realitydb 1.8.0 → 2.0.0

package/dist/index.js

@@ -20958,7 +20958,7 @@ var require_pool_connection = __commonJS({
 var require_make_done_cb = __commonJS({
   "../../node_modules/.pnpm/mysql2@3.19.1_@types+node@25.3.5/node_modules/mysql2/lib/promise/make_done_cb.js"(exports2, module2) {
     "use strict";
-    function makeDoneCb(resolve13, reject, localErr) {
+    function makeDoneCb(resolve14, reject, localErr) {
       return function(err, rows, fields) {
         if (err) {
           localErr.message = err.message;
@@ -20969,7 +20969,7 @@ var require_make_done_cb = __commonJS({
           localErr.sqlMessage = err.sqlMessage;
           reject(localErr);
         } else {
-          resolve13([rows, fields]);
+          resolve14([rows, fields]);
         }
       };
     }
@@ -20990,8 +20990,8 @@ var require_prepared_statement_info = __commonJS({
       execute(parameters) {
         const s = this.statement;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           if (parameters) {
             s.execute(parameters, done);
           } else {
@@ -21000,9 +21000,9 @@ var require_prepared_statement_info = __commonJS({
         });
       }
       close() {
-        return new this.Promise((resolve13) => {
+        return new this.Promise((resolve14) => {
           this.statement.close();
-          resolve13();
+          resolve14();
         });
       }
     };
@@ -21071,8 +21071,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           if (params !== void 0) {
             c.query(query, params, done);
           } else {
@@ -21088,8 +21088,8 @@ var require_connection2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           if (params !== void 0) {
             c.execute(query, params, done);
           } else {
@@ -21098,8 +21098,8 @@ var require_connection2 = __commonJS({
         });
       }
       end() {
-        return new this.Promise((resolve13) => {
-          this.connection.end(resolve13);
+        return new this.Promise((resolve14) => {
+          this.connection.end(resolve14);
         });
       }
       async [Symbol.asyncDispose]() {
@@ -21110,31 +21110,31 @@ var require_connection2 = __commonJS({
       beginTransaction() {
         const c = this.connection;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           c.beginTransaction(done);
         });
       }
       commit() {
         const c = this.connection;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           c.commit(done);
         });
       }
       rollback() {
         const c = this.connection;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           c.rollback(done);
         });
       }
       ping() {
         const c = this.connection;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           c.ping((err) => {
             if (err) {
               localErr.message = err.message;
@@ -21144,7 +21144,7 @@ var require_connection2 = __commonJS({
               localErr.sqlMessage = err.sqlMessage;
               reject(localErr);
             } else {
-              resolve13(true);
+              resolve14(true);
             }
           });
         });
@@ -21152,7 +21152,7 @@ var require_connection2 = __commonJS({
       connect() {
         const c = this.connection;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           c.connect((err, param) => {
             if (err) {
               localErr.message = err.message;
@@ -21162,7 +21162,7 @@ var require_connection2 = __commonJS({
               localErr.sqlMessage = err.sqlMessage;
               reject(localErr);
             } else {
-              resolve13(param);
+              resolve14(param);
             }
           });
         });
@@ -21171,7 +21171,7 @@ var require_connection2 = __commonJS({
         const c = this.connection;
         const promiseImpl = this.Promise;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           c.prepare(options, (err, statement) => {
             if (err) {
               localErr.message = err.message;
@@ -21185,7 +21185,7 @@ var require_connection2 = __commonJS({
                 statement,
                 promiseImpl
               );
-              resolve13(wrappedStatement);
+              resolve14(wrappedStatement);
             }
           });
         });
@@ -21193,7 +21193,7 @@ var require_connection2 = __commonJS({
       changeUser(options) {
         const c = this.connection;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           c.changeUser(options, (err) => {
             if (err) {
               localErr.message = err.message;
@@ -21203,7 +21203,7 @@ var require_connection2 = __commonJS({
               localErr.sqlMessage = err.sqlMessage;
               reject(localErr);
             } else {
-              resolve13();
+              resolve14();
             }
           });
         });
@@ -21546,12 +21546,12 @@ var require_pool2 = __commonJS({
       }
       getConnection() {
         const corePool = this.pool;
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           corePool.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve13(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve14(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -21567,8 +21567,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           if (args !== void 0) {
             corePool.query(sql, args, done);
           } else {
@@ -21584,8 +21584,8 @@ var require_pool2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           if (args) {
             corePool.execute(sql, args, done);
           } else {
@@ -21596,7 +21596,7 @@ var require_pool2 = __commonJS({
       end() {
         const corePool = this.pool;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           corePool.end((err) => {
             if (err) {
               localErr.message = err.message;
@@ -21606,7 +21606,7 @@ var require_pool2 = __commonJS({
               localErr.sqlMessage = err.sqlMessage;
               reject(localErr);
             } else {
-              resolve13();
+              resolve14();
             }
           });
         });
@@ -22051,12 +22051,12 @@ var require_pool_cluster2 = __commonJS({
       }
       getConnection() {
         const corePoolNamespace = this.poolNamespace;
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           corePoolNamespace.getConnection((err, coreConnection) => {
             if (err) {
               reject(err);
             } else {
-              resolve13(new PromisePoolConnection(coreConnection, this.Promise));
+              resolve14(new PromisePoolConnection(coreConnection, this.Promise));
             }
           });
         });
@@ -22069,8 +22069,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           corePoolNamespace.query(sql, values, done);
         });
       }
@@ -22082,8 +22082,8 @@ var require_pool_cluster2 = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           corePoolNamespace.execute(sql, values, done);
         });
       }
@@ -22118,9 +22118,9 @@ var require_promise = __commonJS({
           "no Promise implementation available.Use promise-enabled node version or pass userland Promise implementation as parameter, for example: { Promise: require('bluebird') }"
         );
       }
-      return new thePromise((resolve13, reject) => {
+      return new thePromise((resolve14, reject) => {
         coreConnection.once("connect", () => {
-          resolve13(new PromiseConnection(coreConnection, thePromise));
+          resolve14(new PromiseConnection(coreConnection, thePromise));
         });
         coreConnection.once("error", (err) => {
           createConnectionErr.message = err.message;
@@ -22150,7 +22150,7 @@ var require_promise = __commonJS({
       }
       getConnection(pattern, selector) {
         const corePoolCluster = this.poolCluster;
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           corePoolCluster.getConnection(
             pattern,
             selector,
@@ -22158,7 +22158,7 @@ var require_promise = __commonJS({
               if (err) {
                 reject(err);
               } else {
-                resolve13(new PromisePoolConnection(coreConnection, this.Promise));
+                resolve14(new PromisePoolConnection(coreConnection, this.Promise));
               }
             }
           );
@@ -22172,8 +22172,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           corePoolCluster.query(sql, args, done);
         });
       }
@@ -22185,8 +22185,8 @@ var require_promise = __commonJS({
             "Callback function is not available with promise clients."
