@biffo/cli 0.317.2 → 0.318.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command28 } from "commander";
+import { Command as Command29 } from "commander";
 
 // src/commands/core.ts
 import { Command as Command4 } from "commander";
@@ -1934,7 +1934,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
+      await new Promise((resolve22) => setTimeout(resolve22, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1949,7 +1949,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
+      await new Promise((resolve22) => setTimeout(resolve22, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -2183,7 +2183,7 @@ var GitHubAdapter = class {
             }
             if (status !== 404 || Date.now() >= deadline) throw err;
             log.info("Branch protection endpoint not yet ready, retrying...");
-            await new Promise((resolve21) => setTimeout(resolve21, protectionIntervalMs));
+            await new Promise((resolve22) => setTimeout(resolve22, protectionIntervalMs));
           }
         }
       }
@@ -2356,7 +2356,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve21) => setTimeout(resolve21, protectionIntervalMs));
+          await new Promise((resolve22) => setTimeout(resolve22, protectionIntervalMs));
         }
       }
     } catch (err) {
@@ -2629,7 +2629,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
+        await new Promise((resolve22) => setTimeout(resolve22, intervalMs));
       }
     }
   }
@@ -2648,7 +2648,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
+        await new Promise((resolve22) => setTimeout(resolve22, intervalMs));
       }
     }
   }
@@ -2672,7 +2672,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve21) => setTimeout(resolve21, intervalMs));
+      await new Promise((resolve22) => setTimeout(resolve22, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -5031,7 +5031,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve21) => setTimeout(resolve21, retryDelayMs));
+          await new Promise((resolve22) => setTimeout(resolve22, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -8295,7 +8295,7 @@ async function promptForConfig(awsAccountId, awsRegion, awsProfile) {
 }
 
 // src/commands/plugin.ts
-import { Command as Command21 } from "commander";
+import { Command as Command22 } from "commander";
 
 // src/commands/plugin-create.ts
 import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "fs";
@@ -11233,8 +11233,132 @@ function printLocalDryRun(source, currentVersion, inTreeSource) {
 `);
 }
 
+// src/commands/plugin-verify.ts
+import { dirname as dirname11, resolve as resolve18 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
+import { Command as Command21 } from "commander";
+
+// src/lib/plugin-verify/command-runner.ts
+import { spawnSync } from "child_process";
+var RealCommandRunner = class {
+  run(cmd, args, opts) {
+    const result = spawnSync(cmd, args, {
+      cwd: opts.cwd,
+      // Progress/errors always go to the terminal so a human watching a local
+      // run (or CI's own log) sees them as they happen; stdout is captured only
+      // when the caller needs the value back (pg-test-db.sh's DSN) — capturing
+      // it unconditionally would silence the conformance checks' own printed
+      // denominators, which are the whole point of this feature (#1363's shape).
+      stdio: ["ignore", opts.captureStdout ? "pipe" : "inherit", "inherit"],
+      encoding: "utf8"
+    });
+    return { status: result.status, stdout: result.stdout ?? "" };
+  }
+};
+
+// src/lib/packaged-scripts.ts
+import { existsSync as existsSync38 } from "fs";
+import { dirname as dirname10, join as join40 } from "path";
+function findPackagedScript(startDir, relativePath) {
+  let dir = startDir;
+  for (; ; ) {
+    const candidate = join40(dir, relativePath);
+    if (existsSync38(candidate)) return candidate;
+    const parent = dirname10(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function packagedScriptMissing(relativePath) {
+  return `biffo: cannot find ${relativePath}.
+It ships with this package via cli/scripts/packaged-root-assets.mjs; if you are running from a checkout, run from inside the template repo. If you are running the published package, this is a packaging bug \u2014 the asset was not copied at prepack.`;
+}
+
+// src/lib/plugin-verify/conformance-driver.ts
+var CONFORMANCE_MODULE = "biffo_plugin_sdk.conformance";
+function uvRunPython(runner, cwd, args, captureStdout = false) {
+  return runner.run(
+    "uv",
+    ["run", "--no-sync", "--directory", cwd, "python", "-m", CONFORMANCE_MODULE, ...args],
+    { cwd, captureStdout }
+  );
+}
+function listChecks(runner, cwd) {
+  const { status } = uvRunPython(runner, cwd, ["list-checks"]);
+  return status ?? 2;
+}
+function runChecksOnce(runner, cwd, dsn) {
+  const { status } = uvRunPython(runner, cwd, ["run", "--repo-root", cwd, "--dsn", dsn]);
+  return status ?? 2;
+}
+
+// src/lib/plugin-verify/raise-postgres.ts
+function raisePostgres(runner, script, cwd) {
+  const { status, stdout } = runner.run(script, [], { cwd, captureStdout: true });
+  if (status !== 0) {
+    return { dsn: null, status: status ?? 2 };
+  }
+  const dsn = stdout.trim();
+  if (!dsn) {
+    return { dsn: null, status: 1 };
+  }
+  return { dsn, status: 0 };
+}
+
+// src/lib/plugin-verify/run-plugin-verify.ts
+var PG_TEST_DB_SCRIPT = "scripts/pg-test-db.sh";
+async function runPluginVerify(options, deps) {
+  if (options.listChecks) {
+    return listChecks(deps.runner, options.cwd);
+  }
+  const script = deps.findScript(PG_TEST_DB_SCRIPT);
+  if (!script) {
+    log.error(packagedScriptMissing(PG_TEST_DB_SCRIPT));
+    return 2;
+  }
+  const raised = raisePostgres(deps.runner, script, options.cwd);
+  if (!raised.dsn) {
+    log.error(
+      `plugin verify: could not provision the local Postgres test database (${PG_TEST_DB_SCRIPT} exited ${raised.status})`
+    );
+    return raised.status;
+  }
+  log.info("plugin verify: pass 1 of 2");
+  const first = runChecksOnce(deps.runner, options.cwd, raised.dsn);
+  if (first !== 0) {
+    log.error("plugin verify: the first run failed -- see the check output above");
+    return first;
+  }
+  log.info("plugin verify: pass 2 of 2 (re-runability against the same database)");
+  const second = runChecksOnce(deps.runner, options.cwd, raised.dsn);
+  if (second !== 0) {
+    log.error(
+      "plugin verify: a second consecutive run against the same database failed -- a check that is not re-runnable fails the job (biffo-template#1924)"
+    );
+    return second;
+  }
+  log.success("plugin verify: green twice against the same database");
+  return 0;
+}
+
+// src/commands/plugin-verify.ts
+var pluginVerifyCommand = new Command21("verify").description(
+  "Real-execution conformance harness for a plugin repo: raises a real Postgres, runs every implemented biffo_plugin_sdk.conformance check twice against it, and exits non-zero on the first failure (biffo-template#1523/#1924)."
+).option("--cwd <path>", "Plugin repo root to check (defaults to the current directory)").option("--list-checks", "Print every declared #1523 seam and its implemented state, then exit").action(async (options) => {
+  const cwd = options.cwd ? resolve18(options.cwd) : process.cwd();
+  const here = dirname11(fileURLToPath6(import.meta.url));
+  const exitCode = await runPluginVerify(
+    { cwd, listChecks: options.listChecks ?? false },
+    {
+      runner: new RealCommandRunner(),
+      findScript: (relativePath) => findPackagedScript(here, relativePath)
+    }
+  );
+  process.exit(exitCode);
+});
+
 // src/commands/plugin.ts
-var pluginCommand = new Command21("plugin").description("Manage Biffo plugins");
+var pluginCommand = new Command22("plugin").description("Manage Biffo plugins");
 pluginCommand.addCommand(pluginCreateCommand);
 pluginCommand.addCommand(pluginListCommand);
 pluginCommand.addCommand(pluginInstallCommand);
@@ -11243,15 +11367,16 @@ pluginCommand.addCommand(pluginUpgradeCommand);
 pluginCommand.addCommand(pluginSyncMigrationsCommand);
 pluginCommand.addCommand(pluginInfoCommand);
 pluginCommand.addCommand(pluginStalenessCommand);
+pluginCommand.addCommand(pluginVerifyCommand);
 
