@massu/core 1.0.0 → 1.2.0

package/dist/cli.js

@@ -3277,10 +3277,10 @@ var require_array = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.splitWhen = exports.flatten = void 0;
-    function flatten(items) {
+    function flatten2(items) {
       return items.reduce((collection, item) => [].concat(collection, item), []);
     }
-    exports.flatten = flatten;
+    exports.flatten = flatten2;
     function splitWhen(items, predicate) {
       const result = [[]];
       let groupIndex = 0;
@@ -7797,41 +7797,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push(value) {
-        var p19 = new Promise(function(resolve22, reject) {
+        var p19 = new Promise(function(resolve25, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve22(result);
+            resolve25(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function unshift(value) {
-        var p19 = new Promise(function(resolve22, reject) {
+        var p19 = new Promise(function(resolve25, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve22(result);
+            resolve25(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function drained() {
-        var p19 = new Promise(function(resolve22) {
+        var p19 = new Promise(function(resolve25) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve22();
+              resolve25();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve22();
+                resolve25();
                 queue.drain = previousDrain;
               };
             }
@@ -8317,9 +8317,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve25, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve22(stats) : reject(error);
+            return error === null ? resolve25(stats) : reject(error);
           });
         });
       }
@@ -8343,10 +8343,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve25, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve22(entries);
+              resolve25(entries);
             } else {
               reject(error);
             }
@@ -8356,10 +8356,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve22, reject) => {
+        return new Promise((resolve25, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve22(entries));
+          stream.once("end", () => resolve25(entries));
         });
       }
     };
@@ -9686,6 +9686,132 @@ var init_detect = __esm({
   }
 });
 
+// src/detect/drift.ts
+import { createHash } from "crypto";
+function summarizeDetection(det) {
+  const languages = Array.from(new Set(det.manifests.map((m3) => m3.language))).sort();
+  const frameworks = {};
+  for (const lang of languages) {
+    const fw = det.frameworks[lang];
+    frameworks[lang] = {
+      framework: fw?.framework ?? null,
+      test_framework: fw?.test_framework ?? null,
+      orm: fw?.orm ?? null
+    };
+  }
+  const sourceDirs = {};
+  for (const lang of languages) {
+    const info = det.sourceDirs[lang];
+    sourceDirs[lang] = [...info?.source_dirs ?? []].sort();
+  }
+  const manifests = [...det.manifests.map((m3) => m3.relativePath)].sort();
+  const workspaces = [...det.monorepo.packages.map((p19) => p19.path)].sort();
+  return {
+    languages,
+    frameworks,
+    source_dirs: sourceDirs,
+    manifests,
+    monorepo: det.monorepo.type,
+    workspaces
+  };
+}
+function computeFingerprint(det) {
+  const data = summarizeDetection(det);
+  const stable = JSON.stringify(data, Object.keys(data).sort());
+  return createHash("sha256").update(stable).digest("hex");
+}
+function stringOf(v3) {
+  if (typeof v3 === "string") return v3;
+  if (v3 === null || v3 === void 0) return null;
+  return String(v3);
+}
+function detectDrift(currentConfig, actualDetection) {
+  const changes = [];
+  const configFw = currentConfig.framework && typeof currentConfig.framework === "object" ? currentConfig.framework : {};
+  const configLanguages = configFw.languages && typeof configFw.languages === "object" ? configFw.languages : {};
+  const detectedLanguages = Array.from(
+    new Set(actualDetection.manifests.map((m3) => m3.language))
+  );
+  const configLangKeys = Object.keys(configLanguages).sort();
+  const detectedLangKeys = [...detectedLanguages].sort();
+  if (JSON.stringify(configLangKeys) !== JSON.stringify(detectedLangKeys)) {
+    changes.push({
+      field: "framework.languages",
+      before: configLangKeys,
+      after: detectedLangKeys
+    });
+  }
+  for (const lang of detectedLanguages) {
+    const detFw = actualDetection.frameworks[lang];
+    const cfgEntry = configLanguages[lang];
+    if (!cfgEntry) continue;
+    const cfgFramework = stringOf(cfgEntry.framework);
+    const detFramework = detFw?.framework ?? null;
+    if (cfgFramework !== detFramework && detFramework !== null) {
+      changes.push({
+        field: `framework.languages.${lang}.framework`,