           );
         }
-        return new this.Promise((resolve13, reject) => {
-          const done = makeDoneCb(resolve13, reject, localErr);
+        return new this.Promise((resolve14, reject) => {
+          const done = makeDoneCb(resolve14, reject, localErr);
           corePoolCluster.execute(sql, args, done);
         });
       }
@@ -22199,7 +22199,7 @@ var require_promise = __commonJS({
       end() {
         const corePoolCluster = this.poolCluster;
         const localErr = new Error();
-        return new this.Promise((resolve13, reject) => {
+        return new this.Promise((resolve14, reject) => {
           corePoolCluster.end((err) => {
             if (err) {
               localErr.message = err.message;
@@ -22209,7 +22209,7 @@ var require_promise = __commonJS({
               localErr.sqlMessage = err.sqlMessage;
               reject(localErr);
             } else {
-              resolve13();
+              resolve14();
             }
           });
         });
@@ -31672,15 +31672,92 @@ async function captureDatabase(config, options) {
       foreignKeyCount: filteredFKs.length
     };
     const ddl = generateCreateTableDDL(filteredSchema);
+    let aroundFilter;
+    if (options.around) {
+      aroundFilter = /* @__PURE__ */ new Map();
+      const { column: aroundCol, value: aroundVal } = options.around;
+      for (const table of filteredTables) {
+        const hasCol = table.columns.some((c) => c.name === aroundCol);
+        if (hasCol) {
+          aroundFilter.set(table.name, { column: aroundCol, values: /* @__PURE__ */ new Set([aroundVal]) });
+        }
+      }
+      for (const fk of filteredFKs) {
+        const sourceFilter = aroundFilter.get(fk.targetTable);
+        if (sourceFilter && sourceFilter.column === fk.targetColumn) {
+          aroundFilter.set(fk.sourceTable, { column: fk.sourceColumn, values: sourceFilter.values });
+        }
+      }
+    }
+    const detectionsByTable = /* @__PURE__ */ new Map();
+    let piiSummary;
+    if (options.safe) {
+      const mode = "gdpr";
+      for (const table of filteredTables) {
+        const tableForeignKeys = filteredFKs.filter((fk) => fk.sourceTable === table.name);
+        const detections = detectTablePII(table.columns, tableForeignKeys, table.name, mode);
+        detectionsByTable.set(table.name, detections);
+      }
+      let columnsDetected = 0;
+      let tablesAffected = 0;
+      const categoriesFound = /* @__PURE__ */ new Set();
+      for (const [, detections] of detectionsByTable) {
+        const piiCols = detections.filter((d) => d.shouldMask);
+        if (piiCols.length > 0) {
+          tablesAffected++;
+          columnsDetected += piiCols.length;
+          for (const d of piiCols) {
+            categoriesFound.add(d.category);
+          }
+        }
+      }
+      piiSummary = {
+        columnsDetected,
+        tablesAffected,
+        categoriesFound: Array.from(categoriesFound)
+      };
+    }
     const packDataset = { tables: {} };
     const tableDetails = [];
     let totalRows = 0;
+    const safeMode = options.safeMode ?? "mask";
+    const random = options.safe ? createSeededRandom(42) : void 0;
+    const tokenPrefix = options.safe && safeMode === "tokenize" ? generateTokenPrefix() : void 0;
     for (const tableName of tablesToCapture) {
       const tableSchema = filteredTables.find((t) => t.name === tableName);
       if (!tableSchema)
         continue;
       const columns = tableSchema.columns.map((c) => c.name);
-      const rows = await readTableRows(pool, tableName, columns);
+      let rows = await readTableRows(pool, tableName, columns);
+      const filter = aroundFilter?.get(tableName);
+      if (filter) {
+        rows = rows.filter((row) => {
+          const val = row[filter.column];
+          return val !== null && val !== void 0 && filter.values.has(String(val));
+        });
+      }
+      if (options.maxRows !== void 0 && rows.length > options.maxRows) {
+        rows = rows.slice(0, options.maxRows);
+      }
+      if (options.safe) {
+        const detections = detectionsByTable.get(tableName);
+        if (detections) {
+          const hasPII = detections.some((d) => d.shouldMask);
+          if (hasPII) {
+            if (safeMode === "tokenize" && tokenPrefix) {
+              const { tokenizedRows } = tokenizeTableRows(rows, detections, tableName, tokenPrefix);
+              rows = tokenizedRows;
+            } else if (safeMode === "redact") {
+              const redactDetections = detections.map((d) => d.shouldMask ? { ...d, maskStrategy: "redact" } : d);
+              const { maskedRows } = maskTableRows(rows, redactDetections, random, tableName);
+              rows = maskedRows;
+            } else {
+              const { maskedRows } = maskTableRows(rows, detections, random, tableName);
+              rows = maskedRows;
+            }
+          }
+        }
+      }
       const rowCount = rows.length;
       packDataset.tables[tableName] = {
         columns,
@@ -31725,6 +31802,7 @@ async function captureDatabase(config, options) {
       }
     };
     const masked = maskConnection(config.database.connectionString);
+    const safeModeValue = options.safe ? safeMode === "tokenize" ? "tokenized" : safeMode === "redact" ? "redacted" : "masked" : "raw";
     const pack = {
       format: "realitydb-pack",
       version: "1.0",
@@ -31736,7 +31814,9 @@ async function captureDatabase(config, options) {
         totalRows,
         tableCount: tablesToCapture.length,
         ddl,
-        capturedFrom: masked
+        capturedFrom: masked,
+        safeMode: safeModeValue,
+        piiSummary
       },
       schema: packSchema,
       plan,
@@ -31751,7 +31831,8 @@ async function captureDatabase(config, options) {
       totalRows,
       tableCount: tablesToCapture.length,
       durationMs,
-      tableDetails
+      tableDetails,
+      piiSummary
     };
   } finally {
     await closeConnection(pool);
@@ -31779,7 +31860,7 @@ async function uploadToGist(content, options) {
       [options.filename]: { content }
     }
   });
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const req = import_node_https.default.request({
       hostname: "api.github.com",
       path: "/gists",
@@ -31801,7 +31882,7 @@ async function uploadToGist(content, options) {
           try {
             const parsed = JSON.parse(data);
             const fileEntry = parsed.files[options.filename];
-            resolve13({
+            resolve14({
               url: parsed.html_url,
               rawUrl: fileEntry?.raw_url ?? parsed.html_url,
               gistId: parsed.id
@@ -31928,7 +32009,7 @@ function fetchUrl(url, redirectCount = 0) {
     throw new Error("Too many redirects");
   }
   const lib = url.startsWith("https") ? import_node_https2.default : import_node_http.default;
-  return new Promise((resolve13, reject) => {
+  return new Promise((resolve14, reject) => {
     const req = lib.get(url, {
       headers: {
         "User-Agent": "realitydb-cli",
@@ -31936,7 +32017,7 @@ function fetchUrl(url, redirectCount = 0) {
       }
     }, (res) => {
       if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-        resolve13(fetchUrl(res.headers.location, redirectCount + 1));
+        resolve14(fetchUrl(res.headers.location, redirectCount + 1));
