@vohongtho.infotech/code-intel 0.9.0 → 1.0.0

package/dist/index.js

@@ -1,8 +1,3 @@
-import { createRequire } from 'module';
-import { fileURLToPath } from 'url';
-import path31 from 'path';
-import fs24, { existsSync } from 'fs';
-import { Parser, Language, Query } from 'web-tree-sitter';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
@@ -11,9 +6,14 @@ import { SEMRESATTRS_DEPLOYMENT_ENVIRONMENT, SEMRESATTRS_SERVICE_NAME } from '@o
 import { trace, context, SpanStatusCode } from '@opentelemetry/api';
 import winston from 'winston';
 import DailyRotateFile from 'winston-daily-rotate-file';
+import fs25, { existsSync } from 'fs';
+import path32 from 'path';
 import os13 from 'os';
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import { Parser, Language, Query } from 'web-tree-sitter';
 import { execSync } from 'child_process';
-import Database3 from 'better-sqlite3';
+import Database2 from 'better-sqlite3';
 import bcrypt from 'bcrypt';
 import crypto5 from 'crypto';
 import { v4 } from 'uuid';
@@ -68,220 +68,553 @@ var init_id_generator = __esm({
   }
 });
 
-// src/shared/languages.ts
-var init_languages = __esm({
-  "src/shared/languages.ts"() {
-  }
+// src/observability/tracing.ts
+var tracing_exports = {};
+__export(tracing_exports, {
+  SpanStatusCode: () => SpanStatusCode,
+  context: () => context,
+  getActiveTraceContext: () => getActiveTraceContext,
+  getTracer: () => getTracer,
+  initTracing: () => initTracing,
+  isTracingEnabled: () => isTracingEnabled,
+  sanitizeAttrs: () => sanitizeAttrs,
+  shutdownTracing: () => shutdownTracing,
+  trace: () => trace,
+  withSpan: () => withSpan
 });
-
-// src/shared/detection.ts
-function detectLanguage(filePath) {
-  const ext = filePath.slice(filePath.lastIndexOf("."));
-  return EXTENSION_MAP[ext] ?? null;
+function isTracingEnabled() {
+  return process.env["CODE_INTEL_OTEL_ENABLED"] === "true";
 }
-function getSupportedExtensions() {
-  return Object.keys(EXTENSION_MAP);
+function initTracing() {
+  if (!isTracingEnabled()) return;
+  if (_sdk) return;
+  const endpoint = process.env["CODE_INTEL_OTEL_ENDPOINT"] ?? "http://localhost:4318";
+  const serviceName = process.env["CODE_INTEL_OTEL_SERVICE"] ?? "code-intel";
+  const deploymentEnv = process.env["CODE_INTEL_OTEL_ENV"] ?? process.env["NODE_ENV"] ?? "development";
+  const exporter = new OTLPTraceExporter({ url: `${endpoint}/v1/traces` });
+  _sdk = new NodeSDK({
+    resource: resourceFromAttributes({
+      [SEMRESATTRS_SERVICE_NAME]: serviceName,
+      [SEMRESATTRS_DEPLOYMENT_ENVIRONMENT]: deploymentEnv
+    }),
+    traceExporter: exporter,
+    instrumentations: [
+      getNodeAutoInstrumentations({
+        // Disable noisy file-system instrumentation
+        "@opentelemetry/instrumentation-fs": { enabled: false }
+      })
+    ]
+  });
+  _sdk.start();
 }
-var EXTENSION_MAP;
-var init_detection = __esm({
-  "src/shared/detection.ts"() {
-    init_languages();
-    EXTENSION_MAP = {
-      ".ts": "typescript" /* TypeScript */,
-      ".tsx": "typescript" /* TypeScript */,
-      ".mts": "typescript" /* TypeScript */,
-      ".cts": "typescript" /* TypeScript */,
-      ".js": "javascript" /* JavaScript */,
-      ".jsx": "javascript" /* JavaScript */,
-      ".mjs": "javascript" /* JavaScript */,
-      ".cjs": "javascript" /* JavaScript */,
-      ".py": "python" /* Python */,
-      ".pyi": "python" /* Python */,
-      ".java": "java" /* Java */,
-      ".go": "go" /* Go */,
-      ".c": "c" /* C */,
-      ".h": "c" /* C */,
-      ".cpp": "cpp" /* Cpp */,
-      ".cxx": "cpp" /* Cpp */,
-      ".cc": "cpp" /* Cpp */,
-      ".hpp": "cpp" /* Cpp */,
-      ".hxx": "cpp" /* Cpp */,
-      ".cs": "csharp" /* CSharp */,
-      ".rs": "rust" /* Rust */,
-      ".php": "php" /* PHP */,
-      ".kt": "kotlin" /* Kotlin */,
-      ".kts": "kotlin" /* Kotlin */,
-      ".rb": "ruby" /* Ruby */,
-      ".swift": "swift" /* Swift */,
-      ".dart": "dart" /* Dart */
-    };
-  }
-});
-
-// src/shared/index.ts
-var init_shared = __esm({
-  "src/shared/index.ts"() {
-    init_languages();
-    init_detection();
-  }
-});
-function findBundledWasmDir() {
-  const fileDir = path31.dirname(fileURLToPath(import.meta.url));
-  const candidates = [
-    path31.join(fileDir, "wasm"),
-    // dist/index.js → dist/wasm/
-    path31.join(fileDir, "../wasm")
-    // dist/cli/main.js → dist/wasm/
-  ];
-  for (const candidate of candidates) {
-    if (existsSync(candidate)) return candidate;
+async function shutdownTracing() {
+  if (_sdk) {
+    await _sdk.shutdown();
+    _sdk = null;
   }
-  return candidates[0];
 }
-function wasmPath(lang) {
-  const WASM_PACKAGE_MAP = {
-    ["typescript" /* TypeScript */]: "tree-sitter-typescript/tree-sitter-typescript.wasm",
-    ["javascript" /* JavaScript */]: "tree-sitter-javascript/tree-sitter-javascript.wasm",
-    ["python" /* Python */]: "tree-sitter-python/tree-sitter-python.wasm",
-    ["java" /* Java */]: "tree-sitter-java/tree-sitter-java.wasm",
-    ["go" /* Go */]: "tree-sitter-go/tree-sitter-go.wasm",
-    ["c" /* C */]: "tree-sitter-c/tree-sitter-c.wasm",
-    ["cpp" /* Cpp */]: "tree-sitter-cpp/tree-sitter-cpp.wasm",
-    ["csharp" /* CSharp */]: "tree-sitter-c-sharp/tree-sitter-c_sharp.wasm",
-    ["rust" /* Rust */]: "tree-sitter-rust/tree-sitter-rust.wasm",
-    ["php" /* PHP */]: "tree-sitter-php/tree-sitter-php.wasm",
-    ["ruby" /* Ruby */]: "tree-sitter-ruby/tree-sitter-ruby.wasm",
-    // These are optional dependencies; their packages may or may not include
-    // a WASM.  If require.resolve fails we fall back to the bundled wasm/.
-    ["swift" /* Swift */]: "tree-sitter-swift/tree-sitter-swift.wasm",
-    ["kotlin" /* Kotlin */]: "tree-sitter-kotlin/tree-sitter-kotlin.wasm",
-    ["dart" /* Dart */]: "tree-sitter-dart/tree-sitter-dart.wasm"
-  };
-  const BUNDLED_WASM_MAP = {
-    ["swift" /* Swift */]: "tree-sitter-swift.wasm",
-    ["kotlin" /* Kotlin */]: "tree-sitter-kotlin.wasm",
-    ["dart" /* Dart */]: "tree-sitter-dart.wasm"
-  };
-  const relative = WASM_PACKAGE_MAP[lang];
-  if (relative) {
+function getTracer() {
+  return trace.getTracer(TRACER_NAME);
+}
+async function withSpan(name, attrs, fn) {
+  return getTracer().startActiveSpan(name, { attributes: sanitizeAttrs(attrs) }, async (span) => {
     try {
-      return _require.resolve(relative);
-    } catch {
+      const result = await fn(span);
+      span.setStatus({ code: SpanStatusCode.OK });
+      return result;
+    } catch (err) {
+      span.setStatus({
+        code: SpanStatusCode.ERROR,
+        message: err instanceof Error ? err.message : String(err)
+      });
+      span.recordException(err);
+      throw err;
+    } finally {
+      span.end();
     }
-  }
-  const bundled = BUNDLED_WASM_MAP[lang];
-  if (bundled) {
-    const bundledPath = path31.join(_bundledWasmDir, bundled);
-    if (existsSync(bundledPath)) return bundledPath;
-  }
-  return null;
-}
-async function initParser() {
-  if (!initPromise) {
-    initPromise = Parser.init();
-  }
-  return initPromise;
-}
-async function getLanguage(lang) {
-  if (languageCache.has(lang)) return languageCache.get(lang);
-  const path32 = wasmPath(lang);
-  if (!path32) {
-    languageCache.set(lang, null);
-    return null;
-  }
-  try {
-    await initParser();
-    const language = await Language.load(path32);
-    languageCache.set(lang, language);
-    return language;
-  } catch {
-    languageCache.set(lang, null);
-    return null;
-  }
+  });
 }
-async function getParser(lang) {
-  const language = await getLanguage(lang);
-  if (!language) return null;
-  let parser = parserCache.get(lang);
-  if (!parser) {
-    parser = new Parser();
-    parserCache.set(lang, parser);
+function sanitizeAttrs(attrs) {
+  const safe = {};
+  for (const [k, v] of Object.entries(attrs)) {
+    if (BLOCKED_ATTR_KEYS.test(k)) continue;
+    safe[k] = v;
   }
-  parser.setLanguage(language);
-  return parser;
-}
-async function parseSource(lang, source) {
-  const parser = await getParser(lang);
-  if (!parser) return null;
-  return parser.parse(source);
+  return safe;
 }
-async function isTreeSitterAvailable(lang) {
-  return await getLanguage(lang) !== null;
+function getActiveTraceContext() {
+  const span = trace.getActiveSpan();
+  if (!span) return { traceId: "", spanId: "" };
+  const ctx = span.spanContext();
+  return { traceId: ctx.traceId, spanId: ctx.spanId };
 }
-var _require, _bundledWasmDir, initPromise, languageCache, parserCache;
-var init_parser_manager = __esm({
-  "src/parsing/parser-manager.ts"() {
-    init_shared();
-    _require = createRequire(import.meta.url);
-    _bundledWasmDir = findBundledWasmDir();
-    initPromise = null;
-    languageCache = /* @__PURE__ */ new Map();
-    parserCache = /* @__PURE__ */ new Map();
+var _sdk, TRACER_NAME, BLOCKED_ATTR_KEYS;
+var init_tracing = __esm({
+  "src/observability/tracing.ts"() {
+    _sdk = null;
+    TRACER_NAME = "code-intel";
+    BLOCKED_ATTR_KEYS = /secret|password|token|key|auth|credential/i;
   }
 });
-function getOrCompileQuery(language, querySource) {
-  let langMap = _queryCache.get(language);
-  if (!langMap) {
-    langMap = /* @__PURE__ */ new Map();
-    _queryCache.set(language, langMap);
-  }
-  let q = langMap.get(querySource);
-  if (!q) {
-    q = new Query(language, querySource);
-    langMap.set(querySource, q);
-  }
-  return q;
+function getActiveTraceCtx() {
+  if (_getTraceCtx === "pending") return { traceId: "", spanId: "" };
+  if (_getTraceCtx) return _getTraceCtx();
+  _getTraceCtx = "pending";
+  Promise.resolve().then(() => (init_tracing(), tracing_exports)).then((mod) => {
+    _getTraceCtx = mod.getActiveTraceContext;
+  }).catch(() => {
+    _getTraceCtx = null;
+  });
+  return { traceId: "", spanId: "" };
 }
-function runQuery(tree, language, querySource) {
-  const query = getOrCompileQuery(language, querySource);
-  const matches = query.matches(tree.rootNode);
-  const captures = [];
-  for (const match of matches) {
-    for (const capture of match.captures) {
-      captures.push({
-        name: capture.name,
-        node: capture.node,
-        text: capture.node.text
-      });
-    }
+var _getTraceCtx, SENSITIVE_KEYS, SENSITIVE_PATTERNS, SENSITIVE_KEYS_REGEX, Logger, logger_default;
+var init_logger = __esm({
+  "src/shared/logger.ts"() {
+    _getTraceCtx = null;
+    SENSITIVE_KEYS = [
+      "password",
+      "passwd",
+      "pass",
+      "pwd",
+      "secret",
+      "secretkey",
+      "secret_key",
+      "secretaccesskey",
+      "accesskeyid",
+      "credentials",
+      "auth",
+      "authentication",
+      "login",
+      "api_key",
+      "apikey",
+      "api",
+      "access_key",
+      "access_token",
+      "accesskey",
+      "auth_key",
+      "auth_token",
+      "authkey",
+      "token",
+      "jwt",
+      "bearer_token",
+      "refresh_token",
+      "session_token",
+      "session_key",
+      "oauth_token",
+      "connection_string",
+      "conn_string",
+      "db_uri",
+      "db_url",
+      "database_url",
+      "mongodb_uri",
+      "mysql_uri",
+      "postgres_uri",
+      "sql_uri",
+      "db_username",
+      "db_password",
+      "db_host",
+      "db_port",
+      "db_name",
+      "encryption_key",
+      "crypto_key",
+      "private_key",
+      "public_key",
+      "ssl_key",
+      "ssh_key",
+      "pgp_key",
+      "rsa_key",
+      "aes_key",
+      "email",
+      "phone",
+      "telephone",
+      "mobile",
+      "ssn",
+      "social_security",
+      "credit_card",
+      "cc_number",
+      "card_number",
+      "cvv",
+      "expiry_date",
+      "birth_date",
+      "dob",
+      "address",
+      "zip_code",
+      "postal_code",
+      "bank_account",
+      "iban",
+      "swift_code",
+      "routing_number",
+      "tax_id",
+      "vat_number",
+      "financial_id",
+      "certificate",
+      "client_cert",
+      "server_cert",
+      "ca_cert",
+      "aws_key",
+      "aws_secret",
+      "azure_key",
+      "gcp_key",
+      "s3_key",
+      "cloudinary_key",
+      "stripe_key",
+      "paypal_key",
+      "twilio_key",
+      "app_secret",
+      "client_secret",
+      "consumer_secret",
+      "encryption_secret",
+      "master_key",
+      "root_password",
+      "admin_password",
+      "config_secret",
+      "env_secret",
+      "deploy_key",
+      "ci_key",
+      "session_id",
+      "cookie_secret",
+      "csrf_token",
+      "xsrf_token",
+      "license_key",
+      "product_key",
+      "serial_number",
+      "activation_code"
+    ];
+    SENSITIVE_PATTERNS = [
+      /(?:password|passwd|secret|api_key|access_token|auth_token|token)\s*[:=]\s*([^\s,]+)/gi,
+      /\b\d{16}\b/gi,
+      /\b\d{3}-\d{2}-\d{4}\b/gi,
+      /\b[A-Za-z0-9]{32}\b/gi,
+      /\b[A-Za-z0-9_-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b/gi,
+      /\b\d{10}\b/gi,
+      /\b[A-Za-z0-9]{64}\b/gi,
+      /(?:connection_string|db_uri|db_url|mongodb_uri)\s*[:=]\s*([^\s,]+)/gi,
+      /(?:apikey|api_key|auth_key)\s*[:=]\s*([^\s,]+)/gi,
+      /(?:bearer\s+)([a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+)/gi
+    ];
+    SENSITIVE_KEYS_REGEX = new RegExp(`^(${SENSITIVE_KEYS.join("|")})$`, "i");
+    Logger = class _Logger {
+      static instance = null;
+      static maskSensitiveData(value) {
+        if (typeof value === "string" && value.length > 5) {
+          const firstChar = value.at(0);
+          const lastChar = value.at(-1);
+          return firstChar + "*".repeat(value.length - 2) + lastChar;
+        }
+        return value;
+      }
+      static maskSensitive(message, args = []) {
+        const maskString = (input) => {
+          if (typeof input !== "string") return input;
+          return SENSITIVE_PATTERNS.reduce((str, pattern) => {
+            return str.replace(
+              pattern,
+              (match, value) => value ? match.replace(value, _Logger.maskSensitiveData(value)) : match
+            );
+          }, input);
+        };
+        const deepMask = (obj) => {
+          if (typeof obj === "string") return maskString(obj);
+          if (Array.isArray(obj)) return obj.map((item) => deepMask(item));
+          if (typeof obj === "object" && obj !== null) {
+            return Object.entries(obj).reduce(
+              (acc, [key, value]) => {
+                if (value === void 0) return acc;
+                const isSensitiveKey = SENSITIVE_KEYS_REGEX.test(key);
+                acc[key] = isSensitiveKey && typeof value === "string" ? _Logger.maskSensitiveData(value) : deepMask(value);
+                return acc;
+              },
