@akasecurity/ai-tc-claude-code 0.8.1 → 0.9.0-rc1

package/scripts/backfill.js

@@ -491,6 +491,9 @@ var require_ignore = __commonJS({
   }
 });
 
+// src/backfill.ts
+import { fileURLToPath } from "url";
+
 // ../../packages/persistence/src/database.ts
 import { randomUUID as randomUUID8 } from "crypto";
 import { existsSync, renameSync, rmSync } from "fs";
@@ -538,6 +541,10 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0009_findings_path_expression_index",
     sql: "-- Custom migration: partial expression index for the resolver's per-path reads.\n--\n-- openAtRestKeysForPath / resolvedAtRestKeysForPath (and the scanner's tier-3\n-- open-key probe) filter at-rest events by\n--   e.kind = 'code_change' AND json_extract(e.metadata, '$.filePath') = :path\n-- once per changed/deleted file on every scan \u2014 previously a full events scan\n-- per file. json_extract is deterministic, so SQLite allows it in an index;\n-- the WHERE kind = 'code_change' keeps the index to exactly the rows those\n-- queries can match (in-flight events are never path-addressed).\nCREATE INDEX `idx_events_code_change_path` ON `events` (json_extract(`metadata`, '$.filePath')) WHERE `kind` = 'code_change';\n"
+  },
+  {
+    tag: "0010_events_session_expression_index",
+    sql: "-- Custom migration: partial expression index for session-scoped finding reads.\n--\n-- sessionFindingsCount, the session-scoped listGroupedFindings paths, and the\n-- insert-time session dedup all filter live-capture events by\n--   json_extract(e.metadata, '$.sessionId') = :sessionId\n-- \u2014 previously a full findings-join scan with a JSON parse per row. The\n-- IS NOT NULL predicate keeps the index to session-stamped events only (an\n-- equality probe implies non-null, so SQLite still uses it).\nCREATE INDEX `idx_events_session_id` ON `events` (json_extract(`metadata`, '$.sessionId')) WHERE json_extract(`metadata`, '$.sessionId') IS NOT NULL;\n"
   }
 ];
 
@@ -640,6 +647,12 @@ var defaultCostModel = {
   }
 };
 
+// ../../packages/schema/src/token/format.ts
+var COMPACT = new Intl.NumberFormat("en-US", {
+  notation: "compact",
+  maximumFractionDigits: 1
+});
+
 // ../../packages/schema/src/token/token-report.ts
 var num = (value) => value ?? 0;
 function costUsageOf(a) {
@@ -15311,6 +15324,12 @@ var FindingInstance = external_exports.object({
   provider: FindingProvider,
   repo: external_exports.string(),
   file: external_exports.string(),
+  // Host tool that produced the scanned text (event metadata's toolName).
+  // Present whenever the capturing hook recorded one — including
+  // file-attributed captures (views prefer `file`); its display value is
+  // the location fallback ("via Bash") when no filePath exists. Absent for
+  // legacy rows and non-tool captures (prompts, worktree scans).
+  toolName: external_exports.string().optional(),
   // Effective action: override.action ?? actionTaken, translated to FindingAction.
   action: FindingAction,
   detectedAt: external_exports.iso.datetime(),
@@ -15367,6 +15386,9 @@ var ListGroupedFindingsQuery = external_exports.object({
   provider: external_exports.array(FindingProvider).optional(),
   action: external_exports.array(FindingAction).optional(),
   q: external_exports.string().optional(),
+  // Scope to findings whose event carries this session id (the Activity page's
+  // session → findings drilldown). Findings without a session never match.
+  sessionId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -15378,7 +15400,13 @@ var ListGroupedFindingsResponse = external_exports.object({
   }),
   facets: FindingFacets,
   items: external_exports.array(FindingGroup),
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  // Present only on session-scoped queries (`sessionId` set): per ruleId, how
+  // many times that rule fired in the session's persisted transcript. Findings
+  // here are deduplicated to unique values while the transcript tally counts
+  // every firing, so the two numbers legitimately differ — this map lets a
+  // session-scoped view show both.
+  sessionFirings: external_exports.record(external_exports.string(), external_exports.number().int().nonnegative()).optional()
 }).meta({ id: "ListGroupedFindingsResponse" });
 var ApplyFindingActionRequest = external_exports.object({
   // 'quarantined' is system-assigned (see FindingAction) — clients may not set
@@ -15430,6 +15458,11 @@ var AuditEventType = external_exports.enum([
   "prompt",
   "response",
   "code_change",
+  // The events.kind of a scanned tool call, widened in to keep this a
+  // superset. Narrower than 'tool_call' above and not a duplicate of it:
+  // 'tool_call' is the reconciler's structural row for every call, while
+  // 'tool_use' exists only where a hook enforced against the arguments.
+  "tool_use",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
@@ -15784,6 +15817,10 @@ var ListActivitySessionsQuery = external_exports.object({
   from: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
   /** Upper bound on startedAt; omitted defaults to now. */
   to: external_exports.union([external_exports.iso.date(), external_exports.iso.datetime()]).optional(),
+  /** Exclude zero-activity sessions — roots whose only recorded children are
+   * bookkeeping rows (hooks, config scans), typically background `claude`
+   * launches. Omitted = list everything. `z.stringbool()` per the note above. */
+  excludeEmpty: external_exports.stringbool().optional(),
   /** Page size, 1–100; out-of-range values are a 400. `z.coerce` — query params arrive as strings. */
   limit: external_exports.coerce.number().int().min(1).max(100).default(50),
   /** Opaque pagination cursor (most-recent first). */
@@ -15792,7 +15829,11 @@ var ListActivitySessionsQuery = external_exports.object({
 var ListActivitySessionsResponse = external_exports.object({
   items: external_exports.array(ActivitySessionSummary),
   /** `null` once the last page is reached. */
-  nextCursor: external_exports.string().nullable()
+  nextCursor: external_exports.string().nullable(),
+  /** Zero-activity sessions matching the query's filters/range (whether or
+   * not `excludeEmpty` dropped them from `items`) — the count a UI toggle
+   * shows when collapsing them. */
+  emptyCount: external_exports.number().int().nonnegative()
 }).meta({ id: "ListActivitySessionsResponse" });
 var ListSessionEventsQuery = external_exports.object({
   /** Default 100, range 1–500. */
@@ -15821,12 +15862,18 @@ var ActivityOverviewResponse = external_exports.object({
 }).meta({ id: "ActivityOverviewResponse" });
 
 // ../../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change"]).meta({ id: "EventKind" });
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
   filePath: external_exports.string().optional(),
+  // The host tool whose input/output was scanned (e.g. 'Bash', 'WebFetch'),
+  // set by the tool-scanning hooks. The tool NAME only — never the tool's
+  // arguments or output, which can carry the very value a finding masked
+  // (metadata is stored unredacted). Gives findings on non-file captures a
+  // display location ("via Bash") when no filePath exists.
+  toolName: external_exports.string().optional(),
   // Set (true) by the worktree scanner when the file is excluded by the
   // repo's .gitignore. Gitignored files ARE still scanned — local scratch and
   // generated code can leak real secrets — but the provenance is recorded so
@@ -16134,7 +16181,7 @@ var DetectionException = external_exports.object({
   justification: external_exports.string().min(1),
   conditions: ExceptionConditions.nullable(),
   createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api"]),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
   createdAt: external_exports.iso.datetime(),
   updatedAt: external_exports.iso.datetime(),
   // Revocation is terminal and retained — consumed/expired/revoked rows are
@@ -16158,7 +16205,10 @@ var ExceptionBundleEntry = DetectionException.pick({
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
 var KeywordMatcher = external_exports.object({
   type: external_exports.literal("keyword"),
-  keywords: external_exports.array(external_exports.string()).min(1),
+  // An empty keyword matches at every position, yielding one zero-length span
+  // per character. Rejected here because a keyword that matches everything is
+  // never intentional.
+  keywords: external_exports.array(external_exports.string().min(1)).min(1),
   caseSensitive: external_exports.boolean().default(false)
 });
 function isValidRegex(pattern, flags) {
@@ -16303,20 +16353,26 @@ var PolicyBundle = external_exports.object({
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
-var DEFAULT_ACTIONS = {
-  secret: "block",
-  pii: "redact",
-  financial: "redact",
-  phi: "redact",
-  code_context: "warn",
-  code_flaw: "warn",
-  custom: "warn",
-  // Config-posture findings only observe today (they land in
-  // inspection_findings, outside the live-capture enforcement path).
-  config: "warn"
-};
 var OBSERVE_ONLY_CATEGORIES = ["config"];
 var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
 var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
 var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
 var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
@@ -16343,6 +16399,12 @@ var BUILTIN_POLICY_SPECS = {
     description: "Refuse the request entirely whenever any rule in this detection matches."
   }
 };
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
 var BUILTIN_POLICIES = Object.fromEntries(
   KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
 );
@@ -16395,6 +16457,10 @@ var ListEventsResponse = external_exports.object({
   items: external_exports.array(Event),
   nextCursor: external_exports.string().nullable()
 }).meta({ id: "ListEventsResponse" });
+var IngestResponse = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+}).meta({ id: "IngestResponse" });
 var ListFindingsQuery = external_exports.object({
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(LIST_QUERY_MAX_LIMIT).default(50),
@@ -16749,10 +16815,8 @@ function toApiProvider(sourceTool) {
   return TOOL_TO_HARNESS[sourceTool] ?? "api";
 }
 var STATUS_PRECEDENCE = ["open", "handled", "dismissed", "resolved"];
-function deriveGroupStatus(instances) {
-  const statuses = new Set(
-    instances.map((i) => i.status).filter((s) => s !== void 0)
-  );
+function foldGroupStatus(instanceStatuses) {
+  const statuses = new Set(instanceStatuses.filter((s) => s !== void 0));
   if (statuses.size === 0) return void 0;
   for (const candidate of STATUS_PRECEDENCE) {
     if (statuses.has(candidate)) return candidate;
@@ -16770,6 +16834,7 @@ function deriveFindingStatus(row) {
 function buildFindingGroups(rows, opts = {}) {
   const overrides = opts.overrides;
   const packNames = opts.packNames;
+  const aggregates = opts.aggregates;
   const byRuleId = /* @__PURE__ */ new Map();
   for (const row of rows) {
     const existing = byRuleId.get(row.ruleId);
@@ -16785,23 +16850,27 @@ function buildFindingGroups(rows, opts = {}) {
         provider: toApiProvider(r.sourceTool),
         repo: r.repo,
         file: r.file,
+        ...r.toolName === void 0 ? {} : { toolName: r.toolName },
         action: toApiAction(effectiveDbAction),
         detectedAt: r.occurredAt,
         confidence: r.confidence,
         status: r.status
       };
     });
-    const latestDetectedAt = ruleRows.reduce(
+    const agg = aggregates?.get(ruleId);
+    const latestDetectedAt = agg?.latestDetectedAt ?? ruleRows.reduce(
       (max, r) => r.occurredAt > max ? r.occurredAt : max,
       ruleRows[0]?.occurredAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
     );
     const seenProviders = /* @__PURE__ */ new Set();
-    const providers = instances.map((i) => i.provider).filter((p) => {
+    const providers = (agg ? [...new Set(agg.sourceTools.map(toApiProvider))].sort() : instances.map((i) => i.provider)).filter((p) => {
       if (seenProviders.has(p)) return false;
       seenProviders.add(p);
       return true;
     });
-    const actionSet = new Set(instances.map((i) => i.action));
+    const actionSet = new Set(
+      agg ? agg.actionsTaken.map(toApiAction) : instances.map((i) => i.action)
+    );
     const aggregateAction = actionSet.size === 1 ? [...actionSet][0] ?? null : null;
     const severity = ruleRows[0]?.severity ?? "low";
     const detection = {
@@ -16815,8 +16884,10 @@ function buildFindingGroups(rows, opts = {}) {
       contextPrefix: ""
       // empty (pending privacy review)
     };
-    const status = deriveGroupStatus(instances);
-    groups.push({
+    const status = foldGroupStatus(
+      agg ? agg.statusInputs.map(deriveFindingStatus) : instances.map((i) => i.status)
+    );
+    const group = {
       id: ruleId,
       category: apiCategory,
       subtype: ruleId,
@@ -16825,21 +16896,26 @@ function buildFindingGroups(rows, opts = {}) {
       match,
       detection,
       policy,
-      instanceCount: instances.length,
+      instanceCount: agg?.instanceCount ?? instances.length,
       providers,
       aggregateAction,
       latestDetectedAt,
       instances,
       status
-    });
+    };
+    if (agg) {
+      actionsCache.set(group, [...actionSet]);
+      if (agg.searchText !== void 0) {
+        haystackCache.set(group, buildHaystack(group, agg.searchText));
+      }
+    }
+    groups.push(group);
   }
   return groups;
 }
 var haystackCache = /* @__PURE__ */ new WeakMap();
-function groupHaystack(g) {
-  const cached2 = haystackCache.get(g);
-  if (cached2 !== void 0) return cached2;
-  const haystack = [
+function buildHaystack(g, extra) {
+  return [
     g.subtype,
     g.category,
     g.match.maskedValue,
@@ -16847,11 +16923,26 @@ function groupHaystack(g) {
     g.id,
     ...g.instances.map((i) => i.repo),
     ...g.instances.map((i) => i.file),
-    ...g.instances.map((i) => i.id)
+    ...g.instances.map((i) => i.toolName ? `via ${i.toolName}` : ""),
+    ...g.instances.map((i) => i.id),
+    ...extra === void 0 ? [] : [extra]
   ].join(" ").toLowerCase();
+}
+function groupHaystack(g) {
+  const cached2 = haystackCache.get(g);
+  if (cached2 !== void 0) return cached2;
+  const haystack = buildHaystack(g);
   haystackCache.set(g, haystack);
   return haystack;
 }
+var actionsCache = /* @__PURE__ */ new WeakMap();
+function groupActions(g) {
+  const cached2 = actionsCache.get(g);
+  if (cached2 !== void 0) return cached2;
+  const actions = [...new Set(g.instances.map((i) => i.action))];
+  actionsCache.set(g, actions);
+  return actions;
+}
 function applyFindingFilters(groups, opts) {
   let filtered = groups;
   if (opts.severity && opts.severity.length > 0) {
@@ -16864,7 +16955,7 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.actions && opts.actions.length > 0) {
     const actionSet = new Set(opts.actions);
-    filtered = filtered.filter((g) => g.instances.some((i) => actionSet.has(i.action)));
+    filtered = filtered.filter((g) => groupActions(g).some((a) => actionSet.has(a)));
   }
   if (opts.subtype && opts.subtype.length > 0) {
     const subtypeSet = new Set(opts.subtype);
@@ -16916,8 +17007,7 @@ function computeFindingFacets(allGroups, opts) {
   });
   const actionMap = /* @__PURE__ */ new Map();
   for (const g of forAction) {
-    const actionSet = new Set(g.instances.map((i) => i.action));
-    for (const a of actionSet) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
+    for (const a of groupActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
   }
   const forSubtype = applyFindingFilters(allGroups, {
     providers: opts.providers,
@@ -17100,6 +17190,71 @@ var ProjectFilesScan = external_exports.object({
   scannedAt: external_exports.string()
 });
 
+// ../../packages/schema/src/zod/ranges.ts
+var TIME_RANGES = ["7d", "30d", "3m", "6m"];
+var TimeRange = external_exports.enum(TIME_RANGES).meta({ id: "TimeRange" });
+var DEFAULT_TIME_RANGE = "7d";
+var RANGE_DAYS = {
+  "7d": 7,
+  "30d": 30,
+  "3m": 90,
+  "6m": 180
+};
+var TIME_RANGE_OR_DEFAULT = TimeRange.catch(DEFAULT_TIME_RANGE);
+
+// ../../packages/schema/src/zod/remediation.ts
+var SecretFindingState = external_exports.enum(["still-valid", "unknown", "invalid"]);
+var MaskedFindingLocation = external_exports.object({
+  filePath: external_exports.string(),
+  span: Span.optional()
+}).strict();
+var MaskedSecretFinding = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  where: MaskedFindingLocation,
+  state: SecretFindingState,
+  observedAt: external_exports.iso.datetime().optional()
+}).strict();
+var RotationChecklistEntry = external_exports.object({
+  provider: external_exports.string(),
+  maskedToken: external_exports.string(),
+  consolePath: external_exports.string(),
+  occurrenceSpread: external_exports.number().int().positive()
+}).strict();
+var RemediationOption = external_exports.enum([
+  "redact-rotation-checklist",
+  "redact-only",
+  "set-secret-redact",
+  "leave"
+]);
+var RemediationEntrySource = external_exports.enum(["first-run", "pre-push", "secret-scan"]);
+var RemediationEntryContext = external_exports.object({
+  entrySource: RemediationEntrySource
+}).strict();
+var RemediationOptionChoice = external_exports.object({
+  id: RemediationOption,
+  label: external_exports.string()
+});
+var BatchedRemediationDecision = external_exports.object({
+  kind: external_exports.literal("decision"),
+  entrySource: RemediationEntrySource,
+  secretCount: external_exports.number().int().positive(),
+  prompt: external_exports.string(),
+  options: external_exports.tuple([
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-rotation-checklist") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("redact-only") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("set-secret-redact") }),
+    RemediationOptionChoice.extend({ id: external_exports.literal("leave") })
+  ])
+});
+var NoRemediationDecision = external_exports.object({
+  kind: external_exports.literal("no-decision")
+});
+var BatchedRemediation = external_exports.discriminatedUnion("kind", [
+  BatchedRemediationDecision,
+  NoRemediationDecision
+]);
+
 // ../../packages/schema/src/zod/rule-test.ts
 var TestRulesRequest = external_exports.object({
   rules: external_exports.array(Rule).min(1).max(100),
@@ -17158,10 +17313,8 @@ var SeveritySummaryResponse = external_exports.object({
   // All four severity levels are always present (count may be 0).
   bySeverity: external_exports.array(SeveritySummaryItem)
 }).meta({ id: "SeveritySummaryResponse" });
-var SECURITY_RANGES = ["7d", "30d", "3m", "6m"];
-var SecurityRange = external_exports.enum(SECURITY_RANGES).meta({ id: "SecurityRange" });
 var SecurityRangeQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d")
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE)
 });
 var EnforcementActionKind = external_exports.enum(["blocked", "redacted", "warned"]).meta({ id: "EnforcementActionKind" });
 var EnforcementAction = external_exports.object({
@@ -17171,7 +17324,7 @@ var EnforcementAction = external_exports.object({
   delta: external_exports.number().int()
 }).meta({ id: "EnforcementAction" });
 var EnforcementActionsResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   // Sum of actions[].count in the window.
   total: external_exports.number().int().nonnegative(),
   // One entry per kind, always all three present (count may be 0).
@@ -17186,7 +17339,7 @@ var FindingsTimeseriesPoint = external_exports.object({
   medium: external_exports.number().int().nonnegative()
 }).meta({ id: "FindingsTimeseriesPoint" });
 var FindingsTimeseriesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(FindingsTimeseriesPoint)
 }).meta({ id: "FindingsTimeseriesResponse" });
@@ -17201,7 +17354,7 @@ var MttrTrendPoint = external_exports.object({
   })
 }).meta({ id: "MttrTrendPoint" });
 var MttrTrendResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   granularity: TimeseriesGranularity,
   points: external_exports.array(MttrTrendPoint)
 }).meta({ id: "MttrTrendResponse" });
@@ -17228,11 +17381,11 @@ var TopSource = external_exports.object({
   findingsCount: external_exports.number().int().nonnegative()
 }).meta({ id: "TopSource" });
 var TopSourcesResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   items: external_exports.array(TopSource)
 }).meta({ id: "TopSourcesResponse" });
 var TopSourcesQuery = external_exports.object({
-  range: external_exports.enum(SECURITY_RANGES).default("30d"),
+  range: external_exports.enum(TIME_RANGES).default(DEFAULT_TIME_RANGE),
   limit: external_exports.coerce.number().int().min(1).max(50).default(5),
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
@@ -17245,7 +17398,7 @@ var ScanCoverageProvider = external_exports.object({
   supported: external_exports.boolean()
 }).meta({ id: "ScanCoverageProvider" });
 var ScanCoverageResponse = external_exports.object({
-  range: SecurityRange,
+  range: TimeRange,
   providers: external_exports.array(ScanCoverageProvider)
 }).meta({ id: "ScanCoverageResponse" });
 var SubjectType = external_exports.enum(["repo", "user", "team", "policy", "share", "rule"]).meta({
@@ -17294,6 +17447,114 @@ var ApplyRecommendedActionResponse = external_exports.object({
 var DismissRecommendedActionResponse = external_exports.object({ id: external_exports.string(), status: external_exports.literal("dismissed") }).meta({ id: "DismissRecommendedActionResponse" });
 var RecommendedActionIdParam = external_exports.object({ id: external_exports.string() });
 
