@viberaven/cli 1.5.0 → 1.5.2

package/dist/cli.js

@@ -9474,7 +9474,52 @@ function buildDefinerFunctionCheck(replay) {
     findings
   };
 }
-function buildPoolerCheck(files) {
+function directPostgresClients(files) {
+  const found = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    const path = file.path.replace(/\\/g, "/");
+    if (PRISMA_SCHEMA.test(path)) {
+      if (/provider\s*=\s*["'](?:postgresql|postgres)["']/i.test(file.content)) found.add(`prisma (${path})`);
+    } else if (/(^|\/)package\.json$/.test(path)) {
+      try {
+        const pkg = JSON.parse(file.content);
+        for (const key of ["dependencies", "devDependencies", "optionalDependencies"]) {
+          const group = pkg[key];
+          if (!group || typeof group !== "object") continue;
+          for (const name of Object.keys(group)) if (DIRECT_POSTGRES_PACKAGES.has(name)) found.add(name);
+        }
+      } catch {
+      }
+    } else if (SOURCE_CODE_EXT.test(path)) {
+      const match = file.content.match(DIRECT_POSTGRES_IMPORT);
+      if (match) found.add(match[0].replace(/^(?:from\s+|import\s*\(\s*|require\s*\(\s*)/, "").replace(/['"]/g, ""));
+    }
+  }
+  return [...found].sort();
+}
+function buildPoolerCheck(files, allFiles = files) {
+  const clients = directPostgresClients(allFiles);
+  if (clients.length === 0) {
+    return {
+      id: "vercel-supabase-pooler-port",
+      title: "Vercel/Supabase pooler port",
+      status: "pass",
+      summary: "Not applicable. No direct Postgres driver or ORM was found in package.json or code, so the app reaches Supabase through supabase-js over HTTPS and has no database connection for the pooler to protect.",
+      evidence: []
+    };
+  }
+  const connectionEvidence = allFiles.filter((file) => isEnvFile(file.path.split(/[\\/]/).pop() ?? "") || SOURCE_CODE_EXT.test(file.path) || PRISMA_SCHEMA.test(file.path)).flatMap((file) => lineEvidence(file, CONNECTION_STRING));
+  if (connectionEvidence.length === 0) {
+    const reason = `a direct Postgres client is installed (${clients.join(", ")}) but no DATABASE_URL/POSTGRES_URL, env("...") or postgres:// connection string was found in env files, code or Prisma schemas`;
+    return {
+      id: "vercel-supabase-pooler-port",
+      title: "Vercel/Supabase pooler port",
+      status: "needs_work",
+      summary: `Not checked: ${reason}, so the pooler port could not be checked.`,
+      evidence: [],
+      incomplete: [reason]
+    };
+  }
   const dbUrlPattern = /\b(?:DATABASE_URL|POSTGRES_URL)\b/i;
   const direct5432Evidence = files.flatMap(
     (file) => lineEvidence(file, /\b(?:DATABASE_URL|POSTGRES_URL)\b[^\n\r]*:5432\b/i)
@@ -9546,7 +9591,7 @@ function buildVercelSupabaseAudit(input) {
   const checks = [
     buildRlsCheck(replay),
     buildPermissivePolicyCheck(replay),
-    buildPoolerCheck(input.files),
+    buildPoolerCheck(input.files, allFiles),
     buildServiceRoleCheck(allFiles, incomplete),
     buildDataApiGrantCheck(replay, allFiles, incomplete),
     buildDefinerFunctionCheck(replay)
@@ -9686,6 +9731,7 @@ async function collectSourceFiles(projectRoot, alreadyCollected) {
       else if (name === "package.json" || /^vite\.config\.[cm]?[jt]s$/.test(name)) candidates.push({ absolutePath, relativePath, rank: 0 });
       else if (name === "index.html" && !inTestDir) candidates.push({ absolutePath, relativePath, rank: 0 });
       else if (/(^|\/)supabase\/config\.toml$/.test(relativePath)) candidates.push({ absolutePath, relativePath, rank: 0 });
+      else if (/\.prisma$/i.test(name) && !inTestDir) candidates.push({ absolutePath, relativePath, rank: 0 });
       else if (/\.sql$/i.test(name)) {
         if (!inTestDir) candidates.push({ absolutePath, relativePath, rank: 1 });
       } else if (SOURCE_CODE_EXT.test(name) && !inTestDir) candidates.push({ absolutePath, relativePath, rank: 2, filter: SOURCE_CODE_SIGNAL });
@@ -9776,7 +9822,7 @@ function renderVercelSupabaseAudit(result) {
   }
   return lines.join("\n").trimEnd();
 }
-var import_promises3, import_node_path4, ENV_FILES, SQL_ROOTS, SQL_TEST_DIRS, SKIP_DIRS, SENSITIVE_ENV_KEY, SOURCE_SKIP_DIRS, SOURCE_TEST_DIRS, SOURCE_CODE_EXT, SOURCE_CODE_SIGNAL, SOURCE_LIMITS, CODE_DIR_FIRST, BULK_DIR_LAST;
+var import_promises3, import_node_path4, ENV_FILES, SQL_ROOTS, SQL_TEST_DIRS, SKIP_DIRS, SENSITIVE_ENV_KEY, DIRECT_POSTGRES_PACKAGES, DIRECT_POSTGRES_IMPORT, CONNECTION_STRING, PRISMA_SCHEMA, SOURCE_SKIP_DIRS, SOURCE_TEST_DIRS, SOURCE_CODE_EXT, SOURCE_CODE_SIGNAL, SOURCE_LIMITS, CODE_DIR_FIRST, BULK_DIR_LAST;
 var init_audit = __esm({
   "src/commands/audit.ts"() {
     "use strict";
@@ -9798,6 +9844,27 @@ var init_audit = __esm({
     SQL_TEST_DIRS = /* @__PURE__ */ new Set(["test", "tests", "__tests__", "spec"]);
     SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".next", "dist", "build", "coverage"]);
     SENSITIVE_ENV_KEY = /\b[A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|SERVICE_ROLE|DATABASE_URL|POSTGRES_URL)[A-Z0-9_]*\b/i;
+    DIRECT_POSTGRES_PACKAGES = /* @__PURE__ */ new Set([
+      "pg",
+      "postgres",
+      "pg-promise",
+      "slonik",
+      "@neondatabase/serverless",
+      "@vercel/postgres",
+      "prisma",
+      "@prisma/client",
+      "drizzle-orm",
+      "kysely",
+      "typeorm",
+      "knex",
+      "sequelize",
+      "@mikro-orm/postgresql",
+      "@databases/pg",
+      "massive"
+    ]);
+    DIRECT_POSTGRES_IMPORT = /(?:from\s+|import\s*\(\s*|require\s*\(\s*)['"](?:npm:)?(?:pg|postgres|pg-promise|slonik|@neondatabase\/serverless|@vercel\/postgres|@prisma\/client|drizzle-orm(?:\/[\w-]+)?|kysely|typeorm|knex|sequelize)(?:@[^'"/]*)?(?:\/[^'"]*)?['"]|['"]jsr:@db\/postgres|deno\.land\/x\/postgres(?:js)?\b/;
+    CONNECTION_STRING = /\b[A-Z0-9_]*(?:DATABASE_URL|POSTGRES_URL|POSTGRES_PRISMA_URL|DB_URL|DIRECT_URL)\b|\bpostgres(?:ql)?:\/\//;
+    PRISMA_SCHEMA = /\.prisma$/i;
     SOURCE_SKIP_DIRS = /* @__PURE__ */ new Set([
       ...SKIP_DIRS,
       ".viberaven",
@@ -9817,7 +9884,7 @@ var init_audit = __esm({
     ]);
     SOURCE_TEST_DIRS = /* @__PURE__ */ new Set(["test", "tests", "__tests__", "__mocks__", "e2e", "cypress", "playwright", "fixtures"]);
     SOURCE_CODE_EXT = /\.(?:[cm]?[jt]sx?|vue|svelte|astro|html?)$/i;
-    SOURCE_CODE_SIGNAL = /supabase|service_?role|sb_secret_|eyJhbGci/i;
+    SOURCE_CODE_SIGNAL = /supabase|service_?role|sb_secret_|eyJhbGci|DATABASE_URL|POSTGRES_URL|postgres(?:ql)?:\/\//i;
     SOURCE_LIMITS = {
       /** Directory entries listed, across the whole walk. */
       entries: 2e5,
@@ -10401,24 +10468,153 @@ function detectArchetype(signals, stack) {
   if (stack.length === 0) return "unknown";
   return "Web app";
 }
-function collectEnvVarDrift(scan) {
-  const example = scan.files.find(
-    (file) => /(^|\/)\.env\.example$/.test(file.path) && typeof file.content === "string"
-  );
-  if (!example || typeof example.content !== "string") return [];
-  const declared = new Set(
-    example.content.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#") && line.includes("=")).map((line) => line.split("=")[0].trim())
-  );
-  const used = /* @__PURE__ */ new Set();
-  const pattern = /process\.env\.([A-Z][A-Z0-9_]{2,})/g;
+function isEnvTemplatePath(path) {
+  return ENV_TEMPLATE_NAME.test(path.replace(/\\/g, "/").split("/").pop() ?? "");
+}
+function envTemplateNames(content) {
+  const names = [];
+  for (const raw of content.split(/\r?\n/)) {
+    const match = raw.match(/^\s*(?:#\s*)?(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+    if (match) names.push(match[1]);
+  }
+  return names;
+}
+function analyzeEnvContract(scan, extra = {}) {
+  const templates = /* @__PURE__ */ new Map();
   for (const file of scan.files) {
-    if (!/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(file.path) || typeof file.content !== "string") continue;
-    let match;
-    while ((match = pattern.exec(file.content)) !== null) {
-      used.add(match[1]);
+    if (typeof file.content === "string" && isEnvTemplatePath(file.path)) templates.set(file.path.replace(/\\/g, "/"), file.content);
+  }
+  for (const file of extra.envTemplates ?? []) {
+    if (isEnvTemplatePath(file.path)) templates.set(file.path.replace(/\\/g, "/"), file.content);
+  }
+  const declared = new Set([...templates.values()].flatMap(envTemplateNames));
+  const used = /* @__PURE__ */ new Set();
+  for (const file of codeFilesFor(scan, extra.codeFiles)) {
+    if (!ENV_CODE_FILE.test(file.path)) continue;
+    const edgeFunction = /(^|\/)supabase\/functions\//.test(file.path);
+    const add = (name) => {
+      if (!(edgeFunction && SUPABASE_EDGE_ENV.has(name))) used.add(name);
+    };
+    const code = stripComments2(file.content);
+    for (const pattern of ENV_REFERENCES) {
+      for (const match of code.matchAll(pattern)) add(match[1]);
+    }
+    for (const match of code.matchAll(SVELTEKIT_STATIC_IMPORT)) {
+      for (const part of match[1].split(",")) {
+        const name = part.trim().split(/\s+as\s+/)[0].trim();
+        if (new RegExp(`^${ENV_NAME}$`).test(name)) add(name);
+      }
+    }
+    for (const match of code.matchAll(SVELTEKIT_DYNAMIC_IMPORT)) {
+      for (const part of match[1].split(",")) {
+        const [imported, local] = part.trim().split(/\s+as\s+/).map((x2) => x2.trim());
+        if (imported !== "env") continue;
+        const alias = (local ?? imported).replace(/\$/g, "\\$");
+        const reads = new RegExp(`\\b${alias}\\.(${ENV_NAME})\\b|\\b${alias}\\[\\s*['"\`](${ENV_NAME})['"\`]\\s*\\]`, "g");
+        for (const read of code.matchAll(reads)) add(read[1] ?? read[2]);
+      }
+    }
+    for (const match of code.matchAll(ENV_DESTRUCTURE)) {
+      for (const part of match[1].split(",")) {
+        const name = part.trim().split(/[:=\s]/)[0];
+        if (new RegExp(`^${ENV_NAME}$`).test(name)) add(name);
+      }
+    }
+  }
+  const missing = [...used].filter((name) => !declared.has(name) && !ENV_DRIFT_IGNORE.has(name) && !ENV_DRIFT_IGNORE_PREFIX.test(name)).sort();
+  return { templates: [...templates.keys()].sort(), declared: [...declared].sort(), used: [...used].sort(), missing };
+}
+function stripComments2(source) {
+  return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:'"\\])\/\/.*$/gm, "$1");
+}
+function exportedNames(code) {
+  const names = [];
+  const localVerifiers = /* @__PURE__ */ new Set();
+  const directVerifier = (body) => /^\s*return\s+(?:await\s+)?[\w$.]+\.(?:webhooks\.constructEvent(?:Async)?|signature\.verifyHeader(?:Async)?)\s*\([^;{}]+\)\s*;?\s*$/.test(body) && !STRIPE_VERIFY_JSON_BODY.test(body);
+  for (const fn of code.matchAll(/\b(export\s+)?(default\s+)?(?:async\s+)?function\s+([\w$]+)\s*\([^)]*\)\s*(?::[^{}]+)?\{([^{}]*)\}/g)) {
+    if (!directVerifier(fn[4])) continue;
+    localVerifiers.add(fn[3]);
+    if (fn[1]) names.push(fn[2] ? "default" : fn[3]);
+  }
+  for (const list of code.matchAll(/export\s*\{([^}]+)\}/g)) {
+    for (const entry of list[1].split(",")) {
+      const name = entry.trim().match(/^([\w$]+)(?:\s+as\s+([\w$]+))?$/);
+      if (name && localVerifiers.has(name[1])) names.push(name[2] ?? name[1]);
+    }
+  }
+  for (const object of code.matchAll(/export\s+(?:const|let|var)\s+([\w$]+)\s*=\s*\{\s*(?:async\s+)?([\w$]+)\s*\([^)]*\)\s*\{([^{}]*)\}\s*,?\s*\}/g)) {
+    if (directVerifier(object[3])) names.push(`${object[1]}.${object[2]}`);
+  }
+  return [...new Set(names)];
+}
+function assessStripeWebhooks(files) {
+  const facts = [];
+  for (const file of files) {
+    const path = file.path.replace(/\\/g, "/");
+    if (!CODE_FILE.test(path) || TEST_FILE.test(path)) continue;
+    const code = stripComments2(file.content);
+    const verify = STRIPE_VERIFY_CALL.test(code);
+    const header = STRIPE_SIGNATURE_HEADER.test(code);
+    const requestHandler = REQUEST_HANDLER.test(code);
+    const handler = verify || requestHandler && (header || STRIPE_EVENT_TYPE.test(code) || /webhook/i.test(path) && /stripe/i.test(code));
+    if (!handler) continue;
+    facts.push({ path, code, verify, header, raw: RAW_BODY.test(code), jsonBody: STRIPE_VERIFY_JSON_BODY.test(code), names: exportedNames(code) });
+  }
+  const helpers = facts.filter((f) => f.verify && !f.jsonBody && f.names.length > 0);
+  const paired = /* @__PURE__ */ new Set();
+  for (const route of facts.filter((f) => !f.verify && f.header && f.raw)) {
+    for (const helper of helpers) {
+      const names = [];
+      const withoutExtension = (path) => path.replace(/\.[cm]?[jt]sx?$/, "").replace(/\/index$/, "");
+      for (const imported of route.code.matchAll(/import\s+([^;'"\n]+?)\s+from\s*['"]([^'"]+)['"]/g)) {
+        const specifier = imported[2];
+        const modulePath = specifier.startsWith(".") ? import_node_path7.posix.join(import_node_path7.posix.dirname(route.path), specifier) : specifier.replace(/^@\//, "");
+        if (withoutExtension(modulePath) !== withoutExtension(helper.path)) continue;
+        const binding = imported[1].trim();
+        const defaultName = binding.match(/^([\w$]+)(?:\s*,|$)/)?.[1];
+        if (defaultName && helper.names.includes("default")) names.push(defaultName);
+        const named = binding.match(/\{([^}]+)\}/)?.[1];
+        for (const entry of named?.split(",") ?? []) {
+          const pair = entry.trim().match(/^([\w$]+)(?:\s+as\s+([\w$]+))?$/);
+          if (!pair) continue;
+          for (const name of helper.names) {
+            if (name === pair[1] || name.startsWith(`${pair[1]}.`)) names.push((pair[2] ?? pair[1]) + name.slice(pair[1].length));
+          }
+        }
+      }
+      if (names.some((name) => new RegExp(`\\b${name.replace(/[.$]/g, "\\$&")}\\s*\\(`).test(route.code))) {
+        paired.add(route.path);
+        paired.add(helper.path);
+      }
+    }
+  }
+  const verified = [];
+  const unverified = [];
+  for (const f of facts) {
+    const complete = f.verify && f.header && f.raw && !f.jsonBody;
+    if (complete || paired.has(f.path)) {
+      verified.push(f.path);
+      continue;
     }
+    const missing = [];
+    if (!f.verify) missing.push(f.header && f.raw ? "no signature check (constructEvent), and no call to a helper that runs it" : "no signature check (constructEvent)");
+    if (!f.header) missing.push("no stripe-signature header");
+    if (f.jsonBody) missing.push("body parsed as JSON before verification");
+    else if (!f.raw) missing.push("no raw body");
+    unverified.push({ path: f.path, missing });
   }
-  return [...used].filter((name) => !declared.has(name) && !ENV_DRIFT_IGNORE.has(name) && !name.startsWith("npm_") && !name.startsWith("VERCEL_")).sort();
+  return { verified: verified.sort(), unverified: unverified.sort((a, b3) => a.path < b3.path ? -1 : 1) };
+}
+function codeFilesFor(scan, fullCopies = []) {
+  const full = new Map(fullCopies.map((f) => [f.path.replace(/\\/g, "/"), f.content]));
+  const merged = /* @__PURE__ */ new Map();
+  for (const file of scan.files) {
+    if (typeof file.content !== "string") continue;
+    const path = file.path.replace(/\\/g, "/");
+    merged.set(path, full.get(path) ?? file.content);
+  }
+  for (const [path, content] of full) if (!merged.has(path)) merged.set(path, content);
+  return [...merged].map(([path, content]) => ({ path, content }));
 }
 function findUnboundedQueryFiles(scan) {
   const flagged = [];
@@ -10525,7 +10721,7 @@ function scanIncompleteSeed(audit) {
     primaryMapCategory: "security"
   };
 }
-function buildGapSeeds(scan, audit, databaseEvidence) {
+function buildGapSeeds(scan, audit, databaseEvidence, extra = {}) {
   const signals = scan.stackSignals;
   const usesDatabase = detectDatabaseUsage(scan, databaseEvidence);
   const seeds = [];
@@ -10572,6 +10768,16 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
         copyPrompt: "Audit every use of SUPABASE_SERVICE_ROLE_KEY in this repo. It must only be read in server-only modules (route handlers, server actions, edge functions) \u2014 never in client components or files bundled for the browser. Move violations behind a server boundary.",
         primaryMapCategory: "security"
       });
+    } else if (check.id === "vercel-supabase-pooler-port" && (check.incomplete ?? []).length > 0) {
+      seeds.push({
+        id: "pooler_port_unchecked",
+        category: "DATABASE & DATA",
+        severity: "info",
+        title: "Supabase pooler port could not be checked",
+        detail: `Not checked: ${(check.incomplete ?? []).join("; ")}.`,
+        copyPrompt: "Find where the app builds its Postgres connection string (env files, Prisma schema, the ORM config) and make sure serverless deployments use Supabase's transaction pooler (port 6543) rather than the direct 5432 connection.",
+        primaryMapCategory: "database"
+      });
     } else if (check.id === "vercel-supabase-pooler-port") {
       seeds.push({
         id: "pooler_port_mismatch",
@@ -10685,8 +10891,19 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
     });
   }
   if (signals.hasStripe) {
-    const webhookRoute = hasFilePath(scan, /webhook/i) || fileContentMatches(scan, /\.(ts|js|tsx)$/, /stripe.*webhook|constructEvent/i);
-    if (!webhookRoute) {
+    const webhooks = assessStripeWebhooks(codeFilesFor(scan, extra.codeFiles));
+    if (webhooks.unverified.length > 0) {
+      const lines = webhooks.unverified.map((u2) => `${u2.path} (${u2.missing.join(", ")})`);
+      seeds.push({
+        id: "unverified_stripe_webhook",
+        category: "SECURITY & AUTH",
+        severity: "warning",
+        title: "Stripe webhook does not verify the signature",
+        detail: `${webhooks.unverified.length} Stripe webhook handler${webhooks.unverified.length === 1 ? "" : "s"} without signature verification over the raw body: ${capLines(lines).join("; ")}. Anyone who finds the URL can post a fake event, for example a paid checkout.`,
+        copyPrompt: 'In each listed handler, read the raw request body (await req.text() in Next.js route handlers and Deno, express.raw({ type: "application/json" }) in Express), read the stripe-signature header, and pass both to stripe.webhooks.constructEvent (constructEventAsync on Deno or edge runtimes) with STRIPE_WEBHOOK_SECRET before trusting event.type. Return 400 when verification throws.',
+        primaryMapCategory: "payments"
+      });
+    } else if (webhooks.verified.length === 0) {
       seeds.push({
         id: "missing_stripe_webhook",
         category: "MISSING FEATURES",
@@ -10698,19 +10915,35 @@ ${check.evidence.map((e2) => `- ${e2}`).join("\n")}` : "";
       });
     }
   }
-  if (signals.hasEnvExample) {
-    const drifted = collectEnvVarDrift(scan);
+  {
+    const contract = analyzeEnvContract(scan, extra);
+    const drifted = contract.missing;
     if (drifted.length > 0) {
       const shown = drifted.slice(0, 5).join(", ");
-      seeds.push({
-        id: "env_var_drift",
-        category: "DEPLOYMENT",
-        severity: "warning",
-        title: "Env vars used in code but missing from .env.example",
-        detail: `Code reads ${drifted.length} environment variable${drifted.length === 1 ? "" : "s"} that .env.example does not document (${shown}${drifted.length > 5 ? ", \u2026" : ""}). Fresh clones, CI, and the production deploy can silently run without them.`,
-        copyPrompt: `Add placeholder entries for these variables to .env.example (never real values): ${shown}${drifted.length > 5 ? " and the rest" : ""}. Then confirm each one is set in the deployment environment (Vercel project settings).`,
-        primaryMapCategory: "deployment"
-      });
+      const more = drifted.length > 5 ? ", \u2026" : "";
+      const count = `${drifted.length} environment variable${drifted.length === 1 ? "" : "s"}`;
+      if (contract.templates.length > 0) {
+        const target = contract.templates.length === 1 ? contract.templates[0] : "the env templates";
+        seeds.push({
+          id: "env_var_drift",
+          category: "DEPLOYMENT",
+          severity: "warning",
+          title: `Env vars used in code but missing from ${target}`,
+          detail: `Code reads ${count} that ${contract.templates.length === 1 ? target : `no env template (${contract.templates.join(", ")})`} does not document (${shown}${more}). Fresh clones, CI, and the production deploy can silently run without them.`,
+          copyPrompt: `Add placeholder entries for these variables to ${contract.templates.length === 1 ? target : contract.templates[0]} (never real values): ${shown}${drifted.length > 5 ? " and the rest" : ""}. Then confirm each one is set in the deployment environment (Vercel project settings).`,
+          primaryMapCategory: "deployment"
+        });
+      } else {
+        seeds.push({
+          id: "env_var_drift",
+          category: "DEPLOYMENT",
+          severity: "info",
+          title: "Env vars used in code but no env template documents them",
+          detail: `Code reads ${count} (${shown}${more}) and the repo has no .env.example, .env.sample or similar template, so a fresh clone or CI has no list of what to set.`,
+          copyPrompt: `Add a .env.example with placeholder entries (never real values) for: ${shown}${drifted.length > 5 ? " and the rest" : ""}. Commit it, and confirm each one is set in the deployment environment.`,
+          primaryMapCategory: "deployment"
+        });
+      }
     }
   }
   if (hasDatabase) {
@@ -10799,15 +11032,52 @@ function checklistFrom(gaps) {
   }
   return base;
 }
+async function readPaymentCodeFiles(workspacePath, scan) {
+  if (!scan.stackSignals.hasStripe) return [];
+  const candidates = /* @__PURE__ */ new Set();
+  for (const path of scan.fileTree.split("\n")) {
+    if (CODE_FILE.test(path) && PAYMENT_PATH.test(path)) candidates.add(path);
+  }
+  for (const file of scan.files) {
+    if (CODE_FILE.test(file.path) && typeof file.content === "string" && /stripe|constructEvent/i.test(file.content)) candidates.add(file.path);
+  }
+  const files = [];
+  for (const path of [...candidates].slice(0, FULL_READ_LIMITS.files)) {
+    try {
+      const absolute = (0, import_node_path7.join)(workspacePath, path);
+      if ((await (0, import_promises6.stat)(absolute)).size > FULL_READ_LIMITS.bytes) continue;
+      files.push({ path, content: await (0, import_promises6.readFile)(absolute, "utf8") });
+    } catch {
+    }
+  }
+  return files;
+}
 async function buildLocalStationOutput(input) {
   const { scan, workspacePath } = input;
   const auditInput = await collectVercelSupabaseAuditInput(workspacePath);
   const audit = buildVercelSupabaseAudit(auditInput);
   const evidence = await collectDatabaseEvidence(workspacePath, scan);
-  const seeds = buildGapSeeds(scan, audit, {
-    files: [...auditInput.files, ...evidence.files],
-    incomplete: evidence.incomplete
-  });
+  const auditFiles = [...auditInput.files, ...auditInput.sourceFiles ?? []];
+  const envTemplates = auditFiles.filter((file) => isEnvTemplatePath(file.path));
+  for (const name of ["example.env", "sample.env", "template.env", "env.example", "env.sample", "env.template"]) {
+    try {
+      envTemplates.push({ path: name, content: await (0, import_promises6.readFile)((0, import_node_path7.join)(workspacePath, name), "utf8") });
+    } catch {
+    }
+  }
+  const codeFiles = [
+    ...await readPaymentCodeFiles(workspacePath, scan),
+    ...auditFiles.filter((file) => ENV_CODE_FILE.test(file.path))
+  ];
+  const seeds = buildGapSeeds(
+    scan,
+    audit,
+    {
+      files: [...auditInput.files, ...evidence.files],
+      incomplete: evidence.incomplete
+    },
+    { codeFiles, envTemplates }
+  );
   const releaseTagSeed = await detectReleaseTagGap(workspacePath);
   if (releaseTagSeed) {
     seeds.push(releaseTagSeed);
@@ -10842,13 +11112,15 @@ async function buildLocalStationOutput(input) {
     productionChecklist: checklistFrom(seeds)
   };
 }
-var import_node_child_process3, import_node_util3, execFileAsync3, ENV_DRIFT_IGNORE, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER;
+var import_node_child_process3, import_node_util3, import_promises6, import_node_path7, execFileAsync3, ENV_DRIFT_IGNORE, ENV_DRIFT_IGNORE_PREFIX, SUPABASE_EDGE_ENV, ENV_TEMPLATE_NAME, ENV_CODE_FILE, ENV_NAME, ENV_REFERENCES, SVELTEKIT_STATIC_IMPORT, SVELTEKIT_DYNAMIC_IMPORT, ENV_DESTRUCTURE, CODE_FILE, STRIPE_VERIFY_CALL, STRIPE_VERIFY_JSON_BODY, STRIPE_SIGNATURE_HEADER, RAW_BODY, STRIPE_EVENT_TYPE, REQUEST_HANDLER, TEST_FILE, AUDIT_FINDING_GAPS, FINDING_SEVERITY_RANK, DETAIL_MAX_FINDINGS, SEVERITY_ORDER, FULL_READ_LIMITS, PAYMENT_PATH;
 var init_localStation = __esm({
   "src/localStation.ts"() {
     "use strict";
     import_node_child_process3 = require("node:child_process");
     import_node_util3 = require("node:util");
     init_audit();
+    import_promises6 = require("node:fs/promises");
+    import_node_path7 = require("node:path");
     init_databaseEvidence();
     init_safeGit();
     execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
@@ -10858,13 +11130,80 @@ var init_localStation = __esm({
       "PORT",
       "TZ",
       "ANALYZE",
+      "HOST",
+      "HOSTNAME",
+      "HOME",
+      "PATH",
+      "PWD",
+      "USER",
+      "SHELL",
+      "TMPDIR",
+      "TEMP",
+      "TMP",
+      "LANG",
+      "DEBUG",
       "VERCEL",
-      "VERCEL_ENV",
-      "VERCEL_URL",
-      "VERCEL_REGION",
       "NEXT_RUNTIME",
-      "NEXT_PHASE"
+      "NEXT_PHASE",
+      "NEXT_TELEMETRY_DISABLED",
+      // Vite's built-in import.meta.env values.
+      "MODE",
+      "DEV",
+      "PROD",
+      "SSR",
+      "BASE_URL",
+      // Netlify, Render and other hosts.
+      "NETLIFY",
+      "CONTEXT",
+      "URL",
+      "DEPLOY_URL",
+      "DEPLOY_PRIME_URL",
+      "BUILD_ID",
+      "SITE_ID",
+      "SITE_NAME",
+      "RENDER",
+      "CF_PAGES",
+      "AWS_REGION",
+      "AWS_EXECUTION_ENV",
+      "LAMBDA_TASK_ROOT"
+    ]);
+    ENV_DRIFT_IGNORE_PREFIX = /^(?:npm_|VERCEL_|NEXT_PUBLIC_VERCEL_|__NEXT|CF_PAGES_|RENDER_|RAILWAY_|FLY_|GITHUB_|RUNNER_|NETLIFY_|AWS_LAMBDA_)/;
+    SUPABASE_EDGE_ENV = /* @__PURE__ */ new Set([
+      "SUPABASE_URL",
+      "SUPABASE_ANON_KEY",
+      "SUPABASE_SERVICE_ROLE_KEY",
+      "SUPABASE_DB_URL",
+      "SUPABASE_PUBLISHABLE_KEYS",
+      "SUPABASE_SECRET_KEYS",
+      "SB_REGION",
+      "SB_EXECUTION_ID",
+      "DENO_DEPLOYMENT_ID",
+      "DENO_REGION"
     ]);
+    ENV_TEMPLATE_NAME = /^(?:\.env(?:\.[\w-]+)*\.(?:example|sample|template|tpl|dist|defaults)|(?:example|sample|template)\.env|env\.(?:example|sample|template))$/i;
+    ENV_CODE_FILE = /\.(?:[cm]?[jt]sx?|vue|svelte|astro)$/i;
+    ENV_NAME = "[A-Z][A-Z0-9_]{2,}";
+    ENV_REFERENCES = [
+      new RegExp(`process\\.env\\??\\.(${ENV_NAME})\\b`, "g"),
+      new RegExp(`process\\.env\\??\\.?\\[\\s*['"\`](${ENV_NAME})['"\`]\\s*\\]`, "g"),
+      new RegExp(`import\\.meta\\.env\\??\\.(${ENV_NAME})\\b`, "g"),
+      new RegExp(`import\\.meta\\.env\\??\\.?\\[\\s*['"\`](${ENV_NAME})['"\`]\\s*\\]`, "g"),
+      new RegExp(`Deno\\.env\\.get\\(\\s*['"\`](${ENV_NAME})['"\`]\\s*\\)`, "g"),
+      new RegExp(`Bun\\.env\\.(${ENV_NAME})\\b`, "g"),
+      // Hono and Cloudflare Workers bindings: c.env.X
+      new RegExp(`\\b(?:c|ctx|context)\\.env\\.(${ENV_NAME})\\b`, "g")
+    ];
+    SVELTEKIT_STATIC_IMPORT = /import\s*\{([^}]*)\}\s*from\s*['"]\$env\/static\/(?:private|public)['"]/g;
+    SVELTEKIT_DYNAMIC_IMPORT = /import\s*\{([^}]*)\}\s*from\s*['"]\$env\/dynamic\/(?:private|public)['"]/g;
+    ENV_DESTRUCTURE = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*(?:process\.env|import\.meta\.env|Bun\.env)\b/g;
+    CODE_FILE = /\.(?:[cm]?[jt]sx?)$/i;
+    STRIPE_VERIFY_CALL = /\bconstructEvent(?:Async)?\s*\(|\.signature\.verifyHeader(?:Async)?\s*\(/;
+    STRIPE_VERIFY_JSON_BODY = /\bconstructEvent(?:Async)?\s*\(\s*JSON\.stringify\s*\(/;
+    STRIPE_SIGNATURE_HEADER = /stripe-signature/i;
+    RAW_BODY = /\.text\(\s*\)|\.arrayBuffer\(\s*\)|express\.raw\s*\(|bodyParser\.raw\s*\(|\braw\(\s*\{|\brawBody\b|\bbuffer\(\s*req\b|getRawBody\s*\(|readRawBody\s*\(|\bevent\.body\b/;
+    STRIPE_EVENT_TYPE = /['"`](?:checkout\.session|customer\.subscription|invoice|payment_intent|charge)\.[a-z_.]+['"`]/;
+    REQUEST_HANDLER = /export\s+(?:async\s+)?function\s+POST\b|export\s+const\s+POST\b|export\s+default\s+(?:async\s+)?function\s*[\w$]*\s*\(\s*(?:req|request)\b|export\s+(?:async\s+function|function|const)\s+handler\b|\b[A-Za-z_$][\w$]*\.post\s*\(|Deno\.serve\s*\(|\bserve\s*\(|addEventListener\(\s*['"]fetch|export\s+default\s*\{\s*(?:async\s+)?fetch\b/;
+    TEST_FILE = /(^|\/)(?:__tests__|__mocks__)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/i;
     AUDIT_FINDING_GAPS = {
       rls_policy_allows_all_write: {
         title: "A policy lets anyone write every row",
@@ -10918,6 +11257,8 @@ var init_localStation = __esm({
     FINDING_SEVERITY_RANK = { critical: 0, high: 1, warning: 2, info: 3 };
     DETAIL_MAX_FINDINGS = 10;
     SEVERITY_ORDER = { critical: 0, warning: 1, info: 2 };
+    FULL_READ_LIMITS = { files: 40, bytes: 512e3 };
+    PAYMENT_PATH = /webhook|stripe|payment|billing|checkout/i;
   }
 });
 
