@bolvrk/engine-sqlite 0.1.4

package/dist/index.js

@@ -0,0 +1,1421 @@
+import {
+  SL_RULE_CORPUS_VERSION,
+  SQLITE_RULE_IDS,
+  sl001Meta,
+  sl002Meta,
+  sl003Meta,
+  sl004Meta,
+  sl005Meta,
+  sl006Meta,
+  sl007Meta,
+  sl008Meta,
+  sl009Meta,
+  sl010Meta,
+  sl011Meta,
+  sl012Meta,
+  sl013Meta,
+  sl014Meta,
+  sl015Meta,
+  sl016Meta,
+  sl017Meta,
+  sl018Meta,
+  sl019Meta,
+  sl020Meta,
+  sl021Meta,
+  sl022Meta,
+  sl023Meta,
+  sl024Meta,
+  sl025Meta,
+  sl026Meta,
+  sl027Meta,
+  sl028Meta,
+  sl029Meta,
+  sl030Meta,
+  sl031Meta,
+  sl032Meta,
+  sl033Meta,
+  sl034Meta,
+  sl035Meta,
+  sqliteMetas
+} from "./index-m4sztshc.js";
+
+// src/engine.ts
+import {
+  applySuppressions,
+  collectSuppressions,
+  CONTRACT_VERSION,
+  scanSecrets,
+  sortFindings
+} from "@bolvrk/engine";
+// package.json
+var package_default = {
+  name: "@bolvrk/engine-sqlite",
+  version: "0.1.4",
+  description: "Bolvrk SQLite migration danger rules (SL###) over a real SQLite grammar. ALPHA — static rules only, behind --engine=sqlite in the CLI.",
+  license: "(FSL-1.1-ALv2 AND Apache-2.0)",
+  homepage: "https://bolvrk.com",
+  repository: "github:bolvrk/bolvrk",
+  type: "module",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      bun: "./src/index.ts",
+      import: "./dist/index.js"
+    },
+    "./metas": {
+      types: "./dist/metas/index.d.ts",
+      bun: "./src/metas/index.ts",
+      import: "./dist/metas/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "src",
+    "LICENSE.md"
+  ],
+  scripts: {
+    typecheck: "tsc --noEmit",
+    build: "rm -rf dist && bun build src/index.ts src/metas/index.ts --outdir dist --target node --external @bolvrk/engine --external sql-parser-cst --splitting && tsc -p tsconfig.build.json",
+    docs: "bun scripts/gen-rule-docs.ts"
+  },
+  dependencies: {
+    "sql-parser-cst": "0.42.1"
+  },
+  peerDependencies: {
+    "@bolvrk/engine": "workspace:*"
+  },
+  devDependencies: {
+    "@bolvrk/engine": "workspace:*"
+  },
+  keywords: [
+    "sqlite",
+    "migrations",
+    "sql",
+    "lint",
+    "ddl"
+  ]
+};
+
+// src/parser.ts
+import { parse } from "sql-parser-cst";
+class SqliteMigrationParseError extends Error {
+  cause;
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "SqliteMigrationParseError";
+  }
+}
+var PARSER_VERSION = package_default.dependencies["sql-parser-cst"];
+function parseSqliteMigration(sql) {
+  let program;
+  try {
+    program = parse(sql, { dialect: "sqlite", includeRange: true });
+  } catch (err) {
+    const message = String(err?.message ?? err).split(`
+`)[0];
+    throw new SqliteMigrationParseError(`Migration is not valid SQLite SQL: ${message}`, err);
+  }
+  const statements = [];
+  for (const node of program.statements) {
+    if (node.type === "empty")
+      continue;
+    const [start, stop] = node.range ?? [0, sql.length];
+    const end = Math.min(stop + 1, sql.length);
+    statements.push({
+      index: statements.length,
+      type: node.type,
+      node,
+      sql: sql.slice(start, end).trim(),
+      location: start,
+      end
+    });
+  }
+  return { statements, parserVersion: PARSER_VERSION };
+}
+
+// src/helpers.ts
+function nameOf(node) {
+  if (!node)
+    return;
+  if (node.type === "identifier")
+    return node.name;
+  if (node.type === "member_expr")
+    return nameOf(node.property);
+  if (node.type === "keyword")
+    return String(node.name).toLowerCase();
+  return;
+}
+function items(node) {
+  if (!node)
+    return [];
+  if (node.type === "list_expr")
+    return node.items ?? [];
+  if (node.type === "paren_expr")
+    return items(node.expr);
+  return [node];
+}
+function alterActions(stmt) {
+  if (stmt.node.type !== "alter_table_stmt")
+    return [];
+  return items(stmt.node.actions);
+}
+function addedColumns(stmt) {
+  return alterActions(stmt).filter((action) => action.type === "alter_action_add_column").map((action) => action.column).filter((column) => column?.type === "column_definition");
+}
+function createdColumns(stmt) {
+  if (stmt.node.type !== "create_table_stmt")
+    return [];
+  return items(stmt.node.columns).filter((item) => item.type === "column_definition");
+}
+function tableConstraints(stmt) {
+  if (stmt.node.type !== "create_table_stmt")
+    return [];
+  return items(stmt.node.columns).filter((item) => item.type !== "column_definition");
+}
+function constraintOf(column, type) {
+  return (column.constraints ?? []).find((c) => c.type === type || c.constraint?.type === type);
+}
+function dataTypeName(column) {
+  const name = column.dataType?.name;
+  if (!name)
+    return "";
+  const parts = Array.isArray(name) ? name : [name];
+  return parts.map((part) => String(part?.name ?? part?.text ?? "")).join(" ").toUpperCase();
+}
+function tableOptions(stmt) {
+  if (stmt.node.type !== "create_table_stmt")
+    return [];
+  return items(stmt.node.options).filter((option) => option.type === "table_option").map((option) => (Array.isArray(option.name) ? option.name : [option.name]).map((kw) => String(kw?.name ?? "")).join(" ").toUpperCase());
+}
+function tableOf(stmt) {
+  const node = stmt.node;
+  switch (node.type) {
+    case "alter_table_stmt":
+    case "create_index_stmt":
+      return nameOf(node.table);
+    case "create_table_stmt":
+    case "create_view_stmt":
+      return nameOf(node.name);
+    case "drop_table_stmt":
+      return nameOf(items(node.tables)[0]);
+    case "insert_stmt":
+      return nameOf(node.clauses?.find((c) => c.type === "insert_clause")?.table);
+    case "update_stmt":
+      return nameOf(items(node.clauses?.find((c) => c.type === "update_clause")?.tables)[0]);
+    case "delete_stmt":
+      return nameOf(items(node.clauses?.find((c) => c.type === "delete_clause")?.tables)[0]);
+    default:
+      return;
+  }
+}
+function droppedTables(stmt) {
+  if (stmt.node.type !== "drop_table_stmt")
+    return [];
+  return items(stmt.node.tables).map(nameOf).filter((n) => !!n);
+}
+function tableCreatedInMigration(migration, beforeIndex, table) {
+  const wanted = table.toLowerCase();
+  return migration.statements.some((stmt) => stmt.index < beforeIndex && stmt.node.type === "create_table_stmt" && tableOf(stmt)?.toLowerCase() === wanted);
+}
+function tableRebuilds(migration) {
+  const out = [];
+  for (const drop of migration.statements) {
+    for (const table of droppedTables(drop)) {
+      const wanted = table.toLowerCase();
+      const rename = migration.statements.find((later) => later.index > drop.index && alterActions(later).some((a) => a.type === "alter_action_rename" && String(nameOf(a.newName) ?? "").toLowerCase() === wanted));
+      if (!rename)
+        continue;
+      const replacement = tableOf(rename) ?? "";
+      const copy = migration.statements.find((stmt) => stmt.index < drop.index && stmt.node.type === "insert_stmt" && tableOf(stmt)?.toLowerCase() === replacement.toLowerCase() && readsFromTable(stmt, table));
+      out.push({ drop, rename, table, replacement, replacementCreatedHere: !!replacement && tableCreatedInMigration(migration, rename.index, replacement), copy });
