@biffo/cli 0.97.0 → 0.99.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 
 // src/commands/core.ts
 import { Command as Command4 } from "commander";
@@ -819,7 +819,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -834,7 +834,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1039,7 +1039,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve18) => setTimeout(resolve18, protectionIntervalMs));
+          await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
         }
       }
     }
@@ -1265,7 +1265,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+        await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
       }
     }
   }
@@ -1284,7 +1284,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+        await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
       }
     }
   }
@@ -1308,7 +1308,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -2094,26 +2094,82 @@ function declaredVariables(moduleDir) {
   }
   return names;
 }
+var USER_FACING_PLUGIN_OUTPUTS = [
+  "function_url_domain",
+  "frontend_bucket_regional_domain",
+  "frontend_bucket_name"
+];
+function rootPluginOutputName(pluginName, output) {
+  return `plugin_${pluginName}_${output}`;
+}
+function pluginOutputsFromRoot(pluginName, rootOutputs) {
+  const flat = {};
+  for (const key of USER_FACING_PLUGIN_OUTPUTS) {
+    const value = rootOutputs[rootPluginOutputName(pluginName, key)];
+    if (value !== void 0) flat[key] = value;
+  }
+  return flat;
+}
+function declaredOutputs(moduleDir) {
+  const names = /* @__PURE__ */ new Set();
+  let entries;
+  try {
+    entries = readdirSync3(moduleDir, { withFileTypes: true });
+  } catch {
+    return names;
+  }
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".tf")) continue;
+    let contents;
+    try {
+      contents = readFileSync7(join10(moduleDir, entry.name), "utf8");
+    } catch {
+      continue;
+    }
+    for (const match of contents.matchAll(/^\s*output\s+"([^"]+)"/gm)) {
+      names.add(match[1]);
+    }
+  }
+  return names;
+}
 function renderArguments(args, indent) {
   const width = Math.max(...args.map(([key]) => key.length));
   return args.map(([key, value]) => `${indent}${key.padEnd(width)} = ${value}`).join("\n");
 }
-function renderModuleBlock(pluginName, declared, handler, source) {
+function renderModuleBlock(pluginName, declared, handler, source, declaredOutputNames) {
   const args = standardArguments(pluginName, handler).filter(([key]) => declared.has(key));
   const quoted = JSON.stringify(pluginName);
-  return [
+  const outputBlock = (name, description, attr) => [
+    "",
+    `output "${name}" {`,
+    `  description = "${description}"`,
+    `  value       = try(module.plugin_${pluginName}[${quoted}].${attr}, null)`,
+    "}"
+  ];
+  const lines = [
     `module "plugin_${pluginName}" {`,
     `  source   = "${source}"`,
     `  for_each = contains(var.enabled_plugins, ${quoted}) ? { ${quoted} = true } : {}`,
     "",
     renderArguments(args, "  "),
     "}",
-    "",
-    `output "plugin_${pluginName}_function_arn" {`,
-    `  description = "Lambda ARN of the ${pluginName} plugin, or null when it is not in enabled_plugins."`,
-    `  value       = try(module.plugin_${pluginName}[${quoted}].function_arn, null)`,
-    "}"
-  ].join("\n");
+    ...outputBlock(
+      `plugin_${pluginName}_function_arn`,
+      `Lambda ARN of the ${pluginName} plugin, or null when it is not in enabled_plugins.`,
+      "function_arn"
+    )
+  ];
+  for (const output of USER_FACING_PLUGIN_OUTPUTS) {
+    if (!declaredOutputNames.has(output)) continue;
+    lines.push(
+      ...outputBlock(
+        rootPluginOutputName(pluginName, output),
+        `${output.replace(/_/g, " ")} of the ${pluginName} plugin (ADR-0018 register step), or null when it is not enabled.`,
+        output
+      )
+    );
+  }
+  return lines.join("\n");
