@biffo/cli 0.301.27 → 0.302.0

package/dist/index.js

@@ -11965,8 +11965,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync45, existsSync: existsSync55 } = await import("fs");
-      if (existsSync55(messageFile)) commitMessage = readFileSync45(messageFile, "utf8");
+      const { readFileSync: readFileSync46, existsSync: existsSync56 } = await import("fs");
+      if (existsSync56(messageFile)) commitMessage = readFileSync46(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -12066,9 +12066,253 @@ ${BOLD}If the divergence is deliberate${OFF}
   process.exit(1);
 }
 
-// src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync34, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
+// src/lib/distribution-inventory.ts
+import { existsSync as existsSync43, readFileSync as readFileSync34 } from "fs";
 import { join as join47 } from "path";
+var INVENTORY_FILENAME = "distribution-inventory.json";
+function loadDistributionInventory(root) {
+  const path = join47(root, INVENTORY_FILENAME);
+  if (!existsSync43(path)) {
+    throw new Error(
+      `${INVENTORY_FILENAME} not found at ${root} -- expected it beside core-manifest.json`
+    );
+  }
+  return JSON.parse(readFileSync34(path, "utf8"));
+}
+function validateInventory(inventory) {
+  const violations = [];
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const entry of inventory.entries) {
+    if (seenIds.has(entry.id)) {
+      violations.push({
+        entryId: entry.id,
+        rule: "duplicate-id",
+        detail: "id reused by another entry"
+      });
+    }
+    seenIds.add(entry.id);
+    const channel = inventory.channels[entry.channel];
+    if (!channel) {
+      violations.push({
+        entryId: entry.id,
+        rule: "unknown-channel",
+        detail: `channel "${entry.channel}" is not declared in inventory.channels`
+      });
+      continue;
+    }
+    if (entry.status === "detected" && (!channel.detectorCommand || entry.channel === "none")) {
+      violations.push({
+        entryId: entry.id,
+        rule: "detected-with-no-detector",
+        detail: `status "detected" but channel "${entry.channel}" declares no detectorCommand`
+      });
+    }
+    if (entry.status === "unregistered" && !channel.detectorCommand) {
+      violations.push({
+        entryId: entry.id,
+        rule: "unregistered-with-no-mechanism",
+        detail: `status "unregistered" claims a mechanism exists to register with, but channel "${entry.channel}" declares no detectorCommand -- this should be "unverified" instead`
+      });
+    }
+    if (entry.status === "unverified" && entry.channel !== "none") {
+      violations.push({
+        entryId: entry.id,
+        rule: "unverified-on-live-channel",
+        detail: `status "unverified" but channel "${entry.channel}" has a real detector -- this is "unregistered" (mechanism exists, artifact not added to it), not "unverified" (no mechanism at all)`
+      });
+    }
+    if ((entry.status === "unregistered" || entry.status === "unverified") && !entry.gapReason) {
+      violations.push({
+        entryId: entry.id,
+        rule: "gap-with-no-reason",
+        detail: `status "${entry.status}" requires a gapReason explaining what is missing and why`
+      });
+    }
+    if (entry.evidence.length === 0) {
+      violations.push({
+        entryId: entry.id,
+        rule: "no-evidence",
+        detail: "evidence must name at least one issue or file"
+      });
+    }
+    if (entry.targets.length === 0) {
+      violations.push({
+        entryId: entry.id,
+        rule: "no-targets",
+        detail: "targets must name at least one destination"
+      });
+    }
+    for (const assertion of entry.remoteContentAssertions ?? []) {
+      if (!assertion.repo || !assertion.path || !assertion.ref) {
+        violations.push({
+          entryId: entry.id,
+          rule: "incomplete-remote-content-assertion",
+          detail: `remoteContentAssertions entry missing repo/path/ref: ${JSON.stringify(assertion)}`
+        });
+      }
+      if ((assertion.mustContain?.length ?? 0) === 0 && (assertion.mustNotContain?.length ?? 0) === 0) {
+        violations.push({
+          entryId: entry.id,
+          rule: "empty-remote-content-assertion",
+          detail: `remoteContentAssertions entry for ${assertion.repo}/${assertion.path} states neither mustContain nor mustNotContain -- checks nothing`
+        });
+      }
+    }
+  }
+  return violations;
+}
+function checkRemoteContentAssertions(inventory, fetchedContent) {
+  const violations = [];
+  for (const entry of inventory.entries) {
+    for (const assertion of entry.remoteContentAssertions ?? []) {
+      const key = `${assertion.repo}
+${assertion.path}
+${assertion.ref}`;
+      const content = fetchedContent.get(key);
+      if (content === void 0) {
+        violations.push({
+          entryId: entry.id,
+          assertion,
+          rule: "fetch-failed",
+          detail: `no fetched content supplied for ${key.replace(/\n/g, " @ ")}`
+        });
