@biffo/cli 0.53.0 → 0.54.0

package/core.version

@@ -1 +1 @@
-0.53.0
+0.54.0

package/dist/index.js

@@ -337,7 +337,7 @@ async function runCoreStatus(options) {
 
 // src/commands/core-upgrade.ts
 import { execSync as execSync2 } from "child_process";
-import { join as join9, resolve as resolve3 } from "path";
+import { join as join10, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
 import { execa as execa3 } from "execa";
 import { Command as Command3 } from "commander";
@@ -1634,9 +1634,211 @@ var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
   ".github/workflows/deploy-global.yml"
 ];
 
-// src/lib/lockfile-refresh.ts
-import { existsSync as existsSync6 } from "fs";
+// src/lib/plugin-terraform-wiring.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
 import { join as join8 } from "path";
+var TEMPLATE_MODULE_DIR = "_template";
+var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
+var GENERATED_TF_FILE = "plugins.generated.tf";
+var GENERATED_TFVARS_FILE = "plugins.auto.tfvars.json";
+function standardArguments(pluginName, handler) {
+  return [
+    ["project_name", "var.project_name"],
+    ["environment", "local.environment"],
+    ["plugin_name", JSON.stringify(pluginName)],
+    ["handler", JSON.stringify(handler)],
+    ["event_bus_name", "module.events.event_bus_name"],
+    ["core_api_url", "module.api_gateway.api_endpoint"],
+    ["core_api_execution_arn", "module.api_gateway.execution_arn"],
+    ["tags", "local.tags"]
+  ];
+}
+function listPluginModules(cwd) {
+  const dir = join8(cwd, "modules", "plugins");
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isDirectory() && e.name !== TEMPLATE_MODULE_DIR && !e.name.startsWith(".")).map((e) => e.name).sort();
+}
+var FIRST_PARTY_TERRAFORM = (name) => `../../../services/_plugins/${name}/terraform`;
+var THIRD_PARTY_TERRAFORM = (name) => `../../../modules/plugins/${name}`;
+function isFirstPartyPlugin(cwd, name) {
+  return existsSync6(join8(cwd, "services", "_plugins", name, "terraform", "main.tf"));
+}
+function pluginModuleSource(cwd, name) {
+  return isFirstPartyPlugin(cwd, name) ? FIRST_PARTY_TERRAFORM(name) : THIRD_PARTY_TERRAFORM(name);
+}
+function listWireablePlugins(cwd) {
+  const copied = listPluginModules(cwd);
+  const firstParty = firstPartyPluginNames(cwd);
+  return [.../* @__PURE__ */ new Set([...copied, ...firstParty])].sort();
+}
+function firstPartyPluginNames(cwd) {
+  const dir = join8(cwd, "services", "_plugins");
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") && isFirstPartyPlugin(cwd, e.name)).map((e) => e.name).sort();
+}
+function staleFirstPartyCopies(cwd) {
+  const copied = new Set(listPluginModules(cwd));
+  return firstPartyPluginNames(cwd).filter((name) => copied.has(name));
+}
+function listEnvironments(cwd) {
+  const dir = join8(cwd, "infra", "environments");
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => {
+    if (!e.isDirectory() || !existsSync6(join8(dir, e.name, "main.tf"))) return false;
+    return declaredVariables(join8(dir, e.name)).has("enabled_plugins");
+  }).map((e) => e.name).sort();
+}
+function listUnwirableEnvironments(cwd) {
+  const dir = join8(cwd, "infra", "environments");
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter(
+    (e) => e.isDirectory() && existsSync6(join8(dir, e.name, "main.tf")) && !declaredVariables(join8(dir, e.name)).has("enabled_plugins")
+  ).map((e) => e.name).sort();
+}
+function declaredVariables(moduleDir) {
+  const names = /* @__PURE__ */ new Set();
+  let entries;
+  try {
+    entries = readdirSync3(moduleDir, { withFileTypes: true });
+  } catch {
+    return names;
+  }
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
+    let contents;
+    try {
+      contents = readFileSync5(join8(moduleDir, entry.name), "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of contents.matchAll(/^\s*variable\s+"([^"]+)"/gm)) {
+      names.add(match[1]);
+    }
+  }
+  return names;
+}
+function renderArguments(args, indent) {
+  const width = Math.max(...args.map(([key]) => key.length));
+  return args.map(([key, value]) => `${indent}${key.padEnd(width)} = ${value}`).join("\n");
+}
+function renderModuleBlock(pluginName, declared, handler, source) {
+  const args = standardArguments(pluginName, handler).filter(([key]) => declared.has(key));
+  const quoted = JSON.stringify(pluginName);
+  return [
+    `module "plugin_${pluginName}" {`,
+    `  source   = "${source}"`,
+    `  for_each = contains(var.enabled_plugins, ${quoted}) ? { ${quoted} = true } : {}`,
+    "",
+    renderArguments(args, "  "),
+    "}",
+    "",
+    `output "plugin_${pluginName}_function_arn" {`,
+    `  description = "Lambda ARN of the ${pluginName} plugin, or null when it is not in enabled_plugins."`,
+    `  value       = try(module.plugin_${pluginName}[${quoted}].function_arn, null)`,
+    "}"
+  ].join("\n");
+}
+var GENERATED_HEADER = `# ---------------------------------------------------------------------------
+# GENERATED FILE \u2014 DO NOT EDIT BY HAND.
+#
+# Written by \`biffo plugin install\` / \`biffo plugin uninstall\` (issue #201),
+# regenerated in full from the contents of modules/plugins/. Any manual edit is
+# lost on the next plugin install or uninstall.
+#
+# Terraform loads every *.tf file in this directory, so these blocks are as
+# live as anything in main.tf \u2014 they simply live in a CLI-owned file so the
+# CLI never has to rewrite your hand-authored main.tf.
