@biffo/cli 0.56.2 → 0.57.0

package/dist/index.js

@@ -337,7 +337,7 @@ async function runCoreStatus(options) {
 
 // src/commands/core-upgrade.ts
 import { execSync as execSync2 } from "child_process";
-import { join as join10, resolve as resolve3 } from "path";
+import { join as join11, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
 import { execa as execa3 } from "execa";
 import { Command as Command3 } from "commander";
@@ -1628,6 +1628,45 @@ function materializeTemplateAtTag(repo, version, git = defaultGit) {
   return { dir, cleanup: () => rmSync3(dir, { recursive: true, force: true }) };
 }
 
+// src/lib/breaking-changes.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { join as join8 } from "path";
+var UPGRADE_GUIDE_PATH = "docs/guides/core-upgrade.md";
+var SECTION_HEADING = "## Breaking changes by version";
+var ENTRY_HEADING = /^###\s+(\d+\.\d+\.\d+)\s*[—-]\s*(.+?)\s*$/;
+function parseBreakingChanges(guide) {
+  const lines = guide.split("\n");
+  const start = lines.findIndex((l) => l.trim() === SECTION_HEADING);
+  if (start === -1) return [];
+  const entries = [];
+  let current = null;
+  for (const line of lines.slice(start + 1)) {
+    if (/^##\s/.test(line) && !/^###/.test(line)) break;
+    const match = ENTRY_HEADING.exec(line);
+    if (match?.[1] && match[2]) {
+      if (current) entries.push({ ...current, body: current.body.trim() });
+      current = { version: match[1], title: match[2], body: "" };
+      continue;
+    }
+    if (current) current.body += `${line}
+`;
+  }
+  if (current) entries.push({ ...current, body: current.body.trim() });
+  return entries;
+}
+function readBreakingChanges(templateRoot) {
+  const path = join8(templateRoot, UPGRADE_GUIDE_PATH);
+  if (!existsSync6(path)) return [];
+  return parseBreakingChanges(readFileSync5(path, "utf8"));
+}
+function breakingChangesBetween(from, to, entries) {
+  parseCoreVersion(from);
+  parseCoreVersion(to);
+  return entries.filter(
+    (e) => compareCoreVersions(e.version, from) > 0 && compareCoreVersions(e.version, to) <= 0
+  ).sort((a, b) => compareCoreVersions(a.version, b.version));
+}
+
 // src/lib/global-workflows.ts
 var GLOBAL_DISPATCH_REF = "main";
 var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
@@ -1635,8 +1674,8 @@ var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
 ];
 
 // src/lib/plugin-terraform-wiring.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 var TEMPLATE_MODULE_DIR = "_template";
 var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
 var GENERATED_TF_FILE = "plugins.generated.tf";
@@ -1654,7 +1693,7 @@ function standardArguments(pluginName, handler) {
   ];
 }
 function listPluginModules(cwd) {
-  const dir = join8(cwd, "modules", "plugins");
+  const dir = join9(cwd, "modules", "plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -1666,7 +1705,7 @@ function listPluginModules(cwd) {
 var FIRST_PARTY_TERRAFORM = (name) => `../../../services/_plugins/${name}/terraform`;
 var THIRD_PARTY_TERRAFORM = (name) => `../../../modules/plugins/${name}`;
 function isFirstPartyPlugin(cwd, name) {
-  return existsSync6(join8(cwd, "services", "_plugins", name, "terraform", "main.tf"));
+  return existsSync7(join9(cwd, "services", "_plugins", name, "terraform", "main.tf"));
 }
 function pluginModuleSource(cwd, name) {
   return isFirstPartyPlugin(cwd, name) ? FIRST_PARTY_TERRAFORM(name) : THIRD_PARTY_TERRAFORM(name);
@@ -1677,7 +1716,7 @@ function listWireablePlugins(cwd) {
   return [.../* @__PURE__ */ new Set([...copied, ...firstParty])].sort();
 }
 function firstPartyPluginNames(cwd) {
-  const dir = join8(cwd, "services", "_plugins");
+  const dir = join9(cwd, "services", "_plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -1691,7 +1730,7 @@ function staleFirstPartyCopies(cwd) {
   return firstPartyPluginNames(cwd).filter((name) => copied.has(name));
 }
 function listEnvironments(cwd) {
-  const dir = join8(cwd, "infra", "environments");
+  const dir = join9(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -1699,12 +1738,12 @@ function listEnvironments(cwd) {
     return [];
   }
   return entries.filter((e) => {
-    if (!e.isDirectory() || !existsSync6(join8(dir, e.name, "main.tf"))) return false;
-    return declaredVariables(join8(dir, e.name)).has("enabled_plugins");
+    if (!e.isDirectory() || !existsSync7(join9(dir, e.name, "main.tf"))) return false;
+    return declaredVariables(join9(dir, e.name)).has("enabled_plugins");
   }).map((e) => e.name).sort();
 }
 function listUnwirableEnvironments(cwd) {
-  const dir = join8(cwd, "infra", "environments");
+  const dir = join9(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -1712,7 +1751,7 @@ function listUnwirableEnvironments(cwd) {
     return [];
   }
   return entries.filter(
-    (e) => e.isDirectory() && existsSync6(join8(dir, e.name, "main.tf")) && !declaredVariables(join8(dir, e.name)).has("enabled_plugins")
+    (e) => e.isDirectory() && existsSync7(join9(dir, e.name, "main.tf")) && !declaredVariables(join9(dir, e.name)).has("enabled_plugins")
   ).map((e) => e.name).sort();
 }
 function declaredVariables(moduleDir) {
@@ -1727,7 +1766,7 @@ function declaredVariables(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync5(join8(moduleDir, entry.name), "utf8");
+      contents = readFileSync6(join9(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -1804,7 +1843,7 @@ function syncPluginTerraform(cwd) {
   const changedPaths = [];
   const rendered = plugins.map((name) => {
     const firstParty = isFirstPartyPlugin(cwd, name);
-    const moduleDir = firstParty ? join8(cwd, "services", "_plugins", name, "terraform") : join8(cwd, "modules", "plugins", name);
+    const moduleDir = firstParty ? join9(cwd, "services", "_plugins", name, "terraform") : join9(cwd, "modules", "plugins", name);
     return {
       name,
       declaredVariables: declaredVariables(moduleDir),
@@ -1812,16 +1851,16 @@ function syncPluginTerraform(cwd) {
     };
   });
   for (const env of environments) {
-    const envDir = join8(cwd, "infra", "environments", env);
-    const tfPath = join8(envDir, GENERATED_TF_FILE);
-    const tfvarsPath = join8(envDir, GENERATED_TFVARS_FILE);
+    const envDir = join9(cwd, "infra", "environments", env);
+    const tfPath = join9(envDir, GENERATED_TF_FILE);
+    const tfvarsPath = join9(envDir, GENERATED_TFVARS_FILE);
     const relBase = `infra/environments/${env}`;
     if (plugins.length === 0) {
       for (const [abs, rel] of [
         [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
         [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
       ]) {
-        if (existsSync6(abs)) {
+        if (existsSync7(abs)) {
           rmSync4(abs);
           changedPaths.push(rel);
         }
@@ -1837,8 +1876,8 @@ function syncPluginTerraform(cwd) {
 }
 
