@launchsecure/launch-kit 0.0.29 → 0.0.31

package/dist/server/graph-mcp-entry.js

@@ -653,7 +653,7 @@ function resolveWorkerPath() {
   );
 }
 function runParseInWorker(req) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let workerPath;
     try {
       workerPath = resolveWorkerPath();
@@ -672,7 +672,7 @@ function runParseInWorker(req) {
     };
     worker.on("message", (reply) => {
       if (reply.ok) {
-        finish(() => resolve5({ results: reply.results, failedFiles: reply.failedFiles }));
+        finish(() => resolve6({ results: reply.results, failedFiles: reply.failedFiles }));
       } else {
         const err2 = new Error(reply.error.message);
         err2.name = reply.error.name;
@@ -916,7 +916,7 @@ var init_freshness = __esm({
 function getAvailableLayers(rootDir) {
   const dir = (0, import_node_path10.join)(rootDir, GRAPHS_DIR2);
   if (!(0, import_node_fs8.existsSync)(dir)) return [];
-  return (0, import_node_fs8.readdirSync)(dir).filter((f) => f.endsWith(".json") && !NON_LAYER_GRAPH_FILES.has(f)).map((f) => f.replace(".json", ""));
+  return (0, import_node_fs8.readdirSync)(dir).filter((f) => f.endsWith(".json") && !f.startsWith(".") && !NON_LAYER_GRAPH_FILES.has(f)).map((f) => f.replace(".json", ""));
 }
 function graphsDir(rootDir) {
   return (0, import_node_path10.join)(rootDir, GRAPHS_DIR2);
@@ -2354,6 +2354,8 @@ function extractDeep(absPath) {
     false
   );
   const hasEffects = Object.keys(fileEffects).length > 0;
+  const uiLabels = collectUiLabels(root);
+  const notes = collectNotes(root);
   return {
     elements,
     stateVars,
@@ -2361,10 +2363,77 @@ function extractDeep(absPath) {
     variables,
     responses,
     params,
-    ...hasEffects ? { effects: fileEffects } : {}
+    ...hasEffects ? { effects: fileEffects } : {},
+    ...uiLabels.length > 0 ? { ui_labels: uiLabels } : {},
+    ...notes.length > 0 ? { notes } : {}
   };
 }
-var import_node_fs11, import_node_path13, tsxLanguage, parserInstance, TreeSitterCtor, initPromise, initialized, queriesDir, queryCache, MAX_PARSEABLE_BYTES, MAX_CONSECUTIVE_PARSE_FAILURES, consecutiveParseFailures, ParseCascadeError, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS, TRUST_AS_PROTECT_KEYS, TIMER_FNS, DOM_METHOD_NAMES, CLASSLIST_METHODS, STORAGE_OBJECTS, HISTORY_METHODS, LOCATION_METHODS, ASSIGN_DOM_PROPS;
+function collectNotes(root) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  function visit(node) {
+    if (out.length >= NOTES_MAX) return;
+    if (node.type === "comment") {
+      const text = node.text;
+      const startRow = node.startPosition.row;
+      NOTE_REGEX.lastIndex = 0;
+      let m;
+      while ((m = NOTE_REGEX.exec(text)) !== null) {
+        const kind = m[1];
+        const author = m[2];
+        const body = m[3];
+        if (!kind || !body) continue;
+        const newlinesBefore = (text.slice(0, m.index).match(/\n/g) ?? []).length;
+        const line = startRow + 1 + newlinesBefore;
+        const key = `${line}:${kind}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const note = {
+          kind,
+          text: body.length <= 200 ? body : body.slice(0, 200) + "...",
+          line
+        };
+        if (author) note.author = author;
+        out.push(note);
+        if (out.length >= NOTES_MAX) return;
+      }
+    }
+    for (const child of node.namedChildren) {
+      visit(child);
+      if (out.length >= NOTES_MAX) return;
+    }
+  }
+  visit(root);
+  return out;
+}
+function collectUiLabels(root) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  function visit(node) {
+    if (out.length >= UI_LABELS_MAX) return;
+    if (node.type === "pair") {
+      const key = node.childForFieldName("key");
+      const val = node.childForFieldName("value");
+      if (key && val) {
+        const keyText = key.type === "property_identifier" ? key.text : stringLiteralValue(key) ?? key.text;
+        if (UI_LABEL_KEYS.has(keyText)) {
+          const strVal = stringLiteralValue(val);
+          if (strVal && strVal.length > 0 && strVal.length <= 200 && !seen.has(strVal)) {
+            seen.add(strVal);
+            out.push(strVal);
+          }
+        }
+      }
+    }
+    for (const child of node.namedChildren) {
+      visit(child);
+      if (out.length >= UI_LABELS_MAX) return;
+    }
+  }
+  visit(root);
+  return out;
+}
+var import_node_fs11, import_node_path13, tsxLanguage, parserInstance, TreeSitterCtor, initPromise, initialized, queriesDir, queryCache, MAX_PARSEABLE_BYTES, MAX_CONSECUTIVE_PARSE_FAILURES, consecutiveParseFailures, ParseCascadeError, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS, TRUST_AS_PROTECT_KEYS, TIMER_FNS, DOM_METHOD_NAMES, CLASSLIST_METHODS, STORAGE_OBJECTS, HISTORY_METHODS, LOCATION_METHODS, ASSIGN_DOM_PROPS, UI_LABEL_KEYS, UI_LABELS_MAX, NOTE_REGEX, NOTES_MAX;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
@@ -2483,6 +2552,27 @@ var init_ts_extractor = __esm({
       "selected",
       "disabled"
     ]);
+    UI_LABEL_KEYS = /* @__PURE__ */ new Set([
+      "label",
+      "title",
+      "name",
+      "text",
+      "description",
+      "placeholder",
+      "tooltip",
+      "heading",
+      "subheading",
+      "sheetTitle",
+      "sheetDescription",
+      "caption",
+      "cta",
+      "buttonText",
+      "emptyText",
+      "subtitle"
+    ]);
+    UI_LABELS_MAX = 200;
+    NOTE_REGEX = /^\s*(?:\/\/|\/\*+|\*)\s*([A-Z][A-Z0-9_]{1,15})(?:\(([^)]+)\))?:\s*(\S.*?)\s*(?:\*\/)?$/gm;
+    NOTES_MAX = 100;
   }
 });
 
@@ -2881,6 +2971,7 @@ function generate(rootDir) {
         responses: deep.responses,
         params: deep.params,
         ...deep.effects ? { effects: deep.effects } : {},
+        ...deep.notes ? { notes: deep.notes } : {},
         _dbCalls: dbCalls
         // temp: used for cross-ref building below
       });
@@ -2901,6 +2992,8 @@ function generate(rootDir) {
         conditions: deep.conditions,
         variables: deep.variables,
         ...deep.effects ? { effects: deep.effects } : {},
+        ...deep.ui_labels ? { ui_labels: deep.ui_labels } : {},
+        ...deep.notes ? { notes: deep.notes } : {},
         ...authWrappers.length > 0 ? { auth: authWrappers } : {},
         ...dbCalls.length > 0 ? { _dbCalls: dbCalls } : {}
       });
@@ -3539,241 +3632,6 @@ function pgTypeToPrisma(pgType) {
   const upper = pgType.toUpperCase().trim();
   return PG_TO_PRISMA[upper] ?? upper;
 }
-function bareName(captured) {
-  const parts = captured.split(".");
-  const last = parts[parts.length - 1];
-  return last.replace(/^"(.*)"$/, "$1").trim();
-}
-function parseCreateTable(sql, state) {
-  const re = new RegExp(
-    `CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(${QID})\\s*\\(([\\s\\S]*?)\\);`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const tableName = bareName(m[1]);
-    const body = m[2];
-    const columns = /* @__PURE__ */ new Map();
-    let primaryCol = null;
-    const inlineFks = [];
-    const lines = splitTopLevelCommas(body);
-    for (const raw of lines) {
-      const trimmed = raw.trim().replace(/,\s*$/, "");
-      if (!trimmed || trimmed.startsWith("--")) continue;
-      const namedPk = trimmed.match(new RegExp(`^CONSTRAINT\\s+${ID}\\s+PRIMARY\\s+KEY\\s*\\(\\s*(${QID})`, "i"));
-      if (namedPk) {
-        primaryCol = bareName(namedPk[1]);
-        continue;
-      }
-      const tablePk = trimmed.match(new RegExp(`^PRIMARY\\s+KEY\\s*\\(\\s*(${QID})`, "i"));
-      if (tablePk) {
-        primaryCol = bareName(tablePk[1]);
-        continue;
-      }
-      if (/^UNIQUE\s*\(/i.test(trimmed)) continue;
-      const namedFk = trimmed.match(new RegExp(
-        `^CONSTRAINT\\s+(${ID})\\s+FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
-        "i"
-      ));
-      if (namedFk) {
-        inlineFks.push({
-          constraintName: bareName(namedFk[1]),
-          sourceTable: tableName,
-          sourceColumn: bareName(namedFk[2]),
-          targetTable: bareName(namedFk[3]),
-          targetColumn: bareName(namedFk[4]),
-          onDelete: namedFk[5] ?? null
-        });
-        continue;
-      }
-      const bareFk = trimmed.match(new RegExp(
-        `^FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
-        "i"
-      ));
-      if (bareFk) {
-        inlineFks.push({
-          constraintName: `${tableName}_${bareName(bareFk[1])}_fkey`,
-          sourceTable: tableName,
-          sourceColumn: bareName(bareFk[1]),
-          targetTable: bareName(bareFk[2]),
-          targetColumn: bareName(bareFk[3]),
-          onDelete: bareFk[4] ?? null
-        });
-        continue;
-      }
-      if (/^CONSTRAINT\s/i.test(trimmed)) continue;
-      const colMatch = trimmed.match(new RegExp(`^(${ID})\\s+(.+)`, "i"));
-      if (!colMatch) continue;
-      const colName = bareName(colMatch[1]);
-      let rest = colMatch[2];
-      const inlineRefMatch = rest.match(new RegExp(
-        `\\bREFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
-        "i"
-      ));
-      if (inlineRefMatch) {
-        inlineFks.push({
-          constraintName: `${tableName}_${colName}_fkey`,
-          sourceTable: tableName,
-          sourceColumn: colName,
-          targetTable: bareName(inlineRefMatch[1]),
-          targetColumn: bareName(inlineRefMatch[2]),
-          onDelete: inlineRefMatch[3] ?? null
-        });
-        rest = rest.replace(inlineRefMatch[0], "").trim();
-      }
-      const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
-      const isPrimaryKey = /\bPRIMARY\s+KEY\b/i.test(rest);
-      const isUnique = /\bUNIQUE\b/i.test(rest);
-      const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)(?:\s*,?\s*$)/i);
-      const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
-      let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bPRIMARY\s+KEY\b/gi, "").replace(/\bUNIQUE\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim().replace(/,\s*$/, "").trim();
-      columns.set(colName, {
-        name: colName,
-        type: colType,
-        nullable: !isNotNull && !isPrimaryKey,
-        primary: isPrimaryKey,
-        unique: isUnique,
-        default: defaultVal
-      });
-      if (isPrimaryKey) primaryCol = colName;
-    }
-    if (primaryCol && columns.has(primaryCol)) {
-      columns.get(primaryCol).primary = true;
-    }
-    state.tables.set(tableName, { name: tableName, columns });
-    state.fks.push(...inlineFks);
-  }
-}
-function splitTopLevelCommas(body) {
-  const out = [];
-  let depth = 0;
-  let buf = "";
-  let inString = null;
-  for (const ch of body) {
-    if (inString) {
-      buf += ch;
-      if (ch === inString) inString = null;
-      continue;
-    }
-    if (ch === "'" || ch === '"') {
-      inString = ch;
-      buf += ch;
-      continue;
-    }
-    if (ch === "(") depth++;
-    else if (ch === ")") depth--;
-    if (ch === "," && depth === 0) {
-      out.push(buf);
-      buf = "";
-      continue;
-    }
-    buf += ch;
-  }
-  if (buf.trim()) out.push(buf);
-  return out;
-}
-function parseCreateEnum(sql, state) {
-  const re = new RegExp(
-    `CREATE\\s+TYPE\\s+(${QID})\\s+AS\\s+ENUM\\s*\\(([^)]+)\\)`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const enumName = bareName(m[1]);
-    const valuesStr = m[2];
-    const values = new Set(
-      valuesStr.split(",").map((v) => v.trim().replace(/^'(.*)'$/, "$1")).filter(Boolean)
-    );
-    state.enums.set(enumName, { name: enumName, values });
-  }
-}
-function parseAlterTable(sql, state) {
-  const addColRe = new RegExp(
-    `ALTER\\s+TABLE\\s+(${QID})\\s+ADD\\s+COLUMN\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(${QID})\\s+(.+?);`,
-    "gi"
-  );
-  let m;
-  while ((m = addColRe.exec(sql)) !== null) {
-    const tableName = bareName(m[1]);
-    const colName = bareName(m[2]);
-    let rest = m[3];
-    const table = state.tables.get(tableName);
-    if (!table) continue;
-    const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
-    const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)$/i);
-    const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
-    let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim();
-    table.columns.set(colName, {
-      name: colName,
-      type: colType,
-      nullable: !isNotNull,
-      primary: false,
-      unique: false,
-      default: defaultVal
-    });
-  }
-  const dropColRe = new RegExp(
-    `ALTER\\s+TABLE\\s+(${QID})\\s+DROP\\s+COLUMN\\s+(?:IF\\s+EXISTS\\s+)?(${QID})`,
-    "gi"
-  );
-  while ((m = dropColRe.exec(sql)) !== null) {
-    const table = state.tables.get(bareName(m[1]));
-    if (table) table.columns.delete(bareName(m[2]));
-  }
-  const fkRe = new RegExp(
-    `ALTER\\s+TABLE\\s+(${QID})\\s+ADD\\s+CONSTRAINT\\s+(${ID})\\s+FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
-    "gi"
-  );
-  while ((m = fkRe.exec(sql)) !== null) {
-    state.fks.push({
-      constraintName: bareName(m[2]),
-      sourceTable: bareName(m[1]),
-      sourceColumn: bareName(m[3]),
-      targetTable: bareName(m[4]),
-      targetColumn: bareName(m[5]),
-      onDelete: m[6] ?? null
-    });
-  }
-}
-function parseAlterEnum(sql, state) {
-  const re = new RegExp(
-    `ALTER\\s+TYPE\\s+(${QID})\\s+ADD\\s+VALUE\\s+'([^']+)'`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const en = state.enums.get(bareName(m[1]));
-    if (en) en.values.add(m[2]);
-  }
-}
-function parseDropTable(sql, state) {
-  const re = new RegExp(
-    `DROP\\s+TABLE\\s+(?:IF\\s+EXISTS\\s+)?(${QID})`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const dropped = bareName(m[1]);
-    state.tables.delete(dropped);
-    state.fks = state.fks.filter((fk) => fk.sourceTable !== dropped && fk.targetTable !== dropped);
-  }
-}
-function parseUniqueIndex(sql, state) {
-  const re = new RegExp(
-    `CREATE\\s+UNIQUE\\s+INDEX\\s+(?:(?:IF\\s+NOT\\s+EXISTS\\s+)?(?:${ID}\\s+)?)?ON\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)`,
-    "gi"
-  );
-  let m;
-  while ((m = re.exec(sql)) !== null) {
-    const tableName = bareName(m[1]);
-    const colName = bareName(m[2]);
-    const table = state.tables.get(tableName);
-    const col = table?.columns.get(colName);
-    if (col) col.unique = true;
-    if (!state.uniqueIndexes.has(tableName)) state.uniqueIndexes.set(tableName, /* @__PURE__ */ new Set());
-    state.uniqueIndexes.get(tableName).add(colName);
-  }
-}
 function discoverMigrationFiles(migrationsDir) {
   if (!(0, import_node_fs14.existsSync)(migrationsDir)) return [];
   const out = [];
@@ -3788,25 +3646,589 @@ function discoverMigrationFiles(migrationsDir) {
   }
   return out;
 }
-function parseMigrations(migrationsDir) {
+function parseMigrations(migrationsDir, dialect = postgresDialect) {
   const state = {
     tables: /* @__PURE__ */ new Map(),
     enums: /* @__PURE__ */ new Map(),
     fks: [],
-    uniqueIndexes: /* @__PURE__ */ new Map()
+    uniqueIndexes: /* @__PURE__ */ new Map(),
+    indexes: [],
+    policies: [],
+    extensions: [],
+    triggers: [],
+    functions: [],
+    views: []
   };
   if (!migrationsDir) return state;
   for (const sqlPath of discoverMigrationFiles(migrationsDir)) {
     const sql = (0, import_node_fs14.readFileSync)(sqlPath, "utf-8");