 // src/commands/sibling.ts
-import { Command as Command23 } from "commander";
+import { Command as Command24 } from "commander";
 
 // src/commands/sibling-check-identity.ts
-import { existsSync as existsSync38, readFileSync as readFileSync29 } from "fs";
-import { resolve as resolve18 } from "path";
+import { existsSync as existsSync39, readFileSync as readFileSync29 } from "fs";
+import { resolve as resolve19 } from "path";
 import chalk20 from "chalk";
-import { Command as Command22 } from "commander";
+import { Command as Command23 } from "commander";
 
 // src/lib/sibling-identity-check.ts
 function checkSiblingIdentity(envs) {
@@ -11303,7 +11428,7 @@ function checkSiblingIdentity(envs) {
 // src/commands/sibling-check-identity.ts
 var VALID_ENVIRONMENTS2 = ["dev", "staging", "prod"];
 var SIBLING_CORE_POOL_VAR = "CORE_COGNITO_USER_POOL_ID";
-var siblingCheckIdentityCommand = new Command22("check-identity").description(
+var siblingCheckIdentityCommand = new Command23("check-identity").description(
   "Detect when a core's Cognito pool has drifted from its published identity document or any sibling's baked-in CORE_COGNITO_USER_POOL_ID (#400). Run from the core repo; exits non-zero on drift so a scheduled/CI run goes red."
 ).option("--env <environment>", "Only check this environment (default: dev, staging, prod)").option("-p, --project <name>", "Project name (overrides biffo.config.json in current directory)").option("-c, --config <path>", "Path to biffo.config.json").action(async (options) => {
   if (options.env && !VALID_ENVIRONMENTS2.includes(options.env)) {
@@ -11442,7 +11567,7 @@ async function fetchPublishedIdentity(portalUrl) {
 }
 async function resolveConfig4(options) {
   if (options.config) {
-    const raw = JSON.parse(readFileSync29(resolve18(options.config), "utf8"));
+    const raw = JSON.parse(readFileSync29(resolve19(options.config), "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (!result.success) {
       log.error(`Invalid config at ${options.config}:`);
@@ -11461,8 +11586,8 @@ async function resolveConfig4(options) {
     }
     return cfg;
   }
-  const localConfigPath = resolve18(process.cwd(), "biffo.config.json");
-  if (existsSync38(localConfigPath)) {
+  const localConfigPath = resolve19(process.cwd(), "biffo.config.json");
+  if (existsSync39(localConfigPath)) {
     const raw = JSON.parse(readFileSync29(localConfigPath, "utf8"));
     const result = BiffoConfigSchema.safeParse(raw);
     if (result.success) return result.data;
@@ -11499,28 +11624,28 @@ async function resolveConfig4(options) {
 }
 
