@rubytech/create-maxy-code 0.1.132 → 0.1.138

package/payload/server/server.js

@@ -1,3 +1,4 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   ACCOUNTS_DIR,
   BIN_DIR,
@@ -83,11 +84,12 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-HCYM5FLU.js";
+} from "./chunk-T3DJD5QR.js";
 import {
   __commonJS,
+  __require,
   __toESM
-} from "./chunk-JSBRDJBE.js";
+} from "./chunk-HYQNUVGO.js";
 
 // ../lib/graph-trash/dist/index.js
 var require_dist = __commonJS({
@@ -365,8 +367,314 @@ var require_dist = __commonJS({
   }
 });
 
-// ../lib/graph-style/dist/index.js
+// ../lib/oauth-llm/dist/index.js
 var require_dist2 = __commonJS({
+  "../lib/oauth-llm/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.OAUTH_BETA_HEADER = void 0;
+    exports.callOauthLlm = callOauthLlm3;
+    var node_fs_1 = __require("fs");
+    var node_path_1 = __require("path");
+    var node_os_1 = __require("os");
+    var CREDENTIALS_FILE2 = process.env.CLAUDE_CONFIG_DIR ? (0, node_path_1.resolve)(process.env.CLAUDE_CONFIG_DIR, ".credentials.json") : (0, node_path_1.resolve)((0, node_os_1.homedir)(), ".claude", ".credentials.json");
+    var TOKEN_ENDPOINT3 = "https://platform.claude.com/v1/oauth/token";
+    var ANTHROPIC_MESSAGES_ENDPOINT2 = "https://api.anthropic.com/v1/messages";
+    var ANTHROPIC_VERSION2 = "2023-06-01";
+    var CLIENT_ID3 = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+    var OAUTH_BETA_HEADER2 = "oauth-2025-04-20";
+    exports.OAUTH_BETA_HEADER = OAUTH_BETA_HEADER2;
+    var EXPIRING_THRESHOLD_MS3 = 5 * 60 * 1e3;
+    var INPUT_TOO_LARGE_MARKERS2 = [
+      "prompt is too long",
+      "context_length_exceeded",
+      "too many tokens"
+    ];
+    function isInputTooLargeBody2(body) {
+      const lower = body.toLowerCase();
+      return INPUT_TOO_LARGE_MARKERS2.some((m) => lower.includes(m));
+    }
+    function readCredentials3() {
+      let raw;
+      try {
+        raw = (0, node_fs_1.readFileSync)(CREDENTIALS_FILE2, "utf-8");
+      } catch {
+        return null;
+      }
+      let data;
+      try {
+        data = JSON.parse(raw);
+      } catch {
+        return null;
+      }
+      const oauth = data.claudeAiOauth;
+      if (!oauth || typeof oauth !== "object")
+        return null;
+      const accessToken = oauth.accessToken;
+      const refreshToken = oauth.refreshToken;
+      const expiresAt = oauth.expiresAt;
+      if (typeof accessToken !== "string" || !accessToken)
+        return null;
+      if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || expiresAt <= 0) {
+        return null;
+      }
+      return {
+        accessToken,
+        refreshToken: typeof refreshToken === "string" && refreshToken ? refreshToken : null,
+        expiresAt
+      };
+    }
+    function writeCredentials2(tokens) {
+      const newExpiresAt = typeof tokens.expiresIn === "number" && tokens.expiresIn > 0 ? Date.now() + tokens.expiresIn * 1e3 : Date.now() + 3600 * 1e3;
+      let fileData = {};
+      try {
+        fileData = JSON.parse((0, node_fs_1.readFileSync)(CREDENTIALS_FILE2, "utf-8"));
+      } catch {
+      }
+      const existing = fileData.claudeAiOauth;
+      fileData.claudeAiOauth = {
+        ...existing,
+        accessToken: tokens.accessToken,
+        ...tokens.refreshToken != null ? { refreshToken: tokens.refreshToken } : {},
+        expiresAt: newExpiresAt
+      };
+      (0, node_fs_1.writeFileSync)(CREDENTIALS_FILE2, JSON.stringify(fileData, null, 2), "utf-8");
+      return newExpiresAt;
+    }
+    var refreshLock3 = null;
+    async function refreshAccessToken3(current) {
+      if (refreshLock3)
+        return refreshLock3;
+      refreshLock3 = (async () => {
+        const fresh = readCredentials3();
+        if (fresh && fresh.expiresAt - Date.now() > EXPIRING_THRESHOLD_MS3) {
+          return fresh;
+        }
+        if (!current.refreshToken) {
+          return null;
+        }
+        let res;
+        try {
+          res = await fetch(TOKEN_ENDPOINT3, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+              grant_type: "refresh_token",
+              refresh_token: current.refreshToken,
+              client_id: CLIENT_ID3
+            })
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          console.error(`[oauth-llm] refresh network error: ${msg}`);
+          return null;
+        }
+        if (!res.ok) {
+          const body = await res.text().catch(() => "");
+          console.error(`[oauth-llm] refresh failed status=${res.status} body=${body.slice(0, 200)}`);
+          return null;
+        }
+        let tokenData;
+        try {
+          tokenData = await res.json();
+        } catch {
+          console.error("[oauth-llm] refresh returned malformed JSON");
+          return null;
+        }
+        const newAccessToken = tokenData.access_token;
+        const newRefreshToken = tokenData.refresh_token;
+        const expiresIn = tokenData.expires_in;
+        if (typeof newAccessToken !== "string" || !newAccessToken) {
+          console.error("[oauth-llm] refresh response missing access_token");
+          return null;
+        }
