@cosmicdrift/kumiko-framework 0.215.4 → 0.215.6

package/src/engine/feature-ast/patch.ts

@@ -30,6 +30,7 @@
 // roadmap C-Notes for the canonical-comment-attach Pattern that would
 // preserve prefixed `// kumiko-comment:` markers across roundtrips.
 
+import type { ObjectLiteralExpression } from "ts-morph";
 import { type CallExpression, type Node, type SourceFile, SyntaxKind } from "ts-morph";
 import { readNameLiteral, readNameOrRef } from "./extractors/shared";
 import type { FeaturePattern, FeaturePatternKind } from "./patterns";
@@ -72,6 +73,9 @@ export type PatternId =
   | { readonly kind: "multiStreamProjection"; readonly name: string }
   | { readonly kind: "defineEvent"; readonly eventName: string }
   | { readonly kind: "extendsRegistrar"; readonly extensionName: string }
+  | { readonly kind: "ai.generate"; readonly stepKey: string }
+  | { readonly kind: "ai.extract"; readonly stepKey: string }
+  | { readonly kind: "ai.classify"; readonly stepKey: string }
   // Singleton patterns — only one per feature, kind alone identifies them.
   | { readonly kind: "requires" }
   | { readonly kind: "optionalRequires" }
@@ -188,10 +192,10 @@ export function replacePattern(
   // Whole call-statement spans from the CallExpression's start through
   // its enclosing ExpressionStatement (which carries the trailing `;`).
   const enclosingStatement = call.getFirstAncestorByKind(SyntaxKind.ExpressionStatement);
-  const startNode = enclosingStatement ?? call;
+  const startNode = isAiStepId(id) ? call : (enclosingStatement ?? call);
 
   const startPos = startNode.getStart();
-  const endPos = startNode.getEnd();
+  const endPos = isAiStepId(id) ? aiStepPatchSpan(sourceFile, call).end : startNode.getEnd();
 
   // Detect column of the original call's first non-whitespace character;
   // the rendered pattern starts at column 0 and gets indented to match.
@@ -219,26 +223,51 @@ export function removePattern(sourceFile: SourceFile, id: PatternId): void {
   if (!call) {
     throw new Error(`removePattern: no call found for ${describeId(id)}`);
   }
-  const enclosingStatement = call.getFirstAncestorByKind(SyntaxKind.ExpressionStatement);
-  const target = enclosingStatement ?? call;
-
-  // Erase from the start of the line containing the statement (so leading
-  // indentation goes with it) through the trailing newline, including the
-  // *leading* blank line that addPattern emits — keeps blank-line counts
-  // stable under add → remove cycles. We don't touch leading comments.
-  const startPos = lineStart(sourceFile, target.getStart());
-  const endPos = lineEnd(sourceFile, target.getEnd());
-
-  // Collapse a preceding blank line if there is one (avoids a double
-  // blank line between the now-adjacent statements).
-  const collapseStart = collapsePrecedingBlankLine(sourceFile, startPos);
-  sourceFile.replaceText([collapseStart, endPos + 1], "");
+  if (isAiStepId(id)) {
+    const { start, end } = aiStepPatchSpan(sourceFile, call);
+    sourceFile.replaceText([start, end], "");
+  } else {
+    const enclosingStatement = call.getFirstAncestorByKind(SyntaxKind.ExpressionStatement);
+    const target = enclosingStatement ?? call;
+
+    // Erase from the start of the line containing the statement (so leading
+    // indentation goes with it) through the trailing newline, including the
+    // *leading* blank line that addPattern emits — keeps blank-line counts
+    // stable under add → remove cycles. We don't touch leading comments.
+    const startPos = lineStart(sourceFile, target.getStart());
+    const endPos = lineEnd(sourceFile, target.getEnd());
+
+    // Collapse a preceding blank line if there is one (avoids a double
+    // blank line between the now-adjacent statements).
+    const collapseStart = collapsePrecedingBlankLine(sourceFile, startPos);
+    sourceFile.replaceText([collapseStart, endPos + 1], "");
+  }
 }
 