+        continue;
+      }
+      if (content === null) {
+        violations.push({
+          entryId: entry.id,
+          assertion,
+          rule: "fetch-failed",
+          detail: `fetching ${assertion.repo}/${assertion.path}@${assertion.ref} failed`
+        });
+        continue;
+      }
+      for (const needle of assertion.mustContain ?? []) {
+        if (!content.includes(needle)) {
+          violations.push({
+            entryId: entry.id,
+            assertion,
+            rule: "missing-required-substring",
+            detail: `${assertion.repo}/${assertion.path}@${assertion.ref} no longer contains "${needle}" -- the entry's gapReason claims this is (still) the current state`
+          });
+        }
+      }
+      for (const needle of assertion.mustNotContain ?? []) {
+        if (content.includes(needle)) {
+          violations.push({
+            entryId: entry.id,
+            assertion,
+            rule: "contains-forbidden-substring",
+            detail: `${assertion.repo}/${assertion.path}@${assertion.ref} still contains "${needle}" -- the entry's gapReason claims this was removed/changed`
+          });
+        }
+      }
+    }
+  }
+  return violations;
+}
+async function fetchRemoteContentViaGh(repo, path, ref, execCommand) {
+  const result = await execCommand("gh", [
+    "api",
+    `repos/${repo}/contents/${path}?ref=${ref}`,
+    "--jq",
+    ".content"
+  ]);
+  if (result.exitCode !== 0) return null;
+  const base64 = result.stdout.trim();
+  if (!base64) return null;
+  try {
+    return Buffer.from(base64, "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+
+// src/scripts/check-distribution-inventory.ts
+async function runDistributionInventoryCheck(root) {
+  const repoRoot = root ?? (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const inventory = loadDistributionInventory(repoRoot);
+  const violations = validateInventory(inventory);
+  console.log(
+    `distribution-inventory: examined ${inventory.entries.length} inventory entr(ies) across ${Object.keys(inventory.channels).length} declared channel(s) in distribution-inventory.json (${violations.length} schema violation(s))`
+  );
+  if (violations.length === 0) {
+    console.log("\u2713 distribution-inventory: every entry is well-formed and internally consistent");
+    return;
+  }
+  console.error(
+    `\u2717 distribution-inventory: ${violations.length} schema violation(s) \u2014 an entry is malformed, half-classified, or inconsistent with the channel it names:
+`
+  );
+  for (const v of violations) {
+    console.error(`  ${v.entryId} [${v.rule}]: ${v.detail}`);
+  }
+  process.exit(1);
+}
+
+// src/scripts/check-distribution-remote-state.ts
+import { join as join48 } from "path";
+async function ghExecCommand(file, args) {
+  const result = await execa(file, args, { reject: false });
+  return { stdout: String(result.stdout ?? ""), exitCode: result.exitCode ?? null };
+}
+async function runDistributionRemoteStateCheck(root) {
+  const repoRoot = root ?? (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const inventory = loadDistributionInventory(repoRoot);
+  const assertions = [];
+  for (const entry of inventory.entries) {
+    for (const assertion of entry.remoteContentAssertions ?? []) {
+      assertions.push({ entryId: entry.id, assertion });
+    }
+  }
+  console.log(
+    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join48(repoRoot, "distribution-inventory.json")})`
+  );
+  if (assertions.length === 0) {
+    console.log("\u2713 distribution-remote-state: nothing declared to check");
+    return;
+  }
+  const fetched = /* @__PURE__ */ new Map();
+  let fetchFailures = 0;
+  for (const { assertion } of assertions) {
+    const key = `${assertion.repo}
+${assertion.path}
+${assertion.ref}`;
+    if (fetched.has(key)) continue;
+    const content = await fetchRemoteContentViaGh(
+      assertion.repo,
+      assertion.path,
+      assertion.ref,
+      ghExecCommand
+    );
+    fetched.set(key, content);
+    if (content === null) fetchFailures += 1;
+  }
+  if (fetchFailures > 0) {
+    console.error(
+      `\u2717 distribution-remote-state: could not fetch ${fetchFailures} of ${fetched.size} distinct remote file(s) -- no BIFFO_GITHUB_TOKEN, network failure, or the file/ref no longer exists. Cannot tell whether the remaining claims hold.`
+    );
+    process.exit(2);
+  }
+  const violations = checkRemoteContentAssertions(inventory, fetched);
+  if (violations.length === 0) {
+    console.log(
+      `\u2713 distribution-remote-state: all ${assertions.length} assertion(s) match real content`
+    );
+    return;
+  }
+  console.error(
+    `\u2717 distribution-remote-state: ${violations.length} assertion(s) no longer match real content -- the affected entry's gapReason is stale (#1570/#1816):`
+  );
+  for (const v of violations) {
+    console.error(`  ${v.entryId} [${v.rule}]: ${v.detail}`);
+  }
+  process.exit(1);
+}
+
+// src/lib/eventbridge-log-permission-guard.ts
