codesift-mcp 0.13.1 → 0.15.0

package/dist/storage/sqlite/accessors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessors.js","sourceRoot":"","sources":["../../../src/storage/sqlite/accessors.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAqB,MAAM,WAAW,CAAC;AAC9D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,WAAW,EACX,WAAW,GAGZ,MAAM,WAAW,CAAC;AAEnB;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAI,MAAc,EAAE,IAAa;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,QAAgB;IAEhB,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE;QAClC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAEnE,CAAC;QACd,OAAO,GAAG,EAAE,QAAQ,IAAI,SAAS,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc;IACzD,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,MAAoC,CAAC;IACzC,IAAI,GAAG,GAAwB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,4FAA4F;QAC5F,iFAAiF;QACjF,6FAA6F;QAC7F,8FAA8F;QAC9F,qFAAqF;QACrF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,GAAG,QAAQ,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACxB,OAAO,IAAI,CAAC,CAAC,gCAAgC;YAC/C,CAAC;YAED,0FAA0F;YAC1F,4FAA4F;YAC5F,sEAAsE;YACtE,MAAM,KAAK,GACT,QAAQ,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAC3D,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,GAAG,EAE5D,CAAC;YAEd,MAAM,OAAO,GAAiB;gBAC5B,IAAI;gBACJ,IAAI;gBACJ,KAAK;gBACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC3C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC3C,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrC,UAAU,EAAE,KAAK,CAAC,MAAM;aACzB,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAE7C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,GAAG,GAAG,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,QAAgB;IAEhB,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE;QAClC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAE5D,CAAC;QACd,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,WAAmB,EACnB,UAAwB,EACxB,SAAqB;IAErB,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAErC,IAAI,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,GAAI,WAAW,CAAC,GAAG,CAAa,CAAC,CAAC;QAE3E,IAAI,SAAS;YAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,GAAI,cAAc,CAAC,SAAS,CAAa,CAAC,CAAC;QAE1F,cAAc,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,eAAe,CAAC,EAAE,CAAC,CAAC;QACpB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,WAAmB;IAEnB,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,oBAAoB;IAEzE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClE,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChE,cAAc,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,eAAe,CAAC,EAAE,CAAC,CAAC;QACpB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,QAAgB;IAEhB,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CAAC,sCAAsC,CAAC;aAC/C,GAAG,CAAC,QAAQ,CAA2B,CAAC;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE;QAClC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA8B,CAAC;QAChF,OAAO,GAAG,CAAC,YAAY,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/storage/sqlite/connection.d.ts

@@ -0,0 +1,43 @@
+import type { DatabaseSync as DatabaseSyncType } from "node:sqlite";
+/**
+ * ROLLBACK that cannot replace the error that caused it.
+ *
+ * SQLite rolls back automatically on the faults that matter most here — `SQLITE_FULL`,
+ * `SQLITE_IOERR`, `SQLITE_NOMEM`, `SQLITE_INTERRUPT` — so an explicit ROLLBACK in the catch block
+ * then throws `cannot rollback - no transaction is active`, and THAT is what propagates. Verified
+ * on node v24.18.0: a write that failed with `database or disk is full` (errcode 13) arrived at
+ * the caller as a rollback complaint instead, which classifies as nothing at all.
+ *
+ * Losing the transaction is not the risk — SQLite already ended it. Losing the diagnosis is.
+ */
+export declare function rollbackQuietly(db: DatabaseSyncType): void;
+/**
+ * Open (and cache) a connection, creating the schema on first use.
+ *
+ * WAL is the reason this migration solves a problem a sharded JSON layout would not: the MCP
+ * server and the `codesift postindex-file` hook are separate processes writing the same
+ * index, and WAL gives them concurrent readers with a single writer instead of a corruption
+ * window. `busy_timeout` makes a writer wait its turn rather than throwing SQLITE_BUSY when
+ * an agent edits files faster than the previous write settles.
+ */
+export declare function openIndexDb(dbPath: string): Promise<DatabaseSyncType>;
+/** Close one cached connection (tests, and the shutdown path). */
+export declare function closeIndexDb(dbPath: string): void;
+export declare function closeAllIndexDbs(): void;
+/**
+ * Open a second connection for reading only.