+#
+# Terraform requires a module's \`source\` to be a static string literal, so it
+# cannot loop over var.enabled_plugins; hence one explicit block per plugin,
+# each gated on membership in enabled_plugins (supplied by the generated
+# ${GENERATED_TFVARS_FILE} alongside this file).
+#
+# Not generated here: the Core API's BIFFO_SERVICE_PRINCIPAL_ARN_ALLOWLIST
+# (ADR-0009). It lives in main.tf and is derived from var.enabled_plugins as a
+# static role-name glob \u2014 deriving it from a plugin module's role_arn output
+# would create the cycle core_api -> api_gateway -> plugin -> core_api.
+# ---------------------------------------------------------------------------
+`;
+function renderGeneratedTerraform(plugins) {
+  const blocks = plugins.map(
+    (p) => renderModuleBlock(
+      p.name,
+      p.declaredVariables,
+      p.handler ?? DEFAULT_PLUGIN_HANDLER,
+      p.source ?? THIRD_PARTY_TERRAFORM(p.name)
+    )
+  );
+  return `${GENERATED_HEADER}
+${blocks.join("\n\n")}
+`;
+}
+function renderGeneratedTfvars(pluginNames) {
+  return `${JSON.stringify({ enabled_plugins: pluginNames }, null, 2)}
+`;
+}
+function syncPluginTerraform(cwd) {
+  const plugins = listWireablePlugins(cwd);
+  const environments = listEnvironments(cwd);
+  const skippedEnvironments = listUnwirableEnvironments(cwd);
+  const changedPaths = [];
+  const rendered = plugins.map((name) => {
+    const firstParty = isFirstPartyPlugin(cwd, name);
+    const moduleDir = firstParty ? join8(cwd, "services", "_plugins", name, "terraform") : join8(cwd, "modules", "plugins", name);
+    return {
+      name,
+      declaredVariables: declaredVariables(moduleDir),
+      source: pluginModuleSource(cwd, name)
+    };
+  });
+  for (const env of environments) {
+    const envDir = join8(cwd, "infra", "environments", env);
+    const tfPath = join8(envDir, GENERATED_TF_FILE);
+    const tfvarsPath = join8(envDir, GENERATED_TFVARS_FILE);
+    const relBase = `infra/environments/${env}`;
+    if (plugins.length === 0) {
+      for (const [abs, rel] of [
+        [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
+        [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
+      ]) {
+        if (existsSync6(abs)) {
+          rmSync4(abs);
+          changedPaths.push(rel);
+        }
+      }
+      continue;
+    }
+    mkdirSync3(envDir, { recursive: true });
+    writeFileSync4(tfPath, renderGeneratedTerraform(rendered));
+    writeFileSync4(tfvarsPath, renderGeneratedTfvars(plugins));
+    changedPaths.push(`${relBase}/${GENERATED_TF_FILE}`, `${relBase}/${GENERATED_TFVARS_FILE}`);
+  }
+  return { plugins, environments, skippedEnvironments, changedPaths };
+}
+
+// src/lib/lockfile-refresh.ts
+import { existsSync as existsSync7 } from "fs";
+import { join as join9 } from "path";
 var LOCKFILE_TRIGGERS = [
   {
     manifest: "package.json",
@@ -1654,7 +1856,7 @@ var LOCKFILE_TRIGGERS = [
 function lockfilesNeedingRefresh(changedPaths, instanceDir, triggers = LOCKFILE_TRIGGERS) {
   return triggers.filter((t) => {
     const touched = changedPaths.some((p) => p === t.manifest || p.endsWith(`/${t.manifest}`));
-    return touched && existsSync6(join8(instanceDir, t.lockfile));
+    return touched && existsSync7(join9(instanceDir, t.lockfile));
   });
 }
 async function refreshLockfiles(instanceDir, triggers, run) {
@@ -1743,9 +1945,9 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   let toVersion;
   if (options.theirsDir) {
     theirsDir = options.theirsDir;
-    toVersion = readCoreVersionFile(join9(theirsDir, "core.version"));
+    toVersion = readCoreVersionFile(join10(theirsDir, "core.version"));
   } else {
-    const workingVersion = readCoreVersionFile(join9(templateRepo, "core.version"));
+    const workingVersion = readCoreVersionFile(join10(templateRepo, "core.version"));
     toVersion = options.toVersion ?? workingVersion;
     if (toVersion === workingVersion) {
       theirsDir = templateRepo;
@@ -1759,7 +1961,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   let fromVersion;
   if (options.baseDir) {
     baseDir = options.baseDir;
-    fromVersion = readCoreVersionFile(join9(baseDir, "core.version"));
+    fromVersion = readCoreVersionFile(join10(baseDir, "core.version"));
   } else {
     if (instanceVersion === null) {
       throw new Error(
@@ -1793,6 +1995,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   }
   printPlan(plan);
   printMigrationCarry(migrations);
+  warnStaleFirstPartyCopies(options.cwd);
   console.log(
     `
   ${chalk4.bold(String(plan.changes.length))} change(s), ${chalk4.bold(String(migrations.entries.length))} new core migration(s), ${plan.conflicts.length > 0 ? chalk4.red(`${plan.conflicts.length} conflict(s)`) : chalk4.green("0 conflicts")}.`
@@ -1991,6 +2194,13 @@ var defaultRunCommand = async (command, cwd) => {
     return { ok: false, error: detail.split("\n")[0] ?? "failed" };
   }
 };
+function warnStaleFirstPartyCopies(cwd) {
+  const stale = staleFirstPartyCopies(cwd);
+  if (stale.length === 0) return;
+  log.warn(
+    `${stale.length} first-party plugin(s) still have a copy under modules/plugins/: ${stale.join(", ")}. An upgrade never updates those copies, so if infra/environments/*/ still sources them, this plugin's infrastructure changes are NOT deployed. Point the module source at services/_plugins/<name>/terraform and delete the copy \u2014 see docs/guides/core-upgrade.md.`
+  );
+}
 
