@biffo/cli 0.280.0 → 0.282.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command27 } from "commander";
+import { Command as Command28 } from "commander";
 
 // src/commands/core.ts
 import { Command as Command4 } from "commander";
@@ -1082,6 +1082,23 @@ var GitAdapter = class {
     const { stdout } = await execa2("git", ["remote", "get-url", remote], { cwd });
     return stdout.trim();
   }
+  /**
+   * The commit SHA `HEAD` currently resolves to on `repoUrl`'s default
+   * branch, without cloning anything — a single `git ls-remote` round trip.
+   * Built for plugin provenance/staleness (#1547): recording or checking a
+   * source commit should not need a full clone when the answer is one
+   * network call. Returns `null` on any failure (network, auth, a repo that
+   * does not exist) rather than throwing — both call sites treat an unknown
+   * SHA as an honest "could not determine", never as license to invent one.
+   */
+  async resolveDefaultBranchSha(repoUrl) {
+    const { stdout, exitCode } = await execa2("git", ["ls-remote", "--exit-code", repoUrl, "HEAD"], {
+      reject: false
+    });
+    if (exitCode !== 0) return null;
+    const sha = stdout.split(/\s+/)[0];
+    return sha && /^[0-9a-f]{40}$/i.test(sha) ? sha : null;
+  }
   /**
    * Prunes remote-tracking refs whose remote branch is gone, so `upstream:track`
    * reports `[gone]` for a merged-and-deleted branch (#758).
@@ -1596,7 +1613,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1611,7 +1628,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1845,7 +1862,7 @@ var GitHubAdapter = class {
             }
             if (status !== 404 || Date.now() >= deadline) throw err;
             log.info("Branch protection endpoint not yet ready, retrying...");
-            await new Promise((resolve20) => setTimeout(resolve20, protectionIntervalMs));
+            await new Promise((resolve21) => setTimeout(resolve21, protectionIntervalMs));
           }
         }
       }
@@ -2018,7 +2035,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve20) => setTimeout(resolve20, protectionIntervalMs));
+          await new Promise((resolve21) => setTimeout(resolve21, protectionIntervalMs));
         }
       }
     } catch (err) {
@@ -2291,7 +2308,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+        await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
       }
     }
   }
@@ -2310,7 +2327,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+        await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
       }
     }
   }
@@ -2334,7 +2351,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
+      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -4301,7 +4318,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve20) => setTimeout(resolve20, retryDelayMs));
+          await new Promise((resolve21) => setTimeout(resolve21, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -7504,7 +7521,7 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 }
 
 // src/commands/plugin.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 
 // src/commands/plugin-create.ts
 import { existsSync as existsSync26, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
@@ -7739,6 +7756,13 @@ var ToolDeclarationSchema = z7.object({
   description: z7.string(),
   parameters: z7.record(z7.string(), z7.unknown()).default({})
 });
+var SeedDeclarationSchema = z7.object({
+  dir: z7.string().regex(
+    REL_DIR,
+    "must be a plugin-relative path with no leading slash or traversal, e.g. db/seed"
+  ),
+  baseline_tables: z7.array(z7.string()).default([])
+}).strict();
 var ChatAgentDeclarationSchema = z7.object({
   key: z7.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
   agent_name: z7.string().optional(),
@@ -7777,7 +7801,11 @@ var PluginManifestSchema = z7.object({
   tools: z7.array(ToolDeclarationSchema).default([]),
   // Chat agents the plugin registers with Core (ADR-0017). Default empty — an
   // ordinary plugin declares none.
-  chat_agents: z7.array(ChatAgentDeclarationSchema).default([])
+  chat_agents: z7.array(ChatAgentDeclarationSchema).default([]),
+  // The plugin's tenant-scoped baseline-row seed (ADR-0005, biffo-template#1554).
+  // Optional — a plugin with no baseline data omits this entirely, and
+  // `biffo plugin install`/`upgrade` vendor nothing for it.
+  seed: SeedDeclarationSchema.optional()
 }).superRefine((manifest, ctx) => {
   const tableNames = new Set(manifest.tables.map((t) => t.name));
   for (const route of manifest.api_routes) {
@@ -7788,6 +7816,16 @@ var PluginManifestSchema = z7.object({
       });
     }
   }
+  if (manifest.seed) {
+    for (const table of manifest.seed.baseline_tables) {
+      if (!tableNames.has(table)) {
+        ctx.addIssue({
+          code: z7.ZodIssueCode.custom,
+          message: `seed.baseline_tables references table '${table}', which is not declared in this manifest's 'tables' (${[...tableNames].sort().join(", ") || "none"})`
+        });
+      }
+    }
+  }
 });
 function validateManifest(raw) {
   const result = PluginManifestSchema.safeParse(raw);
@@ -8302,6 +8340,14 @@ var RegistryPluginEntrySchema = z8.object({
   description: z8.string().optional(),
   author: z8.string().optional(),
   tags: z8.array(z8.string()).optional(),
+  // Summary-form mirror of the manifest's `seed.baseline_tables` (see
+  // ../../lib/plugin-manifest.ts's SeedDeclarationSchema and
+  // _skeletons/registry/registry-schema.json's `seed`, biffo-template#1554).
+  // The registry entry only ever needs to know WHICH tables a plugin promises
+  // baseline rows for, never the seed `dir` itself — that only matters to the
+  // install/upgrade vendoring step, which reads it from the plugin's own
+  // biffo.plugin.json after cloning, not from this summary.
+  baseline_tables: z8.array(z8.string()).optional(),
   required_core_version: z8.string().optional(),
   infra_modules: z8.array(z8.string()).optional(),
   api_routes: z8.array(z8.string()).optional(),
@@ -8428,8 +8474,8 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync4, existsSync as existsSync28, mkdirSync as mkdirSync10, readFileSync as readFileSync21, statSync as statSync6 } from "fs";
-import { join as join30, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync5, existsSync as existsSync30, mkdirSync as mkdirSync11, readFileSync as readFileSync22, statSync as statSync6 } from "fs";
+import { join as join32, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
@@ -8475,10 +8521,129 @@ var PluginMigrationsAdapter = class {
   }
 };
 