+    }
+  }
+  return out;
+}
+function readsFromTable(stmt, table) {
+  const wanted = table.toLowerCase();
+  const node = stmt.node;
+  const sources = (node.clauses ?? []).filter((c) => c.type !== "insert_clause");
+  return descendants(sources, (n) => n.type === "identifier" && String(n.name).toLowerCase() === wanted).length > 0;
+}
+function hasWhere(stmt) {
+  const clauses = stmt.node.clauses ?? [];
+  return clauses.some((c) => c.type === "where_clause");
+}
+function pragmaOf(stmt) {
+  if (stmt.node.type !== "pragma_stmt")
+    return;
+  const pragma = stmt.node.pragma;
+  if (!pragma)
+    return;
+  if (pragma.type === "pragma_assignment")
+    return { name: nameOf(pragma.name).toLowerCase(), value: literalText(pragma.value) };
+  if (pragma.type === "pragma_func_call") {
+    const arg = pragma.args?.expr;
+    return { name: nameOf(pragma.name).toLowerCase(), value: arg ? literalText(arg) : undefined };
+  }
+  const name = nameOf(pragma);
+  return name ? { name: name.toLowerCase() } : undefined;
+}
+function literalText(node) {
+  if (!node)
+    return;
+  if (node.type === "prefix_op_expr" && node.expr)
+    return `${String(node.operator ?? "")}${literalText(node.expr) ?? ""}`;
+  if (node.type === "keyword")
+    return String(node.name).toLowerCase();
+  if (node.type === "identifier")
+    return String(node.name).toLowerCase();
+  if ("value" in node && node.value !== undefined && node.value !== null)
+    return String(node.value).toLowerCase();
+  if (node.text)
+    return String(node.text).toLowerCase();
+  return;
+}
+function pragmaIsOff(value) {
+  return value !== undefined && ["off", "0", "false", "no"].includes(value);
+}
+function pragmaIsOn(value) {
+  return value !== undefined && ["on", "1", "true", "yes"].includes(value);
+}
+function insideTransaction(migration) {
+  const out = [];
+  let open = false;
+  for (const stmt of migration.statements) {
+    const type = stmt.node.type;
+    if (type === "start_transaction_stmt") {
+      out.push(false);
+      open = true;
+      continue;
+    }
+    if (type === "commit_transaction_stmt" || type === "rollback_transaction_stmt") {
+      out.push(open);
+      open = false;
+      continue;
+    }
+    out.push(open);
+  }
+  return out;
+}
+function descendants(node, predicate) {
+  const out = [];
+  const walk = (value) => {
+    if (!value || typeof value !== "object")
+      return;
+    if (Array.isArray(value)) {
+      for (const item of value)
+        walk(item);
+      return;
+    }
+    if (value.type && predicate(value))
+      out.push(value);
+    for (const key of Object.keys(value))
+      if (key !== "range" && typeof value[key] === "object")
+        walk(value[key]);
+  };
+  walk(node);
+  return out;
+}
+
+// src/rule.ts
+function finding(rule, stmt, props) {
+  return {
+    ruleId: rule.meta.id,
+    ruleVersion: rule.meta.version,
+    tier: rule.meta.tier,
+    severity: props.severity ?? rule.meta.defaultSeverity,
+    statementIndex: stmt.index,
+    sql: stmt.sql,
+    ...props
+  };
+}
+
+// src/rules/add-column.ts
+function eachAddedColumn(ctx, visit) {
+  for (const stmt of ctx.migration.statements) {
+    const columns = addedColumns(stmt);
+    if (columns.length === 0)
+      continue;
+    const table = tableOf(stmt) ?? "";
+    if (table && tableCreatedInMigration(ctx.migration, stmt.index, table))
+      continue;
+    for (const column of columns)
+      visit(stmt, table, column);
+  }
+}
+function isNullDefault(column) {
+  const def = constraintOf(column, "constraint_default");
+  return !def || def.expr?.type === "null_literal" || def.constraint?.expr?.type === "null_literal";
+}
+var sl001 = {
+  meta: sl001Meta,
+  check(ctx) {
+    const out = [];
+    eachAddedColumn(ctx, (stmt, table, column) => {
+      if (!constraintOf(column, "constraint_not_null"))
+        return;
+      if (constraintOf(column, "constraint_generated"))
+        return;
+      if (!isNullDefault(column))
+        return;
+      const name = nameOf(column.name);
+      out.push(finding(sl001, stmt, {
+        title: `ADD COLUMN "${name}" NOT NULL has no default — SQLite refuses it`,
+        message: `SQLite cannot fill existing rows of "${table}" with NULL for a NOT NULL column, so the statement fails: "Cannot add a NOT NULL column with default value NULL". ` + `Add a non-NULL DEFAULT (schema-only, no rewrite), or add the column nullable and enforce NOT NULL in a later rebuild.`,
+        object: { table, column: name }
+      }));
+    });
+    return out;
+  }
+};
+var sl002 = {
+  meta: sl002Meta,
+  check(ctx) {
+    const out = [];
+    eachAddedColumn(ctx, (stmt, table, column) => {
+      const kind = constraintOf(column, "constraint_primary_key") ? "PRIMARY KEY" : constraintOf(column, "constraint_unique") ? "UNIQUE" : undefined;
+      if (!kind)
+        return;
+      const name = nameOf(column.name);
+      out.push(finding(sl002, stmt, {
+        title: `ADD COLUMN "${name}" ${kind} is rejected by SQLite`,
+        message: `ALTER TABLE ADD COLUMN may not carry a ${kind} constraint; SQLite fails the statement and "${table}" is unchanged. ` + (kind === "UNIQUE" ? `Add the column plain and CREATE UNIQUE INDEX as its own statement.` : `A new primary key needs the table rebuilt (create, copy, drop, rename).`),
+        object: { table, column: name }
+      }));
+    });
+    return out;
+  }
+};
+var NON_CONSTANT_DEFAULTS = new Set(["CURRENT_TIME", "CURRENT_DATE", "CURRENT_TIMESTAMP"]);
+var sl003 = {
+  meta: sl003Meta,
+  check(ctx) {
+    const out = [];
+    eachAddedColumn(ctx, (stmt, table, column) => {
+      const def = constraintOf(column, "constraint_default");
+      const expr = def?.expr ?? def?.constraint?.expr;
+      if (!expr)
+        return;
+      const isCurrent = expr.type === "func_call" && NON_CONSTANT_DEFAULTS.has(String(nameOf(expr.name) ?? "").toUpperCase());
+      const isExpression = expr.type === "paren_expr";
+      if (!isCurrent && !isExpression)
+        return;
+      const name = nameOf(column.name);
+      out.push(finding(sl003, stmt, {
+        title: `ADD COLUMN "${name}" has a non-constant default — SQLite refuses it`,
+        message: `ALTER TABLE ADD COLUMN only accepts a constant default; ${isCurrent ? String(nameOf(expr.name)).toUpperCase() : "an expression in parentheses"} fails with "Cannot add a column with non-constant default" and "${table}" is unchanged. ` + `Use a constant default (or none) and set the value from the application or a trigger.`,
+        object: { table, column: name }
+      }));
+    });
+    return out;
+  }
+};
+var sl004 = {
+  meta: sl004Meta,
+  check(ctx) {
+    const out = [];
+    eachAddedColumn(ctx, (stmt, table, column) => {
+      const generated = constraintOf(column, "constraint_generated");
+      const storage = generated?.storageKw ?? generated?.constraint?.storageKw;
+      if (!generated || String(storage?.name ?? "").toUpperCase() !== "STORED")
