@massu/core 1.5.3 → 1.5.5

package/dist/cli.js

@@ -1673,16 +1673,16 @@ import { parse as parseYaml2 } from "yaml";
 function ingestMemoryFile(db, sessionId, filePath) {
   if (!existsSync3(filePath)) return "skipped";
   const content = readFileSync2(filePath, "utf-8");
-  const basename10 = (filePath.split("/").pop() ?? "").replace(".md", "");
+  const basename11 = (filePath.split("/").pop() ?? "").replace(".md", "");
   const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
-  let name2 = basename10;
+  let name2 = basename11;
   let description = "";
   let type = "discovery";
   let confidence;
   if (frontmatterMatch) {
     try {
       const fm = parseYaml2(frontmatterMatch[1]);
-      name2 = fm.name ?? basename10;
+      name2 = fm.name ?? basename11;
       description = fm.description ?? "";
       type = fm.type ?? "discovery";
       confidence = fm.confidence != null ? Number(fm.confidence) : void 0;
@@ -7374,8 +7374,8 @@ var require_pattern = __commonJS({
     }
     exports.endsWithSlashGlobStar = endsWithSlashGlobStar;
     function isAffectDepthOfReadingPattern(pattern) {
-      const basename10 = path.basename(pattern);
-      return endsWithSlashGlobStar(pattern) || isStaticPattern(basename10);
+      const basename11 = path.basename(pattern);
+      return endsWithSlashGlobStar(pattern) || isStaticPattern(basename11);
     }
     exports.isAffectDepthOfReadingPattern = isAffectDepthOfReadingPattern;
     function expandPatternsWithBraceExpansion(patterns) {
@@ -7420,15 +7420,15 @@ var require_pattern = __commonJS({
     exports.removeDuplicateSlashes = removeDuplicateSlashes;
     function partitionAbsoluteAndRelative(patterns) {
       const absolute = [];
-      const relative12 = [];
+      const relative13 = [];
       for (const pattern of patterns) {
         if (isAbsolute3(pattern)) {
           absolute.push(pattern);
         } else {
-          relative12.push(pattern);
+          relative13.push(pattern);
         }
       }
-      return [absolute, relative12];
+      return [absolute, relative13];
     }
     exports.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
     function isAbsolute3(pattern) {
@@ -7849,11 +7849,11 @@ var require_out = __commonJS({
       async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports.stat = stat;
-    function statSync13(path, optionsOrSettings) {
+    function statSync15(path, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path, settings);
     }
-    exports.statSync = statSync13;
+    exports.statSync = statSync15;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -10623,15 +10623,204 @@ var init_regex_fallback = __esm({
 });
 
 // src/detect/adapters/parse-guard.ts
-var MAX_AST_FILE_BYTES;
+function isParsableSource(source, sizeBytes) {
+  const bytes = sizeBytes ?? Buffer.byteLength(source, "utf-8");
+  if (bytes > MAX_AST_FILE_BYTES) {
+    return {
+      reason: "size-cap",
+      detail: `${bytes} bytes > ${MAX_AST_FILE_BYTES} cap`
+    };
+  }
+  let depth = 0;
+  let maxDepth = 0;
+  for (let i2 = 0; i2 < source.length; i2++) {
+    const c2 = source.charCodeAt(i2);
+    if (c2 === 0) {
+      return { reason: "control-bytes", detail: "NUL byte at offset " + i2 };
+    }
+    if (c2 === 40 || c2 === 91 || c2 === 123) {
+      depth++;
+      if (depth > maxDepth) maxDepth = depth;
+      if (depth > MAX_AST_PARSE_DEPTH) {
+        return {
+          reason: "depth-cap",
+          detail: `nesting depth exceeded ${MAX_AST_PARSE_DEPTH}`
+        };
+      }
+    } else if (c2 === 41 || c2 === 93 || c2 === 125) {
+      depth = depth > 0 ? depth - 1 : 0;
+    }
+  }
+  return null;
+}
+var MAX_AST_FILE_BYTES, MAX_AST_PARSE_DEPTH;
 var init_parse_guard = __esm({
   "src/detect/adapters/parse-guard.ts"() {
     "use strict";
     MAX_AST_FILE_BYTES = 1 * 1024 * 1024;
+    MAX_AST_PARSE_DEPTH = 5e3;
   }
 });
 
 // src/detect/adapters/runner.ts
+import { basename as basename3, relative as relative4 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync7, readFileSync as readFileSync7, statSync as statSync5 } from "fs";
+import { join as join7 } from "path";
+async function runAdapters(adapters, rootDir, signals, options = {}) {
+  const out2 = {
+    byAdapter: {},
+    skipped: [],
+    errored: []
+  };
+  for (const adapter of adapters) {
+    if (out2.byAdapter[adapter.id] || out2.skipped.includes(adapter.id)) {
+      continue;
+    }
+    let matches;
+    try {
+      matches = adapter.matches(signals);
+    } catch (e2) {
+      out2.errored.push({
+        adapterId: adapter.id,
+        error: `matches() threw: ${e2 instanceof Error ? e2.message : String(e2)}`
+      });
+      continue;
+    }
+    if (!matches) {
+      out2.skipped.push(adapter.id);
+      continue;
+    }
+    let files;
+    try {
+      files = options.sampleFiles ? await options.sampleFiles(adapter, rootDir) : [];
+    } catch (e2) {
+      out2.errored.push({
+        adapterId: adapter.id,
+        error: `sampleFiles threw: ${e2 instanceof Error ? e2.message : String(e2)}`
+      });
+      continue;
+    }
+    const safeFiles = [];
+    for (const f2 of files) {
+      const skip = isParsableSource(f2.content, f2.size);
+      if (skip) {
+        process.stderr.write(
+          `[massu/ast] WARN: skipping ${f2.path} for adapter ${adapter.id}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES} bytes. (Phase 3.5 mitigation)
+`
+        );
+        continue;
+      }
+      safeFiles.push(f2);
+    }
+    files = safeFiles;
+    let result;
+    try {
+      result = await adapter.introspect(files, rootDir);
+    } catch (e2) {
+      out2.errored.push({
+        adapterId: adapter.id,
+        error: `introspect() threw: ${e2 instanceof Error ? e2.message : String(e2)}`
+      });
+      continue;
+    }
+    if (result.confidence === "none") {
+      out2.byAdapter[adapter.id] = {
+        conventions: {},
+        _provenance: {},
+        confidence: "none"
+      };
+      continue;
+    }
+    const conventions = {};
+    const provenanceMap = {};
+    for (const [field, value] of Object.entries(result.conventions)) {
+      if (value === null || value === void 0) continue;
+      if (field in conventions) continue;
+      conventions[field] = value;
+    }
+    for (const p19 of result.provenance) {
+      if (p19.field in provenanceMap) continue;
+      provenanceMap[p19.field] = formatProvenance(p19, rootDir);
+    }
+    const resolved = {
+      conventions,
+      _provenance: provenanceMap,
+      confidence: result.confidence
+    };
+    out2.byAdapter[adapter.id] = resolved;
+  }
+  return out2;
+}
+function formatProvenance(p19, rootDir) {
+  const rel = p19.sourceFile.startsWith(rootDir + "/") ? relative4(rootDir, p19.sourceFile) : basename3(p19.sourceFile);
+  return `${rel}:${p19.line} :: ${p19.query}`;
+}
+function buildDetectionSignals(rootDir) {
+  const presentDirs = /* @__PURE__ */ new Set();
+  const presentFiles = /* @__PURE__ */ new Set();
+  try {
+    for (const entry of readdirSync7(rootDir)) {
+      if (entry.startsWith(".")) continue;
+      try {
+        const st = statSync5(join7(rootDir, entry));
+        if (st.isDirectory()) presentDirs.add(entry);
+        else if (st.isFile()) presentFiles.add(entry);
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return {
+    packageJson: tryReadJson(join7(rootDir, "package.json")),
+    pyprojectToml: tryReadToml(join7(rootDir, "pyproject.toml")),
+    gemfile: tryReadString(join7(rootDir, "Gemfile")),
+    cargoToml: tryReadToml(join7(rootDir, "Cargo.toml")),
+    goMod: tryReadString(join7(rootDir, "go.mod")),
+    mixExs: tryReadString(join7(rootDir, "mix.exs")),
+    csproj: tryReadFirstCsproj(rootDir, presentFiles),
+    pomXml: tryReadString(join7(rootDir, "pom.xml")),
+    gradleBuild: tryReadGradleBuild(rootDir, presentFiles),
+    presentDirs,
+    presentFiles
+  };
+}
+function tryReadFirstCsproj(rootDir, presentFiles) {
+  const csprojNames = [...presentFiles].filter((f2) => f2.endsWith(".csproj")).sort();
+  if (csprojNames.length === 0) return void 0;
+  return tryReadString(join7(rootDir, csprojNames[0]));
+}
+function tryReadGradleBuild(rootDir, presentFiles) {
+  if (presentFiles.has("build.gradle.kts")) {
+    return tryReadString(join7(rootDir, "build.gradle.kts"));
+  }
+  if (presentFiles.has("build.gradle")) {
+    return tryReadString(join7(rootDir, "build.gradle"));
+  }
+  return void 0;
+}
+function tryReadString(path) {
+  if (!existsSync9(path)) return void 0;
+  try {
+    return readFileSync7(path, "utf-8");
+  } catch {
+    return void 0;
+  }
+}
+function tryReadJson(path) {
+  const txt = tryReadString(path);
+  if (!txt) return void 0;
+  try {
+    const parsed = JSON.parse(txt);
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function tryReadToml(path) {
+  const txt = tryReadString(path);
+  if (!txt) return void 0;
+  return { __raw: txt };
+}
 var init_runner = __esm({
   "src/detect/adapters/runner.ts"() {
     "use strict";
@@ -14588,22 +14777,408 @@ ${JSON.stringify(symbolNames, null, 2)}`);
 });
 
 // src/detect/adapters/query-helpers.ts
+function compileQuery(language, source, queryName) {
+  let perLang = queryCache.get(language);
+  if (!perLang) {
+    perLang = /* @__PURE__ */ new Map();
+    queryCache.set(language, perLang);
+  }
+  const cached = perLang.get(source);
+  if (cached) return cached;
+  let q2;
+  try {
+    q2 = new Query(language, source);
+  } catch (e2) {
+    throw new InvalidQueryError(queryName, source, e2);
+  }
+  perLang.set(source, q2);
+  return q2;
+}
+function runQuery(parser, source, queryText, queryName, filePath) {
+  const language = parser.language;
+  if (!language) {
+    throw new InvalidQueryError(
+      queryName,
+      queryText,
+      new Error("Parser has no language assigned")
+    );
+  }
+  const query = compileQuery(language, queryText, queryName);
+  const tree = parser.parse(source);
+  if (!tree) return [];
+  let matches;
+  try {
+    matches = query.matches(tree.rootNode);
+  } catch (e2) {
+    throw new InvalidQueryError(queryName, queryText, e2);
+  }
+  const out2 = [];
+  for (const match of matches) {
+    if (!match.captures || match.captures.length === 0) continue;
+    const captures = {};
+    let earliestLine = Number.POSITIVE_INFINITY;
+    for (const cap of match.captures) {
+      const node = cap.node;
+      captures[cap.name] = node.text;
+      if (node.startPosition.row + 1 < earliestLine) {
+        earliestLine = node.startPosition.row + 1;
+      }
+    }
+    out2.push({
+      captures,
+      file: filePath,
+      line: Number.isFinite(earliestLine) ? earliestLine : 1,
+      queryName
+    });
+  }
+  try {
+    tree.delete();
+  } catch {
+  }
+  return out2;
+}
+var InvalidQueryError, queryCache;
 var init_query_helpers = __esm({
   "src/detect/adapters/query-helpers.ts"() {
     "use strict";
     init_tree_sitter();
+    InvalidQueryError = class extends Error {
+      queryName;
+      querySource;
+      cause;
+      constructor(queryName, querySource, cause) {
+        const causeMsg = cause instanceof Error ? cause.message : String(cause);
+        super(
+          `[query-helpers] Invalid Tree-sitter query "${queryName}": ${causeMsg}
+Query source:
+${querySource}`
+        );
+        this.name = "InvalidQueryError";
+        this.queryName = queryName;
+        this.querySource = querySource;
+        this.cause = cause;
+      }
+    };
+    queryCache = /* @__PURE__ */ new WeakMap();
   }
 });
 
 // src/detect/adapters/tree-sitter-loader.ts
+import { createHash as createHash2 } from "crypto";
+import {
+  mkdirSync as mkdirSync3,
+  readdirSync as readdirSync8,
+  readFileSync as readFileSync8,
+  writeFileSync,
+  renameSync as renameSync2,
+  unlinkSync,
+  lstatSync as lstatSync3,
+  chmodSync,
+  utimesSync
+} from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join8 } from "path";
+function getCacheDir() {
+  return process.env.MASSU_WASM_CACHE_DIR ?? join8(homedir2(), ".massu", "wasm-cache");
+}
+function getCachedPath(language, sha) {
+  return join8(getCacheDir(), `${language}-${sha}.wasm`);
+}
+function getCacheRetainCount() {
+  const env = process.env.MASSU_WASM_CACHE_RETAIN;
+  if (env) {
+    const n = Number(env);
+    if (Number.isFinite(n) && n >= 1 && n <= 1024) return Math.floor(n);
+  }
+  return DEFAULT_CACHE_RETAIN_COUNT;
+}
+function touchCacheFile(path) {
+  try {
+    const now = /* @__PURE__ */ new Date();
+    utimesSync(path, now, now);
+  } catch {
+  }
+}
+function evictBeyondRetainCount(retain = getCacheRetainCount()) {
+  const dir = getCacheDir();
+  let entries;
+  try {
+    entries = readdirSync8(dir);
+  } catch {
+    return;
+  }
+  const candidates = [];
+  for (const name2 of entries) {
+    if (!name2.endsWith(".wasm")) continue;
+    const path = join8(dir, name2);
+    let stat;
+    try {
+      stat = lstatSync3(path);
+    } catch {
+      continue;
+    }
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      console.error(
+        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).`
+      );
+      continue;
+    }
+    candidates.push({ path, mtimeMs: stat.mtimeMs });
+  }
+  if (candidates.length <= retain) return;
+  candidates.sort((a2, b2) => b2.mtimeMs - a2.mtimeMs);
+  for (const victim of candidates.slice(retain)) {
+    try {
+      unlinkSync(victim.path);
+    } catch {
+    }
+  }
+}
+function sha256(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+async function ensureParserInitialized() {
+  if (parserInitPromise) return parserInitPromise;
+  parserInitPromise = Parser.init();
+  return parserInitPromise;
+}
+async function loadGrammar(language, options = {}) {
+  await ensureParserInitialized();
+  const cached = loadedGrammars.get(language);
+  if (cached) return cached;
+  const manifest = options.manifestOverride?.[language] ?? GRAMMAR_MANIFEST[language];
+  if (!manifest) {
+    throw new GrammarUnavailableError(
+      language,
+      new Error(`No manifest entry for language "${language}". v1 supports: ${Object.keys(GRAMMAR_MANIFEST).join(", ")}.`)
+    );
+  }
+  const cachePath = getCachedPath(language, manifest.sha256);
+  let cacheLstat;
+  try {
+    cacheLstat = lstatSync3(cachePath);
+  } catch {
+    cacheLstat = null;
+  }
+  if (cacheLstat) {
+    if (cacheLstat.isSymbolicLink() || !cacheLstat.isFile()) {
+      throw new GrammarCacheSymlinkError(cachePath);
+    }
+    let bytes;
+    try {
+      bytes = readFileSync8(cachePath);
+    } catch (e2) {
+      bytes = new Uint8Array(0);
+    }
+    if (bytes.byteLength > 0) {
+      const actualSha = sha256(bytes);
+      if (actualSha !== manifest.sha256) {
+        throw new GrammarSHAMismatchError(language, manifest.sha256, actualSha);
+      }
+      const lang2 = await Language.load(bytes);
+      loadedGrammars.set(language, lang2);
+      touchCacheFile(cachePath);
+      return lang2;
+    }
+  }
+  if (!/^https:\/\//i.test(manifest.url)) {
+    throw new GrammarUrlNotHttpsError(manifest.url);
+  }
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (!fetchImpl) {
+    throw new GrammarUnavailableError(
+      language,
+      new Error("No fetch implementation available (Node < 18?)")
+    );
+  }
+  let body2;
+  try {
+    const res = await fetchImpl(manifest.url);
+    if (!res.ok) {
+      throw new Error(`HTTP ${res.status ?? "unknown"} from ${manifest.url}`);
+    }
+    body2 = new Uint8Array(await res.arrayBuffer());
+  } catch (e2) {
+    throw new GrammarUnavailableError(language, e2);
+  }
+  const downloadedSha = sha256(body2);
+  if (downloadedSha !== manifest.sha256) {
+    throw new GrammarSHAMismatchError(language, manifest.sha256, downloadedSha);
+  }
+  try {
+    mkdirSync3(dirname4(cachePath), { recursive: true, mode: 448 });
+    try {
+      chmodSync(dirname4(cachePath), 448);
+    } catch {
+    }
+    const tmpPath = `${cachePath}.tmp.${process.pid}`;
+    writeFileSync(tmpPath, body2, { mode: 384 });
+    try {
+      chmodSync(tmpPath, 384);
+    } catch {
+    }
+    try {
+      renameSync2(tmpPath, cachePath);
+      try {
+        chmodSync(cachePath, 384);
+      } catch {
+      }
+    } catch (e2) {
+      try {
+        unlinkSync(tmpPath);
+      } catch {
+      }
+      throw e2;
+    }
+    evictBeyondRetainCount();
+  } catch (e2) {
+    console.error(
+      `[tree-sitter-loader] cache write failed for ${language}: ${e2 instanceof Error ? e2.message : String(e2)} \u2014 loading directly from memory.`
+    );
+  }
+  const lang = await Language.load(body2);
+  loadedGrammars.set(language, lang);
+  return lang;
+}
+var GrammarSHAMismatchError, GrammarUnavailableError, GrammarCacheSymlinkError, GrammarUrlNotHttpsError, GRAMMAR_MANIFEST, DEFAULT_CACHE_RETAIN_COUNT, parserInitPromise, loadedGrammars;
 var init_tree_sitter_loader = __esm({
   "src/detect/adapters/tree-sitter-loader.ts"() {
     "use strict";
     init_tree_sitter();
+    GrammarSHAMismatchError = class extends Error {
+      language;
+      expected;
+      actual;
+      constructor(language, expected, actual) {
+        super(
+          `[tree-sitter-loader] SHA-256 mismatch for grammar "${language}". Expected ${expected}, got ${actual}. REFUSING to load \u2014 see Phase 3.5 audit attack vector #3.`
+        );
+        this.name = "GrammarSHAMismatchError";
+        this.language = language;
+        this.expected = expected;
+        this.actual = actual;
+      }
+    };
+    GrammarUnavailableError = class extends Error {
+      language;
+      cause;
+      constructor(language, cause) {
+        const causeMsg = cause instanceof Error ? cause.message : cause ? String(cause) : "no cached grammar and download failed";
+        super(
+          `[tree-sitter-loader] Grammar for "${language}" is unavailable: ${causeMsg}. Falling back to regex introspection for files in ${language}.`
+        );
+        this.name = "GrammarUnavailableError";
+        this.language = language;
+        this.cause = cause;
+      }
+    };
+    GrammarCacheSymlinkError = class extends Error {
+      cachePath;
+      constructor(cachePath) {
+        super(
+          `[tree-sitter-loader] Refusing to load grammar \u2014 cache path "${cachePath}" is a symlink or non-regular file. (Phase 3.5 finding #3 \u2014 symlink attack vector.)`
+        );
+        this.name = "GrammarCacheSymlinkError";
+        this.cachePath = cachePath;
+      }
+    };
+    GrammarUrlNotHttpsError = class extends Error {
+      url;
+      constructor(url) {
+        super(
+          `[tree-sitter-loader] Refusing to download grammar from non-HTTPS URL: ${url}. Only https:// URLs are accepted. (Phase 3.5 finding #3.)`
+        );
+        this.name = "GrammarUrlNotHttpsError";
+        this.url = url;
+      }
+    };
+    GRAMMAR_MANIFEST = {
+      python: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-python.wasm",
+        sha256: "9056d0fb0c337810d019fae350e8167786119da98f0f282aceae7ab89ee8253b",
+        version: "0.1.13"
+      },
+      typescript: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-typescript.wasm",
+        sha256: "8515404dceed38e1ed86aa34b09fcf3379fff1b4ff9dd3967bcd6d1eb5ac3d8f",
+        version: "0.1.13"
+      },
+      javascript: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-javascript.wasm",
+        sha256: "63812b9e275d26851264734868d27a1656bd44a2ef6eb3e85e6b03728c595ab5",
+        version: "0.1.13"
+      },
+      swift: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-swift.wasm",
+        sha256: "41c4fdb2249a3aa6d87eed0d383081ff09725c2248b4977043a43825980ffcc7",
+        version: "0.1.13"
+      },
+      // ----------------------------------------------------------------
+      // Plan 3c Phase 7 expansion (2026-05-07):
+      //
+      // Six additional grammars to support the registry-verified framework
+      // adapters (go-chi, rails, aspnet, spring, ktor, phoenix) plus the
+      // bundled adapters in the same language families (gin/echo/fiber,
+      // sinatra, etc.). All entries use the SAME pinned tree-sitter-wasms
+      // version (0.1.13) as the v1 four to keep the dependency surface
+      // single-source.
+      //
+      // SHA-256s computed 2026-05-07 via:
+      //   curl -fsSL <url> | shasum -a 256
+      //
+      // The unpkg filename for C# uses an underscore (`c_sharp`) while the
+      // TreeSitterLanguage identifier uses no separator (`csharp`); the map
+      // key is the type identifier, the URL is the storage path — they do
+      // NOT need to match, the same as how `python` maps to `tree-sitter-
+      // python.wasm`. This is intentional and validated by the manifest
+      // shape test in tree-sitter-loader-manifest.test.ts.
+      // ----------------------------------------------------------------
+      go: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-go.wasm",
+        sha256: "9963ca89b616eaf04b08a43bc1fb0f07b85395bec313330851f1f1ead2f755b6",
+        version: "0.1.13"
+      },
+      ruby: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-ruby.wasm",
+        sha256: "93a5022855314cdb45458c7bb026a24a0ebc3a5ff6439e542e881f14dfa13a39",
+        version: "0.1.13"
+      },
+      csharp: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-c_sharp.wasm",
+        sha256: "6266a7e32d68a3459104d994dc848df15d5672b0ea8e86d327274b694f8e6991",
+        version: "0.1.13"
+      },
+      java: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-java.wasm",
+        sha256: "637aac4415fb39a211a4f4292d63c66b5ce9c32fa2cd35464af4f681d91b9a1f",
+        version: "0.1.13"
+      },
+      kotlin: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-kotlin.wasm",
+        sha256: "b5cb00c8d06ed0f10f1dbe497205b437809d7e87db1f638721a8cfb30e044449",
+        version: "0.1.13"
+      },
+      elixir: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-elixir.wasm",
+        sha256: "82e91b9759ddca30d8978ebbfa8e347b4451b64c931f9ae62112e6db9b8fac20",
+        version: "0.1.13"
+      }
+    };
+    DEFAULT_CACHE_RETAIN_COUNT = 16;
+    parserInitPromise = null;
+    loadedGrammars = /* @__PURE__ */ new Map();
   }
 });
 
