glassbox 1.1.0-beta.1 → 1.1.0-beta.2

package/dist/cli.js

@@ -636,14 +636,14 @@ function prefixIssues(path, issues) {
     return iss;
   });
 }
-function unwrapMessage(message) {
-  return typeof message === "string" ? message : message?.message;
+function unwrapMessage(message2) {
+  return typeof message2 === "string" ? message2 : message2?.message;
 }
 function finalizeIssue(iss, ctx, config2) {
-  const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config2.customError?.(iss)) ?? unwrapMessage(config2.localeError?.(iss)) ?? "Invalid input";
+  const message2 = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config2.customError?.(iss)) ?? unwrapMessage(config2.localeError?.(iss)) ?? "Invalid input";
   const { inst: _inst, continue: _continue, input: _input, ...rest } = iss;
   rest.path ?? (rest.path = []);
-  rest.message = message;
+  rest.message = message2;
   if (ctx?.reportInput) {
     rest.input = _input;
   }
@@ -15681,8 +15681,8 @@ function hashArtifacts(repoRoot, artifacts) {
     if (/(^|\/)\.\.(\/|$)/.test(safe)) continue;
     try {
       const abs = join2(repoRoot, safe);
-      const stat = statSync(abs);
-      if (!stat.isFile() || stat.size > ARTIFACT_HASH_MAX_BYTES) continue;
+      const stat4 = statSync(abs);
+      if (!stat4.isFile() || stat4.size > ARTIFACT_HASH_MAX_BYTES) continue;
       out[uri] = createHash("sha256").update(readFileSync2(abs)).digest("hex");
     } catch {
     }
@@ -15815,8 +15815,8 @@ function readArtifactText(repoRoot, uri) {
   if (/(^|\/)\.\.(\/|$)/.test(safe)) return void 0;
   try {
     const abs = join2(repoRoot, safe);
-    const stat = statSync(abs);
-    if (!stat.isFile() || stat.size > ARTIFACT_MAX_BYTES) return void 0;
+    const stat4 = statSync(abs);
+    if (!stat4.isFile() || stat4.size > ARTIFACT_MAX_BYTES) return void 0;
     const buf = readFileSync2(abs);
     if (buf.includes(0)) return void 0;
     if (isLfsPointer(buf)) return void 0;
@@ -16780,38 +16780,2012 @@ var init_ddl = __esm({
   }
 });
 