         return;
       }
       if (res.statusCode && (res.statusCode < 200 || res.statusCode >= 300)) {
@@ -31949,7 +32030,7 @@ function fetchUrl(url, redirectCount = 0) {
       });
       res.on("end", () => {
         const buffer = Buffer.concat(chunks);
-        resolve13(buffer.toString("utf-8"));
+        resolve14(buffer.toString("utf-8"));
       });
     });
     req.on("error", (err) => {
@@ -32457,9 +32538,9 @@ var DEFAULT_CONNECTIONS = {
 };
 var SUPPORTED_CLIENTS = ["postgres", "mysql"];
 function ask(rl, prompt) {
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     rl.question(prompt, (answer) => {
-      resolve13(answer);
+      resolve14(answer);
     });
   });
 }
@@ -33737,6 +33818,18 @@ async function captureCommand(options) {
     const config = await loadConfig(options.configPath);
     const masked = maskConnectionString(config.database.connectionString);
     const tables = options.tables ? options.tables.split(",").map((t) => t.trim()).filter((t) => t.length > 0) : void 0;
+    const safeMode = options.safe ? ["mask", "tokenize", "redact"].includes(options.safeMode ?? "") ? options.safeMode : "mask" : void 0;
+    const maxRows = options.maxRows ? parseInt(options.maxRows, 10) : void 0;
+    let around;
+    if (options.around) {
+      const eqIdx = options.around.indexOf("=");
+      if (eqIdx > 0) {
+        around = {
+          column: options.around.substring(0, eqIdx),
+          value: options.around.substring(eqIdx + 1)
+        };
+      }
+    }
     if (!options.ci) {
       console.log("");
       console.log("RealityDB Capture");
@@ -33746,6 +33839,15 @@ async function captureCommand(options) {
       if (tables) {
         console.log(`Tables: ${tables.join(", ")}`);
       }
+      if (options.safe) {
+        console.log(`Safe mode: ${safeMode} (PII will be sanitized)`);
+      }
+      if (maxRows !== void 0) {
+        console.log(`Max rows per table: ${maxRows}`);
+      }
+      if (around) {
+        console.log("");
+      }
       console.log("");
       console.log("Capturing...");
     }
@@ -33753,7 +33855,11 @@ async function captureCommand(options) {
       name: options.name,
       description: options.description,
       tables,
-      outputDir: options.output
+      outputDir: options.output,
+      safe: options.safe,
+      safeMode,
+      maxRows,
+      around
     });
     const durationMs = Math.round(performance.now() - start);
     if (options.ci) {
@@ -33769,6 +33875,8 @@ async function captureCommand(options) {
           filePath: result.filePath,
           tableCount: result.tableCount,
           totalRows: result.totalRows,
+          safeMode: result.pack.metadata.safeMode,
+          piiSummary: result.piiSummary,
           tables: result.tableDetails.map((t) => ({
             name: t.name,
             rowCount: t.rowCount
@@ -33778,6 +33886,21 @@ async function captureCommand(options) {
       }));
       return;
     }
+    if (options.safe && result.piiSummary) {
+      const { columnsDetected, tablesAffected, categoriesFound } = result.piiSummary;
+      if (columnsDetected > 0) {
+        console.log(`PII detected: ${columnsDetected} columns across ${tablesAffected} tables. Sanitizing...`);
+        console.log(`  Categories: ${categoriesFound.join(", ")}`);
+        console.log("");
+      } else {
+        console.log("No PII detected \u2014 data captured as-is.");
+        console.log("");
+      }
+    }
+    if (around) {
+      console.log(`Capturing rows related to ${around.column}=${around.value} across ${result.tableCount} tables`);
+      console.log("");
+    }
     for (const table of result.tableDetails) {
       console.log(`  ${table.name}: ${table.rowCount} rows`);
     }
@@ -33785,6 +33908,9 @@ async function captureCommand(options) {
     const sizeKb = Math.round(fileStat.size / 1024);
     console.log("");
     console.log(`Captured: ${result.filePath} (${sizeKb} KB)`);
+    if (options.safe) {
+      console.log(`Privacy: PII sanitized (${safeMode} mode). Safe to share.`);
+    }
     console.log("Schema DDL included. Share this file to reproduce the environment.");
     console.log("");
   } catch (err) {
@@ -33915,6 +34041,19 @@ var VERSION9 = "0.10.0";
 function isUrl(input) {
   return input.startsWith("http://") || input.startsWith("https://");
 }
+function displaySafeModeStatus(safeMode) {
+  if (!safeMode) {
+    console.warn("Note: This pack was captured before privacy-safe mode was available");
+  } else if (safeMode === "raw") {
+    console.log("WARNING: This pack contains raw (unsanitized) data");
+  } else if (safeMode === "masked") {
+    console.log("This pack was captured with PII masking");
+  } else if (safeMode === "tokenized") {
+    console.log("This pack was captured with PII tokenization");
+  } else if (safeMode === "redacted") {
+    console.log("This pack was captured with PII redaction");
+  }
+}
 async function loadCommand(filePath, options) {
   const start = performance.now();
   try {
@@ -33950,6 +34089,57 @@ async function loadCommand(filePath, options) {
       }
     }
     const pack = await loadRealityPack(localPath);
+    if (options.preview) {
+      const meta2 = pack.metadata;
+      const safeMode2 = meta2.safeMode;
+      const piiSummary = meta2.piiSummary;
+      if (options.ci) {
+        const tableNames = Object.keys(pack.dataset.tables);
+        const tableInfo = tableNames.map((name) => ({
+          name,
+          rowCount: pack.dataset.tables[name].rowCount
+        }));
+        console.log(formatCIOutput({
+          success: true,
+          command: "load",
+          version: VERSION9,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          durationMs: Math.round(performance.now() - start),
+          data: {
+            packName: pack.metadata.name,
+            safeMode: safeMode2 ?? null,
+            piiSummary: piiSummary ?? null,
+            tableCount: pack.metadata.tableCount,
+            totalRows: pack.metadata.totalRows,
+            tables: tableInfo
+          }
+        }));
+        return;
+      }
+      console.log("");
+      console.log("Reality Pack Preview");
+      console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+      console.log(`Name: ${pack.metadata.name}`);
+      if (pack.metadata.description) {
+        console.log(`Description: ${pack.metadata.description}`);
+      }
+      console.log(`Tables: ${pack.metadata.tableCount}`);
+      console.log(`Total rows: ${pack.metadata.totalRows}`);
+      console.log("");
+      displaySafeModeStatus(safeMode2);
+      if (piiSummary) {
+        console.log(`  PII columns detected: ${piiSummary.columnsDetected}`);
+        console.log(`  Tables affected: ${piiSummary.tablesAffected}`);
+        console.log(`  Categories: ${piiSummary.categoriesFound.join(", ")}`);
+      }
+      console.log("");
+      console.log("Tables:");
+      for (const [name, tableData] of Object.entries(pack.dataset.tables)) {
+        console.log(`  ${name}: ${tableData.rowCount} rows`);
+      }
+      console.log("");
+      return;
+    }
     if (options.showDdl) {
       const ddl = pack.metadata.ddl;
       if (options.ci) {
@@ -33982,6 +34172,8 @@ async function loadCommand(filePath, options) {
     }
