@biffo/cli 0.315.9 → 0.316.1

package/dist/index.js

@@ -9169,10 +9169,10 @@ var RegistryPluginEntrySchema = z8.object({
   ui_components: z8.array(UiComponentEntrySchema).optional(),
   status: z8.enum(["active", "disabled"])
 });
-var PluginRegistrySchema = z8.object({
+var PluginRegistryEnvelopeSchema = z8.object({
   schema_version: z8.string(),
   last_updated: z8.string(),
-  plugins: z8.array(RegistryPluginEntrySchema)
+  plugins: z8.array(z8.unknown())
 });
 var DEFAULT_REGISTRY_URL = "https://raw.githubusercontent.com/keiranholloway/biffo-plugins-registry/main/plugins.json";
 var RegistryAdapter = class {
@@ -9203,14 +9203,31 @@ var RegistryAdapter = class {
         `Plugin registry at ${this.registryUrl} did not return valid JSON: ${err.message}`
       );
     }
-    const result = PluginRegistrySchema.safeParse(raw);
-    if (!result.success) {
-      const messages = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+    const envelope = PluginRegistryEnvelopeSchema.safeParse(raw);
+    if (!envelope.success) {
+      const messages = envelope.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
       throw new Error(
         `Plugin registry at ${this.registryUrl} has an invalid shape: ${messages.join("; ")}`
       );
     }
-    return result.data;
+    const plugins = [];
+    for (const [index, entry] of envelope.data.plugins.entries()) {
+      const entryResult = RegistryPluginEntrySchema.safeParse(entry);
+      if (entryResult.success) {
+        plugins.push(entryResult.data);
+        continue;
+      }
+      const label = entry !== null && typeof entry === "object" && "name" in entry && typeof entry.name === "string" ? `'${entry.name}'` : `at index ${index}`;
+      const messages = entryResult.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
+      log.warn(
+        `Plugin registry at ${this.registryUrl} has a malformed entry ${label} \u2014 skipped: ${messages.join("; ")}`
+      );
+    }
+    return {
+      schema_version: envelope.data.schema_version,
+      last_updated: envelope.data.last_updated,
+      plugins
+    };
   }
   /**
    * Resolves `name@minorVersion` (e.g. "rbac", "1.0") against the registry.
@@ -9311,8 +9328,8 @@ function printScopeSeamEntitlement(name) {
 }
 
 // src/commands/plugin-install.ts
-import { cpSync as cpSync5, existsSync as existsSync31, mkdirSync as mkdirSync11, readFileSync as readFileSync23, statSync as statSync7, writeFileSync as writeFileSync12 } from "fs";
-import { join as join33, relative as relative4, resolve as resolve12 } from "path";
+import { cpSync as cpSync5, existsSync as existsSync32, mkdirSync as mkdirSync11, readFileSync as readFileSync24, statSync as statSync7, writeFileSync as writeFileSync13 } from "fs";
+import { join as join34, relative as relative4, resolve as resolve12 } from "path";
 import chalk15 from "chalk";
 import { Command as Command15 } from "commander";
 
@@ -9409,9 +9426,122 @@ ${lines.join("\n")}
 Supply each with --config <name>=<value> (repeatable) and re-run install. For a 'secret', pass the SSM parameter PATH holding the credential (create the parameter first, e.g. \`aws ssm put-parameter --type SecureString ...\`), never the credential itself.`;
 }
 
-// src/lib/plugin-provenance.ts
+// src/lib/plugin-frontend-registry.ts
 import { existsSync as existsSync28, readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "fs";
 import { join as join29 } from "path";
+var PLUGIN_REGISTRY_RELATIVE_PATH = "apps/frontend/src/lib/plugins.ts";
+var REGISTRY_START_MARKER = "// BIFFO-PLUGIN-REGISTRY:START \u2014 managed by `biffo plugin install`/`uninstall`. Do not hand-edit.";
+var REGISTRY_END_MARKER = "// BIFFO-PLUGIN-REGISTRY:END";
+function titleFromSlug(slug) {
+  return slug.split("-").filter((word) => word.length > 0).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+function frontendUrlForSlug(slug) {
+  return `/api/v1/plugins/${slug}/ui`;
+}
+function registryPath2(cwd) {
+  return join29(cwd, PLUGIN_REGISTRY_RELATIVE_PATH);
+}
+function missingRegistryError(cwd, pluginSlug) {
+  return new Error(
+    `${PLUGIN_REGISTRY_RELATIVE_PATH} does not exist in ${cwd} \u2014 this sibling checkout has not adopted the dashboard dynamic-route pattern (ADR-0021 \xA72), so plugin "${pluginSlug}"'s \`user_frontend\` block has nowhere to register. Add the file with a managed \`INSTALLED_PLUGINS\` array (see plugin-frontend-registry.ts for the exact marker contract) before installing a user-facing plugin here, or install a plugin with no \`user_frontend\` block instead.`
+  );
+}
+function malformedRegistryError(cwd, pluginSlug) {
+  return new Error(
+    `${PLUGIN_REGISTRY_RELATIVE_PATH} in ${cwd} does not carry the managed "${REGISTRY_START_MARKER}" / "${REGISTRY_END_MARKER}" region that plugin "${pluginSlug}"'s install needs to write into. Add that managed region around the INSTALLED_PLUGINS array contents (see plugin-frontend-registry.ts's module docstring) rather than hand-editing the array.`
+  );
+}
+function findManagedRegion(source) {
+  const startIdx = source.indexOf(REGISTRY_START_MARKER);
+  if (startIdx === -1) return null;
+  const bodyStart = startIdx + REGISTRY_START_MARKER.length;
+  const endIdx = source.indexOf(REGISTRY_END_MARKER, bodyStart);
+  if (endIdx === -1) return null;
+  return {
+    region: { before: source.slice(0, bodyStart), after: source.slice(endIdx) },
+    body: source.slice(bodyStart, endIdx)
+  };
+}
+var SLUG_FIELD_PATTERN = /\bslug\s*:\s*(['"])([a-zA-Z0-9_-]+)\1/;
+function extractSlug(entryRaw) {
+  const match = SLUG_FIELD_PATTERN.exec(entryRaw);
+  return match ? match[2] : null;
+}
+function splitEntries(body) {
+  const entries = [];
+  const n = body.length;
+  let i = 0;
+  while (i < n) {
+    const ch = body[i];
+    if (ch !== "{") {
+      i++;
+      continue;
+    }
+    const start = i + 1;
+    let depth = 1;
+    let j = start;
+    let quote = null;
+    while (j < n && depth > 0) {
+      const c = body[j];
+      if (quote) {
+        if (c === "\\") {
+          j += 2;
+          continue;
+        }
+        if (c === quote) quote = null;
+      } else if (c === '"' || c === "'" || c === "`") {
+        quote = c;
+      } else if (c === "{") {
+        depth++;
+      } else if (c === "}") {
+        depth--;
+      }
+      j++;
+    }
+    const raw = body.slice(start, j - 1);
+    entries.push({ raw, slug: extractSlug(raw) });
+    i = j;
+  }
+  return entries;
+}
+function serializeEntryRaw(entry) {
+  return `
+    slug: ${JSON.stringify(entry.slug)},
+    title: ${JSON.stringify(entry.title)},
+    frontendUrl: ${JSON.stringify(entry.frontendUrl)},
+  `;
+}
+function assertPluginRegistryReady(cwd, pluginSlug) {
+  readManagedEntries(cwd, pluginSlug);
+}
+function readManagedEntries(cwd, pluginSlug) {
+  const path = registryPath2(cwd);
+  if (!existsSync28(path)) throw missingRegistryError(cwd, pluginSlug);
+  const source = readFileSync21(path, "utf8");
+  const found = findManagedRegion(source);
+  if (!found) throw malformedRegistryError(cwd, pluginSlug);
+  return { source, region: found.region, entries: splitEntries(found.body) };
+}
+function writeManagedEntries(cwd, region, entries) {
+  const body = entries.length > 0 ? "\n" + entries.map((e) => `  {${e.raw}},
+`).join("") : "\n";
+  writeFileSync10(registryPath2(cwd), region.before + body + region.after, "utf8");
+}
+function upsertPluginRegistryEntry(cwd, entry) {
+  const { region, entries } = readManagedEntries(cwd, entry.slug);
+  const preserved = entries.filter((e) => e.slug !== entry.slug);
+  const next = { raw: serializeEntryRaw(entry), slug: entry.slug };
+  writeManagedEntries(cwd, region, [...preserved, next]);
+}
+function removePluginRegistryEntry(cwd, pluginSlug) {
+  const { region, entries } = readManagedEntries(cwd, pluginSlug);
+  const next = entries.filter((e) => e.slug !== pluginSlug);
+  writeManagedEntries(cwd, region, next);
+}
+
+// src/lib/plugin-provenance.ts
+import { existsSync as existsSync29, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "fs";
+import { join as join30 } from "path";
 var PLUGIN_PROVENANCE_FILENAME = ".biffo-plugin-provenance.json";
 function isPluginProvenance(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -9419,11 +9549,11 @@ function isPluginProvenance(value) {
   return typeof v["origin"] === "string" && (typeof v["ref"] === "string" || v["ref"] === null) && (typeof v["sha"] === "string" || v["sha"] === null) && typeof v["recordedAt"] === "string" && typeof v["inTree"] === "boolean";
 }
 function readProvenance(pluginDir2) {
-  const path = join29(pluginDir2, PLUGIN_PROVENANCE_FILENAME);
-  if (!existsSync28(path)) return { status: "absent" };
+  const path = join30(pluginDir2, PLUGIN_PROVENANCE_FILENAME);
+  if (!existsSync29(path)) return { status: "absent" };
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync21(path, "utf8"));
+    parsed = JSON.parse(readFileSync22(path, "utf8"));
   } catch (err) {
     return {
       status: "invalid",
@@ -9439,7 +9569,7 @@ function readProvenance(pluginDir2) {
   return { status: "present", record: parsed };
 }
 function writePluginProvenance(pluginDir2, record) {
-  writeFileSync10(join29(pluginDir2, PLUGIN_PROVENANCE_FILENAME), `${JSON.stringify(record, null, 2)}
+  writeFileSync11(join30(pluginDir2, PLUGIN_PROVENANCE_FILENAME), `${JSON.stringify(record, null, 2)}
 `);
 }
 function reconcileProvenance(previous, next) {
@@ -9489,8 +9619,8 @@ async function tryGit(cwd, args) {
 }
 
