pair of pairs) {
+    const shipped = existsSync10(join11(theirsDir, pair.templateFile));
+    if (!shipped) {
+      findings.push({ pair, status: "not-applicable" });
+      continue;
+    }
+    applicablePairs++;
+    const userPath = join11(oursDir, pair.userFile);
+    const content = existsSync10(userPath) ? readFileSync8(userPath, "utf8") : null;
+    findings.push({ pair, status: isAdopted(pair, content) ? "adopted" : "unadopted" });
+  }
+  return {
+    examinedInstances: 1,
+    registeredPairs: pairs.length,
+    applicablePairs,
+    findings
+  };
+}
+
+// src/lib/breaking-changes.ts
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { join as join12 } from "path";
 var UPGRADE_GUIDE_PATH = "docs/guides/core-upgrade.md";
 var SECTION_HEADING = "## Breaking changes by version";
 var ENTRY_HEADING = /^###\s+(\d+\.\d+\.\d+)\s*[—-]\s*(.+?)\s*$/;
@@ -2988,9 +3027,9 @@ function parseBreakingChanges(guide) {
   return entries;
 }
 function readBreakingChanges(templateRoot) {
-  const path = join11(templateRoot, UPGRADE_GUIDE_PATH);
-  if (!existsSync10(path)) return [];
-  return parseBreakingChanges(readFileSync8(path, "utf8"));
+  const path = join12(templateRoot, UPGRADE_GUIDE_PATH);
+  if (!existsSync11(path)) return [];
+  return parseBreakingChanges(readFileSync9(path, "utf8"));
 }
 function breakingChangesBetween(from, to, entries) {
   parseCoreVersion(from);
@@ -3008,15 +3047,15 @@ var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
 
 // src/lib/plugin-terraform-wiring.ts
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   readdirSync as readdirSync3,
   rmSync as rmSync4,
   statSync as statSync2,
   writeFileSync as writeFileSync4
 } from "fs";
-import { join as join12, relative as relative2, sep as sep2 } from "path";
+import { join as join13, relative as relative2, sep as sep2 } from "path";
 var TEMPLATE_MODULE_DIR = "_template";
 var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
 var GENERATED_TF_FILE = "plugins.generated.tf";
@@ -3070,7 +3109,7 @@ function standardArguments(pluginName, handler) {
   ];
 }
 function listPluginModules(cwd) {
-  const dir = join12(cwd, "modules", "plugins");
+  const dir = join13(cwd, "modules", "plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -3082,7 +3121,7 @@ function listPluginModules(cwd) {
 var FIRST_PARTY_TERRAFORM = (name) => `../../../services/_plugins/${name}/terraform`;
 var THIRD_PARTY_TERRAFORM = (name) => `../../../modules/plugins/${name}`;
 function isFirstPartyPlugin(cwd, name) {
-  return existsSync11(join12(cwd, "services", "_plugins", name, "terraform", "main.tf"));
+  return existsSync12(join13(cwd, "services", "_plugins", name, "terraform", "main.tf"));
 }
 function pluginModuleSource(cwd, name) {
   return isFirstPartyPlugin(cwd, name) ? FIRST_PARTY_TERRAFORM(name) : THIRD_PARTY_TERRAFORM(name);
@@ -3091,7 +3130,7 @@ function listWireablePlugins(cwd) {
   return listPluginModules(cwd).filter((name) => !isFirstPartyPlugin(cwd, name)).sort();
 }
 function firstPartyPluginNames(cwd) {
-  const dir = join12(cwd, "services", "_plugins");
+  const dir = join13(cwd, "services", "_plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -3114,7 +3153,7 @@ function walkTfFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join12(dir, entry);
+      const p = join13(dir, entry);
       let st;
       try {
         st = statSync2(p);
@@ -3135,7 +3174,7 @@ function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function findPluginModuleReferences(cwd, name) {
-  const infraDir = join12(cwd, "infra");
+  const infraDir = join13(cwd, "infra");
   const sourceSegments = ["modules", "plugins", name];
   const sourceLinePattern = /^\s*source\s*=\s*"([^"]+)"/;
   const moduleRefPattern = new RegExp(`module\\.plugin_${escapeRegExp(name)}(?![A-Za-z0-9_-])`);
@@ -3143,7 +3182,7 @@ function findPluginModuleReferences(cwd, name) {
   for (const absPath of walkTfFiles(infraDir)) {
     let contents;
     try {
-      contents = readFileSync9(absPath, "utf8");
+      contents = readFileSync10(absPath, "utf8");
     } catch {
       continue;
     }
@@ -3161,7 +3200,7 @@ function findPluginModuleReferences(cwd, name) {
   return refs;
 }
 function listEnvironments(cwd) {
-  const dir = join12(cwd, "infra", "environments");
+  const dir = join13(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -3169,12 +3208,12 @@ function listEnvironments(cwd) {
     return [];
   }
   return entries.filter((e) => {
-    if (!e.isDirectory() || !existsSync11(join12(dir, e.name, "main.tf"))) return false;
-    return declaredVariables(join12(dir, e.name)).has("enabled_plugins");
+    if (!e.isDirectory() || !existsSync12(join13(dir, e.name, "main.tf"))) return false;
+    return declaredVariables(join13(dir, e.name)).has("enabled_plugins");
   }).map((e) => e.name).sort();
 }
 function listUnwirableEnvironments(cwd) {
-  const dir = join12(cwd, "infra", "environments");
+  const dir = join13(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -3182,7 +3221,7 @@ function listUnwirableEnvironments(cwd) {
     return [];
   }
   return entries.filter(
-    (e) => e.isDirectory() && existsSync11(join12(dir, e.name, "main.tf")) && !declaredVariables(join12(dir, e.name)).has("enabled_plugins")
+    (e) => e.isDirectory() && existsSync12(join13(dir, e.name, "main.tf")) && !declaredVariables(join13(dir, e.name)).has("enabled_plugins")
   ).map((e) => e.name).sort();
 }
 function declaredVariables(moduleDir) {
@@ -3197,7 +3236,7 @@ function declaredVariables(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync9(join12(moduleDir, entry.name), "utf8");
+      contents = readFileSync10(join13(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -3219,7 +3258,7 @@ function declaredOutputs(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync9(join12(moduleDir, entry.name), "utf8");
+      contents = readFileSync10(join13(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -3301,7 +3340,7 @@ function syncPluginTerraform(cwd) {
   const skippedEnvironments = listUnwirableEnvironments(cwd);
   const changedPaths = [];
   const rendered = plugins.map((name) => {
-    const moduleDir = join12(cwd, "modules", "plugins", name);
+    const moduleDir = join13(cwd, "modules", "plugins", name);
     return {
       name,
       declaredVariables: declaredVariables(moduleDir),
@@ -3310,16 +3349,16 @@ function syncPluginTerraform(cwd) {
     };
   });
   for (const env of environments) {
-    const envDir = join12(cwd, "infra", "environments", env);
-    const tfPath = join12(envDir, GENERATED_TF_FILE);
-    const tfvarsPath = join12(envDir, GENERATED_TFVARS_FILE);
+    const envDir = join13(cwd, "infra", "environments", env);
+    const tfPath = join13(envDir, GENERATED_TF_FILE);
+    const tfvarsPath = join13(envDir, GENERATED_TFVARS_FILE);
     const relBase = `infra/environments/${env}`;
     if (plugins.length === 0) {
       for (const [abs, rel] of [
         [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
         [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
       ]) {
-        if (existsSync11(abs)) {
+        if (existsSync12(abs)) {
           rmSync4(abs);
           changedPaths.push(rel);
         }
@@ -3335,8 +3374,8 @@ function syncPluginTerraform(cwd) {
 }
 
 // src/lib/lockfile-refresh.ts
-import { existsSync as existsSync12 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { join as join14 } from "path";
 var LOCKFILE_TRIGGERS = [
   {
     manifest: "package.json",
@@ -3359,7 +3398,7 @@ function lockfilesNeedingRefresh(changedPaths, instanceDir, triggers = LOCKFILE_
   const locked = changedPaths.filter((p) => !isForeignManifest(p));
   return triggers.filter((t) => {
     const touched = locked.some((p) => p === t.manifest || p.endsWith(`/${t.manifest}`));
-    return touched && existsSync12(join13(instanceDir, t.lockfile));
+    return touched && existsSync13(join14(instanceDir, t.lockfile));
   });
 }
 async function refreshLockfiles(instanceDir, triggers, run) {
@@ -3379,11 +3418,11 @@ function describeFailures(outcomes) {
 }
 