 // src/commands/sibling.ts
-var siblingCommand = new Command23("sibling").description(
+var siblingCommand = new Command24("sibling").description(
   "Create and manage sibling apps that share a Biffo core project (ADR-0007)"
 );
 siblingCommand.addCommand(siblingCreateCommand);
 siblingCommand.addCommand(siblingCheckIdentityCommand);
 
 // src/commands/check.ts
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/scripts/check-adr-numbering.ts
-import { existsSync as existsSync40 } from "fs";
-import { join as join41 } from "path";
+import { existsSync as existsSync41 } from "fs";
+import { join as join42 } from "path";
 
 // src/lib/adr-numbering-guard.ts
-import { existsSync as existsSync39, readdirSync as readdirSync15, readFileSync as readFileSync30 } from "fs";
-import { join as join40 } from "path";
+import { existsSync as existsSync40, readdirSync as readdirSync15, readFileSync as readFileSync30 } from "fs";
+import { join as join41 } from "path";
 var ADR_FILENAME = /^(\d{4})-.+\.md$/;
 var ALLOWLIST_FILENAME = ".numbering-allowlist";
 var TEMPLATE_ADR_RESERVED_UPTO = "0099";
 function readAdrNumberingAllowlist(adrDir) {
-  const path = join40(adrDir, ALLOWLIST_FILENAME);
-  if (!existsSync39(path)) return /* @__PURE__ */ new Set();
+  const path = join41(adrDir, ALLOWLIST_FILENAME);
+  if (!existsSync40(path)) return /* @__PURE__ */ new Set();
   const numbers = /* @__PURE__ */ new Set();
   for (const rawLine of readFileSync30(path, "utf8").split("\n")) {
     const line = rawLine.split("#")[0].trim();
@@ -11530,7 +11655,7 @@ function readAdrNumberingAllowlist(adrDir) {
 }
 function adrNumbersIn(adrDir) {
   const claims = /* @__PURE__ */ new Map();
-  if (!existsSync39(adrDir)) return claims;
+  if (!existsSync40(adrDir)) return claims;
   for (const entry of readdirSync15(adrDir).sort()) {
     const match = ADR_FILENAME.exec(entry);
     if (!match) continue;
@@ -11585,8 +11710,8 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const adrDir = join41(root, "docs", "ADR");
-  if (!existsSync40(adrDir)) {
+  const adrDir = join42(root, "docs", "ADR");
+  if (!existsSync41(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
     return;
   }
@@ -11625,7 +11750,7 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 
 // src/lib/api-gateway-integration-guard.ts
 import { readFileSync as readFileSync31, readdirSync as readdirSync16, statSync as statSync9 } from "fs";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var MODULE_TYPE = "module";
 var INTEGRATION_TYPE = "aws_apigatewayv2_integration";
@@ -11707,7 +11832,7 @@ function walkTerraformFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join42(dir, entry);
+      const p = join43(dir, entry);
       let st;
       try {
         st = statSync9(p);
@@ -12123,17 +12248,17 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
 }
 
 // src/lib/claim-invocation-parity.ts
-import { existsSync as existsSync41, readFileSync as readFileSync32, readdirSync as readdirSync17 } from "fs";
-import { join as join43 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync32, readdirSync as readdirSync17 } from "fs";
+import { join as join44 } from "path";
 function distributedAgentsDocs(root) {
   const docs = [];
-  const own = join43(root, "AGENTS.md");
-  if (existsSync41(own)) docs.push({ path: "AGENTS.md", text: readFileSync32(own, "utf8") });
-  const skeletons = join43(root, "_skeletons");
-  if (existsSync41(skeletons)) {
+  const own = join44(root, "AGENTS.md");
+  if (existsSync42(own)) docs.push({ path: "AGENTS.md", text: readFileSync32(own, "utf8") });
+  const skeletons = join44(root, "_skeletons");
+  if (existsSync42(skeletons)) {
     for (const name of readdirSync17(skeletons).sort()) {
-      const abs = join43(skeletons, name, "AGENTS.md");
-      if (!existsSync41(abs)) continue;
+      const abs = join44(skeletons, name, "AGENTS.md");
+      if (!existsSync42(abs)) continue;
       docs.push({ path: `_skeletons/${name}/AGENTS.md`, text: readFileSync32(abs, "utf8") });
     }
   }
@@ -12266,12 +12391,12 @@ async function runClaimInvocationCheck() {
 }
 
 // src/scripts/check-codeql-suppression.ts
-import { existsSync as existsSync42 } from "fs";
-import { join as join45, relative as relative8 } from "path";
+import { existsSync as existsSync43 } from "fs";
+import { join as join46, relative as relative8 } from "path";
 
 // src/lib/codeql-suppression-guard.ts
 import { readdirSync as readdirSync18, readFileSync as readFileSync33, statSync as statSync10 } from "fs";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   ".git",
   ".worktrees",
@@ -12302,7 +12427,7 @@ function walkSourceFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join44(dir, entry);
+      const p = join45(dir, entry);
       let st;
       try {
         st = statSync10(p);
@@ -12339,8 +12464,8 @@ function sweepCodeqlSuppressionComments(root) {
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const scanRoot = join45(root, "cli", "src");
-  if (!existsSync42(scanRoot)) {
+  const scanRoot = join46(root, "cli", "src");
+  if (!existsSync43(scanRoot)) {
     console.log(
       "\u2014 codeql-suppression guard: skipped \u2014 no cli/src in this repo, so there is no CLI source to scan."
     );
@@ -12364,12 +12489,12 @@ async function runCodeqlSuppressionCheck() {
 }
 
