@biffo/cli 0.313.4 → 0.314.1

package/_skeletons/plugin-template/biffo.plugin.json

@@ -80,8 +80,8 @@
     }
   ],
   "ui_components": [
-    { "type": "nav-link", "label": "Example Plugin", "path": "/admin/example-plugin" },
-    { "type": "page", "label": "Widgets", "path": "/admin/example-plugin/widgets" }
+    { "type": "nav-link", "label": "Example Plugin", "path": "/admin/plugins/example-plugin" },
+    { "type": "page", "label": "Widgets", "path": "/admin/plugins/example-plugin/widgets" }
   ],
   "seed": {
     "dir": "db/seed",
@@ -89,5 +89,17 @@
   },
   "dependencies": {
     "biffo-plugin-sdk": "^1.0"
+  },
+  "user_ingress": {
+    "required_group": "founder",
+    "app": "example_plugin.user_app:app"
+  },
+  "admin_ingress": {
+    "required_group": "admin",
+    "app": "example_plugin.admin_app:app"
+  },
+  "user_frontend": {
+    "dir": "web/dist",
+    "required_group": "founder"
   }
 }

package/_skeletons/plugin-template/pyproject.toml

@@ -15,6 +15,12 @@ dependencies = [
   "biffo-plugin-sdk>=1.0,<2.0",
   "aws-lambda-powertools[tracer]>=3.4.0",
   "httpx>=0.28.1",
+  # ASGI apps for the `user_ingress`/`admin_ingress` surfaces (ADR-0021) —
+  # the shared plugin host imports and mounts `<module>:app` directly, so this
+  # is the only new runtime dependency the two placeholder apps need (no
+  # mangum/pyjwt: the host provides the Lambda entry and enforces
+  # `required_group` itself — see user_app.py's docstring).
+  "fastapi>=0.115.0",
 ]
 
 [dependency-groups]

package/_skeletons/plugin-template/src/example_plugin/admin_app.py

@@ -0,0 +1,50 @@
+"""Placeholder ASGI app backing this plugin's `admin_ingress` surface (ADR-0021).
+
+`biffo.plugin.json`'s `admin_ingress.app` names this module's `app` object. The
+**shared plugin host** imports it, provides the Lambda entry, and mounts it at
+`/api/v1/plugins/<name>/admin/*`, enforcing `admin_ingress.required_group`
+(ADR-0011) before a request ever reaches here — see `user_app.py`'s docstring
+for why this file does no auth of its own.
+
+**This is also `web-admin/`'s one reader (biffo-template#2008).** The skeleton
+shipped a full admin frontend at `web-admin/` that no manifest field referenced
+— an orphan directory nothing would ever build or serve. `AdminIngress` in the
+SDK is explicitly "the plugin's admin-gated API and optional static UI bundle":
+unlike `user_frontend` (a separate declarative `dir`, served directly by the
+host with no plugin code involved), the admin surface's static bundle is served
+*by the app this field names* — `web-admin/`'s own `vite.config.ts` already
+targets exactly this mount point (`base:
+'/api/v1/plugins/example-plugin/admin/'`).
+
+`web-admin/dist/` is the Vite build output — gitignored, and not built by this
+repo's CI (that wiring is follow-up work; #2008's scope is declaring the
+surfaces, not shipping the built bundle, mirroring `user_frontend.dir` above
+pointing at `web/dist` before that directory exists either — see #2009). The
+mount below is skipped when `dist/` is absent, so a fresh checkout and `pytest`
+need no build step and no edits (this issue's "done when" criterion) — once
+`web-admin` is built, dropping its `dist/` in place is enough to serve it, with
+no further code change.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import FastAPI
+from fastapi.staticfiles import StaticFiles
+
+app = FastAPI(title="example-plugin admin ingress")
+
+# src/example_plugin/admin_app.py -> src/example_plugin -> src -> repo root
+# (plugin root, where web-admin/ lives alongside biffo.plugin.json).
+WEB_ADMIN_DIST = Path(__file__).resolve().parent.parent.parent / "web-admin" / "dist"
+
+
+@app.get("/ping")
+def ping() -> dict[str, str]:
+    """Identifies the plugin, so the mount can be proven real rather than guessed at."""
+    return {"plugin": "example-plugin", "surface": "admin_ingress"}
+
+
+if WEB_ADMIN_DIST.is_dir():
+    app.mount("/", StaticFiles(directory=str(WEB_ADMIN_DIST), html=True), name="web-admin")