 // src/detect/adapters/python-fastapi.ts
+function extractPrefixBase2(prefix3) {
+  if (!prefix3.startsWith("/")) return null;
+  const stripped = prefix3.replace(/^\/+/, "");
+  const firstSeg = stripped.split("/")[0];
+  if (!firstSeg) return null;
+  return "/" + firstSeg;
+}
+var AUTH_DEP_QUERY, API_PREFIX_QUERY, PYTEST_ASYNCIO_QUERY, pythonFastApiAdapter;
 var init_python_fastapi = __esm({
   "src/detect/adapters/python-fastapi.ts"() {
     "use strict";
@@ -14611,43 +15186,1621 @@ var init_python_fastapi = __esm({
     init_query_helpers();
     init_tree_sitter_loader();
     init_parse_guard();
+    AUTH_DEP_QUERY = `
+(call
+  function: (identifier) @_callee (#eq? @_callee "Depends")
+  arguments: (argument_list
+    (identifier) @auth_dep))
+`;
+    API_PREFIX_QUERY = `
+(call
+  function: (identifier) @_callee (#eq? @_callee "APIRouter")
+  arguments: (argument_list
+    (keyword_argument
+      name: (identifier) @_kw (#eq? @_kw "prefix")
+      value: (string) @prefix_value)))
+`;
+    PYTEST_ASYNCIO_QUERY = `
+(decorator
+  (attribute
+    object: (attribute
+      object: (identifier) @_pkg (#eq? @_pkg "pytest")
+      attribute: (identifier) @_mark (#eq? @_mark "mark"))
+    attribute: (identifier) @_marker (#eq? @_marker "asyncio"))) @decorator
+`;
+    pythonFastApiAdapter = {
+      id: "python-fastapi",
+      languages: ["python"],
+      matches(signals) {
+        const pyToml = signals.pyprojectToml;
+        if (pyToml?.__raw && /\bfastapi\b/i.test(pyToml.__raw)) return true;
+        if (signals.presentDirs.has("routers")) return true;
+        if (signals.presentDirs.has("app") && signals.presentFiles.has("main.py")) return true;
+        return false;
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("python");
+        } catch (e2) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const authDeps = /* @__PURE__ */ new Map();
+        const prefixBases = /* @__PURE__ */ new Map();
+        const testAsyncPatterns = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: python-fastapi skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, AUTH_DEP_QUERY, "fastapi-auth-dep", file.path)) {
+                const name2 = hit.captures.auth_dep;
+                if (name2 && !authDeps.has(name2)) {
+                  authDeps.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, API_PREFIX_QUERY, "fastapi-api-prefix", file.path)) {
+                const raw = hit.captures.prefix_value;
+                if (!raw) continue;
+                const literal = raw.replace(/^['"]/, "").replace(/['"]$/, "");
+                const base = extractPrefixBase2(literal);
+                if (base && !prefixBases.has(base)) {
+                  prefixBases.set(base, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, PYTEST_ASYNCIO_QUERY, "fastapi-pytest-asyncio", file.path)) {
+                const pat = "@pytest.mark.asyncio";
+                if (!testAsyncPatterns.has(pat)) {
+                  testAsyncPatterns.set(pat, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) {
+                throw e2;
+              }
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (authDeps.size === 1) {
+          const [name2, { line, file }] = authDeps.entries().next().value;
+          conventions.auth_dep = name2;
+          provenance.push({ field: "auth_dep", sourceFile: file, line, query: "fastapi-auth-dep" });
+        } else if (authDeps.size >= 2) {
+          const [name2, { line, file }] = authDeps.entries().next().value;
+          conventions.auth_dep = name2;
+          provenance.push({ field: "auth_dep", sourceFile: file, line, query: "fastapi-auth-dep" });
+        }
+        if (prefixBases.size >= 1) {
+          const [base, { line, file }] = prefixBases.entries().next().value;
+          conventions.api_prefix_base = base;
+          provenance.push({ field: "api_prefix_base", sourceFile: file, line, query: "fastapi-api-prefix" });
+        }
+        if (testAsyncPatterns.size >= 1) {
+          const [pat, { line, file }] = testAsyncPatterns.entries().next().value;
+          conventions.test_async_pattern = pat;
+          provenance.push({ field: "test_async_pattern", sourceFile: file, line, query: "fastapi-pytest-asyncio" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (authDeps.size === 1 || authDeps.size === 0 && prefixBases.size > 0) {
+          confidence = "high";
+        } else if (authDeps.size >= 2) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
+  }
+});
+
+// src/detect/adapters/python-django.ts
+var DECORATOR_QUERY, CLASS_BASE_QUERY, URLPATTERNS_QUERY, DJANGO_MIXIN_NAMES, DJANGO_DECORATOR_PATTERNS, pythonDjangoAdapter;
+var init_python_django = __esm({
+  "src/detect/adapters/python-django.ts"() {
+    "use strict";
+    init_tree_sitter();
+    init_query_helpers();
+    init_tree_sitter_loader();
+    init_parse_guard();
+    DECORATOR_QUERY = `
+(decorator
+  (identifier) @decorator_name)
+`;
+    CLASS_BASE_QUERY = `
+(class_definition
+  name: (identifier) @class_name
+  superclasses: (argument_list
+    (identifier) @base_name))
+`;
+    URLPATTERNS_QUERY = `
+(assignment
+  left: (identifier) @_target (#eq? @_target "urlpatterns")
+  right: (list) @urlpatterns_list)
+`;
+    DJANGO_MIXIN_NAMES = /* @__PURE__ */ new Set([
+      "LoginRequiredMixin",
+      "PermissionRequiredMixin",
+      "UserPassesTestMixin",
+      "StaffuserRequiredMixin"
+    ]);
+    DJANGO_DECORATOR_PATTERNS = [
+      /^login_required$/,
+      /^permission_required$/,
+      /_required$/,
+      /^require_/
+    ];
+    pythonDjangoAdapter = {
+      id: "python-django",
+      languages: ["python"],
+      matches(signals) {
+        if (signals.presentFiles.has("manage.py")) return true;
+        const pyToml = signals.pyprojectToml;
+        if (pyToml?.__raw && /\bdjango\b/i.test(pyToml.__raw)) return true;
+        return false;
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("python");
+        } catch {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const decoratorsFound = /* @__PURE__ */ new Map();
+        const mixinsFound = /* @__PURE__ */ new Map();
+        const urlpatternsShape = {
+          value: null,
+          line: 0,
+          file: ""
+        };
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: python-django skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, DECORATOR_QUERY, "django-decorator", file.path)) {
+                const name2 = hit.captures.decorator_name;
+                if (!name2) continue;
+                if (DJANGO_DECORATOR_PATTERNS.some((re2) => re2.test(name2)) && !decoratorsFound.has(name2)) {
+                  decoratorsFound.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, CLASS_BASE_QUERY, "django-mixin", file.path)) {
+                const base = hit.captures.base_name;
+                if (base && DJANGO_MIXIN_NAMES.has(base) && !mixinsFound.has(base)) {
+                  mixinsFound.set(base, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, URLPATTERNS_QUERY, "django-urlpatterns", file.path)) {
+                const listText = hit.captures.urlpatterns_list ?? "";
+                const hasFunctionForm = /\bpath\s*\(/.test(listText) || /\bre_path\s*\(/.test(listText);
+                const hasClassForm = /\.as_view\s*\(/.test(listText);
+                let shape = null;
+                if (hasFunctionForm && hasClassForm) shape = "mixed";
+                else if (hasFunctionForm) shape = "function-views";
+                else if (hasClassForm) shape = "class-views";
+                if (shape && !urlpatternsShape.value) {
+                  urlpatternsShape.value = shape;
+                  urlpatternsShape.line = hit.line;
+                  urlpatternsShape.file = file.path;
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) throw e2;
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (decoratorsFound.size > 0) {
+          const list = Array.from(decoratorsFound.keys());
+          conventions.decorator_usage = list;
+          const [first, { line, file }] = decoratorsFound.entries().next().value;
+          provenance.push({ field: "decorator_usage", sourceFile: file, line, query: "django-decorator" });
+          conventions.auth_dep = first;
+          provenance.push({ field: "auth_dep", sourceFile: file, line, query: "django-decorator" });
+        }
+        if (mixinsFound.size > 0) {
+          const list = Array.from(mixinsFound.keys());
+          conventions.mixin_classes = list;
+          const [, { line, file }] = mixinsFound.entries().next().value;
+          provenance.push({ field: "mixin_classes", sourceFile: file, line, query: "django-mixin" });
+        }
+        if (urlpatternsShape.value) {
+          conventions.urlpatterns_shape = urlpatternsShape.value;
+          provenance.push({
+            field: "urlpatterns_shape",
+            sourceFile: urlpatternsShape.file,
+            line: urlpatternsShape.line,
+            query: "django-urlpatterns"
+          });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (decoratorsFound.size > 0 || mixinsFound.size > 0) {
+          confidence = "high";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
+  }
+});
+
+// src/detect/adapters/nextjs-trpc.ts
+var ROUTER_BUILDER_QUERY, PROCEDURE_QUERY, KNOWN_BUILDERS, nextjsTrpcAdapter;
+var init_nextjs_trpc = __esm({
+  "src/detect/adapters/nextjs-trpc.ts"() {
+    "use strict";
+    init_tree_sitter();
+    init_query_helpers();
+    init_tree_sitter_loader();
+    init_parse_guard();
+    ROUTER_BUILDER_QUERY = `
+(call_expression
+  function: (identifier) @builder_id (#match? @builder_id "^(createTRPCRouter|router)$"))
+
+(call_expression
+  function: (member_expression
+    object: (identifier) @_obj
+    property: (property_identifier) @_prop (#eq? @_prop "router"))) @member_call
+`;
+    PROCEDURE_QUERY = `
+(member_expression
+  object: (identifier) @procedure_id (#match? @procedure_id "Procedure$"))
+
+(call_expression
+  function: (identifier) @procedure_call (#match? @procedure_call "Procedure$"))
+`;
+    KNOWN_BUILDERS = /* @__PURE__ */ new Set(["createTRPCRouter", "router"]);
+    nextjsTrpcAdapter = {
+      id: "nextjs-trpc",
+      languages: ["typescript"],
+      matches(signals) {
+        const pkgJson = signals.packageJson;
+        if (pkgJson) {
+          const deps = pkgJson.dependencies;
+          const devDeps = pkgJson.devDependencies;
+          const all = { ...deps ?? {}, ...devDeps ?? {} };
+          if (Object.keys(all).some((k3) => k3.startsWith("@trpc/"))) return true;
+        }
+        if (signals.presentDirs.has("server")) return true;
+        return false;
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("typescript");
+        } catch {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const builders = /* @__PURE__ */ new Map();
+        const procedures = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: nextjs-trpc skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, ROUTER_BUILDER_QUERY, "trpc-router-builder", file.path)) {
+                const directId = hit.captures.builder_id;
+                const memberCall = hit.captures.member_call;
+                let label = null;
+                if (directId && KNOWN_BUILDERS.has(directId)) {
+                  label = directId;
+                } else if (memberCall) {
+                  const m3 = memberCall.match(/([A-Za-z_$][A-Za-z0-9_$]*)\.router/);
+                  if (m3) label = `${m3[1]}.router`;
+                }
+                if (label && !builders.has(label)) {
+                  builders.set(label, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, PROCEDURE_QUERY, "trpc-procedure", file.path)) {
+                const proc = hit.captures.procedure_id ?? hit.captures.procedure_call;
+                if (proc && !procedures.has(proc)) {
+                  procedures.set(proc, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) throw e2;
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (builders.size > 0) {
+          const [name2, { line, file }] = builders.entries().next().value;
+          conventions.trpc_router_builder = name2;
+          provenance.push({ field: "trpc_router_builder", sourceFile: file, line, query: "trpc-router-builder" });
+        }
+        if (procedures.size > 0) {
+          const [name2, { line, file }] = procedures.entries().next().value;
+          conventions.procedure_pattern = name2;
+          provenance.push({ field: "procedure_pattern", sourceFile: file, line, query: "trpc-procedure" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (builders.size === 1 && procedures.size <= 2) {
+          confidence = "high";
+        } else if (builders.size > 1) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
+  }
+});
+
+// src/detect/adapters/swift-swiftui.ts
+var API_CLASS_QUERY, POLICY_QUERY, NAV_QUERY, POLICY_NAMES, swiftSwiftUiAdapter;
+var init_swift_swiftui = __esm({
+  "src/detect/adapters/swift-swiftui.ts"() {
+    "use strict";
+    init_tree_sitter();
+    init_query_helpers();
+    init_tree_sitter_loader();
+    init_parse_guard();
+    API_CLASS_QUERY = `
+(simple_identifier) @ident
+`;
+    POLICY_QUERY = `
+(navigation_expression
+  suffix: (navigation_suffix
+    (simple_identifier) @policy_name))
+`;
+    NAV_QUERY = `
+(simple_identifier) @nav_ident
+`;
+    POLICY_NAMES = /* @__PURE__ */ new Set([
+      "deviceOwnerAuthentication",
+      "deviceOwnerAuthenticationWithBiometrics"
+    ]);
+    swiftSwiftUiAdapter = {
+      id: "swift-swiftui",
+      languages: ["swift"],
+      matches(signals) {
+        if (signals.presentFiles.has("Package.swift")) return true;
+        for (const dir of signals.presentDirs) {
+          if (dir.endsWith(".xcodeproj") || dir.endsWith(".xcworkspace")) return true;
+          if (dir === "Sources") return true;
+        }
+        for (const file of signals.presentFiles) {
+          if (file.endsWith(".swift")) return true;
+        }
+        return false;
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("swift");
+        } catch {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const apiClasses = /* @__PURE__ */ new Map();
+        const policies = /* @__PURE__ */ new Map();
+        const navs = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: swift-swiftui skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, API_CLASS_QUERY, "swift-api-class", file.path)) {
+                const ident = hit.captures.ident;
+                if (ident && /^[A-Z][A-Za-z0-9_]*API$/.test(ident) && !apiClasses.has(ident)) {
+                  apiClasses.set(ident, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, POLICY_QUERY, "swift-biometric-policy", file.path)) {
+                const name2 = hit.captures.policy_name;
+                if (name2 && POLICY_NAMES.has(name2) && !policies.has(name2)) {
+                  policies.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, NAV_QUERY, "swift-navigation", file.path)) {
+                const ident = hit.captures.nav_ident;
+                if ((ident === "NavigationStack" || ident === "NavigationView") && !navs.has(ident)) {
+                  navs.set(ident, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) throw e2;
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (apiClasses.size > 0) {
+          const [name2, { line, file }] = apiClasses.entries().next().value;
+          conventions.api_client_class = name2;
+          provenance.push({ field: "api_client_class", sourceFile: file, line, query: "swift-api-class" });
+        }
+        if (policies.size > 0) {
+          const [name2, { line, file }] = policies.entries().next().value;
+          conventions.biometric_policy = name2;
+          provenance.push({ field: "biometric_policy", sourceFile: file, line, query: "swift-biometric-policy" });
+        }
+        if (navs.size > 0) {
+          const [name2, { line, file }] = navs.entries().next().value;
+          conventions.navigation_pattern = name2;
+          provenance.push({ field: "navigation_pattern", sourceFile: file, line, query: "swift-navigation" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (apiClasses.size === 1 && policies.size <= 1) {
+          confidence = "high";
+        } else if (apiClasses.size > 1) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
+  }
+});
+
+// src/detect/adapters/python-flask.ts
+function extractPrefixBase3(prefix3) {
+  if (!prefix3.startsWith("/")) return null;
+  const stripped = prefix3.replace(/^\/+/, "");
+  const firstSeg = stripped.split("/")[0];
+  if (!firstSeg) return null;
+  return "/" + firstSeg;
+}
+var AUTH_DECORATOR_QUERY, BLUEPRINT_URL_PREFIX_QUERY, APP_FACTORY_QUERY, pythonFlaskAdapter;
+var init_python_flask = __esm({
+  "src/detect/adapters/python-flask.ts"() {
+    "use strict";
+    init_tree_sitter();
+    init_query_helpers();
+    init_tree_sitter_loader();
+    init_parse_guard();
+    AUTH_DECORATOR_QUERY = `
+(decorator
+  (identifier) @auth_decorator (#match? @auth_decorator "_required$"))
+`;
+    BLUEPRINT_URL_PREFIX_QUERY = `
+(call
+  function: (identifier) @_callee (#eq? @_callee "Blueprint")
+  arguments: (argument_list
+    (keyword_argument
+      name: (identifier) @_kw (#eq? @_kw "url_prefix")
+      value: (string) @url_prefix)))
+`;
+    APP_FACTORY_QUERY = `
+(function_definition
+  name: (identifier) @factory_name (#match? @factory_name "^create_")
+  body: (block
+    (expression_statement
+      (assignment
+        right: (call
+          function: (identifier) @_flask_call (#eq? @_flask_call "Flask"))))))
+`;
+    pythonFlaskAdapter = {
+      id: "python-flask",
+      languages: ["python"],
+      matches(signals) {
+        const pyToml = signals.pyprojectToml;
+        if (pyToml?.__raw && /\bflask\b/i.test(pyToml.__raw)) return true;
+        if (signals.presentDirs.has("app") && signals.presentFiles.has("app.py")) return true;
+        if (signals.presentDirs.has("app") && signals.presentFiles.has("wsgi.py")) return true;
+        return false;
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("python");
+        } catch (e2) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const authDecorators = /* @__PURE__ */ new Map();
+        const urlPrefixes = /* @__PURE__ */ new Map();
+        const appFactories = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: python-flask skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, AUTH_DECORATOR_QUERY, "flask-auth-decorator", file.path)) {
+                const name2 = hit.captures.auth_decorator;
+                if (name2 && !authDecorators.has(name2)) {
+                  authDecorators.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, BLUEPRINT_URL_PREFIX_QUERY, "flask-blueprint-url-prefix", file.path)) {
+                const raw = hit.captures.url_prefix;
+                if (!raw) continue;
+                const literal = raw.replace(/^['"]/, "").replace(/['"]$/, "");
+                const base = extractPrefixBase3(literal);
+                if (base && !urlPrefixes.has(base)) {
+                  urlPrefixes.set(base, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, APP_FACTORY_QUERY, "flask-app-factory", file.path)) {
+                const name2 = hit.captures.factory_name;
+                if (name2 && !appFactories.has(name2)) {
+                  appFactories.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) {
+                throw e2;
+              }
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (authDecorators.size === 1) {
+          const [name2, { line, file }] = authDecorators.entries().next().value;
+          conventions.auth_decorator = name2;
+          provenance.push({ field: "auth_decorator", sourceFile: file, line, query: "flask-auth-decorator" });
+        } else if (authDecorators.size >= 2) {
+          const [name2, { line, file }] = authDecorators.entries().next().value;
+          conventions.auth_decorator = name2;
+          provenance.push({ field: "auth_decorator", sourceFile: file, line, query: "flask-auth-decorator" });
+        }
+        if (urlPrefixes.size >= 1) {
+          const [base, { line, file }] = urlPrefixes.entries().next().value;
+          conventions.blueprint_url_prefix = base;
+          provenance.push({ field: "blueprint_url_prefix", sourceFile: file, line, query: "flask-blueprint-url-prefix" });
+        }
+        if (appFactories.size >= 1) {
+          const [name2, { line, file }] = appFactories.entries().next().value;
+          conventions.app_factory = name2;
+          provenance.push({ field: "app_factory", sourceFile: file, line, query: "flask-app-factory" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (authDecorators.size === 1) {
+          confidence = "high";
+        } else if (authDecorators.size >= 2) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
+  }
+});
+
+// src/detect/adapters/go-chi.ts
+function extractPrefixBase4(prefix3) {
+  if (!prefix3.startsWith("/")) return null;
+  const stripped = prefix3.replace(/^\/+/, "");
+  const firstSeg = stripped.split("/")[0];
+  if (!firstSeg) return null;
+  return "/" + firstSeg;
+}
+var ROUTE_METHOD_QUERY, MOUNT_PREFIX_QUERY, MIDDLEWARE_USE_QUERY, goChiAdapter;
+var init_go_chi = __esm({
+  "src/detect/adapters/go-chi.ts"() {
+    "use strict";
+    init_tree_sitter();
+    init_query_helpers();
+    init_tree_sitter_loader();
+    init_parse_guard();
+    ROUTE_METHOD_QUERY = `
+(call_expression
+  function: (selector_expression
+    field: (field_identifier) @method (#match? @method "^(Get|Post|Put|Delete|Patch|Head|Options|Connect|Trace)$"))
+  arguments: (argument_list
+    .
+    (interpreted_string_literal) @route_path))
+`;
+    MOUNT_PREFIX_QUERY = `
+(call_expression
+  function: (selector_expression
+    field: (field_identifier) @_field (#eq? @_field "Mount"))
+  arguments: (argument_list
+    .
+    (interpreted_string_literal) @mount_path))
+`;
+    MIDDLEWARE_USE_QUERY = `
+(call_expression
+  function: (selector_expression
+    field: (field_identifier) @_use (#eq? @_use "Use"))
+  arguments: (argument_list
+    .
+    (selector_expression
+      operand: (identifier) @_pkg (#eq? @_pkg "middleware")
+      field: (field_identifier) @middleware_name)))
+`;
+    goChiAdapter = {
+      id: "go-chi",
+      languages: ["go"],
+      matches(signals) {
+        if (!signals.goMod) return false;
+        if (/github\.com\/go-chi\/chi/i.test(signals.goMod)) return true;
+        return false;
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("go");
+        } catch (e2) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const routeMethods = /* @__PURE__ */ new Map();
+        const mountBases = /* @__PURE__ */ new Map();
+        const middlewareNames = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: go-chi skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, ROUTE_METHOD_QUERY, "chi-route-method", file.path)) {
+                const method = hit.captures.method;
+                if (method && !routeMethods.has(method)) {
+                  routeMethods.set(method, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, MOUNT_PREFIX_QUERY, "chi-mount-prefix", file.path)) {
+                const raw = hit.captures.mount_path;
+                if (!raw) continue;
+                const literal = raw.replace(/^["`]/, "").replace(/["`]$/, "");
+                const base = extractPrefixBase4(literal);
+                if (base && !mountBases.has(base)) {
+                  mountBases.set(base, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, MIDDLEWARE_USE_QUERY, "chi-middleware-use", file.path)) {
+                const name2 = hit.captures.middleware_name;
+                if (name2 && !middlewareNames.has(name2)) {
+                  middlewareNames.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) {
+                throw e2;
+              }
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (routeMethods.size === 1) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "chi-route-method" });
+        } else if (routeMethods.size >= 2) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "chi-route-method" });
+        }
+        if (mountBases.size >= 1) {
+          const [base, { line, file }] = mountBases.entries().next().value;
+          conventions.mount_prefix_base = base;
+          provenance.push({ field: "mount_prefix_base", sourceFile: file, line, query: "chi-mount-prefix" });
+        }
+        if (middlewareNames.size >= 1) {
+          const [name2, { line, file }] = middlewareNames.entries().next().value;
+          conventions.middleware_name = name2;
+          provenance.push({ field: "middleware_name", sourceFile: file, line, query: "chi-middleware-use" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (routeMethods.size === 1) {
+          confidence = "high";
+        } else if (routeMethods.size >= 2) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
+  }
+});
+
+// src/detect/adapters/rails.ts
+function extractRootController(target) {
+  const idx = target.indexOf("#");
+  if (idx <= 0) return null;
+  const controller = target.slice(0, idx).trim();
+  return controller || null;
+}
+var ROUTE_METHOD_QUERY2, NAMESPACE_QUERY, ROOT_ROUTE_QUERY, railsAdapter;
+var init_rails = __esm({
+  "src/detect/adapters/rails.ts"() {
+    "use strict";
+    init_tree_sitter();
+    init_query_helpers();
+    init_tree_sitter_loader();
+    init_parse_guard();
+    ROUTE_METHOD_QUERY2 = `
+(call
+  method: (identifier) @method (#match? @method "^(get|post|put|patch|delete|options|head)$")
+  arguments: (argument_list
+    .
+    (string) @route_path))
+`;
+    NAMESPACE_QUERY = `
+(call
+  method: (identifier) @_method (#eq? @_method "namespace")
+  arguments: (argument_list
+    .
+    [
+      (simple_symbol) @namespace_symbol
+      (string) @namespace_string
+    ]))
+`;
+    ROOT_ROUTE_QUERY = `
+(call
+  method: (identifier) @_method (#eq? @_method "root")
+  arguments: (argument_list
+    .
+    (string) @root_target))
+
+(call
+  method: (identifier) @_method (#eq? @_method "root")
+  arguments: (argument_list
+    (pair
+      key: (hash_key_symbol) @_key (#eq? @_key "to")
+      value: (string) @root_target)))
+`;
+    railsAdapter = {
+      id: "rails",
+      languages: ["ruby"],
+      matches(signals) {
+        if (!signals.gemfile) return false;
+        return /^\s*gem\s+['"]rails['"]/im.test(signals.gemfile);
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("ruby");
+        } catch (e2) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const routeMethods = /* @__PURE__ */ new Map();
+        const namespaces = /* @__PURE__ */ new Map();
+        const rootControllers = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: rails skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, ROUTE_METHOD_QUERY2, "rails-route-method", file.path)) {
+                const method = hit.captures.method;
+                if (method && !routeMethods.has(method)) {
+                  routeMethods.set(method, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, NAMESPACE_QUERY, "rails-namespace", file.path)) {
+                const symbolRaw = hit.captures.namespace_symbol;
+                const stringRaw = hit.captures.namespace_string;
+                const name2 = symbolRaw ? symbolRaw.replace(/^:/, "") : stringRaw ? stringRaw.replace(/^['"]/, "").replace(/['"]$/, "") : null;
+                if (!name2) continue;
+                const path = "/" + name2;
+                if (!namespaces.has(path)) {
+                  namespaces.set(path, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, ROOT_ROUTE_QUERY, "rails-root", file.path)) {
+                const raw = hit.captures.root_target;
+                if (!raw) continue;
+                const literal = raw.replace(/^['"]/, "").replace(/['"]$/, "");
+                const controller = extractRootController(literal);
+                if (controller && !rootControllers.has(controller)) {
+                  rootControllers.set(controller, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) {
+                throw e2;
+              }
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (routeMethods.size === 1) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "rails-route-method" });
+        } else if (routeMethods.size >= 2) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "rails-route-method" });
+        }
+        if (namespaces.size >= 1) {
+          const [path, { line, file }] = namespaces.entries().next().value;
+          conventions.api_namespace = path;
+          provenance.push({ field: "api_namespace", sourceFile: file, line, query: "rails-namespace" });
+        }
+        if (rootControllers.size >= 1) {
+          const [name2, { line, file }] = rootControllers.entries().next().value;
+          conventions.root_controller = name2;
+          provenance.push({ field: "root_controller", sourceFile: file, line, query: "rails-root" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (routeMethods.size === 1) {
+          confidence = "high";
+        } else if (routeMethods.size >= 2) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
+  }
+});
+
+// src/detect/adapters/phoenix.ts
+function extractPrefixBase5(prefix3) {
+  if (!prefix3.startsWith("/")) return null;
+  const stripped = prefix3.replace(/^\/+/, "");
+  const firstSeg = stripped.split("/")[0];
+  if (!firstSeg) return null;
+  return "/" + firstSeg;
+}
+var ROUTE_METHOD_QUERY3, SCOPE_PATH_QUERY, ROUTER_MODULE_QUERY, phoenixAdapter;
+var init_phoenix = __esm({
+  "src/detect/adapters/phoenix.ts"() {
+    "use strict";
+    init_tree_sitter();
+    init_query_helpers();
+    init_tree_sitter_loader();
+    init_parse_guard();
+    ROUTE_METHOD_QUERY3 = `
+(call
+  (identifier) @method (#match? @method "^(get|post|put|patch|delete|options|head)$")
+  (arguments
+    .
+    (string) @route_path))
+`;
+    SCOPE_PATH_QUERY = `
+(call
+  (identifier) @_method (#eq? @_method "scope")
+  (arguments
+    .
+    (string) @scope_path)
+  (do_block))
+`;
+    ROUTER_MODULE_QUERY = `
+(call
+  (identifier) @_method (#eq? @_method "defmodule")
+  (arguments
+    .
+    (alias) @module_name (#match? @module_name "Router$"))
+  (do_block))
+`;
+    phoenixAdapter = {
+      id: "phoenix",
+      languages: ["elixir"],
+      matches(signals) {
+        if (!signals.mixExs) return false;
+        return /\{\s*:phoenix\b(?!_)/.test(signals.mixExs);
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("elixir");
+        } catch (e2) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const routeMethods = /* @__PURE__ */ new Map();
+        const scopePaths = /* @__PURE__ */ new Map();
+        const routerModules = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: phoenix skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, ROUTE_METHOD_QUERY3, "phoenix-route-method", file.path)) {
+                const method = hit.captures.method;
+                if (method && !routeMethods.has(method)) {
+                  routeMethods.set(method, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, SCOPE_PATH_QUERY, "phoenix-scope-path", file.path)) {
+                const raw = hit.captures.scope_path;
+                if (!raw) continue;
+                const literal = raw.replace(/^["']/, "").replace(/["']$/, "");
+                const base = extractPrefixBase5(literal);
+                if (base && !scopePaths.has(base)) {
+                  scopePaths.set(base, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, ROUTER_MODULE_QUERY, "phoenix-router-module", file.path)) {
+                const name2 = hit.captures.module_name;
+                if (name2 && !routerModules.has(name2)) {
+                  routerModules.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) {
+                throw e2;
+              }
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (routeMethods.size === 1) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "phoenix-route-method" });
+        } else if (routeMethods.size >= 2) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "phoenix-route-method" });
+        }
+        if (scopePaths.size >= 1) {
+          const [base, { line, file }] = scopePaths.entries().next().value;
+          conventions.scope_prefix_base = base;
+          provenance.push({ field: "scope_prefix_base", sourceFile: file, line, query: "phoenix-scope-path" });
+        }
+        if (routerModules.size >= 1) {
+          const [name2, { line, file }] = routerModules.entries().next().value;
+          conventions.router_module = name2;
+          provenance.push({ field: "router_module", sourceFile: file, line, query: "phoenix-router-module" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (routeMethods.size === 1) {
+          confidence = "high";
+        } else if (routeMethods.size >= 2) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
   }
 });
 