+        const newExpiresAt = writeCredentials2({
+          accessToken: newAccessToken,
+          refreshToken: typeof newRefreshToken === "string" && newRefreshToken ? newRefreshToken : current.refreshToken,
+          expiresIn: typeof expiresIn === "number" && expiresIn > 0 ? expiresIn : void 0
+        });
+        console.error(`[oauth-llm] refresh ok expiresAt=${new Date(newExpiresAt).toISOString()}`);
+        return {
+          accessToken: newAccessToken,
+          refreshToken: typeof newRefreshToken === "string" && newRefreshToken ? newRefreshToken : current.refreshToken,
+          expiresAt: newExpiresAt
+        };
+      })();
+      try {
+        return await refreshLock3;
+      } finally {
+        refreshLock3 = null;
+      }
+    }
+    async function ensureValidToken2() {
+      const creds = readCredentials3();
+      if (!creds)
+        return null;
+      const remaining = creds.expiresAt - Date.now();
+      if (remaining > EXPIRING_THRESHOLD_MS3)
+        return creds;
+      if (remaining > 0 && !creds.refreshToken)
+        return creds;
+      if (remaining <= 0 && !creds.refreshToken)
+        return null;
+      return refreshAccessToken3(creds);
+    }
+    var betaHeaderLogged2 = false;
+    function logBetaHeaderOnce2() {
+      if (betaHeaderLogged2)
+        return;
+      betaHeaderLogged2 = true;
+      console.error(`[oauth-llm] beta-header=${OAUTH_BETA_HEADER2}`);
+    }
+    async function callOauthLlm3(params) {
+      const { model, system, userMessage, maxTokens = 4096, timeoutMs = 6e4, tools, toolChoiceName } = params;
+      if (tools && tools.length > 0 && !toolChoiceName) {
+        return {
+          kind: "fallback",
+          cause: "unexpected",
+          reason: "callOauthLlm: `tools` provided without `toolChoiceName`. Forced tool selection is required."
+        };
+      }
+      logBetaHeaderOnce2();
+      const creds = await ensureValidToken2();
+      if (!creds) {
+        return {
+          kind: "fallback",
+          cause: "missing-creds",
+          reason: "Claude Code OAuth credentials missing or expired with no refresh token available \u2014 operator must re-authenticate."
+        };
+      }
+      const controller = new AbortController();
+      const timer2 = setTimeout(() => controller.abort(), timeoutMs);
+      let res;
+      try {
+        res = await fetch(ANTHROPIC_MESSAGES_ENDPOINT2, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "anthropic-version": ANTHROPIC_VERSION2,
+            "anthropic-beta": OAUTH_BETA_HEADER2,
+            Authorization: `Bearer ${creds.accessToken}`
+          },
+          body: JSON.stringify({
+            model,
+            max_tokens: maxTokens,
+            system,
+            messages: [{ role: "user", content: userMessage }],
+            ...tools && tools.length > 0 ? { tools } : {},
+            ...toolChoiceName ? { tool_choice: { type: "tool", name: toolChoiceName } } : {}
+          }),
+          signal: controller.signal
+        });
+      } catch (err) {
+        clearTimeout(timer2);
+        const msg = err instanceof Error ? err.message : String(err);
+        if (controller.signal.aborted) {
+          return {
+            kind: "fallback",
+            cause: "timeout",
+            reason: `Model call timed out after ${timeoutMs}ms.`
+          };
+        }
+        return {
+          kind: "fallback",
+          cause: "network-error",
+          reason: `Network error reaching Anthropic: ${msg}`
+        };
+      }
+      clearTimeout(timer2);
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        if (res.status === 401 || res.status === 403) {
+          return {
+            kind: "fallback",
+            cause: "auth-error",
+            reason: `OAuth bearer rejected (status=${res.status}) \u2014 token may be revoked or beta header rejected. body=${body.slice(0, 200)}`
+          };
+        }
+        if (res.status === 429) {
+          return {
+            kind: "fallback",
+            cause: "rate-limit",
+            reason: `Anthropic rate limit hit (status=429): ${body.slice(0, 200)}`
+          };
+        }
+        if (res.status >= 500) {
+          return {
+            kind: "fallback",
+            cause: "server-error",
+            reason: `Anthropic server error (status=${res.status}): ${body.slice(0, 200)}`
+          };
+        }
+        if (res.status === 400 && isInputTooLargeBody2(body)) {
+          return {
+            kind: "fallback",
+            cause: "input-too-large",
+            reason: `Input exceeds Haiku context window (status=400 body=${body.slice(0, 200)}). Split the source into smaller segments.`
+          };
+        }
+        return {
+          kind: "fallback",
+          cause: "unexpected",
+          reason: `Anthropic returned status=${res.status}: ${body.slice(0, 200)}`
+        };
+      }
+      let payload;
+      try {
+        payload = await res.json();
+      } catch {
+        return {
+          kind: "fallback",
+          cause: "malformed-response",
+          reason: "Anthropic returned malformed JSON."
