@biffo/cli 0.41.9 → 0.41.11

package/core.version

@@ -1 +1 @@
-0.41.9
+0.41.11

package/dist/index.js

@@ -51,12 +51,13 @@ function findTemplateRoot(startDir) {
     dir = parent;
   }
 }
-function resolveTemplateRoot(fromDir) {
-  const start = fromDir ?? dirname(fileURLToPath(import.meta.url));
+function resolveTemplateRoot(options = {}) {
+  const start = options.fromDir ?? dirname(fileURLToPath(import.meta.url));
   const root = findTemplateRoot(start);
   if (!root) {
+    const guidance = options.guidance ?? "Point this command at a biffo-template checkout at the target version.";
     throw new Error(
-      `Could not locate a Biffo template root (a directory with ${CORE_MANIFEST_FILE} and core.version) above ${start}. Pass --template <path> to a biffo-template checkout at the target version.`
+      `Could not locate a Biffo template root (a directory with ${CORE_MANIFEST_FILE} and core.version) above ${start}. ` + guidance
     );
   }
   return root;
@@ -236,6 +237,7 @@ var log = {
 };
 
 // src/commands/core-diff.ts
+var MISSING_TEMPLATE_ROOT_GUIDANCE = "Pass --template <path> to a biffo-template checkout, e.g. `biffo core diff --template /path/to/biffo-template`.";
 var coreDiffCommand = new Command("diff").description(
   "Show which template-owned files an upgrade would change in this instance (read-only)"
 ).option("--cwd <path>", "Instance repo root to inspect (defaults to the current directory)").option(
@@ -253,7 +255,7 @@ var coreDiffCommand = new Command("diff").description(
   }
 });
 async function runCoreDiff(options) {
-  const templateRoot = options.templateRoot ?? resolveTemplateRoot();
+  const templateRoot = options.templateRoot ?? resolveTemplateRoot({ guidance: MISSING_TEMPLATE_ROOT_GUIDANCE });
   const manifest = readCoreManifest(templateRoot);
   const templateVersion = readCoreVersionFile(join3(templateRoot, "core.version"));
   const instanceVersion = readInstanceCoreVersion(options.cwd);
@@ -833,6 +835,39 @@ var GitHubAdapter = class {
     log.info(`Committed ${files.map((f) => f.path).join(", ")} to ${branch}`);
     return commit.sha;
   }
+  /** The commit SHA at the head of `branch`. */
+  async getBranchSha(org, repo, branch) {
+    const ref = await this.waitForRef(org, repo, `heads/${branch}`, 12e4, 3e3);
+    return ref.object.sha;
+  }
+  /**
+   * Point `branch` at `sha` via a fast-forward-only ref update (issue #329).
+   *
+   * `sha` must be an ancestor-descendant of the branch's current head:
+   * GitHub's `updateRef` rejects a non-fast-forward move unless `force` is set,
+   * and it is deliberately left unset here. The only caller is `writeInstanceFiles`,
+   * moving a freshly-created branch onto the instance commit built on that
+   * branch's own shared base — always a fast-forward. If it ever isn't, failing
+   * loudly is the correct outcome, not clobbering history.
+   *
+   * Idempotent: a no-op (no API write) when `branch` is already at `sha`, so a
+   * resumed init neither errors nor rewrites anything.