-// src/detect/adapters/python-django.ts
-var init_python_django = __esm({
-  "src/detect/adapters/python-django.ts"() {
+// src/detect/adapters/aspnet.ts
+function extractPrefixBase6(prefix3) {
+  const stripped = prefix3.replace(/^\/+/, "");
+  const firstSeg = stripped.split("/")[0];
+  if (!firstSeg) return null;
+  return "/" + firstSeg;
+}
+var MAP_VERB_QUERY, HTTP_ATTR_QUERY, ROUTE_ATTR_QUERY, CONTROLLER_CLASS_QUERY, aspnetAdapter;
+var init_aspnet = __esm({
+  "src/detect/adapters/aspnet.ts"() {
     "use strict";
     init_tree_sitter();
     init_query_helpers();
     init_tree_sitter_loader();
     init_parse_guard();
+    MAP_VERB_QUERY = `
+(invocation_expression
+  function: (member_access_expression
+    name: (identifier) @method (#match? @method "^Map(Get|Post|Put|Patch|Delete|Head|Options)$"))
+  arguments: (argument_list
+    .
+    (argument (string_literal) @route_path)))
+`;
+    HTTP_ATTR_QUERY = `
+(attribute
+  name: (identifier) @attr_name (#match? @attr_name "^Http(Get|Post|Put|Patch|Delete|Head|Options)$"))
+`;
+    ROUTE_ATTR_QUERY = `
+(attribute
+  name: (identifier) @_attr_name (#eq? @_attr_name "Route")
+  (attribute_argument_list
+    (attribute_argument (string_literal) @route_template)))
+`;
+    CONTROLLER_CLASS_QUERY = `
+(class_declaration
+  name: (identifier) @class_name (#match? @class_name "Controller$"))
+`;
+    aspnetAdapter = {
+      id: "aspnet",
+      languages: ["csharp"],
+      matches(signals) {
+        if (!signals.csproj) return false;
+        if (/Sdk\s*=\s*["']Microsoft\.NET\.Sdk\.Web["']/i.test(signals.csproj)) return true;
+        if (/Microsoft\.AspNetCore\.App/i.test(signals.csproj)) return true;
+        return false;
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("csharp");
+        } catch (e2) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const routeMethods = /* @__PURE__ */ new Map();
+        const prefixBases = /* @__PURE__ */ new Map();
+        const controllerClasses = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: aspnet skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, MAP_VERB_QUERY, "aspnet-map-verb", file.path)) {
+                const methodRaw = hit.captures.method;
+                if (!methodRaw) continue;
+                const verb = methodRaw.replace(/^Map/, "");
+                if (!routeMethods.has(verb)) {
+                  routeMethods.set(verb, { line: hit.line, file: file.path });
+                }
+                const pathRaw = hit.captures.route_path;
+                if (pathRaw) {
+                  const literal = pathRaw.replace(/^["']/, "").replace(/["']$/, "");
+                  const base = extractPrefixBase6(literal);
+                  if (base && !prefixBases.has(base)) {
+                    prefixBases.set(base, { line: hit.line, file: file.path });
+                  }
+                }
+              }
+              for (const hit of runQuery(parser, file.content, HTTP_ATTR_QUERY, "aspnet-http-attr", file.path)) {
+                const attrRaw = hit.captures.attr_name;
+                if (!attrRaw) continue;
+                const verb = attrRaw.replace(/^Http/, "");
+                if (!routeMethods.has(verb)) {
+                  routeMethods.set(verb, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, ROUTE_ATTR_QUERY, "aspnet-route-attr", file.path)) {
+                const tplRaw = hit.captures.route_template;
+                if (!tplRaw) continue;
+                const literal = tplRaw.replace(/^["']/, "").replace(/["']$/, "");
+                const base = extractPrefixBase6(literal);
+                if (base && !prefixBases.has(base)) {
+                  prefixBases.set(base, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, CONTROLLER_CLASS_QUERY, "aspnet-controller-class", file.path)) {
+                const name2 = hit.captures.class_name;
+                if (name2 && !controllerClasses.has(name2)) {
+                  controllerClasses.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) {
+                throw e2;
+              }
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (routeMethods.size === 1) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "aspnet-map-verb" });
+        } else if (routeMethods.size >= 2) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "aspnet-map-verb" });
+        }
+        if (prefixBases.size >= 1) {
+          const [base, { line, file }] = prefixBases.entries().next().value;
+          conventions.route_prefix_base = base;
+          provenance.push({ field: "route_prefix_base", sourceFile: file, line, query: "aspnet-route-prefix" });
+        }
+        if (controllerClasses.size >= 1) {
+          const [name2, { line, file }] = controllerClasses.entries().next().value;
+          conventions.controller_class = name2;
+          provenance.push({ field: "controller_class", sourceFile: file, line, query: "aspnet-controller-class" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (routeMethods.size === 1) {
+          confidence = "high";
+        } else if (routeMethods.size >= 2) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
   }
 });
 
-// src/detect/adapters/nextjs-trpc.ts
-var init_nextjs_trpc = __esm({
-  "src/detect/adapters/nextjs-trpc.ts"() {
+// src/detect/adapters/spring.ts
+function extractPrefixBase7(prefix3) {
+  const stripped = prefix3.replace(/^\/+/, "");
+  const firstSeg = stripped.split("/")[0];
+  if (!firstSeg) return null;
+  return "/" + firstSeg;
+}
+var HTTP_MAPPING_QUERY, HTTP_MAPPING_NO_ARGS_QUERY, REQUEST_MAPPING_QUERY, CONTROLLER_CLASS_QUERY2, springAdapter;
+var init_spring = __esm({
+  "src/detect/adapters/spring.ts"() {
     "use strict";
     init_tree_sitter();
     init_query_helpers();
     init_tree_sitter_loader();
     init_parse_guard();
+    HTTP_MAPPING_QUERY = `
+(annotation
+  name: (identifier) @method (#match? @method "^(Get|Post|Put|Patch|Delete|Head|Options)Mapping$")
+  arguments: (annotation_argument_list
+    (string_literal) @route_path))
+`;
+    HTTP_MAPPING_NO_ARGS_QUERY = `
+(marker_annotation
+  name: (identifier) @method (#match? @method "^(Get|Post|Put|Patch|Delete|Head|Options)Mapping$"))
+`;
+    REQUEST_MAPPING_QUERY = `
+(annotation
+  name: (identifier) @_name (#eq? @_name "RequestMapping")
+  arguments: (annotation_argument_list
+    (string_literal) @route_template))
+`;
+    CONTROLLER_CLASS_QUERY2 = `
+(class_declaration
+  (modifiers
+    (marker_annotation
+      name: (identifier) @_anno (#match? @_anno "^(RestController|Controller)$")))
+  name: (identifier) @class_name)
+
+(class_declaration
+  (modifiers
+    (annotation
+      name: (identifier) @_anno (#match? @_anno "^(RestController|Controller)$")))
+  name: (identifier) @class_name)
+`;
+    springAdapter = {
+      id: "spring",
+      languages: ["java"],
+      matches(signals) {
+        if (signals.pomXml && /\bspring-boot-starter[\w-]*\b/.test(signals.pomXml)) {
+          return true;
+        }
+        if (signals.gradleBuild && /\bspring-boot-starter[\w-]*\b/.test(signals.gradleBuild)) {
+          return true;
+        }
+        if (signals.pomXml && /\borg\.springframework\b/.test(signals.pomXml)) {
+          return true;
+        }
+        if (signals.gradleBuild && /\borg\.springframework\b/.test(signals.gradleBuild)) {
+          return true;
+        }
+        return false;
+      },
+      async introspect(files, _rootDir) {
+        if (files.length === 0) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        let language;
+        try {
+          language = await loadGrammar("java");
+        } catch (e2) {
+          return { conventions: {}, provenance: [], confidence: "none" };
+        }
+        const parser = new Parser();
+        parser.setLanguage(language);
+        const routeMethods = /* @__PURE__ */ new Map();
+        const prefixBases = /* @__PURE__ */ new Map();
+        const controllerClasses = /* @__PURE__ */ new Map();
+        try {
+          for (const file of files) {
+            const skip = isParsableSource(file.content, file.size);
+            if (skip) {
+              process.stderr.write(
+                `[massu/ast] WARN: spring skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
+`
+              );
+              continue;
+            }
+            try {
+              for (const hit of runQuery(parser, file.content, HTTP_MAPPING_QUERY, "spring-http-mapping", file.path)) {
+                const methodRaw = hit.captures.method;
+                if (!methodRaw) continue;
+                const verb = methodRaw.replace(/Mapping$/, "");
+                if (!routeMethods.has(verb)) {
+                  routeMethods.set(verb, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, HTTP_MAPPING_NO_ARGS_QUERY, "spring-http-mapping-marker", file.path)) {
+                const methodRaw = hit.captures.method;
+                if (!methodRaw) continue;
+                const verb = methodRaw.replace(/Mapping$/, "");
+                if (!routeMethods.has(verb)) {
+                  routeMethods.set(verb, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, REQUEST_MAPPING_QUERY, "spring-request-mapping", file.path)) {
+                const tplRaw = hit.captures.route_template;
+                if (!tplRaw) continue;
+                const literal = tplRaw.replace(/^["']/, "").replace(/["']$/, "");
+                const base = extractPrefixBase7(literal);
+                if (base && !prefixBases.has(base)) {
+                  prefixBases.set(base, { line: hit.line, file: file.path });
+                }
+              }
+              for (const hit of runQuery(parser, file.content, CONTROLLER_CLASS_QUERY2, "spring-controller-class", file.path)) {
+                const name2 = hit.captures.class_name;
+                if (name2 && !controllerClasses.has(name2)) {
+                  controllerClasses.set(name2, { line: hit.line, file: file.path });
+                }
+              }
+            } catch (e2) {
+              if (e2 instanceof InvalidQueryError) {
+                throw e2;
+              }
+              continue;
+            }
+          }
+        } finally {
+          try {
+            parser.delete();
+          } catch {
+          }
+        }
+        const conventions = {};
+        const provenance = [];
+        if (routeMethods.size === 1) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "spring-http-mapping" });
+        } else if (routeMethods.size >= 2) {
+          const [name2, { line, file }] = routeMethods.entries().next().value;
+          conventions.route_method = name2;
+          provenance.push({ field: "route_method", sourceFile: file, line, query: "spring-http-mapping" });
+        }
+        if (prefixBases.size >= 1) {
+          const [base, { line, file }] = prefixBases.entries().next().value;
+          conventions.route_prefix_base = base;
+          provenance.push({ field: "route_prefix_base", sourceFile: file, line, query: "spring-request-mapping" });
+        }
+        if (controllerClasses.size >= 1) {
+          const [name2, { line, file }] = controllerClasses.entries().next().value;
+          conventions.controller_class = name2;
+          provenance.push({ field: "controller_class", sourceFile: file, line, query: "spring-controller-class" });
+        }
+        let confidence;
+        if (Object.keys(conventions).length === 0) {
+          confidence = "none";
+        } else if (routeMethods.size === 1) {
+          confidence = "high";
+        } else if (routeMethods.size >= 2) {
+          confidence = "low";
+        } else {
+          confidence = "medium";
+        }
+        return { conventions, provenance, confidence };
+      }
+    };
   }
 });
 
