@massu/core 1.5.7 → 1.6.0

package/dist/cli.js

@@ -11159,22 +11159,440 @@ var init_python_flask = __esm({
   }
 });
 
-// src/detect/adapters/go-chi.ts
-import { Parser as Parser7 } from "web-tree-sitter";
+// dist/adapter.js
+import { Query as Query2 } from "web-tree-sitter";
+import { createHash as createHash3 } from "crypto";
+import {
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync9,
+  readFileSync as readFileSync9,
+  writeFileSync as writeFileSync2,
+  renameSync as renameSync3,
+  unlinkSync as unlinkSync2,
+  lstatSync as lstatSync4,
+  chmodSync as chmodSync2,
+  utimesSync as utimesSync2
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname5, join as join9 } from "path";
+import { Language as Language2, Parser as Parser7 } from "web-tree-sitter";
+function compileQuery2(language, source, queryName) {
+  let perLang = queryCache2.get(language);
+  if (!perLang) {
+    perLang = /* @__PURE__ */ new Map();
+    queryCache2.set(language, perLang);
+  }
+  const cached = perLang.get(source);
+  if (cached) return cached;
+  let q2;
+  try {
+    q2 = new Query2(language, source);
+  } catch (e2) {
+    throw new InvalidQueryError2(queryName, source, e2);
+  }
+  perLang.set(source, q2);
+  return q2;
+}
+function runQuery2(parser, source, queryText, queryName, filePath) {
+  const language = parser.language;
+  if (!language) {
+    throw new InvalidQueryError2(
+      queryName,
+      queryText,
+      new Error("Parser has no language assigned")
+    );
+  }
+  const query = compileQuery2(language, queryText, queryName);
+  const tree = parser.parse(source);
+  if (!tree) return [];
+  let matches;
+  try {
+    matches = query.matches(tree.rootNode);
+  } catch (e2) {
+    throw new InvalidQueryError2(queryName, queryText, e2);
+  }
+  const out = [];
+  for (const match of matches) {
+    if (!match.captures || match.captures.length === 0) continue;
+    const captures = {};
+    let earliestLine = Number.POSITIVE_INFINITY;
+    for (const cap of match.captures) {
+      const node = cap.node;
+      captures[cap.name] = node.text;
+      if (node.startPosition.row + 1 < earliestLine) {
+        earliestLine = node.startPosition.row + 1;
+      }
+    }
+    out.push({
+      captures,
+      file: filePath,
+      line: Number.isFinite(earliestLine) ? earliestLine : 1,
+      queryName
+    });
+  }
+  try {
+    tree.delete();
+  } catch {
+  }
+  return out;
+}
+function getCacheDir2() {
+  return process.env.MASSU_WASM_CACHE_DIR ?? join9(homedir3(), ".massu", "wasm-cache");
+}
+function getCachedPath2(language, sha) {
+  return join9(getCacheDir2(), `${language}-${sha}.wasm`);
+}
+function getCacheRetainCount2() {
+  const env = process.env.MASSU_WASM_CACHE_RETAIN;
+  if (env) {
+    const n = Number(env);
+    if (Number.isFinite(n) && n >= 1 && n <= 1024) return Math.floor(n);
+  }
+  return DEFAULT_CACHE_RETAIN_COUNT2;
+}
+function touchCacheFile2(path) {
+  try {
+    const now = /* @__PURE__ */ new Date();
+    utimesSync2(path, now, now);
+  } catch {
+  }
+}
+function evictBeyondRetainCount2(retain = getCacheRetainCount2()) {
+  const dir = getCacheDir2();
+  let entries;
+  try {
+    entries = readdirSync9(dir);
+  } catch {
+    return;
+  }
+  const candidates = [];
+  for (const name of entries) {
+    if (!name.endsWith(".wasm")) continue;
+    const path = join9(dir, name);
+    let stat;
+    try {
+      stat = lstatSync4(path);
+    } catch {
+      continue;
+    }
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      console.error(
+        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).`
+      );
+      continue;
+    }
+    candidates.push({ path, mtimeMs: stat.mtimeMs });
+  }
+  if (candidates.length <= retain) return;
+  candidates.sort((a2, b2) => b2.mtimeMs - a2.mtimeMs);
+  for (const victim of candidates.slice(retain)) {
+    try {
+      unlinkSync2(victim.path);
+    } catch {
+    }
+  }
+}
+function sha2562(bytes) {
+  return createHash3("sha256").update(bytes).digest("hex");
+}
+async function ensureParserInitialized2() {
+  if (parserInitPromise2) return parserInitPromise2;
+  parserInitPromise2 = Parser7.init();
+  return parserInitPromise2;
+}
+async function loadGrammar2(language, options = {}) {
+  await ensureParserInitialized2();
+  const cached = loadedGrammars2.get(language);
+  if (cached) return cached;
+  const manifest = options.manifestOverride?.[language] ?? GRAMMAR_MANIFEST2[language];
+  if (!manifest) {
+    throw new GrammarUnavailableError2(
+      language,
+      new Error(`No manifest entry for language "${language}". v1 supports: ${Object.keys(GRAMMAR_MANIFEST2).join(", ")}.`)
+    );
+  }
+  const cachePath = getCachedPath2(language, manifest.sha256);
+  let cacheLstat;
+  try {
+    cacheLstat = lstatSync4(cachePath);
+  } catch {
+    cacheLstat = null;
+  }
+  if (cacheLstat) {
+    if (cacheLstat.isSymbolicLink() || !cacheLstat.isFile()) {
+      throw new GrammarCacheSymlinkError2(cachePath);
+    }
+    let bytes;
+    try {
+      bytes = readFileSync9(cachePath);
+    } catch (e2) {
+      bytes = new Uint8Array(0);
+    }
+    if (bytes.byteLength > 0) {
+      const actualSha = sha2562(bytes);
+      if (actualSha !== manifest.sha256) {
+        throw new GrammarSHAMismatchError2(language, manifest.sha256, actualSha);
+      }
+      const lang2 = await Language2.load(bytes);
+      loadedGrammars2.set(language, lang2);
+      touchCacheFile2(cachePath);
+      return lang2;
+    }
+  }
+  if (!/^https:\/\//i.test(manifest.url)) {
+    throw new GrammarUrlNotHttpsError2(manifest.url);
+  }
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (!fetchImpl) {
+    throw new GrammarUnavailableError2(
+      language,
+      new Error("No fetch implementation available (Node < 18?)")
+    );
+  }
+  let body;
+  try {
+    const res = await fetchImpl(manifest.url);
+    if (!res.ok) {
+      throw new Error(`HTTP ${res.status ?? "unknown"} from ${manifest.url}`);
+    }
+    body = new Uint8Array(await res.arrayBuffer());
+  } catch (e2) {
+    throw new GrammarUnavailableError2(language, e2);
+  }
+  const downloadedSha = sha2562(body);
+  if (downloadedSha !== manifest.sha256) {
+    throw new GrammarSHAMismatchError2(language, manifest.sha256, downloadedSha);
+  }
+  try {
+    mkdirSync4(dirname5(cachePath), { recursive: true, mode: 448 });
+    try {
+      chmodSync2(dirname5(cachePath), 448);
+    } catch {
+    }
+    const tmpPath = `${cachePath}.tmp.${process.pid}`;
+    writeFileSync2(tmpPath, body, { mode: 384 });
+    try {
+      chmodSync2(tmpPath, 384);
+    } catch {
+    }
+    try {
+      renameSync3(tmpPath, cachePath);
+      try {
+        chmodSync2(cachePath, 384);
+      } catch {
+      }
+    } catch (e2) {
+      try {
+        unlinkSync2(tmpPath);
+      } catch {
+      }
+      throw e2;
+    }
+    evictBeyondRetainCount2();
+  } catch (e2) {
+    console.error(
+      `[tree-sitter-loader] cache write failed for ${language}: ${e2 instanceof Error ? e2.message : String(e2)} \u2014 loading directly from memory.`
+    );
+  }
+  const lang = await Language2.load(body);
+  loadedGrammars2.set(language, lang);
+  return lang;
+}
+function isParsableSource2(source, sizeBytes) {
+  const bytes = sizeBytes ?? Buffer.byteLength(source, "utf-8");
+  if (bytes > MAX_AST_FILE_BYTES2) {
+    return {
+      reason: "size-cap",
+      detail: `${bytes} bytes > ${MAX_AST_FILE_BYTES2} cap`
+    };
+  }
+  let depth = 0;
+  let maxDepth = 0;
+  for (let i = 0; i < source.length; i++) {
+    const c2 = source.charCodeAt(i);
+    if (c2 === 0) {
+      return { reason: "control-bytes", detail: "NUL byte at offset " + i };
+    }
+    if (c2 === 40 || c2 === 91 || c2 === 123) {
+      depth++;
+      if (depth > maxDepth) maxDepth = depth;
+      if (depth > MAX_AST_PARSE_DEPTH2) {
+        return {
+          reason: "depth-cap",
+          detail: `nesting depth exceeded ${MAX_AST_PARSE_DEPTH2}`
+        };
+      }
+    } else if (c2 === 41 || c2 === 93 || c2 === 125) {
+      depth = depth > 0 ? depth - 1 : 0;
+    }
+  }
+  return null;
+}
+var InvalidQueryError2, queryCache2, GrammarSHAMismatchError2, GrammarUnavailableError2, GrammarCacheSymlinkError2, GrammarUrlNotHttpsError2, GRAMMAR_MANIFEST2, DEFAULT_CACHE_RETAIN_COUNT2, parserInitPromise2, loadedGrammars2, MAX_AST_FILE_BYTES2, MAX_AST_PARSE_DEPTH2;
+var init_adapter = __esm({
+  "dist/adapter.js"() {
+    "use strict";
+    InvalidQueryError2 = class extends Error {
+      queryName;
+      querySource;
+      cause;
+      constructor(queryName, querySource, cause) {
+        const causeMsg = cause instanceof Error ? cause.message : String(cause);
+        super(
+          `[query-helpers] Invalid Tree-sitter query "${queryName}": ${causeMsg}
+Query source:
+${querySource}`
+        );
+        this.name = "InvalidQueryError";
+        this.queryName = queryName;
+        this.querySource = querySource;
+        this.cause = cause;
+      }
+    };
+    queryCache2 = /* @__PURE__ */ new WeakMap();
+    GrammarSHAMismatchError2 = class extends Error {
+      language;
+      expected;
+      actual;
+      constructor(language, expected, actual) {
+        super(
+          `[tree-sitter-loader] SHA-256 mismatch for grammar "${language}". Expected ${expected}, got ${actual}. REFUSING to load \u2014 see Phase 3.5 audit attack vector #3.`
+        );
+        this.name = "GrammarSHAMismatchError";
+        this.language = language;
+        this.expected = expected;
+        this.actual = actual;
+      }
+    };
+    GrammarUnavailableError2 = class extends Error {
+      language;
+      cause;
+      constructor(language, cause) {
+        const causeMsg = cause instanceof Error ? cause.message : cause ? String(cause) : "no cached grammar and download failed";
+        super(
+          `[tree-sitter-loader] Grammar for "${language}" is unavailable: ${causeMsg}. Falling back to regex introspection for files in ${language}.`
+        );
+        this.name = "GrammarUnavailableError";
+        this.language = language;
+        this.cause = cause;
+      }
+    };
+    GrammarCacheSymlinkError2 = class extends Error {
+      cachePath;
+      constructor(cachePath) {
+        super(
+          `[tree-sitter-loader] Refusing to load grammar \u2014 cache path "${cachePath}" is a symlink or non-regular file. (Phase 3.5 finding #3 \u2014 symlink attack vector.)`
+        );
+        this.name = "GrammarCacheSymlinkError";
+        this.cachePath = cachePath;
+      }
+    };
+    GrammarUrlNotHttpsError2 = class extends Error {
+      url;
+      constructor(url) {
+        super(
+          `[tree-sitter-loader] Refusing to download grammar from non-HTTPS URL: ${url}. Only https:// URLs are accepted. (Phase 3.5 finding #3.)`
+        );
+        this.name = "GrammarUrlNotHttpsError";
+        this.url = url;
+      }
+    };
+    GRAMMAR_MANIFEST2 = {
+      python: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-python.wasm",
+        sha256: "9056d0fb0c337810d019fae350e8167786119da98f0f282aceae7ab89ee8253b",
+        version: "0.1.13"
+      },
+      typescript: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-typescript.wasm",
+        sha256: "8515404dceed38e1ed86aa34b09fcf3379fff1b4ff9dd3967bcd6d1eb5ac3d8f",
+        version: "0.1.13"
+      },
+      javascript: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-javascript.wasm",
+        sha256: "63812b9e275d26851264734868d27a1656bd44a2ef6eb3e85e6b03728c595ab5",
+        version: "0.1.13"
+      },
+      swift: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-swift.wasm",
+        sha256: "41c4fdb2249a3aa6d87eed0d383081ff09725c2248b4977043a43825980ffcc7",
+        version: "0.1.13"
+      },
+      // ----------------------------------------------------------------
+      // Plan 3c Phase 7 expansion (2026-05-07):
+      //
+      // Six additional grammars to support the registry-verified framework
+      // adapters (go-chi, rails, aspnet, spring, ktor, phoenix) plus the
+      // bundled adapters in the same language families (gin/echo/fiber,
+      // sinatra, etc.). All entries use the SAME pinned tree-sitter-wasms
+      // version (0.1.13) as the v1 four to keep the dependency surface
+      // single-source.
+      //
+      // SHA-256s computed 2026-05-07 via:
+      //   curl -fsSL <url> | shasum -a 256
+      //
+      // The unpkg filename for C# uses an underscore (`c_sharp`) while the
+      // TreeSitterLanguage identifier uses no separator (`csharp`); the map
+      // key is the type identifier, the URL is the storage path — they do
+      // NOT need to match, the same as how `python` maps to `tree-sitter-
+      // python.wasm`. This is intentional and validated by the manifest
+      // shape test in tree-sitter-loader-manifest.test.ts.
+      // ----------------------------------------------------------------
+      go: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-go.wasm",
+        sha256: "9963ca89b616eaf04b08a43bc1fb0f07b85395bec313330851f1f1ead2f755b6",
+        version: "0.1.13"
+      },
+      ruby: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-ruby.wasm",
+        sha256: "93a5022855314cdb45458c7bb026a24a0ebc3a5ff6439e542e881f14dfa13a39",
+        version: "0.1.13"
+      },
+      csharp: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-c_sharp.wasm",
+        sha256: "6266a7e32d68a3459104d994dc848df15d5672b0ea8e86d327274b694f8e6991",
+        version: "0.1.13"
+      },
+      java: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-java.wasm",
+        sha256: "637aac4415fb39a211a4f4292d63c66b5ce9c32fa2cd35464af4f681d91b9a1f",
+        version: "0.1.13"
+      },
+      kotlin: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-kotlin.wasm",
+        sha256: "b5cb00c8d06ed0f10f1dbe497205b437809d7e87db1f638721a8cfb30e044449",
+        version: "0.1.13"
+      },
+      elixir: {
+        url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-elixir.wasm",
+        sha256: "82e91b9759ddca30d8978ebbfa8e347b4451b64c931f9ae62112e6db9b8fac20",
+        version: "0.1.13"
+      }
+    };
+    DEFAULT_CACHE_RETAIN_COUNT2 = 16;
+    parserInitPromise2 = null;
+    loadedGrammars2 = /* @__PURE__ */ new Map();
+    MAX_AST_FILE_BYTES2 = 1 * 1024 * 1024;
+    MAX_AST_PARSE_DEPTH2 = 5e3;
+  }
+});
+
+// ../adapter-go-chi/dist/index.js
+import { Parser as Parser8 } from "web-tree-sitter";
 function extractPrefixBase4(prefix3) {
-  if (!prefix3.startsWith("/")) return null;
+  if (!prefix3.startsWith("/"))
+    return null;
   const stripped = prefix3.replace(/^\/+/, "");
   const firstSeg = stripped.split("/")[0];
-  if (!firstSeg) return null;
+  if (!firstSeg)
+    return null;
   return "/" + firstSeg;
 }
 var ROUTE_METHOD_QUERY, MOUNT_PREFIX_QUERY, MIDDLEWARE_USE_QUERY, goChiAdapter;
-var init_go_chi = __esm({
-  "src/detect/adapters/go-chi.ts"() {
+var init_dist = __esm({
+  "../adapter-go-chi/dist/index.js"() {
     "use strict";
-    init_query_helpers();
-    init_tree_sitter_loader();
-    init_parse_guard();
+    init_adapter();
     ROUTE_METHOD_QUERY = `
 (call_expression
   function: (selector_expression
@@ -11205,8 +11623,10 @@ var init_go_chi = __esm({
       id: "go-chi",
       languages: ["go"],
       matches(signals) {
-        if (!signals.goMod) return false;
-        if (/github\.com\/go-chi\/chi/i.test(signals.goMod)) return true;
+        if (!signals.goMod)
+          return false;
+        if (/github\.com\/go-chi\/chi/i.test(signals.goMod))
+          return true;
         return false;
       },
       async introspect(files, _rootDir) {
@@ -11215,49 +11635,48 @@ var init_go_chi = __esm({
         }
         let language;
         try {
-          language = await loadGrammar("go");
+          language = await loadGrammar2("go");
         } catch (e2) {
           return { conventions: {}, provenance: [], confidence: "none" };
         }
-        const parser = new Parser7();
+        const parser = new Parser8();
         parser.setLanguage(language);
         const routeMethods = /* @__PURE__ */ new Map();
         const mountBases = /* @__PURE__ */ new Map();
         const middlewareNames = /* @__PURE__ */ new Map();
         try {
           for (const file of files) {
-            const skip = isParsableSource(file.content, file.size);
+            const skip = isParsableSource2(file.content, file.size);
             if (skip) {
-              process.stderr.write(
-                `[massu/ast] WARN: go-chi skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
-`
-              );
+              process.stderr.write(`[massu/ast] WARN: go-chi skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES2}. (Phase 3.5 mitigation)
+`);
               continue;
             }
             try {
-              for (const hit of runQuery(parser, file.content, ROUTE_METHOD_QUERY, "chi-route-method", file.path)) {
+              for (const hit of runQuery2(parser, file.content, ROUTE_METHOD_QUERY, "chi-route-method", file.path)) {
                 const method = hit.captures.method;
                 if (method && !routeMethods.has(method)) {
                   routeMethods.set(method, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, MOUNT_PREFIX_QUERY, "chi-mount-prefix", file.path)) {
+              for (const hit of runQuery2(parser, file.content, MOUNT_PREFIX_QUERY, "chi-mount-prefix", file.path)) {
                 const raw = hit.captures.mount_path;
-                if (!raw) continue;
+                if (!raw)
+                  continue;
                 const literal = raw.replace(/^["`]/, "").replace(/["`]$/, "");
                 const base = extractPrefixBase4(literal);
                 if (base && !mountBases.has(base)) {
                   mountBases.set(base, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, MIDDLEWARE_USE_QUERY, "chi-middleware-use", file.path)) {
+              for (const hit of runQuery2(parser, file.content, MIDDLEWARE_USE_QUERY, "chi-middleware-use", file.path)) {
                 const name = hit.captures.middleware_name;
                 if (name && !middlewareNames.has(name)) {
                   middlewareNames.set(name, { line: hit.line, file: file.path });
                 }
               }
             } catch (e2) {
-              if (e2 instanceof InvalidQueryError) {
+              if (e2 instanceof InvalidQueryError2) {
                 throw e2;
               }
               continue;
@@ -11306,21 +11725,28 @@ var init_go_chi = __esm({
   }
 });
 