     const config = await loadConfig(options.configPath);
     const masked = maskConnectionString(config.database.connectionString);
+    const meta = pack.metadata;
+    const safeMode = meta.safeMode;
     if (!options.ci) {
       console.log("");
       console.log("RealityDB Load");
@@ -34001,6 +34193,8 @@ async function loadCommand(filePath, options) {
         console.log("Schema DDL: included");
       }
       console.log("");
+      displaySafeModeStatus(safeMode);
+      console.log("");
     }
     if (!options.ci && !options.confirm) {
       console.error("[realitydb] Load requires --confirm flag.");
@@ -34008,6 +34202,9 @@ async function loadCommand(filePath, options) {
       console.error("");
       console.error("To view the schema DDL first:");
       console.error(`  realitydb load ${filePath} --show-ddl`);
+      console.error("");
+      console.error("To preview pack contents:");
+      console.error(`  realitydb load ${filePath} --preview`);
       process.exit(1);
     }
     if (!options.ci) {
@@ -34026,6 +34223,7 @@ async function loadCommand(filePath, options) {
           database: masked,
           packName: pack.metadata.name,
           totalRows: result.totalRows,
+          safeMode: safeMode ?? null,
           source: isUrl(filePath) ? filePath : void 0,
           tables: result.insertResult.tables.map((t) => ({
             name: t.tableName,
@@ -34043,7 +34241,8 @@ async function loadCommand(filePath, options) {
     }
     const totalTime = (result.durationMs / 1e3).toFixed(1);
     console.log("");
-    console.log(`Load complete. ${result.totalRows} rows in ${totalTime}s`);
+    console.log(`Bug reproduction environment ready. ${result.insertResult.tables.length} tables, ${result.totalRows} rows loaded.`);
+    console.log(`Load complete in ${totalTime}s`);
     console.log("");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -34418,12 +34617,396 @@ async function analyzeCommand(options) {
   }
 }
 
-// src/commands/mask.ts
+// src/commands/run.ts
 var import_node_fs12 = require("fs");
 var import_node_path17 = require("path");
+var VERSION13 = "1.0.0";
+function strategyToSqlType(strategy) {
+  switch (strategy) {
+    case "uuid":
+    case "foreign_key":
+      return { dataType: "UUID", maxLength: null, numericPrecision: null, numericScale: null };
+    case "full_name":
+    case "first_name":
+    case "last_name":
+    case "email":
+    case "phone":
+    case "text":
+    case "company_name":
+    case "address":
+    case "custom":
+      return { dataType: "VARCHAR", maxLength: 255, numericPrecision: null, numericScale: null };
+    case "integer":
+    case "auto_increment":
+      return { dataType: "INTEGER", maxLength: null, numericPrecision: null, numericScale: null };
+    case "float":
+    case "money":
+      return { dataType: "NUMERIC", maxLength: null, numericPrecision: 12, numericScale: 2 };
+    case "boolean":
+      return { dataType: "BOOLEAN", maxLength: null, numericPrecision: null, numericScale: null };
+    case "timestamp":
+      return { dataType: "TIMESTAMPTZ", maxLength: null, numericPrecision: null, numericScale: null };
+    case "enum":
+      return { dataType: "VARCHAR", maxLength: 50, numericPrecision: null, numericScale: null };
+    default:
+      return { dataType: "VARCHAR", maxLength: 255, numericPrecision: null, numericScale: null };
+  }
+}
+function collectNullableFromLifecycle(columns) {
+  const nullableFields = /* @__PURE__ */ new Set();
+  for (const col of Object.values(columns)) {
+    const opts = col.options;
+    if (opts?.lifecycleRules && Array.isArray(opts.lifecycleRules)) {
+      for (const rule of opts.lifecycleRules) {
+        const r = rule;
+        if (r.nullFields) {
+          for (const f of r.nullFields) {
+            nullableFields.add(f);
+          }
+        }
+      }
+    }
+  }
+  return nullableFields;
+}
+function extractSchemaFromTemplate(template) {
+  const tables = [];
+  const foreignKeys = [];
+  for (const [tableName, tableJson] of Object.entries(template.tables)) {
+    const lifecycleNullable = collectNullableFromLifecycle(tableJson.columns);
+    const columns = [];
+    let ordinal = 1;
+    for (const [colName, colJson] of Object.entries(tableJson.columns)) {
+      const strategy = colJson.foreignKey ? "foreign_key" : colJson.strategy;
+      const typeInfo = strategyToSqlType(strategy);
+      const isPK = strategy === "uuid" && colName === "id";
+      const isNullable = lifecycleNullable.has(colName);
+      columns.push({
+        name: colName,
+        dataType: typeInfo.dataType,
+        udtName: typeInfo.dataType.toLowerCase(),
+        isNullable: isPK ? false : isNullable,
+        hasDefault: false,
+        defaultValue: null,
+        maxLength: typeInfo.maxLength,
+        numericPrecision: typeInfo.numericPrecision,
+        numericScale: typeInfo.numericScale,
+        isPrimaryKey: isPK,
+        isUnique: isPK,
+        ordinalPosition: ordinal++
+      });
+      if (colJson.foreignKey) {
+        foreignKeys.push({
+          constraintName: `fk_${tableName}_${colName}`,
+          sourceTable: tableName,
+          sourceColumn: colName,
+          targetTable: colJson.foreignKey.table,
+          targetColumn: colJson.foreignKey.column
+        });
+      }
+    }
+    tables.push({
+      name: tableName,
+      schema: "public",
+      columns,
+      primaryKey: columns.find((c) => c.isPrimaryKey) ? { columnName: "id", constraintName: `pk_${tableName}` } : null,
+      estimatedRowCount: 0
+    });
+  }
+  return {
+    tables,
+    foreignKeys,
+    tableCount: tables.length,
+    foreignKeyCount: foreignKeys.length
+  };
+}
+function getDropOrder(schema) {
+  const createOrder = getCreateOrder(schema);
+  return [...createOrder].reverse();
+}
+function getCreateOrder(schema) {
+  const tableNames = new Set(schema.tables.map((t) => t.name));
+  const deps = /* @__PURE__ */ new Map();
+  for (const name of tableNames) {
+    deps.set(name, /* @__PURE__ */ new Set());
+  }
+  for (const fk of schema.foreignKeys) {
+    if (fk.sourceTable !== fk.targetTable && tableNames.has(fk.targetTable)) {
+      deps.get(fk.sourceTable).add(fk.targetTable);
+    }
+  }
+  const result = [];
+  const visited = /* @__PURE__ */ new Set();
+  const visiting = /* @__PURE__ */ new Set();
+  function visit(name) {
+    if (visited.has(name)) return;
+    if (visiting.has(name)) return;
+    visiting.add(name);
+    for (const dep of deps.get(name) ?? []) {
+      visit(dep);
+    }
+    visiting.delete(name);
+    visited.add(name);
+    result.push(name);
+  }
+  for (const name of tableNames) {
+    visit(name);
+  }
+  return result;
+}
+async function runCommand(options) {
+  const start = performance.now();
+  const packPath = (0, import_node_path17.resolve)(options.pack);
+  const masked = maskConnectionString(options.connection);
+  const records = options.records ? parseInt(options.records, 10) : void 0;
+  const seed = options.seed ? parseInt(options.seed, 10) : void 0;
+  if (!(0, import_node_fs12.existsSync)(packPath)) {
+    const msg = `Pack file not found: ${packPath}`;
+    if (options.ci) {
+      console.log(formatCIOutput({ success: false, command: "run", version: VERSION13, timestamp: (/* @__PURE__ */ new Date()).toISOString(), durationMs: 0, error: msg }));