-// src/lib/plugin-source-copy.ts
-import { copyFileSync as copyFileSync2, cpSync as cpSync3, mkdirSync as mkdirSync9 } from "fs";
-import { basename, dirname as dirname9, join as join28 } from "path";
+// src/lib/plugin-provenance.ts
+import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
+import { join as join28 } from "path";
 import { execa as execa5 } from "execa";
+var PLUGIN_PROVENANCE_FILENAME = ".biffo-plugin-provenance.json";
+function isPluginProvenance(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v["origin"] === "string" && (typeof v["ref"] === "string" || v["ref"] === null) && (typeof v["sha"] === "string" || v["sha"] === null) && typeof v["recordedAt"] === "string" && typeof v["inTree"] === "boolean";
+}
+function readProvenance(pluginDir2) {
+  const path = join28(pluginDir2, PLUGIN_PROVENANCE_FILENAME);
+  if (!existsSync27(path)) return { status: "absent" };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync20(path, "utf8"));
+  } catch (err) {
+    return {
+      status: "invalid",
+      reason: `could not parse ${PLUGIN_PROVENANCE_FILENAME}: ${err.message}`
+    };
+  }
+  if (!isPluginProvenance(parsed)) {
+    return {
+      status: "invalid",
+      reason: `${PLUGIN_PROVENANCE_FILENAME} does not have the expected shape`
+    };
+  }
+  return { status: "present", record: parsed };
+}
+function writePluginProvenance(pluginDir2, record) {
+  writeFileSync10(join28(pluginDir2, PLUGIN_PROVENANCE_FILENAME), `${JSON.stringify(record, null, 2)}
+`);
+}
+function reconcileProvenance(previous, next) {
+  if (previous.status === "present" && sameProvenance(previous.record, next)) return previous.record;
+  return next;
+}
+function sameProvenance(a, b) {
+  return a.origin === b.origin && a.ref === b.ref && a.sha === b.sha && a.inTree === b.inTree;
+}
+function inTreePluginProvenance(relTargetDir) {
+  return {
+    origin: relTargetDir,
+    ref: null,
+    sha: null,
+    recordedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    inTree: true
+  };
+}
+async function resolveLocalProvenance(sourceDir, origin) {
+  const recordedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (!await isGitWorkingTree(sourceDir)) {
+    return { origin, ref: null, sha: null, recordedAt, inTree: false };
+  }
+  const sha = await tryGit(sourceDir, ["rev-parse", "HEAD"]);
+  const rawRef = await tryGit(sourceDir, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const ref = rawRef && rawRef !== "HEAD" ? rawRef : null;
+  return { origin, ref, sha, recordedAt, inTree: false };
+}
+function resolveRegistryProvenance(repoUrl, sha) {
+  return { origin: repoUrl, ref: null, sha, recordedAt: (/* @__PURE__ */ new Date()).toISOString(), inTree: false };
+}
+async function isGitWorkingTree(dir) {
+  try {
+    await execa5("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function tryGit(cwd, args) {
+  try {
+    const { stdout } = await execa5("git", args, { cwd });
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/plugin-seed-vendor.ts
+import { cpSync as cpSync3, existsSync as existsSync28, mkdirSync as mkdirSync9, readdirSync as readdirSync12, rmSync as rmSync8 } from "fs";
+import { join as join29 } from "path";
+var VENDOR_PREFIX = "_plugin-";
+function pluginSeedImportDir(pluginName) {
+  return `db/imports/${VENDOR_PREFIX}${pluginName}`;
+}
+function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
+  if (!manifest.seed) {
+    return { vendored: false };
+  }
+  const sourceSeedDir = join29(pluginSourceDir, manifest.seed.dir);
+  if (!existsSync28(sourceSeedDir)) {
+    throw new Error(
+      `${manifest.name}'s manifest declares seed.dir '${manifest.seed.dir}', but ${sourceSeedDir} does not exist in the plugin's source.`
+    );
+  }
+  const sqlFiles = readdirSync12(sourceSeedDir).filter((f) => f.endsWith(".sql"));
+  if (sqlFiles.length === 0) {
+    throw new Error(
+      `${manifest.name}'s manifest declares seed.dir '${manifest.seed.dir}', but ${sourceSeedDir} contains no *.sql files.`
+    );
+  }
+  const relTargetDir = pluginSeedImportDir(manifest.name);
+  const targetDir = join29(cwd, relTargetDir);
+  rmSync8(targetDir, { recursive: true, force: true });
+  mkdirSync9(targetDir, { recursive: true });
+  for (const file of sqlFiles) {
+    cpSync3(join29(sourceSeedDir, file), join29(targetDir, file));
+  }
+  log.success(
+    `Vendored ${sqlFiles.length} seed file(s) to ${relTargetDir}/ (baseline_tables: ${manifest.seed.baseline_tables.join(", ") || "none declared"})`
+  );
+  log.info(
+    `${relTargetDir}/*.sql are checksum-tracked once applied (ADR-0005 section 4) \u2014 a later version must ship a new, additively-numbered file for a changed seed, never edit one already released, or the next deploy fails loudly.`
+  );
+  return { vendored: true, stagedPath: relTargetDir };
+}
+
+// src/lib/plugin-source-copy.ts
+import { copyFileSync as copyFileSync2, cpSync as cpSync4, mkdirSync as mkdirSync10 } from "fs";
+import { basename, dirname as dirname9, join as join30 } from "path";
+import { execa as execa6 } from "execa";
 var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".git",
   ".venv",
@@ -8491,35 +8656,35 @@ var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".terraform"
 ]);
 async function copyPluginSource(sourceDir, targetDir) {
-  if (await isGitWorkingTree(sourceDir)) {
+  if (await isGitWorkingTree2(sourceDir)) {
     const files = await listGitFiles(sourceDir);
     for (const relPath of files) {
-      const destPath = join28(targetDir, relPath);
-      mkdirSync9(dirname9(destPath), { recursive: true });
-      copyFileSync2(join28(sourceDir, relPath), destPath);
+      const destPath = join30(targetDir, relPath);
+      mkdirSync10(dirname9(destPath), { recursive: true });
+      copyFileSync2(join30(sourceDir, relPath), destPath);
     }
     return { usedGitIgnoreRules: true };
   }
   log.warn(
     `${sourceDir} is not a git working tree \u2014 cannot honour .gitignore. Falling back to a fixed exclude list (.git, .venv, node_modules, caches); anything else it does not know about (e.g. an unfamiliar cache directory) will be copied.`
   );
-  mkdirSync9(targetDir, { recursive: true });
-  cpSync3(sourceDir, targetDir, {
+  mkdirSync10(targetDir, { recursive: true });
+  cpSync4(sourceDir, targetDir, {
     recursive: true,
     filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename(src))
   });
   return { usedGitIgnoreRules: false };
 }
-async function isGitWorkingTree(dir) {
+async function isGitWorkingTree2(dir) {
   try {
-    await execa5("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    await execa6("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
     return true;
   } catch {
     return false;
   }
 }
 async function listGitFiles(dir) {
-  const { stdout } = await execa5(
+  const { stdout } = await execa6(
     "git",
     ["ls-files", "--cached", "--others", "--exclude-standard", "-z"],
     { cwd: dir }
@@ -8528,8 +8693,8 @@ async function listGitFiles(dir) {
 }
 
 // src/lib/plugin-workspace-sources.ts
-import { existsSync as existsSync27, readdirSync as readdirSync12, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync29, readdirSync as readdirSync13, readFileSync as readFileSync21, writeFileSync as writeFileSync11 } from "fs";
+import { join as join31 } from "path";
 function readTomlStringArray(text, key) {
   const open = new RegExp(`^${key}\\s*=\\s*\\[`, "m").exec(text);
   if (!open) return [];
@@ -8573,9 +8738,9 @@ function readDependencyNames(text) {
   return readTomlStringArray(text, "dependencies").map((dep) => /^\s*([A-Za-z0-9._-]+)/.exec(dep)?.[1] ?? "").filter(Boolean);
 }
 function workspaceMemberNames(instanceRoot) {
-  const rootPyproject = join29(instanceRoot, "pyproject.toml");
-  if (!existsSync27(rootPyproject)) return /* @__PURE__ */ new Set();
-  const text = readFileSync20(rootPyproject, "utf8");
+  const rootPyproject = join31(instanceRoot, "pyproject.toml");
+  if (!existsSync29(rootPyproject)) return /* @__PURE__ */ new Set();
+  const text = readFileSync21(rootPyproject, "utf8");
   const members = readTomlStringArray(text, "members");
   const excluded = new Set(readTomlStringArray(text, "exclude"));
   const dirs = [];
@@ -8584,7 +8749,7 @@ function workspaceMemberNames(instanceRoot) {
       const base = member.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync12(join29(instanceRoot, base), { withFileTypes: true });
+        entries = readdirSync13(join31(instanceRoot, base), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -8598,9 +8763,9 @@ function workspaceMemberNames(instanceRoot) {
   }
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    const pp = join29(instanceRoot, dir, "pyproject.toml");
-    if (!existsSync27(pp)) continue;
-    const name = readProjectName(readFileSync20(pp, "utf8"));
+    const pp = join31(instanceRoot, dir, "pyproject.toml");
+    if (!existsSync29(pp)) continue;
+    const name = readProjectName(readFileSync21(pp, "utf8"));
     if (name) names.add(name);
   }
   return names;
@@ -8611,8 +8776,8 @@ function existingWorkspaceSources(text) {
   );
 }
 function ensureWorkspaceSources(pluginPyprojectPath, memberNames) {
-  if (!existsSync27(pluginPyprojectPath) || memberNames.size === 0) return [];
-  const text = readFileSync20(pluginPyprojectPath, "utf8");
+  if (!existsSync29(pluginPyprojectPath) || memberNames.size === 0) return [];
+  const text = readFileSync21(pluginPyprojectPath, "utf8");
   const already = existingWorkspaceSources(text);
   const toAdd = readDependencyNames(text).filter((n) => memberNames.has(n) && !already.has(n));
   if (toAdd.length === 0) return [];
@@ -8632,12 +8797,12 @@ ${lines.join("\n")}${text.slice(insertAt)}`;
 ${lines.join("\n")}
 `;
   }
-  writeFileSync10(pluginPyprojectPath, updated);
+  writeFileSync11(pluginPyprojectPath, updated);
   return toAdd;
 }
 function applyWorkspaceSources(targetDir, cwd, relTargetDir) {
-  const pluginPyproject = join29(targetDir, "pyproject.toml");
-  if (!existsSync27(pluginPyproject)) return;
+  const pluginPyproject = join31(targetDir, "pyproject.toml");
+  if (!existsSync29(pluginPyproject)) return;
   const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(cwd));
   if (sourced.length > 0) {
     log.info(
@@ -8677,14 +8842,14 @@ var pluginInstallCommand = new Command15("install").description(
   }
 );
 function resolveLocalPlugin(localPath) {
-  if (!existsSync28(localPath)) {
+  if (!existsSync30(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync6(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join30(localPath, "biffo.plugin.json");
-  if (!existsSync28(manifestPath)) {
+  const manifestPath = join32(localPath, "biffo.plugin.json");
+  if (!existsSync30(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -8710,8 +8875,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join30(tmpDir, "biffo.plugin.json");
-    if (!existsSync28(manifestPath)) {
+    const manifestPath = join32(tmpDir, "biffo.plugin.json");
+    if (!existsSync30(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -8739,8 +8904,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join30(options.cwd, "services");
-  if (!existsSync28(servicesDir)) {
+  const servicesDir = join32(options.cwd, "services");
+  if (!existsSync30(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8758,10 +8923,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join30(options.cwd, relTargetDir);
-  const modulesDir = join30(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join32(options.cwd, relTargetDir);
+  const modulesDir = join32(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync28(targetDir) && !inTreeSource) {
+  if (existsSync30(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -8796,16 +8961,19 @@ async function runPluginInstall(target, options, deps) {
     if (inTreeSource) {
       log.info(`${relTargetDir}/ is already in this checkout \u2014 installing in place.`);
     } else {
-      mkdirSync10(targetDir, { recursive: true });
+      mkdirSync11(targetDir, { recursive: true });
       await copyPluginSource(source.sourceDir, targetDir);
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
+    const previousProvenance = readProvenance(targetDir);
+    const nextProvenance = inTreeSource ? inTreePluginProvenance(relTargetDir) : entry ? resolveRegistryProvenance(entry.repo, await deps.git.resolveDefaultBranchSha(entry.repo)) : await resolveLocalProvenance(source.sourceDir, source.origin);
+    writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, relTargetDir);
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join30(targetDir, "terraform");
-    if (existsSync28(tfSourceDir)) {
-      mkdirSync10(modulesDir, { recursive: true });
-      cpSync4(tfSourceDir, modulesDir, { recursive: true });
+    const tfSourceDir = join32(targetDir, "terraform");
+    if (existsSync30(tfSourceDir)) {
+      mkdirSync11(modulesDir, { recursive: true });
+      cpSync5(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
       log.success(`Copied Terraform module to modules/plugins/${pluginName}/`);
       const wiring = syncPluginTerraform(options.cwd);
@@ -8844,6 +9012,10 @@ async function runPluginInstall(target, options, deps) {
     } else {
       log.info(`${pluginName} declares no tables \u2014 nothing to migrate.`);
     }
+    const seedResult = vendorPluginSeed(targetDir, manifest, options.cwd);
+    if (seedResult.vendored) {
+      stagePaths.push(seedResult.stagedPath);
+    }
     const commitMessage = `feat(plugins): install ${pluginName}@${source.version}`;
     await deps.git.add(options.cwd, stagePaths);
     await deps.git.commit(options.cwd, commitMessage);
@@ -8860,7 +9032,7 @@ async function runPluginInstall(target, options, deps) {
 }
 function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync21(path, "utf8"));
+    return JSON.parse(readFileSync22(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
@@ -8892,13 +9064,18 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
       `  Would generate a migration for ${source.manifest.tables.length} table(s) into services/api/migrations/versions/`
     );
   }
+  if (source && source.manifest.seed) {
+    console.log(
+      `  Would vendor seed DDL into: ${pluginSeedImportDir(name)}/ (baseline_tables: ${source.manifest.seed.baseline_tables.join(", ") || "none declared"})`
+    );
+  }
   console.log(`  Would commit:  feat(plugins): install ${name}@${version}
 `);
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync29, readFileSync as readFileSync22 } from "fs";
-import { join as join31, resolve as resolve13 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync23 } from "fs";
+import { join as join33, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -8911,8 +9088,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join31(options.cwd, "services");
-  if (!existsSync29(servicesDir)) {
+  const servicesDir = join33(options.cwd, "services");
+  if (!existsSync31(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8920,7 +9097,7 @@ async function runPluginList(options) {
   const plugins = [];
   for (const location of findInstalledPlugins(options.cwd)) {
     try {
-      const manifest = validateManifest(JSON.parse(readFileSync22(location.manifestPath, "utf8")));
+      const manifest = validateManifest(JSON.parse(readFileSync23(location.manifestPath, "utf8")));
       plugins.push({
         name: manifest.name,
         version: manifest.version,
@@ -8956,16 +9133,275 @@ async function runPluginList(options) {
   );
 }
 
