@biffo/cli 0.281.0 → 0.283.0

package/dist/index.js

@@ -7744,6 +7744,10 @@ var UserIngressSchema = z7.object({
   required_group: z7.string().min(1, NON_EMPTY_GROUP),
   app: z7.string().regex(APP_REF, "must be an ASGI app reference '<module>:<attr>', e.g. 'ideation.app:app'")
 }).strict();
+var AdminIngressSchema = z7.object({
+  required_group: z7.string().min(1, NON_EMPTY_GROUP),
+  app: z7.string().regex(APP_REF, "must be an ASGI app reference '<module>:<attr>', e.g. 'ideation.admin:app'")
+}).strict();
 var UserFrontendSchema = z7.object({
   dir: z7.string().regex(
     REL_DIR,
@@ -7756,6 +7760,13 @@ var ToolDeclarationSchema = z7.object({
   description: z7.string(),
   parameters: z7.record(z7.string(), z7.unknown()).default({})
 });
+var SeedDeclarationSchema = z7.object({
+  dir: z7.string().regex(
+    REL_DIR,
+    "must be a plugin-relative path with no leading slash or traversal, e.g. db/seed"
+  ),
+  baseline_tables: z7.array(z7.string()).default([])
+}).strict();
 var ChatAgentDeclarationSchema = z7.object({
   key: z7.string().regex(/^[a-z][a-z0-9-]*$/, "must be a lowercase kebab-case slug"),
   agent_name: z7.string().optional(),
@@ -7781,9 +7792,10 @@ var PluginManifestSchema = z7.object({
   // schema is the registry's, and this consumer only needs to count them.
   event_subscriptions: z7.array(z7.object({ source: z7.string(), detail_type: z7.string() }).passthrough()).default([]),
   required_core_version: z7.string().default(">=0.0.0"),
-  // ADR-0018 user-facing surfaces. Optional: a plugin without them is an
-  // ordinary (data/event/CRUD) plugin.
+  // ADR-0018/0021 user-facing and admin-facing surfaces. Optional: a plugin
+  // without them is an ordinary (data/event/CRUD) plugin.
   user_ingress: UserIngressSchema.optional(),
+  admin_ingress: AdminIngressSchema.optional(),
   user_frontend: UserFrontendSchema.optional(),
   // Tools the plugin's runtime exposes to an agentic worker (ADR-0014 §7,
   // #569). Default empty — an ordinary plugin declares none. Parsing this
@@ -7794,7 +7806,11 @@ var PluginManifestSchema = z7.object({
   tools: z7.array(ToolDeclarationSchema).default([]),
   // Chat agents the plugin registers with Core (ADR-0017). Default empty — an
   // ordinary plugin declares none.
-  chat_agents: z7.array(ChatAgentDeclarationSchema).default([])
+  chat_agents: z7.array(ChatAgentDeclarationSchema).default([]),
+  // The plugin's tenant-scoped baseline-row seed (ADR-0005, biffo-template#1554).
+  // Optional — a plugin with no baseline data omits this entirely, and
+  // `biffo plugin install`/`upgrade` vendor nothing for it.
+  seed: SeedDeclarationSchema.optional()
 }).superRefine((manifest, ctx) => {
   const tableNames = new Set(manifest.tables.map((t) => t.name));
   for (const route of manifest.api_routes) {
@@ -7805,6 +7821,16 @@ var PluginManifestSchema = z7.object({
       });
     }
   }
+  if (manifest.seed) {
+    for (const table of manifest.seed.baseline_tables) {
+      if (!tableNames.has(table)) {
+        ctx.addIssue({
+          code: z7.ZodIssueCode.custom,
+          message: `seed.baseline_tables references table '${table}', which is not declared in this manifest's 'tables' (${[...tableNames].sort().join(", ") || "none"})`
+        });
+      }
+    }
+  }
 });
 function validateManifest(raw) {
   const result = PluginManifestSchema.safeParse(raw);
@@ -8319,6 +8345,14 @@ var RegistryPluginEntrySchema = z8.object({
   description: z8.string().optional(),
   author: z8.string().optional(),
   tags: z8.array(z8.string()).optional(),
+  // Summary-form mirror of the manifest's `seed.baseline_tables` (see
+  // ../../lib/plugin-manifest.ts's SeedDeclarationSchema and
+  // _skeletons/registry/registry-schema.json's `seed`, biffo-template#1554).
+  // The registry entry only ever needs to know WHICH tables a plugin promises
+  // baseline rows for, never the seed `dir` itself — that only matters to the
+  // install/upgrade vendoring step, which reads it from the plugin's own
+  // biffo.plugin.json after cloning, not from this summary.