 // src/commands/core.ts
 var coreCommand = new Command4("core").description(
@@ -2004,7 +2214,7 @@ coreCommand.addCommand(coreUpgradeCommand);
 import { Command as Command8 } from "commander";
 
 // src/commands/data-apply.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
 import { resolve as resolve4 } from "path";
 import chalk5 from "chalk";
 import { Command as Command5 } from "commander";
@@ -2455,16 +2665,16 @@ function isTemplatePlaceholderConfig(raw) {
 
 // src/lib/session.ts
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync3,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync5,
-  rmSync as rmSync4,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync6,
+  rmSync as rmSync5,
   statSync,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync5
 } from "fs";
 import { homedir } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var LEGACY_STEP_ALIASES = {
   github_config: ["github_branches", "github_instance_files", "github_settings"]
 };
@@ -2473,39 +2683,39 @@ function hasCompleted(session, step) {
   return session.completedSteps.some((done) => LEGACY_STEP_ALIASES[done]?.includes(step) ?? false);
 }
 function sessionsDir() {
-  return process.env["BIFFO_SESSIONS_DIR"] ?? join10(homedir(), ".biffo", "sessions");
+  return process.env["BIFFO_SESSIONS_DIR"] ?? join11(homedir(), ".biffo", "sessions");
 }
 function sessionPath(projectName) {
-  return join10(sessionsDir(), `${projectName}.json`);
+  return join11(sessionsDir(), `${projectName}.json`);
 }
 function loadSession(projectName) {
   const path = sessionPath(projectName);
-  if (!existsSync7(path)) return null;
+  if (!existsSync8(path)) return null;
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return null;
   }
 }
 function findLatestSession() {
   const dir = sessionsDir();
-  if (!existsSync7(dir)) return null;
-  const files = readdirSync3(dir).filter((f) => f.endsWith(".json"));
+  if (!existsSync8(dir)) return null;
+  const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return null;
   const sorted = files.map((f) => {
-    const fullPath = join10(dir, f);
-    const mtime = existsSync7(fullPath) ? statSync(fullPath).mtimeMs : -1;
+    const fullPath = join11(dir, f);
+    const mtime = existsSync8(fullPath) ? statSync(fullPath).mtimeMs : -1;
     return { f, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   try {
-    return JSON.parse(readFileSync5(join10(dir, sorted[0].f), "utf8"));
+    return JSON.parse(readFileSync6(join11(dir, sorted[0].f), "utf8"));
   } catch {
     return null;
   }
 }
 function saveSession(session) {
   const dir = sessionsDir();
-  if (!existsSync7(dir)) mkdirSync3(dir, { recursive: true });
+  if (!existsSync8(dir)) mkdirSync4(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSession(name);
   if (prior) {
@@ -2514,7 +2724,7 @@ function saveSession(session) {
     }
     session.outputs = { ...prior.outputs, ...definedOnly(session.outputs) };
   }
-  writeFileSync4(sessionPath(name), JSON.stringify(session, null, 2));
+  writeFileSync5(sessionPath(name), JSON.stringify(session, null, 2));
 }
 function definedOnly(value) {
   return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
@@ -2527,36 +2737,36 @@ function markStepComplete(session, step) {
 }
 function deleteSession(projectName) {
   const path = sessionPath(projectName);
-  if (existsSync7(path)) rmSync4(path);
+  if (existsSync8(path)) rmSync5(path);
 }
 function projectsDir() {
-  return process.env["BIFFO_PROJECTS_DIR"] ?? join10(homedir(), ".biffo", "projects");
+  return process.env["BIFFO_PROJECTS_DIR"] ?? join11(homedir(), ".biffo", "projects");
 }
 function saveProjectConfig(config) {
   const dir = projectsDir();
-  if (!existsSync7(dir)) mkdirSync3(dir, { recursive: true });
-  writeFileSync4(join10(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
+  if (!existsSync8(dir)) mkdirSync4(dir, { recursive: true });
+  writeFileSync5(join11(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
 }
 function loadProjectConfig(name) {
-  const path = join10(projectsDir(), `${name}.json`);
-  if (!existsSync7(path)) return null;
+  const path = join11(projectsDir(), `${name}.json`);
+  if (!existsSync8(path)) return null;
   try {
-    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync5(path, "utf8")));
+    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync6(path, "utf8")));
     return result.success ? result.data : null;
   } catch {
     return null;
   }
 }
 function deleteProjectConfig(name) {
-  const path = join10(projectsDir(), `${name}.json`);
-  if (existsSync7(path)) rmSync4(path);
+  const path = join11(projectsDir(), `${name}.json`);
+  if (existsSync8(path)) rmSync5(path);
 }
 function listProjectConfigs() {
   const dir = projectsDir();
-  if (!existsSync7(dir)) return [];
-  return readdirSync3(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
+  if (!existsSync8(dir)) return [];
+  return readdirSync4(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
     try {
-      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync5(join10(dir, f), "utf8")));
+      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync6(join11(dir, f), "utf8")));
       return result.success ? [result.data] : [];
     } catch {
       return [];
@@ -2625,7 +2835,7 @@ async function runDataApply(name, environment, config, aws) {
 }
 async function resolveConfig(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync6(resolve4(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync7(resolve4(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -2645,8 +2855,8 @@ async function resolveConfig(options) {
     return cfg;
   }
   const localConfigPath = resolve4(process.cwd(), "biffo.config.json");
-  if (existsSync8(localConfigPath)) {
-    const raw = JSON.parse(readFileSync6(localConfigPath, "utf8"));
+  if (existsSync9(localConfigPath)) {
+    const raw = JSON.parse(readFileSync7(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -2692,8 +2902,8 @@ async function resolveConfig(options) {
 
 // src/commands/data-import.ts
 import { execSync as execSync3 } from "child_process";
-import { cpSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
-import { join as join11, resolve as resolve5 } from "path";
+import { cpSync, existsSync as existsSync10, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
+import { join as join12, resolve as resolve5 } from "path";
 import chalk6 from "chalk";
 import { Command as Command6 } from "commander";
 import inquirer2 from "inquirer";
@@ -2733,23 +2943,23 @@ async function runDataImport(name, options, deps) {
       `Invalid import name '${name}'. Use lowercase letters, numbers, and hyphens, starting with a letter.`
     );
   }
-  const servicesDir = join11(options.cwd, "services");
-  if (!existsSync9(servicesDir)) {
+  const servicesDir = join12(options.cwd, "services");
+  if (!existsSync10(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join11(options.cwd, "db", "imports", name);
-  if (existsSync9(targetDir)) {
+  const targetDir = join12(options.cwd, "db", "imports", name);
+  if (existsSync10(targetDir)) {
     throw new Error(
       `DDL import '${name}' is already present at db/imports/${name}/. Remove it first to re-import.`
     );
   }
-  const isLocalDir = existsSync9(options.source) && statSync2(options.source).isDirectory();
+  const isLocalDir = existsSync10(options.source) && statSync2(options.source).isDirectory();
   let sourceDir;
   let cleanupClone = null;
   if (isLocalDir) {
-    sourceDir = options.path ? join11(options.source, options.path) : options.source;
+    sourceDir = options.path ? join12(options.source, options.path) : options.source;
   } else {
     const token = options.token ?? await resolveDdlImportToken();
     log.info(`Cloning ${options.source}...`);
@@ -2757,13 +2967,13 @@ async function runDataImport(name, options, deps) {
     cleanupClone = () => {
       deps.git.cleanup(tmpDir);
     };
-    sourceDir = options.path ? join11(tmpDir, options.path) : tmpDir;
+    sourceDir = options.path ? join12(tmpDir, options.path) : tmpDir;
   }
   try {
-    if (!existsSync9(sourceDir)) {
+    if (!existsSync10(sourceDir)) {
       throw new Error(`Source directory does not exist: ${sourceDir}`);
     }
-    const sqlFiles = readdirSync4(sourceDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name).sort();
+    const sqlFiles = readdirSync5(sourceDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name).sort();
     if (sqlFiles.length === 0) {
       throw new Error(`No .sql files found at ${sourceDir}.`);
     }
@@ -2783,9 +2993,9 @@ async function runDataImport(name, options, deps) {
         `${options.cwd} is not a git repository \u2014 biffo data import must be run from a Biffo project checkout.`
       );
     }
-    mkdirSync4(targetDir, { recursive: true });
+    mkdirSync5(targetDir, { recursive: true });
     for (const file of sqlFiles) {
-      cpSync(join11(sourceDir, file), join11(targetDir, file));
+      cpSync(join12(sourceDir, file), join12(targetDir, file));
     }
     log.success(`Imported ${String(sqlFiles.length)} .sql file(s) to db/imports/${name}/`);
     const commitMessage = `feat(data): import ${name} (${String(sqlFiles.length)} SQL file(s))`;
@@ -2837,8 +3047,8 @@ function printDryRun(name, sqlFiles) {
 }
 