package/_skeletons/plugin-template/src/example_plugin/user_app.py

@@ -0,0 +1,31 @@
+"""Placeholder ASGI app backing this plugin's `user_ingress` surface (ADR-0021).
+
+`biffo.plugin.json`'s `user_ingress.app` names this module's `app` object. The
+**shared plugin host** imports it, provides the Lambda entry, and mounts it at
+`/api/v1/plugins/<name>/*` — a plugin declaring `user_ingress` ships no Lambda
+handler and no infrastructure of its own for this surface (see `terraform/`:
+nothing here needs a per-plugin resource).
+
+**No auth in this file, on purpose.** The host enforces `user_ingress.required_group`
+(ADR-0011) before a request ever reaches a mounted app — see
+`biffo_plugin_sdk.user_serving`'s module docstring: its `require_group` dependency
+is only for an `isolated: true` plugin running in its own Lambda outside the
+shared host. Adding a second check here would be redundant at best and a
+divergent enforcement path at worst.
+
+This is intentionally a placeholder (biffo-template#2008): one route that
+identifies the plugin, enough to prove the mount is real, not enough to be
+mistaken for a feature. Replace it with your own user-facing routes.
+"""
+
+from __future__ import annotations
+
+from fastapi import FastAPI
+
+app = FastAPI(title="example-plugin user ingress")
+
+
+@app.get("/ping")
+def ping() -> dict[str, str]:
+    """Identifies the plugin, so the mount can be proven real rather than guessed at."""
+    return {"plugin": "example-plugin", "surface": "user_ingress"}