+  baseline_tables: z8.array(z8.string()).optional(),
   required_core_version: z8.string().optional(),
   infra_modules: z8.array(z8.string()).optional(),
   api_routes: z8.array(z8.string()).optional(),
@@ -8445,8 +8479,8 @@ function printEntry(entry) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync4, existsSync as existsSync29, mkdirSync as mkdirSync10, readFileSync as readFileSync22, statSync as statSync6 } from "fs";
-import { join as join31, relative as relative3, resolve as resolve12 } from "path";
+import { cpSync as cpSync5, existsSync as existsSync30, mkdirSync as mkdirSync11, readFileSync as readFileSync22, statSync as statSync6 } from "fs";
+import { join as join32, relative as relative3, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
@@ -8572,9 +8606,48 @@ async function tryGit(cwd, args) {
   }
 }
 
+// src/lib/plugin-seed-vendor.ts
+import { cpSync as cpSync3, existsSync as existsSync28, mkdirSync as mkdirSync9, readdirSync as readdirSync12, rmSync as rmSync8 } from "fs";
+import { join as join29 } from "path";
+var VENDOR_PREFIX = "_plugin-";
+function pluginSeedImportDir(pluginName) {
+  return `db/imports/${VENDOR_PREFIX}${pluginName}`;
+}
+function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
+  if (!manifest.seed) {
+    return { vendored: false };
+  }
+  const sourceSeedDir = join29(pluginSourceDir, manifest.seed.dir);
+  if (!existsSync28(sourceSeedDir)) {
+    throw new Error(
+      `${manifest.name}'s manifest declares seed.dir '${manifest.seed.dir}', but ${sourceSeedDir} does not exist in the plugin's source.`
+    );
+  }
+  const sqlFiles = readdirSync12(sourceSeedDir).filter((f) => f.endsWith(".sql"));
+  if (sqlFiles.length === 0) {
+    throw new Error(
+      `${manifest.name}'s manifest declares seed.dir '${manifest.seed.dir}', but ${sourceSeedDir} contains no *.sql files.`
+    );
+  }
+  const relTargetDir = pluginSeedImportDir(manifest.name);
+  const targetDir = join29(cwd, relTargetDir);
+  rmSync8(targetDir, { recursive: true, force: true });
+  mkdirSync9(targetDir, { recursive: true });
+  for (const file of sqlFiles) {
+    cpSync3(join29(sourceSeedDir, file), join29(targetDir, file));
+  }
+  log.success(
+    `Vendored ${sqlFiles.length} seed file(s) to ${relTargetDir}/ (baseline_tables: ${manifest.seed.baseline_tables.join(", ") || "none declared"})`
+  );
+  log.info(
+    `${relTargetDir}/*.sql are checksum-tracked once applied (ADR-0005 section 4) \u2014 a later version must ship a new, additively-numbered file for a changed seed, never edit one already released, or the next deploy fails loudly.`
+  );
+  return { vendored: true, stagedPath: relTargetDir };
+}
+
 // src/lib/plugin-source-copy.ts
-import { copyFileSync as copyFileSync2, cpSync as cpSync3, mkdirSync as mkdirSync9 } from "fs";
-import { basename, dirname as dirname9, join as join29 } from "path";
+import { copyFileSync as copyFileSync2, cpSync as cpSync4, mkdirSync as mkdirSync10 } from "fs";
+import { basename, dirname as dirname9, join as join30 } from "path";
 import { execa as execa6 } from "execa";
 var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".git",
@@ -8591,17 +8664,17 @@ async function copyPluginSource(sourceDir, targetDir) {
   if (await isGitWorkingTree2(sourceDir)) {
     const files = await listGitFiles(sourceDir);
     for (const relPath of files) {
-      const destPath = join29(targetDir, relPath);
-      mkdirSync9(dirname9(destPath), { recursive: true });
-      copyFileSync2(join29(sourceDir, relPath), destPath);
+      const destPath = join30(targetDir, relPath);
+      mkdirSync10(dirname9(destPath), { recursive: true });
+      copyFileSync2(join30(sourceDir, relPath), destPath);
     }
     return { usedGitIgnoreRules: true };
   }
   log.warn(
     `${sourceDir} is not a git working tree \u2014 cannot honour .gitignore. Falling back to a fixed exclude list (.git, .venv, node_modules, caches); anything else it does not know about (e.g. an unfamiliar cache directory) will be copied.`
   );
-  mkdirSync9(targetDir, { recursive: true });
-  cpSync3(sourceDir, targetDir, {
+  mkdirSync10(targetDir, { recursive: true });
+  cpSync4(sourceDir, targetDir, {
     recursive: true,
     filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename(src))
   });
@@ -8625,8 +8698,8 @@ async function listGitFiles(dir) {
 }
 
 // src/lib/plugin-workspace-sources.ts
-import { existsSync as existsSync28, readdirSync as readdirSync12, readFileSync as readFileSync21, writeFileSync as writeFileSync11 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync29, readdirSync as readdirSync13, readFileSync as readFileSync21, writeFileSync as writeFileSync11 } from "fs";
+import { join as join31 } from "path";
 function readTomlStringArray(text, key) {
   const open = new RegExp(`^${key}\\s*=\\s*\\[`, "m").exec(text);
   if (!open) return [];
@@ -8670,8 +8743,8 @@ function readDependencyNames(text) {
   return readTomlStringArray(text, "dependencies").map((dep) => /^\s*([A-Za-z0-9._-]+)/.exec(dep)?.[1] ?? "").filter(Boolean);
 }
 function workspaceMemberNames(instanceRoot) {
-  const rootPyproject = join30(instanceRoot, "pyproject.toml");
-  if (!existsSync28(rootPyproject)) return /* @__PURE__ */ new Set();
+  const rootPyproject = join31(instanceRoot, "pyproject.toml");
+  if (!existsSync29(rootPyproject)) return /* @__PURE__ */ new Set();
   const text = readFileSync21(rootPyproject, "utf8");
   const members = readTomlStringArray(text, "members");
   const excluded = new Set(readTomlStringArray(text, "exclude"));
@@ -8681,7 +8754,7 @@ function workspaceMemberNames(instanceRoot) {
       const base = member.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync12(join30(instanceRoot, base), { withFileTypes: true });
+        entries = readdirSync13(join31(instanceRoot, base), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -8695,8 +8768,8 @@ function workspaceMemberNames(instanceRoot) {
   }
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    const pp = join30(instanceRoot, dir, "pyproject.toml");