 // src/lib/lockfile-refresh.ts
-import { existsSync as existsSync7 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { join as join10 } from "path";
 var LOCKFILE_TRIGGERS = [
   {
     manifest: "package.json",
@@ -1861,7 +1900,7 @@ function lockfilesNeedingRefresh(changedPaths, instanceDir, triggers = LOCKFILE_
   const locked = changedPaths.filter((p) => !isForeignManifest(p));
   return triggers.filter((t) => {
     const touched = locked.some((p) => p === t.manifest || p.endsWith(`/${t.manifest}`));
-    return touched && existsSync7(join9(instanceDir, t.lockfile));
+    return touched && existsSync8(join10(instanceDir, t.lockfile));
   });
 }
 async function refreshLockfiles(instanceDir, triggers, run) {
@@ -1891,13 +1930,17 @@ var coreUpgradeCommand = new Command3("upgrade").description("Three-way-merge te
 ).option(
   "--to-template <path>",
   "Override: path to a template checkout at the TARGET version. Normally auto-resolved."
-).option("--apply", "Apply the plan on a new branch and open a PR (default: dry run)").option("--allow-conflicts", "With --apply, open the PR even if some files conflict").option("--base <branch>", "Base branch for the PR (defaults to the current branch)").option("--remote <name>", "Git remote to push to and open the PR on (default: origin)").action(
+).option("--apply", "Apply the plan on a new branch and open a PR (default: dry run)").option("--allow-conflicts", "With --apply, open the PR even if some files conflict").option(
+  "--acknowledge-breaking",
+  "With --apply, proceed even though this upgrade crosses a documented breaking change"
+).option("--base <branch>", "Base branch for the PR (defaults to the current branch)").option("--remote <name>", "Git remote to push to and open the PR on (default: origin)").action(
   async (options) => {
     const cwd = options.cwd ? resolve3(options.cwd) : process.cwd();
     const runOptions = {
       cwd,
       apply: options.apply ?? false,
-      allowConflicts: options.allowConflicts ?? false
+      allowConflicts: options.allowConflicts ?? false,
+      acknowledgeBreaking: options.acknowledgeBreaking ?? false
     };
     if (options.templateRepo) runOptions.templateRepo = resolve3(options.templateRepo);
     if (options.to) runOptions.toVersion = options.to;
@@ -1950,9 +1993,9 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   let toVersion;
   if (options.theirsDir) {
     theirsDir = options.theirsDir;
-    toVersion = readCoreVersionFile(join10(theirsDir, "core.version"));
+    toVersion = readCoreVersionFile(join11(theirsDir, "core.version"));
   } else {
-    const workingVersion = readCoreVersionFile(join10(templateRepo, "core.version"));
+    const workingVersion = readCoreVersionFile(join11(templateRepo, "core.version"));
     toVersion = options.toVersion ?? workingVersion;
     if (toVersion === workingVersion) {
       theirsDir = templateRepo;
@@ -1966,7 +2009,7 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
   let fromVersion;
   if (options.baseDir) {
     baseDir = options.baseDir;
-    fromVersion = readCoreVersionFile(join10(baseDir, "core.version"));
+    fromVersion = readCoreVersionFile(join11(baseDir, "core.version"));
   } else {
     if (instanceVersion === null) {
       throw new Error(
@@ -1998,6 +2041,14 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     log.success("Nothing to upgrade \u2014 the instance already matches the target for all core files.");
     return;
   }
+  const breaking = breakingChangesBetween(
+    fromVersion,
+    toVersion,
+    // From the TEMPLATE at the target version, never the instance's own copy —
+    // docs/ is user-owned, so an instance's guide may be stale or edited.
+    readBreakingChanges(theirsDir)
+  );
+  printBreakingChanges(breaking, options.apply === true);
   printPlan(plan);
   printMigrationCarry(migrations);
   warnStaleFirstPartyCopies(options.cwd);
@@ -2014,9 +2065,14 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     );
     return;
   }
-  await applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion);
+  await applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking);
 }
-async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion) {
+async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVersion, breaking) {
+  if (breaking.length > 0 && !options.acknowledgeBreaking) {
+    throw new Error(
+      `This upgrade crosses ${breaking.length} documented breaking change(s): ${breaking.map((b) => b.version).join(", ")}. They are printed above and in ${UPGRADE_GUIDE_PATH}. Read what each one requires \u2014 some destroy data or need manual work after the deploy \u2014 then re-run with --acknowledge-breaking.`
+    );
+  }
   if (plan.conflicts.length > 0 && !options.allowConflicts) {
     throw new Error(
       `${plan.conflicts.length} file(s) conflict. Resolve them upstream, or re-run with --allow-conflicts to open a PR that includes the conflict markers for manual resolution.`
@@ -2058,7 +2114,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     head: branch,
     base,
     title: `Upgrade Biffo core ${fromVersion} \u2192 ${toVersion}`,
-    body: buildPrBody(fromVersion, toVersion, plan, migrations, base, lockfiles)
+    body: buildPrBody(fromVersion, toVersion, plan, migrations, base, lockfiles, breaking)
   });
   if (plan.conflicts.length > 0) {
     log.warn(`PR opened with ${plan.conflicts.length} conflict(s) to resolve: ${pr.url}`);
@@ -2066,8 +2122,20 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     log.success(`Opened PR #${pr.number}: ${pr.url}`);
   }
 }
-function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, lockfiles = []) {
-  const lines = [
+function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, lockfiles = [], breaking = []) {
+  const lines = [];
+  if (breaking.length > 0) {
+    lines.push(
+      `## \u26A0 This upgrade crosses ${breaking.length} breaking change(s)`,
+      "",
+      "Read these before merging \u2014 some destroy data or require manual work afterwards.",
+      "",
+      ...breaking.flatMap((b) => [`### ${b.version} \u2014 ${b.title}`, "", b.body, ""]),
+      "---",
+      ""
+    );
+  }
+  lines.push(
     "Automated core upgrade generated by `biffo core upgrade` (ADR-0006).",
     "",
     `Bumps the Biffo template core from **${from}** to **${to}** and updates \`biffo.core.json\`. Only template-owned paths (see \`core-manifest.json\`) were touched \u2014 product, plugin, and infra files were left untouched.`,
@@ -2078,7 +2146,7 @@ function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, loc
     `- take-theirs: ${plan.summary["take-theirs"]}`,
     `- added: ${plan.summary.added}`,
     `- removed: ${plan.summary.removed}`
-  ];
+  );
   if (migrations.entries.length > 0) {
     lines.push(
       "",
@@ -2203,6 +2271,28 @@ function warnStaleFirstPartyCopies(cwd) {
     `${stale.length} first-party plugin(s) still have a copy under modules/plugins/: ${stale.join(", ")}. An upgrade never updates those copies, so if infra/environments/*/ still sources them, this plugin's infrastructure changes are NOT deployed. Point the module source at services/_plugins/<name>/terraform and delete the copy \u2014 see docs/guides/core-upgrade.md.`
   );
 }
+function printBreakingChanges(breaking, applying) {
+  if (breaking.length === 0) return;
+  console.log(
+    chalk4.red.bold(
+      `
+  \u26A0 This upgrade crosses ${breaking.length} documented breaking change(s):
+`
+    )
+  );
+  for (const b of breaking) {
+    console.log(`  ${chalk4.bold(b.version)} \u2014 ${b.title}`);
+    for (const line of b.body.split("\n").slice(0, 6)) console.log(chalk4.dim(`      ${line}`));
+    console.log();
+  }
+  console.log(chalk4.dim(`  Full detail: ${UPGRADE_GUIDE_PATH}
+`));
+  if (!applying) {
+    console.log(
+      chalk4.dim("  Re-run with --apply --acknowledge-breaking once you have read them.\n")
+    );
+  }
+}
 
