@massu/core 1.13.1 → 1.15.0

package/dist/cli.js

@@ -622,8 +622,14 @@ __export(memory_db_exports, {
   createSession: () => createSession,
   deduplicateFailedAttempt: () => deduplicateFailedAttempt,
   dequeuePendingSync: () => dequeuePendingSync,
+  drainRulePromotionEvents: () => drainRulePromotionEvents,
+  drainTeamPromotions: () => drainTeamPromotions,
+  drainTeamRevocations: () => drainTeamRevocations,
   endSession: () => endSession,
+  enqueueRulePromotionEvent: () => enqueueRulePromotionEvent,
   enqueueSyncPayload: () => enqueueSyncPayload,
+  enqueueTeamPromotion: () => enqueueTeamPromotion,
+  enqueueTeamRevocation: () => enqueueTeamRevocation,
   getConversationTurns: () => getConversationTurns,
   getCrossTaskProgress: () => getCrossTaskProgress,
   getDecisionsAbout: () => getDecisionsAbout,
@@ -631,8 +637,10 @@ __export(memory_db_exports, {
   getFailureClasses: () => getFailureClasses,
   getLastProcessedLine: () => getLastProcessedLine,
   getMemoryDb: () => getMemoryDb,
+  getMemoryMeta: () => getMemoryMeta,
   getObservabilityDbSize: () => getObservabilityDbSize,
   getRecentObservations: () => getRecentObservations,
+  getRecurrenceCountForPromptHash: () => getRecurrenceCountForPromptHash,
   getSessionStats: () => getSessionStats,
   getSessionSummaries: () => getSessionSummaries,
   getSessionTimeline: () => getSessionTimeline,
@@ -645,12 +653,14 @@ __export(memory_db_exports, {
   pruneOldConversationTurns: () => pruneOldConversationTurns,
   pruneOldObservations: () => pruneOldObservations,
   pruneToolCostEvents: () => pruneToolCostEvents,
+  recordTelemetry: () => recordTelemetry,
   removePendingSync: () => removePendingSync,
   sanitizeFts5Query: () => sanitizeFts5Query,
   scoreFailureClasses: () => scoreFailureClasses,
   searchConversationTurns: () => searchConversationTurns,
   searchObservations: () => searchObservations,
-  setLastProcessedLine: () => setLastProcessedLine
+  setLastProcessedLine: () => setLastProcessedLine,
+  setMemoryMeta: () => setMemoryMeta
 });
 import Database from "better-sqlite3";
 import { dirname as dirname2, basename } from "path";
@@ -1156,6 +1166,45 @@ function initMemorySchema(db) {
     CREATE INDEX IF NOT EXISTS idx_so_file ON shared_observations(file_path);
     CREATE INDEX IF NOT EXISTS idx_so_module ON shared_observations(module);
   `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS team_promotion_outbound (
+      prompt_hash TEXT PRIMARY KEY,
+      destination TEXT NOT NULL,
+      draft_text TEXT NOT NULL,
+      score REAL,
+      signals_json TEXT NOT NULL DEFAULT '[]',
+      content_hash TEXT NOT NULL,
+      -- PA3-004 (Phase 3 Stream A): hardened-destination publish carries the
+      -- publisher's review attestation so the server CHECK (hardened rows need a
+      -- review_attestation) is satisfiable. hardened=0 for the Phase-2 rows.
+      hardened INTEGER NOT NULL DEFAULT 0,
+      review_attestation_json TEXT,
+      created_at TEXT DEFAULT (datetime('now'))
+    );
+    CREATE TABLE IF NOT EXISTS team_revocation_outbound (
+      prompt_hash TEXT PRIMARY KEY,
+      created_at TEXT DEFAULT (datetime('now'))
+    );
+  `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS rule_promotion_events_outbound (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      prompt_hash TEXT NOT NULL,
+      event_type TEXT NOT NULL,
+      metadata_json TEXT NOT NULL DEFAULT '{}',
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_rpe_outbound_created ON rule_promotion_events_outbound(created_at);
+  `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS analytics_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      event_type TEXT NOT NULL,
+      event_data TEXT NOT NULL DEFAULT '{}',
+      created_at TEXT DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_analytics_events_type ON analytics_events(event_type);
+  `);
   db.exec(`
     CREATE TABLE IF NOT EXISTS knowledge_conflicts (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1236,6 +1285,13 @@ function initMemorySchema(db) {
       `ALTER TABLE license_cache ADD COLUMN signed_payload_json TEXT NOT NULL DEFAULT ''`
     );
   }
+  const outboundCols = db.prepare(`PRAGMA table_info(team_promotion_outbound)`).all();
+  if (!outboundCols.some((c2) => c2.name === "hardened")) {
+    db.exec(`ALTER TABLE team_promotion_outbound ADD COLUMN hardened INTEGER NOT NULL DEFAULT 0`);
+  }
+  if (!outboundCols.some((c2) => c2.name === "review_attestation_json")) {
+    db.exec(`ALTER TABLE team_promotion_outbound ADD COLUMN review_attestation_json TEXT`);
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS failure_classes (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1259,6 +1315,136 @@ function initMemorySchema(db) {
 function enqueueSyncPayload(db, payload) {
   db.prepare("INSERT INTO pending_sync (payload) VALUES (?)").run(payload);
 }
+function getMemoryMeta(db, key) {
+  const row = db.prepare("SELECT value FROM memory_meta WHERE key = ?").get(key);
+  return row ? row.value : null;
+}
+function setMemoryMeta(db, key, value) {
+  db.prepare("INSERT OR REPLACE INTO memory_meta (key, value) VALUES (?, ?)").run(key, value);
+}
+function enqueueTeamPromotion(db, promo) {
+  db.prepare(`
+    INSERT OR REPLACE INTO team_promotion_outbound
+      (prompt_hash, destination, draft_text, score, signals_json, content_hash, hardened, review_attestation_json, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
+  `).run(
+    promo.prompt_hash,
+    promo.destination,
+    promo.draft_text.slice(0, MAX_DRAFT_TEXT_LEN),
+    promo.score ?? null,
+    JSON.stringify(promo.signals ?? []),
+    promo.content_hash,
+    promo.hardened ? 1 : 0,
+    promo.review_attestation !== void 0 ? JSON.stringify(promo.review_attestation) : null
+  );
+}
+function drainTeamPromotions(db) {
+  const rows = db.prepare(`
+    SELECT prompt_hash, destination, draft_text, score, signals_json, content_hash, hardened, review_attestation_json
+    FROM team_promotion_outbound ORDER BY created_at ASC LIMIT 1000
+  `).all();
+  if (rows.length === 0) return [];
+  db.prepare("DELETE FROM team_promotion_outbound").run();
+  return rows.map((r2) => ({
+    prompt_hash: r2.prompt_hash,
+    destination: r2.destination,
+    draft_text: r2.draft_text,
+    score: r2.score ?? void 0,
+    signals: safeJsonArray(r2.signals_json),
+    content_hash: r2.content_hash,
+    hardened: r2.hardened === 1,
+    review_attestation: r2.review_attestation_json ? safeJsonParse(r2.review_attestation_json) : void 0
+  }));
+}
+function enqueueTeamRevocation(db, promptHash) {
+  db.prepare(`
+    INSERT OR REPLACE INTO team_revocation_outbound (prompt_hash, created_at)
+    VALUES (?, datetime('now'))
+  `).run(promptHash);
+}
+function drainTeamRevocations(db) {
+  const rows = db.prepare(
+    `SELECT prompt_hash FROM team_revocation_outbound ORDER BY created_at ASC LIMIT 1000`
+  ).all();
+  if (rows.length === 0) return [];
+  db.prepare("DELETE FROM team_revocation_outbound").run();
+  return rows.map((r2) => r2.prompt_hash);
+}
+function getRecurrenceCountForPromptHash(db, promptHash) {
+  try {
+    const row = db.prepare(`
+      SELECT json_extract(metadata, '$.recurrence_count') AS rc
+      FROM audit_log
+      WHERE event_type = 'rule_promoted'
+        AND json_extract(metadata, '$.prompt_hash') = ?
+      LIMIT 1
+    `).get(promptHash);
+    if (!row || row.rc === null || row.rc === void 0) return null;
+    return Number(row.rc);
+  } catch {
+    return null;
+  }
+}
+function enqueueRulePromotionEvent(db, ev) {
+  try {
+    db.prepare(`
+      INSERT INTO rule_promotion_events_outbound
+        (prompt_hash, event_type, metadata_json, created_at)
+      VALUES (?, ?, ?, ?)
+    `).run(
+      ev.prompt_hash,
+      ev.event_type,
+      JSON.stringify(ev.metadata ?? {}),
+      ev.created_at
+    );
+    db.prepare(`
+      DELETE FROM rule_promotion_events_outbound
+      WHERE id NOT IN (
+        SELECT id FROM rule_promotion_events_outbound ORDER BY id DESC LIMIT ?
+      )
+    `).run(FUNNEL_EVENT_OUTBOX_CAP);
+  } catch {
+  }
+}
+function drainRulePromotionEvents(db) {
+  const rows = db.prepare(`
+    SELECT id, prompt_hash, event_type, metadata_json, created_at
+    FROM rule_promotion_events_outbound ORDER BY id ASC LIMIT ?
+  `).all(FUNNEL_EVENT_DRAIN_LIMIT);
+  if (rows.length === 0) return [];
+  const maxId = rows[rows.length - 1].id;
+  db.prepare("DELETE FROM rule_promotion_events_outbound WHERE id <= ?").run(maxId);
+  return rows.map((r2) => ({
+    prompt_hash: r2.prompt_hash,
+    event_type: r2.event_type,
+    created_at: r2.created_at,
+    metadata: safeJsonParse(r2.metadata_json) ?? {}
+  }));
+}
+function recordTelemetry(db, eventType, data) {
+  try {
+    db.prepare(`
+      INSERT INTO analytics_events (event_type, event_data, created_at)
+      VALUES (?, ?, datetime('now'))
+    `).run(eventType, JSON.stringify(data));
+  } catch {
+  }
+}
+function safeJsonArray(json) {
+  try {
+    const v3 = JSON.parse(json);
+    return Array.isArray(v3) ? v3 : [];
+  } catch {
+    return [];
+  }
+}
+function safeJsonParse(json) {
+  try {
+    return JSON.parse(json);
+  } catch {
+    return void 0;
+  }
+}
 function dequeuePendingSync(db, limit = 10) {
   const stale = db.prepare(
     "SELECT id, retry_count, last_error FROM pending_sync WHERE retry_count >= 10 LIMIT 10000"
@@ -1809,12 +1995,15 @@ function scoreFailureClasses(db, matchText, filePath, promptContext, weights) {
   }
   return bestMatch;
 }
-var TOOL_COST_EVENTS_RETENTION_DAYS;
+var TOOL_COST_EVENTS_RETENTION_DAYS, MAX_DRAFT_TEXT_LEN, FUNNEL_EVENT_DRAIN_LIMIT, FUNNEL_EVENT_OUTBOX_CAP;
 var init_memory_db = __esm({
   "src/memory-db.ts"() {
     "use strict";
     init_config();
     TOOL_COST_EVENTS_RETENTION_DAYS = 90;
+    MAX_DRAFT_TEXT_LEN = 16384;
+    FUNNEL_EVENT_DRAIN_LIMIT = 5e3;
+    FUNNEL_EVENT_OUTBOX_CAP = 2e4;
   }
 });
 