+      process.exit(1);
+    }
+    console.error(`[realitydb] ${msg}`);
+    console.error("Hint: Provide the path to a Studio-exported template JSON file.");
+    process.exit(1);
+  }
+  let raw;
+  try {
+    raw = (0, import_node_fs12.readFileSync)(packPath, "utf-8");
+  } catch (err) {
+    const msg = `Cannot read pack file: ${err instanceof Error ? err.message : String(err)}`;
+    if (options.ci) {
+      console.log(formatCIOutput({ success: false, command: "run", version: VERSION13, timestamp: (/* @__PURE__ */ new Date()).toISOString(), durationMs: 0, error: msg }));
+      process.exit(1);
+    }
+    console.error(`[realitydb] ${msg}`);
+    process.exit(1);
+  }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    const msg = `Pack file is not valid JSON: ${packPath}`;
+    if (options.ci) {
+      console.log(formatCIOutput({ success: false, command: "run", version: VERSION13, timestamp: (/* @__PURE__ */ new Date()).toISOString(), durationMs: 0, error: msg }));
+      process.exit(1);
+    }
+    console.error(`[realitydb] ${msg}`);
+    console.error("Hint: Ensure the file is a valid Studio-exported template JSON.");
+    process.exit(1);
+  }
+  let template;
+  try {
+    template = assertValidTemplate(json);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (options.ci) {
+      console.log(formatCIOutput({ success: false, command: "run", version: VERSION13, timestamp: (/* @__PURE__ */ new Date()).toISOString(), durationMs: 0, error: msg }));
+      process.exit(1);
+    }
+    console.error(`[realitydb] ${msg}`);
+    process.exit(1);
+  }
+  const schema = extractSchemaFromTemplate(template);
+  const ddl = generateCreateTableDDL(schema);
+  const effectiveRecords = records ?? template.generationConfig?.seed?.defaultRecords ?? 1e3;
+  const effectiveSeed = seed ?? template.generationConfig?.seed?.randomSeed ?? 42;
+  if (!options.ci) {
+    console.log("");
+    console.log("RealityDB Run");
+    console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+    console.log(`Pack: ${packPath}`);
+    console.log(`Database: ${masked}`);
+    console.log(`Records per table: ${effectiveRecords}`);
+    console.log(`Seed: ${effectiveSeed}`);
+    if (options.dropExisting) console.log("Drop existing: yes");
+    if (options.dryRun) console.log("Mode: dry run");
+    console.log("");
+  }
+  if (options.dryRun) {
+    if (options.ci) {
+      const tableNames = Object.keys(template.tables);
+      const planSummary = tableNames.map((name) => ({
+        table: name,
+        columns: Object.keys(template.tables[name].columns).length,
+        records: effectiveRecords
+      }));
+      console.log(formatCIOutput({
+        success: true,
+        command: "run",
+        version: VERSION13,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        durationMs: Math.round(performance.now() - start),
+        data: { dryRun: true, ddl, plan: planSummary }
+      }));
+      return;
+    }
+    console.log("DDL that would be executed:");
+    console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    if (options.dropExisting) {
+      const dropOrder = getDropOrder(schema);
+      for (const tableName of dropOrder) {
+        console.log(`DROP TABLE IF EXISTS "${tableName}" CASCADE;`);
+      }
+      console.log("");
+    }
+    console.log(ddl);
+    console.log("Generation Plan:");
+    console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    for (const [tableName, tableJson] of Object.entries(template.tables)) {
+      const colCount = Object.keys(tableJson.columns).length;
+      const strategies = Object.values(tableJson.columns).map((c) => c.strategy);
+      const uniqueStrategies = [...new Set(strategies)].join(", ");
+      console.log(`  ${tableName}: ${effectiveRecords} rows, ${colCount} columns [${uniqueStrategies}]`);
+    }
+    console.log("");
+    console.log("Dry run complete. No changes were made.");
+    return;
+  }
+  const clientType = template.generationConfig?.database?.client ?? "postgres";
+  const pool = createDatabaseClient(clientType, options.connection);
+  try {
+    try {
+      await testConnection(pool);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (options.ci) {
+        console.log(formatCIOutput({ success: false, command: "run", version: VERSION13, timestamp: (/* @__PURE__ */ new Date()).toISOString(), durationMs: Math.round(performance.now() - start), error: msg }));
+        process.exit(1);
+      }
+      console.error(`[realitydb] Cannot connect to database: ${msg}`);
+      console.error("Hint: Check your connection string and ensure the database is running.");
+      process.exit(1);
+    }
+    if (!options.dropExisting) {
+      const existingTables = [];
+      for (const table of schema.tables) {
+        try {
+          const client = await pool.connect();
+          try {
+            const result2 = await client.query(
+              `SELECT to_regclass('"${table.name}"') AS exists_check`
+            );
+            if (result2.rows[0]?.exists_check) {
+              existingTables.push(table.name);
+            }
+          } finally {
+            client.release();
+          }
+        } catch {
+        }
+      }
+      if (existingTables.length > 0) {
+        const msg = `Tables already exist: ${existingTables.join(", ")}. Use --drop-existing to recreate them.`;
+        if (options.ci) {
+          console.log(formatCIOutput({ success: false, command: "run", version: VERSION13, timestamp: (/* @__PURE__ */ new Date()).toISOString(), durationMs: Math.round(performance.now() - start), error: msg }));
+          process.exit(1);
+        }
+        console.error(`[realitydb] ${msg}`);
+        process.exit(1);
+      }
+    }
+    if (!options.ci) {
+      console.log("Creating schema...");
+    }
+    try {
+      await withTransaction(pool, async (client) => {
+        if (options.dropExisting) {
+          const dropOrder = getDropOrder(schema);
+          for (const tableName of dropOrder) {
+            await client.query(`DROP TABLE IF EXISTS "${tableName}" CASCADE`);
+          }
+        }
+        const statements = ddl.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+        for (const stmt of statements) {
+          await client.query(stmt + ";");
+        }
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (options.ci) {
+        console.log(formatCIOutput({ success: false, command: "run", version: VERSION13, timestamp: (/* @__PURE__ */ new Date()).toISOString(), durationMs: Math.round(performance.now() - start), error: `DDL failed: ${msg}` }));
+        process.exit(1);
+      }
+      console.error(`[realitydb] DDL failed: ${msg}`);
+      console.error("Database was not modified (transaction rolled back).");
+      process.exit(1);
+    }
+    if (!options.ci) {
+      for (const table of schema.tables) {
+        console.log(`  Created table: ${table.name} (${table.columns.length} columns)`);
+      }
+      console.log("");
+    }
+    if (!options.ci) {
+      console.log("Seeding data...");
+    }
+    const config = {
+      database: {
+        client: clientType,
+        connectionString: options.connection
+      },
+      seed: {
+        defaultRecords: effectiveRecords,
+        batchSize: 500,
+        environment: "development",