+        return;
+      const name = nameOf(column.name);
+      out.push(finding(sl004, stmt, {
+        title: `ADD COLUMN "${name}" GENERATED ... STORED is rejected by SQLite`,
+        message: `Only VIRTUAL generated columns can be added with ALTER TABLE; a STORED one fails ("cannot add a STORED column") and "${table}" is unchanged. ` + `Declare it VIRTUAL, or make it part of a table rebuild.`,
+        object: { table, column: name }
+      }));
+    });
+    return out;
+  }
+};
+var sl005 = {
+  meta: sl005Meta,
+  check(ctx) {
+    const out = [];
+    eachAddedColumn(ctx, (stmt, table, column) => {
+      const references = constraintOf(column, "references_specification") ?? constraintOf(column, "constraint_foreign_key");
+      if (!references)
+        return;
+      if (isNullDefault(column))
+        return;
+      const name = nameOf(column.name);
+      out.push(finding(sl005, stmt, {
+        title: `ADD COLUMN "${name}" REFERENCES with a non-NULL default fails when foreign keys are on`,
+        message: `With PRAGMA foreign_keys=ON — the setting most applications use — SQLite rejects this statement ("Cannot add a REFERENCES column with non-NULL default value"); with it off the statement passes, so the outcome depends on the runner's connection. ` + `Add the column with a NULL default and backfill it.`,
+        object: { table, column: name }
+      }));
+    });
+    return out;
+  }
+};
+var sl008 = {
+  meta: sl008Meta,
+  check(ctx) {
+    const out = [];
+    eachAddedColumn(ctx, (stmt, table, column) => {
+      const check = constraintOf(column, "constraint_check");
+      const generatedNotNull = constraintOf(column, "constraint_generated") && constraintOf(column, "constraint_not_null");
+      if (!check && !generatedNotNull)
+        return;
+      const name = nameOf(column.name);
+      const what = check ? "a CHECK constraint" : "NOT NULL on a generated column";
+      out.push(finding(sl008, stmt, {
+        title: `ADD COLUMN "${name}" with ${what} scans every row of "${table}"`,
+        message: `Adding a column is schema-only in SQLite — except with ${what}, where the whole table is read under the write lock to verify existing rows before the change commits. ` + `On a large table, schedule it; or add the column without the constraint and enforce it in a later rebuild.`,
+        object: { table, column: name }
+      }));
+    });
+    return out;
+  }
+};
+
+// src/rules/dml-and-maintenance.ts
+var sl013 = {
+  meta: sl013Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "update_stmt" && stmt.node.type !== "delete_stmt")
+        continue;
+      if (hasWhere(stmt))
+        continue;
+      const table = tableOf(stmt) ?? "";
+      if (table && tableCreatedInMigration(ctx.migration, stmt.index, table))
+        continue;
+      const kind = stmt.node.type === "update_stmt" ? "UPDATE" : "DELETE";
+      out.push(finding(sl013, stmt, {
+        title: `${kind} with no WHERE touches every row of "${table}"`,
+        message: `Every row changes in one write transaction; SQLite's single writer holds the lock for the whole statement and every other writer waits or fails with SQLITE_BUSY, while the journal grows by the size of the change. ` + `Add the predicate — and if this is a backfill, batch it by rowid range from a job.`,
+        object: { table }
+      }));
+    }
+    return out;
+  }
+};
+var sl014 = {
+  meta: sl014Meta,
+  check(ctx) {
+    const out = [];
+    const inTx = insideTransaction(ctx.migration);
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "vacuum_stmt")
+        continue;
+      if (stmt.node.intoKw)
+        continue;
+      const inside = inTx[stmt.index] === true;
+      out.push(finding(sl014, stmt, {
+        severity: inside ? "critical" : sl014Meta.defaultSeverity,
+        title: inside ? "VACUUM inside a transaction fails" : "VACUUM rewrites the whole database file",
+        message: inside ? `SQLite refuses VACUUM while a transaction is open ("cannot VACUUM from within a transaction"), so the migration stops here. Vacuum from an operational job, outside any transaction.` : `VACUUM copies the entire database into a temporary file and swaps it in: up to twice the database's size in free space, and the write lock held for the whole rewrite. It belongs in a maintenance job, not a migration — and if the runner wraps this file in a transaction it fails outright.`
+      }));
+    }
+    return out;
+  }
+};
+var sl015 = {
+  meta: sl015Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "reindex_stmt")
+        continue;
+      if (stmt.node.name)
+        continue;
+      out.push(finding(sl015, stmt, {
+        title: "REINDEX with no argument rebuilds every index in the database",
+        message: `All indexes of every attached database are rebuilt in one write transaction — the lock is held for the total. Name the index or table that needs it (REINDEX is only needed after a collation change).`
+      }));
+    }
+    return out;
+  }
+};
+
+// src/rules/indexes-and-types.ts
+var sl016 = {
+  meta: sl016Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "create_index_stmt")
+        continue;
+      const table = tableOf(stmt) ?? "";
+      if (table && tableCreatedInMigration(ctx.migration, stmt.index, table))
+        continue;
+      const index = nameOf(stmt.node.name);
+      out.push(finding(sl016, stmt, {
+        title: `Index "${index}" is built under the write lock on "${table}"`,
+        message: `SQLite has no concurrent index build: the table is scanned and the index written in one write transaction, and every other writer waits (or gets SQLITE_BUSY) until it finishes. ` + `Small table, no problem; large table, build it in a window with busy_timeout set on the application's connections.`,
+        object: { table, index }
+      }));
+    }
+    return out;
+  }
+};
+function primaryKeyOf(column) {
+  return constraintOf(column, "constraint_primary_key");
+}
+var sl017 = {
+  meta: sl017Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "create_table_stmt")
+        continue;
+      if (tableOptions(stmt).includes("WITHOUT ROWID"))
+        continue;
+      const table = tableOf(stmt) ?? "";
+      const columns = createdColumns(stmt);
+      if (tableConstraints(stmt).some((c) => c.type === "constraint_primary_key" || c.constraint?.type === "constraint_primary_key"))
+        continue;
+      for (const column of columns) {
+        const pk = primaryKeyOf(column);
+        if (!pk)
+          continue;
+        const type = dataTypeName(column);
+        const direction = (pk.direction ?? pk.constraint?.direction)?.type;
+        const integerLike = /^(INT|INTEGER|BIGINT|SMALLINT|TINYINT|MEDIUMINT|INT2|INT8|UNSIGNED BIG INT)$/.test(type);
+        if (!integerLike)
+          continue;
+        const exact = type === "INTEGER" && direction !== "sort_direction_desc";
+        if (exact)
+          continue;
+        const name = nameOf(column.name);
+        out.push(finding(sl017, stmt, {