+              {}
+            );
+          }
+          return obj;
+        };
+        return {
+          maskedMessage: maskString(message),
+          maskedArgs: args.map((arg) => deepMask(arg))
+        };
+      }
+      /** Global log directory: ~/.code-intel/logs */
+      static LOG_DIR = path32.join(os13.homedir(), ".code-intel", "logs");
+      static getLogger() {
+        if (!_Logger.instance) {
+          const isProduction = process.env.NODE_ENV === "production";
+          const logLevel = process.env.LOG_LEVEL ?? "info";
+          const transports = [];
+          transports.push(new winston.transports.Console());
+          if (!isProduction) {
+            try {
+              if (!fs25.existsSync(_Logger.LOG_DIR)) {
+                fs25.mkdirSync(_Logger.LOG_DIR, { recursive: true });
+              }
+              transports.push(
+                new DailyRotateFile({
+                  filename: path32.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
+                  datePattern: "YYYY-MM-DD",
+                  maxSize: "20m",
+                  maxFiles: "14d"
+                })
+              );
+            } catch {
+            }
+          }
+          _Logger.instance = winston.createLogger({
+            level: logLevel,
+            format: winston.format.combine(
+              winston.format.timestamp(),
+              winston.format.printf(({ timestamp, level, message, ...meta }) => {
+                const args = meta[/* @__PURE__ */ Symbol.for("splat")] || [];
+                const { maskedMessage, maskedArgs } = _Logger.maskSensitive(message, args);
+                const formattedArgs = maskedArgs.map(
+                  (arg) => typeof arg === "object" ? JSON.stringify(arg) : String(arg)
+                );
+                const suffix = formattedArgs.length ? " " + formattedArgs.join(" ") : "";
+                let traceCtx = "";
+                try {
+                  const { traceId, spanId } = getActiveTraceCtx();
+                  if (traceId) traceCtx = ` [trace=${traceId} span=${spanId}]`;
+                } catch {
+                }
+                return `${timestamp} [${level.toUpperCase()}]${traceCtx}: ${maskedMessage}${suffix}`;
+              })
+            ),
+            transports
+          });
+        }
+        return _Logger.instance;
+      }
+      static info(message, ...args) {
+        _Logger.getLogger().info(message, ...args);
+      }
+      static warn(message, ...args) {
+        _Logger.getLogger().warn(message, ...args);
+      }
+      static error(message, ...args) {
+        _Logger.getLogger().error(message, ...args);
+      }
+      static debug(message, ...args) {
+        _Logger.getLogger().debug(message, ...args);
+      }
+    };
+    logger_default = Logger;
+    Logger.getLogger();
   }
-  return captures;
-}
-function runQueryMatches(tree, language, querySource) {
-  const query = getOrCompileQuery(language, querySource);
-  const raw = query.matches(tree.rootNode);
-  return raw.map((m) => ({
-    patternIndex: m.patternIndex,
-    captures: m.captures.map((c) => ({
-      name: c.name,
-      node: c.node,
-      text: c.node.text
-    }))
-  }));
-}
-var _queryCache;
-var init_query_runner = __esm({
-  "src/parsing/query-runner.ts"() {
-    _queryCache = /* @__PURE__ */ new WeakMap();
+});
+
+// src/shared/languages.ts
+var init_languages = __esm({
+  "src/shared/languages.ts"() {
   }
 });
 
-// src/parsing/queries/typescript.ts
-var typescriptQueries;
-var init_typescript = __esm({
-  "src/parsing/queries/typescript.ts"() {
-    typescriptQueries = `
-;; Class declaration
+// src/shared/detection.ts
+function detectLanguage(filePath) {
+  const ext = filePath.slice(filePath.lastIndexOf("."));
+  return EXTENSION_MAP[ext] ?? null;
+}
+function getSupportedExtensions() {
+  return Object.keys(EXTENSION_MAP);
+}
+var EXTENSION_MAP;
+var init_detection = __esm({
+  "src/shared/detection.ts"() {
+    init_languages();
+    EXTENSION_MAP = {
+      ".ts": "typescript" /* TypeScript */,
+      ".tsx": "typescript" /* TypeScript */,
+      ".mts": "typescript" /* TypeScript */,
+      ".cts": "typescript" /* TypeScript */,
+      ".js": "javascript" /* JavaScript */,
+      ".jsx": "javascript" /* JavaScript */,
+      ".mjs": "javascript" /* JavaScript */,
+      ".cjs": "javascript" /* JavaScript */,
+      ".py": "python" /* Python */,
+      ".pyi": "python" /* Python */,
+      ".java": "java" /* Java */,
+      ".go": "go" /* Go */,
+      ".c": "c" /* C */,
+      ".h": "c" /* C */,
+      ".cpp": "cpp" /* Cpp */,
+      ".cxx": "cpp" /* Cpp */,
+      ".cc": "cpp" /* Cpp */,
+      ".hpp": "cpp" /* Cpp */,
+      ".hxx": "cpp" /* Cpp */,
+      ".cs": "csharp" /* CSharp */,
+      ".rs": "rust" /* Rust */,
+      ".php": "php" /* PHP */,
+      ".kt": "kotlin" /* Kotlin */,
+      ".kts": "kotlin" /* Kotlin */,
+      ".rb": "ruby" /* Ruby */,
+      ".swift": "swift" /* Swift */,
+      ".dart": "dart" /* Dart */
+    };
+  }
+});
+
+// src/shared/index.ts
+var init_shared = __esm({
+  "src/shared/index.ts"() {
+    init_languages();
+    init_detection();
+  }
+});
+function findBundledWasmDir() {
+  const fileDir = path32.dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    path32.join(fileDir, "wasm"),
+    // dist/index.js → dist/wasm/
+    path32.join(fileDir, "../wasm")
+    // dist/cli/main.js → dist/wasm/
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return candidates[0];
+}
+function wasmPath(lang) {
+  const WASM_PACKAGE_MAP = {
+    ["typescript" /* TypeScript */]: "tree-sitter-typescript/tree-sitter-typescript.wasm",
+    ["javascript" /* JavaScript */]: "tree-sitter-javascript/tree-sitter-javascript.wasm",
+    ["python" /* Python */]: "tree-sitter-python/tree-sitter-python.wasm",
+    ["java" /* Java */]: "tree-sitter-java/tree-sitter-java.wasm",
+    ["go" /* Go */]: "tree-sitter-go/tree-sitter-go.wasm",
+    ["c" /* C */]: "tree-sitter-c/tree-sitter-c.wasm",
+    ["cpp" /* Cpp */]: "tree-sitter-cpp/tree-sitter-cpp.wasm",
+    ["csharp" /* CSharp */]: "tree-sitter-c-sharp/tree-sitter-c_sharp.wasm",
+    ["rust" /* Rust */]: "tree-sitter-rust/tree-sitter-rust.wasm",
+    ["php" /* PHP */]: "tree-sitter-php/tree-sitter-php.wasm",
+    ["ruby" /* Ruby */]: "tree-sitter-ruby/tree-sitter-ruby.wasm",
+    // These are optional dependencies; their packages may or may not include
+    // a WASM.  If require.resolve fails we fall back to the bundled wasm/.
+    ["swift" /* Swift */]: "tree-sitter-swift/tree-sitter-swift.wasm",
+    ["kotlin" /* Kotlin */]: "tree-sitter-kotlin/tree-sitter-kotlin.wasm",
+    ["dart" /* Dart */]: "tree-sitter-dart/tree-sitter-dart.wasm"
+  };
+  const BUNDLED_WASM_MAP = {
+    ["swift" /* Swift */]: "tree-sitter-swift.wasm",
+    ["kotlin" /* Kotlin */]: "tree-sitter-kotlin.wasm",
+    ["dart" /* Dart */]: "tree-sitter-dart.wasm"
+  };
+  const relative = WASM_PACKAGE_MAP[lang];
+  if (relative) {
+    try {
+      return _require.resolve(relative);
+    } catch {
+    }
+  }
+  const bundled = BUNDLED_WASM_MAP[lang];
+  if (bundled) {
+    const bundledPath = path32.join(_bundledWasmDir, bundled);
+    if (existsSync(bundledPath)) return bundledPath;
+  }
+  return null;
+}
+async function initParser() {
+  if (!initPromise) {
+    initPromise = Parser.init();
+  }
+  return initPromise;
+}
+async function getLanguage(lang) {
+  if (languageCache.has(lang)) return languageCache.get(lang);
+  const path33 = wasmPath(lang);
+  if (!path33) {
+    languageCache.set(lang, null);
+    return null;
+  }
+  try {
+    await initParser();
+    const language = await Language.load(path33);
+    languageCache.set(lang, language);
+    return language;
+  } catch {
+    languageCache.set(lang, null);
+    return null;
+  }
+}
+async function getParser(lang) {
+  const language = await getLanguage(lang);
+  if (!language) return null;
+  let parser = parserCache.get(lang);
+  if (!parser) {
+    parser = new Parser();
+    parserCache.set(lang, parser);
+  }
+  parser.setLanguage(language);
+  return parser;
+}
+async function parseSource(lang, source) {
+  const parser = await getParser(lang);
+  if (!parser) return null;
+  return parser.parse(source);
+}
+async function isTreeSitterAvailable(lang) {
+  return await getLanguage(lang) !== null;
+}
+var _require, _bundledWasmDir, initPromise, languageCache, parserCache;
+var init_parser_manager = __esm({
+  "src/parsing/parser-manager.ts"() {
+    init_shared();
+    _require = createRequire(import.meta.url);
+    _bundledWasmDir = findBundledWasmDir();
+    initPromise = null;
+    languageCache = /* @__PURE__ */ new Map();
+    parserCache = /* @__PURE__ */ new Map();
+  }
+});
+function getOrCompileQuery(language, querySource) {
+  let langMap = _queryCache.get(language);
+  if (!langMap) {
+    langMap = /* @__PURE__ */ new Map();
+    _queryCache.set(language, langMap);
+  }
+  let q = langMap.get(querySource);
+  if (!q) {
+    q = new Query(language, querySource);
+    langMap.set(querySource, q);
+  }
+  return q;
+}
+function runQuery(tree, language, querySource) {
+  const query = getOrCompileQuery(language, querySource);
+  const matches = query.matches(tree.rootNode);
+  const captures = [];
+  for (const match of matches) {
+    for (const capture of match.captures) {
+      captures.push({
+        name: capture.name,
+        node: capture.node,
+        text: capture.node.text
+      });
+    }
+  }
+  return captures;
+}
+function runQueryMatches(tree, language, querySource) {
+  const query = getOrCompileQuery(language, querySource);
+  const raw = query.matches(tree.rootNode);
+  return raw.map((m) => ({
+    patternIndex: m.patternIndex,
+    captures: m.captures.map((c) => ({
+      name: c.name,
+      node: c.node,
+      text: c.node.text
+    }))
+  }));
+}
+var _queryCache;
+var init_query_runner = __esm({
+  "src/parsing/query-runner.ts"() {
+    _queryCache = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// src/parsing/queries/typescript.ts
+var typescriptQueries;
+var init_typescript = __esm({
+  "src/parsing/queries/typescript.ts"() {
+    typescriptQueries = `
+;; Class declaration
 (class_declaration
   name: (type_identifier) @def.class.name) @def.class
 
@@ -889,342 +1222,9 @@ var init_swift = __esm({
 
 ;; Property declaration
 (property_declaration
-  (pattern
-    (simple_identifier) @def.property.name)) @def.property
-`;
-  }
-});
-
-// src/observability/tracing.ts
-var tracing_exports = {};
-__export(tracing_exports, {
-  SpanStatusCode: () => SpanStatusCode,
-  context: () => context,
-  getActiveTraceContext: () => getActiveTraceContext,
-  getTracer: () => getTracer,
-  initTracing: () => initTracing,
-  isTracingEnabled: () => isTracingEnabled,
-  sanitizeAttrs: () => sanitizeAttrs,
-  shutdownTracing: () => shutdownTracing,
-  trace: () => trace,
-  withSpan: () => withSpan
-});
-function isTracingEnabled() {
-  return process.env["CODE_INTEL_OTEL_ENABLED"] === "true";
-}
-function initTracing() {
-  if (!isTracingEnabled()) return;
-  if (_sdk) return;
-  const endpoint = process.env["CODE_INTEL_OTEL_ENDPOINT"] ?? "http://localhost:4318";
-  const serviceName = process.env["CODE_INTEL_OTEL_SERVICE"] ?? "code-intel";
-  const deploymentEnv = process.env["CODE_INTEL_OTEL_ENV"] ?? process.env["NODE_ENV"] ?? "development";
-  const exporter = new OTLPTraceExporter({ url: `${endpoint}/v1/traces` });
-  _sdk = new NodeSDK({
-    resource: resourceFromAttributes({
-      [SEMRESATTRS_SERVICE_NAME]: serviceName,
-      [SEMRESATTRS_DEPLOYMENT_ENVIRONMENT]: deploymentEnv
-    }),
-    traceExporter: exporter,
-    instrumentations: [
-      getNodeAutoInstrumentations({
-        // Disable noisy file-system instrumentation
-        "@opentelemetry/instrumentation-fs": { enabled: false }
-      })
-    ]
-  });
-  _sdk.start();
-}
-async function shutdownTracing() {
-  if (_sdk) {
-    await _sdk.shutdown();
-    _sdk = null;
-  }
-}
-function getTracer() {
-  return trace.getTracer(TRACER_NAME);
-}
-async function withSpan(name, attrs, fn) {
-  return getTracer().startActiveSpan(name, { attributes: sanitizeAttrs(attrs) }, async (span) => {
-    try {
-      const result = await fn(span);
-      span.setStatus({ code: SpanStatusCode.OK });
-      return result;
-    } catch (err) {
-      span.setStatus({
-        code: SpanStatusCode.ERROR,
-        message: err instanceof Error ? err.message : String(err)
-      });
-      span.recordException(err);
-      throw err;
-    } finally {
-      span.end();
-    }
-  });
-}
-function sanitizeAttrs(attrs) {
-  const safe = {};
-  for (const [k, v] of Object.entries(attrs)) {
-    if (BLOCKED_ATTR_KEYS.test(k)) continue;
-    safe[k] = v;
-  }
-  return safe;
-}
-function getActiveTraceContext() {
-  const span = trace.getActiveSpan();
-  if (!span) return { traceId: "", spanId: "" };
-  const ctx = span.spanContext();
-  return { traceId: ctx.traceId, spanId: ctx.spanId };
-}
-var _sdk, TRACER_NAME, BLOCKED_ATTR_KEYS;
-var init_tracing = __esm({
-  "src/observability/tracing.ts"() {
-    _sdk = null;
-    TRACER_NAME = "code-intel";
-    BLOCKED_ATTR_KEYS = /secret|password|token|key|auth|credential/i;
-  }
-});
-function getActiveTraceCtx() {
-  if (_getTraceCtx === "pending") return { traceId: "", spanId: "" };
-  if (_getTraceCtx) return _getTraceCtx();
-  _getTraceCtx = "pending";
-  Promise.resolve().then(() => (init_tracing(), tracing_exports)).then((mod) => {
-    _getTraceCtx = mod.getActiveTraceContext;
-  }).catch(() => {
-    _getTraceCtx = null;
-  });
-  return { traceId: "", spanId: "" };
-}
-var _getTraceCtx, SENSITIVE_KEYS, SENSITIVE_PATTERNS, SENSITIVE_KEYS_REGEX, Logger, logger_default;
-var init_logger = __esm({
-  "src/shared/logger.ts"() {
-    _getTraceCtx = null;
-    SENSITIVE_KEYS = [
-      "password",
-      "passwd",
-      "pass",
-      "pwd",
-      "secret",
-      "secretkey",
-      "secret_key",
-      "secretaccesskey",
-      "accesskeyid",
-      "credentials",
-      "auth",
-      "authentication",
-      "login",
-      "api_key",
-      "apikey",
-      "api",
-      "access_key",
-      "access_token",
-      "accesskey",
-      "auth_key",
-      "auth_token",
-      "authkey",
-      "token",
-      "jwt",
-      "bearer_token",
-      "refresh_token",
-      "session_token",
-      "session_key",
-      "oauth_token",
-      "connection_string",
-      "conn_string",
-      "db_uri",
-      "db_url",
-      "database_url",
-      "mongodb_uri",
-      "mysql_uri",
-      "postgres_uri",
-      "sql_uri",
-      "db_username",
-      "db_password",