+ *
+ * The paged read in `index-io.ts` yields to the event loop between pages, and the cached
+ * connection is shared by every request in this process — so a write landing mid-traversal would
+ * let one `CodeIndex` be assembled out of two different database states. Holding a read
+ * transaction on the SHARED connection cannot fix that: any write arriving during the yield would
+ * hit "cannot start a transaction within a transaction".
+ *
+ * A private connection in WAL mode sees a stable snapshot from `BEGIN` to `COMMIT` regardless of
+ * what other connections commit meanwhile. It costs one open per cold load, which happens once
+ * per process per repo.
+ */
+export declare function openReadConnection(dbPath: string): Promise<DatabaseSyncType>;
+export declare function readMetaValue(db: DatabaseSyncType, key: string): string | undefined;
+export declare function writeMetaValue(db: DatabaseSyncType, key: string, value: string): void;
+//# sourceMappingURL=connection.d.ts.map

package/dist/storage/sqlite/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/storage/sqlite/connection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,IAAI,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAiBpE;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,gBAAgB,GAAG,IAAI,CAO1D;AAmBD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgB3E;AA+FD,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CASjD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgBlF;AAMD,wBAAgB,aAAa,CAAC,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnF;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrF"}

package/dist/storage/sqlite/connection.js

@@ -0,0 +1,241 @@
+import { mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
+import { IndexStorageError, rethrowOperational } from "./errors.js";
+import { loadSqliteCtor } from "./runtime.js";
+import { MIGRATE_V1_TO_V2_SQL, SCHEMA_SQL, SCHEMA_VERSION } from "./schema.js";
+/**
+ * Connection handling, schema creation, migration, and the `meta` key/value accessors.
+ *
+ * The open-connection cache lives HERE and nowhere else. One cache is the whole point: two
+ * modules each holding their own `connections` map would each hand out a different handle for the
+ * same path, so `closeIndexDb` would close one and leave the other open, and a write through one
+ * would be invisible to a `PRAGMA data_version` read through the other. Type-checking, linting and
+ * most tests all pass over that, which is exactly why it is called out.
+ */
+const connections = new Map();
+/**
+ * ROLLBACK that cannot replace the error that caused it.
+ *
+ * SQLite rolls back automatically on the faults that matter most here — `SQLITE_FULL`,
+ * `SQLITE_IOERR`, `SQLITE_NOMEM`, `SQLITE_INTERRUPT` — so an explicit ROLLBACK in the catch block
+ * then throws `cannot rollback - no transaction is active`, and THAT is what propagates. Verified
+ * on node v24.18.0: a write that failed with `database or disk is full` (errcode 13) arrived at
+ * the caller as a rollback complaint instead, which classifies as nothing at all.
+ *
+ * Losing the transaction is not the risk — SQLite already ended it. Losing the diagnosis is.
+ */
+export function rollbackQuietly(db) {
+    try {
+        db.exec("ROLLBACK");
+    }
+    catch {
+        /* already rolled back by SQLite, or the handle is gone — either way the original error is
+           the one worth reporting */
+    }
+}
+/**
+ * Opens that have started but not yet reached `connections`.
+ *
+ * Without this, `openIndexDb` is a check-then-act straddling two awaits (`loadSqliteCtor`, then
+ * `mkdir`): two concurrent callers both miss the cache, both construct a handle, and the second
+ * `connections.set` overwrites the first. The orphan is not in the map, so `closeIndexDb` and
+ * `closeAllIndexDbs` can never reach it — a leaked descriptor and a WAL read mark for the life of
+ * the process, arriving on exactly the EMFILE/BUSY conditions the rest of this file works to avoid.
+ * Reproducible with `Promise.all([openIndexDb(p), openIndexDb(p)])`, and reachable in production
+ * because a save and a read can race on a cold cache.
+ *
+ * Known and unchanged: a `closeIndexDb` issued WHILE an open is in flight does not cancel it, so
+ * the completing open still populates the cache. That is a narrower window than the one closed
+ * here, and pretending otherwise in a comment is how the previous defect survived.
