@massu/core 1.16.0 → 1.16.2

package/dist/cli.js

@@ -1212,6 +1212,20 @@ function setCandidateStatus(db, promptHash, status, destination) {
      WHERE prompt_hash = ?
   `).run(status, destination ?? null, promptHash);
 }
+function getCandidate(db, promptHash) {
+  ensureRuleCandidatesTable(db);
+  const r2 = db.prepare("SELECT * FROM rule_candidates WHERE prompt_hash = ?").get(promptHash);
+  if (!r2) return null;
+  return { ...r2, payload: safeParse(r2.payload_json) };
+}
+function safeParse(raw) {
+  try {
+    const v3 = JSON.parse(raw);
+    return typeof v3 === "object" && v3 !== null ? v3 : {};
+  } catch {
+    return {};
+  }
+}
 var init_rule_candidate_store = __esm({
   "src/rule-candidate-store.ts"() {
     "use strict";
@@ -16541,10 +16555,11 @@ var LICENSE_PUBKEY_ED25519, LICENSE_PUBKEY_FINGERPRINT_HEX, KNOWN_LICENSE_PUBKEY
 var init_license_pubkey_generated = __esm({
   "src/security/license-pubkey.generated.ts"() {
     "use strict";
-    LICENSE_PUBKEY_ED25519 = new Uint8Array([39, 136, 108, 146, 85, 233, 119, 252, 223, 226, 123, 155, 234, 168, 200, 150, 36, 249, 174, 6, 130, 146, 125, 196, 136, 224, 202, 150, 53, 228, 114, 15]);
-    LICENSE_PUBKEY_FINGERPRINT_HEX = "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475";
+    LICENSE_PUBKEY_ED25519 = new Uint8Array([254, 188, 221, 150, 111, 252, 154, 100, 253, 247, 113, 192, 144, 224, 127, 160, 202, 111, 75, 40, 35, 169, 108, 89, 252, 250, 255, 233, 250, 120, 47, 160]);
+    LICENSE_PUBKEY_FINGERPRINT_HEX = "18c0456789a70eeee28012719f04725f43f59e693f735227ff73f0475f2290e3";
     KNOWN_LICENSE_PUBKEY_FINGERPRINTS = /* @__PURE__ */ new Set([
-      "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475"
+      "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475",
+      "18c0456789a70eeee28012719f04725f43f59e693f735227ff73f0475f2290e3"
     ]);
   }
 });
@@ -16562,7 +16577,7 @@ function verifyLicenseResponse(payload) {
   );
 }
 function isLicenseSignatureRequired() {
-  return process.env.MASSU_REQUIRE_SIGNED_LICENSE === "true";
+  return process.env.MASSU_REQUIRE_SIGNED_LICENSE !== "false";
 }
 var init_license_response_verifier = __esm({
   "src/security/license-response-verifier.ts"() {
@@ -21363,6 +21378,173 @@ var init_rule_candidate_preview = __esm({
   }
 });
 
+// src/rule-candidate-renderer.ts
+function renderSignalLine(s) {
+  const sign = s.applied >= 0 ? "+" : "";
+  const evidence = s.evidence ? `: ${s.evidence}` : "";
+  return `- ${s.name} (${sign}${s.applied})${evidence}`;
+}
+function fenced(language, body) {
+  return ["```" + language, body, "```"].join("\n");
+}
+function renderCandidatePreview(candidate) {
+  const lines = [];
+  lines.push(`## Candidate ${candidate.prompt_hash}`);
+  lines.push("");
+  lines.push(`Timestamp: ${candidate.timestamp}`);
+  lines.push("");
+  lines.push("### 1. Detected correction");
+  lines.push(`> ${candidate.prompt.replace(/\n+/g, " ").trim()}`);
+  lines.push("");
+  lines.push(`Score: ${candidate.score}/100 (threshold ${THRESHOLD})`);
+  lines.push("Signals fired:");
+  if (candidate.signals.length === 0) {
+    lines.push("- (none)");
+  } else {
+    for (const s of candidate.signals) lines.push(renderSignalLine(s));
+  }
+  lines.push("");
+  lines.push("### 2. Reacting to");
+  if (candidate.prior_turn_files.length === 0) {
+    lines.push("No prior Edit/Write detected in the previous assistant turn (the correction may target a free-text answer).");
+  } else {
+    lines.push("Prior assistant turn touched:");
+    for (const f2 of candidate.prior_turn_files) lines.push(`- ${f2}`);
+  }
+  if (candidate.prior_turn_diff_snippet) {
+    lines.push("");
+    lines.push(fenced("diff", candidate.prior_turn_diff_snippet.trim()));
+  }
+  lines.push("");
+  lines.push("### 3. Origin & status");
+  lines.push(`- origin: ${candidate.origin ?? "local"}`);
+  lines.push(`- status: ${candidate.status ?? "proposed"}`);
+  lines.push(`- destination: ${candidate.destination ?? "(not yet chosen \u2014 decided at approve time)"}`);
+  if (candidate.draft_text) {
+    lines.push("- authoritative draft (team/pack):");
+    lines.push(fenced("", candidate.draft_text));
+  }
+  lines.push("");
+  lines.push("### 4. Next steps");
+  lines.push("Review the exact text that would be applied, then approve or dismiss:");
+  lines.push(
+    fenced(
+      "bash",
+      `massu rule review ${candidate.prompt_hash} --destination <dest> --draft '<text>'
+massu rule approve ${candidate.prompt_hash} --destination <dest> --draft '<text>'
+massu rule dismiss ${candidate.prompt_hash} --reason '<why>'`
+    )
+  );
+  lines.push("");
+  return lines.join("\n");
+}
+var THRESHOLD;
+var init_rule_candidate_renderer = __esm({
+  "src/rule-candidate-renderer.ts"() {
+    "use strict";
+    THRESHOLD = 60;
+  }
+});
+
+// src/rule-promotion-effectiveness.ts
+import { readFileSync as readFileSync28, existsSync as existsSync34 } from "fs";
+function evaluateCr53Effectiveness(inputs) {
+  const { db, failureLogPath, knownLimitations } = inputs;
+  const allowlist = new Set(knownLimitations.map((k3) => k3.promptHash));
+  const auditRows = db.prepare(`
+    SELECT id, file_path, metadata, timestamp
+    FROM audit_log
+    WHERE event_type = 'rule_promoted'
+      AND timestamp < datetime('now', '-7 days')
+      AND json_extract(metadata, '$.recurrence_count') > 0
+    LIMIT 10000
+  `).all();
+  const auditViolations = [];
+  for (const row of auditRows) {
+    let meta = {};
+    try {
+      meta = JSON.parse(row.metadata);
+    } catch {
+    }
+    const promptHash = String(meta.prompt_hash ?? "");
+    if (allowlist.has(promptHash)) continue;
+    const recurrenceCount = Number(meta.recurrence_count ?? 0);
+    auditViolations.push({
+      auditLogId: row.id,
+      promptHash,
+      filePath: row.file_path,
+      recurrenceCount,
+      timestamp: row.timestamp
+    });
+  }
+  const failureLogViolations = [];
+  if (existsSync34(failureLogPath)) {
+    try {
+      const raw = readFileSync28(failureLogPath, "utf-8");
+      const cutoff = Date.now() - SEVEN_DAYS_MS;
+      for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed) continue;
+        let entry;
+        try {
+          entry = JSON.parse(trimmed);
+        } catch {
+          failureLogViolations.push({ rawLine: trimmed, error: "malformed JSON" });
+          continue;
+        }
+        const ts = String(entry.timestamp ?? "");
+        if (!ts) {
+          failureLogViolations.push({ rawLine: trimmed, error: "missing timestamp" });
+          continue;
+        }
+        const parsed = Date.parse(ts);
+        if (Number.isNaN(parsed)) {
+          failureLogViolations.push({ rawLine: trimmed, error: `invalid timestamp ${ts}` });
+          continue;
+        }
+        if (parsed >= cutoff) {
+          failureLogViolations.push({
+            rawLine: trimmed,
+            timestamp: ts,
+            error: entry.error ? String(entry.error) : void 0
+          });
+        }
+      }
+    } catch {
+    }
+  }
+  return {
+    ok: auditViolations.length === 0 && failureLogViolations.length === 0,
+    auditViolations,
+    failureLogViolations
+  };
+}
+function parseKnownLimitations(envVar) {
+  if (!envVar) return [];
+  try {
+    const parsed = JSON.parse(envVar);
+    if (!Array.isArray(parsed)) return [];
+    const out = [];
+    for (const item of parsed) {
+      if (item && typeof item === "object" && "promptHash" in item && "reason" in item) {
+        const promptHash = String(item.promptHash);
+        const reason = String(item.reason);
+        if (promptHash) out.push({ promptHash, reason });
+      }
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
+var SEVEN_DAYS_MS;
+var init_rule_promotion_effectiveness = __esm({
+  "src/rule-promotion-effectiveness.ts"() {
+    "use strict";
+    SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3;
+  }
+});
+
 // src/security/promotion-pubkey.generated.ts
 var PROMOTION_PUBKEY_ED25519, PROMOTION_PUBKEY_FINGERPRINT_HEX, KNOWN_PROMOTION_PUBKEY_FINGERPRINTS;
 var init_promotion_pubkey_generated = __esm({
@@ -21475,7 +21657,7 @@ var init_rule_pack_schema = __esm({
 });
 