+// src/commands/plugin-staleness.ts
+import { resolve as resolve14 } from "path";
+import { Command as Command17 } from "commander";
+
+// src/lib/plugin-staleness.ts
+import { existsSync as existsSync32, readFileSync as readFileSync24, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
+import { join as join34, relative as relative4 } from "path";
+function discoverVendoredPlugins(servicesDir) {
+  if (!existsSync32(servicesDir)) return [];
+  return readdirSync14(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync32(join34(servicesDir, name, "biffo.plugin.json"))).sort();
+}
+async function checkPluginStaleness(cwd, deps) {
+  const servicesDir = join34(cwd, "services");
+  const names = discoverVendoredPlugins(servicesDir);
+  let registryRepoByName = null;
+  const resolveRegistryRepo = async (name) => {
+    if (registryRepoByName === null) {
+      registryRepoByName = /* @__PURE__ */ new Map();
+      try {
+        const reg = await deps.registry.fetchRegistry();
+        for (const entry of reg.plugins) registryRepoByName.set(entry.name, entry.repo);
+      } catch {
+      }
+    }
+    return registryRepoByName.get(name) ?? null;
+  };
+  const results = [];
+  for (const name of names) {
+    results.push(await checkOnePlugin(join34(servicesDir, name), name, resolveRegistryRepo, deps.git));
+  }
+  return results;
+}
+async function checkOnePlugin(pluginDir2, name, resolveRegistryRepo, git) {
+  const provenance = readProvenance(pluginDir2);
+  if (provenance.status === "invalid") {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: `provenance file is unreadable \u2014 ${provenance.reason}`
+    };
+  }
+  const record = provenance.status === "present" ? provenance.record : null;
+  if (record?.inTree) {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: `installed --local straight into services/${name}/ (in-tree) \u2014 there is no external plugin repo to compare against`
+    };
+  }
+  if (record?.sha && isFetchableUrl(record.origin)) {
+    return checkViaProvenance(name, record, record.origin, git);
+  }
+  const localOrigin = record && !isFetchableUrl(record.origin) && existsSync32(record.origin) ? record.origin : null;
+  if (localOrigin) {
+    return checkViaContentDiff(name, pluginDir2, localOrigin, { isLocalDir: true }, git);
+  }
+  const registryRepo = await resolveRegistryRepo(name);
+  if (!registryRepo) {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: record ? `provenance records origin '${record.origin}', which is neither a reachable git URL nor a local directory that still exists, and '${name}' was not found in the plugin registry either` : `no provenance recorded (vendored before #1547, or an unreachable registry) and '${name}' was not found in the plugin registry \u2014 nothing to compare against`
+    };
+  }
+  if (record?.sha) {
+    return checkViaProvenance(name, record, registryRepo, git);
+  }
+  return checkViaContentDiff(name, pluginDir2, registryRepo, { isLocalDir: false }, git);
+}
+function isFetchableUrl(origin) {
+  return /^(https?|git|ssh):\/\//.test(origin) || /^[^/\\]+@[^:]+:/.test(origin);
+}
+async function checkViaProvenance(name, record, repoUrl, git) {
+  const remoteHeadSha = await git.resolveDefaultBranchSha(repoUrl);
+  if (!remoteHeadSha) {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: `could not reach ${repoUrl} (network or authentication failure)`
+    };
+  }
+  if (remoteHeadSha === record.sha) {
+    return {
+      name,
+      status: "up-to-date",
+      method: "provenance",
+      detail: `matches ${repoUrl}'s default branch (${shortSha(remoteHeadSha)})`
+    };
+  }
+  let clone;
+  try {
+    clone = await git.cloneForEditing(repoUrl, "biffo-plugin-staleness-full");
+  } catch {
+    return {
+      name,
+      status: "cannot-tell",
+      method: "unresolvable",
+      detail: `could not clone ${repoUrl} to count commits behind (network or authentication failure)`
+    };
+  }
+  try {
+    const commitsBehind = await git.countBehind(clone, record.sha, "HEAD");
+    if (commitsBehind === null) {
+      return {
+        name,
+        status: "cannot-tell",
+        method: "unresolvable",
+        detail: `recorded commit ${shortSha(record.sha)} was not found in ${repoUrl}'s history (rebased or force-pushed?) \u2014 cannot count commits behind`
+      };
+    }
+    if (commitsBehind === 0) {
+      return {
+        name,
+        status: "up-to-date",
+        method: "provenance",
+        detail: `matches ${repoUrl}'s default branch (${shortSha(remoteHeadSha)})`
+      };
+    }
+    return {
+      name,
+      status: "behind",
+      commitsBehind,
+      method: "provenance",
+      detail: `${commitsBehind} commit(s) behind ${repoUrl}'s default branch`
+    };
+  } finally {
+    git.cleanup(clone);
+  }
+}
+async function checkViaContentDiff(name, pluginDir2, sourceDir, opts, git) {
+  let cloneDir = null;
+  let effectiveSourceDir = sourceDir;
+  if (!opts.isLocalDir) {
+    try {
+      cloneDir = await git.cloneToTemp(sourceDir, "biffo-plugin-staleness-content");
+    } catch {
+      return {
+        name,
+        status: "cannot-tell",
+        method: "unresolvable",
+        detail: `could not clone ${sourceDir} for a content comparison (network or authentication failure)`
+      };
+    }
+    effectiveSourceDir = cloneDir;
+  }
+  try {
+    const filesDiffering = await countDifferingFiles(effectiveSourceDir, pluginDir2);
+    const originDescription = opts.isLocalDir ? effectiveSourceDir : sourceDir;
+    if (filesDiffering === 0) {
+      return {
+        name,
+        status: "up-to-date",
+        method: "content-diff",
+        filesDiffering: 0,
+        detail: `byte-identical to ${originDescription} (no provenance recorded, so an exact commit could not be named)`
+      };
+    }
+    return {
+      name,
+      status: "behind",
+      filesDiffering,
+      method: "content-diff",
+      detail: `${filesDiffering} file(s) differ from ${originDescription} (no provenance recorded, so an exact commit count could not be determined)`
+    };
+  } finally {
+    if (cloneDir) git.cleanup(cloneDir);
+  }
+}
+function shortSha(sha) {
+  return sha.slice(0, 7);
+}
+async function countDifferingFiles(sourceDir, pluginDir2) {
+  const sourceFiles = await sourceFileList(sourceDir);
+  const vendorFiles = vendorFileList(pluginDir2);
+  const allPaths = /* @__PURE__ */ new Set([...sourceFiles, ...vendorFiles]);
+  let differing = 0;
+  for (const relPath of allPaths) {
+    if (relPath === PLUGIN_PROVENANCE_FILENAME) continue;
+    const inSource = sourceFiles.has(relPath);
+    const inVendor = vendorFiles.has(relPath);
+    if (!inSource || !inVendor) {
+      differing++;
+      continue;
+    }
+    const a = readFileSync24(join34(sourceDir, relPath));
+    const b = readFileSync24(join34(pluginDir2, relPath));
+    if (!a.equals(b)) differing++;
+  }
+  return differing;
+}
+async function sourceFileList(dir) {
+  if (await isGitWorkingTree2(dir)) {
+    return new Set(await listGitFiles(dir));
+  }
+  return new Set(walkExcluding(dir, dir, LOCAL_COPY_EXCLUDES));
+}
+function vendorFileList(dir) {
+  return new Set(walkExcluding(dir, dir, LOCAL_COPY_EXCLUDES));
+}
+function walkExcluding(root, dir, excludes) {
+  if (!existsSync32(dir)) return [];
+  const out = [];
+  for (const entry of readdirSync14(dir)) {
+    if (excludes.has(entry) || entry === ".git") continue;
+    const full = join34(dir, entry);
+    const stat = statSync7(full);
+    if (stat.isDirectory()) {
+      out.push(...walkExcluding(root, full, excludes));
+    } else {
+      out.push(relative4(root, full));
+    }
+  }
+  return out;
+}
+function exitCodeForStaleness(results) {
+  if (results.some((r) => r.status === "cannot-tell")) return 2;
+  if (results.some((r) => r.status === "behind")) return 1;
+  return 0;
+}
+function formatStalenessReport(results) {
+  if (results.length === 0) {
+    return "  No vendored plugins under services/ \u2014 nothing to check.";
+  }
+  const lines = [""];
+  for (const r of results) {
+    const icon = r.status === "up-to-date" ? "\u2713" : r.status === "behind" ? "\u26A0" : "?";
+    lines.push(`  ${icon} ${r.name}: ${labelFor(r.status)} \u2014 ${r.detail}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function labelFor(status) {
+  switch (status) {
+    case "up-to-date":
+      return "up to date";
+    case "behind":
+      return "BEHIND";
+    case "cannot-tell":
+      return "CANNOT TELL";
+  }
+}
+
+// src/commands/plugin-staleness.ts
+var pluginStalenessCommand = new Command17("staleness").description(
+  "Report how far each services/<name>/ vendored plugin has drifted from its source (#1547). Exits 0 up to date, 1 behind, 2 cannot tell \u2014 2 is never a pass."
+).option("--cwd <path>", "Project root to check (defaults to the current directory)").action(async (options) => {
+  const cwd = options.cwd ? resolve14(options.cwd) : process.cwd();
