@biffo/cli 0.303.1 → 0.303.2

package/dist/index.js

@@ -10920,6 +10920,239 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
   console.log("\u2713 ADR numbering guard: OK");
 }
 
+// src/lib/api-gateway-integration-guard.ts
+import { readFileSync as readFileSync30, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
+import { join as join41 } from "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
+var MODULE_TYPE = "module";
+var INTEGRATION_TYPE = "aws_apigatewayv2_integration";
+function lineNumber(text, index) {
+  let count = 1;
+  for (let i = 0; i < index && i < text.length; i++) {
+    if (text[i] === "\n") count += 1;
+  }
+  return count;
+}
+function balancedBraceSpan(text, openIndex) {
+  let depth = 0;
+  for (let i = openIndex; i < text.length; i++) {
+    if (text[i] === "{") depth += 1;
+    else if (text[i] === "}") {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return null;
+}
+function findResourceBlocks(text, file, resourceType) {
+  const blocks = [];
+  const pattern = new RegExp(`resource\\s+"${resourceType}"\\s+"([\\w-]+)"\\s*\\{`, "g");
+  let m;
+  while ((m = pattern.exec(text)) !== null) {
+    const name = m[1];
+    const line = lineNumber(text, m.index);
+    const openIndex = m.index + m[0].length - 1;
+    const closeIndex = balancedBraceSpan(text, openIndex);
+    if (closeIndex === null) {
+      blocks.push({ file, line, type: resourceType, name, body: null });
+      continue;
+    }
+    blocks.push({
+      file,
+      line,
+      type: resourceType,
+      name,
+      body: text.slice(openIndex + 1, closeIndex)
+    });
+  }
+  return blocks;
+}
+function findModuleBlocks(text, file) {
+  const blocks = [];
+  const pattern = /module\s+"([\w-]+)"\s*\{/g;
+  let m;
+  while ((m = pattern.exec(text)) !== null) {
+    const name = m[1];
+    const line = lineNumber(text, m.index);
+    const openIndex = m.index + m[0].length - 1;
+    const closeIndex = balancedBraceSpan(text, openIndex);
+    if (closeIndex === null) {
+      blocks.push({ file, line, type: MODULE_TYPE, name, body: null });
+      continue;
+    }
+    blocks.push({
+      file,
+      line,
+      type: MODULE_TYPE,
+      name,
+      body: text.slice(openIndex + 1, closeIndex)
+    });
+  }
+  return blocks;
+}
+function countRawResourceDeclarations(text, resourceType) {
+  const needle = resourceType === MODULE_TYPE ? 'module "' : `resource "${resourceType}"`;
+  return text.split(needle).length - 1;
+}
+function walkTerraformFiles(root) {
+  const out = [];
+  const walk2 = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync16(dir);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const p = join41(dir, entry);
+      let st;
+      try {
+        st = statSync9(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (SKIP_DIRS.has(entry)) continue;
+        walk2(p);
+        continue;
+      }
+      if (entry.endsWith(".tf")) out.push(p);
+    }
+  };
+  walk2(root);
+  return out.sort();
+}
+function isApiGatewaySource(body) {
+  const m = /source\s*=\s*"([^"]+)"/.exec(body);
+  if (!m) return false;
+  return /(^|\/)modules\/cloud\/aws\/api-gateway\/?$/.test(m[1].trim());
+}
+function protectedFunctionModuleName(body) {
+  const m = /lambda_function_arn\s*=\s*module\.([\w-]+)\.function_arn\b/.exec(body);
+  return m ? m[1] : null;
+}
+function integrationUriOf(body) {
+  const m = /integration_uri\s*=\s*(.+)/.exec(body);
+  if (!m) return null;
+  return m[1].trim().replace(/^"\$\{(.+)\}"$/, "$1").replace(/^"(.+)"$/, "$1").trim();
+}
+function auditApiGatewayIntegrations(root) {
+  const files = walkTerraformFiles(root);
+  if (files.length === 0) {
+    throw new Error(
+      `auditApiGatewayIntegrations: no .tf files found under ${root} \u2014 the guard cannot verify anything against input it cannot see. This is a hard failure, not "0 violations": fix the path, do not treat an empty scan as a clean pass.`
+    );
+  }
+  const moduleBlocks = [];
+  const integrationBlocks = [];
+  let rawModuleCount = 0;
+  let rawIntegrationCount = 0;
+  for (const file of files) {
+    const text = readFileSync30(file, "utf8");
+    rawModuleCount += countRawResourceDeclarations(text, MODULE_TYPE);
+    rawIntegrationCount += countRawResourceDeclarations(text, INTEGRATION_TYPE);
+    moduleBlocks.push(...findModuleBlocks(text, file));
+    integrationBlocks.push(...findResourceBlocks(text, file, INTEGRATION_TYPE));
+  }
+  const unterminatedBlocks = [...moduleBlocks, ...integrationBlocks].filter((b) => b.body === null);
+  const moduleBlind = rawModuleCount > 0 && moduleBlocks.length === 0;
+  const integrationBlind = rawIntegrationCount > 0 && integrationBlocks.length === 0;
+  const protectedLambdas = [];
+  for (const block of moduleBlocks) {
+    if (block.body === null) continue;
+    if (!isApiGatewaySource(block.body)) continue;
+    if (block.file.split("/").includes("_skeletons")) continue;
+    const functionModuleName = protectedFunctionModuleName(block.body);
+    if (functionModuleName === null) continue;
+    protectedLambdas.push({
+      functionModuleName,
+      gatewayModuleName: block.name,
+      file: block.file,
+      line: block.line
+    });
+  }
+  const protectedNames = new Set(protectedLambdas.map((p) => p.functionModuleName));
+  const integrations = [];
+  for (const block of integrationBlocks) {
+    if (block.body === null) continue;
+    integrations.push({
+      file: block.file,
+      line: block.line,
+      name: block.name,
+      integrationUri: integrationUriOf(block.body)
+    });
+  }
+  const violations = [];
+  for (const integration of integrations) {
+    if (integration.integrationUri === null) continue;
+    const m = /^module\.([\w-]+)\.function_arn$/.exec(integration.integrationUri);
+    if (!m) continue;
+    const targetModuleName = m[1];
+    if (!protectedNames.has(targetModuleName)) continue;
+    const owner = protectedLambdas.find((p) => p.functionModuleName === targetModuleName);
+    violations.push({
+      file: integration.file,
+      line: integration.line,
+      integrationName: integration.name,
+      targetModuleName,
+      reason: `aws_apigatewayv2_integration.${integration.name} targets module.${targetModuleName}.function_arn (unqualified), but module.${owner?.gatewayModuleName ?? "<gateway>"} already grants that Lambda's "live" alias \u2014 not the unqualified function \u2014 invoke access (#1747). This integration will fail closed with a generic API Gateway 500 at runtime, invisible to terraform plan/apply on either side. Use module.${owner?.gatewayModuleName ?? "<gateway>"}.lambda_integration_uri instead (biffo-template#1900).`
+    });
+  }
+  const ok = !moduleBlind && !integrationBlind && unterminatedBlocks.length === 0 && violations.length === 0;
+  const summary = `scanned ${files.length} .tf file(s) under ${root}; ${moduleBlocks.length} module block(s) found (${protectedLambdas.length} api-gateway instance(s) fronting an alias-qualified Lambda), ${integrationBlocks.length} ${INTEGRATION_TYPE} block(s) found; ${violations.length} mis-qualified, ${unterminatedBlocks.length} unterminated.`;
+  return {
+    filesScanned: files.length,
+    moduleBlocksFound: moduleBlocks.length,
+    integrationBlocksFound: integrationBlocks.length,
+    protectedLambdas,
+    integrations,
+    unterminatedBlocks,
+    violations,
+    moduleBlind,
+    integrationBlind,
+    ok,
+    summary
+  };
+}
+
+// src/scripts/check-api-gateway-integration.ts
+async function runApiGatewayIntegrationCheck() {
+  const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  let report;
+  try {
+    report = auditApiGatewayIntegrations(root);
+  } catch (err) {
+    console.error("\u2717 API Gateway integration-qualifier guard: could not run\n");
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  console.log(`scanned ${report.filesScanned} .tf file(s) under ${root}`);
+  if (!report.ok) {
+    console.error("\u2717 API Gateway integration-qualifier guard: mis-qualified integration(s) found\n");
+    if (report.moduleBlind) {
+      console.error(
+        '  BLIND (module): raw source contains `module "..."` blocks but the block extractor found none \u2014 the extractor broke, this is not evidence there are no modules.'
+      );
+    }
+    if (report.integrationBlind) {
+      console.error(
+        "  BLIND (aws_apigatewayv2_integration): raw source contains this resource type but the block extractor found none \u2014 the extractor broke, this is not evidence there are no integrations."
+      );
+    }
+    for (const b of report.unterminatedBlocks) {
+      console.error(
+        `  UNTERMINATED ${b.file}:${b.line}  ${b.type} "${b.name}" never closes \u2014 cannot verify what it targets or grants.`
+      );
+    }
+    for (const v of report.violations) {
+      console.error(`  MIS-QUALIFIED ${v.file}:${v.line}  ${v.reason}`);
+    }
+    console.error("\nSee biffo-template#1900.");
+    process.exit(1);
+  }
+  console.log(`\u2713 API Gateway integration-qualifier guard: ${report.summary}`);
+}
+
 // src/scripts/check-branch-protection.ts
 import { Octokit as Octokit2 } from "@octokit/rest";
 
