@biffo/cli 0.74.0 → 0.75.0

package/dist/index.js

@@ -432,8 +432,8 @@ async function runCoreStatus(options) {
 
 // src/commands/core-upgrade.ts
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync10, rmSync as rmSync5 } from "fs";
-import { join as join11, resolve as resolve3 } from "path";
+import { existsSync as existsSync11, rmSync as rmSync5 } from "fs";
+import { join as join12, resolve as resolve3 } from "path";
 import chalk4 from "chalk";
 import { execa as execa3 } from "execa";
 import { Command as Command3 } from "commander";
@@ -1585,23 +1585,137 @@ function applyMigrationCarry(instanceDir, plan) {
 // src/lib/core-upgrade.ts
 import {
   chmodSync,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync2,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   rmSync as rmSync2,
   statSync,
   writeFileSync as writeFileSync3
 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname4, join as join6 } from "path";
+import { dirname as dirname4, join as join7 } from "path";
 import { execa as execa2 } from "execa";
+
+// src/lib/core-ownership-guard.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { join as join6 } from "path";
+import { z as z3 } from "zod";
+var DIVERGENCE_FILE = "biffo.divergence.json";
+var DivergenceEntrySchema = z3.object({
+  prefix: z3.string().min(1),
+  reason: z3.string().min(1),
+  upstream: z3.string().min(1)
+});
+var DivergenceConfigSchema = z3.object({
+  note: z3.string().optional(),
+  warnOnly: z3.array(DivergenceEntrySchema).default([])
+});
+function readDivergenceConfig(repoRoot) {
+  const path = join6(repoRoot, DIVERGENCE_FILE);
+  if (!existsSync6(path)) return { warnOnly: [] };
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync4(path, "utf8"));
+  } catch (err) {
+    throw new Error(`${DIVERGENCE_FILE} is not valid JSON: ${err.message}`);
+  }
+  const parsed = DivergenceConfigSchema.safeParse(raw);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((i) => `  ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
+    throw new Error(`${DIVERGENCE_FILE} is invalid:
+${issues}`);
+  }
+  return parsed.data;
+}
+function parseTrailer(commitMessage, key) {
+  const body = commitMessage.split("\n").filter((line) => !line.startsWith("#")).join("\n");
+  const match = new RegExp(String.raw`^Core-${key}:[ \t]*(\S.*?)[ \t]*$`, "m").exec(body);
+  return match?.[1] ?? null;
+}
+function parseDivergenceTrailer(commitMessage) {
+  return parseTrailer(commitMessage, "Divergence");
+}
+function parseConvergenceTrailer(commitMessage) {
+  return parseTrailer(commitMessage, "Convergence");
+}
+function resolveBranch(env, gitBranch) {
+  return (env["GITHUB_HEAD_REF"] || env["GITHUB_REF_NAME"] || gitBranch).trim();
+}
+function parseNameStatus(stdout) {
+  const changed = [];
+  const deleted = [];
+  for (const line of stdout.split("\n")) {
+    const parts = line.split("	").filter(Boolean);
+    const status = parts[0];
+    const path = parts[parts.length - 1];
+    if (!status || !path || parts.length < 2) continue;
+    changed.push(path);
+    if (status.startsWith("D")) deleted.push(path);
+  }
+  return { changed, deleted };
+}
+function checkCoreOwnership({
+  changedFiles,
+  manifest,
+  isInstance,
+  branch = "",
+  commitMessage = "",
+  warnOnly = []
+}) {
+  const empty = { blocked: [], warned: [], divergenceReason: null, convergenceReason: null };
+  if (!isInstance) return { skipped: "template", ...empty };
+  if (branch.startsWith(UPGRADE_BRANCH_PREFIX)) return { skipped: "upgrade-branch", ...empty };
+  const templateOwned = changedFiles.filter((f) => isTemplateOwned(f, manifest));
+  const acknowledged = (path) => warnOnly.filter((entry) => path.startsWith(entry.prefix)).reduce(
+    (best, entry) => !best || entry.prefix.length > best.prefix.length ? entry : best,
+    void 0
+  );
+  const warned = [];
+  const offending = [];
+  for (const path of templateOwned) {
+    const entry = acknowledged(path);
+    if (entry) warned.push({ path, entry });
+    else offending.push(path);
+  }
+  const divergenceReason = parseDivergenceTrailer(commitMessage);
+  const convergenceReason = parseConvergenceTrailer(commitMessage);
+  if (offending.length > 0) {
+    if (divergenceReason !== null) {
+      return {
+        skipped: "divergence-trailer",
+        blocked: [],
+        warned,
+        divergenceReason,
+        convergenceReason: null
+      };
+    }
+    if (convergenceReason !== null) {
+      return {
+        skipped: "convergence-trailer",
+        blocked: [],
+        warned,
+        divergenceReason: null,
+        convergenceReason
+      };
+    }
+  }
+  return {
+    skipped: null,
+    blocked: offending,
+    warned,
+    divergenceReason: null,
+    convergenceReason: null
+  };
+}
+
+// src/lib/core-upgrade.ts
 var gitMergeFile = async (base, ours, theirs) => {
-  const dir = mkdtempSync2(join6(tmpdir2(), "biffo-merge-"));
+  const dir = mkdtempSync2(join7(tmpdir2(), "biffo-merge-"));
   try {
-    const b = join6(dir, "base");
-    const o = join6(dir, "ours");
-    const t = join6(dir, "theirs");
+    const b = join7(dir, "base");
+    const o = join7(dir, "ours");
+    const t = join7(dir, "theirs");
     writeFileSync3(b, base);
     writeFileSync3(o, ours);
     writeFileSync3(t, theirs);
@@ -1618,7 +1732,7 @@ var gitMergeFile = async (base, ours, theirs) => {
   }
 };
 function read(root, rel) {
-  return readFileSync4(join6(root, rel), "utf8");
+  return readFileSync5(join7(root, rel), "utf8");
 }
 var EMPTY_SUMMARY = () => ({
   unchanged: 0,
@@ -1628,6 +1742,7 @@ var EMPTY_SUMMARY = () => ({
   conflict: 0,
   added: 0,
   "add-conflict": 0,
+  restored: 0,
   removed: 0,
   "remove-conflict": 0
 });
@@ -1636,18 +1751,32 @@ async function planCoreUpgrade(options) {
   const base = new Set(listTemplateOwnedFiles(options.baseDir, options.manifest));
   const ours = new Set(listTemplateOwnedFiles(options.oursDir, options.manifest));
   const theirs = new Set(listTemplateOwnedFiles(options.theirsDir, options.manifest));
+  const divergentPrefixes = readDivergenceConfig(options.oursDir).warnOnly.map((e) => e.prefix);
+  const isDeclaredDivergent = (path) => divergentPrefixes.some((prefix) => path.startsWith(prefix));
   const paths = [.../* @__PURE__ */ new Set([...base, ...ours, ...theirs])].sort();
   const entries = [];
+  const divergenceSkips = [];
   for (const path of paths) {
-    entries.push(await classify(path, base, ours, theirs, options, mergeFile));
+    entries.push(
+      await classify(
+        path,
+        base,
+        ours,
+        theirs,
+        options,
+        mergeFile,
+        isDeclaredDivergent,
+        (p) => divergenceSkips.push(p)
+      )
+    );
   }
   const summary = EMPTY_SUMMARY();
   for (const e of entries) summary[e.status]++;
   const changes = entries.filter((e) => e.status !== "unchanged" && e.status !== "keep-ours");
   const conflicts = entries.filter((e) => e.conflicted);
-  return { entries, changes, conflicts, summary };
+  return { entries, changes, conflicts, summary, divergenceSkips };
 }
-async function classify(path, base, ours, theirs, opts, mergeFile) {
+async function classify(path, base, ours, theirs, opts, mergeFile, isDeclaredDivergent, noteDivergenceSkip) {
   const inBase = base.has(path);
   const inOurs = ours.has(path);
   const inTheirs = theirs.has(path);
@@ -1671,8 +1800,11 @@ async function classify(path, base, ours, theirs, opts, mergeFile) {
   const baseContent = read(opts.baseDir, path);
   const theirsContent = read(opts.theirsDir, path);
   if (!inOurs) {
-    if (baseContent === theirsContent) return { path, status: "removed", conflicted: false };
-    return { path, status: "added", conflicted: false, content: theirsContent };
+    if (isDeclaredDivergent(path)) {
+      noteDivergenceSkip(path);
+      return { path, status: "removed", conflicted: false };
+    }
+    return { path, status: "restored", conflicted: false, content: theirsContent };
   }
   const oursContent = read(opts.oursDir, path);
   const oursChanged = oursContent !== baseContent;
@@ -1693,9 +1825,9 @@ function applyUpgradePlan(instanceDir, plan, theirsDir) {
   const written = [];
   const deleted = [];
   for (const e of plan.entries) {
-    const abs = join6(instanceDir, e.path);
+    const abs = join7(instanceDir, e.path);
     if (e.status === "removed") {
-      if (existsSync6(abs)) {
+      if (existsSync7(abs)) {
         rmSync2(abs);
         deleted.push(e.path);
       }
@@ -1705,8 +1837,8 @@ function applyUpgradePlan(instanceDir, plan, theirsDir) {
       mkdirSync2(dirname4(abs), { recursive: true });
       writeFileSync3(abs, e.content);
       if (theirsDir !== void 0) {
-        const source = join6(theirsDir, e.path);
-        if (existsSync6(source) && (statSync(source).mode & 73) !== 0) {
+        const source = join7(theirsDir, e.path);
+        if (existsSync7(source) && (statSync(source).mode & 73) !== 0) {
           chmodSync(abs, 493);
         }
       }
@@ -1731,7 +1863,7 @@ function upgradeBranchName(from, to) {
 import { execFileSync as execFileSync2 } from "child_process";
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync3 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function coreTag(version) {
   parseCoreVersion(version);
   return `core-v${version}`;
@@ -1770,8 +1902,8 @@ function materializeTemplateAtTag(repo, version, git = defaultGit) {
       `No git tag ${tag} in ${repo}. The template tree at core version ${version} is unavailable, so it can't be used as a merge base. Ensure the tag exists (it is pushed by the Core Version Tag workflow on release), or pass an explicit --from-template / --to-template checkout.`
     );
   }
-  const dir = mkdtempSync3(join7(tmpdir3(), `biffo-core-${version}-`));
-  const tarball = join7(dir, ".tree.tar");
+  const dir = mkdtempSync3(join8(tmpdir3(), `biffo-core-${version}-`));
+  const tarball = join8(dir, ".tree.tar");
   try {
     git(["-C", repo, "archive", "--format=tar", "-o", tarball, tag]);
     execFileSync2("tar", ["-x", "-f", tarball, "-C", dir]);
@@ -1784,8 +1916,8 @@ function materializeTemplateAtTag(repo, version, git = defaultGit) {
 }
 