 // src/rule-pack-sync.ts
-import { existsSync as existsSync34, writeFileSync as writeFileSync11, mkdirSync as mkdirSync15 } from "fs";
+import { existsSync as existsSync35, writeFileSync as writeFileSync11, mkdirSync as mkdirSync15 } from "fs";
 import { join as join21, dirname as dirname18 } from "path";
 async function pullInstalledPackRules(db, opts = {}) {
   const config = getConfig();
@@ -21497,10 +21679,11 @@ async function pullInstalledPackRules(db, opts = {}) {
       headers: { Authorization: `Bearer ${apiKey}` },
       signal: AbortSignal.timeout(timeoutMs)
     });
-    if (!res.ok) return { ...ZERO };
+    if (!res.ok) return failSync(db, `http_${res.status}`);
     envelope = await res.json();
-  } catch {
-    return { ...ZERO };
+  } catch (err) {
+    const reason = err instanceof Error && err.name === "TimeoutError" ? "timeout" : "network";
+    return failSync(db, reason);
   }
   const verdict = verifyPromotionEnvelope(envelope);
   if (verdict.kind !== "valid") {
@@ -21538,7 +21721,7 @@ async function pullInstalledPackRules(db, opts = {}) {
       result.pulled += 1;
       const promptHash = packRulePromptHash(pack.slug, rule);
       const candidatePath = sidecarPath(projectRoot, promptHash);
-      if (existsSync34(candidatePath) || alreadyApplied(db, promptHash)) {
+      if (existsSync35(candidatePath) || alreadyApplied(db, promptHash)) {
         result.skipped += 1;
         continue;
       }
@@ -21626,7 +21809,7 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
     draft_text: draftText
   };
   const dir = dirname18(candidatePath);
-  if (!existsSync34(dir)) mkdirSync15(dir, { recursive: true });
+  if (!existsSync35(dir)) mkdirSync15(dir, { recursive: true });
   writeFileSync11(candidatePath, JSON.stringify(sidecar, null, 2), "utf-8");
 }
 function emitDropTelemetry(db, eventType, data) {
@@ -21636,6 +21819,14 @@ function emitDropTelemetry(db, eventType, data) {
 `
   );
 }
+function failSync(db, reason) {
+  recordTelemetry(db, "installed_pack_rules_sync_failed", { reason });
+  process.stderr.write(
+    `[massu] installed-pack rules pull FAILED (${reason}). This is NOT "nothing to sync" \u2014 the cloud was unreachable or rejected the request; installed-pack rules were NOT refreshed this run.
+`
+  );
+  return { ...ZERO, sync_error: reason };
+}
 var DEFAULT_TIMEOUT_MS, ZERO;
 var init_rule_pack_sync = __esm({
   "src/rule-pack-sync.ts"() {
@@ -21715,6 +21906,82 @@ async function handleRuleSubcommand(args2) {
       }
       return { exitCode: 0 };
     }
+    case "effectiveness": {
+      const db = getMemoryDb();
+      try {
+        const failureLogPath = join22(
+          getProjectRoot(),
+          ".massu",
+          "rule-candidates",
+          ".cr53-increment-failures.jsonl"
+        );
+        const knownLimitations = parseKnownLimitations(process.env.MASSU_KNOWN_RULE_LIMITATIONS);
+        const result = evaluateCr53Effectiveness({ db, failureLogPath, knownLimitations });
+        if (result.ok) {
+          process.stdout.write(
+            "CR-53 effectiveness: OK \u2014 every rule promoted more than 7 days ago has prevented its bug class (0 recurrences), and no unresolved increment failures.\n"
+          );
+          return { exitCode: 0 };
+        }
+        process.stdout.write(
+          `CR-53 effectiveness: PROBLEM \u2014 ${result.auditViolations.length} recurring promoted rule(s) and ${result.failureLogViolations.length} unresolved increment failure(s) in the last 7 days.
+  A recurrence means an auto-learned rule did NOT prevent the bug class it was promoted to enforce.
+`
+        );
+        for (const v3 of result.auditViolations) {
+          process.stdout.write(
+            `  - rule ${v3.promptHash} recurred ${v3.recurrenceCount}x (audit_log #${v3.auditLogId}, promoted ${v3.timestamp})` + (v3.filePath ? ` \u2014 ${v3.filePath}` : "") + "\n"
+          );
+        }
+        for (const v3 of result.failureLogViolations) {
+          process.stdout.write(
+            `  - increment failure: ${v3.error ?? "recent entry"} ${v3.timestamp ?? ""}
+`
+          );
+        }
+        process.stdout.write(
+          "  If a recurrence is a genuine documented limitation, allowlist it via the MASSU_KNOWN_RULE_LIMITATIONS env var.\n"
+        );
+        return { exitCode: 1 };
+      } finally {
+        db.close();
+      }
+    }
+    case "show": {
+      const candidateId = args2[1];
+      if (!candidateId) {
+        process.stderr.write("Usage: massu rule show <candidate_id>\n");
+        return { exitCode: 2 };
+      }
+      let payload;
+      try {
+        payload = readCandidate(candidateId);
+      } catch (err) {
+        process.stderr.write(`massu: ${err instanceof Error ? err.message : String(err)}
+`);
+        return { exitCode: 1 };
+      }
+      const db = getMemoryDb();
+      try {
+        const row = getCandidate(db, candidateId);
+        const preview = renderCandidatePreview({
+          prompt_hash: payload.prompt_hash,
+          prompt: payload.prompt,
+          score: payload.score,
+          signals: payload.signals,
+          prior_turn_files: payload.prior_turn_files,
+          timestamp: payload.timestamp,
+          origin: row?.origin ?? "local",
+          status: row?.status ?? "proposed",
+          destination: payload.destination ?? row?.destination ?? null,
+          ...payload.draft_text ? { draft_text: payload.draft_text } : {}
+        });
+        process.stdout.write(preview + "\n");
+        return { exitCode: 0 };
+      } finally {
+        db.close();
+      }
+    }
     case "review": {
       const candidateId = args2[1];
       if (!candidateId) {
@@ -21887,7 +22154,7 @@ Cloud sync has given up ${giveups.n} time(s) (most recent: ${giveups.last}).
     case "-h":
     case void 0: {
       process.stdout.write(
-        "massu rule <subcommand>\n\nSubcommands:\n  approve <id> --destination <d> --draft <text>\n                              Promote a candidate to a rule (Pro+). Shares to your team at Team+.\n  dismiss <id> [--reason ...] Dismiss a candidate and downweight its signals.\n  review <id> --destination <d> --draft <text>\n                              Preview a HARDENED (executable) promotion + its risk findings;\n                              add --attest-operator/--attest-note to record a 2nd-operator review.\n  record-shown <prompt_hash>  Record a `shown` promotion-funnel event (Team-gated, best-effort).\n  packs                       Pull installed rule-pack rules as reviewable candidates (Team-gated).\n  delivery-status             Show which learned rules have not yet reached your team, and why.\n"
+        "massu rule <subcommand>\n\nSubcommands:\n  show <id>                   Show a detected candidate (the correction, score, signals,\n                              what it reacted to) before deciding to review/approve/dismiss.\n  approve <id> --destination <d> --draft <text>\n                              Promote a candidate to a rule (Pro+). Shares to your team at Team+.\n  dismiss <id> [--reason ...] Dismiss a candidate and downweight its signals.\n  review <id> --destination <d> --draft <text>\n                              Preview a HARDENED (executable) promotion + its risk findings;\n                              add --attest-operator/--attest-note to record a 2nd-operator review.\n  record-shown <prompt_hash>  Record a `shown` promotion-funnel event (Team-gated, best-effort).\n  packs                       Pull installed rule-pack rules as reviewable candidates (Team-gated).\n  delivery-status             Show which learned rules have not yet reached your team, and why.\n  effectiveness               Check CR-53 over the live audit_log: has any promoted rule\n                              (older than 7 days) failed to prevent its bug class? Exits non-zero if so.\n"
       );
       return { exitCode: 0 };
     }
@@ -21907,6 +22174,9 @@ var init_rule = __esm({
     init_rule_delivery();
     init_rule_candidate_applier();
     init_rule_candidate_preview();
+    init_rule_candidate_store();
+    init_rule_candidate_renderer();
+    init_rule_promotion_effectiveness();
     init_license();
     init_auto_learning_entitlement();
     init_rule_pack_sync();
@@ -22410,7 +22680,7 @@ var init_memory_supersede = __esm({
 