package/_skeletons/plugin-template/tests/test_example_plugin_ingress_surfaces.py

@@ -0,0 +1,119 @@
+"""Pins the three platform surfaces `biffo.plugin.json` declares (biffo-template#2008).
+
+Before this, `_skeletons/plugin-template` declared none of `user_ingress`,
+`admin_ingress` or `user_frontend` — the platform already serves all three
+(the working reference is `keiranholloway/biffo-plugin-ideation`'s manifest),
+but every scaffolded plugin started life exposing none of them. This test
+guards three things at once:
+
+1. the manifest actually validates against the SDK's real `PluginManifest`
+   (`extra="forbid"`, so a typo in a block's keys fails loudly rather than
+   silently dropping the surface — see `README.md`'s "Manifest validation"
+   section for why that model, not `registry-schema.json`, is authoritative);
+2. each `*_ingress.app` reference actually resolves to a real, importable ASGI
+   app — not merely a string that looks right; and
+3. each placeholder app answers with something that identifies the plugin,
+   so the mount is real rather than guessed at (this issue's own "done when").
+"""
+
+from __future__ import annotations
+
+import importlib
+
+from biffo_plugin_sdk.plugin import load_manifest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from example_plugin.manifest import MANIFEST_PATH
+
+
+def _resolve_app(app_ref: str) -> FastAPI:
+    """Resolve a manifest `*_ingress.app` string ('<module>:<attr>') the same
+    way the shared plugin host would — a plain dynamic import, not a literal
+    reference to this test's own imports, so a manifest string that drifted
+    from the real module path would be caught here rather than passing by
+    coincidence."""
+    module_name, _, attr = app_ref.partition(":")
+    module = importlib.import_module(module_name)
+    return getattr(module, attr)
+
+
+class TestManifestDeclaresAllThreeSurfaces:
+    def test_manifest_validates_and_declares_user_ingress(self) -> None:
+        manifest = load_manifest(MANIFEST_PATH)
+        assert manifest.user_ingress is not None
+        assert manifest.user_ingress.required_group == "founder"
+        assert manifest.user_ingress.app == "example_plugin.user_app:app"
+
+    def test_manifest_declares_admin_ingress(self) -> None:
+        manifest = load_manifest(MANIFEST_PATH)
+        assert manifest.admin_ingress is not None
+        assert manifest.admin_ingress.required_group == "admin"
+        assert manifest.admin_ingress.app == "example_plugin.admin_app:app"
+
+    def test_manifest_declares_user_frontend(self) -> None:
+        manifest = load_manifest(MANIFEST_PATH)
+        assert manifest.user_frontend is not None
+        assert manifest.user_frontend.dir == "web/dist"
+        assert manifest.user_frontend.required_group == "founder"
+
+    def test_ui_components_no_longer_point_at_a_dead_admin_path(self) -> None:
+        """The old `/admin/example-plugin` paths matched none of the three real
+        surfaces (this issue's own finding) — pin that they now sit under the
+        portal's real installed-plugin route instead."""
+        manifest = load_manifest(MANIFEST_PATH)
+        paths = {c.path for c in manifest.ui_components}
+        assert paths == {
+            "/admin/plugins/example-plugin",
+            "/admin/plugins/example-plugin/widgets",
+        }
+
+
+class TestIngressAppsResolveAndIdentifyThePlugin:
+    def test_user_ingress_app_resolves_and_answers(self) -> None:
+        manifest = load_manifest(MANIFEST_PATH)
+        assert manifest.user_ingress is not None
+        app = _resolve_app(manifest.user_ingress.app)
+
+        response = TestClient(app).get("/ping")
+
+        assert response.status_code == 200
+        assert response.json() == {"plugin": "example-plugin", "surface": "user_ingress"}
+
+    def test_admin_ingress_app_resolves_and_answers(self) -> None:
+        manifest = load_manifest(MANIFEST_PATH)
+        assert manifest.admin_ingress is not None
+        app = _resolve_app(manifest.admin_ingress.app)
+
+        response = TestClient(app).get("/ping")
+
+        assert response.status_code == 200
+        assert response.json() == {"plugin": "example-plugin", "surface": "admin_ingress"}
+
+
+class TestAdminIngressWebAdminOrphanResolution:
+    """`web-admin/` had no manifest field referencing it (this issue's own
+    finding). `admin_app.py` is now its one reader — these pin that the
+    reference is real (the directory `admin_app` looks for is exactly
+    `web-admin/`, not a typo'd sibling) and that a repo state with no built
+    `dist/` yet (true of this skeleton and every fresh checkout, since `dist/`
+    is gitignored and nothing builds it here — see admin_app.py's docstring)
+    still imports and serves cleanly rather than raising at import time.
+    """
+
+    def test_web_admin_dist_path_points_at_the_real_directory(self) -> None:
+        from example_plugin.admin_app import WEB_ADMIN_DIST
+
+        assert WEB_ADMIN_DIST.parent.name == "web-admin"
+        assert WEB_ADMIN_DIST.name == "dist"
+        assert WEB_ADMIN_DIST.parent.is_dir(), "web-admin/ itself must still exist"
+
+    def test_static_mount_is_skipped_when_dist_is_absent(self) -> None:
+        from example_plugin.admin_app import WEB_ADMIN_DIST, app
+
+        assert not WEB_ADMIN_DIST.is_dir(), (
+            "this test asserts the no-build-yet behaviour; if dist/ has been "
+            "built locally, the skip path this test pins is not being exercised"
+        )
+        response = TestClient(app).get("/some/never-built/asset.js")
+        assert response.status_code == 404

package/_skeletons/plugin-template/uv.lock

@@ -2,6 +2,15 @@ version = 1
 revision = 3
 requires-python = ">=3.13"
 
+[[package]]
+name = "annotated-doc"
+version = "0.0.5"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/5a/8e/38aa427ed5402449e226975b649c5dc73ccadfefeb95e6aecb8f8ea4b6b6/annotated_doc-0.0.5.tar.gz", hash = "sha256:c7e58ce09192557605d8bbd92836d7e1d520ac9580096042c0bfd197efacf1bb", size = 10758, upload-time = "2026-07-28T13:50:58.129Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3e/30/e900b21425a860e195f32e37657aa1f7c7f2b1bfb26f03ca209b90933c06/annotated_doc-0.0.5-py3-none-any.whl", hash = "sha256:117bac03a25ede5df5440e855b32d556049ca169ead221505badf432fed4b101", size = 5302, upload-time = "2026-07-28T13:50:57.239Z" },
+]
+
 [[package]]
 name = "annotated-types"
 version = "0.8.0"
@@ -70,6 +79,7 @@ source = { editable = "." }
 dependencies = [
     { name = "aws-lambda-powertools", extra = ["tracer"] },
     { name = "biffo-plugin-sdk" },
+    { name = "fastapi" },
     { name = "httpx" },
 ]
 
