@biffo/cli 0.280.0 → 0.281.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command27 } from "commander";
+import { Command as Command28 } from "commander";
 
 // src/commands/core.ts
 import { Command as Command4 } from "commander";
@@ -1082,6 +1082,23 @@ var GitAdapter = class {
     const { stdout } = await execa2("git", ["remote", "get-url", remote], { cwd });
     return stdout.trim();
   }
+  /**
+   * The commit SHA `HEAD` currently resolves to on `repoUrl`'s default
+   * branch, without cloning anything — a single `git ls-remote` round trip.
+   * Built for plugin provenance/staleness (#1547): recording or checking a
+   * source commit should not need a full clone when the answer is one
+   * network call. Returns `null` on any failure (network, auth, a repo that
+   * does not exist) rather than throwing — both call sites treat an unknown
+   * SHA as an honest "could not determine", never as license to invent one.
+   */
+  async resolveDefaultBranchSha(repoUrl) {
+    const { stdout, exitCode } = await execa2("git", ["ls-remote", "--exit-code", repoUrl, "HEAD"], {
+      reject: false
+    });
+    if (exitCode !== 0) return null;
+    const sha = stdout.split(/\s+/)[0];
+    return sha && /^[0-9a-f]{40}$/i.test(sha) ? sha : null;
+  }
   /**
    * Prunes remote-tracking refs whose remote branch is gone, so `upstream:track`
    * reports `[gone]` for a merged-and-deleted branch (#758).
@@ -1596,7 +1613,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1611,7 +1628,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1845,7 +1862,7 @@ var GitHubAdapter = class {
             }
             if (status !== 404 || Date.now() >= deadline) throw err;
             log.info("Branch protection endpoint not yet ready, retrying...");
-            await new Promise((resolve20) => setTimeout(resolve20, protectionIntervalMs));
+            await new Promise((resolve21) => setTimeout(resolve21, protectionIntervalMs));
           }
         }
       }
@@ -2018,7 +2035,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve20) => setTimeout(resolve20, protectionIntervalMs));
+          await new Promise((resolve21) => setTimeout(resolve21, protectionIntervalMs));
         }
       }
     } catch (err) {
@@ -2291,7 +2308,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+        await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
       }
     }
   }
@@ -2310,7 +2327,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+        await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
       }
     }
   }
@@ -2334,7 +2351,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -4301,7 +4318,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve20) => setTimeout(resolve20, retryDelayMs));
+          await new Promise((resolve21) => setTimeout(resolve21, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -7504,7 +7521,7 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 }
 
 // src/commands/plugin.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 
 // src/commands/plugin-create.ts
 import { existsSync as existsSync26, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
@@ -8428,8 +8445,8 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync4, existsSync as existsSync28, mkdirSync as mkdirSync10, readFileSync as readFileSync21, statSync as statSync6 } from "fs";
-import { join as join30, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync4, existsSync as existsSync29, mkdirSync as mkdirSync10, readFileSync as readFileSync22, statSync as statSync6 } from "fs";
+import { join as join31, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
@@ -8475,10 +8492,90 @@ var PluginMigrationsAdapter = class {
   }
 };
 
+// src/lib/plugin-provenance.ts
+import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
+import { join as join28 } from "path";
+import { execa as execa5 } from "execa";
+var PLUGIN_PROVENANCE_FILENAME = ".biffo-plugin-provenance.json";
+function isPluginProvenance(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v["origin"] === "string" && (typeof v["ref"] === "string" || v["ref"] === null) && (typeof v["sha"] === "string" || v["sha"] === null) && typeof v["recordedAt"] === "string" && typeof v["inTree"] === "boolean";
+}
+function readProvenance(pluginDir2) {
+  const path = join28(pluginDir2, PLUGIN_PROVENANCE_FILENAME);
+  if (!existsSync27(path)) return { status: "absent" };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync20(path, "utf8"));
+  } catch (err) {
+    return {
+      status: "invalid",
+      reason: `could not parse ${PLUGIN_PROVENANCE_FILENAME}: ${err.message}`
+    };
+  }
+  if (!isPluginProvenance(parsed)) {
+    return {
+      status: "invalid",
+      reason: `${PLUGIN_PROVENANCE_FILENAME} does not have the expected shape`
+    };
+  }
+  return { status: "present", record: parsed };
+}
+function writePluginProvenance(pluginDir2, record) {
+  writeFileSync10(join28(pluginDir2, PLUGIN_PROVENANCE_FILENAME), `${JSON.stringify(record, null, 2)}
+`);
+}
+function reconcileProvenance(previous, next) {
+  if (previous.status === "present" && sameProvenance(previous.record, next)) return previous.record;
+  return next;
+}
+function sameProvenance(a, b) {
+  return a.origin === b.origin && a.ref === b.ref && a.sha === b.sha && a.inTree === b.inTree;
+}
+function inTreePluginProvenance(relTargetDir) {
+  return {
+    origin: relTargetDir,
+    ref: null,
+    sha: null,
+    recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    inTree: true
+  };
+}
+async function resolveLocalProvenance(sourceDir, origin) {
+  const recordedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (!await isGitWorkingTree(sourceDir)) {
+    return { origin, ref: null, sha: null, recordedAt, inTree: false };
+  }
+  const sha = await tryGit(sourceDir, ["rev-parse", "HEAD"]);
+  const rawRef = await tryGit(sourceDir, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const ref = rawRef && rawRef !== "HEAD" ? rawRef : null;
+  return { origin, ref, sha, recordedAt, inTree: false };
+}
+function resolveRegistryProvenance(repoUrl, sha) {
+  return { origin: repoUrl, ref: null, sha, recordedAt: (/* @__PURE__ */ new Date()).toISOString(), inTree: false };
+}
+async function isGitWorkingTree(dir) {
+  try {
+    await execa5("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function tryGit(cwd, args) {
+  try {
+    const { stdout } = await execa5("git", args, { cwd });
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
 // src/lib/plugin-source-copy.ts
 import { copyFileSync as copyFileSync2, cpSync as cpSync3, mkdirSync as mkdirSync9 } from "fs";
-import { basename, dirname as dirname9, join as join28 } from "path";
-import { execa as execa5 } from "execa";
+import { basename, dirname as dirname9, join as join29 } from "path";
+import { execa as execa6 } from "execa";
 var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".git",
   ".venv",
@@ -8491,12 +8588,12 @@ var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".terraform"
 ]);
 async function copyPluginSource(sourceDir, targetDir) {
-  if (await isGitWorkingTree(sourceDir)) {
+  if (await isGitWorkingTree2(sourceDir)) {
     const files = await listGitFiles(sourceDir);
     for (const relPath of files) {
-      const destPath = join28(targetDir, relPath);
+      const destPath = join29(targetDir, relPath);
       mkdirSync9(dirname9(destPath), { recursive: true });
-      copyFileSync2(join28(sourceDir, relPath), destPath);
+      copyFileSync2(join29(sourceDir, relPath), destPath);
     }
     return { usedGitIgnoreRules: true };
   }
@@ -8510,16 +8607,16 @@ async function copyPluginSource(sourceDir, targetDir) {
   });
   return { usedGitIgnoreRules: false };
 }
-async function isGitWorkingTree(dir) {
+async function isGitWorkingTree2(dir) {
   try {
-    await execa5("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    await execa6("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
     return true;
   } catch {
     return false;
   }
 }
 async function listGitFiles(dir) {
-  const { stdout } = await execa5(
+  const { stdout } = await execa6(
     "git",
     ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
     { cwd: dir }
@@ -8528,8 +8625,8 @@ async function listGitFiles(dir) {
 }
 