+        };
+      }
+      if (payload.error) {
+        return {
+          kind: "fallback",
+          cause: "unexpected",
+          reason: `Anthropic API error: ${payload.error.type ?? "unknown"} ${payload.error.message ?? ""}`
+        };
+      }
+      const stopReason = typeof payload.stop_reason === "string" ? payload.stop_reason : void 0;
+      const outputTokens = typeof payload.usage?.output_tokens === "number" ? payload.usage.output_tokens : void 0;
+      if (toolChoiceName) {
+        const toolBlock = payload.content?.find((block) => block.type === "tool_use");
+        if (!toolBlock || !toolBlock.input || typeof toolBlock.input !== "object") {
+          return {
+            kind: "fallback",
+            cause: "empty-response",
+            reason: "Model returned no tool_use block despite forced tool selection."
+          };
+        }
+        return {
+          kind: "ok-tool",
+          toolName: toolBlock.name ?? toolChoiceName,
+          input: toolBlock.input,
+          stopReason,
+          outputTokens
+        };
+      }
+      const textBlock = payload.content?.find((block) => {
+        if (block.type !== "text")
+          return false;
+        const candidate = block.text;
+        return typeof candidate === "string" && candidate.trim().length > 0;
+      });
+      if (!textBlock) {
+        return {
+          kind: "fallback",
+          cause: "empty-response",
+          reason: "Model returned no text content."
+        };
+      }
+      return { kind: "ok", text: textBlock.text, stopReason, outputTokens };
+    }
+  }
+});
+
+// ../lib/graph-style/dist/index.js
+var require_dist3 = __commonJS({
   "../lib/graph-style/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -1874,17 +2182,17 @@ var INBOUND_TTL_MS = 20 * 6e4;
 var INBOUND_MAX = 5e3;
 var agentSentCache = /* @__PURE__ */ new Map();
 var inboundCache = /* @__PURE__ */ new Map();
-function pruneCache(cache2, ttl, max) {
+function pruneCache(cache3, ttl, max) {
   const now = Date.now();
-  for (const [key, entry] of cache2) {
-    if (now - entry.ts > ttl) cache2.delete(key);
+  for (const [key, entry] of cache3) {
+    if (now - entry.ts > ttl) cache3.delete(key);
   }
-  if (cache2.size > max) {
-    const excess = cache2.size - max;
+  if (cache3.size > max) {
+    const excess = cache3.size - max;
     let count = 0;
-    for (const key of cache2.keys()) {
+    for (const key of cache3.keys()) {
       if (count >= excess) break;
-      cache2.delete(key);
+      cache3.delete(key);
       count++;
     }
   }
@@ -6502,16 +6810,11 @@ function readUsersFile() {
   if (!raw) return [];
   return JSON.parse(raw);
 }
-function claudeSpawnPath() {
-  const base = process.env.PATH ?? "/usr/bin:/bin:/usr/sbin:/sbin";
-  return `${base}:/opt/homebrew/bin:/usr/local/bin`;
-}
 function checkAuthStatus() {
   try {
     execFileSync2("claude", ["auth", "status"], {
       encoding: "utf-8",
-      timeout: 5e3,
-      env: { ...process.env, PATH: claudeSpawnPath() }
+      timeout: 5e3
     });
     return true;
   } catch {
@@ -6573,7 +6876,6 @@ app4.post("/claude-auth", async (c) => {
   if (process.platform === "darwin") {
     vncLog("claude-auth", { action: "start", transport: "native", platform: "darwin" });
     const claudeProc2 = spawn("claude", ["auth", "login"], {
-      env: { ...process.env, PATH: claudeSpawnPath() },
       stdio: ["ignore", "pipe", "pipe"]
     });
     claudeProc2.unref();
@@ -9716,10 +10018,251 @@ app18.delete("/", requireAdminSession, async (c) => {
 var files_default = app18;
 
 // ../lib/graph-search/src/index.ts
-var import_dist = __toESM(require_dist());
+var import_dist2 = __toESM(require_dist());
 import { int } from "neo4j-driver";
+
+// ../lib/graph-search/src/rrf-fusion.ts
+function fuseRrf(rankedLists, k = 60) {
+  const scores = /* @__PURE__ */ new Map();
+  const representatives = /* @__PURE__ */ new Map();
+  const firstSeen = /* @__PURE__ */ new Map();
+  let order = 0;
+  for (const list of rankedLists) {
+    for (let rank = 0; rank < list.length; rank++) {
+      const candidate = list[rank];
+      const contribution = 1 / (k + rank);
+      const prior = scores.get(candidate.nodeId) ?? 0;
+      scores.set(candidate.nodeId, prior + contribution);
+      if (!representatives.has(candidate.nodeId)) {
+        representatives.set(candidate.nodeId, candidate);
+        firstSeen.set(candidate.nodeId, order++);
+      }
+    }
+  }
+  const out = [];
+  for (const [nodeId, rrfScore] of scores) {
+    const rep = representatives.get(nodeId);
+    out.push({ ...rep, rrfScore });
+  }
+  out.sort((a, b) => {
+    if (b.rrfScore !== a.rrfScore) return b.rrfScore - a.rrfScore;
+    return firstSeen.get(a.nodeId) - firstSeen.get(b.nodeId);
+  });
+  return out;
+}
+
+// ../lib/graph-search/src/query-expansion.ts
+var import_dist = __toESM(require_dist2());
+var CACHE_TTL_MS = 60 * 60 * 1e3;
+var HAIKU_MODEL2 = "claude-haiku-4-5";
+var MAX_PARAPHRASES = 5;
+var cache2 = /* @__PURE__ */ new Map();
+async function expandQuery(params) {
+  const { query, retrievalClass = "general", accountId = "", useCache = true } = params;
+  const normalised = query.trim().toLowerCase();
+  const cacheKey = `${accountId}::${retrievalClass}::${normalised}`;
+  if (useCache) {
+    const hit = cache2.get(cacheKey);
+    if (hit && hit.expiresAt > Date.now()) {
+      return [query, ...hit.expansions];
+    }
+  }
+  const systemPrompt = [
+    "You generate paraphrases of a user query for hybrid graph search.",
+    "Return 3-5 alternative phrasings that preserve the user's intent but vary the surface form (synonyms, word order, entity-vs-attribute framing).",
+    "Do not change the entity names. Do not invent constraints the user did not state.",
+    "Output ONLY a JSON object via the provided tool; never free text."