+        before: cfgFramework,
+        after: detFramework
+      });
+    }
+    const cfgTest = stringOf(cfgEntry.test_framework);
+    const detTest = detFw?.test_framework ?? null;
+    if (cfgTest !== detTest && detTest !== null) {
+      changes.push({
+        field: `framework.languages.${lang}.test_framework`,
+        before: cfgTest,
+        after: detTest
+      });
+    }
+  }
+  const detectedManifestPaths = new Set(actualDetection.manifests.map((m3) => m3.relativePath));
+  const declaredManifestPaths = /* @__PURE__ */ new Set();
+  const canonical = currentConfig.canonical_paths;
+  if (canonical && typeof canonical.manifest_paths === "string") {
+    for (const p19 of canonical.manifest_paths.split(",").map((s) => s.trim())) {
+      if (p19) declaredManifestPaths.add(p19);
+    }
+  }
+  if (Array.isArray(currentConfig.manifests)) {
+    for (const p19 of currentConfig.manifests) {
+      if (typeof p19 === "string") declaredManifestPaths.add(p19);
+    }
+  }
+  if (declaredManifestPaths.size > 0) {
+    const added = [...detectedManifestPaths].filter((p19) => !declaredManifestPaths.has(p19)).sort();
+    const removed = [...declaredManifestPaths].filter((p19) => !detectedManifestPaths.has(p19)).sort();
+    if (added.length > 0) {
+      changes.push({ field: "manifests.added", before: [], after: added });
+    }
+    if (removed.length > 0) {
+      changes.push({ field: "manifests.removed", before: removed, after: [] });
+    }
+  }
+  const configWorkspaces = [];
+  if (Array.isArray(currentConfig.monorepo?.workspaces)) {
+    for (const w2 of currentConfig.monorepo.workspaces) {
+      if (typeof w2 === "string") configWorkspaces.push(w2);
+    }
+  }
+  const detectedWorkspaces = actualDetection.monorepo.packages.map((p19) => p19.path).sort();
+  if (configWorkspaces.length > 0) {
+    const cfgSorted = [...configWorkspaces].sort();
+    if (JSON.stringify(cfgSorted) !== JSON.stringify(detectedWorkspaces)) {
+      changes.push({
+        field: "monorepo.workspaces",
+        before: cfgSorted,
+        after: detectedWorkspaces
+      });
+    }
+  }
+  return { drifted: changes.length > 0, changes };
+}
+var init_drift = __esm({
+  "src/detect/drift.ts"() {
+    "use strict";
+  }
+});
+
 // ../../node_modules/sisteransi/src/index.js
 var require_src = __commonJS({
   "../../node_modules/sisteransi/src/index.js"(exports, module) {
@@ -11000,6 +11126,7 @@ function buildConfigFromDetection(opts) {
   if (Object.keys(verification).length > 0) {
     config.verification = verification;
   }
+  config.detection = { fingerprint: computeFingerprint(detection) };
   if (languages.includes("python")) {
     const pySourceDirs = detection.sourceDirs.python?.source_dirs ?? [];
     const pyRoot = pySourceDirs.length > 0 ? pySourceDirs[0] : ".";
@@ -11372,7 +11499,7 @@ Examples:
 Documentation: https://massu.ai/docs/getting-started/configuration
 `);
 }
-function summarizeDetection(detection) {
+function summarizeDetection2(detection) {
   const parts = [];
   const languages = Array.from(
     new Set(detection.manifests.map((m3) => m3.language))
@@ -11475,7 +11602,7 @@ async function runInit(argv, overrides) {
       errLog("         primary language chosen by manifest count; review framework.primary in the generated config");
     }
   }
-  log(`  Detected: ${summarizeDetection(detection)}`);
+  log(`  Detected: ${summarizeDetection2(detection)}`);
   if (!opts.ci && !opts.force) {
     const confirmed = await promptStackConfirm();
     if (!confirmed) {
@@ -11593,6 +11720,7 @@ var init_init = __esm({
     init_config();
     init_install_commands();
     init_detect();
+    init_drift();
     __filename2 = fileURLToPath2(import.meta.url);
     __dirname2 = dirname4(__filename2);
     TEMPLATE_NAMES = [
@@ -11608,7 +11736,7 @@ var init_init = __esm({
 });
 
 // src/license.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function tierLevel(tier) {
   return TIER_LEVELS[tier] ?? 0;
 }
@@ -11633,7 +11761,7 @@ function annotateToolDefinitions(defs) {
   });
 }
 async function validateLicense(apiKey) {
-  const keyHash = createHash("sha256").update(apiKey).digest("hex");
+  const keyHash = createHash2("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     const cached = memDb.prepare(
@@ -11694,7 +11822,7 @@ async function validateLicense(apiKey) {
   }
 }
 function updateLicenseCache(apiKey, tier, validUntil, features = []) {
-  const keyHash = createHash("sha256").update(apiKey).digest("hex");
+  const keyHash = createHash2("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     memDb.prepare(`
@@ -19004,7 +19132,7 @@ var init_regression_detector = __esm({
 });
 
 // src/knowledge-indexer.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { readFileSync as readFileSync22, readdirSync as readdirSync17, statSync as statSync8, existsSync as existsSync22 } from "fs";
