@vohongtho.infotech/code-intel 0.9.0 → 1.0.1

package/dist/index.js

@@ -1,8 +1,3 @@
-import { createRequire } from 'module';
-import { fileURLToPath } from 'url';
-import path31 from 'path';
-import fs24, { existsSync } from 'fs';
-import { Parser, Language, Query } from 'web-tree-sitter';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
@@ -11,9 +6,15 @@ import { SEMRESATTRS_DEPLOYMENT_ENVIRONMENT, SEMRESATTRS_SERVICE_NAME } from '@o
 import { trace, context, SpanStatusCode } from '@opentelemetry/api';
 import winston from 'winston';
 import DailyRotateFile from 'winston-daily-rotate-file';
+import fs26, { existsSync } from 'fs';
+import path32 from 'path';
 import os13 from 'os';
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import { Parser, Language, Query } from 'web-tree-sitter';
+import { Database, Connection } from '@ladybugdb/core';
 import { execSync } from 'child_process';
-import Database3 from 'better-sqlite3';
+import Database2 from 'better-sqlite3';
 import bcrypt from 'bcrypt';
 import crypto5 from 'crypto';
 import { v4 } from 'uuid';
@@ -24,7 +25,6 @@ import 'events';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-import { Database, Connection } from '@ladybugdb/core';
 import express from 'express';
 import compression from 'compression';
 import cors from 'cors';
@@ -56,6 +56,135 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/graph/knowledge-graph.ts
+var knowledge_graph_exports = {};
+__export(knowledge_graph_exports, {
+  createKnowledgeGraph: () => createKnowledgeGraph
+});
+function createKnowledgeGraph() {
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  const edgesByKind = /* @__PURE__ */ new Map();
+  const edgesFromNode = /* @__PURE__ */ new Map();
+  const edgesToNode = /* @__PURE__ */ new Map();
+  function indexEdge(edge) {
+    let kindSet = edgesByKind.get(edge.kind);
+    if (!kindSet) {
+      kindSet = /* @__PURE__ */ new Set();
+      edgesByKind.set(edge.kind, kindSet);
+    }
+    kindSet.add(edge.id);
+    let fromSet = edgesFromNode.get(edge.source);
+    if (!fromSet) {
+      fromSet = /* @__PURE__ */ new Set();
+      edgesFromNode.set(edge.source, fromSet);
+    }
+    fromSet.add(edge.id);
+    let toSet = edgesToNode.get(edge.target);
+    if (!toSet) {
+      toSet = /* @__PURE__ */ new Set();
+      edgesToNode.set(edge.target, toSet);
+    }
+    toSet.add(edge.id);
+  }
+  function unindexEdge(edge) {
+    edgesByKind.get(edge.kind)?.delete(edge.id);
+    edgesFromNode.get(edge.source)?.delete(edge.id);
+    edgesToNode.get(edge.target)?.delete(edge.id);
+  }
+  return {
+    addNode(node) {
+      nodes.set(node.id, node);
+    },
+    addEdge(edge) {
+      edges.set(edge.id, edge);
+      indexEdge(edge);
+    },
+    getNode(id) {
+      return nodes.get(id);
+    },
+    getEdge(id) {
+      return edges.get(id);
+    },
+    *findEdgesByKind(kind) {
+      const ids = edgesByKind.get(kind);
+      if (!ids) return;
+      for (const id of ids) {
+        const edge = edges.get(id);
+        if (edge) yield edge;
+      }
+    },
+    *findEdgesFrom(sourceId) {
+      const ids = edgesFromNode.get(sourceId);
+      if (!ids) return;
+      for (const id of ids) {
+        const edge = edges.get(id);
+        if (edge) yield edge;
+      }
+    },
+    *findEdgesTo(targetId) {
+      const ids = edgesToNode.get(targetId);
+      if (!ids) return;
+      for (const id of ids) {
+        const edge = edges.get(id);
+        if (edge) yield edge;
+      }
+    },
+    removeNodeCascade(id) {
+      const fromEdges = edgesFromNode.get(id);
+      if (fromEdges) {
+        for (const edgeId of [...fromEdges]) {
+          const edge = edges.get(edgeId);
+          if (edge) {
+            unindexEdge(edge);
+            edges.delete(edgeId);
+          }
+        }
+      }
+      const toEdges = edgesToNode.get(id);
+      if (toEdges) {
+        for (const edgeId of [...toEdges]) {
+          const edge = edges.get(edgeId);
+          if (edge) {
+            unindexEdge(edge);
+            edges.delete(edgeId);
+          }
+        }
+      }
+      edgesFromNode.delete(id);
+      edgesToNode.delete(id);
+      nodes.delete(id);
+    },
+    removeEdge(id) {
+      const edge = edges.get(id);
+      if (edge) {
+        unindexEdge(edge);
+        edges.delete(id);
+      }
+    },
+    *allNodes() {
+      yield* nodes.values();
+    },
+    *allEdges() {
+      yield* edges.values();
+    },
+    get size() {
+      return { nodes: nodes.size, edges: edges.size };
+    },
+    clear() {
+      nodes.clear();
+      edges.clear();
+      edgesByKind.clear();
+      edgesFromNode.clear();
+      edgesToNode.clear();
+    }
+  };
+}
+var init_knowledge_graph = __esm({
+  "src/graph/knowledge-graph.ts"() {
+  }
+});
+
 // src/graph/id-generator.ts
 function generateNodeId(kind, filePath, qualifiedName) {
   return `${kind}:${filePath}:${qualifiedName}`;
@@ -68,310 +197,701 @@ var init_id_generator = __esm({
   }
 });
 
-// src/shared/languages.ts
-var init_languages = __esm({
-  "src/shared/languages.ts"() {
-  }
-});
-
-// src/shared/detection.ts
-function detectLanguage(filePath) {
-  const ext = filePath.slice(filePath.lastIndexOf("."));
-  return EXTENSION_MAP[ext] ?? null;
+// src/storage/schema.ts
+function getCreateNodeTableDDL(tableName) {
+  return `CREATE NODE TABLE IF NOT EXISTS ${tableName} (
+  id STRING,
+  name STRING,
+  file_path STRING,
+  start_line INT64,
+  end_line INT64,
+  exported BOOLEAN,
+  content STRING,
+  metadata STRING,
+  PRIMARY KEY (id)
+)`;
 }
-function getSupportedExtensions() {
-  return Object.keys(EXTENSION_MAP);
+function getCreateEdgeTableDDL() {
+  const uniqueTables = ALL_NODE_TABLES;
+  const fromToPairs = [];
+  for (const from of uniqueTables) {
+    for (const to of uniqueTables) {
+      fromToPairs.push(`FROM ${from} TO ${to}`);
+    }
+  }
+  return [`CREATE REL TABLE GROUP IF NOT EXISTS code_edges (
+  ${fromToPairs.join(",\n  ")},
+  kind STRING,
+  weight DOUBLE,
+  label STRING
+)`];
 }
-var EXTENSION_MAP;
-var init_detection = __esm({
-  "src/shared/detection.ts"() {
-    init_languages();
-    EXTENSION_MAP = {
-      ".ts": "typescript" /* TypeScript */,
-      ".tsx": "typescript" /* TypeScript */,
-      ".mts": "typescript" /* TypeScript */,
-      ".cts": "typescript" /* TypeScript */,
-      ".js": "javascript" /* JavaScript */,
-      ".jsx": "javascript" /* JavaScript */,
-      ".mjs": "javascript" /* JavaScript */,
-      ".cjs": "javascript" /* JavaScript */,
-      ".py": "python" /* Python */,
-      ".pyi": "python" /* Python */,
-      ".java": "java" /* Java */,
-      ".go": "go" /* Go */,
-      ".c": "c" /* C */,
-      ".h": "c" /* C */,
-      ".cpp": "cpp" /* Cpp */,
-      ".cxx": "cpp" /* Cpp */,
-      ".cc": "cpp" /* Cpp */,
-      ".hpp": "cpp" /* Cpp */,
-      ".hxx": "cpp" /* Cpp */,
-      ".cs": "csharp" /* CSharp */,
-      ".rs": "rust" /* Rust */,
-      ".php": "php" /* PHP */,
-      ".kt": "kotlin" /* Kotlin */,
-      ".kts": "kotlin" /* Kotlin */,
-      ".rb": "ruby" /* Ruby */,
-      ".swift": "swift" /* Swift */,
-      ".dart": "dart" /* Dart */
+var NODE_TABLE_MAP, ALL_NODE_TABLES;