+  ].join("\n");
+  const classHint = retrievalClass === "general" ? "" : `The retrieval class is '${retrievalClass}' \u2014 tailor paraphrases accordingly.`;
+  const userMessage = [
+    `Original query: ${query}`,
+    classHint
+  ].filter((s) => s.length > 0).join("\n");
+  const result = await (0, import_dist.callOauthLlm)({
+    model: HAIKU_MODEL2,
+    system: systemPrompt,
+    userMessage,
+    maxTokens: 512,
+    timeoutMs: 15e3,
+    tools: [
+      {
+        name: "emit_paraphrases",
+        description: "Emit 3-5 paraphrases of the user query.",
+        input_schema: {
+          type: "object",
+          properties: {
+            paraphrases: {
+              type: "array",
+              items: { type: "string" },
+              minItems: 3,
+              maxItems: MAX_PARAPHRASES
+            }
+          },
+          required: ["paraphrases"]
+        }
+      }
+    ],
+    toolChoiceName: "emit_paraphrases"
+  });
+  if (result.kind !== "ok-tool") {
+    process.stderr.write(
+      `[graph-search:expansion-failed] cause=${result.kind === "fallback" ? result.cause : "unexpected"} query=${query.slice(0, 60).replace(/\s+/g, " ")}
+`
+    );
+    return [query];
+  }
+  const raw = result.input.paraphrases;
+  if (!Array.isArray(raw)) return [query];
+  const expansions = raw.filter((p) => typeof p === "string" && p.trim().length > 0).map((p) => p.trim()).slice(0, MAX_PARAPHRASES);
+  if (useCache) {
+    cache2.set(cacheKey, { expansions, expiresAt: Date.now() + CACHE_TTL_MS });
+  }
+  return [query, ...expansions];
+}
+
+// ../lib/graph-search/src/boosts.ts
+function applyCompiledTruthBoost(hits, weight = 0.15) {
+  if (weight < 0 || weight > 1) {
+    throw new Error(`applyCompiledTruthBoost: weight must be in [0,1], got ${weight}`);
+  }
+  return hits.map((hit) => {
+    const compiled = hit.properties["compiledTruth"];
+    if (compiled === null || compiled === void 0 || compiled === "") return hit;
+    return { ...hit, score: hit.score * (1 + weight) };
+  });
+}
+function applyBacklinkBoost(hits) {
+  return hits.map((hit) => {
+    const raw = hit.properties["backlinkCount"];
+    const count = typeof raw === "number" ? raw : Number(raw);
+    if (!Number.isFinite(count) || count <= 0) return hit;
+    const bump = Math.max(0.05, Math.min(0.25, 0.05 + 0.05 * Math.log10(count)));
+    return { ...hit, score: hit.score * (1 + bump) };
+  });
+}
+
+// ../lib/graph-search/src/dedup.ts
+import { createHash as createHash3 } from "crypto";
+var DEFAULT_LAYERS = [
+  "nodeId",
+  "slug",
+  "canonicalName",
+  "contentHash"
+];
+function readSlug(props) {
+  const slug = props["slug"];
+  return typeof slug === "string" && slug.length > 0 ? slug : null;
+}
+function readCanonicalName(props) {
+  const canonical = props["canonicalName"];
+  if (typeof canonical === "string" && canonical.length > 0) {
+    return canonical.toLowerCase();
+  }
+  const name = props["name"];
+  if (typeof name === "string" && name.length > 0) {
+    return name.toLowerCase();
+  }
+  return null;
+}
+function readContentHash(props) {
+  const compiled = props["compiledTruth"];
+  const content = props["content"];
+  const source = typeof compiled === "string" && compiled.length > 0 ? compiled : typeof content === "string" && content.length > 0 ? content : null;
+  if (source === null) return null;
+  return createHash3("sha256").update(source).digest("hex").slice(0, 16);
+}
+function dedup(hits, layers = DEFAULT_LAYERS) {
+  const sorted = [...hits].sort((a, b) => b.score - a.score);
+  const seen = /* @__PURE__ */ new Map();
+  for (const layer of layers) seen.set(layer, /* @__PURE__ */ new Set());
+  const out = [];
+  for (const hit of sorted) {
+    let collision = false;
+    const keys = [];
+    for (const layer of layers) {
+      let key;
+      switch (layer) {
+        case "nodeId":
+          key = hit.nodeId;
+          break;
+        case "slug":
+          key = readSlug(hit.properties);
+          break;
+        case "canonicalName":
+          key = readCanonicalName(hit.properties);
+          break;
+        case "contentHash":
+          key = readContentHash(hit.properties);
+          break;
+      }
+      if (key === null) continue;
+      if (seen.get(layer).has(key)) {
+        collision = true;
+        break;