 // src/lib/instance-dependency-install.ts
-import { existsSync as existsSync13 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { join as join15 } from "path";
 function dependencyInstallSteps(instanceDir) {
   const steps = [{ ecosystem: "pnpm", command: ["pnpm", "install"] }];
-  if (existsSync13(join14(instanceDir, "pyproject.toml"))) {
+  if (existsSync14(join15(instanceDir, "pyproject.toml"))) {
     steps.push({ ecosystem: "uv", command: ["uv", "sync"] });
   }
   return steps;
@@ -3595,6 +3634,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   });
   const orphanRatchet = checkOrphanRatchet(plan.orphaned.length, readOrphanBaseline(options.cwd));
   const newSeams = findNewUndeclaredSeams(baseDir, theirsDir, options.cwd);
+  const adoption = checkInstanceAdoption(theirsDir, options.cwd);
   const migrations = planMigrationCarry({
     templateDir: theirsDir,
     instanceDir: options.cwd,
@@ -3621,6 +3661,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     throw new Error(fidelityFailure(fidelity, toVersion));
   }
   printNewInstanceSeams(newSeams);
+  printAdoptionReport(adoption);
   printOrphanReport(plan.orphaned, orphanRatchet);
   if (orphanRatchet.increased) {
     throw new Error(
@@ -3679,10 +3720,11 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     theirsDir,
     coreVersionCleanup,
     orphanRatchet,
-    newSeams
+    newSeams,
+    adoption
   );
 }
-async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet, newSeams) {
+async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet, newSeams, adoption) {
   if (breaking.length > 0 && !options.acknowledgeBreaking) {
     throw new Error(
       `This upgrade crosses ${breaking.length} documented breaking change(s): ${breaking.map((b) => b.version).join(", ")}. They are printed above and in ${UPGRADE_GUIDE_PATH}. Read what each one requires \u2014 some destroy data or need manual work after the deploy \u2014 then re-run with --acknowledge-breaking.`
@@ -3715,6 +3757,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
       coreVersionCleanup,
       orphanRatchet,
       newSeams,
+      adoption,
       branch,
       token
     );
@@ -3749,7 +3792,7 @@ async function restoreCallerBranch(git, cwd, callerBranch, upgradeBranch) {
     );
   }
 }
-async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet, newSeams, branch, token) {
+async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking, theirsDir, coreVersionCleanup, orphanRatchet, newSeams, adoption, branch, token) {
   const { git } = deps;
   const applied = applyUpgradePlan(options.cwd, plan, theirsDir);
   const carried = applyMigrationCarry(options.cwd, migrations);
@@ -3762,7 +3805,7 @@ async function buildCommitAndOpenPr(options, deps, plan, migrations, fromVersion
     );
   }
   const cleanedCoreVersion = coreVersionCleanup?.action === "delete";
-  if (cleanedCoreVersion && existsSync14(coreVersionCleanup.path)) {
+  if (cleanedCoreVersion && existsSync15(coreVersionCleanup.path)) {
     rmSync5(coreVersionCleanup.path);
     log.info(
       coreVersionCleanup.stale ? `Deleted stale ${CORE_VERSION_FILE} (recorded ${coreVersionCleanup.found}, behind the version biffo.core.json records \u2014 this instance has moved past it) (#842).` : `Deleted orphaned ${CORE_VERSION_FILE} (inherited copy recording ${coreVersionCleanup.found}, superseded by biffo.core.json) \u2014 nothing reads it as an authority (#434).`
@@ -3819,7 +3862,8 @@ ${marker}` : "this upgrade carries no template PRs, so no provenance marker is n
       cleanedCoreVersion ? coreVersionCleanup : null,
       carriedPrs,
       newSeams,
-      installFailures
+      installFailures,
+      adoption.findings
     )
   });
   if (plan.conflicts.length > 0) {
@@ -3875,7 +3919,7 @@ function carriedPrNumbers(subjects) {
   }
   return [...new Set(numbers)].sort((a, b) => a - b);
 }
-function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, lockfiles = [], breaking = [], coreVersionCleanup = null, carriedPrs = [], newSeams = [], installFailures = []) {
+function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, lockfiles = [], breaking = [], coreVersionCleanup = null, carriedPrs = [], newSeams = [], installFailures = [], adoptionFindings = []) {
   const lines = [];
   if (breaking.length > 0) {
     lines.push(
@@ -3907,6 +3951,27 @@ function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, loc
       ""
     );
   }
+  const unadopted = adoptionFindings.filter((f) => f.status === "unadopted");
+  if (unadopted.length > 0) {
+    lines.push(
+      `## \u26A0 ${unadopted.length} instance adoption gap(s) \u2014 shipped but not consumed (#1538/#1570)`,
+      "",
+      "The template-owned file(s) below already exist in this instance, but the **user-owned** file that must read them has not been edited to do so. The mechanism ships, CI is green, and it does nothing at runtime \u2014 `biffo core upgrade` cannot fix this itself (the file it would need to edit is user-owned), so it is surfaced here on every upgrade until it is adopted by hand.",
+      "",
+      ...unadopted.flatMap((f) => [
+        `### \`${f.pair.id}\``,
+        "",
+        f.pair.description,
+        "",
+        `- Template-owned: \`${f.pair.templateFile}\` (already present in this instance)`,
+        `- Needs editing: \`${f.pair.userFile}\``,
+        `- Fix: ${f.pair.remedy}`,
+        ""
+      ]),
+      "---",
+      ""
+    );
+  }
   lines.push(
     "Automated core upgrade generated by `biffo core upgrade` (ADR-0006).",
     "",
@@ -4107,6 +4172,30 @@ function printNewInstanceSeams(seams) {
   }
   console.log();
 }
+function printAdoptionReport(report) {
+  console.log(
+    chalk4.dim(
+      `  Instance adoption: examined ${String(report.examinedInstances)} instance against ${String(report.registeredPairs)} registered pair(s), ${String(report.applicablePairs)} applicable to this upgrade.`
+    )
+  );
+  const unadopted = report.findings.filter((f) => f.status === "unadopted");
+  if (unadopted.length === 0) {
+    console.log();
+    return;
+  }
+  console.log(
+    chalk4.red.bold(
+      `  \u26A0 ${String(unadopted.length)} adoption gap(s) \u2014 shipped but not consumed (#1538/#1570):`
+    )
+  );
+  for (const f of unadopted) {
+    console.log(
+      `    ${chalk4.bold(f.pair.id)} \u2014 ${chalk4.yellow(f.pair.userFile)} does not consume ` + chalk4.yellow(f.pair.templateFile)
+    );
+    console.log(chalk4.dim(`      ${f.pair.remedy}`));
+  }
+  console.log();
+}
 function printTargetFidelity(report, toVersion) {
   if (report.unverifiable !== null) {
     console.log(chalk4.yellow(`  Target fidelity: NOT VERIFIED \u2014 ${report.unverifiable}`));
@@ -4223,8 +4312,8 @@ function printBreakingChanges(breaking, applying) {
 }
 function versionOfCheckout(dir, explicit) {
   if (explicit) return explicit;
-  const file = join15(dir, CORE_VERSION_FILE);
-  if (existsSync14(file)) return readCoreVersionFile(file);
+  const file = join16(dir, CORE_VERSION_FILE);
+  if (existsSync15(file)) return readCoreVersionFile(file);
   throw new Error(
     `Cannot determine the core version of ${dir}: it has no ${CORE_VERSION_FILE}, and a checkout supplied explicitly is not resolved from a tag. Pass --to to state which version this tree is.`
   );
@@ -4232,8 +4321,8 @@ function versionOfCheckout(dir, explicit) {
 function latestCoreVersion(repo) {
   const fromTags = latestCoreVersionFromTags(repo);
   if (fromTags) return fromTags;
-  const file = join15(repo, CORE_VERSION_FILE);
-  if (existsSync14(file)) return readCoreVersionFile(file);
+  const file = join16(repo, CORE_VERSION_FILE);
+  if (existsSync15(file)) return readCoreVersionFile(file);
   throw new Error(
     `Cannot determine the template's core version: ${repo} has no core-v* tags and no ${CORE_VERSION_FILE}. Fetch tags (\`git fetch --tags\`) or pass --to explicitly.`
   );
@@ -4251,7 +4340,7 @@ coreCommand.addCommand(coreUpgradeCommand);
 import { Command as Command8 } from "commander";
 
 // src/commands/data-apply.ts
-import { existsSync as existsSync16, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync12 } from "fs";
 import { resolve as resolve4 } from "path";
 import chalk5 from "chalk";
 import { Command as Command5 } from "commander";
@@ -4702,16 +4791,16 @@ function isTemplatePlaceholderConfig(raw) {
 
 // src/lib/session.ts
 import {
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   rmSync as rmSync6,
   statSync as statSync3,
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var LEGACY_STEP_ALIASES = {
   github_config: ["github_branches", "github_instance_files", "github_settings"]
 };
@@ -4720,39 +4809,39 @@ function hasCompleted(session, step) {
   return session.completedSteps.some((done) => LEGACY_STEP_ALIASES[done]?.includes(step) ?? false);
 }
 function sessionsDir() {
-  return process.env["BIFFO_SESSIONS_DIR"] ?? join16(homedir(), ".biffo", "sessions");
+  return process.env["BIFFO_SESSIONS_DIR"] ?? join17(homedir(), ".biffo", "sessions");
 }
 function sessionPath(projectName) {
-  return join16(sessionsDir(), `${projectName}.json`);
+  return join17(sessionsDir(), `${projectName}.json`);
 }
 function loadSession(projectName) {
   const path = sessionPath(projectName);
-  if (!existsSync15(path)) return null;
+  if (!existsSync16(path)) return null;
   try {
-    return JSON.parse(readFileSync10(path, "utf8"));
+    return JSON.parse(readFileSync11(path, "utf8"));
   } catch {
     return null;
   }
 }
 function findLatestSession() {
   const dir = sessionsDir();
-  if (!existsSync15(dir)) return null;
+  if (!existsSync16(dir)) return null;
   const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return null;
   const sorted = files.map((f) => {
-    const fullPath = join16(dir, f);
-    const mtime = existsSync15(fullPath) ? statSync3(fullPath).mtimeMs : -1;
+    const fullPath = join17(dir, f);
+    const mtime = existsSync16(fullPath) ? statSync3(fullPath).mtimeMs : -1;
     return { f, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   try {
-    return JSON.parse(readFileSync10(join16(dir, sorted[0].f), "utf8"));
+    return JSON.parse(readFileSync11(join17(dir, sorted[0].f), "utf8"));
   } catch {
     return null;
   }
 }
 function saveSession(session) {
   const dir = sessionsDir();
-  if (!existsSync15(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync16(dir)) mkdirSync4(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSession(name);
   if (prior) {
@@ -4774,36 +4863,36 @@ function markStepComplete(session, step) {
 }
 function deleteSession(projectName) {
   const path = sessionPath(projectName);
-  if (existsSync15(path)) rmSync6(path);
+  if (existsSync16(path)) rmSync6(path);
 }
 function projectsDir() {
-  return process.env["BIFFO_PROJECTS_DIR"] ?? join16(homedir(), ".biffo", "projects");
+  return process.env["BIFFO_PROJECTS_DIR"] ?? join17(homedir(), ".biffo", "projects");
 }
 function saveProjectConfig(config) {
   const dir = projectsDir();
-  if (!existsSync15(dir)) mkdirSync4(dir, { recursive: true });
-  writeFileSync5(join16(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
+  if (!existsSync16(dir)) mkdirSync4(dir, { recursive: true });
+  writeFileSync5(join17(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
 }
 function loadProjectConfig(name) {
-  const path = join16(projectsDir(), `${name}.json`);
-  if (!existsSync15(path)) return null;
+  const path = join17(projectsDir(), `${name}.json`);
+  if (!existsSync16(path)) return null;
   try {
-    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync10(path, "utf8")));
+    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync11(path, "utf8")));
     return result.success ? result.data : null;
   } catch {
     return null;
   }
 }
 function deleteProjectConfig(name) {
-  const path = join16(projectsDir(), `${name}.json`);
-  if (existsSync15(path)) rmSync6(path);
+  const path = join17(projectsDir(), `${name}.json`);
+  if (existsSync16(path)) rmSync6(path);
 }
 function listProjectConfigs() {
   const dir = projectsDir();
-  if (!existsSync15(dir)) return [];
+  if (!existsSync16(dir)) return [];
   return readdirSync4(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
     try {
-      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync10(join16(dir, f), "utf8")));
+      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync11(join17(dir, f), "utf8")));
       return result.success ? [result.data] : [];
     } catch {
       return [];
@@ -4872,7 +4961,7 @@ async function runDataApply(name, environment, config, aws) {
 }
 async function resolveConfig(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync11(resolve4(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync12(resolve4(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -4892,8 +4981,8 @@ async function resolveConfig(options) {
     return cfg;
   }
   const localConfigPath = resolve4(process.cwd(), "biffo.config.json");
-  if (existsSync16(localConfigPath)) {
-    const raw = JSON.parse(readFileSync11(localConfigPath, "utf8"));
+  if (existsSync17(localConfigPath)) {
+    const raw = JSON.parse(readFileSync12(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -4939,8 +5028,8 @@ async function resolveConfig(options) {
 
 // src/commands/data-import.ts
 import { execSync as execSync3 } from "child_process";
-import { cpSync, existsSync as existsSync17, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
-import { join as join17, resolve as resolve5 } from "path";
+import { cpSync, existsSync as existsSync18, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
+import { join as join18, resolve as resolve5 } from "path";
 import chalk6 from "chalk";
 import { Command as Command6 } from "commander";
 import inquirer2 from "inquirer";
@@ -4980,23 +5069,23 @@ async function runDataImport(name, options, deps) {
       `Invalid import name '${name}'. Use lowercase letters, numbers, and hyphens, starting with a letter.`
     );
   }
-  const servicesDir = join17(options.cwd, "services");
-  if (!existsSync17(servicesDir)) {
+  const servicesDir = join18(options.cwd, "services");
+  if (!existsSync18(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join17(options.cwd, "db", "imports", name);
-  if (existsSync17(targetDir)) {
+  const targetDir = join18(options.cwd, "db", "imports", name);
+  if (existsSync18(targetDir)) {
     throw new Error(
       `DDL import '${name}' is already present at db/imports/${name}/. Remove it first to re-import.`
     );
   }
-  const isLocalDir = existsSync17(options.source) && statSync4(options.source).isDirectory();
+  const isLocalDir = existsSync18(options.source) && statSync4(options.source).isDirectory();
   let sourceDir;
   let cleanupClone = null;
   if (isLocalDir) {
-    sourceDir = options.path ? join17(options.source, options.path) : options.source;
+    sourceDir = options.path ? join18(options.source, options.path) : options.source;
   } else {
     const token = options.token ?? await resolveDdlImportToken();
     log.info(`Cloning ${options.source}...`);
@@ -5004,10 +5093,10 @@ async function runDataImport(name, options, deps) {
     cleanupClone = () => {
       deps.git.cleanup(tmpDir);
     };
-    sourceDir = options.path ? join17(tmpDir, options.path) : tmpDir;
+    sourceDir = options.path ? join18(tmpDir, options.path) : tmpDir;
   }
   try {
-    if (!existsSync17(sourceDir)) {
+    if (!existsSync18(sourceDir)) {
       throw new Error(`Source directory does not exist: ${sourceDir}`);
     }
     const sqlFiles = readdirSync5(sourceDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name).sort();
@@ -5032,7 +5121,7 @@ async function runDataImport(name, options, deps) {
     }
     mkdirSync5(targetDir, { recursive: true });
     for (const file of sqlFiles) {
-      cpSync(join17(sourceDir, file), join17(targetDir, file));
+      cpSync(join18(sourceDir, file), join18(targetDir, file));
     }
     log.success(`Imported ${String(sqlFiles.length)} .sql file(s) to db/imports/${name}/`);
     const commitMessage = `feat(data): import ${name} (${String(sqlFiles.length)} SQL file(s))`;
@@ -5084,8 +5173,8 @@ function printDryRun(name, sqlFiles) {
 }
 