-    if (!existsSync28(pp)) continue;
+    const pp = join31(instanceRoot, dir, "pyproject.toml");
+    if (!existsSync29(pp)) continue;
     const name = readProjectName(readFileSync21(pp, "utf8"));
     if (name) names.add(name);
   }
@@ -8708,7 +8781,7 @@ function existingWorkspaceSources(text) {
   );
 }
 function ensureWorkspaceSources(pluginPyprojectPath, memberNames) {
-  if (!existsSync28(pluginPyprojectPath) || memberNames.size === 0) return [];
+  if (!existsSync29(pluginPyprojectPath) || memberNames.size === 0) return [];
   const text = readFileSync21(pluginPyprojectPath, "utf8");
   const already = existingWorkspaceSources(text);
   const toAdd = readDependencyNames(text).filter((n) => memberNames.has(n) && !already.has(n));
@@ -8733,8 +8806,8 @@ ${lines.join("\n")}
   return toAdd;
 }
 function applyWorkspaceSources(targetDir, cwd, relTargetDir) {
-  const pluginPyproject = join30(targetDir, "pyproject.toml");
-  if (!existsSync28(pluginPyproject)) return;
+  const pluginPyproject = join31(targetDir, "pyproject.toml");
+  if (!existsSync29(pluginPyproject)) return;
   const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(cwd));
   if (sourced.length > 0) {
     log.info(
@@ -8774,14 +8847,14 @@ var pluginInstallCommand = new Command15("install").description(
   }
 );
 function resolveLocalPlugin(localPath) {
-  if (!existsSync29(localPath)) {
+  if (!existsSync30(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync6(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join31(localPath, "biffo.plugin.json");
-  if (!existsSync29(manifestPath)) {
+  const manifestPath = join32(localPath, "biffo.plugin.json");
+  if (!existsSync30(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -8807,8 +8880,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join31(tmpDir, "biffo.plugin.json");
-    if (!existsSync29(manifestPath)) {
+    const manifestPath = join32(tmpDir, "biffo.plugin.json");
+    if (!existsSync30(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -8836,8 +8909,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join31(options.cwd, "services");
-  if (!existsSync29(servicesDir)) {
+  const servicesDir = join32(options.cwd, "services");
+  if (!existsSync30(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -8855,10 +8928,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join31(options.cwd, relTargetDir);
-  const modulesDir = join31(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join32(options.cwd, relTargetDir);
+  const modulesDir = join32(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync29(targetDir) && !inTreeSource) {
+  if (existsSync30(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -8893,7 +8966,7 @@ async function runPluginInstall(target, options, deps) {
     if (inTreeSource) {
       log.info(`${relTargetDir}/ is already in this checkout \u2014 installing in place.`);
     } else {
-      mkdirSync10(targetDir, { recursive: true });
+      mkdirSync11(targetDir, { recursive: true });
       await copyPluginSource(source.sourceDir, targetDir);
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
@@ -8902,10 +8975,10 @@ async function runPluginInstall(target, options, deps) {
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, relTargetDir);
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join31(targetDir, "terraform");
-    if (existsSync29(tfSourceDir)) {
-      mkdirSync10(modulesDir, { recursive: true });
-      cpSync4(tfSourceDir, modulesDir, { recursive: true });
+    const tfSourceDir = join32(targetDir, "terraform");
+    if (existsSync30(tfSourceDir)) {
+      mkdirSync11(modulesDir, { recursive: true });
+      cpSync5(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
       log.success(`Copied Terraform module to modules/plugins/${pluginName}/`);
       const wiring = syncPluginTerraform(options.cwd);
@@ -8944,6 +9017,10 @@ async function runPluginInstall(target, options, deps) {
     } else {
       log.info(`${pluginName} declares no tables \u2014 nothing to migrate.`);
     }
+    const seedResult = vendorPluginSeed(targetDir, manifest, options.cwd);
+    if (seedResult.vendored) {
+      stagePaths.push(seedResult.stagedPath);
+    }
     const commitMessage = `feat(plugins): install ${pluginName}@${source.version}`;
     await deps.git.add(options.cwd, stagePaths);
     await deps.git.commit(options.cwd, commitMessage);
@@ -8992,13 +9069,18 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource) {
       `  Would generate a migration for ${source.manifest.tables.length} table(s) into services/api/migrations/versions/`
     );
   }
+  if (source && source.manifest.seed) {
+    console.log(
+      `  Would vendor seed DDL into: ${pluginSeedImportDir(name)}/ (baseline_tables: ${source.manifest.seed.baseline_tables.join(", ") || "none declared"})`
+    );
+  }
   console.log(`  Would commit:  feat(plugins): install ${name}@${version}
 `);
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync30, readFileSync as readFileSync23 } from "fs";
-import { join as join32, resolve as resolve13 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync23 } from "fs";
+import { join as join33, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -9011,8 +9093,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join32(options.cwd, "services");
-  if (!existsSync30(servicesDir)) {
+  const servicesDir = join33(options.cwd, "services");
+  if (!existsSync31(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -9061,14 +9143,14 @@ import { resolve as resolve14 } from "path";
 import { Command as Command17 } from "commander";
 
 // src/lib/plugin-staleness.ts
-import { existsSync as existsSync31, readFileSync as readFileSync24, readdirSync as readdirSync13, statSync as statSync7 } from "fs";
-import { join as join33, relative as relative4 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync24, readdirSync as readdirSync14, statSync as statSync7 } from "fs";
+import { join as join34, relative as relative4 } from "path";
 function discoverVendoredPlugins(servicesDir) {
