@biffo/cli 0.50.1 → 0.50.3

package/core.version

@@ -1 +1 @@
-0.50.1
+0.50.3

package/dist/index.js

@@ -337,8 +337,9 @@ async function runCoreStatus(options) {
 
 // src/commands/core-upgrade.ts
 import { execSync as execSync2 } from "child_process";
-import { join as join8, resolve as resolve3 } from "path";
+import { join as join9, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
+import { execa as execa3 } from "execa";
 import { Command as Command3 } from "commander";
 
 // src/adapters/git/index.ts
@@ -1467,7 +1468,10 @@ var gitMergeFile = async (base, ours, theirs) => {
     writeFileSync3(b, base);
     writeFileSync3(o, ours);
     writeFileSync3(t, theirs);
-    const result = await execa2("git", ["merge-file", "-p", o, b, t], { reject: false });
+    const result = await execa2("git", ["merge-file", "-p", o, b, t], {
+      reject: false,
+      stripFinalNewline: false
+    });
     if (typeof result.exitCode !== "number" || result.exitCode < 0) {
       throw new Error(`git merge-file failed: ${result.stderr}`);
     }
@@ -1630,6 +1634,45 @@ var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
   ".github/workflows/deploy-global.yml"
 ];
 
+// src/lib/lockfile-refresh.ts
+import { existsSync as existsSync6 } from "fs";
+import { join as join8 } from "path";
+var LOCKFILE_TRIGGERS = [
+  {
+    manifest: "package.json",
+    lockfile: "pnpm-lock.yaml",
+    command: ["pnpm", "install", "--lockfile-only"],
+    ecosystem: "pnpm"
+  },
+  {
+    manifest: "pyproject.toml",
+    lockfile: "uv.lock",
+    command: ["uv", "lock"],
+    ecosystem: "uv"
+  }
+];
+function lockfilesNeedingRefresh(changedPaths, instanceDir, triggers = LOCKFILE_TRIGGERS) {
+  return triggers.filter((t) => {
+    const touched = changedPaths.some((p) => p === t.manifest || p.endsWith(`/${t.manifest}`));
+    return touched && existsSync6(join8(instanceDir, t.lockfile));
+  });
+}
+async function refreshLockfiles(instanceDir, triggers, run) {
+  const outcomes = [];
+  for (const trigger of triggers) {
+    const result = await run(trigger.command, instanceDir);
+    const outcome = { trigger, ok: result.ok };
+    if (result.error !== void 0) outcome.error = result.error;
+    outcomes.push(outcome);
+  }
+  return outcomes;
+}
+function describeFailures(outcomes) {
+  return outcomes.filter((o) => !o.ok).map(
+    (o) => `${o.trigger.lockfile} could not be refreshed (${o.trigger.ecosystem}): ${o.error ?? "unknown error"}. Run \`${o.trigger.command.join(" ")}\` in the instance and commit the result, or CI will fail on a lockfile that disagrees with ${o.trigger.manifest}.`
+  );
+}
+
 // src/commands/core-upgrade.ts
 var MISSING_TEMPLATE_ROOT_GUIDANCE2 = "Pass --template-repo <path> to a biffo-template git checkout, e.g. `biffo core upgrade --template-repo /path/to/biffo-template`.";
 var coreUpgradeCommand = new Command3("upgrade").description("Three-way-merge template-owned files for a core upgrade; preview it or open a PR").option("--cwd <path>", "Instance repo root to upgrade (defaults to the current directory)").option(
@@ -1700,9 +1743,9 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   let toVersion;
   if (options.theirsDir) {
     theirsDir = options.theirsDir;
-    toVersion = readCoreVersionFile(join8(theirsDir, "core.version"));
+    toVersion = readCoreVersionFile(join9(theirsDir, "core.version"));
   } else {
-    const workingVersion = readCoreVersionFile(join8(templateRepo, "core.version"));
+    const workingVersion = readCoreVersionFile(join9(templateRepo, "core.version"));
     toVersion = options.toVersion ?? workingVersion;
     if (toVersion === workingVersion) {
       theirsDir = templateRepo;
@@ -1716,7 +1759,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   let fromVersion;
   if (options.baseDir) {
     baseDir = options.baseDir;
-    fromVersion = readCoreVersionFile(join8(baseDir, "core.version"));
+    fromVersion = readCoreVersionFile(join9(baseDir, "core.version"));
   } else {
     if (instanceVersion === null) {
