@graphmemory/server 1.2.0 → 1.3.0

package/dist/graphs/code.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodeGraphManager = exports.createCodeGraph = void 0;
 exports.updateCodeFile = updateCodeFile;
 exports.resolvePendingImports = resolvePendingImports;
+exports.resolvePendingEdges = resolvePendingEdges;
 exports.removeCodeFile = removeCodeFile;
 exports.getFileSymbols = getFileSymbols;
 exports.getCodeFileMtime = getCodeFileMtime;
@@ -20,6 +21,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const code_1 = require("../lib/search/code");
 const files_1 = require("../lib/search/files");
 const bm25_1 = require("../lib/search/bm25");
+const embedding_codec_1 = require("../lib/embedding-codec");
 // ---------------------------------------------------------------------------
 // CRUD
 // ---------------------------------------------------------------------------
@@ -30,19 +32,31 @@ function updateCodeFile(graph, parsed) {
         graph.addNode(id, attrs);
     }
     const pendingImports = [];
+    const pendingEdges = [];
     for (const { from, to, attrs } of parsed.edges) {
         if (!graph.hasNode(to)) {
-            if (attrs.kind === 'imports')
+            if (attrs.kind === 'imports') {
                 pendingImports.push(to);
+            }
+            else if (attrs.kind === 'extends' || attrs.kind === 'implements') {
+                // Target class/interface may be in another file — defer resolution
+                const toName = to.split('::').pop();
+                pendingEdges.push({ from, toName, kind: attrs.kind });
+            }
             continue;
         }
         if (graph.hasNode(from) && !graph.hasEdge(from, to)) {
             graph.addEdgeWithKey(`${from}→${to}`, from, to, attrs);
         }
     }
-    // Store pending imports on the file node for post-drain resolution
-    if (pendingImports.length > 0 && graph.hasNode(parsed.fileId)) {
-        graph.setNodeAttribute(parsed.fileId, 'pendingImports', pendingImports);
+    // Store pending data on the file node for post-drain resolution
+    if (graph.hasNode(parsed.fileId)) {
+        if (pendingImports.length > 0) {
+            graph.setNodeAttribute(parsed.fileId, 'pendingImports', pendingImports);
+        }
+        if (pendingEdges.length > 0) {
+            graph.setNodeAttribute(parsed.fileId, 'pendingEdges', pendingEdges);
+        }
     }
 }
 /**
@@ -71,6 +85,43 @@ function resolvePendingImports(graph) {
     });
     return created;
 }
+/**
+ * Resolve pending extends/implements edges after all files have been indexed.
+ * Searches the entire graph for nodes matching toName (by symbol name).
+ */
+function resolvePendingEdges(graph) {
+    // Build name → nodeId index for fast lookup
+    const nameIndex = new Map();
+    graph.forEachNode((id, attrs) => {
+        if (attrs.kind === 'class' || attrs.kind === 'interface') {
+            const list = nameIndex.get(attrs.name) ?? [];
+            list.push(id);
+            nameIndex.set(attrs.name, list);
+        }
+    });
+    let created = 0;
+    graph.forEachNode((id, attrs) => {
+        if (!attrs.pendingEdges || attrs.pendingEdges.length === 0)
+            return;
+        const remaining = [];
+        for (const edge of attrs.pendingEdges) {
+            const candidates = nameIndex.get(edge.toName);
+            if (candidates && candidates.length > 0 && graph.hasNode(edge.from)) {
+                // Use first match (ambiguity is rare in practice)
+                const toId = candidates[0];
+                if (toId !== edge.from && !graph.hasEdge(edge.from, toId)) {
+                    graph.addEdgeWithKey(`${edge.from}→${toId}`, edge.from, toId, { kind: edge.kind });
+                    created++;
+                }
+            }
+            else {
+                remaining.push(edge);
+            }
+        }
+        graph.setNodeAttribute(id, 'pendingEdges', remaining.length > 0 ? remaining : undefined);
+    });
+    return created;
+}
 /** Remove all nodes (and their incident edges) belonging to a file. */
 function removeCodeFile(graph, fileId) {
     const toRemove = graph.filterNodes((_, attrs) => attrs.fileId === fileId);
@@ -112,8 +163,19 @@ function saveCodeGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'code.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadCodeGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, code_types_1.createCodeGraph)();
@@ -129,6 +191,7 @@ function loadCodeGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[code-graph] Embedding config changed, re-indexing code graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[code-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }
@@ -144,7 +207,7 @@ class CodeGraphManager {
     _graph;
     embedFns;
     ext;
-    _bm25Index = new bm25_1.BM25Index((attrs) => `${attrs.name} ${attrs.signature} ${attrs.docComment}`);
+    _bm25Index = new bm25_1.BM25Index((attrs) => `${attrs.name} ${attrs.signature} ${attrs.docComment} ${attrs.body}`);
     constructor(_graph, embedFns, ext = {}) {
         this._graph = _graph;
         this.embedFns = embedFns;