-// src/detect/adapters/swift-swiftui.ts
-var init_swift_swiftui = __esm({
-  "src/detect/adapters/swift-swiftui.ts"() {
+// src/detect/adapters/file-sampler.ts
+var file_sampler_exports = {};
+__export(file_sampler_exports, {
+  SAMPLE_EXTENSIONS: () => SAMPLE_EXTENSIONS,
+  SAMPLE_TEST_FILE_PATTERNS: () => SAMPLE_TEST_FILE_PATTERNS,
+  sampleFilesForAdapter: () => sampleFilesForAdapter
+});
+import { readdirSync as readdirSync9, readFileSync as readFileSync9, lstatSync as lstatSync4 } from "node:fs";
+import { join as join9, extname } from "node:path";
+function sampleFilesForAdapter(adapter, projectRoot, detection, options = {}) {
+  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+  const maxFiles = options.maxFilesPerAdapter ?? DEFAULT_MAX_FILES;
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const lang of adapter.languages) {
+    if (out2.length >= maxFiles) break;
+    const exts = SAMPLE_EXTENSIONS[lang];
+    if (!exts || exts.length === 0) continue;
+    const testPatterns = SAMPLE_TEST_FILE_PATTERNS[lang] ?? [];
+    const langKey = lang;
+    const langDetection = detection.sourceDirs[langKey];
+    const candidateDirs = [];
+    if (langDetection?.source_dirs && langDetection.source_dirs.length > 0) {
+      candidateDirs.push(...langDetection.source_dirs.map((d2) => join9(projectRoot, d2)));
+    } else {
+      candidateDirs.push(projectRoot);
+    }
+    for (const dir of candidateDirs) {
+      if (out2.length >= maxFiles) break;
+      walkDir(dir, exts, testPatterns, lang, maxDepth, 0, out2, seen, maxFiles);
+    }
+  }
+  return out2;
+}
+function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out2, seen, maxFiles) {
+  if (curDepth > maxDepth) return;
+  if (out2.length >= maxFiles) return;
+  let entries;
+  try {
+    entries = readdirSync9(dir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (out2.length >= maxFiles) return;
+    if (entry.startsWith(".")) continue;
+    if (IGNORED_DIRS3.has(entry)) continue;
+    const fullPath = join9(dir, entry);
+    let st;
+    try {
+      st = lstatSync4(fullPath);
+    } catch {
+      continue;
+    }
+    if (st.isSymbolicLink()) continue;
+    if (st.isDirectory()) {
+      walkDir(fullPath, exts, testPatterns, lang, maxDepth, curDepth + 1, out2, seen, maxFiles);
+      continue;
+    }
+    if (!st.isFile()) continue;
+    if (st.size > MAX_AST_FILE_BYTES) continue;
+    const ext = extname(entry).slice(1);
+    if (!exts.includes(ext)) continue;
+    if (testPatterns.some((p19) => p19.test(fullPath))) continue;
+    if (seen.has(fullPath)) continue;
+    seen.add(fullPath);
+    let content;
+    try {
+      content = readFileSync9(fullPath, "utf-8");
+    } catch {
+      continue;
+    }
+    out2.push({
+      path: fullPath,
+      content,
+      language: lang,
+      size: st.size
+    });
+  }
+}
+var SAMPLE_EXTENSIONS, SAMPLE_TEST_FILE_PATTERNS, IGNORED_DIRS3, DEFAULT_MAX_DEPTH, DEFAULT_MAX_FILES;
+var init_file_sampler = __esm({
+  "src/detect/adapters/file-sampler.ts"() {
     "use strict";
-    init_tree_sitter();
-    init_query_helpers();
-    init_tree_sitter_loader();
     init_parse_guard();
+    SAMPLE_EXTENSIONS = {
+      python: ["py"],
+      typescript: ["ts", "tsx"],
+      javascript: ["js", "jsx", "mjs", "cjs"],
+      swift: ["swift"],
+      rust: ["rs"],
+      go: ["go"],
+      ruby: ["rb"],
+      php: ["php"],
+      java: ["java", "kt"],
+      kotlin: ["kt", "kts"],
+      elixir: ["ex", "exs"],
+      erlang: ["erl", "hrl"],
+      csharp: ["cs"],
+      cpp: ["cpp", "cc", "cxx", "h", "hpp"],
+      haskell: ["hs", "lhs"],
+      ocaml: ["ml", "mli"]
+    };
+    SAMPLE_TEST_FILE_PATTERNS = {
+      python: [/_test\.py$/, /test_[^/]*\.py$/, /\/tests?\//],
+      typescript: [/\.test\.tsx?$/, /\.spec\.tsx?$/, /\/__tests__\//],
+      javascript: [/\.test\.[mc]?jsx?$/, /\.spec\.[mc]?jsx?$/, /\/__tests__\//],
+      swift: [/Tests\//],
+      rust: [/tests\/.*\.rs$/],
+      go: [/_test\.go$/],
+      ruby: [/_spec\.rb$/, /_test\.rb$/, /\/spec\//],
+      php: [/Test\.php$/, /\/tests?\//i],
+      java: [/Test[^/]*\.(java|kt)$/, /[^/]*Test\.(java|kt)$/, /\/test\//],
+      kotlin: [/Test[^/]*\.kt$/, /[^/]*Test\.kt$/],
+      elixir: [/_test\.exs$/, /\/test\//],
+      erlang: [/_SUITE\.erl$/],
+      csharp: [/Tests?\.cs$/, /\.Tests?\//],
+      cpp: [/_test\.(cpp|cc)$/i, /\/tests?\//i],
+      haskell: [/Spec\.hs$/, /\/test\//],
+      ocaml: [/_test\.ml$/, /\/test\//]
+    };
+    IGNORED_DIRS3 = /* @__PURE__ */ new Set([
+      "node_modules",
+      ".venv",
+      "venv",
+      "__pycache__",
+      "dist",
+      "build",
+      ".build",
+      "target",
+      ".next",
+      ".nuxt",
+      "coverage",
+      ".git",
+      ".massu",
+      ".turbo",
+      ".cache",
+      ".pytest_cache",
+      ".mypy_cache",
+      "DerivedData",
+      "Pods",
+      "_build",
+      "deps",
+      "priv",
+      "cover",
+      ".elixir_ls",
+      // Elixir/Phoenix
+      "bin",
+      "obj",
+      ".vs",
+      "packages",
+      "publish",
+      "TestResults"
+      // .NET
+    ]);
+    DEFAULT_MAX_DEPTH = 3;
+    DEFAULT_MAX_FILES = 50;
   }
 });
 
 // src/detect/codebase-introspector.ts
+var codebase_introspector_exports = {};
+__export(codebase_introspector_exports, {
+  introspect: () => introspect,
+  introspectAsync: () => introspectAsync
+});
 function introspect(detection, projectRoot) {
   const out2 = {};
   const languages = Array.from(
@@ -14667,6 +16820,35 @@ function introspect(detection, projectRoot) {
   }
   return out2;
 }
+async function introspectAsync(detection, projectRoot) {
+  const out2 = introspect(detection, projectRoot);
+  const signals = buildDetectionSignals(projectRoot);
+  const { sampleFilesForAdapter: sampleFilesForAdapter2 } = await Promise.resolve().then(() => (init_file_sampler(), file_sampler_exports));
+  let merged;
+  try {
+    merged = await runAdapters(FIRST_PARTY_ADAPTERS, projectRoot, signals, {
+      sampleFiles: async (adapter, root) => {
+        return sampleFilesForAdapter2(adapter, root, detection);
+      }
+    });
+  } catch {
+    return out2;
+  }
+  for (const [adapterId, resolved] of Object.entries(merged.byAdapter)) {
+    if (resolved.confidence === "none") continue;
+    out2[adapterId] = serializeAdapterBlock(resolved);
+  }
+  return out2;
+}
+function serializeAdapterBlock(r2) {
+  const block = { ...r2.conventions };
+  if (Object.keys(r2._provenance).length > 0) {
+    block._provenance = r2._provenance;
+  }
+  block._confidence = r2.confidence;
+  return block;
+}
+var FIRST_PARTY_ADAPTERS;
 var init_codebase_introspector = __esm({
   "src/detect/codebase-introspector.ts"() {
     "use strict";
@@ -14676,6 +16858,24 @@ var init_codebase_introspector = __esm({
     init_python_django();
     init_nextjs_trpc();
     init_swift_swiftui();
+    init_python_flask();
+    init_go_chi();
+    init_rails();
+    init_phoenix();
+    init_aspnet();
+    init_spring();
+    FIRST_PARTY_ADAPTERS = [
+      pythonFastApiAdapter,
+      pythonDjangoAdapter,
+      pythonFlaskAdapter,
+      nextjsTrpcAdapter,
+      swiftSwiftUiAdapter,
+      goChiAdapter,
+      railsAdapter,
+      phoenixAdapter,
+      aspnetAdapter,
+      springAdapter
+    ];
   }
 });
 
@@ -14741,7 +16941,7 @@ var init_detect = __esm({
 });
 
 // src/detect/drift.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 function summarizeDetection(det) {
   const languages = Array.from(new Set(det.manifests.map((m3) => m3.language))).sort();
   const frameworks = {};
@@ -14772,7 +16972,7 @@ function summarizeDetection(det) {
 function computeFingerprint(det) {
   const data = summarizeDetection(det);
   const stable = JSON.stringify(data, Object.keys(data).sort());
-  return createHash2("sha256").update(stable).digest("hex");
+  return createHash3("sha256").update(stable).digest("hex");
 }
 function stringOf(v3) {
   if (typeof v3 === "string") return v3;
@@ -15931,10 +18131,10 @@ __export(init_exports, {
   validateWrittenConfig: () => validateWrittenConfig,
   writeConfigAtomic: () => writeConfigAtomic
 });
-import { closeSync as closeSync2, existsSync as existsSync9, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync7, writeFileSync, writeSync as writeSync2, mkdirSync as mkdirSync3, readdirSync as readdirSync7, renameSync as renameSync2, rmSync as rmSync2, statSync as statSync5, chmodSync } from "fs";
-import { resolve as resolve6, basename as basename3, dirname as dirname4 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync10, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2, writeSync as writeSync2, mkdirSync as mkdirSync4, readdirSync as readdirSync10, renameSync as renameSync3, rmSync as rmSync2, statSync as statSync7, chmodSync as chmodSync2 } from "fs";
+import { resolve as resolve6, basename as basename4, dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 import { stringify as yamlStringify, parse as yamlParse } from "yaml";
 function detectFramework(projectRoot) {
   const result = {
@@ -15944,9 +18144,9 @@ function detectFramework(projectRoot) {
     ui: "none"
   };
   const pkgPath = resolve6(projectRoot, "package.json");
-  if (!existsSync9(pkgPath)) return result;
+  if (!existsSync10(pkgPath)) return result;
   try {
-    const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
     const allDeps = {
       ...pkg.dependencies,
       ...pkg.devDependencies
@@ -15980,7 +18180,7 @@ function detectPython(projectRoot) {
     alembicDir: null
   };
   const markers = ["pyproject.toml", "setup.py", "requirements.txt", "Pipfile"];
-  const hasMarker = markers.some((m3) => existsSync9(resolve6(projectRoot, m3)));
+  const hasMarker = markers.some((m3) => existsSync10(resolve6(projectRoot, m3)));
   if (!hasMarker) return result;
   result.detected = true;
   const depFiles = [
@@ -15991,34 +18191,34 @@ function detectPython(projectRoot) {
   ];
   for (const { file } of depFiles) {
     const filePath = resolve6(projectRoot, file);
-    if (existsSync9(filePath)) {
+    if (existsSync10(filePath)) {
       try {
-        const content = readFileSync7(filePath, "utf-8").toLowerCase();
+        const content = readFileSync10(filePath, "utf-8").toLowerCase();
         if (content.includes("fastapi")) result.hasFastapi = true;
         if (content.includes("sqlalchemy")) result.hasSqlalchemy = true;
       } catch {
       }
     }
   }
-  if (existsSync9(resolve6(projectRoot, "alembic.ini"))) {
+  if (existsSync10(resolve6(projectRoot, "alembic.ini"))) {
     result.hasAlembic = true;
-    if (existsSync9(resolve6(projectRoot, "alembic"))) {
+    if (existsSync10(resolve6(projectRoot, "alembic"))) {
       result.alembicDir = "alembic";
     }
-  } else if (existsSync9(resolve6(projectRoot, "alembic"))) {
+  } else if (existsSync10(resolve6(projectRoot, "alembic"))) {
     result.hasAlembic = true;
     result.alembicDir = "alembic";
   }
   const candidateRoots = ["app", "src", "backend", "api"];
   for (const candidate of candidateRoots) {
     const candidatePath = resolve6(projectRoot, candidate);
-    if (existsSync9(candidatePath) && existsSync9(resolve6(candidatePath, "__init__.py"))) {
+    if (existsSync10(candidatePath) && existsSync10(resolve6(candidatePath, "__init__.py"))) {
       result.root = candidate;
       break;
     }
-    if (existsSync9(candidatePath)) {
+    if (existsSync10(candidatePath)) {
       try {
-        const files = readdirSync7(candidatePath);
+        const files = readdirSync10(candidatePath);
         if (files.some((f2) => f2.endsWith(".py"))) {
           result.root = candidate;
           break;
@@ -16037,10 +18237,10 @@ function generateConfig(projectRoot, framework) {
     "[@massu/core] generateConfig() is deprecated since 1.2.1 \u2014 use buildConfigFromDetection instead. It cannot produce valid configs for monorepos."
   );
   const configPath = resolve6(projectRoot, "massu.config.yaml");
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     return false;
   }
-  const projectName = basename3(projectRoot);
+  const projectName = basename4(projectRoot);
   const config = {
     project: {
       name: projectName,
@@ -16083,7 +18283,7 @@ function generateConfig(projectRoot, framework) {
 # Documentation: https://massu.ai/docs/getting-started/configuration
 