+var init_schema = __esm({
+  "src/storage/schema.ts"() {
+    NODE_TABLE_MAP = {
+      file: "file_nodes",
+      directory: "dir_nodes",
+      function: "func_nodes",
+      class: "class_nodes",
+      interface: "iface_nodes",
+      method: "method_nodes",
+      constructor: "ctor_nodes",
+      variable: "var_nodes",
+      property: "prop_nodes",
+      struct: "struct_nodes",
+      enum: "enum_nodes",
+      trait: "trait_nodes",
+      namespace: "ns_nodes",
+      module: "mod_nodes",
+      type_alias: "type_nodes",
+      constant: "const_nodes",
+      route: "route_nodes",
+      cluster: "cluster_nodes",
+      flow: "flow_nodes",
+      vulnerability: "vuln_nodes"
     };
+    ALL_NODE_TABLES = [...new Set(Object.values(NODE_TABLE_MAP))];
   }
 });
 
-// src/shared/index.ts
-var init_shared = __esm({
-  "src/shared/index.ts"() {
-    init_languages();
-    init_detection();
-  }
+// src/observability/tracing.ts
+var tracing_exports = {};
+__export(tracing_exports, {
+  SpanStatusCode: () => SpanStatusCode,
+  context: () => context,
+  getActiveTraceContext: () => getActiveTraceContext,
+  getTracer: () => getTracer,
+  initTracing: () => initTracing,
+  isTracingEnabled: () => isTracingEnabled,
+  sanitizeAttrs: () => sanitizeAttrs,
+  shutdownTracing: () => shutdownTracing,
+  trace: () => trace,
+  withSpan: () => withSpan
 });
-function findBundledWasmDir() {
-  const fileDir = path31.dirname(fileURLToPath(import.meta.url));
-  const candidates = [
-    path31.join(fileDir, "wasm"),
-    // dist/index.js → dist/wasm/
-    path31.join(fileDir, "../wasm")
-    // dist/cli/main.js → dist/wasm/
-  ];
-  for (const candidate of candidates) {
-    if (existsSync(candidate)) return candidate;
-  }
-  return candidates[0];
+function isTracingEnabled() {
+  return process.env["CODE_INTEL_OTEL_ENABLED"] === "true";
 }
-function wasmPath(lang) {
-  const WASM_PACKAGE_MAP = {
-    ["typescript" /* TypeScript */]: "tree-sitter-typescript/tree-sitter-typescript.wasm",
-    ["javascript" /* JavaScript */]: "tree-sitter-javascript/tree-sitter-javascript.wasm",
-    ["python" /* Python */]: "tree-sitter-python/tree-sitter-python.wasm",
-    ["java" /* Java */]: "tree-sitter-java/tree-sitter-java.wasm",
-    ["go" /* Go */]: "tree-sitter-go/tree-sitter-go.wasm",
-    ["c" /* C */]: "tree-sitter-c/tree-sitter-c.wasm",
-    ["cpp" /* Cpp */]: "tree-sitter-cpp/tree-sitter-cpp.wasm",
-    ["csharp" /* CSharp */]: "tree-sitter-c-sharp/tree-sitter-c_sharp.wasm",
-    ["rust" /* Rust */]: "tree-sitter-rust/tree-sitter-rust.wasm",
-    ["php" /* PHP */]: "tree-sitter-php/tree-sitter-php.wasm",
-    ["ruby" /* Ruby */]: "tree-sitter-ruby/tree-sitter-ruby.wasm",
-    // These are optional dependencies; their packages may or may not include
-    // a WASM.  If require.resolve fails we fall back to the bundled wasm/.
-    ["swift" /* Swift */]: "tree-sitter-swift/tree-sitter-swift.wasm",
-    ["kotlin" /* Kotlin */]: "tree-sitter-kotlin/tree-sitter-kotlin.wasm",
-    ["dart" /* Dart */]: "tree-sitter-dart/tree-sitter-dart.wasm"
-  };
-  const BUNDLED_WASM_MAP = {
-    ["swift" /* Swift */]: "tree-sitter-swift.wasm",
-    ["kotlin" /* Kotlin */]: "tree-sitter-kotlin.wasm",
-    ["dart" /* Dart */]: "tree-sitter-dart.wasm"
-  };
-  const relative = WASM_PACKAGE_MAP[lang];
-  if (relative) {
-    try {
-      return _require.resolve(relative);
-    } catch {
-    }
-  }
-  const bundled = BUNDLED_WASM_MAP[lang];
-  if (bundled) {
-    const bundledPath = path31.join(_bundledWasmDir, bundled);
-    if (existsSync(bundledPath)) return bundledPath;
-  }
-  return null;
-}
-async function initParser() {
-  if (!initPromise) {
-    initPromise = Parser.init();
-  }
-  return initPromise;
-}
-async function getLanguage(lang) {
-  if (languageCache.has(lang)) return languageCache.get(lang);
-  const path32 = wasmPath(lang);
-  if (!path32) {
-    languageCache.set(lang, null);
-    return null;
-  }
-  try {
-    await initParser();
-    const language = await Language.load(path32);
-    languageCache.set(lang, language);
-    return language;
-  } catch {
-    languageCache.set(lang, null);
-    return null;
-  }
+function initTracing() {
+  if (!isTracingEnabled()) return;
+  if (_sdk) return;
+  const endpoint = process.env["CODE_INTEL_OTEL_ENDPOINT"] ?? "http://localhost:4318";
+  const serviceName = process.env["CODE_INTEL_OTEL_SERVICE"] ?? "code-intel";
+  const deploymentEnv = process.env["CODE_INTEL_OTEL_ENV"] ?? process.env["NODE_ENV"] ?? "development";
+  const exporter = new OTLPTraceExporter({ url: `${endpoint}/v1/traces` });
+  _sdk = new NodeSDK({
+    resource: resourceFromAttributes({
+      [SEMRESATTRS_SERVICE_NAME]: serviceName,
+      [SEMRESATTRS_DEPLOYMENT_ENVIRONMENT]: deploymentEnv
+    }),
+    traceExporter: exporter,
+    instrumentations: [
+      getNodeAutoInstrumentations({
+        // Disable noisy file-system instrumentation
+        "@opentelemetry/instrumentation-fs": { enabled: false }
+      })
+    ]
+  });
+  _sdk.start();
 }
-async function getParser(lang) {
-  const language = await getLanguage(lang);
-  if (!language) return null;
-  let parser = parserCache.get(lang);
-  if (!parser) {
-    parser = new Parser();
-    parserCache.set(lang, parser);
+async function shutdownTracing() {
+  if (_sdk) {
+    await _sdk.shutdown();
+    _sdk = null;
   }
-  parser.setLanguage(language);
-  return parser;
-}
-async function parseSource(lang, source) {
-  const parser = await getParser(lang);
-  if (!parser) return null;
-  return parser.parse(source);
 }
-async function isTreeSitterAvailable(lang) {
-  return await getLanguage(lang) !== null;
-}
-var _require, _bundledWasmDir, initPromise, languageCache, parserCache;
-var init_parser_manager = __esm({
-  "src/parsing/parser-manager.ts"() {
-    init_shared();
-    _require = createRequire(import.meta.url);
-    _bundledWasmDir = findBundledWasmDir();
-    initPromise = null;
-    languageCache = /* @__PURE__ */ new Map();
-    parserCache = /* @__PURE__ */ new Map();
-  }
-});
-function getOrCompileQuery(language, querySource) {
-  let langMap = _queryCache.get(language);
-  if (!langMap) {
-    langMap = /* @__PURE__ */ new Map();
-    _queryCache.set(language, langMap);
-  }
-  let q = langMap.get(querySource);
-  if (!q) {
-    q = new Query(language, querySource);
-    langMap.set(querySource, q);
-  }
-  return q;
+function getTracer() {
+  return trace.getTracer(TRACER_NAME);
 }
-function runQuery(tree, language, querySource) {
-  const query = getOrCompileQuery(language, querySource);
-  const matches = query.matches(tree.rootNode);
-  const captures = [];
-  for (const match of matches) {
-    for (const capture of match.captures) {
-      captures.push({
-        name: capture.name,
-        node: capture.node,
-        text: capture.node.text
+async function withSpan(name, attrs, fn) {
+  return getTracer().startActiveSpan(name, { attributes: sanitizeAttrs(attrs) }, async (span) => {
+    try {
+      const result = await fn(span);
+      span.setStatus({ code: SpanStatusCode.OK });
+      return result;
+    } catch (err) {
+      span.setStatus({
+        code: SpanStatusCode.ERROR,