+  const results = await checkPluginStaleness(cwd, {
+    registry: new RegistryAdapter(),
+    git: new GitAdapter()
+  });
+  console.log(formatStalenessReport(results));
+  process.exit(exitCodeForStaleness(results));
+});
+
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync30 } from "fs";
-import { join as join32, relative as relative4, resolve as resolve14 } from "path";
+import { existsSync as existsSync33 } from "fs";
+import { join as join35, relative as relative5, resolve as resolve15 } from "path";
 import chalk17 from "chalk";
-import { Command as Command17 } from "commander";
-var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
+import { Command as Command18 } from "commander";
+var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
   "Generate real, committed migration file(s) for installed-but-not-yet-migrated plugin(s): biffo plugin sync-migrations [name]"
 ).argument("[name]", "Restrict to this installed plugin (default: every plugin under services/)").option("--dry-run", "Generate nothing; just report what would be generated").option("--no-commit", "Generate and stage the file(s) but do not commit").option("--cwd <path>", "Project root (defaults to the current directory)").action(
   async (name, options) => {
-    const cwd = options.cwd ? resolve14(options.cwd) : process.cwd();
+    const cwd = options.cwd ? resolve15(options.cwd) : process.cwd();
     try {
       await runPluginSyncMigrations(
         name,
@@ -8979,11 +9415,11 @@ var pluginSyncMigrationsCommand = new Command17("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join32(options.cwd, "services");
-  if (!existsSync30(servicesDir)) {
+  const servicesDir = join35(options.cwd, "services");
+  if (!existsSync33(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync30(join32(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync33(join35(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -8999,7 +9435,7 @@ async function runPluginSyncMigrations(name, options, deps) {
     );
     return;
   }
-  const relativePaths = generated.map((p) => relative4(options.cwd, p));
+  const relativePaths = generated.map((p) => relative5(options.cwd, p));
   for (const p of relativePaths) {
     log.success(`Generated ${p}`);
   }
@@ -9019,18 +9455,18 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync31, readFileSync as readFileSync23, rmSync as rmSync8 } from "fs";
-import { join as join33, resolve as resolve15 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync25, rmSync as rmSync9 } from "fs";
+import { join as join36, resolve as resolve16 } from "path";
 import chalk18 from "chalk";
-import { Command as Command18 } from "commander";
+import { Command as Command19 } from "commander";
 import inquirer6 from "inquirer";
 var NAME_PATTERN2 = /^[a-z][a-z0-9-]*$/;
-var pluginUninstallCommand = new Command18("uninstall").description("Remove an installed plugin: biffo plugin uninstall <name>").argument("<name>", "Plugin name").option("--dry-run", "Print planned changes without modifying the repo").option("--force", "Skip the confirmation prompt").option(
+var pluginUninstallCommand = new Command19("uninstall").description("Remove an installed plugin: biffo plugin uninstall <name>").argument("<name>", "Plugin name").option("--dry-run", "Print planned changes without modifying the repo").option("--force", "Skip the confirmation prompt").option(
   "--keep-data",
   "No-op today (see notes) \u2014 the CLI never drops plugin data regardless of this flag"
 ).option("--cwd <path>", "Project root to uninstall from (defaults to the current directory)").action(
   async (name, options) => {
-    const cwd = options.cwd ? resolve15(options.cwd) : process.cwd();
+    const cwd = options.cwd ? resolve16(options.cwd) : process.cwd();
     try {
       await runPluginUninstall(
         name,
@@ -9052,16 +9488,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join33(options.cwd, "services");
-  if (!existsSync31(servicesDir)) {
+  const servicesDir = join36(options.cwd, "services");
+  if (!existsSync34(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join33(servicesDir, name);
-  if (!existsSync31(targetDir)) {
-    const firstParty = join33(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync31(firstParty)) {
+  const targetDir = join36(servicesDir, name);
+  if (!existsSync34(targetDir)) {
+    const firstParty = join36(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync34(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -9069,9 +9505,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join33(options.cwd, "modules", "plugins", name);
+  const modulesDir = join36(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync31(modulesDir)) {
+  if (existsSync34(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -9091,10 +9527,10 @@ async function runPluginUninstall(name, options, deps) {
       `${options.cwd} is not a git repository \u2014 biffo plugin uninstall must be run from a Biffo project checkout.`
     );
   }
-  rmSync8(targetDir, { recursive: true, force: true });
+  rmSync9(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync31(modulesDir)) {
-    rmSync8(modulesDir, { recursive: true, force: true });
+  if (existsSync34(modulesDir)) {
+    rmSync9(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
     stagePaths.push(...wiring.changedPaths);
@@ -9128,12 +9564,17 @@ async function runPluginUninstall(name, options, deps) {
       "Any tables this plugin created remain in the database, and its migration file at services/api/migrations/versions/ is NOT removed (it is a permanent historical record \u2014 see notes). Dropping tables, if desired, requires a manual Alembic migration written against the Core API."
     );
   }
+  if (existsSync34(join36(options.cwd, pluginSeedImportDir(name)))) {
+    log.warn(
+      `${pluginSeedImportDir(name)}/ (this plugin's vendored baseline-row seed, biffo-template#1554) was NOT removed either, for the same reason \u2014 see notes. Delete it by hand if you are certain the rows it applied should go too, but note nothing drops rows already applied to the database; that still needs a manual migration.`
+    );
+  }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join33(targetDir, "biffo.plugin.json");
-  if (!existsSync31(manifestPath)) return void 0;
+  const manifestPath = join36(targetDir, "biffo.plugin.json");
+  if (!existsSync34(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync23(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync25(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -9166,12 +9607,12 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync5, existsSync as existsSync32, mkdirSync as mkdirSync11, readFileSync as readFileSync24, rmSync as rmSync9 } from "fs";
-import { join as join34, relative as relative5, resolve as resolve16 } from "path";
+import { cpSync as cpSync6, existsSync as existsSync35, mkdirSync as mkdirSync12, readFileSync as readFileSync26, rmSync as rmSync10 } from "fs";
+import { join as join37, relative as relative6, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
-import { Command as Command19 } from "commander";
+import { Command as Command20 } from "commander";
 import inquirer7 from "inquirer";
-var pluginUpgradeCommand = new Command19("upgrade").description(
+var pluginUpgradeCommand = new Command20("upgrade").description(
   "Upgrade an installed plugin to a new minor version (biffo plugin upgrade <name>@<new-minor>) or refresh it in place from a local, unpublished checkout (biffo plugin upgrade --local <path>)"
 ).argument(
   "[target]",
@@ -9181,12 +9622,12 @@ var pluginUpgradeCommand = new Command19("upgrade").description(
   "Refresh the installed plugin from a local, unpublished checkout instead of the registry"
 ).option("--dry-run", "Resolve the new version and print planned changes without applying them").option("--force", "Skip the confirmation prompt").option("--cwd <path>", "Project root to upgrade in (defaults to the current directory)").action(
   async (target, options) => {
-    const cwd = options.cwd ? resolve16(options.cwd) : process.cwd();
+    const cwd = options.cwd ? resolve17(options.cwd) : process.cwd();
     try {
       await runPluginUpgrade(
         target,
         {
-          ...options.local ? { local: resolve16(options.local) } : {},
+          ...options.local ? { local: resolve17(options.local) } : {},
           dryRun: options.dryRun ?? false,
           force: options.force ?? false,
           cwd
@@ -9214,8 +9655,8 @@ async function runPluginUpgrade(target, options, deps) {
       `Nothing to upgrade. Pass a registry target (e.g. \`biffo plugin upgrade acme-crm@1.1\`) or a local checkout to refresh from (\`biffo plugin upgrade --local ../acme-crm\`).`
     );
   }
-  const servicesDir = join34(options.cwd, "services");
-  if (!existsSync32(servicesDir)) {
+  const servicesDir = join37(options.cwd, "services");