@@ -11627,20 +11968,20 @@ var init_checkMap = __esm({
 
 // src/playbooks/playbooksRoot.ts
 function playbooksRoot() {
-  const candidates = [(0, import_node_path7.join)(__dirname, "playbooks"), (0, import_node_path7.join)(__dirname, "..", "..", "playbooks")];
+  const candidates = [(0, import_node_path8.join)(__dirname, "playbooks"), (0, import_node_path8.join)(__dirname, "..", "..", "playbooks")];
   for (const dir of candidates) {
-    if ((0, import_node_fs4.existsSync)((0, import_node_path7.join)(dir, "vercel.json"))) {
+    if ((0, import_node_fs4.existsSync)((0, import_node_path8.join)(dir, "vercel.json"))) {
       return dir;
     }
   }
   throw new Error("VibeRaven playbooks directory not found (expected vercel.json)");
 }
-var import_node_fs4, import_node_path7;
+var import_node_fs4, import_node_path8;
 var init_playbooksRoot = __esm({
   "src/playbooks/playbooksRoot.ts"() {
     "use strict";
     import_node_fs4 = require("node:fs");
-    import_node_path7 = require("node:path");
+    import_node_path8 = require("node:path");
   }
 });
 
@@ -11747,8 +12088,8 @@ async function loadPlaybook(provider2) {
       `Unknown provider "${provider2}". Available: ${PLAYBOOK_PROVIDERS.join(", ")}`
     );
   }
-  const path = (0, import_node_path8.join)(playbooksRoot(), `${normalized}.json`);
-  const raw = JSON.parse(await (0, import_promises6.readFile)(path, "utf-8"));
+  const path = (0, import_node_path9.join)(playbooksRoot(), `${normalized}.json`);
+  const raw = JSON.parse(await (0, import_promises7.readFile)(path, "utf-8"));
   const playbook = parsePlaybook(raw);
   if (playbook.provider !== normalized) {
     throw new Error(`Playbook file ${normalized}.json has mismatched provider field`);
@@ -11762,7 +12103,7 @@ function loadPlaybookSync(provider2) {
       `Unknown provider "${provider2}". Available: ${PLAYBOOK_PROVIDERS.join(", ")}`
     );
   }
-  const path = (0, import_node_path8.join)(playbooksRoot(), `${normalized}.json`);
+  const path = (0, import_node_path9.join)(playbooksRoot(), `${normalized}.json`);
   const raw = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf-8"));
   const playbook = parsePlaybook(raw);
   if (playbook.provider !== normalized) {
@@ -11770,13 +12111,13 @@ function loadPlaybookSync(provider2) {
   }
   return playbook;
 }
-var import_node_fs5, import_promises6, import_node_path8;
+var import_node_fs5, import_promises7, import_node_path9;
 var init_loadPlaybook = __esm({
   "src/playbooks/loadPlaybook.ts"() {
     "use strict";
     import_node_fs5 = require("node:fs");
-    import_promises6 = require("node:fs/promises");
-    import_node_path8 = require("node:path");
+    import_promises7 = require("node:fs/promises");
+    import_node_path9 = require("node:path");
     init_playbooksRoot();
     init_types2();
     init_validate();
@@ -11861,20 +12202,20 @@ async function loadLastArtifact(startDir) {
   if (!workspace) {
     throw new ScanNotFoundError(needsScanMessage(startDir));
   }
-  const path = (0, import_node_path9.join)(getProjectArtifactsDir(workspace), "last-scan.json");
+  const path = (0, import_node_path10.join)(getProjectArtifactsDir(workspace), "last-scan.json");
   try {
-    const raw = await (0, import_promises7.readFile)(path, "utf-8");
+    const raw = await (0, import_promises8.readFile)(path, "utf-8");
     return JSON.parse(raw);
   } catch {
     throw new ScanNotFoundError(needsScanMessage(startDir));
   }
 }
-var import_promises7, import_node_path9, SEVERITY_RANK2, ScanNotFoundError;
+var import_promises8, import_node_path10, SEVERITY_RANK2, ScanNotFoundError;
 var init_menu = __esm({
   "src/tui/menu.ts"() {
     "use strict";
-    import_promises7 = require("node:fs/promises");
-    import_node_path9 = require("node:path");
+    import_promises8 = require("node:fs/promises");
+    import_node_path10 = require("node:path");
     init_config();
     SEVERITY_RANK2 = {
       critical: 0,
@@ -12592,25 +12933,25 @@ var init_reportHtml = __esm({
 function getBundledReportAssetsDir() {
   const base = __dirname;
   const candidates = [
-    (0, import_node_path10.join)(base, "report"),
-    (0, import_node_path10.join)(base, "..", "assets", "report"),
-    (0, import_node_path10.join)(base, "..", "..", "assets", "report"),
-    (0, import_node_path10.join)(process.cwd(), "packages", "cli", "assets", "report"),
-    (0, import_node_path10.join)(process.cwd(), "assets", "report")
+    (0, import_node_path11.join)(base, "report"),
+    (0, import_node_path11.join)(base, "..", "assets", "report"),
+    (0, import_node_path11.join)(base, "..", "..", "assets", "report"),
+    (0, import_node_path11.join)(process.cwd(), "packages", "cli", "assets", "report"),
+    (0, import_node_path11.join)(process.cwd(), "assets", "report")
   ];
   for (const dir of candidates) {
-    if ((0, import_node_fs6.existsSync)((0, import_node_path10.join)(dir, "station.css"))) {
+    if ((0, import_node_fs6.existsSync)((0, import_node_path11.join)(dir, "station.css"))) {
       return dir;
     }
   }
   throw new Error("Report assets missing. Run `npm run sync-report-assets` and `npm run build` in packages/cli.");
 }
-var import_node_fs6, import_node_path10, REPORT_ASSET_FILES;
+var import_node_fs6, import_node_path11, REPORT_ASSET_FILES;
 var init_reportAssets = __esm({
   "src/report/reportAssets.ts"() {
     "use strict";
     import_node_fs6 = require("node:fs");
-    import_node_path10 = require("node:path");
+    import_node_path11 = require("node:path");
     REPORT_ASSET_FILES = [
       "station.css",
       "station.js",
@@ -12641,8 +12982,8 @@ function stripWindowsDrive(value) {
 }
 function stripAbsolutePrefix(value) {
   const normalized = slashPath(value);
-  const isAbsolute2 = /^[a-z]:\//i.test(normalized) || normalized.startsWith("/");
-  if (!isAbsolute2) {
+  const isAbsolute3 = /^[a-z]:\//i.test(normalized) || normalized.startsWith("/");
+  if (!isAbsolute3) {
     return normalized;
   }
   const lower = normalized.toLowerCase();
@@ -12838,11 +13179,11 @@ function emptyActionRegistry() {
   return { version: 1, nextId: 1, actions: {} };
 }
 function actionRegistryPath(cwd) {
-  return (0, import_node_path11.join)(getProjectArtifactsDir(cwd), "action-registry.json");
+  return (0, import_node_path12.join)(getProjectArtifactsDir(cwd), "action-registry.json");
 }
 async function loadActionRegistry(cwd) {
   try {
-    const parsed = JSON.parse(await (0, import_promises8.readFile)(actionRegistryPath(cwd), "utf8"));
+    const parsed = JSON.parse(await (0, import_promises9.readFile)(actionRegistryPath(cwd), "utf8"));
     if (parsed.version === 1 && Number.isInteger(parsed.nextId) && parsed.actions) {
       return parsed;
     }
@@ -12852,8 +13193,8 @@ async function loadActionRegistry(cwd) {
 }
 async function saveActionRegistry(cwd, registry) {
   const dir = getProjectArtifactsDir(cwd);
-  await (0, import_promises8.mkdir)(dir, { recursive: true });
-  await (0, import_promises8.writeFile)(actionRegistryPath(cwd), `${JSON.stringify(registry, null, 2)}
+  await (0, import_promises9.mkdir)(dir, { recursive: true });
+  await (0, import_promises9.writeFile)(actionRegistryPath(cwd), `${JSON.stringify(registry, null, 2)}
 `, "utf8");
 }
 function nextActionId(registry) {
@@ -12946,12 +13287,12 @@ async function resolveActionById(cwd, id) {
   const registry = await loadActionRegistry(cwd);
   return Object.values(registry.actions).find((entry) => entry.id === id);
 }
-var import_promises8, import_node_path11;
+var import_promises9, import_node_path12;
 var init_registry2 = __esm({
   "src/actions/registry.ts"() {
     "use strict";
-    import_promises8 = require("node:fs/promises");
-    import_node_path11 = require("node:path");
+    import_promises9 = require("node:fs/promises");
+    import_node_path12 = require("node:path");
     init_config();
     init_canonical();
   }
@@ -12983,8 +13324,8 @@ async function writeActionArtifacts(input) {
     gateStatus: gateStatus2(input.artifact),
     actions: assigned.actions
   };
-  const actionsPath = (0, import_node_path12.join)(getProjectArtifactsDir(input.cwd), "actions.json");
-  await (0, import_promises9.writeFile)(actionsPath, `${JSON.stringify(manifest, null, 2)}
+  const actionsPath = (0, import_node_path13.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  await (0, import_promises10.writeFile)(actionsPath, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   return {
     actionsPath,
@@ -12992,12 +13333,12 @@ async function writeActionArtifacts(input) {
     manifest
   };
 }
-var import_promises9, import_node_path12;
+var import_promises10, import_node_path13;
 var init_artifacts = __esm({
   "src/actions/artifacts.ts"() {
     "use strict";
-    import_promises9 = require("node:fs/promises");
-    import_node_path12 = require("node:path");
+    import_promises10 = require("node:fs/promises");
+    import_node_path13 = require("node:path");
     init_config();
     init_derive();
     init_registry2();
@@ -13007,25 +13348,25 @@ var init_artifacts = __esm({
 // src/artifacts.ts
 async function copyReportAssets(reportAssetsDir) {
   const sourceDir = getBundledReportAssetsDir();
-  await (0, import_promises10.mkdir)((0, import_node_path13.join)(reportAssetsDir, "assets"), { recursive: true });
+  await (0, import_promises11.mkdir)((0, import_node_path14.join)(reportAssetsDir, "assets"), { recursive: true });
   for (const rel of REPORT_ASSET_FILES) {
-    await (0, import_promises10.copyFile)((0, import_node_path13.join)(sourceDir, rel), (0, import_node_path13.join)(reportAssetsDir, rel));
+    await (0, import_promises11.copyFile)((0, import_node_path14.join)(sourceDir, rel), (0, import_node_path14.join)(reportAssetsDir, rel));
   }
 }
 async function writeScanArtifacts(options) {
   const cwd = options.cwd ?? options.artifact.workspacePath;
   const dir = getProjectArtifactsDir(cwd);
-  await (0, import_promises10.mkdir)(dir, { recursive: true });
-  const jsonPath = (0, import_node_path13.join)(dir, "last-scan.json");
-  const gateResultPath = (0, import_node_path13.join)(dir, "gate-result.json");
-  const contextMapPath = (0, import_node_path13.join)(dir, "context-map.json");
-  const gapsDir = (0, import_node_path13.join)(dir, "gaps");
-  const tasklistPath = (0, import_node_path13.join)(dir, "agent-tasklist.md");
-  const summaryPath = (0, import_node_path13.join)(dir, "agent-summary.md");
-  const playbookPath = (0, import_node_path13.join)(dir, "launch-playbook.md");
-  const reportPath = (0, import_node_path13.join)(dir, "report.html");
-  const reportAssetsDir = (0, import_node_path13.join)(dir, "report");
-  await (0, import_promises10.mkdir)(gapsDir, { recursive: true });
+  await (0, import_promises11.mkdir)(dir, { recursive: true });
+  const jsonPath = (0, import_node_path14.join)(dir, "last-scan.json");
+  const gateResultPath = (0, import_node_path14.join)(dir, "gate-result.json");
+  const contextMapPath = (0, import_node_path14.join)(dir, "context-map.json");
+  const gapsDir = (0, import_node_path14.join)(dir, "gaps");
+  const tasklistPath = (0, import_node_path14.join)(dir, "agent-tasklist.md");
+  const summaryPath = (0, import_node_path14.join)(dir, "agent-summary.md");
+  const playbookPath = (0, import_node_path14.join)(dir, "launch-playbook.md");
+  const reportPath = (0, import_node_path14.join)(dir, "report.html");
+  const reportAssetsDir = (0, import_node_path14.join)(dir, "report");
+  await (0, import_promises11.mkdir)(gapsDir, { recursive: true });
   const safe2 = sanitizeArtifactForDisk(options.artifact);
   const json = `${JSON.stringify(safe2, null, 2)}
 `;
@@ -13040,26 +13381,26 @@ async function writeScanArtifacts(options) {
 `;
   const gapEvidenceFiles = generateGapEvidenceFiles(safe2);
   await copyReportAssets(reportAssetsDir);
-  await (0, import_promises10.writeFile)(gateResultPath, gateResult, "utf-8");
-  await (0, import_promises10.writeFile)(contextMapPath, contextMap, "utf-8");
+  await (0, import_promises11.writeFile)(gateResultPath, gateResult, "utf-8");
+  await (0, import_promises11.writeFile)(contextMapPath, contextMap, "utf-8");
   for (const gap of gapEvidenceFiles) {
-    await (0, import_promises10.writeFile)((0, import_node_path13.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
+    await (0, import_promises11.writeFile)((0, import_node_path14.join)(dir, "gaps", `${gap.content.id}.json`), `${JSON.stringify(gap.content, null, 2)}
 `, "utf-8");
   }
-  await (0, import_promises10.writeFile)(tasklistPath, tasklist, "utf-8");
+  await (0, import_promises11.writeFile)(tasklistPath, tasklist, "utf-8");
   let architectureMapPath;
   if (typeof safe2.architectureMap === "string" && safe2.architectureMap.length > 0) {
-    architectureMapPath = (0, import_node_path13.join)(dir, "architecture-map.md");
-    await (0, import_promises10.writeFile)(architectureMapPath, safe2.architectureMap, "utf-8");
+    architectureMapPath = (0, import_node_path14.join)(dir, "architecture-map.md");
+    await (0, import_promises11.writeFile)(architectureMapPath, safe2.architectureMap, "utf-8");
   }
   if (safe2.architectureData) {
-    await (0, import_promises10.writeFile)((0, import_node_path13.join)(dir, "architecture-map.json"), `${JSON.stringify(safe2.architectureData, null, 2)}
+    await (0, import_promises11.writeFile)((0, import_node_path14.join)(dir, "architecture-map.json"), `${JSON.stringify(safe2.architectureData, null, 2)}
 `, "utf-8");
   }
-  await (0, import_promises10.writeFile)(jsonPath, json, "utf-8");
-  await (0, import_promises10.writeFile)(summaryPath, summary, "utf-8");
-  await (0, import_promises10.writeFile)(playbookPath, playbook, "utf-8");
-  await (0, import_promises10.writeFile)(reportPath, html, "utf-8");
+  await (0, import_promises11.writeFile)(jsonPath, json, "utf-8");
+  await (0, import_promises11.writeFile)(summaryPath, summary, "utf-8");
+  await (0, import_promises11.writeFile)(playbookPath, playbook, "utf-8");
+  await (0, import_promises11.writeFile)(reportPath, html, "utf-8");
   const actionArtifacts = await writeActionArtifacts({
     cwd,
     artifact: safe2,
@@ -13082,12 +13423,12 @@ async function writeScanArtifacts(options) {
     ...architectureMapPath ? { architectureMapPath } : {}
   };
 }
-var import_promises10, import_node_path13;
+var import_promises11, import_node_path14;
 var init_artifacts2 = __esm({
   "src/artifacts.ts"() {
     "use strict";
-    import_promises10 = require("node:fs/promises");
-    import_node_path13 = require("node:path");
+    import_promises11 = require("node:fs/promises");
+    import_node_path14 = require("node:path");
     init_contextMap();
     init_gateResult();
     init_gapEvidence();
@@ -13196,12 +13537,12 @@ function createAppWindowOpenCommands(target, platform = process.platform, env =
   ];
   if (platform === "win32") {
     const candidates = [
-      env.LOCALAPPDATA ? (0, import_node_path14.join)(env.LOCALAPPDATA, "Google", "Chrome", "Application", "chrome.exe") : "",
-      env.PROGRAMFILES ? (0, import_node_path14.join)(env.PROGRAMFILES, "Google", "Chrome", "Application", "chrome.exe") : "",
-      env["PROGRAMFILES(X86)"] ? (0, import_node_path14.join)(env["PROGRAMFILES(X86)"], "Google", "Chrome", "Application", "chrome.exe") : "",
-      env.LOCALAPPDATA ? (0, import_node_path14.join)(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe") : "",
-      env.PROGRAMFILES ? (0, import_node_path14.join)(env.PROGRAMFILES, "Microsoft", "Edge", "Application", "msedge.exe") : "",
-      env["PROGRAMFILES(X86)"] ? (0, import_node_path14.join)(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env.LOCALAPPDATA ? (0, import_node_path15.join)(env.LOCALAPPDATA, "Google", "Chrome", "Application", "chrome.exe") : "",
+      env.PROGRAMFILES ? (0, import_node_path15.join)(env.PROGRAMFILES, "Google", "Chrome", "Application", "chrome.exe") : "",
+      env["PROGRAMFILES(X86)"] ? (0, import_node_path15.join)(env["PROGRAMFILES(X86)"], "Google", "Chrome", "Application", "chrome.exe") : "",
+      env.LOCALAPPDATA ? (0, import_node_path15.join)(env.LOCALAPPDATA, "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env.PROGRAMFILES ? (0, import_node_path15.join)(env.PROGRAMFILES, "Microsoft", "Edge", "Application", "msedge.exe") : "",
+      env["PROGRAMFILES(X86)"] ? (0, import_node_path15.join)(env["PROGRAMFILES(X86)"], "Microsoft", "Edge", "Application", "msedge.exe") : "",
       "chrome",
       "msedge"
     ].filter(Boolean);
@@ -13222,12 +13563,12 @@ function createAppWindowOpenCommands(target, platform = process.platform, env =
 }
 async function openWithSystemDefault(target) {
   const { command, args, shell } = createOpenCommand(target);
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     const child = (0, import_node_child_process4.spawn)(command, args, { stdio: "ignore", shell });
     child.on("error", reject);
     child.on("exit", (code) => {
       if (code === 0) {
-        resolve8();
+        resolve9();
       } else {
         reject(new Error(`Could not open browser (exit ${code ?? "unknown"}). Open manually: ${target}`));
       }
@@ -13238,7 +13579,7 @@ async function spawnDetached(command) {
   if (/^[A-Za-z]:[\\/]/.test(command.command) && !(0, import_node_fs7.existsSync)(command.command)) {
     throw new Error(`Browser not found: ${command.command}`);
   }
-  await new Promise((resolve8, reject) => {
+  await new Promise((resolve9, reject) => {
     const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
       detached: true,
       stdio: "ignore",
@@ -13246,7 +13587,7 @@ async function spawnDetached(command) {
     });
     child.once("spawn", () => {
       child.unref();
-      resolve8();
+      resolve9();
     });
     child.once("error", reject);
   });
@@ -13278,13 +13619,13 @@ async function openUrlInBrowser(url) {
   }
   await openWithSystemDefault(trimmed);
 }
-var import_node_child_process4, import_node_fs7, import_node_path14;
+var import_node_child_process4, import_node_fs7, import_node_path15;
 var init_openBrowser = __esm({
   "src/openBrowser.ts"() {
     "use strict";
     import_node_child_process4 = require("node:child_process");
     import_node_fs7 = require("node:fs");
-    import_node_path14 = require("node:path");
+    import_node_path15 = require("node:path");
   }
 });
 
@@ -13314,12 +13655,12 @@ async function copyToClipboard(text) {
   }
 }
 function pipeToCommand(command, text, extraArgs = []) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = (0, import_node_child_process5.spawn)(command, extraArgs, { stdio: ["pipe", "ignore", "ignore"] });
     child.on("error", reject);
     child.on("close", (code) => {
       if (code === 0) {
-        resolve8();
+        resolve9();
       } else {
         reject(new Error(`${command} exited with code ${code ?? "unknown"}`));
       }
@@ -14226,7 +14567,7 @@ var VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    VERSION = "1.5.0";
+    VERSION = "1.5.2";
   }
 });
 
@@ -14621,25 +14962,25 @@ async function initCursorRulesPack(options) {
   const pack = buildCursorRulesPack();
   for (const rule of pack) {
     const file = `${CURSOR_RULES_DIR}/${rule.filename}`;
-    const path = (0, import_node_path15.join)(options.cwd, file);
+    const path = (0, import_node_path16.join)(options.cwd, file);
     const existing = await readExistingFile(path);
     const changed = !existing.exists || existing.content !== rule.content;
     const action = !existing.exists ? "created" : changed ? "updated" : "unchanged";
     if (!options.dryRun && changed) {
-      await (0, import_promises11.mkdir)((0, import_node_path15.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
-      await (0, import_promises11.writeFile)(path, rule.content, "utf-8");
+      await (0, import_promises12.mkdir)((0, import_node_path16.join)(options.cwd, CURSOR_RULES_DIR), { recursive: true });
+      await (0, import_promises12.writeFile)(path, rule.content, "utf-8");
     }
     results.push({ target: "cursor", file, path, action });
   }
-  const legacyPath = (0, import_node_path15.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
+  const legacyPath = (0, import_node_path16.join)(options.cwd, LEGACY_CURSOR_RULE_FILE);
   if (!options.dryRun && await fileExists(legacyPath)) {
-    await (0, import_promises11.rm)(legacyPath, { force: true });
+    await (0, import_promises12.rm)(legacyPath, { force: true });
   }
   return results;
 }
 async function readExistingFile(path) {
   try {
-    return { exists: true, content: await (0, import_promises11.readFile)(path, "utf-8") };
+    return { exists: true, content: await (0, import_promises12.readFile)(path, "utf-8") };
   } catch (error) {
     if (isFileNotFoundError(error)) {
       return { exists: false, content: "" };
@@ -14649,7 +14990,7 @@ async function readExistingFile(path) {
 }
 async function fileExists(path) {
   try {
-    await (0, import_promises11.access)(path);
+    await (0, import_promises12.access)(path);
     return true;
   } catch {
     return false;
@@ -14658,12 +14999,12 @@ async function fileExists(path) {
 function isFileNotFoundError(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises11, import_node_path15, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
+var import_promises12, import_node_path16, CURSOR_RULES_DIR, LEGACY_CURSOR_RULE_FILE, DOMAIN_PATH_POINTER;
 var init_cursorRulesPack = __esm({
   "src/commands/cursorRulesPack.ts"() {
     "use strict";
-    import_promises11 = require("node:fs/promises");
-    import_node_path15 = require("node:path");
+    import_promises12 = require("node:fs/promises");
+    import_node_path16 = require("node:path");
     init_commands();
     CURSOR_RULES_DIR = ".cursor/rules";
     LEGACY_CURSOR_RULE_FILE = `${CURSOR_RULES_DIR}/viberaven.mdc`;
@@ -14763,11 +15104,11 @@ var init_agentTargets = __esm({
 
 // src/commands/seedPackageJsonScripts.ts
 async function seedPackageJsonScripts(options) {
-  const packageJsonPath = (0, import_node_path16.join)(options.cwd, "package.json");
+  const packageJsonPath = (0, import_node_path17.join)(options.cwd, "package.json");
   if (!(0, import_node_fs8.existsSync)(packageJsonPath)) {
     return null;
   }
-  const raw = await (0, import_promises12.readFile)(packageJsonPath, "utf-8");
+  const raw = await (0, import_promises13.readFile)(packageJsonPath, "utf-8");
   let pkg;
   try {
     pkg = JSON.parse(raw);
@@ -14797,17 +15138,17 @@ async function seedPackageJsonScripts(options) {
     pkg.scripts = scripts;
     const output = `${JSON.stringify(pkg, null, 2)}
 `;
-    await (0, import_promises12.writeFile)(packageJsonPath, output, "utf-8");
+    await (0, import_promises13.writeFile)(packageJsonPath, output, "utf-8");
   }
   return { action: "updated", added, skipped, changed: true };
 }
-var import_node_fs8, import_promises12, import_node_path16, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
+var import_node_fs8, import_promises13, import_node_path17, VIBERAVEN_PACKAGE_JSON_SCRIPTS;
 var init_seedPackageJsonScripts = __esm({
   "src/commands/seedPackageJsonScripts.ts"() {
     "use strict";
     import_node_fs8 = require("node:fs");
-    import_promises12 = require("node:fs/promises");
-    import_node_path16 = require("node:path");
+    import_promises13 = require("node:fs/promises");
+    import_node_path17 = require("node:path");
     init_commands();
     VIBERAVEN_PACKAGE_JSON_SCRIPTS = {
       "viberaven:gate": PUBLIC_AGENT_MODE_COMMAND,
@@ -14827,13 +15168,13 @@ async function initAgentRules(options) {
       continue;
     }
     const file = AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path17.join)(options.cwd, file);
+    const path = (0, import_node_path18.join)(options.cwd, file);
     const existing = await readExistingFile2(path);
     const injected = injectAgentRulesBlock(existing.content, renderAgentRulesForTarget(target));
     const action = !existing.exists ? "created" : injected.changed ? "updated" : "unchanged";
     if (!options.dryRun && injected.changed) {
-      await (0, import_promises13.mkdir)((0, import_node_path17.dirname)(path), { recursive: true });
-      await (0, import_promises13.writeFile)(path, injected.content, "utf-8");
+      await (0, import_promises14.mkdir)((0, import_node_path18.dirname)(path), { recursive: true });
+      await (0, import_promises14.writeFile)(path, injected.content, "utf-8");
     }
     results.push({ target, file, path, action });
   }
@@ -14901,7 +15242,7 @@ function formatAgentRulesInitSummary(output) {
 }
 async function readExistingFile2(path) {
   try {
-    return { exists: true, content: await (0, import_promises13.readFile)(path, "utf-8") };
+    return { exists: true, content: await (0, import_promises14.readFile)(path, "utf-8") };
   } catch (error) {
     if (isFileNotFoundError2(error)) {
       return { exists: false, content: "" };
@@ -14912,12 +15253,12 @@ async function readExistingFile2(path) {
 function isFileNotFoundError2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-var import_promises13, import_node_path17;
+var import_promises14, import_node_path18;
 var init_initRules = __esm({
   "src/commands/initRules.ts"() {
     "use strict";
-    import_promises13 = require("node:fs/promises");
-    import_node_path17 = require("node:path");
+    import_promises14 = require("node:fs/promises");
+    import_node_path18 = require("node:path");
     init_agentRulesBlock();
     init_agentTargets();
     init_cursorRulesPack();
@@ -15180,7 +15521,7 @@ async function runInteractiveSession(startDir = process.cwd()) {
   Ie(`${import_picocolors4.default.bold("VibeRaven")} ${import_picocolors4.default.dim(VERSION)}`);
   const cwd = await resolveWorkspaceRoot(startDir);
   const artifactsAt = await findArtifactsWorkspace(startDir);
-  if (artifactsAt && (0, import_node_path18.resolve)(artifactsAt) !== (0, import_node_path18.resolve)(startDir)) {
+  if (artifactsAt && (0, import_node_path19.resolve)(artifactsAt) !== (0, import_node_path19.resolve)(startDir)) {
     M2.message(import_picocolors4.default.dim(`Using scan from: ${artifactsAt}`));
   } else {
     M2.message(import_picocolors4.default.dim(`Project folder: ${cwd}`));
@@ -15239,11 +15580,11 @@ async function runInteractiveSession(startDir = process.cwd()) {
   }
   Se(import_picocolors4.default.dim("Run viberaven anytime for the interactive menu."));
 }
-var import_node_path18, import_picocolors4;
+var import_node_path19, import_picocolors4;
 var init_runInteractive = __esm({
   "src/tui/runInteractive.ts"() {
     "use strict";
-    import_node_path18 = require("node:path");
+    import_node_path19 = require("node:path");
     init_dist2();
     import_picocolors4 = __toESM(require_picocolors());
     init_config();
@@ -15268,18 +15609,18 @@ var init_runInteractive = __esm({
 // src/commands/condense.ts
 async function runCondenseCommand(options) {
   const dir = getProjectArtifactsDir(options.cwd);
-  const artifact = JSON.parse(await (0, import_promises14.readFile)((0, import_node_path19.join)(dir, "last-scan.json"), "utf8"));
-  const contextMapPath = (0, import_node_path19.join)(dir, "context-map.json");
-  await (0, import_promises14.writeFile)(contextMapPath, `${JSON.stringify(generateContextMap(artifact), null, 2)}
+  const artifact = JSON.parse(await (0, import_promises15.readFile)((0, import_node_path20.join)(dir, "last-scan.json"), "utf8"));
+  const contextMapPath = (0, import_node_path20.join)(dir, "context-map.json");
+  await (0, import_promises15.writeFile)(contextMapPath, `${JSON.stringify(generateContextMap(artifact), null, 2)}
 `, "utf8");
   return { contextMapPath };
 }
-var import_promises14, import_node_path19;
+var import_promises15, import_node_path20;
 var init_condense = __esm({
   "src/commands/condense.ts"() {
     "use strict";
-    import_promises14 = require("node:fs/promises");
-    import_node_path19 = require("node:path");
+    import_promises15 = require("node:fs/promises");
+    import_node_path20 = require("node:path");
     init_config();
     init_contextMap();
   }
@@ -15287,9 +15628,9 @@ var init_condense = __esm({
 