+        message: err instanceof Error ? err.message : String(err)
       });
+      span.recordException(err);
+      throw err;
+    } finally {
+      span.end();
     }
+  });
+}
+function sanitizeAttrs(attrs) {
+  const safe = {};
+  for (const [k, v] of Object.entries(attrs)) {
+    if (BLOCKED_ATTR_KEYS.test(k)) continue;
+    safe[k] = v;
   }
-  return captures;
+  return safe;
 }
-function runQueryMatches(tree, language, querySource) {
-  const query = getOrCompileQuery(language, querySource);
-  const raw = query.matches(tree.rootNode);
-  return raw.map((m) => ({
-    patternIndex: m.patternIndex,
-    captures: m.captures.map((c) => ({
-      name: c.name,
-      node: c.node,
-      text: c.node.text
-    }))
-  }));
+function getActiveTraceContext() {
+  const span = trace.getActiveSpan();
+  if (!span) return { traceId: "", spanId: "" };
+  const ctx = span.spanContext();
+  return { traceId: ctx.traceId, spanId: ctx.spanId };
 }
-var _queryCache;
-var init_query_runner = __esm({
-  "src/parsing/query-runner.ts"() {
-    _queryCache = /* @__PURE__ */ new WeakMap();
-  }
-});
-
-// src/parsing/queries/typescript.ts
-var typescriptQueries;
-var init_typescript = __esm({
-  "src/parsing/queries/typescript.ts"() {
-    typescriptQueries = `
-;; Class declaration
-(class_declaration
-  name: (type_identifier) @def.class.name) @def.class
-
-;; Abstract class
-(abstract_class_declaration
-  name: (type_identifier) @def.class.name) @def.class
-
-;; Interface declaration
-(interface_declaration
-  name: (type_identifier) @def.interface.name) @def.interface
-
-;; Type alias
-(type_alias_declaration
-  name: (type_identifier) @def.type_alias.name) @def.type_alias
-
-;; Enum
-(enum_declaration
-  name: (identifier) @def.enum.name) @def.enum
-
-;; Function declaration
-(function_declaration
-  name: (identifier) @def.func.name) @def.func
-
-;; Arrow function in variable
-(lexical_declaration
-  (variable_declarator
-    name: (identifier) @def.func.name
-    value: (arrow_function))) @def.func
-
-;; Const/let/var variable (non-function)
-(lexical_declaration
-  (variable_declarator
-    name: (identifier) @def.var.name
-    value: (_) @def.var.value)) @def.var
-
-;; Method definition
-(method_definition
-  name: (property_identifier) @def.method.name) @def.method
-
-;; Public field definition
-(public_field_definition
-  name: (property_identifier) @def.property.name) @def.property
-
-;; Import statement
-(import_statement
-  source: (string) @imp.source) @imp
-
-;; Import specifier
-(import_specifier
-  name: (identifier) @imp.name)
-
-;; Namespace import
-(namespace_import (identifier) @imp.namespace)
-
-;; Export statement
-(export_statement) @export
-
-;; Call expression \u2014 function call
-(call_expression
-  function: (identifier) @call.name) @call
-
-;; Call expression \u2014 member call
-(call_expression
-  function: (member_expression
-    object: (_) @call.receiver
-    property: (property_identifier) @call.method)) @call.member
-
-;; New expression
-(new_expression
-  constructor: (identifier) @call.constructor) @call.new
-
-;; Class heritage \u2014 extends
-(class_heritage
-  (extends_clause
-    value: (identifier) @inherit.extends))
-
-;; Class heritage \u2014 implements
-(class_heritage
-  (implements_clause
-    (type_identifier) @inherit.implements))
-`;
+var _sdk, TRACER_NAME, BLOCKED_ATTR_KEYS;
+var init_tracing = __esm({
+  "src/observability/tracing.ts"() {
+    _sdk = null;
+    TRACER_NAME = "code-intel";
+    BLOCKED_ATTR_KEYS = /secret|password|token|key|auth|credential/i;
   }
 });
-
-// src/parsing/queries/python.ts
-var pythonQueries;
-var init_python = __esm({
-  "src/parsing/queries/python.ts"() {
-    pythonQueries = `
-;; Class definition
+function getActiveTraceCtx() {
+  if (_getTraceCtx === "pending") return { traceId: "", spanId: "" };
+  if (_getTraceCtx) return _getTraceCtx();
+  _getTraceCtx = "pending";
+  Promise.resolve().then(() => (init_tracing(), tracing_exports)).then((mod) => {
+    _getTraceCtx = mod.getActiveTraceContext;
+  }).catch(() => {
+    _getTraceCtx = null;
+  });
+  return { traceId: "", spanId: "" };
+}
+var _getTraceCtx, SENSITIVE_KEYS, SENSITIVE_PATTERNS, SENSITIVE_KEYS_REGEX, Logger, logger_default;
+var init_logger = __esm({
+  "src/shared/logger.ts"() {
+    _getTraceCtx = null;
+    SENSITIVE_KEYS = [
+      "password",
+      "passwd",
+      "pass",
+      "pwd",
+      "secret",
+      "secretkey",
+      "secret_key",
+      "secretaccesskey",
+      "accesskeyid",
+      "credentials",
+      "auth",
+      "authentication",
+      "login",
+      "api_key",
+      "apikey",
+      "api",
+      "access_key",
+      "access_token",
+      "accesskey",
+      "auth_key",
+      "auth_token",
+      "authkey",
+      "token",
+      "jwt",
+      "bearer_token",
+      "refresh_token",
+      "session_token",
+      "session_key",
+      "oauth_token",
+      "connection_string",
+      "conn_string",
+      "db_uri",
+      "db_url",
+      "database_url",
+      "mongodb_uri",
+      "mysql_uri",
+      "postgres_uri",
+      "sql_uri",
+      "db_username",
+      "db_password",
+      "db_host",
+      "db_port",
+      "db_name",
+      "encryption_key",
+      "crypto_key",
+      "private_key",
+      "public_key",
+      "ssl_key",
+      "ssh_key",
+      "pgp_key",
+      "rsa_key",
+      "aes_key",
+      "email",
+      "phone",
+      "telephone",
+      "mobile",
+      "ssn",
+      "social_security",
+      "credit_card",
+      "cc_number",
+      "card_number",
+      "cvv",
+      "expiry_date",
+      "birth_date",
+      "dob",
+      "address",
+      "zip_code",
+      "postal_code",
+      "bank_account",
+      "iban",
+      "swift_code",
+      "routing_number",
+      "tax_id",
+      "vat_number",
+      "financial_id",
+      "certificate",
+      "client_cert",
+      "server_cert",
+      "ca_cert",
+      "aws_key",
+      "aws_secret",
+      "azure_key",
+      "gcp_key",
+      "s3_key",
+      "cloudinary_key",
+      "stripe_key",
+      "paypal_key",
+      "twilio_key",
+      "app_secret",
+      "client_secret",
+      "consumer_secret",
+      "encryption_secret",
+      "master_key",
+      "root_password",
+      "admin_password",
+      "config_secret",
+      "env_secret",
+      "deploy_key",
+      "ci_key",
+      "session_id",
+      "cookie_secret",
+      "csrf_token",
+      "xsrf_token",
+      "license_key",
+      "product_key",
+      "serial_number",
+      "activation_code"
+    ];
+    SENSITIVE_PATTERNS = [
+      /(?:password|passwd|secret|api_key|access_token|auth_token|token)\s*[:=]\s*([^\s,]+)/gi,
+      /\b\d{16}\b/gi,
+      /\b\d{3}-\d{2}-\d{4}\b/gi,
+      /\b[A-Za-z0-9]{32}\b/gi,
+      /\b[A-Za-z0-9_-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b/gi,
+      /\b\d{10}\b/gi,
+      /\b[A-Za-z0-9]{64}\b/gi,
+      /(?:connection_string|db_uri|db_url|mongodb_uri)\s*[:=]\s*([^\s,]+)/gi,
+      /(?:apikey|api_key|auth_key)\s*[:=]\s*([^\s,]+)/gi,
+      /(?:bearer\s+)([a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+)/gi
+    ];
+    SENSITIVE_KEYS_REGEX = new RegExp(`^(${SENSITIVE_KEYS.join("|")})$`, "i");
+    Logger = class _Logger {