-    parseCreateEnum(sql, state);
-    parseCreateTable(sql, state);
-    parseAlterTable(sql, state);
-    parseAlterEnum(sql, state);
-    parseDropTable(sql, state);
-    parseUniqueIndex(sql, state);
+    let ast;
+    try {
+      ast = dialect.parse(sql);
+    } catch {
+      continue;
+    }
+    dialect.applyAll(ast, state, sqlPath);
   }
   return state;
 }
+function extractIndexesFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const stmt = wrap.stmt ?? {};
+    const ix = stmt.IndexStmt;
+    if (!ix) continue;
+    const name = ix.idxname ?? "";
+    if (!name) continue;
+    const table = ix.relation?.relname ?? "";
+    const unique = !!ix.unique;
+    const method = String(ix.accessMethod ?? "btree").toLowerCase();
+    const params = ix.indexParams ?? [];
+    const columns = [];
+    let hasExpressions = false;
+    for (const p of params) {
+      const elem = p.IndexElem;
+      if (!elem) continue;
+      if (elem.name) columns.push(elem.name);
+      else if (elem.expr) hasExpressions = true;
+    }
+    const hasPredicate = !!ix.whereClause;
+    const existing = state.indexes.findIndex((i) => i.name === name);
+    const next = { name, table, unique, method, columns, hasExpressions, hasPredicate, filepath };
+    if (existing >= 0) state.indexes[existing] = next;
+    else state.indexes.push(next);
+    if (unique && columns.length === 1 && !hasPredicate && !hasExpressions) {
+      const t = state.tables.get(table);
+      const col = t?.columns.get(columns[0]);
+      if (col) col.unique = true;
+      if (!state.uniqueIndexes.has(table)) state.uniqueIndexes.set(table, /* @__PURE__ */ new Set());
+      state.uniqueIndexes.get(table).add(columns[0]);
+    }
+  }
+}
+function applyDropIndexes(stmts, state) {
+  for (const wrap of stmts) {
+    const drop = wrap.stmt?.DropStmt;
+    if (!drop || drop.removeType !== "OBJECT_INDEX") continue;
+    const objects = drop.objects ?? [];
+    const droppedNames = /* @__PURE__ */ new Set();
+    for (const obj of objects) {
+      const items = obj.List?.items ?? [];
+      const last = items[items.length - 1]?.String?.sval;
+      if (last) droppedNames.add(last);
+    }
+    if (droppedNames.size > 0) {
+      state.indexes = state.indexes.filter((i) => !droppedNames.has(i.name));
+    }
+  }
+}
+function formatPgTypeName(typeName) {
+  const names = (typeName?.names ?? []).map((n) => n.String?.sval ?? "").filter(Boolean);
+  const base = (names[names.length - 1] ?? "").toLowerCase();
+  const PG_INTERNAL_MAP = {
+    int4: "INTEGER",
+    int8: "BIGINT",
+    int2: "SMALLINT",
+    float8: "DOUBLE PRECISION",
+    float4: "REAL",
+    bool: "BOOLEAN",
+    bpchar: "CHAR",
+    timestamptz: "TIMESTAMPTZ",
+    timestamp: "TIMESTAMP",
+    numeric: "NUMERIC",
+    text: "TEXT",
+    varchar: "VARCHAR",
+    jsonb: "JSONB",
+    json: "JSON",
+    uuid: "UUID",
+    date: "DATE",
+    bytea: "BYTEA"
+  };
+  return PG_INTERNAL_MAP[base] ?? base.toUpperCase();
+}
+function applyAstAlterations(stmts, state) {
+  for (const wrap of stmts) {
+    const stmt = wrap.stmt ?? {};
+    const kind = Object.keys(stmt)[0];
+    if (!kind) continue;
+    if (kind === "AlterTableStmt") {
+      const body = stmt.AlterTableStmt;
+      const tableName = body.relation?.relname ?? "";
+      const table = state.tables.get(tableName);
+      if (!table) continue;
+      const cmds = body.cmds ?? [];
+      for (const c of cmds) {
+        const cmd = c.AlterTableCmd;
+        if (!cmd) continue;
+        const subtype = cmd.subtype ?? "";
+        const colName = cmd.name ?? "";
+        const col = colName ? table.columns.get(colName) : void 0;
+        switch (subtype) {
+          case "AT_AlterColumnType": {
+            if (!col) break;
+            const typeName = cmd.def?.ColumnDef?.typeName ?? cmd.def?.typeName;
+            if (typeName) col.type = formatPgTypeNameWithMods(typeName);
+            break;
+          }
+          case "AT_SetNotNull":
+            if (col) col.nullable = false;
+            break;
+          case "AT_DropNotNull":
+            if (col) col.nullable = true;
+            break;
+          case "AT_AddColumn": {
+            const cd = cmd.def?.ColumnDef;
+            if (!cd) break;
+            const newColName = cd.colname ?? "";
+            if (!newColName) break;
+            if (table.columns.has(newColName)) break;
+            let nullable = true;
+            let primary = false;
+            let unique = false;
+            let defaultVal = null;
+            for (const c2 of cd.constraints ?? []) {
+              const ct = c2.Constraint;
+              if (!ct) continue;
+              if (ct.contype === "CONSTR_NOTNULL") nullable = false;
+              else if (ct.contype === "CONSTR_PRIMARY") {
+                primary = true;
+                nullable = false;
+              } else if (ct.contype === "CONSTR_UNIQUE") unique = true;
+              else if (ct.contype === "CONSTR_DEFAULT") defaultVal = "<expr>";
+            }
+            table.columns.set(newColName, {
+              name: newColName,
+              type: formatPgTypeNameWithMods(cd.typeName),
+              nullable,
+              primary,
+              unique,
+              default: defaultVal
+            });
+            break;
+          }
+          case "AT_DropColumn":
+            if (colName) table.columns.delete(colName);
+            break;
+          case "AT_AddConstraint": {
+            const ct = cmd.def?.Constraint;
+            if (!ct) break;
+            if (ct.contype !== "CONSTR_FOREIGN") break;
+            const fkCols = (ct.fk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            const pkCols = (ct.pk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            const pkTable = ct.pktable?.relname ?? "";
+            if (fkCols.length && pkCols.length && pkTable) {
+              state.fks.push({
+                constraintName: ct.conname || `${tableName}_${fkCols[0]}_fkey`,
+                sourceTable: tableName,
+                sourceColumn: fkCols[0],
+                targetTable: pkTable,
+                targetColumn: pkCols[0],
+                onDelete: mapFkAction(ct.fk_del_action)
+              });
+            }
+            break;
+          }
+        }
+      }
+    } else if (kind === "RenameStmt") {
+      const body = stmt.RenameStmt;
+      const renameType = body.renameType ?? "";
+      const newName = body.newname ?? "";
+      if (renameType === "OBJECT_COLUMN") {
+        const tableName = body.relation?.relname ?? "";
+        const oldName = body.subname ?? "";
+        const table = state.tables.get(tableName);
+        if (!table || !oldName || !newName) continue;
+        const col = table.columns.get(oldName);
+        if (col) {
+          col.name = newName;
+          table.columns.delete(oldName);
+          table.columns.set(newName, col);
+        }
+      } else if (renameType === "OBJECT_TABLE") {
+        const oldName = body.relation?.relname ?? "";
+        if (!oldName || !newName) continue;
+        const t = state.tables.get(oldName);
+        if (!t) continue;
+        state.tables.delete(oldName);
+        t.name = newName;
+        state.tables.set(newName, t);
+        for (const fk of state.fks) {
+          if (fk.sourceTable === oldName) fk.sourceTable = newName;
+          if (fk.targetTable === oldName) fk.targetTable = newName;
+        }
+      }
+    }
+  }
+}
+function extractPoliciesFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreatePolicyStmt;
+    if (!body) continue;
+    const name = body.policy_name ?? "";
+    if (!name) continue;
+    const table = body.table?.relname ?? "";
+    const cmdRaw = String(body.cmd_name ?? "all").toUpperCase();
+    const command = ["SELECT", "INSERT", "UPDATE", "DELETE", "ALL"].includes(cmdRaw) ? cmdRaw : "ALL";
+    const permissive = body.permissive === true;
+    const roles = (body.roles ?? []).map((r) => {
+      const rs = r.RoleSpec;
+      if (!rs) return "";
+      if (rs.roletype === "ROLESPEC_PUBLIC") return "public";
+      if (rs.roletype === "ROLESPEC_CURRENT_USER") return "current_user";
+      if (rs.roletype === "ROLESPEC_CSTRING" && rs.rolename) return rs.rolename;
+      return "";
+    }).filter(Boolean);
+    const hasUsing = !!body.qual;
+    const hasWithCheck = !!body.with_check;
+    const existing = state.policies.findIndex((p) => p.table === table && p.name === name);
+    const next = { name, table, command, permissive, roles, hasUsing, hasWithCheck, filepath };
+    if (existing >= 0) state.policies[existing] = next;
+    else state.policies.push(next);
+  }
+}
+function applyDropPolicies(stmts, state) {
+  for (const wrap of stmts) {
+    const drop = wrap.stmt?.DropStmt;
+    if (!drop || drop.removeType !== "OBJECT_POLICY") continue;
+    const objects = drop.objects ?? [];
+    for (const obj of objects) {
+      const items = obj.List?.items ?? [];
+      if (items.length < 2) continue;
+      const table = items[0]?.String?.sval ?? "";
+      const policyName = items[items.length - 1]?.String?.sval ?? "";
+      if (!table || !policyName) continue;
+      state.policies = state.policies.filter((p) => !(p.table === table && p.name === policyName));
+    }
+  }
+}
+function mapFkAction(action) {
+  if (!action) return null;
+  const m = {
+    r: "RESTRICT",
+    c: "CASCADE",
+    s: "SET NULL",
+    d: "SET DEFAULT",
+    a: "NO ACTION",
+    // pgsql-parser may also emit FKCONSTR_ACTION_* enum strings:
+    FKCONSTR_ACTION_RESTRICT: "RESTRICT",
+    FKCONSTR_ACTION_CASCADE: "CASCADE",
+    FKCONSTR_ACTION_SETNULL: "SET NULL",
+    FKCONSTR_ACTION_SETDEFAULT: "SET DEFAULT",
+    FKCONSTR_ACTION_NOACTION: "NO ACTION"
+  };
+  return m[action] ?? null;
+}
+function formatPgTypeNameWithMods(typeName) {
+  const base = formatPgTypeName(typeName);
+  if (base === "String" || base === "unknown") return base;
+  const typmods = [];
+  for (const m of typeName?.typmods ?? []) {
+    const v = m.A_Const?.ival?.ival;
+    if (typeof v === "number") typmods.push(v);
+  }
+  return typmods.length ? `${base}(${typmods.join(",")})` : base;
+}
+function extractTablesFromStmts(stmts, state) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateStmt;
+    if (!body) continue;
+    const tableName = body.relation?.relname ?? "";
+    if (!tableName) continue;
+    const columns = /* @__PURE__ */ new Map();
+    const fks = [];
+    let primaryCol = null;
+    for (const elt of body.tableElts ?? []) {
+      if (elt.ColumnDef) {
+        const cd = elt.ColumnDef;
+        const colName = cd.colname ?? "";
+        if (!colName) continue;
+        const colType = formatPgTypeNameWithMods(cd.typeName);
+        let nullable = true;
+        let primary = false;
+        let unique = false;
+        let defaultVal = null;
+        for (const c of cd.constraints ?? []) {
+          const ct = c.Constraint;
+          if (!ct) continue;
+          switch (ct.contype) {
+            case "CONSTR_NOTNULL":
+              nullable = false;
+              break;
+            case "CONSTR_PRIMARY":
+              primary = true;
+              nullable = false;
+              primaryCol = colName;
+              break;
+            case "CONSTR_UNIQUE":
+              unique = true;
+              break;
+            case "CONSTR_DEFAULT":
+              defaultVal = "<expr>";
+              break;
+            case "CONSTR_FOREIGN": {
+              const pkTable = ct.pktable?.relname ?? "";
+              const pkCols = (ct.pk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+              if (pkTable && pkCols.length) {
+                fks.push({
+                  constraintName: ct.conname || `${tableName}_${colName}_fkey`,
+                  sourceTable: tableName,
+                  sourceColumn: colName,
+                  targetTable: pkTable,
+                  targetColumn: pkCols[0],
+                  onDelete: mapFkAction(ct.fk_del_action)
+                });
+              }
+              break;
+            }
+          }
+        }
+        columns.set(colName, {
+          name: colName,
+          type: colType,
+          nullable,
+          primary,
+          unique,
+          default: defaultVal
+        });
+      } else if (elt.Constraint) {
+        const ct = elt.Constraint;
+        switch (ct.contype) {
+          case "CONSTR_PRIMARY": {
+            const keys = (ct.keys ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            if (keys.length) primaryCol = keys[0];
+            break;
+          }
+          case "CONSTR_FOREIGN": {
+            const fkCols = (ct.fk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            const pkCols = (ct.pk_attrs ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+            const pkTable = ct.pktable?.relname ?? "";
+            if (fkCols.length && pkCols.length && pkTable) {
+              fks.push({
+                constraintName: ct.conname || `${tableName}_${fkCols[0]}_fkey`,
+                sourceTable: tableName,
+                sourceColumn: fkCols[0],
+                targetTable: pkTable,
+                targetColumn: pkCols[0],
+                onDelete: mapFkAction(ct.fk_del_action)
+              });
+            }
+            break;
+          }
+        }
+      }
+    }
+    if (primaryCol && columns.has(primaryCol)) {
+      columns.get(primaryCol).primary = true;
+      columns.get(primaryCol).nullable = false;
+    }
+    state.tables.set(tableName, { name: tableName, columns });
+    state.fks.push(...fks);
+  }
+}
+function extractEnumsFromStmts(stmts, state) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateEnumStmt;
+    if (!body) continue;
+    const names = (body.typeName ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+    const enumName = names[names.length - 1] ?? "";
+    if (!enumName) continue;
+    const vals = new Set(
+      (body.vals ?? []).map((s) => s.String?.sval ?? "").filter(Boolean)
+    );
+    state.enums.set(enumName, { name: enumName, values: vals });
+  }
+}
+function applyAstAlterEnums(stmts, state) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.AlterEnumStmt;
+    if (!body) continue;
+    const names = (body.typeName ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+    const enumName = names[names.length - 1] ?? "";
+    const en = state.enums.get(enumName);
+    if (!en) continue;
+    if (body.newVal) en.values.add(String(body.newVal));
+  }
+}
+function extractExtensionsFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateExtensionStmt;
+    if (!body) continue;
+    const name = body.extname ?? "";
+    if (!name) continue;
+    let schema = null;
+    let version = null;
+    for (const opt of body.options ?? []) {
+      const de = opt.DefElem;
+      if (!de) continue;
+      if (de.defname === "schema" && de.arg?.String?.sval) schema = de.arg.String.sval;
+      else if (de.defname === "new_version" && de.arg?.String?.sval) version = de.arg.String.sval;
+    }
+    const next = { name, schema, version, filepath };
+    const existing = state.extensions.findIndex((e) => e.name === name);