 // src/lib/plugin-seed-vendor.ts
-import { cpSync as cpSync3, existsSync as existsSync29, mkdirSync as mkdirSync9, readdirSync as readdirSync12, rmSync as rmSync8 } from "fs";
-import { join as join30 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync30, mkdirSync as mkdirSync9, readdirSync as readdirSync12, rmSync as rmSync8 } from "fs";
+import { join as join31 } from "path";
 var VENDOR_PREFIX = "_plugin-";
 function pluginSeedImportDir(pluginName) {
   return `db/imports/${VENDOR_PREFIX}${pluginName}`;
@@ -9499,8 +9629,8 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
   if (!manifest.seed) {
     return { vendored: false };
   }
-  const sourceSeedDir = join30(pluginSourceDir, manifest.seed.dir);
-  if (!existsSync29(sourceSeedDir)) {
+  const sourceSeedDir = join31(pluginSourceDir, manifest.seed.dir);
+  if (!existsSync30(sourceSeedDir)) {
     throw new Error(
       `${manifest.name}'s manifest declares seed.dir '${manifest.seed.dir}', but ${sourceSeedDir} does not exist in the plugin's source.`
     );
@@ -9512,11 +9642,11 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
     );
   }
   const relTargetDir = pluginSeedImportDir(manifest.name);
-  const targetDir = join30(cwd, relTargetDir);
+  const targetDir = join31(cwd, relTargetDir);
   rmSync8(targetDir, { recursive: true, force: true });
   mkdirSync9(targetDir, { recursive: true });
   for (const file of sqlFiles) {
-    cpSync3(join30(sourceSeedDir, file), join30(targetDir, file));
+    cpSync3(join31(sourceSeedDir, file), join31(targetDir, file));
   }
   log.success(
     `Vendored ${sqlFiles.length} seed file(s) to ${relTargetDir}/ (baseline_tables: ${manifest.seed.baseline_tables.join(", ") || "none declared"})`
@@ -9529,7 +9659,7 @@ function vendorPluginSeed(pluginSourceDir, manifest, cwd) {
 
 // src/lib/plugin-source-copy.ts
 import { copyFileSync as copyFileSync2, cpSync as cpSync4, mkdirSync as mkdirSync10 } from "fs";
-import { basename as basename2, dirname as dirname9, join as join31 } from "path";
+import { basename as basename2, dirname as dirname9, join as join32 } from "path";
 var LOCAL_COPY_EXCLUDES = /* @__PURE__ */ new Set([
   ".git",
   ".venv",
@@ -9545,9 +9675,9 @@ async function copyPluginSource(sourceDir, targetDir) {
   if (await isGitWorkingTree2(sourceDir)) {
     const files = await listGitFiles(sourceDir);
     for (const relPath of files) {
-      const destPath = join31(targetDir, relPath);
+      const destPath = join32(targetDir, relPath);
       mkdirSync10(dirname9(destPath), { recursive: true });
-      copyFileSync2(join31(sourceDir, relPath), destPath);
+      copyFileSync2(join32(sourceDir, relPath), destPath);
     }
     return { usedGitIgnoreRules: true };
   }
@@ -9579,8 +9709,8 @@ async function listGitFiles(dir) {
 }
 
 // src/lib/plugin-workspace-sources.ts
-import { existsSync as existsSync30, readdirSync as readdirSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "fs";
-import { join as join32 } from "path";
+import { existsSync as existsSync31, readdirSync as readdirSync13, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "fs";
+import { join as join33 } from "path";
 function readTomlStringArray(text, key) {
   const open = new RegExp(`^${key}\\s*=\\s*\\[`, "m").exec(text);
   if (!open) return [];
@@ -9624,9 +9754,9 @@ function readDependencyNames(text) {
   return readTomlStringArray(text, "dependencies").map((dep) => /^\s*([A-Za-z0-9._-]+)/.exec(dep)?.[1] ?? "").filter(Boolean);
 }
 function workspaceMemberNames(instanceRoot) {
-  const rootPyproject = join32(instanceRoot, "pyproject.toml");
-  if (!existsSync30(rootPyproject)) return /* @__PURE__ */ new Set();
-  const text = readFileSync22(rootPyproject, "utf8");
+  const rootPyproject = join33(instanceRoot, "pyproject.toml");
+  if (!existsSync31(rootPyproject)) return /* @__PURE__ */ new Set();
+  const text = readFileSync23(rootPyproject, "utf8");
   const members = readTomlStringArray(text, "members");
   const excluded = new Set(readTomlStringArray(text, "exclude"));
   const dirs = [];
@@ -9635,7 +9765,7 @@ function workspaceMemberNames(instanceRoot) {
       const base = member.slice(0, -2);
       let entries;
       try {
-        entries = readdirSync13(join32(instanceRoot, base), { withFileTypes: true });
+        entries = readdirSync13(join33(instanceRoot, base), { withFileTypes: true });
       } catch {
         continue;
       }
@@ -9649,9 +9779,9 @@ function workspaceMemberNames(instanceRoot) {
   }
   const names = /* @__PURE__ */ new Set();
   for (const dir of dirs) {
-    const pp = join32(instanceRoot, dir, "pyproject.toml");
-    if (!existsSync30(pp)) continue;
-    const name = readProjectName(readFileSync22(pp, "utf8"));
+    const pp = join33(instanceRoot, dir, "pyproject.toml");
+    if (!existsSync31(pp)) continue;
+    const name = readProjectName(readFileSync23(pp, "utf8"));
     if (name) names.add(name);
   }
   return names;
@@ -9662,8 +9792,8 @@ function existingWorkspaceSources(text) {
   );
 }
 function ensureWorkspaceSources(pluginPyprojectPath, memberNames) {
-  if (!existsSync30(pluginPyprojectPath) || memberNames.size === 0) return [];
-  const text = readFileSync22(pluginPyprojectPath, "utf8");
+  if (!existsSync31(pluginPyprojectPath) || memberNames.size === 0) return [];
+  const text = readFileSync23(pluginPyprojectPath, "utf8");
   const already = existingWorkspaceSources(text);
   const toAdd = readDependencyNames(text).filter((n) => memberNames.has(n) && !already.has(n));
   if (toAdd.length === 0) return [];
@@ -9683,12 +9813,12 @@ ${lines.join("\n")}${text.slice(insertAt)}`;
 ${lines.join("\n")}
 `;
   }
-  writeFileSync11(pluginPyprojectPath, updated);
+  writeFileSync12(pluginPyprojectPath, updated);
   return toAdd;
 }
 function applyWorkspaceSources(targetDir, cwd, relTargetDir) {
-  const pluginPyproject = join32(targetDir, "pyproject.toml");
-  if (!existsSync30(pluginPyproject)) return;
+  const pluginPyproject = join33(targetDir, "pyproject.toml");
+  if (!existsSync31(pluginPyproject)) return;
   const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(cwd));
   if (sourced.length > 0) {
     log.info(
@@ -9734,14 +9864,14 @@ var pluginInstallCommand = new Command15("install").description(
   }
 );
 function resolveLocalPlugin(localPath) {
-  if (!existsSync31(localPath)) {
+  if (!existsSync32(localPath)) {
     throw new Error(`--local path does not exist: ${localPath}`);
   }
   if (!statSync7(localPath).isDirectory()) {
     throw new Error(`--local path is not a directory: ${localPath}`);
   }
-  const manifestPath = join33(localPath, "biffo.plugin.json");
-  if (!existsSync31(manifestPath)) {
+  const manifestPath = join34(localPath, "biffo.plugin.json");
+  if (!existsSync32(manifestPath)) {
     throw new Error(
       `${localPath} does not contain a biffo.plugin.json manifest at its root \u2014 is it a plugin directory? (Scaffold one with \`biffo plugin create <name>\`.)`
     );
@@ -9767,8 +9897,8 @@ function parsePluginTarget(target) {
 async function cloneAndValidatePlugin(entry, git) {
   const tmpDir = await git.cloneToTemp(entry.repo, `biffo-plugin-${entry.name}`);
   try {
-    const manifestPath = join33(tmpDir, "biffo.plugin.json");
-    if (!existsSync31(manifestPath)) {
+    const manifestPath = join34(tmpDir, "biffo.plugin.json");
+    if (!existsSync32(manifestPath)) {
       throw new Error(
         `Plugin repo ${entry.repo} does not contain a biffo.plugin.json manifest at its root.`
       );
@@ -9796,8 +9926,8 @@ async function runPluginInstall(target, options, deps) {
       `Nothing to install. Pass a registry target (e.g. \`biffo plugin install acme-crm@1.0\`) or a local plugin directory (\`biffo plugin install --local services/acme-crm\`).`
     );
   }
-  const servicesDir = join33(options.cwd, "services");
-  if (!existsSync31(servicesDir)) {
+  const servicesDir = join34(options.cwd, "services");
+  if (!existsSync32(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -9815,10 +9945,10 @@ async function runPluginInstall(target, options, deps) {
   }
   const pluginName = entry ? entry.name : source.name;
   const relTargetDir = pluginDir(pluginName, "third-party");
-  const targetDir = join33(options.cwd, relTargetDir);
-  const modulesDir = join33(options.cwd, "modules", "plugins", pluginName);
+  const targetDir = join34(options.cwd, relTargetDir);
+  const modulesDir = join34(options.cwd, "modules", "plugins", pluginName);
   const inTreeSource = options.local !== void 0 && resolve12(options.local) === resolve12(targetDir);
-  if (existsSync31(targetDir) && !inTreeSource) {
+  if (existsSync32(targetDir) && !inTreeSource) {
     throw new Error(
       `Plugin '${pluginName}' is already installed at ${relTargetDir}/. Remove it first, or wait for a future 'biffo plugin upgrade' command.`
     );
@@ -9850,7 +9980,7 @@ async function runPluginInstall(target, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
-    const retiredShapeReasons = findRetiredFrontendShape(join33(source.sourceDir, "terraform"));
+    const retiredShapeReasons = findRetiredFrontendShape(join34(source.sourceDir, "terraform"));
     if (retiredShapeReasons.length > 0) {
       throw new Error(retiredFrontendShapeError(pluginName, retiredShapeReasons));
     }
@@ -9862,6 +9992,9 @@ async function runPluginInstall(target, options, deps) {
     if (configSupply.missingRequired.length > 0) {
       throw new Error(missingRequiredConfigMessage(pluginName, configSupply.missingRequired));
     }
+    if (manifest.user_frontend) {
+      assertPluginRegistryReady(options.cwd, pluginName);
+    }
     if (inTreeSource) {
       log.info(`${relTargetDir}/ is already in this checkout \u2014 installing in place.`);
     } else {
@@ -9874,8 +10007,8 @@ async function runPluginInstall(target, options, deps) {
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, relTargetDir);
     const stagePaths = [relTargetDir];
-    const tfSourceDir = join33(targetDir, "terraform");
-    if (existsSync31(tfSourceDir)) {
+    const tfSourceDir = join34(targetDir, "terraform");
+    if (existsSync32(tfSourceDir)) {
       mkdirSync11(modulesDir, { recursive: true });
       cpSync5(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${pluginName}`);
@@ -9921,8 +10054,8 @@ async function runPluginInstall(target, options, deps) {
       stagePaths.push(seedResult.stagedPath);
     }
     if (manifest.config.length > 0) {
-      const configFilePath = join33(targetDir, "biffo.plugin-config.json");
-      writeFileSync12(
+      const configFilePath = join34(targetDir, "biffo.plugin-config.json");
+      writeFileSync13(
         configFilePath,
         JSON.stringify(
           {
@@ -9945,6 +10078,15 @@ async function runPluginInstall(target, options, deps) {
         `Recorded ${configSupply.resolved.length}/${manifest.config.length} declared config value(s) at ${relative4(options.cwd, configFilePath)}`
       );
     }
+    if (manifest.user_frontend) {
+      upsertPluginRegistryEntry(options.cwd, {
+        slug: pluginName,
+        title: titleFromSlug(pluginName),
+        frontendUrl: frontendUrlForSlug(pluginName)
+      });
+      stagePaths.push(PLUGIN_REGISTRY_RELATIVE_PATH);
+      log.success(`Registered ${pluginName} in ${PLUGIN_REGISTRY_RELATIVE_PATH}`);
+    }
     const commitMessage = `feat(plugins): install ${pluginName}@${source.version}`;
     await deps.git.add(options.cwd, stagePaths);
     await deps.git.commit(options.cwd, commitMessage);
@@ -9979,7 +10121,7 @@ function printConfigWiringInstructions(pluginName, resolved) {
 }
 function parseManifestFile(path) {
   try {
-    return JSON.parse(readFileSync23(path, "utf8"));
+    return JSON.parse(readFileSync24(path, "utf8"));
   } catch (err) {
     throw new Error(`Could not parse ${path} as JSON: ${err.message}`);
   }
@@ -10033,8 +10175,8 @@ function printDryRun4(entry, source, relTargetDir, inTreeSource, suppliedConfig
 }
 