 // =============================================================================
 // Lookup
 // =============================================================================
 
+function isAiStepId(
+  id: PatternId,
+): id is Extract<PatternId, { kind: "ai.generate" | "ai.extract" | "ai.classify" }> {
+  return id.kind === "ai.generate" || id.kind === "ai.extract" || id.kind === "ai.classify";
+}
+
+function aiStepPatchSpan(
+  sourceFile: SourceFile,
+  call: CallExpression,
+): { start: number; end: number } {
+  const start = call.getStart();
+  let end = call.getEnd();
+  const text = sourceFile.getFullText();
+  while (end < text.length && (text[end] === " " || text[end] === "	")) end++;
+  if (text[end] === ",") end++;
+  while (end < text.length && (text[end] === " " || text[end] === "	")) end++;
+  if (end < text.length && text[end] === "\n") end++;
+  return { start, end };
+}
+
 function findSetupCallback(
   sourceFile: SourceFile,
 ): { call: CallExpression; body: Node } | undefined {
@@ -293,6 +322,9 @@ export const SINGLETON_KINDS: ReadonlySet<PatternId["kind"]> = new Set([
  * feature can fix it explicitly.
  */
 function findCallForId(sourceFile: SourceFile, id: PatternId): CallExpression | undefined {
+  if (id.kind === "ai.generate" || id.kind === "ai.extract" || id.kind === "ai.classify") {
+    return findAiStepCall(sourceFile, id);
+  }
   const setup = findSetupCallback(sourceFile);
   if (!setup) return undefined;
   const registrarParam = setup.call
@@ -319,6 +351,53 @@ function findCallForId(sourceFile: SourceFile, id: PatternId): CallExpression |
   return matches[0];
 }
 
+const AI_STEP_FACTORY: Readonly<Record<"ai.generate" | "ai.extract" | "ai.classify", string>> = {
+  "ai.generate": "aiGenerateStep",
+  "ai.extract": "aiExtractStep",
+  "ai.classify": "aiClassifyStep",
+};
+
+function resolveSameFileObjectLiteral(
+  node: import("ts-morph").Node,
+): ObjectLiteralExpression | undefined {
+  const direct = node.asKind(SyntaxKind.ObjectLiteralExpression);
+  if (direct) return direct;
+  const identifier = node.asKind(SyntaxKind.Identifier);
+  if (!identifier) return undefined;
+  const varDecl = node.getSourceFile().getVariableDeclaration(identifier.getText());
+  return varDecl?.getInitializer()?.asKind(SyntaxKind.ObjectLiteralExpression);
+}
+
+function readAiStepKey(call: CallExpression): string | undefined {
+  const arg = call.getArguments()[0];
+  if (!arg) return undefined;
+  const obj = resolveSameFileObjectLiteral(arg);
+  if (!obj) return undefined;
+  const prop = obj.getProperty("stepKey");
+  if (!prop) return undefined;
+  const assign = prop.asKind(SyntaxKind.PropertyAssignment);
+  if (assign) {
+    const init = assign.getInitializer();
+    if (!init) return undefined;
+    return readNameLiteral(init);
+  }
+  const shorthand = prop.asKind(SyntaxKind.ShorthandPropertyAssignment);
+  if (shorthand) return readNameLiteral(shorthand.getNameNode());
+  return undefined;
+}
+
+function findAiStepCall(sourceFile: SourceFile, id: PatternId): CallExpression | undefined {
+  if (id.kind !== "ai.generate" && id.kind !== "ai.extract" && id.kind !== "ai.classify") {
+    return undefined;
+  }
+  const factory = AI_STEP_FACTORY[id.kind];
+  for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    if (call.getExpression().getText() !== factory) continue;
+    if (callMatchesId(call, id)) return call;
+  }
+  return undefined;
+}
+
 function callMatchesId(call: CallExpression, id: PatternId): boolean {
   switch (id.kind) {
     // Singletons: kind alone identifies the call.
@@ -421,6 +500,10 @@ function callMatchesId(call: CallExpression, id: PatternId): boolean {
       );
     case "extendsRegistrar":
       return matchFirstArgString(call, id.extensionName);
+    case "ai.generate":
+    case "ai.extract":
+    case "ai.classify":
+      return readAiStepKey(call) === id.stepKey;
     default: {
       const _exhaustive: never = id;
       return _exhaustive;