 // src/commands/core.ts
 var coreCommand = new Command4("core").description(
@@ -2216,7 +2306,7 @@ coreCommand.addCommand(coreUpgradeCommand);
 import { Command as Command8 } from "commander";
 
 // src/commands/data-apply.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve4 } from "path";
 import chalk5 from "chalk";
 import { Command as Command5 } from "commander";
@@ -2667,16 +2757,16 @@ function isTemplatePlaceholderConfig(raw) {
 
 // src/lib/session.ts
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   rmSync as rmSync5,
   statSync,
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir } from "os";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var LEGACY_STEP_ALIASES = {
   github_config: ["github_branches", "github_instance_files", "github_settings"]
 };
@@ -2685,39 +2775,39 @@ function hasCompleted(session, step) {
   return session.completedSteps.some((done) => LEGACY_STEP_ALIASES[done]?.includes(step) ?? false);
 }
 function sessionsDir() {
-  return process.env["BIFFO_SESSIONS_DIR"] ?? join11(homedir(), ".biffo", "sessions");
+  return process.env["BIFFO_SESSIONS_DIR"] ?? join12(homedir(), ".biffo", "sessions");
 }
 function sessionPath(projectName) {
-  return join11(sessionsDir(), `${projectName}.json`);
+  return join12(sessionsDir(), `${projectName}.json`);
 }
 function loadSession(projectName) {
   const path = sessionPath(projectName);
-  if (!existsSync8(path)) return null;
+  if (!existsSync9(path)) return null;
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return null;
   }
 }
 function findLatestSession() {
   const dir = sessionsDir();
-  if (!existsSync8(dir)) return null;
+  if (!existsSync9(dir)) return null;
   const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return null;
   const sorted = files.map((f) => {
-    const fullPath = join11(dir, f);
-    const mtime = existsSync8(fullPath) ? statSync(fullPath).mtimeMs : -1;
+    const fullPath = join12(dir, f);
+    const mtime = existsSync9(fullPath) ? statSync(fullPath).mtimeMs : -1;
     return { f, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   try {
-    return JSON.parse(readFileSync6(join11(dir, sorted[0].f), "utf8"));
+    return JSON.parse(readFileSync7(join12(dir, sorted[0].f), "utf8"));
   } catch {
     return null;
   }
 }
 function saveSession(session) {
   const dir = sessionsDir();
-  if (!existsSync8(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync9(dir)) mkdirSync4(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSession(name);
   if (prior) {
@@ -2739,36 +2829,36 @@ function markStepComplete(session, step) {
 }
 function deleteSession(projectName) {
   const path = sessionPath(projectName);
-  if (existsSync8(path)) rmSync5(path);
+  if (existsSync9(path)) rmSync5(path);
 }
 function projectsDir() {
-  return process.env["BIFFO_PROJECTS_DIR"] ?? join11(homedir(), ".biffo", "projects");
+  return process.env["BIFFO_PROJECTS_DIR"] ?? join12(homedir(), ".biffo", "projects");
 }
 function saveProjectConfig(config) {
   const dir = projectsDir();
-  if (!existsSync8(dir)) mkdirSync4(dir, { recursive: true });
-  writeFileSync5(join11(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
+  if (!existsSync9(dir)) mkdirSync4(dir, { recursive: true });
+  writeFileSync5(join12(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
 }
 function loadProjectConfig(name) {
-  const path = join11(projectsDir(), `${name}.json`);
-  if (!existsSync8(path)) return null;
+  const path = join12(projectsDir(), `${name}.json`);
+  if (!existsSync9(path)) return null;
   try {
-    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync6(path, "utf8")));
+    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync7(path, "utf8")));
     return result.success ? result.data : null;
   } catch {
     return null;
   }
 }
 function deleteProjectConfig(name) {
-  const path = join11(projectsDir(), `${name}.json`);
-  if (existsSync8(path)) rmSync5(path);
+  const path = join12(projectsDir(), `${name}.json`);
+  if (existsSync9(path)) rmSync5(path);
 }
 function listProjectConfigs() {
   const dir = projectsDir();
-  if (!existsSync8(dir)) return [];
+  if (!existsSync9(dir)) return [];
   return readdirSync4(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
     try {
-      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync6(join11(dir, f), "utf8")));
+      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync7(join12(dir, f), "utf8")));
       return result.success ? [result.data] : [];
     } catch {
       return [];
@@ -2837,7 +2927,7 @@ async function runDataApply(name, environment, config, aws) {
 }
 async function resolveConfig(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync7(resolve4(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync8(resolve4(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -2857,8 +2947,8 @@ async function resolveConfig(options) {
     return cfg;
   }
   const localConfigPath = resolve4(process.cwd(), "biffo.config.json");
-  if (existsSync9(localConfigPath)) {
-    const raw = JSON.parse(readFileSync7(localConfigPath, "utf8"));
+  if (existsSync10(localConfigPath)) {
+    const raw = JSON.parse(readFileSync8(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -2904,8 +2994,8 @@ async function resolveConfig(options) {
 