+ */
+const opening = new Map();
+/**
+ * Open (and cache) a connection, creating the schema on first use.
+ *
+ * WAL is the reason this migration solves a problem a sharded JSON layout would not: the MCP
+ * server and the `codesift postindex-file` hook are separate processes writing the same
+ * index, and WAL gives them concurrent readers with a single writer instead of a corruption
+ * window. `busy_timeout` makes a writer wait its turn rather than throwing SQLITE_BUSY when
+ * an agent edits files faster than the previous write settles.
+ */
+export async function openIndexDb(dbPath) {
+    const cached = connections.get(dbPath);
+    if (cached)
+        return cached;
+    const inFlight = opening.get(dbPath);
+    if (inFlight)
+        return inFlight;
+    const attempt = openUncachedIndexDb(dbPath);
+    opening.set(dbPath, attempt);
+    try {
+        return await attempt;
+    }
+    finally {
+        // Safe to drop once settled: `openUncachedIndexDb` populates `connections` before it resolves,
+        // so any caller arriving after this point hits the cache instead.
+        opening.delete(dbPath);
+    }
+}
+async function openUncachedIndexDb(dbPath) {
+    const Ctor = await loadSqliteCtor();
+    if (!Ctor)
+        throw new Error("node:sqlite is unavailable (requires Node >= 22.5)");
+    if (dbPath !== ":memory:")
+        await mkdir(dirname(dbPath), { recursive: true });
+    let db;
+    try {
+        db = new Ctor(dbPath);
+        db.exec("PRAGMA journal_mode = WAL");
+        db.exec("PRAGMA busy_timeout = 5000");
+        db.exec("PRAGMA foreign_keys = ON");
+        db.exec(SCHEMA_SQL);
+    }
+    catch (err) {
+        // Close before rethrowing: the constructor can succeed and a PRAGMA still fail, and this
+        // handle never reaches the `connections` cache, so nothing else would ever close it. On a
+        // retry loop against a sick database that leaks a descriptor and a lock per attempt —
+        // which makes the very BUSY/EMFILE conditions being reported worse.
+        try {
+            db?.close();
+        }
+        catch {
+            /* already dead — the original fault is the one worth reporting */
+        }
+        // A corrupt or unopenable file fails here, before any row is read — the one place where
+        // "cannot open" would otherwise look exactly like "nothing indexed yet".
+        rethrowOperational(err, dbPath);
+    }
+    // Classified like the block above, and for a reason that is not obvious: `CREATE TABLE IF NOT
+    // EXISTS` can succeed on a database whose DATA pages are corrupt, because it only consults
+    // sqlite_schema. The first statement that actually reads a page is this one — so on real
+    // corruption the fault surfaces HERE, outside the guard, and reached callers unwrapped. Found by
+    // a test that was aiming at something else; the audits did not catch it either.
+    let stored;
+    try {
+        stored = readMetaValue(db, "schema_version");
+    }
+    catch (err) {
+        try {
+            db.close();
+        }
+        catch { /* not cached yet — nothing else would ever close it */ }
+        rethrowOperational(err, dbPath);
+    }
+    if (stored === undefined) {
+        writeMetaValue(db, "schema_version", String(SCHEMA_VERSION));
+    }
+    else if (Number(stored) > SCHEMA_VERSION) {
+        try {
+            db.close();
+        }
+        catch { /* a throwing close must not mask the message below */ }
+        // An IndexStorageError, not a plain one, and the difference is the whole point: every read
+        // path that routes through `workspace-scope-helper.ts` does
+        // `if (isIndexStorageError(err)) throw err;` and otherwise collapses the failure to
+        // `index = null`. As a plain Error this instruction — the one thing that tells the user how to
+        // fix it — was swallowed, and the tool reported an empty repo.
+        throw new IndexStorageError(`Index at ${dbPath} was written by a newer CodeSift (schema v${stored} > v${SCHEMA_VERSION}). Upgrade codesift-mcp.`, "SCHEMA_TOO_NEW", dbPath);
+    }
+    else if (Number(stored) < SCHEMA_VERSION) {
+        // One transaction: a half-applied table swap would leave `symbols_v1` as the only copy
+        // of the rows, under a name nothing reads.
