code-auditor-mcp 4.1.0 → 5.0.1

package/dist/codeIndexDB.js

@@ -1,247 +1,65 @@
 /**
  * Code Index Database using SQLite (better-sqlite3) + FTS5
  * Replaces LokiJS + FlexSearch with durable, transactional storage.
+ *
+ * `CodeIndexDB` is the connection owner and transaction boundary, plus the
+ * cross-concern orchestrators (sync, diff detection, churn/hotspot/convention
+ * mining). Each storage concern — functions, search, coverage, dependency
+ * graph, schema usage, whitelist, audit results, analyzer configs, code maps,
+ * project tasks, meta, provenance, inferred receivers, conventions, raw SQL —
+ * lives in its own module under `codeIndex/` and is exposed as a public field.
  */
-import { createHash } from 'crypto';
-import { openSqlite } from './sqlite/driver.js';
+import { openSqlite, DB_BUSY_TIMEOUT_MS } from './sqlite/driver.js';
 import { promises as fs } from 'fs';
 import path from 'path';
 import { discoverFiles, ALL_EXTENSIONS } from './utils/fileDiscovery.js';
-import { ProjectTaskRepository } from './services/ProjectTaskRepository.js';
-import { mineConventions, computeMinerInputHash } from './conventions/conventionMiner.js';
+import { computeContentHash } from './utils/contentHash.js';
+import { errorMessage } from './utils/errorMessage.js';
+import { getPersistedStorageRoot, resolvePersistedIndexPath } from './dataPaths.js';
+import { ContextualError, getErrnoCode } from './mcpToolErrors.js';
 import { extractChurn } from './churn/churnExtractor.js';
 import { computeHotspots } from './hotspots/hotspotScorer.js';
-import { populateCallGraphCache, getGraphStats as getGs } from './graph/callGraph.js';
+import { populateCallGraphCache } from './graph/callGraph.js';
 import { populateImportGraphCache } from './graph/importGraph.js';
-import { QueryParser, compileToSQL } from './search/QueryParser.js';
-import { getPersistedStorageRoot, resolvePersistedIndexPath } from './dataPaths.js';
-import { ContextualError, getErrnoCode } from './mcpToolErrors.js';
-import { WhitelistType, WhitelistStatus } from './types/whitelist.js';
-// ── SQLite busy timeout ─────────────────────────────────────────────────
-// The database is shared across forked processes (a detached audit runner and
-// its shard workers). better-sqlite3's default busy timeout (~5s) is too short
-// for a running job's long completion transaction, so a queued job's lease
-// `BEGIN IMMEDIATE` (or the runner's own writes) would throw SQLITE_BUSY
-// ("database is locked") instead of waiting. A generous timeout makes
-// contention block gracefully; the lease loop also retries SQLITE_BUSY.
-export const DB_BUSY_TIMEOUT_MS = 30_000;
-// ── Content hash ────────────────────────────────────────────────────────
-function computeContentHash(body, signature) {
-    const normalized = (body ?? '').replace(/\s+/g, ' ').trim() + '|' + (signature ?? '').trim();
-    return createHash('sha256').update(normalized).digest('hex');
-}
+import { CoverageIndex } from './codeIndex/coverage.js';
+import { DependencyGraphIndex } from './codeIndex/dependencyGraph.js';
+import { FunctionIndex } from './codeIndex/functionIndex.js';
+import { SearchIndex } from './codeIndex/search.js';
+import { SchemaMigrations, migrateFromLokiJS } from './codeIndex/migrations.js';
+import { MetaStore } from './codeIndex/meta.js';
+import { ProvenanceStore } from './codeIndex/provenance.js';
+import { InferredReceiversStore } from './codeIndex/inferredReceivers.js';
+import { CodeMapIndex } from './codeIndex/codeMap.js';
+import { AnalyzerConfigIndex } from './codeIndex/analyzerConfig.js';
+import { AuditResultsIndex } from './codeIndex/auditResults.js';
+import { WhitelistIndex } from './codeIndex/whitelist.js';
+import { SchemaIndex } from './codeIndex/schema.js';
+import { ProjectTasksIndex } from './codeIndex/projectTasks.js';
+import { ConventionsIndex } from './codeIndex/conventions.js';
+import { RawSqlIndex } from './codeIndex/rawSql.js';
+// Re-exported for the security conformance test (`codeIndexDB-security.spec.ts`);
+// the implementations live in `codeIndex/shared.ts` so every extracted module and
+// the facade share one copy instead of drifting.
+export { assertSqlIdentifier, escapeRegExpLiteral } from './codeIndex/shared.js';
+export { DB_BUSY_TIMEOUT_MS };
 // ── Path containment ─────────────────────────────────────────────────────
 /** True when `filePath` is `root` itself or a descendant of `root` (not outside it). */
 function isPathUnderRoot(root, filePath) {
     const rel = path.relative(root, filePath);
     return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
 }
-const SQL_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Reject a value that is not a plain SQL identifier. Table and column names are
- *  interpolated into SQL (SQLite cannot parameterize identifiers), so a value that
- *  fails this check is a would-be injection surface and is refused, never run. */
-export function assertSqlIdentifier(name, context) {
-    if (!SQL_IDENTIFIER_RE.test(name)) {
-        throw new Error(`invalid SQL identifier in ${context}: ${JSON.stringify(name)}`);
-    }
-}
-/** Escape regex metacharacters so a string matches itself literally. */
-export function escapeRegExpLiteral(s) {
-    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-class SqliteCollectionAdapter {
-    db;
-    tableName;
-    constructor(db, tableName) {
-        this.db = db;
-        this.tableName = tableName;
-        assertSqlIdentifier(this.tableName, 'table name');
-    }
-    /** Return all rows, or rows matching the query. */
-    find(query) {
-        if (!query) {
-            return this.db.prepare(`SELECT *, rowid as "$loki" FROM "${this.tableName}"`).all()
-                .map(r => this.unbindRow(r));
-        }
-        const clauses = [];
-        const params = {};
-        for (const [key, value] of Object.entries(query)) {
-            if (key !== '$loki')
-                assertSqlIdentifier(key, 'column name');
-            if (value === null || value === undefined) {
-                clauses.push(`"${key}" IS NULL`);
-            }
-            else if (key === '$loki' && typeof value === 'object' && value.$in) {
-                // Handle $loki: { $in: [...] }
-                const placeholders = value.$in.map((_, i) => `@in_${i}`);
-                clauses.push(`rowid IN (${placeholders.join(', ')})`);
-                value.$in.forEach((v, i) => { params[`in_${i}`] = this.bindable(v); });
-            }
-            else if (key === 'expiresAt' && typeof value === 'object' && value.$lt) {
-                clauses.push(`"expiresAt" < @expiresAt`);
-                params['expiresAt'] = value.$lt instanceof Date ? value.$lt.toISOString() : String(value.$lt);
-            }
-            else if (key === 'timestamp' && typeof value === 'object' && value.$lt) {
-                clauses.push(`"timestamp" < @timestamp`);
-                params['timestamp'] = value.$lt instanceof Date ? value.$lt.toISOString() : String(value.$lt);
-            }
-            else {
-                clauses.push(`"${key}" = @${key}`);
-                params[key] = this.bindable(value);
-            }
-        }
-        const sql = `SELECT *, rowid as "$loki" FROM "${this.tableName}"${clauses.length ? ' WHERE ' + clauses.join(' AND ') : ''}`;
-        return this.db.prepare(sql).all(params).map(r => this.unbindRow(r));
-    }
-    findOne(query) {
-        const clauses = [];
-        const params = {};
-        for (const [key, value] of Object.entries(query)) {
-            if (key !== '$loki')
-                assertSqlIdentifier(key, 'column name');
-            if (value === null || value === undefined) {
-                clauses.push(`"${key}" IS NULL`);
-            }
-            else {
-                clauses.push(`"${key}" = @${key}`);
-                params[key] = this.bindable(value);
-            }
-        }
-        const sql = `SELECT *, rowid as "$loki" FROM "${this.tableName}"${clauses.length ? ' WHERE ' + clauses.join(' AND ') : ''} LIMIT 1`;
-        const row = this.db.prepare(sql).get(params) ?? null;
-        return row ? this.unbindRow(row) : null;
-    }
-    /** Convert a doc value to something SQLite can bind (primitives + Buffer, null). */
-    bindable(v) {
-        if (v === null || v === undefined)
-            return null;
-        if (typeof v === 'object' && !Buffer.isBuffer(v))
-            return JSON.stringify(v);
-        return v;
-    }
-    /** Try to parse a value that looks like serialized JSON back to its native form. */
-    unbindable(v) {
-        if (typeof v === 'string' && (v.startsWith('[') || v.startsWith('{'))) {
-            try {
-                return JSON.parse(v);
-            }
-            catch { /* not JSON, leave as string */ }
-        }
-        return v;
-    }
-    unbindRow(row) {
-        if (!row)
-            return row;
-        const out = {};
-        for (const [k, v] of Object.entries(row)) {
-            out[k] = this.unbindable(v);
-        }
-        return out;
-    }
-    insert(doc) {
-        const keys = Object.keys(doc);
-        for (const k of keys)
-            assertSqlIdentifier(k, 'column name');
-        const vals = keys.map(k => `@${k}`);
-        const sql = `INSERT INTO "${this.tableName}" ("${keys.join('", "')}") VALUES (${vals.join(', ')})`;
-        const params = {};
-        for (const k of keys)
-            params[k] = this.bindable(doc[k]);
-        const info = this.db.prepare(sql).run(params);
-        return { ...doc, $loki: Number(info.lastInsertRowid) };
-    }
-    update(doc) {
-        const keys = Object.keys(doc).filter(k => k !== '$loki' && k !== 'meta');
-        for (const k of keys)
-            assertSqlIdentifier(k, 'column name');
-        const sets = keys.map(k => `"${k}" = @${k}`);
-        const params = {};
-        for (const k of keys)
-            params[k] = this.bindable(doc[k]);
-        params['_rowid'] = doc.$loki;
-        this.db.prepare(`UPDATE "${this.tableName}" SET ${sets.join(', ')} WHERE rowid = @_rowid`).run(params);
-    }
-    remove(doc) {
-        if (doc.$loki !== undefined) {
-            this.db.prepare(`DELETE FROM "${this.tableName}" WHERE rowid = @_rowid`).run({ _rowid: doc.$loki });
-        }
-    }
-    /** Remove all rows matching a query. */
-    findAndRemove(query) {
-        const clauses = [];
-        const params = {};
-        for (const [key, value] of Object.entries(query)) {
-            if (key !== '$loki')
-                assertSqlIdentifier(key, 'column name');
-            if (value === null || value === undefined) {
-                clauses.push(`"${key}" IS NULL`);
-            }
-            else if (key === 'timestamp' && typeof value === 'object' && value.$lt) {
-                clauses.push(`"timestamp" < @timestamp`);
-                params['timestamp'] = value.$lt instanceof Date ? value.$lt.toISOString() : String(value.$lt);
-            }
-            else {
-                clauses.push(`"${key}" = @${key}`);
-                params[key] = value;
-            }
-        }
-        this.db.prepare(`DELETE FROM "${this.tableName}"${clauses.length ? ' WHERE ' + clauses.join(' AND ') : ''}`).run(params);
-    }
-    clear() {
-        this.db.prepare(`DELETE FROM "${this.tableName}"`).run();
-    }
-    chain() {
-        return {
-            _table: this.tableName,
-            _db: this.db,
-            _query: null,
-            _result: null,
-            find(query) {
-                this._query = query ?? null;
-                return this;
-            },
-            where(fn) {
-                if (this._result === null) {
-                    this._result = this._query !== null
-                        ? new SqliteCollectionAdapter(this._db, this._table).find(this._query)
-                        : new SqliteCollectionAdapter(this._db, this._table).find();
-                }
-                this._result = this._result.filter(fn);
-                return this;
-            },
-            simplesort(field, opts = {}) {
-                if (this._result === null) {
-                    this._result = this._query !== null
-                        ? new SqliteCollectionAdapter(this._db, this._table).find(this._query)
-                        : new SqliteCollectionAdapter(this._db, this._table).find();
-                }
-                this._result.sort((a, b) => {
-                    const av = a[field] ?? '';
-                    const bv = b[field] ?? '';
-                    if (av < bv)
-                        return opts.desc ? 1 : -1;
-                    if (av > bv)
-                        return opts.desc ? -1 : 1;
-                    return 0;
-                });
-                return this;
-            },
-            limit(n) {
-                if (this._result === null) {
-                    this._result = this._query !== null
-                        ? new SqliteCollectionAdapter(this._db, this._table).find(this._query)
-                        : new SqliteCollectionAdapter(this._db, this._table).find();
-                }
-                this._result = this._result.slice(0, n);
-                return this;
-            },
-            data() {
-                return this._result ?? [];
-            }
-        };
-    }
-}
+// ── Hoisted SQL / identifier constants ─────────────────────────────────
+const PRAGMA_JOURNAL_WAL = 'journal_mode = WAL';
+const PRAGMA_FOREIGN_KEYS_ON = 'foreign_keys = ON';
+const SQL_DISTINCT_FILE_PATHS = 'SELECT DISTINCT file_path FROM functions';
+const SQL_DELETE_FUNCTIONS_IN_FILEPATHS = 'DELETE FROM functions WHERE file_path IN (SELECT value FROM json_each(?))';
 // ── Main class ──────────────────────────────────────────────────────────
+/**
+ * SQLite-backed code index for a single project. Connection owner and
+ * transaction boundary; storage concerns live on the public module fields
+ * (`functionIndex`, `search`, `coverage`, `graph`, `whitelist`, `schema`,
+ * `projectTasks`, `meta`, …) and cross-concern orchestration stays here.
+ */
 export class CodeIndexDB {
     static instance;
     /** Subclasses (e.g. EnhancedCodeIndexDB) need access for extra tables without `as any`. */
@@ -257,31 +75,51 @@ export class CodeIndexDB {
      *  *cause* (e.g. missing better-sqlite3 binding) instead of the generic
      *  "Database not initialized". Cleared on success and on close(). */
     initFailure = null;
-    // Collection adapters (preserve naming for internal clarity)
-    functionsAdapter;
-    whitelistAdapter;
-    auditResultsAdapter;
-    analyzerConfigAdapter;
-    codeMapAdapter;
-    schemaAdapter;
-    schemaUsageAdapter;
-    tasksAdapter;
-    conventionsAdapter;
-    fileChurnAdapter;
-    functionChurnAdapter;
-    pairHistoryAdapter;
-    hotspotScoresAdapter;
-    graphCacheAdapter;
-    taskRepository = null;
-    stmts = new Map();
+    // ── Concern modules (public fields — assigned in initializeInternal) ──
+    migrations;
+    functionIndex;
+    search;
+    coverage;
+    graph;
+    meta;
+    provenance;
+    inferredReceivers;
+    codeMap;
+    analyzerConfig;
+    auditResults;
+    whitelist;
+    schema;
+    projectTasks;
+    conventions;
+    rawSql;
+    /**
+     * Read-only facade analyzers consume — the raw-SQL, meta, and coverage
+     * concerns composed into the `IndexHandle` contract. Built once at
+     * initialization; a plain object field (not delegator methods), so it adds
+     * nothing to `solid/class-size`.
+     */
+    indexHandle;
     // ── Schema version ──────────────────────────────────────────────────
-    static SCHEMA_VERSION = 16;
+    static SCHEMA_VERSION = 19;
+    /**
+     * Create an index handle for the given SQLite file (in-memory by default).
+     *
+     * @param dbPath - Path to the SQLite database file, or ':memory:'.
+     */
     constructor(dbPath = ':memory:') {
         this.dbPath = dbPath === ':memory:' ? dbPath : path.resolve(dbPath);
     }
     // ── Singleton ───────────────────────────────────────────────────────
     /** The project root this singleton was opened for (used for mismatch detection). */
     static currentProjectRoot;
+    /**
+     * Return the process-wide singleton, reopening the store when the requested
+     * path differs from the one currently open.
+     *
+     * @param dbPath - Optional explicit database file path.
+     * @param projectRoot - The project root the store is scoped to.
+     * @returns The singleton index instance.
+     */
     static getInstance(dbPath, projectRoot) {
         let resolved;
         if (dbPath !== undefined && dbPath !== '') {
@@ -330,6 +168,12 @@ export class CodeIndexDB {
         return CodeIndexDB.currentProjectRoot;
     }
     // ── Lifecycle ───────────────────────────────────────────────────────
+    /**
+     * Initialize the database schema and adapters once, memoized via a shared
+     * promise so concurrent callers await the same initialization.
+     *
+     * @returns A promise that resolves once initialization completes.
+     */
     async initialize() {
         if (this.isInitialized)
             return;
@@ -381,17 +225,17 @@ export class CodeIndexDB {
                     throw e;
                 const code = getErrnoCode(e);
                 throw new ContextualError(`Failed to prepare code index storage: ${e instanceof Error ? e.message : String(e)}`, { ...(code && { errnoCode: code }), storageRoot, dbPath: this.dbPath,
-                    hint: 'Ensure the storage directory is writable (default: <node_modules>/.cache/code-auditor when CODE_AUDITOR_DATA_DIR is unset).' }, e instanceof Error ? e : undefined);
+                    hint: 'Ensure the storage directory is writable (default: a user-level OS cache dir when CODE_AUDITOR_DATA_DIR is unset).' }, e instanceof Error ? e : undefined);
             }
         }
         // Check for LokiJS migration
-        const migrationResult = this.maybeMigrateFromLokiJS();
+        const migrationResult = migrateFromLokiJS(this.dbPath);
         // Open SQLite database (with auto-recovery for corrupted files)
         let retried = false;
         try {
             this.db = openSqlite(this.dbPath, { timeoutMs: DB_BUSY_TIMEOUT_MS });
-            this.db.pragma('journal_mode = WAL');
-            this.db.pragma('foreign_keys = ON');
+            this.db.pragma(PRAGMA_JOURNAL_WAL);
+            this.db.pragma(PRAGMA_FOREIGN_KEYS_ON);
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
@@ -410,8 +254,8 @@ export class CodeIndexDB {
                 }
                 catch { /* ignore */ }
                 this.db = openSqlite(this.dbPath, { timeoutMs: DB_BUSY_TIMEOUT_MS });
-                this.db.pragma('journal_mode = WAL');
-                this.db.pragma('foreign_keys = ON');
+                this.db.pragma(PRAGMA_JOURNAL_WAL);
+                this.db.pragma(PRAGMA_FOREIGN_KEYS_ON);
             }
             else {
                 const code = getErrnoCode(e);
@@ -420,26 +264,41 @@ export class CodeIndexDB {
             }
         }
         // Create schema
-        this.createSchema();
-        // Initialize collection adapters
-        this.functionsAdapter = new SqliteCollectionAdapter(this.db, 'functions');
-        this.whitelistAdapter = new SqliteCollectionAdapter(this.db, 'whitelist');
-        this.auditResultsAdapter = new SqliteCollectionAdapter(this.db, 'audit_results');
-        this.analyzerConfigAdapter = new SqliteCollectionAdapter(this.db, 'analyzer_configs');
-        this.codeMapAdapter = new SqliteCollectionAdapter(this.db, 'code_maps');
-        this.schemaAdapter = new SqliteCollectionAdapter(this.db, 'schema_definitions');
-        this.schemaUsageAdapter = new SqliteCollectionAdapter(this.db, 'schema_usage');
-        this.tasksAdapter = new SqliteCollectionAdapter(this.db, 'project_tasks');
-        this.conventionsAdapter = new SqliteCollectionAdapter(this.db, 'conventions');
-        this.fileChurnAdapter = new SqliteCollectionAdapter(this.db, 'file_churn');
-        this.functionChurnAdapter = new SqliteCollectionAdapter(this.db, 'function_churn');
-        this.pairHistoryAdapter = new SqliteCollectionAdapter(this.db, 'dry_pair_history');
-        this.hotspotScoresAdapter = new SqliteCollectionAdapter(this.db, 'hotspot_scores');
-        this.graphCacheAdapter = new SqliteCollectionAdapter(this.db, 'graph_cache');
+        this.migrations = new SchemaMigrations(this.db);
+        this.migrations.createSchema(CodeIndexDB.SCHEMA_VERSION);
+        // Construct concern modules against the shared handle.