       throw new Error(
@@ -1791,6 +1834,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     4,
     `Applied ${applied.written.length} change(s), ${applied.deleted.length} deletion(s), ${carried.length} new migration(s)`
   );
+  const lockfiles = await refreshInstanceLockfiles(options.cwd, plan, deps);
   await git.add(options.cwd, ["-A"]);
   await git.commit(options.cwd, `chore(core): upgrade template core ${fromVersion} -> ${toVersion}`);
   log.step(3, 4, `Pushing ${branch}`);
@@ -1806,7 +1850,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     head: branch,
     base,
     title: `Upgrade Biffo core ${fromVersion} \u2192 ${toVersion}`,
-    body: buildPrBody(fromVersion, toVersion, plan, migrations, base)
+    body: buildPrBody(fromVersion, toVersion, plan, migrations, base, lockfiles)
   });
   if (plan.conflicts.length > 0) {
     log.warn(`PR opened with ${plan.conflicts.length} conflict(s) to resolve: ${pr.url}`);
@@ -1814,7 +1858,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     log.success(`Opened PR #${pr.number}: ${pr.url}`);
   }
 }
-function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF) {
+function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, lockfiles = []) {
   const lines = [
     "Automated core upgrade generated by `biffo core upgrade` (ADR-0006).",
     "",
@@ -1856,6 +1900,26 @@ function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF) {
       `Merging here lands the fix on \`${base}\` \u2014 **but the deploy runs it from \`${GLOBAL_DISPATCH_REF}\`.** Until you promote \`${base}\` \u2192 \`${GLOBAL_DISPATCH_REF}\` (open a PR from \`${base}\` into \`${GLOBAL_DISPATCH_REF}\` and merge it), the old workflow keeps running and this fix will not take effect.`
     );
   }
+  const lockfileFailures = describeFailures(lockfiles);
+  if (lockfileFailures.length > 0) {
+    lines.push(
+      "",
+      "## \u26A0 Lockfiles could not be refreshed",
+      "",
+      "This upgrade changed a dependency manifest, but the matching lockfile could not be regenerated on the machine that ran the upgrade. **CI will fail on the mismatch** until this is done by hand:",
+      "",
+      ...lockfileFailures.map((f) => `- ${f}`)
+    );
+  } else if (lockfiles.length > 0) {
+    lines.push(
+      "",
+      `## Lockfiles refreshed (${lockfiles.length})`,
+      "",
+      "This upgrade changed a dependency manifest. The manifests are template-owned and the lockfiles are not, so the lockfiles were regenerated **in this repo** \u2014 against its own registry config \u2014 and committed alongside, rather than left disagreeing:",
+      "",
+      ...lockfiles.map((o) => `- \`${o.trigger.lockfile}\` (\`${o.trigger.command.join(" ")}\`)`)
+    );
+  }
   if (plan.conflicts.length > 0) {
     lines.push(
       "",
@@ -1898,6 +1962,35 @@ function printPlan(plan) {
     console.log(`  ${color(e.status.padEnd(15))} ${e.path}`);
   }
 }
+async function refreshInstanceLockfiles(cwd, plan, deps) {
+  const triggers = lockfilesNeedingRefresh(
+    plan.changes.map((c) => c.path),
+    cwd
+  );
+  if (triggers.length === 0) return [];
+  const run = deps.runCommand ?? defaultRunCommand;
+  const outcomes = await refreshLockfiles(cwd, triggers, run);
+  const refreshed = outcomes.filter((o) => o.ok);
+  if (refreshed.length > 0) {
+    log.info(
+      `Refreshed ${refreshed.map((o) => o.trigger.lockfile).join(", ")} \u2014 the upgrade changed a dependency manifest they lock.`
+    );
+  }
+  for (const message of describeFailures(outcomes)) log.warn(message);
+  return outcomes;
+}
+var defaultRunCommand = async (command, cwd) => {
+  const [bin, ...args] = command;
+  if (!bin) return { ok: false, error: "empty command" };
+  try {
+    await execa3(bin, args, { cwd });
+    return { ok: true };
+  } catch (err) {
+    const cause = err;
+    const detail = cause.stderr?.trim() || cause.shortMessage || cause.message || "failed";
+    return { ok: false, error: detail.split("\n")[0] ?? "failed" };
+  }
+};
 