+        try {
+            db.exec("BEGIN IMMEDIATE");
+            // Re-read UNDER the lock. The version above was read before `BEGIN IMMEDIATE`, so two
+            // processes opening the same index at once both saw `stored < 2` and both queued the
+            // migration; the second then re-copied a table that was already v2. Harmless — v2 has no
+            // PRIMARY KEY, so nothing is dropped — but it is a full-table copy of a repo-sized table
+            // done for nothing, and on a large index that is seconds of wall clock plus the disk churn.
+            // The lock is the only point at which the answer is stable, so this is where to ask.
+            // Fall through rather than return early: the connection still has to reach `connections`
+            // below, and an early return here would quietly stop caching it for the racing process.
+            const current = Number(readMetaValue(db, "schema_version") ?? 0);
+            if (current < SCHEMA_VERSION && current < 2) {
+                db.exec(MIGRATE_V1_TO_V2_SQL);
+                // The rebuild keeps every row the v1 table still HELD — it cannot bring back the ones
+                // v1 already discarded on id collision (73,165 across 16 indexes when this was found).
+                // Without this marker the upgraded database looks like any other complete v2 index, so
+                // a caller would read a short symbol list as a fact about the code. Only a full reindex
+                // from source can restore them, and `saveIndexSqlite` clears the flag when it does.
+                writeMetaValue(db, "lossy_v1_migration", "1");
+            }
+            if (current < SCHEMA_VERSION) {
+                writeMetaValue(db, "schema_version", String(SCHEMA_VERSION));
+            }
+            db.exec("COMMIT");
+        }
+        catch (err) {
+            rollbackQuietly(db);
+            try {
+                db.close();
+            }
+            catch { /* already dead */ }
+            rethrowOperational(err, dbPath);
+        }
+    }
+    connections.set(dbPath, db);
+    return db;
+}
+/** Close one cached connection (tests, and the shutdown path). */
+export function closeIndexDb(dbPath) {
+    const db = connections.get(dbPath);
+    if (!db)
+        return;
+    connections.delete(dbPath);
+    try {
+        db.close();
+    }
+    catch {
+        /* already closed — nothing to protect here */
+    }
+}
+export function closeAllIndexDbs() {
+    for (const path of [...connections.keys()])
+        closeIndexDb(path);
+}
+/**
+ * Open a second connection for reading only.
+ *
+ * The paged read in `index-io.ts` yields to the event loop between pages, and the cached
+ * connection is shared by every request in this process — so a write landing mid-traversal would
+ * let one `CodeIndex` be assembled out of two different database states. Holding a read
+ * transaction on the SHARED connection cannot fix that: any write arriving during the yield would
+ * hit "cannot start a transaction within a transaction".
+ *
+ * A private connection in WAL mode sees a stable snapshot from `BEGIN` to `COMMIT` regardless of
+ * what other connections commit meanwhile. It costs one open per cold load, which happens once
+ * per process per repo.
+ */
+export async function openReadConnection(dbPath) {
+    const Ctor = await loadSqliteCtor();
+    if (!Ctor)
+        throw new Error("node:sqlite is unavailable (requires Node >= 22.5)");
+    const db = new Ctor(dbPath);
+    // The constructor can succeed and the PRAGMA still fail — corruption and I/O faults often
+    // surface on the first statement, not at open. This handle never reaches the `connections`
+    // cache, and the caller's `finally` only closes what it managed to assign, so an unguarded
+    // throw here leaks a descriptor on every attempt. Same guard as `openIndexDb`, same reason;
+    // it was missing here only because this connection is deliberately not cached.