package/dist/graphs/docs.js

@@ -20,6 +20,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const docs_1 = require("../lib/search/docs");
 const files_1 = require("../lib/search/files");
 const bm25_1 = require("../lib/search/bm25");
+const embedding_codec_1 = require("../lib/embedding-codec");
 function createGraph() {
     return new graphology_1.DirectedGraph({ multi: false, allowSelfLoops: false });
 }
@@ -133,8 +134,19 @@ function saveGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'docs.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = createGraph();
@@ -150,6 +162,7 @@ function loadGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[graph] Embedding config changed, re-indexing docs graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }

package/dist/graphs/file-index.js

@@ -19,6 +19,7 @@ const file_index_types_1 = require("../graphs/file-index-types");
 const file_lang_1 = require("../graphs/file-lang");
 const manager_types_1 = require("../graphs/manager-types");
 const file_index_1 = require("../lib/search/file-index");
+const embedding_codec_1 = require("../lib/embedding-codec");
 // ---------------------------------------------------------------------------
 // CRUD
 // ---------------------------------------------------------------------------
@@ -157,7 +158,8 @@ function listAllFiles(graph, options = {}) {
             return [];
         graph.forEachOutNeighbor(dirId, (childId) => {
             const attrs = graph.getNodeAttributes(childId);
-            if (graph.getEdgeAttribute(graph.edge(dirId, childId), 'kind') !== 'contains')
+            const edgeKey = graph.edge(dirId, childId);
+            if (!edgeKey || graph.getEdgeAttribute(edgeKey, 'kind') !== 'contains')
                 return;
             if (extension && attrs.extension !== extension)
                 return;
@@ -240,8 +242,19 @@ function saveFileIndexGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'file-index.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadFileIndexGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, file_index_types_1.createFileIndexGraph)();
@@ -257,6 +270,7 @@ function loadFileIndexGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[file-index] Embedding config changed, re-indexing file index\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[file-index] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }

package/dist/graphs/file-lang.js

@@ -15,7 +15,7 @@ exports.EXT_TO_LANGUAGE = {
     '.mjs': 'javascript',
     '.cjs': 'javascript',
     '.ts': 'typescript',
-    '.tsx': 'typescript',
+    '.tsx': 'tsx',
     '.mts': 'typescript',
     '.cts': 'typescript',
     // Web

package/dist/graphs/knowledge.js

@@ -28,6 +28,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const knowledge_1 = require("../lib/search/knowledge");
 const bm25_1 = require("../lib/search/bm25");
 const file_mirror_1 = require("../lib/file-mirror");
+const embedding_codec_1 = require("../lib/embedding-codec");
 const attachment_types_1 = require("../graphs/attachment-types");
 const file_import_1 = require("../lib/file-import");
 // ---------------------------------------------------------------------------
@@ -329,8 +330,19 @@ function saveKnowledgeGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'knowledge.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadKnowledgeGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, knowledge_types_1.createKnowledgeGraph)();
@@ -346,6 +358,7 @@ function loadKnowledgeGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[knowledge-graph] Embedding config changed, re-indexing knowledge graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[knowledge-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }
@@ -552,7 +565,9 @@ class KnowledgeGraphManager {
         try {
             const actualToId = targetGraph ? proxyId(targetGraph, toId, pid) : toId;
             if (this._graph.hasEdge(fromId, actualToId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(fromId, actualToId), 'kind') ?? '';
+                const ek = this._graph.edge(fromId, actualToId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -628,6 +643,8 @@ class KnowledgeGraphManager {
             return;
         const attachments = (0, attachment_types_1.scanAttachments)(path_1.default.join(dir, noteId));
         this._graph.setNodeAttribute(noteId, 'attachments', attachments);
+        this._graph.setNodeAttribute(noteId, 'updatedAt', Date.now());
+        this._graph.setNodeAttribute(noteId, 'version', (this._graph.getNodeAttribute(noteId, 'version') ?? 0) + 1);
         this.ctx.markDirty();
     }
     listAttachments(noteId) {