 // src/lib/plugin-workspace-sources.ts
-import { existsSync as existsSync27, readdirSync as readdirSync12, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync12, readFileSync as readFileSync21, writeFileSync as writeFileSync11 } from "fs";
+import { join as join30 } from "path";
 function readTomlStringArray(text, key) {
   const open = new RegExp(`^${key}\\s*=\\s*\\[`, "m").exec(text);
   if (!open) return [];
@@ -8573,9 +8670,9 @@ function readDependencyNames(text) {
   return readTomlStringArray(text, "dependencies").map((dep) => /^\s*([A-Za-z0-9._-]+)/.exec(dep)?.[1] ?? "").filter(Boolean);
 }
 function workspaceMemberNames(instanceRoot) {
-  const rootPyproject = join29(instanceRoot, "pyproject.toml");
-  if (!existsSync27(rootPyproject)) return /* @__PURE__ */ new Set();
-  const text = readFileSync20(rootPyproject, "utf8");
+  const rootPyproject = join30(instanceRoot, "pyproject.toml");
+  if (!existsSync28(rootPyproject)) return /* @__PURE__ */ new Set();
+  const text = readFileSync21(rootPyproject, "utf8");
   const members = readTomlStringArray(text, "members");
   const excluded = new Set(readTomlStringArray(text, "exclude"));
   const dirs = [];
@@ -8584,7 +8681,7 @@ function workspaceMemberNames(instanceRoot) {
       const base = member.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync12(join29(instanceRoot, base), { withFileTypes: true });
+        entries = readdirSync12(join30(instanceRoot, base), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -8598,9 +8695,9 @@ function workspaceMemberNames(instanceRoot) {
   }
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    const pp = join29(instanceRoot, dir, "pyproject.toml");
-    if (!existsSync27(pp)) continue;
-    const name = readProjectName(readFileSync20(pp, "utf8"));
+    const pp = join30(instanceRoot, dir, "pyproject.toml");
+    if (!existsSync28(pp)) continue;
+    const name = readProjectName(readFileSync21(pp, "utf8"));
     if (name) names.add(name);
   }
   return names;
@@ -8611,8 +8708,8 @@ function existingWorkspaceSources(text) {
   );
 }
 function ensureWorkspaceSources(pluginPyprojectPath, memberNames) {
-  if (!existsSync27(pluginPyprojectPath) || memberNames.size === 0) return [];
-  const text = readFileSync20(pluginPyprojectPath, "utf8");
+  if (!existsSync28(pluginPyprojectPath) || memberNames.size === 0) return [];
+  const text = readFileSync21(pluginPyprojectPath, "utf8");
   const already = existingWorkspaceSources(text);
   const toAdd = readDependencyNames(text).filter((n) => memberNames.has(n) && !already.has(n));
   if (toAdd.length === 0) return [];
@@ -8632,12 +8729,12 @@ ${lines.join("\n")}${text.slice(insertAt)}`;
 ${lines.join("\n")}
 `;
   }
-  writeFileSync10(pluginPyprojectPath, updated);
+  writeFileSync11(pluginPyprojectPath, updated);
   return toAdd;
 }
 function applyWorkspaceSources(targetDir, cwd, relTargetDir) {
-  const pluginPyproject = join29(targetDir, "pyproject.toml");
-  if (!existsSync27(pluginPyproject)) return;
+  const pluginPyproject = join30(targetDir, "pyproject.toml");
+  if (!existsSync28(pluginPyproject)) return;
   const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(cwd));
   if (sourced.length > 0) {
     log.info(
@@ -8677,14 +8774,14 @@ var pluginInstallCommand = new Command15("install").description(
   }
 );
 function resolveLocalPlugin(localPath) {
-  if (!existsSync28(localPath)) {
+  if (!existsSync29(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync6(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join30(localPath, "biffo.plugin.json");
-  if (!existsSync28(manifestPath)) {
+  const manifestPath = join31(localPath, "biffo.plugin.json");
+  if (!existsSync29(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -8710,8 +8807,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join30(tmpDir, "biffo.plugin.json");
-    if (!existsSync28(manifestPath)) {
+    const manifestPath = join31(tmpDir, "biffo.plugin.json");
+    if (!existsSync29(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -8739,8 +8836,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join30(options.cwd, "services");
-  if (!existsSync28(servicesDir)) {
+  const servicesDir = join31(options.cwd, "services");
+  if (!existsSync29(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8758,10 +8855,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join30(options.cwd, relTargetDir);
-  const modulesDir = join30(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join31(options.cwd, relTargetDir);
+  const modulesDir = join31(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync28(targetDir) && !inTreeSource) {
+  if (existsSync29(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -8800,10 +8897,13 @@ async function runPluginInstall(target, options, deps) {
       await copyPluginSource(source.sourceDir, targetDir);
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
+    const previousProvenance = readProvenance(targetDir);
+    const nextProvenance = inTreeSource ? inTreePluginProvenance(relTargetDir) : entry ? resolveRegistryProvenance(entry.repo, await deps.git.resolveDefaultBranchSha(entry.repo)) : await resolveLocalProvenance(source.sourceDir, source.origin);
+    writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, relTargetDir);
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join30(targetDir, "terraform");
-    if (existsSync28(tfSourceDir)) {
+    const tfSourceDir = join31(targetDir, "terraform");
+    if (existsSync29(tfSourceDir)) {
       mkdirSync10(modulesDir, { recursive: true });
       cpSync4(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
@@ -8860,7 +8960,7 @@ async function runPluginInstall(target, options, deps) {
 }
 function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync21(path, "utf8"));
+    return JSON.parse(readFileSync22(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
@@ -8897,8 +8997,8 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync29, readFileSync as readFileSync22 } from "fs";
-import { join as join31, resolve as resolve13 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync23 } from "fs";
+import { join as join32, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -8911,8 +9011,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join31(options.cwd, "services");
-  if (!existsSync29(servicesDir)) {
+  const servicesDir = join32(options.cwd, "services");
+  if (!existsSync30(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8920,7 +9020,7 @@ async function runPluginList(options) {
   const plugins = [];
   for (const location of findInstalledPlugins(options.cwd)) {
     try {
-      const manifest = validateManifest(JSON.parse(readFileSync22(location.manifestPath, "utf8")));
+      const manifest = validateManifest(JSON.parse(readFileSync23(location.manifestPath, "utf8")));
       plugins.push({
         name: manifest.name,
         version: manifest.version,
@@ -8956,16 +9056,275 @@ async function runPluginList(options) {
   );
 }
 
