@launchsecure/launch-kit 0.0.29 → 0.0.31

package/dist/server/cli.js

@@ -1752,7 +1752,7 @@ var require_usage_reader = __commonJS({
       async readJsonlFile(filePath, cutoffTime) {
         const entries = [];
         const fileProcessedEntries = /* @__PURE__ */ new Set();
-        return new Promise((resolve5) => {
+        return new Promise((resolve6) => {
           const rl = readline.createInterface({
             input: createReadStream(filePath),
             crlfDelay: Infinity
@@ -1810,11 +1810,11 @@ var require_usage_reader = __commonJS({
             }
           });
           rl.on("close", () => {
-            resolve5(entries);
+            resolve6(entries);
           });
           rl.on("error", (error) => {
             console.error("Error reading file:", filePath, error);
-            resolve5(entries);
+            resolve6(entries);
           });
         });
       }
@@ -3623,7 +3623,7 @@ var require_src = __commonJS({
         if (session.active) throw new Error(`Agent already running in session ${sessionId}`);
         const { command, args = [], env = {} } = options;
         if (!command) throw new Error("startScriptInSession requires a command");
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           this.scriptBridge.startSession(sessionId, {
             command,
             args,
@@ -3645,7 +3645,7 @@ var require_src = __commonJS({
               session.lastActivity = /* @__PURE__ */ new Date();
               this.broadcastToSession(sessionId, { type: "script_stopped", sessionId });
               if (exitCode === 0) {
-                resolve5({ code: exitCode, signal });
+                resolve6({ code: exitCode, signal });
               } else {
                 reject(new Error(`Script exited with code ${exitCode}`));
               }
@@ -5567,9 +5567,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve5, reject) => {
+          return new Promise((resolve6, reject) => {
             this.close((err2, data) => {
-              return err2 ? reject(err2) : resolve5(data);
+              return err2 ? reject(err2) : resolve6(data);
             });
           });
         }
@@ -5607,12 +5607,12 @@ var require_dispatcher_base = __commonJS({
           err2 = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve5, reject) => {
+          return new Promise((resolve6, reject) => {
             this.destroy(err2, (err3, data) => {
               return err3 ? (
                 /* istanbul ignore next: should never error */
                 reject(err3)
-              ) : resolve5(data);
+              ) : resolve6(data);
             });
           });
         }
@@ -7879,8 +7879,8 @@ var require_util2 = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve5, reject) => {
-        res = resolve5;
+      const promise = new Promise((resolve6, reject) => {
+        res = resolve6;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -10021,12 +10021,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve5, reject) => {
+      const waitForDrain = () => new Promise((resolve6, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve5;
+          callback = resolve6;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -10663,12 +10663,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve5, reject) => {
+      const waitForDrain = () => new Promise((resolve6, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve5;
+          callback = resolve6;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -11146,16 +11146,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       async [kClose]() {
-        return new Promise((resolve5) => {
+        return new Promise((resolve6) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve5;
+            this[kClosedResolve] = resolve6;
           } else {
-            resolve5(null);
+            resolve6(null);
           }
         });
       }
       async [kDestroy](err2) {
-        return new Promise((resolve5) => {
+        return new Promise((resolve6) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request = requests[i];
@@ -11166,7 +11166,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve5(null);
+            resolve6(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err2, callback);
@@ -11217,7 +11217,7 @@ var require_client = __commonJS({
         });
       }
       try {
-        const socket = await new Promise((resolve5, reject) => {
+        const socket = await new Promise((resolve6, reject) => {
           client[kConnector]({
             host,
             hostname,
@@ -11229,7 +11229,7 @@ var require_client = __commonJS({
             if (err2) {
               reject(err2);
             } else {
-              resolve5(socket2);
+              resolve6(socket2);
             }
           });
         });
@@ -11565,8 +11565,8 @@ var require_pool_base = __commonJS({
         if (this[kQueue].isEmpty()) {
           await Promise.all(this[kClients].map((c) => c.close()));
         } else {
-          await new Promise((resolve5) => {
-            this[kClosedResolve] = resolve5;
+          await new Promise((resolve6) => {
+            this[kClosedResolve] = resolve6;
           });
         }
       }
@@ -12781,7 +12781,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return null;
         }
-        return await new Promise((resolve5, reject) => {
+        return await new Promise((resolve6, reject) => {
           if (this[kContentLength] > limit) {
             this.destroy(new AbortError());
           }
@@ -12794,7 +12794,7 @@ var require_readable = __commonJS({
             if (signal?.aborted) {
               reject(signal.reason ?? new AbortError());
             } else {
-              resolve5(null);
+              resolve6(null);
             }
           }).on("error", noop).on("data", function(chunk) {
             limit -= chunk.length;
@@ -12813,7 +12813,7 @@ var require_readable = __commonJS({
     }
     async function consume(stream, type) {
       assert(!stream[kConsume]);
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -12830,7 +12830,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve: resolve5,
+              resolve: resolve6,
               reject,
               length: 0,
               body: []
@@ -12900,18 +12900,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2) {
-      const { type, body, resolve: resolve5, stream, length } = consume2;
+      const { type, body, resolve: resolve6, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve5(chunksDecode(body, length));
+          resolve6(chunksDecode(body, length));
         } else if (type === "json") {
-          resolve5(JSON.parse(chunksDecode(body, length)));
+          resolve6(JSON.parse(chunksDecode(body, length)));
         } else if (type === "arrayBuffer") {
-          resolve5(chunksConcat(body, length).buffer);
+          resolve6(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve5(new Blob(body, { type: stream[kContentType] }));
+          resolve6(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve5(chunksConcat(body, length));
+          resolve6(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err2) {
@@ -13168,9 +13168,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           request.call(this, opts, (err2, data) => {
-            return err2 ? reject(err2) : resolve5(data);
+            return err2 ? reject(err2) : resolve6(data);
           });
         });
       }
@@ -13393,9 +13393,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           stream.call(this, opts, factory, (err2, data) => {
-            return err2 ? reject(err2) : resolve5(data);
+            return err2 ? reject(err2) : resolve6(data);
           });
         });
       }
@@ -13680,9 +13680,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           upgrade.call(this, opts, (err2, data) => {
-            return err2 ? reject(err2) : resolve5(data);
+            return err2 ? reject(err2) : resolve6(data);
           });
         });
       }
@@ -13774,9 +13774,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           connect.call(this, opts, (err2, data) => {
-            return err2 ? reject(err2) : resolve5(data);
+            return err2 ? reject(err2) : resolve6(data);
           });
         });
       }
@@ -17638,7 +17638,7 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url = requestCurrentURL(request);
         const agent = fetchParams.controller.dispatcher;
-        return new Promise((resolve5, reject) => agent.dispatch(
+        return new Promise((resolve6, reject) => agent.dispatch(
           {
             path: url.pathname + url.search,
             origin: url.origin,
@@ -17714,7 +17714,7 @@ var require_fetch = __commonJS({
                 }
               }
               const onError = this.onError.bind(this);
-              resolve5({
+              resolve6({
                 status,
                 statusText,
                 headersList,
@@ -17760,7 +17760,7 @@ var require_fetch = __commonJS({
               for (let i = 0; i < rawHeaders.length; i += 2) {
                 headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i]), rawHeaders[i + 1].toString("latin1"), true);
               }
-              resolve5({
+              resolve6({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList,
@@ -21436,8 +21436,8 @@ var require_util8 = __commonJS({
       return true;
     }
     function delay(ms) {
-      return new Promise((resolve5) => {
-        setTimeout(resolve5, ms).unref();
+      return new Promise((resolve6) => {
+        setTimeout(resolve6, ms).unref();
       });
     }
     module2.exports = {
@@ -22628,7 +22628,7 @@ function resolveWorkerPath() {
   );
 }
 function runParseInWorker(req) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let workerPath;
     try {
       workerPath = resolveWorkerPath();
@@ -22647,7 +22647,7 @@ function runParseInWorker(req) {
     };
     worker.on("message", (reply) => {
       if (reply.ok) {
-        finish(() => resolve5({ results: reply.results, failedFiles: reply.failedFiles }));
+        finish(() => resolve6({ results: reply.results, failedFiles: reply.failedFiles }));
       } else {
         const err2 = new Error(reply.error.message);
         err2.name = reply.error.name;
@@ -22891,7 +22891,7 @@ var init_freshness = __esm({
 function getAvailableLayers(rootDir) {
   const dir = (0, import_node_path13.join)(rootDir, GRAPHS_DIR2);
   if (!(0, import_node_fs11.existsSync)(dir)) return [];
-  return (0, import_node_fs11.readdirSync)(dir).filter((f) => f.endsWith(".json") && !NON_LAYER_GRAPH_FILES.has(f)).map((f) => f.replace(".json", ""));
+  return (0, import_node_fs11.readdirSync)(dir).filter((f) => f.endsWith(".json") && !f.startsWith(".") && !NON_LAYER_GRAPH_FILES.has(f)).map((f) => f.replace(".json", ""));
 }
 function graphsDir(rootDir) {
   return (0, import_node_path13.join)(rootDir, GRAPHS_DIR2);
@@ -24089,6 +24089,8 @@ function extractDeep(absPath) {
     false
   );
   const hasEffects = Object.keys(fileEffects).length > 0;
+  const uiLabels = collectUiLabels(root);
+  const notes = collectNotes(root);
   return {
     elements,
     stateVars,
@@ -24096,10 +24098,77 @@ function extractDeep(absPath) {
     variables,
     responses,
     params,
-    ...hasEffects ? { effects: fileEffects } : {}
+    ...hasEffects ? { effects: fileEffects } : {},
+    ...uiLabels.length > 0 ? { ui_labels: uiLabels } : {},
+    ...notes.length > 0 ? { notes } : {}
   };
 }
-var import_node_fs15, import_node_path17, tsxLanguage, parserInstance, TreeSitterCtor, initPromise, initialized, queriesDir, queryCache, MAX_PARSEABLE_BYTES, MAX_CONSECUTIVE_PARSE_FAILURES, consecutiveParseFailures, ParseCascadeError, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS, TRUST_AS_PROTECT_KEYS, TIMER_FNS, DOM_METHOD_NAMES, CLASSLIST_METHODS, STORAGE_OBJECTS, HISTORY_METHODS, LOCATION_METHODS, ASSIGN_DOM_PROPS;
+function collectNotes(root) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  function visit(node) {
+    if (out.length >= NOTES_MAX) return;
+    if (node.type === "comment") {
+      const text = node.text;
+      const startRow = node.startPosition.row;
+      NOTE_REGEX.lastIndex = 0;
+      let m;
+      while ((m = NOTE_REGEX.exec(text)) !== null) {
+        const kind = m[1];
+        const author = m[2];
+        const body = m[3];
+        if (!kind || !body) continue;
+        const newlinesBefore = (text.slice(0, m.index).match(/\n/g) ?? []).length;
+        const line = startRow + 1 + newlinesBefore;
+        const key = `${line}:${kind}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const note = {
+          kind,
+          text: body.length <= 200 ? body : body.slice(0, 200) + "...",
+          line
+        };
+        if (author) note.author = author;
+        out.push(note);
+        if (out.length >= NOTES_MAX) return;
+      }
+    }
+    for (const child of node.namedChildren) {
+      visit(child);
+      if (out.length >= NOTES_MAX) return;
+    }
+  }
+  visit(root);
+  return out;
+}
+function collectUiLabels(root) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  function visit(node) {
+    if (out.length >= UI_LABELS_MAX) return;
+    if (node.type === "pair") {
+      const key = node.childForFieldName("key");
+      const val = node.childForFieldName("value");
+      if (key && val) {
+        const keyText = key.type === "property_identifier" ? key.text : stringLiteralValue(key) ?? key.text;
+        if (UI_LABEL_KEYS.has(keyText)) {
+          const strVal = stringLiteralValue(val);
+          if (strVal && strVal.length > 0 && strVal.length <= 200 && !seen.has(strVal)) {
+            seen.add(strVal);
+            out.push(strVal);
+          }
+        }
+      }
+    }
+    for (const child of node.namedChildren) {
+      visit(child);
+      if (out.length >= UI_LABELS_MAX) return;
+    }
+  }
+  visit(root);
+  return out;
+}
+var import_node_fs15, import_node_path17, tsxLanguage, parserInstance, TreeSitterCtor, initPromise, initialized, queriesDir, queryCache, MAX_PARSEABLE_BYTES, MAX_CONSECUTIVE_PARSE_FAILURES, consecutiveParseFailures, ParseCascadeError, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS, TRUST_AS_PROTECT_KEYS, TIMER_FNS, DOM_METHOD_NAMES, CLASSLIST_METHODS, STORAGE_OBJECTS, HISTORY_METHODS, LOCATION_METHODS, ASSIGN_DOM_PROPS, UI_LABEL_KEYS, UI_LABELS_MAX, NOTE_REGEX, NOTES_MAX;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
@@ -24218,6 +24287,27 @@ var init_ts_extractor = __esm({
       "selected",
       "disabled"
     ]);
+    UI_LABEL_KEYS = /* @__PURE__ */ new Set([
+      "label",
+      "title",
+      "name",
+      "text",
+      "description",
+      "placeholder",
+      "tooltip",
+      "heading",
+      "subheading",
+      "sheetTitle",
+      "sheetDescription",
+      "caption",
+      "cta",
+      "buttonText",
+      "emptyText",
+      "subtitle"
+    ]);
+    UI_LABELS_MAX = 200;
+    NOTE_REGEX = /^\s*(?:\/\/|\/\*+|\*)\s*([A-Z][A-Z0-9_]{1,15})(?:\(([^)]+)\))?:\s*(\S.*?)\s*(?:\*\/)?$/gm;
+    NOTES_MAX = 100;
   }
 });
 
@@ -24229,7 +24319,7 @@ __export(watcher_exports, {
 function isIgnoredPath(rel) {
   if (rel.startsWith(GRAPHS_RELATIVE)) return true;
   if (rel.endsWith(".lock") || rel.endsWith(".log")) return true;
-  for (const part of rel.split(import_node_path30.sep)) {
+  for (const part of rel.split(import_node_path32.sep)) {
     if (IGNORE_SEGMENTS.has(part)) return true;
   }
   return false;
@@ -24271,7 +24361,7 @@ function startGraphWatcher(rootDir, opts = {}) {
       regenerating = false;
     }
   }
-  const watcher = (0, import_node_fs26.watch)(rootDir, { recursive: true }, (event, filename) => {
+  const watcher = (0, import_node_fs27.watch)(rootDir, { recursive: true }, (event, filename) => {
     if (!filename) return;
     const rel = filename.toString();
     if (process.env.LAUNCH_CHART_WATCH_TRACE === "1") {
@@ -24304,12 +24394,12 @@ function startGraphWatcher(rootDir, opts = {}) {
     freshness: () => getFreshnessTracker(rootDir).get()
   };
 }
-var import_node_fs26, import_node_path30, IGNORE_SEGMENTS, TRIGGER_EXTENSIONS, GRAPHS_RELATIVE;
+var import_node_fs27, import_node_path32, IGNORE_SEGMENTS, TRIGGER_EXTENSIONS, GRAPHS_RELATIVE;
 var init_watcher = __esm({
