@akasecurity/cli 0.8.0 → 0.8.2

package/dist/cli.js

@@ -554,10 +554,10 @@ var AGENT_PLUGINS = [
     name: "Claude Code",
     sourceTool: "claude-code",
     description: "Hooks Claude Code sessions to detect + redact sensitive data in prompts, responses, and file writes.",
-    npmPackage: "@akasecurity/plugin-claude-code",
-    pluginName: "aka",
-    marketplace: "ai-tc",
-    marketplaceSource: "akasecurity/ai-tc"
+    npmPackage: "@akasecurity/ai-tc-claude-code",
+    pluginName: "ai-tc",
+    marketplace: "akasecurity",
+    marketplaceSource: "akasecurity/marketplace"
   }
 ];
 function findAgent(id) {
@@ -16109,6 +16109,11 @@ var AuditEventType = external_exports.enum([
   "prompt",
   "response",
   "code_change",
+  // The events.kind of a scanned tool call, widened in to keep this a
+  // superset. Narrower than 'tool_call' above and not a duplicate of it:
+  // 'tool_call' is the reconciler's structural row for every call, while
+  // 'tool_use' exists only where a hook enforced against the arguments.
+  "tool_use",
   // One row per config-inventory scan, hung off the session root. It is the
   // fact the posture inspection findings reference (findings require an
   // audit_event_id), and its started_at is the "scanned Nm ago" the read
@@ -16500,7 +16505,7 @@ var ActivityOverviewResponse = external_exports.object({
 }).meta({ id: "ActivityOverviewResponse" });
 
 // ../packages/schema/src/zod/event.ts
-var EventKind = external_exports.enum(["prompt", "response", "code_change"]).meta({ id: "EventKind" });
+var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
@@ -16813,7 +16818,7 @@ var DetectionException = external_exports.object({
   justification: external_exports.string().min(1),
   conditions: ExceptionConditions.nullable(),
   createdBy: external_exports.string(),
-  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api"]),
+  createdVia: external_exports.enum(["cli-approve", "cli-add", "web-approve", "web-add", "api", "setup-triage"]),
   createdAt: external_exports.iso.datetime(),
   updatedAt: external_exports.iso.datetime(),
   // Revocation is terminal and retained — consumed/expired/revoked rows are
@@ -16982,20 +16987,26 @@ var PolicyBundle = external_exports.object({
   customKeywords: external_exports.array(external_exports.string()),
   fetchedAt: external_exports.iso.datetime()
 }).meta({ id: "PolicyBundle" });
-var DEFAULT_ACTIONS = {
-  secret: "block",
-  pii: "redact",
-  financial: "redact",
-  phi: "redact",
-  code_context: "warn",
-  code_flaw: "warn",
-  custom: "warn",
-  // Config-posture findings only observe today (they land in
-  // inspection_findings, outside the live-capture enforcement path).
-  config: "warn"
-};
 var OBSERVE_ONLY_CATEGORIES = ["config"];
 var ENFORCEABLE_CATEGORIES = DetectionCategory.options.filter((c) => !OBSERVE_ONLY_CATEGORIES.includes(c));
+var CATEGORY_PEAK_SEVERITY = {
+  secret: "critical",
+  financial: "critical",
+  // core-financial/credit-card
+  code_flaw: "critical",
+  pii: "high",
+  phi: "high",
+  custom: "high",
+  // user-defined; conservative
+  code_context: "low",
+  config: "low"
+  // observe-only; floors to monitor regardless
+};
+function severityFloorPolicy(category) {
+  if (OBSERVE_ONLY_CATEGORIES.includes(category)) return "monitor";
+  const peak = CATEGORY_PEAK_SEVERITY[category];
+  return peak === "critical" || peak === "high" ? "warn" : "monitor";
+}
 var PolicyKind = external_exports.enum(["builtin", "custom"]).meta({ id: "PolicyKind" });
 var KNOWN_BUILTIN_IDS = ["monitor", "warn", "redact", "block"];
 var BuiltinPolicyId = external_exports.enum(KNOWN_BUILTIN_IDS).meta({ id: "BuiltinPolicyId" });
@@ -17022,6 +17033,12 @@ var BUILTIN_POLICY_SPECS = {
     description: "Refuse the request entirely whenever any rule in this detection matches."
   }
 };
+function builtinPolicyToAction(id) {
+  return BUILTIN_POLICY_SPECS[id].action;
+}
+var DEFAULT_ACTIONS = Object.fromEntries(
+  DetectionCategory.options.map((c) => [c, builtinPolicyToAction(severityFloorPolicy(c))])
+);
 var BUILTIN_POLICIES = Object.fromEntries(
   KNOWN_BUILTIN_IDS.map((id) => [id, { id, ...BUILTIN_POLICY_SPECS[id] }])
 );
@@ -17428,10 +17445,8 @@ function toApiProvider(sourceTool) {
   return TOOL_TO_HARNESS[sourceTool] ?? "api";
 }
 var STATUS_PRECEDENCE = ["open", "handled", "dismissed", "resolved"];
-function deriveGroupStatus(instances) {
-  const statuses = new Set(
-    instances.map((i) => i.status).filter((s) => s !== void 0)
-  );
+function foldGroupStatus(instanceStatuses) {
+  const statuses = new Set(instanceStatuses.filter((s) => s !== void 0));
   if (statuses.size === 0) return void 0;
   for (const candidate of STATUS_PRECEDENCE) {
     if (statuses.has(candidate)) return candidate;
@@ -17449,6 +17464,7 @@ function deriveFindingStatus(row) {
 function buildFindingGroups(rows, opts = {}) {
   const overrides = opts.overrides;
   const packNames = opts.packNames;
+  const aggregates = opts.aggregates;
   const byRuleId = /* @__PURE__ */ new Map();
   for (const row of rows) {
     const existing = byRuleId.get(row.ruleId);
@@ -17470,17 +17486,20 @@ function buildFindingGroups(rows, opts = {}) {
         status: r.status
       };
     });
-    const latestDetectedAt = ruleRows.reduce(
+    const agg = aggregates?.get(ruleId);
+    const latestDetectedAt = agg?.latestDetectedAt ?? ruleRows.reduce(
       (max, r) => r.occurredAt > max ? r.occurredAt : max,
       ruleRows[0]?.occurredAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
     );
     const seenProviders = /* @__PURE__ */ new Set();
-    const providers = instances.map((i) => i.provider).filter((p) => {
+    const providers = (agg ? [...new Set(agg.sourceTools.map(toApiProvider))].sort() : instances.map((i) => i.provider)).filter((p) => {
       if (seenProviders.has(p)) return false;
       seenProviders.add(p);
       return true;
     });
-    const actionSet = new Set(instances.map((i) => i.action));
+    const actionSet = new Set(
+      agg ? agg.actionsTaken.map(toApiAction) : instances.map((i) => i.action)
+    );
     const aggregateAction = actionSet.size === 1 ? [...actionSet][0] ?? null : null;
     const severity = ruleRows[0]?.severity ?? "low";
     const detection = {
@@ -17494,8 +17513,10 @@ function buildFindingGroups(rows, opts = {}) {
       contextPrefix: ""
       // empty (pending privacy review)
     };
-    const status = deriveGroupStatus(instances);
-    groups.push({
+    const status = foldGroupStatus(
+      agg ? agg.statusInputs.map(deriveFindingStatus) : instances.map((i) => i.status)
+    );
+    const group = {
       id: ruleId,
       category: apiCategory,
       subtype: ruleId,
@@ -17504,21 +17525,26 @@ function buildFindingGroups(rows, opts = {}) {
       match,
       detection,
       policy,
-      instanceCount: instances.length,
+      instanceCount: agg?.instanceCount ?? instances.length,
       providers,
       aggregateAction,
       latestDetectedAt,
       instances,
       status
-    });
+    };
+    if (agg) {
+      actionsCache.set(group, [...actionSet]);
+      if (agg.searchText !== void 0) {
+        haystackCache.set(group, buildHaystack(group, agg.searchText));
+      }
+    }
+    groups.push(group);
   }
   return groups;
 }
 var haystackCache = /* @__PURE__ */ new WeakMap();
-function groupHaystack(g) {
-  const cached2 = haystackCache.get(g);
-  if (cached2 !== void 0) return cached2;
-  const haystack = [
+function buildHaystack(g, extra) {
+  return [
     g.subtype,
     g.category,
     g.match.maskedValue,
@@ -17526,11 +17552,25 @@ function groupHaystack(g) {
     g.id,
     ...g.instances.map((i) => i.repo),
     ...g.instances.map((i) => i.file),
-    ...g.instances.map((i) => i.id)
+    ...g.instances.map((i) => i.id),
+    ...extra === void 0 ? [] : [extra]
   ].join(" ").toLowerCase();
+}
+function groupHaystack(g) {
+  const cached2 = haystackCache.get(g);
+  if (cached2 !== void 0) return cached2;
+  const haystack = buildHaystack(g);
   haystackCache.set(g, haystack);
   return haystack;
 }
+var actionsCache = /* @__PURE__ */ new WeakMap();
+function groupActions(g) {
+  const cached2 = actionsCache.get(g);
+  if (cached2 !== void 0) return cached2;
+  const actions = [...new Set(g.instances.map((i) => i.action))];
+  actionsCache.set(g, actions);
+  return actions;
+}
 function applyFindingFilters(groups, opts) {
   let filtered = groups;
   if (opts.severity && opts.severity.length > 0) {
@@ -17543,7 +17583,7 @@ function applyFindingFilters(groups, opts) {
   }
   if (opts.actions && opts.actions.length > 0) {
     const actionSet = new Set(opts.actions);
-    filtered = filtered.filter((g) => g.instances.some((i) => actionSet.has(i.action)));
+    filtered = filtered.filter((g) => groupActions(g).some((a) => actionSet.has(a)));
   }
   if (opts.subtype && opts.subtype.length > 0) {
     const subtypeSet = new Set(opts.subtype);
@@ -17595,8 +17635,7 @@ function computeFindingFacets(allGroups, opts) {
   });
   const actionMap = /* @__PURE__ */ new Map();
   for (const g of forAction) {
-    const actionSet = new Set(g.instances.map((i) => i.action));
-    for (const a of actionSet) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
+    for (const a of groupActions(g)) actionMap.set(a, (actionMap.get(a) ?? 0) + 1);
   }
   const forSubtype = applyFindingFilters(allGroups, {
     providers: opts.providers,
@@ -18158,6 +18197,36 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
+// ../packages/schema/src/zod/triage.ts
+var TriageHit = external_exports.object({
+  ruleId: external_exports.string(),
+  category: DetectionCategory,
+  severity: Severity,
+  maskedMatch: external_exports.string(),
+  rawMatch: external_exports.string(),
+  context: external_exports.string(),
+  filePath: external_exports.string().optional(),
+  confidence: external_exports.number().min(0).max(1),
+  id: external_exports.string().optional(),
+  valueFingerprint: external_exports.string().optional(),
+  keyVersion: external_exports.number().int().nonnegative().optional()
+});
+var TriagePolicy = BuiltinPolicyId;
+var TriageCategoryRec = external_exports.object({
+  category: DetectionCategory,
+  action: TriagePolicy,
+  reasoning: external_exports.string(),
+  genuineCount: external_exports.number().int().nonnegative(),
+  fpCount: external_exports.number().int().nonnegative(),
+  // TriageHit ids judged false-positive in this category. fpCount must equal
+  // this array's length — enforced by the consumer, not this schema.
+  fpIds: external_exports.array(external_exports.string())
+});
+var TriageRecommendation = external_exports.object({
+  perCategory: external_exports.array(TriageCategoryRec),
+  notes: external_exports.string()
+});
+
 // ../packages/local-ops/src/fs-scan.ts
 var import_ignore = __toESM(require_ignore(), 1);
 var AKAIGNORE_FILENAME = ".akaignore";
@@ -18281,10 +18350,9 @@ function scanPathIntoStore(db, target, opts = {}) {
   return { scanned, findings: findingCount, files };
 }
 
-// ../packages/local-ops/src/update-cache.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+// ../packages/local-ops/src/project-inventory.ts
+import { statSync as statSync5 } from "fs";
+import { resolve } from "path";
 
 // ../packages/persistence/src/database.ts
 import { randomUUID as randomUUID9 } from "crypto";
@@ -18292,31 +18360,69 @@ import { existsSync as existsSync2, renameSync, rmSync } from "fs";
 import { join as join3, sep as sep2 } from "path";
 import { DatabaseSync } from "node:sqlite";
 
-// ../packages/persistence/src/ids.ts
-import { createHash as createHash2 } from "crypto";
-function sha256Hex(input) {
-  return createHash2("sha256").update(input).digest("hex");
+// ../packages/persistence/src/internal/sql-text.ts
+function escapeLikePattern(s) {
+  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
 }
-function inventoryId(objectType, identityKey) {
-  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+function placeholders(n) {
+  return Array.from({ length: n }, () => "?").join(", ");
 }
-function sourceProjectId(url2) {
-  return sha256Hex(canonicalIdentity(["source_project", url2]));
+function containsPattern(q) {
+  return `%${escapeLikePattern(q)}%`;
 }
-function classifiedDataId(cls) {
-  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+function likeAny(exprs) {
+  return `(${exprs.map((e) => `${e} LIKE ? ESCAPE '\\'`).join(" OR ")})`;
 }
-function inspectionDefinitionId(ruleId, version2) {
-  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
+
+// ../packages/persistence/src/internal/transactions.ts
+var savepointSeq = 0;
+function withTransaction(db, fn, mode = "DEFERRED") {
+  if (db.isTransaction) {
+    const savepoint = `aka_sp_${String(savepointSeq += 1)}`;
+    db.exec(`SAVEPOINT ${savepoint}`);
+    try {
+      fn();
+      db.exec(`RELEASE ${savepoint}`);
+    } catch (error51) {
+      try {
+        db.exec(`ROLLBACK TO ${savepoint}`);
+        db.exec(`RELEASE ${savepoint}`);
+      } catch {
+      }
+      throw error51;
+    }
+    return;
+  }
+  db.exec(mode === "IMMEDIATE" ? "BEGIN IMMEDIATE" : "BEGIN");
+  try {
+    fn();
+    db.exec("COMMIT");
+  } catch (error51) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+    }
+    throw error51;
+  }
 }
-function llmCallId(sessionId, messageId) {
-  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+function failOpenTransaction(db, fn, mode = "DEFERRED") {
+  const nested = db.isTransaction;
+  try {
+    withTransaction(db, fn, mode);
+    return true;
+  } catch (error51) {
+    if (!db.isTransaction && nested) throw error51;
+    return false;
+  }
 }
-function toolCallId(sessionId, toolUseId) {
-  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+
+// ../packages/persistence/src/internal/warn.ts
+function akaWarn(message) {
+  process.stderr.write(`[aka] ${message}
+`);
 }
 
-// ../packages/persistence/src/migrations.ts
+// ../packages/persistence/src/db/migrations/introspection.ts
 function evidenceObjects(sql) {
   const objects = [];
   for (const m of sql.matchAll(/CREATE TABLE (?:IF NOT EXISTS )?`([^`]+)`/g)) {
@@ -18331,14 +18437,50 @@ function evidenceObjects(sql) {
   }
   return objects;
 }
+function schemaObjectExists(db, kind, name) {
+  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = ? AND name = ? LIMIT 1").get(kind, name);
+  return row !== void 0;
+}
+function indexExists(db, name) {
+  return schemaObjectExists(db, "index", name);
+}
+function columnNames(db, table, opts) {
+  const pragma = opts?.includeGenerated ? "table_xinfo" : "table_info";
+  const columns = db.prepare(`PRAGMA ${pragma}(${table})`).all();
+  return columns.map((c) => c.name);
+}
 function evidenceExists(db, object2) {
   if (object2.kind === "column") {
-    const columns = db.prepare(`PRAGMA table_xinfo(${object2.table})`).all();
-    return columns.some((c) => c.name === object2.name);
+    return columnNames(db, object2.table, { includeGenerated: true }).includes(object2.name);
   }
-  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ? LIMIT 1").get(object2.name);
-  return row !== void 0;
+  return schemaObjectExists(db, "table", object2.name);
+}
+
+// ../packages/persistence/src/ids.ts
+import { createHash as createHash2 } from "crypto";
+function sha256Hex(input) {
+  return createHash2("sha256").update(input).digest("hex");
+}
+function inventoryId(objectType, identityKey) {
+  return sha256Hex(canonicalIdentity(["inventory", objectType, identityKey]));
+}
+function sourceProjectId(url2) {
+  return sha256Hex(canonicalIdentity(["source_project", url2]));
+}
+function classifiedDataId(cls) {
+  return sha256Hex(canonicalIdentity(["classified_data", cls]));
+}
+function inspectionDefinitionId(ruleId, version2) {
+  return sha256Hex(canonicalIdentity(["inspection_definition", ruleId, version2]));
 }
+function llmCallId(sessionId, messageId) {
+  return sha256Hex(canonicalIdentity(["audit_event_llm_call", sessionId, messageId]));
+}
+function toolCallId(sessionId, toolUseId) {
+  return sha256Hex(canonicalIdentity(["audit_event_tool_call", sessionId, toolUseId]));
+}
+
+// ../packages/persistence/src/migrations.ts
 function describeObject(object2) {
   return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
 }
@@ -18349,10 +18491,6 @@ function createdIndexName(statement) {
   const body = statement.replace(/^(?:\s*--[^\n]*\n?)+/, "").trimStart();
   return /^CREATE (?:UNIQUE )?INDEX (?:IF NOT EXISTS )?`([^`]+)`/.exec(body)?.[1];
 }
-function indexExists(db, name) {
-  const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'index' AND name = ? LIMIT 1").get(name);
-  return row !== void 0;
-}
 function applyMigrations(db) {
   const legacyCount = db.prepare("PRAGMA user_version").get().user_version;
   db.exec(
@@ -18371,44 +18509,39 @@ function applyMigrations(db) {
     const present = evidence.filter((o) => evidenceExists(db, o));
     if (present.length > 0 && present.length < evidence.length) {
       const missing = evidence.filter((o) => !present.includes(o));
-      const message = `[aka] sqlite migration ${migration.tag} has no ledger row, but the store already has ${present.map(describeObject).join(", ")} while missing ${missing.map(describeObject).join(", ")} \u2014 the schema diverged from the migration history; refusing to replay or skip.`;
-      process.stderr.write(`${message}
-`);
-      throw new Error(message);
+      const message = `sqlite migration ${migration.tag} has no ledger row, but the store already has ${present.map(describeObject).join(", ")} while missing ${missing.map(describeObject).join(", ")} \u2014 the schema diverged from the migration history; refusing to replay or skip.`;
+      akaWarn(message);
+      throw new Error(`[aka] ${message}`);
     }
     const alreadyApplied = evidence.length > 0 ? present.length === evidence.length : preLedgerStore && index < legacyCount;
     const wantsFkOff = /PRAGMA foreign_keys\s*=\s*OFF/i.test(migration.sql);
     const statements = splitStatements(migration.sql);
     if (wantsFkOff) db.exec("PRAGMA foreign_keys = OFF");
     try {
-      db.exec("BEGIN IMMEDIATE");
-      try {
-        for (const statement of statements) {
-          const indexName = createdIndexName(statement);
-          if (indexName === void 0) {
-            if (alreadyApplied) continue;
-          } else if (indexExists(db, indexName)) {
-            continue;
+      withTransaction(
+        db,
+        () => {
+          for (const statement of statements) {
+            const indexName = createdIndexName(statement);
+            if (indexName === void 0) {
+              if (alreadyApplied) continue;
+            } else if (indexExists(db, indexName)) {
+              continue;
+            }
+            db.exec(statement);
           }
-          db.exec(statement);
-        }
-        if (wantsFkOff && !alreadyApplied) {
-          const violations = db.prepare("PRAGMA foreign_key_check").all();
-          if (violations.length > 0) {
-            throw new Error(
-              `[aka] sqlite migration ${migration.tag} left ${String(violations.length)} foreign-key violation(s); rolling back.`
-            );
+          if (wantsFkOff && !alreadyApplied) {
+            const violations = db.prepare("PRAGMA foreign_key_check").all();
+            if (violations.length > 0) {
+              throw new Error(
+                `[aka] sqlite migration ${migration.tag} left ${String(violations.length)} foreign-key violation(s); rolling back.`
+              );
+            }
           }
-        }
-        record2.run(migration.tag, Date.now());
-        db.exec("COMMIT");
-      } catch (error51) {
-        try {
-          db.exec("ROLLBACK");
-        } catch {
-        }
-        throw error51;
-      }
+          record2.run(migration.tag, Date.now());
+        },
+        "IMMEDIATE"
+      );
     } finally {
       if (wantsFkOff) db.exec("PRAGMA foreign_keys = ON");
     }
@@ -18451,8 +18584,7 @@ var TOKEN_USAGE_COLUMNS = [
   }
 ];
 function ensureTokenUsageColumns(db) {
-  const columns = db.prepare("PRAGMA table_xinfo(audit_events)").all();
-  const existing = new Set(columns.map((c) => c.name));
+  const existing = new Set(columnNames(db, "audit_events", { includeGenerated: true }));
   for (const column of TOKEN_USAGE_COLUMNS) {
     if (!existing.has(column.name)) {
       db.exec(column.ddl);
@@ -18490,47 +18622,39 @@ function reconcileSourceProjectIds(db) {
       repoint: db.prepare(`UPDATE ${table} SET project_id = ? WHERE project_id = ?`)
     }));
     const deleteLegacy = db.prepare("DELETE FROM source_project WHERE id = ?");
-    db.exec("BEGIN IMMEDIATE");
-    try {
-      for (const { row, canonicalId } of legacy) {
-        foldProject.run(
-          canonicalId,
-          row.url,
-          row.name,
-          row.attributes,
-          row.firstSeen,
-          row.lastSeen
-        );
-        repointAudit.run(canonicalId, row.id);
-        for (const { dropCollisions, repoint } of pathTables) {
-          dropCollisions.run(row.id, canonicalId);
-          repoint.run(canonicalId, row.id);
+    withTransaction(
+      db,
+      () => {
+        for (const { row, canonicalId } of legacy) {
+          foldProject.run(
+            canonicalId,
+            row.url,
+            row.name,
+            row.attributes,
+            row.firstSeen,
+            row.lastSeen
+          );
+          repointAudit.run(canonicalId, row.id);
+          for (const { dropCollisions, repoint } of pathTables) {
+            dropCollisions.run(row.id, canonicalId);
+            repoint.run(canonicalId, row.id);
+          }
+          repointCallSite.run(canonicalId, row.id);
+          deleteLegacy.run(row.id);
         }
-        repointCallSite.run(canonicalId, row.id);
-        deleteLegacy.run(row.id);
-      }
-      db.exec("COMMIT");
-    } catch (error51) {
-      try {
-        db.exec("ROLLBACK");
-      } catch {
-      }
-      throw error51;
-    }
+      },
+      "IMMEDIATE"
+    );
   } catch (error51) {
-    process.stderr.write(`[aka] source_project id reconcile failed: ${String(error51)}
-`);
+    akaWarn(`source_project id reconcile failed: ${String(error51)}`);
   }
 }
 function isForeignSqliteLineage(db) {
-  const tenantsTable = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'tenants' LIMIT 1").get();
-  if (tenantsTable !== void 0) return true;
-  const eventsColumns = db.prepare("PRAGMA table_info(events)").all();
-  return eventsColumns.some((c) => c.name === "tenant_id");
+  if (schemaObjectExists(db, "table", "tenants")) return true;
+  return columnNames(db, "events").includes("tenant_id");
 }
 function ensureSyncedAtColumn(db, table) {
-  const columns = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (!columns.some((c) => c.name === "synced_at")) {
+  if (!columnNames(db, table).includes("synced_at")) {
     db.exec(`ALTER TABLE ${table} ADD COLUMN synced_at integer`);
   }
 }
@@ -18581,8 +18705,11 @@ function ensureDataDirSync(dir) {
   } catch {
   }
 }
+function walSidecars(file2) {
+  return [`${file2}-wal`, `${file2}-shm`];
+}
 function tightenPerms(file2) {
-  for (const path of [file2, `${file2}-wal`, `${file2}-shm`]) {
+  for (const path of [file2, ...walSidecars(file2)]) {
     try {
       chmodSync(path, DATA_FILE_MODE);
     } catch {
@@ -18590,12 +18717,68 @@ function tightenPerms(file2) {
   }
 }
 