+// src/commands/plugin-staleness.ts
+import { resolve as resolve14 } from "path";
+import { Command as Command17 } from "commander";
+
+// src/lib/plugin-staleness.ts
+import { existsSync as existsSync31, readFileSync as readFileSync24, readdirSync as readdirSync13, statSync as statSync7 } from "fs";
+import { join as join33, relative as relative4 } from "path";
+function discoverVendoredPlugins(servicesDir) {
+  if (!existsSync31(servicesDir)) return [];
+  return readdirSync13(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync31(join33(servicesDir, name, "biffo.plugin.json"))).sort();
+}
+async function checkPluginStaleness(cwd, deps) {
+  const servicesDir = join33(cwd, "services");
+  const names = discoverVendoredPlugins(servicesDir);
+  let registryRepoByName = null;
+  const resolveRegistryRepo = async (name) => {
+    if (registryRepoByName === null) {
+      registryRepoByName = /* @__PURE__ */ new Map();
+      try {
+        const reg = await deps.registry.fetchRegistry();
+        for (const entry of reg.plugins) registryRepoByName.set(entry.name, entry.repo);
+      } catch {
+      }
+    }
+    return registryRepoByName.get(name) ?? null;
+  };
+  const results = [];
+  for (const name of names) {
+    results.push(await checkOnePlugin(join33(servicesDir, name), name, resolveRegistryRepo, deps.git));
+  }
+  return results;
+}
+async function checkOnePlugin(pluginDir2, name, resolveRegistryRepo, git) {
+  const provenance = readProvenance(pluginDir2);
+  if (provenance.status === "invalid") {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: `provenance file is unreadable \u2014 ${provenance.reason}`
+    };
+  }
+  const record = provenance.status === "present" ? provenance.record : null;
+  if (record?.inTree) {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: `installed --local straight into services/${name}/ (in-tree) \u2014 there is no external plugin repo to compare against`
+    };
+  }
+  if (record?.sha && isFetchableUrl(record.origin)) {
+    return checkViaProvenance(name, record, record.origin, git);
+  }
+  const localOrigin = record && !isFetchableUrl(record.origin) && existsSync31(record.origin) ? record.origin : null;
+  if (localOrigin) {
+    return checkViaContentDiff(name, pluginDir2, localOrigin, { isLocalDir: true }, git);
+  }
+  const registryRepo = await resolveRegistryRepo(name);
+  if (!registryRepo) {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: record ? `provenance records origin '${record.origin}', which is neither a reachable git URL nor a local directory that still exists, and '${name}' was not found in the plugin registry either` : `no provenance recorded (vendored before #1547, or an unreachable registry) and '${name}' was not found in the plugin registry \u2014 nothing to compare against`
+    };
+  }
+  if (record?.sha) {
+    return checkViaProvenance(name, record, registryRepo, git);
+  }
+  return checkViaContentDiff(name, pluginDir2, registryRepo, { isLocalDir: false }, git);
+}
+function isFetchableUrl(origin) {
+  return /^(https?|git|ssh):\/\//.test(origin) || /^[^/\\]+@[^:]+:/.test(origin);
+}
+async function checkViaProvenance(name, record, repoUrl, git) {
+  const remoteHeadSha = await git.resolveDefaultBranchSha(repoUrl);
+  if (!remoteHeadSha) {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: `could not reach ${repoUrl} (network or authentication failure)`
+    };
+  }
+  if (remoteHeadSha === record.sha) {
+    return {
+      name,
+      status: "up-to-date",
+      method: "provenance",
+      detail: `matches ${repoUrl}'s default branch (${shortSha(remoteHeadSha)})`
+    };
+  }
+  let clone;
+  try {
+    clone = await git.cloneForEditing(repoUrl, "biffo-plugin-staleness-full");
+  } catch {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: `could not clone ${repoUrl} to count commits behind (network or authentication failure)`
+    };
+  }
+  try {
+    const commitsBehind = await git.countBehind(clone, record.sha, "HEAD");
+    if (commitsBehind === null) {
+      return {
+        name,
+        status: "cannot-tell",
+        method: "unresolvable",
+        detail: `recorded commit ${shortSha(record.sha)} was not found in ${repoUrl}'s history (rebased or force-pushed?) \u2014 cannot count commits behind`
+      };
+    }
+    if (commitsBehind === 0) {
+      return {
+        name,
+        status: "up-to-date",
+        method: "provenance",
+        detail: `matches ${repoUrl}'s default branch (${shortSha(remoteHeadSha)})`
+      };
+    }
+    return {
+      name,
+      status: "behind",
+      commitsBehind,
+      method: "provenance",
+      detail: `${commitsBehind} commit(s) behind ${repoUrl}'s default branch`
+    };
+  } finally {
+    git.cleanup(clone);
+  }
+}
+async function checkViaContentDiff(name, pluginDir2, sourceDir, opts, git) {
+  let cloneDir = null;
+  let effectiveSourceDir = sourceDir;
+  if (!opts.isLocalDir) {
+    try {
+      cloneDir = await git.cloneToTemp(sourceDir, "biffo-plugin-staleness-content");
+    } catch {
+      return {
+        name,
+        status: "cannot-tell",
+        method: "unresolvable",
+        detail: `could not clone ${sourceDir} for a content comparison (network or authentication failure)`
+      };
+    }
+    effectiveSourceDir = cloneDir;
+  }
+  try {
+    const filesDiffering = await countDifferingFiles(effectiveSourceDir, pluginDir2);
+    const originDescription = opts.isLocalDir ? effectiveSourceDir : sourceDir;
+    if (filesDiffering === 0) {
+      return {
+        name,
+        status: "up-to-date",
+        method: "content-diff",
+        filesDiffering: 0,
+        detail: `byte-identical to ${originDescription} (no provenance recorded, so an exact commit could not be named)`
+      };
+    }
+    return {
+      name,
+      status: "behind",
+      filesDiffering,
+      method: "content-diff",
+      detail: `${filesDiffering} file(s) differ from ${originDescription} (no provenance recorded, so an exact commit count could not be determined)`
+    };
+  } finally {
+    if (cloneDir) git.cleanup(cloneDir);
+  }
+}
+function shortSha(sha) {
+  return sha.slice(0, 7);
+}
+async function countDifferingFiles(sourceDir, pluginDir2) {
+  const sourceFiles = await sourceFileList(sourceDir);
+  const vendorFiles = vendorFileList(pluginDir2);
+  const allPaths = /* @__PURE__ */ new Set([...sourceFiles, ...vendorFiles]);
+  let differing = 0;
+  for (const relPath of allPaths) {
+    if (relPath === PLUGIN_PROVENANCE_FILENAME) continue;
+    const inSource = sourceFiles.has(relPath);
+    const inVendor = vendorFiles.has(relPath);
+    if (!inSource || !inVendor) {
+      differing++;
+      continue;
+    }
+    const a = readFileSync24(join33(sourceDir, relPath));
+    const b = readFileSync24(join33(pluginDir2, relPath));
+    if (!a.equals(b)) differing++;
+  }
+  return differing;
+}
+async function sourceFileList(dir) {
+  if (await isGitWorkingTree2(dir)) {
+    return new Set(await listGitFiles(dir));
+  }
+  return new Set(walkExcluding(dir, dir, LOCAL_COPY_EXCLUDES));
+}
+function vendorFileList(dir) {
+  return new Set(walkExcluding(dir, dir, LOCAL_COPY_EXCLUDES));
+}
+function walkExcluding(root, dir, excludes) {
+  if (!existsSync31(dir)) return [];
+  const out = [];
+  for (const entry of readdirSync13(dir)) {
+    if (excludes.has(entry) || entry === ".git") continue;
+    const full = join33(dir, entry);
+    const stat = statSync7(full);
+    if (stat.isDirectory()) {
+      out.push(...walkExcluding(root, full, excludes));
+    } else {
+      out.push(relative4(root, full));
+    }
+  }
+  return out;
+}
+function exitCodeForStaleness(results) {
+  if (results.some((r) => r.status === "cannot-tell")) return 2;
+  if (results.some((r) => r.status === "behind")) return 1;
+  return 0;
+}
+function formatStalenessReport(results) {
+  if (results.length === 0) {
+    return "  No vendored plugins under services/ \u2014 nothing to check.";
+  }
+  const lines = [""];
+  for (const r of results) {
+    const icon = r.status === "up-to-date" ? "\u2713" : r.status === "behind" ? "\u26A0" : "?";
+    lines.push(`  ${icon} ${r.name}: ${labelFor(r.status)} \u2014 ${r.detail}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function labelFor(status) {
+  switch (status) {
+    case "up-to-date":
+      return "up to date";
+    case "behind":
+      return "BEHIND";
+    case "cannot-tell":
+      return "CANNOT TELL";
+  }
+}
+
+// src/commands/plugin-staleness.ts
+var pluginStalenessCommand = new Command17("staleness").description(
+  "Report how far each services/<name>/ vendored plugin has drifted from its source (#1547). Exits 0 up to date, 1 behind, 2 cannot tell \u2014 2 is never a pass."
+).option("--cwd <path>", "Project root to check (defaults to the current directory)").action(async (options) => {
+  const cwd = options.cwd ? resolve14(options.cwd) : process.cwd();
+  const results = await checkPluginStaleness(cwd, {
+    registry: new RegistryAdapter(),
+    git: new GitAdapter()
+  });
+  console.log(formatStalenessReport(results));
+  process.exit(exitCodeForStaleness(results));
+});
+
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync30 } from "fs";
-import { join as join32, relative as relative4, resolve as resolve14 } from "path";
+import { existsSync as existsSync32 } from "fs";
+import { join as join34, relative as relative5, resolve as resolve15 } from "path";
 import chalk17 from "chalk";
-import { Command as Command17 } from "commander";
-var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
+import { Command as Command18 } from "commander";
+var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
   "Generate real, committed migration file(s) for installed-but-not-yet-migrated plugin(s): biffo plugin sync-migrations [name]"
 ).argument("[name]", "Restrict to this installed plugin (default: every plugin under services/)").option("--dry-run", "Generate nothing; just report what would be generated").option("--no-commit", "Generate and stage the file(s) but do not commit").option("--cwd <path>", "Project root (defaults to the current directory)").action(
   async (name, options) => {
-    const cwd = options.cwd ? resolve14(options.cwd) : process.cwd();
+    const cwd = options.cwd ? resolve15(options.cwd) : process.cwd();
     try {
       await runPluginSyncMigrations(
         name,
@@ -8979,11 +9338,11 @@ var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join32(options.cwd, "services");
-  if (!existsSync30(servicesDir)) {
+  const servicesDir = join34(options.cwd, "services");
+  if (!existsSync32(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync30(join32(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync32(join34(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -8999,7 +9358,7 @@ async function runPluginSyncMigrations(name, options, deps) {
     );
     return;
   }
-  const relativePaths = generated.map((p) => relative4(options.cwd, p));
+  const relativePaths = generated.map((p) => relative5(options.cwd, p));
   for (const p of relativePaths) {
     log.success(`Generated ${p}`);
   }
@@ -9019,18 +9378,18 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync31, readFileSync as readFileSync23, rmSync as rmSync8 } from "fs";
-import { join as join33, resolve as resolve15 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync25, rmSync as rmSync8 } from "fs";
