@biffo/cli 0.265.1 → 0.265.3

package/dist/index.js

@@ -9853,8 +9853,342 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
   console.log(`\u2713 branch-protection guard: ${owner}/${repo} (${audited.join(", ")}) OK`);
 }
 
-// src/scripts/check-core-ownership.ts
+// src/scripts/check-core-direct-paths.ts
+import { join as join37 } from "path";
 import { execa as execa7 } from "execa";
+
+// src/lib/core-direct-paths-audit.ts
+import { readFileSync as readFileSync27, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
+import { join as join36 } from "path";
+var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
+var API_ROUTE_PREFIX = "/api/v1";
+var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
+var LEADING_INTERPOLATION = /^\$\{\s*([A-Za-z_$][\w$]*)\s*\}/;
+var COMMENT = /\/\*[\s\S]*?\*\/|(?:^|(?<=\s))\/\/[^\n]*/gm;
+function stripComments(text) {
+  return text.replace(COMMENT, (m) => "\n".repeat((m.match(/\n/g) ?? []).length));
+}
+function* templateLiterals(text) {
+  let i = 0;
+  const n = text.length;
+  while (i < n) {
+    if (text[i] !== "`") {
+      i += 1;
+      continue;
+    }
+    const start = i + 1;
+    let j = start;
+    let depth = 0;
+    let terminated = false;
+    while (j < n) {
+      const ch = text[j];
+      if (ch === "\\") {
+        j += 2;
+        continue;
+      }
+      if (depth === 0 && ch === "`") {
+        yield { content: text.slice(start, j), start };
+        terminated = true;
+        break;
+      }
+      if (ch === "$" && j + 1 < n && text[j + 1] === "{") {
+        depth += 1;
+        j += 2;
+        continue;
+      }
+      if (depth > 0) {
+        if (ch === "{") depth += 1;
+        else if (ch === "}") depth -= 1;
+      }
+      j += 1;
+    }
+    if (!terminated) return;
+    i = j + 1;
+  }
+}
+function lineNumber(text, index) {
+  let count = 1;
+  for (let i = 0; i < index && i < text.length; i++) {
+    if (text[i] === "\n") count += 1;
+  }
+  return count;
+}
+function touchesConcatenation(text, start, end) {
+  const window = 40;
+  const after = text.slice(end, end + window).replace(/^\s+/, "");
+  const before = text.slice(Math.max(0, start - window), start).replace(/\s+$/, "");
+  return after.startsWith("+") || before.endsWith("+");
+}
+function resolveInterpolations(raw) {
+  let out = "";
+  let i = 0;
+  const n = raw.length;
+  while (i < n) {
+    if (raw[i] === "$" && i + 1 < n && raw[i + 1] === "{") {
+      let depth = 1;
+      let j = i + 2;
+      while (j < n && depth > 0) {
+        if (raw[j] === "{") depth += 1;
+        else if (raw[j] === "}") depth -= 1;
+        j += 1;
+      }
+      if (depth > 0) {
+        out += raw.slice(i);
+        break;
+      }
+      out += "{param}";
+      i = j;
+      continue;
+    }
+    out += raw[i];
+    i += 1;
+  }
+  return out;
+}
+function isNestedTemplateLiteralArtifact(raw) {
+  const resolved = resolveInterpolations(raw);
+  if (resolved.includes("${")) return true;
+  return resolved.includes("\n");
+}
+function stripQueryString(raw) {
+  const idx = raw.indexOf("?");
+  return idx === -1 ? raw : raw.slice(0, idx);
+}
+function externalBaseMatch(raw, externalBases) {
+  const match = LEADING_INTERPOLATION.exec(raw);
+  LEADING_INTERPOLATION.lastIndex = 0;
+  if (!match) return null;
+  const name = match[1];
+  if (!externalBases.includes(name)) return null;
+  return { name, rest: raw.slice(match[0].length) };
+}
+function extractCoreDirectPaths(rawText, file, externalBases = EXTERNAL_BASE_IDENTIFIERS) {
+  const text = stripComments(rawText);
+  const found = [];
+  for (const { content, start } of templateLiterals(text)) {
+    const raw = content;
+    const baseMatch = externalBaseMatch(raw, externalBases);
+    if (baseMatch === null) continue;
+    const { name: base, rest } = baseMatch;
+    const end = start + content.length;
+    if (touchesConcatenation(text, start - 1, end + 1)) {
+      found.push({
+        file,
+        line: lineNumber(text, start),
+        raw,
+        normalized: null,
+        unresolvedReason: "built with string concatenation (+) \u2014 the extracted literal is a fragment, not the whole path",
+        externalBase: base
+      });
+      continue;
+    }
+    if (isNestedTemplateLiteralArtifact(rest)) {
+      found.push({
+        file,
+        line: lineNumber(text, start),
+        raw,
+        normalized: null,
+        unresolvedReason: "contains a template literal nested inside its own interpolation \u2014 this extractor's scanner would otherwise truncate at the inner backtick, producing a corrupted path rather than a real mismatch",
+        externalBase: base
+      });
+      continue;
+    }
+    const normalized = stripQueryString(resolveInterpolations(rest));
+    found.push({
+      file,
+      line: lineNumber(text, start),
+      raw,
+      normalized,
+      unresolvedReason: null,
+      externalBase: base
+    });
+  }
+  return found;
+}
+function countRawExternalOccurrences(rawText, externalBases = EXTERNAL_BASE_IDENTIFIERS) {
+  let total = 0;
+  for (const base of externalBases) {
+    const needle = `\${${base}}`;
+    total += rawText.split(needle).length - 1;
+  }
+  return total;
+}
+function walkFiles(root, accept, skipDir) {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync14(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const p = join36(dir, entry);
+      let st;
+      try {
+        st = statSync7(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (skipDir(entry)) continue;
+        walk(p);
+        continue;
+      }
+      if (accept(entry)) out.push(p);