 import { resolve as resolve17, relative as relative10, basename as basename5, extname } from "path";
 function getKnowledgePaths() {
@@ -19092,7 +19220,7 @@ function categorizeFile(filePath) {
   return "root";
 }
 function hashContent(content) {
-  return createHash2("sha256").update(content).digest("hex");
+  return createHash3("sha256").update(content).digest("hex");
 }
 function parseCRTable(content) {
   const rules = [];
@@ -22442,9 +22570,691 @@ var init_server = __esm({
   }
 });
 
+// src/detect/passthrough.ts
+function copyUnknownKeys(source, target, handledKeys) {
+  if (source === null || typeof source !== "object" || Array.isArray(source)) {
+    return;
+  }
+  for (const k3 of Object.keys(source)) {
+    if (UNSAFE_KEYS.has(k3)) continue;
+    if (source[k3] === void 0) continue;
+    if (handledKeys.has(k3)) continue;
+    if (Object.prototype.hasOwnProperty.call(target, k3)) continue;
+    target[k3] = safeClone(source[k3]);
+  }
+}
+function preserveNestedSubkeys(sourceBlock, targetBlock) {
+  if (sourceBlock === null || sourceBlock === void 0 || typeof sourceBlock !== "object" || Array.isArray(sourceBlock)) {
+    return;
+  }
+  const src = sourceBlock;
+  for (const k3 of Object.keys(src)) {
+    if (UNSAFE_KEYS.has(k3)) continue;
+    if (src[k3] === void 0) continue;
+    if (Object.prototype.hasOwnProperty.call(targetBlock, k3)) continue;
+    targetBlock[k3] = safeClone(src[k3]);
+  }
+}
+function safeClone(v3) {
+  if (typeof structuredClone === "function") {
+    try {
+      return structuredClone(v3);
+    } catch {
+    }
+  }
+  return v3;
+}
+var UNSAFE_KEYS;
+var init_passthrough = __esm({
+  "src/detect/passthrough.ts"() {
+    "use strict";
+    UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+  }
+});
+
+// src/commands/config-refresh.ts
+var config_refresh_exports = {};
+__export(config_refresh_exports, {
+  computeDiff: () => computeDiff,
+  mergeRefresh: () => mergeRefresh,
+  runConfigRefresh: () => runConfigRefresh
+});
+import { existsSync as existsSync26, readFileSync as readFileSync26 } from "fs";
+import { resolve as resolve21 } from "path";
+import { parse as parseYaml5 } from "yaml";
+function flatten(obj, prefix3 = "") {
+  const out = {};
+  if (obj === null || obj === void 0) {
+    out[prefix3 || "<root>"] = obj;
+    return out;
+  }
+  if (typeof obj !== "object" || Array.isArray(obj)) {
+    out[prefix3 || "<root>"] = obj;
+    return out;
+  }
+  const rec = obj;
+  for (const [k3, v3] of Object.entries(rec)) {
+    const p19 = prefix3 ? `${prefix3}.${k3}` : k3;
+    if (v3 !== null && typeof v3 === "object" && !Array.isArray(v3)) {
+      Object.assign(out, flatten(v3, p19));
+    } else {
+      out[p19] = v3;
+    }
+  }
+  return out;
+}
+function computeDiff(before, after) {
+  const b2 = flatten(before);
+  const a2 = flatten(after);
+  const keys = /* @__PURE__ */ new Set([...Object.keys(b2), ...Object.keys(a2)]);
+  const sorted = [...keys].sort();
+  const lines = [];
+  for (const k3 of sorted) {
+    const bVal = b2[k3];
+    const aVal = a2[k3];
+    const bHas = k3 in b2;
+    const aHas = k3 in a2;
+    if (bHas && !aHas) {
+      lines.push({ kind: "remove", path: k3, before: bVal });
+    } else if (!bHas && aHas) {
+      lines.push({ kind: "add", path: k3, after: aVal });
+    } else if (JSON.stringify(bVal) !== JSON.stringify(aVal)) {
+      lines.push({ kind: "change", path: k3, before: bVal, after: aVal });
+    }
+  }
+  return lines;
+}
+function mergeRefresh(existing, refreshed) {
+  const out = { ...refreshed };
+  for (const field of PRESERVED_FIELDS) {
+    if (existing[field] !== void 0) {
+      out[field] = existing[field];
+    }
+  }
+  if (typeof existing.toolPrefix === "string" && existing.toolPrefix !== "") {
+    out.toolPrefix = existing.toolPrefix;
+  }
+  for (const block of ["framework", "paths", "project"]) {
+    const existingBlock = existing[block];
+    const outBlock = out[block];
+    if (existingBlock && typeof existingBlock === "object" && !Array.isArray(existingBlock) && outBlock && typeof outBlock === "object" && !Array.isArray(outBlock)) {
+      preserveNestedSubkeys(existingBlock, outBlock);
+    }
+  }
+  const existingProject = existing.project;
+  const outProject = out.project;
+  if (existingProject && typeof existingProject === "object" && !Array.isArray(existingProject) && outProject && typeof outProject === "object" && !Array.isArray(outProject)) {
+    const userRoot = existingProject.root;
+    if (typeof userRoot === "string" && userRoot !== "") {
+      outProject.root = userRoot;
+    }
+  }
+  const existingPaths = existing.paths;
+  const outPaths = out.paths;