 // src/commands/core.ts
 var coreCommand = new Command4("core").description(
@@ -1911,7 +2004,7 @@ coreCommand.addCommand(coreUpgradeCommand);
 import { Command as Command8 } from "commander";
 
 // src/commands/data-apply.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 import { resolve as resolve4 } from "path";
 import chalk5 from "chalk";
 import { Command as Command5 } from "commander";
@@ -2362,7 +2455,7 @@ function isTemplatePlaceholderConfig(raw) {
 
 // src/lib/session.ts
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync3,
   readFileSync as readFileSync5,
@@ -2371,7 +2464,7 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import { homedir } from "os";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var LEGACY_STEP_ALIASES = {
   github_config: ["github_branches", "github_instance_files", "github_settings"]
 };
@@ -2380,14 +2473,14 @@ function hasCompleted(session, step) {
   return session.completedSteps.some((done) => LEGACY_STEP_ALIASES[done]?.includes(step) ?? false);
 }
 function sessionsDir() {
-  return process.env["BIFFO_SESSIONS_DIR"] ?? join9(homedir(), ".biffo", "sessions");
+  return process.env["BIFFO_SESSIONS_DIR"] ?? join10(homedir(), ".biffo", "sessions");
 }
 function sessionPath(projectName) {
-  return join9(sessionsDir(), `${projectName}.json`);
+  return join10(sessionsDir(), `${projectName}.json`);
 }
 function loadSession(projectName) {
   const path = sessionPath(projectName);
-  if (!existsSync6(path)) return null;
+  if (!existsSync7(path)) return null;
   try {
     return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
@@ -2396,23 +2489,23 @@ function loadSession(projectName) {
 }
 function findLatestSession() {
   const dir = sessionsDir();
-  if (!existsSync6(dir)) return null;
+  if (!existsSync7(dir)) return null;
   const files = readdirSync3(dir).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return null;
   const sorted = files.map((f) => {
-    const fullPath = join9(dir, f);
-    const mtime = existsSync6(fullPath) ? statSync(fullPath).mtimeMs : -1;
+    const fullPath = join10(dir, f);
+    const mtime = existsSync7(fullPath) ? statSync(fullPath).mtimeMs : -1;
     return { f, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   try {
-    return JSON.parse(readFileSync5(join9(dir, sorted[0].f), "utf8"));
+    return JSON.parse(readFileSync5(join10(dir, sorted[0].f), "utf8"));
   } catch {
     return null;
   }
 }
 function saveSession(session) {
   const dir = sessionsDir();
-  if (!existsSync6(dir)) mkdirSync3(dir, { recursive: true });
+  if (!existsSync7(dir)) mkdirSync3(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSession(name);
   if (prior) {
@@ -2434,19 +2527,19 @@ function markStepComplete(session, step) {
 }
 function deleteSession(projectName) {
   const path = sessionPath(projectName);
-  if (existsSync6(path)) rmSync4(path);
+  if (existsSync7(path)) rmSync4(path);
 }
 function projectsDir() {
-  return process.env["BIFFO_PROJECTS_DIR"] ?? join9(homedir(), ".biffo", "projects");
+  return process.env["BIFFO_PROJECTS_DIR"] ?? join10(homedir(), ".biffo", "projects");
 }
 function saveProjectConfig(config) {
   const dir = projectsDir();
-  if (!existsSync6(dir)) mkdirSync3(dir, { recursive: true });
-  writeFileSync4(join9(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
+  if (!existsSync7(dir)) mkdirSync3(dir, { recursive: true });
+  writeFileSync4(join10(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
 }
 function loadProjectConfig(name) {
-  const path = join9(projectsDir(), `${name}.json`);
-  if (!existsSync6(path)) return null;
+  const path = join10(projectsDir(), `${name}.json`);
+  if (!existsSync7(path)) return null;
   try {
     const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync5(path, "utf8")));
     return result.success ? result.data : null;
@@ -2455,15 +2548,15 @@ function loadProjectConfig(name) {
   }
 }
 function deleteProjectConfig(name) {
-  const path = join9(projectsDir(), `${name}.json`);
-  if (existsSync6(path)) rmSync4(path);
+  const path = join10(projectsDir(), `${name}.json`);
+  if (existsSync7(path)) rmSync4(path);
 }
 function listProjectConfigs() {
   const dir = projectsDir();
-  if (!existsSync6(dir)) return [];
+  if (!existsSync7(dir)) return [];
   return readdirSync3(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
     try {
-      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync5(join9(dir, f), "utf8")));
+      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync5(join10(dir, f), "utf8")));
       return result.success ? [result.data] : [];
     } catch {
       return [];
@@ -2552,7 +2645,7 @@ async function resolveConfig(options) {
     return cfg;
   }
   const localConfigPath = resolve4(process.cwd(), "biffo.config.json");
-  if (existsSync7(localConfigPath)) {
+  if (existsSync8(localConfigPath)) {
     const raw = JSON.parse(readFileSync6(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
@@ -2599,8 +2692,8 @@ async function resolveConfig(options) {
 
 // src/commands/data-import.ts
 import { execSync as execSync3 } from "child_process";
-import { cpSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
-import { join as join10, resolve as resolve5 } from "path";
+import { cpSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { join as join11, resolve as resolve5 } from "path";
 import chalk6 from "chalk";
 import { Command as Command6 } from "commander";
 import inquirer2 from "inquirer";
@@ -2640,23 +2733,23 @@ async function runDataImport(name, options, deps) {
       `Invalid import name '${name}'. Use lowercase letters, numbers, and hyphens, starting with a letter.`
     );
   }
-  const servicesDir = join10(options.cwd, "services");
-  if (!existsSync8(servicesDir)) {
+  const servicesDir = join11(options.cwd, "services");
+  if (!existsSync9(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join10(options.cwd, "db", "imports", name);
-  if (existsSync8(targetDir)) {
+  const targetDir = join11(options.cwd, "db", "imports", name);
+  if (existsSync9(targetDir)) {
     throw new Error(
       `DDL import '${name}' is already present at db/imports/${name}/. Remove it first to re-import.`
     );
   }
-  const isLocalDir = existsSync8(options.source) && statSync2(options.source).isDirectory();
+  const isLocalDir = existsSync9(options.source) && statSync2(options.source).isDirectory();
   let sourceDir;
   let cleanupClone = null;
   if (isLocalDir) {
-    sourceDir = options.path ? join10(options.source, options.path) : options.source;
+    sourceDir = options.path ? join11(options.source, options.path) : options.source;
   } else {
     const token = options.token ?? await resolveDdlImportToken();
     log.info(`Cloning ${options.source}...`);
@@ -2664,10 +2757,10 @@ async function runDataImport(name, options, deps) {
     cleanupClone = () => {
       deps.git.cleanup(tmpDir);
     };
-    sourceDir = options.path ? join10(tmpDir, options.path) : tmpDir;
+    sourceDir = options.path ? join11(tmpDir, options.path) : tmpDir;
   }
   try {
-    if (!existsSync8(sourceDir)) {
+    if (!existsSync9(sourceDir)) {
       throw new Error(`Source directory does not exist: ${sourceDir}`);
     }
     const sqlFiles = readdirSync4(sourceDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name).sort();
@@ -2692,7 +2785,7 @@ async function runDataImport(name, options, deps) {
     }
     mkdirSync4(targetDir, { recursive: true });
     for (const file of sqlFiles) {
-      cpSync(join10(sourceDir, file), join10(targetDir, file));
+      cpSync(join11(sourceDir, file), join11(targetDir, file));
     }
     log.success(`Imported ${String(sqlFiles.length)} .sql file(s) to db/imports/${name}/`);
     const commitMessage = `feat(data): import ${name} (${String(sqlFiles.length)} SQL file(s))`;
@@ -2744,8 +2837,8 @@ function printDryRun(name, sqlFiles) {
 }
 