+    }
+  };
+  walk(root);
+  return out.sort();
+}
+function frontendSourceFiles(frontendSrcDir) {
+  return walkFiles(
+    frontendSrcDir,
+    (entry) => /\.(ts|tsx)$/.test(entry) && !TEST_FILE_SUFFIXES.some((s) => entry.endsWith(s)),
+    (entry) => entry === "node_modules" || entry === ".next"
+  );
+}
+function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_IDENTIFIERS) {
+  const files = frontendSourceFiles(frontendSrcDir);
+  const extracted = [];
+  let rawTotal = 0;
+  for (const file of files) {
+    const text = readFileSync27(file, "utf8");
+    rawTotal += countRawExternalOccurrences(text, externalBases);
+    extracted.push(...extractCoreDirectPaths(text, file, externalBases));
+  }
+  return { files, extracted, rawTotal };
+}
+function balancedParenSpan(text, openIndex) {
+  let depth = 0;
+  for (let i = openIndex; i < text.length; i++) {
+    if (text[i] === "(") depth += 1;
+    else if (text[i] === ")") {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return null;
+}
+function extractCoreRoutePrefixes(pyText) {
+  const prefixes = [];
+  let rawApiRouterCount = 0;
+  const callSite = /APIRouter\s*\(/g;
+  let m;
+  while ((m = callSite.exec(pyText)) !== null) {
+    rawApiRouterCount += 1;
+    const openParenIndex = m.index + m[0].length - 1;
+    const closeIndex = balancedParenSpan(pyText, openParenIndex);
+    if (closeIndex === null) continue;
+    const inner = pyText.slice(openParenIndex + 1, closeIndex);
+    const prefixMatch = /prefix\s*=\s*["']([^"']*)["']/.exec(inner);
+    if (prefixMatch) prefixes.push(prefixMatch[1]);
+  }
+  return { prefixes, rawApiRouterCount };
+}
+function normalizePrefix(prefix) {
+  if (prefix === "") return "";
+  return prefix.startsWith("/") ? prefix : `/${prefix}`;
+}
+function coreSourceFiles(apiSrcDir) {
+  return walkFiles(
+    apiSrcDir,
+    (entry) => entry.endsWith(".py") && !entry.startsWith("test_") && !entry.endsWith("_test.py"),
+    (entry) => entry === "tests" || entry === "__pycache__"
+  );
+}
+function auditCoreRouteExtraction(apiSrcDir) {
+  const files = coreSourceFiles(apiSrcDir);
+  const prefixSet = /* @__PURE__ */ new Set();
+  let rawApiRouterCount = 0;
+  for (const file of files) {
+    const text = readFileSync27(file, "utf8");
+    const extraction = extractCoreRoutePrefixes(text);
+    rawApiRouterCount += extraction.rawApiRouterCount;
+    for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
+  }
+  return { files, prefixes: [...prefixSet].sort(), rawApiRouterCount };
+}
+function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API_ROUTE_PREFIX) {
+  for (const prefix of corePrefixes) {
+    const full = `${apiRoutePrefix}${prefix}`;
+    if (normalized === full || normalized.startsWith(`${full}/`)) return true;
+  }
+  return false;
+}
+function auditSiblingCoreDirectPaths(params) {
+  const externalBases = params.externalBases ?? EXTERNAL_BASE_IDENTIFIERS;
+  const frontend = auditFrontendExtraction(params.frontendSrcDir, externalBases);
+  const core = auditCoreRouteExtraction(params.coreApiSrcDir);
+  const frontendBlind = frontend.rawTotal > 0 && frontend.extracted.length === 0;
+  const coreBlind = core.rawApiRouterCount > 0 && core.prefixes.length === 0;
+  const resolved = frontend.extracted.filter((p) => p.normalized !== null);
+  const unresolved = frontend.extracted.filter((p) => p.normalized === null);
+  const unmatched = resolved.filter(
+    (p) => !pathMatchesAnyCorePrefix(p.normalized, core.prefixes)
+  );
+  const matchedCount = resolved.length - unmatched.length;
+  const ok = !frontendBlind && !coreBlind && unmatched.length === 0 && unresolved.length === 0;
+  const summary = `${params.sibling}: ${frontend.extracted.length} core-direct call site(s) found under ${params.frontendSrcDir} (${frontend.files.length} file(s) scanned); ${matchedCount} matched a route prefix core registers (${core.prefixes.length} prefix(es) from ${core.files.length} file(s) under ${params.coreApiSrcDir}), ${unmatched.length} did not, ${unresolved.length} could not be resolved at all.`;
+  return {
+    sibling: params.sibling,
+    frontendSrcDir: params.frontendSrcDir,
+    coreApiSrcDir: params.coreApiSrcDir,
+    frontendFiles: frontend.files.length,
+    coreFiles: core.files.length,
+    extractedCount: frontend.extracted.length,
+    matchedCount,
+    unmatched,
+    unresolved,
+    corePrefixCount: core.prefixes.length,
+    frontendBlind,
+    coreBlind,
+    ok,
+    summary
+  };
+}
+
+// src/scripts/check-core-direct-paths.ts
+async function runCoreDirectPathsCheck(opts = {}) {
+  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const sibling = opts.sibling ?? "sibling-template (self-check)";
+  const frontendSrcDir = opts.frontendSrc ?? join37(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const coreApiSrcDir = opts.coreSrc ?? join37(root, "services", "api", "src");
+  const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
+  console.log(
+    `audited ${report.extractedCount} core-direct call site(s) across ${report.frontendFiles} frontend file(s) under ${frontendSrcDir}, against ${report.corePrefixCount} route prefix(es) from ${report.coreFiles} core file(s) under ${coreApiSrcDir}`
+  );
+  if (!report.ok) {
+    console.error(`\u2717 core-direct-paths guard (${sibling}): unmatched or unresolved call site(s)
+`);
+    if (report.frontendBlind) {
+      console.error(
+        "  BLIND (frontend): raw source contains external-base interpolations but the extractor found none \u2014 the extractor broke, this is not evidence of a clean tree."