 }
 var GENERATED_HEADER = `# ---------------------------------------------------------------------------
 # GENERATED FILE \u2014 DO NOT EDIT BY HAND.
@@ -2143,7 +2199,8 @@ function renderGeneratedTerraform(plugins) {
       p.name,
       p.declaredVariables,
       p.handler ?? DEFAULT_PLUGIN_HANDLER,
-      p.source ?? THIRD_PARTY_TERRAFORM(p.name)
+      p.source ?? THIRD_PARTY_TERRAFORM(p.name),
+      p.declaredOutputs ?? /* @__PURE__ */ new Set()
     )
   );
   return `${GENERATED_HEADER}
@@ -2165,6 +2222,7 @@ function syncPluginTerraform(cwd) {
     return {
       name,
       declaredVariables: declaredVariables(moduleDir),
+      declaredOutputs: declaredOutputs(moduleDir),
       source: pluginModuleSource(cwd, name)
     };
   });
@@ -2862,7 +2920,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve18) => setTimeout(resolve18, retryDelayMs));
+          await new Promise((resolve19) => setTimeout(resolve19, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -5977,7 +6035,7 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 }
 
 // src/commands/plugin.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 
 // src/commands/plugin-create.ts
 import { existsSync as existsSync23, readFileSync as readFileSync17 } from "fs";
@@ -6135,6 +6193,22 @@ var RouteDefSchema = z6.object({
     });
   }
 });
+var USER_PATH_SEGMENT = /^[a-z][a-z0-9_-]*$/;
+var HANDLER_IMPORT_PATH = /^[a-zA-Z_]\w*(\.[a-zA-Z_]\w*)+$/;
+var REL_DIR = /^[\w][\w./-]*$/;
+var NON_EMPTY_GROUP = "required_group must be a non-empty Cognito group name.";
+var UserIngressSchema = z6.object({
+  path: z6.string().regex(USER_PATH_SEGMENT, "must be a single lowercase path segment, e.g. api").default("api"),
+  required_group: z6.string().min(1, NON_EMPTY_GROUP),
+  handler: z6.string().regex(HANDLER_IMPORT_PATH, "must be a dotted import path, e.g. 'ideation.app.handler'")
+}).strict();
+var UserFrontendSchema = z6.object({
+  dir: z6.string().regex(
+    REL_DIR,
+    "must be a repo-relative path with no leading slash or traversal, e.g. web/dist"
+  ),
+  required_group: z6.string().min(1, NON_EMPTY_GROUP)
+}).strict();
 var PluginManifestSchema = z6.object({
   name: z6.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
   version: z6.string().regex(/^\d+\.\d+\.\d+$/, "must be a full semver, e.g. 1.2.3"),
@@ -6149,7 +6223,11 @@ var PluginManifestSchema = z6.object({
   // lib/plugin-terraform-guard.ts. Kept loose deliberately: the authoritative
   // schema is the registry's, and this consumer only needs to count them.
   event_subscriptions: z6.array(z6.object({ source: z6.string(), detail_type: z6.string() }).passthrough()).default([]),
-  required_core_version: z6.string().default(">=0.0.0")
+  required_core_version: z6.string().default(">=0.0.0"),
+  // ADR-0018 user-facing surfaces. Optional: a plugin without them is an
+  // ordinary (data/event/CRUD) plugin.
+  user_ingress: UserIngressSchema.optional(),
+  user_frontend: UserFrontendSchema.optional()
 }).superRefine((manifest, ctx) => {
   const tableNames = new Set(manifest.tables.map((t) => t.name));
   for (const route of manifest.api_routes) {
@@ -6817,6 +6895,28 @@ async function runPluginInstall(target, options, deps) {
     console.log(chalk15.dim(`    git push`));
     console.log(chalk15.dim(`    biffo deploy <environment> --app-only
 `));
+    if (manifest.user_ingress || manifest.user_frontend) {
+      const group = manifest.user_ingress?.required_group ?? manifest.user_frontend?.required_group;
+      console.log(chalk15.bold(`  "${pluginName}" is a user-facing plugin (ADR-0018).`));
+      console.log(
+        `  It serves an authenticated${group ? ` ${group}-gated` : ""} app at <base>/${pluginName}/ and an api at <base>/${pluginName}/api/*.`
+      );
+      console.log(
+        "  Two more steps route it onto the shared CloudFront (apply is pipeline-only):\n"
+      );
+      console.log(
+        "    1. After the deploy above applies, register its CDN origins from the plugin module outputs, then redeploy so the CDN gains its behaviours:"
+      );
+      console.log(chalk15.dim(`         biffo plugin wire ${pluginName} <environment>`));
+      console.log(chalk15.dim(`         git push  &&  biffo deploy <environment>`));
+      console.log("    2. Build and sync its frontend to the bucket that first apply created");
+      console.log(
+        chalk15.dim(
+          `         (the plugin's own deploy workflow does this \u2014 see ${relTargetDir}/.github/workflows/).
