@akasecurity/ai-tc-claude-code 0.8.1 → 0.8.2

package/scripts/backfill.js

@@ -491,6 +491,9 @@ var require_ignore = __commonJS({
   }
 });
 
+// src/backfill.ts
+import { fileURLToPath } from "url";
+
 // ../../packages/persistence/src/database.ts
 import { randomUUID as randomUUID8 } from "crypto";
 import { existsSync, renameSync, rmSync } from "fs";
@@ -15430,6 +15433,11 @@ var AuditEventType = external_exports.enum([
   "prompt",
   "response",
   "code_change",
+  // The events.kind of a scanned tool call, widened in to keep this a
+  // superset. Narrower than 'tool_call' above and not a duplicate of it:
+  // 'tool_call' is the reconciler's structural row for every call, while
+  // 'tool_use' exists only where a hook enforced against the arguments.
+  "tool_use",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
@@ -15821,7 +15829,7 @@ var ActivityOverviewResponse = external_exports.object({
 }).meta({ id: "ActivityOverviewResponse" });
 
 // ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change"]).meta({ id: "EventKind" });
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
@@ -16134,7 +16142,7 @@ var DetectionException = external_exports.object({
   justification: external_exports.string().min(1),
   conditions: ExceptionConditions.nullable(),
   createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api"]),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
   createdAt: external_exports.iso.datetime(),
   updatedAt: external_exports.iso.datetime(),
   // Revocation is terminal and retained — consumed/expired/revoked rows are
@@ -16303,20 +16311,26 @@ var PolicyBundle = external_exports.object({
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
-var DEFAULT_ACTIONS = {
-  secret: "block",
-  pii: "redact",
-  financial: "redact",
-  phi: "redact",
-  code_context: "warn",
-  code_flaw: "warn",
-  custom: "warn",
-  // Config-posture findings only observe today (they land in
-  // inspection_findings, outside the live-capture enforcement path).
-  config: "warn"
-};
 var OBSERVE_ONLY_CATEGORIES = ["config"];
 var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
 var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
 var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
 var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
@@ -16343,6 +16357,12 @@ var BUILTIN_POLICY_SPECS = {
     description: "Refuse the request entirely whenever any rule in this detection matches."
   }
 };
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
 var BUILTIN_POLICIES = Object.fromEntries(
   KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
 );
@@ -16749,10 +16769,8 @@ function toApiProvider(sourceTool) {
   return TOOL_TO_HARNESS[sourceTool] ?? "api";
 }
 var STATUS_PRECEDENCE = ["open", "handled", "dismissed", "resolved"];
-function deriveGroupStatus(instances) {
-  const statuses = new Set(
-    instances.map((i) => i.status).filter((s) => s !== void 0)
-  );
+function foldGroupStatus(instanceStatuses) {
+  const statuses = new Set(instanceStatuses.filter((s) => s !== void 0));
   if (statuses.size === 0) return void 0;
   for (const candidate of STATUS_PRECEDENCE) {
     if (statuses.has(candidate)) return candidate;
@@ -16770,6 +16788,7 @@ function deriveFindingStatus(row) {
 function buildFindingGroups(rows, opts = {}) {
   const overrides = opts.overrides;
   const packNames = opts.packNames;
+  const aggregates = opts.aggregates;
   const byRuleId = /* @__PURE__ */ new Map();
   for (const row of rows) {
     const existing = byRuleId.get(row.ruleId);
@@ -16791,17 +16810,20 @@ function buildFindingGroups(rows, opts = {}) {
         status: r.status
       };
     });
-    const latestDetectedAt = ruleRows.reduce(
+    const agg = aggregates?.get(ruleId);
+    const latestDetectedAt = agg?.latestDetectedAt ?? ruleRows.reduce(
       (max, r) => r.occurredAt > max ? r.occurredAt : max,
       ruleRows[0]?.occurredAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
     );
     const seenProviders = /* @__PURE__ */ new Set();
-    const providers = instances.map((i) => i.provider).filter((p) => {
+    const providers = (agg ? [...new Set(agg.sourceTools.map(toApiProvider))].sort() : instances.map((i) => i.provider)).filter((p) => {
       if (seenProviders.has(p)) return false;
       seenProviders.add(p);
       return true;
     });
-    const actionSet = new Set(instances.map((i) => i.action));
+    const actionSet = new Set(
+      agg ? agg.actionsTaken.map(toApiAction) : instances.map((i) => i.action)
+    );
     const aggregateAction = actionSet.size === 1 ? [...actionSet][0] ?? null : null;
     const severity = ruleRows[0]?.severity ?? "low";
     const detection = {
@@ -16815,8 +16837,10 @@ function buildFindingGroups(rows, opts = {}) {
       contextPrefix: ""
       // empty (pending privacy review)
     };
-    const status = deriveGroupStatus(instances);
-    groups.push({
+    const status = foldGroupStatus(
+      agg ? agg.statusInputs.map(deriveFindingStatus) : instances.map((i) => i.status)
+    );
+    const group = {
       id: ruleId,
       category: apiCategory,
       subtype: ruleId,
@@ -16825,21 +16849,26 @@ function buildFindingGroups(rows, opts = {}) {
       match,
       detection,
       policy,
-      instanceCount: instances.length,
+      instanceCount: agg?.instanceCount ?? instances.length,
       providers,
       aggregateAction,
       latestDetectedAt,
       instances,
       status
-    });
+    };
+    if (agg) {
+      actionsCache.set(group, [...actionSet]);
+      if (agg.searchText !== void 0) {
+        haystackCache.set(group, buildHaystack(group, agg.searchText));
+      }
+    }
+    groups.push(group);
   }
   return groups;
 }
 var haystackCache = /* @__PURE__ */ new WeakMap();
-function groupHaystack(g) {
-  const cached2 = haystackCache.get(g);
-  if (cached2 !== void 0) return cached2;
-  const haystack = [
+function buildHaystack(g, extra) {
+  return [
     g.subtype,
     g.category,
     g.match.maskedValue,
@@ -16847,11 +16876,25 @@ function groupHaystack(g) {
     g.id,
     ...g.instances.map((i) => i.repo),
     ...g.instances.map((i) => i.file),
-    ...g.instances.map((i) => i.id)
+    ...g.instances.map((i) => i.id),
+    ...extra === void 0 ? [] : [extra]
   ].join(" ").toLowerCase();
+}
+function groupHaystack(g) {
+  const cached2 = haystackCache.get(g);
+  if (cached2 !== void 0) return cached2;
+  const haystack = buildHaystack(g);
   haystackCache.set(g, haystack);
   return haystack;
 }
+var actionsCache = /* @__PURE__ */ new WeakMap();
+function groupActions(g) {
+  const cached2 = actionsCache.get(g);
+  if (cached2 !== void 0) return cached2;
+  const actions = [...new Set(g.instances.map((i) => i.action))];
+  actionsCache.set(g, actions);
+  return actions;
+}
 function applyFindingFilters(groups, opts) {
   let filtered = groups;
   if (opts.severity && opts.severity.length > 0) {
@@ -16864,7 +16907,7 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.actions && opts.actions.length > 0) {
     const actionSet = new Set(opts.actions);
-    filtered = filtered.filter((g) => g.instances.some((i) => actionSet.has(i.action)));
+    filtered = filtered.filter((g) => groupActions(g).some((a) => actionSet.has(a)));
   }
   if (opts.subtype && opts.subtype.length > 0) {
     const subtypeSet = new Set(opts.subtype);
@@ -16916,8 +16959,7 @@ function computeFindingFacets(allGroups, opts) {
   });
   const actionMap = /* @__PURE__ */ new Map();
   for (const g of forAction) {
-    const actionSet = new Set(g.instances.map((i) => i.action));
-    for (const a of actionSet) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
+    for (const a of groupActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
   }
   const forSubtype = applyFindingFilters(allGroups, {
     providers: opts.providers,
@@ -17479,6 +17521,132 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
+// ../../packages/schema/src/zod/triage.ts
+var TriageHit = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  maskedMatch: external_exports.string(),
+  rawMatch: external_exports.string(),
+  context: external_exports.string(),
+  filePath: external_exports.string().optional(),
+  confidence: external_exports.number().min(0).max(1),
+  id: external_exports.string().optional(),
+  valueFingerprint: external_exports.string().optional(),
+  keyVersion: external_exports.number().int().nonnegative().optional()
+});
+var TriagePolicy = BuiltinPolicyId;
+var TriageCategoryRec = external_exports.object({
+  category: DetectionCategory,
+  action: TriagePolicy,
+  reasoning: external_exports.string(),
+  genuineCount: external_exports.number().int().nonnegative(),
+  fpCount: external_exports.number().int().nonnegative(),
+  // TriageHit ids judged false-positive in this category. fpCount must equal
+  // this array's length — enforced by the consumer, not this schema.
+  fpIds: external_exports.array(external_exports.string())
+});
+var TriageRecommendation = external_exports.object({
+  perCategory: external_exports.array(TriageCategoryRec),
+  notes: external_exports.string()
+});
+
+// ../../packages/persistence/src/internal/sql-text.ts
+function escapeLikePattern(s) {
+  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+}
+function placeholders(n) {
+  return Array.from({ length: n }, () => "?").join(", ");
+}
+function containsPattern(q) {
+  return `%${escapeLikePattern(q)}%`;
+}
+function likeAny(exprs) {
+  return `(${exprs.map((e) => `${e} LIKE ? ESCAPE '\\'`).join(" OR ")})`;
+}
+
+// ../../packages/persistence/src/internal/transactions.ts
+var savepointSeq = 0;
+function withTransaction(db, fn, mode = "DEFERRED") {
+  if (db.isTransaction) {
+    const savepoint = `aka_sp_${String(savepointSeq += 1)}`;
+    db.exec(`SAVEPOINT ${savepoint}`);
+    try {
+      fn();
+      db.exec(`RELEASE ${savepoint}`);
+    } catch (error51) {
+      try {
+        db.exec(`ROLLBACK TO ${savepoint}`);
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {
+      }
+      throw error51;
+    }
+    return;
+  }
+  db.exec(mode === "IMMEDIATE" ? "BEGIN IMMEDIATE" : "BEGIN");
+  try {
+    fn();
+    db.exec("COMMIT");
+  } catch (error51) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+    }
+    throw error51;
+  }
+}
+function failOpenTransaction(db, fn, mode = "DEFERRED") {
+  const nested = db.isTransaction;
+  try {
+    withTransaction(db, fn, mode);
+    return true;
+  } catch (error51) {
+    if (!db.isTransaction && nested) throw error51;
+    return false;
+  }
+}
+
+// ../../packages/persistence/src/internal/warn.ts
+function akaWarn(message) {
+  process.stderr.write(`[aka] ${message}
+`);
+}
+
+// ../../packages/persistence/src/db/migrations/introspection.ts
+function evidenceObjects(sql) {
+  const objects = [];
+  for (const m of sql.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g)) {
+    if (m[1] !== void 0 && !m[1].startsWith("__new_")) {
+      objects.push({ kind: "table", name: m[1] });
+    }
+  }
+  for (const m of sql.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g)) {
+    if (m[1] !== void 0 && m[2] !== void 0) {
+      objects.push({ kind: "column", table: m[1], name: m[2] });
+    }
+  }
+  return objects;
+}
+function schemaObjectExists(db, kind, name) {
+  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = ? AND name = ? LIMIT 1").get(kind, name);
+  return row !== void 0;
+}
+function indexExists(db, name) {
+  return schemaObjectExists(db, "index", name);
+}
+function columnNames(db, table, opts) {
+  const pragma = opts?.includeGenerated ? "table_xinfo" : "table_info";
+  const columns = db.prepare(`PRAGMA ${pragma}(${table})`).all();
+  return columns.map((c) => c.name);
+}
+function evidenceExists(db, object2) {
+  if (object2.kind === "column") {
+    return columnNames(db, object2.table, { includeGenerated: true }).includes(object2.name);
+  }
+  return schemaObjectExists(db, "table", object2.name);
+}
+
 // ../../packages/persistence/src/ids.ts
 import { createHash } from "crypto";
 function sha256Hex(input) {
@@ -17515,28 +17683,6 @@ function inspectionFindingId(auditEventId, definitionId, spanStart, spanEnd) {
 }
 
 // ../../packages/persistence/src/migrations.ts
-function evidenceObjects(sql) {
-  const objects = [];
-  for (const m of sql.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g)) {
-    if (m[1] !== void 0 && !m[1].startsWith("__new_")) {
-      objects.push({ kind: "table", name: m[1] });
-    }
-  }
-  for (const m of sql.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g)) {
-    if (m[1] !== void 0 && m[2] !== void 0) {
-      objects.push({ kind: "column", table: m[1], name: m[2] });
-    }
-  }
-  return objects;
-}
-function evidenceExists(db, object2) {
-  if (object2.kind === "column") {
-    const columns = db.prepare(`PRAGMA table_xinfo(${object2.table})`).all();
-    return columns.some((c) => c.name === object2.name);
-  }
-  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ? LIMIT 1").get(object2.name);
-  return row !== void 0;
-}
 function describeObject(object2) {
   return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
 }
@@ -17547,10 +17693,6 @@ function createdIndexName(statement) {
   const body = statement.replace(/^(?:\s*--[^\n]*\n?)+/, "").trimStart();
   return /^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(body)?.[1];
 }
-function indexExists(db, name) {
-  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'index' AND name = ? LIMIT 1").get(name);
-  return row !== void 0;
-}
 function applyMigrations(db) {
   const legacyCount = db.prepare("PRAGMA user_version").get().user_version;
   db.exec(
@@ -17569,44 +17711,39 @@ function applyMigrations(db) {
     const present = evidence.filter((o) => evidenceExists(db, o));
     if (present.length > 0 && present.length < evidence.length) {
       const missing = evidence.filter((o) => !present.includes(o));
-      const message = `[aka] sqlite migration ${migration.tag} has no ledger row, but the store already has ${present.map(describeObject).join(", ")} while missing ${missing.map(describeObject).join(", ")} \u2014 the schema diverged from the migration history; refusing to replay or skip.`;
-      process.stderr.write(`${message}
-`);
-      throw new Error(message);
+      const message = `sqlite migration ${migration.tag} has no ledger row, but the store already has ${present.map(describeObject).join(", ")} while missing ${missing.map(describeObject).join(", ")} \u2014 the schema diverged from the migration history; refusing to replay or skip.`;
+      akaWarn(message);
+      throw new Error(`[aka] ${message}`);
     }
     const alreadyApplied = evidence.length > 0 ? present.length === evidence.length : preLedgerStore && index < legacyCount;
     const wantsFkOff = /PRAGMA foreign_keys\s*=\s*OFF/i.test(migration.sql);
     const statements = splitStatements(migration.sql);
     if (wantsFkOff) db.exec("PRAGMA foreign_keys = OFF");
     try {
-      db.exec("BEGIN IMMEDIATE");
-      try {
-        for (const statement of statements) {
-          const indexName = createdIndexName(statement);
-          if (indexName === void 0) {
-            if (alreadyApplied) continue;
-          } else if (indexExists(db, indexName)) {
-            continue;
+      withTransaction(
+        db,
+        () => {
+          for (const statement of statements) {
+            const indexName = createdIndexName(statement);
+            if (indexName === void 0) {
+              if (alreadyApplied) continue;
+            } else if (indexExists(db, indexName)) {
+              continue;
+            }
+            db.exec(statement);
           }
-          db.exec(statement);
-        }
-        if (wantsFkOff && !alreadyApplied) {
-          const violations = db.prepare("PRAGMA foreign_key_check").all();
-          if (violations.length > 0) {
-            throw new Error(
-              `[aka] sqlite migration ${migration.tag} left ${String(violations.length)} foreign-key violation(s); rolling back.`
-            );
+          if (wantsFkOff && !alreadyApplied) {
+            const violations = db.prepare("PRAGMA foreign_key_check").all();
+            if (violations.length > 0) {
+              throw new Error(
+                `[aka] sqlite migration ${migration.tag} left ${String(violations.length)} foreign-key violation(s); rolling back.`
+              );
+            }
           }
-        }
-        record2.run(migration.tag, Date.now());
-        db.exec("COMMIT");
-      } catch (error51) {
-        try {
-          db.exec("ROLLBACK");
-        } catch {
-        }
-        throw error51;
-      }
+          record2.run(migration.tag, Date.now());
+        },
+        "IMMEDIATE"
+      );
     } finally {
       if (wantsFkOff) db.exec("PRAGMA foreign_keys = ON");
     }
@@ -17649,8 +17786,7 @@ var TOKEN_USAGE_COLUMNS = [
   }
 ];
 function ensureTokenUsageColumns(db) {
-  const columns = db.prepare("PRAGMA table_xinfo(audit_events)").all();
-  const existing = new Set(columns.map((c) => c.name));
+  const existing = new Set(columnNames(db, "audit_events", { includeGenerated: true }));
   for (const column of TOKEN_USAGE_COLUMNS) {
     if (!existing.has(column.name)) {
       db.exec(column.ddl);
@@ -17688,47 +17824,39 @@ function reconcileSourceProjectIds(db) {
       repoint: db.prepare(`UPDATE ${table} SET project_id = ? WHERE project_id = ?`)
     }));
     const deleteLegacy = db.prepare("DELETE FROM source_project WHERE id = ?");
-    db.exec("BEGIN IMMEDIATE");
-    try {
-      for (const { row, canonicalId } of legacy) {
-        foldProject.run(
-          canonicalId,
-          row.url,
-          row.name,
-          row.attributes,
-          row.firstSeen,
-          row.lastSeen
-        );
-        repointAudit.run(canonicalId, row.id);
-        for (const { dropCollisions, repoint } of pathTables) {
-          dropCollisions.run(row.id, canonicalId);
-          repoint.run(canonicalId, row.id);
+    withTransaction(
+      db,
+      () => {
+        for (const { row, canonicalId } of legacy) {
+          foldProject.run(
+            canonicalId,
+            row.url,
+            row.name,
+            row.attributes,
+            row.firstSeen,
+            row.lastSeen
+          );
+          repointAudit.run(canonicalId, row.id);
+          for (const { dropCollisions, repoint } of pathTables) {
+            dropCollisions.run(row.id, canonicalId);
+            repoint.run(canonicalId, row.id);
+          }
+          repointCallSite.run(canonicalId, row.id);
+          deleteLegacy.run(row.id);
         }
-        repointCallSite.run(canonicalId, row.id);
-        deleteLegacy.run(row.id);
-      }
-      db.exec("COMMIT");
-    } catch (error51) {
-      try {
-        db.exec("ROLLBACK");
-      } catch {
-      }
-      throw error51;
-    }
+      },
+      "IMMEDIATE"
+    );
   } catch (error51) {
-    process.stderr.write(`[aka] source_project id reconcile failed: ${String(error51)}
-`);
+    akaWarn(`source_project id reconcile failed: ${String(error51)}`);
   }
 }
 function isForeignSqliteLineage(db) {
-  const tenantsTable = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'tenants' LIMIT 1").get();
-  if (tenantsTable !== void 0) return true;
-  const eventsColumns = db.prepare("PRAGMA table_info(events)").all();
-  return eventsColumns.some((c) => c.name === "tenant_id");
+  if (schemaObjectExists(db, "table", "tenants")) return true;
+  return columnNames(db, "events").includes("tenant_id");
 }
 function ensureSyncedAtColumn(db, table) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (!columns.some((c) => c.name === "synced_at")) {
+  if (!columnNames(db, table).includes("synced_at")) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN synced_at integer`);
   }
 }
@@ -17779,8 +17907,11 @@ function ensureDataDirSync(dir) {
   } catch {
   }
 }
+function walSidecars(file2) {
+  return [`${file2}-wal`, `${file2}-shm`];
+}
 function tightenPerms(file2) {
-  for (const path of [file2, `${file2}-wal`, `${file2}-shm`]) {
+  for (const path of [file2, ...walSidecars(file2)]) {
     try {
       chmodSync(path, DATA_FILE_MODE);
     } catch {
@@ -17788,12 +17919,68 @@ function tightenPerms(file2) {
   }
 }
 