-// src/detect/adapters/rails.ts
-import { Parser as Parser8 } from "web-tree-sitter";
+// src/detect/adapters/go-chi.ts
+var init_go_chi = __esm({
+  "src/detect/adapters/go-chi.ts"() {
+    "use strict";
+    init_dist();
+  }
+});
+
+// ../adapter-rails/dist/index.js
+import { Parser as Parser9 } from "web-tree-sitter";
 function extractRootController(target) {
   const idx = target.indexOf("#");
-  if (idx <= 0) return null;
+  if (idx <= 0)
+    return null;
   const controller = target.slice(0, idx).trim();
   return controller || null;
 }
 var ROUTE_METHOD_QUERY2, NAMESPACE_QUERY, ROOT_ROUTE_QUERY, railsAdapter;
-var init_rails = __esm({
-  "src/detect/adapters/rails.ts"() {
+var init_dist2 = __esm({
+  "../adapter-rails/dist/index.js"() {
     "use strict";
-    init_query_helpers();
-    init_tree_sitter_loader();
-    init_parse_guard();
+    init_adapter();
     ROUTE_METHOD_QUERY2 = `
 (call
   method: (identifier) @method (#match? @method "^(get|post|put|patch|delete|options|head)$")
@@ -11356,7 +11782,8 @@ var init_rails = __esm({
       id: "rails",
       languages: ["ruby"],
       matches(signals) {
-        if (!signals.gemfile) return false;
+        if (!signals.gemfile)
+          return false;
         return /^\s*gem\s+['"]rails['"]/im.test(signals.gemfile);
       },
       async introspect(files, _rootDir) {
@@ -11365,45 +11792,45 @@ var init_rails = __esm({
         }
         let language;
         try {
-          language = await loadGrammar("ruby");
+          language = await loadGrammar2("ruby");
         } catch (e2) {
           return { conventions: {}, provenance: [], confidence: "none" };
         }
-        const parser = new Parser8();
+        const parser = new Parser9();
         parser.setLanguage(language);
         const routeMethods = /* @__PURE__ */ new Map();
         const namespaces = /* @__PURE__ */ new Map();
         const rootControllers = /* @__PURE__ */ new Map();
         try {
           for (const file of files) {
-            const skip = isParsableSource(file.content, file.size);
+            const skip = isParsableSource2(file.content, file.size);
             if (skip) {
-              process.stderr.write(
-                `[massu/ast] WARN: rails skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
-`
-              );
+              process.stderr.write(`[massu/ast] WARN: rails skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES2}. (Phase 3.5 mitigation)
+`);
               continue;
             }
             try {
-              for (const hit of runQuery(parser, file.content, ROUTE_METHOD_QUERY2, "rails-route-method", file.path)) {
+              for (const hit of runQuery2(parser, file.content, ROUTE_METHOD_QUERY2, "rails-route-method", file.path)) {
                 const method = hit.captures.method;
                 if (method && !routeMethods.has(method)) {
                   routeMethods.set(method, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, NAMESPACE_QUERY, "rails-namespace", file.path)) {
+              for (const hit of runQuery2(parser, file.content, NAMESPACE_QUERY, "rails-namespace", file.path)) {
                 const symbolRaw = hit.captures.namespace_symbol;
                 const stringRaw = hit.captures.namespace_string;
                 const name = symbolRaw ? symbolRaw.replace(/^:/, "") : stringRaw ? stringRaw.replace(/^['"]/, "").replace(/['"]$/, "") : null;
-                if (!name) continue;
+                if (!name)
+                  continue;
                 const path = "/" + name;
                 if (!namespaces.has(path)) {
                   namespaces.set(path, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, ROOT_ROUTE_QUERY, "rails-root", file.path)) {
+              for (const hit of runQuery2(parser, file.content, ROOT_ROUTE_QUERY, "rails-root", file.path)) {
                 const raw = hit.captures.root_target;
-                if (!raw) continue;
+                if (!raw)
+                  continue;
                 const literal = raw.replace(/^['"]/, "").replace(/['"]$/, "");
                 const controller = extractRootController(literal);
                 if (controller && !rootControllers.has(controller)) {
@@ -11411,7 +11838,7 @@ var init_rails = __esm({
                 }
               }
             } catch (e2) {
-              if (e2 instanceof InvalidQueryError) {
+              if (e2 instanceof InvalidQueryError2) {
                 throw e2;
               }
               continue;
@@ -11460,22 +11887,30 @@ var init_rails = __esm({
   }
 });
 
-// src/detect/adapters/phoenix.ts
-import { Parser as Parser9 } from "web-tree-sitter";
+// src/detect/adapters/rails.ts
+var init_rails = __esm({
+  "src/detect/adapters/rails.ts"() {
+    "use strict";
+    init_dist2();
+  }
+});
+
+// ../adapter-phoenix/dist/index.js
+import { Parser as Parser10 } from "web-tree-sitter";
 function extractPrefixBase5(prefix3) {
-  if (!prefix3.startsWith("/")) return null;
+  if (!prefix3.startsWith("/"))
+    return null;
   const stripped = prefix3.replace(/^\/+/, "");
   const firstSeg = stripped.split("/")[0];
-  if (!firstSeg) return null;
+  if (!firstSeg)
+    return null;
   return "/" + firstSeg;
 }
 var ROUTE_METHOD_QUERY3, SCOPE_PATH_QUERY, ROUTER_MODULE_QUERY, phoenixAdapter;
-var init_phoenix = __esm({
-  "src/detect/adapters/phoenix.ts"() {
+var init_dist3 = __esm({
+  "../adapter-phoenix/dist/index.js"() {
     "use strict";
-    init_query_helpers();
-    init_tree_sitter_loader();
-    init_parse_guard();
+    init_adapter();
     ROUTE_METHOD_QUERY3 = `
 (call
   (identifier) @method (#match? @method "^(get|post|put|patch|delete|options|head)$")
@@ -11503,7 +11938,8 @@ var init_phoenix = __esm({
       id: "phoenix",
       languages: ["elixir"],
       matches(signals) {
-        if (!signals.mixExs) return false;
+        if (!signals.mixExs)
+          return false;
         return /\{\s*:phoenix\b(?!_)/.test(signals.mixExs);
       },
       async introspect(files, _rootDir) {
@@ -11512,49 +11948,48 @@ var init_phoenix = __esm({
         }
         let language;
         try {
-          language = await loadGrammar("elixir");
+          language = await loadGrammar2("elixir");
         } catch (e2) {
           return { conventions: {}, provenance: [], confidence: "none" };
         }
-        const parser = new Parser9();
+        const parser = new Parser10();
         parser.setLanguage(language);
         const routeMethods = /* @__PURE__ */ new Map();
         const scopePaths = /* @__PURE__ */ new Map();
         const routerModules = /* @__PURE__ */ new Map();
         try {
           for (const file of files) {
-            const skip = isParsableSource(file.content, file.size);
+            const skip = isParsableSource2(file.content, file.size);
             if (skip) {
-              process.stderr.write(
-                `[massu/ast] WARN: phoenix skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
-`
-              );
+              process.stderr.write(`[massu/ast] WARN: phoenix skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES2}. (Phase 3.5 mitigation)
+`);
               continue;
             }
             try {
-              for (const hit of runQuery(parser, file.content, ROUTE_METHOD_QUERY3, "phoenix-route-method", file.path)) {
+              for (const hit of runQuery2(parser, file.content, ROUTE_METHOD_QUERY3, "phoenix-route-method", file.path)) {
                 const method = hit.captures.method;
                 if (method && !routeMethods.has(method)) {
                   routeMethods.set(method, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, SCOPE_PATH_QUERY, "phoenix-scope-path", file.path)) {
+              for (const hit of runQuery2(parser, file.content, SCOPE_PATH_QUERY, "phoenix-scope-path", file.path)) {
                 const raw = hit.captures.scope_path;
-                if (!raw) continue;
+                if (!raw)
+                  continue;
                 const literal = raw.replace(/^["']/, "").replace(/["']$/, "");
                 const base = extractPrefixBase5(literal);
                 if (base && !scopePaths.has(base)) {
                   scopePaths.set(base, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, ROUTER_MODULE_QUERY, "phoenix-router-module", file.path)) {
+              for (const hit of runQuery2(parser, file.content, ROUTER_MODULE_QUERY, "phoenix-router-module", file.path)) {
                 const name = hit.captures.module_name;
                 if (name && !routerModules.has(name)) {
                   routerModules.set(name, { line: hit.line, file: file.path });
                 }
               }
             } catch (e2) {
-              if (e2 instanceof InvalidQueryError) {
+              if (e2 instanceof InvalidQueryError2) {
                 throw e2;
               }
               continue;
@@ -11603,21 +12038,28 @@ var init_phoenix = __esm({
   }
 });
 