 // src/memory-consolidate.ts
 import { createHash as createHash10 } from "crypto";
-import { existsSync as existsSync35, mkdirSync as mkdirSync16, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync16, writeFileSync as writeFileSync12 } from "fs";
 import { join as join23 } from "path";
 function emptyResult() {
   return {
@@ -22587,7 +22857,7 @@ ${representative.detail}` : ""}`;
     const clusterKey = cluster.map((c2) => c2.title.toLowerCase().replace(/\s+/g, " ").trim()).sort().join("|");
     const promptHash = createHash10("sha256").update(clusterKey).digest("hex").slice(0, 16);
     const candidatePath = join23(candidateDir, `${promptHash}.json`);
-    if (existsSync35(candidatePath)) continue;
+    if (existsSync36(candidatePath)) continue;
     if (dryRun) {
       promoted++;
       continue;
@@ -22863,7 +23133,7 @@ var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync36, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync37, readFileSync as readFileSync29 } from "fs";
 import { resolve as resolve17 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
@@ -22893,13 +23163,13 @@ async function runShowTemplate(args2) {
   }
   const suffix = choice.kind === "hit" ? choice.suffix : "";
   const file = suffix === "" ? resolve17(sourceDir, `${baseName}.md`) : resolve17(sourceDir, `${baseName}${suffix}.md`);
-  if (!existsSync36(file)) {
+  if (!existsSync37(file)) {
     process.stderr.write(`massu: resolved template "${file}" no longer exists
 `);
     process.exit(1);
     return;
   }
-  process.stdout.write(readFileSync28(file, "utf-8"));
+  process.stdout.write(readFileSync29(file, "utf-8"));
 }
 var init_show_template = __esm({
   "src/commands/show-template.ts"() {
@@ -22994,7 +23264,7 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync37, readFileSync as readFileSync29, rmSync as rmSync8 } from "fs";
+import { existsSync as existsSync38, readFileSync as readFileSync30, rmSync as rmSync8 } from "fs";
 import { resolve as resolve19 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
@@ -23126,14 +23396,14 @@ async function runConfigRefresh(opts = {}) {
   const configPath = resolve19(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
-  if (!existsSync37(configPath)) {
+  if (!existsSync38(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     if (!opts.silent) process.stderr.write(message + "\n");
     return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
   }
   let existing;
   try {
-    const content = readFileSync29(configPath, "utf-8");
+    const content = readFileSync30(configPath, "utf-8");
     const parsed = parseYaml5(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -23207,7 +23477,7 @@ async function runConfigRefresh(opts = {}) {
       const stackResolved = installResult.totalInstalled > 0 || installResult.totalUpdated > 0;
       if (stackResolved) {
         const placeholderPath = resolve19(installResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (existsSync37(placeholderPath)) {
+        if (existsSync38(placeholderPath)) {
           try {
             rmSync8(placeholderPath, { force: true });
             log("Removed _massu-needs-stack.md (stack now declared).\n");
@@ -23316,12 +23586,12 @@ var init_gitToplevel = __esm({
 });
 