package/src/engine/feature-ast/patterns.ts

@@ -582,6 +582,51 @@ export type EnvSchemaPattern = {
   readonly schemaBody: SourceLocation;
 };
 
+/** Live-editable policy defaults for an AI pipeline step instance (#256). */
+export type AiStepPolicy = {
+  readonly enabled: boolean;
+  readonly providerId?: string;
+  readonly model?: string;
+  readonly params: Record<string, unknown>;
+};
+
+/** Preserves an unresolvable argument reference across parse → render (#998). */
+export type AiStepOpaqueArgs = {
+  readonly __raw: string;
+};
+
+type AiStepCommonPatternFields = {
+  readonly source: SourceLocation;
+  /** Whole-args reference when the spec is not an inline/same-file object. */
+  readonly argsSource?: AiStepOpaqueArgs;
+  readonly stepKey?: string | AiStepOpaqueArgs;
+  readonly promptKey?: string | AiStepOpaqueArgs;
+  readonly promptFallback?: string | AiStepOpaqueArgs;
+  readonly defaults?: AiStepPolicy | AiStepOpaqueArgs;
+  readonly paramsSchemaSource?: SourceLocation;
+};
+
+// `aiGenerateStep({...})` inside `stepsPipeline` — Tier-3 freeform generation.
+export type AiGeneratePattern = AiStepCommonPatternFields & {
+  readonly kind: "ai.generate";
+  readonly inputBody?: SourceLocation;
+};
+
+// `aiExtractStep({...})` — schema-driven structured extraction.
+export type AiExtractPattern = AiStepCommonPatternFields & {
+  readonly kind: "ai.extract";
+  readonly outputSchemaSource?: SourceLocation;
+  readonly instructionsBody?: SourceLocation;
+  readonly documentBody?: SourceLocation;
+};
+
+// `aiClassifyStep({...})` — action-catalogue classification.
+export type AiClassifyPattern = AiStepCommonPatternFields & {
+  readonly kind: "ai.classify";
+  readonly actions?: readonly { readonly type: string; readonly description: string }[];
+  readonly inputBody?: SourceLocation;
+};
+
 // Catch-all — r.* calls the visitor doesn't recognise. Designer renders
 // "unknown call (cannot edit)", AI patcher leaves them unchanged. When
 // an UnknownPattern shows up in the wild it's a signal that a new r.*
@@ -635,6 +680,9 @@ export type FeaturePattern =
   | DefineEventPattern
   | ExtendsRegistrarPattern
   | EnvSchemaPattern
+  | AiGeneratePattern
+  | AiExtractPattern
+  | AiClassifyPattern
   // Catch-all
   | UnknownPattern;
 
@@ -688,6 +736,9 @@ export function getEditability(pattern: FeaturePattern): Editability {
     case "projection":
     case "multiStreamProjection":
     case "defineEvent":
+    case "ai.generate":
+    case "ai.extract":
+    case "ai.classify":
       return "mixed";
     case "authClaims":
     case "extendsRegistrar":

package/src/engine/feature-ast/render.ts

@@ -23,6 +23,11 @@
 
 import { isRawRefSentinel } from "./extractors/shared";
 import type {
+  AiClassifyPattern,
+  AiExtractPattern,
+  AiGeneratePattern,
+  AiStepOpaqueArgs,
+  AiStepPolicy,
   AuthClaimsPattern,
   ClaimKeyPattern,
   ConfigPattern,
@@ -143,6 +148,12 @@ export function renderPattern(pattern: FeaturePattern): string {
       return renderTreeActions(pattern);
     case "envSchema":
       return renderEnvSchema(pattern);
+    case "ai.generate":
+      return renderAiGenerate(pattern);
+    case "ai.extract":
+      return renderAiExtract(pattern);
+    case "ai.classify":
+      return renderAiClassify(pattern);
     case "unknown":
       return renderUnknown(pattern);
     default: {
@@ -439,6 +450,66 @@ function renderHook(p: HookPattern): string {
   return lines.join("\n");
 }
 