 ${yamlStringify(config)}`;
-  writeFileSync(configPath, yamlContent, "utf-8");
+  writeFileSync2(configPath, yamlContent, "utf-8");
   return true;
 }
 function monorepoCommonRoot(packages) {
@@ -16105,7 +18305,7 @@ function buildConfigFromDetection(opts) {
   if (!detection) {
     throw new Error("buildConfigFromDetection requires a detection result");
   }
-  const projectName = opts.projectName ?? basename3(projectRoot);
+  const projectName = opts.projectName ?? basename4(projectRoot);
   const languages = Array.from(
     new Set(detection.manifests.map((m3) => m3.language))
   );
@@ -16226,7 +18426,7 @@ function buildConfigFromDetection(opts) {
     };
     if (pyFw?.framework) pythonBlock.framework = pyFw.framework;
     if (pyFw?.orm) pythonBlock.orm = pyFw.orm;
-    if (existsSync9(resolve6(projectRoot, "alembic.ini")) || existsSync9(resolve6(projectRoot, "alembic"))) {
+    if (existsSync10(resolve6(projectRoot, "alembic.ini")) || existsSync10(resolve6(projectRoot, "alembic"))) {
       pythonBlock.alembic_dir = "alembic";
     }
     config.python = pythonBlock;
@@ -16251,10 +18451,10 @@ function applyVariantTemplate(config, templatesDir) {
   }
   if (templateId === null) return config;
   const templatePath = resolve6(templatesDir, templateId, "massu.config.yaml");
-  if (!existsSync9(templatePath)) return config;
+  if (!existsSync10(templatePath)) return config;
   let template;
   try {
-    template = yamlParse(readFileSync7(templatePath, "utf-8"));
+    template = yamlParse(readFileSync10(templatePath, "utf-8"));
   } catch {
     return config;
   }
@@ -16313,15 +18513,15 @@ ${yamlStringify(config)}`;
 function writeConfigAtomic(configPath, content) {
   const tmpPath = `${configPath}.tmp`;
   let existingMode;
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     try {
-      existingMode = statSync5(configPath).mode;
+      existingMode = statSync7(configPath).mode;
     } catch {
       existingMode = void 0;
     }
   }
   try {
-    mkdirSync3(dirname4(configPath), { recursive: true });
+    mkdirSync4(dirname5(configPath), { recursive: true });
     const fd = openSync2(tmpPath, "w", 420);
     try {
       const buf = Buffer.from(content, "utf-8");
@@ -16334,16 +18534,16 @@ function writeConfigAtomic(configPath, content) {
     if (parsed === null || typeof parsed !== "object") {
       throw new Error("Generated config is not a valid YAML object");
     }
-    renameSync2(tmpPath, configPath);
+    renameSync3(tmpPath, configPath);
     if (existingMode !== void 0) {
       try {
-        chmodSync(configPath, existingMode);
+        chmodSync2(configPath, existingMode);
       } catch {
       }
     }
     return { validated: true };
   } catch (err2) {
-    if (existsSync9(tmpPath)) {
+    if (existsSync10(tmpPath)) {
       try {
         rmSync2(tmpPath, { force: true });
       } catch {
@@ -16354,8 +18554,8 @@ function writeConfigAtomic(configPath, content) {
 }
 function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
   try {
-    if (!existsSync9(configPath)) return "Config file does not exist after write";
-    const content = readFileSync7(configPath, "utf-8");
+    if (!existsSync10(configPath)) return "Config file does not exist after write";
+    const content = readFileSync10(configPath, "utf-8");
     const parsed = yamlParse(content);
     if (parsed === null || typeof parsed !== "object") {
       return "Config is not a valid YAML object";
@@ -16376,7 +18576,7 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
         const src = cfg.paths.source;
         if (src && src !== ".") {
           const srcAbs = resolve6(projectRoot, src);
-          if (!existsSync9(srcAbs)) {
+          if (!existsSync10(srcAbs)) {
             return `paths.source '${src}' does not exist on disk`;
           }
         }
@@ -16387,7 +18587,7 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
           for (const d2 of rawDirs) {
             if (typeof d2 !== "string" || d2 === ".") continue;
             const abs = resolve6(projectRoot, d2);
-            if (!existsSync9(abs)) {
+            if (!existsSync10(abs)) {
               return `framework.languages.${lang}.source_dirs '${d2}' does not exist on disk`;
             }
           }
@@ -16396,7 +18596,7 @@ function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
         if (Array.isArray(mRoots)) {
           for (const r2 of mRoots) {
             if (typeof r2 !== "string" || r2 === ".") continue;
-            if (!existsSync9(resolve6(projectRoot, r2))) {
+            if (!existsSync10(resolve6(projectRoot, r2))) {
               return `paths.monorepo_roots '${r2}' does not exist on disk`;
             }
           }
@@ -16442,7 +18642,7 @@ function resolveTemplatesDir() {
     resolve6(__dirname2, "../../../templates")
   ];
   for (const c2 of candidates) {
-    if (existsSync9(c2)) return c2;
+    if (existsSync10(c2)) return c2;
   }
   return null;
 }
@@ -16452,13 +18652,13 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
     return { success: false, error: `Templates directory not found (looked in node_modules and dist/src)` };
   }
   const srcPath = resolve6(templatesDir, templateName, "massu.config.yaml");
-  if (!existsSync9(srcPath)) {
+  if (!existsSync10(srcPath)) {
     return { success: false, error: `Template '${templateName}' not found at ${srcPath}` };
   }
   try {
-    let content = readFileSync7(srcPath, "utf-8");
+    let content = readFileSync10(srcPath, "utf-8");
     content = content.replace(/\{\{PROJECT_NAME\}\}/g, projectName);
-    writeFileSync(targetPath, content, "utf-8");
+    writeFileSync2(targetPath, content, "utf-8");
     return { success: true };
   } catch (err2) {
     return { success: false, error: err2 instanceof Error ? err2.message : String(err2) };
@@ -16467,9 +18667,9 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
 function registerMcpServer(projectRoot) {
   const mcpPath = resolve6(projectRoot, ".mcp.json");
   let existing = {};
-  if (existsSync9(mcpPath)) {
+  if (existsSync10(mcpPath)) {
     try {
-      existing = JSON.parse(readFileSync7(mcpPath, "utf-8"));
+      existing = JSON.parse(readFileSync10(mcpPath, "utf-8"));
     } catch {
       existing = {};
     }
@@ -16484,17 +18684,17 @@ function registerMcpServer(projectRoot) {
     args: ["-y", "@massu/core"]
   };
   existing.mcpServers = servers;
-  writeFileSync(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+  writeFileSync2(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
   return true;
 }
 function resolveHooksDir() {
   const cwd = process.cwd();
   const nodeModulesPath = resolve6(cwd, "node_modules/@massu/core/dist/hooks");
-  if (existsSync9(nodeModulesPath)) {
+  if (existsSync10(nodeModulesPath)) {
     return "node_modules/@massu/core/dist/hooks";
   }
   const localPath = resolve6(__dirname2, "../dist/hooks");
-  if (existsSync9(localPath)) {
+  if (existsSync10(localPath)) {
     return localPath;
   }
   return "node_modules/@massu/core/dist/hooks";
@@ -16588,13 +18788,13 @@ function installHooks(projectRoot) {
   }
   const claudeDir = resolve6(projectRoot, claudeDirName);
   const settingsPath = resolve6(claudeDir, "settings.local.json");
-  if (!existsSync9(claudeDir)) {
-    mkdirSync3(claudeDir, { recursive: true });
+  if (!existsSync10(claudeDir)) {
+    mkdirSync4(claudeDir, { recursive: true });
   }
   let settings = {};
-  if (existsSync9(settingsPath)) {
+  if (existsSync10(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync7(settingsPath, "utf-8"));
+      settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
     } catch {
       settings = {};
     }
@@ -16608,21 +18808,21 @@ function installHooks(projectRoot) {
     }
   }
   settings.hooks = hooksConfig;
-  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+  writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
   return { installed: true, count: hookCount };
 }
 function initMemoryDir(projectRoot) {
   const encodedRoot = "-" + projectRoot.replace(/\//g, "-");
-  const memoryDir = resolve6(homedir2(), `.claude/projects/${encodedRoot}/memory`);
+  const memoryDir = resolve6(homedir3(), `.claude/projects/${encodedRoot}/memory`);
   let created = false;
-  if (!existsSync9(memoryDir)) {
-    mkdirSync3(memoryDir, { recursive: true });
+  if (!existsSync10(memoryDir)) {
+    mkdirSync4(memoryDir, { recursive: true });
     created = true;
   }
   const memoryMdPath = resolve6(memoryDir, "MEMORY.md");
   let memoryMdCreated = false;
-  if (!existsSync9(memoryMdPath)) {
-    const projectName = basename3(projectRoot);
+  if (!existsSync10(memoryMdPath)) {
+    const projectName = basename4(projectRoot);
     const memoryContent = `# ${projectName} - Massu Memory
 
 ## Key Learnings
@@ -16637,7 +18837,7 @@ function initMemoryDir(projectRoot) {
 ## File Index
 <!-- Significant files and directories -->
 `;
-    writeFileSync(memoryMdPath, memoryContent, "utf-8");
+    writeFileSync2(memoryMdPath, memoryContent, "utf-8");
     memoryMdCreated = true;
   }
   return { created, memoryMdCreated };
@@ -16649,6 +18849,7 @@ function parseInitArgs(argv) {
     if (a2 === "--ci") opts.ci = true;
     else if (a2 === "--force") opts.force = true;
     else if (a2 === "--skip-commands") opts.skipCommands = true;
+    else if (a2 === "--no-introspect") opts.skipIntrospect = true;
     else if (a2 === "--help" || a2 === "-h") opts.help = true;
     else if (a2 === "--template") {
       const next = argv[i2 + 1];
@@ -16727,7 +18928,7 @@ async function runInit(argv, overrides) {
   log("========================");
   log("");
   const configPath = resolve6(projectRoot, "massu.config.yaml");
-  if (existsSync9(configPath)) {
+  if (existsSync10(configPath)) {
     if (opts.ci && !opts.force) {
       errLog(`error: massu.config.yaml already exists at ${configPath}`);
       errLog("       rerun with --force to overwrite, or remove the file first");
@@ -16746,7 +18947,7 @@ async function runInit(argv, overrides) {
       errLog(`error: unknown template '${opts.template}'. Available: ${TEMPLATE_NAMES.join(", ")}`);
       throw new Error(`Unknown template: ${opts.template}`);
     }
-    const projectName = basename3(projectRoot);
+    const projectName = basename4(projectRoot);
     const res = copyTemplateConfig(opts.template, configPath, projectName);
     if (!res.success) {
       errLog(`error: template copy failed: ${res.error}`);
@@ -16805,7 +19006,25 @@ async function runInit(argv, overrides) {
     }
   }
   const baseConfig = buildConfigFromDetection({ projectRoot, detection });
-  const config = applyVariantTemplate(baseConfig, resolveTemplatesDir());
+  const withVariant = applyVariantTemplate(baseConfig, resolveTemplatesDir());
+  let config = withVariant;
+  if (!opts.skipIntrospect) {
+    try {
+      const { introspectAsync: introspectAsync2 } = await Promise.resolve().then(() => (init_codebase_introspector(), codebase_introspector_exports));
+      const introspected = await introspectAsync2(detection, projectRoot);
+      const detectedBlocks = {};
+      for (const [key, block] of Object.entries(introspected)) {
+        if (block && typeof block === "object" && "_confidence" in block) {
+          detectedBlocks[key] = block;
+        }
+      }
+      if (Object.keys(detectedBlocks).length > 0) {
+        config = { ...config, detected: detectedBlocks };
+      }
+    } catch (err2) {
+      errLog(`warning: AST adapter introspection failed: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    }
+  }
   const content = renderConfigYaml(config);
   const writeRes = writeConfigAtomic(configPath, content);
   if (!writeRes.validated) {
@@ -16849,7 +19068,7 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
       const stackResolved = !emptyStack && commandStats && (commandStats.installed > 0 || commandStats.updated > 0 || commandStats.kept > 0);
       if (!stackResolved) {
         const placeholderPath = resolve6(cmdResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (!existsSync9(placeholderPath)) {
+        if (!existsSync10(placeholderPath)) {
           const placeholderBody = [
             "# Massu \u2014 stack not yet detected",
             "",
@@ -16870,8 +19089,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
             "\u2014 Massu"
           ].join("\n");
           try {
-            mkdirSync3(resolve6(cmdResult.claudeDir, "commands"), { recursive: true });
-            writeFileSync(placeholderPath, placeholderBody, "utf-8");
+            mkdirSync4(resolve6(cmdResult.claudeDir, "commands"), { recursive: true });
+            writeFileSync2(placeholderPath, placeholderBody, "utf-8");
             log("  Wrote _massu-needs-stack.md placeholder (no stack detected yet)");
           } catch {
           }
@@ -16890,8 +19109,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
   (async () => {
     try {
       const encodedRoot = projectRoot.replace(/\//g, "-");
-      const memoryDir = resolve6(homedir2(), ".claude", "projects", encodedRoot, "memory");
-      const memFiles = existsSync9(memoryDir) ? readdirSync7(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
+      const memoryDir = resolve6(homedir3(), ".claude", "projects", encodedRoot, "memory");
+      const memFiles = existsSync10(memoryDir) ? readdirSync10(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
       if (memFiles.length > 0) {
         const { getMemoryDb: getMemoryDb2 } = await Promise.resolve().then(() => (init_memory_db(), memory_db_exports));
         const db = getMemoryDb2();
@@ -16951,7 +19170,7 @@ var init_init = __esm({
     init_detect();
     init_drift();
     __filename2 = fileURLToPath2(import.meta.url);
-    __dirname2 = dirname4(__filename2);
+    __dirname2 = dirname5(__filename2);
     FRAMEWORK_TO_TEMPLATE_ID = {
       rails: "rails",
       phoenix: "phoenix",
@@ -16973,7 +19192,7 @@ var init_init = __esm({
 });
 
 // src/license.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function tierLevel(tier) {
   return TIER_LEVELS[tier] ?? 0;
 }
@@ -16998,7 +19217,7 @@ function annotateToolDefinitions(defs) {
   });
 }
 async function validateLicense(apiKey) {
-  const keyHash = createHash3("sha256").update(apiKey).digest("hex");
+  const keyHash = createHash4("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     const cached = memDb.prepare(
@@ -17059,7 +19278,7 @@ async function validateLicense(apiKey) {
   }
 }
 function updateLicenseCache(apiKey, tier, validUntil, features = []) {
-  const keyHash = createHash3("sha256").update(apiKey).digest("hex");
+  const keyHash = createHash4("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     memDb.prepare(`
@@ -17267,17 +19486,17 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor,
   runValidateConfig: () => runValidateConfig
 });
-import { existsSync as existsSync10, readFileSync as readFileSync8, readdirSync as readdirSync8 } from "fs";
-import { resolve as resolve7, dirname as dirname5 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync11, readdirSync as readdirSync11 } from "fs";
+import { resolve as resolve7, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { parse as parseYaml4 } from "yaml";
 function checkConfig(projectRoot) {
   const configPath = resolve7(projectRoot, "massu.config.yaml");
-  if (!existsSync10(configPath)) {
+  if (!existsSync11(configPath)) {
     return { name: "Configuration", status: "fail", detail: "massu.config.yaml not found. Run: npx massu init" };
   }
   try {
-    const content = readFileSync8(configPath, "utf-8");
+    const content = readFileSync11(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       return { name: "Configuration", status: "fail", detail: "massu.config.yaml is empty or invalid YAML" };
@@ -17289,11 +19508,11 @@ function checkConfig(projectRoot) {
 }
 function checkMcpServer(projectRoot) {
   const mcpPath = getResolvedPaths().mcpJsonPath;
-  if (!existsSync10(mcpPath)) {
+  if (!existsSync11(mcpPath)) {
     return { name: "MCP Server", status: "fail", detail: ".mcp.json not found. Run: npx massu init" };
   }
   try {
-    const content = JSON.parse(readFileSync8(mcpPath, "utf-8"));
+    const content = JSON.parse(readFileSync11(mcpPath, "utf-8"));
     const servers = content.mcpServers ?? {};
     if (!servers.massu) {
       return { name: "MCP Server", status: "fail", detail: "massu not registered in .mcp.json. Run: npx massu init" };
@@ -17305,11 +19524,11 @@ function checkMcpServer(projectRoot) {
 }
 function checkHooksConfig(projectRoot) {
   const settingsPath = getResolvedPaths().settingsLocalPath;
-  if (!existsSync10(settingsPath)) {
+  if (!existsSync11(settingsPath)) {
     return { name: "Hooks Config", status: "fail", detail: ".claude/settings.local.json not found. Run: npx massu init" };
   }
   try {
-    const content = JSON.parse(readFileSync8(settingsPath, "utf-8"));
+    const content = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     if (!content.hooks) {
       return { name: "Hooks Config", status: "fail", detail: "No hooks configured. Run: npx massu install-hooks" };
     }
@@ -17335,9 +19554,9 @@ function checkHooksConfig(projectRoot) {
 function checkHookFiles(projectRoot) {
   const nodeModulesHooksDir = resolve7(projectRoot, "node_modules/@massu/core/dist/hooks");
   let hooksDir = nodeModulesHooksDir;
-  if (!existsSync10(nodeModulesHooksDir)) {
+  if (!existsSync11(nodeModulesHooksDir)) {
     const devHooksDir = resolve7(__dirname3, "../../dist/hooks");
-    if (existsSync10(devHooksDir)) {
+    if (existsSync11(devHooksDir)) {
       hooksDir = devHooksDir;
     } else {
       return { name: "Hook Files", status: "fail", detail: "Compiled hooks not found. Run: npm install @massu/core" };
@@ -17345,7 +19564,7 @@ function checkHookFiles(projectRoot) {
   }
   const missing = [];
   for (const hookFile of EXPECTED_HOOKS) {
-    if (!existsSync10(resolve7(hooksDir, hookFile))) {
+    if (!existsSync11(resolve7(hooksDir, hookFile))) {
       missing.push(hookFile);
     }
   }
@@ -17372,7 +19591,7 @@ function checkNodeVersion() {
 }
 async function checkGitRepo(projectRoot) {
   const gitDir = resolve7(projectRoot, ".git");
-  if (!existsSync10(gitDir)) {
+  if (!existsSync11(gitDir)) {
     return { name: "Git Repository", status: "warn", detail: "Not a git repository (optional but recommended)" };
   }
   try {
@@ -17390,7 +19609,7 @@ async function checkGitRepo(projectRoot) {
 }
 function checkKnowledgeDb(projectRoot) {
   const knowledgeDbPath = getResolvedPaths().memoryDbPath;
-  if (!existsSync10(knowledgeDbPath)) {
+  if (!existsSync11(knowledgeDbPath)) {
     return {
       name: "Knowledge DB",
       status: "warn",
@@ -17401,7 +19620,7 @@ function checkKnowledgeDb(projectRoot) {
 }
 function checkMemoryDir(_projectRoot2) {
   const memoryDir = getResolvedPaths().memoryDir;
-  if (!existsSync10(memoryDir)) {
+  if (!existsSync11(memoryDir)) {
     return {
       name: "Memory Directory",
       status: "warn",
@@ -17412,7 +19631,7 @@ function checkMemoryDir(_projectRoot2) {
 }
 function checkShellHooksWired(_projectRoot2) {
   const settingsPath = getResolvedPaths().settingsLocalPath;
-  if (!existsSync10(settingsPath)) {
+  if (!existsSync11(settingsPath)) {
     return {
       name: "Shell Hooks",
       status: "fail",
@@ -17420,7 +19639,7 @@ function checkShellHooksWired(_projectRoot2) {
     };
   }
   try {
-    const content = JSON.parse(readFileSync8(settingsPath, "utf-8"));
+    const content = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     const hooks = content.hooks ?? {};
     const hasSessionStart = Array.isArray(hooks.SessionStart) && hooks.SessionStart.length > 0;
     const hasPreToolUse = Array.isArray(hooks.PreToolUse) && hooks.PreToolUse.length > 0;
@@ -17472,7 +19691,7 @@ function checkPythonHealth(projectRoot) {
   const config = getConfig();
   if (!config.python?.root) return null;
   const pythonRoot = resolve7(projectRoot, config.python.root);
-  if (!existsSync10(pythonRoot)) {
+  if (!existsSync11(pythonRoot)) {
     return {
       name: "Python",
       status: "fail",
@@ -17486,15 +19705,15 @@ function checkPythonHealth(projectRoot) {
   function scanDir(dir, depth) {
     if (depth > 5) return;
     try {
-      const entries = readdirSync8(dir, { withFileTypes: true });
+      const entries = readdirSync11(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           const excludeDirs = config.python?.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
           if (!excludeDirs.includes(entry.name)) {
             const subdir = resolve7(dir, entry.name);
-            if (depth <= 2 && !existsSync10(resolve7(subdir, "__init__.py"))) {
+            if (depth <= 2 && !existsSync11(resolve7(subdir, "__init__.py"))) {
               try {
-                const subEntries = readdirSync8(subdir);
+                const subEntries = readdirSync11(subdir);
                 if (subEntries.some((f2) => f2.endsWith(".py") && f2 !== "__init__.py")) {
                   initPyMissing.push(entry.name);
                 }
@@ -17588,14 +19807,14 @@ async function runDoctor() {
 async function runValidateConfig() {
   const projectRoot = process.cwd();
   const configPath = resolve7(projectRoot, "massu.config.yaml");
-  if (!existsSync10(configPath)) {
+  if (!existsSync11(configPath)) {
     console.error("Error: massu.config.yaml not found in current directory");
     console.error("Run: npx massu init");
     process.exit(1);
     return;
   }
   try {
-    const content = readFileSync8(configPath, "utf-8");
+    const content = readFileSync11(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       console.error("Error: massu.config.yaml is empty or not a valid YAML object");
@@ -17634,7 +19853,7 @@ var init_doctor = __esm({
     init_config();
     init_license();
     __filename3 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname5(__filename3);
+    __dirname3 = dirname6(__filename3);
     EXPECTED_HOOKS = [
       "session-start.js",
       "session-end.js",
@@ -17680,7 +19899,7 @@ var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
 import { resolve as resolve8 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
@@ -17710,13 +19929,13 @@ async function runShowTemplate(args3) {
   }
   const suffix = choice.kind === "hit" ? choice.suffix : "";
   const file = suffix === "" ? resolve8(sourceDir, `${baseName}.md`) : resolve8(sourceDir, `${baseName}${suffix}.md`);
-  if (!existsSync11(file)) {
+  if (!existsSync12(file)) {
     process.stderr.write(`massu: resolved template "${file}" no longer exists
 `);
     process.exit(1);
     return;
   }
-  process.stdout.write(readFileSync9(file, "utf-8"));
+  process.stdout.write(readFileSync12(file, "utf-8"));
 }
 var init_show_template = __esm({
   "src/commands/show-template.ts"() {
@@ -17769,12 +19988,12 @@ var init_passthrough = __esm({
 });
 
 // src/lib/fileLock.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync10, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname6 } from "path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname7 } from "path";
 import * as lockfile from "proper-lockfile";
 function readLockHolderPid(lockPath) {
   try {
-    const raw = readFileSync10(`${lockPath}.pid`, "utf-8").trim();
+    const raw = readFileSync13(`${lockPath}.pid`, "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     if (!Number.isFinite(pid) || pid <= 0) return null;
     return pid;
@@ -17793,7 +20012,7 @@ function busyWaitSync(ms) {
   Atomics.wait(view, 0, 0, ms);
 }
 function withFileLockSync(lockPath, fn, opts = {}) {
-  mkdirSync4(dirname6(lockPath), { recursive: true });
+  mkdirSync5(dirname7(lockPath), { recursive: true });
   const staleMs = opts.staleMs ?? 3e4;
   const blockMs = opts.retries === 0 ? 0 : opts.blockMs ?? 3e4;
   const pollIntervalMs = opts.pollIntervalMs ?? 100;
@@ -17810,7 +20029,7 @@ function withFileLockSync(lockPath, fn, opts = {}) {
         realpath: false
       });
       try {
-        writeFileSync2(`${lockPath}.pid`, String(process.pid), "utf-8");
+        writeFileSync3(`${lockPath}.pid`, String(process.pid), "utf-8");
       } catch {
       }
       break;
@@ -17899,7 +20118,7 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync12, readFileSync as readFileSync11, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync14, rmSync as rmSync4 } from "fs";
 import { resolve as resolve10 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
@@ -18031,14 +20250,14 @@ async function runConfigRefresh(opts = {}) {
   const configPath = resolve10(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
-  if (!existsSync12(configPath)) {
+  if (!existsSync13(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     if (!opts.silent) process.stderr.write(message + "\n");
     return { exitCode: 1, applied: false, dryRun: !!opts.dryRun, diff: [], message };
   }
   let existing;
   try {
-    const content = readFileSync11(configPath, "utf-8");
+    const content = readFileSync14(configPath, "utf-8");
     const parsed = parseYaml5(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -18112,7 +20331,7 @@ async function runConfigRefresh(opts = {}) {
       const stackResolved = installResult.totalInstalled > 0 || installResult.totalUpdated > 0;
       if (stackResolved) {
         const placeholderPath = resolve10(installResult.claudeDir, "commands", "_massu-needs-stack.md");
-        if (existsSync12(placeholderPath)) {
+        if (existsSync13(placeholderPath)) {
           try {
             rmSync4(placeholderPath, { force: true });
             log("Removed _massu-needs-stack.md (stack now declared).\n");
@@ -18221,14 +20440,14 @@ var init_gitToplevel = __esm({
 });
 