 // src/commands/data-list.ts
-import { existsSync as existsSync9, readdirSync as readdirSync5 } from "fs";
-import { join as join11, resolve as resolve6 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync5 } from "fs";
+import { join as join12, resolve as resolve6 } from "path";
 import chalk7 from "chalk";
 import { Command as Command7 } from "commander";
 var dataListCommand = new Command7("list").description("List DDL imports vendored in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -2758,15 +2851,15 @@ var dataListCommand = new Command7("list").description("List DDL imports vendore
   }
 });
 async function runDataList(options) {
-  const importsDir = join11(options.cwd, "db", "imports");
-  if (!existsSync9(importsDir)) {
+  const importsDir = join12(options.cwd, "db", "imports");
+  if (!existsSync10(importsDir)) {
     console.log(chalk7.dim("\n  No DDL imports in this checkout.\n"));
     return;
   }
   const candidates = readdirSync5(importsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
   const imports = [];
   for (const name of candidates) {
-    const fileCount = readdirSync5(join11(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
+    const fileCount = readdirSync5(join12(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
     if (fileCount > 0) imports.push({ name, fileCount });
   }
   if (imports.length === 0) {
@@ -2796,7 +2889,7 @@ dataCommand.addCommand(dataListCommand);
 
 // src/commands/deploy.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
 import { resolve as resolve7 } from "path";
 import chalk8 from "chalk";
 import { Command as Command9 } from "commander";
@@ -3170,7 +3263,7 @@ async function resolveConfig2(options) {
     return cfg;
   }
   const localConfigPath = resolve7(process.cwd(), "biffo.config.json");
-  if (existsSync10(localConfigPath)) {
+  if (existsSync11(localConfigPath)) {
     const raw = JSON.parse(readFileSync7(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
@@ -3722,8 +3815,8 @@ import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
-import { existsSync as existsSync11, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
-import { dirname as dirname5, join as join12, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
+import { dirname as dirname5, join as join13, relative as relative2, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SKIP_ENV_VAR = "BIFFO_SKIP_BUILD_FRESHNESS_CHECK";
 function checkBuildFreshness(options = {}) {
@@ -3737,7 +3830,7 @@ function checkBuildFreshness(options = {}) {
   if (!packageRoot) {
     return { status: "skipped", reason: `no package.json above ${moduleDir}`, newerSources: [] };
   }
-  const distDir = join12(packageRoot, "dist");
+  const distDir = join13(packageRoot, "dist");
   if (!isInside(distDir, moduleDir)) {
     return {
       status: "skipped",
@@ -3745,16 +3838,16 @@ function checkBuildFreshness(options = {}) {
       newerSources: []
     };
   }
-  const srcDir = join12(packageRoot, "src");
-  if (!existsSync11(srcDir)) {
+  const srcDir = join13(packageRoot, "src");
+  if (!existsSync12(srcDir)) {
     return {
       status: "skipped",
       reason: "no src/ alongside dist/ \u2014 this is a shipped package",
       newerSources: []
     };
   }
-  const entry = join12(distDir, "index.js");
-  if (!existsSync11(entry)) {
+  const entry = join13(distDir, "index.js");
+  if (!existsSync12(entry)) {
     return { status: "skipped", reason: `${entry} not found`, newerSources: [] };
   }
   const builtAt = statSync3(entry).mtimeMs;
@@ -3798,7 +3891,7 @@ function collectSourceFiles(srcDir) {
   const found = [];
   const walk = (dir) => {
     for (const entry of readdirSync6(dir, { withFileTypes: true })) {
-      const full = join12(dir, entry.name);
+      const full = join13(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules") continue;
         walk(full);
@@ -3817,7 +3910,7 @@ function collectSourceFiles(srcDir) {
 function findPackageRoot(from) {
   let dir = from;
   for (; ; ) {
-    if (existsSync11(join12(dir, "package.json"))) return dir;
+    if (existsSync12(join13(dir, "package.json"))) return dir;
     const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -3831,9 +3924,9 @@ function isInside(parent, child) {
 
 // src/lib/credentials.ts
 import { execSync as execSync6 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand2, STSClient as STSClient2 } from "@aws-sdk/client-sts";
 import chalk10 from "chalk";
 import inquirer4 from "inquirer";
@@ -4012,10 +4105,10 @@ async function verifySelectedAwsCredentials(profile, region) {
   return sts.send(new GetCallerIdentityCommand2({}));
 }
 function discoverAwsProfiles() {
-  const files = [join13(homedir2(), ".aws", "credentials"), join13(homedir2(), ".aws", "config")];
+  const files = [join14(homedir2(), ".aws", "credentials"), join14(homedir2(), ".aws", "config")];
   const profiles = /* @__PURE__ */ new Set();
   for (const file of files) {
-    if (!existsSync12(file)) continue;
+    if (!existsSync13(file)) continue;
     const content = readFileSync9(file, "utf8");
     for (const match of content.matchAll(/^\s*\[([^\]]+)\]\s*$/gm)) {
       const section = match[1]?.trim();
@@ -4106,7 +4199,7 @@ var SiblingConfigSchema = z4.object({
 
 // src/lib/sibling-session.ts
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync7,
   readFileSync as readFileSync10,
@@ -4115,16 +4208,16 @@ import {
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function sessionsDir2() {
-  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join14(homedir3(), ".biffo", "sibling-sessions");
+  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join15(homedir3(), ".biffo", "sibling-sessions");
 }
 function sessionPath2(projectName) {
-  return join14(sessionsDir2(), `${projectName}.json`);
+  return join15(sessionsDir2(), `${projectName}.json`);
 }
 function loadSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (!existsSync13(path)) return null;
+  if (!existsSync14(path)) return null;
   try {
     return JSON.parse(readFileSync10(path, "utf8"));
   } catch {
@@ -4133,7 +4226,7 @@ function loadSiblingSession(projectName) {
 }
 function saveSiblingSession(session) {
   const dir = sessionsDir2();
-  if (!existsSync13(dir)) mkdirSync5(dir, { recursive: true });
+  if (!existsSync14(dir)) mkdirSync5(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSiblingSession(name);
   if (prior) {
@@ -4155,30 +4248,30 @@ function markSiblingStepComplete(session, step) {
 }
 function deleteSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (existsSync13(path)) rmSync5(path);
+  if (existsSync14(path)) rmSync5(path);
 }
 