+function renderEditableString(value: string | AiStepOpaqueArgs): string {
+  return typeof value === "string" ? JSON.stringify(value) : value.__raw;
+}
+
+function renderEditableDefaults(value: AiStepPolicy | AiStepOpaqueArgs): string {
+  if (isRawRefSentinel(value)) return value.__raw;
+  return renderValue(value);
+}
+
+function renderAiStepCommonFields(
+  lines: string[],
+  p: AiGeneratePattern | AiExtractPattern | AiClassifyPattern,
+): void {
+  if (p.stepKey !== undefined) lines.push(`  stepKey: ${renderEditableString(p.stepKey)},`);
+  if (p.promptKey !== undefined) lines.push(`  promptKey: ${renderEditableString(p.promptKey)},`);
+  if (p.promptFallback !== undefined) {
+    lines.push(`  promptFallback: ${renderEditableString(p.promptFallback)},`);
+  }
+  if (p.paramsSchemaSource !== undefined) {
+    lines.push(`  paramsSchema: ${p.paramsSchemaSource.raw},`);
+  }
+  if (p.defaults !== undefined) {
+    lines.push(`  defaults: ${renderEditableDefaults(p.defaults)},`);
+  }
+}
+
+function renderAiGenerate(p: AiGeneratePattern): string {
+  if (p.argsSource) return `aiGenerateStep(${p.argsSource.__raw})`;
+  const lines: string[] = ["aiGenerateStep({"];
+  renderAiStepCommonFields(lines, p);
+  if (p.inputBody !== undefined) lines.push(`  input: ${p.inputBody.raw},`);
+  lines.push("});");
+  return lines.join("\n");
+}
+
+function renderAiExtract(p: AiExtractPattern): string {
+  if (p.argsSource) return `aiExtractStep(${p.argsSource.__raw})`;
+  const lines: string[] = ["aiExtractStep({"];
+  renderAiStepCommonFields(lines, p);
+  if (p.outputSchemaSource !== undefined) {
+    lines.push(`  outputSchema: ${p.outputSchemaSource.raw},`);
+  }
+  if (p.instructionsBody !== undefined) {
+    lines.push(`  instructions: ${p.instructionsBody.raw},`);
+  }
+  if (p.documentBody !== undefined) lines.push(`  document: ${p.documentBody.raw},`);
+  lines.push("});");
+  return lines.join("\n");
+}
+
+function renderAiClassify(p: AiClassifyPattern): string {
+  if (p.argsSource) return `aiClassifyStep(${p.argsSource.__raw})`;
+  const lines: string[] = ["aiClassifyStep({"];
+  renderAiStepCommonFields(lines, p);
+  if (p.actions !== undefined) lines.push(`  actions: ${renderValue(p.actions)},`);
+  if (p.inputBody !== undefined) lines.push(`  input: ${p.inputBody.raw},`);
+  lines.push("});");
+  return lines.join("\n");
+}
+
 function renderJob(p: JobPattern): string {
   const lines: string[] = ["r.job({"];
   lines.push(`  name: ${JSON.stringify(p.jobName)},`);

package/src/engine/pattern-library/__tests__/library.test.ts

@@ -60,6 +60,9 @@ const ALL_KINDS: FeaturePatternKind[] = [
   "exposesApi",
   "treeActions",
   "envSchema",
+  "ai.generate",
+  "ai.extract",
+  "ai.classify",
   "unknown",
 ];
 