-// ../../packages/persistence/src/repositories/sql-utils.ts
-function escapeLikePattern(s) {
-  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+// ../../packages/persistence/src/internal/json.ts
+function safeJson(s, fallback) {
+  if (s == null) return fallback;
+  try {
+    return JSON.parse(s);
+  } catch {
+    return fallback;
+  }
 }
-function placeholders(n) {
-  return Array.from({ length: n }, () => "?").join(", ");
+function parseJsonObject(s) {
+  if (s == null) return void 0;
+  try {
+    const parsed = JSON.parse(s);
+    if (typeof parsed === "object" && parsed !== null) return parsed;
+  } catch {
+  }
+  return void 0;
+}
+
+// ../../packages/persistence/src/internal/rows.ts
+function allRows(stmt, params) {
+  if (params === void 0) return stmt.all();
+  if (Array.isArray(params)) return stmt.all(...params);
+  return stmt.all(params);
+}
+function getRow(stmt, params) {
+  if (params === void 0) return stmt.get();
+  if (Array.isArray(params)) return stmt.get(...params);
+  return stmt.get(params);
+}
+function intToBool(raw) {
+  return raw === 1 || raw === true;
+}
+function boolToInt(b) {
+  return b ? 1 : 0;
+}
+function bindParams(row) {
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    out[key] = value === void 0 ? null : value;
+  }
+  return out;
+}
+function countScalar(db, sql, params) {
+  return getRow(db.prepare(sql), params)?.n ?? 0;
+}
+function countBy(db, sql, params) {
+  const map2 = /* @__PURE__ */ new Map();
+  for (const row of allRows(db.prepare(sql), params)) {
+    map2.set(row.k, row.n);
+  }
+  return map2;
+}
+function mapRowsTolerant(rows, map2) {
+  const out = [];
+  for (const row of rows) {
+    try {
+      out.push(map2(row));
+    } catch {
+    }
+  }
+  return out;
 }
 
 // ../../packages/persistence/src/repositories/activity.ts
@@ -17845,15 +18032,11 @@ function encodeCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeCursor(cursor) {
-  try {
-    const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
-    if (parsed !== null && typeof parsed === "object" && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
-      return parsed;
-    }
-    return null;
-  } catch {
-    return null;
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
+    return parsed;
   }
+  return null;
 }
 var DB_EVENT_TYPE_TO_KIND = {
   session: "session",
@@ -17870,15 +18053,8 @@ var DB_EVENT_TYPE_TO_KIND = {
 };
 function safeParseStringArray(raw) {
   if (!raw) return [];
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
-}
-function toBool(raw) {
-  return raw === 1 || raw === true;
+  const parsed = safeJson(raw, null);
+  return Array.isArray(parsed) ? parsed : [];
 }
 function toHarness(raw) {
   const parsed = Harness.safeParse(raw);
@@ -17931,8 +18107,8 @@ function buildAuditEvent(row) {
     severity: severityParsed?.success ? severityParsed.data : null,
     link: linkParsed?.success ? linkParsed.data : null,
     targetId: row.target_id,
-    internal: toBool(row.internal),
-    flagged: toBool(row.flagged)
+    internal: intToBool(row.internal),
+    flagged: intToBool(row.flagged)
   };
 }
 var TIMELINE_COLUMNS = `
@@ -17958,12 +18134,15 @@ var SqliteActivityRepository = class {
   stats(tz) {
     const window = todayWindow(tz ?? defaultTimeZone(), this.now());
     const { startMs, endMs } = window;
-    const sessionsToday = this.db.prepare(
+    const sessionsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE ${SESSION_ROOT} AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
+           WHERE ${SESSION_ROOT} AND started_at >= ? AND started_at < ?`,
+      [startMs, endMs]
+    );
     const liveThreshold = this.now() - LIVE_ACTIVITY_WINDOW_MS;
-    const liveNow = this.db.prepare(
+    const liveNow = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events s
            WHERE s.event_type = 'session' AND s.ended_at IS NULL
              AND max(
@@ -17972,22 +18151,29 @@ var SqliteActivityRepository = class {
                  (SELECT max(${LAST_ACTIVITY_EXPR}) FROM audit_events e WHERE e.root_session_id = s.id),
                  s.started_at
                )
-             ) >= ?`
-    ).get(liveThreshold).n;
-    const toolCallsToday = this.db.prepare(
+             ) >= ?`,
+      [liveThreshold]
+    );
+    const toolCallsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE event_type = 'tool_call' AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
-    const findingsToday = this.db.prepare(
+           WHERE event_type = 'tool_call' AND started_at >= ? AND started_at < ?`,
+      [startMs, endMs]
+    );
+    const findingsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM inspection_findings f
            JOIN audit_events e ON e.id = f.audit_event_id
-           WHERE e.started_at >= ? AND e.started_at < ?`
-    ).get(startMs, endMs).n;
-    const egressToday = this.db.prepare(
+           WHERE e.started_at >= ? AND e.started_at < ?`,
+      [startMs, endMs]
+    );
+    const egressToday = countScalar(
+      this.db,
       `SELECT count(DISTINCT json_extract(attributes, '$.destination')) AS n
            FROM audit_events
-           WHERE event_type = 'share' AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
+           WHERE event_type = 'share' AND started_at >= ? AND started_at < ?`,
+      [startMs, endMs]
+    );
     return Promise.resolve({ sessionsToday, liveNow, toolCallsToday, findingsToday, egressToday });
   }
   listSessions(query) {
@@ -18009,7 +18195,7 @@ var SqliteActivityRepository = class {
     conditions.push("started_at <= ?");
     params.push(toMs);
     if (query.q) {
-      const pattern = `%${escapeLikePattern(query.q)}%`;
+      const pattern = containsPattern(query.q);
       conditions.push(
         `(content LIKE ? ESCAPE '\\'
           OR json_extract(attributes, '$.project') LIKE ? ESCAPE '\\'
@@ -18028,8 +18214,9 @@ var SqliteActivityRepository = class {
       params.push(cursor.startedAtMs, cursor.startedAtMs, cursor.id);
     }
     const limit = query.limit;
-    const rows = this.db.prepare(
-      `SELECT id,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id,
                 json_extract(attributes, '$.harness') AS harness,
                 content AS title,
                 json_extract(attributes, '$.project') AS project,
@@ -18042,7 +18229,9 @@ var SqliteActivityRepository = class {
          WHERE ${conditions.join(" AND ")}
          ORDER BY started_at DESC, id DESC
          LIMIT ?`
-    ).all(...params, limit + 1);
+      ),
+      [...params, limit + 1]
+    );
     const hasMore = rows.length > limit;
     const page = hasMore ? rows.slice(0, limit) : rows;
     const rollups = this.rollupsFor(page.map((r) => r.id));
@@ -18059,8 +18248,9 @@ var SqliteActivityRepository = class {
     return Promise.resolve({ items, nextCursor });
   }
   getSession(sessionId) {
-    const rootRow = this.db.prepare(
-      `SELECT id,
+    const rootRow = getRow(
+      this.db.prepare(
+        `SELECT id,
                 json_extract(attributes, '$.harness') AS harness,
                 content AS title,
                 json_extract(attributes, '$.project') AS project,
@@ -18077,47 +18267,66 @@ var SqliteActivityRepository = class {
          FROM audit_events
          WHERE id = ? AND event_type = 'session'
          LIMIT 1`
-    ).get(sessionId);
+      ),
+      [sessionId]
+    );
     if (!rootRow) return Promise.resolve(null);
-    const timelineRows = this.db.prepare(
-      `SELECT ${TIMELINE_COLUMNS}
+    const timelineRows = allRows(
+      this.db.prepare(
+        `SELECT ${TIMELINE_COLUMNS}
          FROM audit_events
          WHERE id = ? OR root_session_id = ?
          ORDER BY started_at ASC, id ASC`
-    ).all(sessionId, sessionId);
+      ),
+      [sessionId, sessionId]
+    );
     const events = timelineRows.map(buildAuditEvent).filter((e) => e !== null);
-    const tokenRow = this.db.prepare(
-      `SELECT
+    const tokenRow = getRow(
+      this.db.prepare(
+        `SELECT
            coalesce(sum(input_tokens), 0) AS input,
            coalesce(sum(output_tokens), 0) AS output,
            coalesce(sum(cache_creation_input_tokens), 0) AS cache_creation,
            coalesce(sum(cache_read_input_tokens), 0) AS cache_read
          FROM audit_events
          WHERE root_session_id = ? AND event_type = 'llm_call'`
-    ).get(sessionId);
-    const primaryModel = this.db.prepare(
-      `SELECT model, provider FROM audit_events
+      ),
+      [sessionId]
+    ) ?? { input: 0, output: 0, cache_creation: 0, cache_read: 0 };
+    const primaryModel = getRow(
+      this.db.prepare(
+        `SELECT model, provider FROM audit_events
          WHERE root_session_id = ? AND event_type = 'llm_call'
          ORDER BY started_at ASC, id ASC
          LIMIT 1`
-    ).get(sessionId);
-    const toolRows = this.db.prepare(
-      `SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
+      ),
+      [sessionId]
+    );
+    const toolRows = allRows(
+      this.db.prepare(
+        `SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
                 count(*) AS n
          FROM audit_events
          WHERE root_session_id = ? AND event_type = 'tool_call'
          GROUP BY coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool'))`
-    ).all(sessionId);
-    const modelRows = this.db.prepare(
-      `SELECT DISTINCT model FROM audit_events
+      ),
+      [sessionId]
+    );
+    const modelRows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT model FROM audit_events
          WHERE root_session_id = ? AND event_type = 'llm_call' AND model IS NOT NULL AND model <> ''
          ORDER BY model`
-    ).all(sessionId);
+      ),
+      [sessionId]
+    );
     const derivedModels = modelRows.map((r) => r.model);
-    const commits = this.db.prepare(
+    const commits = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE root_session_id = ? AND event_type = 'commit'`
-    ).get(sessionId).n;
+           WHERE root_session_id = ? AND event_type = 'commit'`,
+      [sessionId]
+    );
     const rollup = this.rollupsFor([sessionId]).get(sessionId) ?? {
       turns: 0,
       findings: 0,
@@ -18184,7 +18393,10 @@ var SqliteActivityRepository = class {
       `SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), 'claudecode') AS harness
          FROM audit_events WHERE ${SESSION_ROOT}${where}`
     );
-    const rows = fromMs === void 0 ? stmt.all() : stmt.all(fromMs);
+    const rows = allRows(
+      stmt,
+      fromMs === void 0 ? void 0 : [fromMs]
+    );
     const seen = /* @__PURE__ */ new Set();
     for (const row of rows) seen.add(toHarness(row.harness));
     return Promise.resolve([...seen]);
@@ -18207,23 +18419,23 @@ var SqliteActivityRepository = class {
       conditions.push("started_at >= ?");
       params.push(opts.fromMs);
     }
-    const rows = this.db.prepare(
-      `SELECT root_session_id AS sessionId, attributes
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS sessionId, attributes
            FROM audit_events
           WHERE ${conditions.join(" AND ")}`
-    ).all(...params);
-    const leaves = [];
-    for (const row of rows) {
-      if (row.sessionId === null) continue;
-      try {
-        leaves.push({
-          sessionId: row.sessionId,
-          attributes: JSON.parse(row.attributes)
-        });
-      } catch {
-      }
-    }
-    return leaves;
+      ),
+      params
+    );
+    return mapRowsTolerant(
+      rows.filter(
+        (row) => row.sessionId !== null
+      ),
+      (row) => ({
+        sessionId: row.sessionId,
+        attributes: JSON.parse(row.attributes)
+      })
+    );
   }
   /**
    * Per-session turns/findings/shares + last-activity for a page of session ids,
@@ -18237,57 +18449,72 @@ var SqliteActivityRepository = class {
     );
     if (sessionIds.length === 0) return result;
     const inClause = placeholders(sessionIds.length);
-    const lastActivityRows = this.db.prepare(
-      `SELECT root_session_id AS id, max(${LAST_ACTIVITY_EXPR}) AS m FROM audit_events
+    const lastActivityRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id, max(${LAST_ACTIVITY_EXPR}) AS m FROM audit_events
          WHERE root_session_id IN (${inClause})
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of lastActivityRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry && row.m !== null) entry.lastActivityMs = row.m;
     }
-    const turnsRows = this.db.prepare(
-      `SELECT root_session_id AS id, count(*) AS n FROM audit_events
+    const turnsRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id, count(*) AS n FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'prompt'
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of turnsRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.turns = row.n;
     }
-    const runKeyRows = this.db.prepare(
-      `SELECT root_session_id AS id,
+    const runKeyRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id,
                 count(DISTINCT json_extract(attributes, '$.run_key')) AS n
          FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'llm_call'
            AND json_extract(attributes, '$.run_key') IS NOT NULL
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of runKeyRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.turns = Math.max(entry.turns, row.n);
     }
-    const findingsRows = this.db.prepare(
-      `SELECT e.root_session_id AS id, count(*) AS n FROM inspection_findings f
+    const findingsRows = allRows(
+      this.db.prepare(
+        `SELECT e.root_session_id AS id, count(*) AS n FROM inspection_findings f
          JOIN audit_events e ON e.id = f.audit_event_id
          WHERE e.root_session_id IN (${inClause})
          GROUP BY e.root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of findingsRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.findings = row.n;
     }
-    const sharesRows = this.db.prepare(
-      `SELECT root_session_id AS id,
+    const sharesRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id,
                 count(DISTINCT json_extract(attributes, '$.destination')) AS n
          FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'share'
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of sharesRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
@@ -18337,33 +18564,28 @@ var SqliteAuditEventsRepository = class {
   // the caller fails open and drops the whole pass — recovered idempotently on the
   // next pass. Nesting-safe is NOT needed: the reconciler is the sole caller.
   runInTransaction(fn) {
-    this.db.exec("BEGIN");
-    try {
-      fn();
-      this.db.exec("COMMIT");
-    } catch (err) {
-      this.db.exec("ROLLBACK");
-      throw err;
-    }
+    withTransaction(this.db, fn);
   }
   insertAuditEvent(input) {
     const row = toAuditEventRow(input);
-    this.insertStmt.run({
-      id: row.id,
-      parentId: row.parentId ?? null,
-      rootSessionId: row.rootSessionId ?? null,
-      eventType: row.eventType,
-      hostId: row.hostId ?? null,
-      harnessId: row.harnessId ?? null,
-      sourceProjectId: row.sourceProjectId ?? null,
-      startedAt: row.startedAt,
-      endedAt: row.endedAt ?? null,
-      severity: row.severity ?? null,
-      priority: row.priority ?? null,
-      content: row.content ?? null,
-      contentHash: row.contentHash ?? null,
-      attributes: row.attributes ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        parentId: row.parentId,
+        rootSessionId: row.rootSessionId,
+        eventType: row.eventType,
+        hostId: row.hostId,
+        harnessId: row.harnessId,
+        sourceProjectId: row.sourceProjectId,
+        startedAt: row.startedAt,
+        endedAt: row.endedAt,
+        severity: row.severity,
+        priority: row.priority,
+        content: row.content,
+        contentHash: row.contentHash,
+        attributes: row.attributes
+      })
+    );
   }
   // Insert one transcript-derived `llm_call` leaf. Unlike `insertAuditEvent`
   // (which takes a caller-supplied random id), the id here is MINTED internally
@@ -18377,22 +18599,24 @@ var SqliteAuditEventsRepository = class {
     const startedAt = isoToEpochMillis(input.startedAt);
     if (!Number.isFinite(startedAt)) return;
     const id = llmCallId(input.sessionId, input.messageId);
-    this.upsertLlmCallStmt.run({
-      id,
-      parentId: input.parentId,
-      rootSessionId: input.rootSessionId,
-      eventType: "llm_call",
-      hostId: null,
-      harnessId: null,
-      sourceProjectId: null,
-      startedAt,
-      endedAt: null,
-      severity: null,
-      priority: null,
-      content: null,
-      contentHash: null,
-      attributes: JSON.stringify(input.attributes)
-    });
+    this.upsertLlmCallStmt.run(
+      bindParams({
+        id,
+        parentId: input.parentId,
+        rootSessionId: input.rootSessionId,
+        eventType: "llm_call",
+        hostId: null,
+        harnessId: null,
+        sourceProjectId: null,
+        startedAt,
+        endedAt: null,
+        severity: null,
+        priority: null,
+        content: null,
+        contentHash: null,
+        attributes: JSON.stringify(input.attributes)
+      })
+    );
   }
   // Insert one transcript-derived `tool_call` leaf. Like `insertLlmCall` the id is
   // MINTED internally from the natural key — `toolCallId(sessionId, toolUseId)` —
@@ -18416,25 +18640,29 @@ var SqliteAuditEventsRepository = class {
     const startedAt = isoToEpochMillis(input.startedAt);
     if (!Number.isFinite(startedAt)) return;
     const id = toolCallId(input.sessionId, input.toolUseId);
-    this.insertStmt.run({
-      id,
-      parentId: input.parentId,
-      rootSessionId: input.rootSessionId,
-      eventType: "tool_call",
-      hostId: null,
-      harnessId: null,
-      sourceProjectId: null,
-      startedAt,
-      endedAt: null,
-      severity: null,
-      priority: null,
-      content: null,
-      contentHash: null,
-      attributes: JSON.stringify(input.attributes)
-    });
+    this.insertStmt.run(
+      bindParams({
+        id,
+        parentId: input.parentId,
+        rootSessionId: input.rootSessionId,
+        eventType: "tool_call",
+        hostId: null,
+        harnessId: null,
+        sourceProjectId: null,
+        startedAt,
+        endedAt: null,
+        severity: null,
+        priority: null,
+        content: null,
+        contentHash: null,
+        attributes: JSON.stringify(input.attributes)
+      })
+    );
   }
   findById(id) {
-    return this.db.prepare("SELECT * FROM audit_events WHERE id = :id").get({ id });
+    return getRow(this.db.prepare("SELECT * FROM audit_events WHERE id = :id"), {
+      id
+    });
   }
   // Read the `provider` snapshotted onto a session root's attributes.
   // The reconciler ensures the root, then reads provider back from it — SessionStart's
@@ -18444,14 +18672,8 @@ var SqliteAuditEventsRepository = class {
   sessionProvider(sessionId) {
     const row = this.findById(sessionId);
     if (!row?.attributes) return void 0;
-    try {
-      const parsed = JSON.parse(row.attributes);
-      if (typeof parsed === "object" && parsed !== null) {
-        const provider = parsed.provider;
-        if (typeof provider === "string") return provider;
-      }
-    } catch {
-    }
+    const provider = parseJsonObject(row.attributes)?.provider;
+    if (typeof provider === "string") return provider;
     return void 0;
   }
   // Every `llm_call` leaf's session id + raw attribute bag, for the read-time token
@@ -18460,11 +18682,13 @@ var SqliteAuditEventsRepository = class {
   // is the leaf's session (the reconciler sets parent_id = root_session_id = sessionId);
   // rows whose attributes blob is NULL are skipped (nothing to roll up).
   llmCallLeaves() {
-    return this.db.prepare(
-      `SELECT root_session_id AS sessionId, attributes
+    return allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS sessionId, attributes
            FROM audit_events
           WHERE event_type = 'llm_call' AND attributes IS NOT NULL`
-    ).all();
+      )
+    );
   }
 };
 