-// src/db/connection.ts
+// node_modules/pglite-migrate/dist/index.js
+import { stat } from "fs/promises";
+import { mkdir, writeFile } from "fs/promises";
+import { dirname as dirname22, join as join3, resolve as resolve4, sep } from "path";
+import { promisify } from "util";
+import { gunzip as gunzipCb } from "zlib";
+import { createHash as createHash2, randomUUID } from "crypto";
+import { mkdir as mkdir2, readFile as readFile3, rename as rename2, rm as rm2 } from "fs/promises";
+import { homedir, tmpdir } from "os";
+import { join as join4, resolve as resolve22, sep as sep2 } from "path";
+import { cp, readdir, readFile, rename, rm, stat as stat2 } from "fs/promises";
+import { basename as basename2, dirname as dirname5, join as join5 } from "path";
+import { isAbsolute as isAbsolute2 } from "path";
+import { pathToFileURL } from "url";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join22 } from "path";
+import { rename as rename3, rm as rm3 } from "fs/promises";
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function sanitizedTimestamp(override) {
+  return (override ?? (/* @__PURE__ */ new Date()).toISOString()).replace(/:/g, "-");
+}
+function errorCode(err) {
+  if (typeof err !== "object" || err === null) return void 0;
+  const code = err.code;
+  return typeof code === "string" ? code : void 0;
+}
+function knownMajors() {
+  return RELEASES.map((r) => r.postgresMajor);
+}
+function resolveEngine(major) {
+  const release = tryResolveEngine(major);
+  if (release === void 0) throw new UnknownMajorError(major, knownMajors());
+  return release;
+}
+function tryResolveEngine(major) {
+  return RELEASES.find((r) => r.postgresMajor === major);
+}
+function readOctal(header, offset, length) {
+  if ((header[offset] & 128) !== 0) {
+    throw new TarError("Unsupported base-256 numeric field in tar header");
+  }
+  const raw2 = header.subarray(offset, offset + length).toString("latin1").replace(/\0/g, " ").trim();
+  if (raw2 === "") return 0;
+  if (!/^[0-7]+$/.test(raw2)) throw new TarError(`Malformed octal field: ${JSON.stringify(raw2)}`);
+  return Number.parseInt(raw2, 8);
+}
+function readString(header, offset, length) {
+  const raw2 = header.subarray(offset, offset + length);
+  const end = raw2.indexOf(0);
+  return raw2.subarray(0, end === -1 ? raw2.length : end).toString("utf8");
+}
+function isZeroBlock(block) {
+  for (const byte of block) if (byte !== 0) return false;
+  return true;
+}
+function verifyChecksum(header) {
+  const expected = readOctal(header, OFF.checksum, 8);
+  let signed = 0;
+  let unsigned = 0;
+  for (let i = 0; i < BLOCK; i++) {
+    const inChecksumField = i >= OFF.checksum && i < OFF.checksum + 8;
+    const byte = inChecksumField ? 32 : header[i];
+    unsigned += byte;
+    signed += byte > 127 ? byte - 256 : byte;
+  }
+  if (unsigned !== expected && signed !== expected) {
+    throw new TarError(
+      `Tar header checksum mismatch (expected ${expected.toString()}, got ${unsigned.toString()})`
+    );
+  }
+}
+function safeEntryPath(name, stripComponents) {
+  if (name.includes("\0")) throw new TarError(`Tar entry name contains a NUL byte`);
+  if (name.includes("\\")) throw new TarError(`Tar entry name contains a backslash: ${name}`);
+  if (name.startsWith("/") || /^[A-Za-z]:/.test(name)) {
+    throw new TarError(`Absolute path in tar entry: ${name}`);
+  }
+  const parts = name.split("/").filter((p) => p !== "" && p !== ".");
+  if (parts.includes("..")) throw new TarError(`Path traversal in tar entry: ${name}`);
+  const stripped = parts.slice(stripComponents);
+  return stripped.length === 0 ? null : stripped.join("/");
+}
+function paxPath(data) {
+  const text = data.toString("utf8");
+  const match = /(?:^|\n)\d+ path=([^\n]*)\n/.exec(text);
+  return match?.[1];
+}
+async function extractTarGz(gzipped, dest, stripComponents = 0) {
+  const buf = await gunzip(gzipped);
+  const root = resolve4(dest);
+  await mkdir(root, { recursive: true });
+  let offset = 0;
+  let filesWritten = 0;
+  let nextNameOverride;
+  while (offset + BLOCK <= buf.length) {
+    const header = buf.subarray(offset, offset + BLOCK);
+    if (isZeroBlock(header)) break;
+    verifyChecksum(header);
+    const size = readOctal(header, OFF.size, 12);
+    const typeflag = String.fromCharCode(header[OFF.typeflag]);
+    const prefix = readString(header, OFF.prefix, 155);
+    const base = readString(header, OFF.name, 100);
+    const rawName = nextNameOverride ?? (prefix === "" ? base : `${prefix}/${base}`);
+    nextNameOverride = void 0;
+    const dataStart = offset + BLOCK;
+    const dataEnd = dataStart + size;
+    if (dataEnd > buf.length) throw new TarError("Tar entry extends past end of archive");
+    const data = buf.subarray(dataStart, dataEnd);
+    offset = dataStart + Math.ceil(size / BLOCK) * BLOCK;
+    switch (typeflag) {
+      case TYPE.paxNext: {
+        nextNameOverride = paxPath(data);
+        continue;
+      }
+      case TYPE.gnuLongName: {
+        nextNameOverride = data.toString("utf8").replace(/\0+$/, "");
+        continue;
+      }
+      case TYPE.paxGlobal:
+        continue;
+      // global metadata, nothing to write
+      case TYPE.file:
+      case TYPE.fileAlt:
+      case TYPE.contiguous: {
+        const rel = safeEntryPath(rawName, stripComponents);
+        if (rel === null) continue;
+        const full = resolve4(root, rel);
+        if (full !== root && !full.startsWith(root + sep)) {
+          throw new TarError(`Tar entry escapes extraction root: ${rawName}`);
+        }
+        await mkdir(dirname22(full), { recursive: true });
+        await writeFile(full, data);
+        filesWritten++;
+        continue;
+      }
+      case TYPE.directory: {
+        const rel = safeEntryPath(rawName, stripComponents);
+        if (rel === null) continue;
+        const full = resolve4(root, rel);
+        if (full !== root && !full.startsWith(root + sep)) {
+          throw new TarError(`Tar entry escapes extraction root: ${rawName}`);
+        }
+        await mkdir(full, { recursive: true });
+        continue;
+      }
+      default:
+        throw new TarError(
+          `Refusing tar entry of type '${typeflag}' (${rawName}) \u2014 only regular files and directories are extracted`
+        );
+    }
+  }
+  if (filesWritten === 0) throw new TarError(`Archive contained no files under ${join3(dest)}`);
+  return filesWritten;
+}
+function defaultCacheDir(platform = process.platform, env = process.env) {
+  const parts = ["pglite-migrate", "engines"];
+  if (platform === "win32") {
+    const local = env.LOCALAPPDATA ?? join4(homedir(), "AppData", "Local");
+    return join4(local, ...parts);
+  }
+  if (platform === "darwin") {
+    return join4(homedir(), "Library", "Caches", ...parts);
+  }
+  const xdg = env.XDG_CACHE_HOME ?? join4(homedir(), ".cache");
+  return join4(xdg, ...parts);
+}
+function tarballUrl(version2, registryUrl) {
+  const unscoped = PGLITE_PACKAGE.split("/").pop() ?? PGLITE_PACKAGE;
+  return `${registryUrl.replace(/\/+$/, "")}/${PGLITE_PACKAGE}/-/${unscoped}-${version2}.tgz`;
+}
+async function download(url2, version2) {
+  let response;
+  try {
+    response = await fetch(url2);
+  } catch (err) {
+    throw new EngineFetchError(
+      `Could not reach the npm registry to download ${PGLITE_PACKAGE}@${version2} (${url2}). If this machine is offline or behind a proxy, install the engine yourself instead: npm install pglite-old@npm:${PGLITE_PACKAGE}@${version2}`,
+      { cause: err }
+    );
+  }
+  if (!response.ok) {
+    throw new EngineFetchError(
+      `Registry returned ${response.status.toString()} ${response.statusText} for ${url2}`
+    );
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+function verifyIntegrity(bytes, release) {
+  const actual = `sha512-${createHash2("sha512").update(bytes).digest("base64")}`;
+  if (actual !== release.integrity) {
+    throw new IntegrityError(release.integrity, actual, release.version);
+  }
+}
+function manifestEntryCandidates(manifest) {
+  const candidates = [];
+  const dot = manifest.exports?.["."];
+  if (typeof dot === "string") {
+    candidates.push(dot);
+  } else if (dot !== null && typeof dot === "object") {
+    const imp = dot.import;
+    if (typeof imp === "string") candidates.push(imp);
+  }
+  if (typeof manifest.module === "string") candidates.push(manifest.module);
+  if (typeof manifest.main === "string") candidates.push(manifest.main);
+  candidates.push(FALLBACK_ENTRY);
+  return candidates;
+}
+async function resolveEntry(dir) {
+  const root = resolve22(dir);
+  let manifest = {};
+  try {
+    const raw2 = JSON.parse(await readFile3(join4(root, "package.json"), "utf8"));
+    if (raw2 !== null && typeof raw2 === "object") manifest = raw2;
+  } catch {
+  }
+  for (const candidate of manifestEntryCandidates(manifest)) {
+    const full = resolve22(root, candidate);
+    if (full !== root && !full.startsWith(root + sep2)) continue;
+    if (await exists(full)) return full;
+  }
+  throw new EngineFetchError(
+    `Extracted engine at ${root} has no usable module entry point (tried the package manifest and ${FALLBACK_ENTRY})`
+  );
+}
+async function acquireEngine(major, options = {}) {
+  return acquireRelease(resolveEngine(major), options);
+}
+async function acquireRelease(release, options = {}) {
+  const mode = options.cache ?? "keep";
+  const registryUrl = options.registryUrl ?? DEFAULT_REGISTRY;
+  if (mode === "ephemeral") {
+    const parent = options.cacheDir ?? tmpdir();
+    const dir2 = join4(parent, `pglite-migrate-engine-${release.version}-${randomUUID()}`);
+    const bytes2 = await download(tarballUrl(release.version, registryUrl), release.version);
+    verifyIntegrity(bytes2, release);
+    await extractTarGz(bytes2, dir2, 1);
+    return {
+      entry: await resolveEntry(dir2),
+      dir: dir2,
+      release,
+      fromCache: false,
+      cleanup: () => rm2(dir2, { recursive: true, force: true })
+    };
+  }
+  const root = options.cacheDir ?? defaultCacheDir();
+  const dir = join4(root, `pglite-${release.version}`);
+  const noop = () => Promise.resolve();
+  if (await exists(dir)) {
+    return { entry: await resolveEntry(dir), dir, release, fromCache: true, cleanup: noop };
+  }
+  const bytes = await download(tarballUrl(release.version, registryUrl), release.version);
+  verifyIntegrity(bytes, release);
+  await mkdir2(root, { recursive: true });
+  const staging = join4(root, `.staging-${release.version}-${randomUUID()}`);
+  try {
+    await extractTarGz(bytes, staging, 1);
+    try {
+      await rename2(staging, dir);
+    } catch (err) {
+      if (!await exists(dir)) throw err;
+    }
+  } finally {
+    await rm2(staging, { recursive: true, force: true });
+  }
+  return { entry: await resolveEntry(dir), dir, release, fromCache: false, cleanup: noop };
+}
+async function dirStats(dir) {
+  let files = 0;
+  let bytes = 0;
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = join5(dir, entry.name);
+    if (entry.isDirectory()) {
+      const sub = await dirStats(full);
+      files += sub.files;
+      bytes += sub.bytes;
+    } else if (entry.isFile()) {
+      files += 1;
+      bytes += (await stat2(full)).size;
+    }
+  }
+  return { files, bytes };
+}
+async function backupDataDir(dataDir, options = {}) {
+  const timestamp2 = sanitizedTimestamp(options.timestamp);
+  const backupDir = options.backupDir ?? `${dataDir}.bak-${timestamp2}`;
+  const partial2 = `${backupDir}.partial`;
+  if (await exists(backupDir)) {
+    throw new Error(`Backup directory already exists: ${backupDir}`);
+  }
+  await rm(partial2, { recursive: true, force: true });
+  await cp(dataDir, partial2, { recursive: true });
+  await rename(partial2, backupDir);
+  const sourceVersion = await readFile(join5(dataDir, "PG_VERSION"), "utf8").catch(() => null);
+  if (sourceVersion !== null) {
+    const backupVersion = await readFile(join5(backupDir, "PG_VERSION"), "utf8").catch(() => null);
+    if (backupVersion === null || backupVersion.trim() !== sourceVersion.trim()) {
+      throw new Error(`Backup verification failed: PG_VERSION mismatch for ${backupDir}`);
+    }
+  }
+  const src = await dirStats(dataDir);
+  const bak = await dirStats(backupDir);
+  if (src.files !== bak.files || src.bytes !== bak.bytes) {
+    throw new Error(
+      `Backup verification failed: ${backupDir} has ${bak.files.toString()} files/${bak.bytes.toString()} bytes, source has ${src.files.toString()}/${src.bytes.toString()}`
+    );
+  }
+  if (options.keep !== void 0) await pruneBackups(dataDir, backupDir, options.keep);
+  return backupDir;
+}
+async function pruneBackups(dataDir, currentBackup, keep) {
+  const parent = dirname5(dataDir);
+  const prefix = `${basename2(dataDir)}.bak-`;
+  const entries = await readdir(parent);
+  const backups = entries.filter((e) => e.startsWith(prefix) && !e.endsWith(".partial")).sort();
+  const current = basename2(currentBackup);
+  const excess = backups.slice(0, Math.max(0, backups.length - Math.max(0, keep)));
+  for (const name of excess) {
+    if (name === current) continue;
+    await rm(join5(parent, name), { recursive: true, force: true });
+  }
+}
+function quoteIdent(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+function quoteQualified(schema, name) {
+  return `${quoteIdent(schema)}.${quoteIdent(name)}`;
+}
+function quoteLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function tableKey(t) {
+  return `${t.schema}.${t.name}`;
+}
+function objectKey(schema, table, name) {
+  return `${schema}.${table}.${name}`;
+}
+function systemSchemaFilter(alias = "nspname") {
+  return `${alias} NOT IN ('pg_catalog', 'information_schema') AND ${alias} NOT LIKE 'pg_toast%' AND ${alias} NOT LIKE 'pg_temp%'`;
+}
+function regclassLiteral(schema, name) {
+  return quoteLiteral(quoteQualified(schema, name));
+}
+async function tableKeys(db2) {
+  const { rows } = await db2.query(
+    `SELECT n.nspname || '.' || c.relname AS key
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind = 'r' AND ${systemSchemaFilter("n.nspname")}`
+  );
+  return rows.map((r) => r.key);
+}
+async function countRows(db2, qualified) {
+  const { rows } = await db2.query(`SELECT count(*)::text AS n FROM ${qualified}`);
+  if (rows.length === 0) return 0;
+  const raw2 = rows[0].n;
+  const n = Number(raw2);
+  if (!Number.isFinite(n)) throw new Error(`Unparseable row count for ${qualified}: ${raw2}`);
+  return n;
+}
+async function hasRows(db2, qualified) {
+  const { rows } = await db2.query(`SELECT 1 FROM ${qualified} LIMIT 1`);
+  return rows.length > 0;
+}
+async function introspectSchema(db2) {
+  const tables = await introspectTables(db2);
+  const foreignKeys = await introspectForeignKeys(db2);
+  const sequences = await introspectSequences(db2);
+  return { tables, foreignKeys, sequences };
+}
+async function introspectTables(db2) {
+  const { rows } = await db2.query(
+    `SELECT n.nspname AS schema, c.relname AS name
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind = 'r' AND ${systemSchemaFilter("n.nspname")}
+      ORDER BY n.nspname, c.relname`
+  );
+  const tables = [];
+  for (const { schema, name } of rows) {
+    tables.push({ schema, name, columns: await introspectColumns(db2, schema, name) });
+  }
+  return tables;
+}
+async function introspectColumns(db2, schema, table) {
+  const regclass = regclassLiteral(schema, table);
+  const { rows } = await db2.query(
+    `SELECT a.attname AS name,
+            format_type(a.atttypid, a.atttypmod) AS type,
+            a.attgenerated AS generated,
+            a.attidentity AS identity
+       FROM pg_attribute a
+      WHERE a.attrelid = ${regclass}::regclass
+        AND a.attnum > 0 AND NOT a.attisdropped
+      ORDER BY a.attnum`
+  );
+  return rows.map((r) => ({
+    name: r.name,
+    type: r.type,
+    // attgenerated is 's' for STORED generated columns, '' otherwise.
+    generated: r.generated === "s",
+    // attidentity is 'a' (always) / 'd' (by default) / '' (not an identity column).
+    identity: r.identity === "a" ? "always" : r.identity === "d" ? "default" : null
+  }));
+}
+async function introspectForeignKeys(db2) {
+  const { rows } = await db2.query(
+    `SELECT cn.nspname || '.' || cc.relname AS child,
+            pn.nspname || '.' || pc.relname AS parent
+       FROM pg_constraint con
+       JOIN pg_class cc ON cc.oid = con.conrelid
+       JOIN pg_namespace cn ON cn.oid = cc.relnamespace
+       JOIN pg_class pc ON pc.oid = con.confrelid
+       JOIN pg_namespace pn ON pn.oid = pc.relnamespace
+      WHERE con.contype = 'f'
+        AND con.conrelid <> con.confrelid
+        AND ${systemSchemaFilter("cn.nspname")}`
+  );
+  return rows.map((r) => ({ child: r.child, parent: r.parent }));
+}
+async function introspectSequences(db2) {
+  const { rows } = await db2.query(
+    `SELECT schemaname, sequencename, last_value
+       FROM pg_sequences
+      WHERE ${systemSchemaFilter("schemaname")}`
+  );
+  return rows.map((r) => ({
+    schema: r.schemaname,
+    name: r.sequencename,
+    lastValue: r.last_value
+  }));
+}
+async function readClusterVersion(dataDir) {
+  const file2 = join22(dataDir, "PG_VERSION");
+  const raw2 = await readFile2(file2, "utf8");
+  const major = Number.parseInt(raw2.trim(), 10);
+  if (!Number.isInteger(major)) {
+    throw new Error(`Could not parse a major version from ${file2} (got ${JSON.stringify(raw2)})`);
+  }
+  return major;
+}
+function isUnresolvedModule(err, specifier) {
+  if (!(err instanceof Error)) return false;
+  const code = errorCode(err);
+  if (code === void 0 || !UNRESOLVED_CODES.has(code)) return false;
+  return err.message.includes(specifier);
+}
+async function importEngine(modulePath) {
+  const specifier = isAbsolute2(modulePath) ? pathToFileURL(modulePath).href : modulePath;
+  return import(specifier);
+}
+function constructorFrom(mod, modulePath) {
+  const PGlite3 = mod.PGlite;
+  if (typeof PGlite3 !== "function") {
+    throw new Error(`Module ${modulePath} does not export a PGlite constructor`);
+  }
+  return PGlite3;
+}
+function construct(mod, modulePath, dataDir, pgliteOptions) {
+  const Engine = constructorFrom(mod, modulePath);
+  return pgliteOptions === void 0 ? new Engine(dataDir) : new Engine(dataDir, pgliteOptions);
+}
+async function missingEngineError(modulePath, dataDir, cause) {
+  const major = await readClusterVersion(dataDir).catch(() => null);
+  const lines = [`Could not load the PGlite engine "${modulePath}".`];
+  if (major !== null) {
+    lines.push(`${dataDir} is a PostgreSQL ${major.toString()} data directory.`);
+    const pinned = tryResolveEngine(major)?.version ?? null;
+    if (pinned !== null) {
+      lines.push(
+        `Install a matching engine:`,
+        `  npm install ${modulePath}@npm:@electric-sql/pglite@${pinned}`,
+        `\u2026or pass fetchMissingEngine (CLI: --fetch-missing-engine) to download it automatically.`
+      );
+    } else {
+      lines.push(`No engine is pinned for PostgreSQL ${major.toString()}; install one yourself.`);
+    }
+  } else {
+    lines.push(`Install it, or pass fetchMissingEngine to download a pinned engine automatically.`);
+  }
+  return new Error(lines.join("\n"), { cause });
+}
+async function openDataDir(dataDir, modulePath = "@electric-sql/pglite", options = {}) {
+  let mod;
+  try {
+    mod = await importEngine(modulePath);
+  } catch (err) {
+    if (!isUnresolvedModule(err, modulePath)) throw err;
+    if (options.fetchMissingEngine !== true) {
+      throw await missingEngineError(modulePath, dataDir, err);
+    }
+    return openAcquired(dataDir, options);
+  }
+  return construct(mod, modulePath, dataDir, options.pgliteOptions);
+}
+async function openAcquired(dataDir, options) {
+  const { acquireEngine: acquireEngine22, acquireRelease: acquireRelease22 } = await Promise.resolve().then(() => (init_acquire(), acquire_exports));
+  const acquireOptions = {};
+  if (options.cache !== void 0) acquireOptions.cache = options.cache;
+  if (options.cacheDir !== void 0) acquireOptions.cacheDir = options.cacheDir;
+  if (options.registryUrl !== void 0) acquireOptions.registryUrl = options.registryUrl;
+  const engine = options.release !== void 0 ? await acquireRelease22(options.release, acquireOptions) : await acquireEngine22(options.major ?? await readClusterVersion(dataDir), acquireOptions);
+  const mod = await importEngine(engine.entry);
+  const cluster = construct(mod, engine.entry, dataDir, options.pgliteOptions);
+  const close = cluster.close.bind(cluster);
+  cluster.close = async () => {
+    try {
+      await close();
+    } finally {
+      await engine.cleanup();
+    }
+  };
+  cluster.acquired = { version: engine.release.version, fromCache: engine.fromCache };
+  return cluster;
+}
+function numericLiteral(value, field) {
+  if (!/^-?\d+$/.test(value)) {
+    throw new Error(`Refusing to reconstruct: non-numeric ${field} from the catalog: ${value}`);
+  }
+  return value;
+}
+async function reconstructSchema(source, target, options = {}) {
+  const onUnsupported = options.onUnsupported ?? "warn";
+  const unsupported = await detectUnsupported(source);
+  if (onUnsupported === "error" && unsupported.length > 0) {
+    const list = unsupported.map((u) => `${u.kind} ${u.name}`).join(", ");
+    throw new Error(
+      `Cannot reconstruct: source has ${unsupported.length.toString()} out-of-scope object(s) that would not be recreated: ${list}. Re-run with onUnsupported: 'warn' to rebuild the app-class schema anyway.`
+    );
+  }
+  const schemas = await reconstructSchemas(source, target);
+  const { enums, domains, composites, ranges } = await reconstructCustomTypes(source, target);
+  const sequences = await reconstructSequences(source, target);
+  const tables = await reconstructTables(source, target);
+  await reconstructSequenceOwnership(source, target);
+  const constraints = await reconstructConstraints(source, target);
+  const indexes = await reconstructIndexes(source, target);
+  return {
+    schemas,
+    enums,
+    domains,
+    composites,
+    ranges,
+    sequences,
+    tables,
+    constraints,
+    indexes,
+    unsupported
+  };
+}
+async function reconstructSchemas(source, target) {
+  const { rows } = await source.query(
+    `SELECT n.nspname AS name
+       FROM pg_namespace n
+      WHERE ${SYS} AND n.nspname <> 'public'
+      ORDER BY n.nspname`
+  );
+  const created = [];
+  for (const r of rows) {
+    await target.exec(`CREATE SCHEMA IF NOT EXISTS ${quoteIdent(r.name)}`);
+    created.push(r.name);
+  }
+  return created;
+}
+async function reconstructCustomTypes(source, target) {
+  const { rows } = await source.query(
+    `SELECT t.oid::int AS oid, n.nspname AS schema, t.typname AS name, t.typtype AS kind,
+            CASE WHEN t.typtype = 'e' THEN (
+              SELECT array_agg(e.enumlabel ORDER BY e.enumsortorder)
+                FROM pg_enum e WHERE e.enumtypid = t.oid
+            ) END AS labels,
+            CASE WHEN t.typtype = 'd'
+                 THEN format_type(t.typbasetype, t.typtypmod) END AS base,
+            t.typnotnull AS notnull,
+            pg_get_expr(t.typdefaultbin, 0) AS default_expr,
+            co.collname AS collation,
+            cn.nspname AS collation_schema,
+            CASE WHEN t.typtype = 'r'
+                 THEN format_type(rng.rngsubtype, NULL) END AS range_subtype,
+            rco.collname AS range_collation,
+            rcn.nspname AS range_collation_schema,
+            CASE WHEN opc.opcdefault IS FALSE THEN opc.opcname END AS range_subopclass,
+            CASE WHEN opc.opcdefault IS FALSE THEN opcn.nspname END AS range_subopclass_schema,
+            mrt.typname AS range_multirange
+       FROM pg_type t
+       JOIN pg_namespace n ON n.oid = t.typnamespace
+       LEFT JOIN pg_collation co ON co.oid = t.typcollation AND t.typtype = 'd'
+       LEFT JOIN pg_namespace cn ON cn.oid = co.collnamespace
+       LEFT JOIN pg_range rng ON rng.rngtypid = t.oid
+       LEFT JOIN pg_collation rco ON rco.oid = rng.rngcollation
+       LEFT JOIN pg_namespace rcn ON rcn.oid = rco.collnamespace
+       LEFT JOIN pg_opclass opc ON opc.oid = rng.rngsubopc
+       LEFT JOIN pg_namespace opcn ON opcn.oid = opc.opcnamespace
+       LEFT JOIN pg_type mrt ON mrt.oid = rng.rngmultitypid
+      WHERE ${SYS}
+        -- 'm' (multirange) is deliberately absent: Postgres creates it
+        -- implicitly with its range, so emitting one would fail (FR-17.6).
+        AND t.typtype IN ('e', 'd', 'c', 'r')
+        -- A range needing a canonical/subdiff function cannot be emitted in one
+        -- statement and stays reported instead (FR-17.2).
+        AND (t.typtype <> 'r' OR (rng.rngcanonical = 0 AND rng.rngsubdiff = 0))
+        -- A standalone composite has a pg_class entry of relkind 'c'; a table's
+        -- implicit row type points at the table itself and must not be emitted.
+        AND (t.typtype <> 'c'
+             OR EXISTS (SELECT 1 FROM pg_class c
+                         WHERE c.oid = t.typrelid AND c.relkind = 'c'))
+      ORDER BY t.oid`
+  );
+  const checks = await domainChecks(source);
+  const out = { enums: [], domains: [], composites: [], ranges: [] };
+  for (const t of rows) {
+    const qualified = quoteQualified(t.schema, t.name);
+    if (t.kind === "e") {
+      const labels = (t.labels ?? []).map((l) => quoteLiteral(l)).join(", ");
+      await target.exec(`CREATE TYPE ${qualified} AS ENUM (${labels})`);
+      out.enums.push(tableKey(t));
+    } else if (t.kind === "d") {
+      await target.exec(domainDef(qualified, t, checks.get(t.oid) ?? []));
+      out.domains.push(tableKey(t));
+    } else if (t.kind === "c") {
+      await target.exec(`CREATE TYPE ${qualified} AS (${await compositeAttrs(source, t.oid)})`);
+      out.composites.push(tableKey(t));
+    } else {
+      await target.exec(rangeDef(qualified, t));
+      out.ranges.push(tableKey(t));
+    }
+  }
+  return out;
+}
+async function domainChecks(source) {
+  const { rows } = await source.query(
+    `SELECT t.oid::int AS oid, con.conname AS name, pg_get_constraintdef(con.oid) AS def
+       FROM pg_constraint con
+       JOIN pg_type t ON t.oid = con.contypid
+       JOIN pg_namespace n ON n.oid = t.typnamespace
+      WHERE con.contype = 'c' AND ${SYS}
+      ORDER BY t.oid, con.conname`
+  );
+  const byType = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const clause = `CONSTRAINT ${quoteIdent(r.name)} ${r.def}`;
+    byType.set(r.oid, [...byType.get(r.oid) ?? [], clause]);
+  }
+  return byType;
+}
+function domainDef(qualified, t, checks) {
+  const parts = [`CREATE DOMAIN ${qualified} AS ${t.base ?? "text"}`];
+  if (t.collation !== null && t.collation_schema !== null) {
+    parts.push(`COLLATE ${quoteQualified(t.collation_schema, t.collation)}`);
+  }
+  if (t.default_expr !== null) parts.push(`DEFAULT ${t.default_expr}`);
+  if (t.notnull) parts.push("NOT NULL");
+  parts.push(...checks);
+  return parts.join(" ");
+}
+function rangeDef(qualified, t) {
+  const opts = [`subtype = ${t.range_subtype ?? "text"}`];
+  if (t.range_collation !== null && t.range_collation_schema !== null) {
+    opts.push(`collation = ${quoteQualified(t.range_collation_schema, t.range_collation)}`);
+  }
+  if (t.range_subopclass !== null && t.range_subopclass_schema !== null) {
+    opts.push(
+      `subtype_opclass = ${quoteQualified(t.range_subopclass_schema, t.range_subopclass)}`
+    );
+  }
+  if (t.range_multirange !== null) {
+    opts.push(`multirange_type_name = ${quoteIdent(t.range_multirange)}`);
+  }
+  return `CREATE TYPE ${qualified} AS RANGE (${opts.join(", ")})`;
+}
+async function compositeAttrs(source, typeOid) {
+  const { rows } = await source.query(
+    `SELECT a.attname AS name, format_type(a.atttypid, a.atttypmod) AS type
+       FROM pg_type t
+       JOIN pg_attribute a ON a.attrelid = t.typrelid
+      WHERE t.oid = ${typeOid.toString()}
+        AND a.attnum > 0 AND NOT a.attisdropped
+      ORDER BY a.attnum`
+  );
+  return rows.map((r) => `${quoteIdent(r.name)} ${r.type}`).join(", ");
+}
+async function reconstructSequences(source, target) {
+  const { rows } = await source.query(
+    `SELECT n.nspname AS schema, c.relname AS name,
+            format_type(s.seqtypid, NULL) AS data_type,
+            s.seqstart::text AS start_value,
+            s.seqincrement::text AS increment_by,
+            s.seqmin::text AS min_value,
+            s.seqmax::text AS max_value,
+            s.seqcycle AS cycle
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+       JOIN pg_sequence s ON s.seqrelid = c.oid
+      WHERE c.relkind = 'S' AND ${SYS}
+        AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.objid = c.oid AND d.deptype = 'i')
+      ORDER BY n.nspname, c.relname`
+  );
+  const created = [];
+  for (const r of rows) {
+    await target.exec(
+      `CREATE SEQUENCE IF NOT EXISTS ${quoteQualified(r.schema, r.name)} AS ${r.data_type} INCREMENT BY ${numericLiteral(r.increment_by, "sequence increment")} MINVALUE ${numericLiteral(r.min_value, "sequence minvalue")} MAXVALUE ${numericLiteral(r.max_value, "sequence maxvalue")} START WITH ${numericLiteral(r.start_value, "sequence start")}` + (r.cycle ? " CYCLE" : " NO CYCLE")
+    );
+    created.push(tableKey(r));
+  }
+  return created;
+}
+async function reconstructSequenceOwnership(source, target) {
+  const { rows } = await source.query(
+    `SELECT n.nspname AS seq_schema, c.relname AS seq_name,
+            tn.nspname AS tbl_schema, tc.relname AS tbl_name, a.attname AS col
+       FROM pg_depend d
+       JOIN pg_class c ON c.oid = d.objid AND c.relkind = 'S'
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+       JOIN pg_class tc ON tc.oid = d.refobjid
+       JOIN pg_namespace tn ON tn.oid = tc.relnamespace
+       JOIN pg_attribute a ON a.attrelid = d.refobjid AND a.attnum = d.refobjsubid
+      WHERE d.classid = 'pg_class'::regclass AND d.deptype = 'a' AND ${SYS}`
+  );
+  for (const r of rows) {
+    await target.exec(
+      `ALTER SEQUENCE ${quoteQualified(r.seq_schema, r.seq_name)} OWNED BY ${quoteQualified(r.tbl_schema, r.tbl_name)}.${quoteIdent(r.col)}`
+    );
+  }
+}
+async function reconstructTables(source, target) {
+  const { rows: tables } = await source.query(
+    `SELECT n.nspname AS schema, c.relname AS name
+       FROM pg_class c
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind = 'r' AND ${SYS}
+      ORDER BY n.nspname, c.relname`
+  );
+  const created = [];
+  for (const t of tables) {
+    const qualified = quoteQualified(t.schema, t.name);
+    const { rows: cols } = await source.query(
+      `SELECT a.attname AS name,
+              format_type(a.atttypid, a.atttypmod) AS type,
+              a.attnotnull AS notnull,
+              a.attidentity AS identity,
+              a.attgenerated AS generated,
+              pg_get_expr(ad.adbin, ad.adrelid) AS default_expr
+         FROM pg_attribute a
+         LEFT JOIN pg_attrdef ad ON ad.adrelid = a.attrelid AND ad.adnum = a.attnum
+        WHERE a.attrelid = ${regclassLiteral(t.schema, t.name)}::regclass
+          AND a.attnum > 0 AND NOT a.attisdropped
+        ORDER BY a.attnum`
+    );
+    const defs = cols.map((c) => columnDef(c)).join(",\n  ");
+    await target.exec(`CREATE TABLE ${qualified} (
+  ${defs}
+)`);
+    created.push(tableKey(t));
+  }
+  return created;
+}
+function columnDef(c) {
+  const parts = [`${quoteIdent(c.name)} ${c.type}`];
+  if (c.identity === "a") parts.push("GENERATED ALWAYS AS IDENTITY");
+  else if (c.identity === "d") parts.push("GENERATED BY DEFAULT AS IDENTITY");
+  else if (c.generated === "s" && c.default_expr !== null) {
+    parts.push(`GENERATED ALWAYS AS (${c.default_expr}) STORED`);
+  } else if (c.default_expr !== null) {
+    parts.push(`DEFAULT ${c.default_expr}`);
+  }
+  if (c.notnull && c.identity === "") parts.push("NOT NULL");
+  return parts.join(" ");
+}
+async function reconstructConstraints(source, target) {
+  const { rows } = await source.query(
+    `SELECT n.nspname AS schema, c.relname AS table, con.conname AS name,
+            con.contype AS contype, pg_get_constraintdef(con.oid) AS def
+       FROM pg_constraint con
+       JOIN pg_class c ON c.oid = con.conrelid
+       JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE con.contype IN ('p', 'u', 'c', 'f') AND ${SYS}
+      ORDER BY CASE con.contype WHEN 'f' THEN 1 ELSE 0 END`
+    // FKs after PK/UNIQUE/CHECK
+  );
+  const created = [];
+  for (const r of rows) {
+    await target.exec(
+      `ALTER TABLE ${quoteQualified(r.schema, r.table)} ADD CONSTRAINT ${quoteIdent(r.name)} ${r.def}`
+    );
+    created.push(objectKey(r.schema, r.table, r.name));
+  }
+  return created;
+}
+async function reconstructIndexes(source, target) {
+  const { rows } = await source.query(
+    `SELECT ic.relname AS name, pg_get_indexdef(i.indexrelid) AS def
+       FROM pg_index i
+       JOIN pg_class ic ON ic.oid = i.indexrelid
+       JOIN pg_class tc ON tc.oid = i.indrelid
+       JOIN pg_namespace n ON n.oid = tc.relnamespace
+      WHERE ${SYS}
+        AND NOT EXISTS (SELECT 1 FROM pg_constraint con WHERE con.conindid = i.indexrelid)
+      ORDER BY ic.relname`
+  );
+  const created = [];
+  for (const r of rows) {
+    await target.exec(r.def);
+    created.push(r.name);
+  }
+  return created;
+}
+async function detectUnsupported(source) {
+  const found = [];
+  for (const detector of DETECTORS) {
+    const { rows } = await source.query(detector.sql);
+    for (const r of rows) {
+      found.push({ kind: r.kind ?? detector.label, name: r.name });
+    }
+  }
+  return found;
+}
+function topologicalSort(tables, foreignKeys) {
+  const keys = new Set(tables.map(tableKey));
+  const dependsOn = /* @__PURE__ */ new Map();
+  for (const t of tables) dependsOn.set(tableKey(t), /* @__PURE__ */ new Set());
+  for (const fk of foreignKeys) {
+    if (keys.has(fk.child) && keys.has(fk.parent) && fk.child !== fk.parent) {
+      dependsOn.get(fk.child)?.add(fk.parent);
+    }
+  }
+  const ordered = [];
+  const placed = /* @__PURE__ */ new Set();
+  const byKey = new Map(tables.map((t) => [tableKey(t), t]));
+  let progress = true;
+  while (placed.size < tables.length && progress) {
+    progress = false;
+    for (const t of tables) {
+      const key = tableKey(t);
+      if (placed.has(key)) continue;
+      const parents = dependsOn.get(key);
+      if (parents && [...parents].every((p) => placed.has(p))) {
+        ordered.push(t);
+        placed.add(key);
+        progress = true;
+      }
+    }
+  }
+  const cycles = [];
+  for (const t of tables) {
+    const key = tableKey(t);
+    if (!placed.has(key)) {
+      cycles.push(key);
+      const table = byKey.get(key);
+      if (table) ordered.push(table);
+    }
+  }
+  return { ordered, cycles };
+}
+async function transferTable(source, target, table, onProgress) {
+  const qualified = quoteQualified(table.schema, table.name);
+  const cols = table.columns.filter((c) => c.generated !== true);
+  const colList = cols.map((c) => quoteIdent(c.name)).join(", ");
+  let result;
+  try {
+    const rowsCopied = await copyTable(source, target, qualified, colList);
+    result = { table: tableKey(table), rowsCopied, method: "copy" };
+  } catch (copyErr) {
+    try {
+      const rowsCopied = await insertTable(source, target, qualified, cols, colList);
+      result = {
+        table: tableKey(table),
+        rowsCopied,
+        method: "insert",
+        fallbackReason: message(copyErr)
+      };
+    } catch (insertErr) {
+      throw new Error(
+        `Table ${tableKey(table)}: COPY failed (${message(copyErr)}), and the row-by-row INSERT fallback also failed (${message(insertErr)}).`,
+        { cause: insertErr }
+      );
+    }
+  }
+  onProgress?.(result);
+  return result;
+}
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function copyTable(source, target, qualified, colList) {
+  if (colList === "") return 0;
+  const rowCount2 = await countRows(source, qualified);
+  if (rowCount2 === 0) return 0;
+  const { blob } = await source.query(`COPY ${qualified} (${colList}) TO '/dev/blob'`);
+  if (blob === void 0) throw new Error("COPY TO produced no blob payload");
+  await target.query(`COPY ${qualified} (${colList}) FROM '/dev/blob'`, [], { blob });
+  return rowCount2;
+}
+async function insertTable(source, target, qualified, cols, colList) {
+  if (colList === "") return 0;
+  const { rows } = await source.query(`SELECT ${colList} FROM ${qualified}`);
+  if (rows.length > 0) {
+    const placeholders = cols.map((_, i) => `$${(i + 1).toString()}`).join(", ");
+    const insertSql = `INSERT INTO ${qualified} (${colList}) VALUES (${placeholders})`;
+    for (const row of rows) {
+      const values = cols.map((c) => row[c.name] ?? null);
+      await target.query(insertSql, values);
+    }
+  }
+  return rows.length;
+}
+async function targetCycleConstraints(target, cyclicTables) {
+  const constraints = [];
+  for (const t of cyclicTables) {
+    const qualified = quoteQualified(t.schema, t.name);
+    const { rows } = await target.query(
+      `SELECT conname AS name, condeferrable AS deferrable
+         FROM pg_constraint
+        WHERE contype = 'f' AND conrelid = ${regclassLiteral(t.schema, t.name)}::regclass`
+    );
+    for (const r of rows) constraints.push({ qualified, name: r.name, deferrable: r.deferrable });
+  }
+  return constraints;
+}
+async function transferCycle(source, target, cyclicTables, onProgress) {
+  const toFlip = (await targetCycleConstraints(target, cyclicTables)).filter((c) => !c.deferrable);
+  const flipped = [];
+  const results = [];
+  try {
+    for (const c of toFlip) {
+      await target.query(
+        `ALTER TABLE ${c.qualified} ALTER CONSTRAINT ${quoteIdent(c.name)} DEFERRABLE INITIALLY IMMEDIATE`
+      );
+      flipped.push(c);
+    }
+    await target.exec("BEGIN");
+    await target.exec("SET CONSTRAINTS ALL DEFERRED");
+    for (const t of cyclicTables) {
+      results.push(await transferTable(source, target, t, onProgress));
+    }
+    await target.exec("COMMIT");
+  } catch (err) {
+    await target.exec("ROLLBACK").catch(() => void 0);
+    throw err;
+  } finally {
+    for (const c of flipped) {
+      await target.query(`ALTER TABLE ${c.qualified} ALTER CONSTRAINT ${quoteIdent(c.name)} NOT DEFERRABLE`).catch(() => void 0);
+    }
+  }
+  return results;
+}
+async function applySequences(target, sequences) {
+  let applied = 0;
+  for (const seq of sequences) {
+    if (seq.lastValue === null) continue;
+    const seqRef = regclassLiteral(seq.schema, seq.name);
+    await target.query(`SELECT setval(${seqRef}::regclass, $1, true)`, [seq.lastValue.toString()]);
+    applied++;
+  }
+  return applied;
+}
+async function tableDigest(db2, table, columns) {
+  const qualified = quoteQualified(table.schema, table.name);
+  const projection = columns.map(quoteIdent).join(", ");
+  const { rows } = await db2.query(
+    `SELECT md5(coalesce(string_agg(x::text, E'\\n' ORDER BY x::text), '')) AS d
+       FROM (SELECT ${projection} FROM ${qualified}) AS x`
+  );
+  return rows[0]?.d ?? "";
+}
+function comparableColumns(source, targetColumns2) {
+  const sourceNames = source.columns.map((c) => c.name);
+  const sourceSet = new Set(sourceNames);
+  return {
+    compared: sourceNames.filter((n) => targetColumns2.has(n)).sort(),
+    missing: sourceNames.filter((n) => !targetColumns2.has(n)).sort(),
+    extra: [...targetColumns2].filter((n) => !sourceSet.has(n)).sort()
+  };
+}
+async function targetTableMap(db2, level) {
+  if (level !== "full") {
+    return new Map((await tableKeys(db2)).map((key) => [key, null]));
+  }
+  const schema = await introspectSchema(db2);
+  return new Map(schema.tables.map((t) => [tableKey(t), new Set(t.columns.map((c) => c.name))]));
+}
+async function sequenceValue(db2, schema, name) {
+  const { rows } = await db2.query(
+    `SELECT last_value AS v FROM pg_sequences
+      WHERE schemaname = ${quoteLiteral(schema)} AND sequencename = ${quoteLiteral(name)}`
+  );
+  if (rows.length === 0) return null;
+  const v = rows[0].v;
+  return v === null ? null : v.toString();
+}
+async function validateMigration(source, target, schema, level) {
+  const targetTables = await targetTableMap(target, level);
+  const tables = [];
+  for (const t of schema.tables) {
+    const key = tableKey(t);
+    const qualified = quoteQualified(t.schema, t.name);
+    const sourceRows = await countRows(source, qualified);
+    const targetColumns2 = targetTables.get(key);
+    if (targetColumns2 === void 0) {
+      tables.push({ table: key, sourceRows, targetRows: 0, missingTable: true, ok: false });
+      continue;
+    }
+    const targetRows = await countRows(target, qualified);
+    let ok2 = sourceRows === targetRows;
+    const entry = { table: key, sourceRows, targetRows, ok: ok2 };
+    if (targetColumns2 !== null) {
+      const cols = comparableColumns(t, targetColumns2);
+      entry.comparedColumns = cols.compared;
+      if (cols.missing.length > 0) entry.missingColumns = cols.missing;
+      if (cols.extra.length > 0) entry.extraColumns = cols.extra;
+      if (cols.missing.length > 0) ok2 = false;
+      else if (ok2 && cols.compared.length > 0) {
+        entry.digestMatch = await tableDigest(source, t, cols.compared) === await tableDigest(target, t, cols.compared);
+        ok2 = entry.digestMatch;
+      }
+    }
+    entry.ok = ok2;
+    tables.push(entry);
+  }
+  const sequences = [];
+  for (const s of schema.sequences) {
+    if (s.lastValue === null) continue;
+    const sourceValue = s.lastValue.toString();
+    const targetValue = await sequenceValue(target, s.schema, s.name);
+    const ok2 = targetValue !== null && BigInt(targetValue) >= BigInt(sourceValue);
+    sequences.push({ sequence: tableKey(s), sourceValue, targetValue, ok: ok2 });
+  }
+  const ok = tables.every((t) => t.ok) && sequences.every((s) => s.ok);
+  return { level, ok, tables, sequences };
+}
+async function rowCount(db2, table) {
+  return countRows(db2, quoteQualified(table.schema, table.name));
+}
+async function prepareTarget(target, ordered, onExisting) {
+  const skip = /* @__PURE__ */ new Set();
+  if (ordered.length === 0) return { skip, truncated: [] };
+  const populated = [];
+  for (const t of ordered) {
+    if (await hasRows(target, quoteQualified(t.schema, t.name))) populated.push(tableKey(t));
+  }
+  if (onExisting === "truncate") {
+    const list = ordered.map((t) => quoteQualified(t.schema, t.name)).join(", ");
+    await target.exec(`TRUNCATE TABLE ${list}`);
+    return { skip, truncated: populated };
+  }
+  if (onExisting === "skip") {
+    for (const key of populated) skip.add(key);
+    return { skip, truncated: [] };
+  }
+  if (populated.length > 0) {
+    throw new Error(
+      `Target already contains rows in: ${populated.join(", ")}. Re-run with onExisting: 'truncate' or 'skip', or start from an empty target.`
+    );
+  }
+  return { skip, truncated: [] };
+}
+function fallbackWarning(result) {
+  if (result.method === "insert" && result.fallbackReason !== void 0) {
+    return `Table ${result.table}: COPY unavailable (${result.fallbackReason}); fell back to row-by-row INSERT.`;
+  }
+  return null;
+}
+async function planMigration(source, onProgress) {
+  const schema = await introspectSchema(source);
+  const { ordered, cycles } = topologicalSort(schema.tables, schema.foreignKeys);
+  const tables = [];
+  let totalRows = 0;
+  for (const table of ordered) {
+    const rowsCopied = await rowCount(source, table);
+    const result = { table: tableKey(table), rowsCopied, method: "copy" };
+    tables.push(result);
+    totalRows += rowsCopied;
+    onProgress?.(result);
+  }
+  const sequencesSet = schema.sequences.filter((s) => s.lastValue !== null).length;
+  return {
+    tables,
+    sequencesSet,
+    totalRows,
+    warnings: [],
+    deferredTables: [...cycles],
+    skippedTables: [],
+    // A plan writes nothing, so no table is skipped or truncated. `onExisting`
+    // is echoed by `migrate` for a dry run so the preview names the policy the
+    // real run would apply.
+    onExisting: "error",
+    truncatedTables: []
+  };
+}
+async function migrate(options) {
+  const { source, target, onProgress } = options;
+  const onExisting = options.onExisting ?? "error";
+  if (options.dryRun === true) {
+    return { ...await planMigration(source, onProgress), onExisting };
+  }
+  const level = options.validate ?? "counts";
+  const onValidationFailure = options.onValidationFailure ?? "report";
+  const warnings = [];
+  let reconstruction;
+  if (options.reconstructSchema === true) {
+    reconstruction = await reconstructSchema(source, target, {
+      onUnsupported: options.onUnsupported ?? "warn"
+    });
+    for (const u of reconstruction.unsupported) {
+      warnings.push(`Unsupported ${u.kind} not reconstructed: ${u.name}.`);
+    }
+  }
+  const schema = await introspectSchema(source);
+  const { ordered, cycles } = topologicalSort(schema.tables, schema.foreignKeys);
+  const cyclicSet = new Set(cycles);
+  const { skip, truncated } = await prepareTarget(target, ordered, onExisting);
+  const skippedTables = [...skip];
+  const tables = [];
+  const deferredTables = [];
+  let totalRows = 0;
+  for (const table of ordered) {
+    if (cyclicSet.has(tableKey(table)) || skip.has(tableKey(table))) continue;
+    const result = await transferTable(source, target, table, onProgress);
+    tables.push(result);
+    totalRows += result.rowsCopied;
+    const warning = fallbackWarning(result);
+    if (warning !== null) warnings.push(warning);
+  }
+  if (cycles.length > 0) {
+    const cyclicTables = ordered.filter(
+      (t) => cyclicSet.has(tableKey(t)) && !skip.has(tableKey(t))
+    );
+    const cyclicResults = await transferCycle(source, target, cyclicTables, onProgress);
+    for (const result of cyclicResults) {
+      tables.push(result);
+      totalRows += result.rowsCopied;
+      deferredTables.push(result.table);
+      const warning = fallbackWarning(result);
+      if (warning !== null) warnings.push(warning);
+    }
+  }
+  const sequencesSet = await applySequences(target, schema.sequences);
+  let validation;
+  if (level !== "off" && schema.tables.length > 0) {
+    validation = await validateMigration(source, target, schema, level);
+    if (!validation.ok) {
+      const bad = [
+        ...validation.tables.filter((t) => !t.ok).map((t) => t.table),
+        ...validation.sequences.filter((s) => !s.ok).map((s) => s.sequence)
+      ];
+      const message2 = `Post-migration validation failed for: ${bad.join(", ")}.`;
+      if (onValidationFailure === "throw") throw new ValidationError(validation, message2);
+      warnings.push(message2);
+    }
+  }
+  return {
+    tables,
+    sequencesSet,
+    totalRows,
+    warnings,
+    deferredTables,
+    skippedTables,
+    onExisting,
+    truncatedTables: truncated,
+    validation,
+    reconstruction
+  };
+}
+async function swapIntoPlace(canonicalDir, newDir, options = {}) {
+  if (!await exists(newDir)) {
+    throw new Error(`New cluster directory does not exist: ${newDir}`);
+  }
+  const keepOld = options.keepOld ?? true;
+  const timestamp2 = sanitizedTimestamp(options.timestamp);
+  const oldPath = `${canonicalDir}.old-${timestamp2}`;
+  const canonicalExisted = await exists(canonicalDir);
+  if (canonicalExisted) {
+    if (await exists(oldPath)) {
+      throw new Error(`Retained-old directory already exists: ${oldPath}`);
+    }
+    await rename3(canonicalDir, oldPath);
+  }
+  try {
+    await rename3(newDir, canonicalDir);
+  } catch (err) {
+    if (canonicalExisted) await rename3(oldPath, canonicalDir).catch(() => void 0);
+    if (errorCode(err) === "EXDEV") {
+      throw new Error(
+        `Cannot swap: ${newDir} is on a different filesystem than ${canonicalDir}. Stage the new cluster as a sibling of the canonical location.`,
+        { cause: err }
+      );
+    }
+    throw err;
+  }
+  if (canonicalExisted && !keepOld) {
+    await rm3(oldPath, { recursive: true, force: true });
+    return { canonical: canonicalDir, previous: null };
+  }
+  return { canonical: canonicalDir, previous: canonicalExisted ? oldPath : null };
+}
+var __defProp2, __getOwnPropNames2, __esm2, __export2, init_fsutil, PGLITE_PACKAGE, RELEASES, UnknownMajorError, init_registry, gunzip, BLOCK, OFF, TYPE, TarError, init_tar, acquire_exports, DEFAULT_REGISTRY, FALLBACK_ENTRY, EngineFetchError, IntegrityError, init_acquire, UNRESOLVED_CODES, SYS, DETECTORS, ValidationError;
+var init_dist = __esm({
+  "node_modules/pglite-migrate/dist/index.js"() {
+    "use strict";
+    __defProp2 = Object.defineProperty;
+    __getOwnPropNames2 = Object.getOwnPropertyNames;
+    __esm2 = (fn, res, err) => function __init() {
+      if (err) throw err[0];
+      try {
+        return fn && (res = (0, fn[__getOwnPropNames2(fn)[0]])(fn = 0)), res;
+      } catch (e) {
+        throw err = [e], e;
+      }
+    };
+    __export2 = (target, all) => {
+      for (var name in all)
+        __defProp2(target, name, { get: all[name], enumerable: true });
+    };
+    init_fsutil = __esm2({
+      "src/fsutil.ts"() {
+        "use strict";
+      }
+    });
+    init_registry = __esm2({
+      "src/engines/registry.ts"() {
+        "use strict";
+        PGLITE_PACKAGE = "@electric-sql/pglite";
+        RELEASES = [
+          {
+            postgresMajor: 15,
+            version: "0.1.5",
+            integrity: "sha512-eymv4ONNvoPZQTvOQIi5dbpR+J5HzEv0qQH9o/y3gvNheJV/P/NFcrbsfJZYTsDKoq7DKrTiFNexsRkJKy8x9Q=="
+          },
+          {
+            postgresMajor: 16,
+            version: "0.2.17",
+            integrity: "sha512-qEpKRT2oUaWDH6tjRxLHjdzMqRUGYDnGZlKrnL4dJ77JVMcP2Hpo3NYnOSPKdZdeec57B6QPprCUFg0picx5Pw=="
+          },
+          {
+            postgresMajor: 17,
+            version: "0.4.6",
+            integrity: "sha512-qmlmfN8UyKCee35qkV0r/MBp+Znl8FjBz7OpoglNvww3GJpw0/DLP0o1ZymvLNmcD5DTLOQdzKPtF8Hd3mdl1w=="
+          },
+          {
+            postgresMajor: 18,
+            version: "0.5.4",
+            integrity: "sha512-yYZUyyXrHU7tPlCjwZQJ6hIG9DscdCCn7Uk0mYKwC1FeHX286AbcmFveMiRBEak8e9iPupjsoVImN3yJZVed2g=="
+          }
+        ];
+        UnknownMajorError = class extends Error {
+          /** The major that could not be resolved. */
+          major;
+          /** The majors this build does know how to acquire. */
+          knownMajors;
+          constructor(major, knownMajors22) {
+            super(
+              `No pinned PGlite engine for PostgreSQL ${major.toString()} (this build knows ${knownMajors22.join(", ")}). Install a matching engine yourself and pass it as the source engine, e.g. npm install pglite-old@npm:${PGLITE_PACKAGE}@<version>`
+            );
+            this.name = "UnknownMajorError";
+            this.major = major;
+            this.knownMajors = knownMajors22;
+          }
+        };
+      }
+    });
+    init_tar = __esm2({
+      "src/engines/tar.ts"() {
+        "use strict";
+        gunzip = promisify(gunzipCb);
+        BLOCK = 512;
+        OFF = {
+          name: 0,
+          size: 124,
+          checksum: 148,
+          typeflag: 156,
+          magic: 257,
+          prefix: 345
+        };
+        TYPE = {
+          file: "0",
+          fileAlt: "\0",
+          contiguous: "7",
+          directory: "5",
+          paxNext: "x",
+          paxGlobal: "g",
+          gnuLongName: "L"
+        };
+        TarError = class extends Error {
+          constructor(message2) {
+            super(message2);
+            this.name = "TarError";
+          }
+        };
+      }
+    });
+    acquire_exports = {};
+    __export2(acquire_exports, {
+      EngineFetchError: () => EngineFetchError,
+      IntegrityError: () => IntegrityError,
+      acquireEngine: () => acquireEngine,
+      acquireRelease: () => acquireRelease,
+      defaultCacheDir: () => defaultCacheDir,
+      resolveEntry: () => resolveEntry
+    });
+    init_acquire = __esm2({
+      "src/engines/acquire.ts"() {
+        "use strict";
+        init_fsutil();
+        init_registry();
+        init_tar();
+        DEFAULT_REGISTRY = "https://registry.npmjs.org";
+        FALLBACK_ENTRY = "dist/index.js";
+        EngineFetchError = class extends Error {
+          constructor(message2, options) {
+            super(message2, options);
+            this.name = "EngineFetchError";
+          }
+        };
+        IntegrityError = class extends Error {
+          constructor(expected, actual, version2) {
+            super(
+              `Integrity check failed for ${PGLITE_PACKAGE}@${version2}: expected ${expected}, got ${actual}. The download was discarded and nothing was written. This means the bytes served did not match the hash pinned in this build of pglite-migrate.`
+            );
+            this.expected = expected;
+            this.actual = actual;
+            this.version = version2;
+            this.name = "IntegrityError";
+          }
+          expected;
+          actual;
+          version;
+        };
+      }
+    });
+    init_fsutil();
+    init_registry();
+    init_registry();
+    init_fsutil();
+    UNRESOLVED_CODES = /* @__PURE__ */ new Set([
+      "ERR_MODULE_NOT_FOUND",
+      "ERR_PACKAGE_PATH_NOT_EXPORTED",
+      "ERR_UNSUPPORTED_DIR_IMPORT"
+    ]);
+    SYS = systemSchemaFilter("n.nspname");
+    DETECTORS = [
+      {
+        // Views, matviews, partitioned tables, foreign tables — one relkind sweep.
+        label: "relation",
+        sql: `SELECT CASE c.relkind
+                   WHEN 'v' THEN 'view'
+                   WHEN 'm' THEN 'materialized view'
+                   WHEN 'p' THEN 'partitioned table'
+                   WHEN 'f' THEN 'foreign table'
+                 END AS kind,
+                 n.nspname || '.' || c.relname AS name
+            FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+           WHERE c.relkind IN ('v', 'm', 'p', 'f') AND ${SYS}`
+      },
+      {
+        // Enums, domains, composites (docs/16) and function-free ranges (docs/17)
+        // are reconstructed, so they are deliberately absent: reporting a type as
+        // "not recreated" while recreating it would be worse than either behavior
+        // alone (FR-16.3). What remains is the one genuinely un-emittable case — a
+        // range whose canonical/subdiff is a function. Postgres cannot create such
+        // a range in a single statement even in principle (FR-17.2/FR-17.7).
+        label: "range type (depends on a canonical/subdiff function)",
+        sql: `SELECT n.nspname || '.' || t.typname AS name
+            FROM pg_type t
+            JOIN pg_range r ON r.rngtypid = t.oid
+            JOIN pg_namespace n ON n.oid = t.typnamespace
+           WHERE ${SYS} AND (r.rngcanonical <> 0 OR r.rngsubdiff <> 0)`
+      },
+      {
+        // Excludes functions Postgres creates *for* another object rather than the
+        // user creating them: a range type auto-generates five constructors
+        // (`intrange(int,int)`, `intmultirange(...)`, …), each carrying an INTERNAL
+        // dependency on its type. Reporting those as unsupported user functions
+        // would be a phantom warning on every source that declares a range.
+        label: "function",
+        sql: `SELECT n.nspname || '.' || p.proname AS name
+            FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+           WHERE ${SYS}
+             AND NOT EXISTS (SELECT 1 FROM pg_depend d
+                              WHERE d.objid = p.oid
+                                AND d.classid = 'pg_proc'::regclass
+                                AND d.deptype = 'i')`
+      },
+      {
+        label: "trigger",
+        sql: `SELECT n.nspname || '.' || c.relname || '.' || t.tgname AS name
+            FROM pg_trigger t
+            JOIN pg_class c ON c.oid = t.tgrelid
+            JOIN pg_namespace n ON n.oid = c.relnamespace
+           WHERE NOT t.tgisinternal AND ${SYS}`
+      },
+      {
+        label: "policy",
+        sql: `SELECT n.nspname || '.' || c.relname || '.' || pol.polname AS name
+            FROM pg_policy pol
+            JOIN pg_class c ON c.oid = pol.polrelid
+            JOIN pg_namespace n ON n.oid = c.relnamespace
+           WHERE ${SYS}`
+      },
+      {
+        // A view's implicit _RETURN rule is the view itself, already reported above.
+        label: "rule",
+        sql: `SELECT n.nspname || '.' || c.relname || '.' || r.rulename AS name
+            FROM pg_rewrite r
+            JOIN pg_class c ON c.oid = r.ev_class
+            JOIN pg_namespace n ON n.oid = c.relnamespace
+           WHERE r.rulename <> '_RETURN' AND ${SYS}`
+      },
+      {
+        label: "operator class",
+        sql: `SELECT n.nspname || '.' || o.opcname AS name
+            FROM pg_opclass o JOIN pg_namespace n ON n.oid = o.opcnamespace
+           WHERE ${SYS}`
+      },
+      {
+        label: "collation",
+        sql: `SELECT n.nspname || '.' || col.collname AS name
+            FROM pg_collation col JOIN pg_namespace n ON n.oid = col.collnamespace
+           WHERE ${SYS}`
+      },
+      {
+        // Comments on user relations and their columns. pg_description also carries
+        // the built-in catalog's own docs, hence the join through pg_class.
+        label: "comment",
+        sql: `SELECT n.nspname || '.' || c.relname AS name
+            FROM pg_description d
+            JOIN pg_class c ON c.oid = d.objoid
+            JOIN pg_namespace n ON n.oid = c.relnamespace
+           WHERE ${SYS}
+           GROUP BY n.nspname, c.relname`
+      },
+      {
+        // A relation with no explicit grants has relacl NULL; anything else means
+        // privileges were granted and would be lost.
+        label: "grant",
+        sql: `SELECT n.nspname || '.' || c.relname AS name
+            FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+           WHERE c.relacl IS NOT NULL AND ${SYS}`
+      },
+      {
+        // plpgsql ships with every database; it is not something the source added.
+        label: "extension",
+        sql: `SELECT e.extname AS name FROM pg_extension e WHERE e.extname <> 'plpgsql'`
+      }
+    ];
+    ValidationError = class extends Error {
+      /** The validation report whose `ok` is false. */
+      report;
+      constructor(report, message2) {
+        super(message2 ?? `Post-migration validation failed (${report.level}).`);
+        this.name = "ValidationError";
+        this.report = report;
+      }
+    };
+    init_registry();
+    init_fsutil();
+  }
+});
+
+// node_modules/pglite-migrate/dist/engines.js
+import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { mkdir as mkdir22, readFile as readFile4, rename as rename4, rm as rm4 } from "fs/promises";
+import { homedir as homedir2, tmpdir as tmpdir2 } from "os";
+import { join as join23, resolve as resolve23, sep as sep22 } from "path";
+import { stat as stat3 } from "fs/promises";
+import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname6, join as join6, resolve as resolve5, sep as sep3 } from "path";
+import { promisify as promisify2 } from "util";
+import { gunzip as gunzipCb2 } from "zlib";
+async function exists2(path) {
+  try {
+    await stat3(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function knownMajors2() {
+  return RELEASES2.map((r) => r.postgresMajor);
+}
+function resolveEngine2(major) {
+  const release = tryResolveEngine2(major);
+  if (release === void 0) throw new UnknownMajorError2(major, knownMajors2());
+  return release;
+}
+function tryResolveEngine2(major) {
+  return RELEASES2.find((r) => r.postgresMajor === major);
+}
+function readOctal2(header, offset, length) {
+  if ((header[offset] & 128) !== 0) {
+    throw new TarError2("Unsupported base-256 numeric field in tar header");
+  }
+  const raw2 = header.subarray(offset, offset + length).toString("latin1").replace(/\0/g, " ").trim();
+  if (raw2 === "") return 0;
+  if (!/^[0-7]+$/.test(raw2)) throw new TarError2(`Malformed octal field: ${JSON.stringify(raw2)}`);
+  return Number.parseInt(raw2, 8);
+}
+function readString2(header, offset, length) {
+  const raw2 = header.subarray(offset, offset + length);
+  const end = raw2.indexOf(0);
+  return raw2.subarray(0, end === -1 ? raw2.length : end).toString("utf8");
+}
+function isZeroBlock2(block) {
+  for (const byte of block) if (byte !== 0) return false;
+  return true;
+}
+function verifyChecksum2(header) {
+  const expected = readOctal2(header, OFF2.checksum, 8);
+  let signed = 0;
+  let unsigned = 0;
+  for (let i = 0; i < BLOCK2; i++) {
+    const inChecksumField = i >= OFF2.checksum && i < OFF2.checksum + 8;
+    const byte = inChecksumField ? 32 : header[i];
+    unsigned += byte;
+    signed += byte > 127 ? byte - 256 : byte;
+  }
+  if (unsigned !== expected && signed !== expected) {
+    throw new TarError2(
+      `Tar header checksum mismatch (expected ${expected.toString()}, got ${unsigned.toString()})`
+    );
+  }
+}
+function safeEntryPath2(name, stripComponents) {
+  if (name.includes("\0")) throw new TarError2(`Tar entry name contains a NUL byte`);
+  if (name.includes("\\")) throw new TarError2(`Tar entry name contains a backslash: ${name}`);
+  if (name.startsWith("/") || /^[A-Za-z]:/.test(name)) {
+    throw new TarError2(`Absolute path in tar entry: ${name}`);
+  }
+  const parts = name.split("/").filter((p) => p !== "" && p !== ".");
+  if (parts.includes("..")) throw new TarError2(`Path traversal in tar entry: ${name}`);
+  const stripped = parts.slice(stripComponents);
+  return stripped.length === 0 ? null : stripped.join("/");
+}
+function paxPath2(data) {
+  const text = data.toString("utf8");
+  const match = /(?:^|\n)\d+ path=([^\n]*)\n/.exec(text);
+  return match?.[1];
+}
+async function extractTarGz2(gzipped, dest, stripComponents = 0) {
+  const buf = await gunzip2(gzipped);
+  const root = resolve5(dest);
+  await mkdir3(root, { recursive: true });
+  let offset = 0;
+  let filesWritten = 0;
+  let nextNameOverride;
+  while (offset + BLOCK2 <= buf.length) {
+    const header = buf.subarray(offset, offset + BLOCK2);
+    if (isZeroBlock2(header)) break;
+    verifyChecksum2(header);
+    const size = readOctal2(header, OFF2.size, 12);
+    const typeflag = String.fromCharCode(header[OFF2.typeflag]);
+    const prefix = readString2(header, OFF2.prefix, 155);
+    const base = readString2(header, OFF2.name, 100);
+    const rawName = nextNameOverride ?? (prefix === "" ? base : `${prefix}/${base}`);
+    nextNameOverride = void 0;
+    const dataStart = offset + BLOCK2;
+    const dataEnd = dataStart + size;
+    if (dataEnd > buf.length) throw new TarError2("Tar entry extends past end of archive");
+    const data = buf.subarray(dataStart, dataEnd);
+    offset = dataStart + Math.ceil(size / BLOCK2) * BLOCK2;
+    switch (typeflag) {
+      case TYPE2.paxNext: {
+        nextNameOverride = paxPath2(data);
+        continue;
+      }
+      case TYPE2.gnuLongName: {
+        nextNameOverride = data.toString("utf8").replace(/\0+$/, "");
+        continue;
+      }
+      case TYPE2.paxGlobal:
+        continue;
+      // global metadata, nothing to write
+      case TYPE2.file:
+      case TYPE2.fileAlt:
+      case TYPE2.contiguous: {
+        const rel = safeEntryPath2(rawName, stripComponents);
+        if (rel === null) continue;
+        const full = resolve5(root, rel);
+        if (full !== root && !full.startsWith(root + sep3)) {
+          throw new TarError2(`Tar entry escapes extraction root: ${rawName}`);
+        }
+        await mkdir3(dirname6(full), { recursive: true });
+        await writeFile2(full, data);
+        filesWritten++;
+        continue;
+      }
+      case TYPE2.directory: {
+        const rel = safeEntryPath2(rawName, stripComponents);
+        if (rel === null) continue;
+        const full = resolve5(root, rel);
+        if (full !== root && !full.startsWith(root + sep3)) {
+          throw new TarError2(`Tar entry escapes extraction root: ${rawName}`);
+        }
+        await mkdir3(full, { recursive: true });
+        continue;
+      }
+      default:
+        throw new TarError2(
+          `Refusing tar entry of type '${typeflag}' (${rawName}) \u2014 only regular files and directories are extracted`
+        );
+    }
+  }
+  if (filesWritten === 0) throw new TarError2(`Archive contained no files under ${join6(dest)}`);
+  return filesWritten;
+}
+function defaultCacheDir2(platform = process.platform, env = process.env) {
+  const parts = ["pglite-migrate", "engines"];
+  if (platform === "win32") {
+    const local = env.LOCALAPPDATA ?? join23(homedir2(), "AppData", "Local");
+    return join23(local, ...parts);
+  }
+  if (platform === "darwin") {
+    return join23(homedir2(), "Library", "Caches", ...parts);
+  }
+  const xdg = env.XDG_CACHE_HOME ?? join23(homedir2(), ".cache");
+  return join23(xdg, ...parts);
+}
+function tarballUrl2(version2, registryUrl) {
+  const unscoped = PGLITE_PACKAGE2.split("/").pop() ?? PGLITE_PACKAGE2;
+  return `${registryUrl.replace(/\/+$/, "")}/${PGLITE_PACKAGE2}/-/${unscoped}-${version2}.tgz`;
+}
+async function download2(url2, version2) {
+  let response;
+  try {
+    response = await fetch(url2);
+  } catch (err) {
+    throw new EngineFetchError2(
+      `Could not reach the npm registry to download ${PGLITE_PACKAGE2}@${version2} (${url2}). If this machine is offline or behind a proxy, install the engine yourself instead: npm install pglite-old@npm:${PGLITE_PACKAGE2}@${version2}`,
+      { cause: err }
+    );
+  }
+  if (!response.ok) {
+    throw new EngineFetchError2(
+      `Registry returned ${response.status.toString()} ${response.statusText} for ${url2}`
+    );
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+function verifyIntegrity2(bytes, release) {
+  const actual = `sha512-${createHash3("sha512").update(bytes).digest("base64")}`;
+  if (actual !== release.integrity) {
+    throw new IntegrityError2(release.integrity, actual, release.version);
+  }
+}
+function manifestEntryCandidates2(manifest) {
+  const candidates = [];
+  const dot = manifest.exports?.["."];
+  if (typeof dot === "string") {
+    candidates.push(dot);
+  } else if (dot !== null && typeof dot === "object") {
+    const imp = dot.import;
+    if (typeof imp === "string") candidates.push(imp);
+  }
+  if (typeof manifest.module === "string") candidates.push(manifest.module);
+  if (typeof manifest.main === "string") candidates.push(manifest.main);
+  candidates.push(FALLBACK_ENTRY2);
+  return candidates;
+}
+async function resolveEntry2(dir) {
+  const root = resolve23(dir);
+  let manifest = {};
+  try {
+    const raw2 = JSON.parse(await readFile4(join23(root, "package.json"), "utf8"));
+    if (raw2 !== null && typeof raw2 === "object") manifest = raw2;
+  } catch {
+  }
+  for (const candidate of manifestEntryCandidates2(manifest)) {
+    const full = resolve23(root, candidate);
+    if (full !== root && !full.startsWith(root + sep22)) continue;
+    if (await exists2(full)) return full;
+  }
+  throw new EngineFetchError2(
+    `Extracted engine at ${root} has no usable module entry point (tried the package manifest and ${FALLBACK_ENTRY2})`
+  );
+}
+async function acquireEngine2(major, options = {}) {
+  return acquireRelease2(resolveEngine2(major), options);
+}
+async function acquireRelease2(release, options = {}) {
+  const mode = options.cache ?? "keep";
+  const registryUrl = options.registryUrl ?? DEFAULT_REGISTRY2;
+  if (mode === "ephemeral") {
+    const parent = options.cacheDir ?? tmpdir2();
+    const dir2 = join23(parent, `pglite-migrate-engine-${release.version}-${randomUUID2()}`);
+    const bytes2 = await download2(tarballUrl2(release.version, registryUrl), release.version);
+    verifyIntegrity2(bytes2, release);
+    await extractTarGz2(bytes2, dir2, 1);
+    return {
+      entry: await resolveEntry2(dir2),
+      dir: dir2,
+      release,
+      fromCache: false,
+      cleanup: () => rm4(dir2, { recursive: true, force: true })
+    };
+  }
+  const root = options.cacheDir ?? defaultCacheDir2();
+  const dir = join23(root, `pglite-${release.version}`);
+  const noop = () => Promise.resolve();
+  if (await exists2(dir)) {
+    return { entry: await resolveEntry2(dir), dir, release, fromCache: true, cleanup: noop };
+  }
+  const bytes = await download2(tarballUrl2(release.version, registryUrl), release.version);
+  verifyIntegrity2(bytes, release);
+  await mkdir22(root, { recursive: true });
+  const staging = join23(root, `.staging-${release.version}-${randomUUID2()}`);
+  try {
+    await extractTarGz2(bytes, staging, 1);
+    try {
+      await rename4(staging, dir);
+    } catch (err) {
+      if (!await exists2(dir)) throw err;
+    }
+  } finally {
+    await rm4(staging, { recursive: true, force: true });
+  }
+  return { entry: await resolveEntry2(dir), dir, release, fromCache: false, cleanup: noop };
+}
+var PGLITE_PACKAGE2, RELEASES2, UnknownMajorError2, gunzip2, BLOCK2, OFF2, TYPE2, TarError2, DEFAULT_REGISTRY2, FALLBACK_ENTRY2, EngineFetchError2, IntegrityError2;
+var init_engines = __esm({
+  "node_modules/pglite-migrate/dist/engines.js"() {
+    "use strict";
+    PGLITE_PACKAGE2 = "@electric-sql/pglite";
+    RELEASES2 = [
+      {
+        postgresMajor: 15,
+        version: "0.1.5",
+        integrity: "sha512-eymv4ONNvoPZQTvOQIi5dbpR+J5HzEv0qQH9o/y3gvNheJV/P/NFcrbsfJZYTsDKoq7DKrTiFNexsRkJKy8x9Q=="
+      },
+      {
+        postgresMajor: 16,
+        version: "0.2.17",
+        integrity: "sha512-qEpKRT2oUaWDH6tjRxLHjdzMqRUGYDnGZlKrnL4dJ77JVMcP2Hpo3NYnOSPKdZdeec57B6QPprCUFg0picx5Pw=="
+      },
+      {
+        postgresMajor: 17,
+        version: "0.4.6",
+        integrity: "sha512-qmlmfN8UyKCee35qkV0r/MBp+Znl8FjBz7OpoglNvww3GJpw0/DLP0o1ZymvLNmcD5DTLOQdzKPtF8Hd3mdl1w=="
+      },
+      {
+        postgresMajor: 18,
+        version: "0.5.4",
+        integrity: "sha512-yYZUyyXrHU7tPlCjwZQJ6hIG9DscdCCn7Uk0mYKwC1FeHX286AbcmFveMiRBEak8e9iPupjsoVImN3yJZVed2g=="
+      }
+    ];
+    UnknownMajorError2 = class extends Error {
+      /** The major that could not be resolved. */
+      major;
+      /** The majors this build does know how to acquire. */
+      knownMajors;
+      constructor(major, knownMajors22) {
+        super(
+          `No pinned PGlite engine for PostgreSQL ${major.toString()} (this build knows ${knownMajors22.join(", ")}). Install a matching engine yourself and pass it as the source engine, e.g. npm install pglite-old@npm:${PGLITE_PACKAGE2}@<version>`
+        );
+        this.name = "UnknownMajorError";
+        this.major = major;
+        this.knownMajors = knownMajors22;
+      }
+    };
+    gunzip2 = promisify2(gunzipCb2);
+    BLOCK2 = 512;
+    OFF2 = {
+      name: 0,
+      size: 124,
+      checksum: 148,
+      typeflag: 156,
+      magic: 257,
+      prefix: 345
+    };
+    TYPE2 = {
+      file: "0",
+      fileAlt: "\0",
+      contiguous: "7",
+      directory: "5",
+      paxNext: "x",
+      paxGlobal: "g",
+      gnuLongName: "L"
+    };
+    TarError2 = class extends Error {
+      constructor(message2) {
+        super(message2);
+        this.name = "TarError";
+      }
+    };
+    DEFAULT_REGISTRY2 = "https://registry.npmjs.org";
+    FALLBACK_ENTRY2 = "dist/index.js";
+    EngineFetchError2 = class extends Error {
+      constructor(message2, options) {
+        super(message2, options);
+        this.name = "EngineFetchError";
+      }
+    };
+    IntegrityError2 = class extends Error {
+      constructor(expected, actual, version2) {
+        super(
+          `Integrity check failed for ${PGLITE_PACKAGE2}@${version2}: expected ${expected}, got ${actual}. The download was discarded and nothing was written. This means the bytes served did not match the hash pinned in this build of pglite-migrate.`
+        );
+        this.expected = expected;
+        this.actual = actual;
+        this.version = version2;
+        this.name = "IntegrityError";
+      }
+      expected;
+      actual;
+      version;
+    };
+  }
+});
+
+// src/db/migrate-major.ts
 import { PGlite } from "@electric-sql/pglite";
-import { mkdirSync as mkdirSync3, rmSync } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, rmSync } from "fs";
+async function migrateMajorIfNeeded(dbPath, initSchema2) {
+  if (!existsSync3(dbPath)) return { status: "not-needed" };
+  let fromMajor;
+  try {
+    fromMajor = await readClusterVersion(dbPath);
+  } catch {
+    return { status: "not-needed" };
+  }
+  const staged = `${dbPath}.migrating-${timestamp()}`;
+  let toMajor;
+  try {
+    toMajor = await buildTarget(staged, initSchema2);
+  } catch (err) {
+    discard(staged);
+    return { status: "blocked", fromMajor, reason: describe3(err) };
+  }
+  if (fromMajor === toMajor) {
+    discard(staged);
+    return { status: "not-needed" };
+  }
+  try {
+    const { rows, backupPath } = await runMigration(dbPath, staged, fromMajor);
+    return { status: "migrated", fromMajor, toMajor, rows, backupPath };
+  } catch (err) {
+    discard(staged);
+    return { status: "blocked", fromMajor, reason: describe3(err) };
+  }
+}
+async function buildTarget(staged, initSchema2) {
+  const target = new PGlite(staged, DB_OPTIONS);
+  try {
+    await target.waitReady;
+    await initSchema2(target);
+  } finally {
+    await target.close();
+  }
+  return readClusterVersion(staged);
+}
+async function runMigration(dbPath, staged, fromMajor) {
+  const engine = await acquireEngine2(fromMajor, { cache: "ephemeral" });
+  try {
+    const backupPath = await backupDataDir(dbPath, { keep: 1 });
+    const source = await openDataDir(dbPath, engine.entry, { pgliteOptions: DB_OPTIONS });
+    const target = new PGlite(staged, DB_OPTIONS);
+    try {
+      await target.waitReady;
+      const schema = await introspectSchema(source);
+      const obsolete = await materializeObsoleteColumns(target, schema);
+      const report = await migrate({ source, target });
+      const validation = await validateMigration(source, target, schema, "full");
+      if (!validation.ok) {
+        throw new Error(`post-migration validation failed: ${summarize(validation)}`);
+      }
+      await dropObsoleteColumns(target, obsolete);
+      const rows = report.tables.reduce((n, t) => n + t.rowsCopied, 0);
+      await source.close();
+      await target.close();
+      await swapIntoPlace(dbPath, staged, { keepOld: false });
+      return { rows, backupPath };
+    } catch (err) {
+      await source.close().catch(() => void 0);
+      await target.close().catch(() => void 0);
+      throw err;
+    }
+  } finally {
+    await engine.cleanup().catch(() => void 0);
+  }
+}
+async function materializeObsoleteColumns(target, sourceSchema) {
+  const added = [];
+  for (const table of sourceSchema.tables) {
+    const present = await targetColumns(target, table.schema, table.name);
+    if (present === null) continue;
+    for (const column of table.columns) {
+      if (present.has(column.name)) continue;
+      await target.exec(
+        `ALTER TABLE ${quote(table.schema)}.${quote(table.name)} ADD COLUMN ${quote(column.name)} ${column.type}`
+      );
+      added.push({ table: `${table.schema}.${table.name}`, name: column.name });
+    }
+  }
+  if (added.length > 0) {
+    console.error(
+      `Carrying over ${String(added.length)} column(s) from a removed feature so they can be verified, then discarding them: ${added.map((c) => `${c.table}.${c.name}`).join(", ")}`
+    );
+  }
+  return added;
+}
+async function dropObsoleteColumns(target, columns) {
+  for (const column of columns) {
+    const [schema, table] = column.table.split(".");
+    await target.exec(
+      `ALTER TABLE ${quote(schema)}.${quote(table)} DROP COLUMN ${quote(column.name)}`
+    );
+  }
+}
+async function targetColumns(target, schema, table) {
+  const { rows } = await target.query(
+    `SELECT column_name FROM information_schema.columns
+      WHERE table_schema = $1 AND table_name = $2`,
+    [schema, table]
+  );
+  return rows.length === 0 ? null : new Set(rows.map((r) => r.column_name));
+}
+function quote(identifier) {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+function summarize(validation) {
+  const failed = validation.tables.filter((t) => !t.ok).map((t) => t.table);
+  return failed.length > 0 ? failed.join(", ") : "sequence check";
+}
+function describe3(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function timestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+}
+function discard(staged) {
+  try {
+    rmSync(staged, { recursive: true, force: true });
+  } catch {
+  }
+}
+var DB_OPTIONS;
+var init_migrate_major = __esm({
+  "src/db/migrate-major.ts"() {
+    "use strict";
+    init_dist();
+    init_engines();
+    DB_OPTIONS = { database: "template1" };
+  }
+});
+
+// src/db/connection.ts
+import { PGlite as PGlite2 } from "@electric-sql/pglite";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, renameSync } from "fs";
+import { join as join7 } from "path";
 function setDataDir(dataDir) {
   currentDataDir = dataDir;
-  const dbDir = join3(dataDir, "data");
+  const dbDir = join7(dataDir, "data");
   mkdirSync3(dbDir, { recursive: true });
-  currentDbPath = join3(dbDir, "reviews");
+  currentDbPath = join7(dbDir, "reviews");
 }
 function getDataDir() {
   return currentDataDir;
 }
+function getDbPath() {
+  return currentDbPath;
+}
 async function getDb() {
   if (db) return db;
   if (currentDbPath === null) throw new Error("Data directory not set. Call setDataDir() first.");
   try {
-    db = new PGlite(currentDbPath, DB_OPTIONS);
+    db = new PGlite2(currentDbPath, DB_OPTIONS2);
     await db.waitReady;
     await initSchema(db);
     return db;
   } catch (err) {
     db = null;
-    const message = err instanceof Error ? err.message : String(err);
-    if (message.includes("Aborted") || message.includes("RuntimeError")) {
-      console.error("Database appears to be corrupt. Recreating...");
-      console.error("(Previous review data will be lost.)");
-      try {
-        rmSync(currentDbPath, { recursive: true, force: true });
-      } catch {
+    const migration = await migrateMajorIfNeeded(currentDbPath, initSchema);
+    if (migration.status === "migrated") {
+      console.error(
+        `Upgraded your database from PostgreSQL ${migration.fromMajor} to ${migration.toMajor} (${migration.rows} rows). A backup of the original is at: ${migration.backupPath}`
+      );
+      db = new PGlite2(currentDbPath, DB_OPTIONS2);
+      await db.waitReady;
+      await initSchema(db);
+      return db;
+    }
+    if (migration.status === "blocked") {
+      throw new Error(
+        `Your database was created by PostgreSQL ${migration.fromMajor}, which this version of Glassbox cannot open directly. A one-time upgrade is needed and it could not be completed.
+
+Reason: ${migration.reason}
+
+Your data has not been modified. If the reason above mentions the network or the registry, reconnect and start Glassbox again \u2014 the upgrade downloads the older database engine once.`,
+        { cause: err }
+      );
+    }
+    const message2 = err instanceof Error ? err.message : String(err);
+    if (message2.includes("Aborted") || message2.includes("RuntimeError")) {
+      const result = quarantineDataDir(currentDbPath);
+      if (!result.cleared) {
+        throw err;
       }
-      db = new PGlite(currentDbPath, DB_OPTIONS);
+      console.error("Database could not be opened. Starting a fresh one.");
+      if (result.movedTo !== null) {
+        console.error(`Your previous data has NOT been deleted \u2014 it is at: ${result.movedTo}`);
+      }
+      db = new PGlite2(currentDbPath, DB_OPTIONS2);
       await db.waitReady;
       await initSchema(db);
       return db;
@@ -16819,6 +18793,17 @@ async function getDb() {
     throw err;
   }
 }
+function quarantineDataDir(dbPath) {
+  if (!existsSync4(dbPath)) return { cleared: true, movedTo: null };
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const quarantined = `${dbPath}.unreadable-${stamp}`;
+  try {
+    renameSync(dbPath, quarantined);
+    return { cleared: true, movedTo: quarantined };
+  } catch {
+    return { cleared: false };
+  }
+}
 async function initSchema(db2) {
   await db2.exec(SCHEMA_CORE_SQL);
   await db2.exec(SCHEMA_AI_SQL);
@@ -16848,28 +18833,29 @@ async function addColumnIfMissing(db2, table, column, definition) {
     await db2.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
   }
 }
-var db, currentDbPath, currentDataDir, DB_OPTIONS;
+var db, currentDbPath, currentDataDir, DB_OPTIONS2;
 var init_connection = __esm({
   "src/db/connection.ts"() {
     "use strict";
     init_ddl();
+    init_migrate_major();
     db = null;
     currentDbPath = null;
     currentDataDir = null;
-    DB_OPTIONS = { database: "template1" };
+    DB_OPTIONS2 = { database: "template1" };
   }
 });
 