@@ -342,6 +345,42 @@ function makePlaceholderPattern(kind: FeaturePatternKind): FeaturePattern {
       return { kind, source: PLACEHOLDER_LOC, definitions: {} };
     case "envSchema":
       return { kind, source: PLACEHOLDER_LOC, schemaBody: PLACEHOLDER_BODY_LOC };
+
+    case "ai.generate":
+      return {
+        kind,
+        source: PLACEHOLDER_LOC,
+        stepKey: "generate",
+        promptKey: "demo:generate",
+        promptFallback: "Write a summary.",
+        defaults: { enabled: true, params: {} },
+        paramsSchemaSource: PLACEHOLDER_BODY_LOC,
+        inputBody: PLACEHOLDER_BODY_LOC,
+      };
+    case "ai.extract":
+      return {
+        kind,
+        source: PLACEHOLDER_LOC,
+        stepKey: "extract",
+        promptKey: "demo:extract",
+        promptFallback: "Extract fields.",
+        defaults: { enabled: true, params: {} },
+        paramsSchemaSource: PLACEHOLDER_BODY_LOC,
+        outputSchemaSource: PLACEHOLDER_BODY_LOC,
+        instructionsBody: PLACEHOLDER_BODY_LOC,
+      };
+    case "ai.classify":
+      return {
+        kind,
+        source: PLACEHOLDER_LOC,
+        stepKey: "classify",
+        promptKey: "demo:classify",
+        promptFallback: "Classify the input.",
+        defaults: { enabled: true, params: {} },
+        paramsSchemaSource: PLACEHOLDER_BODY_LOC,
+        actions: [{ type: "approve", description: "Approve" }],
+        inputBody: PLACEHOLDER_BODY_LOC,
+      };
     case "unknown":
       return { kind, source: PLACEHOLDER_LOC, methodName: "x" };
     case "usesApi":

package/src/engine/pattern-library/library.ts

@@ -15,6 +15,9 @@
 
 import type { FeaturePatternKind } from "../feature-ast/patterns";
 import {
+  aiClassifySchema,
+  aiExtractSchema,
+  aiGenerateSchema,
   authClaimsSchema,
   defineEventSchema,
   hookSchema,
@@ -94,6 +97,9 @@ export const PATTERN_LIBRARY: Readonly<Record<FeaturePatternKind, PatternFormSch
   exposesApi: exposesApiSchema,
   treeActions: treeActionsSchema,
   envSchema: envSchemaSchema,
+  "ai.generate": aiGenerateSchema,
+  "ai.extract": aiExtractSchema,
+  "ai.classify": aiClassifySchema,
   unknown: unknownSchema,
 } satisfies Readonly<Record<FeaturePatternKind, PatternFormSchema>>;
 

package/src/engine/pattern-library/mixed-schemas.ts

@@ -1,7 +1,7 @@
 // Mixed pattern schemas (header form + opaque body source).
 
 import { accessRuleField, HOOK_TYPE_OPTIONS, HTTP_METHOD_OPTIONS } from "./shared-fields";
-import type { PatternFormSchema } from "./types";
+import type { FormFieldSpec, PatternFormSchema } from "./types";
 
 // --- Mixed patterns (header form + opaque body source) --------------------
 
@@ -230,6 +230,108 @@ export const jobSchema: PatternFormSchema = {
   ],
 };
 