+  if (existingPaths && typeof existingPaths === "object" && !Array.isArray(existingPaths) && outPaths && typeof outPaths === "object" && !Array.isArray(outPaths)) {
+    const existingAliases = existingPaths.aliases;
+    const outAliases = outPaths.aliases;
+    if (existingAliases && typeof existingAliases === "object" && !Array.isArray(existingAliases) && outAliases && typeof outAliases === "object" && !Array.isArray(outAliases)) {
+      outPaths.aliases = {
+        ...outAliases,
+        ...existingAliases
+      };
+    } else if (existingAliases && typeof existingAliases === "object" && !Array.isArray(existingAliases)) {
+      outPaths.aliases = existingAliases;
+    }
+  }
+  const existingVer = existing.verification;
+  const outVer = out.verification;
+  if (existingVer && typeof existingVer === "object" && !Array.isArray(existingVer) && outVer && typeof outVer === "object" && !Array.isArray(outVer)) {
+    const eVer = existingVer;
+    const oVer = outVer;
+    for (const lang of Object.keys(eVer)) {
+      const userLang = eVer[lang];
+      if (userLang === void 0) continue;
+      if (!(lang in oVer)) {
+        oVer[lang] = userLang;
+      } else if (userLang && typeof userLang === "object" && !Array.isArray(userLang) && oVer[lang] && typeof oVer[lang] === "object" && !Array.isArray(oVer[lang])) {
+        oVer[lang] = {
+          ...oVer[lang],
+          ...userLang
+        };
+      }
+    }
+  }
+  const handledTopLevel = /* @__PURE__ */ new Set([
+    "schema_version",
+    "project",
+    "framework",
+    "paths",
+    "toolPrefix",
+    "verification",
+    "detection",
+    ...PRESERVED_FIELDS
+  ]);
+  copyUnknownKeys(existing, out, handledTopLevel);
+  return out;
+}
+function renderDiff(diff) {
+  if (diff.length === 0) return "(no changes)\n";
+  const lines = [];
+  for (const d2 of diff) {
+    if (d2.kind === "add") lines.push(`+ ${d2.path}: ${JSON.stringify(d2.after)}`);
+    else if (d2.kind === "remove") lines.push(`- ${d2.path}: ${JSON.stringify(d2.before)}`);
+    else if (d2.kind === "change") {
+      lines.push(`~ ${d2.path}: ${JSON.stringify(d2.before)} -> ${JSON.stringify(d2.after)}`);
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+async function runConfigRefresh(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const configPath = resolve21(cwd, "massu.config.yaml");
+  const log = opts.silent ? () => {
+  } : (s) => process.stdout.write(s);
+  if (!existsSync26(configPath)) {
+    const message = "massu.config.yaml not found. Run: npx massu init";
+    if (!opts.silent) process.stderr.write(message + "\n");
+    return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
+  }
+  let existing;
+  try {
+    const content = readFileSync26(configPath, "utf-8");
+    const parsed = parseYaml5(content);
+    if (!parsed || typeof parsed !== "object") {
+      throw new Error("config is not a YAML object");
+    }
+    existing = parsed;
+  } catch (err) {
+    const message = `Failed to parse massu.config.yaml: ${err instanceof Error ? err.message : String(err)}`;
+    if (!opts.silent) process.stderr.write(message + "\n");
+    return { exitCode: 2, applied: false, dryRun: !!opts.dryRun, diff: [], message };
+  }
+  const detection = await runDetection(cwd);
+  const refreshed = buildConfigFromDetection({
+    projectRoot: cwd,
+    detection,
+    projectName: typeof existing.project?.name === "string" ? existing.project.name : void 0
+  });
+  if (!refreshed.detection?.fingerprint) {
+    refreshed.detection = { fingerprint: computeFingerprint(detection) };
+  }
+  const merged = mergeRefresh(existing, refreshed);
+  const diff = computeDiff(existing, merged);
+  if (opts.dryRun) {
+    log("Config diff (dry-run; no changes written):\n");
+    log(renderDiff(diff));
+    return { exitCode: 0, applied: false, dryRun: true, diff };
+  }
+  if (diff.length === 0) {
+    log("No changes needed \u2014 config is already up to date.\n");
+    return { exitCode: 0, applied: false, dryRun: false, diff };
+  }
+  if (!process.stdin.isTTY) {
+    log("Config diff (non-interactive; pass --dry-run to suppress this note or run interactively to apply):\n");
+    log(renderDiff(diff));
+    return {
+      exitCode: 0,
+      applied: false,
+      dryRun: false,
+      diff,
+      message: "non-interactive shell; no changes written"
+    };
+  }
+  log("Config diff:\n");
+  log(renderDiff(diff));
+  const { confirm } = await Promise.resolve().then(() => (init_dist3(), dist_exports));
+  const apply = await confirm({ message: "Apply these changes to massu.config.yaml?" });
+  if (apply !== true) {
+    log("Aborted; no changes written.\n");
+    return { exitCode: 0, applied: false, dryRun: false, diff, message: "aborted by user" };
+  }
+  const yamlContent = renderConfigYaml(merged);
+  const writeRes = writeConfigAtomic(configPath, yamlContent);