+`
+        )
+      );
+    }
   } finally {
     source.cleanup();
   }
@@ -7278,24 +7378,187 @@ function printDryRun6(entry, currentVersion) {
 `);
 }
 
+// src/commands/plugin-wire.ts
+import { existsSync as existsSync30, readFileSync as readFileSync23 } from "fs";
+import { resolve as resolve17 } from "path";
+import chalk20 from "chalk";
+import { Command as Command20 } from "commander";
+
+// src/lib/plugin-origin.ts
+import { existsSync as existsSync29, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "fs";
+import { join as join30 } from "path";
+var PLUGIN_API_TFVARS = "plugin-apis.auto.tfvars.json";
+var SIBLINGS_TFVARS = "siblings.auto.tfvars.json";
+function upsertPluginApiOrigin(existing, entry) {
+  return [...existing.filter((p) => p.name !== entry.name), entry];
+}
+function serializePluginApiRegistry(origins) {
+  return JSON.stringify({ plugin_api_origins: origins }, null, 2) + "\n";
+}
+function readArray(path, key) {
+  if (!existsSync29(path)) return [];
+  try {
+    const parsed = JSON.parse(readFileSync22(path, "utf8"));
+    const arr = parsed[key];
+    return Array.isArray(arr) ? arr : [];
+  } catch {
+    return [];
+  }
+}
+function registerUserFacingPlugin(cwd, environment, reg) {
+  const envDir = join30(cwd, "infra", "environments", environment);
+  const apiPath = join30(envDir, PLUGIN_API_TFVARS);
+  const siblingPath = join30(envDir, SIBLINGS_TFVARS);
+  const apis = upsertPluginApiOrigin(readArray(apiPath, "plugin_api_origins"), {
+    name: reg.name,
+    function_url_domain: reg.functionUrlDomain
+  });
+  writeFileSync9(apiPath, serializePluginApiRegistry(apis));
+  const siblings = upsertSiblingOrigin(readArray(siblingPath, "sibling_origins"), {
+    name: reg.name,
+    bucket_regional_domain: reg.bucketRegionalDomain
+  });
+  writeFileSync9(siblingPath, serializeRegistry(siblings));
+  return [
+    `infra/environments/${environment}/${PLUGIN_API_TFVARS}`,
+    `infra/environments/${environment}/${SIBLINGS_TFVARS}`
+  ];
+}
+var REQUIRED_PLUGIN_OUTPUTS = [
+  "function_url_domain",
+  "frontend_bucket_regional_domain",
+  "frontend_bucket_name"
+];
+function wireUserFacingPluginFromOutputs(cwd, environment, name, outputs) {
+  const missing = REQUIRED_PLUGIN_OUTPUTS.filter((k) => !outputs[k]?.trim());
+  if (missing.length > 0) {
+    throw new Error(
+      `Cannot register the user-facing plugin "${name}" for ${environment}: its Terraform apply did not expose ${missing.join(", ")}. A registration written without these would route ${name}/api/* and ${name}/* at nothing (the frontend 403s, the api 502s). Confirm the plugin module applied for ${environment} before wiring.`
+    );
+  }
+  const registeredPaths = registerUserFacingPlugin(cwd, environment, {
+    name,
+    functionUrlDomain: outputs["function_url_domain"],
+    bucketRegionalDomain: outputs["frontend_bucket_regional_domain"]
+  });
+  return { registeredPaths, frontendBucketName: outputs["frontend_bucket_name"] };
+}
+
+// src/commands/plugin-wire.ts
+var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
+async function runPluginWire(pluginName, environment, config, deps, cwd = process.cwd()) {
+  const awsConfig2 = config.cloud.config;
+  const stateBucket = awsConfig2.tf_state_bucket ?? `${config.project.name}-terraform-state-${awsConfig2.account_id}`;
+  const stateKey = `${environment}/terraform.tfstate`;
+  log.info(`Reading Terraform outputs from s3://${stateBucket}/${stateKey}...`);
+  const outputs = await deps.readOutputs(stateBucket, stateKey);
+  const pluginOutputs = pluginOutputsFromRoot(pluginName, outputs);