+      }
+      keys.push([layer, key]);
+    }
+    if (collision) continue;
+    for (const [layer, key] of keys) seen.get(layer).add(key);
+    out.push(hit);
+  }
+  return out;
+}
+
+// ../lib/graph-search/src/route.ts
+function pickIndexMix(retrievalClass) {
+  switch (retrievalClass) {
+    case "entity":
+      return {
+        skip: false,
+        labelFilter: ["Person", "Company", "Concept"],
+        vectorWeight: 0.85,
+        bm25Weight: 0.15
+      };
+    case "temporal":
+      return {
+        skip: false,
+        labelFilter: ["Event"],
+        vectorWeight: 0.2,
+        bm25Weight: 0.8
+      };
+    case "event":
+      return {
+        skip: false,
+        labelFilter: ["Event"],
+        vectorWeight: 0,
+        bm25Weight: 1
+      };
+    case "none":
+      return { skip: true, vectorWeight: 0, bm25Weight: 0 };
+    case "general":
+    default:
+      if (retrievalClass && retrievalClass !== "general") {
+        process.stderr.write(
+          `[graph-search:unknown-class] rc=${retrievalClass} fallback=general
+`
+        );
+      }
+      return { skip: false, vectorWeight: 0.7, bm25Weight: 0.3 };
+  }
+}
+
+// ../lib/graph-search/src/index.ts
 var VECTOR_WEIGHT = 0.7;
 var BM25_WEIGHT = 0.3;
+function envFlag(name) {
+  const v = process.env[name];
+  return v === "1" || v === "true" || v === "yes";
+}
+function readFlags() {
+  return {
+    rrf: envFlag("MAXY_GS_RRF"),
+    expansion: envFlag("MAXY_GS_EXPANSION"),
+    boosts: envFlag("MAXY_GS_BOOSTS"),
+    dedup: envFlag("MAXY_GS_DEDUP"),
+    route: envFlag("MAXY_GS_ROUTE")
+  };
+}
 var FULLTEXT_INDEX_NAME = "entity_search";
 function escapeLucene(query) {
   return query.replace(/[+\-&|!(){}[\]^"~*?:\\/]/g, "\\$&");
@@ -9771,7 +10314,7 @@ async function bm25Only(session, params) {
        ${scopeClause}
        ${agentClause}
        ${labelClause}
-       AND ${(0, import_dist.notTrashed)("node")}
+       AND ${(0, import_dist2.notTrashed)("node")}
        ${kwClause}
        RETURN node, score, labels(node) AS nodeLabels, elementId(node) AS nodeId
        ORDER BY score DESC
@@ -9818,17 +10361,49 @@ async function hybrid(session, embed2, params) {
     agentSlug,
     keywordSubscriptions,
     expandHops = 1,
-    degradeOnEmbedFailure = false
+    degradeOnEmbedFailure = false,
+    retrievalClass,
+    dedupLayers = DEFAULT_LAYERS,
+    rrfK = 60
   } = params;
+  const envFlags = readFlags();
+  const useRoute = params.enableRoute ?? envFlags.route;
+  const useRrf = params.enableRrf ?? envFlags.rrf;
+  const useExpansion = params.enableExpansion ?? envFlags.expansion;
+  const useBoosts = params.enableBoosts ?? envFlags.boosts;
+  const useDedup = params.enableDedup ?? envFlags.dedup;
+  const plan = useRoute ? pickIndexMix(retrievalClass) : { skip: false, vectorWeight: VECTOR_WEIGHT, bm25Weight: BM25_WEIGHT, labelFilter: void 0 };
+  const emptyStageCounts = {
+    expansions: 1,
+    vector: 0,
+    bm25: 0,
+    fused: 0,
+    boosted: 0,
+    deduped: 0,
+    final: 0
+  };
+  if (plan.skip) {
+    return {
+      mode: useRrf ? "rrf" : "hybrid",
+      results: [],
+      expandMs: 0,
+      rawMerged: 0,
+      suppressed: 0,
+      bm25Bypass: 0,
+      threshold: params.vectorThreshold ?? null,
+      stageCounts: emptyStageCounts
+    };
+  }
+  const effectiveLabels = labels && labels.length > 0 ? labels : plan.labelFilter;
   let queryEmbedding;
   try {
     queryEmbedding = await embed2(query);
   } catch (err) {
     if (!degradeOnEmbedFailure) throw err;
     const msg = err instanceof Error ? err.message : String(err);
-    const bm25Hits2 = await bm25Only(session, params);
-    const normalised = normaliseBm25Scores(bm25Hits2.map((h) => h.score));
-    const results2 = bm25Hits2.map((h, i) => ({
+    const bm25Hits = await bm25Only(session, { ...params, labels: effectiveLabels });
+    const normalised = normaliseBm25Scores(bm25Hits.map((h) => h.score));
+    const results2 = bm25Hits.map((h, i) => ({
       ...h,
       vectorScore: 0,
       bm25Score: normalised[i] ?? 0,
@@ -9842,26 +10417,32 @@ async function hybrid(session, embed2, params) {
       rawMerged: results2.length,
       suppressed: 0,
       bm25Bypass: 0,
-      threshold: null
+      threshold: null,
+      stageCounts: {
+        expansions: 1,
+        vector: 0,