-// ../packages/persistence/src/repositories/sql-utils.ts
-function escapeLikePattern(s) {
-  return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+// ../packages/persistence/src/internal/json.ts
+function safeJson(s, fallback) {
+  if (s == null) return fallback;
+  try {
+    return JSON.parse(s);
+  } catch {
+    return fallback;
+  }
 }
-function placeholders(n) {
-  return Array.from({ length: n }, () => "?").join(", ");
+function parseJsonObject(s) {
+  if (s == null) return void 0;
+  try {
+    const parsed = JSON.parse(s);
+    if (typeof parsed === "object" && parsed !== null) return parsed;
+  } catch {
+  }
+  return void 0;
+}
+
+// ../packages/persistence/src/internal/rows.ts
+function allRows(stmt, params) {
+  if (params === void 0) return stmt.all();
+  if (Array.isArray(params)) return stmt.all(...params);
+  return stmt.all(params);
+}
+function getRow(stmt, params) {
+  if (params === void 0) return stmt.get();
+  if (Array.isArray(params)) return stmt.get(...params);
+  return stmt.get(params);
+}
+function intToBool(raw) {
+  return raw === 1 || raw === true;
+}
+function boolToInt(b) {
+  return b ? 1 : 0;
+}
+function bindParams(row) {
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    out[key] = value === void 0 ? null : value;
+  }
+  return out;
+}
+function countScalar(db, sql, params) {
+  return getRow(db.prepare(sql), params)?.n ?? 0;
+}
+function countBy(db, sql, params) {
+  const map2 = /* @__PURE__ */ new Map();
+  for (const row of allRows(db.prepare(sql), params)) {
+    map2.set(row.k, row.n);
+  }
+  return map2;
+}
+function mapRowsTolerant(rows, map2) {
+  const out = [];
+  for (const row of rows) {
+    try {
+      out.push(map2(row));
+    } catch {
+    }
+  }
+  return out;
 }
 
 // ../packages/persistence/src/repositories/activity.ts
@@ -18647,15 +18830,11 @@ function encodeCursor(payload) {
   return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
 function decodeCursor(cursor) {
-  try {
-    const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
-    if (parsed !== null && typeof parsed === "object" && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
-      return parsed;
-    }
-    return null;
-  } catch {
-    return null;
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
+    return parsed;
   }
+  return null;
 }
 var DB_EVENT_TYPE_TO_KIND = {
   session: "session",
@@ -18672,15 +18851,8 @@ var DB_EVENT_TYPE_TO_KIND = {
 };
 function safeParseStringArray(raw) {
   if (!raw) return [];
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
-}
-function toBool(raw) {
-  return raw === 1 || raw === true;
+  const parsed = safeJson(raw, null);
+  return Array.isArray(parsed) ? parsed : [];
 }
 function toHarness(raw) {
   const parsed = Harness.safeParse(raw);
@@ -18733,8 +18905,8 @@ function buildAuditEvent(row) {
     severity: severityParsed?.success ? severityParsed.data : null,
     link: linkParsed?.success ? linkParsed.data : null,
     targetId: row.target_id,
-    internal: toBool(row.internal),
-    flagged: toBool(row.flagged)
+    internal: intToBool(row.internal),
+    flagged: intToBool(row.flagged)
   };
 }
 var TIMELINE_COLUMNS = `
@@ -18760,12 +18932,15 @@ var SqliteActivityRepository = class {
   stats(tz) {
     const window = todayWindow(tz ?? defaultTimeZone(), this.now());
     const { startMs, endMs } = window;
-    const sessionsToday = this.db.prepare(
+    const sessionsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE ${SESSION_ROOT} AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
+           WHERE ${SESSION_ROOT} AND started_at >= ? AND started_at < ?`,
+      [startMs, endMs]
+    );
     const liveThreshold = this.now() - LIVE_ACTIVITY_WINDOW_MS;
-    const liveNow = this.db.prepare(
+    const liveNow = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events s
            WHERE s.event_type = 'session' AND s.ended_at IS NULL
              AND max(
@@ -18774,22 +18949,29 @@ var SqliteActivityRepository = class {
                  (SELECT max(${LAST_ACTIVITY_EXPR}) FROM audit_events e WHERE e.root_session_id = s.id),
                  s.started_at
                )
-             ) >= ?`
-    ).get(liveThreshold).n;
-    const toolCallsToday = this.db.prepare(
+             ) >= ?`,
+      [liveThreshold]
+    );
+    const toolCallsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE event_type = 'tool_call' AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
-    const findingsToday = this.db.prepare(
+           WHERE event_type = 'tool_call' AND started_at >= ? AND started_at < ?`,
+      [startMs, endMs]
+    );
+    const findingsToday = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM inspection_findings f
            JOIN audit_events e ON e.id = f.audit_event_id
-           WHERE e.started_at >= ? AND e.started_at < ?`
-    ).get(startMs, endMs).n;
-    const egressToday = this.db.prepare(
+           WHERE e.started_at >= ? AND e.started_at < ?`,
+      [startMs, endMs]
+    );
+    const egressToday = countScalar(
+      this.db,
       `SELECT count(DISTINCT json_extract(attributes, '$.destination')) AS n
            FROM audit_events
-           WHERE event_type = 'share' AND started_at >= ? AND started_at < ?`
-    ).get(startMs, endMs).n;
+           WHERE event_type = 'share' AND started_at >= ? AND started_at < ?`,
+      [startMs, endMs]
+    );
     return Promise.resolve({ sessionsToday, liveNow, toolCallsToday, findingsToday, egressToday });
   }
   listSessions(query) {
@@ -18811,7 +18993,7 @@ var SqliteActivityRepository = class {
     conditions.push("started_at <= ?");
     params.push(toMs);
     if (query.q) {
-      const pattern = `%${escapeLikePattern(query.q)}%`;
+      const pattern = containsPattern(query.q);
       conditions.push(
         `(content LIKE ? ESCAPE '\\'
           OR json_extract(attributes, '$.project') LIKE ? ESCAPE '\\'
@@ -18830,8 +19012,9 @@ var SqliteActivityRepository = class {
       params.push(cursor.startedAtMs, cursor.startedAtMs, cursor.id);
     }
     const limit = query.limit;
-    const rows = this.db.prepare(
-      `SELECT id,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id,
                 json_extract(attributes, '$.harness') AS harness,
                 content AS title,
                 json_extract(attributes, '$.project') AS project,
@@ -18844,7 +19027,9 @@ var SqliteActivityRepository = class {
          WHERE ${conditions.join(" AND ")}
          ORDER BY started_at DESC, id DESC
          LIMIT ?`
-    ).all(...params, limit + 1);
+      ),
+      [...params, limit + 1]
+    );
     const hasMore = rows.length > limit;
     const page = hasMore ? rows.slice(0, limit) : rows;
     const rollups = this.rollupsFor(page.map((r) => r.id));
@@ -18861,8 +19046,9 @@ var SqliteActivityRepository = class {
     return Promise.resolve({ items, nextCursor });
   }
   getSession(sessionId) {
-    const rootRow = this.db.prepare(
-      `SELECT id,
+    const rootRow = getRow(
+      this.db.prepare(
+        `SELECT id,
                 json_extract(attributes, '$.harness') AS harness,
                 content AS title,
                 json_extract(attributes, '$.project') AS project,
@@ -18879,47 +19065,66 @@ var SqliteActivityRepository = class {
          FROM audit_events
          WHERE id = ? AND event_type = 'session'
          LIMIT 1`
-    ).get(sessionId);
+      ),
+      [sessionId]
+    );
     if (!rootRow) return Promise.resolve(null);
-    const timelineRows = this.db.prepare(
-      `SELECT ${TIMELINE_COLUMNS}
+    const timelineRows = allRows(
+      this.db.prepare(
+        `SELECT ${TIMELINE_COLUMNS}
          FROM audit_events
          WHERE id = ? OR root_session_id = ?
          ORDER BY started_at ASC, id ASC`
-    ).all(sessionId, sessionId);
+      ),
+      [sessionId, sessionId]
+    );
     const events = timelineRows.map(buildAuditEvent).filter((e) => e !== null);
-    const tokenRow = this.db.prepare(
-      `SELECT
+    const tokenRow = getRow(
+      this.db.prepare(
+        `SELECT
            coalesce(sum(input_tokens), 0) AS input,
            coalesce(sum(output_tokens), 0) AS output,
            coalesce(sum(cache_creation_input_tokens), 0) AS cache_creation,
            coalesce(sum(cache_read_input_tokens), 0) AS cache_read
          FROM audit_events
          WHERE root_session_id = ? AND event_type = 'llm_call'`
-    ).get(sessionId);
-    const primaryModel = this.db.prepare(
-      `SELECT model, provider FROM audit_events
+      ),
+      [sessionId]
+    ) ?? { input: 0, output: 0, cache_creation: 0, cache_read: 0 };
+    const primaryModel = getRow(
+      this.db.prepare(
+        `SELECT model, provider FROM audit_events
          WHERE root_session_id = ? AND event_type = 'llm_call'
          ORDER BY started_at ASC, id ASC
          LIMIT 1`
-    ).get(sessionId);
-    const toolRows = this.db.prepare(
-      `SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
+      ),
+      [sessionId]
+    );
+    const toolRows = allRows(
+      this.db.prepare(
+        `SELECT coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool')) AS tool,
                 count(*) AS n
          FROM audit_events
          WHERE root_session_id = ? AND event_type = 'tool_call'
          GROUP BY coalesce(json_extract(attributes, '$.tool_name'), json_extract(attributes, '$.tool'))`
-    ).all(sessionId);
-    const modelRows = this.db.prepare(
-      `SELECT DISTINCT model FROM audit_events
+      ),
+      [sessionId]
+    );
+    const modelRows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT model FROM audit_events
          WHERE root_session_id = ? AND event_type = 'llm_call' AND model IS NOT NULL AND model <> ''
          ORDER BY model`
-    ).all(sessionId);
+      ),
+      [sessionId]
+    );
     const derivedModels = modelRows.map((r) => r.model);
-    const commits = this.db.prepare(
+    const commits = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM audit_events
-           WHERE root_session_id = ? AND event_type = 'commit'`
-    ).get(sessionId).n;
+           WHERE root_session_id = ? AND event_type = 'commit'`,
+      [sessionId]
+    );
     const rollup = this.rollupsFor([sessionId]).get(sessionId) ?? {
       turns: 0,
       findings: 0,
@@ -18986,7 +19191,10 @@ var SqliteActivityRepository = class {
       `SELECT DISTINCT coalesce(json_extract(attributes, '$.harness'), 'claudecode') AS harness
          FROM audit_events WHERE ${SESSION_ROOT}${where}`
     );
-    const rows = fromMs === void 0 ? stmt.all() : stmt.all(fromMs);
+    const rows = allRows(
+      stmt,
+      fromMs === void 0 ? void 0 : [fromMs]
+    );
     const seen = /* @__PURE__ */ new Set();
     for (const row of rows) seen.add(toHarness(row.harness));
     return Promise.resolve([...seen]);
@@ -19009,23 +19217,23 @@ var SqliteActivityRepository = class {
       conditions.push("started_at >= ?");
       params.push(opts.fromMs);
     }
-    const rows = this.db.prepare(
-      `SELECT root_session_id AS sessionId, attributes
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS sessionId, attributes
            FROM audit_events
           WHERE ${conditions.join(" AND ")}`
-    ).all(...params);
-    const leaves = [];
-    for (const row of rows) {
-      if (row.sessionId === null) continue;
-      try {
-        leaves.push({
-          sessionId: row.sessionId,
-          attributes: JSON.parse(row.attributes)
-        });
-      } catch {
-      }
-    }
-    return leaves;
+      ),
+      params
+    );
+    return mapRowsTolerant(
+      rows.filter(
+        (row) => row.sessionId !== null
+      ),
+      (row) => ({
+        sessionId: row.sessionId,
+        attributes: JSON.parse(row.attributes)
+      })
+    );
   }
   /**
    * Per-session turns/findings/shares + last-activity for a page of session ids,
@@ -19039,57 +19247,72 @@ var SqliteActivityRepository = class {
     );
     if (sessionIds.length === 0) return result;
     const inClause = placeholders(sessionIds.length);
-    const lastActivityRows = this.db.prepare(
-      `SELECT root_session_id AS id, max(${LAST_ACTIVITY_EXPR}) AS m FROM audit_events
+    const lastActivityRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id, max(${LAST_ACTIVITY_EXPR}) AS m FROM audit_events
          WHERE root_session_id IN (${inClause})
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of lastActivityRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry && row.m !== null) entry.lastActivityMs = row.m;
     }
-    const turnsRows = this.db.prepare(
-      `SELECT root_session_id AS id, count(*) AS n FROM audit_events
+    const turnsRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id, count(*) AS n FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'prompt'
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of turnsRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.turns = row.n;
     }
-    const runKeyRows = this.db.prepare(
-      `SELECT root_session_id AS id,
+    const runKeyRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id,
                 count(DISTINCT json_extract(attributes, '$.run_key')) AS n
          FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'llm_call'
            AND json_extract(attributes, '$.run_key') IS NOT NULL
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of runKeyRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.turns = Math.max(entry.turns, row.n);
     }
-    const findingsRows = this.db.prepare(
-      `SELECT e.root_session_id AS id, count(*) AS n FROM inspection_findings f
+    const findingsRows = allRows(
+      this.db.prepare(
+        `SELECT e.root_session_id AS id, count(*) AS n FROM inspection_findings f
          JOIN audit_events e ON e.id = f.audit_event_id
          WHERE e.root_session_id IN (${inClause})
          GROUP BY e.root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of findingsRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
       if (entry) entry.findings = row.n;
     }
-    const sharesRows = this.db.prepare(
-      `SELECT root_session_id AS id,
+    const sharesRows = allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS id,
                 count(DISTINCT json_extract(attributes, '$.destination')) AS n
          FROM audit_events
          WHERE root_session_id IN (${inClause}) AND event_type = 'share'
          GROUP BY root_session_id`
-    ).all(...sessionIds);
+      ),
+      sessionIds
+    );
     for (const row of sharesRows) {
       if (row.id === null) continue;
       const entry = result.get(row.id);
@@ -19139,33 +19362,28 @@ var SqliteAuditEventsRepository = class {
   // the caller fails open and drops the whole pass — recovered idempotently on the
   // next pass. Nesting-safe is NOT needed: the reconciler is the sole caller.
   runInTransaction(fn) {
-    this.db.exec("BEGIN");
-    try {
-      fn();
-      this.db.exec("COMMIT");
-    } catch (err) {
-      this.db.exec("ROLLBACK");
-      throw err;
-    }
+    withTransaction(this.db, fn);
   }
   insertAuditEvent(input) {
     const row = toAuditEventRow(input);
-    this.insertStmt.run({
-      id: row.id,
-      parentId: row.parentId ?? null,
-      rootSessionId: row.rootSessionId ?? null,
-      eventType: row.eventType,
-      hostId: row.hostId ?? null,
-      harnessId: row.harnessId ?? null,
-      sourceProjectId: row.sourceProjectId ?? null,
-      startedAt: row.startedAt,
-      endedAt: row.endedAt ?? null,
-      severity: row.severity ?? null,
-      priority: row.priority ?? null,
-      content: row.content ?? null,
-      contentHash: row.contentHash ?? null,
-      attributes: row.attributes ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        parentId: row.parentId,
+        rootSessionId: row.rootSessionId,
+        eventType: row.eventType,
+        hostId: row.hostId,
+        harnessId: row.harnessId,
+        sourceProjectId: row.sourceProjectId,
+        startedAt: row.startedAt,
+        endedAt: row.endedAt,
+        severity: row.severity,
+        priority: row.priority,
+        content: row.content,
+        contentHash: row.contentHash,
+        attributes: row.attributes
+      })
+    );
   }
   // Insert one transcript-derived `llm_call` leaf. Unlike `insertAuditEvent`
   // (which takes a caller-supplied random id), the id here is MINTED internally
@@ -19179,22 +19397,24 @@ var SqliteAuditEventsRepository = class {
     const startedAt = isoToEpochMillis(input.startedAt);
     if (!Number.isFinite(startedAt)) return;
     const id = llmCallId(input.sessionId, input.messageId);
-    this.upsertLlmCallStmt.run({
-      id,
-      parentId: input.parentId,
-      rootSessionId: input.rootSessionId,
-      eventType: "llm_call",
-      hostId: null,
-      harnessId: null,
-      sourceProjectId: null,
-      startedAt,
-      endedAt: null,
-      severity: null,
-      priority: null,
-      content: null,
-      contentHash: null,
-      attributes: JSON.stringify(input.attributes)
-    });
+    this.upsertLlmCallStmt.run(
+      bindParams({
+        id,
+        parentId: input.parentId,
+        rootSessionId: input.rootSessionId,
+        eventType: "llm_call",
+        hostId: null,
+        harnessId: null,
+        sourceProjectId: null,
+        startedAt,
+        endedAt: null,
+        severity: null,
+        priority: null,
+        content: null,
+        contentHash: null,
+        attributes: JSON.stringify(input.attributes)
+      })
+    );
   }
   // Insert one transcript-derived `tool_call` leaf. Like `insertLlmCall` the id is
   // MINTED internally from the natural key — `toolCallId(sessionId, toolUseId)` —
@@ -19218,25 +19438,29 @@ var SqliteAuditEventsRepository = class {
     const startedAt = isoToEpochMillis(input.startedAt);
     if (!Number.isFinite(startedAt)) return;
     const id = toolCallId(input.sessionId, input.toolUseId);
-    this.insertStmt.run({
-      id,
-      parentId: input.parentId,
-      rootSessionId: input.rootSessionId,
-      eventType: "tool_call",
-      hostId: null,
-      harnessId: null,
-      sourceProjectId: null,
-      startedAt,
-      endedAt: null,
-      severity: null,
-      priority: null,
-      content: null,
-      contentHash: null,
-      attributes: JSON.stringify(input.attributes)
-    });
+    this.insertStmt.run(
+      bindParams({
+        id,
+        parentId: input.parentId,
+        rootSessionId: input.rootSessionId,
+        eventType: "tool_call",
+        hostId: null,
+        harnessId: null,
+        sourceProjectId: null,
+        startedAt,
+        endedAt: null,
+        severity: null,
+        priority: null,
+        content: null,
+        contentHash: null,
+        attributes: JSON.stringify(input.attributes)
+      })
+    );
   }
   findById(id) {
-    return this.db.prepare("SELECT * FROM audit_events WHERE id = :id").get({ id });
+    return getRow(this.db.prepare("SELECT * FROM audit_events WHERE id = :id"), {
+      id
+    });
   }
   // Read the `provider` snapshotted onto a session root's attributes.
   // The reconciler ensures the root, then reads provider back from it — SessionStart's
@@ -19246,14 +19470,8 @@ var SqliteAuditEventsRepository = class {
   sessionProvider(sessionId) {
     const row = this.findById(sessionId);
     if (!row?.attributes) return void 0;
-    try {
-      const parsed = JSON.parse(row.attributes);
-      if (typeof parsed === "object" && parsed !== null) {
-        const provider = parsed.provider;
-        if (typeof provider === "string") return provider;
-      }
-    } catch {
-    }
+    const provider = parseJsonObject(row.attributes)?.provider;
+    if (typeof provider === "string") return provider;
     return void 0;
   }
   // Every `llm_call` leaf's session id + raw attribute bag, for the read-time token
@@ -19262,11 +19480,13 @@ var SqliteAuditEventsRepository = class {
   // is the leaf's session (the reconciler sets parent_id = root_session_id = sessionId);
   // rows whose attributes blob is NULL are skipped (nothing to roll up).
   llmCallLeaves() {
-    return this.db.prepare(
-      `SELECT root_session_id AS sessionId, attributes
+    return allRows(
+      this.db.prepare(
+        `SELECT root_session_id AS sessionId, attributes
            FROM audit_events
           WHERE event_type = 'llm_call' AND attributes IS NOT NULL`
-    ).all();
+      )
+    );
   }
 };
 