+  if (!existsSync35(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -9224,8 +9665,8 @@ async function runPluginUpgrade(target, options, deps) {
     return runLocalPluginRefresh(options.local, options, deps);
   }
   const { name, minor } = parsePluginTarget(target);
-  const targetDir = join34(servicesDir, name);
-  if (!existsSync32(targetDir)) {
+  const targetDir = join37(servicesDir, name);
+  if (!existsSync35(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -9239,7 +9680,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join34(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join37(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -9267,19 +9708,25 @@ async function runPluginUpgrade(target, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
-    rmSync9(targetDir, { recursive: true, force: true });
-    mkdirSync11(targetDir, { recursive: true });
-    cpSync5(tmpDir, targetDir, { recursive: true });
+    const previousProvenance = readProvenance(targetDir);
+    rmSync10(targetDir, { recursive: true, force: true });
+    mkdirSync12(targetDir, { recursive: true });
+    cpSync6(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
+    const nextProvenance = resolveRegistryProvenance(
+      entry.repo,
+      await deps.git.resolveDefaultBranchSha(entry.repo)
+    );
+    writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync32(modulesDir)) {
-      rmSync9(modulesDir, { recursive: true, force: true });
+    if (existsSync35(modulesDir)) {
+      rmSync10(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join34(targetDir, "terraform");
-    if (existsSync32(tfSourceDir)) {
-      mkdirSync11(modulesDir, { recursive: true });
-      cpSync5(tfSourceDir, modulesDir, { recursive: true });
+    const tfSourceDir = join37(targetDir, "terraform");
+    if (existsSync35(tfSourceDir)) {
+      mkdirSync12(modulesDir, { recursive: true });
+      cpSync6(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
       log.success(`Copied Terraform module to modules/plugins/${entry.name}/`);
     }
@@ -9289,16 +9736,20 @@ async function runPluginUpgrade(target, options, deps) {
       );
       const generatedPaths = await deps.migrations.generate(options.cwd, [entry.name]);
       for (const absPath of generatedPaths) {
-        stagePaths.push(relative5(options.cwd, absPath));
+        stagePaths.push(relative6(options.cwd, absPath));
       }
       if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative5(options.cwd, generatedPaths[0])}`);
+        log.success(`Generated migration: ${relative6(options.cwd, generatedPaths[0])}`);
       } else {
         log.info(
           `${entry.name}'s tables and columns already match the manifest \u2014 no migration needed.`
         );
       }
     }
+    const seedResult = vendorPluginSeed(targetDir, manifest, options.cwd);
+    if (seedResult.vendored) {
+      stagePaths.push(seedResult.stagedPath);
+    }
     const label = currentVersion ? `${entry.name} ${currentVersion} -> ${entry.version}` : `${entry.name} to ${entry.version}`;
     const commitMessage = `feat(plugins): upgrade ${label}`;
     await deps.git.add(options.cwd, stagePaths);
@@ -9317,16 +9768,16 @@ async function runPluginUpgrade(target, options, deps) {
 async function runLocalPluginRefresh(localPath, options, deps) {
   const source = resolveLocalPlugin(localPath);
   log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
-  const servicesDir = join34(options.cwd, "services");
-  const targetDir = join34(servicesDir, source.name);
-  if (!existsSync32(targetDir)) {
+  const servicesDir = join37(options.cwd, "services");
+  const targetDir = join37(servicesDir, source.name);
+  if (!existsSync35(targetDir)) {
     throw new Error(
       `Plugin '${source.name}' is not installed at services/${source.name}/. Use 'biffo plugin install --local ${localPath}' instead.`
     );
   }
-  const inTreeSource = resolve16(source.sourceDir) === resolve16(targetDir);
+  const inTreeSource = resolve17(source.sourceDir) === resolve17(targetDir);
   const currentVersion = readInstalledVersion2(targetDir);
-  const modulesDir = join34(options.cwd, "modules", "plugins", source.name);
+  const modulesDir = join37(options.cwd, "modules", "plugins", source.name);
   if (options.dryRun) {
     printLocalDryRun(source, currentVersion, inTreeSource);
     return;
@@ -9349,25 +9800,28 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
+    const previousProvenance = readProvenance(targetDir);
     if (inTreeSource) {
       log.info(
         `services/${source.name}/ is already the local checkout \u2014 nothing to copy; re-syncing its Terraform module and checking for a migration.`
       );
     } else {
-      rmSync9(targetDir, { recursive: true, force: true });
-      mkdirSync11(targetDir, { recursive: true });
+      rmSync10(targetDir, { recursive: true, force: true });
+      mkdirSync12(targetDir, { recursive: true });
       await copyPluginSource(source.sourceDir, targetDir);
       log.success(`Refreshed plugin source at services/${source.name}/ from ${source.origin}`);
     }
+    const nextProvenance = inTreeSource ? inTreePluginProvenance(`services/${source.name}`) : await resolveLocalProvenance(source.sourceDir, source.origin);
+    writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
     const stagePaths = [`services/${source.name}`];
-    if (existsSync32(modulesDir)) {
-      rmSync9(modulesDir, { recursive: true, force: true });
+    if (existsSync35(modulesDir)) {
+      rmSync10(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join34(targetDir, "terraform");
-    if (existsSync32(tfSourceDir)) {
-      mkdirSync11(modulesDir, { recursive: true });
-      cpSync5(tfSourceDir, modulesDir, { recursive: true });
+    const tfSourceDir = join37(targetDir, "terraform");
+    if (existsSync35(tfSourceDir)) {
+      mkdirSync12(modulesDir, { recursive: true });
+      cpSync6(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${source.name}`);
       log.success(`Refreshed Terraform module at modules/plugins/${source.name}/`);
     }
@@ -9377,10 +9831,10 @@ async function runLocalPluginRefresh(localPath, options, deps) {
       );
       const generatedPaths = await deps.migrations.generate(options.cwd, [source.name]);
       for (const absPath of generatedPaths) {
-        stagePaths.push(relative5(options.cwd, absPath));
+        stagePaths.push(relative6(options.cwd, absPath));
       }
       if (generatedPaths.length > 0) {
-        log.success(`Generated migration: ${relative5(options.cwd, generatedPaths[0])}`);
+        log.success(`Generated migration: ${relative6(options.cwd, generatedPaths[0])}`);
       } else {
         log.info(
           `${source.name}'s tables and columns already match the manifest \u2014 no migration needed.`
@@ -9389,6 +9843,10 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     } else {
       log.info(`${source.name} declares no tables \u2014 nothing to migrate.`);
     }
+    const seedResult = vendorPluginSeed(targetDir, manifest, options.cwd);
+    if (seedResult.vendored) {
+      stagePaths.push(seedResult.stagedPath);
+    }
     await deps.git.add(options.cwd, stagePaths);
     if (!await deps.git.hasUncommittedChanges(options.cwd)) {
       log.warn(`services/${source.name}/ already matches ${source.origin} \u2014 nothing to commit.`);
@@ -9408,10 +9866,10 @@ async function runLocalPluginRefresh(localPath, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join34(targetDir, "biffo.plugin.json");
-  if (!existsSync32(manifestPath)) return void 0;
+  const manifestPath = join37(targetDir, "biffo.plugin.json");
+  if (!existsSync35(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync24(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync26(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -9446,6 +9904,11 @@ function printDryRun6(entry, currentVersion) {
       `  Would replace Terraform module at: modules/plugins/${entry.name}/ (if the repo has one)`
     );
   }
+  if (entry.baseline_tables && entry.baseline_tables.length > 0) {
+    console.log(
+      `  Would re-vendor seed DDL into: ${pluginSeedImportDir(entry.name)}/ (baseline_tables: ${entry.baseline_tables.join(", ")})`
+    );
+  }
   console.log(`  Would commit:  feat(plugins): upgrade ${entry.name} to ${entry.version}
 `);
 }
@@ -9465,12 +9928,17 @@ function printLocalDryRun(source, currentVersion, inTreeSource) {
       `  Would check for a migration for ${source.manifest.tables.length} table(s) (generated for a new table or an added column on an already-migrated table; a removed/retyped/nullability-changed column stops the refresh instead \u2014 #1539)`
     );
   }
+  if (source.manifest.seed) {
+    console.log(
+      `  Would re-vendor seed DDL into: ${pluginSeedImportDir(source.name)}/ (baseline_tables: ${source.manifest.seed.baseline_tables.join(", ") || "none declared"})`
+    );
+  }
   console.log(`  Would commit:  chore(plugins): refresh ${source.name} from local checkout
 `);
 }
 
