septum 0.1.0

package/src/cli/templates/hooks.ts

@@ -0,0 +1,75 @@
+export const SEPTUM_HOOKS_CONFIG = {
+  "septum-boundary-guard": {
+    "PreToolUse": [
+      {
+        "matcher": "write_to_file|replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sh -c 'HOOK=\"$(git rev-parse --show-toplevel 2>/dev/null)/.agents/hooks/septum-pre-write.sh\"; if [ -f \"$HOOK\" ]; then exec \"$HOOK\"; else exit 0; fi'",
+            "timeout": 10,
+          },
+        ],
+      },
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "write_to_file|replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sh -c 'HOOK=\"$(git rev-parse --show-toplevel 2>/dev/null)/.agents/hooks/septum-post-write.sh\"; if [ -f \"$HOOK\" ]; then exec \"$HOOK\"; else exit 0; fi'",
+            "timeout": 15,
+          },
+        ],
+      },
+    ],
+  },
+};
+
+export const SEPTUM_PRE_WRITE_SCRIPT = `#!/usr/bin/env sh
+# Septum 3-Gate Boundary Guard Pre-Write Hook
+# Intercepts write_to_file and replace_file_content before disk mutation
+
+ROOT_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+if [ ! -f "$ROOT_DIR/.septum/septum.db" ]; then
+  exit 0
+fi
+
+# Delegate directly to Septum's active 3-gate hook engine
+if command -v bun >/dev/null 2>&1 && [ -f "$ROOT_DIR/bin/septum.ts" ]; then
+  exec bun run "$ROOT_DIR/bin/septum.ts" hook pre-write
+elif command -v septum >/dev/null 2>&1; then
+  exec septum hook pre-write
+elif [ -f "$ROOT_DIR/node_modules/.bin/septum" ]; then
+  exec "$ROOT_DIR/node_modules/.bin/septum" hook pre-write
+elif command -v bunx >/dev/null 2>&1; then
+  exec bunx septum hook pre-write
+fi
+
+exit 0
+`;
+
+export const SEPTUM_POST_WRITE_SCRIPT = `#!/usr/bin/env sh
+# Septum Automated Incremental Post-Write Hook
+# Syncs modified AST into SQLite SSOT after file mutations
+
+ROOT_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+if [ ! -f "$ROOT_DIR/.septum/septum.db" ]; then
+  exit 0
+fi
+
+# Trigger background incremental sync
+if command -v bun >/dev/null 2>&1 && [ -f "$ROOT_DIR/bin/septum.ts" ]; then
+  bun run "$ROOT_DIR/bin/septum.ts" sync --json >/dev/null 2>&1 &
+elif command -v septum >/dev/null 2>&1; then
+  septum sync --json >/dev/null 2>&1 &
+elif [ -f "$ROOT_DIR/node_modules/.bin/septum" ]; then
+  "$ROOT_DIR/node_modules/.bin/septum" sync --json >/dev/null 2>&1 &
+elif command -v bunx >/dev/null 2>&1; then
+  bunx septum sync --json >/dev/null 2>&1 &
+fi
+
+exit 0
+`;
+