 // src/lib/breaking-changes.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join9 } from "path";
 var UPGRADE_GUIDE_PATH = "docs/guides/core-upgrade.md";
 var SECTION_HEADING = "## Breaking changes by version";
 var ENTRY_HEADING = /^###\s+(\d+\.\d+\.\d+)\s*[—-]\s*(.+?)\s*$/;
@@ -1810,9 +1942,9 @@ function parseBreakingChanges(guide) {
   return entries;
 }
 function readBreakingChanges(templateRoot) {
-  const path = join8(templateRoot, UPGRADE_GUIDE_PATH);
-  if (!existsSync7(path)) return [];
-  return parseBreakingChanges(readFileSync5(path, "utf8"));
+  const path = join9(templateRoot, UPGRADE_GUIDE_PATH);
+  if (!existsSync8(path)) return [];
+  return parseBreakingChanges(readFileSync6(path, "utf8"));
 }
 function breakingChangesBetween(from, to, entries) {
   parseCoreVersion(from);
@@ -1829,8 +1961,8 @@ var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
 ];
 
 // src/lib/plugin-terraform-wiring.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync6, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync7, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
 var TEMPLATE_MODULE_DIR = "_template";
 var DEFAULT_PLUGIN_HANDLER = "src.lambda.main.handler";
 var GENERATED_TF_FILE = "plugins.generated.tf";
@@ -1848,7 +1980,7 @@ function standardArguments(pluginName, handler) {
   ];
 }
 function listPluginModules(cwd) {
-  const dir = join9(cwd, "modules", "plugins");
+  const dir = join10(cwd, "modules", "plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -1860,7 +1992,7 @@ function listPluginModules(cwd) {
 var FIRST_PARTY_TERRAFORM = (name) => `../../../services/_plugins/${name}/terraform`;
 var THIRD_PARTY_TERRAFORM = (name) => `../../../modules/plugins/${name}`;
 function isFirstPartyPlugin(cwd, name) {
-  return existsSync8(join9(cwd, "services", "_plugins", name, "terraform", "main.tf"));
+  return existsSync9(join10(cwd, "services", "_plugins", name, "terraform", "main.tf"));
 }
 function pluginModuleSource(cwd, name) {
   return isFirstPartyPlugin(cwd, name) ? FIRST_PARTY_TERRAFORM(name) : THIRD_PARTY_TERRAFORM(name);
@@ -1871,7 +2003,7 @@ function listWireablePlugins(cwd) {
   return [.../* @__PURE__ */ new Set([...copied, ...firstParty])].sort();
 }
 function firstPartyPluginNames(cwd) {
-  const dir = join9(cwd, "services", "_plugins");
+  const dir = join10(cwd, "services", "_plugins");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -1885,7 +2017,7 @@ function staleFirstPartyCopies(cwd) {
   return firstPartyPluginNames(cwd).filter((name) => copied.has(name));
 }
 function listEnvironments(cwd) {
-  const dir = join9(cwd, "infra", "environments");
+  const dir = join10(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -1893,12 +2025,12 @@ function listEnvironments(cwd) {
     return [];
   }
   return entries.filter((e) => {
-    if (!e.isDirectory() || !existsSync8(join9(dir, e.name, "main.tf"))) return false;
-    return declaredVariables(join9(dir, e.name)).has("enabled_plugins");
+    if (!e.isDirectory() || !existsSync9(join10(dir, e.name, "main.tf"))) return false;
+    return declaredVariables(join10(dir, e.name)).has("enabled_plugins");
   }).map((e) => e.name).sort();
 }
 function listUnwirableEnvironments(cwd) {
-  const dir = join9(cwd, "infra", "environments");
+  const dir = join10(cwd, "infra", "environments");
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -1906,7 +2038,7 @@ function listUnwirableEnvironments(cwd) {
     return [];
   }
   return entries.filter(
-    (e) => e.isDirectory() && existsSync8(join9(dir, e.name, "main.tf")) && !declaredVariables(join9(dir, e.name)).has("enabled_plugins")
+    (e) => e.isDirectory() && existsSync9(join10(dir, e.name, "main.tf")) && !declaredVariables(join10(dir, e.name)).has("enabled_plugins")
   ).map((e) => e.name).sort();
 }
 function declaredVariables(moduleDir) {
@@ -1921,7 +2053,7 @@ function declaredVariables(moduleDir) {
     if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
     let contents;
     try {
-      contents = readFileSync6(join9(moduleDir, entry.name), "utf8");
+      contents = readFileSync7(join10(moduleDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -1998,7 +2130,7 @@ function syncPluginTerraform(cwd) {
   const changedPaths = [];
   const rendered = plugins.map((name) => {
     const firstParty = isFirstPartyPlugin(cwd, name);
-    const moduleDir = firstParty ? join9(cwd, "services", "_plugins", name, "terraform") : join9(cwd, "modules", "plugins", name);
+    const moduleDir = firstParty ? join10(cwd, "services", "_plugins", name, "terraform") : join10(cwd, "modules", "plugins", name);
     return {
       name,
       declaredVariables: declaredVariables(moduleDir),
@@ -2006,16 +2138,16 @@ function syncPluginTerraform(cwd) {
     };
   });
   for (const env of environments) {
-    const envDir = join9(cwd, "infra", "environments", env);
-    const tfPath = join9(envDir, GENERATED_TF_FILE);
-    const tfvarsPath = join9(envDir, GENERATED_TFVARS_FILE);
+    const envDir = join10(cwd, "infra", "environments", env);
+    const tfPath = join10(envDir, GENERATED_TF_FILE);
+    const tfvarsPath = join10(envDir, GENERATED_TFVARS_FILE);
     const relBase = `infra/environments/${env}`;
     if (plugins.length === 0) {
       for (const [abs, rel] of [
         [tfPath, `${relBase}/${GENERATED_TF_FILE}`],
         [tfvarsPath, `${relBase}/${GENERATED_TFVARS_FILE}`]
       ]) {
-        if (existsSync8(abs)) {
+        if (existsSync9(abs)) {
           rmSync4(abs);
           changedPaths.push(rel);
         }
@@ -2031,8 +2163,8 @@ function syncPluginTerraform(cwd) {
 }
 
 // src/lib/lockfile-refresh.ts
-import { existsSync as existsSync9 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { join as join11 } from "path";
 var LOCKFILE_TRIGGERS = [
   {
     manifest: "package.json",
@@ -2055,7 +2187,7 @@ function lockfilesNeedingRefresh(changedPaths, instanceDir, triggers = LOCKFILE_
   const locked = changedPaths.filter((p) => !isForeignManifest(p));
   return triggers.filter((t) => {
     const touched = locked.some((p) => p === t.manifest || p.endsWith(`/${t.manifest}`));
-    return touched && existsSync9(join10(instanceDir, t.lockfile));
+    return touched && existsSync10(join11(instanceDir, t.lockfile));
   });
 }
 async function refreshLockfiles(instanceDir, triggers, run) {
@@ -2242,6 +2374,13 @@ async function runCoreUpgradeResolved(options, deps, cleanups) {
     `
   ${chalk4.bold(String(plan.changes.length))} change(s), ${chalk4.bold(String(migrations.entries.length))} new core migration(s), ${plan.conflicts.length > 0 ? chalk4.red(`${plan.conflicts.length} conflict(s)`) : chalk4.green("0 conflicts")}.`
   );
+  if (plan.divergenceSkips && plan.divergenceSkips.length > 0) {
+    console.log(
+      chalk4.dim(
+        `  ${plan.divergenceSkips.length} deleted template-owned file(s) left absent \u2014 declared divergent in biffo.divergence.json.`
+      )
+    );
+  }
   if (!options.apply) {
     if (plan.conflicts.length > 0) {
       log.warn("Some core files changed on both sides and need manual resolution.");
@@ -2286,7 +2425,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
   const carried = applyMigrationCarry(options.cwd, migrations);
   writeInstanceCoreVersion(options.cwd, toVersion);
   const cleanedCoreVersion = coreVersionCleanup?.action === "delete";
-  if (cleanedCoreVersion && existsSync10(coreVersionCleanup.path)) {
+  if (cleanedCoreVersion && existsSync11(coreVersionCleanup.path)) {
     rmSync5(coreVersionCleanup.path);
     log.info(
       `Deleted orphaned ${CORE_VERSION_FILE} (inherited copy recording ${coreVersionCleanup.found}, superseded by biffo.core.json) \u2014 nothing reads it as an authority (#434).`
@@ -2355,8 +2494,15 @@ function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF, loc
     `- merged: ${plan.summary.merged}`,
     `- take-theirs: ${plan.summary["take-theirs"]}`,
     `- added: ${plan.summary.added}`,
+    `- restored: ${plan.summary.restored}`,
     `- removed: ${plan.summary.removed}`
   );
+  if (plan.divergenceSkips && plan.divergenceSkips.length > 0) {
+    lines.push(
+      "",
+      `> ${plan.divergenceSkips.length} template-owned file(s) the instance deleted were left absent because \`biffo.divergence.json\` declares the path an intentional divergence (not restored).`
+    );
+  }
   if (migrations.entries.length > 0) {
     lines.push(
       "",
@@ -2433,6 +2579,7 @@ var STATUS_COLOR = {
   merged: chalk4.yellow,
   "take-theirs": chalk4.green,
   added: chalk4.green,
+  restored: chalk4.green,
   removed: chalk4.red,
   "keep-ours": chalk4.dim
 };
@@ -2525,8 +2672,8 @@ function printBreakingChanges(breaking, applying) {
 }
 function versionOfCheckout(dir, explicit) {
   if (explicit) return explicit;
-  const file = join11(dir, CORE_VERSION_FILE);
-  if (existsSync10(file)) return readCoreVersionFile(file);
+  const file = join12(dir, CORE_VERSION_FILE);
+  if (existsSync11(file)) return readCoreVersionFile(file);
   throw new Error(
     `Cannot determine the core version of ${dir}: it has no ${CORE_VERSION_FILE}, and a checkout supplied explicitly is not resolved from a tag. Pass --to to state which version this tree is.`
   );
@@ -2534,8 +2681,8 @@ function versionOfCheckout(dir, explicit) {
 function latestCoreVersion(repo) {
   const fromTags = latestCoreVersionFromTags(repo);
   if (fromTags) return fromTags;
-  const file = join11(repo, CORE_VERSION_FILE);
-  if (existsSync10(file)) return readCoreVersionFile(file);
+  const file = join12(repo, CORE_VERSION_FILE);
+  if (existsSync11(file)) return readCoreVersionFile(file);
   throw new Error(
     `Cannot determine the template's core version: ${repo} has no core-v* tags and no ${CORE_VERSION_FILE}. Fetch tags (\`git fetch --tags\`) or pass --to explicitly.`
   );
@@ -2553,7 +2700,7 @@ coreCommand.addCommand(coreUpgradeCommand);
 import { Command as Command8 } from "commander";
 