+      static instance = null;
+      static maskSensitiveData(value) {
+        if (typeof value === "string" && value.length > 5) {
+          const firstChar = value.at(0);
+          const lastChar = value.at(-1);
+          return firstChar + "*".repeat(value.length - 2) + lastChar;
+        }
+        return value;
+      }
+      static maskSensitive(message, args = []) {
+        const maskString = (input) => {
+          if (typeof input !== "string") return input;
+          return SENSITIVE_PATTERNS.reduce((str, pattern) => {
+            return str.replace(
+              pattern,
+              (match, value) => value ? match.replace(value, _Logger.maskSensitiveData(value)) : match
+            );
+          }, input);
+        };
+        const deepMask = (obj) => {
+          if (typeof obj === "string") return maskString(obj);
+          if (Array.isArray(obj)) return obj.map((item) => deepMask(item));
+          if (typeof obj === "object" && obj !== null) {
+            return Object.entries(obj).reduce(
+              (acc, [key, value]) => {
+                if (value === void 0) return acc;
+                const isSensitiveKey = SENSITIVE_KEYS_REGEX.test(key);
+                acc[key] = isSensitiveKey && typeof value === "string" ? _Logger.maskSensitiveData(value) : deepMask(value);
+                return acc;
+              },
+              {}
+            );
+          }
+          return obj;
+        };
+        return {
+          maskedMessage: maskString(message),
+          maskedArgs: args.map((arg) => deepMask(arg))
+        };
+      }
+      /** Global log directory: ~/.code-intel/logs */
+      static LOG_DIR = path32.join(os13.homedir(), ".code-intel", "logs");
+      static getLogger() {
+        if (!_Logger.instance) {
+          const isProduction = process.env.NODE_ENV === "production";
+          const logLevel = process.env.LOG_LEVEL ?? "info";
+          const transports = [];
+          transports.push(new winston.transports.Console());
+          if (!isProduction) {
+            try {
+              if (!fs26.existsSync(_Logger.LOG_DIR)) {
+                fs26.mkdirSync(_Logger.LOG_DIR, { recursive: true });
+              }
+              transports.push(
+                new DailyRotateFile({
+                  filename: path32.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
+                  datePattern: "YYYY-MM-DD",
+                  maxSize: "20m",
+                  maxFiles: "14d"
+                })
+              );
+            } catch {
+            }
+          }
+          _Logger.instance = winston.createLogger({
+            level: logLevel,
+            format: winston.format.combine(
+              winston.format.timestamp(),
+              winston.format.printf(({ timestamp, level, message, ...meta }) => {
+                const args = meta[/* @__PURE__ */ Symbol.for("splat")] || [];
+                const { maskedMessage, maskedArgs } = _Logger.maskSensitive(message, args);
+                const formattedArgs = maskedArgs.map(
+                  (arg) => typeof arg === "object" ? JSON.stringify(arg) : String(arg)
+                );
+                const suffix = formattedArgs.length ? " " + formattedArgs.join(" ") : "";
+                let traceCtx = "";
+                try {
+                  const { traceId, spanId } = getActiveTraceCtx();
+                  if (traceId) traceCtx = ` [trace=${traceId} span=${spanId}]`;
+                } catch {
+                }
+                return `${timestamp} [${level.toUpperCase()}]${traceCtx}: ${maskedMessage}${suffix}`;
+              })
+            ),
+            transports
+          });
+        }
+        return _Logger.instance;
+      }
+      static info(message, ...args) {
+        _Logger.getLogger().info(message, ...args);
+      }
+      static warn(message, ...args) {
+        _Logger.getLogger().warn(message, ...args);
+      }
+      static error(message, ...args) {
+        _Logger.getLogger().error(message, ...args);
+      }
+      static debug(message, ...args) {
+        _Logger.getLogger().debug(message, ...args);
+      }
+    };
+    logger_default = Logger;
+    Logger.getLogger();
+  }
+});
+
+// src/shared/languages.ts
+var init_languages = __esm({
+  "src/shared/languages.ts"() {
+  }
+});
+
+// src/shared/detection.ts
+function detectLanguage(filePath) {
+  const ext = filePath.slice(filePath.lastIndexOf("."));
+  return EXTENSION_MAP[ext] ?? null;
+}
+function getSupportedExtensions() {
+  return Object.keys(EXTENSION_MAP);
+}
+var EXTENSION_MAP;
+var init_detection = __esm({
+  "src/shared/detection.ts"() {
+    init_languages();
+    EXTENSION_MAP = {
+      ".ts": "typescript" /* TypeScript */,
+      ".tsx": "typescript" /* TypeScript */,
+      ".mts": "typescript" /* TypeScript */,
+      ".cts": "typescript" /* TypeScript */,
+      ".js": "javascript" /* JavaScript */,
+      ".jsx": "javascript" /* JavaScript */,
+      ".mjs": "javascript" /* JavaScript */,
+      ".cjs": "javascript" /* JavaScript */,
+      ".py": "python" /* Python */,
+      ".pyi": "python" /* Python */,
+      ".java": "java" /* Java */,
+      ".go": "go" /* Go */,
+      ".c": "c" /* C */,
+      ".h": "c" /* C */,
+      ".cpp": "cpp" /* Cpp */,
+      ".cxx": "cpp" /* Cpp */,
+      ".cc": "cpp" /* Cpp */,
+      ".hpp": "cpp" /* Cpp */,
+      ".hxx": "cpp" /* Cpp */,
+      ".cs": "csharp" /* CSharp */,
+      ".rs": "rust" /* Rust */,
+      ".php": "php" /* PHP */,
+      ".kt": "kotlin" /* Kotlin */,
+      ".kts": "kotlin" /* Kotlin */,
+      ".rb": "ruby" /* Ruby */,
+      ".swift": "swift" /* Swift */,
+      ".dart": "dart" /* Dart */
+    };
+  }
+});
+
+// src/shared/index.ts
+var init_shared = __esm({
+  "src/shared/index.ts"() {
+    init_languages();
+    init_detection();
+  }
+});
+function findBundledWasmDir() {
+  const fileDir = path32.dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    path32.join(fileDir, "wasm"),
+    // dist/index.js → dist/wasm/
+    path32.join(fileDir, "../wasm")
+    // dist/cli/main.js → dist/wasm/
+  ];
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return candidates[0];
+}
+function wasmPath(lang) {
+  const WASM_PACKAGE_MAP = {
+    ["typescript" /* TypeScript */]: "tree-sitter-typescript/tree-sitter-typescript.wasm",
+    ["javascript" /* JavaScript */]: "tree-sitter-javascript/tree-sitter-javascript.wasm",
+    ["python" /* Python */]: "tree-sitter-python/tree-sitter-python.wasm",
+    ["java" /* Java */]: "tree-sitter-java/tree-sitter-java.wasm",
+    ["go" /* Go */]: "tree-sitter-go/tree-sitter-go.wasm",
+    ["c" /* C */]: "tree-sitter-c/tree-sitter-c.wasm",
+    ["cpp" /* Cpp */]: "tree-sitter-cpp/tree-sitter-cpp.wasm",
+    ["csharp" /* CSharp */]: "tree-sitter-c-sharp/tree-sitter-c_sharp.wasm",
+    ["rust" /* Rust */]: "tree-sitter-rust/tree-sitter-rust.wasm",
+    ["php" /* PHP */]: "tree-sitter-php/tree-sitter-php.wasm",
+    ["ruby" /* Ruby */]: "tree-sitter-ruby/tree-sitter-ruby.wasm",
+    // These are optional dependencies; their packages may or may not include
+    // a WASM.  If require.resolve fails we fall back to the bundled wasm/.