 // src/heal/pathSafety.ts
 function assertSafeHealTarget(cwd, target) {
-  const root = (0, import_node_path20.resolve)(cwd);
-  const absolute = (0, import_node_path20.resolve)(root, target);
-  const rel = (0, import_node_path20.relative)(root, absolute);
+  const root = (0, import_node_path21.resolve)(cwd);
+  const absolute = (0, import_node_path21.resolve)(root, target);
+  const rel = (0, import_node_path21.relative)(root, absolute);
   if (rel.startsWith("..") || rel === "" || /^[A-Za-z]:/.test(rel)) {
     throw new Error("Heal target must stay inside the workspace");
   }
@@ -15299,11 +15640,11 @@ function assertSafeHealTarget(cwd, target) {
   }
   return absolute;
 }
-var import_node_path20, BLOCKED_SEGMENTS;
+var import_node_path21, BLOCKED_SEGMENTS;
 var init_pathSafety = __esm({
   "src/heal/pathSafety.ts"() {
     "use strict";
-    import_node_path20 = require("node:path");
+    import_node_path21 = require("node:path");
     BLOCKED_SEGMENTS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", ".next", ".viberaven"]);
   }
 });
@@ -15765,7 +16106,7 @@ export const config = {
 // src/heal/recipes/eslintRestrictedImports.ts
 function detectEslintConfigFile(cwd) {
   for (const candidate of ESLINT_CONFIG_CANDIDATES) {
-    if ((0, import_node_fs9.existsSync)((0, import_node_path21.join)(cwd, candidate))) {
+    if ((0, import_node_fs9.existsSync)((0, import_node_path22.join)(cwd, candidate))) {
       return candidate;
     }
   }
@@ -15920,12 +16261,12 @@ function applyEslintRestrictedImportsRecipe(source, configFile) {
   }
   return applyLegacyModuleRecipe(source);
 }
-var import_node_fs9, import_node_path21, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
+var import_node_fs9, import_node_path22, VIBERAVEN_ESLINT_MARKER, RESTRICTED_IMPORTS_MESSAGE, RESTRICTED_PATHS, RESTRICTED_PATTERNS, ESLINT_CONFIG_CANDIDATES;
 var init_eslintRestrictedImports = __esm({
   "src/heal/recipes/eslintRestrictedImports.ts"() {
     "use strict";
     import_node_fs9 = require("node:fs");
-    import_node_path21 = require("node:path");
+    import_node_path22 = require("node:path");
     init_commands();
     VIBERAVEN_ESLINT_MARKER = "VibeRaven heal: eslint_restricted_imports";
     RESTRICTED_IMPORTS_MESSAGE = `Restricted import. Run ${PUBLIC_AGENT_MODE_COMMAND} before substituting packages.`;
@@ -15977,13 +16318,13 @@ function defaultTargetFile(gapId) {
 }
 async function readSourceOrEmpty(absolutePath) {
   if (!(0, import_node_fs10.existsSync)(absolutePath)) return "";
-  return (0, import_promises15.readFile)(absolutePath, "utf8");
+  return (0, import_promises16.readFile)(absolutePath, "utf8");
 }
 async function detectUpstash(cwd) {
   try {
-    const pkgPath = (0, import_node_path22.join)(cwd, "package.json");
+    const pkgPath = (0, import_node_path23.join)(cwd, "package.json");
     if (!(0, import_node_fs10.existsSync)(pkgPath)) return false;
-    const raw = await (0, import_promises15.readFile)(pkgPath, "utf8");
+    const raw = await (0, import_promises16.readFile)(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
     const deps = {
       ...pkg["dependencies"] ?? {},
@@ -15998,7 +16339,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   const targetFile = explicitTarget ?? defaultTargetFile(gapId);
   if (targetFile === void 0) return null;
   if (gapId === "auth_secret_missing" || gapId === "node_env_not_set" || gapId === "database_url_missing") {
-    const absolutePath = (0, import_node_path22.join)(cwd, targetFile);
+    const absolutePath = (0, import_node_path23.join)(cwd, targetFile);
     const source = await readSourceOrEmpty(absolutePath);
     let result;
     if (gapId === "auth_secret_missing") result = applyAuthSecretRecipe(source);
@@ -16012,25 +16353,25 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
     };
   }
   if (gapId === "missing_error_boundary") {
-    const absolutePath = (0, import_node_path22.join)(cwd, "app/error.tsx");
+    const absolutePath = (0, import_node_path23.join)(cwd, "app/error.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyErrorBoundaryRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_health_route") {
-    const absolutePath = (0, import_node_path22.join)(cwd, "app/api/health/route.ts");
+    const absolutePath = (0, import_node_path23.join)(cwd, "app/api/health/route.ts");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyHealthRouteRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_loading_state") {
-    const absolutePath = (0, import_node_path22.join)(cwd, "app/loading.tsx");
+    const absolutePath = (0, import_node_path23.join)(cwd, "app/loading.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyLoadingStateRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
   }
   if (gapId === "missing_404_page") {
-    const absolutePath = (0, import_node_path22.join)(cwd, "app/not-found.tsx");
+    const absolutePath = (0, import_node_path23.join)(cwd, "app/not-found.tsx");
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyNotFoundRecipe(source);
     return { ...result, canAutoApply: true, recipeName: gapId };
@@ -16048,10 +16389,10 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_csp_header") {
     let configFile = "next.config.js";
-    let absolutePath = (0, import_node_path22.join)(cwd, configFile);
+    let absolutePath = (0, import_node_path23.join)(cwd, configFile);
     if (!(0, import_node_fs10.existsSync)(absolutePath)) {
       configFile = "next.config.mjs";
-      absolutePath = (0, import_node_path22.join)(cwd, configFile);
+      absolutePath = (0, import_node_path23.join)(cwd, configFile);
     }
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyCspHeaderRecipe(source);
@@ -16063,7 +16404,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   if (gapId === "missing_rate_limit") {
     const hasUpstash = await detectUpstash(cwd);
-    const middlewarePath = (0, import_node_path22.join)(cwd, "middleware.ts");
+    const middlewarePath = (0, import_node_path23.join)(cwd, "middleware.ts");
     const source = await readSourceOrEmpty(middlewarePath);
     const result = applyRateLimitRecipe(source, hasUpstash);
     return {
@@ -16085,7 +16426,7 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
         recipeName: gapId
       };
     }
-    const absolutePath = (0, import_node_path22.join)(cwd, configFile);
+    const absolutePath = (0, import_node_path23.join)(cwd, configFile);
     const source = await readSourceOrEmpty(absolutePath);
     const result = applyEslintRestrictedImportsRecipe(source, configFile);
     return {
@@ -16099,13 +16440,13 @@ async function dispatchRecipeByGapId(gapId, cwd, explicitTarget) {
   }
   return null;
 }
-var import_node_fs10, import_promises15, import_node_path22;
+var import_node_fs10, import_promises16, import_node_path23;
 var init_recipes = __esm({
   "src/heal/recipes/index.ts"() {
     "use strict";
     import_node_fs10 = require("node:fs");
-    import_promises15 = require("node:fs/promises");
-    import_node_path22 = require("node:path");
+    import_promises16 = require("node:fs/promises");
+    import_node_path23 = require("node:path");
     init_envAuthSecret();
     init_envNodeEnv();
     init_envDatabaseUrl();
@@ -16180,14 +16521,14 @@ async function applyHeal(options) {
           rollback: { available: false, instructions: "Recipe matched but no change was needed (already applied or file already exists)." }
         };
       }
-      const absoluteTarget = (0, import_node_path23.join)(options.cwd, dispatched.targetFile);
+      const absoluteTarget = (0, import_node_path24.join)(options.cwd, dispatched.targetFile);
       assertSafeHealTarget(options.cwd, dispatched.targetFile);
-      await (0, import_promises16.mkdir)((0, import_node_path23.dirname)(absoluteTarget), { recursive: true });
-      const healDir2 = (0, import_node_path23.join)(options.cwd, ".viberaven", "heal", id);
-      await (0, import_promises16.mkdir)((0, import_node_path23.join)(healDir2, "before"), { recursive: true });
-      const beforeContent = (0, import_node_fs11.existsSync)(absoluteTarget) ? await (0, import_promises16.readFile)(absoluteTarget, "utf8") : "";
-      await (0, import_promises16.writeFile)((0, import_node_path23.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
-      await (0, import_promises16.writeFile)(absoluteTarget, dispatched.output, "utf8");
+      await (0, import_promises17.mkdir)((0, import_node_path24.dirname)(absoluteTarget), { recursive: true });
+      const healDir2 = (0, import_node_path24.join)(options.cwd, ".viberaven", "heal", id);
+      await (0, import_promises17.mkdir)((0, import_node_path24.join)(healDir2, "before"), { recursive: true });
+      const beforeContent = (0, import_node_fs11.existsSync)(absoluteTarget) ? await (0, import_promises17.readFile)(absoluteTarget, "utf8") : "";
+      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "before", "target.txt"), beforeContent, "utf8");
+      await (0, import_promises17.writeFile)(absoluteTarget, dispatched.output, "utf8");
       const patch2 = [
         `--- ${dispatched.targetFile}`,
         `+++ ${dispatched.targetFile}`,
@@ -16197,7 +16538,7 @@ async function applyHeal(options) {
         dispatched.output,
         ""
       ].join("\n");
-      await (0, import_promises16.writeFile)((0, import_node_path23.join)(healDir2, "patch.diff"), patch2, "utf8");
+      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "patch.diff"), patch2, "utf8");
       const result2 = {
         $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
         schemaVersion: "v1",
@@ -16208,7 +16549,7 @@ async function applyHeal(options) {
         gapId: options.gapId,
         recipe: dispatched.recipeName,
         target: dispatched.targetFile,
-        changedFiles: [(0, import_node_path23.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
+        changedFiles: [(0, import_node_path24.relative)(options.cwd, absoluteTarget).replace(/\\/g, "/")],
         artifacts: {
           patch: `.viberaven/heal/${id}/patch.diff`,
           result: `.viberaven/heal/${id}/result.json`
@@ -16218,7 +16559,7 @@ async function applyHeal(options) {
           instructions: "Restore .viberaven/heal/<healId>/before/target.txt to the target file or apply the reverse patch."
         }
       };
-      await (0, import_promises16.writeFile)((0, import_node_path23.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
+      await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir2, "result.json"), `${JSON.stringify(result2, null, 2)}
 `, "utf8");
       return result2;
     }
@@ -16238,7 +16579,7 @@ async function applyHeal(options) {
     };
   }
   const absolute = assertSafeHealTarget(options.cwd, options.target);
-  const before = await (0, import_promises16.readFile)(absolute, "utf8");
+  const before = await (0, import_promises17.readFile)(absolute, "utf8");
   const recipe = applyEmptyCatchRecipe(before);
   if (!recipe.changed) {
     return {
@@ -16255,10 +16596,10 @@ async function applyHeal(options) {
       rollback: { available: false, instructions: "No supported heal recipe matched this file." }
     };
   }
-  const healDir = (0, import_node_path23.join)(options.cwd, ".viberaven", "heal", id);
-  await (0, import_promises16.mkdir)((0, import_node_path23.join)(healDir, "before"), { recursive: true });
-  await (0, import_promises16.writeFile)((0, import_node_path23.join)(healDir, "before", "target.txt"), before, "utf8");
-  await (0, import_promises16.writeFile)(absolute, recipe.output, "utf8");
+  const healDir = (0, import_node_path24.join)(options.cwd, ".viberaven", "heal", id);
+  await (0, import_promises17.mkdir)((0, import_node_path24.join)(healDir, "before"), { recursive: true });
+  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "before", "target.txt"), before, "utf8");
+  await (0, import_promises17.writeFile)(absolute, recipe.output, "utf8");
   const patch = [
     `--- ${options.target}`,
     `+++ ${options.target}`,
@@ -16268,7 +16609,7 @@ async function applyHeal(options) {
     recipe.output,
     ""
   ].join("\n");
-  await (0, import_promises16.writeFile)((0, import_node_path23.join)(healDir, "patch.diff"), patch, "utf8");
+  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "patch.diff"), patch, "utf8");
   const result = {
     $schema: "https://viberaven.dev/schemas/heal-result.schema.json",
     schemaVersion: "v1",
@@ -16279,7 +16620,7 @@ async function applyHeal(options) {
     gapId: options.gapId,
     recipe: "empty-catch-safe-response",
     target: options.target,
-    changedFiles: [(0, import_node_path23.relative)(options.cwd, absolute).replace(/\\/g, "/")],
+    changedFiles: [(0, import_node_path24.relative)(options.cwd, absolute).replace(/\\/g, "/")],
     artifacts: {
       patch: `.viberaven/heal/${id}/patch.diff`,
       result: `.viberaven/heal/${id}/result.json`
@@ -16289,17 +16630,17 @@ async function applyHeal(options) {
       instructions: "Restore .viberaven/heal/<healId>/before/target.txt to the target file or apply the reverse patch."
     }
   };
-  await (0, import_promises16.writeFile)((0, import_node_path23.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises17.writeFile)((0, import_node_path24.join)(healDir, "result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises16, import_node_fs11, import_node_path23;
+var import_promises17, import_node_fs11, import_node_path24;
 var init_apply = __esm({
   "src/heal/apply.ts"() {
     "use strict";
-    import_promises16 = require("node:fs/promises");
+    import_promises17 = require("node:fs/promises");
     import_node_fs11 = require("node:fs");
-    import_node_path23 = require("node:path");
+    import_node_path24 = require("node:path");
     init_pathSafety();
     init_emptyCatch();
     init_recipes();
@@ -16311,8 +16652,8 @@ function healId2() {
   return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
 }
 async function writeHealPlan(options) {
-  const dir = (0, import_node_path24.join)(options.cwd, ".viberaven");
-  await (0, import_promises17.mkdir)(dir, { recursive: true });
+  const dir = (0, import_node_path25.join)(options.cwd, ".viberaven");
+  await (0, import_promises18.mkdir)(dir, { recursive: true });
   const id = healId2();
   const target = options.target ?? `gap:${options.gapId}`;
   const markdown = [
@@ -16339,17 +16680,17 @@ async function writeHealPlan(options) {
     artifacts: { plan: ".viberaven/heal-plan.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises17.writeFile)((0, import_node_path24.join)(dir, "heal-plan.md"), markdown, "utf8");
-  await (0, import_promises17.writeFile)((0, import_node_path24.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
+  await (0, import_promises18.writeFile)((0, import_node_path25.join)(dir, "heal-plan.md"), markdown, "utf8");
+  await (0, import_promises18.writeFile)((0, import_node_path25.join)(dir, "heal-plan.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   return result;
 }
-var import_promises17, import_node_path24;
+var import_promises18, import_node_path25;
 var init_plan = __esm({
   "src/heal/plan.ts"() {
     "use strict";
-    import_promises17 = require("node:fs/promises");
-    import_node_path24 = require("node:path");
+    import_promises18 = require("node:fs/promises");
+    import_node_path25 = require("node:path");
     init_commands();
   }
 });
@@ -16359,8 +16700,8 @@ function healId3() {
   return `heal_${(/* @__PURE__ */ new Date()).toISOString().replace(/\D/g, "").slice(0, 14)}`;
 }
 async function writeHealPrompt(options) {
-  const dir = (0, import_node_path25.join)(options.cwd, ".viberaven");
-  await (0, import_promises18.mkdir)(dir, { recursive: true });
+  const dir = (0, import_node_path26.join)(options.cwd, ".viberaven");
+  await (0, import_promises19.mkdir)(dir, { recursive: true });
   const id = healId3();
   const target = options.target ?? `gap:${options.gapId}`;
   const prompt = [
@@ -16387,15 +16728,15 @@ async function writeHealPrompt(options) {
     artifacts: { prompt: ".viberaven/heal-prompt.md" },
     rollback: { available: false, instructions: "No source files were changed." }
   };
-  await (0, import_promises18.writeFile)((0, import_node_path25.join)(dir, "heal-prompt.md"), prompt, "utf8");
+  await (0, import_promises19.writeFile)((0, import_node_path26.join)(dir, "heal-prompt.md"), prompt, "utf8");
   return result;
 }
-var import_promises18, import_node_path25;
+var import_promises19, import_node_path26;
 var init_prompt = __esm({
   "src/heal/prompt.ts"() {
     "use strict";
-    import_promises18 = require("node:fs/promises");
-    import_node_path25 = require("node:path");
+    import_promises19 = require("node:fs/promises");
+    import_node_path26 = require("node:path");
     init_commands();
   }
 });
@@ -16406,7 +16747,7 @@ function loopStatePath(workspaceRoot) {
 }
 async function loadLoopState(workspaceRoot) {
   try {
-    const raw = await (0, import_promises19.readFile)(loopStatePath(workspaceRoot), "utf8");
+    const raw = await (0, import_promises20.readFile)(loopStatePath(workspaceRoot), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.batchApplied === "number" && typeof parsed.lastGapCount === "number" && typeof parsed.stalledScans === "number") {
       const p2 = parsed;
@@ -16426,8 +16767,8 @@ async function loadLoopState(workspaceRoot) {
 async function saveLoopState(workspaceRoot, state) {
   try {
     const dir = (0, import_path.join)(workspaceRoot, ".viberaven");
-    await (0, import_promises19.mkdir)(dir, { recursive: true });
-    await (0, import_promises19.writeFile)(loopStatePath(workspaceRoot), JSON.stringify(state, null, 2) + "\n", "utf8");
+    await (0, import_promises20.mkdir)(dir, { recursive: true });
+    await (0, import_promises20.writeFile)(loopStatePath(workspaceRoot), JSON.stringify(state, null, 2) + "\n", "utf8");
   } catch (err) {
     console.warn("[VibeRaven] Could not save loop-state.json:", err instanceof Error ? err.message : String(err));
   }
@@ -16453,11 +16794,11 @@ function resetBatch(state, newGapCount) {
     appliedGapIdsSinceScan: []
   };
 }
-var import_promises19, import_path, DEFAULT_LOOP_STATE;
+var import_promises20, import_path, DEFAULT_LOOP_STATE;
 var init_loopState = __esm({
   "src/loopState.ts"() {
     "use strict";
-    import_promises19 = require("fs/promises");
+    import_promises20 = require("fs/promises");
     import_path = require("path");
     DEFAULT_LOOP_STATE = {
       batchApplied: 0,
@@ -16498,11 +16839,11 @@ var init_heal = __esm({
 
 // src/stackRecommend.ts
 async function recommendStack(cwd = process.cwd()) {
-  const pkgPath = (0, import_node_path26.join)(cwd, "package.json");
+  const pkgPath = (0, import_node_path27.join)(cwd, "package.json");
   if (!(0, import_node_fs12.existsSync)(pkgPath)) {
     return DEFAULT_STACK;
   }
-  const pkg = JSON.parse(await (0, import_promises20.readFile)(pkgPath, "utf-8"));
+  const pkg = JSON.parse(await (0, import_promises21.readFile)(pkgPath, "utf-8"));
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   const names = Object.keys(deps).join(" ").toLowerCase();
   const rec = {
@@ -16530,13 +16871,13 @@ async function recommendStack(cwd = process.cwd()) {
   }
   return rec;
 }
-var import_promises20, import_node_fs12, import_node_path26, DEFAULT_STACK;
+var import_promises21, import_node_fs12, import_node_path27, DEFAULT_STACK;
 var init_stackRecommend = __esm({
   "src/stackRecommend.ts"() {
     "use strict";
-    import_promises20 = require("node:fs/promises");
+    import_promises21 = require("node:fs/promises");
     import_node_fs12 = require("node:fs");
-    import_node_path26 = require("node:path");
+    import_node_path27 = require("node:path");
     DEFAULT_STACK = {
       frontend: "react",
       ui: "tailwind + shadcn/ui",
@@ -16581,7 +16922,7 @@ var init_runInit = __esm({
 async function checkAgentInjection(cwd) {
   const checks = [];
   for (const item4 of REQUIRED_EXISTENCE_CHECKS) {
-    const exists = await fileExists2((0, import_node_path27.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path28.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
@@ -16589,17 +16930,17 @@ async function checkAgentInjection(cwd) {
     });
   }
   for (const item4 of OPTIONAL_CURSOR_PACK_CHECKS) {
-    const exists = await fileExists2((0, import_node_path27.join)(cwd, item4.file));
+    const exists = await fileExists2((0, import_node_path28.join)(cwd, item4.file));
     checks.push({
       id: item4.id,
       status: exists ? "pass" : "fail",
       message: exists ? `${item4.file} exists` : `Missing ${item4.file} \u2014 run npx -y viberaven init --agents all`
     });
   }
-  const legacyCursorPath = (0, import_node_path27.join)(cwd, ".cursor/rules/viberaven.mdc");
+  const legacyCursorPath = (0, import_node_path28.join)(cwd, ".cursor/rules/viberaven.mdc");
   if (await fileExists2(legacyCursorPath)) {
-    const legacyContent = await (0, import_promises21.readFile)(legacyCursorPath, "utf-8");
-    const hasCoreSplit = await fileExists2((0, import_node_path27.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
+    const legacyContent = await (0, import_promises22.readFile)(legacyCursorPath, "utf-8");
+    const hasCoreSplit = await fileExists2((0, import_node_path28.join)(cwd, ".cursor/rules/viberaven-core.mdc"));
     if (!hasCoreSplit || legacyContent.includes("alwaysApply: true")) {
       checks.push({
         id: "cursor-legacy-mdc",
@@ -16610,7 +16951,7 @@ async function checkAgentInjection(cwd) {
   }
   for (const target of CORE_AGENT_INJECTION_TARGETS) {
     const file = target === "cursor" ? ".cursor/rules/viberaven-core.mdc" : AGENT_RULE_TARGETS[target].file;
-    const path = (0, import_node_path27.join)(cwd, file);
+    const path = (0, import_node_path28.join)(cwd, file);
     const exists = await fileExists2(path);
     if (!exists) {
       checks.push({
@@ -16620,7 +16961,7 @@ async function checkAgentInjection(cwd) {
       });
       continue;
     }
-    const content = await (0, import_promises21.readFile)(path, "utf-8");
+    const content = await (0, import_promises22.readFile)(path, "utf-8");
     const hasCommand = content.includes(PUBLIC_CHECK_COMMAND);
     checks.push({
       id: `canonical-${target}`,
@@ -16654,18 +16995,18 @@ function formatDoctorAgentsReport(report) {
 }
 async function fileExists2(path) {
   try {
-    await (0, import_promises21.access)(path);
+    await (0, import_promises22.access)(path);
     return true;
   } catch {
     return false;
   }
 }
-var import_promises21, import_node_path27, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS;
+var import_promises22, import_node_path28, REQUIRED_EXISTENCE_CHECKS, OPTIONAL_CURSOR_PACK_CHECKS, STALE_PATTERNS;
 var init_doctorAgents = __esm({
   "src/commands/doctorAgents.ts"() {
     "use strict";
-    import_promises21 = require("node:fs/promises");
-    import_node_path27 = require("node:path");
+    import_promises22 = require("node:fs/promises");
+    import_node_path28 = require("node:path");
     init_commands();
     init_agentTargets();
     REQUIRED_EXISTENCE_CHECKS = [
@@ -16925,39 +17266,164 @@ var init_runAudit = __esm({
   }
 });
 
-// src/actions/render.ts
-function redact(text) {
-  return redactString(text).replace(/\[REDACTED(?:_[A-Z_]+)?\]/g, "<redacted>").replace(
-    /\b([A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|DATABASE_URL|POSTGRES_URL|SERVICE_ROLE)[A-Z0-9_]*)=([^,\s]+)/gi,
-    "$1=<redacted>"
-  ).replace(/\bpostgres(?:ql)?:\/\/[^@\s]+@/gi, "postgresql://<redacted>@").replace(/[A-Za-z]:\\[^\s`"]+/g, "<repo-relative-path>").replace(/\b\/Users\/[^\s`"]+/g, "<repo-relative-path>").replace(/\b\/home\/[^\s`"]+/g, "<repo-relative-path>").replace(/\beyJ[A-Za-z0-9._-]*\b/g, "<redacted>");
-}
-function stringifyPayload(value) {
-  if (Array.isArray(value)) {
-    return value.map((entry) => String(entry)).join("\n");
-  }
-  if (value && typeof value === "object") {
-    return JSON.stringify(value, null, 2);
+// src/commands/cleanPlan.ts
+function buildContextCleanupPlan(input) {
+  const items = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const file of input.files) {
+    const path = normalizePath5((0, import_node_path29.relative)(input.projectRoot, file.path) || file.path);
+    const fullPath = normalizePath5(file.path);
+    const category = categorizeCleanupFile(path, fullPath, file);
+    if (!category || seen.has(path)) {
+      continue;
+    }
+    seen.add(path);
+    items.push({
+      path,
+      category,
+      action: "review-ignore-or-exclude-manually",
+      reason: reasonForCategory(category)
+    });
   }
-  return String(value ?? "");
+  return {
+    title: "VibeRaven context cleanup plan",
+    warning: "VibeRaven only writes this review plan. Review each item manually before changing ignore rules or excluding artifacts from agent context.",
+    items
+  };
 }
-function fenceFor(format) {
-  if (format === "bash" || format === "sql" || format === "json") {
-    return format;
-  }
-  return "txt";
+async function collectCleanupFiles(projectRoot) {
+  const files = [];
+  await walkCleanupFiles(projectRoot, projectRoot, files, 0);
+  return files;
 }
-function renderTarget(target) {
-  if (!target) {
-    return [];
+async function writeCleanupPlan(projectRoot, plan) {
+  const outputDir = (0, import_node_path29.join)(projectRoot, ".viberaven");
+  const outputPath = (0, import_node_path29.join)(outputDir, "context-cleanup.md");
+  await (0, import_promises23.mkdir)(outputDir, { recursive: true });
+  await (0, import_promises23.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
+  return outputPath;
+}
+function categorizeCleanupFile(relativePath, fullPath, file) {
+  if (relativePath.startsWith(".viberaven/") || fullPath.includes("/.viberaven/")) {
+    return "generated-artifact";
   }
-  if (target.type === "url") {
-    return [`Open: ${redact(target.href || target.label)}`];
+  if (isCachePath(relativePath)) {
+    return "cache-directory";
   }
-  if (target.type === "file") {
-    return [`File: ${redact(target.path)}`];
+  if (relativePath.endsWith(".log") && file.sizeBytes >= LARGE_LOG_BYTES) {
+    return "large-log";
   }
-  if (target.type === "command") {
+  return void 0;
+}
+function isCachePath(path) {
+  return path === ".next/cache" || path.startsWith(".next/cache/") || path === ".turbo" || path.startsWith(".turbo/") || path === ".vite" || path.startsWith(".vite/") || path.includes("/node_modules/.cache/") || path.endsWith("/node_modules/.cache");
+}
+function reasonForCategory(category) {
+  switch (category) {
+    case "generated-artifact":
+      return "Generated VibeRaven artifact. Keep current scan outputs, but avoid loading old reports into agent context.";
+    case "large-log":
+      return "Large log file that can add token noise. Review it before changing ignore rules or excluding it from agent context.";
+    case "cache-directory":
+      return "Build cache evidence. Do not load it into agent context unless debugging build internals.";
+  }
+}
+function renderCleanupPlan(plan) {
+  const lines = ["# VibeRaven context cleanup plan", "", plan.warning, ""];
+  if (plan.items.length === 0) {
+    lines.push("No noisy generated artifacts, large logs, or cache directories were found by the conservative scanner.");
+  }
+  for (const item4 of plan.items) {
+    lines.push(`- ${item4.path}`);
+    lines.push(`  - Category: ${item4.category}`);
+    lines.push(`  - Action: ${item4.action}`);
+    lines.push(`  - Reason: ${item4.reason}`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+async function walkCleanupFiles(root, dir, result, depth) {
+  if (depth > MAX_WALK_DEPTH) {
+    return;
+  }
+  let entries;
+  try {
+    entries = await (0, import_promises23.readdir)(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRECTORIES.has(entry.name)) {
+      continue;
+    }
+    const absolute = (0, import_node_path29.join)(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (isCachePath(normalizePath5((0, import_node_path29.relative)(root, absolute)))) {
+        result.push({ path: absolute, sizeBytes: 0, kind: "directory" });
+        continue;
+      }
+      await walkCleanupFiles(root, absolute, result, depth + 1);
+      continue;
+    }
+    if (!entry.isFile()) {
+      continue;
+    }
+    try {
+      const fileStat = await (0, import_promises23.stat)(absolute);
+      result.push({ path: absolute, sizeBytes: fileStat.size, kind: "file" });
+    } catch {
+      continue;
+    }
+  }
+}
+function normalizePath5(path) {
+  return path.replace(/\\/g, "/");
+}
+var import_promises23, import_node_path29, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
+var init_cleanPlan = __esm({
+  "src/commands/cleanPlan.ts"() {
+    "use strict";
+    import_promises23 = require("node:fs/promises");
+    import_node_path29 = require("node:path");
+    MAX_WALK_DEPTH = 5;
+    LARGE_LOG_BYTES = 8192;
+    SKIP_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
+  }
+});
+
+// src/actions/render.ts
+function redact(text) {
+  return redactString(text).replace(/\[REDACTED(?:_[A-Z_]+)?\]/g, "<redacted>").replace(
+    /\b([A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|DATABASE_URL|POSTGRES_URL|SERVICE_ROLE)[A-Z0-9_]*)=([^,\s]+)/gi,
+    "$1=<redacted>"
+  ).replace(/\bpostgres(?:ql)?:\/\/[^@\s]+@/gi, "postgresql://<redacted>@").replace(/[A-Za-z]:\\[^\s`"]+/g, "<repo-relative-path>").replace(/\b\/Users\/[^\s`"]+/g, "<repo-relative-path>").replace(/\b\/home\/[^\s`"]+/g, "<repo-relative-path>").replace(/\beyJ[A-Za-z0-9._-]*\b/g, "<redacted>");
+}
+function stringifyPayload(value) {
+  if (Array.isArray(value)) {
+    return value.map((entry) => String(entry)).join("\n");
+  }
+  if (value && typeof value === "object") {
+    return JSON.stringify(value, null, 2);
+  }
+  return String(value ?? "");
+}
+function fenceFor(format) {
+  if (format === "bash" || format === "sql" || format === "json") {
+    return format;
+  }
+  return "txt";
+}
+function renderTarget(target) {
+  if (!target) {
+    return [];
+  }
+  if (target.type === "url") {
+    return [`Open: ${redact(target.href || target.label)}`];
+  }
+  if (target.type === "file") {
+    return [`File: ${redact(target.path)}`];
+  }
+  if (target.type === "command") {
     return ["Run:", "```bash", redact(target.command), "```"];
   }
   if (target.type === "provider") {
@@ -17027,10 +17493,10 @@ var init_render = __esm({
 