-  if (!existsSync31(servicesDir)) return [];
-  return readdirSync13(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync31(join33(servicesDir, name, "biffo.plugin.json"))).sort();
+  if (!existsSync32(servicesDir)) return [];
+  return readdirSync14(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync32(join34(servicesDir, name, "biffo.plugin.json"))).sort();
 }
 async function checkPluginStaleness(cwd, deps) {
-  const servicesDir = join33(cwd, "services");
+  const servicesDir = join34(cwd, "services");
   const names = discoverVendoredPlugins(servicesDir);
   let registryRepoByName = null;
   const resolveRegistryRepo = async (name) => {
@@ -9084,7 +9166,7 @@ async function checkPluginStaleness(cwd, deps) {
   };
   const results = [];
   for (const name of names) {
-    results.push(await checkOnePlugin(join33(servicesDir, name), name, resolveRegistryRepo, deps.git));
+    results.push(await checkOnePlugin(join34(servicesDir, name), name, resolveRegistryRepo, deps.git));
   }
   return results;
 }
@@ -9110,7 +9192,7 @@ async function checkOnePlugin(pluginDir2, name, resolveRegistryRepo, git) {
   if (record?.sha && isFetchableUrl(record.origin)) {
     return checkViaProvenance(name, record, record.origin, git);
   }
-  const localOrigin = record && !isFetchableUrl(record.origin) && existsSync31(record.origin) ? record.origin : null;
+  const localOrigin = record && !isFetchableUrl(record.origin) && existsSync32(record.origin) ? record.origin : null;
   if (localOrigin) {
     return checkViaContentDiff(name, pluginDir2, localOrigin, { isLocalDir: true }, git);
   }
@@ -9244,8 +9326,8 @@ async function countDifferingFiles(sourceDir, pluginDir2) {
       differing++;
       continue;
     }
-    const a = readFileSync24(join33(sourceDir, relPath));
-    const b = readFileSync24(join33(pluginDir2, relPath));
+    const a = readFileSync24(join34(sourceDir, relPath));
+    const b = readFileSync24(join34(pluginDir2, relPath));
     if (!a.equals(b)) differing++;
   }
   return differing;
@@ -9260,11 +9342,11 @@ function vendorFileList(dir) {
   return new Set(walkExcluding(dir, dir, LOCAL_COPY_EXCLUDES));
 }
 function walkExcluding(root, dir, excludes) {
-  if (!existsSync31(dir)) return [];
+  if (!existsSync32(dir)) return [];
   const out = [];
-  for (const entry of readdirSync13(dir)) {
+  for (const entry of readdirSync14(dir)) {
     if (excludes.has(entry) || entry === ".git") continue;
-    const full = join33(dir, entry);
+    const full = join34(dir, entry);
     const stat = statSync7(full);
     if (stat.isDirectory()) {
       out.push(...walkExcluding(root, full, excludes));
@@ -9316,8 +9398,8 @@ var pluginStalenessCommand = new Command17("staleness").description(
 });
 
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync32 } from "fs";
-import { join as join34, relative as relative5, resolve as resolve15 } from "path";
+import { existsSync as existsSync33 } from "fs";
+import { join as join35, relative as relative5, resolve as resolve15 } from "path";
 import chalk17 from "chalk";
 import { Command as Command18 } from "commander";
 var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
@@ -9338,11 +9420,11 @@ var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join34(options.cwd, "services");
-  if (!existsSync32(servicesDir)) {
+  const servicesDir = join35(options.cwd, "services");
+  if (!existsSync33(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync32(join34(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync33(join35(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -9378,8 +9460,8 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync33, readFileSync as readFileSync25, rmSync as rmSync8 } from "fs";
-import { join as join35, resolve as resolve16 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync25, rmSync as rmSync9 } from "fs";
+import { join as join36, resolve as resolve16 } from "path";
 import chalk18 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer6 from "inquirer";
@@ -9411,16 +9493,16 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join35(options.cwd, "services");
-  if (!existsSync33(servicesDir)) {
+  const servicesDir = join36(options.cwd, "services");
+  if (!existsSync34(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join35(servicesDir, name);
-  if (!existsSync33(targetDir)) {
-    const firstParty = join35(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync33(firstParty)) {
+  const targetDir = join36(servicesDir, name);
+  if (!existsSync34(targetDir)) {
+    const firstParty = join36(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync34(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
@@ -9428,9 +9510,9 @@ async function runPluginUninstall(name, options, deps) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   const version = readInstalledVersion(targetDir);
-  const modulesDir = join35(options.cwd, "modules", "plugins", name);
+  const modulesDir = join36(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync33(modulesDir)) {
+  if (existsSync34(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
   if (options.dryRun) {
@@ -9450,10 +9532,10 @@ async function runPluginUninstall(name, options, deps) {
       `${options.cwd} is not a git repository \u2014 biffo plugin uninstall must be run from a Biffo project checkout.`
     );
   }
-  rmSync8(targetDir, { recursive: true, force: true });
+  rmSync9(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync33(modulesDir)) {
-    rmSync8(modulesDir, { recursive: true, force: true });
+  if (existsSync34(modulesDir)) {
+    rmSync9(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
     stagePaths.push(...wiring.changedPaths);
@@ -9487,10 +9569,15 @@ async function runPluginUninstall(name, options, deps) {
       "Any tables this plugin created remain in the database, and its migration file at services/api/migrations/versions/ is NOT removed (it is a permanent historical record \u2014 see notes). Dropping tables, if desired, requires a manual Alembic migration written against the Core API."