@@ -18483,16 +18707,29 @@ var SqliteClassifiedDataRepository = class {
   upsert(input) {
     const id = classifiedDataId(input.class);
     const row = toClassifiedDataRow(input, id);
-    this.insertStmt.run({
-      id: row.id,
-      class: row.class,
-      label: row.label ?? null,
-      attributes: row.attributes ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        class: row.class,
+        label: row.label,
+        attributes: row.attributes
+      })
+    );
     return id;
   }
 };
 
+// ../../packages/persistence/src/repositories/config-scan.ts
+function latestConfigScan(db) {
+  return getRow(
+    db.prepare(
+      `SELECT id, started_at, attributes FROM audit_events
+          WHERE event_type = 'config_scan'
+          ORDER BY started_at DESC, id DESC LIMIT 1`
+    )
+  );
+}
+
 // ../../packages/persistence/src/repositories/config-inventory.ts
 var SqliteConfigInventoryRepository = class {
   constructor(db) {
@@ -18500,7 +18737,7 @@ var SqliteConfigInventoryRepository = class {
   }
   db;
   report() {
-    const scan2 = this.latestScan();
+    const scan2 = latestConfigScan(this.db);
     if (!scan2) {
       return {
         scannedAt: null,
@@ -18511,17 +18748,23 @@ var SqliteConfigInventoryRepository = class {
         topics: []
       };
     }
-    const rows = this.db.prepare(
-      `SELECT id, object_type AS objectType, title, location, attributes FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, object_type AS objectType, title, location, attributes FROM inventory
           WHERE object_type IN ('skill', 'hook', 'mcp_server', 'config_file') AND last_seen >= :startedAt
           ORDER BY object_type, title`
-    ).all({ startedAt: scan2.started_at });
-    const findings = this.db.prepare(
-      `SELECT f.masked_match AS maskedMatch, d.rule_id AS ruleId, d.name AS name
+      ),
+      { startedAt: scan2.started_at }
+    );
+    const findings = allRows(
+      this.db.prepare(
+        `SELECT f.masked_match AS maskedMatch, d.rule_id AS ruleId, d.name AS name
            FROM inspection_findings f
            JOIN inspection_definitions d ON d.id = f.inspection_definition_id
           WHERE f.audit_event_id = :scanId`
-    ).all({ scanId: scan2.id });
+      ),
+      { scanId: scan2.id }
+    );
     const skills = [];
     const hooks = [];
     const mcpServers = [];
@@ -18550,7 +18793,9 @@ var SqliteConfigInventoryRepository = class {
   // schema note); an override whose asset is gone simply never matches. A row
   // with an out-of-vocabulary trust value is ignored rather than guessed at.
   trustOverrides() {
-    const rows = this.db.prepare("SELECT asset_id AS assetId, trust FROM mcp_trust_override").all();
+    const rows = allRows(
+      this.db.prepare("SELECT asset_id AS assetId, trust FROM mcp_trust_override")
+    );
     const map2 = /* @__PURE__ */ new Map();
     for (const row of rows) {
       if (row.trust === "known-good" || row.trust === "risky" || row.trust === "unapproved") {
@@ -18559,13 +18804,6 @@ var SqliteConfigInventoryRepository = class {
     }
     return map2;
   }
-  latestScan() {
-    return this.db.prepare(
-      `SELECT id, started_at, attributes FROM audit_events
-          WHERE event_type = 'config_scan'
-          ORDER BY started_at DESC, id DESC LIMIT 1`
-    ).get();
-  }
 };
 function toSkillItem(row, bag) {
   const item = {
@@ -18676,22 +18914,11 @@ function buildTopics(skills, hooks, mcpServers, configFiles, scanAttributes) {
   return topics;
 }
 function countScanErrors(attributes) {
-  if (!attributes) return 0;
-  try {
-    const parsed = JSON.parse(attributes);
-    const errors = parsed?.errors;
-    return typeof errors === "number" ? errors : 0;
-  } catch {
-    return 0;
-  }
+  const errors = parseJsonObject(attributes)?.errors;
+  return typeof errors === "number" ? errors : 0;
 }
 function parseBag(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null) return parsed;
-  } catch {
-  }
-  return void 0;
+  return parseJsonObject(raw);
 }
 function str(value) {
   return typeof value === "string" ? value : void 0;
@@ -18700,12 +18927,7 @@ function str(value) {
 // ../../packages/persistence/src/repositories/detections.ts
 var DAY_MS2 = 864e5;
 function parseRules(rulesJson) {
-  let raw;
-  try {
-    raw = JSON.parse(rulesJson);
-  } catch {
-    return [];
-  }
+  const raw = safeJson(rulesJson, []);
   if (!Array.isArray(raw)) return [];
   const rules = [];
   for (const entry of raw) {
@@ -18724,11 +18946,13 @@ var SqliteDetectionsRepository = class {
   db;
   now;
   listDetections(query) {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
                 rules_json AS rulesJson
          FROM installed_packs`
-    ).all();
+      )
+    );
     const available = this.availableByPack();
     const summaries = rows.map((r) => {
       const latest = available.get(`${r.namespace}/${r.packId}`);
@@ -18737,7 +18961,7 @@ var SqliteDetectionsRepository = class {
         packId: r.packId,
         version: r.version,
         name: r.name,
-        enabled: r.enabled === 1,
+        enabled: intToBool(r.enabled),
         // Count rules in JS via the tolerant parse rather than SQL json_array_length,
         // which THROWS "malformed JSON" on a corrupt/foreign rules_json and would
         // crash the whole list. This also keeps ruleCount identical to the detail
@@ -18754,19 +18978,23 @@ var SqliteDetectionsRepository = class {
   // available_packs keyed by the "namespace/packId" slug (one read per list /
   // detail call; the table is a handful of rows).
   availableByPack() {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson
          FROM available_packs`
-    ).all();
+      )
+    );
     return new Map(rows.map((r) => [`${r.namespace}/${r.packId}`, r]));
   }
   getDetectionStats() {
-    const rows = this.db.prepare("SELECT enabled, rules_json AS rulesJson FROM installed_packs").all();
+    const rows = allRows(
+      this.db.prepare("SELECT enabled, rules_json AS rulesJson FROM installed_packs")
+    );
     let rules = 0;
     let active = 0;
     const ruleIds = /* @__PURE__ */ new Set();
     for (const r of rows) {
-      if (r.enabled === 1) active += 1;
+      if (intToBool(r.enabled)) active += 1;
       const parsed = parseRules(r.rulesJson);
       rules += parsed.length;
       for (const rule of parsed) {
@@ -18784,12 +19012,15 @@ var SqliteDetectionsRepository = class {
     const parts = splitDetectionId(id);
     if (!parts) return Promise.resolve(null);
     const { namespace, packId } = parts;
-    const row = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
                 rules_json AS rulesJson, updated_at AS updatedAt
          FROM installed_packs
          WHERE namespace = ? AND pack_id = ?`
-    ).get(namespace, packId);
+      ),
+      [namespace, packId]
+    );
     if (!row) return Promise.resolve(null);
     const rules = parseRules(row.rulesJson);
     const ruleIds = rules.map((r) => r.id).filter((id2) => typeof id2 === "string");
@@ -18807,7 +19038,7 @@ var SqliteDetectionsRepository = class {
           packId: row.packId,
           version: row.version,
           name: row.name,
-          enabled: row.enabled === 1,
+          enabled: intToBool(row.enabled),
           rules,
           updatedAt: new Date(row.updatedAt),
           policyId: row.policyId
@@ -18822,13 +19053,14 @@ var SqliteDetectionsRepository = class {
   countFindingsLast30d(ruleIds) {
     if (ruleIds.length === 0) return 0;
     const since = this.now() - 30 * DAY_MS2;
-    const placeholders2 = ruleIds.map(() => "?").join(", ");
-    const row = this.db.prepare(
-      `SELECT count(*) AS c
+    const inClause = placeholders(ruleIds.length);
+    return countScalar(
+      this.db,
+      `SELECT count(*) AS n
          FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= ? AND f.rule_id IN (${placeholders2})`
-    ).get(since, ...ruleIds);
-    return row.c;
+         WHERE e.occurred_at >= ? AND f.rule_id IN (${inClause})`,
+      [since, ...ruleIds]
+    );
   }
 };
 
@@ -18845,16 +19077,17 @@ var SqliteEventsRepository = class {
   insertStmt;
   insertEvent(event) {
     const row = toEventRow(event);
-    this.insertStmt.run({
-      id: row.id,
-      sourceTool: row.sourceTool,
-      kind: row.kind,
-      occurredAt: row.occurredAt,
-      contentHash: row.contentHash,
-      content: row.content,
-      // exactOptionalPropertyTypes: the column is nullable, never undefined.
-      metadata: row.metadata ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        sourceTool: row.sourceTool,
+        kind: row.kind,
+        occurredAt: row.occurredAt,
+        contentHash: row.contentHash,
+        content: row.content,
+        metadata: row.metadata
+      })
+    );
   }
   // Every recorded event's content hash — the historical backfill loads this once
   // to skip transcript messages it has already stored, so re-running the scan
@@ -18862,13 +19095,23 @@ var SqliteEventsRepository = class {
   // Async (Promise.resolve over synchronous node:sqlite) so it satisfies the
   // async EventsReadPort contract.
   contentHashes() {
-    const rows = this.db.prepare("SELECT content_hash FROM events").all();
+    const rows = allRows(
+      this.db.prepare("SELECT content_hash FROM events")
+    );
     return Promise.resolve(new Set(rows.map((r) => r.content_hash)));
   }
 };
 
