@massu/core 1.10.7 → 1.12.0

package/src/lib/fileLock.ts

@@ -1,203 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Generic synchronous file-lock primitive built on `proper-lockfile`.
- *
- * Plan 3c gap-59 deliverable. Single source of truth for "acquire-lock,
- * run fn, release on every exit path" across the codebase. Both
- * `lib/installLock.ts:withInstallLock` (Plan 3a installAll serialization)
- * AND `security/manifest-cache.ts:refreshManifest` (Plan 3c manifest
- * cache writes) MUST delegate to `withFileLockSync` here — there is NO
- * parallel lock implementation in the codebase per CR-46 / Rule 0
- * (single-source-of-truth for lock semantics).
- *
- * What this primitive provides:
- * 1. mkdirSync the lock parent dir if absent (fresh-repo / fresh-home case).
- * 2. proper-lockfile.lockSync acquires the lock; we wrap the manual retry
- *    loop because lockSync rejects retries>0 (`Cannot use retries with
- *    the sync api` per node_modules/proper-lockfile/lib/adapter.js).
- * 3. Surface ELOCKED (POSIX) and EBUSY (Windows) as the same FileLockBusyError.
- * 4. Persist the lock-holder PID alongside the lock as `<lockPath>.pid` so
- *    the next contender can include it in a user-friendly error message.
- * 5. Default 30s block-then-bail per Plan 3a §190; configurable per-callsite.
- * 6. `errorFactory` opt lets callers customize the busy-error class so
- *    domain-specific helpers (`InstallLockBusyError`, future Phase 5
- *    `ManifestCacheBusyError`) can extend the base type without each
- *    re-implementing the lock logic.
- *
- * NOT provided by this primitive:
- * - Async variant (`withFileLockAsync`). The current Phase 5 cache-write
- *   path resolves the async fetch BEFORE acquiring the lock, so the lock
- *   is held only during the brief sync atomicWrite. Async-while-holding-
- *   the-lock would deadlock under contention; the design is "fetch first,
- *   then lock-for-write only".
- * - Reentrancy. `proper-lockfile.lockSync` is non-reentrant; calling
- *   withFileLockSync recursively from inside its own `fn` will fail with
- *   ELOCKED. Plan 3a observed and documented this in
- *   __tests__/watch/config-refresh-autoyes.test.ts:129.
- */
-
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'fs';
-import { dirname } from 'path';
-import * as lockfile from 'proper-lockfile';
-
-export interface FileLockOpts {
-  /** Default 30s — proper-lockfile considers a lock stale after this elapses. */
-  staleMs?: number;
-  /**
-   * How long the manual retry loop should block waiting for the holder to
-   * release before bailing with the busy error. Default 30s.
-   * Pass `0` to bail immediately (used in tests).
-   */
-  blockMs?: number;
-  /** Sleep granularity inside the retry loop. Default 100ms. */
-  pollIntervalMs?: number;
-  /**
-   * Backwards-compat: legacy callers pass `retries: 0` to mean "do not
-   * block". When set to a positive integer, used by tests that want to
-   * exercise a specific retry count instead of the default time-based loop.
-   */
-  retries?: number;
-  /** Override clock (test seam). */
-  now?: () => number;
-  /** Override sleep (test seam). Defaults to a busy-wait spinloop. */
-  sleep?: (ms: number) => void;
-  /**
-   * Optional custom busy-error factory. When provided, the default
-   * FileLockBusyError throw is replaced with whatever this factory returns.
-   * Domain-specific callers (installLock, manifest-cache) use this to
-   * keep their own user-facing error types and messages.
-   */
-  errorFactory?: (
-    lockPath: string,
-    holderPid: number | null,
-    retryAfterSeconds: number,
-    causeCode: string | undefined,
-  ) => Error;
-}
-
-export class FileLockBusyError extends Error {
-  constructor(
-    public lockPath: string,
-    public holderPid: number | null,
-    public retryAfterSeconds: number,
-    public causeCode?: string,
-  ) {
-    const pidPart = holderPid != null ? `(PID=${holderPid})` : '(PID=unknown)';