 // src/attachments/store.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename as basename2, join as join4 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename as basename3, join as join8 } from "path";
 function attachmentsDir() {
   const dataDir = getDataDir();
-  return dataDir === null ? null : join4(dataDir, "attachments");
+  return dataDir === null ? null : join8(dataDir, "attachments");
 }
 function sanitizeFilename(name) {
-  const base = basename2(name.replace(/\\/g, "/"));
+  const base = basename3(name.replace(/\\/g, "/"));
   const cleaned = base.replace(/[\x00-\x1f<>:"|?*/\\]/g, "").trim();
   return cleaned === "" ? "attachment" : cleaned.slice(0, 200);
 }
@@ -16877,14 +18863,14 @@ function writeAttachmentFile(id, originalFilename, bytes) {
   const dir = attachmentsDir();
   if (dir === null) throw new Error("No data directory for attachments");
   mkdirSync4(dir, { recursive: true });
-  const storedPath = join4(dir, `${id}-${sanitizeFilename(originalFilename)}`);
+  const storedPath = join8(dir, `${id}-${sanitizeFilename(originalFilename)}`);
   writeFileSync2(storedPath, bytes);
-  const sha256 = createHash2("sha256").update(bytes).digest("hex");
+  const sha256 = createHash4("sha256").update(bytes).digest("hex");
   return { storedPath, size: bytes.length, sha256 };
 }
 function deleteAttachmentFile(storedPath) {
   try {
-    if (existsSync3(storedPath)) rmSync2(storedPath, { force: true });
+    if (existsSync5(storedPath)) rmSync2(storedPath, { force: true });
   } catch {
   }
 }
@@ -17384,17 +19370,17 @@ var init_queries = __esm({
 });
 