     );
   }
+  if (existsSync34(join36(options.cwd, pluginSeedImportDir(name)))) {
+    log.warn(
+      `${pluginSeedImportDir(name)}/ (this plugin's vendored baseline-row seed, biffo-template#1554) was NOT removed either, for the same reason \u2014 see notes. Delete it by hand if you are certain the rows it applied should go too, but note nothing drops rows already applied to the database; that still needs a manual migration.`
+    );
+  }
 }
 function readInstalledVersion(targetDir) {
-  const manifestPath = join35(targetDir, "biffo.plugin.json");
-  if (!existsSync33(manifestPath)) return void 0;
+  const manifestPath = join36(targetDir, "biffo.plugin.json");
+  if (!existsSync34(manifestPath)) return void 0;
   try {
     return validateManifest(JSON.parse(readFileSync25(manifestPath, "utf8"))).version;
   } catch {
@@ -9525,8 +9612,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync5, existsSync as existsSync34, mkdirSync as mkdirSync11, readFileSync as readFileSync26, rmSync as rmSync9 } from "fs";
-import { join as join36, relative as relative6, resolve as resolve17 } from "path";
+import { cpSync as cpSync6, existsSync as existsSync35, mkdirSync as mkdirSync12, readFileSync as readFileSync26, rmSync as rmSync10 } from "fs";
+import { join as join37, relative as relative6, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
 import { Command as Command20 } from "commander";
 import inquirer7 from "inquirer";
@@ -9573,8 +9660,8 @@ async function runPluginUpgrade(target, options, deps) {
       `Nothing to upgrade. Pass a registry target (e.g. \`biffo plugin upgrade acme-crm@1.1\`) or a local checkout to refresh from (\`biffo plugin upgrade --local ../acme-crm\`).`
     );
   }
-  const servicesDir = join36(options.cwd, "services");
-  if (!existsSync34(servicesDir)) {
+  const servicesDir = join37(options.cwd, "services");
+  if (!existsSync35(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -9583,8 +9670,8 @@ async function runPluginUpgrade(target, options, deps) {
     return runLocalPluginRefresh(options.local, options, deps);
   }
   const { name, minor } = parsePluginTarget(target);
-  const targetDir = join36(servicesDir, name);
-  if (!existsSync34(targetDir)) {
+  const targetDir = join37(servicesDir, name);
+  if (!existsSync35(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
@@ -9598,7 +9685,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join36(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join37(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -9627,9 +9714,9 @@ async function runPluginUpgrade(target, options, deps) {
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
     const previousProvenance = readProvenance(targetDir);
-    rmSync9(targetDir, { recursive: true, force: true });
-    mkdirSync11(targetDir, { recursive: true });
-    cpSync5(tmpDir, targetDir, { recursive: true });
+    rmSync10(targetDir, { recursive: true, force: true });
+    mkdirSync12(targetDir, { recursive: true });
+    cpSync6(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
     const nextProvenance = resolveRegistryProvenance(
       entry.repo,
@@ -9638,13 +9725,13 @@ async function runPluginUpgrade(target, options, deps) {
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync34(modulesDir)) {
-      rmSync9(modulesDir, { recursive: true, force: true });
+    if (existsSync35(modulesDir)) {
+      rmSync10(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join36(targetDir, "terraform");
-    if (existsSync34(tfSourceDir)) {
-      mkdirSync11(modulesDir, { recursive: true });
-      cpSync5(tfSourceDir, modulesDir, { recursive: true });
+    const tfSourceDir = join37(targetDir, "terraform");
+    if (existsSync35(tfSourceDir)) {
+      mkdirSync12(modulesDir, { recursive: true });
+      cpSync6(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
       log.success(`Copied Terraform module to modules/plugins/${entry.name}/`);
     }
@@ -9664,6 +9751,10 @@ async function runPluginUpgrade(target, options, deps) {
         );
       }
     }
+    const seedResult = vendorPluginSeed(targetDir, manifest, options.cwd);
+    if (seedResult.vendored) {
+      stagePaths.push(seedResult.stagedPath);
+    }
     const label = currentVersion ? `${entry.name} ${currentVersion} -> ${entry.version}` : `${entry.name} to ${entry.version}`;
     const commitMessage = `feat(plugins): upgrade ${label}`;
     await deps.git.add(options.cwd, stagePaths);
@@ -9682,16 +9773,16 @@ async function runPluginUpgrade(target, options, deps) {
 async function runLocalPluginRefresh(localPath, options, deps) {
   const source = resolveLocalPlugin(localPath);
   log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
-  const servicesDir = join36(options.cwd, "services");
-  const targetDir = join36(servicesDir, source.name);
-  if (!existsSync34(targetDir)) {
+  const servicesDir = join37(options.cwd, "services");
+  const targetDir = join37(servicesDir, source.name);
+  if (!existsSync35(targetDir)) {
     throw new Error(
       `Plugin '${source.name}' is not installed at services/${source.name}/. Use 'biffo plugin install --local ${localPath}' instead.`
     );
   }
   const inTreeSource = resolve17(source.sourceDir) === resolve17(targetDir);
   const currentVersion = readInstalledVersion2(targetDir);
-  const modulesDir = join36(options.cwd, "modules", "plugins", source.name);
+  const modulesDir = join37(options.cwd, "modules", "plugins", source.name);
   if (options.dryRun) {
     printLocalDryRun(source, currentVersion, inTreeSource);
     return;
@@ -9720,8 +9811,8 @@ async function runLocalPluginRefresh(localPath, options, deps) {
         `services/${source.name}/ is already the local checkout \u2014 nothing to copy; re-syncing its Terraform module and checking for a migration.`
       );
     } else {
-      rmSync9(targetDir, { recursive: true, force: true });
-      mkdirSync11(targetDir, { recursive: true });
+      rmSync10(targetDir, { recursive: true, force: true });
+      mkdirSync12(targetDir, { recursive: true });
       await copyPluginSource(source.sourceDir, targetDir);
       log.success(`Refreshed plugin source at services/${source.name}/ from ${source.origin}`);
     }
@@ -9729,13 +9820,13 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
     const stagePaths = [`services/${source.name}`];
-    if (existsSync34(modulesDir)) {
-      rmSync9(modulesDir, { recursive: true, force: true });
+    if (existsSync35(modulesDir)) {
+      rmSync10(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join36(targetDir, "terraform");
-    if (existsSync34(tfSourceDir)) {
-      mkdirSync11(modulesDir, { recursive: true });
-      cpSync5(tfSourceDir, modulesDir, { recursive: true });