-      "db_host",
-      "db_port",
-      "db_name",
-      "encryption_key",
-      "crypto_key",
-      "private_key",
-      "public_key",
-      "ssl_key",
-      "ssh_key",
-      "pgp_key",
-      "rsa_key",
-      "aes_key",
-      "email",
-      "phone",
-      "telephone",
-      "mobile",
-      "ssn",
-      "social_security",
-      "credit_card",
-      "cc_number",
-      "card_number",
-      "cvv",
-      "expiry_date",
-      "birth_date",
-      "dob",
-      "address",
-      "zip_code",
-      "postal_code",
-      "bank_account",
-      "iban",
-      "swift_code",
-      "routing_number",
-      "tax_id",
-      "vat_number",
-      "financial_id",
-      "certificate",
-      "client_cert",
-      "server_cert",
-      "ca_cert",
-      "aws_key",
-      "aws_secret",
-      "azure_key",
-      "gcp_key",
-      "s3_key",
-      "cloudinary_key",
-      "stripe_key",
-      "paypal_key",
-      "twilio_key",
-      "app_secret",
-      "client_secret",
-      "consumer_secret",
-      "encryption_secret",
-      "master_key",
-      "root_password",
-      "admin_password",
-      "config_secret",
-      "env_secret",
-      "deploy_key",
-      "ci_key",
-      "session_id",
-      "cookie_secret",
-      "csrf_token",
-      "xsrf_token",
-      "license_key",
-      "product_key",
-      "serial_number",
-      "activation_code"
-    ];
-    SENSITIVE_PATTERNS = [
-      /(?:password|passwd|secret|api_key|access_token|auth_token|token)\s*[:=]\s*([^\s,]+)/gi,
-      /\b\d{16}\b/gi,
-      /\b\d{3}-\d{2}-\d{4}\b/gi,
-      /\b[A-Za-z0-9]{32}\b/gi,
-      /\b[A-Za-z0-9_-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b/gi,
-      /\b\d{10}\b/gi,
-      /\b[A-Za-z0-9]{64}\b/gi,
-      /(?:connection_string|db_uri|db_url|mongodb_uri)\s*[:=]\s*([^\s,]+)/gi,
-      /(?:apikey|api_key|auth_key)\s*[:=]\s*([^\s,]+)/gi,
-      /(?:bearer\s+)([a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+)/gi
-    ];
-    SENSITIVE_KEYS_REGEX = new RegExp(`^(${SENSITIVE_KEYS.join("|")})$`, "i");
-    Logger = class _Logger {
-      static instance = null;
-      static maskSensitiveData(value) {
-        if (typeof value === "string" && value.length > 5) {
-          const firstChar = value.at(0);
-          const lastChar = value.at(-1);
-          return firstChar + "*".repeat(value.length - 2) + lastChar;
-        }
-        return value;
-      }
-      static maskSensitive(message, args = []) {
-        const maskString = (input) => {
-          if (typeof input !== "string") return input;
-          return SENSITIVE_PATTERNS.reduce((str, pattern) => {
-            return str.replace(
-              pattern,
-              (match, value) => value ? match.replace(value, _Logger.maskSensitiveData(value)) : match
-            );
-          }, input);
-        };
-        const deepMask = (obj) => {
-          if (typeof obj === "string") return maskString(obj);
-          if (Array.isArray(obj)) return obj.map((item) => deepMask(item));
-          if (typeof obj === "object" && obj !== null) {
-            return Object.entries(obj).reduce(
-              (acc, [key, value]) => {
-                if (value === void 0) return acc;
-                const isSensitiveKey = SENSITIVE_KEYS_REGEX.test(key);
-                acc[key] = isSensitiveKey && typeof value === "string" ? _Logger.maskSensitiveData(value) : deepMask(value);
-                return acc;
-              },
-              {}
-            );
-          }
-          return obj;
-        };
-        return {
-          maskedMessage: maskString(message),
-          maskedArgs: args.map((arg) => deepMask(arg))
-        };
-      }
-      /** Global log directory: ~/.code-intel/logs */
-      static LOG_DIR = path31.join(os13.homedir(), ".code-intel", "logs");
-      static getLogger() {
-        if (!_Logger.instance) {
-          const isProduction = process.env.NODE_ENV === "production";
-          const logLevel = process.env.LOG_LEVEL ?? "info";
-          const transports = [];
-          transports.push(new winston.transports.Console());
-          if (!isProduction) {
-            try {
-              if (!fs24.existsSync(_Logger.LOG_DIR)) {
-                fs24.mkdirSync(_Logger.LOG_DIR, { recursive: true });
-              }
-              transports.push(
-                new DailyRotateFile({
-                  filename: path31.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
-                  datePattern: "YYYY-MM-DD",
-                  maxSize: "20m",
-                  maxFiles: "14d"
-                })
-              );
-            } catch {
-            }
-          }
-          _Logger.instance = winston.createLogger({
-            level: logLevel,
-            format: winston.format.combine(
-              winston.format.timestamp(),
-              winston.format.printf(({ timestamp, level, message, ...meta }) => {
-                const args = meta[/* @__PURE__ */ Symbol.for("splat")] || [];
-                const { maskedMessage, maskedArgs } = _Logger.maskSensitive(message, args);
-                const formattedArgs = maskedArgs.map(
-                  (arg) => typeof arg === "object" ? JSON.stringify(arg) : String(arg)
-                );
-                const suffix = formattedArgs.length ? " " + formattedArgs.join(" ") : "";
-                let traceCtx = "";
-                try {
-                  const { traceId, spanId } = getActiveTraceCtx();
-                  if (traceId) traceCtx = ` [trace=${traceId} span=${spanId}]`;
-                } catch {
-                }
-                return `${timestamp} [${level.toUpperCase()}]${traceCtx}: ${maskedMessage}${suffix}`;
-              })
-            ),
-            transports
-          });
-        }
-        return _Logger.instance;
-      }
-      static info(message, ...args) {
-        _Logger.getLogger().info(message, ...args);
-      }
-      static warn(message, ...args) {
-        _Logger.getLogger().warn(message, ...args);
-      }
-      static error(message, ...args) {
-        _Logger.getLogger().error(message, ...args);
-      }
-      static debug(message, ...args) {
-        _Logger.getLogger().debug(message, ...args);
-      }
-    };
-    logger_default = Logger;
-    Logger.getLogger();
+  (pattern
+    (simple_identifier) @def.property.name)) @def.property
+`;
   }
 });
 
@@ -1961,7 +1961,7 @@ var init_parse_phase = __esm({
           const batch = filePaths.slice(i, i + CONCURRENCY);
           await Promise.all(batch.map(async (filePath) => {
             try {
-              const source = await fs24.promises.readFile(filePath, "utf-8");
+              const source = await fs25.promises.readFile(filePath, "utf-8");
               context2.fileCache.set(filePath, source);
             } catch {
             }
@@ -1974,14 +1974,14 @@ var init_parse_phase = __esm({
           const lang = detectLanguage(filePath);
           if (!lang) {
             if (context2.verbose) {
-              const relativePath2 = path31.relative(context2.workspaceRoot, filePath);
+              const relativePath2 = path32.relative(context2.workspaceRoot, filePath);
               logger_default.info(`  [parse] skipped (no parser): ${relativePath2}`);
             }
             continue;
           }
           const source = context2.fileCache.get(filePath);
           if (!source) continue;
-          const relativePath = path31.relative(context2.workspaceRoot, filePath);
+          const relativePath = path32.relative(context2.workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const fileNode = context2.graph.getNode(fileNodeId);
           if (fileNode) {
@@ -2221,11 +2221,11 @@ var init_resolve_phase = __esm({
         let heritageEdges = 0;
         const fileIndex = /* @__PURE__ */ new Map();
         for (const fp of filePaths) {
-          const rel = path31.relative(workspaceRoot, fp);
+          const rel = path32.relative(workspaceRoot, fp);
           fileIndex.set(rel, fp);
           const noExt = rel.replace(/\.\w+$/, "");
           if (!fileIndex.has(noExt)) fileIndex.set(noExt, fp);
-          const base = path31.basename(rel, path31.extname(rel));
+          const base = path32.basename(rel, path32.extname(rel));
           if (!fileIndex.has(base)) fileIndex.set(base, fp);
         }
         const symbolIndex = /* @__PURE__ */ new Map();
@@ -2256,7 +2256,7 @@ var init_resolve_phase = __esm({
         for (const filePath of filePaths) {
           const lang = detectLanguage(filePath);
           if (!lang) continue;
-          const relativePath = path31.relative(workspaceRoot, filePath);
+          const relativePath = path32.relative(workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const source = fileCache.get(filePath);
           if (!source) continue;
@@ -2269,13 +2269,13 @@ var init_resolve_phase = __esm({
             let resolvedRelPath = null;
             if (cleaned.startsWith(".")) {
               const cleanedNoJs = cleaned.replace(/\.(js|jsx)$/, "");
-              const fromDir = path31.dirname(relativePath);
+              const fromDir = path32.dirname(relativePath);
               for (const ext of ["", ".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", "/index.ts", "/index.js"]) {
-                const candidate = path31.join(fromDir, cleanedNoJs + ext);
-                const normalized = path31.normalize(candidate);
+                const candidate = path32.join(fromDir, cleanedNoJs + ext);
+                const normalized = path32.normalize(candidate);
                 if (fileIndex.has(normalized)) {
                   const absPath = fileIndex.get(normalized);
-                  resolvedRelPath = path31.relative(workspaceRoot, absPath);
+                  resolvedRelPath = path32.relative(workspaceRoot, absPath);
                   break;
                 }
               }
@@ -2589,27 +2589,27 @@ __export(group_registry_exports, {
   saveSyncResult: () => saveSyncResult
 });
 function groupFile(name) {
-  return path31.join(GROUPS_DIR, `${name}.json`);
+  return path32.join(GROUPS_DIR, `${name}.json`);
 }
 function loadGroup(name) {
   try {
-    return JSON.parse(fs24.readFileSync(groupFile(name), "utf-8"));
+    return JSON.parse(fs25.readFileSync(groupFile(name), "utf-8"));
   } catch {
     return null;
   }
 }
 function saveGroup(group) {
-  fs24.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs24.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
+  fs25.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs25.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
 }
 function listGroups() {
   const groups = [];
   try {
-    for (const file of fs24.readdirSync(GROUPS_DIR)) {
+    for (const file of fs25.readdirSync(GROUPS_DIR)) {
       if (!file.endsWith(".json") || file.endsWith(".sync.json")) continue;
       try {
         const g = JSON.parse(
-          fs24.readFileSync(path31.join(GROUPS_DIR, file), "utf-8")
+          fs25.readFileSync(path32.join(GROUPS_DIR, file), "utf-8")
         );
         groups.push(g);
       } catch {
@@ -2621,16 +2621,16 @@ function listGroups() {
 }
 function deleteGroup(name) {
   try {
-    fs24.unlinkSync(groupFile(name));
+    fs25.unlinkSync(groupFile(name));
   } catch {
   }
   try {
-    fs24.unlinkSync(path31.join(GROUPS_DIR, `${name}.sync.json`));
+    fs25.unlinkSync(path32.join(GROUPS_DIR, `${name}.sync.json`));
   } catch {
   }
 }
 function groupExists(name) {
-  return fs24.existsSync(groupFile(name));
+  return fs25.existsSync(groupFile(name));
 }
 function addMember(groupName, member) {
   const group = loadGroup(groupName);
@@ -2656,16 +2656,16 @@ function removeMember(groupName, groupPath) {
   return group;
 }
 function saveSyncResult(result) {
-  fs24.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs24.writeFileSync(
-    path31.join(GROUPS_DIR, `${result.groupName}.sync.json`),
+  fs25.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs25.writeFileSync(
+    path32.join(GROUPS_DIR, `${result.groupName}.sync.json`),
     JSON.stringify(result, null, 2) + "\n"
   );
 }
 function loadSyncResult(groupName) {
   try {
     return JSON.parse(
-      fs24.readFileSync(path31.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
+      fs25.readFileSync(path32.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
     );
   } catch {
     return null;
@@ -2674,7 +2674,7 @@ function loadSyncResult(groupName) {
 var GROUPS_DIR;
 var init_group_registry = __esm({
   "src/multi-repo/group-registry.ts"() {
-    GROUPS_DIR = path31.join(os13.homedir(), ".code-intel", "groups");
+    GROUPS_DIR = path32.join(os13.homedir(), ".code-intel", "groups");
   }
 });
 
@@ -2964,7 +2964,7 @@ __export(gql_parser_exports, {
 function isGQLParseError(v) {
   return v.type === "GQLParseError";
 }
-function tokenize(input) {
+function tokenize2(input) {
   const tokens = [];
   let i = 0;
   const len = input.length;
@@ -3059,7 +3059,7 @@ function tokenize(input) {
   return tokens;
 }
 function parseGQL(input) {
-  const tokens = tokenize(input.trim());
+  const tokens = tokenize2(input.trim());
   if (!Array.isArray(tokens)) return tokens;
   const parser = new Parser2(tokens);
   return parser.parse();
@@ -3852,7 +3852,7 @@ function isTestFile(filePath) {
   if (filePath.includes(".test.") || filePath.includes(".spec.")) return true;
   if (filePath.includes("_test.") || filePath.endsWith("_test.go")) return true;
   if (filePath.includes("__tests__")) return true;
-  const base = path31.basename(filePath);
+  const base = path32.basename(filePath);
   if (base.startsWith("Test") && filePath.endsWith(".java")) return true;
   return false;
 }
@@ -3897,7 +3897,7 @@ function computeCoverage(graph, scope) {
   }
   const baseNameToTestFiles = /* @__PURE__ */ new Map();
   for (const testPath of testFilePaths) {
-    const base = path31.basename(testPath);
+    const base = path32.basename(testPath);
     const stripped = base.replace(/\.test\.[^.]+$/, "").replace(/\.spec\.[^.]+$/, "").replace(/_test\.[^.]+$/, "").replace(/_test$/, "");
     const existing = baseNameToTestFiles.get(stripped) ?? [];
     existing.push(testPath);
@@ -3930,7 +3930,7 @@ function computeCoverage(graph, scope) {
         }
       }
     }
-    const nodeBase = path31.basename(node.filePath).replace(/\.[^.]+$/, "");
+    const nodeBase = path32.basename(node.filePath).replace(/\.[^.]+$/, "");
     const matchingTestFiles = baseNameToTestFiles.get(nodeBase) ?? [];
     for (const tf of matchingTestFiles) {
       if (!testFiles.includes(tf)) testFiles.push(tf);
@@ -4000,7 +4000,7 @@ var init_secret_scanner = __esm({