+      );
+    }
+    if (report.coreBlind) {
+      console.error(
+        "  BLIND (core): raw source contains APIRouter(...) call sites but no prefixes were extracted \u2014 the extractor broke, this is not evidence core registers nothing."
+      );
+    }
+    for (const p of report.unmatched) {
+      console.error(
+        `  UNMATCHED  ${p.file}:${p.line}  ${JSON.stringify(p.raw)} -> normalised ${JSON.stringify(p.normalized)}, no core route prefix matches`
+      );
+    }
+    for (const p of report.unresolved) {
+      console.error(
+        `  UNRESOLVED ${p.file}:${p.line}  ${JSON.stringify(p.raw)} -> ${p.unresolvedReason}`
+      );
+    }
+    console.error("\nSee biffo-template#1377.");
+    process.exit(1);
+  }
+  console.log(`\u2713 core-direct-paths guard: ${report.summary}`);
+}
+
+// src/scripts/check-core-ownership.ts
+import { execa as execa8 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -9865,7 +10199,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -9881,11 +10215,11 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa7("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa8("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync29, existsSync: existsSync41 } = await import("fs");
-      if (existsSync41(messageFile)) commitMessage = readFileSync29(messageFile, "utf8");
+      const { readFileSync: readFileSync32, existsSync: existsSync42 } = await import("fs");
+      if (existsSync42(messageFile)) commitMessage = readFileSync32(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -9893,18 +10227,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa7("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa7("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa8("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa8("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa7("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa8("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa7("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa8("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -9985,35 +10319,249 @@ ${BOLD}If the divergence is deliberate${OFF}
   process.exit(1);
 }
 
+// src/scripts/check-eventbridge-log-permissions.ts
+import { execa as execa9 } from "execa";
+
+// src/lib/eventbridge-log-permission-guard.ts
+import { readFileSync as readFileSync28, readdirSync as readdirSync15, statSync as statSync8 } from "fs";
+import { join as join38 } from "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
+var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
+var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
+var LOG_GROUP_ARN_REF = /aws_cloudwatch_log_group\.([\w-]+)(?:\[[^\]]*\])?\.arn/g;
+var EVENTBRIDGE_PRINCIPAL = "events.amazonaws.com";
+var SERVICE_PRINCIPAL_ASSIGNMENT = /Service\s*=\s*(\[[^\]]*\]|"[^"]*")/g;
+function servicePrincipalsIn(body) {
+  const values = [];
+  SERVICE_PRINCIPAL_ASSIGNMENT.lastIndex = 0;
+  let m;
+  while ((m = SERVICE_PRINCIPAL_ASSIGNMENT.exec(body)) !== null) {
+    const raw = m[1];
+    for (const sm of raw.matchAll(/"([^"]*)"/g)) {
+      values.push(sm[1]);
+    }
+  }
+  return values;
+}
+function grantsPrincipal(body, principal) {
+  return servicePrincipalsIn(body).includes(principal);
+}
+function lineNumber2(text, index) {
+  let count = 1;
+  for (let i = 0; i < index && i < text.length; i++) {
+    if (text[i] === "\n") count += 1;
+  }
+  return count;
+}
+function balancedBraceSpan(text, openIndex) {
+  let depth = 0;
+  for (let i = openIndex; i < text.length; i++) {
+    if (text[i] === "{") depth += 1;
+    else if (text[i] === "}") {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return null;
+}
+function findResourceBlocks(text, file, resourceType) {
+  const blocks = [];
+  const pattern = new RegExp(`resource\\s+"${resourceType}"\\s+"([\\w-]+)"\\s*\\{`, "g");
+  let m;
+  while ((m = pattern.exec(text)) !== null) {
+    const name = m[1];
+    const line = lineNumber2(text, m.index);
+    const openIndex = m.index + m[0].length - 1;
+    const closeIndex = balancedBraceSpan(text, openIndex);
+    if (closeIndex === null) {
+      blocks.push({ file, line, type: resourceType, name, body: null });
+      continue;
+    }
+    blocks.push({
+      file,
+      line,
+      type: resourceType,
+      name,
+      body: text.slice(openIndex + 1, closeIndex)
+    });
+  }
+  return blocks;
+}
+function countRawResourceDeclarations(text, resourceType) {
+  const needle = `resource "${resourceType}"`;
+  return text.split(needle).length - 1;
+}
+function walkTerraformFiles(root) {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync15(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const p = join38(dir, entry);
+      let st;
+      try {
+        st = statSync8(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (SKIP_DIRS.has(entry)) continue;
+        walk(p);
+        continue;
+      }