 // src/commands/data-list.ts
-import { existsSync as existsSync18, readdirSync as readdirSync6 } from "fs";
-import { join as join18, resolve as resolve6 } from "path";
+import { existsSync as existsSync19, readdirSync as readdirSync6 } from "fs";
+import { join as join19, resolve as resolve6 } from "path";
 import chalk7 from "chalk";
 import { Command as Command7 } from "commander";
 var dataListCommand = new Command7("list").description("List DDL imports vendored in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -5098,15 +5187,15 @@ var dataListCommand = new Command7("list").description("List DDL imports vendore
   }
 });
 async function runDataList(options) {
-  const importsDir = join18(options.cwd, "db", "imports");
-  if (!existsSync18(importsDir)) {
+  const importsDir = join19(options.cwd, "db", "imports");
+  if (!existsSync19(importsDir)) {
     console.log(chalk7.dim("\n  No DDL imports in this checkout.\n"));
     return;
   }
   const candidates = readdirSync6(importsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
   const imports = [];
   for (const name of candidates) {
-    const fileCount = readdirSync6(join18(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
+    const fileCount = readdirSync6(join19(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
     if (fileCount > 0) imports.push({ name, fileCount });
   }
   if (imports.length === 0) {
@@ -5136,7 +5225,7 @@ dataCommand.addCommand(dataListCommand);
 
 // src/commands/deploy.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync13 } from "fs";
 import { resolve as resolve7 } from "path";
 import chalk8 from "chalk";
 import { Command as Command9 } from "commander";
@@ -5493,7 +5582,7 @@ var deployCommand = new Command9("deploy").description("Deploy infrastructure an
 );
 async function resolveConfig2(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync12(resolve7(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync13(resolve7(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -5513,8 +5602,8 @@ async function resolveConfig2(options) {
     return cfg;
   }
   const localConfigPath = resolve7(process.cwd(), "biffo.config.json");
-  if (existsSync19(localConfigPath)) {
-    const raw = JSON.parse(readFileSync12(localConfigPath, "utf8"));
+  if (existsSync20(localConfigPath)) {
+    const raw = JSON.parse(readFileSync13(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -5910,7 +5999,7 @@ function resolveGithubToken() {
 
 // src/commands/destroy.ts
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { resolve as resolve8 } from "path";
 import chalk9 from "chalk";
 import { Command as Command10 } from "commander";
@@ -6000,7 +6089,7 @@ var destroyCommand = new Command10("destroy").description("Destroy infrastructur
 });
 async function resolveConfig3(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync13(resolve8(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync14(resolve8(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -6020,7 +6109,7 @@ async function resolveConfig3(options) {
     return cfg;
   }
   try {
-    const raw = JSON.parse(readFileSync13(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
+    const raw = JSON.parse(readFileSync14(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
   } catch {
@@ -6070,15 +6159,15 @@ function resolveGithubToken2() {
 }
 
 // src/commands/init.ts
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 import { resolve as resolve10 } from "path";
 import chalk12 from "chalk";
 import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
-import { existsSync as existsSync20, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
-import { dirname as dirname5, join as join19, relative as relative3, sep as sep3 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
+import { dirname as dirname5, join as join20, relative as relative3, sep as sep3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SKIP_ENV_VAR = "BIFFO_SKIP_BUILD_FRESHNESS_CHECK";
 function checkBuildFreshness(options = {}) {
@@ -6092,7 +6181,7 @@ function checkBuildFreshness(options = {}) {
   if (!packageRoot) {
     return { status: "skipped", reason: `no package.json above ${moduleDir}`, newerSources: [] };
   }
-  const distDir = join19(packageRoot, "dist");
+  const distDir = join20(packageRoot, "dist");
   if (!isInside(distDir, moduleDir)) {
     return {
       status: "skipped",
@@ -6100,16 +6189,16 @@ function checkBuildFreshness(options = {}) {
       newerSources: []
     };
   }
-  const srcDir = join19(packageRoot, "src");
-  if (!existsSync20(srcDir)) {
+  const srcDir = join20(packageRoot, "src");
+  if (!existsSync21(srcDir)) {
     return {
       status: "skipped",
       reason: "no src/ alongside dist/ \u2014 this is a shipped package",
       newerSources: []
     };
   }
-  const entry = join19(distDir, "index.js");
-  if (!existsSync20(entry)) {
+  const entry = join20(distDir, "index.js");
+  if (!existsSync21(entry)) {
     return { status: "skipped", reason: `${entry} not found`, newerSources: [] };
   }
   const builtAt = statSync5(entry).mtimeMs;
@@ -6153,7 +6242,7 @@ function collectSourceFiles(srcDir) {
   const found = [];
   const walk2 = (dir) => {
     for (const entry of readdirSync7(dir, { withFileTypes: true })) {
-      const full = join19(dir, entry.name);
+      const full = join20(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules") continue;
         walk2(full);
@@ -6172,7 +6261,7 @@ function collectSourceFiles(srcDir) {
 function findPackageRoot(from) {
   let dir = from;
   for (; ; ) {
-    if (existsSync20(join19(dir, "package.json"))) return dir;
+    if (existsSync21(join20(dir, "package.json"))) return dir;
     const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -6186,9 +6275,9 @@ function isInside(parent, child) {
 
 // src/lib/credentials.ts
 import { execSync as execSync6 } from "child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync15 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand2, STSClient as STSClient2 } from "@aws-sdk/client-sts";
 import chalk10 from "chalk";
 import inquirer4 from "inquirer";
@@ -6367,11 +6456,11 @@ async function verifySelectedAwsCredentials(profile, region) {
   return sts.send(new GetCallerIdentityCommand2({}));
 }
 function discoverAwsProfiles() {
-  const files = [join20(homedir2(), ".aws", "credentials"), join20(homedir2(), ".aws", "config")];
+  const files = [join21(homedir2(), ".aws", "credentials"), join21(homedir2(), ".aws", "config")];
   const profiles = /* @__PURE__ */ new Set();
   for (const file of files) {
-    if (!existsSync21(file)) continue;
-    const content = readFileSync14(file, "utf8");
+    if (!existsSync22(file)) continue;
+    const content = readFileSync15(file, "utf8");
     for (const match of content.matchAll(/^\s*\[([^\]]+)\]\s*$/gm)) {
       const section = match[1]?.trim();
       if (!section) continue;
@@ -6461,34 +6550,34 @@ var SiblingConfigSchema = z6.object({
 
 // src/lib/sibling-session.ts
 import {
-  existsSync as existsSync22,
+  existsSync as existsSync23,
   mkdirSync as mkdirSync6,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   rmSync as rmSync7,
   statSync as statSync6,
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function sessionsDir2() {
-  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join21(homedir3(), ".biffo", "sibling-sessions");
+  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join22(homedir3(), ".biffo", "sibling-sessions");
 }
 function sessionPath2(projectName) {
-  return join21(sessionsDir2(), `${projectName}.json`);
+  return join22(sessionsDir2(), `${projectName}.json`);
 }
 function loadSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (!existsSync22(path)) return null;
+  if (!existsSync23(path)) return null;
   try {
-    return JSON.parse(readFileSync15(path, "utf8"));
+    return JSON.parse(readFileSync16(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveSiblingSession(session) {
   const dir = sessionsDir2();
-  if (!existsSync22(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync23(dir)) mkdirSync6(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSiblingSession(name);
   if (prior) {
@@ -6510,30 +6599,30 @@ function markSiblingStepComplete(session, step) {
 }
 function deleteSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (existsSync22(path)) rmSync7(path);
+  if (existsSync23(path)) rmSync7(path);
 }
 
 // src/commands/sibling-create.ts
-import { cpSync as cpSync2, existsSync as existsSync23, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync24, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync17, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname6, join as join23, resolve as resolve9 } from "path";
+import { dirname as dirname6, join as join24, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import chalk11 from "chalk";
 import { Command as Command11 } from "commander";
 