+        randomSeed: effectiveSeed
+      },
+      template: packPath
+    };
+    const result = await seedDatabase(config, {
+      records: effectiveRecords,
+      seed: effectiveSeed,
+      template: packPath
+    });
+    const durationMs = Math.round(performance.now() - start);
+    const totalTime = (durationMs / 1e3).toFixed(1);
+    if (options.ci) {
+      console.log(formatCIOutput({
+        success: true,
+        command: "run",
+        version: VERSION13,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        durationMs,
+        data: {
+          tablesCreated: schema.tables.length,
+          totalRows: result.totalRows,
+          pack: packPath,
+          database: masked,
+          tables: result.insertResult.tables.map((t) => ({
+            name: t.tableName,
+            rowsInserted: t.rowsInserted,
+            batchCount: t.batchCount,
+            durationMs: t.durationMs
+          }))
+        }
+      }));
+      return;
+    }
+    for (const tableResult of result.insertResult.tables) {
+      console.log(
+        `  ${tableResult.tableName}: ${tableResult.rowsInserted} rows inserted (${tableResult.batchCount} batches, ${tableResult.durationMs}ms)`
+      );
+    }
+    console.log("");
+    console.log("RealityDB Run Complete");
+    console.log("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
+    console.log(`Schema: ${schema.tables.length} tables created`);
+    console.log(`Data: ${result.totalRows} total rows in ${totalTime}s`);
+    console.log(`Pack: ${packPath}`);
+    console.log(`Database: ${masked}`);
+    console.log("");
+  } finally {
+    await closeConnection(pool);
+  }
+}
+
+// src/commands/mask.ts
+var import_node_fs13 = require("fs");
+var import_node_path18 = require("path");
 var import_node_readline2 = require("readline");
 var import_node_process2 = require("process");
-var VERSION13 = "1.3.1";
+var VERSION14 = "1.3.1";
 function askPassphrase(prompt) {
   return new Promise((resolvePromise) => {
     const rl = (0, import_node_readline2.createInterface)({ input: import_node_process2.stdin, output: import_node_process2.stdout });
@@ -34460,7 +35043,7 @@ async function maskCommand(options) {
         console.log(formatCIOutput({
           success: false,
           command: "mask",
-          version: VERSION13,
+          version: VERSION14,
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           durationMs: Math.round(performance.now() - start),
           error: msg
@@ -34476,7 +35059,7 @@ async function maskCommand(options) {
         console.log(formatCIOutput({
           success: false,
           command: "mask",
-          version: VERSION13,
+          version: VERSION14,
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           durationMs: Math.round(performance.now() - start),
           error: msg
@@ -34527,8 +35110,8 @@ async function maskCommand(options) {
     });
     const durationMs = Math.round(performance.now() - start);
     if (options.auditLog) {
-      const auditPath = (0, import_node_path17.resolve)(options.auditLog);
-      (0, import_node_fs12.writeFileSync)(auditPath, serializeAuditLog(result.auditLog) + "\n", "utf-8");
+      const auditPath = (0, import_node_path18.resolve)(options.auditLog);
+      (0, import_node_fs13.writeFileSync)(auditPath, serializeAuditLog(result.auditLog) + "\n", "utf-8");
     }
     if (options.tokenMap && result.tokenMap) {
       const passphrase = await askPassphrase("Enter passphrase for token map encryption: ");
@@ -34536,8 +35119,8 @@ async function maskCommand(options) {
         console.error("[realitydb] Passphrase cannot be empty. Token map not written.");
       } else {
         const encryptedData = encryptTokenMap(result.tokenMap, passphrase);
-        const tokenMapPath = (0, import_node_path17.resolve)(options.tokenMap);
-        (0, import_node_fs12.writeFileSync)(tokenMapPath, encryptedData + "\n", "utf-8");
+        const tokenMapPath = (0, import_node_path18.resolve)(options.tokenMap);
+        (0, import_node_fs13.writeFileSync)(tokenMapPath, encryptedData + "\n", "utf-8");
         if (!options.ci) {
           console.log(`Token map exported (AES-256-GCM encrypted) \u2192 ${tokenMapPath}`);
           console.log(`  ${result.tokenMap.totalTokens} unique tokens generated`);
@@ -34550,7 +35133,7 @@ async function maskCommand(options) {
       console.log(formatCIOutput({
         success: true,
         command: "mask",
-        version: VERSION13,
+        version: VERSION14,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: {
@@ -34582,7 +35165,7 @@ async function maskCommand(options) {
       console.log("");
     }
     if (options.auditLog) {
-      console.log(`Audit log written to: ${(0, import_node_path17.resolve)(options.auditLog)}`);
+      console.log(`Audit log written to: ${(0, import_node_path18.resolve)(options.auditLog)}`);
       console.log("");
     }
     const totalTime = (durationMs / 1e3).toFixed(1);
@@ -34598,7 +35181,7 @@ async function maskCommand(options) {
       console.log(formatCIOutput({
         success: false,
         command: "mask",
-        version: VERSION13,
+        version: VERSION14,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -34619,8 +35202,8 @@ async function maskCommand(options) {
 }
 
 // src/commands/audit.ts
-var import_node_fs13 = require("fs");
-var import_node_path18 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path19 = require("path");
 var import_node_readline3 = require("readline");
 var import_node_process3 = require("process");
 function askPassphrase2(prompt) {
@@ -34646,8 +35229,8 @@ function askPassphrase2(prompt) {
 }
 async function auditVerifyCommand(logFile, options) {
   try {
-    const filePath = (0, import_node_path18.resolve)(logFile);
-    const raw = (0, import_node_fs13.readFileSync)(filePath, "utf-8");
+    const filePath = (0, import_node_path19.resolve)(logFile);
+    const raw = (0, import_node_fs14.readFileSync)(filePath, "utf-8");
     const log = JSON.parse(raw);
     const result = verifyAuditLogIntegrity(log);
     const entryCount = log.tables?.length ?? 0;
@@ -34681,8 +35264,8 @@ async function auditVerifyCommand(logFile, options) {
 }
 async function auditSummaryCommand(logFile, options) {
   try {
-    const filePath = (0, import_node_path18.resolve)(logFile);
-    const raw = (0, import_node_fs13.readFileSync)(filePath, "utf-8");
+    const filePath = (0, import_node_path19.resolve)(logFile);
+    const raw = (0, import_node_fs14.readFileSync)(filePath, "utf-8");
     const log = JSON.parse(raw);
     if (options.ci) {
       console.log(JSON.stringify({
@@ -34712,8 +35295,8 @@ async function auditReIdentifyCommand(options) {
       console.error("[realitydb] --token-map <file> is required for re-identify");
       process.exit(1);
     }
-    const filePath = (0, import_node_path18.resolve)(options.tokenMap);
-    const encryptedData = (0, import_node_fs13.readFileSync)(filePath, "utf-8").trim();
+    const filePath = (0, import_node_path19.resolve)(options.tokenMap);
+    const encryptedData = (0, import_node_fs14.readFileSync)(filePath, "utf-8").trim();
     const passphrase = await askPassphrase2("Enter passphrase to decrypt token map: ");
     if (!passphrase) {
       console.error("[realitydb] Passphrase cannot be empty.");
