@massu/core 1.10.6 → 1.10.8

package/src/lib/sql-table-names.ts

@@ -0,0 +1,71 @@
+// Copyright (c) 2026 Massu. All rights reserved.
+// Licensed under BSL 1.1 - see LICENSE file for details.
+
+/**
+ * P-H032 (plan-stage-c-high-batch / 1.10.7): SoT for SQL table names that
+ * are prefixed with the customer's configured `toolPrefix`.
+ *
+ * **Bug class closed**: 20 distinct SQL table names (`massu_imports`,
+ * `massu_trpc_procedures`, `massu_sentinel`, etc.) were hardcoded with the
+ * `massu_` prefix in ~145 SQL string sites across 21 source files. Tool
+ * names were already config-driven via `getConfig().toolPrefix` but
+ * persistence wasn't — split-brain where a non-default-prefix customer
+ * (e.g. `toolPrefix: 'foo'`) would have tools named `foo_*` but tables
+ * still named `massu_*`. Default-prefix customers (100% of current
+ * installs) see ZERO behavior change.
+ *
+ * **Structural fix**: every SQL string that references a prefix-scoped
+ * table now goes through `t(suffix)` which returns
+ * `\`${getConfig().toolPrefix}_${suffix}\``. The ESLint rule
+ * `no-hardcoded-massu-tables` bans bare `'massu_X'` literals so future
+ * regressions are impossible. The drift-guard test
+ * `sql-table-names-source-grep.test.ts` scans the source tree and asserts
+ * zero bare `massu_<table>` literals outside this module + the test files.
+ *
+ * **20 canonical table suffixes** (registered here as a typed const so
+ * typos at callsites are caught at compile time):
+ */
+
+import { getConfig } from '../config.ts';
+
+/**
+ * The complete set of suffixes for prefix-scoped SQL tables. Keep this in
+ * sync with `packages/core/src/db.ts` (CodeGraph schema) +
+ * `sentinel-db.ts` (sentinel schema) + Python indexer DDL in
+ * `packages/core/src/python/*.ts`.
+ */
+export type MassuTableSuffix =
+  | 'imports'
+  | 'meta'
+  | 'middleware_tree'
+  | 'page_deps'
+  | 'py_fk_edges'
+  | 'py_imports'
+  | 'py_meta'
+  | 'py_migrations'
+  | 'py_models'
+  | 'py_route_callers'
+  | 'py_routes'
+  | 'sentinel'
+  | 'sentinel_changelog'
+  | 'sentinel_components'
+  | 'sentinel_deps'
+  | 'sentinel_fts'
+  | 'sentinel_pages'
+  | 'sentinel_procedures'
+  | 'trpc_call_sites'
+  | 'trpc_procedures';
+
+/**
+ * Resolve a prefix-scoped table name to its concrete identifier using the
+ * current `getConfig().toolPrefix`. For default-prefix installs returns
+ * `massu_<suffix>` (current behavior). For custom-prefix installs returns
+ * `<customPrefix>_<suffix>`.
+ *
+ * Use this in EVERY SQL string that references a prefix-scoped table.
+ * The ESLint rule bans bare `'massu_X'` literals; the only legitimate
+ * exit is this function.
+ */
+export function t(suffix: MassuTableSuffix): string {
+  return `${getConfig().toolPrefix}_${suffix}`;
+}

package/src/middleware-tree.ts

@@ -5,6 +5,7 @@ import type Database from 'better-sqlite3';
 import { getConfig } from './config.ts';
 import { existsSync } from 'fs';
 import { resolve } from 'path';
+import { t } from './lib/sql-table-names.ts';
 
 /**
  * Build the middleware import tree by tracing all transitive imports
@@ -13,7 +14,7 @@ import { resolve } from 'path';
  */
 export function buildMiddlewareTree(dataDb: Database.Database): number {
   // Clear existing data
-  dataDb.exec('DELETE FROM massu_middleware_tree');
+  dataDb.exec(`DELETE FROM ${t('middleware_tree')}`);
 
   const config = getConfig();
   const middlewareFile = config.paths.middleware ?? 'src/middleware.ts';
@@ -30,7 +31,7 @@ export function buildMiddlewareTree(dataDb: Database.Database): number {
     const current = queue.shift()!;
 
     const imports = dataDb.prepare(
-      'SELECT target_file FROM massu_imports WHERE source_file = ?'
+      `SELECT target_file FROM ${t('imports')} WHERE source_file = ?`
     ).all(current) as { target_file: string }[];
 
     for (const imp of imports) {
@@ -42,7 +43,7 @@ export function buildMiddlewareTree(dataDb: Database.Database): number {
   }
 