package/src/cli/templates/rules.ts

@@ -0,0 +1,38 @@
+export const SEPTUM_RULES_TEMPLATE = `# Septum Bounded-Context & Anti-Poisoning Partition Rules
+
+> **Prinsip Utama:** Proyek ini menggunakan **Septum** untuk menegakkan batasan arsitektur (bounded-context) secara deterministik. Setiap AI Coding Agent wajib mematuhi aturan batas domain dan touchpoint berikut.
+
+---
+
+## 1. Single Source of Truth (SSOT) via Septum MCP
+
+Sebelum menulis atau mengedit file backend/domain:
+1. **Dilarang Menebak Kontrak Domain:**
+   Gunakan tool MCP \`septum_get_domain_catalog(domain: "...")\` untuk memeriksa file, arketipe, dan signature publik yang sah di dalam domain tersebut.
+2. **Kunci Scope pada Fitur Aktif:**
+   Jika sedang mengerjakan fitur spesifik yang terdaftar di katalog Septum, panggil \`septum_get_feature_context(feature: "...")\`.
+   * **Wajib patuhi \`allowed_touchpoints\`:** Jangan menyentuh atau memodifikasi file di luar daftar yang diizinkan untuk fitur tersebut.
+   * **Wajib gunakan ulang \`reuse_symbols\`:** Jangan membuat fungsi atau helper duplikat jika simbol tersebut sudah terdaftar di \`reuse_symbols\`.
+
+---
+
+## 2. Pre-Flight Boundary Check Sebelum Menulis Kode
+
+Sebelum mengeksekusi penulisan file (\`write_to_file\` atau \`replace_file_content\`):
+1. Panggil tool MCP:
+   \`\`\`json
+   septum_check_boundary({
+     "file_path": "path/ke/file.ts",
+     "proposed_imports": ["target_import_statement"],
+     "feature_key": "nama_fitur_opsional"
+   })
+   \`\`\`
+2. **Rejection Handling:** Jika Septum mengembalikan status \`rejected\` (\`forbidden_dependency\`, \`disallowed_dependency\`, atau \`touchpoint_violation\`), **BATALKAN** rencana penulisan tersebut dan cari rute arsitektur yang sah (misal melalui Interface/Shared-Kernel yang diizinkan).
+
+---
+
+## 3. Anti Local Scope Myopia
+
+* Dilarang menghapus fungsi publik atau mengubah signature class hanya karena fungsi tersebut tidak terlihat dipanggil di file lokal yang sedang diedit.
+* Pastikan seluruh dependensi inbound/outbound mematuhi batasan domain yang terdaftar di database Septum (\`.septum/septum.db\`).
+`;