@@ -19285,16 +19505,29 @@ var SqliteClassifiedDataRepository = class {
   upsert(input) {
     const id = classifiedDataId(input.class);
     const row = toClassifiedDataRow(input, id);
-    this.insertStmt.run({
-      id: row.id,
-      class: row.class,
-      label: row.label ?? null,
-      attributes: row.attributes ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        class: row.class,
+        label: row.label,
+        attributes: row.attributes
+      })
+    );
     return id;
   }
 };
 
+// ../packages/persistence/src/repositories/config-scan.ts
+function latestConfigScan(db) {
+  return getRow(
+    db.prepare(
+      `SELECT id, started_at, attributes FROM audit_events
+          WHERE event_type = 'config_scan'
+          ORDER BY started_at DESC, id DESC LIMIT 1`
+    )
+  );
+}
+
 // ../packages/persistence/src/repositories/config-inventory.ts
 var SqliteConfigInventoryRepository = class {
   constructor(db) {
@@ -19302,7 +19535,7 @@ var SqliteConfigInventoryRepository = class {
   }
   db;
   report() {
-    const scan2 = this.latestScan();
+    const scan2 = latestConfigScan(this.db);
     if (!scan2) {
       return {
         scannedAt: null,
@@ -19313,17 +19546,23 @@ var SqliteConfigInventoryRepository = class {
         topics: []
       };
     }
-    const rows = this.db.prepare(
-      `SELECT id, object_type AS objectType, title, location, attributes FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, object_type AS objectType, title, location, attributes FROM inventory
           WHERE object_type IN ('skill', 'hook', 'mcp_server', 'config_file') AND last_seen >= :startedAt
           ORDER BY object_type, title`
-    ).all({ startedAt: scan2.started_at });
-    const findings = this.db.prepare(
-      `SELECT f.masked_match AS maskedMatch, d.rule_id AS ruleId, d.name AS name
+      ),
+      { startedAt: scan2.started_at }
+    );
+    const findings = allRows(
+      this.db.prepare(
+        `SELECT f.masked_match AS maskedMatch, d.rule_id AS ruleId, d.name AS name
            FROM inspection_findings f
            JOIN inspection_definitions d ON d.id = f.inspection_definition_id
           WHERE f.audit_event_id = :scanId`
-    ).all({ scanId: scan2.id });
+      ),
+      { scanId: scan2.id }
+    );
     const skills = [];
     const hooks = [];
     const mcpServers = [];
@@ -19352,7 +19591,9 @@ var SqliteConfigInventoryRepository = class {
   // schema note); an override whose asset is gone simply never matches. A row
   // with an out-of-vocabulary trust value is ignored rather than guessed at.
   trustOverrides() {
-    const rows = this.db.prepare("SELECT asset_id AS assetId, trust FROM mcp_trust_override").all();
+    const rows = allRows(
+      this.db.prepare("SELECT asset_id AS assetId, trust FROM mcp_trust_override")
+    );
     const map2 = /* @__PURE__ */ new Map();
     for (const row of rows) {
       if (row.trust === "known-good" || row.trust === "risky" || row.trust === "unapproved") {
@@ -19361,13 +19602,6 @@ var SqliteConfigInventoryRepository = class {
     }
     return map2;
   }
-  latestScan() {
-    return this.db.prepare(
-      `SELECT id, started_at, attributes FROM audit_events
-          WHERE event_type = 'config_scan'
-          ORDER BY started_at DESC, id DESC LIMIT 1`
-    ).get();
-  }
 };
 function toSkillItem(row, bag) {
   const item = {
@@ -19478,22 +19712,11 @@ function buildTopics(skills, hooks, mcpServers, configFiles, scanAttributes) {
   return topics;
 }
 function countScanErrors(attributes) {
-  if (!attributes) return 0;
-  try {
-    const parsed = JSON.parse(attributes);
-    const errors = parsed?.errors;
-    return typeof errors === "number" ? errors : 0;
-  } catch {
-    return 0;
-  }
+  const errors = parseJsonObject(attributes)?.errors;
+  return typeof errors === "number" ? errors : 0;
 }
 function parseBag(raw) {
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null) return parsed;
-  } catch {
-  }
-  return void 0;
+  return parseJsonObject(raw);
 }
 function str(value) {
   return typeof value === "string" ? value : void 0;
@@ -19502,12 +19725,7 @@ function str(value) {
 // ../packages/persistence/src/repositories/detections.ts
 var DAY_MS2 = 864e5;
 function parseRules(rulesJson) {
-  let raw;
-  try {
-    raw = JSON.parse(rulesJson);
-  } catch {
-    return [];
-  }
+  const raw = safeJson(rulesJson, []);
   if (!Array.isArray(raw)) return [];
   const rules = [];
   for (const entry of raw) {
@@ -19526,11 +19744,13 @@ var SqliteDetectionsRepository = class {
   db;
   now;
   listDetections(query) {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
                 rules_json AS rulesJson
          FROM installed_packs`
-    ).all();
+      )
+    );
     const available = this.availableByPack();
     const summaries = rows.map((r) => {
       const latest = available.get(`${r.namespace}/${r.packId}`);
@@ -19539,7 +19759,7 @@ var SqliteDetectionsRepository = class {
         packId: r.packId,
         version: r.version,
         name: r.name,
-        enabled: r.enabled === 1,
+        enabled: intToBool(r.enabled),
         // Count rules in JS via the tolerant parse rather than SQL json_array_length,
         // which THROWS "malformed JSON" on a corrupt/foreign rules_json and would
         // crash the whole list. This also keeps ruleCount identical to the detail
@@ -19556,19 +19776,23 @@ var SqliteDetectionsRepository = class {
   // available_packs keyed by the "namespace/packId" slug (one read per list /
   // detail call; the table is a handful of rows).
   availableByPack() {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson
          FROM available_packs`
-    ).all();
+      )
+    );
     return new Map(rows.map((r) => [`${r.namespace}/${r.packId}`, r]));
   }
   getDetectionStats() {
-    const rows = this.db.prepare("SELECT enabled, rules_json AS rulesJson FROM installed_packs").all();
+    const rows = allRows(
+      this.db.prepare("SELECT enabled, rules_json AS rulesJson FROM installed_packs")
+    );
     let rules = 0;
     let active = 0;
     const ruleIds = /* @__PURE__ */ new Set();
     for (const r of rows) {
-      if (r.enabled === 1) active += 1;
+      if (intToBool(r.enabled)) active += 1;
       const parsed = parseRules(r.rulesJson);
       rules += parsed.length;
       for (const rule of parsed) {
@@ -19586,12 +19810,15 @@ var SqliteDetectionsRepository = class {
     const parts = splitDetectionId(id);
     if (!parts) return Promise.resolve(null);
     const { namespace, packId } = parts;
-    const row = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, name, enabled, policy_id AS policyId,
                 rules_json AS rulesJson, updated_at AS updatedAt
          FROM installed_packs
          WHERE namespace = ? AND pack_id = ?`
-    ).get(namespace, packId);
+      ),
+      [namespace, packId]
+    );
     if (!row) return Promise.resolve(null);
     const rules = parseRules(row.rulesJson);
     const ruleIds = rules.map((r) => r.id).filter((id2) => typeof id2 === "string");
@@ -19609,7 +19836,7 @@ var SqliteDetectionsRepository = class {
           packId: row.packId,
           version: row.version,
           name: row.name,
-          enabled: row.enabled === 1,
+          enabled: intToBool(row.enabled),
           rules,
           updatedAt: new Date(row.updatedAt),
           policyId: row.policyId
@@ -19624,13 +19851,14 @@ var SqliteDetectionsRepository = class {
   countFindingsLast30d(ruleIds) {
     if (ruleIds.length === 0) return 0;
     const since = this.now() - 30 * DAY_MS2;
-    const placeholders2 = ruleIds.map(() => "?").join(", ");
-    const row = this.db.prepare(
-      `SELECT count(*) AS c
+    const inClause = placeholders(ruleIds.length);
+    return countScalar(
+      this.db,
+      `SELECT count(*) AS n
          FROM findings f JOIN events e ON e.id = f.event_id
-         WHERE e.occurred_at >= ? AND f.rule_id IN (${placeholders2})`
-    ).get(since, ...ruleIds);
-    return row.c;
+         WHERE e.occurred_at >= ? AND f.rule_id IN (${inClause})`,
+      [since, ...ruleIds]
+    );
   }
 };
 
@@ -19647,16 +19875,17 @@ var SqliteEventsRepository = class {
   insertStmt;
   insertEvent(event) {
     const row = toEventRow(event);
-    this.insertStmt.run({
-      id: row.id,
-      sourceTool: row.sourceTool,
-      kind: row.kind,
-      occurredAt: row.occurredAt,
-      contentHash: row.contentHash,
-      content: row.content,
-      // exactOptionalPropertyTypes: the column is nullable, never undefined.
-      metadata: row.metadata ?? null
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        sourceTool: row.sourceTool,
+        kind: row.kind,
+        occurredAt: row.occurredAt,
+        contentHash: row.contentHash,
+        content: row.content,
+        metadata: row.metadata
+      })
+    );
   }
   // Every recorded event's content hash — the historical backfill loads this once
   // to skip transcript messages it has already stored, so re-running the scan
@@ -19664,13 +19893,23 @@ var SqliteEventsRepository = class {
   // Async (Promise.resolve over synchronous node:sqlite) so it satisfies the
   // async EventsReadPort contract.
   contentHashes() {
-    const rows = this.db.prepare("SELECT content_hash FROM events").all();
+    const rows = allRows(
+      this.db.prepare("SELECT content_hash FROM events")
+    );
     return Promise.resolve(new Set(rows.map((r) => r.content_hash)));
   }
 };
 
 // ../packages/persistence/src/repositories/exceptions.ts
 import { randomUUID as randomUUID2 } from "crypto";
+
+// ../packages/persistence/src/internal/sqlite-errors.ts
+var SQLITE_CONSTRAINT_UNIQUE = 2067;
+function isUniqueConstraintError(err) {
+  return err instanceof Error && (err.errcode === SQLITE_CONSTRAINT_UNIQUE || err.message.includes("UNIQUE constraint failed"));
+}
+
+// ../packages/persistence/src/repositories/exceptions.ts
 var BLOCKED_DETECTIONS_TTL_MS = 30 * 60 * 1e3;
 var BLOCKED_DETECTIONS_RETENTION_MS = 24 * 60 * 60 * 1e3;
 var DuplicateActiveExceptionError = class extends Error {
@@ -19691,10 +19930,6 @@ var AmbiguousExceptionIdError = class extends Error {
     this.name = "AmbiguousExceptionIdError";
   }
 };
-var SQLITE_CONSTRAINT_UNIQUE = 2067;
-function isUniqueConstraintError(err) {
-  return err instanceof Error && (err.errcode === SQLITE_CONSTRAINT_UNIQUE || err.message.includes("UNIQUE constraint failed"));
-}
 var ACTIVE_PREDICATE = `revoked_at IS NULL
      AND (expires_at IS NULL OR expires_at > :now)
      AND (max_uses IS NULL OR use_count < max_uses)`;
@@ -19750,10 +19985,11 @@ var SqliteExceptionsRepository = class {
       this.insertExceptionRow(id, input, now);
     } catch (err) {
       if (!isUniqueConstraintError(err)) throw err;
-      this.db.exec("BEGIN IMMEDIATE");
-      try {
-        const superseded = this.db.prepare(
-          `UPDATE exceptions
+      withTransaction(
+        this.db,
+        () => {
+          const superseded = this.db.prepare(
+            `UPDATE exceptions
                 SET revoked_at = :now, revoked_by = :revokedBy,
                     revoke_reason = 'superseded by a new grant for the same value',
                     updated_at = :now
@@ -19761,24 +19997,27 @@ var SqliteExceptionsRepository = class {
                 AND key_version = :keyVersion AND revoked_at IS NULL
                 AND ((expires_at IS NOT NULL AND expires_at <= :now)
                   OR (max_uses IS NOT NULL AND use_count >= max_uses))`
-        ).run({
-          now,
-          revokedBy: input.createdBy,
-          ruleId: input.ruleId,
-          valueFingerprint: input.valueFingerprint,
-          keyVersion: input.keyVersion
-        });
-        if (Number(superseded.changes) !== 1) {
-          throw new DuplicateActiveExceptionError(input.ruleId);
-        }
-        this.insertExceptionRow(id, input, now);
-        this.db.exec("COMMIT");
-      } catch (retryErr) {
-        this.db.exec("ROLLBACK");
-        throw retryErr;
-      }
+          ).run({
+            now,
+            revokedBy: input.createdBy,
+            ruleId: input.ruleId,
+            valueFingerprint: input.valueFingerprint,
+            keyVersion: input.keyVersion
+          });
+          if (Number(superseded.changes) !== 1) {
+            throw new DuplicateActiveExceptionError(input.ruleId);
+          }
+          this.insertExceptionRow(id, input, now);
+        },
+        "IMMEDIATE"
+      );
+    }
+    const row = getRow(this.db.prepare("SELECT * FROM exceptions WHERE id = :id"), {
+      id
+    });
+    if (row === void 0) {
+      throw new Error("exception row not found immediately after insert");
     }
-    const row = this.db.prepare("SELECT * FROM exceptions WHERE id = :id").get({ id });
     return parseExceptionRow(row);
   }
   insertExceptionRow(id, input, now) {
@@ -19816,14 +20055,11 @@ var SqliteExceptionsRepository = class {
    */
   list(opts) {
     const where = opts?.includeTerminal ? "" : `WHERE ${ACTIVE_PREDICATE}`;
-    const rows = this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`).all(opts?.includeTerminal ? {} : { now: Date.now() });
-    const exceptions = [];
-    for (const row of rows) {
-      try {
-        exceptions.push(parseExceptionRow(row));
-      } catch {
-      }
-    }
+    const rows = allRows(
+      this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`),
+      opts?.includeTerminal ? {} : { now: Date.now() }
+    );
+    const exceptions = mapRowsTolerant(rows, parseExceptionRow);
     return Promise.resolve(exceptions);
   }
   /**
@@ -19833,7 +20069,12 @@ var SqliteExceptionsRepository = class {
    */
   getByIdPrefix(prefix) {
     if (prefix.length === 0) return Promise.resolve(void 0);
-    const rows = this.db.prepare(String.raw`SELECT * FROM exceptions WHERE id LIKE :pattern ESCAPE '\' LIMIT 2`).all({ pattern: `${escapeLikePattern(prefix)}%` });
+    const rows = allRows(
+      this.db.prepare(
+        String.raw`SELECT * FROM exceptions WHERE id LIKE :pattern ESCAPE '\' LIMIT 2`
+      ),
+      { pattern: `${escapeLikePattern(prefix)}%` }
+    );
     if (rows.length > 1) {
       return Promise.reject(new AmbiguousExceptionIdError(prefix));
     }
@@ -19875,30 +20116,27 @@ var SqliteExceptionsRepository = class {
    * a different (rotated-away) key never match, so they are excluded at read.
    */
   activeBundleEntries(keyVersion, now = Date.now()) {
-    const rows = this.db.prepare(
-      `SELECT * FROM exceptions
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT * FROM exceptions
           WHERE key_version = :keyVersion AND ${ACTIVE_PREDICATE}
           ORDER BY created_at DESC, rowid DESC`
-    ).all({ keyVersion, now });
-    const entries = [];
-    for (const row of rows) {
-      try {
-        const conditions = row.conditions === null ? null : JSON.parse(row.conditions);
-        entries.push(
-          ExceptionBundleEntry.parse({
-            id: row.id,
-            ruleId: row.rule_id,
-            valueFingerprint: row.value_fingerprint,
-            keyVersion: row.key_version,
-            expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
-            maxUses: row.max_uses,
-            useCount: row.use_count,
-            conditions
-          })
-        );
-      } catch {
-      }
-    }
+      ),
+      { keyVersion, now }
+    );
+    const entries = mapRowsTolerant(rows, (row) => {
+      const conditions = row.conditions === null ? null : JSON.parse(row.conditions);
+      return ExceptionBundleEntry.parse({
+        id: row.id,
+        ruleId: row.rule_id,
+        valueFingerprint: row.value_fingerprint,
+        keyVersion: row.key_version,
+        expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
+        maxUses: row.max_uses,
+        useCount: row.use_count,
+        conditions
+      });
+    });
     return Promise.resolve(entries);
   }
   /**
@@ -19925,11 +20163,14 @@ var SqliteExceptionsRepository = class {
   }
   /** Blocked detections within the window (default: the 30-minute TTL), newest-first. */
   recentBlocked(windowMs = BLOCKED_DETECTIONS_TTL_MS) {
-    const rows = this.db.prepare(
-      `SELECT * FROM blocked_detections
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT * FROM blocked_detections
           WHERE blocked_at > :cutoff
           ORDER BY blocked_at DESC, rowid DESC`
-    ).all({ cutoff: Date.now() - windowMs });
+      ),
+      { cutoff: Date.now() - windowMs }
+    );
     return Promise.resolve(
       rows.map((row) => ({
         reference: row.reference,
@@ -20009,7 +20250,12 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 )`;
 