+    const tfSourceDir = join37(targetDir, "terraform");
+    if (existsSync35(tfSourceDir)) {
+      mkdirSync12(modulesDir, { recursive: true });
+      cpSync6(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${source.name}`);
       log.success(`Refreshed Terraform module at modules/plugins/${source.name}/`);
     }
@@ -9757,6 +9848,10 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     } else {
       log.info(`${source.name} declares no tables \u2014 nothing to migrate.`);
     }
+    const seedResult = vendorPluginSeed(targetDir, manifest, options.cwd);
+    if (seedResult.vendored) {
+      stagePaths.push(seedResult.stagedPath);
+    }
     await deps.git.add(options.cwd, stagePaths);
     if (!await deps.git.hasUncommittedChanges(options.cwd)) {
       log.warn(`services/${source.name}/ already matches ${source.origin} \u2014 nothing to commit.`);
@@ -9776,8 +9871,8 @@ async function runLocalPluginRefresh(localPath, options, deps) {
   }
 }
 function readInstalledVersion2(targetDir) {
-  const manifestPath = join36(targetDir, "biffo.plugin.json");
-  if (!existsSync34(manifestPath)) return void 0;
+  const manifestPath = join37(targetDir, "biffo.plugin.json");
+  if (!existsSync35(manifestPath)) return void 0;
   try {
     return validateManifest(JSON.parse(readFileSync26(manifestPath, "utf8"))).version;
   } catch {
@@ -9814,6 +9909,11 @@ function printDryRun6(entry, currentVersion) {
       `  Would replace Terraform module at: modules/plugins/${entry.name}/ (if the repo has one)`
     );
   }
+  if (entry.baseline_tables && entry.baseline_tables.length > 0) {
+    console.log(
+      `  Would re-vendor seed DDL into: ${pluginSeedImportDir(entry.name)}/ (baseline_tables: ${entry.baseline_tables.join(", ")})`
+    );
+  }
   console.log(`  Would commit:  feat(plugins): upgrade ${entry.name} to ${entry.version}
 `);
 }
@@ -9833,6 +9933,11 @@ function printLocalDryRun(source, currentVersion, inTreeSource) {
       `  Would check for a migration for ${source.manifest.tables.length} table(s) (generated for a new table or an added column on an already-migrated table; a removed/retyped/nullability-changed column stops the refresh instead \u2014 #1539)`
     );
   }
+  if (source.manifest.seed) {
+    console.log(
+      `  Would re-vendor seed DDL into: ${pluginSeedImportDir(source.name)}/ (baseline_tables: ${source.manifest.seed.baseline_tables.join(", ") || "none declared"})`
+    );
+  }
   console.log(`  Would commit:  chore(plugins): refresh ${source.name} from local checkout
 `);
 }
@@ -9852,7 +9957,7 @@ pluginCommand.addCommand(pluginStalenessCommand);
 import { Command as Command23 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync35, readFileSync as readFileSync27 } from "fs";
+import { existsSync as existsSync36, readFileSync as readFileSync27 } from "fs";
 import { resolve as resolve18 } from "path";
 import chalk20 from "chalk";
 import { Command as Command22 } from "commander";
@@ -10066,7 +10171,7 @@ async function resolveConfig4(options) {
     return cfg;
   }
   const localConfigPath = resolve18(process.cwd(), "biffo.config.json");
-  if (existsSync35(localConfigPath)) {
+  if (existsSync36(localConfigPath)) {
     const raw = JSON.parse(readFileSync27(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
@@ -10113,19 +10218,19 @@ siblingCommand.addCommand(siblingCheckIdentityCommand);
 import { Command as Command24 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
-import { existsSync as existsSync37 } from "fs";
-import { join as join38 } from "path";
+import { existsSync as existsSync38 } from "fs";
+import { join as join39 } from "path";
 import { execa as execa7 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
-import { existsSync as existsSync36, readdirSync as readdirSync14, readFileSync as readFileSync28 } from "fs";
-import { join as join37 } from "path";
+import { existsSync as existsSync37, readdirSync as readdirSync15, readFileSync as readFileSync28 } from "fs";
+import { join as join38 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join37(adrDir, ALLOWLIST_FILENAME);
-  if (!existsSync36(path)) return /* @__PURE__ */ new Set();
+  const path = join38(adrDir, ALLOWLIST_FILENAME);
+  if (!existsSync37(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
   for (const rawLine of readFileSync28(path, "utf8").split("\n")) {
     const line = rawLine.split("#")[0].trim();
@@ -10135,8 +10240,8 @@ function readAdrNumberingAllowlist(adrDir) {
 }
 function adrNumbersIn(adrDir) {
   const claims = /* @__PURE__ */ new Map();
-  if (!existsSync36(adrDir)) return claims;
-  for (const entry of readdirSync14(adrDir).sort()) {
+  if (!existsSync37(adrDir)) return claims;
+  for (const entry of readdirSync15(adrDir).sort()) {
     const match = ADR_FILENAME.exec(entry);
     if (!match) continue;
     const number = match[1];
@@ -10190,8 +10295,8 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
   const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join38(root, "docs", "ADR");
-  if (!existsSync37(adrDir)) {
+  const adrDir = join39(root, "docs", "ADR");
+  if (!existsSync38(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
   }
@@ -10489,13 +10594,13 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 }
 
 // src/scripts/check-codeql-suppression.ts
-import { existsSync as existsSync38 } from "fs";
-import { join as join40, relative as relative7 } from "path";
+import { existsSync as existsSync39 } from "fs";
+import { join as join41, relative as relative7 } from "path";
 import { execa as execa9 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
-import { readdirSync as readdirSync15, readFileSync as readFileSync29, statSync as statSync8 } from "fs";
-import { join as join39 } from "path";
+import { readdirSync as readdirSync16, readFileSync as readFileSync29, statSync as statSync8 } from "fs";
+import { join as join40 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".worktrees",
@@ -10521,12 +10626,12 @@ function walkSourceFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync15(dir);
+      entries = readdirSync16(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join39(dir, entry);
+      const p = join40(dir, entry);
       let st;
       try {
         st = statSync8(p);
@@ -10563,8 +10668,8 @@ function sweepCodeqlSuppressionComments(root) {
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
   const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const scanRoot = join40(root, "cli", "src");
-  if (!existsSync38(scanRoot)) {
+  const scanRoot = join41(root, "cli", "src");
+  if (!existsSync39(scanRoot)) {
     console.log(
       "\u2014 codeql-suppression guard: skipped \u2014 no cli/src in this repo, so there is no CLI source to scan."