package/src/cli/templates/skill.ts

@@ -0,0 +1,66 @@
+export const SEPTUM_MAP_SKILL_TEMPLATE = `---
+name: septum-map
+description: Framework-agnostic codebase discovery, architectural domain mapping, and bounded-context initialization for Septum. Uses AI reasoning to map unknown project topologies (JS/TS, PHP, Python, Go), auto-registers bounded contexts into Septum's SQLite catalog, and enforces deterministic architectural boundaries.
+---
+
+# \`septum-map\` — Framework-Agnostic Semantic Discovery & Bounded-Context Initialization
+
+> **Prinsip Utama:** AI Agent berperan sebagai *The Architect* untuk membedah topologi arsitektur proyek apa pun tanpa terikat pada framework tertentu, merumuskan batas bounded-context, dan mendaftarkannya langsung ke database deterministik (.septum/septum.db via septum_register_domain) agar AI coding berikutnya tidak mengalami context poisoning atau over-editing.
+
+---
+
+## 1. Landasan Riset & Filosofi Desain
+
+Skill ini berakar langsung pada riset rekayasa perangkat lunak terkemuka:
+1. **Software Reflexion Models (Murphy, Notkin, & Sullivan, IEEE TSE):**
+   Membedakan model arsitektur tingkat tinggi yang dirancang (*high-level intention*) dengan implementasi fisik di kode sumber. Septum mendeteksi *Divergences* (pelanggaran baru) dan *Absences* sebelum kode di-merge.
+2. **Eliminasi Over-Editing (SWE-bench, RepoCoder - NeurIPS / ICLR):**
+   Akar kegagalan agen AI terbesar adalah mengedit file di luar lokus tugas (*local scope myopia*). \`septum-map\` menetapkan *bounded context* dan *allowed touchpoints* sejak awal.
+3. **Principle of Least Privilege & Object-Capabilities (Miller):**
+   Agen hanya diberikan kapabilitas membaca dan mengubah file dalam domain/fitur aktif, memangkas *blast radius* kesalahan hingga mendekati nol.
+4. **Hybrid Defense (SynCode / NeMo Guardrails):**
+   Probabilistic AI digunakan untuk penalaran awal (*discovery & blueprinting*), sementara eksekusi dan penegakannya 100% deterministik (*Tree-sitter WASM, SQLite WAL, Pre-Commit Hooks*).
+
+---
+
+## 2. Kapan Wajib Menggunakan (Trigger Moments)
+
+Gunakan skill ini saat:
+1. Menghubungkan Septum pertama kali ke repositori baru atau codebase yang belum terpetakan.
+2. Memetakan ulang domain bisnis setelah terjadi refactoring arsitektur besar (*re-mapping*).
+3. Mengonfigurasi fitur baru (\`features\` session) untuk mengunci daftar file yang boleh dimodifikasi (*allowed_touchpoints*) dan simbol yang wajib dipakai ulang (*reuse_symbols*).
+4. Pengguna meminta inisialisasi cerdas berbasis pemahaman AI pada struktur proyek.
+
+---
+
+## 3. Alur Kerja 4 Langkah (The 4-Step Discovery Lifecycle)
+
+### Langkah 1: Topological Scan (Maksimal 2 Tool Call)
+Analisis karakteristik proyek secara framework-agnostic:
+1. **Periksa Manifest & Config Root:**
+   * JS/TS: \`package.json\`, \`tsconfig.json\` (baca dependencies, path aliases).
+   * PHP: \`composer.json\` (baca \`autoload.psr-4\`, framework dependencies).
+   * Python: \`pyproject.toml\`, \`requirements.txt\`, \`setup.py\` (baca modules & framework).
+   * Go: \`go.mod\` (baca module path).
+2. **Petakan Direktori Tingkat Atas:**
+   Identifikasi apakah proyek menggunakan pola:
+   * *Domain-Driven / Vertical Slice:* \`src/domains/\`, \`app/Domain/\`, \`features/\`.
+   * *Layered / Clean Architecture:* \`core/\`, \`infrastructure/\`, \`application/\`, \`interfaces/\`.
+   * *Framework Conventional:* NestJS modules, Laravel app folders, FastAPI routers, Next.js route groups.
+
+### Langkah 2: Semantic Blueprint Drafting & Domain Boundary Formulation
+Rumuskan spesifikasi domain dengan prinsip **Contract & Invariants (Bukan Prosedural)**:
+* **\`root\`:** Direktori fisik domain (gunakan path kanonikal).
+* **\`allowed_dependencies\`:** Domain mana saja yang sah diimpor (inbound whitelist).
+* **\`forbidden_dependencies\`:** Domain yang dilarang keras diimpor (outbound blacklist).
+* **\`archetypes\`:** Pola glob penamaan layer (\`service: "*Service.*"\`, \`model: "*Model.*"\`).
+
+### Langkah 3: Human-in-the-Loop Approval Gate
+Tampilkan ringkasan domain boundary yang dirumuskan kepada pengguna / Tech Lead untuk disetujui atau disesuaikan sebelum didaftarkan.
+
+### Langkah 4: Deterministic Registration & Ingestion
+Setelah disetujui:
+1. Daftarkan domain secara langsung via tool MCP \`septum_register_domain(domain_name, root, ...)\` dengan opsi \`ingest_now: true\`.
+2. Atau jalankan CLI \`septum ingest\` untuk mengekstrak seluruh simbol AST dan menyimpannya ke database SQLite \`.septum/septum.db\`.
+3. Pastikan hook pre-commit terpasang aktif di \`.git/hooks/pre-commit\`.
+`;