 // src/commands/actions.ts
 async function runActionsCommand(input) {
-  const actionsPath = (0, import_node_path28.join)(getProjectArtifactsDir(input.cwd), "actions.json");
+  const actionsPath = (0, import_node_path30.join)(getProjectArtifactsDir(input.cwd), "actions.json");
   let raw;
   try {
-    raw = await (0, import_promises22.readFile)(actionsPath, "utf8");
+    raw = await (0, import_promises24.readFile)(actionsPath, "utf8");
   } catch {
     process.stderr.write("No VibeRaven actions found. Run `npx -y viberaven --agent-mode` first.\n");
     return 1;
@@ -17044,12 +17510,12 @@ async function runActionsCommand(input) {
   process.stdout.write(renderActionSurface(manifest));
   return 0;
 }
-var import_promises22, import_node_path28;
+var import_promises24, import_node_path30;
 var init_actions = __esm({
   "src/commands/actions.ts"() {
     "use strict";
-    import_promises22 = require("node:fs/promises");
-    import_node_path28 = require("node:path");
+    import_promises24 = require("node:fs/promises");
+    import_node_path30 = require("node:path");
     init_render();
     init_config();
   }
@@ -17058,7 +17524,7 @@ var init_actions = __esm({
 // src/commands/verifyAction.ts
 async function currentActionExists(cwd, actionId) {
   try {
-    const raw = await (0, import_promises23.readFile)((0, import_node_path29.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
+    const raw = await (0, import_promises25.readFile)((0, import_node_path31.join)(getProjectArtifactsDir(cwd), "actions.json"), "utf8");
     const manifest = JSON.parse(raw);
     return manifest.actions.some((action) => action.id === actionId);
   } catch {
@@ -17102,12 +17568,12 @@ Run \`npx -y viberaven --verify\` to refresh the production gate for this action
   );
   return 0;
 }
-var import_promises23, import_node_path29;
+var import_promises25, import_node_path31;
 var init_verifyAction = __esm({
   "src/commands/verifyAction.ts"() {
     "use strict";
-    import_promises23 = require("node:fs/promises");
-    import_node_path29 = require("node:path");
+    import_promises25 = require("node:fs/promises");
+    import_node_path31 = require("node:path");
     init_registry2();
     init_config();
   }
@@ -17272,8 +17738,8 @@ async function runCheckCommand(options) {
     for (const gap of sorted) {
       console.log(`${SEVERITY_ICON[gap.severity]} ${gap.title}  (${gap.id})`);
       if (!options.quiet && gap.detail) {
-        const firstLine = gap.detail.split("\n")[0];
-        console.log(`   ${firstLine}`);
+        const firstLine2 = gap.detail.split("\n")[0];
+        console.log(`   ${firstLine2}`);
       }
     }
   }
@@ -17304,128 +17770,1443 @@ var init_check = __esm({
   }
 });
 