 // src/commands/data-import.ts
 import { execSync as execSync3 } from "child_process";
-import { cpSync, existsSync as existsSync10, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
-import { join as join12, resolve as resolve5 } from "path";
+import { cpSync, existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
+import { join as join13, resolve as resolve5 } from "path";
 import chalk6 from "chalk";
 import { Command as Command6 } from "commander";
 import inquirer2 from "inquirer";
@@ -2945,23 +3035,23 @@ async function runDataImport(name, options, deps) {
       `Invalid import name '${name}'. Use lowercase letters, numbers, and hyphens, starting with a letter.`
     );
   }
-  const servicesDir = join12(options.cwd, "services");
-  if (!existsSync10(servicesDir)) {
+  const servicesDir = join13(options.cwd, "services");
+  if (!existsSync11(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join12(options.cwd, "db", "imports", name);
-  if (existsSync10(targetDir)) {
+  const targetDir = join13(options.cwd, "db", "imports", name);
+  if (existsSync11(targetDir)) {
     throw new Error(
       `DDL import '${name}' is already present at db/imports/${name}/. Remove it first to re-import.`
     );
   }
-  const isLocalDir = existsSync10(options.source) && statSync2(options.source).isDirectory();
+  const isLocalDir = existsSync11(options.source) && statSync2(options.source).isDirectory();
   let sourceDir;
   let cleanupClone = null;
   if (isLocalDir) {
-    sourceDir = options.path ? join12(options.source, options.path) : options.source;
+    sourceDir = options.path ? join13(options.source, options.path) : options.source;
   } else {
     const token = options.token ?? await resolveDdlImportToken();
     log.info(`Cloning ${options.source}...`);
@@ -2969,10 +3059,10 @@ async function runDataImport(name, options, deps) {
     cleanupClone = () => {
       deps.git.cleanup(tmpDir);
     };
-    sourceDir = options.path ? join12(tmpDir, options.path) : tmpDir;
+    sourceDir = options.path ? join13(tmpDir, options.path) : tmpDir;
   }
   try {
-    if (!existsSync10(sourceDir)) {
+    if (!existsSync11(sourceDir)) {
       throw new Error(`Source directory does not exist: ${sourceDir}`);
     }
     const sqlFiles = readdirSync5(sourceDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name).sort();
@@ -2997,7 +3087,7 @@ async function runDataImport(name, options, deps) {
     }
     mkdirSync5(targetDir, { recursive: true });
     for (const file of sqlFiles) {
-      cpSync(join12(sourceDir, file), join12(targetDir, file));
+      cpSync(join13(sourceDir, file), join13(targetDir, file));
     }
     log.success(`Imported ${String(sqlFiles.length)} .sql file(s) to db/imports/${name}/`);
     const commitMessage = `feat(data): import ${name} (${String(sqlFiles.length)} SQL file(s))`;
@@ -3049,8 +3139,8 @@ function printDryRun(name, sqlFiles) {
 }
 
 // src/commands/data-list.ts
-import { existsSync as existsSync11, readdirSync as readdirSync6 } from "fs";
-import { join as join13, resolve as resolve6 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync6 } from "fs";
+import { join as join14, resolve as resolve6 } from "path";
 import chalk7 from "chalk";
 import { Command as Command7 } from "commander";
 var dataListCommand = new Command7("list").description("List DDL imports vendored in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -3063,15 +3153,15 @@ var dataListCommand = new Command7("list").description("List DDL imports vendore
   }
 });
 async function runDataList(options) {
-  const importsDir = join13(options.cwd, "db", "imports");
-  if (!existsSync11(importsDir)) {
+  const importsDir = join14(options.cwd, "db", "imports");
+  if (!existsSync12(importsDir)) {
     console.log(chalk7.dim("\n  No DDL imports in this checkout.\n"));
     return;
   }
   const candidates = readdirSync6(importsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
   const imports = [];
   for (const name of candidates) {
-    const fileCount = readdirSync6(join13(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
+    const fileCount = readdirSync6(join14(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
     if (fileCount > 0) imports.push({ name, fileCount });
   }
   if (imports.length === 0) {
@@ -3101,7 +3191,7 @@ dataCommand.addCommand(dataListCommand);
 
 // src/commands/deploy.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve7 } from "path";
 import chalk8 from "chalk";
 import { Command as Command9 } from "commander";
@@ -3455,7 +3545,7 @@ var deployCommand = new Command9("deploy").description("Deploy infrastructure an
 );
 async function resolveConfig2(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync8(resolve7(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync9(resolve7(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -3475,8 +3565,8 @@ async function resolveConfig2(options) {
     return cfg;
   }
   const localConfigPath = resolve7(process.cwd(), "biffo.config.json");
-  if (existsSync12(localConfigPath)) {
-    const raw = JSON.parse(readFileSync8(localConfigPath, "utf8"));
+  if (existsSync13(localConfigPath)) {
+    const raw = JSON.parse(readFileSync9(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -3860,7 +3950,7 @@ function resolveGithubToken() {
 
 // src/commands/destroy.ts
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { resolve as resolve8 } from "path";
 import chalk9 from "chalk";
 import { Command as Command10 } from "commander";
@@ -3950,7 +4040,7 @@ var destroyCommand = new Command10("destroy").description("Destroy infrastructur
 });
 async function resolveConfig3(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync9(resolve8(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync10(resolve8(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -3970,7 +4060,7 @@ async function resolveConfig3(options) {
     return cfg;
   }
   try {
-    const raw = JSON.parse(readFileSync9(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
+    const raw = JSON.parse(readFileSync10(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
   } catch {
@@ -4020,15 +4110,15 @@ function resolveGithubToken2() {
 }
 