+        this.functionIndex = new FunctionIndex(this.db);
+        this.search = new SearchIndex(this.db, this.functionIndex);
+        this.coverage = new CoverageIndex(this.db);
+        this.graph = new DependencyGraphIndex(this.db);
+        this.meta = new MetaStore(this.db);
+        this.provenance = new ProvenanceStore(this.db);
+        this.inferredReceivers = new InferredReceiversStore(this.db);
+        this.codeMap = new CodeMapIndex(this.db);
+        this.analyzerConfig = new AnalyzerConfigIndex(this.db);
+        this.auditResults = new AuditResultsIndex(this.db);
+        this.whitelist = new WhitelistIndex(this.db);
+        this.schema = new SchemaIndex(this.db);
+        this.projectTasks = new ProjectTasksIndex(this.db);
+        this.conventions = new ConventionsIndex(this.db);
+        this.rawSql = new RawSqlIndex(this.db);
+        // Compose the read-only analyzer facade from the raw-SQL, meta, and
+        // coverage modules. This is the same shape the detached-audit runner builds
+        // inline; keeping it here gives every consumer one source of truth.
+        this.indexHandle = {
+            query: (sql, params) => this.rawSql.query(sql, params),
+            count: (table) => this.rawSql.count(table),
+            tableHasRows: (table) => this.rawSql.tableHasRows(table),
+            run: (sql, params) => this.rawSql.run(sql, params),
+            exec: (sql) => this.rawSql.exec(sql),
+            getMeta: (key) => this.meta.getMeta(key),
+            getUntestedTopDecile: (decile) => this.coverage.getUntestedTopDecile(decile),
+            rawDb: this.db,
+        };
         // Init defaults
         const whitelistCount = this.db.prepare('SELECT COUNT(*) as cnt FROM whitelist').get().cnt;
         if (whitelistCount === 0) {
-            await this.initializeDefaultWhitelists();
+            await this.whitelist.initializeDefaultWhitelists();
         }
         // Auto-sync if we just migrated
         if (migrationResult.migrated) {
@@ -456,1028 +315,6 @@ export class CodeIndexDB {
         this.isInitialized = true;
         this.initFailure = null;
     }
-    // ── Schema migrations ────────────────────────────────────────────────
-    runMigrations() {
-        // Read the currently stored schema version (if any)
-        const row = this.db.prepare("SELECT value FROM meta WHERE key = 'schema_version'").get();
-        const currentVersion = row ? parseInt(row.value, 10) : 0;
-        // Migration 1 → 2: Unique index on (name, file_path, line_number)
-        // Previously the unique index was on (name, file_path) only, which caused
-        // same-named functions at different lines in the same file to collide.
-        if (currentVersion < 2) {
-            this.db.exec(`
-        DROP INDEX IF EXISTS idx_functions_name_file;
-        CREATE UNIQUE INDEX IF NOT EXISTS idx_functions_name_file_line ON functions(name, file_path, line_number);
-      `);
-        }
-        // Migration 2 → 3: Style intelligence tables (Spec 10)
-        if (currentVersion < 3) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS style_declarations (
-          id              INTEGER PRIMARY KEY AUTOINCREMENT,
-          property        TEXT NOT NULL,
-          raw_value       TEXT NOT NULL,
-          normalized_value TEXT,
-          mechanism       TEXT NOT NULL,
-          file_path       TEXT NOT NULL,
-          line            INTEGER NOT NULL,
-          context         TEXT,
-          variant_context TEXT,
-          token_ref       TEXT,
-          content_hash    TEXT,
-          created_at      TEXT DEFAULT (datetime('now'))
-        );
-        CREATE INDEX IF NOT EXISTS idx_style_decls_property   ON style_declarations(property);
-        CREATE INDEX IF NOT EXISTS idx_style_decls_mechanism  ON style_declarations(mechanism);
-        CREATE INDEX IF NOT EXISTS idx_style_decls_file_path  ON style_declarations(file_path);
-        CREATE INDEX IF NOT EXISTS idx_style_decls_token_ref  ON style_declarations(token_ref);
-        CREATE INDEX IF NOT EXISTS idx_style_decls_content_hash ON style_declarations(content_hash);
-
-        CREATE VIRTUAL TABLE IF NOT EXISTS style_declarations_fts USING fts5(
-          property, raw_value, normalized_value,
-          content='style_declarations', content_rowid='id',
-          tokenize='porter unicode61'
-        );
-
-        CREATE TABLE IF NOT EXISTS style_tokens (
-          id         INTEGER PRIMARY KEY AUTOINCREMENT,
-          name       TEXT NOT NULL,
-          value      TEXT NOT NULL,
-          file_path  TEXT NOT NULL,
-          mechanism  TEXT NOT NULL,
-          created_at TEXT DEFAULT (datetime('now'))
-        );
-        CREATE INDEX IF NOT EXISTS idx_style_tokens_name ON style_tokens(name);
-
-        CREATE TABLE IF NOT EXISTS style_class_usage (
-          id           INTEGER PRIMARY KEY AUTOINCREMENT,
-          class_name   TEXT NOT NULL,
-          file_path    TEXT NOT NULL,
-          line         INTEGER NOT NULL,
-          mechanism    TEXT NOT NULL,
-          unresolvable INTEGER DEFAULT 0,
-          created_at   TEXT DEFAULT (datetime('now'))
-        );
-        CREATE INDEX IF NOT EXISTS idx_style_class_usage_name   ON style_class_usage(class_name);
-        CREATE INDEX IF NOT EXISTS idx_style_class_usage_file   ON style_class_usage(file_path);
-        CREATE INDEX IF NOT EXISTS idx_style_class_usage_unres  ON style_class_usage(unresolvable);
-      `);
-        }
-        // Migration 3 → 4: Convention mining tables (Spec 12)
-        if (currentVersion < 4) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS conventions (
-          id INTEGER PRIMARY KEY AUTOINCREMENT,
-          domain TEXT NOT NULL,
-          rule_id TEXT NOT NULL,
-          antecedent TEXT,
-          consequent TEXT,
-          pattern TEXT,
-          directory TEXT,
-          file_path TEXT,
-          line INTEGER,
-          support INTEGER DEFAULT 0,
-          total_cases INTEGER DEFAULT 0,
-          confidence REAL DEFAULT 0,
-          exemplar_file TEXT,
-          exemplar_line INTEGER,
-          hash TEXT,
-          created_at TEXT DEFAULT (datetime('now'))
-        );
-        CREATE INDEX IF NOT EXISTS idx_conv_domain ON conventions(domain);
-        CREATE INDEX IF NOT EXISTS idx_conv_rule_id ON conventions(rule_id);
-        CREATE INDEX IF NOT EXISTS idx_conv_directory ON conventions(directory);
-        CREATE INDEX IF NOT EXISTS idx_conv_hash ON conventions(hash);
-      `);
-        }
-        // Migration 4 → 5: Hotspots & temporal analysis (Spec 13)
-        if (currentVersion < 5) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS file_churn (
-          file_path            TEXT PRIMARY KEY,
-          commit_count         INTEGER NOT NULL DEFAULT 0,
-          lines_added          INTEGER NOT NULL DEFAULT 0,
-          lines_deleted        INTEGER NOT NULL DEFAULT 0,
-          distinct_authors     INTEGER NOT NULL DEFAULT 0,
-          dominant_author      TEXT,
-          dominant_author_share REAL DEFAULT 0,
-          last_touched         TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_file_churn_cc ON file_churn(commit_count);
-
-        CREATE TABLE IF NOT EXISTS function_churn (
-          id                   INTEGER PRIMARY KEY AUTOINCREMENT,
-          function_id          INTEGER REFERENCES functions(id) ON DELETE CASCADE,
-          function_name        TEXT NOT NULL,
-          file_path            TEXT NOT NULL,
-          commit_count         INTEGER NOT NULL DEFAULT 0,
-          distinct_authors     INTEGER NOT NULL DEFAULT 0,
-          dominant_author      TEXT,
-          dominant_author_share REAL DEFAULT 0,
-          renamed              INTEGER DEFAULT 0,
-          confidence           REAL DEFAULT 1.0
-        );
-        CREATE INDEX IF NOT EXISTS idx_func_churn_fid ON function_churn(function_id);
-
-        CREATE TABLE IF NOT EXISTS hotspot_scores (
-          target       TEXT PRIMARY KEY,
-          type         TEXT NOT NULL,
-          score        REAL NOT NULL DEFAULT 0,
-          churn_pct    REAL NOT NULL DEFAULT 0,
-          complexity_pct REAL NOT NULL DEFAULT 0,
-          commit_count INTEGER NOT NULL DEFAULT 0,
-          distinct_authors INTEGER NOT NULL DEFAULT 0,
-          dominant_author TEXT,
-          dominant_author_share REAL DEFAULT 0,
-          bus_factor_risk INTEGER DEFAULT 0,
-          complexity   INTEGER NOT NULL DEFAULT 0,
-          updated_at   TEXT DEFAULT (datetime('now'))
-        );
-        CREATE INDEX IF NOT EXISTS idx_hotspot_scores_score ON hotspot_scores(score DESC);
-
-        CREATE TABLE IF NOT EXISTS dry_pair_history (
-          id              INTEGER PRIMARY KEY AUTOINCREMENT,
-          pair_fingerprint TEXT NOT NULL,
-          file1           TEXT NOT NULL,
-          symbol1         TEXT,
-          line1           INTEGER NOT NULL,
-          content_hash1   TEXT NOT NULL,
-          file2           TEXT NOT NULL,
-          symbol2         TEXT,
-          line2           INTEGER NOT NULL,
-          content_hash2   TEXT NOT NULL,
-          similarity      REAL NOT NULL,
-          timestamp       TEXT DEFAULT (datetime('now')),
-          run_id          TEXT NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_dph_fingerprint ON dry_pair_history(pair_fingerprint);
-        CREATE INDEX IF NOT EXISTS idx_dph_run ON dry_pair_history(run_id);
-      `);
-        }
-        // Migration 5 → 6: Graph cache for call/import graph construction (Spec 14)
-        if (currentVersion < 6) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS graph_cache (
-          graph_type   TEXT NOT NULL,
-          node_key     TEXT NOT NULL,
-          neighbor_key TEXT NOT NULL,
-          weight       REAL NOT NULL,
-          PRIMARY KEY (graph_type, node_key, neighbor_key)
-        );
-        CREATE INDEX IF NOT EXISTS idx_gc_type_node ON graph_cache(graph_type, node_key);
-        CREATE INDEX IF NOT EXISTS idx_gc_type_neighbor ON graph_cache(graph_type, neighbor_key);
-      `);
-        }
-        // Migration 6 → 7: Coverage data for cross-domain analysis (Spec 15)
-        if (currentVersion < 7) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS coverage_data (
-          id            INTEGER PRIMARY KEY AUTOINCREMENT,
-          function_name TEXT NOT NULL,
-          file_path     TEXT NOT NULL,
-          line_number   INTEGER,
-          basis         TEXT NOT NULL DEFAULT 'static-reach',
-          covered       INTEGER NOT NULL DEFAULT 0,
-          source        TEXT,
-          imported_at   TEXT DEFAULT (datetime('now')),
-          UNIQUE(function_name, file_path, line_number)
-        );
-        CREATE INDEX IF NOT EXISTS idx_cov_basis ON coverage_data(basis);
-        CREATE INDEX IF NOT EXISTS idx_cov_covered ON coverage_data(covered);
-        CREATE INDEX IF NOT EXISTS idx_cov_function ON coverage_data(function_name);
-      `);
-        }
-        // Migration 7 → 8: export_kind on conventions (Spec 22 R5.1)
-        if (currentVersion < 8) {
-            const cols = this.db
-                .prepare(`PRAGMA table_info('conventions')`)
-                .all();
-            if (!cols.some((c) => c.name === 'export_kind')) {
-                this.db.exec(`ALTER TABLE conventions ADD COLUMN export_kind TEXT`);
-            }
-        }
-        // Migration 8 → 9: Detached-run lifecycle + queryable coverage (Spec 41).
-        // `findings_ledger_runs` gains the job-lifecycle columns (status, timing,
-        // provenance, lease heartbeat, progress, stderr log); the one genuinely new
-        // table is `findings_ledger_coverage` (per-rule state + reason rows that
-        // `writeAuditToLedger` previously dropped).
-        if (currentVersion < 9) {
-            const runCols = this.db
-                .prepare(`PRAGMA table_info('findings_ledger_runs')`)
-                .all();
-            const hasRunCol = (name) => runCols.some((c) => c.name === name);
-            const newRunCols = [
-                ['status', "TEXT NOT NULL DEFAULT 'completed'"],
-                ['project_root', 'TEXT'],
-                ['started_at', 'TEXT'],
-                ['heartbeat_at', 'TEXT'],
-                ['finished_at', 'TEXT'],
-                ['error', 'TEXT'],
-                ['progress_json', 'TEXT'],
-                ['stderr_log', 'TEXT'],
-                ['content_hash', 'TEXT'],
-                ['files_count', 'INTEGER'],
-                ['file_manifest_json', 'TEXT'],
-            ];
-            for (const [name, decl] of newRunCols) {
-                if (!hasRunCol(name)) {
-                    this.db.exec(`ALTER TABLE findings_ledger_runs ADD COLUMN ${name} ${decl}`);
-                }
-            }
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS findings_ledger_coverage (
-          run_id    TEXT NOT NULL REFERENCES findings_ledger_runs(run_id) ON DELETE CASCADE,
-          analyzer  TEXT NOT NULL,
-          rule_id   TEXT NOT NULL,
-          state     TEXT NOT NULL,
-          count     INTEGER NOT NULL DEFAULT 0,
-          reason    TEXT,
-          PRIMARY KEY (run_id, analyzer, rule_id)
-        );
-        CREATE INDEX IF NOT EXISTS idx_ledger_coverage_run ON findings_ledger_coverage(run_id);
-      `);
-        }
-        // Migration 9 → 10: PID-based lease liveness (Spec 41 Amendment B).
-        // The heartbeat is no longer the primary liveness signal for the common
-        // case (a healthy child whose synchronous `syncFileIndex` phase starves the
-        // event loop, so its heartbeat interval cannot fire). The child records its
-        // PID + process start time + hostname at lease claim; `reclaimStaleRunning`
-        // then skips any `running` row whose PID is still the same live process, and
-        // only reclaims when the process is genuinely gone (or on a foreign host,
-        // where the PID means nothing and the heartbeat stays the fallback).
-        if (currentVersion < 10) {
-            const runCols = this.db
-                .prepare(`PRAGMA table_info('findings_ledger_runs')`)
-                .all();
-            const hasRunCol = (name) => runCols.some((c) => c.name === name);
-            const newRunCols = [
-                ['runner_pid', 'INTEGER'],
-                ['runner_pid_started_at', 'TEXT'],
-                ['runner_host', 'TEXT'],
-            ];
-            for (const [name, decl] of newRunCols) {
-                if (!hasRunCol(name)) {
-                    this.db.exec(`ALTER TABLE findings_ledger_runs ADD COLUMN ${name} ${decl}`);
-                }
-            }
-        }
-        // Migration 10 → 11: unread stylesheet sources (Spec 45 R5).
-        // Records stylesheets whose dialect the style indexer cannot read, so
-        // styles/undefined-class findings can carry them as incomplete-definition
-        // context instead of asserting a class is undefined against the whole project.
-        if (currentVersion < 11) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS style_unread_sources (
-          id         INTEGER PRIMARY KEY AUTOINCREMENT,
-          file_path  TEXT NOT NULL UNIQUE,
-          reason     TEXT NOT NULL,
-          created_at TEXT DEFAULT (datetime('now'))
-        );
-      `);
-        }
-        // Migration 11 → 12: defined-class catalog (Spec 45 — styles/undefined-class).
-        // A dedicated (class_name, file_path) table so the undefined-class detector
-        // can resolve a class name with an indexed `class_name IN (...)` lookup
-        // instead of loading every style_declarations row and regex-extracting
-        // selectors from `context` in JS. Populated by the style indexer on insert;
-        // backfilled here once so an in-place upgrade does not leave the catalog
-        // empty (unchanged-file hashing would otherwise skip the re-extract).
-        if (currentVersion < 12) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS style_defined_classes (
-          id         INTEGER PRIMARY KEY AUTOINCREMENT,
-          class_name TEXT NOT NULL,
-          file_path  TEXT NOT NULL,
-          created_at TEXT DEFAULT (datetime('now')),
-          UNIQUE(class_name, file_path)
-        );
-        CREATE INDEX IF NOT EXISTS idx_style_defined_class_name ON style_defined_classes(class_name);
-      `);
-            const definedRows = this.db
-                .prepare('SELECT DISTINCT context, file_path FROM style_declarations WHERE context IS NOT NULL')
-                .all();
-            const insertDefined = this.db.prepare('INSERT OR IGNORE INTO style_defined_classes (class_name, file_path) VALUES (?, ?)');
-            const backfill = this.db.transaction(() => {
-                for (const r of definedRows) {
-                    for (const m of r.context.matchAll(/\.([a-zA-Z0-9_-]+)/g)) {
-                        insertDefined.run(m[1], r.file_path);
-                    }
-                }
-            });
-            backfill();
-        }
-        // Migration 12 → 13: import_specifiers (Spec 60 — import classification at
-        // emission). One row per static import specifier occurrence, classified
-        // package / unresolved-alias / internal-resolved / internal-broken /
-        // unresolved-virtual (Spec 60.1 widened the three-class scheme to five;
-        // `classification` is free TEXT, no constraint, so no further migration).
-        // Nothing consumes it yet (Spec 61 persists edges; Spec 62 derives coverage).
-        // Flat — resolved_path inline, no lookup table, no join.
-        if (currentVersion < 13) {
-            this.db.exec(`
-        CREATE TABLE IF NOT EXISTS import_specifiers (
-          file_path       TEXT NOT NULL,
-          specifier       TEXT NOT NULL,
-          classification  TEXT NOT NULL,
-          resolved_path   TEXT,
-          line            INTEGER,
-          PRIMARY KEY (file_path, specifier, line)
-        );
-        CREATE INDEX IF NOT EXISTS idx_import_specifiers_class ON import_specifiers(classification);
-        CREATE INDEX IF NOT EXISTS idx_import_specifiers_resolved ON import_specifiers(resolved_path);
-      `);
-        }
-        // Migration 13 → 14: schema_usage identity becomes a coordinate (Spec 61
-        // Amendment A). function_name stops holding source text and becomes the
-        // nullable display name (null for anonymous handlers); identity is the
-        // inline (file_path, function_start_line, function_start_column) coordinate.
-        // function_name drops its NOT NULL so anonymous handlers store NULL, distinct
-        // from 'top-level' (function_start_line IS NULL). Old rows keep their
-        // (now-legacy) names but are regenerated on the next per-file sync.
-        if (currentVersion < 14) {
-            const suCols = this.db
-                .prepare(`PRAGMA table_info('schema_usage')`)
-                .all();
-            if (!suCols.some((c) => c.name === 'function_start_line')) {
-                this.db.exec(`
-          ALTER TABLE schema_usage RENAME TO schema_usage_old;
-          CREATE TABLE schema_usage (
-            id            INTEGER PRIMARY KEY AUTOINCREMENT,
-            schema_id     TEXT,
-            table_name    TEXT NOT NULL,
-            file_path     TEXT NOT NULL,
-            function_name TEXT,
-            function_start_line   INTEGER,
-            function_start_column INTEGER,
-            usage_type    TEXT NOT NULL,
-            line          INTEGER,
-            "column"      INTEGER,
-            raw_query     TEXT,
-            parameters    TEXT,
-            origin        TEXT,
-            recorded_at   TEXT DEFAULT (datetime('now'))
-          );
-          INSERT INTO schema_usage (id, schema_id, table_name, file_path, function_name, usage_type, line, "column", raw_query, parameters, recorded_at)
-            SELECT id, schema_id, table_name, file_path, function_name, usage_type, line, "column", raw_query, parameters, recorded_at FROM schema_usage_old;
-          DROP TABLE schema_usage_old;
-          CREATE INDEX IF NOT EXISTS idx_schema_usage_table ON schema_usage(table_name);
-          CREATE INDEX IF NOT EXISTS idx_schema_usage_file ON schema_usage(file_path);
-          CREATE INDEX IF NOT EXISTS idx_schema_usage_function ON schema_usage(function_name);
-          CREATE INDEX IF NOT EXISTS idx_schema_usage_usage_type ON schema_usage(usage_type);
-        `);
-            }
-        }
-        // Migration 14 → 15: tool's own git sha on the run (the second axis next to
-        // tool_version). `git_sha` already records the *audited project* commit; this
-        // records the *code-auditor* commit so a count change is attributable to a
-        // tool commit, not just a version. NULL when running from a published
-        // install (no .git) — best-effort, and tool_version stays always-present.