 // src/commands/plugin-list.ts
-import { existsSync as existsSync32, readFileSync as readFileSync24 } from "fs";
-import { join as join34, resolve as resolve13 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync25 } from "fs";
+import { join as join35, resolve as resolve13 } from "path";
 import chalk16 from "chalk";
 import { Command as Command16 } from "commander";
 var pluginListCommand = new Command16("list").description("List plugins installed in this project checkout").option("--cwd <path>", "Project root to scan (defaults to the current directory)").action(async (options) => {
@@ -10047,8 +10189,8 @@ var pluginListCommand = new Command16("list").description("List plugins installe
   }
 });
 async function runPluginList(options) {
-  const servicesDir = join34(options.cwd, "services");
-  if (!existsSync32(servicesDir)) {
+  const servicesDir = join35(options.cwd, "services");
+  if (!existsSync33(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -10056,7 +10198,7 @@ async function runPluginList(options) {
   const plugins = [];
   for (const location of findInstalledPlugins(options.cwd)) {
     try {
-      const manifest = validateManifest(JSON.parse(readFileSync24(location.manifestPath, "utf8")));
+      const manifest = validateManifest(JSON.parse(readFileSync25(location.manifestPath, "utf8")));
       plugins.push({
         name: manifest.name,
         version: manifest.version,
@@ -10097,30 +10239,35 @@ import { resolve as resolve14 } from "path";
 import { Command as Command17 } from "commander";
 
 // src/lib/plugin-staleness.ts
-import { existsSync as existsSync33, readFileSync as readFileSync25, readdirSync as readdirSync14, statSync as statSync8 } from "fs";
-import { join as join35, relative as relative5 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync26, readdirSync as readdirSync14, statSync as statSync8 } from "fs";
+import { join as join36, relative as relative5 } from "path";
 function discoverVendoredPlugins(servicesDir) {
-  if (!existsSync33(servicesDir)) return [];
-  return readdirSync14(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync33(join35(servicesDir, name, "biffo.plugin.json"))).sort();
+  if (!existsSync34(servicesDir)) return [];
+  return readdirSync14(servicesDir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("_") && e.name !== "api").map((e) => e.name).filter((name) => existsSync34(join36(servicesDir, name, "biffo.plugin.json"))).sort();
 }
 async function checkPluginStaleness(cwd, deps) {
-  const servicesDir = join35(cwd, "services");
+  const servicesDir = join36(cwd, "services");
   const names = discoverVendoredPlugins(servicesDir);
   let registryRepoByName = null;
+  let registryFetchFailure = null;
   const resolveRegistryRepo = async (name) => {
-    if (registryRepoByName === null) {
-      registryRepoByName = /* @__PURE__ */ new Map();
+    if (registryRepoByName === null && registryFetchFailure === null) {
       try {
         const reg = await deps.registry.fetchRegistry();
+        registryRepoByName = /* @__PURE__ */ new Map();
         for (const entry of reg.plugins) registryRepoByName.set(entry.name, entry.repo);
-      } catch {
+      } catch (err) {
+        registryFetchFailure = err.message;
       }
     }
-    return registryRepoByName.get(name) ?? null;
+    if (registryFetchFailure !== null) {
+      return { repo: null, fetchFailure: registryFetchFailure };
+    }
+    return { repo: registryRepoByName?.get(name) ?? null, fetchFailure: null };
   };
   const results = [];
   for (const name of names) {
-    results.push(await checkOnePlugin(join35(servicesDir, name), name, resolveRegistryRepo, deps.git));
+    results.push(await checkOnePlugin(join36(servicesDir, name), name, resolveRegistryRepo, deps.git));
   }
   return results;
 }
@@ -10146,19 +10293,28 @@ async function checkOnePlugin(pluginDir2, name, resolveRegistryRepo, git) {
   if (record?.sha && isFetchableUrl(record.origin)) {
     return checkViaProvenance(name, record, record.origin, git);
   }
-  const localOrigin = record && !isFetchableUrl(record.origin) && existsSync33(record.origin) ? record.origin : null;
+  const localOrigin = record && !isFetchableUrl(record.origin) && existsSync34(record.origin) ? record.origin : null;
   if (localOrigin) {
     return checkViaContentDiff(name, pluginDir2, localOrigin, { isLocalDir: true }, git);
   }
-  const registryRepo = await resolveRegistryRepo(name);
-  if (!registryRepo) {
+  const lookup = await resolveRegistryRepo(name);
+  if (!lookup.repo) {
+    if (lookup.fetchFailure) {
+      return {
+        name,
+        status: "cannot-tell",
+        method: "unresolvable",
+        detail: record ? `provenance records origin '${record.origin}', which is neither a reachable git URL nor a local directory that still exists, and the plugin registry could not be fetched to resolve '${name}' by name either: ${lookup.fetchFailure}` : `no provenance recorded (vendored before #1547) and the plugin registry could not be fetched to resolve '${name}' by name: ${lookup.fetchFailure}`
+      };
+    }
     return {
       name,
       status: "cannot-tell",
       method: "unresolvable",
-      detail: record ? `provenance records origin '${record.origin}', which is neither a reachable git URL nor a local directory that still exists, and '${name}' was not found in the plugin registry either` : `no provenance recorded (vendored before #1547, or an unreachable registry) and '${name}' was not found in the plugin registry \u2014 nothing to compare against`
+      detail: record ? `provenance records origin '${record.origin}', which is neither a reachable git URL nor a local directory that still exists, and '${name}' was not found in the plugin registry either` : `no provenance recorded (vendored before #1547) and '${name}' was not found in the plugin registry \u2014 nothing to compare against`
     };
   }
+  const registryRepo = lookup.repo;
   if (record?.sha) {
     return checkViaProvenance(name, record, registryRepo, git);
   }
@@ -10280,8 +10436,8 @@ async function countDifferingFiles(sourceDir, pluginDir2) {
       differing++;
       continue;
     }
-    const a = readFileSync25(join35(sourceDir, relPath));
-    const b = readFileSync25(join35(pluginDir2, relPath));
+    const a = readFileSync26(join36(sourceDir, relPath));
+    const b = readFileSync26(join36(pluginDir2, relPath));
     if (!a.equals(b)) differing++;
   }
   return differing;
@@ -10296,11 +10452,11 @@ function vendorFileList(dir) {
   return new Set(walkExcluding(dir, dir, LOCAL_COPY_EXCLUDES));
 }
 function walkExcluding(root, dir, excludes) {
-  if (!existsSync33(dir)) return [];
+  if (!existsSync34(dir)) return [];
   const out = [];
   for (const entry of readdirSync14(dir)) {
     if (excludes.has(entry) || entry === ".git") continue;
-    const full = join35(dir, entry);
+    const full = join36(dir, entry);
     let stat;
     try {
       stat = statSync8(full);
@@ -10357,8 +10513,8 @@ var pluginStalenessCommand = new Command17("staleness").description(
 });
 