@@ -34765,9 +35348,9 @@ async function auditReIdentifyCommand(options) {
 }
 
 // src/commands/classroom.ts
-var import_node_fs14 = require("fs");
-var import_node_path19 = require("path");
-var VERSION14 = "1.3.1";
+var import_node_fs15 = require("fs");
+var import_node_path20 = require("path");
+var VERSION15 = "1.3.1";
 async function classroomListCommand(options) {
   const start = performance.now();
   try {
@@ -34777,7 +35360,7 @@ async function classroomListCommand(options) {
       console.log(formatCIOutput({
         success: true,
         command: "classroom list",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: {
@@ -34813,7 +35396,7 @@ async function classroomListCommand(options) {
       console.log(formatCIOutput({
         success: false,
         command: "classroom list",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -34844,7 +35427,7 @@ async function classroomStartCommand(courseName, options) {
       console.log(formatCIOutput({
         success: true,
         command: "classroom start",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: {
@@ -34878,7 +35461,7 @@ async function classroomStartCommand(courseName, options) {
       console.log(formatCIOutput({
         success: false,
         command: "classroom start",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -34908,7 +35491,7 @@ async function classroomStatusCommand(courseName, options) {
       console.log(formatCIOutput({
         success: true,
         command: "classroom status",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: { courses: result.courses }
@@ -34935,7 +35518,7 @@ async function classroomStatusCommand(courseName, options) {
       console.log(formatCIOutput({
         success: false,
         command: "classroom status",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -34955,7 +35538,7 @@ async function classroomCompleteCommand(courseName, exerciseId, options) {
       console.log(formatCIOutput({
         success: true,
         command: "classroom complete",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: { courseName, exerciseId, completed: true }
@@ -34978,7 +35561,7 @@ async function classroomCompleteCommand(courseName, exerciseId, options) {
       console.log(formatCIOutput({
         success: false,
         command: "classroom complete",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -34998,7 +35581,7 @@ async function classroomResetCommand(courseName, options) {
       console.log(formatCIOutput({
         success: true,
         command: "classroom reset",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: { courseName, reset: true }
@@ -35013,7 +35596,7 @@ async function classroomResetCommand(courseName, options) {
       console.log(formatCIOutput({
         success: false,
         command: "classroom reset",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -35029,14 +35612,14 @@ async function classroomCreateCommand(name, options) {
   try {
     const content = classroomCreate(name);
     const filename = `${name}.course.json`;
-    const filePath = (0, import_node_path19.resolve)(filename);
-    (0, import_node_fs14.writeFileSync)(filePath, content + "\n", "utf-8");
+    const filePath = (0, import_node_path20.resolve)(filename);
+    (0, import_node_fs15.writeFileSync)(filePath, content + "\n", "utf-8");
     const durationMs = Math.round(performance.now() - start);
     if (options.ci) {
       console.log(formatCIOutput({
         success: true,
         command: "classroom create",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: { name, file: filePath }
@@ -35055,7 +35638,7 @@ async function classroomCreateCommand(name, options) {
       console.log(formatCIOutput({
         success: false,
         command: "classroom create",
-        version: VERSION14,
+        version: VERSION15,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -35074,7 +35657,7 @@ function buildProgressBar(percent) {
 }
 
 // src/commands/simulate.ts
-var VERSION15 = "1.3.1";
+var VERSION16 = "1.3.1";
 async function simulateRunCommand(options) {
   const start = performance.now();
   try {
@@ -35106,7 +35689,7 @@ async function simulateRunCommand(options) {
       console.log(formatCIOutput({
         success: true,
         command: "simulate run",
-        version: VERSION15,
+        version: VERSION16,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: {
@@ -35130,7 +35713,7 @@ async function simulateRunCommand(options) {
       console.log(formatCIOutput({
         success: false,
         command: "simulate run",
-        version: VERSION15,
+        version: VERSION16,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -35150,7 +35733,7 @@ async function simulateProfilesCommand(options) {
       console.log(formatCIOutput({
         success: true,
         command: "simulate profiles",
-        version: VERSION15,
+        version: VERSION16,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: {
@@ -35185,7 +35768,7 @@ async function simulateProfilesCommand(options) {
       console.log(formatCIOutput({
         success: false,
         command: "simulate profiles",
-        version: VERSION15,
+        version: VERSION16,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -35209,7 +35792,7 @@ async function simulateWebhooksCommand(options) {
         console.log(formatCIOutput({
           success: false,
           command: "simulate webhooks",
-          version: VERSION15,
+          version: VERSION16,
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           durationMs: Math.round(performance.now() - start),
           error: msg
@@ -35242,7 +35825,7 @@ async function simulateWebhooksCommand(options) {
       console.log(formatCIOutput({
         success: true,
         command: "simulate webhooks",
-        version: VERSION15,
+        version: VERSION16,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs,
         data: {
@@ -35267,7 +35850,7 @@ async function simulateWebhooksCommand(options) {
       console.log(formatCIOutput({
         success: false,
         command: "simulate webhooks",
-        version: VERSION15,
+        version: VERSION16,
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         durationMs: Math.round(performance.now() - start),
         error: message
@@ -35280,11 +35863,11 @@ async function simulateWebhooksCommand(options) {
 }
 
 // src/cli.ts
-var VERSION16 = "1.8.0";
+var VERSION17 = "2.0.0";
 function run(argv) {
   const program2 = new Command();
-  program2.name("realitydb").description("RealityDB \xC3\u0192\xC6\u2019\xC3\u2020\xE2\u20AC\u2122\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\xA2\xC3\u0192\xC6\u2019\xC3\u201A\xC2\xA2\xC3\u0192\xC2\xA2\xC3\xA2\xE2\u20AC\u0161\xC2\xAC\xC3\u2026\xC2\xA1\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\xAC\xC3\u0192\xC6\u2019\xC3\u201A\xC2\xA2\xC3\u0192\xC2\xA2\xC3\xA2\xE2\u201A\xAC\xC5\xA1\xC3\u201A\xC2\xAC\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\x9D Developer Reality Platform").version(VERSION16).option("--config <path>", "Path to config file").option("--ci", "CI mode: JSON output, no prompts, proper exit codes", false).option("--verbose", "Enable verbose output", false);