 // src/global-config.ts
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { homedir } from "os";
-import { join as join5 } from "path";
+import { chmodSync, existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join9 } from "path";
 function resolveGlobalConfigDir() {
   const override = process.env.GLASSBOX_CONFIG_DIR;
   if (override !== void 0 && override.trim() !== "") return override;
-  return join5(homedir(), ".glassbox");
+  return join9(homedir3(), ".glassbox");
 }
 function readGlobalConfig() {
   try {
-    if (existsSync4(GLOBAL_CONFIG_PATH)) {
+    if (existsSync6(GLOBAL_CONFIG_PATH)) {
       const raw2 = JSON.parse(readFileSync4(GLOBAL_CONFIG_PATH, "utf-8"));
       const parsed = GlobalConfigSchema.safeParse(raw2);
       if (parsed.success) return parsed.data;
@@ -17423,7 +19409,7 @@ var init_global_config = __esm({
     init_zod();
     GlobalConfigSchema = external_exports.record(external_exports.string(), external_exports.unknown());
     GLOBAL_CONFIG_DIR = resolveGlobalConfigDir();
-    GLOBAL_CONFIG_PATH = join5(GLOBAL_CONFIG_DIR, "config.json");
+    GLOBAL_CONFIG_PATH = join9(GLOBAL_CONFIG_DIR, "config.json");
   }
 });
 