@@ -88,6 +98,7 @@ dev = [
 requires-dist = [
     { name = "aws-lambda-powertools", extras = ["tracer"], specifier = ">=3.4.0" },
     { name = "biffo-plugin-sdk", specifier = ">=1.0,<2.0" },
+    { name = "fastapi", specifier = ">=0.115.0" },
     { name = "httpx", specifier = ">=0.28.1" },
 ]
 
@@ -398,6 +409,22 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/07/6c/aa3f2f849e01cb6a001cd8554a88d4c77c5c1a31c95bdf1cf9301e6d9ef4/defusedxml-0.7.1-py2.py3-none-any.whl", hash = "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61", size = 25604, upload-time = "2021-03-08T10:59:24.45Z" },
 ]
 
+[[package]]
+name = "fastapi"
+version = "0.141.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "annotated-doc" },
+    { name = "pydantic" },
+    { name = "starlette" },
+    { name = "typing-extensions" },
+    { name = "typing-inspection" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8a/02/91e3416a8fdd715abb903a952a6bec7cdd8d14eed55d415fc8595524c319/fastapi-0.141.1.tar.gz", hash = "sha256:e8822fc40db1e1858054d7a949a888695bc9bdce70139178e33bd2871a453ca1", size = 425799, upload-time = "2026-07-29T17:18:05.568Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/03/10388a42375ee7e4ac9b94eb2c5c569c8b5795e377e701c9ac3ad63de890/fastapi-0.141.1-py3-none-any.whl", hash = "sha256:bfb91aa2d334c61cb35ba9a116fc123b3d3df31640b801cf57a7a78ec3f603b3", size = 131954, upload-time = "2026-07-29T17:18:04.364Z" },
+]
+
 [[package]]
 name = "filelock"
 version = "3.32.3"
@@ -1005,6 +1032,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/32/46/9cb0e58b2deb7f82b84065f37f3bffeb12413f947f9388e4cac22c4621ce/sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0", size = 29575, upload-time = "2021-05-16T22:03:41.177Z" },
 ]
 
+[[package]]
+name = "starlette"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b5/b4/205b0d5241d934e8add0c38aa924c4f9fb7330834ff11e5444db964ec3f9/starlette-1.6.0.tar.gz", hash = "sha256:d4e3ac5e546444960c710297a3c9fc3f7ebae1b7e963f3d36173b49da535be9b", size = 2716969, upload-time = "2026-08-08T18:27:57.512Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c8/cb/6a6a47d5b464bd08695d254f3da6e7986cc70c9fa5d778eda57538edfe56/starlette-1.6.0-py3-none-any.whl", hash = "sha256:a86dd39d14bb45f85a3d18525215a9ef0cfd1f192ac793220e72598c90335f0c", size = 75969, upload-time = "2026-08-08T18:27:56.196Z" },
+]
+
 [[package]]
 name = "tomli"
 version = "2.4.1"

package/_skeletons/plugin-template/web-admin/pnpm-lock.yaml

@@ -67,7 +67,7 @@ importers:
         version: 6.4.3(@types/node@26.2.0)
       vitest:
         specifier: ^4.1.0
-        version: 4.1.10(@types/node@26.2.0)(jsdom@30.0.1)(vite@6.4.3(@types/node@26.2.0))
+        version: 4.1.11(@types/node@26.2.0)(jsdom@30.0.1)(vite@6.4.3(@types/node@26.2.0))
 
 packages:
 
@@ -461,6 +461,9 @@ packages:
   '@jridgewell/sourcemap-codec@1.5.5':
     resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
 