 // ../packages/persistence/src/repositories/findings.ts
-var GROUP_ROW_CAP = 2e3;
+var PREVIEW_INSTANCES_PER_GROUP = 200;
+var CONCAT_SEP = ",";
+var TUPLE_SEP = "|";
+function splitConcat(value) {
+  return value === null || value === "" ? [] : value.split(CONCAT_SEP);
+}
 function deriveInstanceStatus(row) {
   return deriveFindingStatus({
     kind: row.kind,
@@ -20077,13 +20323,16 @@ var SqliteFindingsRepository = class {
   }
   recentFindings(opts) {
     const limit = opts?.limit ?? 50;
-    const rows = this.db.prepare(
-      `SELECT f.id, f.event_id, f.rule_id, f.category, f.severity, f.masked_match,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.id, f.event_id, f.rule_id, f.category, f.severity, f.masked_match,
                 f.action_taken, f.confidence, e.occurred_at, e.source_tool, e.kind
          FROM findings f JOIN events e ON e.id = f.event_id
          ORDER BY e.occurred_at DESC, f.rowid DESC
          LIMIT :limit`
-    ).all({ limit });
+      ),
+      { limit }
+    );
     return Promise.resolve(
       rows.map((r) => ({
         id: r.id,
@@ -20106,20 +20355,47 @@ var SqliteFindingsRepository = class {
    * applies the requested filters, and sorts by severity then recency. Filtering
    * and faceting run in JS via the shared @akasecurity/schema helpers. `totals`
    * reflect the full filtered set; `items` is the requested
-   * page (default 100); no cursor (nextCursor is always null).
+   * page (default 50); no cursor (nextCursor is always null).
+   *
+   * Two reads, neither of which materializes a row per finding:
+   *   1. one aggregate row per rule_id, folding EVERY instance into the numbers
+   *      the group and the filters need (count, providers, actions, statuses,
+   *      latest, search text);
+   *   2. each group's newest PREVIEW_INSTANCES_PER_GROUP instances, which
+   *      populate `instances` for the table's expanded rows.
+   * The aggregates carry raw DB values and are translated by the same
+   * @akasecurity/schema mappers the row path uses, so no enum mapping or status
+   * rule is ever restated in SQL.
    */
   listGroupedFindings(query) {
-    const rows = this.db.prepare(
-      `SELECT f.id, f.rule_id, f.category, f.severity, f.masked_match,
-                f.action_taken, f.confidence, e.occurred_at, e.source_tool,
-                json_extract(e.metadata, '$.repo') AS repo,
-                json_extract(e.metadata, '$.filePath') AS file,
-                e.kind AS kind, f.finding_key AS finding_key,
-                ${latestResolutionStatusSql("f")} AS latest_status
-         FROM findings f JOIN events e ON e.id = f.event_id
-         ORDER BY e.occurred_at DESC, f.id DESC
-         LIMIT :cap`
-    ).all({ cap: GROUP_ROW_CAP });
+    const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "");
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
+                occurred_at, source_tool, repo, file, kind, finding_key, latest_status
+         FROM (
+           SELECT f.id AS id, f.rule_id AS rule_id, f.category AS category,
+                  f.severity AS severity, f.masked_match AS masked_match,
+                  f.action_taken AS action_taken, f.confidence AS confidence,
+                  e.occurred_at AS occurred_at, e.source_tool AS source_tool,
+                  json_extract(e.metadata, '$.repo') AS repo,
+                  json_extract(e.metadata, '$.filePath') AS file,
+                  e.kind AS kind, f.finding_key AS finding_key,
+                  latest.status AS latest_status,
+                  ROW_NUMBER() OVER (
+                    PARTITION BY f.rule_id
+                    ORDER BY e.occurred_at DESC, f.id DESC
+                  ) AS rn
+             FROM findings f
+             JOIN events e ON e.id = f.event_id
+             LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+               ON latest.finding_key = f.finding_key
+         )
+         WHERE rn <= :cap
+         ORDER BY occurred_at DESC, id DESC`
+      ),
+      { cap: PREVIEW_INSTANCES_PER_GROUP }
+    );
     const groupable = rows.map((r) => ({
       id: r.id,
       ruleId: r.rule_id,
@@ -20134,7 +20410,7 @@ var SqliteFindingsRepository = class {
       file: r.file ?? "",
       status: deriveInstanceStatus(r)
     }));
-    const allGroups = buildFindingGroups(groupable);
+    const allGroups = buildFindingGroups(groupable, { aggregates });
     const filterOpts = {
       severity: query.severity,
       providers: query.provider,
@@ -20152,42 +20428,122 @@ var SqliteFindingsRepository = class {
     const items = sorted.slice(0, limit);
     return Promise.resolve({ totals, facets, items, nextCursor: null });
   }
+  /**
+   * One row per rule_id, folding EVERY instance of the group into the values
+   * buildFindingGroups cannot recover from a preview. Bounded by the number of
+   * distinct rule_ids (the installed packs' rules), not by the store's size.
+   *
+   * The per-instance sets ride back as group_concat lists of RAW DB values —
+   * source_tool, action_taken, and the (kind, has-key, latest-status) triples
+   * deriveFindingStatus consumes. Aggregating the status INPUTS rather than a
+   * status keeps the classifier itself in @akasecurity/schema, where
+   * severitySummary's SQL and this query can't drift apart on what 'resolved'
+   * means (see resolution-sql.ts). Each of those sets is bounded by an enum, so
+   * a group's row stays small however many findings it holds.
+   *
+   * `withSearchText` is the exception, and the one column here that does NOT
+   * stay small: the group's distinct repos/filePaths, whose size tracks how many
+   * distinct paths a rule fired across — for a rule hitting mostly-unique paths
+   * that is a string proportional to the store (~8MB over 200k distinct paths,
+   * and buildHaystack lowercases a second copy). It buys `q` the ability to
+   * match an instance outside the preview, which searching the preview alone
+   * would silently lose, so it is fetched only when the request actually
+   * carries a `q`.
+   */
+  groupAggregates(withSearchText) {
+    const searchTextColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.metadata, '$.repo')) AS repos,
+           group_concat(DISTINCT json_extract(e.metadata, '$.filePath')) AS files` : `, NULL AS repos, NULL AS files`;
+    const rows = this.db.prepare(
+      `SELECT f.rule_id AS rule_id,
+                count(*) AS instance_count,
+                max(e.occurred_at) AS latest_at,
+                group_concat(DISTINCT e.source_tool) AS source_tools,
+                group_concat(DISTINCT f.action_taken) AS actions_taken,
+                group_concat(DISTINCT (
+                  e.kind || '${TUPLE_SEP}' ||
+                  (CASE WHEN f.finding_key IS NULL THEN '' ELSE 'k' END) || '${TUPLE_SEP}' ||
+                  coalesce(latest.status, '')
+                )) AS status_inputs
+                ${searchTextColumns}
+           FROM findings f
+           JOIN events e ON e.id = f.event_id
+           LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
+             ON latest.finding_key = f.finding_key
+          GROUP BY f.rule_id`
+    ).all();
+    return new Map(
+      rows.map((r) => [
+        r.rule_id,
+        {
+          instanceCount: r.instance_count,
+          sourceTools: splitConcat(r.source_tools),
+          actionsTaken: splitConcat(r.actions_taken),
+          statusInputs: splitConcat(r.status_inputs).map((tuple2) => {
+            const [kind = "", keyMarker = "", latestStatus = ""] = tuple2.split(TUPLE_SEP);
+            return {
+              // deriveFindingStatus only distinguishes null from non-null here,
+              // so the marker stands in for the key itself (never rendered).
+              kind,
+              findingKey: keyMarker === "" ? null : keyMarker,
+              latestResolutionStatus: latestStatus === "" ? null : latestStatus
+            };
+          }),
+          latestDetectedAt: epochMillisToIso(r.latest_at),
+          // Free text only — joined and substring-matched, so group_concat's
+          // commas need no unpicking (a repo/path containing one still matches).
+          // Left undefined (not '') when unfetched, so buildFindingGroups can
+          // tell "no q this request" from "a group with no repo/file at all"
+          // and skip priming a haystack nothing will read.
+          ...withSearchText ? { searchText: [r.repos ?? "", r.files ?? ""].filter((s) => s !== "").join(" ") } : {}
+        }
+      ])
+    );
+  }
   healthSummary() {
-    const total = this.db.prepare("SELECT count(*) AS c FROM findings").get().c;
+    const total = countScalar(this.db, "SELECT count(*) AS n FROM findings");
     const byAction = Object.fromEntries(ACTION_TAKEN_KEYS.map((a) => [a, 0]));
-    const grouped = this.db.prepare("SELECT action_taken, count(*) AS c FROM findings GROUP BY action_taken").all();
+    const grouped = allRows(
+      this.db.prepare("SELECT action_taken, count(*) AS c FROM findings GROUP BY action_taken")
+    );
     for (const row of grouped) {
       if (row.action_taken in byAction) byAction[row.action_taken] = row.c;
     }
     const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
-    const sevRows = this.db.prepare(
-      `SELECT f.severity AS severity, count(*) AS c
+    const sevRows = allRows(
+      this.db.prepare(
+        `SELECT f.severity AS severity, count(*) AS c
          FROM findings f
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
          WHERE latest.status IS NULL OR latest.status != 'resolved'
          GROUP BY f.severity`
-    ).all();
+      )
+    );
     for (const row of sevRows) {
       if (row.severity in bySeverity) bySeverity[row.severity] = row.c;
     }
     const categories = ENFORCEABLE_CATEGORIES;
-    const enabledRows = this.db.prepare(
-      `SELECT DISTINCT json_extract(target, '$.category') AS category
+    const enabledRows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT json_extract(target, '$.category') AS category
          FROM policies WHERE enabled = 1 AND json_extract(target, '$.category') IS NOT NULL`
-    ).all();
+      )
+    );
     const enabled = new Set(enabledRows.map((r) => r.category));
     const coverage = categories.length === 0 ? 0 : categories.filter((c) => enabled.has(c)).length / categories.length;
     return Promise.resolve({ findings: total, byAction, bySeverity, coverage });
   }
   activityByDay(days = 7) {
     const since = startOfUtcDay(Date.now()) - (days - 1) * DAY_MS3;
-    const rows = this.db.prepare(
-      `SELECT date(e.occurred_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT date(e.occurred_at / 1000, 'unixepoch') AS day, f.action_taken AS action, count(*) AS c
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :since
          GROUP BY day, f.action_taken`
-    ).all({ since });
+      ),
+      { since }
+    );
     const buckets = /* @__PURE__ */ new Map();
     for (let i = 0; i < days; i++) {
       const day = isoDay(since + i * DAY_MS3);
@@ -20259,17 +20615,19 @@ var SqliteInspectionFindingsRepository = class {
   insertStmt;
   insertFinding(input) {
     const row = toInspectionFindingRow(input);
-    this.insertStmt.run({
-      id: row.id,
-      auditEventId: row.auditEventId,
-      inspectionDefinitionId: row.inspectionDefinitionId,
-      classifiedDataId: row.classifiedDataId ?? null,
-      spanStart: row.spanStart,
-      spanEnd: row.spanEnd,
-      maskedMatch: row.maskedMatch,
-      actionTaken: row.actionTaken,
-      confidence: row.confidence
-    });
+    this.insertStmt.run(
+      bindParams({
+        id: row.id,
+        auditEventId: row.auditEventId,
+        inspectionDefinitionId: row.inspectionDefinitionId,
+        classifiedDataId: row.classifiedDataId,
+        spanStart: row.spanStart,
+        spanEnd: row.spanEnd,
+        maskedMatch: row.maskedMatch,
+        actionTaken: row.actionTaken,
+        confidence: row.confidence
+      })
+    );
   }
 };
 