+    try {
+        db.exec("PRAGMA busy_timeout = 5000");
+    }
+    catch (err) {
+        try {
+            db.close();
+        }
+        catch { /* already unusable — the leak is what we came to prevent */ }
+        throw err;
+    }
+    return db;
+}
+// ---------------------------------------------------------------------------
+// meta helpers
+// ---------------------------------------------------------------------------
+export function readMetaValue(db, key) {
+    const row = db.prepare("SELECT value FROM meta WHERE key = ?").get(key);
+    return row?.value;
+}
+export function writeMetaValue(db, key, value) {
+    db.prepare("INSERT INTO meta(key, value) VALUES(?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
+}
+//# sourceMappingURL=connection.js.map

package/dist/storage/sqlite/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/storage/sqlite/connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE/E;;;;;;;;GAQG;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;AAExD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAAoB;IAClD,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP;qCAC6B;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqC,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,+FAA+F;QAC/F,kEAAkE;QAClE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc;IAC/C,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAEjF,IAAI,MAAM,KAAK,UAAU;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7E,IAAI,EAAgC,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACrC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACtC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACpC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,oEAAoE;QACpE,IAAI,CAAC;YACH,EAAE,EAAE,KAAK,EAAE,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,wFAAwF;QACxF,yEAAyE;QACzE,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,8FAA8F;IAC9F,2FAA2F;IAC3F,yFAAyF;IACzF,iGAAiG;IACjG,gFAAgF;IAChF,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uDAAuD,CAAC,CAAC;QACrF,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,cAAc,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;QAC3C,IAAI,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;QACpF,2FAA2F;QAC3F,4DAA4D;QAC5D,oFAAoF;QACpF,+FAA+F;QAC/F,+DAA+D;QAC/D,MAAM,IAAI,iBAAiB,CACzB,YAAY,MAAM,6CAA6C,MAAM,OAAO,cAAc,0BAA0B,EACpH,gBAAgB,EAChB,MAAM,CACP,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;QAC3C,uFAAuF;QACvF,2CAA2C;QAC3C,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3B,sFAAsF;YACtF,qFAAqF;YACrF,yFAAyF;YACzF,yFAAyF;YACzF,4FAA4F;YAC5F,qFAAqF;YACrF,yFAAyF;YACzF,wFAAwF;YACxF,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,IAAI,OAAO,GAAG,cAAc,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAC5C,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC9B,sFAAsF;gBACtF,uFAAuF;gBACvF,uFAAuF;gBACvF,wFAAwF;gBACxF,oFAAoF;gBACpF,cAAc,CAAC,EAAE,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,OAAO,GAAG,cAAc,EAAE,CAAC;gBAC7B,cAAc,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,EAAE,CAAC,CAAC;YACpB,IAAI,CAAC;gBAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAChD,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QAAE,YAAY,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACjF,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F,4FAA4F;IAC5F,+EAA+E;IAC/E,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,UAAU,aAAa,CAAC,EAAoB,EAAE,GAAW;IAC7D,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,GAAG,CAEzD,CAAC;IACd,OAAO,GAAG,EAAE,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAoB,EAAE,GAAW,EAAE,KAAa;IAC7E,EAAE,CAAC,OAAO,CACR,iGAAiG,CAClG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/storage/sqlite/errors.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Operational failures of the index store, as distinct from "this repo has no index".
+ *
+ * Pure classification: no database handle, no filesystem, no dependency on any other module here.
+ * That is deliberate — every other module in this backend rethrows through `rethrowOperational`,
+ * so anything this file imported would become a dependency of the whole backend.
+ */
+/**
+ * A storage fault, as distinct from "this repo has no index".
+ *
+ * Both used to arrive at callers as `null`, so a locked or corrupt database was indistinguishable
+ * from an unindexed repo: tools reported "not indexed" (prompting a pointless full reindex over a
+ * database that was merely busy) or returned empty results that read as an authoritative "no
+ * matches". Empty-because-broken is the worst answer an index can give, because nothing about it
+ * looks wrong.
+ */
+export declare class IndexStorageError extends Error {
+    readonly code: string;
+    readonly path: string;
+    constructor(message: string, code: string, path: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Structural check, not `instanceof`.
+ *
+ * A duplicated module instance (bundler, worker/thread boundary, a test importing through a
+ * different specifier) makes `instanceof` false for an object that is in every observable way
+ * the right error — and the failure mode is silent: the fault falls into the "unexpected error"
+ * branch and gets reported as an unindexed repo, which is the exact bug this file exists to
+ * prevent.