 // src/commands/plugin-sync-migrations.ts
-import { existsSync as existsSync34 } from "fs";
-import { join as join36, relative as relative6, resolve as resolve15 } from "path";
+import { existsSync as existsSync35 } from "fs";
+import { join as join37, relative as relative6, resolve as resolve15 } from "path";
 import chalk17 from "chalk";
 import { Command as Command18 } from "commander";
 var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
@@ -10379,11 +10535,11 @@ var pluginSyncMigrationsCommand = new Command18("sync-migrations").description(
   }
 );
 async function runPluginSyncMigrations(name, options, deps) {
-  const servicesDir = join36(options.cwd, "services");
-  if (!existsSync34(servicesDir)) {
+  const servicesDir = join37(options.cwd, "services");
+  if (!existsSync35(servicesDir)) {
     throw new Error(`${servicesDir} does not exist \u2014 is ${options.cwd} a Biffo project checkout?`);
   }
-  if (name && !existsSync34(join36(servicesDir, name, "biffo.plugin.json"))) {
+  if (name && !existsSync35(join37(servicesDir, name, "biffo.plugin.json"))) {
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
   if (options.dryRun) {
@@ -10419,8 +10575,8 @@ async function runPluginSyncMigrations(name, options, deps) {
 }
 
 // src/commands/plugin-uninstall.ts
-import { existsSync as existsSync35, readFileSync as readFileSync26, rmSync as rmSync9 } from "fs";
-import { join as join37, resolve as resolve16 } from "path";
+import { existsSync as existsSync36, readFileSync as readFileSync27, rmSync as rmSync9 } from "fs";
+import { join as join38, resolve as resolve16 } from "path";
 import chalk18 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer6 from "inquirer";
@@ -10452,28 +10608,33 @@ async function runPluginUninstall(name, options, deps) {
   if (!NAME_PATTERN2.test(name)) {
     throw new Error(`Invalid plugin name '${name}'. Expected a lowercase kebab-case slug.`);
   }
-  const servicesDir = join37(options.cwd, "services");
-  if (!existsSync35(servicesDir)) {
+  const servicesDir = join38(options.cwd, "services");
+  if (!existsSync36(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
-  const targetDir = join37(servicesDir, name);
-  if (!existsSync35(targetDir)) {
-    const firstParty = join37(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
-    if (existsSync35(firstParty)) {
+  const targetDir = join38(servicesDir, name);
+  if (!existsSync36(targetDir)) {
+    const firstParty = join38(servicesDir, FIRST_PARTY_PLUGINS_DIR, name);
+    if (existsSync36(firstParty)) {
       throw new Error(
         `Plugin '${name}' is a first-party plugin at ${pluginDir(name, "first-party")}/, which is template-owned \u2014 \`biffo core upgrade\` would restore it on the next upgrade. Disable it instead by removing '${name}' from \`enabled_plugins\` in infra/environments/<env>/main.tf and re-applying.`
       );
     }
     throw new Error(`Plugin '${name}' is not installed at services/${name}/.`);
   }
-  const version = readInstalledVersion(targetDir);
-  const modulesDir = join37(options.cwd, "modules", "plugins", name);
+  const installedManifest = readInstalledManifest(targetDir);
+  const version = installedManifest?.version;
+  const modulesDir = join38(options.cwd, "modules", "plugins", name);
   const stagePaths = [`services/${name}`];
-  if (existsSync35(modulesDir)) {
+  if (existsSync36(modulesDir)) {
     stagePaths.push(`modules/plugins/${name}`);
   }
+  const hasUserFrontend = installedManifest?.user_frontend !== void 0;
+  if (hasUserFrontend) {
+    stagePaths.push(PLUGIN_REGISTRY_RELATIVE_PATH);
+  }
   if (options.dryRun) {
     printDryRun5(name, version, stagePaths, options.keepData);
     return;
@@ -10491,7 +10652,10 @@ async function runPluginUninstall(name, options, deps) {
       `${options.cwd} is not a git repository \u2014 biffo plugin uninstall must be run from a Biffo project checkout.`
     );
   }
-  if (existsSync35(modulesDir)) {
+  if (hasUserFrontend) {
+    assertPluginRegistryReady(options.cwd, name);
+  }
+  if (existsSync36(modulesDir)) {
     const refs = findPluginModuleReferences(options.cwd, name).filter(
       (r) => !r.file.endsWith(`/${GENERATED_TF_FILE}`) && r.file !== GENERATED_TF_FILE
     );
@@ -10506,7 +10670,7 @@ Remove the reference(s) above first, then re-run uninstall.`
   }
   rmSync9(targetDir, { recursive: true, force: true });
   log.success(`Removed services/${name}/`);
-  if (existsSync35(modulesDir)) {
+  if (existsSync36(modulesDir)) {
     rmSync9(modulesDir, { recursive: true, force: true });
     log.success(`Removed modules/plugins/${name}/`);
     const wiring = syncPluginTerraform(options.cwd);
@@ -10517,6 +10681,10 @@ Remove the reference(s) above first, then re-run uninstall.`
       );
     }
   }
+  if (hasUserFrontend) {
+    removePluginRegistryEntry(options.cwd, name);
+    log.success(`Removed ${name} from ${PLUGIN_REGISTRY_RELATIVE_PATH}`);
+  }
   const label = version ? `${name}@${version}` : name;
   const commitMessage = `chore(plugins): uninstall ${label}`;
   await deps.git.add(options.cwd, stagePaths);
@@ -10541,17 +10709,17 @@ Remove the reference(s) above first, then re-run uninstall.`
       "Any tables this plugin created remain in the database, and its migration file at services/api/migrations/versions/ is NOT removed (it is a permanent historical record \u2014 see notes). Dropping tables, if desired, requires a manual Alembic migration written against the Core API."
     );
   }
-  if (existsSync35(join37(options.cwd, pluginSeedImportDir(name)))) {
+  if (existsSync36(join38(options.cwd, pluginSeedImportDir(name)))) {
     log.warn(
       `${pluginSeedImportDir(name)}/ (this plugin's vendored baseline-row seed, biffo-template#1554) was NOT removed either, for the same reason \u2014 see notes. Delete it by hand if you are certain the rows it applied should go too, but note nothing drops rows already applied to the database; that still needs a manual migration.`
     );
   }
 }
-function readInstalledVersion(targetDir) {
-  const manifestPath = join37(targetDir, "biffo.plugin.json");
-  if (!existsSync35(manifestPath)) return void 0;
+function readInstalledManifest(targetDir) {
+  const manifestPath = join38(targetDir, "biffo.plugin.json");
+  if (!existsSync36(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync26(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync27(manifestPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -10584,8 +10752,8 @@ function printDryRun5(name, version, stagePaths, keepData) {
 }
 