 // src/commands/data-list.ts
-import { existsSync as existsSync10, readdirSync as readdirSync5 } from "fs";
-import { join as join12, resolve as resolve6 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync6 } from "fs";
+import { join as join13, resolve as resolve6 } from "path";
 import chalk7 from "chalk";
 import { Command as Command7 } from "commander";
 var dataListCommand = new Command7("list").description("List DDL imports vendored in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -2851,15 +3061,15 @@ var dataListCommand = new Command7("list").description("List DDL imports vendore
   }
 });
 async function runDataList(options) {
-  const importsDir = join12(options.cwd, "db", "imports");
-  if (!existsSync10(importsDir)) {
+  const importsDir = join13(options.cwd, "db", "imports");
+  if (!existsSync11(importsDir)) {
     console.log(chalk7.dim("\n  No DDL imports in this checkout.\n"));
     return;
   }
-  const candidates = readdirSync5(importsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+  const candidates = readdirSync6(importsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
   const imports = [];
   for (const name of candidates) {
-    const fileCount = readdirSync5(join12(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
+    const fileCount = readdirSync6(join13(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
     if (fileCount > 0) imports.push({ name, fileCount });
   }
   if (imports.length === 0) {
@@ -2889,7 +3099,7 @@ dataCommand.addCommand(dataListCommand);
 
 // src/commands/deploy.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve7 } from "path";
 import chalk8 from "chalk";
 import { Command as Command9 } from "commander";
@@ -3243,7 +3453,7 @@ var deployCommand = new Command9("deploy").description("Deploy infrastructure an
 );
 async function resolveConfig2(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync7(resolve7(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync8(resolve7(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -3263,8 +3473,8 @@ async function resolveConfig2(options) {
     return cfg;
   }
   const localConfigPath = resolve7(process.cwd(), "biffo.config.json");
-  if (existsSync11(localConfigPath)) {
-    const raw = JSON.parse(readFileSync7(localConfigPath, "utf8"));
+  if (existsSync12(localConfigPath)) {
+    const raw = JSON.parse(readFileSync8(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -3648,7 +3858,7 @@ function resolveGithubToken() {
 
 // src/commands/destroy.ts
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve8 } from "path";
 import chalk9 from "chalk";
 import { Command as Command10 } from "commander";
@@ -3738,7 +3948,7 @@ var destroyCommand = new Command10("destroy").description("Destroy infrastructur
 });
 async function resolveConfig3(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync8(resolve8(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync9(resolve8(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -3758,7 +3968,7 @@ async function resolveConfig3(options) {
     return cfg;
   }
   try {
-    const raw = JSON.parse(readFileSync8(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
+    const raw = JSON.parse(readFileSync9(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
   } catch {
@@ -3808,15 +4018,15 @@ function resolveGithubToken2() {
 }
 
 // src/commands/init.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { resolve as resolve10 } from "path";
 import chalk12 from "chalk";
 import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
-import { existsSync as existsSync12, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
-import { dirname as dirname5, join as join13, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync13, readdirSync as readdirSync7, statSync as statSync3 } from "fs";
+import { dirname as dirname5, join as join14, relative as relative2, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SKIP_ENV_VAR = "BIFFO_SKIP_BUILD_FRESHNESS_CHECK";
 function checkBuildFreshness(options = {}) {
@@ -3830,7 +4040,7 @@ function checkBuildFreshness(options = {}) {
   if (!packageRoot) {
     return { status: "skipped", reason: `no package.json above ${moduleDir}`, newerSources: [] };
   }
-  const distDir = join13(packageRoot, "dist");
+  const distDir = join14(packageRoot, "dist");
   if (!isInside(distDir, moduleDir)) {
     return {
       status: "skipped",
@@ -3838,16 +4048,16 @@ function checkBuildFreshness(options = {}) {
       newerSources: []
     };
   }
-  const srcDir = join13(packageRoot, "src");
-  if (!existsSync12(srcDir)) {
+  const srcDir = join14(packageRoot, "src");
+  if (!existsSync13(srcDir)) {
     return {
       status: "skipped",
       reason: "no src/ alongside dist/ \u2014 this is a shipped package",
       newerSources: []
     };
   }
-  const entry = join13(distDir, "index.js");
-  if (!existsSync12(entry)) {
+  const entry = join14(distDir, "index.js");
+  if (!existsSync13(entry)) {
     return { status: "skipped", reason: `${entry} not found`, newerSources: [] };
   }
   const builtAt = statSync3(entry).mtimeMs;
@@ -3890,8 +4100,8 @@ function formatStaleBuildError(result) {
 function collectSourceFiles(srcDir) {
   const found = [];
   const walk = (dir) => {
-    for (const entry of readdirSync6(dir, { withFileTypes: true })) {
-      const full = join13(dir, entry.name);
+    for (const entry of readdirSync7(dir, { withFileTypes: true })) {
+      const full = join14(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules") continue;
         walk(full);
@@ -3910,7 +4120,7 @@ function collectSourceFiles(srcDir) {
 function findPackageRoot(from) {
   let dir = from;
   for (; ; ) {
-    if (existsSync12(join13(dir, "package.json"))) return dir;
+    if (existsSync13(join14(dir, "package.json"))) return dir;
     const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -3924,9 +4134,9 @@ function isInside(parent, child) {
 