+  if (!writeRes.validated) {
+    const message = `Failed to write config: ${writeRes.error}`;
+    if (!opts.silent) process.stderr.write(message + "\n");
+    return { exitCode: 2, applied: false, dryRun: false, diff, message };
+  }
+  log("Config refreshed.\n");
+  return { exitCode: 0, applied: true, dryRun: false, diff };
+}
+var PRESERVED_FIELDS;
+var init_config_refresh = __esm({
+  "src/commands/config-refresh.ts"() {
+    "use strict";
+    init_detect();
+    init_drift();
+    init_passthrough();
+    init_init();
+    PRESERVED_FIELDS = [
+      "rules",
+      "domains",
+      "canonical_paths",
+      "verification_types",
+      "accessScopes",
+      "knownMismatches",
+      "dbAccessPattern",
+      "analytics",
+      "governance",
+      "security",
+      "team",
+      "regression",
+      "cloud",
+      "conventions",
+      "autoLearning",
+      "python",
+      "toolPrefix"
+    ];
+  }
+});
+
+// src/detect/migrate.ts
+function getRecord(obj) {
+  if (obj !== null && typeof obj === "object" && !Array.isArray(obj)) {
+    return obj;
+  }
+  return {};
+}
+function isNoneOrDefault(v3) {
+  if (v3 === void 0 || v3 === null) return true;
+  if (typeof v3 !== "string") return false;
+  return v3 === "none" || v3 === "";
+}
+function chooseString(user, detected) {
+  if (typeof user === "string" && !isNoneOrDefault(user)) return user;
+  if (typeof detected === "string" && detected !== "") return detected;
+  if (typeof user === "string") return user;
+  return "none";
+}
+function buildLanguageEntries(detection) {
+  const languages = Array.from(
+    new Set(detection.manifests.map((m3) => m3.language))
+  );
+  const entries = {};
+  for (const lang of languages) {
+    const fw = detection.frameworks[lang];
+    const dirInfo = detection.sourceDirs[lang];
+    const sourceDirs = dirInfo?.source_dirs ?? [];
+    const entry = {};
+    if (fw?.framework) entry.framework = fw.framework;
+    if (fw?.test_framework) entry.test_framework = fw.test_framework;
+    if (fw?.orm) entry.orm = fw.orm;
+    if (fw?.router) entry.router = fw.router;
+    if (fw?.ui_library) entry.ui = fw.ui_library;
+    if (sourceDirs.length > 0) entry.source_dirs = sourceDirs;
+    if (Object.keys(entry).length > 0) {
+      entries[lang] = entry;
+    }
+  }
+  return entries;
+}
+function pickPrimary(detection) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const m3 of detection.manifests) {
+    counts.set(m3.language, (counts.get(m3.language) ?? 0) + 1);
+  }
+  const sorted = [...counts.entries()].sort((a2, b2) => {
+    if (b2[1] !== a2[1]) return b2[1] - a2[1];
+    return a2[0].localeCompare(b2[0]);
+  });
+  return sorted.length > 0 ? sorted[0][0] : null;
+}
+function buildVerificationBlock(detection, userVerification) {
+  const ver = {};
+  const languages = Array.from(
+    new Set(detection.manifests.map((m3) => m3.language))
+  );
+  for (const lang of languages) {
+    const cmds = detection.verificationCommands[lang];
+    if (!cmds) continue;
+    const entry = {};
+    if (cmds.test) entry.test = cmds.test;
+    if (cmds.type) entry.type = cmds.type;
+    if (cmds.build) entry.build = cmds.build;
+    if (cmds.syntax) entry.syntax = cmds.syntax;
+    if (cmds.lint) entry.lint = cmds.lint;
+    if (Object.keys(entry).length > 0) ver[lang] = entry;
+  }
+  if (userVerification) {
+    for (const [lang, userEntry] of Object.entries(userVerification)) {
+      if (typeof userEntry !== "object" || userEntry === null) continue;
+      ver[lang] = { ...ver[lang] ?? {}, ...userEntry };
+    }
+  }
+  return ver;
+}
+function migrateV1ToV2(v1Config, detection) {
+  const v1 = getRecord(v1Config);
+  const v1Framework = getRecord(v1.framework);
+  const v1Paths = getRecord(v1.paths);
+  const v1Project = getRecord(v1.project);
+  const v1Verification = v1.verification;
+  const languages = Array.from(
+    new Set(detection.manifests.map((m3) => m3.language))
+  );
+  const languageEntries = buildLanguageEntries(detection);
+  const primary = pickPrimary(detection);
+  const frameworkType = languages.length > 1 ? "multi" : languages[0] ?? (typeof v1Framework.type === "string" ? v1Framework.type : "typescript");
+  const primaryEntry = primary ? languageEntries[primary] : void 0;
+  const primaryRouter = primaryEntry?.router;
+  const primaryOrm = primaryEntry?.orm;
+  const primaryUi = primaryEntry?.ui;
+  const legacyRouter = chooseString(v1Framework.router, primaryRouter);
+  const legacyOrm = chooseString(v1Framework.orm, primaryOrm);
+  const legacyUi = chooseString(v1Framework.ui, primaryUi);
+  const framework = {
+    type: frameworkType,
+    router: legacyRouter,
+    orm: legacyOrm,
+    ui: legacyUi
+  };
+  if (languages.length > 1 && primary) {
+    framework.primary = primary;
+  }