@@ -11180,18 +11413,18 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 }
 
 // src/lib/claim-invocation-parity.ts
-import { existsSync as existsSync40, readFileSync as readFileSync30, readdirSync as readdirSync16 } from "fs";
-import { join as join41 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync31, readdirSync as readdirSync17 } from "fs";
+import { join as join42 } from "path";
 function distributedAgentsDocs(root) {
   const docs = [];
-  const own = join41(root, "AGENTS.md");
-  if (existsSync40(own)) docs.push({ path: "AGENTS.md", text: readFileSync30(own, "utf8") });
-  const skeletons = join41(root, "_skeletons");
+  const own = join42(root, "AGENTS.md");
+  if (existsSync40(own)) docs.push({ path: "AGENTS.md", text: readFileSync31(own, "utf8") });
+  const skeletons = join42(root, "_skeletons");
   if (existsSync40(skeletons)) {
-    for (const name of readdirSync16(skeletons).sort()) {
-      const abs = join41(skeletons, name, "AGENTS.md");
+    for (const name of readdirSync17(skeletons).sort()) {
+      const abs = join42(skeletons, name, "AGENTS.md");
       if (!existsSync40(abs)) continue;
-      docs.push({ path: `_skeletons/${name}/AGENTS.md`, text: readFileSync30(abs, "utf8") });
+      docs.push({ path: `_skeletons/${name}/AGENTS.md`, text: readFileSync31(abs, "utf8") });
     }
   }
   return docs;
@@ -11324,12 +11557,12 @@ async function runClaimInvocationCheck() {
 