 // src/lib/credentials.ts
 import { execSync as execSync6 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand2, STSClient as STSClient2 } from "@aws-sdk/client-sts";
 import chalk10 from "chalk";
 import inquirer4 from "inquirer";
@@ -4105,11 +4315,11 @@ async function verifySelectedAwsCredentials(profile, region) {
   return sts.send(new GetCallerIdentityCommand2({}));
 }
 function discoverAwsProfiles() {
-  const files = [join14(homedir2(), ".aws", "credentials"), join14(homedir2(), ".aws", "config")];
+  const files = [join15(homedir2(), ".aws", "credentials"), join15(homedir2(), ".aws", "config")];
   const profiles = /* @__PURE__ */ new Set();
   for (const file of files) {
-    if (!existsSync13(file)) continue;
-    const content = readFileSync9(file, "utf8");
+    if (!existsSync14(file)) continue;
+    const content = readFileSync10(file, "utf8");
     for (const match of content.matchAll(/^\s*\[([^\]]+)\]\s*$/gm)) {
       const section = match[1]?.trim();
       if (!section) continue;
@@ -4199,34 +4409,34 @@ var SiblingConfigSchema = z4.object({
 
 // src/lib/sibling-session.ts
 import {
-  existsSync as existsSync14,
-  mkdirSync as mkdirSync5,
-  readdirSync as readdirSync7,
-  readFileSync as readFileSync10,
-  rmSync as rmSync5,
+  existsSync as existsSync15,
+  mkdirSync as mkdirSync6,
+  readdirSync as readdirSync8,
+  readFileSync as readFileSync11,
+  rmSync as rmSync6,
   statSync as statSync4,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function sessionsDir2() {
-  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join15(homedir3(), ".biffo", "sibling-sessions");
+  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join16(homedir3(), ".biffo", "sibling-sessions");
 }
 function sessionPath2(projectName) {
-  return join15(sessionsDir2(), `${projectName}.json`);
+  return join16(sessionsDir2(), `${projectName}.json`);
 }
 function loadSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (!existsSync14(path)) return null;
+  if (!existsSync15(path)) return null;
   try {
-    return JSON.parse(readFileSync10(path, "utf8"));
+    return JSON.parse(readFileSync11(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveSiblingSession(session) {
   const dir = sessionsDir2();
-  if (!existsSync14(dir)) mkdirSync5(dir, { recursive: true });
+  if (!existsSync15(dir)) mkdirSync6(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSiblingSession(name);
   if (prior) {
@@ -4235,7 +4445,7 @@ function saveSiblingSession(session) {
     }
     session.outputs = { ...prior.outputs, ...definedOnly2(session.outputs) };
   }
-  writeFileSync5(sessionPath2(name), JSON.stringify(session, null, 2));
+  writeFileSync6(sessionPath2(name), JSON.stringify(session, null, 2));
 }
 function definedOnly2(value) {
   return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
@@ -4248,30 +4458,30 @@ function markSiblingStepComplete(session, step) {
 }
 function deleteSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (existsSync14(path)) rmSync5(path);
+  if (existsSync15(path)) rmSync6(path);
 }
 
 // src/commands/sibling-create.ts
-import { cpSync as cpSync2, existsSync as existsSync15, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync4, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync16, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname6, join as join17, resolve as resolve9 } from "path";
+import { dirname as dirname6, join as join18, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import chalk11 from "chalk";
 import { Command as Command11 } from "commander";
 