+   */
+  async fastForwardBranch(org, repo, branch, sha) {
+    const current = await this.getBranchSha(org, repo, branch);
+    if (current === sha) {
+      log.info(`${branch} already at ${sha.slice(0, 7)} \u2014 skipping`);
+      return;
+    }
+    await this.octokit.git.updateRef({
+      owner: org,
+      repo,
+      ref: `heads/${branch}`,
+      sha,
+      force: false
+    });
+    log.info(`Fast-forwarded ${branch} to ${sha.slice(0, 7)}`);
+  }
   async setDefaultBranch(org, repo, branch) {
     await this.octokit.repos.update({ owner: org, repo, default_branch: branch });
     log.info(`Default branch set to ${branch}`);
@@ -1508,6 +1543,7 @@ function materializeTemplateAtTag(repo, version, git = defaultGit) {
 }
 
 // src/commands/core-upgrade.ts
+var MISSING_TEMPLATE_ROOT_GUIDANCE2 = "Pass --template-repo <path> to a biffo-template git checkout, e.g. `biffo core upgrade --template-repo /path/to/biffo-template`.";
 var coreUpgradeCommand = new Command3("upgrade").description("Three-way-merge template-owned files for a core upgrade; preview it or open a PR").option("--cwd <path>", "Instance repo root to upgrade (defaults to the current directory)").option(
   "--template-repo <path>",
   "Path to a biffo-template git checkout whose core-v* tags supply the base/target trees (defaults to the template this CLI ships with)"
@@ -1570,7 +1606,7 @@ async function runCoreUpgrade(options, deps = defaultDeps()) {
 }
 async function runCoreUpgradeResolved(options, deps, cleanups) {
   const materialize = deps.materialize ?? materializeTemplateAtTag;
-  const templateRepo = options.templateRepo ? resolve3(options.templateRepo) : resolveTemplateRoot();
+  const templateRepo = options.templateRepo ? resolve3(options.templateRepo) : resolveTemplateRoot({ guidance: MISSING_TEMPLATE_ROOT_GUIDANCE2 });
   const instanceVersion = readInstanceCoreVersion(options.cwd);
   let theirsDir;
   let toVersion;
@@ -2701,6 +2737,287 @@ function registerNonInteractive(command) {
   return command;
 }
 
+// src/lib/root-sibling.ts
+var ROOT_SIBLING_NAME = "app";
+var RESERVED_SIBLING_NAMES = ["admin", "login", ROOT_SIBLING_NAME];
+function isRootPathPrefix(pathPrefix) {
+  return pathPrefix === "";
+}
+function registryNameFor(pathPrefix) {
+  return isRootPathPrefix(pathPrefix) ? ROOT_SIBLING_NAME : pathPrefix;
+}
+function displayPath(pathPrefix) {
+  return isRootPathPrefix(pathPrefix) ? "/" : `/${pathPrefix}`;
+}
+function basePathFor(pathPrefix) {
+  return isRootPathPrefix(pathPrefix) ? "" : `/${pathPrefix}`;
+}
+function rootSiblingProjectName(coreProjectName) {
+  return `${coreProjectName}-app`;
+}
+function bucketRegionalDomain(bucketName, region) {
+  return region === "us-east-1" ? `${bucketName}.s3.amazonaws.com` : `${bucketName}.s3.${region}.amazonaws.com`;
+}
+function siteBucketName(projectName, environment, accountId) {
+  return `${projectName}-${environment}-site-${accountId}`;
+}
+function upsertSiblingOrigin(existing, entry) {
+  return [...existing.filter((s) => s.name !== entry.name), entry];
+}
+function serializeRegistry(origins) {
+  return JSON.stringify({ sibling_origins: origins }, null, 2) + "\n";
+}
+
+// src/lib/sibling-teardown.ts
+var SiblingResolutionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SiblingResolutionError";
+  }
+};
+var REGISTRY_ENVIRONMENTS = ["dev", "staging", "prod"];
+function registryPath(environment) {
+  return `infra/environments/${environment}/siblings.auto.tfvars.json`;
+}
+var REGISTRATION_BRANCH_PREFIX = "biffo/register-sibling-";
+function parseSiblingBucketDomain(domain) {
+  const host = /^(?<bucket>[a-z0-9][a-z0-9.-]*)\.s3(?:\.[a-z0-9-]+)?\.amazonaws\.com$/.exec(domain);
+  const bucket = host?.groups?.["bucket"];
+  if (!bucket) return null;
+  const parts = /^(?<project>.+)-(?<env>dev|staging|prod)-site-(?<account>\d{12})$/.exec(bucket);
+  const project = parts?.groups?.["project"];
+  const env = parts?.groups?.["env"];
+  const account = parts?.groups?.["account"];
+  if (!project || !env || !account) return null;
+  return { projectName: project, environment: env, accountId: account };
+}
+function parseRegistry(contents) {
+  if (contents === void 0 || contents.trim() === "") return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch {
+    throw new SiblingResolutionError(
+      "A siblings.auto.tfvars.json in the core repo is not valid JSON. Refusing to tear down while the sibling registry cannot be read \u2014 fix or remove the file and re-run."
+    );
+  }
+  const origins = parsed.sibling_origins;
+  if (origins === void 0) return [];
+  if (!Array.isArray(origins)) {
+    throw new SiblingResolutionError(
+      "sibling_origins in the core repo is not a list. Refusing to tear down while the sibling registry cannot be read."