 // src/scripts/check-codeql-suppression.ts
 import { existsSync as existsSync41 } from "fs";
-import { join as join43, relative as relative8 } from "path";
+import { join as join44, relative as relative8 } from "path";
 
 // src/lib/codeql-suppression-guard.ts
-import { readdirSync as readdirSync17, readFileSync as readFileSync31, statSync as statSync9 } from "fs";
-import { join as join42 } from "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set([
+import { readdirSync as readdirSync18, readFileSync as readFileSync32, statSync as statSync10 } from "fs";
+import { join as join43 } from "path";
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   ".git",
   ".worktrees",
   "node_modules",
@@ -11354,20 +11587,20 @@ function walkSourceFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync17(dir);
+      entries = readdirSync18(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join42(dir, entry);
+      const p = join43(dir, entry);
       let st;
       try {
-        st = statSync9(p);
+        st = statSync10(p);
       } catch {
         continue;
       }
       if (st.isDirectory()) {
-        if (SKIP_DIRS.has(entry)) continue;
+        if (SKIP_DIRS2.has(entry)) continue;
         walk2(p);
         continue;
       }
@@ -11385,7 +11618,7 @@ function countSourceFiles(root) {
 function sweepCodeqlSuppressionComments(root) {
   const hits = [];
   for (const path of walkSourceFiles(root)) {
-    const text = readFileSync31(path, "utf8");
+    const text = readFileSync32(path, "utf8");
     for (const line of findCodeqlSuppressionComments(text)) {
       hits.push({ path, line, text: text.split("\n")[line - 1] ?? "" });
     }
@@ -11396,7 +11629,7 @@ function sweepCodeqlSuppressionComments(root) {
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const scanRoot = join43(root, "cli", "src");
+  const scanRoot = join44(root, "cli", "src");
   if (!existsSync41(scanRoot)) {
     console.log(
       "\u2014 codeql-suppression guard: skipped \u2014 no cli/src in this repo, so there is no CLI source to scan."
@@ -11421,8 +11654,8 @@ async function runCodeqlSuppressionCheck() {
 }
 
 // src/lib/cognito-invite-template-guard.ts
-import { readdirSync as readdirSync18, readFileSync as readFileSync32, statSync as statSync10 } from "fs";
-import { join as join44 } from "path";
+import { readdirSync as readdirSync19, readFileSync as readFileSync33, statSync as statSync11 } from "fs";
+import { join as join45 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -11499,18 +11732,18 @@ function findModuleTerraformFiles(repoRoot) {
   const walk2 = (dir, relative11) => {
     let entries;
     try {
-      entries = readdirSync18(dir);
+      entries = readdirSync19(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees" || entry === ".venv")
         continue;
-      const full = join44(dir, entry);
+      const full = join45(dir, entry);
       const rel = `${relative11}/${entry}`;
       let isDir;
       try {
-        isDir = statSync10(full).isDirectory();
+        isDir = statSync11(full).isDirectory();
       } catch {
         continue;
       }
@@ -11521,12 +11754,12 @@ function findModuleTerraformFiles(repoRoot) {
       }
     }
   };
-  walk2(join44(repoRoot, "modules"), "modules");
+  walk2(join45(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync32(join44(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync33(join45(repoRoot, file), "utf8"))
   );
 }
 