+      if (entry.endsWith(".tf")) out.push(p);
+    }
+  };
+  walk(root);
+  return out.sort();
+}
+function resolveEventTargetLogGroup(body) {
+  const m = /arn\s*=\s*aws_cloudwatch_log_group\.([\w-]+)(?:\[[^\]]*\])?\.arn/.exec(body);
+  return m ? m[1] : null;
+}
+function logGroupNamesReferencedIn(body) {
+  const names = /* @__PURE__ */ new Set();
+  LOG_GROUP_ARN_REF.lastIndex = 0;
+  let m;
+  while ((m = LOG_GROUP_ARN_REF.exec(body)) !== null) {
+    names.add(m[1]);
+  }
+  return names;
+}
+function auditEventBridgeLogPermissions(root) {
+  const files = walkTerraformFiles(root);
+  if (files.length === 0) {
+    throw new Error(
+      `auditEventBridgeLogPermissions: no .tf files found under ${root} \u2014 the guard cannot verify anything against input it cannot see. This is a hard failure, not "0 violations": fix the path, do not treat an empty scan as a clean pass.`
+    );
+  }
+  const eventTargetBlocks = [];
+  const logResourcePolicyBlocks = [];
+  let rawEventTargetCount = 0;
+  let rawLogPolicyCount = 0;
+  for (const file of files) {
+    const text = readFileSync28(file, "utf8");
+    rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
+    rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
+    eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
+    logResourcePolicyBlocks.push(...findResourceBlocks(text, file, LOG_RESOURCE_POLICY_TYPE));
+  }
+  const unterminatedBlocks = [...eventTargetBlocks, ...logResourcePolicyBlocks].filter(
+    (b) => b.body === null
+  );
+  const eventTargetBlind = rawEventTargetCount > 0 && eventTargetBlocks.length === 0;
+  const logPolicyBlind = rawLogPolicyCount > 0 && logResourcePolicyBlocks.length === 0;
+  const logTargets = [];
+  for (const block of eventTargetBlocks) {
+    if (block.body === null) continue;
+    const logGroupName = resolveEventTargetLogGroup(block.body);
+    if (logGroupName === null) continue;
+    logTargets.push({ file: block.file, line: block.line, targetName: block.name, logGroupName });
+  }
+  const grantedLogGroups = /* @__PURE__ */ new Set();
+  for (const block of logResourcePolicyBlocks) {
+    if (block.body === null) continue;
+    if (!grantsPrincipal(block.body, EVENTBRIDGE_PRINCIPAL)) continue;
+    for (const name of logGroupNamesReferencedIn(block.body)) grantedLogGroups.add(name);
+  }
+  const violations = [];
+  for (const target of logTargets) {
+    if (grantedLogGroups.has(target.logGroupName)) continue;
+    violations.push({
+      file: target.file,
+      line: target.line,
+      targetName: target.targetName,
+      logGroupName: target.logGroupName,
+      reason: `aws_cloudwatch_event_target.${target.targetName} writes to aws_cloudwatch_log_group.${target.logGroupName}, but no aws_cloudwatch_log_resource_policy grants ${EVENTBRIDGE_PRINCIPAL} access to that group \u2014 terraform apply will succeed and the rule will report ENABLED, but \`put-events\` will accept every event while the log group receives none (#1356).`
+    });
+  }
+  const ok = !eventTargetBlind && !logPolicyBlind && unterminatedBlocks.length === 0 && violations.length === 0;
+  const summary = `${files.length} .tf file(s) scanned under ${root}; ${eventTargetBlocks.length} ${EVENT_TARGET_TYPE} block(s) found (${logTargets.length} targeting a log group), ${logResourcePolicyBlocks.length} ${LOG_RESOURCE_POLICY_TYPE} block(s) found; ${violations.length} unpermissioned, ${unterminatedBlocks.length} unterminated.`;
+  return {
+    filesScanned: files.length,
+    eventTargetBlocksFound: eventTargetBlocks.length,
+    logResourcePolicyBlocksFound: logResourcePolicyBlocks.length,
+    logTargets,
+    unterminatedBlocks,
+    violations,
+    eventTargetBlind,
+    logPolicyBlind,
+    ok,
+    summary
+  };
+}
+
+// src/scripts/check-eventbridge-log-permissions.ts
+async function runEventBridgeLogPermissionCheck() {
+  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  let report;
+  try {
+    report = auditEventBridgeLogPermissions(root);
+  } catch (err) {
+    console.error("\u2717 EventBridge log permission guard: could not run\n");
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  console.log(`audited ${report.filesScanned} .tf file(s) under ${root}`);
+  if (!report.ok) {
+    console.error("\u2717 EventBridge log permission guard: unpermissioned target(s) found\n");
+    if (report.eventTargetBlind) {
+      console.error(
+        "  BLIND (aws_cloudwatch_event_target): raw source contains this resource type but the block extractor found none \u2014 the extractor broke, this is not evidence there are no event targets (#1374 was exactly this shape on an adjacent guard)."
+      );
+    }
+    if (report.logPolicyBlind) {
+      console.error(
+        "  BLIND (aws_cloudwatch_log_resource_policy): raw source contains this resource type but the block extractor found none \u2014 the extractor broke, this is not evidence there are no log resource policies."
