@biffo/cli 0.79.0 → 0.81.0

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -67,15 +67,16 @@ jobs:
       - name: Test
         if: ${{ !cancelled() }}
         run: pnpm run test
-      # Deliberately run with NO NEXT_PUBLIC_CORE_COGNITO_* in scope (issue
-      # #286). `next build` prerenders `/`, which imports src/lib/auth.ts; when
-      # that module built its Cognito pool eagerly the build blew up on any
-      # machine without the real pool ids exported, and nothing in CI caught it
-      # — the first person to find out was whoever had just scaffolded the
-      # sibling, debugging template code they did not write. A sibling's build
-      # must not need auth credentials, so this step is the assertion of that.
-      # Provide the real values in deploy.yml, where they are inlined into the
-      # artifact that actually ships.
+      # Run with NO NEXT_PUBLIC_CORE_COGNITO_* in scope — this is now the
+      # PERMANENT state, not a build-guard quirk. The frontend NEVER reads those
+      # vars: it resolves the core's Cognito identity at runtime from
+      # /.well-known/biffo-identity.json (#403 Stage 3), so nothing is baked into
+      # the bundle and deploy.yml no longer sets them either. `next build`
+      # prerenders `/`, which imports src/lib/auth.ts; that module builds its
+      # Cognito pool lazily (never at module scope) so the build succeeds with no
+      # identity in scope. Originally added as a guard for the eager-construction
+      # crash (issue #286); it now simply asserts a sibling's build needs no auth
+      # credentials at all.
       - name: Build
         if: ${{ !cancelled() }}
         run: pnpm run build

package/_skeletons/sibling-template/.github/workflows/deploy.yml

@@ -153,8 +153,12 @@ jobs:
           NEXT_PUBLIC_SIBLING_PATH_PREFIX: ${{ vars.PATH_PREFIX && format('/{0}', vars.PATH_PREFIX) || '' }}
           NEXT_PUBLIC_BASE_PATH: ${{ vars.PATH_PREFIX && format('/{0}', vars.PATH_PREFIX) || '' }}
           NEXT_PUBLIC_CORE_PORTAL_URL: ${{ vars.CORE_PORTAL_URL }}
-          NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID: ${{ vars.CORE_COGNITO_USER_POOL_ID }}
-          NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID: ${{ vars.CORE_COGNITO_CLIENT_ID }}
+          # The frontend no longer bakes NEXT_PUBLIC_CORE_COGNITO_* into the
+          # bundle: it resolves the core's Cognito identity at RUNTIME from the
+          # core-published /.well-known/biffo-identity.json document (#403), so
+          # the build no longer needs the pool/client ids. (The BACKEND still
+          # consumes CORE_COGNITO_* via TF_VAR for JWT validation — see the
+          # deploy-infra job above; that is deliberately unchanged.)
           NEXT_PUBLIC_API_URL: ${{ vars.API_URL }}
         run: pnpm run build
       - uses: aws-actions/configure-aws-credentials@v6

package/_skeletons/sibling-template/README.md

@@ -198,14 +198,21 @@ part of the install, so its lifecycle scripts never run.)
 
 ## The build must not need Cognito credentials
 
-`pnpm run build` has to succeed with **no** `NEXT_PUBLIC_CORE_COGNITO_*` set,
-and `.github/workflows/ci.yml` runs it that way on every PR to keep it that
-way. `next build` prerenders `/` in Node, which imports `src/lib/auth.ts`; that
-module therefore constructs its Cognito user pool lazily, on first session
-read, never at module scope (the `CognitoUserPool` constructor throws outright
-when either id is missing). If you add module-scope code that requires real
-core config, the build breaks for everyone who has not exported the pool ids —
-starting with CI. Read config inside the function that needs it.
+The frontend resolves the core's Cognito identity at **runtime** from the
+core-published `/.well-known/biffo-identity.json` document (#403) — it never
+bakes `NEXT_PUBLIC_CORE_COGNITO_*` into the bundle. So `pnpm run build` succeeds
+with **no** `NEXT_PUBLIC_CORE_COGNITO_*` set, and `.github/workflows/ci.yml`
+runs it that way on every PR to keep it that way. `next build` prerenders `/` in
+Node, which imports `src/lib/auth.ts`; that module constructs its Cognito user
+pool lazily, on first session read, never at module scope (the `CognitoUserPool`
+constructor throws outright when either id is missing). If you add module-scope
+code that requires real core config, the build breaks for everyone — starting
+with CI. Read config inside the function that needs it.
+
+(The sibling's **backend** still receives the core pool/client ids at deploy
+time via `TF_VAR_core_cognito_*` — its Terraform builds a JWKS URL from the pool
+id to validate JWTs. That is a separate concern from the frontend bundle and is
+deliberately unchanged.)
 
 ## The two-phase CDN registration
 
@@ -267,12 +274,19 @@ this repo's own `statusChecks` list — see that method's third parameter):
 
 1. Rename `biffo.sibling.json`'s `name`/`core_project`/`path_prefix`.
 2. Copy `apps/frontend/.env.example` to `.env.local` and fill in your core
-   project's real Cognito/API values for local dev.
+   project's real API/portal values for local dev. No Cognito values are
+   needed: the frontend resolves the core's Cognito identity at runtime from
+   `/.well-known/biffo-identity.json` (#403). A locally-run frontend with no
+   reachable document just treats the visitor as signed-out.
 3. `cd infra && terraform init -backend-config=backend.hcl && terraform apply`
    (generate `backend.hcl` yourself for local use — CI generates it inline,
    see `deploy.yml`).
 4. Wire the GitHub Environment variables/secrets `deploy.yml` reads
    (`CORE_COGNITO_USER_POOL_ID`, `CORE_COGNITO_CLIENT_ID`, `CORE_API_URL`,
-   `CORE_PORTAL_URL`, `SIBLING_OIDC_ROLE_ARN`, `TF_STATE_BUCKET`, etc.).
+   `CORE_PORTAL_URL`, `SIBLING_OIDC_ROLE_ARN`, `TF_STATE_BUCKET`, etc.). The
+   `CORE_COGNITO_*` variables are still required: the **backend** consumes them
+   via `TF_VAR_core_cognito_*` for JWT validation (its Terraform derives a JWKS
+   URL from the pool id). They are no longer inlined into the frontend bundle —
+   the frontend resolves the core's Cognito identity at runtime (#403).
 5. Open the registration PR against your core project (`infra/siblings.auto.tfvars.json`)
    yourself, or let `biffo sibling create` do it for you.

package/_skeletons/sibling-template/apps/frontend/.env.example

@@ -6,8 +6,11 @@ NEXT_PUBLIC_SIBLING_NAME=example-sibling
 NEXT_PUBLIC_SIBLING_PATH_PREFIX=/example-sibling
 NEXT_PUBLIC_BASE_PATH=/example-sibling
 NEXT_PUBLIC_CORE_PORTAL_URL=https://baseurl.com
-NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID=us-east-1_XXXXXXXXX
-NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID=XXXXXXXXXXXXXXXXXXXXXXXXXX
+# No Cognito env is needed: the sibling resolves the core's Cognito identity at
+# RUNTIME from /.well-known/biffo-identity.json (served by the core), so nothing
+# is baked into the bundle (#403). A locally-run frontend with no reachable
+# document simply treats the visitor as signed-out — a sibling never signs
+# anyone in (ADR-0007).
 # This sibling's OWN API Gateway endpoint (from `terraform output api_url`),
 # NOT the core project's API — the frontend never calls the core API
 # directly (ADR-0002/ADR-0007).

package/_skeletons/sibling-template/apps/frontend/src/lib/auth.test.ts

@@ -22,16 +22,16 @@ function userWithSession(session: unknown, err: Error | null = null) {
   }
 }
 
-// The env vars are the TRANSITIONAL fallback (#403 Stage 3 removes them). The
-// document is now the preferred source, so most tests set env AND control
-// `fetch` to prove which one wins.
-function configureCognitoEnv() {
-  vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID', 'us-east-1_TESTPOOL')
-  vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID', 'testclientid')
+// The sibling is DOC-ONLY (#403 Stage 3): it NEVER reads NEXT_PUBLIC_CORE_COGNITO_*.
+// This helper only exists to set BOGUS env values in the "env is ignored" tests,
+// proving the pool is never built from env even when it is present.
+function stubBogusCognitoEnv() {
+  vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID', 'us-east-1_BOGUSENV')
+  vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID', 'bogusenvclientid')
 }
 
-// A `fetch` returning a valid identity document. The ids differ from the env
-// values on purpose so a test can prove the DOCUMENT wins over baked env.
+// A `fetch` returning a valid identity document. The ids are what the pool must
+// be built from — the ONLY source of Cognito coordinates now.
 function mockFetchDocument(overrides: Record<string, unknown> = {}) {
   const body = {
     userPoolId: 'us-east-1_DOCPOOL',
@@ -45,7 +45,8 @@ function mockFetchDocument(overrides: Record<string, unknown> = {}) {
   }) as unknown as typeof fetch
 }
 
-// A `fetch` that rejects (network error) — drives the env fallback path.
+// A `fetch` that rejects (network error) — the document is unreachable, so the
+// sibling resolves to null (no env fallback).
 function mockFetchUnreachable() {
   global.fetch = vi.fn().mockRejectedValue(new Error('network down')) as unknown as typeof fetch
 }
@@ -53,7 +54,7 @@ function mockFetchUnreachable() {
 // Each test re-imports the module fresh: both the pool (auth.ts) and the
 // resolved-identity Promise (identity.ts) are memoised at module scope, so a
 // module instance left over from a previous test would carry that test's
-// document/env into the next one.
+// document into the next one.
 async function loadAuth() {
   vi.resetModules()
   return await import('@/lib/auth')
@@ -62,11 +63,9 @@ async function loadAuth() {
 describe('getCurrentSession', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    configureCognitoEnv()
-    // Default: document unreachable, so these behaviour tests build the pool
-    // from the env fallback (us-east-1_TESTPOOL / testclientid) exactly as the
-    // pre-runtime version did.
-    mockFetchUnreachable()
+    // The document is reachable, so these behaviour tests build the pool from
+    // the DOCUMENT (us-east-1_DOCPOOL / docclientid) — never from env.
+    mockFetchDocument()
   })
 
   afterEach(() => {
@@ -100,9 +99,9 @@ describe('getCurrentSession', () => {
   })
 })
 
-// The core now publishes its Cognito coordinates at runtime; the sibling
-// prefers that document over its baked env vars (#403/#400). These tests pin
-// which source wins under each condition.
+// The core publishes its Cognito coordinates at runtime; the sibling is
+// DOC-ONLY (#403 Stage 3) and resolves them from that document alone. These
+// tests pin that the document is the sole source — env is never consulted.
 describe('runtime core identity resolution', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -113,9 +112,9 @@ describe('runtime core identity resolution', () => {
     vi.restoreAllMocks()
   })
 
-  it('builds the pool from the published document, not from env', async () => {
-    // Env is set to DIFFERENT values so a pass proves the document won.
-    configureCognitoEnv()
+  it('builds the pool from the published document', async () => {
+    // Bogus env is set to prove the document — not env — is the source.
+    stubBogusCognitoEnv()
     mockFetchDocument()
     const { getCurrentSession } = await loadAuth()
     getCurrentUser.mockReturnValue(null)
@@ -131,55 +130,44 @@ describe('runtime core identity resolution', () => {
     })
   })
 
-  it('falls back to env and warns when the document is unreachable', async () => {
-    configureCognitoEnv()
+  it('resolves null and never builds the pool from env when the document is unreachable', async () => {
+    // Env is present but BOGUS: a DOC-ONLY sibling must ignore it entirely.
+    stubBogusCognitoEnv()
     mockFetchUnreachable()
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const { getCurrentSession } = await loadAuth()
     getCurrentUser.mockReturnValue(null)
 
-    await getCurrentSession()
-
-    expect(poolConstructor).toHaveBeenCalledWith({
-      UserPoolId: 'us-east-1_TESTPOOL',
-      ClientId: 'testclientid',
-    })
+    await expect(getCurrentSession()).resolves.toBeNull()
+    // Proves env is ignored: the pool was never constructed from the bogus env.
+    expect(poolConstructor).not.toHaveBeenCalled()
     expect(warn).toHaveBeenCalledOnce()
-    expect(warn.mock.calls[0]?.[0]).toContain('DEGRADED')
   })
 
-  it('falls back to env when the document is served but missing ids', async () => {
-    configureCognitoEnv()
+  it('resolves null and never builds the pool when the document is served but missing ids', async () => {
+    stubBogusCognitoEnv()
     // ok:true but the body lacks a clientId — treated as unusable.
     mockFetchDocument({ clientId: '' })
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const { getCurrentSession } = await loadAuth()
     getCurrentUser.mockReturnValue(null)
 
-    await getCurrentSession()
-
-    expect(poolConstructor).toHaveBeenCalledWith({
-      UserPoolId: 'us-east-1_TESTPOOL',
-      ClientId: 'testclientid',
-    })
+    await expect(getCurrentSession()).resolves.toBeNull()
+    expect(poolConstructor).not.toHaveBeenCalled()
     expect(warn).toHaveBeenCalledOnce()
   })
 
-  it('resolves null and never constructs the pool when both document and env are absent', async () => {
-    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID', '')
-    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID', '')
+  it('resolves null when the document is unreachable', async () => {
     mockFetchUnreachable()
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
     const { getCurrentSession } = await loadAuth()
 
     await expect(getCurrentSession()).resolves.toBeNull()
     expect(poolConstructor).not.toHaveBeenCalled()
-    // No document AND no env is an unconfigured build, not degradation — quiet.
-    expect(warn).not.toHaveBeenCalled()
+    expect(warn).toHaveBeenCalledOnce()
   })
 
   it('fetches the document at most once across multiple session reads (memoised)', async () => {
-    configureCognitoEnv()
     mockFetchDocument()
     const { getCurrentSession } = await loadAuth()
     getCurrentUser.mockReturnValue(null)
@@ -210,14 +198,12 @@ describe('lazy pool construction', () => {
   })
 
   it('does not construct the pool merely by importing the module', async () => {
-    configureCognitoEnv()
+    mockFetchDocument()
     await loadAuth()
     expect(poolConstructor).not.toHaveBeenCalled()
   })
 
-  it('imports cleanly with no Cognito env vars set and no fetch available', async () => {
-    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID', '')
-    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID', '')
+  it('imports cleanly with no fetch available (next build prerender)', async () => {
     // Simulate `next build` prerendering `/` in Node with no fetch in scope.
     const originalFetch = global.fetch
     // @ts-expect-error deliberately remove fetch to mimic the Node prerender.
@@ -230,16 +216,14 @@ describe('lazy pool construction', () => {
     }
   })
 
-  it('resolves null instead of throwing when Cognito env vars are absent', async () => {
-    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID', '')
-    vi.stubEnv('NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID', '')
+  it('resolves null instead of throwing when the document is unreachable', async () => {
     const { getCurrentSession } = await loadAuth()
     await expect(getCurrentSession()).resolves.toBeNull()
     expect(poolConstructor).not.toHaveBeenCalled()
   })
 
-  it('constructs the pool once, on first session read, from the env fallback', async () => {
-    configureCognitoEnv()
+  it('constructs the pool once, on first session read, from the document', async () => {
+    mockFetchDocument()
     const { getCurrentSession } = await loadAuth()
     getCurrentUser.mockReturnValue(null)
 
@@ -248,8 +232,8 @@ describe('lazy pool construction', () => {
 
     expect(poolConstructor).toHaveBeenCalledTimes(1)
     expect(poolConstructor).toHaveBeenCalledWith({
-      UserPoolId: 'us-east-1_TESTPOOL',
-      ClientId: 'testclientid',
+      UserPoolId: 'us-east-1_DOCPOOL',
+      ClientId: 'docclientid',
     })
   })
 })

package/_skeletons/sibling-template/apps/frontend/src/lib/auth.ts

@@ -32,11 +32,12 @@ import { resolveCoreIdentity } from './identity'
 // ---------------------------------------------------------------------------
 // Module-private on purpose: the pool is an implementation detail of
 // getCurrentSession(), not part of this sibling's auth surface. Its Cognito
-// coordinates now come from resolveCoreIdentity() (identity.ts), which prefers
-// the core's runtime-published /.well-known/biffo-identity.json document and
-// only falls back to the baked NEXT_PUBLIC_CORE_COGNITO_* env vars when that
-// document is unreachable — see identity.ts for why runtime resolution kills
-// the stale-baked-pool bug class (#403/#400).
+// coordinates come from resolveCoreIdentity() (identity.ts), which resolves the
+// core's runtime-published /.well-known/biffo-identity.json document. The
+// sibling is now DOC-ONLY (#403 Stage 3): there is NO NEXT_PUBLIC_CORE_COGNITO_*
+// env fallback. An unreachable document resolves to null → the caller treats it
+// as "signed out" — see identity.ts for why runtime resolution kills the
+// stale-baked-pool bug class (#403/#400).
 //
 // Constructed LAZILY, on first session read — never at module scope. The
 // CognitoUserPool constructor throws ("Both UserPoolId and ClientId are

package/_skeletons/sibling-template/apps/frontend/src/lib/identity.ts

@@ -29,12 +29,13 @@
 //   this exactly ONE network request per page load, shared by every caller,
 //   rather than one per session read.
 //
-// The env fallback below is TRANSITIONAL (Stage 3 of #403 removes it). It lets
-// an instance whose core has not yet started publishing the document keep
-// working off its baked env vars, so instances can upgrade at their own pace.
-// A baked value that shadows a live document is precisely the stale-copy bug
-// we are removing, so falling back because the document was UNREACHABLE is a
-// degraded path and warns loudly.
+// A sibling is DOC-ONLY (#403 Stage 3): it carries NO CORE_COGNITO_* env vars —
+// `biffo sibling create` no longer sets them and this module no longer reads
+// them. When the document is unreachable, resolution returns null, and the
+// caller (getCurrentSession) treats that as "no session" — the sibling redirects
+// to the portal's login rather than trusting a stale baked value, because a
+// stale value is exactly the bug (#400) this removes. A clean redirect beats a
+// silent point at a dead pool.
 // ---------------------------------------------------------------------------
 
 export interface CoreIdentity {
@@ -54,16 +55,6 @@ const IDENTITY_DOCUMENT_PATH = '/.well-known/biffo-identity.json'
 // callers before the fetch settles also coalesce onto the one request.
 let cached: Promise<CoreIdentity | null> | null = null
 
-// Read the transitional env fallback. Returns a valid CoreIdentity only when
-// BOTH ids are present; otherwise null (an unconfigured build has neither a
-// document nor env, and that is not an error to shout about).
-function identityFromEnv(): CoreIdentity | null {
-  const userPoolId = process.env['NEXT_PUBLIC_CORE_COGNITO_USER_POOL_ID'] ?? ''
-  const clientId = process.env['NEXT_PUBLIC_CORE_COGNITO_CLIENT_ID'] ?? ''
-  if (!userPoolId || !clientId) return null
-  return { userPoolId, clientId }
-}
-
 // A parsed document counts only when it carries both ids non-empty; a document
 // missing either is treated as unusable and triggers the fallback.
 function identityFromDocument(data: unknown): CoreIdentity | null {
@@ -90,38 +81,31 @@ async function fetchCoreIdentity(): Promise<CoreIdentity | null> {
       const identity = identityFromDocument(await res.json())
       if (identity) return identity
     }
-    // Reached here => the document was served but unusable (non-ok status or
-    // missing ids). Fall through to the degraded env fallback below.
+    // Served but unusable (non-ok status or missing ids). Fall through to null.
   } catch {
     // Network error, or `fetch` not available (e.g. `next build` prerendering
-    // `/` in Node with no fetch). Fall through to the env fallback.
+    // in Node with no fetch — though resolution is lazy and never runs there).
+    // Fall through to null.
   }
 
-  // DEGRADED path: the document was unreachable/unusable, so we lean on the
-  // baked env vars. If those exist, warn once — a stale baked value silently
-  // shadowing a live document is the #403/#400 bug. If they DON'T exist, this
-  // is simply an unconfigured build (no document, no env) — not degradation,
-  // so stay quiet.
-  const fallback = identityFromEnv()
-  if (fallback) {
-    console.warn(
-      '[biffo] DEGRADED: could not resolve the core identity document at ' +
-        `${IDENTITY_DOCUMENT_PATH}; falling back to baked ` +
-        'NEXT_PUBLIC_CORE_COGNITO_* env vars. This is transitional (#403) and ' +
-        'risks pointing at a stale/dead Cognito pool — ensure the core is ' +
-        'publishing the runtime identity document.',
-    )
-  }
-  return fallback
+  // The document was unreachable or unusable. A sibling has NO baked fallback
+  // (#403 Stage 3), so this resolves to null and the caller treats it as
+  // "signed out" — a clean redirect to the portal login beats trusting a stale
+  // local pool id, which is the exact bug (#400) this removes.
+  console.warn(
+    `[biffo] could not resolve the core identity document at ${IDENTITY_DOCUMENT_PATH}; ` +
+      'treating the visitor as signed out. If this persists, confirm the core is publishing it.',
+  )
+  return null
 }
 
 /**
- * Resolve the core's Cognito identity at runtime, preferring the published
- * `/.well-known/biffo-identity.json` document and falling back to baked
- * `NEXT_PUBLIC_CORE_COGNITO_*` env vars when the document is unreachable.
+ * Resolve the core's Cognito identity at runtime from the published
+ * `/.well-known/biffo-identity.json` document. A sibling has no env fallback
+ * (#403 Stage 3).
  *
  * Memoised: at most one fetch per page load, shared by every caller. Returns
- * null when neither the document nor the env vars supply both ids.
+ * null when the document is unreachable or does not supply both ids.
  */
 export function resolveCoreIdentity(): Promise<CoreIdentity | null> {
   cached ??= fetchCoreIdentity()

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/commands/core.ts
 import { Command as Command4 } from "commander";
@@ -819,7 +819,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -834,7 +834,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1039,7 +1039,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve17) => setTimeout(resolve17, protectionIntervalMs));
+          await new Promise((resolve18) => setTimeout(resolve18, protectionIntervalMs));
         }
       }
     }
@@ -1082,6 +1082,28 @@ var GitHubAdapter = class {
       }
     }
   }
+  /**
+   * Read an environment-scoped Actions variable's value, or `null` if it isn't
+   * set (a 404). The counterpart to `setEnvVariable`, used by
+   * `biffo sibling check-identity` to read each sibling's baked-in
+   * `CORE_COGNITO_USER_POOL_ID` and compare it against the core's live pool
+   * (#400/#496). A 404 means the variable was never set on that environment,
+   * which is a real, reportable state — not an error — so it maps to `null`.
+   */
+  async getEnvVariable(org, repo, env, name) {
+    try {
+      const { data } = await this.octokit.request(
+        "GET /repos/{owner}/{repo}/environments/{environment_name}/variables/{variable_name}",
+        { owner: org, repo, environment_name: env, variable_name: name }
+      );
+      return data.value;
+    } catch (err) {
+      if (err.status === 404) {
+        return null;
+      }
+      throw err;
+    }
+  }
   async setRepoVariable(org, repo, name, value) {
     log.info(`Setting variable: ${name}`);
     try {
@@ -1243,7 +1265,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
       }
     }
   }
@@ -1262,7 +1284,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
       }
     }
   }
@@ -1286,7 +1308,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -2831,7 +2853,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve17) => setTimeout(resolve17, retryDelayMs));
+          await new Promise((resolve18) => setTimeout(resolve18, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -7258,14 +7280,268 @@ pluginCommand.addCommand(pluginSyncMigrationsCommand);
 pluginCommand.addCommand(pluginInfoCommand);
 
 // src/commands/sibling.ts
+import { Command as Command22 } from "commander";
+
+// src/commands/sibling-check-identity.ts
+import { existsSync as existsSync29, readFileSync as readFileSync22 } from "fs";
+import { resolve as resolve17 } from "path";
+import chalk20 from "chalk";
 import { Command as Command21 } from "commander";
-var siblingCommand = new Command21("sibling").description(
+
+// src/lib/sibling-identity-check.ts
+function checkSiblingIdentity(envs) {
+  const findings = [];
+  for (const env of envs) {
+    if (env.publishedDoc === null) {
+      findings.push({
+        environment: env.environment,
+        subject: "published-document",
+        kind: "published-doc-unreachable",
+        expected: env.livePoolId,
+        actual: null
+      });
+    } else {
+      const docPool = env.publishedDoc.userPoolId ?? null;
+      if (docPool !== env.livePoolId) {
+        findings.push({
+          environment: env.environment,
+          subject: "published-document",
+          kind: "published-doc-stale",
+          expected: env.livePoolId,
+          actual: docPool
+        });
+      }
+    }
+    for (const sibling of env.siblings) {
+      if (sibling.coreCognitoUserPoolId === null) {
+        findings.push({
+          environment: env.environment,
+          subject: sibling.projectName,
+          kind: "sibling-var-missing",
+          expected: env.livePoolId,
+          actual: null
+        });
+      } else if (sibling.coreCognitoUserPoolId !== env.livePoolId) {
+        findings.push({
+          environment: env.environment,
+          subject: sibling.projectName,
+          kind: "sibling-backend-stale",
+          expected: env.livePoolId,
+          actual: sibling.coreCognitoUserPoolId
+        });
+      }
+    }
+  }
+  return { ok: findings.length === 0, findings };
+}
+
+// src/commands/sibling-check-identity.ts
+var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
+var SIBLING_CORE_POOL_VAR = "CORE_COGNITO_USER_POOL_ID";
+var siblingCheckIdentityCommand = new Command21("check-identity").description(
+  "Detect when a core's Cognito pool has drifted from its published identity document or any sibling's baked-in CORE_COGNITO_USER_POOL_ID (#400). Run from the core repo; exits non-zero on drift so a scheduled/CI run goes red."
+).option("--env <environment>", "Only check this environment (default: dev, staging, prod)").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(async (options) => {
+  if (options.env && !VALID_ENVIRONMENTS2.includes(options.env)) {
+    log.error(
+      `Unknown environment: ${options.env}. Must be one of: ${VALID_ENVIRONMENTS2.join(", ")}`
+    );
+    process.exit(1);
+  }
+  const environments = options.env ? [options.env] : [...VALID_ENVIRONMENTS2];
+  const config = await resolveConfig4(options);
+  const { org, repo } = config.source_control.config;
+  const awsConfig2 = config.cloud.config;
+  const stateBucket = awsConfig2.tf_state_bucket ?? `${config.project.name}-terraform-state-${awsConfig2.account_id}`;
+  const token = await resolveGithubToken3(true);
+  const deps = {
+    aws: new AwsAdapter(config),
+    github: new GitHubAdapter(token),
+    fetchIdentityDoc: fetchPublishedIdentity
+  };
+  console.log(chalk20.bold(`
+  Biffo \u2014 Sibling identity check (${config.project.name})
+`));
+  let result;
+  try {
+    result = await runCheckIdentity(deps, {
+      coreOrg: org,
+      coreRepo: repo,
+      coreProjectName: config.project.name,
+      stateBucket,
+      environments
+    });
+  } catch (err) {
+    if (err instanceof SiblingResolutionError) {
+      log.error(`Could not enumerate siblings: ${err.message}`);
+    } else {
+      log.error(`Identity check failed: ${err.message}`);
+    }
+    process.exit(1);
+  }
+  printIdentityReport(result);
+  if (!result.ok) process.exit(1);
+});
+async function runCheckIdentity(deps, params) {
+  const siblings = await discoverSiblings(
+    deps.github,
+    params.coreOrg,
+    params.coreRepo,
+    params.coreProjectName
+  );
+  const envInputs = [];
+  const skipped = [];
+  for (const environment of params.environments) {
+    let outputs;
+    try {
+      outputs = await deps.aws.readTerraformOutputs(
+        params.stateBucket,
+        `${environment}/terraform.tfstate`
+      );
+    } catch {
+      skipped.push({
+        environment,
+        reason: "no Terraform state (core not deployed to this environment)"
+      });
+      continue;
+    }
+    const livePoolId = outputs["cognito_user_pool_id"];
+    const portalUrl = outputs["portal_url"];
+    if (!livePoolId || !portalUrl) {
+      skipped.push({
+        environment,
+        reason: "Terraform outputs missing cognito_user_pool_id or portal_url"
+      });
+      continue;
+    }
+    const publishedDoc = await deps.fetchIdentityDoc(portalUrl);
+    const envSiblings = siblings.filter(
+      (s) => s.registered && s.repoState !== "gone" && s.environments.includes(environment)
+    );
+    const siblingInputs = await Promise.all(
+      envSiblings.map(async (s) => ({
+        projectName: s.projectName,
+        coreCognitoUserPoolId: await deps.github.getEnvVariable(
+          s.org,
+          s.repo,
+          environment,
+          SIBLING_CORE_POOL_VAR
+        )
+      }))
+    );
+    envInputs.push({ environment, livePoolId, publishedDoc, siblings: siblingInputs });
+  }
+  const { ok, findings } = checkSiblingIdentity(envInputs);
+  return { ok, findings, skipped };
+}
+var FINDING_LABEL = {
+  "published-doc-unreachable": "published identity document unreachable",
+  "published-doc-stale": "published identity document is stale",
+  "sibling-var-missing": `sibling backend has no ${SIBLING_CORE_POOL_VAR}`,
+  "sibling-backend-stale": `sibling backend ${SIBLING_CORE_POOL_VAR} is stale`
+};
+function printIdentityReport(result) {
+  for (const s of result.skipped) {
+    log.warn(`${s.environment}: skipped \u2014 ${s.reason}`);
+  }
+  if (result.ok) {
+    log.success(
+      chalk20.green(
+        "\u2713 identity consistent \u2014 every published document and sibling backend matches the live pool"
+      )
+    );
+    return;
+  }
+  log.error(chalk20.red(`\u2718 ${String(result.findings.length)} identity drift finding(s):`));
+  for (const f of result.findings) {
+    console.error(
+      chalk20.red(
+        `  [${f.environment}] ${f.subject}: ${FINDING_LABEL[f.kind]}
+      expected (live pool): ${f.expected}
+      found:                ${f.actual ?? "(unset)"}`
+      )
+    );
+  }
+}
+async function fetchPublishedIdentity(portalUrl) {
+  try {
+    const base = portalUrl.replace(/\/+$/, "");
+    const res = await fetch(`${base}/.well-known/biffo-identity.json`, {
+      cache: "no-store"
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return { userPoolId: data?.userPoolId ?? null };
+  } catch {
+    return null;
+  }
+}
+async function resolveConfig4(options) {
+  if (options.config) {
+    const raw = JSON.parse(readFileSync22(resolve17(options.config), "utf8"));
+    const result = BiffoConfigSchema.safeParse(raw);
+    if (!result.success) {
+      log.error(`Invalid config at ${options.config}:`);
+      result.error.issues.forEach((i) => log.error(`  ${i.path.join(".")} \u2014 ${i.message}`));
+      process.exit(1);
+    }
+    return result.data;
+  }
+  if (options.project) {
+    const cfg = loadProjectConfig(options.project);
+    if (!cfg) {
+      log.error(
+        `Project "${options.project}" not found in ~/.biffo/projects/. Run biffo init first or pass --config <path>.`
+      );
+      process.exit(1);
+    }
+    return cfg;
+  }
+  const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
+  if (existsSync29(localConfigPath)) {
+    const raw = JSON.parse(readFileSync22(localConfigPath, "utf8"));
+    const result = BiffoConfigSchema.safeParse(raw);
+    if (result.success) return result.data;
+    if (isTemplatePlaceholderConfig(raw)) {
+      log.warn(
+        `Ignoring ${localConfigPath} \u2014 it is the unsubstituted Biffo template placeholder, not this project's config.`
+      );
+    } else {
+      log.error(`Invalid config at ${localConfigPath}:`);
+      result.error.issues.forEach((i) => log.error(`  ${i.path.join(".")} \u2014 ${i.message}`));
+      log.error("Refusing to fall back to a saved project while a local config file is present.");
+      log.error("Fix biffo.config.json, or pass --project <name> / --config <path> explicitly.");
+      process.exit(1);
+    }
+  }
+  const projects = listProjectConfigs();
+  if (projects.length === 0) {
+    log.error(
+      "No biffo.config.json found in the current directory and no projects in ~/.biffo/projects/."
+    );
+    log.error("Run biffo init first, or pass --project <name> or --config <path>.");
+    log.error(
+      "A Biffo instance's resolved config is not committed to its repo \u2014 it lives in ~/.biffo/projects/ on the machine that ran biffo init. On a second machine, copy it there or pass it with --config <path>."
+    );
+    process.exit(1);
+  }
+  if (projects.length === 1) {
+    log.info(`Using project: ${projects[0].project.name}`);
+    return projects[0];
+  }
+  log.error("Multiple projects found in ~/.biffo/projects/. Pass --project <name> to choose one:");
+  for (const p of projects) log.error(`  ${p.project.name}`);
+  process.exit(1);
+}
+
+// src/commands/sibling.ts
+var siblingCommand = new Command22("sibling").description(
   "Create and manage sibling apps that share a Biffo core project (ADR-0007)"
 );
 siblingCommand.addCommand(siblingCreateCommand);
+siblingCommand.addCommand(siblingCheckIdentityCommand);
 
 // src/commands/check.ts
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/scripts/check-core-ownership.ts
 import { execa as execa5 } from "execa";
@@ -7291,8 +7567,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa5("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync23, existsSync: existsSync30 } = await import("fs");
-      if (existsSync30(messageFile)) commitMessage = readFileSync23(messageFile, "utf8");
+      const { readFileSync: readFileSync24, existsSync: existsSync31 } = await import("fs");
+      if (existsSync31(messageFile)) commitMessage = readFileSync24(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -7396,7 +7672,7 @@ ${BOLD}If the divergence is deliberate${OFF}
 import { execa as execa6 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync29, readFileSync as readFileSync22, readdirSync as readdirSync12 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync23, readdirSync as readdirSync12 } from "fs";
 import { dirname as dirname9, join as join30, relative as relative6, sep as sep3 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
@@ -7424,7 +7700,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync22(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync23(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -7439,14 +7715,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync29(join30(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync30(join30(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
     const absManifest = join30(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync29(join30(pluginDir2, "terraform"))) continue;
+    if (existsSync30(join30(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative6(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -7565,7 +7841,7 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/commands/check.ts
-var checkCommand = new Command22("check").description(
+var checkCommand = new Command23("check").description(
   "Repo guards (ownership, release subject, plugin terraform) \u2014 run in CI and git hooks"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
@@ -7585,17 +7861,17 @@ function rawArgsAfter(subcommand) {
 // src/commands/teardown.ts
 import { execSync as execSync7 } from "child_process";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STSClient3 } from "@aws-sdk/client-sts";
-import chalk20 from "chalk";
-import { Command as Command23 } from "commander";
+import chalk21 from "chalk";
+import { Command as Command24 } from "commander";
 import inquirer8 from "inquirer";
-var teardownCommand = new Command23("teardown").description(
+var teardownCommand = new Command24("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
   "--confirm <name>",
   "Pre-confirm by supplying the project name (the scriptable form of the typed confirmation)"
 ).option("-y, --yes", "Skip the typed project-name confirmation entirely").action(
   async (options) => {
-    console.log(chalk20.bold("\n  Biffo \u2014 Teardown\n"));
+    console.log(chalk21.bold("\n  Biffo \u2014 Teardown\n"));
     const githubToken = resolveGithubToken4();
     const sts = new STSClient3({});
     const { Account: accountId } = await sts.send(new GetCallerIdentityCommand3({}));
@@ -7617,7 +7893,7 @@ var teardownCommand = new Command23("teardown").description(
       adminEmail = session.config.admin?.email ?? "noop@example.com";
       adminUsername = session.config.admin?.username ?? "noop";
       domain = session.config.project.domain ?? "";
-      console.log(chalk20.yellow("  Loaded session for: ") + chalk20.bold(projectName));
+      console.log(chalk21.yellow("  Loaded session for: ") + chalk21.bold(projectName));
       if (org && repo) console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else if (savedConfig) {
@@ -7630,7 +7906,7 @@ var teardownCommand = new Command23("teardown").description(
       adminEmail = savedConfig.admin.email;
       adminUsername = savedConfig.admin.username;
       domain = resolveDnsConfig(savedConfig).domain;
-      console.log(chalk20.yellow("  Loaded config for: ") + chalk20.bold(projectName));
+      console.log(chalk21.yellow("  Loaded config for: ") + chalk21.bold(projectName));
       console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else {
@@ -7701,35 +7977,35 @@ var teardownCommand = new Command23("teardown").description(
         throw err;
       }
     }
-    console.log(chalk20.red.bold("  This will permanently delete:\n"));
+    console.log(chalk21.red.bold("  This will permanently delete:\n"));
     if (deployedEnvs.length > 0 || hasGlobal) {
-      console.log(chalk20.red("  Infrastructure (via GitHub Actions terraform destroy):"));
+      console.log(chalk21.red("  Infrastructure (via GitHub Actions terraform destroy):"));
       for (const env of deployedEnvs) {
         console.log(
-          `    ${chalk20.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
+          `    ${chalk21.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
         );
       }
       if (hasGlobal) {
-        console.log(`    ${chalk20.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
+        console.log(`    ${chalk21.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
       }
       console.log();
     }
     for (const line of formatSiblingPlan(siblings, options.skipDestroy === true)) {
       console.log(line);
     }
-    console.log(chalk20.red("  Biffo resources:"));
-    console.log(`    ${chalk20.red("\u2717")} GitHub repository  ${chalk20.bold(`${org}/${repo}`)}`);
+    console.log(chalk21.red("  Biffo resources:"));
+    console.log(`    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${org}/${repo}`)}`);
     console.log(
-      `    ${chalk20.red("\u2717")} IAM role           ${chalk20.bold(`biffo-github-actions-${projectName}`)}`
+      `    ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${projectName}`)}`
     );
     console.log(
-      `    ${chalk20.red("\u2717")} S3 bucket          ${chalk20.bold(stateBucket)} (all versions)`
+      `    ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(stateBucket)} (all versions)`
     );
-    console.log(`    ${chalk20.red("\u2717")} Local session file`);
+    console.log(`    ${chalk21.red("\u2717")} Local session file`);
     if (options.skipDestroy) {
       console.log();
       console.log(
-        chalk20.yellow(
+        chalk21.yellow(
           "  --skip-destroy: NO terraform destroy runs, for this project or any sibling.\n  Everything above is deleted, but any infrastructure still standing is left\n  standing \u2014 and, with the state buckets gone, orphaned."
         )
       );
@@ -7917,30 +8193,30 @@ async function assertSiblingsAreDestroyable(github, siblings) {
 }
 function formatSiblingPlan(siblings, skipDestroy) {
   if (siblings.length === 0) return [];
-  const lines = [chalk20.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
+  const lines = [chalk21.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
   for (const s of siblings) {
     const envs = s.environments.join(", ");
     if (s.repoState === "gone") {
       lines.push(
-        `    ${chalk20.yellow("!")} ${chalk20.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
+        `    ${chalk21.yellow("!")} ${chalk21.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
       );
       continue;
     }
     lines.push(
-      `    ${chalk20.red("\u2717")} GitHub repository  ${chalk20.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
+      `    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
     );
     lines.push(
-      `      ${chalk20.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
+      `      ${chalk21.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
     );
     lines.push(
-      `      ${chalk20.red("\u2717")} IAM role           ${chalk20.bold(`biffo-github-actions-${s.projectName}`)}`
+      `      ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${s.projectName}`)}`
     );
     lines.push(
-      `      ${chalk20.red("\u2717")} S3 bucket          ${chalk20.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
+      `      ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
     );
     if (s.pendingRegistrationPr !== void 0) {
       lines.push(
-        chalk20.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
+        chalk21.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
       );
     }
   }
@@ -7978,7 +8254,7 @@ async function confirmTeardown(projectName, options) {
     {
       type: "input",
       name: "confirm",
-      message: `Type ${chalk20.bold(projectName)} to confirm:`
+      message: `Type ${chalk21.bold(projectName)} to confirm:`
     }
   ]);
   return confirm === projectName;
@@ -7996,7 +8272,7 @@ function resolveGithubToken4() {
 }
 
 // src/index.ts
-var program = new Command24();
+var program = new Command25();
 function cliVersion() {
   try {
     return getLatestCoreVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.79.0",
+  "version": "0.81.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",