@@ -11554,11 +11787,11 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync42, readFileSync as readFileSync33, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
-import { join as join45 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync34, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
+import { join as join46 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -11605,7 +11838,7 @@ function* templateLiterals(text) {
     i = j + 1;
   }
 }
-function lineNumber(text, index) {
+function lineNumber2(text, index) {
   let count = 1;
   for (let i = 0; i < index && i < text.length; i++) {
     if (text[i] === "\n") count += 1;
@@ -11673,7 +11906,7 @@ function extractCoreDirectPaths(rawText, file, externalBases = EXTERNAL_BASE_IDE
     if (touchesConcatenation(text, start - 1, end + 1)) {
       found.push({
         file,
-        line: lineNumber(text, start),
+        line: lineNumber2(text, start),
         raw,
         normalized: null,
         unresolvedReason: "built with string concatenation (+) \u2014 the extracted literal is a fragment, not the whole path",
@@ -11684,7 +11917,7 @@ function extractCoreDirectPaths(rawText, file, externalBases = EXTERNAL_BASE_IDE
     if (isNestedTemplateLiteralArtifact(rest)) {
       found.push({
         file,
-        line: lineNumber(text, start),
+        line: lineNumber2(text, start),
         raw,
         normalized: null,
         unresolvedReason: "contains a template literal nested inside its own interpolation \u2014 this extractor's scanner would otherwise truncate at the inner backtick, producing a corrupted path rather than a real mismatch",
@@ -11695,7 +11928,7 @@ function extractCoreDirectPaths(rawText, file, externalBases = EXTERNAL_BASE_IDE
     const normalized = stripQueryString(resolveInterpolations(rest));
     found.push({
       file,
-      line: lineNumber(text, start),
+      line: lineNumber2(text, start),
       raw,
       normalized,
       unresolvedReason: null,
@@ -11717,15 +11950,15 @@ function walkFiles(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync19(dir);
+      entries = readdirSync20(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join45(dir, entry);
+      const p = join46(dir, entry);
       let st;
       try {
-        st = statSync11(p);
+        st = statSync12(p);
       } catch {
         continue;
       }
@@ -11752,7 +11985,7 @@ function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_I
   const extracted = [];
   let rawTotal = 0;
   for (const file of files) {
-    const text = readFileSync33(file, "utf8");
+    const text = readFileSync34(file, "utf8");
     rawTotal += countRawExternalOccurrences(text, externalBases);
     extracted.push(...extractCoreDirectPaths(text, file, externalBases));
   }
@@ -11801,7 +12034,7 @@ function auditCoreRouteExtraction(apiSrcDir) {
   const prefixSet = /* @__PURE__ */ new Set();
   let rawApiRouterCount = 0;
   for (const file of files) {
-    const text = readFileSync33(file, "utf8");
+    const text = readFileSync34(file, "utf8");
     const extraction = extractCoreRoutePrefixes(text);
     rawApiRouterCount += extraction.rawApiRouterCount;
     for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
@@ -11817,10 +12050,10 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join45(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join46(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
-    raw = readFileSync33(configPath, "utf8");
+    raw = readFileSync34(configPath, "utf8");
   } catch (err) {
     throw new Error(
       `cannot resolve ${sibling}'s core: ${configPath} does not exist or is unreadable (${err.message}) -- refusing to guess which core serves this sibling.`
@@ -11840,7 +12073,7 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join45(estateDir, coreProject, "services", "api", "src");
+  const coreApiSrcDir = join46(estateDir, coreProject, "services", "api", "src");
   if (!existsSync42(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
@@ -11884,7 +12117,7 @@ function auditSiblingCoreDirectPaths(params) {
 async function runCoreDirectPathsCheck(opts = {}) {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join46(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join47(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -11900,7 +12133,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join46(root, "services", "api", "src");
+    coreApiSrcDir = join47(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -11965,8 +12198,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync46, existsSync: existsSync57 } = await import("fs");
-      if (existsSync57(messageFile)) commitMessage = readFileSync46(messageFile, "utf8");
+      const { readFileSync: readFileSync47, existsSync: existsSync57 } = await import("fs");
+      if (existsSync57(messageFile)) commitMessage = readFileSync47(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -12068,20 +12301,20 @@ ${BOLD}If the divergence is deliberate${OFF}
 
 // src/scripts/check-distribution-inventory.ts
 import { existsSync as existsSync44 } from "fs";
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 
 // src/lib/distribution-inventory.ts
-import { existsSync as existsSync43, readFileSync as readFileSync34 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync35 } from "fs";
+import { join as join48 } from "path";
 var INVENTORY_FILENAME = "distribution-inventory.json";
 function loadDistributionInventory(root) {
-  const path = join47(root, INVENTORY_FILENAME);
+  const path = join48(root, INVENTORY_FILENAME);
   if (!existsSync43(path)) {
     throw new Error(
       `${INVENTORY_FILENAME} not found at ${root} -- expected it beside core-manifest.json`
     );
   }
-  return JSON.parse(readFileSync34(path, "utf8"));
+  return JSON.parse(readFileSync35(path, "utf8"));
 }
 function validateInventory(inventory) {
   const violations = [];
@@ -12241,7 +12474,7 @@ async function runDistributionInventoryCheck(root) {
     );
     return;
   }
-  if (!existsSync44(join48(repoRoot, INVENTORY_FILENAME))) {
+  if (!existsSync44(join49(repoRoot, INVENTORY_FILENAME))) {
     console.log(
       `\u2713 distribution-inventory: skipped \u2014 no ${INVENTORY_FILENAME} at ${repoRoot}. This is a template-only registry; a checkout that legitimately has none has nothing for this guard to check.`
     );
@@ -12267,7 +12500,7 @@ async function runDistributionInventoryCheck(root) {
 }
 
