@biffo/cli 0.296.0 → 0.296.2

package/dist/index.js

@@ -8647,8 +8647,30 @@ function printEntry(entry) {
     const summary = entry.ui_components.map((c) => `${c.label} (${c.type})`).join(", ");
     console.log(`  UI components:          ${summary}`);
   }
+  printScopeSeamEntitlement(entry.name);
   console.log("");
 }
+function printScopeSeamEntitlement(name) {
+  console.log("");
+  console.log(chalk14.bold("  Scope-seam entitlement"));
+  console.log("    Declared by the INSTANCE, never by this plugin (ADR-0029, #1653).");
+  console.log("    A plugin manifest cannot grant it \u2014 biffo.plugin.json is not consulted.");
+  console.log("    To let this plugin call GET /internal/scopes or POST /internal/scope-check,");
+  console.log("    the instance operator adds it beside their own scope authorizer:");
+  console.log("");
+  console.log(chalk14.dim("      register_scope_authorizer("));
+  console.log(chalk14.dim("          authorizer,"));
+  console.log(
+    chalk14.dim(`          entitlements={"system:${name}": frozenset({"<permission_code>"})},`)
+  );
+  console.log(chalk14.dim("      )"));
+  console.log("");
+  console.log(
+    chalk14.dim(
+      "    <permission_code> is one of the INSTANCE's own codes, so ask the operator which\n    one covers this plugin's surface. This command cannot report what an instance\n    has actually entitled: the map is evaluated in the instance's API at import\n    time, and re-deriving it here would be a second authority that can drift from\n    the one enforcing the 403."
+    )
+  );
+}
 
 // src/commands/plugin-install.ts
 import { cpSync as cpSync5, existsSync as existsSync31, mkdirSync as mkdirSync11, readFileSync as readFileSync23, statSync as statSync7 } from "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.296.0",
+  "version": "0.296.2",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",