+// ../../packages/schema/src/zod/triage.ts
+var TriageHit = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  maskedMatch: external_exports.string(),
+  rawMatch: external_exports.string(),
+  context: external_exports.string(),
+  filePath: external_exports.string().optional(),
+  confidence: external_exports.number().min(0).max(1),
+  id: external_exports.string().optional(),
+  valueFingerprint: external_exports.string().optional(),
+  keyVersion: external_exports.number().int().nonnegative().optional()
+});
+var TriagePolicy = BuiltinPolicyId;
+var TriageCategoryRec = external_exports.object({
+  category: DetectionCategory,
+  action: TriagePolicy,
+  reasoning: external_exports.string(),
+  genuineCount: external_exports.number().int().nonnegative(),
+  fpCount: external_exports.number().int().nonnegative(),
+  // TriageHit ids judged false-positive in this category. fpCount must equal
+  // this array's length — enforced by the consumer, not this schema.
+  fpIds: external_exports.array(external_exports.string())
+});
+var TriageRecommendation = external_exports.object({
+  perCategory: external_exports.array(TriageCategoryRec),
+  notes: external_exports.string()
+});
+
+// ../../packages/schema/src/zod/setup-frame.ts
+var CalibrationCounts = external_exports.object({
+  total: external_exports.number().int().nonnegative(),
+  important: external_exports.number().int().nonnegative(),
+  routine: external_exports.number().int().nonnegative()
+}).refine((c) => c.total === c.important + c.routine, {
+  message: "total must equal important + routine",
+  path: ["total"]
+});
+var FalsePositivePatternValue = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  valueFingerprint: external_exports.string(),
+  keyVersion: external_exports.number().int().nonnegative()
+});
+var FalsePositivePatternGroup = external_exports.object({
+  pattern: external_exports.string(),
+  count: external_exports.number().int().nonnegative(),
+  values: external_exports.array(FalsePositivePatternValue).min(1)
+});
+var CalibrationFindingKind = external_exports.object({
+  category: DetectionCategory,
+  count: external_exports.number().int().nonnegative(),
+  egress: external_exports.boolean()
+});
+var CalibrationFrame = external_exports.object({
+  counts: CalibrationCounts,
+  routineCategories: external_exports.array(DetectionCategory),
+  surfacedCategories: external_exports.array(DetectionCategory),
+  findingKinds: external_exports.array(CalibrationFindingKind),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId),
+  maskedFindings: external_exports.array(MaskedSecretFinding).optional(),
+  falsePositivePatterns: external_exports.array(FalsePositivePatternGroup).optional()
+});
+var CalibrationPreviewCategory = TriageCategoryRec.pick({
+  category: true,
+  genuineCount: true,
+  fpCount: true
+}).extend({
+  egress: external_exports.boolean()
+});
+var CalibrationPreview = external_exports.object({
+  categories: external_exports.array(CalibrationPreviewCategory),
+  posture: external_exports.record(DetectionCategory, BuiltinPolicyId)
+});
+var CalibrationResult = external_exports.object({
+  frame: CalibrationFrame,
+  copy: external_exports.string()
+});
+var FirstRunCalibration = external_exports.enum(["scan", "floor"]);
+var SetupHandoffOption = external_exports.object({
+  id: external_exports.enum(["enter-remediation", "open-dashboard", "not-now"]),
+  label: external_exports.string()
+});
+var DashboardHandoffOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var ComposedRemediationOptions = external_exports.tuple([
+  SetupHandoffOption.extend({ id: external_exports.literal("enter-remediation") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("open-dashboard") }),
+  SetupHandoffOption.extend({ id: external_exports.literal("not-now") })
+]);
+var SetupHandoffOffer = external_exports.object({
+  worthALook: external_exports.number().int().nonnegative(),
+  liveKeys: external_exports.number().int().nonnegative().optional(),
+  options: external_exports.union([DashboardHandoffOptions, ComposedRemediationOptions])
+}).refine(
+  (o) => o.options.some((opt) => opt.id === "enter-remediation") === (o.liveKeys ?? 0) > 0,
+  {
+    message: "the chain-entry option is present exactly when liveKeys > 0",
+    path: ["options"]
+  }
+).refine((o) => (o.liveKeys ?? 0) <= o.worthALook, {
+  message: "liveKeys is a subset of worthALook and cannot exceed it",
+  path: ["liveKeys"]
+});
+
 // ../../packages/schema/src/zod/shares.ts
 var DestinationKind = external_exports.enum(["provider", "internal", "ip"]).meta({ id: "DestinationKind" });
 var Transport = external_exports.enum(["https", "http", "sftp", "grpc", "smtp"]).meta({ id: "Transport" });
@@ -17479,6 +17740,102 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
+// ../../packages/persistence/src/internal/sql-text.ts
+function escapeLikePattern(s) {
+  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+}
+function placeholders(n) {
+  return Array.from({ length: n }, () => "?").join(", ");
+}
+function containsPattern(q) {
+  return `%${escapeLikePattern(q)}%`;
+}
+function likeAny(exprs) {
+  return `(${exprs.map((e) => `${e} LIKE ? ESCAPE '\\'`).join(" OR ")})`;
+}
+
+// ../../packages/persistence/src/internal/transactions.ts
+var savepointSeq = 0;
+function withTransaction(db, fn, mode = "DEFERRED") {
+  if (db.isTransaction) {
+    const savepoint = `aka_sp_${String(savepointSeq += 1)}`;
+    db.exec(`SAVEPOINT ${savepoint}`);
+    try {
+      fn();
+      db.exec(`RELEASE ${savepoint}`);
+    } catch (error51) {
+      try {
+        db.exec(`ROLLBACK TO ${savepoint}`);
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {
+      }
+      throw error51;
+    }
+    return;
+  }
+  db.exec(mode === "IMMEDIATE" ? "BEGIN IMMEDIATE" : "BEGIN");
+  try {
+    fn();
+    db.exec("COMMIT");
+  } catch (error51) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+    }
+    throw error51;
+  }
+}
+function failOpenTransaction(db, fn, mode = "DEFERRED") {
+  const nested = db.isTransaction;
+  try {
+    withTransaction(db, fn, mode);
+    return true;
+  } catch (error51) {
+    if (!db.isTransaction && nested) throw error51;
+    return false;
+  }
+}
+
+// ../../packages/persistence/src/internal/warn.ts
+function akaWarn(message) {
+  process.stderr.write(`[aka] ${message}
+`);
+}
+
+// ../../packages/persistence/src/db/migrations/introspection.ts
+function evidenceObjects(sql) {
+  const objects = [];
+  for (const m of sql.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g)) {
+    if (m[1] !== void 0 && !m[1].startsWith("__new_")) {
+      objects.push({ kind: "table", name: m[1] });
+    }
+  }
+  for (const m of sql.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g)) {
+    if (m[1] !== void 0 && m[2] !== void 0) {
+      objects.push({ kind: "column", table: m[1], name: m[2] });
+    }
+  }
+  return objects;
+}
+function schemaObjectExists(db, kind, name) {
+  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = ? AND name = ? LIMIT 1").get(kind, name);
+  return row !== void 0;
+}
+function indexExists(db, name) {
+  return schemaObjectExists(db, "index", name);
+}
+function columnNames(db, table, opts) {
+  const pragma = opts?.includeGenerated ? "table_xinfo" : "table_info";
+  const columns = db.prepare(`PRAGMA ${pragma}(${table})`).all();
+  return columns.map((c) => c.name);
+}
+function evidenceExists(db, object2) {
+  if (object2.kind === "column") {
+    return columnNames(db, object2.table, { includeGenerated: true }).includes(object2.name);
+  }
+  return schemaObjectExists(db, "table", object2.name);
+}
+
 // ../../packages/persistence/src/ids.ts
 import { createHash } from "crypto";
 function sha256Hex(input) {
@@ -17515,28 +17872,6 @@ function inspectionFindingId(auditEventId, definitionId, spanStart, spanEnd) {
 }
 
 // ../../packages/persistence/src/migrations.ts
-function evidenceObjects(sql) {
-  const objects = [];
-  for (const m of sql.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g)) {
-    if (m[1] !== void 0 && !m[1].startsWith("__new_")) {
-      objects.push({ kind: "table", name: m[1] });
-    }
-  }
-  for (const m of sql.matchAll(/ALTER TABLE `([^`]+)` ADD (?:COLUMN )?`([^`]+)`/g)) {
-    if (m[1] !== void 0 && m[2] !== void 0) {
-      objects.push({ kind: "column", table: m[1], name: m[2] });
-    }
-  }
-  return objects;
-}
-function evidenceExists(db, object2) {
-  if (object2.kind === "column") {
-    const columns = db.prepare(`PRAGMA table_xinfo(${object2.table})`).all();
-    return columns.some((c) => c.name === object2.name);
-  }
-  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ? LIMIT 1").get(object2.name);
-  return row !== void 0;
-}
 function describeObject(object2) {
   return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
 }
@@ -17547,10 +17882,6 @@ function createdIndexName(statement) {
   const body = statement.replace(/^(?:\s*--[^\n]*\n?)+/, "").trimStart();
   return /^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(body)?.[1];
 }
-function indexExists(db, name) {
-  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'index' AND name = ? LIMIT 1").get(name);
-  return row !== void 0;
-}
 function applyMigrations(db) {
   const legacyCount = db.prepare("PRAGMA user_version").get().user_version;
   db.exec(
@@ -17569,44 +17900,39 @@ function applyMigrations(db) {
     const present = evidence.filter((o) => evidenceExists(db, o));
     if (present.length > 0 && present.length < evidence.length) {
       const missing = evidence.filter((o) => !present.includes(o));
-      const message = `[aka] sqlite migration ${migration.tag} has no ledger row, but the store already has ${present.map(describeObject).join(", ")} while missing ${missing.map(describeObject).join(", ")} \u2014 the schema diverged from the migration history; refusing to replay or skip.`;
-      process.stderr.write(`${message}
-`);
-      throw new Error(message);
+      const message = `sqlite migration ${migration.tag} has no ledger row, but the store already has ${present.map(describeObject).join(", ")} while missing ${missing.map(describeObject).join(", ")} \u2014 the schema diverged from the migration history; refusing to replay or skip.`;
+      akaWarn(message);
+      throw new Error(`[aka] ${message}`);
     }
     const alreadyApplied = evidence.length > 0 ? present.length === evidence.length : preLedgerStore && index < legacyCount;
     const wantsFkOff = /PRAGMA foreign_keys\s*=\s*OFF/i.test(migration.sql);
     const statements = splitStatements(migration.sql);
     if (wantsFkOff) db.exec("PRAGMA foreign_keys = OFF");
     try {
-      db.exec("BEGIN IMMEDIATE");
-      try {
-        for (const statement of statements) {
-          const indexName = createdIndexName(statement);
-          if (indexName === void 0) {
-            if (alreadyApplied) continue;
-          } else if (indexExists(db, indexName)) {
-            continue;
+      withTransaction(
+        db,
+        () => {
+          for (const statement of statements) {
+            const indexName = createdIndexName(statement);
+            if (indexName === void 0) {
+              if (alreadyApplied) continue;
+            } else if (indexExists(db, indexName)) {
+              continue;
+            }
+            db.exec(statement);
           }
-          db.exec(statement);
-        }
-        if (wantsFkOff && !alreadyApplied) {
-          const violations = db.prepare("PRAGMA foreign_key_check").all();
-          if (violations.length > 0) {
-            throw new Error(
-              `[aka] sqlite migration ${migration.tag} left ${String(violations.length)} foreign-key violation(s); rolling back.`
-            );
+          if (wantsFkOff && !alreadyApplied) {
+            const violations = db.prepare("PRAGMA foreign_key_check").all();
+            if (violations.length > 0) {
+              throw new Error(
+                `[aka] sqlite migration ${migration.tag} left ${String(violations.length)} foreign-key violation(s); rolling back.`
+              );
+            }
           }
-        }
-        record2.run(migration.tag, Date.now());
-        db.exec("COMMIT");
-      } catch (error51) {
-        try {
-          db.exec("ROLLBACK");
-        } catch {
-        }
-        throw error51;
-      }
+          record2.run(migration.tag, Date.now());
+        },
+        "IMMEDIATE"
+      );
     } finally {
       if (wantsFkOff) db.exec("PRAGMA foreign_keys = ON");
     }
@@ -17649,8 +17975,7 @@ var TOKEN_USAGE_COLUMNS = [
   }
 ];
 function ensureTokenUsageColumns(db) {
-  const columns = db.prepare("PRAGMA table_xinfo(audit_events)").all();
-  const existing = new Set(columns.map((c) => c.name));
+  const existing = new Set(columnNames(db, "audit_events", { includeGenerated: true }));
   for (const column of TOKEN_USAGE_COLUMNS) {
     if (!existing.has(column.name)) {
       db.exec(column.ddl);
@@ -17688,47 +18013,39 @@ function reconcileSourceProjectIds(db) {
       repoint: db.prepare(`UPDATE ${table} SET project_id = ? WHERE project_id = ?`)
     }));
     const deleteLegacy = db.prepare("DELETE FROM source_project WHERE id = ?");
-    db.exec("BEGIN IMMEDIATE");
-    try {
-      for (const { row, canonicalId } of legacy) {
-        foldProject.run(
-          canonicalId,
-          row.url,
-          row.name,
-          row.attributes,
-          row.firstSeen,
-          row.lastSeen
-        );
-        repointAudit.run(canonicalId, row.id);
-        for (const { dropCollisions, repoint } of pathTables) {
-          dropCollisions.run(row.id, canonicalId);
-          repoint.run(canonicalId, row.id);
+    withTransaction(
+      db,
+      () => {
+        for (const { row, canonicalId } of legacy) {
+          foldProject.run(
+            canonicalId,
+            row.url,
+            row.name,
+            row.attributes,
+            row.firstSeen,
+            row.lastSeen
+          );
+          repointAudit.run(canonicalId, row.id);
+          for (const { dropCollisions, repoint } of pathTables) {
+            dropCollisions.run(row.id, canonicalId);
+            repoint.run(canonicalId, row.id);
+          }
+          repointCallSite.run(canonicalId, row.id);
+          deleteLegacy.run(row.id);
         }
-        repointCallSite.run(canonicalId, row.id);
-        deleteLegacy.run(row.id);
-      }
-      db.exec("COMMIT");
-    } catch (error51) {
-      try {
-        db.exec("ROLLBACK");
-      } catch {
-      }
-      throw error51;
-    }
+      },
+      "IMMEDIATE"
+    );
   } catch (error51) {
-    process.stderr.write(`[aka] source_project id reconcile failed: ${String(error51)}
-`);
+    akaWarn(`source_project id reconcile failed: ${String(error51)}`);
   }
 }
 function isForeignSqliteLineage(db) {
-  const tenantsTable = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'tenants' LIMIT 1").get();
-  if (tenantsTable !== void 0) return true;
-  const eventsColumns = db.prepare("PRAGMA table_info(events)").all();
-  return eventsColumns.some((c) => c.name === "tenant_id");
+  if (schemaObjectExists(db, "table", "tenants")) return true;
+  return columnNames(db, "events").includes("tenant_id");
 }
 function ensureSyncedAtColumn(db, table) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (!columns.some((c) => c.name === "synced_at")) {
+  if (!columnNames(db, table).includes("synced_at")) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN synced_at integer`);
   }
 }
@@ -17779,8 +18096,11 @@ function ensureDataDirSync(dir) {
   } catch {
   }
 }
+function walSidecars(file2) {
+  return [`${file2}-wal`, `${file2}-shm`];
+}
 function tightenPerms(file2) {
-  for (const path of [file2, `${file2}-wal`, `${file2}-shm`]) {
+  for (const path of [file2, ...walSidecars(file2)]) {
     try {
       chmodSync(path, DATA_FILE_MODE);
     } catch {
@@ -17788,12 +18108,68 @@ function tightenPerms(file2) {
   }
 }
 
-// ../../packages/persistence/src/repositories/sql-utils.ts
-function escapeLikePattern(s) {
-  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+// ../../packages/persistence/src/internal/json.ts
+function safeJson(s, fallback) {
+  if (s == null) return fallback;
+  try {
+    return JSON.parse(s);
+  } catch {
+    return fallback;
+  }
 }
-function placeholders(n) {
-  return Array.from({ length: n }, () => "?").join(", ");
+function parseJsonObject(s) {
+  if (s == null) return void 0;
+  try {
+    const parsed = JSON.parse(s);
+    if (typeof parsed === "object" && parsed !== null) return parsed;
+  } catch {
+  }
+  return void 0;
+}
+
+// ../../packages/persistence/src/internal/rows.ts
+function allRows(stmt, params) {
+  if (params === void 0) return stmt.all();
+  if (Array.isArray(params)) return stmt.all(...params);
+  return stmt.all(params);
+}
+function getRow(stmt, params) {
+  if (params === void 0) return stmt.get();
+  if (Array.isArray(params)) return stmt.get(...params);
+  return stmt.get(params);
+}
+function intToBool(raw) {
+  return raw === 1 || raw === true;
+}
+function boolToInt(b) {
+  return b ? 1 : 0;
+}
+function bindParams(row) {
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    out[key] = value === void 0 ? null : value;
+  }
+  return out;
+}
+function countScalar(db, sql, params) {
+  return getRow(db.prepare(sql), params)?.n ?? 0;
+}
+function countBy(db, sql, params) {
+  const map2 = /* @__PURE__ */ new Map();
+  for (const row of allRows(db.prepare(sql), params)) {
+    map2.set(row.k, row.n);
+  }
+  return map2;
+}
+function mapRowsTolerant(rows, map2) {
+  const out = [];
+  for (const row of rows) {
+    try {
+      out.push(map2(row));
+    } catch {
+    }
+  }
+  return out;
 }
 