+  const targets = wireUserFacingPluginFromOutputs(cwd, environment, pluginName, pluginOutputs);
+  console.log(chalk20.bold(`
+  Registered "${pluginName}" CDN origins for ${environment}
+`));
+  for (const path of targets.registeredPaths) console.log(`    ${chalk20.green("~")} ${path}`);
+  console.log(
+    "\n  Commit these and redeploy so the CDN gains its behaviours (apply is pipeline-only):"
+  );
+  console.log(chalk20.dim(`    git add ${targets.registeredPaths.join(" ")}`));
+  console.log(chalk20.dim(`    git commit -m "infra(cdn): route ${pluginName} (${environment})"`));
+  console.log(chalk20.dim(`    git push  &&  biffo deploy ${environment}
+`));
+  console.log(
+    `  Then build and sync the frontend to its bucket: ${chalk20.bold(targets.frontendBucketName)}`
+  );
+  console.log(
+    chalk20.dim(
+      "  (the plugin's own deploy workflow does this \u2014 it reads the bucket from the same outputs.)\n"
+    )
+  );
+  return targets;
+}
+var pluginWireCommand = new Command20("wire").description(
+  "Register a user-facing plugin's CDN origins from its deployed outputs (ADR-0018 register step): biffo plugin wire <name> <environment>"
+).argument("<name>", "Plugin name, e.g. ideation").argument("<environment>", "Target environment: dev | staging | prod").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(
+  async (name, environment, options) => {
+    if (!VALID_ENVIRONMENTS2.includes(environment)) {
+      log.error(
+        `Unknown environment: ${environment}. Must be one of: ${VALID_ENVIRONMENTS2.join(", ")}`
+      );
+      process.exit(1);
+    }
+    const config = await resolveConfig4(options);
+    const aws = new AwsAdapter(config);
+    try {
+      await runPluginWire(name, environment, config, {
+        readOutputs: (bucket, key) => aws.readTerraformOutputs(bucket, key)
+      });
+    } catch (err) {
+      log.error(err.message);
+      process.exit(1);
+    }
+  }
+);
+async function resolveConfig4(options) {
+  if (options.config) {
+    const raw = JSON.parse(readFileSync23(resolve17(options.config), "utf8"));
+    const result = BiffoConfigSchema.safeParse(raw);
+    if (!result.success) {
+      log.error(`Invalid config at ${options.config}:`);
+      result.error.issues.forEach((i) => log.error(`  ${i.path.join(".")} \u2014 ${i.message}`));
+      process.exit(1);
+    }
+    return result.data;
+  }
+  if (options.project) {
+    const cfg = loadProjectConfig(options.project);
+    if (!cfg) {
+      log.error(
+        `Project "${options.project}" not found in ~/.biffo/projects/. Run biffo init first or pass --config <path>.`
+      );
+      process.exit(1);
+    }
+    return cfg;
+  }
+  const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
+  if (existsSync30(localConfigPath)) {
+    const raw = JSON.parse(readFileSync23(localConfigPath, "utf8"));
+    const result = BiffoConfigSchema.safeParse(raw);
+    if (result.success) return result.data;
+    if (isTemplatePlaceholderConfig(raw)) {
+      log.warn(
+        `Ignoring ${localConfigPath} \u2014 it is the unsubstituted Biffo template placeholder, not this project's config.`
+      );
+    } else {
+      log.error(`Invalid config at ${localConfigPath}:`);
+      result.error.issues.forEach((i) => log.error(`  ${i.path.join(".")} \u2014 ${i.message}`));
+      log.error("Refusing to fall back to a saved project while a local config file is present.");
+      process.exit(1);
+    }
+  }
+  log.error(
+    "No config found. Run inside a Biffo project, or pass --project <name> / --config <path>."