 // src/commands/plugin.ts
-var pluginCommand = new Command20("plugin").description("Manage Biffo plugins");
+var pluginCommand = new Command21("plugin").description("Manage Biffo plugins");
 pluginCommand.addCommand(pluginCreateCommand);
 pluginCommand.addCommand(pluginListCommand);
 pluginCommand.addCommand(pluginInstallCommand);
@@ -9478,15 +9946,16 @@ pluginCommand.addCommand(pluginUninstallCommand);
 pluginCommand.addCommand(pluginUpgradeCommand);
 pluginCommand.addCommand(pluginSyncMigrationsCommand);
 pluginCommand.addCommand(pluginInfoCommand);
+pluginCommand.addCommand(pluginStalenessCommand);
 
 // src/commands/sibling.ts
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync33, readFileSync as readFileSync25 } from "fs";
-import { resolve as resolve17 } from "path";
+import { existsSync as existsSync36, readFileSync as readFileSync27 } from "fs";
+import { resolve as resolve18 } from "path";
 import chalk20 from "chalk";
-import { Command as Command21 } from "commander";
+import { Command as Command22 } from "commander";
 
 // src/lib/sibling-identity-check.ts
 function checkSiblingIdentity(envs) {
@@ -9538,7 +10007,7 @@ function checkSiblingIdentity(envs) {
 // src/commands/sibling-check-identity.ts
 var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
 var SIBLING_CORE_POOL_VAR = "CORE_COGNITO_USER_POOL_ID";
-var siblingCheckIdentityCommand = new Command21("check-identity").description(
+var siblingCheckIdentityCommand = new Command22("check-identity").description(
   "Detect when a core's Cognito pool has drifted from its published identity document or any sibling's baked-in CORE_COGNITO_USER_POOL_ID (#400). Run from the core repo; exits non-zero on drift so a scheduled/CI run goes red."
 ).option("--env <environment>", "Only check this environment (default: dev, staging, prod)").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(async (options) => {
   if (options.env && !VALID_ENVIRONMENTS2.includes(options.env)) {
@@ -9677,7 +10146,7 @@ async function fetchPublishedIdentity(portalUrl) {
 }
 async function resolveConfig4(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync25(resolve17(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync27(resolve18(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -9696,9 +10165,9 @@ async function resolveConfig4(options) {
     }
     return cfg;
   }
-  const localConfigPath = resolve17(process.cwd(), "biffo.config.json");
-  if (existsSync33(localConfigPath)) {
-    const raw = JSON.parse(readFileSync25(localConfigPath, "utf8"));
+  const localConfigPath = resolve18(process.cwd(), "biffo.config.json");
+  if (existsSync36(localConfigPath)) {
+    const raw = JSON.parse(readFileSync27(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -9734,31 +10203,31 @@ async function resolveConfig4(options) {
 }
 
 // src/commands/sibling.ts
-var siblingCommand = new Command22("sibling").description(
+var siblingCommand = new Command23("sibling").description(
   "Create and manage sibling apps that share a Biffo core project (ADR-0007)"
 );
 siblingCommand.addCommand(siblingCreateCommand);
 siblingCommand.addCommand(siblingCheckIdentityCommand);
 
 // src/commands/check.ts
-import { Command as Command23 } from "commander";
+import { Command as Command24 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
-import { existsSync as existsSync35 } from "fs";
-import { join as join36 } from "path";
-import { execa as execa6 } from "execa";
+import { existsSync as existsSync38 } from "fs";
+import { join as join39 } from "path";
+import { execa as execa7 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
-import { existsSync as existsSync34, readdirSync as readdirSync13, readFileSync as readFileSync26 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync37, readdirSync as readdirSync15, readFileSync as readFileSync28 } from "fs";
+import { join as join38 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join35(adrDir, ALLOWLIST_FILENAME);
-  if (!existsSync34(path)) return /* @__PURE__ */ new Set();
+  const path = join38(adrDir, ALLOWLIST_FILENAME);
+  if (!existsSync37(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
-  for (const rawLine of readFileSync26(path, "utf8").split("\n")) {
+  for (const rawLine of readFileSync28(path, "utf8").split("\n")) {
     const line = rawLine.split("#")[0].trim();
     if (line) numbers.add(line);
   }
@@ -9766,8 +10235,8 @@ function readAdrNumberingAllowlist(adrDir) {
 }
 function adrNumbersIn(adrDir) {
   const claims = /* @__PURE__ */ new Map();
-  if (!existsSync34(adrDir)) return claims;
-  for (const entry of readdirSync13(adrDir).sort()) {
+  if (!existsSync37(adrDir)) return claims;
+  for (const entry of readdirSync15(adrDir).sort()) {
     const match = ADR_FILENAME.exec(entry);
     if (!match) continue;
     const number = match[1];
@@ -9820,9 +10289,9 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
-  const root = (await execa6("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join36(root, "docs", "ADR");
-  if (!existsSync35(adrDir)) {
+  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const adrDir = join39(root, "docs", "ADR");
+  if (!existsSync38(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
   }
@@ -9861,7 +10330,7 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 
 // src/scripts/check-branch-protection.ts
 import { Octokit as Octokit2 } from "@octokit/rest";
-import { execa as execa7 } from "execa";
+import { execa as execa8 } from "execa";
 
 // src/lib/branch-protection-apply.ts
 var CONTEXT_CONSISTENCY_THRESHOLD = 2 / 3;
@@ -9988,7 +10457,7 @@ async function resolveRepo(explicit) {
     }
     return { owner, repo };
   }
-  const { stdout } = await execa7("git", ["remote", "get-url", "origin"]);
+  const { stdout } = await execa8("git", ["remote", "get-url", "origin"]);
   const m = /github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/.exec(stdout.trim());
   if (!m?.[1] || !m[2]) {
     console.error(
@@ -10120,13 +10589,13 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 }
 
 // src/scripts/check-codeql-suppression.ts
-import { existsSync as existsSync36 } from "fs";
-import { join as join38, relative as relative6 } from "path";
-import { execa as execa8 } from "execa";
+import { existsSync as existsSync39 } from "fs";
+import { join as join41, relative as relative7 } from "path";
+import { execa as execa9 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
-import { readdirSync as readdirSync14, readFileSync as readFileSync27, statSync as statSync7 } from "fs";
-import { join as join37 } from "path";
+import { readdirSync as readdirSync16, readFileSync as readFileSync29, statSync as statSync8 } from "fs";
+import { join as join40 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".worktrees",
@@ -10152,15 +10621,15 @@ function walkSourceFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync14(dir);
+      entries = readdirSync16(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join37(dir, entry);
+      const p = join40(dir, entry);
       let st;
       try {
-        st = statSync7(p);
+        st = statSync8(p);
       } catch {
         continue;
       }
@@ -10183,7 +10652,7 @@ function countSourceFiles(root) {
 function sweepCodeqlSuppressionComments(root) {
   const hits = [];
   for (const path of walkSourceFiles(root)) {
-    const text = readFileSync27(path, "utf8");
+    const text = readFileSync29(path, "utf8");
     for (const line of findCodeqlSuppressionComments(text)) {
       hits.push({ path, line, text: text.split("\n")[line - 1] ?? "" });
     }
@@ -10193,9 +10662,9 @@ function sweepCodeqlSuppressionComments(root) {
 
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
-  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const scanRoot = join38(root, "cli", "src");
-  if (!existsSync36(scanRoot)) {
+  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const scanRoot = join41(root, "cli", "src");
+  if (!existsSync39(scanRoot)) {
     console.log(
       "\u2014 codeql-suppression guard: skipped \u2014 no cli/src in this repo, so there is no CLI source to scan."
     );
@@ -10207,7 +10676,7 @@ async function runCodeqlSuppressionCheck() {
       "\u2717 codeql-suppression guard: found a `codeql[...]`-shaped comment, which does not suppress anything in this repo (#1491) \u2014 dismiss the real alert instead (UI, or `PATCH .../code-scanning/alerts/<n>` with a recorded reason)\n"
     );
     for (const hit of hits) {
-      console.error(`  ${relative6(root, hit.path)}:${hit.line}  ${hit.text.trim()}`);
+      console.error(`  ${relative7(root, hit.path)}:${hit.line}  ${hit.text.trim()}`);
     }
     process.exit(1);
   }
@@ -10219,11 +10688,11 @@ async function runCodeqlSuppressionCheck() {
 }
 
 // src/scripts/check-cognito-invite-template.ts
-import { execa as execa9 } from "execa";
+import { execa as execa10 } from "execa";
 
 // src/lib/cognito-invite-template-guard.ts
-import { readdirSync as readdirSync15, readFileSync as readFileSync28, statSync as statSync8 } from "fs";
-import { join as join39 } from "path";
+import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync9 } from "fs";
+import { join as join42 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -10297,36 +10766,36 @@ function memberBody(blockBody, member) {
 }
 function findModuleTerraformFiles(repoRoot) {
   const found = [];
-  const walk2 = (dir, relative9) => {
+  const walk2 = (dir, relative10) => {
     let entries;
     try {
-      entries = readdirSync15(dir);
+      entries = readdirSync17(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join39(dir, entry);
-      const rel = `${relative9}/${entry}`;
-      if (statSync8(full).isDirectory()) {
+      const full = join42(dir, entry);
+      const rel = `${relative10}/${entry}`;
+      if (statSync9(full).isDirectory()) {
         walk2(full, rel);
       } else if (entry.endsWith(".tf")) {
         found.push(rel);
       }
     }
   };
-  walk2(join39(repoRoot, "modules"), "modules");
+  walk2(join42(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync28(join39(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync30(join42(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-cognito-invite-template.ts
 async function runCognitoInviteTemplateCheck() {
-  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
@@ -10348,12 +10817,12 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join41 } from "path";
-import { execa as execa10 } from "execa";
+import { join as join44 } from "path";
+import { execa as execa11 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync37, readFileSync as readFileSync29, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
-import { join as join40 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync31, readdirSync as readdirSync18, statSync as statSync10 } from "fs";
+import { join as join43 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -10512,15 +10981,15 @@ function walkFiles(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync16(dir);
+      entries = readdirSync18(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join40(dir, entry);
+      const p = join43(dir, entry);
       let st;
       try {
-        st = statSync9(p);
+        st = statSync10(p);
       } catch {
         continue;
       }
@@ -10547,7 +11016,7 @@ function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_I
   const extracted = [];
   let rawTotal = 0;
   for (const file of files) {
-    const text = readFileSync29(file, "utf8");
+    const text = readFileSync31(file, "utf8");
     rawTotal += countRawExternalOccurrences(text, externalBases);
     extracted.push(...extractCoreDirectPaths(text, file, externalBases));
   }
@@ -10596,7 +11065,7 @@ function auditCoreRouteExtraction(apiSrcDir) {
   const prefixSet = /* @__PURE__ */ new Set();
   let rawApiRouterCount = 0;
   for (const file of files) {
-    const text = readFileSync29(file, "utf8");
+    const text = readFileSync31(file, "utf8");
     const extraction = extractCoreRoutePrefixes(text);
     rawApiRouterCount += extraction.rawApiRouterCount;
     for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
@@ -10612,10 +11081,10 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join40(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join43(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
-    raw = readFileSync29(configPath, "utf8");
+    raw = readFileSync31(configPath, "utf8");
   } catch (err) {
     throw new Error(
       `cannot resolve ${sibling}'s core: ${configPath} does not exist or is unreadable (${err.message}) -- refusing to guess which core serves this sibling.`
@@ -10635,8 +11104,8 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join40(estateDir, coreProject, "services", "api", "src");
-  if (!existsSync37(coreApiSrcDir)) {
+  const coreApiSrcDir = join43(estateDir, coreProject, "services", "api", "src");
+  if (!existsSync40(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
     );
@@ -10677,9 +11146,9 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join41(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join44(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -10695,7 +11164,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join41(root, "services", "api", "src");
+    coreApiSrcDir = join44(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -10731,7 +11200,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa11 } from "execa";
+import { execa as execa12 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -10742,7 +11211,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -10758,11 +11227,11 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa11("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa12("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync39, existsSync: existsSync46 } = await import("fs");
-      if (existsSync46(messageFile)) commitMessage = readFileSync39(messageFile, "utf8");
+      const { readFileSync: readFileSync41, existsSync: existsSync49 } = await import("fs");
+      if (existsSync49(messageFile)) commitMessage = readFileSync41(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -10770,18 +11239,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa11("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa11("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa12("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa12("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa11("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa12("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa11("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa12("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -10863,11 +11332,11 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa12 } from "execa";
+import { execa as execa13 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync30, readdirSync as readdirSync17, statSync as statSync10 } from "fs";
-import { join as join42 } from "path";
+import { readFileSync as readFileSync32, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
+import { join as join45 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -10939,15 +11408,15 @@ function walkTerraformFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync17(dir);
+      entries = readdirSync19(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join42(dir, entry);
+      const p = join45(dir, entry);
       let st;
       try {
-        st = statSync10(p);
+        st = statSync11(p);
       } catch {
         continue;
       }
@@ -10987,7 +11456,7 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync30(file, "utf8");
+    const text = readFileSync32(file, "utf8");
     rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
     rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
     eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
@@ -11040,7 +11509,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -11077,15 +11546,15 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-lambda-output.ts
-import { execa as execa13 } from "execa";
+import { execa as execa14 } from "execa";
 