 // ../../packages/persistence/src/repositories/activity.ts
@@ -17845,15 +18221,11 @@ function encodeCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeCursor(cursor) {
-  try {
-    const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
-    if (parsed !== null && typeof parsed === "object" && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
-      return parsed;
-    }
-    return null;
-  } catch {
-    return null;
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
+    return parsed;
   }
+  return null;
 }
 var DB_EVENT_TYPE_TO_KIND = {
   session: "session",
@@ -17870,15 +18242,8 @@ var DB_EVENT_TYPE_TO_KIND = {
 };
 function safeParseStringArray(raw) {
   if (!raw) return [];
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
-}
-function toBool(raw) {
-  return raw === 1 || raw === true;
+  const parsed = safeJson(raw, null);
+  return Array.isArray(parsed) ? parsed : [];
 }
 function toHarness(raw) {
   const parsed = Harness.safeParse(raw);
@@ -17931,8 +18296,8 @@ function buildAuditEvent(row) {
     severity: severityParsed?.success ? severityParsed.data : null,
     link: linkParsed?.success ? linkParsed.data : null,
     targetId: row.target_id,
-    internal: toBool(row.internal),
-    flagged: toBool(row.flagged)
+    internal: intToBool(row.internal),
+    flagged: intToBool(row.flagged)
   };
 }
 var TIMELINE_COLUMNS = `
@@ -17948,6 +18313,10 @@ var TIMELINE_COLUMNS = `
   json_extract(attributes, '$.internal') AS internal,
   json_extract(attributes, '$.flagged') AS flagged`;
 var SESSION_ROOT = `event_type = 'session'`;
+var HAS_ACTIVITY = `EXISTS (
+  SELECT 1 FROM audit_events c
+  WHERE c.root_session_id = audit_events.id
+    AND c.event_type NOT IN ('hook', 'config_scan'))`;
 var SqliteActivityRepository = class {
   constructor(db, now = () => Date.now()) {
     this.db = db;
@@ -17958,12 +18327,16 @@ var SqliteActivityRepository = class {
   stats(tz) {
     const window = todayWindow(tz ?? defaultTimeZone(), this.now());
     const { startMs, endMs } = window;
-    const sessionsToday = this.db.prepare(
+    const sessionsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE ${SESSION_ROOT} AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
+           WHERE ${SESSION_ROOT} AND started_at >= ? AND started_at < ?
+             AND ${HAS_ACTIVITY}`,
+      [startMs, endMs]
+    );
     const liveThreshold = this.now() - LIVE_ACTIVITY_WINDOW_MS;
-    const liveNow = this.db.prepare(
+    const liveNow = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events s
            WHERE s.event_type = 'session' AND s.ended_at IS NULL
              AND max(
@@ -17972,22 +18345,29 @@ var SqliteActivityRepository = class {
                  (SELECT max(${LAST_ACTIVITY_EXPR}) FROM audit_events e WHERE e.root_session_id = s.id),
                  s.started_at
                )
-             ) >= ?`
-    ).get(liveThreshold).n;
-    const toolCallsToday = this.db.prepare(
+             ) >= ?`,
+      [liveThreshold]
+    );
+    const toolCallsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE event_type = 'tool_call' AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
-    const findingsToday = this.db.prepare(
+           WHERE event_type = 'tool_call' AND started_at >= ? AND started_at < ?`,
+      [startMs, endMs]
+    );
+    const findingsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM inspection_findings f
            JOIN audit_events e ON e.id = f.audit_event_id
-           WHERE e.started_at >= ? AND e.started_at < ?`
-    ).get(startMs, endMs).n;
-    const egressToday = this.db.prepare(
+           WHERE e.started_at >= ? AND e.started_at < ?`,
+      [startMs, endMs]
+    );
+    const egressToday = countScalar(
+      this.db,
       `SELECT count(DISTINCT json_extract(attributes, '$.destination')) AS n
            FROM audit_events
-           WHERE event_type = 'share' AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
+           WHERE event_type = 'share' AND started_at >= ? AND started_at < ?`,
+      [startMs, endMs]
+    );
     return Promise.resolve({ sessionsToday, liveNow, toolCallsToday, findingsToday, egressToday });
   }
   listSessions(query) {
@@ -18009,7 +18389,7 @@ var SqliteActivityRepository = class {
     conditions.push("started_at <= ?");
     params.push(toMs);
     if (query.q) {
-      const pattern = `%${escapeLikePattern(query.q)}%`;
+      const pattern = containsPattern(query.q);
       conditions.push(
         `(content LIKE ? ESCAPE '\\'
           OR json_extract(attributes, '$.project') LIKE ? ESCAPE '\\'
@@ -18023,13 +18403,21 @@ var SqliteActivityRepository = class {
       );
       params.push(pattern, pattern, pattern, pattern, pattern, pattern);
     }
+    const emptyCount = countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM audit_events
+        WHERE ${[...conditions, `NOT ${HAS_ACTIVITY}`].join(" AND ")}`,
+      params
+    );
+    if (query.excludeEmpty) conditions.push(HAS_ACTIVITY);
     if (cursor) {
       conditions.push("(started_at < ? OR (started_at = ? AND id < ?))");
       params.push(cursor.startedAtMs, cursor.startedAtMs, cursor.id);
     }
     const limit = query.limit;
-    const rows = this.db.prepare(
-      `SELECT id,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id,
                 json_extract(attributes, '$.harness') AS harness,
                 content AS title,
                 json_extract(attributes, '$.project') AS project,
@@ -18042,7 +18430,9 @@ var SqliteActivityRepository = class {
          WHERE ${conditions.join(" AND ")}
          ORDER BY started_at DESC, id DESC
          LIMIT ?`
-    ).all(...params, limit + 1);
+      ),
+      [...params, limit + 1]
+    );
     const hasMore = rows.length > limit;
     const page = hasMore ? rows.slice(0, limit) : rows;
     const rollups = this.rollupsFor(page.map((r) => r.id));
@@ -18056,11 +18446,12 @@ var SqliteActivityRepository = class {
     );
     const last = page[page.length - 1];
     const nextCursor = hasMore && last ? encodeCursor({ startedAtMs: last.started_at, id: last.id }) : null;
-    return Promise.resolve({ items, nextCursor });
+    return Promise.resolve({ items, nextCursor, emptyCount });
   }
   getSession(sessionId) {
-    const rootRow = this.db.prepare(
-      `SELECT id,
+    const rootRow = getRow(
+      this.db.prepare(
+        `SELECT id,
                 json_extract(attributes, '$.harness') AS harness,
                 content AS title,
                 json_extract(attributes, '$.project') AS project,
@@ -18077,47 +18468,66 @@ var SqliteActivityRepository = class {
          FROM audit_events
          WHERE id = ? AND event_type = 'session'
          LIMIT 1`
-    ).get(sessionId);
+      ),
+      [sessionId]
+    );
     if (!rootRow) return Promise.resolve(null);
-    const timelineRows = this.db.prepare(
-      `SELECT ${TIMELINE_COLUMNS}
+    const timelineRows = allRows(
+      this.db.prepare(
+        `SELECT ${TIMELINE_COLUMNS}
          FROM audit_events
          WHERE id = ? OR root_session_id = ?
          ORDER BY started_at ASC, id ASC`
-    ).all(sessionId, sessionId);
+      ),
+      [sessionId, sessionId]
+    );
     const events = timelineRows.map(buildAuditEvent).filter((e) => e !== null);
-    const tokenRow = this.db.prepare(
-      `SELECT
+    const tokenRow = getRow(
+      this.db.prepare(
+        `SELECT
            coalesce(sum(input_tokens), 0) AS input,
            coalesce(sum(output_tokens), 0) AS output,
            coalesce(sum(cache_creation_input_tokens), 0) AS cache_creation,
            coalesce(sum(cache_read_input_tokens), 0) AS cache_read
          FROM audit_events
          WHERE root_session_id = ? AND event_type = 'llm_call'`
-    ).get(sessionId);
-    const primaryModel = this.db.prepare(
-      `SELECT model, provider FROM audit_events
-         WHERE root_session_id = ? AND event_type = 'llm_call'
+      ),
+      [sessionId]
+    ) ?? { input: 0, output: 0, cache_creation: 0, cache_read: 0 };
+    const primaryModel = getRow(
+      this.db.prepare(
+        `SELECT model, provider FROM audit_events
+         WHERE root_session_id = ? AND event_type = 'llm_call'
          ORDER BY started_at ASC, id ASC
          LIMIT 1`
-    ).get(sessionId);
-    const toolRows = this.db.prepare(
-      `SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
+      ),
+      [sessionId]
+    );
+    const toolRows = allRows(
+      this.db.prepare(
+        `SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
                 count(*) AS n
          FROM audit_events
          WHERE root_session_id = ? AND event_type = 'tool_call'
          GROUP BY coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool'))`
-    ).all(sessionId);
-    const modelRows = this.db.prepare(
-      `SELECT DISTINCT model FROM audit_events
+      ),
+      [sessionId]
+    );
+    const modelRows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT model FROM audit_events
          WHERE root_session_id = ? AND event_type = 'llm_call' AND model IS NOT NULL AND model <> ''
          ORDER BY model`
-    ).all(sessionId);
+      ),
+      [sessionId]
+    );
     const derivedModels = modelRows.map((r) => r.model);
-    const commits = this.db.prepare(
+    const commits = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE root_session_id = ? AND event_type = 'commit'`
-    ).get(sessionId).n;
+           WHERE root_session_id = ? AND event_type = 'commit'`,
+      [sessionId]
+    );
     const rollup = this.rollupsFor([sessionId]).get(sessionId) ?? {
       turns: 0,
       findings: 0,
@@ -18184,7 +18594,10 @@ var SqliteActivityRepository = class {
       `SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), 'claudecode') AS harness
          FROM audit_events WHERE ${SESSION_ROOT}${where}`
     );
-    const rows = fromMs === void 0 ? stmt.all() : stmt.all(fromMs);
+    const rows = allRows(
+      stmt,
+      fromMs === void 0 ? void 0 : [fromMs]
+    );
     const seen = /* @__PURE__ */ new Set();
     for (const row of rows) seen.add(toHarness(row.harness));
     return Promise.resolve([...seen]);
@@ -18207,23 +18620,23 @@ var SqliteActivityRepository = class {
       conditions.push("started_at >= ?");
       params.push(opts.fromMs);
     }
-    const rows = this.db.prepare(
-      `SELECT root_session_id AS sessionId, attributes
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS sessionId, attributes
            FROM audit_events
           WHERE ${conditions.join(" AND ")}`
-    ).all(...params);
-    const leaves = [];
-    for (const row of rows) {
-      if (row.sessionId === null) continue;
-      try {
-        leaves.push({
-          sessionId: row.sessionId,
-          attributes: JSON.parse(row.attributes)
-        });
-      } catch {
-      }
-    }
-    return leaves;
+      ),
+      params
+    );
+    return mapRowsTolerant(
+      rows.filter(
+        (row) => row.sessionId !== null
+      ),
+      (row) => ({
+        sessionId: row.sessionId,
+        attributes: JSON.parse(row.attributes)
+      })
+    );
   }
   /**
    * Per-session turns/findings/shares + last-activity for a page of session ids,
@@ -18237,57 +18650,72 @@ var SqliteActivityRepository = class {
     );
     if (sessionIds.length === 0) return result;
     const inClause = placeholders(sessionIds.length);
-    const lastActivityRows = this.db.prepare(
-      `SELECT root_session_id AS id, max(${LAST_ACTIVITY_EXPR}) AS m FROM audit_events
+    const lastActivityRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id, max(${LAST_ACTIVITY_EXPR}) AS m FROM audit_events
          WHERE root_session_id IN (${inClause})
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of lastActivityRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry && row.m !== null) entry.lastActivityMs = row.m;
     }
-    const turnsRows = this.db.prepare(
-      `SELECT root_session_id AS id, count(*) AS n FROM audit_events
+    const turnsRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id, count(*) AS n FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'prompt'
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of turnsRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.turns = row.n;
     }
-    const runKeyRows = this.db.prepare(
-      `SELECT root_session_id AS id,
+    const runKeyRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id,
                 count(DISTINCT json_extract(attributes, '$.run_key')) AS n
          FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'llm_call'
            AND json_extract(attributes, '$.run_key') IS NOT NULL
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of runKeyRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.turns = Math.max(entry.turns, row.n);
     }
-    const findingsRows = this.db.prepare(
-      `SELECT e.root_session_id AS id, count(*) AS n FROM inspection_findings f
+    const findingsRows = allRows(
+      this.db.prepare(
+        `SELECT e.root_session_id AS id, count(*) AS n FROM inspection_findings f
          JOIN audit_events e ON e.id = f.audit_event_id
          WHERE e.root_session_id IN (${inClause})
          GROUP BY e.root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of findingsRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.findings = row.n;
     }
-    const sharesRows = this.db.prepare(
-      `SELECT root_session_id AS id,
+    const sharesRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id,
                 count(DISTINCT json_extract(attributes, '$.destination')) AS n
          FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'share'
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of sharesRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
@@ -18337,33 +18765,28 @@ var SqliteAuditEventsRepository = class {
   // the caller fails open and drops the whole pass — recovered idempotently on the
   // next pass. Nesting-safe is NOT needed: the reconciler is the sole caller.
   runInTransaction(fn) {
-    this.db.exec("BEGIN");
-    try {
-      fn();
-      this.db.exec("COMMIT");
-    } catch (err) {
-      this.db.exec("ROLLBACK");
-      throw err;
-    }
+    withTransaction(this.db, fn);
   }
   insertAuditEvent(input) {
     const row = toAuditEventRow(input);
-    this.insertStmt.run({
-      id: row.id,
-      parentId: row.parentId ?? null,
-      rootSessionId: row.rootSessionId ?? null,
-      eventType: row.eventType,
-      hostId: row.hostId ?? null,
-      harnessId: row.harnessId ?? null,
-      sourceProjectId: row.sourceProjectId ?? null,
-      startedAt: row.startedAt,
-      endedAt: row.endedAt ?? null,
-      severity: row.severity ?? null,
-      priority: row.priority ?? null,
-      content: row.content ?? null,
-      contentHash: row.contentHash ?? null,
-      attributes: row.attributes ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        parentId: row.parentId,
+        rootSessionId: row.rootSessionId,
+        eventType: row.eventType,
+        hostId: row.hostId,
+        harnessId: row.harnessId,
+        sourceProjectId: row.sourceProjectId,
+        startedAt: row.startedAt,
+        endedAt: row.endedAt,
+        severity: row.severity,
+        priority: row.priority,
+        content: row.content,
+        contentHash: row.contentHash,
+        attributes: row.attributes
+      })
+    );
   }
   // Insert one transcript-derived `llm_call` leaf. Unlike `insertAuditEvent`
   // (which takes a caller-supplied random id), the id here is MINTED internally
@@ -18377,22 +18800,24 @@ var SqliteAuditEventsRepository = class {
     const startedAt = isoToEpochMillis(input.startedAt);
     if (!Number.isFinite(startedAt)) return;
     const id = llmCallId(input.sessionId, input.messageId);
-    this.upsertLlmCallStmt.run({
-      id,
-      parentId: input.parentId,
-      rootSessionId: input.rootSessionId,
-      eventType: "llm_call",
-      hostId: null,
-      harnessId: null,
-      sourceProjectId: null,
-      startedAt,
-      endedAt: null,
-      severity: null,
-      priority: null,
-      content: null,
-      contentHash: null,
-      attributes: JSON.stringify(input.attributes)
-    });
+    this.upsertLlmCallStmt.run(
+      bindParams({
+        id,
+        parentId: input.parentId,
+        rootSessionId: input.rootSessionId,
+        eventType: "llm_call",
+        hostId: null,
+        harnessId: null,
+        sourceProjectId: null,
+        startedAt,
+        endedAt: null,
+        severity: null,
+        priority: null,
+        content: null,
+        contentHash: null,
+        attributes: JSON.stringify(input.attributes)
+      })
+    );
   }
   // Insert one transcript-derived `tool_call` leaf. Like `insertLlmCall` the id is
   // MINTED internally from the natural key — `toolCallId(sessionId, toolUseId)` —
@@ -18416,25 +18841,29 @@ var SqliteAuditEventsRepository = class {
     const startedAt = isoToEpochMillis(input.startedAt);
     if (!Number.isFinite(startedAt)) return;
     const id = toolCallId(input.sessionId, input.toolUseId);
-    this.insertStmt.run({
-      id,
-      parentId: input.parentId,
-      rootSessionId: input.rootSessionId,
-      eventType: "tool_call",
-      hostId: null,
-      harnessId: null,
-      sourceProjectId: null,
-      startedAt,
-      endedAt: null,
-      severity: null,
-      priority: null,
-      content: null,
-      contentHash: null,
-      attributes: JSON.stringify(input.attributes)
-    });
+    this.insertStmt.run(
+      bindParams({
+        id,
+        parentId: input.parentId,
+        rootSessionId: input.rootSessionId,
+        eventType: "tool_call",
+        hostId: null,
+        harnessId: null,
+        sourceProjectId: null,
+        startedAt,
+        endedAt: null,
+        severity: null,
+        priority: null,
+        content: null,
+        contentHash: null,
+        attributes: JSON.stringify(input.attributes)
+      })
+    );
   }
   findById(id) {
-    return this.db.prepare("SELECT * FROM audit_events WHERE id = :id").get({ id });
+    return getRow(this.db.prepare("SELECT * FROM audit_events WHERE id = :id"), {
+      id
+    });
   }
   // Read the `provider` snapshotted onto a session root's attributes.
   // The reconciler ensures the root, then reads provider back from it — SessionStart's
@@ -18444,14 +18873,8 @@ var SqliteAuditEventsRepository = class {
   sessionProvider(sessionId) {
     const row = this.findById(sessionId);
     if (!row?.attributes) return void 0;
-    try {
-      const parsed = JSON.parse(row.attributes);
-      if (typeof parsed === "object" && parsed !== null) {
-        const provider = parsed.provider;
-        if (typeof provider === "string") return provider;
-      }
-    } catch {
-    }
+    const provider = parseJsonObject(row.attributes)?.provider;
+    if (typeof provider === "string") return provider;
     return void 0;
   }
   // Every `llm_call` leaf's session id + raw attribute bag, for the read-time token
@@ -18460,11 +18883,13 @@ var SqliteAuditEventsRepository = class {
   // is the leaf's session (the reconciler sets parent_id = root_session_id = sessionId);
   // rows whose attributes blob is NULL are skipped (nothing to roll up).
   llmCallLeaves() {
-    return this.db.prepare(
-      `SELECT root_session_id AS sessionId, attributes
+    return allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS sessionId, attributes
            FROM audit_events
           WHERE event_type = 'llm_call' AND attributes IS NOT NULL`
-    ).all();
+      )
+    );
   }
 };
 
@@ -18483,16 +18908,29 @@ var SqliteClassifiedDataRepository = class {
   upsert(input) {
     const id = classifiedDataId(input.class);
     const row = toClassifiedDataRow(input, id);
-    this.insertStmt.run({
-      id: row.id,
-      class: row.class,
-      label: row.label ?? null,
-      attributes: row.attributes ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        class: row.class,
+        label: row.label,
+        attributes: row.attributes
+      })
+    );
     return id;
   }
 };
 