+  );
+  return process.exit(1);
+}
+
 // src/commands/plugin.ts
-var pluginCommand = new Command20("plugin").description("Manage Biffo plugins");
+var pluginCommand = new Command21("plugin").description("Manage Biffo plugins");
 pluginCommand.addCommand(pluginCreateCommand);
 pluginCommand.addCommand(pluginListCommand);
 pluginCommand.addCommand(pluginInstallCommand);
+pluginCommand.addCommand(pluginWireCommand);
 pluginCommand.addCommand(pluginUninstallCommand);
 pluginCommand.addCommand(pluginUpgradeCommand);
 pluginCommand.addCommand(pluginSyncMigrationsCommand);
 pluginCommand.addCommand(pluginInfoCommand);
 
 // src/commands/sibling.ts
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync29, readFileSync as readFileSync22 } from "fs";
-import { resolve as resolve17 } from "path";
-import chalk20 from "chalk";
-import { Command as Command21 } from "commander";
+import { existsSync as existsSync31, readFileSync as readFileSync24 } from "fs";
+import { resolve as resolve18 } from "path";
+import chalk21 from "chalk";
+import { Command as Command22 } from "commander";
 
 // src/lib/sibling-identity-check.ts
 function checkSiblingIdentity(envs) {
@@ -7345,19 +7608,19 @@ function checkSiblingIdentity(envs) {
 }
 
 // src/commands/sibling-check-identity.ts
-var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
+var VALID_ENVIRONMENTS3 = ["dev", "staging", "prod"];
 var SIBLING_CORE_POOL_VAR = "CORE_COGNITO_USER_POOL_ID";
-var siblingCheckIdentityCommand = new Command21("check-identity").description(
+var siblingCheckIdentityCommand = new Command22("check-identity").description(
   "Detect when a core's Cognito pool has drifted from its published identity document or any sibling's baked-in CORE_COGNITO_USER_POOL_ID (#400). Run from the core repo; exits non-zero on drift so a scheduled/CI run goes red."
 ).option("--env <environment>", "Only check this environment (default: dev, staging, prod)").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(async (options) => {
-  if (options.env && !VALID_ENVIRONMENTS2.includes(options.env)) {
+  if (options.env && !VALID_ENVIRONMENTS3.includes(options.env)) {
     log.error(
-      `Unknown environment: ${options.env}. Must be one of: ${VALID_ENVIRONMENTS2.join(", ")}`
+      `Unknown environment: ${options.env}. Must be one of: ${VALID_ENVIRONMENTS3.join(", ")}`
     );
     process.exit(1);
   }
-  const environments = options.env ? [options.env] : [...VALID_ENVIRONMENTS2];
-  const config = await resolveConfig4(options);
+  const environments = options.env ? [options.env] : [...VALID_ENVIRONMENTS3];
+  const config = await resolveConfig5(options);
   const { org, repo } = config.source_control.config;
   const awsConfig2 = config.cloud.config;
   const stateBucket = awsConfig2.tf_state_bucket ?? `${config.project.name}-terraform-state-${awsConfig2.account_id}`;
@@ -7367,7 +7630,7 @@ var siblingCheckIdentityCommand = new Command21("check-identity").description(
     github: new GitHubAdapter(token),
     fetchIdentityDoc: fetchPublishedIdentity
   };
-  console.log(chalk20.bold(`
+  console.log(chalk21.bold(`
   Biffo \u2014 Sibling identity check (${config.project.name})
 `));
   let result;
@@ -7454,16 +7717,16 @@ function printIdentityReport(result) {
   }
   if (result.ok) {
     log.success(
-      chalk20.green(
+      chalk21.green(
         "\u2713 identity consistent \u2014 every published document and sibling backend matches the live pool"
       )
     );
     return;
   }
-  log.error(chalk20.red(`\u2718 ${String(result.findings.length)} identity drift finding(s):`));
+  log.error(chalk21.red(`\u2718 ${String(result.findings.length)} identity drift finding(s):`));
   for (const f of result.findings) {
     console.error(
-      chalk20.red(
+      chalk21.red(
         `  [${f.environment}] ${f.subject}: ${FINDING_LABEL[f.kind]}
       expected (live pool): ${f.expected}
       found:                ${f.actual ?? "(unset)"}`
@@ -7484,9 +7747,9 @@ async function fetchPublishedIdentity(portalUrl) {
     return null;
   }
 }
-async function resolveConfig4(options) {
+async function resolveConfig5(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync22(resolve17(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync24(resolve18(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -7505,9 +7768,9 @@ async function resolveConfig4(options) {
     }
     return cfg;
   }
-  const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
-  if (existsSync29(localConfigPath)) {
-    const raw = JSON.parse(readFileSync22(localConfigPath, "utf8"));
+  const localConfigPath = resolve18(process.cwd(), "biffo.config.json");
+  if (existsSync31(localConfigPath)) {
+    const raw = JSON.parse(readFileSync24(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -7543,14 +7806,14 @@ async function resolveConfig4(options) {
 }
 
 // src/commands/sibling.ts
-var siblingCommand = new Command22("sibling").description(