 // src/commands/init.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { resolve as resolve10 } from "path";
 import chalk12 from "chalk";
 import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
-import { existsSync as existsSync13, readdirSync as readdirSync7, statSync as statSync3 } from "fs";
-import { dirname as dirname5, join as join14, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync14, readdirSync as readdirSync7, statSync as statSync3 } from "fs";
+import { dirname as dirname5, join as join15, relative as relative2, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SKIP_ENV_VAR = "BIFFO_SKIP_BUILD_FRESHNESS_CHECK";
 function checkBuildFreshness(options = {}) {
@@ -4042,7 +4132,7 @@ function checkBuildFreshness(options = {}) {
   if (!packageRoot) {
     return { status: "skipped", reason: `no package.json above ${moduleDir}`, newerSources: [] };
   }
-  const distDir = join14(packageRoot, "dist");
+  const distDir = join15(packageRoot, "dist");
   if (!isInside(distDir, moduleDir)) {
     return {
       status: "skipped",
@@ -4050,16 +4140,16 @@ function checkBuildFreshness(options = {}) {
       newerSources: []
     };
   }
-  const srcDir = join14(packageRoot, "src");
-  if (!existsSync13(srcDir)) {
+  const srcDir = join15(packageRoot, "src");
+  if (!existsSync14(srcDir)) {
     return {
       status: "skipped",
       reason: "no src/ alongside dist/ \u2014 this is a shipped package",
       newerSources: []
     };
   }
-  const entry = join14(distDir, "index.js");
-  if (!existsSync13(entry)) {
+  const entry = join15(distDir, "index.js");
+  if (!existsSync14(entry)) {
     return { status: "skipped", reason: `${entry} not found`, newerSources: [] };
   }
   const builtAt = statSync3(entry).mtimeMs;
@@ -4103,7 +4193,7 @@ function collectSourceFiles(srcDir) {
   const found = [];
   const walk = (dir) => {
     for (const entry of readdirSync7(dir, { withFileTypes: true })) {
-      const full = join14(dir, entry.name);
+      const full = join15(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules") continue;
         walk(full);
@@ -4122,7 +4212,7 @@ function collectSourceFiles(srcDir) {
 function findPackageRoot(from) {
   let dir = from;
   for (; ; ) {
-    if (existsSync13(join14(dir, "package.json"))) return dir;
+    if (existsSync14(join15(dir, "package.json"))) return dir;
     const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -4136,9 +4226,9 @@ function isInside(parent, child) {
 
 // src/lib/credentials.ts
 import { execSync as execSync6 } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand2, STSClient as STSClient2 } from "@aws-sdk/client-sts";
 import chalk10 from "chalk";
 import inquirer4 from "inquirer";
@@ -4317,11 +4407,11 @@ async function verifySelectedAwsCredentials(profile, region) {
   return sts.send(new GetCallerIdentityCommand2({}));
 }
 function discoverAwsProfiles() {
-  const files = [join15(homedir2(), ".aws", "credentials"), join15(homedir2(), ".aws", "config")];
+  const files = [join16(homedir2(), ".aws", "credentials"), join16(homedir2(), ".aws", "config")];
   const profiles = /* @__PURE__ */ new Set();
   for (const file of files) {
-    if (!existsSync14(file)) continue;
-    const content = readFileSync10(file, "utf8");
+    if (!existsSync15(file)) continue;
+    const content = readFileSync11(file, "utf8");
     for (const match of content.matchAll(/^\s*\[([^\]]+)\]\s*$/gm)) {
       const section = match[1]?.trim();
       if (!section) continue;
@@ -4411,34 +4501,34 @@ var SiblingConfigSchema = z4.object({
 
 // src/lib/sibling-session.ts
 import {
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   mkdirSync as mkdirSync6,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   rmSync as rmSync6,
   statSync as statSync4,
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function sessionsDir2() {
-  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join16(homedir3(), ".biffo", "sibling-sessions");
+  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join17(homedir3(), ".biffo", "sibling-sessions");
 }
 function sessionPath2(projectName) {
-  return join16(sessionsDir2(), `${projectName}.json`);
+  return join17(sessionsDir2(), `${projectName}.json`);
 }
 function loadSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (!existsSync15(path)) return null;
+  if (!existsSync16(path)) return null;
   try {
-    return JSON.parse(readFileSync11(path, "utf8"));
+    return JSON.parse(readFileSync12(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveSiblingSession(session) {
   const dir = sessionsDir2();
-  if (!existsSync15(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync16(dir)) mkdirSync6(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSiblingSession(name);
   if (prior) {
@@ -4460,30 +4550,30 @@ function markSiblingStepComplete(session, step) {
 }
 function deleteSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (existsSync15(path)) rmSync6(path);
+  if (existsSync16(path)) rmSync6(path);
 }
 
 // src/commands/sibling-create.ts
-import { cpSync as cpSync2, existsSync as existsSync16, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync17, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname6, join as join18, resolve as resolve9 } from "path";
+import { dirname as dirname6, join as join19, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import chalk11 from "chalk";
 import { Command as Command11 } from "commander";
 