+import { readFileSync as readFileSync35, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
+import { join as join49 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -12145,7 +12389,7 @@ function walkTerraformFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join47(dir, entry);
+      const p = join49(dir, entry);
       let st;
       try {
         st = statSync12(p);
@@ -12188,7 +12432,7 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync34(file, "utf8");
+    const text = readFileSync35(file, "utf8");
     rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
     rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
     eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
@@ -12278,8 +12522,8 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-instance-adoption.ts
-import { existsSync as existsSync43 } from "fs";
-import { join as join48 } from "path";
+import { existsSync as existsSync44 } from "fs";
+import { join as join50 } from "path";
 async function runInstanceAdoptionCheck(opts = {}) {
   if (!opts.instanceDir) {
     console.error(
@@ -12287,7 +12531,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
     );
     process.exit(2);
   }
-  if (!existsSync43(opts.instanceDir)) {
+  if (!existsSync44(opts.instanceDir)) {
     console.error(
       `\u2717 instance-adoption guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it is adopted, and that is not the same as a clean pass.`
     );
@@ -12295,7 +12539,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
   }
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const theirsDir = opts.theirsDir ?? root;
-  const instanceLabel = opts.instance ?? join48(opts.instanceDir).split("/").filter(Boolean).pop();
+  const instanceLabel = opts.instance ?? join50(opts.instanceDir).split("/").filter(Boolean).pop();
   const report = checkInstanceAdoption(theirsDir, opts.instanceDir);
   console.log(
     `examined ${report.examinedInstances} instance (${instanceLabel}) against ${report.registeredPairs} registered pair(s), ${report.applicablePairs} applicable to this instance, against template tree ${theirsDir}`
@@ -12317,12 +12561,12 @@ async function runInstanceAdoptionCheck(opts = {}) {
 }
 
 // src/lib/lambda-output-guard.ts
-import { readFileSync as readFileSync36 } from "fs";
-import { join as join50 } from "path";
+import { readFileSync as readFileSync37 } from "fs";
+import { join as join52 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync44, readdirSync as readdirSync21, readFileSync as readFileSync35, statSync as statSync13 } from "fs";
-import { join as join49 } from "path";
+import { existsSync as existsSync45, readdirSync as readdirSync21, readFileSync as readFileSync36, statSync as statSync13 } from "fs";
+import { join as join51 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -12336,7 +12580,7 @@ function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
 function vendoredPluginServiceDirs(repoRoot) {
-  const servicesDir = join49(repoRoot, "services");
+  const servicesDir = join51(repoRoot, "services");
   const result = /* @__PURE__ */ new Set();
   let entries;
   try {
@@ -12345,9 +12589,9 @@ function vendoredPluginServiceDirs(repoRoot) {
     return result;
   }
   for (const entry of entries) {
-    const full = join49(servicesDir, entry);
-    if (!existsSync44(full) || !statSync13(full).isDirectory()) continue;
-    if (existsSync44(join49(full, "biffo.plugin.json"))) {
+    const full = join51(servicesDir, entry);
+    if (!existsSync45(full) || !statSync13(full).isDirectory()) continue;
+    if (existsSync45(join51(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
   }
@@ -12369,7 +12613,7 @@ function findWorkflowFiles(repoRoot) {
       if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
-      const full = join49(dir, entry);
+      const full = join51(dir, entry);
       const rel = relative11 ? `${relative11}/${entry}` : entry;
       let isDir;
       try {
@@ -12419,7 +12663,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync35(join49(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync36(join51(repoRoot, file), "utf8"))
   );
 }
 
@@ -12477,7 +12721,7 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync36(join50(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync37(join52(repoRoot, file), "utf8"))
   );
 }
 
@@ -12505,8 +12749,8 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-migration-body-change.ts
-import { existsSync as existsSync45 } from "fs";
-import { join as join51 } from "path";
+import { existsSync as existsSync46 } from "fs";
+import { join as join53 } from "path";
 
 // src/lib/migration-body-change-guard.ts
 function checkMigrationBodyChangeMarkers(diffs) {
@@ -12572,7 +12816,7 @@ async function runMigrationBodyChangeCheck(argv) {
     );
     return;
   }
-  if (!existsSync45(join51(root, MIGRATIONS_VERSIONS_DIR))) {
+  if (!existsSync46(join53(root, MIGRATIONS_VERSIONS_DIR))) {
     console.log(`\u2713 migration body-change guard: no ${MIGRATIONS_VERSIONS_DIR} in this repo.`);
     return;