@@ -17562,10 +19548,10 @@ __export(image_blobs_exports, {
   readImageBlob: () => readImageBlob,
   writeImageBlob: () => writeImageBlob
 });
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
 function blobDir(dataDir) {
-  return join6(dataDir, "image-blobs");
+  return join10(dataDir, "image-blobs");
 }
 function blobName(fileId, side) {
   return `${fileId.replace(/[^a-z0-9]/gi, "")}-${side}`;
@@ -17574,11 +19560,11 @@ function writeImageBlob(dataDir, fileId, side, bytes) {
   if (bytes.length === 0) return;
   const dir = blobDir(dataDir);
   mkdirSync6(dir, { recursive: true });
-  writeFileSync4(join6(dir, blobName(fileId, side)), bytes);
+  writeFileSync4(join10(dir, blobName(fileId, side)), bytes);
 }
 function readImageBlob(dataDir, fileId, side) {
-  const path = join6(blobDir(dataDir), blobName(fileId, side));
-  if (!existsSync5(path)) return null;
+  const path = join10(blobDir(dataDir), blobName(fileId, side));
+  if (!existsSync7(path)) return null;
   try {
     return readFileSync5(path);
   } catch {
@@ -17680,15 +19666,15 @@ var init_project_settings = __esm({
 });
 
 // src/project-settings-store.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
+import { join as join15 } from "path";
 function settingsPath(repoRoot) {
-  return join11(repoRoot, ".glassbox", "settings.json");
+  return join15(repoRoot, ".glassbox", "settings.json");
 }
 function readProjectSettings(repoRoot) {
   try {
     const path = settingsPath(repoRoot);
-    if (existsSync10(path)) {
+    if (existsSync12(path)) {
       const raw2 = JSON.parse(readFileSync10(path, "utf-8"));
       const parsed = ProjectSettingsSchema.safeParse(raw2);
       if (parsed.success) return parsed.data;
@@ -17701,9 +19687,9 @@ function updateProjectSettings2(repoRoot, mutator) {
   const current = readProjectSettings(repoRoot);
   const result = mutator(current);
   const next = result === void 0 ? current : result;
-  const dir = join11(repoRoot, ".glassbox");
+  const dir = join15(repoRoot, ".glassbox");
   mkdirSync8(dir, { recursive: true });
-  writeFileSync9(join11(dir, "settings.json"), JSON.stringify(next, null, 2), "utf-8");
+  writeFileSync9(join15(dir, "settings.json"), JSON.stringify(next, null, 2), "utf-8");
 }
 var init_project_settings_store = __esm({
   "src/project-settings-store.ts"() {
@@ -17922,7 +19908,7 @@ function pickBest(handlers, input) {
   return best;
 }
 var ContentPluginRegistry;
-var init_registry = __esm({
+var init_registry2 = __esm({
   "src/plugins/registry.ts"() {
     "use strict";
     ContentPluginRegistry = class {
@@ -18057,9 +20043,9 @@ var init_settings = __esm({
 });
 
 // src/plugins/loader.ts
-import { existsSync as existsSync11, readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync3 } from "fs";
-import { join as join12 } from "path";
-import { pathToFileURL } from "url";
+import { existsSync as existsSync13, readdirSync as readdirSync2, readFileSync as readFileSync11, statSync as statSync3 } from "fs";
+import { join as join16 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
 function getConfigLabelOverride(pluginId, labelId) {
   return configLabelOverrides.get(`${pluginId}:${labelId}`);
 }
@@ -18079,10 +20065,10 @@ function clearAllPluginUIElements() {
   pluginUIElements.clear();
 }
 function pluginsDir() {
-  return join12(GLOBAL_CONFIG_DIR, "plugins");
+  return join16(GLOBAL_CONFIG_DIR, "plugins");
 }
 function discoverPluginDirs(root = pluginsDir()) {
-  if (!existsSync11(root)) return [];
+  if (!existsSync13(root)) return [];
   let entries;
   try {
     entries = readdirSync2(root);
@@ -18092,7 +20078,7 @@ function discoverPluginDirs(root = pluginsDir()) {
   const out = [];
   for (const name of entries) {
     if (name.startsWith(".")) continue;
-    const dir = join12(root, name);
+    const dir = join16(root, name);
     try {
       if (statSync3(dir).isDirectory()) out.push(dir);
     } catch {
@@ -18101,16 +20087,16 @@ function discoverPluginDirs(root = pluginsDir()) {
   return out.sort();
 }
 function readManifest(dir) {
-  const manifestPath = join12(dir, "manifest.json");
-  if (existsSync11(manifestPath)) {
+  const manifestPath = join16(dir, "manifest.json");
+  if (existsSync13(manifestPath)) {
     try {
       return parseManifest(JSON.parse(readFileSync11(manifestPath, "utf-8")));
     } catch {
       return null;
     }
   }
-  const pkgPath = join12(dir, "package.json");
-  if (existsSync11(pkgPath)) {
+  const pkgPath = join16(dir, "package.json");
+  if (existsSync13(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
       const gb = pkg.glassbox;
@@ -18126,8 +20112,8 @@ function readManifest(dir) {
 function makeContext(manifest, repoRoot) {
   const id = manifest.id;
   return {
-    log: (level, message) => {
-      const line = `[plugin:${id}] ${message}`;
+    log: (level, message2) => {
+      const line = `[plugin:${id}] ${message2}`;
       if (level === "error") console.error(line);
       else if (level === "warn") console.warn(line);
       else console.log(line);
@@ -18155,9 +20141,9 @@ async function loadPluginDir(dir, registry3, isEnabled = ALWAYS_ENABLED, repoRoo
     return { id: manifest.id, dir, manifest, status: "disabled", disabledScope: enablement.scope };
   }
   try {
-    const entry = join12(dir, manifest.entry ?? "index.js");
-    if (!existsSync11(entry)) throw new Error(`entry not found: ${manifest.entry ?? "index.js"}`);
-    const mod = await import(pathToFileURL(entry).href);
+    const entry = join16(dir, manifest.entry ?? "index.js");
+    if (!existsSync13(entry)) throw new Error(`entry not found: ${manifest.entry ?? "index.js"}`);
+    const mod = await import(pathToFileURL2(entry).href);
     const plugin = mod.default ?? (typeof mod.activate === "function" ? { activate: mod.activate, onAction: mod.onAction } : void 0);
     if (plugin === void 0 || typeof plugin.activate !== "function") {
       throw new Error("plugin exports no activate()");
@@ -18190,7 +20176,7 @@ var init_loader = __esm({
     init_feature_flags();
     init_global_config();
     init_manifest2();
-    init_registry();
+    init_registry2();
     init_settings();
     configLabelOverrides = /* @__PURE__ */ new Map();
     pluginUIElements = /* @__PURE__ */ new Map();
@@ -18199,22 +20185,22 @@ var init_loader = __esm({
 });
 
 // src/plugins/install.ts
-import { createHash as createHash3 } from "crypto";
-import { cpSync, existsSync as existsSync12, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync12, rmSync as rmSync6, statSync as statSync4, symlinkSync, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname8, join as join13 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { cpSync, existsSync as existsSync14, mkdirSync as mkdirSync9, readdirSync as readdirSync3, readFileSync as readFileSync12, rmSync as rmSync6, statSync as statSync4, symlinkSync, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname10, join as join17 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function dismissedPathFor(userDir) {
-  return join13(dirname8(userDir), DISMISSED_FILE);
+  return join17(dirname10(userDir), DISMISSED_FILE);
 }
 function bundledPluginsDir() {
   const override = process.env.GLASSBOX_BUNDLED_PLUGINS_DIR;
   if (override !== void 0 && override.trim() !== "") return override;
-  const sibling = join13(dirname8(fileURLToPath3(import.meta.url)), "plugins");
-  if (existsSync12(sibling)) return sibling;
-  return join13(process.cwd(), "dist", "plugins");
+  const sibling = join17(dirname10(fileURLToPath3(import.meta.url)), "plugins");
+  if (existsSync14(sibling)) return sibling;
+  return join17(process.cwd(), "dist", "plugins");
 }
 function discoverBundledPlugins(bundledDir = bundledPluginsDir()) {
-  if (!existsSync12(bundledDir)) return [];
+  if (!existsSync14(bundledDir)) return [];
   let entries;
   try {
     entries = readdirSync3(bundledDir);
@@ -18223,7 +20209,7 @@ function discoverBundledPlugins(bundledDir = bundledPluginsDir()) {
   }
   const out = [];
   for (const name of entries.sort()) {
-    const dir = join13(bundledDir, name);
+    const dir = join17(bundledDir, name);
     try {
       if (!statSync4(dir).isDirectory()) continue;
       const manifest = readManifest(dir);
@@ -18243,14 +20229,14 @@ function readDismissed(userDir = pluginsDir()) {
 }
 function writeDismissed(ids, userDir) {
   const path = dismissedPathFor(userDir);
-  mkdirSync9(dirname8(path), { recursive: true });
+  mkdirSync9(dirname10(path), { recursive: true });
   writeFileSync10(path, JSON.stringify([...new Set(ids)], null, 2), "utf-8");
 }
 function hashPluginDir(dir) {
-  const h = createHash3("sha1");
+  const h = createHash5("sha1");
   const walk = (d, rel) => {
     for (const name of readdirSync3(d).sort()) {
-      const abs = join13(d, name);
+      const abs = join17(d, name);
       const r = rel === "" ? name : `${rel}/${name}`;
       if (statSync4(abs).isDirectory()) walk(abs, r);
       else {
@@ -18263,7 +20249,7 @@ function hashPluginDir(dir) {
   return h.digest("hex");
 }
 function shouldInstall(src, dest, bundledVersion) {
-  if (!existsSync12(dest)) return true;
+  if (!existsSync14(dest)) return true;
   const destManifest = readManifest(dest);
   const destVersion = destManifest?.version ?? "0";
   const cmp = compareVersions(bundledVersion, destVersion);
@@ -18278,7 +20264,7 @@ function shouldInstall(src, dest, bundledVersion) {
 function installBundledPlugins(opts) {
   const bundledDir = opts?.bundledDir ?? bundledPluginsDir();
   const userDir = opts?.userDir ?? pluginsDir();
-  if (!existsSync12(bundledDir)) return;
+  if (!existsSync14(bundledDir)) return;
   const dismissed = new Set(readDismissed(userDir));
   let entries;
   try {
@@ -18287,13 +20273,13 @@ function installBundledPlugins(opts) {
     return;
   }
   for (const name of entries) {
-    const src = join13(bundledDir, name);
+    const src = join17(bundledDir, name);
     try {
       if (!statSync4(src).isDirectory()) continue;
       const manifest = readManifest(src);
       if (manifest === null || dismissed.has(manifest.id)) continue;
       if (manifest.autoInstall === false) continue;
-      const dest = join13(userDir, manifest.id);
+      const dest = join17(userDir, manifest.id);
       if (!shouldInstall(src, dest, manifest.version)) continue;
       mkdirSync9(userDir, { recursive: true });
       rmSync6(dest, { recursive: true, force: true });
@@ -18307,7 +20293,7 @@ function installPluginFromDisk(sourceDir, opts) {
   if (manifest === null) throw new Error("The selected folder is not a Glassbox plugin (no manifest.json).");
   const userDir = opts?.userDir ?? pluginsDir();
   mkdirSync9(userDir, { recursive: true });
-  const dest = join13(userDir, manifest.id);
+  const dest = join17(userDir, manifest.id);
   rmSync6(dest, { recursive: true, force: true });
   try {
     symlinkSync(sourceDir, dest, "dir");
@@ -18322,7 +20308,7 @@ function undismissPlugin(id, userDir = pluginsDir()) {
 }
 function uninstallPlugin(id, opts) {
   const userDir = opts?.userDir ?? pluginsDir();
-  rmSync6(join13(userDir, id), { recursive: true, force: true });
+  rmSync6(join17(userDir, id), { recursive: true, force: true });
   writeDismissed([...readDismissed(userDir), id], userDir);
 }
 var DISMISSED_FILE;
@@ -18633,7 +20619,7 @@ var init_plugins = __esm({
     init_enablement();
     init_install();
     init_loader();
-    init_registry();
+    init_registry2();
     init_settings();
     init_svgSize();
     init_hooks();
@@ -18737,17 +20723,17 @@ __export(difftool_discovery_exports, {
   tryAcquireStartingLock: () => tryAcquireStartingLock,
   writeDiscovery: () => writeDiscovery
 });
-import { existsSync as existsSync19, mkdirSync as mkdirSync16, readFileSync as readFileSync23, rmSync as rmSync7, statSync as statSync7, writeFileSync as writeFileSync16 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join24 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync16, readFileSync as readFileSync23, rmSync as rmSync8, statSync as statSync8, writeFileSync as writeFileSync16 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join31 } from "path";
 function difftoolHome() {
-  return join24(homedir3(), ".glassbox");
+  return join31(homedir5(), ".glassbox");
 }
 function discoveryPath(home = difftoolHome()) {
-  return join24(home, "difftool.lock");
+  return join31(home, "difftool.lock");
 }
 function startingLockPath(home = difftoolHome()) {
-  return join24(home, "difftool-starting.lock");
+  return join31(home, "difftool-starting.lock");
 }
 function parseDiscovery(raw2) {
   let parsed;
@@ -18761,7 +20747,7 @@ function parseDiscovery(raw2) {
 }
 function readDiscovery(home = difftoolHome()) {
   const path = discoveryPath(home);
-  if (!existsSync19(path)) return null;
+  if (!existsSync21(path)) return null;
   try {
     return parseDiscovery(readFileSync23(path, "utf-8"));
   } catch {
@@ -18774,7 +20760,7 @@ function writeDiscovery(port, home = difftoolHome()) {
 }
 function clearDiscovery(home = difftoolHome()) {
   try {
-    rmSync7(discoveryPath(home), { force: true });
+    rmSync8(discoveryPath(home), { force: true });
   } catch {
   }
 }
@@ -18786,9 +20772,9 @@ function tryAcquireStartingLock(home = difftoolHome()) {
     return true;
   } catch {
     try {
-      const ageMs = Date.now() - statSync7(path).mtimeMs;
+      const ageMs = Date.now() - statSync8(path).mtimeMs;
       if (ageMs > STARTING_LOCK_STALE_MS) {
-        rmSync7(path, { force: true });
+        rmSync8(path, { force: true });
         writeFileSync16(path, String(process.pid), { flag: "wx" });
         return true;
       }
@@ -18799,7 +20785,7 @@ function tryAcquireStartingLock(home = difftoolHome()) {
 }
 function releaseStartingLock(home = difftoolHome()) {
   try {
-    rmSync7(startingLockPath(home), { force: true });
+    rmSync8(startingLockPath(home), { force: true });
   } catch {
   }
 }
@@ -20692,10 +22678,10 @@ var require_decoder = __commonJS({
           if (frames.length != 1)
             throw new Error("only single frame JPEGs supported");
           for (var i = 0; i < frames.length; i++) {
-            var cp = frames[i].components;
-            for (var j in cp) {
-              cp[j].quantizationTable = quantizationTables[cp[j].quantizationIdx];
-              delete cp[j].quantizationIdx;
+            var cp2 = frames[i].components;
+            for (var j in cp2) {
+              cp2[j].quantizationTable = quantizationTables[cp2[j].quantizationIdx];
+              delete cp2[j].quantizationIdx;
             }
           }
           this.width = frame.samplesPerLine;
@@ -23332,9 +25318,9 @@ var init_perceptual_diff = __esm({
 });
 