 // src/watch/lockfile-detector.ts
-import { existsSync as existsSync38, statSync as statSync14 } from "fs";
+import { existsSync as existsSync39, statSync as statSync14 } from "fs";
 import { resolve as resolve20 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
     const p19 = resolve20(projectRoot, lf);
-    if (!existsSync38(p19)) continue;
+    if (!existsSync39(p19)) continue;
     try {
       const stat = statSync14(p19);
       const delta = now - stat.mtimeMs;
@@ -23334,7 +23604,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync38(resolve20(projectRoot, ".git", s))) return true;
+    if (existsSync39(resolve20(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -23533,7 +23803,7 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync4, existsSync as existsSync39, fsyncSync as fsyncSync4, mkdirSync as mkdirSync17, openSync as openSync4, readFileSync as readFileSync30, renameSync as renameSync5, rmSync as rmSync9, writeFileSync as writeFileSync13, writeSync as writeSync3 } from "fs";
+import { closeSync as closeSync4, existsSync as existsSync40, fsyncSync as fsyncSync4, mkdirSync as mkdirSync17, openSync as openSync4, readFileSync as readFileSync31, renameSync as renameSync5, rmSync as rmSync9, writeFileSync as writeFileSync13, writeSync as writeSync3 } from "fs";
 import { dirname as dirname19, resolve as resolve21 } from "path";
 function watchStatePath(projectRoot) {
   return resolve21(projectRoot, ".massu", "watch-state.json");
@@ -23543,8 +23813,8 @@ function backupStatePath(projectRoot) {
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
-  if (!existsSync39(path)) return { ...DEFAULT_STATE };
-  const content = readFileSync30(path, "utf-8");
+  if (!existsSync40(path)) return { ...DEFAULT_STATE };
+  const content = readFileSync31(path, "utf-8");
   let raw;
   try {
     raw = JSON.parse(content);
@@ -23607,7 +23877,7 @@ function writeStateAtomic(projectRoot, state) {
     renameSync5(tmp, path);
     renamed = true;
   } finally {
-    if (!renamed && existsSync39(tmp)) {
+    if (!renamed && existsSync40(tmp)) {
       try {
         rmSync9(tmp, { force: true });
       } catch {
@@ -23890,7 +24160,7 @@ __export(watch_exports, {
 });
 import { spawnSync as spawnSync3 } from "child_process";
 import { basename as basename8, dirname as dirname20, resolve as resolve22 } from "path";
-import { appendFileSync as appendFileSync3, existsSync as existsSync40, mkdirSync as mkdirSync18, readFileSync as readFileSync31 } from "fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync41, mkdirSync as mkdirSync18, readFileSync as readFileSync32 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -23916,7 +24186,7 @@ function parseFlags(args2) {
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
   const fixed = home ? resolve22(home, ".claude", "bin", "claude-bg") : null;
-  if (fixed && existsSync40(fixed)) return fixed;
+  if (fixed && existsSync41(fixed)) return fixed;
   const which = spawnSync3("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
     const p19 = which.stdout.trim();
@@ -23977,7 +24247,7 @@ async function runWatch(args2) {
 }
 function runStatus(root) {
   const path = watchStatePath(root);
-  if (!existsSync40(path)) {
+  if (!existsSync41(path)) {
     process.stdout.write("massu watch: not running (no state file)\n");
     return { exitCode: 0 };
   }
@@ -24142,11 +24412,11 @@ function appendRefreshLog(projectRoot, event) {
 }
 function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const path = refreshLogPath(projectRoot);
-  if (!existsSync40(path)) return [];
+  if (!existsSync41(path)) return [];
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
-  const lines = readFileSync31(path, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync32(path, "utf-8").split("\n").filter(Boolean);
   const tail = lines.slice(-limit);
   const out = [];
   let corrupt = 0;
@@ -24219,7 +24489,7 @@ var init_refresh_log = __esm({
 import {
   chmodSync as chmodSync6,
   closeSync as closeSync5,
-  existsSync as existsSync41,
+  existsSync as existsSync42,
   fsyncSync as fsyncSync5,
   mkdirSync as mkdirSync19,
   openSync as openSync5,
@@ -24233,7 +24503,7 @@ function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
   const parentDir = dirname21(path);
   try {
-    if (!existsSync41(parentDir)) {
+    if (!existsSync42(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
@@ -24255,7 +24525,7 @@ function atomicWrite(path, content, opts = {}) {
     renameSync6(tmpPath, path);
     return { written: true };
   } catch (err) {
-    if (existsSync41(tmpPath)) {
+    if (existsSync42(tmpPath)) {
       try {
         rmSync10(tmpPath, { force: true });
       } catch {
@@ -24604,7 +24874,7 @@ var init_fetcher = __esm({
 });
 
 // src/security/manifest-cache.ts
-import { existsSync as existsSync42, readFileSync as readFileSync32, statSync as statSync16 } from "node:fs";
+import { existsSync as existsSync43, readFileSync as readFileSync33, statSync as statSync16 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
 import { resolve as resolve23 } from "node:path";
 import { z as z5 } from "zod";
@@ -24616,12 +24886,12 @@ function defaultCachePaths() {
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
-  if (!existsSync42(paths.cachePath)) {
+  if (!existsSync43(paths.cachePath)) {
     return { kind: "absent" };
   }
   let raw;
   try {
-    const content = readFileSync32(paths.cachePath, "utf-8");
+    const content = readFileSync33(paths.cachePath, "utf-8");
     raw = JSON.parse(content);
   } catch (err) {
     return {
@@ -24810,7 +25080,7 @@ var init_adapter_origin = __esm({
 });
 
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync43, readFileSync as readFileSync33, lstatSync as lstatSync5 } from "node:fs";
+import { existsSync as existsSync44, readFileSync as readFileSync34, lstatSync as lstatSync5 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
 import { resolve as resolve24, isAbsolute as isAbsolute3 } from "node:path";
 import { createHash as createHash12 } from "node:crypto";
@@ -24827,7 +25097,7 @@ function computeLocalFingerprint(localPaths, projectRoot) {
       } else if (!lst.isFile()) {
         contentTag = "<not-a-file>";
       } else {
-        contentTag = createHash12("sha256").update(readFileSync33(abs)).digest("hex");
+        contentTag = createHash12("sha256").update(readFileSync34(abs)).digest("hex");
       }
     } catch {
       contentTag = "<missing>";
@@ -24839,10 +25109,10 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   return createHash12("sha256").update(canonical).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
-  if (!existsSync43(path)) return null;
+  if (!existsSync44(path)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync33(path, "utf-8"));
+    raw = JSON.parse(readFileSync34(path, "utf-8"));
   } catch {
     return null;
   }
@@ -24906,7 +25176,7 @@ var init_local_fingerprint = __esm({
 });
 
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync34, readdirSync as readdirSync16, lstatSync as lstatSync6, existsSync as existsSync44 } from "node:fs";
+import { readFileSync as readFileSync35, readdirSync as readdirSync16, lstatSync as lstatSync6, existsSync as existsSync45 } from "node:fs";
 import { join as join24, relative as relative7, sep as sep2 } from "node:path";
 import { homedir as homedir15 } from "node:os";
 import { resolve as resolve25 } from "node:path";
@@ -24914,7 +25184,7 @@ import { createHash as createHash13 } from "node:crypto";
 import { z as z7 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
-    if (existsSync44(`${packageDir}/${hidden}`)) {
+    if (existsSync45(`${packageDir}/${hidden}`)) {
       return hidden;
     }
   }
@@ -24960,7 +25230,7 @@ function sha256OfDir(dir, opts = {}) {
   files.sort((a2, b2) => a2.relativePath < b2.relativePath ? -1 : a2.relativePath > b2.relativePath ? 1 : 0);
   const top = createHash13("sha256");
   for (const f2 of files) {
-    const fileHash = createHash13("sha256").update(readFileSync34(f2.absPath)).digest("hex");
+    const fileHash = createHash13("sha256").update(readFileSync35(f2.absPath)).digest("hex");
     top.update(f2.relativePath, "utf-8");
     top.update("\0", "utf-8");
     top.update(fileHash, "utf-8");
@@ -24969,10 +25239,10 @@ function sha256OfDir(dir, opts = {}) {
   return top.digest("hex");
 }
 function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
-  if (!existsSync44(path)) return {};
+  if (!existsSync45(path)) return {};
   let raw;
   try {
-    raw = JSON.parse(readFileSync34(path, "utf-8"));
+    raw = JSON.parse(readFileSync35(path, "utf-8"));
   } catch {
     return {};
   }
@@ -25059,12 +25329,12 @@ var init_install_tracking = __esm({
 });
 