 // src/commands/data-apply.ts
-import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve4 } from "path";
 import chalk5 from "chalk";
 import { Command as Command5 } from "commander";
@@ -2913,62 +3060,62 @@ var AwsAdapter = class {
 };
 
 // src/config/schema.ts
-import { z as z3 } from "zod";
-var AwsConfigSchema = z3.object({
-  account_id: z3.string().regex(/^\d{12}$/, "AWS account ID must be 12 digits").describe("12-digit AWS account ID"),
-  region: z3.string().default("us-east-1"),
-  profile: z3.string().optional(),
-  oidc_role_arn: z3.string().regex(/^arn:aws:iam::\d{12}:role\/.+/, "Must be a valid IAM role ARN").optional(),
-  tf_state_bucket: z3.string().optional()
+import { z as z4 } from "zod";
+var AwsConfigSchema = z4.object({
+  account_id: z4.string().regex(/^\d{12}$/, "AWS account ID must be 12 digits").describe("12-digit AWS account ID"),
+  region: z4.string().default("us-east-1"),
+  profile: z4.string().optional(),
+  oidc_role_arn: z4.string().regex(/^arn:aws:iam::\d{12}:role\/.+/, "Must be a valid IAM role ARN").optional(),
+  tf_state_bucket: z4.string().optional()
 });
-var GitHubConfigSchema = z3.object({
-  org: z3.string().min(1).describe("GitHub organisation or username"),
-  repo: z3.string().min(1).describe("Repository name (will be created)")
+var GitHubConfigSchema = z4.object({
+  org: z4.string().min(1).describe("GitHub organisation or username"),
+  repo: z4.string().min(1).describe("Repository name (will be created)")
 });
-var SourceControlConfigSchema = z3.discriminatedUnion("provider", [
-  z3.object({ provider: z3.literal("github"), config: GitHubConfigSchema })
+var SourceControlConfigSchema = z4.discriminatedUnion("provider", [
+  z4.object({ provider: z4.literal("github"), config: GitHubConfigSchema })
 ]);
-var CloudConfigSchema = z3.discriminatedUnion("provider", [
-  z3.object({ provider: z3.literal("aws"), config: AwsConfigSchema })
+var CloudConfigSchema = z4.discriminatedUnion("provider", [
+  z4.object({ provider: z4.literal("aws"), config: AwsConfigSchema })
 ]);
-var ModulesSchema = z3.object({
-  auth: z3.enum(["cognito"]).default("cognito"),
-  events: z3.enum(["eventbridge"]).default("eventbridge"),
-  storage: z3.enum(["s3"]).default("s3"),
-  database: z3.enum(["postgresql"]).default("postgresql"),
-  compute: z3.enum(["lambda"]).default("lambda"),
-  cdn: z3.enum(["cloudfront"]).default("cloudfront")
+var ModulesSchema = z4.object({
+  auth: z4.enum(["cognito"]).default("cognito"),
+  events: z4.enum(["eventbridge"]).default("eventbridge"),
+  storage: z4.enum(["s3"]).default("s3"),
+  database: z4.enum(["postgresql"]).default("postgresql"),
+  compute: z4.enum(["lambda"]).default("lambda"),
+  cdn: z4.enum(["cloudfront"]).default("cloudfront")
 });
-var DnsSchema = z3.object({
-  mode: z3.enum(["managed-route53", "external", "none"]).default("managed-route53"),
-  domain: z3.string().min(1).optional()
+var DnsSchema = z4.object({
+  mode: z4.enum(["managed-route53", "external", "none"]).default("managed-route53"),
+  domain: z4.string().min(1).optional()
 });
-var BiffoConfigSchema = z3.object({
-  $schema: z3.string().optional(),
-  project: z3.object({
-    name: z3.string().min(1).regex(/^[a-z0-9-]+$/, "Must be lowercase kebab-case"),
-    description: z3.string().default(""),
+var BiffoConfigSchema = z4.object({
+  $schema: z4.string().optional(),
+  project: z4.object({
+    name: z4.string().min(1).regex(/^[a-z0-9-]+$/, "Must be lowercase kebab-case"),
+    description: z4.string().default(""),
     // Backward compatibility for existing configs. New configs should use dns.domain.
-    domain: z3.string().min(1).optional().describe("Primary domain, e.g. myapp.com")
+    domain: z4.string().min(1).optional().describe("Primary domain, e.g. myapp.com")
   }),
   dns: DnsSchema.optional(),
   source_control: SourceControlConfigSchema,
   cloud: CloudConfigSchema,
-  environments: z3.array(z3.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
-  admin: z3.object({
-    email: z3.string().email(),
-    username: z3.string().min(1)
+  environments: z4.array(z4.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
+  admin: z4.object({
+    email: z4.string().email(),
+    username: z4.string().min(1)
   }),
-  database: z3.object({
-    schema_path: z3.string().nullable().default(null),
-    migrations_path: z3.string().default("services/api/migrations")
+  database: z4.object({
+    schema_path: z4.string().nullable().default(null),
+    migrations_path: z4.string().default("services/api/migrations")
   }).default({}),
   modules: ModulesSchema.default({})
 }).superRefine((config, ctx) => {
   const dns = resolveDnsConfig(config);
   if (dns.mode !== "none" && !dns.domain) {
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       path: ["dns", "domain"],
       message: 'DNS domain is required unless dns.mode is "none"'
     });
@@ -3004,16 +3151,16 @@ function isTemplatePlaceholderConfig(raw) {
 
 // src/lib/session.ts
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   rmSync as rmSync6,
   statSync as statSync2,
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 var LEGACY_STEP_ALIASES = {
   github_config: ["github_branches", "github_instance_files", "github_settings"]
 };
@@ -3022,39 +3169,39 @@ function hasCompleted(session, step) {
   return session.completedSteps.some((done) => LEGACY_STEP_ALIASES[done]?.includes(step) ?? false);
 }
 function sessionsDir() {
-  return process.env["BIFFO_SESSIONS_DIR"] ?? join12(homedir(), ".biffo", "sessions");
+  return process.env["BIFFO_SESSIONS_DIR"] ?? join13(homedir(), ".biffo", "sessions");
 }
 function sessionPath(projectName) {
-  return join12(sessionsDir(), `${projectName}.json`);
+  return join13(sessionsDir(), `${projectName}.json`);
 }
 function loadSession(projectName) {
   const path = sessionPath(projectName);
-  if (!existsSync11(path)) return null;
+  if (!existsSync12(path)) return null;
   try {
-    return JSON.parse(readFileSync7(path, "utf8"));
+    return JSON.parse(readFileSync8(path, "utf8"));
   } catch {
     return null;
   }
 }
 function findLatestSession() {
   const dir = sessionsDir();
-  if (!existsSync11(dir)) return null;
+  if (!existsSync12(dir)) return null;
   const files = readdirSync4(dir).filter((f) => f.endsWith(".json"));
   if (files.length === 0) return null;
   const sorted = files.map((f) => {
-    const fullPath = join12(dir, f);
-    const mtime = existsSync11(fullPath) ? statSync2(fullPath).mtimeMs : -1;
+    const fullPath = join13(dir, f);
+    const mtime = existsSync12(fullPath) ? statSync2(fullPath).mtimeMs : -1;
     return { f, mtime };
   }).sort((a, b) => b.mtime - a.mtime);
   try {
-    return JSON.parse(readFileSync7(join12(dir, sorted[0].f), "utf8"));
+    return JSON.parse(readFileSync8(join13(dir, sorted[0].f), "utf8"));
   } catch {
     return null;
   }
 }
 function saveSession(session) {
   const dir = sessionsDir();
-  if (!existsSync11(dir)) mkdirSync4(dir, { recursive: true });
+  if (!existsSync12(dir)) mkdirSync4(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSession(name);
   if (prior) {
@@ -3076,36 +3223,36 @@ function markStepComplete(session, step) {
 }
 function deleteSession(projectName) {
   const path = sessionPath(projectName);
-  if (existsSync11(path)) rmSync6(path);
+  if (existsSync12(path)) rmSync6(path);
 }
 function projectsDir() {
-  return process.env["BIFFO_PROJECTS_DIR"] ?? join12(homedir(), ".biffo", "projects");
+  return process.env["BIFFO_PROJECTS_DIR"] ?? join13(homedir(), ".biffo", "projects");
 }
 function saveProjectConfig(config) {
   const dir = projectsDir();
-  if (!existsSync11(dir)) mkdirSync4(dir, { recursive: true });
-  writeFileSync5(join12(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
+  if (!existsSync12(dir)) mkdirSync4(dir, { recursive: true });
+  writeFileSync5(join13(dir, `${config.project.name}.json`), JSON.stringify(config, null, 2));
 }
 function loadProjectConfig(name) {
-  const path = join12(projectsDir(), `${name}.json`);
-  if (!existsSync11(path)) return null;
+  const path = join13(projectsDir(), `${name}.json`);
+  if (!existsSync12(path)) return null;
   try {
-    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync7(path, "utf8")));
+    const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync8(path, "utf8")));
     return result.success ? result.data : null;
   } catch {
     return null;
   }
 }
 function deleteProjectConfig(name) {
-  const path = join12(projectsDir(), `${name}.json`);
-  if (existsSync11(path)) rmSync6(path);
+  const path = join13(projectsDir(), `${name}.json`);
+  if (existsSync12(path)) rmSync6(path);
 }
 function listProjectConfigs() {
   const dir = projectsDir();
-  if (!existsSync11(dir)) return [];
+  if (!existsSync12(dir)) return [];
   return readdirSync4(dir).filter((f) => f.endsWith(".json")).flatMap((f) => {
     try {
-      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync7(join12(dir, f), "utf8")));
+      const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync8(join13(dir, f), "utf8")));
       return result.success ? [result.data] : [];
     } catch {
       return [];
@@ -3174,7 +3321,7 @@ async function runDataApply(name, environment, config, aws) {
 }
 async function resolveConfig(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync8(resolve4(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync9(resolve4(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -3194,8 +3341,8 @@ async function resolveConfig(options) {
     return cfg;
   }
   const localConfigPath = resolve4(process.cwd(), "biffo.config.json");
-  if (existsSync12(localConfigPath)) {
-    const raw = JSON.parse(readFileSync8(localConfigPath, "utf8"));
+  if (existsSync13(localConfigPath)) {
+    const raw = JSON.parse(readFileSync9(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -3241,8 +3388,8 @@ async function resolveConfig(options) {
 