-// src/commands/cleanPlan.ts
-function buildContextCleanupPlan(input) {
-  const items = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const file of input.files) {
-    const path = normalizePath5((0, import_node_path30.relative)(input.projectRoot, file.path) || file.path);
-    const fullPath = normalizePath5(file.path);
-    const category = categorizeCleanupFile(path, fullPath, file);
-    if (!category || seen.has(path)) {
-      continue;
+// src/rls/permissionsMatrix.ts
+function sha256(data) {
+  return (0, import_node_crypto.createHash)("sha256").update(data).digest("hex");
+}
+function parsePermissionsMatrix(text) {
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (error) {
+    throw new MatrixError([`not valid JSON: ${error instanceof Error ? error.message : String(error)}`]);
+  }
+  const problems = [];
+  if (!isObject2(raw)) throw new MatrixError(["the file must hold a JSON object"]);
+  for (const key of Object.keys(raw)) {
+    if (!TOP_KEYS.has(key)) problems.push(`${key}: unknown key`);
+  }
+  if (raw.version !== 1) problems.push(`version: must be 1 (got ${show(raw.version)})`);
+  if (raw.description !== void 0 && typeof raw.description !== "string") problems.push("description: must be a string");
+  let defaultGrants = "supabase-legacy";
+  if (raw.defaultGrants !== void 0) {
+    if (DEFAULT_GRANT_MODES.includes(raw.defaultGrants)) defaultGrants = raw.defaultGrants;
+    else problems.push(`defaultGrants: must be ${quoteList(DEFAULT_GRANT_MODES)} (got ${show(raw.defaultGrants)})`);
+  }
+  const tables = [];
+  if (!isObject2(raw.tables)) {
+    problems.push('tables: must be an object keyed by table name, e.g. { "public.posts": { ... } }');
+  } else if (Object.keys(raw.tables).length === 0) {
+    problems.push("tables: list at least one table");
+  } else {
+    const seen = /* @__PURE__ */ new Set();
+    for (const [key, value] of Object.entries(raw.tables)) {
+      const table = parseTable(key, value, problems);
+      if (!table) continue;
+      const full = `${table.schema}.${table.name}`;
+      if (seen.has(full)) problems.push(`tables[${show(key)}]: ${full} is listed twice`);
+      seen.add(full);
+      tables.push(table);
     }
-    seen.add(path);
-    items.push({
-      path,
-      category,
-      action: "review-ignore-or-exclude-manually",
-      reason: reasonForCategory(category)
+  }
+  if (problems.length > 0) throw new MatrixError(problems);
+  return {
+    version: 1,
+    ...typeof raw.description === "string" ? { description: raw.description } : {},
+    defaultGrants,
+    tables,
+    hash: sha256(text)
+  };
+}
+function parseTable(key, value, problems) {
+  const at2 = `tables[${show(key)}]`;
+  const parts = key.split(".");
+  const nameOk = (parts.length === 1 || parts.length === 2) && parts.every((p2) => IDENT.test(p2));
+  if (!nameOk) {
+    problems.push(`${at2}: table must be "name" or "schema.name" using letters, digits, _ and $`);
+    return void 0;
+  }
+  if (!isObject2(value)) {
+    problems.push(`${at2}: must be an object with "owner" and "expect"`);
+    return void 0;
+  }
+  const before = problems.length;
+  for (const k3 of Object.keys(value)) {
+    if (!TABLE_KEYS.has(k3)) problems.push(`${at2}.${k3}: unknown key`);
+  }
+  let ownerColumn = "";
+  if (value.owner === void 0) {
+    problems.push(`${at2}.owner: missing; say which column holds the owner, e.g. { "column": "user_id", "is": "auth.uid()" }`);
+  } else if (!isObject2(value.owner)) {
+    problems.push(`${at2}.owner: must be an object like { "column": "user_id", "is": "auth.uid()" }`);
+  } else {
+    for (const k3 of Object.keys(value.owner)) {
+      if (!OWNER_KEYS.has(k3)) problems.push(`${at2}.owner.${k3}: unknown key`);
+    }
+    if (typeof value.owner.column !== "string" || !IDENT.test(value.owner.column)) {
+      problems.push(`${at2}.owner.column: must be a column name (got ${show(value.owner.column)})`);
+    } else {
+      ownerColumn = value.owner.column;
+    }
+    if (value.owner.is !== "auth.uid()") {
+      problems.push(`${at2}.owner.is: only "auth.uid()" is supported (got ${show(value.owner.is)})`);
+    }
+  }
+  const expect = {};
+  let serviceRoleExcluded = false;
+  if (!isObject2(value.expect)) {
+    problems.push(`${at2}.expect: missing; list owner, other_user and anon, each with select, insert, update and delete`);
+  } else {
+    for (const actor of Object.keys(value.expect)) {
+      if (!MATRIX_ACTORS.includes(actor)) {
+        problems.push(`${at2}.expect.${actor}: unknown actor; use one of ${MATRIX_ACTORS.join(", ")}`);
+      }
+    }
+    for (const actor of TESTED_ACTORS) {
+      const cells = value.expect[actor];
+      const actorAt = `${at2}.expect.${actor}`;
+      if (cells === void 0) {
+        problems.push(`${actorAt}: missing; list select, insert, update and delete for this actor`);
+        continue;
+      }
+      if (!isObject2(cells)) {
+        problems.push(`${actorAt}: must be an object like { "select": "deny", "insert": "deny", "update": "deny", "delete": "deny" }`);
+        continue;
+      }
+      for (const action of Object.keys(cells)) {
+        if (!ALL_ACTIONS.includes(action)) {
+          problems.push(`${actorAt}.${action}: unknown action; use one of ${ALL_ACTIONS.join(", ")}`);
+        }
+      }
+      const parsed = {};
+      for (const action of MATRIX_ACTIONS) {
+        const cell = cells[action];
+        if (cell === void 0) problems.push(`${actorAt}.${action}: missing; write ${quoteList(CELL_VALUES)}`);
+        else if (!CELL_VALUES.includes(cell)) problems.push(`${actorAt}.${action}: must be ${quoteList(CELL_VALUES)} (got ${show(cell)})`);
+        else parsed[action] = cell;
+      }
+      if (cells.reassign !== void 0) {
+        if (!CELL_VALUES.includes(cells.reassign)) problems.push(`${actorAt}.reassign: must be ${quoteList(CELL_VALUES)} (got ${show(cells.reassign)})`);
+        else parsed.reassign = cells.reassign;
+      }
+      expect[actor] = parsed;
+    }
+    if (value.expect.service_role !== void 0) {
+      if (value.expect.service_role === "excluded") serviceRoleExcluded = true;
+      else problems.push(`${at2}.expect.service_role: must be "excluded"; the service role bypasses RLS, so it is never tested`);
+    }
+  }
+  const seed = {};
+  if (value.seed !== void 0) {
+    if (!isObject2(value.seed)) {
+      problems.push(`${at2}.seed: must be an object of column values, e.g. { "title": "hello" }`);
+    } else {
+      for (const [column, v] of Object.entries(value.seed)) {
+        if (!IDENT.test(column)) problems.push(`${at2}.seed.${column}: not a column name`);
+        else if (v !== null && !["string", "number", "boolean"].includes(typeof v)) problems.push(`${at2}.seed.${column}: must be a string, number, boolean or null`);
+        else if (column === ownerColumn) problems.push(`${at2}.seed.${column}: the owner column is set by the test, leave it out`);
+        else seed[column] = v;
+      }
+    }
+  }
+  let updateColumn;
+  if (value.updateColumn !== void 0) {
+    if (typeof value.updateColumn !== "string" || !IDENT.test(value.updateColumn)) problems.push(`${at2}.updateColumn: must be a column name`);
+    else if (value.updateColumn === ownerColumn) problems.push(`${at2}.updateColumn: pick a column other than the owner column`);
+    else updateColumn = value.updateColumn;
+  }
+  if (value.description !== void 0 && typeof value.description !== "string") problems.push(`${at2}.description: must be a string`);
+  if (problems.length > before) return void 0;
+  const [schema, name] = parts.length === 2 ? parts : ["public", parts[0]];
+  return { key, schema, name, ownerColumn, expect, serviceRoleExcluded, seed, ...updateColumn ? { updateColumn } : {} };
+}
+var import_node_crypto, MATRIX_ACTORS, TESTED_ACTORS, MATRIX_ACTIONS, OPTIONAL_ACTIONS, ALL_ACTIONS, CELL_VALUES, DEFAULT_GRANT_MODES, DEFAULT_MATRIX_FILE, MatrixError, IDENT, TOP_KEYS, TABLE_KEYS, OWNER_KEYS, isObject2, show, quoteList;
+var init_permissionsMatrix = __esm({
+  "src/rls/permissionsMatrix.ts"() {
+    "use strict";
+    import_node_crypto = require("node:crypto");
+    MATRIX_ACTORS = ["owner", "other_user", "anon", "service_role"];
+    TESTED_ACTORS = ["owner", "other_user", "anon"];
+    MATRIX_ACTIONS = ["select", "insert", "update", "delete"];
+    OPTIONAL_ACTIONS = ["reassign"];
+    ALL_ACTIONS = [...MATRIX_ACTIONS, ...OPTIONAL_ACTIONS];
+    CELL_VALUES = ["allow", "deny", "skip"];
+    DEFAULT_GRANT_MODES = ["supabase-legacy", "none"];
+    DEFAULT_MATRIX_FILE = "viberaven.permissions.json";
+    MatrixError = class extends Error {
+      constructor(problems) {
+        super(`The permissions matrix is not valid:
+${problems.map((p2) => `  - ${p2}`).join("\n")}`);
+        this.problems = problems;
+      }
+      name = "MatrixError";
+    };
+    IDENT = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+    TOP_KEYS = /* @__PURE__ */ new Set(["$schema", "version", "description", "defaultGrants", "tables"]);
+    TABLE_KEYS = /* @__PURE__ */ new Set(["owner", "expect", "seed", "updateColumn", "description"]);
+    OWNER_KEYS = /* @__PURE__ */ new Set(["column", "is"]);
+    isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    show = (value) => JSON.stringify(value);
+    quoteList = (items) => items.length === 2 ? `"${items[0]}" or "${items[1]}"` : `${items.slice(0, -1).map((i) => `"${i}"`).join(", ")} or "${items[items.length - 1]}"`;
+  }
+});
+
+// src/rls/supabaseImitation.ts
+function assumptionsFor(defaultGrants) {
+  return [
+    defaultGrants === "supabase-legacy" ? "defaultGrants supabase-legacy: new public tables are granted to anon and authenticated, as on existing Supabase projects. Newer projects may not grant by default, so a table without RLS may be less exposed there." : "defaultGrants none: new public tables get no grants beyond what the migrations write. Existing Supabase projects do grant by default.",
+    "Migrations run in file-name order as the postgres superuser, like `supabase db reset`.",
+    "Each probe runs in its own transaction and is rolled back, so every cell starts from the same seeded rows."
+  ];
+}
+function imitationSetupSql(defaultGrants) {
+  const grants = defaultGrants === "supabase-legacy" ? `
+alter default privileges in schema public grant all on tables to anon, authenticated, service_role;
+alter default privileges in schema public grant all on sequences to anon, authenticated, service_role;
+alter default privileges in schema public grant all on functions to anon, authenticated, service_role;` : "";
+  return `
+create role anon nologin noinherit;
+create role authenticated nologin noinherit;
+create role service_role nologin noinherit bypassrls;
+create role authenticator nologin noinherit;
+create role supabase_admin nologin;
+create role supabase_auth_admin nologin;
+create role supabase_storage_admin nologin;
+create role dashboard_user nologin;
+grant anon, authenticated, service_role to authenticator;
+
+create schema if not exists extensions;
+grant usage on schema extensions to anon, authenticated, service_role;
+
+create schema auth;
+grant usage on schema auth to anon, authenticated, service_role;
+create table auth.users (
+  instance_id uuid,
+  id uuid primary key,
+  aud varchar(255),
+  role varchar(255),
+  email varchar(255) unique,
+  encrypted_password varchar(255),
+  email_confirmed_at timestamptz,
+  phone text unique,
+  raw_app_meta_data jsonb default '{}'::jsonb,
+  raw_user_meta_data jsonb default '{}'::jsonb,
+  is_anonymous boolean not null default false,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now()
+);
+create function auth.jwt() returns jsonb language sql stable as $$
+  select coalesce(nullif(current_setting('request.jwt.claims', true), ''), '{}')::jsonb
+$$;
+create function auth.uid() returns uuid language sql stable as $$
+  select nullif(coalesce(nullif(current_setting('request.jwt.claim.sub', true), ''), auth.jwt() ->> 'sub'), '')::uuid
+$$;
+create function auth.role() returns text language sql stable as $$
+  select coalesce(nullif(current_setting('request.jwt.claim.role', true), ''), auth.jwt() ->> 'role')
+$$;
+create function auth.email() returns text language sql stable as $$
+  select coalesce(nullif(current_setting('request.jwt.claim.email', true), ''), auth.jwt() ->> 'email')
+$$;
+grant execute on all functions in schema auth to anon, authenticated, service_role;
+
+create schema storage;
+grant usage on schema storage to anon, authenticated, service_role;
+create table storage.buckets (
+  id text primary key,
+  name text not null unique,
+  owner uuid,
+  public boolean default false,
+  file_size_limit bigint,
+  allowed_mime_types text[],
+  created_at timestamptz default now(),
+  updated_at timestamptz default now()
+);
+create table storage.objects (
+  id uuid primary key default gen_random_uuid(),
+  bucket_id text references storage.buckets (id),
+  name text,
+  owner uuid,
+  owner_id text,
+  metadata jsonb,
+  path_tokens text[] generated always as (string_to_array(name, '/')) stored,
+  created_at timestamptz default now(),
+  updated_at timestamptz default now()
+);
+alter table storage.objects enable row level security;
+alter table storage.buckets enable row level security;
+create function storage.foldername(name text) returns text[] language sql immutable as $$
+  select (string_to_array(name, '/'))[1:array_length(string_to_array(name, '/'), 1) - 1]
+$$;
+create function storage.filename(name text) returns text language sql immutable as $$
+  select (string_to_array(name, '/'))[array_length(string_to_array(name, '/'), 1)]
+$$;
+create function storage.extension(name text) returns text language sql immutable as $$
+  select reverse(split_part(reverse(storage.filename(name)), '.', 1))
+$$;
+
+grant usage on schema public to anon, authenticated, service_role;
+${grants}
+`;
+}
+function seedUsersSql() {
+  return `
+insert into auth.users (id, aud, role, email) values
+  ('${OWNER_ID}', 'authenticated', 'authenticated', 'owner@example.test'),
+  ('${OTHER_USER_ID}', 'authenticated', 'authenticated', 'other-user@example.test');
+`;
+}
+var OWNER_ID, OTHER_USER_ID, IMITATION_EXCLUSIONS;
+var init_supabaseImitation = __esm({
+  "src/rls/supabaseImitation.ts"() {
+    "use strict";
+    OWNER_ID = "11111111-1111-4111-8111-111111111111";
+    OTHER_USER_ID = "22222222-2222-4222-8222-222222222222";
+    IMITATION_EXCLUSIONS = [
+      "Supabase Auth is not run: auth.uid() reads a JWT sub claim the test sets, no sign-in or token signing happens.",
+      "PostgREST (the Data API) is not run: probes go straight to Postgres as the anon and authenticated roles, so API settings, exposed schemas and column selection are not tested.",
+      "Storage, Realtime and Edge Functions are not modelled; storage.objects and storage.buckets exist only so migrations that mention them can apply.",
+      "The live project is not read: its applied migrations, actual grants and Auth settings may differ from the repo.",
+      "supabase/seed.sql is not applied.",
+      "Views, functions and RPC calls are only exercised through the listed tables."
+    ];
+  }
+});
+
+// src/rls/workerDatabase.ts
+async function createWorkerDatabase(options) {
+  const worker = new import_node_worker_threads.Worker(WORKER_SOURCE, {
+    eval: true,
+    workerData: { pglitePath: options.pglitePath, contrib: options.contrib },
+    env: { ...options.env }
+  });
+  const pending = /* @__PURE__ */ new Map();
+  let nextId = 0;
+  let dead;
+  const failAll = (error) => {
+    dead = dead ?? error;
+    for (const [, p2] of pending) {
+      clearTimeout(p2.timer);
+      p2.reject(error);
+    }
+    pending.clear();
+  };
+  worker.on("message", (m2) => {
+    const p2 = pending.get(m2.id);
+    if (!p2) return;
+    pending.delete(m2.id);
+    clearTimeout(p2.timer);
+    if (m2.ok) p2.resolve(m2.result);
+    else p2.reject(new SqlError(m2.error?.message ?? "unknown error", m2.error?.code));
+  });
+  worker.on("error", (error) => failAll(error instanceof Error ? error : new Error(String(error))));
+  worker.on("exit", (code) => failAll(new Error(`the PGlite worker stopped (exit ${code})`)));
+  const call = (message, timeoutMs) => {
+    if (dead) return Promise.reject(dead);
+    const id = ++nextId;
+    return new Promise((resolve9, reject) => {
+      const timer = setTimeout(() => {
+        const error = new RlsTimeoutError(`timed out after ${Math.round(timeoutMs / 1e3)} s`);
+        failAll(error);
+        void worker.terminate();
+      }, timeoutMs);
+      pending.set(id, { resolve: resolve9, reject, timer });
+      worker.postMessage({ ...message, id });
     });
+  };
+  try {
+    await call({ op: "init" }, options.startTimeoutMs ?? 6e4);
+  } catch (error) {
+    failAll(error instanceof Error ? error : new Error(String(error)));
+    await worker.terminate();
+    throw error;
   }
   return {
-    title: "VibeRaven context cleanup plan",
-    warning: "VibeRaven only writes this review plan. Review each item manually before changing ignore rules or excluding artifacts from agent context.",
-    items
+    query: (sql, params = [], opts = {}) => call({ op: "query", sql, params }, opts.timeoutMs ?? options.statementTimeoutMs),
+    exec: (sql, opts = {}) => call({ op: "exec", sql }, opts.timeoutMs ?? options.statementTimeoutMs),
+    isolationReport: () => call({ op: "isolation" }, 1e4),
+    close: async () => {
+      if (!dead) await call({ op: "close" }, 1e4).catch(() => void 0);
+      await worker.terminate();
+    }
   };
 }
-async function collectCleanupFiles(projectRoot) {
-  const files = [];
-  await walkCleanupFiles(projectRoot, projectRoot, files, 0);
-  return files;
+var import_node_module, import_node_worker_threads, NETWORK_DENIED, RlsTimeoutError, WORKER_SOURCE, SqlError, resolveFromCli, defaultPgliteLoader;
+var init_workerDatabase = __esm({
+  "src/rls/workerDatabase.ts"() {
+    "use strict";
+    import_node_module = require("node:module");
+    import_node_worker_threads = require("node:worker_threads");
+    NETWORK_DENIED = "rls-test: network is denied while the runner is active";
+    RlsTimeoutError = class extends Error {
+      name = "RlsTimeoutError";
+    };
+    WORKER_SOURCE = `
+const { parentPort, workerData } = require('node:worker_threads');
+const DENIED = ${JSON.stringify(NETWORK_DENIED)};
+globalThis.fetch = async () => { throw new Error(DENIED); };
+const net = require('node:net');
+net.Socket.prototype.connect = function () { throw new Error(DENIED); };
+const { PGlite } = require(workerData.pglitePath);
+const extensions = {};
+for (const [name, path] of Object.entries(workerData.contrib)) {
+  try { const mod = require(path); if (mod[name]) extensions[name] = mod[name]; } catch {}
+}
+let db;
+const reply = (id, result) => parentPort.postMessage({ id, ok: true, result });
+parentPort.on('message', async (m) => {
+  try {
+    if (m.op === 'init') { db = new PGlite({ extensions }); await db.waitReady; return reply(m.id, null); }
+    if (m.op === 'exec') { await db.exec(m.sql); return reply(m.id, null); }
+    if (m.op === 'query') { const r = await db.query(m.sql, m.params); return reply(m.id, { rows: r.rows, affectedRows: r.affectedRows }); }
+    if (m.op === 'close') { await db.close(); return reply(m.id, null); }
+    if (m.op === 'isolation') {
+      let f = 'fetch allowed', s = 'socket allowed';
+      try { await fetch('http://127.0.0.1:9/'); } catch (e) { f = String(e && e.message); }
+      try { net.connect(9, '127.0.0.1'); } catch (e) { s = String(e && e.message); }
+      return reply(m.id, { envKeys: Object.keys(process.env).sort(), fetch: f, socket: s });
+    }
+  } catch (e) {
+    parentPort.postMessage({ id: m.id, ok: false, error: { code: e && typeof e.code === 'string' ? e.code : undefined, message: String((e && e.message) || e) } });
+  }
+});
+`;
+    SqlError = class extends Error {
+      constructor(message, code) {
+        super(message);
+        this.code = code;
+      }
+    };
+    resolveFromCli = (specifier) => (0, import_node_module.createRequire)(__filename).resolve(specifier);
+    defaultPgliteLoader = async () => {
+      const pglitePath = resolveFromCli("@electric-sql/pglite");
+      const contrib = {};
+      for (const name of ["uuid_ossp", "pgcrypto", "citext", "pg_trgm"]) {
+        try {
+          contrib[name] = resolveFromCli(`@electric-sql/pglite/contrib/${name}`);
+        } catch {
+        }
+      }
+      return { create: (options) => createWorkerDatabase({ pglitePath, contrib, ...options }) };
+    };
+  }
+});
+
+// src/rls/rlsRunner.ts
+function sqlError(error) {
+  const e2 = error;
+  return { code: typeof e2?.code === "string" ? e2.code : "unknown", message: firstLine(typeof e2?.message === "string" ? e2.message : String(error)) };
+}
+function isSqlError(error) {
+  return !(error instanceof RlsTimeoutError) && typeof error?.code === "string";
+}
+function displayPath(projectDir, path) {
+  for (const base of [projectDir, process.cwd()]) {
+    const rel = (0, import_node_path32.relative)(base, path);
+    if (rel && !rel.startsWith("..") && !(0, import_node_path32.isAbsolute)(rel)) return rel.split("\\").join("/");
+  }
+  return path;
+}
+async function gitCommit(projectDir, paths) {
+  const run = async (args) => {
+    const call = await safeGitInvocation(projectDir, args);
+    const { stdout } = await (0, import_node_util4.promisify)(import_node_child_process6.execFile)("git", call.args, { cwd: projectDir, env: call.env, windowsHide: true, timeout: 5e3, encoding: "utf8" });
+    return String(stdout);
+  };
+  let sha;
+  try {
+    sha = (await run(["rev-parse", "HEAD"])).trim();
+    if (!/^[0-9a-f]{40}$/.test(sha)) return null;
+  } catch {
+    return null;
+  }
+  let dirty = null;
+  try {
+    dirty = (await run(["status", "--porcelain", "--untracked-files=all", "--", ...paths])).trim().length > 0;
+  } catch {
+    dirty = null;
+  }
+  return { sha, dirty };
+}
+function allowlistedEnv(source) {
+  const allowed = {};
+  for (const key of ENV_ALLOWLIST) if (source[key] !== void 0) allowed[key] = source[key];
+  return allowed;
+}
+async function withIsolation(fn) {
+  const savedEnv = process.env;
+  const savedFetch = globalThis.fetch;
+  const savedConnect = import_node_net.default.Socket.prototype.connect;
+  process.env = allowlistedEnv(savedEnv);
+  globalThis.fetch = (async () => {
+    throw new Error(NETWORK_DENIED);
+  });
+  import_node_net.default.Socket.prototype.connect = function denied() {
+    throw new Error(NETWORK_DENIED);
+  };
+  try {
+    return await fn();
+  } finally {
+    process.env = savedEnv;
+    globalThis.fetch = savedFetch;
+    import_node_net.default.Socket.prototype.connect = savedConnect;
+  }
+}
+function valueCandidates(column, label) {
+  if (column.enumLabels && column.enumLabels.length > 0) return label === "u" ? [...column.enumLabels] : [column.enumLabels[0]];
+  const u2 = label === "u";
+  switch (column.typname) {
+    case "uuid":
+      return [(0, import_node_crypto2.randomUUID)()];
+    case "json":
+    case "jsonb":
+      return u2 ? ['{"vr":"u"}', "{}"] : ["{}"];
+    case "date":
+      return u2 ? ["2002-02-02", "2003-03-03"] : ["2001-01-01"];
+    case "timestamp":
+    case "timestamptz":
+      return u2 ? ["2002-02-02 00:00:00+00", "2003-03-03 00:00:00+00"] : ["2001-01-01 00:00:00+00"];
+    case "time":
+    case "timetz":
+      return u2 ? ["13:00:00", "14:00:00"] : ["12:00:00"];
+    case "interval":
+      return u2 ? ["2 days", "3 days"] : ["1 day"];
+    default:
+      break;
+  }
+  if (column.category === "S") {
+    const values = [`vr-${label} rls-test value`, `vr-${label}`, label];
+    return values.filter((v) => column.maxLength === null || v.length <= column.maxLength);
+  }
+  if (column.category === "N") return NUMBERS[label];
+  if (column.category === "B") return u2 ? ["true", "false"] : ["false"];
+  if (column.category === "A") return u2 ? [] : ["{}"];
+  return [];
+}
+async function describeTable(db, table) {
+  const display = `${table.schema}.${table.name}`;
+  const rel = await db.query(
+    `select c.oid::int as oid, c.relkind::text as kind from pg_class c join pg_namespace n on n.oid = c.relnamespace where n.nspname = $1 and c.relname = $2`,
+    [table.schema, table.name]
+  );
+  if (rel.rows.length === 0) return { reason: `${display} does not exist after the migrations; check the table name in the matrix.` };
+  const kind = String(rel.rows[0].kind);
+  if (kind !== "r" && kind !== "p") return { reason: `${display} is not a plain table (relkind ${kind}); views and other relations are not tested yet.` };
+  const oid = Number(rel.rows[0].oid);
+  const cols = await db.query(
+    `select a.attname::text as name, a.attnotnull as not_null, a.atthasdef as has_default, a.attidentity::text as identity,
+            a.attgenerated::text as generated, t.typname::text as typname, t.typcategory::text as category,
+            format_type(a.atttypid, a.atttypmod) as type,
+            case when t.typname in ('varchar', 'bpchar') and a.atttypmod > 4 then a.atttypmod - 4 end as max_length,
+            (select array_agg(e.enumlabel::text order by e.enumsortorder) from pg_enum e where e.enumtypid = a.atttypid) as enum_labels,
+            exists (select 1 from pg_constraint k where k.conrelid = a.attrelid and k.contype = 'f' and a.attnum = any (k.conkey)) as is_fk,
+            exists (select 1 from pg_index i where i.indrelid = a.attrelid and i.indisprimary and a.attnum = any (i.indkey)) as is_pk,
+            exists (select 1 from pg_index i where i.indrelid = a.attrelid and i.indisunique and i.indnkeyatts = 1 and i.indkey[0] = a.attnum) as is_unique
+       from pg_attribute a join pg_type t on t.oid = a.atttypid
+      where a.attrelid = $1 and a.attnum > 0 and not a.attisdropped
+      order by a.attnum`,
+    [oid]
+  );
+  const unique3 = /* @__PURE__ */ new Set();
+  const columns = cols.rows.map((r) => {
+    if (r.is_unique) unique3.add(String(r.name));
+    return {
+      name: String(r.name),
+      notNull: Boolean(r.not_null),
+      hasDefault: Boolean(r.has_default),
+      identity: String(r.identity ?? ""),
+      generated: String(r.generated ?? ""),
+      typname: String(r.typname),
+      category: String(r.category),
+      type: String(r.type),
+      maxLength: r.max_length === null || r.max_length === void 0 ? null : Number(r.max_length),
+      enumLabels: Array.isArray(r.enum_labels) ? r.enum_labels : null,
+      isFk: Boolean(r.is_fk),
+      isPk: Boolean(r.is_pk)
+    };
+  });
+  const byName = new Map(columns.map((c) => [c.name, c]));
+  const owner = byName.get(table.ownerColumn);
+  if (!owner) return { reason: `${display} has no column ${table.ownerColumn} (the matrix owner column).` };
+  if (owner.typname !== "uuid" && owner.category !== "S") {
+    return { reason: `${display}.${table.ownerColumn} is ${owner.type}; the owner column must hold auth.uid() (uuid or text).` };
+  }
+  const pk = columns.filter((c) => c.isPk);
+  if (pk.length === 0) return { reason: `${display} has no primary key; rls-test targets the owner's row by primary key.` };
+  for (const column of Object.keys(table.seed)) {
+    if (!byName.has(column)) return { reason: `the matrix seeds ${display}.${column}, which does not exist.` };
+  }
+  if (table.updateColumn) {
+    const column = byName.get(table.updateColumn);
+    if (!column) return { reason: `the matrix updateColumn ${display}.${table.updateColumn} does not exist.` };
+    if (valueCandidates(column, "u").length === 0) return { reason: `the test cannot invent a new value for ${display}.${column.name} (${column.type}); pick another updateColumn.` };
+  }
+  const writable = (c) => c.identity === "" && c.generated === "";
+  const required = columns.filter((c) => c.name !== owner.name && c.notNull && !c.hasDefault && writable(c) && !(c.name in table.seed));
+  for (const column of required) {
+    if (column.isFk) return { reason: `${display}.${column.name} is a NOT NULL foreign key the test cannot invent; give it a value under "seed" in the matrix.` };
+    if (valueCandidates(column, "a").length === 0) {
+      return { reason: `${display}.${column.name} (${column.type}) is NOT NULL and the test cannot invent a value; give it one under "seed" in the matrix.` };
+    }
+  }
+  const seedColumns = Object.keys(table.seed);
+  return {
+    shape: {
+      table,
+      oid,
+      qualified: `${quoteIdent2(table.schema)}.${quoteIdent2(table.name)}`,
+      display,
+      columns,
+      pk,
+      owner,
+      ownerUnique: unique3.has(owner.name),
+      ownerInPk: pk.some((c) => c.name === owner.name),
+      insertColumns: [owner.name, ...seedColumns, ...required.map((c) => c.name)],
+      rowValues: (label, ownerId) => [ownerId, ...seedColumns.map((c) => table.seed[c]), ...required.map((c) => valueCandidates(c, label)[0])]
+    }
+  };
+}
+function pkCondition(shape, firstParam) {
+  return `(${shape.pk.map((c) => quoteIdent2(c.name)).join(", ")}) = (${shape.pk.map((_3, i) => `$${firstParam + i}`).join(", ")})`;
+}
+async function privilegesFor(db, shape, role) {
+  const t = (await db.query(
+    `select has_table_privilege($1, $2::oid, 'SELECT') as ts, has_table_privilege($1, $2::oid, 'INSERT') as ti,
+              has_table_privilege($1, $2::oid, 'UPDATE') as tu, has_table_privilege($1, $2::oid, 'DELETE') as td,
+              has_any_column_privilege($1, $2::oid, 'SELECT') as cs, has_any_column_privilege($1, $2::oid, 'INSERT') as ci,
+              has_any_column_privilege($1, $2::oid, 'UPDATE') as cu`,
+    [role, shape.oid]
+  )).rows[0];
+  const cols = await db.query(
+    `select a.attname::text as name, has_column_privilege($1, $2::oid, a.attnum, 'SELECT') as s,
+            has_column_privilege($1, $2::oid, a.attnum, 'INSERT') as i, has_column_privilege($1, $2::oid, a.attnum, 'UPDATE') as u
+       from pg_attribute a where a.attrelid = $2 and a.attnum > 0 and not a.attisdropped`,
+    [role, shape.oid]
+  );
+  return {
+    table: { select: Boolean(t.ts), insert: Boolean(t.ti), update: Boolean(t.tu), delete: Boolean(t.td) },
+    any: { select: Boolean(t.cs), insert: Boolean(t.ci), update: Boolean(t.cu) },
+    column: new Map(cols.rows.map((r) => [String(r.name), { select: Boolean(r.s), insert: Boolean(r.i), update: Boolean(r.u) }]))
+  };
+}
+async function setClaims(db, claims) {
+  await db.query(
+    `select set_config('request.jwt.claims', $1, true), set_config('request.jwt.claim.sub', $2, true), set_config('request.jwt.claim.role', $3, true), set_config('request.jwt.claim.email', $4, true)`,
+    [JSON.stringify(claims), claims.sub ?? "", claims.role ?? "", claims.email ?? ""]
+  );
+}
+async function measure(db, shape, target) {
+  const owner = quoteIdent2(shape.owner.name);
+  const all = (await db.query(
+    `select count(*)::int as n, coalesce(md5(string_agg(row_to_json(t)::text, E'\\n' order by row_to_json(t)::text)), '') as digest,
+              (count(*) filter (where ${owner}::text = $1))::int as owned
+         from ${shape.qualified} t`,
+    [OWNER_ID]
+  )).rows[0];
+  const row = (await db.query(`select row_to_json(t)::text as j, ${owner}::text as o from ${shape.qualified} t where ${pkCondition(shape, 1)}`, target)).rows[0];
+  return {
+    count: Number(all.n),
+    digest: String(all.digest),
+    owned: Number(all.owned),
+    target: row ? String(row.j) : null,
+    targetOwner: row && row.o !== null ? String(row.o) : null
+  };
+}
+async function runStatement(db, shape, target, stmt, session, prep) {
+  await db.exec("begin");
+  try {
+    if (prep) await prep();
+    const before = await measure(db, shape, target);
+    await db.exec("savepoint vr_probe");
+    let identity;
+    if (session) {
+      await db.exec(`set local role ${session.role}`);
+      await setClaims(db, session.claims);
+      const who = (await db.query(`select current_user::text as u, current_setting('is_superuser') as su, (select rolbypassrls from pg_roles where rolname = current_user) as b`)).rows[0];
+      identity = { user: String(who.u), superuser: who.su === "on", bypass: Boolean(who.b) };
+    }
+    const run = { identity };
+    try {
+      const r = await db.query(stmt.sql, stmt.params);
+      run.rows = r.rows;
+      run.affected = r.affectedRows ?? 0;
+    } catch (error) {
+      if (!isSqlError(error)) throw error;
+      run.error = sqlError(error);
+    }
+    if (!run.error && stmt.select) {
+      await db.exec("savepoint vr_count");
+      try {
+        run.visible = Number((await db.query(`select count(*)::int as n from ${shape.qualified}`)).rows[0].n);
+        await db.exec("release savepoint vr_count");
+      } catch (error) {
+        if (!isSqlError(error)) throw error;
+        await db.exec("rollback to savepoint vr_count");
+      }
+    }
+    if (run.error) await db.exec("rollback to savepoint vr_probe");
+    else await db.exec("reset role");
+    const after = await measure(db, shape, target);
+    return { ...run, before, after };
+  } finally {
+    await db.exec("rollback");
+  }
+}
+function writeControl(filtered, changed) {
+  return (run) => {
+    if (run.error) return { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` };
+    if (!changed(run)) {
+      return {
+        ok: false,
+        detail: filtered ? `as the superuser the same statement changed ${plural2(run.affected ?? 0, "row")}, expected 1` : "as the superuser the same statement did not change the owner row"
+      };
+    }
+    return { ok: true, detail: `as the superuser the same statement changed ${plural2(filtered ? run.affected ?? 0 : 1, "row")}` };
+  };
+}
+async function differingValue(db, shape, target, column) {
+  for (const candidate of valueCandidates(column, "u")) {
+    try {
+      const r = await db.query(
+        `select ($${target.length + 1}::${column.type}) is distinct from ${quoteIdent2(column.name)} as d from ${shape.qualified} where ${pkCondition(shape, 1)}`,
+        [...target, candidate]
+      );
+      if (r.rows[0]?.d === true) return candidate;
+    } catch (error) {
+      if (!isSqlError(error)) throw error;
+    }
+  }
+  return void 0;
+}
+async function selectPlans(c) {
+  const { shape, target, privileges } = c;
+  const pkSelectable = shape.pk.every((col) => privileges.column.get(col.name)?.select);
+  const noPrivilege = !privileges.table.select && !privileges.any.select;
+  const privilegeDenied = (run) => isPrivilegeRefusal(run) && noPrivilege ? { verdict: "denied", detail: `refused: ${run.error.message} (42501), no SELECT on any column` } : void 0;
+  if (pkSelectable || noPrivilege) {
+    const pkList = shape.pk.map((col) => `${quoteIdent2(col.name)}::text`).join(", ");
+    return [
+      {
+        stmt: { name: "select", sql: `select ${pkList} from ${shape.qualified} where ${pkCondition(shape, 1)}`, params: target, display: `select the owner's row from ${shape.display} by primary key`, filtered: true, select: "pk" },
+        controlOk: (run) => run.error ? { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` } : run.rows?.length === 1 ? { ok: true, detail: "as the superuser the same statement returned 1 row" } : { ok: false, detail: `as the superuser the same statement returned ${plural2(run.rows?.length ?? 0, "row")}, expected 1` },
+        judge: (run) => {
+          const denied = privilegeDenied(run);
+          if (denied) return denied;
+          if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
+          const sees = run.visible === void 0 ? "" : ` (sees ${run.visible} of ${run.before.count} rows)`;
+          if (run.rows?.length === 1) return { verdict: "allowed", detail: `returned the owner row${sees}` };
+          if (run.rows?.length === 0) return { verdict: "denied", detail: `returned no row${sees}` };
+          return { verdict: "unknown", detail: `returned ${run.rows?.length} rows for one primary key` };
+        }
+      }
+    ];
+  }
+  const granted = shape.columns.filter((col) => privileges.column.get(col.name)?.select);
+  const cols = granted.map((col) => `${quoteIdent2(col.name)}::text as ${quoteIdent2(col.name)}`).join(", ");
+  const all = (await c.db.query(`select ${cols}, (${pkCondition(shape, 1)}) as is_target from ${shape.qualified}`, target)).rows;
+  const key = (row) => JSON.stringify(granted.map((col) => row[col.name] ?? null));
+  const targetRow = all.find((r) => r.is_target === true);
+  const targetKey = targetRow ? key(targetRow) : void 0;
+  const unique3 = targetKey !== void 0 && all.filter((r) => key(r) === targetKey).length === 1;
+  const found = (run) => Boolean(targetKey && run.rows?.some((r) => key(r) === targetKey));
+  const names = granted.map((col) => col.name).join(", ");
+  return [
+    {
+      stmt: { name: "select columns", sql: `select ${cols} from ${shape.qualified}`, params: [], display: `select the granted columns (${names}) of ${shape.display}, no row filter`, filtered: false, select: "columns" },
+      controlOk: (run) => found(run) ? { ok: true, detail: "as the superuser the same statement returned the owner row" } : { ok: false, detail: "as the superuser the same statement did not return the owner row" },
+      judge: (run) => {
+        if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
+        if (!unique3) return { verdict: "unknown", detail: `the granted columns (${names}) do not uniquely identify the owner row` };
+        if (found(run)) return { verdict: "allowed", detail: `read the owner row through the granted columns (${names})` };
+        return { verdict: "denied", detail: `the owner row is not among the rows returned through the granted columns (${names})` };
+      }
+    }
+  ];
+}
+function insertPlans(c) {
+  const { shape, privileges, db } = c;
+  const values = shape.rowValues("i", OWNER_ID);
+  const placeholders = values.map((_3, i) => `$${i + 1}`).join(", ");
+  const noPrivilege = !privileges.table.insert && !privileges.any.insert;
+  const owner = quoteIdent2(shape.owner.name);
+  const prep = shape.ownerUnique ? async () => void await db.query(`delete from ${shape.qualified} where ${owner}::text = $1`, [OWNER_ID]) : void 0;
+  const added = (run) => run.after.owned === run.before.owned + 1 && run.after.count === run.before.count + 1;
+  return [
+    {
+      stmt: {
+        name: "insert",
+        sql: `insert into ${shape.qualified} (${shape.insertColumns.map(quoteIdent2).join(", ")}) values (${placeholders})`,
+        params: values,
+        display: `insert into ${shape.display} a row whose ${shape.owner.name} is the owner`,
+        filtered: true
+      },
+      prep,
+      controlOk: (run) => {
+        if (run.error) return { ok: false, detail: `as the superuser the same statement failed: ${run.error.message} (${run.error.code})` };
+        return added(run) ? { ok: true, detail: "as the superuser the same statement changed 1 row" } : { ok: false, detail: `as the superuser the same statement changed ${plural2(run.affected ?? 0, "row")}, expected 1` };
+      },
+      judge: (run) => {
+        if (isRlsRefusal(run)) return { verdict: "unknown", detail: `refused by WITH CHECK: ${run.error.message} (42501). Only the generated row was tried; other values may allow insertion` };
+        if (isPrivilegeRefusal(run)) {
+          return noPrivilege ? { verdict: "denied", detail: `refused: ${run.error.message} (42501), no INSERT on any column` } : { verdict: "unknown", detail: `refused for missing column privileges (${run.error.message}), but the role can insert some columns` };
+        }
+        if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
+        if (added(run)) return { verdict: "allowed", detail: `1 row added for the owner (${run.before.count} to ${run.after.count} rows)` };
+        if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows added, table unchanged" };
+        return {
+          verdict: "unknown",
+          detail: `reported ${plural2(run.affected ?? 0, "row")}, but the table went from ${run.before.count} to ${run.after.count} rows and the owner's rows from ${run.before.owned} to ${run.after.owned}`
+        };
+      }
+    }
+  ];
+}
+function freeOtherUserSlot(db, shape) {
+  if (!shape.ownerUnique) return void 0;
+  return async () => void await db.query(`delete from ${shape.qualified} where ${quoteIdent2(shape.owner.name)}::text = $1`, [OTHER_USER_ID]);
+}
+function pickUpdateColumn(shape, privileges) {
+  if (shape.table.updateColumn) return shape.columns.find((col) => col.name === shape.table.updateColumn);
+  const candidates = shape.columns.filter(
+    (col) => col.name !== shape.owner.name && !col.isPk && !col.isFk && col.identity === "" && col.generated === "" && col.category !== "A" && valueCandidates(col, "u").length > 0
+  );
+  if (!privileges.any.update) return candidates[0];
+  return candidates.find((col) => privileges.column.get(col.name)?.update);
+}
+async function updatePlans(c) {
+  const { db, shape, target, privileges, actor } = c;