 // src/scripts/check-distribution-remote-state.ts
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 async function ghExecCommand(file, args) {
   const result = await execa(file, args, { reject: false });
   return { stdout: String(result.stdout ?? ""), exitCode: result.exitCode ?? null };
@@ -12282,7 +12515,7 @@ async function runDistributionRemoteStateCheck(root) {
     }
   }
   console.log(
-    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join49(repoRoot, "distribution-inventory.json")})`
+    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join50(repoRoot, "distribution-inventory.json")})`
   );
   if (assertions.length === 0) {
     console.log("\u2713 distribution-remote-state: nothing declared to check");
@@ -12327,9 +12560,9 @@ ${assertion.ref}`;
 }
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync35, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
-import { join as join50 } from "path";
-var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
+import { readFileSync as readFileSync36, readdirSync as readdirSync21, statSync as statSync13 } from "fs";
+import { join as join51 } from "path";
+var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
 var LOG_GROUP_ARN_REF = /aws_cloudwatch_log_group\.([\w-]+)(?:\[[^\]]*\])?\.arn/g;
@@ -12350,14 +12583,14 @@ function servicePrincipalsIn(body) {
 function grantsPrincipal(body, principal) {
   return servicePrincipalsIn(body).includes(principal);
 }
-function lineNumber2(text, index) {
+function lineNumber3(text, index) {
   let count = 1;
   for (let i = 0; i < index && i < text.length; i++) {
     if (text[i] === "\n") count += 1;
   }
   return count;
 }
-function balancedBraceSpan(text, openIndex) {
+function balancedBraceSpan2(text, openIndex) {
   let depth = 0;
   for (let i = openIndex; i < text.length; i++) {
     if (text[i] === "{") depth += 1;
@@ -12368,15 +12601,15 @@ function balancedBraceSpan(text, openIndex) {
   }
   return null;
 }
-function findResourceBlocks(text, file, resourceType) {
+function findResourceBlocks2(text, file, resourceType) {
   const blocks = [];
   const pattern = new RegExp(`resource\\s+"${resourceType}"\\s+"([\\w-]+)"\\s*\\{`, "g");
   let m;
   while ((m = pattern.exec(text)) !== null) {
     const name = m[1];
-    const line = lineNumber2(text, m.index);
+    const line = lineNumber3(text, m.index);
     const openIndex = m.index + m[0].length - 1;
-    const closeIndex = balancedBraceSpan(text, openIndex);
+    const closeIndex = balancedBraceSpan2(text, openIndex);
     if (closeIndex === null) {
       blocks.push({ file, line, type: resourceType, name, body: null });
       continue;
@@ -12391,29 +12624,29 @@ function findResourceBlocks(text, file, resourceType) {
   }
   return blocks;
 }
-function countRawResourceDeclarations(text, resourceType) {
+function countRawResourceDeclarations2(text, resourceType) {
   const needle = `resource "${resourceType}"`;
   return text.split(needle).length - 1;
 }
-function walkTerraformFiles(root) {
+function walkTerraformFiles2(root) {
   const out = [];
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync20(dir);
+      entries = readdirSync21(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join50(dir, entry);
+      const p = join51(dir, entry);
       let st;
       try {
-        st = statSync12(p);
+        st = statSync13(p);
       } catch {
         continue;
       }
       if (st.isDirectory()) {
-        if (SKIP_DIRS2.has(entry)) continue;
+        if (SKIP_DIRS3.has(entry)) continue;
         walk2(p);
         continue;
       }
@@ -12437,7 +12670,7 @@ function logGroupNamesReferencedIn(body) {
   return names;
 }
 function auditEventBridgeLogPermissions(root) {
-  const files = walkTerraformFiles(root);
+  const files = walkTerraformFiles2(root);
   if (files.length === 0) {
     throw new Error(
       `auditEventBridgeLogPermissions: no .tf files found under ${root} \u2014 the guard cannot verify anything against input it cannot see. This is a hard failure, not "0 violations": fix the path, do not treat an empty scan as a clean pass.`
@@ -12448,11 +12681,11 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync35(file, "utf8");
-    rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
-    rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
-    eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
-    logResourcePolicyBlocks.push(...findResourceBlocks(text, file, LOG_RESOURCE_POLICY_TYPE));
+    const text = readFileSync36(file, "utf8");
+    rawEventTargetCount += countRawResourceDeclarations2(text, EVENT_TARGET_TYPE);
+    rawLogPolicyCount += countRawResourceDeclarations2(text, LOG_RESOURCE_POLICY_TYPE);
+    eventTargetBlocks.push(...findResourceBlocks2(text, file, EVENT_TARGET_TYPE));
+    logResourcePolicyBlocks.push(...findResourceBlocks2(text, file, LOG_RESOURCE_POLICY_TYPE));
   }
   const unterminatedBlocks = [...eventTargetBlocks, ...logResourcePolicyBlocks].filter(
     (b) => b.body === null
@@ -12539,7 +12772,7 @@ async function runEventBridgeLogPermissionCheck() {
 
 // src/scripts/check-instance-adoption.ts
 import { existsSync as existsSync45 } from "fs";
-import { join as join51 } from "path";
+import { join as join52 } from "path";
 async function runInstanceAdoptionCheck(opts = {}) {
   if (!opts.instanceDir) {
     console.error(
@@ -12555,7 +12788,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
   }
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const theirsDir = opts.theirsDir ?? root;
-  const instanceLabel = opts.instance ?? join51(opts.instanceDir).split("/").filter(Boolean).pop();
+  const instanceLabel = opts.instance ?? join52(opts.instanceDir).split("/").filter(Boolean).pop();
   const report = checkInstanceAdoption(theirsDir, opts.instanceDir);
   console.log(
     `examined ${report.examinedInstances} instance (${instanceLabel}) against ${report.registeredPairs} registered pair(s), ${report.applicablePairs} applicable to this instance, against template tree ${theirsDir}`
@@ -12577,12 +12810,12 @@ async function runInstanceAdoptionCheck(opts = {}) {
 }
 
 // src/lib/lambda-output-guard.ts
-import { readFileSync as readFileSync37 } from "fs";
-import { join as join53 } from "path";
+import { readFileSync as readFileSync38 } from "fs";
+import { join as join54 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync46, readdirSync as readdirSync21, readFileSync as readFileSync36, statSync as statSync13 } from "fs";
-import { join as join52 } from "path";
+import { existsSync as existsSync46, readdirSync as readdirSync22, readFileSync as readFileSync37, statSync as statSync14 } from "fs";
+import { join as join53 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -12596,18 +12829,18 @@ function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
 function vendoredPluginServiceDirs(repoRoot) {
-  const servicesDir = join52(repoRoot, "services");
+  const servicesDir = join53(repoRoot, "services");
   const result = /* @__PURE__ */ new Set();
   let entries;
   try {
-    entries = readdirSync21(servicesDir);
+    entries = readdirSync22(servicesDir);
   } catch {
     return result;
   }
   for (const entry of entries) {
-    const full = join52(servicesDir, entry);
-    if (!existsSync46(full) || !statSync13(full).isDirectory()) continue;
-    if (existsSync46(join52(full, "biffo.plugin.json"))) {
+    const full = join53(servicesDir, entry);
+    if (!existsSync46(full) || !statSync14(full).isDirectory()) continue;
+    if (existsSync46(join53(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
   }
@@ -12619,7 +12852,7 @@ function findWorkflowFiles(repoRoot) {
   const walk2 = (dir, relative11) => {
     let entries;
     try {
-      entries = readdirSync21(dir);
+      entries = readdirSync22(dir);
     } catch {
       return;
     }
@@ -12629,11 +12862,11 @@ function findWorkflowFiles(repoRoot) {
       if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
-      const full = join52(dir, entry);
+      const full = join53(dir, entry);
       const rel = relative11 ? `${relative11}/${entry}` : entry;
       let isDir;
       try {
-        isDir = statSync13(full).isDirectory();
+        isDir = statSync14(full).isDirectory();
       } catch {
         continue;
       }
@@ -12679,7 +12912,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync36(join52(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync37(join53(repoRoot, file), "utf8"))
   );
 }
 