+    if (existing >= 0) state.extensions[existing] = next;
+    else state.extensions.push(next);
+  }
+}
+function extractTriggersFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateTrigStmt;
+    if (!body) continue;
+    const name = body.trigname ?? "";
+    if (!name) continue;
+    const table = body.relation?.relname ?? "";
+    const timingVal = body.timing ?? 0;
+    const eventsVal = body.events ?? 0;
+    const timing = timingVal & 2 ? "BEFORE" : timingVal & 64 ? "INSTEAD OF" : "AFTER";
+    const events = [];
+    if (eventsVal & 4) events.push("INSERT");
+    if (eventsVal & 8) events.push("DELETE");
+    if (eventsVal & 16) events.push("UPDATE");
+    if (eventsVal & 32) events.push("TRUNCATE");
+    const funcname = body.funcname ?? [];
+    const funcCall = funcname[funcname.length - 1]?.String?.sval ?? "";
+    const forEach = body.row ? "ROW" : "STATEMENT";
+    const hasWhen = !!body.whenClause;
+    const next = { name, table, timing, events, function: funcCall, hasWhen, forEach, filepath };
+    const existing = state.triggers.findIndex((t) => t.table === table && t.name === name);
+    if (existing >= 0) state.triggers[existing] = next;
+    else state.triggers.push(next);
+  }
+}
+function functionIdFor(name, schema) {
+  return schema ? `${schema}.${name}` : name;
+}
+function extractFunctionsFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const body = wrap.stmt?.CreateFunctionStmt;
+    if (!body) continue;
+    const fn = body.funcname ?? [];
+    if (fn.length === 0) continue;
+    const name = fn[fn.length - 1]?.String?.sval ?? "";
+    if (!name) continue;
+    const schema = fn.length > 1 ? fn[fn.length - 2]?.String?.sval ?? null : null;
+    let language = "sql";
+    for (const opt of body.options ?? []) {
+      const de = opt.DefElem;
+      if (de?.defname === "language" && de.arg?.String?.sval) language = de.arg.String.sval;
+    }
+    const returnType = body.returnType ? formatPgTypeName(body.returnType) : "";
+    const isProcedure = !!body.is_procedure;
+    const next = { name, schema, language, returnType, isProcedure, filepath };
+    const id = functionIdFor(name, schema);
+    const existing = state.functions.findIndex((f) => functionIdFor(f.name, f.schema) === id);
+    if (existing >= 0) state.functions[existing] = next;
+    else state.functions.push(next);
+  }
+}
+function extractViewsFromStmts(stmts, state, filepath) {
+  for (const wrap of stmts) {
+    const stmt = wrap.stmt ?? {};
+    const view = stmt.ViewStmt;
+    if (view) {
+      const name = view.view?.relname ?? "";
+      if (!name) continue;
+      const schema = view.view?.schemaname ?? null;
+      const next = {
+        name,
+        schema,
+        isMaterialized: false,
+        withCheckOption: String(view.withCheckOption ?? "NO_CHECK_OPTION"),
+        filepath
+      };
+      const id = functionIdFor(name, schema);
+      const existing = state.views.findIndex((v) => functionIdFor(v.name, v.schema) === id);
+      if (existing >= 0) state.views[existing] = next;
+      else state.views.push(next);
+    }
+    const ctas = stmt.CreateTableAsStmt;
+    if (ctas && ctas.objtype === "OBJECT_MATVIEW") {
+      const name = ctas.into?.rel?.relname ?? "";
+      if (!name) continue;
+      const schema = ctas.into?.rel?.schemaname ?? null;
+      const next = {
+        name,
+        schema,
+        isMaterialized: true,
+        withCheckOption: "N/A",
+        filepath
+      };
+      const id = functionIdFor(name, schema);
+      const existing = state.views.findIndex((v) => functionIdFor(v.name, v.schema) === id);
+      if (existing >= 0) state.views[existing] = next;
+      else state.views.push(next);
+    }
+  }
+}
+function applyDropsForSchemaObjects(stmts, state) {
+  for (const wrap of stmts) {
+    const drop = wrap.stmt?.DropStmt;
+    if (!drop) continue;
+    const removeType = drop.removeType ?? "";
+    const objects = drop.objects ?? [];
+    if (removeType === "OBJECT_TABLE") {
+      const droppedTables = /* @__PURE__ */ new Set();
+      for (const obj of objects) {
+        const items = obj.List?.items ?? [];
+        const last = items[items.length - 1]?.String?.sval;
+        if (last) droppedTables.add(last);
+      }
+      if (droppedTables.size > 0) {
+        for (const t of droppedTables) state.tables.delete(t);
+        state.fks = state.fks.filter((fk) => !droppedTables.has(fk.sourceTable) && !droppedTables.has(fk.targetTable));
+      }
+    } else if (removeType === "OBJECT_TYPE") {
+      const droppedEnums = /* @__PURE__ */ new Set();
+      for (const obj of objects) {
+        const tn = obj.TypeName;
+        if (!tn) continue;
+        const names = (tn.names ?? []).map((s) => s.String?.sval ?? "").filter(Boolean);
+        const last = names[names.length - 1];
+        if (last) droppedEnums.add(last);
+      }
+      for (const e of droppedEnums) state.enums.delete(e);
+    } else if (removeType === "OBJECT_EXTENSION") {
+      const names = /* @__PURE__ */ new Set();
+      for (const obj of objects) {
+        const sval = obj.String?.sval;
+        if (sval) names.add(sval);
+      }
+      if (names.size > 0) state.extensions = state.extensions.filter((e) => !names.has(e.name));
+    } else if (removeType === "OBJECT_TRIGGER") {
+      for (const obj of objects) {
+        const items = obj.List?.items ?? [];
+        if (items.length < 2) continue;
+        const table = items[0]?.String?.sval ?? "";
+        const trigName = items[items.length - 1]?.String?.sval ?? "";
+        if (!table || !trigName) continue;
+        state.triggers = state.triggers.filter((t) => !(t.table === table && t.name === trigName));
+      }
+    } else if (removeType === "OBJECT_FUNCTION" || removeType === "OBJECT_PROCEDURE") {
+      for (const obj of objects) {
+        const items = obj.ObjectWithArgs?.objname?.items ?? obj.ObjectWithArgs?.objname ?? obj.List?.items ?? [];
+        if (!items.length) continue;
+        const segs = items.map((s) => s.String?.sval ?? "").filter(Boolean);
+        if (!segs.length) continue;
+        const name = segs[segs.length - 1];
+        const schema = segs.length > 1 ? segs[segs.length - 2] : null;
+        const id = functionIdFor(name, schema);
+        state.functions = state.functions.filter((f) => functionIdFor(f.name, f.schema) !== id);
+      }
+    } else if (removeType === "OBJECT_VIEW" || removeType === "OBJECT_MATVIEW") {
+      for (const obj of objects) {
+        const items = obj.List?.items ?? [];
+        if (!items.length) continue;
+        const name = items[items.length - 1]?.String?.sval ?? "";
+        const schema = items.length > 1 ? items[items.length - 2]?.String?.sval ?? null : null;
+        if (!name) continue;
+        const id = functionIdFor(name, schema);
+        state.views = state.views.filter((v) => functionIdFor(v.name, v.schema) !== id);
+      }
+    }
+  }
+}
+function indexIsPrismaUncoverable(idx) {
+  return idx.hasPredicate || idx.hasExpressions || idx.method !== "btree";
+}
 function loadPrismaState(schemaPath) {
   if (!schemaPath || !(0, import_node_fs14.existsSync)(schemaPath)) return null;
   const content = (0, import_node_fs14.readFileSync)(schemaPath, "utf-8");
@@ -3973,6 +4395,96 @@ function verify(sqlState, prisma) {
   }
   return { contradictions, flaggedEdges };
 }
+function deriveMigrationName(sqlPath) {
+  const segments = sqlPath.split(/[\\/]/);
+  const last = segments[segments.length - 1];
+  if (last === "migration.sql" && segments.length >= 2) {
+    return segments[segments.length - 2];
+  }
+  return last.replace(/\.sql$/, "");
+}
+function extractMigrationInfoFromStmts(stmts, name, filepath) {
+  let isDestructive = false;
+  let hasOrphanCheck = false;
+  let hasSidecarBackup = false;
+  let hasPreFlightNotice = false;
+  let containsBackfill = false;
+  let containsDropColumn = false;
+  let containsDropTable = false;
+  for (const wrap of stmts) {
+    const stmt = wrap.stmt ?? {};
+    const kind = Object.keys(stmt)[0];
+    if (!kind) continue;
+    const body = stmt[kind] ?? {};
+    switch (kind) {
+      case "AlterTableStmt": {
+        const cmds = body.cmds ?? [];
+        for (const c of cmds) {
+          const subtype = c.AlterTableCmd?.subtype;
+          if (subtype === "AT_DropColumn") {
+            containsDropColumn = true;
+            isDestructive = true;
+          } else if (subtype === "AT_AlterColumnType" || subtype === "AT_DropNotNull" || subtype === "AT_DropConstraint") {
+            isDestructive = true;
+          }
+        }
+        break;
+      }
+      case "DropStmt": {
+        const removeType = body.removeType ?? "";
+        if (removeType === "OBJECT_TABLE") {
+          containsDropTable = true;
+          isDestructive = true;
+        } else if (removeType === "OBJECT_TYPE" || removeType === "OBJECT_COLUMN" || removeType === "OBJECT_INDEX" || removeType === "OBJECT_POLICY") {
+          isDestructive = true;
+        }
+        break;
+      }
+      case "CreateStmt": {
+        const relname = body.relation?.relname ?? "";
+        if (relname.startsWith("_backup_")) hasSidecarBackup = true;
+        break;
+      }
+      case "CreateTableAsStmt": {
+        const relname = body.into?.rel?.relname ?? "";
+        if (relname.startsWith("_backup_")) hasSidecarBackup = true;
+        break;
+      }
+      case "UpdateStmt":
+      case "InsertStmt":
+      case "DeleteStmt": {
+        containsBackfill = true;
+        break;
+      }
+      case "DoStmt": {
+        const args = body.args ?? [];
+        for (const arg of args) {
+          const def = arg.DefElem;
+          if (!def || def.defname !== "as") continue;
+          const code = def.arg?.String?.sval ?? "";
+          if (/\bRAISE\s+EXCEPTION\b/i.test(code)) hasOrphanCheck = true;
+          if (/\bRAISE\s+NOTICE\b/i.test(code)) hasPreFlightNotice = true;
+        }
+        break;
+      }
+    }
+  }
+  const tsMatch = name.match(/^(\d{8,14})/);
+  const timestamp = tsMatch ? tsMatch[1] : null;
+  return {
+    name,
+    filepath,
+    timestamp,
+    isDestructive,
+    hasOrphanCheck,
+    hasSidecarBackup,
+    hasPreFlightNotice,
+    containsBackfill,
+    containsDropColumn,
+    containsDropTable,
+    statementCount: stmts.length
+  };
+}
 function migrationsDirFor(rootDir) {
   const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
   if (!paths) return null;
@@ -4027,6 +4539,132 @@ function generate3(rootDir) {
       values: [...sqlEnum.values]
     });
   }
+  let indexNodeCount = 0;
+  for (const idx of sqlState.indexes) {
+    if (!indexIsPrismaUncoverable(idx)) continue;
+    nodes.push({
+      id: `index:${idx.name}`,
+      type: "index",
+      name: idx.name,
+      source: "sql",
+      table: idx.table,
+      unique: idx.unique,
+      method: idx.method,
+      columns: idx.columns,
+      has_expressions: idx.hasExpressions,
+      has_predicate: idx.hasPredicate,
+      filepath: idx.filepath
+    });
+    indexNodeCount++;
+  }
+  let extensionNodeCount = 0;
+  for (const ext of sqlState.extensions) {
+    nodes.push({
+      id: `extension:${ext.name}`,
+      type: "extension",
+      name: ext.name,
+      source: "sql",
+      schema: ext.schema,
+      version: ext.version,
+      filepath: ext.filepath
+    });
+    extensionNodeCount++;
+  }
+  let triggerNodeCount = 0;
+  for (const trg of sqlState.triggers) {
+    nodes.push({
+      id: `trigger:${trg.table}:${trg.name}`,
+      type: "trigger",
+      name: trg.name,
+      source: "sql",
+      table: trg.table,
+      timing: trg.timing,
+      events: trg.events,
+      function: trg.function,
+      has_when: trg.hasWhen,
+      for_each: trg.forEach,
+      filepath: trg.filepath
+    });
+    triggerNodeCount++;
+  }
+  let functionNodeCount = 0;
+  for (const fn of sqlState.functions) {
+    const qualified = fn.schema ? `${fn.schema}.${fn.name}` : fn.name;
+    nodes.push({
+      id: `function:${qualified}`,
+      type: "function",
+      name: fn.name,
+      source: "sql",
+      schema: fn.schema,
+      language: fn.language,
+      return_type: fn.returnType,
+      is_procedure: fn.isProcedure,
+      filepath: fn.filepath
+    });
+    functionNodeCount++;
+  }
+  let viewNodeCount = 0;
+  for (const vw of sqlState.views) {
+    const qualified = vw.schema ? `${vw.schema}.${vw.name}` : vw.name;
+    nodes.push({
+      id: `${vw.isMaterialized ? "matview" : "view"}:${qualified}`,
+      type: vw.isMaterialized ? "materialized_view" : "view",
+      name: vw.name,
+      source: "sql",
+      schema: vw.schema,
+      is_materialized: vw.isMaterialized,
+      with_check_option: vw.withCheckOption,
+      filepath: vw.filepath
+    });
+    viewNodeCount++;
+  }
+  let policyNodeCount = 0;
+  for (const pol of sqlState.policies) {
+    nodes.push({
+      id: `policy:${pol.table}:${pol.name}`,
+      type: "policy",
+      name: pol.name,
+      source: "sql",
+      table: pol.table,
+      command: pol.command,
+      permissive: pol.permissive,
+      roles: pol.roles,
+      has_using: pol.hasUsing,
+      has_with_check: pol.hasWithCheck,
+      filepath: pol.filepath
+    });
+    policyNodeCount++;
+  }
+  const migrationFiles = migrationsDir ? discoverMigrationFiles(migrationsDir) : [];
+  let migrationNodeCount = 0;
+  for (const sqlPath of migrationFiles) {
+    const sql = (0, import_node_fs14.readFileSync)(sqlPath, "utf-8");
+    const name = deriveMigrationName(sqlPath);
+    let ast;
+    try {
+      ast = postgresDialect.parse(sql);
+    } catch {
+      ast = { stmts: [] };
+    }
+    const info = postgresDialect.extractMigrationInfo(ast, name, sqlPath);
+    nodes.push({
+      id: `migration:${name}`,
+      type: "migration",
+      name,
+      source: "sql",
+      filepath: info.filepath,
+      timestamp: info.timestamp,
+      is_destructive: info.isDestructive,
+      has_orphan_check: info.hasOrphanCheck,
+      has_sidecar_backup: info.hasSidecarBackup,
+      has_pre_flight_notice: info.hasPreFlightNotice,
+      contains_backfill: info.containsBackfill,
+      contains_drop_column: info.containsDropColumn,
+      contains_drop_table: info.containsDropTable,
+      statement_count: info.statementCount
+    });
+    migrationNodeCount++;
+  }
   const sqlOnlyTables = new Set(nodes.filter((n) => n.type === "table").map((n) => n.id));
   const edges = sqlState.fks.filter((fk) => sqlOnlyTables.has(fk.sourceTable)).map((fk) => ({
     source: fk.sourceTable,
@@ -4045,6 +4683,13 @@ function generate3(rootDir) {
       sql_tables: sqlState.tables.size,
       sql_enums: sqlState.enums.size,
       sql_fks: sqlState.fks.length,
+      sql_index_nodes: indexNodeCount,
+      sql_policy_nodes: policyNodeCount,
+      sql_extension_nodes: extensionNodeCount,
+      sql_trigger_nodes: triggerNodeCount,
+      sql_function_nodes: functionNodeCount,
+      sql_view_nodes: viewNodeCount,
+      sql_migration_nodes: migrationNodeCount,
       additive_nodes: nodes.length,
       contradictions_found: contradictions.length,
       flagged_edges_found: flaggedEdges.length
@@ -4057,12 +4702,13 @@ function generate3(rootDir) {