 // ../../packages/persistence/src/repositories/exceptions.ts
 import { randomUUID } from "crypto";
+
+// ../../packages/persistence/src/internal/sqlite-errors.ts
+var SQLITE_CONSTRAINT_UNIQUE = 2067;
+function isUniqueConstraintError(err) {
+  return err instanceof Error && (err.errcode === SQLITE_CONSTRAINT_UNIQUE || err.message.includes("UNIQUE constraint failed"));
+}
+
+// ../../packages/persistence/src/repositories/exceptions.ts
 var BLOCKED_DETECTIONS_TTL_MS = 30 * 60 * 1e3;
 var BLOCKED_DETECTIONS_RETENTION_MS = 24 * 60 * 60 * 1e3;
 var DuplicateActiveExceptionError = class extends Error {
@@ -18889,10 +19132,6 @@ var AmbiguousExceptionIdError = class extends Error {
     this.name = "AmbiguousExceptionIdError";
   }
 };
-var SQLITE_CONSTRAINT_UNIQUE = 2067;
-function isUniqueConstraintError(err) {
-  return err instanceof Error && (err.errcode === SQLITE_CONSTRAINT_UNIQUE || err.message.includes("UNIQUE constraint failed"));
-}
 var ACTIVE_PREDICATE = `revoked_at IS NULL
      AND (expires_at IS NULL OR expires_at > :now)
      AND (max_uses IS NULL OR use_count < max_uses)`;
@@ -18948,10 +19187,11 @@ var SqliteExceptionsRepository = class {
       this.insertExceptionRow(id, input, now);
     } catch (err) {
       if (!isUniqueConstraintError(err)) throw err;
-      this.db.exec("BEGIN IMMEDIATE");
-      try {
-        const superseded = this.db.prepare(
-          `UPDATE exceptions
+      withTransaction(
+        this.db,
+        () => {
+          const superseded = this.db.prepare(
+            `UPDATE exceptions
                 SET revoked_at = :now, revoked_by = :revokedBy,
                     revoke_reason = 'superseded by a new grant for the same value',
                     updated_at = :now
@@ -18959,24 +19199,27 @@ var SqliteExceptionsRepository = class {
                 AND key_version = :keyVersion AND revoked_at IS NULL
                 AND ((expires_at IS NOT NULL AND expires_at <= :now)
                   OR (max_uses IS NOT NULL AND use_count >= max_uses))`
-        ).run({
-          now,
-          revokedBy: input.createdBy,
-          ruleId: input.ruleId,
-          valueFingerprint: input.valueFingerprint,
-          keyVersion: input.keyVersion
-        });
-        if (Number(superseded.changes) !== 1) {
-          throw new DuplicateActiveExceptionError(input.ruleId);
-        }
-        this.insertExceptionRow(id, input, now);
-        this.db.exec("COMMIT");
-      } catch (retryErr) {
-        this.db.exec("ROLLBACK");
-        throw retryErr;
-      }
+          ).run({
+            now,
+            revokedBy: input.createdBy,
+            ruleId: input.ruleId,
+            valueFingerprint: input.valueFingerprint,
+            keyVersion: input.keyVersion
+          });
+          if (Number(superseded.changes) !== 1) {
+            throw new DuplicateActiveExceptionError(input.ruleId);
+          }
+          this.insertExceptionRow(id, input, now);
+        },
+        "IMMEDIATE"
+      );
+    }
+    const row = getRow(this.db.prepare("SELECT * FROM exceptions WHERE id = :id"), {
+      id
+    });
+    if (row === void 0) {
+      throw new Error("exception row not found immediately after insert");
     }
-    const row = this.db.prepare("SELECT * FROM exceptions WHERE id = :id").get({ id });
     return parseExceptionRow(row);
   }
   insertExceptionRow(id, input, now) {
@@ -19014,14 +19257,11 @@ var SqliteExceptionsRepository = class {
    */
   list(opts) {
     const where = opts?.includeTerminal ? "" : `WHERE ${ACTIVE_PREDICATE}`;
-    const rows = this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`).all(opts?.includeTerminal ? {} : { now: Date.now() });
-    const exceptions = [];
-    for (const row of rows) {
-      try {
-        exceptions.push(parseExceptionRow(row));
-      } catch {
-      }
-    }
+    const rows = allRows(
+      this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`),
+      opts?.includeTerminal ? {} : { now: Date.now() }
+    );
+    const exceptions = mapRowsTolerant(rows, parseExceptionRow);
     return Promise.resolve(exceptions);
   }
   /**
@@ -19031,7 +19271,12 @@ var SqliteExceptionsRepository = class {
    */
   getByIdPrefix(prefix) {
     if (prefix.length === 0) return Promise.resolve(void 0);
-    const rows = this.db.prepare(String.raw`SELECT * FROM exceptions WHERE id LIKE :pattern ESCAPE '\' LIMIT 2`).all({ pattern: `${escapeLikePattern(prefix)}%` });
+    const rows = allRows(
+      this.db.prepare(
+        String.raw`SELECT * FROM exceptions WHERE id LIKE :pattern ESCAPE '\' LIMIT 2`
+      ),
+      { pattern: `${escapeLikePattern(prefix)}%` }
+    );
     if (rows.length > 1) {
       return Promise.reject(new AmbiguousExceptionIdError(prefix));
     }
@@ -19073,30 +19318,27 @@ var SqliteExceptionsRepository = class {
    * a different (rotated-away) key never match, so they are excluded at read.
    */
   activeBundleEntries(keyVersion, now = Date.now()) {
-    const rows = this.db.prepare(
-      `SELECT * FROM exceptions
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT * FROM exceptions
           WHERE key_version = :keyVersion AND ${ACTIVE_PREDICATE}
           ORDER BY created_at DESC, rowid DESC`
-    ).all({ keyVersion, now });
-    const entries = [];
-    for (const row of rows) {
-      try {
-        const conditions = row.conditions === null ? null : JSON.parse(row.conditions);
-        entries.push(
-          ExceptionBundleEntry.parse({
-            id: row.id,
-            ruleId: row.rule_id,
-            valueFingerprint: row.value_fingerprint,
-            keyVersion: row.key_version,
-            expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
-            maxUses: row.max_uses,
-            useCount: row.use_count,
-            conditions
-          })
-        );
-      } catch {
-      }
-    }
+      ),
+      { keyVersion, now }
+    );
+    const entries = mapRowsTolerant(rows, (row) => {
+      const conditions = row.conditions === null ? null : JSON.parse(row.conditions);
+      return ExceptionBundleEntry.parse({
+        id: row.id,
+        ruleId: row.rule_id,
+        valueFingerprint: row.value_fingerprint,
+        keyVersion: row.key_version,
+        expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
+        maxUses: row.max_uses,
+        useCount: row.use_count,
+        conditions
+      });
+    });
     return Promise.resolve(entries);
   }
   /**
@@ -19123,11 +19365,14 @@ var SqliteExceptionsRepository = class {
   }
   /** Blocked detections within the window (default: the 30-minute TTL), newest-first. */
   recentBlocked(windowMs = BLOCKED_DETECTIONS_TTL_MS) {
-    const rows = this.db.prepare(
-      `SELECT * FROM blocked_detections
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT * FROM blocked_detections
           WHERE blocked_at > :cutoff
           ORDER BY blocked_at DESC, rowid DESC`
-    ).all({ cutoff: Date.now() - windowMs });
+      ),
+      { cutoff: Date.now() - windowMs }
+    );
     return Promise.resolve(
       rows.map((row) => ({
         reference: row.reference,
@@ -19207,7 +19452,12 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 )`;
 
 // ../../packages/persistence/src/repositories/findings.ts
-var GROUP_ROW_CAP = 2e3;
+var PREVIEW_INSTANCES_PER_GROUP = 200;
+var CONCAT_SEP = ",";
+var TUPLE_SEP = "|";
+function splitConcat(value) {
+  return value === null || value === "" ? [] : value.split(CONCAT_SEP);
+}
 function deriveInstanceStatus(row) {
   return deriveFindingStatus({
     kind: row.kind,
@@ -19275,13 +19525,16 @@ var SqliteFindingsRepository = class {
   }
   recentFindings(opts) {
     const limit = opts?.limit ?? 50;
-    const rows = this.db.prepare(
-      `SELECT f.id, f.event_id, f.rule_id, f.category, f.severity, f.masked_match,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.id, f.event_id, f.rule_id, f.category, f.severity, f.masked_match,
                 f.action_taken, f.confidence, e.occurred_at, e.source_tool, e.kind
          FROM findings f JOIN events e ON e.id = f.event_id
          ORDER BY e.occurred_at DESC, f.rowid DESC
          LIMIT :limit`
-    ).all({ limit });
+      ),
+      { limit }
+    );
     return Promise.resolve(
       rows.map((r) => ({
         id: r.id,
@@ -19304,20 +19557,47 @@ var SqliteFindingsRepository = class {
    * applies the requested filters, and sorts by severity then recency. Filtering
    * and faceting run in JS via the shared @akasecurity/schema helpers. `totals`
    * reflect the full filtered set; `items` is the requested
-   * page (default 100); no cursor (nextCursor is always null).
+   * page (default 50); no cursor (nextCursor is always null).
+   *
+   * Two reads, neither of which materializes a row per finding:
+   *   1. one aggregate row per rule_id, folding EVERY instance into the numbers
+   *      the group and the filters need (count, providers, actions, statuses,
+   *      latest, search text);
+   *   2. each group's newest PREVIEW_INSTANCES_PER_GROUP instances, which
+   *      populate `instances` for the table's expanded rows.
+   * The aggregates carry raw DB values and are translated by the same
+   * @akasecurity/schema mappers the row path uses, so no enum mapping or status
+   * rule is ever restated in SQL.
    */
   listGroupedFindings(query) {
-    const rows = this.db.prepare(
-      `SELECT f.id, f.rule_id, f.category, f.severity, f.masked_match,
-                f.action_taken, f.confidence, e.occurred_at, e.source_tool,
-                json_extract(e.metadata, '$.repo') AS repo,
-                json_extract(e.metadata, '$.filePath') AS file,
-                e.kind AS kind, f.finding_key AS finding_key,
-                ${latestResolutionStatusSql("f")} AS latest_status
-         FROM findings f JOIN events e ON e.id = f.event_id
-         ORDER BY e.occurred_at DESC, f.id DESC
-         LIMIT :cap`
-    ).all({ cap: GROUP_ROW_CAP });
+    const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "");
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
+                occurred_at, source_tool, repo, file, kind, finding_key, latest_status
+         FROM (
+           SELECT f.id AS id, f.rule_id AS rule_id, f.category AS category,
+                  f.severity AS severity, f.masked_match AS masked_match,
+                  f.action_taken AS action_taken, f.confidence AS confidence,
+                  e.occurred_at AS occurred_at, e.source_tool AS source_tool,
+                  json_extract(e.metadata, '$.repo') AS repo,
+                  json_extract(e.metadata, '$.filePath') AS file,
+                  e.kind AS kind, f.finding_key AS finding_key,
+                  latest.status AS latest_status,
+                  ROW_NUMBER() OVER (
+                    PARTITION BY f.rule_id
+                    ORDER BY e.occurred_at DESC, f.id DESC
+                  ) AS rn
+             FROM findings f
+             JOIN events e ON e.id = f.event_id
+             LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+               ON latest.finding_key = f.finding_key
+         )
+         WHERE rn <= :cap
+         ORDER BY occurred_at DESC, id DESC`
+      ),
+      { cap: PREVIEW_INSTANCES_PER_GROUP }
+    );
     const groupable = rows.map((r) => ({
       id: r.id,
       ruleId: r.rule_id,
@@ -19332,7 +19612,7 @@ var SqliteFindingsRepository = class {
       file: r.file ?? "",
       status: deriveInstanceStatus(r)
     }));
-    const allGroups = buildFindingGroups(groupable);
+    const allGroups = buildFindingGroups(groupable, { aggregates });
     const filterOpts = {
       severity: query.severity,
       providers: query.provider,
@@ -19350,42 +19630,122 @@ var SqliteFindingsRepository = class {
     const items = sorted.slice(0, limit);
     return Promise.resolve({ totals, facets, items, nextCursor: null });
   }
+  /**
+   * One row per rule_id, folding EVERY instance of the group into the values
+   * buildFindingGroups cannot recover from a preview. Bounded by the number of
+   * distinct rule_ids (the installed packs' rules), not by the store's size.
+   *
+   * The per-instance sets ride back as group_concat lists of RAW DB values —
+   * source_tool, action_taken, and the (kind, has-key, latest-status) triples
+   * deriveFindingStatus consumes. Aggregating the status INPUTS rather than a
+   * status keeps the classifier itself in @akasecurity/schema, where
+   * severitySummary's SQL and this query can't drift apart on what 'resolved'
+   * means (see resolution-sql.ts). Each of those sets is bounded by an enum, so
+   * a group's row stays small however many findings it holds.
+   *
+   * `withSearchText` is the exception, and the one column here that does NOT
+   * stay small: the group's distinct repos/filePaths, whose size tracks how many
+   * distinct paths a rule fired across — for a rule hitting mostly-unique paths
+   * that is a string proportional to the store (~8MB over 200k distinct paths,
+   * and buildHaystack lowercases a second copy). It buys `q` the ability to
+   * match an instance outside the preview, which searching the preview alone
+   * would silently lose, so it is fetched only when the request actually
+   * carries a `q`.
+   */
+  groupAggregates(withSearchText) {
+    const searchTextColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.metadata, '$.repo')) AS repos,
+           group_concat(DISTINCT json_extract(e.metadata, '$.filePath')) AS files` : `, NULL AS repos, NULL AS files`;
+    const rows = this.db.prepare(
+      `SELECT f.rule_id AS rule_id,
+                count(*) AS instance_count,
+                max(e.occurred_at) AS latest_at,
+                group_concat(DISTINCT e.source_tool) AS source_tools,
+                group_concat(DISTINCT f.action_taken) AS actions_taken,
+                group_concat(DISTINCT (
+                  e.kind || '${TUPLE_SEP}' ||
+                  (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '${TUPLE_SEP}' ||
+                  coalesce(latest.status, '')
+                )) AS status_inputs
+                ${searchTextColumns}
+           FROM findings f
+           JOIN events e ON e.id = f.event_id
+           LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+             ON latest.finding_key = f.finding_key
+          GROUP BY f.rule_id`
+    ).all();
+    return new Map(
+      rows.map((r) => [
+        r.rule_id,
+        {
+          instanceCount: r.instance_count,
+          sourceTools: splitConcat(r.source_tools),
+          actionsTaken: splitConcat(r.actions_taken),
+          statusInputs: splitConcat(r.status_inputs).map((tuple2) => {
+            const [kind = "", keyMarker = "", latestStatus = ""] = tuple2.split(TUPLE_SEP);
+            return {
+              // deriveFindingStatus only distinguishes null from non-null here,
+              // so the marker stands in for the key itself (never rendered).
+              kind,
+              findingKey: keyMarker === "" ? null : keyMarker,
+              latestResolutionStatus: latestStatus === "" ? null : latestStatus
+            };
+          }),
+          latestDetectedAt: epochMillisToIso(r.latest_at),
+          // Free text only — joined and substring-matched, so group_concat's
+          // commas need no unpicking (a repo/path containing one still matches).
+          // Left undefined (not '') when unfetched, so buildFindingGroups can
+          // tell "no q this request" from "a group with no repo/file at all"
+          // and skip priming a haystack nothing will read.
+          ...withSearchText ? { searchText: [r.repos ?? "", r.files ?? ""].filter((s) => s !== "").join(" ") } : {}
+        }
+      ])
+    );
+  }
   healthSummary() {
-    const total = this.db.prepare("SELECT count(*) AS c FROM findings").get().c;
+    const total = countScalar(this.db, "SELECT count(*) AS n FROM findings");
     const byAction = Object.fromEntries(ACTION_TAKEN_KEYS.map((a) => [a, 0]));
-    const grouped = this.db.prepare("SELECT action_taken, count(*) AS c FROM findings GROUP BY action_taken").all();
+    const grouped = allRows(
+      this.db.prepare("SELECT action_taken, count(*) AS c FROM findings GROUP BY action_taken")
+    );
     for (const row of grouped) {
       if (row.action_taken in byAction) byAction[row.action_taken] = row.c;
     }
     const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
-    const sevRows = this.db.prepare(
-      `SELECT f.severity AS severity, count(*) AS c
+    const sevRows = allRows(
+      this.db.prepare(
+        `SELECT f.severity AS severity, count(*) AS c
          FROM findings f
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
          WHERE latest.status IS NULL OR latest.status != 'resolved'
          GROUP BY f.severity`
-    ).all();
+      )
+    );
     for (const row of sevRows) {
       if (row.severity in bySeverity) bySeverity[row.severity] = row.c;
     }
     const categories = ENFORCEABLE_CATEGORIES;
-    const enabledRows = this.db.prepare(
-      `SELECT DISTINCT json_extract(target, '$.category') AS category
+    const enabledRows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT json_extract(target, '$.category') AS category
          FROM policies WHERE enabled = 1 AND json_extract(target, '$.category') IS NOT NULL`
-    ).all();
+      )
+    );
     const enabled = new Set(enabledRows.map((r) => r.category));
     const coverage = categories.length === 0 ? 0 : categories.filter((c) => enabled.has(c)).length / categories.length;
     return Promise.resolve({ findings: total, byAction, bySeverity, coverage });
   }
   activityByDay(days = 7) {
     const since = startOfUtcDay(Date.now()) - (days - 1) * DAY_MS3;
-    const rows = this.db.prepare(
-      `SELECT date(e.occurred_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT date(e.occurred_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :since
          GROUP BY day, f.action_taken`
-    ).all({ since });
+      ),
+      { since }
+    );
     const buckets = /* @__PURE__ */ new Map();
     for (let i = 0; i < days; i++) {
       const day = isoDay(since + i * DAY_MS3);
@@ -19457,17 +19817,19 @@ var SqliteInspectionFindingsRepository = class {
   insertStmt;
   insertFinding(input) {
     const row = toInspectionFindingRow(input);
-    this.insertStmt.run({
-      id: row.id,
-      auditEventId: row.auditEventId,
-      inspectionDefinitionId: row.inspectionDefinitionId,
-      classifiedDataId: row.classifiedDataId ?? null,
-      spanStart: row.spanStart,
-      spanEnd: row.spanEnd,
-      maskedMatch: row.maskedMatch,
-      actionTaken: row.actionTaken,
-      confidence: row.confidence
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        auditEventId: row.auditEventId,
+        inspectionDefinitionId: row.inspectionDefinitionId,
+        classifiedDataId: row.classifiedDataId,
+        spanStart: row.spanStart,
+        spanEnd: row.spanEnd,
+        maskedMatch: row.maskedMatch,
+        actionTaken: row.actionTaken,
+        confidence: row.confidence
+      })
+    );
   }
 };
 