+// ../../packages/persistence/src/repositories/config-scan.ts
+function latestConfigScan(db) {
+  return getRow(
+    db.prepare(
+      `SELECT id, started_at, attributes FROM audit_events
+          WHERE event_type = 'config_scan'
+          ORDER BY started_at DESC, id DESC LIMIT 1`
+    )
+  );
+}
+
 // ../../packages/persistence/src/repositories/config-inventory.ts
 var SqliteConfigInventoryRepository = class {
   constructor(db) {
@@ -18500,7 +18938,7 @@ var SqliteConfigInventoryRepository = class {
   }
   db;
   report() {
-    const scan2 = this.latestScan();
+    const scan2 = latestConfigScan(this.db);
     if (!scan2) {
       return {
         scannedAt: null,
@@ -18511,17 +18949,23 @@ var SqliteConfigInventoryRepository = class {
         topics: []
       };
     }
-    const rows = this.db.prepare(
-      `SELECT id, object_type AS objectType, title, location, attributes FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, object_type AS objectType, title, location, attributes FROM inventory
           WHERE object_type IN ('skill', 'hook', 'mcp_server', 'config_file') AND last_seen >= :startedAt
           ORDER BY object_type, title`
-    ).all({ startedAt: scan2.started_at });
-    const findings = this.db.prepare(
-      `SELECT f.masked_match AS maskedMatch, d.rule_id AS ruleId, d.name AS name
+      ),
+      { startedAt: scan2.started_at }
+    );
+    const findings = allRows(
+      this.db.prepare(
+        `SELECT f.masked_match AS maskedMatch, d.rule_id AS ruleId, d.name AS name
            FROM inspection_findings f
            JOIN inspection_definitions d ON d.id = f.inspection_definition_id
           WHERE f.audit_event_id = :scanId`
-    ).all({ scanId: scan2.id });
+      ),
+      { scanId: scan2.id }
+    );
     const skills = [];
     const hooks = [];
     const mcpServers = [];
@@ -18550,7 +18994,9 @@ var SqliteConfigInventoryRepository = class {
   // schema note); an override whose asset is gone simply never matches. A row
   // with an out-of-vocabulary trust value is ignored rather than guessed at.
   trustOverrides() {
-    const rows = this.db.prepare("SELECT asset_id AS assetId, trust FROM mcp_trust_override").all();
+    const rows = allRows(
+      this.db.prepare("SELECT asset_id AS assetId, trust FROM mcp_trust_override")
+    );
     const map2 = /* @__PURE__ */ new Map();
     for (const row of rows) {
       if (row.trust === "known-good" || row.trust === "risky" || row.trust === "unapproved") {
@@ -18559,13 +19005,6 @@ var SqliteConfigInventoryRepository = class {
     }
     return map2;
   }
-  latestScan() {
-    return this.db.prepare(
-      `SELECT id, started_at, attributes FROM audit_events
-          WHERE event_type = 'config_scan'
-          ORDER BY started_at DESC, id DESC LIMIT 1`
-    ).get();
-  }
 };
 function toSkillItem(row, bag) {
   const item = {
@@ -18676,22 +19115,11 @@ function buildTopics(skills, hooks, mcpServers, configFiles, scanAttributes) {
   return topics;
 }
 function countScanErrors(attributes) {
-  if (!attributes) return 0;
-  try {
-    const parsed = JSON.parse(attributes);
-    const errors = parsed?.errors;
-    return typeof errors === "number" ? errors : 0;
-  } catch {
-    return 0;
-  }
+  const errors = parseJsonObject(attributes)?.errors;
+  return typeof errors === "number" ? errors : 0;
 }
 function parseBag(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null) return parsed;
-  } catch {
-  }
-  return void 0;
+  return parseJsonObject(raw);
 }
 function str(value) {
   return typeof value === "string" ? value : void 0;
@@ -18700,12 +19128,7 @@ function str(value) {
 // ../../packages/persistence/src/repositories/detections.ts
 var DAY_MS2 = 864e5;
 function parseRules(rulesJson) {
-  let raw;
-  try {
-    raw = JSON.parse(rulesJson);
-  } catch {
-    return [];
-  }
+  const raw = safeJson(rulesJson, []);
   if (!Array.isArray(raw)) return [];
   const rules = [];
   for (const entry of raw) {
@@ -18724,11 +19147,13 @@ var SqliteDetectionsRepository = class {
   db;
   now;
   listDetections(query) {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
                 rules_json AS rulesJson
          FROM installed_packs`
-    ).all();
+      )
+    );
     const available = this.availableByPack();
     const summaries = rows.map((r) => {
       const latest = available.get(`${r.namespace}/${r.packId}`);
@@ -18737,7 +19162,7 @@ var SqliteDetectionsRepository = class {
         packId: r.packId,
         version: r.version,
         name: r.name,
-        enabled: r.enabled === 1,
+        enabled: intToBool(r.enabled),
         // Count rules in JS via the tolerant parse rather than SQL json_array_length,
         // which THROWS "malformed JSON" on a corrupt/foreign rules_json and would
         // crash the whole list. This also keeps ruleCount identical to the detail
@@ -18754,19 +19179,23 @@ var SqliteDetectionsRepository = class {
   // available_packs keyed by the "namespace/packId" slug (one read per list /
   // detail call; the table is a handful of rows).
   availableByPack() {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson
          FROM available_packs`
-    ).all();
+      )
+    );
     return new Map(rows.map((r) => [`${r.namespace}/${r.packId}`, r]));
   }
   getDetectionStats() {
-    const rows = this.db.prepare("SELECT enabled, rules_json AS rulesJson FROM installed_packs").all();
+    const rows = allRows(
+      this.db.prepare("SELECT enabled, rules_json AS rulesJson FROM installed_packs")
+    );
     let rules = 0;
     let active = 0;
     const ruleIds = /* @__PURE__ */ new Set();
     for (const r of rows) {
-      if (r.enabled === 1) active += 1;
+      if (intToBool(r.enabled)) active += 1;
       const parsed = parseRules(r.rulesJson);
       rules += parsed.length;
       for (const rule of parsed) {
@@ -18784,12 +19213,15 @@ var SqliteDetectionsRepository = class {
     const parts = splitDetectionId(id);
     if (!parts) return Promise.resolve(null);
     const { namespace, packId } = parts;
-    const row = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
                 rules_json AS rulesJson, updated_at AS updatedAt
          FROM installed_packs
          WHERE namespace = ? AND pack_id = ?`
-    ).get(namespace, packId);
+      ),
+      [namespace, packId]
+    );
     if (!row) return Promise.resolve(null);
     const rules = parseRules(row.rulesJson);
     const ruleIds = rules.map((r) => r.id).filter((id2) => typeof id2 === "string");
@@ -18807,7 +19239,7 @@ var SqliteDetectionsRepository = class {
           packId: row.packId,
           version: row.version,
           name: row.name,
-          enabled: row.enabled === 1,
+          enabled: intToBool(row.enabled),
           rules,
           updatedAt: new Date(row.updatedAt),
           policyId: row.policyId
@@ -18822,13 +19254,14 @@ var SqliteDetectionsRepository = class {
   countFindingsLast30d(ruleIds) {
     if (ruleIds.length === 0) return 0;
     const since = this.now() - 30 * DAY_MS2;
-    const placeholders2 = ruleIds.map(() => "?").join(", ");
-    const row = this.db.prepare(
-      `SELECT count(*) AS c
+    const inClause = placeholders(ruleIds.length);
+    return countScalar(
+      this.db,
+      `SELECT count(*) AS n
          FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= ? AND f.rule_id IN (${placeholders2})`
-    ).get(since, ...ruleIds);
-    return row.c;
+         WHERE e.occurred_at >= ? AND f.rule_id IN (${inClause})`,
+      [since, ...ruleIds]
+    );
   }
 };
 
@@ -18845,16 +19278,17 @@ var SqliteEventsRepository = class {
   insertStmt;
   insertEvent(event) {
     const row = toEventRow(event);
-    this.insertStmt.run({
-      id: row.id,
-      sourceTool: row.sourceTool,
-      kind: row.kind,
-      occurredAt: row.occurredAt,
-      contentHash: row.contentHash,
-      content: row.content,
-      // exactOptionalPropertyTypes: the column is nullable, never undefined.
-      metadata: row.metadata ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        sourceTool: row.sourceTool,
+        kind: row.kind,
+        occurredAt: row.occurredAt,
+        contentHash: row.contentHash,
+        content: row.content,
+        metadata: row.metadata
+      })
+    );
   }
   // Every recorded event's content hash — the historical backfill loads this once
   // to skip transcript messages it has already stored, so re-running the scan
@@ -18862,13 +19296,23 @@ var SqliteEventsRepository = class {
   // Async (Promise.resolve over synchronous node:sqlite) so it satisfies the
   // async EventsReadPort contract.
   contentHashes() {
-    const rows = this.db.prepare("SELECT content_hash FROM events").all();
+    const rows = allRows(
+      this.db.prepare("SELECT content_hash FROM events")
+    );
     return Promise.resolve(new Set(rows.map((r) => r.content_hash)));
   }
 };
 
 // ../../packages/persistence/src/repositories/exceptions.ts
 import { randomUUID } from "crypto";
+
+// ../../packages/persistence/src/internal/sqlite-errors.ts
+var SQLITE_CONSTRAINT_UNIQUE = 2067;
+function isUniqueConstraintError(err) {
+  return err instanceof Error && (err.errcode === SQLITE_CONSTRAINT_UNIQUE || err.message.includes("UNIQUE constraint failed"));
+}
+
+// ../../packages/persistence/src/repositories/exceptions.ts
 var BLOCKED_DETECTIONS_TTL_MS = 30 * 60 * 1e3;
 var BLOCKED_DETECTIONS_RETENTION_MS = 24 * 60 * 60 * 1e3;
 var DuplicateActiveExceptionError = class extends Error {
@@ -18889,10 +19333,6 @@ var AmbiguousExceptionIdError = class extends Error {
     this.name = "AmbiguousExceptionIdError";
   }
 };
-var SQLITE_CONSTRAINT_UNIQUE = 2067;
-function isUniqueConstraintError(err) {
-  return err instanceof Error && (err.errcode === SQLITE_CONSTRAINT_UNIQUE || err.message.includes("UNIQUE constraint failed"));
-}
 var ACTIVE_PREDICATE = `revoked_at IS NULL
      AND (expires_at IS NULL OR expires_at > :now)
      AND (max_uses IS NULL OR use_count < max_uses)`;
@@ -18948,10 +19388,11 @@ var SqliteExceptionsRepository = class {
       this.insertExceptionRow(id, input, now);
     } catch (err) {
       if (!isUniqueConstraintError(err)) throw err;
-      this.db.exec("BEGIN IMMEDIATE");
-      try {
-        const superseded = this.db.prepare(
-          `UPDATE exceptions
+      withTransaction(
+        this.db,
+        () => {
+          const superseded = this.db.prepare(
+            `UPDATE exceptions
                 SET revoked_at = :now, revoked_by = :revokedBy,
                     revoke_reason = 'superseded by a new grant for the same value',
                     updated_at = :now
@@ -18959,24 +19400,27 @@ var SqliteExceptionsRepository = class {
                 AND key_version = :keyVersion AND revoked_at IS NULL
                 AND ((expires_at IS NOT NULL AND expires_at <= :now)
                   OR (max_uses IS NOT NULL AND use_count >= max_uses))`
-        ).run({
-          now,
-          revokedBy: input.createdBy,
-          ruleId: input.ruleId,
-          valueFingerprint: input.valueFingerprint,
-          keyVersion: input.keyVersion
-        });
-        if (Number(superseded.changes) !== 1) {
-          throw new DuplicateActiveExceptionError(input.ruleId);
-        }
-        this.insertExceptionRow(id, input, now);
-        this.db.exec("COMMIT");
-      } catch (retryErr) {
-        this.db.exec("ROLLBACK");
-        throw retryErr;
-      }
+          ).run({
+            now,
+            revokedBy: input.createdBy,
+            ruleId: input.ruleId,
+            valueFingerprint: input.valueFingerprint,
+            keyVersion: input.keyVersion
+          });
+          if (Number(superseded.changes) !== 1) {
+            throw new DuplicateActiveExceptionError(input.ruleId);
+          }
+          this.insertExceptionRow(id, input, now);
+        },
+        "IMMEDIATE"
+      );
+    }
+    const row = getRow(this.db.prepare("SELECT * FROM exceptions WHERE id = :id"), {
+      id
+    });
+    if (row === void 0) {
+      throw new Error("exception row not found immediately after insert");
     }
-    const row = this.db.prepare("SELECT * FROM exceptions WHERE id = :id").get({ id });
     return parseExceptionRow(row);
   }
   insertExceptionRow(id, input, now) {
@@ -19014,14 +19458,11 @@ var SqliteExceptionsRepository = class {
    */
   list(opts) {
     const where = opts?.includeTerminal ? "" : `WHERE ${ACTIVE_PREDICATE}`;
-    const rows = this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`).all(opts?.includeTerminal ? {} : { now: Date.now() });
-    const exceptions = [];
-    for (const row of rows) {
-      try {
-        exceptions.push(parseExceptionRow(row));
-      } catch {
-      }
-    }
+    const rows = allRows(
+      this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`),
+      opts?.includeTerminal ? {} : { now: Date.now() }
+    );
+    const exceptions = mapRowsTolerant(rows, parseExceptionRow);
     return Promise.resolve(exceptions);
   }
   /**
@@ -19031,7 +19472,12 @@ var SqliteExceptionsRepository = class {
    */
   getByIdPrefix(prefix) {
     if (prefix.length === 0) return Promise.resolve(void 0);
-    const rows = this.db.prepare(String.raw`SELECT * FROM exceptions WHERE id LIKE :pattern ESCAPE '\' LIMIT 2`).all({ pattern: `${escapeLikePattern(prefix)}%` });
+    const rows = allRows(
+      this.db.prepare(
+        String.raw`SELECT * FROM exceptions WHERE id LIKE :pattern ESCAPE '\' LIMIT 2`
+      ),
+      { pattern: `${escapeLikePattern(prefix)}%` }
+    );
     if (rows.length > 1) {
       return Promise.reject(new AmbiguousExceptionIdError(prefix));
     }
@@ -19073,30 +19519,27 @@ var SqliteExceptionsRepository = class {
    * a different (rotated-away) key never match, so they are excluded at read.
    */
   activeBundleEntries(keyVersion, now = Date.now()) {
-    const rows = this.db.prepare(
-      `SELECT * FROM exceptions
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT * FROM exceptions
           WHERE key_version = :keyVersion AND ${ACTIVE_PREDICATE}
           ORDER BY created_at DESC, rowid DESC`
-    ).all({ keyVersion, now });
-    const entries = [];
-    for (const row of rows) {
-      try {
-        const conditions = row.conditions === null ? null : JSON.parse(row.conditions);
-        entries.push(
-          ExceptionBundleEntry.parse({
-            id: row.id,
-            ruleId: row.rule_id,
-            valueFingerprint: row.value_fingerprint,
-            keyVersion: row.key_version,
-            expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
-            maxUses: row.max_uses,
-            useCount: row.use_count,
-            conditions
-          })
-        );
-      } catch {
-      }
-    }
+      ),
+      { keyVersion, now }
+    );
+    const entries = mapRowsTolerant(rows, (row) => {
+      const conditions = row.conditions === null ? null : JSON.parse(row.conditions);
+      return ExceptionBundleEntry.parse({
+        id: row.id,
+        ruleId: row.rule_id,
+        valueFingerprint: row.value_fingerprint,
+        keyVersion: row.key_version,
+        expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
+        maxUses: row.max_uses,
+        useCount: row.use_count,
+        conditions
+      });
+    });
     return Promise.resolve(entries);
   }
   /**
@@ -19123,11 +19566,14 @@ var SqliteExceptionsRepository = class {
   }
   /** Blocked detections within the window (default: the 30-minute TTL), newest-first. */
   recentBlocked(windowMs = BLOCKED_DETECTIONS_TTL_MS) {
-    const rows = this.db.prepare(
-      `SELECT * FROM blocked_detections
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT * FROM blocked_detections
           WHERE blocked_at > :cutoff
           ORDER BY blocked_at DESC, rowid DESC`
-    ).all({ cutoff: Date.now() - windowMs });
+      ),
+      { cutoff: Date.now() - windowMs }
+    );
     return Promise.resolve(
       rows.map((row) => ({
         reference: row.reference,
@@ -19207,7 +19653,12 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 )`;
 