   }
@@ -12674,7 +12918,7 @@ ${BOLD2}What to do${OFF2}
 }
 
 // src/scripts/check-orphan-ratchet.ts
-import { existsSync as existsSync46 } from "fs";
+import { existsSync as existsSync47 } from "fs";
 import { basename as basename3 } from "path";
 function reportOrphan(entry, manifest) {
   console.error(`  ${entry.path}`);
@@ -12697,7 +12941,7 @@ function reportOrphan(entry, manifest) {
   }
 }
 async function runOrphanRatchetCheck(opts = {}) {
-  if (opts.instanceDir !== void 0 && !existsSync46(opts.instanceDir)) {
+  if (opts.instanceDir !== void 0 && !existsSync47(opts.instanceDir)) {
     console.error(
       `\u2717 orphan-ratchet guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it carries unsanctioned files, and that is not the same as a clean pass.`
     );
@@ -12739,8 +12983,8 @@ baseline was ${String(ratchet.baseline)}, now ${String(ratchet.count)}. See biff
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync37, readdirSync as readdirSync22 } from "fs";
-import { join as join52, relative as relative9 } from "path";
+import { readFileSync as readFileSync38, readdirSync as readdirSync22 } from "fs";
+import { join as join54, relative as relative9 } from "path";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -12836,7 +13080,7 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join52(root, dir);
+    const full = join54(root, dir);
     let entries;
     try {
       entries = readdirSync22(full, { withFileTypes: true });
@@ -12846,7 +13090,7 @@ function shellFiles(root) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join52(full, entry.name));
+      out.push(join54(full, entry.name));
     }
   }
   return out;
@@ -12862,7 +13106,7 @@ async function runPipeTrapCheck() {
     process.exit(1);
   }
   const findings = files.flatMap(
-    (file) => findPipeTraps(readFileSync37(file, "utf8")).map(
+    (file) => findPipeTraps(readFileSync38(file, "utf8")).map(
       (t) => `${relative9(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
@@ -12879,8 +13123,8 @@ async function runPipeTrapCheck() {
 }
 
 // src/lib/plugin-allowlist-convention.ts
-import { readFileSync as readFileSync38 } from "fs";
-import { join as join53 } from "path";
+import { readFileSync as readFileSync39 } from "fs";
+import { join as join55 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -12891,7 +13135,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync38(join53(repoRoot, relative11), "utf8");
+    return readFileSync39(join55(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -13012,32 +13256,32 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync48 } from "fs";
-import { join as join55 } from "path";
+import { existsSync as existsSync49 } from "fs";
+import { join as join57 } from "path";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync47, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join54 } from "path";
+import { existsSync as existsSync48, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join56 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync47(dir)) return [];
+  if (!existsSync48(dir)) return [];
   return readdirSync23(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync14(join54(dir, entry)).isDirectory();
+      return statSync14(join56(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync47(join54(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync48(join56(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join54(pluginDir2, "tests");
-  if (!existsSync47(testsDir)) return [];
-  if (existsSync47(join54(testsDir, "__init__.py"))) return [];
+  const testsDir = join56(pluginDir2, "tests");
+  if (!existsSync48(testsDir)) return [];
+  if (existsSync48(join56(testsDir, "__init__.py"))) return [];
   return readdirSync23(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -13046,7 +13290,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join54(servicesDir, plugin))) {
+      for (const name of namesOf(join56(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -13084,8 +13328,8 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join55(root, "services");
-  if (!existsSync48(servicesDir)) {
+  const servicesDir = join57(root, "services");
+  if (!existsSync49(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -13102,8 +13346,8 @@ async function runPluginCollisionCheck() {
 }
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync49, readFileSync as readFileSync39, readdirSync as readdirSync24 } from "fs";
-import { dirname as dirname10, join as join56, relative as relative10, sep as sep4 } from "path";
+import { existsSync as existsSync50, readFileSync as readFileSync40, readdirSync as readdirSync24 } from "fs";
+import { dirname as dirname10, join as join58, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -13118,9 +13362,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join56(dir, entry.name));