   "src/server/graph/core/watcher.ts"() {
     "use strict";
-    import_node_fs26 = require("node:fs");
-    import_node_path30 = require("node:path");
+    import_node_fs27 = require("node:fs");
+    import_node_path32 = require("node:path");
     init_launch_kit_paths();
     init_graph();
     init_freshness();
@@ -24338,7 +24428,7 @@ var init_watcher = __esm({
       ".prisma",
       ".sql"
     ]);
-    GRAPHS_RELATIVE = (0, import_node_path30.join)(LAUNCHSECURE_DIR, "graphs");
+    GRAPHS_RELATIVE = (0, import_node_path32.join)(LAUNCHSECURE_DIR, "graphs");
   }
 });
 
@@ -26015,7 +26105,7 @@ var PostImplLaunchExecutor = class {
     return 3001;
   }
   startDevServer(port, databaseUrl) {
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       const env = { ...process.env, PORT: String(port), ...databaseUrl ? { DATABASE_URL: databaseUrl } : {} };
       this.devProcess = (0, import_child_process3.spawn)("npm", ["run", "dev"], {
         cwd: this.workingDir,
@@ -26027,7 +26117,7 @@ var PostImplLaunchExecutor = class {
       const timeout = setTimeout(() => {
         if (!resolved) {
           resolved = true;
-          this.healthCheck(port).then(resolve5);
+          this.healthCheck(port).then(resolve6);
         }
       }, 15e3);
       const onData = (data) => {
@@ -26036,7 +26126,7 @@ var PostImplLaunchExecutor = class {
           if (!resolved) {
             resolved = true;
             clearTimeout(timeout);
-            resolve5(true);
+            resolve6(true);
           }
         }
       };
@@ -26047,7 +26137,7 @@ var PostImplLaunchExecutor = class {
         if (!resolved) {
           resolved = true;
           clearTimeout(timeout);
-          resolve5(false);
+          resolve6(false);
         }
       });
       this.devProcess.unref();
@@ -27392,7 +27482,7 @@ var ProjectMcpClient = class {
     this.initialized = true;
   }
   send(body) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const headers = {
         ...this.headers,
         "Content-Length": String(Buffer.byteLength(body))
@@ -27417,7 +27507,7 @@ var ProjectMcpClient = class {
               return;
             }
             const sid = res.headers["mcp-session-id"];
-            resolve5({ body: text, sessionId: typeof sid === "string" ? sid : void 0 });
+            resolve6({ body: text, sessionId: typeof sid === "string" ? sid : void 0 });
           });
         }
       );
@@ -28344,16 +28434,16 @@ var CloudflaredTunnel = class extends import_node_events.EventEmitter {
     const tun = this.tunnel;
     this.tunnel = null;
     if (!tun) return;
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       tun.once("exit", () => {
         this.emit("stopped");
-        resolve5();
+        resolve6();
       });
       try {
         tun.stop();
       } catch {
       }
-      setTimeout(() => resolve5(), 6e3);
+      setTimeout(() => resolve6(), 6e3);
     });
   }
   spawnOnce() {
@@ -29007,10 +29097,10 @@ function streamTranscript(opts) {
 }
 
 // src/server/graph-mcp.ts
-var import_node_fs27 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_path33 = require("node:path");
 var import_node_child_process3 = require("node:child_process");
-var import_node_os5 = require("node:os");
+var import_node_os6 = require("node:os");
 init_launch_kit_paths();
 init_graph();
 
@@ -29753,6 +29843,7 @@ function generate(rootDir) {
         responses: deep.responses,
         params: deep.params,
         ...deep.effects ? { effects: deep.effects } : {},
+        ...deep.notes ? { notes: deep.notes } : {},
         _dbCalls: dbCalls
         // temp: used for cross-ref building below
       });
@@ -29773,6 +29864,8 @@ function generate(rootDir) {
         conditions: deep.conditions,
         variables: deep.variables,
         ...deep.effects ? { effects: deep.effects } : {},
+        ...deep.ui_labels ? { ui_labels: deep.ui_labels } : {},
+        ...deep.notes ? { notes: deep.notes } : {},
         ...authWrappers.length > 0 ? { auth: authWrappers } : {},
         ...dbCalls.length > 0 ? { _dbCalls: dbCalls } : {}
       });
@@ -30374,6 +30467,7 @@ var prismaSchemaParser = {
 // src/server/graph/parsers/db/sql-migrations.ts
 var import_node_fs18 = require("node:fs");
 var import_node_path19 = require("node:path");
+var import_pgsql_parser = require("pgsql-parser");
 init_config();
 var PG_TO_PRISMA = {
   "TEXT": "String",
@@ -30405,243 +30499,6 @@ function pgTypeToPrisma(pgType) {
   const upper = pgType.toUpperCase().trim();
   return PG_TO_PRISMA[upper] ?? upper;
 }
-var ID = `(?:"[\\w$]+"|[\\w$]+)`;
-var QID = `(?:${ID}\\.)?${ID}`;
-function bareName(captured) {
-  const parts = captured.split(".");
-  const last = parts[parts.length - 1];
-  return last.replace(/^"(.*)"$/, "$1").trim();
-}
-function parseCreateTable(sql, state) {
-  const re = new RegExp(
-    `CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(${QID})\\s*\\(([\\s\\S]*?)\\);`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const tableName = bareName(m[1]);
-    const body = m[2];
-    const columns = /* @__PURE__ */ new Map();
-    let primaryCol = null;
-    const inlineFks = [];
-    const lines = splitTopLevelCommas(body);
-    for (const raw of lines) {
-      const trimmed = raw.trim().replace(/,\s*$/, "");
-      if (!trimmed || trimmed.startsWith("--")) continue;
-      const namedPk = trimmed.match(new RegExp(`^CONSTRAINT\\s+${ID}\\s+PRIMARY\\s+KEY\\s*\\(\\s*(${QID})`, "i"));
-      if (namedPk) {
-        primaryCol = bareName(namedPk[1]);
-        continue;
-      }
-      const tablePk = trimmed.match(new RegExp(`^PRIMARY\\s+KEY\\s*\\(\\s*(${QID})`, "i"));
-      if (tablePk) {
-        primaryCol = bareName(tablePk[1]);
-        continue;
-      }
-      if (/^UNIQUE\s*\(/i.test(trimmed)) continue;
-      const namedFk = trimmed.match(new RegExp(
-        `^CONSTRAINT\\s+(${ID})\\s+FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
-        "i"
-      ));
-      if (namedFk) {
-        inlineFks.push({
-          constraintName: bareName(namedFk[1]),
-          sourceTable: tableName,
-          sourceColumn: bareName(namedFk[2]),
-          targetTable: bareName(namedFk[3]),
-          targetColumn: bareName(namedFk[4]),
-          onDelete: namedFk[5] ?? null
-        });
-        continue;
-      }
-      const bareFk = trimmed.match(new RegExp(
-        `^FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
-        "i"
-      ));
-      if (bareFk) {
-        inlineFks.push({
-          constraintName: `${tableName}_${bareName(bareFk[1])}_fkey`,
-          sourceTable: tableName,
-          sourceColumn: bareName(bareFk[1]),
-          targetTable: bareName(bareFk[2]),
-          targetColumn: bareName(bareFk[3]),
-          onDelete: bareFk[4] ?? null
-        });
-        continue;
-      }
-      if (/^CONSTRAINT\s/i.test(trimmed)) continue;
-      const colMatch = trimmed.match(new RegExp(`^(${ID})\\s+(.+)`, "i"));
-      if (!colMatch) continue;
-      const colName = bareName(colMatch[1]);
-      let rest = colMatch[2];
-      const inlineRefMatch = rest.match(new RegExp(
-        `\\bREFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
-        "i"
-      ));
-      if (inlineRefMatch) {
-        inlineFks.push({
-          constraintName: `${tableName}_${colName}_fkey`,
-          sourceTable: tableName,
-          sourceColumn: colName,
-          targetTable: bareName(inlineRefMatch[1]),
-          targetColumn: bareName(inlineRefMatch[2]),
-          onDelete: inlineRefMatch[3] ?? null
-        });
-        rest = rest.replace(inlineRefMatch[0], "").trim();
-      }
-      const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
-      const isPrimaryKey = /\bPRIMARY\s+KEY\b/i.test(rest);
-      const isUnique = /\bUNIQUE\b/i.test(rest);
-      const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)(?:\s*,?\s*$)/i);
-      const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
-      let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bPRIMARY\s+KEY\b/gi, "").replace(/\bUNIQUE\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim().replace(/,\s*$/, "").trim();
-      columns.set(colName, {
-        name: colName,
-        type: colType,
-        nullable: !isNotNull && !isPrimaryKey,
-        primary: isPrimaryKey,
-        unique: isUnique,
-        default: defaultVal
-      });
-      if (isPrimaryKey) primaryCol = colName;
-    }
-    if (primaryCol && columns.has(primaryCol)) {
-      columns.get(primaryCol).primary = true;
-    }
-    state.tables.set(tableName, { name: tableName, columns });
-    state.fks.push(...inlineFks);
-  }
-}
-function splitTopLevelCommas(body) {
-  const out = [];
-  let depth = 0;
-  let buf = "";
-  let inString = null;
-  for (const ch of body) {
-    if (inString) {
-      buf += ch;
-      if (ch === inString) inString = null;
-      continue;
-    }
-    if (ch === "'" || ch === '"') {
-      inString = ch;
-      buf += ch;
-      continue;
-    }
-    if (ch === "(") depth++;
-    else if (ch === ")") depth--;
-    if (ch === "," && depth === 0) {
-      out.push(buf);
-      buf = "";
-      continue;
-    }
-    buf += ch;
-  }
-  if (buf.trim()) out.push(buf);
-  return out;
-}
-function parseCreateEnum(sql, state) {
-  const re = new RegExp(
-    `CREATE\\s+TYPE\\s+(${QID})\\s+AS\\s+ENUM\\s*\\(([^)]+)\\)`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const enumName = bareName(m[1]);
-    const valuesStr = m[2];
-    const values = new Set(
-      valuesStr.split(",").map((v) => v.trim().replace(/^'(.*)'$/, "$1")).filter(Boolean)
-    );
-    state.enums.set(enumName, { name: enumName, values });
-  }
-}
-function parseAlterTable(sql, state) {
-  const addColRe = new RegExp(
-    `ALTER\\s+TABLE\\s+(${QID})\\s+ADD\\s+COLUMN\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(${QID})\\s+(.+?);`,
-    "gi"
-  );
-  let m;
-  while ((m = addColRe.exec(sql)) !== null) {
-    const tableName = bareName(m[1]);
-    const colName = bareName(m[2]);
-    let rest = m[3];
-    const table = state.tables.get(tableName);
-    if (!table) continue;
-    const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
-    const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)$/i);
-    const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
-    let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim();
-    table.columns.set(colName, {
-      name: colName,
-      type: colType,
-      nullable: !isNotNull,
-      primary: false,
-      unique: false,
-      default: defaultVal
-    });
-  }
-  const dropColRe = new RegExp(
-    `ALTER\\s+TABLE\\s+(${QID})\\s+DROP\\s+COLUMN\\s+(?:IF\\s+EXISTS\\s+)?(${QID})`,
-    "gi"
-  );
-  while ((m = dropColRe.exec(sql)) !== null) {
-    const table = state.tables.get(bareName(m[1]));
-    if (table) table.columns.delete(bareName(m[2]));
-  }
-  const fkRe = new RegExp(
-    `ALTER\\s+TABLE\\s+(${QID})\\s+ADD\\s+CONSTRAINT\\s+(${ID})\\s+FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
-    "gi"
-  );
-  while ((m = fkRe.exec(sql)) !== null) {
-    state.fks.push({
-      constraintName: bareName(m[2]),
-      sourceTable: bareName(m[1]),
-      sourceColumn: bareName(m[3]),
-      targetTable: bareName(m[4]),
-      targetColumn: bareName(m[5]),
-      onDelete: m[6] ?? null
-    });
-  }
-}
-function parseAlterEnum(sql, state) {
-  const re = new RegExp(
-    `ALTER\\s+TYPE\\s+(${QID})\\s+ADD\\s+VALUE\\s+'([^']+)'`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const en = state.enums.get(bareName(m[1]));
-    if (en) en.values.add(m[2]);
-  }
-}
-function parseDropTable(sql, state) {
-  const re = new RegExp(
-    `DROP\\s+TABLE\\s+(?:IF\\s+EXISTS\\s+)?(${QID})`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const dropped = bareName(m[1]);
-    state.tables.delete(dropped);
-    state.fks = state.fks.filter((fk) => fk.sourceTable !== dropped && fk.targetTable !== dropped);
-  }
-}
-function parseUniqueIndex(sql, state) {
-  const re = new RegExp(
-    `CREATE\\s+UNIQUE\\s+INDEX\\s+(?:(?:IF\\s+NOT\\s+EXISTS\\s+)?(?:${ID}\\s+)?)?ON\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const tableName = bareName(m[1]);
-    const colName = bareName(m[2]);
-    const table = state.tables.get(tableName);
-    const col = table?.columns.get(colName);
-    if (col) col.unique = true;
-    if (!state.uniqueIndexes.has(tableName)) state.uniqueIndexes.set(tableName, /* @__PURE__ */ new Set());
-    state.uniqueIndexes.get(tableName).add(colName);
-  }
-}
 function discoverMigrationFiles(migrationsDir) {
   if (!(0, import_node_fs18.existsSync)(migrationsDir)) return [];
   const out = [];
@@ -30656,25 +30513,614 @@ function discoverMigrationFiles(migrationsDir) {
   }
   return out;
 }
-function parseMigrations(migrationsDir) {
+var postgresDialect = {
+  parse(sql) {
+    return (0, import_pgsql_parser.parseSync)(sql);
+  },
+  applyAll(ast, state, filepath) {
+    const stmts = ast.stmts ?? [];
+    extractTablesFromStmts(stmts, state);
+    extractEnumsFromStmts(stmts, state);
+    extractIndexesFromStmts(stmts, state, filepath);
+    extractPoliciesFromStmts(stmts, state, filepath);
+    extractExtensionsFromStmts(stmts, state, filepath);
+    extractTriggersFromStmts(stmts, state, filepath);
+    extractFunctionsFromStmts(stmts, state, filepath);
+    extractViewsFromStmts(stmts, state, filepath);
+    applyDropIndexes(stmts, state);
+    applyDropPolicies(stmts, state);
+    applyDropsForSchemaObjects(stmts, state);
+    applyAstAlterEnums(stmts, state);
+    applyAstAlterations(stmts, state);
+  },
+  extractMigrationInfo(ast, name, filepath) {
+    const stmts = ast.stmts ?? [];
+    return extractMigrationInfoFromStmts(stmts, name, filepath);
+  }
+};
+function parseMigrations(migrationsDir, dialect = postgresDialect) {
   const state = {
     tables: /* @__PURE__ */ new Map(),
     enums: /* @__PURE__ */ new Map(),
     fks: [],
-    uniqueIndexes: /* @__PURE__ */ new Map()
+    uniqueIndexes: /* @__PURE__ */ new Map(),
+    indexes: [],
+    policies: [],
+    extensions: [],
+    triggers: [],
+    functions: [],
+    views: []
   };
   if (!migrationsDir) return state;
   for (const sqlPath of discoverMigrationFiles(migrationsDir)) {
     const sql = (0, import_node_fs18.readFileSync)(sqlPath, "utf-8");
-    parseCreateEnum(sql, state);
-    parseCreateTable(sql, state);
-    parseAlterTable(sql, state);
-    parseAlterEnum(sql, state);
-    parseDropTable(sql, state);
-    parseUniqueIndex(sql, state);
+    let ast;
+    try {
+      ast = dialect.parse(sql);
+    } catch {
+      continue;
+    }
+    dialect.applyAll(ast, state, sqlPath);
   }
   return state;
 }
+function extractIndexesFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const stmt = wrap.stmt ?? {};
+    const ix = stmt.IndexStmt;
+    if (!ix) continue;
+    const name = ix.idxname ?? "";
+    if (!name) continue;
+    const table = ix.relation?.relname ?? "";
+    const unique = !!ix.unique;
+    const method = String(ix.accessMethod ?? "btree").toLowerCase();
+    const params = ix.indexParams ?? [];
+    const columns = [];
+    let hasExpressions = false;
+    for (const p of params) {
+      const elem = p.IndexElem;
+      if (!elem) continue;
+      if (elem.name) columns.push(elem.name);
+      else if (elem.expr) hasExpressions = true;
+    }
+    const hasPredicate = !!ix.whereClause;
+    const existing = state.indexes.findIndex((i) => i.name === name);
+    const next = { name, table, unique, method, columns, hasExpressions, hasPredicate, filepath };
+    if (existing >= 0) state.indexes[existing] = next;
+    else state.indexes.push(next);
+    if (unique && columns.length === 1 && !hasPredicate && !hasExpressions) {
+      const t = state.tables.get(table);
+      const col = t?.columns.get(columns[0]);
+      if (col) col.unique = true;
+      if (!state.uniqueIndexes.has(table)) state.uniqueIndexes.set(table, /* @__PURE__ */ new Set());
+      state.uniqueIndexes.get(table).add(columns[0]);
+    }
+  }
+}
+function applyDropIndexes(stmts, state) {
+  for (const wrap of stmts) {
+    const drop = wrap.stmt?.DropStmt;
+    if (!drop || drop.removeType !== "OBJECT_INDEX") continue;
+    const objects = drop.objects ?? [];
+    const droppedNames = /* @__PURE__ */ new Set();
+    for (const obj of objects) {