-// src/detect/adapters/aspnet.ts
-import { Parser as Parser10 } from "web-tree-sitter";
+// src/detect/adapters/phoenix.ts
+var init_phoenix = __esm({
+  "src/detect/adapters/phoenix.ts"() {
+    "use strict";
+    init_dist3();
+  }
+});
+
+// ../adapter-aspnet/dist/index.js
+import { Parser as Parser11 } from "web-tree-sitter";
 function extractPrefixBase6(prefix3) {
   const stripped = prefix3.replace(/^\/+/, "");
   const firstSeg = stripped.split("/")[0];
-  if (!firstSeg) return null;
+  if (!firstSeg)
+    return null;
   return "/" + firstSeg;
 }
 var MAP_VERB_QUERY, HTTP_ATTR_QUERY, ROUTE_ATTR_QUERY, CONTROLLER_CLASS_QUERY, aspnetAdapter;
-var init_aspnet = __esm({
-  "src/detect/adapters/aspnet.ts"() {
+var init_dist4 = __esm({
+  "../adapter-aspnet/dist/index.js"() {
     "use strict";
-    init_query_helpers();
-    init_tree_sitter_loader();
-    init_parse_guard();
+    init_adapter();
     MAP_VERB_QUERY = `
 (invocation_expression
   function: (member_access_expression
@@ -11644,9 +12086,12 @@ var init_aspnet = __esm({
       id: "aspnet",
       languages: ["csharp"],
       matches(signals) {
-        if (!signals.csproj) return false;
-        if (/Sdk\s*=\s*["']Microsoft\.NET\.Sdk\.Web["']/i.test(signals.csproj)) return true;
-        if (/Microsoft\.AspNetCore\.App/i.test(signals.csproj)) return true;
+        if (!signals.csproj)
+          return false;
+        if (/Sdk\s*=\s*["']Microsoft\.NET\.Sdk\.Web["']/i.test(signals.csproj))
+          return true;
+        if (/Microsoft\.AspNetCore\.App/i.test(signals.csproj))
+          return true;
         return false;
       },
       async introspect(files, _rootDir) {
@@ -11655,29 +12100,28 @@ var init_aspnet = __esm({
         }
         let language;
         try {
-          language = await loadGrammar("csharp");
+          language = await loadGrammar2("csharp");
         } catch (e2) {
           return { conventions: {}, provenance: [], confidence: "none" };
         }
-        const parser = new Parser10();
+        const parser = new Parser11();
         parser.setLanguage(language);
         const routeMethods = /* @__PURE__ */ new Map();
         const prefixBases = /* @__PURE__ */ new Map();
         const controllerClasses = /* @__PURE__ */ new Map();
         try {
           for (const file of files) {
-            const skip = isParsableSource(file.content, file.size);
+            const skip = isParsableSource2(file.content, file.size);
             if (skip) {
-              process.stderr.write(
-                `[massu/ast] WARN: aspnet skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
-`
-              );
+              process.stderr.write(`[massu/ast] WARN: aspnet skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES2}. (Phase 3.5 mitigation)
+`);
               continue;
             }
             try {
-              for (const hit of runQuery(parser, file.content, MAP_VERB_QUERY, "aspnet-map-verb", file.path)) {
+              for (const hit of runQuery2(parser, file.content, MAP_VERB_QUERY, "aspnet-map-verb", file.path)) {
                 const methodRaw = hit.captures.method;
-                if (!methodRaw) continue;
+                if (!methodRaw)
+                  continue;
                 const verb = methodRaw.replace(/^Map/, "");
                 if (!routeMethods.has(verb)) {
                   routeMethods.set(verb, { line: hit.line, file: file.path });
@@ -11691,31 +12135,33 @@ var init_aspnet = __esm({
                   }
                 }
               }
-              for (const hit of runQuery(parser, file.content, HTTP_ATTR_QUERY, "aspnet-http-attr", file.path)) {
+              for (const hit of runQuery2(parser, file.content, HTTP_ATTR_QUERY, "aspnet-http-attr", file.path)) {
                 const attrRaw = hit.captures.attr_name;
-                if (!attrRaw) continue;
+                if (!attrRaw)
+                  continue;
                 const verb = attrRaw.replace(/^Http/, "");
                 if (!routeMethods.has(verb)) {
                   routeMethods.set(verb, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, ROUTE_ATTR_QUERY, "aspnet-route-attr", file.path)) {
+              for (const hit of runQuery2(parser, file.content, ROUTE_ATTR_QUERY, "aspnet-route-attr", file.path)) {
                 const tplRaw = hit.captures.route_template;
-                if (!tplRaw) continue;
+                if (!tplRaw)
+                  continue;
                 const literal = tplRaw.replace(/^["']/, "").replace(/["']$/, "");
                 const base = extractPrefixBase6(literal);
                 if (base && !prefixBases.has(base)) {
                   prefixBases.set(base, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, CONTROLLER_CLASS_QUERY, "aspnet-controller-class", file.path)) {
+              for (const hit of runQuery2(parser, file.content, CONTROLLER_CLASS_QUERY, "aspnet-controller-class", file.path)) {
                 const name = hit.captures.class_name;
                 if (name && !controllerClasses.has(name)) {
                   controllerClasses.set(name, { line: hit.line, file: file.path });
                 }
               }
             } catch (e2) {
-              if (e2 instanceof InvalidQueryError) {
+              if (e2 instanceof InvalidQueryError2) {
                 throw e2;
               }
               continue;
@@ -11764,21 +12210,28 @@ var init_aspnet = __esm({
   }
 });
 
-// src/detect/adapters/spring.ts
-import { Parser as Parser11 } from "web-tree-sitter";
+// src/detect/adapters/aspnet.ts
+var init_aspnet = __esm({
+  "src/detect/adapters/aspnet.ts"() {
+    "use strict";
+    init_dist4();
+  }
+});
+
+// ../adapter-spring/dist/index.js
+import { Parser as Parser12 } from "web-tree-sitter";
 function extractPrefixBase7(prefix3) {
   const stripped = prefix3.replace(/^\/+/, "");
   const firstSeg = stripped.split("/")[0];
-  if (!firstSeg) return null;
+  if (!firstSeg)
+    return null;
   return "/" + firstSeg;
 }
 var HTTP_MAPPING_QUERY, HTTP_MAPPING_NO_ARGS_QUERY, REQUEST_MAPPING_QUERY, CONTROLLER_CLASS_QUERY2, springAdapter;
-var init_spring = __esm({
-  "src/detect/adapters/spring.ts"() {
+var init_dist5 = __esm({
+  "../adapter-spring/dist/index.js"() {
     "use strict";
-    init_query_helpers();
-    init_tree_sitter_loader();
-    init_parse_guard();
+    init_adapter();
     HTTP_MAPPING_QUERY = `
 (annotation
   name: (identifier) @method (#match? @method "^(Get|Post|Put|Patch|Delete|Head|Options)Mapping$")
@@ -11832,59 +12285,60 @@ var init_spring = __esm({
         }
         let language;
         try {
-          language = await loadGrammar("java");
+          language = await loadGrammar2("java");
         } catch (e2) {
           return { conventions: {}, provenance: [], confidence: "none" };
         }
-        const parser = new Parser11();
+        const parser = new Parser12();
         parser.setLanguage(language);
         const routeMethods = /* @__PURE__ */ new Map();
         const prefixBases = /* @__PURE__ */ new Map();
         const controllerClasses = /* @__PURE__ */ new Map();
         try {
           for (const file of files) {
-            const skip = isParsableSource(file.content, file.size);
+            const skip = isParsableSource2(file.content, file.size);
             if (skip) {
-              process.stderr.write(
-                `[massu/ast] WARN: spring skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
-`
-              );
+              process.stderr.write(`[massu/ast] WARN: spring skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES2}. (Phase 3.5 mitigation)
+`);
               continue;
             }
             try {
-              for (const hit of runQuery(parser, file.content, HTTP_MAPPING_QUERY, "spring-http-mapping", file.path)) {
+              for (const hit of runQuery2(parser, file.content, HTTP_MAPPING_QUERY, "spring-http-mapping", file.path)) {
                 const methodRaw = hit.captures.method;
-                if (!methodRaw) continue;
+                if (!methodRaw)
+                  continue;
                 const verb = methodRaw.replace(/Mapping$/, "");
                 if (!routeMethods.has(verb)) {
                   routeMethods.set(verb, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, HTTP_MAPPING_NO_ARGS_QUERY, "spring-http-mapping-marker", file.path)) {
+              for (const hit of runQuery2(parser, file.content, HTTP_MAPPING_NO_ARGS_QUERY, "spring-http-mapping-marker", file.path)) {
                 const methodRaw = hit.captures.method;
-                if (!methodRaw) continue;
+                if (!methodRaw)
+                  continue;
                 const verb = methodRaw.replace(/Mapping$/, "");
                 if (!routeMethods.has(verb)) {
                   routeMethods.set(verb, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, REQUEST_MAPPING_QUERY, "spring-request-mapping", file.path)) {
+              for (const hit of runQuery2(parser, file.content, REQUEST_MAPPING_QUERY, "spring-request-mapping", file.path)) {
                 const tplRaw = hit.captures.route_template;
-                if (!tplRaw) continue;
+                if (!tplRaw)
+                  continue;
                 const literal = tplRaw.replace(/^["']/, "").replace(/["']$/, "");
                 const base = extractPrefixBase7(literal);
                 if (base && !prefixBases.has(base)) {
                   prefixBases.set(base, { line: hit.line, file: file.path });
                 }
               }
-              for (const hit of runQuery(parser, file.content, CONTROLLER_CLASS_QUERY2, "spring-controller-class", file.path)) {
+              for (const hit of runQuery2(parser, file.content, CONTROLLER_CLASS_QUERY2, "spring-controller-class", file.path)) {
                 const name = hit.captures.class_name;
                 if (name && !controllerClasses.has(name)) {
                   controllerClasses.set(name, { line: hit.line, file: file.path });
                 }
               }
             } catch (e2) {
-              if (e2 instanceof InvalidQueryError) {
+              if (e2 instanceof InvalidQueryError2) {
                 throw e2;
               }
               continue;
@@ -11933,6 +12387,14 @@ var init_spring = __esm({
   }
 });
 
+// src/detect/adapters/spring.ts
+var init_spring = __esm({
+  "src/detect/adapters/spring.ts"() {
+    "use strict";
+    init_dist5();
+  }
+});
+
 // src/detect/adapters/file-sampler.ts
 var file_sampler_exports = {};
 __export(file_sampler_exports, {
@@ -11940,8 +12402,8 @@ __export(file_sampler_exports, {
   SAMPLE_TEST_FILE_PATTERNS: () => SAMPLE_TEST_FILE_PATTERNS,
   sampleFilesForAdapter: () => sampleFilesForAdapter
 });
-import { readdirSync as readdirSync9, readFileSync as readFileSync9, lstatSync as lstatSync4 } from "node:fs";
-import { join as join9, extname } from "node:path";
+import { readdirSync as readdirSync10, readFileSync as readFileSync10, lstatSync as lstatSync5 } from "node:fs";
+import { join as join10, extname } from "node:path";
 function sampleFilesForAdapter(adapter, projectRoot, detection, options = {}) {
   const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
   const maxFiles = options.maxFilesPerAdapter ?? DEFAULT_MAX_FILES;
@@ -11956,7 +12418,7 @@ function sampleFilesForAdapter(adapter, projectRoot, detection, options = {}) {
     const langDetection = detection.sourceDirs[langKey];
     const candidateDirs = [];
     if (langDetection?.source_dirs && langDetection.source_dirs.length > 0) {
-      candidateDirs.push(...langDetection.source_dirs.map((d2) => join9(projectRoot, d2)));
+      candidateDirs.push(...langDetection.source_dirs.map((d2) => join10(projectRoot, d2)));
     } else {
       candidateDirs.push(projectRoot);
     }
@@ -11972,7 +12434,7 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
   if (out.length >= maxFiles) return;
   let entries;
   try {
-    entries = readdirSync9(dir);
+    entries = readdirSync10(dir);
   } catch {
     return;
   }
@@ -11980,10 +12442,10 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
     if (out.length >= maxFiles) return;
     if (entry.startsWith(".")) continue;
     if (IGNORED_DIRS3.has(entry)) continue;
-    const fullPath = join9(dir, entry);
+    const fullPath = join10(dir, entry);
     let st;
     try {
-      st = lstatSync4(fullPath);
+      st = lstatSync5(fullPath);
     } catch {
       continue;
     }
@@ -12001,7 +12463,7 @@ function walkDir(dir, exts, testPatterns, lang, maxDepth, curDepth, out, seen, m
     seen.add(fullPath);
     let content;
     try {
-      content = readFileSync9(fullPath, "utf-8");
+      content = readFileSync10(fullPath, "utf-8");
     } catch {
       continue;
     }
@@ -12239,7 +12701,7 @@ var init_detect = __esm({
 });
 