+    ["swift" /* Swift */]: "tree-sitter-swift/tree-sitter-swift.wasm",
+    ["kotlin" /* Kotlin */]: "tree-sitter-kotlin/tree-sitter-kotlin.wasm",
+    ["dart" /* Dart */]: "tree-sitter-dart/tree-sitter-dart.wasm"
+  };
+  const BUNDLED_WASM_MAP = {
+    ["swift" /* Swift */]: "tree-sitter-swift.wasm",
+    ["kotlin" /* Kotlin */]: "tree-sitter-kotlin.wasm",
+    ["dart" /* Dart */]: "tree-sitter-dart.wasm"
+  };
+  const relative = WASM_PACKAGE_MAP[lang];
+  if (relative) {
+    try {
+      return _require.resolve(relative);
+    } catch {
+    }
+  }
+  const bundled = BUNDLED_WASM_MAP[lang];
+  if (bundled) {
+    const bundledPath = path32.join(_bundledWasmDir, bundled);
+    if (existsSync(bundledPath)) return bundledPath;
+  }
+  return null;
+}
+async function initParser() {
+  if (!initPromise) {
+    initPromise = Parser.init();
+  }
+  return initPromise;
+}
+async function getLanguage(lang) {
+  if (languageCache.has(lang)) return languageCache.get(lang);
+  const path33 = wasmPath(lang);
+  if (!path33) {
+    languageCache.set(lang, null);
+    return null;
+  }
+  try {
+    await initParser();
+    const language = await Language.load(path33);
+    languageCache.set(lang, language);
+    return language;
+  } catch {
+    languageCache.set(lang, null);
+    return null;
+  }
+}
+async function getParser(lang) {
+  const language = await getLanguage(lang);
+  if (!language) return null;
+  let parser = parserCache.get(lang);
+  if (!parser) {
+    parser = new Parser();
+    parserCache.set(lang, parser);
+  }
+  parser.setLanguage(language);
+  return parser;
+}
+async function parseSource(lang, source) {
+  const parser = await getParser(lang);
+  if (!parser) return null;
+  return parser.parse(source);
+}
+async function isTreeSitterAvailable(lang) {
+  return await getLanguage(lang) !== null;
+}
+var _require, _bundledWasmDir, initPromise, languageCache, parserCache;
+var init_parser_manager = __esm({
+  "src/parsing/parser-manager.ts"() {
+    init_shared();
+    _require = createRequire(import.meta.url);
+    _bundledWasmDir = findBundledWasmDir();
+    initPromise = null;
+    languageCache = /* @__PURE__ */ new Map();
+    parserCache = /* @__PURE__ */ new Map();
+  }
+});
+function getOrCompileQuery(language, querySource) {
+  let langMap = _queryCache.get(language);
+  if (!langMap) {
+    langMap = /* @__PURE__ */ new Map();
+    _queryCache.set(language, langMap);
+  }
+  let q = langMap.get(querySource);
+  if (!q) {
+    q = new Query(language, querySource);
+    langMap.set(querySource, q);
+  }
+  return q;
+}
+function runQuery(tree, language, querySource) {
+  const query = getOrCompileQuery(language, querySource);
+  const matches = query.matches(tree.rootNode);
+  const captures = [];
+  for (const match of matches) {
+    for (const capture of match.captures) {
+      captures.push({
+        name: capture.name,
+        node: capture.node,
+        text: capture.node.text
+      });
+    }
+  }
+  return captures;
+}
+function runQueryMatches(tree, language, querySource) {
+  const query = getOrCompileQuery(language, querySource);
+  const raw = query.matches(tree.rootNode);
+  return raw.map((m) => ({
+    patternIndex: m.patternIndex,
+    captures: m.captures.map((c) => ({
+      name: c.name,
+      node: c.node,
+      text: c.node.text
+    }))
+  }));
+}
+var _queryCache;
+var init_query_runner = __esm({
+  "src/parsing/query-runner.ts"() {
+    _queryCache = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// src/parsing/queries/typescript.ts
+var typescriptQueries;
+var init_typescript = __esm({
+  "src/parsing/queries/typescript.ts"() {
+    typescriptQueries = `
+;; Class declaration
+(class_declaration
+  name: (type_identifier) @def.class.name) @def.class
+
+;; Abstract class
+(abstract_class_declaration
+  name: (type_identifier) @def.class.name) @def.class
+
+;; Interface declaration
+(interface_declaration
+  name: (type_identifier) @def.interface.name) @def.interface
+
+;; Type alias
+(type_alias_declaration
+  name: (type_identifier) @def.type_alias.name) @def.type_alias
+
+;; Enum
+(enum_declaration
+  name: (identifier) @def.enum.name) @def.enum
+
+;; Function declaration
+(function_declaration
+  name: (identifier) @def.func.name) @def.func
+
+;; Arrow function in variable
+(lexical_declaration
+  (variable_declarator
+    name: (identifier) @def.func.name
+    value: (arrow_function))) @def.func
+
+;; Const/let/var variable (non-function)
+(lexical_declaration
+  (variable_declarator
+    name: (identifier) @def.var.name
+    value: (_) @def.var.value)) @def.var
+
+;; Method definition
+(method_definition
+  name: (property_identifier) @def.method.name) @def.method
+
+;; Public field definition
+(public_field_definition
+  name: (property_identifier) @def.property.name) @def.property
+
+;; Import statement
+(import_statement
+  source: (string) @imp.source) @imp
+
+;; Import specifier
+(import_specifier
+  name: (identifier) @imp.name)
+
+;; Namespace import
+(namespace_import (identifier) @imp.namespace)
+
+;; Export statement
+(export_statement) @export
+
+;; Call expression \u2014 function call
+(call_expression
+  function: (identifier) @call.name) @call
+
+;; Call expression \u2014 member call
+(call_expression
+  function: (member_expression
+    object: (_) @call.receiver
+    property: (property_identifier) @call.method)) @call.member
+
+;; New expression
+(new_expression
+  constructor: (identifier) @call.constructor) @call.new
+
+;; Class heritage \u2014 extends
+(class_heritage
+  (extends_clause
+    value: (identifier) @inherit.extends))
+
+;; Class heritage \u2014 implements
+(class_heritage
+  (implements_clause
+    (type_identifier) @inherit.implements))
+`;
+  }
+});
+
+// src/parsing/queries/python.ts
+var pythonQueries;
+var init_python = __esm({
+  "src/parsing/queries/python.ts"() {
+    pythonQueries = `
+;; Class definition
 (class_definition
   name: (identifier) @def.class.name) @def.class
 
@@ -850,381 +1370,48 @@ var init_ruby = __esm({
 
 ;; Call
 (call
-  method: (identifier) @call.name) @call
-
-;; Superclass
-(superclass
-  (constant) @inherit.extends)
-`;
-  }
-});
-
-// src/parsing/queries/swift.ts
-var swiftQueries;
-var init_swift = __esm({
-  "src/parsing/queries/swift.ts"() {
-    swiftQueries = `
-;; In tree-sitter-swift, structs/classes/enums/actors all use class_declaration.
-;; Distinguish them with a keyword anchor.