+      );
+    }
+    for (const b of report.unterminatedBlocks) {
+      console.error(
+        `  UNTERMINATED ${b.file}:${b.line}  resource "${b.type}" "${b.name}" never closes \u2014 cannot verify what it grants or targets.`
+      );
+    }
+    for (const v of report.violations) {
+      console.error(`  UNPERMISSIONED ${v.file}:${v.line}  ${v.reason}`);
+    }
+    console.error("\nSee biffo-template#1356.");
+    process.exit(1);
+  }
+  console.log(`\u2713 EventBridge log permission guard: ${report.summary}`);
+}
+
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync37 } from "fs";
-import { join as join37 } from "path";
-import { execa as execa8 } from "execa";
+import { join as join40 } from "path";
+import { execa as execa10 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync36, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
-import { join as join36 } from "path";
+import { existsSync as existsSync36, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
+import { join as join39 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
   if (!existsSync36(dir)) return [];
-  return readdirSync14(dir).filter((entry) => {
+  return readdirSync16(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync7(join36(dir, entry)).isDirectory();
+      return statSync9(join39(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync36(join36(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync36(join39(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join36(pluginDir2, "tests");
+  const testsDir = join39(pluginDir2, "tests");
   if (!existsSync36(testsDir)) return [];
-  if (existsSync36(join36(testsDir, "__init__.py"))) return [];
-  return readdirSync14(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
+  if (existsSync36(join39(testsDir, "__init__.py"))) return [];
+  return readdirSync16(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
   const plugins = (pluginDirs ?? subdirectories(servicesDir)).filter((name) => !name.startsWith("_")).filter((name) => name !== "api").sort();
@@ -10021,7 +10569,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join36(servicesDir, plugin))) {
+      for (const name of namesOf(join39(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -10058,8 +10606,8 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join37(root, "services");
+  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join40(root, "services");
   if (!existsSync37(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
@@ -10077,28 +10625,28 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa9 } from "execa";
+import { execa as execa11 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync38, readFileSync as readFileSync27, readdirSync as readdirSync15 } from "fs";
-import { dirname as dirname9, join as join38, relative as relative6, sep as sep3 } from "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
+import { existsSync as existsSync38, readFileSync as readFileSync29, readdirSync as readdirSync17 } from "fs";
+import { dirname as dirname9, join as join41, relative as relative6, sep as sep3 } from "path";
+var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
   const found = [];
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync15(dir, { withFileTypes: true });
+      entries = readdirSync17(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (SKIP_DIRS.has(entry.name)) continue;
-        walk(join38(dir, entry.name));
+        if (SKIP_DIRS2.has(entry.name)) continue;
+        walk(join41(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative6(root, join38(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative6(root, join41(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -10108,7 +10656,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync27(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync29(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -10123,14 +10671,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync38(join38(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync38(join41(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join38(root, manifest);
+    const absManifest = join41(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname9(absManifest);
-    if (existsSync38(join38(pluginDir2, "terraform"))) continue;
+    if (existsSync38(join41(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative6(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -10150,7 +10698,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -10160,8 +10708,448 @@ async function runPluginTerraformCheck() {
   console.log("\u2713 plugin Terraform guard: OK");
 }
 
+// src/scripts/check-plugin-tool-supply.ts
+import { existsSync as existsSync39 } from "fs";
+import { join as join43 } from "path";
+import { execa as execa12 } from "execa";
+
+// src/lib/plugin-tool-supply-audit.ts
+import { readFileSync as readFileSync30, readdirSync as readdirSync18, statSync as statSync10 } from "fs";
+import { join as join42 } from "path";
+function listDirs(root) {
+  let entries;
+  try {
+    entries = readdirSync18(root);
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => {
+    try {
+      return statSync10(join42(root, e)).isDirectory();
+    } catch {
+      return false;
+    }
+  }).sort();
+}
+function walkFiles2(root, accept, skipDir) {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync18(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const p = join42(dir, entry);
+      let st;
+      try {
+        st = statSync10(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (skipDir(entry)) continue;
+        walk(p);
+        continue;
+      }
+      if (accept(entry)) out.push(p);
+    }
+  };
+  walk(root);
+  return out.sort();
+}
+function pluginPythonFiles(pluginDir2) {
+  return walkFiles2(
+    pluginDir2,
+    (entry) => entry.endsWith(".py") && !entry.startsWith("test_") && !entry.endsWith("_test.py"),
+    (entry) => entry === "tests" || entry === "__pycache__" || entry === "terraform"
+  );
+}
+function pluginTerraformFiles(pluginDir2) {
+  const tfDir = join42(pluginDir2, "terraform");
+  let entries;
+  try {
+    entries = readdirSync18(tfDir);
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join42(tfDir, e)).sort();
+}
+function extractManifestTools(manifestText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(manifestText);
+  } catch (exc) {
+    return { tools: [], parseError: `invalid JSON: ${exc.message}` };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { tools: [], parseError: "manifest is not a JSON object" };
+  }
+  const raw = parsed.tools;
+  if (raw === void 0) return { tools: [], parseError: null };