 // src/lib/skeleton-dotfiles.ts
-import { readdirSync as readdirSync8, renameSync } from "fs";
-import { join as join16 } from "path";
+import { readdirSync as readdirSync9, renameSync } from "fs";
+import { join as join17 } from "path";
 var PACKAGED_GITIGNORE = "_gitignore";
 var REAL_GITIGNORE = ".gitignore";
 function restorePackagedDotfiles(dir) {
   const restored = [];
-  for (const entry of readdirSync8(dir, { withFileTypes: true })) {
-    const full = join16(dir, entry.name);
+  for (const entry of readdirSync9(dir, { withFileTypes: true })) {
+    const full = join17(dir, entry.name);
     if (entry.isDirectory()) {
       restored.push(...restorePackagedDotfiles(full));
     } else if (entry.name === PACKAGED_GITIGNORE) {
-      const target = join16(dir, REAL_GITIGNORE);
+      const target = join17(dir, REAL_GITIGNORE);
       renameSync(full, target);
       restored.push(target);
     }
@@ -4316,7 +4526,7 @@ async function runSiblingCreateCommand(name, options) {
     printDryRun2(config, coreConfig, options.templateRoot);
     return;
   }
-  if (!existsSync15(options.templateRoot)) {
+  if (!existsSync16(options.templateRoot)) {
     throw new Error(`Sibling template not found at ${options.templateRoot}`);
   }
   let session = null;
@@ -4501,7 +4711,7 @@ function assertPathPrefixIsAllowed(pathPrefix) {
   }
 }
 function readSiblingConfig(path, root = false) {
-  const raw = JSON.parse(readFileSync11(path, "utf8"));
+  const raw = JSON.parse(readFileSync12(path, "utf8"));
   const withDefaults = raw && typeof raw === "object" && "project" in raw && "core" in raw ? {
     ...raw,
     core: {
@@ -4535,7 +4745,7 @@ function resolveCoreConfig(config, configPath) {
   throw new Error("Either core.project_name or core.config_path is required.");
 }
 function parseCoreConfig(path) {
-  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync11(path, "utf8")));
+  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync12(path, "utf8")));
   if (!result.success) {
     throw new Error(
       `Invalid core configuration at ${path}:
@@ -4574,7 +4784,7 @@ async function resolveCoreIdentity(coreAws, coreConfig, environments) {
   return coreIdentity;
 }
 async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
-  const workDir = mkdtempSync4(join17(tmpdir4(), `biffo-sibling-${config.project.name}-`));
+  const workDir = mkdtempSync4(join18(tmpdir4(), `biffo-sibling-${config.project.name}-`));
   try {
     writeSiblingTemplate(skeletonRoot, workDir, config, {
       coreProjectName: coreConfig.project.name,
@@ -4590,13 +4800,13 @@ async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, git
   }
 }
 function writeSiblingTemplate(templateRoot, targetDir, config, context) {
-  if (!existsSync15(templateRoot)) {
+  if (!existsSync16(templateRoot)) {
     throw new Error(`Sibling template not found at ${templateRoot}`);
   }
   cpSync2(templateRoot, targetDir, { recursive: true });
   restorePackagedDotfiles(targetDir);
-  writeFileSync6(
-    join17(targetDir, "biffo.sibling.json"),
+  writeFileSync7(
+    join18(targetDir, "biffo.sibling.json"),
     JSON.stringify(
       {
         name: config.project.name,
@@ -4612,11 +4822,11 @@ function writeSiblingTemplate(templateRoot, targetDir, config, context) {
       2
     ) + "\n"
   );
-  const envPath = join17(targetDir, "apps", "frontend", ".env.example");
+  const envPath = join18(targetDir, "apps", "frontend", ".env.example");
   try {
     const path = basePathFor(context.pathPrefix);
-    const content = readFileSync11(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
-    writeFileSync6(envPath, content);
+    const content = readFileSync12(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
+    writeFileSync7(envPath, content);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -4661,17 +4871,17 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
 }
 function readExistingSiblingOrigins(filePath) {
   try {
-    return JSON.parse(readFileSync11(filePath, "utf8"));
+    return JSON.parse(readFileSync12(filePath, "utf8"));
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw err;
   }
 }
 function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
-  const cdnVarsPath = join17(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
+  const cdnVarsPath = join18(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
   let declaresSiblingOrigins = false;
   try {
-    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync11(cdnVarsPath, "utf8"));
+    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync12(cdnVarsPath, "utf8"));
   } catch {
     declaresSiblingOrigins = false;
   }
@@ -4681,10 +4891,10 @@ function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x")
     );
   }
   if (!isRootPathPrefix(pathPrefix)) return;
-  const cdnMainPath = join17(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
+  const cdnMainPath = join18(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
   let supportsRoot = false;
   try {
-    supportsRoot = /root_sibling_registered/.test(readFileSync11(cdnMainPath, "utf8"));
+    supportsRoot = /root_sibling_registered/.test(readFileSync12(cdnMainPath, "utf8"));
   } catch {
     supportsRoot = false;
   }
@@ -4714,8 +4924,8 @@ async function registerWithCore(git, github, config, coreConfig, pathPrefix, git
     for (const env of config.environments) {
       const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
       const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
-      const relativePath = join17("infra", "environments", env, "siblings.auto.tfvars.json");
-      const filePath = join17(cloneDir, relativePath);
+      const relativePath = join18("infra", "environments", env, "siblings.auto.tfvars.json");
+      const filePath = join18(cloneDir, relativePath);
       const existing = readExistingSiblingOrigins(filePath);
       const siblings = upsertSiblingOrigin(existing.sibling_origins ?? [], {
         name,
@@ -4723,8 +4933,8 @@ async function registerWithCore(git, github, config, coreConfig, pathPrefix, git
         ...config.project.description ? { description: config.project.description } : {},
         ...config.project.routes.length > 0 ? { routes: config.project.routes } : {}
       });
-      mkdirSync6(dirname6(filePath), { recursive: true });
-      writeFileSync6(filePath, serializeRegistry(siblings));
+      mkdirSync7(dirname6(filePath), { recursive: true });
+      writeFileSync7(filePath, serializeRegistry(siblings));
       touchedFiles.push(relativePath);
     }
     await git.add(cloneDir, touchedFiles);
@@ -4795,8 +5005,8 @@ function defaultSiblingTemplateRoot() {
   const start = dirname6(fileURLToPath4(import.meta.url));
   let dir = start;
   for (; ; ) {
-    const candidate = join17(dir, "_skeletons", "sibling-template");
-    if (existsSync15(candidate)) return candidate;
+    const candidate = join18(dir, "_skeletons", "sibling-template");
+    if (existsSync16(candidate)) return candidate;
     const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
@@ -4820,7 +5030,7 @@ var initCommand = new Command12("init").description("Scaffold a new project from
     let config;
     let githubToken;
     if (options.config) {
-      const rawConfig = JSON.parse(readFileSync12(resolve10(options.config), "utf8"));
+      const rawConfig = JSON.parse(readFileSync13(resolve10(options.config), "utf8"));
       config = parseConfig(rawConfig);
       const { account_id: accountId, region } = config.cloud.config;
       session = resolveConfigFileSession(config, accountId, region, options.fresh === true);
@@ -5253,28 +5463,28 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 import { Command as Command20 } from "commander";
 
 // src/commands/plugin-create.ts
-import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
-import { dirname as dirname8, join as join20, resolve as resolve11 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
+import { dirname as dirname8, join as join21, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
 