package/dist/graphs/skill.js

@@ -30,6 +30,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const skills_1 = require("../lib/search/skills");
 const bm25_1 = require("../lib/search/bm25");
 const file_mirror_1 = require("../lib/file-mirror");
+const embedding_codec_1 = require("../lib/embedding-codec");
 const attachment_types_1 = require("../graphs/attachment-types");
 const file_import_1 = require("../lib/file-import");
 // ---------------------------------------------------------------------------
@@ -473,8 +474,19 @@ function saveSkillGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'skills.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadSkillGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, skill_types_1.createSkillGraph)();
@@ -490,6 +502,7 @@ function loadSkillGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[skill-graph] Embedding config changed, re-indexing skill graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[skill-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }
@@ -760,7 +773,9 @@ class SkillGraphManager {
         try {
             const proxyNodeId = proxyId(targetGraph, targetId, pid);
             if (this._graph.hasEdge(skillId, proxyNodeId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(skillId, proxyNodeId), 'kind') ?? '';
+                const ek = this._graph.edge(skillId, proxyNodeId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -788,7 +803,9 @@ class SkillGraphManager {
         let kind = '';
         try {
             if (this._graph.hasEdge(fromId, toId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(fromId, toId), 'kind') ?? '';
+                const ek = this._graph.edge(fromId, toId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -856,6 +873,8 @@ class SkillGraphManager {
             return;
         const attachments = (0, attachment_types_1.scanAttachments)(path_1.default.join(dir, skillId));
         this._graph.setNodeAttribute(skillId, 'attachments', attachments);
+        this._graph.setNodeAttribute(skillId, 'updatedAt', Date.now());
+        this._graph.setNodeAttribute(skillId, 'version', (this._graph.getNodeAttribute(skillId, 'version') ?? 0) + 1);
         this.ctx.markDirty();
     }
     listAttachments(skillId) {

package/dist/graphs/task.js

@@ -30,6 +30,7 @@ const manager_types_1 = require("../graphs/manager-types");
 const tasks_1 = require("../lib/search/tasks");
 const bm25_1 = require("../lib/search/bm25");
 const file_mirror_1 = require("../lib/file-mirror");
+const embedding_codec_1 = require("../lib/embedding-codec");
 const attachment_types_1 = require("../graphs/attachment-types");
 const file_import_1 = require("../lib/file-import");
 // ---------------------------------------------------------------------------
@@ -494,8 +495,19 @@ function saveTaskGraph(graph, graphMemory, embeddingFingerprint) {
     fs_1.default.mkdirSync(graphMemory, { recursive: true });
     const file = path_1.default.join(graphMemory, 'tasks.json');
     const tmp = file + '.tmp';
-    fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: graph.export() }));
-    fs_1.default.renameSync(tmp, file);
+    try {
+        const exported = graph.export();
+        (0, embedding_codec_1.compressEmbeddings)(exported);
+        fs_1.default.writeFileSync(tmp, JSON.stringify({ embeddingModel: embeddingFingerprint, graph: exported }));
+        fs_1.default.renameSync(tmp, file);
+    }
+    catch (err) {
+        try {
+            fs_1.default.unlinkSync(tmp);
+        }
+        catch { /* ignore cleanup error */ }
+        throw err;
+    }
 }
 function loadTaskGraph(graphMemory, fresh = false, embeddingFingerprint) {
     const graph = (0, task_types_1.createTaskGraph)();
@@ -511,6 +523,7 @@ function loadTaskGraph(graphMemory, fresh = false, embeddingFingerprint) {
             process.stderr.write(`[task-graph] Embedding config changed, re-indexing task graph\n`);
             return graph;
         }
+        (0, embedding_codec_1.decompressEmbeddings)(data.graph);
         graph.import(data.graph);
         process.stderr.write(`[task-graph] Loaded ${graph.order} nodes, ${graph.size} edges\n`);
     }
@@ -733,7 +746,9 @@ class TaskGraphManager {
         try {
             const proxyNodeId = proxyId(targetGraph, targetId, pid);
             if (this._graph.hasEdge(taskId, proxyNodeId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(taskId, proxyNodeId), 'kind') ?? '';
+                const ek = this._graph.edge(taskId, proxyNodeId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -759,7 +774,9 @@ class TaskGraphManager {
         let kind = '';
         try {
             if (this._graph.hasEdge(fromId, toId)) {
-                kind = this._graph.getEdgeAttribute(this._graph.edge(fromId, toId), 'kind') ?? '';
+                const ek = this._graph.edge(fromId, toId);
+                if (ek)
+                    kind = this._graph.getEdgeAttribute(ek, 'kind') ?? '';
             }
         }
         catch { /* ignore */ }
@@ -827,6 +844,8 @@ class TaskGraphManager {
             return;
         const attachments = (0, attachment_types_1.scanAttachments)(path_1.default.join(dir, taskId));
         this._graph.setNodeAttribute(taskId, 'attachments', attachments);
+        this._graph.setNodeAttribute(taskId, 'updatedAt', Date.now());
+        this._graph.setNodeAttribute(taskId, 'version', (this._graph.getNodeAttribute(taskId, 'version') ?? 0) + 1);
         this.ctx.markDirty();
     }
     listAttachments(taskId) {