         const ignorePatterns = [...options?.ignorePatterns ?? []];
         if (options?.workspaceRoot) {
           try {
-            const raw = fs24.readFileSync(path31.join(options.workspaceRoot, ".codeintelignore"), "utf-8");
+            const raw = fs25.readFileSync(path32.join(options.workspaceRoot, ".codeintelignore"), "utf-8");
             for (const line of raw.split("\n")) {
               const trimmed = line.trim();
               if (trimmed && !trimmed.startsWith("#")) ignorePatterns.push(trimmed);
@@ -4288,10 +4288,10 @@ var init_codes = __esm({
   }
 });
 function secureMkdir(dir) {
-  fs24.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  fs25.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
   if (process.platform !== "win32") {
     try {
-      fs24.chmodSync(dir, SECURE_DIR_MODE);
+      fs25.chmodSync(dir, SECURE_DIR_MODE);
     } catch {
     }
   }
@@ -4299,17 +4299,17 @@ function secureMkdir(dir) {
 function secureChmodFile(file) {
   if (process.platform === "win32") return;
   try {
-    fs24.chmodSync(file, SECURE_FILE_MODE);
+    fs25.chmodSync(file, SECURE_FILE_MODE);
   } catch {
   }
 }
 function tightenDbFiles(dir) {
   if (process.platform === "win32") return;
-  if (!fs24.existsSync(dir)) return;
-  for (const name of fs24.readdirSync(dir)) {
+  if (!fs25.existsSync(dir)) return;
+  for (const name of fs25.readdirSync(dir)) {
     if (name.endsWith(".db") || name.endsWith(".db-wal") || name.endsWith(".db-shm")) {
       try {
-        fs24.chmodSync(path31.join(dir, name), SECURE_FILE_MODE);
+        fs25.chmodSync(path32.join(dir, name), SECURE_FILE_MODE);
       } catch {
       }
     }
@@ -4323,7 +4323,7 @@ var init_fs_secure = __esm({
   }
 });
 function getUsersDBPath() {
-  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path31.join(os13.homedir(), ".code-intel", "users.db");
+  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path32.join(os13.homedir(), ".code-intel", "users.db");
 }
 function getOrCreateUsersDB() {
   if (!_usersDB) {
@@ -4339,9 +4339,9 @@ var init_users_db = __esm({
     UsersDB = class {
       db;
       constructor(dbPath) {
-        const dir = path31.dirname(dbPath);
+        const dir = path32.dirname(dbPath);
         secureMkdir(dir);
-        this.db = new Database3(dbPath);
+        this.db = new Database2(dbPath);
         this.db.pragma("journal_mode = WAL");
         this.db.pragma("foreign_keys = ON");
         this.createTables();
@@ -4616,7 +4616,7 @@ function getScryptN() {
   return Number.isInteger(v) && v >= 1024 ? v : 1 << 14;
 }
 function getSecretsPath() {
-  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path31.join(os13.homedir(), ".code-intel", ".secrets");
+  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path32.join(os13.homedir(), ".code-intel", ".secrets");
 }
 function getMasterPassword() {
   const fromEnv = process.env["CODE_INTEL_SECRET_KEY"];
@@ -4647,8 +4647,8 @@ function decryptSecrets(encrypted) {
   return JSON.parse(plaintext.toString("utf8"));
 }
 function loadSecrets(secretsPath = getSecretsPath()) {
-  if (!fs24.existsSync(secretsPath)) return {};
-  const blob = fs24.readFileSync(secretsPath);
+  if (!fs25.existsSync(secretsPath)) return {};
+  const blob = fs25.readFileSync(secretsPath);
   return decryptSecrets(blob);
 }
 function getSecret(key, secretsPath = getSecretsPath()) {
@@ -5158,6 +5158,71 @@ function createKnowledgeGraph() {
 // src/graph/index.ts
 init_id_generator();
 
+// src/storage/schema.ts
+var NODE_TABLE_MAP = {
+  file: "file_nodes",
+  directory: "dir_nodes",
+  function: "func_nodes",
+  class: "class_nodes",
+  interface: "iface_nodes",
+  method: "method_nodes",
+  constructor: "ctor_nodes",
+  variable: "var_nodes",
+  property: "prop_nodes",
+  struct: "struct_nodes",
+  enum: "enum_nodes",
+  trait: "trait_nodes",
+  namespace: "ns_nodes",
+  module: "mod_nodes",
+  type_alias: "type_nodes",
+  constant: "const_nodes",
+  route: "route_nodes",
+  cluster: "cluster_nodes",
+  flow: "flow_nodes",
+  vulnerability: "vuln_nodes"
+};
+var ALL_NODE_TABLES = [...new Set(Object.values(NODE_TABLE_MAP))];
+function getCreateNodeTableDDL(tableName) {
+  return `CREATE NODE TABLE IF NOT EXISTS ${tableName} (
+  id STRING,
+  name STRING,
+  file_path STRING,
+  start_line INT64,
+  end_line INT64,
+  exported BOOLEAN,
+  content STRING,
+  metadata STRING,
+  PRIMARY KEY (id)
+)`;
+}
+function getCreateEdgeTableDDL() {
+  const uniqueTables = ALL_NODE_TABLES;
+  const fromToPairs = [];
+  for (const from of uniqueTables) {
+    for (const to of uniqueTables) {
+      fromToPairs.push(`FROM ${from} TO ${to}`);
+    }
+  }
+  return [`CREATE REL TABLE GROUP IF NOT EXISTS code_edges (
+  ${fromToPairs.join(",\n  ")},
+  kind STRING,
+  weight DOUBLE,
+  label STRING
+)`];
+}
+
+// src/graph/lazy-knowledge-graph.ts
+init_logger();
+Object.fromEntries(
+  Object.entries(NODE_TABLE_MAP).map(([kind, table]) => [table, kind])
+);
+function isLazyGraph(g) {
+  return "lazy" in g && g.lazy === true;
+}
+
+// src/graph/compact-knowledge-graph.ts
+init_logger();
+
 // src/parsing/index.ts
 init_parser_manager();
 init_query_runner();
@@ -5215,7 +5280,7 @@ init_shared();
 init_shared();
 init_typescript();
 function resolveRelative(rawPath, fromFile, workspace) {
-  const fromDir = path31.dirname(fromFile);
+  const fromDir = path32.dirname(fromFile);
   const cleaned = rawPath.replace(/['"]/g, "");
   const extensions = [".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.js"];
   const resolved = workspace.resolve(fromDir, cleaned);
@@ -5267,7 +5332,7 @@ var pythonModule = {
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/['"]/g, "");
     const parts = cleaned.split(".");
-    const fromDir = path31.dirname(fromFile);
+    const fromDir = path32.dirname(fromFile);
     const relPath = parts.join("/");
     for (const suffix of ["/__init__.py", ".py"]) {
       const r = workspace.resolve(fromDir, relPath + suffix);
@@ -5346,7 +5411,7 @@ var cModule = {
   inheritanceStrategy: "none",
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/[<>"']/g, "");
-    const fromDir = path31.dirname(fromFile);
+    const fromDir = path32.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(_node) {
@@ -5369,7 +5434,7 @@ var cppModule = {
   inheritanceStrategy: "depth-first",
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/[<>"']/g, "");
-    const fromDir = path31.dirname(fromFile);
+    const fromDir = path32.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(_node) {
@@ -5531,7 +5596,7 @@ var dartModule = {
       const pkg = cleaned.replace("package:", "");
       return workspace.findByPackage(pkg);
     }
-    const fromDir = path31.dirname(fromFile);
+    const fromDir = path32.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(node) {
@@ -5886,25 +5951,25 @@ function validateDAG(phases) {
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
   const phaseMap = new Map(phases.map((p) => [p.name, p]));
-  function dfs(name, path32) {
+  function dfs(name, path33) {
     if (visiting.has(name)) {
-      const cycleStart = path32.indexOf(name);
-      const cycle = path32.slice(cycleStart).concat(name);
+      const cycleStart = path33.indexOf(name);
+      const cycle = path33.slice(cycleStart).concat(name);
       errors.push({ type: "cycle", message: `Cycle detected: ${cycle.join(" \u2192 ")}` });
       return true;
     }
     if (visited.has(name)) return false;
     visiting.add(name);
-    path32.push(name);
+    path33.push(name);
     const phase = phaseMap.get(name);
     if (phase) {
       for (const dep of phase.dependencies) {
-        if (dfs(dep, path32)) return true;
+        if (dfs(dep, path33)) return true;
       }
     }
     visiting.delete(name);
     visited.add(name);
-    path32.pop();
+    path33.pop();
     return false;
   }
   for (const phase of phases) {
@@ -6032,6 +6097,7 @@ ${errors.map((e) => e.message).join("\n")}`);
   for (const phase of sorted) {
     context2.onProgress?.(phase.name, "running");
     const phaseStart = Date.now();
+    const memBefore = context2.profile ? Math.round(process.memoryUsage().heapUsed / 1024 / 1024) : void 0;
     const runPhase = async () => {
       const depResults = /* @__PURE__ */ new Map();
       for (const dep of phase.dependencies) {
@@ -6055,6 +6121,10 @@ ${errors.map((e) => e.message).join("\n")}`);
       }
       const durationSec = (Date.now() - phaseStart) / 1e3;
       pipelinePhaseDurationSeconds.observe({ phase: phase.name, status: result.status }, durationSec);
+      if (memBefore !== void 0) {
+        result.memoryBeforeMB = memBefore;
+        result.memoryAfterMB = Math.round(process.memoryUsage().heapUsed / 1024 / 1024);
+      }
       results.set(phase.name, result);
       context2.onProgress?.(phase.name, result.status);
       if (result.status === "failed") {
@@ -6065,7 +6135,9 @@ ${errors.map((e) => e.message).join("\n")}`);
       const result = {
         status: "failed",
         duration: Date.now() - phaseStart,
-        message: err instanceof Error ? err.message : String(err)
+        message: err instanceof Error ? err.message : String(err),
+        memoryBeforeMB: memBefore,
+        memoryAfterMB: memBefore !== void 0 ? Math.round(process.memoryUsage().heapUsed / 1024 / 1024) : void 0
       };
       pipelinePhaseDurationSeconds.observe({ phase: phase.name, status: "failed" }, (Date.now() - phaseStart) / 1e3);
       results.set(phase.name, result);
@@ -6117,7 +6189,7 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
 ]);
 function loadIgnorePatterns(workspaceRoot) {
   try {
-    const raw = fs24.readFileSync(path31.join(workspaceRoot, ".codeintelignore"), "utf-8");
+    const raw = fs25.readFileSync(path32.join(workspaceRoot, ".codeintelignore"), "utf-8");
     const extras = /* @__PURE__ */ new Set();
     for (const line of raw.split("\n")) {
       const trimmed = line.trim();
@@ -6141,7 +6213,7 @@ var scanPhase = {
     function walk(dir) {
       let entries;
       try {
-        entries = fs24.readdirSync(dir, { withFileTypes: true });
+        entries = fs25.readdirSync(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -6150,15 +6222,15 @@ var scanPhase = {
           if (entry.name.startsWith(".")) continue;
           if (IGNORED_DIRS.has(entry.name)) continue;
           if (extraIgnore.has(entry.name)) continue;
-          walk(path31.join(dir, entry.name));
+          walk(path32.join(dir, entry.name));
         } else if (entry.isFile()) {
           const name = entry.name;
           if (IGNORED_FILE_SUFFIXES.some((s) => name.endsWith(s))) continue;
-          const ext = path31.extname(name);
+          const ext = path32.extname(name);
           if (!extensions.has(ext)) continue;
-          const fullPath = path31.join(dir, name);
+          const fullPath = path32.join(dir, name);
           try {
-            const stat = fs24.statSync(fullPath);
+            const stat = fs25.statSync(fullPath);
             if (stat.size > MAX_FILE_SIZE_BYTES) continue;
           } catch {
             continue;
@@ -6185,20 +6257,20 @@ var structurePhase = {
     const dirs = /* @__PURE__ */ new Set();
     let structDone = 0;
     for (const filePath of context2.filePaths) {
-      const relativePath = path31.relative(context2.workspaceRoot, filePath);
+      const relativePath = path32.relative(context2.workspaceRoot, filePath);
       const lang = detectLanguage(filePath);
       context2.graph.addNode({
         id: generateNodeId("file", relativePath, relativePath),
         kind: "file",
-        name: path31.basename(filePath),
+        name: path32.basename(filePath),
         filePath: relativePath,
         metadata: lang ? { language: lang } : void 0
       });
-      let dir = path31.dirname(relativePath);
+      let dir = path32.dirname(relativePath);
       while (dir && dir !== "." && dir !== "") {
         if (dirs.has(dir)) break;
         dirs.add(dir);
-        dir = path31.dirname(dir);
+        dir = path32.dirname(dir);
       }
       structDone++;
       context2.onPhaseProgress?.("structure", structDone, context2.filePaths.length);
@@ -6207,7 +6279,7 @@ var structurePhase = {
       context2.graph.addNode({
         id: generateNodeId("directory", dir, dir),
         kind: "directory",
-        name: path31.basename(dir),
+        name: path32.basename(dir),
         filePath: dir
       });
     }
@@ -6318,22 +6390,22 @@ var flowPhase = {
       const queue = [{ nodeId: ep.id, path: [ep.id] }];
       const visited = /* @__PURE__ */ new Set();
       while (queue.length > 0 && flowCount < maxFlows) {
-        const { nodeId, path: path32 } = queue.shift();
-        if (path32.length > maxDepth) continue;
+        const { nodeId, path: path33 } = queue.shift();
+        if (path33.length > maxDepth) continue;
         const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-        if (callEdges.length === 0 && path32.length >= 3) {
+        if (callEdges.length === 0 && path33.length >= 3) {
           const flowId = generateNodeId("flow", ep.filePath, `flow-${flowCount}`);
           graph.addNode({
             id: flowId,
             kind: "flow",
             name: `${ep.name} flow ${flowCount}`,
             filePath: ep.filePath,
-            metadata: { steps: path32, entryPoint: ep.name }
+            metadata: { steps: path33, entryPoint: ep.name }
           });
-          for (let i = 0; i < path32.length; i++) {
+          for (let i = 0; i < path33.length; i++) {
             graph.addEdge({
-              id: generateEdgeId(path32[i], flowId, `step_of_${i}`),
-              source: path32[i],
+              id: generateEdgeId(path33[i], flowId, `step_of_${i}`),
+              source: path33[i],
               target: flowId,
               kind: "step_of",
               weight: 1,
@@ -6346,7 +6418,7 @@ var flowPhase = {
         for (const edge of callEdges) {
           if (visited.has(edge.target)) continue;
           visited.add(edge.target);
-          queue.push({ nodeId: edge.target, path: [...path32, edge.target] });
+          queue.push({ nodeId: edge.target, path: [...path33, edge.target] });
         }
       }
     }
@@ -6364,7 +6436,7 @@ var LLMGovernanceLogger = class {
   }
   /** Path to the JSONL log file. */
   getLogPath() {
-    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path31.join(os13.homedir(), ".code-intel", "llm-governance.jsonl");
+    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path32.join(os13.homedir(), ".code-intel", "llm-governance.jsonl");
   }
   /**
    * Append an entry to the governance log.