 // src/lib/lambda-output-guard.ts
-import { readFileSync as readFileSync32 } from "fs";
-import { join as join44 } from "path";
+import { readFileSync as readFileSync34 } from "fs";
+import { join as join47 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { readdirSync as readdirSync18, readFileSync as readFileSync31, statSync as statSync11 } from "fs";
-import { join as join43 } from "path";
+import { readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync12 } from "fs";
+import { join as join46 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -11100,20 +11569,20 @@ function stripComments2(source) {
 }
 function findWorkflowFiles(repoRoot) {
   const found = [];
-  const walk2 = (dir, relative9) => {
+  const walk2 = (dir, relative10) => {
     let entries;
     try {
-      entries = readdirSync18(dir);
+      entries = readdirSync20(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join43(dir, entry);
-      const rel = relative9 ? `${relative9}/${entry}` : entry;
-      if (statSync11(full).isDirectory()) {
+      const full = join46(dir, entry);
+      const rel = relative10 ? `${relative10}/${entry}` : entry;
+      if (statSync12(full).isDirectory()) {
         walk2(full, rel);
-      } else if (/\.ya?ml$/.test(entry) && relative9.endsWith(".github/workflows")) {
+      } else if (/\.ya?ml$/.test(entry) && relative10.endsWith(".github/workflows")) {
         found.push(rel);
       }
     }
@@ -11153,7 +11622,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync31(join43(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync33(join46(repoRoot, file), "utf8"))
   );
 }
 
@@ -11211,13 +11680,13 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync32(join44(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync34(join47(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -11239,9 +11708,9 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync33, readdirSync as readdirSync19 } from "fs";
-import { join as join45, relative as relative7 } from "path";
-import { execa as execa14 } from "execa";
+import { readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
+import { join as join48, relative as relative8 } from "path";
+import { execa as execa15 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -11337,23 +11806,23 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join45(root, dir);
+    const full = join48(root, dir);
     let entries;
     try {
-      entries = readdirSync19(full, { withFileTypes: true });
+      entries = readdirSync21(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join45(full, entry.name));
+      out.push(join48(full, entry.name));
     }
   }
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -11363,8 +11832,8 @@ async function runPipeTrapCheck() {
     process.exit(1);
   }
   const findings = files.flatMap(
-    (file) => findPipeTraps(readFileSync33(file, "utf8")).map(
-      (t) => `${relative7(root, file)}:${t.line}  ${t.text}
+    (file) => findPipeTraps(readFileSync35(file, "utf8")).map(
+      (t) => `${relative8(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
   );
@@ -11380,11 +11849,11 @@ async function runPipeTrapCheck() {
 }
 
 // src/scripts/check-plugin-allowlist-convention.ts
-import { execa as execa15 } from "execa";
+import { execa as execa16 } from "execa";
 
 // src/lib/plugin-allowlist-convention.ts
-import { readFileSync as readFileSync34 } from "fs";
-import { join as join46 } from "path";
+import { readFileSync as readFileSync36 } from "fs";
+import { join as join49 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -11393,18 +11862,18 @@ var PROJECT = "<project>";
 var ENV = "<env>";
 var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
-function read(repoRoot, relative9) {
+function read(repoRoot, relative10) {
   try {
-    return readFileSync34(join46(repoRoot, relative9), "utf8");
+    return readFileSync36(join49(repoRoot, relative10), "utf8");
   } catch {
-    throw new Error(`plugin-allowlist drift guard: cannot read ${relative9}`);
+    throw new Error(`plugin-allowlist drift guard: cannot read ${relative10}`);
   }
 }
 function assignedString(source, name) {
   const match = new RegExp(`^\\s*${name}\\s*=\\s*"((?:[^"\\\\]|\\\\.)*)"\\s*$`, "m").exec(source);
   return match?.[1];
 }
-function resolve18(expression, bindings) {
+function resolve19(expression, bindings) {
   let current = expression;
   for (let pass = 0; pass < 10; pass += 1) {
     const next = current.replace(/\$\{([^}]+)\}/g, (whole, ref) => {
@@ -11441,13 +11910,13 @@ function composeExpectedRoleName(repoRoot) {
     "var.project_name": PROJECT,
     "var.environment": ENV,
     "var.plugin_name": PLUGIN,
-    "var.function_name": resolve18(pluginFunctionName, {
+    "var.function_name": resolve19(pluginFunctionName, {
       "var.plugin_name": PLUGIN
     })
   };
-  bindings["local.name_prefix"] = resolve18(namePrefix, bindings);
-  bindings["local.function_name"] = resolve18(functionName, bindings);
-  return resolve18(roleName, bindings);
+  bindings["local.name_prefix"] = resolve19(namePrefix, bindings);
+  bindings["local.function_name"] = resolve19(functionName, bindings);
+  return resolve19(roleName, bindings);
 }
 function readAllowlistGlob(repoRoot) {
   const allowlist = read(repoRoot, ALLOWLIST_MAIN_TF);
@@ -11457,7 +11926,7 @@ function readAllowlistGlob(repoRoot) {
       `plugin-allowlist drift guard: could not find the "for name in var.enabled_plugins" glob in ${ALLOWLIST_MAIN_TF}.`
     );
   }
-  return resolve18(glob, {
+  return resolve19(glob, {
     "data.aws_caller_identity.current.account_id": ACCOUNT,
     "var.project_name": PROJECT,
     "var.environment": ENV,
@@ -11491,7 +11960,7 @@ Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob,
 