-        if (currentVersion < 15) {
-            const runCols = this.db
-                .prepare(`PRAGMA table_info('findings_ledger_runs')`)
-                .all();
-            if (!runCols.some((c) => c.name === 'tool_git_sha')) {
-                this.db.exec(`ALTER TABLE findings_ledger_runs ADD COLUMN tool_git_sha TEXT`);
-            }
-        }
-        // Migration 15 → 16: schema_usage gains an `origin` column. Rows produced by
-        // the knex-style fluent-builder read extractor carry `origin = 'query-builder'`;
-        // every other extractor (raw SQL, tagged template, .sql, ORM) leaves it NULL.
-        // The cross-domain lifecycle rules use it to exempt tables whose usage is
-        // entirely query-builder — scratch/test tables built and consumed through the
-        // fluent builder are not one-sided lifecycle defects.
-        if (currentVersion < 16) {
-            const suCols = this.db
-                .prepare(`PRAGMA table_info('schema_usage')`)
-                .all();
-            if (!suCols.some((c) => c.name === 'origin')) {
-                this.db.exec(`ALTER TABLE schema_usage ADD COLUMN origin TEXT`);
-            }
-        }
-    }
-    // ── SQLite schema ───────────────────────────────────────────────────
-    createSchema() {
-        this.db.exec(`
-      CREATE TABLE IF NOT EXISTS meta (
-        key    TEXT PRIMARY KEY,
-        value  TEXT NOT NULL
-      );
-
-      CREATE TABLE IF NOT EXISTS functions (
-        id                INTEGER PRIMARY KEY AUTOINCREMENT,
-        name              TEXT NOT NULL,
-        file_path         TEXT NOT NULL,
-        line_number       INTEGER,
-        start_line        INTEGER,
-        end_line          INTEGER,
-        language          TEXT DEFAULT 'typescript',
-        entity_type       TEXT DEFAULT 'function',
-        component_type    TEXT,
-        signature         TEXT,
-        return_type       TEXT,
-        complexity        INTEGER DEFAULT 0,
-        is_exported       INTEGER DEFAULT 0,
-        has_jsdoc         INTEGER DEFAULT 0,
-        jsdoc_description TEXT,
-        jsdoc_tags        TEXT,
-        parameters        TEXT,
-        type_info         TEXT,
-        hooks             TEXT,
-        props             TEXT,
-        used_imports      TEXT,
-        unused_imports    TEXT,
-        import_usage      TEXT,
-        has_unused_imports INTEGER DEFAULT 0,
-        dependency_depth  INTEGER DEFAULT 0,
-        purpose           TEXT DEFAULT '',
-        context           TEXT DEFAULT '',
-        body              TEXT,
-        content_hash      TEXT,
-        last_modified     TEXT,
-        metadata_json     TEXT,
-        created_at        TEXT DEFAULT (datetime('now')),
-        updated_at        TEXT DEFAULT (datetime('now'))
-      );
-
-      CREATE INDEX IF NOT EXISTS idx_functions_name ON functions(name);
-      CREATE INDEX IF NOT EXISTS idx_functions_file_path ON functions(file_path);
-      CREATE INDEX IF NOT EXISTS idx_functions_language ON functions(language);
-      CREATE INDEX IF NOT EXISTS idx_functions_entity_type ON functions(entity_type);
-      CREATE INDEX IF NOT EXISTS idx_functions_complexity ON functions(complexity);
-      CREATE INDEX IF NOT EXISTS idx_functions_content_hash ON functions(content_hash);
-      CREATE INDEX IF NOT EXISTS idx_functions_is_exported ON functions(is_exported);
-      CREATE UNIQUE INDEX IF NOT EXISTS idx_functions_name_file_line ON functions(name, file_path, line_number);
-
-      CREATE VIRTUAL TABLE IF NOT EXISTS functions_fts USING fts5(
-        name, signature, jsdoc_description, purpose, context, body,
-        content='functions', content_rowid='id',
-        tokenize='porter unicode61'
-      );
-
-      CREATE TRIGGER IF NOT EXISTS functions_ai AFTER INSERT ON functions BEGIN
-        INSERT INTO functions_fts(rowid, name, signature, jsdoc_description, purpose, context, body)
-        VALUES (new.id, new.name, new.signature, new.jsdoc_description, new.purpose, new.context, new.body);
-      END;
-      CREATE TRIGGER IF NOT EXISTS functions_ad AFTER DELETE ON functions BEGIN
-        INSERT INTO functions_fts(functions_fts, rowid, name, signature, jsdoc_description, purpose, context, body)
-        VALUES ('delete', old.id, old.name, old.signature, old.jsdoc_description, old.purpose, old.context, old.body);
-      END;
-      CREATE TRIGGER IF NOT EXISTS functions_au AFTER UPDATE ON functions BEGIN
-        INSERT INTO functions_fts(functions_fts, rowid, name, signature, jsdoc_description, purpose, context, body)
-        VALUES ('delete', old.id, old.name, old.signature, old.jsdoc_description, old.purpose, old.context, old.body);
-        INSERT INTO functions_fts(rowid, name, signature, jsdoc_description, purpose, context, body)
-        VALUES (new.id, new.name, new.signature, new.jsdoc_description, new.purpose, new.context, new.body);
-      END;
-
-      CREATE TABLE IF NOT EXISTS function_calls (
-        caller_id   INTEGER NOT NULL REFERENCES functions(id) ON DELETE CASCADE,
-        callee_name TEXT NOT NULL,
-        PRIMARY KEY (caller_id, callee_name)
-      );
-      CREATE INDEX IF NOT EXISTS idx_function_calls_callee ON function_calls(callee_name);
-
-      CREATE TABLE IF NOT EXISTS function_dependencies (
-        function_id INTEGER NOT NULL REFERENCES functions(id) ON DELETE CASCADE,
-        dependency  TEXT NOT NULL,
-        PRIMARY KEY (function_id, dependency)
-      );
-      CREATE INDEX IF NOT EXISTS idx_function_dependencies_dep ON function_dependencies(dependency);
-
-      CREATE TABLE IF NOT EXISTS whitelist (
-        id           INTEGER PRIMARY KEY AUTOINCREMENT,
-        name         TEXT NOT NULL,
-        type         TEXT NOT NULL,
-        status       TEXT DEFAULT 'Active',
-        category     TEXT,
-        description  TEXT,
-        patterns     TEXT,
-        added_by     TEXT DEFAULT 'system',
-        added_at     TEXT DEFAULT (datetime('now')),
-        updated_at   TEXT,
-        metadata_json TEXT
-      );
-      CREATE INDEX IF NOT EXISTS idx_whitelist_name ON whitelist(name);
-      CREATE INDEX IF NOT EXISTS idx_whitelist_type ON whitelist(type);
-      CREATE INDEX IF NOT EXISTS idx_whitelist_status ON whitelist(status);
-
-      CREATE TABLE IF NOT EXISTS audit_results (
-        audit_id              TEXT PRIMARY KEY,
-        timestamp             TEXT NOT NULL,
-        project_path          TEXT NOT NULL,
-        summary_json          TEXT NOT NULL,
-        analyzer_results_json TEXT NOT NULL,
-        violations_json       TEXT,
-        recommendations_json  TEXT,
-        metadata_json         TEXT,
-        expires_at            TEXT NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS idx_audit_results_timestamp ON audit_results(timestamp);
-      CREATE INDEX IF NOT EXISTS idx_audit_results_project_path ON audit_results(project_path);
-
-      CREATE TABLE IF NOT EXISTS analyzer_configs (
-        id            INTEGER PRIMARY KEY AUTOINCREMENT,
-        analyzer_name TEXT NOT NULL,
-        project_path  TEXT,
-        is_global     INTEGER DEFAULT 0,
-        config_json   TEXT NOT NULL DEFAULT '{}',
-        version       TEXT,
-        created_by    TEXT DEFAULT 'system',
-        created_at    TEXT DEFAULT (datetime('now')),
-        updated_at    TEXT DEFAULT (datetime('now')),
-        metadata_json TEXT
-      );
-      CREATE UNIQUE INDEX IF NOT EXISTS idx_analyzer_configs_key
-        ON analyzer_configs(analyzer_name, COALESCE(project_path, '__global__'), is_global);
-
-      CREATE TABLE IF NOT EXISTS code_maps (
-        map_id        TEXT NOT NULL,
-        section_type  TEXT NOT NULL,
-        content       TEXT NOT NULL,
-        metadata_json TEXT DEFAULT '{}',
-        timestamp     TEXT DEFAULT (datetime('now')),
-        size          INTEGER DEFAULT 0,
-        PRIMARY KEY (map_id, section_type)
-      );
-      CREATE INDEX IF NOT EXISTS idx_code_maps_timestamp ON code_maps(timestamp);
-
-      CREATE TABLE IF NOT EXISTS schema_definitions (
-        schema_id     TEXT PRIMARY KEY,
-        schema_name   TEXT,
-        schema_json   TEXT NOT NULL,
-        metadata_json TEXT,
-        indexed_at    TEXT DEFAULT (datetime('now'))
-      );
-
-      CREATE TABLE IF NOT EXISTS schema_usage (
-        id            INTEGER PRIMARY KEY AUTOINCREMENT,
-        schema_id     TEXT,
-        table_name    TEXT NOT NULL,
-        file_path     TEXT NOT NULL,
-        function_name TEXT,
-        function_start_line   INTEGER,
-        function_start_column INTEGER,
-        usage_type    TEXT NOT NULL,
-        line          INTEGER,
-        "column"      INTEGER,
-        raw_query     TEXT,
-        parameters    TEXT,
-        origin        TEXT,
-        recorded_at   TEXT DEFAULT (datetime('now'))
-      );
-      CREATE INDEX IF NOT EXISTS idx_schema_usage_table ON schema_usage(table_name);
-      CREATE INDEX IF NOT EXISTS idx_schema_usage_file ON schema_usage(file_path);
-      CREATE INDEX IF NOT EXISTS idx_schema_usage_function ON schema_usage(function_name);
-      CREATE INDEX IF NOT EXISTS idx_schema_usage_usage_type ON schema_usage(usage_type);
-
-      CREATE TABLE IF NOT EXISTS coverage_data (
-        id            INTEGER PRIMARY KEY AUTOINCREMENT,
-        function_name TEXT NOT NULL,
-        file_path     TEXT NOT NULL,
-        line_number   INTEGER,
-        basis         TEXT NOT NULL DEFAULT 'static-reach',
-        covered       INTEGER NOT NULL DEFAULT 0,
-        source        TEXT,
-        imported_at   TEXT DEFAULT (datetime('now')),
-        UNIQUE(function_name, file_path, line_number)
-      );
-      CREATE INDEX IF NOT EXISTS idx_cov_basis ON coverage_data(basis);
-      CREATE INDEX IF NOT EXISTS idx_cov_covered ON coverage_data(covered);
-      CREATE INDEX IF NOT EXISTS idx_cov_function ON coverage_data(function_name);
-
-      CREATE TABLE IF NOT EXISTS project_tasks (
-        taskId         TEXT PRIMARY KEY,
-        projectPath    TEXT NOT NULL,
-        title          TEXT NOT NULL,
-        description    TEXT DEFAULT '',
-        status         TEXT DEFAULT 'pending',
-        priority       TEXT DEFAULT 'medium',
-        labels         TEXT DEFAULT '[]',
-        source         TEXT DEFAULT 'manual',
-        parentTaskId   TEXT,
-        blockedBy      TEXT DEFAULT '[]',
-        dueAt          TEXT,
-        sortOrder      INTEGER DEFAULT 0,
-        relatedFiles   TEXT DEFAULT '[]',
-        relatedSymbols TEXT DEFAULT '[]',
-        fingerprint    TEXT,
-        metadata       TEXT DEFAULT '{}',
-        createdAt      TEXT DEFAULT (datetime('now')),
-        updatedAt      TEXT DEFAULT (datetime('now')),
-        completedAt    TEXT
-      );
-      CREATE INDEX IF NOT EXISTS idx_project_tasks_project ON project_tasks(projectPath);
-      CREATE INDEX IF NOT EXISTS idx_project_tasks_status ON project_tasks(status);
-      CREATE INDEX IF NOT EXISTS idx_project_tasks_source ON project_tasks(source);
-      CREATE INDEX IF NOT EXISTS idx_project_tasks_fingerprint ON project_tasks(fingerprint);
-      CREATE INDEX IF NOT EXISTS idx_project_tasks_sort ON project_tasks(sortOrder);
-
-      -- Spec 11 R1 — Findings Ledger: append-only audit history
-      CREATE TABLE IF NOT EXISTS findings_ledger_runs (
-        run_id       TEXT PRIMARY KEY,
-        timestamp    TEXT NOT NULL,
-        git_sha      TEXT,
-        git_dirty    INTEGER NOT NULL DEFAULT 0,
-        tool_version TEXT NOT NULL,
-        tool_git_sha TEXT,
-        command      TEXT NOT NULL,
-        surface      TEXT NOT NULL,
-        scope        TEXT NOT NULL,
-        target       TEXT NOT NULL,
-        duration_ms  INTEGER NOT NULL DEFAULT 0,
-        exit_status  INTEGER NOT NULL DEFAULT 0,
-        metadata_json TEXT DEFAULT '{}',
-        status        TEXT NOT NULL DEFAULT 'completed',
-        project_root  TEXT,
-        started_at    TEXT,
-        heartbeat_at  TEXT,
-        finished_at   TEXT,
-        error         TEXT,
-        progress_json TEXT,
-        stderr_log    TEXT,
-        content_hash  TEXT,
-        files_count   INTEGER,
-        file_manifest_json TEXT,
-        runner_pid           INTEGER,
-        runner_pid_started_at TEXT,
-        runner_host          TEXT
-      );
-      CREATE TABLE IF NOT EXISTS findings_ledger_findings (
-        id           INTEGER PRIMARY KEY AUTOINCREMENT,
-        run_id       TEXT NOT NULL REFERENCES findings_ledger_runs(run_id) ON DELETE CASCADE,
-        analyzer     TEXT NOT NULL,
-        rule         TEXT NOT NULL,
-        severity     TEXT NOT NULL,
-        message      TEXT NOT NULL,
-        file         TEXT NOT NULL,
-        line         INTEGER,
-        symbol       TEXT DEFAULT '',
-        fingerprint  TEXT NOT NULL
-      );
-      CREATE TABLE IF NOT EXISTS findings_ledger_coverage (
-        run_id    TEXT NOT NULL REFERENCES findings_ledger_runs(run_id) ON DELETE CASCADE,
-        analyzer  TEXT NOT NULL,
-        rule_id   TEXT NOT NULL,
-        state     TEXT NOT NULL,
-        count     INTEGER NOT NULL DEFAULT 0,
-        reason    TEXT,
-        PRIMARY KEY (run_id, analyzer, rule_id)
-      );
-      CREATE INDEX IF NOT EXISTS idx_ledger_runs_surface    ON findings_ledger_runs(surface);
-      CREATE INDEX IF NOT EXISTS idx_ledger_runs_timestamp   ON findings_ledger_runs(timestamp);
-      CREATE INDEX IF NOT EXISTS idx_ledger_coverage_run     ON findings_ledger_coverage(run_id);
-      CREATE INDEX IF NOT EXISTS idx_ledger_findings_run     ON findings_ledger_findings(run_id);
-      CREATE INDEX IF NOT EXISTS idx_ledger_findings_fp      ON findings_ledger_findings(fingerprint);
-      CREATE INDEX IF NOT EXISTS idx_ledger_findings_rule    ON findings_ledger_findings(analyzer, rule);
-
-      -- Spec 10: Style intelligence tables
-      CREATE TABLE IF NOT EXISTS style_declarations (
-        id              INTEGER PRIMARY KEY AUTOINCREMENT,
-        property        TEXT NOT NULL,
-        raw_value       TEXT NOT NULL,
-        normalized_value TEXT,
-        mechanism       TEXT NOT NULL,
-        file_path       TEXT NOT NULL,
-        line            INTEGER NOT NULL,
-        context         TEXT,
-        variant_context TEXT,
-        token_ref       TEXT,
-        content_hash    TEXT,
-        created_at      TEXT DEFAULT (datetime('now'))
-      );
-      CREATE INDEX IF NOT EXISTS idx_style_decls_property   ON style_declarations(property);
-      CREATE INDEX IF NOT EXISTS idx_style_decls_mechanism  ON style_declarations(mechanism);
-      CREATE INDEX IF NOT EXISTS idx_style_decls_file_path  ON style_declarations(file_path);
-      CREATE INDEX IF NOT EXISTS idx_style_decls_token_ref  ON style_declarations(token_ref);
-      CREATE INDEX IF NOT EXISTS idx_style_decls_content_hash ON style_declarations(content_hash);
-
-      CREATE VIRTUAL TABLE IF NOT EXISTS style_declarations_fts USING fts5(
-        property, raw_value, normalized_value,
-        content='style_declarations', content_rowid='id',
-        tokenize='porter unicode61'
-      );
-
-      CREATE TABLE IF NOT EXISTS style_tokens (
-        id         INTEGER PRIMARY KEY AUTOINCREMENT,
-        name       TEXT NOT NULL,
-        value      TEXT NOT NULL,
-        file_path  TEXT NOT NULL,
-        mechanism  TEXT NOT NULL,
-        created_at TEXT DEFAULT (datetime('now'))
-      );
-      CREATE INDEX IF NOT EXISTS idx_style_tokens_name ON style_tokens(name);
-
-      CREATE TABLE IF NOT EXISTS style_class_usage (
-        id           INTEGER PRIMARY KEY AUTOINCREMENT,
-        class_name   TEXT NOT NULL,
-        file_path    TEXT NOT NULL,
-        line         INTEGER NOT NULL,
-        mechanism    TEXT NOT NULL,
-        unresolvable INTEGER DEFAULT 0,
-        created_at   TEXT DEFAULT (datetime('now'))
-      );
-      CREATE INDEX IF NOT EXISTS idx_style_class_usage_name   ON style_class_usage(class_name);
-      CREATE INDEX IF NOT EXISTS idx_style_class_usage_file   ON style_class_usage(file_path);
-      CREATE INDEX IF NOT EXISTS idx_style_class_usage_unres  ON style_class_usage(unresolvable);
-
-      -- Spec 45 R5: Stylesheet sources the style indexer could not read.
-      -- When any rows exist, styles/undefined-class findings carry them as
-      -- incomplete-definition context instead of going silent.