 // src/lib/skeleton-dotfiles.ts
 import { readdirSync as readdirSync9, renameSync } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var PACKAGED_GITIGNORE = "_gitignore";
 var REAL_GITIGNORE = ".gitignore";
 function restorePackagedDotfiles(dir) {
   const restored = [];
   for (const entry of readdirSync9(dir, { withFileTypes: true })) {
-    const full = join22(dir, entry.name);
+    const full = join23(dir, entry.name);
     if (entry.isDirectory()) {
       restored.push(...restorePackagedDotfiles(full));
     } else if (entry.name === PACKAGED_GITIGNORE) {
-      const target = join22(dir, REAL_GITIGNORE);
+      const target = join23(dir, REAL_GITIGNORE);
       renameSync(full, target);
       restored.push(target);
     }
@@ -6578,7 +6667,7 @@ async function runSiblingCreateCommand(name, options) {
     printDryRun2(config, coreConfig, options.templateRoot);
     return;
   }
-  if (!existsSync23(options.templateRoot)) {
+  if (!existsSync24(options.templateRoot)) {
     throw new Error(`Sibling template not found at ${options.templateRoot}`);
   }
   let session = null;
@@ -6795,7 +6884,7 @@ function assertPathPrefixIsAllowed(pathPrefix) {
   }
 }
 function readSiblingConfig(path, root = false) {
-  const raw = JSON.parse(readFileSync16(path, "utf8"));
+  const raw = JSON.parse(readFileSync17(path, "utf8"));
   const withDefaults = raw && typeof raw === "object" && "project" in raw && "core" in raw ? {
     ...raw,
     core: {
@@ -6829,7 +6918,7 @@ function resolveCoreConfig(config, configPath) {
   throw new Error("Either core.project_name or core.config_path is required.");
 }
 function parseCoreConfig(path) {
-  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync16(path, "utf8")));
+  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync17(path, "utf8")));
   if (!result.success) {
     throw new Error(
       `Invalid core configuration at ${path}:
@@ -6868,7 +6957,7 @@ async function resolveCoreIdentity(coreAws, coreConfig, environments) {
   return coreIdentity;
 }
 async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
-  const workDir = mkdtempSync4(join23(tmpdir4(), `biffo-sibling-${config.project.name}-`));
+  const workDir = mkdtempSync4(join24(tmpdir4(), `biffo-sibling-${config.project.name}-`));
   try {
     writeSiblingTemplate(skeletonRoot, workDir, config, {
       coreProjectName: coreConfig.project.name,
@@ -6893,13 +6982,13 @@ async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, git
   }
 }
 function writeSiblingTemplate(templateRoot, targetDir, config, context) {
-  if (!existsSync23(templateRoot)) {
+  if (!existsSync24(templateRoot)) {
     throw new Error(`Sibling template not found at ${templateRoot}`);
   }
   cpSync2(templateRoot, targetDir, { recursive: true });
   restorePackagedDotfiles(targetDir);
   writeFileSync7(
-    join23(targetDir, "biffo.sibling.json"),
+    join24(targetDir, "biffo.sibling.json"),
     JSON.stringify(
       {
         name: config.project.name,
@@ -6918,14 +7007,14 @@ function writeSiblingTemplate(templateRoot, targetDir, config, context) {
     ) + "\n"
   );
   writeFileSync7(
-    join23(targetDir, ".biffo-shared-version"),
+    join24(targetDir, ".biffo-shared-version"),
     `core-v${context.templateVersion.replace(/^core-v/, "")}
 `
   );
-  const envPath = join23(targetDir, "apps", "frontend", ".env.example");
+  const envPath = join24(targetDir, "apps", "frontend", ".env.example");
   try {
     const path = basePathFor(context.pathPrefix);
-    const content = readFileSync16(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
+    const content = readFileSync17(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
     writeFileSync7(envPath, content);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
@@ -6972,7 +7061,7 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
 }
 function readExistingSiblingOrigins(filePath) {
   try {
-    return JSON.parse(readFileSync16(filePath, "utf8"));
+    return JSON.parse(readFileSync17(filePath, "utf8"));
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw err;
@@ -6991,10 +7080,10 @@ function assertGitIdentity(identity) {
   );
 }
 function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
-  const cdnVarsPath = join23(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
+  const cdnVarsPath = join24(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
   let declaresSiblingOrigins = false;
   try {
-    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync16(cdnVarsPath, "utf8"));
+    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync17(cdnVarsPath, "utf8"));
   } catch {
     declaresSiblingOrigins = false;
   }
@@ -7004,10 +7093,10 @@ function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x")
     );
   }
   if (!isRootPathPrefix(pathPrefix)) return;
-  const cdnMainPath = join23(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
+  const cdnMainPath = join24(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
   let supportsRoot = false;
   try {
-    supportsRoot = /root_sibling_registered/.test(readFileSync16(cdnMainPath, "utf8"));
+    supportsRoot = /root_sibling_registered/.test(readFileSync17(cdnMainPath, "utf8"));
   } catch {
     supportsRoot = false;
   }
@@ -7037,8 +7126,8 @@ async function registerWithCore(git, github, config, coreConfig, pathPrefix, git
     for (const env of config.environments) {
       const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
       const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
-      const relativePath = join23("infra", "environments", env, "siblings.auto.tfvars.json");
-      const filePath = join23(cloneDir, relativePath);
+      const relativePath = join24("infra", "environments", env, "siblings.auto.tfvars.json");
+      const filePath = join24(cloneDir, relativePath);
       const existing = readExistingSiblingOrigins(filePath);
       const siblings = upsertSiblingOrigin(existing.sibling_origins ?? [], {
         name,
@@ -7118,8 +7207,8 @@ function defaultSiblingTemplateRoot() {
   const start = dirname6(fileURLToPath4(import.meta.url));
   let dir = start;
   for (; ; ) {
-    const candidate = join23(dir, "_skeletons", "sibling-template");
-    if (existsSync23(candidate)) return candidate;
+    const candidate = join24(dir, "_skeletons", "sibling-template");
+    if (existsSync24(candidate)) return candidate;
     const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
@@ -7143,7 +7232,7 @@ var initCommand = new Command12("init").description("Scaffold a new project from
     let config;
     let githubToken;
     if (options.config) {
-      const rawConfig = JSON.parse(readFileSync17(resolve10(options.config), "utf8"));
+      const rawConfig = JSON.parse(readFileSync18(resolve10(options.config), "utf8"));
       config = parseConfig(rawConfig);
       const { account_id: accountId, region } = config.cloud.config;
       session = resolveConfigFileSession(config, accountId, region, options.fresh === true);
@@ -7588,8 +7677,8 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 import { Command as Command21 } from "commander";
 
 // src/commands/plugin-create.ts
-import { existsSync as existsSync26, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname8, join as join26, resolve as resolve11 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join27, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
@@ -7653,21 +7742,21 @@ function workflowCheckContexts(workflow) {
 }
 
 // src/lib/plugin-locations.ts
-import { existsSync as existsSync24, readdirSync as readdirSync10 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync25, readdirSync as readdirSync10 } from "fs";
+import { join as join25 } from "path";
 var FIRST_PARTY_PLUGINS_DIR = "_plugins";
 var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
 function pluginDir(name, channel) {
   return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
 }
 function scanDir(absDir, relDir, channel) {
-  if (!existsSync24(absDir)) return [];
+  if (!existsSync25(absDir)) return [];
   const found = [];
   for (const entry of readdirSync10(absDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
-    const manifestPath = join24(absDir, entry.name, PLUGIN_MANIFEST_FILE);
-    if (!existsSync24(manifestPath)) continue;
+    const manifestPath = join25(absDir, entry.name, PLUGIN_MANIFEST_FILE);
+    if (!existsSync25(manifestPath)) continue;
     found.push({
       dirName: entry.name,
       relDir: `${relDir}/${entry.name}`,
@@ -7678,11 +7767,11 @@ function scanDir(absDir, relDir, channel) {
   return found;
 }
 function findInstalledPlugins(cwd) {
-  const servicesDir = join24(cwd, "services");
+  const servicesDir = join25(cwd, "services");
   return [
     ...scanDir(servicesDir, "services", "third-party"),
     ...scanDir(
-      join24(servicesDir, FIRST_PARTY_PLUGINS_DIR),
+      join25(servicesDir, FIRST_PARTY_PLUGINS_DIR),
       `services/${FIRST_PARTY_PLUGINS_DIR}`,
       "first-party"
     )
@@ -7911,13 +8000,13 @@ function validateManifest(raw) {
 // src/lib/plugin-scaffold.ts
 import {
   copyFileSync,
-  existsSync as existsSync25,
+  existsSync as existsSync26,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync11,
   writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname7, join as join25 } from "path";
+import { dirname as dirname7, join as join26 } from "path";
 var STANDALONE_ONLY_ENTRIES = {
   ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
   "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
@@ -7971,10 +8060,10 @@ function applySubstitutions(text, names) {
 var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
 function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
   const layout = options.layout ?? "in-tree";
-  if (!existsSync25(skeletonRoot)) {
+  if (!existsSync26(skeletonRoot)) {
     throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
   }
-  if (!existsSync25(join25(skeletonRoot, "terraform"))) {
+  if (!existsSync26(join26(skeletonRoot, "terraform"))) {
     throw new Error(
       `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
     );
@@ -7982,7 +8071,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
   const skipped = [];
   const files = [];
   const walk2 = (relDir) => {
-    const absDir = join25(skeletonRoot, relDir);
+    const absDir = join26(skeletonRoot, relDir);
     for (const entry of readdirSync11(absDir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     )) {
@@ -7997,14 +8086,14 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
         continue;
       }
       const destRel = applySubstitutions(relPath, names);
-      const destPath = join25(destDir, destRel);
+      const destPath = join26(destDir, destRel);
       mkdirSync8(dirname7(destPath), { recursive: true });
       if (BINARY_EXTENSIONS.test(entry.name)) {
-        copyFileSync(join25(skeletonRoot, relPath), destPath);
+        copyFileSync(join26(skeletonRoot, relPath), destPath);
       } else {
         writeFileSync8(
           destPath,
-          applySubstitutions(readFileSync18(join25(skeletonRoot, relPath), "utf8"), names)
+          applySubstitutions(readFileSync19(join26(skeletonRoot, relPath), "utf8"), names)
         );
       }
       files.push(destRel);
@@ -8021,8 +8110,8 @@ function scaffoldPlugin(skeletonRoot, destDir, names, options = {}) {
 function findSkeletonRoot(startDir, skeleton) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join25(dir, "_skeletons", skeleton);
-    if (existsSync25(candidate)) return candidate;
+    const candidate = join26(dir, "_skeletons", skeleton);
+    if (existsSync26(candidate)) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -8090,7 +8179,7 @@ async function runPluginCreate(name, options, deps) {
     reportBranchProtectionSummary();
     return;
   }
-  const isInstance = existsSync26(join26(options.cwd, INSTANCE_CORE_FILE));
+  const isInstance = existsSync27(join27(options.cwd, INSTANCE_CORE_FILE));
   if (options.firstParty && isInstance) {
     throw new Error(
       `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
@@ -8098,19 +8187,19 @@ async function runPluginCreate(name, options, deps) {
   }
   const channel = options.firstParty ? "first-party" : "third-party";
   const relDir = pluginDir(names.slug, channel);
-  const destDir = join26(options.cwd, relDir);
-  const servicesDir = join26(options.cwd, "services");
-  if (!existsSync26(servicesDir)) {
+  const destDir = join27(options.cwd, relDir);
+  const servicesDir = join27(options.cwd, "services");
+  if (!existsSync27(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  if (existsSync26(destDir)) {
+  if (existsSync27(destDir)) {
     throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
   }
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join26(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync26(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join27(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync27(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -8125,8 +8214,8 @@ async function runPluginCreate(name, options, deps) {
   for (const { entry, reason } of skipped) {
     log.info(`Skipped ${entry} \u2014 ${reason}`);
   }
-  const manifestPath = join26(destDir, "biffo.plugin.json");
-  const manifest = validateManifest(JSON.parse(readFileSync19(manifestPath, "utf8")));
+  const manifestPath = join27(destDir, "biffo.plugin.json");
+  const manifest = validateManifest(JSON.parse(readFileSync20(manifestPath, "utf8")));
   if (manifest.name !== names.slug) {
     throw new Error(
       `Scaffolded manifest declares name '${manifest.name}', expected '${names.slug}'. The skeleton's manifest name may have diverged from 'example-plugin'.`
@@ -8149,8 +8238,8 @@ async function runPluginCreate(name, options, deps) {
   printNextSteps(names, relDir, channel);
 }
 async function runStandaloneCreate(names, options, deps) {
-  const destDir = join26(options.cwd, names.dist);
-  if (existsSync26(destDir)) {
+  const destDir = join27(options.cwd, names.dist);
+  if (existsSync27(destDir)) {
     throw new Error(`${names.dist}/ already exists. Choose a different name, or remove it first.`);
   }
   const skeletonRoot = resolveSkeletonRoot(options);
@@ -8168,7 +8257,7 @@ async function runStandaloneCreate(names, options, deps) {
   restorePackagedDotfiles(destDir);
   log.success(`Scaffolded ${String(files.length)} file(s) into ${names.dist}/`);
   const manifest = validateManifest(
-    JSON.parse(readFileSync19(join26(destDir, "biffo.plugin.json"), "utf8"))
+    JSON.parse(readFileSync20(join27(destDir, "biffo.plugin.json"), "utf8"))
   );
   if (manifest.name !== names.slug) {
     throw new Error(
@@ -8179,7 +8268,7 @@ async function runStandaloneCreate(names, options, deps) {
     `Manifest valid \u2014 ${String(manifest.tables.length)} table(s), ${String(manifest.api_routes.length)} route(s)`
   );
   writeFileSync9(
-    join26(destDir, ".biffo-shared-version"),
+    join27(destDir, ".biffo-shared-version"),
     `core-v${getLatestCoreVersion().replace(/^core-v/, "")}
 `
   );
@@ -8212,8 +8301,8 @@ async function createAndPushStandaloneRepo(org, names, destDir, options, deps) {
   await deps.git.push(destDir, "dev", { token });
   log.success(`Pushed dev to ${org}/${names.dist}`);
   await github.setDefaultBranch(org, names.dist, "dev");
-  const ciPath = join26(destDir, ".github", "workflows", "ci.yml");
-  const contexts = existsSync26(ciPath) ? workflowCheckContexts(readFileSync19(ciPath, "utf8")) : [];
+  const ciPath = join27(destDir, ".github", "workflows", "ci.yml");
+  const contexts = existsSync27(ciPath) ? workflowCheckContexts(readFileSync20(ciPath, "utf8")) : [];
   if (contexts.length === 0) {
     log.warn(
       `Could not determine required status checks from ${ciPath} \u2014 skipping branch protection. Configure it manually on dev once you know the CI job names.`
@@ -8242,8 +8331,8 @@ async function registerInRegistrySources(names, cloneUrl, token, deps) {
   let dir;
   try {
     dir = await deps.git.cloneForEditing(REGISTRY_REPO, "biffo-registry", token);
-    const path = join26(dir, "sources.json");
-    const file = JSON.parse(readFileSync19(path, "utf8"));
+    const path = join27(dir, "sources.json");
+    const file = JSON.parse(readFileSync20(path, "utf8"));
     const next = addSource(file, {
       name: names.slug,
       repo: cloneUrl.replace(/\.git$/, ""),
@@ -8351,8 +8440,8 @@ function printStandaloneNextSteps(names, minor) {
 }
 function resolveSkeletonRoot(options) {
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join26(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync26(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join27(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync27(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -8543,14 +8632,14 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync5, existsSync as existsSync30, mkdirSync as mkdirSync11, readFileSync as readFileSync22, statSync as statSync7 } from "fs";
-import { join as join32, relative as relative4, resolve as resolve12 } from "path";
+import { cpSync as cpSync5, existsSync as existsSync31, mkdirSync as mkdirSync11, readFileSync as readFileSync23, statSync as statSync7 } from "fs";
+import { join as join33, relative as relative4, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
 import { execa as execa4 } from "execa";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var PluginMigrationsAdapter = class {
   /**
    * Generates migration file(s) for `pluginNames` (every discovered
@@ -8559,22 +8648,22 @@ var PluginMigrationsAdapter = class {
    * or declared no tables.
    */
   async generate(cwd, pluginNames) {
-    const scriptPath = join27(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
+    const scriptPath = join28(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
     const args = [
       "run",
       "python",
       scriptPath,
       "--services-root",
-      join27(cwd, "services"),
+      join28(cwd, "services"),
       "--versions-dir",
-      join27(cwd, "services", "api", "migrations", "versions")
+      join28(cwd, "services", "api", "migrations", "versions")
     ];
     for (const name of pluginNames ?? []) {
       args.push("--plugin", name);
     }
     let result;
     try {
-      result = await execa4("uv", args, { cwd: join27(cwd, "services", "api") });
+      result = await execa4("uv", args, { cwd: join28(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -8591,8 +8680,8 @@ var PluginMigrationsAdapter = class {
 };
 