@@ -20345,12 +20703,7 @@ function isMirrorDowngrade(incoming, stored) {
 }
 function ruleIdsOf(rulesJson) {
   const ids = /* @__PURE__ */ new Set();
-  let raw;
-  try {
-    raw = JSON.parse(rulesJson);
-  } catch {
-    return ids;
-  }
+  const raw = safeJson(rulesJson, []);
   if (!Array.isArray(raw)) return ids;
   for (const entry of raw) {
     if (entry && typeof entry === "object") {
@@ -20423,47 +20776,48 @@ var SqliteInstalledPacksRepository = class {
       }));
       if (this.storedSignature() === inventorySignature(rows)) return;
       const now = Date.now();
-      this.db.exec("BEGIN IMMEDIATE");
-      try {
-        const mirror = this.mirrorState();
-        let behind = false;
-        for (const row of rows) {
-          const params = {
-            id: randomUUID3(),
-            namespace: row.namespace,
-            packId: row.packId,
-            version: row.version,
-            name: row.name,
-            rulesJson: row.rulesJson,
-            now
-          };
-          const stored = mirror.get(`${row.namespace}/${row.packId}`);
-          if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
-            this.upsertAvailableStmt.run({
-              ...params,
+      withTransaction(
+        this.db,
+        () => {
+          const mirror = this.mirrorState();
+          let behind = false;
+          for (const row of rows) {
+            const params = {
               id: randomUUID3(),
-              recordedBy: meta3?.recordedBy ?? null
-            });
-          } else {
-            behind = true;
+              namespace: row.namespace,
+              packId: row.packId,
+              version: row.version,
+              name: row.name,
+              rulesJson: row.rulesJson,
+              now
+            };
+            const stored = mirror.get(`${row.namespace}/${row.packId}`);
+            if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
+              this.upsertAvailableStmt.run({
+                ...params,
+                id: randomUUID3(),
+                recordedBy: meta3?.recordedBy ?? null
+              });
+            } else {
+              behind = true;
+            }
+            this.insertMissingStmt.run(params);
           }
-          this.insertMissingStmt.run(params);
-        }
-        if (!behind) this.pruneAvailable(rows.map((r) => `${r.namespace}/${r.packId}`));
-        this.db.exec("COMMIT");
-      } catch (err) {
-        this.db.exec("ROLLBACK");
-        throw err;
-      }
+          if (!behind) this.pruneAvailable(rows.map((r) => `${r.namespace}/${r.packId}`));
+        },
+        "IMMEDIATE"
+      );
     } catch {
     }
   }
   // The mirror's current (namespace/packId → {version, ruleIds}) map — the
   // input to the downgrade guard. Read INSIDE the write transaction.
   mirrorState() {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, version, rules_json AS rulesJson FROM available_packs`
+      )
+    );
     return new Map(
       rows.map((r) => [
         `${r.namespace}/${r.packId}`,
@@ -20475,7 +20829,9 @@ var SqliteInstalledPacksRepository = class {
   // (keys joined with '/', matching the detection id slug encoding — packId may
   // itself contain '/', but namespace may not, so the join is unambiguous).
   pruneAvailable(keep) {
-    const rows = this.db.prepare(`SELECT namespace, pack_id AS packId FROM available_packs`).all();
+    const rows = allRows(
+      this.db.prepare(`SELECT namespace, pack_id AS packId FROM available_packs`)
+    );
     const keepSet = new Set(keep);
     const del = this.db.prepare(`DELETE FROM available_packs WHERE namespace = ? AND pack_id = ?`);
     for (const r of rows) {
@@ -20502,11 +20858,13 @@ var SqliteInstalledPacksRepository = class {
     if (this.db.isTransaction) {
       throw new Error("applyUpdate must not be called inside an open transaction");
     }
-    this.db.exec("BEGIN IMMEDIATE");
-    try {
-      this.db.exec("UPDATE _pack_write_gate SET open = 1 WHERE id = 1");
-      const res = this.db.prepare(
-        `UPDATE installed_packs SET
+    let changed = false;
+    withTransaction(
+      this.db,
+      () => {
+        this.db.exec("UPDATE _pack_write_gate SET open = 1 WHERE id = 1");
+        const res = this.db.prepare(
+          `UPDATE installed_packs SET
              version = (SELECT a.version FROM available_packs a
                         WHERE a.namespace = :namespace AND a.pack_id = :packId),
              name = (SELECT a.name FROM available_packs a
@@ -20517,17 +20875,13 @@ var SqliteInstalledPacksRepository = class {
            WHERE namespace = :namespace AND pack_id = :packId
              AND EXISTS (SELECT 1 FROM available_packs a
                          WHERE a.namespace = :namespace AND a.pack_id = :packId)`
-      ).run({ namespace, packId, now: Date.now() });
-      this.db.exec("UPDATE _pack_write_gate SET open = 0 WHERE id = 1");
-      this.db.exec("COMMIT");
-      return Number(res.changes) > 0;
-    } catch (err) {
-      try {
-        this.db.exec("ROLLBACK");
-      } catch {
-      }
-      throw err;
-    }
+        ).run({ namespace, packId, now: Date.now() });
+        this.db.exec("UPDATE _pack_write_gate SET open = 0 WHERE id = 1");
+        changed = Number(res.changes) > 0;
+      },
+      "IMMEDIATE"
+    );
+    return changed;
   }
   /**
    * The scan-time ruleset: every rule under an ENABLED installed pack that
@@ -20541,9 +20895,11 @@ var SqliteInstalledPacksRepository = class {
    * JSON-level failure therefore counts as invalid.
    */
   installedRuleset() {
-    const rows = this.db.prepare(
-      `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson FROM installed_packs`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT enabled, policy_id AS policyId, rules_json AS rulesJson FROM installed_packs`
+      )
+    );
     const out = {
       installedPacks: rows.length,
       enabledPacks: 0,
@@ -20552,7 +20908,7 @@ var SqliteInstalledPacksRepository = class {
       ruleActions: /* @__PURE__ */ new Map()
     };
     for (const row of rows) {
-      if (row.enabled !== 1) continue;
+      if (!intToBool(row.enabled)) continue;
       out.enabledPacks += 1;
       const action = policyIdToAction(row.policyId);
       let raw;
@@ -20587,9 +20943,11 @@ var SqliteInstalledPacksRepository = class {
    * running max would mask a genuinely-newer parseable stamp.
    */
   newestRecordedBinary() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT recorded_by AS recordedBy FROM available_packs WHERE recorded_by IS NOT NULL`
-    ).all();
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT recorded_by AS recordedBy FROM available_packs WHERE recorded_by IS NOT NULL`
+      )
+    );
     let newest = null;
     for (const row of rows) {
       const at = row.recordedBy.lastIndexOf("@");
@@ -20604,13 +20962,15 @@ var SqliteInstalledPacksRepository = class {
     return newest;
   }
   counts() {
-    const row = this.db.prepare(
-      `SELECT count(*) AS packs,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT count(*) AS packs,
                 coalesce(sum(json_array_length(rules_json)), 0) AS rules,
                 coalesce(sum(enabled), 0) AS enabled
          FROM installed_packs`
-    ).get();
-    return Promise.resolve(row);
+      )
+    );
+    return Promise.resolve(row ?? { packs: 0, rules: 0, enabled: 0 });
   }
   // ─── Policy-catalog reads ────────────────────────────────────────────────────
   // Back the Policies page's built-in catalog: how many
@@ -20623,26 +20983,29 @@ var SqliteInstalledPacksRepository = class {
    * attributed to Monitor, matching the Detections views.
    */
   countsByPolicyId() {
-    const rows = this.db.prepare(
-      `SELECT coalesce(policy_id, '${DEFAULT_POLICY_ID}') AS pid, count(*) AS n
+    return countBy(
+      this.db,
+      `SELECT coalesce(policy_id, '${DEFAULT_POLICY_ID}') AS k, count(*) AS n
          FROM installed_packs
-         GROUP BY pid`
-    ).all();
-    return new Map(rows.map((r) => [r.pid, r.n]));
+         GROUP BY k`
+    );
   }
   /** The detections governed by a built-in policy — one UsedByItem per pack. */
   listByPolicyId(policyId) {
-    const rows = this.db.prepare(
-      `SELECT namespace, pack_id AS packId, name, enabled, rules_json AS rulesJson
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT namespace, pack_id AS packId, name, enabled, rules_json AS rulesJson
          FROM installed_packs
          WHERE coalesce(policy_id, '${DEFAULT_POLICY_ID}') = ?
          ORDER BY name ASC`
-    ).all(policyId);
+      ),
+      [policyId]
+    );
     return rows.map((r) => ({
       id: `${r.namespace}/${r.packId}`,
       name: r.name,
       ruleCount: parseRules(r.rulesJson).length,
-      enabled: r.enabled === 1
+      enabled: intToBool(r.enabled)
     }));
   }
   // ─── Writes ────────────────────────────────────────────────────────────────
@@ -20671,14 +21034,14 @@ var SqliteInstalledPacksRepository = class {
     const res = this.db.prepare(
       `UPDATE installed_packs SET enabled = :enabled, updated_at = :now
          WHERE namespace = :namespace AND pack_id = :packId`
-    ).run({ enabled: enabled ? 1 : 0, now: Date.now(), namespace, packId });
+    ).run({ enabled: boolToInt(enabled), now: Date.now(), namespace, packId });
     return Number(res.changes) > 0;
   }
   // Fingerprint of the recorded available mirror — compared against the
   // incoming inventory's signature to skip the write entirely when the running
   // binary's inventory hasn't changed since the last record.
   storedSignature() {
-    const rows = this.signatureStmt.all();
+    const rows = allRows(this.signatureStmt);
     return inventorySignature(rows);
   }
 };
@@ -20706,42 +21069,48 @@ var SqliteInventoryRepository = class {
   upsert(input, now = Date.now()) {
     const id = inventoryId(input.objectType, input.identityKey);
     const row = toInventoryRow(input, id, now);
-    this.upsertStmt.run({
-      id: row.id,
-      objectType: row.objectType,
-      location: row.location ?? null,
-      title: row.title ?? null,
-      hostId: row.hostId ?? null,
-      attributes: row.attributes,
-      firstSeen: row.firstSeen,
-      lastSeen: row.lastSeen
-    });
+    this.upsertStmt.run(
+      bindParams({
+        id: row.id,
+        objectType: row.objectType,
+        location: row.location,
+        title: row.title,
+        hostId: row.hostId,
+        attributes: row.attributes,
+        firstSeen: row.firstSeen,
+        lastSeen: row.lastSeen
+      })
+    );
     return id;
   }
   // The full row, for round-trip assertions.
   findById(id) {
-    const row = this.db.prepare("SELECT * FROM inventory WHERE id = :id").get({ id });
-    return row;
+    return getRow(this.db.prepare("SELECT * FROM inventory WHERE id = :id"), { id });
   }
   // Distinct titles for an object_type — a filter facet (e.g. hostnames),
   // served from the object_type index, never from audit_events.
   distinctTitles(objectType) {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT title FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT title FROM inventory
          WHERE object_type = :objectType AND title IS NOT NULL
          ORDER BY title`
-    ).all({ objectType });
+      ),
+      { objectType }
+    );
     return rows.map((r) => r.title);
   }
   // Distinct host os_version values — a facet served from an inventory index
   // over the generated column, never from the audit fact (confirm via EXPLAIN
   // QUERY PLAN).
   osVersions() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT os_version AS value FROM inventory
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT os_version AS value FROM inventory
          WHERE object_type = 'host' AND os_version IS NOT NULL
          ORDER BY value`
-    ).all();
+      )
+    );
     return rows.map((r) => r.value);
   }
 };
@@ -20761,14 +21130,6 @@ var EMPTY_PROJECT_AGG = {
   accessCounts: { open: 0, approved: 0, blocked: 0, total: 0 },
   findingsCount: 0
 };
-function safeJson(s, fallback) {
-  if (s == null) return fallback;
-  try {
-    return JSON.parse(s);
-  } catch {
-    return fallback;
-  }
-}
 function resolveHarnessId(attrs, row) {
   if (attrs.provider && VALID_HARNESS_IDS.has(attrs.provider)) {
     return attrs.provider;
@@ -20964,30 +21325,49 @@ var SqliteInventoryAssetsRepository = class {
   configRowsCache;
   // ─── stats ─────────────────────────────────────────────────────────────────
   getInventoryStats() {
-    const byType = { project: 0, skill: 0, mcp: 0, hook: 0, config: 0 };
-    for (const r of this.db.prepare("SELECT asset_type AS t, count(*) AS n FROM inventory_asset GROUP BY asset_type").all()) {
-      if (r.t in byType) byType[r.t] = r.n;
-    }
-    byType.project = this.db.prepare(`SELECT count(*) AS n FROM source_project WHERE ${WORKTREE_CHECKOUT_FILTER}`).get().n;
-    const mcpTrust = { "known-good": 0, risky: 0, unapproved: 0 };
-    for (const r of this.db.prepare(
-      `SELECT coalesce(o.trust, a.trust) AS trust, count(*) AS n
+    const typeCounts = countBy(
+      this.db,
+      "SELECT asset_type AS k, count(*) AS n FROM inventory_asset GROUP BY asset_type"
+    );
+    const byType = {
+      project: 0,
+      skill: typeCounts.get("skill") ?? 0,
+      mcp: typeCounts.get("mcp") ?? 0,
+      hook: typeCounts.get("hook") ?? 0,
+      config: typeCounts.get("config") ?? 0
+    };
+    byType.project = countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM source_project WHERE ${WORKTREE_CHECKOUT_FILTER}`
+    );
+    const mcpTrustCounts = countBy(
+      this.db,
+      `SELECT coalesce(o.trust, a.trust) AS k, count(*) AS n
          FROM inventory_asset a
          LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
          WHERE a.asset_type = 'mcp' AND coalesce(o.trust, a.trust) IS NOT NULL
          GROUP BY coalesce(o.trust, a.trust)`
-    ).all()) {
-      if (r.trust in mcpTrust) mcpTrust[r.trust] = r.n;
-    }
-    const harnesses = this.db.prepare(
+    );
+    const mcpTrust = {
+      "known-good": mcpTrustCounts.get("known-good") ?? 0,
+      risky: mcpTrustCounts.get("risky") ?? 0,
+      unapproved: mcpTrustCounts.get("unapproved") ?? 0
+    };
+    const harnesses = countScalar(
+      this.db,
       `SELECT count(*) AS n FROM inventory
            WHERE object_type = 'harness'
-             AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`
-    ).get({ liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }).n;
-    const flaggedAssets = this.db.prepare("SELECT count(*) AS n FROM inventory_asset WHERE flags_json <> '[]'").get().n;
-    const flaggedProjects = this.db.prepare(
+             AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`,
+      { liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }
+    );
+    const flaggedAssets = countScalar(
+      this.db,
+      "SELECT count(*) AS n FROM inventory_asset WHERE flags_json <> '[]'"
+    );
+    const flaggedProjects = countScalar(
+      this.db,
       `SELECT count(DISTINCT project_id) AS n FROM project_file WHERE findings_count > 0`
-    ).get().n;
+    );
     const configRows = this.configAssetRows();
     for (const r of configRows) {
       byType[r.assetType] += 1;
@@ -21244,12 +21624,15 @@ var SqliteInventoryAssetsRepository = class {
   }
   // ─── raw fetchers ────────────────────────────────────────────────────────────
   fetchHarnessRows() {
-    return this.db.prepare(
-      `SELECT id, title, attributes, harness_version AS harnessVersion
+    return allRows(
+      this.db.prepare(
+        `SELECT id, title, attributes, harness_version AS harnessVersion
          FROM inventory
          WHERE object_type = 'harness'
            AND (last_seen >= :liveSince OR json_extract(attributes, '$.provenance') = 'sample')`
-    ).all({ liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS });
+      ),
+      { liveSince: Date.now() - HARNESS_LIVENESS_WINDOW_MS }
+    );
   }
   // Every harness's assets in ONE grouped query, keyed by harness inventory id —
   // replaces the per-harness-row query the listHarnesses loop used to make.
@@ -21259,12 +21642,13 @@ var SqliteInventoryAssetsRepository = class {
     const params = [...harnessInvIds];
     let where = `ha.harness_id IN (${placeholders(harnessInvIds.length)})`;
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      where += " AND (a.name LIKE ? ESCAPE '\\' OR a.sub LIKE ? ESCAPE '\\')";
+      const pat = containsPattern(q);
+      where += ` AND ${likeAny(["a.name", "a.sub"])}`;
       params.push(pat, pat);
     }
-    const rows = this.db.prepare(
-      `SELECT ha.harness_id AS harnessInvId, a.id, a.asset_type AS assetType, a.name, a.sub,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT ha.harness_id AS harnessInvId, a.id, a.asset_type AS assetType, a.name, a.sub,
                 a.description, a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                 a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
          FROM harness_asset ha
@@ -21272,7 +21656,9 @@ var SqliteInventoryAssetsRepository = class {
          LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
          WHERE ${where}
          ORDER BY a.name ASC`
-    ).all(...params);
+      ),
+      params
+    );
     for (const raw of rows) {
       const harnessInvId = raw.harnessInvId;
       const [asset] = this.mapAssetRows([raw]);
@@ -21291,21 +21677,24 @@ var SqliteInventoryAssetsRepository = class {
       params.push(...types);
     }
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      conditions.push("(a.name LIKE ? ESCAPE '\\' OR a.sub LIKE ? ESCAPE '\\')");
+      const pat = containsPattern(q);
+      conditions.push(likeAny(["a.name", "a.sub"]));
       params.push(pat, pat);
     }
     const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
     const sampleRows = this.mapAssetRows(
-      this.db.prepare(
-        `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
+      allRows(
+        this.db.prepare(
+          `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
                   a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                   a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
            FROM inventory_asset a
            LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
            ${where}
            ORDER BY a.name ASC`
-      ).all(...params)
+        ),
+        params
+      )
     );
     const configRows = this.configAssetRows(q).filter(
       (r) => !types || types.length === 0 || types.includes(r.assetType)
@@ -21314,14 +21703,17 @@ var SqliteInventoryAssetsRepository = class {
   }
   fetchAssetById(assetId) {
     const rows = this.mapAssetRows(
-      this.db.prepare(
-        `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
+      allRows(
+        this.db.prepare(
+          `SELECT a.id, a.asset_type AS assetType, a.name, a.sub, a.description,
                   a.flags_json AS flagsJson, a.meta_json AS metaJson, a.trust,
                   a.tools_json AS toolsJson, coalesce(o.trust, a.trust) AS effectiveTrust
            FROM inventory_asset a
            LEFT JOIN mcp_trust_override o ON o.asset_id = a.id
            WHERE a.id = ?`
-      ).all(assetId)
+        ),
+        [assetId]
+      )
     );
     return rows[0] ?? this.configAssetRows().find((r) => r.id === assetId) ?? null;
   }
@@ -21377,37 +21769,39 @@ var SqliteInventoryAssetsRepository = class {
     return rows;
   }
   latestConfigScanId() {
-    const row = this.db.prepare(
-      `SELECT id FROM audit_events WHERE event_type = 'config_scan'
-         ORDER BY started_at DESC, id DESC LIMIT 1`
-    ).get();
-    return row?.id ?? null;
+    return latestConfigScan(this.db)?.id ?? null;
   }
   fetchProjects(q) {
     let sql = `SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project
                WHERE ${WORKTREE_CHECKOUT_FILTER}`;
     const params = [];
     if (q) {
-      const pat = `%${escapeLikePattern(q)}%`;
-      sql += " AND (name LIKE ? ESCAPE '\\' OR url LIKE ? ESCAPE '\\')";
+      const pat = containsPattern(q);
+      sql += ` AND ${likeAny(["name", "url"])}`;
       params.push(pat, pat);
     }
     sql += " ORDER BY name ASC";
-    return this.db.prepare(sql).all(...params);
+    return allRows(this.db.prepare(sql), params);
   }
   fetchProjectById(projectId) {
-    return this.db.prepare(
-      "SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project WHERE id = ?"
-    ).get(projectId) ?? null;
+    return getRow(
+      this.db.prepare(
+        "SELECT id, url, name, attributes, last_seen AS lastSeen FROM source_project WHERE id = ?"
+      ),
+      [projectId]
+    ) ?? null;
   }
   // The referenced projects in ONE `id IN (…)` fetch, keyed by id.
   fetchProjectsByIds(projectIds) {
     const map2 = /* @__PURE__ */ new Map();
     if (projectIds.length === 0) return map2;
-    const rows = this.db.prepare(
-      `SELECT id, url, name, attributes, last_seen AS lastSeen
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, url, name, attributes, last_seen AS lastSeen
          FROM source_project WHERE id IN (${placeholders(projectIds.length)})`
-    ).all(...projectIds);
+      ),
+      projectIds
+    );
     for (const r of rows) map2.set(r.id, r);
     return map2;
   }
@@ -21418,8 +21812,9 @@ var SqliteInventoryAssetsRepository = class {
   projectAggregates(projectIds) {
     const map2 = /* @__PURE__ */ new Map();
     if (projectIds.length === 0) return map2;
-    const rows = this.db.prepare(
-      `SELECT f.project_id AS projectId,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.project_id AS projectId,
                 coalesce(o.access, f.default_access) AS eff,
                 count(*) AS n,
                 coalesce(sum(f.findings_count), 0) AS findings
@@ -21427,7 +21822,9 @@ var SqliteInventoryAssetsRepository = class {
          LEFT JOIN file_access_override o ON o.project_id = f.project_id AND o.path = f.path
          WHERE f.project_id IN (${placeholders(projectIds.length)})
          GROUP BY f.project_id, eff`
-    ).all(...projectIds);
+      ),
+      projectIds
+    );
     for (const r of rows) {
       let agg = map2.get(r.projectId);
       if (!agg) {
@@ -21465,37 +21862,52 @@ var SqliteInventoryAssetsRepository = class {
   fetchProjectFilesUnder(projectId, prefix) {
     if (prefix === "") {
       return this.mapFileRows(
-        this.db.prepare(this.fileSelect("f.project_id = ? ORDER BY f.path ASC")).all(projectId)
+        allRows(
+          this.db.prepare(this.fileSelect("f.project_id = ? ORDER BY f.path ASC")),
+          [projectId]
+        )
       );
     }
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect("f.project_id = ? AND f.path LIKE ? ESCAPE '\\' ORDER BY f.path ASC")
-      ).all(projectId, `${escapeLikePattern(prefix)}/%`)
+      allRows(
+        this.db.prepare(
+          this.fileSelect("f.project_id = ? AND f.path LIKE ? ESCAPE '\\' ORDER BY f.path ASC")
+        ),
+        [projectId, `${escapeLikePattern(prefix)}/%`]
+      )
     );
   }
   fetchProjectFilesSearch(projectId, q) {
-    const pat = `%${escapeLikePattern(q)}%`;
+    const pat = containsPattern(q);
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect(
-          "f.project_id = ? AND (f.path LIKE ? ESCAPE '\\' OR f.name LIKE ? ESCAPE '\\') ORDER BY f.path ASC"
-        )
-      ).all(projectId, pat, pat)
+      allRows(
+        this.db.prepare(
+          this.fileSelect(
+            "f.project_id = ? AND (f.path LIKE ? ESCAPE '\\' OR f.name LIKE ? ESCAPE '\\') ORDER BY f.path ASC"
+          )
+        ),
+        [projectId, pat, pat]
+      )
     );
   }
   fetchProjectFilesBlocked(projectId) {
     return this.mapFileRows(
-      this.db.prepare(
-        this.fileSelect(
-          "f.project_id = ? AND coalesce(o.access, f.default_access) = 'blocked' AND f.blocked_at IS NOT NULL"
-        )
-      ).all(projectId)
+      allRows(
+        this.db.prepare(
+          this.fileSelect(
+            "f.project_id = ? AND coalesce(o.access, f.default_access) = 'blocked' AND f.blocked_at IS NOT NULL"
+          )
+        ),
+        [projectId]
+      )
     );
   }
   fetchProjectFile(projectId, path) {
     const rows = this.mapFileRows(
-      this.db.prepare(this.fileSelect("f.project_id = ? AND f.path = ?")).all(projectId, path)
+      allRows(
+        this.db.prepare(this.fileSelect("f.project_id = ? AND f.path = ?")),
+        [projectId, path]
+      )
     );
     return rows[0] ?? null;
   }
@@ -21509,39 +21921,32 @@ var SqlitePoliciesRepository = class {
   }
   db;
   readPolicies() {
-    const rows = this.db.prepare("SELECT * FROM policies").all();
-    const policies = [];
-    for (const row of rows) {
-      try {
-        const target = JSON.parse(row.target);
-        const customKeywords = row.custom_keywords ? JSON.parse(row.custom_keywords) : void 0;
-        policies.push(
-          Policy.parse({
-            id: row.id,
-            scope: row.scope,
-            target,
-            action: row.action,
-            enabled: row.enabled === 1,
-            customKeywords
-          })
-        );
-      } catch {
-      }
-    }
+    const rows = allRows(this.db.prepare("SELECT * FROM policies"));
+    const policies = mapRowsTolerant(rows, (row) => {
+      const target = JSON.parse(row.target);
+      const customKeywords = row.custom_keywords ? JSON.parse(row.custom_keywords) : void 0;
+      return Policy.parse({
+        id: row.id,
+        scope: row.scope,
+        target,
+        action: row.action,
+        enabled: intToBool(row.enabled),
+        customKeywords
+      });
+    });
     return Promise.resolve(policies);
   }
   // Seed one policy per bundled category from DEFAULT_ACTIONS so the
   // detection-type config exists from first run. Only when the table is empty,
   // so a user's edits are never clobbered.
   seedDefaults() {
-    const count = this.db.prepare("SELECT count(*) AS c FROM policies").get().c;
+    const count = countScalar(this.db, "SELECT count(*) AS n FROM policies");
     if (count > 0) return;
     const stmt = this.db.prepare(
       `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
        VALUES (:id, 'global', :target, :action, 1, :now, :now)`
     );
-    this.db.exec("BEGIN");
-    try {
+    failOpenTransaction(this.db, () => {
       for (const [category, action] of Object.entries(DEFAULT_ACTIONS)) {
         stmt.run({
           id: randomUUID5(),
@@ -21550,10 +21955,41 @@ var SqlitePoliciesRepository = class {
           now: Date.now()
         });
       }
-      this.db.exec("COMMIT");
-    } catch {
-      this.db.exec("ROLLBACK");
-    }
+    });
+  }
+  // Insert-or-update the single global per-category policy row, keyed on the
+  // existing uq_policies_scope_target unique index (scope, target). `action`
+  // uses the SAME vocabulary seedDefaults writes (DEFAULT_ACTIONS' ActionTaken
+  // values), so the runtime's resolveAction reads rows written by either path
+  // identically. On conflict, `action`, `enabled`, and `updated_at` are updated;
+  // `id` and `created_at` are left exactly as they were.
+  upsertCategoryAction(category, action) {
+    const now = Date.now();
+    this.db.prepare(
+      `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
+         VALUES (:id, 'global', :target, :action, 1, :now, :now)
+         ON CONFLICT(scope, target) DO UPDATE SET action = excluded.action, enabled = 1, updated_at = excluded.updated_at`
+    ).run({ id: randomUUID5(), target: JSON.stringify({ category }), action, now });
+  }
+  // Caps every global per-category policy currently set to block/redact down
+  // to warn (see warn-era-cap.ts). Rule-targeted policies are untouched.
+  // Returns the number of rows changed.
+  capCategoryActions() {
+    const info = this.db.prepare(
+      `UPDATE policies SET action='warn', updated_at=:now
+         WHERE scope='global' AND action IN ('block','redact')
+           AND json_extract(target,'$.category') IS NOT NULL`
+    ).run({ now: Date.now() });
+    return Number(info.changes);
+  }
+  // Read the current action for a single global per-category policy row, mirroring
+  // upsertCategoryAction's category-lookup predicate. Returns undefined when no
+  // row exists yet, so callers can distinguish an unset category from a set one.
+  getCategoryAction(category) {
+    const row = this.db.prepare(
+      `SELECT action FROM policies WHERE scope='global' AND json_extract(target,'$.category') = :category`
+    ).get({ category });
+    return row?.action;
   }
 };
 
@@ -21629,7 +22065,7 @@ var SqliteProjectFilesRepository = class {
   maxStampStmt;
   /** Replace `projectId`'s tree with the scan's files. Caller wraps in a transaction. */
   replaceForProject(projectId, scan2, now) {
-    const { maxStamp } = this.maxStampStmt.get({ projectId });
+    const maxStamp = getRow(this.maxStampStmt, { projectId })?.maxStamp ?? 0;
     const stamp = Math.max(now, maxStamp + 1);
     for (const file2 of scan2.files) {
       this.upsertStmt.run({
@@ -21712,7 +22148,7 @@ var SqliteResolutionsRepository = class {
   }
   /** The newest disposition recorded for a finding key, or undefined if none. */
   latestByKey(key) {
-    const row = this.latestStmt.get({ findingKey: key });
+    const row = getRow(this.latestStmt, { findingKey: key });
     if (!row) return void 0;
     return {
       // Safe narrows: insertResolution enum-parses both columns on every write,
@@ -21729,7 +22165,7 @@ var SqliteResolutionsRepository = class {
    * the CLI) surfaces for that file.
    */
   openAtRestKeysForPath(path) {
-    const rows = this.openAtRestStmt.all({ path });
+    const rows = allRows(this.openAtRestStmt, { path });
     return rows.map((r) => r.finding_key);
   }
   /**
@@ -21740,7 +22176,7 @@ var SqliteResolutionsRepository = class {
    * resolution row (see scan.ts).
    */
   resolvedAtRestKeysForPath(path) {
-    const rows = this.resolvedAtRestStmt.all({ path });
+    const rows = allRows(this.resolvedAtRestStmt, { path });
     return rows.map((r) => r.finding_key);
   }
 };
@@ -21769,31 +22205,25 @@ var SqliteScanLedgerRepository = class {
   // Previously scanned files under THIS ruleset, keyed by path. Rows from an
   // older ruleset are simply absent, which reads as "never scanned".
   entriesForRuleset(rulesetHash) {
-    const rows = this.readStmt.all({ rulesetHash });
+    const rows = allRows(this.readStmt, {
+      rulesetHash
+    });
     return new Map(rows.map((r) => [r.path, { mtime: r.mtime, contentHash: r.contentHash }]));
   }
   upsertEntries(entries) {
     if (entries.length === 0) return;
     const scannedAt = Date.now();
-    try {
-      this.db.exec("BEGIN");
-      try {
-        for (const entry of entries) {
-          this.upsertStmt.run({
-            path: entry.path,
-            mtime: entry.mtime,
-            contentHash: entry.contentHash,
-            rulesetHash: entry.rulesetHash,
-            scannedAt
-          });
-        }
-        this.db.exec("COMMIT");
-      } catch (err) {
-        this.db.exec("ROLLBACK");
-        throw err;
+    failOpenTransaction(this.db, () => {
+      for (const entry of entries) {
+        this.upsertStmt.run({
+          path: entry.path,
+          mtime: entry.mtime,
+          contentHash: entry.contentHash,
+          rulesetHash: entry.rulesetHash,
+          scannedAt
+        });
       }
-    } catch {
-    }
+    });
   }
 };
 