     flagged_edges: flaggedEdges
   };
 }
-var import_node_fs14, import_node_path15, PG_TO_PRISMA, ID, QID, sqlMigrationsParser;
+var import_node_fs14, import_node_path15, import_pgsql_parser, PG_TO_PRISMA, postgresDialect, sqlMigrationsParser;
 var init_sql_migrations = __esm({
   "src/server/graph/parsers/db/sql-migrations.ts"() {
     "use strict";
     import_node_fs14 = require("node:fs");
     import_node_path15 = require("node:path");
+    import_pgsql_parser = require("pgsql-parser");
     init_config();
     init_resolve_paths();
     PG_TO_PRISMA = {
@@ -4091,8 +4737,31 @@ var init_sql_migrations = __esm({
       "UUID": "String",
       "TEXT[]": "String[]"
     };
-    ID = `(?:"[\\w$]+"|[\\w$]+)`;
-    QID = `(?:${ID}\\.)?${ID}`;
+    postgresDialect = {
+      parse(sql) {
+        return (0, import_pgsql_parser.parseSync)(sql);
+      },
+      applyAll(ast, state, filepath) {
+        const stmts = ast.stmts ?? [];
+        extractTablesFromStmts(stmts, state);
+        extractEnumsFromStmts(stmts, state);
+        extractIndexesFromStmts(stmts, state, filepath);
+        extractPoliciesFromStmts(stmts, state, filepath);
+        extractExtensionsFromStmts(stmts, state, filepath);
+        extractTriggersFromStmts(stmts, state, filepath);
+        extractFunctionsFromStmts(stmts, state, filepath);
+        extractViewsFromStmts(stmts, state, filepath);
+        applyDropIndexes(stmts, state);
+        applyDropPolicies(stmts, state);
+        applyDropsForSchemaObjects(stmts, state);
+        applyAstAlterEnums(stmts, state);
+        applyAstAlterations(stmts, state);
+      },
+      extractMigrationInfo(ast, name, filepath) {
+        const stmts = ast.stmts ?? [];
+        return extractMigrationInfoFromStmts(stmts, name, filepath);
+      }
+    };
     sqlMigrationsParser = {
       id: "sql-migrations",
       layer: "db",
@@ -6270,14 +6939,14 @@ function serveIndex(res, clientDir) {
   serveStatic(res, indexPath);
 }
 function tryListen(server, port) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const onError = (err2) => {
       server.off("listening", onListening);
       reject(err2);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve5(port);
+      resolve6(port);
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -6717,6 +7386,73 @@ var init_chart_serve = __esm({
   }
 });
 
+// src/server/orbit/registry.ts
+function emptyRegistry() {
+  return { version: 1, worktrees: {} };
+}
+function readRegistry() {
+  if (!(0, import_node_fs22.existsSync)(REGISTRY_PATH)) return emptyRegistry();
+  try {
+    const parsed = JSON.parse((0, import_node_fs22.readFileSync)(REGISTRY_PATH, "utf-8"));
+    if (parsed?.version === 1 && parsed.worktrees && typeof parsed.worktrees === "object") {
+      return parsed;
+    }
+  } catch {
+  }
+  return emptyRegistry();
+}
+function listWorktrees() {
+  return Object.values(readRegistry().worktrees);
+}
+var import_node_fs22, import_node_os2, import_node_path25, REGISTRY_DIR, REGISTRY_PATH, LOCK_PATH;
+var init_registry = __esm({
+  "src/server/orbit/registry.ts"() {
+    "use strict";
+    import_node_fs22 = require("node:fs");
+    import_node_os2 = require("node:os");
+    import_node_path25 = require("node:path");
+    init_launch_kit_paths();
+    REGISTRY_DIR = (0, import_node_path25.join)((0, import_node_os2.homedir)(), LAUNCHSECURE_DIR, "orbit");
+    REGISTRY_PATH = (0, import_node_path25.join)(REGISTRY_DIR, "state.json");
+    LOCK_PATH = (0, import_node_path25.join)(REGISTRY_DIR, "state.json.lock");
+  }
+});
+
+// src/server/lib/worktree.ts
+function resolveWorktreeRoot(slug, monorepoRoot) {
+  const local = listWorktrees().filter((w) => w.projectRoot === monorepoRoot);
+  const match = local.find((w) => w.slug === slug);
+  if (match) return match.path;
+  if (local.length === 0) {
+    throw new Error(
+      `worktree="${slug}" requested but no worktrees are registered for this project. Run \`launch-orbit create <branch>\` first, or use \`project_root\` to point at an arbitrary path.`
+    );
+  }
+  const available = local.map((w) => `"${w.slug}" (${w.branch})`).join(", ");
+  throw new Error(`Unknown worktree "${slug}". Available: ${available}.`);
+}
+function resolveWorktreeOrProjectRoot(args, monorepoRoot) {
+  const projectRoot = typeof args.project_root === "string" ? args.project_root.trim() : "";
+  if (projectRoot) {
+    return (0, import_node_path26.isAbsolute)(projectRoot) ? projectRoot : (0, import_node_path26.resolve)(monorepoRoot, projectRoot);
+  }
+  const worktree = typeof args.worktree === "string" ? args.worktree.trim() : "";
+  if (worktree) {
+    return resolveWorktreeRoot(worktree, monorepoRoot);
+  }
+  return null;
+}
+var import_node_path26, WORKTREE_PARAM_DESCRIPTION, PROJECT_ROOT_PARAM_DESCRIPTION;
+var init_worktree = __esm({
+  "src/server/lib/worktree.ts"() {
+    "use strict";
+    import_node_path26 = require("node:path");
+    init_registry();
+    WORKTREE_PARAM_DESCRIPTION = "Optional orbit worktree slug (from `launch-orbit create`). Resolves to the worktree's path via the orbit registry (~/.launchsecure/orbit/state.json). Lets you query a worktree's state from a Claude Code session pinned to the main repo. Superseded by `project_root`.";
+    PROJECT_ROOT_PARAM_DESCRIPTION = "Optional explicit project root. Accepts an absolute path or a path relative to the monorepo root. Escape hatch when `worktree` doesn't fit. Takes precedence over all other root args.";
+  }
+});
+
 // src/server/graph/core/projects.ts
 function listProjects(monorepoRoot) {
   const cfg = loadConfig(monorepoRoot);
@@ -6724,7 +7460,7 @@ function listProjects(monorepoRoot) {
   return entries.map((p) => ({
     name: p.name,
     root: p.root,
-    absoluteRoot: (0, import_node_path25.resolve)(monorepoRoot, p.root)
+    absoluteRoot: (0, import_node_path27.resolve)(monorepoRoot, p.root)
   }));
 }
 function resolveProject(name, projects) {
@@ -6746,12 +7482,21 @@ function resolveProjectRoot(project, monorepoRoot) {
   }
   return resolveProject(raw, projects).absoluteRoot;
 }
-var import_node_path25, PROJECT_PARAM_DESCRIPTION;
+function resolveRequestRoot2(args, monorepoRoot) {
+  const fromArgs = resolveWorktreeOrProjectRoot(args, monorepoRoot);
+  if (fromArgs) return fromArgs;
+  const project = typeof args.project === "string" ? args.project : void 0;
+  return resolveProjectRoot(project, monorepoRoot);
+}
+var import_node_path27, WORKTREE_PARAM_DESCRIPTION2, PROJECT_ROOT_PARAM_DESCRIPTION2, PROJECT_PARAM_DESCRIPTION;
 var init_projects = __esm({
   "src/server/graph/core/projects.ts"() {
     "use strict";
-    import_node_path25 = require("node:path");
+    import_node_path27 = require("node:path");
+    init_worktree();
     init_config();
+    WORKTREE_PARAM_DESCRIPTION2 = WORKTREE_PARAM_DESCRIPTION;
+    PROJECT_ROOT_PARAM_DESCRIPTION2 = PROJECT_ROOT_PARAM_DESCRIPTION;
     PROJECT_PARAM_DESCRIPTION = "Optional sub-project name (or root path) from .launchchart.json projects[]. Defaults to the monorepo root. Run detect_project_stack to list configured projects.";
   }
 });
@@ -6890,10 +7635,10 @@ var init_graph_cli = __esm({
 // src/server/graph/core/language-detection.ts
 function walkForExtensions(dir, extCounts, depth = 0) {
   if (depth > 10) return;
-  if (!(0, import_node_fs22.existsSync)(dir)) return;
+  if (!(0, import_node_fs23.existsSync)(dir)) return;
   let entries;
   try {
-    entries = (0, import_node_fs22.readdirSync)(dir, { withFileTypes: true });
+    entries = (0, import_node_fs23.readdirSync)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -6901,9 +7646,9 @@ function walkForExtensions(dir, extCounts, depth = 0) {
     if (entry.name.startsWith(".") && entry.isDirectory()) continue;
     if (entry.isDirectory()) {
       if (IGNORE_DIRS.has(entry.name)) continue;
-      walkForExtensions((0, import_node_path26.join)(dir, entry.name), extCounts, depth + 1);
+      walkForExtensions((0, import_node_path28.join)(dir, entry.name), extCounts, depth + 1);
     } else {
-      const ext = (0, import_node_path26.extname)(entry.name).toLowerCase();
+      const ext = (0, import_node_path28.extname)(entry.name).toLowerCase();
       if (ext && EXTENSION_TO_LANGUAGE[ext]) {
         extCounts.set(ext, (extCounts.get(ext) ?? 0) + 1);
       }
@@ -6942,12 +7687,12 @@ function detectLanguages(rootDir, supportedLanguages) {
   });
   return results;
 }
-var import_node_fs22, import_node_path26, EXTENSION_TO_LANGUAGE, IGNORE_DIRS, AUXILIARY_LANGUAGES;
+var import_node_fs23, import_node_path28, EXTENSION_TO_LANGUAGE, IGNORE_DIRS, AUXILIARY_LANGUAGES;
 var init_language_detection = __esm({
   "src/server/graph/core/language-detection.ts"() {
     "use strict";
-    import_node_fs22 = require("node:fs");
-    import_node_path26 = require("node:path");
+    import_node_fs23 = require("node:fs");
+    import_node_path28 = require("node:path");
     init_launch_kit_paths();
     EXTENSION_TO_LANGUAGE = {
       // Web / Frontend
@@ -7069,7 +7814,7 @@ __export(watcher_exports, {
 function isIgnoredPath(rel) {
   if (rel.startsWith(GRAPHS_RELATIVE)) return true;
   if (rel.endsWith(".lock") || rel.endsWith(".log")) return true;
-  for (const part of rel.split(import_node_path27.sep)) {
+  for (const part of rel.split(import_node_path29.sep)) {
     if (IGNORE_SEGMENTS.has(part)) return true;
   }
   return false;
@@ -7111,7 +7856,7 @@ function startGraphWatcher(rootDir, opts = {}) {
       regenerating = false;
     }
   }
-  const watcher = (0, import_node_fs23.watch)(rootDir, { recursive: true }, (event, filename) => {
+  const watcher = (0, import_node_fs24.watch)(rootDir, { recursive: true }, (event, filename) => {
     if (!filename) return;
     const rel = filename.toString();
     if (process.env.LAUNCH_CHART_WATCH_TRACE === "1") {
@@ -7144,12 +7889,12 @@ function startGraphWatcher(rootDir, opts = {}) {
     freshness: () => getFreshnessTracker(rootDir).get()
   };
 }
-var import_node_fs23, import_node_path27, IGNORE_SEGMENTS, TRIGGER_EXTENSIONS, GRAPHS_RELATIVE;
+var import_node_fs24, import_node_path29, IGNORE_SEGMENTS, TRIGGER_EXTENSIONS, GRAPHS_RELATIVE;
 var init_watcher = __esm({
   "src/server/graph/core/watcher.ts"() {
     "use strict";
-    import_node_fs23 = require("node:fs");
-    import_node_path27 = require("node:path");
+    import_node_fs24 = require("node:fs");
+    import_node_path29 = require("node:path");
     init_launch_kit_paths();
     init_graph();
     init_freshness();
@@ -7178,7 +7923,7 @@ var init_watcher = __esm({
       ".prisma",
       ".sql"
     ]);
-    GRAPHS_RELATIVE = (0, import_node_path27.join)(LAUNCHSECURE_DIR, "graphs");
+    GRAPHS_RELATIVE = (0, import_node_path29.join)(LAUNCHSECURE_DIR, "graphs");
   }
 });
 
@@ -7194,14 +7939,43 @@ function matchesSearch(node, query) {
   if (node.name.toLowerCase().includes(q)) return true;
   const route = node.route;
   if (route && route.toLowerCase().includes(q)) return true;
+  const elements = node.elements;
+  if (elements) {
+    for (const el of elements) {
+      if (el.text && el.text.toLowerCase().includes(q)) return true;
+      if (el.props) {
+        for (const v of Object.values(el.props)) {
+          if (typeof v !== "string") continue;
+          if (v.includes("=>") || v.startsWith("(") || v.startsWith("{")) continue;
+          if (v.toLowerCase().includes(q)) return true;
+        }
+      }
+    }
+  }
+  const uiLabels = node.ui_labels;
+  if (uiLabels) {
+    for (const lbl of uiLabels) {
+      if (typeof lbl === "string" && lbl.toLowerCase().includes(q)) return true;
+    }
+  }
+  const notes = node.notes;
+  if (notes) {
+    for (const n of notes) {
+      if (n.kind && n.kind.toLowerCase().includes(q)) return true;
+      if (n.text && n.text.toLowerCase().includes(q)) return true;
+    }
+  }
   return false;
 }
 function toMinimal(nodes) {
   return nodes.map((n) => {
     const out = { id: n.id, type: n.type, name: n.name };
-    if (n.tags != null) out.tags = n.tags;
-    if (n.route != null) out.route = n.route;
-    if (n.methods != null) out.methods = n.methods;
+    for (const [k, v] of Object.entries(n)) {
+      if (k === "id" || k === "type" || k === "name") continue;
+      if (MINIMAL_STRIP_FIELDS.has(k)) continue;
+      if (DEEP_FIELDS.has(k)) continue;
+      if (v != null) out[k] = v;
+    }
     return out;
   });
 }
@@ -7213,6 +7987,9 @@ function crossRefsAsEdges(graph) {
     target_layer: c.layer
   }));
 }
+function categorizeNoteKind(kind) {
+  return NOTE_KIND_CATEGORY[kind] ?? "custom";
+}
 function toCompactNode(n) {
   const out = { i: n.id, t: n.type, n: n.name };
   const tags = n.tags;
@@ -7467,7 +8244,7 @@ function withFreshnessMeta(result, args) {
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return result;
   let rootDir;
   try {
-    rootDir = resolveProjectRoot(args.project, process.cwd());
+    rootDir = resolveRequestRoot2(args, process.cwd());
   } catch {
     return result;
   }
@@ -7482,7 +8259,7 @@ function withFreshnessMeta(result, args) {
 }
 function resolveOrErr(args) {
   try {
-    return { rootDir: resolveProjectRoot(args.project, process.cwd()) };
+    return { rootDir: resolveRequestRoot2(args, process.cwd()) };
   } catch (e) {
     return err(e.message);
   }
@@ -7491,6 +8268,8 @@ async function handleGenerateGraph(args) {
   const monorepoRoot = process.cwd();
   const layer = args.layer;
   const projectArg = typeof args.project === "string" ? args.project.trim() : "";
+  const worktreeArg = typeof args.worktree === "string" ? args.worktree.trim() : "";
+  const projectRootArg = typeof args.project_root === "string" ? args.project_root.trim() : "";
   function formatProjectResult(results2, relativeRoot) {
     return results2.map((r) => {
       const warnings = r.output.warnings.length;
@@ -7498,25 +8277,27 @@ async function handleGenerateGraph(args) {
     }).join("\n") + `
   \u2192 ${relativeRoot}/.launchsecure/graphs/`;
   }
-  if (projectArg) {
+  if (projectArg || worktreeArg || projectRootArg) {
     let rootDir;
     try {
-      rootDir = resolveProjectRoot(projectArg, monorepoRoot);
+      rootDir = resolveRequestRoot2(args, monorepoRoot);
     } catch (e) {
       return err(e.message);
     }
     const results2 = await generateGraph(rootDir, layer);
+    const label = worktreeArg ? `worktree "${worktreeArg}"` : projectArg ? `project "${projectArg}"` : `root "${projectRootArg}"`;
+    const queryHint = worktreeArg ? `read_graph (with worktree="${worktreeArg}")` : projectArg ? `read_graph (with project="${projectArg}")` : `read_graph (with project_root="${projectRootArg}")`;
     if (results2.length === 0) {
       return err(
-        layer ? `No parser detected for the "${layer}" layer in project "${projectArg}".` : `No parsers detected for project "${projectArg}". Check that the project root has the expected structure.`
+        layer ? `No parser detected for the "${layer}" layer in ${label}.` : `No parsers detected for ${label}. Check that the root has the expected structure.`
       );
     }
     return ok(
-      `Graph generated successfully for project "${projectArg}".
+      `Graph generated successfully for ${label}.