@@ -12737,7 +12970,7 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync37(join53(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync38(join54(repoRoot, file), "utf8"))
   );
 }
 
@@ -12766,7 +12999,7 @@ async function runLambdaOutputCheck() {
 
 // src/scripts/check-migration-body-change.ts
 import { existsSync as existsSync47 } from "fs";
-import { join as join54 } from "path";
+import { join as join55 } from "path";
 
 // src/lib/migration-body-change-guard.ts
 function checkMigrationBodyChangeMarkers(diffs) {
@@ -12832,7 +13065,7 @@ async function runMigrationBodyChangeCheck(argv) {
     );
     return;
   }
-  if (!existsSync47(join54(root, MIGRATIONS_VERSIONS_DIR))) {
+  if (!existsSync47(join55(root, MIGRATIONS_VERSIONS_DIR))) {
     console.log(`\u2713 migration body-change guard: no ${MIGRATIONS_VERSIONS_DIR} in this repo.`);
     return;
   }
@@ -12999,8 +13232,8 @@ baseline was ${String(ratchet.baseline)}, now ${String(ratchet.count)}. See biff
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync38, readdirSync as readdirSync22 } from "fs";
-import { join as join55, relative as relative9 } from "path";
+import { readFileSync as readFileSync39, readdirSync as readdirSync23 } from "fs";
+import { join as join56, relative as relative9 } from "path";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -13096,17 +13329,17 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join55(root, dir);
+    const full = join56(root, dir);
     let entries;
     try {
-      entries = readdirSync22(full, { withFileTypes: true });
+      entries = readdirSync23(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join55(full, entry.name));
+      out.push(join56(full, entry.name));
     }
   }
   return out;
@@ -13122,7 +13355,7 @@ async function runPipeTrapCheck() {
     process.exit(1);
   }
   const findings = files.flatMap(
-    (file) => findPipeTraps(readFileSync38(file, "utf8")).map(
+    (file) => findPipeTraps(readFileSync39(file, "utf8")).map(
       (t) => `${relative9(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
@@ -13139,8 +13372,8 @@ async function runPipeTrapCheck() {
 }
 
 // src/lib/plugin-allowlist-convention.ts
-import { readFileSync as readFileSync39 } from "fs";
-import { join as join56 } from "path";
+import { readFileSync as readFileSync40 } from "fs";
+import { join as join57 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -13151,7 +13384,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync39(join56(repoRoot, relative11), "utf8");
+    return readFileSync40(join57(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -13273,32 +13506,32 @@ async function runPluginAllowlistConventionCheck() {
 
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync50 } from "fs";
-import { join as join58 } from "path";
+import { join as join59 } from "path";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync49, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join57 } from "path";
+import { existsSync as existsSync49, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
+import { join as join58 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
   if (!existsSync49(dir)) return [];
-  return readdirSync23(dir).filter((entry) => {
+  return readdirSync24(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync14(join57(dir, entry)).isDirectory();
+      return statSync15(join58(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync49(join57(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync49(join58(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join57(pluginDir2, "tests");
+  const testsDir = join58(pluginDir2, "tests");
   if (!existsSync49(testsDir)) return [];
-  if (existsSync49(join57(testsDir, "__init__.py"))) return [];
-  return readdirSync23(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
+  if (existsSync49(join58(testsDir, "__init__.py"))) return [];
+  return readdirSync24(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
   const plugins = (pluginDirs ?? subdirectories(servicesDir)).filter((name) => !name.startsWith("_")).filter((name) => name !== "api").sort();
@@ -13306,7 +13539,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join57(servicesDir, plugin))) {
+      for (const name of namesOf(join58(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -13344,7 +13577,7 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join58(root, "services");
+  const servicesDir = join59(root, "services");
   if (!existsSync50(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
@@ -13362,25 +13595,25 @@ async function runPluginCollisionCheck() {
 }
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync51, readFileSync as readFileSync40, readdirSync as readdirSync24 } from "fs";
-import { dirname as dirname10, join as join59, relative as relative10, sep as sep4 } from "path";
-var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
+import { existsSync as existsSync51, readFileSync as readFileSync41, readdirSync as readdirSync25 } from "fs";
+import { dirname as dirname10, join as join60, relative as relative10, sep as sep4 } from "path";
+var SKIP_DIRS4 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
   const found = [];
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync24(dir, { withFileTypes: true });
+      entries = readdirSync25(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join59(dir, entry.name));
+        if (SKIP_DIRS4.has(entry.name)) continue;
+        walk2(join60(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join59(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join60(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -13390,7 +13623,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync40(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync41(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -13405,14 +13638,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync51(join59(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync51(join60(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join59(root, manifest);
+    const absManifest = join60(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync51(join59(pluginDir2, "terraform"))) continue;
+    if (existsSync51(join60(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -13444,11 +13677,11 @@ async function runPluginTerraformCheck() {
 