-      CREATE TABLE IF NOT EXISTS style_unread_sources (
-        id         INTEGER PRIMARY KEY AUTOINCREMENT,
-        file_path  TEXT NOT NULL UNIQUE,
-        reason     TEXT NOT NULL,
-        created_at TEXT DEFAULT (datetime('now'))
-      );
-
-      -- Spec 12: Convention mining
-      CREATE TABLE IF NOT EXISTS conventions (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        domain TEXT NOT NULL,
-        rule_id TEXT NOT NULL,
-        antecedent TEXT,
-        consequent TEXT,
-        pattern TEXT,
-        directory TEXT,
-        file_path TEXT,
-        line INTEGER,
-        support INTEGER DEFAULT 0,
-        total_cases INTEGER DEFAULT 0,
-        confidence REAL DEFAULT 0,
-        exemplar_file TEXT,
-        exemplar_line INTEGER,
-        export_kind TEXT,
-        hash TEXT,
-        created_at TEXT DEFAULT (datetime('now'))
-      );
-      CREATE INDEX IF NOT EXISTS idx_conv_domain ON conventions(domain);
-      CREATE INDEX IF NOT EXISTS idx_conv_rule_id ON conventions(rule_id);
-      CREATE INDEX IF NOT EXISTS idx_conv_directory ON conventions(directory);
-      CREATE INDEX IF NOT EXISTS idx_conv_file_path ON conventions(file_path);
-      CREATE INDEX IF NOT EXISTS idx_conv_hash ON conventions(hash);
-
-      -- Spec 13: Hotspots & temporal analysis
-      CREATE TABLE IF NOT EXISTS file_churn (
-        file_path            TEXT PRIMARY KEY,
-        commit_count         INTEGER NOT NULL DEFAULT 0,
-        lines_added          INTEGER NOT NULL DEFAULT 0,
-        lines_deleted        INTEGER NOT NULL DEFAULT 0,
-        distinct_authors     INTEGER NOT NULL DEFAULT 0,
-        dominant_author      TEXT,
-        dominant_author_share REAL DEFAULT 0,
-        last_touched         TEXT
-      );
-      CREATE INDEX IF NOT EXISTS idx_file_churn_cc ON file_churn(commit_count);
-
-      CREATE TABLE IF NOT EXISTS function_churn (
-        id                   INTEGER PRIMARY KEY AUTOINCREMENT,
-        function_id          INTEGER REFERENCES functions(id) ON DELETE CASCADE,
-        function_name        TEXT NOT NULL,
-        file_path            TEXT NOT NULL,
-        commit_count         INTEGER NOT NULL DEFAULT 0,
-        distinct_authors     INTEGER NOT NULL DEFAULT 0,
-        dominant_author      TEXT,
-        dominant_author_share REAL DEFAULT 0,
-        renamed              INTEGER DEFAULT 0,
-        confidence           REAL DEFAULT 1.0
-      );
-      CREATE INDEX IF NOT EXISTS idx_func_churn_fid ON function_churn(function_id);
-
-      CREATE TABLE IF NOT EXISTS hotspot_scores (
-        target       TEXT PRIMARY KEY,
-        type         TEXT NOT NULL,
-        score        REAL NOT NULL DEFAULT 0,
-        churn_pct    REAL NOT NULL DEFAULT 0,
-        complexity_pct REAL NOT NULL DEFAULT 0,
-        commit_count INTEGER NOT NULL DEFAULT 0,
-        distinct_authors INTEGER NOT NULL DEFAULT 0,
-        dominant_author TEXT,
-        dominant_author_share REAL DEFAULT 0,
-        bus_factor_risk INTEGER DEFAULT 0,
-        complexity   INTEGER NOT NULL DEFAULT 0,
-        updated_at   TEXT DEFAULT (datetime('now'))
-      );
-      CREATE INDEX IF NOT EXISTS idx_hotspot_scores_score ON hotspot_scores(score DESC);
-
-      CREATE TABLE IF NOT EXISTS dry_pair_history (
-        id              INTEGER PRIMARY KEY AUTOINCREMENT,
-        pair_fingerprint TEXT NOT NULL,
-        file1           TEXT NOT NULL,
-        symbol1         TEXT,
-        line1           INTEGER NOT NULL,
-        content_hash1   TEXT NOT NULL,
-        file2           TEXT NOT NULL,
-        symbol2         TEXT,
-        line2           INTEGER NOT NULL,
-        content_hash2   TEXT NOT NULL,
-        similarity      REAL NOT NULL,
-        timestamp       TEXT DEFAULT (datetime('now')),
-        run_id          TEXT NOT NULL
-      );
-      CREATE INDEX IF NOT EXISTS idx_dph_fingerprint ON dry_pair_history(pair_fingerprint);
-      CREATE INDEX IF NOT EXISTS idx_dph_run ON dry_pair_history(run_id);
-    `);
-        // Run schema migrations
-        this.runMigrations();
-        // Record schema version
-        this.db.prepare(`INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', ?)`).run(String(CodeIndexDB.SCHEMA_VERSION));
-    }
-    // ── LokiJS migration ────────────────────────────────────────────────
-    maybeMigrateFromLokiJS() {
-        if (this.dbPath === ':memory:')
-            return { migrated: false };
-        const bakPath = this.dbPath + '.loki.bak';
-        // If backup already exists alongside a valid SQLite db, skip
-        try {
-            const st = require('fs').statSync(bakPath);
-            if (st.isFile()) {
-                // Check if SQLite db exists
-                try {
-                    require('fs').statSync(this.dbPath);
-                    return { migrated: false };
-                }
-                catch { /* fall through */ }
-            }
-        }
-        catch { /* no backup */ }
-        // Check if dbPath is a LokiJS file
-        try {
-            const raw = require('fs').readFileSync(this.dbPath, 'utf-8');
-            if (!raw.startsWith('{"filename":') && !raw.includes('"collections":')) {
-                return { migrated: false };
-            }
-        }
-        catch {
-            return { migrated: false };
-        }
-        // It's LokiJS — migrate
-        try {
-            const content = require('fs').readFileSync(this.dbPath, 'utf-8');
-            const data = JSON.parse(content);
-            // LokiJS stores collections as an array of {name, data, ...}
-            const collArray = Array.isArray(data.collections)
-                ? data.collections
-                : [];
-            const collections = {};
-            for (const c of collArray) {
-                collections[c.name] = c.data ?? [];
-            }
-            // Rename old LokiJS file FIRST, then create fresh SQLite DB
-            require('fs').renameSync(this.dbPath, bakPath);
-            const migDb = openSqlite(this.dbPath, { timeoutMs: DB_BUSY_TIMEOUT_MS });
-            migDb.pragma('journal_mode = WAL');
-            migDb.pragma('foreign_keys = ON');
-            // User-authored tables only (function index gets rebuilt by sync).
-            // whitelist + analyzer_configs use snake_case (matching raw SQL queries in the main code).
-            // project_tasks uses camelCase (matching ProjectTaskRepository document fields).
-            migDb.exec(`
-        CREATE TABLE IF NOT EXISTS whitelist (
-          id           INTEGER PRIMARY KEY AUTOINCREMENT,
-          name         TEXT NOT NULL,
-          type         TEXT NOT NULL,
-          status       TEXT DEFAULT 'Active',
-          category     TEXT,
-          description  TEXT,
-          patterns     TEXT,
-          added_by     TEXT DEFAULT 'system',
-          added_at     TEXT DEFAULT (datetime('now')),
-          updated_at   TEXT,
-          metadata_json TEXT
-        );
-
-        CREATE TABLE IF NOT EXISTS analyzer_configs (
-          id            INTEGER PRIMARY KEY AUTOINCREMENT,
-          analyzer_name TEXT NOT NULL,
-          project_path  TEXT,
-          is_global     INTEGER DEFAULT 0,
-          config_json   TEXT NOT NULL DEFAULT '{}',
-          version       TEXT,
-          created_by    TEXT DEFAULT 'system',
-          created_at    TEXT DEFAULT (datetime('now')),
-          updated_at    TEXT DEFAULT (datetime('now')),
-          metadata_json TEXT
-        );
-
-        CREATE TABLE IF NOT EXISTS project_tasks (
-          taskId         TEXT PRIMARY KEY,
-          projectPath    TEXT NOT NULL,
-          title          TEXT NOT NULL,
-          description    TEXT DEFAULT '',
-          status         TEXT DEFAULT 'pending',
-          priority       TEXT DEFAULT 'medium',
-          labels         TEXT DEFAULT '[]',
-          source         TEXT DEFAULT 'manual',
-          parentTaskId   TEXT,
-          blockedBy      TEXT DEFAULT '[]',
-          dueAt          TEXT,
-          sortOrder      INTEGER DEFAULT 0,
-          relatedFiles   TEXT DEFAULT '[]',
-          relatedSymbols TEXT DEFAULT '[]',
-          fingerprint    TEXT,
-          metadata       TEXT DEFAULT '{}',
-          createdAt      TEXT DEFAULT (datetime('now')),
-          updatedAt      TEXT DEFAULT (datetime('now')),
-          completedAt    TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_project_tasks_fingerprint ON project_tasks(fingerprint);
-      `);
-            let taskCount = 0;
-            let configCount = 0;
-            let whitelistCount = 0;
-            // Migrate tasks
-            const tasksData = collections['projectTasks'] ?? [];
-            const insertTask = migDb.prepare(`INSERT OR IGNORE INTO project_tasks
-        (taskId, projectPath, title, description, status, priority, labels, source,
-         parentTaskId, blockedBy, dueAt, sortOrder, relatedFiles, relatedSymbols,
-         fingerprint, metadata, createdAt, updatedAt, completedAt)
-        VALUES (@taskId, @projectPath, @title, @description, @status, @priority, @labels, @source,
-                @parentTaskId, @blockedBy, @dueAt, @sortOrder, @relatedFiles, @relatedSymbols,
-                @fingerprint, @metadata, @createdAt, @updatedAt, @completedAt)`);
-            for (const t of tasksData) {
-                insertTask.run({
-                    taskId: t.taskId ?? '',
-                    projectPath: t.projectPath ?? '',
-                    title: t.title ?? '',
-                    description: t.description ?? '',
-                    status: t.status ?? 'pending',
-                    priority: t.priority ?? 'medium',
-                    labels: JSON.stringify(t.labels ?? []),
-                    source: t.source ?? 'manual',
-                    parentTaskId: t.parentTaskId ?? null,
-                    blockedBy: JSON.stringify(t.blockedBy ?? []),
-                    dueAt: t.dueAt ?? null,
-                    sortOrder: t.sortOrder ?? 0,
-                    relatedFiles: JSON.stringify(t.relatedFiles ?? []),
-                    relatedSymbols: JSON.stringify(t.relatedSymbols ?? []),
-                    fingerprint: t.fingerprint ?? null,
-                    metadata: JSON.stringify(t.metadata ?? t.metadata_json ?? {}),
-                    createdAt: t.createdAt ?? t.created_at ?? new Date().toISOString(),
-                    updatedAt: t.updatedAt ?? t.updated_at ?? new Date().toISOString(),
-                    completedAt: t.completedAt ?? t.completed_at ?? null,
-                });
-                taskCount++;
-            }
-            // Migrate analyzer configs (snake_case columns matching createSchema)
-            const configsData = collections['analyzerConfigs'] ?? [];
-            const insertConfig = migDb.prepare(`INSERT OR IGNORE INTO analyzer_configs
-        (analyzer_name, project_path, is_global, config_json, version, created_by, created_at, updated_at, metadata_json)
-        VALUES (@analyzerName, @projectPath, @isGlobal, @configJson, @version, @createdBy, @createdAt, @updatedAt, @metadataJson)`);
-            for (const c of configsData) {
-                insertConfig.run({
-                    analyzerName: c.analyzerName ?? '',
-                    projectPath: c.projectPath ?? null,
-                    isGlobal: c.isGlobal ? 1 : 0,
-                    configJson: typeof c.config_json === 'string'
-                        ? c.config_json
-                        : JSON.stringify(c.config ?? c.config_json ?? {}),
-                    version: c.version ?? null,
-                    createdBy: c.createdBy ?? c.created_by ?? 'system',
-                    createdAt: c.createdAt ?? c.created_at ?? new Date().toISOString(),
-                    updatedAt: c.updatedAt ?? c.updated_at ?? new Date().toISOString(),
-                    metadataJson: JSON.stringify(c.metadata ?? c.metadata_json ?? {}),
-                });
-                configCount++;
-            }
-            // Migrate whitelist (snake_case columns matching createSchema)
-            const whitelistData = collections['whitelist'] ?? [];
-            const insertWl = migDb.prepare(`INSERT OR IGNORE INTO whitelist
-        (name, type, status, category, description, patterns, added_by, added_at, updated_at, metadata_json)
-        VALUES (@name, @type, @status, @category, @description, @patterns, @addedBy, @addedAt, @updatedAt, @metadataJson)`);
-            for (const w of whitelistData) {
-                insertWl.run({
-                    name: w.name ?? '',
-                    type: w.type ?? 'PlatformAPI',
-                    status: w.status ?? 'Active',
-                    category: w.category ?? null,
-                    description: w.description ?? null,
-                    patterns: JSON.stringify(w.patterns ?? []),
-                    addedBy: w.addedBy ?? w.added_by ?? 'system',
-                    addedAt: w.addedAt ?? w.added_at ?? new Date().toISOString(),
-                    updatedAt: w.updatedAt ?? w.updated_at ?? null,
-                    metadataJson: JSON.stringify(w.metadata ?? w.metadata_json ?? {}),
-                });
-                whitelistCount++;
-            }
-            migDb.close();
-            const countLine = [
-                taskCount && `${taskCount} tasks`,
-                configCount && `${configCount} analyzer configs`,
-                whitelistCount && `${whitelistCount} whitelist entries`,
-            ].filter(Boolean).join(', ') || '0 entries';
-            console.error(`[code-auditor] Migrated ${countLine} from LokiJS to SQLite. Old file saved as ${path.basename(bakPath)}`);
-            return { migrated: true, counts: { tasks: taskCount, configs: configCount, whitelist: whitelistCount } };
-        }
-        catch (err) {
-            // Migration failed — try to restore the backup
-            console.error('[code-auditor] LokiJS migration failed:', err instanceof Error ? err.message : String(err));
-            try {
-                if (require('fs').existsSync(bakPath) && !require('fs').existsSync(this.dbPath)) {
-                    require('fs').renameSync(bakPath, this.dbPath);
-                }
-            }
-            catch { /* best effort */ }
-            return { migrated: false };
-        }
-    }
     // ── Init guard ──────────────────────────────────────────────────────
     ensureInitialized() {
         if (!this.isInitialized) {
@@ -1489,174 +326,18 @@ export class CodeIndexDB {
             throw new Error('Database not initialized. Call initialize() first.');
         }
     }
-    // ── Helpers: row → EnhancedFunctionMetadata ─────────────────────────
-    rowToFunction(row) {
-        return {
-            name: row.name,
-            filePath: row.file_path,
-            lineNumber: row.line_number,
-            startLine: row.start_line,
-            endLine: row.end_line,
-            language: row.language,
-            dependencies: [],
-            purpose: row.purpose ?? '',
-            context: row.context ?? '',
-            signature: row.signature ?? '',
-            parameters: tryParseJson(row.parameters) ?? [],
-            jsDoc: { description: row.jsdoc_description ?? '' },
-            imports: [],
-            body: row.body ?? '',
-            comments: [],
-            isAsync: false,
-            isGenerator: false,
-            returnType: row.return_type,
-            visibility: 'public',
-            complexity: row.complexity ?? 0,
-            content_hash: row.content_hash,
-            metadata: tryParseJson(row.metadata_json) ?? {},
-            hooks: tryParseJson(row.hooks),
-            props: tryParseJson(row.props),
-        };
-    }
-    functionToRow(func, lastModified) {
-        const enhanced = func;
-        const jsDoc = func.jsDoc;
-        return {
-            name: func.name,
-            file_path: func.filePath,
-            line_number: func.lineNumber ?? 0,
-            start_line: func.startLine ?? null,
-            end_line: func.endLine ?? null,
-            language: func.language ?? 'typescript',
-            entity_type: func.metadata?.entityType ?? 'function',
-            component_type: func.metadata?.componentType ?? null,
-            signature: enhanced.signature ?? '',
-            return_type: enhanced.returnType ?? null,
-            complexity: enhanced.complexity ?? func.metadata?.complexity ?? 0,
-            is_exported: func.metadata?.isExported ? 1 : 0,
-            has_jsdoc: (jsDoc && jsDoc.description) ? 1 : 0,
-            jsdoc_description: typeof jsDoc === 'string' ? jsDoc : (jsDoc?.description ?? ''),
-            jsdoc_tags: jsDoc?.tags ? JSON.stringify(jsDoc.tags) : null,
-            parameters: enhanced.parameters ? JSON.stringify(enhanced.parameters) : null,
-            type_info: func.metadata?.typeInfo ? JSON.stringify(func.metadata.typeInfo) : null,
-            hooks: enhanced.hooks ? JSON.stringify(enhanced.hooks) : null,
-            props: enhanced.props ? JSON.stringify(enhanced.props) : null,
-            used_imports: func.metadata?.usedImports ? JSON.stringify(func.metadata.usedImports) : null,
-            unused_imports: func.metadata?.unusedImports ? JSON.stringify(func.metadata.unusedImports) : null,
-            import_usage: func.metadata?.importUsage ? JSON.stringify(func.metadata.importUsage) : null,
-            has_unused_imports: func.metadata?.unusedImports?.length > 0 ? 1 : 0,
-            dependency_depth: func.metadata?.dependencyDepth ?? 0,
-            purpose: func.purpose ?? '',
-            context: func.context ?? '',
-            body: func.body ?? null,
-            content_hash: enhanced.content_hash ?? computeContentHash(func.body, enhanced.signature),
-            last_modified: lastModified ?? new Date().toISOString(),
-            // body lives only in the dedicated `body` column, never in metadata_json
-            // (previously triple-stored). JSON.stringify omits the undefined value, so
-            // this strips any stray `body` key at the write boundary.
-            metadata_json: func.metadata ? JSON.stringify({ ...func.metadata, body: undefined }) : '{}',
-        };
-    }
-    // ── Function CRUD ───────────────────────────────────────────────────
-    async registerFunction(func) {
-        this.ensureInitialized();
-        const row = this.functionToRow(func);
-        try {
-            this.db.prepare(`
-        INSERT INTO functions (name, file_path, line_number, start_line, end_line, language,
-          entity_type, component_type, signature, return_type, complexity, is_exported, has_jsdoc,
-          jsdoc_description, jsdoc_tags, parameters, type_info, hooks, props,
-          used_imports, unused_imports, import_usage, has_unused_imports, dependency_depth,
-          purpose, context, body, content_hash, last_modified, metadata_json)
-        VALUES (@name, @file_path, @line_number, @start_line, @end_line, @language,
-          @entity_type, @component_type, @signature, @return_type, @complexity, @is_exported, @has_jsdoc,
-          @jsdoc_description, @jsdoc_tags, @parameters, @type_info, @hooks, @props,
-          @used_imports, @unused_imports, @import_usage, @has_unused_imports, @dependency_depth,
-          @purpose, @context, @body, @content_hash, @last_modified, @metadata_json)
-        ON CONFLICT(name, file_path, line_number) DO UPDATE SET
-          line_number=excluded.line_number, start_line=excluded.start_line, end_line=excluded.end_line,
-          language=excluded.language, entity_type=excluded.entity_type, component_type=excluded.component_type,
-          signature=excluded.signature, return_type=excluded.return_type, complexity=excluded.complexity,
-          is_exported=excluded.is_exported, has_jsdoc=excluded.has_jsdoc,
-          jsdoc_description=excluded.jsdoc_description, jsdoc_tags=excluded.jsdoc_tags,
-          parameters=excluded.parameters, type_info=excluded.type_info, hooks=excluded.hooks, props=excluded.props,
-          used_imports=excluded.used_imports, unused_imports=excluded.unused_imports,
-          import_usage=excluded.import_usage, has_unused_imports=excluded.has_unused_imports,
-          dependency_depth=excluded.dependency_depth,
-          purpose=excluded.purpose, context=excluded.context, body=excluded.body,
-          content_hash=excluded.content_hash, last_modified=excluded.last_modified,
-          metadata_json=excluded.metadata_json
-      `).run(row);
-        }
-        catch (error) {
-            throw new Error(`Failed to register function: ${error instanceof Error ? error.message : 'Unknown error'}`);
-        }
-    }
-    async registerFunctions(functions) {
-        this.ensureInitialized();
-        let registered = 0;
-        let failed = 0;
-        const errors = [];
-        const insertAll = this.db.transaction((funcs) => {
-            for (const func of funcs) {
-                try {
-                    this.registerFunction(func);
-                    registered++;
-                }
-                catch (error) {
-                    failed++;
-                    errors.push({
-                        function: func.name || 'unknown',
-                        error: error instanceof Error ? error.message : 'Unknown error'
-                    });
-                }
-            }
-        });
-        insertAll(functions);
-        return {
-            success: failed === 0,
-            registered,
-            failed,
-            errors: errors
-        };
-    }
+    // ── Function sync (orchestration) ────────────────────────────────────
     /**
-     * Upsert/remove one file's function rows. Runs inside the caller's
-     * transaction (no nested `db.transaction` here) so a batch sync can wrap many
-     * files in a single write transaction.
+     * Upsert one file's functions and remove rows that no longer exist, then
+     * rebuild the dependency graph for that file.