 // src/scripts/check-cognito-invite-template.ts
-import { existsSync as existsSync43 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync44 } from "fs";
+import { join as join48 } from "path";
 
 // src/lib/cognito-invite-template-guard.ts
 import { readdirSync as readdirSync19, readFileSync as readFileSync34, statSync as statSync11 } from "fs";
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -12453,7 +12578,7 @@ function findModuleTerraformFiles(repoRoot) {
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees" || entry === ".venv")
         continue;
-      const full = join46(dir, entry);
+      const full = join47(dir, entry);
       const rel = `${relative11}/${entry}`;
       let isDir;
       try {
@@ -12468,12 +12593,12 @@ function findModuleTerraformFiles(repoRoot) {
       }
     }
   };
-  walk2(join46(repoRoot, "modules"), "modules");
+  walk2(join47(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync34(join46(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync34(join47(repoRoot, file), "utf8"))
   );
 }
 
@@ -12483,7 +12608,7 @@ async function runCognitoInviteTemplateCheck() {
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
-    if (!existsSync43(join47(root, "modules"))) {
+    if (!existsSync44(join48(root, "modules"))) {
       console.log(
         `\xB7 Cognito invite template guard: not applicable \u2014 no modules/ directory under ${root} \u2014 this is not a template/instance tree (a satellite repo never carries the template-owned Terraform modules). Skipping.`
       );
@@ -12507,11 +12632,11 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync44, readFileSync as readFileSync35, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
-import { join as join48 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync35, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
+import { join as join49 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -12675,7 +12800,7 @@ function walkFiles(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join48(dir, entry);
+      const p = join49(dir, entry);
       let st;
       try {
         st = statSync12(p);
@@ -12770,7 +12895,7 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join48(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join49(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
     raw = readFileSync35(configPath, "utf8");
@@ -12793,8 +12918,8 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join48(estateDir, coreProject, "services", "api", "src");
-  if (!existsSync44(coreApiSrcDir)) {
+  const coreApiSrcDir = join49(estateDir, coreProject, "services", "api", "src");
+  if (!existsSync45(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
     );
@@ -12847,7 +12972,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     }
   }
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join49(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join50(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -12863,7 +12988,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join49(root, "services", "api", "src");
+    coreApiSrcDir = join50(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -13114,16 +13239,16 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-distribution-inventory.ts
-import { existsSync as existsSync46 } from "fs";
-import { join as join51 } from "path";
+import { existsSync as existsSync47 } from "fs";
+import { join as join52 } from "path";
 
 // src/lib/distribution-inventory.ts
-import { existsSync as existsSync45, readFileSync as readFileSync36 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync36 } from "fs";
+import { join as join51 } from "path";
 var INVENTORY_FILENAME = "distribution-inventory.json";
 function loadDistributionInventory(root) {
-  const path = join50(root, INVENTORY_FILENAME);
-  if (!existsSync45(path)) {
+  const path = join51(root, INVENTORY_FILENAME);
+  if (!existsSync46(path)) {
     throw new Error(
       `${INVENTORY_FILENAME} not found at ${root} -- expected it beside core-manifest.json`
     );
@@ -13288,7 +13413,7 @@ async function runDistributionInventoryCheck(root) {
     );
     return;
   }
-  if (!existsSync46(join51(repoRoot, INVENTORY_FILENAME))) {
+  if (!existsSync47(join52(repoRoot, INVENTORY_FILENAME))) {
     console.log(
       `\u2713 distribution-inventory: skipped \u2014 no ${INVENTORY_FILENAME} at ${repoRoot}. This is a template-only registry; a checkout that legitimately has none has nothing for this guard to check.`
     );
@@ -13314,7 +13439,7 @@ async function runDistributionInventoryCheck(root) {
 }
 
 // src/scripts/check-distribution-remote-state.ts
-import { join as join52 } from "path";
+import { join as join53 } from "path";
 async function ghExecCommand(file, args) {
   const result = await execa(file, args, { reject: false });
   return { stdout: String(result.stdout ?? ""), exitCode: result.exitCode ?? null };
@@ -13329,7 +13454,7 @@ async function runDistributionRemoteStateCheck(root) {
     }
   }
   console.log(
-    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join52(repoRoot, "distribution-inventory.json")})`
+    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join53(repoRoot, "distribution-inventory.json")})`
   );
   if (assertions.length === 0) {
     console.log("\u2713 distribution-remote-state: nothing declared to check");
@@ -13375,7 +13500,7 @@ ${assertion.ref}`;
 