package/dist/lib/embedding-codec.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Encode/decode embedding vectors as Base64 for compact JSON serialization.
+ * Float32Array → Base64 string saves ~3x vs JSON number arrays.
+ * Backwards compatible: detects old format (number[]) on load.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compressEmbeddings = compressEmbeddings;
+exports.decompressEmbeddings = decompressEmbeddings;
+const EMBEDDING_FIELDS = ['embedding', 'fileEmbedding'];
+/** Convert a number[] to a Base64-encoded Float32Array. */
+function float32ToBase64(arr) {
+    const f32 = new Float32Array(arr);
+    const bytes = new Uint8Array(f32.buffer);
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++)
+        binary += String.fromCharCode(bytes[i]);
+    return Buffer.from(binary, 'binary').toString('base64');
+}
+/** Convert a Base64-encoded Float32Array back to number[]. */
+function base64ToFloat32(b64) {
+    const buf = Buffer.from(b64, 'base64');
+    // Copy to aligned buffer to guarantee 4-byte alignment for Float32Array
+    const aligned = new Uint8Array(buf.byteLength);
+    aligned.set(new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength));
+    const f32 = new Float32Array(aligned.buffer, 0, aligned.byteLength / 4);
+    return Array.from(f32);
+}
+/**
+ * Compress embedding fields in a graphology export object (mutates in place).
+ * Converts number[] → Base64 string for fields named 'embedding' or 'fileEmbedding'.
+ */
+function compressEmbeddings(exported) {
+    if (!exported?.nodes)
+        return;
+    for (const node of exported.nodes) {
+        const attrs = node.attributes;
+        if (!attrs)
+            continue;
+        for (const field of EMBEDDING_FIELDS) {
+            if (Array.isArray(attrs[field]) && attrs[field].length > 0) {
+                attrs[field] = float32ToBase64(attrs[field]);
+            }
+        }
+    }
+}
+/**
+ * Decompress embedding fields in a graphology export object (mutates in place).
+ * Converts Base64 string → number[]. Handles both old format (number[]) and new (string).
+ */
+function decompressEmbeddings(exported) {
+    if (!exported?.nodes)
+        return;
+    for (const node of exported.nodes) {
+        const attrs = node.attributes;
+        if (!attrs)
+            continue;
+        for (const field of EMBEDDING_FIELDS) {
+            if (typeof attrs[field] === 'string' && attrs[field].length > 0) {
+                attrs[field] = base64ToFloat32(attrs[field]);
+            }
+            // number[] stays as-is (backwards compatible with old format)
+        }
+    }
+}