+  if (Object.keys(languageEntries).length > 0) {
+    framework.languages = languageEntries;
+  }
+  preserveNestedSubkeys(v1Framework, framework);
+  let pathsSource = typeof v1Paths.source === "string" ? v1Paths.source : "src";
+  if (pathsSource === "src" && primary) {
+    const primaryDirs = detection.sourceDirs[primary]?.source_dirs ?? [];
+    if (primaryDirs.length > 0) pathsSource = primaryDirs[0];
+  }
+  const aliases = v1Paths.aliases && typeof v1Paths.aliases === "object" ? v1Paths.aliases : { "@": pathsSource };
+  const paths = {
+    source: pathsSource,
+    aliases
+  };
+  for (const k3 of ["routers", "routerRoot", "pages", "middleware", "schema", "components", "hooks"]) {
+    if (typeof v1Paths[k3] === "string") paths[k3] = v1Paths[k3];
+  }
+  preserveNestedSubkeys(v1Paths, paths);
+  const verification = buildVerificationBlock(detection, v1Verification);
+  const project = {
+    name: typeof v1Project.name === "string" ? v1Project.name : "my-project",
+    root: typeof v1Project.root === "string" ? v1Project.root : "auto"
+  };
+  preserveNestedSubkeys(v1Project, project);
+  const v22 = {
+    schema_version: 2,
+    project,
+    framework,
+    paths,
+    toolPrefix: typeof v1.toolPrefix === "string" ? v1.toolPrefix : "massu"
+  };
+  for (const field of PRESERVED_FIELDS2) {
+    if (field in v1 && v1[field] !== void 0) {
+      v22[field] = v1[field];
+    }
+  }
+  const handledTopLevel = /* @__PURE__ */ new Set([
+    "schema_version",
+    "project",
+    "framework",
+    "paths",
+    "toolPrefix",
+    "verification",
+    "python",
+    ...PRESERVED_FIELDS2
+  ]);
+  copyUnknownKeys(v1, v22, handledTopLevel);
+  if (!Array.isArray(v22.domains)) {
+    v22.domains = [];
+  }
+  if (!Array.isArray(v22.rules)) {
+    v22.rules = [];
+  }
+  if (Object.keys(verification).length > 0) {
+    v22.verification = verification;
+  }
+  if (languages.includes("python")) {
+    const existing = getRecord(v1.python);
+    const pyFw = detection.frameworks.python;
+    const pySourceDirs = detection.sourceDirs.python?.source_dirs ?? [];
+    const pyRoot = typeof existing.root === "string" && existing.root !== "" ? existing.root : pySourceDirs.length > 0 ? pySourceDirs[0] : ".";
+    const pythonBlock = {
+      root: pyRoot,
+      exclude_dirs: Array.isArray(existing.exclude_dirs) ? existing.exclude_dirs : ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]
+    };
+    if (existing.domains !== void 0) pythonBlock.domains = existing.domains;
+    if (existing.alembic_dir !== void 0) pythonBlock.alembic_dir = existing.alembic_dir;
+    if (pyFw?.framework && existing.framework === void 0) {
+      pythonBlock.framework = pyFw.framework;
+    } else if (existing.framework !== void 0) {
+      pythonBlock.framework = existing.framework;
+    }
+    if (pyFw?.orm && existing.orm === void 0) {
+      pythonBlock.orm = pyFw.orm;
+    } else if (existing.orm !== void 0) {
+      pythonBlock.orm = existing.orm;
+    }
+    preserveNestedSubkeys(v1.python, pythonBlock);
+    v22.python = pythonBlock;
+  } else if (v1.python !== void 0) {
+    v22.python = v1.python;
+  }
+  return v22;
+}
+var PRESERVED_FIELDS2;
+var init_migrate = __esm({
+  "src/detect/migrate.ts"() {
+    "use strict";
+    init_passthrough();
+    PRESERVED_FIELDS2 = [
+      "rules",
+      "domains",
+      "canonical_paths",
+      "verification_types",
+      "detection",
+      "accessScopes",
+      "knownMismatches",
+      "dbAccessPattern",
+      "analytics",
+      "governance",
+      "security",
+      "team",
+      "regression",
+      "cloud",
+      "conventions",
+      "autoLearning"
+    ];
+  }
+});
+
+// src/commands/config-upgrade.ts
+var config_upgrade_exports = {};
+__export(config_upgrade_exports, {
+  runConfigUpgrade: () => runConfigUpgrade
+});
+import { existsSync as existsSync27, readFileSync as readFileSync27, writeFileSync as writeFileSync4, copyFileSync, unlinkSync } from "fs";
+import { resolve as resolve22 } from "path";
+import { parse as parseYaml6 } from "yaml";
+async function runConfigUpgrade(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const configPath = resolve22(cwd, "massu.config.yaml");
+  const bakPath = `${configPath}.bak`;
+  const log = opts.silent ? () => {
+  } : (s) => process.stdout.write(s);
+  const err = opts.silent ? () => {
+  } : (s) => process.stderr.write(s);
+  if (opts.rollback) {
+    if (!existsSync27(bakPath)) {
+      const message = `No backup found at ${bakPath}`;
+      err(message + "\n");
+      return { exitCode: 1, action: "none", message };
+    }
+    try {
+      copyFileSync(bakPath, configPath);
+      unlinkSync(bakPath);
+      log("Config restored from backup.\n");
+      return { exitCode: 0, action: "rolled-back" };
+    } catch (e2) {