 // src/lib/eventbridge-log-permission-guard.ts
 import { readFileSync as readFileSync37, readdirSync as readdirSync21, statSync as statSync13 } from "fs";
-import { join as join53 } from "path";
+import { join as join54 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -13452,7 +13577,7 @@ function walkTerraformFiles2(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join53(dir, entry);
+      const p = join54(dir, entry);
       let st;
       try {
         st = statSync13(p);
@@ -13592,8 +13717,8 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-instance-adoption.ts
-import { existsSync as existsSync47 } from "fs";
-import { join as join54 } from "path";
+import { existsSync as existsSync48 } from "fs";
+import { join as join55 } from "path";
 async function runInstanceAdoptionCheck(opts = {}) {
   if (!opts.instanceDir) {
     console.error(
@@ -13601,7 +13726,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
     );
     process.exit(2);
   }
-  if (!existsSync47(opts.instanceDir)) {
+  if (!existsSync48(opts.instanceDir)) {
     console.error(
       `\u2717 instance-adoption guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it is adopted, and that is not the same as a clean pass.`
     );
@@ -13609,7 +13734,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
   }
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const theirsDir = opts.theirsDir ?? root;
-  const instanceLabel = opts.instance ?? join54(opts.instanceDir).split("/").filter(Boolean).pop();
+  const instanceLabel = opts.instance ?? join55(opts.instanceDir).split("/").filter(Boolean).pop();
   const report = checkInstanceAdoption(theirsDir, opts.instanceDir);
   console.log(
     `examined ${report.examinedInstances} instance (${instanceLabel}) against ${report.registeredPairs} registered pair(s), ${report.applicablePairs} applicable to this instance, against template tree ${theirsDir}`
@@ -13632,11 +13757,11 @@ async function runInstanceAdoptionCheck(opts = {}) {
 
 // src/lib/lambda-output-guard.ts
 import { readFileSync as readFileSync39 } from "fs";
-import { join as join56 } from "path";
+import { join as join57 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync48, readdirSync as readdirSync22, readFileSync as readFileSync38, statSync as statSync14 } from "fs";
-import { join as join55 } from "path";
+import { existsSync as existsSync49, readdirSync as readdirSync22, readFileSync as readFileSync38, statSync as statSync14 } from "fs";
+import { join as join56 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -13650,7 +13775,7 @@ function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
 function vendoredPluginServiceDirs(repoRoot) {
-  const servicesDir = join55(repoRoot, "services");
+  const servicesDir = join56(repoRoot, "services");
   const result = /* @__PURE__ */ new Set();
   let entries;
   try {
@@ -13659,9 +13784,9 @@ function vendoredPluginServiceDirs(repoRoot) {
     return result;
   }
   for (const entry of entries) {
-    const full = join55(servicesDir, entry);
-    if (!existsSync48(full) || !statSync14(full).isDirectory()) continue;
-    if (existsSync48(join55(full, "biffo.plugin.json"))) {
+    const full = join56(servicesDir, entry);
+    if (!existsSync49(full) || !statSync14(full).isDirectory()) continue;
+    if (existsSync49(join56(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
   }
@@ -13683,7 +13808,7 @@ function findWorkflowFiles(repoRoot) {
       if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
-      const full = join55(dir, entry);
+      const full = join56(dir, entry);
       const rel = relative11 ? `${relative11}/${entry}` : entry;
       let isDir;
       try {
@@ -13733,7 +13858,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync38(join55(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync38(join56(repoRoot, file), "utf8"))
   );
 }
 
@@ -13791,7 +13916,7 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync39(join56(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync39(join57(repoRoot, file), "utf8"))
   );
 }
 
@@ -13819,8 +13944,8 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-migration-body-change.ts
-import { existsSync as existsSync49 } from "fs";
-import { join as join57 } from "path";
+import { existsSync as existsSync50 } from "fs";
+import { join as join58 } from "path";
 
 // src/lib/migration-body-change-guard.ts
 function checkMigrationBodyChangeMarkers(diffs) {
@@ -13902,7 +14027,7 @@ async function runMigrationBodyChangeCheck(argv) {
     );
     return;
   }
-  if (!existsSync49(join57(root, MIGRATIONS_VERSIONS_DIR))) {
+  if (!existsSync50(join58(root, MIGRATIONS_VERSIONS_DIR))) {
     console.log(`\u2713 migration body-change guard: no ${MIGRATIONS_VERSIONS_DIR} in this repo.`);
     return;
   }
@@ -14008,8 +14133,8 @@ ${BOLD2}What to do${OFF2}
 }
 
 // src/scripts/check-orphan-ratchet.ts
-import { existsSync as existsSync50 } from "fs";
-import { basename as basename3, join as join58 } from "path";
+import { existsSync as existsSync51 } from "fs";
+import { basename as basename3, join as join59 } from "path";
 function reportOrphan(entry, manifest) {
   console.error(`  ${entry.path}`);
   const { templateOwnedMatch, nearestUserOwnedEntries } = explainOwnership(entry.path, manifest);
@@ -14031,7 +14156,7 @@ function reportOrphan(entry, manifest) {
   }
 }
 async function runOrphanRatchetCheck(opts = {}) {
-  if (opts.instanceDir !== void 0 && !existsSync50(opts.instanceDir)) {
+  if (opts.instanceDir !== void 0 && !existsSync51(opts.instanceDir)) {
     console.error(
       `\u2717 orphan-ratchet guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it carries unsanctioned files, and that is not the same as a clean pass.`
     );
@@ -14048,7 +14173,7 @@ async function runOrphanRatchetCheck(opts = {}) {
       "self-check mode: --instance-dir was not given, so it defaulted to --theirs-dir (this repo's own root) alongside --base-dir \u2014 all three trees are the same, so this run can only ever find zero orphans by construction. See this script's doc comment. Pass a real instance tree with --instance-dir for a check that can actually find something. biffo-template#1714."
     );
   }
-  if (!existsSync50(join58(theirsDir, CORE_MANIFEST_FILE))) {
+  if (!existsSync51(join59(theirsDir, CORE_MANIFEST_FILE))) {
     console.log(
       `orphan-ratchet guard (${label}): no ${CORE_MANIFEST_FILE} in ${theirsDir} \u2014 this is not a Biffo template/instance tree (a satellite repo never carries one), so there is no ownership manifest to classify paths against. Not applicable; skipping.`
     );
@@ -14080,7 +14205,7 @@ baseline was ${String(ratchet.baseline)}, now ${String(ratchet.count)}. See biff
 