+import { join as join35, resolve as resolve16 } from "path";
 import chalk18 from "chalk";
-import { Command as Command18 } from "commander";
+import { Command as Command19 } from "commander";
 import inquirer6 from "inquirer";
 var NAME_PATTERN2 = /^[a-z][a-z0-9-]*$/;
-var pluginUninstallCommand = new Command18("uninstall").description("Remove an installed plugin: biffo plugin uninstall <name>").argument("<name>", "Plugin name").option("--dry-run", "Print planned changes without modifying the repo").option("--force", "Skip the confirmation prompt").option(
+var pluginUninstallCommand = new Command19("uninstall").description("Remove an installed plugin: biffo plugin uninstall <name>").argument("<name>", "Plugin name").option("--dry-run", "Print planned changes without modifying the repo").option("--force", "Skip the confirmation prompt").option(
   "--keep-data",
   "No-op today (see notes) \u2014 the CLI never drops plugin data regardless of this flag"
 ).option("--cwd <path>", "Project root to uninstall from (defaults to the current directory)").action(
   async (name, options) => {
-    const cwd = options.cwd ? resolve15(options.cwd) : process.cwd();
+    const cwd = options.cwd ? resolve16(options.cwd) : process.cwd();
     try {
       await runPluginUninstall(
         name,
@@ -9052,16 +9411,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join33(options.cwd, "services");
-  if (!existsSync31(servicesDir)) {
+  const servicesDir = join35(options.cwd, "services");
+  if (!existsSync33(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join33(servicesDir, name);
-  if (!existsSync31(targetDir)) {
-    const firstParty = join33(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync31(firstParty)) {
+  const targetDir = join35(servicesDir, name);
+  if (!existsSync33(targetDir)) {
+    const firstParty = join35(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync33(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -9069,9 +9428,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join33(options.cwd, "modules", "plugins", name);
+  const modulesDir = join35(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync31(modulesDir)) {
+  if (existsSync33(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -9093,7 +9452,7 @@ async function runPluginUninstall(name, options, deps) {
   }
   rmSync8(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync31(modulesDir)) {
+  if (existsSync33(modulesDir)) {
     rmSync8(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
@@ -9130,10 +9489,10 @@ async function runPluginUninstall(name, options, deps) {
   }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join33(targetDir, "biffo.plugin.json");
-  if (!existsSync31(manifestPath)) return void 0;
+  const manifestPath = join35(targetDir, "biffo.plugin.json");
+  if (!existsSync33(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync23(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync25(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -9166,12 +9525,12 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync5, existsSync as existsSync32, mkdirSync as mkdirSync11, readFileSync as readFileSync24, rmSync as rmSync9 } from "fs";
-import { join as join34, relative as relative5, resolve as resolve16 } from "path";
+import { cpSync as cpSync5, existsSync as existsSync34, mkdirSync as mkdirSync11, readFileSync as readFileSync26, rmSync as rmSync9 } from "fs";
+import { join as join36, relative as relative6, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
-import { Command as Command19 } from "commander";
+import { Command as Command20 } from "commander";
 import inquirer7 from "inquirer";
-var pluginUpgradeCommand = new Command19("upgrade").description(
+var pluginUpgradeCommand = new Command20("upgrade").description(
   "Upgrade an installed plugin to a new minor version (biffo plugin upgrade <name>@<new-minor>) or refresh it in place from a local, unpublished checkout (biffo plugin upgrade --local <path>)"
 ).argument(
   "[target]",
@@ -9181,12 +9540,12 @@ var pluginUpgradeCommand = new Command19("upgrade").description(
   "Refresh the installed plugin from a local, unpublished checkout instead of the registry"
 ).option("--dry-run", "Resolve the new version and print planned changes without applying them").option("--force", "Skip the confirmation prompt").option("--cwd <path>", "Project root to upgrade in (defaults to the current directory)").action(
   async (target, options) => {
-    const cwd = options.cwd ? resolve16(options.cwd) : process.cwd();
+    const cwd = options.cwd ? resolve17(options.cwd) : process.cwd();
     try {
       await runPluginUpgrade(
         target,
         {
-          ...options.local ? { local: resolve16(options.local) } : {},
+          ...options.local ? { local: resolve17(options.local) } : {},
           dryRun: options.dryRun ?? false,
           force: options.force ?? false,
           cwd
@@ -9214,8 +9573,8 @@ async function runPluginUpgrade(target, options, deps) {
       `Nothing to upgrade. Pass a registry target (e.g. \`biffo plugin upgrade acme-crm@1.1\`) or a local checkout to refresh from (\`biffo plugin upgrade --local ../acme-crm\`).`
     );
   }
-  const servicesDir = join34(options.cwd, "services");
-  if (!existsSync32(servicesDir)) {
+  const servicesDir = join36(options.cwd, "services");
+  if (!existsSync34(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -9224,8 +9583,8 @@ async function runPluginUpgrade(target, options, deps) {
     return runLocalPluginRefresh(options.local, options, deps);
   }
   const { name, minor } = parsePluginTarget(target);
-  const targetDir = join34(servicesDir, name);
-  if (!existsSync32(targetDir)) {
+  const targetDir = join36(servicesDir, name);
+  if (!existsSync34(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -9239,7 +9598,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join34(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join36(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -9267,17 +9626,23 @@ async function runPluginUpgrade(target, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
+    const previousProvenance = readProvenance(targetDir);
     rmSync9(targetDir, { recursive: true, force: true });
     mkdirSync11(targetDir, { recursive: true });
     cpSync5(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
+    const nextProvenance = resolveRegistryProvenance(
+      entry.repo,
+      await deps.git.resolveDefaultBranchSha(entry.repo)
+    );
+    writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync32(modulesDir)) {
+    if (existsSync34(modulesDir)) {
       rmSync9(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join34(targetDir, "terraform");
-    if (existsSync32(tfSourceDir)) {
+    const tfSourceDir = join36(targetDir, "terraform");
+    if (existsSync34(tfSourceDir)) {
       mkdirSync11(modulesDir, { recursive: true });
       cpSync5(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
@@ -9289,10 +9654,10 @@ async function runPluginUpgrade(target, options, deps) {
       );
       const generatedPaths = await deps.migrations.generate(options.cwd, [entry.name]);
       for (const absPath of generatedPaths) {
-        stagePaths.push(relative5(options.cwd, absPath));
+        stagePaths.push(relative6(options.cwd, absPath));
       }
       if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative5(options.cwd, generatedPaths[0])}`);
+        log.success(`Generated migration: ${relative6(options.cwd, generatedPaths[0])}`);
       } else {
         log.info(
           `${entry.name}'s tables and columns already match the manifest \u2014 no migration needed.`
@@ -9317,16 +9682,16 @@ async function runPluginUpgrade(target, options, deps) {
 async function runLocalPluginRefresh(localPath, options, deps) {
   const source = resolveLocalPlugin(localPath);
   log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
-  const servicesDir = join34(options.cwd, "services");
-  const targetDir = join34(servicesDir, source.name);
-  if (!existsSync32(targetDir)) {
+  const servicesDir = join36(options.cwd, "services");
+  const targetDir = join36(servicesDir, source.name);
+  if (!existsSync34(targetDir)) {
     throw new Error(
       `Plugin '${source.name}' is not installed at services/${source.name}/. Use 'biffo plugin install --local ${localPath}' instead.`
     );
   }
-  const inTreeSource = resolve16(source.sourceDir) === resolve16(targetDir);
+  const inTreeSource = resolve17(source.sourceDir) === resolve17(targetDir);
   const currentVersion = readInstalledVersion2(targetDir);
-  const modulesDir = join34(options.cwd, "modules", "plugins", source.name);
+  const modulesDir = join36(options.cwd, "modules", "plugins", source.name);
   if (options.dryRun) {
     printLocalDryRun(source, currentVersion, inTreeSource);
     return;
@@ -9349,6 +9714,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
+    const previousProvenance = readProvenance(targetDir);
     if (inTreeSource) {
       log.info(
         `services/${source.name}/ is already the local checkout \u2014 nothing to copy; re-syncing its Terraform module and checking for a migration.`
@@ -9359,13 +9725,15 @@ async function runLocalPluginRefresh(localPath, options, deps) {
       await copyPluginSource(source.sourceDir, targetDir);
       log.success(`Refreshed plugin source at services/${source.name}/ from ${source.origin}`);
     }
+    const nextProvenance = inTreeSource ? inTreePluginProvenance(`services/${source.name}`) : await resolveLocalProvenance(source.sourceDir, source.origin);
+    writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
     const stagePaths = [`services/${source.name}`];
-    if (existsSync32(modulesDir)) {
+    if (existsSync34(modulesDir)) {
       rmSync9(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join34(targetDir, "terraform");
-    if (existsSync32(tfSourceDir)) {
+    const tfSourceDir = join36(targetDir, "terraform");
+    if (existsSync34(tfSourceDir)) {
       mkdirSync11(modulesDir, { recursive: true });
       cpSync5(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${source.name}`);
@@ -9377,10 +9745,10 @@ async function runLocalPluginRefresh(localPath, options, deps) {
       );
       const generatedPaths = await deps.migrations.generate(options.cwd, [source.name]);
       for (const absPath of generatedPaths) {
-        stagePaths.push(relative5(options.cwd, absPath));
+        stagePaths.push(relative6(options.cwd, absPath));
       }
       if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative5(options.cwd, generatedPaths[0])}`);
+        log.success(`Generated migration: ${relative6(options.cwd, generatedPaths[0])}`);
       } else {
         log.info(
           `${source.name}'s tables and columns already match the manifest \u2014 no migration needed.`
@@ -9408,10 +9776,10 @@ async function runLocalPluginRefresh(localPath, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join34(targetDir, "biffo.plugin.json");
-  if (!existsSync32(manifestPath)) return void 0;
+  const manifestPath = join36(targetDir, "biffo.plugin.json");
+  if (!existsSync34(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync24(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync26(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -9470,7 +9838,7 @@ function printLocalDryRun(source, currentVersion, inTreeSource) {
 }
 