+     *
+     * @param filePath - The file whose functions are being synced.
+     * @param currentFunctions - The functions currently present in the file.
+     * @param fileHash - Optional file-level content hash stamped onto each written
+     *   row for diff detection.
+     * @returns Counts of added, updated, and removed rows.
      */
-    syncFileIndexRow(filePath, currentFunctions, stats, lastModified) {
-        const existing = this.db.prepare('SELECT id, name, file_path, line_number FROM functions WHERE file_path = ?').all(filePath);
-        const createKey = (f) => `${f.name ?? f.name}:${f.filePath ?? f.file_path}:${f.lineNumber ?? f.line_number}`;
-        const currentMap = new Map(currentFunctions.map(f => [createKey(f), f]));
-        // Insert/update current functions
-        for (const func of currentFunctions) {
-            const exists = existing.find(e => e.name === func.name && e.line_number === func.lineNumber);
-            if (exists) {
-                const row = this.functionToRow(func, lastModified);
-                const keys = Object.keys(row);
-                const sets = keys.filter(k => k !== 'name' && k !== 'file_path').map(k => `"${k}" = @${k}`);
-                const params = { ...row, _id: exists.id };
-                this.db.prepare(`UPDATE functions SET ${sets.join(', ')} WHERE id = @_id`).run(params);
-                stats.updated++;
-            }
-            else {
-                const row = this.functionToRow(func, lastModified);
-                const keys = Object.keys(row);
-                const sql = `INSERT INTO functions ("${keys.join('", "')}") VALUES (${keys.map(k => '@' + k).join(', ')})`;
-                this.db.prepare(sql).run(row);
-                stats.added++;
-            }
-        }
-        // Remove stale functions
-        for (const e of existing) {
-            if (!currentMap.has(createKey(e))) {
-                this.db.prepare('DELETE FROM functions WHERE id = ?').run(e.id);
-                stats.removed++;
-            }
-        }
-    }
-    async syncFileIndex(filePath, currentFunctions) {
+    async syncFileIndex(filePath, currentFunctions, fileHash) {
         this.ensureInitialized();
         const stats = { added: 0, updated: 0, removed: 0 };
         // Record the file's actual mtime (not wall clock) so detectModifiedFiles can
@@ -1670,8 +351,8 @@ export class CodeIndexDB {
             // stat failed — fall back to wall clock; detectModifiedFiles will then treat
             // an unreadable file as modified, which is the safe direction.
         }
-        this.db.transaction(() => this.syncFileIndexRow(filePath, currentFunctions, stats, lastModified)).immediate();
-        await this.updateDependencyGraph(filePath);
+        this.db.transaction(() => this.functionIndex.syncFileIndexRow(filePath, currentFunctions, stats, lastModified, fileHash)).immediate();
+        await this.graph.updateDependencyGraph(filePath);
         return stats;
     }
     /**
@@ -1681,6 +362,9 @@ export class CodeIndexDB {
      * one transaction plus one dependency-graph rebuild per file, and the
      * rebuild's un-scoped `SELECT` made that O(files × functions). Collapsing it
      * to one transaction is Amendment B2.
+     *
+     * @param entries - The per-file sync entries (path plus current functions).
+     * @returns Counts of added, updated, and removed rows across all files.
      */
     async syncFileIndexBatch(entries) {
         this.ensureInitialized();
@@ -1697,380 +381,69 @@ export class CodeIndexDB {
             }
         }));
         this.db.transaction(() => {
-            for (const { filePath, currentFunctions } of entries) {
-                this.syncFileIndexRow(filePath, currentFunctions, stats, mtimes.get(filePath));
+            for (const { filePath, currentFunctions, fileHash } of entries) {
+                this.functionIndex.syncFileIndexRow(filePath, currentFunctions, stats, mtimes.get(filePath), fileHash);
             }
         }).immediate();
-        await this.updateDependencyGraph();
+        await this.graph.updateDependencyGraph();
         return stats;
     }
-    // ── Dependency graph ────────────────────────────────────────────────
-    async updateDependencyGraph(filePath) {
-        this.ensureInitialized();
-        const txn = this.db.transaction(() => {
-            // Clear existing call edges for scoped functions
-            if (filePath) {
-                this.db.prepare(`DELETE FROM function_calls WHERE caller_id IN (SELECT id FROM functions WHERE file_path = ?)`).run(filePath);
-            }
-            else {
-                this.db.prepare('DELETE FROM function_calls').run();
-            }
-            // Clear existing dependency edges for scoped functions
-            if (filePath) {
-                this.db.prepare(`DELETE FROM function_dependencies WHERE function_id IN (SELECT id FROM functions WHERE file_path = ?)`).run(filePath);
-            }
-            else {
-                this.db.prepare('DELETE FROM function_dependencies').run();
-            }
-            // Rebuild edges from metadata. When scoped to one file, read only that
-            // file's functions — a per-file call previously re-read every function
-            // in the index, making the detached-audit loop O(files × functions).
-            const allFns = filePath
-                ? this.db.prepare('SELECT id, name, file_path, metadata_json FROM functions WHERE file_path = ?').all(filePath)
-                : this.db.prepare('SELECT id, name, file_path, metadata_json FROM functions').all();
-            const insertCall = this.db.prepare('INSERT OR IGNORE INTO function_calls (caller_id, callee_name) VALUES (?, ?)');
-            const insertFnDep = this.db.prepare('INSERT OR IGNORE INTO function_dependencies (function_id, dependency) VALUES (?, ?)');
-            for (const fn of allFns) {
-                const meta = tryParseJson(fn.metadata_json) ?? {};
-                if (meta.functionCalls) {
-                    for (const callee of meta.functionCalls) {
-                        insertCall.run(fn.id, callee);
-                    }
-                }
-                // Add specifier-level dependencies (e.g., useState, useEffect)
-                const usedImports = meta.usedImports ?? [];
-                for (const imp of usedImports) {
-                    insertFnDep.run(fn.id, imp);
-                }
-                // Add module-level dependencies (e.g., react, express) — stored in
-                // metadata.dependencies since v3.0.4 to power the dep: operator
-                const moduleDeps = meta.dependencies ?? [];
-                for (const dep of moduleDeps) {
-                    insertFnDep.run(fn.id, dep);
-                }
-            }
-        });
-        txn.immediate();
-    }
-    async getTransitiveDependencies(functionName, maxDepth = 10) {
-        this.ensureInitialized();
-        const result = [];
-        const visited = new Set();
-        // Find starting function(s)
-        const startFns = this.db.prepare('SELECT id FROM functions WHERE name = ?').all(functionName);
-        if (startFns.length === 0)
-            return result;
-        // Use recursive CTE for transitive closure
-        const rows = this.db.prepare(`
-      WITH RECURSIVE deps(id, callee_name, depth) AS (
-        SELECT fc.caller_id, fc.callee_name, 1
-        FROM function_calls fc
-        WHERE fc.caller_id IN (SELECT id FROM functions WHERE name = ?)
-        UNION
-        SELECT fc.caller_id, fc.callee_name, deps.depth + 1
-        FROM function_calls fc
-        JOIN deps ON fc.caller_id IN (SELECT id FROM functions WHERE name = deps.callee_name)
-        WHERE deps.depth < ?
-      )
-      SELECT DISTINCT callee_name as name, depth FROM deps ORDER BY depth, name
-    `).all(functionName, maxDepth);
-        return rows;
-    }
-    async getTransitiveCallers(functionName, maxDepth = 10) {
-        this.ensureInitialized();
-        const rows = this.db.prepare(`
-      WITH RECURSIVE callers(id, caller_name, depth) AS (
-        SELECT fc.caller_id, f.name, 1
-        FROM function_calls fc
-        JOIN functions f ON f.id = fc.caller_id
-        WHERE fc.callee_name = ?
-        UNION
-        SELECT fc.caller_id, f2.name, callers.depth + 1
-        FROM function_calls fc
-        JOIN functions f2 ON f2.id = fc.caller_id
-        JOIN functions f3 ON f3.name = callers.caller_name AND fc.callee_name = f3.name
-        WHERE callers.depth < ?
-      )
-      SELECT DISTINCT caller_name as name, depth FROM callers ORDER BY depth, name
-    `).all(functionName, maxDepth);
-        return rows;
-    }
-    async detectCircularDependencies() {
-        this.ensureInitialized();
-        // SQLite recursive CTE for cycle detection
-        const rows = this.db.prepare(`
-      WITH RECURSIVE paths(start_name, path, current_name, depth) AS (
-        SELECT f.name, f.name, fc.callee_name, 1
-        FROM functions f
-        JOIN function_calls fc ON fc.caller_id = f.id
-        UNION
-        SELECT paths.start_name,
-               paths.path || '→' || fc.callee_name,
-               fc.callee_name,
-               paths.depth + 1
-        FROM paths
-        JOIN functions f ON f.name = paths.current_name
-        JOIN function_calls fc ON fc.caller_id = f.id
-        WHERE paths.depth < 20
-          AND instr(paths.path, fc.callee_name) = 0
-      )
-      SELECT DISTINCT path FROM paths
-      WHERE current_name = start_name AND depth > 1
-    `).all();
-        return rows.map(r => r.path.split('→'));
-    }
-    async calculateDependencyDepths() {
-        this.ensureInitialized();
-        const functions = this.db.prepare('SELECT id, name FROM functions').all();
-        const update = this.db.prepare('UPDATE functions SET dependency_depth = ? WHERE id = ?');
-        // Calculate depths outside transaction since getTransitiveDependencies is async
-        const depths = [];
-        for (const fn of functions) {
-            const deps = await this.getTransitiveDependencies(fn.name);
-            const maxDepth = deps.length > 0 ? Math.max(...deps.map(d => d.depth)) : 0;
-            depths.push({ id: fn.id, maxDepth });
-        }
-        const txn = this.db.transaction(() => {
-            for (const { id, maxDepth } of depths) {
-                update.run(maxDepth, id);
-            }
-        });
-        txn();
-    }
-    // ── Search ──────────────────────────────────────────────────────────
-    async searchFunctions(options) {
-        this.ensureInitialized();
-        const startTime = Date.now();
-        const queryParser = new QueryParser();
-        let parsedQuery;
-        if (options.query) {
-            parsedQuery = options.parsedQuery || queryParser.parse(options.query);
-        }
-        else if (options.parsedQuery) {
-            parsedQuery = options.parsedQuery;
-        }
-        // If there's a parsed query, use the SQL path (handles both FTS5 and operator-only queries)
-        if (parsedQuery) {
-            const compiled = compileToSQL(parsedQuery, { defaultLimit: options.limit || 50, offset: options.offset || 0 });
-            return this.executeCompiledSearch(compiled, parsedQuery, options, startTime);
-        }
-        // Otherwise, get all functions and apply filters in-memory (backward compatible)
-        const rows = this.db.prepare('SELECT *, rowid as "$loki" FROM functions').all();
-        let results = rows.map((r) => this.rowToFunctionDoc(r));
-        // Apply filters (parsedQuery is undefined here — the if-parsedQuery branch returned early)
-        const combinedFilters = this.mergeFilters(options.filters, undefined);
-        results = this.applyFilters(results, combinedFilters);
-        const totalCount = results.length;
-        const limit = options.limit || 50;
-        const offset = options.offset || 0;
-        results = results.slice(offset, offset + limit);
-        const functions = results.map(doc => ({
-            ...doc,
-            score: 50
-        }));
-        return {
-            functions,
-            totalCount,
-            query: options.query,
-            parsedQuery,
-            executionTime: Date.now() - startTime
-        };
-    }
-    executeCompiledSearch(compiled, parsedQuery, options, startTime) {
-        let sql;
-        const params = { ...compiled.params };
-        let afterFrom = '';
-        // Collect JOINs first — they must precede WHERE in SQL
-        for (const join of compiled.joinClauses) {
-            afterFrom += ` ${join}`;
-        }
-        if (compiled.ftsMatch) {
-            // FTS5 path
-            sql = `SELECT f.*, f.rowid as "$loki", bm25(functions_fts) as score
-        FROM functions f
-        JOIN functions_fts ON functions_fts.rowid = f.id${afterFrom}
-        WHERE functions_fts MATCH @_ftsMatch`;
-            params['_ftsMatch'] = compiled.ftsMatch;
-        }
-        else {
-            sql = `SELECT f.*, f.rowid as "$loki", 0 as score FROM functions f${afterFrom} WHERE 1=1`;
-        }
-        // Add WHERE clauses
-        for (const clause of compiled.whereClauses) {
-            sql += ` AND (${clause})`;
-        }
-        // Ordering
-        sql += ` ORDER BY ${compiled.orderBy}`;
-        // Limit/offset
-        sql += ` LIMIT ${compiled.limit} OFFSET ${compiled.offset}`;
-        const rows = this.db.prepare(sql).all(params);
-        // Get total count (without limit)
-        let totalCount = rows.length;
-        try {
-            let countSql;
-            let countAfterFrom = '';
-            for (const join of compiled.joinClauses) {
-                countAfterFrom += ` ${join}`;
-            }
-            if (compiled.ftsMatch) {
-                countSql = `SELECT COUNT(*) as cnt FROM functions f
-          JOIN functions_fts ON functions_fts.rowid = f.id${countAfterFrom}
-          WHERE functions_fts MATCH @_ftsMatch`;
-            }
-            else {
-                countSql = `SELECT COUNT(*) as cnt FROM functions f${countAfterFrom} WHERE 1=1`;
-            }
-            for (const clause of compiled.whereClauses) {
-                countSql += ` AND (${clause})`;
-            }
-            const countParams = { ...params };
-            delete countParams['_ftsMatch'];
-            if (compiled.ftsMatch) {
-                countParams['_ftsMatch'] = compiled.ftsMatch;
-            }
-            const countResult = this.db.prepare(countSql).get(countParams);
-            totalCount = countResult?.cnt ?? rows.length;
-        }
-        catch {
-            // Fall back to results length
-        }
-        // Convert rows to FunctionDocument, applying excluded terms
-        let docs = rows.map((r) => this.rowToFunctionDoc(r));
-        if (parsedQuery.excludedTerms.length > 0) {
-            docs = this.excludeTermsFromResults(docs, parsedQuery.excludedTerms);
-        }
-        // Apply in-memory filters (for filters not handled by compileToSQL)
-        const combinedFilters = this.mergeFilters(options.filters, parsedQuery.filters);
-        docs = this.applyFilters(docs, combinedFilters);
-        const functions = docs.map(doc => ({
-            ...doc,
-            score: doc.score ?? 0
-        }));
-        return {
-            functions,
-            totalCount,
-            query: options.query,
-            parsedQuery,
-            executionTime: Date.now() - startTime
-        };
-    }
-    rowToFunctionDoc(row) {
-        const func = this.rowToFunction(row);
-        const doc = {
-            ...func,
-            $loki: row['$loki'] ?? row.id,
-            dependencies: [],
-        };
-        // Populate dependencies from metadata
-        const meta = tryParseJson(row.metadata_json);
-        if (meta) {
-            // Include both specifier-level (usedImports) and module-level (dependencies)
-            const usedImports = meta.usedImports ?? [];
-            const moduleDeps = meta.dependencies ?? [];
-            doc.dependencies = [...new Set([...usedImports, ...moduleDeps])];
-        }
-        return doc;
-    }
-    async findDefinition(name, filePath) {
-        this.ensureInitialized();
-        let row;
-        if (filePath) {
-            row = this.db.prepare('SELECT * FROM functions WHERE name = ? AND file_path = ?').get(name, filePath);
-        }
-        else {
-            row = this.db.prepare('SELECT * FROM functions WHERE name = ?').get(name);
-        }
-        if (!row)
-            return null;
-        const func = this.rowToFunction(row);
-        return func;
-    }
-    // ── Stats ───────────────────────────────────────────────────────────
-    async getAllFunctions() {
-        this.ensureInitialized();
-        const rows = this.db.prepare('SELECT * FROM functions').all();
-        return rows.map((r) => this.rowToFunction(r));
-    }
+    // ── Lifecycle: clear & close ────────────────────────────────────────
     /**
-     * Narrow variant for the scoped-DRY gate path (Spec 43 R4). Selects only the
-     * columns `buildFullFunctionHashmap` reads — name, file_path, start_line,
-     * line_number, body — so the hot `changed` path skips the wide JSON columns
-     * (`parameters`, `hooks`, `props`, `signature`, `metadata_json`,
-     * `content_hash`) and their per-row `JSON.parse` cost.
+     * Delete all index data while preserving project tasks, configs, whitelist,
+     * and ledger rows.
+     *
+     * @returns A promise that resolves once the index is cleared.
      */
-    async getAllFunctionsForDry() {
-        this.ensureInitialized();
-        const rows = this.db
-            .prepare('SELECT name, file_path, start_line, line_number, body FROM functions')
-            .all();
-        return rows.map((r) => ({
-            name: r.name,
-            filePath: r.file_path,
-            startLine: r.start_line ?? undefined,
-            lineNumber: r.line_number ?? undefined,
-            body: r.body ?? '',
-        }));
-    }
-    /** Row count of the `functions` table — for callers that only need `.length`. */
-    async getFunctionCount() {
-        this.ensureInitialized();
-        const row = this.db.prepare('SELECT COUNT(*) AS n FROM functions').get();
-        return row?.n ?? 0;
-    }
-    async getStats() {
-        this.ensureInitialized();
-        const totalFunctions = this.db.prepare('SELECT COUNT(*) as cnt FROM functions').get().cnt;
-        const languages = {};
-        const langRows = this.db.prepare('SELECT language, COUNT(*) as cnt FROM functions GROUP BY language').all();
-        for (const r of langRows) {
-            languages[r.language] = r.cnt;
-        }
-        const depRows = this.db.prepare('SELECT dependency as name, COUNT(*) as cnt FROM function_dependencies GROUP BY dependency ORDER BY cnt DESC LIMIT 10').all();
-        const topDependencies = depRows.map((r) => ({ name: r.name, count: r.cnt }));
-        const filesIndexed = this.db.prepare('SELECT COUNT(DISTINCT file_path) as cnt FROM functions').get().cnt;
-        return {
-            totalFunctions,
-            languages,
-            topDependencies,
-            filesIndexed,
-            lastUpdated: new Date()
-        };
-    }
-    /** Get graph statistics — delegates to graph/callGraph.ts (Spec 14 R1). */
-    getGraphStats() {
-        this.ensureInitialized();
-        return getGs(this.db);
-    }
-    // ── Lifecycle: clear & close ────────────────────────────────────────
     async clearIndex() {
         this.ensureInitialized();
+        // Delete every indexed table inside a single transaction. Each DELETE is a
+        // literal statement (no interpolation → no sql-injection), one table per
+        // statement (no multi-table `exec` → no complex-query), prepared once outside
+        // the loop and only `.run()` inside it (no prepare-in-loop → no loop-query),
+        // and executed through one shared loop (one query site → no too-many-queries).
+        // `meta` keeps the keyed subset below; the FTS5 triggers handle functions_fts
+        // cleanup on the functions delete. Preserved by design: project_tasks,
+        // analyzer_configs, whitelist, findings_ledger_runs, findings_ledger_findings.
         this.db.transaction(() => {
-            this.db.prepare('DELETE FROM functions').run();
-            // FTS5 triggers handle cleanup
-            this.db.prepare('DELETE FROM audit_results').run();
-            this.db.prepare('DELETE FROM code_maps').run();
-            this.db.prepare('DELETE FROM schema_definitions').run();
-            this.db.prepare('DELETE FROM schema_usage').run();
-            this.db.prepare('DELETE FROM conventions').run();
-            this.db.prepare('DELETE FROM file_churn').run();
-            this.db.prepare('DELETE FROM function_churn').run();
-            this.db.prepare('DELETE FROM hotspot_scores').run();
-            this.db.prepare('DELETE FROM dry_pair_history').run();
-            this.db.prepare('DELETE FROM graph_cache').run();
-            this.db.prepare("DELETE FROM meta WHERE key IN ('churn_hash', 'conventions_hash', 'style_last_sync')").run();
-            // Preserve: project_tasks, analyzer_configs, whitelist, findings_ledger_runs, findings_ledger_findings
+            const deletes = [
+                this.db.prepare('DELETE FROM functions'),
+                this.db.prepare('DELETE FROM audit_results'),
+                this.db.prepare('DELETE FROM code_maps'),
+                this.db.prepare('DELETE FROM schema_definitions'),
+                this.db.prepare('DELETE FROM schema_usage'),
+                this.db.prepare('DELETE FROM conventions'),
+                this.db.prepare('DELETE FROM file_churn'),
+                this.db.prepare('DELETE FROM function_churn'),
+                this.db.prepare('DELETE FROM hotspot_scores'),
+                this.db.prepare('DELETE FROM dry_pair_history'),
+                this.db.prepare('DELETE FROM graph_cache'),
+                this.db.prepare("DELETE FROM meta WHERE key IN ('churn_hash', 'conventions_hash', 'style_last_sync')"),
+            ];
+            for (const del of deletes)
+                del.run();
         })();
     }
+    /**
+     * Close the database handle and release resources, if initialized.