@@ -6380,8 +6452,8 @@ var LLMGovernanceLogger = class {
         ...entry
       };
       const logPath = this.getLogPath();
-      fs24.mkdirSync(path31.dirname(logPath), { recursive: true });
-      fs24.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
+      fs25.mkdirSync(path32.dirname(logPath), { recursive: true });
+      fs25.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
     } catch {
     }
   }
@@ -6391,7 +6463,7 @@ var LLMGovernanceLogger = class {
    */
   readLog(limit = 100) {
     try {
-      const raw = fs24.readFileSync(this.getLogPath(), "utf-8");
+      const raw = fs25.readFileSync(this.getLogPath(), "utf-8");
       const lines = raw.split("\n").filter((l) => l.trim().length > 0).slice(-limit);
       return lines.map((l) => JSON.parse(l));
     } catch {
@@ -6401,6 +6473,9 @@ var LLMGovernanceLogger = class {
 };
 var governanceLogger = new LLMGovernanceLogger();
 
+// src/pipeline/phases/summarize-phase.ts
+init_logger();
+
 // src/pipeline/workers/parse-phase-parallel.ts
 init_shared();
 init_id_generator();
@@ -6535,17 +6610,17 @@ function traceFlow(entryId, graph, maxDepth = 10, maxBranching = 4) {
     const queue = [{ nodeId: entryId, path: [entryId] }];
     const visited = /* @__PURE__ */ new Set();
     while (queue.length > 0 && flows.length < maxFlows) {
-      const { nodeId, path: path32 } = queue.shift();
-      if (path32.length > maxDepth) continue;
+      const { nodeId, path: path33 } = queue.shift();
+      if (path33.length > maxDepth) continue;
       const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-      if (callEdges.length === 0 && path32.length >= 3) {
-        flows.push({ entryPointId: entryId, steps: [...path32] });
+      if (callEdges.length === 0 && path33.length >= 3) {
+        flows.push({ entryPointId: entryId, steps: [...path33] });
         continue;
       }
       for (const edge of callEdges) {
         if (visited.has(edge.target)) continue;
         visited.add(edge.target);
-        queue.push({ nodeId: edge.target, path: [...path32, edge.target] });
+        queue.push({ nodeId: edge.target, path: [...path33, edge.target] });
       }
     }
   }
@@ -6646,7 +6721,7 @@ var VectorIndex = class {
     this.sqlitePath = sqlitePath;
   }
   async init() {
-    this.db = new Database3(this.sqlitePath);
+    this.db = new Database2(this.sqlitePath);
     this.db.pragma("journal_mode = WAL");
     this.db.exec(`
       CREATE TABLE IF NOT EXISTS ${EMBED_TABLE} (
@@ -6777,9 +6852,9 @@ function siftDown(arr, i, score) {
 }
 init_embedder();
 async function hybridSearch(graph, query, limit, options = {}) {
-  const { vectorDbPath, bm25Limit = 50, vectorLimit = 50 } = options;
-  const bm25Promise = Promise.resolve(textSearch(graph, query, bm25Limit));
-  const hasVectorDb = Boolean(vectorDbPath && fs24.existsSync(vectorDbPath));
+  const { vectorDbPath, bm25Limit = 50, vectorLimit = 50, bm25Results: precomputedBm25 } = options;
+  const bm25Promise = precomputedBm25 ? Promise.resolve(precomputedBm25) : Promise.resolve(textSearch(graph, query, bm25Limit));
+  const hasVectorDb = Boolean(vectorDbPath && fs25.existsSync(vectorDbPath));
   if (!hasVectorDb) {
     const bm25Results2 = await bm25Promise;
     return {
@@ -6828,16 +6903,282 @@ async function runVectorSearch(vectorDbPath, query, topK) {
     return null;
   }
 }
+
+// src/search/bm25-index.ts
+init_logger();
+var K1 = 1.2;
+var B = 0.75;
+function tokenize(text) {
+  return text.toLowerCase().split(/[\s\-_./\\:(){}[\]<>,"'`~!@#$%^&*+=|;?]+/).filter((t) => t.length >= 2 && t.length <= 64);
+}
+function nodeToDoc(node) {
+  return [
+    node.name,
+    node.kind,
+    node.filePath,
+    (node.content ?? "").slice(0, 1e3)
+  ].join(" ");
+}
+var Bm25Index = class {
+  constructor(dbPath) {
+    this.dbPath = dbPath;
+  }
+  dbPath;
+  /** In-memory inverted index (populated after `load()`). */
+  invertedIndex = /* @__PURE__ */ new Map();
+  docLengths = /* @__PURE__ */ new Map();
+  nodeMeta = /* @__PURE__ */ new Map();
+  avgdl = 1;
+  docCount = 0;
+  _loaded = false;
+  get isLoaded() {
+    return this._loaded;
+  }
+  // ── Build ───────────────────────────────────────────────────────────────────
+  /**
+   * Build the inverted index from a KnowledgeGraph and persist to SQLite.
+   * Called once at analysis time after the main pipeline completes.
+   */
+  build(graph) {
+    const nodeTermFreqs = /* @__PURE__ */ new Map();
+    const docLengths = /* @__PURE__ */ new Map();
+    const nodeMeta = /* @__PURE__ */ new Map();
+    for (const node of graph.allNodes()) {
+      if (["directory", "cluster", "flow"].includes(node.kind)) continue;
+      const terms = tokenize(nodeToDoc(node));
+      const tf = /* @__PURE__ */ new Map();
+      for (const t of terms) tf.set(t, (tf.get(t) ?? 0) + 1);
+      nodeTermFreqs.set(node.id, tf);
+      docLengths.set(node.id, terms.length);
+      nodeMeta.set(node.id, {
+        name: node.name,
+        kind: node.kind,
+        filePath: node.filePath,
+        snippet: node.content?.slice(0, 200)
+      });
+    }
+    const docCount = nodeTermFreqs.size;
+    const totalLen = [...docLengths.values()].reduce((a, b) => a + b, 0);
+    const avgdl = docCount > 0 ? totalLen / docCount : 1;
+    const invertedIndex = /* @__PURE__ */ new Map();
+    for (const [nodeId, tf] of nodeTermFreqs) {
+      for (const [term, count] of tf) {
+        let postings = invertedIndex.get(term);
+        if (!postings) {
+          postings = [];
+          invertedIndex.set(term, postings);
+        }
+        postings.push({ nodeId, tf: count });
+      }
+    }
+    fs25.mkdirSync(path32.dirname(this.dbPath), { recursive: true });
+    for (const f of [this.dbPath, `${this.dbPath}-shm`, `${this.dbPath}-wal`]) {
+      try {
+        if (fs25.existsSync(f)) fs25.unlinkSync(f);
+      } catch {
+      }
+    }
+    const db = new Database2(this.dbPath);
+    db.pragma("journal_mode = WAL");
+    db.exec(`
+      CREATE TABLE bm25_index   (term     TEXT PRIMARY KEY, postings TEXT NOT NULL);
+      CREATE TABLE bm25_doclen  (node_id  TEXT PRIMARY KEY, doclen   INTEGER NOT NULL);
+      CREATE TABLE bm25_nodemeta(node_id  TEXT PRIMARY KEY, name TEXT, kind TEXT, file_path TEXT, snippet TEXT);
+      CREATE TABLE bm25_meta    (key      TEXT PRIMARY KEY, value    TEXT NOT NULL);
+    `);
+    const insPosting = db.prepare("INSERT OR REPLACE INTO bm25_index    VALUES (?, ?)");
+    const insDoclen = db.prepare("INSERT OR REPLACE INTO bm25_doclen   VALUES (?, ?)");
+    const insNodeMeta = db.prepare("INSERT OR REPLACE INTO bm25_nodemeta VALUES (?, ?, ?, ?, ?)");
+    const insMeta = db.prepare("INSERT OR REPLACE INTO bm25_meta     VALUES (?, ?)");
+    db.transaction(() => {
+      for (const [term, postings] of invertedIndex) {
+        insPosting.run(term, JSON.stringify(postings));
+      }
+      for (const [nodeId, len] of docLengths) {
+        insDoclen.run(nodeId, len);
+      }
+      for (const [nodeId, meta] of nodeMeta) {
+        insNodeMeta.run(nodeId, meta.name, meta.kind, meta.filePath, meta.snippet ?? null);
+      }
+      insMeta.run("avgdl", String(avgdl));
+      insMeta.run("docCount", String(docCount));
+    })();
+    db.close();
+    logger_default.info(`  [bm25] Index built: ${invertedIndex.size} terms, ${docCount} documents`);
+  }
+  // ── Load into memory ────────────────────────────────────────────────────────
+  /**
+   * Load the full inverted index into memory.
+   * Called once on `serve` startup.
+   */
+  load() {
+    if (!fs25.existsSync(this.dbPath)) return;
+    const db = new Database2(this.dbPath, { readonly: true });
+    try {
+      const getMeta = db.prepare("SELECT value FROM bm25_meta WHERE key = ?");
+      this.avgdl = parseFloat(getMeta.get("avgdl")?.value ?? "1");
+      this.docCount = parseInt(getMeta.get("docCount")?.value ?? "0", 10);
+      this.invertedIndex.clear();
+      const postingRows = db.prepare("SELECT term, postings FROM bm25_index").all();
+      for (const row of postingRows) {
+        this.invertedIndex.set(row.term, JSON.parse(row.postings));
+      }
+      this.docLengths.clear();
+      const dlRows = db.prepare("SELECT node_id, doclen FROM bm25_doclen").all();
+      for (const row of dlRows) {
+        this.docLengths.set(row.node_id, row.doclen);
+      }
+      this.nodeMeta.clear();
+      const metaRows = db.prepare("SELECT node_id, name, kind, file_path, snippet FROM bm25_nodemeta").all();
+      for (const row of metaRows) {
+        this.nodeMeta.set(row.node_id, {
+          name: row.name,
+          kind: row.kind,
+          filePath: row.file_path,
+          snippet: row.snippet ?? void 0
+        });
+      }
+      this._loaded = true;
+      logger_default.info(`  [bm25] Index loaded (${this.invertedIndex.size} terms)`);
+    } finally {
+      db.close();
+    }
+  }
+  // ── Search ──────────────────────────────────────────────────────────────────
+  /**
+   * BM25 search. LIMIT pushdown: scores only the posting lists for query terms,
+   * then partial-sorts to return only the top `limit` results.
+   */
+  search(query, limit) {
+    if (!this._loaded || this.invertedIndex.size === 0) return [];
+    const queryTerms = [...new Set(tokenize(query))];
+    if (queryTerms.length === 0) return [];
+    const scores = /* @__PURE__ */ new Map();
+    const N = this.docCount;
+    const avgdl = this.avgdl;
+    for (const term of queryTerms) {
+      const postings = this.invertedIndex.get(term);
+      if (!postings) continue;
+      const df = postings.length;
+      const idf = Math.log((N - df + 0.5) / (df + 0.5) + 1);
+      for (const { nodeId, tf } of postings) {
+        const dl = this.docLengths.get(nodeId) ?? avgdl;
+        const score = idf * (tf * (K1 + 1)) / (tf + K1 * (1 - B + B * (dl / avgdl)));
+        scores.set(nodeId, (scores.get(nodeId) ?? 0) + score);
+      }
+    }
+    const entries = [...scores.entries()];
+    entries.sort((a, b) => b[1] - a[1]);
+    const topK = entries.slice(0, limit);
+    return topK.map(([nodeId, score]) => {
+      const meta = this.nodeMeta.get(nodeId);
+      return {
+        nodeId,
+        name: meta?.name ?? nodeId,
+        kind: meta?.kind ?? "unknown",
+        filePath: meta?.filePath ?? "",
+        score,
+        snippet: meta?.snippet
+      };
+    });
+  }
+  // ── Incremental update ──────────────────────────────────────────────────────
+  /**
+   * Incrementally update index for a set of changed/added nodes.
+   * Only terms that overlap with the changed nodes are rewritten.
+   * Works even if `load()` was not called (reads affected terms directly from DB).