+ */
+export declare function isIndexStorageError(err: unknown): err is IndexStorageError;
+/** The operational code for `err`, or null when it is not an operational failure. */
+export declare function classifyStorageError(err: unknown): string | null;
+/** Rethrow operational faults as IndexStorageError; leave everything else untouched. */
+export declare function rethrowOperational(err: unknown, path: string): never;
+//# sourceMappingURL=errors.d.ts.map

package/dist/storage/sqlite/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/storage/sqlite/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAGxC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACE,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAI9B;CACF;AA2DD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,iBAAiB,CAO1E;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAoChE;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAWpE"}

package/dist/storage/sqlite/errors.js

@@ -0,0 +1,150 @@
+/**
+ * Operational failures of the index store, as distinct from "this repo has no index".
+ *
+ * Pure classification: no database handle, no filesystem, no dependency on any other module here.
+ * That is deliberate — every other module in this backend rethrows through `rethrowOperational`,
+ * so anything this file imported would become a dependency of the whole backend.
+ */
+/**
+ * A storage fault, as distinct from "this repo has no index".
+ *
+ * Both used to arrive at callers as `null`, so a locked or corrupt database was indistinguishable
+ * from an unindexed repo: tools reported "not indexed" (prompting a pointless full reindex over a
+ * database that was merely busy) or returned empty results that read as an authoritative "no
+ * matches". Empty-because-broken is the worst answer an index can give, because nothing about it
+ * looks wrong.
+ */
+export class IndexStorageError extends Error {
+    code;
+    path;
+    constructor(message, code, path, options) {
+        super(message, options);
+        this.code = code;
+        this.path = path;
+        this.name = "IndexStorageError";
+    }
+}
+/**
+ * Codes that mean "the store is there but unusable right now", never "there is nothing here".
+ *
+ * Deliberately a tight allowlist. Classifying too broadly would convert ordinary absence into a
+ * thrown error on a hot path used by ~every tool, which is a worse failure than the one being
+ * fixed — so anything unrecognised keeps the previous null-ish behaviour.
+ */
+const OPERATIONAL_CODES = new Set([
+    "SQLITE_BUSY",
+    "SQLITE_LOCKED",
+    "SQLITE_CORRUPT",
+    "SQLITE_NOTADB",
+    "SQLITE_CANTOPEN",
+    "SQLITE_IOERR",
+    "SQLITE_READONLY",
+    "SQLITE_PERM",
+    "SQLITE_FULL",
+    "EACCES",
+    "EPERM",
+    "EIO",
+    "EBUSY",
+    "ENOSPC",
+    "EMFILE",
+]);
+/**
+ * SQLite primary result codes, by number — the path that actually fires for `node:sqlite`.
+ *
+ * The driver sets `code = "ERR_SQLITE_ERROR"` on EVERY sqlite fault and puts the real result code
+ * in `errcode` (numeric) with its text in `errstr`. So the string allowlist below never matched a
+ * sqlite fault at all; only the four message regexes did, and only by accident of wording.
+ * Measured on node v24.18.0:
+ *
+ *     not-a-database   code=ERR_SQLITE_ERROR  errcode=26  errstr=file is not a database
+ *     readonly write   code=ERR_SQLITE_ERROR  errcode=8   errstr=attempt to write a readonly database
+ *     disk full        code=ERR_SQLITE_ERROR  errcode=13  errstr=database or disk is full
+ *
+ * `SQLITE_FULL`, `SQLITE_READONLY` and `SQLITE_PERM` are listed in the allowlist as must-classify
+ * and returned `null` for the entire life of that allowlist: a full disk reported as "this repo
+ * has no index". Numbers are the only form the driver actually gives, so they are what we read.
+ *
+ * Masked with `& 0xff` because SQLite's extended codes are `primary | (sub << 8)` — 266 is
+ * SQLITE_IOERR_READ, and 266 & 0xff is 10, SQLITE_IOERR. Reporting the primary code keeps the
+ * vocabulary the allowlist speaks; the detail survives in the message.
+ */
+const SQLITE_RESULT_CODES = new Map([
+    [3, "SQLITE_PERM"],
+    [5, "SQLITE_BUSY"],
+    [6, "SQLITE_LOCKED"],
+    [8, "SQLITE_READONLY"],
+    [10, "SQLITE_IOERR"],
+    [11, "SQLITE_CORRUPT"],
+    [13, "SQLITE_FULL"],
+    [14, "SQLITE_CANTOPEN"],
+    [26, "SQLITE_NOTADB"],
+]);
+/**
+ * Structural check, not `instanceof`.