 // src/lib/skeleton-dotfiles.ts
 import { readdirSync as readdirSync9, renameSync } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var PACKAGED_GITIGNORE = "_gitignore";
 var REAL_GITIGNORE = ".gitignore";
 function restorePackagedDotfiles(dir) {
   const restored = [];
   for (const entry of readdirSync9(dir, { withFileTypes: true })) {
-    const full = join17(dir, entry.name);
+    const full = join18(dir, entry.name);
     if (entry.isDirectory()) {
       restored.push(...restorePackagedDotfiles(full));
     } else if (entry.name === PACKAGED_GITIGNORE) {
-      const target = join17(dir, REAL_GITIGNORE);
+      const target = join18(dir, REAL_GITIGNORE);
       renameSync(full, target);
       restored.push(target);
     }
@@ -4528,7 +4618,7 @@ async function runSiblingCreateCommand(name, options) {
     printDryRun2(config, coreConfig, options.templateRoot);
     return;
   }
-  if (!existsSync16(options.templateRoot)) {
+  if (!existsSync17(options.templateRoot)) {
     throw new Error(`Sibling template not found at ${options.templateRoot}`);
   }
   let session = null;
@@ -4713,7 +4803,7 @@ function assertPathPrefixIsAllowed(pathPrefix) {
   }
 }
 function readSiblingConfig(path, root = false) {
-  const raw = JSON.parse(readFileSync12(path, "utf8"));
+  const raw = JSON.parse(readFileSync13(path, "utf8"));
   const withDefaults = raw && typeof raw === "object" && "project" in raw && "core" in raw ? {
     ...raw,
     core: {
@@ -4747,7 +4837,7 @@ function resolveCoreConfig(config, configPath) {
   throw new Error("Either core.project_name or core.config_path is required.");
 }
 function parseCoreConfig(path) {
-  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync12(path, "utf8")));
+  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync13(path, "utf8")));
   if (!result.success) {
     throw new Error(
       `Invalid core configuration at ${path}:
@@ -4786,7 +4876,7 @@ async function resolveCoreIdentity(coreAws, coreConfig, environments) {
   return coreIdentity;
 }
 async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
-  const workDir = mkdtempSync4(join18(tmpdir4(), `biffo-sibling-${config.project.name}-`));
+  const workDir = mkdtempSync4(join19(tmpdir4(), `biffo-sibling-${config.project.name}-`));
   try {
     writeSiblingTemplate(skeletonRoot, workDir, config, {
       coreProjectName: coreConfig.project.name,
@@ -4802,13 +4892,13 @@ async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, git
   }
 }
 function writeSiblingTemplate(templateRoot, targetDir, config, context) {
-  if (!existsSync16(templateRoot)) {
+  if (!existsSync17(templateRoot)) {
     throw new Error(`Sibling template not found at ${templateRoot}`);
   }
   cpSync2(templateRoot, targetDir, { recursive: true });
   restorePackagedDotfiles(targetDir);
   writeFileSync7(
-    join18(targetDir, "biffo.sibling.json"),
+    join19(targetDir, "biffo.sibling.json"),
     JSON.stringify(
       {
         name: config.project.name,
@@ -4824,10 +4914,10 @@ function writeSiblingTemplate(templateRoot, targetDir, config, context) {
       2
     ) + "\n"
   );
-  const envPath = join18(targetDir, "apps", "frontend", ".env.example");
+  const envPath = join19(targetDir, "apps", "frontend", ".env.example");
   try {
     const path = basePathFor(context.pathPrefix);
-    const content = readFileSync12(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
+    const content = readFileSync13(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
     writeFileSync7(envPath, content);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
@@ -4873,17 +4963,17 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
 }
 function readExistingSiblingOrigins(filePath) {
   try {
-    return JSON.parse(readFileSync12(filePath, "utf8"));
+    return JSON.parse(readFileSync13(filePath, "utf8"));
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw err;
   }
 }
 function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
-  const cdnVarsPath = join18(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
+  const cdnVarsPath = join19(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
   let declaresSiblingOrigins = false;
   try {
-    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync12(cdnVarsPath, "utf8"));
+    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync13(cdnVarsPath, "utf8"));
   } catch {
     declaresSiblingOrigins = false;
   }
@@ -4893,10 +4983,10 @@ function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x")
     );
   }
   if (!isRootPathPrefix(pathPrefix)) return;
-  const cdnMainPath = join18(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
+  const cdnMainPath = join19(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
   let supportsRoot = false;
   try {
-    supportsRoot = /root_sibling_registered/.test(readFileSync12(cdnMainPath, "utf8"));
+    supportsRoot = /root_sibling_registered/.test(readFileSync13(cdnMainPath, "utf8"));
   } catch {
     supportsRoot = false;
   }
@@ -4926,8 +5016,8 @@ async function registerWithCore(git, github, config, coreConfig, pathPrefix, git
     for (const env of config.environments) {
       const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
       const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
-      const relativePath = join18("infra", "environments", env, "siblings.auto.tfvars.json");
-      const filePath = join18(cloneDir, relativePath);
+      const relativePath = join19("infra", "environments", env, "siblings.auto.tfvars.json");
+      const filePath = join19(cloneDir, relativePath);
       const existing = readExistingSiblingOrigins(filePath);
       const siblings = upsertSiblingOrigin(existing.sibling_origins ?? [], {
         name,
@@ -5007,8 +5097,8 @@ function defaultSiblingTemplateRoot() {
   const start = dirname6(fileURLToPath4(import.meta.url));
   let dir = start;
   for (; ; ) {
-    const candidate = join18(dir, "_skeletons", "sibling-template");
-    if (existsSync16(candidate)) return candidate;
+    const candidate = join19(dir, "_skeletons", "sibling-template");
+    if (existsSync17(candidate)) return candidate;
     const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
@@ -5032,7 +5122,7 @@ var initCommand = new Command12("init").description("Scaffold a new project from
     let config;
     let githubToken;
     if (options.config) {
-      const rawConfig = JSON.parse(readFileSync13(resolve10(options.config), "utf8"));
+      const rawConfig = JSON.parse(readFileSync14(resolve10(options.config), "utf8"));
       config = parseConfig(rawConfig);
       const { account_id: accountId, region } = config.cloud.config;
       session = resolveConfigFileSession(config, accountId, region, options.fresh === true);
@@ -5465,28 +5555,28 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 import { Command as Command20 } from "commander";
 
 // src/commands/plugin-create.ts
-import { existsSync as existsSync19, readFileSync as readFileSync15 } from "fs";
-import { dirname as dirname8, join as join21, resolve as resolve11 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync16 } from "fs";
+import { dirname as dirname8, join as join22, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
 