+      const message = `Rollback failed: ${e2 instanceof Error ? e2.message : String(e2)}`;
+      err(message + "\n");
+      return { exitCode: 2, action: "none", message };
+    }
+  }
+  if (!existsSync27(configPath)) {
+    const message = "massu.config.yaml not found. Run: npx massu init";
+    err(message + "\n");
+    return { exitCode: 1, action: "none", message };
+  }
+  let existing;
+  try {
+    const content = readFileSync27(configPath, "utf-8");
+    const parsed = parseYaml6(content);
+    if (!parsed || typeof parsed !== "object") {
+      throw new Error("config is not a YAML object");
+    }
+    existing = parsed;
+  } catch (e2) {
+    const message = `Failed to parse massu.config.yaml: ${e2 instanceof Error ? e2.message : String(e2)}`;
+    err(message + "\n");
+    return { exitCode: 2, action: "none", message };
+  }
+  const schemaVersion = existing.schema_version;
+  if (schemaVersion === 2) {
+    log("Config is already at schema_version=2; nothing to do.\n");
+    return { exitCode: 0, action: "already-current" };
+  }
+  const detection = await runDetection(cwd);
+  const v22 = migrateV1ToV2(existing, detection);
+  v22.detection = {
+    ...v22.detection ?? {},
+    fingerprint: computeFingerprint(detection)
+  };
+  try {
+    const original = readFileSync27(configPath, "utf-8");
+    writeFileSync4(bakPath, original, "utf-8");
+  } catch (e2) {
+    const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
+    err(message + "\n");
+    return { exitCode: 2, action: "none", message };
+  }
+  const yamlContent = renderConfigYaml(v22);
+  const writeRes = writeConfigAtomic(configPath, yamlContent);
+  if (!writeRes.validated) {
+    const message = `Failed to write upgraded config: ${writeRes.error}`;
+    err(message + "\n");
+    return { exitCode: 2, action: "none", message };
+  }
+  void opts.ci;
+  log(`Config upgraded to schema_version=2. Backup saved at ${bakPath}
+`);
+  return { exitCode: 0, action: "migrated" };
+}
+var init_config_upgrade = __esm({
+  "src/commands/config-upgrade.ts"() {
+    "use strict";
+    init_detect();
+    init_drift();
+    init_migrate();
+    init_init();
+  }
+});
+
+// src/commands/config-check-drift.ts
+var config_check_drift_exports = {};
+__export(config_check_drift_exports, {
+  runConfigCheckDrift: () => runConfigCheckDrift
+});
+import { existsSync as existsSync28, readFileSync as readFileSync28 } from "fs";
+import { resolve as resolve23 } from "path";
+import { parse as parseYaml7 } from "yaml";
+function renderChanges(changes) {
+  if (changes.length === 0) return "(none)\n";
+  return changes.map((c2) => `  ${c2.field}: ${JSON.stringify(c2.before)} -> ${JSON.stringify(c2.after)}`).join("\n") + "\n";
+}
+async function runConfigCheckDrift(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const configPath = resolve23(cwd, "massu.config.yaml");
+  const log = opts.silent ? () => {
+  } : (s) => process.stdout.write(s);
+  const err = opts.silent ? () => {
+  } : (s) => process.stderr.write(s);
+  if (!existsSync28(configPath)) {
+    const message = "massu.config.yaml not found. Run: npx massu init";
+    err(message + "\n");
+    return {
+      exitCode: 2,
+      drifted: false,
+      changes: [],
+      storedFingerprint: null,
+      currentFingerprint: null,
+      message
+    };
+  }
+  let config;
+  try {
+    const content = readFileSync28(configPath, "utf-8");
+    const parsed = parseYaml7(content);
+    if (!parsed || typeof parsed !== "object") {
+      throw new Error("config is not a YAML object");
+    }
+    config = parsed;
+  } catch (e2) {
+    const message = `Failed to parse massu.config.yaml: ${e2 instanceof Error ? e2.message : String(e2)}`;
+    err(message + "\n");
+    return {
+      exitCode: 2,
+      drifted: false,
+      changes: [],
+      storedFingerprint: null,
+      currentFingerprint: null,
+      message
+    };
+  }
+  const detection = await runDetection(cwd);
+  const currentFp = computeFingerprint(detection);
+  const storedFp = typeof config.detection?.fingerprint === "string" ? config.detection.fingerprint : null;
+  const report = detectDrift(config, detection);
+  const fingerprintDrift = storedFp !== null && storedFp !== currentFp;
+  const drifted = report.drifted || fingerprintDrift;
+  if (!drifted) {
+    log("No drift detected.\n");
+    if (opts.verbose) {
+      log(`Fingerprint: ${currentFp}
+`);
+    }
+    return {
+      exitCode: 0,
+      drifted: false,
+      changes: report.changes,
+      storedFingerprint: storedFp,
+      currentFingerprint: currentFp
+    };
+  }
+  err("Config drift detected; run `npx massu config refresh` to update.\n");
+  if (opts.verbose) {
+    if (storedFp !== null) {
+      log(`Fingerprint: ${storedFp.slice(0, 16)} -> ${currentFp.slice(0, 16)}
+`);