+   */
+  updateNodes(nodes) {
+    if (!fs25.existsSync(this.dbPath)) return;
+    if (nodes.length === 0) return;
+    const changedIds = new Set(nodes.map((n) => n.id));
+    const newTermFreqs = /* @__PURE__ */ new Map();
+    for (const node of nodes) {
+      if (["directory", "cluster", "flow"].includes(node.kind)) continue;
+      const terms = tokenize(nodeToDoc(node));
+      const tf = /* @__PURE__ */ new Map();
+      for (const t of terms) tf.set(t, (tf.get(t) ?? 0) + 1);
+      newTermFreqs.set(node.id, tf);
+    }
+    const newTermSet = new Set([...newTermFreqs.values()].flatMap((m) => [...m.keys()]));
+    const db = new Database2(this.dbPath);
+    db.pragma("journal_mode = WAL");
+    const termsToRewrite = /* @__PURE__ */ new Map();
+    for (const term of newTermSet) {
+      const row = db.prepare("SELECT postings FROM bm25_index WHERE term = ?").get(term);
+      const existing = row ? JSON.parse(row.postings) : [];
+      termsToRewrite.set(term, existing.filter((p) => !changedIds.has(p.nodeId)));
+    }
+    for (const nodeId of changedIds) {
+      const rows = db.prepare("SELECT term, postings FROM bm25_index WHERE postings LIKE ?").all(`%${nodeId}%`);
+      for (const row of rows) {
+        if (termsToRewrite.has(row.term)) continue;
+        const postings = JSON.parse(row.postings);
+        if (postings.some((p) => changedIds.has(p.nodeId))) {
+          termsToRewrite.set(row.term, postings.filter((p) => !changedIds.has(p.nodeId)));
+        }
+      }
+    }
+    for (const [nodeId, tf] of newTermFreqs) {
+      for (const [term, count] of tf) {
+        const postings = termsToRewrite.get(term) ?? [];
+        postings.push({ nodeId, tf: count });
+        termsToRewrite.set(term, postings);
+      }
+    }
+    const upsertPosting = db.prepare("INSERT OR REPLACE INTO bm25_index    VALUES (?, ?)");
+    const upsertDoclen = db.prepare("INSERT OR REPLACE INTO bm25_doclen   VALUES (?, ?)");
+    const upsertNodeMeta = db.prepare("INSERT OR REPLACE INTO bm25_nodemeta VALUES (?, ?, ?, ?, ?)");
+    db.transaction(() => {
+      for (const [term, postings] of termsToRewrite) {
+        if (postings.length === 0) {
+          db.prepare("DELETE FROM bm25_index WHERE term = ?").run(term);
+        } else {
+          upsertPosting.run(term, JSON.stringify(postings));
+        }
+      }
+      for (const node of nodes) {
+        const terms = tokenize(nodeToDoc(node));
+        upsertDoclen.run(node.id, terms.length);
+        upsertNodeMeta.run(node.id, node.name, node.kind, node.filePath, node.content?.slice(0, 200) ?? null);
+      }
+    })();
+    db.close();
+    if (this._loaded) {
+      for (const [term, postings] of termsToRewrite) {
+        if (postings.length === 0) this.invertedIndex.delete(term);
+        else this.invertedIndex.set(term, postings);
+      }
+      for (const node of nodes) {
+        const terms = tokenize(nodeToDoc(node));
+        this.docLengths.set(node.id, terms.length);
+        this.nodeMeta.set(node.id, {
+          name: node.name,
+          kind: node.kind,
+          filePath: node.filePath,
+          snippet: node.content?.slice(0, 200)
+        });
+      }
+    }
+  }
+};
+function getBm25DbPath(workspaceRoot) {
+  return path32.join(workspaceRoot, ".code-intel", "bm25.db");
+}
 var DbManager = class {
   db = null;
   conn = null;
   dbPath;
-  constructor(dbPath) {
+  readOnly;
+  constructor(dbPath, readOnly = false) {
     this.dbPath = dbPath;
+    this.readOnly = readOnly;
   }
   async init() {
-    fs24.mkdirSync(path31.dirname(this.dbPath), { recursive: true });
-    this.db = new Database(this.dbPath);
+    if (!this.readOnly) {
+      fs25.mkdirSync(path32.dirname(this.dbPath), { recursive: true });
+    }
+    this.db = new Database(this.dbPath, 0, true, this.readOnly);
     await this.db.init();
     this.conn = new Connection(this.db);
     await this.conn.init();
@@ -6872,61 +7213,8 @@ var DbManager = class {
     return this.conn !== null;
   }
 };
-
-// src/storage/schema.ts
-var NODE_TABLE_MAP = {
-  file: "file_nodes",
-  directory: "dir_nodes",
-  function: "func_nodes",
-  class: "class_nodes",
-  interface: "iface_nodes",
-  method: "method_nodes",
-  constructor: "ctor_nodes",
-  variable: "var_nodes",
-  property: "prop_nodes",
-  struct: "struct_nodes",
-  enum: "enum_nodes",
-  trait: "trait_nodes",
-  namespace: "ns_nodes",
-  module: "mod_nodes",
-  type_alias: "type_nodes",
-  constant: "const_nodes",
-  route: "route_nodes",
-  cluster: "cluster_nodes",
-  flow: "flow_nodes",
-  vulnerability: "vuln_nodes"
-};
-var ALL_NODE_TABLES = [...new Set(Object.values(NODE_TABLE_MAP))];
-function getCreateNodeTableDDL(tableName) {
-  return `CREATE NODE TABLE IF NOT EXISTS ${tableName} (
-  id STRING,
-  name STRING,
-  file_path STRING,
-  start_line INT64,
-  end_line INT64,
-  exported BOOLEAN,
-  content STRING,
-  metadata STRING,
-  PRIMARY KEY (id)
-)`;
-}
-function getCreateEdgeTableDDL() {
-  const uniqueTables = ALL_NODE_TABLES;
-  const fromToPairs = [];
-  for (const from of uniqueTables) {
-    for (const to of uniqueTables) {
-      fromToPairs.push(`FROM ${from} TO ${to}`);
-    }
-  }
-  return [`CREATE REL TABLE GROUP IF NOT EXISTS code_edges (
-  ${fromToPairs.join(",\n  ")},
-  kind STRING,
-  weight DOUBLE,
-  label STRING
-)`];
-}
 function writeNodeCSVs(graph, outputDir) {
-  fs24.mkdirSync(outputDir, { recursive: true });
+  fs25.mkdirSync(outputDir, { recursive: true });
   const header = "id,name,file_path,start_line,end_line,exported,content,metadata\n";
   const tableBuffers = /* @__PURE__ */ new Map();
   const tableFilePaths = /* @__PURE__ */ new Map();
@@ -6934,7 +7222,7 @@ function writeNodeCSVs(graph, outputDir) {
     const table = NODE_TABLE_MAP[node.kind];
     if (!tableBuffers.has(table)) {
       tableBuffers.set(table, [header]);
-      tableFilePaths.set(table, path31.join(outputDir, `${table}.csv`));
+      tableFilePaths.set(table, path32.join(outputDir, `${table}.csv`));
     }
     tableBuffers.get(table).push(
       csvRow([
@@ -6954,12 +7242,12 @@ function writeNodeCSVs(graph, outputDir) {
     );
   }
   for (const [table, lines] of tableBuffers) {
-    fs24.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
+    fs25.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
   }
   return tableFilePaths;
 }
 function writeEdgeCSV(graph, outputDir) {
-  fs24.mkdirSync(outputDir, { recursive: true });
+  fs25.mkdirSync(outputDir, { recursive: true });
   const header = "from_id,to_id,kind,weight,label\n";
   const groups = /* @__PURE__ */ new Map();
   for (const edge of graph.allEdges()) {
@@ -6970,7 +7258,7 @@ function writeEdgeCSV(graph, outputDir) {
     const toTable = NODE_TABLE_MAP[targetNode.kind];
     const key = `${fromTable}->${toTable}`;
     if (!groups.has(key)) {
-      const filePath = path31.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
+      const filePath = path32.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
       groups.set(key, { lines: [header], from: fromTable, to: toTable, filePath });
     }
     groups.get(key).lines.push(
@@ -6985,7 +7273,7 @@ function writeEdgeCSV(graph, outputDir) {
   }
   const result = [];
   for (const group of groups.values()) {
-    fs24.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
+    fs25.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
     result.push({ fromTable: group.from, toTable: group.to, filePath: group.filePath });
   }
   return result;
@@ -7013,7 +7301,7 @@ async function loadGraphToDB(graph, dbManager) {
     } catch {
     }
   }
-  const tmpDir = fs24.mkdtempSync(path31.join(os13.tmpdir(), "code-intel-csv-"));
+  const tmpDir = fs25.mkdtempSync(path32.join(os13.tmpdir(), "code-intel-csv-"));
   try {
     const nodeTableFiles = writeNodeCSVs(graph, tmpDir);
     const edgeGroups = writeEdgeCSV(graph, tmpDir);
@@ -7032,8 +7320,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let nodeCount = 0;
     for (const [table, csvPath] of nodeTableFiles) {
-      if (!fs24.existsSync(csvPath)) continue;
-      const stat = fs24.statSync(csvPath);
+      if (!fs25.existsSync(csvPath)) continue;
+      const stat = fs25.statSync(csvPath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -7046,8 +7334,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let edgeCount = 0;
     for (const group of edgeGroups) {
-      if (!fs24.existsSync(group.filePath)) continue;
-      const stat = fs24.statSync(group.filePath);
+      if (!fs25.existsSync(group.filePath)) continue;
+      const stat = fs25.statSync(group.filePath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -7061,7 +7349,7 @@ async function loadGraphToDB(graph, dbManager) {
     return { nodeCount, edgeCount };
   } finally {
     try {
-      fs24.rmSync(tmpDir, { recursive: true, force: true });
+      fs25.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -7113,19 +7401,19 @@ function buildNodeProps(node) {
 function escCypher(s) {
   return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "");
 }
-var GLOBAL_DIR = path31.join(os13.homedir(), ".code-intel");
-var REPOS_FILE = path31.join(GLOBAL_DIR, "repos.json");
+var GLOBAL_DIR = path32.join(os13.homedir(), ".code-intel");
+var REPOS_FILE = path32.join(GLOBAL_DIR, "repos.json");
 function loadRegistry() {
   try {
-    const data = fs24.readFileSync(REPOS_FILE, "utf-8");
+    const data = fs25.readFileSync(REPOS_FILE, "utf-8");
     return JSON.parse(data);
   } catch {
     return [];
   }
 }
 function saveRegistry(entries) {
-  fs24.mkdirSync(GLOBAL_DIR, { recursive: true });
-  fs24.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
+  fs25.mkdirSync(GLOBAL_DIR, { recursive: true });
+  fs25.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
 }
 function upsertRepo(entry) {
   const entries = loadRegistry();
@@ -7142,30 +7430,30 @@ function removeRepo(repoPath) {
   saveRegistry(entries);
 }
 function saveMetadata(repoDir, metadata) {
-  const metaDir = path31.join(repoDir, ".code-intel");
-  fs24.mkdirSync(metaDir, { recursive: true });
-  fs24.writeFileSync(path31.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
+  const metaDir = path32.join(repoDir, ".code-intel");
+  fs25.mkdirSync(metaDir, { recursive: true });
+  fs25.writeFileSync(path32.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
 }
 function loadMetadata(repoDir) {
   try {
-    const data = fs24.readFileSync(path31.join(repoDir, ".code-intel", "meta.json"), "utf-8");
+    const data = fs25.readFileSync(path32.join(repoDir, ".code-intel", "meta.json"), "utf-8");
     return JSON.parse(data);
   } catch {
     return null;
   }
 }
 function getDbPath(repoDir) {
-  return path31.join(repoDir, ".code-intel", "graph.db");
+  return path32.join(repoDir, ".code-intel", "graph.db");
 }
 function getVectorDbPath(repoDir) {
-  return path31.join(repoDir, ".code-intel", "vector.db");
+  return path32.join(repoDir, ".code-intel", "vector.db");
 }
 
 // src/mcp-server/server.ts
 init_group_registry();
 
 // src/multi-repo/graph-from-db.ts
-var TABLE_TO_KIND = Object.fromEntries(
+var TABLE_TO_KIND2 = Object.fromEntries(
   Object.entries(NODE_TABLE_MAP).map(([kind, table]) => [table, kind])
 );
 function parseRow(row, kind) {
@@ -7189,7 +7477,7 @@ function parseRow(row, kind) {
 }
 async function loadGraphFromDB(graph, db) {
   for (const table of ALL_NODE_TABLES) {
-    const kind = TABLE_TO_KIND[table];
+    const kind = TABLE_TO_KIND2[table];
     if (!kind) continue;
     let rows = [];
     try {
@@ -7242,12 +7530,12 @@ function scanForFiles(root, matcher, maxDepth = 2) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs24.readdirSync(dir, { withFileTypes: true });
+      entries = fs25.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = path31.join(dir, entry.name);
+      const full = path32.join(dir, entry.name);
       if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
         walk(full, depth + 1);
       } else if (entry.isFile() && matcher(entry.name)) {
@@ -7270,8 +7558,8 @@ var OPENAPI_FILENAMES = /* @__PURE__ */ new Set([
 ]);
 var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options"];
 function tryParseFile(filePath) {
-  const ext = path31.extname(filePath).toLowerCase();
-  const content = fs24.readFileSync(filePath, "utf-8");
+  const ext = path32.extname(filePath).toLowerCase();
+  const content = fs25.readFileSync(filePath, "utf-8");
   if (ext === ".json") {
     try {
       return JSON.parse(content);
@@ -7325,7 +7613,7 @@ async function parseGraphQLContracts(repoRoot) {
   const files = scanForFiles(repoRoot, (name) => name.endsWith(".graphql") || name.endsWith(".gql"));
   const contracts = [];
   for (const filePath of files) {
-    const content = fs24.readFileSync(filePath, "utf-8");
+    const content = fs25.readFileSync(filePath, "utf-8");
     const typeRegex = /type\s+(\w+)\s*\{([^}]+)\}/g;
     let match;
     while ((match = typeRegex.exec(content)) !== null) {
@@ -7356,7 +7644,7 @@ async function parseProtoContracts(repoRoot) {
   const files = scanForFiles(repoRoot, (name) => name.endsWith(".proto"));
   const contracts = [];
   for (const filePath of files) {
-    const content = fs24.readFileSync(filePath, "utf-8");
+    const content = fs25.readFileSync(filePath, "utf-8");
     const serviceRegex = /service\s+(\w+)\s*\{([^}]+)\}/g;
     let serviceMatch;
     while ((serviceMatch = serviceRegex.exec(content)) !== null) {
@@ -7561,13 +7849,13 @@ async function syncGroup(group) {
       logger_default.warn(`  \u26A0 Registry entry "${member.registryName}" not found \u2014 skipping ${member.groupPath}`);
       continue;
     }
-    const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs24.existsSync(dbPath)) {
+    const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs25.existsSync(dbPath)) {
       logger_default.warn(`  \u26A0 No index at ${dbPath} \u2014 run \`code-intel analyze ${regEntry.path}\` first`);
       continue;
     }
     const graph = createKnowledgeGraph();
-    const db = new DbManager(dbPath);
+    const db = new DbManager(dbPath, true);
     try {
       await db.init();
       await loadGraphFromDB(graph, db);
@@ -7635,10 +7923,10 @@ async function queryGroup(group, query, limit = 20) {
   for (const member of group.members) {
     const regEntry = registry.find((r) => r.name === member.registryName);
     if (!regEntry) continue;
-    const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs24.existsSync(dbPath)) continue;
+    const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs25.existsSync(dbPath)) continue;
     const graph = createKnowledgeGraph();
-    const db = new DbManager(dbPath);
+    const db = new DbManager(dbPath, true);
     try {
       await db.init();
       await loadGraphFromDB(graph, db);
@@ -8136,22 +8424,22 @@ function suggestTests(graph, symbolName) {
   const callPaths = [];
   const pathQueue = [{ id: targetId, path: [symbolName], depth: 0 }];
   while (pathQueue.length > 0 && callPaths.length < 5) {
-    const { id, path: path32, depth } = pathQueue.shift();
+    const { id, path: path33, depth } = pathQueue.shift();
     let hasCallers2 = false;
     for (const edge of graph.findEdgesTo(id)) {
       if (edge.kind !== "calls") continue;
       const callerNode = graph.getNode(edge.source);
       if (!callerNode) continue;
       hasCallers2 = true;
-      const newPath = [callerNode.name, ...path32];
+      const newPath = [callerNode.name, ...path33];
       if (depth + 1 >= 3 || callPaths.length >= 5) {
         if (callPaths.length < 5) callPaths.push(newPath);
         continue;
       }
       pathQueue.push({ id: edge.source, path: newPath, depth: depth + 1 });
     }
-    if (!hasCallers2 && path32.length > 1) {
-      callPaths.push(path32);
+    if (!hasCallers2 && path33.length > 1) {
+      callPaths.push(path33);
     }
   }
   if (callPaths.length === 0) {
@@ -8708,24 +8996,44 @@ function createMcpServer(graph, repoName, workspaceRoot) {
     }
     const startMs = Date.now();
     const dispatch = () => dispatchTool(name, a, graph, repoName, workspaceRoot);
+    const MCP_TIMEOUT_MS = parseInt(process.env["CODE_INTEL_MCP_TIMEOUT_MS"] ?? "30000", 10);
+    let timeoutHandle = null;
+    let timedOut = false;
+    const timeoutPromise = new Promise((_, reject) => {
+      timeoutHandle = setTimeout(() => {
+        timedOut = true;
+        reject(new Error(`MCP tool '${name}' timed out after ${MCP_TIMEOUT_MS}ms`));
+      }, MCP_TIMEOUT_MS);
+    });
     let result;
     let status = "success";
     try {
       if (isTracingEnabled()) {
-        result = await withSpan(
-          `mcp.tool.${name}`,
-          sanitizeAttrs({ "mcp.tool": name, "mcp.repo": repoName }),
-          dispatch
-        );
+        result = await Promise.race([
+          withSpan(
+            `mcp.tool.${name}`,
+            sanitizeAttrs({ "mcp.tool": name, "mcp.repo": repoName }),
+            dispatch
+          ),
+          timeoutPromise
+        ]);
       } else {
-        result = await dispatch();
+        result = await Promise.race([dispatch(), timeoutPromise]);
       }
       if (result.isError) status = "error";
     } catch (err) {
       status = "error";
       mcpToolCallsTotal.inc({ tool: name, status });
       mcpToolDurationSeconds.observe({ tool: name }, (Date.now() - startMs) / 1e3);
+      if (timedOut) {
+        return {
+          content: [{ type: "text", text: JSON.stringify({ truncated: true, reason: `Tool '${name}' timed out after ${MCP_TIMEOUT_MS}ms`, partialResults: [] }) }],
+          isError: false
+        };
+      }
       throw err;
+    } finally {
+      if (timeoutHandle) clearTimeout(timeoutHandle);
     }
     mcpToolCallsTotal.inc({ tool: name, status });
     mcpToolDurationSeconds.observe({ tool: name }, (Date.now() - startMs) / 1e3);
@@ -9113,7 +9421,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       for (const { filePath: changedFile, changedLines } of changedFiles) {
         for (const node of graph.allNodes()) {
           if (!node.filePath) continue;
-          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path31.sep, "");
+          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path32.sep, "");
           const normChanged = changedFile.replace(/^a\/|^b\//, "");
           if (!normNode.endsWith(normChanged) && !normChanged.endsWith(normNode)) continue;
           if (node.startLine !== void 0 && node.endLine !== void 0) {
@@ -9536,8 +9844,8 @@ var STUCK_THRESHOLD_MINUTES = 30;
 var JobsDB = class {
   db;
   constructor(dbPath) {
-    fs24.mkdirSync(path31.dirname(dbPath), { recursive: true });
-    this.db = new Database3(dbPath);
+    fs25.mkdirSync(path32.dirname(dbPath), { recursive: true });
+    this.db = new Database2(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("foreign_keys = ON");
     this.createTables();
@@ -9678,7 +9986,7 @@ var JobsDB = class {
   }
 };
 function getJobsDBPath() {
-  return path31.join(os13.homedir(), ".code-intel", "jobs.db");
+  return path32.join(os13.homedir(), ".code-intel", "jobs.db");
 }
 var _jobsDB = null;
 function getOrCreateJobsDB() {
@@ -9770,7 +10078,7 @@ var BACKUP_VERSION = "1.0";
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 function getBackupDir() {
-  return path31.join(os13.homedir(), ".code-intel", "backups");
+  return path32.join(os13.homedir(), ".code-intel", "backups");
 }
 function getBackupKey() {
   const keyHex = process.env["CODE_INTEL_BACKUP_KEY"];
@@ -9801,30 +10109,30 @@ var BackupService = class {
   constructor(backupDir) {
     this.backupDir = backupDir ?? getBackupDir();
     this.key = getBackupKey();
-    fs24.mkdirSync(this.backupDir, { recursive: true });
+    fs25.mkdirSync(this.backupDir, { recursive: true });
   }
   /**
    * Create a backup for a repository.