 // src/lib/plugin-provenance.ts
-import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "fs";
+import { join as join29 } from "path";
 import { execa as execa5 } from "execa";
 var PLUGIN_PROVENANCE_FILENAME = ".biffo-plugin-provenance.json";
 function isPluginProvenance(value) {
@@ -8601,11 +8690,11 @@ function isPluginProvenance(value) {
   return typeof v["origin"] === "string" && (typeof v["ref"] === "string" || v["ref"] === null) && (typeof v["sha"] === "string" || v["sha"] === null) && typeof v["recordedAt"] === "string" && typeof v["inTree"] === "boolean";
 }
 function readProvenance(pluginDir2) {
-  const path = join28(pluginDir2, PLUGIN_PROVENANCE_FILENAME);
-  if (!existsSync27(path)) return { status: "absent" };
+  const path = join29(pluginDir2, PLUGIN_PROVENANCE_FILENAME);
+  if (!existsSync28(path)) return { status: "absent" };
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync20(path, "utf8"));
+    parsed = JSON.parse(readFileSync21(path, "utf8"));
   } catch (err) {
     return {
       status: "invalid",
@@ -8621,7 +8710,7 @@ function readProvenance(pluginDir2) {
   return { status: "present", record: parsed };
 }
 function writePluginProvenance(pluginDir2, record) {
-  writeFileSync10(join28(pluginDir2, PLUGIN_PROVENANCE_FILENAME), `${JSON.stringify(record, null, 2)}
+  writeFileSync10(join29(pluginDir2, PLUGIN_PROVENANCE_FILENAME), `${JSON.stringify(record, null, 2)}
 `);
 }
 function reconcileProvenance(previous, next) {
@@ -8671,8 +8760,8 @@ async function tryGit(cwd, args) {
 }
 
 // src/lib/plugin-seed-vendor.ts
-import { cpSync as cpSync3, existsSync as existsSync28, mkdirSync as mkdirSync9, readdirSync as readdirSync12, rmSync as rmSync8 } from "fs";
-import { join as join29 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync29, mkdirSync as mkdirSync9, readdirSync as readdirSync12, rmSync as rmSync8 } from "fs";
+import { join as join30 } from "path";
 var VENDOR_PREFIX = "_plugin-";
 function pluginSeedImportDir(pluginName) {
   return `db/imports/${VENDOR_PREFIX}${pluginName}`;
@@ -8681,8 +8770,8 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
   if (!manifest.seed) {
     return { vendored: false };
   }
-  const sourceSeedDir = join29(pluginSourceDir, manifest.seed.dir);
-  if (!existsSync28(sourceSeedDir)) {
+  const sourceSeedDir = join30(pluginSourceDir, manifest.seed.dir);
+  if (!existsSync29(sourceSeedDir)) {
     throw new Error(
       `${manifest.name}'s manifest declares seed.dir '${manifest.seed.dir}', but ${sourceSeedDir} does not exist in the plugin's source.`
     );
@@ -8694,11 +8783,11 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
     );
   }
   const relTargetDir = pluginSeedImportDir(manifest.name);
-  const targetDir = join29(cwd, relTargetDir);
+  const targetDir = join30(cwd, relTargetDir);
   rmSync8(targetDir, { recursive: true, force: true });
   mkdirSync9(targetDir, { recursive: true });
   for (const file of sqlFiles) {
-    cpSync3(join29(sourceSeedDir, file), join29(targetDir, file));
+    cpSync3(join30(sourceSeedDir, file), join30(targetDir, file));
   }
   log.success(
     `Vendored ${sqlFiles.length} seed file(s) to ${relTargetDir}/ (baseline_tables: ${manifest.seed.baseline_tables.join(", ") || "none declared"})`
@@ -8711,7 +8800,7 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
 
 // src/lib/plugin-source-copy.ts
 import { copyFileSync as copyFileSync2, cpSync as cpSync4, mkdirSync as mkdirSync10 } from "fs";
-import { basename, dirname as dirname9, join as join30 } from "path";
+import { basename, dirname as dirname9, join as join31 } from "path";
 import { execa as execa6 } from "execa";
 var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".git",
@@ -8728,9 +8817,9 @@ async function copyPluginSource(sourceDir, targetDir) {
   if (await isGitWorkingTree2(sourceDir)) {
     const files = await listGitFiles(sourceDir);
     for (const relPath of files) {
-      const destPath = join30(targetDir, relPath);
+      const destPath = join31(targetDir, relPath);
       mkdirSync10(dirname9(destPath), { recursive: true });
-      copyFileSync2(join30(sourceDir, relPath), destPath);
+      copyFileSync2(join31(sourceDir, relPath), destPath);
     }
     return { usedGitIgnoreRules: true };
   }
@@ -8762,8 +8851,8 @@ async function listGitFiles(dir) {
 }
 
 // src/lib/plugin-workspace-sources.ts
-import { existsSync as existsSync29, readdirSync as readdirSync13, readFileSync as readFileSync21, writeFileSync as writeFileSync11 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync30, readdirSync as readdirSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "fs";
+import { join as join32 } from "path";
 function readTomlStringArray(text, key) {
   const open = new RegExp(`^${key}\\s*=\\s*\\[`, "m").exec(text);
   if (!open) return [];
@@ -8807,9 +8896,9 @@ function readDependencyNames(text) {
   return readTomlStringArray(text, "dependencies").map((dep) => /^\s*([A-Za-z0-9._-]+)/.exec(dep)?.[1] ?? "").filter(Boolean);
 }
 function workspaceMemberNames(instanceRoot) {
-  const rootPyproject = join31(instanceRoot, "pyproject.toml");
-  if (!existsSync29(rootPyproject)) return /* @__PURE__ */ new Set();
-  const text = readFileSync21(rootPyproject, "utf8");
+  const rootPyproject = join32(instanceRoot, "pyproject.toml");
+  if (!existsSync30(rootPyproject)) return /* @__PURE__ */ new Set();
+  const text = readFileSync22(rootPyproject, "utf8");
   const members = readTomlStringArray(text, "members");
   const excluded = new Set(readTomlStringArray(text, "exclude"));
   const dirs = [];
@@ -8818,7 +8907,7 @@ function workspaceMemberNames(instanceRoot) {
       const base = member.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync13(join31(instanceRoot, base), { withFileTypes: true });
+        entries = readdirSync13(join32(instanceRoot, base), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -8832,9 +8921,9 @@ function workspaceMemberNames(instanceRoot) {
   }
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    const pp = join31(instanceRoot, dir, "pyproject.toml");
-    if (!existsSync29(pp)) continue;
-    const name = readProjectName(readFileSync21(pp, "utf8"));
+    const pp = join32(instanceRoot, dir, "pyproject.toml");
+    if (!existsSync30(pp)) continue;
+    const name = readProjectName(readFileSync22(pp, "utf8"));
     if (name) names.add(name);
   }
   return names;
@@ -8845,8 +8934,8 @@ function existingWorkspaceSources(text) {
   );
 }
 function ensureWorkspaceSources(pluginPyprojectPath, memberNames) {
-  if (!existsSync29(pluginPyprojectPath) || memberNames.size === 0) return [];
-  const text = readFileSync21(pluginPyprojectPath, "utf8");
+  if (!existsSync30(pluginPyprojectPath) || memberNames.size === 0) return [];
+  const text = readFileSync22(pluginPyprojectPath, "utf8");
   const already = existingWorkspaceSources(text);
   const toAdd = readDependencyNames(text).filter((n) => memberNames.has(n) && !already.has(n));
   if (toAdd.length === 0) return [];
@@ -8870,8 +8959,8 @@ ${lines.join("\n")}
   return toAdd;
 }
 function applyWorkspaceSources(targetDir, cwd, relTargetDir) {
-  const pluginPyproject = join31(targetDir, "pyproject.toml");
-  if (!existsSync29(pluginPyproject)) return;
+  const pluginPyproject = join32(targetDir, "pyproject.toml");
+  if (!existsSync30(pluginPyproject)) return;
   const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(cwd));
   if (sourced.length > 0) {
     log.info(
@@ -8911,14 +9000,14 @@ var pluginInstallCommand = new Command15("install").description(
   }
 );
 function resolveLocalPlugin(localPath) {
-  if (!existsSync30(localPath)) {
+  if (!existsSync31(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync7(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join32(localPath, "biffo.plugin.json");
-  if (!existsSync30(manifestPath)) {
+  const manifestPath = join33(localPath, "biffo.plugin.json");
+  if (!existsSync31(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -8944,8 +9033,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join32(tmpDir, "biffo.plugin.json");
-    if (!existsSync30(manifestPath)) {
+    const manifestPath = join33(tmpDir, "biffo.plugin.json");
+    if (!existsSync31(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -8973,8 +9062,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join32(options.cwd, "services");
-  if (!existsSync30(servicesDir)) {
+  const servicesDir = join33(options.cwd, "services");
+  if (!existsSync31(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8992,10 +9081,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join32(options.cwd, relTargetDir);
-  const modulesDir = join32(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join33(options.cwd, relTargetDir);
+  const modulesDir = join33(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync30(targetDir) && !inTreeSource) {
+  if (existsSync31(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -9039,8 +9128,8 @@ async function runPluginInstall(target, options, deps) {
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, relTargetDir);
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join32(targetDir, "terraform");
-    if (existsSync30(tfSourceDir)) {
+    const tfSourceDir = join33(targetDir, "terraform");
+    if (existsSync31(tfSourceDir)) {
       mkdirSync11(modulesDir, { recursive: true });
       cpSync5(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
@@ -9101,7 +9190,7 @@ async function runPluginInstall(target, options, deps) {
 }
 function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync22(path, "utf8"));
+    return JSON.parse(readFileSync23(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
@@ -9143,8 +9232,8 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync31, readFileSync as readFileSync23 } from "fs";
-import { join as join33, resolve as resolve13 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync24 } from "fs";
+import { join as join34, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -9157,8 +9246,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join33(options.cwd, "services");
-  if (!existsSync31(servicesDir)) {
+  const servicesDir = join34(options.cwd, "services");
+  if (!existsSync32(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -9166,7 +9255,7 @@ async function runPluginList(options) {
   const plugins = [];
   for (const location of findInstalledPlugins(options.cwd)) {
     try {
-      const manifest = validateManifest(JSON.parse(readFileSync23(location.manifestPath, "utf8")));
+      const manifest = validateManifest(JSON.parse(readFileSync24(location.manifestPath, "utf8")));
       plugins.push({
         name: manifest.name,
         version: manifest.version,
@@ -9207,14 +9296,14 @@ import { resolve as resolve14 } from "path";
 import { Command as Command17 } from "commander";
 