-    super(`File lock at ${lockPath} held by another process ${pidPart} — try again in ${retryAfterSeconds}s`);
-    this.name = 'FileLockBusyError';
-  }
-}
-
-/**
- * Best-effort: read the PID of the current lock holder from the
- * `<lockPath>.pid` sidecar file. Returns null on any read error.
- */
-export function readLockHolderPid(lockPath: string): number | null {
-  try {
-    const raw = readFileSync(`${lockPath}.pid`, 'utf-8').trim();
-    const pid = Number.parseInt(raw, 10);
-    if (!Number.isFinite(pid) || pid <= 0) return null;
-    return pid;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * CR-9 audit L3 fix: REQUIRES SharedArrayBuffer + Atomics for the sync
- * wait. The prior fallback (a tight `while (Date.now() < end)` spinloop)
- * burned 100% CPU on environments without Atomics — typically sandboxed
- * serverless runtimes — making contended manifest refreshes a DoS
- * surface against the host. With this throw, callers running on
- * Atomics-less environments fail loudly + early instead of silently
- * spinning.
- */
-export function busyWaitSync(ms: number): void {
-  if (typeof SharedArrayBuffer === 'undefined' || typeof Atomics === 'undefined') {
-    throw new Error(
-      `withFileLockSync requires SharedArrayBuffer + Atomics for its retry-loop wait. ` +
-      `This Node runtime does not provide them — refusing to fall back to a CPU spinloop. ` +
-      `If you hit this in a sandboxed serverless env, the fix is to perform the ` +
-      `lock-protected operation in a host runtime that supports Atomics.`,
-    );
-  }
-  const sab = new SharedArrayBuffer(4);
-  const view = new Int32Array(sab);
-  Atomics.wait(view, 0, 0, ms);
-}
-
-/**
- * Acquire the lock at `lockPath`, run `fn`, release on every exit path.
- * Synchronous all the way through. See module-level doc for guarantees.
- *
- * Throws:
- * - The result of `opts.errorFactory(...)` if provided AND lock is busy
- *   beyond `blockMs`. Otherwise throws FileLockBusyError.
- * - Any non-ELOCKED/EBUSY filesystem error from proper-lockfile is
- *   re-thrown unchanged.
- */
-export function withFileLockSync<T>(lockPath: string, fn: () => T, opts: FileLockOpts = {}): T {
-  // Ensure the lock's parent directory exists. Fresh repos / fresh user-home
-  // .massu/ may not have the parent yet.
-  mkdirSync(dirname(lockPath), { recursive: true });
-
-  const staleMs = opts.staleMs ?? 30_000;
-  const blockMs = opts.retries === 0 ? 0 : (opts.blockMs ?? 30_000);
-  const pollIntervalMs = opts.pollIntervalMs ?? 100;
-  const now = opts.now ?? Date.now;
-  const sleep = opts.sleep ?? busyWaitSync;
-  const makeBusyError =
-    opts.errorFactory ??
-    ((path, pid, retrySeconds, code) => new FileLockBusyError(path, pid, retrySeconds, code));
-
-  let release: (() => void) | null = null;
-  const deadline = now() + blockMs;
-
-  for (;;) {
-    try {
-      release = lockfile.lockSync(lockPath, {
-        stale: staleMs,
-        retries: 0,
-        realpath: false,
-      });
-      try {
-        writeFileSync(`${lockPath}.pid`, String(process.pid), 'utf-8');
-      } catch {
-        // best-effort
-      }
-      break;
-    } catch (err) {
-      const e = err as NodeJS.ErrnoException;
-      const code = e.code;
-      if (code !== 'ELOCKED' && code !== 'EBUSY') {
-        throw err;
-      }
-      if (now() >= deadline) {
-        const holderPid = readLockHolderPid(lockPath);
-        const remainingMs = Math.max(0, deadline - now());
-        const retryAfterSeconds = blockMs === 0
-          ? Math.round(staleMs / 1000)
-          : Math.round(remainingMs / 1000);
-        throw makeBusyError(lockPath, holderPid, retryAfterSeconds, code);
-      }
-      sleep(pollIntervalMs);
-    }
-  }
-
-  try {
-    return fn();
-  } finally {
-    try {
-      if (release) release();
-    } catch {
-      // best-effort
-    }
-    try {
-      rmSync(`${lockPath}.pid`, { force: true });
-    } catch {
-      // best-effort
-    }
-  }
-}