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync45, readdirSync as readdirSync17, readFileSync as readFileSync35, lstatSync as lstatSync7 } from "node:fs";
+import { existsSync as existsSync46, readdirSync as readdirSync17, readFileSync as readFileSync36, lstatSync as lstatSync7 } from "node:fs";
 import { resolve as resolve26, isAbsolute as isAbsolute4 } from "node:path";
 import { z as z8 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
   const nodeModulesDir = resolve26(projectRoot, "node_modules");
-  if (!existsSync45(nodeModulesDir)) {
+  if (!existsSync46(nodeModulesDir)) {
     return [];
   }
   const candidates = [];
@@ -25119,10 +25389,10 @@ function walkNodeModules(projectRoot, warnings) {
 }
 function tryReadAdapterPackage(packageDir, warnings) {
   const pkgJsonPath = resolve26(packageDir, "package.json");
-  if (!existsSync45(pkgJsonPath)) return null;
+  if (!existsSync46(pkgJsonPath)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync35(pkgJsonPath, "utf-8"));
+    raw = JSON.parse(readFileSync36(pkgJsonPath, "utf-8"));
   } catch (err) {
     warnings.push(
       `skipping ${packageDir}: package.json parse failed (${err instanceof Error ? err.message : String(err)})`
@@ -25257,7 +25527,7 @@ function discoverAdapters(opts) {
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
     const absPath = isAbsolute4(localPath) ? localPath : resolve26(opts.projectRoot, localPath);
-    if (!existsSync45(absPath)) {
+    if (!existsSync46(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
       );
@@ -25339,7 +25609,7 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync46, readFileSync as readFileSync36 } from "node:fs";
+import { existsSync as existsSync47, readFileSync as readFileSync37 } from "node:fs";
 import { resolve as resolve27 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
@@ -25608,7 +25878,7 @@ function mutateLocalArray(mutator, command) {
     return { exitCode: 2 };
   }
   const yamlPath = resolve27(projectRoot, "massu.config.yaml");
-  if (!existsSync46(yamlPath)) {
+  if (!existsSync47(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
 `
@@ -25617,7 +25887,7 @@ function mutateLocalArray(mutator, command) {
   }
   let yamlText;
   try {
-    yamlText = readFileSync36(yamlPath, "utf-8");
+    yamlText = readFileSync37(yamlPath, "utf-8");
   } catch (err) {
     process.stderr.write(`${command}: failed to read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -25708,7 +25978,7 @@ async function runAdaptersInstall(args2) {
     return { exitCode: 1 };
   }
   const packageDir = resolve27(projectRoot, "node_modules", ...packageName.split("/"));
-  if (!existsSync46(packageDir)) {
+  if (!existsSync47(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
 `
@@ -25716,14 +25986,14 @@ async function runAdaptersInstall(args2) {
     return { exitCode: 1 };
   }
   const pkgJsonPath = resolve27(packageDir, "package.json");
-  if (!existsSync46(pkgJsonPath)) {
+  if (!existsSync47(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
     return { exitCode: 1 };
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync36(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(readFileSync37(pkgJsonPath, "utf-8"));
   } catch (err) {
     process.stderr.write(`install: ${packageName} has malformed package.json: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -25843,7 +26113,7 @@ async function runAdaptersResign(_args) {
       continue;
     }
     const packageDir = resolve27(projectRoot, "node_modules", ...name.split("/"));
-    if (!existsSync46(packageDir)) {
+    if (!existsSync47(packageDir)) {
       removed++;
       warnings.push(`${name}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
       removeInstalledManifestEntry(name);
@@ -25930,10 +26200,10 @@ var init_adapters2 = __esm({
 