 // src/lib/plugin-staleness.ts
-import { existsSync as existsSync32, readFileSync as readFileSync24, readdirSync as readdirSync14, statSync as statSync8 } from "fs";
-import { join as join34, relative as relative5 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync25, readdirSync as readdirSync14, statSync as statSync8 } from "fs";
+import { join as join35, relative as relative5 } from "path";
 function discoverVendoredPlugins(servicesDir) {
-  if (!existsSync32(servicesDir)) return [];
-  return readdirSync14(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync32(join34(servicesDir, name, "biffo.plugin.json"))).sort();
+  if (!existsSync33(servicesDir)) return [];
+  return readdirSync14(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync33(join35(servicesDir, name, "biffo.plugin.json"))).sort();
 }
 async function checkPluginStaleness(cwd, deps) {
-  const servicesDir = join34(cwd, "services");
+  const servicesDir = join35(cwd, "services");
   const names = discoverVendoredPlugins(servicesDir);
   let registryRepoByName = null;
   const resolveRegistryRepo = async (name) => {
@@ -9230,7 +9319,7 @@ async function checkPluginStaleness(cwd, deps) {
   };
   const results = [];
   for (const name of names) {
-    results.push(await checkOnePlugin(join34(servicesDir, name), name, resolveRegistryRepo, deps.git));
+    results.push(await checkOnePlugin(join35(servicesDir, name), name, resolveRegistryRepo, deps.git));
   }
   return results;
 }
@@ -9256,7 +9345,7 @@ async function checkOnePlugin(pluginDir2, name, resolveRegistryRepo, git) {
   if (record?.sha && isFetchableUrl(record.origin)) {
     return checkViaProvenance(name, record, record.origin, git);
   }
-  const localOrigin = record && !isFetchableUrl(record.origin) && existsSync32(record.origin) ? record.origin : null;
+  const localOrigin = record && !isFetchableUrl(record.origin) && existsSync33(record.origin) ? record.origin : null;
   if (localOrigin) {
     return checkViaContentDiff(name, pluginDir2, localOrigin, { isLocalDir: true }, git);
   }
@@ -9390,8 +9479,8 @@ async function countDifferingFiles(sourceDir, pluginDir2) {
       differing++;
       continue;
     }
-    const a = readFileSync24(join34(sourceDir, relPath));
-    const b = readFileSync24(join34(pluginDir2, relPath));
+    const a = readFileSync25(join35(sourceDir, relPath));
+    const b = readFileSync25(join35(pluginDir2, relPath));
     if (!a.equals(b)) differing++;
   }
   return differing;
@@ -9406,11 +9495,11 @@ function vendorFileList(dir) {
   return new Set(walkExcluding(dir, dir, LOCAL_COPY_EXCLUDES));
 }
 function walkExcluding(root, dir, excludes) {
-  if (!existsSync32(dir)) return [];
+  if (!existsSync33(dir)) return [];
   const out = [];
   for (const entry of readdirSync14(dir)) {
     if (excludes.has(entry) || entry === ".git") continue;
-    const full = join34(dir, entry);
+    const full = join35(dir, entry);
     const stat = statSync8(full);
     if (stat.isDirectory()) {
       out.push(...walkExcluding(root, full, excludes));
@@ -9462,8 +9551,8 @@ var pluginStalenessCommand = new Command17("staleness").description(
 });
 
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync33 } from "fs";
-import { join as join35, relative as relative6, resolve as resolve15 } from "path";
+import { existsSync as existsSync34 } from "fs";
+import { join as join36, relative as relative6, resolve as resolve15 } from "path";
 import chalk17 from "chalk";
 import { Command as Command18 } from "commander";
 var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
@@ -9484,11 +9573,11 @@ var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join35(options.cwd, "services");
-  if (!existsSync33(servicesDir)) {
+  const servicesDir = join36(options.cwd, "services");
+  if (!existsSync34(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync33(join35(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync34(join36(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -9524,8 +9613,8 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync34, readFileSync as readFileSync25, rmSync as rmSync9 } from "fs";
-import { join as join36, resolve as resolve16 } from "path";
+import { existsSync as existsSync35, readFileSync as readFileSync26, rmSync as rmSync9 } from "fs";
+import { join as join37, resolve as resolve16 } from "path";
 import chalk18 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer6 from "inquirer";
@@ -9557,16 +9646,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join36(options.cwd, "services");
-  if (!existsSync34(servicesDir)) {
+  const servicesDir = join37(options.cwd, "services");
+  if (!existsSync35(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join36(servicesDir, name);
-  if (!existsSync34(targetDir)) {
-    const firstParty = join36(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync34(firstParty)) {
+  const targetDir = join37(servicesDir, name);
+  if (!existsSync35(targetDir)) {
+    const firstParty = join37(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync35(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -9574,9 +9663,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join36(options.cwd, "modules", "plugins", name);
+  const modulesDir = join37(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync34(modulesDir)) {
+  if (existsSync35(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -9596,7 +9685,7 @@ async function runPluginUninstall(name, options, deps) {
       `${options.cwd} is not a git repository \u2014 biffo plugin uninstall must be run from a Biffo project checkout.`
     );
   }
-  if (existsSync34(modulesDir)) {
+  if (existsSync35(modulesDir)) {
     const refs = findPluginModuleReferences(options.cwd, name).filter(
       (r) => !r.file.endsWith(`/${GENERATED_TF_FILE}`) && r.file !== GENERATED_TF_FILE
     );
@@ -9611,7 +9700,7 @@ Remove the reference(s) above first, then re-run uninstall.`
   }
   rmSync9(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync34(modulesDir)) {
+  if (existsSync35(modulesDir)) {
     rmSync9(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
@@ -9646,17 +9735,17 @@ Remove the reference(s) above first, then re-run uninstall.`
       "Any tables this plugin created remain in the database, and its migration file at services/api/migrations/versions/ is NOT removed (it is a permanent historical record \u2014 see notes). Dropping tables, if desired, requires a manual Alembic migration written against the Core API."
     );
   }
-  if (existsSync34(join36(options.cwd, pluginSeedImportDir(name)))) {
+  if (existsSync35(join37(options.cwd, pluginSeedImportDir(name)))) {
     log.warn(
       `${pluginSeedImportDir(name)}/ (this plugin's vendored baseline-row seed, biffo-template#1554) was NOT removed either, for the same reason \u2014 see notes. Delete it by hand if you are certain the rows it applied should go too, but note nothing drops rows already applied to the database; that still needs a manual migration.`
     );
   }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join36(targetDir, "biffo.plugin.json");
-  if (!existsSync34(manifestPath)) return void 0;
+  const manifestPath = join37(targetDir, "biffo.plugin.json");
+  if (!existsSync35(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync25(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync26(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -9689,8 +9778,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync6, existsSync as existsSync35, mkdirSync as mkdirSync12, readFileSync as readFileSync26, rmSync as rmSync10 } from "fs";
-import { join as join37, relative as relative7, resolve as resolve17 } from "path";
+import { cpSync as cpSync6, existsSync as existsSync36, mkdirSync as mkdirSync12, readFileSync as readFileSync27, rmSync as rmSync10 } from "fs";
+import { join as join38, relative as relative7, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
 import { Command as Command20 } from "commander";
 import { execa as execa7 } from "execa";
@@ -9738,8 +9827,8 @@ async function runPluginUpgrade(target, options, deps) {
       `Nothing to upgrade. Pass a registry target (e.g. \`biffo plugin upgrade acme-crm@1.1\`) or a local checkout to refresh from (\`biffo plugin upgrade --local ../acme-crm\`).`
     );
   }
-  const servicesDir = join37(options.cwd, "services");
-  if (!existsSync35(servicesDir)) {
+  const servicesDir = join38(options.cwd, "services");
+  if (!existsSync36(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -9748,8 +9837,8 @@ async function runPluginUpgrade(target, options, deps) {
     return runLocalPluginRefresh(options.local, options, deps);
   }
   const { name, minor } = parsePluginTarget(target);
-  const targetDir = join37(servicesDir, name);
-  if (!existsSync35(targetDir)) {
+  const targetDir = join38(servicesDir, name);
+  if (!existsSync36(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -9763,7 +9852,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join37(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join38(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -9791,7 +9880,7 @@ async function runPluginUpgrade(target, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
-    if (!existsSync35(join37(tmpDir, "terraform"))) {
+    if (!existsSync36(join38(tmpDir, "terraform"))) {
       refuseIfModuleStillReferenced(options.cwd, modulesDir, entry.name);
     }
     const previousProvenance = readProvenance(targetDir);
@@ -9808,11 +9897,11 @@ async function runPluginUpgrade(target, options, deps) {
     applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
     const newPyproject = readPyprojectIfPresent(targetDir);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync35(modulesDir)) {
+    if (existsSync36(modulesDir)) {
       rmSync10(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join37(targetDir, "terraform");
-    if (existsSync35(tfSourceDir)) {
+    const tfSourceDir = join38(targetDir, "terraform");
+    if (existsSync36(tfSourceDir)) {
       mkdirSync12(modulesDir, { recursive: true });
       cpSync6(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
@@ -9873,16 +9962,16 @@ async function runPluginUpgrade(target, options, deps) {
 async function runLocalPluginRefresh(localPath, options, deps) {
   const source = resolveLocalPlugin(localPath);
   log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
-  const servicesDir = join37(options.cwd, "services");
-  const targetDir = join37(servicesDir, source.name);
-  if (!existsSync35(targetDir)) {
+  const servicesDir = join38(options.cwd, "services");
+  const targetDir = join38(servicesDir, source.name);
+  if (!existsSync36(targetDir)) {
     throw new Error(
       `Plugin '${source.name}' is not installed at services/${source.name}/. Use 'biffo plugin install --local ${localPath}' instead.`
     );
   }
   const inTreeSource = resolve17(source.sourceDir) === resolve17(targetDir);
   const currentVersion = readInstalledVersion2(targetDir);
-  const modulesDir = join37(options.cwd, "modules", "plugins", source.name);
+  const modulesDir = join38(options.cwd, "modules", "plugins", source.name);
   if (options.dryRun) {
     printLocalDryRun(source, currentVersion, inTreeSource);
     return;
@@ -9905,7 +9994,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
-    if (!existsSync35(join37(source.sourceDir, "terraform"))) {
+    if (!existsSync36(join38(source.sourceDir, "terraform"))) {
       refuseIfModuleStillReferenced(options.cwd, modulesDir, source.name);
     }
     const previousProvenance = readProvenance(targetDir);
@@ -9925,11 +10014,11 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
     const newPyproject = readPyprojectIfPresent(targetDir);
     const stagePaths = [`services/${source.name}`];
-    if (existsSync35(modulesDir)) {
+    if (existsSync36(modulesDir)) {
       rmSync10(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join37(targetDir, "terraform");
-    if (existsSync35(tfSourceDir)) {
+    const tfSourceDir = join38(targetDir, "terraform");
+    if (existsSync36(tfSourceDir)) {
       mkdirSync12(modulesDir, { recursive: true });
       cpSync6(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${source.name}`);
@@ -9993,7 +10082,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
   }
 }
 function refuseIfModuleStillReferenced(cwd, modulesDir, name) {
-  if (!existsSync35(modulesDir)) return;
+  if (!existsSync36(modulesDir)) return;
   const refs = findPluginModuleReferences(cwd, name);
   if (refs.length === 0) return;
   const refList = refs.map((r) => `  ${r.file}:${r.line}  ${r.text}`).join("\n");
@@ -10031,8 +10120,8 @@ var defaultRunCommand2 = async (command, cwd) => {
   }
 };
 function readPyprojectIfPresent(targetDir) {
-  const path = join37(targetDir, "pyproject.toml");
-  return existsSync35(path) ? readFileSync26(path, "utf8") : null;
+  const path = join38(targetDir, "pyproject.toml");
+  return existsSync36(path) ? readFileSync27(path, "utf8") : null;
 }
 function dependenciesChanged(before, after) {
   if (before === after) return false;
@@ -10060,10 +10149,10 @@ function tomlTableBody(text, header) {
   return nextHeader ? rest.slice(0, nextHeader.index) : rest;
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join37(targetDir, "biffo.plugin.json");
-  if (!existsSync35(manifestPath)) return void 0;
+  const manifestPath = join38(targetDir, "biffo.plugin.json");
+  if (!existsSync36(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync26(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync27(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -10146,7 +10235,7 @@ pluginCommand.addCommand(pluginStalenessCommand);
 import { Command as Command23 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync36, readFileSync as readFileSync27 } from "fs";
+import { existsSync as existsSync37, readFileSync as readFileSync28 } from "fs";
 import { resolve as resolve18 } from "path";
 import chalk20 from "chalk";
 import { Command as Command22 } from "commander";
@@ -10340,7 +10429,7 @@ async function fetchPublishedIdentity(portalUrl) {
 }
 async function resolveConfig4(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync27(resolve18(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync28(resolve18(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -10360,8 +10449,8 @@ async function resolveConfig4(options) {
     return cfg;
   }
   const localConfigPath = resolve18(process.cwd(), "biffo.config.json");
-  if (existsSync36(localConfigPath)) {
-    const raw = JSON.parse(readFileSync27(localConfigPath, "utf8"));
+  if (existsSync37(localConfigPath)) {
+    const raw = JSON.parse(readFileSync28(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -10407,21 +10496,21 @@ siblingCommand.addCommand(siblingCheckIdentityCommand);
 import { Command as Command24 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
-import { existsSync as existsSync38 } from "fs";
-import { join as join39 } from "path";
+import { existsSync as existsSync39 } from "fs";
+import { join as join40 } from "path";
 import { execa as execa8 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
-import { existsSync as existsSync37, readdirSync as readdirSync15, readFileSync as readFileSync28 } from "fs";
-import { join as join38 } from "path";
+import { existsSync as existsSync38, readdirSync as readdirSync15, readFileSync as readFileSync29 } from "fs";
+import { join as join39 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join38(adrDir, ALLOWLIST_FILENAME);
-  if (!existsSync37(path)) return /* @__PURE__ */ new Set();
+  const path = join39(adrDir, ALLOWLIST_FILENAME);
+  if (!existsSync38(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
-  for (const rawLine of readFileSync28(path, "utf8").split("\n")) {
+  for (const rawLine of readFileSync29(path, "utf8").split("\n")) {
     const line = rawLine.split("#")[0].trim();
     if (line) numbers.add(line);
   }
@@ -10429,7 +10518,7 @@ function readAdrNumberingAllowlist(adrDir) {
 }
 function adrNumbersIn(adrDir) {
   const claims = /* @__PURE__ */ new Map();
-  if (!existsSync37(adrDir)) return claims;
+  if (!existsSync38(adrDir)) return claims;
   for (const entry of readdirSync15(adrDir).sort()) {
     const match = ADR_FILENAME.exec(entry);
     if (!match) continue;
@@ -10484,8 +10573,8 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
   const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join39(root, "docs", "ADR");
-  if (!existsSync38(adrDir)) {
+  const adrDir = join40(root, "docs", "ADR");
+  if (!existsSync39(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
   }
@@ -10786,18 +10875,18 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 import { execa as execa10 } from "execa";
 