+  '@jridgewell/sourcemap-codec@1.6.0':
+    resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
+
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
@@ -740,11 +743,11 @@ packages:
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@vitest/expect@4.1.10':
-    resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==}
+  '@vitest/expect@4.1.11':
+    resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==}
 
-  '@vitest/mocker@4.1.10':
-    resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==}
+  '@vitest/mocker@4.1.11':
+    resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==}
     peerDependencies:
       msw: ^2.4.9
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -754,20 +757,20 @@ packages:
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.1.10':
-    resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==}
+  '@vitest/pretty-format@4.1.11':
+    resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==}
 
-  '@vitest/runner@4.1.10':
-    resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==}
+  '@vitest/runner@4.1.11':
+    resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==}
 
-  '@vitest/snapshot@4.1.10':
-    resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==}
+  '@vitest/snapshot@4.1.11':
+    resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==}
 
-  '@vitest/spy@4.1.10':
-    resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==}
+  '@vitest/spy@4.1.11':
+    resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==}
 
-  '@vitest/utils@4.1.10':
-    resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==}
+  '@vitest/utils@4.1.11':
+    resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==}
 
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
@@ -913,8 +916,8 @@ packages:
     resolution: {integrity: sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==}
     engines: {node: '>=20.19.0'}
 
-  es-module-lexer@2.3.1:
-    resolution: {integrity: sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==}
+  es-module-lexer@2.3.2:
+    resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
 
   esbuild@0.25.12:
     resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
@@ -1190,8 +1193,8 @@ packages:
     resolution: {integrity: sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==}
     engines: {node: '>=18'}
 
-  obug@2.1.4:
-    resolution: {integrity: sha512-4a+OsYv9UktOJKE+l1A4OufDgdRF9PifWj+tJnHURo/P+WOxpG4GzUFL9qCalmWauao6ogiG+QvnCovwPoyAWA==}
+  obug@2.2.1:
+    resolution: {integrity: sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==}
     engines: {node: '>=12.20.0'}
 
   optionator@0.9.4:
@@ -1231,6 +1234,10 @@ packages:
     resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
     engines: {node: '>=12'}
 
+  picomatch@4.0.7:
+    resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
+    engines: {node: '>=12'}
+
   postcss@8.5.26:
     resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==}
     engines: {node: ^10 || ^12 || >=14}
@@ -1335,8 +1342,8 @@ packages:
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
-  tinyexec@1.3.0:
-    resolution: {integrity: sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ==}
+  tinyexec@1.3.1:
+    resolution: {integrity: sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==}
     engines: {node: '>=18'}
 
   tinyglobby@0.2.17:
@@ -1452,20 +1459,20 @@ packages:
       yaml:
         optional: true
 
-  vitest@4.1.10:
-    resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==}
+  vitest@4.1.11:
+    resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.10
-      '@vitest/browser-preview': 4.1.10
-      '@vitest/browser-webdriverio': 4.1.10
-      '@vitest/coverage-istanbul': 4.1.10
-      '@vitest/coverage-v8': 4.1.10
-      '@vitest/ui': 4.1.10
+      '@vitest/browser-playwright': 4.1.11
+      '@vitest/browser-preview': 4.1.11
+      '@vitest/browser-webdriverio': 4.1.11
+      '@vitest/coverage-istanbul': 4.1.11
+      '@vitest/coverage-v8': 4.1.11
+      '@vitest/ui': 4.1.11
       happy-dom: '*'
       jsdom: '*'
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -1887,6 +1894,8 @@ snapshots:
 
   '@jridgewell/sourcemap-codec@1.5.5': {}
 
+  '@jridgewell/sourcemap-codec@1.6.0': {}
+
   '@jridgewell/trace-mapping@0.3.31':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
@@ -2162,44 +2171,44 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/expect@4.1.10':
+  '@vitest/expect@4.1.11':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.10
-      '@vitest/utils': 4.1.10
+      '@vitest/spy': 4.1.11
+      '@vitest/utils': 4.1.11
       chai: 6.2.2
       tinyrainbow: 3.1.1
 