 // src/watch/lockfile-detector.ts
-import { existsSync as existsSync13, statSync as statSync6 } from "fs";
+import { existsSync as existsSync14, statSync as statSync8 } from "fs";
 import { resolve as resolve11 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
     const p19 = resolve11(projectRoot, lf);
-    if (!existsSync13(p19)) continue;
+    if (!existsSync14(p19)) continue;
     try {
-      const stat = statSync6(p19);
+      const stat = statSync8(p19);
       const delta = now - stat.mtimeMs;
       if (delta >= 0 && delta < windowMs) return true;
     } catch {
@@ -18239,7 +20458,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync13(resolve11(projectRoot, ".git", s))) return true;
+    if (existsSync14(resolve11(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -18436,8 +20655,8 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync3, existsSync as existsSync14, fsyncSync as fsyncSync3, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync12, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync3, writeSync as writeSync3 } from "fs";
-import { dirname as dirname7, resolve as resolve12 } from "path";
+import { closeSync as closeSync3, existsSync as existsSync15, fsyncSync as fsyncSync3, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync4, writeSync as writeSync3 } from "fs";
+import { dirname as dirname8, resolve as resolve12 } from "path";
 function watchStatePath(projectRoot) {
   return resolve12(projectRoot, ".massu", "watch-state.json");
 }
@@ -18446,8 +20665,8 @@ function backupStatePath(projectRoot) {
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
-  if (!existsSync14(path)) return { ...DEFAULT_STATE };
-  const content = readFileSync12(path, "utf-8");
+  if (!existsSync15(path)) return { ...DEFAULT_STATE };
+  const content = readFileSync15(path, "utf-8");
   let raw;
   try {
     raw = JSON.parse(content);
@@ -18489,14 +20708,14 @@ function readState(projectRoot) {
 }
 function archiveCorrupt(projectRoot, content) {
   const bak = backupStatePath(projectRoot);
-  mkdirSync5(dirname7(bak), { recursive: true });
-  writeFileSync3(bak, content, "utf-8");
+  mkdirSync6(dirname8(bak), { recursive: true });
+  writeFileSync4(bak, content, "utf-8");
 }
 function writeStateAtomic(projectRoot, state) {
   const path = watchStatePath(projectRoot);
   writeStateAtomicCounter = writeStateAtomicCounter + 1 >>> 0;
   const tmp = `${path}.${process.pid}.${writeStateAtomicCounter}.tmp`;
-  mkdirSync5(dirname7(path), { recursive: true });
+  mkdirSync6(dirname8(path), { recursive: true });
   let renamed = false;
   try {
     const fd = openSync3(tmp, "w");
@@ -18507,10 +20726,10 @@ function writeStateAtomic(projectRoot, state) {
     } finally {
       closeSync3(fd);
     }
-    renameSync3(tmp, path);
+    renameSync4(tmp, path);
     renamed = true;
   } finally {
-    if (!renamed && existsSync14(tmp)) {
+    if (!renamed && existsSync15(tmp)) {
       try {
         rmSync5(tmp, { force: true });
       } catch {
@@ -18790,8 +21009,8 @@ __export(watch_exports, {
   runWatch: () => runWatch
 });
 import { spawnSync as spawnSync3 } from "child_process";
-import { basename as basename4, dirname as dirname8, resolve as resolve13 } from "path";
-import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync13 } from "fs";
+import { basename as basename5, dirname as dirname9, resolve as resolve13 } from "path";
+import { appendFileSync, existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync16 } from "fs";
 function parseFlags(args3) {
   const out2 = {
     foreground: false,
@@ -18817,7 +21036,7 @@ function parseFlags(args3) {
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
   const fixed = home ? resolve13(home, ".claude", "bin", "claude-bg") : null;
-  if (fixed && existsSync15(fixed)) return fixed;
+  if (fixed && existsSync16(fixed)) return fixed;
   const which = spawnSync3("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
     const p19 = which.stdout.trim();
@@ -18826,7 +21045,7 @@ function findClaudeBg() {
   return null;
 }
 function watchName(root) {
-  return `massu-watch-${basename4(root)}`;
+  return `massu-watch-${basename5(root)}`;
 }
 function printHelp(out2) {
   out2(`
@@ -18878,7 +21097,7 @@ async function runWatch(args3) {
 }
 function runStatus(root) {
   const path = watchStatePath(root);
-  if (!existsSync15(path)) {
+  if (!existsSync16(path)) {
     process.stdout.write("massu watch: not running (no state file)\n");
     return { exitCode: 0 };
   }
@@ -19036,18 +21255,18 @@ function refreshLogPath(projectRoot) {
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
   try {
-    mkdirSync6(dirname8(path), { recursive: true });
+    mkdirSync7(dirname9(path), { recursive: true });
     appendFileSync(path, JSON.stringify(event) + "\n", "utf-8");
   } catch {
   }
 }
 function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const path = refreshLogPath(projectRoot);
-  if (!existsSync15(path)) return [];
+  if (!existsSync16(path)) return [];
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
-  const lines = readFileSync13(path, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync16(path, "utf-8").split("\n").filter(Boolean);
   const tail = lines.slice(-limit);
   const out2 = [];
   let corrupt = 0;
@@ -19118,28 +21337,28 @@ var init_refresh_log = __esm({
 
 // src/security/atomic-write.ts
 import {
-  chmodSync as chmodSync2,
+  chmodSync as chmodSync3,
   closeSync as closeSync4,
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   fsyncSync as fsyncSync4,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   openSync as openSync4,
-  renameSync as renameSync4,
+  renameSync as renameSync5,
   rmSync as rmSync6,
-  statSync as statSync7,
+  statSync as statSync9,
   writeSync as writeSync4
 } from "node:fs";
-import { dirname as dirname9 } from "node:path";
+import { dirname as dirname10 } from "node:path";
 function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
-  const parentDir = dirname9(path);
+  const parentDir = dirname10(path);
   try {
-    if (!existsSync16(parentDir)) {
+    if (!existsSync17(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
       }
-      mkdirSync7(parentDir, mkdirOpts);
+      mkdirSync8(parentDir, mkdirOpts);
     }
     const buf = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
     const openMode = opts.mode ?? 420;
@@ -19151,12 +21370,12 @@ function atomicWrite(path, content, opts = {}) {
       closeSync4(fd);
     }
     if (opts.mode !== void 0) {
-      chmodSync2(tmpPath, opts.mode);
+      chmodSync3(tmpPath, opts.mode);
     }
-    renameSync4(tmpPath, path);
+    renameSync5(tmpPath, path);
     return { written: true };
   } catch (err2) {
-    if (existsSync16(tmpPath)) {
+    if (existsSync17(tmpPath)) {
       try {
         rmSync6(tmpPath, { force: true });
       } catch {
@@ -21460,9 +23679,9 @@ var init_registry_pubkey_generated = __esm({
 });
 
 // src/security/adapter-verifier.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 function sha256Hex(bytes) {
-  return createHash4("sha256").update(bytes).digest("hex");
+  return createHash5("sha256").update(bytes).digest("hex");
 }
 function reviver(key, value) {
   if (key === "__proto__" || key === "constructor" || key === "prototype") {
@@ -21724,24 +23943,24 @@ var init_fetcher = __esm({
 });
 
 // src/security/manifest-cache.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14, statSync as statSync8 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
+import { existsSync as existsSync18, readFileSync as readFileSync17, statSync as statSync10 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
 import { resolve as resolve14 } from "node:path";
 import { z as z4 } from "zod";
 function defaultCachePaths() {
-  const dir = resolve14(homedir3(), ".massu");
+  const dir = resolve14(homedir4(), ".massu");
   return {
     cachePath: resolve14(dir, "adapter-manifest.json"),
     lockPath: resolve14(dir, ".adapter-manifest.lock")
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
-  if (!existsSync17(paths.cachePath)) {
+  if (!existsSync18(paths.cachePath)) {
     return { kind: "absent" };
   }
   let raw;
   try {
-    const content = readFileSync14(paths.cachePath, "utf-8");
+    const content = readFileSync17(paths.cachePath, "utf-8");
     raw = JSON.parse(content);
   } catch (err2) {
     return {
@@ -21930,10 +24149,10 @@ var init_adapter_origin = __esm({
 });
 
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync18, readFileSync as readFileSync15, lstatSync as lstatSync3 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { existsSync as existsSync19, readFileSync as readFileSync18, lstatSync as lstatSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
 import { resolve as resolve15, isAbsolute } from "node:path";
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { z as z5 } from "zod";
 function computeLocalFingerprint(localPaths, projectRoot) {
   const tuples = [];
@@ -21941,13 +24160,13 @@ function computeLocalFingerprint(localPaths, projectRoot) {
     const abs = isAbsolute(p19) ? p19 : resolve15(projectRoot, p19);
     let contentTag;
     try {
-      const lst = lstatSync3(abs);
+      const lst = lstatSync5(abs);
       if (lst.isSymbolicLink()) {
         contentTag = "<symlink>";
       } else if (!lst.isFile()) {
         contentTag = "<not-a-file>";
       } else {
-        contentTag = createHash5("sha256").update(readFileSync15(abs)).digest("hex");
+        contentTag = createHash6("sha256").update(readFileSync18(abs)).digest("hex");
       }
     } catch {
       contentTag = "<missing>";
@@ -21956,13 +24175,13 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   }
   tuples.sort((a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0);
   const canonical = JSON.stringify(tuples);
-  return createHash5("sha256").update(canonical).digest("hex");
+  return createHash6("sha256").update(canonical).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
-  if (!existsSync18(path)) return null;
+  if (!existsSync19(path)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync15(path, "utf-8"));
+    raw = JSON.parse(readFileSync18(path, "utf-8"));
   } catch {
     return null;
   }
@@ -22010,7 +24229,7 @@ var init_local_fingerprint = __esm({
     "use strict";
     init_atomic_write();
     init_manifest_schema();
-    FINGERPRINT_PATH = resolve15(homedir4(), ".massu", "adapters-local-fingerprint.json");
+    FINGERPRINT_PATH = resolve15(homedir5(), ".massu", "adapters-local-fingerprint.json");
     FingerprintSentinelSchema = z5.object({
       fingerprint: z5.string().regex(/^[0-9a-f]{64}$/),
       source: z5.enum(["cli", "cli-resync"]),
@@ -22026,15 +24245,15 @@ var init_local_fingerprint = __esm({
 });
 
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync16, readdirSync as readdirSync9, lstatSync as lstatSync4, existsSync as existsSync19 } from "node:fs";
-import { join as join7, relative as relative4, sep } from "node:path";
-import { homedir as homedir5 } from "node:os";
+import { readFileSync as readFileSync19, readdirSync as readdirSync12, lstatSync as lstatSync6, existsSync as existsSync20 } from "node:fs";
+import { join as join10, relative as relative5, sep } from "node:path";
+import { homedir as homedir6 } from "node:os";
 import { resolve as resolve16 } from "node:path";
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { z as z6 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
-    if (existsSync19(`${packageDir}/${hidden}`)) {
+    if (existsSync20(`${packageDir}/${hidden}`)) {
       return hidden;
     }
   }
@@ -22046,15 +24265,15 @@ function sha256OfDir(dir, opts = {}) {
   function walk(currentDir) {
     let entries;
     try {
-      entries = readdirSync9(currentDir);
+      entries = readdirSync12(currentDir);
     } catch {
       return;
     }
     for (const entry of entries.sort()) {
-      const absPath = join7(currentDir, entry);
+      const absPath = join10(currentDir, entry);
       let lst;
       try {
-        lst = lstatSync4(absPath);
+        lst = lstatSync6(absPath);
       } catch {
         continue;
       }
@@ -22072,15 +24291,15 @@ function sha256OfDir(dir, opts = {}) {
           `sha256OfDir: file ${absPath} exceeds maxFileBytes (${lst.size} > ${maxFileBytes}); adapter packages should not ship files this large.`
         );
       }
-      const rel = relative4(dir, absPath).split(sep).join("/");
+      const rel = relative5(dir, absPath).split(sep).join("/");
       files.push({ relativePath: rel, absPath });
     }
   }
   walk(dir);
   files.sort((a2, b2) => a2.relativePath < b2.relativePath ? -1 : a2.relativePath > b2.relativePath ? 1 : 0);
-  const top = createHash6("sha256");
+  const top = createHash7("sha256");
   for (const f2 of files) {
-    const fileHash = createHash6("sha256").update(readFileSync16(f2.absPath)).digest("hex");
+    const fileHash = createHash7("sha256").update(readFileSync19(f2.absPath)).digest("hex");
     top.update(f2.relativePath, "utf-8");
     top.update("\0", "utf-8");
     top.update(fileHash, "utf-8");
@@ -22089,10 +24308,10 @@ function sha256OfDir(dir, opts = {}) {
   return top.digest("hex");
 }
 function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
-  if (!existsSync19(path)) return {};
+  if (!existsSync20(path)) return {};
   let raw;
   try {
-    raw = JSON.parse(readFileSync16(path, "utf-8"));
+    raw = JSON.parse(readFileSync19(path, "utf-8"));
   } catch {
     return {};
   }
@@ -22156,7 +24375,7 @@ var init_install_tracking = __esm({
   "src/security/install-tracking.ts"() {
     "use strict";
     init_atomic_write();
-    INSTALLED_MANIFEST_PATH = resolve16(homedir5(), ".massu", "adapter-manifest-installed.json");
+    INSTALLED_MANIFEST_PATH = resolve16(homedir6(), ".massu", "adapter-manifest-installed.json");
     DEFAULT_MAX_FILE_BYTES = 64 * 1024 * 1024;
     EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", ".cache", ".tmp"]);
     InstallEntrySchema = z6.object({
@@ -22179,18 +24398,18 @@ var init_install_tracking = __esm({
 });
 
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync20, readdirSync as readdirSync10, readFileSync as readFileSync17, lstatSync as lstatSync5 } from "node:fs";
+import { existsSync as existsSync21, readdirSync as readdirSync13, readFileSync as readFileSync20, lstatSync as lstatSync7 } from "node:fs";
 import { resolve as resolve17, isAbsolute as isAbsolute2 } from "node:path";
 import { z as z7 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
   const nodeModulesDir = resolve17(projectRoot, "node_modules");
-  if (!existsSync20(nodeModulesDir)) {
+  if (!existsSync21(nodeModulesDir)) {
     return [];
   }
   const candidates = [];
   let topLevelEntries;
   try {
-    topLevelEntries = readdirSync10(nodeModulesDir);
+    topLevelEntries = readdirSync13(nodeModulesDir);
   } catch (err2) {
     warnings.push(`failed to read node_modules: ${err2 instanceof Error ? err2.message : String(err2)}`);
     return [];
@@ -22200,7 +24419,7 @@ function walkNodeModules(projectRoot, warnings) {
     const entryPath = resolve17(nodeModulesDir, entry);
     let entryStat;
     try {
-      entryStat = lstatSync5(entryPath);
+      entryStat = lstatSync7(entryPath);
     } catch {
       continue;
     }
@@ -22214,7 +24433,7 @@ function walkNodeModules(projectRoot, warnings) {
     if (entry.startsWith("@")) {
       let scopedEntries;
       try {
-        scopedEntries = readdirSync10(entryPath);
+        scopedEntries = readdirSync13(entryPath);
       } catch {
         continue;
       }
@@ -22222,7 +24441,7 @@ function walkNodeModules(projectRoot, warnings) {
         const subPath = resolve17(entryPath, sub);
         let subStat;
         try {
-          subStat = lstatSync5(subPath);
+          subStat = lstatSync7(subPath);
         } catch {
           continue;
         }
@@ -22239,10 +24458,10 @@ function walkNodeModules(projectRoot, warnings) {
 }
 function tryReadAdapterPackage(packageDir, warnings) {
   const pkgJsonPath = resolve17(packageDir, "package.json");
-  if (!existsSync20(pkgJsonPath)) return null;
+  if (!existsSync21(pkgJsonPath)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync17(pkgJsonPath, "utf-8"));
+    raw = JSON.parse(readFileSync20(pkgJsonPath, "utf-8"));
   } catch (err2) {
     warnings.push(
       `skipping ${packageDir}: package.json parse failed (${err2 instanceof Error ? err2.message : String(err2)})`
@@ -22377,7 +24596,7 @@ function discoverAdapters(opts) {
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
     const absPath = isAbsolute2(localPath) ? localPath : resolve17(opts.projectRoot, localPath);
-    if (!existsSync20(absPath)) {
+    if (!existsSync21(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
       );
@@ -22458,7 +24677,7 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync21, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync21 } from "node:fs";
 import { resolve as resolve18 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args3) {
@@ -22727,7 +24946,7 @@ function mutateLocalArray(mutator, command) {
     return { exitCode: 2 };
   }
   const yamlPath = resolve18(projectRoot, "massu.config.yaml");
-  if (!existsSync21(yamlPath)) {
+  if (!existsSync22(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
 `
@@ -22736,7 +24955,7 @@ function mutateLocalArray(mutator, command) {
   }
   let yamlText;
   try {
-    yamlText = readFileSync18(yamlPath, "utf-8");
+    yamlText = readFileSync21(yamlPath, "utf-8");
   } catch (err2) {
     process.stderr.write(`${command}: failed to read ${yamlPath}: ${err2 instanceof Error ? err2.message : String(err2)}
 `);
@@ -22827,7 +25046,7 @@ async function runAdaptersInstall(args3) {
     return { exitCode: 1 };
   }
   const packageDir = resolve18(projectRoot, "node_modules", ...packageName.split("/"));
-  if (!existsSync21(packageDir)) {
+  if (!existsSync22(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
 `
@@ -22835,14 +25054,14 @@ async function runAdaptersInstall(args3) {
     return { exitCode: 1 };
   }
   const pkgJsonPath = resolve18(packageDir, "package.json");
-  if (!existsSync21(pkgJsonPath)) {
+  if (!existsSync22(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
     return { exitCode: 1 };
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync18(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(readFileSync21(pkgJsonPath, "utf-8"));
   } catch (err2) {
     process.stderr.write(`install: ${packageName} has malformed package.json: ${err2 instanceof Error ? err2.message : String(err2)}
 `);
@@ -22962,7 +25181,7 @@ async function runAdaptersResign(_args) {
       continue;
     }
     const packageDir = resolve18(projectRoot, "node_modules", ...name2.split("/"));
-    if (!existsSync21(packageDir)) {
+    if (!existsSync22(packageDir)) {
       removed++;
       warnings.push(`${name2}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
       removeInstalledManifestEntry(name2);
@@ -23049,11 +25268,11 @@ var init_adapters2 = __esm({
 