+    } else {
+      log(`Fingerprint (new): ${currentFp.slice(0, 16)}
+`);
+    }
+    log("Changes:\n");
+    log(renderChanges(report.changes));
+  }
+  return {
+    exitCode: 1,
+    drifted: true,
+    changes: report.changes,
+    storedFingerprint: storedFp,
+    currentFingerprint: currentFp
+  };
+}
+var init_config_check_drift = __esm({
+  "src/commands/config-check-drift.ts"() {
+    "use strict";
+    init_detect();
+    init_drift();
+  }
+});
+
 // src/cli.ts
-import { readFileSync as readFileSync26 } from "fs";
-import { resolve as resolve21, dirname as dirname12 } from "path";
+import { readFileSync as readFileSync29 } from "fs";
+import { resolve as resolve24, dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 var __filename4 = fileURLToPath5(import.meta.url);
 var __dirname5 = dirname12(__filename4);
@@ -22477,6 +23287,10 @@ async function main() {
       await runValidateConfig2();
       break;
     }
+    case "config": {
+      await handleConfigSubcommand(args.slice(1));
+      break;
+    }
     case "--help":
     case "-h": {
       printHelp();
@@ -22492,6 +23306,56 @@ async function main() {
     }
   }
 }
+async function handleConfigSubcommand(configArgs) {
+  const sub = configArgs[0];
+  const flags = new Set(configArgs.slice(1));
+  switch (sub) {
+    case "refresh": {
+      const { runConfigRefresh: runConfigRefresh2 } = await Promise.resolve().then(() => (init_config_refresh(), config_refresh_exports));
+      const result = await runConfigRefresh2({ dryRun: flags.has("--dry-run") });
+      process.exit(result.exitCode);
+      return;
+    }
+    case "validate": {
+      const { runValidateConfig: runValidateConfig2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
+      await runValidateConfig2();
+      return;
+    }
+    case "upgrade": {
+      const { runConfigUpgrade: runConfigUpgrade2 } = await Promise.resolve().then(() => (init_config_upgrade(), config_upgrade_exports));
+      const result = await runConfigUpgrade2({
+        rollback: flags.has("--rollback"),
+        ci: flags.has("--ci") || flags.has("--yes")
+      });
+      process.exit(result.exitCode);
+      return;
+    }
+    case "doctor": {
+      const { runDoctor: runDoctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
+      await runDoctor2();
+      return;
+    }
+    case "check-drift": {
+      const { runConfigCheckDrift: runConfigCheckDrift2 } = await Promise.resolve().then(() => (init_config_check_drift(), config_check_drift_exports));
+      const result = await runConfigCheckDrift2({ verbose: flags.has("--verbose") });
+      process.exit(result.exitCode);
+      return;
+    }
+    case "--help":
+    case "-h":
+    case void 0: {
+      printConfigHelp();
+      return;
+    }
+    default: {
+      process.stderr.write(`massu: unknown config subcommand: ${sub}
+`);
+      printConfigHelp();
+      process.exit(1);
+      return;
+    }
+  }
+}
 function printHelp() {
   console.log(`
 Massu AI - Engineering Governance Platform
@@ -22504,7 +23368,8 @@ Commands:
   doctor            Check installation health
   install-hooks     Install/update Claude Code hooks
   install-commands  Install/update slash commands
-  validate-config   Validate massu.config.yaml
+  validate-config   Validate massu.config.yaml (alias: config validate)
+  config <sub>      Config lifecycle: refresh | validate | upgrade | doctor | check-drift
 
 Options:
   --help, -h        Show this help message
@@ -22513,13 +23378,35 @@ Options:
 Getting started:
   npx massu init              # Full setup in one command
   npx massu init --help       # Show all init options (--ci, --force, --template)
+  npx massu config --help     # Show config subcommands
 
 Documentation: https://massu.ai/docs
 `);
 }
+function printConfigHelp() {
+  console.log(`
+massu config <subcommand>
+
+Subcommands:
+  refresh       Re-run detection and apply changes to massu.config.yaml.
+                  --dry-run    Print diff and exit without writing.
+  validate      Validate massu.config.yaml (alias of \`massu validate-config\`).
+  upgrade       Migrate a v1 config to schema_version=2.
+                  --rollback   Restore from .bak file.
+                  --ci, --yes  Non-interactive mode (no prompts).
+  doctor        Run the full health check (alias of \`massu doctor\`).
+  check-drift   CI-safe drift gate; exits 1 on drift.
+                  --verbose    Print detailed changes to stdout.
+
+Examples:
+  npx massu config refresh --dry-run
+  npx massu config upgrade --ci
+  npx massu config check-drift --verbose
+`);
+}
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync26(resolve21(__dirname5, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync29(resolve24(__dirname5, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");