 
-${formatProjectResult(results2, projectArg)}
+${formatProjectResult(results2, rootDir)}
 
-Use read_graph (with project="${projectArg}") to query.`
+Use ${queryHint} to query.`
     );
   }
   const projects = listProjects(monorepoRoot);
@@ -7579,9 +8360,14 @@ function runReadGraphQueryRaw(rootDir, args) {
   const layerIsDb = args.layer === "db";
   const minimal = args.minimal ?? layerIsDb;
   const includeEdges = args.include_edges;
+  const includeFindings = args.include_findings === true;
+  const tagPredicates = Array.isArray(args.tag_predicates) ? args.tag_predicates : void 0;
+  const includeCrossRefs = args.include_cross_refs === true;
+  const crossRefType = args.cross_ref_type;
+  const edgeConfidence = Array.isArray(args.edge_confidence) ? new Set(args.edge_confidence.map((s) => String(s).toLowerCase())) : void 0;
   const offset = args.offset ?? 0;
   const limit = args.limit;
-  const hasFilter = !!(search || type || module_ || nodeId || tagKey && tagValue);
+  const hasFilter = !!(search || type || module_ || nodeId || tagKey && tagValue || tagPredicates && tagPredicates.length > 0);
   if (layer) {
     const available = getAvailableLayers(rootDir);
     if (available.length > 0 && !available.includes(layer)) {
@@ -7628,14 +8414,31 @@ function runReadGraphQueryRaw(rootDir, args) {
       result2.budget_exceeded = true;
       result2.hint = `Neighborhood truncated at hop ${nb.stoppedAtHop} (projected size exceeded budget). To explore further, call read_graph with node_id set to a specific neighbor from the returned nodes, or rerun with hops=${Math.max(1, nb.stoppedAtHop)} to confirm the partial view is what you wanted.`;
     }
+    if (includeFindings && layer === "db") {
+      result2.contradictions = graph.contradictions ?? [];
+      result2.flagged_edges = graph.flagged_edges ?? [];
+    }
+    const neighborhoodIds = new Set(nb.nodes.map((n) => n.id));
+    attachCrossRefsAndFlagged(result2, graph, neighborhoodIds, {
+      includeCrossRefs,
+      crossRefType,
+      edgeConfidence,
+      scopeToIds: true,
+      layer
+    });
     return result2;
   }
   if (!hasFilter) {
-    return {
+    const summaryResult = {
       hint: "No filter specified \u2014 returning summary only. Use search/type/module/node_id to retrieve nodes.",
       layer,
       summary: layerSummary(graph)
     };
+    if (includeFindings && layer === "db") {
+      summaryResult.contradictions = graph.contradictions ?? [];
+      summaryResult.flagged_edges = graph.flagged_edges ?? [];
+    }
+    return summaryResult;
   }
   const matched = graph.nodes.filter((n) => {
     if (search && !matchesSearch(n, search)) return false;
@@ -7643,6 +8446,11 @@ function runReadGraphQueryRaw(rootDir, args) {
     const nodeTags = n.tags;
     if (module_ && nodeTags?.module !== module_) return false;
     if (tagKey && tagValue && nodeTags?.[tagKey] !== tagValue) return false;
+    if (tagPredicates && tagPredicates.length > 0) {
+      for (const p of tagPredicates) {
+        if (!evaluatePredicate(n, p)) return false;
+      }
+    }
     return true;
   });
   if (matched.length === 0) {
@@ -7686,8 +8494,93 @@ function runReadGraphQueryRaw(rootDir, args) {
   } else if (returnedEdges.length > 0) {
     result.edges_hint = `${returnedEdges.length} edges between matched nodes omitted. Pass include_edges:true to retrieve them (only do this when you actually need edge data).`;
   }
+  if (includeFindings && layer === "db") {
+    result.contradictions = graph.contradictions ?? [];
+    result.flagged_edges = graph.flagged_edges ?? [];
+  }
+  attachCrossRefsAndFlagged(result, graph, returnedIds, {
+    includeCrossRefs,
+    crossRefType,
+    edgeConfidence,
+    scopeToIds: true,
+    layer
+  });
   return result;
 }
+function attachCrossRefsAndFlagged(result, graph, scopeIds, opts) {
+  if (opts.includeCrossRefs) {
+    const allCrossRefs = graph.cross_refs ?? [];
+    const crossRefsByNode = {};
+    for (const id of scopeIds) {
+      crossRefsByNode[id] = { outgoing: [], incoming: [] };
+    }
+    for (const cr of allCrossRefs) {
+      if (opts.crossRefType && cr.type !== opts.crossRefType) continue;
+      if (crossRefsByNode[cr.source]) crossRefsByNode[cr.source].outgoing.push(cr);
+      if (crossRefsByNode[cr.target]) crossRefsByNode[cr.target].incoming.push(cr);
+    }
+    result.cross_refs = crossRefsByNode;
+    if (opts.crossRefType) result.cross_ref_type = opts.crossRefType;
+    if (allCrossRefs.length === 0) {
+      result.parser_warning = parserWarning([opts.layer], "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)");
+    }
+  }
+  if (opts.edgeConfidence && opts.edgeConfidence.size > 0) {
+    const allFlagged = graph.flagged_edges ?? [];
+    const useScope = opts.scopeToIds && scopeIds.size > 0;
+    result.flagged_edges = allFlagged.filter((fe) => {
+      if (!opts.edgeConfidence.has(String(fe.confidence).toLowerCase())) return false;
+      if (useScope && !scopeIds.has(fe.source) && !scopeIds.has(fe.target)) return false;
+      return true;
+    });
+    if (allFlagged.length === 0 && !result.parser_warning) {
+      result.parser_warning = parserWarning([opts.layer], "flagged_edges", opts.layer === "db" ? "sql-migrations parser" : "cross-layer parsers");
+    }
+  }
+}
+function parserWarning(layers, capability, parserName) {
+  return `The ${capability} data is empty in scanned layer(s): ${layers.join(", ")}. This likely means the ${parserName} did not produce output for this project \u2014 run detect_project_stack to verify parser configuration, then generate_graph to refresh. (If the parser IS configured and the source data is genuinely empty, ignore this warning.)`;
+}
+function evaluatePredicate(node, p) {
+  if (!p.field || !p.op) return true;
+  const tags = node.tags;
+  const fromTag = tags?.[p.field];
+  const fromField = node[p.field];
+  const present = fromTag !== void 0 || fromField !== void 0;
+  if (p.op === "exists") return present;
+  if (p.op === "not_exists") return !present;
+  if (!present) return false;
+  const raw = fromTag !== void 0 ? coerceTagValue(fromTag, p.value) : fromField;
+  switch (p.op) {
+    case "eq":
+      return raw === p.value;
+    case "ne":
+      return raw !== p.value;
+    case "gt":
+      return typeof raw === "number" && typeof p.value === "number" && raw > p.value;
+    case "lt":
+      return typeof raw === "number" && typeof p.value === "number" && raw < p.value;
+    case "gte":
+      return typeof raw === "number" && typeof p.value === "number" && raw >= p.value;
+    case "lte":
+      return typeof raw === "number" && typeof p.value === "number" && raw <= p.value;
+    case "in":
+      return Array.isArray(p.value) && p.value.includes(raw);
+    default:
+      return false;
+  }
+}
+function coerceTagValue(raw, target) {
+  if (typeof target === "boolean") {
+    if (raw === "true") return true;
+    if (raw === "false") return false;
+  }
+  if (typeof target === "number") {
+    const n = Number(raw);
+    if (!Number.isNaN(n)) return n;
+  }
+  return raw;
+}
 function runReadGraphQuery(rootDir, args) {
   const raw = runReadGraphQueryRaw(rootDir, args);
   return compactResult(raw);
@@ -7700,6 +8593,8 @@ function handleReadGraph(args) {
       return err("queries array is empty. Provide at least one query object.");
     }
     const inheritedProject = typeof args.project === "string" ? args.project : void 0;
+    const inheritedWorktree = typeof args.worktree === "string" ? args.worktree : void 0;
+    const inheritedProjectRoot = typeof args.project_root === "string" ? args.project_root : void 0;
     const results = [];
     let cumulativeChars = 0;
     let budgetHit = false;
@@ -7717,15 +8612,18 @@ function handleReadGraph(args) {
         });
         continue;
       }
-      const qWithProject = inheritedProject && !q.project ? { ...q, project: inheritedProject } : q;
+      const qInherited = { ...q };
+      if (inheritedProject && !qInherited.project) qInherited.project = inheritedProject;
+      if (inheritedWorktree && !qInherited.worktree) qInherited.worktree = inheritedWorktree;
+      if (inheritedProjectRoot && !qInherited.project_root) qInherited.project_root = inheritedProjectRoot;
       let perQueryRoot;
       try {
-        perQueryRoot = resolveProjectRoot(qWithProject.project, monorepoRoot);
+        perQueryRoot = resolveRequestRoot2(qInherited, monorepoRoot);
       } catch (e) {
         results.push({ index: i, query: q, result: { error: e.message } });
         continue;
       }
-      const r = runReadGraphQuery(perQueryRoot, qWithProject);
+      const r = runReadGraphQuery(perQueryRoot, qInherited);
       const entry = { index: i, query: q, result: r };
       const entrySize = JSON.stringify(entry, null, 2).length;
       if (cumulativeChars + entrySize > BATCH_BUDGET_CHARS && results.length > 0) {
@@ -7758,12 +8656,12 @@ function handleReadGraph(args) {
   return okJson(result);
 }
 function nodeToFilePath(rootDir, layer, nodeId) {
-  if (layer === "ui" || layer === "api") return (0, import_node_path28.join)(rootDir, "src", nodeId);
-  if (layer === "db") return (0, import_node_path28.join)(rootDir, "prisma", "schema.prisma");
-  const withSrc = (0, import_node_path28.join)(rootDir, "src", nodeId);
-  if ((0, import_node_fs24.existsSync)(withSrc)) return withSrc;
-  const direct = (0, import_node_path28.join)(rootDir, nodeId);
-  if ((0, import_node_fs24.existsSync)(direct)) return direct;
+  if (layer === "ui" || layer === "api") return (0, import_node_path30.join)(rootDir, "src", nodeId);
+  if (layer === "db") return (0, import_node_path30.join)(rootDir, "prisma", "schema.prisma");
+  const withSrc = (0, import_node_path30.join)(rootDir, "src", nodeId);
+  if ((0, import_node_fs25.existsSync)(withSrc)) return withSrc;
+  const direct = (0, import_node_path30.join)(rootDir, nodeId);
+  if ((0, import_node_fs25.existsSync)(direct)) return direct;
   return null;
 }
 function handleInspectNode(args) {
@@ -7793,8 +8691,23 @@ function handleInspectNode(args) {
   } else {
     matched = graph.nodes;
   }
-  const allDeepFields = ["elements", "stateVars", "conditions", "variables", "responses", "params", "effects"];
+  const allDeepFields = ["elements", "stateVars", "conditions", "variables", "responses", "params", "effects", "ui_labels", "notes", "crossRefs"];
   const requestedFields = fields ?? allDeepFields;
+  const crossRefTypeArg = args.cross_ref_type;
+  const wantCrossRefs = requestedFields.includes("crossRefs");
+  let crossRefsBySource = null;
+  let crossRefsByTarget = null;
+  if (wantCrossRefs) {
+    crossRefsBySource = /* @__PURE__ */ new Map();
+    crossRefsByTarget = /* @__PURE__ */ new Map();
+    for (const cr of graph.cross_refs ?? []) {
+      if (crossRefTypeArg && cr.type !== crossRefTypeArg) continue;
+      if (!crossRefsBySource.has(cr.source)) crossRefsBySource.set(cr.source, []);
+      crossRefsBySource.get(cr.source).push(cr);
+      if (!crossRefsByTarget.has(cr.target)) crossRefsByTarget.set(cr.target, []);
+      crossRefsByTarget.get(cr.target).push(cr);
+    }
+  }
   let filterRegex = null;
   if (filter) {
     try {
@@ -7817,7 +8730,14 @@ function handleInspectNode(args) {
     const deep = { id: node.id, name: node.name, type: node.type };
     let hasData = false;
     for (const field of requestedFields) {
-      if (allDeepFields.includes(field) && node[field] != null) {
+      if (field === "crossRefs") {
+        const outgoing = crossRefsBySource?.get(node.id) ?? [];
+        const incoming = crossRefsByTarget?.get(node.id) ?? [];
+        if (outgoing.length > 0 || incoming.length > 0) {
+          deep.crossRefs = { outgoing, incoming };
+          hasData = true;
+        }
+      } else if (allDeepFields.includes(field) && node[field] != null) {
         deep[field] = node[field];
         hasData = true;
       }
@@ -7841,13 +8761,112 @@ function handleInspectNode(args) {
     const hint = filter ? `No nodes with deep fields matching /${filter}/${caseInsensitive ? "i" : ""} in ${layer} layer.` : `No nodes matching "${search}" in ${layer} layer.`;
     return err(hint);
   }
+  const wantedCrossRefs = wantCrossRefs;
+  const graphHasNoCrossRefs = (graph.cross_refs ?? []).length === 0;
+  const extraWarning = wantedCrossRefs && graphHasNoCrossRefs ? { parser_warning: parserWarning([layer], "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)") } : {};
   return okJson({
     layer,
     matched: results.length,
     ...results.length >= maxResults ? { truncated: true, hint: `Showing first ${maxResults} matches. Narrow with search param.` } : {},
+    ...extraWarning,
     nodes: results
   });
 }
+function handleListNotes(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const layerArg = args.layer;
+  const kindArg = args.kind?.toUpperCase();
+  const categoryArg = args.category ?? "actionable,warning";
+  const moduleArg = args.module;
+  const patternArg = args.pattern;
+  const authorArg = args.author?.toLowerCase();
+  const limit = args.limit ?? 100;
+  const offset = args.offset ?? 0;
+  let patternRegex = null;
+  if (patternArg) {
+    try {
+      patternRegex = new RegExp(patternArg, "i");
+    } catch {
+      return err(`Invalid regex pattern: "${patternArg}"`);
+    }
+  }
+  const wantedCategories = (() => {
+    const trimmed = categoryArg.trim().toLowerCase();
+    if (trimmed === "all") return "all";
+    const out = /* @__PURE__ */ new Set();
+    for (const part of trimmed.split(",").map((s) => s.trim()).filter(Boolean)) {
+      if (part === "actionable" || part === "warning" || part === "doc" || part === "custom") {
+        out.add(part);
+      }
+    }
+    if (out.size === 0) {
+      out.add("actionable");
+      out.add("warning");
+    }
+    return out;
+  })();
+  const layers = layerArg ? [layerArg] : getAvailableLayers(rootDir);
+  const items = [];
+  for (const layer of layers) {
+    const graph = readGraph(rootDir, layer);
+    if (!graph) continue;
+    for (const node of graph.nodes) {
+      const nodeNotes = node.notes;
+      if (!nodeNotes || nodeNotes.length === 0) continue;
+      const tags = node.tags;
+      const nodeModule = tags?.module;
+      if (moduleArg && nodeModule !== moduleArg) continue;
+      for (const n of nodeNotes) {
+        if (!n.kind || !n.text || typeof n.line !== "number") continue;
+        const category = categorizeNoteKind(n.kind);
+        if (wantedCategories !== "all" && !wantedCategories.has(category)) continue;
+        if (kindArg && n.kind.toUpperCase() !== kindArg) continue;
+        if (authorArg && (!n.author || n.author.toLowerCase() !== authorArg)) continue;
+        if (patternRegex && !patternRegex.test(n.text)) continue;
+        const item = {
+          file: node.id,
+          line: n.line,
+          kind: n.kind,
+          category,
+          text: n.text
+        };
+        if (n.author) item.author = n.author;
+        if (nodeModule) item.module = nodeModule;
+        items.push(item);
+      }
+    }
+  }
+  const catOrder = { actionable: 0, warning: 1, doc: 2, custom: 3 };
+  items.sort((a, b) => {
+    const c = catOrder[a.category] - catOrder[b.category];
+    if (c !== 0) return c;
+    const k = a.kind.localeCompare(b.kind);
+    if (k !== 0) return k;
+    const f = a.file.localeCompare(b.file);
+    if (f !== 0) return f;
+    return a.line - b.line;
+  });
+  const total = items.length;
+  const paged = items.slice(offset, offset + limit);
+  const hasMore = offset + paged.length < total;
+  return okJson({
+    total,
+    returned: paged.length,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + paged.length } : {},
+    filter: {
+      layer: layerArg ?? "all",
+      kind: kindArg ?? null,
+      category: categoryArg,
+      module: moduleArg ?? null,
+      pattern: patternArg ?? null,
+      author: authorArg ?? null
+    },
+    items: paged
+  });
+}
 function handleGrepNodes(args) {
   const __resolved = resolveOrErr(args);
   if ("content" in __resolved) return __resolved;
@@ -7910,11 +8929,11 @@ function handleGrepNodes(args) {
   let filesSearched = 0;
   let truncated = false;
   for (const [filePath, nodeId] of filePaths) {
-    if (!(0, import_node_fs24.existsSync)(filePath)) continue;
+    if (!(0, import_node_fs25.existsSync)(filePath)) continue;
     filesSearched++;
     let content;
     try {
-      content = (0, import_node_fs24.readFileSync)(filePath, "utf-8");
+      content = (0, import_node_fs25.readFileSync)(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -7955,13 +8974,19 @@ function handleEffectsIndex(args) {
   const __resolved = resolveOrErr(args);
   if ("content" in __resolved) return __resolved;
   const { rootDir } = __resolved;
+  const kind = args.kind ?? "collisions";
+  const key = args.key;
+  const MAX_KEYS = 200;
+  if (kind === "fetch_calls") {
+    return okJson(buildFetchCallsIndex(rootDir, key, MAX_KEYS));
+  }
+  if (kind === "api_effects") {
+    return okJson(buildApiEffectsIndex(rootDir, key, MAX_KEYS));