+    );
+  }
+  return origins;
+}
+function collectSiblings(sources) {
+  const byPrefix = /* @__PURE__ */ new Map();
+  for (const source of sources) {
+    for (const entry of source.entries) {
+      if (!entry?.name || !entry.bucket_regional_domain) {
+        throw new SiblingResolutionError(
+          `A sibling entry in ${registryPath(source.environment)} is missing name or bucket_regional_domain. Refusing to tear down while a registered sibling cannot be identified \u2014 it would be left behind, still billing.`
+        );
+      }
+      const parsed = parseSiblingBucketDomain(entry.bucket_regional_domain);
+      if (!parsed) {
+        throw new SiblingResolutionError(
+          `Could not work out which project owns the sibling "${entry.name}" from its bucket "${entry.bucket_regional_domain}" (in ${registryPath(source.environment)}).
+  Refusing to guess \u2014 tear that sibling down by hand, remove its entry, then re-run.`
+        );
+      }
+      const existing = byPrefix.get(entry.name);
+      if (existing) {
+        if (existing.projectName !== parsed.projectName) {
+          throw new SiblingResolutionError(
+            `The sibling "${entry.name}" maps to two different projects across environments ("${existing.projectName}" and "${parsed.projectName}"). Refusing to guess which repo to delete \u2014 resolve the registry by hand and re-run.`
+          );
+        }
+        if (!existing.environments.includes(parsed.environment)) {
+          existing.environments.push(parsed.environment);
+        }
+        if (source.pendingRegistrationPr === void 0) {
+          existing.registered = true;
+          delete existing.pendingRegistrationPr;
+        }
+        continue;
+      }
+      byPrefix.set(entry.name, {
+        pathPrefix: entry.name,
+        projectName: parsed.projectName,
+        environments: [parsed.environment],
+        accountId: parsed.accountId,
+        registered: source.pendingRegistrationPr === void 0,
+        ...source.pendingRegistrationPr !== void 0 ? { pendingRegistrationPr: source.pendingRegistrationPr } : {}
+      });
+    }
+  }
+  return [...byPrefix.values()].sort((a, b) => a.pathPrefix.localeCompare(b.pathPrefix));
+}
+var SIBLING_MARKER_FILE = "biffo.sibling.json";
+function markerMatches(marker, coreProjectName, sibling) {
+  if (!marker) return false;
+  if (marker.core_project !== coreProjectName) return false;
+  if (marker.path_prefix === sibling.pathPrefix) return true;
+  if (marker.path_prefix === "" && sibling.pathPrefix === ROOT_SIBLING_NAME) return true;
+  return marker.name === sibling.projectName;
+}
+async function resolveSiblingRepos(github, coreOrg, coreProjectName, siblings) {
+  const resolved = [];
+  for (const sibling of siblings) {
+    const repo = sibling.projectName;
+    if (!await github.repoExists(coreOrg, repo)) {
+      resolved.push({ ...sibling, org: coreOrg, repo, repoState: "gone" });
+      continue;
+    }
+    const raw = await github.getFileContent(coreOrg, repo, SIBLING_MARKER_FILE);
+    let marker = null;
+    if (raw !== void 0) {
+      try {
+        marker = JSON.parse(raw);
+      } catch {
+        marker = null;
+      }
+    }
+    if (!markerMatches(marker, coreProjectName, sibling)) {
+      throw new SiblingResolutionError(
+        `Refusing to tear down: ${coreOrg}/${repo} is registered as the sibling "${sibling.pathPrefix}" of "${coreProjectName}", but that repo does not carry a matching ${SIBLING_MARKER_FILE}.
+  It may be an unrelated repo that happens to share the name. Deleting a repo cannot be undone, so nothing has been deleted.