 // src/lib/plugin-locations.ts
-import { existsSync as existsSync17, readdirSync as readdirSync10 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readdirSync as readdirSync10 } from "fs";
+import { join as join20 } from "path";
 var FIRST_PARTY_PLUGINS_DIR = "_plugins";
 var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
 function pluginDir(name, channel) {
   return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
 }
 function scanDir(absDir, relDir, channel) {
-  if (!existsSync17(absDir)) return [];
+  if (!existsSync18(absDir)) return [];
   const found = [];
   for (const entry of readdirSync10(absDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
-    const manifestPath = join19(absDir, entry.name, PLUGIN_MANIFEST_FILE);
-    if (!existsSync17(manifestPath)) continue;
+    const manifestPath = join20(absDir, entry.name, PLUGIN_MANIFEST_FILE);
+    if (!existsSync18(manifestPath)) continue;
     found.push({
       dirName: entry.name,
       relDir: `${relDir}/${entry.name}`,
@@ -5497,11 +5587,11 @@ function scanDir(absDir, relDir, channel) {
   return found;
 }
 function findInstalledPlugins(cwd) {
-  const servicesDir = join19(cwd, "services");
+  const servicesDir = join20(cwd, "services");
   return [
     ...scanDir(servicesDir, "services", "third-party"),
     ...scanDir(
-      join19(servicesDir, FIRST_PARTY_PLUGINS_DIR),
+      join20(servicesDir, FIRST_PARTY_PLUGINS_DIR),
       `services/${FIRST_PARTY_PLUGINS_DIR}`,
       "first-party"
     )
@@ -5661,13 +5751,13 @@ function validateManifest(raw) {
 // src/lib/plugin-scaffold.ts
 import {
   copyFileSync,
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   readdirSync as readdirSync11,
   writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname7, join as join20 } from "path";
+import { dirname as dirname7, join as join21 } from "path";
 var STANDALONE_ONLY_ENTRIES = {
   ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
   "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
@@ -5720,10 +5810,10 @@ function applySubstitutions(text, names) {
 }
 var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
 function scaffoldPlugin(skeletonRoot, destDir, names) {
-  if (!existsSync18(skeletonRoot)) {
+  if (!existsSync19(skeletonRoot)) {
     throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
   }
-  if (!existsSync18(join20(skeletonRoot, "terraform"))) {
+  if (!existsSync19(join21(skeletonRoot, "terraform"))) {
     throw new Error(
       `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
     );
@@ -5731,7 +5821,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
   const skipped = [];
   const files = [];
   const walk = (relDir) => {
-    const absDir = join20(skeletonRoot, relDir);
+    const absDir = join21(skeletonRoot, relDir);
     for (const entry of readdirSync11(absDir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     )) {
@@ -5746,14 +5836,14 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
         continue;
       }
       const destRel = applySubstitutions(relPath, names);
-      const destPath = join20(destDir, destRel);
+      const destPath = join21(destDir, destRel);
       mkdirSync8(dirname7(destPath), { recursive: true });
       if (BINARY_EXTENSIONS.test(entry.name)) {
-        copyFileSync(join20(skeletonRoot, relPath), destPath);
+        copyFileSync(join21(skeletonRoot, relPath), destPath);
       } else {
         writeFileSync8(
           destPath,
-          applySubstitutions(readFileSync14(join20(skeletonRoot, relPath), "utf8"), names)
+          applySubstitutions(readFileSync15(join21(skeletonRoot, relPath), "utf8"), names)
         );
       }
       files.push(destRel);
@@ -5770,8 +5860,8 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
 function findSkeletonRoot(startDir, skeleton) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join20(dir, "_skeletons", skeleton);
-    if (existsSync18(candidate)) return candidate;
+    const candidate = join21(dir, "_skeletons", skeleton);
+    if (existsSync19(candidate)) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -5808,7 +5898,7 @@ var pluginCreateCommand = new Command13("create").description("Scaffold a new pl
 );
 async function runPluginCreate(name, options, deps) {
   const names = deriveNames(name);
-  const isInstance = existsSync19(join21(options.cwd, INSTANCE_CORE_FILE));
+  const isInstance = existsSync20(join22(options.cwd, INSTANCE_CORE_FILE));
   if (options.firstParty && isInstance) {
     throw new Error(
       `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
@@ -5816,19 +5906,19 @@ async function runPluginCreate(name, options, deps) {
   }
   const channel = options.firstParty ? "first-party" : "third-party";
   const relDir = pluginDir(names.slug, channel);
-  const destDir = join21(options.cwd, relDir);
-  const servicesDir = join21(options.cwd, "services");
-  if (!existsSync19(servicesDir)) {
+  const destDir = join22(options.cwd, relDir);
+  const servicesDir = join22(options.cwd, "services");
+  if (!existsSync20(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  if (existsSync19(destDir)) {
+  if (existsSync20(destDir)) {
     throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
   }
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join21(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync19(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join22(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync20(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -5843,8 +5933,8 @@ async function runPluginCreate(name, options, deps) {
   for (const { entry, reason } of skipped) {
     log.info(`Skipped ${entry} \u2014 ${reason}`);
   }
-  const manifestPath = join21(destDir, "biffo.plugin.json");
-  const manifest = validateManifest(JSON.parse(readFileSync15(manifestPath, "utf8")));
+  const manifestPath = join22(destDir, "biffo.plugin.json");
+  const manifest = validateManifest(JSON.parse(readFileSync16(manifestPath, "utf8")));
   if (manifest.name !== names.slug) {
     throw new Error(
       `Scaffolded manifest declares name '${manifest.name}', expected '${names.slug}'. The skeleton's manifest name may have diverged from 'example-plugin'.`
@@ -6034,14 +6124,14 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync3, existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync16, statSync as statSync5 } from "fs";
-import { basename, join as join23, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync17, statSync as statSync5 } from "fs";
+import { basename, join as join24, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
 import { execa as execa4 } from "execa";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var PluginMigrationsAdapter = class {
   /**
    * Generates migration file(s) for `pluginNames` (every discovered
@@ -6050,22 +6140,22 @@ var PluginMigrationsAdapter = class {
    * or declared no tables.
    */
   async generate(cwd, pluginNames) {
-    const scriptPath = join22(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
+    const scriptPath = join23(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
     const args = [
       "run",
       "python",
       scriptPath,
       "--services-root",
-      join22(cwd, "services"),
+      join23(cwd, "services"),
       "--versions-dir",
-      join22(cwd, "services", "api", "migrations", "versions")
+      join23(cwd, "services", "api", "migrations", "versions")
     ];
     for (const name of pluginNames ?? []) {
       args.push("--plugin", name);
     }
     let result;
     try {
-      result = await execa4("uv", args, { cwd: join22(cwd, "services", "api") });
+      result = await execa4("uv", args, { cwd: join23(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -6123,14 +6213,14 @@ var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".terraform"
 ]);
 function resolveLocalPlugin(localPath) {
-  if (!existsSync20(localPath)) {
+  if (!existsSync21(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync5(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join23(localPath, "biffo.plugin.json");
-  if (!existsSync20(manifestPath)) {
+  const manifestPath = join24(localPath, "biffo.plugin.json");
+  if (!existsSync21(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -6156,8 +6246,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join23(tmpDir, "biffo.plugin.json");
-    if (!existsSync20(manifestPath)) {
+    const manifestPath = join24(tmpDir, "biffo.plugin.json");
+    if (!existsSync21(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -6185,8 +6275,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join23(options.cwd, "services");
-  if (!existsSync20(servicesDir)) {
+  const servicesDir = join24(options.cwd, "services");
+  if (!existsSync21(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -6204,10 +6294,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join23(options.cwd, relTargetDir);
-  const modulesDir = join23(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join24(options.cwd, relTargetDir);
+  const modulesDir = join24(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync20(targetDir) && !inTreeSource) {
+  if (existsSync21(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -6250,8 +6340,8 @@ async function runPluginInstall(target, options, deps) {
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join23(targetDir, "terraform");
-    if (existsSync20(tfSourceDir)) {
+    const tfSourceDir = join24(targetDir, "terraform");
+    if (existsSync21(tfSourceDir)) {
       mkdirSync9(modulesDir, { recursive: true });
       cpSync3(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
@@ -6308,7 +6398,7 @@ async function runPluginInstall(target, options, deps) {
 }
 function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync16(path, "utf8"));
+    return JSON.parse(readFileSync17(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
@@ -6345,8 +6435,8 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync21, readFileSync as readFileSync17 } from "fs";
-import { join as join24, resolve as resolve13 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync18 } from "fs";
+import { join as join25, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -6359,8 +6449,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join24(options.cwd, "services");
-  if (!existsSync21(servicesDir)) {
+  const servicesDir = join25(options.cwd, "services");
+  if (!existsSync22(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -6368,7 +6458,7 @@ async function runPluginList(options) {
   const plugins = [];
   for (const location of findInstalledPlugins(options.cwd)) {
     try {
-      const manifest = validateManifest(JSON.parse(readFileSync17(location.manifestPath, "utf8")));
+      const manifest = validateManifest(JSON.parse(readFileSync18(location.manifestPath, "utf8")));
       plugins.push({
         name: manifest.name,
         version: manifest.version,
@@ -6405,8 +6495,8 @@ async function runPluginList(options) {
 }
 