+  }
   const idx = readEffectsIndex(rootDir);
   if (!idx) {
     return err("No effects-index.json found. Run generate_graph first (or wait for the file-watcher to fire).");
   }
-  const kind = args.kind ?? "collisions";
-  const key = args.key;
-  const MAX_KEYS = 200;
   if (kind === "singleton_risks") {
     return okJson({ kind, count: idx.singleton_risks.length, nodes: idx.singleton_risks });
   }
@@ -7975,7 +9000,7 @@ function handleEffectsIndex(args) {
   }
   const map = idx[kind];
   if (!map || typeof map !== "object") {
-    return err(`Unknown kind "${kind}". Valid: dom_ids, window_events, storage_keys, fetch_urls, timers, singleton_risks, collisions.`);
+    return err(`Unknown kind "${kind}". Valid: dom_ids, window_events, storage_keys, fetch_urls, timers, singleton_risks, collisions, fetch_calls, api_effects.`);
   }
   if (key) {
     const nodes = map[key] ?? [];
@@ -7993,6 +9018,97 @@ function handleEffectsIndex(args) {
     results
   });
 }
+function buildFetchCallsIndex(rootDir, key, maxKeys) {
+  const ui = readGraph(rootDir, "ui");
+  if (!ui) return { kind: "fetch_calls", error: "No ui graph found. Run generate_graph first." };
+  const inverted = /* @__PURE__ */ new Map();
+  let callsApiCount = 0;
+  for (const cr of ui.cross_refs ?? []) {
+    if (cr.type !== "calls_api") continue;
+    callsApiCount++;
+    if (!inverted.has(cr.target)) inverted.set(cr.target, /* @__PURE__ */ new Set());
+    inverted.get(cr.target).add(cr.source);
+  }
+  for (const n of ui.nodes) {
+    const eff = n.effects;
+    if (!eff?.fetches) continue;
+    for (const f of eff.fetches) {
+      if (!inverted.has(f)) inverted.set(f, /* @__PURE__ */ new Set());
+      inverted.get(f).add(n.id);
+    }
+  }
+  const allCrossRefs = ui.cross_refs ?? [];
+  const fetchResolverAbsent = callsApiCount === 0 && allCrossRefs.length === 0;
+  const partialResolverGap = callsApiCount === 0 && inverted.size > 0;
+  if (key) {
+    return {
+      kind: "fetch_calls",
+      key,
+      callers: [...inverted.get(key) ?? []],
+      ...fetchResolverAbsent ? { parser_warning: parserWarning(["ui"], "cross_refs", "fetch-resolver cross-layer parser") } : {},
+      ...partialResolverGap ? { parser_warning: "No calls_api cross_refs found \u2014 fetch-resolver may not be enabled. Only raw fetch() strings from ui.node.effects.fetches are indexed; resolved-to-endpoint links are missing." } : {}
+    };
+  }
+  const entries = [...inverted.entries()].sort((a, b) => b[1].size - a[1].size);
+  const truncated = entries.length > maxKeys;
+  const results = {};
+  for (const [k, v] of entries.slice(0, maxKeys)) results[k] = [...v];
+  return {
+    kind: "fetch_calls",
+    total_keys: entries.length,
+    ...truncated ? { truncated: true, showing: maxKeys, hint: "Pass `key` (endpoint path or URL template) to look up callers." } : {},
+    ...fetchResolverAbsent ? { parser_warning: parserWarning(["ui"], "cross_refs", "fetch-resolver cross-layer parser") } : {},
+    ...partialResolverGap ? { parser_warning: "No calls_api cross_refs found \u2014 fetch-resolver may not be enabled. Only raw fetch() strings from ui.node.effects.fetches are indexed; resolved-to-endpoint links are missing." } : {},
+    results
+  };
+}
+function buildApiEffectsIndex(rootDir, key, maxKeys) {
+  const api = readGraph(rootDir, "api");
+  if (!api) return { kind: "api_effects", error: "No api graph found. Run generate_graph first." };
+  const categories = ["calls", "fetches", "persists", "subscribes", "timers", "dom_writes", "globals"];
+  const inverted = {};
+  for (const c of categories) inverted[c] = /* @__PURE__ */ new Map();
+  for (const n of api.nodes) {
+    const eff = n.effects;
+    if (!eff) continue;
+    for (const c of categories) {
+      const items = eff[c];
+      if (!Array.isArray(items)) continue;
+      for (const item of items) {
+        if (!inverted[c].has(item)) inverted[c].set(item, /* @__PURE__ */ new Set());
+        inverted[c].get(item).add(n.id);
+      }
+    }
+  }
+  if (key) {
+    const hits = {};
+    for (const c of categories) {
+      const endpoints = inverted[c].get(key);
+      if (endpoints && endpoints.size > 0) hits[c] = [...endpoints];
+    }
+    return { kind: "api_effects", key, hits };
+  }
+  const TOP_CATEGORIES = Math.min(maxKeys, 50);
+  const TOP_CALLERS = 10;
+  const summary = {};
+  for (const c of categories) {
+    const entries = [...inverted[c].entries()].sort((a, b) => b[1].size - a[1].size);
+    const top = {};
+    for (const [k, v] of entries.slice(0, TOP_CATEGORIES)) {
+      const endpoints = [...v];
+      top[k] = {
+        count: endpoints.length,
+        sample_endpoints: endpoints.slice(0, TOP_CALLERS)
+      };
+    }
+    summary[c] = { total_items: entries.length, top };
+  }
+  return {
+    kind: "api_effects",
+    hint: `Summary mode: top ${TOP_CATEGORIES} items per category, top ${TOP_CALLERS} endpoints per item. Pass \`key\` (a specific call/url/event) to get the FULL caller list across all categories.`,
+    summary
+  };
+}
 function handleChartServerStatus() {
   const rootDir = process.cwd();
   const lock = getLiveLock(rootDir);
@@ -8036,11 +9152,11 @@ function handleStartChartServer(args) {
     });
   }
   const entryPath = process.argv[1];
-  const logDir = (0, import_node_path28.join)((0, import_node_os2.homedir)(), LAUNCHSECURE_DIR);
-  (0, import_node_fs24.mkdirSync)(logDir, { recursive: true });
-  const logPath = (0, import_node_path28.join)(logDir, "launch-chart.log");
-  const out = (0, import_node_fs24.openSync)(logPath, "a");
-  const err2 = (0, import_node_fs24.openSync)(logPath, "a");
+  const logDir = (0, import_node_path30.join)((0, import_node_os3.homedir)(), LAUNCHSECURE_DIR);
+  (0, import_node_fs25.mkdirSync)(logDir, { recursive: true });
+  const logPath = (0, import_node_path30.join)(logDir, "launch-chart.log");
+  const out = (0, import_node_fs25.openSync)(logPath, "a");
+  const err2 = (0, import_node_fs25.openSync)(logPath, "a");
   const portArgs = args.port ? ["--port", String(args.port)] : [];
   const child = (0, import_node_child_process2.spawn)(process.execPath, [entryPath, "serve", ...portArgs], {
     detached: true,
@@ -8106,6 +9222,296 @@ function handleRemoveTag(args) {
   removeTag(rootDir, nodeId, key);
   return okJson({ ok: true, node_id: nodeId, removed_key: key });
 }
+function handleMigrationAudit(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const requireOrphan = args.require_orphan_check !== false;
+  const requireBackup = args.require_sidecar_backup !== false;
+  const requirePreFlight = args.require_pre_flight_notice !== false;
+  const includeSafe = args.include_safe === true;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const db = readGraph(rootDir, "db");
+  if (!db) return err("No db graph found. Run generate_graph first.");
+  const migrations = db.nodes.filter((n) => n.type === "migration");
+  const audit = [];
+  for (const m of migrations) {
+    const isDestructive = m.is_destructive === true;
+    if (!isDestructive && !includeSafe) continue;
+    const violations = [];
+    if (isDestructive) {
+      if (requireOrphan && m.has_orphan_check !== true) violations.push("missing_orphan_check");
+      if (requireBackup && m.has_sidecar_backup !== true) violations.push("missing_sidecar_backup");
+      if (requirePreFlight && m.has_pre_flight_notice !== true) violations.push("missing_pre_flight_notice");
+    }
+    if (!isDestructive && includeSafe && violations.length === 0) {
+      audit.push({ id: m.id, name: m.name, timestamp: m.timestamp, is_destructive: false, status: "safe" });
+      continue;
+    }
+    if (violations.length === 0 && !includeSafe) continue;
+    audit.push({
+      id: m.id,
+      name: m.name,
+      timestamp: m.timestamp,
+      filepath: m.filepath,
+      is_destructive: isDestructive,
+      contains_drop_column: m.contains_drop_column === true,
+      contains_drop_table: m.contains_drop_table === true,
+      contains_backfill: m.contains_backfill === true,
+      has_orphan_check: m.has_orphan_check === true,
+      has_sidecar_backup: m.has_sidecar_backup === true,
+      has_pre_flight_notice: m.has_pre_flight_notice === true,
+      statement_count: m.statement_count,
+      violations,
+      status: violations.length === 0 ? "safe" : "unsafe"
+    });
+  }
+  audit.sort((a, b) => String(b.timestamp ?? "").localeCompare(String(a.timestamp ?? "")));
+  const total = audit.length;
+  const page = audit.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  return okJson({
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    items: page,
+    discipline: "Layer 1 (expand-and-contract) + Layer 2 (pg_dump wrapper) + Layer 3 (in-migration SQL guards) per CLAUDE.md. This tool checks Layer 3 only."
+  });
+}
+function handleDriftReport(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const layerArg = args.layer;
+  const kind = args.kind ?? "all";
+  const confidenceArg = Array.isArray(args.confidence) ? new Set(args.confidence.map((s) => String(s).toLowerCase())) : void 0;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const layers = layerArg ? [layerArg] : getAvailableLayers(rootDir);
+  const items = [];
+  const layersWithAnyFinding = [];
+  for (const layer of layers) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    const cs = g.contradictions ?? [];
+    const fes = g.flagged_edges ?? [];
+    if (cs.length > 0 || fes.length > 0) layersWithAnyFinding.push(layer);
+    if (kind === "all" || kind === "contradictions") {
+      for (const c of cs) {
+        items.push({ layer, kind: "contradiction", entity: c.entity, source_a: c.source_a, source_b: c.source_b, detail: c.detail });
+      }
+    }
+    if (kind === "all" || kind === "flagged_edges") {
+      for (const fe of fes) {
+        if (confidenceArg && !confidenceArg.has(String(fe.confidence).toLowerCase())) continue;
+        items.push({
+          layer,
+          kind: "flagged_edge",
+          source: fe.source,
+          target: fe.target,
+          edge_type: fe.type,
+          confidence: fe.confidence,
+          label: fe.label
+        });
+      }
+    }
+  }
+  const total = items.length;
+  const page = items.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layers.length > 0 && layersWithAnyFinding.length === 0;
+  return okJson({
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    layers_scanned: layers,
+    ...parserAbsent ? { parser_warning: parserWarning(layers, "contradictions + flagged_edges", layers.includes("db") ? "sql-migrations parser and/or cross-layer parsers" : "cross-layer parsers") } : {},
+    items: page
+  });
+}
+function handleWhoUses(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const target = args.target;
+  if (!target) return err("target is required");
+  const filterType = args.cross_ref_type;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const hits = [];
+  const layersScanned = [];
+  const layersWithCrossRefs = [];
+  for (const layer of getAvailableLayers(rootDir)) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    layersScanned.push(layer);
+    const crs = g.cross_refs ?? [];
+    if (crs.length > 0) layersWithCrossRefs.push(layer);
+    for (const cr of crs) {
+      if (cr.target !== target) continue;
+      if (filterType && cr.type !== filterType) continue;
+      const entry = {
+        source_layer: layer,
+        source: cr.source,
+        cross_ref_type: cr.type,
+        target_layer: cr.layer
+      };
+      const via = cr.via;
+      if (Array.isArray(via)) entry.via = via;
+      hits.push(entry);
+    }
+  }
+  hits.sort((a, b) => String(a.source).localeCompare(String(b.source)));
+  const total = hits.length;
+  const page = hits.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layersScanned.length > 0 && layersWithCrossRefs.length === 0;
+  return okJson({
+    target,
+    ...filterType ? { cross_ref_type: filterType } : {},
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    ...parserAbsent ? { parser_warning: parserWarning(layersScanned, "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)") } : {},
+    items: page
+  });
+}
+function handleTracePath(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const from = args.from;
+  const to = args.to;
+  if (!from || !to) return err("from and to are required");
+  const maxHops = args.max_hops ?? 5;
+  const maxPaths = args.max_paths ?? 10;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const outgoing = /* @__PURE__ */ new Map();
+  const layersScanned = [];
+  const layersWithCrossRefs = [];
+  for (const layer of getAvailableLayers(rootDir)) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    layersScanned.push(layer);
+    if ((g.cross_refs ?? []).length > 0) layersWithCrossRefs.push(layer);
+    for (const cr of g.cross_refs ?? []) {
+      const via = cr.via;
+      if (Array.isArray(via) && via.length > 0) {
+        let prev = cr.source;
+        for (const step of via) {
+          pushEdge(outgoing, { from: prev, to: step, type: cr.type, layer: cr.layer });
+          prev = step;
+        }
+        pushEdge(outgoing, { from: prev, to: cr.target, type: cr.type, layer: cr.layer });
+      } else {
+        pushEdge(outgoing, { from: cr.source, to: cr.target, type: cr.type, layer: cr.layer });
+      }
+    }
+    for (const e of g.edges ?? []) {
+      pushEdge(outgoing, { from: e.source, to: e.target, type: e.type, layer });
+    }
+  }
+  const paths = [];
+  const queue = [{ nodes: [from], edges: [] }];
+  while (queue.length > 0 && paths.length < maxPaths) {
+    const p = queue.shift();
+    const tail = p.nodes[p.nodes.length - 1];
+    if (tail === to && p.nodes.length > 1) {
+      paths.push(p);
+      continue;
+    }
+    if (p.nodes.length > maxHops) continue;
+    const next = outgoing.get(tail) ?? [];
+    for (const e of next) {
+      if (p.nodes.includes(e.to)) continue;
+      queue.push({ nodes: [...p.nodes, e.to], edges: [...p.edges, e] });
+    }
+  }
+  paths.sort((a, b) => a.nodes.length - b.nodes.length);
+  const total = paths.length;
+  const page = paths.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layersScanned.length > 0 && layersWithCrossRefs.length === 0;
+  return okJson({
+    from,
+    to,
+    max_hops: maxHops,
+    max_paths: maxPaths,
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    ...total === maxPaths ? { search_capped: true, hint: "Hit max_paths cap \u2014 more paths may exist. Raise max_paths or narrow from/to." } : {},
+    ...parserAbsent ? { parser_warning: parserWarning(layersScanned, "cross_refs", "cross-layer references parser(s)") + " Cross-layer paths are unreachable without cross_refs; only same-layer paths (imports/renders/belongs_to) are visible." } : {},
+    paths: page.map((p) => ({ hops: p.nodes.length - 1, nodes: p.nodes, edges: p.edges }))
+  });
+}
+function pushEdge(map, e) {
+  if (!map.has(e.from)) map.set(e.from, []);
+  map.get(e.from).push(e);
+}
+function handleAuthCoverageReport(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const moduleFilter = args.module;
+  const strategyFilter = args.strategy;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const api = readGraph(rootDir, "api");
+  if (!api) return err("No api graph found. Run generate_graph first.");
+  const byStrategy = {};
+  const byModule = {};
+  const unauthenticated = [];
+  const matchedEndpoints = [];
+  for (const n of api.nodes) {
+    const tags = n.tags;
+    const moduleTag = tags?.module ?? "root";
+    const auth = n.auth ?? [];
+    const strategyKey = auth.length === 0 ? "none" : auth.slice().sort().join("+");
+    byStrategy[strategyKey] = (byStrategy[strategyKey] ?? 0) + 1;
+    if (!byModule[moduleTag]) byModule[moduleTag] = { total: 0, by_strategy: {} };
+    byModule[moduleTag].total += 1;
+    byModule[moduleTag].by_strategy[strategyKey] = (byModule[moduleTag].by_strategy[strategyKey] ?? 0) + 1;
+    if (auth.length === 0) unauthenticated.push(n.id);
+    if (moduleFilter && moduleTag !== moduleFilter) continue;
+    if (strategyFilter && strategyKey !== strategyFilter) continue;
+    matchedEndpoints.push({
+      id: n.id,
+      path: n.path,
+      methods: n.methods,
+      module: moduleTag,
+      auth,
+      mutates: n.mutates === true
+    });
+  }
+  matchedEndpoints.sort((a, b) => String(a.path ?? a.id).localeCompare(String(b.path ?? b.id)));
+  const total = matchedEndpoints.length;
+  const page = matchedEndpoints.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  return okJson({
+    total_endpoints: api.nodes.length,
+    by_strategy: byStrategy,
+    unauthenticated_count: unauthenticated.length,
+    by_module: byModule,
+    filter: { module: moduleFilter, strategy: strategyFilter },
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    items: page
+  });
+}
 function handleAuditLayer(args) {
   const __resolved = resolveOrErr(args);
   if ("content" in __resolved) return __resolved;