 // src/commands/plugin-upgrade.ts
-import { cpSync as cpSync6, existsSync as existsSync36, mkdirSync as mkdirSync12, readFileSync as readFileSync27, rmSync as rmSync10 } from "fs";
-import { join as join38, relative as relative7, resolve as resolve17 } from "path";
+import { cpSync as cpSync6, existsSync as existsSync37, mkdirSync as mkdirSync12, readFileSync as readFileSync28, rmSync as rmSync10 } from "fs";
+import { join as join39, relative as relative7, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
 import { Command as Command20 } from "commander";
 import inquirer7 from "inquirer";
@@ -10632,8 +10800,8 @@ async function runPluginUpgrade(target, options, deps) {
       `Nothing to upgrade. Pass a registry target (e.g. \`biffo plugin upgrade acme-crm@1.1\`) or a local checkout to refresh from (\`biffo plugin upgrade --local ../acme-crm\`).`
     );
   }
-  const servicesDir = join38(options.cwd, "services");
-  if (!existsSync36(servicesDir)) {
+  const servicesDir = join39(options.cwd, "services");
+  if (!existsSync37(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
@@ -10642,13 +10810,13 @@ async function runPluginUpgrade(target, options, deps) {
     return runLocalPluginRefresh(options.local, options, deps);
   }
   const { name, minor } = parsePluginTarget(target);
-  const targetDir = join38(servicesDir, name);
-  if (!existsSync36(targetDir)) {
+  const targetDir = join39(servicesDir, name);
+  if (!existsSync37(targetDir)) {
     throw new Error(
       `Plugin '${name}' is not installed at services/${name}/. Use 'biffo plugin install ${name}@${minor}' instead.`
     );
   }
-  const currentVersion = readInstalledVersion2(targetDir);
+  const currentVersion = readInstalledVersion(targetDir);
   log.info(`Resolving ${name}@${minor} from the plugin registry...`);
   const entry = await deps.registry.resolvePlugin(name, minor);
   log.success(`Resolved ${entry.name}@${entry.version} \u2014 ${entry.repo}`);
@@ -10657,7 +10825,7 @@ async function runPluginUpgrade(target, options, deps) {
       `Plugin declares required_core_version '${entry.required_core_version}'. The CLI cannot verify this against your deployment \u2014 the Core API exposes no version endpoint and services/api/pyproject.toml's version is a static placeholder, not a real release marker. Confirm compatibility yourself before deploying.`
     );
   }
-  const modulesDir = join38(options.cwd, "modules", "plugins", entry.name);
+  const modulesDir = join39(options.cwd, "modules", "plugins", entry.name);
   if (options.dryRun) {
     printDryRun6(entry, currentVersion);
     return;
@@ -10685,11 +10853,11 @@ async function runPluginUpgrade(target, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
-    const retiredShapeReasons = findRetiredFrontendShape(join38(tmpDir, "terraform"));
+    const retiredShapeReasons = findRetiredFrontendShape(join39(tmpDir, "terraform"));
     if (retiredShapeReasons.length > 0) {
       throw new Error(retiredFrontendShapeError(entry.name, retiredShapeReasons));
     }
-    if (!existsSync36(join38(tmpDir, "terraform"))) {
+    if (!existsSync37(join39(tmpDir, "terraform"))) {
       refuseIfModuleStillReferenced(options.cwd, modulesDir, entry.name);
     }
     const previousProvenance = readProvenance(targetDir);
@@ -10706,11 +10874,11 @@ async function runPluginUpgrade(target, options, deps) {
     applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
     const newPyproject = readPyprojectIfPresent(targetDir);
     const stagePaths = [`services/${entry.name}`];
-    if (existsSync36(modulesDir)) {
+    if (existsSync37(modulesDir)) {
       rmSync10(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join38(targetDir, "terraform");
-    if (existsSync36(tfSourceDir)) {
+    const tfSourceDir = join39(targetDir, "terraform");
+    if (existsSync37(tfSourceDir)) {
       mkdirSync12(modulesDir, { recursive: true });
       cpSync6(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${entry.name}`);
@@ -10771,16 +10939,16 @@ async function runPluginUpgrade(target, options, deps) {
 async function runLocalPluginRefresh(localPath, options, deps) {
   const source = resolveLocalPlugin(localPath);
   log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
-  const servicesDir = join38(options.cwd, "services");
-  const targetDir = join38(servicesDir, source.name);
-  if (!existsSync36(targetDir)) {
+  const servicesDir = join39(options.cwd, "services");
+  const targetDir = join39(servicesDir, source.name);
+  if (!existsSync37(targetDir)) {
     throw new Error(
       `Plugin '${source.name}' is not installed at services/${source.name}/. Use 'biffo plugin install --local ${localPath}' instead.`
     );
   }
   const inTreeSource = resolve17(source.sourceDir) === resolve17(targetDir);
-  const currentVersion = readInstalledVersion2(targetDir);
-  const modulesDir = join38(options.cwd, "modules", "plugins", source.name);
+  const currentVersion = readInstalledVersion(targetDir);
+  const modulesDir = join39(options.cwd, "modules", "plugins", source.name);
   if (options.dryRun) {
     printLocalDryRun(source, currentVersion, inTreeSource);
     return;
@@ -10803,11 +10971,11 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     log.success(
       `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
     );
-    const retiredShapeReasons = findRetiredFrontendShape(join38(source.sourceDir, "terraform"));
+    const retiredShapeReasons = findRetiredFrontendShape(join39(source.sourceDir, "terraform"));
     if (retiredShapeReasons.length > 0) {
       throw new Error(retiredFrontendShapeError(source.name, retiredShapeReasons));
     }
-    if (!existsSync36(join38(source.sourceDir, "terraform"))) {
+    if (!existsSync37(join39(source.sourceDir, "terraform"))) {
       refuseIfModuleStillReferenced(options.cwd, modulesDir, source.name);
     }
     const previousProvenance = readProvenance(targetDir);
@@ -10827,11 +10995,11 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
     const newPyproject = readPyprojectIfPresent(targetDir);
     const stagePaths = [`services/${source.name}`];
-    if (existsSync36(modulesDir)) {
+    if (existsSync37(modulesDir)) {
       rmSync10(modulesDir, { recursive: true, force: true });
     }
-    const tfSourceDir = join38(targetDir, "terraform");
-    if (existsSync36(tfSourceDir)) {
+    const tfSourceDir = join39(targetDir, "terraform");
+    if (existsSync37(tfSourceDir)) {
       mkdirSync12(modulesDir, { recursive: true });
       cpSync6(tfSourceDir, modulesDir, { recursive: true });
       stagePaths.push(`modules/plugins/${source.name}`);
@@ -10895,7 +11063,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
   }
 }
 function refuseIfModuleStillReferenced(cwd, modulesDir, name) {
-  if (!existsSync36(modulesDir)) return;
+  if (!existsSync37(modulesDir)) return;
   const refs = findPluginModuleReferences(cwd, name);
   if (refs.length === 0) return;
   const refList = refs.map((r) => `  ${r.file}:${r.line}  ${r.text}`).join("\n");
@@ -10956,8 +11124,8 @@ var defaultRunCommand2 = async (command, cwd) => {
   }
 };
 function readPyprojectIfPresent(targetDir) {
-  const path = join38(targetDir, "pyproject.toml");
-  return existsSync36(path) ? readFileSync27(path, "utf8") : null;
+  const path = join39(targetDir, "pyproject.toml");
+  return existsSync37(path) ? readFileSync28(path, "utf8") : null;
 }
 function dependenciesChanged(before, after) {
   if (before === after) return false;
@@ -10984,11 +11152,11 @@ function tomlTableBody(text, header) {
   const nextHeader = /^\[/m.exec(rest);
   return nextHeader ? rest.slice(0, nextHeader.index) : rest;
 }
-function readInstalledVersion2(targetDir) {
-  const manifestPath = join38(targetDir, "biffo.plugin.json");
-  if (!existsSync36(manifestPath)) return void 0;
+function readInstalledVersion(targetDir) {
+  const manifestPath = join39(targetDir, "biffo.plugin.json");
+  if (!existsSync37(manifestPath)) return void 0;
   try {
-    return validateManifest(JSON.parse(readFileSync27(manifestPath, "utf8"))).version;
+    return validateManifest(JSON.parse(readFileSync28(manifestPath, "utf8"))).version;
   } catch {
     return void 0;
   }
@@ -11071,7 +11239,7 @@ pluginCommand.addCommand(pluginStalenessCommand);
 import { Command as Command23 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync37, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync38, readFileSync as readFileSync29 } from "fs";
 import { resolve as resolve18 } from "path";
 import chalk20 from "chalk";
 import { Command as Command22 } from "commander";
@@ -11265,7 +11433,7 @@ async function fetchPublishedIdentity(portalUrl) {
 }
 async function resolveConfig4(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync28(resolve18(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync29(resolve18(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -11285,8 +11453,8 @@ async function resolveConfig4(options) {
     return cfg;
   }
   const localConfigPath = resolve18(process.cwd(), "biffo.config.json");
-  if (existsSync37(localConfigPath)) {
-    const raw = JSON.parse(readFileSync28(localConfigPath, "utf8"));
+  if (existsSync38(localConfigPath)) {
+    const raw = JSON.parse(readFileSync29(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
     if (isTemplatePlaceholderConfig(raw)) {
@@ -11332,20 +11500,20 @@ siblingCommand.addCommand(siblingCheckIdentityCommand);
 import { Command as Command24 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
-import { existsSync as existsSync39 } from "fs";
-import { join as join40 } from "path";
+import { existsSync as existsSync40 } from "fs";
+import { join as join41 } from "path";
 
 // src/lib/adr-numbering-guard.ts
-import { existsSync as existsSync38, readdirSync as readdirSync15, readFileSync as readFileSync29 } from "fs";
-import { join as join39 } from "path";
+import { existsSync as existsSync39, readdirSync as readdirSync15, readFileSync as readFileSync30 } from "fs";
+import { join as join40 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join39(adrDir, ALLOWLIST_FILENAME);
-  if (!existsSync38(path)) return /* @__PURE__ */ new Set();
+  const path = join40(adrDir, ALLOWLIST_FILENAME);
+  if (!existsSync39(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
-  for (const rawLine of readFileSync29(path, "utf8").split("\n")) {
+  for (const rawLine of readFileSync30(path, "utf8").split("\n")) {
     const line = rawLine.split("#")[0].trim();
     if (line) numbers.add(line);
   }
@@ -11353,7 +11521,7 @@ function readAdrNumberingAllowlist(adrDir) {
 }
 function adrNumbersIn(adrDir) {
   const claims = /* @__PURE__ */ new Map();
-  if (!existsSync38(adrDir)) return claims;
+  if (!existsSync39(adrDir)) return claims;
   for (const entry of readdirSync15(adrDir).sort()) {
     const match = ADR_FILENAME.exec(entry);
     if (!match) continue;
@@ -11408,8 +11576,8 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join40(root, "docs", "ADR");
-  if (!existsSync39(adrDir)) {
+  const adrDir = join41(root, "docs", "ADR");
+  if (!existsSync40(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
   }
@@ -11447,8 +11615,8 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 }
 
 // src/lib/api-gateway-integration-guard.ts
-import { readFileSync as readFileSync30, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
-import { join as join41 } from "path";
+import { readFileSync as readFileSync31, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
+import { join as join42 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var MODULE_TYPE = "module";
 var INTEGRATION_TYPE = "aws_apigatewayv2_integration";
@@ -11530,7 +11698,7 @@ function walkTerraformFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join41(dir, entry);
+      const p = join42(dir, entry);
       let st;
       try {
         st = statSync9(p);
@@ -11574,7 +11742,7 @@ function auditApiGatewayIntegrations(root) {
   let rawModuleCount = 0;
   let rawIntegrationCount = 0;
   for (const file of files) {
-    const text = readFileSync30(file, "utf8");
+    const text = readFileSync31(file, "utf8");
     rawModuleCount += countRawResourceDeclarations(text, MODULE_TYPE);
     rawIntegrationCount += countRawResourceDeclarations(text, INTEGRATION_TYPE);
     moduleBlocks.push(...findModuleBlocks(text, file));
@@ -11946,18 +12114,18 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 }
 