 // src/preflight.ts
 import Database4 from "better-sqlite3";
-import { existsSync as existsSync47 } from "fs";
+import { existsSync as existsSync48 } from "fs";
 function assertCodegraphUsable(dbPath) {
   const path = dbPath ?? getResolvedPaths().codegraphDbPath;
-  if (!existsSync47(path)) {
+  if (!existsSync48(path)) {
     throw new CodegraphDbUnusableError(path, "missing");
   }
   let db = null;
@@ -26023,7 +26293,7 @@ var init_sql_table_names = __esm({
 // src/db.ts
 import Database5 from "better-sqlite3";
 import { dirname as dirname22, join as join25 } from "path";
-import { existsSync as existsSync48, mkdirSync as mkdirSync20, readdirSync as readdirSync18, statSync as statSync17 } from "fs";
+import { existsSync as existsSync49, mkdirSync as mkdirSync20, readdirSync as readdirSync18, statSync as statSync17 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
   assertCodegraphUsable(dbPath);
@@ -26034,7 +26304,7 @@ function getCodeGraphDb() {
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
   const dir = dirname22(dbPath);
-  if (!existsSync48(dir)) {
+  if (!existsSync49(dir)) {
     mkdirSync20(dir, { recursive: true });
   }
   const db = new Database5(dbPath);
@@ -26411,7 +26681,7 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync37, existsSync as existsSync49, statSync as statSync18 } from "fs";
+import { readFileSync as readFileSync38, existsSync as existsSync50, statSync as statSync18 } from "fs";
 import { resolve as resolve29, dirname as dirname23, join as join26 } from "path";
 function parseImports(source) {
   const imports = [];
@@ -26472,19 +26742,19 @@ function resolveImportPath(specifier, fromFile) {
   } else {
     basePath = resolve29(dirname23(fromFile), specifier);
   }
-  if (existsSync49(basePath) && !isDirectory(basePath)) {
+  if (existsSync50(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync49(withExt)) {
+    if (existsSync50(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
     const indexPath = join26(basePath, indexFile);
-    if (existsSync49(indexPath)) {
+    if (existsSync50(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -26521,10 +26791,10 @@ function buildImportIndex(dataDb, codegraphDb) {
   let batch = [];
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve29(projectRoot, file.path), projectRoot);
-    if (!existsSync49(absPath)) continue;
+    if (!existsSync50(absPath)) continue;
     let source;
     try {
-      source = readFileSync37(absPath, "utf-8");
+      source = readFileSync38(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -26561,15 +26831,15 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync38, existsSync as existsSync50, readdirSync as readdirSync19 } from "fs";
+import { readFileSync as readFileSync39, existsSync as existsSync51, readdirSync as readdirSync19 } from "fs";
 import { resolve as resolve30, join as join27 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync50(rootPath)) {
+  if (!existsSync51(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
-  const source = readFileSync38(rootPath, "utf-8");
+  const source = readFileSync39(rootPath, "utf-8");
   const mappings = [];
   const importMap = /* @__PURE__ */ new Map();
   const importRegex = /import\s+\{[^}]*?(\w+Router)[^}]*\}\s+from\s+['"]\.\/routers\/([^'"]+)['"]/g;
@@ -26581,12 +26851,12 @@ function parseRootRouter() {
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync50(candidate)) {
+      if (existsSync51(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
       const indexCandidate = join27(fullPath, "index.ts");
-      if (existsSync50(indexCandidate)) {
+      if (existsSync51(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -26606,8 +26876,8 @@ function parseRootRouter() {
 }
 function extractProcedures(routerFilePath) {
   const absPath = resolve30(getProjectRoot(), routerFilePath);
-  if (!existsSync50(absPath)) return [];
-  const source = readFileSync38(absPath, "utf-8");
+  if (!existsSync51(absPath)) return [];
+  const source = readFileSync39(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
   const procRegex = /(\w+)\s*:\s*(protected|public)Procedure/g;
@@ -26636,7 +26906,7 @@ function findUICallSites(routerKey, procedureName) {
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync50(dir)) continue;
+    if (!existsSync51(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
@@ -26650,7 +26920,7 @@ function searchDirectory(dir, pattern, results) {
       searchDirectory(fullPath, pattern, results);
     } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
       try {
-        const source = readFileSync38(fullPath, "utf-8");
+        const source = readFileSync39(fullPath, "utf-8");
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           if (lines[i].includes(pattern)) {
@@ -26714,7 +26984,7 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync39, existsSync as existsSync51 } from "fs";
+import { readFileSync as readFileSync40, existsSync as existsSync52 } from "fs";
 import { resolve as resolve31 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
@@ -26754,9 +27024,9 @@ function findRouterCalls(files) {
   const projectRoot = getProjectRoot();
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve31(projectRoot, file), projectRoot);
-    if (!existsSync51(absPath)) continue;
+    if (!existsSync52(absPath)) continue;
     try {
-      const source = readFileSync39(absPath, "utf-8");
+      const source = readFileSync40(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
       let match;
       while ((match = apiCallRegex.exec(source)) !== null) {
@@ -26775,9 +27045,9 @@ function findTablesFromRouters(routerNames, dataDb) {
     ).all(routerName);
     for (const proc of procs) {
       const absPath = ensureWithinRoot(resolve31(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync51(absPath)) continue;
+      if (!existsSync52(absPath)) continue;
       try {
-        const source = readFileSync39(absPath, "utf-8");
+        const source = readFileSync40(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
         const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
         const tableRegex = new RegExp(regexStr + "\\.", "g");
@@ -27049,14 +27319,14 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync40, existsSync as existsSync52, readdirSync as readdirSync20 } from "fs";
+import { readFileSync as readFileSync41, existsSync as existsSync53, readdirSync as readdirSync20 } from "fs";
 import { join as join28 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync52(schemaPath)) {
+  if (!existsSync53(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
-  const source = readFileSync40(schemaPath, "utf-8");
+  const source = readFileSync41(schemaPath, "utf-8");
   const models = [];
   const sourceLines = source.split("\n");
   let i = 0;
@@ -27114,7 +27384,7 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage2 = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync52(routersDir)) return usage2;
+  if (!existsSync53(routersDir)) return usage2;
   scanDirectory(routersDir, tableName, usage2);
   return usage2;
 }
@@ -27131,7 +27401,7 @@ function scanDirectory(dir, tableName, usage2) {
 }
 function scanFile(absPath, tableName, usage2) {
   try {
-    const source = readFileSync40(absPath, "utf-8");
+    const source = readFileSync41(absPath, "utf-8");
     if (!source.includes(tableName)) return;
     const relPath = absPath.slice(getProjectRoot().length + 1);
     const lines = source.split("\n");
@@ -27176,7 +27446,7 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync52(dir)) return result;
+  if (!existsSync53(dir)) return result;
   const entries = readdirSync20(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join28(dir, entry.name);
@@ -27184,7 +27454,7 @@ function findFilesUsingColumn(dir, column, tableName) {
       result.push(...findFilesUsingColumn(fullPath, column, tableName));
     } else if (entry.name.endsWith(".ts")) {
       try {
-        const source = readFileSync40(fullPath, "utf-8");
+        const source = readFileSync41(fullPath, "utf-8");
         if (source.includes(tableName) && source.includes(column)) {
           result.push(fullPath.slice(getProjectRoot().length + 1));
         }
@@ -27329,7 +27599,7 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync41, existsSync as existsSync53, readdirSync as readdirSync21 } from "fs";
+import { readFileSync as readFileSync42, existsSync as existsSync54, readdirSync as readdirSync21 } from "fs";
 import { resolve as resolve33, join as join29, relative as relative8, dirname as dirname24 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
@@ -27350,13 +27620,13 @@ function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync53(basePath + ".py")) {
+  if (existsSync54(basePath + ".py")) {
     return relative8(projectRoot, basePath + ".py");
   }
-  if (existsSync53(join29(basePath, "__init__.py"))) {
+  if (existsSync54(join29(basePath, "__init__.py"))) {
     return relative8(projectRoot, join29(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync53(basePath)) {
+  if (basePath.endsWith(".py") && existsSync54(basePath)) {
     return relative8(projectRoot, basePath);
   }
   return null;
@@ -27396,7 +27666,7 @@ function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__"
     const relFile = relative8(projectRoot, absFile);
     let source;
     try {
-      source = readFileSync41(absFile, "utf-8");
+      source = readFileSync42(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -27663,7 +27933,7 @@ var init_route_parser = __esm({
 });
 
 // src/python/route-indexer.ts
-import { readFileSync as readFileSync42, readdirSync as readdirSync22 } from "fs";
+import { readFileSync as readFileSync43, readdirSync as readdirSync22 } from "fs";
 import { join as join30, relative as relative9 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
@@ -27696,7 +27966,7 @@ function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
       const relFile = relative9(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync42(absFile, "utf-8");
+        source = readFileSync43(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -27908,7 +28178,7 @@ var init_model_parser = __esm({
 });
 
 // src/python/model-indexer.ts
-import { readFileSync as readFileSync43, readdirSync as readdirSync23 } from "fs";
+import { readFileSync as readFileSync44, readdirSync as readdirSync23 } from "fs";
 import { join as join31, relative as relative10 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
@@ -27944,7 +28214,7 @@ function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
       const relFile = relative10(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync43(absFile, "utf-8");
+        source = readFileSync44(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -28205,7 +28475,7 @@ var init_migration_parser = __esm({
 });
 
 // src/python/migration-indexer.ts
-import { readFileSync as readFileSync44, readdirSync as readdirSync24 } from "fs";
+import { readFileSync as readFileSync45, readdirSync as readdirSync24 } from "fs";
 import { join as join32, relative as relative11 } from "path";
 function buildPythonMigrationIndex(dataDb, alembicDir) {
   const projectRoot = getProjectRoot();
@@ -28231,7 +28501,7 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
   for (const absFile of files) {
     let source;
     try {
-      source = readFileSync44(absFile, "utf-8");
+      source = readFileSync45(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -28266,7 +28536,7 @@ var init_migration_indexer = __esm({
 });
 