 // src/commands/sibling-create.ts
-import { cpSync as cpSync2, existsSync as existsSync14, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync15, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname6, join as join16, resolve as resolve9 } from "path";
+import { dirname as dirname6, join as join17, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import chalk11 from "chalk";
 import { Command as Command11 } from "commander";
 
 // src/lib/skeleton-dotfiles.ts
 import { readdirSync as readdirSync8, renameSync } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var PACKAGED_GITIGNORE = "_gitignore";
 var REAL_GITIGNORE = ".gitignore";
 function restorePackagedDotfiles(dir) {
   const restored = [];
   for (const entry of readdirSync8(dir, { withFileTypes: true })) {
-    const full = join15(dir, entry.name);
+    const full = join16(dir, entry.name);
     if (entry.isDirectory()) {
       restored.push(...restorePackagedDotfiles(full));
     } else if (entry.name === PACKAGED_GITIGNORE) {
-      const target = join15(dir, REAL_GITIGNORE);
+      const target = join16(dir, REAL_GITIGNORE);
       renameSync(full, target);
       restored.push(target);
     }
@@ -4223,7 +4316,7 @@ async function runSiblingCreateCommand(name, options) {
     printDryRun2(config, coreConfig, options.templateRoot);
     return;
   }
-  if (!existsSync14(options.templateRoot)) {
+  if (!existsSync15(options.templateRoot)) {
     throw new Error(`Sibling template not found at ${options.templateRoot}`);
   }
   let session = null;
@@ -4481,7 +4574,7 @@ async function resolveCoreIdentity(coreAws, coreConfig, environments) {
   return coreIdentity;
 }
 async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
-  const workDir = mkdtempSync4(join16(tmpdir4(), `biffo-sibling-${config.project.name}-`));
+  const workDir = mkdtempSync4(join17(tmpdir4(), `biffo-sibling-${config.project.name}-`));
   try {
     writeSiblingTemplate(skeletonRoot, workDir, config, {
       coreProjectName: coreConfig.project.name,
@@ -4497,13 +4590,13 @@ async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, git
   }
 }
 function writeSiblingTemplate(templateRoot, targetDir, config, context) {
-  if (!existsSync14(templateRoot)) {
+  if (!existsSync15(templateRoot)) {
     throw new Error(`Sibling template not found at ${templateRoot}`);
   }
   cpSync2(templateRoot, targetDir, { recursive: true });
   restorePackagedDotfiles(targetDir);
   writeFileSync6(
-    join16(targetDir, "biffo.sibling.json"),
+    join17(targetDir, "biffo.sibling.json"),
     JSON.stringify(
       {
         name: config.project.name,
@@ -4519,7 +4612,7 @@ function writeSiblingTemplate(templateRoot, targetDir, config, context) {
       2
     ) + "\n"
   );
-  const envPath = join16(targetDir, "apps", "frontend", ".env.example");
+  const envPath = join17(targetDir, "apps", "frontend", ".env.example");
   try {
     const path = basePathFor(context.pathPrefix);
     const content = readFileSync11(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
@@ -4575,7 +4668,7 @@ function readExistingSiblingOrigins(filePath) {
   }
 }
 function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
-  const cdnVarsPath = join16(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
+  const cdnVarsPath = join17(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
   let declaresSiblingOrigins = false;
   try {
     declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync11(cdnVarsPath, "utf8"));
@@ -4588,7 +4681,7 @@ function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x")
     );
   }
   if (!isRootPathPrefix(pathPrefix)) return;
-  const cdnMainPath = join16(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
+  const cdnMainPath = join17(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
   let supportsRoot = false;
   try {
     supportsRoot = /root_sibling_registered/.test(readFileSync11(cdnMainPath, "utf8"));
@@ -4621,8 +4714,8 @@ async function registerWithCore(git, github, config, coreConfig, pathPrefix, git
     for (const env of config.environments) {
       const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
       const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
-      const relativePath = join16("infra", "environments", env, "siblings.auto.tfvars.json");
-      const filePath = join16(cloneDir, relativePath);
+      const relativePath = join17("infra", "environments", env, "siblings.auto.tfvars.json");
+      const filePath = join17(cloneDir, relativePath);
       const existing = readExistingSiblingOrigins(filePath);
       const siblings = upsertSiblingOrigin(existing.sibling_origins ?? [], {
         name,
@@ -4702,8 +4795,8 @@ function defaultSiblingTemplateRoot() {
   const start = dirname6(fileURLToPath4(import.meta.url));
   let dir = start;
   for (; ; ) {
-    const candidate = join16(dir, "_skeletons", "sibling-template");
-    if (existsSync14(candidate)) return candidate;
+    const candidate = join17(dir, "_skeletons", "sibling-template");
+    if (existsSync15(candidate)) return candidate;
     const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
@@ -5160,28 +5253,28 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 import { Command as Command20 } from "commander";
 
 // src/commands/plugin-create.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "fs";
-import { dirname as dirname8, join as join19, resolve as resolve11 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
+import { dirname as dirname8, join as join20, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
 