 // src/lib/plugin-locations.ts
-import { existsSync as existsSync16, readdirSync as readdirSync9 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync10 } from "fs";
+import { join as join19 } from "path";
 var FIRST_PARTY_PLUGINS_DIR = "_plugins";
 var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
 function pluginDir(name, channel) {
   return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
 }
 function scanDir(absDir, relDir, channel) {
-  if (!existsSync16(absDir)) return [];
+  if (!existsSync17(absDir)) return [];
   const found = [];
-  for (const entry of readdirSync9(absDir, { withFileTypes: true })) {
+  for (const entry of readdirSync10(absDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
-    const manifestPath = join18(absDir, entry.name, PLUGIN_MANIFEST_FILE);
-    if (!existsSync16(manifestPath)) continue;
+    const manifestPath = join19(absDir, entry.name, PLUGIN_MANIFEST_FILE);
+    if (!existsSync17(manifestPath)) continue;
     found.push({
       dirName: entry.name,
       relDir: `${relDir}/${entry.name}`,
@@ -5285,11 +5495,11 @@ function scanDir(absDir, relDir, channel) {
   return found;
 }
 function findInstalledPlugins(cwd) {
-  const servicesDir = join18(cwd, "services");
+  const servicesDir = join19(cwd, "services");
   return [
     ...scanDir(servicesDir, "services", "third-party"),
     ...scanDir(
-      join18(servicesDir, FIRST_PARTY_PLUGINS_DIR),
+      join19(servicesDir, FIRST_PARTY_PLUGINS_DIR),
       `services/${FIRST_PARTY_PLUGINS_DIR}`,
       "first-party"
     )
@@ -5449,13 +5659,13 @@ function validateManifest(raw) {
 // src/lib/plugin-scaffold.ts
 import {
   copyFileSync,
-  existsSync as existsSync17,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync13,
-  readdirSync as readdirSync10,
-  writeFileSync as writeFileSync7
+  existsSync as existsSync18,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync14,
+  readdirSync as readdirSync11,
+  writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname7, join as join19 } from "path";
+import { dirname as dirname7, join as join20 } from "path";
 var STANDALONE_ONLY_ENTRIES = {
   ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
   "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
@@ -5508,10 +5718,10 @@ function applySubstitutions(text, names) {
 }
 var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
 function scaffoldPlugin(skeletonRoot, destDir, names) {
-  if (!existsSync17(skeletonRoot)) {
+  if (!existsSync18(skeletonRoot)) {
     throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
   }
-  if (!existsSync17(join19(skeletonRoot, "terraform"))) {
+  if (!existsSync18(join20(skeletonRoot, "terraform"))) {
     throw new Error(
       `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
     );
@@ -5519,8 +5729,8 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
   const skipped = [];
   const files = [];
   const walk = (relDir) => {
-    const absDir = join19(skeletonRoot, relDir);
-    for (const entry of readdirSync10(absDir, { withFileTypes: true }).sort(
+    const absDir = join20(skeletonRoot, relDir);
+    for (const entry of readdirSync11(absDir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     )) {
       if (NEVER_COPY.has(entry.name)) continue;
@@ -5534,14 +5744,14 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
         continue;
       }
       const destRel = applySubstitutions(relPath, names);
-      const destPath = join19(destDir, destRel);
-      mkdirSync7(dirname7(destPath), { recursive: true });
+      const destPath = join20(destDir, destRel);
+      mkdirSync8(dirname7(destPath), { recursive: true });
       if (BINARY_EXTENSIONS.test(entry.name)) {
-        copyFileSync(join19(skeletonRoot, relPath), destPath);
+        copyFileSync(join20(skeletonRoot, relPath), destPath);
       } else {
-        writeFileSync7(
+        writeFileSync8(
           destPath,
-          applySubstitutions(readFileSync13(join19(skeletonRoot, relPath), "utf8"), names)
+          applySubstitutions(readFileSync14(join20(skeletonRoot, relPath), "utf8"), names)
         );
       }
       files.push(destRel);
@@ -5558,8 +5768,8 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
 function findSkeletonRoot(startDir, skeleton) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join19(dir, "_skeletons", skeleton);
-    if (existsSync17(candidate)) return candidate;
+    const candidate = join20(dir, "_skeletons", skeleton);
+    if (existsSync18(candidate)) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -5596,7 +5806,7 @@ var pluginCreateCommand = new Command13("create").description("Scaffold a new pl
 );
 async function runPluginCreate(name, options, deps) {
   const names = deriveNames(name);
-  const isInstance = existsSync18(join20(options.cwd, INSTANCE_CORE_FILE));
+  const isInstance = existsSync19(join21(options.cwd, INSTANCE_CORE_FILE));
   if (options.firstParty && isInstance) {
     throw new Error(
       `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
@@ -5604,19 +5814,19 @@ async function runPluginCreate(name, options, deps) {
   }
   const channel = options.firstParty ? "first-party" : "third-party";
   const relDir = pluginDir(names.slug, channel);
-  const destDir = join20(options.cwd, relDir);
-  const servicesDir = join20(options.cwd, "services");
-  if (!existsSync18(servicesDir)) {
+  const destDir = join21(options.cwd, relDir);
+  const servicesDir = join21(options.cwd, "services");
+  if (!existsSync19(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  if (existsSync18(destDir)) {
+  if (existsSync19(destDir)) {
     throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
   }
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join20(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync18(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join21(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync19(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -5631,8 +5841,8 @@ async function runPluginCreate(name, options, deps) {
   for (const { entry, reason } of skipped) {
     log.info(`Skipped ${entry} \u2014 ${reason}`);
   }
-  const manifestPath = join20(destDir, "biffo.plugin.json");
-  const manifest = validateManifest(JSON.parse(readFileSync14(manifestPath, "utf8")));
+  const manifestPath = join21(destDir, "biffo.plugin.json");
+  const manifest = validateManifest(JSON.parse(readFileSync15(manifestPath, "utf8")));
   if (manifest.name !== names.slug) {
     throw new Error(
       `Scaffolded manifest declares name '${manifest.name}', expected '${names.slug}'. The skeleton's manifest name may have diverged from 'example-plugin'.`
@@ -5829,7 +6039,7 @@ import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
 import { execa as execa4 } from "execa";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var PluginMigrationsAdapter = class {
   /**
    * Generates migration file(s) for `pluginNames` (every discovered
@@ -5838,22 +6048,22 @@ var PluginMigrationsAdapter = class {
    * or declared no tables.
    */
   async generate(cwd, pluginNames) {
-    const scriptPath = join21(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
+    const scriptPath = join22(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
     const args = [
       "run",
       "python",
       scriptPath,
       "--services-root",
-      join21(cwd, "services"),
+      join22(cwd, "services"),
       "--versions-dir",
-      join21(cwd, "services", "api", "migrations", "versions")
+      join22(cwd, "services", "api", "migrations", "versions")
     ];
     for (const name of pluginNames ?? []) {
       args.push("--plugin", name);
     }
     let result;
     try {
-      result = await execa4("uv", args, { cwd: join21(cwd, "services", "api") });
+      result = await execa4("uv", args, { cwd: join22(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -5869,171 +6079,6 @@ var PluginMigrationsAdapter = class {
   }
 };
 