-
-;; Struct declaration
-(class_declaration "struct"
-  (type_identifier) @def.struct.name) @def.struct
-
-;; Class declaration
-(class_declaration "class"
-  (type_identifier) @def.class.name) @def.class
-
-;; Enum declaration
-(class_declaration "enum"
-  (type_identifier) @def.enum.name) @def.enum
-
-;; Protocol declaration
-(protocol_declaration
-  (type_identifier) @def.interface.name) @def.interface
-
-;; Function declaration (no name: field in this grammar; positional match)
-(function_declaration
-  (simple_identifier) @def.func.name) @def.func
-
-;; Property declaration
-(property_declaration
-  (pattern
-    (simple_identifier) @def.property.name)) @def.property
-`;
-  }
-});
-
-// src/observability/tracing.ts
-var tracing_exports = {};
-__export(tracing_exports, {
-  SpanStatusCode: () => SpanStatusCode,
-  context: () => context,
-  getActiveTraceContext: () => getActiveTraceContext,
-  getTracer: () => getTracer,
-  initTracing: () => initTracing,
-  isTracingEnabled: () => isTracingEnabled,
-  sanitizeAttrs: () => sanitizeAttrs,
-  shutdownTracing: () => shutdownTracing,
-  trace: () => trace,
-  withSpan: () => withSpan
-});
-function isTracingEnabled() {
-  return process.env["CODE_INTEL_OTEL_ENABLED"] === "true";
-}
-function initTracing() {
-  if (!isTracingEnabled()) return;
-  if (_sdk) return;
-  const endpoint = process.env["CODE_INTEL_OTEL_ENDPOINT"] ?? "http://localhost:4318";
-  const serviceName = process.env["CODE_INTEL_OTEL_SERVICE"] ?? "code-intel";
-  const deploymentEnv = process.env["CODE_INTEL_OTEL_ENV"] ?? process.env["NODE_ENV"] ?? "development";
-  const exporter = new OTLPTraceExporter({ url: `${endpoint}/v1/traces` });
-  _sdk = new NodeSDK({
-    resource: resourceFromAttributes({
-      [SEMRESATTRS_SERVICE_NAME]: serviceName,
-      [SEMRESATTRS_DEPLOYMENT_ENVIRONMENT]: deploymentEnv
-    }),
-    traceExporter: exporter,
-    instrumentations: [
-      getNodeAutoInstrumentations({
-        // Disable noisy file-system instrumentation
-        "@opentelemetry/instrumentation-fs": { enabled: false }
-      })
-    ]
-  });
-  _sdk.start();
-}
-async function shutdownTracing() {
-  if (_sdk) {
-    await _sdk.shutdown();
-    _sdk = null;
-  }
-}
-function getTracer() {
-  return trace.getTracer(TRACER_NAME);
-}
-async function withSpan(name, attrs, fn) {
-  return getTracer().startActiveSpan(name, { attributes: sanitizeAttrs(attrs) }, async (span) => {
-    try {
-      const result = await fn(span);
-      span.setStatus({ code: SpanStatusCode.OK });
-      return result;
-    } catch (err) {
-      span.setStatus({
-        code: SpanStatusCode.ERROR,
-        message: err instanceof Error ? err.message : String(err)
-      });
-      span.recordException(err);
-      throw err;
-    } finally {
-      span.end();
-    }
-  });
-}
-function sanitizeAttrs(attrs) {
-  const safe = {};
-  for (const [k, v] of Object.entries(attrs)) {
-    if (BLOCKED_ATTR_KEYS.test(k)) continue;
-    safe[k] = v;
-  }
-  return safe;
-}
-function getActiveTraceContext() {
-  const span = trace.getActiveSpan();
-  if (!span) return { traceId: "", spanId: "" };
-  const ctx = span.spanContext();
-  return { traceId: ctx.traceId, spanId: ctx.spanId };
-}
-var _sdk, TRACER_NAME, BLOCKED_ATTR_KEYS;
-var init_tracing = __esm({
-  "src/observability/tracing.ts"() {
-    _sdk = null;
-    TRACER_NAME = "code-intel";
-    BLOCKED_ATTR_KEYS = /secret|password|token|key|auth|credential/i;
+  method: (identifier) @call.name) @call
+
+;; Superclass
+(superclass
+  (constant) @inherit.extends)
+`;
   }
 });
-function getActiveTraceCtx() {
-  if (_getTraceCtx === "pending") return { traceId: "", spanId: "" };
-  if (_getTraceCtx) return _getTraceCtx();
-  _getTraceCtx = "pending";
-  Promise.resolve().then(() => (init_tracing(), tracing_exports)).then((mod) => {
-    _getTraceCtx = mod.getActiveTraceContext;
-  }).catch(() => {
-    _getTraceCtx = null;
-  });
-  return { traceId: "", spanId: "" };
-}
-var _getTraceCtx, SENSITIVE_KEYS, SENSITIVE_PATTERNS, SENSITIVE_KEYS_REGEX, Logger, logger_default;
-var init_logger = __esm({
-  "src/shared/logger.ts"() {
-    _getTraceCtx = null;
-    SENSITIVE_KEYS = [
-      "password",
-      "passwd",
-      "pass",
-      "pwd",
-      "secret",
-      "secretkey",
-      "secret_key",
-      "secretaccesskey",
-      "accesskeyid",
-      "credentials",
-      "auth",
-      "authentication",
-      "login",
-      "api_key",
-      "apikey",
-      "api",
-      "access_key",
-      "access_token",
-      "accesskey",
-      "auth_key",
-      "auth_token",
-      "authkey",
-      "token",
-      "jwt",
-      "bearer_token",
-      "refresh_token",
-      "session_token",
-      "session_key",
-      "oauth_token",
-      "connection_string",
-      "conn_string",
-      "db_uri",
-      "db_url",
-      "database_url",
-      "mongodb_uri",
-      "mysql_uri",
-      "postgres_uri",
-      "sql_uri",
-      "db_username",
-      "db_password",
-      "db_host",
-      "db_port",
-      "db_name",
-      "encryption_key",
-      "crypto_key",
-      "private_key",
-      "public_key",
-      "ssl_key",
-      "ssh_key",
-      "pgp_key",
-      "rsa_key",
-      "aes_key",
-      "email",
-      "phone",
-      "telephone",
-      "mobile",
-      "ssn",
-      "social_security",
-      "credit_card",
-      "cc_number",
-      "card_number",
-      "cvv",
-      "expiry_date",
-      "birth_date",
-      "dob",
-      "address",
-      "zip_code",
-      "postal_code",
-      "bank_account",
-      "iban",
-      "swift_code",
-      "routing_number",
-      "tax_id",
-      "vat_number",
-      "financial_id",
-      "certificate",
-      "client_cert",
-      "server_cert",
-      "ca_cert",
-      "aws_key",
-      "aws_secret",
-      "azure_key",
-      "gcp_key",
-      "s3_key",
-      "cloudinary_key",
-      "stripe_key",
-      "paypal_key",
-      "twilio_key",
-      "app_secret",
-      "client_secret",
-      "consumer_secret",
-      "encryption_secret",
-      "master_key",
-      "root_password",
-      "admin_password",
-      "config_secret",
-      "env_secret",
-      "deploy_key",
-      "ci_key",
-      "session_id",
-      "cookie_secret",
-      "csrf_token",
-      "xsrf_token",
-      "license_key",
-      "product_key",
-      "serial_number",
-      "activation_code"
-    ];
-    SENSITIVE_PATTERNS = [
-      /(?:password|passwd|secret|api_key|access_token|auth_token|token)\s*[:=]\s*([^\s,]+)/gi,
-      /\b\d{16}\b/gi,
-      /\b\d{3}-\d{2}-\d{4}\b/gi,
-      /\b[A-Za-z0-9]{32}\b/gi,
-      /\b[A-Za-z0-9_-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\b/gi,
-      /\b\d{10}\b/gi,
-      /\b[A-Za-z0-9]{64}\b/gi,
-      /(?:connection_string|db_uri|db_url|mongodb_uri)\s*[:=]\s*([^\s,]+)/gi,
-      /(?:apikey|api_key|auth_key)\s*[:=]\s*([^\s,]+)/gi,
-      /(?:bearer\s+)([a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+)/gi
-    ];
-    SENSITIVE_KEYS_REGEX = new RegExp(`^(${SENSITIVE_KEYS.join("|")})$`, "i");
-    Logger = class _Logger {
-      static instance = null;
-      static maskSensitiveData(value) {
-        if (typeof value === "string" && value.length > 5) {
-          const firstChar = value.at(0);
-          const lastChar = value.at(-1);
-          return firstChar + "*".repeat(value.length - 2) + lastChar;
-        }
-        return value;
-      }
-      static maskSensitive(message, args = []) {
-        const maskString = (input) => {
-          if (typeof input !== "string") return input;
-          return SENSITIVE_PATTERNS.reduce((str, pattern) => {
-            return str.replace(
-              pattern,
-              (match, value) => value ? match.replace(value, _Logger.maskSensitiveData(value)) : match
-            );
-          }, input);
-        };
-        const deepMask = (obj) => {
-          if (typeof obj === "string") return maskString(obj);
-          if (Array.isArray(obj)) return obj.map((item) => deepMask(item));