-  program2.command("init").description("Interactive setup wizard \xC3\u0192\xC6\u2019\xC3\u2020\xE2\u20AC\u2122\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\xA2\xC3\u0192\xC6\u2019\xC3\u201A\xC2\xA2\xC3\u0192\xC2\xA2\xC3\xA2\xE2\u20AC\u0161\xC2\xAC\xC3\u2026\xC2\xA1\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\xAC\xC3\u0192\xC6\u2019\xC3\u201A\xC2\xA2\xC3\u0192\xC2\xA2\xC3\xA2\xE2\u201A\xAC\xC5\xA1\xC3\u201A\xC2\xAC\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\x9D connect, scan, and seed in one step").action(async () => {
+  program2.name("realitydb").description("RealityDB -- Developer Reality Platform").version(VERSION17).option("--config <path>", "Path to config file").option("--ci", "CI mode: JSON output, no prompts, proper exit codes", false).option("--verbose", "Enable verbose output", false);
+  program2.command("init").description("Interactive setup wizard -- connect, scan, and seed in one step").action(async () => {
     await initCommand();
   });
   program2.command("scan").description("Scan database schema").action(async () => {
@@ -35295,7 +35878,7 @@ function run(argv) {
     const opts = program2.opts();
     await analyzeCommand({ ...cmdOpts, ci: opts.ci, configPath: opts.config });
   });
-  program2.command("seed").description("Seed database with generated data").option("--records <count>", "Number of records per table").option("--template <name|path>", "Template name or path to custom .json file").option("--seed <number>", "Random seed for reproducibility").option("--timeline <duration>", 'Timeline duration (e.g., "12-months", "1-year")').option("--scenario <names>", "Scenarios to apply (comma-separated)").option("--scenario-intensity <level>", "Scenario intensity (low|medium|high)", "medium").option("--scenario-schedule <schedule>", 'Timeline-scheduled scenarios (e.g., "fraud-spike:month-6,churn-spike:month-9")').option("--lifecycle", "Enable lifecycle simulation for causally-connected data").option("--auto-template", "Run analyze \xE2\u2020\u2019 generate template \xE2\u2020\u2019 seed in one command").action(async (cmdOpts) => {
+  program2.command("seed").description("Seed database with generated data").option("--records <count>", "Number of records per table").option("--template <name|path>", "Template name or path to custom .json file").option("--seed <number>", "Random seed for reproducibility").option("--timeline <duration>", 'Timeline duration (e.g., "12-months", "1-year")').option("--scenario <names>", "Scenarios to apply (comma-separated)").option("--scenario-intensity <level>", "Scenario intensity (low|medium|high)", "medium").option("--scenario-schedule <schedule>", 'Timeline-scheduled scenarios (e.g., "fraud-spike:month-6,churn-spike:month-9")').option("--lifecycle", "Enable lifecycle simulation for causally-connected data").option("--auto-template", "Run analyze, generate template, and seed in one command").action(async (cmdOpts) => {
     const opts = program2.opts();
     await seedCommand({ ...cmdOpts, ci: opts.ci, configPath: opts.config });
   });
@@ -35311,6 +35894,10 @@ function run(argv) {
     const opts = program2.opts();
     await generateCommand({ ...cmdOpts, ci: opts.ci, configPath: opts.config });
   });
+  program2.command("run").description("Create schema and seed database from a Studio-exported template pack").requiredOption("--pack <path>", "Path to Studio template JSON file").requiredOption("--connection <url>", "Database connection string").option("--records <count>", "Number of records per table (overrides template config)").option("--seed <number>", "Random seed for reproducibility (overrides template config)").option("--drop-existing", "Drop and recreate tables if they already exist").option("--dry-run", "Show DDL and plan without executing").action(async (cmdOpts) => {
+    const opts = program2.opts();
+    await runCommand({ ...cmdOpts, ci: opts.ci });
+  });
   const templates = program2.command("templates").description("Template management");
   templates.command("list", { isDefault: true }).description("List available domain templates").action(templatesCommand);
   templates.command("init").description("Scaffold a new custom template JSON file").action(templatesInitCommand);
@@ -35378,7 +35965,7 @@ function run(argv) {
     const opts = program2.opts();
     await simulateWebhooksCommand({ ...cmdOpts, ci: opts.ci, configPath: opts.config });
   });
-  program2.command("capture").description("Capture live database state into a Reality Pack").requiredOption("--name <name>", "Name for the captured pack").option("--description <desc>", "Pack description").option("--tables <tables>", "Comma-separated list of tables to capture").option("--output <dir>", "Output directory", ".").action(async (cmdOpts) => {
+  program2.command("capture").description("Capture live database state into a Reality Pack").requiredOption("--name <name>", "Name for the captured pack").option("--description <desc>", "Pack description").option("--tables <tables>", "Comma-separated list of tables to capture").option("--output <dir>", "Output directory", ".").option("--safe", "Enable privacy-safe capture (sanitize PII before writing)").option("--safe-mode <mode>", "PII sanitization mode: mask (default), tokenize, redact", "mask").option("--max-rows <count>", "Maximum rows to capture per table").option("--around <column=value>", "Capture rows related to a specific entity (follows FK chains)").action(async (cmdOpts) => {
     const opts = program2.opts();
     await captureCommand({ ...cmdOpts, ci: opts.ci, configPath: opts.config });
   });
@@ -35386,7 +35973,7 @@ function run(argv) {
     const opts = program2.opts();
     await shareCommand(filePath, { ...cmdOpts, ci: opts.ci, configPath: opts.config });
   });
-  program2.command("load <file>").description("Load a Reality Pack into the database (file path or URL)").option("--confirm", "Confirm import operation").option("--show-ddl", "Show schema DDL without importing").action(async (filePath, cmdOpts) => {
+  program2.command("load <file>").description("Load a Reality Pack into the database (file path or URL)").option("--confirm", "Confirm import operation").option("--show-ddl", "Show schema DDL without importing").option("--preview", "Preview pack contents without importing").action(async (filePath, cmdOpts) => {
     const opts = program2.opts();
     await loadCommand(filePath, { ...cmdOpts, ci: opts.ci, configPath: opts.config });
   });
@@ -35407,10 +35994,10 @@ function run(argv) {
   program2.action(() => {
     const opts = program2.opts();
     if (opts.ci) {
-      console.log(JSON.stringify({ name: "realitydb", version: VERSION16 }));
+      console.log(JSON.stringify({ name: "realitydb", version: VERSION17 }));
     } else {
       console.log("");
-      console.log(`RealityDB v${VERSION16} \xC3\u0192\xC6\u2019\xC3\u2020\xE2\u20AC\u2122\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\xA2\xC3\u0192\xC6\u2019\xC3\u201A\xC2\xA2\xC3\u0192\xC2\xA2\xC3\xA2\xE2\u20AC\u0161\xC2\xAC\xC3\u2026\xC2\xA1\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\xAC\xC3\u0192\xC6\u2019\xC3\u201A\xC2\xA2\xC3\u0192\xC2\xA2\xC3\xA2\xE2\u201A\xAC\xC5\xA1\xC3\u201A\xC2\xAC\xC3\u0192\xE2\u20AC\u0161\xC3\u201A\xC2\x9D Developer Reality Platform`);
+      console.log(`RealityDB v${VERSION17} -- Developer Reality Platform`);
       console.log("Run `realitydb --help` for available commands.");
       console.log("");
     }