 // src/lib/ownership-header-claim-guard.ts
 import { readFileSync as readFileSync40 } from "fs";
-import { join as join59 } from "path";
+import { join as join60 } from "path";
 var OWNERSHIP_HEADER_SWEEP_DIRS = [
   "scripts",
   ".githooks",
@@ -14289,7 +14414,7 @@ function sweepOwnershipHeaderClaims(root, options = {}) {
   for (const rel of files) {
     let content;
     try {
-      content = readFileSync40(join59(root, rel), "utf8");
+      content = readFileSync40(join60(root, rel), "utf8");
     } catch {
       continue;
     }
@@ -14365,7 +14490,7 @@ async function runOwnershipHeaderClaimCheck() {
 
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync41, readdirSync as readdirSync23 } from "fs";
-import { join as join60, relative as relative9 } from "path";
+import { join as join61, relative as relative9 } from "path";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -14461,7 +14586,7 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join60(root, dir);
+    const full = join61(root, dir);
     let entries;
     try {
       entries = readdirSync23(full, { withFileTypes: true });
@@ -14471,7 +14596,7 @@ function shellFiles(root) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join60(full, entry.name));
+      out.push(join61(full, entry.name));
     }
   }
   return out;
@@ -14505,7 +14630,7 @@ async function runPipeTrapCheck() {
 
 // src/lib/plugin-allowlist-convention.ts
 import { readFileSync as readFileSync42 } from "fs";
-import { join as join61 } from "path";
+import { join as join62 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -14516,7 +14641,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync42(join61(repoRoot, relative11), "utf8");
+    return readFileSync42(join62(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -14525,7 +14650,7 @@ function assignedString(source, name) {
   const match = new RegExp(`^\\s*${name}\\s*=\\s*"((?:[^"\\\\]|\\\\.)*)"\\s*$`, "m").exec(source);
   return match?.[1];
 }
-function resolve19(expression, bindings) {
+function resolve20(expression, bindings) {
   let current = expression;
   for (let pass = 0; pass < 10; pass += 1) {
     const next = current.replace(/\$\{([^}]+)\}/g, (whole, ref) => {
@@ -14562,13 +14687,13 @@ function composeExpectedRoleName(repoRoot) {
     "var.project_name": PROJECT,
     "var.environment": ENV,
     "var.plugin_name": PLUGIN,
-    "var.function_name": resolve19(pluginFunctionName, {
+    "var.function_name": resolve20(pluginFunctionName, {
       "var.plugin_name": PLUGIN
     })
   };
-  bindings["local.name_prefix"] = resolve19(namePrefix, bindings);
-  bindings["local.function_name"] = resolve19(functionName, bindings);
-  return resolve19(roleName, bindings);
+  bindings["local.name_prefix"] = resolve20(namePrefix, bindings);
+  bindings["local.function_name"] = resolve20(functionName, bindings);
+  return resolve20(roleName, bindings);
 }
 function readAllowlistGlob(repoRoot) {
   const allowlist = read(repoRoot, ALLOWLIST_MAIN_TF);
@@ -14578,7 +14703,7 @@ function readAllowlistGlob(repoRoot) {
       `plugin-allowlist drift guard: could not find the "for name in var.enabled_plugins" glob in ${ALLOWLIST_MAIN_TF}.`
     );
   }
-  return resolve19(glob, {
+  return resolve20(glob, {
     "data.aws_caller_identity.current.account_id": ACCOUNT,
     "var.project_name": PROJECT,
     "var.environment": ENV,
@@ -14644,32 +14769,32 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync52 } from "fs";
-import { join as join63 } from "path";
+import { existsSync as existsSync53 } from "fs";
+import { join as join64 } from "path";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync51, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
-import { join as join62 } from "path";
+import { existsSync as existsSync52, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
+import { join as join63 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync51(dir)) return [];
+  if (!existsSync52(dir)) return [];
   return readdirSync24(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync15(join62(dir, entry)).isDirectory();
+      return statSync15(join63(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync51(join62(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync52(join63(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join62(pluginDir2, "tests");
-  if (!existsSync51(testsDir)) return [];
-  if (existsSync51(join62(testsDir, "__init__.py"))) return [];
+  const testsDir = join63(pluginDir2, "tests");
+  if (!existsSync52(testsDir)) return [];
+  if (existsSync52(join63(testsDir, "__init__.py"))) return [];
   return readdirSync24(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -14678,7 +14803,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join62(servicesDir, plugin))) {
+      for (const name of namesOf(join63(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -14716,8 +14841,8 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join63(root, "services");
-  if (!existsSync52(servicesDir)) {
+  const servicesDir = join64(root, "services");
+  if (!existsSync53(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -14734,8 +14859,8 @@ async function runPluginCollisionCheck() {
 }
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync53, readFileSync as readFileSync43, readdirSync as readdirSync25 } from "fs";
-import { dirname as dirname10, join as join64, relative as relative10, sep as sep4 } from "path";
+import { existsSync as existsSync54, readFileSync as readFileSync43, readdirSync as readdirSync25 } from "fs";
+import { dirname as dirname12, join as join65, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS4 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -14750,9 +14875,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS4.has(entry.name)) continue;
-        walk2(join64(dir, entry.name));
+        walk2(join65(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join64(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join65(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -14777,14 +14902,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync53(join64(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync54(join65(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join64(root, manifest);
+    const absManifest = join65(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
-    const pluginDir2 = dirname10(absManifest);
-    if (existsSync53(join64(pluginDir2, "terraform"))) continue;
+    const pluginDir2 = dirname12(absManifest);
+    if (existsSync54(join65(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -14815,12 +14940,12 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync55 } from "fs";
-import { join as join66 } from "path";
+import { existsSync as existsSync56 } from "fs";
+import { join as join67 } from "path";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync54, readFileSync as readFileSync44, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
-import { join as join65 } from "path";
+import { existsSync as existsSync55, readFileSync as readFileSync44, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
+import { join as join66 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -15237,7 +15362,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync16(join65(root, e)).isDirectory();
+      return statSync16(join66(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -15253,7 +15378,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join65(dir, entry);
+      const p = join66(dir, entry);
       let st;
       try {
         st = statSync16(p);
@@ -15279,14 +15404,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join65(pluginDir2, "terraform");
+  const tfDir = join66(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync26(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join65(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join66(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -15538,8 +15663,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join65("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join65(
+var CONFIG_PY_PATH = join66("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join66(
   "services",
   "api",
   "src",
@@ -15551,10 +15676,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join65(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join65(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync54(configPath);
-  const orchestrationSchemaMissing = !existsSync54(orchestrationPath);
+  const configPath = join66(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join66(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync55(configPath);
+  const orchestrationSchemaMissing = !existsSync55(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -15625,7 +15750,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync16(join65(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync16(join66(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -15638,8 +15763,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join65(pluginsRoot, name);
-    const manifestText = readFileSync44(join65(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join66(pluginsRoot, name);
+    const manifestText = readFileSync44(join66(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -15737,7 +15862,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join65(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join66(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -15777,8 +15902,8 @@ async function runPluginToolSupplyCheck() {
     return;
   }
   let allOk = true;
-  const pluginsRoot = join66(root, "services", "_plugins");
-  if (!existsSync55(pluginsRoot)) {
+  const pluginsRoot = join67(root, "services", "_plugins");
+  if (!existsSync56(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -15808,8 +15933,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join66(root, "services", "api");
-  if (!existsSync55(servicesApiRoot)) {
+  const servicesApiRoot = join67(root, "services", "api");
+  if (!existsSync56(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -16186,12 +16311,12 @@ async function runSharedFileReductionCheck(args) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync56, readdirSync as readdirSync28 } from "fs";
-import { join as join68 } from "path";
+import { existsSync as existsSync57, readdirSync as readdirSync28 } from "fs";
+import { join as join69 } from "path";
 