package/dist/lib/jwt.js

@@ -85,15 +85,15 @@ function parseTtl(ttl) {
 }
 function signAccessToken(userId, secret, ttl) {
     const payload = { userId, type: 'access' };
-    return jsonwebtoken_1.default.sign(payload, secret, { expiresIn: parseTtl(ttl) });
+    return jsonwebtoken_1.default.sign(payload, secret, { algorithm: 'HS256', expiresIn: parseTtl(ttl) });
 }
 function signRefreshToken(userId, secret, ttl) {
     const payload = { userId, type: 'refresh' };
-    return jsonwebtoken_1.default.sign(payload, secret, { expiresIn: parseTtl(ttl) });
+    return jsonwebtoken_1.default.sign(payload, secret, { algorithm: 'HS256', expiresIn: parseTtl(ttl) });
 }
 function verifyToken(token, secret) {
     try {
-        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        const decoded = jsonwebtoken_1.default.verify(token, secret, { algorithms: ['HS256'] });
         if (!decoded.userId || !decoded.type)
             return null;
         return { userId: decoded.userId, type: decoded.type };
@@ -108,7 +108,7 @@ function verifyToken(token, secret) {
 const ACCESS_COOKIE = 'mgm_access';
 const REFRESH_COOKIE = 'mgm_refresh';
 function setAuthCookies(res, accessToken, refreshToken, accessTtl, refreshTtl) {
-    const secure = process.env.NODE_ENV === 'production';
+    const secure = process.env.NODE_ENV !== 'development';
     res.cookie(ACCESS_COOKIE, accessToken, {
         httpOnly: true,
         secure,

package/dist/lib/multi-config.js

@@ -50,6 +50,7 @@ const userSchema = zod_1.z.object({
 });
 const graphConfigSchema = zod_1.z.object({
     enabled: zod_1.z.boolean().optional(),
+    readonly: zod_1.z.boolean().optional(),
     include: zod_1.z.string().optional(),
     exclude: excludeSchema,
     model: modelConfigSchema.optional(),
@@ -98,7 +99,7 @@ const serverSchema = zod_1.z.object({
     embeddingApi: embeddingApiSchema.optional(),
     defaultAccess: accessLevelSchema.optional(),
     access: accessMapSchema,
-    jwtSecret: zod_1.z.string().optional(),
+    jwtSecret: zod_1.z.string().min(16).optional(),
     accessTokenTtl: zod_1.z.string().optional(),
     refreshTokenTtl: zod_1.z.string().optional(),
     rateLimit: rateLimitSchema.optional(),
@@ -107,6 +108,7 @@ const serverSchema = zod_1.z.object({
 });
 const wsGraphConfigSchema = zod_1.z.object({
     enabled: zod_1.z.boolean().optional(),
+    readonly: zod_1.z.boolean().optional(),
     exclude: excludeSchema,
     model: modelConfigSchema.optional(),
     embedding: embeddingConfigSchema.optional(),
@@ -301,6 +303,7 @@ function loadMultiConfig(yamlPath) {
             const graphExclude = [...projectExclude, ...parseExclude(gc?.exclude)];
             graphConfigs[gn] = {
                 enabled: gc?.enabled ?? true,
+                readonly: gc?.readonly ?? false,
                 include: gc?.include ?? (gn === 'docs' ? PROJECT_DEFAULTS.docsInclude : gn === 'code' ? PROJECT_DEFAULTS.codeInclude : undefined),
                 exclude: graphExclude,
                 model: resolveModel(gc?.model, projectModel),
@@ -348,6 +351,7 @@ function loadMultiConfig(yamlPath) {
                 const gc = rawGraphs[gn];
                 graphConfigs[gn] = {
                     enabled: gc?.enabled ?? true,
+                    readonly: gc?.readonly ?? false,
                     exclude: [...wsExclude, ...parseExclude(gc?.exclude)],
                     model: resolveModel(gc?.model, wsModel),
                     embedding: resolveEmbedding(gc?.embedding, wsEmbedding),
@@ -418,6 +422,7 @@ function defaultConfig(projectDir) {
     for (const gn of exports.GRAPH_NAMES) {
         graphConfigs[gn] = {
             enabled: true,
+            readonly: false,
             include: gn === 'docs' ? PROJECT_DEFAULTS.docsInclude : gn === 'code' ? PROJECT_DEFAULTS.codeInclude : undefined,
             exclude: [...server.exclude],
             model: MODEL_DEFAULTS,