 // src/detect/drift.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function summarizeDetection(det) {
   const languages = Array.from(new Set(det.manifests.map((m3) => m3.language))).sort();
   const frameworks = {};
@@ -12270,7 +12732,7 @@ function summarizeDetection(det) {
 function computeFingerprint(det) {
   const data = summarizeDetection(det);
   const stable = JSON.stringify(data, Object.keys(data).sort());
-  return createHash3("sha256").update(stable).digest("hex");
+  return createHash4("sha256").update(stable).digest("hex");
 }
 function stringOf(v3) {
   if (typeof v3 === "string") return v3;
@@ -12620,7 +13082,7 @@ function cD({ input: t = $, output: u2 = j, overwrite: F = true, hideCursor: e2
   };
 }
 var import_sisteransi, import_picocolors, Q, P, X, DD, uD, FD, m, L, N, I, r, tD, eD, iD, v, CD, w, W, rD, R, y, V, z2, ED, _, nD, oD, aD, c, xD, S, AD, pD, h, x, fD, gD, vD, K, dD, bD, mD, Y, wD, yD, _D, Z, kD, SD, $D, q, jD, MD, TD, H, OD, PD;
-var init_dist = __esm({
+var init_dist6 = __esm({
   "../../node_modules/@clack/core/dist/index.mjs"() {
     import_sisteransi = __toESM(require_src(), 1);
     import_picocolors = __toESM(require_picocolors(), 1);
@@ -13038,10 +13500,10 @@ function X2() {
   return p.platform !== "win32" ? p.env.TERM !== "linux" : !!p.env.CI || !!p.env.WT_SESSION || !!p.env.TERMINUS_SUBLIME || p.env.ConEmuTask === "{cmd::Cmder}" || p.env.TERM_PROGRAM === "Terminus-Sublime" || p.env.TERM_PROGRAM === "vscode" || p.env.TERM === "xterm-256color" || p.env.TERM === "alacritty" || p.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 var import_picocolors2, import_sisteransi2, E, u, ee, A2, B, S2, te, a, m2, j2, R2, V2, M2, G2, se, N2, re, ie, ne, ae, oe, ce, le, y2, k2, ue, $e, me, de, he, pe, ge, ye, ve, we, fe, v2, L2, be, xe;
-var init_dist2 = __esm({
+var init_dist7 = __esm({
   "../../node_modules/@clack/prompts/dist/index.mjs"() {
-    init_dist();
-    init_dist();
+    init_dist6();
+    init_dist6();
     import_picocolors2 = __toESM(require_picocolors(), 1);
     import_sisteransi2 = __toESM(require_src(), 1);
     E = X2();
@@ -13429,10 +13891,10 @@ __export(init_exports, {
   validateWrittenConfig: () => validateWrittenConfig,
   writeConfigAtomic: () => writeConfigAtomic
 });
-import { closeSync as closeSync2, existsSync as existsSync10, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2, writeSync as writeSync2, mkdirSync as mkdirSync4, readdirSync as readdirSync10, renameSync as renameSync3, rmSync as rmSync2, statSync as statSync7, chmodSync as chmodSync2 } from "fs";
-import { resolve as resolve6, basename as basename4, dirname as dirname5 } from "path";
+import { closeSync as closeSync2, existsSync as existsSync10, fsyncSync as fsyncSync2, openSync as openSync2, readFileSync as readFileSync11, writeFileSync as writeFileSync3, writeSync as writeSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync11, renameSync as renameSync4, rmSync as rmSync2, statSync as statSync7, chmodSync as chmodSync3 } from "fs";
+import { resolve as resolve6, basename as basename4, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { stringify as yamlStringify, parse as yamlParse } from "yaml";
 function detectFramework(projectRoot) {
   const result = {
@@ -13444,7 +13906,7 @@ function detectFramework(projectRoot) {
   const pkgPath = resolve6(projectRoot, "package.json");
   if (!existsSync10(pkgPath)) return result;
   try {
-    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
     const allDeps = {
       ...pkg.dependencies,
       ...pkg.devDependencies
@@ -13491,7 +13953,7 @@ function detectPython(projectRoot) {
     const filePath = resolve6(projectRoot, file);
     if (existsSync10(filePath)) {
       try {
-        const content = readFileSync10(filePath, "utf-8").toLowerCase();
+        const content = readFileSync11(filePath, "utf-8").toLowerCase();
         if (content.includes("fastapi")) result.hasFastapi = true;
         if (content.includes("sqlalchemy")) result.hasSqlalchemy = true;
       } catch {
@@ -13516,7 +13978,7 @@ function detectPython(projectRoot) {
     }
     if (existsSync10(candidatePath)) {
       try {
-        const files = readdirSync10(candidatePath);
+        const files = readdirSync11(candidatePath);
         if (files.some((f2) => f2.endsWith(".py"))) {
           result.root = candidate;
           break;
@@ -13581,7 +14043,7 @@ function generateConfig(projectRoot, framework) {
 # Documentation: https://massu.ai/docs/getting-started/configuration
 
 ${yamlStringify(config)}`;
-  writeFileSync2(configPath, yamlContent, "utf-8");
+  writeFileSync3(configPath, yamlContent, "utf-8");
   return true;
 }
 function monorepoCommonRoot(packages) {
@@ -13752,7 +14214,7 @@ function applyVariantTemplate(config, templatesDir) {
   if (!existsSync10(templatePath)) return config;
   let template;
   try {
-    template = yamlParse(readFileSync10(templatePath, "utf-8"));
+    template = yamlParse(readFileSync11(templatePath, "utf-8"));
   } catch {
     return config;
   }
@@ -13819,7 +14281,7 @@ function writeConfigAtomic(configPath, content) {
     }
   }
   try {
-    mkdirSync4(dirname5(configPath), { recursive: true });
+    mkdirSync5(dirname6(configPath), { recursive: true });
     const fd = openSync2(tmpPath, "w", 420);
     try {
       const buf = Buffer.from(content, "utf-8");
@@ -13832,10 +14294,10 @@ function writeConfigAtomic(configPath, content) {
     if (parsed === null || typeof parsed !== "object") {
       throw new Error("Generated config is not a valid YAML object");
     }
-    renameSync3(tmpPath, configPath);
+    renameSync4(tmpPath, configPath);
     if (existingMode !== void 0) {
       try {
-        chmodSync2(configPath, existingMode);
+        chmodSync3(configPath, existingMode);
       } catch {
       }
     }
@@ -13853,7 +14315,7 @@ function writeConfigAtomic(configPath, content) {
 function validateWrittenConfig(configPath, projectRoot, checkPaths = true) {
   try {
     if (!existsSync10(configPath)) return "Config file does not exist after write";
-    const content = readFileSync10(configPath, "utf-8");
+    const content = readFileSync11(configPath, "utf-8");
     const parsed = yamlParse(content);
     if (parsed === null || typeof parsed !== "object") {
       return "Config is not a valid YAML object";
@@ -13954,9 +14416,9 @@ function copyTemplateConfig(templateName, targetPath, projectName) {
     return { success: false, error: `Template '${templateName}' not found at ${srcPath}` };
   }
   try {
-    let content = readFileSync10(srcPath, "utf-8");
+    let content = readFileSync11(srcPath, "utf-8");
     content = content.replace(/\{\{PROJECT_NAME\}\}/g, projectName);
-    writeFileSync2(targetPath, content, "utf-8");
+    writeFileSync3(targetPath, content, "utf-8");
     return { success: true };
   } catch (err) {
     return { success: false, error: err instanceof Error ? err.message : String(err) };
@@ -13967,7 +14429,7 @@ function registerMcpServer(projectRoot) {
   let existing = {};
   if (existsSync10(mcpPath)) {
     try {
-      existing = JSON.parse(readFileSync10(mcpPath, "utf-8"));
+      existing = JSON.parse(readFileSync11(mcpPath, "utf-8"));
     } catch {
       existing = {};
     }
@@ -13982,7 +14444,7 @@ function registerMcpServer(projectRoot) {
     args: ["-y", "@massu/core"]
   };
   existing.mcpServers = servers;
-  writeFileSync2(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
+  writeFileSync3(mcpPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
   return true;
 }
 function resolveHooksDir() {
@@ -14087,12 +14549,12 @@ function installHooks(projectRoot) {
   const claudeDir = resolve6(projectRoot, claudeDirName);
   const settingsPath = resolve6(claudeDir, "settings.local.json");
   if (!existsSync10(claudeDir)) {
-    mkdirSync4(claudeDir, { recursive: true });
+    mkdirSync5(claudeDir, { recursive: true });
   }
   let settings = {};
   if (existsSync10(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync10(settingsPath, "utf-8"));
+      settings = JSON.parse(readFileSync11(settingsPath, "utf-8"));
     } catch {
       settings = {};
     }
@@ -14106,15 +14568,15 @@ function installHooks(projectRoot) {
     }
   }
   settings.hooks = hooksConfig;
-  writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+  writeFileSync3(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
   return { installed: true, count: hookCount };
 }
 function initMemoryDir(projectRoot) {
   const encodedRoot = "-" + projectRoot.replace(/\//g, "-");
-  const memoryDir = resolve6(homedir3(), `.claude/projects/${encodedRoot}/memory`);
+  const memoryDir = resolve6(homedir4(), `.claude/projects/${encodedRoot}/memory`);
   let created = false;
   if (!existsSync10(memoryDir)) {
-    mkdirSync4(memoryDir, { recursive: true });
+    mkdirSync5(memoryDir, { recursive: true });
     created = true;
   }
   const memoryMdPath = resolve6(memoryDir, "MEMORY.md");
@@ -14135,7 +14597,7 @@ function initMemoryDir(projectRoot) {
 ## File Index
 <!-- Significant files and directories -->
 `;
-    writeFileSync2(memoryMdPath, memoryContent, "utf-8");
+    writeFileSync3(memoryMdPath, memoryContent, "utf-8");
     memoryMdCreated = true;
   }
   return { created, memoryMdCreated };
@@ -14387,8 +14849,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
             "\u2014 Massu"
           ].join("\n");
           try {
-            mkdirSync4(resolve6(cmdResult.claudeDir, "commands"), { recursive: true });
-            writeFileSync2(placeholderPath, placeholderBody, "utf-8");
+            mkdirSync5(resolve6(cmdResult.claudeDir, "commands"), { recursive: true });
+            writeFileSync3(placeholderPath, placeholderBody, "utf-8");
             log("  Wrote _massu-needs-stack.md placeholder (no stack detected yet)");
           } catch {
           }
@@ -14407,8 +14869,8 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
   (async () => {
     try {
       const encodedRoot = projectRoot.replace(/\//g, "-");
-      const memoryDir = resolve6(homedir3(), ".claude", "projects", encodedRoot, "memory");
-      const memFiles = existsSync10(memoryDir) ? readdirSync10(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
+      const memoryDir = resolve6(homedir4(), ".claude", "projects", encodedRoot, "memory");
+      const memFiles = existsSync10(memoryDir) ? readdirSync11(memoryDir).filter((f2) => f2.endsWith(".md") && f2 !== "MEMORY.md") : [];
       if (memFiles.length > 0) {
         const { getMemoryDb: getMemoryDb2 } = await Promise.resolve().then(() => (init_memory_db(), memory_db_exports));
         const db = getMemoryDb2();
@@ -14431,7 +14893,7 @@ function installSideEffects(projectRoot, log, skipCommands = false, emptyStack =
 }
 async function promptOverwrite(configPath) {
   try {
-    const { confirm, isCancel } = await Promise.resolve().then(() => (init_dist2(), dist_exports));
+    const { confirm, isCancel } = await Promise.resolve().then(() => (init_dist7(), dist_exports));
     const res = await confirm({
       message: `massu.config.yaml already exists at ${configPath}. Overwrite?`,
       initialValue: false
@@ -14444,7 +14906,7 @@ async function promptOverwrite(configPath) {
 }
 async function promptStackConfirm() {
   try {
-    const { confirm, isCancel } = await Promise.resolve().then(() => (init_dist2(), dist_exports));
+    const { confirm, isCancel } = await Promise.resolve().then(() => (init_dist7(), dist_exports));
     const res = await confirm({
       message: "Generate massu.config.yaml from detected stack?",
       initialValue: true
@@ -14468,7 +14930,7 @@ var init_init = __esm({
     init_detect();
     init_drift();
     __filename2 = fileURLToPath2(import.meta.url);
-    __dirname2 = dirname5(__filename2);
+    __dirname2 = dirname6(__filename2);
     FRAMEWORK_TO_TEMPLATE_ID = {
       rails: "rails",
       phoenix: "phoenix",
@@ -14490,7 +14952,7 @@ var init_init = __esm({
 });
 