+  const pkSelectable = shape.pk.every((col) => privileges.column.get(col.name)?.select);
+  const noPrivilege = !privileges.table.update && !privileges.any.update;
+  const filtered = pkSelectable || noPrivilege;
+  const where = filtered ? ` where ${pkCondition(shape, 1)}` : "";
+  const baseParams = filtered ? target : [];
+  const ownerUpdatable = Boolean(privileges.column.get(shape.owner.name)?.update) || noPrivilege;
+  const column = pickUpdateColumn(shape, privileges);
+  const value = column ? await differingValue(db, shape, target, column) : void 0;
+  const plans = [];
+  const add = (name, sets, display, noop = false, prep) => {
+    let n = baseParams.length;
+    const assignments = sets.map((s) => `${quoteIdent2(s.column)} = ${s.value === SELF ? quoteIdent2(s.column) : `$${++n}`}`).join(", ");
+    const sql = `update ${shape.qualified} set ${assignments}${where}`;
+    const params = [...baseParams, ...sets.filter((s) => s.value !== SELF).map((s) => s.value)];
+    const changed = (run) => noop ? (run.affected ?? 0) >= 1 && run.after.target !== null : run.after.target !== null && run.after.target !== run.before.target;
+    plans.push({
+      stmt: { name, sql, params, display: `${display}${filtered ? "" : ", no row filter (the role cannot read the primary key)"}`, filtered },
+      prep,
+      controlOk: writeControl(filtered, changed),
+      judge: (run) => {
+        if (isRlsRefusal(run)) return { verdict: "unknown", detail: `refused by WITH CHECK: ${run.error.message}. USING matched the owner row, so this is not a denial` };
+        if (isPrivilegeRefusal(run)) {
+          return noPrivilege ? { verdict: "denied", detail: `refused: ${run.error.message} (42501), no UPDATE on any column` } : { verdict: "unknown", detail: `refused for column privileges (${run.error.message}), but the role can update some columns` };
+        }
+        if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
+        if (changed(run)) return { verdict: "allowed", detail: noop ? "1 row updated (rewrote its own value)" : `${changedRows(filtered ? run.affected : 1)} (${sets.map((s) => s.column).join(" and ")} rewritten)` };
+        if (!filtered) return { verdict: "denied", detail: "the owner row is unchanged" };
+        if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
+        return { verdict: "unknown", detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner row ${run.after.target === null ? "is gone" : "did not change"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change` };
+      }
+    });
+  };
+  if (column && value !== void 0) add("update value", [{ column: column.name, value }], `update ${column.name} on the owner's row in ${shape.display}`);
+  if (actor === "other_user" && ownerUpdatable && !shape.ownerInPk) {
+    const sets = [{ column: shape.owner.name, value: OTHER_USER_ID }];
+    if (column && value !== void 0) sets.push({ column: column.name, value });
+    add(
+      "update claiming the row",
+      sets,
+      `update the owner's row setting ${shape.owner.name} to the other user${column && value !== void 0 ? ` and ${column.name}` : ""}`,
+      false,
+      freeOtherUserSlot(db, shape)
+    );
+  }
+  if (plans.length === 0) {
+    add("update noop", [{ column: shape.owner.name, value: SELF }], `update the owner's row in ${shape.display} (${shape.owner.name} = itself)`, true);
+  }
+  return plans;
+}
+function reassignPlans(c) {
+  const { db, shape, target, privileges, actor } = c;
+  const pkSelectable = shape.pk.every((col) => privileges.column.get(col.name)?.select);
+  const ownerUpdatable = Boolean(privileges.column.get(shape.owner.name)?.update);
+  const noPrivilege = !ownerUpdatable;
+  const filtered = pkSelectable || noPrivilege;
+  const where = filtered ? ` where ${pkCondition(shape, 1)}` : "";
+  const baseParams = filtered ? target : [];
+  const owner = quoteIdent2(shape.owner.name);
+  const moved = (run) => run.after.targetOwner === OTHER_USER_ID;
+  const stmt = {
+    name: "reassign",
+    sql: `update ${shape.qualified} set ${owner} = $${baseParams.length + 1}${where}`,
+    params: [...baseParams, OTHER_USER_ID],
+    display: `set ${shape.owner.name} on the owner's row in ${shape.display} to the other user${filtered ? "" : ", no row filter"}`,
+    filtered
+  };
+  return [
+    {
+      stmt,
+      prep: freeOtherUserSlot(db, shape),
+      controlOk: writeControl(filtered, moved),
+      judge: (run) => {
+        if (isRlsRefusal(run)) return { verdict: "unknown", detail: `refused by WITH CHECK: ${run.error.message} (42501). A transfer combined with other values was not tested, so this may not be about the owner change alone` };
+        if (isPrivilegeRefusal(run)) {
+          return noPrivilege ? { verdict: "denied", detail: `refused: ${run.error.message} (42501), no UPDATE on ${shape.owner.name}` } : { verdict: "unknown", detail: `refused for privileges (${run.error.message}), but the role can update ${shape.owner.name}` };
+        }
+        if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
+        if (moved(run)) return { verdict: "allowed", detail: `the owner row now belongs to the other user` };
+        if (!filtered && run.after.target === run.before.target) return { verdict: "denied", detail: "the owner row is unchanged" };
+        if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
+        return { verdict: "unknown", detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner column did not move` };
+      }
+    }
+  ];
 }
-async function writeCleanupPlan(projectRoot, plan) {
-  const outputDir = (0, import_node_path30.join)(projectRoot, ".viberaven");
-  const outputPath = (0, import_node_path30.join)(outputDir, "context-cleanup.md");
-  await (0, import_promises24.mkdir)(outputDir, { recursive: true });
-  await (0, import_promises24.writeFile)(outputPath, renderCleanupPlan(plan), "utf8");
-  return outputPath;
+function deletePlans(c) {
+  const { shape, target, privileges } = c;
+  const pkSelectable = shape.pk.every((col) => privileges.column.get(col.name)?.select);
+  const noPrivilege = !privileges.table.delete;
+  const filtered = pkSelectable || noPrivilege;
+  const gone = (run) => run.after.target === null && run.before.target !== null;
+  return [
+    {
+      stmt: {
+        name: "delete",
+        sql: `delete from ${shape.qualified}${filtered ? ` where ${pkCondition(shape, 1)}` : ""}`,
+        params: filtered ? target : [],
+        display: `delete the owner's row from ${shape.display}${filtered ? "" : ", no row filter (the role cannot read the primary key)"}`,
+        filtered
+      },
+      controlOk: writeControl(filtered, gone),
+      judge: (run) => {
+        if (isPrivilegeRefusal(run) && noPrivilege) return { verdict: "denied", detail: `refused: ${run.error.message} (42501), no DELETE privilege` };
+        if (run.error) return { verdict: "unknown", detail: `error ${run.error.code}: ${run.error.message}` };
+        if (gone(run)) return { verdict: "allowed", detail: `${filtered ? "1 row deleted" : "deleted"}, the owner row is gone (${run.before.count} to ${run.after.count} rows)` };
+        if (!filtered) return { verdict: "denied", detail: "the owner row is still there" };
+        if ((run.affected ?? 0) === 0 && run.after.digest === run.before.digest) return { verdict: "denied", detail: "0 rows changed, the row is still there and unchanged" };
+        return {
+          verdict: "unknown",
+          detail: `reported ${plural2(run.affected ?? 0, "row")}, but the owner row is ${run.after.target === null ? "gone" : "still there"} and the table ${run.after.digest === run.before.digest ? "did not" : "did"} change`
+        };
+      }
+    }
+  ];
 }
-function categorizeCleanupFile(relativePath, fullPath, file) {
-  if (relativePath.startsWith(".viberaven/") || fullPath.includes("/.viberaven/")) {
-    return "generated-artifact";
-  }
-  if (isCachePath(relativePath)) {
-    return "cache-directory";
+async function runCell(ctx, privilegesByRole, actor, action, expected) {
+  const base = { table: ctx.shape.display, actor, action, expected };
+  if (expected === "skip") return { ...base, outcome: "N/A", observed: { summary: "not tested (skip in the matrix)" }, reason: "The matrix marks this cell skip." };
+  const session = ACTOR_SESSION[actor];
+  if (action === "reassign" && ctx.shape.ownerInPk) {
+    const reason2 = `${ctx.shape.owner.name} is both the owner column and the primary key, so moving a row to another user changes which row it is; reassign is not tested on this table.`;
+    return { ...base, outcome: "Unknown", observed: { summary: "not tested: the owner column is the primary key" }, reason: reason2 };
+  }
+  const c = { ...ctx, actor, privileges: privilegesByRole.get(session.role) };
+  const plans = action === "select" ? await selectPlans(c) : action === "insert" ? insertPlans(c) : action === "update" ? await updatePlans(c) : action === "reassign" ? reassignPlans(c) : deletePlans(c);
+  const records = [];
+  let decisive;
+  let firstRun;
+  for (const plan of plans) {
+    const control = plan.controlOk(await runStatement(ctx.db, ctx.shape, ctx.target, plan.stmt, null, plan.prep));
+    const run = await runStatement(ctx.db, ctx.shape, ctx.target, plan.stmt, session, plan.prep);
+    firstRun = firstRun ?? run;
+    let judged;
+    const id = run.identity;
+    if (!id || id.superuser || id.bypass || id.user !== session.role) {
+      judged = { verdict: "unknown", detail: `the probe ran as ${id?.user} (superuser ${id?.superuser}, BYPASSRLS ${id?.bypass}), so RLS may not have applied` };
+    } else if (!control.ok) {
+      judged = { verdict: "unknown", detail: `positive control failed: ${control.detail}` };
+    } else {
+      judged = plan.judge(run);
+    }
+    const record = { name: plan.stmt.name, statement: plan.stmt.display, verdict: judged.verdict, detail: judged.detail, affectedRows: run.affected, ...run.error ? { error: run.error } : {}, control };
+    records.push(record);
+    if (judged.verdict === "allowed" && !decisive) decisive = { run, record };
+  }
+  let verdict;
+  if (decisive) verdict = "allowed";
+  else if (records.length > 0 && records.every((r2) => r2.verdict === "denied")) verdict = "denied";
+  else verdict = "unknown";
+  const shown = decisive ?? { run: firstRun, record: records.find((r2) => r2.verdict !== "denied") ?? records[0] };
+  const r = shown.run;
+  const observed = {
+    statement: shown.record.statement,
+    role: session.role,
+    currentUser: r.identity?.user,
+    superuser: r.identity?.superuser,
+    bypassRls: r.identity?.bypass,
+    rowsReturned: r.rows && plans[0].stmt.select === "pk" ? r.rows.length : void 0,
+    visibleRows: r.visible,
+    affectedRows: plans[0].stmt.select ? void 0 : r.affected,
+    ...r.error ? { error: r.error } : {},
+    rowCountBefore: r.before.count,
+    rowCountAfter: r.after.count,
+    stateChanged: r.after.digest !== r.before.digest,
+    targetPresentAfter: r.after.target !== null,
+    control: shown.record.control,
+    probes: records,
+    ...action === "insert" && ctx.shape.ownerUnique ? { note: `${ctx.shape.owner.name} allows one row per user, so the owner's existing row was removed inside the rolled-back probe transaction first` } : {},
+    summary: verdict === "unknown" ? records.filter((x2) => x2.verdict !== "denied").map((x2) => x2.detail).join("; ") : shown.record.detail
+  };
+  if (verdict === "unknown") {
+    return { ...base, outcome: "Unknown", observed, reason: `Not settled by the evidence: ${observed.summary}.` };
   }
-  if (relativePath.endsWith(".log") && file.sizeBytes >= LARGE_LOG_BYTES) {
-    return "large-log";
+  const allowed = verdict === "allowed";
+  const want = expected === "allow";
+  const pass = allowed === want;
+  const actorText = actor === "other_user" ? "another signed-in user" : actor === "anon" ? "anon" : "the owner";
+  const reason = pass ? `Expected ${expected}, observed ${allowed ? "allowed" : "denied"}.` : want ? `Expected ${actorText} to be allowed to ${action}, but ${observed.summary}.${action !== "select" && !r.error ? " Postgres reports rows no policy allows as 0 rows, not as an error, so the app sees no failure." : ""}` : `Expected ${actorText} to be denied ${action}, but ${observed.summary}.`;
+  return { ...base, outcome: pass ? "Pass" : "Fail", observed, reason };
+}
+function cellsFor(table) {
+  const out = [];
+  for (const actor of TESTED_ACTORS) {
+    for (const action of MATRIX_ACTIONS) out.push({ actor, action, expected: table.expect[actor][action] });
+    const reassign = table.expect[actor].reassign;
+    if (reassign) out.push({ actor, action: "reassign", expected: reassign });
   }
-  return void 0;
+  return out;
 }
-function isCachePath(path) {
-  return path === ".next/cache" || path.startsWith(".next/cache/") || path === ".turbo" || path.startsWith(".turbo/") || path === ".vite" || path.startsWith(".vite/") || path.includes("/node_modules/.cache/") || path.endsWith("/node_modules/.cache");
+function unknownCells(table, reason, summary) {
+  const display = `${table.schema}.${table.name}`;
+  const cells = cellsFor(table).map(
+    ({ actor, action, expected }) => expected === "skip" ? { table: display, actor, action, expected, outcome: "N/A", observed: { summary: "not tested (skip in the matrix)" }, reason: "The matrix marks this cell skip." } : { table: display, actor, action, expected, outcome: "Unknown", observed: { summary }, reason }
+  );
+  return [...cells, ...serviceRoleCells(table)];
+}
+function serviceRoleCells(table) {
+  if (!table.serviceRoleExcluded) return [];
+  const display = `${table.schema}.${table.name}`;
+  return MATRIX_ACTIONS.map((action) => ({
+    table: display,
+    actor: "service_role",
+    action,
+    expected: "excluded",
+    outcome: "N/A",
+    observed: { summary: "excluded: the service role bypasses RLS by design" },
+    reason: "The matrix excludes the service role."
+  }));
 }
-function reasonForCategory(category) {
-  switch (category) {
-    case "generated-artifact":
-      return "Generated VibeRaven artifact. Keep current scan outputs, but avoid loading old reports into agent context.";
-    case "large-log":
-      return "Large log file that can add token noise. Review it before changing ignore rules or excluding it from agent context.";
-    case "cache-directory":
-      return "Build cache evidence. Do not load it into agent context unless debugging build internals.";
-  }
+function summarise(tables) {
+  const cells = tables.flatMap((t) => t.cells);
+  const count = (o2) => cells.filter((c) => c.outcome === o2).length;
+  const notApplicable = count("N/A");
+  return { pass: count("Pass"), fail: count("Fail"), unknown: count("Unknown"), notApplicable, tested: cells.length - notApplicable, total: cells.length };
 }
-function renderCleanupPlan(plan) {
-  const lines = ["# VibeRaven context cleanup plan", "", plan.warning, ""];
-  if (plan.items.length === 0) {
-    lines.push("No noisy generated artifacts, large logs, or cache directories were found by the conservative scanner.");
+function verdictFor(summary) {
+  if (summary.fail > 0) {
+    return {
+      verdict: `Not ready within tested scope: ${plural2(summary.fail, "cell does", "cells do")} not match the matrix; ${plural2(summary.unknown, "unknown")}.`,
+      exitCode: 1
+    };
   }
-  for (const item4 of plan.items) {
-    lines.push(`- ${item4.path}`);
-    lines.push(`  - Category: ${item4.category}`);
-    lines.push(`  - Action: ${item4.action}`);
-    lines.push(`  - Reason: ${item4.reason}`);
+  if (summary.pass === 0) {
+    return { verdict: `Nothing was observed: ${plural2(summary.unknown, "unknown")}, ${summary.notApplicable} N/A.`, exitCode: 2 };
   }
-  return `${lines.join("\n")}
-`;
+  if (summary.unknown > 0) {
+    return { verdict: `No blockers found within tested scope; ${plural2(summary.unknown, "unknown")}.`, exitCode: 2 };
+  }
+  return { verdict: "No blockers found within tested scope; 0 unknowns. Scenario passed locally.", exitCode: 0 };
 }
-async function walkCleanupFiles(root, dir, result, depth) {
-  if (depth > MAX_WALK_DEPTH) {
-    return;
+async function listMigrations(dir) {
+  try {
+    const entries = await (0, import_promises26.readdir)(dir, { withFileTypes: true });
+    return entries.filter((e2) => e2.isFile() && /\.sql$/i.test(e2.name) && !e2.name.startsWith(".")).map((e2) => e2.name).sort((a, b3) => a < b3 ? -1 : a > b3 ? 1 : 0);
+  } catch {
+    return [];
   }
-  let entries;
+}
+async function runRlsTest(options) {
+  const projectDir = (0, import_node_path32.resolve)(options.projectDir);
+  const matrixPath = (0, import_node_path32.resolve)(projectDir, options.matrixPath ?? DEFAULT_MATRIX_FILE);
+  const migrationsDir = (0, import_node_path32.resolve)(projectDir, options.migrationsDir ?? (0, import_node_path32.join)("supabase", "migrations"));
+  const timeouts = { ...DEFAULT_TIMEOUTS, ...options.timeouts };
+  if ((0, import_node_path32.basename)(matrixPath).toLowerCase().startsWith(".env")) {
+    throw new RlsInputError(`Refusing to read ${(0, import_node_path32.basename)(matrixPath)}: rls-test never reads .env files. Point --matrix at a viberaven.permissions.json.`);
+  }
+  const filesRead = [];
+  let matrixText;
   try {
-    entries = await (0, import_promises24.readdir)(dir, { withFileTypes: true });
+    const info = await (0, import_promises26.stat)(matrixPath);
+    if (!info.isFile()) throw new Error("not a file");
+    matrixText = normalise(await (0, import_promises26.readFile)(matrixPath, "utf8"));
   } catch {
-    return;
+    throw new RlsInputError(
+      `No permissions matrix at ${matrixPath}. Write one by hand (schema: schemas/permissions-matrix.schema.json in the @viberaven/cli package); rls-test never infers it from your policies.`
+    );
   }
-  for (const entry of entries) {
-    if (SKIP_DIRECTORIES.has(entry.name)) {
-      continue;
+  filesRead.push(displayPath(projectDir, matrixPath));
+  const matrix = parsePermissionsMatrix(matrixText);
+  const names = await listMigrations(migrationsDir);
+  const migrationFiles = [];
+  for (const name of names) {
+    const sql = normalise(await (0, import_promises26.readFile)((0, import_node_path32.join)(migrationsDir, name), "utf8"));
+    filesRead.push(displayPath(projectDir, (0, import_node_path32.join)(migrationsDir, name)));
+    migrationFiles.push({ name, sha256: sha256(sql), sql });
+  }
+  const migrationsHash = sha256(migrationFiles.map((f) => `${f.name}\0${f.sha256}`).join("\n"));
+  const commit = await gitCommit(projectDir, [migrationsDir, matrixPath]);
+  const noReassign = matrix.tables.filter((t) => TESTED_ACTORS.every((a) => t.expect[a].reassign === void 0)).map((t) => `${t.schema}.${t.name}`);
+  const result = {
+    label: NON_AUTHORITATIVE_LABEL,
+    experimental: true,
+    tool: options.tool ?? "viberaven rls-test",
+    project: projectDir,
+    commit,
+    engine: { name: "PGlite", available: false },
+    migrations: { dir: displayPath(projectDir, migrationsDir), files: migrationFiles.map(({ name, sha256: hash }) => ({ name, sha256: hash })), hash: migrationsHash, applied: false },
+    matrix: { path: displayPath(projectDir, matrixPath), hash: matrix.hash, defaultGrants: matrix.defaultGrants },
+    filesRead,
+    assumptions: assumptionsFor(matrix.defaultGrants),
+    exclusions: [
+      ...IMITATION_EXCLUSIONS,
+      ...PROBE_EXCLUSIONS,
+      ...noReassign.length > 0 ? [`Ownership transfer (reassign) is not in the matrix for ${noReassign.join(", ")}, so it was not tested.`] : [],
+      ...matrix.tables.some((t) => t.serviceRoleExcluded) ? ["The service role bypasses RLS and is excluded by the matrix."] : []
+    ],
+    roleChecks: [],
+    tables: [],
+    summary: { pass: 0, fail: 0, unknown: 0, notApplicable: 0, tested: 0, total: 0 },
+    verdict: "",
+    exitCode: 2
+  };
+  const finish = () => {
+    result.summary = summarise(result.tables);
+    const { verdict, exitCode } = verdictFor(result.summary);
+    result.verdict = verdict;
+    result.exitCode = exitCode;
+    return result;
+  };
+  const allUnknown = (reason, summary) => {
+    result.tables = matrix.tables.map((t) => ({ name: `${t.schema}.${t.name}`, unknownReason: reason, cells: unknownCells(t, reason, summary) }));
+    result.roleChecks = result.roleChecks.filter((c) => !c.role.includes(" on "));
+    return finish();
+  };
+  if (migrationFiles.length === 0) {
+    return allUnknown(`No migrations found in ${result.migrations.dir}; there is nothing to test.`, "no migrations");
+  }
+  return withIsolation(async () => {
+    let db;
+    let engineLoaded = false;
+    try {
+      const engine = await (options.loadPglite ?? defaultPgliteLoader)();
+      engineLoaded = true;
+      db = await engine.create({ env: allowlistedEnv(process.env), statementTimeoutMs: timeouts.statementMs });
+    } catch (error) {
+      result.engine.error = firstLine(error instanceof Error ? error.message : String(error));
+      if (engineLoaded) return allUnknown(`PGlite could not start: ${result.engine.error}. Nothing was tested.`, "not run: PGlite startup failed");
+      const missing = error?.code === "MODULE_NOT_FOUND" || error?.code === "ERR_MODULE_NOT_FOUND";
+      return missing ? allUnknown(PGLITE_INSTALL_HINT, "not run: PGlite is not installed") : allUnknown(`PGlite could not load: ${result.engine.error}. Nothing was tested.`, "not run: PGlite loading failed");
     }
-    const absolute = (0, import_node_path30.join)(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (isCachePath(normalizePath5((0, import_node_path30.relative)(root, absolute)))) {
-        result.push({ path: absolute, sizeBytes: 0, kind: "directory" });
-        continue;
+    try {
+      result.engine.available = true;
+      const version = String((await db.query("select version() as v")).rows[0]?.v ?? "");
+      result.engine.postgres = version.match(/PostgreSQL [0-9.]+/)?.[0];
+      result.engine.version = version.match(/PGlite ([0-9.]+)/)?.[1];
+      if (db.isolationReport) result.engine.isolation = await db.isolationReport();
+      await options.onIsolated?.();
+      const me2 = await db.query(`select current_user::text as u, current_setting('is_superuser') as su`);
+      if (me2.rows[0]?.su !== "on") {
+        return allUnknown(`The PGlite session user ${me2.rows[0]?.u} is not a superuser, so migrations and state checks cannot run as intended.`, "harness problem");
       }
-      await walkCleanupFiles(root, absolute, result, depth + 1);
-      continue;
+      await db.exec(imitationSetupSql(matrix.defaultGrants));
+      await db.exec("set search_path to public, extensions");
+      const deadline = Date.now() + timeouts.migrationsMs;
+      for (const file of migrationFiles) {
+        try {
+          const remaining = deadline - Date.now();
+          if (remaining <= 0) throw new RlsTimeoutError(`timed out after ${Math.round(timeouts.migrationsMs / 1e3)} s`);
+          await db.exec(file.sql, { timeoutMs: remaining });
+        } catch (error) {
+          if (error instanceof RlsTimeoutError) {
+            result.migrations.failure = { file: file.name, message: error.message };
+            return allUnknown(
+              `Applying the migrations did not finish within ${Math.round(timeouts.migrationsMs / 1e3)} s (stopped at ${file.name}). PGlite ignores statement_timeout, so the worker was stopped and nothing was tested.`,
+              `not run: migration ${file.name} timed out`
+            );
+          }
+          if (!isSqlError(error)) throw error;
+          const e2 = sqlError(error);
+          result.migrations.failure = { file: file.name, code: e2.code, message: e2.message };
+          return allUnknown(
+            `Migration ${file.name} failed in the PGlite imitation (${e2.code}: ${e2.message}). The imitation cannot model something it needs, so nothing after it was tested.`,
+            `not run: migration ${file.name} failed`
+          );
+        }
+      }
+      result.migrations.applied = true;
+      await db.exec(`reset role; set search_path to public, extensions`);
+      try {
+        await db.exec(seedUsersSql());
+      } catch (error) {
+        if (!isSqlError(error)) throw error;
+        const e2 = sqlError(error);
+        return allUnknown(
+          `Creating the two test users in auth.users failed (${e2.code}: ${e2.message}), probably in a trigger the migrations add. Nothing was tested.`,
+          "not run: test users could not be created"
+        );
+      }
+      const roles = await db.query(`select rolname::text as r, rolsuper as su, rolbypassrls as bypass from pg_roles where rolname in ('anon', 'authenticated') order by rolname`);
+      for (const role of ["anon", "authenticated"]) {
+        const row = roles.rows.find((r) => r.r === role);
+        const ok = Boolean(row) && !row?.su && !row?.bypass;
+        result.roleChecks.push({ role, ok, detail: row ? `superuser ${Boolean(row.su)}, BYPASSRLS ${Boolean(row.bypass)}` : "the role does not exist after the migrations" });
+      }
+      const badRoles = result.roleChecks.filter((c) => !c.ok);
+      for (const table of matrix.tables) {
+        result.tables.push(await runTable(db, table, badRoles, result.roleChecks));
+      }
+      return finish();
+    } catch (error) {
+      if (error instanceof RlsTimeoutError || !isSqlError(error)) {
+        const message = firstLine(error instanceof Error ? error.message : String(error));
+        return allUnknown(
+          error instanceof RlsTimeoutError ? `A statement did not finish within ${Math.round(timeouts.statementMs / 1e3)} s, so the PGlite worker was stopped and no cell is reported as passed.` : `The PGlite worker stopped (${message}), so no cell is reported as passed.`,
+          "not run: the database stopped"
+        );
+      }
+      throw error;
+    } finally {
+      await db.close().catch(() => void 0);
     }
-    if (!entry.isFile()) {
-      continue;
+  });
+}
+async function seedRow(db, shape, label, userId) {
+  const owner = quoteIdent2(shape.owner.name);
+  const pkText = shape.pk.map((c, i) => `${quoteIdent2(c.name)}::text as k${i}`).join(", ");
+  const existing = await db.query(`select ${pkText} from ${shape.qualified} where ${owner}::text = $1 order by 1 limit 1`, [userId]);
+  const keyOf2 = (row) => shape.pk.map((_3, i) => String(row[`k${i}`]));
+  if (existing.rows.length === 1) return { key: keyOf2(existing.rows[0]), reused: true };
+  const values = shape.rowValues(label, userId);
+  const r = await db.query(
+    `insert into ${shape.qualified} (${shape.insertColumns.map(quoteIdent2).join(", ")}) values (${values.map((_3, i) => `$${i + 1}`).join(", ")}) returning ${shape.pk.map((c, i) => `${quoteIdent2(c.name)}::text as k${i}`).join(", ")}`,
+    values
+  );
+  if (r.rows.length !== 1) throw Object.assign(new Error("the insert returned no row (a trigger or rule may drop it)"), { code: "vr000" });
+  return { key: keyOf2(r.rows[0]), reused: false };
+}
+async function runTable(db, table, badRoles, roleChecks) {
+  const display = `${table.schema}.${table.name}`;
+  const unknownTable = (reason, extra = {}) => ({ name: display, ...extra, unknownReason: reason, cells: unknownCells(table, reason, "not run") });
+  if (badRoles.length > 0) {
+    return unknownTable(`Role check failed (${badRoles.map((c) => `${c.role}: ${c.detail}`).join("; ")}), so RLS would not apply to the probes the way it does for the Data API.`);
+  }
+  const described = await describeTable(db, table);
+  if (!described.shape) return unknownTable(described.reason ?? "unknown table problem");
+  const shape = described.shape;
+  const rel = await db.query(
+    `select c.relrowsecurity as enabled, c.relforcerowsecurity as forced, pg_get_userbyid(c.relowner)::text as owner,
+            pg_has_role('anon', c.relowner, 'USAGE') as anon_owner, pg_has_role('authenticated', c.relowner, 'USAGE') as auth_owner
+       from pg_class c where c.oid = $1`,
+    [shape.oid]
+  );
+  const info = rel.rows[0];
+  const rls = { enabled: Boolean(info.enabled), forced: Boolean(info.forced), owner: String(info.owner) };
+  for (const [role, isOwner] of [["anon", info.anon_owner], ["authenticated", info.auth_owner]]) {
+    roleChecks.push({ role: `${role} on ${display}`, ok: !isOwner, detail: isOwner ? `${role} owns ${display} (owner ${rls.owner}), so RLS does not apply to it` : `not the owner (owner ${rls.owner})` });
+  }
+  if (info.anon_owner || info.auth_owner) {
+    return unknownTable(`anon or authenticated owns ${display} (owner ${rls.owner}); table owners skip RLS, so the probes would prove nothing.`, { rls });
+  }
+  let ownerSeed;
+  let otherSeed;
+  try {
+    ownerSeed = await seedRow(db, shape, "a", OWNER_ID);
+    otherSeed = await seedRow(db, shape, "b", OTHER_USER_ID);
+  } catch (error) {
+    if (!isSqlError(error)) throw error;
+    const e2 = sqlError(error);
+    return unknownTable(`Could not seed ${display} (${e2.code}: ${e2.message}).${SEED_HINTS[e2.code] ? ` ${SEED_HINTS[e2.code]}` : ""}`, { rls });
+  }
+  const seeded = await measure(db, shape, ownerSeed.key);
+  if (seeded.target === null || seeded.targetOwner !== OWNER_ID) {
+    return unknownTable(`After seeding, the owner's row in ${display} is not owned by the test owner; a trigger or default may rewrite ${shape.owner.name}.`, { rls });
+  }
+  const privilegesByRole = /* @__PURE__ */ new Map();
+  for (const role of ["anon", "authenticated"]) privilegesByRole.set(role, await privilegesFor(db, shape, role));
+  const cells = [];
+  for (const { actor, action, expected } of cellsFor(table)) {
+    cells.push(await runCell({ db, shape, target: ownerSeed.key }, privilegesByRole, actor, action, expected));
+  }
+  cells.push(...serviceRoleCells(table));
+  const columns = {};
+  shape.insertColumns.forEach((c) => {
+    columns[c] = c === shape.owner.name ? "the test user id" : "generated test value";
+  });
+  for (const c of Object.keys(table.seed)) columns[c] = "from the matrix seed";
+  return {
+    name: display,
+    rls,
+    seed: { rowsBefore: seeded.count, ownerRow: ownerSeed.key.join(","), otherUserRow: otherSeed.key.join(","), reused: { owner: ownerSeed.reused, otherUser: otherSeed.reused }, columns },
+    cells
+  };
+}
+var import_node_child_process6, import_node_crypto2, import_promises26, import_node_net, import_node_path32, import_node_util4, NON_AUTHORITATIVE_LABEL, PGLITE_INSTALL_HINT, ENV_ALLOWLIST, PERMISSION_DENIED, RLS_REFUSAL, DEFAULT_TIMEOUTS, RlsInputError, normalise, quoteIdent2, firstLine, plural2, NUMBERS, ACTOR_SESSION, changedRows, isRlsRefusal, isPrivilegeRefusal, SELF, PROBE_EXCLUSIONS, SEED_HINTS;
+var init_rlsRunner = __esm({
+  "src/rls/rlsRunner.ts"() {
+    "use strict";
+    import_node_child_process6 = require("node:child_process");
+    import_node_crypto2 = require("node:crypto");
+    import_promises26 = require("node:fs/promises");
+    import_node_net = __toESM(require("node:net"));
+    import_node_path32 = require("node:path");
+    import_node_util4 = require("node:util");
+    init_safeGit();
+    init_permissionsMatrix();
+    init_supabaseImitation();
+    init_workerDatabase();
+    NON_AUTHORITATIVE_LABEL = "PGlite imitation of Supabase, non-authoritative. Scenario passed locally does not prove production.";
+    PGLITE_INSTALL_HINT = "PGlite (@electric-sql/pglite) is not installed next to VibeRaven, so nothing was run. It is optional (about 25 MB). Run: npx -y -p viberaven -p @electric-sql/pglite@0.5.8 viberaven rls-test, or add both to the project: npm i -D viberaven @electric-sql/pglite@0.5.8";
+    ENV_ALLOWLIST = ["PATH", "Path", "SystemRoot", "SYSTEMROOT", "windir", "TEMP", "TMP", "TMPDIR", "HOME", "USERPROFILE", "LANG", "LC_ALL", "TZ"];
+    PERMISSION_DENIED = "42501";
+    RLS_REFUSAL = /row-level security/i;
+    DEFAULT_TIMEOUTS = { migrationsMs: 12e4, statementMs: 3e4 };
+    RlsInputError = class extends Error {
+      name = "RlsInputError";
+    };
+    normalise = (text) => text.replace(/\r\n/g, "\n");
+    quoteIdent2 = (name) => `"${name.replace(/"/g, '""')}"`;
+    firstLine = (message) => message.split("\n")[0].trim();
+    plural2 = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+    NUMBERS = { a: ["1001"], b: ["1002"], i: ["1003"], u: ["1004", "7", "1"] };
+    ACTOR_SESSION = {
+      owner: { role: "authenticated", uid: OWNER_ID, claims: { sub: OWNER_ID, role: "authenticated", aud: "authenticated", email: "owner@example.test" } },
+      other_user: { role: "authenticated", uid: OTHER_USER_ID, claims: { sub: OTHER_USER_ID, role: "authenticated", aud: "authenticated", email: "other-user@example.test" } },
+      anon: { role: "anon", uid: null, claims: { role: "anon" } }
+    };
+    changedRows = (n) => `${plural2(n ?? 0, "row")} changed`;
+    isRlsRefusal = (run) => run.error?.code === PERMISSION_DENIED && RLS_REFUSAL.test(run.error.message);
+    isPrivilegeRefusal = (run) => run.error?.code === PERMISSION_DENIED && !RLS_REFUSAL.test(run.error.message);
+    SELF = Symbol("self");
+    PROBE_EXCLUSIONS = [
+      "Policies that look up other tables (teams, organisations, memberships) are only exercised with the rows the migrations create: no membership rows are seeded.",
+      "WITH CHECK expressions are tried with the generated values only; when every value tried is refused, the cell is Unknown, not a pass.",
+      "When a role can use some columns but cannot read the primary key, probes run without a row filter and are judged by the owner row alone.",
+      "When the primary key is readable, writes are filtered by it; unfiltered UPDATE and DELETE statements are not also tested.",
+      "One row per test user is used; a row the migrations create for the user (an auth.users trigger) is reused.",
+      "Side effects of triggers on other tables are not checked."
+    ];
+    SEED_HINTS = {
+      "23502": 'A NOT NULL column has no value: give it one under "seed" in the matrix.',
+      "23503": 'A foreign key points at a row that does not exist: give the column a value under "seed" in the matrix.',
+      "23505": 'A unique constraint clashed with the test row: give the unique column a distinct value under "seed", or check whether a trigger already creates the row.',
+      "23514": 'A CHECK constraint refused the generated values: give the column a valid value under "seed" in the matrix.'
+    };
+  }
+});
+
+// src/rls/render.ts
+function renderRlsText(result) {
+  const lines = [];
+  lines.push(`viberaven rls-test (experimental) \xB7 ${result.project}`);
+  lines.push(NON_AUTHORITATIVE_LABEL);
+  lines.push("");
+  const commit = result.commit ? `${result.commit.sha.slice(0, 12)}${result.commit.dirty === true ? " (migrations or matrix changed since this commit)" : result.commit.dirty === false ? " (migrations and matrix match this commit)" : ""}` : "not a git repository";
+  lines.push(`Commit      ${commit}`);
+  const files = result.migrations.files.map((f) => f.name);
+  lines.push(
+    `Migrations  ${result.migrations.dir}: ${files.length} file${files.length === 1 ? "" : "s"}${files.length > 0 ? ` (${files.slice(0, 4).join(", ")}${files.length > 4 ? ", ..." : ""})` : ""}, sha256 ${result.migrations.hash.slice(0, 16)}, ${result.migrations.applied ? "applied" : result.migrations.failure ? `failed at ${result.migrations.failure.file}` : "not applied"}`
+  );
+  lines.push(`Matrix      ${result.matrix.path}, sha256 ${result.matrix.hash.slice(0, 16)}, defaultGrants ${result.matrix.defaultGrants}`);
+  lines.push(
+    `Engine      ${result.engine.available ? `PGlite ${result.engine.version ?? "?"} (${result.engine.postgres ?? "PostgreSQL ?"}), in memory, network denied` : "PGlite not available"}`
+  );
+  if (result.roleChecks.length > 0) {
+    const bad = result.roleChecks.filter((c) => !c.ok);
+    lines.push(
+      `Roles       ${bad.length === 0 ? "anon and authenticated: not superuser, not BYPASSRLS, not the table owner" : bad.map((c) => `${c.role}: ${c.detail}`).join("; ")}`
+    );
+  }
+  if (!result.engine.available) {
+    lines.push("");
+    if (result.engine.error) lines.push(`(${result.engine.error})`);
+  }
+  for (const table of result.tables) {
+    lines.push("");
+    const rls = table.rls ? `RLS ${table.rls.enabled ? "on" : "off"}${table.rls.forced ? ", forced" : ""}, owner ${table.rls.owner}` : "not inspected";
+    lines.push(`${table.name}  (${rls})`);
+    if (table.seed) {
+      const reused = [table.seed.reused.owner ? "the owner" : "", table.seed.reused.otherUser ? "the other user" : ""].filter(Boolean);
+      lines.push(
+        `  One row for the owner and one for another user (${table.seed.rowsBefore} rows in the table)${reused.length > 0 ? `; reused the rows the migrations created for ${reused.join(" and ")}` : ""}.`
+      );
     }
-    try {
-      const fileStat = await (0, import_promises24.stat)(absolute);
-      result.push({ path: absolute, sizeBytes: fileStat.size, kind: "file" });
-    } catch {
-      continue;
+    if (table.unknownReason) lines.push(`  Unknown: ${table.unknownReason}`);
+    const tested = table.cells.filter((c) => c.actor !== "service_role");
+    const actorWidth = 14;
+    const actionWidth = 10;
+    lines.push(`  ${"actor".padEnd(actorWidth)}${"action".padEnd(actionWidth)}${"expected".padEnd(10)}${"result".padEnd(9)}observed`);
+    for (const cell of tested) {
+      lines.push(`  ${cell.actor.padEnd(actorWidth)}${cell.action.padEnd(actionWidth)}${cell.expected.padEnd(10)}${cell.outcome.padEnd(9)}${cell.observed.summary}`);
     }
+    const service = table.cells.filter((c) => c.actor === "service_role");
+    if (service.length > 0) lines.push(`  ${"service_role".padEnd(actorWidth)}${"all".padEnd(actionWidth)}${"excluded".padEnd(10)}${"N/A".padEnd(9)}bypasses RLS by design, not tested`);
   }
+  const s = result.summary;
+  lines.push("");
+  lines.push(`Result: ${s.pass} Pass, ${s.fail} Fail, ${s.unknown} Unknown, ${s.notApplicable} N/A \xB7 ${s.pass + s.fail} of ${s.tested} tested cells observed (${s.total} cells in the matrix)`);
+  lines.push(result.verdict);
+  const failed = result.tables.flatMap((t) => t.cells).filter((c) => c.outcome === "Fail");
+  for (const cell of failed) {
+    lines.push(`  Fail  ${cell.actor} ${cell.action} on ${cell.table}: ${cell.reason}`);
+  }
+  const unknown = result.tables.flatMap((t) => t.cells).filter((c) => c.outcome === "Unknown");
+  const unknownReasons = [...new Set(unknown.map((c) => c.reason))];
+  for (const reason of unknownReasons.slice(0, 5)) lines.push(`  Unknown  ${reason}`);
+  if (unknownReasons.length > 5) lines.push(`  Unknown  and ${unknownReasons.length - 5} more reasons (see --json)`);
+  lines.push("");
+  lines.push("Assumptions:");
+  for (const a of result.assumptions) lines.push(`  - ${a}`);
+  lines.push("Not tested:");
+  for (const e2 of result.exclusions) lines.push(`  - ${e2}`);
+  lines.push("");
+  lines.push(NON_AUTHORITATIVE_LABEL);
+  return lines.join("\n");
 }
-function normalizePath5(path) {
-  return path.replace(/\\/g, "/");
+function renderRlsJson(result) {
+  return `${JSON.stringify(result, null, 2)}
+`;
 }
-var import_promises24, import_node_path30, MAX_WALK_DEPTH, LARGE_LOG_BYTES, SKIP_DIRECTORIES;
-var init_cleanPlan = __esm({
-  "src/commands/cleanPlan.ts"() {
+var init_render2 = __esm({
+  "src/rls/render.ts"() {
     "use strict";
-    import_promises24 = require("node:fs/promises");
-    import_node_path30 = require("node:path");
-    MAX_WALK_DEPTH = 5;
-    LARGE_LOG_BYTES = 8192;
-    SKIP_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
+    init_rlsRunner();
+  }
+});
+
+// src/commands/rlsTest.ts
+async function runRlsTestCommand(input) {
+  const write = input.write ?? ((text) => process.stdout.write(text));
+  const writeError = input.writeError ?? ((text) => process.stderr.write(text));
+  try {
+    const result = await (input.run ?? runRlsTest)({ projectDir: input.cwd, matrixPath: input.matrix, migrationsDir: input.migrations });
+    write(input.json ? renderRlsJson(result) : `${renderRlsText(result)}
+`);
+    return result.exitCode;
+  } catch (error) {
+    const expected = error instanceof MatrixError || error instanceof RlsInputError;
+    const message = expected ? error.message : `rls-test stopped on an unexpected error, so nothing is reported as passed: ${error instanceof Error ? error.message : String(error)}`;
+    if (input.json) {
+      write(
+        `${JSON.stringify(
+          { label: NON_AUTHORITATIVE_LABEL, experimental: true, error: message, ...error instanceof MatrixError ? { problems: error.problems } : {}, exitCode: 2 },
+          null,
+          2
+        )}
+`
+      );
+    } else {
+      writeError(`viberaven rls-test (experimental)
+${NON_AUTHORITATIVE_LABEL}
+
+${message}
+`);
+    }
+    return 2;
+  }
+}
+var init_rlsTest = __esm({
+  "src/commands/rlsTest.ts"() {
+    "use strict";
+    init_permissionsMatrix();
+    init_render2();
+    init_rlsRunner();
   }
 });
 