@@ -8169,20 +9575,20 @@ function handleDetectProjectStack() {
       if (ref.type === "references_api") stats.references_api++;
     }
   }
-  const srcDir = (0, import_node_path28.join)(rootDir, "src");
-  if ((0, import_node_fs24.existsSync)(srcDir)) {
+  const srcDir = (0, import_node_path30.join)(rootDir, "src");
+  if ((0, import_node_fs25.existsSync)(srcDir)) {
     const scanDir = (dir) => {
-      if (!(0, import_node_fs24.existsSync)(dir)) return;
-      for (const entry of (0, import_node_fs24.readdirSync)(dir, { withFileTypes: true })) {
+      if (!(0, import_node_fs25.existsSync)(dir)) return;
+      for (const entry of (0, import_node_fs25.readdirSync)(dir, { withFileTypes: true })) {
         if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-        const full = (0, import_node_path28.join)(dir, entry.name);
+        const full = (0, import_node_path30.join)(dir, entry.name);
         if (entry.isDirectory()) {
           scanDir(full);
           continue;
         }
-        if (![".ts", ".tsx"].includes((0, import_node_path28.extname)(entry.name))) continue;
+        if (![".ts", ".tsx"].includes((0, import_node_path30.extname)(entry.name))) continue;
         try {
-          const content = (0, import_node_fs24.readFileSync)(full, "utf-8");
+          const content = (0, import_node_fs25.readFileSync)(full, "utf-8");
           const matches = content.match(/@api\s+(GET|POST|PUT|DELETE|PATCH)\s+\/\S+/g);
           if (matches) stats.annotations += matches.length;
         } catch {
@@ -8201,7 +9607,7 @@ function handleDetectProjectStack() {
     name: p.name,
     root: p.root,
     absolute_root: p.absoluteRoot,
-    has_graph: (0, import_node_fs24.existsSync)((0, import_node_path28.join)(p.absoluteRoot, LAUNCHSECURE_DIR, "graphs"))
+    has_graph: (0, import_node_fs25.existsSync)((0, import_node_path30.join)(p.absoluteRoot, LAUNCHSECURE_DIR, "graphs"))
   }));
   return okJson({
     languages,
@@ -8315,6 +9721,30 @@ async function handleMessage(msg) {
       respond(id ?? null, withFreshnessMeta(handleBlastPoints(args), args));
       return;
     }
+    if (toolName === "list_notes") {
+      respond(id ?? null, withFreshnessMeta(handleListNotes(args), args));
+      return;
+    }
+    if (toolName === "migration_audit") {
+      respond(id ?? null, withFreshnessMeta(handleMigrationAudit(args), args));
+      return;
+    }
+    if (toolName === "drift_report") {
+      respond(id ?? null, withFreshnessMeta(handleDriftReport(args), args));
+      return;
+    }
+    if (toolName === "who_uses") {
+      respond(id ?? null, withFreshnessMeta(handleWhoUses(args), args));
+      return;
+    }
+    if (toolName === "trace_path") {
+      respond(id ?? null, withFreshnessMeta(handleTracePath(args), args));
+      return;
+    }
+    if (toolName === "auth_coverage_report") {
+      respond(id ?? null, withFreshnessMeta(handleAuthCoverageReport(args), args));
+      return;
+    }
     respondError(id ?? null, -32601, `Unknown tool: ${toolName}`);
     return;
   }
@@ -8375,14 +9805,14 @@ function startGraphMcpServer() {
   process.stderr.write(`[launchsecure-graph] MCP server started (cwd: ${process.cwd()})
 `);
 }
-var import_node_fs24, import_node_path28, import_node_child_process2, import_node_os2, SERVER_INFO, TOOLS, COMPACT_SCHEMA, COMPACT_NODE_KNOWN_KEYS, DEEP_FIELDS, EST_CHARS_PER_NODE_FULL, EST_CHARS_PER_NODE_MIN, EST_CHARS_PER_EDGE, DEFAULT_EST_NODE_FULL, DEFAULT_EST_NODE_MIN, DEFAULT_EST_EDGE, NEIGHBORHOOD_BUDGET_CHARS, MAX_FILTER_EDGES, BATCH_BUDGET_CHARS, watcherHandle;
+var import_node_fs25, import_node_path30, import_node_child_process2, import_node_os3, SERVER_INFO, TOOLS, MINIMAL_STRIP_FIELDS, COMPACT_SCHEMA, COMPACT_NODE_KNOWN_KEYS, DEEP_FIELDS, NOTE_KIND_CATEGORY, EST_CHARS_PER_NODE_FULL, EST_CHARS_PER_NODE_MIN, EST_CHARS_PER_EDGE, DEFAULT_EST_NODE_FULL, DEFAULT_EST_NODE_MIN, DEFAULT_EST_EDGE, NEIGHBORHOOD_BUDGET_CHARS, MAX_FILTER_EDGES, BATCH_BUDGET_CHARS, watcherHandle;
 var init_graph_mcp = __esm({
   "src/server/graph-mcp.ts"() {
     "use strict";
-    import_node_fs24 = require("node:fs");
-    import_node_path28 = require("node:path");
+    import_node_fs25 = require("node:fs");
+    import_node_path30 = require("node:path");
     import_node_child_process2 = require("node:child_process");
-    import_node_os2 = require("node:os");
+    import_node_os3 = require("node:os");
     init_launch_kit_paths();
     init_graph();
     init_lockfile();
@@ -8410,13 +9840,21 @@ var init_graph_mcp = __esm({
             project: {
               type: "string",
               description: PROJECT_PARAM_DESCRIPTION + " Special: omit to regenerate ALL configured projects."
+            },
+            worktree: {
+              type: "string",
+              description: WORKTREE_PARAM_DESCRIPTION2
+            },
+            project_root: {
+              type: "string",
+              description: PROJECT_ROOT_PARAM_DESCRIPTION2
             }
           }
         }
       },
       {
         name: "read_graph",
-        description: 'Query the structural project graph \u2014 use INSTEAD of Glob and Grep for locating files, understanding structure, and navigating the codebase. Faster and more accurate than file-system search because it returns typed nodes with metadata and relationships. \n\nUSE THIS FOR: "where is X", "what files are in module Y", "what pages exist under /admin", "what components does Z render", "what tables relate to User", "list all hooks in auth module", "which endpoints touch the User table", "what auth strategy does this endpoint use". \n\nDO NOT USE FOR: understanding what\'s INSIDE a component (use inspect_node for elements, conditions, state, variables, responses), reading actual source code (use Read). \n\nQUERY PARAMS (at least one required for node data \u2014 unfiltered calls return summary only to stay in context):\n- search: substring match on node id, name, or route\n- type: filter by node type (ui layer: page, layout, component, ui, hook, context, config, util; api layer: endpoint; db layer: table, enum)\n- module: filter by module tag (computed from directory structure, e.g. "auth", "admin", "settings")\n- node_id: return this node + its neighborhood (incoming+outgoing edges within `hops`)\n- hops: neighborhood radius when node_id is set (default 1)\n- minimal: return only id/type/name/module/route per node (skip heavy fields like columns, exports)\n- include_edges: return the actual edge list. Default: TRUE for neighborhood queries (node_id), FALSE for filter queries (search/type/module). Filter responses always include `edge_count`; only pass include_edges:true when you actually need to inspect individual edges (e.g. "which components render X"). This default cuts typical filter responses in half.\n\nBATCH MODE: pass `queries` (array of query objects) to run multiple independent queries in a single call. Each query object uses the same params (layer/search/type/module/node_id/hops/minimal). Returns { batch: true, count, results: [{index, query, result}, ...] }. Use this when you need multiple graph views up-front (e.g. scoping a feature across ui+api+db layers) to save round-trips. When batch mode is used, top-level params are ignored.\n\nReturns: filtered nodes + edges between them. If no filter given, returns per-layer counts and type breakdown only.\n\nWIRE FORMAT (compact): responses that include nodes/edges use short keys and edge-by-index refs to cut payload ~40-60%. Every such response carries a `_schema` legend. Quick reference:\n  nodes[]: { i: id, t: type, n: name, m: module, r: route, mt: methods, x: exports, c: columns }\n  edges[]: { s: source_node_index, d: target_node_index, t: type, l: label }\nedges.s / edges.d are 0-based indices into THIS response\'s nodes array. If a referenced node is not in the response (boundary case), s/d may instead contain the full node id string \u2014 always check the type.\n\nPAGINATION (filter queries):\n- Use `offset` and `limit` to paginate through large result sets.\n- Response includes: `total` (matched), `returned` (in this page), `has_more`, `next_offset`.\n- If `has_more: true`, call again with `offset: next_offset` to get the next page.\n\nBUDGET GUARDS:\n- Neighborhood queries stop expanding when the projected response exceeds budget. The response then contains `budget_exceeded: true` plus `hops_traversed < hops_requested`. When this happens, drill into a specific neighbor with another node_id call rather than retrying with larger hops \u2014 it will just truncate again.\n- Batch mode caps total response size. Once the budget is hit, later queries return `{skipped: true, reason: "batch_budget_exhausted"}` and you must re-run them individually.\n\nMONOREPOS: pass `project: "<name>"` to query a sub-project graph (defined in .launchchart.json projects[]). Omitting `project` targets the monorepo root. In batch mode the top-level `project` is inherited by sub-queries that do not set their own. Run detect_project_stack to list configured projects.',
+        description: 'Query the structural project graph \u2014 use INSTEAD of Glob and Grep for locating files, understanding structure, and navigating the codebase. Faster and more accurate than file-system search because it returns typed nodes with metadata and relationships. \n\nUSE THIS FOR: "where is X", "what files are in module Y", "what pages exist under /admin", "what components does Z render", "what tables relate to User", "list all hooks in auth module", "which endpoints touch the User table", "what auth strategy does this endpoint use". \n\nDO NOT USE FOR: understanding what\'s INSIDE a component (use inspect_node for elements, conditions, state, variables, responses), reading actual source code (use Read). \n\nQUERY PARAMS (at least one required for node data \u2014 unfiltered calls return summary only to stay in context):\n- search: substring match on node id, name, route, JSX element text/string-prop literals, ui_labels (strings from `const X = [{label:\'\u2026\'}]` data arrays), and notes (tagged comments). Lets queries like search:"Briefs" find a page where "Briefs" is a tab label inside an array, or search:"FIXME" find every file with a FIXME comment. For exhaustive note listings use list_notes.\n- type: filter by node type (ui layer: page, layout, component, ui, hook, context, config, util; api layer: endpoint; db layer: table, enum, migration). Migration nodes carry safety attributes \u2014 is_destructive, has_orphan_check, has_sidecar_backup, has_pre_flight_notice, contains_backfill, contains_drop_column, contains_drop_table, statement_count, timestamp \u2014 queryable via tag_key filters or by inspecting returned node fields.\n- include_findings: db layer only. When true, response includes `contradictions` and `flagged_edges` arrays surfacing SQL\u2194ORM schema drift detected by the SQL migrations parser. Use this to audit "schema vs migrations" disagreement (missing columns, type mismatches, nullability drift, FKs declared in SQL but not ORM).\n- module: filter by module tag (computed from directory structure, e.g. "auth", "admin", "settings")\n- node_id: return this node + its neighborhood (incoming+outgoing edges within `hops`)\n- hops: neighborhood radius when node_id is set (default 1)\n- minimal: return only id/type/name/module/route per node (skip heavy fields like columns, exports)\n- include_edges: return the actual edge list. Default: TRUE for neighborhood queries (node_id), FALSE for filter queries (search/type/module). Filter responses always include `edge_count`; only pass include_edges:true when you actually need to inspect individual edges (e.g. "which components render X"). This default cuts typical filter responses in half.\n\nBATCH MODE: pass `queries` (array of query objects) to run multiple independent queries in a single call. Each query object uses the same params (layer/search/type/module/node_id/hops/minimal). Returns { batch: true, count, results: [{index, query, result}, ...] }. Use this when you need multiple graph views up-front (e.g. scoping a feature across ui+api+db layers) to save round-trips. When batch mode is used, top-level params are ignored.\n\nReturns: filtered nodes + edges between them. If no filter given, returns per-layer counts and type breakdown only.\n\nWIRE FORMAT (compact): responses that include nodes/edges use short keys and edge-by-index refs to cut payload ~40-60%. Every such response carries a `_schema` legend. Quick reference:\n  nodes[]: { i: id, t: type, n: name, m: module, r: route, mt: methods, x: exports, c: columns }\n  edges[]: { s: source_node_index, d: target_node_index, t: type, l: label }\nedges.s / edges.d are 0-based indices into THIS response\'s nodes array. If a referenced node is not in the response (boundary case), s/d may instead contain the full node id string \u2014 always check the type.\n\nPAGINATION (filter queries):\n- Use `offset` and `limit` to paginate through large result sets.\n- Response includes: `total` (matched), `returned` (in this page), `has_more`, `next_offset`.\n- If `has_more: true`, call again with `offset: next_offset` to get the next page.\n\nBUDGET GUARDS:\n- Neighborhood queries stop expanding when the projected response exceeds budget. The response then contains `budget_exceeded: true` plus `hops_traversed < hops_requested`. When this happens, drill into a specific neighbor with another node_id call rather than retrying with larger hops \u2014 it will just truncate again.\n- Batch mode caps total response size. Once the budget is hit, later queries return `{skipped: true, reason: "batch_budget_exhausted"}` and you must re-run them individually.\n\nMONOREPOS: pass `project: "<name>"` to query a sub-project graph (defined in .launchchart.json projects[]). Omitting `project` targets the monorepo root. In batch mode the top-level `project` is inherited by sub-queries that do not set their own. Run detect_project_stack to list configured projects.',
         inputSchema: {
           type: "object",
           properties: {
@@ -8426,7 +9864,7 @@ var init_graph_mcp = __esm({
             },
             search: {
               type: "string",
-              description: "Case-insensitive substring match against node id, name, or route."
+              description: "Case-insensitive substring match against node id, name, route, JSX element text/string-prop literals, and ui_labels (strings from `const X = [{label:'\u2026'}]` data arrays)."
             },
             type: {
               type: "string",
@@ -8460,6 +9898,36 @@ var init_graph_mcp = __esm({
               type: "boolean",
               description: "Include the edge list in the response. Default TRUE for neighborhood queries (node_id), FALSE for filter queries. Filter responses always include edge_count. Only set true on filter queries when you actually need edge data."
             },
+            include_findings: {
+              type: "boolean",
+              description: "DB layer only. When true, response includes `contradictions[]` and `flagged_edges[]` arrays from the SQL migrations parser \u2014 SQL\u2194ORM schema drift findings (missing columns/tables, type mismatches, nullability drift, FKs in SQL but no ORM @relation). Default false."
+            },
+            tag_predicates: {
+              type: "array",
+              description: 'Multi-condition AND filter over node attributes. Each predicate is { field, op, value }. `field` matches either a top-level node attribute (e.g. is_destructive, mutates, statement_count) OR a tag key (tag values take precedence when both exist). `op` \u2208 {eq, ne, gt, lt, gte, lte, exists, not_exists, in}. Example: [{field:"is_destructive",op:"eq",value:true},{field:"has_orphan_check",op:"eq",value:false}] returns destructive migrations missing an orphan check.',
+              items: {
+                type: "object",
+                properties: {
+                  field: { type: "string", description: "Node attribute or tag key." },
+                  op: { type: "string", enum: ["eq", "ne", "gt", "lt", "gte", "lte", "exists", "not_exists", "in"] },
+                  value: { description: "Comparison value. Required for all ops except exists/not_exists. Pass an array for `in`." }
+                },
+                required: ["field", "op"]
+              }
+            },
+            include_cross_refs: {
+              type: "boolean",
+              description: "When true, attach `cross_refs` (incoming + outgoing) to each returned node. Unlocks the cross-layer reference data (references_static, calls_api, reads_via, mutates_via, reads, mutates, references_api) that is otherwise dropped from responses. Combine with `cross_ref_type` to narrow."
+            },
+            cross_ref_type: {
+              type: "string",
+              description: "Narrow attached cross_refs by kind. Common values: calls_api, references_static, reads_via, mutates_via, reads, mutates, references_api. Only applies when include_cross_refs is true."