     );
@@ -10591,8 +10696,8 @@ async function runCodeqlSuppressionCheck() {
 import { execa as execa10 } from "execa";
 
 // src/lib/cognito-invite-template-guard.ts
-import { readdirSync as readdirSync16, readFileSync as readFileSync30, statSync as statSync9 } from "fs";
-import { join as join41 } from "path";
+import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync9 } from "fs";
+import { join as join42 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -10669,13 +10774,13 @@ function findModuleTerraformFiles(repoRoot) {
   const walk2 = (dir, relative10) => {
     let entries;
     try {
-      entries = readdirSync16(dir);
+      entries = readdirSync17(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join41(dir, entry);
+      const full = join42(dir, entry);
       const rel = `${relative10}/${entry}`;
       if (statSync9(full).isDirectory()) {
         walk2(full, rel);
@@ -10684,12 +10789,12 @@ function findModuleTerraformFiles(repoRoot) {
       }
     }
   };
-  walk2(join41(repoRoot, "modules"), "modules");
+  walk2(join42(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync30(join41(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync30(join42(repoRoot, file), "utf8"))
   );
 }
 
@@ -10717,12 +10822,12 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 import { execa as execa11 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync39, readFileSync as readFileSync31, readdirSync as readdirSync17, statSync as statSync10 } from "fs";
-import { join as join42 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync31, readdirSync as readdirSync18, statSync as statSync10 } from "fs";
+import { join as join43 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -10881,12 +10986,12 @@ function walkFiles(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync17(dir);
+      entries = readdirSync18(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join42(dir, entry);
+      const p = join43(dir, entry);
       let st;
       try {
         st = statSync10(p);
@@ -10981,7 +11086,7 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join42(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join43(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
     raw = readFileSync31(configPath, "utf8");
@@ -11004,8 +11109,8 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join42(estateDir, coreProject, "services", "api", "src");
-  if (!existsSync39(coreApiSrcDir)) {
+  const coreApiSrcDir = join43(estateDir, coreProject, "services", "api", "src");
+  if (!existsSync40(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
     );
@@ -11048,7 +11153,7 @@ function auditSiblingCoreDirectPaths(params) {
 async function runCoreDirectPathsCheck(opts = {}) {
   const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join43(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join44(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -11064,7 +11169,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join43(root, "services", "api", "src");
+    coreApiSrcDir = join44(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -11130,8 +11235,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa12("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync41, existsSync: existsSync48 } = await import("fs");
-      if (existsSync48(messageFile)) commitMessage = readFileSync41(messageFile, "utf8");
+      const { readFileSync: readFileSync41, existsSync: existsSync49 } = await import("fs");
+      if (existsSync49(messageFile)) commitMessage = readFileSync41(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -11235,8 +11340,8 @@ ${BOLD}If the divergence is deliberate${OFF}
 import { execa as execa13 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync32, readdirSync as readdirSync18, statSync as statSync11 } from "fs";
-import { join as join44 } from "path";
+import { readFileSync as readFileSync32, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
+import { join as join45 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -11308,12 +11413,12 @@ function walkTerraformFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync18(dir);
+      entries = readdirSync19(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join44(dir, entry);
+      const p = join45(dir, entry);
       let st;
       try {
         st = statSync11(p);
@@ -11450,11 +11555,11 @@ import { execa as execa14 } from "execa";
 
 // src/lib/lambda-output-guard.ts
 import { readFileSync as readFileSync34 } from "fs";
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { readdirSync as readdirSync19, readFileSync as readFileSync33, statSync as statSync12 } from "fs";
-import { join as join45 } from "path";
+import { readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync12 } from "fs";
+import { join as join46 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -11472,13 +11577,13 @@ function findWorkflowFiles(repoRoot) {
   const walk2 = (dir, relative10) => {
     let entries;
     try {
-      entries = readdirSync19(dir);
+      entries = readdirSync20(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join45(dir, entry);
+      const full = join46(dir, entry);
       const rel = relative10 ? `${relative10}/${entry}` : entry;
       if (statSync12(full).isDirectory()) {
         walk2(full, rel);
@@ -11522,7 +11627,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync33(join45(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync33(join46(repoRoot, file), "utf8"))
   );
 }
 
@@ -11580,7 +11685,7 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync34(join46(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync34(join47(repoRoot, file), "utf8"))
   );
 }
 
@@ -11608,8 +11713,8 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync35, readdirSync as readdirSync20 } from "fs";
-import { join as join47, relative as relative8 } from "path";
+import { readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
+import { join as join48, relative as relative8 } from "path";
 import { execa as execa15 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
@@ -11706,17 +11811,17 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join47(root, dir);
+    const full = join48(root, dir);
     let entries;
     try {
-      entries = readdirSync20(full, { withFileTypes: true });
+      entries = readdirSync21(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join47(full, entry.name));
+      out.push(join48(full, entry.name));
     }
   }
   return out;
@@ -11753,7 +11858,7 @@ import { execa as execa16 } from "execa";
 
 // src/lib/plugin-allowlist-convention.ts
 import { readFileSync as readFileSync36 } from "fs";
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -11764,7 +11869,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative10) {
   try {
-    return readFileSync36(join48(repoRoot, relative10), "utf8");
+    return readFileSync36(join49(repoRoot, relative10), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative10}`);
   }
@@ -11885,34 +11990,34 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync41 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync42 } from "fs";
+import { join as join51 } from "path";
 import { execa as execa17 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync40, readdirSync as readdirSync21, statSync as statSync13 } from "fs";
-import { join as join49 } from "path";
+import { existsSync as existsSync41, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { join as join50 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync40(dir)) return [];
-  return readdirSync21(dir).filter((entry) => {
+  if (!existsSync41(dir)) return [];
+  return readdirSync22(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync13(join49(dir, entry)).isDirectory();
+      return statSync13(join50(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync40(join49(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync41(join50(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join49(pluginDir2, "tests");
-  if (!existsSync40(testsDir)) return [];
-  if (existsSync40(join49(testsDir, "__init__.py"))) return [];
-  return readdirSync21(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
+  const testsDir = join50(pluginDir2, "tests");
+  if (!existsSync41(testsDir)) return [];
+  if (existsSync41(join50(testsDir, "__init__.py"))) return [];
+  return readdirSync22(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
   const plugins = (pluginDirs ?? subdirectories(servicesDir)).filter((name) => !name.startsWith("_")).filter((name) => name !== "api").sort();
@@ -11920,7 +12025,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join49(servicesDir, plugin))) {
+      for (const name of namesOf(join50(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -11958,8 +12063,8 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join50(root, "services");
-  if (!existsSync41(servicesDir)) {
+  const servicesDir = join51(root, "services");