+      const items = obj.List?.items ?? [];
+      const last = items[items.length - 1]?.String?.sval;
+      if (last) droppedNames.add(last);
+    }
+    if (droppedNames.size > 0) {
+      state.indexes = state.indexes.filter((i) => !droppedNames.has(i.name));
+    }
+  }
+}
+function formatPgTypeName(typeName) {
+  const names = (typeName?.names ?? []).map((n) => n.String?.sval ?? "").filter(Boolean);
+  const base = (names[names.length - 1] ?? "").toLowerCase();
+  const PG_INTERNAL_MAP = {
+    int4: "INTEGER",
+    int8: "BIGINT",
+    int2: "SMALLINT",
+    float8: "DOUBLE PRECISION",
+    float4: "REAL",
+    bool: "BOOLEAN",
+    bpchar: "CHAR",
+    timestamptz: "TIMESTAMPTZ",
+    timestamp: "TIMESTAMP",
+    numeric: "NUMERIC",
+    text: "TEXT",
+    varchar: "VARCHAR",
+    jsonb: "JSONB",
+    json: "JSON",
+    uuid: "UUID",
+    date: "DATE",
+    bytea: "BYTEA"
+  };
+  return PG_INTERNAL_MAP[base] ?? base.toUpperCase();
+}
+function applyAstAlterations(stmts, state) {
+  for (const wrap of stmts) {
+    const stmt = wrap.stmt ?? {};
+    const kind = Object.keys(stmt)[0];
+    if (!kind) continue;
+    if (kind === "AlterTableStmt") {
+      const body = stmt.AlterTableStmt;
+      const tableName = body.relation?.relname ?? "";
+      const table = state.tables.get(tableName);
+      if (!table) continue;
+      const cmds = body.cmds ?? [];
+      for (const c of cmds) {
+        const cmd = c.AlterTableCmd;
+        if (!cmd) continue;
+        const subtype = cmd.subtype ?? "";
+        const colName = cmd.name ?? "";
+        const col = colName ? table.columns.get(colName) : void 0;
+        switch (subtype) {
+          case "AT_AlterColumnType": {
+            if (!col) break;
+            const typeName = cmd.def?.ColumnDef?.typeName ?? cmd.def?.typeName;
+            if (typeName) col.type = formatPgTypeNameWithMods(typeName);
+            break;
+          }
+          case "AT_SetNotNull":
+            if (col) col.nullable = false;
+            break;
+          case "AT_DropNotNull":
+            if (col) col.nullable = true;
+            break;
+          case "AT_AddColumn": {
+            const cd = cmd.def?.ColumnDef;
+            if (!cd) break;
+            const newColName = cd.colname ?? "";
+            if (!newColName) break;
+            if (table.columns.has(newColName)) break;
+            let nullable = true;
+            let primary = false;
+            let unique = false;
+            let defaultVal = null;
+            for (const c2 of cd.constraints ?? []) {
+              const ct = c2.Constraint;
+              if (!ct) continue;
+              if (ct.contype === "CONSTR_NOTNULL") nullable = false;
+              else if (ct.contype === "CONSTR_PRIMARY") {
+                primary = true;
+                nullable = false;
+              } else if (ct.contype === "CONSTR_UNIQUE") unique = true;
+              else if (ct.contype === "CONSTR_DEFAULT") defaultVal = "<expr>";
+            }
+            table.columns.set(newColName, {
+              name: newColName,
+              type: formatPgTypeNameWithMods(cd.typeName),
+              nullable,
+              primary,
+              unique,
+              default: defaultVal
+            });
+            break;
+          }
+          case "AT_DropColumn":
+            if (colName) table.columns.delete(colName);
+            break;
+          case "AT_AddConstraint": {
+            const ct = cmd.def?.Constraint;
+            if (!ct) break;
+            if (ct.contype !== "CONSTR_FOREIGN") break;
+            const fkCols = (ct.fk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            const pkCols = (ct.pk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            const pkTable = ct.pktable?.relname ?? "";
+            if (fkCols.length && pkCols.length && pkTable) {
+              state.fks.push({
+                constraintName: ct.conname || `${tableName}_${fkCols[0]}_fkey`,
+                sourceTable: tableName,
+                sourceColumn: fkCols[0],
+                targetTable: pkTable,
+                targetColumn: pkCols[0],
+                onDelete: mapFkAction(ct.fk_del_action)
+              });
+            }
+            break;
+          }
+        }
+      }
+    } else if (kind === "RenameStmt") {
+      const body = stmt.RenameStmt;
+      const renameType = body.renameType ?? "";
+      const newName = body.newname ?? "";
+      if (renameType === "OBJECT_COLUMN") {
+        const tableName = body.relation?.relname ?? "";
+        const oldName = body.subname ?? "";
+        const table = state.tables.get(tableName);
+        if (!table || !oldName || !newName) continue;
+        const col = table.columns.get(oldName);
+        if (col) {
+          col.name = newName;
+          table.columns.delete(oldName);
+          table.columns.set(newName, col);
+        }
+      } else if (renameType === "OBJECT_TABLE") {
+        const oldName = body.relation?.relname ?? "";
+        if (!oldName || !newName) continue;
+        const t = state.tables.get(oldName);
+        if (!t) continue;
+        state.tables.delete(oldName);
+        t.name = newName;
+        state.tables.set(newName, t);
+        for (const fk of state.fks) {
+          if (fk.sourceTable === oldName) fk.sourceTable = newName;
+          if (fk.targetTable === oldName) fk.targetTable = newName;
+        }
+      }
+    }
+  }
+}
+function extractPoliciesFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreatePolicyStmt;
+    if (!body) continue;
+    const name = body.policy_name ?? "";
+    if (!name) continue;
+    const table = body.table?.relname ?? "";
+    const cmdRaw = String(body.cmd_name ?? "all").toUpperCase();
+    const command = ["SELECT", "INSERT", "UPDATE", "DELETE", "ALL"].includes(cmdRaw) ? cmdRaw : "ALL";
+    const permissive = body.permissive === true;
+    const roles = (body.roles ?? []).map((r) => {
+      const rs = r.RoleSpec;
+      if (!rs) return "";
+      if (rs.roletype === "ROLESPEC_PUBLIC") return "public";
+      if (rs.roletype === "ROLESPEC_CURRENT_USER") return "current_user";
+      if (rs.roletype === "ROLESPEC_CSTRING" && rs.rolename) return rs.rolename;
+      return "";
+    }).filter(Boolean);
+    const hasUsing = !!body.qual;
+    const hasWithCheck = !!body.with_check;
+    const existing = state.policies.findIndex((p) => p.table === table && p.name === name);
+    const next = { name, table, command, permissive, roles, hasUsing, hasWithCheck, filepath };
+    if (existing >= 0) state.policies[existing] = next;
+    else state.policies.push(next);
+  }
+}
+function applyDropPolicies(stmts, state) {
+  for (const wrap of stmts) {
+    const drop = wrap.stmt?.DropStmt;
+    if (!drop || drop.removeType !== "OBJECT_POLICY") continue;
+    const objects = drop.objects ?? [];
+    for (const obj of objects) {
+      const items = obj.List?.items ?? [];
+      if (items.length < 2) continue;
+      const table = items[0]?.String?.sval ?? "";
+      const policyName = items[items.length - 1]?.String?.sval ?? "";
+      if (!table || !policyName) continue;
+      state.policies = state.policies.filter((p) => !(p.table === table && p.name === policyName));
+    }
+  }
+}
+function mapFkAction(action) {
+  if (!action) return null;
+  const m = {
+    r: "RESTRICT",
+    c: "CASCADE",
+    s: "SET NULL",
+    d: "SET DEFAULT",
+    a: "NO ACTION",
+    // pgsql-parser may also emit FKCONSTR_ACTION_* enum strings:
+    FKCONSTR_ACTION_RESTRICT: "RESTRICT",
+    FKCONSTR_ACTION_CASCADE: "CASCADE",
+    FKCONSTR_ACTION_SETNULL: "SET NULL",
+    FKCONSTR_ACTION_SETDEFAULT: "SET DEFAULT",
+    FKCONSTR_ACTION_NOACTION: "NO ACTION"
+  };
+  return m[action] ?? null;
+}
+function formatPgTypeNameWithMods(typeName) {
+  const base = formatPgTypeName(typeName);
+  if (base === "String" || base === "unknown") return base;
+  const typmods = [];
+  for (const m of typeName?.typmods ?? []) {
+    const v = m.A_Const?.ival?.ival;
+    if (typeof v === "number") typmods.push(v);
+  }
+  return typmods.length ? `${base}(${typmods.join(",")})` : base;
+}
+function extractTablesFromStmts(stmts, state) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateStmt;
+    if (!body) continue;
+    const tableName = body.relation?.relname ?? "";
+    if (!tableName) continue;
+    const columns = /* @__PURE__ */ new Map();
+    const fks = [];
+    let primaryCol = null;
+    for (const elt of body.tableElts ?? []) {
+      if (elt.ColumnDef) {
+        const cd = elt.ColumnDef;
+        const colName = cd.colname ?? "";
+        if (!colName) continue;
+        const colType = formatPgTypeNameWithMods(cd.typeName);
+        let nullable = true;
+        let primary = false;
+        let unique = false;
+        let defaultVal = null;
+        for (const c of cd.constraints ?? []) {
+          const ct = c.Constraint;
+          if (!ct) continue;
+          switch (ct.contype) {
+            case "CONSTR_NOTNULL":
+              nullable = false;
+              break;
+            case "CONSTR_PRIMARY":
+              primary = true;
+              nullable = false;
+              primaryCol = colName;
+              break;
+            case "CONSTR_UNIQUE":
+              unique = true;
+              break;
+            case "CONSTR_DEFAULT":
+              defaultVal = "<expr>";
+              break;
+            case "CONSTR_FOREIGN": {
+              const pkTable = ct.pktable?.relname ?? "";
+              const pkCols = (ct.pk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+              if (pkTable && pkCols.length) {
+                fks.push({
+                  constraintName: ct.conname || `${tableName}_${colName}_fkey`,
+                  sourceTable: tableName,
+                  sourceColumn: colName,
+                  targetTable: pkTable,
+                  targetColumn: pkCols[0],
+                  onDelete: mapFkAction(ct.fk_del_action)
+                });
+              }
+              break;
+            }
+          }
+        }
+        columns.set(colName, {
+          name: colName,
+          type: colType,
+          nullable,
+          primary,
+          unique,
+          default: defaultVal
+        });
+      } else if (elt.Constraint) {
+        const ct = elt.Constraint;
+        switch (ct.contype) {
+          case "CONSTR_PRIMARY": {
+            const keys = (ct.keys ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            if (keys.length) primaryCol = keys[0];
+            break;
+          }
+          case "CONSTR_FOREIGN": {
+            const fkCols = (ct.fk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            const pkCols = (ct.pk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            const pkTable = ct.pktable?.relname ?? "";
+            if (fkCols.length && pkCols.length && pkTable) {
+              fks.push({
+                constraintName: ct.conname || `${tableName}_${fkCols[0]}_fkey`,
+                sourceTable: tableName,
+                sourceColumn: fkCols[0],
+                targetTable: pkTable,
+                targetColumn: pkCols[0],
+                onDelete: mapFkAction(ct.fk_del_action)
+              });
+            }
+            break;
+          }
+        }
+      }
+    }
+    if (primaryCol && columns.has(primaryCol)) {
+      columns.get(primaryCol).primary = true;
+      columns.get(primaryCol).nullable = false;
+    }
+    state.tables.set(tableName, { name: tableName, columns });
+    state.fks.push(...fks);
+  }
+}
+function extractEnumsFromStmts(stmts, state) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateEnumStmt;
+    if (!body) continue;
+    const names = (body.typeName ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+    const enumName = names[names.length - 1] ?? "";
+    if (!enumName) continue;
+    const vals = new Set(
+      (body.vals ?? []).map((s) => s.String?.sval ?? "").filter(Boolean)
+    );
+    state.enums.set(enumName, { name: enumName, values: vals });
+  }
+}
+function applyAstAlterEnums(stmts, state) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.AlterEnumStmt;
+    if (!body) continue;
+    const names = (body.typeName ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+    const enumName = names[names.length - 1] ?? "";
+    const en = state.enums.get(enumName);
+    if (!en) continue;
+    if (body.newVal) en.values.add(String(body.newVal));
+  }
+}
+function extractExtensionsFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateExtensionStmt;
+    if (!body) continue;
+    const name = body.extname ?? "";
+    if (!name) continue;
+    let schema = null;
+    let version2 = null;
+    for (const opt of body.options ?? []) {
+      const de = opt.DefElem;
+      if (!de) continue;
+      if (de.defname === "schema" && de.arg?.String?.sval) schema = de.arg.String.sval;
+      else if (de.defname === "new_version" && de.arg?.String?.sval) version2 = de.arg.String.sval;
+    }
+    const next = { name, schema, version: version2, filepath };
+    const existing = state.extensions.findIndex((e) => e.name === name);
+    if (existing >= 0) state.extensions[existing] = next;
+    else state.extensions.push(next);
+  }
+}
+function extractTriggersFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateTrigStmt;
+    if (!body) continue;
+    const name = body.trigname ?? "";
+    if (!name) continue;
+    const table = body.relation?.relname ?? "";
+    const timingVal = body.timing ?? 0;
+    const eventsVal = body.events ?? 0;
+    const timing = timingVal & 2 ? "BEFORE" : timingVal & 64 ? "INSTEAD OF" : "AFTER";
+    const events = [];
+    if (eventsVal & 4) events.push("INSERT");
+    if (eventsVal & 8) events.push("DELETE");
+    if (eventsVal & 16) events.push("UPDATE");
+    if (eventsVal & 32) events.push("TRUNCATE");
+    const funcname = body.funcname ?? [];
+    const funcCall = funcname[funcname.length - 1]?.String?.sval ?? "";
+    const forEach = body.row ? "ROW" : "STATEMENT";
+    const hasWhen = !!body.whenClause;
+    const next = { name, table, timing, events, function: funcCall, hasWhen, forEach, filepath };
+    const existing = state.triggers.findIndex((t) => t.table === table && t.name === name);
+    if (existing >= 0) state.triggers[existing] = next;
+    else state.triggers.push(next);
+  }
+}
+function functionIdFor(name, schema) {
+  return schema ? `${schema}.${name}` : name;
+}
+function extractFunctionsFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateFunctionStmt;
+    if (!body) continue;
+    const fn = body.funcname ?? [];
+    if (fn.length === 0) continue;
+    const name = fn[fn.length - 1]?.String?.sval ?? "";
+    if (!name) continue;
+    const schema = fn.length > 1 ? fn[fn.length - 2]?.String?.sval ?? null : null;
+    let language = "sql";
+    for (const opt of body.options ?? []) {
+      const de = opt.DefElem;
+      if (de?.defname === "language" && de.arg?.String?.sval) language = de.arg.String.sval;
+    }
+    const returnType = body.returnType ? formatPgTypeName(body.returnType) : "";
+    const isProcedure = !!body.is_procedure;
+    const next = { name, schema, language, returnType, isProcedure, filepath };
+    const id = functionIdFor(name, schema);
+    const existing = state.functions.findIndex((f) => functionIdFor(f.name, f.schema) === id);
+    if (existing >= 0) state.functions[existing] = next;
+    else state.functions.push(next);
+  }
+}
+function extractViewsFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const stmt = wrap.stmt ?? {};
+    const view = stmt.ViewStmt;
+    if (view) {
+      const name = view.view?.relname ?? "";
+      if (!name) continue;
+      const schema = view.view?.schemaname ?? null;
+      const next = {
+        name,
+        schema,
+        isMaterialized: false,
+        withCheckOption: String(view.withCheckOption ?? "NO_CHECK_OPTION"),
+        filepath
+      };
+      const id = functionIdFor(name, schema);
+      const existing = state.views.findIndex((v) => functionIdFor(v.name, v.schema) === id);
+      if (existing >= 0) state.views[existing] = next;
+      else state.views.push(next);
+    }
+    const ctas = stmt.CreateTableAsStmt;
+    if (ctas && ctas.objtype === "OBJECT_MATVIEW") {