package/src/lib/gitToplevel.ts

@@ -1,22 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Resolve the git repository root for a given working directory, falling
- * back to the cwd itself when not inside a git repo.
- *
- * Used by `massu watch` and `massu refresh-log` so the watcher root and the
- * refresh-log path always anchor on the same toplevel rather than wherever
- * the user happened to invoke the CLI from.
- */
-
-import { spawnSync } from 'child_process';
-
-export function gitToplevel(cwd: string): string {
-  const res = spawnSync('git', ['rev-parse', '--show-toplevel'], {
-    cwd,
-    encoding: 'utf-8',
-  });
-  if (res.status === 0 && res.stdout) return res.stdout.trim();
-  return cwd;
-}

package/src/lib/hook-registry.ts

@@ -1,43 +0,0 @@
-/**
- * Single source of truth for the canonical Massu hook set.
- *
- * P-H001 (plan-stage-c-high-batch): doctor / installer / build:hooks all
- * consume from here. The drift-guard `hook-registry-parity.test.ts` asserts:
- *
- *   1. REGISTERED_HOOKS matches `src/hooks/*.ts` filenames (the build SoT).
- *   2. REGISTERED_HOOKS matches the hook names referenced in
- *      `buildHooksConfig()` (the installer SoT).
- *   3. REGISTERED_HOOKS matches `dist/hooks/*.js` after `npm run build:hooks`
- *      (the runtime SoT, when build artifacts are available).
- *
- * Adding a new hook requires touching THREE places: src/hooks/X.ts,
- * REGISTERED_HOOKS, and buildHooksConfig() — the parity tests enforce this.
- */
-export const REGISTERED_HOOKS = [
-  'auto-learning-pipeline',
-  'classify-failure',
-  'cost-tracker',
-  'fix-detector',
-  'incident-pipeline',
-  'intent-suggester',
-  'post-edit-context',
-  'post-tool-use',
-  'pre-compact',
-  'pre-delete-check',
-  'quality-event',
-  'rule-enforcement-pipeline',
-  'security-gate',
-  'session-end',
-  'session-start',
-  'user-prompt',
-] as const;
-
-export type RegisteredHook = (typeof REGISTERED_HOOKS)[number];
-
-export function getExpectedHookFiles(): readonly string[] {
-  return REGISTERED_HOOKS.map((name) => `${name}.js`);
-}
-
-export function getRegisteredHookCount(): number {
-  return REGISTERED_HOOKS.length;
-}

package/src/lib/installLock.ts

@@ -1,66 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Synchronous file lock around installAll() for cross-process safety.
- *
- * Plan 3a Phase 6: installAll() may now be invoked from BOTH the manual
- * `runConfigRefresh` path AND the watcher auto-trigger. Without
- * serialization, two concurrent callers can race on `.claude/commands/`
- * file writes. proper-lockfile gives us atomic mkdir-based locks that
- * work cross-platform.
- *
- * Plan 3c gap-59 / Rule 0 single-source-of-truth refactor (commit pending,
- * 2026-05-07): the proper-lockfile-wrapping logic + manual retry loop +
- * .pid sidecar bookkeeping now lives in `lib/fileLock.ts:withFileLockSync`.
- * This file is a thin domain-specific wrapper that:
- *   1. Computes the project-root-anchored lockPath
- *   2. Delegates to withFileLockSync via an `errorFactory` that returns
- *      `InstallLockBusyError` (preserving the exact error message format
- *      Plan 3a §243 specified and the install-lock tests assert)
- *
- * Plan 3a §190 retry behavior preserved: "second caller blocks up to 30s,
- * then bails". InstallLockBusyError instances continue to expose
- * `lockPath`, `holderPid`, `retryAfterSeconds`, `causeCode` — backwards-
- * compatible for any caller that does `instanceof InstallLockBusyError`.
- */
-
-import { resolve } from 'path';
-import { withFileLockSync, type FileLockOpts } from './fileLock.js';
-
-export interface InstallLockOpts extends FileLockOpts {
-  // No additional fields — all options come from FileLockOpts. This alias
-  // preserves the public surface for any caller that imported `InstallLockOpts`.
-}
-
-export class InstallLockBusyError extends Error {
-  constructor(
-    public lockPath: string,
-    public holderPid: number | null,
-    public retryAfterSeconds: number,
-    public causeCode?: string,
-  ) {
-    const pidPart = holderPid != null ? `(PID=${holderPid})` : '(PID=unknown)';
-    super(`installAll already running ${pidPart} — try again in ${retryAfterSeconds}s`);
-    this.name = 'InstallLockBusyError';
-  }
-}
-
-/**
- * Acquire the install lock for `projectRoot`, run `fn`, release on every
- * exit path. Throws `InstallLockBusyError` when the lock is held beyond
- * `blockMs`. See `lib/fileLock.ts:withFileLockSync` for the underlying
- * primitive.
- */
-export function withInstallLock<T>(projectRoot: string, fn: () => T, opts: InstallLockOpts = {}): T {
-  const lockPath = resolve(projectRoot, '.massu', 'installAll.lock');
-  return withFileLockSync(
-    lockPath,
-    fn,
-    {
-      ...opts,
-      errorFactory: (path, pid, retrySeconds, code) =>
-        new InstallLockBusyError(path, pid, retrySeconds, code),
-    },
-  );
-}