 // ../../packages/persistence/src/repositories/findings.ts
-var GROUP_ROW_CAP = 2e3;
+var PREVIEW_INSTANCES_PER_GROUP = 200;
+var CONCAT_SEP = ",";
+var TUPLE_SEP = "|";
+function splitConcat(value) {
+  return value === null || value === "" ? [] : value.split(CONCAT_SEP);
+}
 function deriveInstanceStatus(row) {
   return deriveFindingStatus({
     kind: row.kind,
@@ -19275,13 +19726,16 @@ var SqliteFindingsRepository = class {
   }
   recentFindings(opts) {
     const limit = opts?.limit ?? 50;
-    const rows = this.db.prepare(
-      `SELECT f.id, f.event_id, f.rule_id, f.category, f.severity, f.masked_match,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.id, f.event_id, f.rule_id, f.category, f.severity, f.masked_match,
                 f.action_taken, f.confidence, e.occurred_at, e.source_tool, e.kind
          FROM findings f JOIN events e ON e.id = f.event_id
          ORDER BY e.occurred_at DESC, f.rowid DESC
          LIMIT :limit`
-    ).all({ limit });
+      ),
+      { limit }
+    );
     return Promise.resolve(
       rows.map((r) => ({
         id: r.id,
@@ -19298,26 +19752,94 @@ var SqliteFindingsRepository = class {
       }))
     );
   }
+  /** Live-enforced findings recorded for one session — a bare COUNT over the
+   * session-stamped events (served by idx_events_session_id), so the Activity
+   * page can label its findings link without the grouped pipeline. */
+  sessionFindingsCount(sessionId) {
+    if (!sessionId) return Promise.resolve(0);
+    return Promise.resolve(
+      countScalar(
+        this.db,
+        `SELECT count(*) AS n FROM findings f
+           JOIN events e ON e.id = f.event_id
+          WHERE json_extract(e.metadata, '$.sessionId') = :sessionId`,
+        { sessionId }
+      )
+    );
+  }
+  /** Per-rule transcript firing tally for one session — reads the OTHER finding
+   * store (inspection_findings, keyed to audit_events): every detection the
+   * transcript pass recorded, counted per firing rather than per unique value.
+   * Rides on session-scoped grouped responses so the findings view can
+   * reconcile the Activity page's tally with the deduped groups it lists. */
+  sessionFirings(sessionId) {
+    return Object.fromEntries(
+      countBy(
+        this.db,
+        `SELECT d.rule_id AS k, count(*) AS n
+           FROM inspection_findings f
+           JOIN audit_events e ON e.id = f.audit_event_id
+           JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+          WHERE e.root_session_id = :sessionId
+          GROUP BY d.rule_id`,
+        { sessionId }
+      )
+    );
+  }
   /**
-   * Grouped findings for the dashboard — joins findings⋈events (repo/file
-   * from event metadata), groups by ruleId, computes per-filter-excluded facets,
+   * Grouped findings for the dashboard — joins findings⋈events (repo/file/
+   * toolName from event metadata), groups by ruleId, computes per-filter-excluded facets,
    * applies the requested filters, and sorts by severity then recency. Filtering
    * and faceting run in JS via the shared @akasecurity/schema helpers. `totals`
    * reflect the full filtered set; `items` is the requested
-   * page (default 100); no cursor (nextCursor is always null).
+   * page (default 50); no cursor (nextCursor is always null).
+   *
+   * Two reads, neither of which materializes a row per finding:
+   *   1. one aggregate row per rule_id, folding EVERY instance into the numbers
+   *      the group and the filters need (count, providers, actions, statuses,
+   *      latest, search text);
+   *   2. each group's newest PREVIEW_INSTANCES_PER_GROUP instances, which
+   *      populate `instances` for the table's expanded rows.
+   * The aggregates carry raw DB values and are translated by the same
+   * @akasecurity/schema mappers the row path uses, so no enum mapping or status
+   * rule is ever restated in SQL.
    */
   listGroupedFindings(query) {
-    const rows = this.db.prepare(
-      `SELECT f.id, f.rule_id, f.category, f.severity, f.masked_match,
-                f.action_taken, f.confidence, e.occurred_at, e.source_tool,
-                json_extract(e.metadata, '$.repo') AS repo,
-                json_extract(e.metadata, '$.filePath') AS file,
-                e.kind AS kind, f.finding_key AS finding_key,
-                ${latestResolutionStatusSql("f")} AS latest_status
-         FROM findings f JOIN events e ON e.id = f.event_id
-         ORDER BY e.occurred_at DESC, f.id DESC
-         LIMIT :cap`
-    ).all({ cap: GROUP_ROW_CAP });
+    const sessionPredicate = query.sessionId ? `WHERE json_extract(e.metadata, '$.sessionId') = :sessionId` : "";
+    const sessionParams = query.sessionId ? { sessionId: query.sessionId } : {};
+    const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "", {
+      predicate: sessionPredicate,
+      params: sessionParams
+    });
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
+                occurred_at, source_tool, repo, file, tool_name, kind, finding_key, latest_status
+         FROM (
+           SELECT f.id AS id, f.rule_id AS rule_id, f.category AS category,
+                  f.severity AS severity, f.masked_match AS masked_match,
+                  f.action_taken AS action_taken, f.confidence AS confidence,
+                  e.occurred_at AS occurred_at, e.source_tool AS source_tool,
+                  json_extract(e.metadata, '$.repo') AS repo,
+                  json_extract(e.metadata, '$.filePath') AS file,
+                  json_extract(e.metadata, '$.toolName') AS tool_name,
+                  e.kind AS kind, f.finding_key AS finding_key,
+                  latest.status AS latest_status,
+                  ROW_NUMBER() OVER (
+                    PARTITION BY f.rule_id
+                    ORDER BY e.occurred_at DESC, f.id DESC
+                  ) AS rn
+             FROM findings f
+             JOIN events e ON e.id = f.event_id
+             LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+               ON latest.finding_key = f.finding_key
+             ${sessionPredicate}
+         )
+         WHERE rn <= :cap
+         ORDER BY occurred_at DESC, id DESC`
+      ),
+      { cap: PREVIEW_INSTANCES_PER_GROUP, ...sessionParams }
+    );
     const groupable = rows.map((r) => ({
       id: r.id,
       ruleId: r.rule_id,
@@ -19330,9 +19852,10 @@ var SqliteFindingsRepository = class {
       sourceTool: r.source_tool,
       repo: r.repo ?? "",
       file: r.file ?? "",
+      ...r.tool_name === null ? {} : { toolName: r.tool_name },
       status: deriveInstanceStatus(r)
     }));
-    const allGroups = buildFindingGroups(groupable);
+    const allGroups = buildFindingGroups(groupable, { aggregates });
     const filterOpts = {
       severity: query.severity,
       providers: query.provider,
@@ -19348,44 +19871,134 @@ var SqliteFindingsRepository = class {
     };
     const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
     const items = sorted.slice(0, limit);
-    return Promise.resolve({ totals, facets, items, nextCursor: null });
+    return Promise.resolve({
+      totals,
+      facets,
+      items,
+      nextCursor: null,
+      ...query.sessionId ? { sessionFirings: this.sessionFirings(query.sessionId) } : {}
+    });
+  }
+  /**
+   * One row per rule_id, folding EVERY instance of the group into the values
+   * buildFindingGroups cannot recover from a preview. Bounded by the number of
+   * distinct rule_ids (the installed packs' rules), not by the store's size.
+   *
+   * The per-instance sets ride back as group_concat lists of RAW DB values —
+   * source_tool, action_taken, and the (kind, has-key, latest-status) triples
+   * deriveFindingStatus consumes. Aggregating the status INPUTS rather than a
+   * status keeps the classifier itself in @akasecurity/schema, where
+   * severitySummary's SQL and this query can't drift apart on what 'resolved'
+   * means (see resolution-sql.ts). Each of those sets is bounded by an enum, so
+   * a group's row stays small however many findings it holds.
+   *
+   * `withSearchText` is the exception, and the one column here that does NOT
+   * stay small: the group's distinct repos/filePaths, whose size tracks how many
+   * distinct paths a rule fired across — for a rule hitting mostly-unique paths
+   * that is a string proportional to the store (~8MB over 200k distinct paths,
+   * and buildHaystack lowercases a second copy). It buys `q` the ability to
+   * match an instance outside the preview, which searching the preview alone
+   * would silently lose, so it is fetched only when the request actually
+   * carries a `q`.
+   */
+  groupAggregates(withSearchText, scope) {
+    const searchTextColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.metadata, '$.repo')) AS repos,
+           group_concat(DISTINCT json_extract(e.metadata, '$.filePath')) AS files,
+           group_concat(DISTINCT 'via ' || json_extract(e.metadata, '$.toolName')) AS tool_names` : `, NULL AS repos, NULL AS files, NULL AS tool_names`;
+    const rows = this.db.prepare(
+      `SELECT f.rule_id AS rule_id,
+                count(*) AS instance_count,
+                max(e.occurred_at) AS latest_at,
+                group_concat(DISTINCT e.source_tool) AS source_tools,
+                group_concat(DISTINCT f.action_taken) AS actions_taken,
+                group_concat(DISTINCT (
+                  e.kind || '${TUPLE_SEP}' ||
+                  (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '${TUPLE_SEP}' ||
+                  coalesce(latest.status, '')
+                )) AS status_inputs
+                ${searchTextColumns}
+           FROM findings f
+           JOIN events e ON e.id = f.event_id
+           LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+             ON latest.finding_key = f.finding_key
+          ${scope.predicate}
+          GROUP BY f.rule_id`
+    ).all(scope.params);
+    return new Map(
+      rows.map((r) => [
+        r.rule_id,
+        {
+          instanceCount: r.instance_count,
+          sourceTools: splitConcat(r.source_tools),
+          actionsTaken: splitConcat(r.actions_taken),
+          statusInputs: splitConcat(r.status_inputs).map((tuple2) => {
+            const [kind = "", keyMarker = "", latestStatus = ""] = tuple2.split(TUPLE_SEP);
+            return {
+              // deriveFindingStatus only distinguishes null from non-null here,
+              // so the marker stands in for the key itself (never rendered).
+              kind,
+              findingKey: keyMarker === "" ? null : keyMarker,
+              latestResolutionStatus: latestStatus === "" ? null : latestStatus
+            };
+          }),
+          latestDetectedAt: epochMillisToIso(r.latest_at),
+          // Free text only — joined and substring-matched, so group_concat's
+          // commas need no unpicking (a repo/path containing one still matches).
+          // Left undefined (not '') when unfetched, so buildFindingGroups can
+          // tell "no q this request" from "a group with no repo/file at all"
+          // and skip priming a haystack nothing will read.
+          ...withSearchText ? {
+            searchText: [r.repos ?? "", r.files ?? "", r.tool_names ?? ""].filter((s) => s !== "").join(" ")
+          } : {}
+        }
+      ])
+    );
   }
   healthSummary() {
-    const total = this.db.prepare("SELECT count(*) AS c FROM findings").get().c;
+    const total = countScalar(this.db, "SELECT count(*) AS n FROM findings");
     const byAction = Object.fromEntries(ACTION_TAKEN_KEYS.map((a) => [a, 0]));
-    const grouped = this.db.prepare("SELECT action_taken, count(*) AS c FROM findings GROUP BY action_taken").all();
+    const grouped = allRows(
+      this.db.prepare("SELECT action_taken, count(*) AS c FROM findings GROUP BY action_taken")
+    );
     for (const row of grouped) {
       if (row.action_taken in byAction) byAction[row.action_taken] = row.c;
     }
     const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
-    const sevRows = this.db.prepare(
-      `SELECT f.severity AS severity, count(*) AS c
+    const sevRows = allRows(
+      this.db.prepare(
+        `SELECT f.severity AS severity, count(*) AS c
          FROM findings f
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
          WHERE latest.status IS NULL OR latest.status != 'resolved'
          GROUP BY f.severity`
-    ).all();
+      )
+    );
     for (const row of sevRows) {
       if (row.severity in bySeverity) bySeverity[row.severity] = row.c;
     }
     const categories = ENFORCEABLE_CATEGORIES;
-    const enabledRows = this.db.prepare(
-      `SELECT DISTINCT json_extract(target, '$.category') AS category
+    const enabledRows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT json_extract(target, '$.category') AS category
          FROM policies WHERE enabled = 1 AND json_extract(target, '$.category') IS NOT NULL`
-    ).all();
+      )
+    );
     const enabled = new Set(enabledRows.map((r) => r.category));
     const coverage = categories.length === 0 ? 0 : categories.filter((c) => enabled.has(c)).length / categories.length;
     return Promise.resolve({ findings: total, byAction, bySeverity, coverage });
   }
   activityByDay(days = 7) {
     const since = startOfUtcDay(Date.now()) - (days - 1) * DAY_MS3;
-    const rows = this.db.prepare(
-      `SELECT date(e.occurred_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT date(e.occurred_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :since
          GROUP BY day, f.action_taken`
-    ).all({ since });
+      ),
+      { since }
+    );
     const buckets = /* @__PURE__ */ new Map();
     for (let i = 0; i < days; i++) {
       const day = isoDay(since + i * DAY_MS3);
@@ -19457,17 +20070,19 @@ var SqliteInspectionFindingsRepository = class {
   insertStmt;
   insertFinding(input) {
     const row = toInspectionFindingRow(input);
-    this.insertStmt.run({
-      id: row.id,
-      auditEventId: row.auditEventId,
-      inspectionDefinitionId: row.inspectionDefinitionId,
-      classifiedDataId: row.classifiedDataId ?? null,
-      spanStart: row.spanStart,
-      spanEnd: row.spanEnd,
-      maskedMatch: row.maskedMatch,
-      actionTaken: row.actionTaken,
-      confidence: row.confidence
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        auditEventId: row.auditEventId,
+        inspectionDefinitionId: row.inspectionDefinitionId,
+        classifiedDataId: row.classifiedDataId,
+        spanStart: row.spanStart,
+        spanEnd: row.spanEnd,
+        maskedMatch: row.maskedMatch,
+        actionTaken: row.actionTaken,
+        confidence: row.confidence
+      })
+    );
   }
 };
 