 // src/scripts/check-plugin-tool-supply.ts
 import { existsSync as existsSync53 } from "fs";
-import { join as join61 } from "path";
+import { join as join62 } from "path";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync52, readFileSync as readFileSync41, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
-import { join as join60 } from "path";
+import { existsSync as existsSync52, readFileSync as readFileSync42, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
+import { join as join61 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -13859,13 +14092,13 @@ var OPENROUTER_MODEL_IDS = [
 function listDirs(root) {
   let entries;
   try {
-    entries = readdirSync25(root);
+    entries = readdirSync26(root);
   } catch {
     return [];
   }
   return entries.filter((e) => {
     try {
-      return statSync15(join60(root, e)).isDirectory();
+      return statSync16(join61(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -13876,15 +14109,15 @@ function walkFiles2(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync25(dir);
+      entries = readdirSync26(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join60(dir, entry);
+      const p = join61(dir, entry);
       let st;
       try {
-        st = statSync15(p);
+        st = statSync16(p);
       } catch {
         continue;
       }
@@ -13907,14 +14140,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join60(pluginDir2, "terraform");
+  const tfDir = join61(pluginDir2, "terraform");
   let entries;
   try {
-    entries = readdirSync25(tfDir);
+    entries = readdirSync26(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join60(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join61(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -14166,8 +14399,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join60("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join60(
+var CONFIG_PY_PATH = join61("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join61(
   "services",
   "api",
   "src",
@@ -14179,8 +14412,8 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join60(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join60(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configPath = join61(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join61(repoRoot, ORCHESTRATION_SCHEMA_PATH);
   const configMissing = !existsSync52(configPath);
   const orchestrationSchemaMissing = !existsSync52(orchestrationPath);
   const knownSet = new Set(knownModelIds);
@@ -14200,13 +14433,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync41(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync42(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync41(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync42(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -14253,7 +14486,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync15(join60(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync16(join61(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -14266,8 +14499,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join60(pluginsRoot, name);
-    const manifestText = readFileSync41(join60(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join61(pluginsRoot, name);
+    const manifestText = readFileSync42(join61(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -14285,13 +14518,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync41(f, "utf8")
+      text: readFileSync42(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync41(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync42(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -14365,7 +14598,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join60(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join61(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -14398,7 +14631,7 @@ function auditPluginToolSupply(pluginsRoot) {
 async function runPluginToolSupplyCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join61(root, "services", "_plugins");
+  const pluginsRoot = join62(root, "services", "_plugins");
   if (!existsSync53(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
@@ -14429,7 +14662,7 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join61(root, "services", "api");
+  const servicesApiRoot = join62(root, "services", "api");
   if (!existsSync53(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
@@ -14604,10 +14837,10 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-shared-file-reduction.ts
-import { readFileSync as readFileSync43 } from "fs";
+import { readFileSync as readFileSync44 } from "fs";
 
 // src/lib/shared-file-reduction-guard.ts
-import { readFileSync as readFileSync42 } from "fs";
+import { readFileSync as readFileSync43 } from "fs";
 var LEAF_TEST_CALLS = /* @__PURE__ */ new Set(["it", "test"]);
 var SUITE_CALLS = /* @__PURE__ */ new Set(["describe", "suite"]);
 var TEST_FILE_PATTERN = /\.(test|spec)\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
@@ -14734,7 +14967,7 @@ function formatReductionReport(report) {
 // src/scripts/check-shared-file-reduction.ts
 function readStdin() {
   try {
-    return readFileSync43(0, "utf8");
+    return readFileSync44(0, "utf8");
   } catch {
     return "";
   }
@@ -14751,15 +14984,15 @@ function pairsFromTsv(tsv) {
     const [target, existingPath, incomingPath] = fields;
     pairs.push({
       target,
-      existing: readFileSync43(existingPath, "utf8"),
-      incoming: readFileSync43(incomingPath, "utf8")
+      existing: readFileSync44(existingPath, "utf8"),
+      incoming: readFileSync44(incomingPath, "utf8")
     });
   }
   return pairs;
 }
 function loadAccepted(manifestPath) {
   if (!manifestPath) return {};
-  const parsed = JSON.parse(readFileSync43(manifestPath, "utf8"));
+  const parsed = JSON.parse(readFileSync44(manifestPath, "utf8"));
   return parsed.acceptedReductions ?? {};
 }
 async function runSharedFileReductionCheck(args) {
@@ -14767,13 +15000,13 @@ async function runSharedFileReductionCheck(args) {
   let accepted;
   try {
     if (args.pairs) {
-      pairs = pairsFromTsv(args.pairs === "-" ? readStdin() : readFileSync43(args.pairs, "utf8"));
+      pairs = pairsFromTsv(args.pairs === "-" ? readStdin() : readFileSync44(args.pairs, "utf8"));
     } else if (args.target && args.existing && args.incoming) {
       pairs = [
         {
           target: args.target,
-          existing: readFileSync43(args.existing, "utf8"),
-          incoming: readFileSync43(args.incoming, "utf8")
+          existing: readFileSync44(args.existing, "utf8"),
+          incoming: readFileSync44(args.incoming, "utf8")
         }
       ];
     } else {
@@ -14807,12 +15040,12 @@ async function runSharedFileReductionCheck(args) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync54, readdirSync as readdirSync27 } from "fs";
-import { join as join63 } from "path";
+import { existsSync as existsSync54, readdirSync as readdirSync28 } from "fs";
+import { join as join64 } from "path";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync44, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
-import { join as join62 } from "path";
+import { readFileSync as readFileSync45, readdirSync as readdirSync27, statSync as statSync17 } from "fs";
+import { join as join63 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -14870,16 +15103,16 @@ function walk(dir, base = dir) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync26(dir);
+    entries = readdirSync27(dir);
   } catch {
     return out;
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join62(dir, entry);
+    const abs = join63(dir, entry);
     let isDir;
     try {
-      isDir = statSync16(abs).isDirectory();
+      isDir = statSync17(abs).isDirectory();
     } catch {
       continue;
     }
@@ -14898,7 +15131,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync44(join62(skeletonRoot, rel), "utf8");
+        contents = readFileSync45(join63(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -14927,23 +15160,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join63(root, "_skeletons");
+  const skeletonsDir = join64(root, "_skeletons");
   let entries;
   try {
-    entries = readdirSync27(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    entries = readdirSync28(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync54(join63(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync54(join64(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join63(root, "_skeletons", name);
+    const skeletonRoot = join64(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync54(join63(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync54(join64(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -14957,7 +15190,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join63(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join64(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -14993,7 +15226,7 @@ async function runTerraformInputCheck() {
 