package/src/lib/memory-path.ts

@@ -1,49 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Memory directory name encoding — canonical helpers.
- *
- * Single source of truth for translating a project's absolute filesystem
- * root into the directory name used under `~/.claude/projects/<encoded-root>/memory/`.
- *
- * Closes the P-004 install-path drift class: the writer in `commands/init.ts`
- * historically prepended an EXTRA leading `-` while the reader in
- * `config.ts:getResolvedPaths()` and the backfill code path used the
- * canonical single-dash form. Result: 100% of `massu init` runs orphaned
- * `MEMORY.md` in a directory the reader could never find.
- *
- * Both encoding and decoding live here so the round-trip property is testable.
- *
- * Encoding rule:
- *   Replace every `/` in the absolute project root with `-`.
- *   An absolute path always starts with `/`, so the result always starts with
- *   `-` exactly once. NEVER prepend an additional `-`.
- *
- * Decoding rule:
- *   Replace every `-` in the directory name with `/`. This is the canonical
- *   inverse used by Claude Code's session-state plumbing. Note: project roots
- *   that contain literal `-` characters cannot be unambiguously round-tripped
- *   through this encoding — the same trade-off Claude Code's own resolver makes.
- */
-
-/**
- * Encode an absolute project root into the directory name used under
- * `~/.claude/projects/<dir>/memory/`.
- *
- * @param projectRoot Absolute filesystem path (must start with `/`).
- * @returns Canonical encoded directory name (always begins with `-`).
- */
-export function encodeMemoryDirName(projectRoot: string): string {
-  return projectRoot.replace(/\//g, '-');
-}
-
-/**
- * Decode a memory-directory name back to its slash-separated form.
- *
- * @param dirname The directory name as it appears under `~/.claude/projects/`.
- * @returns A slash-separated path (begins with `/`).
- */
-export function decodeMemoryDirName(dirname: string): string {
-  return dirname.replace(/-/g, '/');
-}