package/src/core/boundary/evaluator.ts

@@ -0,0 +1,210 @@
+import type { BoundaryViolation } from "../../types/index.ts";
+import type { ValidatedSeptumConfig } from "../config/schema.ts";
+import { ConfigLoader } from "../config/loader.ts";
+import type { SeptumRepository } from "../database/repository.ts";
+import { ModuleResolver } from "../resolver/module-resolver.ts";
+
+export class BoundaryEvaluator {
+  private repo: SeptumRepository;
+  private resolver: ModuleResolver;
+
+  constructor(repo: SeptumRepository, resolver?: ModuleResolver) {
+    this.repo = repo;
+    this.resolver = resolver ?? new ModuleResolver(process.cwd(), repo);
+  }
+
+  public getResolver(): ModuleResolver {
+    return this.resolver;
+  }
+
+  public evaluate(
+    filePath: string,
+    proposedImports: string[] = [],
+    featureKey?: string,
+    config?: ValidatedSeptumConfig
+  ): BoundaryViolation[] {
+    const activeConfig = config ?? ConfigLoader.loadFromDatabaseOrDefaults();
+    const violations: BoundaryViolation[] = [];
+
+    if (featureKey) {
+      violations.push(...this.checkFeatureTouchpoints(featureKey, filePath, activeConfig));
+    }
+
+    if (proposedImports.length > 0) {
+      violations.push(...this.checkProposedChanges(filePath, proposedImports, activeConfig));
+    }
+
+    return violations;
+  }
+
+  public auditCodebase(config: ValidatedSeptumConfig): BoundaryViolation[] {
+    const violations: BoundaryViolation[] = [];
+    const allDependencies = this.repo.getAllDependenciesWithDomains();
+
+    for (const dep of allDependencies) {
+      const targetDomain = this.resolveTargetDomain(dep.target, config, dep.source_file);
+      if (!targetDomain || targetDomain === dep.source_domain) {
+        continue;
+      }
+
+      const sourceDomainConfig = config.domains[dep.source_domain];
+      if (!sourceDomainConfig) {
+        continue;
+      }
+
+      const forbidden = sourceDomainConfig.forbidden_dependencies ?? [];
+      const allowed = sourceDomainConfig.allowed_dependencies ?? [];
+
+      // 1. Explicit forbidden check
+      if (forbidden.includes(targetDomain)) {
+        violations.push({
+          file: dep.source_file,
+          line: dep.line_number,
+          source_domain: dep.source_domain,
+          target_domain: targetDomain,
+          imported_target: dep.target,
+          rule: "forbidden_dependency",
+          message: `Forbidden cross-domain dependency detected: '${dep.source_domain}' is strictly prohibited from importing domain '${targetDomain}'.`,
+        });
+        continue;
+      }
+
+      // 2. Strict enforcement allowed check
+      if (config.settings.enforcement === "strict" && !allowed.includes(targetDomain)) {
+        violations.push({
+          file: dep.source_file,
+          line: dep.line_number,
+          source_domain: dep.source_domain,
+          target_domain: targetDomain,
+          imported_target: dep.target,
+          rule: "disallowed_dependency",
+          message: `Disallowed dependency: '${targetDomain}' is not declared in allowed_dependencies for domain '${dep.source_domain}'.`,
+        });
+      }
+    }
+
+    return violations;
+  }
+
+  public checkProposedChanges(
+    sourceFilePath: string,
+    proposedImports: string[],
+    config: ValidatedSeptumConfig
+  ): BoundaryViolation[] {
+    const violations: BoundaryViolation[] = [];
+    const sourceDomain = this.resolveSourceDomain(sourceFilePath, config);
+
+    if (!sourceDomain) {
+      return violations;
+    }
+
+    const sourceDomainConfig = config.domains[sourceDomain];
+    if (!sourceDomainConfig) {
+      return violations;
+    }
+