@@ -18049,15 +19830,17 @@ function buildConnectProviders(providers) {
   }));
 }
 function buildMissionCards(artifact, providers) {
-  const blockers = artifact.gaps.slice(0, 6).map((gap) => ({
+  const blockers = artifact.gaps.map((gap) => ({
     id: gap.id,
     title: gap.title,
     detail: gap.detail || void 0,
     severity: gap.severity,
     category: blockerCategoryLabel(gap),
-    tone: blockerTone(gap.severity)
+    tone: blockerTone(gap.severity),
+    prompt: gap.copyPrompt || void 0,
+    requiresUserAction: gapRequiresUserAction(gap)
   }));
-  const planSteps = artifact.gaps.slice(0, 8).map((gap) => ({
+  const planSteps = artifact.gaps.map((gap) => ({
     id: gap.id,
     title: gap.title,
     category: planStepCategoryLabel(gap),
@@ -18076,7 +19859,7 @@ function buildMissionCards(artifact, providers) {
   };
 }
 function projectNameFromPath(pathValue) {
-  return (0, import_node_path31.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
+  return (0, import_node_path33.basename)(pathValue.replace(/[\\/]$/, "")) || "current repo";
 }
 function gapSearchText(gap) {
   return [
@@ -18495,19 +20278,19 @@ function mapArtifactToLocalUiState(artifact, presentProviderIds) {
     selectedProviderId: selectedProvider.id,
     currentPrompt: selectedProvider.nextFix?.prompt ?? "",
     artifacts: {
-      tasklist: (0, import_node_path31.join)(".viberaven", "agent-tasklist.md"),
-      contextMap: (0, import_node_path31.join)(".viberaven", "context-map.json"),
-      gateResult: (0, import_node_path31.join)(".viberaven", "gate-result.json"),
-      lastScan: (0, import_node_path31.join)(".viberaven", "last-scan.json")
+      tasklist: (0, import_node_path33.join)(".viberaven", "agent-tasklist.md"),
+      contextMap: (0, import_node_path33.join)(".viberaven", "context-map.json"),
+      gateResult: (0, import_node_path33.join)(".viberaven", "gate-result.json"),
+      lastScan: (0, import_node_path33.join)(".viberaven", "last-scan.json")
     },
     empty: false
   };
 }
-var import_node_path31, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
+var import_node_path33, CONNECT_PROVIDER_PRIORITY, providerDashboardUrls, providerHints, PROVIDER_OWNED_GAP;
 var init_artifactAdapter = __esm({
   "src/local-ui/artifactAdapter.ts"() {
     "use strict";
-    import_node_path31 = require("node:path");
+    import_node_path33 = require("node:path");
     init_providerLogos();
     init_prompts();
     init_providerLaunchPaths();
@@ -18549,19 +20332,20 @@ function escapeJsonForHtml(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c");
 }
 function renderStackHtml(state) {
-  const title = "VibeRaven";
+  const title = `VibeRaven | ${state.project?.name ? `Studio for ${state.project.name}` : "Studio"}`;
   return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <meta name="theme-color" content="#0a0a0a" />
+    <meta name="theme-color" content="#0a0a0b" />
     <meta name="color-scheme" content="dark" />
     <title>${title.replace(/</g, "&lt;")}</title>
     <link rel="icon" type="image/png" href="/manga/favicon.png?v=stack1" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&family=Instrument+Serif&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
+    <!-- Same faces as viberaven.dev. Offline, the Studio falls back to the system sans and mono. -->
+    <link href="https://fonts.googleapis.com/css2?family=Schibsted+Grotesk:wght@400..700&family=IBM+Plex+Mono:wght@400;600&display=swap" rel="stylesheet" />
     <link rel="stylesheet" href="/stack/app.css" />
   </head>
   <body>
@@ -18808,27 +20592,39 @@ var init_planLimits = __esm({
 // src/hosted/credentials.ts
 function defaultConfigDir(env = process.env, platform = process.platform) {
   const override = env.VIBERAVEN_CONFIG_DIR?.trim();
-  if (override) return (0, import_node_path32.resolve)(override);
+  if (override) return (0, import_node_path34.resolve)(override);
   if (platform === "win32") {
-    return (0, import_node_path32.join)(env.APPDATA?.trim() || (0, import_node_path32.join)((0, import_node_os.homedir)(), "AppData", "Roaming"), "viberaven");
+    return (0, import_node_path34.join)(env.APPDATA?.trim() || (0, import_node_path34.join)((0, import_node_os.homedir)(), "AppData", "Roaming"), "viberaven");
   }
   if (platform === "darwin") {
-    return (0, import_node_path32.join)((0, import_node_os.homedir)(), "Library", "Application Support", "viberaven");
+    return (0, import_node_path34.join)((0, import_node_os.homedir)(), "Library", "Application Support", "viberaven");
   }
-  return (0, import_node_path32.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path32.join)((0, import_node_os.homedir)(), ".config"), "viberaven");
+  return (0, import_node_path34.join)(env.XDG_CONFIG_HOME?.trim() || (0, import_node_path34.join)((0, import_node_os.homedir)(), ".config"), "viberaven");
 }
 function isInside(child, parent) {
-  const rel = (0, import_node_path32.relative)((0, import_node_path32.resolve)(parent), (0, import_node_path32.resolve)(child));
-  return rel === "" || !rel.startsWith("..") && !(0, import_node_path32.isAbsolute)(rel);
+  const rel = (0, import_node_path34.relative)((0, import_node_path34.resolve)(parent), (0, import_node_path34.resolve)(child));
+  return rel === "" || !rel.startsWith("..") && !(0, import_node_path34.isAbsolute)(rel);
+}
+async function retryTransient(work) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      return await work();
+    } catch (error) {
+      const code = error?.code;
+      if (attempt >= FS_ATTEMPTS || !code || !TRANSIENT_FS_CODES.has(code)) throw error;
+      await new Promise((resolveWait) => setTimeout(resolveWait, FS_BACKOFF_MS * attempt));
+    }
+  }
 }
-var import_node_child_process6, import_promises25, import_node_os, import_node_path32, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, CredentialStore;
+var import_node_child_process7, import_node_crypto3, import_promises27, import_node_os, import_node_path34, CREDENTIALS_FILE_NAME, CredentialLocationError, CredentialPermissionError, restrictWithIcacls, TRANSIENT_FS_CODES, FS_ATTEMPTS, FS_BACKOFF_MS, CredentialStore;
 var init_credentials = __esm({
   "src/hosted/credentials.ts"() {
     "use strict";
-    import_node_child_process6 = require("node:child_process");
-    import_promises25 = require("node:fs/promises");
+    import_node_child_process7 = require("node:child_process");
+    import_node_crypto3 = require("node:crypto");
+    import_promises27 = require("node:fs/promises");
     import_node_os = require("node:os");
-    import_node_path32 = require("node:path");
+    import_node_path34 = require("node:path");
     CREDENTIALS_FILE_NAME = "credentials.json";
     CredentialLocationError = class extends Error {
     };
@@ -18842,25 +20638,32 @@ var init_credentials = __esm({
       const name = (0, import_node_os.userInfo)().username;
       const user = process.env.USERDOMAIN ? `${process.env.USERDOMAIN}\\${name}` : name;
       return new Promise((resolveRestrict, reject) => {
-        (0, import_node_child_process6.execFile)("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`], { windowsHide: true, timeout: 1e4 }, (error) => {
+        (0, import_node_child_process7.execFile)("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`], { windowsHide: true, timeout: 1e4 }, (error) => {
           if (error) reject(error);
           else resolveRestrict();
         });
       });
     };
+    TRANSIENT_FS_CODES = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY"]);
+    FS_ATTEMPTS = 8;
+    FS_BACKOFF_MS = 10;
     CredentialStore = class {
       constructor(configDir, workspacePath, options = {}) {
         this.configDir = configDir;
         this.workspacePath = workspacePath;
-        this.path = (0, import_node_path32.join)(configDir, CREDENTIALS_FILE_NAME);
+        this.path = (0, import_node_path34.join)(configDir, CREDENTIALS_FILE_NAME);
         this.restrict = options.restrict !== void 0 ? options.restrict : process.platform === "win32" ? restrictWithIcacls : null;
+        this.fs = { readFile: (path, encoding) => (0, import_promises27.readFile)(path, encoding), rename: (from, to) => (0, import_promises27.rename)(from, to), rm: (path) => (0, import_promises27.rm)(path, { force: true }), ...options.fs };
       }
       path;
       restrict;
+      fs;
+      /** Every change to the file runs one at a time, in the order it was asked for. */
+      queue = Promise.resolve();
       async read() {
         let raw;
         try {
-          raw = await (0, import_promises25.readFile)(this.path, "utf8");
+          raw = await retryTransient(() => this.fs.readFile(this.path, "utf8"));
         } catch {
           return null;
         }
@@ -18878,22 +20681,36 @@ var init_credentials = __esm({
         const stored = await this.read();
         return stored && stored.apiBaseUrl === apiBaseUrl ? stored : null;
       }
-      async write(credentials) {
+      /** Resolves once every change queued so far has landed (or failed). */
+      idle() {
+        return this.queue;
+      }
+      serial(work) {
+        const run = this.queue.then(work, work);
+        this.queue = run.then(() => void 0, () => void 0);
+        return run;
+      }
+      write(credentials) {
+        return this.serial(async () => {
+          await this.writeNow({ version: 1, ...credentials, savedAt: (/* @__PURE__ */ new Date()).toISOString() });
+        });
+      }
+      /** Must run inside `serial`. Returns false when `guard` stopped the swap and the file was left alone. */
+      async writeNow(body, guard) {
         if (isInside(this.configDir, this.workspacePath)) {
           throw new CredentialLocationError(
             `Refusing to store the VibeRaven sign-in inside this project (${this.configDir}). Set VIBERAVEN_CONFIG_DIR to a folder outside the repo.`
           );
         }
-        await (0, import_promises25.mkdir)(this.configDir, { recursive: true, mode: 448 });
-        const body = { version: 1, ...credentials, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
-        const temp = `${this.path}.${process.pid}.tmp`;
-        await (0, import_promises25.writeFile)(temp, `${JSON.stringify(body, null, 2)}
+        await (0, import_promises27.mkdir)(this.configDir, { recursive: true, mode: 448 });
+        const temp = `${this.path}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
+        await (0, import_promises27.writeFile)(temp, `${JSON.stringify(body, null, 2)}
 `, { encoding: "utf8", mode: 384 });
-        await (0, import_promises25.chmod)(temp, 384).catch(() => void 0);
+        await (0, import_promises27.chmod)(temp, 384).catch(() => void 0);
         try {
           if (this.restrict) await this.restrict(temp);
         } catch (error) {
-          await (0, import_promises25.rm)(temp, { force: true });
+          await (0, import_promises27.rm)(temp, { force: true });
           const code = error?.code;
           const toolMissing = code === "ENOENT";
           throw new CredentialPermissionError(
@@ -18901,22 +20718,53 @@ var init_credentials = __esm({
             toolMissing
           );
         }
+        if (guard) {
+          const onDisk = await this.readFor(guard.apiBaseUrl);
+          if (onDisk?.accessToken !== guard.accessToken || guard.isCurrent && !guard.isCurrent()) {
+            await (0, import_promises27.rm)(temp, { force: true });
+            return false;
+          }
+        }
         try {
-          await (0, import_promises25.rename)(temp, this.path);
+          await retryTransient(() => this.fs.rename(temp, this.path));
         } catch (error) {
-          await (0, import_promises25.rm)(temp, { force: true });
+          await (0, import_promises27.rm)(temp, { force: true });
           throw error;
         }
-        await (0, import_promises25.chmod)(this.path, 384).catch(() => void 0);
+        await (0, import_promises27.chmod)(this.path, 384).catch(() => void 0);
+        return true;
       }
       /** Keeps the stored plan label in step with what the API last said. */
-      async updatePlan(apiBaseUrl, plan) {
-        const stored = await this.readFor(apiBaseUrl);
-        if (!stored || stored.account.plan === plan) return;
-        await this.write({ apiBaseUrl: stored.apiBaseUrl, accessToken: stored.accessToken, account: { ...stored.account, plan } });
+      updatePlan(apiBaseUrl, plan) {
+        return this.serial(async () => {
+          const stored = await this.readFor(apiBaseUrl);
+          if (!stored || stored.account.plan === plan) return;
+          await this.writeNow(
+            { version: 1, apiBaseUrl: stored.apiBaseUrl, accessToken: stored.accessToken, account: { ...stored.account, plan }, savedAt: (/* @__PURE__ */ new Date()).toISOString() },
+            { apiBaseUrl: stored.apiBaseUrl, accessToken: stored.accessToken }
+          );
+        });
       }
-      async clear() {
-        await (0, import_promises25.rm)(this.path, { force: true });
+      /**
+       * Replaces the saved account label with what the API holds now. Only touches the file while it
+       * still holds the sign-in `accessToken` belongs to and `isCurrent()` still says yes, so a
+       * sign-out or a new sign-in made while the API was answering is never overwritten. `savedAt`
+       * is the sign-in time and is kept.
+       */
+      updateAccount(apiBaseUrl, accessToken, account, isCurrent) {
+        return this.serial(async () => {
+          const stored = await this.readFor(apiBaseUrl);
+          if (!stored || stored.accessToken !== accessToken) return;
+          if (stored.account.email === account.email && stored.account.plan === account.plan) return;
+          if (isCurrent && !isCurrent()) return;
+          await this.writeNow(
+            { version: 1, apiBaseUrl: stored.apiBaseUrl, accessToken, account: { ...stored.account, ...account }, savedAt: stored.savedAt },
+            { apiBaseUrl: stored.apiBaseUrl, accessToken, isCurrent }
+          );
+        });
+      }
+      clear() {
+        return this.serial(() => retryTransient(() => this.fs.rm(this.path)));
       }
     };
   }
@@ -18942,17 +20790,22 @@ function assertHttpBaseUrl(baseUrl) {
   }
 }
 async function postJson(url, payload, options) {
+  return requestJson(url, { ...options, method: "POST", body: JSON.stringify(payload === void 0 ? {} : payload) });
+}
+async function getJson(url, options) {
+  return requestJson(url, { ...options, method: "GET" });
+}
+async function requestJson(url, options) {
   let response;
   try {
     response = await fetch(url, {
-      method: "POST",
+      method: options.method,
       headers: {
-        "Content-Type": "application/json",
+        ...options.body !== void 0 ? { "Content-Type": "application/json" } : {},
         ...options.headers ?? {},
         ...options.accessToken ? { Authorization: `Bearer ${options.accessToken}` } : {}
       },
-      // The Node API rejects `Content-Type: application/json` with an empty body.
-      body: JSON.stringify(payload === void 0 ? {} : payload),
+      body: options.body,
       // Never follow a redirect with the sign-in token and the project attached.
       redirect: "error",
       signal: AbortSignal.timeout(options.timeoutMs)
@@ -19029,6 +20882,13 @@ async function runHostedCheck(baseUrl, accessToken, payload, timeoutMs, idempote
   }
   return response;
 }
+async function fetchAccount(baseUrl, accessToken, timeoutMs) {
+  const payload = await getJson(`${normalizeBaseUrl(baseUrl)}/v1/account/me`, { accessToken, timeoutMs, label: "Account check" });
+  if (!isAccount(payload)) {
+    throw new HostedCallError("invalid_response", "Account response did not match the expected shape.");
+  }
+  return { email: payload.email, plan: payload.plan, usage: payload.usage };
+}
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -19053,6 +20913,9 @@ function isUsage(value) {
 function isStationResponse(value) {
   return isRecord4(value) && (value.status === "stable" || value.status === "drifting" || value.status === "chaos") && isNonEmptyString(value.reason) && isNonEmptyString(value.impact) && (value.confidence === "low" || value.confidence === "medium" || value.confidence === "high") && typeof value.output === "string" && isUsage(value.usage);
 }
+function isAccount(value) {
+  return isRecord4(value) && isNonEmptyString(value.email) && (value.plan === "free" || value.plan === "pro") && isUsage(value.usage);
+}
 var DEFAULT_API_BASE_URL, HostedCallError;
 var init_hostedClient = __esm({
   "src/hosted/hostedClient.ts"() {
@@ -19237,7 +21100,7 @@ async function buildHostedCheckPayload(workspacePath) {
   throw new Error("Could not assemble the full check request.");
 }
 function finalizePayload(payload) {
-  const folder = (0, import_node_path33.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
+  const folder = (0, import_node_path35.basename)(payload.workspacePath.split("\\").join("/").replace(/\/+$/, "")) || "project";
   const redacted = redactPayload({ ...payload, workspacePath: folder });
   return { payload: redacted.payload, redactions: redacted.count };
 }
@@ -19268,13 +21131,13 @@ function splitSections(prompt) {
     chars: section.length
   }));
 }
-var import_node_path33, PayloadCaptured;
+var import_node_path35, PayloadCaptured;
 var init_payload = __esm({
   "src/hosted/payload.ts"() {
     "use strict";
     init_fileScanner();
     init_orchestrator();
-    import_node_path33 = require("node:path");
+    import_node_path35 = require("node:path");
     init_config();
     init_redact();
     PayloadCaptured = class extends Error {
@@ -19350,11 +21213,11 @@ function readServerMessage(body) {
     return body.slice(0, 300);
   }
 }
-var import_node_crypto, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK3, FullCheckService;
+var import_node_crypto4, PRICING_URL, FREE_LIMIT_MESSAGE, PREVIEW_TTL_MS, STATUS_TIMEOUT_MS, STATUS_CACHE_MS, MAX_PREVIEWS, TRANSIENT_REASONS, SEVERITY_RANK3, FullCheckService;
 var init_fullCheck = __esm({
   "src/hosted/fullCheck.ts"() {
     "use strict";
-    import_node_crypto = require("node:crypto");
+    import_node_crypto4 = require("node:crypto");
     init_engines();
     init_planLimits();
     init_productionMapLanes();
@@ -19365,6 +21228,8 @@ var init_fullCheck = __esm({
     PRICING_URL = "https://viberaven.dev/pricing";
     FREE_LIMIT_MESSAGE = `You've used your free full checks. Pro gives ${PRO_MONTHLY_STATION_RUNS} a month.`;
     PREVIEW_TTL_MS = 15 * 6e4;
+    STATUS_TIMEOUT_MS = 5e3;
+    STATUS_CACHE_MS = 5e3;
     MAX_PREVIEWS = 5;
     TRANSIENT_REASONS = /* @__PURE__ */ new Set(["network", "timeout", "server", "rate_limited", "busy"]);
     SEVERITY_RANK3 = { critical: 0, warning: 1, info: 2 };
@@ -19372,10 +21237,12 @@ var init_fullCheck = __esm({
       constructor(workspacePath, options = {}) {
         this.workspacePath = workspacePath;
         this.apiBaseUrl = normalizeBaseUrl(options.apiBaseUrl ?? resolveApiBaseUrl());
-        this.store = new CredentialStore(options.configDir ?? defaultConfigDir(), workspacePath, { restrict: options.restrictCredentialsFile });
+        this.store = new CredentialStore(options.configDir ?? defaultConfigDir(), workspacePath, { restrict: options.restrictCredentialsFile, fs: options.credentialsFs });
         this.openUrl = options.openUrl ?? openUrlInBrowser;
         this.requestTimeoutMs = options.requestTimeoutMs ?? 15e3;
         this.runTimeoutMs = options.runTimeoutMs ?? 18e4;
+        this.statusTimeoutMs = options.statusTimeoutMs ?? STATUS_TIMEOUT_MS;
+        this.statusCacheMs = options.statusCacheMs ?? STATUS_CACHE_MS;
         this.buildPayload = options.buildPayload ?? buildHostedCheckPayload;
       }
       apiBaseUrl;
@@ -19383,6 +21250,8 @@ var init_fullCheck = __esm({
       openUrl;
       requestTimeoutMs;
       runTimeoutMs;
+      statusTimeoutMs;
+      statusCacheMs;
       buildPayload;
       pending = null;
       previews = /* @__PURE__ */ new Map();
@@ -19390,16 +21259,54 @@ var init_fullCheck = __esm({
       running = false;
       /** Used only when the token could not be written to disk with owner-only access. */
       sessionCredentials = null;
+      /** The last live plan check, so a burst of `status()` calls asks the API once. */
+      lastCheck = null;
+      checkInFlight = null;
+      /**
+       * Bumped whenever the sign-in or what the API holds may have changed (sign-out, sign-in, a run,
+       * a plan limit). A live check started before the bump is superseded: its answer is not cached,
+       * not shown as live, and not written to the credentials file.
+       */
+      generation = 0;
+      /** The last time the API confirmed the plan, kept when a later check fails. */
+      lastLive = null;
+      /** A saved sign-in this Studio signed out of but could not delete. Ignored until the file changes. */
+      unremovedToken = null;
+      /** Failed sign-out could not identify the disk token; only a new explicit sign-in can trust it again. */
+      ignoreStoredCredentials = false;
       /** The sign-in to use: the saved one, else a session-only one, and only for this API. */
       async credentials() {
+        if (this.sessionCredentials?.apiBaseUrl === this.apiBaseUrl) return this.sessionCredentials;
+        if (this.ignoreStoredCredentials) return null;
         const stored = await this.store.readFor(this.apiBaseUrl);
-        if (stored) return stored;
-        return this.sessionCredentials?.apiBaseUrl === this.apiBaseUrl ? this.sessionCredentials : null;
+        return stored && stored.accessToken !== this.unremovedToken ? stored : null;
       }
+      /**
+       * Signs this Studio out. Never throws: if the saved sign-in cannot be deleted (Windows still
+       * refusing after the retries), this Studio ignores it from now on and it returns false.
+       */
       async clearCredentials() {
         this.sessionCredentials = null;
         this.lastUsage = null;
-        await this.store.clear();
+        this.lastLive = null;
+        this.forgetLiveCheck();
+        const saved = await this.store.readFor(this.apiBaseUrl).catch(() => null);
+        try {
+          await this.store.clear();
+          this.ignoreStoredCredentials = false;
+          return true;
+        } catch (error) {
+          if (saved) this.unremovedToken = saved.accessToken;
+          else this.ignoreStoredCredentials = true;
+          console.warn(`VibeRaven: the saved sign-in at ${this.store.path} could not be removed (${error instanceof Error ? error.message : String(error)}). This Studio treats it as signed out.`);
+          return false;
+        }
+      }
+      /** The next `status()` asks the API again, and any check still in flight is superseded. */
+      forgetLiveCheck() {
+        this.generation += 1;
+        this.lastCheck = null;
+        this.checkInFlight = null;
       }
       /** Keep the plan label in step with what the API last said (upgrade, downgrade, lapse). */
       /**
@@ -19409,6 +21316,8 @@ var init_fullCheck = __esm({
        * failure the old saved sign-in (with its old plan label) is still there.
        */
       async refreshPlan(plan) {
+        this.forgetLiveCheck();
+        if (this.lastLive) this.lastLive = { ...this.lastLive, account: { ...this.lastLive.account, plan } };
         if (this.sessionCredentials) this.sessionCredentials = { ...this.sessionCredentials, account: { ...this.sessionCredentials.account, plan } };
         try {
           await this.store.updatePlan(this.apiBaseUrl, plan);
@@ -19416,19 +21325,87 @@ var init_fullCheck = __esm({
           console.warn(`VibeRaven: could not update the saved plan label to "${plan}"; keeping the saved sign-in as it was. ${error instanceof Error ? error.message : String(error)}`);
         }
       }
+      /**
+       * What the "Run full check" sheet shows. When signed in, the plan and usage come from the API
+       * (`GET /v1/account/me`), not from the label saved at sign-in, so a Pro subscription that is no
+       * longer valid shows as Free. If the API cannot be asked, the saved values are returned with `stale: true`.
+       * A 401 means the sign-in is gone: it is cleared and the status reads signed out.
+       */
       async status() {
+        const before = await this.credentials();
+        const check = before ? await this.liveCheck(before) : null;
         const creds = await this.credentials();
+        const live = creds && typeof check === "object" && check?.accessToken === creds.accessToken ? check : null;
+        const known = creds && this.lastLive?.accessToken === creds.accessToken ? this.lastLive : null;
         const pending = this.pending && Date.parse(this.pending.expiresAt) > Date.now() ? this.pending : null;
         return {
           apiBaseUrl: this.apiBaseUrl,
           usingDefaultApi: this.apiBaseUrl === DEFAULT_API_BASE_URL,
           signedIn: creds !== null,
-          account: creds ? creds.account : null,
-          usage: creds ? this.lastUsage : null,
+          // When stale, the last live answer beats the file: its rewrite may not have landed yet.
+          account: creds ? live?.account ?? known?.account ?? creds.account : null,
+          usage: creds ? live?.usage ?? this.lastUsage : null,
           signIn: pending ? this.signInView(pending) : null,
           credentialsPath: this.store.path,
-          sessionOnly: creds !== null && creds === this.sessionCredentials
+          sessionOnly: creds !== null && creds === this.sessionCredentials,
+          stale: creds !== null && live === null,
+          checkedAt: known?.checkedAt ?? null
+        };
+      }
+      /** One live check per sign-in, shared by concurrent callers and reused for `statusCacheMs`. */
+      liveCheck(creds) {
+        const last = this.lastCheck;
+        if (last && last.accessToken === creds.accessToken && Date.now() - last.at < this.statusCacheMs) return Promise.resolve(last.result);
+        const inFlight = this.checkInFlight;
+        if (inFlight && inFlight.accessToken === creds.accessToken) return inFlight.promise;
+        const generation = this.generation;
+        const entry = {
+          accessToken: creds.accessToken,
+          promise: this.askAccount(creds, generation).then((result) => {
+            if (this.checkInFlight === entry) this.checkInFlight = null;
+            if (this.generation === generation) this.lastCheck = { accessToken: creds.accessToken, at: Date.now(), result };
+            return result;
+          })
         };
+        this.checkInFlight = entry;
+        return entry.promise;
+      }
+      /** Never throws: any failure other than a 401 leaves the saved sign-in as it is. */
+      async askAccount(creds, generation) {
+        try {
+          const answer = await fetchAccount(this.apiBaseUrl, creds.accessToken, this.statusTimeoutMs);
+          const live = {
+            accessToken: creds.accessToken,
+            account: { email: answer.email, plan: answer.plan },
+            usage: toUsage(answer.usage),
+            checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          const current = await this.credentials();
+          if (current?.accessToken !== creds.accessToken) return "unavailable";
+          if (this.generation !== generation) return "unavailable";
+          this.lastLive = live;
+          this.lastUsage = live.usage;
+          this.saveAccount(creds.accessToken, live.account, generation);
+          return live;
+        } catch (error) {
+          if (error instanceof HostedCallError && error.kind === "http" && error.details.status === 401) {
+            const current = await this.credentials().catch(() => null);
+            if (current?.accessToken === creds.accessToken) await this.clearCredentials();
+            return "signed_out";
+          }
+          return "unavailable";
+        }
+      }
+      /**
+       * Fire and forget: `status()` never waits on the file (locking it can take seconds on Windows).
+       * The rewrite is queued behind every other change to the file, skipped if this check has been
+       * superseded by the time it runs, and a failure is logged, never thrown.
+       */
+      saveAccount(accessToken, account, generation) {
+        if (this.sessionCredentials?.accessToken === accessToken) this.sessionCredentials = { ...this.sessionCredentials, account };
+        this.store.updateAccount(this.apiBaseUrl, accessToken, account, () => this.generation === generation).catch((error) => {
+          console.warn(`VibeRaven: could not update the saved plan label to "${account.plan}"; keeping the saved sign-in as it was. ${error instanceof Error ? error.message : String(error)}`);
+        });
       }
       async startSignIn() {
         return this.guard(async () => {
@@ -19466,27 +21443,37 @@ var init_fullCheck = __esm({
           const account = { email: polled.account.email, plan: polled.account.plan };
           this.pending = null;
           this.lastUsage = null;
+          this.lastLive = null;
           this.sessionCredentials = null;
+          this.unremovedToken = null;
+          this.forgetLiveCheck();
           try {
             await this.store.write({ apiBaseUrl: this.apiBaseUrl, accessToken: polled.accessToken, account });
           } catch (error) {
-            if (!(error instanceof CredentialPermissionError)) throw error;
-            await this.store.clear();
+            if (error instanceof CredentialLocationError) throw error;
+            const reason = error instanceof CredentialPermissionError ? error.message : `The sign-in file could not be saved (${error instanceof Error ? error.message : String(error)})`;
+            if (!(error instanceof CredentialPermissionError)) console.warn(`VibeRaven: ${reason}; keeping this sign-in for this Studio session only.`);
+            await this.store.clear().catch(() => void 0);
             this.sessionCredentials = { version: 1, apiBaseUrl: this.apiBaseUrl, accessToken: polled.accessToken, account, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
+            this.ignoreStoredCredentials = false;
             return {
               kind: "signed_in",
               account,
-              notice: `Signed in for this Studio session only. ${error.message}, so it was not saved to disk. You will need to sign in again next time you open the Studio.`
+              notice: `Signed in for this Studio session only. ${reason}, so it was not saved to disk. You will need to sign in again next time you open the Studio.`
             };
           }
+          this.ignoreStoredCredentials = false;
           return { kind: "signed_in", account };
         });
       }
       async signOut() {
         return this.guard(async () => {
           this.pending = null;
-          await this.clearCredentials();
-          return { kind: "signed_out" };
+          if (await this.clearCredentials()) return { kind: "signed_out" };
+          return {
+            kind: "signed_out",
+            notice: `Signed out in this Studio, but the saved sign-in at ${this.store.path} could not be removed. Delete that file, or sign out again once nothing else has it open.`
+          };
         });
       }
       async prepare() {
@@ -19495,8 +21482,8 @@ var init_fullCheck = __esm({
           const built = await this.buildPayload(this.workspacePath);
           const final = finalizePayload(built.payload);
           this.prunePreviews();
-          const id = (0, import_node_crypto.randomUUID)();
-          this.previews.set(id, { payload: final.payload, idempotencyKey: (0, import_node_crypto.randomUUID)(), createdAt: Date.now() });
+          const id = (0, import_node_crypto4.randomUUID)();
+          this.previews.set(id, { payload: final.payload, idempotencyKey: (0, import_node_crypto4.randomUUID)(), createdAt: Date.now() });
           return { kind: "preview", preview: describePayload(id, `${this.apiBaseUrl}/v1/station/run`, final.payload, built.scan, final.redactions) };
         } catch (error) {
           if (error instanceof HostedCallError) return this.fromCallError(error);
@@ -19616,10 +21603,10 @@ async function connectProviderMcp(cwd, providerId) {
   if (!recipe) {
     return { ok: false, message: `No known MCP server for ${providerId} yet. Add one manually to .mcp.json.` };
   }
-  const configPath = (0, import_node_path34.join)(cwd, ".mcp.json");
+  const configPath = (0, import_node_path36.join)(cwd, ".mcp.json");
   let config = {};
   try {
-    const raw = await (0, import_promises26.readFile)(configPath, "utf8");
+    const raw = await (0, import_promises28.readFile)(configPath, "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     if (!isRecord5(parsed) || parsed.mcpServers !== void 0 && !isRecord5(parsed.mcpServers)) {
       return { ok: false, message: "Existing .mcp.json has an unsupported structure. It was left unchanged." };
@@ -19636,7 +21623,7 @@ async function connectProviderMcp(cwd, providerId) {
   }
   servers[providerId] = recipe.entry;
   const next = { ...config, mcpServers: servers };
-  await (0, import_promises26.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
+  await (0, import_promises28.writeFile)(configPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   const suffix = recipe.note ? ` ${recipe.note}` : "";
   return { ok: true, message: `Added ${providerId} MCP server to .mcp.json.${suffix}`, path: ".mcp.json" };
@@ -19648,7 +21635,7 @@ function headerValue(request, name) {
 function tokensMatch(given, expected) {
   const a = Buffer.from(given, "utf8");
   const b3 = Buffer.from(expected, "utf8");
-  return a.length === b3.length && (0, import_node_crypto2.timingSafeEqual)(a, b3);
+  return a.length === b3.length && (0, import_node_crypto5.timingSafeEqual)(a, b3);
 }
 function guardRequest(request, response, pathname, guard) {
   const allowedHosts = [`127.0.0.1:${guard.port}`, `localhost:${guard.port}`];
@@ -19689,7 +21676,7 @@ async function defaultScanRunner(flags, positional) {
 }
 async function readPackageJson(cwd) {
   try {
-    const raw = await (0, import_promises26.readFile)((0, import_node_path34.join)(cwd, "package.json"), "utf8");
+    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, "package.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -19712,7 +21699,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
     if (files.length >= maxFiles) return;
     let entries;
     try {
-      entries = await (0, import_promises26.readdir)(dir, { withFileTypes: true });
+      entries = await (0, import_promises28.readdir)(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -19720,7 +21707,7 @@ async function listProjectFiles(cwd, maxFiles = 1800) {
       if (files.length >= maxFiles) return;
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
-        if (!skipped.has(entry.name)) await walk((0, import_node_path34.join)(dir, entry.name), rel);
+        if (!skipped.has(entry.name)) await walk((0, import_node_path36.join)(dir, entry.name), rel);
         continue;
       }
       if (entry.isFile()) files.push(rel.toLowerCase());
@@ -19739,7 +21726,7 @@ async function readEnvKeys(cwd) {
   const keys = /* @__PURE__ */ new Set();
   for (const name of [".env.example", ".env"]) {
     try {
-      const raw = await (0, import_promises26.readFile)((0, import_node_path34.join)(cwd, name), "utf8");
+      const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, name), "utf8");
       for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith("#")) continue;
@@ -19842,7 +21829,7 @@ function runGit(cwd, args, timeoutMs = 1500) {
 }
 function spawnGit(cwd, args, env, timeoutMs) {
   return new Promise((resolveGit) => {
-    const child = (0, import_node_child_process7.spawn)("git", args, {
+    const child = (0, import_node_child_process8.spawn)("git", args, {
       cwd,
       env,
       windowsHide: true,
@@ -19915,7 +21902,7 @@ function runGitCommand(cwd, args, timeoutMs = 5e3) {
 }
 function spawnGitCommand(cwd, args, env, timeoutMs) {
   return new Promise((resolveCommand) => {
-    const child = (0, import_node_child_process7.spawn)("git", args, {
+    const child = (0, import_node_child_process8.spawn)("git", args, {
       cwd,
       env,
       windowsHide: true,
@@ -20057,7 +22044,7 @@ async function codexModelOptions() {
     { id: "gpt-5.4-mini", label: "GPT-5.4 Mini" }
   ];
   try {
-    const raw = await (0, import_promises26.readFile)((0, import_node_path34.join)((0, import_node_os2.homedir)(), ".codex", "models_cache.json"), "utf8");
+    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)((0, import_node_os2.homedir)(), ".codex", "models_cache.json"), "utf8");
     const parsed = JSON.parse(raw);
     const list = Array.isArray(parsed) ? parsed : parsed.models ?? [];
     const options = list.filter((model) => typeof model?.slug === "string").filter((model) => !/auto-review|reserve/i.test(model.slug)).map((model) => ({ id: model.slug, label: model.display_name?.trim() || model.slug }));
@@ -20081,7 +22068,7 @@ function cliModelDefaults(id) {
 }
 function detectCommand(command, cwd) {
   return new Promise((resolveDetect) => {
-    const child = (0, import_node_child_process7.spawn)(process.platform === "win32" ? "where.exe" : "sh", process.platform === "win32" ? [command] : ["-lc", `command -v ${command}`], {
+    const child = (0, import_node_child_process8.spawn)(process.platform === "win32" ? "where.exe" : "sh", process.platform === "win32" ? [command] : ["-lc", `command -v ${command}`], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"]
@@ -20168,7 +22155,7 @@ function setupCommandFor(cliId, step) {
 function runShellCommand(command, cwd, timeoutMs = 18e4) {
   return new Promise((resolveRun) => {
     const useCmd = process.platform === "win32";
-    const child = (0, import_node_child_process7.spawn)(useCmd ? process.env.ComSpec || "cmd.exe" : "sh", useCmd ? ["/d", "/s", "/c", command] : ["-lc", command], {
+    const child = (0, import_node_child_process8.spawn)(useCmd ? process.env.ComSpec || "cmd.exe" : "sh", useCmd ? ["/d", "/s", "/c", command] : ["-lc", command], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "pipe"]
@@ -20202,7 +22189,7 @@ function openSystemTerminal(command, cwd) {
     const fullCommand = process.platform === "win32" ? `cd /d ${quotedCwd} && ${command}` : `cd ${quotedCwd} && ${command}`;
     let child;
     if (process.platform === "win32") {
-      child = (0, import_node_child_process7.spawn)("cmd.exe", ["/c", "start", "cmd.exe", "/k", fullCommand], {
+      child = (0, import_node_child_process8.spawn)("cmd.exe", ["/c", "start", "cmd.exe", "/k", fullCommand], {
         cwd,
         windowsHide: true,
         stdio: "ignore",
@@ -20210,9 +22197,9 @@ function openSystemTerminal(command, cwd) {
       });
     } else if (process.platform === "darwin") {
       const script = `tell application "Terminal" to do script "${fullCommand.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-      child = (0, import_node_child_process7.spawn)("osascript", ["-e", script], { cwd, windowsHide: true, stdio: "ignore", detached: true });
+      child = (0, import_node_child_process8.spawn)("osascript", ["-e", script], { cwd, windowsHide: true, stdio: "ignore", detached: true });
     } else {
-      child = (0, import_node_child_process7.spawn)("x-terminal-emulator", ["-e", `bash -lc ${JSON.stringify(fullCommand)}`], {
+      child = (0, import_node_child_process8.spawn)("x-terminal-emulator", ["-e", `bash -lc ${JSON.stringify(fullCommand)}`], {
         cwd,
         windowsHide: true,
         stdio: "ignore",
@@ -20260,19 +22247,19 @@ function isPlaceholderProjectName(value) {
 async function readMcpEvidence(cwd) {
   const candidates = MCP_CONFIG_PATHS.map((relativePath) => ({
     source: relativePath.replace(/\\/g, "/"),
-    path: (0, import_node_path34.resolve)(cwd, relativePath)
+    path: (0, import_node_path36.resolve)(cwd, relativePath)
   }));
   const home = process.env.USERPROFILE || process.env.HOME;
   if (home) {
     candidates.push({
       source: "~/.codex/config.toml",
-      path: (0, import_node_path34.resolve)(home, ".codex", "config.toml")
+      path: (0, import_node_path36.resolve)(home, ".codex", "config.toml")
     });
   }
   const evidence = [];
   for (const candidate of candidates) {
     try {
-      const text = await (0, import_promises26.readFile)(candidate.path, "utf8");
+      const text = await (0, import_promises28.readFile)(candidate.path, "utf8");
       if (/mcp/i.test(text)) evidence.push({ source: candidate.source, text });
     } catch {
     }
@@ -20363,7 +22350,7 @@ async function enrichProjectMetadata(state, cwd) {
 async function readState(cwd) {
   let state;
   try {
-    const raw = await (0, import_promises26.readFile)((0, import_node_path34.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
+    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "last-scan.json"), "utf8");
     const packageJson = await readPackageJson(cwd);
     const deps = dependencyNames(packageJson);
     const files = await listProjectFiles(cwd);
@@ -20609,7 +22596,7 @@ function quoteWindowsCmdArg(value) {
 }
 async function whereExe(command, cwd) {
   return new Promise((resolvePath) => {
-    const child = (0, import_node_child_process7.spawn)("where.exe", [command], {
+    const child = (0, import_node_child_process8.spawn)("where.exe", [command], {
       cwd,
       windowsHide: true,
       stdio: ["ignore", "pipe", "ignore"]
@@ -20629,8 +22616,8 @@ async function whereExe(command, cwd) {
   });
 }
 function expandShimPath(value, base) {
-  const relative7 = value.replace(/^%(?:dp0%\\+|~dp0\\*)/i, "");
-  return relative7 === value ? value : (0, import_node_path34.join)(base, ...relative7.split(/[\\/]+/));
+  const relative8 = value.replace(/^%(?:dp0%\\+|~dp0\\*)/i, "");
+  return relative8 === value ? value : (0, import_node_path36.join)(base, ...relative8.split(/[\\/]+/));
 }
 function findShimTarget(lines, pattern, accept = () => true) {
   for (const line of lines) {
@@ -20641,21 +22628,21 @@ function findShimTarget(lines, pattern, accept = () => true) {
 }
 async function resolveWindowsShimTarget(shimPath) {
   try {
-    const content = await (0, import_promises26.readFile)(shimPath, "utf8");
-    const base = (0, import_node_path34.dirname)(shimPath);
+    const content = await (0, import_promises28.readFile)(shimPath, "utf8");
+    const base = (0, import_node_path36.dirname)(shimPath);
     const lines = content.split(/\r?\n/);
     const trailingArgs = (line, after) => [...line.slice(after).split("%*")[0].matchAll(/"([^"]*)"|([^\s"&|<>]+)/g)].map((token) => expandShimPath(token[1] ?? token[2], base)).filter((value) => value.length > 0 && !value.includes("%"));
     const script = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.js)"/i);
     if (script) {
       return {
         command: process.execPath,
-        args: [(0, import_node_path34.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
+        args: [(0, import_node_path36.join)(base, ...script.match[1].split(/[\\/]+/)), ...trailingArgs(script.line, script.match.index + script.match[0].length)]
       };
     }
-    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path34.basename)(target).toLowerCase() !== "node.exe");
+    const binary = findShimTarget(lines, /"%(?:dp0%\\+|~dp0\\*)([^"]+\.exe)"/i, (target) => (0, import_node_path36.basename)(target).toLowerCase() !== "node.exe");
     if (binary) {
       return {
-        command: (0, import_node_path34.join)(base, ...binary.match[1].split(/[\\/]+/)),
+        command: (0, import_node_path36.join)(base, ...binary.match[1].split(/[\\/]+/)),
         args: trailingArgs(binary.line, binary.match.index + binary.match[0].length)
       };
     }
@@ -20676,7 +22663,7 @@ function killProcessTree(pid, fallback) {
     return;
   }
   if (process.platform === "win32") {
-    const killer = (0, import_node_child_process7.spawn)("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
+    const killer = (0, import_node_child_process8.spawn)("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
     killer.once("error", fallback);
     killer.once("close", (code) => {
       if (code !== 0) fallback();
@@ -20701,7 +22688,7 @@ async function runAgentCommand(command, args, cwd, stdin, runId) {
   const spawnCommand = shim?.command ?? (useCmdShim ? process.env.ComSpec || "cmd.exe" : command);
   const spawnArgs = shim ? [...shim.args, ...args] : useCmdShim ? ["/d", "/s", "/c", [command, ...args.map(quoteWindowsCmdArg)].join(" ")] : args;
   return new Promise((resolveRun) => {
-    const child = (0, import_node_child_process7.spawn)(spawnCommand, spawnArgs, {
+    const child = (0, import_node_child_process8.spawn)(spawnCommand, spawnArgs, {
       cwd,
       windowsHide: true,
       // A separate process group lets Stop and timeout terminate descendants on Unix too.
@@ -20780,8 +22767,8 @@ async function writeChatContextArtifact(cwd, request, prompt) {
       "",
       prompt
     ].filter((line) => typeof line === "string");
-    await (0, import_promises26.mkdir)((0, import_node_path34.join)(cwd, ".viberaven"), { recursive: true });
-    await (0, import_promises26.writeFile)((0, import_node_path34.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
+    await (0, import_promises28.mkdir)((0, import_node_path36.join)(cwd, ".viberaven"), { recursive: true });
+    await (0, import_promises28.writeFile)((0, import_node_path36.join)(cwd, ".viberaven", "chat-context.md"), `${lines.join("\n")}
 `, "utf8");
   } catch {
   }
@@ -20801,13 +22788,13 @@ async function runAgentChat(cwd, request) {
   }
   const prompt = await buildAgentChatPrompt(request, cwd);
   await writeChatContextArtifact(cwd, request, prompt);
-  const outputPath = request.cliId === "codex" ? (0, import_node_path34.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
-  if (outputPath) await (0, import_promises26.mkdir)((0, import_node_path34.dirname)(outputPath), { recursive: true });
+  const outputPath = request.cliId === "codex" ? (0, import_node_path36.join)(cwd, ".viberaven", `studio-agent-${Date.now()}-${Math.random().toString(36).slice(2)}.md`) : void 0;
+  if (outputPath) await (0, import_promises28.mkdir)((0, import_node_path36.dirname)(outputPath), { recursive: true });
   const { command, args, stdin } = commandForAgentChat(request, prompt, cwd, outputPath);
   const result = await runAgentCommand(command, args, cwd, stdin, request.runId);
   if (outputPath) {
     try {
-      const finalMessage = (await (0, import_promises26.readFile)(outputPath, "utf8")).trim();
+      const finalMessage = (await (0, import_promises28.readFile)(outputPath, "utf8")).trim();
       if (finalMessage) return { ...result, output: finalMessage };
     } catch {
     }
@@ -20819,8 +22806,8 @@ function firstGapId(state) {
   return state.providers.find((provider2) => provider2.nextFix?.id)?.nextFix?.id;
 }
 async function runLocalAction(cwd, intent) {
-  const artifactDir = (0, import_node_path34.join)(cwd, ".viberaven");
-  await (0, import_promises26.mkdir)(artifactDir, { recursive: true });
+  const artifactDir = (0, import_node_path36.join)(cwd, ".viberaven");
+  await (0, import_promises28.mkdir)(artifactDir, { recursive: true });
   if (intent === "preview_rehearsal") {
     const state2 = await readState(cwd);
     const topProvider = state2.providers[0];
@@ -20861,7 +22848,7 @@ async function runLocalAction(cwd, intent) {
       proof,
       ""
     ].join("\n");
-    await (0, import_promises26.writeFile)((0, import_node_path34.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
+    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "preview-rehearsal.md"), markdown, "utf8");
     return {
       title: "Preview rehearsal ready",
       summary: `${projectName}: ${gateLabel} with ${state2.providers.length} provider beat${state2.providers.length === 1 ? "" : "s"}`,
@@ -20871,7 +22858,7 @@ async function runLocalAction(cwd, intent) {
   if (intent === "audit_vercel_supabase") {
     const auditInput = await collectVercelSupabaseAuditInput(cwd);
     const result2 = buildVercelSupabaseAudit(auditInput);
-    await (0, import_promises26.writeFile)((0, import_node_path34.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
+    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "audit-vercel-supabase.txt"), `${renderVercelSupabaseAudit(result2)}
 `, "utf8");
     return {
       title: result2.status === "pass" ? "Audit passed" : "Audit needs work",
@@ -20899,7 +22886,7 @@ async function runLocalAction(cwd, intent) {
   const mode = intent === "heal_prompt" ? "prompt" : intent === "heal_apply" ? "apply" : "plan";
   const result = await runHealCommand({ cwd, mode, gapId, yes: mode === "apply", noVerify: true });
   if (mode === "apply") {
-    await (0, import_promises26.writeFile)((0, import_node_path34.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
+    await (0, import_promises28.writeFile)((0, import_node_path36.join)(artifactDir, "heal-apply-result.json"), `${JSON.stringify(result, null, 2)}
 `, "utf8");
   }
   return {
@@ -20909,14 +22896,14 @@ async function runLocalAction(cwd, intent) {
   };
 }
 async function sendArtifact(cwd, rel, response, contentType = "text/plain; charset=utf-8") {
-  const absolute = (0, import_node_path34.resolve)(cwd, rel);
-  const root = (0, import_node_path34.resolve)(cwd);
+  const absolute = (0, import_node_path36.resolve)(cwd, rel);
+  const root = (0, import_node_path36.resolve)(cwd);
   if (!absolute.startsWith(root)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const text = await (0, import_promises26.readFile)(absolute, "utf8");
+    const text = await (0, import_promises28.readFile)(absolute, "utf8");
     response.writeHead(200, { "content-type": contentType });
     response.end(text);
   } catch {
@@ -20925,7 +22912,7 @@ async function sendArtifact(cwd, rel, response, contentType = "text/plain; chars
 }
 async function sendReportArtifact(cwd, response) {
   try {
-    const text = await (0, import_promises26.readFile)((0, import_node_path34.join)(cwd, ".viberaven", "report.html"), "utf8");
+    const text = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "report.html"), "utf8");
     response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
     response.end(text);
     return;
@@ -21052,7 +23039,7 @@ async function sendReportArtifact(cwd, response) {
 }
 async function sendExtensionIcon(cwd, response) {
   try {
-    const body = await (0, import_promises26.readFile)((0, import_node_path34.join)(cwd, "media", "extension-icon.png"));
+    const body = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, "media", "extension-icon.png"));
     sendBinary(response, 200, "image/png", body);
   } catch {
     sendText(response, 404, "Icon not found");
@@ -21065,15 +23052,15 @@ async function sendMangaAsset(pathname, response) {
     return;
   }
   const candidates = [
-    (0, import_node_path34.join)(__dirname, "manga", name),
+    (0, import_node_path36.join)(__dirname, "manga", name),
     // installed + dev: <pkg>/dist/manga
-    (0, import_node_path34.join)(__dirname, "..", "assets", "manga", name),
+    (0, import_node_path36.join)(__dirname, "..", "assets", "manga", name),
     // fallback: <pkg>/assets/manga (source)
-    (0, import_node_path34.join)(__dirname, "..", "..", "assets", "manga", name)
+    (0, import_node_path36.join)(__dirname, "..", "..", "assets", "manga", name)
   ];
   for (const candidate of candidates) {
     try {
-      const body = await (0, import_promises26.readFile)(candidate);
+      const body = await (0, import_promises28.readFile)(candidate);
       response.setHeader("cache-control", "no-cache");
       sendBinary(response, 200, contentTypeForAsset(candidate), body);
       return;
@@ -21083,7 +23070,7 @@ async function sendMangaAsset(pathname, response) {
   sendText(response, 404, "Asset not found");
 }
 function contentTypeForAsset(pathname) {
-  switch ((0, import_node_path34.extname)(pathname).toLowerCase()) {
+  switch ((0, import_node_path36.extname)(pathname).toLowerCase()) {
     case ".svg":
       return "image/svg+xml; charset=utf-8";
     case ".png":
@@ -21100,14 +23087,14 @@ function contentTypeForAsset(pathname) {
 }
 async function sendBundledReportAsset(pathname, response) {
   const rel = decodeURIComponent(pathname.replace(/^\/report\//, ""));
-  const assetRoot = (0, import_node_path34.resolve)(getBundledReportAssetsDir());
-  const absolute = (0, import_node_path34.resolve)(assetRoot, rel);
+  const assetRoot = (0, import_node_path36.resolve)(getBundledReportAssetsDir());
+  const absolute = (0, import_node_path36.resolve)(assetRoot, rel);
   if (!absolute.startsWith(assetRoot)) {
     sendText(response, 403, "Forbidden");
     return;
   }
   try {
-    const body = await (0, import_promises26.readFile)(absolute);
+    const body = await (0, import_promises28.readFile)(absolute);
     sendBinary(response, 200, contentTypeForAsset(absolute), body);
   } catch {
     sendText(response, 404, "Asset not found");
@@ -21129,18 +23116,18 @@ async function bundleStackClient(entryPath) {
   return output.text;
 }
 async function sendStackAppJs(response) {
-  const distPath = (0, import_node_path34.join)(__dirname, "stack", "app.js");
+  const distPath = (0, import_node_path36.join)(__dirname, "stack", "app.js");
   try {
-    const body = await (0, import_promises26.readFile)(distPath);
+    const body = await (0, import_promises28.readFile)(distPath);
     response.writeHead(200, { "content-type": "application/javascript; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
     return;
   } catch {
   }
-  const entryPath = (0, import_node_path34.join)(__dirname, "stack", "main.ts");
+  const entryPath = (0, import_node_path36.join)(__dirname, "stack", "main.ts");
   let mtimeMs;
   try {
-    mtimeMs = (await (0, import_promises26.stat)(entryPath)).mtimeMs;
+    mtimeMs = (await (0, import_promises28.stat)(entryPath)).mtimeMs;
   } catch {
     sendText(response, 404, "Stack client entry not found: src/local-ui/stack/main.ts is missing.");
     return;
@@ -21159,7 +23146,7 @@ async function sendStackAppJs(response) {
 }
 async function sendStackAppCss(response) {
   try {
-    const body = await (0, import_promises26.readFile)((0, import_node_path34.join)(__dirname, "stack", "stack.css"));
+    const body = await (0, import_promises28.readFile)((0, import_node_path36.join)(__dirname, "stack", "stack.css"));
     response.writeHead(200, { "content-type": "text/css; charset=utf-8", "cache-control": "no-store" });
     response.end(body);
   } catch {
@@ -21168,7 +23155,7 @@ async function sendStackAppCss(response) {
 }
 async function readProviderVerifyLedger(cwd) {
   try {
-    const raw = await (0, import_promises26.readFile)((0, import_node_path34.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
+    const raw = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "provider-verify.json"), "utf8");
     const parsed = JSON.parse(raw.replace(/^\uFEFF/, ""));
     return isRecord5(parsed) ? parsed : {};
   } catch {
@@ -21178,8 +23165,8 @@ async function readProviderVerifyLedger(cwd) {
 async function writeProviderVerifyEntry(cwd, providerId, entry) {
   const ledger = await readProviderVerifyLedger(cwd);
   ledger[providerId] = entry;
-  await (0, import_promises26.mkdir)((0, import_node_path34.join)(cwd, ".viberaven"), { recursive: true });
-  await (0, import_promises26.writeFile)((0, import_node_path34.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
+  await (0, import_promises28.mkdir)((0, import_node_path36.join)(cwd, ".viberaven"), { recursive: true });
+  await (0, import_promises28.writeFile)((0, import_node_path36.join)(cwd, ".viberaven", "provider-verify.json"), `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
 }
 async function handleRequest(request, response, options) {
@@ -21240,13 +23227,13 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/architecture-map") {
-    const mapPath = (0, import_node_path34.join)(options.cwd, ".viberaven", "architecture-map.md");
-    const markdown = await (0, import_promises26.readFile)(mapPath, "utf8").catch(() => null);
+    const mapPath = (0, import_node_path36.join)(options.cwd, ".viberaven", "architecture-map.md");
+    const markdown = await (0, import_promises28.readFile)(mapPath, "utf8").catch(() => null);
     if (markdown === null) {
       sendJsonStatus(response, 404, { error: "No architecture map yet. Run a scan first (it is written on every scan)." });
       return;
     }
-    const dataRaw = await (0, import_promises26.readFile)((0, import_node_path34.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
+    const dataRaw = await (0, import_promises28.readFile)((0, import_node_path36.join)(options.cwd, ".viberaven", "architecture-map.json"), "utf8").catch(() => null);
     let data = null;
     if (dataRaw) {
       try {
@@ -21255,7 +23242,7 @@ async function handleRequest(request, response, options) {
         data = null;
       }
     }
-    const contextRaw = await (0, import_promises26.readFile)((0, import_node_path34.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
+    const contextRaw = await (0, import_promises28.readFile)((0, import_node_path36.join)(options.cwd, ".viberaven", "context-map.json"), "utf8").catch(() => null);
     let gaps = [];
     if (contextRaw) {
       try {
@@ -21521,35 +23508,35 @@ async function handleRequest(request, response, options) {
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/tasklist") {
-    await sendArtifact(options.cwd, (0, import_node_path34.join)(".viberaven", "agent-tasklist.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "agent-tasklist.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/playbook") {
-    await sendArtifact(options.cwd, (0, import_node_path34.join)(".viberaven", "launch-playbook.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "launch-playbook.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/audit") {
-    await sendArtifact(options.cwd, (0, import_node_path34.join)(".viberaven", "audit-vercel-supabase.txt"), response);
+    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "audit-vercel-supabase.txt"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/cleanup") {
-    await sendArtifact(options.cwd, (0, import_node_path34.join)(".viberaven", "context-cleanup.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "context-cleanup.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/preview") {
-    await sendArtifact(options.cwd, (0, import_node_path34.join)(".viberaven", "preview-rehearsal.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "preview-rehearsal.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-plan") {
-    await sendArtifact(options.cwd, (0, import_node_path34.join)(".viberaven", "heal-plan.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-plan.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-prompt") {
-    await sendArtifact(options.cwd, (0, import_node_path34.join)(".viberaven", "heal-prompt.md"), response);
+    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-prompt.md"), response);
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/heal-apply") {
-    await sendArtifact(options.cwd, (0, import_node_path34.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
+    await sendArtifact(options.cwd, (0, import_node_path36.join)(".viberaven", "heal-apply-result.json"), response, "application/json; charset=utf-8");
     return;
   }
   if (request.method === "GET" && url.pathname === "/api/artifacts/report") {
@@ -21575,12 +23562,12 @@ async function handleRequest(request, response, options) {
   }
   if (request.method === "GET" && url.pathname === "/vendor/anime.umd.min.js") {
     for (const candidate of [
-      (0, import_node_path34.join)(__dirname, "vendor", "anime.umd.min.js"),
-      (0, import_node_path34.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
-      (0, import_node_path34.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
+      (0, import_node_path36.join)(__dirname, "vendor", "anime.umd.min.js"),
+      (0, import_node_path36.join)(__dirname, "..", "assets", "vendor", "anime.umd.min.js"),
+      (0, import_node_path36.join)(__dirname, "..", "..", "assets", "vendor", "anime.umd.min.js")
     ]) {
       try {
-        const body = await (0, import_promises26.readFile)(candidate);
+        const body = await (0, import_promises28.readFile)(candidate);
         response.setHeader("cache-control", "public, max-age=604800, immutable");
         sendBinary(response, 200, "text/javascript; charset=utf-8", body);
         return;
@@ -21797,11 +23784,11 @@ function listen(server, startPort) {
   });
 }
 async function startLocalUiServer(options) {
-  const cwd = (0, import_node_path34.resolve)(options.cwd);
+  const cwd = (0, import_node_path36.resolve)(options.cwd);
   const scanRunner = options.scanRunner ?? defaultScanRunner;
   const autoScan = { state: "idle" };
   const fullCheck = new FullCheckService(cwd, options.fullCheck);
-  const guard = { token: (0, import_node_crypto2.randomBytes)(32).toString("base64url"), port: 0 };
+  const guard = { token: (0, import_node_crypto5.randomBytes)(32).toString("base64url"), port: 0 };
   const server = (0, import_node_http.createServer)((request, response) => {
     const pathname = new URL(request.url ?? "/", "http://127.0.0.1").pathname;
     if (!guardRequest(request, response, pathname, guard)) {
@@ -21814,7 +23801,7 @@ async function startLocalUiServer(options) {
   });
   const port = await listen(server, options.port ?? 4177);
   guard.port = port;
-  const hasArtifact = await (0, import_promises26.readFile)((0, import_node_path34.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
+  const hasArtifact = await (0, import_promises28.readFile)((0, import_node_path36.join)(cwd, ".viberaven", "last-scan.json"), "utf8").then(
     () => true,
     () => false
   );
@@ -21853,16 +23840,16 @@ async function waitForServerShutdown() {
     process.once("SIGTERM", done);
   });
 }
-var import_node_http, import_node_child_process7, import_node_crypto2, import_promises26, import_node_os2, import_node_path34, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
+var import_node_http, import_node_child_process8, import_node_crypto5, import_promises28, import_node_os2, import_node_path36, CLI_AGENT_SETUP, MCP_CONFIG_PATHS, MCP_PROVIDER_NEEDLES, MCP_CONNECT_COMMANDS, MCP_SERVER_RECIPES, STUDIO_TOKEN_HEADER, PROVIDER_IDS, STUDIO_STATUS_ARGS, CLI_AUTH_PROBE, AGENT_RUN_TIMEOUT_MS, activeAgentRuns, stackBundleCache;
 var init_server = __esm({
   "src/local-ui/server.ts"() {
     "use strict";
     import_node_http = require("node:http");
-    import_node_child_process7 = require("node:child_process");
-    import_node_crypto2 = require("node:crypto");
-    import_promises26 = require("node:fs/promises");
+    import_node_child_process8 = require("node:child_process");
+    import_node_crypto5 = require("node:crypto");
+    import_promises28 = require("node:fs/promises");
     import_node_os2 = require("node:os");
-    import_node_path34 = require("node:path");
+    import_node_path36 = require("node:path");
     init_cleanPlan();
     init_audit();
     init_heal();
@@ -21903,8 +23890,8 @@ var init_server = __esm({
     MCP_CONFIG_PATHS = [
       ".mcp.json",
       "mcp.json",
-      (0, import_node_path34.join)(".cursor", "mcp.json"),
-      (0, import_node_path34.join)(".vscode", "mcp.json")
+      (0, import_node_path36.join)(".cursor", "mcp.json"),
+      (0, import_node_path36.join)(".vscode", "mcp.json")
     ];
     MCP_PROVIDER_NEEDLES = {
       supabase: ["supabase", "@supabase/mcp", "mcp-server-supabase"],
@@ -22063,9 +24050,9 @@ var init_nextActionBlock = __esm({
 function defaultMcpConfigPaths() {
   const home = (0, import_node_os3.homedir)();
   return [
-    (0, import_node_path35.join)(home, ".config", "claude", "claude_desktop_config.json"),
-    (0, import_node_path35.join)(home, ".cursor", "mcp.json"),
-    (0, import_node_path35.join)(home, ".gemini", "antigravity", "mcp_config.json")
+    (0, import_node_path37.join)(home, ".config", "claude", "claude_desktop_config.json"),
+    (0, import_node_path37.join)(home, ".cursor", "mcp.json"),
+    (0, import_node_path37.join)(home, ".gemini", "antigravity", "mcp_config.json")
   ];
 }
 function resolveConfigPaths() {
@@ -22142,13 +24129,13 @@ async function verifyProviderGap(options) {
     fallbackCommand: FALLBACK_COMMAND
   };
 }
-var import_node_fs13, import_node_os3, import_node_path35, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
+var import_node_fs13, import_node_os3, import_node_path37, FALLBACK_COMMAND, SUPPORTED_PROVIDERS, configPathsOverride;
 var init_providerMcpBridge = __esm({
   "src/providerMcpBridge.ts"() {
     "use strict";
     import_node_fs13 = require("node:fs");
     import_node_os3 = require("node:os");
-    import_node_path35 = require("node:path");
+    import_node_path37 = require("node:path");
     FALLBACK_COMMAND = "npx -y viberaven audit --vercel-supabase --json";
     SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set(["supabase", "vercel"]);
   }
@@ -22232,6 +24219,13 @@ Usage:
   viberaven audit --vercel-supabase [--json] [path]
                        Local Vercel/Supabase repo evidence audit (RLS, pooler, secrets)
 