+      const name = ctas.into?.rel?.relname ?? "";
+      if (!name) continue;
+      const schema = ctas.into?.rel?.schemaname ?? null;
+      const next = {
+        name,
+        schema,
+        isMaterialized: true,
+        withCheckOption: "N/A",
+        filepath
+      };
+      const id = functionIdFor(name, schema);
+      const existing = state.views.findIndex((v) => functionIdFor(v.name, v.schema) === id);
+      if (existing >= 0) state.views[existing] = next;
+      else state.views.push(next);
+    }
+  }
+}
+function applyDropsForSchemaObjects(stmts, state) {
+  for (const wrap of stmts) {
+    const drop = wrap.stmt?.DropStmt;
+    if (!drop) continue;
+    const removeType = drop.removeType ?? "";
+    const objects = drop.objects ?? [];
+    if (removeType === "OBJECT_TABLE") {
+      const droppedTables = /* @__PURE__ */ new Set();
+      for (const obj of objects) {
+        const items = obj.List?.items ?? [];
+        const last = items[items.length - 1]?.String?.sval;
+        if (last) droppedTables.add(last);
+      }
+      if (droppedTables.size > 0) {
+        for (const t of droppedTables) state.tables.delete(t);
+        state.fks = state.fks.filter((fk) => !droppedTables.has(fk.sourceTable) && !droppedTables.has(fk.targetTable));
+      }
+    } else if (removeType === "OBJECT_TYPE") {
+      const droppedEnums = /* @__PURE__ */ new Set();
+      for (const obj of objects) {
+        const tn = obj.TypeName;
+        if (!tn) continue;
+        const names = (tn.names ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+        const last = names[names.length - 1];
+        if (last) droppedEnums.add(last);
+      }
+      for (const e of droppedEnums) state.enums.delete(e);
+    } else if (removeType === "OBJECT_EXTENSION") {
+      const names = /* @__PURE__ */ new Set();
+      for (const obj of objects) {
+        const sval = obj.String?.sval;
+        if (sval) names.add(sval);
+      }
+      if (names.size > 0) state.extensions = state.extensions.filter((e) => !names.has(e.name));
+    } else if (removeType === "OBJECT_TRIGGER") {
+      for (const obj of objects) {
+        const items = obj.List?.items ?? [];
+        if (items.length < 2) continue;
+        const table = items[0]?.String?.sval ?? "";
+        const trigName = items[items.length - 1]?.String?.sval ?? "";
+        if (!table || !trigName) continue;
+        state.triggers = state.triggers.filter((t) => !(t.table === table && t.name === trigName));
+      }
+    } else if (removeType === "OBJECT_FUNCTION" || removeType === "OBJECT_PROCEDURE") {
+      for (const obj of objects) {
+        const items = obj.ObjectWithArgs?.objname?.items ?? obj.ObjectWithArgs?.objname ?? obj.List?.items ?? [];
+        if (!items.length) continue;
+        const segs = items.map((s) => s.String?.sval ?? "").filter(Boolean);
+        if (!segs.length) continue;
+        const name = segs[segs.length - 1];
+        const schema = segs.length > 1 ? segs[segs.length - 2] : null;
+        const id = functionIdFor(name, schema);
+        state.functions = state.functions.filter((f) => functionIdFor(f.name, f.schema) !== id);
+      }
+    } else if (removeType === "OBJECT_VIEW" || removeType === "OBJECT_MATVIEW") {
+      for (const obj of objects) {
+        const items = obj.List?.items ?? [];
+        if (!items.length) continue;
+        const name = items[items.length - 1]?.String?.sval ?? "";
+        const schema = items.length > 1 ? items[items.length - 2]?.String?.sval ?? null : null;
+        if (!name) continue;
+        const id = functionIdFor(name, schema);
+        state.views = state.views.filter((v) => functionIdFor(v.name, v.schema) !== id);
+      }
+    }
+  }
+}
+function indexIsPrismaUncoverable(idx) {
+  return idx.hasPredicate || idx.hasExpressions || idx.method !== "btree";
+}
 function loadPrismaState(schemaPath) {
   if (!schemaPath || !(0, import_node_fs18.existsSync)(schemaPath)) return null;
   const content = (0, import_node_fs18.readFileSync)(schemaPath, "utf-8");
@@ -30841,6 +31287,96 @@ function verify(sqlState, prisma) {
   }
   return { contradictions, flaggedEdges };
 }
+function deriveMigrationName(sqlPath) {
+  const segments = sqlPath.split(/[\\/]/);
+  const last = segments[segments.length - 1];
+  if (last === "migration.sql" && segments.length >= 2) {
+    return segments[segments.length - 2];
+  }
+  return last.replace(/\.sql$/, "");
+}
+function extractMigrationInfoFromStmts(stmts, name, filepath) {
+  let isDestructive = false;
+  let hasOrphanCheck = false;
+  let hasSidecarBackup = false;
+  let hasPreFlightNotice = false;
+  let containsBackfill = false;
+  let containsDropColumn = false;
+  let containsDropTable = false;
+  for (const wrap of stmts) {
+    const stmt = wrap.stmt ?? {};
+    const kind = Object.keys(stmt)[0];
+    if (!kind) continue;
+    const body = stmt[kind] ?? {};
+    switch (kind) {
+      case "AlterTableStmt": {
+        const cmds = body.cmds ?? [];
+        for (const c of cmds) {
+          const subtype = c.AlterTableCmd?.subtype;
+          if (subtype === "AT_DropColumn") {
+            containsDropColumn = true;
+            isDestructive = true;
+          } else if (subtype === "AT_AlterColumnType" || subtype === "AT_DropNotNull" || subtype === "AT_DropConstraint") {
+            isDestructive = true;
+          }
+        }
+        break;
+      }
+      case "DropStmt": {
+        const removeType = body.removeType ?? "";
+        if (removeType === "OBJECT_TABLE") {
+          containsDropTable = true;
+          isDestructive = true;
+        } else if (removeType === "OBJECT_TYPE" || removeType === "OBJECT_COLUMN" || removeType === "OBJECT_INDEX" || removeType === "OBJECT_POLICY") {
+          isDestructive = true;
+        }
+        break;
+      }
+      case "CreateStmt": {
+        const relname = body.relation?.relname ?? "";
+        if (relname.startsWith("_backup_")) hasSidecarBackup = true;
+        break;
+      }
+      case "CreateTableAsStmt": {
+        const relname = body.into?.rel?.relname ?? "";
+        if (relname.startsWith("_backup_")) hasSidecarBackup = true;
+        break;
+      }
+      case "UpdateStmt":
+      case "InsertStmt":
+      case "DeleteStmt": {
+        containsBackfill = true;
+        break;
+      }
+      case "DoStmt": {
+        const args = body.args ?? [];
+        for (const arg of args) {
+          const def = arg.DefElem;
+          if (!def || def.defname !== "as") continue;
+          const code = def.arg?.String?.sval ?? "";
+          if (/\bRAISE\s+EXCEPTION\b/i.test(code)) hasOrphanCheck = true;
+          if (/\bRAISE\s+NOTICE\b/i.test(code)) hasPreFlightNotice = true;
+        }
+        break;
+      }
+    }
+  }
+  const tsMatch = name.match(/^(\d{8,14})/);
+  const timestamp = tsMatch ? tsMatch[1] : null;
+  return {
+    name,
+    filepath,
+    timestamp,
+    isDestructive,
+    hasOrphanCheck,
+    hasSidecarBackup,
+    hasPreFlightNotice,
+    containsBackfill,
+    containsDropColumn,
+    containsDropTable,
+    statementCount: stmts.length
+  };
+}
 function migrationsDirFor(rootDir) {
   const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
   if (!paths) return null;
@@ -30895,6 +31431,132 @@ function generate3(rootDir) {
       values: [...sqlEnum.values]
     });
   }
+  let indexNodeCount = 0;
+  for (const idx of sqlState.indexes) {
+    if (!indexIsPrismaUncoverable(idx)) continue;
+    nodes.push({
+      id: `index:${idx.name}`,
+      type: "index",
+      name: idx.name,
+      source: "sql",
+      table: idx.table,
+      unique: idx.unique,
+      method: idx.method,
+      columns: idx.columns,
+      has_expressions: idx.hasExpressions,
+      has_predicate: idx.hasPredicate,
+      filepath: idx.filepath
+    });
+    indexNodeCount++;
+  }
+  let extensionNodeCount = 0;
+  for (const ext of sqlState.extensions) {
+    nodes.push({
+      id: `extension:${ext.name}`,
+      type: "extension",
+      name: ext.name,
+      source: "sql",
+      schema: ext.schema,
+      version: ext.version,
+      filepath: ext.filepath
+    });
+    extensionNodeCount++;
+  }
+  let triggerNodeCount = 0;
+  for (const trg of sqlState.triggers) {
+    nodes.push({
+      id: `trigger:${trg.table}:${trg.name}`,
+      type: "trigger",
+      name: trg.name,
+      source: "sql",
+      table: trg.table,
+      timing: trg.timing,
+      events: trg.events,
+      function: trg.function,
+      has_when: trg.hasWhen,
+      for_each: trg.forEach,
+      filepath: trg.filepath
+    });
+    triggerNodeCount++;
+  }
+  let functionNodeCount = 0;
+  for (const fn of sqlState.functions) {
+    const qualified = fn.schema ? `${fn.schema}.${fn.name}` : fn.name;
+    nodes.push({
+      id: `function:${qualified}`,
+      type: "function",
+      name: fn.name,
+      source: "sql",
+      schema: fn.schema,
+      language: fn.language,
+      return_type: fn.returnType,
+      is_procedure: fn.isProcedure,
+      filepath: fn.filepath
+    });
+    functionNodeCount++;
+  }
+  let viewNodeCount = 0;
+  for (const vw of sqlState.views) {
+    const qualified = vw.schema ? `${vw.schema}.${vw.name}` : vw.name;
+    nodes.push({
+      id: `${vw.isMaterialized ? "matview" : "view"}:${qualified}`,
+      type: vw.isMaterialized ? "materialized_view" : "view",
+      name: vw.name,
+      source: "sql",
+      schema: vw.schema,
+      is_materialized: vw.isMaterialized,
+      with_check_option: vw.withCheckOption,
+      filepath: vw.filepath
+    });
+    viewNodeCount++;
+  }
+  let policyNodeCount = 0;
+  for (const pol of sqlState.policies) {
+    nodes.push({
+      id: `policy:${pol.table}:${pol.name}`,
+      type: "policy",
+      name: pol.name,
+      source: "sql",
+      table: pol.table,
+      command: pol.command,
+      permissive: pol.permissive,
+      roles: pol.roles,
+      has_using: pol.hasUsing,
+      has_with_check: pol.hasWithCheck,
+      filepath: pol.filepath
+    });
+    policyNodeCount++;
+  }
+  const migrationFiles = migrationsDir ? discoverMigrationFiles(migrationsDir) : [];
+  let migrationNodeCount = 0;
+  for (const sqlPath of migrationFiles) {
+    const sql = (0, import_node_fs18.readFileSync)(sqlPath, "utf-8");
+    const name = deriveMigrationName(sqlPath);
+    let ast;
+    try {
+      ast = postgresDialect.parse(sql);
+    } catch {
+      ast = { stmts: [] };
+    }
+    const info = postgresDialect.extractMigrationInfo(ast, name, sqlPath);
+    nodes.push({
+      id: `migration:${name}`,
+      type: "migration",
+      name,
+      source: "sql",
+      filepath: info.filepath,
+      timestamp: info.timestamp,
+      is_destructive: info.isDestructive,
+      has_orphan_check: info.hasOrphanCheck,
+      has_sidecar_backup: info.hasSidecarBackup,
+      has_pre_flight_notice: info.hasPreFlightNotice,
+      contains_backfill: info.containsBackfill,
+      contains_drop_column: info.containsDropColumn,
+      contains_drop_table: info.containsDropTable,
+      statement_count: info.statementCount
+    });
+    migrationNodeCount++;
+  }
   const sqlOnlyTables = new Set(nodes.filter((n) => n.type === "table").map((n) => n.id));
   const edges = sqlState.fks.filter((fk) => sqlOnlyTables.has(fk.sourceTable)).map((fk) => ({
     source: fk.sourceTable,
@@ -30913,6 +31575,13 @@ function generate3(rootDir) {
       sql_tables: sqlState.tables.size,
       sql_enums: sqlState.enums.size,
       sql_fks: sqlState.fks.length,
+      sql_index_nodes: indexNodeCount,
+      sql_policy_nodes: policyNodeCount,
+      sql_extension_nodes: extensionNodeCount,
+      sql_trigger_nodes: triggerNodeCount,
+      sql_function_nodes: functionNodeCount,
+      sql_view_nodes: viewNodeCount,
+      sql_migration_nodes: migrationNodeCount,
       additive_nodes: nodes.length,
       contradictions_found: contradictions.length,
       flagged_edges_found: flaggedEdges.length
@@ -33053,15 +33722,75 @@ function runAudit(rootDir, layer, check) {
 }
 
 // src/server/graph/core/projects.ts
+var import_node_path31 = require("node:path");
+
+// src/server/lib/worktree.ts
+var import_node_path30 = require("node:path");
+
+// src/server/orbit/registry.ts
+var import_node_fs26 = require("node:fs");
+var import_node_os5 = require("node:os");
 var import_node_path29 = require("node:path");
+init_launch_kit_paths();
+var REGISTRY_DIR = (0, import_node_path29.join)((0, import_node_os5.homedir)(), LAUNCHSECURE_DIR, "orbit");
+var REGISTRY_PATH = (0, import_node_path29.join)(REGISTRY_DIR, "state.json");
+var LOCK_PATH = (0, import_node_path29.join)(REGISTRY_DIR, "state.json.lock");
+function emptyRegistry() {
+  return { version: 1, worktrees: {} };
+}
+function readRegistry() {
+  if (!(0, import_node_fs26.existsSync)(REGISTRY_PATH)) return emptyRegistry();
+  try {
+    const parsed = JSON.parse((0, import_node_fs26.readFileSync)(REGISTRY_PATH, "utf-8"));
+    if (parsed?.version === 1 && parsed.worktrees && typeof parsed.worktrees === "object") {
+      return parsed;
+    }
+  } catch {
+  }
+  return emptyRegistry();
+}
+function listWorktrees() {
+  return Object.values(readRegistry().worktrees);
+}
+
+// src/server/lib/worktree.ts
+var WORKTREE_PARAM_DESCRIPTION = "Optional orbit worktree slug (from `launch-orbit create`). Resolves to the worktree's path via the orbit registry (~/.launchsecure/orbit/state.json). Lets you query a worktree's state from a Claude Code session pinned to the main repo. Superseded by `project_root`.";
+var PROJECT_ROOT_PARAM_DESCRIPTION = "Optional explicit project root. Accepts an absolute path or a path relative to the monorepo root. Escape hatch when `worktree` doesn't fit. Takes precedence over all other root args.";
+function resolveWorktreeRoot(slug, monorepoRoot) {
+  const local = listWorktrees().filter((w) => w.projectRoot === monorepoRoot);
+  const match = local.find((w) => w.slug === slug);
+  if (match) return match.path;
+  if (local.length === 0) {
+    throw new Error(
+      `worktree="${slug}" requested but no worktrees are registered for this project. Run \`launch-orbit create <branch>\` first, or use \`project_root\` to point at an arbitrary path.`
+    );
+  }
+  const available = local.map((w) => `"${w.slug}" (${w.branch})`).join(", ");
+  throw new Error(`Unknown worktree "${slug}". Available: ${available}.`);
+}
+function resolveWorktreeOrProjectRoot(args, monorepoRoot) {
+  const projectRoot = typeof args.project_root === "string" ? args.project_root.trim() : "";
+  if (projectRoot) {
+    return (0, import_node_path30.isAbsolute)(projectRoot) ? projectRoot : (0, import_node_path30.resolve)(monorepoRoot, projectRoot);
+  }
+  const worktree = typeof args.worktree === "string" ? args.worktree.trim() : "";
+  if (worktree) {
+    return resolveWorktreeRoot(worktree, monorepoRoot);
+  }
+  return null;
+}
+
+// src/server/graph/core/projects.ts
 init_config();
+var WORKTREE_PARAM_DESCRIPTION2 = WORKTREE_PARAM_DESCRIPTION;
+var PROJECT_ROOT_PARAM_DESCRIPTION2 = PROJECT_ROOT_PARAM_DESCRIPTION;
 function listProjects(monorepoRoot) {
   const cfg = loadConfig(monorepoRoot);
   const entries = cfg.projects ?? [];
   return entries.map((p) => ({
     name: p.name,
     root: p.root,
-    absoluteRoot: (0, import_node_path29.resolve)(monorepoRoot, p.root)
+    absoluteRoot: (0, import_node_path31.resolve)(monorepoRoot, p.root)
   }));
 }
 function resolveProject(name, projects) {
@@ -33084,6 +33813,12 @@ function resolveProjectRoot(project, monorepoRoot) {
   return resolveProject(raw, projects).absoluteRoot;
 }
 var PROJECT_PARAM_DESCRIPTION = "Optional sub-project name (or root path) from .launchchart.json projects[]. Defaults to the monorepo root. Run detect_project_stack to list configured projects.";
+function resolveRequestRoot(args, monorepoRoot) {
+  const fromArgs = resolveWorktreeOrProjectRoot(args, monorepoRoot);
+  if (fromArgs) return fromArgs;
+  const project = typeof args.project === "string" ? args.project : void 0;
+  return resolveProjectRoot(project, monorepoRoot);
+}
 
 // src/server/graph-mcp.ts
 init_freshness();
@@ -33105,13 +33840,21 @@ var TOOLS = [
         project: {
           type: "string",
           description: PROJECT_PARAM_DESCRIPTION + " Special: omit to regenerate ALL configured projects."