@@ -14344,26 +14533,13 @@ var init_init = __esm({
   }
 });
 
-// src/security/license-pubkey.generated.ts
-var LICENSE_PUBKEY_ED25519, LICENSE_PUBKEY_FINGERPRINT_HEX, KNOWN_LICENSE_PUBKEY_FINGERPRINTS;
-var init_license_pubkey_generated = __esm({
-  "src/security/license-pubkey.generated.ts"() {
-    "use strict";
-    LICENSE_PUBKEY_ED25519 = new Uint8Array([39, 136, 108, 146, 85, 233, 119, 252, 223, 226, 123, 155, 234, 168, 200, 150, 36, 249, 174, 6, 130, 146, 125, 196, 136, 224, 202, 150, 53, 228, 114, 15]);
-    LICENSE_PUBKEY_FINGERPRINT_HEX = "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475";
-    KNOWN_LICENSE_PUBKEY_FINGERPRINTS = /* @__PURE__ */ new Set([
-      "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475"
-    ]);
-  }
-});
-
-// src/security/license-response-verifier.ts
+// src/security/ed25519-envelope-verifier.ts
 import { createPublicKey, verify as cryptoVerify } from "crypto";
-function verifyLicenseResponse(payload) {
-  if (!KNOWN_LICENSE_PUBKEY_FINGERPRINTS.has(LICENSE_PUBKEY_FINGERPRINT_HEX)) {
+function verifyEd25519SignedEnvelope(key, payload) {
+  if (!key.knownFingerprints.has(key.fingerprintHex)) {
     return {
       kind: "error",
-      reason: `Bundled license pubkey fingerprint ${LICENSE_PUBKEY_FINGERPRINT_HEX} is not in the trusted allowlist. Possible build-time tamper.`
+      reason: `Bundled ${key.keyLabel} pubkey fingerprint ${key.fingerprintHex} is not in the trusted allowlist. Possible build-time tamper.`
     };
   }
   const sig = payload._signature;
@@ -14379,7 +14555,7 @@ function verifyLicenseResponse(payload) {
   if (!Array.isArray(payloadKeys) || payloadKeys.length === 0) {
     return { kind: "error", reason: "Missing _signature_payload_keys" };
   }
-  if (typeof sigPubkey === "string" && sigPubkey !== LICENSE_PUBKEY_FINGERPRINT_HEX) {
+  if (typeof sigPubkey === "string" && sigPubkey !== key.fingerprintHex) {
     return { kind: "unknown_pubkey", got: sigPubkey };
   }
   const canonicalObj = {};
@@ -14389,21 +14565,7 @@ function verifyLicenseResponse(payload) {
   }
   const canonical = JSON.stringify(canonicalObj, [...payloadKeys].sort());
   try {
-    const spkiPrefix = Buffer.from([
-      48,
-      42,
-      48,
-      5,
-      6,
-      3,
-      43,
-      101,
-      112,
-      3,
-      33,
-      0
-    ]);
-    const der = Buffer.concat([spkiPrefix, Buffer.from(LICENSE_PUBKEY_ED25519)]);
+    const der = Buffer.concat([SPKI_ED25519_PREFIX, Buffer.from(key.pubkeyBytes)]);
     const pubkey = createPublicKey({ key: der, format: "der", type: "spki" });
     const ok = cryptoVerify(
       null,
@@ -14419,12 +14581,59 @@ function verifyLicenseResponse(payload) {
     };
   }
 }
+var SPKI_ED25519_PREFIX;
+var init_ed25519_envelope_verifier = __esm({
+  "src/security/ed25519-envelope-verifier.ts"() {
+    "use strict";
+    SPKI_ED25519_PREFIX = Buffer.from([
+      48,
+      42,
+      48,
+      5,
+      6,
+      3,
+      43,
+      101,
+      112,
+      3,
+      33,
+      0
+    ]);
+  }
+});
+
+// src/security/license-pubkey.generated.ts
+var LICENSE_PUBKEY_ED25519, LICENSE_PUBKEY_FINGERPRINT_HEX, KNOWN_LICENSE_PUBKEY_FINGERPRINTS;
+var init_license_pubkey_generated = __esm({
+  "src/security/license-pubkey.generated.ts"() {
+    "use strict";
+    LICENSE_PUBKEY_ED25519 = new Uint8Array([39, 136, 108, 146, 85, 233, 119, 252, 223, 226, 123, 155, 234, 168, 200, 150, 36, 249, 174, 6, 130, 146, 125, 196, 136, 224, 202, 150, 53, 228, 114, 15]);
+    LICENSE_PUBKEY_FINGERPRINT_HEX = "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475";
+    KNOWN_LICENSE_PUBKEY_FINGERPRINTS = /* @__PURE__ */ new Set([
+      "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475"
+    ]);
+  }
+});
+
+// src/security/license-response-verifier.ts
+function verifyLicenseResponse(payload) {
+  return verifyEd25519SignedEnvelope(
+    {
+      pubkeyBytes: LICENSE_PUBKEY_ED25519,
+      fingerprintHex: LICENSE_PUBKEY_FINGERPRINT_HEX,
+      knownFingerprints: KNOWN_LICENSE_PUBKEY_FINGERPRINTS,
+      keyLabel: "license"
+    },
+    payload
+  );
+}
 function isLicenseSignatureRequired() {
   return process.env.MASSU_REQUIRE_SIGNED_LICENSE === "true";
 }
 var init_license_response_verifier = __esm({
   "src/security/license-response-verifier.ts"() {
     "use strict";
+    init_ed25519_envelope_verifier();
     init_license_pubkey_generated();
   }
 });
@@ -14540,7 +14749,7 @@ async function validateLicense(apiKey) {
     }
     if (cached && trusted) {
       const lastValidated = new Date(cached.last_validated);
-      const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3);
+      const sevenDaysAgo = new Date(Date.now() - GRACE_PERIOD_MS);
       if (lastValidated > sevenDaysAgo) {
         return trusted;
       }
@@ -14591,7 +14800,8 @@ function readTrustedCache(cached) {
   const tier = verifiedPlan ? PLAN_TO_TIER_MAP[verifiedPlan] ?? "free" : verifiedTierField ?? "free";
   const validUntil = typeof parsed.validUntil === "string" ? parsed.validUntil : "";
   const features = Array.isArray(parsed.features) ? parsed.features : [];
-  return { tier, validUntil, features };
+  const orgId = typeof parsed.orgId === "string" && parsed.orgId.length > 0 ? parsed.orgId : void 0;
+  return { tier, validUntil, features, orgId };
 }
 async function getCurrentTier() {
   if (cachedTier && Date.now() - cachedTierTimestamp < IN_MEMORY_CACHE_TTL_MS) {
@@ -14609,6 +14819,64 @@ async function getCurrentTier() {
   cachedTierTimestamp = Date.now();
   return info.tier;
 }
+function getCachedTierReadOnly(memDb) {
+  const config = getConfig();
+  const apiKey = config.cloud?.apiKey;
+  if (!apiKey) return "free";
+  const ownsDb = !memDb;
+  const db = memDb ?? getMemoryDb();
+  try {
+    const keyHash = createHash5("sha256").update(apiKey).digest("hex");
+    const cached = db.prepare(
+      "SELECT tier, valid_until, last_validated, features, signed_payload_json FROM license_cache WHERE api_key_hash = ?"
+    ).get(keyHash);
+    if (!cached) return "free";
+    const trusted = readTrustedCache(cached);
+    if (!trusted) return "free";
+    const lastValidated = new Date(cached.last_validated);
+    const sevenDaysAgo = new Date(Date.now() - GRACE_PERIOD_MS);
+    if (!(lastValidated > sevenDaysAgo)) return "free";
+    return trusted.tier;
+  } catch {
+    return "free";
+  } finally {
+    if (ownsDb) {
+      try {
+        db.close();
+      } catch {
+      }
+    }
+  }
+}
+function getCachedOrgId(memDb) {
+  const config = getConfig();
+  const apiKey = config.cloud?.apiKey;
+  if (!apiKey) return null;
+  const ownsDb = !memDb;
+  const db = memDb ?? getMemoryDb();
+  try {
+    const keyHash = createHash5("sha256").update(apiKey).digest("hex");
+    const cached = db.prepare(
+      "SELECT tier, valid_until, last_validated, features, signed_payload_json FROM license_cache WHERE api_key_hash = ?"
+    ).get(keyHash);
+    if (!cached) return null;
+    const trusted = readTrustedCache(cached);
+    if (!trusted) return null;
+    const lastValidated = new Date(cached.last_validated);
+    const sevenDaysAgo = new Date(Date.now() - GRACE_PERIOD_MS);
+    if (!(lastValidated > sevenDaysAgo)) return null;
+    return trusted.orgId ?? null;
+  } catch {
+    return null;
+  } finally {
+    if (ownsDb) {
+      try {
+        db.close();
+      } catch {
+      }
+    }
+  }
+}
 async function getLicenseInfo() {
   if (!cachedTier || Date.now() - cachedTierTimestamp >= IN_MEMORY_CACHE_TTL_MS) {
     await getCurrentTier();
@@ -14675,7 +14943,7 @@ async function handleLicenseToolCall(name, _args, _memDb) {
   }
   return { content: [{ type: "text", text: `Unknown license tool: ${name}` }] };
 }
-var _warnedLicenseSig, TIER_LEVELS, TOOL_TIER_MAP, PLAN_TO_TIER_MAP, TIER_LABELS, cachedTier, cachedTierTimestamp, IN_MEMORY_CACHE_TTL_MS;
+var _warnedLicenseSig, TIER_LEVELS, TOOL_TIER_MAP, PLAN_TO_TIER_MAP, TIER_LABELS, cachedTier, cachedTierTimestamp, IN_MEMORY_CACHE_TTL_MS, GRACE_PERIOD_MS;
 var init_license = __esm({
   "src/license.ts"() {
     "use strict";
@@ -14789,6 +15057,7 @@ var init_license = __esm({
     cachedTier = null;
     cachedTierTimestamp = 0;
     IN_MEMORY_CACHE_TTL_MS = 15 * 60 * 1e3;
+    GRACE_PERIOD_MS = 7 * 24 * 60 * 60 * 1e3;
   }
 });
 