 // src/commands/plugin.ts
-var pluginCommand = new Command20("plugin").description("Manage Biffo plugins");
+var pluginCommand = new Command21("plugin").description("Manage Biffo plugins");
 pluginCommand.addCommand(pluginCreateCommand);
 pluginCommand.addCommand(pluginListCommand);
 pluginCommand.addCommand(pluginInstallCommand);
@@ -9478,15 +9846,16 @@ pluginCommand.addCommand(pluginUninstallCommand);
 pluginCommand.addCommand(pluginUpgradeCommand);
 pluginCommand.addCommand(pluginSyncMigrationsCommand);
 pluginCommand.addCommand(pluginInfoCommand);
+pluginCommand.addCommand(pluginStalenessCommand);
 
 // src/commands/sibling.ts
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync33, readFileSync as readFileSync25 } from "fs";
-import { resolve as resolve17 } from "path";
+import { existsSync as existsSync35, readFileSync as readFileSync27 } from "fs";
+import { resolve as resolve18 } from "path";
 import chalk20 from "chalk";
-import { Command as Command21 } from "commander";
+import { Command as Command22 } from "commander";
 
 // src/lib/sibling-identity-check.ts
 function checkSiblingIdentity(envs) {
@@ -9538,7 +9907,7 @@ function checkSiblingIdentity(envs) {
 // src/commands/sibling-check-identity.ts
 var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
 var SIBLING_CORE_POOL_VAR = "CORE_COGNITO_USER_POOL_ID";
-var siblingCheckIdentityCommand = new Command21("check-identity").description(
+var siblingCheckIdentityCommand = new Command22("check-identity").description(
   "Detect when a core's Cognito pool has drifted from its published identity document or any sibling's baked-in CORE_COGNITO_USER_POOL_ID (#400). Run from the core repo; exits non-zero on drift so a scheduled/CI run goes red."
 ).option("--env <environment>", "Only check this environment (default: dev, staging, prod)").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(async (options) => {
   if (options.env && !VALID_ENVIRONMENTS2.includes(options.env)) {
@@ -9677,7 +10046,7 @@ async function fetchPublishedIdentity(portalUrl) {
 }
 async function resolveConfig4(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync25(resolve17(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync27(resolve18(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -9696,9 +10065,9 @@ async function resolveConfig4(options) {
     }
     return cfg;
   }
-  const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
-  if (existsSync33(localConfigPath)) {
-    const raw = JSON.parse(readFileSync25(localConfigPath, "utf8"));
+  const localConfigPath = resolve18(process.cwd(), "biffo.config.json");
+  if (existsSync35(localConfigPath)) {
+    const raw = JSON.parse(readFileSync27(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -9734,31 +10103,31 @@ async function resolveConfig4(options) {
 }
 
 // src/commands/sibling.ts
-var siblingCommand = new Command22("sibling").description(
+var siblingCommand = new Command23("sibling").description(
   "Create and manage sibling apps that share a Biffo core project (ADR-0007)"
 );
 siblingCommand.addCommand(siblingCreateCommand);
 siblingCommand.addCommand(siblingCheckIdentityCommand);
 
 // src/commands/check.ts
-import { Command as Command23 } from "commander";
+import { Command as Command24 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
-import { existsSync as existsSync35 } from "fs";
-import { join as join36 } from "path";
-import { execa as execa6 } from "execa";
+import { existsSync as existsSync37 } from "fs";
+import { join as join38 } from "path";
+import { execa as execa7 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
-import { existsSync as existsSync34, readdirSync as readdirSync13, readFileSync as readFileSync26 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync36, readdirSync as readdirSync14, readFileSync as readFileSync28 } from "fs";
+import { join as join37 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join35(adrDir, ALLOWLIST_FILENAME);
-  if (!existsSync34(path)) return /* @__PURE__ */ new Set();
+  const path = join37(adrDir, ALLOWLIST_FILENAME);
+  if (!existsSync36(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
-  for (const rawLine of readFileSync26(path, "utf8").split("\n")) {
+  for (const rawLine of readFileSync28(path, "utf8").split("\n")) {
     const line = rawLine.split("#")[0].trim();
     if (line) numbers.add(line);
   }
@@ -9766,8 +10135,8 @@ function readAdrNumberingAllowlist(adrDir) {
 }
 function adrNumbersIn(adrDir) {
   const claims = /* @__PURE__ */ new Map();
-  if (!existsSync34(adrDir)) return claims;
-  for (const entry of readdirSync13(adrDir).sort()) {
+  if (!existsSync36(adrDir)) return claims;
+  for (const entry of readdirSync14(adrDir).sort()) {
     const match = ADR_FILENAME.exec(entry);
     if (!match) continue;
     const number = match[1];
@@ -9820,9 +10189,9 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
-  const root = (await execa6("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join36(root, "docs", "ADR");
-  if (!existsSync35(adrDir)) {
+  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const adrDir = join38(root, "docs", "ADR");
+  if (!existsSync37(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
   }
@@ -9861,7 +10230,7 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 
 // src/scripts/check-branch-protection.ts
 import { Octokit as Octokit2 } from "@octokit/rest";
-import { execa as execa7 } from "execa";
+import { execa as execa8 } from "execa";
 
 // src/lib/branch-protection-apply.ts
 var CONTEXT_CONSISTENCY_THRESHOLD = 2 / 3;
@@ -9988,7 +10357,7 @@ async function resolveRepo(explicit) {
     }
     return { owner, repo };
   }
-  const { stdout } = await execa7("git", ["remote", "get-url", "origin"]);
+  const { stdout } = await execa8("git", ["remote", "get-url", "origin"]);
   const m = /github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/.exec(stdout.trim());
   if (!m?.[1] || !m[2]) {
     console.error(
@@ -10120,13 +10489,13 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 }
 