+        bm25: results2.length,
+        fused: results2.length,
+        boosted: results2.length,
+        deduped: results2.length,
+        final: results2.length
+      }
     };
   }
   const labelToIndex = await discoverIndexes(session);
-  const keywordFilter = buildKeywordFilter(keywords, keywordMatch);
-  const keywordClause = keywordFilter?.clause ?? "";
-  const keywordParams = keywordFilter?.params ?? {};
-  const scoreMap = /* @__PURE__ */ new Map();
   let indexesToQuery;
-  if (labels && labels.length > 0) {
-    indexesToQuery = labels.map((l) => labelToIndex.get(l)).filter((idx) => idx !== void 0);
+  if (effectiveLabels && effectiveLabels.length > 0) {
+    indexesToQuery = effectiveLabels.map((l) => labelToIndex.get(l)).filter((idx) => idx !== void 0);
     if (indexesToQuery.length === 0) {
       return {
-        mode: "hybrid",
+        mode: useRrf ? "rrf" : "hybrid",
         results: [],
         expandMs: 0,
         rawMerged: 0,
         suppressed: 0,
         bm25Bypass: 0,
-        threshold: params.vectorThreshold ?? null
+        threshold: params.vectorThreshold ?? null,
+        stageCounts: emptyStageCounts
       };
     }
   } else {
@@ -9871,56 +10452,162 @@ async function hybrid(session, embed2, params) {
   const scopeParams = allowedScopes ? { allowedScopes } : {};
   const agentClause = agentSlug ? "AND node.agents IS NOT NULL AND $agentSlug IN node.agents" : "";
   const agentParams = agentSlug ? { agentSlug } : {};
-  for (const indexName of indexesToQuery) {
-    const vectorResult = await session.run(
-      `CALL db.index.vector.queryNodes($indexName, $limit, $embedding)
-       YIELD node, score
+  const keywordFilter = buildKeywordFilter(keywords, keywordMatch);
+  const keywordClause = keywordFilter?.clause ?? "";
+  const keywordParams = keywordFilter?.params ?? {};
+  const expansions = useExpansion ? await expandQuery({ query, retrievalClass, accountId }) : [query];
+  const passes = await Promise.all(
+    expansions.map(async (qText, idx) => {
+      let pEmbed;
+      if (idx === 0) {
+        pEmbed = queryEmbedding;
+      } else {
+        try {
+          pEmbed = await embed2(qText);
+        } catch {
+          pEmbed = null;
+        }
+      }
+      const vectorRanked = [];
+      const vectorSeen = /* @__PURE__ */ new Map();
+      if (pEmbed) {
+        for (const indexName of indexesToQuery) {
+          const vectorResult = await session.run(
+            `CALL db.index.vector.queryNodes($indexName, $limit, $embedding)
+             YIELD node, score
+             WHERE node.accountId = $accountId
+             ${scopeClause}
+             ${agentClause}
+             AND ${(0, import_dist2.notTrashed)("node")}
+             ${keywordClause}
+             RETURN node, score, labels(node) AS nodeLabels, elementId(node) AS nodeId
+             ORDER BY score DESC
+             LIMIT $limit`,
+            {
+              indexName,
+              embedding: pEmbed,
+              limit: int(limit),
+              accountId,
+              ...scopeParams,
+              ...agentParams,
+              ...keywordParams
+            }
+          );
+          for (const record of vectorResult.records) {
+            const nodeId = record.get("nodeId");
+            const scoreRaw = record.get("score");
+            const score = typeof scoreRaw === "number" ? scoreRaw : Number(scoreRaw);
+            const existingIdx = vectorSeen.get(nodeId);
+            if (existingIdx !== void 0) {
+              const existing = vectorRanked[existingIdx];
+              if (score > existing.vectorScore) existing.vectorScore = score;
+              continue;
+            }
+            const node = record.get("node");
+            vectorSeen.set(nodeId, vectorRanked.length);
+            vectorRanked.push({
+              nodeId,
+              labels: record.get("nodeLabels"),
+              properties: plainProperties(node.properties),
+              vectorScore: score,
+              bm25Score: 0,
+              bm25Hit: false
+            });
+          }
+        }
+        vectorRanked.sort((a, b) => b.vectorScore - a.vectorScore);
+      }
+      const bm25Hits = await bm25Only(session, {
+        ...params,
+        query: qText,
+        labels: effectiveLabels
+      });