@@ -21870,8 +22300,9 @@ var SqliteSecurityRepository = class {
   // finding — its rn = 1 filter is also what makes the LEFT JOIN safe against
   // double-counting a key that accumulated several append-only rows.
   severitySummary() {
-    const rows = this.db.prepare(
-      `SELECT f.severity AS severity,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.severity AS severity,
                 COUNT(*) AS count,
                 SUM(CASE
                       WHEN e.kind != 'code_change' THEN 1
@@ -21890,7 +22321,8 @@ var SqliteSecurityRepository = class {
          LEFT JOIN ${LATEST_RESOLUTION_BY_KEY_SQL} latest
            ON latest.finding_key = f.finding_key
          GROUP BY f.severity`
-    ).all();
+      )
+    );
     const byRow = new Map(rows.map((r) => [r.severity, r]));
     const bySeverity = SEVERITIES.map((severity) => ({
       severity,
@@ -21974,14 +22406,15 @@ var SqliteSecurityRepository = class {
     const numBuckets = granularity === "day" ? lenDays : Math.ceil(lenDays / 7);
     const now = this.now();
     const windowStart = startOfUtcDay2(now) - (lenDays - 1) * DAY_MS4;
-    const rows = this.db.prepare(
-      // first_detected_at is the PRESERVED first-detection time (set once on a
-      // finding's INSERT, never overwritten on the re-detection upsert), so MTTR
-      // measures from first sighting — not the latest re-scan's event, whose
-      // occurred_at the upsert overwrites onto findings.event_id. COALESCE onto
-      // the parent event's occurred_at defends against any legacy/edge row the
-      // backfill left null.
-      `SELECT COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at, f.severity AS severity,
+    const rows = allRows(
+      this.db.prepare(
+        // first_detected_at is the PRESERVED first-detection time (set once on a
+        // finding's INSERT, never overwritten on the re-detection upsert), so MTTR
+        // measures from first sighting — not the latest re-scan's event, whose
+        // occurred_at the upsert overwrites onto findings.event_id. COALESCE onto
+        // the parent event's occurred_at defends against any legacy/edge row the
+        // backfill left null.
+        `SELECT COALESCE(f.first_detected_at, e.occurred_at) AS first_detected_at, f.severity AS severity,
                 (
                   SELECT fr.status FROM finding_resolution fr
                    WHERE fr.finding_key = f.finding_key
@@ -22007,14 +22440,16 @@ var SqliteSecurityRepository = class {
               WHERE fr.finding_key = f.finding_key
                 AND fr.resolved_at >= :windowStart
            )`
-      // The EXISTS is a SUPERSET prefilter that bounds the scan to keys with
-      // any resolution activity at/after the window start — a row this method
-      // ultimately counts has its LATEST resolution inside the window, which
-      // implies such a row exists, so nothing wanted is dropped. The exact
-      // latest-wins + status/method + window gate stays in JS below,
-      // dialect-agnostic. Without this, a
-      // 7d request evaluated the store's entire trackable-findings history.
-    ).all({ windowStart });
+        // The EXISTS is a SUPERSET prefilter that bounds the scan to keys with
+        // any resolution activity at/after the window start — a row this method
+        // ultimately counts has its LATEST resolution inside the window, which
+        // implies such a row exists, so nothing wanted is dropped. The exact
+        // latest-wins + status/method + window gate stays in JS below,
+        // dialect-agnostic. Without this, a
+        // 7d request evaluated the store's entire trackable-findings history.
+      ),
+      { windowStart }
+    );
     const sums = /* @__PURE__ */ new Map();
     const counts = /* @__PURE__ */ new Map();
     for (const r of rows) {
@@ -22044,8 +22479,9 @@ var SqliteSecurityRepository = class {
     if (opts.kind === "user") return Promise.resolve({ range, items: [] });
     const now = this.now();
     const from = now - RANGE_DAYS[range] * DAY_MS4;
-    const rows = this.db.prepare(
-      `SELECT json_extract(e.metadata, '$.repo') AS repo, count(*) AS c
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT json_extract(e.metadata, '$.repo') AS repo, count(*) AS c
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :from AND e.occurred_at < :to
            AND json_extract(e.metadata, '$.repo') IS NOT NULL
@@ -22053,7 +22489,9 @@ var SqliteSecurityRepository = class {
          GROUP BY repo
          ORDER BY c DESC, repo
          LIMIT :limit`
-    ).all({ from, to: now, limit });
+      ),
+      { from, to: now, limit }
+    );
     const items = rows.map((r) => ({
       id: `repo_${r.repo}`,
       name: r.repo,
@@ -22075,8 +22513,9 @@ var SqliteSecurityRepository = class {
   // resolutions.ts's openAtRestStmt accessor. Ordered by resolved_at DESC,
   // capped at `limit`.
   recentlyResolved(limit = 20) {
-    const rows = this.db.prepare(
-      `SELECT f.finding_key AS finding_key,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT f.finding_key AS finding_key,
                 f.rule_id AS rule_id,
                 f.severity AS severity,
                 json_extract(e.metadata, '$.filePath') AS path,
@@ -22110,7 +22549,9 @@ var SqliteSecurityRepository = class {
            ) IS NOT NULL
          ORDER BY latest_resolved_at DESC
          LIMIT :limit`
-    ).all({ limit });
+      ),
+      { limit }
+    );
     const items = rows.map((r) => ({
       findingKey: r.finding_key,
       ruleId: r.rule_id,
@@ -22127,12 +22568,15 @@ var SqliteSecurityRepository = class {
   // epoch-millis timestamp. occurred_at is an INTEGER column, so the bounds stay
   // numeric and the JS aggregations bucket/split on ms directly.
   findingsInRange(fromMs, toMs) {
-    const rows = this.db.prepare(
-      `SELECT e.occurred_at AS occurred_at, f.severity AS severity, f.action_taken AS action_taken
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT e.occurred_at AS occurred_at, f.severity AS severity, f.action_taken AS action_taken
          FROM findings f JOIN events e ON e.id = f.event_id
          WHERE e.occurred_at >= :from AND e.occurred_at < :to
          ORDER BY e.occurred_at`
-    ).all({ from: fromMs, to: toMs });
+      ),
+      { from: fromMs, to: toMs }
+    );
     return rows.map((r) => ({
       occurredAt: r.occurred_at,
       severity: r.severity,
@@ -22146,12 +22590,7 @@ import { randomUUID as randomUUID8 } from "crypto";
 var KIND_ORDER = ["provider", "internal", "ip"];
 var CALL_SITE_EMBED_CAP = 200;
 function parseNetwork(networkJson) {
-  if (!networkJson) return null;
-  try {
-    return JSON.parse(networkJson);
-  } catch {
-    return null;
-  }
+  return safeJson(networkJson, null);
 }
 function toEndpointSummary(row) {
   return {
@@ -22238,27 +22677,39 @@ var SqliteSharesRepository = class {
   }
   db;
   stats() {
-    const scalar = (sql) => this.db.prepare(sql).get()?.n ?? 0;
-    const destinations = scalar("SELECT count(*) AS n FROM share_destination");
-    const endpoints = scalar("SELECT count(*) AS n FROM share_endpoint");
-    const callSites = scalar("SELECT count(*) AS n FROM share_call_site");
-    const insecure = scalar(
+    const destinations = countScalar(this.db, "SELECT count(*) AS n FROM share_destination");
+    const endpoints = countScalar(this.db, "SELECT count(*) AS n FROM share_endpoint");
+    const callSites = countScalar(this.db, "SELECT count(*) AS n FROM share_call_site");
+    const insecure = countScalar(
+      this.db,
       "SELECT count(DISTINCT destination_id) AS n FROM share_endpoint WHERE transport = 'http'"
     );
-    const needsReview = scalar(
+    const needsReview = countScalar(
+      this.db,
       `SELECT count(DISTINCT d.id) AS n
        FROM share_destination d
        LEFT JOIN share_endpoint e ON e.destination_id = d.id AND e.transport = 'http'
        WHERE d.trust IN ('unverified', 'ip') OR e.id IS NOT NULL`
     );
-    const byKind = { provider: 0, internal: 0, ip: 0 };
-    for (const row of this.db.prepare("SELECT kind, count(*) AS n FROM share_destination GROUP BY kind").all()) {
-      byKind[row.kind] = row.n;
-    }
-    const byTrust = { recognized: 0, internal: 0, unverified: 0, ip: 0 };
-    for (const row of this.db.prepare("SELECT trust, count(*) AS n FROM share_destination GROUP BY trust").all()) {
-      byTrust[row.trust] = row.n;
-    }
+    const kindCounts = countBy(
+      this.db,
+      "SELECT kind AS k, count(*) AS n FROM share_destination GROUP BY kind"
+    );
+    const byKind = {
+      provider: kindCounts.get("provider") ?? 0,
+      internal: kindCounts.get("internal") ?? 0,
+      ip: kindCounts.get("ip") ?? 0
+    };
+    const trustCounts = countBy(
+      this.db,
+      "SELECT trust AS k, count(*) AS n FROM share_destination GROUP BY trust"
+    );
+    const byTrust = {
+      recognized: trustCounts.get("recognized") ?? 0,
+      internal: trustCounts.get("internal") ?? 0,
+      unverified: trustCounts.get("unverified") ?? 0,
+      ip: trustCounts.get("ip") ?? 0
+    };
     return Promise.resolve({
       destinations,
       endpoints,
@@ -22374,7 +22825,7 @@ var SqliteSharesRepository = class {
     }
     let sql;
     if (q) {
-      const pattern = `%${escapeLikePattern(q)}%`;
+      const pattern = containsPattern(q);
       conditions.push(
         `(d.name LIKE ? ESCAPE '\\' OR d.category LIKE ? ESCAPE '\\' OR e.url LIKE ? ESCAPE '\\'
           OR c.project LIKE ? ESCAPE '\\' OR c.file LIKE ? ESCAPE '\\')`
@@ -22394,24 +22845,31 @@ var SqliteSharesRepository = class {
              ${conditions.length ? `WHERE ${conditions.join(" AND ")}` : ""}
              ORDER BY d.created_at ASC, d.id ASC`;
     }
-    const rows = this.db.prepare(sql).all(...params);
+    const rows = allRows(
+      this.db.prepare(sql),
+      params
+    );
     return rows.map((r) => this.mapDestRow(r));
   }
   fetchDestinationById(destinationId) {
-    const row = this.db.prepare(
-      `SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
+    const row = getRow(
+      this.db.prepare(
+        `SELECT d.id, d.kind, d.name, d.host, d.category, d.trust, d.note,
                 d.network_json AS networkJson, d.last_seen AS lastSeenMs,
                 o.decision AS overrideDecision
          FROM share_destination d
          LEFT JOIN egress_decision_override o ON o.destination_id = d.id
          WHERE d.id = ?`
-    ).get(destinationId);
+      ),
+      [destinationId]
+    );
     return row ? this.mapDestRow(row) : null;
   }
   fetchEndpoints(destinationIds) {
     if (destinationIds.length === 0) return [];
-    const rows = this.db.prepare(
-      `SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT e.id, e.destination_id AS destinationId, e.method, e.transport, e.url,
                 e.template, e.data_class AS dataClass, e.last_seen AS lastSeenMs,
                 count(c.id) AS callSiteCount
          FROM share_endpoint e
@@ -22419,7 +22877,9 @@ var SqliteSharesRepository = class {
          WHERE e.destination_id IN (${placeholders(destinationIds.length)})
          GROUP BY e.id
          ORDER BY e.created_at ASC, e.id ASC`
-    ).all(...destinationIds);
+      ),
+      destinationIds
+    );
     return rows.map((r) => ({
       id: r.id,
       destinationId: r.destinationId,
@@ -22444,13 +22904,16 @@ var SqliteSharesRepository = class {
   }
   fetchCallSites(endpointIds) {
     if (endpointIds.length === 0) return [];
-    const rows = this.db.prepare(
-      `SELECT id, endpoint_id AS endpointId, project, file, line, snippet, dynamic, vendored,
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, endpoint_id AS endpointId, project, file, line, snippet, dynamic, vendored,
                 project_id AS projectId
          FROM share_call_site
          WHERE endpoint_id IN (${placeholders(endpointIds.length)})
          ORDER BY created_at ASC, id ASC`
-    ).all(...endpointIds);
+      ),
+      endpointIds
+    );
     return rows.map((r) => ({
       id: r.id,
       endpointId: r.endpointId,
@@ -22486,27 +22949,36 @@ var SqliteSourceProjectRepository = class {
   upsert(input, now = Date.now()) {
     const id = sourceProjectId(input.url);
     const row = toSourceProjectRow(input, id, now);
-    this.upsertStmt.run({
-      id: row.id,
-      url: row.url ?? null,
-      name: row.name ?? null,
-      attributes: row.attributes,
-      firstSeen: row.firstSeen,
-      lastSeen: row.lastSeen
-    });
+    this.upsertStmt.run(
+      bindParams({
+        id: row.id,
+        url: row.url,
+        name: row.name,
+        attributes: row.attributes,
+        firstSeen: row.firstSeen,
+        lastSeen: row.lastSeen
+      })
+    );
     return id;
   }
   findById(id) {
-    return this.db.prepare("SELECT * FROM source_project WHERE id = :id").get({ id });
+    return getRow(
+      this.db.prepare("SELECT * FROM source_project WHERE id = :id"),
+      {
+        id
+      }
+    );
   }
   // Distinct project names — a filter facet, served from the source_project
   // table, never from the audit fact table.
   distinctNames() {
-    const rows = this.db.prepare(
-      `SELECT DISTINCT name FROM source_project
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT DISTINCT name FROM source_project
          WHERE name IS NOT NULL
          ORDER BY name`
-    ).all();
+      )
+    );
     return rows.map((r) => r.name);
   }
 };
@@ -22525,8 +22997,7 @@ function hasLegacySampleRows(db) {
 function purgeSampleData(db) {
   try {
     if (!hasLegacySampleRows(db)) return;
-    db.exec("BEGIN");
-    try {
+    withTransaction(db, () => {
       db.exec(
         `DELETE FROM share_call_site WHERE endpoint_id IN (
            SELECT e.id FROM share_endpoint e
@@ -22571,11 +23042,7 @@ function purgeSampleData(db) {
         value TEXT NOT NULL
       )`);
       db.exec("DELETE FROM app_meta WHERE key LIKE 'sample_seeded:%'");
-      db.exec("COMMIT");
-    } catch (err) {
-      db.exec("ROLLBACK");
-      throw err;
-    }
+    });
   } catch {
   }
 }
@@ -22594,7 +23061,7 @@ function openWithPragmas(file2) {
 function backupLegacyStore(file2) {
   const backup = `${file2}.legacy.${String(Date.now())}.bak`;
   renameSync(file2, backup);
-  for (const sidecar of [`${file2}-wal`, `${file2}-shm`]) {
+  for (const sidecar of walSidecars(file2)) {
     if (existsSync2(sidecar)) rmSync(sidecar);
   }
   return backup;
@@ -22607,9 +23074,8 @@ function openLocalDatabase(dir) {
     db.close();
     const backup = backupLegacyStore(file2);
     db = openWithPragmas(file2);
-    process.stderr.write(
-      `[aka] Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.
-`
+    akaWarn(
+      `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
     );
   }
   applyMigrations(db);
@@ -22637,96 +23103,77 @@ function openLocalDatabase(dir) {
   const configInventory = new SqliteConfigInventoryRepository(db);
   policies.seedDefaults();
   function recordCapture(event, detected) {
-    try {
-      db.exec("BEGIN");
-      try {
-        events.insertEvent(event);
-        const sessionId = event.metadata?.sessionId;
-        findings.insertFindings(detected, sessionId ? { sessionId } : {});
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
-    } catch {
-    }
+    failOpenTransaction(db, () => {
+      events.insertEvent(event);
+      const sessionId = event.metadata?.sessionId;
+      findings.insertFindings(detected, sessionId ? { sessionId } : {});
+    });
   }
   function ensureInventory(ctx) {
     const resolved = {};
-    try {
-      db.exec("BEGIN");
-      try {
-        const now = Date.now();
-        if (ctx.host) resolved.hostId = inventory.upsert(ctx.host, now);
-        if (ctx.harness) {
-          resolved.harnessId = inventory.upsert(linkHost(ctx.harness, resolved.hostId), now);
-        }
-        resolved.accountId = inventory.upsert(
-          linkHost(
-            {
-              objectType: "user",
-              identityKey: "local",
-              attributes: { source: "local" }
-            },
-            resolved.hostId
-          ),
-          now
-        );
-        if (ctx.project) resolved.sourceProjectId = sourceProject.upsert(ctx.project, now);
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
-    } catch {
-      return {};
-    }
-    return resolved;
+    const committed = failOpenTransaction(db, () => {
+      const now = Date.now();
+      if (ctx.host) resolved.hostId = inventory.upsert(ctx.host, now);
+      if (ctx.harness) {
+        resolved.harnessId = inventory.upsert(linkHost(ctx.harness, resolved.hostId), now);
+      }
+      resolved.accountId = inventory.upsert(
+        linkHost(
+          {
+            objectType: "user",
+            identityKey: "local",
+            attributes: { source: "local" }
+          },
+          resolved.hostId
+        ),
+        now
+      );
+      if (ctx.project) resolved.sourceProjectId = sourceProject.upsert(ctx.project, now);
+    });
+    return committed ? resolved : {};
   }
   function recordConfigScan(record2) {
-    try {
-      db.exec("BEGIN");
-      try {
-        const now = isoToEpochMillis(record2.scanEvent.startedAt);
-        for (const item of record2.items) inventory.upsert(item, now);
-        auditEvents.insertAuditEvent(record2.scanEvent);
-        const definitionIds = /* @__PURE__ */ new Map();
-        for (const def of record2.definitions ?? []) {
-          definitionIds.set(`${def.ruleId}@${def.version}`, inspectionDefinitions.upsert(def));
-        }
-        for (const finding of record2.findings ?? []) {
-          const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
-          if (!definitionId) continue;
-          inspectionFindings.insertFinding({
-            id: randomUUID9(),
-            auditEventId: record2.scanEvent.id,
-            inspectionDefinitionId: definitionId,
-            span: finding.span,
-            maskedMatch: finding.maskedMatch,
-            actionTaken: finding.actionTaken,
-            confidence: finding.confidence
-          });
-        }
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
+    failOpenTransaction(db, () => {
+      const now = isoToEpochMillis(record2.scanEvent.startedAt);
+      for (const item of record2.items) inventory.upsert(item, now);
+      auditEvents.insertAuditEvent(record2.scanEvent);
+      const definitionIds = /* @__PURE__ */ new Map();
+      for (const def of record2.definitions ?? []) {
+        definitionIds.set(`${def.ruleId}@${def.version}`, inspectionDefinitions.upsert(def));
+      }
+      for (const finding of record2.findings ?? []) {
+        const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
+        if (!definitionId) continue;
+        inspectionFindings.insertFinding({
+          id: randomUUID9(),
+          auditEventId: record2.scanEvent.id,
+          inspectionDefinitionId: definitionId,
+          span: finding.span,
+          maskedMatch: finding.maskedMatch,
+          actionTaken: finding.actionTaken,
+          confidence: finding.confidence
+        });
       }
-    } catch {
-    }
+    });
   }
   function recordProjectFiles(projectId, scan2) {
     if (scan2.files.length === 0) return;
+    failOpenTransaction(db, () => {
+      projectFiles.replaceForProject(projectId, scan2, Date.now());
+    });
+  }
+  async function transaction(fn) {
+    db.exec("BEGIN");
     try {
-      db.exec("BEGIN");
+      const result = await fn();
+      db.exec("COMMIT");
+      return result;
+    } catch (err) {
       try {
-        projectFiles.replaceForProject(projectId, scan2, Date.now());
-        db.exec("COMMIT");
-      } catch (err) {
         db.exec("ROLLBACK");
-        throw err;
+      } catch {
       }
-    } catch {
+      throw err;
     }
   }
   function reconcileWorktreeProjects(canonicalId, headRoot, worktreeRoot) {
@@ -22745,8 +23192,7 @@ function openLocalDatabase(dir) {
         patternWin: `${escapeLikePattern(headPosix.split("/").join("\\"))}\\\\.claude\\\\worktrees\\\\%`
       });
       if (stale.length === 0) return;
-      db.exec("BEGIN");
-      try {
+      withTransaction(db, () => {
         for (const { id } of stale) {
           db.prepare(
             "UPDATE audit_events SET source_project_id = :canonicalId WHERE source_project_id = :id"
@@ -22758,11 +23204,7 @@ function openLocalDatabase(dir) {
           db.prepare("DELETE FROM project_file WHERE project_id = :id").run({ id });
           db.prepare("DELETE FROM source_project WHERE id = :id").run({ id });
         }
-        db.exec("COMMIT");
-      } catch (err) {
-        db.exec("ROLLBACK");
-        throw err;
-      }
+      });
     } catch {
     }
   }
@@ -22804,6 +23246,7 @@ function openLocalDatabase(dir) {
     purgeSampleData: () => {
       purgeSampleData(db);
     },
+    transaction,
     close: () => {
       db.close();
     }
@@ -22908,190 +23351,9 @@ function ensureLayoutDirSync(dir = defaultDataDir()) {
 import { readFileSync as readFileSync4, renameSync as renameSync4, writeFileSync as writeFileSync2 } from "fs";
 import { join as join6 } from "path";
 