+        walk2(join58(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join56(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join58(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -13130,7 +13374,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync39(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync40(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -13145,14 +13389,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync49(join56(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync50(join58(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join56(root, manifest);
+    const absManifest = join58(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync49(join56(pluginDir2, "terraform"))) continue;
+    if (existsSync50(join58(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -13183,12 +13427,12 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync51 } from "fs";
-import { join as join58 } from "path";
+import { existsSync as existsSync52 } from "fs";
+import { join as join60 } from "path";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync50, readFileSync as readFileSync40, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
-import { join as join57 } from "path";
+import { existsSync as existsSync51, readFileSync as readFileSync41, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { join as join59 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -13605,7 +13849,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync15(join57(root, e)).isDirectory();
+      return statSync15(join59(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -13621,7 +13865,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join57(dir, entry);
+      const p = join59(dir, entry);
       let st;
       try {
         st = statSync15(p);
@@ -13647,14 +13891,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join57(pluginDir2, "terraform");
+  const tfDir = join59(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync25(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join57(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join59(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -13906,8 +14150,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join57("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join57(
+var CONFIG_PY_PATH = join59("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join59(
   "services",
   "api",
   "src",
@@ -13919,10 +14163,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join57(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join57(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync50(configPath);
-  const orchestrationSchemaMissing = !existsSync50(orchestrationPath);
+  const configPath = join59(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join59(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync51(configPath);
+  const orchestrationSchemaMissing = !existsSync51(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -13940,13 +14184,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync40(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync41(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync40(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync41(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -13993,7 +14237,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync15(join57(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync15(join59(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -14006,8 +14250,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join57(pluginsRoot, name);
-    const manifestText = readFileSync40(join57(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join59(pluginsRoot, name);
+    const manifestText = readFileSync41(join59(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -14025,13 +14269,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync40(f, "utf8")
+      text: readFileSync41(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync40(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync41(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -14105,7 +14349,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join57(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join59(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -14138,8 +14382,8 @@ function auditPluginToolSupply(pluginsRoot) {
 async function runPluginToolSupplyCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join58(root, "services", "_plugins");
-  if (!existsSync51(pluginsRoot)) {
+  const pluginsRoot = join60(root, "services", "_plugins");
+  if (!existsSync52(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -14169,8 +14413,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join58(root, "services", "api");
-  if (!existsSync51(servicesApiRoot)) {
+  const servicesApiRoot = join60(root, "services", "api");
+  if (!existsSync52(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -14344,10 +14588,10 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-shared-file-reduction.ts
-import { readFileSync as readFileSync42 } from "fs";
+import { readFileSync as readFileSync43 } from "fs";
 
 // src/lib/shared-file-reduction-guard.ts
-import { readFileSync as readFileSync41 } from "fs";