+ *
+ * A duplicated module instance (bundler, worker/thread boundary, a test importing through a
+ * different specifier) makes `instanceof` false for an object that is in every observable way
+ * the right error — and the failure mode is silent: the fault falls into the "unexpected error"
+ * branch and gets reported as an unindexed repo, which is the exact bug this file exists to
+ * prevent.
+ */
+export function isIndexStorageError(err) {
+    return (typeof err === "object" &&
+        err !== null &&
+        err.name === "IndexStorageError" &&
+        typeof err.code === "string");
+}
+/** The operational code for `err`, or null when it is not an operational failure. */
+export function classifyStorageError(err) {
+    // Structural, not `instanceof`, for the reason spelled out on `isIndexStorageError`: a duplicated
+    // module instance makes `instanceof` false for an object that is in every observable way the
+    // right error, and the fault then falls through to "unexpected" — reported as an unindexed repo.
+    if (isIndexStorageError(err))
+        return err.code;
+    if (typeof err !== "object" || err === null)
+        return null;
+    // `errcode` first: it is the only field `node:sqlite` puts the real result code in.
+    const errcode = err.errcode;
+    if (typeof errcode === "number") {
+        const primary = SQLITE_RESULT_CODES.get(errcode & 0xff);
+        if (primary !== undefined)
+            return primary;
+    }
+    const code = err.code;
+    if (typeof code === "string") {
+        if (OPERATIONAL_CODES.has(code))
+            return code;
+        // Kept for error sources that DO name codes as strings — filesystem faults from `mkdir`, and
+        // other sqlite bindings (better-sqlite3 sets `code: "SQLITE_IOERR_READ"`). `node:sqlite` is
+        // not one of them; see SQLITE_RESULT_CODES.
+        for (const known of OPERATIONAL_CODES) {
+            if (known.startsWith("SQLITE_") && code.startsWith(`${known}_`))
+                return code;
+        }
+    }
+    // Last resort, for a build or binding that carries the reason only in prose.
+    const message = err.message;
+    if (typeof message === "string") {
+        if (/database disk image is malformed|file is not a database/i.test(message)) {
+            return "SQLITE_CORRUPT";
+        }
+        if (/database is locked|database table is locked/i.test(message))
+            return "SQLITE_BUSY";
+        if (/unable to open database/i.test(message))
+            return "SQLITE_CANTOPEN";
+        if (/disk I\/O error/i.test(message))
+            return "SQLITE_IOERR";
+    }
+    return null;
+}
+/** Rethrow operational faults as IndexStorageError; leave everything else untouched. */
+export function rethrowOperational(err, path) {
+    const code = classifyStorageError(err);
+    if (code === null)
+        throw err;
+    if (isIndexStorageError(err))
+        throw err; // already classified — do not re-wrap
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new IndexStorageError(`index storage at ${path} is unreadable (${code}): ${detail}`, code, path, { cause: err });
+}
+//# sourceMappingURL=errors.js.map

package/dist/storage/sqlite/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/storage/sqlite/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG/B,IAAI;IACJ,IAAI;IAHf,YACE,OAAe,EACN,IAAY,EACZ,IAAY,EACrB,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAuB,CAAC,CAAC;oBAJ/B,IAAI;oBACJ,IAAI;QAIb,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,QAAQ;IACR,OAAO;IACP,KAAK;IACL,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAiB;IAClD,CAAC,CAAC,EAAE,aAAa,CAAC;IAClB,CAAC,CAAC,EAAE,aAAa,CAAC;IAClB,CAAC,CAAC,EAAE,eAAe,CAAC;IACpB,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACtB,CAAC,EAAE,EAAE,cAAc,CAAC;IACpB,CAAC,EAAE,EAAE,gBAAgB,CAAC;IACtB,CAAC,EAAE,EAAE,aAAa,CAAC;IACnB,CAAC,EAAE,EAAE,iBAAiB,CAAC;IACvB,CAAC,EAAE,EAAE,eAAe,CAAC;CACtB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACX,GAA0B,CAAC,IAAI,KAAK,mBAAmB;QACxD,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ,CACrD,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,kGAAkG;IAClG,6FAA6F;IAC7F,iGAAiG;IACjG,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEzD,oFAAoF;IACpF,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,6FAA6F;QAC7F,4FAA4F;QAC5F,4CAA4C;QAC5C,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;IACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,0DAA0D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,aAAa,CAAC;QACvF,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,iBAAiB,CAAC;QACvE,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,cAAc,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,IAAY;IAC3D,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,GAAG,CAAC;IAC7B,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,MAAM,GAAG,CAAC,CAAC,sCAAsC;IAC/E,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,IAAI,mBAAmB,IAAI,MAAM,MAAM,EAAE,EAC7D,IAAI,EACJ,IAAI,EACJ,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;AACJ,CAAC"}

package/dist/storage/sqlite/index-io.d.ts

@@ -0,0 +1,49 @@
+import type { CodeIndex } from "../../types.js";
+/**
+ * Whole-index read and write: the paths that touch every row.