 // src/scripts/check-codeql-suppression.ts
-import { existsSync as existsSync36 } from "fs";
-import { join as join38, relative as relative6 } from "path";
-import { execa as execa8 } from "execa";
+import { existsSync as existsSync38 } from "fs";
+import { join as join40, relative as relative7 } from "path";
+import { execa as execa9 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
-import { readdirSync as readdirSync14, readFileSync as readFileSync27, statSync as statSync7 } from "fs";
-import { join as join37 } from "path";
+import { readdirSync as readdirSync15, readFileSync as readFileSync29, statSync as statSync8 } from "fs";
+import { join as join39 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".worktrees",
@@ -10152,15 +10521,15 @@ function walkSourceFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync14(dir);
+      entries = readdirSync15(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join37(dir, entry);
+      const p = join39(dir, entry);
       let st;
       try {
-        st = statSync7(p);
+        st = statSync8(p);
       } catch {
         continue;
       }
@@ -10183,7 +10552,7 @@ function countSourceFiles(root) {
 function sweepCodeqlSuppressionComments(root) {
   const hits = [];
   for (const path of walkSourceFiles(root)) {
-    const text = readFileSync27(path, "utf8");
+    const text = readFileSync29(path, "utf8");
     for (const line of findCodeqlSuppressionComments(text)) {
       hits.push({ path, line, text: text.split("\n")[line - 1] ?? "" });
     }
@@ -10193,9 +10562,9 @@ function sweepCodeqlSuppressionComments(root) {
 
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
-  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const scanRoot = join38(root, "cli", "src");
-  if (!existsSync36(scanRoot)) {
+  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const scanRoot = join40(root, "cli", "src");
+  if (!existsSync38(scanRoot)) {
     console.log(
       "\u2014 codeql-suppression guard: skipped \u2014 no cli/src in this repo, so there is no CLI source to scan."
     );
@@ -10207,7 +10576,7 @@ async function runCodeqlSuppressionCheck() {
       "\u2717 codeql-suppression guard: found a `codeql[...]`-shaped comment, which does not suppress anything in this repo (#1491) \u2014 dismiss the real alert instead (UI, or `PATCH .../code-scanning/alerts/<n>` with a recorded reason)\n"
     );
     for (const hit of hits) {
-      console.error(`  ${relative6(root, hit.path)}:${hit.line}  ${hit.text.trim()}`);
+      console.error(`  ${relative7(root, hit.path)}:${hit.line}  ${hit.text.trim()}`);
     }
     process.exit(1);
   }
@@ -10219,11 +10588,11 @@ async function runCodeqlSuppressionCheck() {
 }
 
 // src/scripts/check-cognito-invite-template.ts
-import { execa as execa9 } from "execa";
+import { execa as execa10 } from "execa";
 
 // src/lib/cognito-invite-template-guard.ts
-import { readdirSync as readdirSync15, readFileSync as readFileSync28, statSync as statSync8 } from "fs";
-import { join as join39 } from "path";
+import { readdirSync as readdirSync16, readFileSync as readFileSync30, statSync as statSync9 } from "fs";
+import { join as join41 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -10297,36 +10666,36 @@ function memberBody(blockBody, member) {
 }
 function findModuleTerraformFiles(repoRoot) {
   const found = [];
-  const walk2 = (dir, relative9) => {
+  const walk2 = (dir, relative10) => {
     let entries;
     try {
-      entries = readdirSync15(dir);
+      entries = readdirSync16(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join39(dir, entry);
-      const rel = `${relative9}/${entry}`;
-      if (statSync8(full).isDirectory()) {
+      const full = join41(dir, entry);
+      const rel = `${relative10}/${entry}`;
+      if (statSync9(full).isDirectory()) {
         walk2(full, rel);
       } else if (entry.endsWith(".tf")) {
         found.push(rel);
       }
     }
   };
-  walk2(join39(repoRoot, "modules"), "modules");
+  walk2(join41(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync28(join39(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync30(join41(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-cognito-invite-template.ts
 async function runCognitoInviteTemplateCheck() {
-  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
@@ -10348,12 +10717,12 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join41 } from "path";
-import { execa as execa10 } from "execa";
+import { join as join43 } from "path";
+import { execa as execa11 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync37, readFileSync as readFileSync29, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
-import { join as join40 } from "path";
+import { existsSync as existsSync39, readFileSync as readFileSync31, readdirSync as readdirSync17, statSync as statSync10 } from "fs";
+import { join as join42 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -10512,15 +10881,15 @@ function walkFiles(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync16(dir);
+      entries = readdirSync17(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join40(dir, entry);
+      const p = join42(dir, entry);
       let st;
       try {
-        st = statSync9(p);
+        st = statSync10(p);
       } catch {
         continue;
       }
@@ -10547,7 +10916,7 @@ function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_I
   const extracted = [];
   let rawTotal = 0;
   for (const file of files) {
-    const text = readFileSync29(file, "utf8");
+    const text = readFileSync31(file, "utf8");
     rawTotal += countRawExternalOccurrences(text, externalBases);
     extracted.push(...extractCoreDirectPaths(text, file, externalBases));
   }
@@ -10596,7 +10965,7 @@ function auditCoreRouteExtraction(apiSrcDir) {
   const prefixSet = /* @__PURE__ */ new Set();
   let rawApiRouterCount = 0;
   for (const file of files) {
-    const text = readFileSync29(file, "utf8");
+    const text = readFileSync31(file, "utf8");
     const extraction = extractCoreRoutePrefixes(text);
     rawApiRouterCount += extraction.rawApiRouterCount;
     for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
@@ -10612,10 +10981,10 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join40(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join42(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
-    raw = readFileSync29(configPath, "utf8");
+    raw = readFileSync31(configPath, "utf8");
   } catch (err) {
     throw new Error(
       `cannot resolve ${sibling}'s core: ${configPath} does not exist or is unreadable (${err.message}) -- refusing to guess which core serves this sibling.`
@@ -10635,8 +11004,8 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join40(estateDir, coreProject, "services", "api", "src");
-  if (!existsSync37(coreApiSrcDir)) {
+  const coreApiSrcDir = join42(estateDir, coreProject, "services", "api", "src");
+  if (!existsSync39(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
     );
@@ -10677,9 +11046,9 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join41(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join43(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -10695,7 +11064,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join41(root, "services", "api", "src");
+    coreApiSrcDir = join43(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -10731,7 +11100,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa11 } from "execa";
+import { execa as execa12 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -10742,7 +11111,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -10758,11 +11127,11 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa11("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa12("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync39, existsSync: existsSync46 } = await import("fs");
-      if (existsSync46(messageFile)) commitMessage = readFileSync39(messageFile, "utf8");
+      const { readFileSync: readFileSync41, existsSync: existsSync48 } = await import("fs");
+      if (existsSync48(messageFile)) commitMessage = readFileSync41(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -10770,18 +11139,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa11("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa11("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa12("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa12("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa11("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa12("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa11("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa12("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -10863,11 +11232,11 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa12 } from "execa";
+import { execa as execa13 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync30, readdirSync as readdirSync17, statSync as statSync10 } from "fs";
-import { join as join42 } from "path";
+import { readFileSync as readFileSync32, readdirSync as readdirSync18, statSync as statSync11 } from "fs";
+import { join as join44 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -10939,15 +11308,15 @@ function walkTerraformFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync17(dir);
+      entries = readdirSync18(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join42(dir, entry);
+      const p = join44(dir, entry);
       let st;
       try {
-        st = statSync10(p);
+        st = statSync11(p);
       } catch {
         continue;
       }
@@ -10987,7 +11356,7 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync30(file, "utf8");
+    const text = readFileSync32(file, "utf8");
     rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
     rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
     eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
@@ -11040,7 +11409,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -11077,15 +11446,15 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-lambda-output.ts
-import { execa as execa13 } from "execa";
+import { execa as execa14 } from "execa";
 
 // src/lib/lambda-output-guard.ts
-import { readFileSync as readFileSync32 } from "fs";
-import { join as join44 } from "path";
+import { readFileSync as readFileSync34 } from "fs";
+import { join as join46 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { readdirSync as readdirSync18, readFileSync as readFileSync31, statSync as statSync11 } from "fs";
-import { join as join43 } from "path";
+import { readdirSync as readdirSync19, readFileSync as readFileSync33, statSync as statSync12 } from "fs";
+import { join as join45 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -11100,20 +11469,20 @@ function stripComments2(source) {
 }
 function findWorkflowFiles(repoRoot) {
   const found = [];
-  const walk2 = (dir, relative9) => {
+  const walk2 = (dir, relative10) => {
     let entries;
     try {
-      entries = readdirSync18(dir);
+      entries = readdirSync19(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join43(dir, entry);
-      const rel = relative9 ? `${relative9}/${entry}` : entry;
-      if (statSync11(full).isDirectory()) {
+      const full = join45(dir, entry);
+      const rel = relative10 ? `${relative10}/${entry}` : entry;
+      if (statSync12(full).isDirectory()) {
         walk2(full, rel);
-      } else if (/\.ya?ml$/.test(entry) && relative9.endsWith(".github/workflows")) {
+      } else if (/\.ya?ml$/.test(entry) && relative10.endsWith(".github/workflows")) {
         found.push(rel);
       }
     }
@@ -11153,7 +11522,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync31(join43(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync33(join45(repoRoot, file), "utf8"))
   );
 }
 