   // Store the tree
-  const insertStmt = dataDb.prepare('INSERT INTO massu_middleware_tree (file) VALUES (?)');
+  const insertStmt = dataDb.prepare(`INSERT INTO ${t('middleware_tree')} (file) VALUES (?)`);
   const insertAll = dataDb.transaction(() => {
     for (const file of visited) {
       insertStmt.run(file);
@@ -57,7 +58,7 @@ export function buildMiddlewareTree(dataDb: Database.Database): number {
  * Check if a file is in the middleware import tree.
  */
 export function isInMiddlewareTree(dataDb: Database.Database, file: string): boolean {
-  const result = dataDb.prepare('SELECT 1 FROM massu_middleware_tree WHERE file = ?').get(file);
+  const result = dataDb.prepare(`SELECT 1 FROM ${t('middleware_tree')} WHERE file = ?`).get(file);
   return result !== undefined;
 }
 
@@ -65,6 +66,6 @@ export function isInMiddlewareTree(dataDb: Database.Database, file: string): boo
  * Get all files in the middleware import tree.
  */
 export function getMiddlewareTree(dataDb: Database.Database): string[] {
-  const rows = dataDb.prepare('SELECT file FROM massu_middleware_tree ORDER BY file').all() as { file: string }[];
+  const rows = dataDb.prepare(`SELECT file FROM ${t('middleware_tree')} ORDER BY file`).all() as { file: string }[];
   return rows.map(r => r.file);
 }

package/src/page-deps.ts

@@ -6,6 +6,7 @@ import { resolve } from 'path';
 import type Database from 'better-sqlite3';
 import { getConfig, getProjectRoot } from './config.ts';
 import { ensureWithinRoot } from './security-utils.ts';
+import { t } from './lib/sql-table-names.ts';
 
 export interface PageChain {
   page: string;
@@ -61,7 +62,7 @@ function traceImports(
   visited.add(startFile);
 
   const imports = dataDb.prepare(
-    'SELECT target_file, imported_names FROM massu_imports WHERE source_file = ?'
+    `SELECT target_file, imported_names FROM ${t('imports')} WHERE source_file = ?`
   ).all(startFile) as { target_file: string; imported_names: string }[];
 
   for (const imp of imports) {
@@ -117,7 +118,7 @@ function findTablesFromRouters(routerNames: string[], dataDb: Database.Database)
   // Look up router files from the tRPC index
   for (const routerName of routerNames) {
     const procs = dataDb.prepare(
-      'SELECT DISTINCT router_file FROM massu_trpc_procedures WHERE router_name = ?'
+      `SELECT DISTINCT router_file FROM ${t('trpc_procedures')} WHERE router_name = ?`
     ).all(routerName) as { router_file: string }[];
 
     for (const proc of procs) {
@@ -150,7 +151,7 @@ function findTablesFromRouters(routerNames: string[], dataDb: Database.Database)
  */
 export function buildPageDeps(dataDb: Database.Database, codegraphDb: Database.Database): number {
   // Clear existing data
-  dataDb.exec('DELETE FROM massu_page_deps');
+  dataDb.exec(`DELETE FROM ${t('page_deps')}`);
 
   // Find all page.tsx files from CodeGraph
   const pages = codegraphDb.prepare(
@@ -158,7 +159,7 @@ export function buildPageDeps(dataDb: Database.Database, codegraphDb: Database.D
   ).all() as { path: string }[];
 
   const insertStmt = dataDb.prepare(
-    'INSERT INTO massu_page_deps (page_file, route, portal, components, hooks, routers, tables_touched) VALUES (?, ?, ?, ?, ?, ?, ?)'
+    `INSERT INTO ${t('page_deps')} (page_file, route, portal, components, hooks, routers, tables_touched) VALUES (?, ?, ?, ?, ?, ?, ?)`
   );
 
   let count = 0;
@@ -200,7 +201,7 @@ export function buildPageDeps(dataDb: Database.Database, codegraphDb: Database.D
  * Get the dependency chain for a specific page.
  */
 export function getPageChain(dataDb: Database.Database, pageFile: string): PageChain | null {
-  const row = dataDb.prepare('SELECT * FROM massu_page_deps WHERE page_file = ?').get(pageFile) as {
+  const row = dataDb.prepare(`SELECT * FROM ${t('page_deps')} WHERE page_file = ?`).get(pageFile) as {
     page_file: string; route: string; portal: string;
     components: string; hooks: string; routers: string; tables_touched: string;
   } | undefined;
@@ -229,7 +230,7 @@ export function findAffectedPages(dataDb: Database.Database, file: string): Page
   // Find all pages that import this file (directly or transitively)
   // First, find who imports this file
   const importers = dataDb.prepare(
-    'SELECT source_file FROM massu_imports WHERE target_file = ?'
+    `SELECT source_file FROM ${t('imports')} WHERE target_file = ?`
   ).all(file) as { source_file: string }[];
 