+     *
+     * @returns A promise that resolves once the handle is closed.
+     */
     async close() {
         if (this.isInitialized) {
-            this.taskRepository = null;
-            this.stmts.clear();
             this.db.close();
             this.isInitialized = false;
         }
         this.initFailure = null;
     }
     // ── File sync & bulk cleanup ────────────────────────────────────────
+    /**
+     * Re-scan a single file and reconcile its indexed functions, removing rows
+     * when the file no longer exists.
+     *
+     * @param filePath - The file to synchronize.
+     * @returns Counts of added, updated, and removed rows (null on scan error).
+     */
     async synchronizeFile(filePath) {
         this.ensureInitialized();
         try {
@@ -2085,17 +458,23 @@ export class CodeIndexDB {
             const { FunctionScanner } = await import('./functionScanner.js');
             const scanner = new FunctionScanner();
             const fileContent = await fs.readFile(filePath, 'utf-8');
-            const language = filePath.endsWith('.ts') || filePath.endsWith('.tsx') ? 'typescript' : 'javascript';
-            const parsedFunctions = await scanner.scanFunctions(fileContent, filePath, language);
+            const parsedFunctions = await scanner.scanFunctions(fileContent, filePath);
             return await this.syncFileIndex(filePath, parsedFunctions);
         }
         catch (error) {
-            throw new Error(`Failed to sync file: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            throw new Error(`Failed to sync file: ${errorMessage(error)}`);
         }
     }
+    /**
+     * Remove stale function rows whose files are deleted or no longer part of
+     * the discovery set.
+     *
+     * @param projectRoot - Optional project root to reconcile against.
+     * @returns Scan counts, removed rows, and per-file errors.
+     */
     async bulkCleanup(projectRoot) {
         this.ensureInitialized();
-        const files = this.db.prepare('SELECT DISTINCT file_path FROM functions').all();
+        const files = this.db.prepare(SQL_DISTINCT_FILE_PATHS).all();
         const removedFiles = [];
         const errors = [];
         let removedCount = 0;
@@ -2118,6 +497,7 @@ export class CodeIndexDB {
                 discovered = null;
             }
         }
+        const stalePaths = [];
         for (const { file_path: fp } of files) {
             scannedCount++;
             let stale = false;
@@ -2135,13 +515,30 @@ export class CodeIndexDB {
                 }
             }
             if (stale) {
-                const result = this.db.prepare('DELETE FROM functions WHERE file_path = ?').run(fp);
-                removedCount += result.changes;
+                stalePaths.push(fp);
                 removedFiles.push(fp);
             }
         }
+        // Batch the deletes — one `IN (SELECT value FROM json_each(?))` DELETE for the
+        // whole stale set, instead of one DELETE per stale file (loop-query / N+1).
+        // A single JSON-array bind expands through json_each, so a large stale set
+        // can't exceed the SQLite bind-parameter ceiling.
+        if (stalePaths.length > 0) {
+            const result = this.db
+                .prepare(SQL_DELETE_FUNCTIONS_IN_FILEPATHS)
+                .run(JSON.stringify(stalePaths));
+            removedCount += result.changes;
+        }
         return { scannedCount, removedCount, removedFiles, errors };
     }
+    /**
+     * Re-scan the whole project (or the already-indexed files) and reconcile the
+     * index, reporting aggregate counts.
+     *
+     * @param projectRoot - Optional project root to discover files from.
+     * @param progressCallback - Optional per-file progress callback.
+     * @returns Aggregate sync counts and errors.
+     */
     async deepSync(projectRoot, progressCallback) {
         this.ensureInitialized();
         let syncedFiles = 0;
@@ -2159,31 +556,68 @@ export class CodeIndexDB {
         }
         else {
             // Fallback: sync files already in the index
-            const rows = this.db.prepare('SELECT DISTINCT file_path FROM functions').all();
+            const rows = this.db.prepare(SQL_DISTINCT_FILE_PATHS).all();
             files = rows.map(r => r.file_path);
         }
         const total = files.length;
+        // Parse each file and defer its index write to one batched transaction plus
+        // one dependency-graph rebuild after the loop. The previous per-file
+        // `synchronizeFile` → `syncFileIndex` path was one transaction plus one
+        // per-file dependency-graph rebuild per file — the same O(files × functions)
+        // query-in-loop N+1 Amendment B2 collapsed in the detached-audit path.
+        // Tree-sitter parsing stays per-file (it is the inherent cost); only the DB
+        // write is batched. Progress and per-file error attribution are unchanged.
+        const syncEntries = [];
+        const inaccessiblePaths = [];
         for (let i = 0; i < files.length; i++) {
             const fp = files[i];
             if (progressCallback) {
                 progressCallback({ current: i + 1, total, file: fp });
             }
+            let accessible = true;
             try {
-                const result = await this.synchronizeFile(fp);
-                if (result) {
-                    syncedFiles++;
-                    totalAdded += result.added;
-                    totalUpdated += result.updated;
-                    totalRemoved += result.removed;
-                }
+                await fs.access(fp);
+            }
+            catch {
+                accessible = false;
+            }
+            if (!accessible) {
+                // File doesn't exist — defer its delete to one batched DELETE after the
+                // loop (the same json_each batch the stale cleanup below uses), instead
+                // of one `DELETE … WHERE file_path = ?` per missing file (loop-query N+1).
+                inaccessiblePaths.push(fp);
+                syncedFiles++;
+                continue;
+            }
+            try {
+                const { FunctionScanner } = await import('./functionScanner.js');
+                const scanner = new FunctionScanner();
+                const fileContent = await fs.readFile(fp, 'utf-8');
+                const parsedFunctions = await scanner.scanFunctions(fileContent, fp);
+                syncEntries.push({ filePath: fp, currentFunctions: parsedFunctions });
+                syncedFiles++;
             }
             catch (error) {
                 errors.push({
                     file: fp,
-                    error: error instanceof Error ? error.message : String(error)
+                    error: `Failed to sync file: ${errorMessage(error)}`
                 });
             }
         }
+        if (syncEntries.length > 0) {
+            const batchStats = await this.syncFileIndexBatch(syncEntries);
+            totalAdded += batchStats.added;
+            totalUpdated += batchStats.updated;
+            totalRemoved += batchStats.removed;
+        }
+        // Batch-delete the functions of every file that vanished between discovery
+        // and the scan (one json_each DELETE, not one per file).
+        if (inaccessiblePaths.length > 0) {
+            const removed = this.db
+                .prepare(SQL_DELETE_FUNCTIONS_IN_FILEPATHS)
+                .run(JSON.stringify(inaccessiblePaths));
+            totalRemoved += removed.changes;
+        }
         // Clean up stale entries: a file is stale when it is no longer in the
         // discovery set (deleted OR gitignored since the last sync). Comparing
         // against discovery — not `fs.access` — makes a gitignored-but-present file
@@ -2191,7 +625,8 @@ export class CodeIndexDB {
         // project root (files came from the index itself), fall back to the on-disk
         // existence check.
         const discoveredSet = projectRoot ? new Set(files) : null;
-        const allIndexed = this.db.prepare('SELECT DISTINCT file_path FROM functions').all();
+        const allIndexed = this.db.prepare(SQL_DISTINCT_FILE_PATHS).all();
+        const stalePaths = [];
         for (const { file_path: fp } of allIndexed) {
             let stale = false;
             if (discoveredSet) {
@@ -2205,12 +640,18 @@ export class CodeIndexDB {
                     stale = true;
                 }
             }
-            if (stale) {
-                const result = this.db.prepare('DELETE FROM functions WHERE file_path = ?').run(fp);
-                if (result.changes > 0) {
-                    totalRemoved += result.changes;
-                }
-            }
+            if (stale)
+                stalePaths.push(fp);
+        }
+        // Batch the deletes — one `IN (SELECT value FROM json_each(?))` DELETE for the
+        // whole stale set, instead of one DELETE per stale file (loop-query / N+1). A
+        // single JSON-array bind expands through json_each, so a large stale set can't
+        // exceed the SQLite bind-parameter ceiling.
+        if (stalePaths.length > 0) {
+            const result = this.db
+                .prepare(SQL_DELETE_FUNCTIONS_IN_FILEPATHS)
+                .run(JSON.stringify(stalePaths));
+            totalRemoved += result.changes;
         }
         // Spec 13 — Extract git churn data after index is built and stale entries
         // are cleaned up. Runs before conventions mining so hotspot data is
@@ -2230,7 +671,7 @@ export class CodeIndexDB {
         }
         // Spec 12 — Mine codebase conventions after sync when the functions table
         // has changed. Content-hash-based skip: stored hash avoids re-mining.
-        this.mineAllConventions(projectRoot);
+        this.conventions.mineAllConventions(projectRoot);
         // Spec 14 — Populate graph caches after index is built
         try {
             populateCallGraphCache(this.db);
@@ -2255,6 +696,9 @@ export class CodeIndexDB {
      *
      * Returns the list of changed/new function metadata for scoped analysis,
      * and the set of file paths that were actually touched.
+     *
+     * @param filePaths - The file paths to re-parse and diff.
+     * @returns Changed and deleted functions, touched paths, and per-file errors.
      */
     async detectChangedFunctions(filePaths) {
         this.ensureInitialized();
@@ -2263,43 +707,87 @@ export class CodeIndexDB {
         const changedFilePaths = [];
         const errors = [];
         const { FunctionScanner } = await import('./functionScanner.js');
+        // First pass: split the changed set into files that no longer exist (deleted)
+        // and files that are still on disk. The deleted set is handled with one batched
+        // SELECT + DELETE below — a per-file query here was a query-in-loop N+1.
+        const missingFiles = [];
         for (const filePath of filePaths) {
             try {
                 await fs.access(filePath);
             }
             catch {
-                // File doesn't exist — remove all its functions
-                const removed = this.db.prepare('SELECT * FROM functions WHERE file_path = ?').all(filePath);
-                if (removed.length > 0) {
-                    const parsed = removed.map((r) => this.rowToFunction(r));
-                    deletedFunctions.push(...parsed);
-                    this.db.prepare('DELETE FROM functions WHERE file_path = ?').run(filePath);
-                    changedFilePaths.push(filePath);
-                }
+                missingFiles.push(filePath);
+            }
+        }
+        if (missingFiles.length > 0) {
+            const removed = this.db.prepare(`SELECT * FROM functions WHERE file_path IN (SELECT value FROM json_each(?))`).all(JSON.stringify(missingFiles));
+            if (removed.length > 0) {
+                deletedFunctions.push(...removed.map((r) => this.functionIndex.rowToFunction(r)));
+                this.db.prepare(SQL_DELETE_FUNCTIONS_IN_FILEPATHS).run(JSON.stringify(missingFiles));
+                const touched = new Set(removed.map((r) => r.file_path));
+                changedFilePaths.push(...missingFiles.filter((fp) => touched.has(fp)));
+            }
+        }
+        const missingSet = new Set(missingFiles);
+        // Batch-fetch the existing functions for every still-present file in one
+        // query, grouped in memory — a per-file `SELECT … WHERE file_path = ?` inside
+        // the diff loop below was a query-in-loop N+1.
+        const presentFiles = filePaths.filter((fp) => !missingSet.has(fp));
+        const existingByFile = new Map();
+        if (presentFiles.length > 0) {
+            const rows = this.db.prepare(`SELECT * FROM functions WHERE file_path IN (SELECT value FROM json_each(?))`).all(JSON.stringify(presentFiles));
+            for (const row of rows) {
+                const list = existingByFile.get(row.file_path) ?? [];
+                list.push(row);
+                existingByFile.set(row.file_path, list);
+            }
+        }
+        // Collect per-file sync entries here and batch them after the loop — a
+        // `syncFileIndex` call inside the loop was a per-file transaction plus a
+        // per-file dependency-graph rebuild (query-in-loop N+1). `syncFileIndexBatch`
+        // collapses that to one transaction and one unscoped rebuild (Amendment B2),
+        // and carries each file's content hash so the warm-path short-circuit keeps
+        // its stored `file_hash` baseline.
+        const syncEntries = [];
+        for (const filePath of filePaths) {
+            if (missingSet.has(filePath))
                 continue;
-            }
             try {
-                const scanner = new FunctionScanner();
                 const fileContent = await fs.readFile(filePath, 'utf-8');
-                const language = (filePath.endsWith('.ts') || filePath.endsWith('.tsx'))
-                    ? 'typescript' : 'javascript';
-                const currentFunctions = await scanner.scanFunctions(fileContent, filePath, language);
-                // Get existing functions for this file from DB
-                const existing = this.db.prepare('SELECT * FROM functions WHERE file_path = ?').all(filePath);
-                // Build a name → existing-row map
+                const fileHash = computeContentHash(fileContent);
+                const existing = existingByFile.get(filePath) ?? [];
+                // Short-circuit: when the file's whole-content hash round-trips to the
+                // stored `file_hash`, no function can be new, changed, or deleted — skip
+                // the tree-sitter re-scan and the re-sync. This is the warm path for
+                // `changed` on an already-indexed, unchanged file. The hash is content-
+                // based (not mtime), so it preserves the precise change-detection
+                // guarantee; a NULL stored hash (first sync after upgrade) never
+                // short-circuits, so the index self-heals.
+                if (existing.length > 0 && existing[0].file_hash && existing[0].file_hash === fileHash) {
+                    continue;
+                }
+                const scanner = new FunctionScanner();
+                const currentFunctions = await scanner.scanFunctions(fileContent, filePath);
+                // Key identity on (name, line_number) — the table's unique index —
+                // not name alone. Two same-named functions in one file (overloads, a
+                // method and a free function, the same name in two scopes) otherwise
+                // collapse to one map entry, and an edit to the shadowed one is
+                // reported against the wrong row or not at all. file_path is constant
+                // across the loop, so (name, line_number) is the distinguishing pair.
+                const keyOf = (name, lineNumber) => `${name}:${lineNumber}`;
                 const existingByName = new Map();
                 for (const e of existing) {
-                    existingByName.set(e.name, e);
+                    existingByName.set(keyOf(e.name, e.line_number), e);
                 }
-                const currentNames = new Set(currentFunctions.map((f) => f.name));
+                const currentKeys = new Set(currentFunctions.map((f) => keyOf(f.name, f.lineNumber)));
                 let fileChanged = false;
                 for (const func of currentFunctions) {
-                    const existingRow = existingByName.get(func.name);
+                    const existingRow = existingByName.get(keyOf(func.name, func.lineNumber));
                     // Convert scanner output to EnhancedFunctionMetadata shape
                     const funcMeta = {
                         ...func,
                         complexity: func.complexity,
-                        content_hash: computeContentHash(func.body, func.signature),
+                        content_hash: computeContentHash(func.body),
                     };
                     const newHash = funcMeta.content_hash;
                     if (!existingRow) {
@@ -2315,16 +803,17 @@ export class CodeIndexDB {
                 }
                 // Detect deleted functions
                 for (const e of existing) {
-                    if (!currentNames.has(e.name)) {
-                        deletedFunctions.push(this.rowToFunction(e));
+                    if (!currentKeys.has(keyOf(e.name, e.line_number))) {
+                        deletedFunctions.push(this.functionIndex.rowToFunction(e));
                         fileChanged = true;
                     }
                 }
                 if (fileChanged) {
                     changedFilePaths.push(filePath);
                 }
-                // Sync the file into the index (upsert + deletes)
-                await this.syncFileIndex(filePath, currentFunctions);
+                // Defer the index write: collected above and flushed in one batch after
+                // the loop (see `syncEntries`).
+                syncEntries.push({ filePath, currentFunctions: currentFunctions, fileHash });
             }
             catch (error) {
                 errors.push({
@@ -2333,11 +822,18 @@ export class CodeIndexDB {
                 });
             }
         }
+        // One batched write + one dependency-graph rebuild for all changed files.
+        if (syncEntries.length > 0) {
+            await this.syncFileIndexBatch(syncEntries);
+        }
         return { changedFunctions, deletedFunctions, changedFilePaths, errors };
     }
     /**
      * Given a project root, detect all indexed files whose mtime is newer than
      * the stored last_modified timestamp. Returns file paths for further processing.
+     *
+     * @param projectRoot - The project root to scan.
+     * @returns The file paths whose mtime is newer than the stored timestamp.
      */
     async detectModifiedFiles(projectRoot) {
         this.ensureInitialized();
@@ -2365,582 +861,19 @@ export class CodeIndexDB {
         }
         return modifiedFiles;
     }
+    // ── Cross-concern search (search + schema usage) ─────────────────────
     /**
-     * Get content hashes for a set of file paths. Returns a map:
-     * file_path → { name → content_hash }
-     */
-    getContentHashesForFiles(filePaths) {
-        this.ensureInitialized();
-        const result = new Map();
-        if (filePaths.length === 0)
-            return result;
-        const placeholders = filePaths.map(() => '?').join(', ');
-        const rows = this.db.prepare(`SELECT file_path, name, content_hash FROM functions WHERE file_path IN (${placeholders})`).all(...filePaths);
-        for (const row of rows) {
-            if (!result.has(row.file_path)) {
-                result.set(row.file_path, new Map());
-            }
-            result.get(row.file_path).set(row.name, row.content_hash ?? '');
-        }
-        return result;
-    }
-    // ── Legacy search helpers (for in-memory filtering) ─────────────────
-    mergeFilters(optionsFilters, queryFilters) {
-        const merged = {};
-        if (optionsFilters)
-            Object.assign(merged, optionsFilters);
-        if (queryFilters) {
-            if (queryFilters.language)
-                merged.language = queryFilters.language;
-            if (queryFilters.filePath)
-                merged.filePath = queryFilters.filePath;
-            if (queryFilters.fileType)
-                merged.fileType = queryFilters.fileType;
-            if (queryFilters.hasJsDoc !== undefined)
-                merged.hasJsDoc = queryFilters.hasJsDoc;
-            if (queryFilters.complexity)
-                merged.complexity = queryFilters.complexity;
-            if (queryFilters.dateRange)
-                merged.dateRange = queryFilters.dateRange;
-            if (queryFilters.metadata)
-                merged.metadata = queryFilters.metadata;
-        }
-        return merged;
-    }
-    applyFilters(results, filters) {
-        if (!filters)
-            return results;
-        let filtered = results;
-        if (filters.language) {
-            filtered = filtered.filter(doc => doc.language === filters.language);
-        }
-        if (filters.filePath) {
-            if (filters.filePath.includes('*') || filters.filePath.includes('?')) {
-                // `*` and `?` are the only glob wildcards; every other character is
-                // escaped so it matches literally. A path like `foo[0-9].ts` no longer
-                // becomes an accidental regex character class.