 // src/lib/plugin-locations.ts
-import { existsSync as existsSync15, readdirSync as readdirSync9 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync9 } from "fs";
+import { join as join18 } from "path";
 var FIRST_PARTY_PLUGINS_DIR = "_plugins";
 var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
 function pluginDir(name, channel) {
   return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
 }
 function scanDir(absDir, relDir, channel) {
-  if (!existsSync15(absDir)) return [];
+  if (!existsSync16(absDir)) return [];
   const found = [];
   for (const entry of readdirSync9(absDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
-    const manifestPath = join17(absDir, entry.name, PLUGIN_MANIFEST_FILE);
-    if (!existsSync15(manifestPath)) continue;
+    const manifestPath = join18(absDir, entry.name, PLUGIN_MANIFEST_FILE);
+    if (!existsSync16(manifestPath)) continue;
     found.push({
       dirName: entry.name,
       relDir: `${relDir}/${entry.name}`,
@@ -5192,11 +5285,11 @@ function scanDir(absDir, relDir, channel) {
   return found;
 }
 function findInstalledPlugins(cwd) {
-  const servicesDir = join17(cwd, "services");
+  const servicesDir = join18(cwd, "services");
   return [
     ...scanDir(servicesDir, "services", "third-party"),
     ...scanDir(
-      join17(servicesDir, FIRST_PARTY_PLUGINS_DIR),
+      join18(servicesDir, FIRST_PARTY_PLUGINS_DIR),
       `services/${FIRST_PARTY_PLUGINS_DIR}`,
       "first-party"
     )
@@ -5356,13 +5449,13 @@ function validateManifest(raw) {
 // src/lib/plugin-scaffold.ts
 import {
   copyFileSync,
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync13,
   readdirSync as readdirSync10,
   writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname7, join as join18 } from "path";
+import { dirname as dirname7, join as join19 } from "path";
 var STANDALONE_ONLY_ENTRIES = {
   ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
   "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
@@ -5415,10 +5508,10 @@ function applySubstitutions(text, names) {
 }
 var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
 function scaffoldPlugin(skeletonRoot, destDir, names) {
-  if (!existsSync16(skeletonRoot)) {
+  if (!existsSync17(skeletonRoot)) {
     throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
   }
-  if (!existsSync16(join18(skeletonRoot, "terraform"))) {
+  if (!existsSync17(join19(skeletonRoot, "terraform"))) {
     throw new Error(
       `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
     );
@@ -5426,7 +5519,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
   const skipped = [];
   const files = [];
   const walk = (relDir) => {
-    const absDir = join18(skeletonRoot, relDir);
+    const absDir = join19(skeletonRoot, relDir);
     for (const entry of readdirSync10(absDir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     )) {
@@ -5441,14 +5534,14 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
         continue;
       }
       const destRel = applySubstitutions(relPath, names);
-      const destPath = join18(destDir, destRel);
+      const destPath = join19(destDir, destRel);
       mkdirSync7(dirname7(destPath), { recursive: true });
       if (BINARY_EXTENSIONS.test(entry.name)) {
-        copyFileSync(join18(skeletonRoot, relPath), destPath);
+        copyFileSync(join19(skeletonRoot, relPath), destPath);
       } else {
         writeFileSync7(
           destPath,
-          applySubstitutions(readFileSync13(join18(skeletonRoot, relPath), "utf8"), names)
+          applySubstitutions(readFileSync13(join19(skeletonRoot, relPath), "utf8"), names)
         );
       }
       files.push(destRel);
@@ -5465,8 +5558,8 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
 function findSkeletonRoot(startDir, skeleton) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join18(dir, "_skeletons", skeleton);
-    if (existsSync16(candidate)) return candidate;
+    const candidate = join19(dir, "_skeletons", skeleton);
+    if (existsSync17(candidate)) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -5503,7 +5596,7 @@ var pluginCreateCommand = new Command13("create").description("Scaffold a new pl
 );
 async function runPluginCreate(name, options, deps) {
   const names = deriveNames(name);
-  const isInstance = existsSync17(join19(options.cwd, INSTANCE_CORE_FILE));
+  const isInstance = existsSync18(join20(options.cwd, INSTANCE_CORE_FILE));
   if (options.firstParty && isInstance) {
     throw new Error(
       `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
@@ -5511,19 +5604,19 @@ async function runPluginCreate(name, options, deps) {
   }
   const channel = options.firstParty ? "first-party" : "third-party";
   const relDir = pluginDir(names.slug, channel);
-  const destDir = join19(options.cwd, relDir);
-  const servicesDir = join19(options.cwd, "services");
-  if (!existsSync17(servicesDir)) {
+  const destDir = join20(options.cwd, relDir);
+  const servicesDir = join20(options.cwd, "services");
+  if (!existsSync18(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  if (existsSync17(destDir)) {
+  if (existsSync18(destDir)) {
     throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
   }
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join19(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync17(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join20(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync18(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -5538,7 +5631,7 @@ async function runPluginCreate(name, options, deps) {
   for (const { entry, reason } of skipped) {
     log.info(`Skipped ${entry} \u2014 ${reason}`);
   }
-  const manifestPath = join19(destDir, "biffo.plugin.json");
+  const manifestPath = join20(destDir, "biffo.plugin.json");
   const manifest = validateManifest(JSON.parse(readFileSync14(manifestPath, "utf8")));
   if (manifest.name !== names.slug) {
     throw new Error(
@@ -5729,14 +5822,14 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync3, existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync16, statSync as statSync5 } from "fs";
-import { basename, join as join22, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync16, statSync as statSync5 } from "fs";
+import { basename, join as join23, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
-import { execa as execa3 } from "execa";
-import { join as join20 } from "path";
+import { execa as execa4 } from "execa";
+import { join as join21 } from "path";
 var PluginMigrationsAdapter = class {
   /**
    * Generates migration file(s) for `pluginNames` (every discovered
@@ -5745,22 +5838,22 @@ var PluginMigrationsAdapter = class {
    * or declared no tables.
    */
   async generate(cwd, pluginNames) {
-    const scriptPath = join20(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
+    const scriptPath = join21(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
     const args = [
       "run",
       "python",
       scriptPath,
       "--services-root",
-      join20(cwd, "services"),
+      join21(cwd, "services"),
       "--versions-dir",
-      join20(cwd, "services", "api", "migrations", "versions")
+      join21(cwd, "services", "api", "migrations", "versions")
     ];
     for (const name of pluginNames ?? []) {
       args.push("--plugin", name);
     }
     let result;
     try {
-      result = await execa3("uv", args, { cwd: join20(cwd, "services", "api") });
+      result = await execa4("uv", args, { cwd: join21(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -5777,8 +5870,8 @@ var PluginMigrationsAdapter = class {
 };
 