+        },
+        worktree: {
+          type: "string",
+          description: WORKTREE_PARAM_DESCRIPTION2
+        },
+        project_root: {
+          type: "string",
+          description: PROJECT_ROOT_PARAM_DESCRIPTION2
         }
       }
     }
   },
   {
     name: "read_graph",
-    description: 'Query the structural project graph \u2014 use INSTEAD of Glob and Grep for locating files, understanding structure, and navigating the codebase. Faster and more accurate than file-system search because it returns typed nodes with metadata and relationships. \n\nUSE THIS FOR: "where is X", "what files are in module Y", "what pages exist under /admin", "what components does Z render", "what tables relate to User", "list all hooks in auth module", "which endpoints touch the User table", "what auth strategy does this endpoint use". \n\nDO NOT USE FOR: understanding what\'s INSIDE a component (use inspect_node for elements, conditions, state, variables, responses), reading actual source code (use Read). \n\nQUERY PARAMS (at least one required for node data \u2014 unfiltered calls return summary only to stay in context):\n- search: substring match on node id, name, or route\n- type: filter by node type (ui layer: page, layout, component, ui, hook, context, config, util; api layer: endpoint; db layer: table, enum)\n- module: filter by module tag (computed from directory structure, e.g. "auth", "admin", "settings")\n- node_id: return this node + its neighborhood (incoming+outgoing edges within `hops`)\n- hops: neighborhood radius when node_id is set (default 1)\n- minimal: return only id/type/name/module/route per node (skip heavy fields like columns, exports)\n- include_edges: return the actual edge list. Default: TRUE for neighborhood queries (node_id), FALSE for filter queries (search/type/module). Filter responses always include `edge_count`; only pass include_edges:true when you actually need to inspect individual edges (e.g. "which components render X"). This default cuts typical filter responses in half.\n\nBATCH MODE: pass `queries` (array of query objects) to run multiple independent queries in a single call. Each query object uses the same params (layer/search/type/module/node_id/hops/minimal). Returns { batch: true, count, results: [{index, query, result}, ...] }. Use this when you need multiple graph views up-front (e.g. scoping a feature across ui+api+db layers) to save round-trips. When batch mode is used, top-level params are ignored.\n\nReturns: filtered nodes + edges between them. If no filter given, returns per-layer counts and type breakdown only.\n\nWIRE FORMAT (compact): responses that include nodes/edges use short keys and edge-by-index refs to cut payload ~40-60%. Every such response carries a `_schema` legend. Quick reference:\n  nodes[]: { i: id, t: type, n: name, m: module, r: route, mt: methods, x: exports, c: columns }\n  edges[]: { s: source_node_index, d: target_node_index, t: type, l: label }\nedges.s / edges.d are 0-based indices into THIS response\'s nodes array. If a referenced node is not in the response (boundary case), s/d may instead contain the full node id string \u2014 always check the type.\n\nPAGINATION (filter queries):\n- Use `offset` and `limit` to paginate through large result sets.\n- Response includes: `total` (matched), `returned` (in this page), `has_more`, `next_offset`.\n- If `has_more: true`, call again with `offset: next_offset` to get the next page.\n\nBUDGET GUARDS:\n- Neighborhood queries stop expanding when the projected response exceeds budget. The response then contains `budget_exceeded: true` plus `hops_traversed < hops_requested`. When this happens, drill into a specific neighbor with another node_id call rather than retrying with larger hops \u2014 it will just truncate again.\n- Batch mode caps total response size. Once the budget is hit, later queries return `{skipped: true, reason: "batch_budget_exhausted"}` and you must re-run them individually.\n\nMONOREPOS: pass `project: "<name>"` to query a sub-project graph (defined in .launchchart.json projects[]). Omitting `project` targets the monorepo root. In batch mode the top-level `project` is inherited by sub-queries that do not set their own. Run detect_project_stack to list configured projects.',
+    description: 'Query the structural project graph \u2014 use INSTEAD of Glob and Grep for locating files, understanding structure, and navigating the codebase. Faster and more accurate than file-system search because it returns typed nodes with metadata and relationships. \n\nUSE THIS FOR: "where is X", "what files are in module Y", "what pages exist under /admin", "what components does Z render", "what tables relate to User", "list all hooks in auth module", "which endpoints touch the User table", "what auth strategy does this endpoint use". \n\nDO NOT USE FOR: understanding what\'s INSIDE a component (use inspect_node for elements, conditions, state, variables, responses), reading actual source code (use Read). \n\nQUERY PARAMS (at least one required for node data \u2014 unfiltered calls return summary only to stay in context):\n- search: substring match on node id, name, route, JSX element text/string-prop literals, ui_labels (strings from `const X = [{label:\'\u2026\'}]` data arrays), and notes (tagged comments). Lets queries like search:"Briefs" find a page where "Briefs" is a tab label inside an array, or search:"FIXME" find every file with a FIXME comment. For exhaustive note listings use list_notes.\n- type: filter by node type (ui layer: page, layout, component, ui, hook, context, config, util; api layer: endpoint; db layer: table, enum, migration). Migration nodes carry safety attributes \u2014 is_destructive, has_orphan_check, has_sidecar_backup, has_pre_flight_notice, contains_backfill, contains_drop_column, contains_drop_table, statement_count, timestamp \u2014 queryable via tag_key filters or by inspecting returned node fields.\n- include_findings: db layer only. When true, response includes `contradictions` and `flagged_edges` arrays surfacing SQL\u2194ORM schema drift detected by the SQL migrations parser. Use this to audit "schema vs migrations" disagreement (missing columns, type mismatches, nullability drift, FKs declared in SQL but not ORM).\n- module: filter by module tag (computed from directory structure, e.g. "auth", "admin", "settings")\n- node_id: return this node + its neighborhood (incoming+outgoing edges within `hops`)\n- hops: neighborhood radius when node_id is set (default 1)\n- minimal: return only id/type/name/module/route per node (skip heavy fields like columns, exports)\n- include_edges: return the actual edge list. Default: TRUE for neighborhood queries (node_id), FALSE for filter queries (search/type/module). Filter responses always include `edge_count`; only pass include_edges:true when you actually need to inspect individual edges (e.g. "which components render X"). This default cuts typical filter responses in half.\n\nBATCH MODE: pass `queries` (array of query objects) to run multiple independent queries in a single call. Each query object uses the same params (layer/search/type/module/node_id/hops/minimal). Returns { batch: true, count, results: [{index, query, result}, ...] }. Use this when you need multiple graph views up-front (e.g. scoping a feature across ui+api+db layers) to save round-trips. When batch mode is used, top-level params are ignored.\n\nReturns: filtered nodes + edges between them. If no filter given, returns per-layer counts and type breakdown only.\n\nWIRE FORMAT (compact): responses that include nodes/edges use short keys and edge-by-index refs to cut payload ~40-60%. Every such response carries a `_schema` legend. Quick reference:\n  nodes[]: { i: id, t: type, n: name, m: module, r: route, mt: methods, x: exports, c: columns }\n  edges[]: { s: source_node_index, d: target_node_index, t: type, l: label }\nedges.s / edges.d are 0-based indices into THIS response\'s nodes array. If a referenced node is not in the response (boundary case), s/d may instead contain the full node id string \u2014 always check the type.\n\nPAGINATION (filter queries):\n- Use `offset` and `limit` to paginate through large result sets.\n- Response includes: `total` (matched), `returned` (in this page), `has_more`, `next_offset`.\n- If `has_more: true`, call again with `offset: next_offset` to get the next page.\n\nBUDGET GUARDS:\n- Neighborhood queries stop expanding when the projected response exceeds budget. The response then contains `budget_exceeded: true` plus `hops_traversed < hops_requested`. When this happens, drill into a specific neighbor with another node_id call rather than retrying with larger hops \u2014 it will just truncate again.\n- Batch mode caps total response size. Once the budget is hit, later queries return `{skipped: true, reason: "batch_budget_exhausted"}` and you must re-run them individually.\n\nMONOREPOS: pass `project: "<name>"` to query a sub-project graph (defined in .launchchart.json projects[]). Omitting `project` targets the monorepo root. In batch mode the top-level `project` is inherited by sub-queries that do not set their own. Run detect_project_stack to list configured projects.',
     inputSchema: {
       type: "object",
       properties: {
@@ -33121,7 +33864,7 @@ var TOOLS = [
         },
         search: {
           type: "string",
-          description: "Case-insensitive substring match against node id, name, or route."
+          description: "Case-insensitive substring match against node id, name, route, JSX element text/string-prop literals, and ui_labels (strings from `const X = [{label:'\u2026'}]` data arrays)."
         },
         type: {
           type: "string",
@@ -33155,6 +33898,36 @@ var TOOLS = [
           type: "boolean",
           description: "Include the edge list in the response. Default TRUE for neighborhood queries (node_id), FALSE for filter queries. Filter responses always include edge_count. Only set true on filter queries when you actually need edge data."
         },
+        include_findings: {
+          type: "boolean",
+          description: "DB layer only. When true, response includes `contradictions[]` and `flagged_edges[]` arrays from the SQL migrations parser \u2014 SQL\u2194ORM schema drift findings (missing columns/tables, type mismatches, nullability drift, FKs in SQL but no ORM @relation). Default false."
+        },
+        tag_predicates: {
+          type: "array",
+          description: 'Multi-condition AND filter over node attributes. Each predicate is { field, op, value }. `field` matches either a top-level node attribute (e.g. is_destructive, mutates, statement_count) OR a tag key (tag values take precedence when both exist). `op` \u2208 {eq, ne, gt, lt, gte, lte, exists, not_exists, in}. Example: [{field:"is_destructive",op:"eq",value:true},{field:"has_orphan_check",op:"eq",value:false}] returns destructive migrations missing an orphan check.',
+          items: {
+            type: "object",
+            properties: {
+              field: { type: "string", description: "Node attribute or tag key." },
+              op: { type: "string", enum: ["eq", "ne", "gt", "lt", "gte", "lte", "exists", "not_exists", "in"] },
+              value: { description: "Comparison value. Required for all ops except exists/not_exists. Pass an array for `in`." }
+            },
+            required: ["field", "op"]
+          }
+        },
+        include_cross_refs: {
+          type: "boolean",
+          description: "When true, attach `cross_refs` (incoming + outgoing) to each returned node. Unlocks the cross-layer reference data (references_static, calls_api, reads_via, mutates_via, reads, mutates, references_api) that is otherwise dropped from responses. Combine with `cross_ref_type` to narrow."
+        },
+        cross_ref_type: {
+          type: "string",
+          description: "Narrow attached cross_refs by kind. Common values: calls_api, references_static, reads_via, mutates_via, reads, mutates, references_api. Only applies when include_cross_refs is true."
+        },
+        edge_confidence: {
+          type: "array",
+          description: 'Filter to surface low/medium/high-confidence flagged_edges in the response. Pass e.g. ["medium","high"] to get DYNAMIC navigation targets, FK drift, etc. Scoped to matched nodes when a node filter is in play; otherwise returns all flagged_edges at the requested confidence levels. Layer-independent.',
+          items: { type: "string", enum: ["low", "medium", "high"] }
+        },
         offset: {
           type: "number",
           description: "Skip first N matched nodes (pagination). Default 0. Use next_offset from a previous response to get the next page."
@@ -33165,7 +33938,7 @@ var TOOLS = [
         },
         queries: {
           type: "array",
-          description: "Batch mode \u2014 array of query objects to run in a single call. Each uses the same param schema (including `project`). When set, top-level params are ignored. Subject to an aggregate size budget \u2014 later queries may return a skipped stub.",
+          description: "Batch mode \u2014 array of query objects to run in a single call. Each uses the same param schema (including `project` / `worktree` / `project_root`). Top-level root args are inherited by sub-queries that don't specify their own. Subject to an aggregate size budget \u2014 later queries may return a skipped stub.",
           items: {
             type: "object",
             properties: {
@@ -33177,13 +33950,28 @@ var TOOLS = [
               hops: { type: "number" },
               minimal: { type: "boolean" },
               include_edges: { type: "boolean" },
-              project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+              include_findings: { type: "boolean" },
+              tag_predicates: { type: "array" },
+              include_cross_refs: { type: "boolean" },
+              cross_ref_type: { type: "string" },
+              edge_confidence: { type: "array" },
+              project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+              worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+              project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
             }
           }
         },
         project: {
           type: "string",
           description: PROJECT_PARAM_DESCRIPTION
+        },
+        worktree: {
+          type: "string",
+          description: WORKTREE_PARAM_DESCRIPTION2
+        },
+        project_root: {
+          type: "string",
+          description: PROJECT_ROOT_PARAM_DESCRIPTION2
         }
       }
     }
@@ -33231,7 +34019,9 @@ Returns: { pattern, filter, files_searched, total_matches, matches: [{file, line
         context: { type: "number", description: "Context lines around each match. Default 2." },
         max_matches: { type: "number", description: "Max matches to return total. Default 50." },
         max_files: { type: "number", description: "Max files to search. Default 50." },
-        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
       },
       required: ["layer", "pattern"]
     }
@@ -33263,17 +34053,23 @@ Returns deep fields only \u2014 not structural metadata (use read_graph for that
         fields: {
           type: "array",
           items: { type: "string" },
-          description: 'Specific deep fields to return. Options: elements, stateVars, conditions, variables, responses, params, effects. Omit for all. "effects" returns the file-level side-effect summary (calls, dom_writes, subscribes, timers, persists, fetches, globals); per-arrow-function effects are also attached to each entry in "variables".'
+          description: `Specific deep fields to return. Options: elements, stateVars, conditions, variables, responses, params, effects, crossRefs. Omit for all. "effects" returns the file-level side-effect summary (calls, dom_writes, subscribes, timers, persists, fetches, globals); per-arrow-function effects are also attached to each entry in "variables". "crossRefs" returns this node's incoming + outgoing cross-layer references (calls_api, references_static, reads_via, mutates_via, reads, mutates, references_api) \u2014 the cross-layer linking data otherwise dropped from responses.`
         },
         filter: {
           type: "string",
           description: "Regex pattern to search WITHIN deep field values. Only returns nodes where at least one deep field matches. Searches across all string values in the requested fields (condition tests, variable inits, element tags/props, response bodies, etc.). When set, search becomes optional and node limit is raised to 50."
         },
+        cross_ref_type: {
+          type: "string",
+          description: 'Narrow returned crossRefs by kind (e.g. calls_api, references_static, reads_via). Only applies when "crossRefs" is included in fields (or fields is omitted).'
+        },
         case_insensitive: {
           type: "boolean",
           description: "Case-insensitive filter matching. Default true."
         },
-        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
       },
       required: ["layer"]
     }
@@ -33311,20 +34107,111 @@ Use this when the user asks "is the chart running", "show me the project graph U
   },
   {
     name: "effects_index",
-    description: 'Cross-layer inverted index over per-node side effects. Answers "who else touches X?" without re-walking every node. Built automatically when generate_graph runs (or whenever the watcher regenerates). \n\nUSE THIS FOR: "is mountFoo safe to instantiate twice?" (kind="singleton_risks"), "who writes DOM id moon-shadow-blur?" (kind="dom_ids", key="moon-shadow-blur"), "which files attach a window keydown listener?" (kind="window_events", key="window:keydown"), "who else writes localStorage key panchang.settings.v1?" (kind="storage_keys", key="..."), "any DOM-id collisions?" (kind="collisions"). \n\nReturns: { kind, results } where results is a {key: [nodeIds]} map for the chosen kind, or a list of multi-writer collisions when kind="collisions", or a flat node-id list when kind="singleton_risks".',
+    description: 'Cross-layer inverted index over per-node side effects. Answers "who else touches X?" without re-walking every node. Most kinds load from a precomputed effects-index.json (built when generate_graph runs); fetch_calls and api_effects are computed on demand from the ui/api graphs so they always reflect current state.\n\nUSE THIS FOR: "is mountFoo safe to instantiate twice?" (kind="singleton_risks"), "who writes DOM id moon-shadow-blur?" (kind="dom_ids", key="moon-shadow-blur"), "which files attach a window keydown listener?" (kind="window_events", key="window:keydown"), "who else writes localStorage key panchang.settings.v1?" (kind="storage_keys", key="..."), "any DOM-id collisions?" (kind="collisions"), "who calls /api/work-items?" (kind="fetch_calls", key="app/api/.../work-items/route.ts"), "which endpoints call db.user.findUnique?" (kind="api_effects", key="db.user.findUnique"). \n\nReturns vary by kind: {key:[nodeIds]} map for standard kinds; {dom_ids, storage_keys, window_events} for collisions; flat node-id list for singleton_risks; {api_endpoint|url_template: [ui_files]} for fetch_calls; {category: {item: [endpoint_ids]}} summary for api_effects (or {category, key, hits} when key is set).',
     inputSchema: {
       type: "object",
       properties: {
         kind: {
           type: "string",
-          enum: ["dom_ids", "window_events", "storage_keys", "fetch_urls", "timers", "singleton_risks", "collisions"],
-          description: "Which inverted index to query. Default: collisions (most actionable signal)."
+          enum: ["dom_ids", "window_events", "storage_keys", "fetch_urls", "timers", "singleton_risks", "collisions", "fetch_calls", "api_effects"],
+          description: 'Which inverted index to query. Default: collisions (most actionable signal). fetch_calls = "UI\u2192API call inventory" (resolved via ui cross_refs + raw fetch strings). api_effects = "what does each endpoint touch" inverted across all effect categories (calls / fetches / persists / subscribes / timers / dom_writes / globals).'
         },
         key: {
           type: "string",
-          description: 'Optional specific key to look up within the chosen kind (e.g. "moon-shadow-blur"). When omitted, returns the full {key:nodes} map for the kind.'
+          description: 'Optional specific key to look up within the chosen kind (e.g. "moon-shadow-blur" for dom_ids, "/api/work-items" for fetch_calls, "db.user.findUnique" for api_effects). When omitted, returns the full {key:nodes} map (or per-category summary for api_effects).'
         },
-        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+      }
+    }
+  },
+  {
+    name: "migration_audit",
+    description: `List Prisma migrations that violate the migration-safety discipline: destructive migrations missing one or more guards (orphan check, sidecar backup, pre-flight notice). Codifies the three-layer migration safety rules \u2014 derived from each migration node's extracted attributes (is_destructive, has_orphan_check, has_sidecar_backup, has_pre_flight_notice, contains_backfill, contains_drop_column, contains_drop_table).