+const aiStepCommonFields = [
+  {
+    path: "stepKey",
+    label: { en: "Step key", de: "Step-Key" },
+    input: "text",
+    required: true,
+  },
+  {
+    path: "promptKey",
+    label: { en: "Prompt key", de: "Prompt-Key" },
+    input: "text",
+    required: true,
+  },
+  {
+    path: "defaults",
+    label: { en: "Defaults", de: "Defaults" },
+    hint: { en: "enabled, providerId, model, params" },
+    input: "json-readonly",
+  },
+  {
+    path: "paramsSchemaSource",
+    label: { en: "Params schema (source)", de: "Params-Schema (Source)" },
+    input: "code-block",
+    language: "typescript",
+    readOnly: true,
+  },
+] as const satisfies readonly FormFieldSpec[];
+
+export const aiGenerateSchema: PatternFormSchema = {
+  kind: "ai.generate",
+  label: { en: "AI generate step", de: "AI-Generate-Step" },
+  summary: { en: "Tier-3 workflow step for freeform text generation." },
+  category: "behaviour",
+  editability: "mixed",
+  fields: [
+    ...aiStepCommonFields,
+    {
+      path: "inputBody",
+      label: { en: "Input resolver (source)", de: "Input-Resolver (Source)" },
+      input: "code-block",
+      language: "typescript",
+      readOnly: true,
+    },
+  ],
+};
+
+export const aiExtractSchema: PatternFormSchema = {
+  kind: "ai.extract",
+  label: { en: "AI extract step", de: "AI-Extract-Step" },
+  summary: { en: "Schema-driven structured extraction step." },
+  category: "behaviour",
+  editability: "mixed",
+  fields: [
+    ...aiStepCommonFields,
+    {
+      path: "outputSchemaSource",
+      label: { en: "Output schema (source)", de: "Output-Schema (Source)" },
+      input: "code-block",
+      language: "typescript",
+      readOnly: true,
+    },
+    {
+      path: "instructionsBody",
+      label: { en: "Instructions (source)", de: "Instructions (Source)" },
+      input: "code-block",
+      language: "typescript",
+      readOnly: true,
+    },
+    {
+      path: "documentBody",
+      label: { en: "Document resolver (source)", de: "Document-Resolver (Source)" },
+      input: "code-block",
+      language: "typescript",
+      readOnly: true,
+    },
+  ],
+};
+
+export const aiClassifySchema: PatternFormSchema = {
+  kind: "ai.classify",
+  label: { en: "AI classify step", de: "AI-Classify-Step" },
+  summary: { en: "Action-catalogue classification step." },
+  category: "behaviour",
+  editability: "mixed",
+  fields: [
+    ...aiStepCommonFields,
+    {
+      path: "actions",
+      label: { en: "Actions", de: "Aktionen" },
+      input: "json-readonly",
+      required: true,
+    },
+    {
+      path: "inputBody",
+      label: { en: "Input resolver (source)", de: "Input-Resolver (Source)" },
+      input: "code-block",
+      language: "typescript",
+      readOnly: true,
+    },
+  ],
+};
+
 export const notificationSchema: PatternFormSchema = {
   kind: "notification",
   label: { en: "Notification", de: "Benachrichtigung" },

package/src/files/__tests__/storage-tracking.integration.test.ts

@@ -180,7 +180,6 @@ describe("tenant-storage-usage MSP", () => {
     const [first] = await selectMany(stack.db, tenantStorageUsageTable, {
       tenantId: admin.tenantId,
     });
-    expect(first?.["lastUpdatedAt"]).toBeInstanceOf(Temporal.Instant);
 
     // Postgres NOW() resolution is microseconds; a second upload a beat
     // later must produce a strictly later timestamp (or at least not an
@@ -193,7 +192,6 @@ describe("tenant-storage-usage MSP", () => {
     const [second] = await selectMany(stack.db, tenantStorageUsageTable, {
       tenantId: admin.tenantId,
     });
-    expect(second?.["lastUpdatedAt"]).toBeInstanceOf(Temporal.Instant);
     if (!first?.["lastUpdatedAt"] || !second?.["lastUpdatedAt"]) throw new Error("missing rows");
     expect(
       Temporal.Instant.compare(second["lastUpdatedAt"], first["lastUpdatedAt"]),

package/src/lifecycle/signal-handlers.ts

@@ -47,14 +47,14 @@ export function attachSignalHandlers(
         .then(() => exitFn(0))
         .catch(() => exitFn(1));
     };
-    process.on(sig, handler);
+    (process as NodeJS.EventEmitter).on(sig, handler);
     listeners.set(sig, handler);
   }
 