    * Returns the backup entry.
    */
   createBackup(repoPath) {
-    const codeIntelDir = path31.join(repoPath, ".code-intel");
+    const codeIntelDir = path32.join(repoPath, ".code-intel");
     const id = v4();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
     const filesToBackup = [];
     const candidates = ["graph.db", "vector.db", "meta.json"];
     for (const f of candidates) {
-      const fp = path31.join(codeIntelDir, f);
-      if (fs24.existsSync(fp)) {
+      const fp = path32.join(codeIntelDir, f);
+      if (fs25.existsSync(fp)) {
         filesToBackup.push({ name: f, localPath: fp });
       }
     }
-    const registryPath = path31.join(os13.homedir(), ".code-intel", "registry.json");
-    if (fs24.existsSync(registryPath)) {
+    const registryPath = path32.join(os13.homedir(), ".code-intel", "registry.json");
+    if (fs25.existsSync(registryPath)) {
       filesToBackup.push({ name: "registry.json", localPath: registryPath });
     }
-    const usersDbPath = path31.join(os13.homedir(), ".code-intel", "users.db");
-    if (fs24.existsSync(usersDbPath)) {
+    const usersDbPath = path32.join(os13.homedir(), ".code-intel", "users.db");
+    if (fs25.existsSync(usersDbPath)) {
       filesToBackup.push({ name: "users.db", localPath: usersDbPath });
     }
     if (filesToBackup.length === 0) {
@@ -9835,7 +10143,7 @@ var BackupService = class {
       createdAt,
       version: BACKUP_VERSION,
       files: filesToBackup.map((f) => {
-        const data = fs24.readFileSync(f.localPath);
+        const data = fs25.readFileSync(f.localPath);
         return {
           name: f.name,
           sha256: crypto5.createHash("sha256").update(data).digest("hex"),
@@ -9849,7 +10157,7 @@ var BackupService = class {
     manifestLenBuf.writeUInt32BE(manifestBuf.length, 0);
     parts.push(manifestLenBuf, manifestBuf);
     for (const f of filesToBackup) {
-      const data = fs24.readFileSync(f.localPath);
+      const data = fs25.readFileSync(f.localPath);
       const nameBuf = Buffer.from(f.name, "utf-8");
       const nameLenBuf = Buffer.alloc(2);
       nameLenBuf.writeUInt16BE(nameBuf.length, 0);
@@ -9860,8 +10168,8 @@ var BackupService = class {
     const plaintext = Buffer.concat(parts);
     const encrypted = encryptBuffer(plaintext, this.key);
     const backupFileName = `backup-${id}.cib`;
-    const backupPath = path31.join(this.backupDir, backupFileName);
-    fs24.writeFileSync(backupPath, encrypted);
+    const backupPath = path32.join(this.backupDir, backupFileName);
+    fs25.writeFileSync(backupPath, encrypted);
     const entry = {
       id,
       createdAt,
@@ -9888,9 +10196,9 @@ var BackupService = class {
   async uploadToS3(entry) {
     const cfg = getS3Config();
     if (!cfg) throw new Error("S3 not configured. Set CODE_INTEL_BACKUP_S3_BUCKET, CODE_INTEL_BACKUP_S3_ACCESS_KEY_ID, CODE_INTEL_BACKUP_S3_SECRET_ACCESS_KEY.");
-    const fileName = path31.basename(entry.path);
+    const fileName = path32.basename(entry.path);
     const s3Key = `${cfg.prefix}${fileName}`;
-    const body = fs24.readFileSync(entry.path);
+    const body = fs25.readFileSync(entry.path);
     const result = await s3Request({ method: "PUT", cfg, key: s3Key, body });
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 upload failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
@@ -9907,8 +10215,8 @@ var BackupService = class {
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 download failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
     }
-    fs24.mkdirSync(path31.dirname(destPath), { recursive: true });
-    fs24.writeFileSync(destPath, Buffer.from(result.body, "binary"));
+    fs25.mkdirSync(path32.dirname(destPath), { recursive: true });
+    fs25.writeFileSync(destPath, Buffer.from(result.body, "binary"));
   }
   /**
    * List backup objects in S3 with the configured prefix.
@@ -9954,10 +10262,10 @@ var BackupService = class {
     if (!entry) {
       throw new Error(`Backup "${backupId}" not found.`);
     }
-    if (!fs24.existsSync(entry.path)) {
+    if (!fs25.existsSync(entry.path)) {
       throw new Error(`Backup file not found at: ${entry.path}`);
     }
-    const encrypted = fs24.readFileSync(entry.path);
+    const encrypted = fs25.readFileSync(entry.path);
     let plaintext;
     try {
       plaintext = decryptBuffer(encrypted, this.key);
@@ -9971,8 +10279,8 @@ var BackupService = class {
     offset += manifestLen;
     const manifest = JSON.parse(manifestStr);
     const restoreBase = targetRepoPath ?? entry.repoPath;
-    const codeIntelDir = path31.join(restoreBase, ".code-intel");
-    fs24.mkdirSync(codeIntelDir, { recursive: true });
+    const codeIntelDir = path32.join(restoreBase, ".code-intel");
+    fs25.mkdirSync(codeIntelDir, { recursive: true });
     for (const fileEntry of manifest.files) {
       const nameLen = plaintext.readUInt16BE(offset);
       offset += 2;
@@ -9989,18 +10297,18 @@ var BackupService = class {
       }
       let destPath;
       if (name === "registry.json" || name === "users.db") {
-        destPath = path31.join(os13.homedir(), ".code-intel", name);
+        destPath = path32.join(os13.homedir(), ".code-intel", name);
       } else {
-        destPath = path31.join(codeIntelDir, name);
+        destPath = path32.join(codeIntelDir, name);
       }
-      fs24.writeFileSync(destPath, data);
+      fs25.writeFileSync(destPath, data);
     }
   }
   /**
    * Apply retention policy: keep N daily, M weekly, L monthly backups.
    */
   applyRetention(options = { daily: 7, weekly: 4, monthly: 12 }) {
-    const entries = this._loadIndex().filter((e) => fs24.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    const entries = this._loadIndex().filter((e) => fs25.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
     const keep = /* @__PURE__ */ new Set();
     const now = /* @__PURE__ */ new Date();
     const dailyCutoff = new Date(now);
@@ -10030,7 +10338,7 @@ var BackupService = class {
     for (const e of entries) {
       if (!keep.has(e.id)) {
         try {
-          fs24.unlinkSync(e.path);
+          fs25.unlinkSync(e.path);
           deleted++;
         } catch {
         }
@@ -10042,17 +10350,17 @@ var BackupService = class {
   }
   // ── Index helpers ──────────────────────────────────────────────────────────
   _indexPath() {
-    return path31.join(this.backupDir, "index.json");
+    return path32.join(this.backupDir, "index.json");
   }
   _loadIndex() {
     try {
-      return JSON.parse(fs24.readFileSync(this._indexPath(), "utf-8"));
+      return JSON.parse(fs25.readFileSync(this._indexPath(), "utf-8"));
     } catch {
       return [];
     }
   }
   _saveIndex(entries) {
-    fs24.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
+    fs25.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
   }
   _appendIndex(entry) {
     const entries = this._loadIndex();
@@ -10845,11 +11153,11 @@ var openApiSpec = {
 };
 
 // src/http/app.ts
-var __dirname$1 = path31.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path32.dirname(fileURLToPath(import.meta.url));
 var WEB_DIST = (() => {
-  const bundled = path31.resolve(__dirname$1, "..", "web");
-  if (fs24.existsSync(bundled)) return bundled;
-  return path31.resolve(__dirname$1, "..", "..", "..", "web", "dist");
+  const bundled = path32.resolve(__dirname$1, "..", "web");
+  if (fs25.existsSync(bundled)) return bundled;
+  return path32.resolve(__dirname$1, "..", "..", "..", "web", "dist");
 })();
 function getAllowedOrigins() {
   const env = process.env["CODE_INTEL_CORS_ORIGINS"];
@@ -10858,13 +11166,17 @@ function getAllowedOrigins() {
 }
 function createDefaultLimiter() {
   const max = parseInt(process.env["CODE_INTEL_RATE_LIMIT_MAX"] ?? "100", 10);
-  const windowMs = parseInt(process.env["CODE_INTEL_RATE_LIMIT_WINDOW_MS"] ?? `${15 * 60 * 1e3}`, 10);
+  const windowMs = parseInt(process.env["CODE_INTEL_RATE_LIMIT_WINDOW_MS"] ?? `${60 * 1e3}`, 10);
   return rateLimit({
     windowMs,
     max,
     standardHeaders: true,
     legacyHeaders: false,
-    skip: (req) => req.path.startsWith("/health") || req.path === "/metrics",
+    // Skip health checks, metrics, and read-only listing/pagination endpoints.
+    // The node pagination and group/repo listing endpoints are hit many times
+    // when loading a large graph — rate-limiting them only hurts the user's own
+    // session without providing meaningful abuse protection.