+
+USE THIS FOR: "are there unsafe migrations on this branch", "audit the migration history before deploy", "find migrations that drop columns without backup". Paginated. Returns one entry per offending migration with the specific missing guards listed.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        require_orphan_check: { type: "boolean", description: "Flag destructive migrations missing an orphan-count guard. Default true." },
+        require_sidecar_backup: { type: "boolean", description: "Flag destructive migrations missing a sidecar backup table. Default true." },
+        require_pre_flight_notice: { type: "boolean", description: "Flag destructive migrations missing a RAISE NOTICE pre-flight. Default true." },
+        include_safe: { type: "boolean", description: "Also return migrations that pass all checks (no violations). Default false \u2014 by default only offenders are returned." },
+        offset: { type: "number", description: "Pagination offset. Default 0." },
+        limit: { type: "number", description: "Max migrations to return. Default 10." },
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+      }
+    }
+  },
+  {
+    name: "drift_report",
+    description: 'Aggregate cross-layer drift findings \u2014 contradictions (schema disagreements) + flagged_edges (low-confidence resolutions, FK drift, dynamic routes) \u2014 into one report. Generalizes the db-only `read_graph include_findings` flag to all layers.\n\nUSE THIS FOR: "is the codebase drifting", "show me SQL vs ORM mismatches", "list endpoints/components with unresolved routes", "audit schema health before refactor". Paginated. Returns items with { layer, kind, source, target, detail, confidence }.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        layer: { type: "string", description: "Restrict to one layer (e.g. db, ui). Omit for all layers." },
+        kind: { type: "string", enum: ["contradictions", "flagged_edges", "all"], description: "Which finding type to return. Default all." },
+        confidence: { type: "array", items: { type: "string", enum: ["low", "medium", "high"] }, description: "For flagged_edges: filter by confidence levels. Default all." },
+        offset: { type: "number", description: "Pagination offset. Default 0." },
+        limit: { type: "number", description: "Max items to return. Default 10." },
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+      }
+    }
+  },
+  {
+    name: "who_uses",
+    description: 'List everything that references a target node via cross_refs \u2014 the cross-layer references_static / calls_api / reads_via / mutates_via / reads / mutates / references_api edges that are otherwise dropped from responses.\n\nUSE THIS FOR: "where is permission `manage_billing` used", "which UI components reference enum `WorkItemPriority`", "which endpoints touch the User table", "which files call /api/work-items". Auto-scans all layers\' cross_refs for incoming edges to the target. Paginated.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        target: { type: "string", description: 'Target node id to look up (e.g. "seed:permission:manage_billing", "User", "app/api/.../work-items/route.ts", "WorkItemPriority").' },
+        cross_ref_type: { type: "string", description: "Narrow by cross-ref kind (calls_api / references_static / reads_via / mutates_via / reads / mutates / references_api). Omit for all kinds." },
+        offset: { type: "number", description: "Pagination offset. Default 0." },
+        limit: { type: "number", description: "Max references to return. Default 10." },
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+      },
+      required: ["target"]
+    }
+  },
+  {
+    name: "trace_path",
+    description: 'Find shortest paths between two nodes across layers via cross_refs (including the via[] chains that capture transitive DB access through middleware).\n\nUSE THIS FOR: "how does AdminAnalyticsPage end up reading the User table" \u2014 returns the call chain page \u2192 fetch \u2192 endpoint \u2192 middleware \u2192 db. BFS-bounded by max_hops + max_paths to keep responses tractable on hub nodes. Paginated.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        from: { type: "string", description: "Source node id." },
+        to: { type: "string", description: "Target node id." },
+        max_hops: { type: "number", description: "Hard cap on path length. Default 5." },
+        max_paths: { type: "number", description: "Hard cap on total paths discovered. Default 10. Once hit, BFS stops." },
+        offset: { type: "number", description: "Pagination offset over discovered paths. Default 0." },
+        limit: { type: "number", description: "Max paths returned per response. Default 10." },
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+      },
+      required: ["from", "to"]
+    }
+  },
+  {
+    name: "auth_coverage_report",
+    description: 'Aggregate every API endpoint by its auth[] wrapper(s) \u2014 surfaces endpoints with empty auth, groups by module, shows which auth strategies dominate. Computed from api.json endpoint auth field (100% populated).\n\nUSE THIS FOR: "are there unauthenticated endpoints", "which auth wrappers are in use", "audit auth strategy consistency across modules". Paginated. Returns { total, by_strategy: {strategy: count}, unauthenticated: [endpoint_ids], by_module: {module: {total, by_strategy}} } plus the paginated endpoint list.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        module: { type: "string", description: 'Restrict to one module tag (e.g. "orgs", "admin").' },
+        strategy: { type: "string", description: 'Restrict to endpoints using this auth wrapper (e.g. "withAuth"). Pass "none" to list unauthenticated endpoints.' },
+        offset: { type: "number", description: "Pagination offset over the endpoint list. Default 0." },
+        limit: { type: "number", description: "Max endpoints to return per response. Default 10." },
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
       }
     }
   },
@@ -33354,7 +34241,9 @@ Use this when the user asks "is the chart running", "show me the project graph U
           type: "string",
           description: 'Tag value (e.g. "auth", "alice", "true").'
         },
-        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
       },
       required: ["node_id", "key", "value"]
     }
@@ -33373,7 +34262,9 @@ Use this when the user asks "is the chart running", "show me the project graph U
           type: "string",
           description: "Tag key to remove."
         },
-        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
       },
       required: ["node_id", "key"]
     }
@@ -33392,7 +34283,9 @@ Use this when the user asks "is the chart running", "show me the project graph U
           type: "string",
           description: "Specific check to run (e.g. 'schema_drift', 'unprotected_routes'). Omit to run all checks for the layer."
         },
-        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
       },
       required: ["layer"]
     }
@@ -33428,10 +34321,56 @@ Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 retu
           enum: ["reverse", "both"],
           description: "'reverse' (default) = only what depends on this node. 'both' = full neighborhood."
         },
-        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
       },
       required: ["node_id"]
     }
+  },
+  {
+    name: "list_notes",
+    description: 'List tagged comments across the project graph \u2014 TODO, FIXME, HACK, NOTE, SECURITY, etc. Any `// KIND: body` or `/* KIND: body */` comment where KIND is an all-caps identifier (2\u201316 chars) is captured automatically; team conventions like `// CLAUDE:` are discovered without configuration.\n\nKinds are categorized at read time:\n  actionable: TODO, FIXME, HACK, XXX, REFACTOR, OPTIMIZE, REVIEW\n  warning:    SECURITY, WARNING, IMPORTANT, CAUTION, DANGER, DEPRECATED\n  doc:        NOTE, TIP, SEE, NB, INFO, EXAMPLE\n  custom:     anything else (team-specific conventions)\n\nDefault category filter is `actionable,warning` \u2014 the "what should I act on" view. Pass category:"all" for everything including doc + custom.\n\nReturns: { total, returned, has_more, items: [{file, line, kind, category, text, author?, module?}] }.',
+    inputSchema: {
+      type: "object",
+      properties: {
+        layer: {
+          type: "string",
+          description: "Restrict to one layer ('ui', 'api', 'db'). Default: scan all layers that have notes."
+        },
+        kind: {
+          type: "string",
+          description: 'Exact kind match, case-insensitive (e.g. "TODO", "FIXME", "SECURITY").'
+        },
+        category: {
+          type: "string",
+          description: "'actionable' | 'warning' | 'doc' | 'custom' | 'all'. Comma-separated list also accepted. Default: 'actionable,warning'."
+        },
+        module: {
+          type: "string",
+          description: 'Restrict to nodes carrying this module tag (e.g. "auth", "work-items").'
+        },
+        pattern: {
+          type: "string",
+          description: 'Regex applied to note body text (case-insensitive). Use to grep within bodies, e.g. "race condition".'
+        },
+        author: {
+          type: "string",
+          description: "Match author from `// TODO(alice): \u2026` syntax, case-insensitive."
+        },
+        limit: {
+          type: "number",
+          description: "Max items returned. Default 100. Pair with offset for pagination."
+        },
+        offset: {
+          type: "number",
+          description: "Skip first N items. Default 0."
+        },
+        project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+        worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+        project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+      }
+    }
   }
 ];
 function matchesSearch(node, query) {
@@ -33440,14 +34379,44 @@ function matchesSearch(node, query) {
   if (node.name.toLowerCase().includes(q)) return true;
   const route = node.route;
   if (route && route.toLowerCase().includes(q)) return true;
+  const elements = node.elements;
+  if (elements) {
+    for (const el of elements) {
+      if (el.text && el.text.toLowerCase().includes(q)) return true;
+      if (el.props) {
+        for (const v of Object.values(el.props)) {
+          if (typeof v !== "string") continue;
+          if (v.includes("=>") || v.startsWith("(") || v.startsWith("{")) continue;
+          if (v.toLowerCase().includes(q)) return true;
+        }
+      }
+    }
+  }
+  const uiLabels = node.ui_labels;
+  if (uiLabels) {
+    for (const lbl of uiLabels) {
+      if (typeof lbl === "string" && lbl.toLowerCase().includes(q)) return true;
+    }
+  }
+  const notes = node.notes;
+  if (notes) {
+    for (const n of notes) {
+      if (n.kind && n.kind.toLowerCase().includes(q)) return true;
+      if (n.text && n.text.toLowerCase().includes(q)) return true;
+    }
+  }
   return false;
 }
+var MINIMAL_STRIP_FIELDS = /* @__PURE__ */ new Set(["columns"]);
 function toMinimal(nodes) {
   return nodes.map((n) => {
     const out = { id: n.id, type: n.type, name: n.name };
-    if (n.tags != null) out.tags = n.tags;
-    if (n.route != null) out.route = n.route;
-    if (n.methods != null) out.methods = n.methods;
+    for (const [k, v] of Object.entries(n)) {
+      if (k === "id" || k === "type" || k === "name") continue;
+      if (MINIMAL_STRIP_FIELDS.has(k)) continue;
+      if (DEEP_FIELDS.has(k)) continue;
+      if (v != null) out[k] = v;
+    }
     return out;
   });
 }
@@ -33498,8 +34467,34 @@ var DEEP_FIELDS = /* @__PURE__ */ new Set([
   "variables",
   "responses",
   "params",
-  "effects"
+  "effects",
+  "ui_labels",
+  "notes"
 ]);
+var NOTE_KIND_CATEGORY = {
+  TODO: "actionable",
+  FIXME: "actionable",
+  HACK: "actionable",
+  XXX: "actionable",
+  REFACTOR: "actionable",
+  OPTIMIZE: "actionable",
+  REVIEW: "actionable",
+  SECURITY: "warning",
+  WARNING: "warning",
+  IMPORTANT: "warning",
+  CAUTION: "warning",
+  DANGER: "warning",
+  DEPRECATED: "warning",
+  NOTE: "doc",
+  TIP: "doc",
+  SEE: "doc",
+  NB: "doc",
+  INFO: "doc",
+  EXAMPLE: "doc"
+};
+function categorizeNoteKind(kind) {
+  return NOTE_KIND_CATEGORY[kind] ?? "custom";
+}
 var EST_CHARS_PER_NODE_FULL = {
   ui: 300,
   api: 300,
@@ -33775,7 +34770,7 @@ function withFreshnessMeta(result, args) {
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return result;
   let rootDir;
   try {
-    rootDir = resolveProjectRoot(args.project, process.cwd());
+    rootDir = resolveRequestRoot(args, process.cwd());
   } catch {
     return result;
   }
@@ -33790,7 +34785,7 @@ function withFreshnessMeta(result, args) {
 }
 function resolveOrErr(args) {
   try {
-    return { rootDir: resolveProjectRoot(args.project, process.cwd()) };
+    return { rootDir: resolveRequestRoot(args, process.cwd()) };
   } catch (e) {
     return err(e.message);
   }
@@ -33799,6 +34794,8 @@ async function handleGenerateGraph(args) {
   const monorepoRoot = process.cwd();
   const layer = args.layer;
   const projectArg = typeof args.project === "string" ? args.project.trim() : "";
+  const worktreeArg = typeof args.worktree === "string" ? args.worktree.trim() : "";
+  const projectRootArg = typeof args.project_root === "string" ? args.project_root.trim() : "";
   function formatProjectResult(results2, relativeRoot) {
     return results2.map((r) => {
       const warnings = r.output.warnings.length;
@@ -33806,25 +34803,27 @@ async function handleGenerateGraph(args) {
     }).join("\n") + `
   \u2192 ${relativeRoot}/.launchsecure/graphs/`;
   }
-  if (projectArg) {
+  if (projectArg || worktreeArg || projectRootArg) {
     let rootDir;
     try {
-      rootDir = resolveProjectRoot(projectArg, monorepoRoot);
+      rootDir = resolveRequestRoot(args, monorepoRoot);
     } catch (e) {
       return err(e.message);
     }
     const results2 = await generateGraph(rootDir, layer);
+    const label = worktreeArg ? `worktree "${worktreeArg}"` : projectArg ? `project "${projectArg}"` : `root "${projectRootArg}"`;
+    const queryHint = worktreeArg ? `read_graph (with worktree="${worktreeArg}")` : projectArg ? `read_graph (with project="${projectArg}")` : `read_graph (with project_root="${projectRootArg}")`;
     if (results2.length === 0) {
       return err(
-        layer ? `No parser detected for the "${layer}" layer in project "${projectArg}".` : `No parsers detected for project "${projectArg}". Check that the project root has the expected structure.`
+        layer ? `No parser detected for the "${layer}" layer in ${label}.` : `No parsers detected for ${label}. Check that the root has the expected structure.`
       );
     }
     return ok(
-      `Graph generated successfully for project "${projectArg}".
+      `Graph generated successfully for ${label}.
 
-${formatProjectResult(results2, projectArg)}
+${formatProjectResult(results2, rootDir)}
 
-Use read_graph (with project="${projectArg}") to query.`
+Use ${queryHint} to query.`
     );
   }
   const projects = listProjects(monorepoRoot);
@@ -33887,9 +34886,14 @@ function runReadGraphQueryRaw(rootDir, args) {
   const layerIsDb = args.layer === "db";
   const minimal = args.minimal ?? layerIsDb;
   const includeEdges = args.include_edges;
+  const includeFindings = args.include_findings === true;
+  const tagPredicates = Array.isArray(args.tag_predicates) ? args.tag_predicates : void 0;
+  const includeCrossRefs = args.include_cross_refs === true;
+  const crossRefType = args.cross_ref_type;
+  const edgeConfidence = Array.isArray(args.edge_confidence) ? new Set(args.edge_confidence.map((s) => String(s).toLowerCase())) : void 0;
   const offset = args.offset ?? 0;
   const limit = args.limit;
-  const hasFilter = !!(search || type || module_ || nodeId || tagKey && tagValue);
+  const hasFilter = !!(search || type || module_ || nodeId || tagKey && tagValue || tagPredicates && tagPredicates.length > 0);
   if (layer) {
     const available = getAvailableLayers(rootDir);
     if (available.length > 0 && !available.includes(layer)) {
@@ -33936,14 +34940,31 @@ function runReadGraphQueryRaw(rootDir, args) {
       result2.budget_exceeded = true;
       result2.hint = `Neighborhood truncated at hop ${nb.stoppedAtHop} (projected size exceeded budget). To explore further, call read_graph with node_id set to a specific neighbor from the returned nodes, or rerun with hops=${Math.max(1, nb.stoppedAtHop)} to confirm the partial view is what you wanted.`;
     }
+    if (includeFindings && layer === "db") {
+      result2.contradictions = graph.contradictions ?? [];
+      result2.flagged_edges = graph.flagged_edges ?? [];
+    }
+    const neighborhoodIds = new Set(nb.nodes.map((n) => n.id));
+    attachCrossRefsAndFlagged(result2, graph, neighborhoodIds, {
+      includeCrossRefs,
+      crossRefType,
+      edgeConfidence,
+      scopeToIds: true,
+      layer
+    });
     return result2;
   }
   if (!hasFilter) {
-    return {
+    const summaryResult = {
       hint: "No filter specified \u2014 returning summary only. Use search/type/module/node_id to retrieve nodes.",
       layer,
       summary: layerSummary(graph)
     };
+    if (includeFindings && layer === "db") {
+      summaryResult.contradictions = graph.contradictions ?? [];
+      summaryResult.flagged_edges = graph.flagged_edges ?? [];
+    }
+    return summaryResult;
   }
   const matched = graph.nodes.filter((n) => {
     if (search && !matchesSearch(n, search)) return false;
@@ -33951,6 +34972,11 @@ function runReadGraphQueryRaw(rootDir, args) {
     const nodeTags = n.tags;
     if (module_ && nodeTags?.module !== module_) return false;
     if (tagKey && tagValue && nodeTags?.[tagKey] !== tagValue) return false;
+    if (tagPredicates && tagPredicates.length > 0) {
+      for (const p of tagPredicates) {
+        if (!evaluatePredicate(n, p)) return false;
+      }
+    }
     return true;
   });
   if (matched.length === 0) {
@@ -33994,8 +35020,93 @@ function runReadGraphQueryRaw(rootDir, args) {
   } else if (returnedEdges.length > 0) {
     result.edges_hint = `${returnedEdges.length} edges between matched nodes omitted. Pass include_edges:true to retrieve them (only do this when you actually need edge data).`;
   }
+  if (includeFindings && layer === "db") {
+    result.contradictions = graph.contradictions ?? [];
+    result.flagged_edges = graph.flagged_edges ?? [];
+  }
+  attachCrossRefsAndFlagged(result, graph, returnedIds, {
+    includeCrossRefs,
+    crossRefType,
+    edgeConfidence,
+    scopeToIds: true,
+    layer
+  });
   return result;
 }
+function attachCrossRefsAndFlagged(result, graph, scopeIds, opts) {
+  if (opts.includeCrossRefs) {
+    const allCrossRefs = graph.cross_refs ?? [];
+    const crossRefsByNode = {};
+    for (const id of scopeIds) {
+      crossRefsByNode[id] = { outgoing: [], incoming: [] };
+    }
+    for (const cr of allCrossRefs) {
+      if (opts.crossRefType && cr.type !== opts.crossRefType) continue;
+      if (crossRefsByNode[cr.source]) crossRefsByNode[cr.source].outgoing.push(cr);
+      if (crossRefsByNode[cr.target]) crossRefsByNode[cr.target].incoming.push(cr);
+    }
+    result.cross_refs = crossRefsByNode;
+    if (opts.crossRefType) result.cross_ref_type = opts.crossRefType;
+    if (allCrossRefs.length === 0) {
+      result.parser_warning = parserWarning([opts.layer], "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)");
+    }
+  }
+  if (opts.edgeConfidence && opts.edgeConfidence.size > 0) {
+    const allFlagged = graph.flagged_edges ?? [];
+    const useScope = opts.scopeToIds && scopeIds.size > 0;
+    result.flagged_edges = allFlagged.filter((fe) => {
+      if (!opts.edgeConfidence.has(String(fe.confidence).toLowerCase())) return false;
+      if (useScope && !scopeIds.has(fe.source) && !scopeIds.has(fe.target)) return false;
+      return true;
+    });
+    if (allFlagged.length === 0 && !result.parser_warning) {
+      result.parser_warning = parserWarning([opts.layer], "flagged_edges", opts.layer === "db" ? "sql-migrations parser" : "cross-layer parsers");
+    }
+  }
+}
+function parserWarning(layers, capability, parserName) {