+    const forbidden = sourceDomainConfig.forbidden_dependencies ?? [];
+    const allowed = sourceDomainConfig.allowed_dependencies ?? [];
+
+    for (const statement of proposedImports) {
+      const targetDomain = this.resolveTargetDomain(statement, config, sourceFilePath);
+      if (!targetDomain || targetDomain === sourceDomain) {
+        continue;
+      }
+
+      if (forbidden.includes(targetDomain)) {
+        violations.push({
+          file: sourceFilePath,
+          line: 1,
+          source_domain: sourceDomain,
+          target_domain: targetDomain,
+          imported_target: statement,
+          rule: "forbidden_dependency",
+          message: `Illegal import blocked: Domain '${sourceDomain}' is strictly forbidden from importing domain '${targetDomain}'.`,
+        });
+      } else if (config.settings.enforcement === "strict" && !allowed.includes(targetDomain)) {
+        violations.push({
+          file: sourceFilePath,
+          line: 1,
+          source_domain: sourceDomain,
+          target_domain: targetDomain,
+          imported_target: statement,
+          rule: "disallowed_dependency",
+          message: `Unlisted domain dependency: '${targetDomain}' must be explicitly added to allowed_dependencies before domain '${sourceDomain}' can import it.`,
+        });
+      }
+    }
+
+    return violations;
+  }
+
+  public resolveSourceDomain(filePath: string, config: ValidatedSeptumConfig): string | null {
+    return this.resolver.resolveSourceDomain(filePath, config);
+  }
+
+  public resolveTargetDomain(
+    targetStatement: string,
+    config: ValidatedSeptumConfig,
+    sourceFilePath?: string
+  ): string | null {
+    return this.resolver.resolveTargetDomain(targetStatement, sourceFilePath, config);
+  }
+
+  public checkFeatureTouchpoints(
+    featureKey: string,
+    targetFilePath: string,
+    config: ValidatedSeptumConfig
+  ): BoundaryViolation[] {
+    const violations: BoundaryViolation[] = [];
+    const features = config.features ?? {};
+    const featureConfig = features[featureKey];
+
+    if (!featureConfig) {
+      violations.push({
+        file: targetFilePath,
+        line: 1,
+        source_domain: "unknown",
+        target_domain: "unknown",
+        imported_target: targetFilePath,
+        rule: "unknown_feature",
+        message: `Feature '${featureKey}' is not defined in septum configuration.`,
+      });
+      return violations;
+    }
+
+    const normalizedTarget = targetFilePath.replace(/\\/g, "/").replace(/^\.\//, "");
+    const allowedTouchpoints = featureConfig.allowed_touchpoints.map((tp) =>
+      tp.replace(/\\/g, "/").replace(/^\.\//, "")
+    );
+
+    const isAllowed = allowedTouchpoints.some((pattern) => {
+      if (pattern.endsWith("/**")) {
+        const prefix = pattern.slice(0, -3);
+        return normalizedTarget.startsWith(prefix);
+      }
+      if (pattern.endsWith("/*")) {
+        const prefix = pattern.slice(0, -2);
+        return normalizedTarget.startsWith(prefix);
+      }
+      return (
+        normalizedTarget === pattern ||
+        normalizedTarget.endsWith("/" + pattern) ||
+        pattern.endsWith("/" + normalizedTarget)
+      );
+    });
+
+    if (!isAllowed) {
+      violations.push({
+        file: targetFilePath,
+        line: 1,
+        source_domain: featureConfig.domain,
+        target_domain: "unknown",
+        imported_target: targetFilePath,
+        rule: "touchpoint_violation",
+        message: `Scope violation: File '${targetFilePath}' is outside the declared allowed_touchpoints for feature '${featureKey}'. Permitted: [${allowedTouchpoints.join(", ")}].`,
+      });
+    }
+
+    return violations;
+  }
+}