+          title: `"${name}" ${type} PRIMARY KEY${direction === "sort_direction_desc" ? " DESC" : ""} on "${table}" is not a rowid alias`,
+          message: `Only a column declared exactly INTEGER PRIMARY KEY aliases the rowid. This one gets its own unique index: every primary-key lookup is an extra B-tree hop, the value is not the rowid, and VACUUM may renumber the real rowid underneath it. ` + `Spell it INTEGER PRIMARY KEY (ascending).`,
+          object: { table, column: name }
+        }));
+      }
+    }
+    return out;
+  }
+};
+var sl018 = {
+  meta: sl018Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "create_table_stmt")
+        continue;
+      const table = tableOf(stmt) ?? "";
+      for (const column of createdColumns(stmt)) {
+        if (!constraintOf(column, "constraint_auto_increment"))
+          continue;
+        const name = nameOf(column.name);
+        out.push(finding(sl018, stmt, {
+          title: `AUTOINCREMENT on "${table}"."${name}" costs every insert an extra write`,
+          message: `Each insert also updates sqlite_sequence; the SQLite manual says AUTOINCREMENT "should be avoided if not strictly needed". INTEGER PRIMARY KEY already assigns increasing ids — keep the keyword only if reusing a deleted id would be a correctness bug.`,
+          object: { table, column: name }
+        }));
+      }
+    }
+    return out;
+  }
+};
+
+// src/rules/performance.ts
+function indexColumns(stmt) {
+  return items(stmt.node.columns).map((spec) => (nameOf(spec.expr ?? spec) ?? "").toLowerCase());
+}
+function createdIndexes(ctx) {
+  const out = [];
+  for (const stmt of ctx.migration.statements) {
+    if (stmt.node.type !== "create_index_stmt")
+      continue;
+    const specs = items(stmt.node.columns);
+    if (specs.some((spec) => (spec.expr ?? spec).type !== "identifier"))
+      continue;
+    out.push({
+      stmt,
+      name: nameOf(stmt.node.name) ?? "",
+      table: (tableOf(stmt) ?? "").toLowerCase(),
+      columns: indexColumns(stmt),
+      unique: String(stmt.node.indexTypeKw?.name ?? "").toUpperCase() === "UNIQUE"
+    });
+  }
+  return out;
+}
+function keyedColumns(ctx, table) {
+  const out = { unique: [] };
+  for (const stmt of ctx.migration.statements) {
+    if (stmt.node.type !== "create_table_stmt" || (tableOf(stmt) ?? "").toLowerCase() !== table)
+      continue;
+    const withoutRowid = tableOptions(stmt).includes("WITHOUT ROWID");
+    for (const column of createdColumns(stmt)) {
+      const name = (nameOf(column.name) ?? "").toLowerCase();
+      const pk = constraintOf(column, "constraint_primary_key");
+      if (pk && !withoutRowid && dataTypeName(column) === "INTEGER" && (pk.direction ?? pk.constraint?.direction)?.type !== "sort_direction_desc")
+        out.rowid = name;
+      else if (pk || constraintOf(column, "constraint_unique"))
+        out.unique.push([name]);
+    }
+    for (const constraint of tableConstraints(stmt)) {
+      const inner = constraint.constraint ?? constraint;
+      if (inner.type === "constraint_primary_key" || inner.type === "constraint_unique") {
+        out.unique.push(items(inner.columns).map((spec) => (nameOf(spec.expr ?? spec) ?? "").toLowerCase()));
+      }
+    }
+  }
+  return out;
+}
+var isPrefix = (short, long) => short.length <= long.length && short.every((c, i) => long[i] === c);
+var sameColumns = (a, b) => a.length === b.length && isPrefix(a, b);
+var sl031 = {
+  meta: sl031Meta,
+  check(ctx) {
+    const out = [];
+    const indexes = createdIndexes(ctx);
+    for (const index of indexes) {
+      const keyed = keyedColumns(ctx, index.table);
+      let why;
+      if (index.columns.length === 1 && index.columns[0] === keyed.rowid) {
+        why = `"${index.columns[0]}" is the INTEGER PRIMARY KEY — the rowid, which the table's own B-tree already indexes`;
+      } else if (keyed.unique.some((u) => sameColumns(u, index.columns))) {
+        why = `(${index.columns.join(", ")}) is already UNIQUE, which SQLite enforces with an index of its own`;
+      } else {
+        const wider = indexes.find((other) => other !== index && other.table === index.table && isPrefix(index.columns, other.columns) && (!index.unique || other.unique) && (other.columns.length > index.columns.length || other.stmt.index < index.stmt.index));
+        if (wider) {
+          why = sameColumns(index.columns, wider.columns) ? `it duplicates "${wider.name}"` : `(${index.columns.join(", ")}) is a leading prefix of "${wider.name}" (${wider.columns.join(", ")}), which serves the same lookups`;
+        }
+      }
+      if (!why)
+        continue;
+      out.push(finding(sl031, index.stmt, {
+        title: `Index "${index.name}" on "${index.table}" is redundant`,
+        message: `${why[0].toUpperCase()}${why.slice(1)}. The index changes no plan and costs a write on every insert, update and delete. Drop it.`,
+        object: { table: index.table, index: index.name }
+      }));
+    }
+    return out;
+  }
+};
+var sl032 = {
+  meta: sl032Meta,
+  check(ctx) {
+    const out = [];
+    const statements = ctx.migration.statements;
+    for (const stmt of statements) {
+      if (stmt.node.type !== "create_index_stmt")
+        continue;
+      const table = (tableOf(stmt) ?? "").toLowerCase();
+      const created = statements.some((s) => s.index < stmt.index && s.node.type === "create_table_stmt" && (tableOf(s) ?? "").toLowerCase() === table);
+      if (!created)
+        continue;
+      const copy = statements.find((s) => s.index > stmt.index && s.node.type === "insert_stmt" && (tableOf(s) ?? "").toLowerCase() === table && s.node.clauses?.some((c) => c.type === "select_stmt" || c.type === "compound_select_stmt"));
+      if (!copy)
+        continue;
+      const index = nameOf(stmt.node.name) ?? "";
+      out.push(finding(sl032, stmt, {
+        title: `Index "${index}" is built before the copy into "${table}"`,
+        message: `The INSERT ... SELECT that fills "${table}" maintains this index row by row. Move the CREATE INDEX after the copy so SQLite builds it once, sorted, over the populated table.`,
+        object: { table, index }
+      }));
+    }
+    return out;
+  }
+};
+var sl033 = {
+  meta: sl033Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "create_table_stmt" || tableOptions(stmt).includes("WITHOUT ROWID"))
+        continue;
+      const columns = createdColumns(stmt);
+      const tableLevel = tableConstraints(stmt).some((c) => (c.constraint ?? c).type === "constraint_primary_key");
+      if (tableLevel)
+        continue;
+      const pk = columns.find((c) => constraintOf(c, "constraint_primary_key"));
+      if (!pk)
+        continue;
+      const type = dataTypeName(pk);
+      if (!/^(TEXT|BLOB|VARCHAR|CHAR|CLOB|CHARACTER|NCHAR|NVARCHAR|UUID)/.test(type))
+        continue;
+      const table = tableOf(stmt) ?? "";
+      const name = nameOf(pk.name) ?? "";
+      out.push(finding(sl033, stmt, {
+        title: `"${table}" keys on ${type} "${name}" but stays a rowid table`,