 // src/license.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function tierLevel(tier) {
   return TIER_LEVELS[tier] ?? 0;
 }
@@ -14515,7 +14977,7 @@ function annotateToolDefinitions(defs) {
   });
 }
 async function validateLicense(apiKey) {
-  const keyHash = createHash4("sha256").update(apiKey).digest("hex");
+  const keyHash = createHash5("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     const cached = memDb.prepare(
@@ -14576,7 +15038,7 @@ async function validateLicense(apiKey) {
   }
 }
 function updateLicenseCache(apiKey, tier, validUntil, features = []) {
-  const keyHash = createHash4("sha256").update(apiKey).digest("hex");
+  const keyHash = createHash5("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     memDb.prepare(`
@@ -14784,8 +15246,8 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor,
   runValidateConfig: () => runValidateConfig
 });
-import { existsSync as existsSync11, readFileSync as readFileSync11, readdirSync as readdirSync11 } from "fs";
-import { resolve as resolve7, dirname as dirname6 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync12, readdirSync as readdirSync12 } from "fs";
+import { resolve as resolve7, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { parse as parseYaml4 } from "yaml";
 function checkConfig(projectRoot) {
@@ -14794,7 +15256,7 @@ function checkConfig(projectRoot) {
     return { name: "Configuration", status: "fail", detail: "massu.config.yaml not found. Run: npx massu init" };
   }
   try {
-    const content = readFileSync11(configPath, "utf-8");
+    const content = readFileSync12(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       return { name: "Configuration", status: "fail", detail: "massu.config.yaml is empty or invalid YAML" };
@@ -14810,7 +15272,7 @@ function checkMcpServer(projectRoot) {
     return { name: "MCP Server", status: "fail", detail: ".mcp.json not found. Run: npx massu init" };
   }
   try {
-    const content = JSON.parse(readFileSync11(mcpPath, "utf-8"));
+    const content = JSON.parse(readFileSync12(mcpPath, "utf-8"));
     const servers = content.mcpServers ?? {};
     if (!servers.massu) {
       return { name: "MCP Server", status: "fail", detail: "massu not registered in .mcp.json. Run: npx massu init" };
@@ -14826,7 +15288,7 @@ function checkHooksConfig(projectRoot) {
     return { name: "Hooks Config", status: "fail", detail: ".claude/settings.local.json not found. Run: npx massu init" };
   }
   try {
-    const content = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+    const content = JSON.parse(readFileSync12(settingsPath, "utf-8"));
     if (!content.hooks) {
       return { name: "Hooks Config", status: "fail", detail: "No hooks configured. Run: npx massu install-hooks" };
     }
@@ -14937,7 +15399,7 @@ function checkShellHooksWired(_projectRoot2) {
     };
   }
   try {
-    const content = JSON.parse(readFileSync11(settingsPath, "utf-8"));
+    const content = JSON.parse(readFileSync12(settingsPath, "utf-8"));
     const hooks = content.hooks ?? {};
     const hasSessionStart = Array.isArray(hooks.SessionStart) && hooks.SessionStart.length > 0;
     const hasPreToolUse = Array.isArray(hooks.PreToolUse) && hooks.PreToolUse.length > 0;
@@ -15003,7 +15465,7 @@ function checkPythonHealth(projectRoot) {
   function scanDir(dir, depth) {
     if (depth > 5) return;
     try {
-      const entries = readdirSync11(dir, { withFileTypes: true });
+      const entries = readdirSync12(dir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           const excludeDirs = config.python?.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
@@ -15011,7 +15473,7 @@ function checkPythonHealth(projectRoot) {
             const subdir = resolve7(dir, entry.name);
             if (depth <= 2 && !existsSync11(resolve7(subdir, "__init__.py"))) {
               try {
-                const subEntries = readdirSync11(subdir);
+                const subEntries = readdirSync12(subdir);
                 if (subEntries.some((f2) => f2.endsWith(".py") && f2 !== "__init__.py")) {
                   initPyMissing.push(entry.name);
                 }
@@ -15112,7 +15574,7 @@ async function runValidateConfig() {
     return;
   }
   try {
-    const content = readFileSync11(configPath, "utf-8");
+    const content = readFileSync12(configPath, "utf-8");
     const parsed = parseYaml4(content);
     if (!parsed || typeof parsed !== "object") {
       console.error("Error: massu.config.yaml is empty or not a valid YAML object");
@@ -15151,7 +15613,7 @@ var init_doctor = __esm({
     init_config();
     init_license();
     __filename3 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname6(__filename3);
+    __dirname3 = dirname7(__filename3);
     EXPECTED_HOOKS = [
       "session-start.js",
       "session-end.js",
@@ -15197,7 +15659,7 @@ var show_template_exports = {};
 __export(show_template_exports, {
   runShowTemplate: () => runShowTemplate
 });
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync13 } from "fs";
 import { resolve as resolve8 } from "path";
 function normalizeBaseName(input) {
   return input.endsWith(".md") ? input.slice(0, -".md".length) : input;
@@ -15233,7 +15695,7 @@ async function runShowTemplate(args2) {
     process.exit(1);
     return;
   }
-  process.stdout.write(readFileSync12(file, "utf-8"));
+  process.stdout.write(readFileSync13(file, "utf-8"));
 }
 var init_show_template = __esm({
   "src/commands/show-template.ts"() {
@@ -15286,12 +15748,12 @@ var init_passthrough = __esm({
 });
 
 // src/lib/fileLock.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname7 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync14, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname8 } from "path";
 import * as lockfile from "proper-lockfile";
 function readLockHolderPid(lockPath) {
   try {
-    const raw = readFileSync13(`${lockPath}.pid`, "utf-8").trim();
+    const raw = readFileSync14(`${lockPath}.pid`, "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     if (!Number.isFinite(pid) || pid <= 0) return null;
     return pid;
@@ -15310,7 +15772,7 @@ function busyWaitSync(ms) {
   Atomics.wait(view, 0, 0, ms);
 }
 function withFileLockSync(lockPath, fn, opts = {}) {
-  mkdirSync5(dirname7(lockPath), { recursive: true });
+  mkdirSync6(dirname8(lockPath), { recursive: true });
   const staleMs = opts.staleMs ?? 3e4;
   const blockMs = opts.retries === 0 ? 0 : opts.blockMs ?? 3e4;
   const pollIntervalMs = opts.pollIntervalMs ?? 100;
@@ -15327,7 +15789,7 @@ function withFileLockSync(lockPath, fn, opts = {}) {
         realpath: false
       });
       try {
-        writeFileSync3(`${lockPath}.pid`, String(process.pid), "utf-8");
+        writeFileSync4(`${lockPath}.pid`, String(process.pid), "utf-8");
       } catch {
       }
       break;
@@ -15416,7 +15878,7 @@ __export(config_refresh_exports, {
   mergeRefresh: () => mergeRefresh,
   runConfigRefresh: () => runConfigRefresh
 });
-import { existsSync as existsSync13, readFileSync as readFileSync14, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync15, rmSync as rmSync4 } from "fs";
 import { resolve as resolve10 } from "path";
 import { parse as parseYaml5 } from "yaml";
 function flatten(obj, prefix3 = "") {
@@ -15555,7 +16017,7 @@ async function runConfigRefresh(opts = {}) {
   }
   let existing;
   try {
-    const content = readFileSync14(configPath, "utf-8");
+    const content = readFileSync15(configPath, "utf-8");
     const parsed = parseYaml5(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -15600,7 +16062,7 @@ async function runConfigRefresh(opts = {}) {
     }
     log("Config diff:\n");
     log(renderDiff(diff));
-    const { confirm } = await Promise.resolve().then(() => (init_dist2(), dist_exports));
+    const { confirm } = await Promise.resolve().then(() => (init_dist7(), dist_exports));
     const apply = await confirm({ message: "Apply these changes to massu.config.yaml?" });
     if (apply !== true) {
       log("Aborted; no changes written.\n");
@@ -15953,8 +16415,8 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync3, existsSync as existsSync15, fsyncSync as fsyncSync3, mkdirSync as mkdirSync6, openSync as openSync3, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync4, writeSync as writeSync3 } from "fs";
-import { dirname as dirname8, resolve as resolve12 } from "path";
+import { closeSync as closeSync3, existsSync as existsSync15, fsyncSync as fsyncSync3, mkdirSync as mkdirSync7, openSync as openSync3, readFileSync as readFileSync16, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync5, writeSync as writeSync3 } from "fs";
+import { dirname as dirname9, resolve as resolve12 } from "path";
 function watchStatePath(projectRoot) {
   return resolve12(projectRoot, ".massu", "watch-state.json");
 }
@@ -15964,7 +16426,7 @@ function backupStatePath(projectRoot) {
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
   if (!existsSync15(path)) return { ...DEFAULT_STATE };
-  const content = readFileSync15(path, "utf-8");
+  const content = readFileSync16(path, "utf-8");
   let raw;
   try {
     raw = JSON.parse(content);
@@ -16006,14 +16468,14 @@ function readState(projectRoot) {
 }
 function archiveCorrupt(projectRoot, content) {
   const bak = backupStatePath(projectRoot);
-  mkdirSync6(dirname8(bak), { recursive: true });
-  writeFileSync4(bak, content, "utf-8");
+  mkdirSync7(dirname9(bak), { recursive: true });
+  writeFileSync5(bak, content, "utf-8");
 }
 function writeStateAtomic(projectRoot, state) {
   const path = watchStatePath(projectRoot);
   writeStateAtomicCounter = writeStateAtomicCounter + 1 >>> 0;
   const tmp = `${path}.${process.pid}.${writeStateAtomicCounter}.tmp`;
-  mkdirSync6(dirname8(path), { recursive: true });
+  mkdirSync7(dirname9(path), { recursive: true });
   let renamed = false;
   try {
     const fd = openSync3(tmp, "w");
@@ -16024,7 +16486,7 @@ function writeStateAtomic(projectRoot, state) {
     } finally {
       closeSync3(fd);
     }
-    renameSync4(tmp, path);
+    renameSync5(tmp, path);
     renamed = true;
   } finally {
     if (!renamed && existsSync15(tmp)) {
@@ -16307,8 +16769,8 @@ __export(watch_exports, {
   runWatch: () => runWatch
 });
 import { spawnSync as spawnSync3 } from "child_process";
-import { basename as basename5, dirname as dirname9, resolve as resolve13 } from "path";
-import { appendFileSync, existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync16 } from "fs";
+import { basename as basename5, dirname as dirname10, resolve as resolve13 } from "path";
+import { appendFileSync, existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync17 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -16553,7 +17015,7 @@ function refreshLogPath(projectRoot) {
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
   try {
-    mkdirSync7(dirname9(path), { recursive: true });
+    mkdirSync8(dirname10(path), { recursive: true });
     appendFileSync(path, JSON.stringify(event) + "\n", "utf-8");
   } catch {
   }
@@ -16564,7 +17026,7 @@ function readRefreshLog(projectRoot, limit = 10, opts = {}) {
   const warn = opts.warn ?? ((s) => {
     process.stderr.write(s);
   });
-  const lines = readFileSync16(path, "utf-8").split("\n").filter(Boolean);
+  const lines = readFileSync17(path, "utf-8").split("\n").filter(Boolean);
   const tail = lines.slice(-limit);
   const out = [];
   let corrupt = 0;
@@ -16635,28 +17097,28 @@ var init_refresh_log = __esm({
 
 // src/security/atomic-write.ts
 import {
-  chmodSync as chmodSync3,
+  chmodSync as chmodSync4,
   closeSync as closeSync4,
   existsSync as existsSync17,
   fsyncSync as fsyncSync4,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync4,
-  renameSync as renameSync5,
+  renameSync as renameSync6,
   rmSync as rmSync6,
   statSync as statSync9,
   writeSync as writeSync4
 } from "node:fs";
-import { dirname as dirname10 } from "node:path";
+import { dirname as dirname11 } from "node:path";
 function atomicWrite(path, content, opts = {}) {
   const tmpPath = `${path}.tmp`;
-  const parentDir = dirname10(path);
+  const parentDir = dirname11(path);
   try {
     if (!existsSync17(parentDir)) {
       const mkdirOpts = { recursive: true };
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
       }
-      mkdirSync8(parentDir, mkdirOpts);
+      mkdirSync9(parentDir, mkdirOpts);
     }
     const buf = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
     const openMode = opts.mode ?? 420;
@@ -16668,9 +17130,9 @@ function atomicWrite(path, content, opts = {}) {
       closeSync4(fd);
     }
     if (opts.mode !== void 0) {
-      chmodSync3(tmpPath, opts.mode);
+      chmodSync4(tmpPath, opts.mode);
     }
-    renameSync5(tmpPath, path);
+    renameSync6(tmpPath, path);
     return { written: true };
   } catch (err) {
     if (existsSync17(tmpPath)) {
@@ -16753,10 +17215,10 @@ var init_registry_pubkey_generated = __esm({
 });
 
 // src/security/adapter-verifier.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import nacl from "tweetnacl";
 function sha256Hex(bytes) {
-  return createHash5("sha256").update(bytes).digest("hex");
+  return createHash6("sha256").update(bytes).digest("hex");
 }
 function reviver(key, value) {
   if (key === "__proto__" || key === "constructor" || key === "prototype") {
@@ -17016,12 +17478,12 @@ var init_fetcher = __esm({
 });
 