 // src/lib/skeleton-drift-guard.ts
 import { readFileSync as readFileSync47, readdirSync as readdirSync27, statSync as statSync17 } from "fs";
-import { join as join67 } from "path";
+import { join as join68 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -16255,7 +16380,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join67(dir, entry);
+    const abs = join68(dir, entry);
     let isDir;
     try {
       isDir = statSync17(abs).isDirectory();
@@ -16277,7 +16402,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync47(join67(skeletonRoot, rel), "utf8");
+        contents = readFileSync47(join68(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -16306,23 +16431,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join68(root, "_skeletons");
+  const skeletonsDir = join69(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync28(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync56(join68(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync57(join69(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join68(root, "_skeletons", name);
+    const skeletonRoot = join69(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync56(join68(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync57(join69(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -16330,7 +16455,7 @@ async function runSkeletonDriftCheck() {
     `audited ${skeletons.length} skeleton(s) (${skeletons.join(", ") || "none"}), ${filesConsidered} file(s) considered, under ${root}/_skeletons`
   );
   if (skeletons.length === 0) {
-    if (!existsSync56(join68(root, "_skeletons"))) {
+    if (!existsSync57(join69(root, "_skeletons"))) {
       console.log(
         `\xB7 Skeleton-drift guard: no _skeletons/ directory under ${root} \u2014 this is not a repo that ships scaffolding (a satellite repo never carries one). Not applicable; skipping.`
       );
@@ -16342,7 +16467,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join68(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join69(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -16377,7 +16502,7 @@ async function runTerraformInputCheck() {
 }
 
 // src/commands/check.ts
-var checkCommand = new Command24("check").description(
+var checkCommand = new Command25("check").description(
   "Repo guards (ownership, ownership-header-claim, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, instance-adoption, orphan-ratchet, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention, migration-body-change, distribution-inventory, distribution-remote-state, api-gateway-integration) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
@@ -16543,10 +16668,10 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync57, readFileSync as readFileSync48 } from "fs";
-import { join as join70, resolve as resolve20 } from "path";
+import { existsSync as existsSync58, readFileSync as readFileSync48 } from "fs";
+import { join as join71, resolve as resolve21 } from "path";
 import chalk21 from "chalk";
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 
 // src/adapters/github-cli/index.ts
 var GithubCliAdapter = class {
@@ -16885,11 +17010,11 @@ async function reapAllBareBranches(cwd, branches, worktrees, currentBranch, deps
 