@@ -19543,12 +20158,7 @@ function isMirrorDowngrade(incoming, stored) {
 }
 function ruleIdsOf(rulesJson) {
   const ids = /* @__PURE__ */ new Set();
-  let raw;
-  try {
-    raw = JSON.parse(rulesJson);
-  } catch {
-    return ids;
-  }
+  const raw = safeJson(rulesJson, []);
   if (!Array.isArray(raw)) return ids;
   for (const entry of raw) {
     if (entry && typeof entry === "object") {
@@ -19621,47 +20231,48 @@ var SqliteInstalledPacksRepository = class {
       }));
       if (this.storedSignature() === inventorySignature(rows)) return;
       const now = Date.now();
-      this.db.exec("BEGIN IMMEDIATE");
-      try {
-        const mirror = this.mirrorState();
-        let behind = false;
-        for (const row of rows) {
-          const params = {
-            id: randomUUID2(),
-            namespace: row.namespace,
-            packId: row.packId,
-            version: row.version,
-            name: row.name,
-            rulesJson: row.rulesJson,
-            now
-          };
-          const stored = mirror.get(`${row.namespace}/${row.packId}`);
-          if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
-            this.upsertAvailableStmt.run({
-              ...params,
+      withTransaction(
+        this.db,
+        () => {
+          const mirror = this.mirrorState();
+          let behind = false;
+          for (const row of rows) {
+            const params = {
               id: randomUUID2(),
-              recordedBy: meta3?.recordedBy ?? null
-            });
-          } else {
-            behind = true;
+              namespace: row.namespace,
+              packId: row.packId,
+              version: row.version,
+              name: row.name,
+              rulesJson: row.rulesJson,
+              now
+            };
+            const stored = mirror.get(`${row.namespace}/${row.packId}`);
+            if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
+              this.upsertAvailableStmt.run({
+                ...params,
+                id: randomUUID2(),
+                recordedBy: meta3?.recordedBy ?? null
+              });
+            } else {
+              behind = true;
+            }
+            this.insertMissingStmt.run(params);
           }
-          this.insertMissingStmt.run(params);
-        }
-        if (!behind) this.pruneAvailable(rows.map((r) => `${r.namespace}/${r.packId}`));
-        this.db.exec("COMMIT");
-      } catch (err) {
-        this.db.exec("ROLLBACK");
-        throw err;
-      }
+          if (!behind) this.pruneAvailable(rows.map((r) => `${r.namespace}/${r.packId}`));
+        },
+        "IMMEDIATE"
+      );
     } catch {
     }
   }
   // The mirror's current (namespace/packId → {version, ruleIds}) map — the
   // input to the downgrade guard. Read INSIDE the write transaction.
   mirrorState() {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs`
+      )
+    );
     return new Map(
       rows.map((r) => [
         `${r.namespace}/${r.packId}`,
@@ -19673,7 +20284,9 @@ var SqliteInstalledPacksRepository = class {
   // (keys joined with '/', matching the detection id slug encoding — packId may
   // itself contain '/', but namespace may not, so the join is unambiguous).
   pruneAvailable(keep) {
-    const rows = this.db.prepare(`SELECT namespace, pack_id AS packId FROM available_packs`).all();
+    const rows = allRows(
+      this.db.prepare(`SELECT namespace, pack_id AS packId FROM available_packs`)
+    );
     const keepSet = new Set(keep);
     const del = this.db.prepare(`DELETE FROM available_packs WHERE namespace = ? AND pack_id = ?`);
     for (const r of rows) {
@@ -19700,11 +20313,13 @@ var SqliteInstalledPacksRepository = class {
     if (this.db.isTransaction) {
       throw new Error("applyUpdate must not be called inside an open transaction");
     }
-    this.db.exec("BEGIN IMMEDIATE");
-    try {
-      this.db.exec("UPDATE _pack_write_gate SET open = 1 WHERE id = 1");
-      const res = this.db.prepare(
-        `UPDATE installed_packs SET
+    let changed = false;
+    withTransaction(
+      this.db,
+      () => {
+        this.db.exec("UPDATE _pack_write_gate SET open = 1 WHERE id = 1");
+        const res = this.db.prepare(
+          `UPDATE installed_packs SET
              version = (SELECT a.version FROM available_packs a
                         WHERE a.namespace = :namespace AND a.pack_id = :packId),
              name = (SELECT a.name FROM available_packs a
@@ -19715,17 +20330,13 @@ var SqliteInstalledPacksRepository = class {
            WHERE namespace = :namespace AND pack_id = :packId
              AND EXISTS (SELECT 1 FROM available_packs a
                          WHERE a.namespace = :namespace AND a.pack_id = :packId)`
-      ).run({ namespace, packId, now: Date.now() });
-      this.db.exec("UPDATE _pack_write_gate SET open = 0 WHERE id = 1");
-      this.db.exec("COMMIT");
-      return Number(res.changes) > 0;
-    } catch (err) {
-      try {
-        this.db.exec("ROLLBACK");
-      } catch {
-      }
-      throw err;
-    }
+        ).run({ namespace, packId, now: Date.now() });
+        this.db.exec("UPDATE _pack_write_gate SET open = 0 WHERE id = 1");
+        changed = Number(res.changes) > 0;
+      },
+      "IMMEDIATE"
+    );
+    return changed;
   }
   /**
    * The scan-time ruleset: every rule under an ENABLED installed pack that
@@ -19739,9 +20350,11 @@ var SqliteInstalledPacksRepository = class {
    * JSON-level failure therefore counts as invalid.
    */
   installedRuleset() {
-    const rows = this.db.prepare(
-      `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson FROM installed_packs`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson FROM installed_packs`
+      )
+    );
     const out = {
       installedPacks: rows.length,
       enabledPacks: 0,
@@ -19750,7 +20363,7 @@ var SqliteInstalledPacksRepository = class {
       ruleActions: /* @__PURE__ */ new Map()
     };
     for (const row of rows) {
-      if (row.enabled !== 1) continue;
+      if (!intToBool(row.enabled)) continue;
       out.enabledPacks += 1;
       const action = policyIdToAction(row.policyId);
       let raw;
@@ -19785,9 +20398,11 @@ var SqliteInstalledPacksRepository = class {
    * running max would mask a genuinely-newer parseable stamp.
    */
   newestRecordedBinary() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT recorded_by AS recordedBy FROM available_packs WHERE recorded_by IS NOT NULL`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT recorded_by AS recordedBy FROM available_packs WHERE recorded_by IS NOT NULL`
+      )
+    );
     let newest = null;
     for (const row of rows) {
       const at = row.recordedBy.lastIndexOf("@");
@@ -19802,13 +20417,15 @@ var SqliteInstalledPacksRepository = class {
     return newest;
   }
   counts() {
-    const row = this.db.prepare(
-      `SELECT count(*) AS packs,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT count(*) AS packs,
                 coalesce(sum(json_array_length(rules_json)), 0) AS rules,
                 coalesce(sum(enabled), 0) AS enabled
          FROM installed_packs`
-    ).get();
-    return Promise.resolve(row);
+      )
+    );
+    return Promise.resolve(row ?? { packs: 0, rules: 0, enabled: 0 });
   }
   // ─── Policy-catalog reads ────────────────────────────────────────────────────
   // Back the Policies page's built-in catalog: how many
@@ -19821,26 +20438,29 @@ var SqliteInstalledPacksRepository = class {
    * attributed to Monitor, matching the Detections views.
    */
   countsByPolicyId() {
-    const rows = this.db.prepare(
-      `SELECT coalesce(policy_id, '${DEFAULT_POLICY_ID}') AS pid, count(*) AS n
+    return countBy(
+      this.db,
+      `SELECT coalesce(policy_id, '${DEFAULT_POLICY_ID}') AS k, count(*) AS n
          FROM installed_packs
-         GROUP BY pid`
-    ).all();
-    return new Map(rows.map((r) => [r.pid, r.n]));
+         GROUP BY k`
+    );
   }
   /** The detections governed by a built-in policy — one UsedByItem per pack. */
   listByPolicyId(policyId) {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, name, enabled, rules_json AS rulesJson
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, name, enabled, rules_json AS rulesJson
          FROM installed_packs
          WHERE coalesce(policy_id, '${DEFAULT_POLICY_ID}') = ?
          ORDER BY name ASC`
-    ).all(policyId);
+      ),
+      [policyId]
+    );
     return rows.map((r) => ({
       id: `${r.namespace}/${r.packId}`,
       name: r.name,
       ruleCount: parseRules(r.rulesJson).length,
-      enabled: r.enabled === 1
+      enabled: intToBool(r.enabled)
     }));
   }
   // ─── Writes ────────────────────────────────────────────────────────────────
@@ -19869,14 +20489,14 @@ var SqliteInstalledPacksRepository = class {
     const res = this.db.prepare(
       `UPDATE installed_packs SET enabled = :enabled, updated_at = :now
          WHERE namespace = :namespace AND pack_id = :packId`
-    ).run({ enabled: enabled ? 1 : 0, now: Date.now(), namespace, packId });
+    ).run({ enabled: boolToInt(enabled), now: Date.now(), namespace, packId });
     return Number(res.changes) > 0;
   }
   // Fingerprint of the recorded available mirror — compared against the
   // incoming inventory's signature to skip the write entirely when the running
   // binary's inventory hasn't changed since the last record.
   storedSignature() {
-    const rows = this.signatureStmt.all();
+    const rows = allRows(this.signatureStmt);
     return inventorySignature(rows);
   }
 };
@@ -19904,42 +20524,48 @@ var SqliteInventoryRepository = class {
   upsert(input, now = Date.now()) {
     const id = inventoryId(input.objectType, input.identityKey);
     const row = toInventoryRow(input, id, now);
-    this.upsertStmt.run({
-      id: row.id,
-      objectType: row.objectType,
-      location: row.location ?? null,
-      title: row.title ?? null,
-      hostId: row.hostId ?? null,
-      attributes: row.attributes,
-      firstSeen: row.firstSeen,
-      lastSeen: row.lastSeen
-    });
+    this.upsertStmt.run(
+      bindParams({
+        id: row.id,
+        objectType: row.objectType,
+        location: row.location,
+        title: row.title,
+        hostId: row.hostId,
+        attributes: row.attributes,
+        firstSeen: row.firstSeen,
+        lastSeen: row.lastSeen
+      })
+    );
     return id;
   }
   // The full row, for round-trip assertions.
   findById(id) {
-    const row = this.db.prepare("SELECT * FROM inventory WHERE id = :id").get({ id });
-    return row;
+    return getRow(this.db.prepare("SELECT * FROM inventory WHERE id = :id"), { id });
   }
   // Distinct titles for an object_type — a filter facet (e.g. hostnames),
   // served from the object_type index, never from audit_events.
   distinctTitles(objectType) {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT title FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT title FROM inventory
          WHERE object_type = :objectType AND title IS NOT NULL
          ORDER BY title`
-    ).all({ objectType });
+      ),
+      { objectType }
+    );
     return rows.map((r) => r.title);
   }
   // Distinct host os_version values — a facet served from an inventory index
   // over the generated column, never from the audit fact (confirm via EXPLAIN
   // QUERY PLAN).
   osVersions() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT os_version AS value FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT os_version AS value FROM inventory
          WHERE object_type = 'host' AND os_version IS NOT NULL
          ORDER BY value`
-    ).all();
+      )
+    );
     return rows.map((r) => r.value);
   }
 };
@@ -19959,14 +20585,6 @@ var EMPTY_PROJECT_AGG = {
   accessCounts: { open: 0, approved: 0, blocked: 0, total: 0 },
   findingsCount: 0
 };
-function safeJson(s, fallback) {
-  if (s == null) return fallback;
-  try {
-    return JSON.parse(s);
-  } catch {
-    return fallback;
-  }
-}
 function resolveHarnessId(attrs, row) {
   if (attrs.provider && VALID_HARNESS_IDS.has(attrs.provider)) {
     return attrs.provider;
@@ -20162,30 +20780,49 @@ var SqliteInventoryAssetsRepository = class {
   configRowsCache;
   // ─── stats ─────────────────────────────────────────────────────────────────
   getInventoryStats() {
-    const byType = { project: 0, skill: 0, mcp: 0, hook: 0, config: 0 };
-    for (const r of this.db.prepare("SELECT asset_type AS t, count(*) AS n FROM inventory_asset GROUP BY asset_type").all()) {
-      if (r.t in byType) byType[r.t] = r.n;
-    }
-    byType.project = this.db.prepare(`SELECT count(*) AS n FROM source_project WHERE ${WORKTREE_CHECKOUT_FILTER}`).get().n;
-    const mcpTrust = { "known-good": 0, risky: 0, unapproved: 0 };
-    for (const r of this.db.prepare(
-      `SELECT coalesce(o.trust, a.trust) AS trust, count(*) AS n
+    const typeCounts = countBy(
+      this.db,
+      "SELECT asset_type AS k, count(*) AS n FROM inventory_asset GROUP BY asset_type"
+    );
+    const byType = {
+      project: 0,
+      skill: typeCounts.get("skill") ?? 0,
+      mcp: typeCounts.get("mcp") ?? 0,
+      hook: typeCounts.get("hook") ?? 0,
+      config: typeCounts.get("config") ?? 0
+    };
+    byType.project = countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM source_project WHERE ${WORKTREE_CHECKOUT_FILTER}`
+    );
+    const mcpTrustCounts = countBy(
+      this.db,
+      `SELECT coalesce(o.trust, a.trust) AS k, count(*) AS n
          FROM inventory_asset a
          LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
          WHERE a.asset_type = 'mcp' AND coalesce(o.trust, a.trust) IS NOT NULL
          GROUP BY coalesce(o.trust, a.trust)`
-    ).all()) {
-      if (r.trust in mcpTrust) mcpTrust[r.trust] = r.n;
-    }
-    const harnesses = this.db.prepare(
+    );
+    const mcpTrust = {
+      "known-good": mcpTrustCounts.get("known-good") ?? 0,
+      risky: mcpTrustCounts.get("risky") ?? 0,
+      unapproved: mcpTrustCounts.get("unapproved") ?? 0
+    };
+    const harnesses = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM inventory
            WHERE object_type = 'harness'
-             AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`
-    ).get({ liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }).n;
-    const flaggedAssets = this.db.prepare("SELECT count(*) AS n FROM inventory_asset WHERE flags_json <> '[]'").get().n;
-    const flaggedProjects = this.db.prepare(
+             AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`,
+      { liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }
+    );
+    const flaggedAssets = countScalar(
+      this.db,
+      "SELECT count(*) AS n FROM inventory_asset WHERE flags_json <> '[]'"
+    );
+    const flaggedProjects = countScalar(
+      this.db,
       `SELECT count(DISTINCT project_id) AS n FROM project_file WHERE findings_count > 0`
-    ).get().n;
+    );
     const configRows = this.configAssetRows();
     for (const r of configRows) {
       byType[r.assetType] += 1;
@@ -20442,12 +21079,15 @@ var SqliteInventoryAssetsRepository = class {
   }
   // ─── raw fetchers ────────────────────────────────────────────────────────────
   fetchHarnessRows() {
-    return this.db.prepare(
-      `SELECT id, title, attributes, harness_version AS harnessVersion
+    return allRows(
+      this.db.prepare(
+        `SELECT id, title, attributes, harness_version AS harnessVersion
          FROM inventory
          WHERE object_type = 'harness'
            AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`
-    ).all({ liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS });
+      ),
+      { liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }
+    );
   }
   // Every harness's assets in ONE grouped query, keyed by harness inventory id —
   // replaces the per-harness-row query the listHarnesses loop used to make.
@@ -20457,12 +21097,13 @@ var SqliteInventoryAssetsRepository = class {
     const params = [...harnessInvIds];
     let where = `ha.harness_id IN (${placeholders(harnessInvIds.length)})`;
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      where += " AND (a.name LIKE ? ESCAPE '\\' OR a.sub LIKE ? ESCAPE '\\')";
+      const pat = containsPattern(q);
+      where += ` AND ${likeAny(["a.name", "a.sub"])}`;
       params.push(pat, pat);
     }
-    const rows = this.db.prepare(
-      `SELECT ha.harness_id AS harnessInvId, a.id, a.asset_type AS assetType, a.name, a.sub,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT ha.harness_id AS harnessInvId, a.id, a.asset_type AS assetType, a.name, a.sub,
                 a.description, a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                 a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
          FROM harness_asset ha
@@ -20470,7 +21111,9 @@ var SqliteInventoryAssetsRepository = class {
          LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
          WHERE ${where}
          ORDER BY a.name ASC`
-    ).all(...params);
+      ),
+      params
+    );
     for (const raw of rows) {
       const harnessInvId = raw.harnessInvId;
       const [asset] = this.mapAssetRows([raw]);
@@ -20489,21 +21132,24 @@ var SqliteInventoryAssetsRepository = class {
       params.push(...types);
     }
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      conditions.push("(a.name LIKE ? ESCAPE '\\' OR a.sub LIKE ? ESCAPE '\\')");
+      const pat = containsPattern(q);
+      conditions.push(likeAny(["a.name", "a.sub"]));
       params.push(pat, pat);
     }
     const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
     const sampleRows = this.mapAssetRows(
-      this.db.prepare(
-        `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
+      allRows(
+        this.db.prepare(
+          `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
                   a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                   a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
            FROM inventory_asset a
            LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
            ${where}
            ORDER BY a.name ASC`
-      ).all(...params)
+        ),
+        params
+      )
     );
     const configRows = this.configAssetRows(q).filter(
       (r) => !types || types.length === 0 || types.includes(r.assetType)
@@ -20512,14 +21158,17 @@ var SqliteInventoryAssetsRepository = class {
   }
   fetchAssetById(assetId) {
     const rows = this.mapAssetRows(
-      this.db.prepare(
-        `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
+      allRows(
+        this.db.prepare(
+          `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
                   a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                   a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
            FROM inventory_asset a
            LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
            WHERE a.id = ?`
-      ).all(assetId)
+        ),
+        [assetId]
+      )
     );
     return rows[0] ?? this.configAssetRows().find((r) => r.id === assetId) ?? null;
   }
@@ -20575,37 +21224,39 @@ var SqliteInventoryAssetsRepository = class {
     return rows;
   }
   latestConfigScanId() {
-    const row = this.db.prepare(
-      `SELECT id FROM audit_events WHERE event_type = 'config_scan'
-         ORDER BY started_at DESC, id DESC LIMIT 1`
-    ).get();
-    return row?.id ?? null;
+    return latestConfigScan(this.db)?.id ?? null;
   }
   fetchProjects(q) {
     let sql = `SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project
                WHERE ${WORKTREE_CHECKOUT_FILTER}`;
     const params = [];
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      sql += " AND (name LIKE ? ESCAPE '\\' OR url LIKE ? ESCAPE '\\')";
+      const pat = containsPattern(q);
+      sql += ` AND ${likeAny(["name", "url"])}`;
       params.push(pat, pat);
     }
     sql += " ORDER BY name ASC";
-    return this.db.prepare(sql).all(...params);
+    return allRows(this.db.prepare(sql), params);
   }
   fetchProjectById(projectId) {
-    return this.db.prepare(
-      "SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project WHERE id = ?"
-    ).get(projectId) ?? null;
+    return getRow(
+      this.db.prepare(
+        "SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project WHERE id = ?"
+      ),
+      [projectId]
+    ) ?? null;
   }
   // The referenced projects in ONE `id IN (…)` fetch, keyed by id.
   fetchProjectsByIds(projectIds) {
     const map2 = /* @__PURE__ */ new Map();
     if (projectIds.length === 0) return map2;
-    const rows = this.db.prepare(
-      `SELECT id, url, name, attributes, last_seen AS lastSeen
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, url, name, attributes, last_seen AS lastSeen
          FROM source_project WHERE id IN (${placeholders(projectIds.length)})`
-    ).all(...projectIds);
+      ),
+      projectIds
+    );
     for (const r of rows) map2.set(r.id, r);
     return map2;
   }
@@ -20616,8 +21267,9 @@ var SqliteInventoryAssetsRepository = class {
   projectAggregates(projectIds) {
     const map2 = /* @__PURE__ */ new Map();
     if (projectIds.length === 0) return map2;
-    const rows = this.db.prepare(
-      `SELECT f.project_id AS projectId,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.project_id AS projectId,
                 coalesce(o.access, f.default_access) AS eff,
                 count(*) AS n,
                 coalesce(sum(f.findings_count), 0) AS findings
@@ -20625,7 +21277,9 @@ var SqliteInventoryAssetsRepository = class {
          LEFT JOIN file_access_override o ON o.project_id = f.project_id AND o.path = f.path
          WHERE f.project_id IN (${placeholders(projectIds.length)})
          GROUP BY f.project_id, eff`
-    ).all(...projectIds);
+      ),
+      projectIds
+    );
     for (const r of rows) {
       let agg = map2.get(r.projectId);
       if (!agg) {
@@ -20663,37 +21317,52 @@ var SqliteInventoryAssetsRepository = class {
   fetchProjectFilesUnder(projectId, prefix) {
     if (prefix === "") {
       return this.mapFileRows(
-        this.db.prepare(this.fileSelect("f.project_id = ? ORDER BY f.path ASC")).all(projectId)
+        allRows(
+          this.db.prepare(this.fileSelect("f.project_id = ? ORDER BY f.path ASC")),
+          [projectId]
+        )
       );
     }
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect("f.project_id = ? AND f.path LIKE ? ESCAPE '\\' ORDER BY f.path ASC")
-      ).all(projectId, `${escapeLikePattern(prefix)}/%`)
+      allRows(
+        this.db.prepare(
+          this.fileSelect("f.project_id = ? AND f.path LIKE ? ESCAPE '\\' ORDER BY f.path ASC")
+        ),
+        [projectId, `${escapeLikePattern(prefix)}/%`]
+      )
     );
   }
   fetchProjectFilesSearch(projectId, q) {
-    const pat = `%${escapeLikePattern(q)}%`;
+    const pat = containsPattern(q);
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect(
-          "f.project_id = ? AND (f.path LIKE ? ESCAPE '\\' OR f.name LIKE ? ESCAPE '\\') ORDER BY f.path ASC"
-        )
-      ).all(projectId, pat, pat)
+      allRows(
+        this.db.prepare(
+          this.fileSelect(
+            "f.project_id = ? AND (f.path LIKE ? ESCAPE '\\' OR f.name LIKE ? ESCAPE '\\') ORDER BY f.path ASC"
+          )
+        ),
+        [projectId, pat, pat]
+      )
     );
   }
   fetchProjectFilesBlocked(projectId) {
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect(
-          "f.project_id = ? AND coalesce(o.access, f.default_access) = 'blocked' AND f.blocked_at IS NOT NULL"
-        )
-      ).all(projectId)
+      allRows(
+        this.db.prepare(
+          this.fileSelect(
+            "f.project_id = ? AND coalesce(o.access, f.default_access) = 'blocked' AND f.blocked_at IS NOT NULL"
+          )
+        ),
+        [projectId]
+      )
     );
   }
   fetchProjectFile(projectId, path) {
     const rows = this.mapFileRows(
-      this.db.prepare(this.fileSelect("f.project_id = ? AND f.path = ?")).all(projectId, path)
+      allRows(
+        this.db.prepare(this.fileSelect("f.project_id = ? AND f.path = ?")),
+        [projectId, path]
+      )
     );
     return rows[0] ?? null;
   }
@@ -20707,39 +21376,32 @@ var SqlitePoliciesRepository = class {
   }
   db;
   readPolicies() {
-    const rows = this.db.prepare("SELECT * FROM policies").all();
-    const policies = [];
-    for (const row of rows) {
-      try {
-        const target = JSON.parse(row.target);
-        const customKeywords = row.custom_keywords ? JSON.parse(row.custom_keywords) : void 0;
-        policies.push(
-          Policy.parse({
-            id: row.id,
-            scope: row.scope,
-            target,
-            action: row.action,
-            enabled: row.enabled === 1,
-            customKeywords
-          })
-        );
-      } catch {
-      }
-    }
+    const rows = allRows(this.db.prepare("SELECT * FROM policies"));
+    const policies = mapRowsTolerant(rows, (row) => {
+      const target = JSON.parse(row.target);
+      const customKeywords = row.custom_keywords ? JSON.parse(row.custom_keywords) : void 0;
+      return Policy.parse({
+        id: row.id,
+        scope: row.scope,
+        target,
+        action: row.action,
+        enabled: intToBool(row.enabled),
+        customKeywords
+      });
+    });
     return Promise.resolve(policies);
   }
   // Seed one policy per bundled category from DEFAULT_ACTIONS so the
   // detection-type config exists from first run. Only when the table is empty,
   // so a user's edits are never clobbered.
   seedDefaults() {
-    const count = this.db.prepare("SELECT count(*) AS c FROM policies").get().c;
+    const count = countScalar(this.db, "SELECT count(*) AS n FROM policies");
     if (count > 0) return;
     const stmt = this.db.prepare(
       `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
        VALUES (:id, 'global', :target, :action, 1, :now, :now)`
     );
-    this.db.exec("BEGIN");
-    try {
+    failOpenTransaction(this.db, () => {
       for (const [category, action] of Object.entries(DEFAULT_ACTIONS)) {
         stmt.run({
           id: randomUUID4(),
@@ -20748,10 +21410,41 @@ var SqlitePoliciesRepository = class {
           now: Date.now()
         });
       }
-      this.db.exec("COMMIT");
-    } catch {
-      this.db.exec("ROLLBACK");
-    }
+    });
+  }
+  // Insert-or-update the single global per-category policy row, keyed on the
+  // existing uq_policies_scope_target unique index (scope, target). `action`
+  // uses the SAME vocabulary seedDefaults writes (DEFAULT_ACTIONS' ActionTaken
+  // values), so the runtime's resolveAction reads rows written by either path
+  // identically. On conflict, `action`, `enabled`, and `updated_at` are updated;
+  // `id` and `created_at` are left exactly as they were.
+  upsertCategoryAction(category, action) {
+    const now = Date.now();
+    this.db.prepare(
+      `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
+         VALUES (:id, 'global', :target, :action, 1, :now, :now)
+         ON CONFLICT(scope, target) DO UPDATE SET action = excluded.action, enabled = 1, updated_at = excluded.updated_at`
+    ).run({ id: randomUUID4(), target: JSON.stringify({ category }), action, now });
+  }
+  // Caps every global per-category policy currently set to block/redact down
+  // to warn (see warn-era-cap.ts). Rule-targeted policies are untouched.
+  // Returns the number of rows changed.
+  capCategoryActions() {
+    const info = this.db.prepare(
+      `UPDATE policies SET action='warn', updated_at=:now
+         WHERE scope='global' AND action IN ('block','redact')
+           AND json_extract(target,'$.category') IS NOT NULL`
+    ).run({ now: Date.now() });
+    return Number(info.changes);
+  }
+  // Read the current action for a single global per-category policy row, mirroring
+  // upsertCategoryAction's category-lookup predicate. Returns undefined when no
+  // row exists yet, so callers can distinguish an unset category from a set one.
+  getCategoryAction(category) {
+    const row = this.db.prepare(
+      `SELECT action FROM policies WHERE scope='global' AND json_extract(target,'$.category') = :category`
+    ).get({ category });
+    return row?.action;
   }
 };
 
@@ -20827,7 +21520,7 @@ var SqliteProjectFilesRepository = class {
   maxStampStmt;
   /** Replace `projectId`'s tree with the scan's files. Caller wraps in a transaction. */
   replaceForProject(projectId, scan2, now) {
-    const { maxStamp } = this.maxStampStmt.get({ projectId });
+    const maxStamp = getRow(this.maxStampStmt, { projectId })?.maxStamp ?? 0;
     const stamp = Math.max(now, maxStamp + 1);
     for (const file2 of scan2.files) {
       this.upsertStmt.run({
@@ -20910,7 +21603,7 @@ var SqliteResolutionsRepository = class {
   }
   /** The newest disposition recorded for a finding key, or undefined if none. */
   latestByKey(key) {
-    const row = this.latestStmt.get({ findingKey: key });
+    const row = getRow(this.latestStmt, { findingKey: key });
     if (!row) return void 0;
     return {
       // Safe narrows: insertResolution enum-parses both columns on every write,
@@ -20927,7 +21620,7 @@ var SqliteResolutionsRepository = class {
    * the CLI) surfaces for that file.
    */
   openAtRestKeysForPath(path) {
-    const rows = this.openAtRestStmt.all({ path });
+    const rows = allRows(this.openAtRestStmt, { path });
     return rows.map((r) => r.finding_key);
   }
   /**
@@ -20938,7 +21631,7 @@ var SqliteResolutionsRepository = class {
    * resolution row (see scan.ts).
    */
   resolvedAtRestKeysForPath(path) {
-    const rows = this.resolvedAtRestStmt.all({ path });
+    const rows = allRows(this.resolvedAtRestStmt, { path });
     return rows.map((r) => r.finding_key);
   }
 };
@@ -20967,38 +21660,31 @@ var SqliteScanLedgerRepository = class {
   // Previously scanned files under THIS ruleset, keyed by path. Rows from an
   // older ruleset are simply absent, which reads as "never scanned".
   entriesForRuleset(rulesetHash) {
-    const rows = this.readStmt.all({ rulesetHash });
+    const rows = allRows(this.readStmt, {
+      rulesetHash
+    });
     return new Map(rows.map((r) => [r.path, { mtime: r.mtime, contentHash: r.contentHash }]));
   }
   upsertEntries(entries) {
     if (entries.length === 0) return;
     const scannedAt = Date.now();
-    try {
-      this.db.exec("BEGIN");
-      try {
-        for (const entry of entries) {
-          this.upsertStmt.run({
-            path: entry.path,
-            mtime: entry.mtime,
-            contentHash: entry.contentHash,
-            rulesetHash: entry.rulesetHash,
-            scannedAt
-          });
-        }
-        this.db.exec("COMMIT");
-      } catch (err) {
-        this.db.exec("ROLLBACK");
-        throw err;
+    failOpenTransaction(this.db, () => {
+      for (const entry of entries) {
+        this.upsertStmt.run({
+          path: entry.path,
+          mtime: entry.mtime,
+          contentHash: entry.contentHash,
+          rulesetHash: entry.rulesetHash,
+          scannedAt
+        });
       }
-    } catch {
-    }
+    });
   }
 };
 