 // src/security/manifest-cache.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17, statSync as statSync10 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { existsSync as existsSync18, readFileSync as readFileSync18, statSync as statSync10 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
 import { resolve as resolve14 } from "node:path";
 import { z as z4 } from "zod";
 function defaultCachePaths() {
-  const dir = resolve14(homedir4(), ".massu");
+  const dir = resolve14(homedir5(), ".massu");
   return {
     cachePath: resolve14(dir, "adapter-manifest.json"),
     lockPath: resolve14(dir, ".adapter-manifest.lock")
@@ -17033,7 +17495,7 @@ function loadCachedManifest(paths = defaultCachePaths()) {
   }
   let raw;
   try {
-    const content = readFileSync17(paths.cachePath, "utf-8");
+    const content = readFileSync18(paths.cachePath, "utf-8");
     raw = JSON.parse(content);
   } catch (err) {
     return {
@@ -17222,10 +17684,10 @@ var init_adapter_origin = __esm({
 });
 
 // src/security/local-fingerprint.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18, lstatSync as lstatSync5 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { existsSync as existsSync19, readFileSync as readFileSync19, lstatSync as lstatSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
 import { resolve as resolve15, isAbsolute } from "node:path";
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { z as z5 } from "zod";
 function computeLocalFingerprint(localPaths, projectRoot) {
   const tuples = [];
@@ -17233,13 +17695,13 @@ function computeLocalFingerprint(localPaths, projectRoot) {
     const abs = isAbsolute(p19) ? p19 : resolve15(projectRoot, p19);
     let contentTag;
     try {
-      const lst = lstatSync5(abs);
+      const lst = lstatSync6(abs);
       if (lst.isSymbolicLink()) {
         contentTag = "<symlink>";
       } else if (!lst.isFile()) {
         contentTag = "<not-a-file>";
       } else {
-        contentTag = createHash6("sha256").update(readFileSync18(abs)).digest("hex");
+        contentTag = createHash7("sha256").update(readFileSync19(abs)).digest("hex");
       }
     } catch {
       contentTag = "<missing>";
@@ -17248,13 +17710,13 @@ function computeLocalFingerprint(localPaths, projectRoot) {
   }
   tuples.sort((a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0);
   const canonical = JSON.stringify(tuples);
-  return createHash6("sha256").update(canonical).digest("hex");
+  return createHash7("sha256").update(canonical).digest("hex");
 }
 function readFingerprintSentinel(path = FINGERPRINT_PATH) {
   if (!existsSync19(path)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync18(path, "utf-8"));
+    raw = JSON.parse(readFileSync19(path, "utf-8"));
   } catch {
     return null;
   }
@@ -17302,7 +17764,7 @@ var init_local_fingerprint = __esm({
     "use strict";
     init_atomic_write();
     init_manifest_schema();
-    FINGERPRINT_PATH = resolve15(homedir5(), ".massu", "adapters-local-fingerprint.json");
+    FINGERPRINT_PATH = resolve15(homedir6(), ".massu", "adapters-local-fingerprint.json");
     FingerprintSentinelSchema = z5.object({
       fingerprint: z5.string().regex(/^[0-9a-f]{64}$/),
       source: z5.enum(["cli", "cli-resync"]),
@@ -17318,11 +17780,11 @@ var init_local_fingerprint = __esm({
 });
 
 // src/security/install-tracking.ts
-import { readFileSync as readFileSync19, readdirSync as readdirSync12, lstatSync as lstatSync6, existsSync as existsSync20 } from "node:fs";
-import { join as join10, relative as relative5, sep } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { readFileSync as readFileSync20, readdirSync as readdirSync13, lstatSync as lstatSync7, existsSync as existsSync20 } from "node:fs";
+import { join as join11, relative as relative5, sep } from "node:path";
+import { homedir as homedir7 } from "node:os";
 import { resolve as resolve16 } from "node:path";
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { z as z6 } from "zod";
 function containsHiddenDirs(packageDir) {
   for (const hidden of EXCLUDED_DIR_NAMES) {
@@ -17338,15 +17800,15 @@ function sha256OfDir(dir, opts = {}) {
   function walk(currentDir) {
     let entries;
     try {
-      entries = readdirSync12(currentDir);
+      entries = readdirSync13(currentDir);
     } catch {
       return;
     }
     for (const entry of entries.sort()) {
-      const absPath = join10(currentDir, entry);
+      const absPath = join11(currentDir, entry);
       let lst;
       try {
-        lst = lstatSync6(absPath);
+        lst = lstatSync7(absPath);
       } catch {
         continue;
       }
@@ -17370,9 +17832,9 @@ function sha256OfDir(dir, opts = {}) {
   }
   walk(dir);
   files.sort((a2, b2) => a2.relativePath < b2.relativePath ? -1 : a2.relativePath > b2.relativePath ? 1 : 0);
-  const top = createHash7("sha256");
+  const top = createHash8("sha256");
   for (const f2 of files) {
-    const fileHash = createHash7("sha256").update(readFileSync19(f2.absPath)).digest("hex");
+    const fileHash = createHash8("sha256").update(readFileSync20(f2.absPath)).digest("hex");
     top.update(f2.relativePath, "utf-8");
     top.update("\0", "utf-8");
     top.update(fileHash, "utf-8");
@@ -17384,7 +17846,7 @@ function readInstalledManifest(path = INSTALLED_MANIFEST_PATH) {
   if (!existsSync20(path)) return {};
   let raw;
   try {
-    raw = JSON.parse(readFileSync19(path, "utf-8"));
+    raw = JSON.parse(readFileSync20(path, "utf-8"));
   } catch {
     return {};
   }
@@ -17448,7 +17910,7 @@ var init_install_tracking = __esm({
   "src/security/install-tracking.ts"() {
     "use strict";
     init_atomic_write();
-    INSTALLED_MANIFEST_PATH = resolve16(homedir6(), ".massu", "adapter-manifest-installed.json");
+    INSTALLED_MANIFEST_PATH = resolve16(homedir7(), ".massu", "adapter-manifest-installed.json");
     DEFAULT_MAX_FILE_BYTES = 64 * 1024 * 1024;
     EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", ".cache", ".tmp"]);
     InstallEntrySchema = z6.object({
@@ -17471,7 +17933,7 @@ var init_install_tracking = __esm({
 });
 
 // src/detect/adapters/discover.ts
-import { existsSync as existsSync21, readdirSync as readdirSync13, readFileSync as readFileSync20, lstatSync as lstatSync7 } from "node:fs";
+import { existsSync as existsSync21, readdirSync as readdirSync14, readFileSync as readFileSync21, lstatSync as lstatSync8 } from "node:fs";
 import { resolve as resolve17, isAbsolute as isAbsolute2 } from "node:path";
 import { z as z7 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
@@ -17482,7 +17944,7 @@ function walkNodeModules(projectRoot, warnings) {
   const candidates = [];
   let topLevelEntries;
   try {
-    topLevelEntries = readdirSync13(nodeModulesDir);
+    topLevelEntries = readdirSync14(nodeModulesDir);
   } catch (err) {
     warnings.push(`failed to read node_modules: ${err instanceof Error ? err.message : String(err)}`);
     return [];
@@ -17492,7 +17954,7 @@ function walkNodeModules(projectRoot, warnings) {
     const entryPath = resolve17(nodeModulesDir, entry);
     let entryStat;
     try {
-      entryStat = lstatSync7(entryPath);
+      entryStat = lstatSync8(entryPath);
     } catch {
       continue;
     }
@@ -17506,7 +17968,7 @@ function walkNodeModules(projectRoot, warnings) {
     if (entry.startsWith("@")) {
       let scopedEntries;
       try {
-        scopedEntries = readdirSync13(entryPath);
+        scopedEntries = readdirSync14(entryPath);
       } catch {
         continue;
       }
@@ -17514,7 +17976,7 @@ function walkNodeModules(projectRoot, warnings) {
         const subPath = resolve17(entryPath, sub);
         let subStat;
         try {
-          subStat = lstatSync7(subPath);
+          subStat = lstatSync8(subPath);
         } catch {
           continue;
         }
@@ -17534,7 +17996,7 @@ function tryReadAdapterPackage(packageDir, warnings) {
   if (!existsSync21(pkgJsonPath)) return null;
   let raw;
   try {
-    raw = JSON.parse(readFileSync20(pkgJsonPath, "utf-8"));
+    raw = JSON.parse(readFileSync21(pkgJsonPath, "utf-8"));
   } catch (err) {
     warnings.push(
       `skipping ${packageDir}: package.json parse failed (${err instanceof Error ? err.message : String(err)})`
@@ -17750,7 +18212,7 @@ __export(adapters_exports, {
   runAdaptersResyncLocalFingerprint: () => runAdaptersResyncLocalFingerprint,
   runAdaptersSearch: () => runAdaptersSearch
 });
-import { existsSync as existsSync22, readFileSync as readFileSync21 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync22 } from "node:fs";
 import { resolve as resolve18 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
@@ -18028,7 +18490,7 @@ function mutateLocalArray(mutator, command) {
   }
   let yamlText;
   try {
-    yamlText = readFileSync21(yamlPath, "utf-8");
+    yamlText = readFileSync22(yamlPath, "utf-8");
   } catch (err) {
     process.stderr.write(`${command}: failed to read ${yamlPath}: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -18134,7 +18596,7 @@ async function runAdaptersInstall(args2) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync21(pkgJsonPath, "utf-8"));
+    pkgJson = JSON.parse(readFileSync22(pkgJsonPath, "utf-8"));
   } catch (err) {
     process.stderr.write(`install: ${packageName} has malformed package.json: ${err instanceof Error ? err.message : String(err)}
 `);
@@ -18341,8 +18803,8 @@ var init_adapters2 = __esm({
 