-          if (typeof obj === "object" && obj !== null) {
-            return Object.entries(obj).reduce(
-              (acc, [key, value]) => {
-                if (value === void 0) return acc;
-                const isSensitiveKey = SENSITIVE_KEYS_REGEX.test(key);
-                acc[key] = isSensitiveKey && typeof value === "string" ? _Logger.maskSensitiveData(value) : deepMask(value);
-                return acc;
-              },
-              {}
-            );
-          }
-          return obj;
-        };
-        return {
-          maskedMessage: maskString(message),
-          maskedArgs: args.map((arg) => deepMask(arg))
-        };
-      }
-      /** Global log directory: ~/.code-intel/logs */
-      static LOG_DIR = path31.join(os13.homedir(), ".code-intel", "logs");
-      static getLogger() {
-        if (!_Logger.instance) {
-          const isProduction = process.env.NODE_ENV === "production";
-          const logLevel = process.env.LOG_LEVEL ?? "info";
-          const transports = [];
-          transports.push(new winston.transports.Console());
-          if (!isProduction) {
-            try {
-              if (!fs24.existsSync(_Logger.LOG_DIR)) {
-                fs24.mkdirSync(_Logger.LOG_DIR, { recursive: true });
-              }
-              transports.push(
-                new DailyRotateFile({
-                  filename: path31.join(_Logger.LOG_DIR, "%DATE%-code-intel.log"),
-                  datePattern: "YYYY-MM-DD",
-                  maxSize: "20m",
-                  maxFiles: "14d"
-                })
-              );
-            } catch {
-            }
-          }
-          _Logger.instance = winston.createLogger({
-            level: logLevel,
-            format: winston.format.combine(
-              winston.format.timestamp(),
-              winston.format.printf(({ timestamp, level, message, ...meta }) => {
-                const args = meta[/* @__PURE__ */ Symbol.for("splat")] || [];
-                const { maskedMessage, maskedArgs } = _Logger.maskSensitive(message, args);
-                const formattedArgs = maskedArgs.map(
-                  (arg) => typeof arg === "object" ? JSON.stringify(arg) : String(arg)
-                );
-                const suffix = formattedArgs.length ? " " + formattedArgs.join(" ") : "";
-                let traceCtx = "";
-                try {
-                  const { traceId, spanId } = getActiveTraceCtx();
-                  if (traceId) traceCtx = ` [trace=${traceId} span=${spanId}]`;
-                } catch {
-                }
-                return `${timestamp} [${level.toUpperCase()}]${traceCtx}: ${maskedMessage}${suffix}`;
-              })
-            ),
-            transports
-          });
-        }
-        return _Logger.instance;
-      }
-      static info(message, ...args) {
-        _Logger.getLogger().info(message, ...args);
-      }
-      static warn(message, ...args) {
-        _Logger.getLogger().warn(message, ...args);
-      }
-      static error(message, ...args) {
-        _Logger.getLogger().error(message, ...args);
-      }
-      static debug(message, ...args) {
-        _Logger.getLogger().debug(message, ...args);
-      }
-    };
-    logger_default = Logger;
-    Logger.getLogger();
+
+// src/parsing/queries/swift.ts
+var swiftQueries;
+var init_swift = __esm({
+  "src/parsing/queries/swift.ts"() {
+    swiftQueries = `
+;; In tree-sitter-swift, structs/classes/enums/actors all use class_declaration.
+;; Distinguish them with a keyword anchor.
+
+;; Struct declaration
+(class_declaration "struct"
+  (type_identifier) @def.struct.name) @def.struct
+
+;; Class declaration
+(class_declaration "class"
+  (type_identifier) @def.class.name) @def.class
+
+;; Enum declaration
+(class_declaration "enum"
+  (type_identifier) @def.enum.name) @def.enum
+
+;; Protocol declaration
+(protocol_declaration
+  (type_identifier) @def.interface.name) @def.interface
+
+;; Function declaration (no name: field in this grammar; positional match)
+(function_declaration
+  (simple_identifier) @def.func.name) @def.func
+
+;; Property declaration
+(property_declaration
+  (pattern
+    (simple_identifier) @def.property.name)) @def.property
+`;
   }
 });
 
@@ -1961,7 +2148,7 @@ var init_parse_phase = __esm({
           const batch = filePaths.slice(i, i + CONCURRENCY);
           await Promise.all(batch.map(async (filePath) => {
             try {
-              const source = await fs24.promises.readFile(filePath, "utf-8");
+              const source = await fs26.promises.readFile(filePath, "utf-8");
               context2.fileCache.set(filePath, source);
             } catch {
             }
@@ -1974,14 +2161,14 @@ var init_parse_phase = __esm({
           const lang = detectLanguage(filePath);
           if (!lang) {
             if (context2.verbose) {
-              const relativePath2 = path31.relative(context2.workspaceRoot, filePath);
+              const relativePath2 = path32.relative(context2.workspaceRoot, filePath);
               logger_default.info(`  [parse] skipped (no parser): ${relativePath2}`);
             }
             continue;
           }
           const source = context2.fileCache.get(filePath);
           if (!source) continue;
-          const relativePath = path31.relative(context2.workspaceRoot, filePath);
+          const relativePath = path32.relative(context2.workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const fileNode = context2.graph.getNode(fileNodeId);
           if (fileNode) {
@@ -2221,11 +2408,11 @@ var init_resolve_phase = __esm({
         let heritageEdges = 0;
         const fileIndex = /* @__PURE__ */ new Map();
         for (const fp of filePaths) {
-          const rel = path31.relative(workspaceRoot, fp);
+          const rel = path32.relative(workspaceRoot, fp);
           fileIndex.set(rel, fp);
           const noExt = rel.replace(/\.\w+$/, "");
           if (!fileIndex.has(noExt)) fileIndex.set(noExt, fp);
-          const base = path31.basename(rel, path31.extname(rel));
+          const base = path32.basename(rel, path32.extname(rel));
           if (!fileIndex.has(base)) fileIndex.set(base, fp);
         }
         const symbolIndex = /* @__PURE__ */ new Map();
@@ -2256,7 +2443,7 @@ var init_resolve_phase = __esm({
         for (const filePath of filePaths) {
           const lang = detectLanguage(filePath);
           if (!lang) continue;
-          const relativePath = path31.relative(workspaceRoot, filePath);
+          const relativePath = path32.relative(workspaceRoot, filePath);
           const fileNodeId = generateNodeId("file", relativePath, relativePath);
           const source = fileCache.get(filePath);
           if (!source) continue;
@@ -2269,13 +2456,13 @@ var init_resolve_phase = __esm({
             let resolvedRelPath = null;
             if (cleaned.startsWith(".")) {
               const cleanedNoJs = cleaned.replace(/\.(js|jsx)$/, "");
-              const fromDir = path31.dirname(relativePath);
+              const fromDir = path32.dirname(relativePath);
               for (const ext of ["", ".ts", ".tsx", ".js", ".jsx", ".py", ".java", ".go", "/index.ts", "/index.js"]) {
-                const candidate = path31.join(fromDir, cleanedNoJs + ext);
-                const normalized = path31.normalize(candidate);
+                const candidate = path32.join(fromDir, cleanedNoJs + ext);
+                const normalized = path32.normalize(candidate);
                 if (fileIndex.has(normalized)) {
                   const absPath = fileIndex.get(normalized);
-                  resolvedRelPath = path31.relative(workspaceRoot, absPath);
+                  resolvedRelPath = path32.relative(workspaceRoot, absPath);
                   break;
                 }
               }
@@ -2575,6 +2762,65 @@ var init_embedder = __esm({
   }
 });
 
+// src/storage/db-manager.ts
+var db_manager_exports = {};
+__export(db_manager_exports, {
+  DbManager: () => DbManager