+      const bm25Norm = normaliseBm25Scores(bm25Hits.map((h) => h.score));
+      const bm25Ranked = bm25Hits.map((h, i) => ({
+        nodeId: h.nodeId,
+        labels: h.labels,
+        properties: h.properties,
+        vectorScore: 0,
+        bm25Score: bm25Norm[i] ?? 0,
+        bm25Hit: true
+      }));
+      return { queryText: qText, embedding: pEmbed, vectorRanked, bm25Ranked };
+    })
+  );
+  const scoreMap = /* @__PURE__ */ new Map();
+  let totalVector = 0;
+  let totalBm25 = 0;
+  for (const pass of passes) {
+    totalVector += pass.vectorRanked.length;
+    totalBm25 += pass.bm25Ranked.length;
+    for (const v of pass.vectorRanked) {
+      const existing = scoreMap.get(v.nodeId);
+      if (existing) {
+        existing.vectorScore = Math.max(existing.vectorScore, v.vectorScore);
+      } else {
+        scoreMap.set(v.nodeId, { ...v });
+      }
+    }
+    for (const b of pass.bm25Ranked) {
+      mergeBm25Hit(scoreMap, {
+        nodeId: b.nodeId,
+        labels: b.labels,
+        properties: b.properties,
+        score: b.bm25Score
+      }, b.bm25Score);
+    }
+  }
+  if (keywordSubscriptions && keywordSubscriptions.length > 0) {
+    for (const kw of keywordSubscriptions) {
+      const kwHits = await bm25Only(session, {
+        query: kw,
+        accountId,
+        limit,
+        allowedScopes
+      });
+      if (kwHits.length === 0) continue;
+      const rawScores = kwHits.map((h) => h.score);
+      const normalised = normaliseBm25Scores(rawScores);
+      for (let i = 0; i < kwHits.length; i++) {
+        mergeBm25Hit(scoreMap, kwHits[i], normalised[i]);
+      }
+    }
+    const propScopeClause = allowedScopes ? "AND (node.scope IS NULL OR node.scope IN $allowedScopes)" : "";
+    const propResult = await session.run(
+      `MATCH (node)
        WHERE node.accountId = $accountId
-       ${scopeClause}
-       ${agentClause}
-       AND ${(0, import_dist.notTrashed)("node")}
-       ${keywordClause}
-       RETURN node, score, labels(node) AS nodeLabels, elementId(node) AS nodeId
-       ORDER BY score DESC
+       AND ${(0, import_dist2.notTrashed)("node")}
+       AND node.keywords IS NOT NULL
+       AND ANY(kw IN $kwSubs WHERE ANY(nk IN node.keywords WHERE toLower(nk) = kw))
+       ${propScopeClause}
+       RETURN node, labels(node) AS nodeLabels, elementId(node) AS nodeId
        LIMIT $limit`,
       {
-        indexName,
-        embedding: queryEmbedding,
-        limit: int(limit),
         accountId,
-        ...scopeParams,
-        ...agentParams,
-        ...keywordParams
+        kwSubs: keywordSubscriptions,
+        limit: int(limit),
+        ...allowedScopes ? { allowedScopes } : {}
       }
     );
-    for (const record of vectorResult.records) {
+    for (const record of propResult.records) {
       const nodeId = record.get("nodeId");
-      const scoreRaw = record.get("score");
-      const score = typeof scoreRaw === "number" ? scoreRaw : Number(scoreRaw);
       const existing = scoreMap.get(nodeId);
       if (existing) {
-        existing.vectorScore = Math.max(existing.vectorScore, score);
+        existing.bm25Score = Math.max(existing.bm25Score, 1);
+        existing.bm25Hit = true;
       } else {
         const node = record.get("node");
         scoreMap.set(nodeId, {
           nodeId,
           labels: record.get("nodeLabels"),
           properties: plainProperties(node.properties),
-          vectorScore: score,
-          bm25Score: 0,
-          bm25Hit: false
+          vectorScore: 0,
+          bm25Score: 1,
+          bm25Hit: true
         });
       }
     }
   }
-  const bm25Hits = await bm25Only(session, params);
-  if (bm25Hits.length > 0) {
-    const rawScores = bm25Hits.map((h) => h.score);
-    const normalised = normaliseBm25Scores(rawScores);
-    for (let i = 0; i < bm25Hits.length; i++) {
-      mergeBm25Hit(scoreMap, bm25Hits[i], normalised[i]);
-    }
-  }
   if (keywordSubscriptions && keywordSubscriptions.length > 0) {
     for (const kw of keywordSubscriptions) {
       const kwHits = await bm25Only(session, {
@@ -9940,7 +10627,7 @@ async function hybrid(session, embed2, params) {
     const propResult = await session.run(
       `MATCH (node)
        WHERE node.accountId = $accountId
-       AND ${(0, import_dist.notTrashed)("node")}