@@ -19543,12 +19905,7 @@ function isMirrorDowngrade(incoming, stored) {
 }
 function ruleIdsOf(rulesJson) {
   const ids = /* @__PURE__ */ new Set();
-  let raw;
-  try {
-    raw = JSON.parse(rulesJson);
-  } catch {
-    return ids;
-  }
+  const raw = safeJson(rulesJson, []);
   if (!Array.isArray(raw)) return ids;
   for (const entry of raw) {
     if (entry && typeof entry === "object") {
@@ -19621,47 +19978,48 @@ var SqliteInstalledPacksRepository = class {
       }));
       if (this.storedSignature() === inventorySignature(rows)) return;
       const now = Date.now();
-      this.db.exec("BEGIN IMMEDIATE");
-      try {
-        const mirror = this.mirrorState();
-        let behind = false;
-        for (const row of rows) {
-          const params = {
-            id: randomUUID2(),
-            namespace: row.namespace,
-            packId: row.packId,
-            version: row.version,
-            name: row.name,
-            rulesJson: row.rulesJson,
-            now
-          };
-          const stored = mirror.get(`${row.namespace}/${row.packId}`);
-          if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
-            this.upsertAvailableStmt.run({
-              ...params,
+      withTransaction(
+        this.db,
+        () => {
+          const mirror = this.mirrorState();
+          let behind = false;
+          for (const row of rows) {
+            const params = {
               id: randomUUID2(),
-              recordedBy: meta3?.recordedBy ?? null
-            });
-          } else {
-            behind = true;
+              namespace: row.namespace,
+              packId: row.packId,
+              version: row.version,
+              name: row.name,
+              rulesJson: row.rulesJson,
+              now
+            };
+            const stored = mirror.get(`${row.namespace}/${row.packId}`);
+            if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
+              this.upsertAvailableStmt.run({
+                ...params,
+                id: randomUUID2(),
+                recordedBy: meta3?.recordedBy ?? null
+              });
+            } else {
+              behind = true;
+            }
+            this.insertMissingStmt.run(params);
           }
-          this.insertMissingStmt.run(params);
-        }
-        if (!behind) this.pruneAvailable(rows.map((r) => `${r.namespace}/${r.packId}`));
-        this.db.exec("COMMIT");
-      } catch (err) {
-        this.db.exec("ROLLBACK");
-        throw err;
-      }
+          if (!behind) this.pruneAvailable(rows.map((r) => `${r.namespace}/${r.packId}`));
+        },
+        "IMMEDIATE"
+      );
     } catch {
     }
   }
   // The mirror's current (namespace/packId → {version, ruleIds}) map — the
   // input to the downgrade guard. Read INSIDE the write transaction.
   mirrorState() {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs`
+      )
+    );
     return new Map(
       rows.map((r) => [
         `${r.namespace}/${r.packId}`,
@@ -19673,7 +20031,9 @@ var SqliteInstalledPacksRepository = class {
   // (keys joined with '/', matching the detection id slug encoding — packId may
   // itself contain '/', but namespace may not, so the join is unambiguous).
   pruneAvailable(keep) {
-    const rows = this.db.prepare(`SELECT namespace, pack_id AS packId FROM available_packs`).all();
+    const rows = allRows(
+      this.db.prepare(`SELECT namespace, pack_id AS packId FROM available_packs`)
+    );
     const keepSet = new Set(keep);
     const del = this.db.prepare(`DELETE FROM available_packs WHERE namespace = ? AND pack_id = ?`);
     for (const r of rows) {
@@ -19700,11 +20060,13 @@ var SqliteInstalledPacksRepository = class {
     if (this.db.isTransaction) {
       throw new Error("applyUpdate must not be called inside an open transaction");
     }
-    this.db.exec("BEGIN IMMEDIATE");
-    try {
-      this.db.exec("UPDATE _pack_write_gate SET open = 1 WHERE id = 1");
-      const res = this.db.prepare(
-        `UPDATE installed_packs SET
+    let changed = false;
+    withTransaction(
+      this.db,
+      () => {
+        this.db.exec("UPDATE _pack_write_gate SET open = 1 WHERE id = 1");
+        const res = this.db.prepare(
+          `UPDATE installed_packs SET
              version = (SELECT a.version FROM available_packs a
                         WHERE a.namespace = :namespace AND a.pack_id = :packId),
              name = (SELECT a.name FROM available_packs a
@@ -19715,17 +20077,13 @@ var SqliteInstalledPacksRepository = class {
            WHERE namespace = :namespace AND pack_id = :packId
              AND EXISTS (SELECT 1 FROM available_packs a
                          WHERE a.namespace = :namespace AND a.pack_id = :packId)`
-      ).run({ namespace, packId, now: Date.now() });
-      this.db.exec("UPDATE _pack_write_gate SET open = 0 WHERE id = 1");
-      this.db.exec("COMMIT");
-      return Number(res.changes) > 0;
-    } catch (err) {
-      try {
-        this.db.exec("ROLLBACK");
-      } catch {
-      }
-      throw err;
-    }
+        ).run({ namespace, packId, now: Date.now() });
+        this.db.exec("UPDATE _pack_write_gate SET open = 0 WHERE id = 1");
+        changed = Number(res.changes) > 0;
+      },
+      "IMMEDIATE"
+    );
+    return changed;
   }
   /**
    * The scan-time ruleset: every rule under an ENABLED installed pack that
@@ -19739,9 +20097,11 @@ var SqliteInstalledPacksRepository = class {
    * JSON-level failure therefore counts as invalid.
    */
   installedRuleset() {
-    const rows = this.db.prepare(
-      `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson FROM installed_packs`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson FROM installed_packs`
+      )
+    );
     const out = {
       installedPacks: rows.length,
       enabledPacks: 0,
@@ -19750,7 +20110,7 @@ var SqliteInstalledPacksRepository = class {
       ruleActions: /* @__PURE__ */ new Map()
     };
     for (const row of rows) {
-      if (row.enabled !== 1) continue;
+      if (!intToBool(row.enabled)) continue;
       out.enabledPacks += 1;
       const action = policyIdToAction(row.policyId);
       let raw;
@@ -19785,9 +20145,11 @@ var SqliteInstalledPacksRepository = class {
    * running max would mask a genuinely-newer parseable stamp.
    */
   newestRecordedBinary() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT recorded_by AS recordedBy FROM available_packs WHERE recorded_by IS NOT NULL`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT recorded_by AS recordedBy FROM available_packs WHERE recorded_by IS NOT NULL`
+      )
+    );
     let newest = null;
     for (const row of rows) {
       const at = row.recordedBy.lastIndexOf("@");
@@ -19802,13 +20164,15 @@ var SqliteInstalledPacksRepository = class {
     return newest;
   }
   counts() {
-    const row = this.db.prepare(
-      `SELECT count(*) AS packs,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT count(*) AS packs,
                 coalesce(sum(json_array_length(rules_json)), 0) AS rules,
                 coalesce(sum(enabled), 0) AS enabled
          FROM installed_packs`
-    ).get();
-    return Promise.resolve(row);
+      )
+    );
+    return Promise.resolve(row ?? { packs: 0, rules: 0, enabled: 0 });
   }
   // ─── Policy-catalog reads ────────────────────────────────────────────────────
   // Back the Policies page's built-in catalog: how many
@@ -19821,26 +20185,29 @@ var SqliteInstalledPacksRepository = class {
    * attributed to Monitor, matching the Detections views.
    */
   countsByPolicyId() {
-    const rows = this.db.prepare(
-      `SELECT coalesce(policy_id, '${DEFAULT_POLICY_ID}') AS pid, count(*) AS n
+    return countBy(
+      this.db,
+      `SELECT coalesce(policy_id, '${DEFAULT_POLICY_ID}') AS k, count(*) AS n
          FROM installed_packs
-         GROUP BY pid`
-    ).all();
-    return new Map(rows.map((r) => [r.pid, r.n]));
+         GROUP BY k`
+    );
   }
   /** The detections governed by a built-in policy — one UsedByItem per pack. */
   listByPolicyId(policyId) {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, name, enabled, rules_json AS rulesJson
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, name, enabled, rules_json AS rulesJson
          FROM installed_packs
          WHERE coalesce(policy_id, '${DEFAULT_POLICY_ID}') = ?
          ORDER BY name ASC`
-    ).all(policyId);
+      ),
+      [policyId]
+    );
     return rows.map((r) => ({
       id: `${r.namespace}/${r.packId}`,
       name: r.name,
       ruleCount: parseRules(r.rulesJson).length,
-      enabled: r.enabled === 1
+      enabled: intToBool(r.enabled)
     }));
   }
   // ─── Writes ────────────────────────────────────────────────────────────────
@@ -19869,14 +20236,14 @@ var SqliteInstalledPacksRepository = class {
     const res = this.db.prepare(
       `UPDATE installed_packs SET enabled = :enabled, updated_at = :now
          WHERE namespace = :namespace AND pack_id = :packId`
-    ).run({ enabled: enabled ? 1 : 0, now: Date.now(), namespace, packId });
+    ).run({ enabled: boolToInt(enabled), now: Date.now(), namespace, packId });
     return Number(res.changes) > 0;
   }
   // Fingerprint of the recorded available mirror — compared against the
   // incoming inventory's signature to skip the write entirely when the running
   // binary's inventory hasn't changed since the last record.
   storedSignature() {
-    const rows = this.signatureStmt.all();
+    const rows = allRows(this.signatureStmt);
     return inventorySignature(rows);
   }
 };
@@ -19904,42 +20271,48 @@ var SqliteInventoryRepository = class {
   upsert(input, now = Date.now()) {
     const id = inventoryId(input.objectType, input.identityKey);
     const row = toInventoryRow(input, id, now);
-    this.upsertStmt.run({
-      id: row.id,
-      objectType: row.objectType,
-      location: row.location ?? null,
-      title: row.title ?? null,
-      hostId: row.hostId ?? null,
-      attributes: row.attributes,
-      firstSeen: row.firstSeen,
-      lastSeen: row.lastSeen
-    });
+    this.upsertStmt.run(
+      bindParams({
+        id: row.id,
+        objectType: row.objectType,
+        location: row.location,
+        title: row.title,
+        hostId: row.hostId,
+        attributes: row.attributes,
+        firstSeen: row.firstSeen,
+        lastSeen: row.lastSeen
+      })
+    );
     return id;
   }
   // The full row, for round-trip assertions.
   findById(id) {
-    const row = this.db.prepare("SELECT * FROM inventory WHERE id = :id").get({ id });
-    return row;
+    return getRow(this.db.prepare("SELECT * FROM inventory WHERE id = :id"), { id });
   }
   // Distinct titles for an object_type — a filter facet (e.g. hostnames),
   // served from the object_type index, never from audit_events.
   distinctTitles(objectType) {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT title FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT title FROM inventory
          WHERE object_type = :objectType AND title IS NOT NULL
          ORDER BY title`
-    ).all({ objectType });
+      ),
+      { objectType }
+    );
     return rows.map((r) => r.title);
   }
   // Distinct host os_version values — a facet served from an inventory index
   // over the generated column, never from the audit fact (confirm via EXPLAIN
   // QUERY PLAN).
   osVersions() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT os_version AS value FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT os_version AS value FROM inventory
          WHERE object_type = 'host' AND os_version IS NOT NULL
          ORDER BY value`
-    ).all();
+      )
+    );
     return rows.map((r) => r.value);
   }
 };
@@ -19959,14 +20332,6 @@ var EMPTY_PROJECT_AGG = {
   accessCounts: { open: 0, approved: 0, blocked: 0, total: 0 },
   findingsCount: 0
 };
-function safeJson(s, fallback) {
-  if (s == null) return fallback;
-  try {
-    return JSON.parse(s);
-  } catch {
-    return fallback;
-  }
-}
 function resolveHarnessId(attrs, row) {
   if (attrs.provider && VALID_HARNESS_IDS.has(attrs.provider)) {
     return attrs.provider;
@@ -20162,30 +20527,49 @@ var SqliteInventoryAssetsRepository = class {
   configRowsCache;
   // ─── stats ─────────────────────────────────────────────────────────────────
   getInventoryStats() {
-    const byType = { project: 0, skill: 0, mcp: 0, hook: 0, config: 0 };
-    for (const r of this.db.prepare("SELECT asset_type AS t, count(*) AS n FROM inventory_asset GROUP BY asset_type").all()) {
-      if (r.t in byType) byType[r.t] = r.n;
-    }
-    byType.project = this.db.prepare(`SELECT count(*) AS n FROM source_project WHERE ${WORKTREE_CHECKOUT_FILTER}`).get().n;
-    const mcpTrust = { "known-good": 0, risky: 0, unapproved: 0 };
-    for (const r of this.db.prepare(
-      `SELECT coalesce(o.trust, a.trust) AS trust, count(*) AS n
+    const typeCounts = countBy(
+      this.db,
+      "SELECT asset_type AS k, count(*) AS n FROM inventory_asset GROUP BY asset_type"
+    );
+    const byType = {
+      project: 0,
+      skill: typeCounts.get("skill") ?? 0,
+      mcp: typeCounts.get("mcp") ?? 0,
+      hook: typeCounts.get("hook") ?? 0,
+      config: typeCounts.get("config") ?? 0
+    };
+    byType.project = countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM source_project WHERE ${WORKTREE_CHECKOUT_FILTER}`
+    );
+    const mcpTrustCounts = countBy(
+      this.db,
+      `SELECT coalesce(o.trust, a.trust) AS k, count(*) AS n
          FROM inventory_asset a
          LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
          WHERE a.asset_type = 'mcp' AND coalesce(o.trust, a.trust) IS NOT NULL
          GROUP BY coalesce(o.trust, a.trust)`
-    ).all()) {
-      if (r.trust in mcpTrust) mcpTrust[r.trust] = r.n;
-    }
-    const harnesses = this.db.prepare(
+    );
+    const mcpTrust = {
+      "known-good": mcpTrustCounts.get("known-good") ?? 0,
+      risky: mcpTrustCounts.get("risky") ?? 0,
+      unapproved: mcpTrustCounts.get("unapproved") ?? 0
+    };
+    const harnesses = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM inventory
            WHERE object_type = 'harness'
-             AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`
-    ).get({ liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }).n;
-    const flaggedAssets = this.db.prepare("SELECT count(*) AS n FROM inventory_asset WHERE flags_json <> '[]'").get().n;
-    const flaggedProjects = this.db.prepare(
+             AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`,
+      { liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }
+    );
+    const flaggedAssets = countScalar(
+      this.db,
+      "SELECT count(*) AS n FROM inventory_asset WHERE flags_json <> '[]'"
+    );
+    const flaggedProjects = countScalar(
+      this.db,
       `SELECT count(DISTINCT project_id) AS n FROM project_file WHERE findings_count > 0`
-    ).get().n;
+    );
     const configRows = this.configAssetRows();
     for (const r of configRows) {
       byType[r.assetType] += 1;
@@ -20442,12 +20826,15 @@ var SqliteInventoryAssetsRepository = class {
   }
   // ─── raw fetchers ────────────────────────────────────────────────────────────
   fetchHarnessRows() {
-    return this.db.prepare(
-      `SELECT id, title, attributes, harness_version AS harnessVersion
+    return allRows(
+      this.db.prepare(
+        `SELECT id, title, attributes, harness_version AS harnessVersion
          FROM inventory
          WHERE object_type = 'harness'
            AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`
-    ).all({ liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS });
+      ),
+      { liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }
+    );
   }
   // Every harness's assets in ONE grouped query, keyed by harness inventory id —
   // replaces the per-harness-row query the listHarnesses loop used to make.
@@ -20457,12 +20844,13 @@ var SqliteInventoryAssetsRepository = class {
     const params = [...harnessInvIds];
     let where = `ha.harness_id IN (${placeholders(harnessInvIds.length)})`;
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      where += " AND (a.name LIKE ? ESCAPE '\\' OR a.sub LIKE ? ESCAPE '\\')";
+      const pat = containsPattern(q);
+      where += ` AND ${likeAny(["a.name", "a.sub"])}`;
       params.push(pat, pat);
     }
-    const rows = this.db.prepare(
-      `SELECT ha.harness_id AS harnessInvId, a.id, a.asset_type AS assetType, a.name, a.sub,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT ha.harness_id AS harnessInvId, a.id, a.asset_type AS assetType, a.name, a.sub,
                 a.description, a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                 a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
          FROM harness_asset ha
@@ -20470,7 +20858,9 @@ var SqliteInventoryAssetsRepository = class {
          LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
          WHERE ${where}
          ORDER BY a.name ASC`
-    ).all(...params);
+      ),
+      params
+    );
     for (const raw of rows) {
       const harnessInvId = raw.harnessInvId;
       const [asset] = this.mapAssetRows([raw]);
@@ -20489,21 +20879,24 @@ var SqliteInventoryAssetsRepository = class {
       params.push(...types);
     }
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      conditions.push("(a.name LIKE ? ESCAPE '\\' OR a.sub LIKE ? ESCAPE '\\')");
+      const pat = containsPattern(q);
+      conditions.push(likeAny(["a.name", "a.sub"]));
       params.push(pat, pat);
     }
     const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
     const sampleRows = this.mapAssetRows(
-      this.db.prepare(
-        `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
+      allRows(
+        this.db.prepare(
+          `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
                   a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                   a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
            FROM inventory_asset a
            LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
            ${where}
            ORDER BY a.name ASC`
-      ).all(...params)
+        ),
+        params
+      )
     );
     const configRows = this.configAssetRows(q).filter(
       (r) => !types || types.length === 0 || types.includes(r.assetType)
@@ -20512,14 +20905,17 @@ var SqliteInventoryAssetsRepository = class {
   }
   fetchAssetById(assetId) {
     const rows = this.mapAssetRows(
-      this.db.prepare(
-        `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
+      allRows(
+        this.db.prepare(
+          `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
                   a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                   a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
            FROM inventory_asset a
            LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
            WHERE a.id = ?`
-      ).all(assetId)
+        ),
+        [assetId]
+      )
     );
     return rows[0] ?? this.configAssetRows().find((r) => r.id === assetId) ?? null;
   }
@@ -20575,37 +20971,39 @@ var SqliteInventoryAssetsRepository = class {
     return rows;
   }
   latestConfigScanId() {
-    const row = this.db.prepare(
-      `SELECT id FROM audit_events WHERE event_type = 'config_scan'
-         ORDER BY started_at DESC, id DESC LIMIT 1`
-    ).get();
-    return row?.id ?? null;
+    return latestConfigScan(this.db)?.id ?? null;
   }
   fetchProjects(q) {
     let sql = `SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project
                WHERE ${WORKTREE_CHECKOUT_FILTER}`;
     const params = [];
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      sql += " AND (name LIKE ? ESCAPE '\\' OR url LIKE ? ESCAPE '\\')";
+      const pat = containsPattern(q);
+      sql += ` AND ${likeAny(["name", "url"])}`;
       params.push(pat, pat);
     }
     sql += " ORDER BY name ASC";
-    return this.db.prepare(sql).all(...params);
+    return allRows(this.db.prepare(sql), params);
   }
   fetchProjectById(projectId) {
-    return this.db.prepare(
-      "SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project WHERE id = ?"
-    ).get(projectId) ?? null;
+    return getRow(
+      this.db.prepare(
+        "SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project WHERE id = ?"
+      ),
+      [projectId]
+    ) ?? null;
   }
   // The referenced projects in ONE `id IN (…)` fetch, keyed by id.
   fetchProjectsByIds(projectIds) {
     const map2 = /* @__PURE__ */ new Map();
     if (projectIds.length === 0) return map2;
-    const rows = this.db.prepare(
-      `SELECT id, url, name, attributes, last_seen AS lastSeen
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, url, name, attributes, last_seen AS lastSeen
          FROM source_project WHERE id IN (${placeholders(projectIds.length)})`
-    ).all(...projectIds);
+      ),
+      projectIds
+    );
     for (const r of rows) map2.set(r.id, r);
     return map2;
   }
@@ -20616,8 +21014,9 @@ var SqliteInventoryAssetsRepository = class {
   projectAggregates(projectIds) {
     const map2 = /* @__PURE__ */ new Map();
     if (projectIds.length === 0) return map2;
-    const rows = this.db.prepare(
-      `SELECT f.project_id AS projectId,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.project_id AS projectId,
                 coalesce(o.access, f.default_access) AS eff,
                 count(*) AS n,
                 coalesce(sum(f.findings_count), 0) AS findings
@@ -20625,7 +21024,9 @@ var SqliteInventoryAssetsRepository = class {
          LEFT JOIN file_access_override o ON o.project_id = f.project_id AND o.path = f.path
          WHERE f.project_id IN (${placeholders(projectIds.length)})
          GROUP BY f.project_id, eff`
-    ).all(...projectIds);
+      ),
+      projectIds
+    );
     for (const r of rows) {
       let agg = map2.get(r.projectId);
       if (!agg) {
@@ -20663,37 +21064,52 @@ var SqliteInventoryAssetsRepository = class {
   fetchProjectFilesUnder(projectId, prefix) {
     if (prefix === "") {
       return this.mapFileRows(
-        this.db.prepare(this.fileSelect("f.project_id = ? ORDER BY f.path ASC")).all(projectId)
+        allRows(
+          this.db.prepare(this.fileSelect("f.project_id = ? ORDER BY f.path ASC")),
+          [projectId]
+        )
       );
     }
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect("f.project_id = ? AND f.path LIKE ? ESCAPE '\\' ORDER BY f.path ASC")
-      ).all(projectId, `${escapeLikePattern(prefix)}/%`)
+      allRows(
+        this.db.prepare(
+          this.fileSelect("f.project_id = ? AND f.path LIKE ? ESCAPE '\\' ORDER BY f.path ASC")
+        ),
+        [projectId, `${escapeLikePattern(prefix)}/%`]
+      )
     );
   }
   fetchProjectFilesSearch(projectId, q) {
-    const pat = `%${escapeLikePattern(q)}%`;
+    const pat = containsPattern(q);
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect(
-          "f.project_id = ? AND (f.path LIKE ? ESCAPE '\\' OR f.name LIKE ? ESCAPE '\\') ORDER BY f.path ASC"
-        )
-      ).all(projectId, pat, pat)
+      allRows(
+        this.db.prepare(
+          this.fileSelect(
+            "f.project_id = ? AND (f.path LIKE ? ESCAPE '\\' OR f.name LIKE ? ESCAPE '\\') ORDER BY f.path ASC"
+          )
+        ),
+        [projectId, pat, pat]
+      )
     );
   }
   fetchProjectFilesBlocked(projectId) {
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect(
-          "f.project_id = ? AND coalesce(o.access, f.default_access) = 'blocked' AND f.blocked_at IS NOT NULL"
-        )
-      ).all(projectId)
+      allRows(
+        this.db.prepare(
+          this.fileSelect(
+            "f.project_id = ? AND coalesce(o.access, f.default_access) = 'blocked' AND f.blocked_at IS NOT NULL"
+          )
+        ),
+        [projectId]
+      )
     );
   }
   fetchProjectFile(projectId, path) {
     const rows = this.mapFileRows(
-      this.db.prepare(this.fileSelect("f.project_id = ? AND f.path = ?")).all(projectId, path)
+      allRows(
+        this.db.prepare(this.fileSelect("f.project_id = ? AND f.path = ?")),
+        [projectId, path]
+      )
     );
     return rows[0] ?? null;
   }
@@ -20707,39 +21123,32 @@ var SqlitePoliciesRepository = class {
   }
   db;
   readPolicies() {
-    const rows = this.db.prepare("SELECT * FROM policies").all();
-    const policies = [];
-    for (const row of rows) {
-      try {
-        const target = JSON.parse(row.target);
-        const customKeywords = row.custom_keywords ? JSON.parse(row.custom_keywords) : void 0;
-        policies.push(
-          Policy.parse({
-            id: row.id,
-            scope: row.scope,
-            target,
-            action: row.action,
-            enabled: row.enabled === 1,
-            customKeywords
-          })
-        );
-      } catch {
-      }
-    }
+    const rows = allRows(this.db.prepare("SELECT * FROM policies"));
+    const policies = mapRowsTolerant(rows, (row) => {
+      const target = JSON.parse(row.target);
+      const customKeywords = row.custom_keywords ? JSON.parse(row.custom_keywords) : void 0;
+      return Policy.parse({
+        id: row.id,
+        scope: row.scope,
+        target,
+        action: row.action,
+        enabled: intToBool(row.enabled),
+        customKeywords
+      });
+    });
     return Promise.resolve(policies);
   }
   // Seed one policy per bundled category from DEFAULT_ACTIONS so the
   // detection-type config exists from first run. Only when the table is empty,
   // so a user's edits are never clobbered.
   seedDefaults() {
-    const count = this.db.prepare("SELECT count(*) AS c FROM policies").get().c;
+    const count = countScalar(this.db, "SELECT count(*) AS n FROM policies");
     if (count > 0) return;
     const stmt = this.db.prepare(
       `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
        VALUES (:id, 'global', :target, :action, 1, :now, :now)`
     );
-    this.db.exec("BEGIN");
-    try {
+    failOpenTransaction(this.db, () => {
       for (const [category, action] of Object.entries(DEFAULT_ACTIONS)) {
         stmt.run({
           id: randomUUID4(),
@@ -20748,10 +21157,41 @@ var SqlitePoliciesRepository = class {
           now: Date.now()
         });
       }
-      this.db.exec("COMMIT");
-    } catch {
-      this.db.exec("ROLLBACK");
-    }
+    });
+  }
+  // Insert-or-update the single global per-category policy row, keyed on the
+  // existing uq_policies_scope_target unique index (scope, target). `action`
+  // uses the SAME vocabulary seedDefaults writes (DEFAULT_ACTIONS' ActionTaken
+  // values), so the runtime's resolveAction reads rows written by either path
+  // identically. On conflict, `action`, `enabled`, and `updated_at` are updated;
+  // `id` and `created_at` are left exactly as they were.
+  upsertCategoryAction(category, action) {
+    const now = Date.now();
+    this.db.prepare(
+      `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
+         VALUES (:id, 'global', :target, :action, 1, :now, :now)
+         ON CONFLICT(scope, target) DO UPDATE SET action = excluded.action, enabled = 1, updated_at = excluded.updated_at`
+    ).run({ id: randomUUID4(), target: JSON.stringify({ category }), action, now });
+  }
+  // Caps every global per-category policy currently set to block/redact down
+  // to warn (see warn-era-cap.ts). Rule-targeted policies are untouched.
+  // Returns the number of rows changed.
+  capCategoryActions() {
+    const info = this.db.prepare(
+      `UPDATE policies SET action='warn', updated_at=:now
+         WHERE scope='global' AND action IN ('block','redact')
+           AND json_extract(target,'$.category') IS NOT NULL`
+    ).run({ now: Date.now() });
+    return Number(info.changes);
+  }
+  // Read the current action for a single global per-category policy row, mirroring
+  // upsertCategoryAction's category-lookup predicate. Returns undefined when no
+  // row exists yet, so callers can distinguish an unset category from a set one.
+  getCategoryAction(category) {
+    const row = this.db.prepare(
+      `SELECT action FROM policies WHERE scope='global' AND json_extract(target,'$.category') = :category`
+    ).get({ category });
+    return row?.action;
   }
 };
 