+  Delete ${coreOrg}/${repo} by hand if it really is the sibling, remove its entry from the core repo's siblings.auto.tfvars.json, then re-run biffo teardown.`
+      );
+    }
+    resolved.push({ ...sibling, org: coreOrg, repo, repoState: "present" });
+  }
+  return resolved;
+}
+async function discoverSiblings(github, coreOrg, coreRepo, coreProjectName) {
+  const sources = [];
+  for (const env of REGISTRY_ENVIRONMENTS) {
+    const contents = await github.getFileContent(coreOrg, coreRepo, registryPath(env));
+    sources.push({ environment: env, entries: parseRegistry(contents) });
+  }
+  const openPrs = await github.listOpenPullRequests(coreOrg, coreRepo);
+  for (const pr of openPrs) {
+    if (!pr.headRef.startsWith(REGISTRATION_BRANCH_PREFIX)) continue;
+    for (const env of REGISTRY_ENVIRONMENTS) {
+      const contents = await github.getFileContent(coreOrg, coreRepo, registryPath(env), pr.headRef);
+      sources.push({
+        environment: env,
+        entries: parseRegistry(contents),
+        pendingRegistrationPr: pr.number
+      });
+    }
+  }
+  const discovered = collectSiblings(sources);
+  return resolveSiblingRepos(github, coreOrg, coreProjectName, discovered);
+}
+
+// src/lib/sibling-wiring.ts
+function cloudfrontDistributionArn(accountId, distributionId) {
+  return `arn:aws:cloudfront::${accountId}:distribution/${distributionId}`;
+}
+var REQUIRED_CORE_OUTPUTS = [
+  "cognito_user_pool_id",
+  "cognito_client_id",
+  "api_gateway_url",
+  "portal_url",
+  "cloudfront_distribution_id"
+];
+function coreWiringFromOutputs(outputs, coreAccountId, environment) {
+  const missing = REQUIRED_CORE_OUTPUTS.filter((k) => !outputs[k]?.trim());
+  if (missing.length > 0) {
+    throw new Error(
+      `Cannot wire siblings for ${environment}: the core deploy did not expose ${missing.join(", ")} in its Terraform outputs. A sibling wired without these would build a frontend pointing at no API/Cognito and skip its S3 bucket policy (so / returns 403). Confirm the core actually deployed ${environment} before wiring.`
+    );
+  }
+  const distributionId = outputs["cloudfront_distribution_id"];
+  return {
+    identity: {
+      cognitoUserPoolId: outputs["cognito_user_pool_id"],
+      cognitoClientId: outputs["cognito_client_id"],
+      apiUrl: outputs["api_gateway_url"],
+      portalUrl: outputs["portal_url"]
+    },
+    cdn: {
+      distributionId,
+      distributionArn: cloudfrontDistributionArn(coreAccountId, distributionId)
+    }
+  };
+}
+async function setSiblingCoreIdentity(github, org, repo, env, identity) {
+  await github.setEnvVariable(
+    org,
+    repo,
+    env,
+    "CORE_COGNITO_USER_POOL_ID",
+    identity.cognitoUserPoolId
+  );
+  await github.setEnvVariable(org, repo, env, "CORE_COGNITO_CLIENT_ID", identity.cognitoClientId);
+  await github.setEnvVariable(org, repo, env, "CORE_API_URL", identity.apiUrl);
+  await github.setEnvVariable(org, repo, env, "CORE_PORTAL_URL", identity.portalUrl);
+  await github.setEnvVariable(
+    org,
+    repo,
+    env,
+    "CORS_ORIGINS_JSON",
+    JSON.stringify([identity.portalUrl])
+  );
+}
+async function wireSiblingEnvironment(github, org, repo, env, wiring) {
+  await setSiblingCoreIdentity(github, org, repo, env, wiring.identity);
+  await github.setEnvVariable(
+    org,
+    repo,
+    env,
+    "PARENT_CLOUDFRONT_DISTRIBUTION_ARN",
+    wiring.cdn.distributionArn
+  );
+  await github.setEnvVariable(
+    org,
+    repo,
+    env,
+    "PARENT_CLOUDFRONT_DISTRIBUTION_ID",
+    wiring.cdn.distributionId
+  );
+}
+async function wireSiblingsAfterCoreDeploy(github, coreOrg, coreRepo, coreProjectName, environment, wiring, siblingGithubToken) {
+  const siblings = await discoverSiblings(github, coreOrg, coreRepo, coreProjectName);
+  const result = { wired: [], gone: [], skippedEnv: [] };
+  for (const sibling of siblings) {
+    const slug = `${sibling.org}/${sibling.repo}`;
+    if (sibling.repoState === "gone") {
+      result.gone.push(slug);
+      continue;
+    }
+    await github.setRepoSecret(
+      sibling.org,
+      sibling.repo,
+      "SIBLING_GITHUB_TOKEN",
+      siblingGithubToken
+    );
+    if (!sibling.environments.includes(environment)) {
+      result.skippedEnv.push(slug);
+      continue;
+    }
+    await wireSiblingEnvironment(github, sibling.org, sibling.repo, environment, wiring);
+    result.wired.push(slug);
+  }
+  return result;
+}
+function formatWiringResult(environment, result) {
+  const lines = [];
+  for (const slug of result.wired) {
+    lines.push(`  Wired sibling ${slug} (${environment}): CORE_*, CORS, PARENT_CLOUDFRONT_*, token`);
+  }
+  for (const slug of result.skippedEnv) {