   const affectedFiles = new Set<string>([file, ...importers.map(i => i.source_file)]);
@@ -244,7 +245,7 @@ export function findAffectedPages(dataDb: Database.Database, file: string): Page
     const next: string[] = [];
     for (const f of frontier) {
       const upstreamImporters = dataDb.prepare(
-        'SELECT source_file FROM massu_imports WHERE target_file = ?'
+        `SELECT source_file FROM ${t('imports')} WHERE target_file = ?`
       ).all(f) as { source_file: string }[];
 
       for (const imp of upstreamImporters) {
@@ -260,7 +261,7 @@ export function findAffectedPages(dataDb: Database.Database, file: string): Page
   }
 
   // Now find which pages are in the affected set
-  const allPages = dataDb.prepare('SELECT * FROM massu_page_deps').all() as {
+  const allPages = dataDb.prepare(`SELECT * FROM ${t('page_deps')}`).all() as {
     page_file: string; route: string; portal: string;
     components: string; hooks: string; routers: string; tables_touched: string;
   }[];

package/src/python/coupling-detector.ts

@@ -5,6 +5,7 @@ import { readFileSync, readdirSync } from 'fs';
 import { join, relative } from 'path';
 import type Database from 'better-sqlite3';
 import { getProjectRoot, getConfig } from '../config.ts';
+import { t } from '../lib/sql-table-names.ts';
 
 interface CouplingMatch {
   frontendFile: string;
@@ -23,20 +24,20 @@ export function buildPythonCouplingIndex(dataDb: Database.Database): number {
   const srcDir = join(projectRoot, config.paths.source);
 
   // Get all routes from DB
-  const routes = dataDb.prepare('SELECT id, method, path FROM massu_py_routes').all() as {
+  const routes = dataDb.prepare(`SELECT id, method, path FROM ${t('py_routes')}`).all() as {
     id: number; method: string; path: string;
   }[];
 
   if (routes.length === 0) return 0;
 
   // Clear existing callers
-  dataDb.exec('DELETE FROM massu_py_route_callers');
+  dataDb.exec(`DELETE FROM ${t('py_route_callers')}`);
 
   // Walk frontend files (TS/TSX/JS/JSX)
   const frontendFiles = walkFrontendFiles(srcDir);
 
   const insertStmt = dataDb.prepare(
-    'INSERT INTO massu_py_route_callers (route_id, frontend_file, line, call_pattern) VALUES (?, ?, ?, ?)'
+    `INSERT INTO ${t('py_route_callers')} (route_id, frontend_file, line, call_pattern) VALUES (?, ?, ?, ?)`
   );
 
   let count = 0;

package/src/python/domain-enforcer.ts

@@ -3,6 +3,7 @@
 
 import type Database from 'better-sqlite3';
 import { getConfig } from '../config.ts';
+import { t } from '../lib/sql-table-names.ts';
 
 export interface DomainViolation {
   sourceFile: string;
@@ -44,7 +45,7 @@ export function findPythonDomainViolations(dataDb: Database.Database): DomainVio
   if (domains.length === 0) return [];
 
   const imports = dataDb.prepare(
-    'SELECT source_file, target_file FROM massu_py_imports'
+    `SELECT source_file, target_file FROM ${t('py_imports')}`
   ).all() as { source_file: string; target_file: string }[];
 
   const violations: DomainViolation[] = [];
@@ -74,7 +75,7 @@ export function findPythonDomainViolations(dataDb: Database.Database): DomainVio
  */
 export function getPythonFilesInDomain(dataDb: Database.Database, domainName: string): string[] {
   const allFiles = dataDb.prepare(
-    'SELECT DISTINCT source_file as f FROM massu_py_imports UNION SELECT DISTINCT target_file as f FROM massu_py_imports'
+    `SELECT DISTINCT source_file as f FROM ${t('py_imports')} UNION SELECT DISTINCT target_file as f FROM ${t('py_imports')}`
   ).all() as { f: string }[];
 
   return allFiles

package/src/python/impact-analyzer.ts

@@ -3,6 +3,7 @@
 
 import type Database from 'better-sqlite3';
 import { classifyPythonFileDomain } from './domain-enforcer.ts';
+import { t } from '../lib/sql-table-names.ts';
 
 export interface PythonImpactReport {
   file: string;
@@ -26,28 +27,28 @@ export function analyzePythonImpact(dataDb: Database.Database, file: string): Py
 