   return {
     detach: () => {
       for (const [sig, handler] of listeners) {
-        process.off(sig, handler);
+        (process as NodeJS.EventEmitter).off(sig, handler);
       }
       listeners.clear();
     },

package/src/db/__tests__/sql-inventory.test.ts

@@ -1,81 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-import {
-  formatReport,
-  isRawSqlAllowed,
-  joinPath,
-  scanRepo,
-  toBaselineJson,
-} from "../sql-inventory";
-
-const cleanups: string[] = [];
-
-afterEach(async () => {
-  for (const dir of cleanups) {
-    await Bun.spawn(["rm", "-rf", dir]).exited;
-  }
-  cleanups.length = 0;
-});
-
-async function tempRepo(files: Record<string, string>): Promise<string> {
-  const root = joinPath(import.meta.dir, `.tmp-sql-inv-${crypto.randomUUID()}`);
-  cleanups.push(root);
-  await Promise.all(
-    Object.entries(files).map(([rel, content]) => Bun.write(joinPath(root, rel), content)),
-  );
-  return root;
-}
-
-describe("sql-inventory", () => {
-  test("isRawSqlAllowed permits db/queries and bun-db/query", () => {
-    expect(isRawSqlAllowed("/repo/packages/framework/src/db/queries/event-store.ts")).toBe(true);
-    expect(isRawSqlAllowed("/repo/packages/framework/src/bun-db/query.ts")).toBe(true);
-    expect(
-      isRawSqlAllowed("/repo/packages/bundled-features/src/sessions/db/queries/cleanup.ts"),
-    ).toBe(true);
-    expect(isRawSqlAllowed("/repo/samples/apps/marketing-demo/src/db/queries/seed-counts.ts")).toBe(
-      true,
-    );
-    expect(isRawSqlAllowed("/repo/bin/commands/schema.ts")).toBe(true);
-    expect(isRawSqlAllowed("/repo/scripts/codemod-bun-db-swap.ts")).toBe(true);
-    expect(
-      isRawSqlAllowed("/repo/packages/bundled-features/src/sessions/handlers/cleanup.job.ts"),
-    ).toBe(false);
-  });
-
-  test("scanRepo classifies production vs test hits", async () => {
-    const root = await tempRepo({
-      "packages/framework/src/db/queries/demo.ts": `export async function x(db: unknown) {
-  return asRawClient(db).unsafe("SELECT 1");
-}`,
-      "packages/framework/src/handlers/bad.ts": `export async function y(db: unknown) {
-  return asRawClient(db).unsafe("DELETE FROM read_users");
-}`,
-      "packages/framework/src/__tests__/ok.integration.ts": `await asRawClient(db).unsafe("DELETE FROM read_users");`,
-    });
-
-    const report = await scanRepo(root);
-    expect(report.summary.byBucket.allowed).toBeGreaterThanOrEqual(1);
-    expect(report.summary.byBucket.tests).toBeGreaterThanOrEqual(1);
-    expect(report.summary.byBucket.disallowed).toBeGreaterThanOrEqual(1);
-    expect(formatReport(report)).toContain("sql inventory");
-  });
-
-  test("toBaselineJson normalizes machine-specific root + scannedAt, keeps the rest", async () => {
-    const root = await tempRepo({
-      "packages/framework/src/handlers/bad.ts": `export async function y(db: unknown) {
-  return asRawClient(db).unsafe("DELETE FROM read_users");
-}`,
-    });
-
-    const report = await scanRepo(root);
-    expect(report.root).toBe(root);
-    expect(report.scannedAt).not.toBe("");
-
-    const parsed = JSON.parse(toBaselineJson(report));
-    expect(parsed.root).toBe(".");
-    expect(parsed.scannedAt).toBe("");
-    expect(parsed.root).not.toContain(root);
-    expect(parsed.summary.disallowed).toBe(report.summary.disallowed);
-    expect(parsed.hits).toHaveLength(report.hits.length);
-  });
-});