+    lines.push(`  Sibling ${slug}: token set; not registered for ${environment}, env vars skipped`);
+  }
+  for (const slug of result.gone) {
+    lines.push(`  Sibling ${slug}: registered but repo not found \u2014 skipped`);
+  }
+  return lines;
+}
+
 // src/commands/deploy.ts
 var deployCommand = new Command9("deploy").description("Deploy infrastructure and application to an environment").argument("<environment>", "Target environment: dev | staging | prod").option("--infra-only", "Deploy infrastructure only, skip application build").option("--app-only", "Deploy application only, skip Terraform").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").option("-y, --yes", "Skip deployment target confirmation").action(
   async (environment, options) => {
@@ -2968,8 +3285,9 @@ async function runDeploy(github, aws, config, environment, options = {}) {
   }
   const reportStep = totalSteps;
   log.step(reportStep, totalSteps, "Reading deployment outputs...");
+  let outputs;
   try {
-    const outputs = await aws.readTerraformOutputs(stateBucket, stateKey);
+    outputs = await aws.readTerraformOutputs(stateBucket, stateKey);
     console.log(chalk8.bold("\n  Deploy complete!\n"));
     if (outputs.portal_url) console.log(`  Portal:      ${chalk8.cyan(outputs.portal_url)}`);
     if (outputs.api_gateway_url)
@@ -3006,6 +3324,50 @@ async function runDeploy(github, aws, config, environment, options = {}) {
     console.log(`  Actions: ${actionsUrl}
 `);
   }
+  await wireSiblingsIfAny(github, config, environment, awsConfig2.account_id, outputs, options.token);
+}
+async function wireSiblingsIfAny(github, config, environment, coreAccountId, outputs, token) {
+  const { org, repo } = config.source_control.config;
+  if (!outputs) {
+    log.warn(
+      `Skipped wiring siblings: this run produced no readable Terraform outputs (e.g. --app-only without a prior infra apply). Re-run \`biffo deploy ${environment}\` once the core infrastructure is applied so its siblings can be wired.`
+    );
+    return;
+  }
+  if (!token) {
+    log.warn(
+      "Skipped wiring siblings: no GitHub token available to set the SIBLING_GITHUB_TOKEN secret."
+    );
+    return;
+  }
+  try {
+    const wiring = coreWiringFromOutputs(outputs, coreAccountId, environment);
+    const result = await wireSiblingsAfterCoreDeploy(
+      github,
+      org,
+      repo,
+      config.project.name,
+      environment,
+      wiring,
+      token
+    );
+    const lines = formatWiringResult(environment, result);
+    if (lines.length > 0) {
+      console.log(chalk8.dim("\n  Siblings:"));
+      for (const line of lines) console.log(chalk8.dim(line));
+      console.log();
+    }
+  } catch (err) {
+    if (err instanceof SiblingResolutionError) {
+      log.error(`Could not wire siblings: ${err.message}`);
+    } else {
+      log.error(`Failed to wire siblings to the deployed core: ${err.message}`);
+    }
+    log.error(
+      `  The core deployed, but at least one sibling was not wired. Fix the cause and re-run \`biffo deploy ${environment}\` \u2014 wiring is idempotent.`
+    );
+    process.exit(1);
+  }
 }
 function resolveGithubToken() {
   if (process.env["GITHUB_TOKEN"]) return process.env["GITHUB_TOKEN"];
@@ -3507,37 +3869,6 @@ async function resolveRepoIds(github, config) {
   }
 }
 
-// src/lib/root-sibling.ts
-var ROOT_SIBLING_NAME = "app";
-var RESERVED_SIBLING_NAMES = ["admin", "login", ROOT_SIBLING_NAME];
-function isRootPathPrefix(pathPrefix) {
-  return pathPrefix === "";
-}
-function registryNameFor(pathPrefix) {
-  return isRootPathPrefix(pathPrefix) ? ROOT_SIBLING_NAME : pathPrefix;
-}
-function displayPath(pathPrefix) {
-  return isRootPathPrefix(pathPrefix) ? "/" : `/${pathPrefix}`;
-}
-function basePathFor(pathPrefix) {
-  return isRootPathPrefix(pathPrefix) ? "" : `/${pathPrefix}`;
-}
-function rootSiblingProjectName(coreProjectName) {
-  return `${coreProjectName}-app`;
-}
-function bucketRegionalDomain(bucketName, region) {
-  return region === "us-east-1" ? `${bucketName}.s3.amazonaws.com` : `${bucketName}.s3.${region}.amazonaws.com`;
-}
-function siteBucketName(projectName, environment, accountId) {
-  return `${projectName}-${environment}-site-${accountId}`;
-}
-function upsertSiblingOrigin(existing, entry) {
-  return [...existing.filter((s) => s.name !== entry.name), entry];
-}
-function serializeRegistry(origins) {
-  return JSON.stringify({ sibling_origins: origins }, null, 2) + "\n";
-}
-
 // src/config/sibling-schema.ts
 import { z as z4 } from "zod";
 var SiblingConfigSchema = z4.object({
@@ -3774,12 +4105,11 @@ async function runSiblingCreateCommand(name, options) {
     `
   Next steps:
   1. Merge the registration PR above \u2014 until it merges, baseurl.com${displayPath(pathPrefix)} won't route anywhere.
-  2. Add a SIBLING_GITHUB_TOKEN secret to this new repo (a PAT with repo scope) \u2014 needed by its
-     deploy workflow to export Terraform outputs as environment variables, same as the core project.
+  2. Run \`biffo deploy <env>\` on the CORE project (or re-run it if already deployed). That wires
+     this sibling automatically: the SIBLING_GITHUB_TOKEN secret, the CORE_* identity variables,
+     and \u2014 once the registration PR has merged and the core has redeployed \u2014
+     PARENT_CLOUDFRONT_DISTRIBUTION_ARN. No manual variable/secret setup is needed (issue #337).
   3. Push to \`dev\` (or run the Deploy workflow manually) to provision this sibling's own AWS resources.
-  4. Once the registration PR has ALSO merged and the core project has redeployed, set
-     PARENT_CLOUDFRONT_DISTRIBUTION_ARN on this repo and re-run its Deploy workflow \u2014 see this
-     repo's README, "The two-phase CDN registration".
 `
   );
 }
@@ -3801,7 +4131,6 @@ async function runSiblingCreate(github, aws, coreAws, git, config, session, opti
       "Core project isn't deployed yet \u2014 deferring its identity (CORE_COGNITO_*, CORE_API_URL)"
     );
     session.outputs.coreIdentity = {};
-    markSiblingStepComplete(session, "resolve_core_identity");
   } else if (!session.completedSteps.includes("resolve_core_identity")) {
     log.step(2, totalSteps, "Resolving core project's identity...");
     session.outputs.coreIdentity = await resolveCoreIdentity(
@@ -4060,23 +4389,7 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
   for (const env of config.environments) {
     const identity = coreIdentity[env];
     if (!identity) continue;
-    await github.setEnvVariable(
-      org,
-      repo,
-      env,
-      "CORE_COGNITO_USER_POOL_ID",
-      identity.cognitoUserPoolId
-    );
-    await github.setEnvVariable(org, repo, env, "CORE_COGNITO_CLIENT_ID", identity.cognitoClientId);
-    await github.setEnvVariable(org, repo, env, "CORE_API_URL", identity.apiUrl);
-    await github.setEnvVariable(org, repo, env, "CORE_PORTAL_URL", identity.portalUrl);
-    await github.setEnvVariable(
-      org,
-      repo,
-      env,
-      "CORS_ORIGINS_JSON",
-      JSON.stringify([identity.portalUrl])
-    );
+    await setSiblingCoreIdentity(github, org, repo, env, identity);
   }
   if (session.outputs.oidcRoleArn) {
     await github.setRepoSecret(org, repo, "SIBLING_OIDC_ROLE_ARN", session.outputs.oidcRoleArn);
@@ -4320,12 +4633,7 @@ var initCommand = new Command12("init").description("Scaffold a new project from
   Platform:    https://github.com/${org}/${repo}`);
     console.log(`  Application: https://github.com/${org}/${appRepo}   (serves /)`);
     console.log(
-      `
-  Next:
-  1. Clone the platform repo and run its first deploy \u2014 /admin and /login come up with it.
-  2. Then deploy the application repo. Until it deploys, / has no content and 404s;
-     that window is expected.