 // src/db.ts
 import Database2 from "better-sqlite3";
-import { dirname as dirname11, join as join11 } from "path";
-import { existsSync as existsSync23, mkdirSync as mkdirSync9, readdirSync as readdirSync14, statSync as statSync11 } from "fs";
+import { dirname as dirname12, join as join12 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync10, readdirSync as readdirSync15, statSync as statSync11 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
   if (!existsSync23(dbPath)) {
@@ -18354,9 +18816,9 @@ function getCodeGraphDb() {
 }
 function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
-  const dir = dirname11(dbPath);
+  const dir = dirname12(dbPath);
   if (!existsSync23(dir)) {
-    mkdirSync9(dir, { recursive: true });
+    mkdirSync10(dir, { recursive: true });
   }
   const db = new Database2(dbPath);
   db.pragma("journal_mode = WAL");
@@ -18626,9 +19088,9 @@ function isPythonDataStale(dataDb2, pythonRoot) {
   const lastBuildTime = new Date(lastBuild.value).getTime();
   function checkDir(dir) {
     try {
-      const entries = readdirSync14(dir, { withFileTypes: true });
+      const entries = readdirSync15(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = join11(dir, entry.name);
+        const fullPath = join12(dir, entry.name);
         if (entry.isDirectory()) {
           if (["__pycache__", ".venv", "venv", "node_modules", ".mypy_cache", ".pytest_cache"].includes(entry.name)) continue;
           if (checkDir(fullPath)) return true;
@@ -18729,8 +19191,8 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync22, existsSync as existsSync24, statSync as statSync12 } from "fs";
-import { resolve as resolve20, dirname as dirname12, join as join12 } from "path";
+import { readFileSync as readFileSync23, existsSync as existsSync24, statSync as statSync12 } from "fs";
+import { resolve as resolve20, dirname as dirname13, join as join13 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -18788,7 +19250,7 @@ function resolveImportPath(specifier, fromFile) {
     const paths = getResolvedPaths();
     basePath = resolve20(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve20(dirname12(fromFile), specifier);
+    basePath = resolve20(dirname13(fromFile), specifier);
   }
   if (existsSync24(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
@@ -18801,7 +19263,7 @@ function resolveImportPath(specifier, fromFile) {
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
-    const indexPath = join12(basePath, indexFile);
+    const indexPath = join13(basePath, indexFile);
     if (existsSync24(indexPath)) {
       return toRelative(indexPath);
     }
@@ -18842,7 +19304,7 @@ function buildImportIndex(dataDb2, codegraphDb2) {
     if (!existsSync24(absPath)) continue;
     let source;
     try {
-      source = readFileSync22(absPath, "utf-8");
+      source = readFileSync23(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -18878,15 +19340,15 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync23, existsSync as existsSync25, readdirSync as readdirSync15 } from "fs";
-import { resolve as resolve21, join as join13 } from "path";
+import { readFileSync as readFileSync24, existsSync as existsSync25, readdirSync as readdirSync16 } from "fs";
+import { resolve as resolve21, join as join14 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
   if (!existsSync25(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
-  const source = readFileSync23(rootPath, "utf-8");
+  const source = readFileSync24(rootPath, "utf-8");
   const mappings = [];
   const importMap = /* @__PURE__ */ new Map();
   const importRegex = /import\s+\{[^}]*?(\w+Router)[^}]*\}\s+from\s+['"]\.\/routers\/([^'"]+)['"]/g;
@@ -18902,7 +19364,7 @@ function parseRootRouter() {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
-      const indexCandidate = join13(fullPath, "index.ts");
+      const indexCandidate = join14(fullPath, "index.ts");
       if (existsSync25(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
@@ -18924,7 +19386,7 @@ function parseRootRouter() {
 function extractProcedures(routerFilePath) {
   const absPath = resolve21(getProjectRoot(), routerFilePath);
   if (!existsSync25(absPath)) return [];
-  const source = readFileSync23(absPath, "utf-8");
+  const source = readFileSync24(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
   const procRegex = /(\w+)\s*:\s*(protected|public)Procedure/g;
@@ -18959,15 +19421,15 @@ function findUICallSites(routerKey, procedureName) {
   return callSites;
 }
 function searchDirectory(dir, pattern, results) {
-  const entries = readdirSync15(dir, { withFileTypes: true });
+  const entries = readdirSync16(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join13(dir, entry.name);
+    const fullPath = join14(dir, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name === ".next") continue;
       searchDirectory(fullPath, pattern, results);
     } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
       try {
-        const source = readFileSync23(fullPath, "utf-8");
+        const source = readFileSync24(fullPath, "utf-8");
         const lines = source.split("\n");
         for (let i = 0; i < lines.length; i++) {
           if (lines[i].includes(pattern)) {
@@ -19030,7 +19492,7 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync24, existsSync as existsSync26 } from "fs";
+import { readFileSync as readFileSync25, existsSync as existsSync26 } from "fs";
 import { resolve as resolve22 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
@@ -19072,7 +19534,7 @@ function findRouterCalls(files) {
     const absPath = ensureWithinRoot(resolve22(projectRoot, file), projectRoot);
     if (!existsSync26(absPath)) continue;
     try {
-      const source = readFileSync24(absPath, "utf-8");
+      const source = readFileSync25(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
       let match;
       while ((match = apiCallRegex.exec(source)) !== null) {
@@ -19093,7 +19555,7 @@ function findTablesFromRouters(routerNames, dataDb2) {
       const absPath = ensureWithinRoot(resolve22(getProjectRoot(), proc.router_file), getProjectRoot());
       if (!existsSync26(absPath)) continue;
       try {
-        const source = readFileSync24(absPath, "utf-8");
+        const source = readFileSync25(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
         const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
         const tableRegex = new RegExp(regexStr + "\\.", "g");
@@ -19362,14 +19824,14 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync25, existsSync as existsSync27, readdirSync as readdirSync16 } from "fs";
-import { join as join14 } from "path";
+import { readFileSync as readFileSync26, existsSync as existsSync27, readdirSync as readdirSync17 } from "fs";
+import { join as join15 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
   if (!existsSync27(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
-  const source = readFileSync25(schemaPath, "utf-8");
+  const source = readFileSync26(schemaPath, "utf-8");
   const models = [];
   const sourceLines = source.split("\n");
   let i = 0;
@@ -19432,9 +19894,9 @@ function findColumnUsageInRouters(tableName) {
   return usage;
 }
 function scanDirectory(dir, tableName, usage) {
-  const entries = readdirSync16(dir, { withFileTypes: true });
+  const entries = readdirSync17(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join14(dir, entry.name);
+    const fullPath = join15(dir, entry.name);
     if (entry.isDirectory()) {
       scanDirectory(fullPath, tableName, usage);
     } else if (entry.name.endsWith(".ts")) {
@@ -19444,7 +19906,7 @@ function scanDirectory(dir, tableName, usage) {
 }
 function scanFile(absPath, tableName, usage) {
   try {
-    const source = readFileSync25(absPath, "utf-8");
+    const source = readFileSync26(absPath, "utf-8");
     if (!source.includes(tableName)) return;
     const relPath = absPath.slice(getProjectRoot().length + 1);
     const lines = source.split("\n");
@@ -19490,14 +19952,14 @@ function detectMismatches(models) {
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
   if (!existsSync27(dir)) return result;
-  const entries = readdirSync16(dir, { withFileTypes: true });
+  const entries = readdirSync17(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join14(dir, entry.name);
+    const fullPath = join15(dir, entry.name);
     if (entry.isDirectory()) {
       result.push(...findFilesUsingColumn(fullPath, column, tableName));
     } else if (entry.name.endsWith(".ts")) {
       try {
-        const source = readFileSync25(fullPath, "utf-8");
+        const source = readFileSync26(fullPath, "utf-8");
         if (source.includes(tableName) && source.includes(column)) {
           result.push(fullPath.slice(getProjectRoot().length + 1));
         }
@@ -19642,32 +20104,32 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync26, existsSync as existsSync28, readdirSync as readdirSync17 } from "fs";
-import { resolve as resolve24, join as join15, relative as relative6, dirname as dirname13 } from "path";
+import { readFileSync as readFileSync27, existsSync as existsSync28, readdirSync as readdirSync18 } from "fs";
+import { resolve as resolve24, join as join16, relative as relative6, dirname as dirname14 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname13(resolve24(projectRoot, fromFile));
+    let baseDir = dirname14(resolve24(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
-      baseDir = dirname13(baseDir);
+      baseDir = dirname14(baseDir);
     }
     const modulePart = module.replace(/^\.+/, "");
     if (modulePart) {
       const parts2 = modulePart.split(".");
-      return tryResolvePythonPath(join15(baseDir, ...parts2), projectRoot);
+      return tryResolvePythonPath(join16(baseDir, ...parts2), projectRoot);
     }
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts = module.split(".");
-  const candidate = join15(resolve24(projectRoot, pythonRoot), ...parts);
+  const candidate = join16(resolve24(projectRoot, pythonRoot), ...parts);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
   if (existsSync28(basePath + ".py")) {
     return relative6(projectRoot, basePath + ".py");
   }
-  if (existsSync28(join15(basePath, "__init__.py"))) {
-    return relative6(projectRoot, join15(basePath, "__init__.py"));
+  if (existsSync28(join16(basePath, "__init__.py"))) {
+    return relative6(projectRoot, join16(basePath, "__init__.py"));
   }
   if (basePath.endsWith(".py") && existsSync28(basePath)) {
     return relative6(projectRoot, basePath);
@@ -19677,13 +20139,13 @@ function tryResolvePythonPath(basePath, projectRoot) {
 function walkPythonFiles(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync17(dir, { withFileTypes: true });
+    const entries = readdirSync18(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPythonFiles(join15(dir, entry.name), excludeDirs));
+        files.push(...walkPythonFiles(join16(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join15(dir, entry.name));
+        files.push(join16(dir, entry.name));
       }
     }
   } catch {
@@ -19709,7 +20171,7 @@ function buildPythonImportIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__
     const relFile = relative6(projectRoot, absFile);
     let source;
     try {
-      source = readFileSync26(absFile, "utf-8");
+      source = readFileSync27(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -19975,18 +20437,18 @@ var init_route_parser = __esm({
 });
 
 // src/python/route-indexer.ts
-import { readFileSync as readFileSync27, readdirSync as readdirSync18 } from "fs";
-import { join as join16, relative as relative7 } from "path";
+import { readFileSync as readFileSync28, readdirSync as readdirSync19 } from "fs";
+import { join as join17, relative as relative7 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync18(dir, { withFileTypes: true });
+    const entries = readdirSync19(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles(join16(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles(join17(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join16(dir, entry.name));
+        files.push(join17(dir, entry.name));
       }
     }
   } catch {
@@ -19995,7 +20457,7 @@ function walkPyFiles(dir, excludeDirs) {
 }
 function buildPythonRouteIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join16(projectRoot, pythonRoot);
+  const absRoot = join17(projectRoot, pythonRoot);
   dataDb2.exec("DELETE FROM massu_py_routes");
   dataDb2.exec("DELETE FROM massu_py_route_callers");
   const insertStmt = dataDb2.prepare(
@@ -20008,7 +20470,7 @@ function buildPythonRouteIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__"
       const relFile = relative7(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync27(absFile, "utf-8");
+        source = readFileSync28(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -20219,18 +20681,18 @@ var init_model_parser = __esm({
 });
 
 // src/python/model-indexer.ts
-import { readFileSync as readFileSync28, readdirSync as readdirSync19 } from "fs";
-import { join as join17, relative as relative8 } from "path";
+import { readFileSync as readFileSync29, readdirSync as readdirSync20 } from "fs";
+import { join as join18, relative as relative8 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
   try {
-    const entries = readdirSync19(dir, { withFileTypes: true });
+    const entries = readdirSync20(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (excludeDirs.includes(entry.name)) continue;
-        files.push(...walkPyFiles2(join17(dir, entry.name), excludeDirs));
+        files.push(...walkPyFiles2(join18(dir, entry.name), excludeDirs));
       } else if (entry.name.endsWith(".py")) {
-        files.push(join17(dir, entry.name));
+        files.push(join18(dir, entry.name));
       }
     }
   } catch {
@@ -20239,7 +20701,7 @@ function walkPyFiles2(dir, excludeDirs) {
 }
 function buildPythonModelIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = join17(projectRoot, pythonRoot);
+  const absRoot = join18(projectRoot, pythonRoot);
   dataDb2.exec("DELETE FROM massu_py_models");
   dataDb2.exec("DELETE FROM massu_py_fk_edges");
   const insertModel = dataDb2.prepare(
@@ -20255,7 +20717,7 @@ function buildPythonModelIndex(dataDb2, pythonRoot, excludeDirs = ["__pycache__"
       const relFile = relative8(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync28(absFile, "utf-8");
+        source = readFileSync29(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -20515,19 +20977,19 @@ var init_migration_parser = __esm({
 });
 
 // src/python/migration-indexer.ts
-import { readFileSync as readFileSync29, readdirSync as readdirSync20 } from "fs";
-import { join as join18, relative as relative9 } from "path";
+import { readFileSync as readFileSync30, readdirSync as readdirSync21 } from "fs";
+import { join as join19, relative as relative9 } from "path";
 function buildPythonMigrationIndex(dataDb2, alembicDir) {
   const projectRoot = getProjectRoot();
-  const absDir = join18(projectRoot, alembicDir);
+  const absDir = join19(projectRoot, alembicDir);
   dataDb2.exec("DELETE FROM massu_py_migrations");
-  const versionsDir = join18(absDir, "versions");
+  const versionsDir = join19(absDir, "versions");
   let files = [];
   try {
-    files = readdirSync20(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join18(versionsDir, f2));
+    files = readdirSync21(versionsDir).filter((f2) => f2.endsWith(".py")).map((f2) => join19(versionsDir, f2));
   } catch {
     try {
-      files = readdirSync20(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join18(absDir, f2));
+      files = readdirSync21(absDir).filter((f2) => f2.endsWith(".py") && f2 !== "env.py").map((f2) => join19(absDir, f2));
     } catch {
     }
   }
@@ -20541,7 +21003,7 @@ function buildPythonMigrationIndex(dataDb2, alembicDir) {
   for (const absFile of files) {
     let source;
     try {
-      source = readFileSync29(absFile, "utf-8");
+      source = readFileSync30(absFile, "utf-8");
     } catch {
       continue;
     }
@@ -20575,12 +21037,12 @@ var init_migration_indexer = __esm({
 });
 