package/src/core/config/loader.ts

@@ -0,0 +1,84 @@
+import { existsSync } from "node:fs";
+import { Database } from "bun:sqlite";
+import type { ValidatedSeptumConfig } from "./schema.ts";
+import { TopologyDetector } from "../discovery/topology-detector.ts";
+import { SeptumDatabase } from "../database/client.ts";
+import { SeptumRepository } from "../database/repository.ts";
+
+export class ConfigLoader {
+  /**
+   * Loads configuration with SQLite as the Single Source of Truth (SSOT).
+   * Automatically executes Zero-Config TopologyDetector if the database has no domains.
+   */
+  public static load(dbPath: string = ".septum/septum.db"): ValidatedSeptumConfig {
+    // 1. If database exists and has registered domains, load directly from SQLite SSOT
+    if (existsSync(dbPath)) {
+      const dbConfig = ConfigLoader.loadFromDatabaseOrDefaults(dbPath);
+      if (Object.keys(dbConfig.domains).length > 0) {
+        return dbConfig;
+      }
+    }
+
+    // 2. Zero-Config Auto-Discovery: Discover project topology and persist to SQLite
+    const septumDb = new SeptumDatabase(dbPath);
+    const repo = new SeptumRepository(septumDb.raw);
+    TopologyDetector.discoverAndPersist(repo, process.cwd());
+    septumDb.close();
+
+    return ConfigLoader.loadFromDatabaseOrDefaults(dbPath);
+  }
+
+  public static getDefaultConfig(): ValidatedSeptumConfig {
+    return {
+      version: "1.0",
+      settings: {
+        enforcement: "warn",
+        db_path: ".septum/septum.db",
+        ignore_patterns: [
+          "node_modules/**",
+          "vendor/**",
+          "dist/**",
+          "build/**",
+          "tests/**",
+          ".git/**",
+          ".septum/**",
+        ],
+      },
+      domains: {},
+      features: {},
+    };
+  }
+
+  public static loadFromDatabaseOrDefaults(dbPath: string = ".septum/septum.db"): ValidatedSeptumConfig {
+    const config = ConfigLoader.getDefaultConfig();
+    config.settings.db_path = dbPath;
+
+    if (existsSync(dbPath)) {
+      try {
+        const db = new Database(dbPath, { readonly: true });
+        const tables = db
+          .query<{ name: string }, [string]>(
+            "SELECT name FROM sqlite_master WHERE type='table' AND name = ?"
+          )
+          .get("domains");
+
+        if (tables) {
+          const rows = db.query<any, []>("SELECT * FROM domains").all();
+          for (const r of rows) {
+            config.domains[r.name] = {
+              root: r.root_path,
+              allowed_dependencies: JSON.parse(r.allowed_deps_json || "[]"),
+              forbidden_dependencies: JSON.parse(r.forbidden_deps_json || "[]"),
+              archetypes: JSON.parse(r.archetypes_json || "{}"),
+            };
+          }
+        }
+        db.close();
+      } catch {
+        // Fallback gracefully to default config
+      }
+    }
+
+    return config;
+  }
+}

package/src/core/config/schema.ts

@@ -0,0 +1,39 @@
+import { z } from "zod";
+
+export const DomainConfigSchema = z.object({
+  root: z.string().min(1, "root path cannot be empty"),
+  description: z.string().optional(),
+  allowed_dependencies: z.array(z.string()).default([]),
+  forbidden_dependencies: z.array(z.string()).default([]),
+  archetypes: z.record(z.string()).optional().default({}),
+});
+
+export const FeatureConfigSchema = z.object({
+  domain: z.string().min(1, "domain reference is required"),
+  description: z.string().optional(),
+  allowed_touchpoints: z.array(z.string()).min(1, "allowed_touchpoints must contain at least one file/path"),
+  reuse_symbols: z.array(z.string()).optional().default([]),
+  input_contract: z.record(z.unknown()).optional().default({}),
+  output_contract: z.record(z.unknown()).optional().default({}),
+});
+
+export const SeptumConfigSchema = z.object({
+  version: z.string().default("1.0"),
+  settings: z
+    .object({
+      enforcement: z.enum(["strict", "warn"]).default("strict"),
+      db_path: z.string().default(".septum/septum.db"),
+      ignore_patterns: z
+        .array(z.string())
+        .default(["node_modules/**", "vendor/**", "dist/**", "build/**", "tests/**", ".git/**"]),
+    })
+    .default({
+      enforcement: "strict",
+      db_path: ".septum/septum.db",
+      ignore_patterns: ["node_modules/**", "vendor/**", "dist/**", "build/**", "tests/**", ".git/**"],
+    }),
+  domains: z.record(DomainConfigSchema).default({}),
+  features: z.record(FeatureConfigSchema).optional().default({}),
+});
+
+export type ValidatedSeptumConfig = z.infer<typeof SeptumConfigSchema>;