-// src/lib/plugin-terraform-wiring.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync8, readFileSync as readFileSync15, readdirSync as readdirSync11, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
-import { join as join22 } from "path";
-var TEMPLATE_MODULE_DIR = "_template";
-var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
-var GENERATED_TF_FILE = "plugins.generated.tf";
-var GENERATED_TFVARS_FILE = "plugins.auto.tfvars.json";
-function standardArguments(pluginName, handler) {
-  return [
-    ["project_name", "var.project_name"],
-    ["environment", "local.environment"],
-    ["plugin_name", JSON.stringify(pluginName)],
-    ["handler", JSON.stringify(handler)],
-    ["event_bus_name", "module.events.event_bus_name"],
-    ["core_api_url", "module.api_gateway.api_endpoint"],
-    ["core_api_execution_arn", "module.api_gateway.execution_arn"],
-    ["tags", "local.tags"]
-  ];
-}
-function listPluginModules(cwd) {
-  const dir = join22(cwd, "modules", "plugins");
-  let entries;
-  try {
-    entries = readdirSync11(dir, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  return entries.filter((e) => e.isDirectory() && e.name !== TEMPLATE_MODULE_DIR && !e.name.startsWith(".")).map((e) => e.name).sort();
-}
-function listEnvironments(cwd) {
-  const dir = join22(cwd, "infra", "environments");
-  let entries;
-  try {
-    entries = readdirSync11(dir, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  return entries.filter((e) => {
-    if (!e.isDirectory() || !existsSync19(join22(dir, e.name, "main.tf"))) return false;
-    return declaredVariables(join22(dir, e.name)).has("enabled_plugins");
-  }).map((e) => e.name).sort();
-}
-function listUnwirableEnvironments(cwd) {
-  const dir = join22(cwd, "infra", "environments");
-  let entries;
-  try {
-    entries = readdirSync11(dir, { withFileTypes: true });
-  } catch {
-    return [];
-  }
-  return entries.filter(
-    (e) => e.isDirectory() && existsSync19(join22(dir, e.name, "main.tf")) && !declaredVariables(join22(dir, e.name)).has("enabled_plugins")
-  ).map((e) => e.name).sort();
-}
-function declaredVariables(moduleDir) {
-  const names = /* @__PURE__ */ new Set();
-  let entries;
-  try {
-    entries = readdirSync11(moduleDir, { withFileTypes: true });
-  } catch {
-    return names;
-  }
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
-    let contents;
-    try {
-      contents = readFileSync15(join22(moduleDir, entry.name), "utf8");
-    } catch {
-      continue;
-    }
-    for (const match of contents.matchAll(/^\s*variable\s+"([^"]+)"/gm)) {
-      names.add(match[1]);
-    }
-  }
-  return names;
-}
-function renderArguments(args, indent) {
-  const width = Math.max(...args.map(([key]) => key.length));
-  return args.map(([key, value]) => `${indent}${key.padEnd(width)} = ${value}`).join("\n");
-}
-function renderModuleBlock(pluginName, declared, handler) {
-  const args = standardArguments(pluginName, handler).filter(([key]) => declared.has(key));
-  const quoted = JSON.stringify(pluginName);
-  return [
-    `module "plugin_${pluginName}" {`,
-    `  source   = "../../../modules/plugins/${pluginName}"`,
-    `  for_each = contains(var.enabled_plugins, ${quoted}) ? { ${quoted} = true } : {}`,
-    "",
-    renderArguments(args, "  "),
-    "}",
-    "",
-    `output "plugin_${pluginName}_function_arn" {`,
-    `  description = "Lambda ARN of the ${pluginName} plugin, or null when it is not in enabled_plugins."`,
-    `  value       = try(module.plugin_${pluginName}[${quoted}].function_arn, null)`,
-    "}"
-  ].join("\n");
-}
-var GENERATED_HEADER = `# ---------------------------------------------------------------------------
-# GENERATED FILE \u2014 DO NOT EDIT BY HAND.
-#
-# Written by \`biffo plugin install\` / \`biffo plugin uninstall\` (issue #201),
-# regenerated in full from the contents of modules/plugins/. Any manual edit is
-# lost on the next plugin install or uninstall.
-#
-# Terraform loads every *.tf file in this directory, so these blocks are as
-# live as anything in main.tf \u2014 they simply live in a CLI-owned file so the
-# CLI never has to rewrite your hand-authored main.tf.
-#
-# Terraform requires a module's \`source\` to be a static string literal, so it
-# cannot loop over var.enabled_plugins; hence one explicit block per plugin,
-# each gated on membership in enabled_plugins (supplied by the generated
-# ${GENERATED_TFVARS_FILE} alongside this file).
-#
-# Not generated here: the Core API's BIFFO_SERVICE_PRINCIPAL_ARN_ALLOWLIST
-# (ADR-0009). It lives in main.tf and is derived from var.enabled_plugins as a
-# static role-name glob \u2014 deriving it from a plugin module's role_arn output
-# would create the cycle core_api -> api_gateway -> plugin -> core_api.
-# ---------------------------------------------------------------------------
-`;
-function renderGeneratedTerraform(plugins) {
-  const blocks = plugins.map(
-    (p) => renderModuleBlock(p.name, p.declaredVariables, p.handler ?? DEFAULT_PLUGIN_HANDLER)
-  );
-  return `${GENERATED_HEADER}
-${blocks.join("\n\n")}
-`;
-}
-function renderGeneratedTfvars(pluginNames) {
-  return `${JSON.stringify({ enabled_plugins: pluginNames }, null, 2)}
-`;
-}
-function syncPluginTerraform(cwd) {
-  const plugins = listPluginModules(cwd);
-  const environments = listEnvironments(cwd);
-  const skippedEnvironments = listUnwirableEnvironments(cwd);
-  const changedPaths = [];
-  const rendered = plugins.map((name) => ({
-    name,
-    declaredVariables: declaredVariables(join22(cwd, "modules", "plugins", name))
-  }));
-  for (const env of environments) {
-    const envDir = join22(cwd, "infra", "environments", env);
-    const tfPath = join22(envDir, GENERATED_TF_FILE);
-    const tfvarsPath = join22(envDir, GENERATED_TFVARS_FILE);
-    const relBase = `infra/environments/${env}`;
-    if (plugins.length === 0) {
-      for (const [abs, rel] of [
-        [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
-        [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
-      ]) {
-        if (existsSync19(abs)) {
-          rmSync6(abs);
-          changedPaths.push(rel);
-        }
-      }
-      continue;
-    }
-    mkdirSync8(envDir, { recursive: true });
-    writeFileSync8(tfPath, renderGeneratedTerraform(rendered));
-    writeFileSync8(tfvarsPath, renderGeneratedTfvars(plugins));
-    changedPaths.push(`${relBase}/${GENERATED_TF_FILE}`, `${relBase}/${GENERATED_TFVARS_FILE}`);
-  }
-  return { plugins, environments, skippedEnvironments, changedPaths };
-}
-
 // src/commands/plugin-install.ts
 var TARGET_PATTERN = /^([a-z][a-z0-9-]*)@(\d+\.\d+)$/;
 var pluginInstallCommand = new Command15("install").description(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",