package/src/lib/pidLiveness.ts

@@ -1,67 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Cross-platform PID liveness probe.
- *
- * POSIX (macOS / Linux):
- *   process.kill(pid, 0) → no-throw == alive; ESRCH → dead; EPERM → alive
- *   (the process exists but we lack permission to signal it).
- *
- * Windows:
- *   `tasklist /FI "PID eq <pid>" /NH` and grep for the PID. Best-effort.
- *
- * Returns boolean; never throws. Used by hooks/session-start.ts
- * (banner suppression) and watch/daemon.ts (registry sweep).
- */
-
-import { spawnSync } from 'child_process';
-
-interface ProbeOpts {
-  /** When set, override `process.platform` (test seam). */
-  platformOverride?: NodeJS.Platform;
-  /** When set, override `process.kill` (test seam). */
-  killOverride?: (pid: number, signal: number) => boolean;
-}
-
-export function isPidAlive(pid: number, opts: ProbeOpts = {}): boolean {
-  if (!Number.isFinite(pid) || pid <= 0) return false;
-
-  const platform = opts.platformOverride ?? process.platform;
-
-  if (platform === 'win32') {
-    return checkWindows(pid);
-  }
-  return checkPosix(pid, opts.killOverride);
-}
-
-function checkPosix(pid: number, killOverride?: (pid: number, signal: number) => boolean): boolean {
-  try {
-    if (killOverride) {
-      killOverride(pid, 0);
-    } else {
-      process.kill(pid, 0);
-    }
-    return true;
-  } catch (err) {
-    const code = (err as NodeJS.ErrnoException).code;
-    if (code === 'EPERM') return true;
-    // ESRCH or anything else → treat as dead.
-    return false;
-  }
-}
-
-function checkWindows(pid: number): boolean {
-  try {
-    const res = spawnSync('tasklist', ['/FI', `PID eq ${pid}`, '/NH'], {
-      encoding: 'utf-8',
-      windowsHide: true,
-    });
-    if (res.error || res.status !== 0) return false;
-    const stdout = res.stdout || '';
-    // Each match is a line that starts with the image name and includes the PID.
-    return new RegExp(`\\b${pid}\\b`).test(stdout);
-  } catch {
-    return false;
-  }
-}

package/src/lib/settings-local.ts

@@ -1,110 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * Shared IO helper for `.claude/settings.local.json` and the user-global
- * `~/.claude/settings.json`. SSOT for read+atomic-write semantics; closes
- * the pre-existing non-atomic-write bug at init.ts installHooks (previously
- * used writeFileSync which was vulnerable to SIGINT-between-truncate-and-write).
- *
- * Three exports:
- *   - readSettingsLocal(claudeDir): safe-parse of <claudeDir>/settings.local.json
- *   - writeSettingsLocalAtomic(claudeDir, settings): atomic write of same
- *   - readSettingsAtPath(absolutePath): generic safe-parse used by readSettingsLocal
- *     AND by permissions.ts:readGlobalSettings() reading ~/.claude/settings.json
- *
- * Plus the atomicWriteFile primitive (moved here from install-commands.ts to
- * centralize). All consumers — install-commands manifest save, install-commands
- * per-file syncs, init.ts installHooks, doctor.ts hooks-config check — share
- * this single source of truth for filesystem IO.
- */
-
-import {
-  closeSync,
-  existsSync,
-  fsyncSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  writeSync,
-} from 'fs';
-import { dirname, resolve } from 'path';
-
-/**
- * Atomic file write — tmp + fsync + rename. Moved from install-commands.ts so
- * it can be reused by settings-local IO without circular import.
- *
- * Writes via openSync + writeSync + fsyncSync + closeSync + renameSync so the
- * data hits the platter before the rename. On any error, removes the tmp file.
- * Tmp filename includes process.pid to avoid clashes with concurrent installs.
- */
-export function atomicWriteFile(targetPath: string, content: string, mode = 0o644): void {
-  const tmpPath = `${targetPath}.${process.pid}.tmp`;
-  try {
-    const fd = openSync(tmpPath, 'w', mode);
-    try {
-      const buf = Buffer.from(content, 'utf-8');
-      writeSync(fd, buf, 0, buf.length, 0);
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
-    renameSync(tmpPath, targetPath);
-  } catch (err) {
-    if (existsSync(tmpPath)) {
-      try { rmSync(tmpPath, { force: true }); } catch { /* ignore */ }
-    }
-    throw err;
-  }
-}
-
-/**
- * Generic safe-parse of a JSON settings file. Used by readSettingsLocal
- * (project-local) AND permissions.ts:readGlobalSettings (user-global).
- *
- * Returns `{}` on any failure path: missing file, unreadable, malformed JSON,
- * non-object root. This contract lets callers do `(settings.permissions as any)`
- * shape-checks defensively without a separate "does the file exist" pre-check.
- */
-export function readSettingsAtPath(absolutePath: string): Record<string, unknown> {
-  if (!existsSync(absolutePath)) {
-    return {};
-  }
-  try {
-    const raw = readFileSync(absolutePath, 'utf-8');
-    const parsed = JSON.parse(raw);
-    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
-      return {};
-    }
-    return parsed as Record<string, unknown>;
-  } catch {
-    return {};
-  }
-}
-
-/**
- * Read `<claudeDir>/settings.local.json`. Returns `{}` on missing/corrupt.
- */
-export function readSettingsLocal(claudeDir: string): Record<string, unknown> {
-  return readSettingsAtPath(resolve(claudeDir, 'settings.local.json'));
-}
-
-/**
- * Atomically write `<claudeDir>/settings.local.json`. Creates the parent
- * directory if missing. JSON.stringify with 2-space indent + trailing newline
- * (matches the existing convention in init.ts installHooks).
- */
-export function writeSettingsLocalAtomic(
-  claudeDir: string,
-  settings: Record<string, unknown>,
-): void {
-  const targetPath = resolve(claudeDir, 'settings.local.json');
-  const dir = dirname(targetPath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-  const content = JSON.stringify(settings, null, 2) + '\n';
-  atomicWriteFile(targetPath, content);
-}