 // src/commands/check.ts
 var checkCommand = new Command24("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, instance-adoption, orphan-ratchet, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention, migration-body-change, distribution-inventory, distribution-remote-state) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, instance-adoption, orphan-ratchet, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention, migration-body-change, distribution-inventory, distribution-remote-state, api-gateway-integration) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -15117,6 +15350,11 @@ checkCommand.command("terraform-input").description(
 ).action(async () => {
   await runTerraformInputCheck();
 });
+checkCommand.command("api-gateway-integration").description(
+  "Refuse an env-owned aws_apigatewayv2_integration targeting a Lambda's raw, unqualified function_arn when modules/cloud/aws/api-gateway already fronts that same Lambda with an alias-qualified aws_lambda_permission (#1747) \u2014 terraform validate/plan pass on both sides in isolation, so this is the only signal before a real deploy 500s (biffo-template#1900; tabsii-platform took 11 public routes down this exact way)."
+).action(async () => {
+  await runApiGatewayIntegrationCheck();
+});
 checkCommand.command("shared-file-reduction").description(
   "Refuse a shared-files.json overwrite that would DELETE tests from the satellite it lands in (#1577) \u2014 filesIfPresent is a one-way cp and nothing ever compared the two copies. Invoked by scripts/shared-sync.sh at the moment of the write, not by per-PR CI: both sides of the comparison only exist together inside a sync run. Compares TEST TITLES in TS/JS test files and nothing else \u2014 see the guard module for what it does not catch."
 ).option("--pairs <tsv>", "TSV of target<TAB>existing<TAB>incoming lines, or - for stdin").option("--target <path>", "Single pair: path inside the satellite").option("--existing <path>", "Single pair: the satellite's current copy").option("--incoming <path>", "Single pair: the canonical copy that would replace it").option("--manifest <path>", "shared-files.json, read for acceptedReductions").action(
@@ -15148,8 +15386,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync55, readFileSync as readFileSync45 } from "fs";
-import { join as join64, resolve as resolve20 } from "path";
+import { existsSync as existsSync55, readFileSync as readFileSync46 } from "fs";
+import { join as join65, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -15544,10 +15782,10 @@ async function runDoctorFixBranches(cwd, facts, deps = { git: new GitAdapter(),
   return reapAllBareBranches(cwd, facts.branches, facts.worktrees, facts.currentBranch, deps);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join64(cwd, INSTANCE_CORE_FILE);
+  const path = join65(cwd, INSTANCE_CORE_FILE);
   if (!existsSync55(path)) return null;
   try {
-    return extractVersionField(readFileSync45(path, "utf8"));
+    return extractVersionField(readFileSync46(path, "utf8"));
   } catch {
     return null;
   }
@@ -15567,10 +15805,10 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join64(cwd, CORE_VERSION_FILE);
+  const path = join65(cwd, CORE_VERSION_FILE);
   if (!existsSync55(path)) return null;
   try {
-    const value = readFileSync45(path, "utf8").trim();
+    const value = readFileSync46(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -16093,18 +16331,18 @@ function resolveGithubToken4() {
 
 // src/lib/packaged-script-command.ts
 import { spawnSync } from "child_process";
-import { chmodSync as chmodSync2, statSync as statSync17 } from "fs";
+import { chmodSync as chmodSync2, statSync as statSync18 } from "fs";
 import { dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
 import { existsSync as existsSync56 } from "fs";
-import { dirname as dirname11, join as join65 } from "path";
+import { dirname as dirname11, join as join66 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join65(dir, relativePath);
+    const candidate = join66(dir, relativePath);
     if (existsSync56(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
@@ -16119,7 +16357,7 @@ It ships with this package via cli/scripts/packaged-root-assets.mjs; if you are
 // src/lib/packaged-script-command.ts
 function ensureExecutable(script) {
   try {
-    const { mode } = statSync17(script);
+    const { mode } = statSync18(script);
     if ((mode & 73) === 0) chmodSync2(script, mode | 493);
   } catch {
   }