+import { readFileSync as readFileSync42 } from "fs";
 var LEAF_TEST_CALLS = /* @__PURE__ */ new Set(["it", "test"]);
 var SUITE_CALLS = /* @__PURE__ */ new Set(["describe", "suite"]);
 var TEST_FILE_PATTERN = /\.(test|spec)\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
@@ -14474,7 +14718,7 @@ function formatReductionReport(report) {
 // src/scripts/check-shared-file-reduction.ts
 function readStdin() {
   try {
-    return readFileSync42(0, "utf8");
+    return readFileSync43(0, "utf8");
   } catch {
     return "";
   }
@@ -14491,15 +14735,15 @@ function pairsFromTsv(tsv) {
     const [target, existingPath, incomingPath] = fields;
     pairs.push({
       target,
-      existing: readFileSync42(existingPath, "utf8"),
-      incoming: readFileSync42(incomingPath, "utf8")
+      existing: readFileSync43(existingPath, "utf8"),
+      incoming: readFileSync43(incomingPath, "utf8")
     });
   }
   return pairs;
 }
 function loadAccepted(manifestPath) {
   if (!manifestPath) return {};
-  const parsed = JSON.parse(readFileSync42(manifestPath, "utf8"));
+  const parsed = JSON.parse(readFileSync43(manifestPath, "utf8"));
   return parsed.acceptedReductions ?? {};
 }
 async function runSharedFileReductionCheck(args) {
@@ -14507,13 +14751,13 @@ async function runSharedFileReductionCheck(args) {
   let accepted;
   try {
     if (args.pairs) {
-      pairs = pairsFromTsv(args.pairs === "-" ? readStdin() : readFileSync42(args.pairs, "utf8"));
+      pairs = pairsFromTsv(args.pairs === "-" ? readStdin() : readFileSync43(args.pairs, "utf8"));
     } else if (args.target && args.existing && args.incoming) {
       pairs = [
         {
           target: args.target,
-          existing: readFileSync42(args.existing, "utf8"),
-          incoming: readFileSync42(args.incoming, "utf8")
+          existing: readFileSync43(args.existing, "utf8"),
+          incoming: readFileSync43(args.incoming, "utf8")
         }
       ];
     } else {
@@ -14547,12 +14791,12 @@ async function runSharedFileReductionCheck(args) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync52, readdirSync as readdirSync27 } from "fs";
-import { join as join60 } from "path";
+import { existsSync as existsSync53, readdirSync as readdirSync27 } from "fs";
+import { join as join62 } from "path";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync43, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
-import { join as join59 } from "path";
+import { readFileSync as readFileSync44, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
+import { join as join61 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -14616,7 +14860,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join59(dir, entry);
+    const abs = join61(dir, entry);
     let isDir;
     try {
       isDir = statSync16(abs).isDirectory();
@@ -14638,7 +14882,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync43(join59(skeletonRoot, rel), "utf8");
+        contents = readFileSync44(join61(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -14667,23 +14911,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join60(root, "_skeletons");
+  const skeletonsDir = join62(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync27(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync52(join60(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync53(join62(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join60(root, "_skeletons", name);
+    const skeletonRoot = join62(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync52(join60(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync53(join62(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -14697,7 +14941,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join60(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join62(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -14733,7 +14977,7 @@ async function runTerraformInputCheck() {
 
 // src/commands/check.ts
 var checkCommand = new Command24("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, instance-adoption, orphan-ratchet, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention, migration-body-change) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, instance-adoption, orphan-ratchet, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention, migration-body-change, distribution-inventory, distribution-remote-state) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -14796,6 +15040,16 @@ checkCommand.command("instance-adoption").description(
 ).action(async (opts) => {
   await runInstanceAdoptionCheck(opts);
 });
+checkCommand.command("distribution-inventory").description(
+  "Refuse a distribution-inventory.json entry that is malformed, half-classified, or inconsistent with the channel it names (#1570) -- validateInventory's own schema rules, self-checkable and network-free. Contrast distribution-remote-state below, its sibling, which needs a real cross-repo token to check a NAMED REMOTE repo's actual content and runs only on a schedule."