-                const pattern = filters.filePath
-                    .split(/([*?])/)
-                    .map((seg) => (seg === '*' ? '.*' : seg === '?' ? '.' : escapeRegExpLiteral(seg)))
-                    .join('');
-                const regex = new RegExp(pattern);
-                filtered = filtered.filter(doc => regex.test(doc.filePath));
-            }
-            else if (filters.filePath.endsWith('.ts') || filters.filePath.endsWith('.tsx') ||
-                filters.filePath.endsWith('.js') || filters.filePath.endsWith('.jsx')) {
-                filtered = filtered.filter(doc => doc.filePath.endsWith(filters.filePath));
-            }
-            else {
-                filtered = filtered.filter(doc => doc.filePath.includes(filters.filePath));
-            }
-        }
-        if (filters.fileType) {
-            filtered = filtered.filter(doc => doc.filePath.endsWith(filters.fileType));
-        }
-        if (filters.hasJsDoc !== undefined) {
-            filtered = filtered.filter(doc => {
-                const hasJsDoc = doc.jsDoc && doc.jsDoc.description && doc.jsDoc.description.length > 0;
-                return filters.hasJsDoc ? hasJsDoc : !hasJsDoc;
-            });
-        }
-        if (filters.complexity) {
-            filtered = filtered.filter(doc => {
-                if (!doc.complexity)
-                    return false;
-                const min = filters.complexity.min || 0;
-                const max = filters.complexity.max || Infinity;
-                return doc.complexity >= min && doc.complexity <= max;
-            });
-        }
-        if (filters.hasAnyDependency && filters.hasAnyDependency.length > 0) {
-            filtered = filtered.filter(doc => filters.hasAnyDependency.some(dep => doc.dependencies.includes(dep)));
-        }
-        if (filters.metadata) {
-            filtered = filtered.filter(doc => {
-                if (!doc.metadata)
-                    return false;
-                const m = filters.metadata;
-                if (m.entityType && doc.metadata.entityType !== m.entityType)
-                    return false;
-                if (m.componentType && doc.metadata.componentType !== m.componentType)
-                    return false;
-                if (m.hasHook) {
-                    if (!doc.metadata.hooks)
-                        return false;
-                    const found = doc.metadata.hooks.some((h) => h.name?.toLowerCase().includes(m.hasHook.toLowerCase()));
-                    if (!found)
-                        return false;
-                }
-                if (m.hasProp) {
-                    if (!doc.metadata.props)
-                        return false;
-                    const found = doc.metadata.props.some((p) => p.name?.toLowerCase().includes(m.hasProp.toLowerCase()));
-                    if (!found)
-                        return false;
-                }
-                if (m.usesDependency) {
-                    const dep = m.usesDependency.toLowerCase();
-                    const inFile = doc.dependencies.some(d => d.toLowerCase().includes(dep));
-                    const inFunc = doc.metadata.usedImports?.some(i => i.toLowerCase().includes(dep)) ?? false;
-                    if (!inFile && !inFunc)
-                        return false;
-                }
-                if (m.callsFunction) {
-                    const target = m.callsFunction.toLowerCase();
-                    const calls = doc.metadata.functionCalls;
-                    if (!calls || !calls.some(c => c.toLowerCase().includes(target)))
-                        return false;
-                }
-                if (m.calledByFunction) {
-                    const caller = m.calledByFunction.toLowerCase();
-                    const calledBy = doc.metadata.calledBy;
-                    if (!calledBy || !calledBy.some(c => c.toLowerCase().includes(caller)))
-                        return false;
-                }
-                if (m.dependsOnModule) {
-                    const mod = m.dependsOnModule.toLowerCase();
-                    const inFile2 = doc.filePath.toLowerCase().includes(mod);
-                    const inDep = doc.dependencies.some(d => d.toLowerCase().includes(mod));
-                    const inCall = doc.metadata.functionCalls?.some(c => c.toLowerCase().includes(mod)) ?? false;
-                    if (!inFile2 && !inDep && !inCall)
-                        return false;
-                }
-                if (m.hasUnusedImports) {
-                    const unused = doc.metadata.unusedImports;
-                    if (!unused || unused.length === 0)
-                        return false;
-                }
-                return true;
-            });
-        }
-        return filtered;
-    }
-    excludeTermsFromResults(results, excludedTerms) {
-        return results.filter(doc => {
-            const searchText = [
-                doc.name, doc.signature, doc.purpose, doc.context,
-                doc.jsDoc?.description, doc.returnType,
-                ...(doc.parameters || []).map((p) => `${p.name} ${p.description || ''}`),
-                ...doc.dependencies
-            ].filter(Boolean).join(' ').toLowerCase();
-            return !excludedTerms.some(term => searchText.includes(term.toLowerCase()));
-        });
-    }
-    // ── Whitelist ───────────────────────────────────────────────────────
-    async initializeDefaultWhitelists() {
-        const defaults = [
-            { name: 'Date', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'javascript', addedBy: 'system', addedAt: new Date() },
-            { name: 'Error', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'javascript', addedBy: 'system', addedAt: new Date() },
-            { name: 'Array', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'javascript', addedBy: 'system', addedAt: new Date() },
-            { name: 'Map', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'javascript', addedBy: 'system', addedAt: new Date() },
-            { name: 'Set', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'javascript', addedBy: 'system', addedAt: new Date() },
-            { name: 'Promise', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'javascript', addedBy: 'system', addedAt: new Date() },
-            { name: 'RegExp', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'javascript', addedBy: 'system', addedAt: new Date() },
-            { name: 'URL', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'dom', addedBy: 'system', addedAt: new Date() },
-            { name: 'URLSearchParams', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'dom', addedBy: 'system', addedAt: new Date() },
-            { name: 'FormData', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'dom', addedBy: 'system', addedAt: new Date() },
-            { name: 'Headers', type: WhitelistType.PlatformAPI, status: WhitelistStatus.Active, category: 'dom', addedBy: 'system', addedAt: new Date() },
-            { name: 'fs', type: WhitelistType.NodeBuiltin, status: WhitelistStatus.Active, patterns: ['fs', 'node:fs', 'fs/promises'], addedBy: 'system', addedAt: new Date() },
-            { name: 'path', type: WhitelistType.NodeBuiltin, status: WhitelistStatus.Active, patterns: ['path', 'node:path'], addedBy: 'system', addedAt: new Date() },
-            { name: 'crypto', type: WhitelistType.NodeBuiltin, status: WhitelistStatus.Active, patterns: ['crypto', 'node:crypto'], addedBy: 'system', addedAt: new Date() },
-            { name: 'NextResponse', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'nextjs', addedBy: 'system', addedAt: new Date() },
-            { name: 'NextRequest', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'nextjs', addedBy: 'system', addedAt: new Date() },
-            { name: 'Response', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'web-api', addedBy: 'system', addedAt: new Date() },
-            { name: 'Request', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'web-api', addedBy: 'system', addedAt: new Date() },
-            { name: 'Component', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'react', addedBy: 'system', addedAt: new Date() },
-            { name: 'PureComponent', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'react', addedBy: 'system', addedAt: new Date() },
-            { name: 'Fragment', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'react', addedBy: 'system', addedAt: new Date() },
-            { name: 'StrictMode', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'react', addedBy: 'system', addedAt: new Date() },
-            { name: 'Suspense', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'react', addedBy: 'system', addedAt: new Date() },
-            { name: 'Pool', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'database', patterns: ['pg'], addedBy: 'system', addedAt: new Date() },
-            { name: 'Client', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'database', patterns: ['pg'], addedBy: 'system', addedAt: new Date() },
-            { name: 'MongoClient', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'database', patterns: ['mongodb'], addedBy: 'system', addedAt: new Date() },
-            { name: 'PrismaClient', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'database', patterns: ['@prisma/client'], addedBy: 'system', addedAt: new Date() },
-            { name: 'StackServerApp', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'auth', patterns: ['@stackframe/stack'], addedBy: 'system', addedAt: new Date() },
-            { name: 'StackClient', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'auth', patterns: ['@stackframe/stack'], addedBy: 'system', addedAt: new Date() },
-            { name: 'ClerkProvider', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'auth', patterns: ['@clerk/nextjs'], addedBy: 'system', addedAt: new Date() },
-            { name: 'Auth0Provider', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'auth', patterns: ['@auth0/nextjs-auth0'], addedBy: 'system', addedAt: new Date() },
-            { name: 'Axios', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'http', patterns: ['axios'], addedBy: 'system', addedAt: new Date() },
-            { name: 'HttpClient', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'http', addedBy: 'system', addedAt: new Date() },
-            { name: 'Router', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'express', patterns: ['express'], addedBy: 'system', addedAt: new Date() },
-            { name: 'Application', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'express', patterns: ['express'], addedBy: 'system', addedAt: new Date() },
-            { name: 'TestingModule', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'testing', patterns: ['@nestjs/testing'], addedBy: 'system', addedAt: new Date() },
-            { name: 'MockedProvider', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'testing', patterns: ['@apollo/client/testing'], addedBy: 'system', addedAt: new Date() },
-            { name: 'EventEmitter', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'nodejs', patterns: ['events', 'node:events'], addedBy: 'system', addedAt: new Date() },
-            { name: 'Readable', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'nodejs', patterns: ['stream', 'node:stream'], addedBy: 'system', addedAt: new Date() },
-            { name: 'Writable', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'nodejs', patterns: ['stream', 'node:stream'], addedBy: 'system', addedAt: new Date() },
-            { name: 'Transform', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'nodejs', patterns: ['stream', 'node:stream'], addedBy: 'system', addedAt: new Date() },
-            { name: 'Buffer', type: WhitelistType.FrameworkClass, status: WhitelistStatus.Active, category: 'nodejs', addedBy: 'system', addedAt: new Date() },
-        ];
-        const insert = this.db.prepare(`INSERT INTO whitelist (name, type, status, category, description, patterns, added_by, added_at, metadata_json)
-      VALUES (@name, @type, @status, @category, @description, @patterns, @added_by, @added_at, @metadata_json)`);
-        for (const entry of defaults) {
-            insert.run({
-                name: entry.name,
-                type: entry.type,
-                status: entry.status,
-                category: entry.category ?? null,
-                description: entry.description ?? null,
-                patterns: JSON.stringify(entry.patterns ?? []),
-                added_by: entry.addedBy ?? 'system',
-                added_at: (entry.addedAt ?? new Date()).toISOString(),
-                metadata_json: '{}',
-            });
-        }
-    }
-    async getWhitelist(type, status) {
-        this.ensureInitialized();
-        const rows = this.whitelistAdapter.find({
-            ...(type ? { type } : {}),
-            ...(status ? { status } : {}),
-        });
-        return rows.map((r) => ({
-            name: r.name,
-            type: r.type,
-            status: r.status,
-            category: r.category,
-            description: r.description,
-            patterns: tryParseJson(r.patterns),
-            addedBy: r.added_by ?? r.addedBy,
-            addedAt: new Date(r.added_at ?? r.addedAt),
-            updatedAt: r.updated_at ? new Date(r.updated_at) : undefined,
-            metadata: tryParseJson(r.metadata_json),
-        }));
-    }
-    async addWhitelistEntry(entry) {
-        this.ensureInitialized();
-        const row = this.whitelistAdapter.insert({
-            name: entry.name,
-            type: entry.type,
-            status: entry.status ?? WhitelistStatus.Active,
-            category: entry.category ?? null,
-            description: entry.description ?? null,
-            patterns: JSON.stringify(entry.patterns ?? []),
-            added_by: entry.addedBy ?? 'user',
-            added_at: new Date().toISOString(),
-            metadata_json: '{}',
-        });
-        return {
-            name: row.name,
-            type: row.type,
-            status: row.status,
-            category: row.category,
-            description: row.description,
-            patterns: tryParseJson(row.patterns),
-            addedBy: row.added_by,
-            addedAt: new Date(row.added_at),
-        };
-    }
-    async updateWhitelistStatus(name, status) {
-        this.ensureInitialized();
-        this.db.prepare('UPDATE whitelist SET status = ?, updated_at = ? WHERE name = ?')
-            .run(status, new Date().toISOString(), name);
-    }
-    isWhitelisted(name, type) {
-        if (!this.isInitialized)
-            return false;
-        const rows = this.db.prepare('SELECT name, patterns FROM whitelist WHERE type = ? AND status = ?').all(type, WhitelistStatus.Active);
-        return rows.some(entry => {
-            if (entry.name === name)
-                return true;
-            const patterns = tryParseJson(entry.patterns);
-            if (patterns && Array.isArray(patterns)) {
-                return patterns.some((p) => {
-                    if (p.includes('*')) {
-                        const regex = new RegExp(p.replace(/\*/g, '.*'));
-                        return regex.test(name);
-                    }
-                    return p === name;
-                });
-            }
-            return false;
-        });
-    }
-    async detectWhitelistCandidates() {
-        return [];
-    }
-    // ── Audit results ───────────────────────────────────────────────────
-    async storeAuditResults(auditResult, projectPath) {
-        this.ensureInitialized();
-        const auditId = `audit_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
-        this.db.prepare(`INSERT INTO audit_results (audit_id, timestamp, project_path, summary_json, analyzer_results_json, violations_json, recommendations_json, metadata_json, expires_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(auditId, new Date().toISOString(), projectPath, JSON.stringify(auditResult.summary ?? {}), JSON.stringify(auditResult.analyzerResults ?? auditResult.results ?? {}), JSON.stringify(auditResult.violations ?? null), JSON.stringify(auditResult.recommendations ?? null), JSON.stringify(auditResult.metadata ?? {}), new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString());
-        this.cleanupExpiredAudits();
-        return auditId;
-    }
-    async getAuditResults(auditId) {
-        this.ensureInitialized();
-        const row = this.db.prepare('SELECT * FROM audit_results WHERE audit_id = ?').get(auditId);
-        if (!row)
-            return null;
-        if (new Date(row.expires_at) <= new Date()) {
-            this.db.prepare('DELETE FROM audit_results WHERE audit_id = ?').run(auditId);
-            return null;
-        }
-        return {
-            auditId: row.audit_id,
-            timestamp: new Date(row.timestamp),
-            projectPath: row.project_path,
-            summary: tryParseJson(row.summary_json),
-            analyzerResults: tryParseJson(row.analyzer_results_json),
-            violations: tryParseJson(row.violations_json),
-            recommendations: tryParseJson(row.recommendations_json),
-            metadata: tryParseJson(row.metadata_json),
-            expiresAt: new Date(row.expires_at),
-        };
-    }
-    async getMostRecentAuditResults(projectPath, resultScope) {
-        this.ensureInitialized();
-        const now = new Date().toISOString();
-        let row;
-        const scopeFilter = resultScope
-            ? "AND json_extract(metadata_json, '$.scope') = ?"
-            : '';
-        if (projectPath) {
-            const params = [projectPath, now];
-            if (resultScope)
-                params.push(resultScope);
-            row = this.db.prepare(`SELECT * FROM audit_results WHERE project_path = ? AND expires_at > ? ${scopeFilter} ORDER BY timestamp DESC, rowid DESC LIMIT 1`).get(...params);
-        }
-        else {
-            const params = [now];
-            if (resultScope)
-                params.push(resultScope);
-            row = this.db.prepare(`SELECT * FROM audit_results WHERE expires_at > ? ${scopeFilter} ORDER BY timestamp DESC, rowid DESC LIMIT 1`).get(...params);
-        }
-        if (!row)
-            return null;
-        return {
-            auditId: row.audit_id,
-            timestamp: new Date(row.timestamp),
-            projectPath: row.project_path,
-            summary: tryParseJson(row.summary_json),
-            analyzerResults: tryParseJson(row.analyzer_results_json),
-            violations: tryParseJson(row.violations_json),
-            recommendations: tryParseJson(row.recommendations_json),
-            metadata: tryParseJson(row.metadata_json),
-            expiresAt: new Date(row.expires_at),
-        };
-    }
-    hasOpenTaskByFingerprint(fingerprint) {
-        if (!fingerprint)
-            return false;
-        return this.getTaskRepository().findOpenByFingerprint(fingerprint).length > 0;
-    }
-    cleanupExpiredAudits() {
-        this.db.prepare('DELETE FROM audit_results WHERE expires_at < ?').run(new Date().toISOString());
-    }
-    // ── Analyzer configs ────────────────────────────────────────────────
-    async storeAnalyzerConfig(analyzerName, config, options) {
-        this.ensureInitialized();
-        const projectPath = options?.projectPath ?? null;
-        const isGlobal = options?.isGlobal ?? true;
-        const existing = this.db.prepare('SELECT id FROM analyzer_configs WHERE analyzer_name = ? AND COALESCE(project_path, \'__global__\') = ? AND is_global = ?').get(analyzerName, projectPath ?? '__global__', isGlobal ? 1 : 0);
-        if (existing) {
-            this.db.prepare('UPDATE analyzer_configs SET config_json = ?, updated_at = ?, metadata_json = ? WHERE id = ?').run(JSON.stringify(config), new Date().toISOString(), JSON.stringify(options?.metadata ?? {}), existing.id);
-        }
-        else {
-            this.db.prepare(`INSERT INTO analyzer_configs (analyzer_name, project_path, is_global, config_json, created_by, created_at, updated_at, metadata_json)
-         VALUES (?, ?, ?, ?, 'user', ?, ?, ?)`).run(analyzerName, projectPath, isGlobal ? 1 : 0, JSON.stringify(config), new Date().toISOString(), new Date().toISOString(), JSON.stringify(options?.metadata ?? {}));
-        }
-        return analyzerName;
-    }
-    async getAnalyzerConfig(analyzerName, projectPath) {
-        this.ensureInitialized();
-        if (projectPath) {
-            const row = this.db.prepare('SELECT config_json FROM analyzer_configs WHERE analyzer_name = ? AND project_path = ? AND is_global = 0').get(analyzerName, projectPath);
-            if (row)
-                return tryParseJson(row.config_json);
-        }
-        const globalRow = this.db.prepare('SELECT config_json FROM analyzer_configs WHERE analyzer_name = ? AND is_global = 1').get(analyzerName);
-        return globalRow ? tryParseJson(globalRow.config_json) : null;
-    }
-    async getAllAnalyzerConfigs(projectPath) {
-        this.ensureInitialized();
-        const configs = {};
-        const globals = this.db.prepare('SELECT analyzer_name, config_json FROM analyzer_configs WHERE is_global = 1').all();
-        for (const c of globals) {
-            configs[c.analyzer_name] = tryParseJson(c.config_json);
-        }
-        if (projectPath) {
-            const locals = this.db.prepare('SELECT analyzer_name, config_json FROM analyzer_configs WHERE project_path = ? AND is_global = 0').all(projectPath);
-            for (const c of locals) {
-                configs[c.analyzer_name] = tryParseJson(c.config_json);
-            }
-        }
-        return configs;
-    }
-    async deleteAnalyzerConfig(analyzerName, options) {
-        this.ensureInitialized();
-        const result = this.db.prepare('DELETE FROM analyzer_configs WHERE analyzer_name = ? AND COALESCE(project_path, \'__global__\') = ? AND is_global = ?').run(analyzerName, options?.projectPath ?? '__global__', (options?.isGlobal ?? !options?.projectPath) ? 1 : 0);
-        return result.changes > 0;
-    }
-    async resetAnalyzerConfigs(projectPath) {
-        this.ensureInitialized();
-        if (projectPath) {
-            this.db.prepare('DELETE FROM analyzer_configs WHERE project_path = ? AND is_global = 0').run(projectPath);
-        }
-        else {
-            this.db.prepare('DELETE FROM analyzer_configs').run();
-        }
-    }
-    // ── Code maps ───────────────────────────────────────────────────────
-    async storeCodeMapSection(mapId, sectionType, content, metadata) {
-        this.ensureInitialized();
-        this.db.prepare(`INSERT OR REPLACE INTO code_maps (map_id, section_type, content, metadata_json, timestamp, size)
-       VALUES (?, ?, ?, ?, ?, ?)`).run(mapId, sectionType, content, JSON.stringify(metadata ?? {}), new Date().toISOString(), content.length);
-    }
-    async getCodeMapSection(mapId, sectionType) {
-        this.ensureInitialized();
-        const row = this.db.prepare('SELECT content, metadata_json FROM code_maps WHERE map_id = ? AND section_type = ?')
-            .get(mapId, sectionType);
-        return row ? { content: row.content, metadata: tryParseJson(row.metadata_json) ?? {} } : null;
-    }
-    async listCodeMapSections(mapId) {
-        this.ensureInitialized();
-        const rows = this.db.prepare('SELECT section_type, size, timestamp FROM code_maps WHERE map_id = ?')