 // src/cli.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync17, realpathSync, statSync as statSync8 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { basename as basename5, join as join25, resolve as resolve12 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync17, realpathSync, statSync as statSync9 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { basename as basename7, join as join32, resolve as resolve14 } from "path";
 
 // src/cli-subcommands.ts
 import { resolve as resolve3 } from "path";
@@ -24455,9 +26441,9 @@ async function setupReviewNoteReply(fileIdMap) {
 
 // src/git/diff.ts
 init_zod();
-import { existsSync as existsSync6, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
-import { tmpdir } from "os";
-import { basename as basename3, dirname as dirname5, join as join7, resolve as resolve4 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync4, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename4, dirname as dirname7, join as join11, resolve as resolve6 } from "path";
 
 // src/git/parseDiff.ts
 init_lfs();
@@ -24688,9 +26674,9 @@ function getDiffArgs(mode) {
 function directComparisonRoots(mode) {
   const rootOf = (p) => {
     try {
-      return statSync2(p).isDirectory() ? p : dirname5(p);
+      return statSync2(p).isDirectory() ? p : dirname7(p);
     } catch {
-      return dirname5(p);
+      return dirname7(p);
     }
   };
   return { rootA: rootOf(mode.pathA), rootB: rootOf(mode.pathB) };
@@ -24718,14 +26704,14 @@ function getDirectComparisonFiles(mode, cwd) {
 function diffRawContent(displayPath, oldContent, newContent) {
   const rel = displayPath.replace(/\\/g, "/").replace(/^\/+/, "").replace(/(^|\/)\.\.(?=\/|$)/g, "$1_");
   const safeRel = rel === "" ? "file" : rel;
-  const work = mkdtempSync(join7(tmpdir(), "glassbox-difftool-append-"));
-  const rootA = join7(work, "a");
-  const rootB = join7(work, "b");
-  const oldAbs = join7(rootA, safeRel);
-  const newAbs = join7(rootB, safeRel);
+  const work = mkdtempSync(join11(tmpdir3(), "glassbox-difftool-append-"));
+  const rootA = join11(work, "a");
+  const rootB = join11(work, "b");
+  const oldAbs = join11(rootA, safeRel);
+  const newAbs = join11(rootB, safeRel);
   try {
-    mkdirSync7(dirname5(oldAbs), { recursive: true });
-    mkdirSync7(dirname5(newAbs), { recursive: true });
+    mkdirSync7(dirname7(oldAbs), { recursive: true });
+    mkdirSync7(dirname7(newAbs), { recursive: true });
     writeFileSync5(oldAbs, oldContent);
     writeFileSync5(newAbs, newContent);
     const rawDiff = gitOrEmpty(["diff", "--no-index", "-U3", toGitArg(oldAbs), toGitArg(newAbs)], work);
@@ -24789,7 +26775,7 @@ function getAllFiles(repoRoot) {
 function createNewFileDiff(filePath, repoRoot) {
   let content;
   try {
-    const buf = readFileSync6(resolve4(repoRoot, filePath));
+    const buf = readFileSync6(resolve6(repoRoot, filePath));
     const checkLen = Math.min(buf.length, 8192);
     for (let i = 0; i < checkLen; i++) {
       if (buf[i] === 0) {
@@ -24825,7 +26811,7 @@ function getFileContent(filePath, ref, cwd) {
   const repoRoot = getRepoRoot(cwd);
   try {
     if (ref === "working") {
-      return readFileSync6(resolve4(repoRoot, filePath), "utf-8");
+      return readFileSync6(resolve6(repoRoot, filePath), "utf-8");
     }
     return git(["show", `${ref}:${filePath}`], repoRoot);
   } catch {
@@ -24835,7 +26821,7 @@ function getFileContent(filePath, ref, cwd) {
 function getModeFileContent(mode, filePath, side, cwd) {
   if (mode.type === "diff") {
     const { rootA, rootB } = directComparisonRoots(mode);
-    const abs = join7(side === "old" ? rootA : rootB, filePath);
+    const abs = join11(side === "old" ? rootA : rootB, filePath);
     try {
       return readFileSync6(abs, "utf-8");
     } catch {
@@ -24882,9 +26868,9 @@ function getSingleFileDiff(mode, filePath, repoRoot, extraFlags = "") {
   if (mode.type === "ground-truth") return null;
   if (mode.type === "diff") {
     const { rootA, rootB } = directComparisonRoots(mode);
-    const oldAbs = join7(rootA, filePath);
-    const newAbs = join7(rootB, filePath);
-    if (!existsSync6(oldAbs) || !existsSync6(newAbs)) return null;
+    const oldAbs = join11(rootA, filePath);
+    const newAbs = join11(rootB, filePath);
+    if (!existsSync8(oldAbs) || !existsSync8(newAbs)) return null;
     const args2 = ["diff", "--no-index", "-U3"];
     if (extraFlags) args2.push(...extraFlags.split(" ").filter(Boolean));
     args2.push(toGitArg(oldAbs), toGitArg(newAbs));
@@ -24937,9 +26923,9 @@ function getModeArgs(mode) {
     // A short, human-readable label for the sidebar/history. Full path
     // disambiguation lives in the mode string, so basenames are fine here.
     case "diff":
-      return `${basename3(mode.pathA)} \u2194 ${basename3(mode.pathB)}`;
+      return `${basename4(mode.pathA)} \u2194 ${basename4(mode.pathB)}`;
     case "ground-truth":
-      return basename3(mode.manifestPath);
+      return basename4(mode.manifestPath);
     case "uncommitted":
     case "staged":
     case "unstaged":
@@ -24949,8 +26935,8 @@ function getModeArgs(mode) {
 }
 
 // src/git/gitignore.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename4, dirname as dirname6, join as join8 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename5, dirname as dirname8, join as join12 } from "path";
 var GLASSBOX_GITIGNORE_LINES = ["/.glassbox/*", "!/.glassbox/settings.json"];
 function isGlassboxPattern(token) {
   const core = token.replace(/^!/, "").replace(/^\//, "").trim();
@@ -25000,11 +26986,11 @@ function computeGitignore(existing) {
   return { changed: true, content };
 }
 function ensureGlassboxGitignored(glassboxDir) {
-  if (basename4(glassboxDir) !== ".glassbox") return { changed: false };
-  const targetDir = dirname6(glassboxDir);
+  if (basename5(glassboxDir) !== ".glassbox") return { changed: false };
+  const targetDir = dirname8(glassboxDir);
   if (!isGitRepo(targetDir)) return { changed: false };
-  const gitignorePath = join8(targetDir, ".gitignore");
-  const existing = existsSync7(gitignorePath) ? readFileSync7(gitignorePath, "utf-8") : null;
+  const gitignorePath = join12(targetDir, ".gitignore");
+  const existing = existsSync9(gitignorePath) ? readFileSync7(gitignorePath, "utf-8") : null;
   const { changed, content } = computeGitignore(existing);
   if (changed) writeFileSync6(gitignorePath, content, "utf-8");
   return { changed };
@@ -25012,13 +26998,13 @@ function ensureGlassboxGitignored(glassboxDir) {
 
 // src/lock.ts
 init_zod();
-import { existsSync as existsSync8, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join13 } from "path";
 var lockPath = null;
 var LockFileSchema = external_exports.object({ pid: external_exports.number().int() });
 function acquireLock(dataDir) {
-  lockPath = join9(dataDir, "glassbox.lock");
-  if (existsSync8(lockPath)) {
+  lockPath = join13(dataDir, "glassbox.lock");
+  if (existsSync10(lockPath)) {
     try {
       const raw2 = JSON.parse(readFileSync8(lockPath, "utf-8"));
       const contents = LockFileSchema.parse(raw2);
@@ -25190,15 +27176,15 @@ async function updateReviewDiffs(reviewId, newDiffs, headCommit) {
 
 // src/server.ts
 import { serve } from "@hono/node-server";
-import { existsSync as existsSync16, readFileSync as readFileSync20 } from "fs";
-import { Hono as Hono21 } from "hono";
-import { dirname as dirname9, join as join21 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync20 } from "fs";
+import { Hono as Hono22 } from "hono";
+import { dirname as dirname12, join as join28 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
 // src/channel-config.ts
 init_zod();
-import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join10, resolve as resolve5 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname9, join as join14, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var MCP_SERVER_KEY = "glassbox-channel";
 var McpConfigSchema = external_exports.object({
@@ -25206,13 +27192,13 @@ var McpConfigSchema = external_exports.object({
 }).loose();
 var HealthResponseSchema = external_exports.object({ ok: external_exports.boolean() });
 function getChannelServerPath() {
-  const thisDir = dirname7(fileURLToPath2(import.meta.url));
-  const distPath = resolve5(thisDir, "channel.js");
-  if (existsSync9(distPath)) {
+  const thisDir = dirname9(fileURLToPath2(import.meta.url));
+  const distPath = resolve7(thisDir, "channel.js");
+  if (existsSync11(distPath)) {
     return { command: process.execPath, args: [distPath] };
   }
-  const srcPath = resolve5(thisDir, "channel.ts");
-  if (existsSync9(srcPath)) {
+  const srcPath = resolve7(thisDir, "channel.ts");
+  if (existsSync11(srcPath)) {
     return { command: "npx", args: ["tsx", srcPath] };
   }
   return { command: process.execPath, args: [distPath] };
@@ -25222,10 +27208,10 @@ function projectRoot(dataDir) {
 }
 function registerChannel(dataDir) {
   const root = projectRoot(dataDir);
-  const mcpPath = join10(root, ".mcp.json");
+  const mcpPath = join14(root, ".mcp.json");
   const { command, args } = getChannelServerPath();
   let config2 = {};
-  if (existsSync9(mcpPath)) {
+  if (existsSync11(mcpPath)) {
     try {
       const raw2 = JSON.parse(readFileSync9(mcpPath, "utf-8"));
       const parsed = McpConfigSchema.safeParse(raw2);
@@ -25242,8 +27228,8 @@ function registerChannel(dataDir) {
 }
 function unregisterChannel(dataDir) {
   const root = projectRoot(dataDir);
-  const mcpPath = join10(root, ".mcp.json");
-  if (!existsSync9(mcpPath)) return;
+  const mcpPath = join14(root, ".mcp.json");
+  if (!existsSync11(mcpPath)) return;
   try {
     const raw2 = JSON.parse(readFileSync9(mcpPath, "utf-8"));
     const parsed = McpConfigSchema.safeParse(raw2);
@@ -25260,7 +27246,7 @@ function unregisterChannel(dataDir) {
 }
 function getChannelPort(dataDir) {
   try {
-    const portStr = readFileSync9(join10(dataDir, "channel-port"), "utf-8").trim();
+    const portStr = readFileSync9(join14(dataDir, "channel-port"), "utf-8").trim();
     const port = parseInt(portStr, 10);
     return isNaN(port) ? null : port;
   } catch {
@@ -25281,13 +27267,13 @@ async function isChannelAlive(dataDir) {
 }
 function getChannelSecret(dataDir) {
   try {
-    const secret = readFileSync9(join10(dataDir, "channel-secret"), "utf-8").trim();
+    const secret = readFileSync9(join14(dataDir, "channel-secret"), "utf-8").trim();
     return secret === "" ? null : secret;
   } catch {
     return null;
   }
 }
-async function triggerChannel(dataDir, message) {
+async function triggerChannel(dataDir, message2) {
   const port = getChannelPort(dataDir);
   const secret = getChannelSecret(dataDir);
   if (port === null || secret === null) return false;
@@ -25295,7 +27281,7 @@ async function triggerChannel(dataDir, message) {
     const res = await fetch(`http://127.0.0.1:${port}/trigger`, {
       method: "POST",
       headers: { "X-Glassbox-Secret": secret },
-      body: message
+      body: message2
     });
     return res.ok;
   } catch {
@@ -26172,8 +28158,8 @@ function isRetriable(err) {
   return msg.includes("429") || msg.includes("500") || msg.includes("502") || msg.includes("503") || msg.includes("504") || msg.includes("rate_limit");
 }
 function sleep(ms) {
-  return new Promise((resolve13) => {
-    setTimeout(resolve13, ms);
+  return new Promise((resolve15) => {
+    setTimeout(resolve15, ms);
   });
 }
 
@@ -26217,8 +28203,8 @@ function randomLines(count) {
   return lines.sort((a, b) => a.line - b.line);
 }
 function sleep2(ms) {
-  return new Promise((resolve13) => {
-    setTimeout(resolve13, ms);
+  return new Promise((resolve15) => {
+    setTimeout(resolve15, ms);
   });
 }
 async function mockRiskAnalysisBatch(files) {
@@ -26348,10 +28334,10 @@ async function executeAnalysis(input) {
     debugLog(`Analysis ${analysisId} completed successfully`);
     await updateAnalysisStatus(analysisId, "completed");
   } catch (err) {
-    const message = err instanceof Error ? err.message : "Unknown error";
-    console.error(`Analysis failed: ${message}`);
-    debugLog(`Analysis ${analysisId} failed: ${message}`);
-    await updateAnalysisStatus(analysisId, "failed", message);
+    const message2 = err instanceof Error ? err.message : "Unknown error";
+    console.error(`Analysis failed: ${message2}`);
+    debugLog(`Analysis ${analysisId} failed: ${message2}`);
+    await updateAnalysisStatus(analysisId, "failed", message2);
   } finally {
     canceledAnalyses.delete(analysisId);
   }
@@ -28126,8 +30112,8 @@ function requireSlugParam(c, name) {
   }
   return value;
 }
-function errorResponse(c, message, status = 400) {
-  return c.json({ error: message }, status);
+function errorResponse(c, message2, status = 400) {
+  return c.json({ error: message2 }, status);
 }
 
 // src/utils/resolveReviewId.ts
@@ -28508,7 +30494,7 @@ aiApiRoutes.route("/", aiConfigRoutes);
 aiApiRoutes.route("/", aiAnalysisRoutes);
 
 // src/routes/api.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono17 } from "hono";
 
 // src/routes/api/annotations.ts
 import { Hono as Hono4 } from "hono";
@@ -28518,8 +30504,8 @@ init_queries();
 init_attachment_queries();
 init_queries();
 init_schemas3();
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync13, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync13, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "fs";
+import { join as join18 } from "path";
 init_image_metadata();
 
 // src/utils/formatReviewMode.ts
@@ -28814,10 +30800,10 @@ function buildReviewMarkdown(args) {
 
 // src/export/generate.ts
 function deleteReviewExport(reviewId, repoRoot) {
-  const exportDir = join14(repoRoot, ".glassbox");
+  const exportDir = join18(repoRoot, ".glassbox");
   for (const ext of ["md", "json"]) {
-    const archivePath = join14(exportDir, `review-${reviewId}.${ext}`);
-    if (existsSync13(archivePath)) unlinkSync2(archivePath);
+    const archivePath = join18(exportDir, `review-${reviewId}.${ext}`);
+    if (existsSync15(archivePath)) unlinkSync2(archivePath);
   }
 }
 function annotationAnchorLabel(a) {
@@ -28844,7 +30830,7 @@ async function generateReviewExport(reviewId, repoRoot, isCurrent) {
   if (!review) throw new Error("Review not found");
   const files = await getReviewFiles(reviewId);
   const annotations = await getAnnotationsForReview(reviewId);
-  const exportDir = join14(repoRoot, ".glassbox");
+  const exportDir = join18(repoRoot, ".glassbox");
   mkdirSync10(exportDir, { recursive: true });
   const modeLabel = formatReviewMode(review.mode, review.mode_args);
   const exportDate = (/* @__PURE__ */ new Date()).toISOString();
@@ -28877,13 +30863,13 @@ async function generateReviewExport(reviewId, repoRoot, isCurrent) {
     resolveDims: resolveImageDims
   });
   const json2 = JSON.stringify(exportData, null, 2);
-  const archivePath = join14(exportDir, `review-${review.id}.md`);
+  const archivePath = join18(exportDir, `review-${review.id}.md`);
   writeFileSync11(archivePath, content, "utf-8");
-  writeFileSync11(join14(exportDir, `review-${review.id}.json`), json2, "utf-8");
+  writeFileSync11(join18(exportDir, `review-${review.id}.json`), json2, "utf-8");
   if (isCurrent) {
-    const latestPath = join14(exportDir, "latest-review.md");
+    const latestPath = join18(exportDir, "latest-review.md");
     writeFileSync11(latestPath, content, "utf-8");
-    writeFileSync11(join14(exportDir, "latest-review.json"), json2, "utf-8");
+    writeFileSync11(join18(exportDir, "latest-review.json"), json2, "utf-8");
     return latestPath;
   }
   return archivePath;
@@ -29049,7 +31035,7 @@ function mimeForFilename(filename) {
 
 // src/utils/openOS.ts
 import { execFileSync, spawn } from "child_process";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve8 } from "path";
 function openOS(target, mode) {
   if (mode === "quicklook") {
     if (process.platform === "darwin") {
@@ -29077,7 +31063,7 @@ function openOS(target, mode) {
     } else if (process.platform === "win32") {
       launchDetached("explorer", ["/select," + target]);
     } else {
-      launchDetached("xdg-open", [resolve6(target, "..")]);
+      launchDetached("xdg-open", [resolve8(target, "..")]);
     }
     return;
   }
@@ -29161,8 +31147,8 @@ attachmentsRoutes.get("/attachments/:id/raw", async (c) => {
   const attachment = await getAttachment(idParam.data);
   if (attachment === void 0) return c.text("Not found", 404);
   try {
-    const stat = statSync5(attachment.stored_path);
-    if (!stat.isFile()) return c.text("Not found", 404);
+    const stat4 = statSync5(attachment.stored_path);
+    if (!stat4.isFile()) return c.text("Not found", 404);
     const bytes = readFileSync14(attachment.stored_path);
     const asciiName = attachment.original_filename.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_");
     const utf8Name = encodeURIComponent(attachment.original_filename);
@@ -29230,9 +31216,130 @@ contextRoutes.get("/context/:fileId", async (c) => {
   return c.json({ lines });
 });
 