@@ -15443,6 +15712,111 @@ var init_permissions2 = __esm({
   }
 });
 
+// src/auto-learning-entitlement.ts
+function autoLearningUpgradeMessage(currentTier) {
+  return `Auto-learning (rule-candidate detection + /massu-rule promotion) is a Pro feature. Your tier: ${currentTier.toUpperCase()}. Upgrade at https://massu.ai/pricing`;
+}
+function entitledForTeamSharedPromotion(tier) {
+  return tierLevel(tier) >= tierLevel(TEAM_SHARED_PROMOTION_MIN_TIER);
+}
+var TEAM_SHARED_PROMOTION_MIN_TIER;
+var init_auto_learning_entitlement = __esm({
+  "src/auto-learning-entitlement.ts"() {
+    "use strict";
+    init_license();
+    TEAM_SHARED_PROMOTION_MIN_TIER = "team";
+  }
+});
+
+// src/commands/license.ts
+var license_exports = {};
+__export(license_exports, {
+  handleLicenseSubcommand: () => handleLicenseSubcommand,
+  printLicenseHelp: () => printLicenseHelp
+});
+function isValidTier(value) {
+  return VALID_TIERS.includes(value);
+}
+async function handleLicenseSubcommand(args2) {
+  const sub = args2[0];
+  switch (sub) {
+    case "check": {
+      const minIdx = args2.indexOf("--min");
+      if (minIdx === -1 || minIdx === args2.length - 1) {
+        process.stderr.write(
+          "Usage: massu license check --min <free|pro|team|enterprise>\n"
+        );
+        return { exitCode: 2 };
+      }
+      const minRaw = args2[minIdx + 1];
+      if (!isValidTier(minRaw)) {
+        process.stderr.write(
+          `massu: invalid --min tier "${minRaw}" (expected one of: ${VALID_TIERS.join(", ")})
+`
+        );
+        return { exitCode: 2 };
+      }
+      const min = minRaw;
+      let current;
+      try {
+        current = await getCurrentTier();
+      } catch (err) {
+        process.stderr.write(
+          `massu: could not resolve license tier (${err instanceof Error ? err.message : String(err)})
+`
+        );
+        return { exitCode: 3 };
+      }
+      if (tierLevel(current) >= tierLevel(min)) {
+        return { exitCode: 0 };
+      }
+      process.stderr.write(autoLearningUpgradeMessage(current) + "\n");
+      return { exitCode: 3 };
+    }
+    case "--help":
+    case "-h":
+    case void 0: {
+      printLicenseHelp();
+      return { exitCode: 0 };
+    }
+    default: {
+      process.stderr.write(`massu: unknown license subcommand: ${sub}
+`);
+      printLicenseHelp();
+      return { exitCode: 1 };
+    }
+  }
+}
+function printLicenseHelp() {
+  process.stdout.write(`
+massu license <subcommand>
+
+Subcommands:
+  check --min <tier>   Exit 0 if the current license tier is at or above <tier>,
+                         else exit 3 with a generic upgrade message on stderr.
+                         <tier> is one of: free | pro | team | enterprise.
+                         Fail-closed \u2014 any error resolving the tier exits non-zero.
+
+                         Use as the first step of a gated command to hard-fail:
+                           npx massu license check --min pro || exit 1
+
+Examples:
+  npx massu license check --min pro
+  npx massu license check --min team
+
+Documentation: https://massu.ai/docs/reference/license-tiers
+`);
+}
+var VALID_TIERS;
+var init_license2 = __esm({
+  "src/commands/license.ts"() {
+    "use strict";
+    init_license();
+    init_auto_learning_entitlement();
+    VALID_TIERS = ["free", "pro", "team", "enterprise"];
+  }
+});
+
 // src/changelog-generator.ts
 import { existsSync as existsSync14, readFileSync as readFileSync13, readdirSync as readdirSync12 } from "fs";
 import { resolve as resolve11 } from "path";
@@ -15682,12 +16056,397 @@ var init_changelog = __esm({
   }
 });
 