 // src/python/coupling-detector.ts
-import { readFileSync as readFileSync45, readdirSync as readdirSync25 } from "fs";
+import { readFileSync as readFileSync46, readdirSync as readdirSync25 } from "fs";
 import { join as join33, relative as relative12 } from "path";
 function buildPythonCouplingIndex(dataDb) {
   const projectRoot = getProjectRoot();
@@ -28303,7 +28573,7 @@ function buildPythonCouplingIndex(dataDb) {
       const relFile = relative12(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync45(absFile, "utf-8");
+        source = readFileSync46(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -28709,7 +28979,7 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync46, existsSync as existsSync54 } from "fs";
+import { readFileSync as readFileSync47, existsSync as existsSync55 } from "fs";
 import { resolve as resolve34, basename as basename9 } from "path";
 function p4(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -28765,10 +29035,10 @@ function handleDocsToolCall(name, args2) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync54(mapPath)) {
+  if (!existsSync55(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
-  return JSON.parse(readFileSync46(mapPath, "utf-8"));
+  return JSON.parse(readFileSync47(mapPath, "utf-8"));
 }
 function matchesPattern(filePath, pattern) {
   const regexStr = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
@@ -28839,12 +29109,12 @@ function extractFrontmatter(content) {
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
   const absPath = ensureWithinRoot(resolve34(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync54(absPath)) {
+  if (!existsSync55(absPath)) {
     const altPath = ensureWithinRoot(resolve34(getResolvedPaths().srcDir, "../server/api/routers", basename9(routerPath)), root);
-    if (!existsSync54(altPath)) return [];
-    return extractProcedureNamesFromContent(readFileSync46(altPath, "utf-8"));
+    if (!existsSync55(altPath)) return [];
+    return extractProcedureNamesFromContent(readFileSync47(altPath, "utf-8"));
   }
-  return extractProcedureNamesFromContent(readFileSync46(absPath, "utf-8"));
+  return extractProcedureNamesFromContent(readFileSync47(absPath, "utf-8"));
 }
 function extractProcedureNamesFromContent(content) {
   const procRegex = /\.(?:query|mutation)\s*\(/g;
@@ -28885,7 +29155,7 @@ function handleDocsAudit(args2) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
     const helpPagePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync54(helpPagePath)) {
+    if (!existsSync55(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -28897,7 +29167,7 @@ function handleDocsAudit(args2) {
       });
       continue;
     }
-    const content = readFileSync46(helpPagePath, "utf-8");
+    const content = readFileSync47(helpPagePath, "utf-8");
     const sections = extractSections(content);
     const frontmatter = extractFrontmatter(content);
     const staleReasons = [];
@@ -28938,8 +29208,8 @@ function handleDocsAudit(args2) {
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
         const guidePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync54(guidePath)) {
-          const guideContent = readFileSync46(guidePath, "utf-8");
+        if (existsSync55(guidePath)) {
+          const guideContent = readFileSync47(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
             results.push({
@@ -28973,13 +29243,13 @@ function handleDocsCoverage(args2) {
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
     const helpPagePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync54(helpPagePath);
+    const exists = existsSync55(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
     let status = null;
     if (exists) {
-      const content = readFileSync46(helpPagePath, "utf-8");
+      const content = readFileSync47(helpPagePath, "utf-8");
       lineCount = content.split("\n").length;
       hasContent = lineCount > 10;
       const frontmatter = extractFrontmatter(content);
@@ -29320,7 +29590,7 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync55 } from "fs";
+import { existsSync as existsSync56 } from "fs";
 import { resolve as resolve35 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
@@ -29558,22 +29828,22 @@ function validateFeatures(db, domainFilter) {
     const missingPages = [];
     for (const comp of components) {
       const absPath = resolve35(PROJECT_ROOT, comp.component_file);
-      if (!existsSync55(absPath)) {
+      if (!existsSync56(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
       const routerPath = resolve35(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync55(routerPath)) {
+      if (!existsSync56(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
       const absPath = resolve35(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync55(absPath)) {
+      if (page.page_route.startsWith("/") && !existsSync56(absPath)) {
         const altPath = resolve35(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync55(altPath)) {
+        if (!existsSync56(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -30099,7 +30369,7 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync47, existsSync as existsSync56, readdirSync as readdirSync26, statSync as statSync19 } from "fs";
+import { readFileSync as readFileSync48, existsSync as existsSync57, readdirSync as readdirSync26, statSync as statSync19 } from "fs";
 import { resolve as resolve36, join as join34, basename as basename10, dirname as dirname25, relative as relative13 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
@@ -30232,7 +30502,7 @@ function scanComponentExports(dataDb) {
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
   const basePath = resolve36(projectRoot, componentsBase);
-  if (existsSync56(basePath)) {
+  if (existsSync57(basePath)) {
     try {
       const entries = readdirSync26(basePath, { withFileTypes: true });
       for (const entry of entries) {
@@ -30245,11 +30515,11 @@ function scanComponentExports(dataDb) {
   }
   for (const dir of componentDirs) {
     const absDir = resolve36(projectRoot, dir);
-    if (!existsSync56(absDir)) continue;
+    if (!existsSync57(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative13(projectRoot, file);
-      const source = readFileSync47(file, "utf-8");
+      const source = readFileSync48(file, "utf-8");
       const annotations = parseFeatureAnnotations(source);
       if (annotations.length > 0) {
         for (const ann of annotations) {
@@ -31010,7 +31280,7 @@ var init_prompt_analyzer = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync57, readFileSync as readFileSync48 } from "fs";
+import { existsSync as existsSync58, readFileSync as readFileSync49 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -31041,7 +31311,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync57(absPath)) {
+  if (!existsSync58(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -31050,7 +31320,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  const source = readFileSync48(absPath, "utf-8");
+  const source = readFileSync49(absPath, "utf-8");
   const lines = source.split("\n");
   if (activeChecks.rule_compliance !== false) {
     for (const ruleSet of config.rules) {
@@ -31509,7 +31779,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync58, readFileSync as readFileSync49 } from "fs";
+import { existsSync as existsSync59, readFileSync as readFileSync50 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -31533,12 +31803,12 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync58(absPath)) {
+  if (!existsSync59(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
   try {
-    source = readFileSync49(absPath, "utf-8");
+    source = readFileSync50(absPath, "utf-8");
   } catch {
     return { riskScore: 0, findings: [] };
   }
@@ -31828,7 +32098,7 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync59, readFileSync as readFileSync50 } from "fs";
+import { existsSync as existsSync60, readFileSync as readFileSync51 } from "fs";
 import { resolve as resolve37 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -31862,9 +32132,9 @@ function calculateDepRisk(factors) {
 }
 function getInstalledPackages(projectRoot) {
   const pkgPath = resolve37(projectRoot, "package.json");
-  if (!existsSync59(pkgPath)) return /* @__PURE__ */ new Map();
+  if (!existsSync60(pkgPath)) return /* @__PURE__ */ new Map();
   try {
-    const pkg = JSON.parse(readFileSync50(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync51(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
     for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
       packages.set(name, version);
@@ -32470,7 +32740,7 @@ var init_regression_detector = __esm({
 