-// src/routes/api/files.ts
+// src/routes/api/db-backups.ts
 import { Hono as Hono7 } from "hono";
-import { resolve as resolve7 } from "path";
+
+// src/db/backups.ts
+import { readdirSync as readdirSync4, rmSync as rmSync7, statSync as statSync6 } from "fs";
+import { basename as basename6, dirname as dirname11, join as join19 } from "path";
+var BACKUP_PREFIX = ".bak-";
+var QUARANTINE_PREFIX = ".unreadable-";
+function listDatabaseBackups(dbPath) {
+  return listWithPrefix(dbPath, BACKUP_PREFIX);
+}
+function listQuarantinedDirectories(dbPath) {
+  return listWithPrefix(dbPath, QUARANTINE_PREFIX);
+}
+function resolvePreservedDirectory(dbPath, name) {
+  if (!isPreservedName(dbPath, name)) return null;
+  const target = join19(dirname11(dbPath), name);
+  try {
+    return statSync6(target).isDirectory() ? target : null;
+  } catch {
+    return null;
+  }
+}
+function listWithPrefix(dbPath, prefix) {
+  const parent = dirname11(dbPath);
+  const full = `${basename6(dbPath)}${prefix}`;
+  let entries;
+  try {
+    entries = readdirSync4(parent);
+  } catch {
+    return [];
+  }
+  return entries.filter((name) => name.startsWith(full)).map((name) => {
+    const path = join19(parent, name);
+    return {
+      name,
+      path,
+      bytes: directorySize(path),
+      createdAt: parseStamp(name.slice(full.length))
+    };
+  }).sort((a, b) => a.name < b.name ? 1 : -1);
+}
+function isPreservedName(dbPath, name) {
+  if (name !== basename6(name)) return false;
+  const stem = basename6(dbPath);
+  return name.startsWith(`${stem}${BACKUP_PREFIX}`) || name.startsWith(`${stem}${QUARANTINE_PREFIX}`);
+}
+function deleteDatabaseBackup(dbPath, name) {
+  const prefix = `${basename6(dbPath)}${BACKUP_PREFIX}`;
+  if (!name.startsWith(prefix)) return false;
+  if (name !== basename6(name)) return false;
+  const target = join19(dirname11(dbPath), name);
+  try {
+    if (!statSync6(target).isDirectory()) return false;
+    rmSync7(target, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function directorySize(path) {
+  let total = 0;
+  let entries;
+  try {
+    entries = readdirSync4(path);
+  } catch {
+    return 0;
+  }
+  for (const entry of entries) {
+    const child = join19(path, entry);
+    try {
+      const stat4 = statSync6(child);
+      total += stat4.isDirectory() ? directorySize(child) : stat4.size;
+    } catch {
+    }
+  }
+  return total;
+}
+function parseStamp(suffix) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})T(\d{2})-(\d{2})-(\d{2})[.-](\d{3})Z$/.exec(suffix);
+  if (m === null) return null;
+  const [, y, mo, d, h, mi, s, ms] = m;
+  const iso = `${y}-${mo}-${d}T${h}:${mi}:${s}.${ms}Z`;
+  return Number.isNaN(Date.parse(iso)) ? null : iso;
+}
+
+// src/routes/api/db-backups.ts
+init_connection();
+var dbBackupRoutes = new Hono7();
+dbBackupRoutes.get("/db-backups", (c) => {
+  const dbPath = getDbPath();
+  if (dbPath === null) return c.json({ backups: [], quarantined: [] });
+  return c.json({
+    backups: listDatabaseBackups(dbPath),
+    quarantined: listQuarantinedDirectories(dbPath)
+  });
+});
+dbBackupRoutes.delete("/db-backups/:name", (c) => {
+  const name = requireSlugParam(c, "name");
+  if (!name.ok) return name.response;
+  const dbPath = getDbPath();
+  if (dbPath === null) return errorResponse(c, "No data directory is set", 400);
+  if (!deleteDatabaseBackup(dbPath, name.data)) {
+    return errorResponse(c, `No such database backup: ${name.data}`, 404);
+  }
+  return c.json({ ok: true });
+});
+dbBackupRoutes.post("/db-backups/:name/reveal", (c) => {
+  const name = requireSlugParam(c, "name");
+  if (!name.ok) return name.response;
+  const dbPath = getDbPath();
+  if (dbPath === null) return errorResponse(c, "No data directory is set", 400);
+  const target = resolvePreservedDirectory(dbPath, name.data);
+  if (target === null) return errorResponse(c, `No such directory: ${name.data}`, 404);
+  try {
+    openOS(target, "reveal");
+  } catch {
+  }
+  return c.json({ ok: true });
+});
+
+// src/routes/api/files.ts
+import { Hono as Hono8 } from "hono";
+import { resolve as resolve9 } from "path";
 init_queries();
 
 // src/ground-truth/presentation.ts
@@ -29296,7 +31403,7 @@ async function renderPluginSvgSide(mode, filePath, oldPath, side, cwd) {
 }
 
 // src/routes/api/files.ts
-var filesRoutes = new Hono7();
+var filesRoutes = new Hono8();
 filesRoutes.get("/files", async (c) => {
   const reviewId = resolveReviewId(c);
   const [files, annotationCounts, staleCounts, review] = await Promise.all([
@@ -29337,7 +31444,7 @@ filesRoutes.post("/files/:fileId/reveal", async (c) => {
   const file2 = await getReviewFile(fileId.data);
   if (!file2) return errorResponse(c, "Not found", 404);
   const repoRoot = c.get("repoRoot");
-  const fullPath = resolve7(repoRoot, file2.file_path);
+  const fullPath = resolve9(repoRoot, file2.file_path);
   try {
     openOS(fullPath, "reveal");
   } catch (err) {
@@ -29351,7 +31458,7 @@ filesRoutes.get("/files/:fileId/path", async (c) => {
   const file2 = await getReviewFile(fileId.data);
   if (!file2) return errorResponse(c, "Not found", 404);
   const repoRoot = c.get("repoRoot");
-  return c.json({ relativePath: file2.file_path, absolutePath: resolve7(repoRoot, file2.file_path) });
+  return c.json({ relativePath: file2.file_path, absolutePath: resolve9(repoRoot, file2.file_path) });
 });
 filesRoutes.post("/files/:fileId/open", async (c) => {
   const fileId = requirePathParam(c, "fileId");
@@ -29359,7 +31466,7 @@ filesRoutes.post("/files/:fileId/open", async (c) => {
   const file2 = await getReviewFile(fileId.data);
   if (!file2) return errorResponse(c, "Not found", 404);
   const repoRoot = c.get("repoRoot");
-  const fullPath = resolve7(repoRoot, file2.file_path);
+  const fullPath = resolve9(repoRoot, file2.file_path);
   try {
     openOS(fullPath, "edit");
   } catch (err) {
@@ -29371,13 +31478,13 @@ filesRoutes.post("/files/:fileId/open", async (c) => {
 // src/routes/api/image.ts
 init_connection();
 init_queries();
-import { Hono as Hono8 } from "hono";
+import { Hono as Hono9 } from "hono";
 
 // src/git/image.ts
 init_lfs();
 import { spawnSync as spawnSync8 } from "child_process";
 import { readFileSync as readFileSync15 } from "fs";
-import { join as join15, resolve as resolve8 } from "path";
+import { join as join20, resolve as resolve10 } from "path";
 init_image_metadata();
 function getOldRef(mode) {
   switch (mode.type) {
@@ -29448,7 +31555,7 @@ function gitShowFile(ref, filePath, repoRoot) {
 }
 function readWorkingFile(filePath, repoRoot) {
   try {
-    const data = readFileSync15(resolve8(repoRoot, filePath));
+    const data = readFileSync15(resolve10(repoRoot, filePath));
     return isLfsPointer(data) ? null : data;
   } catch {
     return null;
@@ -29467,7 +31574,7 @@ function groundTruthEntry(mode, filePath) {
 }
 function getOldImage(mode, filePath, oldPath, repoRoot) {
   if (mode.type === "diff") {
-    return readDiskImage(join15(directComparisonRoots(mode).rootA, oldPath ?? filePath));
+    return readDiskImage(join20(directComparisonRoots(mode).rootA, oldPath ?? filePath));
   }
   if (mode.type === "ground-truth") {
     const entry = groundTruthEntry(mode, filePath);
@@ -29487,7 +31594,7 @@ function getOldImage(mode, filePath, oldPath, repoRoot) {
 }
 function getNewImage(mode, filePath, repoRoot) {
   if (mode.type === "diff") {
-    return readDiskImage(join15(directComparisonRoots(mode).rootB, filePath));
+    return readDiskImage(join20(directComparisonRoots(mode).rootB, filePath));
   }
   if (mode.type === "ground-truth") {
     const entry = groundTruthEntry(mode, filePath);
@@ -29511,7 +31618,7 @@ function getNewImage(mode, filePath, repoRoot) {
 
 // src/routes/api/image.ts
 init_image_blobs();
-var imageRoutes = new Hono8();
+var imageRoutes = new Hono9();
 function blobImageSide(fileId, side) {
   const dataDir = getDataDir();
   if (dataDir === null) return null;
@@ -29589,8 +31696,8 @@ imageRoutes.get("/image/:fileId/:side", async (c) => {
 init_queries();
 import { spawnSync as spawnSync9 } from "child_process";
 import { readFileSync as readFileSync16 } from "fs";
-import { Hono as Hono9 } from "hono";
-import { resolve as resolve9 } from "path";
+import { Hono as Hono10 } from "hono";
+import { resolve as resolve11 } from "path";
 
 // src/outline/parser.ts
 var BRACE_LANGS = /* @__PURE__ */ new Set([
@@ -29910,7 +32017,7 @@ function pushIndentSymbol(root, stack, sym, indent, lines, lineIdx) {
 }
 
 // src/routes/api/outline.ts
-var outlineRoutes = new Hono9();
+var outlineRoutes = new Hono10();
 var MAX_REPO_SCAN_FILES = 2e3;
 outlineRoutes.get("/outline/:fileId", async (c) => {
   const repoRoot = c.get("repoRoot");
@@ -29966,7 +32073,7 @@ outlineRoutes.get("/symbol-definition", async (c) => {
         }
         let content = "";
         try {
-          content = readFileSync16(resolve9(repoRoot, filePath), "utf-8");
+          content = readFileSync16(resolve11(repoRoot, filePath), "utf-8");
         } catch {
           continue;
         }
@@ -30002,13 +32109,13 @@ function collectDefinitions(symbols, targetName, fileId, filePath, out) {
 }
 
 // src/routes/api/plugins.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 
 // src/plugins/available.ts
 init_install();
 init_loader();
-import { existsSync as existsSync14 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join21 } from "path";
 
 // src/plugins/readiness.ts
 import { spawnSync as spawnSync10 } from "child_process";
@@ -30064,7 +32171,7 @@ function listAvailablePlugins(opts) {
   const out = [];
   for (const { manifest } of discoverBundledPlugins(bundledDir)) {
     if (manifest.autoInstall !== false) continue;
-    if (existsSync14(join16(userDir, manifest.id))) continue;
+    if (existsSync16(join21(userDir, manifest.id))) continue;
     out.push(describeAvailablePlugin(manifest, opts?.runProbe));
   }
   return out.sort((a, b) => a.name.localeCompare(b.name));
@@ -30079,9 +32186,9 @@ init_install();
 init_install();
 init_loader();
 import { spawnSync as spawnSync11 } from "child_process";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { cpSync as cpSync2, mkdirSync as mkdirSync11, writeFileSync as writeFileSync12 } from "fs";
-import { join as join17 } from "path";
+import { join as join24 } from "path";
 var defaultFetchBytes = async (url2) => {
   const res = await fetch(url2);
   if (!res.ok) throw new Error(`HTTP ${String(res.status)}`);
@@ -30099,12 +32206,12 @@ async function runProvisionStep(step, installDir, requirements, deps) {
     try {
       const bytes = await deps.fetchBytes(step.url);
       if (step.sha256 !== void 0) {
-        const got = createHash4("sha256").update(bytes).digest("hex");
+        const got = createHash6("sha256").update(bytes).digest("hex");
         if (got.toLowerCase() !== step.sha256.toLowerCase()) {
           return { step: label2, ok: false, skipped: false, detail: `checksum mismatch (expected ${step.sha256})` };
         }
       }
-      writeFileSync12(join17(installDir, step.dest), bytes);
+      writeFileSync12(join24(installDir, step.dest), bytes);
       return { step: label2, ok: true, skipped: false, detail: `saved ${step.dest}` };
     } catch (e) {
       return { step: label2, ok: false, skipped: false, detail: e instanceof Error ? e.message : "download failed" };
@@ -30139,7 +32246,7 @@ async function installAvailablePlugin(id, deps = {}) {
     return { id, installed: false, status: "error", requirements: [], provisioned: [], instructions: [], error: "Not a bundled plugin available to install." };
   }
   const manifest = bundled.manifest;
-  const dest = join17(userDir, id);
+  const dest = join24(userDir, id);
   try {
     mkdirSync11(userDir, { recursive: true });
     cpSync2(bundled.dir, dest, { recursive: true });
@@ -30160,7 +32267,7 @@ async function installAvailablePlugin(id, deps = {}) {
 // src/routes/api/plugins.ts
 init_loader();
 init_settings();
-var pluginsRoutes = new Hono10();
+var pluginsRoutes = new Hono11();
 pluginsRoutes.get("/plugins", (c) => {
   return c.json({ plugins: describeInstalledPlugins(c.get("repoRoot")) });
 });
@@ -30242,8 +32349,8 @@ pluginsRoutes.delete("/plugins/:id", async (c) => {
 // src/routes/api/project-settings.ts
 init_project_settings();
 init_project_settings_store();
-import { Hono as Hono11 } from "hono";
-var projectSettingsRoutes = new Hono11();
+import { Hono as Hono12 } from "hono";
+var projectSettingsRoutes = new Hono12();
 projectSettingsRoutes.get("/project-settings", (c) => {
   return c.json(readProjectSettings(c.get("repoRoot")));
 });
@@ -30260,10 +32367,10 @@ projectSettingsRoutes.patch("/project-settings", async (c) => {
 // src/routes/api/review-notes.ts
 init_store();
 init_lfs();
-import { readFileSync as readFileSync17, statSync as statSync6 } from "fs";
-import { Hono as Hono12 } from "hono";
-import { extname as extname2, relative as relative2, resolve as resolve10 } from "path";
-var reviewNotesRoutes = new Hono12();
+import { readFileSync as readFileSync17, statSync as statSync7 } from "fs";
+import { Hono as Hono13 } from "hono";
+import { extname as extname2, relative as relative2, resolve as resolve12 } from "path";
+var reviewNotesRoutes = new Hono13();
 var ARTIFACT_SERVE_MAX_BYTES = 1e7;
 var IMAGE_CONTENT_TYPES = {
   ".png": "image/png",
@@ -30278,15 +32385,15 @@ reviewNotesRoutes.get("/review-notes/artifact", (c) => {
   const file2 = c.req.query("file");
   if (file2 === void 0 || file2 === "") return c.text("Missing file", 400);
   const repoRoot = c.get("repoRoot");
-  const abs = resolve10(repoRoot, file2);
+  const abs = resolve12(repoRoot, file2);
   const rel = relative2(repoRoot, abs);
   if (rel === "" || rel.startsWith("..") || rel.startsWith("/")) return c.text("Forbidden", 403);
   const ext = extname2(abs).toLowerCase();
   if (!(ext in IMAGE_CONTENT_TYPES)) return c.text("Unsupported artifact type", 415);
   const contentType = IMAGE_CONTENT_TYPES[ext];
   try {
-    const stat = statSync6(abs);
-    if (!stat.isFile() || stat.size > ARTIFACT_SERVE_MAX_BYTES) return c.text("Not found", 404);
+    const stat4 = statSync7(abs);
+    if (!stat4.isFile() || stat4.size > ARTIFACT_SERVE_MAX_BYTES) return c.text("Not found", 404);
     const body = readFileSync17(abs);
     if (isLfsPointer(body)) return c.text("Not found", 404);
     return c.body(body, 200, { "Content-Type": contentType });
@@ -30305,24 +32412,24 @@ reviewNotesRoutes.delete("/review-notes/:guid", (c) => {
 
 // src/routes/api/reviews.ts
 init_queries();
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 
 // src/export/on-complete-hook.ts
 import { spawn as spawn2 } from "child_process";
 import { appendFileSync } from "fs";
-import { join as join18 } from "path";
+import { join as join25 } from "path";
 function runOnCompleteHook(command, ctx) {
   if (command === null || command.trim() === "") {
     return Promise.resolve({ ran: false, ok: true, exitCode: 0 });
   }
-  const logPath = join18(ctx.repoRoot, ".glassbox", "on-complete.log");
+  const logPath = join25(ctx.repoRoot, ".glassbox", "on-complete.log");
   const log = (s) => {
     try {
       appendFileSync(logPath, s);
     } catch {
     }
   };
-  return new Promise((resolve13) => {
+  return new Promise((resolve15) => {
     log(`
 === on-complete ${(/* @__PURE__ */ new Date()).toISOString()} \u2014 review ${ctx.reviewId} ===
 $ ${command}
@@ -30344,7 +32451,7 @@ $ ${command}
       const error51 = err instanceof Error ? err.message : String(err);
       log(`spawn failed: ${error51}
 `);
-      resolve13({ ran: true, ok: false, exitCode: null, error: error51 });
+      resolve15({ ran: true, ok: false, exitCode: null, error: error51 });
       return;
     }
     child.stdout.on("data", (d) => {
@@ -30356,19 +32463,19 @@ $ ${command}
     child.on("error", (err) => {
       log(`error: ${err.message}
 `);
-      resolve13({ ran: true, ok: false, exitCode: null, error: err.message });
+      resolve15({ ran: true, ok: false, exitCode: null, error: err.message });
     });
     child.on("close", (code) => {
       log(`exited with code ${String(code)}
 `);
-      resolve13({ ran: true, ok: code === 0, exitCode: code });
+      resolve15({ ran: true, ok: code === 0, exitCode: code });
     });
   });
 }
 
 // src/routes/api/reviews.ts
 init_plugins();
-var reviewsRoutes = new Hono13();
+var reviewsRoutes = new Hono14();
 reviewsRoutes.get("/reviews", async (c) => {
   const repoRoot = c.get("repoRoot");
   const reviews = await listReviews(repoRoot);
@@ -30460,9 +32567,9 @@ reviewsRoutes.post("/reviews/delete-all", async (c) => {
 
 // src/routes/api/share-prompt.ts
 init_zod();
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 init_global_config();
-var sharePromptRoutes = new Hono14();
+var sharePromptRoutes = new Hono15();
 var SharePromptShapeSchema = external_exports.object({
   dismissedAt: external_exports.number().nullable().optional(),
   totalOpenMs: external_exports.number().optional()
@@ -30501,8 +32608,8 @@ sharePromptRoutes.post("/share-prompt/tick", async (c) => {
 });
 
 // src/routes/api/system.ts
-import { Hono as Hono15 } from "hono";
-var systemRoutes = new Hono15();
+import { Hono as Hono16 } from "hono";
+var systemRoutes = new Hono16();
 systemRoutes.post("/open-external", async (c) => {
   const parsed = await parseBody(c, OpenExternalReqSchema);
   if (!parsed.ok) return parsed.response;
@@ -30514,7 +32621,7 @@ systemRoutes.post("/open-external", async (c) => {
 });
 
 // src/routes/api.ts
-var apiRoutes = new Hono16();
+var apiRoutes = new Hono17();
 apiRoutes.route("/", reviewsRoutes);
 apiRoutes.route("/", filesRoutes);
 apiRoutes.route("/", annotationsRoutes);
@@ -30527,21 +32634,22 @@ apiRoutes.route("/", imageRoutes);
 apiRoutes.route("/", reviewNotesRoutes);
 apiRoutes.route("/", sharePromptRoutes);
 apiRoutes.route("/", systemRoutes);
+apiRoutes.route("/", dbBackupRoutes);
 
 // src/routes/channel-api.ts
 import { spawnSync as spawnSync12 } from "child_process";
 import { mkdirSync as mkdirSync12 } from "fs";
-import { Hono as Hono17 } from "hono";
-import { join as join19 } from "path";
+import { Hono as Hono18 } from "hono";
+import { join as join26 } from "path";
 init_global_config();
 init_compareVersions();
 var MIN_CLAUDE_VERSION = "2.1.80";
-var channelApiRoutes = new Hono17();
+var channelApiRoutes = new Hono18();
 channelApiRoutes.get("/status", async (c) => {
   const config2 = readGlobalConfig();
   const enabled = config2.channelEnabled === true;
   const repoRoot = c.get("repoRoot");
-  const dataDir = join19(repoRoot, ".glassbox");
+  const dataDir = join26(repoRoot, ".glassbox");
   const connected = enabled ? await isChannelAlive(dataDir) : false;
   return c.json({ enabled, connected });
 });
@@ -30550,7 +32658,7 @@ channelApiRoutes.post("/enable", (c) => {
     config2.channelEnabled = true;
   });
   const repoRoot = c.get("repoRoot");
-  const dataDir = join19(repoRoot, ".glassbox");
+  const dataDir = join26(repoRoot, ".glassbox");
   mkdirSync12(dataDir, { recursive: true });
   registerChannel(dataDir);
   return c.json({ ok: true });
@@ -30560,7 +32668,7 @@ channelApiRoutes.post("/disable", (c) => {
     config2.channelEnabled = false;
   });
   const repoRoot = c.get("repoRoot");
-  const dataDir = join19(repoRoot, ".glassbox");
+  const dataDir = join26(repoRoot, ".glassbox");
   unregisterChannel(dataDir);
   return c.json({ ok: true });
 });
@@ -30568,7 +32676,7 @@ channelApiRoutes.post("/trigger", async (c) => {
   const parsed = await parseBody(c, TriggerChannelReqSchema);
   if (!parsed.ok) return parsed.response;
   const repoRoot = c.get("repoRoot");
-  const dataDir = join19(repoRoot, ".glassbox");
+  const dataDir = join26(repoRoot, ".glassbox");
   const sent = await triggerChannel(dataDir, parsed.data.message);
   if (!sent) {
     return errorResponse(c, "Channel not connected", 503);
@@ -30592,13 +32700,13 @@ channelApiRoutes.get("/claude-check", (c) => {
 });
 