 // ../../packages/persistence/src/repositories/security.ts
 var DAY_MS4 = 864e5;
 var SEVERITIES = ["critical", "high", "medium", "low"];
-var RANGE_DAYS = { "7d": 7, "30d": 30, "3m": 90, "6m": 180 };
 var ACTION_TO_KIND = {
   block: "blocked",
   redact: "redacted",
@@ -21013,8 +21699,14 @@ var SCAN_COVERAGE = [
   { provider: "copilot", coverage: 0, supported: false },
   { provider: "api", coverage: 0, supported: false }
 ];
+var GRANULARITY = {
+  "7d": "day",
+  "30d": "day",
+  "3m": "week",
+  "6m": "week"
+};
 function granularityFor(range) {
-  return range === "7d" || range === "30d" ? "day" : "week";
+  return GRANULARITY[range];
 }
 function startOfUtcDay2(ms) {
   return Math.floor(ms / DAY_MS4) * DAY_MS4;
@@ -21068,8 +21760,9 @@ var SqliteSecurityRepository = class {
   // finding — its rn = 1 filter is also what makes the LEFT JOIN safe against
   // double-counting a key that accumulated several append-only rows.
   severitySummary() {
-    const rows = this.db.prepare(
-      `SELECT f.severity AS severity,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.severity AS severity,
                 COUNT(*) AS count,
                 SUM(CASE
                       WHEN e.kind != 'code_change' THEN 1
@@ -21088,7 +21781,8 @@ var SqliteSecurityRepository = class {
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
          GROUP BY f.severity`
-    ).all();
+      )
+    );
     const byRow = new Map(rows.map((r) => [r.severity, r]));
     const bySeverity = SEVERITIES.map((severity) => ({
       severity,
@@ -21172,14 +21866,15 @@ var SqliteSecurityRepository = class {
     const numBuckets = granularity === "day" ? lenDays : Math.ceil(lenDays / 7);
     const now = this.now();
     const windowStart = startOfUtcDay2(now) - (lenDays - 1) * DAY_MS4;
-    const rows = this.db.prepare(
-      // first_detected_at is the PRESERVED first-detection time (set once on a
-      // finding's INSERT, never overwritten on the re-detection upsert), so MTTR
-      // measures from first sighting — not the latest re-scan's event, whose
-      // occurred_at the upsert overwrites onto findings.event_id. COALESCE onto
-      // the parent event's occurred_at defends against any legacy/edge row the
-      // backfill left null.
-      `SELECT COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at, f.severity AS severity,
+    const rows = allRows(
+      this.db.prepare(
+        // first_detected_at is the PRESERVED first-detection time (set once on a
+        // finding's INSERT, never overwritten on the re-detection upsert), so MTTR
+        // measures from first sighting — not the latest re-scan's event, whose
+        // occurred_at the upsert overwrites onto findings.event_id. COALESCE onto
+        // the parent event's occurred_at defends against any legacy/edge row the
+        // backfill left null.
+        `SELECT COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at, f.severity AS severity,
                 (
                   SELECT fr.status FROM finding_resolution fr
                    WHERE fr.finding_key = f.finding_key
@@ -21205,14 +21900,16 @@ var SqliteSecurityRepository = class {
               WHERE fr.finding_key = f.finding_key
                 AND fr.resolved_at >= :windowStart
            )`
-      // The EXISTS is a SUPERSET prefilter that bounds the scan to keys with
-      // any resolution activity at/after the window start — a row this method
-      // ultimately counts has its LATEST resolution inside the window, which
-      // implies such a row exists, so nothing wanted is dropped. The exact
-      // latest-wins + status/method + window gate stays in JS below,
-      // dialect-agnostic. Without this, a
-      // 7d request evaluated the store's entire trackable-findings history.
-    ).all({ windowStart });
+        // The EXISTS is a SUPERSET prefilter that bounds the scan to keys with
+        // any resolution activity at/after the window start — a row this method
+        // ultimately counts has its LATEST resolution inside the window, which
+        // implies such a row exists, so nothing wanted is dropped. The exact
+        // latest-wins + status/method + window gate stays in JS below,
+        // dialect-agnostic. Without this, a
+        // 7d request evaluated the store's entire trackable-findings history.
+      ),
+      { windowStart }
+    );
     const sums = /* @__PURE__ */ new Map();
     const counts = /* @__PURE__ */ new Map();
     for (const r of rows) {
@@ -21242,8 +21939,9 @@ var SqliteSecurityRepository = class {
     if (opts.kind === "user") return Promise.resolve({ range, items: [] });
     const now = this.now();
     const from = now - RANGE_DAYS[range] * DAY_MS4;
-    const rows = this.db.prepare(
-      `SELECT json_extract(e.metadata, '$.repo') AS repo, count(*) AS c
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT json_extract(e.metadata, '$.repo') AS repo, count(*) AS c
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :from AND e.occurred_at < :to
            AND json_extract(e.metadata, '$.repo') IS NOT NULL
@@ -21251,7 +21949,9 @@ var SqliteSecurityRepository = class {
          GROUP BY repo
          ORDER BY c DESC, repo
          LIMIT :limit`
-    ).all({ from, to: now, limit });
+      ),
+      { from, to: now, limit }
+    );
     const items = rows.map((r) => ({
       id: `repo_${r.repo}`,
       name: r.repo,
@@ -21273,8 +21973,9 @@ var SqliteSecurityRepository = class {
   // resolutions.ts's openAtRestStmt accessor. Ordered by resolved_at DESC,
   // capped at `limit`.
   recentlyResolved(limit = 20) {
-    const rows = this.db.prepare(
-      `SELECT f.finding_key AS finding_key,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.finding_key AS finding_key,
                 f.rule_id AS rule_id,
                 f.severity AS severity,
                 json_extract(e.metadata, '$.filePath') AS path,
@@ -21308,7 +22009,9 @@ var SqliteSecurityRepository = class {
            ) IS NOT NULL
          ORDER BY latest_resolved_at DESC
          LIMIT :limit`
-    ).all({ limit });
+      ),
+      { limit }
+    );
     const items = rows.map((r) => ({
       findingKey: r.finding_key,
       ruleId: r.rule_id,
@@ -21325,12 +22028,15 @@ var SqliteSecurityRepository = class {
   // epoch-millis timestamp. occurred_at is an INTEGER column, so the bounds stay
   // numeric and the JS aggregations bucket/split on ms directly.
   findingsInRange(fromMs, toMs) {
-    const rows = this.db.prepare(
-      `SELECT e.occurred_at AS occurred_at, f.severity AS severity, f.action_taken AS action_taken
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT e.occurred_at AS occurred_at, f.severity AS severity, f.action_taken AS action_taken
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :from AND e.occurred_at < :to
          ORDER BY e.occurred_at`
-    ).all({ from: fromMs, to: toMs });
+      ),
+      { from: fromMs, to: toMs }
+    );
     return rows.map((r) => ({
       occurredAt: r.occurred_at,
       severity: r.severity,
@@ -21344,12 +22050,7 @@ import { randomUUID as randomUUID7 } from "crypto";
 var KIND_ORDER = ["provider", "internal", "ip"];
 var CALL_SITE_EMBED_CAP = 200;
 function parseNetwork(networkJson) {
-  if (!networkJson) return null;
-  try {
-    return JSON.parse(networkJson);
-  } catch {
-    return null;
-  }
+  return safeJson(networkJson, null);
 }
 function toEndpointSummary(row) {
   return {
@@ -21436,27 +22137,39 @@ var SqliteSharesRepository = class {
   }
   db;
   stats() {
-    const scalar = (sql) => this.db.prepare(sql).get()?.n ?? 0;
-    const destinations = scalar("SELECT count(*) AS n FROM share_destination");
-    const endpoints = scalar("SELECT count(*) AS n FROM share_endpoint");
-    const callSites = scalar("SELECT count(*) AS n FROM share_call_site");
-    const insecure = scalar(
+    const destinations = countScalar(this.db, "SELECT count(*) AS n FROM share_destination");
+    const endpoints = countScalar(this.db, "SELECT count(*) AS n FROM share_endpoint");
+    const callSites = countScalar(this.db, "SELECT count(*) AS n FROM share_call_site");
+    const insecure = countScalar(
+      this.db,
       "SELECT count(DISTINCT destination_id) AS n FROM share_endpoint WHERE transport = 'http'"
     );
-    const needsReview = scalar(
+    const needsReview = countScalar(
+      this.db,
       `SELECT count(DISTINCT d.id) AS n
        FROM share_destination d
        LEFT JOIN share_endpoint e ON e.destination_id = d.id AND e.transport = 'http'
        WHERE d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL`
     );
-    const byKind = { provider: 0, internal: 0, ip: 0 };
-    for (const row of this.db.prepare("SELECT kind, count(*) AS n FROM share_destination GROUP BY kind").all()) {
-      byKind[row.kind] = row.n;
-    }
-    const byTrust = { recognized: 0, internal: 0, unverified: 0, ip: 0 };
-    for (const row of this.db.prepare("SELECT trust, count(*) AS n FROM share_destination GROUP BY trust").all()) {
-      byTrust[row.trust] = row.n;
-    }
+    const kindCounts = countBy(
+      this.db,
+      "SELECT kind AS k, count(*) AS n FROM share_destination GROUP BY kind"
+    );
+    const byKind = {
+      provider: kindCounts.get("provider") ?? 0,
+      internal: kindCounts.get("internal") ?? 0,
+      ip: kindCounts.get("ip") ?? 0
+    };
+    const trustCounts = countBy(
+      this.db,
+      "SELECT trust AS k, count(*) AS n FROM share_destination GROUP BY trust"
+    );
+    const byTrust = {
+      recognized: trustCounts.get("recognized") ?? 0,
+      internal: trustCounts.get("internal") ?? 0,
+      unverified: trustCounts.get("unverified") ?? 0,
+      ip: trustCounts.get("ip") ?? 0
+    };
     return Promise.resolve({
       destinations,
       endpoints,
@@ -21572,7 +22285,7 @@ var SqliteSharesRepository = class {
     }
     let sql;
     if (q) {
-      const pattern = `%${escapeLikePattern(q)}%`;
+      const pattern = containsPattern(q);
       conditions.push(
         `(d.name LIKE ? ESCAPE '\\' OR d.category LIKE ? ESCAPE '\\' OR e.url LIKE ? ESCAPE '\\'
           OR c.project LIKE ? ESCAPE '\\' OR c.file LIKE ? ESCAPE '\\')`
@@ -21592,24 +22305,31 @@ var SqliteSharesRepository = class {
              ${conditions.length ? `WHERE ${conditions.join(" AND ")}` : ""}
              ORDER BY d.created_at ASC, d.id ASC`;
     }
-    const rows = this.db.prepare(sql).all(...params);
+    const rows = allRows(
+      this.db.prepare(sql),
+      params
+    );
     return rows.map((r) => this.mapDestRow(r));
   }
   fetchDestinationById(destinationId) {
-    const row = this.db.prepare(
-      `SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
                 d.network_json AS networkJson, d.last_seen AS lastSeenMs,
                 o.decision AS overrideDecision
          FROM share_destination d
          LEFT JOIN egress_decision_override o ON o.destination_id = d.id
          WHERE d.id = ?`
-    ).get(destinationId);
+      ),
+      [destinationId]
+    );
     return row ? this.mapDestRow(row) : null;
   }
   fetchEndpoints(destinationIds) {
     if (destinationIds.length === 0) return [];
-    const rows = this.db.prepare(
-      `SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
                 e.template, e.data_class AS dataClass, e.last_seen AS lastSeenMs,
                 count(c.id) AS callSiteCount
          FROM share_endpoint e
@@ -21617,7 +22337,9 @@ var SqliteSharesRepository = class {
          WHERE e.destination_id IN (${placeholders(destinationIds.length)})
          GROUP BY e.id
          ORDER BY e.created_at ASC, e.id ASC`
-    ).all(...destinationIds);
+      ),
+      destinationIds
+    );
     return rows.map((r) => ({
       id: r.id,
       destinationId: r.destinationId,
@@ -21642,13 +22364,16 @@ var SqliteSharesRepository = class {
   }
   fetchCallSites(endpointIds) {
     if (endpointIds.length === 0) return [];
-    const rows = this.db.prepare(
-      `SELECT id, endpoint_id AS endpointId, project, file, line, snippet, dynamic, vendored,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, endpoint_id AS endpointId, project, file, line, snippet, dynamic, vendored,
                 project_id AS projectId
          FROM share_call_site
          WHERE endpoint_id IN (${placeholders(endpointIds.length)})
          ORDER BY created_at ASC, id ASC`
-    ).all(...endpointIds);
+      ),
+      endpointIds
+    );
     return rows.map((r) => ({
       id: r.id,
       endpointId: r.endpointId,
@@ -21684,27 +22409,36 @@ var SqliteSourceProjectRepository = class {
   upsert(input, now = Date.now()) {
     const id = sourceProjectId(input.url);
     const row = toSourceProjectRow(input, id, now);
-    this.upsertStmt.run({
-      id: row.id,
-      url: row.url ?? null,
-      name: row.name ?? null,
-      attributes: row.attributes,
-      firstSeen: row.firstSeen,
-      lastSeen: row.lastSeen
-    });
+    this.upsertStmt.run(
+      bindParams({
+        id: row.id,
+        url: row.url,
+        name: row.name,
+        attributes: row.attributes,
+        firstSeen: row.firstSeen,
+        lastSeen: row.lastSeen
+      })
+    );
     return id;
   }
   findById(id) {
-    return this.db.prepare("SELECT * FROM source_project WHERE id = :id").get({ id });
+    return getRow(
+      this.db.prepare("SELECT * FROM source_project WHERE id = :id"),
+      {
+        id
+      }
+    );
   }
   // Distinct project names — a filter facet, served from the source_project
   // table, never from the audit fact table.
   distinctNames() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT name FROM source_project
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT name FROM source_project
          WHERE name IS NOT NULL
          ORDER BY name`
-    ).all();
+      )
+    );
     return rows.map((r) => r.name);
   }
 };
@@ -21723,8 +22457,7 @@ function hasLegacySampleRows(db) {
 function purgeSampleData(db) {
   try {
     if (!hasLegacySampleRows(db)) return;
-    db.exec("BEGIN");
-    try {
+    withTransaction(db, () => {
       db.exec(
         `DELETE FROM share_call_site WHERE endpoint_id IN (
            SELECT e.id FROM share_endpoint e
@@ -21769,11 +22502,7 @@ function purgeSampleData(db) {
         value TEXT NOT NULL
       )`);
       db.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'");
-      db.exec("COMMIT");
-    } catch (err) {
-      db.exec("ROLLBACK");
-      throw err;
-    }
+    });
   } catch {
   }
 }
@@ -21792,7 +22521,7 @@ function openWithPragmas(file2) {
 function backupLegacyStore(file2) {
   const backup = `${file2}.legacy.${String(Date.now())}.bak`;
   renameSync(file2, backup);
-  for (const sidecar of [`${file2}-wal`, `${file2}-shm`]) {
+  for (const sidecar of walSidecars(file2)) {
     if (existsSync(sidecar)) rmSync(sidecar);
   }
   return backup;
@@ -21805,9 +22534,8 @@ function openLocalDatabase(dir) {
     db.close();
     const backup = backupLegacyStore(file2);
     db = openWithPragmas(file2);
-    process.stderr.write(
-      `[aka] Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.
-`
+    akaWarn(
+      `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
     );
   }
   applyMigrations(db);
@@ -21835,96 +22563,77 @@ function openLocalDatabase(dir) {
   const configInventory = new SqliteConfigInventoryRepository(db);
   policies.seedDefaults();
   function recordCapture(event, detected) {
-    try {
-      db.exec("BEGIN");
-      try {
-        events.insertEvent(event);
-        const sessionId = event.metadata?.sessionId;
-        findings.insertFindings(detected, sessionId ? { sessionId } : {});
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
-    } catch {
-    }
+    failOpenTransaction(db, () => {
+      events.insertEvent(event);
+      const sessionId = event.metadata?.sessionId;
+      findings.insertFindings(detected, sessionId ? { sessionId } : {});
+    });
   }
   function ensureInventory(ctx) {
     const resolved = {};
-    try {
-      db.exec("BEGIN");
-      try {
-        const now = Date.now();
-        if (ctx.host) resolved.hostId = inventory.upsert(ctx.host, now);
-        if (ctx.harness) {
-          resolved.harnessId = inventory.upsert(linkHost(ctx.harness, resolved.hostId), now);
-        }
-        resolved.accountId = inventory.upsert(
-          linkHost(
-            {
-              objectType: "user",
-              identityKey: "local",
-              attributes: { source: "local" }
-            },
-            resolved.hostId
-          ),
-          now
-        );
-        if (ctx.project) resolved.sourceProjectId = sourceProject.upsert(ctx.project, now);
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
-    } catch {
-      return {};
-    }
-    return resolved;
+    const committed = failOpenTransaction(db, () => {
+      const now = Date.now();
+      if (ctx.host) resolved.hostId = inventory.upsert(ctx.host, now);
+      if (ctx.harness) {
+        resolved.harnessId = inventory.upsert(linkHost(ctx.harness, resolved.hostId), now);
+      }
+      resolved.accountId = inventory.upsert(
+        linkHost(
+          {
+            objectType: "user",
+            identityKey: "local",
+            attributes: { source: "local" }
+          },
+          resolved.hostId
+        ),
+        now
+      );
+      if (ctx.project) resolved.sourceProjectId = sourceProject.upsert(ctx.project, now);
+    });
+    return committed ? resolved : {};
   }
   function recordConfigScan(record2) {
-    try {
-      db.exec("BEGIN");
-      try {
-        const now = isoToEpochMillis(record2.scanEvent.startedAt);
-        for (const item of record2.items) inventory.upsert(item, now);
-        auditEvents.insertAuditEvent(record2.scanEvent);
-        const definitionIds = /* @__PURE__ */ new Map();
-        for (const def of record2.definitions ?? []) {
-          definitionIds.set(`${def.ruleId}@${def.version}`, inspectionDefinitions.upsert(def));
-        }
-        for (const finding of record2.findings ?? []) {
-          const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
-          if (!definitionId) continue;
-          inspectionFindings.insertFinding({
-            id: randomUUID8(),
-            auditEventId: record2.scanEvent.id,
-            inspectionDefinitionId: definitionId,
-            span: finding.span,
-            maskedMatch: finding.maskedMatch,
-            actionTaken: finding.actionTaken,
-            confidence: finding.confidence
-          });
-        }
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
+    failOpenTransaction(db, () => {
+      const now = isoToEpochMillis(record2.scanEvent.startedAt);
+      for (const item of record2.items) inventory.upsert(item, now);
+      auditEvents.insertAuditEvent(record2.scanEvent);
+      const definitionIds = /* @__PURE__ */ new Map();
+      for (const def of record2.definitions ?? []) {
+        definitionIds.set(`${def.ruleId}@${def.version}`, inspectionDefinitions.upsert(def));
+      }
+      for (const finding of record2.findings ?? []) {
+        const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
+        if (!definitionId) continue;
+        inspectionFindings.insertFinding({
+          id: randomUUID8(),
+          auditEventId: record2.scanEvent.id,
+          inspectionDefinitionId: definitionId,
+          span: finding.span,
+          maskedMatch: finding.maskedMatch,
+          actionTaken: finding.actionTaken,
+          confidence: finding.confidence
+        });
       }
-    } catch {
-    }
+    });
   }
   function recordProjectFiles(projectId, scan2) {
     if (scan2.files.length === 0) return;
+    failOpenTransaction(db, () => {
+      projectFiles.replaceForProject(projectId, scan2, Date.now());
+    });
+  }
+  async function transaction(fn) {
+    db.exec("BEGIN");
     try {
-      db.exec("BEGIN");
+      const result = await fn();
+      db.exec("COMMIT");
+      return result;
+    } catch (err) {
       try {
-        projectFiles.replaceForProject(projectId, scan2, Date.now());
-        db.exec("COMMIT");
-      } catch (err) {
         db.exec("ROLLBACK");
-        throw err;
+      } catch {
       }
-    } catch {
+      throw err;
     }
   }
   function reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot) {
@@ -21943,8 +22652,7 @@ function openLocalDatabase(dir) {
         patternWin: `${escapeLikePattern(headPosix.split("/").join("\\"))}\\\\.claude\\\\worktrees\\\\%`
       });
       if (stale.length === 0) return;
-      db.exec("BEGIN");
-      try {
+      withTransaction(db, () => {
         for (const { id } of stale) {
           db.prepare(
             "UPDATE audit_events SET source_project_id = :canonicalId WHERE source_project_id = :id"
@@ -21956,11 +22664,7 @@ function openLocalDatabase(dir) {
           db.prepare("DELETE FROM project_file WHERE project_id = :id").run({ id });
           db.prepare("DELETE FROM source_project WHERE id = :id").run({ id });
         }
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
+      });
     } catch {
     }
   }
@@ -22002,6 +22706,7 @@ function openLocalDatabase(dir) {
     purgeSampleData: () => {
       purgeSampleData(db);
     },
+    transaction,
     close: () => {
       db.close();
     }
@@ -22122,12 +22827,27 @@ function readWorkspaceSettings(base = defaultDataDir()) {
   }
 }
 function readJson(file2) {
+  let text;
   try {
-    const parsed = JSON.parse(readFileSync2(file2, "utf8"));
-    return typeof parsed === "object" && parsed !== null ? parsed : null;
+    text = readFileSync2(file2, "utf8");
   } catch {
     return null;
   }
+  return parseJsonObject(text) ?? null;
+}
+
+// ../../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+var MARKER = "warn-era-capped";
+function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
+  if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
+  const marker = join5(dataDir2, MARKER);
+  if (existsSync2(marker)) return { capped: 0, skipped: "already-run" };
+  const capped = db.policies.capCategoryActions();
+  writeFileSync3(marker, `${new Date(Date.now()).toISOString()}
+`, { mode: DATA_FILE_MODE });
+  return { capped };
 }
 