+var siblingCommand = new Command23("sibling").description(
   "Create and manage sibling apps that share a Biffo core project (ADR-0007)"
 );
 siblingCommand.addCommand(siblingCreateCommand);
 siblingCommand.addCommand(siblingCheckIdentityCommand);
 
 // src/commands/check.ts
-import { Command as Command23 } from "commander";
+import { Command as Command24 } from "commander";
 
 // src/scripts/check-core-ownership.ts
 import { execa as execa5 } from "execa";
@@ -7576,8 +7839,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa5("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync24, existsSync: existsSync31 } = await import("fs");
-      if (existsSync31(messageFile)) commitMessage = readFileSync24(messageFile, "utf8");
+      const { readFileSync: readFileSync26, existsSync: existsSync33 } = await import("fs");
+      if (existsSync33(messageFile)) commitMessage = readFileSync26(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -7681,8 +7944,8 @@ ${BOLD}If the divergence is deliberate${OFF}
 import { execa as execa6 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync30, readFileSync as readFileSync23, readdirSync as readdirSync12 } from "fs";
-import { dirname as dirname9, join as join30, relative as relative6, sep as sep3 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync25, readdirSync as readdirSync12 } from "fs";
+import { dirname as dirname9, join as join31, relative as relative6, sep as sep3 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -7697,9 +7960,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
-        walk(join30(dir, entry.name));
+        walk(join31(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative6(root, join30(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative6(root, join31(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -7709,7 +7972,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync23(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync25(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -7724,14 +7987,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync30(join30(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync32(join31(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join30(root, manifest);
+    const absManifest = join31(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync30(join30(pluginDir2, "terraform"))) continue;
+    if (existsSync32(join31(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative6(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -7850,7 +8113,7 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/commands/check.ts
-var checkCommand = new Command23("check").description(
+var checkCommand = new Command24("check").description(
   "Repo guards (ownership, release subject, plugin terraform) \u2014 run in CI and git hooks"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
@@ -7870,17 +8133,17 @@ function rawArgsAfter(subcommand) {
 // src/commands/teardown.ts
 import { execSync as execSync7 } from "child_process";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STSClient3 } from "@aws-sdk/client-sts";
-import chalk21 from "chalk";
-import { Command as Command24 } from "commander";
+import chalk22 from "chalk";
+import { Command as Command25 } from "commander";
 import inquirer8 from "inquirer";
-var teardownCommand = new Command24("teardown").description(
+var teardownCommand = new Command25("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
   "--confirm <name>",
   "Pre-confirm by supplying the project name (the scriptable form of the typed confirmation)"
 ).option("-y, --yes", "Skip the typed project-name confirmation entirely").action(
   async (options) => {
-    console.log(chalk21.bold("\n  Biffo \u2014 Teardown\n"));
+    console.log(chalk22.bold("\n  Biffo \u2014 Teardown\n"));
     const githubToken = resolveGithubToken4();
     const sts = new STSClient3({});
     const { Account: accountId } = await sts.send(new GetCallerIdentityCommand3({}));
@@ -7902,7 +8165,7 @@ var teardownCommand = new Command24("teardown").description(
       adminEmail = session.config.admin?.email ?? "noop@example.com";
       adminUsername = session.config.admin?.username ?? "noop";
       domain = session.config.project.domain ?? "";
-      console.log(chalk21.yellow("  Loaded session for: ") + chalk21.bold(projectName));
+      console.log(chalk22.yellow("  Loaded session for: ") + chalk22.bold(projectName));
       if (org && repo) console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else if (savedConfig) {
@@ -7915,7 +8178,7 @@ var teardownCommand = new Command24("teardown").description(
       adminEmail = savedConfig.admin.email;
       adminUsername = savedConfig.admin.username;
       domain = resolveDnsConfig(savedConfig).domain;
-      console.log(chalk21.yellow("  Loaded config for: ") + chalk21.bold(projectName));