 // src/lib/plugin-terraform-wiring.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync8, readFileSync as readFileSync15, readdirSync as readdirSync11, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync8, readFileSync as readFileSync15, readdirSync as readdirSync11, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
+import { join as join22 } from "path";
 var TEMPLATE_MODULE_DIR = "_template";
 var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
 var GENERATED_TF_FILE = "plugins.generated.tf";
@@ -5796,7 +5889,7 @@ function standardArguments(pluginName, handler) {
   ];
 }
 function listPluginModules(cwd) {
-  const dir = join21(cwd, "modules", "plugins");
+  const dir = join22(cwd, "modules", "plugins");
   let entries;
   try {
     entries = readdirSync11(dir, { withFileTypes: true });
@@ -5806,7 +5899,7 @@ function listPluginModules(cwd) {
   return entries.filter((e) => e.isDirectory() && e.name !== TEMPLATE_MODULE_DIR && !e.name.startsWith(".")).map((e) => e.name).sort();
 }
 function listEnvironments(cwd) {
-  const dir = join21(cwd, "infra", "environments");
+  const dir = join22(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync11(dir, { withFileTypes: true });
@@ -5814,12 +5907,12 @@ function listEnvironments(cwd) {
     return [];
   }
   return entries.filter((e) => {
-    if (!e.isDirectory() || !existsSync18(join21(dir, e.name, "main.tf"))) return false;
-    return declaredVariables(join21(dir, e.name)).has("enabled_plugins");
+    if (!e.isDirectory() || !existsSync19(join22(dir, e.name, "main.tf"))) return false;
+    return declaredVariables(join22(dir, e.name)).has("enabled_plugins");
   }).map((e) => e.name).sort();
 }
 function listUnwirableEnvironments(cwd) {
-  const dir = join21(cwd, "infra", "environments");
+  const dir = join22(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync11(dir, { withFileTypes: true });
@@ -5827,7 +5920,7 @@ function listUnwirableEnvironments(cwd) {
     return [];
   }
   return entries.filter(
-    (e) => e.isDirectory() && existsSync18(join21(dir, e.name, "main.tf")) && !declaredVariables(join21(dir, e.name)).has("enabled_plugins")
+    (e) => e.isDirectory() && existsSync19(join22(dir, e.name, "main.tf")) && !declaredVariables(join22(dir, e.name)).has("enabled_plugins")
   ).map((e) => e.name).sort();
 }
 function declaredVariables(moduleDir) {
@@ -5842,7 +5935,7 @@ function declaredVariables(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync15(join21(moduleDir, entry.name), "utf8");
+      contents = readFileSync15(join22(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -5914,19 +6007,19 @@ function syncPluginTerraform(cwd) {
   const changedPaths = [];
   const rendered = plugins.map((name) => ({
     name,
-    declaredVariables: declaredVariables(join21(cwd, "modules", "plugins", name))
+    declaredVariables: declaredVariables(join22(cwd, "modules", "plugins", name))
   }));
   for (const env of environments) {
-    const envDir = join21(cwd, "infra", "environments", env);
-    const tfPath = join21(envDir, GENERATED_TF_FILE);
-    const tfvarsPath = join21(envDir, GENERATED_TFVARS_FILE);
+    const envDir = join22(cwd, "infra", "environments", env);
+    const tfPath = join22(envDir, GENERATED_TF_FILE);
+    const tfvarsPath = join22(envDir, GENERATED_TFVARS_FILE);
     const relBase = `infra/environments/${env}`;
     if (plugins.length === 0) {
       for (const [abs, rel] of [
         [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
         [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
       ]) {
-        if (existsSync18(abs)) {
+        if (existsSync19(abs)) {
           rmSync6(abs);
           changedPaths.push(rel);
         }
@@ -5983,14 +6076,14 @@ var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".terraform"
 ]);
 function resolveLocalPlugin(localPath) {
-  if (!existsSync19(localPath)) {
+  if (!existsSync20(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync5(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join22(localPath, "biffo.plugin.json");
-  if (!existsSync19(manifestPath)) {
+  const manifestPath = join23(localPath, "biffo.plugin.json");
+  if (!existsSync20(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -6016,8 +6109,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join22(tmpDir, "biffo.plugin.json");
-    if (!existsSync19(manifestPath)) {
+    const manifestPath = join23(tmpDir, "biffo.plugin.json");
+    if (!existsSync20(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -6045,8 +6138,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join22(options.cwd, "services");
-  if (!existsSync19(servicesDir)) {
+  const servicesDir = join23(options.cwd, "services");
+  if (!existsSync20(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -6064,10 +6157,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join22(options.cwd, relTargetDir);
-  const modulesDir = join22(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join23(options.cwd, relTargetDir);
+  const modulesDir = join23(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync19(targetDir) && !inTreeSource) {
+  if (existsSync20(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -6110,8 +6203,8 @@ async function runPluginInstall(target, options, deps) {
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join22(targetDir, "terraform");
-    if (existsSync19(tfSourceDir)) {
+    const tfSourceDir = join23(targetDir, "terraform");
+    if (existsSync20(tfSourceDir)) {
       mkdirSync9(modulesDir, { recursive: true });
       cpSync3(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
@@ -6205,8 +6298,8 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync20, readFileSync as readFileSync17 } from "fs";
-import { join as join23, resolve as resolve13 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync17 } from "fs";
+import { join as join24, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -6219,8 +6312,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join23(options.cwd, "services");
-  if (!existsSync20(servicesDir)) {
+  const servicesDir = join24(options.cwd, "services");
+  if (!existsSync21(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -6265,8 +6358,8 @@ async function runPluginList(options) {
 }
 