 // src/db.ts
 import Database2 from "better-sqlite3";
-import { dirname as dirname10, join as join8 } from "path";
-import { existsSync as existsSync22, mkdirSync as mkdirSync8, readdirSync as readdirSync11, statSync as statSync9 } from "fs";
+import { dirname as dirname11, join as join11 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync9, readdirSync as readdirSync14, statSync as statSync11 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
-  if (!existsSync22(dbPath)) {
+  if (!existsSync23(dbPath)) {
     throw new Error(`CodeGraph database not found at ${dbPath}. Run 'npx @colbymchenry/codegraph sync' first.`);
   }
   const db = new Database2(dbPath, { readonly: true });
@@ -23062,9 +25281,9 @@ function getCodeGraphDb() {
 }
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
-  const dir = dirname10(dbPath);
-  if (!existsSync22(dir)) {
-    mkdirSync8(dir, { recursive: true });
+  const dir = dirname11(dbPath);
+  if (!existsSync23(dir)) {
+    mkdirSync9(dir, { recursive: true });
   }
   const db = new Database2(dbPath);
   db.pragma("journal_mode = WAL");
@@ -23334,14 +25553,14 @@ function isPythonDataStale(dataDb2, pythonRoot) {
   const lastBuildTime = new Date(lastBuild.value).getTime();
   function checkDir(dir) {
     try {
-      const entries = readdirSync11(dir, { withFileTypes: true });
+      const entries = readdirSync14(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = join8(dir, entry.name);
+        const fullPath = join11(dir, entry.name);
         if (entry.isDirectory()) {
           if (["__pycache__", ".venv", "venv", "node_modules", ".mypy_cache", ".pytest_cache"].includes(entry.name)) continue;
           if (checkDir(fullPath)) return true;
         } else if (entry.name.endsWith(".py")) {
-          if (statSync9(fullPath).mtimeMs > lastBuildTime) return true;
+          if (statSync11(fullPath).mtimeMs > lastBuildTime) return true;
         }
       }
     } catch {
@@ -23437,8 +25656,8 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync19, existsSync as existsSync23, statSync as statSync10 } from "fs";
-import { resolve as resolve20, dirname as dirname11, join as join9 } from "path";
+import { readFileSync as readFileSync22, existsSync as existsSync24, statSync as statSync12 } from "fs";
+import { resolve as resolve20, dirname as dirname12, join as join12 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -23496,21 +25715,21 @@ function resolveImportPath(specifier, fromFile) {
     const paths = getResolvedPaths();
     basePath = resolve20(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve20(dirname11(fromFile), specifier);
+    basePath = resolve20(dirname12(fromFile), specifier);
   }
-  if (existsSync23(basePath) && !isDirectory(basePath)) {
+  if (existsSync24(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync23(withExt)) {
+    if (existsSync24(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
-    const indexPath = join9(basePath, indexFile);
-    if (existsSync23(indexPath)) {
+    const indexPath = join12(basePath, indexFile);
+    if (existsSync24(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -23518,7 +25737,7 @@ function resolveImportPath(specifier, fromFile) {
 }
 function isDirectory(path) {
   try {
-    return statSync10(path).isDirectory();
+    return statSync12(path).isDirectory();
   } catch {
     return false;
   }
@@ -23547,10 +25766,10 @@ function buildImportIndex(dataDb2, codegraphDb2) {
   let batch = [];
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve20(projectRoot, file.path), projectRoot);
-    if (!existsSync23(absPath)) continue;
+    if (!existsSync24(absPath)) continue;
     let source;
     try {
-      source = readFileSync19(absPath, "utf-8");
+      source = readFileSync22(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -23586,15 +25805,15 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync20, existsSync as existsSync24, readdirSync as readdirSync12 } from "fs";
-import { resolve as resolve21, join as join10 } from "path";
+import { readFileSync as readFileSync23, existsSync as existsSync25, readdirSync as readdirSync15 } from "fs";
+import { resolve as resolve21, join as join13 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync24(rootPath)) {
+  if (!existsSync25(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
-  const source = readFileSync20(rootPath, "utf-8");
+  const source = readFileSync23(rootPath, "utf-8");
   const mappings = [];
   const importMap = /* @__PURE__ */ new Map();
   const importRegex = /import\s+\{[^}]*?(\w+Router)[^}]*\}\s+from\s+['"]\.\/routers\/([^'"]+)['"]/g;
@@ -23606,12 +25825,12 @@ function parseRootRouter() {
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync24(candidate)) {
+      if (existsSync25(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
-      const indexCandidate = join10(fullPath, "index.ts");
-      if (existsSync24(indexCandidate)) {
+      const indexCandidate = join13(fullPath, "index.ts");
+      if (existsSync25(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -23631,8 +25850,8 @@ function parseRootRouter() {
 }
 function extractProcedures(routerFilePath) {
   const absPath = resolve21(getProjectRoot(), routerFilePath);
-  if (!existsSync24(absPath)) return [];
-  const source = readFileSync20(absPath, "utf-8");
+  if (!existsSync25(absPath)) return [];
+  const source = readFileSync23(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
   const procRegex = /(\w+)\s*:\s*(protected|public)Procedure/g;
@@ -23661,21 +25880,21 @@ function findUICallSites(routerKey, procedureName) {
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync24(dir)) continue;
+    if (!existsSync25(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
 }
 function searchDirectory(dir, pattern, results) {
-  const entries = readdirSync12(dir, { withFileTypes: true });
+  const entries = readdirSync15(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join10(dir, entry.name);
+    const fullPath = join13(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name === ".next") continue;
       searchDirectory(fullPath, pattern, results);
     } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
       try {
-        const source = readFileSync20(fullPath, "utf-8");
+        const source = readFileSync23(fullPath, "utf-8");
         const lines = source.split("\n");
         for (let i2 = 0; i2 < lines.length; i2++) {
           if (lines[i2].includes(pattern)) {
@@ -23738,7 +25957,7 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync21, existsSync as existsSync25 } from "fs";
+import { readFileSync as readFileSync24, existsSync as existsSync26 } from "fs";
 import { resolve as resolve22 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
@@ -23778,9 +25997,9 @@ function findRouterCalls(files) {
   const projectRoot = getProjectRoot();
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve22(projectRoot, file), projectRoot);
-    if (!existsSync25(absPath)) continue;
+    if (!existsSync26(absPath)) continue;
     try {
-      const source = readFileSync21(absPath, "utf-8");
+      const source = readFileSync24(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
       let match;
       while ((match = apiCallRegex.exec(source)) !== null) {
@@ -23799,9 +26018,9 @@ function findTablesFromRouters(routerNames, dataDb2) {
     ).all(routerName);
     for (const proc of procs) {
       const absPath = ensureWithinRoot(resolve22(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync25(absPath)) continue;
+      if (!existsSync26(absPath)) continue;
       try {
-        const source = readFileSync21(absPath, "utf-8");
+        const source = readFileSync24(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
         const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
         const tableRegex = new RegExp(regexStr + "\\.", "g");
@@ -24070,14 +26289,14 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync22, existsSync as existsSync26, readdirSync as readdirSync13 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync25, existsSync as existsSync27, readdirSync as readdirSync16 } from "fs";
+import { join as join14 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync26(schemaPath)) {
+  if (!existsSync27(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
-  const source = readFileSync22(schemaPath, "utf-8");
+  const source = readFileSync25(schemaPath, "utf-8");
   const models = [];
   const sourceLines = source.split("\n");
   let i2 = 0;
@@ -24135,14 +26354,14 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync26(routersDir)) return usage;
+  if (!existsSync27(routersDir)) return usage;
   scanDirectory(routersDir, tableName, usage);
   return usage;
 }
 function scanDirectory(dir, tableName, usage) {
-  const entries = readdirSync13(dir, { withFileTypes: true });
+  const entries = readdirSync16(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join11(dir, entry.name);
+    const fullPath = join14(dir, entry.name);
     if (entry.isDirectory()) {
       scanDirectory(fullPath, tableName, usage);
     } else if (entry.name.endsWith(".ts")) {
@@ -24152,7 +26371,7 @@ function scanDirectory(dir, tableName, usage) {
 }
 function scanFile(absPath, tableName, usage) {
   try {
-    const source = readFileSync22(absPath, "utf-8");
+    const source = readFileSync25(absPath, "utf-8");
     if (!source.includes(tableName)) return;
     const relPath = absPath.slice(getProjectRoot().length + 1);
     const lines = source.split("\n");
@@ -24197,15 +26416,15 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync26(dir)) return result;
-  const entries = readdirSync13(dir, { withFileTypes: true });
+  if (!existsSync27(dir)) return result;
+  const entries = readdirSync16(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join11(dir, entry.name);
+    const fullPath = join14(dir, entry.name);
     if (entry.isDirectory()) {
       result.push(...findFilesUsingColumn(fullPath, column, tableName));
     } else if (entry.name.endsWith(".ts")) {
       try {
-        const source = readFileSync22(fullPath, "utf-8");
+        const source = readFileSync25(fullPath, "utf-8");
         if (source.includes(tableName) && source.includes(column)) {
           result.push(fullPath.slice(getProjectRoot().length + 1));
         }
@@ -24350,48 +26569,48 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync23, existsSync as existsSync27, readdirSync as readdirSync14 } from "fs";
-import { resolve as resolve24, join as join12, relative as relative5, dirname as dirname12 } from "path";
+import { readFileSync as readFileSync26, existsSync as existsSync28, readdirSync as readdirSync17 } from "fs";
+import { resolve as resolve24, join as join15, relative as relative6, dirname as dirname13 } from "path";
 function resolvePythonModulePath(module2, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname12(resolve24(projectRoot, fromFile));
+    let baseDir = dirname13(resolve24(projectRoot, fromFile));
     for (let i2 = 1; i2 < level; i2++) {
-      baseDir = dirname12(baseDir);
+      baseDir = dirname13(baseDir);
     }
     const modulePart = module2.replace(/^\.+/, "");
     if (modulePart) {
       const parts3 = modulePart.split(".");
-      return tryResolvePythonPath(join12(baseDir, ...parts3), projectRoot);
+      return tryResolvePythonPath(join15(baseDir, ...parts3), projectRoot);
     }
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts2 = module2.split(".");
-  const candidate = join12(resolve24(projectRoot, pythonRoot), ...parts2);
+  const candidate = join15(resolve24(projectRoot, pythonRoot), ...parts2);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync27(basePath + ".py")) {
-    return relative5(projectRoot, basePath + ".py");
+  if (existsSync28(basePath + ".py")) {
+    return relative6(projectRoot, basePath + ".py");
   }
-  if (existsSync27(join12(basePath, "__init__.py"))) {
-    return relative5(projectRoot, join12(basePath, "__init__.py"));
+  if (existsSync28(join15(basePath, "__init__.py"))) {
+    return relative6(projectRoot, join15(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync27(basePath)) {
-    return relative5(projectRoot, basePath);
+  if (basePath.endsWith(".py") && existsSync28(basePath)) {
+    return relative6(projectRoot, basePath);
   }
   return null;
 }
 function walkPythonFiles(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync14(dir, { withFileTypes: true });
+    const entries = readdirSync17(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPythonFiles(join12(dir, entry.name), excludeDirs));
+        files.push(...walkPythonFiles(join15(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join12(dir, entry.name));
+        files.push(join15(dir, entry.name));
       }
     }
   } catch {
@@ -24414,10 +26633,10 @@ function buildPythonImportIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__
   });
   const batch = [];
   for (const absFile of files) {
-    const relFile = relative5(projectRoot, absFile);
+    const relFile = relative6(projectRoot, absFile);
     let source;
     try {
-      source = readFileSync23(absFile, "utf-8");
+      source = readFileSync26(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -24683,18 +26902,18 @@ var init_route_parser = __esm({
 });
 
 // src/python/route-indexer.ts
-import { readFileSync as readFileSync24, readdirSync as readdirSync15 } from "fs";
-import { join as join13, relative as relative6 } from "path";
+import { readFileSync as readFileSync27, readdirSync as readdirSync18 } from "fs";
+import { join as join16, relative as relative7 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync15(dir, { withFileTypes: true });
+    const entries = readdirSync18(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles(join13(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles(join16(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join13(dir, entry.name));
+        files.push(join16(dir, entry.name));
       }
     }
   } catch {
@@ -24703,7 +26922,7 @@ function walkPyFiles(dir, excludeDirs) {
 }
 function buildPythonRouteIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join13(projectRoot, pythonRoot);
+  const absRoot = join16(projectRoot, pythonRoot);
   dataDb2.exec("DELETE FROM massu_py_routes");
   dataDb2.exec("DELETE FROM massu_py_route_callers");
   const insertStmt = dataDb2.prepare(
@@ -24713,10 +26932,10 @@ function buildPythonRouteIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__"
   let count = 0;
   dataDb2.transaction(() => {
     for (const absFile of files) {
-      const relFile = relative6(projectRoot, absFile);
+      const relFile = relative7(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync24(absFile, "utf-8");
+        source = readFileSync27(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -24927,18 +27146,18 @@ var init_model_parser = __esm({
 });
 
 // src/python/model-indexer.ts
-import { readFileSync as readFileSync25, readdirSync as readdirSync16 } from "fs";
-import { join as join14, relative as relative7 } from "path";
+import { readFileSync as readFileSync28, readdirSync as readdirSync19 } from "fs";
+import { join as join17, relative as relative8 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync16(dir, { withFileTypes: true });
+    const entries = readdirSync19(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles2(join14(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles2(join17(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join14(dir, entry.name));
+        files.push(join17(dir, entry.name));
       }
     }
   } catch {
@@ -24947,7 +27166,7 @@ function walkPyFiles2(dir, excludeDirs) {
 }
 function buildPythonModelIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join14(projectRoot, pythonRoot);
+  const absRoot = join17(projectRoot, pythonRoot);
   dataDb2.exec("DELETE FROM massu_py_models");
   dataDb2.exec("DELETE FROM massu_py_fk_edges");
   const insertModel = dataDb2.prepare(
@@ -24960,10 +27179,10 @@ function buildPythonModelIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__"
   let count = 0;
   dataDb2.transaction(() => {
     for (const absFile of files) {
-      const relFile = relative7(projectRoot, absFile);
+      const relFile = relative8(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync25(absFile, "utf-8");
+        source = readFileSync28(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -25223,19 +27442,19 @@ var init_migration_parser = __esm({
 });
 
 // src/python/migration-indexer.ts
-import { readFileSync as readFileSync26, readdirSync as readdirSync17 } from "fs";
-import { join as join15, relative as relative8 } from "path";
+import { readFileSync as readFileSync29, readdirSync as readdirSync20 } from "fs";
+import { join as join18, relative as relative9 } from "path";
 function buildPythonMigrationIndex(dataDb2, alembicDir) {
   const projectRoot = getProjectRoot();
-  const absDir = join15(projectRoot, alembicDir);
+  const absDir = join18(projectRoot, alembicDir);
   dataDb2.exec("DELETE FROM massu_py_migrations");
-  const versionsDir = join15(absDir, "versions");
+  const versionsDir = join18(absDir, "versions");
   let files = [];
   try {
-    files = readdirSync17(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join15(versionsDir, f2));
+    files = readdirSync20(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join18(versionsDir, f2));
   } catch {
     try {
-      files = readdirSync17(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join15(absDir, f2));
+      files = readdirSync20(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join18(absDir, f2));
     } catch {
     }
   }
@@ -25249,7 +27468,7 @@ function buildPythonMigrationIndex(dataDb2, alembicDir) {
   for (const absFile of files) {
     let source;
     try {
-      source = readFileSync26(absFile, "utf-8");
+      source = readFileSync29(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -25260,7 +27479,7 @@ function buildPythonMigrationIndex(dataDb2, alembicDir) {
     rows.push({
       revision: parsed.revision,
       downRevision: parsed.downRevision,
-      file: relative8(projectRoot, absFile),
+      file: relative9(projectRoot, absFile),
       description: parsed.description,
       operations: JSON.stringify(parsed.operations)
     });
@@ -25283,12 +27502,12 @@ var init_migration_indexer = __esm({
 });
 
 // src/python/coupling-detector.ts
-import { readFileSync as readFileSync27, readdirSync as readdirSync18 } from "fs";
-import { join as join16, relative as relative9 } from "path";
+import { readFileSync as readFileSync30, readdirSync as readdirSync21 } from "fs";
+import { join as join19, relative as relative10 } from "path";
 function buildPythonCouplingIndex(dataDb2) {
   const projectRoot = getProjectRoot();
   const config = getConfig();
-  const srcDir = join16(projectRoot, config.paths.source);
+  const srcDir = join19(projectRoot, config.paths.source);
   const routes = dataDb2.prepare("SELECT id, method, path FROM massu_py_routes").all();
   if (routes.length === 0) return 0;
   dataDb2.exec("DELETE FROM massu_py_route_callers");
@@ -25317,10 +27536,10 @@ function buildPythonCouplingIndex(dataDb2) {
   ];
   dataDb2.transaction(() => {
     for (const absFile of frontendFiles) {
-      const relFile = relative9(projectRoot, absFile);
+      const relFile = relative10(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync27(absFile, "utf-8");
+        source = readFileSync30(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -25348,13 +27567,13 @@ function walkFrontendFiles(dir) {
   const files = [];
   const exclude = ["node_modules", ".next", "dist", ".git", "__pycache__", ".venv", "venv"];
   try {
-    const entries = readdirSync18(dir, { withFileTypes: true });
+    const entries = readdirSync21(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (exclude.includes(entry.name)) continue;
-        files.push(...walkFrontendFiles(join16(dir, entry.name)));
+        files.push(...walkFrontendFiles(join19(dir, entry.name)));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
-        files.push(join16(dir, entry.name));
+        files.push(join19(dir, entry.name));
       }
     }
   } catch {
@@ -25725,8 +27944,8 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync28, existsSync as existsSync28 } from "fs";
-import { resolve as resolve25, basename as basename5 } from "path";
+import { readFileSync as readFileSync31, existsSync as existsSync29 } from "fs";
+import { resolve as resolve25, basename as basename6 } from "path";
 function p3(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -25781,10 +28000,10 @@ function handleDocsToolCall(name2, args3) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync28(mapPath)) {
+  if (!existsSync29(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
-  return JSON.parse(readFileSync28(mapPath, "utf-8"));
+  return JSON.parse(readFileSync31(mapPath, "utf-8"));
 }
 function matchesPattern(filePath, pattern) {
   const regexStr = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
@@ -25793,7 +28012,7 @@ function matchesPattern(filePath, pattern) {
 function findAffectedMappings(docsMap, changedFiles) {
   const affected = /* @__PURE__ */ new Map();
   for (const file of changedFiles) {
-    const fileName = basename5(file);
+    const fileName = basename6(file);
     for (const mapping of docsMap.mappings) {
       let matched = false;
       for (const routePattern of mapping.appRoutes) {
@@ -25855,12 +28074,12 @@ function extractFrontmatter(content) {
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
   const absPath = ensureWithinRoot(resolve25(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync28(absPath)) {
-    const altPath = ensureWithinRoot(resolve25(getResolvedPaths().srcDir, "../server/api/routers", basename5(routerPath)), root);
-    if (!existsSync28(altPath)) return [];
-    return extractProcedureNamesFromContent(readFileSync28(altPath, "utf-8"));
+  if (!existsSync29(absPath)) {
+    const altPath = ensureWithinRoot(resolve25(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
+    if (!existsSync29(altPath)) return [];
+    return extractProcedureNamesFromContent(readFileSync31(altPath, "utf-8"));
   }
-  return extractProcedureNamesFromContent(readFileSync28(absPath, "utf-8"));
+  return extractProcedureNamesFromContent(readFileSync31(absPath, "utf-8"));
 }
 function extractProcedureNamesFromContent(content) {
   const procRegex = /\.(?:query|mutation)\s*\(/g;
@@ -25901,7 +28120,7 @@ function handleDocsAudit(args3) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
     const helpPagePath = ensureWithinRoot(resolve25(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync28(helpPagePath)) {
+    if (!existsSync29(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -25913,12 +28132,12 @@ function handleDocsAudit(args3) {
       });
       continue;
     }
-    const content = readFileSync28(helpPagePath, "utf-8");
+    const content = readFileSync31(helpPagePath, "utf-8");
     const sections = extractSections(content);
     const frontmatter = extractFrontmatter(content);
     const staleReasons = [];
     for (const file of triggeringFiles) {
-      const fileName = basename5(file);
+      const fileName = basename6(file);
       if (mapping.routers.includes(fileName)) {
         const procedures = extractProcedureNames(file);
         const undocumented = procedures.filter((p19) => !contentMentions(content, p19));
@@ -25949,13 +28168,13 @@ function handleDocsAudit(args3) {
       reason: staleReasons.length > 0 ? staleReasons.join("; ") : "Content appears current",
       sections,
       changedFiles: triggeringFiles,
-      suggestedAction: status === "STALE" ? `Review and update ${mapping.helpPage} to reflect changes in: ${triggeringFiles.map((f2) => basename5(f2)).join(", ")}` : "No action needed"
+      suggestedAction: status === "STALE" ? `Review and update ${mapping.helpPage} to reflect changes in: ${triggeringFiles.map((f2) => basename6(f2)).join(", ")}` : "No action needed"
     });
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
         const guidePath = ensureWithinRoot(resolve25(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync28(guidePath)) {
-          const guideContent = readFileSync28(guidePath, "utf-8");
+        if (existsSync29(guidePath)) {
+          const guideContent = readFileSync31(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
             results.push({
@@ -25989,13 +28208,13 @@ function handleDocsCoverage(args3) {
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
     const helpPagePath = ensureWithinRoot(resolve25(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync28(helpPagePath);
+    const exists = existsSync29(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
     let status = null;
     if (exists) {
-      const content = readFileSync28(helpPagePath, "utf-8");
+      const content = readFileSync31(helpPagePath, "utf-8");
       lineCount = content.split("\n").length;
       hasContent = lineCount > 10;
       const frontmatter = extractFrontmatter(content);
@@ -26336,7 +28555,7 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync29 } from "fs";
+import { existsSync as existsSync30 } from "fs";
 import { resolve as resolve26 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
@@ -26574,22 +28793,22 @@ function validateFeatures(db, domainFilter) {
     const missingPages = [];
     for (const comp of components) {
       const absPath = resolve26(PROJECT_ROOT, comp.component_file);
-      if (!existsSync29(absPath)) {
+      if (!existsSync30(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
       const routerPath = resolve26(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync29(routerPath)) {
+      if (!existsSync30(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
       const absPath = resolve26(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync29(absPath)) {
+      if (page.page_route.startsWith("/") && !existsSync30(absPath)) {
         const altPath = resolve26(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync29(altPath)) {
+        if (!existsSync30(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -27113,8 +29332,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync29, existsSync as existsSync30, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
-import { resolve as resolve27, join as join17, basename as basename6, dirname as dirname13, relative as relative10 } from "path";
+import { readFileSync as readFileSync32, existsSync as existsSync31, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { resolve as resolve27, join as join20, basename as basename7, dirname as dirname14, relative as relative11 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -27244,9 +29463,9 @@ function scanComponentExports(dataDb2) {
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
   const basePath = resolve27(projectRoot, componentsBase);
-  if (existsSync30(basePath)) {
+  if (existsSync31(basePath)) {
     try {
-      const entries = readdirSync19(basePath, { withFileTypes: true });
+      const entries = readdirSync22(basePath, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           componentDirs.push(componentsBase + "/" + entry.name);
@@ -27257,11 +29476,11 @@ function scanComponentExports(dataDb2) {
   }
   for (const dir of componentDirs) {
     const absDir = resolve27(projectRoot, dir);
-    if (!existsSync30(absDir)) continue;
-    const files = walkDir(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
+    if (!existsSync31(absDir)) continue;
+    const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
-      const relPath = relative10(projectRoot, file);
-      const source = readFileSync29(file, "utf-8");
+      const relPath = relative11(projectRoot, file);
+      const source = readFileSync32(file, "utf-8");
       const annotations = parseFeatureAnnotations(source);
       if (annotations.length > 0) {
         for (const ann of annotations) {
@@ -27287,7 +29506,7 @@ function scanComponentExports(dataDb2) {
       if (hasHandlers && exportMatch) {
         const componentName = exportMatch[1];
         const domain = inferDomain(relPath);
-        const subdomain = basename6(dirname13(relPath));
+        const subdomain = basename7(dirname14(relPath));
         const featureKey = `component.${subdomain}.${componentName.replace(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "")}`;
         if (!annotations.some((a2) => a2.featureKey === featureKey)) {
           features.push({
@@ -27307,16 +29526,16 @@ function scanComponentExports(dataDb2) {
   }
   return features;
 }
-function walkDir(dir) {
+function walkDir2(dir) {
   const results = [];
   try {
-    const entries = readdirSync19(dir);
+    const entries = readdirSync22(dir);
     for (const entry of entries) {
-      const fullPath = join17(dir, entry);
+      const fullPath = join20(dir, entry);
       try {
-        const stat = statSync11(fullPath);
+        const stat = statSync13(fullPath);
         if (stat.isDirectory()) {
-          results.push(...walkDir(fullPath));
+          results.push(...walkDir2(fullPath));
         } else {
           results.push(fullPath);
         }
@@ -28300,7 +30519,7 @@ var init_audit_trail = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync31, readFileSync as readFileSync30 } from "fs";
+import { existsSync as existsSync32, readFileSync as readFileSync33 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -28331,7 +30550,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync31(absPath)) {
+  if (!existsSync32(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -28340,7 +30559,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  const source = readFileSync30(absPath, "utf-8");
+  const source = readFileSync33(absPath, "utf-8");
   const lines = source.split("\n");
   if (activeChecks.rule_compliance !== false) {
     for (const ruleSet of config.rules) {
@@ -28785,7 +31004,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync32, readFileSync as readFileSync31 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync34 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -28809,12 +31028,12 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync32(absPath)) {
+  if (!existsSync33(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
   try {
-    source = readFileSync31(absPath, "utf-8");
+    source = readFileSync34(absPath, "utf-8");
   } catch {
     return { riskScore: 0, findings: [] };
   }
@@ -29103,7 +31322,7 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync33, readFileSync as readFileSync32 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync35 } from "fs";
 import { resolve as resolve28 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -29137,9 +31356,9 @@ function calculateDepRisk(factors) {
 }
 function getInstalledPackages(projectRoot) {
   const pkgPath = resolve28(projectRoot, "package.json");
-  if (!existsSync33(pkgPath)) return /* @__PURE__ */ new Map();
+  if (!existsSync34(pkgPath)) return /* @__PURE__ */ new Map();
   try {
-    const pkg = JSON.parse(readFileSync32(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync35(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
     for (const [name2, version] of Object.entries(pkg.dependencies ?? {})) {
       packages.set(name2, version);
@@ -29741,9 +31960,9 @@ var init_regression_detector = __esm({
 });
 