@@ -11211,13 +11580,13 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync32(join44(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync34(join46(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -11239,9 +11608,9 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync33, readdirSync as readdirSync19 } from "fs";
-import { join as join45, relative as relative7 } from "path";
-import { execa as execa14 } from "execa";
+import { readFileSync as readFileSync35, readdirSync as readdirSync20 } from "fs";
+import { join as join47, relative as relative8 } from "path";
+import { execa as execa15 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -11337,23 +11706,23 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join45(root, dir);
+    const full = join47(root, dir);
     let entries;
     try {
-      entries = readdirSync19(full, { withFileTypes: true });
+      entries = readdirSync20(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join45(full, entry.name));
+      out.push(join47(full, entry.name));
     }
   }
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -11363,8 +11732,8 @@ async function runPipeTrapCheck() {
     process.exit(1);
   }
   const findings = files.flatMap(
-    (file) => findPipeTraps(readFileSync33(file, "utf8")).map(
-      (t) => `${relative7(root, file)}:${t.line}  ${t.text}
+    (file) => findPipeTraps(readFileSync35(file, "utf8")).map(
+      (t) => `${relative8(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
   );
@@ -11380,11 +11749,11 @@ async function runPipeTrapCheck() {
 }
 
 // src/scripts/check-plugin-allowlist-convention.ts
-import { execa as execa15 } from "execa";
+import { execa as execa16 } from "execa";
 
 // src/lib/plugin-allowlist-convention.ts
-import { readFileSync as readFileSync34 } from "fs";
-import { join as join46 } from "path";
+import { readFileSync as readFileSync36 } from "fs";
+import { join as join48 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -11393,18 +11762,18 @@ var PROJECT = "<project>";
 var ENV = "<env>";
 var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
-function read(repoRoot, relative9) {
+function read(repoRoot, relative10) {
   try {
-    return readFileSync34(join46(repoRoot, relative9), "utf8");
+    return readFileSync36(join48(repoRoot, relative10), "utf8");
   } catch {
-    throw new Error(`plugin-allowlist drift guard: cannot read ${relative9}`);
+    throw new Error(`plugin-allowlist drift guard: cannot read ${relative10}`);
   }
 }
 function assignedString(source, name) {
   const match = new RegExp(`^\\s*${name}\\s*=\\s*"((?:[^"\\\\]|\\\\.)*)"\\s*$`, "m").exec(source);
   return match?.[1];
 }
-function resolve18(expression, bindings) {
+function resolve19(expression, bindings) {
   let current = expression;
   for (let pass = 0; pass < 10; pass += 1) {
     const next = current.replace(/\$\{([^}]+)\}/g, (whole, ref) => {
@@ -11441,13 +11810,13 @@ function composeExpectedRoleName(repoRoot) {
     "var.project_name": PROJECT,
     "var.environment": ENV,
     "var.plugin_name": PLUGIN,
-    "var.function_name": resolve18(pluginFunctionName, {
+    "var.function_name": resolve19(pluginFunctionName, {
       "var.plugin_name": PLUGIN
     })
   };
-  bindings["local.name_prefix"] = resolve18(namePrefix, bindings);
-  bindings["local.function_name"] = resolve18(functionName, bindings);
-  return resolve18(roleName, bindings);
+  bindings["local.name_prefix"] = resolve19(namePrefix, bindings);
+  bindings["local.function_name"] = resolve19(functionName, bindings);
+  return resolve19(roleName, bindings);
 }
 function readAllowlistGlob(repoRoot) {
   const allowlist = read(repoRoot, ALLOWLIST_MAIN_TF);
@@ -11457,7 +11826,7 @@ function readAllowlistGlob(repoRoot) {
       `plugin-allowlist drift guard: could not find the "for name in var.enabled_plugins" glob in ${ALLOWLIST_MAIN_TF}.`
     );
   }
-  return resolve18(glob, {
+  return resolve19(glob, {
     "data.aws_caller_identity.current.account_id": ACCOUNT,
     "var.project_name": PROJECT,
     "var.environment": ENV,
@@ -11491,7 +11860,7 @@ Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob,
 
 // src/scripts/check-plugin-allowlist-convention.ts
 async function runPluginAllowlistConventionCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let violations;
   try {
     violations = checkAllowlistConvention(root);
@@ -11516,34 +11885,34 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync39 } from "fs";
-import { join as join48 } from "path";
-import { execa as execa16 } from "execa";
+import { existsSync as existsSync41 } from "fs";
+import { join as join50 } from "path";
+import { execa as execa17 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync38, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync40, readdirSync as readdirSync21, statSync as statSync13 } from "fs";
+import { join as join49 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync38(dir)) return [];
-  return readdirSync20(dir).filter((entry) => {
+  if (!existsSync40(dir)) return [];
+  return readdirSync21(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync12(join47(dir, entry)).isDirectory();
+      return statSync13(join49(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync38(join47(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync40(join49(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join47(pluginDir2, "tests");
-  if (!existsSync38(testsDir)) return [];
-  if (existsSync38(join47(testsDir, "__init__.py"))) return [];
-  return readdirSync20(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
+  const testsDir = join49(pluginDir2, "tests");
+  if (!existsSync40(testsDir)) return [];
+  if (existsSync40(join49(testsDir, "__init__.py"))) return [];
+  return readdirSync21(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
   const plugins = (pluginDirs ?? subdirectories(servicesDir)).filter((name) => !name.startsWith("_")).filter((name) => name !== "api").sort();
@@ -11551,7 +11920,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join47(servicesDir, plugin))) {
+      for (const name of namesOf(join49(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -11588,9 +11957,9 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join48(root, "services");
-  if (!existsSync39(servicesDir)) {
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join50(root, "services");
+  if (!existsSync41(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -11607,11 +11976,11 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa17 } from "execa";
+import { execa as execa18 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync40, readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
-import { dirname as dirname10, join as join49, relative as relative8, sep as sep3 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync37, readdirSync as readdirSync22 } from "fs";
+import { dirname as dirname10, join as join51, relative as relative9, sep as sep3 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -11619,16 +11988,16 @@ function findPluginManifests(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync21(dir, { withFileTypes: true });
+      entries = readdirSync22(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join49(dir, entry.name));
+        walk2(join51(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative8(root, join49(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative9(root, join51(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -11638,7 +12007,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync35(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync37(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -11653,15 +12022,15 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync40(join49(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync42(join51(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join49(root, manifest);
+    const absManifest = join51(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync40(join49(pluginDir2, "terraform"))) continue;
-    const relPluginDir = relative8(root, pluginDir2).split(sep3).join("/");
+    if (existsSync42(join51(pluginDir2, "terraform"))) continue;
+    const relPluginDir = relative9(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
       expectedTerraformDir: relPluginDir ? `${relPluginDir}/terraform` : "terraform",
@@ -11680,7 +12049,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -11691,13 +12060,13 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync42 } from "fs";
-import { join as join51 } from "path";
-import { execa as execa18 } from "execa";
+import { existsSync as existsSync44 } from "fs";
+import { join as join53 } from "path";
+import { execa as execa19 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync41, readFileSync as readFileSync36, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync38, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join52 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -12108,13 +12477,13 @@ var OPENROUTER_MODEL_IDS = [
 function listDirs(root) {
   let entries;
   try {
-    entries = readdirSync22(root);
+    entries = readdirSync23(root);
   } catch {
     return [];
   }
   return entries.filter((e) => {
     try {
-      return statSync13(join50(root, e)).isDirectory();
+      return statSync14(join52(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -12125,15 +12494,15 @@ function walkFiles2(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync22(dir);
+      entries = readdirSync23(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join50(dir, entry);
+      const p = join52(dir, entry);
       let st;
       try {
-        st = statSync13(p);
+        st = statSync14(p);
       } catch {
         continue;
       }
@@ -12156,14 +12525,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join50(pluginDir2, "terraform");
+  const tfDir = join52(pluginDir2, "terraform");
   let entries;
   try {
-    entries = readdirSync22(tfDir);
+    entries = readdirSync23(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join50(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join52(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -12415,8 +12784,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join50("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join50(
+var CONFIG_PY_PATH = join52("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join52(
   "services",
   "api",
   "src",
@@ -12428,10 +12797,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join50(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join50(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync41(configPath);
-  const orchestrationSchemaMissing = !existsSync41(orchestrationPath);
+  const configPath = join52(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join52(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync43(configPath);
+  const orchestrationSchemaMissing = !existsSync43(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -12449,13 +12818,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync36(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync38(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync36(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync38(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -12502,7 +12871,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync13(join50(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync14(join52(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -12515,8 +12884,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join50(pluginsRoot, name);
-    const manifestText = readFileSync36(join50(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join52(pluginsRoot, name);
+    const manifestText = readFileSync38(join52(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -12534,13 +12903,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync36(f, "utf8")
+      text: readFileSync38(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync36(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync38(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -12614,7 +12983,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join50(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join52(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -12645,10 +13014,10 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join51(root, "services", "_plugins");
-  if (!existsSync42(pluginsRoot)) {
+  const pluginsRoot = join53(root, "services", "_plugins");
+  if (!existsSync44(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -12678,8 +13047,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join51(root, "services", "api");
-  if (!existsSync42(servicesApiRoot)) {
+  const servicesApiRoot = join53(root, "services", "api");
+  if (!existsSync44(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -12725,7 +13094,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa19 } from "execa";
+import { execa as execa20 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -12762,7 +13131,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa19(
+  const { stdout } = await execa20(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -12798,7 +13167,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa19("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa20("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -12806,9 +13175,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa19("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa19("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa20("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa20("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -12856,13 +13225,13 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync43, readdirSync as readdirSync24 } from "fs";
-import { join as join53 } from "path";
-import { execa as execa20 } from "execa";
+import { existsSync as existsSync45, readdirSync as readdirSync25 } from "fs";
+import { join as join55 } from "path";
+import { execa as execa21 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync37, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join52 } from "path";
+import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
+import { join as join54 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -12920,16 +13289,16 @@ function walk(dir, base = dir) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync23(dir);
+    entries = readdirSync24(dir);
   } catch {
     return out;
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join52(dir, entry);
+    const abs = join54(dir, entry);
     let isDir;
     try {
-      isDir = statSync14(abs).isDirectory();
+      isDir = statSync15(abs).isDirectory();
     } catch {
       continue;
     }
@@ -12948,7 +13317,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync37(join52(skeletonRoot, rel), "utf8");
+        contents = readFileSync39(join54(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -12977,23 +13346,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join53(root, "_skeletons");
+  const skeletonsDir = join55(root, "_skeletons");
   let entries;
   try {
-    entries = readdirSync24(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    entries = readdirSync25(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync43(join53(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync45(join55(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join53(root, "_skeletons", name);
+    const skeletonRoot = join55(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync43(join53(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync45(join55(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -13007,7 +13376,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join53(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join55(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -13019,9 +13388,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa21 } from "execa";
+import { execa as execa22 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -13043,8 +13412,8 @@ async function runTerraformInputCheck() {
 }
 