+        message: `The primary key is a separate unique index over a rowid B-tree: every lookup by "${name}" walks two trees and the key is stored twice. Declare the table WITHOUT ROWID so the key is the table's own B-tree (small rows), or keep rowid deliberately for wide rows.`,
+        object: { table, column: name }
+      }));
+    }
+    return out;
+  }
+};
+var sl034 = {
+  meta: sl034Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      const pragma = pragmaOf(stmt);
+      if (pragma?.name !== "journal_mode" || pragma.value === undefined || pragma.value === "wal")
+        continue;
+      out.push(finding(sl034, stmt, {
+        title: `journal_mode = ${pragma.value.toUpperCase()} is stored in the file for every connection`,
+        message: `${pragma.value.toUpperCase()} is a rollback-journal mode: a writer blocks every reader for the length of its transaction, and this setting outlives the migration — it is written into the database file. Set WAL, or leave the mode to the application's connection setup.`
+      }));
+    }
+    return out;
+  }
+};
+var CONNECTION_PRAGMAS = new Set(["cache_size", "synchronous", "temp_store", "mmap_size", "busy_timeout"]);
+var sl035 = {
+  meta: sl035Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      const pragma = pragmaOf(stmt);
+      if (!pragma || pragma.value === undefined || !CONNECTION_PRAGMAS.has(pragma.name))
+        continue;
+      const durability = pragma.name === "synchronous" && ["off", "0"].includes(pragma.value);
+      out.push(finding(sl035, stmt, {
+        title: `PRAGMA ${pragma.name} in a migration reaches only the runner's connection`,
+        message: `${pragma.name} is per connection: the application never sees this value. ` + (durability ? `And synchronous=OFF means a crash during the schema change can corrupt the file. ` : ``) + `Set connection pragmas where the application opens connections.`
+      }));
+    }
+    return out;
+  }
+};
+
+// src/rules/rebuild-pragmas.ts
+function pragmaTimeline(ctx) {
+  const off = [];
+  const on = [];
+  const check = [];
+  for (const stmt of ctx.migration.statements) {
+    const pragma = pragmaOf(stmt);
+    if (!pragma)
+      continue;
+    if (pragma.name === "foreign_keys" && pragmaIsOff(pragma.value))
+      off.push(stmt.index);
+    else if (pragma.name === "foreign_keys" && pragmaIsOn(pragma.value))
+      on.push(stmt.index);
+    else if (pragma.name === "foreign_key_check")
+      check.push(stmt.index);
+  }
+  return { off, on, check };
+}
+var sl009 = {
+  meta: sl009Meta,
+  check(ctx) {
+    const out = [];
+    const { off } = pragmaTimeline(ctx);
+    const inTx = insideTransaction(ctx.migration);
+    for (const { drop, table } of tableRebuilds(ctx.migration)) {
+      const effectiveOff = off.some((index) => index < drop.index && !inTx[index]);
+      if (effectiveOff)
+        continue;
+      out.push(finding(sl009, drop, {
+        title: `Rebuild of "${table}" drops it with foreign keys still enforced`,
+        message: `This file rebuilds "${table}" (drop, then rename a new table onto the name) without PRAGMA foreign_keys=OFF first. ` + `With enforcement on, DROP TABLE runs an implicit DELETE FROM "${table}": rows referencing it fail the migration, or ON DELETE CASCADE removes them. ` + `Switch foreign keys off outside the transaction, rebuild, run PRAGMA foreign_key_check, commit, switch them on.`,
+        object: { table }
+      }));
+    }
+    return out;
+  }
+};
+var TRANSACTION_NOOP_PRAGMAS = new Set(["foreign_keys", "journal_mode"]);
+var sl010 = {
+  meta: sl010Meta,
+  check(ctx) {
+    const out = [];
+    const inTx = insideTransaction(ctx.migration);
+    for (const stmt of ctx.migration.statements) {
+      const pragma = pragmaOf(stmt);
+      if (!pragma || pragma.value === undefined || !TRANSACTION_NOOP_PRAGMAS.has(pragma.name))
+        continue;
+      if (!inTx[stmt.index])
+        continue;
+      out.push(finding(sl010, stmt, {
+        title: `PRAGMA ${pragma.name} inside a transaction does nothing`,
+        message: `SQLite ignores PRAGMA ${pragma.name} while a transaction is open — no error, the setting stays as it was. ` + `Move it before BEGIN (and its counterpart after COMMIT); if the runner wraps the file in a transaction, the runner has to set it.`
+      }));
+    }
+    return out;
+  }
+};
+var sl011 = {
+  meta: sl011Meta,
+  check(ctx) {
+    const { off, on } = pragmaTimeline(ctx);
+    if (off.length === 0)
+      return [];
+    const lastOff = off[off.length - 1];
+    if (on.some((index) => index > lastOff))
+      return [];
+    const stmt = ctx.migration.statements[lastOff];
+    return [
+      finding(sl011, stmt, {
+        title: "Foreign keys are switched off and not switched back on",
+        message: `PRAGMA foreign_keys=OFF is per connection and survives COMMIT; nothing in this file re-enables it, so the runner's connection accepts orphaned rows for every statement that follows. ` + `End the file with PRAGMA foreign_keys=ON after the transaction that needed it off.`
+      })
+    ];
+  }
+};
+var sl012 = {
+  meta: sl012Meta,
+  check(ctx) {
+    const out = [];
+    const { off, on, check } = pragmaTimeline(ctx);
+    for (const onIndex of on) {
+      const offIndex = [...off].reverse().find((index) => index < onIndex);
+      if (offIndex === undefined)
+        continue;
+      if (check.some((index) => index > offIndex && index < onIndex))
+        continue;
+      const stmt = ctx.migration.statements[onIndex];
+      out.push(finding(sl012, stmt, {
+        title: "Foreign keys re-enabled without a foreign_key_check",
+        message: `Turning enforcement back on does not validate rows written while it was off. Run PRAGMA foreign_key_check inside the transaction, before COMMIT, so a violation can still be rolled back.`
+      }));
+    }
+    return out;
+  }
+};
+var sl019 = {
+  meta: sl019Meta,
+  check(ctx) {
+    const out = [];
+    for (const rebuild of tableRebuilds(ctx.migration)) {
+      if (!rebuild.replacementCreatedHere || rebuild.copy)
+        continue;
+      const { drop, table, replacement } = rebuild;
+      out.push(finding(sl019, drop, {
+        title: `Rebuild of "${table}" drops it without copying its rows into "${replacement}"`,
+        message: `This file creates "${replacement}", drops "${table}" and renames "${replacement}" onto the name, but no INSERT INTO "${replacement}" ... SELECT ... FROM "${table}" runs before the DROP. ` + `DROP TABLE discards the rows; the rename brings back the name with an empty table. Copy first (INSERT INTO "${replacement}" SELECT ... FROM "${table}"), then drop — or, if the data is meant to go, say so in a bolvrk-ignore reason.`,
+        object: { table }
+      }));
+    }
+    return out;
+  }
+};
+
+// src/rules/schema-and-transactions.ts
+var sl020 = {
+  meta: sl020Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "create_table_stmt")
+        continue;
+      if (createdColumns(stmt).length === 0)
+        continue;
+      if (tableOptions(stmt).includes("STRICT"))
+        continue;