+).action(async () => {
+  await runDistributionInventoryCheck();
+});
+checkCommand.command("distribution-remote-state").description(
+  "Refuse a distribution-inventory.json gapReason restating a REMOTE repo's content as current fact once that content has actually changed (#1816) -- fetches every declared remoteContentAssertion via `gh api` and compares against real content, generalising the one-off #1807 wording-regex guard to any entry that declares one. Needs a real cross-repo token (BIFFO_GITHUB_TOKEN in CI); exits 2 (cannot tell) rather than passing when a fetch fails."
+).action(async () => {
+  await runDistributionRemoteStateCheck();
+});
 checkCommand.command("orphan-ratchet").description(
   "Refuse an instance-written file under a template-owned path with no sanctioned carve-out (#1026), reusing planCoreUpgrade's classify() and checkOrphanRatchet \u2014 previously reachable only from inside `biffo core upgrade`, so drift was discovered only ~90 core versions later by the upgrade it blocks (#1714). --instance-dir defaults to a SELF-CHECK (this repo's own tree, unlike instance-adoption above) that can only ever report zero \u2014 see the entrypoint's own doc comment for why that default exists anyway. Pass a real instance checkout for a check that can actually find something."
 ).option(
@@ -14878,8 +15132,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync53, readFileSync as readFileSync44 } from "fs";
-import { join as join61, resolve as resolve20 } from "path";
+import { existsSync as existsSync54, readFileSync as readFileSync45 } from "fs";
+import { join as join63, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -15274,10 +15528,10 @@ async function runDoctorFixBranches(cwd, facts, deps = { git: new GitAdapter(),
   return reapAllBareBranches(cwd, facts.branches, facts.worktrees, facts.currentBranch, deps);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join61(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync53(path)) return null;
+  const path = join63(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync54(path)) return null;
   try {
-    return extractVersionField(readFileSync44(path, "utf8"));
+    return extractVersionField(readFileSync45(path, "utf8"));
   } catch {
     return null;
   }
@@ -15297,10 +15551,10 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join61(cwd, CORE_VERSION_FILE);
-  if (!existsSync53(path)) return null;
+  const path = join63(cwd, CORE_VERSION_FILE);
+  if (!existsSync54(path)) return null;
   try {
-    const value = readFileSync44(path, "utf8").trim();
+    const value = readFileSync45(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -15829,13 +16083,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync54 } from "fs";
-import { dirname as dirname11, join as join62 } from "path";
+import { existsSync as existsSync55 } from "fs";
+import { dirname as dirname11, join as join64 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join62(dir, relativePath);
-    if (existsSync54(candidate)) return candidate;
+    const candidate = join64(dir, relativePath);
+    if (existsSync55(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.301.27",
+  "version": "0.302.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/verify.sh

@@ -1421,6 +1421,7 @@ if [ -f scripts/biffo.sh ]; then
   run_check claim-invocation sh scripts/biffo.sh check claim-invocation
   run_check terraform-input sh scripts/biffo.sh check terraform-input
   run_check plugin-allowlist sh scripts/biffo.sh check plugin-allowlist-convention
+  run_check distribution-inventory sh scripts/biffo.sh check distribution-inventory
 else
   skip biffo-guards "no scripts/biffo.sh in this repo"
 fi