 // src/commands/data-import.ts
 import { execSync as execSync3 } from "child_process";
-import { cpSync, existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
-import { join as join13, resolve as resolve5 } from "path";
+import { cpSync, existsSync as existsSync14, mkdirSync as mkdirSync5, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { join as join14, resolve as resolve5 } from "path";
 import chalk6 from "chalk";
 import { Command as Command6 } from "commander";
 import inquirer2 from "inquirer";
@@ -3282,23 +3429,23 @@ async function runDataImport(name, options, deps) {
       `Invalid import name '${name}'. Use lowercase letters, numbers, and hyphens, starting with a letter.`
     );
   }
-  const servicesDir = join13(options.cwd, "services");
-  if (!existsSync13(servicesDir)) {
+  const servicesDir = join14(options.cwd, "services");
+  if (!existsSync14(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join13(options.cwd, "db", "imports", name);
-  if (existsSync13(targetDir)) {
+  const targetDir = join14(options.cwd, "db", "imports", name);
+  if (existsSync14(targetDir)) {
     throw new Error(
       `DDL import '${name}' is already present at db/imports/${name}/. Remove it first to re-import.`
     );
   }
-  const isLocalDir = existsSync13(options.source) && statSync3(options.source).isDirectory();
+  const isLocalDir = existsSync14(options.source) && statSync3(options.source).isDirectory();
   let sourceDir;
   let cleanupClone = null;
   if (isLocalDir) {
-    sourceDir = options.path ? join13(options.source, options.path) : options.source;
+    sourceDir = options.path ? join14(options.source, options.path) : options.source;
   } else {
     const token = options.token ?? await resolveDdlImportToken();
     log.info(`Cloning ${options.source}...`);
@@ -3306,10 +3453,10 @@ async function runDataImport(name, options, deps) {
     cleanupClone = () => {
       deps.git.cleanup(tmpDir);
     };
-    sourceDir = options.path ? join13(tmpDir, options.path) : tmpDir;
+    sourceDir = options.path ? join14(tmpDir, options.path) : tmpDir;
   }
   try {
-    if (!existsSync13(sourceDir)) {
+    if (!existsSync14(sourceDir)) {
       throw new Error(`Source directory does not exist: ${sourceDir}`);
     }
     const sqlFiles = readdirSync5(sourceDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".sql")).map((entry) => entry.name).sort();
@@ -3334,7 +3481,7 @@ async function runDataImport(name, options, deps) {
     }
     mkdirSync5(targetDir, { recursive: true });
     for (const file of sqlFiles) {
-      cpSync(join13(sourceDir, file), join13(targetDir, file));
+      cpSync(join14(sourceDir, file), join14(targetDir, file));
     }
     log.success(`Imported ${String(sqlFiles.length)} .sql file(s) to db/imports/${name}/`);
     const commitMessage = `feat(data): import ${name} (${String(sqlFiles.length)} SQL file(s))`;
@@ -3386,8 +3533,8 @@ function printDryRun(name, sqlFiles) {
 }
 
 // src/commands/data-list.ts
-import { existsSync as existsSync14, readdirSync as readdirSync6 } from "fs";
-import { join as join14, resolve as resolve6 } from "path";
+import { existsSync as existsSync15, readdirSync as readdirSync6 } from "fs";
+import { join as join15, resolve as resolve6 } from "path";
 import chalk7 from "chalk";
 import { Command as Command7 } from "commander";
 var dataListCommand = new Command7("list").description("List DDL imports vendored in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -3400,15 +3547,15 @@ var dataListCommand = new Command7("list").description("List DDL imports vendore
   }
 });
 async function runDataList(options) {
-  const importsDir = join14(options.cwd, "db", "imports");
-  if (!existsSync14(importsDir)) {
+  const importsDir = join15(options.cwd, "db", "imports");
+  if (!existsSync15(importsDir)) {
     console.log(chalk7.dim("\n  No DDL imports in this checkout.\n"));
     return;
   }
   const candidates = readdirSync6(importsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
   const imports = [];
   for (const name of candidates) {
-    const fileCount = readdirSync6(join14(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
+    const fileCount = readdirSync6(join15(importsDir, name)).filter((f) => f.endsWith(".sql")).length;
     if (fileCount > 0) imports.push({ name, fileCount });
   }
   if (imports.length === 0) {
@@ -3438,7 +3585,7 @@ dataCommand.addCommand(dataListCommand);
 
 // src/commands/deploy.ts
 import { execSync as execSync4 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync10 } from "fs";
 import { resolve as resolve7 } from "path";
 import chalk8 from "chalk";
 import { Command as Command9 } from "commander";
@@ -3792,7 +3939,7 @@ var deployCommand = new Command9("deploy").description("Deploy infrastructure an
 );
 async function resolveConfig2(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync9(resolve7(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync10(resolve7(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -3812,8 +3959,8 @@ async function resolveConfig2(options) {
     return cfg;
   }
   const localConfigPath = resolve7(process.cwd(), "biffo.config.json");
-  if (existsSync15(localConfigPath)) {
-    const raw = JSON.parse(readFileSync9(localConfigPath, "utf8"));
+  if (existsSync16(localConfigPath)) {
+    const raw = JSON.parse(readFileSync10(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -4197,7 +4344,7 @@ function resolveGithubToken() {
 
 // src/commands/destroy.ts
 import { execSync as execSync5 } from "child_process";
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import { resolve as resolve8 } from "path";
 import chalk9 from "chalk";
 import { Command as Command10 } from "commander";
@@ -4287,7 +4434,7 @@ var destroyCommand = new Command10("destroy").description("Destroy infrastructur
 });
 async function resolveConfig3(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync10(resolve8(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync11(resolve8(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -4307,7 +4454,7 @@ async function resolveConfig3(options) {
     return cfg;
   }
   try {
-    const raw = JSON.parse(readFileSync10(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
+    const raw = JSON.parse(readFileSync11(resolve8(process.cwd(), "biffo.config.json"), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
   } catch {
@@ -4357,15 +4504,15 @@ function resolveGithubToken2() {
 }
 
 // src/commands/init.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 import { resolve as resolve10 } from "path";
 import chalk12 from "chalk";
 import { Command as Command12 } from "commander";
 import inquirer5 from "inquirer";
 
 // src/lib/build-freshness.ts
-import { existsSync as existsSync16, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
-import { dirname as dirname5, join as join15, relative as relative2, sep as sep2 } from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
+import { dirname as dirname5, join as join16, relative as relative2, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var SKIP_ENV_VAR = "BIFFO_SKIP_BUILD_FRESHNESS_CHECK";
 function checkBuildFreshness(options = {}) {
@@ -4379,7 +4526,7 @@ function checkBuildFreshness(options = {}) {
   if (!packageRoot) {
     return { status: "skipped", reason: `no package.json above ${moduleDir}`, newerSources: [] };
   }
-  const distDir = join15(packageRoot, "dist");
+  const distDir = join16(packageRoot, "dist");
   if (!isInside(distDir, moduleDir)) {
     return {
       status: "skipped",
@@ -4387,16 +4534,16 @@ function checkBuildFreshness(options = {}) {
       newerSources: []
     };
   }
-  const srcDir = join15(packageRoot, "src");
-  if (!existsSync16(srcDir)) {
+  const srcDir = join16(packageRoot, "src");
+  if (!existsSync17(srcDir)) {
     return {
       status: "skipped",
       reason: "no src/ alongside dist/ \u2014 this is a shipped package",
       newerSources: []
     };
   }
-  const entry = join15(distDir, "index.js");
-  if (!existsSync16(entry)) {
+  const entry = join16(distDir, "index.js");
+  if (!existsSync17(entry)) {
     return { status: "skipped", reason: `${entry} not found`, newerSources: [] };
   }
   const builtAt = statSync4(entry).mtimeMs;
@@ -4440,7 +4587,7 @@ function collectSourceFiles(srcDir) {
   const found = [];
   const walk = (dir) => {
     for (const entry of readdirSync7(dir, { withFileTypes: true })) {
-      const full = join15(dir, entry.name);
+      const full = join16(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules") continue;
         walk(full);
@@ -4459,7 +4606,7 @@ function collectSourceFiles(srcDir) {
 function findPackageRoot(from) {
   let dir = from;
   for (; ; ) {
-    if (existsSync16(join15(dir, "package.json"))) return dir;
+    if (existsSync17(join16(dir, "package.json"))) return dir;
     const parent = dirname5(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -4473,9 +4620,9 @@ function isInside(parent, child) {
 
 // src/lib/credentials.ts
 import { execSync as execSync6 } from "child_process";
-import { existsSync as existsSync17, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync12 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand2, STSClient as STSClient2 } from "@aws-sdk/client-sts";
 import chalk10 from "chalk";
 import inquirer4 from "inquirer";
@@ -4654,11 +4801,11 @@ async function verifySelectedAwsCredentials(profile, region) {
   return sts.send(new GetCallerIdentityCommand2({}));
 }
 function discoverAwsProfiles() {
-  const files = [join16(homedir2(), ".aws", "credentials"), join16(homedir2(), ".aws", "config")];
+  const files = [join17(homedir2(), ".aws", "credentials"), join17(homedir2(), ".aws", "config")];
   const profiles = /* @__PURE__ */ new Set();
   for (const file of files) {
-    if (!existsSync17(file)) continue;
-    const content = readFileSync11(file, "utf8");
+    if (!existsSync18(file)) continue;
+    const content = readFileSync12(file, "utf8");
     for (const match of content.matchAll(/^\s*\[([^\]]+)\]\s*$/gm)) {
       const section = match[1]?.trim();
       if (!section) continue;
@@ -4683,15 +4830,15 @@ async function resolveRepoIds(github, config) {
 }
 