 // src/lib/claim-invocation-parity.ts
-import { existsSync as existsSync39, readFileSync as readFileSync29, readdirSync as readdirSync16 } from "fs";
-import { join as join40 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync30, readdirSync as readdirSync16 } from "fs";
+import { join as join41 } from "path";
 function distributedAgentsDocs(root) {
   const docs = [];
-  const own = join40(root, "AGENTS.md");
-  if (existsSync39(own)) docs.push({ path: "AGENTS.md", text: readFileSync29(own, "utf8") });
-  const skeletons = join40(root, "_skeletons");
-  if (existsSync39(skeletons)) {
+  const own = join41(root, "AGENTS.md");
+  if (existsSync40(own)) docs.push({ path: "AGENTS.md", text: readFileSync30(own, "utf8") });
+  const skeletons = join41(root, "_skeletons");
+  if (existsSync40(skeletons)) {
     for (const name of readdirSync16(skeletons).sort()) {
-      const abs = join40(skeletons, name, "AGENTS.md");
-      if (!existsSync39(abs)) continue;
-      docs.push({ path: `_skeletons/${name}/AGENTS.md`, text: readFileSync29(abs, "utf8") });
+      const abs = join41(skeletons, name, "AGENTS.md");
+      if (!existsSync40(abs)) continue;
+      docs.push({ path: `_skeletons/${name}/AGENTS.md`, text: readFileSync30(abs, "utf8") });
     }
   }
   return docs;
@@ -10929,13 +11018,13 @@ async function runClaimInvocationCheck() {
 }
 
 // src/scripts/check-codeql-suppression.ts
-import { existsSync as existsSync40 } from "fs";
-import { join as join42, relative as relative8 } from "path";
+import { existsSync as existsSync41 } from "fs";
+import { join as join43, relative as relative8 } from "path";
 import { execa as execa11 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
-import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync9 } from "fs";
-import { join as join41 } from "path";
+import { readdirSync as readdirSync17, readFileSync as readFileSync31, statSync as statSync9 } from "fs";
+import { join as join42 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".worktrees",
@@ -10966,7 +11055,7 @@ function walkSourceFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join41(dir, entry);
+      const p = join42(dir, entry);
       let st;
       try {
         st = statSync9(p);
@@ -10992,7 +11081,7 @@ function countSourceFiles(root) {
 function sweepCodeqlSuppressionComments(root) {
   const hits = [];
   for (const path of walkSourceFiles(root)) {
-    const text = readFileSync30(path, "utf8");
+    const text = readFileSync31(path, "utf8");
     for (const line of findCodeqlSuppressionComments(text)) {
       hits.push({ path, line, text: text.split("\n")[line - 1] ?? "" });
     }
@@ -11003,8 +11092,8 @@ function sweepCodeqlSuppressionComments(root) {
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
   const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const scanRoot = join42(root, "cli", "src");
-  if (!existsSync40(scanRoot)) {
+  const scanRoot = join43(root, "cli", "src");
+  if (!existsSync41(scanRoot)) {
     console.log(
       "\u2014 codeql-suppression guard: skipped \u2014 no cli/src in this repo, so there is no CLI source to scan."
     );
@@ -11031,8 +11120,8 @@ async function runCodeqlSuppressionCheck() {
 import { execa as execa12 } from "execa";
 
 // src/lib/cognito-invite-template-guard.ts
-import { readdirSync as readdirSync18, readFileSync as readFileSync31, statSync as statSync10 } from "fs";
-import { join as join43 } from "path";
+import { readdirSync as readdirSync18, readFileSync as readFileSync32, statSync as statSync10 } from "fs";
+import { join as join44 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -11115,7 +11204,7 @@ function findModuleTerraformFiles(repoRoot) {
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join43(dir, entry);
+      const full = join44(dir, entry);
       const rel = `${relative11}/${entry}`;
       if (statSync10(full).isDirectory()) {
         walk2(full, rel);
@@ -11124,12 +11213,12 @@ function findModuleTerraformFiles(repoRoot) {
       }
     }
   };
-  walk2(join43(repoRoot, "modules"), "modules");
+  walk2(join44(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync31(join43(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync32(join44(repoRoot, file), "utf8"))
   );
 }
 
@@ -11157,12 +11246,12 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join45 } from "path";
+import { join as join46 } from "path";
 import { execa as execa13 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync41, readFileSync as readFileSync32, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
-import { join as join44 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync33, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
+import { join as join45 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -11326,7 +11415,7 @@ function walkFiles(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join44(dir, entry);
+      const p = join45(dir, entry);
       let st;
       try {
         st = statSync11(p);
@@ -11356,7 +11445,7 @@ function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_I
   const extracted = [];
   let rawTotal = 0;
   for (const file of files) {
-    const text = readFileSync32(file, "utf8");
+    const text = readFileSync33(file, "utf8");
     rawTotal += countRawExternalOccurrences(text, externalBases);
     extracted.push(...extractCoreDirectPaths(text, file, externalBases));
   }
@@ -11405,7 +11494,7 @@ function auditCoreRouteExtraction(apiSrcDir) {
   const prefixSet = /* @__PURE__ */ new Set();
   let rawApiRouterCount = 0;
   for (const file of files) {
-    const text = readFileSync32(file, "utf8");
+    const text = readFileSync33(file, "utf8");
     const extraction = extractCoreRoutePrefixes(text);
     rawApiRouterCount += extraction.rawApiRouterCount;
     for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
@@ -11421,10 +11510,10 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join44(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join45(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
-    raw = readFileSync32(configPath, "utf8");
+    raw = readFileSync33(configPath, "utf8");
   } catch (err) {
     throw new Error(
       `cannot resolve ${sibling}'s core: ${configPath} does not exist or is unreadable (${err.message}) -- refusing to guess which core serves this sibling.`
@@ -11444,8 +11533,8 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join44(estateDir, coreProject, "services", "api", "src");
-  if (!existsSync41(coreApiSrcDir)) {
+  const coreApiSrcDir = join45(estateDir, coreProject, "services", "api", "src");
+  if (!existsSync42(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
     );
@@ -11488,7 +11577,7 @@ function auditSiblingCoreDirectPaths(params) {
 async function runCoreDirectPathsCheck(opts = {}) {
   const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join45(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join46(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -11504,7 +11593,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join45(root, "services", "api", "src");
+    coreApiSrcDir = join46(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -11570,8 +11659,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa14("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync44, existsSync: existsSync51 } = await import("fs");
-      if (existsSync51(messageFile)) commitMessage = readFileSync44(messageFile, "utf8");
+      const { readFileSync: readFileSync45, existsSync: existsSync52 } = await import("fs");
+      if (existsSync52(messageFile)) commitMessage = readFileSync45(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -11675,8 +11764,8 @@ ${BOLD}If the divergence is deliberate${OFF}
 import { execa as execa15 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync33, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
-import { join as join46 } from "path";
+import { readFileSync as readFileSync34, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
+import { join as join47 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -11753,7 +11842,7 @@ function walkTerraformFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join46(dir, entry);
+      const p = join47(dir, entry);
       let st;
       try {
         st = statSync12(p);
@@ -11796,7 +11885,7 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync33(file, "utf8");
+    const text = readFileSync34(file, "utf8");
     rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
     rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
     eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
@@ -11889,12 +11978,12 @@ async function runEventBridgeLogPermissionCheck() {
 import { execa as execa16 } from "execa";
 