+// src/security/promotion-pubkey.generated.ts
+var PROMOTION_PUBKEY_ED25519, PROMOTION_PUBKEY_FINGERPRINT_HEX, KNOWN_PROMOTION_PUBKEY_FINGERPRINTS;
+var init_promotion_pubkey_generated = __esm({
+  "src/security/promotion-pubkey.generated.ts"() {
+    "use strict";
+    PROMOTION_PUBKEY_ED25519 = new Uint8Array([107, 161, 33, 17, 189, 44, 193, 128, 252, 155, 188, 236, 100, 163, 23, 146, 219, 155, 216, 139, 134, 72, 211, 182, 151, 122, 209, 151, 135, 65, 167, 26]);
+    PROMOTION_PUBKEY_FINGERPRINT_HEX = "b14e2a73e23c02891e976ec161d339da6c930266c0202828d3187a3bd6e5d83f";
+    KNOWN_PROMOTION_PUBKEY_FINGERPRINTS = /* @__PURE__ */ new Set([
+      "b14e2a73e23c02891e976ec161d339da6c930266c0202828d3187a3bd6e5d83f"
+    ]);
+  }
+});
+
+// src/security/promotion-envelope-verifier.ts
+function verifyPromotionEnvelope(payload) {
+  return verifyEd25519SignedEnvelope(
+    {
+      pubkeyBytes: PROMOTION_PUBKEY_ED25519,
+      fingerprintHex: PROMOTION_PUBKEY_FINGERPRINT_HEX,
+      knownFingerprints: KNOWN_PROMOTION_PUBKEY_FINGERPRINTS,
+      keyLabel: "promotion"
+    },
+    payload
+  );
+}
+var init_promotion_envelope_verifier = __esm({
+  "src/security/promotion-envelope-verifier.ts"() {
+    "use strict";
+    init_ed25519_envelope_verifier();
+    init_promotion_pubkey_generated();
+  }
+});
+
+// src/rule-candidate-hardened.ts
+var TEAM_HARDENED_SHAREABLE_DESTINATIONS;
+var init_rule_candidate_hardened = __esm({
+  "src/rule-candidate-hardened.ts"() {
+    "use strict";
+    TEAM_HARDENED_SHAREABLE_DESTINATIONS = [
+      "pattern-scanner",
+      "custom-destination"
+    ];
+  }
+});
+
+// src/rule-pack-schema.ts
+function isRuleDestination(value) {
+  return typeof value === "string" && RULE_DESTINATIONS.includes(value);
+}
+function isExecutableDestination(destination) {
+  return TEAM_HARDENED_SHAREABLE_DESTINATIONS.includes(destination);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function validateRulePackRule(rule) {
+  const errors = [];
+  if (typeof rule !== "object" || rule === null || Array.isArray(rule)) {
+    return { valid: false, errors: ["rule must be a non-null object"], requiresHardened: false };
+  }
+  const r2 = rule;
+  if (!isNonEmptyString(r2.title)) {
+    errors.push("missing required field: title");
+  }
+  if (!isNonEmptyString(r2.description)) {
+    errors.push("missing required field: description");
+  }
+  if (!isNonEmptyString(r2.severity)) {
+    errors.push("missing required field: severity");
+  }
+  const destinationKnown = isRuleDestination(r2.destination);
+  if (!destinationKnown) {
+    errors.push(
+      `invalid destination: ${JSON.stringify(r2.destination)} is not a known RuleDestination (one of ${RULE_DESTINATIONS.join(", ")})`
+    );
+  }
+  if (destinationKnown) {
+    const destination = r2.destination;
+    const hasPattern = isNonEmptyString(r2.pattern);
+    const hasCheck = isNonEmptyString(r2.check);
+    const hasTextBody = isNonEmptyString(r2.description);
+    switch (destination) {
+      case "pattern-scanner":
+        if (!hasPattern && !hasCheck) {
+          errors.push(
+            "inert rule: pattern-scanner destination requires a non-empty `pattern` (or a `check` command)"
+          );
+        }
+        break;
+      case "custom-destination":
+        if (!hasPattern && !hasCheck) {
+          errors.push(
+            "inert rule: custom-destination requires a deterministic enforcement body (`pattern` or `check`)"
+          );
+        }
+        break;
+      case "corrections-md":
+      case "claude-md-cr":
+        if (!hasTextBody && !hasPattern && !hasCheck) {
+          errors.push(
+            `inert rule: ${destination} requires a non-empty text body (description)`
+          );
+        }
+        break;
+    }
+  }
+  const requiresHardened = destinationKnown && isExecutableDestination(r2.destination);
+  return { valid: errors.length === 0, errors, requiresHardened };
+}
+var RULE_DESTINATIONS;
+var init_rule_pack_schema = __esm({
+  "src/rule-pack-schema.ts"() {
+    "use strict";
+    init_rule_candidate_hardened();
+    RULE_DESTINATIONS = [
+      "corrections-md",
+      "pattern-scanner",
+      "claude-md-cr",
+      "custom-destination"
+    ];
+  }
+});
+
+// src/rule-pack-sync.ts
+import { existsSync as existsSync16, writeFileSync as writeFileSync3, mkdirSync as mkdirSync6 } from "fs";
+import { join as join11, dirname as dirname9 } from "path";
+async function pullInstalledPackRules(db, opts = {}) {
+  const config = getConfig();
+  const cloud = config.cloud;
+  const projectRoot = opts.projectRoot ?? getProjectRoot();
+  const tier = opts.tier ?? getCachedTierReadOnly(db);
+  if (!entitledForTeamSharedPromotion(tier)) return { ...ZERO };
+  const endpoint = opts.endpoint ?? cloud?.endpoint;
+  const apiKey = opts.apiKey ?? cloud?.apiKey;
+  if (!endpoint || !apiKey) return { ...ZERO };
+  const ownOrgId = opts.orgId !== void 0 ? opts.orgId : getCachedOrgId(db);
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const timeoutMs = opts.timeoutMs ?? cloud?.requestTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const url = `${endpoint}/installed-rules${opts.updatesOnly ? "?updates_only=1" : ""}`;
+  let envelope;
+  try {
+    const res = await fetchImpl(url, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!res.ok) return { ...ZERO };
+    envelope = await res.json();
+  } catch {
+    return { ...ZERO };
+  }
+  const verdict = verifyPromotionEnvelope(envelope);
+  if (verdict.kind !== "valid") {
+    emitDropTelemetry(db, "pack_rules_envelope_dropped", { reason: verdict.kind });
+    return { ...ZERO, dropped_unverified: countUntrusted(envelope) };
+  }
+  const signedKeys = Array.isArray(envelope._signature_payload_keys) ? envelope._signature_payload_keys : [];
+  if (!signedKeys.includes("orgId") || !signedKeys.includes("packs_json")) {
+    emitDropTelemetry(db, "pack_rules_unsigned_field", {
+      orgId_signed: signedKeys.includes("orgId"),
+      packs_json_signed: signedKeys.includes("packs_json")
+    });
+    return { ...ZERO, dropped_unverified: countUntrusted(envelope) };
+  }
+  const signedOrgId = typeof envelope.orgId === "string" ? envelope.orgId : null;
+  if (!signedOrgId || !ownOrgId || signedOrgId !== ownOrgId) {
+    emitDropTelemetry(db, "pack_rules_org_mismatch", {
+      signed_org_present: !!signedOrgId,
+      own_org_present: !!ownOrgId
+    });
+    return { ...ZERO, dropped_unverified: countUntrusted(envelope) };
+  }
+  const packs = parsePacks(envelope.packs_json);
+  const result = { ...ZERO };
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  for (const pack of packs) {
+    if (!isValidInstalledPack(pack)) continue;
+    for (const rawRule of pack.rules) {
+      const validation = validateRulePackRule(rawRule);
+      if (!validation.valid) {
+        result.skipped += 1;
+        continue;
+      }
+      const rule = rawRule;
+      result.pulled += 1;
+      const promptHash = packRulePromptHash(pack.slug, rule);
+      const candidatePath = sidecarPath(projectRoot, promptHash);
+      if (existsSync16(candidatePath) || alreadyApplied(db, promptHash)) {
+        result.skipped += 1;
+        continue;
+      }
+      materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, signedOrgId, nowIso);
+      result.materialized += 1;
+    }
+  }
+  return result;
+}
+function parsePacks(json) {
+  if (typeof json !== "string") return [];
+  try {
+    const v3 = JSON.parse(json);
+    return Array.isArray(v3) ? v3 : [];
+  } catch {
+    return [];
+  }
+}
+function countUntrusted(envelope) {
+  const packs = parsePacks(envelope.packs_json);
+  let n = 0;
+  for (const p19 of packs) {
+    if (p19 && Array.isArray(p19.rules)) n += p19.rules.length;
+  }
+  return n > 0 ? n : 1;
+}
+function isValidInstalledPack(p19) {
+  if (!p19 || typeof p19 !== "object") return false;
+  const r2 = p19;
+  return typeof r2.slug === "string" && r2.slug.length > 0 && Array.isArray(r2.rules);
+}
+function packRulePromptHash(slug, rule) {
+  const { createHash: createHash10 } = __require("node:crypto");
+  const body = `${slug}\0${rule.destination}\0${rule.title}\0${rule.pattern ?? rule.check ?? rule.description}`;
+  return createHash10("sha256").update(body, "utf-8").digest("hex").slice(0, 16);
+}
+function sidecarPath(projectRoot, promptHash) {
+  return join11(projectRoot, ".massu", "rule-candidates", `${promptHash}.json`);
+}
+function alreadyApplied(db, promptHash) {
+  try {
+    const row = db.prepare(
+      `SELECT 1 FROM audit_log WHERE event_type = 'rule_promoted'
+           AND json_extract(metadata, '$.prompt_hash') = ? LIMIT 1`
+    ).get(promptHash);
+    return !!row;
+  } catch {
+    return false;
+  }
+}
+function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, orgId, nowIso) {
+  const promptText = `${rule.title}: ${rule.description}`.replace(/\n+/g, " ").slice(0, 200) || `pack rule ${promptHash}`;
+  const draftText = rule.pattern ?? rule.check ?? rule.description;
+  const hardened = isExecutableDestination(rule.destination);
+  const sidecar = {
+    // Standard RuleCandidatePayload fields (so `/massu-rule approve` → readCandidate
+    // → validateCandidatePayload passes), synthesized from the pack rule.
+    prompt: promptText,
+    prompt_hash: promptHash,
+    score: 0,
+    signals: [],
+    prior_turn_files: [],
+    timestamp: nowIso,
+    session_id: `pack:${pack.slug}`,
+    // Provenance (P2-002/P2-003): the applier's team-origin / hardened apply-gate
+    // keys on this. `origin:'pack'` rides the SAME gate as a team origin
+    // (tier≥Team + signature_verified + shareable/hardened destination). A
+    // hardened (executable-destination) materialization sets `hardened:true` so
+    // the operator's `/massu-rule review` (render-only preview + a distinct
+    // second-operator attestation) is required before `approve`.
+    provenance: {
+      origin: "pack",
+      org_id: orgId,
+      promoted_by: `pack:${pack.slug}`,
+      promoted_at: nowIso,
+      signature_verified: true,
+      pack_slug: pack.slug,
+      pack_version: pack.current_version,
+      ...hardened ? { hardened: true } : {}
+    },
+    // Extra fields the `/massu-rule approve` flow reads to drive the apply (the
+    // pack author already decided destination + body). validateCandidatePayload
+    // ignores unknown keys.
+    destination: rule.destination,
+    draft_text: draftText
+  };
+  const dir = dirname9(candidatePath);
+  if (!existsSync16(dir)) mkdirSync6(dir, { recursive: true });
+  writeFileSync3(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
+}
+function emitDropTelemetry(db, eventType, data) {
+  recordTelemetry(db, eventType, data);
+  process.stderr.write(
+    `[massu] installed-pack rules pull: dropped envelope (${eventType}). A signed/org-matched response is required \u2014 see massu.ai for details.
+`
+  );
+}
+var DEFAULT_TIMEOUT_MS, ZERO;
+var init_rule_pack_sync = __esm({
+  "src/rule-pack-sync.ts"() {
+    "use strict";
+    init_config();
+    init_license();
+    init_auto_learning_entitlement();
+    init_promotion_envelope_verifier();
+    init_rule_pack_schema();
+    init_memory_db();
+    DEFAULT_TIMEOUT_MS = 2e3;
+    ZERO = {
+      pulled: 0,
+      materialized: 0,
+      skipped: 0,
+      dropped_unverified: 0
+    };
+  }
+});
+
+// src/commands/rule.ts
+var rule_exports = {};
+__export(rule_exports, {
+  handleRuleSubcommand: () => handleRuleSubcommand
+});
+async function handleRuleSubcommand(args2) {
+  const sub = args2[0];
+  switch (sub) {
+    case "record-shown": {
+      const promptHash = args2[1];
+      if (!promptHash || !PROMPT_HASH_RE.test(promptHash)) {
+        process.stderr.write(
+          "Usage: massu rule record-shown <prompt_hash>  (16-hex)\n"
+        );
+        return { exitCode: 2 };
+      }
+      try {
+        const db = getMemoryDb();
+        try {
+          if (entitledForTeamSharedPromotion(getCachedTierReadOnly(db))) {
+            enqueueRulePromotionEvent(db, {
+              prompt_hash: promptHash,
+              event_type: "shown",
+              created_at: (/* @__PURE__ */ new Date()).toISOString(),
+              metadata: {}
+            });
+          }
+        } finally {
+          db.close();
+        }
+      } catch {
+      }
+      return { exitCode: 0 };
+    }
+    case "packs": {
+      try {
+        const db = getMemoryDb();
+        try {
+          const res = await pullInstalledPackRules(db);
+          process.stdout.write(
+            `pack rules: pulled=${res.pulled} materialized=${res.materialized} skipped=${res.skipped} dropped_unverified=${res.dropped_unverified}
+`
+          );
+        } finally {
+          db.close();
+        }
+      } catch {
+        process.stdout.write(
+          "pack rules: pulled=0 materialized=0 skipped=0 dropped_unverified=0\n"
+        );
+      }
+      return { exitCode: 0 };
+    }
+    case "--help":
+    case "-h":
+    case void 0: {
+      process.stdout.write(
+        "massu rule <subcommand>\n\nSubcommands:\n  record-shown <prompt_hash>  Record a `shown` promotion-funnel event (Team-gated, best-effort).\n  packs                       Pull installed rule-pack rules as reviewable candidates (Team-gated).\n"
+      );
+      return { exitCode: 0 };
+    }
+    default: {
+      process.stderr.write(`massu: unknown rule subcommand: ${sub}
+`);
+      return { exitCode: 2 };
+    }
+  }
+}
+var PROMPT_HASH_RE;
+var init_rule = __esm({
+  "src/commands/rule.ts"() {
+    "use strict";
+    init_memory_db();
+    init_license();
+    init_auto_learning_entitlement();
+    init_rule_pack_sync();
+    PROMPT_HASH_RE = /^[0-9a-f]{16}$/;
+  }
+});
+
 // src/commands/show-template.ts
 var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync16, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "fs";
 import { resolve as resolve13 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
@@ -15717,7 +16476,7 @@ async function runShowTemplate(args2) {
   }
   const suffix = choice.kind === "hit" ? choice.suffix : "";
   const file = suffix === "" ? resolve13(sourceDir, `${baseName}.md`) : resolve13(sourceDir, `${baseName}${suffix}.md`);
-  if (!existsSync16(file)) {
+  if (!existsSync17(file)) {
     process.stderr.write(`massu: resolved template "${file}" no longer exists
 `);
     process.exit(1);
@@ -15776,8 +16535,8 @@ var init_passthrough = __esm({
 });
 