+  viberaven clean --plan [path]
+                       Write a non-destructive context cleanup review plan (.viberaven/context-cleanup.md)
+
+  viberaven rls-test [--matrix viberaven.permissions.json] [--migrations dir] [--json] [path]
+                       Experimental: run the Supabase migrations in a PGlite imitation and test who can
+                       read, change and delete rows against your permissions matrix (non-authoritative)
+
 
 
 Agent workflow (Claude Code / Codex / Gemini):
@@ -22352,7 +24346,7 @@ async function cmdProviderVerify(flags, positional) {
   return result.verified ? 0 : 1;
 }
 async function cmdStatus(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -22391,7 +24385,7 @@ async function cmdStatus(flags, positional) {
   return 0;
 }
 async function runScanCommand(flags, positional, options) {
-  const workspacePath = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
+  const workspacePath = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : await resolveWorkspaceRoot(process.cwd());
   if (!options?.deferMachineOutput) {
     console.log(`Scanning ${workspacePath}\u2026 (local, offline)`);
   }
@@ -22418,7 +24412,7 @@ async function runScanCommand(flags, positional, options) {
     printNextActionBlock(block);
     printProviderActionBlock(tasks);
     try {
-      const manifest = JSON.parse(await (0, import_promises27.readFile)(paths.actionsPath, "utf8"));
+      const manifest = JSON.parse(await (0, import_promises29.readFile)(paths.actionsPath, "utf8"));
       console.log(renderActionSurface(manifest, { limit: 5 }).trimEnd());
     } catch (error) {
       console.warn(error instanceof Error ? error.message : String(error));
@@ -22435,7 +24429,7 @@ async function runScanCommand(flags, positional, options) {
   return { exitCode: 0, artifacts: paths };
 }
 async function cmdReport(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
   try {
     const paths = await refreshReportFromDisk(startDir);
     console.log(`Report refreshed: ${paths.reportPath}`);
@@ -22457,7 +24451,7 @@ async function cmdReport(flags, positional) {
   }
 }
 async function cmdPrompt(flags, positional) {
-  const startDir = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd();
+  const startDir = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
   let artifact;
   try {
     artifact = await loadLastArtifact(startDir);
@@ -22554,7 +24548,7 @@ async function main() {
   const wantsJsonl = hasFlag(flags, "jsonl");
   const wantsStrict = hasFlag(flags, "strict");
   if (flags.condense) {
-    const cwd = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd();
+    const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
     const result = await runCondenseCommand({ cwd });
     console.log(`VibeRaven context map refreshed: ${result.contextMapPath}`);
     return 0;
@@ -22574,7 +24568,7 @@ async function main() {
   }
   if (!command && flags.verify === true && typeof flags.action === "string") {
     return runVerifyActionCommand({
-      cwd: positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd(),
+      cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
       actionId: flags.action
     });
   }
@@ -22585,7 +24579,7 @@ async function main() {
       console.error("VibeRaven could not produce machine output because scan artifacts were not written.");
       return 3;
     }
-    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises27.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
+    const gateResult = scanResult.artifacts && (wantsJson || wantsJsonl || wantsStrict) ? JSON.parse(await (0, import_promises29.readFile)(scanResult.artifacts.gateResultPath, "utf8")) : void 0;
     const strictExitCode = wantsStrict && gateResult ? exitCodeForStrictGate(gateResult, { failOnWarnings: flags.strict === "warning" }) : scanResult.exitCode;
     if (wantsJson && gateResult) {
       process.stdout.write(renderGateResultJson(gateResult));
@@ -22607,7 +24601,7 @@ async function main() {
       env: process.env
     });
     if (mode === "local-ui") {
-      const cwd = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
       const handle = await startLocalUiServer({ cwd });
       console.log(`VibeRaven local UI: ${handle.url}`);
       await waitForServerShutdown();
@@ -22627,7 +24621,7 @@ async function main() {
       await runInteractiveSession();
       return 0;
     case "ui": {
-      const cwd = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
       const envPort = Number(process.env.PORT);
       const handle = await startLocalUiServer({ cwd, port: Number.isFinite(envPort) && envPort > 0 ? envPort : void 0 });
       console.log(`VibeRaven local UI: ${handle.url}`);
@@ -22639,12 +24633,12 @@ async function main() {
       return cmdStatus(flags, positional);
     case "check":
       return runCheckCommand({
-        cwd: positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json),
         quiet: Boolean(flags.quiet)
       });
     case "fix": {
-      const fixCwd = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const fixCwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
       const gapId = typeof flags.gap === "string" ? flags.gap : void 0;
       if (!gapId) {
         const artifact = await loadLastArtifact(fixCwd).catch(() => void 0);
@@ -22671,19 +24665,19 @@ async function main() {
     }
     case "actions":
       return runActionsCommand({
-        cwd: positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
         json: Boolean(flags.json)
       });
     case "preview":
       return runPreviewCommand({
-        cwd: positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
         agentMode: flags["agent-mode"] === true,
         json: Boolean(flags.json)
       });
     case "next":
       return runNextCommand({
         json: Boolean(flags.json),
-        cwd: positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "guide": {
       const provider2 = positional[0];
@@ -22717,7 +24711,7 @@ async function main() {
     case "provider-verify":
       return cmdProviderVerify(flags, positional);
     case "init": {
-      const cwd = positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
       const agents = typeof flags.agents === "string" ? flags.agents : void 0;
       return runInitCommand({
         cwd,
@@ -22731,7 +24725,7 @@ async function main() {
         return 1;
       }
       return runDoctorAgentsCommand({
-        cwd: positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd()
+        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd()
       });
     case "validate-npm-package":
       return runValidateNpmPackageCommand({
@@ -22744,7 +24738,27 @@ async function main() {
         return 1;
       }
       return runAuditCommand({
-        cwd: positional[0] ? (0, import_node_path36.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        json: Boolean(flags.json)
+      });
+    case "clean": {
+      if (flags.plan !== true) {
+        console.error("Usage: viberaven clean --plan [path]");
+        return 1;
+      }
+      const cwd = positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd();
+      const plan = buildContextCleanupPlan({ projectRoot: cwd, files: await collectCleanupFiles(cwd) });
+      const outputPath = await writeCleanupPlan(cwd, plan);
+      console.log(`Wrote ${outputPath}
+`);
+      console.log(renderCleanupPlan(plan).trimEnd());
+      return 0;
+    }
+    case "rls-test":
+      return runRlsTestCommand({
+        cwd: positional[0] ? (0, import_node_path38.resolve)(process.cwd(), positional[0]) : process.cwd(),
+        matrix: typeof flags.matrix === "string" ? (0, import_node_path38.resolve)(process.cwd(), flags.matrix) : void 0,
+        migrations: typeof flags.migrations === "string" ? (0, import_node_path38.resolve)(process.cwd(), flags.migrations) : void 0,
         json: Boolean(flags.json)
       });
     default:
@@ -22753,11 +24767,11 @@ async function main() {
       return 1;
   }
 }
-var import_promises27, import_node_path36, STACK_AREAS;
+var import_promises29, import_node_path38, STACK_AREAS;
 var init_cli = __esm({
   "src/cli.ts"() {
-    import_promises27 = require("node:fs/promises");
-    import_node_path36 = require("node:path");
+    import_promises29 = require("node:fs/promises");
+    import_node_path38 = require("node:path");
     init_config();
     init_runScan();
     init_artifacts2();
@@ -22784,10 +24798,12 @@ var init_cli = __esm({
     init_runDoctor();
     init_runValidateNpmPackage();
     init_runAudit();
+    init_cleanPlan();
     init_actions();
     init_verifyAction();
     init_preview();
     init_check();
+    init_rlsTest();
     init_server();
     init_version();
     init_loopState();