+  if (!Array.isArray(raw))
+    return { tools: [], parseError: '"tools" is present but is not an array' };
+  const tools = [];
+  for (const entry of raw) {
+    if (typeof entry === "string" && entry.trim()) {
+      tools.push(entry.trim());
+      continue;
+    }
+    if (entry && typeof entry === "object" && typeof entry.name === "string" && entry.name.trim()) {
+      tools.push(entry.name.trim());
+      continue;
+    }
+    return {
+      tools: [],
+      parseError: `a "tools" entry has no resolvable string name: ${JSON.stringify(entry)}`
+    };
+  }
+  return { tools, parseError: null };
+}
+var ASSIGNMENT = /^[ \t]*([A-Za-z_][A-Za-z0-9_]*)\s*(?::\s*[A-Za-z_][\w.[\], ]*)?\s*=\s*("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')/gm;
+function unquote2(literal) {
+  return literal.slice(1, -1);
+}
+function isStringLiteral(token) {
+  return /^"(?:[^"\\]|\\.)*"$/.test(token) || /^'(?:[^'\\]|\\.)*'$/.test(token);
+}
+var SymbolResolver = class {
+  constructor(perFile, merged) {
+    this.perFile = perFile;
+    this.merged = merged;
+  }
+  perFile;
+  merged;
+  resolve(token, file) {
+    const trimmed = token.trim();
+    if (isStringLiteral(trimmed)) return unquote2(trimmed);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(trimmed)) return null;
+    const local = this.perFile.get(file);
+    if (local?.has(trimmed)) return local.get(trimmed);
+    const cross = this.merged.get(trimmed);
+    return typeof cross === "string" ? cross : null;
+  }
+};
+function buildSymbolResolver(sources) {
+  const perFile = /* @__PURE__ */ new Map();
+  const merged = /* @__PURE__ */ new Map();
+  for (const { file, text } of sources) {
+    const table = /* @__PURE__ */ new Map();
+    ASSIGNMENT.lastIndex = 0;
+    let m;
+    while ((m = ASSIGNMENT.exec(text)) !== null) {
+      const [ident, literal] = [m[1], m[2]];
+      if (!table.has(ident)) table.set(ident, unquote2(literal));
+    }
+    perFile.set(file, table);
+    for (const [name, value] of table) {
+      if (!merged.has(name)) merged.set(name, value);
+      else if (merged.get(name) !== value) merged.set(name, null);
+    }
+  }
+  return new SymbolResolver(perFile, merged);
+}
+function balancedSpanFrom(text, openIndex, openCh, closeCh) {
+  let depth = 0;
+  for (let i = openIndex; i < text.length; i++) {
+    if (text[i] === openCh) depth += 1;
+    else if (text[i] === closeCh) {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return null;
+}
+var NAME_KWARG = /\bname\s*=\s*("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[A-Za-z_][A-Za-z0-9_]*)\s*,/;
+var IS_AVAILABLE_KWARG = /\bis_available\s*=\s*([A-Za-z_][A-Za-z0-9_.]*)\s*,?/;
+function extractToolRegistryEntries(sources, resolver) {
+  const entries = [];
+  let rawToolDefinitionCount = 0;
+  for (const { file, text } of sources) {
+    const callSite = /ToolDefinition\s*\(/g;
+    let m;
+    while ((m = callSite.exec(text)) !== null) {
+      rawToolDefinitionCount += 1;
+      const openIdx = m.index + m[0].length - 1;
+      const closeIdx = balancedSpanFrom(text, openIdx, "(", ")");
+      if (closeIdx === null) continue;
+      const inner = text.slice(openIdx + 1, closeIdx);
+      const nameMatch = NAME_KWARG.exec(inner);
+      if (!nameMatch) {
+        entries.push({
+          name: null,
+          predicate: null,
+          unresolvedReason: `ToolDefinition(...) call in ${file} has no resolvable \`name=\` kwarg`
+        });
+        continue;
+      }
+      const resolvedName = resolver.resolve(nameMatch[1], file);
+      if (resolvedName === null) {
+        entries.push({
+          name: null,
+          predicate: null,
+          unresolvedReason: `name=${nameMatch[1]} in ${file} is an identifier absent from (or ambiguous in) the symbol table`
+        });
+        continue;
+      }
+      const availMatch = IS_AVAILABLE_KWARG.exec(inner);
+      if (!availMatch) {
+        entries.push({ name: resolvedName, predicate: null, unresolvedReason: null });
+        continue;
+      }
+      const dotted = availMatch[1];
+      const predicate = dotted.includes(".") ? dotted.split(".").pop() : dotted;
+      entries.push({ name: resolvedName, predicate, unresolvedReason: null });
+    }
+  }
+  return { entries, rawToolDefinitionCount };
+}
+var ENV_READ = /\bos\.(?:environ\.get|getenv)\(\s*("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[A-Za-z_][A-Za-z0-9_]*)|\bos\.environ\[\s*("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[A-Za-z_][A-Za-z0-9_]*)\s*\]/g;
+function extractPredicateEnvVars(sources, predicate, resolver) {
+  const defPattern = new RegExp(`^def\\s+${predicate}\\s*\\(`, "m");
+  let found = null;
+  for (const { file, text } of sources) {
+    const defMatch = defPattern.exec(text);
+    if (!defMatch) continue;
+    const bodyStart = defMatch.index + defMatch[0].length;
+    const rest = text.slice(bodyStart);
+    const nextTopLevel = /^(?:def |class )/m.exec(rest);
+    found = { file, body: nextTopLevel ? rest.slice(0, nextTopLevel.index) : rest };
+    break;
+  }
+  if (!found) return { predicateFound: false, envVars: [], unresolvedTokens: [] };
+  const envVars = /* @__PURE__ */ new Set();
+  const unresolvedTokens = /* @__PURE__ */ new Set();
+  ENV_READ.lastIndex = 0;
+  let m;
+  while ((m = ENV_READ.exec(found.body)) !== null) {
+    const token = m[1] ?? m[2];
+    const resolved = resolver.resolve(token, found.file);
+    if (resolved === null) unresolvedTokens.add(token);
+    else envVars.add(resolved);
+  }
+  return {
+    predicateFound: true,
+    envVars: [...envVars].sort(),
+    unresolvedTokens: [...unresolvedTokens].sort()
+  };
+}
+function extractTerraformEnvKeys(tfText) {
+  const keys = /* @__PURE__ */ new Set();
+  let resolvedBlockCount = 0;
+  let rawMarkerCount = 0;
+  const marker = /environment_variables\s*=\s*/g;
+  let m;
+  while ((m = marker.exec(tfText)) !== null) {
+    rawMarkerCount += 1;
+    let openIdx = m.index + m[0].length;
+    while (openIdx < tfText.length) {
+      const ch = tfText.charAt(openIdx);
+      if (ch === "{" || ch === "(") break;
+      if (ch === "\n" || !/[\s.A-Za-z0-9_]/.test(ch)) {
+        openIdx = -1;
+        break;
+      }
+      openIdx += 1;
+    }
+    if (openIdx === -1 || openIdx >= tfText.length) continue;
+    const openCh = tfText.charAt(openIdx);
+    const closeCh = openCh === "{" ? "}" : ")";
+    const endIdx = balancedSpanFrom(tfText, openIdx, openCh, closeCh);
+    if (endIdx === null) continue;
+    resolvedBlockCount += 1;
+    const inner = tfText.slice(openIdx, endIdx + 1);
+    const keyPattern = /^\s*([A-Z][A-Z0-9_]*)\s*=/gm;