 // src/lib/fileLock.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync16, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname9 } from "path";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync16, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname10 } from "path";
 import * as lockfile from "proper-lockfile";
 function readLockHolderPid(lockPath) {
   try {
@@ -15800,7 +16559,7 @@ function busyWaitSync(ms) {
   Atomics.wait(view, 0, 0, ms);
 }
 function withFileLockSync(lockPath, fn, opts = {}) {
-  mkdirSync6(dirname9(lockPath), { recursive: true });
+  mkdirSync7(dirname10(lockPath), { recursive: true });
   const staleMs = opts.staleMs ?? 3e4;
   const blockMs = opts.retries === 0 ? 0 : opts.blockMs ?? 3e4;
   const pollIntervalMs = opts.pollIntervalMs ?? 100;
@@ -15817,7 +16576,7 @@ function withFileLockSync(lockPath, fn, opts = {}) {
         realpath: false
       });
       try {
-        writeFileSync3(`${lockPath}.pid`, String(process.pid), "utf-8");
+        writeFileSync4(`${lockPath}.pid`, String(process.pid), "utf-8");
       } catch {
       }
       break;
@@ -15906,7 +16665,7 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync17, readFileSync as readFileSync17, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync17, rmSync as rmSync4 } from "fs";
 import { resolve as resolve15 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
@@ -16038,7 +16797,7 @@ async function runConfigRefresh(opts = {}) {
   const configPath = resolve15(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
-  if (!existsSync17(configPath)) {
+  if (!existsSync18(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     if (!opts.silent) process.stderr.write(message + "\n");
     return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
@@ -16119,7 +16878,7 @@ async function runConfigRefresh(opts = {}) {
       const stackResolved = installResult.totalInstalled > 0 || installResult.totalUpdated > 0;
       if (stackResolved) {
         const placeholderPath = resolve15(installResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (existsSync17(placeholderPath)) {
+        if (existsSync18(placeholderPath)) {
           try {
             rmSync4(placeholderPath, { force: true });
             log("Removed _massu-needs-stack.md (stack now declared).\n");
@@ -16228,12 +16987,12 @@ var init_gitToplevel = __esm({
 });
 
 // src/watch/lockfile-detector.ts
-import { existsSync as existsSync18, statSync as statSync8 } from "fs";
+import { existsSync as existsSync19, statSync as statSync8 } from "fs";
 import { resolve as resolve16 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
     const p19 = resolve16(projectRoot, lf);
-    if (!existsSync18(p19)) continue;
+    if (!existsSync19(p19)) continue;
     try {
       const stat = statSync8(p19);
       const delta = now - stat.mtimeMs;
@@ -16246,7 +17005,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync18(resolve16(projectRoot, ".git", s))) return true;
+    if (existsSync19(resolve16(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -16443,8 +17202,8 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync3, existsSync as existsSync19, fsyncSync as fsyncSync3, mkdirSync as mkdirSync7, openSync as openSync3, readFileSync as readFileSync18, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync4, writeSync as writeSync3 } from "fs";
-import { dirname as dirname10, resolve as resolve17 } from "path";
+import { closeSync as closeSync3, existsSync as existsSync20, fsyncSync as fsyncSync3, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync18, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync5, writeSync as writeSync3 } from "fs";
+import { dirname as dirname11, resolve as resolve17 } from "path";
 function watchStatePath(projectRoot) {
   return resolve17(projectRoot, ".massu", "watch-state.json");
 }
@@ -16453,7 +17212,7 @@ function backupStatePath(projectRoot) {
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
-  if (!existsSync19(path)) return { ...DEFAULT_STATE };
+  if (!existsSync20(path)) return { ...DEFAULT_STATE };
   const content = readFileSync18(path, "utf-8");
   let raw;
   try {
@@ -16496,14 +17255,14 @@ function readState(projectRoot) {
 }
 function archiveCorrupt(projectRoot, content) {
   const bak = backupStatePath(projectRoot);
-  mkdirSync7(dirname10(bak), { recursive: true });
-  writeFileSync4(bak, content, "utf-8");
+  mkdirSync8(dirname11(bak), { recursive: true });
+  writeFileSync5(bak, content, "utf-8");
 }
 function writeStateAtomic(projectRoot, state) {
   const path = watchStatePath(projectRoot);
   writeStateAtomicCounter = writeStateAtomicCounter + 1 >>> 0;
   const tmp = `${path}.${process.pid}.${writeStateAtomicCounter}.tmp`;
-  mkdirSync7(dirname10(path), { recursive: true });
+  mkdirSync8(dirname11(path), { recursive: true });
   let renamed = false;
   try {
     const fd = openSync3(tmp, "w");
@@ -16517,7 +17276,7 @@ function writeStateAtomic(projectRoot, state) {
     renameSync4(tmp, path);
     renamed = true;
   } finally {
-    if (!renamed && existsSync19(tmp)) {
+    if (!renamed && existsSync20(tmp)) {
       try {
         rmSync5(tmp, { force: true });
       } catch {
@@ -16797,8 +17556,8 @@ __export(watch_exports, {
   runWatch: () => runWatch
 });
 import { spawnSync as spawnSync3 } from "child_process";
-import { basename as basename5, dirname as dirname11, resolve as resolve18 } from "path";
-import { appendFileSync, existsSync as existsSync20, mkdirSync as mkdirSync8, readFileSync as readFileSync19 } from "fs";
+import { basename as basename5, dirname as dirname12, resolve as resolve18 } from "path";
+import { appendFileSync, existsSync as existsSync21, mkdirSync as mkdirSync9, readFileSync as readFileSync19 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -16824,7 +17583,7 @@ function parseFlags(args2) {
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
   const fixed = home ? resolve18(home, ".claude", "bin", "claude-bg") : null;
-  if (fixed && existsSync20(fixed)) return fixed;
+  if (fixed && existsSync21(fixed)) return fixed;
   const which = spawnSync3("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
     const p19 = which.stdout.trim();
@@ -16885,7 +17644,7 @@ async function runWatch(args2) {
 }
 function runStatus(root) {
   const path = watchStatePath(root);
-  if (!existsSync20(path)) {
+  if (!existsSync21(path)) {
     process.stdout.write("massu watch: not running (no state file)\n");
     return { exitCode: 0 };
   }
@@ -17043,14 +17802,14 @@ function refreshLogPath(projectRoot) {
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
   try {
-    mkdirSync8(dirname11(path), { recursive: true });
+    mkdirSync9(dirname12(path), { recursive: true });
     appendFileSync(path, JSON.stringify(event) + "\n", "utf-8");
   } catch {
   }
 }
 function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const path = refreshLogPath(projectRoot);
-  if (!existsSync20(path)) return [];
+  if (!existsSync21(path)) return [];
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
@@ -17127,26 +17886,26 @@ var init_refresh_log = __esm({
 import {
   chmodSync as chmodSync3,
   closeSync as closeSync4,
-  existsSync as existsSync21,
+  existsSync as existsSync22,
   fsyncSync as fsyncSync4,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   openSync as openSync4,
   renameSync as renameSync5,
   rmSync as rmSync6,
   statSync as statSync9,
   writeSync as writeSync4
 } from "node:fs";
-import { dirname as dirname12 } from "node:path";
+import { dirname as dirname13 } from "node:path";
 function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
-  const parentDir = dirname12(path);
+  const parentDir = dirname13(path);
   try {
-    if (!existsSync21(parentDir)) {
+    if (!existsSync22(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
       }
-      mkdirSync9(parentDir, mkdirOpts);
+      mkdirSync10(parentDir, mkdirOpts);
     }
     const buf = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
     const openMode = opts.mode ?? 420;
@@ -17163,7 +17922,7 @@ function atomicWrite(path, content, opts = {}) {
     renameSync5(tmpPath, path);
     return { written: true };
   } catch (err) {
-    if (existsSync21(tmpPath)) {
+    if (existsSync22(tmpPath)) {
       try {
         rmSync6(tmpPath, { force: true });
       } catch {
@@ -17390,7 +18149,7 @@ var init_adapter_verifier = __esm({
 // src/security/fetcher.ts
 async function fetchUrl(url, opts = {}) {
   const allowedHosts = opts.allowedHosts ?? ALLOWED_HOSTS;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
   let parsed;
   try {
@@ -17464,11 +18223,11 @@ async function fetchUrl(url, opts = {}) {
     clearTimeout(timeoutHandle);
   }
 }
-var DEFAULT_TIMEOUT_MS, DEFAULT_MAX_BODY_BYTES, ALLOWED_HOSTS, FetchAllowlistError, FetchTimeoutError, FetchBodySizeError;
+var DEFAULT_TIMEOUT_MS2, DEFAULT_MAX_BODY_BYTES, ALLOWED_HOSTS, FetchAllowlistError, FetchTimeoutError, FetchBodySizeError;
 var init_fetcher = __esm({
   "src/security/fetcher.ts"() {
     "use strict";
-    DEFAULT_TIMEOUT_MS = 1e4;
+    DEFAULT_TIMEOUT_MS2 = 1e4;
     DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024;
     ALLOWED_HOSTS = [
       "registry.massu.ai",
@@ -17506,7 +18265,7 @@ var init_fetcher = __esm({
 });
 
 // src/security/manifest-cache.ts
-import { existsSync as existsSync22, readFileSync as readFileSync20, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync20, statSync as statSync10 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { resolve as resolve19 } from "node:path";
 import { z as z4 } from "zod";
@@ -17518,7 +18277,7 @@ function defaultCachePaths() {
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
-  if (!existsSync22(paths.cachePath)) {
+  if (!existsSync23(paths.cachePath)) {
     return { kind: "absent" };
   }
   let raw;
@@ -17712,7 +18471,7 @@ var init_adapter_origin = __esm({
 });
 
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync23, readFileSync as readFileSync21, lstatSync as lstatSync5 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync21, lstatSync as lstatSync5 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { resolve as resolve20, isAbsolute } from "node:path";
 import { createHash as createHash7 } from "node:crypto";
@@ -17741,7 +18500,7 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   return createHash7("sha256").update(canonical).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
-  if (!existsSync23(path)) return null;
+  if (!existsSync24(path)) return null;
   let raw;
   try {
     raw = JSON.parse(readFileSync21(path, "utf-8"));
@@ -17808,15 +18567,15 @@ var init_local_fingerprint = __esm({
 });
 