 // src/lib/claim-invocation-parity.ts
-import { existsSync as existsSync40, readFileSync as readFileSync31, readdirSync as readdirSync17 } from "fs";
-import { join as join42 } from "path";
+import { existsSync as existsSync41, readFileSync as readFileSync32, readdirSync as readdirSync17 } from "fs";
+import { join as join43 } from "path";
 function distributedAgentsDocs(root) {
   const docs = [];
-  const own = join42(root, "AGENTS.md");
-  if (existsSync40(own)) docs.push({ path: "AGENTS.md", text: readFileSync31(own, "utf8") });
-  const skeletons = join42(root, "_skeletons");
-  if (existsSync40(skeletons)) {
+  const own = join43(root, "AGENTS.md");
+  if (existsSync41(own)) docs.push({ path: "AGENTS.md", text: readFileSync32(own, "utf8") });
+  const skeletons = join43(root, "_skeletons");
+  if (existsSync41(skeletons)) {
     for (const name of readdirSync17(skeletons).sort()) {
-      const abs = join42(skeletons, name, "AGENTS.md");
-      if (!existsSync40(abs)) continue;
-      docs.push({ path: `_skeletons/${name}/AGENTS.md`, text: readFileSync31(abs, "utf8") });
+      const abs = join43(skeletons, name, "AGENTS.md");
+      if (!existsSync41(abs)) continue;
+      docs.push({ path: `_skeletons/${name}/AGENTS.md`, text: readFileSync32(abs, "utf8") });
     }
   }
   return docs;
@@ -12089,12 +12257,12 @@ async function runClaimInvocationCheck() {
 }
 
 // src/scripts/check-codeql-suppression.ts
-import { existsSync as existsSync41 } from "fs";
-import { join as join44, relative as relative8 } from "path";
+import { existsSync as existsSync42 } from "fs";
+import { join as join45, relative as relative8 } from "path";
 
 // src/lib/codeql-suppression-guard.ts
-import { readdirSync as readdirSync18, readFileSync as readFileSync32, statSync as statSync10 } from "fs";
-import { join as join43 } from "path";
+import { readdirSync as readdirSync18, readFileSync as readFileSync33, statSync as statSync10 } from "fs";
+import { join as join44 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   ".git",
   ".worktrees",
@@ -12125,7 +12293,7 @@ function walkSourceFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join43(dir, entry);
+      const p = join44(dir, entry);
       let st;
       try {
         st = statSync10(p);
@@ -12151,7 +12319,7 @@ function countSourceFiles(root) {
 function sweepCodeqlSuppressionComments(root) {
   const hits = [];
   for (const path of walkSourceFiles(root)) {
-    const text = readFileSync32(path, "utf8");
+    const text = readFileSync33(path, "utf8");
     for (const line of findCodeqlSuppressionComments(text)) {
       hits.push({ path, line, text: text.split("\n")[line - 1] ?? "" });
     }
@@ -12162,8 +12330,8 @@ function sweepCodeqlSuppressionComments(root) {
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const scanRoot = join44(root, "cli", "src");
-  if (!existsSync41(scanRoot)) {
+  const scanRoot = join45(root, "cli", "src");
+  if (!existsSync42(scanRoot)) {
     console.log(
       "\u2014 codeql-suppression guard: skipped \u2014 no cli/src in this repo, so there is no CLI source to scan."
     );
@@ -12187,12 +12355,12 @@ async function runCodeqlSuppressionCheck() {
 }
 
 // src/scripts/check-cognito-invite-template.ts
-import { existsSync as existsSync42 } from "fs";
-import { join as join46 } from "path";
+import { existsSync as existsSync43 } from "fs";
+import { join as join47 } from "path";
 
 // src/lib/cognito-invite-template-guard.ts
-import { readdirSync as readdirSync19, readFileSync as readFileSync33, statSync as statSync11 } from "fs";
-import { join as join45 } from "path";
+import { readdirSync as readdirSync19, readFileSync as readFileSync34, statSync as statSync11 } from "fs";
+import { join as join46 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -12276,7 +12444,7 @@ function findModuleTerraformFiles(repoRoot) {
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees" || entry === ".venv")
         continue;
-      const full = join45(dir, entry);
+      const full = join46(dir, entry);
       const rel = `${relative11}/${entry}`;
       let isDir;
       try {
@@ -12291,12 +12459,12 @@ function findModuleTerraformFiles(repoRoot) {
       }
     }
   };
-  walk2(join45(repoRoot, "modules"), "modules");
+  walk2(join46(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync33(join45(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync34(join46(repoRoot, file), "utf8"))
   );
 }
 
@@ -12306,7 +12474,7 @@ async function runCognitoInviteTemplateCheck() {
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
-    if (!existsSync42(join46(root, "modules"))) {
+    if (!existsSync43(join47(root, "modules"))) {
       console.log(
         `\xB7 Cognito invite template guard: not applicable \u2014 no modules/ directory under ${root} \u2014 this is not a template/instance tree (a satellite repo never carries the template-owned Terraform modules). Skipping.`
       );
@@ -12330,11 +12498,11 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync43, readFileSync as readFileSync34, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync35, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
+import { join as join48 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -12498,7 +12666,7 @@ function walkFiles(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join47(dir, entry);
+      const p = join48(dir, entry);
       let st;
       try {
         st = statSync12(p);
@@ -12528,7 +12696,7 @@ function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_I
   const extracted = [];
   let rawTotal = 0;
   for (const file of files) {
-    const text = readFileSync34(file, "utf8");
+    const text = readFileSync35(file, "utf8");
     rawTotal += countRawExternalOccurrences(text, externalBases);
     extracted.push(...extractCoreDirectPaths(text, file, externalBases));
   }
@@ -12577,7 +12745,7 @@ function auditCoreRouteExtraction(apiSrcDir) {
   const prefixSet = /* @__PURE__ */ new Set();
   let rawApiRouterCount = 0;
   for (const file of files) {
-    const text = readFileSync34(file, "utf8");
+    const text = readFileSync35(file, "utf8");
     const extraction = extractCoreRoutePrefixes(text);
     rawApiRouterCount += extraction.rawApiRouterCount;
     for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
@@ -12593,10 +12761,10 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join47(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join48(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
-    raw = readFileSync34(configPath, "utf8");
+    raw = readFileSync35(configPath, "utf8");
   } catch (err) {
     throw new Error(
       `cannot resolve ${sibling}'s core: ${configPath} does not exist or is unreadable (${err.message}) -- refusing to guess which core serves this sibling.`
@@ -12616,8 +12784,8 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join47(estateDir, coreProject, "services", "api", "src");
-  if (!existsSync43(coreApiSrcDir)) {
+  const coreApiSrcDir = join48(estateDir, coreProject, "services", "api", "src");
+  if (!existsSync44(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
     );
@@ -12670,7 +12838,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     }
   }
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join48(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join49(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -12686,7 +12854,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join48(root, "services", "api", "src");
+    coreApiSrcDir = join49(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -12813,8 +12981,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync48, existsSync: existsSync58 } = await import("fs");
-      if (existsSync58(messageFile)) commitMessage = readFileSync48(messageFile, "utf8");
+      const { readFileSync: readFileSync49, existsSync: existsSync59 } = await import("fs");
+      if (existsSync59(messageFile)) commitMessage = readFileSync49(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -12937,21 +13105,21 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-distribution-inventory.ts
-import { existsSync as existsSync45 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync46 } from "fs";
+import { join as join51 } from "path";
 
 // src/lib/distribution-inventory.ts
-import { existsSync as existsSync44, readFileSync as readFileSync35 } from "fs";
-import { join as join49 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync36 } from "fs";
+import { join as join50 } from "path";
 var INVENTORY_FILENAME = "distribution-inventory.json";
 function loadDistributionInventory(root) {
-  const path = join49(root, INVENTORY_FILENAME);
-  if (!existsSync44(path)) {
+  const path = join50(root, INVENTORY_FILENAME);
+  if (!existsSync45(path)) {
     throw new Error(
       `${INVENTORY_FILENAME} not found at ${root} -- expected it beside core-manifest.json`
     );
   }
-  return JSON.parse(readFileSync35(path, "utf8"));
+  return JSON.parse(readFileSync36(path, "utf8"));
 }
 function validateInventory(inventory) {
   const violations = [];
@@ -13111,7 +13279,7 @@ async function runDistributionInventoryCheck(root) {
     );
     return;
   }
-  if (!existsSync45(join50(repoRoot, INVENTORY_FILENAME))) {
+  if (!existsSync46(join51(repoRoot, INVENTORY_FILENAME))) {
     console.log(
       `\u2713 distribution-inventory: skipped \u2014 no ${INVENTORY_FILENAME} at ${repoRoot}. This is a template-only registry; a checkout that legitimately has none has nothing for this guard to check.`
     );
@@ -13137,7 +13305,7 @@ async function runDistributionInventoryCheck(root) {
 }
 