 // src/knowledge-indexer.ts
 import { createHash as createHash14 } from "crypto";
-import { readFileSync as readFileSync51, readdirSync as readdirSync27, statSync as statSync20, existsSync as existsSync60 } from "fs";
+import { readFileSync as readFileSync52, readdirSync as readdirSync27, statSync as statSync20, existsSync as existsSync61 } from "fs";
 import { resolve as resolve38, relative as relative14, basename as basename11, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
@@ -32778,11 +33048,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync60(paths.plansDir)) {
+  if (existsSync61(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync60(paths.docsDir)) {
+  if (existsSync61(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -32825,8 +33095,8 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync60(filePath)) continue;
-      const content = readFileSync51(filePath, "utf-8");
+      if (!existsSync61(filePath)) continue;
+      const content = readFileSync52(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative14(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative14(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative14(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative14(paths.memoryDir, filePath)}` : basename11(filePath);
       const category = categorizeFile(filePath);
@@ -32961,10 +33231,10 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync60(paths.plansDir)) {
+  if (existsSync61(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync60(paths.docsDir)) {
+  if (existsSync61(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -32993,7 +33263,7 @@ var init_knowledge_indexer = __esm({
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync52, writeFileSync as writeFileSync14, appendFileSync as appendFileSync4, readdirSync as readdirSync28 } from "fs";
+import { readFileSync as readFileSync53, writeFileSync as writeFileSync14, appendFileSync as appendFileSync4, readdirSync as readdirSync28 } from "fs";
 import { resolve as resolve39, basename as basename12 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -33746,7 +34016,7 @@ function handleCorrect(db, args2) {
   });
   let existing = "";
   try {
-    existing = readFileSync52(correctionsPath, "utf-8");
+    existing = readFileSync53(correctionsPath, "utf-8");
   } catch {
   }
   const archiveIdx = existing.indexOf("## Archived");
@@ -34702,7 +34972,7 @@ var init_framework_supports = __esm({
 });
 
 // src/tools.ts
-import { readFileSync as readFileSync53, existsSync as existsSync62 } from "fs";
+import { readFileSync as readFileSync54, existsSync as existsSync63 } from "fs";
 import { resolve as resolve40, basename as basename13 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
@@ -35122,8 +35392,8 @@ function handleContext(file, dataDb, codegraphDb) {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
           const absFilePath = ensureWithinRoot(resolve40(resolvedPaths.srcDir, "..", file), root);
-          if (existsSync62(absFilePath)) {
-            const fileContent = readFileSync53(absFilePath, "utf-8").slice(0, 3e3);
+          if (existsSync63(absFilePath)) {
+            const fileContent = readFileSync54(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
             if (fileContent.includes("BigInt") || fileContent.includes("Decimal")) keywords.push("BigInt", "serialization");
@@ -35561,10 +35831,10 @@ function handleSchema(args2) {
     lines.push("");
     const projectRoot = getProjectRoot();
     const absPath = ensureWithinRoot(resolve40(projectRoot, file), projectRoot);
-    if (!existsSync62(absPath)) {
+    if (!existsSync63(absPath)) {
       return text17(`File not found: ${file}`);
     }
-    const source = readFileSync53(absPath, "utf-8");
+    const source = readFileSync54(absPath, "utf-8");
     const config = getConfig();
     const dbPattern = config.dbAccessPattern ?? "ctx.db.{table}";
     const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
@@ -35967,9 +36237,36 @@ var init_server_dispatch = __esm({
   }
 });
 
+// src/startup-health.ts
+function assertMemoryEngineHealthy(open) {
+  let db;
+  try {
+    db = open();
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    throw new FatalStartupError(
+      `the memory database engine could not be opened: ${msg}
+This usually means the native SQLite binding was built for a different Node.js ABI (e.g. after a Node major upgrade). Remedy: rebuild the native binding for this Node version \u2014 'npm rebuild better-sqlite3' inside the @massu/core install, or reinstall @massu/core. Refusing to start in a "connected but broken" state where every database tool would fail silently.`
+    );
+  }
+  db.close();
+}
+var FatalStartupError;
+var init_startup_health = __esm({
+  "src/startup-health.ts"() {
+    "use strict";
+    FatalStartupError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "FatalStartupError";
+      }
+    };
+  }
+});
+
 // src/server.ts
 var server_exports = {};
-import { readFileSync as readFileSync54 } from "fs";
+import { readFileSync as readFileSync55 } from "fs";
 import { resolve as resolve41, dirname as dirname26 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function pruneMemoryOnStartup() {
@@ -36012,16 +36309,27 @@ var init_server = __esm({
     init_consolidation_config();
     init_license();
     init_server_dispatch();
+    init_startup_health();
     __dirname5 = dirname26(fileURLToPath6(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync54(resolve41(__dirname5, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync55(resolve41(__dirname5, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
       }
     })();
     dispatcher = createDispatcher({ serverInfoVersion: PKG_VERSION });
+    try {
+      assertMemoryEngineHealthy(getMemoryDb);
+    } catch (error) {
+      if (error instanceof FatalStartupError) {
+        process.stderr.write(`massu: FATAL \u2014 ${error.message}
+`);
+        process.exit(1);
+      }
+      throw error;
+    }
     pruneMemoryOnStartup();
     getCurrentTier().then((tier) => {
       process.stderr.write(`massu: License tier: ${tier}
@@ -36301,7 +36609,7 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync63, readFileSync as readFileSync55, writeFileSync as writeFileSync15, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
+import { existsSync as existsSync64, readFileSync as readFileSync56, writeFileSync as writeFileSync15, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
 import { resolve as resolve42 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
@@ -36313,7 +36621,7 @@ async function runConfigUpgrade(opts = {}) {
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
   if (opts.rollback) {
-    if (!existsSync63(bakPath)) {
+    if (!existsSync64(bakPath)) {
       const message = `No backup found at ${bakPath}`;
       err(message + "\n");
       return { exitCode: 1, action: "none", message };
@@ -36329,14 +36637,14 @@ async function runConfigUpgrade(opts = {}) {
       return { exitCode: 2, action: "none", message };
     }
   }
-  if (!existsSync63(configPath)) {
+  if (!existsSync64(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return { exitCode: 1, action: "none", message };
   }
   let existing;
   try {
-    const content = readFileSync55(configPath, "utf-8");
+    const content = readFileSync56(configPath, "utf-8");
     const parsed = parseYaml6(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -36359,7 +36667,7 @@ async function runConfigUpgrade(opts = {}) {
     fingerprint: computeFingerprint(detection)
   };
   try {
-    const original = readFileSync55(configPath, "utf-8");
+    const original = readFileSync56(configPath, "utf-8");
     writeFileSync15(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
@@ -36393,7 +36701,7 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync64, readFileSync as readFileSync56 } from "fs";
+import { existsSync as existsSync65, readFileSync as readFileSync57 } from "fs";
 import { resolve as resolve43 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
@@ -36407,7 +36715,7 @@ async function runConfigCheckDrift(opts = {}) {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
-  if (!existsSync64(configPath)) {
+  if (!existsSync65(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err(message + "\n");
     return {
@@ -36421,7 +36729,7 @@ async function runConfigCheckDrift(opts = {}) {
   }
   let config;
   try {
-    const content = readFileSync56(configPath, "utf-8");
+    const content = readFileSync57(configPath, "utf-8");
     const parsed = parseYaml7(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -36488,7 +36796,7 @@ var init_config_check_drift = __esm({
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync57 } from "fs";
+import { readFileSync as readFileSync58 } from "fs";
 import { resolve as resolve44, dirname as dirname27 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 var __filename5 = fileURLToPath7(import.meta.url);
@@ -36770,7 +37078,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync57(resolve44(__dirname6, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync58(resolve44(__dirname6, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");