 // src/python/coupling-detector.ts
-import { readFileSync as readFileSync30, readdirSync as readdirSync21 } from "fs";
-import { join as join19, relative as relative10 } from "path";
+import { readFileSync as readFileSync31, readdirSync as readdirSync22 } from "fs";
+import { join as join20, relative as relative10 } from "path";
 function buildPythonCouplingIndex(dataDb2) {
   const projectRoot = getProjectRoot();
   const config = getConfig();
-  const srcDir = join19(projectRoot, config.paths.source);
+  const srcDir = join20(projectRoot, config.paths.source);
   const routes = dataDb2.prepare("SELECT id, method, path FROM massu_py_routes").all();
   if (routes.length === 0) return 0;
   dataDb2.exec("DELETE FROM massu_py_route_callers");
@@ -20612,7 +21074,7 @@ function buildPythonCouplingIndex(dataDb2) {
       const relFile = relative10(projectRoot, absFile);
       let source;
       try {
-        source = readFileSync30(absFile, "utf-8");
+        source = readFileSync31(absFile, "utf-8");
       } catch {
         continue;
       }
@@ -20640,13 +21102,13 @@ function walkFrontendFiles(dir) {
   const files = [];
   const exclude = ["node_modules", ".next", "dist", ".git", "__pycache__", ".venv", "venv"];
   try {
-    const entries = readdirSync21(dir, { withFileTypes: true });
+    const entries = readdirSync22(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (exclude.includes(entry.name)) continue;
-        files.push(...walkFrontendFiles(join19(dir, entry.name)));
+        files.push(...walkFrontendFiles(join20(dir, entry.name)));
       } else if (/\.(tsx?|jsx?)$/.test(entry.name)) {
-        files.push(join19(dir, entry.name));
+        files.push(join20(dir, entry.name));
       }
     }
   } catch {
@@ -21017,7 +21479,7 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync31, existsSync as existsSync29 } from "fs";
+import { readFileSync as readFileSync32, existsSync as existsSync29 } from "fs";
 import { resolve as resolve25, basename as basename6 } from "path";
 function p3(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -21076,7 +21538,7 @@ function loadDocsMap() {
   if (!existsSync29(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
-  return JSON.parse(readFileSync31(mapPath, "utf-8"));
+  return JSON.parse(readFileSync32(mapPath, "utf-8"));
 }
 function matchesPattern(filePath, pattern) {
   const regexStr = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "{{GLOBSTAR}}").replace(/\*/g, "[^/]*").replace(/\{\{GLOBSTAR\}\}/g, ".*");
@@ -21150,9 +21612,9 @@ function extractProcedureNames(routerPath) {
   if (!existsSync29(absPath)) {
     const altPath = ensureWithinRoot(resolve25(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
     if (!existsSync29(altPath)) return [];
-    return extractProcedureNamesFromContent(readFileSync31(altPath, "utf-8"));
+    return extractProcedureNamesFromContent(readFileSync32(altPath, "utf-8"));
   }
-  return extractProcedureNamesFromContent(readFileSync31(absPath, "utf-8"));
+  return extractProcedureNamesFromContent(readFileSync32(absPath, "utf-8"));
 }
 function extractProcedureNamesFromContent(content) {
   const procRegex = /\.(?:query|mutation)\s*\(/g;
@@ -21205,7 +21667,7 @@ function handleDocsAudit(args2) {
       });
       continue;
     }
-    const content = readFileSync31(helpPagePath, "utf-8");
+    const content = readFileSync32(helpPagePath, "utf-8");
     const sections = extractSections(content);
     const frontmatter = extractFrontmatter(content);
     const staleReasons = [];
@@ -21247,7 +21709,7 @@ function handleDocsAudit(args2) {
       if (parentId === mappingId) {
         const guidePath = ensureWithinRoot(resolve25(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
         if (existsSync29(guidePath)) {
-          const guideContent = readFileSync31(guidePath, "utf-8");
+          const guideContent = readFileSync32(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
             results.push({
@@ -21287,7 +21749,7 @@ function handleDocsCoverage(args2) {
     let lastVerified = null;
     let status = null;
     if (exists) {
-      const content = readFileSync31(helpPagePath, "utf-8");
+      const content = readFileSync32(helpPagePath, "utf-8");
       lineCount = content.split("\n").length;
       hasContent = lineCount > 10;
       const frontmatter = extractFrontmatter(content);
@@ -22405,8 +22867,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync32, existsSync as existsSync31, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
-import { resolve as resolve27, join as join20, basename as basename7, dirname as dirname14, relative as relative11 } from "path";
+import { readFileSync as readFileSync33, existsSync as existsSync31, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
+import { resolve as resolve27, join as join21, basename as basename7, dirname as dirname15, relative as relative11 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -22538,7 +23000,7 @@ function scanComponentExports(dataDb2) {
   const basePath = resolve27(projectRoot, componentsBase);
   if (existsSync31(basePath)) {
     try {
-      const entries = readdirSync22(basePath, { withFileTypes: true });
+      const entries = readdirSync23(basePath, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           componentDirs.push(componentsBase + "/" + entry.name);
@@ -22553,7 +23015,7 @@ function scanComponentExports(dataDb2) {
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative11(projectRoot, file);
-      const source = readFileSync32(file, "utf-8");
+      const source = readFileSync33(file, "utf-8");
       const annotations = parseFeatureAnnotations(source);
       if (annotations.length > 0) {
         for (const ann of annotations) {
@@ -22579,7 +23041,7 @@ function scanComponentExports(dataDb2) {
       if (hasHandlers && exportMatch) {
         const componentName = exportMatch[1];
         const domain = inferDomain(relPath);
-        const subdomain = basename7(dirname14(relPath));
+        const subdomain = basename7(dirname15(relPath));
         const featureKey = `component.${subdomain}.${componentName.replace(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "")}`;
         if (!annotations.some((a2) => a2.featureKey === featureKey)) {
           features.push({
@@ -22602,9 +23064,9 @@ function scanComponentExports(dataDb2) {
 function walkDir2(dir) {
   const results = [];
   try {
-    const entries = readdirSync22(dir);
+    const entries = readdirSync23(dir);
     for (const entry of entries) {
-      const fullPath = join20(dir, entry);
+      const fullPath = join21(dir, entry);
       try {
         const stat = statSync13(fullPath);
         if (stat.isDirectory()) {
@@ -23592,7 +24054,7 @@ var init_audit_trail = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync32, readFileSync as readFileSync33 } from "fs";
+import { existsSync as existsSync32, readFileSync as readFileSync34 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -23632,7 +24094,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  const source = readFileSync33(absPath, "utf-8");
+  const source = readFileSync34(absPath, "utf-8");
   const lines = source.split("\n");
   if (activeChecks.rule_compliance !== false) {
     for (const ruleSet of config.rules) {
@@ -24077,7 +24539,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync33, readFileSync as readFileSync34 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync35 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -24106,7 +24568,7 @@ function scoreFileSecurity(filePath, projectRoot) {
   }
   let source;
   try {
-    source = readFileSync34(absPath, "utf-8");
+    source = readFileSync35(absPath, "utf-8");
   } catch {
     return { riskScore: 0, findings: [] };
   }
@@ -24395,7 +24857,7 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync34, readFileSync as readFileSync35 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync36 } from "fs";
 import { resolve as resolve28 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -24431,7 +24893,7 @@ function getInstalledPackages(projectRoot) {
   const pkgPath = resolve28(projectRoot, "package.json");
   if (!existsSync34(pkgPath)) return /* @__PURE__ */ new Map();
   try {
-    const pkg = JSON.parse(readFileSync35(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync36(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
     for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {
       packages.set(name, version);
@@ -25033,8 +25495,8 @@ var init_regression_detector = __esm({
 });
 
 // src/knowledge-indexer.ts
-import { createHash as createHash8 } from "crypto";
-import { readFileSync as readFileSync36, readdirSync as readdirSync23, statSync as statSync14, existsSync as existsSync35 } from "fs";
+import { createHash as createHash9 } from "crypto";
+import { readFileSync as readFileSync37, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync35 } from "fs";
 import { resolve as resolve29, relative as relative12, basename as basename8, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
@@ -25061,7 +25523,7 @@ function discoverMarkdownFiles(baseDir) {
   const files = [];
   function walk(dir) {
     try {
-      const entries = readdirSync23(dir, { withFileTypes: true });
+      const entries = readdirSync24(dir, { withFileTypes: true });
       for (const entry of entries) {
         const fullPath = resolve29(dir, entry.name);
         if (entry.isDirectory()) {
@@ -25121,7 +25583,7 @@ function categorizeFile(filePath) {
   return "root";
 }
 function hashContent2(content) {
-  return createHash8("sha256").update(content).digest("hex");
+  return createHash9("sha256").update(content).digest("hex");
 }
 function parseCRTable(content) {
   const rules = [];
@@ -25389,7 +25851,7 @@ function indexAllKnowledge(db) {
     }
     for (const filePath of files) {
       if (!existsSync35(filePath)) continue;
-      const content = readFileSync36(filePath, "utf-8");
+      const content = readFileSync37(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative12(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative12(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative12(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative12(paths.memoryDir, filePath)}` : basename8(filePath);
       const category = categorizeFile(filePath);
@@ -25541,7 +26003,7 @@ var init_knowledge_indexer = __esm({
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync37, writeFileSync as writeFileSync5, appendFileSync as appendFileSync2, readdirSync as readdirSync24 } from "fs";
+import { readFileSync as readFileSync38, writeFileSync as writeFileSync6, appendFileSync as appendFileSync2, readdirSync as readdirSync25 } from "fs";
 import { resolve as resolve30, basename as basename9 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -26292,14 +26754,14 @@ ${crRule ? `- **CR**: ${crRule}
 `;
   let existing = "";
   try {
-    existing = readFileSync37(correctionsPath, "utf-8");
+    existing = readFileSync38(correctionsPath, "utf-8");
   } catch {
   }
   const archiveIdx = existing.indexOf("## Archived");
   if (archiveIdx > 0) {
     const before = existing.slice(0, archiveIdx);
     const after = existing.slice(archiveIdx);
-    writeFileSync5(correctionsPath, before + entry + after);
+    writeFileSync6(correctionsPath, before + entry + after);
   } else {
     appendFileSync2(correctionsPath, entry);
   }
@@ -26474,7 +26936,7 @@ function handleGaps(db, args2) {
   } else if (checkType === "routers") {
     try {
       const routersDir = getResolvedPaths().routersDir;
-      const routerFiles = readdirSync24(routersDir).filter((f2) => f2.endsWith(".ts") && !f2.startsWith("_"));
+      const routerFiles = readdirSync25(routersDir).filter((f2) => f2.endsWith(".ts") && !f2.startsWith("_"));
       lines.push(`| Router | Knowledge Hits | Status |`);
       lines.push(`|--------|----------------|--------|`);
       for (const file of routerFiles) {
@@ -26630,13 +27092,13 @@ var init_knowledge_tools = __esm({
 
 // src/knowledge-db.ts
 import Database3 from "better-sqlite3";
-import { dirname as dirname15 } from "path";
-import { existsSync as existsSync37, mkdirSync as mkdirSync10 } from "fs";
+import { dirname as dirname16 } from "path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync11 } from "fs";
 function getKnowledgeDb() {
   const dbPath = getResolvedPaths().knowledgeDbPath;
-  const dir = dirname15(dbPath);
+  const dir = dirname16(dbPath);
   if (!existsSync37(dir)) {
-    mkdirSync10(dir, { recursive: true });
+    mkdirSync11(dir, { recursive: true });
   }
   const db = new Database3(dbPath);
   db.pragma("journal_mode = WAL");
@@ -27369,7 +27831,7 @@ var init_python_tools = __esm({
 });
 
 // src/tools.ts
-import { readFileSync as readFileSync38, existsSync as existsSync38 } from "fs";
+import { readFileSync as readFileSync39, existsSync as existsSync38 } from "fs";
 import { resolve as resolve31, basename as basename10 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
@@ -27806,7 +28268,7 @@ function handleContext(file, dataDb2, codegraphDb2) {
           const root = getProjectRoot();
           const absFilePath = ensureWithinRoot(resolve31(resolvedPaths.srcDir, "..", file), root);
           if (existsSync38(absFilePath)) {
-            const fileContent = readFileSync38(absFilePath, "utf-8").slice(0, 3e3);
+            const fileContent = readFileSync39(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
             if (fileContent.includes("ctx.db")) keywords.push("database", "schema");
             if (fileContent.includes("BigInt") || fileContent.includes("Decimal")) keywords.push("BigInt", "serialization");
@@ -28234,7 +28696,7 @@ function handleSchema(args2) {
     if (!existsSync38(absPath)) {
       return text17(`File not found: ${file}`);
     }
-    const source = readFileSync38(absPath, "utf-8");
+    const source = readFileSync39(absPath, "utf-8");
     const config = getConfig();
     const dbPattern = config.dbAccessPattern ?? "ctx.db.{table}";
     const regexStr = dbPattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace("\\{table\\}", "(\\w+)");
@@ -28312,8 +28774,8 @@ var init_tools = __esm({
 
 // src/server.ts
 var server_exports = {};
-import { readFileSync as readFileSync39 } from "fs";
-import { resolve as resolve32, dirname as dirname16 } from "path";
+import { readFileSync as readFileSync40 } from "fs";
+import { resolve as resolve32, dirname as dirname17 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function getDb() {
   if (!codegraphDb) codegraphDb = getCodeGraphDb();
@@ -28405,10 +28867,10 @@ var init_server = __esm({
     init_tools();
     init_memory_db();
     init_license();
-    __dirname4 = dirname16(fileURLToPath4(import.meta.url));
+    __dirname4 = dirname17(fileURLToPath4(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync39(resolve32(__dirname4, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync40(resolve32(__dirname4, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
@@ -28711,7 +29173,7 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync39, readFileSync as readFileSync40, writeFileSync as writeFileSync6, copyFileSync, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync41, writeFileSync as writeFileSync7, copyFileSync, unlinkSync as unlinkSync3 } from "fs";
 import { resolve as resolve33 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
@@ -28730,7 +29192,7 @@ async function runConfigUpgrade(opts = {}) {
     }
     try {
       copyFileSync(bakPath, configPath);
-      unlinkSync2(bakPath);
+      unlinkSync3(bakPath);
       log("Config restored from backup.\n");
       return { exitCode: 0, action: "rolled-back" };
     } catch (e2) {
@@ -28746,7 +29208,7 @@ async function runConfigUpgrade(opts = {}) {
   }
   let existing;
   try {
-    const content = readFileSync40(configPath, "utf-8");
+    const content = readFileSync41(configPath, "utf-8");
     const parsed = parseYaml6(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -28769,8 +29231,8 @@ async function runConfigUpgrade(opts = {}) {
     fingerprint: computeFingerprint(detection)
   };
   try {
-    const original = readFileSync40(configPath, "utf-8");
-    writeFileSync6(bakPath, original, "utf-8");
+    const original = readFileSync41(configPath, "utf-8");
+    writeFileSync7(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
     err(message + "\n");
@@ -28803,7 +29265,7 @@ var config_check_drift_exports = {};
 __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
-import { existsSync as existsSync40, readFileSync as readFileSync41 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync42 } from "fs";
 import { resolve as resolve34 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
@@ -28831,7 +29293,7 @@ async function runConfigCheckDrift(opts = {}) {
   }
   let config;
   try {
-    const content = readFileSync41(configPath, "utf-8");
+    const content = readFileSync42(configPath, "utf-8");
     const parsed = parseYaml7(content);
     if (!parsed || typeof parsed !== "object") {
       throw new Error("config is not a YAML object");
@@ -28898,11 +29360,11 @@ var init_config_check_drift = __esm({
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync42 } from "fs";
-import { resolve as resolve35, dirname as dirname17 } from "path";
+import { readFileSync as readFileSync43 } from "fs";
+import { resolve as resolve35, dirname as dirname18 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 var __filename4 = fileURLToPath5(import.meta.url);
-var __dirname5 = dirname17(__filename4);
+var __dirname5 = dirname18(__filename4);
 var args = process.argv.slice(2);
 var subcommand = args[0];
 async function main() {
@@ -29084,7 +29546,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync42(resolve35(__dirname5, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync43(resolve35(__dirname5, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");