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync22, readdirSync as readdirSync13, lstatSync as lstatSync6, existsSync as existsSync24 } from "node:fs";
-import { join as join11, relative as relative5, sep } from "node:path";
+import { readFileSync as readFileSync22, readdirSync as readdirSync13, lstatSync as lstatSync6, existsSync as existsSync25 } from "node:fs";
+import { join as join12, relative as relative5, sep } from "node:path";
 import { homedir as homedir7 } from "node:os";
 import { resolve as resolve21 } from "node:path";
 import { createHash as createHash8 } from "node:crypto";
 import { z as z6 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
-    if (existsSync24(`${packageDir}/${hidden}`)) {
+    if (existsSync25(`${packageDir}/${hidden}`)) {
       return hidden;
     }
   }
@@ -17833,7 +18592,7 @@ function sha256OfDir(dir, opts = {}) {
       return;
     }
     for (const entry of entries.sort()) {
-      const absPath = join11(currentDir, entry);
+      const absPath = join12(currentDir, entry);
       let lst;
       try {
         lst = lstatSync6(absPath);
@@ -17871,7 +18630,7 @@ function sha256OfDir(dir, opts = {}) {
   return top.digest("hex");
 }
 function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
-  if (!existsSync24(path)) return {};
+  if (!existsSync25(path)) return {};
   let raw;
   try {
     raw = JSON.parse(readFileSync22(path, "utf-8"));
@@ -17913,8 +18672,8 @@ function removeInstalledManifestEntry(packageName, path = INSTALLED_MANIFEST_PAT
   }
   return { written: true };
 }
-function verifyInstalledIntegrity(packageName, packageDir, sidecarPath = INSTALLED_MANIFEST_PATH) {
-  const installed = readInstalledManifest(sidecarPath);
+function verifyInstalledIntegrity(packageName, packageDir, sidecarPath2 = INSTALLED_MANIFEST_PATH) {
+  const installed = readInstalledManifest(sidecarPath2);
   const entry = installed[packageName];
   if (!entry) {
     return {
@@ -17961,12 +18720,12 @@ var init_install_tracking = __esm({
 });
 
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync25, readdirSync as readdirSync14, readFileSync as readFileSync23, lstatSync as lstatSync7 } from "node:fs";
+import { existsSync as existsSync26, readdirSync as readdirSync14, readFileSync as readFileSync23, lstatSync as lstatSync7 } from "node:fs";
 import { resolve as resolve22, isAbsolute as isAbsolute2 } from "node:path";
 import { z as z7 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
   const nodeModulesDir = resolve22(projectRoot, "node_modules");
-  if (!existsSync25(nodeModulesDir)) {
+  if (!existsSync26(nodeModulesDir)) {
     return [];
   }
   const candidates = [];
@@ -18021,7 +18780,7 @@ function walkNodeModules(projectRoot, warnings) {
 }
 function tryReadAdapterPackage(packageDir, warnings) {
   const pkgJsonPath = resolve22(packageDir, "package.json");
-  if (!existsSync25(pkgJsonPath)) return null;
+  if (!existsSync26(pkgJsonPath)) return null;
   let raw;
   try {
     raw = JSON.parse(readFileSync23(pkgJsonPath, "utf-8"));
@@ -18159,7 +18918,7 @@ function discoverAdapters(opts) {
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
     const absPath = isAbsolute2(localPath) ? localPath : resolve22(opts.projectRoot, localPath);
-    if (!existsSync25(absPath)) {
+    if (!existsSync26(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
       );
@@ -18241,7 +19000,7 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync26, readFileSync as readFileSync24 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync24 } from "node:fs";
 import { resolve as resolve23 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
@@ -18510,7 +19269,7 @@ function mutateLocalArray(mutator, command) {
     return { exitCode: 2 };
   }
   const yamlPath = resolve23(projectRoot, "massu.config.yaml");
-  if (!existsSync26(yamlPath)) {
+  if (!existsSync27(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
 `
@@ -18610,7 +19369,7 @@ async function runAdaptersInstall(args2) {
     return { exitCode: 1 };
   }
   const packageDir = resolve23(projectRoot, "node_modules", ...packageName.split("/"));
-  if (!existsSync26(packageDir)) {
+  if (!existsSync27(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
 `
@@ -18618,7 +19377,7 @@ async function runAdaptersInstall(args2) {
     return { exitCode: 1 };
   }
   const pkgJsonPath = resolve23(packageDir, "package.json");
-  if (!existsSync26(pkgJsonPath)) {
+  if (!existsSync27(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
     return { exitCode: 1 };
@@ -18745,7 +19504,7 @@ async function runAdaptersResign(_args) {
       continue;
     }
     const packageDir = resolve23(projectRoot, "node_modules", ...name.split("/"));
-    if (!existsSync26(packageDir)) {
+    if (!existsSync27(packageDir)) {
       removed++;
       warnings.push(`${name}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
       removeInstalledManifestEntry(name);
@@ -18843,11 +19602,11 @@ var init_sql_table_names = __esm({
 
 // src/db.ts
 import Database2 from "better-sqlite3";
-import { dirname as dirname13, join as join12 } from "path";
-import { existsSync as existsSync27, mkdirSync as mkdirSync10, readdirSync as readdirSync15, statSync as statSync11 } from "fs";
+import { dirname as dirname14, join as join13 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync11, readdirSync as readdirSync15, statSync as statSync11 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
-  if (!existsSync27(dbPath)) {
+  if (!existsSync28(dbPath)) {
     throw new CodegraphDbNotInitializedError(dbPath);
   }
   const db = new Database2(dbPath, { readonly: true });
@@ -18856,9 +19615,9 @@ function getCodeGraphDb() {
 }
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
-  const dir = dirname13(dbPath);
-  if (!existsSync27(dir)) {
-    mkdirSync10(dir, { recursive: true });
+  const dir = dirname14(dbPath);
+  if (!existsSync28(dir)) {
+    mkdirSync11(dir, { recursive: true });
   }
   const db = new Database2(dbPath);
   db.pragma("journal_mode = WAL");
@@ -19130,7 +19889,7 @@ function isPythonDataStale(dataDb, pythonRoot) {
     try {
       const entries = readdirSync15(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = join12(dir, entry.name);
+        const fullPath = join13(dir, entry.name);
         if (entry.isDirectory()) {
           if (["__pycache__", ".venv", "venv", "node_modules", ".mypy_cache", ".pytest_cache"].includes(entry.name)) continue;
           if (checkDir(fullPath)) return true;
@@ -19166,13 +19925,13 @@ var init_db = __esm({
 