+    let km;
+    while ((km = keyPattern.exec(inner)) !== null) {
+      keys.add(km[1]);
+    }
+  }
+  return { keys: [...keys].sort(), rawMarkerCount, resolvedBlockCount };
+}
+function discoverPluginDirs(pluginsRoot) {
+  return listDirs(pluginsRoot).filter((name) => {
+    try {
+      return statSync10(join42(pluginsRoot, name, "biffo.plugin.json")).isFile();
+    } catch {
+      return false;
+    }
+  });
+}
+function auditPluginToolSupply(pluginsRoot) {
+  const pluginNames = discoverPluginDirs(pluginsRoot);
+  const findings = [];
+  let registryBlind = false;
+  let terraformBlind = false;
+  let totalDeclaredTools = 0;
+  for (const name of pluginNames) {
+    const pluginDir2 = join42(pluginsRoot, name);
+    const manifestText = readFileSync30(join42(pluginDir2, "biffo.plugin.json"), "utf8");
+    const manifest = extractManifestTools(manifestText);
+    if (manifest.parseError) {
+      findings.push({
+        plugin: name,
+        tool: "(manifest)",
+        predicate: null,
+        requiredEnvVars: [],
+        missingEnvVars: [],
+        status: "unresolved-registry",
+        detail: `manifest could not be read: ${manifest.parseError}`
+      });
+      continue;
+    }
+    if (manifest.tools.length === 0) continue;
+    totalDeclaredTools += manifest.tools.length;
+    const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
+      file: f,
+      text: readFileSync30(f, "utf8")
+    }));
+    const resolver = buildSymbolResolver(pySources);
+    const registry = extractToolRegistryEntries(pySources, resolver);
+    if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
+    const tfFiles = pluginTerraformFiles(pluginDir2);
+    const tfText = tfFiles.map((f) => readFileSync30(f, "utf8")).join("\n");
+    const terraform = extractTerraformEnvKeys(tfText);
+    if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
+    for (const toolName of manifest.tools) {
+      const entry = registry.entries.find((e) => e.name === toolName);
+      if (!entry) {
+        findings.push({
+          plugin: name,
+          tool: toolName,
+          predicate: null,
+          requiredEnvVars: [],
+          missingEnvVars: [],
+          status: "unresolved-registry",
+          detail: `manifest declares "${toolName}" but no ToolDefinition in ${pluginDir2} resolves to that name`
+        });
+        continue;
+      }
+      if (entry.predicate === null) {
+        findings.push({
+          plugin: name,
+          tool: toolName,
+          predicate: null,
+          requiredEnvVars: [],
+          missingEnvVars: [],
+          status: "ok",
+          detail: "registered with no is_available gate (unconditionally available)"
+        });
+        continue;
+      }
+      const envResult = extractPredicateEnvVars(pySources, entry.predicate, resolver);
+      if (!envResult.predicateFound) {
+        findings.push({
+          plugin: name,
+          tool: toolName,
+          predicate: entry.predicate,
+          requiredEnvVars: [],
+          missingEnvVars: [],
+          status: "unresolved-predicate",
+          detail: `is_available=${entry.predicate} but no "def ${entry.predicate}(" was found anywhere under ${pluginDir2}`
+        });
+        continue;
+      }
+      if (envResult.unresolvedTokens.length > 0) {
+        findings.push({
+          plugin: name,
+          tool: toolName,
+          predicate: entry.predicate,
+          requiredEnvVars: envResult.envVars,
+          missingEnvVars: [],
+          status: "unresolved-env-token",
+          detail: `${entry.predicate}() reads os.environ token(s) ${JSON.stringify(envResult.unresolvedTokens)} that are identifiers absent from the symbol table`
+        });
+        continue;
+      }
+      if (envResult.envVars.length === 0) {
+        findings.push({
+          plugin: name,
+          tool: toolName,
+          predicate: entry.predicate,
+          requiredEnvVars: [],
+          missingEnvVars: [],
+          status: "ok",
+          detail: `${entry.predicate}() gates availability but reads no os.environ variable this guard can cross-check`
+        });
+        continue;
+      }
+      const anyWired = envResult.envVars.some((v) => terraform.keys.includes(v));
+      findings.push({
+        plugin: name,
+        tool: toolName,
+        predicate: entry.predicate,
+        requiredEnvVars: envResult.envVars,
+        missingEnvVars: anyWired ? [] : envResult.envVars,
+        status: anyWired ? "ok" : "missing-env",
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join42(pluginDir2, "terraform")}, so this deployment can never supply it`
+      });
+    }
+  }
+  const noPluginsFound = pluginNames.length === 0;
+  const noToolsDeclaredAnywhere = !noPluginsFound && totalDeclaredTools === 0;
+  const badFindings = findings.filter((f) => f.status !== "ok");
+  const ok = !noPluginsFound && !registryBlind && !terraformBlind && badFindings.length === 0;
+  const summaryParts = [
+    `${pluginNames.length} plugin dir(s) under ${pluginsRoot}`,
+    `${totalDeclaredTools} declared tool(s)`,
+    `${findings.length} cross-checked, ${badFindings.length} not ok`
+  ];
+  if (noPluginsFound) summaryParts.push("NO PLUGINS FOUND \u2014 cannot evaluate an empty world");
+  if (registryBlind) summaryParts.push("REGISTRY BLIND");
+  if (terraformBlind) summaryParts.push("TERRAFORM BLIND");
+  return {
+    pluginsRoot,
+    plugins: pluginNames,
+    findings,
+    registryBlind,
+    terraformBlind,
+    noPluginsFound,
+    noToolsDeclaredAnywhere,
+    ok,
+    summary: summaryParts.join("; ")
+  };
+}
+
+// src/scripts/check-plugin-tool-supply.ts
+async function runPluginToolSupplyCheck() {
+  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const pluginsRoot = join43(root, "services", "_plugins");
+  if (!existsSync39(pluginsRoot)) {
+    console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
+    return;
+  }
+  const report = auditPluginToolSupply(pluginsRoot);
+  console.log(
+    `audited ${report.plugins.length} plugin dir(s), ${report.findings.length} declared tool(s) cross-checked, under ${pluginsRoot}`
+  );
+  if (!report.ok) {
+    console.error("\u2717 plugin tool-supply guard: an unsatisfiable tool grant found\n");
+    if (report.noPluginsFound) {
+      console.error(`  NO PLUGINS FOUND under ${pluginsRoot} \u2014 cannot evaluate an empty world.`);
+    }
+    if (report.registryBlind) {
+      console.error(
+        "  REGISTRY BLIND: raw source contains ToolDefinition( call site(s) but the extractor resolved none \u2014 the extractor broke, this is not evidence a plugin registers nothing."