package/src/lib/sql-table-names.ts

@@ -1,71 +0,0 @@
-// Copyright (c) 2026 Massu. All rights reserved.
-// Licensed under BSL 1.1 - see LICENSE file for details.
-
-/**
- * P-H032 (plan-stage-c-high-batch / 1.10.7): SoT for SQL table names that
- * are prefixed with the customer's configured `toolPrefix`.
- *
- * **Bug class closed**: 20 distinct SQL table names (`massu_imports`,
- * `massu_trpc_procedures`, `massu_sentinel`, etc.) were hardcoded with the
- * `massu_` prefix in ~145 SQL string sites across 21 source files. Tool
- * names were already config-driven via `getConfig().toolPrefix` but
- * persistence wasn't — split-brain where a non-default-prefix customer
- * (e.g. `toolPrefix: 'foo'`) would have tools named `foo_*` but tables
- * still named `massu_*`. Default-prefix customers (100% of current
- * installs) see ZERO behavior change.
- *
- * **Structural fix**: every SQL string that references a prefix-scoped
- * table now goes through `t(suffix)` which returns
- * `\`${getConfig().toolPrefix}_${suffix}\``. The ESLint rule
- * `no-hardcoded-massu-tables` bans bare `'massu_X'` literals so future
- * regressions are impossible. The drift-guard test
- * `sql-table-names-source-grep.test.ts` scans the source tree and asserts
- * zero bare `massu_<table>` literals outside this module + the test files.
- *
- * **20 canonical table suffixes** (registered here as a typed const so
- * typos at callsites are caught at compile time):
- */
-
-import { getConfig } from '../config.ts';
-
-/**
- * The complete set of suffixes for prefix-scoped SQL tables. Keep this in
- * sync with `packages/core/src/db.ts` (CodeGraph schema) +
- * `sentinel-db.ts` (sentinel schema) + Python indexer DDL in
- * `packages/core/src/python/*.ts`.
- */
-export type MassuTableSuffix =
-  | 'imports'
-  | 'meta'
-  | 'middleware_tree'
-  | 'page_deps'
-  | 'py_fk_edges'
-  | 'py_imports'
-  | 'py_meta'
-  | 'py_migrations'
-  | 'py_models'
-  | 'py_route_callers'
-  | 'py_routes'
-  | 'sentinel'
-  | 'sentinel_changelog'
-  | 'sentinel_components'
-  | 'sentinel_deps'
-  | 'sentinel_fts'
-  | 'sentinel_pages'
-  | 'sentinel_procedures'
-  | 'trpc_call_sites'
-  | 'trpc_procedures';
-
-/**
- * Resolve a prefix-scoped table name to its concrete identifier using the
- * current `getConfig().toolPrefix`. For default-prefix installs returns
- * `massu_<suffix>` (current behavior). For custom-prefix installs returns
- * `<customPrefix>_<suffix>`.
- *
- * Use this in EVERY SQL string that references a prefix-scoped table.
- * The ESLint rule bans bare `'massu_X'` literals; the only legitimate
- * exit is this function.
- */
-export function t(suffix: MassuTableSuffix): string {
-  return `${getConfig().toolPrefix}_${suffix}`;
-}