+      const table = tableOf(stmt) ?? "";
+      out.push(finding(sl020, stmt, {
+        title: `"${table}" is created without STRICT — column types are not enforced`,
+        message: `Without STRICT, SQLite stores whatever value arrives regardless of the declared type: text in an INTEGER column, a number in a TEXT one. ` + `Add STRICT now — it is a CREATE TABLE option only, and adding it later means rebuilding the table.`,
+        object: { table }
+      }));
+    }
+    return out;
+  }
+};
+function childKeys(stmt) {
+  if (stmt.node.type !== "create_table_stmt")
+    return [];
+  const table = tableOf(stmt) ?? "";
+  const out = [];
+  for (const column of createdColumns(stmt)) {
+    const ref = constraintOf(column, "references_specification");
+    if (!ref)
+      continue;
+    const spec = ref.type === "references_specification" ? ref : ref.constraint;
+    out.push({ table, columns: [nameOf(column.name) ?? ""], parent: nameOf(spec.table) ?? "", cascade: cascades(spec) });
+  }
+  for (const constraint of tableConstraints(stmt)) {
+    const fk = constraint.type === "constraint_foreign_key" ? constraint : constraint.constraint?.type === "constraint_foreign_key" ? constraint.constraint : undefined;
+    if (!fk)
+      continue;
+    const spec = fk.references ?? fk;
+    out.push({
+      table,
+      columns: items(fk.columns).map((c) => nameOf(c) ?? ""),
+      parent: nameOf(spec.table) ?? "",
+      cascade: cascades(spec) || cascades(fk)
+    });
+  }
+  return out;
+}
+function cascades(spec) {
+  return descendants(spec, (n) => n.type === "referential_action").some((action) => {
+    const words = descendants(action, (n) => n.type === "keyword").map((k) => String(k.name).toUpperCase());
+    return words.includes("DELETE") && words.includes("CASCADE");
+  });
+}
+function indexedPrefixes(ctx, table) {
+  const out = [];
+  for (const stmt of ctx.migration.statements) {
+    if (stmt.node.type === "create_index_stmt" && tableOf(stmt)?.toLowerCase() === table.toLowerCase()) {
+      out.push(items(stmt.node.columns).map((spec) => nameOf(spec.expr ?? spec) ?? ""));
+    }
+    if (stmt.node.type === "create_table_stmt" && tableOf(stmt)?.toLowerCase() === table.toLowerCase()) {
+      for (const column of createdColumns(stmt)) {
+        if (constraintOf(column, "constraint_primary_key") || constraintOf(column, "constraint_unique"))
+          out.push([nameOf(column.name) ?? ""]);
+      }
+      for (const constraint of tableConstraints(stmt)) {
+        const inner = constraint.constraint ?? constraint;
+        if (inner.type === "constraint_primary_key" || inner.type === "constraint_unique") {
+          out.push(items(inner.columns).map((spec) => nameOf(spec.expr ?? spec) ?? ""));
+        }
+      }
+    }
+  }
+  return out;
+}
+function isPrefix2(columns, index) {
+  return columns.every((column, i) => index[i]?.toLowerCase() === column.toLowerCase());
+}
+var sl021 = {
+  meta: sl021Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      for (const key of childKeys(stmt)) {
+        if (indexedPrefixes(ctx, key.table).some((index) => isPrefix2(key.columns, index)))
+          continue;
+        out.push(finding(sl021, stmt, {
+          title: `Foreign key "${key.table}"(${key.columns.join(", ")}) has no index`,
+          message: `Every DELETE or UPDATE of a "${key.parent}" row scans all of "${key.table}" to check for references, because SQLite never indexes the child side of a foreign key. ` + `Add CREATE INDEX on (${key.columns.join(", ")}) in this migration.`,
+          object: { table: key.table, column: key.columns[0] }
+        }));
+      }
+    }
+    return out;
+  }
+};
+var sl022 = {
+  meta: sl022Meta,
+  check(ctx) {
+    const out = [];
+    let legacy = false;
+    for (const stmt of ctx.migration.statements) {
+      const pragma = pragmaOf(stmt);
+      if (pragma?.name === "legacy_alter_table") {
+        legacy = pragmaIsOn(pragma.value);
+        continue;
+      }
+      if (!legacy)
+        continue;
+      for (const action of alterActions(stmt)) {
+        if (action.type !== "alter_action_rename" && action.type !== "alter_action_rename_column")
+          continue;
+        const table = tableOf(stmt) ?? "";
+        out.push(finding(sl022, stmt, {
+          title: `Rename on "${table}" runs with legacy_alter_table on — views and triggers are not rewritten`,
+          message: `PRAGMA legacy_alter_table=ON restores the pre-3.26 rename: any view or trigger that names the old identifier keeps naming it, and fails the first time it is used. ` + `Switch the pragma off before renaming.`,
+          object: { table }
+        }));
+      }
+    }
+    return out;
+  }
+};
+function dependents(ctx, beforeIndex) {
+  const live = new Map;
+  for (const stmt of ctx.migration.statements) {
+    if (stmt.index >= beforeIndex)
+      break;
+    const node = stmt.node;
+    if (node.type === "create_view_stmt" || node.type === "create_trigger_stmt") {
+      const kind = node.type === "create_view_stmt" ? "view" : "trigger";
+      const identifiers = new Set(descendants([node.clauses, node.body], (n) => n.type === "identifier").map((n) => String(n.name).toLowerCase()));
+      const target = kind === "trigger" ? nameOf(node.target?.table)?.toLowerCase() : undefined;
+      if (target)
+        identifiers.add(target);
+      live.set(`${kind}:${(nameOf(node.name) ?? "").toLowerCase()}`, { kind, name: nameOf(node.name) ?? "", identifiers, target });
+    } else if (node.type === "drop_view_stmt") {
+      for (const view of items(node.views))
+        live.delete(`view:${(nameOf(view) ?? "").toLowerCase()}`);
+    } else if (node.type === "drop_trigger_stmt") {
+      live.delete(`trigger:${(nameOf(node.trigger) ?? "").toLowerCase()}`);
+    }
+  }
+  return [...live.values()];
+}
+var sl023 = {
+  meta: sl023Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      for (const table of droppedTables(stmt)) {
+        const hit = dependents(ctx, stmt.index).find((d) => d.identifiers.has(table.toLowerCase()));
+        if (!hit)
+          continue;
+        out.push(finding(sl023, stmt, {
+          title: `DROP TABLE "${table}" breaks ${hit.kind} "${hit.name}" created in this migration`,
+          message: hit.kind === "trigger" && hit.target === table.toLowerCase() ? `Dropping the table drops the trigger with it — if that is the intent, drop the trigger explicitly so the migration says so.` : `${hit.kind === "view" ? "The view" : "The trigger"} still names "${table}"; it fails the first time it is used. Drop or redefine it first.`,
+          object: { table }
+        }));
+      }
+      for (const action of alterActions(stmt)) {
+        if (action.type !== "alter_action_drop_column")
+          continue;
+        const table = tableOf(stmt) ?? "";
+        const column = nameOf(action.column) ?? "";
+        const hit = dependents(ctx, stmt.index).find((d) => d.identifiers.has(table.toLowerCase()) && d.identifiers.has(column.toLowerCase()));
+        if (!hit)