-// ../packages/local-ops/src/update-cache.ts
-var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
-function cachePath(home) {
-  return join7(dataDir(home), "update-check.json");
-}
-function readCache(home) {
-  const path = cachePath(home);
-  if (!existsSync3(path)) return null;
-  try {
-    const raw = JSON.parse(readFileSync5(path, "utf8"));
-    if (!isRecord(raw) || typeof raw.checkedAt !== "number" || !isRecord(raw.report)) return null;
-    return raw;
-  } catch {
-    return null;
-  }
-}
-function writeCache(home, cache) {
-  if (!existsSync3(dataDir(home))) return;
-  try {
-    writeFileSync3(cachePath(home), `${JSON.stringify(cache, null, 2)}
-`);
-  } catch {
-  }
-}
-function isStale(cache, ttlMs = CHECK_TTL_MS) {
-  return Date.now() - cache.checkedAt >= ttlMs;
-}
-function clearCache(home) {
-  try {
-    rmSync2(cachePath(home), { force: true });
-  } catch {
-  }
-}
-function refreshCache(home) {
-  const previous = readCache(home);
-  writeCache(home, {
-    checkedAt: Date.now(),
-    report: gatherReportLive(),
-    notifiedPluginIds: previous?.notifiedPluginIds ?? []
-  });
-}
-function triggerBackgroundRefresh(home) {
-  const entry = process.argv[1];
-  if (!entry) return;
-  try {
-    spawn(process.execPath, [entry, "__update-refresh", "--home", home], {
-      detached: true,
-      stdio: "ignore"
-    }).unref();
-  } catch {
-  }
-}
-function notifyFromCache(home, opts) {
-  if (!opts.isTty) return;
-  const cache = readCache(home);
-  if (cache) {
-    const lines = [];
-    for (const s of cache.report.statuses) {
-      if (!s.updateAvailable || !s.latest) continue;
-      const cmd = s.kind === "cli" ? "aka update" : `aka update ${s.id}`;
-      lines.push(`  \u2B06 ${s.name}: ${s.installed ?? "\u2014"} \u2192 ${s.latest} available. Run \`${cmd}\`.`);
-    }
-    const alreadyShown = new Set(cache.notifiedPluginIds);
-    const freshlyShown = [];
-    for (const p of cache.report.availablePlugins) {
-      if (alreadyShown.has(p.id)) continue;
-      lines.push(
-        `  \u2728 New plugin available: ${p.name}. Install with \`aka plugins install ${p.id}\`.`
-      );
-      freshlyShown.push(p.id);
-    }
-    if (lines.length > 0) {
-      process.stderr.write(`
-${lines.join("\n")}
-`);
-    }
-    if (freshlyShown.length > 0) {
-      writeCache(home, {
-        ...cache,
-        notifiedPluginIds: [...cache.notifiedPluginIds, ...freshlyShown]
-      });
-    }
-  }
-  if (!cache || isStale(cache)) triggerBackgroundRefresh(home);
-}
-
-// ../packages/local-ops/src/update-render.ts
-function statusLabel(s) {
-  if (s.installed === null || s.latest === null) return "unknown";
-  return s.updateAvailable ? "update available" : "up to date";
-}
-function renderReport(report) {
-  const rows = report.statuses.map((s) => ({
-    name: s.name,
-    installed: s.installed ?? "\u2014",
-    latest: s.latest ?? "unknown",
-    status: statusLabel(s)
-  }));
-  const nameW = Math.max(9, ...rows.map((r) => r.name.length));
-  const instW = Math.max(9, ...rows.map((r) => r.installed.length));
-  const latW = Math.max(6, ...rows.map((r) => r.latest.length));
-  const lines = [];
-  lines.push(
-    `  ${"Component".padEnd(nameW)}  ${"Installed".padEnd(instW)}  ${"Latest".padEnd(latW)}  Status`
-  );
-  for (const r of rows) {
-    lines.push(
-      `  ${r.name.padEnd(nameW)}  ${r.installed.padEnd(instW)}  ${r.latest.padEnd(latW)}  ${r.status}`
-    );
-  }
-  if (report.availablePlugins.length > 0) {
-    lines.push("");
-    lines.push("  Available plugins (not installed):");
-    for (const p of report.availablePlugins) {
-      const version2 = p.latest ? ` v${p.latest}` : "";
-      lines.push(`    ${p.name} (${p.id})${version2} \u2014 install: aka plugins install ${p.id}`);
-    }
-  }
-  return lines.join("\n");
-}
-function outdated(report) {
-  return report.statuses.filter((s) => s.updateAvailable);
-}
-
-// src/command-manifest.ts
-var COMMAND_SPECS = [
-  { name: "init", summary: "Scaffold ~/.aka (settings + local database)" },
-  {
-    name: "scan",
-    argHint: "[path]",
-    summary: "Scan a file or directory and record findings (default: .)",
-    completesFiles: true
-  },
-  { name: "stats", summary: "Print findings / enforcement / detections from the local store" },
-  {
-    name: "detections",
-    argHint: "[update]",
-    summary: "List installed detection packs + available updates (updates are manual)",
-    args: ["update"]
-  },
-  {
-    name: "plugins",
-    summary: "List / install agent plugins (the CLI is an optional hub)",
-    args: ["list", "install"]
-  },
-  { name: "dashboard", summary: "Launch the local web dashboard and open it in the browser" },
-  {
-    name: "exception",
-    summary: "Manage detection exceptions (approve, add, list, show, revoke, rotate-key)",
-    args: ["approve", "add", "list", "show", "revoke", "rotate-key"]
-  },
-  {
-    name: "tui",
-    argHint: "[view]",
-    summary: "Interactive colour dashboard \u2014 health|findings|recommend|audit (needs a TTY)",
-    args: ["health", "findings", "recommend", "audit"]
-  },
-  {
-    name: "check-updates",
-    summary: "Show which components (CLI + plugins) have updates available"
-  },
-  {
-    name: "update",
-    argHint: "[what]",
-    summary: "Update the CLI and/or plugins (what: cli | <plugin-id> | all)",
-    args: ["cli", "all"]
-  },
-  {
-    name: "completion",
-    argHint: "<sh>",
-    summary: "Emit a shell completion script (sh: zsh | bash)",
-    args: ["zsh", "bash"]
-  }
-];
-var GLOBAL_FLAGS = ["--home", "--no-update-check", "--version", "--help"];
-function commandsHelp() {
-  const label = (s) => s.argHint ? `${s.name} ${s.argHint}` : s.name;
-  const width = Math.max(...COMMAND_SPECS.map((s) => label(s).length)) + 1;
-  return COMMAND_SPECS.map((s) => `  ${label(s).padEnd(width)}${s.summary}`).join("\n");
-}
-
-// src/commands/check-updates.ts
-import { existsSync as existsSync6 } from "fs";
-import { parseArgs } from "util";
+// ../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join7 } from "path";
 
 // ../packages/plugin-sdk/src/provider-env.ts
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -23112,7 +23374,7 @@ var providerEnvShape = {
 var ProviderEnvSchema = external_exports.object(providerEnvShape);
 
 // ../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync7, realpathSync, statSync as statSync3 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync, statSync as statSync3 } from "fs";
 import { homedir as homedir4 } from "os";
 import { basename as basename2, join as join9 } from "path";
 
@@ -25043,140 +25305,597 @@ var BUNDLED_PACKS = [
     ]
   },
   {
-    packId: "core-phi",
-    name: "Protected Health Information",
-    version: "0.1.0",
-    rawRules: [
-      mrn_default,
-      hipaa_identifier_default,
-      member_id_default,
-      group_id_default,
-      icd10_code_default,
-      ndc_code_default,
-      genetic_data_default,
-      biometric_ref_default
-    ]
+    packId: "core-phi",
+    name: "Protected Health Information",
+    version: "0.1.0",
+    rawRules: [
+      mrn_default,
+      hipaa_identifier_default,
+      member_id_default,
+      group_id_default,
+      icd10_code_default,
+      ndc_code_default,
+      genetic_data_default,
+      biometric_ref_default
+    ]
+  },
+  {
+    packId: "core-pii",
+    name: "Core PII",
+    version: "0.2.0",
+    rawRules: [
+      email_default,
+      ssn_default,
+      phone_us_default,
+      phone_intl_default,
+      ip_address_default,
+      dob_default,
+      drivers_license_us_default,
+      passport_us_default,
+      home_address_default,
+      name_default,
+      vin_default,
+      mac_address_default,
+      national_id_default,
+      zip_default
+    ]
+  },
+  {
+    packId: "secrets",
+    name: "Secrets & Credentials",
+    version: "0.1.0",
+    rawRules: [
+      aws_access_key_default,
+      aws_secret_key_default,
+      gcp_service_account_default,
+      azure_connection_string_default,
+      openai_api_key_default,
+      anthropic_api_key_default,
+      stripe_live_key_default,
+      slack_token_default,
+      discord_token_default,
+      sendgrid_key_default,
+      twilio_key_default,
+      gitlab_token_default,
+      digitalocean_token_default,
+      datadog_key_default,
+      npm_token_default,
+      heroku_api_key_default,
+      cloudflare_api_key_default,
+      pulumi_access_token_default,
+      terraform_cloud_token_default,
+      vault_token_default,
+      github_pat_default
+    ]
+  },
+  {
+    packId: "secrets-infra",
+    name: "Infrastructure Secrets",
+    version: "0.1.0",
+    rawRules: [
+      ssh_private_key_default,
+      db_connection_string_default,
+      jwt_token_default,
+      basic_auth_url_default,
+      basic_auth_header_default,
+      pgp_private_key_default,
+      bearer_token_default,
+      env_key_value_default,
+      password_field_default,
+      docker_config_auth_default,
+      kubeconfig_token_default,
+      api_key_header_default,
+      generic_high_entropy_secret_default
+    ]
+  }
+];
+
+// ../packages/plugin-sdk/src/rule-packs.ts
+var BUNDLED_NAMESPACE = "aka";
+function registerRulePack(packId, rawRules) {
+  const rules = rawRules.map((raw) => Rule.parse(raw));
+  registerPack({ id: packId, rules });
+}
+function registerBundledPacks() {
+  for (const pack of BUNDLED_PACKS) registerRulePack(pack.packId, pack.rawRules);
+}
+var cachedDetections;
+function bundledDetections() {
+  cachedDetections ??= BUNDLED_PACKS.map((pack) => ({
+    namespace: BUNDLED_NAMESPACE,
+    packId: pack.packId,
+    version: pack.version,
+    name: pack.name,
+    rules: pack.rawRules.map((raw) => Rule.parse(raw))
+  }));
+  return cachedDetections;
+}
+
+// ../packages/plugin-sdk/src/repo.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { basename, dirname as dirname2, isAbsolute, join as join8, sep as sep3 } from "path";
+function resolveRepoIdentity(cwd) {
+  try {
+    const root = findGitRoot(cwd);
+    if (!root) return void 0;
+    const ctx = resolveGitContext(root);
+    const headRoot = ctx?.headRoot ?? root;
+    const url2 = ctx ? remoteUrl(ctx) : void 0;
+    return {
+      // The path fallback is normalized to posix separators (a no-op outside
+      // win32) so the persistence layer's `/`-separated checkout-path patterns
+      // (the ghost sweep + the read-side worktree filter) match it as written.
+      url: url2 ?? headRoot.split(sep3).join("/"),
+      name: (url2 ? slugFromUrl(url2) : void 0) ?? basename(headRoot)
+    };
+  } catch {
+    return void 0;
+  }
+}
+function resolveWorktreeRoot(cwd) {
+  try {
+    return findGitRoot(cwd);
+  } catch {
+    return void 0;
+  }
+}
+function resolveHeadRoot(cwd) {
+  try {
+    const root = findGitRoot(cwd);
+    if (!root) return void 0;
+    return resolveGitContext(root)?.headRoot ?? root;
+  } catch {
+    return void 0;
+  }
+}
+function findGitRoot(start) {
+  let dir = start;
+  for (; ; ) {
+    if (existsSync4(join8(dir, ".git"))) return dir;
+    const parent = dirname2(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function resolveGitContext(root) {
+  const dotGit = join8(root, ".git");
+  try {
+    if (statSync2(dotGit).isDirectory()) {
+      return { configPath: join8(dotGit, "config"), headRoot: root };
+    }
+  } catch {
+    return void 0;
+  }
+  const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
+  if (!target) return void 0;
+  const gitdir = isAbsolute(target) ? target : join8(root, target);
+  if (existsSync4(join8(gitdir, "config"))) {
+    return { configPath: join8(gitdir, "config"), headRoot: root };
+  }
+  const commonRaw = safeRead(join8(gitdir, "commondir"))?.trim();
+  if (!commonRaw) return void 0;
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join8(gitdir, commonRaw);
+  const headRoot = basename(commonGitDir) === ".git" ? dirname2(commonGitDir) : root;
+  return { configPath: join8(commonGitDir, "config"), headRoot };
+}
+function safeRead(path) {
+  try {
+    return readFileSync5(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function remoteUrl(ctx) {
+  const config2 = safeRead(ctx.configPath);
+  if (config2 === void 0) return void 0;
+  const remotes = parseRemoteUrls(config2);
+  return remotes.origin ?? Object.values(remotes)[0];
+}
+function parseRemoteUrls(config2) {
+  const remotes = {};
+  let current;
+  for (const raw of config2.split("\n")) {
+    const line = raw.trim();
+    const header = /^\[remote "([^"]+)"\]$/.exec(line);
+    if (header) {
+      current = header[1];
+      continue;
+    }
+    if (line.startsWith("[")) {
+      current = void 0;
+      continue;
+    }
+    if (current && !(current in remotes)) {
+      const url2 = /^url\s*=\s*(.+)$/.exec(line)?.[1];
+      if (url2) remotes[current] = url2.trim();
+    }
+  }
+  return remotes;
+}
+function slugFromUrl(url2) {
+  const segment = url2.replace(/\.git$/, "").split(/[/:]/).filter(Boolean).pop();
+  return segment && segment.length > 0 ? segment : void 0;
+}
+
+// ../packages/plugin-sdk/src/events.ts
+import { createHash as createHash4, randomUUID as randomUUID10 } from "crypto";
+
+// ../packages/plugin-sdk/src/finding-key.ts
+import { createHash as createHash5 } from "crypto";
+
+// ../packages/plugin-sdk/src/inventory-resolver.ts
+import { arch, hostname as hostname3, platform, release } from "os";
+
+// ../packages/plugin-sdk/src/nudge.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
+
+// ../packages/plugin-sdk/src/project-files.ts
+var import_ignore2 = __toESM(require_ignore(), 1);
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
+import { basename as basename3, join as join11, relative as relative2, sep as sep4 } from "path";
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  ".pnpm-store",
+  ".venv",
+  "venv",
+  "__pycache__",
+  ".next",
+  ".turbo",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  "target",
+  ".cache"
+]);
+var MAX_FILES = 2e4;
+function readIgnoreLayer2(dir) {
+  try {
+    const content = readFileSync8(join11(dir, ".gitignore"), "utf8");
+    return { base: dir, matcher: (0, import_ignore2.default)().add(content) };
+  } catch {
+    return void 0;
+  }
+}
+function isIgnored(layers, absPath, isDir) {
+  let ignored = false;
+  for (const layer of layers) {
+    const rel = relative2(layer.base, absPath).split(sep4).join("/") + (isDir ? "/" : "");
+    const verdict = layer.matcher.test(rel);
+    if (verdict.ignored) ignored = true;
+    else if (verdict.unignored) ignored = false;
+  }
+  return ignored;
+}
+var GENERATED_FILES = /* @__PURE__ */ new Set([
+  "pnpm-lock.yaml",
+  "package-lock.json",
+  "yarn.lock",
+  "cargo.lock",
+  "poetry.lock",
+  "gemfile.lock",
+  "composer.lock",
+  "go.sum"
+]);
+var CONFIG_EXTENSIONS = /* @__PURE__ */ new Set([".yml", ".yaml", ".toml", ".ini", ".properties", ".conf"]);
+var DOCS_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".mdx", ".rst", ".adoc", ".txt"]);
+var CONFIG_TXT_BASENAMES = /* @__PURE__ */ new Set(["cmakelists.txt", "constraints.txt", "robots.txt"]);
+var DATA_EXTENSIONS = /* @__PURE__ */ new Set([".csv", ".tsv", ".parquet", ".sql", ".jsonl", ".ndjson"]);
+var CONFIG_BASENAMES = /* @__PURE__ */ new Set([
+  "package.json",
+  "dockerfile",
+  "makefile",
+  "justfile",
+  ".gitignore",
+  ".gitattributes",
+  ".npmrc",
+  ".nvmrc",
+  ".editorconfig",
+  ".akaignore"
+]);
+function classifyOrigin(relPath, name) {
+  const lowerName = name.toLowerCase();
+  const dot = lowerName.lastIndexOf(".");
+  const ext = dot > 0 ? lowerName.slice(dot) : "";
+  const segments = relPath.split("/");
+  if (GENERATED_FILES.has(lowerName) || lowerName.includes(".generated.") || segments.includes("__generated__") || segments.includes("generated") || ext === ".map" || lowerName.endsWith(".min.js") || lowerName.endsWith(".min.css")) {
+    return "generated";
+  }
+  if (segments.includes("vendor") || segments.includes("third_party")) return "vendored";
+  if (CONFIG_TXT_BASENAMES.has(lowerName) || ext === ".txt" && lowerName.startsWith("requirements")) {
+    return "config";
+  }
+  if (DOCS_EXTENSIONS.has(ext) || lowerName.startsWith("license") || segments[0] === "docs") {
+    return "docs";
+  }
+  if (DATA_EXTENSIONS.has(ext) || segments.includes("fixtures") || segments.includes("__fixtures__")) {
+    return "data";
+  }
+  if (CONFIG_BASENAMES.has(lowerName) || CONFIG_EXTENSIONS.has(ext) || lowerName.startsWith(".") || lowerName.includes(".config.") || lowerName.startsWith("tsconfig")) {
+    return "config";
+  }
+  return "source";
+}
+function resolveProjectFiles(cwd) {
+  try {
+    let visit3 = function(dir, layers) {
+      let dirents;
+      try {
+        dirents = readdirSync3(dir, { withFileTypes: true, encoding: "utf8" });
+      } catch {
+        walk.lostSubtree = true;
+        return false;
+      }
+      const layer = readIgnoreLayer2(dir);
+      const dirLayers = layer ? [...layers, layer] : layers;
+      for (const entry of dirents) {
+        const fullPath = join11(dir, entry.name);
+        if (entry.isDirectory()) {
+          if (SKIP_DIRS2.has(entry.name) || isIgnored(dirLayers, fullPath, true)) continue;
+          if (existsSync5(join11(fullPath, ".git"))) continue;
+          if (visit3(fullPath, dirLayers)) return true;
+          continue;
+        }
+        if (!entry.isFile()) continue;
+        if (entry.name === ".git") continue;
+        if (isIgnored(dirLayers, fullPath, false)) continue;
+        if (files.length >= MAX_FILES) return true;
+        const relPath = relative2(root, fullPath).split(sep4).join("/");
+        files.push({
+          path: relPath,
+          name: basename3(entry.name),
+          origin: classifyOrigin(relPath, entry.name),
+          defaultAccess: "approved"
+        });
+      }
+      return false;
+    };
+    var visit2 = visit3;
+    const worktree = resolveWorktreeRoot(cwd);
+    if (!worktree) return void 0;
+    const root = worktree;
+    const isLinkedCheckout = resolveHeadRoot(cwd) !== worktree;
+    const files = [];
+    const walk = { lostSubtree: false };
+    const truncated = visit3(root, []) || walk.lostSubtree || isLinkedCheckout;
+    if (files.length === 0) return void 0;
+    files.sort((a, b) => a.path.localeCompare(b.path));
+    return { files, truncated, scannedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  } catch {
+    return void 0;
+  }
+}
+
+// ../packages/plugin-sdk/src/runtime.ts
+import { randomUUID as randomUUID11 } from "crypto";
+
+// ../packages/plugin-sdk/src/suppressions.ts
+var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
+
+// ../packages/plugin-sdk/src/throttle.ts
+import { mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
+
+// ../packages/local-ops/src/project-inventory.ts
+function recordProjectInventory(db, target) {
+  try {
+    const abs = resolve(target);
+    statSync5(abs);
+    const identity = resolveRepoIdentity(abs);
+    if (!identity) return null;
+    const sourceProjectId2 = db.sourceProject.upsert({
+      url: identity.url,
+      name: identity.name,
+      attributes: {}
+    });
+    const scan2 = resolveProjectFiles(abs);
+    if (scan2) db.recordProjectFiles(sourceProjectId2, scan2);
+    const headRoot = resolveHeadRoot(abs);
+    const worktreeRoot = resolveWorktreeRoot(abs);
+    if (headRoot && worktreeRoot) {
+      db.reconcileWorktreeProjects(sourceProjectId2, headRoot, worktreeRoot);
+    }
+    return {
+      projectId: sourceProjectId2,
+      name: identity.name,
+      url: identity.url,
+      fileCount: scan2?.files.length ?? 0,
+      truncated: scan2?.truncated ?? false
+    };
+  } catch {
+    return null;
+  }
+}
+
+// ../packages/local-ops/src/update-cache.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
+var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
+function cachePath(home) {
+  return join13(dataDir(home), "update-check.json");
+}
+function readCache(home) {
+  const path = cachePath(home);
+  if (!existsSync6(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync9(path, "utf8"));
+    if (!isRecord(raw) || typeof raw.checkedAt !== "number" || !isRecord(raw.report)) return null;
+    return raw;
+  } catch {
+    return null;
+  }
+}
+function writeCache(home, cache) {
+  if (!existsSync6(dataDir(home))) return;
+  try {
+    writeFileSync6(cachePath(home), `${JSON.stringify(cache, null, 2)}
+`);
+  } catch {
+  }
+}
+function isStale(cache, ttlMs = CHECK_TTL_MS) {
+  return Date.now() - cache.checkedAt >= ttlMs;
+}
+function clearCache(home) {
+  try {
+    rmSync2(cachePath(home), { force: true });
+  } catch {
+  }
+}
+function refreshCache(home) {
+  const previous = readCache(home);
+  writeCache(home, {
+    checkedAt: Date.now(),
+    report: gatherReportLive(),
+    notifiedPluginIds: previous?.notifiedPluginIds ?? []
+  });
+}
+function triggerBackgroundRefresh(home) {
+  const entry = process.argv[1];
+  if (!entry) return;
+  try {
+    spawn(process.execPath, [entry, "__update-refresh", "--home", home], {
+      detached: true,
+      stdio: "ignore"
+    }).unref();
+  } catch {
+  }
+}
+function notifyFromCache(home, opts) {
+  if (!opts.isTty) return;
+  const cache = readCache(home);
+  if (cache) {
+    const lines = [];
+    for (const s of cache.report.statuses) {
+      if (!s.updateAvailable || !s.latest) continue;
+      const cmd = s.kind === "cli" ? "aka update" : `aka update ${s.id}`;
+      lines.push(`  \u2B06 ${s.name}: ${s.installed ?? "\u2014"} \u2192 ${s.latest} available. Run \`${cmd}\`.`);
+    }
+    const alreadyShown = new Set(cache.notifiedPluginIds);
+    const freshlyShown = [];
+    for (const p of cache.report.availablePlugins) {
+      if (alreadyShown.has(p.id)) continue;
+      lines.push(
+        `  \u2728 New plugin available: ${p.name}. Install with \`aka plugins install ${p.id}\`.`
+      );
+      freshlyShown.push(p.id);
+    }
+    if (lines.length > 0) {
+      process.stderr.write(`
+${lines.join("\n")}
+`);
+    }
+    if (freshlyShown.length > 0) {
+      writeCache(home, {
+        ...cache,
+        notifiedPluginIds: [...cache.notifiedPluginIds, ...freshlyShown]
+      });
+    }
+  }
+  if (!cache || isStale(cache)) triggerBackgroundRefresh(home);
+}
+
+// ../packages/local-ops/src/update-render.ts
+function statusLabel(s) {
+  if (s.installed === null || s.latest === null) return "unknown";
+  return s.updateAvailable ? "update available" : "up to date";
+}
+function renderReport(report) {
+  const rows = report.statuses.map((s) => ({
+    name: s.name,
+    installed: s.installed ?? "\u2014",
+    latest: s.latest ?? "unknown",
+    status: statusLabel(s)
+  }));
+  const nameW = Math.max(9, ...rows.map((r) => r.name.length));
+  const instW = Math.max(9, ...rows.map((r) => r.installed.length));
+  const latW = Math.max(6, ...rows.map((r) => r.latest.length));
+  const lines = [];
+  lines.push(
+    `  ${"Component".padEnd(nameW)}  ${"Installed".padEnd(instW)}  ${"Latest".padEnd(latW)}  Status`
+  );
+  for (const r of rows) {
+    lines.push(
+      `  ${r.name.padEnd(nameW)}  ${r.installed.padEnd(instW)}  ${r.latest.padEnd(latW)}  ${r.status}`
+    );
+  }
+  if (report.availablePlugins.length > 0) {
+    lines.push("");
+    lines.push("  Available plugins (not installed):");
+    for (const p of report.availablePlugins) {
+      const version2 = p.latest ? ` v${p.latest}` : "";
+      lines.push(`    ${p.name} (${p.id})${version2} \u2014 install: aka plugins install ${p.id}`);
+    }
+  }
+  return lines.join("\n");
+}
+function outdated(report) {
+  return report.statuses.filter((s) => s.updateAvailable);
+}
+
+// src/command-manifest.ts
+var COMMAND_SPECS = [
+  { name: "init", summary: "Scaffold ~/.aka (settings + local database)" },
+  {
+    name: "scan",
+    argHint: "[path]",
+    summary: "Scan a file or directory and record findings (default: .)",
+    completesFiles: true
+  },
+  { name: "stats", summary: "Print findings / enforcement / detections from the local store" },
+  {
+    name: "detections",
+    argHint: "[update]",
+    summary: "List installed detection packs + available updates (updates are manual)",
+    args: ["update"]
+  },
+  {
+    name: "plugins",
+    summary: "List / install agent plugins (the CLI is an optional hub)",
+    args: ["list", "install"]
+  },
+  { name: "dashboard", summary: "Launch the local web dashboard and open it in the browser" },
+  {
+    name: "exception",
+    summary: "Manage detection exceptions (approve, add, list, show, revoke, rotate-key)",
+    args: ["approve", "add", "list", "show", "revoke", "rotate-key"]
+  },
+  {
+    name: "tui",
+    argHint: "[view]",
+    summary: "Interactive colour dashboard \u2014 health|findings|recommend|audit (needs a TTY)",
+    args: ["health", "findings", "recommend", "audit"]
   },
   {
-    packId: "core-pii",
-    name: "Core PII",
-    version: "0.2.0",
-    rawRules: [
-      email_default,
-      ssn_default,
-      phone_us_default,
-      phone_intl_default,
-      ip_address_default,
-      dob_default,
-      drivers_license_us_default,
-      passport_us_default,
-      home_address_default,
-      name_default,
-      vin_default,
-      mac_address_default,
-      national_id_default,
-      zip_default
-    ]
+    name: "check-updates",
+    summary: "Show which components (CLI + plugins) have updates available"
   },
   {
-    packId: "secrets",
-    name: "Secrets & Credentials",
-    version: "0.1.0",
-    rawRules: [
-      aws_access_key_default,
-      aws_secret_key_default,
-      gcp_service_account_default,
-      azure_connection_string_default,
-      openai_api_key_default,
-      anthropic_api_key_default,
-      stripe_live_key_default,
-      slack_token_default,
-      discord_token_default,
-      sendgrid_key_default,
-      twilio_key_default,
-      gitlab_token_default,
-      digitalocean_token_default,
-      datadog_key_default,
-      npm_token_default,
-      heroku_api_key_default,
-      cloudflare_api_key_default,
-      pulumi_access_token_default,
-      terraform_cloud_token_default,
-      vault_token_default,
-      github_pat_default
-    ]
+    name: "update",
+    argHint: "[what]",
+    summary: "Update the CLI and/or plugins (what: cli | <plugin-id> | all)",
+    args: ["cli", "all"]
   },
   {
-    packId: "secrets-infra",
-    name: "Infrastructure Secrets",
-    version: "0.1.0",
-    rawRules: [
-      ssh_private_key_default,
-      db_connection_string_default,
-      jwt_token_default,
-      basic_auth_url_default,
-      basic_auth_header_default,
-      pgp_private_key_default,
-      bearer_token_default,
-      env_key_value_default,
-      password_field_default,
-      docker_config_auth_default,
-      kubeconfig_token_default,
-      api_key_header_default,
-      generic_high_entropy_secret_default
-    ]
+    name: "completion",
+    argHint: "<sh>",
+    summary: "Emit a shell completion script (sh: zsh | bash)",
+    args: ["zsh", "bash"]
   }
 ];
-
-// ../packages/plugin-sdk/src/rule-packs.ts
-var BUNDLED_NAMESPACE = "aka";
-function registerRulePack(packId, rawRules) {
-  const rules = rawRules.map((raw) => Rule.parse(raw));
-  registerPack({ id: packId, rules });
-}
-function registerBundledPacks() {
-  for (const pack of BUNDLED_PACKS) registerRulePack(pack.packId, pack.rawRules);
-}
-var cachedDetections;
-function bundledDetections() {
-  cachedDetections ??= BUNDLED_PACKS.map((pack) => ({
-    namespace: BUNDLED_NAMESPACE,
-    packId: pack.packId,
-    version: pack.version,
-    name: pack.name,
-    rules: pack.rawRules.map((raw) => Rule.parse(raw))
-  }));
-  return cachedDetections;
+var GLOBAL_FLAGS = ["--home", "--no-update-check", "--version", "--help"];
+function commandsHelp() {
+  const label = (s) => s.argHint ? `${s.name} ${s.argHint}` : s.name;
+  const width = Math.max(...COMMAND_SPECS.map((s) => label(s).length)) + 1;
+  return COMMAND_SPECS.map((s) => `  ${label(s).padEnd(width)}${s.summary}`).join("\n");
 }
 