+       AND ${(0, import_dist2.notTrashed)("node")}
        AND node.keywords IS NOT NULL
        AND ANY(kw IN $kwSubs WHERE ANY(nk IN node.keywords WHERE toLower(nk) = kw))
        ${propScopeClause}
@@ -9972,10 +10659,41 @@ async function hybrid(session, embed2, params) {
       }
     }
   }
-  const allMerged = [...scoreMap.values()].map((node) => ({
-    ...node,
-    combinedScore: VECTOR_WEIGHT * node.vectorScore + BM25_WEIGHT * node.bm25Score
-  }));
+  let allMerged;
+  if (useRrf) {
+    const rankedLists = [];
+    for (const pass of passes) {
+      if (pass.vectorRanked.length > 0) rankedLists.push(pass.vectorRanked);
+      if (pass.bm25Ranked.length > 0) rankedLists.push(pass.bm25Ranked);
+    }
+    const fused = fuseRrf(rankedLists, rrfK);
+    allMerged = fused.map((f) => {
+      const rep = scoreMap.get(f.nodeId) ?? f;
+      return { ...rep, combinedScore: f.rrfScore };
+    });
+  } else {
+    allMerged = [...scoreMap.values()].map((node) => ({
+      ...node,
+      combinedScore: plan.vectorWeight * node.vectorScore + plan.bm25Weight * node.bm25Score
+    }));
+  }
+  const fusedCount = allMerged.length;
+  if (useBoosts) {
+    allMerged = applyCompiledTruthBoost(
+      applyBacklinkBoost(allMerged.map((m) => ({
+        ...m,
+        score: m.combinedScore
+      })))
+    ).map((m) => ({ ...m, combinedScore: m.score }));
+  }
+  const boostedCount = allMerged.length;
+  if (useDedup) {
+    allMerged = dedup(
+      allMerged.map((m) => ({ ...m, score: m.combinedScore })),
+      dedupLayers
+    ).map((m) => ({ ...m, combinedScore: m.score }));
+  }
+  const dedupedCount = allMerged.length;
   const rawMerged = allMerged.length;
   const threshold = params.vectorThreshold;
   let kept = allMerged;
@@ -10016,7 +10734,7 @@ async function hybrid(session, embed2, params) {
       `UNWIND $nodeIds AS nid
        MATCH (n)-[r]-(related)
        WHERE elementId(n) = nid
-       AND ${(0, import_dist.notTrashed)("related")}
+       AND ${(0, import_dist2.notTrashed)("related")}
        ${expandScopeClause}
        ${expandAgentClause}
        WITH nid, n, r, related
@@ -10049,13 +10767,22 @@ async function hybrid(session, embed2, params) {
     }
   }
   return {
-    mode: "hybrid",
+    mode: useRrf ? "rrf" : "hybrid",
     results,
     expandMs,
     rawMerged,
     suppressed,
     bm25Bypass,
-    threshold: threshold ?? null
+    threshold: threshold ?? null,
+    stageCounts: {
+      expansions: expansions.length,
+      vector: totalVector,
+      bm25: totalBm25,
+      fused: fusedCount,
+      boosted: boostedCount,
+      deduped: dedupedCount,
+      final: results.length
+    }
   };
 }
 function mergeBm25Hit(map, hit, normalisedScore) {
@@ -10231,8 +10958,8 @@ var graph_search_default = app19;
 import neo4j from "neo4j-driver";
 
 // app/lib/graph-labels.ts
-var import_dist2 = __toESM(require_dist2(), 1);
-var import_dist3 = __toESM(require_dist2(), 1);
+var import_dist3 = __toESM(require_dist3(), 1);
+var import_dist4 = __toESM(require_dist3(), 1);
 var HIDDEN_BY_DEFAULT_LABELS = Object.freeze(
   /* @__PURE__ */ new Set(["Chunk", "GraphPreference"])
 );
@@ -10288,7 +11015,7 @@ var EXCLUDED_EDGE_TYPES = Object.freeze(
   ])
 );
 function isKnownLabel(label) {
-  return Object.prototype.hasOwnProperty.call(import_dist3.GRAPH_LABEL_COLOURS, label);
+  return Object.prototype.hasOwnProperty.call(import_dist4.GRAPH_LABEL_COLOURS, label);
 }
 function isHiddenByDefault(label) {
   return HIDDEN_BY_DEFAULT_LABELS.has(label);
@@ -13096,7 +13823,7 @@ function broadcastAdminShutdown(reason) {
 }
 
 // ../lib/entitlement/src/index.ts
-import { createPublicKey, createHash as createHash3, verify as cryptoVerify } from "crypto";
+import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
 import { existsSync as existsSync23, readFileSync as readFileSync20, statSync as statSync8 } from "fs";
 import { resolve as resolve20 } from "path";
 
@@ -13167,7 +13894,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
       reason: "pubkey-missing"
     });
   }
-  const pubkeyHash = createHash3("sha256").update(pubkeyPem).digest("hex");
+  const pubkeyHash = createHash4("sha256").update(pubkeyPem).digest("hex");
   if (pubkeyHash !== PUBKEY_SHA256) {
     return logResolved(anonymousFallback("pubkey-tamper"), {
       reason: "pubkey-tamper"