-`
+      "\n  Next:\n  1. Clone the platform repo and run `biffo deploy dev` \u2014 /admin and /login come up, and\n     the same deploy wires the application repo (its CORE_* identity, the parent CloudFront\n     ARN, and the SIBLING_GITHUB_TOKEN secret) automatically.\n  2. Then run the application repo's Deploy workflow \u2014 no manual variable/secret setup is\n     needed. Until it deploys, / has no content and 404s; that window is expected.\n"
     );
   }
 );
@@ -4539,7 +4847,12 @@ function appSiblingRegistryFiles(config) {
   }));
 }
 var INSTANCE_CONFIG_FILE = "biffo.config.json";
-var INSTANCE_FILE_BRANCHES = ["main", "dev", "staging"];
+var INSTANCE_FILE_BASE_BRANCH = "main";
+var INSTANCE_FILE_FOLLOWER_BRANCHES = ["dev", "staging"];
+var INSTANCE_FILE_BRANCHES = [
+  INSTANCE_FILE_BASE_BRANCH,
+  ...INSTANCE_FILE_FOLLOWER_BRANCHES
+];
 async function writeInstanceFiles(github, org, repo, config) {
   const files = [
     { path: INSTANCE_CORE_FILE, content: serializeInstanceCoreVersion(getLatestCoreVersion()) },
@@ -4547,8 +4860,10 @@ async function writeInstanceFiles(github, org, repo, config) {
     ...config ? appSiblingRegistryFiles(config) : []
   ];
   const message = config ? `chore: record core version, register the ${ROOT_SIBLING_NAME} sibling, and drop the template ${INSTANCE_CONFIG_FILE}` : `chore: record core version and drop the template ${INSTANCE_CONFIG_FILE}`;
-  for (const branch of INSTANCE_FILE_BRANCHES) {
-    await github.commitFiles(org, repo, branch, files, message);
+  const committed = await github.commitFiles(org, repo, INSTANCE_FILE_BASE_BRANCH, files, message);
+  const sharedSha = committed ?? await github.getBranchSha(org, repo, INSTANCE_FILE_BASE_BRANCH);
+  for (const branch of INSTANCE_FILE_FOLLOWER_BRANCHES) {
+    await github.fastForwardBranch(org, repo, branch, sharedSha);
   }
 }
 function printPlan2(config) {
@@ -6160,131 +6475,6 @@ import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STS
 import chalk20 from "chalk";
 import { Command as Command22 } from "commander";
 import inquirer8 from "inquirer";
-
-// src/lib/sibling-teardown.ts
-var SiblingResolutionError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SiblingResolutionError";
-  }
-};
-var REGISTRY_ENVIRONMENTS = ["dev", "staging", "prod"];
-function registryPath(environment) {
-  return `infra/environments/${environment}/siblings.auto.tfvars.json`;
-}
-var REGISTRATION_BRANCH_PREFIX = "biffo/register-sibling-";
-function parseSiblingBucketDomain(domain) {
-  const host = /^(?<bucket>[a-z0-9][a-z0-9.-]*)\.s3(?:\.[a-z0-9-]+)?\.amazonaws\.com$/.exec(domain);
-  const bucket = host?.groups?.["bucket"];
-  if (!bucket) return null;
-  const parts = /^(?<project>.+)-(?<env>dev|staging|prod)-site-(?<account>\d{12})$/.exec(bucket);
-  const project = parts?.groups?.["project"];
-  const env = parts?.groups?.["env"];
-  const account = parts?.groups?.["account"];
-  if (!project || !env || !account) return null;
-  return { projectName: project, environment: env, accountId: account };
-}
-function parseRegistry(contents) {
-  if (contents === void 0 || contents.trim() === "") return [];
-  let parsed;
-  try {
-    parsed = JSON.parse(contents);
-  } catch {
-    throw new SiblingResolutionError(
-      "A siblings.auto.tfvars.json in the core repo is not valid JSON. Refusing to tear down while the sibling registry cannot be read \u2014 fix or remove the file and re-run."
-    );
-  }
-  const origins = parsed.sibling_origins;
-  if (origins === void 0) return [];
-  if (!Array.isArray(origins)) {
-    throw new SiblingResolutionError(
-      "sibling_origins in the core repo is not a list. Refusing to tear down while the sibling registry cannot be read."
-    );
-  }
-  return origins;
-}
-function collectSiblings(sources) {
-  const byPrefix = /* @__PURE__ */ new Map();
-  for (const source of sources) {
-    for (const entry of source.entries) {
-      if (!entry?.name || !entry.bucket_regional_domain) {
-        throw new SiblingResolutionError(
-          `A sibling entry in ${registryPath(source.environment)} is missing name or bucket_regional_domain. Refusing to tear down while a registered sibling cannot be identified \u2014 it would be left behind, still billing.`
-        );
-      }
-      const parsed = parseSiblingBucketDomain(entry.bucket_regional_domain);
-      if (!parsed) {
-        throw new SiblingResolutionError(
-          `Could not work out which project owns the sibling "${entry.name}" from its bucket "${entry.bucket_regional_domain}" (in ${registryPath(source.environment)}).