 // src/routes/difftool-api.ts
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono19 } from "hono";
 init_connection();
 init_queries();
 init_session();
 init_difftool();
 init_image_blobs();
-var difftoolApiRoutes = new Hono18();
+var difftoolApiRoutes = new Hono19();
 difftoolApiRoutes.get("/status", (c) => {
   return c.json(getDifftoolStatus("global"));
 });
@@ -30660,9 +32768,9 @@ difftoolApiRoutes.get("/hold", (c) => {
   const session2 = getDifftoolSession();
   if (session2 === null) return c.json({ ended: true });
   noteDifftoolActivity();
-  return new Promise((resolve13) => {
+  return new Promise((resolve15) => {
     addDifftoolHold(() => {
-      resolve13(c.json({ ended: true }));
+      resolve15(c.json({ ended: true }));
     });
     c.req.raw.signal.addEventListener("abort", () => {
       endDifftoolSession();
@@ -30676,8 +32784,8 @@ difftoolApiRoutes.post("/end", (c) => {
 
 // src/routes/pages.tsx
 import { readFileSync as readFileSync19 } from "fs";
-import { Hono as Hono19 } from "hono";
-import { relative as relative3, resolve as resolve11 } from "path";
+import { Hono as Hono20 } from "hono";
+import { relative as relative3, resolve as resolve13 } from "path";
 
 // src/components/diffView.tsx
 import { raw } from "kerfjs";
@@ -30999,8 +33107,8 @@ function renderBlocks(lines, depth, ctx) {
       i++;
       continue;
     }
-    const quote = QUOTE_RE.exec(line);
-    if (quote !== null) {
+    const quote2 = QUOTE_RE.exec(line);
+    if (quote2 !== null) {
       const inner = [];
       while (i < lines.length) {
         const m = QUOTE_RE.exec(lines[i]);
@@ -31636,7 +33744,7 @@ function ReviewNoteRows({ notes, repliesByNote }) {
                   className: "ai-note-artifact-img",
                   loading: "lazy",
                   alt: a.uri,
-                  draggable: false,
+                  draggable: "false",
                   src: raw(`data:image/svg+xml;utf8,${encodeURIComponent(a.renderedSvg)}`)
                 }
               ) })
@@ -31664,7 +33772,7 @@ function ReviewNoteRows({ notes, repliesByNote }) {
                     className: "ai-note-artifact-img",
                     loading: "lazy",
                     alt: a.uri,
-                    draggable: false,
+                    draggable: "false",
                     "data-artifact-uri": a.uri,
                     title: "Drag to mark a region, or click to view full screen",
                     src: `/api/review-notes/artifact?file=${encodeURIComponent(a.uri)}`
@@ -31693,7 +33801,7 @@ function AnnotationItem({ annotation: a }) {
       "data-is-stale": a.is_stale ? "true" : void 0,
       "data-region-data": a.region_data ?? void 0,
       children: [
-        /* @__PURE__ */ jsx4("span", { className: "annotation-drag-handle", draggable: true, title: "Drag to move", children: /* @__PURE__ */ jsx4(IconGripVertical, {}) }),
+        /* @__PURE__ */ jsx4("span", { className: "annotation-drag-handle", draggable: "true", title: "Drag to move", children: /* @__PURE__ */ jsx4(IconGripVertical, {}) }),
         /* @__PURE__ */ jsx4("span", { className: `annotation-category category-${a.category}`, "data-action": "reclassify", children: a.category }),
         a.reply_to_note_id !== null ? /* @__PURE__ */ jsxs4("span", { className: "annotation-reply-tag", title: "Reply to an AI review note", children: [
           /* @__PURE__ */ jsx4(IconCornerDownRight, {}),
@@ -31718,10 +33826,10 @@ function AnnotationRows({ annotations }) {
 
 // src/themes/config.ts
 init_zod();
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readdirSync as readdirSync4, readFileSync as readFileSync18, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync13, readdirSync as readdirSync5, readFileSync as readFileSync18, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "fs";
+import { join as join27 } from "path";
 init_global_config();
-var THEMES_DIR = join20(GLOBAL_CONFIG_DIR, "themes");
+var THEMES_DIR = join27(GLOBAL_CONFIG_DIR, "themes");
 var ThemeConfigSliceSchema = external_exports.object({ active: external_exports.string().optional() }).loose();
 function getActiveThemeId() {
   const config2 = readGlobalConfig();
@@ -31745,11 +33853,11 @@ function readStoredTheme(filePath) {
   }
 }
 function loadCustomThemes() {
-  if (!existsSync15(THEMES_DIR)) return [];
+  if (!existsSync17(THEMES_DIR)) return [];
   const themes = [];
   try {
-    for (const file2 of readdirSync4(THEMES_DIR).filter((f) => f.endsWith(".json"))) {
-      const theme = readStoredTheme(join20(THEMES_DIR, file2));
+    for (const file2 of readdirSync5(THEMES_DIR).filter((f) => f.endsWith(".json"))) {
+      const theme = readStoredTheme(join27(THEMES_DIR, file2));
       if (theme !== void 0) themes.push(theme);
     }
   } catch {
@@ -31758,18 +33866,18 @@ function loadCustomThemes() {
 }
 function saveCustomTheme(theme) {
   mkdirSync13(THEMES_DIR, { recursive: true });
-  const filePath = join20(THEMES_DIR, `${theme.id}.json`);
+  const filePath = join27(THEMES_DIR, `${theme.id}.json`);
   writeFileSync13(filePath, JSON.stringify(theme, null, 2), "utf-8");
 }
 function deleteCustomTheme(id) {
-  const filePath = join20(THEMES_DIR, `${id}.json`);
-  if (existsSync15(filePath)) {
+  const filePath = join27(THEMES_DIR, `${id}.json`);
+  if (existsSync17(filePath)) {
     unlinkSync3(filePath);
   }
 }
 function getCustomTheme(id) {
-  const filePath = join20(THEMES_DIR, `${id}.json`);
-  if (!existsSync15(filePath)) return void 0;
+  const filePath = join27(THEMES_DIR, `${id}.json`);
+  if (!existsSync17(filePath)) return void 0;
   return readStoredTheme(filePath);
 }
 function getAllThemes() {
@@ -32114,7 +34222,7 @@ function reanchorReviewNotes(notes, diff) {
 // src/routes/pages.tsx
 init_store();
 import { Fragment as Fragment2, jsx as jsx9, jsxs as jsxs9 } from "kerfjs/jsx-runtime";
-var pageRoutes = new Hono19();
+var pageRoutes = new Hono20();
 pageRoutes.get("/", async (c) => {
   const reviewId = c.get("reviewId");
   const review = await getReview(reviewId);
@@ -32242,7 +34350,7 @@ pageRoutes.get("/file-raw", (c) => {
   const filePath = c.req.query("path");
   if (filePath === void 0 || filePath === "") return c.text("Missing path", 400);
   const repoRoot = c.get("repoRoot");
-  const abs = resolve11(repoRoot, filePath);
+  const abs = resolve13(repoRoot, filePath);
   const rel = relative3(repoRoot, abs);
   if (rel === "" || rel.startsWith("..") || rel.startsWith("/")) return c.text("Forbidden", 403);
   let content;
@@ -32303,8 +34411,8 @@ pageRoutes.get("/history", async (c) => {
 });
 
 // src/routes/theme-api.ts
-import { Hono as Hono20 } from "hono";
-var themeApiRoutes = new Hono20();
+import { Hono as Hono21 } from "hono";
+var themeApiRoutes = new Hono21();
 themeApiRoutes.get("/", (c) => {
   const themes = getAllThemes();
   const activeId = getActiveThemeId();
@@ -32415,10 +34523,10 @@ themeApiRoutes.delete("/:id", (c) => {
 // src/server.ts
 var MAX_PORT_ATTEMPTS = 20;
 function tryServe(appFetch, port) {
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve15, reject) => {
     const server = serve({ fetch: appFetch, port, hostname: "127.0.0.1" });
     server.on("listening", () => {
-      resolve13({ port, server });
+      resolve15({ port, server });
     });
     server.on("error", (err) => {
       reject(err);
@@ -32426,7 +34534,7 @@ function tryServe(appFetch, port) {
   });
 }
 async function startServer(port, reviewId, repoRoot, options) {
-  const app = new Hono21();
+  const app = new Hono22();
   const onCompleteCommand = options?.onComplete ?? null;
   app.use("*", async (c, next) => {
     c.set("reviewId", reviewId);
@@ -32435,22 +34543,22 @@ async function startServer(port, reviewId, repoRoot, options) {
     c.set("onCompleteCommand", onCompleteCommand);
     await next();
   });
-  const selfDir = dirname9(fileURLToPath4(import.meta.url));
-  const distDir = existsSync16(join21(selfDir, "client", "styles.css")) ? join21(selfDir, "client") : join21(selfDir, "..", "dist", "client");
+  const selfDir = dirname12(fileURLToPath4(import.meta.url));
+  const distDir = existsSync18(join28(selfDir, "client", "styles.css")) ? join28(selfDir, "client") : join28(selfDir, "..", "dist", "client");
   app.get("/static/styles.css", (c) => {
-    const css = readFileSync20(join21(distDir, "styles.css"), "utf-8");
+    const css = readFileSync20(join28(distDir, "styles.css"), "utf-8");
     return c.text(css, 200, { "Content-Type": "text/css", "Cache-Control": "no-cache" });
   });
   app.get("/static/app.js", (c) => {
-    const js = readFileSync20(join21(distDir, "app.global.js"), "utf-8");
+    const js = readFileSync20(join28(distDir, "app.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
   app.get("/static/history.js", (c) => {
-    const js = readFileSync20(join21(distDir, "history.global.js"), "utf-8");
+    const js = readFileSync20(join28(distDir, "history.global.js"), "utf-8");
     return c.text(js, 200, { "Content-Type": "application/javascript", "Cache-Control": "no-cache" });
   });
   app.get("/favicon.svg", (c) => {
-    const svg = readFileSync20(join21(distDir, "favicon.svg"), "utf-8");
+    const svg = readFileSync20(join28(distDir, "favicon.svg"), "utf-8");
     return c.body(svg, 200, { "Content-Type": "image/svg+xml", "Cache-Control": "no-cache" });
   });
   app.get("/favicon.ico", (c) => c.body(null, 204));
@@ -32494,7 +34602,7 @@ async function startServer(port, reviewId, repoRoot, options) {
   try {
     const globalConfig2 = readGlobalConfig();
     if (globalConfig2.channelEnabled === true) {
-      const dataDir = join21(repoRoot, ".glassbox");
+      const dataDir = join28(repoRoot, ".glassbox");
       registerChannel(dataDir);
     }
   } catch {
@@ -32509,8 +34617,8 @@ async function startServer(port, reviewId, repoRoot, options) {
 }
 
 // src/skills.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync14, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "fs";
+import { join as join29 } from "path";
 var SKILL_VERSION = 1;
 function versionHeader() {
   return `<!-- glassbox-skill-version: ${SKILL_VERSION} -->`;
@@ -32521,7 +34629,7 @@ function parseVersionHeader(content) {
   return parseInt(match[1], 10);
 }
 function updateFile(path, content) {
-  if (existsSync17(path)) {
+  if (existsSync19(path)) {
     const existing = readFileSync21(path, "utf-8");
     const version2 = parseVersionHeader(existing);
     if (version2 !== null && version2 >= SKILL_VERSION) {
@@ -32548,7 +34656,7 @@ function skillBody() {
   ].join("\n");
 }
 function ensureClaudeSkills(cwd) {
-  const dir = join22(cwd, ".claude", "skills", "glassbox");
+  const dir = join29(cwd, ".claude", "skills", "glassbox");
   mkdirSync14(dir, { recursive: true });
   const content = [
     "---",
@@ -32561,10 +34669,10 @@ function ensureClaudeSkills(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join22(dir, "SKILL.md"), content);
+  return updateFile(join29(dir, "SKILL.md"), content);
 }
 function ensureCursorRules(cwd) {
-  const rulesDir = join22(cwd, ".cursor", "rules");
+  const rulesDir = join29(cwd, ".cursor", "rules");
   mkdirSync14(rulesDir, { recursive: true });
   const content = [
     "---",
@@ -32576,10 +34684,10 @@ function ensureCursorRules(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join22(rulesDir, "glassbox.mdc"), content);
+  return updateFile(join29(rulesDir, "glassbox.mdc"), content);
 }
 function ensureCopilotPrompts(cwd) {
-  const promptsDir = join22(cwd, ".github", "prompts");
+  const promptsDir = join29(cwd, ".github", "prompts");
   mkdirSync14(promptsDir, { recursive: true });
   const content = [
     "---",
@@ -32590,10 +34698,10 @@ function ensureCopilotPrompts(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join22(promptsDir, "glassbox.prompt.md"), content);
+  return updateFile(join29(promptsDir, "glassbox.prompt.md"), content);
 }
 function ensureWindsurfRules(cwd) {
-  const rulesDir = join22(cwd, ".windsurf", "rules");
+  const rulesDir = join29(cwd, ".windsurf", "rules");
   mkdirSync14(rulesDir, { recursive: true });
   const content = [
     "---",
@@ -32605,21 +34713,21 @@ function ensureWindsurfRules(cwd) {
     skillBody(),
     ""
   ].join("\n");
-  return updateFile(join22(rulesDir, "glassbox.md"), content);
+  return updateFile(join29(rulesDir, "glassbox.md"), content);
 }
 function ensureSkills() {
   const cwd = process.cwd();
   const platforms = [];
-  if (existsSync17(join22(cwd, ".claude"))) {
+  if (existsSync19(join29(cwd, ".claude"))) {
     if (ensureClaudeSkills(cwd)) platforms.push("Claude Code");
   }
-  if (existsSync17(join22(cwd, ".cursor"))) {
+  if (existsSync19(join29(cwd, ".cursor"))) {
     if (ensureCursorRules(cwd)) platforms.push("Cursor");
   }
-  if (existsSync17(join22(cwd, ".github", "prompts")) || existsSync17(join22(cwd, ".github", "copilot-instructions.md"))) {
+  if (existsSync19(join29(cwd, ".github", "prompts")) || existsSync19(join29(cwd, ".github", "copilot-instructions.md"))) {
     if (ensureCopilotPrompts(cwd)) platforms.push("GitHub Copilot");
   }
-  if (existsSync17(join22(cwd, ".windsurf"))) {
+  if (existsSync19(join29(cwd, ".windsurf"))) {
     if (ensureWindsurfRules(cwd)) platforms.push("Windsurf");
   }
   return platforms;
@@ -32629,17 +34737,17 @@ function ensureSkills() {
 init_zod();
 init_app_version();
 init_compareVersions();
-import { existsSync as existsSync18, mkdirSync as mkdirSync15, readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "fs";
 import { get } from "https";
-import { homedir as homedir2 } from "os";
-import { join as join23 } from "path";
-var DATA_DIR = join23(homedir2(), ".glassbox");
-var CHECK_FILE = join23(DATA_DIR, "last-update-check");
+import { homedir as homedir4 } from "os";
+import { join as join30 } from "path";
+var DATA_DIR = join30(homedir4(), ".glassbox");
+var CHECK_FILE = join30(DATA_DIR, "last-update-check");
 var PACKAGE_NAME = "glassbox";
 var VersionPayloadSchema2 = external_exports.object({ version: external_exports.string() });
 function getLastCheckDate() {
   try {
-    if (existsSync18(CHECK_FILE)) {
+    if (existsSync20(CHECK_FILE)) {
       return readFileSync22(CHECK_FILE, "utf-8").trim();
     }
   } catch {
@@ -32657,10 +34765,10 @@ function isFirstUseToday() {
   return last !== today;
 }
 function fetchLatestVersion() {
-  return new Promise((resolve13) => {
+  return new Promise((resolve15) => {
     const req = get(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, { timeout: 5e3 }, (res) => {
       if (res.statusCode !== 200) {
-        resolve13(null);
+        resolve15(null);
         return;
       }
       let data = "";
@@ -32670,18 +34778,18 @@ function fetchLatestVersion() {
       res.on("end", () => {
         try {
           const raw2 = JSON.parse(data);
-          resolve13(VersionPayloadSchema2.parse(raw2).version);
+          resolve15(VersionPayloadSchema2.parse(raw2).version);
         } catch {
-          resolve13(null);
+          resolve15(null);
         }
       });
     });
     req.on("error", () => {
-      resolve13(null);
+      resolve15(null);
     });
     req.on("timeout", () => {
       req.destroy();
-      resolve13(null);
+      resolve15(null);
     });
   });
 }
@@ -32838,7 +34946,7 @@ function parseArgs(argv) {
           console.error("--diff requires two paths: --diff <pathA> <pathB>");
           process.exit(1);
         }
-        mode = { type: "diff", pathA: resolve12(args[++i]), pathB: resolve12(args[++i]) };
+        mode = { type: "diff", pathA: resolve14(args[++i]), pathB: resolve14(args[++i]) };
         break;
       }
       case "--ground-truth": {
@@ -32846,7 +34954,7 @@ function parseArgs(argv) {
           console.error("--ground-truth requires a manifest path: --ground-truth <manifest.json>");
           process.exit(1);
         }
-        mode = { type: "ground-truth", manifestPath: resolve12(args[++i]), comparisons: [] };
+        mode = { type: "ground-truth", manifestPath: resolve14(args[++i]), comparisons: [] };
         break;
       }
       case "--port": {
@@ -32860,7 +34968,7 @@ function parseArgs(argv) {
         break;
       }
       case "--data-dir":
-        dataDir = resolve12(requireValue("--data-dir"));
+        dataDir = resolve14(requireValue("--data-dir"));
         break;
       case "--resume":
         resume = true;
@@ -32959,7 +35067,7 @@ async function resolveGroundTruthLaunch(mode, cwd) {
   }
   for (const entry of comparisons) {
     for (const [role, p] of [["actual", entry.actualPath], ["expected", entry.expectedPath]]) {
-      if (!existsSync20(p)) {
+      if (!existsSync22(p)) {
         console.error(`Error: ${role} image does not exist: ${p}`);
         process.exit(1);
       }
@@ -33009,17 +35117,17 @@ async function main() {
     console.log("AI service test mode enabled \u2014 using mock AI responses");
   }
   if (debug) {
-    console.log(`[debug] Build timestamp: ${"2026-07-24T02:30:22.046Z"}`);
+    console.log(`[debug] Build timestamp: ${"2026-08-03T07:40:54.168Z"}`);
   }
   if (projectDir !== null) {
-    if (!existsSync20(projectDir) || !statSync8(projectDir).isDirectory()) {
+    if (!existsSync22(projectDir) || !statSync9(projectDir).isDirectory()) {
       console.error(`--project-dir is not a directory: ${projectDir}`);
       process.exit(1);
     }
     process.chdir(projectDir);
   }
   if (dataDir === null) {
-    dataDir = join25(process.cwd(), ".glassbox");
+    dataDir = join32(process.cwd(), ".glassbox");
   }
   if (difftoolServe) {
     await runDifftoolServe(dataDir, port, { noOpen, strictPort, onComplete });
@@ -33035,7 +35143,7 @@ async function main() {
       }
       process.exit(1);
     }
-    dataDir = join25(tmpdir2(), `glassbox-demo-${demo}-${Date.now()}`);
+    dataDir = join32(tmpdir4(), `glassbox-demo-${demo}-${Date.now()}`);
     setDemoMode(demo);
     console.log(`
   DEMO MODE: ${scenario.label}
@@ -33066,23 +35174,23 @@ async function main() {
   if (mode.type === "diff") {
     const { pathA, pathB } = mode;
     for (const p of [pathA, pathB]) {
-      if (!existsSync20(p)) {
+      if (!existsSync22(p)) {
         console.error(`Error: path does not exist: ${p}`);
         process.exit(1);
       }
     }
-    if (statSync8(pathA).isDirectory() !== statSync8(pathB).isDirectory()) {
+    if (statSync9(pathA).isDirectory() !== statSync9(pathB).isDirectory()) {
       console.error("Error: --diff requires two files or two folders, not a mix of both.");
       process.exit(1);
     }
     repoRoot = cwd;
-    repoName = `${basename5(pathA)} \u2194 ${basename5(pathB)}`;
+    repoName = `${basename7(pathA)} \u2194 ${basename7(pathB)}`;
   } else if (mode.type === "ground-truth") {
     const resolved = await resolveGroundTruthLaunch(mode, cwd);
     mode = resolved.mode;
     for (const [k, v] of resolved.scores) groundTruthScores.set(k, v);
     repoRoot = cwd;
-    repoName = `Ground truth: ${basename5(mode.manifestPath)}`;
+    repoName = `Ground truth: ${basename7(mode.manifestPath)}`;
   } else {
     if (!isGitRepo(cwd)) {
       console.error("Error: Not a git repository. Run this from inside a git repo.");