 // src/config/sibling-schema.ts
-import { z as z4 } from "zod";
-var SiblingConfigSchema = z4.object({
-  $schema: z4.string().optional(),
-  project: z4.object({
-    name: z4.string().min(1).regex(
+import { z as z5 } from "zod";
+var SiblingConfigSchema = z5.object({
+  $schema: z5.string().optional(),
+  project: z5.object({
+    name: z5.string().min(1).regex(
       /^[a-z][a-z0-9-]*$/,
       "Must be lowercase kebab-case, starting with a letter (it becomes a URL path segment)"
     ),
-    description: z4.string().default(""),
+    description: z5.string().default(""),
     // Notable routes this sibling exposes, shown as labelled links on the
     // core project's Microservices tab (ADR-0007). Each `path` is relative to
     // the sibling's own path_prefix (so "demo" renders as /<prefix>/demo), and
@@ -4699,26 +4846,26 @@ var SiblingConfigSchema = z4.object({
     // routes just shows its single root link. Declare real routes here as you
     // build the sibling's pages; the values flow to the core's
     // siblings.auto.tfvars.json at registration and into siblings.json at deploy.
-    routes: z4.array(
-      z4.object({
-        path: z4.string().min(1).regex(
+    routes: z5.array(
+      z5.object({
+        path: z5.string().min(1).regex(
           /^[a-z0-9][a-z0-9/-]*$/,
           'Sub-path relative to the sibling prefix, no leading slash (e.g. "demo" or "apply")'
         ),
-        label: z4.string().min(1)
+        label: z5.string().min(1)
       })
     ).default([])
   }),
   source_control: SourceControlConfigSchema,
   cloud: CloudConfigSchema,
-  environments: z4.array(z4.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
+  environments: z5.array(z5.enum(["dev", "staging", "prod"])).min(1).default(["dev"]),
   // The core project this sibling is paired with (ADR-0007) — never
   // provisions its own Cognito pool or CloudFront distribution, always
   // plugs into the core project's.
-  core: z4.object({
+  core: z5.object({
     // Exactly one of these two must be set — see the superRefine below.
-    project_name: z4.string().min(1).optional().describe("Name of a project previously scaffolded with `biffo init` on this machine"),
-    config_path: z4.string().min(1).optional().describe(
+    project_name: z5.string().min(1).optional().describe("Name of a project previously scaffolded with `biffo init` on this machine"),
+    config_path: z5.string().min(1).optional().describe(
       "Path to the core project's biffo.config.json, for when it wasn't scaffolded here"
     ),
     // Defaults to project.name at parse time by the caller (sibling-create.ts),
@@ -4731,7 +4878,7 @@ var SiblingConfigSchema = z4.object({
     // CDN's default_cache_behavior instead of a pair of ordered behaviours.
     // It still registers under a non-empty reserved name ("app") — see
     // lib/root-sibling.ts for why the two must not be conflated.
-    path_prefix: z4.string().regex(
+    path_prefix: z5.string().regex(
       /^$|^[a-z][a-z0-9-]*$/,
       "Must be lowercase kebab-case, or empty for the root sibling"
     ).optional()
@@ -4739,7 +4886,7 @@ var SiblingConfigSchema = z4.object({
 }).superRefine((config, ctx) => {
   if (!config.core.project_name && !config.core.config_path) {
     ctx.addIssue({
-      code: z4.ZodIssueCode.custom,
+      code: z5.ZodIssueCode.custom,
       path: ["core"],
       message: "Either core.project_name or core.config_path is required"
     });
@@ -4748,34 +4895,34 @@ var SiblingConfigSchema = z4.object({
 
 // src/lib/sibling-session.ts
 import {
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync6,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   rmSync as rmSync7,
   statSync as statSync5,
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 function sessionsDir2() {
-  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join17(homedir3(), ".biffo", "sibling-sessions");
+  return process.env["BIFFO_SIBLING_SESSIONS_DIR"] ?? join18(homedir3(), ".biffo", "sibling-sessions");
 }
 function sessionPath2(projectName) {
-  return join17(sessionsDir2(), `${projectName}.json`);
+  return join18(sessionsDir2(), `${projectName}.json`);
 }
 function loadSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (!existsSync18(path)) return null;
+  if (!existsSync19(path)) return null;
   try {
-    return JSON.parse(readFileSync12(path, "utf8"));
+    return JSON.parse(readFileSync13(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveSiblingSession(session) {
   const dir = sessionsDir2();
-  if (!existsSync18(dir)) mkdirSync6(dir, { recursive: true });
+  if (!existsSync19(dir)) mkdirSync6(dir, { recursive: true });
   const name = session.config.project?.name ?? "unknown";
   const prior = loadSiblingSession(name);
   if (prior) {
@@ -4797,30 +4944,30 @@ function markSiblingStepComplete(session, step) {
 }
 function deleteSiblingSession(projectName) {
   const path = sessionPath2(projectName);
-  if (existsSync18(path)) rmSync7(path);
+  if (existsSync19(path)) rmSync7(path);
 }
 
 // src/commands/sibling-create.ts
-import { cpSync as cpSync2, existsSync as existsSync19, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync20, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname6, join as join19, resolve as resolve9 } from "path";
+import { dirname as dirname6, join as join20, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import chalk11 from "chalk";
 import { Command as Command11 } from "commander";
 
 // src/lib/skeleton-dotfiles.ts
 import { readdirSync as readdirSync9, renameSync } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var PACKAGED_GITIGNORE = "_gitignore";
 var REAL_GITIGNORE = ".gitignore";
 function restorePackagedDotfiles(dir) {
   const restored = [];
   for (const entry of readdirSync9(dir, { withFileTypes: true })) {
-    const full = join18(dir, entry.name);
+    const full = join19(dir, entry.name);
     if (entry.isDirectory()) {
       restored.push(...restorePackagedDotfiles(full));
     } else if (entry.name === PACKAGED_GITIGNORE) {
-      const target = join18(dir, REAL_GITIGNORE);
+      const target = join19(dir, REAL_GITIGNORE);
       renameSync(full, target);
       restored.push(target);
     }
@@ -4865,7 +5012,7 @@ async function runSiblingCreateCommand(name, options) {
     printDryRun2(config, coreConfig, options.templateRoot);
     return;
   }
-  if (!existsSync19(options.templateRoot)) {
+  if (!existsSync20(options.templateRoot)) {
     throw new Error(`Sibling template not found at ${options.templateRoot}`);
   }
   let session = null;
@@ -5050,7 +5197,7 @@ function assertPathPrefixIsAllowed(pathPrefix) {
   }
 }
 function readSiblingConfig(path, root = false) {
-  const raw = JSON.parse(readFileSync13(path, "utf8"));
+  const raw = JSON.parse(readFileSync14(path, "utf8"));
   const withDefaults = raw && typeof raw === "object" && "project" in raw && "core" in raw ? {
     ...raw,
     core: {
@@ -5084,7 +5231,7 @@ function resolveCoreConfig(config, configPath) {
   throw new Error("Either core.project_name or core.config_path is required.");
 }
 function parseCoreConfig(path) {
-  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync13(path, "utf8")));
+  const result = BiffoConfigSchema.safeParse(JSON.parse(readFileSync14(path, "utf8")));
   if (!result.success) {
     throw new Error(
       `Invalid core configuration at ${path}:
@@ -5123,7 +5270,7 @@ async function resolveCoreIdentity(coreAws, coreConfig, environments) {
   return coreIdentity;
 }
 async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, githubToken) {
-  const workDir = mkdtempSync4(join19(tmpdir4(), `biffo-sibling-${config.project.name}-`));
+  const workDir = mkdtempSync4(join20(tmpdir4(), `biffo-sibling-${config.project.name}-`));
   try {
     writeSiblingTemplate(skeletonRoot, workDir, config, {
       coreProjectName: coreConfig.project.name,
@@ -5139,13 +5286,13 @@ async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, git
   }
 }
 function writeSiblingTemplate(templateRoot, targetDir, config, context) {
-  if (!existsSync19(templateRoot)) {
+  if (!existsSync20(templateRoot)) {
     throw new Error(`Sibling template not found at ${templateRoot}`);
   }
   cpSync2(templateRoot, targetDir, { recursive: true });
   restorePackagedDotfiles(targetDir);
   writeFileSync7(
-    join19(targetDir, "biffo.sibling.json"),
+    join20(targetDir, "biffo.sibling.json"),
     JSON.stringify(
       {
         name: config.project.name,
@@ -5161,10 +5308,10 @@ function writeSiblingTemplate(templateRoot, targetDir, config, context) {
       2
     ) + "\n"
   );
-  const envPath = join19(targetDir, "apps", "frontend", ".env.example");
+  const envPath = join20(targetDir, "apps", "frontend", ".env.example");
   try {
     const path = basePathFor(context.pathPrefix);
-    const content = readFileSync13(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
+    const content = readFileSync14(envPath, "utf8").replace(/^NEXT_PUBLIC_SIBLING_NAME=.*$/m, `NEXT_PUBLIC_SIBLING_NAME=${config.project.name}`).replace(/^NEXT_PUBLIC_SIBLING_PATH_PREFIX=.*$/m, `NEXT_PUBLIC_SIBLING_PATH_PREFIX=${path}`).replace(/^NEXT_PUBLIC_BASE_PATH=.*$/m, `NEXT_PUBLIC_BASE_PATH=${path}`);
     writeFileSync7(envPath, content);
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
@@ -5210,17 +5357,17 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
 }
 function readExistingSiblingOrigins(filePath) {
   try {
-    return JSON.parse(readFileSync13(filePath, "utf8"));
+    return JSON.parse(readFileSync14(filePath, "utf8"));
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw err;
   }
 }
 function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x") {
-  const cdnVarsPath = join19(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
+  const cdnVarsPath = join20(cloneDir, "modules", "cloud", "aws", "cdn", "variables.tf");
   let declaresSiblingOrigins = false;
   try {
-    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync13(cdnVarsPath, "utf8"));
+    declaresSiblingOrigins = /variable\s+"sibling_origins"/.test(readFileSync14(cdnVarsPath, "utf8"));
   } catch {
     declaresSiblingOrigins = false;
   }
@@ -5230,10 +5377,10 @@ function assertCoreSupportsSiblingRouting(cloneDir, coreRepo, pathPrefix = "x")
     );
   }
   if (!isRootPathPrefix(pathPrefix)) return;
-  const cdnMainPath = join19(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
+  const cdnMainPath = join20(cloneDir, "modules", "cloud", "aws", "cdn", "main.tf");
   let supportsRoot = false;
   try {
-    supportsRoot = /root_sibling_registered/.test(readFileSync13(cdnMainPath, "utf8"));
+    supportsRoot = /root_sibling_registered/.test(readFileSync14(cdnMainPath, "utf8"));
   } catch {
     supportsRoot = false;
   }
@@ -5263,8 +5410,8 @@ async function registerWithCore(git, github, config, coreConfig, pathPrefix, git
     for (const env of config.environments) {
       const bucketName = siteBucketName(config.project.name, env, siblingAccountId);
       const domain = bucketRegionalDomain(bucketName, coreAwsRegion);
-      const relativePath = join19("infra", "environments", env, "siblings.auto.tfvars.json");
-      const filePath = join19(cloneDir, relativePath);
+      const relativePath = join20("infra", "environments", env, "siblings.auto.tfvars.json");
+      const filePath = join20(cloneDir, relativePath);
       const existing = readExistingSiblingOrigins(filePath);
       const siblings = upsertSiblingOrigin(existing.sibling_origins ?? [], {
         name,
@@ -5344,8 +5491,8 @@ function defaultSiblingTemplateRoot() {
   const start = dirname6(fileURLToPath4(import.meta.url));
   let dir = start;
   for (; ; ) {
-    const candidate = join19(dir, "_skeletons", "sibling-template");
-    if (existsSync19(candidate)) return candidate;
+    const candidate = join20(dir, "_skeletons", "sibling-template");
+    if (existsSync20(candidate)) return candidate;
     const parent = dirname6(dir);
     if (parent === dir) break;
     dir = parent;
@@ -5369,7 +5516,7 @@ var initCommand = new Command12("init").description("Scaffold a new project from
     let config;
     let githubToken;
     if (options.config) {
-      const rawConfig = JSON.parse(readFileSync14(resolve10(options.config), "utf8"));
+      const rawConfig = JSON.parse(readFileSync15(resolve10(options.config), "utf8"));
       config = parseConfig(rawConfig);
       const { account_id: accountId, region } = config.cloud.config;
       session = resolveConfigFileSession(config, accountId, region, options.fresh === true);
@@ -5802,28 +5949,28 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 import { Command as Command20 } from "commander";
 
 // src/commands/plugin-create.ts
-import { existsSync as existsSync22, readFileSync as readFileSync16 } from "fs";
-import { dirname as dirname8, join as join22, resolve as resolve11 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync17 } from "fs";
+import { dirname as dirname8, join as join23, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import chalk13 from "chalk";
 import { Command as Command13 } from "commander";
 
 // src/lib/plugin-locations.ts
-import { existsSync as existsSync20, readdirSync as readdirSync10 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync10 } from "fs";
+import { join as join21 } from "path";
 var FIRST_PARTY_PLUGINS_DIR = "_plugins";
 var PLUGIN_MANIFEST_FILE = "biffo.plugin.json";
 function pluginDir(name, channel) {
   return channel === "first-party" ? `services/${FIRST_PARTY_PLUGINS_DIR}/${name}` : `services/${name}`;
 }
 function scanDir(absDir, relDir, channel) {
-  if (!existsSync20(absDir)) return [];
+  if (!existsSync21(absDir)) return [];
   const found = [];
   for (const entry of readdirSync10(absDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     if (channel === "third-party" && entry.name === FIRST_PARTY_PLUGINS_DIR) continue;
-    const manifestPath = join20(absDir, entry.name, PLUGIN_MANIFEST_FILE);
-    if (!existsSync20(manifestPath)) continue;
+    const manifestPath = join21(absDir, entry.name, PLUGIN_MANIFEST_FILE);
+    if (!existsSync21(manifestPath)) continue;
     found.push({
       dirName: entry.name,
       relDir: `${relDir}/${entry.name}`,
@@ -5834,11 +5981,11 @@ function scanDir(absDir, relDir, channel) {
   return found;
 }
 function findInstalledPlugins(cwd) {
-  const servicesDir = join20(cwd, "services");
+  const servicesDir = join21(cwd, "services");
   return [
     ...scanDir(servicesDir, "services", "third-party"),
     ...scanDir(
-      join20(servicesDir, FIRST_PARTY_PLUGINS_DIR),
+      join21(servicesDir, FIRST_PARTY_PLUGINS_DIR),
       `services/${FIRST_PARTY_PLUGINS_DIR}`,
       "first-party"
     )
@@ -5846,46 +5993,46 @@ function findInstalledPlugins(cwd) {
 }
 
 // src/lib/plugin-manifest.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["id", "tenant_id", "created_at", "updated_at"]);
 var COLUMN_TYPE_PATTERN = /^(String|Integer|Text|Boolean|Float|DateTime)(\(.*\))?$/;
-var ColumnDefinitionSchema = z5.object({
-  name: z5.string().refine(
+var ColumnDefinitionSchema = z6.object({
+  name: z6.string().refine(
     (n) => !RESERVED_COLUMN_NAMES.has(n),
     (n) => ({
       message: `Column '${n}' is reserved and added automatically; it must not be declared in the manifest.`
     })
   ),
-  type: z5.string().regex(
+  type: z6.string().regex(
     COLUMN_TYPE_PATTERN,
     "must be one of String, Integer, Text, Boolean, Float, DateTime (e.g. 'String(255)')"
   ),
-  primary_key: z5.boolean().default(false),
-  nullable: z5.boolean().default(false),
-  index: z5.boolean().default(false),
-  default: z5.string().optional(),
-  description: z5.string().default("")
+  primary_key: z6.boolean().default(false),
+  nullable: z6.boolean().default(false),
+  index: z6.boolean().default(false),
+  default: z6.string().optional(),
+  description: z6.string().default("")
 });
-var IndexDefinitionSchema = z5.object({
-  name: z5.string(),
-  columns: z5.array(z5.string()).min(1),
-  unique: z5.boolean().default(false)
+var IndexDefinitionSchema = z6.object({
+  name: z6.string(),
+  columns: z6.array(z6.string()).min(1),
+  unique: z6.boolean().default(false)
 });
-var PermissionRuleSchema = z5.object({
-  allowed: z5.boolean().default(false),
-  required_role: z5.array(z5.string()).default([])
+var PermissionRuleSchema = z6.object({
+  allowed: z6.boolean().default(false),
+  required_role: z6.array(z6.string()).default([])
 }).strict();
-var TablePermissionsSchema = z5.object({
+var TablePermissionsSchema = z6.object({
   list: PermissionRuleSchema.default({}),
   read: PermissionRuleSchema.default({}),
   create: PermissionRuleSchema.default({}),
   update: PermissionRuleSchema.default({}),
   delete: PermissionRuleSchema.default({})
 }).strict();
-var TableDefinitionSchema = z5.object({
-  name: z5.string().regex(/^[a-z][a-z0-9_]*$/, "table name must be snake_case, e.g. rbac_roles"),
-  columns: z5.array(ColumnDefinitionSchema).default([]),
-  indexes: z5.array(IndexDefinitionSchema).default([]),
+var TableDefinitionSchema = z6.object({
+  name: z6.string().regex(/^[a-z][a-z0-9_]*$/, "table name must be snake_case, e.g. rbac_roles"),
+  columns: z6.array(ColumnDefinitionSchema).default([]),
+  indexes: z6.array(IndexDefinitionSchema).default([]),
   permissions: TablePermissionsSchema.default({})
 }).superRefine((table, ctx) => {
   const colCounts = /* @__PURE__ */ new Map();
@@ -5893,7 +6040,7 @@ var TableDefinitionSchema = z5.object({
   for (const [name, count] of colCounts) {
     if (count > 1) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         message: `Duplicate column name '${name}' in table '${table.name}'`
       });
     }
@@ -5903,7 +6050,7 @@ var TableDefinitionSchema = z5.object({
   for (const [name, count] of idxCounts) {
     if (count > 1) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         message: `Duplicate index name '${name}' in table '${table.name}'`
       });
     }
@@ -5913,7 +6060,7 @@ var TableDefinitionSchema = z5.object({
     for (const col of idx.columns) {
       if (!validColumns.has(col)) {
         ctx.addIssue({
-          code: z5.ZodIssueCode.custom,
+          code: z6.ZodIssueCode.custom,
           message: `Index '${idx.name}' on table '${table.name}' references unknown column '${col}'`
         });
       }
@@ -5928,17 +6075,17 @@ var OPERATION_METHODS = {
   delete: /* @__PURE__ */ new Set(["DELETE"])
 };
 var SINGLE_ROW_OPERATIONS = /* @__PURE__ */ new Set(["read", "update", "delete"]);
-var RouteDefSchema = z5.object({
-  method: z5.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
-  path: z5.string().startsWith("/", "path must start with '/'"),
-  table: z5.string(),
-  operation: z5.enum(["list", "read", "create", "update", "delete"]),
-  description: z5.string().default("")
+var RouteDefSchema = z6.object({
+  method: z6.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
+  path: z6.string().startsWith("/", "path must start with '/'"),
+  table: z6.string(),
+  operation: z6.enum(["list", "read", "create", "update", "delete"]),
+  description: z6.string().default("")
 }).superRefine((route, ctx) => {
   const allowed = OPERATION_METHODS[route.operation];
   if (allowed && !allowed.has(route.method)) {
     ctx.addIssue({
-      code: z5.ZodIssueCode.custom,
+      code: z6.ZodIssueCode.custom,
       message: `operation '${route.operation}' requires method in [${[...allowed].sort().join(", ")}], got '${route.method}'`
     });
   }
@@ -5946,38 +6093,38 @@ var RouteDefSchema = z5.object({
   const needsId = SINGLE_ROW_OPERATIONS.has(route.operation);
   if (needsId && !hasId) {
     ctx.addIssue({
-      code: z5.ZodIssueCode.custom,
+      code: z6.ZodIssueCode.custom,
       message: `operation '${route.operation}' addresses a single row and requires an '{id}' path parameter: ${route.path}`
     });
   }
   if (!needsId && hasId) {
     ctx.addIssue({
-      code: z5.ZodIssueCode.custom,
+      code: z6.ZodIssueCode.custom,
       message: `operation '${route.operation}' is collection-level and must not have an '{id}' path parameter: ${route.path}`
     });
   }
 });
-var PluginManifestSchema = z5.object({
-  name: z5.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
-  version: z5.string().regex(/^\d+\.\d+\.\d+$/, "must be a full semver, e.g. 1.2.3"),
-  description: z5.string().default(""),
-  author: z5.string().default("Biffo Team"),
-  tags: z5.array(z5.string()).default([]),
-  tables: z5.array(TableDefinitionSchema).default([]),
-  api_routes: z5.array(RouteDefSchema).default([]),
+var PluginManifestSchema = z6.object({
+  name: z6.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
+  version: z6.string().regex(/^\d+\.\d+\.\d+$/, "must be a full semver, e.g. 1.2.3"),
+  description: z6.string().default(""),
+  author: z6.string().default("Biffo Team"),
+  tags: z6.array(z6.string()).default([]),
+  tables: z6.array(TableDefinitionSchema).default([]),
+  api_routes: z6.array(RouteDefSchema).default([]),
   // Events the plugin reacts to. Parsed (rather than dropped as an unknown
   // key) so `biffo plugin install` can warn when a plugin declares
   // subscriptions but ships no terraform/ to route them — see #194 and
   // lib/plugin-terraform-guard.ts. Kept loose deliberately: the authoritative
   // schema is the registry's, and this consumer only needs to count them.
-  event_subscriptions: z5.array(z5.object({ source: z5.string(), detail_type: z5.string() }).passthrough()).default([]),
-  required_core_version: z5.string().default(">=0.0.0")
+  event_subscriptions: z6.array(z6.object({ source: z6.string(), detail_type: z6.string() }).passthrough()).default([]),
+  required_core_version: z6.string().default(">=0.0.0")
 }).superRefine((manifest, ctx) => {
   const tableNames = new Set(manifest.tables.map((t) => t.name));
   for (const route of manifest.api_routes) {
     if (!tableNames.has(route.table)) {
       ctx.addIssue({
-        code: z5.ZodIssueCode.custom,
+        code: z6.ZodIssueCode.custom,
         message: `Route ${route.method} ${route.path} references table '${route.table}', which is not declared in this manifest's 'tables' (${[...tableNames].sort().join(", ") || "none"})`
       });
     }
@@ -5998,13 +6145,13 @@ function validateManifest(raw) {
 // src/lib/plugin-scaffold.ts
 import {
   copyFileSync,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync15,
+  readFileSync as readFileSync16,
   readdirSync as readdirSync11,
   writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname7, join as join21 } from "path";
+import { dirname as dirname7, join as join22 } from "path";
 var STANDALONE_ONLY_ENTRIES = {
   ".github": "standalone-repo CI/release workflows \u2014 the host monorepo already runs lint/type/test/security over services/",
   "registry-schema.json": "the plugin-registry publishing schema, used when submitting a *published* plugin to the registry repo, not by an in-tree plugin"
@@ -6057,10 +6204,10 @@ function applySubstitutions(text, names) {
 }
 var BINARY_EXTENSIONS = /\.(png|jpe?g|gif|ico|woff2?|ttf|zip|gz)$/i;
 function scaffoldPlugin(skeletonRoot, destDir, names) {
-  if (!existsSync21(skeletonRoot)) {
+  if (!existsSync22(skeletonRoot)) {
     throw new Error(`Plugin skeleton not found at ${skeletonRoot}`);
   }
-  if (!existsSync21(join21(skeletonRoot, "terraform"))) {
+  if (!existsSync22(join22(skeletonRoot, "terraform"))) {
     throw new Error(
       `Plugin skeleton at ${skeletonRoot} has no terraform/ directory. Refusing to scaffold a plugin that cannot receive events (issue #194) \u2014 the skeleton is broken.`
     );
@@ -6068,7 +6215,7 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
   const skipped = [];
   const files = [];
   const walk = (relDir) => {
-    const absDir = join21(skeletonRoot, relDir);
+    const absDir = join22(skeletonRoot, relDir);
     for (const entry of readdirSync11(absDir, { withFileTypes: true }).sort(
       (a, b) => a.name.localeCompare(b.name)
     )) {
@@ -6083,14 +6230,14 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
         continue;
       }
       const destRel = applySubstitutions(relPath, names);
-      const destPath = join21(destDir, destRel);
+      const destPath = join22(destDir, destRel);
       mkdirSync8(dirname7(destPath), { recursive: true });
       if (BINARY_EXTENSIONS.test(entry.name)) {
-        copyFileSync(join21(skeletonRoot, relPath), destPath);
+        copyFileSync(join22(skeletonRoot, relPath), destPath);
       } else {
         writeFileSync8(
           destPath,
-          applySubstitutions(readFileSync15(join21(skeletonRoot, relPath), "utf8"), names)
+          applySubstitutions(readFileSync16(join22(skeletonRoot, relPath), "utf8"), names)
         );
       }
       files.push(destRel);
@@ -6107,8 +6254,8 @@ function scaffoldPlugin(skeletonRoot, destDir, names) {
 function findSkeletonRoot(startDir, skeleton) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join21(dir, "_skeletons", skeleton);
-    if (existsSync21(candidate)) return candidate;
+    const candidate = join22(dir, "_skeletons", skeleton);
+    if (existsSync22(candidate)) return candidate;
     const parent = dirname7(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -6145,7 +6292,7 @@ var pluginCreateCommand = new Command13("create").description("Scaffold a new pl
 );
 async function runPluginCreate(name, options, deps) {
   const names = deriveNames(name);
-  const isInstance = existsSync22(join22(options.cwd, INSTANCE_CORE_FILE));
+  const isInstance = existsSync23(join23(options.cwd, INSTANCE_CORE_FILE));
   if (options.firstParty && isInstance) {
     throw new Error(
       `--first-party scaffolds into services/_plugins/, which is template-owned: \`biffo core upgrade\` three-way-merges it against the template on every upgrade, and the template has no '${names.slug}'. This checkout is a Biffo instance (${INSTANCE_CORE_FILE} is present), so your plugin belongs in the user-owned ${pluginDir(names.slug, "third-party")}/ \u2014 re-run without --first-party.`
@@ -6153,19 +6300,19 @@ async function runPluginCreate(name, options, deps) {
   }
   const channel = options.firstParty ? "first-party" : "third-party";
   const relDir = pluginDir(names.slug, channel);
-  const destDir = join22(options.cwd, relDir);
-  const servicesDir = join22(options.cwd, "services");
-  if (!existsSync22(servicesDir)) {
+  const destDir = join23(options.cwd, relDir);
+  const servicesDir = join23(options.cwd, "services");
+  if (!existsSync23(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  if (existsSync22(destDir)) {
+  if (existsSync23(destDir)) {
     throw new Error(`${relDir}/ already exists. Choose a different name, or remove it first.`);
   }
   const here = dirname8(fileURLToPath5(import.meta.url));
-  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join22(options.cwd, "_skeletons", "plugin-template");
-  if (!existsSync22(skeletonRoot)) {
+  const skeletonRoot = options.skeletonRoot ?? findSkeletonRoot(here, "plugin-template") ?? join23(options.cwd, "_skeletons", "plugin-template");
+  if (!existsSync23(skeletonRoot)) {
     throw new Error(
       `Could not find the plugin skeleton (_skeletons/plugin-template/). Pass --skeleton <path> to point at it explicitly.`
     );
@@ -6180,8 +6327,8 @@ async function runPluginCreate(name, options, deps) {
   for (const { entry, reason } of skipped) {
     log.info(`Skipped ${entry} \u2014 ${reason}`);
   }
-  const manifestPath = join22(destDir, "biffo.plugin.json");
-  const manifest = validateManifest(JSON.parse(readFileSync16(manifestPath, "utf8")));
+  const manifestPath = join23(destDir, "biffo.plugin.json");
+  const manifest = validateManifest(JSON.parse(readFileSync17(manifestPath, "utf8")));
   if (manifest.name !== names.slug) {
     throw new Error(
       `Scaffolded manifest declares name '${manifest.name}', expected '${names.slug}'. The skeleton's manifest name may have diverged from 'example-plugin'.`
@@ -6237,25 +6384,25 @@ import chalk14 from "chalk";
 import { Command as Command14 } from "commander";
 
 // src/adapters/registry/index.ts
-import { z as z6 } from "zod";
-var RegistryPluginEntrySchema = z6.object({
-  name: z6.string().regex(/^[a-z][a-z0-9-]*$/),
-  version: z6.string().regex(/^\d+\.\d+\.\d+$/),
-  minor_version: z6.string().regex(/^\d+\.\d+$/),
-  repo: z6.string().url(),
-  description: z6.string().optional(),
-  author: z6.string().optional(),
-  tags: z6.array(z6.string()).optional(),
-  required_core_version: z6.string().optional(),
-  infra_modules: z6.array(z6.string()).optional(),
-  api_routes: z6.array(z6.string()).optional(),
-  ui_components: z6.array(z6.string()).optional(),
-  status: z6.enum(["active", "disabled"])
+import { z as z7 } from "zod";
+var RegistryPluginEntrySchema = z7.object({
+  name: z7.string().regex(/^[a-z][a-z0-9-]*$/),
+  version: z7.string().regex(/^\d+\.\d+\.\d+$/),
+  minor_version: z7.string().regex(/^\d+\.\d+$/),
+  repo: z7.string().url(),
+  description: z7.string().optional(),
+  author: z7.string().optional(),
+  tags: z7.array(z7.string()).optional(),
+  required_core_version: z7.string().optional(),
+  infra_modules: z7.array(z7.string()).optional(),
+  api_routes: z7.array(z7.string()).optional(),
+  ui_components: z7.array(z7.string()).optional(),
+  status: z7.enum(["active", "disabled"])
 });
-var PluginRegistrySchema = z6.object({
-  schema_version: z6.string(),
-  last_updated: z6.string(),
-  plugins: z6.array(RegistryPluginEntrySchema)
+var PluginRegistrySchema = z7.object({
+  schema_version: z7.string(),
+  last_updated: z7.string(),
+  plugins: z7.array(RegistryPluginEntrySchema)
 });
 var DEFAULT_REGISTRY_URL = "https://raw.githubusercontent.com/keiranholloway/biffo-plugins-registry/main/plugins.json";
 var RegistryAdapter = class {
@@ -6371,14 +6518,14 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync3, existsSync as existsSync23, mkdirSync as mkdirSync9, readFileSync as readFileSync17, statSync as statSync6 } from "fs";
-import { basename, join as join24, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync24, mkdirSync as mkdirSync9, readFileSync as readFileSync18, statSync as statSync6 } from "fs";
+import { basename, join as join25, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
 // src/adapters/plugin-migrations/index.ts
 import { execa as execa4 } from "execa";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var PluginMigrationsAdapter = class {
   /**
    * Generates migration file(s) for `pluginNames` (every discovered
@@ -6387,22 +6534,22 @@ var PluginMigrationsAdapter = class {
    * or declared no tables.
    */
   async generate(cwd, pluginNames) {
-    const scriptPath = join23(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
+    const scriptPath = join24(cwd, "services", "api", "scripts", "generate_plugin_migrations.py");
     const args = [
       "run",
       "python",
       scriptPath,
       "--services-root",
-      join23(cwd, "services"),
+      join24(cwd, "services"),
       "--versions-dir",
-      join23(cwd, "services", "api", "migrations", "versions")
+      join24(cwd, "services", "api", "migrations", "versions")
     ];
     for (const name of pluginNames ?? []) {
       args.push("--plugin", name);
     }
     let result;
     try {
-      result = await execa4("uv", args, { cwd: join23(cwd, "services", "api") });
+      result = await execa4("uv", args, { cwd: join24(cwd, "services", "api") });
     } catch (err) {
       const cause = err;
       if (cause.code === "ENOENT") {
@@ -6460,14 +6607,14 @@ var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".terraform"
 ]);
 function resolveLocalPlugin(localPath) {
-  if (!existsSync23(localPath)) {
+  if (!existsSync24(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync6(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join24(localPath, "biffo.plugin.json");
-  if (!existsSync23(manifestPath)) {
+  const manifestPath = join25(localPath, "biffo.plugin.json");
+  if (!existsSync24(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -6493,8 +6640,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join24(tmpDir, "biffo.plugin.json");
-    if (!existsSync23(manifestPath)) {
+    const manifestPath = join25(tmpDir, "biffo.plugin.json");
+    if (!existsSync24(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -6522,8 +6669,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join24(options.cwd, "services");
-  if (!existsSync23(servicesDir)) {
+  const servicesDir = join25(options.cwd, "services");
+  if (!existsSync24(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -6541,10 +6688,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join24(options.cwd, relTargetDir);
-  const modulesDir = join24(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join25(options.cwd, relTargetDir);
+  const modulesDir = join25(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync23(targetDir) && !inTreeSource) {
+  if (existsSync24(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -6587,8 +6734,8 @@ async function runPluginInstall(target, options, deps) {
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join24(targetDir, "terraform");
-    if (existsSync23(tfSourceDir)) {
+    const tfSourceDir = join25(targetDir, "terraform");
+    if (existsSync24(tfSourceDir)) {
       mkdirSync9(modulesDir, { recursive: true });
       cpSync3(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
@@ -6645,7 +6792,7 @@ async function runPluginInstall(target, options, deps) {
 }
 function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync17(path, "utf8"));
+    return JSON.parse(readFileSync18(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
@@ -6682,8 +6829,8 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync24, readFileSync as readFileSync18 } from "fs";
-import { join as join25, resolve as resolve13 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync19 } from "fs";
+import { join as join26, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -6696,8 +6843,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join25(options.cwd, "services");
-  if (!existsSync24(servicesDir)) {
+  const servicesDir = join26(options.cwd, "services");
+  if (!existsSync25(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -6705,7 +6852,7 @@ async function runPluginList(options) {
   const plugins = [];
   for (const location of findInstalledPlugins(options.cwd)) {
     try {
-      const manifest = validateManifest(JSON.parse(readFileSync18(location.manifestPath, "utf8")));
+      const manifest = validateManifest(JSON.parse(readFileSync19(location.manifestPath, "utf8")));
       plugins.push({
         name: manifest.name,
         version: manifest.version,
@@ -6742,8 +6889,8 @@ async function runPluginList(options) {
 }
 
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync25 } from "fs";
-import { join as join26, relative as relative4, resolve as resolve14 } from "path";
+import { existsSync as existsSync26 } from "fs";
+import { join as join27, relative as relative4, resolve as resolve14 } from "path";
 import chalk17 from "chalk";
 import { Command as Command17 } from "commander";
 var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
@@ -6764,11 +6911,11 @@ var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join26(options.cwd, "services");
-  if (!existsSync25(servicesDir)) {
+  const servicesDir = join27(options.cwd, "services");
+  if (!existsSync26(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync25(join26(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync26(join27(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -6804,8 +6951,8 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync26, readFileSync as readFileSync19, rmSync as rmSync8 } from "fs";
-import { join as join27, resolve as resolve15 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync20, rmSync as rmSync8 } from "fs";
+import { join as join28, resolve as resolve15 } from "path";
 import chalk18 from "chalk";
 import { Command as Command18 } from "commander";
 import inquirer6 from "inquirer";
@@ -6837,16 +6984,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join27(options.cwd, "services");
-  if (!existsSync26(servicesDir)) {
+  const servicesDir = join28(options.cwd, "services");
+  if (!existsSync27(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join27(servicesDir, name);
-  if (!existsSync26(targetDir)) {
-    const firstParty = join27(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync26(firstParty)) {
+  const targetDir = join28(servicesDir, name);
+  if (!existsSync27(targetDir)) {
+    const firstParty = join28(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync27(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -6854,9 +7001,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join27(options.cwd, "modules", "plugins", name);
+  const modulesDir = join28(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync26(modulesDir)) {
+  if (existsSync27(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -6878,7 +7025,7 @@ async function runPluginUninstall(name, options, deps) {
   }
   rmSync8(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync26(modulesDir)) {
+  if (existsSync27(modulesDir)) {
     rmSync8(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
@@ -6915,10 +7062,10 @@ async function runPluginUninstall(name, options, deps) {
   }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join27(targetDir, "biffo.plugin.json");
-  if (!existsSync26(manifestPath)) return void 0;
+  const manifestPath = join28(targetDir, "biffo.plugin.json");
+  if (!existsSync27(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync19(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync20(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -6951,8 +7098,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync4, existsSync as existsSync27, mkdirSync as mkdirSync10, readFileSync as readFileSync20, rmSync as rmSync9 } from "fs";
-import { join as join28, relative as relative5, resolve as resolve16 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync28, mkdirSync as mkdirSync10, readFileSync as readFileSync21, rmSync as rmSync9 } from "fs";
+import { join as join29, relative as relative5, resolve as resolve16 } from "path";
 import chalk19 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer7 from "inquirer";
@@ -6977,14 +7124,14 @@ var pluginUpgradeCommand = new Command19("upgrade").description(
 });
 async function runPluginUpgrade(target, options, deps) {
   const { name, minor } = parsePluginTarget(target);
-  const servicesDir = join28(options.cwd, "services");
-  if (!existsSync27(servicesDir)) {
+  const servicesDir = join29(options.cwd, "services");
+  if (!existsSync28(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join28(servicesDir, name);
-  if (!existsSync27(targetDir)) {
+  const targetDir = join29(servicesDir, name);
+  if (!existsSync28(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -6998,7 +7145,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join28(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join29(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -7031,11 +7178,11 @@ async function runPluginUpgrade(target, options, deps) {
     cpSync4(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync27(modulesDir)) {
+    if (existsSync28(modulesDir)) {
       rmSync9(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join28(targetDir, "terraform");
-    if (existsSync27(tfSourceDir)) {
+    const tfSourceDir = join29(targetDir, "terraform");
+    if (existsSync28(tfSourceDir)) {
       mkdirSync10(modulesDir, { recursive: true });
       cpSync4(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
@@ -7069,10 +7216,10 @@ async function runPluginUpgrade(target, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join28(targetDir, "biffo.plugin.json");
-  if (!existsSync27(manifestPath)) return void 0;
+  const manifestPath = join29(targetDir, "biffo.plugin.json");
+  if (!existsSync28(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync20(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync21(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -7122,90 +7269,6 @@ import { Command as Command22 } from "commander";
 
 // src/scripts/check-core-ownership.ts
 import { execa as execa5 } from "execa";
-
-// src/lib/core-ownership-guard.ts
-import { existsSync as existsSync28, readFileSync as readFileSync21 } from "fs";
-import { join as join29 } from "path";
-import { z as z7 } from "zod";
-var DIVERGENCE_FILE = "biffo.divergence.json";
-var DivergenceEntrySchema = z7.object({
-  prefix: z7.string().min(1),
-  reason: z7.string().min(1),
-  upstream: z7.string().min(1)
-});
-var DivergenceConfigSchema = z7.object({
-  note: z7.string().optional(),
-  warnOnly: z7.array(DivergenceEntrySchema).default([])
-});
-function readDivergenceConfig(repoRoot) {
-  const path = join29(repoRoot, DIVERGENCE_FILE);
-  if (!existsSync28(path)) return { warnOnly: [] };
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync21(path, "utf8"));
-  } catch (err) {
-    throw new Error(`${DIVERGENCE_FILE} is not valid JSON: ${err.message}`);
-  }
-  const parsed = DivergenceConfigSchema.safeParse(raw);
-  if (!parsed.success) {
-    const issues = parsed.error.issues.map((i) => `  ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
-    throw new Error(`${DIVERGENCE_FILE} is invalid:
-${issues}`);
-  }
-  return parsed.data;
-}
-function parseDivergenceTrailer(commitMessage) {
-  const body = commitMessage.split("\n").filter((line) => !line.startsWith("#")).join("\n");
-  const match = /^Core-Divergence:[ \t]*(\S.*?)[ \t]*$/m.exec(body);
-  return match?.[1] ?? null;
-}
-function resolveBranch(env, gitBranch) {
-  return (env["GITHUB_HEAD_REF"] || env["GITHUB_REF_NAME"] || gitBranch).trim();
-}
-function parseNameStatus(stdout) {
-  const changed = [];
-  const deleted = [];
-  for (const line of stdout.split("\n")) {
-    const parts = line.split("	").filter(Boolean);
-    const status = parts[0];
-    const path = parts[parts.length - 1];
-    if (!status || !path || parts.length < 2) continue;
-    changed.push(path);
-    if (status.startsWith("D")) deleted.push(path);
-  }
-  return { changed, deleted };
-}
-function checkCoreOwnership({
-  changedFiles,
-  manifest,
-  isInstance,
-  branch = "",
-  commitMessage = "",
-  warnOnly = []
-}) {
-  const empty = { blocked: [], warned: [], divergenceReason: null };
-  if (!isInstance) return { skipped: "template", ...empty };
-  if (branch.startsWith(UPGRADE_BRANCH_PREFIX)) return { skipped: "upgrade-branch", ...empty };
-  const templateOwned = changedFiles.filter((f) => isTemplateOwned(f, manifest));
-  const acknowledged = (path) => warnOnly.filter((entry) => path.startsWith(entry.prefix)).reduce(
-    (best, entry) => !best || entry.prefix.length > best.prefix.length ? entry : best,
-    void 0
-  );
-  const warned = [];
-  const offending = [];
-  for (const path of templateOwned) {
-    const entry = acknowledged(path);
-    if (entry) warned.push({ path, entry });
-    else offending.push(path);
-  }
-  const divergenceReason = parseDivergenceTrailer(commitMessage);
-  if (offending.length > 0 && divergenceReason !== null) {
-    return { skipped: "divergence-trailer", blocked: [], warned, divergenceReason };
-  }
-  return { skipped: null, blocked: offending, warned, divergenceReason: null };
-}
-
-// src/scripts/check-core-ownership.ts
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -7276,6 +7339,12 @@ async function runOwnershipCheck(argv) {
     );
     return;
   }
+  if (result.skipped === "convergence-trailer") {
+    console.log(
+      `\u2713 core ownership guard: allowed by Core-Convergence (reverting toward the template): ${result.convergenceReason ?? ""}`
+    );
+    return;
+  }
   if (result.blocked.length === 0) {
     console.log("\u2713 core ownership guard: no template-owned paths changed.");
     return;
@@ -7299,11 +7368,20 @@ ${BOLD}What to do instead${OFF}
   path \u2014 see core-manifest.json for the split.
 
 ${result.blocked.some((p) => deletedFiles.includes(p)) ? `${BOLD}Some of these are deletions${OFF}
-  Deleting a template-owned file is not a smaller change than editing one \u2014 a
-  core upgrade will not restore it (#395), so the instance loses it silently and
-  for ever. If the file genuinely should not exist, delete it in biffo-template.
+  Deleting a template-owned file is drift like any other: the next
+  \`biffo core upgrade\` will restore it (#395) unless you declare the path an
+  intentional divergence. If the file genuinely should not exist, delete it in
+  biffo-template so every instance drops it.
+
+` : ""}${BOLD}If this REMOVES divergence (reverting toward the template)${OFF}
+  Reverting a template-owned file to the template's own content, or deleting a
+  file the template no longer ships, leaves the instance strictly closer to the
+  template. Record that it converges \u2014 it is allowed, and kept distinct from a
+  divergence so it never reads as drift to chase later (#385):
+
+    ${DIM}Core-Convergence: <what this reverts toward the template>${OFF}
 
-` : ""}${BOLD}If the divergence is deliberate${OFF}
+${BOLD}If the divergence is deliberate${OFF}
   Record it in the commit message and it is allowed:
 
     ${DIM}Core-Divergence: <why this instance must differ from the template>${OFF}