 // src/scripts/check-plugin-allowlist-convention.ts
 async function runPluginAllowlistConventionCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let violations;
   try {
     violations = checkAllowlistConvention(root);
@@ -11516,34 +11985,34 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync39 } from "fs";
-import { join as join48 } from "path";
-import { execa as execa16 } from "execa";
+import { existsSync as existsSync42 } from "fs";
+import { join as join51 } from "path";
+import { execa as execa17 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync38, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync41, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { join as join50 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync38(dir)) return [];
-  return readdirSync20(dir).filter((entry) => {
+  if (!existsSync41(dir)) return [];
+  return readdirSync22(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync12(join47(dir, entry)).isDirectory();
+      return statSync13(join50(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync38(join47(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync41(join50(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join47(pluginDir2, "tests");
-  if (!existsSync38(testsDir)) return [];
-  if (existsSync38(join47(testsDir, "__init__.py"))) return [];
-  return readdirSync20(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
+  const testsDir = join50(pluginDir2, "tests");
+  if (!existsSync41(testsDir)) return [];
+  if (existsSync41(join50(testsDir, "__init__.py"))) return [];
+  return readdirSync22(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
   const plugins = (pluginDirs ?? subdirectories(servicesDir)).filter((name) => !name.startsWith("_")).filter((name) => name !== "api").sort();
@@ -11551,7 +12020,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join47(servicesDir, plugin))) {
+      for (const name of namesOf(join50(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -11588,9 +12057,9 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join48(root, "services");
-  if (!existsSync39(servicesDir)) {
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join51(root, "services");
+  if (!existsSync42(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -11607,11 +12076,11 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa17 } from "execa";
+import { execa as execa18 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync40, readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
-import { dirname as dirname10, join as join49, relative as relative8, sep as sep3 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync37, readdirSync as readdirSync23 } from "fs";
+import { dirname as dirname10, join as join52, relative as relative9, sep as sep3 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -11619,16 +12088,16 @@ function findPluginManifests(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync21(dir, { withFileTypes: true });
+      entries = readdirSync23(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join49(dir, entry.name));
+        walk2(join52(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative8(root, join49(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative9(root, join52(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -11638,7 +12107,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync35(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync37(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -11653,15 +12122,15 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync40(join49(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync43(join52(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join49(root, manifest);
+    const absManifest = join52(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync40(join49(pluginDir2, "terraform"))) continue;
-    const relPluginDir = relative8(root, pluginDir2).split(sep3).join("/");
+    if (existsSync43(join52(pluginDir2, "terraform"))) continue;
+    const relPluginDir = relative9(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
       expectedTerraformDir: relPluginDir ? `${relPluginDir}/terraform` : "terraform",
@@ -11680,7 +12149,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -11691,13 +12160,13 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync42 } from "fs";
-import { join as join51 } from "path";
-import { execa as execa18 } from "execa";
+import { existsSync as existsSync45 } from "fs";
+import { join as join54 } from "path";
+import { execa as execa19 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync41, readFileSync as readFileSync36, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync38, readdirSync as readdirSync24, statSync as statSync14 } from "fs";
+import { join as join53 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -12108,13 +12577,13 @@ var OPENROUTER_MODEL_IDS = [
 function listDirs(root) {
   let entries;
   try {
-    entries = readdirSync22(root);
+    entries = readdirSync24(root);
   } catch {
     return [];
   }
   return entries.filter((e) => {
     try {
-      return statSync13(join50(root, e)).isDirectory();
+      return statSync14(join53(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -12125,15 +12594,15 @@ function walkFiles2(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync22(dir);
+      entries = readdirSync24(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join50(dir, entry);
+      const p = join53(dir, entry);
       let st;
       try {
-        st = statSync13(p);
+        st = statSync14(p);
       } catch {
         continue;
       }
@@ -12156,14 +12625,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join50(pluginDir2, "terraform");
+  const tfDir = join53(pluginDir2, "terraform");
   let entries;
   try {
-    entries = readdirSync22(tfDir);
+    entries = readdirSync24(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join50(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join53(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -12415,8 +12884,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join50("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join50(
+var CONFIG_PY_PATH = join53("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join53(
   "services",
   "api",
   "src",
@@ -12428,10 +12897,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join50(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join50(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync41(configPath);
-  const orchestrationSchemaMissing = !existsSync41(orchestrationPath);
+  const configPath = join53(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join53(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync44(configPath);
+  const orchestrationSchemaMissing = !existsSync44(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -12449,13 +12918,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync36(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync38(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync36(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync38(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -12502,7 +12971,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync13(join50(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync14(join53(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -12515,8 +12984,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join50(pluginsRoot, name);
-    const manifestText = readFileSync36(join50(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join53(pluginsRoot, name);
+    const manifestText = readFileSync38(join53(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -12534,13 +13003,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync36(f, "utf8")
+      text: readFileSync38(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync36(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync38(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -12614,7 +13083,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join50(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join53(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -12645,10 +13114,10 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join51(root, "services", "_plugins");
-  if (!existsSync42(pluginsRoot)) {
+  const pluginsRoot = join54(root, "services", "_plugins");
+  if (!existsSync45(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -12678,8 +13147,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join51(root, "services", "api");
-  if (!existsSync42(servicesApiRoot)) {
+  const servicesApiRoot = join54(root, "services", "api");
+  if (!existsSync45(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -12725,7 +13194,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa19 } from "execa";
+import { execa as execa20 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -12762,7 +13231,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa19(
+  const { stdout } = await execa20(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -12798,7 +13267,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa19("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa20("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -12806,9 +13275,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa19("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa19("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa20("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa20("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -12856,13 +13325,13 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync43, readdirSync as readdirSync24 } from "fs";
-import { join as join53 } from "path";
-import { execa as execa20 } from "execa";
+import { existsSync as existsSync46, readdirSync as readdirSync26 } from "fs";
+import { join as join56 } from "path";
+import { execa as execa21 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync37, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join52 } from "path";
+import { readFileSync as readFileSync39, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { join as join55 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -12920,16 +13389,16 @@ function walk(dir, base = dir) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync23(dir);
+    entries = readdirSync25(dir);
   } catch {
     return out;
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join52(dir, entry);
+    const abs = join55(dir, entry);
     let isDir;
     try {
-      isDir = statSync14(abs).isDirectory();
+      isDir = statSync15(abs).isDirectory();
     } catch {
       continue;
     }
@@ -12948,7 +13417,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync37(join52(skeletonRoot, rel), "utf8");
+        contents = readFileSync39(join55(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -12977,23 +13446,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join53(root, "_skeletons");
+  const skeletonsDir = join56(root, "_skeletons");
   let entries;
   try {
-    entries = readdirSync24(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    entries = readdirSync26(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync43(join53(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync46(join56(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join53(root, "_skeletons", name);
+    const skeletonRoot = join56(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync43(join53(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync46(join56(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -13007,7 +13476,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join53(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join56(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -13019,9 +13488,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa21 } from "execa";
+import { execa as execa22 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -13043,8 +13512,8 @@ async function runTerraformInputCheck() {
 }
 
 // src/commands/check.ts
-var checkCommand = new Command23("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention) run in CI and git hooks, plus out-of-band audits (branch protection)"
+var checkCommand = new Command24("check").description(
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -13129,16 +13598,26 @@ checkCommand.command("branch-protection").description(
 ).action(async (opts) => {
   await runBranchProtectionCheck(opts.repo, { fix: opts.fix });
 });
+checkCommand.command("plugin-staleness").description(
+  "Advisory: report how far each services/<name>/ vendored plugin has drifted from its source (#1547) \u2014 an instance can drift arbitrarily far behind a plugin repo while both sides' CI stays green, because neither has an opinion about the gap between them. Deliberately NEVER fails this check, unlike every other one in this group: an instance may legitimately pin a plugin version, and staleness moving is not a defect the way an ownership violation or a namespace collision is. Run `biffo plugin staleness` directly for the same measurement with a real 0/1/2 exit code, if you want to gate on it."
+).action(async () => {
+  const cwd = process.env["BIFFO_ORIGINAL_CWD"] || process.cwd();
+  const results = await checkPluginStaleness(cwd, {
+    registry: new RegistryAdapter(),
+    git: new GitAdapter()
+  });
+  console.log(formatStalenessReport(results));
+});
 function rawArgsAfter(subcommand) {
   const at = process.argv.indexOf(subcommand);
   return at === -1 ? [] : process.argv.slice(at + 1);
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync44, readFileSync as readFileSync38 } from "fs";
-import { join as join54, resolve as resolve19 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync40 } from "fs";
+import { join as join57, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/lib/doctor.ts
 function checkCheckoutCurrency(facts) {
@@ -13261,10 +13740,10 @@ function runDoctorChecks(facts) {
 
 // src/commands/doctor.ts
 var INTEGRATION_BRANCH = "dev";
-var doctorCommand = new Command24("doctor").description(
+var doctorCommand = new Command25("doctor").description(
   "Report repo-state conditions that make everything read from this checkout unreliable"
 ).option("--cwd <path>", "Repo root to inspect (defaults to the current directory)").option("--no-fetch", "Skip the fetch; report against refs as they already are locally").action(async (options) => {
-  const cwd = options.cwd ? resolve19(options.cwd) : process.cwd();
+  const cwd = options.cwd ? resolve20(options.cwd) : process.cwd();
   try {
     const findings = await runDoctor({ cwd, fetch: options.fetch !== false });
     printFindings(findings);
@@ -13315,10 +13794,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join54(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync44(path)) return null;
+  const path = join57(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync47(path)) return null;
   try {
-    return extractVersionField(readFileSync38(path, "utf8"));
+    return extractVersionField(readFileSync40(path, "utf8"));
   } catch {
     return null;
   }
@@ -13338,10 +13817,10 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join54(cwd, CORE_VERSION_FILE);
-  if (!existsSync44(path)) return null;
+  const path = join57(cwd, CORE_VERSION_FILE);
+  if (!existsSync47(path)) return null;
   try {
-    const value = readFileSync38(path, "utf8").trim();
+    const value = readFileSync40(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -13374,9 +13853,9 @@ function printFindings(findings) {
 import { execSync as execSync7 } from "child_process";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STSClient3 } from "@aws-sdk/client-sts";
 import chalk22 from "chalk";
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 import inquirer8 from "inquirer";
-var teardownCommand = new Command25("teardown").description(
+var teardownCommand = new Command26("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
   "--confirm <name>",
@@ -13787,16 +14266,16 @@ function resolveGithubToken4() {
 import { spawnSync } from "child_process";
 import { dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
-import { Command as Command26 } from "commander";
+import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync45 } from "fs";
-import { dirname as dirname11, join as join55 } from "path";
+import { existsSync as existsSync48 } from "fs";
+import { dirname as dirname11, join as join58 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join55(dir, relativePath);
-    if (existsSync45(candidate)) return candidate;
+    const candidate = join58(dir, relativePath);
+    if (existsSync48(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -13816,7 +14295,7 @@ function runPackagedScript(script, args, cwd) {
   return result.status === null ? 2 : result.status;
 }
 function packagedScriptCommand(spec) {
-  const command = new Command26(spec.name).description(spec.description).allowExcessArguments(true).allowUnknownOption(true);
+  const command = new Command27(spec.name).description(spec.description).allowExcessArguments(true).allowUnknownOption(true);
   if (spec.argument) command.argument(`<${spec.argument.name}>`, spec.argument.description);
   return command.action(() => {
     const here = dirname12(fileURLToPath6(import.meta.url));
@@ -13905,7 +14384,7 @@ var runnerDropForensicsCommand = packagedScriptCommand({
 });
 
 // src/index.ts
-var program = new Command27();
+var program = new Command28();
 function cliVersion() {
   try {
     return getLatestCoreVersion();