 // src/knowledge-db.ts
 import Database3 from "better-sqlite3";
-import { dirname as dirname14 } from "path";
-import { existsSync as existsSync28, mkdirSync as mkdirSync11 } from "fs";
+import { dirname as dirname15 } from "path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync12 } from "fs";
 function getKnowledgeDb() {
   const dbPath = getResolvedPaths().knowledgeDbPath;
-  const dir = dirname14(dbPath);
-  if (!existsSync28(dir)) {
-    mkdirSync11(dir, { recursive: true });
+  const dir = dirname15(dbPath);
+  if (!existsSync29(dir)) {
+    mkdirSync12(dir, { recursive: true });
   }
   const db = new Database3(dbPath);
   db.pragma("journal_mode = WAL");
@@ -19419,8 +20178,8 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync25, existsSync as existsSync29, statSync as statSync12 } from "fs";
-import { resolve as resolve25, dirname as dirname15, join as join13 } from "path";
+import { readFileSync as readFileSync25, existsSync as existsSync30, statSync as statSync12 } from "fs";
+import { resolve as resolve25, dirname as dirname16, join as join14 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -19478,21 +20237,21 @@ function resolveImportPath(specifier, fromFile) {
     const paths = getResolvedPaths();
     basePath = resolve25(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve25(dirname15(fromFile), specifier);
+    basePath = resolve25(dirname16(fromFile), specifier);
   }
-  if (existsSync29(basePath) && !isDirectory(basePath)) {
+  if (existsSync30(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync29(withExt)) {
+    if (existsSync30(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
-    const indexPath = join13(basePath, indexFile);
-    if (existsSync29(indexPath)) {
+    const indexPath = join14(basePath, indexFile);
+    if (existsSync30(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -19529,7 +20288,7 @@ function buildImportIndex(dataDb, codegraphDb) {
   let batch = [];
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve25(projectRoot, file.path), projectRoot);
-    if (!existsSync29(absPath)) continue;
+    if (!existsSync30(absPath)) continue;
     let source;
     try {
       source = readFileSync25(absPath, "utf-8");
@@ -19569,12 +20328,12 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync26, existsSync as existsSync30, readdirSync as readdirSync16 } from "fs";
-import { resolve as resolve26, join as join14 } from "path";
+import { readFileSync as readFileSync26, existsSync as existsSync31, readdirSync as readdirSync16 } from "fs";
+import { resolve as resolve26, join as join15 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync30(rootPath)) {
+  if (!existsSync31(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
   const source = readFileSync26(rootPath, "utf-8");
@@ -19589,12 +20348,12 @@ function parseRootRouter() {
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync30(candidate)) {
+      if (existsSync31(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
-      const indexCandidate = join14(fullPath, "index.ts");
-      if (existsSync30(indexCandidate)) {
+      const indexCandidate = join15(fullPath, "index.ts");
+      if (existsSync31(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -19614,7 +20373,7 @@ function parseRootRouter() {
 }
 function extractProcedures(routerFilePath) {
   const absPath = resolve26(getProjectRoot(), routerFilePath);
-  if (!existsSync30(absPath)) return [];
+  if (!existsSync31(absPath)) return [];
   const source = readFileSync26(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
@@ -19644,7 +20403,7 @@ function findUICallSites(routerKey, procedureName) {
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync30(dir)) continue;
+    if (!existsSync31(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
@@ -19652,7 +20411,7 @@ function findUICallSites(routerKey, procedureName) {
 function searchDirectory(dir, pattern, results) {
   const entries = readdirSync16(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join14(dir, entry.name);
+    const fullPath = join15(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name === ".next") continue;
       searchDirectory(fullPath, pattern, results);
@@ -19722,7 +20481,7 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync27, existsSync as existsSync31 } from "fs";
+import { readFileSync as readFileSync27, existsSync as existsSync32 } from "fs";
 import { resolve as resolve27 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
@@ -19762,7 +20521,7 @@ function findRouterCalls(files) {
   const projectRoot = getProjectRoot();
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve27(projectRoot, file), projectRoot);
-    if (!existsSync31(absPath)) continue;
+    if (!existsSync32(absPath)) continue;
     try {
       const source = readFileSync27(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
@@ -19783,7 +20542,7 @@ function findTablesFromRouters(routerNames, dataDb) {
     ).all(routerName);
     for (const proc of procs) {
       const absPath = ensureWithinRoot(resolve27(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync31(absPath)) continue;
+      if (!existsSync32(absPath)) continue;
       try {
         const source = readFileSync27(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
@@ -20057,11 +20816,11 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync28, existsSync as existsSync32, readdirSync as readdirSync17 } from "fs";
-import { join as join15 } from "path";
+import { readFileSync as readFileSync28, existsSync as existsSync33, readdirSync as readdirSync17 } from "fs";
+import { join as join16 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync32(schemaPath)) {
+  if (!existsSync33(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
   const source = readFileSync28(schemaPath, "utf-8");
@@ -20122,14 +20881,14 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync32(routersDir)) return usage;
+  if (!existsSync33(routersDir)) return usage;
   scanDirectory(routersDir, tableName, usage);
   return usage;
 }
 function scanDirectory(dir, tableName, usage) {
   const entries = readdirSync17(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join15(dir, entry.name);
+    const fullPath = join16(dir, entry.name);
     if (entry.isDirectory()) {
       scanDirectory(fullPath, tableName, usage);
     } else if (entry.name.endsWith(".ts")) {
@@ -20184,10 +20943,10 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync32(dir)) return result;
+  if (!existsSync33(dir)) return result;
   const entries = readdirSync17(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join15(dir, entry.name);
+    const fullPath = join16(dir, entry.name);
     if (entry.isDirectory()) {
       result.push(...findFilesUsingColumn(fullPath, column, tableName));
     } else if (entry.name.endsWith(".ts")) {
@@ -20337,34 +21096,34 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync29, existsSync as existsSync33, readdirSync as readdirSync18 } from "fs";
-import { resolve as resolve29, join as join16, relative as relative6, dirname as dirname16 } from "path";
+import { readFileSync as readFileSync29, existsSync as existsSync34, readdirSync as readdirSync18 } from "fs";
+import { resolve as resolve29, join as join17, relative as relative6, dirname as dirname17 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname16(resolve29(projectRoot, fromFile));
+    let baseDir = dirname17(resolve29(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
-      baseDir = dirname16(baseDir);
+      baseDir = dirname17(baseDir);
     }
     const modulePart = module.replace(/^\.+/, "");
     if (modulePart) {
       const parts2 = modulePart.split(".");
-      return tryResolvePythonPath(join16(baseDir, ...parts2), projectRoot);
+      return tryResolvePythonPath(join17(baseDir, ...parts2), projectRoot);
     }
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts = module.split(".");
-  const candidate = join16(resolve29(projectRoot, pythonRoot), ...parts);
+  const candidate = join17(resolve29(projectRoot, pythonRoot), ...parts);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync33(basePath + ".py")) {
+  if (existsSync34(basePath + ".py")) {
     return relative6(projectRoot, basePath + ".py");
   }
-  if (existsSync33(join16(basePath, "__init__.py"))) {
-    return relative6(projectRoot, join16(basePath, "__init__.py"));
+  if (existsSync34(join17(basePath, "__init__.py"))) {
+    return relative6(projectRoot, join17(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync33(basePath)) {
+  if (basePath.endsWith(".py") && existsSync34(basePath)) {
     return relative6(projectRoot, basePath);
   }
   return null;
@@ -20376,9 +21135,9 @@ function walkPythonFiles(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPythonFiles(join16(dir, entry.name), excludeDirs));
+        files.push(...walkPythonFiles(join17(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join16(dir, entry.name));
+        files.push(join17(dir, entry.name));
       }
     }
   } catch {
@@ -20672,7 +21431,7 @@ var init_route_parser = __esm({
 
 // src/python/route-indexer.ts
 import { readFileSync as readFileSync30, readdirSync as readdirSync19 } from "fs";
-import { join as join17, relative as relative7 } from "path";
+import { join as join18, relative as relative7 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
   try {
@@ -20680,9 +21439,9 @@ function walkPyFiles(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles(join17(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles(join18(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join17(dir, entry.name));
+        files.push(join18(dir, entry.name));
       }
     }
   } catch {
@@ -20691,7 +21450,7 @@ function walkPyFiles(dir, excludeDirs) {
 }
 function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join17(projectRoot, pythonRoot);
+  const absRoot = join18(projectRoot, pythonRoot);
   dataDb.exec(`DELETE FROM ${t("py_routes")}`);
   dataDb.exec(`DELETE FROM ${t("py_route_callers")}`);
   const insertStmt = dataDb.prepare(
@@ -20917,7 +21676,7 @@ var init_model_parser = __esm({
 
 // src/python/model-indexer.ts
 import { readFileSync as readFileSync31, readdirSync as readdirSync20 } from "fs";
-import { join as join18, relative as relative8 } from "path";
+import { join as join19, relative as relative8 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
   try {
@@ -20925,9 +21684,9 @@ function walkPyFiles2(dir, excludeDirs) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles2(join18(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles2(join19(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join18(dir, entry.name));
+        files.push(join19(dir, entry.name));
       }
     }
   } catch {
@@ -20936,7 +21695,7 @@ function walkPyFiles2(dir, excludeDirs) {
 }
 function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join18(projectRoot, pythonRoot);
+  const absRoot = join19(projectRoot, pythonRoot);
   dataDb.exec(`DELETE FROM ${t("py_models")}`);
   dataDb.exec(`DELETE FROM ${t("py_fk_edges")}`);
   const insertModel = dataDb.prepare(
@@ -21214,18 +21973,18 @@ var init_migration_parser = __esm({
 
 // src/python/migration-indexer.ts
 import { readFileSync as readFileSync32, readdirSync as readdirSync21 } from "fs";
-import { join as join19, relative as relative9 } from "path";
+import { join as join20, relative as relative9 } from "path";
 function buildPythonMigrationIndex(dataDb, alembicDir) {
   const projectRoot = getProjectRoot();
-  const absDir = join19(projectRoot, alembicDir);
+  const absDir = join20(projectRoot, alembicDir);
   dataDb.exec(`DELETE FROM ${t("py_migrations")}`);
-  const versionsDir = join19(absDir, "versions");
+  const versionsDir = join20(absDir, "versions");
   let files = [];
   try {
-    files = readdirSync21(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join19(versionsDir, f2));
+    files = readdirSync21(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join20(versionsDir, f2));
   } catch {
     try {
-      files = readdirSync21(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join19(absDir, f2));
+      files = readdirSync21(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join20(absDir, f2));
     } catch {
     }
   }
@@ -21275,11 +22034,11 @@ var init_migration_indexer = __esm({
 
 // src/python/coupling-detector.ts
 import { readFileSync as readFileSync33, readdirSync as readdirSync22 } from "fs";
-import { join as join20, relative as relative10 } from "path";
+import { join as join21, relative as relative10 } from "path";
 function buildPythonCouplingIndex(dataDb) {
   const projectRoot = getProjectRoot();
   const config = getConfig();
-  const srcDir = join20(projectRoot, config.paths.source);
+  const srcDir = join21(projectRoot, config.paths.source);
   const routes = dataDb.prepare(`SELECT id, method, path FROM ${t("py_routes")}`).all();
   if (routes.length === 0) return 0;
   dataDb.exec(`DELETE FROM ${t("py_route_callers")}`);
@@ -21343,9 +22102,9 @@ function walkFrontendFiles(dir) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (exclude.includes(entry.name)) continue;
-        files.push(...walkFrontendFiles(join20(dir, entry.name)));
+        files.push(...walkFrontendFiles(join21(dir, entry.name)));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
-        files.push(join20(dir, entry.name));
+        files.push(join21(dir, entry.name));
       }
     }
   } catch {
@@ -21717,7 +22476,7 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync34, existsSync as existsSync34 } from "fs";
+import { readFileSync as readFileSync34, existsSync as existsSync35 } from "fs";
 import { resolve as resolve30, basename as basename6 } from "path";
 function p3(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -21773,7 +22532,7 @@ function handleDocsToolCall(name, args2) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync34(mapPath)) {
+  if (!existsSync35(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
   return JSON.parse(readFileSync34(mapPath, "utf-8"));
@@ -21847,9 +22606,9 @@ function extractFrontmatter(content) {
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
   const absPath = ensureWithinRoot(resolve30(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync34(absPath)) {
+  if (!existsSync35(absPath)) {
     const altPath = ensureWithinRoot(resolve30(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
-    if (!existsSync34(altPath)) return [];
+    if (!existsSync35(altPath)) return [];
     return extractProcedureNamesFromContent(readFileSync34(altPath, "utf-8"));
   }
   return extractProcedureNamesFromContent(readFileSync34(absPath, "utf-8"));
@@ -21893,7 +22652,7 @@ function handleDocsAudit(args2) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
     const helpPagePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync34(helpPagePath)) {
+    if (!existsSync35(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -21946,7 +22705,7 @@ function handleDocsAudit(args2) {
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
         const guidePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync34(guidePath)) {
+        if (existsSync35(guidePath)) {
           const guideContent = readFileSync34(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
@@ -21981,7 +22740,7 @@ function handleDocsCoverage(args2) {
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
     const helpPagePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync34(helpPagePath);
+    const exists = existsSync35(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
@@ -22328,7 +23087,7 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync35 } from "fs";
+import { existsSync as existsSync36 } from "fs";
 import { resolve as resolve31 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
@@ -22566,22 +23325,22 @@ function validateFeatures(db, domainFilter) {
     const missingPages = [];
     for (const comp of components) {
       const absPath = resolve31(PROJECT_ROOT, comp.component_file);
-      if (!existsSync35(absPath)) {
+      if (!existsSync36(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
       const routerPath = resolve31(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync35(routerPath)) {
+      if (!existsSync36(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
       const absPath = resolve31(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync35(absPath)) {
+      if (page.page_route.startsWith("/") && !existsSync36(absPath)) {
         const altPath = resolve31(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync35(altPath)) {
+        if (!existsSync36(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -23107,8 +23866,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync35, existsSync as existsSync36, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
-import { resolve as resolve32, join as join21, basename as basename7, dirname as dirname17, relative as relative11 } from "path";
+import { readFileSync as readFileSync35, existsSync as existsSync37, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
+import { resolve as resolve32, join as join22, basename as basename7, dirname as dirname18, relative as relative11 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -23240,7 +23999,7 @@ function scanComponentExports(dataDb) {
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
   const basePath = resolve32(projectRoot, componentsBase);
-  if (existsSync36(basePath)) {
+  if (existsSync37(basePath)) {
     try {
       const entries = readdirSync23(basePath, { withFileTypes: true });
       for (const entry of entries) {
@@ -23253,7 +24012,7 @@ function scanComponentExports(dataDb) {
   }
   for (const dir of componentDirs) {
     const absDir = resolve32(projectRoot, dir);
-    if (!existsSync36(absDir)) continue;
+    if (!existsSync37(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative11(projectRoot, file);
@@ -23283,7 +24042,7 @@ function scanComponentExports(dataDb) {
       if (hasHandlers && exportMatch) {
         const componentName = exportMatch[1];
         const domain = inferDomain(relPath);
-        const subdomain = basename7(dirname17(relPath));
+        const subdomain = basename7(dirname18(relPath));
         const featureKey = `component.${subdomain}.${componentName.replace(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "")}`;
         if (!annotations.some((a2) => a2.featureKey === featureKey)) {
           features.push({
@@ -23308,7 +24067,7 @@ function walkDir2(dir) {
   try {
     const entries = readdirSync23(dir);
     for (const entry of entries) {
-      const fullPath = join21(dir, entry);
+      const fullPath = join22(dir, entry);
       try {
         const stat = statSync13(fullPath);
         if (stat.isDirectory()) {
@@ -24300,7 +25059,7 @@ var init_audit_trail = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync37, readFileSync as readFileSync36 } from "fs";
+import { existsSync as existsSync38, readFileSync as readFileSync36 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -24331,7 +25090,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync37(absPath)) {
+  if (!existsSync38(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -24786,7 +25545,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync38, readFileSync as readFileSync37 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync37 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -24810,7 +25569,7 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync38(absPath)) {
+  if (!existsSync39(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
@@ -25105,7 +25864,7 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync39, readFileSync as readFileSync38 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync38 } from "fs";
 import { resolve as resolve33 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -25139,7 +25898,7 @@ function calculateDepRisk(factors) {
 }
 function getInstalledPackages(projectRoot) {
   const pkgPath = resolve33(projectRoot, "package.json");
-  if (!existsSync39(pkgPath)) return /* @__PURE__ */ new Map();
+  if (!existsSync40(pkgPath)) return /* @__PURE__ */ new Map();
   try {
     const pkg = JSON.parse(readFileSync38(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
@@ -25747,7 +26506,7 @@ var init_regression_detector = __esm({
 