-  Refusing to guess \u2014 tear that sibling down by hand, remove its entry, then re-run.`
-        );
-      }
-      const existing = byPrefix.get(entry.name);
-      if (existing) {
-        if (existing.projectName !== parsed.projectName) {
-          throw new SiblingResolutionError(
-            `The sibling "${entry.name}" maps to two different projects across environments ("${existing.projectName}" and "${parsed.projectName}"). Refusing to guess which repo to delete \u2014 resolve the registry by hand and re-run.`
-          );
-        }
-        if (!existing.environments.includes(parsed.environment)) {
-          existing.environments.push(parsed.environment);
-        }
-        if (source.pendingRegistrationPr === void 0) {
-          existing.registered = true;
-          delete existing.pendingRegistrationPr;
-        }
-        continue;
-      }
-      byPrefix.set(entry.name, {
-        pathPrefix: entry.name,
-        projectName: parsed.projectName,
-        environments: [parsed.environment],
-        accountId: parsed.accountId,
-        registered: source.pendingRegistrationPr === void 0,
-        ...source.pendingRegistrationPr !== void 0 ? { pendingRegistrationPr: source.pendingRegistrationPr } : {}
-      });
-    }
-  }
-  return [...byPrefix.values()].sort((a, b) => a.pathPrefix.localeCompare(b.pathPrefix));
-}
-var SIBLING_MARKER_FILE = "biffo.sibling.json";
-function markerMatches(marker, coreProjectName, sibling) {
-  if (!marker) return false;
-  if (marker.core_project !== coreProjectName) return false;
-  if (marker.path_prefix === sibling.pathPrefix) return true;
-  if (marker.path_prefix === "" && sibling.pathPrefix === ROOT_SIBLING_NAME) return true;
-  return marker.name === sibling.projectName;
-}
-async function resolveSiblingRepos(github, coreOrg, coreProjectName, siblings) {
-  const resolved = [];
-  for (const sibling of siblings) {
-    const repo = sibling.projectName;
-    if (!await github.repoExists(coreOrg, repo)) {
-      resolved.push({ ...sibling, org: coreOrg, repo, repoState: "gone" });
-      continue;
-    }
-    const raw = await github.getFileContent(coreOrg, repo, SIBLING_MARKER_FILE);
-    let marker = null;
-    if (raw !== void 0) {
-      try {
-        marker = JSON.parse(raw);
-      } catch {
-        marker = null;
-      }
-    }
-    if (!markerMatches(marker, coreProjectName, sibling)) {
-      throw new SiblingResolutionError(
-        `Refusing to tear down: ${coreOrg}/${repo} is registered as the sibling "${sibling.pathPrefix}" of "${coreProjectName}", but that repo does not carry a matching ${SIBLING_MARKER_FILE}.
-  It may be an unrelated repo that happens to share the name. Deleting a repo cannot be undone, so nothing has been deleted.
-  Delete ${coreOrg}/${repo} by hand if it really is the sibling, remove its entry from the core repo's siblings.auto.tfvars.json, then re-run biffo teardown.`
-      );
-    }
-    resolved.push({ ...sibling, org: coreOrg, repo, repoState: "present" });
-  }
-  return resolved;
-}
-
-// src/commands/teardown.ts
 var teardownCommand = new Command22("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
@@ -6594,27 +6784,6 @@ Destroying sibling ${sibling.org}/${sibling.repo} (${env})...`);
 }
 var SIBLING_DESTROY_WORKFLOW = "destroy-infra.yml";
 var SIBLING_DESTROY_WORKFLOW_PATH = `.github/workflows/${SIBLING_DESTROY_WORKFLOW}`;
-async function discoverSiblings(github, coreOrg, coreRepo, coreProjectName) {
-  const sources = [];
-  for (const env of REGISTRY_ENVIRONMENTS) {
-    const contents = await github.getFileContent(coreOrg, coreRepo, registryPath(env));
-    sources.push({ environment: env, entries: parseRegistry(contents) });
-  }
-  const openPrs = await github.listOpenPullRequests(coreOrg, coreRepo);
-  for (const pr of openPrs) {
-    if (!pr.headRef.startsWith(REGISTRATION_BRANCH_PREFIX)) continue;
-    for (const env of REGISTRY_ENVIRONMENTS) {
-      const contents = await github.getFileContent(coreOrg, coreRepo, registryPath(env), pr.headRef);
-      sources.push({
-        environment: env,
-        entries: parseRegistry(contents),
-        pendingRegistrationPr: pr.number
-      });
-    }
-  }
-  const discovered = collectSiblings(sources);
-  return resolveSiblingRepos(github, coreOrg, coreProjectName, discovered);
-}
 async function assertSiblingsAreDestroyable(github, siblings) {
   const missing = [];
   for (const sibling of siblings) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.41.9",
+  "version": "0.41.11",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",