+          continue;
+        out.push(finding(sl023, stmt, {
+          title: `DROP COLUMN "${column}" breaks ${hit.kind} "${hit.name}", which references it`,
+          message: hit.kind === "view" ? `The view keeps naming "${column}" and fails with "no such column" the first time it is queried (older SQLite releases refuse the DROP instead). Drop or redefine "${hit.name}" first.` : `The trigger keeps naming "${column}", so every later write that fires it fails with "no such column" — writes to "${table}" break (older SQLite releases refuse the DROP instead). Drop or redefine "${hit.name}" first.`,
+          object: { table, column }
+        }));
+      }
+    }
+    return out;
+  }
+};
+var sl024 = {
+  meta: sl024Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "create_table_stmt")
+        continue;
+      if (tableOptions(stmt).includes("WITHOUT ROWID"))
+        continue;
+      const table = tableOf(stmt) ?? "";
+      const keyed = new Set;
+      for (const column of createdColumns(stmt))
+        if (constraintOf(column, "constraint_primary_key"))
+          keyed.add(nameOf(column.name) ?? "");
+      for (const constraint of tableConstraints(stmt)) {
+        const inner = constraint.constraint ?? constraint;
+        if (inner.type === "constraint_primary_key")
+          for (const spec of items(inner.columns))
+            keyed.add(nameOf(spec.expr ?? spec) ?? "");
+      }
+      for (const column of createdColumns(stmt)) {
+        const name = nameOf(column.name) ?? "";
+        if (!keyed.has(name))
+          continue;
+        if (constraintOf(column, "constraint_not_null"))
+          continue;
+        const pk = constraintOf(column, "constraint_primary_key");
+        const direction = (pk?.direction ?? pk?.constraint?.direction)?.type;
+        if (pk && keyed.size === 1 && dataTypeName(column) === "INTEGER" && direction !== "sort_direction_desc")
+          continue;
+        out.push(finding(sl024, stmt, {
+          title: `PRIMARY KEY column "${name}" on "${table}" accepts NULL`,
+          message: `A non-INTEGER primary key in a rowid table does not imply NOT NULL — SQLite keeps this old behaviour for compatibility — so NULL keys are accepted and each one counts as distinct. ` + `Add NOT NULL to the column.`,
+          object: { table, column: name }
+        }));
+      }
+    }
+    return out;
+  }
+};
+var WRITE_TYPES = new Set([
+  "alter_table_stmt",
+  "create_table_stmt",
+  "create_index_stmt",
+  "create_view_stmt",
+  "create_trigger_stmt",
+  "drop_table_stmt",
+  "drop_index_stmt",
+  "drop_view_stmt",
+  "drop_trigger_stmt",
+  "insert_stmt",
+  "update_stmt",
+  "delete_stmt",
+  "reindex_stmt"
+]);
+var sl025 = {
+  meta: sl025Meta,
+  check(ctx) {
+    const out = [];
+    const statements = ctx.migration.statements;
+    for (const stmt of statements) {
+      if (stmt.node.type !== "start_transaction_stmt")
+        continue;
+      const behavior = String(stmt.node.behaviorKw?.name ?? "DEFERRED").toUpperCase();
+      if (behavior !== "DEFERRED")
+        continue;
+      const writes = statements.some((later) => later.index > stmt.index && WRITE_TYPES.has(later.node.type) && !statements.some((end) => end.index > stmt.index && end.index < later.index && (end.node.type === "commit_transaction_stmt" || end.node.type === "rollback_transaction_stmt")));
+      if (!writes)
+        continue;
+      out.push(finding(sl025, stmt, {
+        title: "Write migration starts with a DEFERRED transaction",
+        message: `A plain BEGIN takes no lock until the first write, then upgrades a read lock to a write lock — and a lock upgrade that finds another writer fails at once with SQLITE_BUSY, busy_timeout or not. ` + `Use BEGIN IMMEDIATE for a migration that writes.`
+      }));
+    }
+    return out;
+  }
+};
+var sl026 = {
+  meta: sl026Meta,
+  check(ctx) {
+    const out = [];
+    let open = false;
+    for (const stmt of ctx.migration.statements) {
+      const type = stmt.node.type;
+      if (type === "start_transaction_stmt") {
+        if (open) {
+          out.push(finding(sl026, stmt, {
+            title: "BEGIN inside an open transaction fails",
+            message: `SQLite cannot nest transactions: this BEGIN fails with "cannot start a transaction within a transaction". Remove it, or use SAVEPOINT for a nested scope.`
+          }));
+        }
+        open = true;
+      } else if (type === "commit_transaction_stmt" || type === "rollback_transaction_stmt") {
+        if (!open) {
+          out.push(finding(sl026, stmt, {
+            title: `${type === "commit_transaction_stmt" ? "COMMIT" : "ROLLBACK"} with no open transaction fails`,
+            message: `Nothing is open at this point in the file, so SQLite answers "cannot ${type === "commit_transaction_stmt" ? "commit" : "rollback"} - no transaction is active". If the runner wraps the file, drop the statement; otherwise add the BEGIN.`
+          }));
+        }
+        open = false;
+      }
+    }
+    return out;
+  }
+};
+var sl027 = {
+  meta: sl027Meta,
+  check(ctx) {
+    const out = [];
+    const cascading = ctx.migration.statements.flatMap(childKeys).filter((key) => key.cascade);
+    if (cascading.length === 0)
+      return out;
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "delete_stmt" || hasWhere(stmt))
+        continue;
+      const table = tableOf(stmt) ?? "";
+      if (tableCreatedInMigration(ctx.migration, stmt.index, table))
+        continue;
+      const children = cascading.filter((key) => key.parent.toLowerCase() === table.toLowerCase()).map((key) => key.table);
+      if (children.length === 0)
+        continue;
+      out.push(finding(sl027, stmt, {
+        title: `DELETE FROM "${table}" with no WHERE also empties ${children.map((c) => `"${c}"`).join(", ")}`,
+        message: `With foreign keys on, ON DELETE CASCADE removes every referencing row in ${children.join(", ")} in the same statement; with them off, nothing happens to those tables — the outcome depends on the runner's connection. ` + `Add the predicate, batch it, and delete the children explicitly so the migration reads the way it behaves.`,
+        object: { table }
+      }));
+    }
+    return out;
+  }
+};
+var NON_DETERMINISTIC = new Set(["random", "randomblob", "changes", "total_changes", "last_insert_rowid", "sqlite_offset"]);
+var sl028 = {
+  meta: sl028Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "create_index_stmt")
+        continue;
+      const calls = descendants(stmt.node.columns, (n) => n.type === "func_call").map((call) => String(nameOf(call.name) ?? "").toLowerCase()).filter((name) => NON_DETERMINISTIC.has(name));
+      if (calls.length === 0)
+        continue;
+      const table = tableOf(stmt) ?? "";
+      const index = nameOf(stmt.node.name);
+      out.push(finding(sl028, stmt, {
+        title: `Index "${index}" uses ${calls[0]}() — SQLite refuses it`,