 // src/knowledge-indexer.ts
-import { createHash as createHash7 } from "crypto";
-import { readFileSync as readFileSync33, readdirSync as readdirSync20, statSync as statSync12, existsSync as existsSync34 } from "fs";
-import { resolve as resolve29, relative as relative11, basename as basename7, extname } from "path";
+import { createHash as createHash8 } from "crypto";
+import { readFileSync as readFileSync36, readdirSync as readdirSync23, statSync as statSync14, existsSync as existsSync35 } from "fs";
+import { resolve as resolve29, relative as relative12, basename as basename8, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
   const config = getConfig();
@@ -29769,7 +31988,7 @@ function discoverMarkdownFiles(baseDir) {
   const files = [];
   function walk(dir) {
     try {
-      const entries = readdirSync20(dir, { withFileTypes: true });
+      const entries = readdirSync23(dir, { withFileTypes: true });
       for (const entry of entries) {
         const fullPath = resolve29(dir, entry.name);
         if (entry.isDirectory()) {
@@ -29777,7 +31996,7 @@ function discoverMarkdownFiles(baseDir) {
           if (entry.name === "archive" && dir.includes("status")) continue;
           if (entry.name === "node_modules") continue;
           walk(fullPath);
-        } else if (entry.isFile() && extname(entry.name) === ".md") {
+        } else if (entry.isFile() && extname2(entry.name) === ".md") {
           files.push(fullPath);
         }
       }
@@ -29791,7 +32010,7 @@ function categorizeFile(filePath) {
   const paths = getKnowledgePaths();
   if (filePath.startsWith(paths.plansDir)) return "plan";
   if (filePath.startsWith(paths.docsDir)) {
-    const relFromDocs = relative11(paths.docsDir, filePath).replace(/\\/g, "/").toLowerCase();
+    const relFromDocs = relative12(paths.docsDir, filePath).replace(/\\/g, "/").toLowerCase();
     if (relFromDocs.startsWith("plans/")) return "plan";
     if (relFromDocs.includes("architecture")) return "architecture";
     if (relFromDocs.includes("security")) return "security";
@@ -29807,7 +32026,7 @@ function categorizeFile(filePath) {
   }
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
   if (filePath.includes(`${claudeDirName}/projects/`) && filePath.includes("/memory/")) return "memory";
-  const rel = relative11(paths.claudeDir, filePath).replace(/\\/g, "/");
+  const rel = relative12(paths.claudeDir, filePath).replace(/\\/g, "/");
   const firstDir = rel.split("/")[0];
   const knownCategories = getConfig().conventions?.knowledgeCategories ?? [
     "patterns",
@@ -29829,7 +32048,7 @@ function categorizeFile(filePath) {
   return "root";
 }
 function hashContent2(content) {
-  return createHash7("sha256").update(content).digest("hex");
+  return createHash8("sha256").update(content).digest("hex");
 }
 function parseCRTable(content) {
   const rules = [];
@@ -29948,7 +32167,7 @@ function parseCorrections(content) {
 function extractTitle(content, filePath) {
   const h1Match = content.match(/^#\s+(.+)/m);
   if (h1Match) return h1Match[1].trim();
-  return basename7(filePath, ".md");
+  return basename8(filePath, ".md");
 }
 function extractDescription2(content) {
   const fmMatch = content.match(/^---\s*\n[\s\S]*?description:\s*"?([^"\n]+)"?\s*\n[\s\S]*?---/);
@@ -29977,7 +32196,7 @@ function buildCrossReferences(db) {
       }
     }
     if (rule.reference_path) {
-      const patternName = basename7(rule.reference_path, ".md");
+      const patternName = basename8(rule.reference_path, ".md");
       insertEdge.run("cr", rule.rule_id, "pattern", patternName, "references");
       edgeCount++;
     }
@@ -30049,11 +32268,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync34(paths.plansDir)) {
+  if (existsSync35(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync34(paths.docsDir)) {
+  if (existsSync35(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -30096,10 +32315,10 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync34(filePath)) continue;
-      const content = readFileSync33(filePath, "utf-8");
+      if (!existsSync35(filePath)) continue;
+      const content = readFileSync36(filePath, "utf-8");
       const hash = hashContent2(content);
-      const relPath = filePath.startsWith(paths.claudeDir) ? relative11(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative11(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative11(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative11(paths.memoryDir, filePath)}` : basename7(filePath);
+      const relPath = filePath.startsWith(paths.claudeDir) ? relative12(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative12(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative12(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative12(paths.memoryDir, filePath)}` : basename8(filePath);
       const category = categorizeFile(filePath);
       const title = extractTitle(content, filePath);
       const description = extractDescription2(content);
@@ -30113,10 +32332,10 @@ function indexAllKnowledge(db) {
           stats.chunksCreated++;
         }
       }
-      const fileName = basename7(filePath);
+      const fileName = basename8(filePath);
       const fileNameLower = fileName.toLowerCase();
       const relPathLower = relPath.toLowerCase();
-      const claudeMdName = basename7(getResolvedPaths().claudeMdPath).toLowerCase();
+      const claudeMdName = basename8(getResolvedPaths().claudeMdPath).toLowerCase();
       if (fileNameLower === claudeMdName || relPathLower.includes(claudeMdName)) {
         const crRules = parseCRTable(content);
         for (const rule of crRules) {
@@ -30150,7 +32369,7 @@ function indexAllKnowledge(db) {
         }
       }
       if (category === "commands" && fileName !== "_shared-preamble.md") {
-        const cmdName = basename7(filePath, ".md");
+        const cmdName = basename8(filePath, ".md");
         insertChunk.run(docId, "command", cmdName, content.substring(0, 1e3), 1, null, JSON.stringify({ command_name: cmdName }));
         stats.chunksCreated++;
       }
@@ -30217,17 +32436,17 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync34(paths.plansDir)) {
+  if (existsSync35(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync34(paths.docsDir)) {
+  if (existsSync35(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
   }
   for (const filePath of files) {
     try {
-      const stat = statSync12(filePath);
+      const stat = statSync14(filePath);
       if (stat.mtimeMs > lastIndexTime) return true;
     } catch {
       continue;
@@ -30249,8 +32468,8 @@ var init_knowledge_indexer = __esm({
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync34, writeFileSync as writeFileSync4, appendFileSync as appendFileSync2, readdirSync as readdirSync21 } from "fs";
-import { resolve as resolve30, basename as basename8 } from "path";
+import { readFileSync as readFileSync37, writeFileSync as writeFileSync5, appendFileSync as appendFileSync2, readdirSync as readdirSync24 } from "fs";
+import { resolve as resolve30, basename as basename9 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -31000,14 +33219,14 @@ ${crRule ? `- **CR**: ${crRule}
 `;
   let existing = "";
   try {
-    existing = readFileSync34(correctionsPath, "utf-8");
+    existing = readFileSync37(correctionsPath, "utf-8");
   } catch {
   }
   const archiveIdx = existing.indexOf("## Archived");
   if (archiveIdx > 0) {
     const before = existing.slice(0, archiveIdx);
     const after = existing.slice(archiveIdx);
-    writeFileSync4(correctionsPath, before + entry + after);
+    writeFileSync5(correctionsPath, before + entry + after);
   } else {
     appendFileSync2(correctionsPath, entry);
   }
@@ -31049,7 +33268,7 @@ function handlePlan(db, args3) {
       AND kc.content LIKE ?
       ORDER BY kd.file_path DESC
       LIMIT 20
-    `).all(`%${basename8(file)}%`);
+    `).all(`%${basename9(file)}%`);
     lines.push(`## Plans referencing \`${file}\` (${results.length} found)`);
     lines.push("");
     for (const r2 of results) {
@@ -31182,7 +33401,7 @@ function handleGaps(db, args3) {
   } else if (checkType === "routers") {
     try {
       const routersDir = getResolvedPaths().routersDir;
-      const routerFiles = readdirSync21(routersDir).filter((f2) => f2.endsWith(".ts") && !f2.startsWith("_"));
+      const routerFiles = readdirSync24(routersDir).filter((f2) => f2.endsWith(".ts") && !f2.startsWith("_"));
       lines.push(`| Router | Knowledge Hits | Status |`);
       lines.push(`|--------|----------------|--------|`);
       for (const file of routerFiles) {
@@ -31338,13 +33557,13 @@ var init_knowledge_tools = __esm({
 
 // src/knowledge-db.ts
 import Database3 from "better-sqlite3";
-import { dirname as dirname14 } from "path";
-import { existsSync as existsSync36, mkdirSync as mkdirSync9 } from "fs";
+import { dirname as dirname15 } from "path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync10 } from "fs";
 function getKnowledgeDb() {
   const dbPath = getResolvedPaths().knowledgeDbPath;
-  const dir = dirname14(dbPath);
-  if (!existsSync36(dir)) {
-    mkdirSync9(dir, { recursive: true });
+  const dir = dirname15(dbPath);
+  if (!existsSync37(dir)) {
+    mkdirSync10(dir, { recursive: true });
   }
   const db = new Database3(dbPath);
   db.pragma("journal_mode = WAL");
@@ -32077,8 +34296,8 @@ var init_python_tools = __esm({
 });
 
 // src/tools.ts
-import { readFileSync as readFileSync35, existsSync as existsSync37 } from "fs";
-import { resolve as resolve31, basename as basename9 } from "path";
+import { readFileSync as readFileSync38, existsSync as existsSync38 } from "fs";
+import { resolve as resolve31, basename as basename10 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
 }
@@ -32513,8 +34732,8 @@ function handleContext(file, dataDb2, codegraphDb2) {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
           const absFilePath = ensureWithinRoot(resolve31(resolvedPaths.srcDir, "..", file), root);
-          if (existsSync37(absFilePath)) {
-            const fileContent = readFileSync35(absFilePath, "utf-8").slice(0, 3e3);
+          if (existsSync38(absFilePath)) {
+            const fileContent = readFileSync38(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
             if (fileContent.includes("BigInt") || fileContent.includes("Decimal")) keywords.push("BigInt", "serialization");
@@ -32608,7 +34827,7 @@ function handleContext(file, dataDb2, codegraphDb2) {
       WHERE o.files_involved LIKE ?
       ORDER BY o.importance DESC, o.created_at_epoch DESC
       LIMIT 5
-    `).all(`%${basename9(file)}%`);
+    `).all(`%${basename10(file)}%`);
     if (fileObservations.length > 0) {
       lines.push("## Past Observations (This File)");
       for (const obs of fileObservations) {
@@ -32624,7 +34843,7 @@ function handleContext(file, dataDb2, codegraphDb2) {
       WHERE type = 'failed_attempt' AND files_involved LIKE ?
       ORDER BY recurrence_count DESC
       LIMIT 3
-    `).all(`%${basename9(file)}%`);
+    `).all(`%${basename10(file)}%`);
     if (failures.length > 0) {
       lines.push("## Failed Attempts (DO NOT RETRY)");
       for (const f2 of failures) {
@@ -32939,10 +35158,10 @@ function handleSchema(args3) {
     lines.push("");
     const projectRoot = getProjectRoot();
     const absPath = ensureWithinRoot(resolve31(projectRoot, file), projectRoot);
-    if (!existsSync37(absPath)) {
+    if (!existsSync38(absPath)) {
       return text17(`File not found: ${file}`);
     }
-    const source = readFileSync35(absPath, "utf-8");
+    const source = readFileSync38(absPath, "utf-8");
     const config = getConfig();
     const dbPattern = config.dbAccessPattern ?? "ctx.db.{table}";
     const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
@@ -33020,8 +35239,8 @@ var init_tools = __esm({
 
 // src/server.ts
 var server_exports = {};
-import { readFileSync as readFileSync36 } from "fs";
-import { resolve as resolve32, dirname as dirname15 } from "path";
+import { readFileSync as readFileSync39 } from "fs";
+import { resolve as resolve32, dirname as dirname16 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function getDb() {
   if (!codegraphDb) codegraphDb = getCodeGraphDb();
@@ -33113,10 +35332,10 @@ var init_server = __esm({
     init_tools();
     init_memory_db();
     init_license();
-    __dirname4 = dirname15(fileURLToPath4(import.meta.url));
+    __dirname4 = dirname16(fileURLToPath4(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync36(resolve32(__dirname4, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync39(resolve32(__dirname4, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
@@ -33419,7 +35638,7 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync38, readFileSync as readFileSync37, writeFileSync as writeFileSync5, copyFileSync, unlinkSync } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync40, writeFileSync as writeFileSync6, copyFileSync, unlinkSync as unlinkSync2 } from "fs";
 import { resolve as resolve33 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
@@ -33431,14 +35650,14 @@ async function runConfigUpgrade(opts = {}) {
   const err2 = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
   if (opts.rollback) {
-    if (!existsSync38(bakPath)) {
+    if (!existsSync39(bakPath)) {
       const message = `No backup found at ${bakPath}`;
       err2(message + "\n");
       return { exitCode: 1, action: "none", message };
     }
     try {
       copyFileSync(bakPath, configPath);
-      unlinkSync(bakPath);
+      unlinkSync2(bakPath);
       log("Config restored from backup.\n");
       return { exitCode: 0, action: "rolled-back" };
     } catch (e2) {
@@ -33447,14 +35666,14 @@ async function runConfigUpgrade(opts = {}) {
       return { exitCode: 2, action: "none", message };
     }
   }
-  if (!existsSync38(configPath)) {
+  if (!existsSync39(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err2(message + "\n");
     return { exitCode: 1, action: "none", message };
   }
   let existing;
   try {
-    const content = readFileSync37(configPath, "utf-8");
+    const content = readFileSync40(configPath, "utf-8");
     const parsed = parseYaml6(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -33477,8 +35696,8 @@ async function runConfigUpgrade(opts = {}) {
     fingerprint: computeFingerprint(detection)
   };
   try {
-    const original = readFileSync37(configPath, "utf-8");
-    writeFileSync5(bakPath, original, "utf-8");
+    const original = readFileSync40(configPath, "utf-8");
+    writeFileSync6(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
     err2(message + "\n");
@@ -33511,7 +35730,7 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync39, readFileSync as readFileSync38 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync41 } from "fs";
 import { resolve as resolve34 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
@@ -33525,7 +35744,7 @@ async function runConfigCheckDrift(opts = {}) {
   } : (s) => process.stdout.write(s);
   const err2 = opts.silent ? () => {
   } : (s) => process.stderr.write(s);
-  if (!existsSync39(configPath)) {
+  if (!existsSync40(configPath)) {
     const message = "massu.config.yaml not found. Run: npx massu init";
     err2(message + "\n");
     return {
@@ -33539,7 +35758,7 @@ async function runConfigCheckDrift(opts = {}) {
   }
   let config;
   try {
-    const content = readFileSync38(configPath, "utf-8");
+    const content = readFileSync41(configPath, "utf-8");
     const parsed = parseYaml7(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -33606,11 +35825,11 @@ var init_config_check_drift = __esm({
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync39 } from "fs";
-import { resolve as resolve35, dirname as dirname16 } from "path";
+import { readFileSync as readFileSync42 } from "fs";
+import { resolve as resolve35, dirname as dirname17 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 var __filename4 = fileURLToPath5(import.meta.url);
-var __dirname5 = dirname16(__filename4);
+var __dirname5 = dirname17(__filename4);
 var args2 = process.argv.slice(2);
 var subcommand = args2[0];
 async function main() {
@@ -33792,7 +36011,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync39(resolve35(__dirname5, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync42(resolve35(__dirname5, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");