 // src/lib/lambda-output-guard.ts
-import { readFileSync as readFileSync35 } from "fs";
-import { join as join48 } from "path";
+import { readFileSync as readFileSync36 } from "fs";
+import { join as join49 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync42, readdirSync as readdirSync21, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync43, readdirSync as readdirSync21, readFileSync as readFileSync35, statSync as statSync13 } from "fs";
+import { join as join48 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -11908,7 +11997,7 @@ function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
 function vendoredPluginServiceDirs(repoRoot) {
-  const servicesDir = join47(repoRoot, "services");
+  const servicesDir = join48(repoRoot, "services");
   const result = /* @__PURE__ */ new Set();
   let entries;
   try {
@@ -11917,9 +12006,9 @@ function vendoredPluginServiceDirs(repoRoot) {
     return result;
   }
   for (const entry of entries) {
-    const full = join47(servicesDir, entry);
-    if (!existsSync42(full) || !statSync13(full).isDirectory()) continue;
-    if (existsSync42(join47(full, "biffo.plugin.json"))) {
+    const full = join48(servicesDir, entry);
+    if (!existsSync43(full) || !statSync13(full).isDirectory()) continue;
+    if (existsSync43(join48(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
   }
@@ -11940,7 +12029,7 @@ function findWorkflowFiles(repoRoot) {
       if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
-      const full = join47(dir, entry);
+      const full = join48(dir, entry);
       const rel = relative11 ? `${relative11}/${entry}` : entry;
       if (statSync13(full).isDirectory()) {
         walk2(full, rel);
@@ -11984,7 +12073,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync34(join47(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync35(join48(repoRoot, file), "utf8"))
   );
 }
 
@@ -12042,7 +12131,7 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync35(join48(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync36(join49(repoRoot, file), "utf8"))
   );
 }
 
@@ -12070,8 +12159,8 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync36, readdirSync as readdirSync22 } from "fs";
-import { join as join49, relative as relative9 } from "path";
+import { readFileSync as readFileSync37, readdirSync as readdirSync22 } from "fs";
+import { join as join50, relative as relative9 } from "path";
 import { execa as execa17 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
@@ -12168,7 +12257,7 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join49(root, dir);
+    const full = join50(root, dir);
     let entries;
     try {
       entries = readdirSync22(full, { withFileTypes: true });
@@ -12178,7 +12267,7 @@ function shellFiles(root) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join49(full, entry.name));
+      out.push(join50(full, entry.name));
     }
   }
   return out;
@@ -12194,7 +12283,7 @@ async function runPipeTrapCheck() {
     process.exit(1);
   }
   const findings = files.flatMap(
-    (file) => findPipeTraps(readFileSync36(file, "utf8")).map(
+    (file) => findPipeTraps(readFileSync37(file, "utf8")).map(
       (t) => `${relative9(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
@@ -12214,8 +12303,8 @@ async function runPipeTrapCheck() {
 import { execa as execa18 } from "execa";
 
 // src/lib/plugin-allowlist-convention.ts
-import { readFileSync as readFileSync37 } from "fs";
-import { join as join50 } from "path";
+import { readFileSync as readFileSync38 } from "fs";
+import { join as join51 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -12226,7 +12315,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync37(join50(repoRoot, relative11), "utf8");
+    return readFileSync38(join51(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -12347,33 +12436,33 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync44 } from "fs";
-import { join as join52 } from "path";
+import { existsSync as existsSync45 } from "fs";
+import { join as join53 } from "path";
 import { execa as execa19 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync43, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join51 } from "path";
+import { existsSync as existsSync44, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join52 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync43(dir)) return [];
+  if (!existsSync44(dir)) return [];
   return readdirSync23(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync14(join51(dir, entry)).isDirectory();
+      return statSync14(join52(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync43(join51(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync44(join52(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join51(pluginDir2, "tests");
-  if (!existsSync43(testsDir)) return [];
-  if (existsSync43(join51(testsDir, "__init__.py"))) return [];
+  const testsDir = join52(pluginDir2, "tests");
+  if (!existsSync44(testsDir)) return [];
+  if (existsSync44(join52(testsDir, "__init__.py"))) return [];
   return readdirSync23(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -12382,7 +12471,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join51(servicesDir, plugin))) {
+      for (const name of namesOf(join52(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -12420,8 +12509,8 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join52(root, "services");
-  if (!existsSync44(servicesDir)) {
+  const servicesDir = join53(root, "services");
+  if (!existsSync45(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -12441,8 +12530,8 @@ async function runPluginCollisionCheck() {
 import { execa as execa20 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync45, readFileSync as readFileSync38, readdirSync as readdirSync24 } from "fs";
-import { dirname as dirname10, join as join53, relative as relative10, sep as sep4 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync39, readdirSync as readdirSync24 } from "fs";
+import { dirname as dirname10, join as join54, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -12457,9 +12546,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join53(dir, entry.name));
+        walk2(join54(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join53(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join54(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -12469,7 +12558,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync38(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync39(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -12484,14 +12573,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync45(join53(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync46(join54(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join53(root, manifest);
+    const absManifest = join54(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync45(join53(pluginDir2, "terraform"))) continue;
+    if (existsSync46(join54(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -12522,13 +12611,13 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync47 } from "fs";
-import { join as join55 } from "path";
+import { existsSync as existsSync48 } from "fs";
+import { join as join56 } from "path";
 import { execa as execa21 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync46, readFileSync as readFileSync39, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
-import { join as join54 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync40, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { join as join55 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -12945,7 +13034,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync15(join54(root, e)).isDirectory();
+      return statSync15(join55(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -12961,7 +13050,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join54(dir, entry);
+      const p = join55(dir, entry);
       let st;
       try {
         st = statSync15(p);
@@ -12987,14 +13076,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join54(pluginDir2, "terraform");
+  const tfDir = join55(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync25(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join54(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join55(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -13246,8 +13335,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join54("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join54(
+var CONFIG_PY_PATH = join55("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join55(
   "services",
   "api",
   "src",
@@ -13259,10 +13348,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join54(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join54(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync46(configPath);
-  const orchestrationSchemaMissing = !existsSync46(orchestrationPath);
+  const configPath = join55(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join55(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync47(configPath);
+  const orchestrationSchemaMissing = !existsSync47(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -13280,13 +13369,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync39(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync40(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync39(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync40(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -13333,7 +13422,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync15(join54(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync15(join55(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -13346,8 +13435,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join54(pluginsRoot, name);
-    const manifestText = readFileSync39(join54(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join55(pluginsRoot, name);
+    const manifestText = readFileSync40(join55(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -13365,13 +13454,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync39(f, "utf8")
+      text: readFileSync40(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync39(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync40(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -13445,7 +13534,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join54(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join55(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -13478,8 +13567,8 @@ function auditPluginToolSupply(pluginsRoot) {
 async function runPluginToolSupplyCheck() {
   const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join55(root, "services", "_plugins");
-  if (!existsSync47(pluginsRoot)) {
+  const pluginsRoot = join56(root, "services", "_plugins");
+  if (!existsSync48(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -13509,8 +13598,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join55(root, "services", "api");
-  if (!existsSync47(servicesApiRoot)) {
+  const servicesApiRoot = join56(root, "services", "api");
+  if (!existsSync48(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -13687,10 +13776,10 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-shared-file-reduction.ts
-import { readFileSync as readFileSync41 } from "fs";
+import { readFileSync as readFileSync42 } from "fs";
 
 // src/lib/shared-file-reduction-guard.ts
-import { readFileSync as readFileSync40 } from "fs";
+import { readFileSync as readFileSync41 } from "fs";
 var LEAF_TEST_CALLS = /* @__PURE__ */ new Set(["it", "test"]);
 var SUITE_CALLS = /* @__PURE__ */ new Set(["describe", "suite"]);
 var TEST_FILE_PATTERN = /\.(test|spec)\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
@@ -13817,7 +13906,7 @@ function formatReductionReport(report) {
 // src/scripts/check-shared-file-reduction.ts
 function readStdin() {
   try {
-    return readFileSync41(0, "utf8");
+    return readFileSync42(0, "utf8");
   } catch {
     return "";
   }
@@ -13834,15 +13923,15 @@ function pairsFromTsv(tsv) {
     const [target, existingPath, incomingPath] = fields;
     pairs.push({
       target,
-      existing: readFileSync41(existingPath, "utf8"),
-      incoming: readFileSync41(incomingPath, "utf8")
+      existing: readFileSync42(existingPath, "utf8"),
+      incoming: readFileSync42(incomingPath, "utf8")
     });
   }
   return pairs;
 }
 function loadAccepted(manifestPath) {
   if (!manifestPath) return {};
-  const parsed = JSON.parse(readFileSync41(manifestPath, "utf8"));
+  const parsed = JSON.parse(readFileSync42(manifestPath, "utf8"));
   return parsed.acceptedReductions ?? {};
 }
 async function runSharedFileReductionCheck(args) {
@@ -13850,13 +13939,13 @@ async function runSharedFileReductionCheck(args) {
   let accepted;
   try {
     if (args.pairs) {
-      pairs = pairsFromTsv(args.pairs === "-" ? readStdin() : readFileSync41(args.pairs, "utf8"));
+      pairs = pairsFromTsv(args.pairs === "-" ? readStdin() : readFileSync42(args.pairs, "utf8"));
     } else if (args.target && args.existing && args.incoming) {
       pairs = [
         {
           target: args.target,
-          existing: readFileSync41(args.existing, "utf8"),
-          incoming: readFileSync41(args.incoming, "utf8")
+          existing: readFileSync42(args.existing, "utf8"),
+          incoming: readFileSync42(args.incoming, "utf8")
         }
       ];
     } else {
@@ -13890,13 +13979,13 @@ async function runSharedFileReductionCheck(args) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync48, readdirSync as readdirSync27 } from "fs";
-import { join as join57 } from "path";
+import { existsSync as existsSync49, readdirSync as readdirSync27 } from "fs";
+import { join as join58 } from "path";
 import { execa as execa23 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync42, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
-import { join as join56 } from "path";
+import { readFileSync as readFileSync43, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
+import { join as join57 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -13960,7 +14049,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join56(dir, entry);
+    const abs = join57(dir, entry);
     let isDir;
     try {
       isDir = statSync16(abs).isDirectory();
@@ -13982,7 +14071,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync42(join56(skeletonRoot, rel), "utf8");
+        contents = readFileSync43(join57(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -14011,23 +14100,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join57(root, "_skeletons");
+  const skeletonsDir = join58(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync27(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync48(join57(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync49(join58(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join57(root, "_skeletons", name);
+    const skeletonRoot = join58(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync48(join57(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync49(join58(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -14041,7 +14130,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join57(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join58(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -14191,8 +14280,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync49, readFileSync as readFileSync43 } from "fs";
-import { join as join58, resolve as resolve20 } from "path";
+import { existsSync as existsSync50, readFileSync as readFileSync44 } from "fs";
+import { join as join59, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -14371,10 +14460,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join58(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync49(path)) return null;
+  const path = join59(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync50(path)) return null;
   try {
-    return extractVersionField(readFileSync43(path, "utf8"));
+    return extractVersionField(readFileSync44(path, "utf8"));
   } catch {
     return null;
   }
@@ -14394,10 +14483,10 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join58(cwd, CORE_VERSION_FILE);
-  if (!existsSync49(path)) return null;
+  const path = join59(cwd, CORE_VERSION_FILE);
+  if (!existsSync50(path)) return null;
   try {
-    const value = readFileSync43(path, "utf8").trim();
+    const value = readFileSync44(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -14846,13 +14935,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync50 } from "fs";
-import { dirname as dirname11, join as join59 } from "path";
+import { existsSync as existsSync51 } from "fs";
+import { dirname as dirname11, join as join60 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join59(dir, relativePath);
-    if (existsSync50(candidate)) return candidate;
+    const candidate = join60(dir, relativePath);
+    if (existsSync51(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;