 // src/lib/scratch-clone-scan.ts
 import { readdirSync as readdirSync29, statSync as statSync18 } from "fs";
-import { join as join69 } from "path";
+import { join as join70 } from "path";
 var INTEGRATION_BRANCH = "dev";
 function isPlainCloneDir(path) {
   try {
-    return statSync18(join69(path, ".git")).isDirectory();
+    return statSync18(join70(path, ".git")).isDirectory();
   } catch {
     return false;
   }
@@ -16904,7 +17029,7 @@ async function findScratchCloneCandidates(estateRoot, deps) {
   const names = readdirSync29(estateRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   const candidates = [];
   for (const name of names) {
-    const path = join69(estateRoot, name);
+    const path = join70(estateRoot, name);
     if (!isPlainCloneDir(path)) continue;
     let branch;
     try {
@@ -16953,7 +17078,7 @@ async function classifyScratchClones(candidates, deps) {
 
 // src/commands/doctor.ts
 var INTEGRATION_BRANCH2 = "dev";
-var doctorCommand = new Command25("doctor").description(
+var doctorCommand = new Command26("doctor").description(
   "Report repo-state conditions that make everything read from this checkout unreliable"
 ).option("--cwd <path>", "Repo root to inspect (defaults to the current directory)").option("--no-fetch", "Skip the fetch; report against refs as they already are locally").option(
   "--fix",
@@ -16964,10 +17089,10 @@ var doctorCommand = new Command25("doctor").description(
 ).action(
   async (options) => {
     if (options.scratchClones !== void 0) {
-      await runScratchCloneScan(resolve20(options.scratchClones));
+      await runScratchCloneScan(resolve21(options.scratchClones));
       return;
     }
-    const cwd = options.cwd ? resolve20(options.cwd) : process.cwd();
+    const cwd = options.cwd ? resolve21(options.cwd) : process.cwd();
     const git = new GitAdapter();
     try {
       const facts = await gatherRepoFacts({ cwd, fetch: options.fetch !== false }, { git });
@@ -17084,8 +17209,8 @@ function printScratchCloneReports(estateRoot, reports) {
   );
 }
 function readLocalCoreVersion(cwd) {
-  const path = join70(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync57(path)) return null;
+  const path = join71(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync58(path)) return null;
   try {
     return extractVersionField(readFileSync48(path, "utf8"));
   } catch {
@@ -17107,8 +17232,8 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join70(cwd, CORE_VERSION_FILE);
-  if (!existsSync57(path)) return null;
+  const path = join71(cwd, CORE_VERSION_FILE);
+  if (!existsSync58(path)) return null;
   try {
     const value = readFileSync48(path, "utf8").trim();
     return value === "" ? null : value;
@@ -17231,9 +17356,9 @@ function printBranchReapOutcomes(outcomes) {
 import { execSync as execSync7 } from "child_process";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STSClient3 } from "@aws-sdk/client-sts";
 import chalk22 from "chalk";
-import { Command as Command26 } from "commander";
+import { Command as Command27 } from "commander";
 import inquirer8 from "inquirer";
-var teardownCommand = new Command26("teardown").description(
+var teardownCommand = new Command27("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
   "--confirm <name>",
@@ -17641,31 +17766,11 @@ function resolveGithubToken4() {
 }
 
 // src/lib/packaged-script-command.ts
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import { chmodSync as chmodSync2, statSync as statSync19 } from "fs";
-import { dirname as dirname12 } from "path";
-import { fileURLToPath as fileURLToPath6 } from "url";
-import { Command as Command27 } from "commander";
-
-// src/lib/packaged-scripts.ts
-import { existsSync as existsSync58 } from "fs";
-import { dirname as dirname11, join as join71 } from "path";
-function findPackagedScript(startDir, relativePath) {
-  let dir = startDir;
-  for (; ; ) {
-    const candidate = join71(dir, relativePath);
-    if (existsSync58(candidate)) return candidate;
-    const parent = dirname11(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function packagedScriptMissing(relativePath) {
-  return `biffo: cannot find ${relativePath}.
-It ships with this package via cli/scripts/packaged-root-assets.mjs; if you are running from a checkout, run from inside the template repo. If you are running the published package, this is a packaging bug \u2014 the asset was not copied at prepack.`;
-}
-
-// src/lib/packaged-script-command.ts
+import { dirname as dirname13 } from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
+import { Command as Command28 } from "commander";
 function ensureExecutable(script) {
   try {
     const { mode } = statSync19(script);
@@ -17675,14 +17780,14 @@ function ensureExecutable(script) {
 }
 function runPackagedScript(script, args, cwd) {
   ensureExecutable(script);
-  const result = spawnSync(script, args, { stdio: "inherit", cwd });
+  const result = spawnSync2(script, args, { stdio: "inherit", cwd });
   return result.status === null ? 2 : result.status;
 }
 function packagedScriptCommand(spec) {
-  const command = new Command27(spec.name).description(spec.description).allowExcessArguments(true).allowUnknownOption(true);
+  const command = new Command28(spec.name).description(spec.description).allowExcessArguments(true).allowUnknownOption(true);
   if (spec.argument) command.argument(`<${spec.argument.name}>`, spec.argument.description);
   return command.action(() => {
-    const here = dirname12(fileURLToPath6(import.meta.url));
+    const here = dirname13(fileURLToPath7(import.meta.url));
     const script = findPackagedScript(here, spec.script);
     if (!script) {
       process.stderr.write(`${packagedScriptMissing(spec.script)}
@@ -17768,7 +17873,7 @@ var runnerDropForensicsCommand = packagedScriptCommand({
 });
 
 // src/index.ts
-var program = new Command28();
+var program = new Command29();
 function cliVersion() {
   try {
     return getLatestCoreVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.317.2",
+  "version": "0.318.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",