+  if (!existsSync42(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -11979,8 +12084,8 @@ async function runPluginCollisionCheck() {
 import { execa as execa18 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync42, readFileSync as readFileSync37, readdirSync as readdirSync22 } from "fs";
-import { dirname as dirname10, join as join51, relative as relative9, sep as sep3 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync37, readdirSync as readdirSync23 } from "fs";
+import { dirname as dirname10, join as join52, relative as relative9, sep as sep3 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -11988,16 +12093,16 @@ function findPluginManifests(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync22(dir, { withFileTypes: true });
+      entries = readdirSync23(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join51(dir, entry.name));
+        walk2(join52(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative9(root, join51(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative9(root, join52(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -12022,14 +12127,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync42(join51(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync43(join52(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join51(root, manifest);
+    const absManifest = join52(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync42(join51(pluginDir2, "terraform"))) continue;
+    if (existsSync43(join52(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative9(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -12060,13 +12165,13 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync44 } from "fs";
-import { join as join53 } from "path";
+import { existsSync as existsSync45 } from "fs";
+import { join as join54 } from "path";
 import { execa as execa19 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync43, readFileSync as readFileSync38, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join52 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync38, readdirSync as readdirSync24, statSync as statSync14 } from "fs";
+import { join as join53 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -12477,13 +12582,13 @@ var OPENROUTER_MODEL_IDS = [
 function listDirs(root) {
   let entries;
   try {
-    entries = readdirSync23(root);
+    entries = readdirSync24(root);
   } catch {
     return [];
   }
   return entries.filter((e) => {
     try {
-      return statSync14(join52(root, e)).isDirectory();
+      return statSync14(join53(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -12494,12 +12599,12 @@ function walkFiles2(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync23(dir);
+      entries = readdirSync24(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join52(dir, entry);
+      const p = join53(dir, entry);
       let st;
       try {
         st = statSync14(p);
@@ -12525,14 +12630,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join52(pluginDir2, "terraform");
+  const tfDir = join53(pluginDir2, "terraform");
   let entries;
   try {
-    entries = readdirSync23(tfDir);
+    entries = readdirSync24(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join52(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join53(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -12784,8 +12889,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join52("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join52(
+var CONFIG_PY_PATH = join53("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join53(
   "services",
   "api",
   "src",
@@ -12797,10 +12902,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join52(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join52(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync43(configPath);
-  const orchestrationSchemaMissing = !existsSync43(orchestrationPath);
+  const configPath = join53(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join53(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync44(configPath);
+  const orchestrationSchemaMissing = !existsSync44(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -12871,7 +12976,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync14(join52(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync14(join53(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -12884,8 +12989,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join52(pluginsRoot, name);
-    const manifestText = readFileSync38(join52(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join53(pluginsRoot, name);
+    const manifestText = readFileSync38(join53(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -12983,7 +13088,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join52(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join53(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -13016,8 +13121,8 @@ function auditPluginToolSupply(pluginsRoot) {
 async function runPluginToolSupplyCheck() {
   const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join53(root, "services", "_plugins");
-  if (!existsSync44(pluginsRoot)) {
+  const pluginsRoot = join54(root, "services", "_plugins");
+  if (!existsSync45(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -13047,8 +13152,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join53(root, "services", "api");
-  if (!existsSync44(servicesApiRoot)) {
+  const servicesApiRoot = join54(root, "services", "api");
+  if (!existsSync45(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -13225,13 +13330,13 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync45, readdirSync as readdirSync25 } from "fs";
-import { join as join55 } from "path";
+import { existsSync as existsSync46, readdirSync as readdirSync26 } from "fs";
+import { join as join56 } from "path";
 import { execa as execa21 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
-import { join as join54 } from "path";
+import { readFileSync as readFileSync39, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { join as join55 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -13289,13 +13394,13 @@ function walk(dir, base = dir) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync24(dir);
+    entries = readdirSync25(dir);
   } catch {
     return out;
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join54(dir, entry);
+    const abs = join55(dir, entry);
     let isDir;
     try {
       isDir = statSync15(abs).isDirectory();
@@ -13317,7 +13422,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync39(join54(skeletonRoot, rel), "utf8");
+        contents = readFileSync39(join55(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -13346,23 +13451,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join55(root, "_skeletons");
+  const skeletonsDir = join56(root, "_skeletons");
   let entries;
   try {
-    entries = readdirSync25(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    entries = readdirSync26(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync45(join55(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync46(join56(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join55(root, "_skeletons", name);
+    const skeletonRoot = join56(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync45(join55(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync46(join56(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -13376,7 +13481,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join55(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join56(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -13514,8 +13619,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync46, readFileSync as readFileSync40 } from "fs";
-import { join as join56, resolve as resolve20 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync40 } from "fs";
+import { join as join57, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -13694,8 +13799,8 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join56(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync46(path)) return null;
+  const path = join57(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync47(path)) return null;
   try {
     return extractVersionField(readFileSync40(path, "utf8"));
   } catch {
@@ -13717,8 +13822,8 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join56(cwd, CORE_VERSION_FILE);
-  if (!existsSync46(path)) return null;
+  const path = join57(cwd, CORE_VERSION_FILE);
+  if (!existsSync47(path)) return null;
   try {
     const value = readFileSync40(path, "utf8").trim();
     return value === "" ? null : value;
@@ -14169,13 +14274,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync47 } from "fs";
-import { dirname as dirname11, join as join57 } from "path";
+import { existsSync as existsSync48 } from "fs";
+import { dirname as dirname11, join as join58 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join57(dir, relativePath);
-    if (existsSync47(candidate)) return candidate;
+    const candidate = join58(dir, relativePath);
+    if (existsSync48(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;