 // src/commands/check.ts
-var checkCommand = new Command23("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention) run in CI and git hooks, plus out-of-band audits (branch protection)"
+var checkCommand = new Command24("check").description(
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -13129,16 +13498,26 @@ checkCommand.command("branch-protection").description(
 ).action(async (opts) => {
   await runBranchProtectionCheck(opts.repo, { fix: opts.fix });
 });
+checkCommand.command("plugin-staleness").description(
+  "Advisory: report how far each services/<name>/ vendored plugin has drifted from its source (#1547) \u2014 an instance can drift arbitrarily far behind a plugin repo while both sides' CI stays green, because neither has an opinion about the gap between them. Deliberately NEVER fails this check, unlike every other one in this group: an instance may legitimately pin a plugin version, and staleness moving is not a defect the way an ownership violation or a namespace collision is. Run `biffo plugin staleness` directly for the same measurement with a real 0/1/2 exit code, if you want to gate on it."
+).action(async () => {
+  const cwd = process.env["BIFFO_ORIGINAL_CWD"] || process.cwd();
+  const results = await checkPluginStaleness(cwd, {
+    registry: new RegistryAdapter(),
+    git: new GitAdapter()
+  });
+  console.log(formatStalenessReport(results));
+});
 function rawArgsAfter(subcommand) {
   const at = process.argv.indexOf(subcommand);
   return at === -1 ? [] : process.argv.slice(at + 1);
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync44, readFileSync as readFileSync38 } from "fs";
-import { join as join54, resolve as resolve19 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync40 } from "fs";
+import { join as join56, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/lib/doctor.ts
 function checkCheckoutCurrency(facts) {
@@ -13261,10 +13640,10 @@ function runDoctorChecks(facts) {
 
 // src/commands/doctor.ts
 var INTEGRATION_BRANCH = "dev";
-var doctorCommand = new Command24("doctor").description(
+var doctorCommand = new Command25("doctor").description(
   "Report repo-state conditions that make everything read from this checkout unreliable"
 ).option("--cwd <path>", "Repo root to inspect (defaults to the current directory)").option("--no-fetch", "Skip the fetch; report against refs as they already are locally").action(async (options) => {
-  const cwd = options.cwd ? resolve19(options.cwd) : process.cwd();
+  const cwd = options.cwd ? resolve20(options.cwd) : process.cwd();
   try {
     const findings = await runDoctor({ cwd, fetch: options.fetch !== false });
     printFindings(findings);
@@ -13315,10 +13694,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join54(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync44(path)) return null;
+  const path = join56(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync46(path)) return null;
   try {
-    return extractVersionField(readFileSync38(path, "utf8"));
+    return extractVersionField(readFileSync40(path, "utf8"));
   } catch {
     return null;
   }
@@ -13338,10 +13717,10 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join54(cwd, CORE_VERSION_FILE);
-  if (!existsSync44(path)) return null;
+  const path = join56(cwd, CORE_VERSION_FILE);
+  if (!existsSync46(path)) return null;
   try {
-    const value = readFileSync38(path, "utf8").trim();
+    const value = readFileSync40(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -13374,9 +13753,9 @@ function printFindings(findings) {
 import { execSync as execSync7 } from "child_process";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STSClient3 } from "@aws-sdk/client-sts";
 import chalk22 from "chalk";
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 import inquirer8 from "inquirer";
-var teardownCommand = new Command25("teardown").description(
+var teardownCommand = new Command26("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
   "--confirm <name>",
@@ -13787,16 +14166,16 @@ function resolveGithubToken4() {
 import { spawnSync } from "child_process";
 import { dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
-import { Command as Command26 } from "commander";
+import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync45 } from "fs";
-import { dirname as dirname11, join as join55 } from "path";
+import { existsSync as existsSync47 } from "fs";
+import { dirname as dirname11, join as join57 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join55(dir, relativePath);
-    if (existsSync45(candidate)) return candidate;
+    const candidate = join57(dir, relativePath);
+    if (existsSync47(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -13816,7 +14195,7 @@ function runPackagedScript(script, args, cwd) {
   return result.status === null ? 2 : result.status;
 }
 function packagedScriptCommand(spec) {
-  const command = new Command26(spec.name).description(spec.description).allowExcessArguments(true).allowUnknownOption(true);
+  const command = new Command27(spec.name).description(spec.description).allowExcessArguments(true).allowUnknownOption(true);
   if (spec.argument) command.argument(`<${spec.argument.name}>`, spec.argument.description);
   return command.action(() => {
     const here = dirname12(fileURLToPath6(import.meta.url));
@@ -13905,7 +14284,7 @@ var runnerDropForensicsCommand = packagedScriptCommand({
 });
 
 // src/index.ts
-var program = new Command27();
+var program = new Command28();
 function cliVersion() {
   try {
     return getLatestCoreVersion();