+      console.log(chalk22.yellow("  Loaded config for: ") + chalk22.bold(projectName));
       console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else {
@@ -7986,35 +8249,35 @@ var teardownCommand = new Command24("teardown").description(
         throw err;
       }
     }
-    console.log(chalk21.red.bold("  This will permanently delete:\n"));
+    console.log(chalk22.red.bold("  This will permanently delete:\n"));
     if (deployedEnvs.length > 0 || hasGlobal) {
-      console.log(chalk21.red("  Infrastructure (via GitHub Actions terraform destroy):"));
+      console.log(chalk22.red("  Infrastructure (via GitHub Actions terraform destroy):"));
       for (const env of deployedEnvs) {
         console.log(
-          `    ${chalk21.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
+          `    ${chalk22.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
         );
       }
       if (hasGlobal) {
-        console.log(`    ${chalk21.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
+        console.log(`    ${chalk22.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
       }
       console.log();
     }
     for (const line of formatSiblingPlan(siblings, options.skipDestroy === true)) {
       console.log(line);
     }
-    console.log(chalk21.red("  Biffo resources:"));
-    console.log(`    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${org}/${repo}`)}`);
+    console.log(chalk22.red("  Biffo resources:"));
+    console.log(`    ${chalk22.red("\u2717")} GitHub repository  ${chalk22.bold(`${org}/${repo}`)}`);
     console.log(
-      `    ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${projectName}`)}`
+      `    ${chalk22.red("\u2717")} IAM role           ${chalk22.bold(`biffo-github-actions-${projectName}`)}`
     );
     console.log(
-      `    ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(stateBucket)} (all versions)`
+      `    ${chalk22.red("\u2717")} S3 bucket          ${chalk22.bold(stateBucket)} (all versions)`
     );
-    console.log(`    ${chalk21.red("\u2717")} Local session file`);
+    console.log(`    ${chalk22.red("\u2717")} Local session file`);
     if (options.skipDestroy) {
       console.log();
       console.log(
-        chalk21.yellow(
+        chalk22.yellow(
           "  --skip-destroy: NO terraform destroy runs, for this project or any sibling.\n  Everything above is deleted, but any infrastructure still standing is left\n  standing \u2014 and, with the state buckets gone, orphaned."
         )
       );
@@ -8202,30 +8465,30 @@ async function assertSiblingsAreDestroyable(github, siblings) {
 }
 function formatSiblingPlan(siblings, skipDestroy) {
   if (siblings.length === 0) return [];
-  const lines = [chalk21.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
+  const lines = [chalk22.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
   for (const s of siblings) {
     const envs = s.environments.join(", ");
     if (s.repoState === "gone") {
       lines.push(
-        `    ${chalk21.yellow("!")} ${chalk21.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
+        `    ${chalk22.yellow("!")} ${chalk22.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
       );
       continue;
     }
     lines.push(
-      `    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
+      `    ${chalk22.red("\u2717")} GitHub repository  ${chalk22.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
     );
     lines.push(
-      `      ${chalk21.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
+      `      ${chalk22.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
     );
     lines.push(
-      `      ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${s.projectName}`)}`
+      `      ${chalk22.red("\u2717")} IAM role           ${chalk22.bold(`biffo-github-actions-${s.projectName}`)}`
     );
     lines.push(
-      `      ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
+      `      ${chalk22.red("\u2717")} S3 bucket          ${chalk22.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
     );
     if (s.pendingRegistrationPr !== void 0) {
       lines.push(
-        chalk21.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
+        chalk22.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
       );
     }
   }
@@ -8263,7 +8526,7 @@ async function confirmTeardown(projectName, options) {
     {
       type: "input",
       name: "confirm",
-      message: `Type ${chalk21.bold(projectName)} to confirm:`
+      message: `Type ${chalk22.bold(projectName)} to confirm:`
     }
   ]);
   return confirm === projectName;
@@ -8281,7 +8544,7 @@ function resolveGithubToken4() {
 }
 
 // src/index.ts
-var program = new Command25();
+var program = new Command26();
 function cliVersion() {
   try {
     return getLatestCoreVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.97.0",
+  "version": "0.99.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",