@@ -20827,7 +21267,7 @@ var SqliteProjectFilesRepository = class {
   maxStampStmt;
   /** Replace `projectId`'s tree with the scan's files. Caller wraps in a transaction. */
   replaceForProject(projectId, scan2, now) {
-    const { maxStamp } = this.maxStampStmt.get({ projectId });
+    const maxStamp = getRow(this.maxStampStmt, { projectId })?.maxStamp ?? 0;
     const stamp = Math.max(now, maxStamp + 1);
     for (const file2 of scan2.files) {
       this.upsertStmt.run({
@@ -20910,7 +21350,7 @@ var SqliteResolutionsRepository = class {
   }
   /** The newest disposition recorded for a finding key, or undefined if none. */
   latestByKey(key) {
-    const row = this.latestStmt.get({ findingKey: key });
+    const row = getRow(this.latestStmt, { findingKey: key });
     if (!row) return void 0;
     return {
       // Safe narrows: insertResolution enum-parses both columns on every write,
@@ -20927,7 +21367,7 @@ var SqliteResolutionsRepository = class {
    * the CLI) surfaces for that file.
    */
   openAtRestKeysForPath(path) {
-    const rows = this.openAtRestStmt.all({ path });
+    const rows = allRows(this.openAtRestStmt, { path });
     return rows.map((r) => r.finding_key);
   }
   /**
@@ -20938,7 +21378,7 @@ var SqliteResolutionsRepository = class {
    * resolution row (see scan.ts).
    */
   resolvedAtRestKeysForPath(path) {
-    const rows = this.resolvedAtRestStmt.all({ path });
+    const rows = allRows(this.resolvedAtRestStmt, { path });
     return rows.map((r) => r.finding_key);
   }
 };
@@ -20967,31 +21407,25 @@ var SqliteScanLedgerRepository = class {
   // Previously scanned files under THIS ruleset, keyed by path. Rows from an
   // older ruleset are simply absent, which reads as "never scanned".
   entriesForRuleset(rulesetHash) {
-    const rows = this.readStmt.all({ rulesetHash });
+    const rows = allRows(this.readStmt, {
+      rulesetHash
+    });
     return new Map(rows.map((r) => [r.path, { mtime: r.mtime, contentHash: r.contentHash }]));
   }
   upsertEntries(entries) {
     if (entries.length === 0) return;
     const scannedAt = Date.now();
-    try {
-      this.db.exec("BEGIN");
-      try {
-        for (const entry of entries) {
-          this.upsertStmt.run({
-            path: entry.path,
-            mtime: entry.mtime,
-            contentHash: entry.contentHash,
-            rulesetHash: entry.rulesetHash,
-            scannedAt
-          });
-        }
-        this.db.exec("COMMIT");
-      } catch (err) {
-        this.db.exec("ROLLBACK");
-        throw err;
+    failOpenTransaction(this.db, () => {
+      for (const entry of entries) {
+        this.upsertStmt.run({
+          path: entry.path,
+          mtime: entry.mtime,
+          contentHash: entry.contentHash,
+          rulesetHash: entry.rulesetHash,
+          scannedAt
+        });
       }
-    } catch {
-    }
+    });
   }
 };
 