+            },
+            edge_confidence: {
+              type: "array",
+              description: 'Filter to surface low/medium/high-confidence flagged_edges in the response. Pass e.g. ["medium","high"] to get DYNAMIC navigation targets, FK drift, etc. Scoped to matched nodes when a node filter is in play; otherwise returns all flagged_edges at the requested confidence levels. Layer-independent.',
+              items: { type: "string", enum: ["low", "medium", "high"] }
+            },
             offset: {
               type: "number",
               description: "Skip first N matched nodes (pagination). Default 0. Use next_offset from a previous response to get the next page."
@@ -8470,7 +9938,7 @@ var init_graph_mcp = __esm({
             },
             queries: {
               type: "array",
-              description: "Batch mode \u2014 array of query objects to run in a single call. Each uses the same param schema (including `project`). When set, top-level params are ignored. Subject to an aggregate size budget \u2014 later queries may return a skipped stub.",
+              description: "Batch mode \u2014 array of query objects to run in a single call. Each uses the same param schema (including `project` / `worktree` / `project_root`). Top-level root args are inherited by sub-queries that don't specify their own. Subject to an aggregate size budget \u2014 later queries may return a skipped stub.",
               items: {
                 type: "object",
                 properties: {
@@ -8482,13 +9950,28 @@ var init_graph_mcp = __esm({
                   hops: { type: "number" },
                   minimal: { type: "boolean" },
                   include_edges: { type: "boolean" },
-                  project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+                  include_findings: { type: "boolean" },
+                  tag_predicates: { type: "array" },
+                  include_cross_refs: { type: "boolean" },
+                  cross_ref_type: { type: "string" },
+                  edge_confidence: { type: "array" },
+                  project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+                  worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+                  project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
                 }
               }
             },
             project: {
               type: "string",
               description: PROJECT_PARAM_DESCRIPTION
+            },
+            worktree: {
+              type: "string",
+              description: WORKTREE_PARAM_DESCRIPTION2
+            },
+            project_root: {
+              type: "string",
+              description: PROJECT_ROOT_PARAM_DESCRIPTION2
             }
           }
         }
@@ -8536,7 +10019,9 @@ Returns: { pattern, filter, files_searched, total_matches, matches: [{file, line
             context: { type: "number", description: "Context lines around each match. Default 2." },
             max_matches: { type: "number", description: "Max matches to return total. Default 50." },
             max_files: { type: "number", description: "Max files to search. Default 50." },
-            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
           },
           required: ["layer", "pattern"]
         }
@@ -8568,17 +10053,23 @@ Returns deep fields only \u2014 not structural metadata (use read_graph for that
             fields: {
               type: "array",
               items: { type: "string" },
-              description: 'Specific deep fields to return. Options: elements, stateVars, conditions, variables, responses, params, effects. Omit for all. "effects" returns the file-level side-effect summary (calls, dom_writes, subscribes, timers, persists, fetches, globals); per-arrow-function effects are also attached to each entry in "variables".'
+              description: `Specific deep fields to return. Options: elements, stateVars, conditions, variables, responses, params, effects, crossRefs. Omit for all. "effects" returns the file-level side-effect summary (calls, dom_writes, subscribes, timers, persists, fetches, globals); per-arrow-function effects are also attached to each entry in "variables". "crossRefs" returns this node's incoming + outgoing cross-layer references (calls_api, references_static, reads_via, mutates_via, reads, mutates, references_api) \u2014 the cross-layer linking data otherwise dropped from responses.`
             },
             filter: {
               type: "string",
               description: "Regex pattern to search WITHIN deep field values. Only returns nodes where at least one deep field matches. Searches across all string values in the requested fields (condition tests, variable inits, element tags/props, response bodies, etc.). When set, search becomes optional and node limit is raised to 50."
             },
+            cross_ref_type: {
+              type: "string",
+              description: 'Narrow returned crossRefs by kind (e.g. calls_api, references_static, reads_via). Only applies when "crossRefs" is included in fields (or fields is omitted).'
+            },
             case_insensitive: {
               type: "boolean",
               description: "Case-insensitive filter matching. Default true."
             },
-            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
           },
           required: ["layer"]
         }
@@ -8616,20 +10107,111 @@ Use this when the user asks "is the chart running", "show me the project graph U
       },
       {
         name: "effects_index",
-        description: 'Cross-layer inverted index over per-node side effects. Answers "who else touches X?" without re-walking every node. Built automatically when generate_graph runs (or whenever the watcher regenerates). \n\nUSE THIS FOR: "is mountFoo safe to instantiate twice?" (kind="singleton_risks"), "who writes DOM id moon-shadow-blur?" (kind="dom_ids", key="moon-shadow-blur"), "which files attach a window keydown listener?" (kind="window_events", key="window:keydown"), "who else writes localStorage key panchang.settings.v1?" (kind="storage_keys", key="..."), "any DOM-id collisions?" (kind="collisions"). \n\nReturns: { kind, results } where results is a {key: [nodeIds]} map for the chosen kind, or a list of multi-writer collisions when kind="collisions", or a flat node-id list when kind="singleton_risks".',
+        description: 'Cross-layer inverted index over per-node side effects. Answers "who else touches X?" without re-walking every node. Most kinds load from a precomputed effects-index.json (built when generate_graph runs); fetch_calls and api_effects are computed on demand from the ui/api graphs so they always reflect current state.\n\nUSE THIS FOR: "is mountFoo safe to instantiate twice?" (kind="singleton_risks"), "who writes DOM id moon-shadow-blur?" (kind="dom_ids", key="moon-shadow-blur"), "which files attach a window keydown listener?" (kind="window_events", key="window:keydown"), "who else writes localStorage key panchang.settings.v1?" (kind="storage_keys", key="..."), "any DOM-id collisions?" (kind="collisions"), "who calls /api/work-items?" (kind="fetch_calls", key="app/api/.../work-items/route.ts"), "which endpoints call db.user.findUnique?" (kind="api_effects", key="db.user.findUnique"). \n\nReturns vary by kind: {key:[nodeIds]} map for standard kinds; {dom_ids, storage_keys, window_events} for collisions; flat node-id list for singleton_risks; {api_endpoint|url_template: [ui_files]} for fetch_calls; {category: {item: [endpoint_ids]}} summary for api_effects (or {category, key, hits} when key is set).',
         inputSchema: {
           type: "object",
           properties: {
             kind: {
               type: "string",
-              enum: ["dom_ids", "window_events", "storage_keys", "fetch_urls", "timers", "singleton_risks", "collisions"],
-              description: "Which inverted index to query. Default: collisions (most actionable signal)."
+              enum: ["dom_ids", "window_events", "storage_keys", "fetch_urls", "timers", "singleton_risks", "collisions", "fetch_calls", "api_effects"],
+              description: 'Which inverted index to query. Default: collisions (most actionable signal). fetch_calls = "UI\u2192API call inventory" (resolved via ui cross_refs + raw fetch strings). api_effects = "what does each endpoint touch" inverted across all effect categories (calls / fetches / persists / subscribes / timers / dom_writes / globals).'
             },
             key: {
               type: "string",
-              description: 'Optional specific key to look up within the chosen kind (e.g. "moon-shadow-blur"). When omitted, returns the full {key:nodes} map for the kind.'
+              description: 'Optional specific key to look up within the chosen kind (e.g. "moon-shadow-blur" for dom_ids, "/api/work-items" for fetch_calls, "db.user.findUnique" for api_effects). When omitted, returns the full {key:nodes} map (or per-category summary for api_effects).'
             },
-            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          }
+        }
+      },
+      {
+        name: "migration_audit",
+        description: `List Prisma migrations that violate the migration-safety discipline: destructive migrations missing one or more guards (orphan check, sidecar backup, pre-flight notice). Codifies the three-layer migration safety rules \u2014 derived from each migration node's extracted attributes (is_destructive, has_orphan_check, has_sidecar_backup, has_pre_flight_notice, contains_backfill, contains_drop_column, contains_drop_table).
+
+USE THIS FOR: "are there unsafe migrations on this branch", "audit the migration history before deploy", "find migrations that drop columns without backup". Paginated. Returns one entry per offending migration with the specific missing guards listed.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            require_orphan_check: { type: "boolean", description: "Flag destructive migrations missing an orphan-count guard. Default true." },
+            require_sidecar_backup: { type: "boolean", description: "Flag destructive migrations missing a sidecar backup table. Default true." },
+            require_pre_flight_notice: { type: "boolean", description: "Flag destructive migrations missing a RAISE NOTICE pre-flight. Default true." },
+            include_safe: { type: "boolean", description: "Also return migrations that pass all checks (no violations). Default false \u2014 by default only offenders are returned." },
+            offset: { type: "number", description: "Pagination offset. Default 0." },
+            limit: { type: "number", description: "Max migrations to return. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          }
+        }
+      },
+      {
+        name: "drift_report",
+        description: 'Aggregate cross-layer drift findings \u2014 contradictions (schema disagreements) + flagged_edges (low-confidence resolutions, FK drift, dynamic routes) \u2014 into one report. Generalizes the db-only `read_graph include_findings` flag to all layers.\n\nUSE THIS FOR: "is the codebase drifting", "show me SQL vs ORM mismatches", "list endpoints/components with unresolved routes", "audit schema health before refactor". Paginated. Returns items with { layer, kind, source, target, detail, confidence }.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            layer: { type: "string", description: "Restrict to one layer (e.g. db, ui). Omit for all layers." },
+            kind: { type: "string", enum: ["contradictions", "flagged_edges", "all"], description: "Which finding type to return. Default all." },
+            confidence: { type: "array", items: { type: "string", enum: ["low", "medium", "high"] }, description: "For flagged_edges: filter by confidence levels. Default all." },
+            offset: { type: "number", description: "Pagination offset. Default 0." },
+            limit: { type: "number", description: "Max items to return. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          }
+        }
+      },
+      {
+        name: "who_uses",
+        description: 'List everything that references a target node via cross_refs \u2014 the cross-layer references_static / calls_api / reads_via / mutates_via / reads / mutates / references_api edges that are otherwise dropped from responses.\n\nUSE THIS FOR: "where is permission `manage_billing` used", "which UI components reference enum `WorkItemPriority`", "which endpoints touch the User table", "which files call /api/work-items". Auto-scans all layers\' cross_refs for incoming edges to the target. Paginated.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            target: { type: "string", description: 'Target node id to look up (e.g. "seed:permission:manage_billing", "User", "app/api/.../work-items/route.ts", "WorkItemPriority").' },
+            cross_ref_type: { type: "string", description: "Narrow by cross-ref kind (calls_api / references_static / reads_via / mutates_via / reads / mutates / references_api). Omit for all kinds." },
+            offset: { type: "number", description: "Pagination offset. Default 0." },
+            limit: { type: "number", description: "Max references to return. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          },
+          required: ["target"]
+        }
+      },
+      {
+        name: "trace_path",
+        description: 'Find shortest paths between two nodes across layers via cross_refs (including the via[] chains that capture transitive DB access through middleware).\n\nUSE THIS FOR: "how does AdminAnalyticsPage end up reading the User table" \u2014 returns the call chain page \u2192 fetch \u2192 endpoint \u2192 middleware \u2192 db. BFS-bounded by max_hops + max_paths to keep responses tractable on hub nodes. Paginated.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            from: { type: "string", description: "Source node id." },
+            to: { type: "string", description: "Target node id." },
+            max_hops: { type: "number", description: "Hard cap on path length. Default 5." },
+            max_paths: { type: "number", description: "Hard cap on total paths discovered. Default 10. Once hit, BFS stops." },
+            offset: { type: "number", description: "Pagination offset over discovered paths. Default 0." },
+            limit: { type: "number", description: "Max paths returned per response. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          },
+          required: ["from", "to"]
+        }
+      },
+      {
+        name: "auth_coverage_report",
+        description: 'Aggregate every API endpoint by its auth[] wrapper(s) \u2014 surfaces endpoints with empty auth, groups by module, shows which auth strategies dominate. Computed from api.json endpoint auth field (100% populated).\n\nUSE THIS FOR: "are there unauthenticated endpoints", "which auth wrappers are in use", "audit auth strategy consistency across modules". Paginated. Returns { total, by_strategy: {strategy: count}, unauthenticated: [endpoint_ids], by_module: {module: {total, by_strategy}} } plus the paginated endpoint list.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            module: { type: "string", description: 'Restrict to one module tag (e.g. "orgs", "admin").' },
+            strategy: { type: "string", description: 'Restrict to endpoints using this auth wrapper (e.g. "withAuth"). Pass "none" to list unauthenticated endpoints.' },
+            offset: { type: "number", description: "Pagination offset over the endpoint list. Default 0." },
+            limit: { type: "number", description: "Max endpoints to return per response. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
           }
         }
       },
@@ -8659,7 +10241,9 @@ Use this when the user asks "is the chart running", "show me the project graph U
               type: "string",
               description: 'Tag value (e.g. "auth", "alice", "true").'
             },
-            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
           },
           required: ["node_id", "key", "value"]
         }
@@ -8678,7 +10262,9 @@ Use this when the user asks "is the chart running", "show me the project graph U
               type: "string",
               description: "Tag key to remove."
             },
-            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
           },
           required: ["node_id", "key"]
         }
@@ -8697,7 +10283,9 @@ Use this when the user asks "is the chart running", "show me the project graph U
               type: "string",
               description: "Specific check to run (e.g. 'schema_drift', 'unprotected_routes'). Omit to run all checks for the layer."
             },
-            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
           },
           required: ["layer"]
         }
@@ -8733,12 +10321,59 @@ Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 retu
               enum: ["reverse", "both"],
               description: "'reverse' (default) = only what depends on this node. 'both' = full neighborhood."
             },
-            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
           },
           required: ["node_id"]
         }
+      },
+      {
+        name: "list_notes",
+        description: 'List tagged comments across the project graph \u2014 TODO, FIXME, HACK, NOTE, SECURITY, etc. Any `// KIND: body` or `/* KIND: body */` comment where KIND is an all-caps identifier (2\u201316 chars) is captured automatically; team conventions like `// CLAUDE:` are discovered without configuration.\n\nKinds are categorized at read time:\n  actionable: TODO, FIXME, HACK, XXX, REFACTOR, OPTIMIZE, REVIEW\n  warning:    SECURITY, WARNING, IMPORTANT, CAUTION, DANGER, DEPRECATED\n  doc:        NOTE, TIP, SEE, NB, INFO, EXAMPLE\n  custom:     anything else (team-specific conventions)\n\nDefault category filter is `actionable,warning` \u2014 the "what should I act on" view. Pass category:"all" for everything including doc + custom.\n\nReturns: { total, returned, has_more, items: [{file, line, kind, category, text, author?, module?}] }.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            layer: {
+              type: "string",
+              description: "Restrict to one layer ('ui', 'api', 'db'). Default: scan all layers that have notes."
+            },
+            kind: {
+              type: "string",
+              description: 'Exact kind match, case-insensitive (e.g. "TODO", "FIXME", "SECURITY").'
+            },
+            category: {
+              type: "string",
+              description: "'actionable' | 'warning' | 'doc' | 'custom' | 'all'. Comma-separated list also accepted. Default: 'actionable,warning'."
+            },
+            module: {
+              type: "string",
+              description: 'Restrict to nodes carrying this module tag (e.g. "auth", "work-items").'
+            },
+            pattern: {
+              type: "string",
+              description: 'Regex applied to note body text (case-insensitive). Use to grep within bodies, e.g. "race condition".'
+            },
+            author: {
+              type: "string",
+              description: "Match author from `// TODO(alice): \u2026` syntax, case-insensitive."
+            },
+            limit: {
+              type: "number",
+              description: "Max items returned. Default 100. Pair with offset for pagination."
+            },
+            offset: {
+              type: "number",
+              description: "Skip first N items. Default 0."
+            },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          }
+        }
       }
     ];
+    MINIMAL_STRIP_FIELDS = /* @__PURE__ */ new Set(["columns"]);
     COMPACT_SCHEMA = {
       nodes: {
         i: "id",
@@ -8778,8 +10413,31 @@ Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 retu
       "variables",
       "responses",
       "params",
-      "effects"
+      "effects",
+      "ui_labels",
+      "notes"
     ]);
+    NOTE_KIND_CATEGORY = {
+      TODO: "actionable",
+      FIXME: "actionable",
+      HACK: "actionable",
+      XXX: "actionable",
+      REFACTOR: "actionable",
+      OPTIMIZE: "actionable",
+      REVIEW: "actionable",
+      SECURITY: "warning",
+      WARNING: "warning",
+      IMPORTANT: "warning",
+      CAUTION: "warning",
+      DANGER: "warning",
+      DEPRECATED: "warning",
+      NOTE: "doc",
+      TIP: "doc",
+      SEE: "doc",
+      NB: "doc",
+      INFO: "doc",
+      EXAMPLE: "doc"
+    };
     EST_CHARS_PER_NODE_FULL = {
       ui: 300,
       api: 300,