 // ../../packages/plugin-sdk/src/provider-env.ts
@@ -22212,23 +22932,30 @@ function resolveProviderSafe() {
 // ../../packages/plugin-sdk/src/config-inventory.ts
 import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join6 } from "path";
+import { basename as basename2, join as join7 } from "path";
+
+// ../../packages/detections/src/escape-regexp.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// ../../packages/detections/src/matchers/limits.ts
+var MAX_MATCHES_PER_RULE = 1e4;
 
 // ../../packages/detections/src/matchers/keyword.ts
 var KeywordMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "keyword") return [];
     const { keywords, caseSensitive } = rule.matcher;
-    const haystack = caseSensitive ? text : text.toLowerCase();
     const spans = [];
     for (const kw of keywords) {
-      const needle = caseSensitive ? kw : kw.toLowerCase();
-      let idx = 0;
-      while (idx < haystack.length) {
-        const pos = haystack.indexOf(needle, idx);
-        if (pos === -1) break;
-        spans.push({ start: pos, end: pos + kw.length });
-        idx = pos + 1;
+      if (kw.length === 0) continue;
+      if (spans.length >= MAX_MATCHES_PER_RULE) break;
+      const re = new RegExp(escapeRegExp(kw), caseSensitive ? "gu" : "giu");
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        spans.push({ start: m.index, end: m.index + m[0].length });
+        if (spans.length >= MAX_MATCHES_PER_RULE) break;
       }
     }
     return spans;
@@ -22236,7 +22963,6 @@ var KeywordMatcher2 = class {
 };
 
 // ../../packages/detections/src/matchers/regex.ts
-var MAX_MATCHES_PER_RULE = 1e4;
 var RegexMatcher2 = class {
   match(text, rule) {
     if (rule.matcher.type !== "regex") return [];
@@ -22322,9 +23048,6 @@ function registerPack(pack) {
 function getLoadedRules() {
   return [...packs.values()].flatMap((p) => p.rules);
 }
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
 function isCorroborated(candidate, candidates, text) {
   const req = candidate.rule.requiresNearby;
   if (!req) return true;
@@ -23106,7 +23829,6 @@ var db_table_name_default = {
       "SELECT * FROM ",
       "SELECT COUNT(*) FROM ",
       "INSERT INTO ",
-      "UPDATE ",
       "DELETE FROM ",
       "CREATE TABLE ",
       "ALTER TABLE ",
@@ -24591,8 +25313,8 @@ function scanText(text) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join5, sep as sep2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync } from "fs";
+import { basename, dirname, isAbsolute, join as join6, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -24625,32 +25347,32 @@ function resolveRepoNwo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync2(join5(dir, ".git"))) return dir;
+    if (existsSync3(join6(dir, ".git"))) return dir;
     const parent = dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join5(root, ".git");
+  const dotGit = join6(root, ".git");
   try {
     if (statSync(dotGit).isDirectory()) {
-      return { configPath: join5(dotGit, "config"), headRoot: root };
+      return { configPath: join6(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join5(root, target);
-  if (existsSync2(join5(gitdir, "config"))) {
-    return { configPath: join5(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join6(root, target);
+  if (existsSync3(join6(gitdir, "config"))) {
+    return { configPath: join6(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join5(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join6(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join5(gitdir, commonRaw);
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join6(gitdir, commonRaw);
   const headRoot = basename(commonGitDir) === ".git" ? dirname(commonGitDir) : root;
-  return { configPath: join5(commonGitDir, "config"), headRoot };
+  return { configPath: join6(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
@@ -24767,16 +25489,57 @@ function resolveInventoryContext(input) {
 }
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
-import { basename as basename3, join as join8, relative, sep as sep3 } from "path";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { basename as basename3, join as join9, relative, sep as sep3 } from "path";
+
+// ../../packages/plugin-sdk/src/raw-egress.ts
+var RawEgressError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RawEgressError";
+  }
+};
+var MIN_RAW_LEN = 4;
+function maskContextSlice(slice, sliceStart, hits) {
+  const findings = [];
+  for (const h of hits) {
+    const start = Math.max(0, h.span.start - sliceStart);
+    const end = Math.min(slice.length, h.span.end - sliceStart);
+    if (end > start) {
+      findings.push({
+        ruleId: "raw-egress",
+        category: "secret",
+        severity: "critical",
+        span: { start, end },
+        rawMatch: "",
+        confidence: 1
+      });
+    }
+  }
+  const masked = findings.length > 0 ? redact(slice, findings) : slice;
+  for (const h of hits) {
+    if (h.rawMatch.length >= MIN_RAW_LEN && masked.includes(h.rawMatch)) {
+      throw new RawEgressError("raw match survived context masking");
+    }
+  }
+  return masked;
+}
+function safeMaskedMatch(rawMatch) {
+  const masked = maskMatch(rawMatch);
+  if (masked === rawMatch || rawMatch.length >= MIN_RAW_LEN && masked.includes(rawMatch)) {
+    return "***";
+  }
+  return masked;
+}
 
 // ../../packages/plugin-sdk/src/runtime.ts
 import { randomUUID as randomUUID10 } from "crypto";
+var ENFORCEMENT_CEILING_ENABLED = false;
 var ACTION_PRIORITY = ["block", "redact", "warn", "log", "allow"];
 function entryIsActive(entry, now) {
   if (entry.expiresAt !== null && Date.parse(entry.expiresAt) <= now) return false;
@@ -24849,17 +25612,22 @@ function createPluginRuntime(gateway, settings, opts) {
     const fallback = DEFAULT_ACTIONS[category];
     return fallback ?? "log";
   }
+  function actionForFinding(finding, excepted) {
+    if (excepted?.has(finding)) return "allow";
+    const action = resolveAction(finding.ruleId, finding.category);
+    if (ENFORCEMENT_CEILING_ENABLED && policyMode === "warn" && (action === "block" || action === "redact")) {
+      return "warn";
+    }
+    return action;
+  }
   function decide(findings, text, excepted) {
     if (findings.length === 0) return { action: "log", text, findings: [] };
-    const actionFor = (finding) => excepted?.has(finding) ? "allow" : resolveAction(finding.ruleId, finding.category);
+    const actionFor = (finding) => actionForFinding(finding, excepted);
     let worst = "log";
     for (const finding of findings) {
       const action = actionFor(finding);
       if (ACTION_PRIORITY.indexOf(action) < ACTION_PRIORITY.indexOf(worst)) worst = action;
     }
-    if (policyMode === "warn" && (worst === "block" || worst === "redact")) {
-      return { action: "warn", text, findings };
-    }
     if (worst === "block") return { action: "block", text: null, findings };
     if (worst === "redact") {
       const redactFindings = findings.filter((f) => actionFor(f) === "redact");
@@ -24879,7 +25647,7 @@ function createPluginRuntime(gateway, settings, opts) {
     const excepted = /* @__PURE__ */ new Set();
     const exceptionIds = [];
     try {
-      if (policyMode === "warn") return { excepted, exceptionIds };
+      if (ENFORCEMENT_CEILING_ENABLED && policyMode === "warn") return { excepted, exceptionIds };
       const enforced = findings.filter((f) => {
         const action = resolveAction(f.ruleId, f.category);
         return action === "block" || action === "redact";
@@ -24932,8 +25700,8 @@ function createPluginRuntime(gateway, settings, opts) {
       if (!key) return references;
       const seen = /* @__PURE__ */ new Set();
       for (const finding of decision.findings) {
-        const action = resolveAction(finding.ruleId, finding.category);
-        if (action !== "block" && action !== "redact" || excepted.has(finding)) continue;
+        const action = actionForFinding(finding, excepted);
+        if (action !== "block" && action !== "redact") continue;
         const fp = fingerprintOf(key, finding, fpCache);
         const pair = `${finding.ruleId}:${fp}`;
         if (seen.has(pair)) continue;
@@ -25022,7 +25790,7 @@ function createPluginRuntime(gateway, settings, opts) {
           severity: match.severity,
           span: match.span,
           maskedMatch,
-          actionTaken: excepted.has(match) ? "allow" : decision.action,
+          actionTaken: actionForFinding(match, excepted),
           confidence: match.confidence,
           ...findingKey ? { findingKey } : {}
         };
@@ -25050,9 +25818,12 @@ function createPluginRuntime(gateway, settings, opts) {
   return { processText, capture, rulesetFingerprint, close };
 }
 
+// ../../packages/plugin-sdk/src/suppressions.ts
+var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
 
 // ../../packages/plugin-runtime/src/standalone-gateway.ts
 import { randomUUID as randomUUID11 } from "crypto";
@@ -25245,6 +26016,14 @@ var StandaloneDataGateway = class {
   sweepTerminalExceptions(retentionMs) {
     return this.db.exceptions.sweepTerminal(retentionMs);
   }
+  // The warn-era enforcement cap, standalone-only store maintenance invoked
+  // from SessionStart, not part of the DataGateway port. Returns the number
+  // of block/redact rows capped to warn (0 for a redact-policy store or an
+  // already-capped one).
+  capWarnEraEnforcement(policyMode) {
+    const { capped } = capWarnEraEnforcementOnce(this.db, policyMode, this.dataDir);
+    return { capped };
+  }
   // One project-file scan → the local project_file tree (one transaction inside
   // the LocalDatabase, fail-open there). Like the sweep above, this is
   // NOT part of the DataGateway port: the file tree is a local-store read model.
@@ -25344,9 +26123,9 @@ var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 // src/history/transcripts.ts
 import { readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join10 } from "path";
-function transcriptsDir() {
-  return join10(homedir3(), ".claude", "projects");
+import { join as join11 } from "path";
+function transcriptsDir(home) {
+  return join11(home ?? homedir3(), ".claude", "projects");
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null;
@@ -25362,7 +26141,7 @@ function extractText(content) {
   }
   return parts.join("\n");
 }
-function parseTranscript(jsonl, sinceMs = 0) {
+function parseTranscript(jsonl, sinceMs = 0, beforeMs = Infinity, filePath = "") {
   const out = [];
   for (const line of jsonl.split("\n")) {
     const trimmed = line.trim();
@@ -25380,11 +26159,12 @@ function parseTranscript(jsonl, sinceMs = 0) {
     const occurredMs = Date.parse(occurredAt);
     if (Number.isNaN(occurredMs)) continue;
     if (sinceMs > 0 && occurredMs < sinceMs) continue;
+    if (occurredMs >= beforeMs) continue;
     const message = rec.message;
     if (!isRecord(message)) continue;
     const text = extractText(message.content);
     if (text.trim() === "") continue;
-    out.push({ kind: rec.type === "user" ? "prompt" : "response", text, occurredAt });
+    out.push({ kind: rec.type === "user" ? "prompt" : "response", text, occurredAt, filePath });
   }
   return out;
 }
@@ -25585,7 +26365,7 @@ function parseTranscriptToolCalls(jsonl, sinceMs = 0) {
   return out;
 }
 var DAY_MS5 = 24 * 60 * 60 * 1e3;
-function* iterateFileContents(dir) {
+function* iterateFileContents(dir, excludeSessionId) {
   let projects;
   try {
     projects = readdirSync3(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
@@ -25593,7 +26373,7 @@ function* iterateFileContents(dir) {
     return;
   }
   for (const project of projects) {
-    const projectDir = join10(dir, project);
+    const projectDir = join11(dir, project);
     let files;
     try {
       files = readdirSync3(projectDir).filter((name) => name.endsWith(".jsonl"));
@@ -25601,13 +26381,16 @@ function* iterateFileContents(dir) {
       continue;
     }
     for (const file2 of files) {
+      if (excludeSessionId !== void 0 && file2.slice(0, -".jsonl".length) === excludeSessionId)
+        continue;
+      const filePath = join11(projectDir, file2);
       let content;
       try {
-        content = readFileSync7(join10(projectDir, file2), "utf8");
+        content = readFileSync7(filePath, "utf8");
       } catch {
         continue;
       }
-      yield content;
+      yield { content, filePath };
     }
   }
 }
@@ -25617,12 +26400,16 @@ function windowStartMs(opts) {
 }
 function* iterateHistory(opts = {}) {
   const sinceMs = windowStartMs(opts);
-  for (const content of iterateFileContents(opts.dir ?? transcriptsDir()))
-    yield* parseTranscript(content, sinceMs);
+  const beforeMs = opts.beforeMs ?? Infinity;
+  for (const { content, filePath } of iterateFileContents(
+    opts.dir ?? transcriptsDir(),
+    opts.excludeSessionId
+  ))
+    yield* parseTranscript(content, sinceMs, beforeMs, filePath);
 }
 function* iterateUsageAndToolCalls(opts = {}) {
   const sinceMs = windowStartMs(opts);
-  for (const content of iterateFileContents(opts.dir ?? transcriptsDir())) {
+  for (const { content } of iterateFileContents(opts.dir ?? transcriptsDir())) {
     yield {
       usage: parseTranscriptUsage(content, sinceMs),
       toolCalls: parseTranscriptToolCalls(content, sinceMs)
@@ -25631,7 +26418,36 @@ function* iterateUsageAndToolCalls(opts = {}) {
 }
 
 // src/history/scan.ts
-async function scanHistory(config2, opts = {}) {
+var CONTEXT_RADIUS = 120;
+function redactOverlapping(rawContext, contextStart, others) {
+  if (others.length === 0) return rawContext;
+  try {
+    return maskContextSlice(rawContext, contextStart, others);
+  } catch {
+    let safe = rawContext;
+    for (const other of others) {
+      if (other.rawMatch.length > 0) safe = safe.split(other.rawMatch).join("[REDACTED]");
+    }
+    return safe;
+  }
+}
+function buildTriageHit(text, f, otherFindings = [], filePath = "") {
+  const start = Math.max(0, f.span.start - CONTEXT_RADIUS);
+  const end = Math.min(text.length, f.span.end + CONTEXT_RADIUS);
+  const rawContext = text.slice(start, end);
+  const overlapping = otherFindings.filter((o) => o.span.start < end && o.span.end > start);
+  return {
+    ruleId: f.ruleId,
+    category: f.category,
+    severity: f.severity,
+    maskedMatch: safeMaskedMatch(f.rawMatch),
+    rawMatch: f.rawMatch,
+    context: redactOverlapping(rawContext, start, overlapping),
+    confidence: f.confidence,
+    ...filePath !== "" ? { filePath } : {}
+  };
+}
+async function scanHistory(config2, opts = {}, onHit) {
   const windowDays = opts.windowDays ?? 30;
   if (config2.settings.historicalAccess !== "full") {
     return { consented: false, scanned: 0, skipped: 0, findings: 0, bySeverity: {}, windowDays };
@@ -25667,6 +26483,14 @@ async function scanHistory(config2, opts = {}) {
       for (const finding of result.findings) {
         findings++;
         bySeverity[finding.severity] = (bySeverity[finding.severity] ?? 0) + 1;
+        if (onHit) {
+          const otherFindings = result.findings.filter((other) => other !== finding);
+          const hit = buildTriageHit(message.text, finding, otherFindings, message.filePath);
+          try {
+            onHit(hit);
+          } catch {
+          }
+        }
       }
     }
   } finally {
@@ -25684,9 +26508,9 @@ import {
   openSync,
   readFileSync as readFileSync8,
   readSync,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
 // src/history/usage.ts
 var NO_PROJECT_CWD = "/nonexistent/aka-reconciler/no-project";
@@ -25929,25 +26753,116 @@ function fenced(body) {
 }
 
 // src/backfill.ts
-try {
-  const cfg = loadConfig();
-  if (cfg.settings.historicalAccess !== "full") {
-    process.stdout.write("Historical scan skipped \u2014 full review was not granted.\n");
-    process.exit(0);
-  }
-  const summary = await scanHistory(cfg);
+var TRIAGE_STATUSES = ["complete", "complete:no-history", "skipped:no-consent"];
+function triageSentinel(count, status) {
+  return JSON.stringify({ done: true, count, status }) + "\n";
+}
+async function runBackfill(deps) {
+  const { triage, io } = deps;
   try {
-    await reconcileHistory(cfg);
-  } catch {
-  }
-  const heading = "\u2713 Historical scan complete";
-  const scope = `Scanned ${String(summary.scanned)} messages from the last ${String(summary.windowDays)} days of Claude Code history.`;
-  const result = summary.findings > 0 ? `Found ${String(summary.findings)} pre-install finding${summary.findings === 1 ? "" : "s"} \u2014 review them with /findings.` : "No new pre-install secrets found in your history.";
-  process.stdout.write(`${fenced([heading, "", indent(scope), "", indent(result)].join("\n"))}
+    const cfg = deps.loadConfig();
+    if (cfg.settings.historicalAccess !== "full") {
+      if (triage) {
+        io.stdout(triageSentinel(0, "skipped:no-consent"));
+      } else {
+        io.stdout("Historical scan skipped \u2014 full review was not granted.\n");
+      }
+      return;
+    }
+    let fpKey = null;
+    if (triage) {
+      try {
+        fpKey = loadOrCreateFingerprintKey(cfg.dataDir);
+      } catch {
+        fpKey = null;
+      }
+    }
+    let count = 0;
+    let onHitError;
+    const summary = await deps.scanHistory(
+      cfg,
+      deps.guard ?? {},
+      triage ? (hit) => {
+        if (onHitError !== void 0) return;
+        try {
+          const enriched = {
+            ...hit,
+            id: String(count),
+            valueFingerprint: fpKey ? fingerprintValue(fpKey, hit.rawMatch) : void 0,
+            keyVersion: fpKey?.version
+          };
+          const validated = TriageHit.safeParse(enriched);
+          if (!validated.success) {
+            throw new Error("enriched triage hit failed TriageHit validation");
+          }
+          io.stdout(JSON.stringify(validated.data) + "\n");
+          count += 1;
+        } catch (err) {
+          onHitError = err;
+        }
+      } : void 0
+    );
+    if (onHitError !== void 0) {
+      throw onHitError instanceof Error ? onHitError : new Error(typeof onHitError === "string" ? onHitError : "triage stream write failed");
+    }
+    try {
+      await deps.reconcileHistory(cfg);
+    } catch {
+    }
+    if (triage) {
+      const status = summary.scanned === 0 && summary.skipped === 0 ? "complete:no-history" : "complete";
+      io.stdout(triageSentinel(count, status));
+    } else {
+      const heading = "\u2713 Historical scan complete";
+      const scope = `Scanned ${String(summary.scanned)} messages from the last ${String(summary.windowDays)} days of Claude Code history.`;
+      const result = summary.findings > 0 ? `Found ${String(summary.findings)} pre-install finding${summary.findings === 1 ? "" : "s"} \u2014 review them with /findings.` : "No new pre-install secrets found in your history.";
+      io.stdout(`${fenced([heading, "", indent(scope), "", indent(result)].join("\n"))}
 `);
-} catch {
-  process.stdout.write(
-    "AKA could not scan your history right now. It will still protect everything from here on.\n"
-  );
+    }
+  } catch (err) {
+    if (triage) {
+      io.stderr(`aka backfill --triage: history scan failed: ${String(err)}
+`);
+      io.fail();
+    } else {
+      io.stdout(
+        "AKA could not scan your history right now. It will still protect everything from here on.\n"
+      );
+    }
+  }
+}
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  const triage = process.argv.includes("--triage");
+  const startedAt = Date.now();
+  const sessionId = process.env.CLAUDE_CODE_BRIDGE_SESSION_ID;
+  await runBackfill({
+    triage,
+    io: {
+      stdout: (chunk) => process.stdout.write(chunk),
+      stderr: (chunk) => process.stderr.write(chunk),
+      fail: () => {
+        process.exitCode = 1;
+      }
+    },
+    loadConfig: () => loadConfig(),
+    scanHistory,
+    reconcileHistory: (cfg) => reconcileHistory(cfg),
+    guard: {
+      beforeMs: startedAt,
+      ...sessionId ? { excludeSessionId: sessionId } : {}
+    }
+  });
+  if (process.stdout.writableLength > 0) {
+    await new Promise((resolve) => {
+      process.stdout.write("", () => {
+        resolve();
+      });
+    });
+  }
+  process.exit(process.exitCode ?? 0);
 }
-process.exit(0);
+export {
+  TRIAGE_STATUSES,
+  runBackfill,
+  triageSentinel
+};