+  return `The ${capability} data is empty in scanned layer(s): ${layers.join(", ")}. This likely means the ${parserName} did not produce output for this project \u2014 run detect_project_stack to verify parser configuration, then generate_graph to refresh. (If the parser IS configured and the source data is genuinely empty, ignore this warning.)`;
+}
+function evaluatePredicate(node, p) {
+  if (!p.field || !p.op) return true;
+  const tags = node.tags;
+  const fromTag = tags?.[p.field];
+  const fromField = node[p.field];
+  const present = fromTag !== void 0 || fromField !== void 0;
+  if (p.op === "exists") return present;
+  if (p.op === "not_exists") return !present;
+  if (!present) return false;
+  const raw = fromTag !== void 0 ? coerceTagValue(fromTag, p.value) : fromField;
+  switch (p.op) {
+    case "eq":
+      return raw === p.value;
+    case "ne":
+      return raw !== p.value;
+    case "gt":
+      return typeof raw === "number" && typeof p.value === "number" && raw > p.value;
+    case "lt":
+      return typeof raw === "number" && typeof p.value === "number" && raw < p.value;
+    case "gte":
+      return typeof raw === "number" && typeof p.value === "number" && raw >= p.value;
+    case "lte":
+      return typeof raw === "number" && typeof p.value === "number" && raw <= p.value;
+    case "in":
+      return Array.isArray(p.value) && p.value.includes(raw);
+    default:
+      return false;
+  }
+}
+function coerceTagValue(raw, target) {
+  if (typeof target === "boolean") {
+    if (raw === "true") return true;
+    if (raw === "false") return false;
+  }
+  if (typeof target === "number") {
+    const n = Number(raw);
+    if (!Number.isNaN(n)) return n;
+  }
+  return raw;
+}
 function runReadGraphQuery(rootDir, args) {
   const raw = runReadGraphQueryRaw(rootDir, args);
   return compactResult(raw);
@@ -34008,6 +35119,8 @@ function handleReadGraph(args) {
       return err("queries array is empty. Provide at least one query object.");
     }
     const inheritedProject = typeof args.project === "string" ? args.project : void 0;
+    const inheritedWorktree = typeof args.worktree === "string" ? args.worktree : void 0;
+    const inheritedProjectRoot = typeof args.project_root === "string" ? args.project_root : void 0;
     const results = [];
     let cumulativeChars = 0;
     let budgetHit = false;
@@ -34025,15 +35138,18 @@ function handleReadGraph(args) {
         });
         continue;
       }
-      const qWithProject = inheritedProject && !q.project ? { ...q, project: inheritedProject } : q;
+      const qInherited = { ...q };
+      if (inheritedProject && !qInherited.project) qInherited.project = inheritedProject;
+      if (inheritedWorktree && !qInherited.worktree) qInherited.worktree = inheritedWorktree;
+      if (inheritedProjectRoot && !qInherited.project_root) qInherited.project_root = inheritedProjectRoot;
       let perQueryRoot;
       try {
-        perQueryRoot = resolveProjectRoot(qWithProject.project, monorepoRoot);
+        perQueryRoot = resolveRequestRoot(qInherited, monorepoRoot);
       } catch (e) {
         results.push({ index: i, query: q, result: { error: e.message } });
         continue;
       }
-      const r = runReadGraphQuery(perQueryRoot, qWithProject);
+      const r = runReadGraphQuery(perQueryRoot, qInherited);
       const entry = { index: i, query: q, result: r };
       const entrySize = JSON.stringify(entry, null, 2).length;
       if (cumulativeChars + entrySize > BATCH_BUDGET_CHARS && results.length > 0) {
@@ -34066,12 +35182,12 @@ function handleReadGraph(args) {
   return okJson(result);
 }
 function nodeToFilePath(rootDir, layer, nodeId) {
-  if (layer === "ui" || layer === "api") return (0, import_node_path31.join)(rootDir, "src", nodeId);
-  if (layer === "db") return (0, import_node_path31.join)(rootDir, "prisma", "schema.prisma");
-  const withSrc = (0, import_node_path31.join)(rootDir, "src", nodeId);
-  if ((0, import_node_fs27.existsSync)(withSrc)) return withSrc;
-  const direct = (0, import_node_path31.join)(rootDir, nodeId);
-  if ((0, import_node_fs27.existsSync)(direct)) return direct;
+  if (layer === "ui" || layer === "api") return (0, import_node_path33.join)(rootDir, "src", nodeId);
+  if (layer === "db") return (0, import_node_path33.join)(rootDir, "prisma", "schema.prisma");
+  const withSrc = (0, import_node_path33.join)(rootDir, "src", nodeId);
+  if ((0, import_node_fs28.existsSync)(withSrc)) return withSrc;
+  const direct = (0, import_node_path33.join)(rootDir, nodeId);
+  if ((0, import_node_fs28.existsSync)(direct)) return direct;
   return null;
 }
 function handleInspectNode(args) {
@@ -34101,8 +35217,23 @@ function handleInspectNode(args) {
   } else {
     matched = graph.nodes;
   }
-  const allDeepFields = ["elements", "stateVars", "conditions", "variables", "responses", "params", "effects"];
+  const allDeepFields = ["elements", "stateVars", "conditions", "variables", "responses", "params", "effects", "ui_labels", "notes", "crossRefs"];
   const requestedFields = fields ?? allDeepFields;
+  const crossRefTypeArg = args.cross_ref_type;
+  const wantCrossRefs = requestedFields.includes("crossRefs");
+  let crossRefsBySource = null;
+  let crossRefsByTarget = null;
+  if (wantCrossRefs) {
+    crossRefsBySource = /* @__PURE__ */ new Map();
+    crossRefsByTarget = /* @__PURE__ */ new Map();
+    for (const cr of graph.cross_refs ?? []) {
+      if (crossRefTypeArg && cr.type !== crossRefTypeArg) continue;
+      if (!crossRefsBySource.has(cr.source)) crossRefsBySource.set(cr.source, []);
+      crossRefsBySource.get(cr.source).push(cr);
+      if (!crossRefsByTarget.has(cr.target)) crossRefsByTarget.set(cr.target, []);
+      crossRefsByTarget.get(cr.target).push(cr);
+    }
+  }
   let filterRegex = null;
   if (filter) {
     try {
@@ -34125,7 +35256,14 @@ function handleInspectNode(args) {
     const deep = { id: node.id, name: node.name, type: node.type };
     let hasData = false;
     for (const field of requestedFields) {
-      if (allDeepFields.includes(field) && node[field] != null) {
+      if (field === "crossRefs") {
+        const outgoing = crossRefsBySource?.get(node.id) ?? [];
+        const incoming = crossRefsByTarget?.get(node.id) ?? [];
+        if (outgoing.length > 0 || incoming.length > 0) {
+          deep.crossRefs = { outgoing, incoming };
+          hasData = true;
+        }
+      } else if (allDeepFields.includes(field) && node[field] != null) {
         deep[field] = node[field];
         hasData = true;
       }
@@ -34149,13 +35287,112 @@ function handleInspectNode(args) {
     const hint = filter ? `No nodes with deep fields matching /${filter}/${caseInsensitive ? "i" : ""} in ${layer} layer.` : `No nodes matching "${search}" in ${layer} layer.`;
     return err(hint);
   }
+  const wantedCrossRefs = wantCrossRefs;
+  const graphHasNoCrossRefs = (graph.cross_refs ?? []).length === 0;
+  const extraWarning = wantedCrossRefs && graphHasNoCrossRefs ? { parser_warning: parserWarning([layer], "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)") } : {};
   return okJson({
     layer,
     matched: results.length,
     ...results.length >= maxResults ? { truncated: true, hint: `Showing first ${maxResults} matches. Narrow with search param.` } : {},
+    ...extraWarning,
     nodes: results
   });
 }
+function handleListNotes(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const layerArg = args.layer;
+  const kindArg = args.kind?.toUpperCase();
+  const categoryArg = args.category ?? "actionable,warning";
+  const moduleArg = args.module;
+  const patternArg = args.pattern;
+  const authorArg = args.author?.toLowerCase();
+  const limit = args.limit ?? 100;
+  const offset = args.offset ?? 0;
+  let patternRegex = null;
+  if (patternArg) {
+    try {
+      patternRegex = new RegExp(patternArg, "i");
+    } catch {
+      return err(`Invalid regex pattern: "${patternArg}"`);
+    }
+  }
+  const wantedCategories = (() => {
+    const trimmed = categoryArg.trim().toLowerCase();
+    if (trimmed === "all") return "all";
+    const out = /* @__PURE__ */ new Set();
+    for (const part of trimmed.split(",").map((s) => s.trim()).filter(Boolean)) {
+      if (part === "actionable" || part === "warning" || part === "doc" || part === "custom") {
+        out.add(part);
+      }
+    }
+    if (out.size === 0) {
+      out.add("actionable");
+      out.add("warning");
+    }
+    return out;
+  })();
+  const layers = layerArg ? [layerArg] : getAvailableLayers(rootDir);
+  const items = [];
+  for (const layer of layers) {
+    const graph = readGraph(rootDir, layer);
+    if (!graph) continue;
+    for (const node of graph.nodes) {
+      const nodeNotes = node.notes;
+      if (!nodeNotes || nodeNotes.length === 0) continue;
+      const tags = node.tags;
+      const nodeModule = tags?.module;
+      if (moduleArg && nodeModule !== moduleArg) continue;
+      for (const n of nodeNotes) {
+        if (!n.kind || !n.text || typeof n.line !== "number") continue;
+        const category = categorizeNoteKind(n.kind);
+        if (wantedCategories !== "all" && !wantedCategories.has(category)) continue;
+        if (kindArg && n.kind.toUpperCase() !== kindArg) continue;
+        if (authorArg && (!n.author || n.author.toLowerCase() !== authorArg)) continue;
+        if (patternRegex && !patternRegex.test(n.text)) continue;
+        const item = {
+          file: node.id,
+          line: n.line,
+          kind: n.kind,
+          category,
+          text: n.text
+        };
+        if (n.author) item.author = n.author;
+        if (nodeModule) item.module = nodeModule;
+        items.push(item);
+      }
+    }
+  }
+  const catOrder = { actionable: 0, warning: 1, doc: 2, custom: 3 };
+  items.sort((a, b) => {
+    const c = catOrder[a.category] - catOrder[b.category];
+    if (c !== 0) return c;
+    const k = a.kind.localeCompare(b.kind);
+    if (k !== 0) return k;
+    const f = a.file.localeCompare(b.file);
+    if (f !== 0) return f;
+    return a.line - b.line;
+  });
+  const total = items.length;
+  const paged = items.slice(offset, offset + limit);
+  const hasMore = offset + paged.length < total;
+  return okJson({
+    total,
+    returned: paged.length,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + paged.length } : {},
+    filter: {
+      layer: layerArg ?? "all",
+      kind: kindArg ?? null,
+      category: categoryArg,
+      module: moduleArg ?? null,
+      pattern: patternArg ?? null,
+      author: authorArg ?? null
+    },
+    items: paged
+  });
+}
 function handleGrepNodes(args) {
   const __resolved = resolveOrErr(args);
   if ("content" in __resolved) return __resolved;
@@ -34218,11 +35455,11 @@ function handleGrepNodes(args) {
   let filesSearched = 0;
   let truncated = false;
   for (const [filePath, nodeId] of filePaths) {
-    if (!(0, import_node_fs27.existsSync)(filePath)) continue;
+    if (!(0, import_node_fs28.existsSync)(filePath)) continue;
     filesSearched++;
     let content;
     try {
-      content = (0, import_node_fs27.readFileSync)(filePath, "utf-8");
+      content = (0, import_node_fs28.readFileSync)(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -34263,13 +35500,19 @@ function handleEffectsIndex(args) {
   const __resolved = resolveOrErr(args);
   if ("content" in __resolved) return __resolved;
   const { rootDir } = __resolved;
+  const kind = args.kind ?? "collisions";
+  const key = args.key;
+  const MAX_KEYS = 200;
+  if (kind === "fetch_calls") {
+    return okJson(buildFetchCallsIndex(rootDir, key, MAX_KEYS));
+  }
+  if (kind === "api_effects") {
+    return okJson(buildApiEffectsIndex(rootDir, key, MAX_KEYS));
+  }
   const idx = readEffectsIndex(rootDir);
   if (!idx) {
     return err("No effects-index.json found. Run generate_graph first (or wait for the file-watcher to fire).");
   }
-  const kind = args.kind ?? "collisions";
-  const key = args.key;
-  const MAX_KEYS = 200;
   if (kind === "singleton_risks") {
     return okJson({ kind, count: idx.singleton_risks.length, nodes: idx.singleton_risks });
   }
@@ -34283,7 +35526,7 @@ function handleEffectsIndex(args) {
   }
   const map = idx[kind];
   if (!map || typeof map !== "object") {
-    return err(`Unknown kind "${kind}". Valid: dom_ids, window_events, storage_keys, fetch_urls, timers, singleton_risks, collisions.`);
+    return err(`Unknown kind "${kind}". Valid: dom_ids, window_events, storage_keys, fetch_urls, timers, singleton_risks, collisions, fetch_calls, api_effects.`);
   }
   if (key) {
     const nodes = map[key] ?? [];
@@ -34301,6 +35544,97 @@ function handleEffectsIndex(args) {
     results
   });
 }
+function buildFetchCallsIndex(rootDir, key, maxKeys) {
+  const ui = readGraph(rootDir, "ui");
+  if (!ui) return { kind: "fetch_calls", error: "No ui graph found. Run generate_graph first." };
+  const inverted = /* @__PURE__ */ new Map();
+  let callsApiCount = 0;
+  for (const cr of ui.cross_refs ?? []) {
+    if (cr.type !== "calls_api") continue;
+    callsApiCount++;
+    if (!inverted.has(cr.target)) inverted.set(cr.target, /* @__PURE__ */ new Set());
+    inverted.get(cr.target).add(cr.source);
+  }
+  for (const n of ui.nodes) {
+    const eff = n.effects;
+    if (!eff?.fetches) continue;
+    for (const f of eff.fetches) {
+      if (!inverted.has(f)) inverted.set(f, /* @__PURE__ */ new Set());
+      inverted.get(f).add(n.id);
+    }
+  }
+  const allCrossRefs = ui.cross_refs ?? [];
+  const fetchResolverAbsent = callsApiCount === 0 && allCrossRefs.length === 0;
+  const partialResolverGap = callsApiCount === 0 && inverted.size > 0;
+  if (key) {
+    return {
+      kind: "fetch_calls",
+      key,
+      callers: [...inverted.get(key) ?? []],
+      ...fetchResolverAbsent ? { parser_warning: parserWarning(["ui"], "cross_refs", "fetch-resolver cross-layer parser") } : {},
+      ...partialResolverGap ? { parser_warning: "No calls_api cross_refs found \u2014 fetch-resolver may not be enabled. Only raw fetch() strings from ui.node.effects.fetches are indexed; resolved-to-endpoint links are missing." } : {}
+    };
+  }
+  const entries = [...inverted.entries()].sort((a, b) => b[1].size - a[1].size);
+  const truncated = entries.length > maxKeys;
+  const results = {};
+  for (const [k, v] of entries.slice(0, maxKeys)) results[k] = [...v];
+  return {
+    kind: "fetch_calls",
+    total_keys: entries.length,
+    ...truncated ? { truncated: true, showing: maxKeys, hint: "Pass `key` (endpoint path or URL template) to look up callers." } : {},
+    ...fetchResolverAbsent ? { parser_warning: parserWarning(["ui"], "cross_refs", "fetch-resolver cross-layer parser") } : {},
+    ...partialResolverGap ? { parser_warning: "No calls_api cross_refs found \u2014 fetch-resolver may not be enabled. Only raw fetch() strings from ui.node.effects.fetches are indexed; resolved-to-endpoint links are missing." } : {},
+    results
+  };
+}
+function buildApiEffectsIndex(rootDir, key, maxKeys) {
+  const api = readGraph(rootDir, "api");
+  if (!api) return { kind: "api_effects", error: "No api graph found. Run generate_graph first." };
+  const categories = ["calls", "fetches", "persists", "subscribes", "timers", "dom_writes", "globals"];
+  const inverted = {};
+  for (const c of categories) inverted[c] = /* @__PURE__ */ new Map();
+  for (const n of api.nodes) {
+    const eff = n.effects;
+    if (!eff) continue;
+    for (const c of categories) {
+      const items = eff[c];
+      if (!Array.isArray(items)) continue;
+      for (const item of items) {
+        if (!inverted[c].has(item)) inverted[c].set(item, /* @__PURE__ */ new Set());
+        inverted[c].get(item).add(n.id);
+      }
+    }
+  }
+  if (key) {
+    const hits = {};
+    for (const c of categories) {
+      const endpoints = inverted[c].get(key);
+      if (endpoints && endpoints.size > 0) hits[c] = [...endpoints];
+    }
+    return { kind: "api_effects", key, hits };
+  }
+  const TOP_CATEGORIES = Math.min(maxKeys, 50);
+  const TOP_CALLERS = 10;
+  const summary = {};
+  for (const c of categories) {
+    const entries = [...inverted[c].entries()].sort((a, b) => b[1].size - a[1].size);
+    const top = {};
+    for (const [k, v] of entries.slice(0, TOP_CATEGORIES)) {
+      const endpoints = [...v];
+      top[k] = {
+        count: endpoints.length,
+        sample_endpoints: endpoints.slice(0, TOP_CALLERS)
+      };
+    }
+    summary[c] = { total_items: entries.length, top };
+  }
+  return {
+    kind: "api_effects",
+    hint: `Summary mode: top ${TOP_CATEGORIES} items per category, top ${TOP_CALLERS} endpoints per item. Pass \`key\` (a specific call/url/event) to get the FULL caller list across all categories.`,
+    summary
+  };
+}
 function handleChartServerStatus() {
   const rootDir = process.cwd();
   const lock = getLiveLock(rootDir);
@@ -34344,11 +35678,11 @@ function handleStartChartServer(args) {
     });
   }
   const entryPath = process.argv[1];
-  const logDir = (0, import_node_path31.join)((0, import_node_os5.homedir)(), LAUNCHSECURE_DIR);
-  (0, import_node_fs27.mkdirSync)(logDir, { recursive: true });
-  const logPath = (0, import_node_path31.join)(logDir, "launch-chart.log");
-  const out = (0, import_node_fs27.openSync)(logPath, "a");
-  const err2 = (0, import_node_fs27.openSync)(logPath, "a");
+  const logDir = (0, import_node_path33.join)((0, import_node_os6.homedir)(), LAUNCHSECURE_DIR);
+  (0, import_node_fs28.mkdirSync)(logDir, { recursive: true });
+  const logPath = (0, import_node_path33.join)(logDir, "launch-chart.log");
+  const out = (0, import_node_fs28.openSync)(logPath, "a");
+  const err2 = (0, import_node_fs28.openSync)(logPath, "a");
   const portArgs = args.port ? ["--port", String(args.port)] : [];
   const child = (0, import_node_child_process3.spawn)(process.execPath, [entryPath, "serve", ...portArgs], {
     detached: true,
@@ -34414,6 +35748,296 @@ function handleRemoveTag(args) {
   removeTag(rootDir, nodeId, key);
   return okJson({ ok: true, node_id: nodeId, removed_key: key });
 }
+function handleMigrationAudit(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const requireOrphan = args.require_orphan_check !== false;
+  const requireBackup = args.require_sidecar_backup !== false;
+  const requirePreFlight = args.require_pre_flight_notice !== false;
+  const includeSafe = args.include_safe === true;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const db = readGraph(rootDir, "db");
+  if (!db) return err("No db graph found. Run generate_graph first.");
+  const migrations = db.nodes.filter((n) => n.type === "migration");
+  const audit = [];
+  for (const m of migrations) {
+    const isDestructive = m.is_destructive === true;
+    if (!isDestructive && !includeSafe) continue;
+    const violations = [];
+    if (isDestructive) {
+      if (requireOrphan && m.has_orphan_check !== true) violations.push("missing_orphan_check");
+      if (requireBackup && m.has_sidecar_backup !== true) violations.push("missing_sidecar_backup");
+      if (requirePreFlight && m.has_pre_flight_notice !== true) violations.push("missing_pre_flight_notice");
+    }
+    if (!isDestructive && includeSafe && violations.length === 0) {
+      audit.push({ id: m.id, name: m.name, timestamp: m.timestamp, is_destructive: false, status: "safe" });
+      continue;
+    }
+    if (violations.length === 0 && !includeSafe) continue;
+    audit.push({
+      id: m.id,
+      name: m.name,
+      timestamp: m.timestamp,
+      filepath: m.filepath,
+      is_destructive: isDestructive,
+      contains_drop_column: m.contains_drop_column === true,
+      contains_drop_table: m.contains_drop_table === true,
+      contains_backfill: m.contains_backfill === true,
+      has_orphan_check: m.has_orphan_check === true,
+      has_sidecar_backup: m.has_sidecar_backup === true,
+      has_pre_flight_notice: m.has_pre_flight_notice === true,
+      statement_count: m.statement_count,
+      violations,
+      status: violations.length === 0 ? "safe" : "unsafe"
+    });
+  }
+  audit.sort((a, b) => String(b.timestamp ?? "").localeCompare(String(a.timestamp ?? "")));
+  const total = audit.length;
+  const page = audit.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  return okJson({
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    items: page,
+    discipline: "Layer 1 (expand-and-contract) + Layer 2 (pg_dump wrapper) + Layer 3 (in-migration SQL guards) per CLAUDE.md. This tool checks Layer 3 only."