@@ -21068,8 +21502,9 @@ var SqliteSecurityRepository = class {
   // finding — its rn = 1 filter is also what makes the LEFT JOIN safe against
   // double-counting a key that accumulated several append-only rows.
   severitySummary() {
-    const rows = this.db.prepare(
-      `SELECT f.severity AS severity,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.severity AS severity,
                 COUNT(*) AS count,
                 SUM(CASE
                       WHEN e.kind != 'code_change' THEN 1
@@ -21088,7 +21523,8 @@ var SqliteSecurityRepository = class {
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
          GROUP BY f.severity`
-    ).all();
+      )
+    );
     const byRow = new Map(rows.map((r) => [r.severity, r]));
     const bySeverity = SEVERITIES.map((severity) => ({
       severity,
@@ -21172,14 +21608,15 @@ var SqliteSecurityRepository = class {
     const numBuckets = granularity === "day" ? lenDays : Math.ceil(lenDays / 7);
     const now = this.now();
     const windowStart = startOfUtcDay2(now) - (lenDays - 1) * DAY_MS4;
-    const rows = this.db.prepare(
-      // first_detected_at is the PRESERVED first-detection time (set once on a
-      // finding's INSERT, never overwritten on the re-detection upsert), so MTTR
-      // measures from first sighting — not the latest re-scan's event, whose
-      // occurred_at the upsert overwrites onto findings.event_id. COALESCE onto
-      // the parent event's occurred_at defends against any legacy/edge row the
-      // backfill left null.
-      `SELECT COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at, f.severity AS severity,
+    const rows = allRows(
+      this.db.prepare(
+        // first_detected_at is the PRESERVED first-detection time (set once on a
+        // finding's INSERT, never overwritten on the re-detection upsert), so MTTR
+        // measures from first sighting — not the latest re-scan's event, whose
+        // occurred_at the upsert overwrites onto findings.event_id. COALESCE onto
+        // the parent event's occurred_at defends against any legacy/edge row the
+        // backfill left null.
+        `SELECT COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at, f.severity AS severity,
                 (
                   SELECT fr.status FROM finding_resolution fr
                    WHERE fr.finding_key = f.finding_key
@@ -21205,14 +21642,16 @@ var SqliteSecurityRepository = class {
               WHERE fr.finding_key = f.finding_key
                 AND fr.resolved_at >= :windowStart
            )`
-      // The EXISTS is a SUPERSET prefilter that bounds the scan to keys with
-      // any resolution activity at/after the window start — a row this method
-      // ultimately counts has its LATEST resolution inside the window, which
-      // implies such a row exists, so nothing wanted is dropped. The exact
-      // latest-wins + status/method + window gate stays in JS below,
-      // dialect-agnostic. Without this, a
-      // 7d request evaluated the store's entire trackable-findings history.
-    ).all({ windowStart });
+        // The EXISTS is a SUPERSET prefilter that bounds the scan to keys with
+        // any resolution activity at/after the window start — a row this method
+        // ultimately counts has its LATEST resolution inside the window, which
+        // implies such a row exists, so nothing wanted is dropped. The exact
+        // latest-wins + status/method + window gate stays in JS below,
+        // dialect-agnostic. Without this, a
+        // 7d request evaluated the store's entire trackable-findings history.
+      ),
+      { windowStart }
+    );
     const sums = /* @__PURE__ */ new Map();
     const counts = /* @__PURE__ */ new Map();
     for (const r of rows) {
@@ -21242,8 +21681,9 @@ var SqliteSecurityRepository = class {
     if (opts.kind === "user") return Promise.resolve({ range, items: [] });
     const now = this.now();
     const from = now - RANGE_DAYS[range] * DAY_MS4;
-    const rows = this.db.prepare(
-      `SELECT json_extract(e.metadata, '$.repo') AS repo, count(*) AS c
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT json_extract(e.metadata, '$.repo') AS repo, count(*) AS c
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :from AND e.occurred_at < :to
            AND json_extract(e.metadata, '$.repo') IS NOT NULL
@@ -21251,7 +21691,9 @@ var SqliteSecurityRepository = class {
          GROUP BY repo
          ORDER BY c DESC, repo
          LIMIT :limit`
-    ).all({ from, to: now, limit });
+      ),
+      { from, to: now, limit }
+    );
     const items = rows.map((r) => ({
       id: `repo_${r.repo}`,
       name: r.repo,
@@ -21273,8 +21715,9 @@ var SqliteSecurityRepository = class {
   // resolutions.ts's openAtRestStmt accessor. Ordered by resolved_at DESC,
   // capped at `limit`.
   recentlyResolved(limit = 20) {
-    const rows = this.db.prepare(
-      `SELECT f.finding_key AS finding_key,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.finding_key AS finding_key,
                 f.rule_id AS rule_id,
                 f.severity AS severity,
                 json_extract(e.metadata, '$.filePath') AS path,
@@ -21308,7 +21751,9 @@ var SqliteSecurityRepository = class {
            ) IS NOT NULL
          ORDER BY latest_resolved_at DESC
          LIMIT :limit`
-    ).all({ limit });
+      ),
+      { limit }
+    );
     const items = rows.map((r) => ({
       findingKey: r.finding_key,
       ruleId: r.rule_id,
@@ -21325,12 +21770,15 @@ var SqliteSecurityRepository = class {
   // epoch-millis timestamp. occurred_at is an INTEGER column, so the bounds stay
   // numeric and the JS aggregations bucket/split on ms directly.
   findingsInRange(fromMs, toMs) {
-    const rows = this.db.prepare(
-      `SELECT e.occurred_at AS occurred_at, f.severity AS severity, f.action_taken AS action_taken
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT e.occurred_at AS occurred_at, f.severity AS severity, f.action_taken AS action_taken
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :from AND e.occurred_at < :to
          ORDER BY e.occurred_at`
-    ).all({ from: fromMs, to: toMs });
+      ),
+      { from: fromMs, to: toMs }
+    );
     return rows.map((r) => ({
       occurredAt: r.occurred_at,
       severity: r.severity,
@@ -21344,12 +21792,7 @@ import { randomUUID as randomUUID7 } from "crypto";
 var KIND_ORDER = ["provider", "internal", "ip"];
 var CALL_SITE_EMBED_CAP = 200;
 function parseNetwork(networkJson) {
-  if (!networkJson) return null;
-  try {
-    return JSON.parse(networkJson);
-  } catch {
-    return null;
-  }
+  return safeJson(networkJson, null);
 }
 function toEndpointSummary(row) {
   return {
@@ -21436,27 +21879,39 @@ var SqliteSharesRepository = class {
   }
   db;
   stats() {
-    const scalar = (sql) => this.db.prepare(sql).get()?.n ?? 0;
-    const destinations = scalar("SELECT count(*) AS n FROM share_destination");
-    const endpoints = scalar("SELECT count(*) AS n FROM share_endpoint");
-    const callSites = scalar("SELECT count(*) AS n FROM share_call_site");
-    const insecure = scalar(
+    const destinations = countScalar(this.db, "SELECT count(*) AS n FROM share_destination");
+    const endpoints = countScalar(this.db, "SELECT count(*) AS n FROM share_endpoint");
+    const callSites = countScalar(this.db, "SELECT count(*) AS n FROM share_call_site");
+    const insecure = countScalar(
+      this.db,
       "SELECT count(DISTINCT destination_id) AS n FROM share_endpoint WHERE transport = 'http'"
     );
-    const needsReview = scalar(
+    const needsReview = countScalar(
+      this.db,
       `SELECT count(DISTINCT d.id) AS n
        FROM share_destination d
        LEFT JOIN share_endpoint e ON e.destination_id = d.id AND e.transport = 'http'
        WHERE d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL`
     );
-    const byKind = { provider: 0, internal: 0, ip: 0 };
-    for (const row of this.db.prepare("SELECT kind, count(*) AS n FROM share_destination GROUP BY kind").all()) {
-      byKind[row.kind] = row.n;
-    }
-    const byTrust = { recognized: 0, internal: 0, unverified: 0, ip: 0 };
-    for (const row of this.db.prepare("SELECT trust, count(*) AS n FROM share_destination GROUP BY trust").all()) {
-      byTrust[row.trust] = row.n;
-    }
+    const kindCounts = countBy(
+      this.db,
+      "SELECT kind AS k, count(*) AS n FROM share_destination GROUP BY kind"
+    );
+    const byKind = {
+      provider: kindCounts.get("provider") ?? 0,
+      internal: kindCounts.get("internal") ?? 0,
+      ip: kindCounts.get("ip") ?? 0
+    };
+    const trustCounts = countBy(
+      this.db,
+      "SELECT trust AS k, count(*) AS n FROM share_destination GROUP BY trust"
+    );
+    const byTrust = {
+      recognized: trustCounts.get("recognized") ?? 0,
+      internal: trustCounts.get("internal") ?? 0,
+      unverified: trustCounts.get("unverified") ?? 0,
+      ip: trustCounts.get("ip") ?? 0
+    };
     return Promise.resolve({
       destinations,
       endpoints,
@@ -21572,7 +22027,7 @@ var SqliteSharesRepository = class {
     }
     let sql;
     if (q) {
-      const pattern = `%${escapeLikePattern(q)}%`;
+      const pattern = containsPattern(q);
       conditions.push(
         `(d.name LIKE ? ESCAPE '\\' OR d.category LIKE ? ESCAPE '\\' OR e.url LIKE ? ESCAPE '\\'
           OR c.project LIKE ? ESCAPE '\\' OR c.file LIKE ? ESCAPE '\\')`
@@ -21592,24 +22047,31 @@ var SqliteSharesRepository = class {
              ${conditions.length ? `WHERE ${conditions.join(" AND ")}` : ""}
              ORDER BY d.created_at ASC, d.id ASC`;
     }
-    const rows = this.db.prepare(sql).all(...params);
+    const rows = allRows(
+      this.db.prepare(sql),
+      params
+    );
     return rows.map((r) => this.mapDestRow(r));
   }
   fetchDestinationById(destinationId) {
-    const row = this.db.prepare(
-      `SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
                 d.network_json AS networkJson, d.last_seen AS lastSeenMs,
                 o.decision AS overrideDecision
          FROM share_destination d
          LEFT JOIN egress_decision_override o ON o.destination_id = d.id
          WHERE d.id = ?`
-    ).get(destinationId);
+      ),
+      [destinationId]
+    );
     return row ? this.mapDestRow(row) : null;
   }
   fetchEndpoints(destinationIds) {
     if (destinationIds.length === 0) return [];
-    const rows = this.db.prepare(
-      `SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
                 e.template, e.data_class AS dataClass, e.last_seen AS lastSeenMs,
                 count(c.id) AS callSiteCount
          FROM share_endpoint e
@@ -21617,7 +22079,9 @@ var SqliteSharesRepository = class {
          WHERE e.destination_id IN (${placeholders(destinationIds.length)})
          GROUP BY e.id
          ORDER BY e.created_at ASC, e.id ASC`
-    ).all(...destinationIds);
+      ),
+      destinationIds
+    );
     return rows.map((r) => ({
       id: r.id,
       destinationId: r.destinationId,
@@ -21642,13 +22106,16 @@ var SqliteSharesRepository = class {
   }
   fetchCallSites(endpointIds) {
     if (endpointIds.length === 0) return [];
-    const rows = this.db.prepare(
-      `SELECT id, endpoint_id AS endpointId, project, file, line, snippet, dynamic, vendored,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, endpoint_id AS endpointId, project, file, line, snippet, dynamic, vendored,
                 project_id AS projectId
          FROM share_call_site
          WHERE endpoint_id IN (${placeholders(endpointIds.length)})
          ORDER BY created_at ASC, id ASC`
-    ).all(...endpointIds);
+      ),
+      endpointIds
+    );
     return rows.map((r) => ({
       id: r.id,
       endpointId: r.endpointId,
@@ -21684,27 +22151,36 @@ var SqliteSourceProjectRepository = class {
   upsert(input, now = Date.now()) {
     const id = sourceProjectId(input.url);
     const row = toSourceProjectRow(input, id, now);
-    this.upsertStmt.run({
-      id: row.id,
-      url: row.url ?? null,
-      name: row.name ?? null,
-      attributes: row.attributes,
-      firstSeen: row.firstSeen,
-      lastSeen: row.lastSeen
-    });
+    this.upsertStmt.run(
+      bindParams({
+        id: row.id,
+        url: row.url,
+        name: row.name,
+        attributes: row.attributes,
+        firstSeen: row.firstSeen,
+        lastSeen: row.lastSeen
+      })
+    );
     return id;
   }
   findById(id) {
-    return this.db.prepare("SELECT * FROM source_project WHERE id = :id").get({ id });
+    return getRow(
+      this.db.prepare("SELECT * FROM source_project WHERE id = :id"),
+      {
+        id
+      }
+    );
   }
   // Distinct project names — a filter facet, served from the source_project
   // table, never from the audit fact table.
   distinctNames() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT name FROM source_project
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT name FROM source_project
          WHERE name IS NOT NULL
          ORDER BY name`
-    ).all();
+      )
+    );
     return rows.map((r) => r.name);
   }
 };
@@ -21723,8 +22199,7 @@ function hasLegacySampleRows(db) {
 function purgeSampleData(db) {
   try {
     if (!hasLegacySampleRows(db)) return;
-    db.exec("BEGIN");
-    try {
+    withTransaction(db, () => {
       db.exec(
         `DELETE FROM share_call_site WHERE endpoint_id IN (
            SELECT e.id FROM share_endpoint e
@@ -21769,11 +22244,7 @@ function purgeSampleData(db) {
         value TEXT NOT NULL
       )`);
       db.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'");
-      db.exec("COMMIT");
-    } catch (err) {
-      db.exec("ROLLBACK");
-      throw err;
-    }
+    });
   } catch {
   }
 }
@@ -21792,7 +22263,7 @@ function openWithPragmas(file2) {
 function backupLegacyStore(file2) {
   const backup = `${file2}.legacy.${String(Date.now())}.bak`;
   renameSync(file2, backup);
-  for (const sidecar of [`${file2}-wal`, `${file2}-shm`]) {
+  for (const sidecar of walSidecars(file2)) {
     if (existsSync(sidecar)) rmSync(sidecar);
   }
   return backup;
@@ -21805,9 +22276,8 @@ function openLocalDatabase(dir) {
     db.close();
     const backup = backupLegacyStore(file2);
     db = openWithPragmas(file2);
-    process.stderr.write(
-      `[aka] Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.
-`
+    akaWarn(
+      `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
     );
   }
   applyMigrations(db);
@@ -21835,96 +22305,77 @@ function openLocalDatabase(dir) {
   const configInventory = new SqliteConfigInventoryRepository(db);
   policies.seedDefaults();
   function recordCapture(event, detected) {
-    try {
-      db.exec("BEGIN");
-      try {
-        events.insertEvent(event);
-        const sessionId = event.metadata?.sessionId;
-        findings.insertFindings(detected, sessionId ? { sessionId } : {});
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
-    } catch {
-    }
+    failOpenTransaction(db, () => {
+      events.insertEvent(event);
+      const sessionId = event.metadata?.sessionId;
+      findings.insertFindings(detected, sessionId ? { sessionId } : {});
+    });
   }
   function ensureInventory(ctx) {
     const resolved = {};
-    try {
-      db.exec("BEGIN");
-      try {
-        const now = Date.now();
-        if (ctx.host) resolved.hostId = inventory.upsert(ctx.host, now);
-        if (ctx.harness) {
-          resolved.harnessId = inventory.upsert(linkHost(ctx.harness, resolved.hostId), now);
-        }
-        resolved.accountId = inventory.upsert(
-          linkHost(
-            {
-              objectType: "user",
-              identityKey: "local",
-              attributes: { source: "local" }
-            },
-            resolved.hostId
-          ),
-          now
-        );
-        if (ctx.project) resolved.sourceProjectId = sourceProject.upsert(ctx.project, now);
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
-    } catch {
-      return {};
-    }
-    return resolved;
+    const committed = failOpenTransaction(db, () => {
+      const now = Date.now();
+      if (ctx.host) resolved.hostId = inventory.upsert(ctx.host, now);
+      if (ctx.harness) {
+        resolved.harnessId = inventory.upsert(linkHost(ctx.harness, resolved.hostId), now);
+      }
+      resolved.accountId = inventory.upsert(
+        linkHost(
+          {
+            objectType: "user",
+            identityKey: "local",
+            attributes: { source: "local" }
+          },
+          resolved.hostId
+        ),
+        now
+      );
+      if (ctx.project) resolved.sourceProjectId = sourceProject.upsert(ctx.project, now);
+    });
+    return committed ? resolved : {};
   }
   function recordConfigScan(record2) {
-    try {
-      db.exec("BEGIN");
-      try {
-        const now = isoToEpochMillis(record2.scanEvent.startedAt);
-        for (const item of record2.items) inventory.upsert(item, now);
-        auditEvents.insertAuditEvent(record2.scanEvent);
-        const definitionIds = /* @__PURE__ */ new Map();
-        for (const def of record2.definitions ?? []) {
-          definitionIds.set(`${def.ruleId}@${def.version}`, inspectionDefinitions.upsert(def));
-        }
-        for (const finding of record2.findings ?? []) {
-          const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
-          if (!definitionId) continue;
-          inspectionFindings.insertFinding({
-            id: randomUUID8(),
-            auditEventId: record2.scanEvent.id,
-            inspectionDefinitionId: definitionId,
-            span: finding.span,
-            maskedMatch: finding.maskedMatch,
-            actionTaken: finding.actionTaken,
-            confidence: finding.confidence
-          });
-        }
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
+    failOpenTransaction(db, () => {
+      const now = isoToEpochMillis(record2.scanEvent.startedAt);
+      for (const item of record2.items) inventory.upsert(item, now);
+      auditEvents.insertAuditEvent(record2.scanEvent);
+      const definitionIds = /* @__PURE__ */ new Map();
+      for (const def of record2.definitions ?? []) {
+        definitionIds.set(`${def.ruleId}@${def.version}`, inspectionDefinitions.upsert(def));
+      }
+      for (const finding of record2.findings ?? []) {
+        const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
+        if (!definitionId) continue;
+        inspectionFindings.insertFinding({
+          id: randomUUID8(),
+          auditEventId: record2.scanEvent.id,
+          inspectionDefinitionId: definitionId,
+          span: finding.span,
+          maskedMatch: finding.maskedMatch,
+          actionTaken: finding.actionTaken,
+          confidence: finding.confidence
+        });
       }
-    } catch {
-    }
+    });
   }
   function recordProjectFiles(projectId, scan2) {
     if (scan2.files.length === 0) return;
+    failOpenTransaction(db, () => {
+      projectFiles.replaceForProject(projectId, scan2, Date.now());
+    });
+  }
+  async function transaction(fn) {
+    db.exec("BEGIN");
     try {
-      db.exec("BEGIN");
+      const result = await fn();
+      db.exec("COMMIT");
+      return result;
+    } catch (err) {
       try {
-        projectFiles.replaceForProject(projectId, scan2, Date.now());
-        db.exec("COMMIT");
-      } catch (err) {
         db.exec("ROLLBACK");
-        throw err;
+      } catch {
       }
-    } catch {
+      throw err;
     }
   }
   function reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot) {
@@ -21943,8 +22394,7 @@ function openLocalDatabase(dir) {
         patternWin: `${escapeLikePattern(headPosix.split("/").join("\\"))}\\\\.claude\\\\worktrees\\\\%`
       });
       if (stale.length === 0) return;
-      db.exec("BEGIN");
-      try {
+      withTransaction(db, () => {
         for (const { id } of stale) {
           db.prepare(
             "UPDATE audit_events SET source_project_id = :canonicalId WHERE source_project_id = :id"
@@ -21956,11 +22406,7 @@ function openLocalDatabase(dir) {
           db.prepare("DELETE FROM project_file WHERE project_id = :id").run({ id });
           db.prepare("DELETE FROM source_project WHERE id = :id").run({ id });
         }
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
+      });
     } catch {
     }
   }
@@ -22002,6 +22448,7 @@ function openLocalDatabase(dir) {
     purgeSampleData: () => {
       purgeSampleData(db);
     },
+    transaction,
     close: () => {
       db.close();
     }
@@ -22122,12 +22569,27 @@ function readWorkspaceSettings(base = defaultDataDir()) {
   }
 }
 function readJson(file2) {
+  let text;
   try {
-    const parsed = JSON.parse(readFileSync2(file2, "utf8"));
-    return typeof parsed === "object" && parsed !== null ? parsed : null;
+    text = readFileSync2(file2, "utf8");
   } catch {
     return null;
   }
+  return parseJsonObject(text) ?? null;
+}
+
+// ../../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+var MARKER = "warn-era-capped";
+function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
+  if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
+  const marker = join5(dataDir2, MARKER);
+  if (existsSync2(marker)) return { capped: 0, skipped: "already-run" };
+  const capped = db.policies.capCategoryActions();
+  writeFileSync3(marker, `${new Date(Date.now()).toISOString()}
+`, { mode: DATA_FILE_MODE });
+  return { capped };
 }
 