+        message: `An index expression must be deterministic; ${calls[0]}() is not, so CREATE INDEX fails ("non-deterministic functions prohibited in index expressions") and the migration stops. Index a deterministic expression or a stored column instead.`,
+        object: { table, index }
+      }));
+    }
+    return out;
+  }
+};
+var sl029 = {
+  meta: sl029Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "create_table_stmt" || !tableOptions(stmt).includes("WITHOUT ROWID"))
+        continue;
+      const column = createdColumns(stmt).find((c) => constraintOf(c, "constraint_auto_increment"));
+      if (!column)
+        continue;
+      const table = tableOf(stmt) ?? "";
+      out.push(finding(sl029, stmt, {
+        title: `AUTOINCREMENT on WITHOUT ROWID table "${table}" is refused`,
+        message: `A WITHOUT ROWID table has no rowid for AUTOINCREMENT to drive, so SQLite rejects the statement ("AUTOINCREMENT not allowed on WITHOUT ROWID tables") and the table is not created. Drop one of the two.`,
+        object: { table, column: nameOf(column.name) }
+      }));
+    }
+    return out;
+  }
+};
+var sl030 = {
+  meta: sl030Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      if (stmt.node.type !== "attach_database_stmt")
+        continue;
+      out.push(finding(sl030, stmt, {
+        title: "ATTACH DATABASE in a migration",
+        message: `This opens a second file by a machine-specific path on the runner's connection, for the life of that connection. Move the import into an operational job that takes the path as a parameter, and keep the migration to the schema.`
+      }));
+    }
+    return out;
+  }
+};
+
+// src/rules/table-shape.ts
+var sl006 = {
+  meta: sl006Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      for (const action of alterActions(stmt)) {
+        if (action.type !== "alter_action_drop_column")
+          continue;
+        const table = tableOf(stmt) ?? "";
+        if (table && tableCreatedInMigration(ctx.migration, stmt.index, table))
+          continue;
+        const column = nameOf(action.column);
+        out.push(finding(sl006, stmt, {
+          title: `DROP COLUMN "${column}" rewrites every row of "${table}"`,
+          message: `SQLite purges the column by rewriting the table's content in one write transaction — the single write lock is held for the whole copy, and every other writer waits. ` + `The statement also fails if an index, foreign key, view, trigger or generated column still names "${column}". Remove code references first, drop dependent objects, and schedule the rewrite.`,
+          object: { table, column }
+        }));
+      }
+    }
+    return out;
+  }
+};
+var sl007 = {
+  meta: sl007Meta,
+  check(ctx) {
+    const out = [];
+    for (const stmt of ctx.migration.statements) {
+      for (const action of alterActions(stmt)) {
+        const table = tableOf(stmt) ?? "";
+        if (action.type === "alter_action_rename_column") {
+          if (table && tableCreatedInMigration(ctx.migration, stmt.index, table))
+            continue;
+          const from = nameOf(action.oldName);
+          const to = nameOf(action.newName);
+          out.push(finding(sl007, stmt, {
+            title: `RENAME COLUMN "${from}" → "${to}" on "${table}" breaks code still using the old name`,
+            message: `The rename is instant; any process still running the previous release fails on "${from}" from the next statement it sends. ` + `Expand and contract instead: add "${to}", dual-write, backfill, switch readers, drop "${from}" in a later release.`,
+            object: { table, column: from }
+          }));
+        } else if (action.type === "alter_action_rename") {
+          const to = nameOf(action.newName) ?? "";
+          const finishesRebuild = tableRebuilds(ctx.migration).some((r) => r.rename.index === stmt.index && r.replacementCreatedHere);
+          if (finishesRebuild)
+            continue;
+          if (table && tableCreatedInMigration(ctx.migration, stmt.index, table))
+            continue;
+          out.push(finding(sl007, stmt, {
+            title: `RENAME TABLE "${table}" → "${to}" breaks code still using the old name`,
+            message: `The rename is instant; any process still running the previous release fails on "${table}" from the next statement it sends. ` + `Create the new table and copy, and swap names only when no deployed code reads the old one.`,
+            object: { table }
+          }));
+        }
+      }
+    }
+    return out;
+  }
+};
+
+// src/rules/index.ts
+var allSqliteRules = [
+  sl001,
+  sl002,
+  sl003,
+  sl004,
+  sl005,
+  sl006,
+  sl007,
+  sl008,
+  sl009,
+  sl010,
+  sl011,
+  sl012,
+  sl013,
+  sl014,
+  sl015,
+  sl016,
+  sl017,
+  sl018,
+  sl019,
+  sl020,
+  sl021,
+  sl022,
+  sl023,
+  sl024,
+  sl025,
+  sl026,
+  sl027,
+  sl028,
+  sl029,
+  sl030,
+  sl031,
+  sl032,
+  sl033,
+  sl034,
+  sl035
+];
+
+// src/engine.ts
+var CREDENTIAL_RULE_IDS = new Set(["BC003", "BC004"]);
+function credentialFindings(sql, migration) {
+  const report = scanSecrets(sql);
+  if (report.findings.length === 0)
+    return [];
+  const lineStarts = [0];
+  for (let i = 0;i < sql.length; i++)
+    if (sql.charCodeAt(i) === 10)
+      lineStarts.push(i + 1);
+  const lines = sql.split(/\r?\n/);
+  const out = [];
+  for (const hit of report.findings) {
+    if (!CREDENTIAL_RULE_IDS.has(hit.ruleId))
+      continue;
+    const offset = lineStarts[hit.statementIndex] ?? -1;
+    const stmt = migration.statements.find((s) => offset >= s.location && offset < s.end);
+    if (!stmt)
+      continue;
+    const original = lines[hit.statementIndex] ?? "";
+    out.push({ ...hit, statementIndex: stmt.index, sql: original ? stmt.sql.replace(original.trim(), hit.sql.trim()) : stmt.sql });
+  }
+  return out;
+}
+function checkSqliteMigration(sql, options = {}) {
+  const migration = parseSqliteMigration(sql);
+  const rules = options.rules ?? allSqliteRules;
+  const raw = [...rules.flatMap((rule) => rule.check({ migration })), ...options.skipCredentials ? [] : credentialFindings(sql, migration)];
+  const suppressions = collectSuppressions(sql, migration, new Set([...SQLITE_RULE_IDS, ...CREDENTIAL_RULE_IDS]));
+  const findings = sortFindings(applySuppressions(raw, suppressions));
+  return {
+    contractVersion: CONTRACT_VERSION,
+    engine: "sqlite",
+    engineVersion: package_default.version,
+    ruleCorpusVersion: SL_RULE_CORPUS_VERSION,
+    schemaInspected: false,
+    statementCount: migration.statements.length,
+    findings,
+    ...suppressions.length > 0 ? { suppressions } : {}
+  };
+}
+function sqliteStatementStartLines(sql) {
+  const migration = parseSqliteMigration(sql);
+  return migration.statements.map((stmt) => {
+    let line = 1;
+    for (let i = 0;i < stmt.location; i++)
+      if (sql.charCodeAt(i) === 10)
+        line++;
+    return line;
+  });
+}
+export {
+  CREDENTIAL_RULE_IDS,
+  SL_RULE_CORPUS_VERSION,
+  SQLITE_RULE_IDS,
+  SqliteMigrationParseError,
+  allSqliteRules,
+  checkSqliteMigration,
+  finding,
+  parseSqliteMigration,
+  sqliteMetas,
+  sqliteStatementStartLines
+};