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync22 } from "fs";
-import { join as join25, relative as relative4, resolve as resolve14 } from "path";
+import { existsSync as existsSync23 } from "fs";
+import { join as join26, relative as relative4, resolve as resolve14 } from "path";
 import chalk17 from "chalk";
 import { Command as Command17 } from "commander";
 var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
@@ -6427,11 +6517,11 @@ var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join25(options.cwd, "services");
-  if (!existsSync22(servicesDir)) {
+  const servicesDir = join26(options.cwd, "services");
+  if (!existsSync23(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync22(join25(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync23(join26(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -6467,8 +6557,8 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync23, readFileSync as readFileSync18, rmSync as rmSync7 } from "fs";
-import { join as join26, resolve as resolve15 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync19, rmSync as rmSync7 } from "fs";
+import { join as join27, resolve as resolve15 } from "path";
 import chalk18 from "chalk";
 import { Command as Command18 } from "commander";
 import inquirer6 from "inquirer";
@@ -6500,16 +6590,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join26(options.cwd, "services");
-  if (!existsSync23(servicesDir)) {
+  const servicesDir = join27(options.cwd, "services");
+  if (!existsSync24(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join26(servicesDir, name);
-  if (!existsSync23(targetDir)) {
-    const firstParty = join26(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync23(firstParty)) {
+  const targetDir = join27(servicesDir, name);
+  if (!existsSync24(targetDir)) {
+    const firstParty = join27(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync24(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -6517,9 +6607,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join26(options.cwd, "modules", "plugins", name);
+  const modulesDir = join27(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync23(modulesDir)) {
+  if (existsSync24(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -6541,7 +6631,7 @@ async function runPluginUninstall(name, options, deps) {
   }
   rmSync7(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync23(modulesDir)) {
+  if (existsSync24(modulesDir)) {
     rmSync7(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
@@ -6578,10 +6668,10 @@ async function runPluginUninstall(name, options, deps) {
   }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join26(targetDir, "biffo.plugin.json");
-  if (!existsSync23(manifestPath)) return void 0;
+  const manifestPath = join27(targetDir, "biffo.plugin.json");
+  if (!existsSync24(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync18(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync19(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -6614,8 +6704,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync4, existsSync as existsSync24, mkdirSync as mkdirSync10, readFileSync as readFileSync19, rmSync as rmSync8 } from "fs";
-import { join as join27, relative as relative5, resolve as resolve16 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync20, rmSync as rmSync8 } from "fs";
+import { join as join28, relative as relative5, resolve as resolve16 } from "path";
 import chalk19 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer7 from "inquirer";
@@ -6640,14 +6730,14 @@ var pluginUpgradeCommand = new Command19("upgrade").description(
 });
 async function runPluginUpgrade(target, options, deps) {
   const { name, minor } = parsePluginTarget(target);
-  const servicesDir = join27(options.cwd, "services");
-  if (!existsSync24(servicesDir)) {
+  const servicesDir = join28(options.cwd, "services");
+  if (!existsSync25(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join27(servicesDir, name);
-  if (!existsSync24(targetDir)) {
+  const targetDir = join28(servicesDir, name);
+  if (!existsSync25(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -6661,7 +6751,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join27(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join28(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -6694,11 +6784,11 @@ async function runPluginUpgrade(target, options, deps) {
     cpSync4(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync24(modulesDir)) {
+    if (existsSync25(modulesDir)) {
       rmSync8(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join27(targetDir, "terraform");
-    if (existsSync24(tfSourceDir)) {
+    const tfSourceDir = join28(targetDir, "terraform");
+    if (existsSync25(tfSourceDir)) {
       mkdirSync10(modulesDir, { recursive: true });
       cpSync4(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
@@ -6732,10 +6822,10 @@ async function runPluginUpgrade(target, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join27(targetDir, "biffo.plugin.json");
-  if (!existsSync24(manifestPath)) return void 0;
+  const manifestPath = join28(targetDir, "biffo.plugin.json");
+  if (!existsSync25(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync19(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync20(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }