@biffo/cli 0.80.0 → 0.82.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/commands/core.ts
 import { Command as Command4 } from "commander";
@@ -819,7 +819,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -834,7 +834,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1039,7 +1039,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve17) => setTimeout(resolve17, protectionIntervalMs));
+          await new Promise((resolve18) => setTimeout(resolve18, protectionIntervalMs));
         }
       }
     }
@@ -1082,6 +1082,28 @@ var GitHubAdapter = class {
       }
     }
   }
+  /**
+   * Read an environment-scoped Actions variable's value, or `null` if it isn't
+   * set (a 404). The counterpart to `setEnvVariable`, used by
+   * `biffo sibling check-identity` to read each sibling's baked-in
+   * `CORE_COGNITO_USER_POOL_ID` and compare it against the core's live pool
+   * (#400/#496). A 404 means the variable was never set on that environment,
+   * which is a real, reportable state — not an error — so it maps to `null`.
+   */
+  async getEnvVariable(org, repo, env, name) {
+    try {
+      const { data } = await this.octokit.request(
+        "GET /repos/{owner}/{repo}/environments/{environment_name}/variables/{variable_name}",
+        { owner: org, repo, environment_name: env, variable_name: name }
+      );
+      return data.value;
+    } catch (err) {
+      if (err.status === 404) {
+        return null;
+      }
+      throw err;
+    }
+  }
   async setRepoVariable(org, repo, name, value) {
     log.info(`Setting variable: ${name}`);
     try {
@@ -1243,7 +1265,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
       }
     }
   }
@@ -1262,7 +1284,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
       }
     }
   }
@@ -1286,7 +1308,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve17) => setTimeout(resolve17, intervalMs));
+      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -2831,7 +2853,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve17) => setTimeout(resolve17, retryDelayMs));
+          await new Promise((resolve18) => setTimeout(resolve18, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -7258,14 +7280,268 @@ pluginCommand.addCommand(pluginSyncMigrationsCommand);
 pluginCommand.addCommand(pluginInfoCommand);
 
 // src/commands/sibling.ts
+import { Command as Command22 } from "commander";
+
+// src/commands/sibling-check-identity.ts
+import { existsSync as existsSync29, readFileSync as readFileSync22 } from "fs";
+import { resolve as resolve17 } from "path";
+import chalk20 from "chalk";
 import { Command as Command21 } from "commander";
-var siblingCommand = new Command21("sibling").description(
+
+// src/lib/sibling-identity-check.ts
+function checkSiblingIdentity(envs) {
+  const findings = [];
+  for (const env of envs) {
+    if (env.publishedDoc === null) {
+      findings.push({
+        environment: env.environment,
+        subject: "published-document",
+        kind: "published-doc-unreachable",
+        expected: env.livePoolId,
+        actual: null
+      });
+    } else {
+      const docPool = env.publishedDoc.userPoolId ?? null;
+      if (docPool !== env.livePoolId) {
+        findings.push({
+          environment: env.environment,
+          subject: "published-document",
+          kind: "published-doc-stale",
+          expected: env.livePoolId,
+          actual: docPool
+        });
+      }
+    }
+    for (const sibling of env.siblings) {
+      if (sibling.coreCognitoUserPoolId === null) {
+        findings.push({
+          environment: env.environment,
+          subject: sibling.projectName,
+          kind: "sibling-var-missing",
+          expected: env.livePoolId,
+          actual: null
+        });
+      } else if (sibling.coreCognitoUserPoolId !== env.livePoolId) {
+        findings.push({
+          environment: env.environment,
+          subject: sibling.projectName,
+          kind: "sibling-backend-stale",
+          expected: env.livePoolId,
+          actual: sibling.coreCognitoUserPoolId
+        });
+      }
+    }
+  }
+  return { ok: findings.length === 0, findings };
+}
+
+// src/commands/sibling-check-identity.ts
+var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
+var SIBLING_CORE_POOL_VAR = "CORE_COGNITO_USER_POOL_ID";
+var siblingCheckIdentityCommand = new Command21("check-identity").description(
+  "Detect when a core's Cognito pool has drifted from its published identity document or any sibling's baked-in CORE_COGNITO_USER_POOL_ID (#400). Run from the core repo; exits non-zero on drift so a scheduled/CI run goes red."
+).option("--env <environment>", "Only check this environment (default: dev, staging, prod)").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(async (options) => {
+  if (options.env && !VALID_ENVIRONMENTS2.includes(options.env)) {
+    log.error(
+      `Unknown environment: ${options.env}. Must be one of: ${VALID_ENVIRONMENTS2.join(", ")}`
+    );
+    process.exit(1);
+  }
+  const environments = options.env ? [options.env] : [...VALID_ENVIRONMENTS2];
+  const config = await resolveConfig4(options);
+  const { org, repo } = config.source_control.config;
+  const awsConfig2 = config.cloud.config;
+  const stateBucket = awsConfig2.tf_state_bucket ?? `${config.project.name}-terraform-state-${awsConfig2.account_id}`;
+  const token = await resolveGithubToken3(true);
+  const deps = {
+    aws: new AwsAdapter(config),
+    github: new GitHubAdapter(token),
+    fetchIdentityDoc: fetchPublishedIdentity
+  };
+  console.log(chalk20.bold(`
+  Biffo \u2014 Sibling identity check (${config.project.name})
+`));
+  let result;
+  try {
+    result = await runCheckIdentity(deps, {
+      coreOrg: org,
+      coreRepo: repo,
+      coreProjectName: config.project.name,
+      stateBucket,
+      environments
+    });
+  } catch (err) {
+    if (err instanceof SiblingResolutionError) {
+      log.error(`Could not enumerate siblings: ${err.message}`);
+    } else {
+      log.error(`Identity check failed: ${err.message}`);
+    }
+    process.exit(1);
+  }
+  printIdentityReport(result);
+  if (!result.ok) process.exit(1);
+});
+async function runCheckIdentity(deps, params) {
+  const siblings = await discoverSiblings(
+    deps.github,
+    params.coreOrg,
+    params.coreRepo,
+    params.coreProjectName
+  );
+  const envInputs = [];
+  const skipped = [];
+  for (const environment of params.environments) {
+    let outputs;
+    try {
+      outputs = await deps.aws.readTerraformOutputs(
+        params.stateBucket,
+        `${environment}/terraform.tfstate`
+      );
+    } catch {
+      skipped.push({
+        environment,
+        reason: "no Terraform state (core not deployed to this environment)"
+      });
+      continue;
+    }
+    const livePoolId = outputs["cognito_user_pool_id"];
+    const portalUrl = outputs["portal_url"];
+    if (!livePoolId || !portalUrl) {
+      skipped.push({
+        environment,
+        reason: "Terraform outputs missing cognito_user_pool_id or portal_url"
+      });
+      continue;
+    }
+    const publishedDoc = await deps.fetchIdentityDoc(portalUrl);
+    const envSiblings = siblings.filter(
+      (s) => s.registered && s.repoState !== "gone" && s.environments.includes(environment)
+    );
+    const siblingInputs = await Promise.all(
+      envSiblings.map(async (s) => ({
+        projectName: s.projectName,
+        coreCognitoUserPoolId: await deps.github.getEnvVariable(
+          s.org,
+          s.repo,
+          environment,
+          SIBLING_CORE_POOL_VAR
+        )
+      }))
+    );
+    envInputs.push({ environment, livePoolId, publishedDoc, siblings: siblingInputs });
+  }
+  const { ok, findings } = checkSiblingIdentity(envInputs);
+  return { ok, findings, skipped };
+}
+var FINDING_LABEL = {
+  "published-doc-unreachable": "published identity document unreachable",
+  "published-doc-stale": "published identity document is stale",
+  "sibling-var-missing": `sibling backend has no ${SIBLING_CORE_POOL_VAR}`,
+  "sibling-backend-stale": `sibling backend ${SIBLING_CORE_POOL_VAR} is stale`
+};
+function printIdentityReport(result) {
+  for (const s of result.skipped) {
+    log.warn(`${s.environment}: skipped \u2014 ${s.reason}`);
+  }
+  if (result.ok) {
+    log.success(
+      chalk20.green(
+        "\u2713 identity consistent \u2014 every published document and sibling backend matches the live pool"
+      )
+    );
+    return;
+  }
+  log.error(chalk20.red(`\u2718 ${String(result.findings.length)} identity drift finding(s):`));
+  for (const f of result.findings) {
+    console.error(
+      chalk20.red(
+        `  [${f.environment}] ${f.subject}: ${FINDING_LABEL[f.kind]}
+      expected (live pool): ${f.expected}
+      found:                ${f.actual ?? "(unset)"}`
+      )
+    );
+  }
+}
+async function fetchPublishedIdentity(portalUrl) {
+  try {
+    const base = portalUrl.replace(/\/+$/, "");
+    const res = await fetch(`${base}/.well-known/biffo-identity.json`, {
+      cache: "no-store"
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return { userPoolId: data?.userPoolId ?? null };
+  } catch {
+    return null;
+  }
+}
+async function resolveConfig4(options) {
+  if (options.config) {
+    const raw = JSON.parse(readFileSync22(resolve17(options.config), "utf8"));
+    const result = BiffoConfigSchema.safeParse(raw);
+    if (!result.success) {
+      log.error(`Invalid config at ${options.config}:`);
+      result.error.issues.forEach((i) => log.error(`  ${i.path.join(".")} \u2014 ${i.message}`));
+      process.exit(1);
+    }
+    return result.data;
+  }
+  if (options.project) {
+    const cfg = loadProjectConfig(options.project);
+    if (!cfg) {
+      log.error(
+        `Project "${options.project}" not found in ~/.biffo/projects/. Run biffo init first or pass --config <path>.`
+      );
+      process.exit(1);
+    }
+    return cfg;
+  }
+  const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
+  if (existsSync29(localConfigPath)) {
+    const raw = JSON.parse(readFileSync22(localConfigPath, "utf8"));
+    const result = BiffoConfigSchema.safeParse(raw);
+    if (result.success) return result.data;
+    if (isTemplatePlaceholderConfig(raw)) {
+      log.warn(
+        `Ignoring ${localConfigPath} \u2014 it is the unsubstituted Biffo template placeholder, not this project's config.`
+      );
+    } else {
+      log.error(`Invalid config at ${localConfigPath}:`);
+      result.error.issues.forEach((i) => log.error(`  ${i.path.join(".")} \u2014 ${i.message}`));
+      log.error("Refusing to fall back to a saved project while a local config file is present.");
+      log.error("Fix biffo.config.json, or pass --project <name> / --config <path> explicitly.");
+      process.exit(1);
+    }
+  }
+  const projects = listProjectConfigs();
+  if (projects.length === 0) {
+    log.error(
+      "No biffo.config.json found in the current directory and no projects in ~/.biffo/projects/."
+    );
+    log.error("Run biffo init first, or pass --project <name> or --config <path>.");
+    log.error(
+      "A Biffo instance's resolved config is not committed to its repo \u2014 it lives in ~/.biffo/projects/ on the machine that ran biffo init. On a second machine, copy it there or pass it with --config <path>."
+    );
+    process.exit(1);
+  }
+  if (projects.length === 1) {
+    log.info(`Using project: ${projects[0].project.name}`);
+    return projects[0];
+  }
+  log.error("Multiple projects found in ~/.biffo/projects/. Pass --project <name> to choose one:");
+  for (const p of projects) log.error(`  ${p.project.name}`);
+  process.exit(1);
+}
+
+// src/commands/sibling.ts
+var siblingCommand = new Command22("sibling").description(
   "Create and manage sibling apps that share a Biffo core project (ADR-0007)"
 );
 siblingCommand.addCommand(siblingCreateCommand);
+siblingCommand.addCommand(siblingCheckIdentityCommand);
 
 // src/commands/check.ts
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/scripts/check-core-ownership.ts
 import { execa as execa5 } from "execa";
@@ -7291,8 +7567,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa5("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync23, existsSync: existsSync30 } = await import("fs");
-      if (existsSync30(messageFile)) commitMessage = readFileSync23(messageFile, "utf8");
+      const { readFileSync: readFileSync24, existsSync: existsSync31 } = await import("fs");
+      if (existsSync31(messageFile)) commitMessage = readFileSync24(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -7396,7 +7672,7 @@ ${BOLD}If the divergence is deliberate${OFF}
 import { execa as execa6 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync29, readFileSync as readFileSync22, readdirSync as readdirSync12 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync23, readdirSync as readdirSync12 } from "fs";
 import { dirname as dirname9, join as join30, relative as relative6, sep as sep3 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
@@ -7424,7 +7700,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync22(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync23(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -7439,14 +7715,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync29(join30(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync30(join30(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
     const absManifest = join30(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync29(join30(pluginDir2, "terraform"))) continue;
+    if (existsSync30(join30(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative6(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -7565,7 +7841,7 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/commands/check.ts
-var checkCommand = new Command22("check").description(
+var checkCommand = new Command23("check").description(
   "Repo guards (ownership, release subject, plugin terraform) \u2014 run in CI and git hooks"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
@@ -7585,17 +7861,17 @@ function rawArgsAfter(subcommand) {
 // src/commands/teardown.ts
 import { execSync as execSync7 } from "child_process";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STSClient3 } from "@aws-sdk/client-sts";
-import chalk20 from "chalk";
-import { Command as Command23 } from "commander";
+import chalk21 from "chalk";
+import { Command as Command24 } from "commander";
 import inquirer8 from "inquirer";
-var teardownCommand = new Command23("teardown").description(
+var teardownCommand = new Command24("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
   "--confirm <name>",
   "Pre-confirm by supplying the project name (the scriptable form of the typed confirmation)"
 ).option("-y, --yes", "Skip the typed project-name confirmation entirely").action(
   async (options) => {
-    console.log(chalk20.bold("\n  Biffo \u2014 Teardown\n"));
+    console.log(chalk21.bold("\n  Biffo \u2014 Teardown\n"));
     const githubToken = resolveGithubToken4();
     const sts = new STSClient3({});
     const { Account: accountId } = await sts.send(new GetCallerIdentityCommand3({}));
@@ -7617,7 +7893,7 @@ var teardownCommand = new Command23("teardown").description(
       adminEmail = session.config.admin?.email ?? "noop@example.com";
       adminUsername = session.config.admin?.username ?? "noop";
       domain = session.config.project.domain ?? "";
-      console.log(chalk20.yellow("  Loaded session for: ") + chalk20.bold(projectName));
+      console.log(chalk21.yellow("  Loaded session for: ") + chalk21.bold(projectName));
       if (org && repo) console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else if (savedConfig) {
@@ -7630,7 +7906,7 @@ var teardownCommand = new Command23("teardown").description(
       adminEmail = savedConfig.admin.email;
       adminUsername = savedConfig.admin.username;
       domain = resolveDnsConfig(savedConfig).domain;
-      console.log(chalk20.yellow("  Loaded config for: ") + chalk20.bold(projectName));
+      console.log(chalk21.yellow("  Loaded config for: ") + chalk21.bold(projectName));
       console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else {
@@ -7701,35 +7977,35 @@ var teardownCommand = new Command23("teardown").description(
         throw err;
       }
     }
-    console.log(chalk20.red.bold("  This will permanently delete:\n"));
+    console.log(chalk21.red.bold("  This will permanently delete:\n"));
     if (deployedEnvs.length > 0 || hasGlobal) {
-      console.log(chalk20.red("  Infrastructure (via GitHub Actions terraform destroy):"));
+      console.log(chalk21.red("  Infrastructure (via GitHub Actions terraform destroy):"));
       for (const env of deployedEnvs) {
         console.log(
-          `    ${chalk20.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
+          `    ${chalk21.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
         );
       }
       if (hasGlobal) {
-        console.log(`    ${chalk20.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
+        console.log(`    ${chalk21.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
       }
       console.log();
     }
     for (const line of formatSiblingPlan(siblings, options.skipDestroy === true)) {
       console.log(line);
     }
-    console.log(chalk20.red("  Biffo resources:"));
-    console.log(`    ${chalk20.red("\u2717")} GitHub repository  ${chalk20.bold(`${org}/${repo}`)}`);
+    console.log(chalk21.red("  Biffo resources:"));
+    console.log(`    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${org}/${repo}`)}`);
     console.log(
-      `    ${chalk20.red("\u2717")} IAM role           ${chalk20.bold(`biffo-github-actions-${projectName}`)}`
+      `    ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${projectName}`)}`
     );
     console.log(
-      `    ${chalk20.red("\u2717")} S3 bucket          ${chalk20.bold(stateBucket)} (all versions)`
+      `    ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(stateBucket)} (all versions)`
     );
-    console.log(`    ${chalk20.red("\u2717")} Local session file`);
+    console.log(`    ${chalk21.red("\u2717")} Local session file`);
     if (options.skipDestroy) {
       console.log();
       console.log(
-        chalk20.yellow(
+        chalk21.yellow(
           "  --skip-destroy: NO terraform destroy runs, for this project or any sibling.\n  Everything above is deleted, but any infrastructure still standing is left\n  standing \u2014 and, with the state buckets gone, orphaned."
         )
       );
@@ -7917,30 +8193,30 @@ async function assertSiblingsAreDestroyable(github, siblings) {
 }
 function formatSiblingPlan(siblings, skipDestroy) {
   if (siblings.length === 0) return [];
-  const lines = [chalk20.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
+  const lines = [chalk21.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
   for (const s of siblings) {
     const envs = s.environments.join(", ");
     if (s.repoState === "gone") {
       lines.push(
-        `    ${chalk20.yellow("!")} ${chalk20.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
+        `    ${chalk21.yellow("!")} ${chalk21.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
       );
       continue;
     }
     lines.push(
-      `    ${chalk20.red("\u2717")} GitHub repository  ${chalk20.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
+      `    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
     );
     lines.push(
-      `      ${chalk20.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
+      `      ${chalk21.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
     );
     lines.push(
-      `      ${chalk20.red("\u2717")} IAM role           ${chalk20.bold(`biffo-github-actions-${s.projectName}`)}`
+      `      ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${s.projectName}`)}`
     );
     lines.push(
-      `      ${chalk20.red("\u2717")} S3 bucket          ${chalk20.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
+      `      ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
     );
     if (s.pendingRegistrationPr !== void 0) {
       lines.push(
-        chalk20.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
+        chalk21.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
       );
     }
   }
@@ -7978,7 +8254,7 @@ async function confirmTeardown(projectName, options) {
     {
       type: "input",
       name: "confirm",
-      message: `Type ${chalk20.bold(projectName)} to confirm:`
+      message: `Type ${chalk21.bold(projectName)} to confirm:`
     }
   ]);
   return confirm === projectName;
@@ -7996,7 +8272,7 @@ function resolveGithubToken4() {
 }
 
 // src/index.ts
-var program = new Command24();
+var program = new Command25();
 function cliVersion() {
   try {
     return getLatestCoreVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.80.0",
+  "version": "0.82.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",