package/src/core/database/client.ts

@@ -0,0 +1,132 @@
+import { Database } from "bun:sqlite";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+export class SeptumDatabase {
+  private db: Database;
+  private dbPath: string;
+
+  constructor(dbPath: string = ".septum/septum.db") {
+    this.dbPath = dbPath;
+    const dir = dirname(dbPath);
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+
+    this.db = new Database(dbPath, { create: true });
+    this.configurePragmas();
+    this.initSchema();
+  }
+
+  private configurePragmas(): void {
+    this.db.run("PRAGMA journal_mode = WAL;");
+    this.db.run("PRAGMA foreign_keys = ON;");
+    this.db.run("PRAGMA synchronous = NORMAL;");
+  }
+
+  private initSchema(): void {
+    const schemaFile = join(import.meta.dir, "schema.sql");
+    if (existsSync(schemaFile)) {
+      const sql = readFileSync(schemaFile, "utf-8");
+      this.db.run(sql);
+    } else {
+      // Fallback inline schema if schema.sql is not found in compiled bundle
+      this.db.run(`
+        CREATE TABLE IF NOT EXISTS domains (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          name TEXT NOT NULL UNIQUE,
+          root_path TEXT NOT NULL,
+          allowed_deps_json TEXT NOT NULL DEFAULT '[]',
+          forbidden_deps_json TEXT NOT NULL DEFAULT '[]',
+          archetypes_json TEXT NOT NULL DEFAULT '{}',
+          created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+        CREATE TABLE IF NOT EXISTS files (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          domain_id INTEGER NOT NULL,
+          path TEXT NOT NULL UNIQUE,
+          archetype TEXT NOT NULL DEFAULT 'unknown',
+          content_hash TEXT NOT NULL,
+          line_count INTEGER NOT NULL DEFAULT 0,
+          last_scanned_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (domain_id) REFERENCES domains(id) ON DELETE CASCADE
+        );
+        CREATE TABLE IF NOT EXISTS symbols (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          file_id INTEGER NOT NULL,
+          name TEXT NOT NULL,
+          kind TEXT NOT NULL,
+          signature TEXT NOT NULL,
+          visibility TEXT NOT NULL DEFAULT 'public',
+          line_start INTEGER NOT NULL DEFAULT 0,
+          line_end INTEGER NOT NULL DEFAULT 0,
+          FOREIGN KEY (file_id) REFERENCES files(id) ON DELETE CASCADE
+        );
+        CREATE TABLE IF NOT EXISTS dependencies (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          source_file_id INTEGER NOT NULL,
+          target_symbol_or_path TEXT NOT NULL,
+          import_statement TEXT NOT NULL,
+          line_number INTEGER NOT NULL DEFAULT 0,
+          is_external BOOLEAN NOT NULL DEFAULT 0,
+          FOREIGN KEY (source_file_id) REFERENCES files(id) ON DELETE CASCADE
+        );
+        CREATE TABLE IF NOT EXISTS vertical_slices (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          domain_id INTEGER,
+          feature_key TEXT,
+          http_method TEXT NOT NULL,
+          route_uri TEXT NOT NULL,
+          route_name TEXT,
+          controller_class TEXT NOT NULL,
+          action_name TEXT NOT NULL,
+          controller_file TEXT,
+          controller_line INTEGER DEFAULT 0,
+          architecture_style TEXT NOT NULL DEFAULT 'clean',
+          entry_kind TEXT NOT NULL DEFAULT 'http_route',
+          execution_chain_json TEXT NOT NULL,
+          created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (domain_id) REFERENCES domains(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_slices_route_uri ON vertical_slices(route_uri);
+        CREATE INDEX IF NOT EXISTS idx_slices_route_name ON vertical_slices(route_name);
+        CREATE INDEX IF NOT EXISTS idx_slices_controller ON vertical_slices(controller_class, action_name);
+        CREATE TABLE IF NOT EXISTS repo_meta (
+          key TEXT PRIMARY KEY,
+          value TEXT NOT NULL,
+          updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    }
+    this.migrateSchema();
+  }
+
+  private migrateSchema(): void {
+    try {
+      const tableInfo = this.db.query<{ name: string }, []>("PRAGMA table_info(vertical_slices)").all();
+      const existingCols = new Set(tableInfo.map((c) => c.name));
+
+      if (tableInfo.length > 0) {
+        if (existingCols.has("form_request_class") || !existingCols.has("execution_chain_json")) {
+          this.db.run("DROP TABLE IF EXISTS vertical_slices;");
+          this.initSchema();
+        }
+      }
+    } catch (_) {
+      // Ignore migration errors
+    }
+  }
+
+  public get raw(): Database {
+    return this.db;
+  }
+
+  public close(): void {
+    this.db.close();
+  }
+
+  public transaction<T>(fn: () => T): T {
+    return this.db.transaction(fn)();
+  }
+}