+    skip: (req) => req.path.startsWith("/health") || req.path === "/metrics" || req.path === "/api/v1/repos" || req.path === "/api/v1/groups" || req.method === "GET" && req.path.startsWith("/api/v1/groups/") || /^\/api\/v1\/graph\/[^/]+\/nodes$/.test(req.path),
     message: {
       error: {
         code: ErrorCodes.RATE_LIMIT_EXCEEDED,
@@ -10923,12 +11235,31 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
   });
   app.use(requestIdMiddleware);
   app.use(authMiddleware);
+  let dbUnavailableSince = null;
   app.use((_req, res, next) => {
     if (workspaceRoot) {
+      const metaFilePath = path32.join(workspaceRoot, ".code-intel", "meta.json");
+      let metaOk = false;
       try {
-        const meta = loadMetadata(workspaceRoot);
-        if (meta?.indexVersion) res.setHeader("X-Index-Version", meta.indexVersion);
-      } catch {
+        if (fs25.existsSync(metaFilePath)) {
+          const raw = fs25.readFileSync(metaFilePath, "utf-8");
+          const meta = JSON.parse(raw);
+          if (meta?.indexVersion) res.setHeader("X-Index-Version", meta.indexVersion);
+        }
+        metaOk = true;
+        if (dbUnavailableSince !== null) {
+          dbUnavailableSince = null;
+          logger_default.info("[serve] DB back online \u2014 cleared stale flag");
+        }
+      } catch (err) {
+        if (dbUnavailableSince === null) {
+          dbUnavailableSince = (/* @__PURE__ */ new Date()).toISOString();
+          logger_default.warn(`[serve] DB unavailable since ${dbUnavailableSince}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      if (!metaOk) {
+        res.setHeader("X-Stale", "true");
+        res.setHeader("X-Stale-Since", dbUnavailableSince);
       }
     }
     next();
@@ -10984,6 +11315,21 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
   let vectorIndex = null;
   let vectorIndexBuilding = false;
   let vectorIndexReady = false;
+  let bm25Index = null;
+  function ensureBm25Index() {
+    if (bm25Index) return bm25Index;
+    if (!workspaceRoot) return null;
+    const idx = new Bm25Index(getBm25DbPath(workspaceRoot));
+    idx.load();
+    if (idx.isLoaded) {
+      bm25Index = idx;
+      return idx;
+    }
+    return null;
+  }
+  if (workspaceRoot && process.env["NODE_ENV"] !== "test") {
+    setImmediate(() => ensureBm25Index());
+  }
   async function ensureVectorIndex() {
     if (vectorIndexReady && vectorIndex) return vectorIndex;
     if (!workspaceRoot || vectorIndexBuilding) return null;
@@ -11380,10 +11726,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const registry = loadRegistry();
     const entry = registry.find((r) => r.name === requestedRepo || r.path === requestedRepo);
     if (!entry) return null;
-    const dbPath = path31.join(entry.path, ".code-intel", "graph.db");
-    if (!fs24.existsSync(dbPath)) return null;
+    const dbPath = path32.join(entry.path, ".code-intel", "graph.db");
+    if (!fs25.existsSync(dbPath)) return null;
     const repoGraph = createKnowledgeGraph();
-    const db = new DbManager(dbPath);
+    const db = new DbManager(dbPath, true);
     try {
       await db.init();
       await loadGraphFromDB(repoGraph, db);
@@ -11394,10 +11740,33 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       return null;
     }
   }
+  async function loadGroupGraph(groupName) {
+    const group = loadGroup(groupName);
+    if (!group) return null;
+    const registry = loadRegistry();
+    const mergedGraph = createKnowledgeGraph();
+    for (const member of group.members) {
+      const regEntry = registry.find((r) => r.name === member.registryName);
+      if (!regEntry) continue;
+      const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+      if (!fs25.existsSync(dbPath)) continue;
+      const db = new DbManager(dbPath, true);
+      try {
+        await db.init();
+        await loadGraphFromDB(mergedGraph, db);
+        db.close();
+      } catch {
+        db.close();
+      }
+    }
+    return mergedGraph.size.nodes > 0 ? mergedGraph : null;
+  }
   async function getGraphForRepo(requestedRepo) {
     if (!requestedRepo || requestedRepo === repoName) return graph;
     const g = await loadRepoGraph(requestedRepo);
-    return g ?? graph;
+    if (g) return g;
+    const gg = await loadGroupGraph(requestedRepo);
+    return gg ?? graph;
   }
   app.get("/api/v1/graph/:repo", requireRepoAccess((req) => {
     const p = req.params["repo"];
@@ -11421,11 +11790,56 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     }
     res.json({ nodes: [...g.allNodes()], edges: [...g.allEdges()] });
   });
+  app.get("/api/v1/graph/:repo/nodes", requireRepoAccess((req) => {
+    const p = req.params["repo"];
+    const repo = Array.isArray(p) ? p[0] : p;
+    return repo ? decodeURIComponent(repo) : void 0;
+  }), async (req, res) => {
+    const rawRepo = req.params["repo"];
+    const requestedRepo = decodeURIComponent(Array.isArray(rawRepo) ? rawRepo[0] ?? "" : rawRepo ?? "");
+    const limit = Math.min(parseInt(req.query["limit"] ?? "200", 10), 1e3);
+    const offset = Math.max(parseInt(req.query["offset"] ?? "0", 10), 0);
+    const g = requestedRepo === repoName ? graph : await loadRepoGraph(requestedRepo);
+    if (!g) {
+      res.status(404).json({
+        error: {
+          code: ErrorCodes.NOT_FOUND,
+          message: `Repo "${requestedRepo}" not found or not indexed`,
+          hint: `Run: code-intel analyze <path>`,
+          requestId: req.requestId,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+      return;
+    }
+    let nodes;
+    if (isLazyGraph(g)) {
+      nodes = await g.getNodePage(offset, limit);
+    } else {
+      const eager = g;
+      if (!eager._nodeArray) {
+        eager._nodeArray = [...g.allNodes()];
+      }
+      nodes = eager._nodeArray.slice(offset, offset + limit);
+    }
+    res.json({
+      nodes,
+      offset,
+      limit,
+      total: g.size.nodes,
+      hasMore: offset + nodes.length < g.size.nodes
+    });
+  });
   app.post("/api/v1/search", requireToolScope("search"), async (req, res) => {
     const { query, limit, repo } = req.body;
     const g = await getGraphForRepo(repo);
     const vdbPath = workspaceRoot ? getVectorDbPath(workspaceRoot) : void 0;
-    const { results, searchMode } = await hybridSearch(g, query ?? "", limit ?? 20, { vectorDbPath: vdbPath });
+    const bm25 = !repo || repo === repoName ? ensureBm25Index() : null;
+    const bm25Results = bm25 ? bm25.search(query ?? "", (limit ?? 20) * 3) : null;
+    const { results, searchMode } = await hybridSearch(g, query ?? "", limit ?? 20, {
+      vectorDbPath: vdbPath,
+      bm25Results: bm25Results ?? void 0
+    });
     res.json({ results, searchMode });
   });
   app.post("/api/v1/vector-search", async (req, res) => {
@@ -11468,7 +11882,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       return;
     }
     try {
-      const content = fs24.readFileSync(file_path, "utf-8");
+      const content = fs25.readFileSync(file_path, "utf-8");
       res.json({ content });
     } catch {
       res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: "File not found" } });
@@ -11505,7 +11919,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     if (workspaceRoot) {
       try {
         const dbPath = getDbPath(workspaceRoot);
-        const dbm = new DbManager(dbPath);
+        const dbm = new DbManager(dbPath, true);
         await dbm.init();
         const rows = await dbm.query(q);
         dbm.close();
@@ -11546,33 +11960,53 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
   app.get("/api/v1/nodes/:id", async (req, res) => {
     const nodeId = decodeURIComponent(req.params.id);
     const g = await getGraphForRepo(req.query["repo"]);
-    const node = g.getNode(nodeId);
+    const node = isLazyGraph(g) ? await g.getNodeAsync(nodeId) : g.getNode(nodeId);
     if (!node) {
       res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: "Node not found", requestId: req.requestId } });
       return;
     }
     const incoming = [...g.findEdgesTo(nodeId)];
     const outgoing = [...g.findEdgesFrom(nodeId)];
+    const resolveName = isLazyGraph(g) ? async (id) => {
+      const n = g.getNode(id) ?? await g.getNodeAsync(id);
+      return n?.name;
+    } : (id) => Promise.resolve(g.getNode(id)?.name);
+    const resolveKind = isLazyGraph(g) ? async (id) => {
+      const n = g.getNode(id) ?? await g.getNodeAsync(id);
+      return n?.kind;
+    } : (id) => Promise.resolve(g.getNode(id)?.kind);
     res.json({
       node,
-      callers: incoming.filter((e) => e.kind === "calls").map((e) => ({ id: e.source, name: g.getNode(e.source)?.name, weight: e.weight })),
-      callees: outgoing.filter((e) => e.kind === "calls").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name, weight: e.weight })),
-      imports: outgoing.filter((e) => e.kind === "imports").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name })),
-      importedBy: incoming.filter((e) => e.kind === "imports").map((e) => ({ id: e.source, name: g.getNode(e.source)?.name })),
-      extends: outgoing.filter((e) => e.kind === "extends").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name })),
-      implementsEdges: outgoing.filter((e) => e.kind === "implements").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name })),
-      members: outgoing.filter((e) => e.kind === "has_member").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name, kind: g.getNode(e.target)?.kind })),
-      cluster: incoming.filter((e) => e.kind === "belongs_to").map((e) => g.getNode(e.target)?.name)[0]
+      callers: await Promise.all(incoming.filter((e) => e.kind === "calls").map(async (e) => ({ id: e.source, name: await resolveName(e.source), weight: e.weight }))),
+      callees: await Promise.all(outgoing.filter((e) => e.kind === "calls").map(async (e) => ({ id: e.target, name: await resolveName(e.target), weight: e.weight }))),
+      imports: await Promise.all(outgoing.filter((e) => e.kind === "imports").map(async (e) => ({ id: e.target, name: await resolveName(e.target) }))),
+      importedBy: await Promise.all(incoming.filter((e) => e.kind === "imports").map(async (e) => ({ id: e.source, name: await resolveName(e.source) }))),
+      extends: await Promise.all(outgoing.filter((e) => e.kind === "extends").map(async (e) => ({ id: e.target, name: await resolveName(e.target) }))),
+      implementsEdges: await Promise.all(outgoing.filter((e) => e.kind === "implements").map(async (e) => ({ id: e.target, name: await resolveName(e.target) }))),
+      members: await Promise.all(outgoing.filter((e) => e.kind === "has_member").map(async (e) => ({ id: e.target, name: await resolveName(e.target), kind: await resolveKind(e.target) }))),
+      cluster: (await Promise.all(incoming.filter((e) => e.kind === "belongs_to").map(async (e) => resolveName(e.target))))[0]
     });
   });
   app.post("/api/v1/blast-radius", async (req, res) => {
     const { target, direction = "both", max_hops = 5, repo } = req.body;
     const g = await getGraphForRepo(repo);
     let targetNode = null;
-    for (const node of g.allNodes()) {
-      if (node.name === target || node.id === target) {
-        targetNode = node;
-        break;
+    if (isLazyGraph(g) && target) {
+      targetNode = g.getNode(target) ?? await g.getNodeAsync(target) ?? null;
+      if (!targetNode) {
+        for await (const node of g.allNodesAsync()) {
+          if (node.name === target || node.id === target) {
+            targetNode = node;
+            break;
+          }
+        }
+      }
+    } else {
+      for (const node of g.allNodes()) {
+        if (node.name === target || node.id === target) {
+          targetNode = node;
+          break;
+        }
       }
     }
     if (!targetNode) {
@@ -11726,9 +12160,9 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     for (const member of group.members) {
       const regEntry = registry.find((r) => r.name === member.registryName);
       if (!regEntry) continue;
-      const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
-      if (!fs24.existsSync(dbPath)) continue;
-      const db = new DbManager(dbPath);
+      const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+      if (!fs25.existsSync(dbPath)) continue;
+      const db = new DbManager(dbPath, true);
       try {
         await db.init();
         await loadGraphFromDB(mergedGraph, db);
@@ -11753,10 +12187,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       let nodeCount = 0;
       let edgeCount = 0;
       if (regEntry) {
-        const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
-        if (fs24.existsSync(dbPath)) {
+        const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+        if (fs25.existsSync(dbPath)) {
           try {
-            const db = new DbManager(dbPath);
+            const db = new DbManager(dbPath, true);
             await db.init();
             const g = createKnowledgeGraph();
             await loadGraphFromDB(g, db);
@@ -11779,7 +12213,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     res.json({ repos, edges });
   });
   app.get("/api/v1/source", requireAuth, requireRole("viewer"), (req, res) => {
-    const { file, startLine: startLineStr, endLine: endLineStr } = req.query;
+    const { file, startLine: startLineStr, endLine: endLineStr, repo } = req.query;
     if (!file) {
       res.status(400).json({
         error: {
@@ -11803,14 +12237,36 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       });
       return;
     }
-    let rawResolved = path31.normalize(file);
-    if (!path31.isAbsolute(rawResolved) && workspaceRoot) {
-      rawResolved = path31.join(workspaceRoot, rawResolved);
+    let baseDir = workspaceRoot;
+    if (repo && repo !== repoName) {
+      const registry = loadRegistry();
+      const entry = registry.find((r) => r.name === repo || r.path === repo);
+      if (entry) {
+        baseDir = entry.path;
+      } else {
+        const group = loadGroup(repo);
+        if (group) {
+          const normalizedFile = path32.normalize(file);
+          for (const member of group.members) {
+            const regEntry = registry.find((r) => r.name === member.registryName);
+            if (!regEntry) continue;
+            const candidate = path32.resolve(path32.join(regEntry.path, normalizedFile));
+            if (fs25.existsSync(candidate)) {
+              baseDir = regEntry.path;
+              break;
+            }
+          }
+        }
+      }
+    }
+    let rawResolved = path32.normalize(file);
+    if (!path32.isAbsolute(rawResolved) && baseDir) {
+      rawResolved = path32.join(baseDir, rawResolved);
     }
-    const resolvedFile = path31.resolve(rawResolved);
+    const resolvedFile = path32.resolve(rawResolved);
     function isInsideDir(fileAbs, dir) {
-      const rel = path31.relative(path31.resolve(dir), fileAbs);
-      return !rel.startsWith("..") && !path31.isAbsolute(rel);
+      const rel = path32.relative(path32.resolve(dir), fileAbs);
+      return !rel.startsWith("..") && !path32.isAbsolute(rel);
     }
     if (workspaceRoot) {
       if (!isInsideDir(resolvedFile, workspaceRoot)) {
@@ -11847,7 +12303,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     }
     let fileContent;
     try {
-      fileContent = fs24.readFileSync(resolvedFile, "utf-8");
+      fileContent = fs25.readFileSync(resolvedFile, "utf-8");
     } catch {
       res.status(404).json({
         error: {
@@ -11878,7 +12334,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const contextStart = Math.max(1, startLine - 20);
     const contextEnd = Math.min(lines.length, endLine + 20);
     const content = lines.slice(contextStart - 1, contextEnd).join("\n");
-    const ext = path31.extname(resolvedFile).toLowerCase();
+    const ext = path32.extname(resolvedFile).toLowerCase();
     const languageMap = {
       ".ts": "typescript",
       ".tsx": "typescript",
@@ -12013,10 +12469,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       res.status(500).json({ error: { code: ErrorCodes.INTERNAL_ERROR, message: err instanceof Error ? err.message : String(err), requestId: req.requestId, timestamp: (/* @__PURE__ */ new Date()).toISOString() } });
     }
   });
-  if (fs24.existsSync(WEB_DIST)) {
+  if (fs25.existsSync(WEB_DIST)) {
     app.use(express.static(WEB_DIST));
     app.get("/{*path}", (_req, res) => {
-      res.sendFile(path31.join(WEB_DIST, "index.html"));
+      res.sendFile(path32.join(WEB_DIST, "index.html"));
     });
   }
   app.use("/admin", requireRole("admin"));
@@ -12176,6 +12632,6 @@ function mergeSearchResults(...perRepoResults) {
   return reciprocalRankFusion(...perRepoResults);
 }
 
-export { AstCache, BindingTracker, DbManager, addBinding, addClustersToGraph, addMember, buildCallEdges, buildHeritageEdges, classifyCall, clusterPhase, computeMRO, createApp, createKnowledgeGraph, createMcpServer, createScope, deleteGroup, detectCommunities, detectOverrides, findEntryPoints, flowPhase, generateEdgeId, generateNodeId, getAllLanguageModules, getDbPath, getLanguage, getLanguageModule, getParser, groupExists, initParser, isTreeSitterAvailable, listGroups, loadGraphToDB, loadGroup, loadMetadata, loadRegistry, loadSyncResult, mergeSearchResults, parsePhase, parseSource, queryGroup, reciprocalRankFusion, removeMember, removeRepo, resolveBinding, resolveImports, resolvePhase, runPipeline, runQuery, runQueryMatches, saveGroup, saveMetadata, saveSyncResult, scanPhase, startHttpServer, startMcpStdio, structurePhase, syncGroup, textSearch, topologicalSort, traceFlow, upsertRepo, validateDAG };
+export { AstCache, BindingTracker, Bm25Index, DbManager, addBinding, addClustersToGraph, addMember, buildCallEdges, buildHeritageEdges, classifyCall, clusterPhase, computeMRO, createApp, createKnowledgeGraph, createMcpServer, createScope, deleteGroup, detectCommunities, detectOverrides, findEntryPoints, flowPhase, generateEdgeId, generateNodeId, getAllLanguageModules, getBm25DbPath, getDbPath, getLanguage, getLanguageModule, getParser, groupExists, initParser, isTreeSitterAvailable, listGroups, loadGraphToDB, loadGroup, loadMetadata, loadRegistry, loadSyncResult, mergeSearchResults, parsePhase, parseSource, queryGroup, reciprocalRankFusion, removeMember, removeRepo, resolveBinding, resolveImports, resolvePhase, runPipeline, runQuery, runQueryMatches, saveGroup, saveMetadata, saveSyncResult, scanPhase, startHttpServer, startMcpStdio, structurePhase, syncGroup, textSearch, topologicalSort, traceFlow, upsertRepo, validateDAG };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map