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync21 } from "fs";
-import { join as join24, relative as relative4, resolve as resolve14 } from "path";
+import { existsSync as existsSync22 } from "fs";
+import { join as join25, relative as relative4, resolve as resolve14 } from "path";
 import chalk17 from "chalk";
 import { Command as Command17 } from "commander";
 var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
@@ -6287,11 +6380,11 @@ var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join24(options.cwd, "services");
-  if (!existsSync21(servicesDir)) {
+  const servicesDir = join25(options.cwd, "services");
+  if (!existsSync22(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync21(join24(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync22(join25(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -6327,8 +6420,8 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync22, readFileSync as readFileSync18, rmSync as rmSync7 } from "fs";
-import { join as join25, resolve as resolve15 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync18, rmSync as rmSync7 } from "fs";
+import { join as join26, resolve as resolve15 } from "path";
 import chalk18 from "chalk";
 import { Command as Command18 } from "commander";
 import inquirer6 from "inquirer";
@@ -6360,16 +6453,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join25(options.cwd, "services");
-  if (!existsSync22(servicesDir)) {
+  const servicesDir = join26(options.cwd, "services");
+  if (!existsSync23(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join25(servicesDir, name);
-  if (!existsSync22(targetDir)) {
-    const firstParty = join25(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync22(firstParty)) {
+  const targetDir = join26(servicesDir, name);
+  if (!existsSync23(targetDir)) {
+    const firstParty = join26(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync23(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -6377,9 +6470,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join25(options.cwd, "modules", "plugins", name);
+  const modulesDir = join26(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync22(modulesDir)) {
+  if (existsSync23(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -6401,7 +6494,7 @@ async function runPluginUninstall(name, options, deps) {
   }
   rmSync7(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync22(modulesDir)) {
+  if (existsSync23(modulesDir)) {
     rmSync7(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
@@ -6438,8 +6531,8 @@ async function runPluginUninstall(name, options, deps) {
   }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join25(targetDir, "biffo.plugin.json");
-  if (!existsSync22(manifestPath)) return void 0;
+  const manifestPath = join26(targetDir, "biffo.plugin.json");
+  if (!existsSync23(manifestPath)) return void 0;
   try {
     return validateManifest(JSON.parse(readFileSync18(manifestPath, "utf8"))).version;
   } catch {
@@ -6474,8 +6567,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync4, existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync19, rmSync as rmSync8 } from "fs";
-import { join as join26, relative as relative5, resolve as resolve16 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync24, mkdirSync as mkdirSync10, readFileSync as readFileSync19, rmSync as rmSync8 } from "fs";
+import { join as join27, relative as relative5, resolve as resolve16 } from "path";
 import chalk19 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer7 from "inquirer";
@@ -6500,14 +6593,14 @@ var pluginUpgradeCommand = new Command19("upgrade").description(
 });
 async function runPluginUpgrade(target, options, deps) {
   const { name, minor } = parsePluginTarget(target);
-  const servicesDir = join26(options.cwd, "services");
-  if (!existsSync23(servicesDir)) {
+  const servicesDir = join27(options.cwd, "services");
+  if (!existsSync24(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join26(servicesDir, name);
-  if (!existsSync23(targetDir)) {
+  const targetDir = join27(servicesDir, name);
+  if (!existsSync24(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -6521,7 +6614,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join26(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join27(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -6554,11 +6647,11 @@ async function runPluginUpgrade(target, options, deps) {
     cpSync4(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync23(modulesDir)) {
+    if (existsSync24(modulesDir)) {
       rmSync8(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join26(targetDir, "terraform");
-    if (existsSync23(tfSourceDir)) {
+    const tfSourceDir = join27(targetDir, "terraform");
+    if (existsSync24(tfSourceDir)) {
       mkdirSync10(modulesDir, { recursive: true });
       cpSync4(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
@@ -6592,8 +6685,8 @@ async function runPluginUpgrade(target, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join26(targetDir, "biffo.plugin.json");
-  if (!existsSync23(manifestPath)) return void 0;
+  const manifestPath = join27(targetDir, "biffo.plugin.json");
+  if (!existsSync24(manifestPath)) return void 0;
   try {
     return validateManifest(JSON.parse(readFileSync19(manifestPath, "utf8"))).version;
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.50.1",
+  "version": "0.50.3",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",