   // 2. Routes defined in this file
   const routes = dataDb.prepare(
-    'SELECT method, path, function_name FROM massu_py_routes WHERE file = ?'
+    `SELECT method, path, function_name FROM ${t('py_routes')} WHERE file = ?`
   ).all(file) as { method: string; path: string; function_name: string }[];
 
   // 3. Models defined in this file
   const models = dataDb.prepare(
-    'SELECT class_name, table_name FROM massu_py_models WHERE file = ?'
+    `SELECT class_name, table_name FROM ${t('py_models')} WHERE file = ?`
   ).all(file) as { class_name: string; table_name: string | null }[];
 
   // 4. Frontend callers (via routes in this file)
-  const routeIds = dataDb.prepare('SELECT id FROM massu_py_routes WHERE file = ?').all(file) as { id: number }[];
+  const routeIds = dataDb.prepare(`SELECT id FROM ${t('py_routes')} WHERE file = ?`).all(file) as { id: number }[];
   const frontendCallers: string[] = [];
   if (routeIds.length > 0) {
     const placeholders = routeIds.map(() => '?').join(',');
     const callers = dataDb.prepare(
-      `SELECT DISTINCT frontend_file FROM massu_py_route_callers WHERE route_id IN (${placeholders})`
+      `SELECT DISTINCT frontend_file FROM ${t('py_route_callers')} WHERE route_id IN (${placeholders})`
     ).all(...routeIds.map(r => r.id)) as { frontend_file: string }[];
     frontendCallers.push(...callers.map(c => c.frontend_file));
   }
 
   // 5. Domain crossings
   const imports = dataDb.prepare(
-    'SELECT target_file FROM massu_py_imports WHERE source_file = ?'
+    `SELECT target_file FROM ${t('py_imports')} WHERE source_file = ?`
   ).all(file) as { target_file: string }[];
 
   const domainCrossings = imports
@@ -71,7 +72,7 @@ function collectTransitiveImporters(dataDb: Database.Database, file: string, max
   let depth = 0;
 
   const importerStmt = dataDb.prepare(
-    'SELECT source_file FROM massu_py_imports WHERE target_file = ?'
+    `SELECT source_file FROM ${t('py_imports')} WHERE target_file = ?`
   );
 
   while (queue.length > 0 && depth < maxDepth) {

package/src/python/import-resolver.ts

@@ -6,6 +6,7 @@ import { resolve, join, relative, dirname } from 'path';
 import type Database from 'better-sqlite3';
 import { parsePythonImports } from './import-parser.ts';
 import { getProjectRoot } from '../config.ts';
+import { t } from '../lib/sql-table-names.ts';
 
 /**
  * Resolve a Python module path to a file path.
@@ -82,10 +83,10 @@ export function buildPythonImportIndex(dataDb: Database.Database, pythonRoot: st
   const absRoot = resolve(projectRoot, pythonRoot);
 
   // Clear existing Python import edges
-  dataDb.exec('DELETE FROM massu_py_imports');
+  dataDb.exec(`DELETE FROM ${t('py_imports')}`);
 
   const insertStmt = dataDb.prepare(
-    'INSERT INTO massu_py_imports (source_file, target_file, import_type, imported_names, line) VALUES (?, ?, ?, ?, ?)'
+    `INSERT INTO ${t('py_imports')} (source_file, target_file, import_type, imported_names, line) VALUES (?, ?, ?, ?, ?)`
   );
 
   const files = walkPythonFiles(absRoot, excludeDirs);

package/src/python/migration-indexer.ts

@@ -6,11 +6,12 @@ import { join, relative } from 'path';
 import type Database from 'better-sqlite3';
 import { parseAlembicMigration } from './migration-parser.ts';
 import { getProjectRoot } from '../config.ts';
+import { t } from '../lib/sql-table-names.ts';
 
 export function buildPythonMigrationIndex(dataDb: Database.Database, alembicDir: string): number {
   const projectRoot = getProjectRoot();
   const absDir = join(projectRoot, alembicDir);
-  dataDb.exec('DELETE FROM massu_py_migrations');
+  dataDb.exec(`DELETE FROM ${t('py_migrations')}`);
 