-  '@vitest/mocker@4.1.10(vite@6.4.3(@types/node@26.2.0))':
+  '@vitest/mocker@4.1.11(vite@6.4.3(@types/node@26.2.0))':
     dependencies:
-      '@vitest/spy': 4.1.10
+      '@vitest/spy': 4.1.11
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
       vite: 6.4.3(@types/node@26.2.0)
 
-  '@vitest/pretty-format@4.1.10':
+  '@vitest/pretty-format@4.1.11':
     dependencies:
       tinyrainbow: 3.1.1
 
-  '@vitest/runner@4.1.10':
+  '@vitest/runner@4.1.11':
     dependencies:
-      '@vitest/utils': 4.1.10
+      '@vitest/utils': 4.1.11
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.1.10':
+  '@vitest/snapshot@4.1.11':
     dependencies:
-      '@vitest/pretty-format': 4.1.10
-      '@vitest/utils': 4.1.10
+      '@vitest/pretty-format': 4.1.11
+      '@vitest/utils': 4.1.11
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.1.10': {}
+  '@vitest/spy@4.1.11': {}
 
-  '@vitest/utils@4.1.10':
+  '@vitest/utils@4.1.11':
     dependencies:
-      '@vitest/pretty-format': 4.1.10
+      '@vitest/pretty-format': 4.1.11
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.1
 
@@ -2331,7 +2340,7 @@ snapshots:
 
   entities@8.0.0: {}
 
-  es-module-lexer@2.3.1: {}
+  es-module-lexer@2.3.2: {}
 
   esbuild@0.25.12:
     optionalDependencies:
@@ -2590,7 +2599,7 @@ snapshots:
 
   magic-string@0.30.21:
     dependencies:
-      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/sourcemap-codec': 1.6.0
 
   mdn-data@2.27.1: {}
 
@@ -2616,7 +2625,7 @@ snapshots:
 
   node-releases@2.0.53: {}
 
-  obug@2.1.4: {}
+  obug@2.2.1: {}
 
   optionator@0.9.4:
     dependencies:
@@ -2653,6 +2662,8 @@ snapshots:
 
   picomatch@4.0.5: {}
 
+  picomatch@4.0.7: {}
+
   postcss@8.5.26:
     dependencies:
       nanoid: 3.3.18
@@ -2759,7 +2770,7 @@ snapshots:
 
   tinybench@2.9.0: {}
 
-  tinyexec@1.3.0: {}
+  tinyexec@1.3.1: {}
 
   tinyglobby@0.2.17:
     dependencies:
@@ -2837,24 +2848,24 @@ snapshots:
       '@types/node': 26.2.0
       fsevents: 2.3.3
 
-  vitest@4.1.10(@types/node@26.2.0)(jsdom@30.0.1)(vite@6.4.3(@types/node@26.2.0)):
+  vitest@4.1.11(@types/node@26.2.0)(jsdom@30.0.1)(vite@6.4.3(@types/node@26.2.0)):
     dependencies:
-      '@vitest/expect': 4.1.10
-      '@vitest/mocker': 4.1.10(vite@6.4.3(@types/node@26.2.0))
-      '@vitest/pretty-format': 4.1.10
-      '@vitest/runner': 4.1.10
-      '@vitest/snapshot': 4.1.10
-      '@vitest/spy': 4.1.10
-      '@vitest/utils': 4.1.10
-      es-module-lexer: 2.3.1
+      '@vitest/expect': 4.1.11
+      '@vitest/mocker': 4.1.11(vite@6.4.3(@types/node@26.2.0))
+      '@vitest/pretty-format': 4.1.11
+      '@vitest/runner': 4.1.11
+      '@vitest/snapshot': 4.1.11
+      '@vitest/spy': 4.1.11
+      '@vitest/utils': 4.1.11
+      es-module-lexer: 2.3.2
       expect-type: 1.4.0
       magic-string: 0.30.21
-      obug: 2.1.4
+      obug: 2.2.1
       pathe: 2.0.3
-      picomatch: 4.0.5
+      picomatch: 4.0.7
       std-env: 4.2.0
       tinybench: 2.9.0
-      tinyexec: 1.3.0
+      tinyexec: 1.3.1
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.1
       vite: 6.4.3(@types/node@26.2.0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.313.4",
+  "version": "0.314.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",