+      );
+    }
+    if (report.terraformBlind) {
+      console.error(
+        "  TERRAFORM BLIND: raw source contains environment_variables but the extractor resolved no keys \u2014 the extractor broke, this is not evidence of an empty Lambda."
+      );
+    }
+    for (const f of report.findings.filter((f2) => f2.status !== "ok")) {
+      console.error(`  ${f.status.toUpperCase()}  ${f.plugin}/${f.tool}  ${f.detail}`);
+    }
+    console.error("\nSee biffo-template#822.");
+    process.exit(1);
+  }
+  console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
+}
+
 // src/scripts/check-release-subject.ts
-import { execa as execa10 } from "execa";
+import { execa as execa13 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -10198,7 +11186,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa10(
+  const { stdout } = await execa13(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -10234,7 +11222,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa10("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa13("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -10242,9 +11230,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa10("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa10("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa13("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa13("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -10293,7 +11281,7 @@ async function runReleaseSubjectCheck(argv) {
 
 // src/commands/check.ts
 var checkCommand = new Command23("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions) run in CI and git hooks, plus out-of-band audits (branch protection)"
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths) run in CI and git hooks, plus out-of-band audits (branch protection)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -10312,6 +11300,21 @@ checkCommand.command("adr-numbering").description(
 ).action(async () => {
   await runAdrNumberingCheck();
 });
+checkCommand.command("eventbridge-log-permissions").description(
+  "Refuse an EventBridge target writing to a CloudWatch Logs group no resource policy grants it access to (#1356) \u2014 terraform apply succeeds and the rule reports ENABLED on the broken shape, so this is the only signal available before either exists"
+).action(async () => {
+  await runEventBridgeLogPermissionCheck();
+});
+checkCommand.command("plugin-tool-supply").description(
+  "Refuse a plugin manifest declaring a tool whose is_available predicate reads an env var no Terraform environment_variables block ever wires (#822) \u2014 the shape that left web_search silently unavailable in every environment, forever"
+).action(async () => {
+  await runPluginToolSupplyCheck();
+});
+checkCommand.command("core-direct-paths").description(
+  "Refuse a frontend's core-direct call site (bypassing its own BFF) naming a route prefix core does not register (#1377). Defaults to a self-check of the sibling skeleton against this repo's own services/api/src; --sibling/--frontend-src/--core-src point it at a real checked-out sibling instead"
+).option("--sibling <name>", "Label for the report").option("--frontend-src <dir>", "Sibling's frontend source directory to scan").option("--core-src <dir>", "Core API's source directory (ground truth for route prefixes)").action(async (opts) => {
+  await runCoreDirectPathsCheck(opts);
+});
 checkCommand.command("branch-protection").description(
   "Verify dev/staging/main are actually protected \u2014 scaffolding skips this on a 403 (#715)"
 ).option("--repo <owner/name>", "Repo to audit; defaults to this checkout's origin remote").option(
@@ -10326,8 +11329,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync39, readFileSync as readFileSync28 } from "fs";
-import { join as join39, resolve as resolve18 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync31 } from "fs";
+import { join as join44, resolve as resolve18 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
 
@@ -10502,10 +11505,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join39(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync39(path)) return null;
+  const path = join44(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync40(path)) return null;
   try {
-    return parseCoreRecord(readFileSync28(path, "utf8"));
+    return parseCoreRecord(readFileSync31(path, "utf8"));
   } catch {
     return null;
   }
@@ -10520,10 +11523,10 @@ function parseCoreRecord(contents) {
   }
 }
 function readFossil(cwd) {
-  const path = join39(cwd, CORE_VERSION_FILE);
-  if (!existsSync39(path)) return null;
+  const path = join44(cwd, CORE_VERSION_FILE);
+  if (!existsSync40(path)) return null;
   try {
-    const value = readFileSync28(path, "utf8").trim();
+    const value = readFileSync31(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -10972,13 +11975,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command26 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync40 } from "fs";
-import { dirname as dirname10, join as join40 } from "path";
+import { existsSync as existsSync41 } from "fs";
+import { dirname as dirname10, join as join45 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join40(dir, relativePath);
-    if (existsSync40(candidate)) return candidate;
+    const candidate = join45(dir, relativePath);
+    if (existsSync41(candidate)) return candidate;
     const parent = dirname10(dir);
     if (parent === dir) return null;
     dir = parent;