 // ../../packages/plugin-sdk/src/provider-env.ts
@@ -22212,7 +22674,7 @@ function resolveProviderSafe() {
 // ../../packages/plugin-sdk/src/config-inventory.ts
 import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join6 } from "path";
+import { basename as basename2, join as join7 } from "path";
 
 // ../../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher2 = class {
@@ -24591,8 +25053,8 @@ function scanText(text) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join5, sep as sep2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "fs";
+import { basename, dirname, isAbsolute, join as join6, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -24625,32 +25087,32 @@ function resolveRepoNwo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync2(join5(dir, ".git"))) return dir;
+    if (existsSync3(join6(dir, ".git"))) return dir;
     const parent = dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join5(root, ".git");
+  const dotGit = join6(root, ".git");
   try {
     if (statSync(dotGit).isDirectory()) {
-      return { configPath: join5(dotGit, "config"), headRoot: root };
+      return { configPath: join6(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join5(root, target);
-  if (existsSync2(join5(gitdir, "config"))) {
-    return { configPath: join5(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join6(root, target);
+  if (existsSync3(join6(gitdir, "config"))) {
+    return { configPath: join6(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join5(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join6(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join5(gitdir, commonRaw);
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join6(gitdir, commonRaw);
   const headRoot = basename(commonGitDir) === ".git" ? dirname(commonGitDir) : root;
-  return { configPath: join5(commonGitDir, "config"), headRoot };
+  return { configPath: join6(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
@@ -24767,16 +25229,57 @@ function resolveInventoryContext(input) {
 }
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { basename as basename3, join as join8, relative, sep as sep3 } from "path";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { basename as basename3, join as join9, relative, sep as sep3 } from "path";
+
+// ../../packages/plugin-sdk/src/raw-egress.ts
+var RawEgressError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RawEgressError";
+  }
+};
+var MIN_RAW_LEN = 4;
+function maskContextSlice(slice, sliceStart, hits) {
+  const findings = [];
+  for (const h of hits) {
+    const start = Math.max(0, h.span.start - sliceStart);
+    const end = Math.min(slice.length, h.span.end - sliceStart);
+    if (end > start) {
+      findings.push({
+        ruleId: "raw-egress",
+        category: "secret",
+        severity: "critical",
+        span: { start, end },
+        rawMatch: "",
+        confidence: 1
+      });
+    }
+  }
+  const masked = findings.length > 0 ? redact(slice, findings) : slice;
+  for (const h of hits) {
+    if (h.rawMatch.length >= MIN_RAW_LEN && masked.includes(h.rawMatch)) {
+      throw new RawEgressError("raw match survived context masking");
+    }
+  }
+  return masked;
+}
+function safeMaskedMatch(rawMatch) {
+  const masked = maskMatch(rawMatch);
+  if (masked === rawMatch || rawMatch.length >= MIN_RAW_LEN && masked.includes(rawMatch)) {
+    return "***";
+  }
+  return masked;
+}
 
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
+var ENFORCEMENT_CEILING_ENABLED = false;
 var ACTION_PRIORITY = ["block", "redact", "warn", "log", "allow"];
 function entryIsActive(entry, now) {
   if (entry.expiresAt !== null && Date.parse(entry.expiresAt) <= now) return false;
@@ -24857,7 +25360,7 @@ function createPluginRuntime(gateway, settings, opts) {
       const action = actionFor(finding);
       if (ACTION_PRIORITY.indexOf(action) < ACTION_PRIORITY.indexOf(worst)) worst = action;
     }
-    if (policyMode === "warn" && (worst === "block" || worst === "redact")) {
+    if (ENFORCEMENT_CEILING_ENABLED && policyMode === "warn" && (worst === "block" || worst === "redact")) {
       return { action: "warn", text, findings };
     }
     if (worst === "block") return { action: "block", text: null, findings };
@@ -24879,7 +25382,7 @@ function createPluginRuntime(gateway, settings, opts) {
     const excepted = /* @__PURE__ */ new Set();
     const exceptionIds = [];
     try {
-      if (policyMode === "warn") return { excepted, exceptionIds };
+      if (ENFORCEMENT_CEILING_ENABLED && policyMode === "warn") return { excepted, exceptionIds };
       const enforced = findings.filter((f) => {
         const action = resolveAction(f.ruleId, f.category);
         return action === "block" || action === "redact";
@@ -25050,9 +25553,12 @@ function createPluginRuntime(gateway, settings, opts) {
   return { processText, capture, rulesetFingerprint, close };
 }
 
+// ../../packages/plugin-sdk/src/suppressions.ts
+var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
 
 // ../../packages/plugin-runtime/src/standalone-gateway.ts
 import { randomUUID as randomUUID11 } from "crypto";
@@ -25245,6 +25751,14 @@ var StandaloneDataGateway = class {
   sweepTerminalExceptions(retentionMs) {
     return this.db.exceptions.sweepTerminal(retentionMs);
   }
+  // The warn-era enforcement cap, standalone-only store maintenance invoked
+  // from SessionStart, not part of the DataGateway port. Returns the number
+  // of block/redact rows capped to warn (0 for a redact-policy store or an
+  // already-capped one).
+  capWarnEraEnforcement(policyMode) {
+    const { capped } = capWarnEraEnforcementOnce(this.db, policyMode, this.dataDir);
+    return { capped };
+  }
   // One project-file scan → the local project_file tree (one transaction inside
   // the LocalDatabase, fail-open there). Like the sweep above, this is
   // NOT part of the DataGateway port: the file tree is a local-store read model.
@@ -25344,9 +25858,9 @@ var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 // src/history/transcripts.ts
 import { readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function transcriptsDir() {
-  return join10(homedir3(), ".claude", "projects");
+  return join11(homedir3(), ".claude", "projects");
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null;
@@ -25362,7 +25876,7 @@ function extractText(content) {
   }
   return parts.join("\n");
 }
-function parseTranscript(jsonl, sinceMs = 0) {
+function parseTranscript(jsonl, sinceMs = 0, beforeMs = Infinity) {
   const out = [];
   for (const line of jsonl.split("\n")) {
     const trimmed = line.trim();
@@ -25380,6 +25894,7 @@ function parseTranscript(jsonl, sinceMs = 0) {
     const occurredMs = Date.parse(occurredAt);
     if (Number.isNaN(occurredMs)) continue;
     if (sinceMs > 0 && occurredMs < sinceMs) continue;
+    if (occurredMs >= beforeMs) continue;
     const message = rec.message;
     if (!isRecord(message)) continue;
     const text = extractText(message.content);
@@ -25585,7 +26100,7 @@ function parseTranscriptToolCalls(jsonl, sinceMs = 0) {
   return out;
 }
 var DAY_MS5 = 24 * 60 * 60 * 1e3;
-function* iterateFileContents(dir) {
+function* iterateFileContents(dir, excludeSessionId) {
   let projects;
   try {
     projects = readdirSync3(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -25593,7 +26108,7 @@ function* iterateFileContents(dir) {
     return;
   }
   for (const project of projects) {
-    const projectDir = join10(dir, project);
+    const projectDir = join11(dir, project);
     let files;
     try {
       files = readdirSync3(projectDir).filter((name) => name.endsWith(".jsonl"));
@@ -25601,9 +26116,11 @@ function* iterateFileContents(dir) {
       continue;
     }
     for (const file2 of files) {
+      if (excludeSessionId !== void 0 && file2.slice(0, -".jsonl".length) === excludeSessionId)
+        continue;
       let content;
       try {
-        content = readFileSync7(join10(projectDir, file2), "utf8");
+        content = readFileSync7(join11(projectDir, file2), "utf8");
       } catch {
         continue;
       }
@@ -25617,8 +26134,9 @@ function windowStartMs(opts) {
 }
 function* iterateHistory(opts = {}) {
   const sinceMs = windowStartMs(opts);
-  for (const content of iterateFileContents(opts.dir ?? transcriptsDir()))
-    yield* parseTranscript(content, sinceMs);
+  const beforeMs = opts.beforeMs ?? Infinity;
+  for (const content of iterateFileContents(opts.dir ?? transcriptsDir(), opts.excludeSessionId))
+    yield* parseTranscript(content, sinceMs, beforeMs);
 }
 function* iterateUsageAndToolCalls(opts = {}) {
   const sinceMs = windowStartMs(opts);
@@ -25631,7 +26149,35 @@ function* iterateUsageAndToolCalls(opts = {}) {
 }
 
 // src/history/scan.ts
-async function scanHistory(config2, opts = {}) {
+var CONTEXT_RADIUS = 120;
+function redactOverlapping(rawContext, contextStart, others) {
+  if (others.length === 0) return rawContext;
+  try {
+    return maskContextSlice(rawContext, contextStart, others);
+  } catch {
+    let safe = rawContext;
+    for (const other of others) {
+      if (other.rawMatch.length > 0) safe = safe.split(other.rawMatch).join("[REDACTED]");
+    }
+    return safe;
+  }
+}
+function buildTriageHit(text, f, otherFindings = []) {
+  const start = Math.max(0, f.span.start - CONTEXT_RADIUS);
+  const end = Math.min(text.length, f.span.end + CONTEXT_RADIUS);
+  const rawContext = text.slice(start, end);
+  const overlapping = otherFindings.filter((o) => o.span.start < end && o.span.end > start);
+  return {
+    ruleId: f.ruleId,
+    category: f.category,
+    severity: f.severity,
+    maskedMatch: safeMaskedMatch(f.rawMatch),
+    rawMatch: f.rawMatch,
+    context: redactOverlapping(rawContext, start, overlapping),
+    confidence: f.confidence
+  };
+}
+async function scanHistory(config2, opts = {}, onHit) {
   const windowDays = opts.windowDays ?? 30;
   if (config2.settings.historicalAccess !== "full") {
     return { consented: false, scanned: 0, skipped: 0, findings: 0, bySeverity: {}, windowDays };
@@ -25667,6 +26213,14 @@ async function scanHistory(config2, opts = {}) {
       for (const finding of result.findings) {
         findings++;
         bySeverity[finding.severity] = (bySeverity[finding.severity] ?? 0) + 1;
+        if (onHit) {
+          const otherFindings = result.findings.filter((other) => other !== finding);
+          const hit = buildTriageHit(message.text, finding, otherFindings);
+          try {
+            onHit(hit);
+          } catch {
+          }
+        }
       }
     }
   } finally {
@@ -25684,9 +26238,9 @@ import {
   openSync,
   readFileSync as readFileSync8,
   readSync,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
 // src/history/usage.ts
 var NO_PROJECT_CWD = "/nonexistent/aka-reconciler/no-project";
@@ -25929,25 +26483,113 @@ function fenced(body) {
 }
 
 // src/backfill.ts
-try {
-  const cfg = loadConfig();
-  if (cfg.settings.historicalAccess !== "full") {
-    process.stdout.write("Historical scan skipped \u2014 full review was not granted.\n");
-    process.exit(0);
-  }
-  const summary = await scanHistory(cfg);
+function triageSentinel(count, status) {
+  return JSON.stringify({ done: true, count, status }) + "\n";
+}
+async function runBackfill(deps) {
+  const { triage, io } = deps;
   try {
-    await reconcileHistory(cfg);
-  } catch {
-  }
-  const heading = "\u2713 Historical scan complete";
-  const scope = `Scanned ${String(summary.scanned)} messages from the last ${String(summary.windowDays)} days of Claude Code history.`;
-  const result = summary.findings > 0 ? `Found ${String(summary.findings)} pre-install finding${summary.findings === 1 ? "" : "s"} \u2014 review them with /findings.` : "No new pre-install secrets found in your history.";
-  process.stdout.write(`${fenced([heading, "", indent(scope), "", indent(result)].join("\n"))}
+    const cfg = deps.loadConfig();
+    if (cfg.settings.historicalAccess !== "full") {
+      if (triage) {
+        io.stdout(triageSentinel(0, "skipped:no-consent"));
+      } else {
+        io.stdout("Historical scan skipped \u2014 full review was not granted.\n");
+      }
+      return;
+    }
+    let fpKey = null;
+    if (triage) {
+      try {
+        fpKey = loadOrCreateFingerprintKey(cfg.dataDir);
+      } catch {
+        fpKey = null;
+      }
+    }
+    let count = 0;
+    let onHitError;
+    const summary = await deps.scanHistory(
+      cfg,
+      deps.guard ?? {},
+      triage ? (hit) => {
+        if (onHitError !== void 0) return;
+        try {
+          const enriched = {
+            ...hit,
+            id: String(count),
+            valueFingerprint: fpKey ? fingerprintValue(fpKey, hit.rawMatch) : void 0,
+            keyVersion: fpKey?.version
+          };
+          const validated = TriageHit.safeParse(enriched);
+          if (!validated.success) {
+            throw new Error("enriched triage hit failed TriageHit validation");
+          }
+          io.stdout(JSON.stringify(validated.data) + "\n");
+          count += 1;
+        } catch (err) {
+          onHitError = err;
+        }
+      } : void 0
+    );
+    if (onHitError !== void 0) {
+      throw onHitError instanceof Error ? onHitError : new Error(typeof onHitError === "string" ? onHitError : "triage stream write failed");
+    }
+    try {
+      await deps.reconcileHistory(cfg);
+    } catch {
+    }
+    if (triage) {
+      io.stdout(triageSentinel(count, "complete"));
+    } else {
+      const heading = "\u2713 Historical scan complete";
+      const scope = `Scanned ${String(summary.scanned)} messages from the last ${String(summary.windowDays)} days of Claude Code history.`;
+      const result = summary.findings > 0 ? `Found ${String(summary.findings)} pre-install finding${summary.findings === 1 ? "" : "s"} \u2014 review them with /findings.` : "No new pre-install secrets found in your history.";
+      io.stdout(`${fenced([heading, "", indent(scope), "", indent(result)].join("\n"))}
 `);
-} catch {
-  process.stdout.write(
-    "AKA could not scan your history right now. It will still protect everything from here on.\n"
-  );
+    }
+  } catch (err) {
+    if (triage) {
+      io.stderr(`aka backfill --triage: history scan failed: ${String(err)}
+`);
+      io.fail();
+    } else {
+      io.stdout(
+        "AKA could not scan your history right now. It will still protect everything from here on.\n"
+      );
+    }
+  }
 }
-process.exit(0);
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  const triage = process.argv.includes("--triage");
+  const startedAt = Date.now();
+  const sessionId = process.env.CLAUDE_CODE_BRIDGE_SESSION_ID;
+  await runBackfill({
+    triage,
+    io: {
+      stdout: (chunk) => process.stdout.write(chunk),
+      stderr: (chunk) => process.stderr.write(chunk),
+      fail: () => {
+        process.exitCode = 1;
+      }
+    },
+    loadConfig,
+    scanHistory,
+    reconcileHistory,
+    guard: {
+      beforeMs: startedAt,
+      ...sessionId ? { excludeSessionId: sessionId } : {}
+    }
+  });
+  if (process.stdout.writableLength > 0) {
+    await new Promise((resolve) => {
+      process.stdout.write("", () => {
+        resolve();
+      });
+    });
+  }
+  process.exit(process.exitCode ?? 0);
+}
+export {
+  runBackfill,
+  triageSentinel
+};