-// ../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { basename, dirname as dirname2, isAbsolute, join as join8, sep as sep3 } from "path";
-
-// ../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID10 } from "crypto";
-
-// ../packages/plugin-sdk/src/finding-key.ts
-import { createHash as createHash5 } from "crypto";
-
-// ../packages/plugin-sdk/src/inventory-resolver.ts
-import { arch, hostname as hostname3, platform, release } from "os";
-
-// ../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
-
-// ../packages/plugin-sdk/src/project-files.ts
-var import_ignore2 = __toESM(require_ignore(), 1);
-import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
-import { basename as basename3, join as join11, relative as relative2, sep as sep4 } from "path";
-
-// ../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID11 } from "crypto";
-
-// ../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+// src/commands/check-updates.ts
+import { existsSync as existsSync7 } from "fs";
+import { parseArgs } from "util";
 
 // src/lib/args.ts
 var HOME_OPTION = { home: { type: "string" } };
@@ -25206,7 +25925,7 @@ function runCheckUpdates(argv) {
     out.write(`${String(ups.length)} update(s) available \u2014 run \`aka update\` to apply.
 `);
   }
-  if (existsSync6(dataDir(home))) {
+  if (existsSync7(dataDir(home))) {
     const notifiedPluginIds = readCache(home)?.notifiedPluginIds ?? [];
     writeCache(home, { checkedAt: Date.now(), report, notifiedPluginIds });
   }
@@ -25360,10 +26079,10 @@ function runCompletion(argv) {
 
 // src/commands/dashboard.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { createRequire } from "module";
 import { createServer } from "net";
-import { dirname as dirname3, join as join13 } from "path";
+import { dirname as dirname3, join as join14 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { parseArgs as parseArgs2 } from "util";
 
@@ -25383,14 +26102,14 @@ function openUrl(url2) {
 var require2 = createRequire(import.meta.url);
 var here = dirname3(fileURLToPath2(import.meta.url));
 function isPortFree(port) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const probe = createServer();
     probe.once("error", () => {
-      resolve(false);
+      resolve2(false);
     });
     probe.once("listening", () => {
       probe.close(() => {
-        resolve(true);
+        resolve2(true);
       });
     });
     probe.listen(port, "127.0.0.1");
@@ -25433,9 +26152,9 @@ async function runDashboard(argv) {
   }
   refreshUpdateMirror(dataDir());
   const bundledServer = [
-    join13(here, "..", "web-ui", "server.js"),
-    join13(here, "..", "web-ui", "web-ui", "server.js")
-  ].find((p) => existsSync7(p));
+    join14(here, "..", "web-ui", "server.js"),
+    join14(here, "..", "web-ui", "web-ui", "server.js")
+  ].find((p) => existsSync8(p));
   if (bundledServer) {
     launchStandalone(bundledServer, port, shouldOpen, url2);
     return;
@@ -25454,7 +26173,7 @@ async function runDashboard(argv) {
     onReadyOpen(child, shouldOpen, url2, `Starting the AKA dashboard at ${url2}
 `);
   };
-  if (existsSync7(join13(webUiDir, ".next", "BUILD_ID"))) {
+  if (existsSync8(join14(webUiDir, ".next", "BUILD_ID"))) {
     startNext();
     return;
   }
@@ -25680,11 +26399,11 @@ function terminalPrompter() {
     },
     isInteractive: process.stdin.isTTY && process.stdout.isTTY,
     ask(question) {
-      return new Promise((resolve) => {
+      return new Promise((resolve2) => {
         const rl = createInterface({ input: process.stdin, output: process.stdout });
         rl.question(question, (answer) => {
           rl.close();
-          resolve(answer);
+          resolve2(answer);
         });
       });
     },
@@ -25695,7 +26414,7 @@ function terminalPrompter() {
     // fatal signals: a security tool must never brick the terminal it was
     // invoked from.
     askHidden(question) {
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve2, reject) => {
         const stdin = process.stdin;
         process.stdout.write(question);
         stdin.setRawMode(true);
@@ -25718,7 +26437,7 @@ function terminalPrompter() {
           restore();
           process.stdout.write("\n");
           if (err) reject(err);
-          else resolve(state.value);
+          else resolve2(state.value);
         };
         const onError = (err) => {
           finish(err);
@@ -25881,6 +26600,8 @@ function viaLabel(via) {
       return "web add";
     case "api":
       return "api";
+    case "setup-triage":
+      return "setup triage";
   }
 }
 function scopeSummary(ex) {
@@ -26387,50 +27108,14 @@ async function runException(argv, io = terminalPrompter()) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync8, renameSync as renameSync5, writeFileSync as writeFileSync6 } from "fs";
-import { join as join14 } from "path";
-import { parseArgs as parseArgs5 } from "util";
-async function runInit(argv) {
-  const { values } = parseArgs5({ args: argv, options: HOME_OPTION });
-  const home = homeBase(values.home);
-  ensureLayoutDirSync(home);
-  const settings = settingsDir(home);
-  ensureLayoutDirSync(settings);
-  const settingsFile = join14(settings, "settings.json");
-  const settingsCreated = !existsSync8(settingsFile);
-  if (settingsCreated) {
-    const tmp = `${settingsFile}.tmp`;
-    writeFileSync6(tmp, `${JSON.stringify(defaultWorkspaceSettings(), null, 2)}
-`, {
-      mode: DATA_FILE_MODE
-    });
-    renameSync5(tmp, settingsFile);
-  }
-  const db = openLocalDatabase(dataDir(home));
-  let policyCount;
-  let packCount;
-  let updatesAvailable;
-  try {
-    db.installedPacks.recordInventory(bundledDetections(), cliRecordedBy());
-    policyCount = (await db.policies.readPolicies()).length;
-    packCount = (await db.installedPacks.counts()).packs;
-    updatesAvailable = (await db.detections.listDetections({ filter: "all" })).counts.updates;
-  } finally {
-    db.close();
-  }
-  process.stdout.write(
-    `\u2713 Initialized AKA at ${home}
-  settings: ${settingsFile}${settingsCreated ? "" : " (kept existing)"}
-  database: ${dbPath(home)}
-  seeded ${String(policyCount)} default policies, ${String(packCount)} detection pack(s)
-` + (updatesAvailable > 0 ? `  \u2B06 ${String(updatesAvailable)} detection pack update(s) available \u2014 review with \`aka detections\`, apply with \`aka detections update --all\`
-` : "")
-  );
-}
+import { existsSync as existsSync10, renameSync as renameSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join15 } from "path";
+import * as readline from "readline/promises";
+import { parseArgs as parseArgs6 } from "util";
 
 // src/commands/plugins.ts
 import { existsSync as existsSync9 } from "fs";
-import { parseArgs as parseArgs6 } from "util";
+import { parseArgs as parseArgs5 } from "util";
 function runPlugins(argv) {
   const [sub, ...rest] = argv;
   if (!sub || sub === "list") return listPlugins(rest);
@@ -26443,7 +27128,7 @@ function runPlugins(argv) {
   process.exitCode = 1;
 }
 async function listPlugins(argv) {
-  const { values } = parseArgs6({ args: argv, options: HOME_OPTION });
+  const { values } = parseArgs5({ args: argv, options: HOME_OPTION });
   const home = homeBase(values.home);
   const active = /* @__PURE__ */ new Set();
   if (existsSync9(dbPath(home))) {
@@ -26471,7 +27156,7 @@ async function listPlugins(argv) {
   out.write("Update:   aka update            (or: aka check-updates)\n");
 }
 function installPlugin(argv) {
-  const { positionals } = parseArgs6({ args: argv, options: HOME_OPTION, allowPositionals: true });
+  const { positionals } = parseArgs5({ args: argv, options: HOME_OPTION, allowPositionals: true });
   const id = positionals[0];
   if (!id) {
     process.stderr.write("aka plugins install: missing <agent> (try: aka plugins list)\n");
@@ -26528,11 +27213,95 @@ Then run \`aka init\` to set up the local store.
   }
 }
 
+// src/commands/init.ts
+async function runInit(argv) {
+  const { values } = parseArgs6({
+    args: argv,
+    options: { ...HOME_OPTION, yes: { type: "boolean", short: "y" } }
+  });
+  const home = homeBase(values.home);
+  ensureLayoutDirSync(home);
+  const settings = settingsDir(home);
+  ensureLayoutDirSync(settings);
+  const settingsFile = join15(settings, "settings.json");
+  const settingsCreated = !existsSync10(settingsFile);
+  if (settingsCreated) {
+    const tmp = `${settingsFile}.tmp`;
+    writeFileSync7(tmp, `${JSON.stringify(defaultWorkspaceSettings(), null, 2)}
+`, {
+      mode: DATA_FILE_MODE
+    });
+    renameSync5(tmp, settingsFile);
+  }
+  const db = openLocalDatabase(dataDir(home));
+  let policyCount;
+  let packCount;
+  let updatesAvailable;
+  try {
+    db.installedPacks.recordInventory(bundledDetections(), cliRecordedBy());
+    policyCount = (await db.policies.readPolicies()).length;
+    packCount = (await db.installedPacks.counts()).packs;
+    updatesAvailable = (await db.detections.listDetections({ filter: "all" })).counts.updates;
+  } finally {
+    db.close();
+  }
+  process.stdout.write(
+    `\u2713 Initialized AKA at ${home}
+  settings: ${settingsFile}${settingsCreated ? "" : " (kept existing)"}
+  database: ${dbPath(home)}
+  seeded ${String(policyCount)} default policies, ${String(packCount)} detection pack(s)
+` + (updatesAvailable > 0 ? `  \u2B06 ${String(updatesAvailable)} detection pack update(s) available \u2014 review with \`aka detections\`, apply with \`aka detections update --all\`
+` : "")
+  );
+  await offerPluginInstall(values.yes === true);
+}
+async function offerPluginInstall(autoYes) {
+  const agent = findAgent("claude-code");
+  const ref = agent ? pluginRef(agent) : void 0;
+  if (!agent || !ref) return;
+  if (installedPluginVersions().has(ref)) return;
+  const out = process.stdout;
+  if (!autoYes) {
+    if (!process.stdin.isTTY) {
+      out.write(
+        `
+No Claude Code plugin detected. Install it via the marketplace:
+  /plugin marketplace add ${agent.marketplaceSource ?? ""}
+  /plugin install ${ref}
+Or re-run \`aka init --yes\` to install it automatically.
+`
+      );
+      return;
+    }
+    if (!await confirm(`
+Install the AKA Claude Code plugin now (via the marketplace)? [y/N] `)) {
+      out.write("Skipped. Install anytime with `aka plugins install claude-code`.\n");
+      return;
+    }
+  }
+  await runPlugins(["install", "claude-code"]);
+}
+async function confirm(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(question)).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+
 // src/commands/scan.ts
+import { statSync as statSync6 } from "fs";
 import { parseArgs as parseArgs7 } from "util";
 function severityRank(s) {
   return Severity.options.indexOf(s);
 }
+function renderInventoryLine(inv) {
+  if (inv.fileCount === 0) return `Inventory: ${inv.name} \xB7 file tree unchanged`;
+  const partial2 = inv.truncated ? " (partial walk)" : "";
+  return `Inventory: ${inv.name} \xB7 ${String(inv.fileCount)} project file(s) recorded${partial2}`;
+}
 function runScan(argv) {
   const { values, positionals } = parseArgs7({
     args: argv,
@@ -26565,12 +27334,22 @@ function runScan(argv) {
     }
     failOn = parsed.data;
   }
+  try {
+    statSync6(target);
+  } catch {
+    process.stderr.write(`aka scan: no such file or directory: ${target}
+`);
+    process.exitCode = 1;
+    return;
+  }
   registerBundledPacks();
   const db = openLocalDatabase(dataDir(home));
   let result;
+  let inventory;
   try {
     const { ruleActions } = db.installedPacks.installedRuleset();
     result = scanPathIntoStore(db, target, { ruleActions, sourceTool: "cli" });
+    inventory = recordProjectInventory(db, target);
   } finally {
     db.close();
   }
@@ -26588,8 +27367,14 @@ function runScan(argv) {
         confidence: d.confidence
       }))
     );
+    const inventoryJson = inventory ? {
+      name: inventory.name,
+      url: inventory.url,
+      fileCount: inventory.fileCount,
+      truncated: inventory.truncated
+    } : null;
     process.stdout.write(
-      `${JSON.stringify({ target, scanned: result.scanned, findings }, null, 2)}
+      `${JSON.stringify({ target, scanned: result.scanned, findings, inventory: inventoryJson }, null, 2)}
 `
     );
   } else {
@@ -26597,6 +27382,8 @@ function runScan(argv) {
       `Scanned ${String(result.scanned)} file(s) under ${target} \xB7 ${String(result.findings)} finding(s) recorded
 `
     );
+    if (inventory) process.stdout.write(`${renderInventoryLine(inventory)}
+`);
   }
   if (failOn !== void 0) {
     const threshold = severityRank(failOn);
@@ -27335,7 +28122,7 @@ async function runTui(argv) {
 }
 
 // src/commands/update.ts
-import * as readline from "readline/promises";
+import * as readline2 from "readline/promises";
 import { parseArgs as parseArgs10 } from "util";
 async function runUpdate(argv) {
   const { values, positionals } = parseArgs10({
@@ -27385,7 +28172,7 @@ async function runUpdate(argv) {
       out.write("Re-run with --yes to apply (no interactive terminal detected).\n");
       return;
     }
-    if (!await confirm("Apply these updates? [y/N] ")) {
+    if (!await confirm2("Apply these updates? [y/N] ")) {
       out.write("Aborted \u2014 nothing changed.\n");
       return;
     }
@@ -27404,8 +28191,8 @@ async function runUpdate(argv) {
   }
   if (anyFailed) process.exitCode = 1;
 }
-async function confirm(question) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+async function confirm2(question) {
+  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   try {
     const answer = (await rl.question(question)).trim().toLowerCase();
     return answer === "y" || answer === "yes";