 // src/knowledge-indexer.ts
 import { createHash as createHash9 } from "crypto";
-import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync40 } from "fs";
+import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync41 } from "fs";
 import { resolve as resolve34, relative as relative12, basename as basename8, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
@@ -26055,11 +26814,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync40(paths.plansDir)) {
+  if (existsSync41(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync40(paths.docsDir)) {
+  if (existsSync41(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -26102,7 +26861,7 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync40(filePath)) continue;
+      if (!existsSync41(filePath)) continue;
       const content = readFileSync39(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative12(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative12(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative12(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative12(paths.memoryDir, filePath)}` : basename8(filePath);
@@ -26238,10 +26997,10 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync40(paths.plansDir)) {
+  if (existsSync41(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync40(paths.docsDir)) {
+  if (existsSync41(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -26270,7 +27029,7 @@ var init_knowledge_indexer = __esm({
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync40, writeFileSync as writeFileSync5, appendFileSync as appendFileSync2, readdirSync as readdirSync25 } from "fs";
+import { readFileSync as readFileSync40, writeFileSync as writeFileSync6, appendFileSync as appendFileSync2, readdirSync as readdirSync25 } from "fs";
 import { resolve as resolve35, basename as basename9 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -27030,7 +27789,7 @@ ${crRule ? `- **CR**: ${crRule}
   if (archiveIdx > 0) {
     const before = existing.slice(0, archiveIdx);
     const after = existing.slice(archiveIdx);
-    writeFileSync5(correctionsPath, before + entry + after);
+    writeFileSync6(correctionsPath, before + entry + after);
   } else {
     appendFileSync2(correctionsPath, entry);
   }
@@ -27978,7 +28737,7 @@ var init_framework_supports = __esm({
 });
 
 // src/tools.ts
-import { readFileSync as readFileSync41, existsSync as existsSync42 } from "fs";
+import { readFileSync as readFileSync41, existsSync as existsSync43 } from "fs";
 import { resolve as resolve36, basename as basename10 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
@@ -28398,7 +29157,7 @@ function handleContext(file, dataDb, codegraphDb) {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
           const absFilePath = ensureWithinRoot(resolve36(resolvedPaths.srcDir, "..", file), root);
-          if (existsSync42(absFilePath)) {
+          if (existsSync43(absFilePath)) {
             const fileContent = readFileSync41(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
@@ -28837,7 +29596,7 @@ function handleSchema(args2) {
     lines.push("");
     const projectRoot = getProjectRoot();
     const absPath = ensureWithinRoot(resolve36(projectRoot, file), projectRoot);
-    if (!existsSync42(absPath)) {
+    if (!existsSync43(absPath)) {
       return text17(`File not found: ${file}`);
     }
     const source = readFileSync41(absPath, "utf-8");
@@ -29246,7 +30005,7 @@ var init_server_dispatch = __esm({
 // src/server.ts
 var server_exports = {};
 import { readFileSync as readFileSync42 } from "fs";
-import { resolve as resolve37, dirname as dirname18 } from "path";
+import { resolve as resolve37, dirname as dirname19 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function pruneMemoryOnStartup() {
   try {
@@ -29278,7 +30037,7 @@ var init_server = __esm({
     init_memory_db();
     init_license();
     init_server_dispatch();
-    __dirname5 = dirname18(fileURLToPath5(import.meta.url));
+    __dirname5 = dirname19(fileURLToPath5(import.meta.url));
     PKG_VERSION = (() => {
       try {
         const pkg = JSON.parse(readFileSync42(resolve37(__dirname5, "..", "package.json"), "utf-8"));
@@ -29567,7 +30326,7 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync43, readFileSync as readFileSync43, writeFileSync as writeFileSync6, copyFileSync, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync44, readFileSync as readFileSync43, writeFileSync as writeFileSync7, copyFileSync, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve38 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
@@ -29579,7 +30338,7 @@ async function runConfigUpgrade(opts = {}) {
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
   if (opts.rollback) {
-    if (!existsSync43(bakPath)) {
+    if (!existsSync44(bakPath)) {
       const message = `No backup found at ${bakPath}`;
       err(message + "\n");
       return { exitCode: 1, action: "none", message };
@@ -29595,7 +30354,7 @@ async function runConfigUpgrade(opts = {}) {
       return { exitCode: 2, action: "none", message };
     }
   }
-  if (!existsSync43(configPath)) {
+  if (!existsSync44(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return { exitCode: 1, action: "none", message };
@@ -29626,7 +30385,7 @@ async function runConfigUpgrade(opts = {}) {
   };
   try {
     const original = readFileSync43(configPath, "utf-8");
-    writeFileSync6(bakPath, original, "utf-8");
+    writeFileSync7(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
     err(message + "\n");
@@ -29659,7 +30418,7 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync44, readFileSync as readFileSync44 } from "fs";
+import { existsSync as existsSync45, readFileSync as readFileSync44 } from "fs";
 import { resolve as resolve39 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
@@ -29673,7 +30432,7 @@ async function runConfigCheckDrift(opts = {}) {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
-  if (!existsSync44(configPath)) {
+  if (!existsSync45(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return {
@@ -29755,10 +30514,10 @@ var init_config_check_drift = __esm({
 
 // src/cli.ts
 import { readFileSync as readFileSync45 } from "fs";
-import { resolve as resolve40, dirname as dirname19 } from "path";
+import { resolve as resolve40, dirname as dirname20 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 var __filename5 = fileURLToPath6(import.meta.url);
-var __dirname6 = dirname19(__filename5);
+var __dirname6 = dirname20(__filename5);
 var args = process.argv.slice(2);
 var subcommand = args[0];
 async function main() {
@@ -29795,12 +30554,24 @@ async function main() {
       process.exit(result.exitCode);
       return;
     }
+    case "license": {
+      const { handleLicenseSubcommand: handleLicenseSubcommand2 } = await Promise.resolve().then(() => (init_license2(), license_exports));
+      const result = await handleLicenseSubcommand2(args.slice(1));
+      process.exit(result.exitCode);
+      return;
+    }
     case "changelog": {
       const { handleChangelogSubcommand: handleChangelogSubcommand2 } = await Promise.resolve().then(() => (init_changelog(), changelog_exports));
       const result = await handleChangelogSubcommand2(args.slice(1));
       process.exit(result.exitCode);
       return;
     }
+    case "rule": {
+      const { handleRuleSubcommand: handleRuleSubcommand2 } = await Promise.resolve().then(() => (init_rule(), rule_exports));
+      const result = await handleRuleSubcommand2(args.slice(1));
+      process.exit(result.exitCode);
+      return;
+    }
     case "show-template": {
       const { runShowTemplate: runShowTemplate2 } = await Promise.resolve().then(() => (init_show_template(), show_template_exports));
       await runShowTemplate2(args.slice(1));
@@ -29929,8 +30700,10 @@ Commands:
   validate-config   Validate massu.config.yaml (alias: config validate)
   config <sub>      Config lifecycle: refresh | validate | upgrade | doctor | check-drift
   permissions <sub> MCP permission lifecycle: install | verify | check-drift
+  license <sub>     License/tier gate: check --min <free|pro|team|enterprise>
   changelog <sub>   CHANGELOG generation / verification: generate | verify
   adapters <sub>    Third-party adapter registry: list | refresh | search | add-local | remove-local | install | resign
+  rule <sub>        Auto-learning rule-candidate side-effects: record-shown <prompt_hash>
 
 Options:
   --help, -h        Show this help message