+ *
+ * These are the operations the narrow accessors exist to avoid, kept together because they share
+ * the same two invariants — one transaction per logical read, and `repo` written last so a
+ * half-written index reads as empty rather than as a complete one.
+ */
+/**
+ * Replace the entire index. Used by full (re)indexing and by JSON->SQLite migration.
+ *
+ * `sourceComplete` means every symbol in `index` came from parsing the file it belongs to during
+ * THIS run — the only condition under which the `lossy_v1_migration` marker can honestly be
+ * cleared. It defaults to false, and the default is the point: rewriting every row is NOT the
+ * same as re-reading every file. `index_folder` reuses cached symbols for files whose mtime has
+ * not moved, and `enqueueIndexMutation` folds a single-file edit into a whole-index rewrite that
+ * arrives here indistinguishable from a real reindex. An earlier version cleared the marker on
+ * any call and so erased the warning on the next keystroke after an upgrade.
+ *
+ * Defaulting to "still lossy" errs toward over-warning, which a reindex clears, rather than
+ * toward silence, which nothing does.
+ */
+export declare function saveIndexSqlite(dbPath: string, index: CodeIndex, opts?: {
+    sourceComplete?: boolean;
+}): Promise<void>;
+/**
+ * True when this database was upgraded from the v1 schema, whose PRIMARY KEY on a non-unique
+ * `symbols.id` silently discarded colliding rows. The rebuild preserved everything still stored,
+ * but cannot recover what was already gone — so a short symbol list here is a fact about the
+ * migration, not about the code. Cleared by a full reindex.
+ */
+export declare function wasLossilyMigrated(dbPath: string): Promise<boolean>;
+/**
+ * Import a legacy JSON index, but only if this db is still empty — decided and written
+ * inside ONE `BEGIN IMMEDIATE` transaction.
+ *
+ * The check-then-act cannot be done in JS: `codesift postindex-file` is a fresh process per
+ * edit, so two of them (or one plus the server) can both observe an empty db, both read the
+ * same legacy JSON, and the slower writer then overwrites an incremental update the faster
+ * one already committed. An in-process guard cannot see the other process at all.
+ *
+ * `BEGIN IMMEDIATE` takes the write lock before the emptiness check, so the second writer
+ * either waits and then sees the committed import (returns false), or fails on busy_timeout —
+ * never silently clobbers. Returns true when this call performed the import.
+ */
+export declare function importLegacyIndexIfEmpty(dbPath: string, index: CodeIndex): Promise<boolean>;
+/** Materialise the whole index. Returns null when the db has never been written to. */
+export declare function loadIndexSqlite(dbPath: string): Promise<CodeIndex | null>;
+//# sourceMappingURL=index-io.d.ts.map

package/dist/storage/sqlite/index-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-io.d.ts","sourceRoot":"","sources":["../../../src/storage/sqlite/index-io.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,gBAAgB,CAAC;AAyBvE;;;;;;GAMG;AAEH;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,EAChB,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGzE;AA4BD;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAgFD,uFAAuF;AACvF,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAkF/E"}