+  });
+}
+function handleDriftReport(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const layerArg = args.layer;
+  const kind = args.kind ?? "all";
+  const confidenceArg = Array.isArray(args.confidence) ? new Set(args.confidence.map((s) => String(s).toLowerCase())) : void 0;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const layers = layerArg ? [layerArg] : getAvailableLayers(rootDir);
+  const items = [];
+  const layersWithAnyFinding = [];
+  for (const layer of layers) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    const cs = g.contradictions ?? [];
+    const fes = g.flagged_edges ?? [];
+    if (cs.length > 0 || fes.length > 0) layersWithAnyFinding.push(layer);
+    if (kind === "all" || kind === "contradictions") {
+      for (const c of cs) {
+        items.push({ layer, kind: "contradiction", entity: c.entity, source_a: c.source_a, source_b: c.source_b, detail: c.detail });
+      }
+    }
+    if (kind === "all" || kind === "flagged_edges") {
+      for (const fe of fes) {
+        if (confidenceArg && !confidenceArg.has(String(fe.confidence).toLowerCase())) continue;
+        items.push({
+          layer,
+          kind: "flagged_edge",
+          source: fe.source,
+          target: fe.target,
+          edge_type: fe.type,
+          confidence: fe.confidence,
+          label: fe.label
+        });
+      }
+    }
+  }
+  const total = items.length;
+  const page = items.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layers.length > 0 && layersWithAnyFinding.length === 0;
+  return okJson({
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    layers_scanned: layers,
+    ...parserAbsent ? { parser_warning: parserWarning(layers, "contradictions + flagged_edges", layers.includes("db") ? "sql-migrations parser and/or cross-layer parsers" : "cross-layer parsers") } : {},
+    items: page
+  });
+}
+function handleWhoUses(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const target = args.target;
+  if (!target) return err("target is required");
+  const filterType = args.cross_ref_type;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const hits = [];
+  const layersScanned = [];
+  const layersWithCrossRefs = [];
+  for (const layer of getAvailableLayers(rootDir)) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    layersScanned.push(layer);
+    const crs = g.cross_refs ?? [];
+    if (crs.length > 0) layersWithCrossRefs.push(layer);
+    for (const cr of crs) {
+      if (cr.target !== target) continue;
+      if (filterType && cr.type !== filterType) continue;
+      const entry = {
+        source_layer: layer,
+        source: cr.source,
+        cross_ref_type: cr.type,
+        target_layer: cr.layer
+      };
+      const via = cr.via;
+      if (Array.isArray(via)) entry.via = via;
+      hits.push(entry);
+    }
+  }
+  hits.sort((a, b) => String(a.source).localeCompare(String(b.source)));
+  const total = hits.length;
+  const page = hits.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layersScanned.length > 0 && layersWithCrossRefs.length === 0;
+  return okJson({
+    target,
+    ...filterType ? { cross_ref_type: filterType } : {},
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    ...parserAbsent ? { parser_warning: parserWarning(layersScanned, "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)") } : {},
+    items: page
+  });
+}
+function handleTracePath(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const from = args.from;
+  const to = args.to;
+  if (!from || !to) return err("from and to are required");
+  const maxHops = args.max_hops ?? 5;
+  const maxPaths = args.max_paths ?? 10;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const outgoing = /* @__PURE__ */ new Map();
+  const layersScanned = [];
+  const layersWithCrossRefs = [];
+  for (const layer of getAvailableLayers(rootDir)) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    layersScanned.push(layer);
+    if ((g.cross_refs ?? []).length > 0) layersWithCrossRefs.push(layer);
+    for (const cr of g.cross_refs ?? []) {
+      const via = cr.via;
+      if (Array.isArray(via) && via.length > 0) {
+        let prev = cr.source;
+        for (const step of via) {
+          pushEdge(outgoing, { from: prev, to: step, type: cr.type, layer: cr.layer });
+          prev = step;
+        }
+        pushEdge(outgoing, { from: prev, to: cr.target, type: cr.type, layer: cr.layer });
+      } else {
+        pushEdge(outgoing, { from: cr.source, to: cr.target, type: cr.type, layer: cr.layer });
+      }
+    }
+    for (const e of g.edges ?? []) {
+      pushEdge(outgoing, { from: e.source, to: e.target, type: e.type, layer });
+    }
+  }
+  const paths = [];
+  const queue = [{ nodes: [from], edges: [] }];
+  while (queue.length > 0 && paths.length < maxPaths) {
+    const p = queue.shift();
+    const tail = p.nodes[p.nodes.length - 1];
+    if (tail === to && p.nodes.length > 1) {
+      paths.push(p);
+      continue;
+    }
+    if (p.nodes.length > maxHops) continue;
+    const next = outgoing.get(tail) ?? [];
+    for (const e of next) {
+      if (p.nodes.includes(e.to)) continue;
+      queue.push({ nodes: [...p.nodes, e.to], edges: [...p.edges, e] });
+    }
+  }
+  paths.sort((a, b) => a.nodes.length - b.nodes.length);
+  const total = paths.length;
+  const page = paths.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layersScanned.length > 0 && layersWithCrossRefs.length === 0;
+  return okJson({
+    from,
+    to,
+    max_hops: maxHops,
+    max_paths: maxPaths,
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    ...total === maxPaths ? { search_capped: true, hint: "Hit max_paths cap \u2014 more paths may exist. Raise max_paths or narrow from/to." } : {},
+    ...parserAbsent ? { parser_warning: parserWarning(layersScanned, "cross_refs", "cross-layer references parser(s)") + " Cross-layer paths are unreachable without cross_refs; only same-layer paths (imports/renders/belongs_to) are visible." } : {},
+    paths: page.map((p) => ({ hops: p.nodes.length - 1, nodes: p.nodes, edges: p.edges }))
+  });
+}
+function pushEdge(map, e) {
+  if (!map.has(e.from)) map.set(e.from, []);
+  map.get(e.from).push(e);
+}
+function handleAuthCoverageReport(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const moduleFilter = args.module;
+  const strategyFilter = args.strategy;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const api = readGraph(rootDir, "api");
+  if (!api) return err("No api graph found. Run generate_graph first.");
+  const byStrategy = {};
+  const byModule = {};
+  const unauthenticated = [];
+  const matchedEndpoints = [];
+  for (const n of api.nodes) {
+    const tags = n.tags;
+    const moduleTag = tags?.module ?? "root";
+    const auth = n.auth ?? [];
+    const strategyKey = auth.length === 0 ? "none" : auth.slice().sort().join("+");
+    byStrategy[strategyKey] = (byStrategy[strategyKey] ?? 0) + 1;
+    if (!byModule[moduleTag]) byModule[moduleTag] = { total: 0, by_strategy: {} };
+    byModule[moduleTag].total += 1;
+    byModule[moduleTag].by_strategy[strategyKey] = (byModule[moduleTag].by_strategy[strategyKey] ?? 0) + 1;
+    if (auth.length === 0) unauthenticated.push(n.id);
+    if (moduleFilter && moduleTag !== moduleFilter) continue;
+    if (strategyFilter && strategyKey !== strategyFilter) continue;
+    matchedEndpoints.push({
+      id: n.id,
+      path: n.path,
+      methods: n.methods,
+      module: moduleTag,
+      auth,
+      mutates: n.mutates === true
+    });
+  }
+  matchedEndpoints.sort((a, b) => String(a.path ?? a.id).localeCompare(String(b.path ?? b.id)));
+  const total = matchedEndpoints.length;
+  const page = matchedEndpoints.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  return okJson({
+    total_endpoints: api.nodes.length,
+    by_strategy: byStrategy,
+    unauthenticated_count: unauthenticated.length,
+    by_module: byModule,
+    filter: { module: moduleFilter, strategy: strategyFilter },
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    items: page
+  });
+}
 function handleAuditLayer(args) {
   const __resolved = resolveOrErr(args);
   if ("content" in __resolved) return __resolved;
@@ -34477,20 +36101,20 @@ function handleDetectProjectStack() {
       if (ref.type === "references_api") stats.references_api++;
     }
   }
-  const srcDir = (0, import_node_path31.join)(rootDir, "src");
-  if ((0, import_node_fs27.existsSync)(srcDir)) {
+  const srcDir = (0, import_node_path33.join)(rootDir, "src");
+  if ((0, import_node_fs28.existsSync)(srcDir)) {
     const scanDir = (dir) => {
-      if (!(0, import_node_fs27.existsSync)(dir)) return;
-      for (const entry of (0, import_node_fs27.readdirSync)(dir, { withFileTypes: true })) {
+      if (!(0, import_node_fs28.existsSync)(dir)) return;
+      for (const entry of (0, import_node_fs28.readdirSync)(dir, { withFileTypes: true })) {
         if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-        const full = (0, import_node_path31.join)(dir, entry.name);
+        const full = (0, import_node_path33.join)(dir, entry.name);
         if (entry.isDirectory()) {
           scanDir(full);
           continue;
         }
-        if (![".ts", ".tsx"].includes((0, import_node_path31.extname)(entry.name))) continue;
+        if (![".ts", ".tsx"].includes((0, import_node_path33.extname)(entry.name))) continue;
         try {
-          const content = (0, import_node_fs27.readFileSync)(full, "utf-8");
+          const content = (0, import_node_fs28.readFileSync)(full, "utf-8");
           const matches = content.match(/@api\s+(GET|POST|PUT|DELETE|PATCH)\s+\/\S+/g);
           if (matches) stats.annotations += matches.length;
         } catch {
@@ -34509,7 +36133,7 @@ function handleDetectProjectStack() {
     name: p.name,
     root: p.root,
     absolute_root: p.absoluteRoot,
-    has_graph: (0, import_node_fs27.existsSync)((0, import_node_path31.join)(p.absoluteRoot, LAUNCHSECURE_DIR, "graphs"))
+    has_graph: (0, import_node_fs28.existsSync)((0, import_node_path33.join)(p.absoluteRoot, LAUNCHSECURE_DIR, "graphs"))
   }));
   return okJson({
     languages,
@@ -34623,6 +36247,30 @@ async function handleMessage(msg) {
       respond(id ?? null, withFreshnessMeta(handleBlastPoints(args), args));
       return;
     }
+    if (toolName === "list_notes") {
+      respond(id ?? null, withFreshnessMeta(handleListNotes(args), args));
+      return;
+    }
+    if (toolName === "migration_audit") {
+      respond(id ?? null, withFreshnessMeta(handleMigrationAudit(args), args));
+      return;
+    }
+    if (toolName === "drift_report") {
+      respond(id ?? null, withFreshnessMeta(handleDriftReport(args), args));
+      return;
+    }
+    if (toolName === "who_uses") {
+      respond(id ?? null, withFreshnessMeta(handleWhoUses(args), args));
+      return;
+    }
+    if (toolName === "trace_path") {
+      respond(id ?? null, withFreshnessMeta(handleTracePath(args), args));
+      return;
+    }
+    if (toolName === "auth_coverage_report") {
+      respond(id ?? null, withFreshnessMeta(handleAuthCoverageReport(args), args));
+      return;
+    }
     respondError(id ?? null, -32601, `Unknown tool: ${toolName}`);
     return;
   }
@@ -34797,7 +36445,7 @@ function parseArgs() {
   return { port, token, serverUrl: LAUNCHSECURE_URL, subcommand };
 }
 function tryListen(server, port, maxRetries = 10) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let attempts = 0;
     function attempt(p) {
       server.once("error", (err2) => {
@@ -34808,7 +36456,7 @@ function tryListen(server, port, maxRetries = 10) {
           reject(err2);
         }
       });
-      server.listen(p, "127.0.0.1", () => resolve5(p));
+      server.listen(p, "127.0.0.1", () => resolve6(p));
     }
     attempt(port);
   });
@@ -34829,7 +36477,7 @@ function saveCredentials(creds) {
   });
 }
 function verifyToken(serverUrl, token) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const url = new URL("/api/mcp/verify", serverUrl);
     const body = JSON.stringify({ token });
     const mod = url.protocol === "https:" ? import_https.default : import_http.default;
@@ -34844,30 +36492,30 @@ function verifyToken(serverUrl, token) {
       res.on("data", (chunk) => data += chunk);
       res.on("end", () => {
         try {
-          resolve5(JSON.parse(data));
+          resolve6(JSON.parse(data));
         } catch {
-          resolve5({ valid: false, error: "Invalid response from server" });
+          resolve6({ valid: false, error: "Invalid response from server" });
         }
       });
     });
     req.on("error", (err2) => {
-      resolve5({ valid: false, error: `Cannot reach server: ${err2.message}` });
+      resolve6({ valid: false, error: `Cannot reach server: ${err2.message}` });
     });
     req.setTimeout(1e4, () => {
       req.destroy();
-      resolve5({ valid: false, error: "Connection timed out" });
+      resolve6({ valid: false, error: "Connection timed out" });
     });
     req.write(body);
     req.end();
   });
 }
 function httpRequest2(reqUrl, options, body, timeout = 3e4) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const mod = reqUrl.protocol === "https:" ? import_https.default : import_http.default;
     const r = mod.request(reqUrl, options, (resp) => {
       let data = "";
       resp.on("data", (chunk) => data += chunk);
-      resp.on("end", () => resolve5({ status: resp.statusCode || 0, headers: resp.headers, body: data }));
+      resp.on("end", () => resolve6({ status: resp.statusCode || 0, headers: resp.headers, body: data }));
     });
     r.on("error", reject);
     r.setTimeout(timeout, () => {