   // Look for version files in versions/ subdirectory
   const versionsDir = join(absDir, 'versions');
@@ -28,7 +29,7 @@ export function buildPythonMigrationIndex(dataDb: Database.Database, alembicDir:
   }
 
   const insertStmt = dataDb.prepare(
-    'INSERT INTO massu_py_migrations (revision, down_revision, file, description, operations, is_head) VALUES (?, ?, ?, ?, ?, ?)'
+    `INSERT INTO ${t('py_migrations')} (revision, down_revision, file, description, operations, is_head) VALUES (?, ?, ?, ?, ?, ?)`
   );
 
   let count = 0;
@@ -80,11 +81,11 @@ export interface DriftReport {
 }
 
 export function detectMigrationDrift(dataDb: Database.Database): DriftReport {
-  const models = dataDb.prepare('SELECT class_name, table_name, columns FROM massu_py_models WHERE table_name IS NOT NULL').all() as {
+  const models = dataDb.prepare(`SELECT class_name, table_name, columns FROM ${t('py_models')} WHERE table_name IS NOT NULL`).all() as {
     class_name: string; table_name: string; columns: string;
   }[];
 
-  const migrations = dataDb.prepare('SELECT operations FROM massu_py_migrations').all() as { operations: string }[];
+  const migrations = dataDb.prepare(`SELECT operations FROM ${t('py_migrations')}`).all() as { operations: string }[];
 
   // Collect all tables and columns mentioned in migrations
   const migratedTables = new Set<string>();

package/src/python/model-indexer.ts

@@ -6,6 +6,7 @@ import { join, relative } from 'path';
 import type Database from 'better-sqlite3';
 import { parsePythonModels } from './model-parser.ts';
 import { getProjectRoot } from '../config.ts';
+import { t } from '../lib/sql-table-names.ts';
 
 function walkPyFiles(dir: string, excludeDirs: string[]): string[] {
   const files: string[] = [];
@@ -26,14 +27,14 @@ function walkPyFiles(dir: string, excludeDirs: string[]): string[] {
 export function buildPythonModelIndex(dataDb: Database.Database, pythonRoot: string, excludeDirs: string[] = ['__pycache__', '.venv', 'venv', '.mypy_cache', '.pytest_cache']): number {
   const projectRoot = getProjectRoot();
   const absRoot = join(projectRoot, pythonRoot);
-  dataDb.exec('DELETE FROM massu_py_models');
-  dataDb.exec('DELETE FROM massu_py_fk_edges');
+  dataDb.exec(`DELETE FROM ${t('py_models')}`);
+  dataDb.exec(`DELETE FROM ${t('py_fk_edges')}`);
 
   const insertModel = dataDb.prepare(
-    'INSERT INTO massu_py_models (class_name, table_name, file, line, columns, relationships, foreign_keys) VALUES (?, ?, ?, ?, ?, ?, ?)'
+    `INSERT INTO ${t('py_models')} (class_name, table_name, file, line, columns, relationships, foreign_keys) VALUES (?, ?, ?, ?, ?, ?, ?)`
   );
   const insertFk = dataDb.prepare(
-    'INSERT INTO massu_py_fk_edges (source_table, source_column, target_table, target_column) VALUES (?, ?, ?, ?)'
+    `INSERT INTO ${t('py_fk_edges')} (source_table, source_column, target_table, target_column) VALUES (?, ?, ?, ?)`
   );
 
   const files = walkPyFiles(absRoot, excludeDirs);

package/src/python/route-indexer.ts

@@ -6,6 +6,7 @@ import { join, relative } from 'path';
 import type Database from 'better-sqlite3';
 import { parsePythonRoutes } from './route-parser.ts';
 import { getProjectRoot } from '../config.ts';
+import { t } from '../lib/sql-table-names.ts';
 
 function walkPyFiles(dir: string, excludeDirs: string[]): string[] {
   const files: string[] = [];
@@ -26,11 +27,11 @@ function walkPyFiles(dir: string, excludeDirs: string[]): string[] {
 export function buildPythonRouteIndex(dataDb: Database.Database, pythonRoot: string, excludeDirs: string[] = ['__pycache__', '.venv', 'venv', '.mypy_cache', '.pytest_cache']): number {
   const projectRoot = getProjectRoot();
   const absRoot = join(projectRoot, pythonRoot);
-  dataDb.exec('DELETE FROM massu_py_routes');
-  dataDb.exec('DELETE FROM massu_py_route_callers');
+  dataDb.exec(`DELETE FROM ${t('py_routes')}`);
+  dataDb.exec(`DELETE FROM ${t('py_route_callers')}`);
 
   const insertStmt = dataDb.prepare(
-    'INSERT INTO massu_py_routes (file, method, path, function_name, dependencies, request_model, response_model, is_authenticated, line) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)'
+    `INSERT INTO ${t('py_routes')} (file, method, path, function_name, dependencies, request_model, response_model, is_authenticated, line) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
   );
 
   const files = walkPyFiles(absRoot, excludeDirs);