-            .all(mapId);
-        return rows.map((r) => ({ sectionType: r.section_type, size: r.size ?? 0, timestamp: new Date(r.timestamp) }));
-    }
-    async clearOldCodeMaps(olderThanHours = 24) {
-        this.ensureInitialized();
-        const cutoff = new Date(Date.now() - olderThanHours * 60 * 60 * 1000).toISOString();
-        const result = this.db.prepare('DELETE FROM code_maps WHERE timestamp < ?').run(cutoff);
-        return result.changes;
-    }
-    async deleteCodeMap(mapId) {
-        this.ensureInitialized();
-        const result = this.db.prepare('DELETE FROM code_maps WHERE map_id = ?').run(mapId);
-        return result.changes;
-    }
-    // ── Schema management ───────────────────────────────────────────────
-    async storeSchema(schema) {
-        this.ensureInitialized();
-        const schemaId = `schema_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
-        const metadata = {
-            schemaId,
-            schemaName: schema.name,
-            indexedAt: new Date(),
-            tableCount: schema.databases.reduce((acc, db) => acc + db.tables.length, 0),
-            relationshipCount: schema.databases.reduce((acc, db) => acc + (db.relationships?.length || 0), 0),
-            usagePatterns: [],
-            discoveredPatterns: [],
-            violations: []
-        };
-        this.db.prepare('INSERT INTO schema_definitions (schema_id, schema_name, schema_json, metadata_json, indexed_at) VALUES (?, ?, ?, ?, ?)').run(schemaId, schema.name, JSON.stringify(schema), JSON.stringify(metadata), new Date().toISOString());
-        return schemaId;
-    }
-    async getSchema(schemaId) {
-        this.ensureInitialized();
-        const row = this.db.prepare('SELECT schema_json FROM schema_definitions WHERE schema_id = ?').get(schemaId);
-        return row ? tryParseJson(row.schema_json) : null;
-    }
-    async getAllSchemas() {
-        this.ensureInitialized();
-        const rows = this.db.prepare('SELECT schema_id, schema_json, metadata_json FROM schema_definitions').all();
-        return rows.map((r) => ({
-            schemaId: r.schema_id,
-            metadata: tryParseJson(r.metadata_json) ?? {},
-            schema: tryParseJson(r.schema_json),
-        }));
-    }
-    async deleteSchema(schemaId) {
-        this.ensureInitialized();
-        this.db.prepare('DELETE FROM schema_usage WHERE schema_id = ?').run(schemaId);
-        const result = this.db.prepare('DELETE FROM schema_definitions WHERE schema_id = ?').run(schemaId);
-        return result.changes > 0;
-    }
-    async recordSchemaUsage(usage, schemaId) {
-        this.ensureInitialized();
-        const existing = this.db.prepare('SELECT id FROM schema_usage WHERE table_name = ? AND file_path = ? AND function_start_line IS ? AND function_start_column IS ? AND line = ?').get(usage.tableName, usage.filePath, usage.functionStartLine ?? null, usage.functionStartColumn ?? null, usage.line);
-        if (existing) {
-            this.db.prepare('UPDATE schema_usage SET schema_id = ?, function_name = ?, usage_type = ?, "column" = ?, raw_query = ?, parameters = ?, origin = ?, recorded_at = ? WHERE id = ?').run(schemaId ?? 'default', usage.functionName ?? null, usage.usageType, usage.column ?? null, usage.rawQuery ?? null, JSON.stringify(usage.parameters ?? []), usage.origin ?? null, new Date().toISOString(), existing.id);
-        }
-        else {
-            this.db.prepare('INSERT INTO schema_usage (schema_id, table_name, file_path, function_name, function_start_line, function_start_column, usage_type, line, "column", raw_query, parameters, origin, recorded_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').run(schemaId ?? 'default', usage.tableName, usage.filePath, usage.functionName ?? null, usage.functionStartLine ?? null, usage.functionStartColumn ?? null, usage.usageType, usage.line ?? null, usage.column ?? null, usage.rawQuery ?? null, JSON.stringify(usage.parameters ?? []), usage.origin ?? null, new Date().toISOString());
-        }
-    }
-    /**
-     * Clear all schema_usage entries for a given file path.
-     * Used for idempotent per-file writes during indexing — stale entries
-     * from a previous scan are removed before fresh references are inserted.
+     * Search functions and optionally annotate results with schema usage context.
+     *
+     * @param options - Search options, including includeSchemaUsage.
+     * @returns The search result, with schema context when requested.
      */
-    clearSchemaUsageForFile(filePath) {
-        this.ensureInitialized();
-        this.db.prepare('DELETE FROM schema_usage WHERE file_path = ?').run(filePath);
-    }
-    async getSchemaUsage(options = {}) {
-        this.ensureInitialized();
-        const clauses = [];
-        const params = [];
-        if (options.schemaId) {
-            clauses.push('schema_id = ?');
-            params.push(options.schemaId);
-        }
-        if (options.tableName) {
-            clauses.push('table_name = ?');
-            params.push(options.tableName);
-        }
-        if (options.filePath) {
-            clauses.push('file_path = ?');
-            params.push(options.filePath);
-        }
-        if (options.functionName) {
-            clauses.push('function_name = ?');
-            params.push(options.functionName);
-        }
-        if (options.usageType) {
-            clauses.push('usage_type = ?');
-            params.push(options.usageType);
-        }
-        const sql = 'SELECT * FROM schema_usage' + (clauses.length ? ' WHERE ' + clauses.join(' AND ') : '');
-        const rows = this.db.prepare(sql).all(...params);
-        return rows.map((r) => ({
-            tableName: r.table_name,
-            filePath: r.file_path,
-            functionName: r.function_name,
-            functionStartLine: r.function_start_line,
-            functionStartColumn: r.function_start_column,
-            usageType: r.usage_type,
-            line: r.line,
-            column: r.column,
-            rawQuery: r.raw_query,
-            parameters: tryParseJson(r.parameters) ?? [],
-        }));
-    }
-    async findFunctionsUsingTable(tableName) {
-        this.ensureInitialized();
-        const rows = this.db.prepare('SELECT function_name, file_path, usage_type, line FROM schema_usage WHERE table_name = ?').all(tableName);
-        return rows.map((r) => ({
-            functionName: r.function_name,
-            filePath: r.file_path,
-            usageType: r.usage_type,
-            line: r.line,
-        }));
-    }
-    async getSchemaStats() {
-        this.ensureInitialized();
-        const totalSchemas = this.db.prepare('SELECT COUNT(*) as cnt FROM schema_definitions').get().cnt;
-        const totalUsagePatterns = this.db.prepare('SELECT COUNT(*) as cnt FROM schema_usage').get().cnt;
-        const schemas = this.db.prepare('SELECT schema_json FROM schema_definitions').all();
-        const totalTables = schemas.reduce((acc, s) => {
-            const schema = tryParseJson(s.schema_json);
-            return acc + (schema?.databases?.reduce((dbAcc, db) => dbAcc + (db.tables?.length ?? 0), 0) ?? 0);
-        }, 0);
-        const mostUsedTables = this.db.prepare('SELECT table_name as tableName, COUNT(*) as usageCount FROM schema_usage GROUP BY table_name ORDER BY usageCount DESC LIMIT 10').all();
-        const usageByType = {};
-        const typeRows = this.db.prepare('SELECT usage_type, COUNT(*) as cnt FROM schema_usage GROUP BY usage_type').all();
-        for (const r of typeRows) {
-            usageByType[r.usage_type] = r.cnt;
-        }
-        return { totalSchemas, totalTables, totalUsagePatterns, mostUsedTables, usageByType };
-    }
-    async searchWithSchemaContext(query, options = {}) {
-        const searchResult = await this.searchFunctions(options);
+    async searchWithSchemaContext(options = {}) {
+        const searchResult = await this.search.searchFunctions(options);
         if (!options.includeSchemaUsage)
             return searchResult;
         const enhancedFunctions = await Promise.all(searchResult.functions.map(async (func) => {
-            const schemaUsage = await this.getSchemaUsage({
+            const schemaUsage = await this.schema.getSchemaUsage({
                 filePath: func.filePath,
                 functionName: func.name
             });
@@ -2957,322 +890,5 @@ export class CodeIndexDB {
             })))];
         return { ...searchResult, functions: enhancedFunctions, schemaContext };
     }
-    // ── Project tasks ───────────────────────────────────────────────────
-    getTaskRepository() {
-        this.ensureInitialized();
-        if (!this.taskRepository) {
-            this.taskRepository = new ProjectTaskRepository(() => this.tasksAdapter, () => { });
-        }
-        return this.taskRepository;
-    }
-    async createProjectTask(input) {
-        return this.getTaskRepository().create(input);
-    }
-    async getProjectTask(taskId) {
-        return this.getTaskRepository().getById(taskId);
-    }
-    async listProjectTasks(projectPath, options) {
-        return this.getTaskRepository().list(projectPath, options);
-    }
-    async listProjectTasksTree(projectPath, options) {
-        return this.getTaskRepository().listTree(projectPath, options);
-    }
-    async listActionableProjectTasks(projectPath, options) {
-        return this.getTaskRepository().listActionable(projectPath, options);
-    }
-    async completeProjectTask(taskId) {
-        return this.getTaskRepository().complete(taskId);
-    }
-    async updateProjectTask(taskId, patch) {
-        return this.getTaskRepository().update(taskId, patch);
-    }
-    async deleteProjectTask(taskId, mode) {
-        return this.getTaskRepository().delete(taskId, mode);
-    }
-    // ── Meta key-value store ─────────────────────────────────────────────
-    /** Upsert a key-value pair in the meta table. */
-    setMeta(key, value) {
-        this.ensureInitialized();
-        this.db.prepare(`INSERT INTO meta (key, value) VALUES (?, ?)
-       ON CONFLICT(key) DO UPDATE SET value = excluded.value`).run(key, value);
-    }
-    /** Retrieve a value from the meta table, or null if absent. */
-    getMeta(key) {
-        this.ensureInitialized();
-        const row = this.db.prepare('SELECT value FROM meta WHERE key = ?').get(key);
-        return row?.value ?? null;
-    }
-    // ── Provenance storage (Spec-21 R2 cross-file) ─────────────────────
-    /** Store per-file provenance context in the meta table. */
-    storeFileProvenance(filePath, provenanceData) {
-        const key = `provenance:${filePath}`;
-        this.setMeta(key, JSON.stringify(provenanceData));
-    }
-    /** Retrieve per-file provenance context, or null if not stored. */
-    getFileProvenance(filePath) {
-        const raw = this.getMeta(`provenance:${filePath}`);
-        if (!raw)
-            return null;
-        try {
-            return JSON.parse(raw);
-        }
-        catch {
-            return null;
-        }
-    }
-    /** Store the inferred receiver set as a meta record. */
-    storeInferredReceivers(inferred) {
-        this.setMeta('inferred_receivers', JSON.stringify(inferred));
-    }
-    /** Retrieve the inferred receiver set, or null if not stored. */
-    getInferredReceivers() {
-        const raw = this.getMeta('inferred_receivers');
-        if (!raw)
-            return null;
-        try {
-            return JSON.parse(raw);
-        }
-        catch {
-            return null;
-        }
-    }
-    // ── Coverage data (Spec 15 R4) ──────────────────────────────────────
-    /** Import coverage entries, replacing any existing data for the given basis. */
-    importCoverageData(entries) {
-        this.ensureInitialized();
-        // Group by basis so we only clear one basis at a time
-        const bases = new Set(entries.map(e => e.basis));
-        const clearStmt = this.db.prepare('DELETE FROM coverage_data WHERE basis = ?');
-        for (const basis of bases) {
-            clearStmt.run(basis);
-        }
-        const insert = this.db.prepare(`INSERT OR REPLACE INTO coverage_data (function_name, file_path, line_number, basis, covered, source, imported_at)
-       VALUES (?, ?, ?, ?, ?, ?, datetime('now'))`);
-        const tx = this.db.transaction((items) => {
-            for (const e of items) {
-                insert.run(e.functionName, e.filePath, e.lineNumber, e.basis, e.covered ? 1 : 0, e.source ?? null);
-            }
-        });
-        tx(entries);
-    }
-    /** Get all coverage entries for a given basis. */
-    getCoverageByBasis(basis) {
-        this.ensureInitialized();
-        const rows = this.db.prepare('SELECT * FROM coverage_data WHERE basis = ?').all(basis);
-        return rows.map((r) => ({
-            functionName: r.function_name,
-            filePath: r.file_path,
-            lineNumber: r.line_number,
-            basis: r.basis,
-            covered: r.covered === 1,
-            source: r.source,
-            importedAt: r.imported_at,
-        }));
-    }
-    /** Clear coverage data, optionally scoped to a single basis. */
-    clearCoverageData(basis) {
-        this.ensureInitialized();
-        if (basis) {
-            this.db.prepare('DELETE FROM coverage_data WHERE basis = ?').run(basis);
-        }
-        else {
-            this.db.prepare('DELETE FROM coverage_data').run();
-        }
-    }
-    /** Check if measured coverage data is stale (older than the last full sync). */
-    isCoverageStale() {
-        this.ensureInitialized();
-        const lastSync = this.getMeta('last_full_sync_timestamp');
-        if (!lastSync)
-            return false;
-        const staleRow = this.db.prepare(`SELECT COUNT(*) as cnt FROM coverage_data
-       WHERE basis = 'measured' AND imported_at < ?`).get(lastSync);
-        return (staleRow?.cnt ?? 0) > 0;
-    }
-    /** Get coverage rate by risk decile for the coverage report. */
-    getCoverageByRiskDecile(decileCount = 10) {
-        this.ensureInitialized();
-        // Rank functions by risk score from hotspot_scores, join with coverage_data
-        const rows = this.db.prepare(`
-      WITH ranked AS (
-        SELECT
-          f.name,
-          f.file_path,
-          f.line_number,
-          COALESCE(hs.score, 0.0) as risk_score,
-          NTILE(?) OVER (ORDER BY COALESCE(hs.score, 0.0) DESC) as decile
-        FROM functions f
-        LEFT JOIN hotspot_scores hs ON hs.target = (f.file_path || ':' || f.name)
-          AND hs.type = 'function'
-        WHERE f.is_exported = 1
-      ),
-      coverage AS (
-        SELECT DISTINCT function_name, file_path FROM coverage_data
-        WHERE covered = 1
-      )
-      SELECT
-        r.decile,
-        COUNT(*) as total,
-        SUM(CASE WHEN c.function_name IS NOT NULL THEN 1 ELSE 0 END) as covered
-      FROM ranked r
-      LEFT JOIN coverage c ON c.function_name = r.name AND c.file_path = r.file_path
-      GROUP BY r.decile
-      ORDER BY r.decile
-    `).all(decileCount);
-        return rows.map((r) => ({
-            decile: r.decile,
-            covered: r.covered,
-            total: r.total,
-            rate: r.total > 0 ? r.covered / r.total : 0,
-        }));
-    }
-    /** Get untested functions in the top risk decile. */
-    getUntestedTopDecile(topDecile = 0.1) {
-        this.ensureInitialized();
-        const rows = this.db.prepare(`
-      WITH ranked AS (
-        SELECT
-          f.name,
-          f.file_path,
-          f.line_number,
-          COALESCE(hs.score, 0.0) as risk_score,
-          PERCENT_RANK() OVER (ORDER BY COALESCE(hs.score, 0.0) DESC) as pct
-        FROM functions f
-        LEFT JOIN hotspot_scores hs ON hs.target = (f.file_path || ':' || f.name)
-          AND hs.type = 'function'
-        WHERE f.is_exported = 1
-      ),
-      best_coverage AS (
-        SELECT DISTINCT function_name, file_path, basis FROM coverage_data
-        WHERE covered = 1
-      )
-      SELECT
-        r.name,
-        r.file_path,
-        r.line_number,
-        r.risk_score,
-        COALESCE(bc.basis, 'static-reach') as basis
-      FROM ranked r
-      LEFT JOIN best_coverage bc ON bc.function_name = r.name AND bc.file_path = r.file_path
-      WHERE r.pct <= ?
-        AND bc.basis IS NULL
-      ORDER BY r.risk_score DESC
-    `).all(topDecile);
-        return rows.map((r) => ({
-            functionName: r.name,
-            filePath: r.file_path,
-            lineNumber: r.line_number ?? 1,
-            riskScore: r.risk_score,
-            basis: r.basis,
-        }));
-    }
-    /** Execute a parameterized query and return all rows. */
-    query(sql, params) {
-        this.ensureInitialized();
-        return params?.length
-            ? this.db.prepare(sql).all(...params)
-            : this.db.prepare(sql).all();
-    }
-    /** Count rows in a table, with optional WHERE clause. */
-    count(table, where, params) {
-        this.ensureInitialized();
-        assertSqlIdentifier(table, 'table name');
-        const whereClause = where ? ` WHERE ${where}` : '';
-        const row = this.db.prepare(`SELECT COUNT(*) as cnt FROM ${table}${whereClause}`).get(...(params ?? []));
-        return row.cnt;
-    }
-    /** Check if a table has any rows. */
-    tableHasRows(table) {
-        this.ensureInitialized();
-        assertSqlIdentifier(table, 'table name');
-        const row = this.db.prepare(`SELECT 1 FROM ${table} LIMIT 1`).get();
-        return row !== undefined;
-    }
-    /**
-     * Mine codebase conventions from the functions table and upsert into the
-     * conventions table. Content-hash-based skip: stored hash avoids re-mining
-     * when the function corpus hasn't changed since the last mine.
-     *
-     * Called both by deepSync() (after indexing) and by audit runs (so the
-     * conventions analyzer has data to query even without an explicit sync).
-     */
-    mineAllConventions(projectRoot, getSource) {
-        this.ensureInitialized();
-        const miningConfig = {
-            minCorpus: 20,
-            pairConfidence: 0.9,
-            modeShare: 0.8,
-            maxConventionsPerDomain: 200,
-        };
-        const newHash = computeMinerInputHash(this.db, miningConfig);
-        const oldHashRow = this.db.prepare("SELECT value FROM meta WHERE key = 'conventions_hash'").get();
-        if (!oldHashRow || oldHashRow.value !== newHash) {
-            const conventions = mineConventions(this.db, miningConfig, projectRoot, getSource);
-            const deleteStmt = this.db.prepare('DELETE FROM conventions');
-            const insertStmt = this.db.prepare(`INSERT INTO conventions
-         (domain, rule_id, antecedent, consequent, pattern, directory,
-          file_path, line, support, total_cases, confidence,
-          exemplar_file, exemplar_line, export_kind, hash)
-         VALUES (@domain, @rule_id, @antecedent, @consequent, @pattern,
-                 @directory, @file_path, @line, @support, @total_cases,
-                 @confidence, @exemplar_file, @exemplar_line, @export_kind, @hash)`);
-            const upsertAll = this.db.transaction(() => {
-                deleteStmt.run();
-                for (const c of conventions) {
-                    insertStmt.run({
-                        domain: c.domain,
-                        rule_id: c.rule_id,
-                        antecedent: c.antecedent ?? null,
-                        consequent: c.consequent ?? null,
-                        pattern: c.pattern ?? null,
-                        directory: c.directory ?? null,
-                        file_path: c.file_path ?? null,
-                        line: c.line ?? null,
-                        support: c.support,
-                        total_cases: c.total_cases,
-                        confidence: c.confidence,
-                        exemplar_file: c.exemplar_file ?? null,
-                        exemplar_line: c.exemplar_line ?? null,
-                        export_kind: c.export_kind ?? null,
-                        hash: c.hash ?? null,
-                    });
-                }
-            });
-            upsertAll();
-            // Only store the hash when conventions were actually produced.
-            // Storing it on an empty mine would be a poison pill — the hash
-            // would match on every subsequent run, skipping mining forever.
-            if (conventions.length > 0) {
-                this.db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('conventions_hash', ?)").run(newHash);
-            }
-        }
-    }
-    /** Execute a DML statement (INSERT/UPDATE/DELETE) and return its result. */
-    run(sql, params) {
-        this.ensureInitialized();
-        return params?.length
-            ? this.db.prepare(sql).run(...params)
-            : this.db.prepare(sql).run();
-    }
-    /** Execute raw SQL (multi-statement) — for schema setup / bulk operations. */
-    exec(sql) {
-        this.ensureInitialized();
-        this.db.exec(sql);
-    }
-}
-// ── Helpers ────────────────────────────────────────────────────────────
-function tryParseJson(val) {
-    if (val === null || val === undefined)
-        return null;
-    if (typeof val === 'object')
-        return val;
-    if (typeof val !== 'string')
-        return val;
-    try {
-        return JSON.parse(val);
-    }
-    catch {
-        return val;
-    }
 }
 //# sourceMappingURL=codeIndexDB.js.map