 // src/scripts/check-distribution-remote-state.ts
-import { join as join51 } from "path";
+import { join as join52 } from "path";
 async function ghExecCommand(file, args) {
   const result = await execa(file, args, { reject: false });
   return { stdout: String(result.stdout ?? ""), exitCode: result.exitCode ?? null };
@@ -13152,7 +13320,7 @@ async function runDistributionRemoteStateCheck(root) {
     }
   }
   console.log(
-    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join51(repoRoot, "distribution-inventory.json")})`
+    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join52(repoRoot, "distribution-inventory.json")})`
   );
   if (assertions.length === 0) {
     console.log("\u2713 distribution-remote-state: nothing declared to check");
@@ -13197,8 +13365,8 @@ ${assertion.ref}`;
 }
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync36, readdirSync as readdirSync21, statSync as statSync13 } from "fs";
-import { join as join52 } from "path";
+import { readFileSync as readFileSync37, readdirSync as readdirSync21, statSync as statSync13 } from "fs";
+import { join as join53 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -13275,7 +13443,7 @@ function walkTerraformFiles2(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join52(dir, entry);
+      const p = join53(dir, entry);
       let st;
       try {
         st = statSync13(p);
@@ -13318,7 +13486,7 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync36(file, "utf8");
+    const text = readFileSync37(file, "utf8");
     rawEventTargetCount += countRawResourceDeclarations2(text, EVENT_TARGET_TYPE);
     rawLogPolicyCount += countRawResourceDeclarations2(text, LOG_RESOURCE_POLICY_TYPE);
     eventTargetBlocks.push(...findResourceBlocks2(text, file, EVENT_TARGET_TYPE));
@@ -13415,8 +13583,8 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-instance-adoption.ts
-import { existsSync as existsSync46 } from "fs";
-import { join as join53 } from "path";
+import { existsSync as existsSync47 } from "fs";
+import { join as join54 } from "path";
 async function runInstanceAdoptionCheck(opts = {}) {
   if (!opts.instanceDir) {
     console.error(
@@ -13424,7 +13592,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
     );
     process.exit(2);
   }
-  if (!existsSync46(opts.instanceDir)) {
+  if (!existsSync47(opts.instanceDir)) {
     console.error(
       `\u2717 instance-adoption guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it is adopted, and that is not the same as a clean pass.`
     );
@@ -13432,7 +13600,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
   }
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const theirsDir = opts.theirsDir ?? root;
-  const instanceLabel = opts.instance ?? join53(opts.instanceDir).split("/").filter(Boolean).pop();
+  const instanceLabel = opts.instance ?? join54(opts.instanceDir).split("/").filter(Boolean).pop();
   const report = checkInstanceAdoption(theirsDir, opts.instanceDir);
   console.log(
     `examined ${report.examinedInstances} instance (${instanceLabel}) against ${report.registeredPairs} registered pair(s), ${report.applicablePairs} applicable to this instance, against template tree ${theirsDir}`
@@ -13454,12 +13622,12 @@ async function runInstanceAdoptionCheck(opts = {}) {
 }
 
 // src/lib/lambda-output-guard.ts
-import { readFileSync as readFileSync38 } from "fs";
-import { join as join55 } from "path";
+import { readFileSync as readFileSync39 } from "fs";
+import { join as join56 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync47, readdirSync as readdirSync22, readFileSync as readFileSync37, statSync as statSync14 } from "fs";
-import { join as join54 } from "path";
+import { existsSync as existsSync48, readdirSync as readdirSync22, readFileSync as readFileSync38, statSync as statSync14 } from "fs";
+import { join as join55 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -13473,7 +13641,7 @@ function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
 function vendoredPluginServiceDirs(repoRoot) {
-  const servicesDir = join54(repoRoot, "services");
+  const servicesDir = join55(repoRoot, "services");
   const result = /* @__PURE__ */ new Set();
   let entries;
   try {
@@ -13482,9 +13650,9 @@ function vendoredPluginServiceDirs(repoRoot) {
     return result;
   }
   for (const entry of entries) {
-    const full = join54(servicesDir, entry);
-    if (!existsSync47(full) || !statSync14(full).isDirectory()) continue;
-    if (existsSync47(join54(full, "biffo.plugin.json"))) {
+    const full = join55(servicesDir, entry);
+    if (!existsSync48(full) || !statSync14(full).isDirectory()) continue;
+    if (existsSync48(join55(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
   }
@@ -13506,7 +13674,7 @@ function findWorkflowFiles(repoRoot) {
       if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
-      const full = join54(dir, entry);
+      const full = join55(dir, entry);
       const rel = relative11 ? `${relative11}/${entry}` : entry;
       let isDir;
       try {
@@ -13556,7 +13724,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync37(join54(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync38(join55(repoRoot, file), "utf8"))
   );
 }
 
@@ -13614,7 +13782,7 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync38(join55(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync39(join56(repoRoot, file), "utf8"))
   );
 }
 
@@ -13642,8 +13810,8 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-migration-body-change.ts
-import { existsSync as existsSync48 } from "fs";
-import { join as join56 } from "path";
+import { existsSync as existsSync49 } from "fs";
+import { join as join57 } from "path";
 
 // src/lib/migration-body-change-guard.ts
 function checkMigrationBodyChangeMarkers(diffs) {
@@ -13725,7 +13893,7 @@ async function runMigrationBodyChangeCheck(argv) {
     );
     return;
   }
-  if (!existsSync48(join56(root, MIGRATIONS_VERSIONS_DIR))) {
+  if (!existsSync49(join57(root, MIGRATIONS_VERSIONS_DIR))) {
     console.log(`\u2713 migration body-change guard: no ${MIGRATIONS_VERSIONS_DIR} in this repo.`);
     return;
   }
@@ -13831,8 +13999,8 @@ ${BOLD2}What to do${OFF2}
 }
 
 // src/scripts/check-orphan-ratchet.ts
-import { existsSync as existsSync49 } from "fs";
-import { basename as basename3, join as join57 } from "path";
+import { existsSync as existsSync50 } from "fs";
+import { basename as basename3, join as join58 } from "path";
 function reportOrphan(entry, manifest) {
   console.error(`  ${entry.path}`);
   const { templateOwnedMatch, nearestUserOwnedEntries } = explainOwnership(entry.path, manifest);
@@ -13854,7 +14022,7 @@ function reportOrphan(entry, manifest) {
   }
 }
 async function runOrphanRatchetCheck(opts = {}) {
-  if (opts.instanceDir !== void 0 && !existsSync49(opts.instanceDir)) {
+  if (opts.instanceDir !== void 0 && !existsSync50(opts.instanceDir)) {
     console.error(
       `\u2717 orphan-ratchet guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it carries unsanctioned files, and that is not the same as a clean pass.`
     );
@@ -13871,7 +14039,7 @@ async function runOrphanRatchetCheck(opts = {}) {
       "self-check mode: --instance-dir was not given, so it defaulted to --theirs-dir (this repo's own root) alongside --base-dir \u2014 all three trees are the same, so this run can only ever find zero orphans by construction. See this script's doc comment. Pass a real instance tree with --instance-dir for a check that can actually find something. biffo-template#1714."
     );
   }
-  if (!existsSync49(join57(theirsDir, CORE_MANIFEST_FILE))) {
+  if (!existsSync50(join58(theirsDir, CORE_MANIFEST_FILE))) {
     console.log(
       `orphan-ratchet guard (${label}): no ${CORE_MANIFEST_FILE} in ${theirsDir} \u2014 this is not a Biffo template/instance tree (a satellite repo never carries one), so there is no ownership manifest to classify paths against. Not applicable; skipping.`
     );
@@ -13902,8 +14070,8 @@ baseline was ${String(ratchet.baseline)}, now ${String(ratchet.count)}. See biff
 }
 
 // src/lib/ownership-header-claim-guard.ts
-import { readFileSync as readFileSync39 } from "fs";
-import { join as join58 } from "path";
+import { readFileSync as readFileSync40 } from "fs";
+import { join as join59 } from "path";
 var OWNERSHIP_HEADER_SWEEP_DIRS = [
   "scripts",
   ".githooks",
@@ -14112,7 +14280,7 @@ function sweepOwnershipHeaderClaims(root, options = {}) {
   for (const rel of files) {
     let content;
     try {
-      content = readFileSync39(join58(root, rel), "utf8");
+      content = readFileSync40(join59(root, rel), "utf8");
     } catch {
       continue;
     }
@@ -14187,8 +14355,8 @@ async function runOwnershipHeaderClaimCheck() {
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync40, readdirSync as readdirSync23 } from "fs";
-import { join as join59, relative as relative9 } from "path";
+import { readFileSync as readFileSync41, readdirSync as readdirSync23 } from "fs";
+import { join as join60, relative as relative9 } from "path";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -14284,7 +14452,7 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join59(root, dir);
+    const full = join60(root, dir);
     let entries;
     try {
       entries = readdirSync23(full, { withFileTypes: true });
@@ -14294,7 +14462,7 @@ function shellFiles(root) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join59(full, entry.name));
+      out.push(join60(full, entry.name));
     }
   }
   return out;
@@ -14310,7 +14478,7 @@ async function runPipeTrapCheck() {
     process.exit(1);
   }
   const findings = files.flatMap(
-    (file) => findPipeTraps(readFileSync40(file, "utf8")).map(
+    (file) => findPipeTraps(readFileSync41(file, "utf8")).map(
       (t) => `${relative9(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
@@ -14327,8 +14495,8 @@ async function runPipeTrapCheck() {
 }
 
 // src/lib/plugin-allowlist-convention.ts
-import { readFileSync as readFileSync41 } from "fs";
-import { join as join60 } from "path";
+import { readFileSync as readFileSync42 } from "fs";
+import { join as join61 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -14339,7 +14507,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync41(join60(repoRoot, relative11), "utf8");
+    return readFileSync42(join61(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -14467,32 +14635,32 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync51 } from "fs";
-import { join as join62 } from "path";
+import { existsSync as existsSync52 } from "fs";
+import { join as join63 } from "path";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync50, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
-import { join as join61 } from "path";
+import { existsSync as existsSync51, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
+import { join as join62 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync50(dir)) return [];
+  if (!existsSync51(dir)) return [];
   return readdirSync24(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync15(join61(dir, entry)).isDirectory();
+      return statSync15(join62(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync50(join61(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync51(join62(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join61(pluginDir2, "tests");
-  if (!existsSync50(testsDir)) return [];
-  if (existsSync50(join61(testsDir, "__init__.py"))) return [];
+  const testsDir = join62(pluginDir2, "tests");
+  if (!existsSync51(testsDir)) return [];
+  if (existsSync51(join62(testsDir, "__init__.py"))) return [];
   return readdirSync24(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -14501,7 +14669,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join61(servicesDir, plugin))) {
+      for (const name of namesOf(join62(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -14539,8 +14707,8 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join62(root, "services");
-  if (!existsSync51(servicesDir)) {
+  const servicesDir = join63(root, "services");
+  if (!existsSync52(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -14557,8 +14725,8 @@ async function runPluginCollisionCheck() {
 }
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync52, readFileSync as readFileSync42, readdirSync as readdirSync25 } from "fs";
-import { dirname as dirname10, join as join63, relative as relative10, sep as sep4 } from "path";
+import { existsSync as existsSync53, readFileSync as readFileSync43, readdirSync as readdirSync25 } from "fs";
+import { dirname as dirname10, join as join64, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS4 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -14573,9 +14741,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS4.has(entry.name)) continue;
-        walk2(join63(dir, entry.name));
+        walk2(join64(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join63(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join64(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -14585,7 +14753,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync42(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync43(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -14600,14 +14768,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync52(join63(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync53(join64(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join63(root, manifest);
+    const absManifest = join64(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync52(join63(pluginDir2, "terraform"))) continue;
+    if (existsSync53(join64(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -14638,12 +14806,12 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync54 } from "fs";
-import { join as join65 } from "path";
+import { existsSync as existsSync55 } from "fs";
+import { join as join66 } from "path";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync53, readFileSync as readFileSync43, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
-import { join as join64 } from "path";
+import { existsSync as existsSync54, readFileSync as readFileSync44, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
+import { join as join65 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -15060,7 +15228,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync16(join64(root, e)).isDirectory();
+      return statSync16(join65(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -15076,7 +15244,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join64(dir, entry);
+      const p = join65(dir, entry);
       let st;
       try {
         st = statSync16(p);
@@ -15102,14 +15270,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join64(pluginDir2, "terraform");
+  const tfDir = join65(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync26(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join64(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join65(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -15361,8 +15529,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join64("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join64(
+var CONFIG_PY_PATH = join65("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join65(
   "services",
   "api",
   "src",
@@ -15374,10 +15542,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join64(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join64(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync53(configPath);
-  const orchestrationSchemaMissing = !existsSync53(orchestrationPath);
+  const configPath = join65(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join65(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync54(configPath);
+  const orchestrationSchemaMissing = !existsSync54(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -15395,13 +15563,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync43(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync44(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync43(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync44(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -15448,7 +15616,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync16(join64(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync16(join65(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -15461,8 +15629,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join64(pluginsRoot, name);
-    const manifestText = readFileSync43(join64(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join65(pluginsRoot, name);
+    const manifestText = readFileSync44(join65(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -15480,13 +15648,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync43(f, "utf8")
+      text: readFileSync44(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync43(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync44(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -15560,7 +15728,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join64(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join65(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -15600,8 +15768,8 @@ async function runPluginToolSupplyCheck() {
     return;
   }
   let allOk = true;
-  const pluginsRoot = join65(root, "services", "_plugins");
-  if (!existsSync54(pluginsRoot)) {
+  const pluginsRoot = join66(root, "services", "_plugins");
+  if (!existsSync55(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -15631,8 +15799,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join65(root, "services", "api");
-  if (!existsSync54(servicesApiRoot)) {
+  const servicesApiRoot = join66(root, "services", "api");
+  if (!existsSync55(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -15806,10 +15974,10 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-shared-file-reduction.ts
-import { readFileSync as readFileSync45 } from "fs";
+import { readFileSync as readFileSync46 } from "fs";
 
 // src/lib/shared-file-reduction-guard.ts
-import { readFileSync as readFileSync44 } from "fs";
+import { readFileSync as readFileSync45 } from "fs";
 var LEAF_TEST_CALLS = /* @__PURE__ */ new Set(["it", "test"]);
 var SUITE_CALLS = /* @__PURE__ */ new Set(["describe", "suite"]);
 var TEST_FILE_PATTERN = /\.(test|spec)\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
@@ -15936,7 +16104,7 @@ function formatReductionReport(report) {
 // src/scripts/check-shared-file-reduction.ts
 function readStdin() {
   try {
-    return readFileSync45(0, "utf8");
+    return readFileSync46(0, "utf8");
   } catch {
     return "";
   }
@@ -15953,15 +16121,15 @@ function pairsFromTsv(tsv) {
     const [target, existingPath, incomingPath] = fields;
     pairs.push({
       target,
-      existing: readFileSync45(existingPath, "utf8"),
-      incoming: readFileSync45(incomingPath, "utf8")
+      existing: readFileSync46(existingPath, "utf8"),
+      incoming: readFileSync46(incomingPath, "utf8")
     });
   }
   return pairs;
 }
 function loadAccepted(manifestPath) {
   if (!manifestPath) return {};
-  const parsed = JSON.parse(readFileSync45(manifestPath, "utf8"));
+  const parsed = JSON.parse(readFileSync46(manifestPath, "utf8"));
   return parsed.acceptedReductions ?? {};
 }
 async function runSharedFileReductionCheck(args) {
@@ -15969,13 +16137,13 @@ async function runSharedFileReductionCheck(args) {
   let accepted;
   try {
     if (args.pairs) {
-      pairs = pairsFromTsv(args.pairs === "-" ? readStdin() : readFileSync45(args.pairs, "utf8"));
+      pairs = pairsFromTsv(args.pairs === "-" ? readStdin() : readFileSync46(args.pairs, "utf8"));
     } else if (args.target && args.existing && args.incoming) {
       pairs = [
         {
           target: args.target,
-          existing: readFileSync45(args.existing, "utf8"),
-          incoming: readFileSync45(args.incoming, "utf8")
+          existing: readFileSync46(args.existing, "utf8"),
+          incoming: readFileSync46(args.incoming, "utf8")
         }
       ];
     } else {
@@ -16009,12 +16177,12 @@ async function runSharedFileReductionCheck(args) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync55, readdirSync as readdirSync28 } from "fs";
-import { join as join67 } from "path";
+import { existsSync as existsSync56, readdirSync as readdirSync28 } from "fs";
+import { join as join68 } from "path";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync46, readdirSync as readdirSync27, statSync as statSync17 } from "fs";
-import { join as join66 } from "path";
+import { readFileSync as readFileSync47, readdirSync as readdirSync27, statSync as statSync17 } from "fs";
+import { join as join67 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -16078,7 +16246,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join66(dir, entry);
+    const abs = join67(dir, entry);
     let isDir;
     try {
       isDir = statSync17(abs).isDirectory();
@@ -16100,7 +16268,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync46(join66(skeletonRoot, rel), "utf8");
+        contents = readFileSync47(join67(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -16129,23 +16297,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join67(root, "_skeletons");
+  const skeletonsDir = join68(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync28(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync55(join67(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync56(join68(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join67(root, "_skeletons", name);
+    const skeletonRoot = join68(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync55(join67(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync56(join68(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -16153,7 +16321,7 @@ async function runSkeletonDriftCheck() {
     `audited ${skeletons.length} skeleton(s) (${skeletons.join(", ") || "none"}), ${filesConsidered} file(s) considered, under ${root}/_skeletons`
   );
   if (skeletons.length === 0) {
-    if (!existsSync55(join67(root, "_skeletons"))) {
+    if (!existsSync56(join68(root, "_skeletons"))) {
       console.log(
         `\xB7 Skeleton-drift guard: no _skeletons/ directory under ${root} \u2014 this is not a repo that ships scaffolding (a satellite repo never carries one). Not applicable; skipping.`
       );
@@ -16165,7 +16333,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join67(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join68(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -16366,8 +16534,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync56, readFileSync as readFileSync47 } from "fs";
-import { join as join69, resolve as resolve20 } from "path";
+import { existsSync as existsSync57, readFileSync as readFileSync48 } from "fs";
+import { join as join70, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -16708,11 +16876,11 @@ async function reapAllBareBranches(cwd, branches, worktrees, currentBranch, deps
 
 // src/lib/scratch-clone-scan.ts
 import { readdirSync as readdirSync29, statSync as statSync18 } from "fs";
-import { join as join68 } from "path";
+import { join as join69 } from "path";
 var INTEGRATION_BRANCH = "dev";
 function isPlainCloneDir(path) {
   try {
-    return statSync18(join68(path, ".git")).isDirectory();
+    return statSync18(join69(path, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -16727,7 +16895,7 @@ async function findScratchCloneCandidates(estateRoot, deps) {
   const names = readdirSync29(estateRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   const candidates = [];
   for (const name of names) {
-    const path = join68(estateRoot, name);
+    const path = join69(estateRoot, name);
     if (!isPlainCloneDir(path)) continue;
     let branch;
     try {
@@ -16907,10 +17075,10 @@ function printScratchCloneReports(estateRoot, reports) {
   );
 }
 function readLocalCoreVersion(cwd) {
-  const path = join69(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync56(path)) return null;
+  const path = join70(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync57(path)) return null;
   try {
-    return extractVersionField(readFileSync47(path, "utf8"));
+    return extractVersionField(readFileSync48(path, "utf8"));
   } catch {
     return null;
   }
@@ -16930,10 +17098,10 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join69(cwd, CORE_VERSION_FILE);
-  if (!existsSync56(path)) return null;
+  const path = join70(cwd, CORE_VERSION_FILE);
+  if (!existsSync57(path)) return null;
   try {
-    const value = readFileSync47(path, "utf8").trim();
+    const value = readFileSync48(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -17471,13 +17639,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync57 } from "fs";
-import { dirname as dirname11, join as join70 } from "path";
+import { existsSync as existsSync58 } from "fs";
+import { dirname as dirname11, join as join71 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join70(dir, relativePath);
-    if (existsSync57(candidate)) return candidate;
+    const candidate = join71(dir, relativePath);
+    if (existsSync58(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;