+});
+var DbManager;
+var init_db_manager = __esm({
+  "src/storage/db-manager.ts"() {
+    DbManager = class {
+      db = null;
+      conn = null;
+      dbPath;
+      readOnly;
+      constructor(dbPath, readOnly = false) {
+        this.dbPath = dbPath;
+        this.readOnly = readOnly;
+      }
+      async init() {
+        if (!this.readOnly) {
+          fs26.mkdirSync(path32.dirname(this.dbPath), { recursive: true });
+        }
+        this.db = new Database(this.dbPath, 0, true, this.readOnly);
+        await this.db.init();
+        this.conn = new Connection(this.db);
+        await this.conn.init();
+      }
+      async query(cypher) {
+        if (!this.conn) throw new Error("Database not initialized");
+        const result = await this.conn.query(cypher);
+        const qr = Array.isArray(result) ? result[0] : result;
+        const rows = await qr.getAll();
+        qr.close();
+        return rows;
+      }
+      async execute(cypher) {
+        if (!this.conn) throw new Error("Database not initialized");
+        const result = await this.conn.query(cypher);
+        const qr = Array.isArray(result) ? result[0] : result;
+        qr.close();
+      }
+      close() {
+        try {
+          this.conn?.closeSync();
+        } catch {
+        }
+        try {
+          this.db?.closeSync();
+        } catch {
+        }
+        this.conn = null;
+        this.db = null;
+      }
+      get isOpen() {
+        return this.conn !== null;
+      }
+    };
+  }
+});
+
 // src/multi-repo/group-registry.ts
 var group_registry_exports = {};
 __export(group_registry_exports, {
@@ -2589,27 +2835,27 @@ __export(group_registry_exports, {
   saveSyncResult: () => saveSyncResult
 });
 function groupFile(name) {
-  return path31.join(GROUPS_DIR, `${name}.json`);
+  return path32.join(GROUPS_DIR, `${name}.json`);
 }
 function loadGroup(name) {
   try {
-    return JSON.parse(fs24.readFileSync(groupFile(name), "utf-8"));
+    return JSON.parse(fs26.readFileSync(groupFile(name), "utf-8"));
   } catch {
     return null;
   }
 }
 function saveGroup(group) {
-  fs24.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs24.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
+  fs26.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs26.writeFileSync(groupFile(group.name), JSON.stringify(group, null, 2) + "\n");
 }
 function listGroups() {
   const groups = [];
   try {
-    for (const file of fs24.readdirSync(GROUPS_DIR)) {
+    for (const file of fs26.readdirSync(GROUPS_DIR)) {
       if (!file.endsWith(".json") || file.endsWith(".sync.json")) continue;
       try {
         const g = JSON.parse(
-          fs24.readFileSync(path31.join(GROUPS_DIR, file), "utf-8")
+          fs26.readFileSync(path32.join(GROUPS_DIR, file), "utf-8")
         );
         groups.push(g);
       } catch {
@@ -2621,16 +2867,16 @@ function listGroups() {
 }
 function deleteGroup(name) {
   try {
-    fs24.unlinkSync(groupFile(name));
+    fs26.unlinkSync(groupFile(name));
   } catch {
   }
   try {
-    fs24.unlinkSync(path31.join(GROUPS_DIR, `${name}.sync.json`));
+    fs26.unlinkSync(path32.join(GROUPS_DIR, `${name}.sync.json`));
   } catch {
   }
 }
 function groupExists(name) {
-  return fs24.existsSync(groupFile(name));
+  return fs26.existsSync(groupFile(name));
 }
 function addMember(groupName, member) {
   const group = loadGroup(groupName);
@@ -2656,16 +2902,16 @@ function removeMember(groupName, groupPath) {
   return group;
 }
 function saveSyncResult(result) {
-  fs24.mkdirSync(GROUPS_DIR, { recursive: true });
-  fs24.writeFileSync(
-    path31.join(GROUPS_DIR, `${result.groupName}.sync.json`),
+  fs26.mkdirSync(GROUPS_DIR, { recursive: true });
+  fs26.writeFileSync(
+    path32.join(GROUPS_DIR, `${result.groupName}.sync.json`),
     JSON.stringify(result, null, 2) + "\n"
   );
 }
 function loadSyncResult(groupName) {
   try {
     return JSON.parse(
-      fs24.readFileSync(path31.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
+      fs26.readFileSync(path32.join(GROUPS_DIR, `${groupName}.sync.json`), "utf-8")
     );
   } catch {
     return null;
@@ -2674,7 +2920,87 @@ function loadSyncResult(groupName) {
 var GROUPS_DIR;
 var init_group_registry = __esm({
   "src/multi-repo/group-registry.ts"() {
-    GROUPS_DIR = path31.join(os13.homedir(), ".code-intel", "groups");
+    GROUPS_DIR = path32.join(os13.homedir(), ".code-intel", "groups");
+  }
+});
+
+// src/multi-repo/graph-from-db.ts
+var graph_from_db_exports = {};
+__export(graph_from_db_exports, {
+  loadGraphFromDB: () => loadGraphFromDB
+});
+function parseRow(row, kind) {
+  return {
+    id: String(row["id"] ?? ""),
+    kind,
+    name: String(row["name"] ?? ""),
+    filePath: String(row["file_path"] ?? ""),
+    startLine: row["start_line"] != null ? Number(row["start_line"]) : void 0,
+    endLine: row["end_line"] != null ? Number(row["end_line"]) : void 0,
+    exported: row["exported"] != null ? Boolean(row["exported"]) : void 0,
+    content: row["content"] ? String(row["content"]) : void 0,
+    metadata: row["metadata"] ? (() => {
+      try {
+        return JSON.parse(String(row["metadata"]));
+      } catch {
+        return void 0;
+      }
+    })() : void 0
+  };
+}
+async function loadGraphFromDB(graph, db) {
+  for (const table of ALL_NODE_TABLES) {
+    const kind = TABLE_TO_KIND2[table];
+    if (!kind) continue;
+    let rows = [];
+    try {
+      rows = await db.query(`MATCH (n:${table}) RETURN n.id, n.name, n.file_path, n.start_line, n.end_line, n.exported, n.content, n.metadata`);
+    } catch {
+      continue;
+    }
+    for (const row of rows) {
+      const node = parseRow({
+        id: row["n.id"],
+        name: row["n.name"],
+        file_path: row["n.file_path"],
+        start_line: row["n.start_line"],
+        end_line: row["n.end_line"],
+        exported: row["n.exported"],
+        content: row["n.content"],
+        metadata: row["n.metadata"]
+      }, kind);
+      if (node.id && node.name) graph.addNode(node);
+    }
+  }
+  try {
+    const edgeRows = await db.query(
+      `MATCH (a)-[e:code_edges]->(b) RETURN a.id, b.id, e.kind, e.weight, e.label`
+    );
+    for (const row of edgeRows) {
+      const sourceId = String(row["a.id"] ?? "");
+      const targetId = String(row["b.id"] ?? "");
+      const kind = String(row["e.kind"] ?? "");
+      if (!sourceId || !targetId || !kind) continue;
+      const edge = {
+        id: `${sourceId}::${kind}::${targetId}`,
+        source: sourceId,
+        target: targetId,
+        kind,
+        weight: row["e.weight"] != null ? Number(row["e.weight"]) : void 0,
+        label: row["e.label"] ? String(row["e.label"]) : void 0
+      };
+      graph.addEdge(edge);
+    }
+  } catch {
+  }
+}
+var TABLE_TO_KIND2;
+var init_graph_from_db = __esm({
+  "src/multi-repo/graph-from-db.ts"() {
+    init_schema();
+    TABLE_TO_KIND2 = Object.fromEntries(
+      Object.entries(NODE_TABLE_MAP).map(([kind, table]) => [table, kind])
+    );
   }
 });
 
@@ -2964,7 +3290,7 @@ __export(gql_parser_exports, {
 function isGQLParseError(v) {
   return v.type === "GQLParseError";
 }
-function tokenize(input) {
+function tokenize2(input) {
   const tokens = [];
   let i = 0;
   const len = input.length;
@@ -3059,7 +3385,7 @@ function tokenize(input) {
   return tokens;
 }
 function parseGQL(input) {
-  const tokens = tokenize(input.trim());
+  const tokens = tokenize2(input.trim());
   if (!Array.isArray(tokens)) return tokens;
   const parser = new Parser2(tokens);
   return parser.parse();
@@ -3852,7 +4178,7 @@ function isTestFile(filePath) {
   if (filePath.includes(".test.") || filePath.includes(".spec.")) return true;
   if (filePath.includes("_test.") || filePath.endsWith("_test.go")) return true;
   if (filePath.includes("__tests__")) return true;
-  const base = path31.basename(filePath);
+  const base = path32.basename(filePath);
   if (base.startsWith("Test") && filePath.endsWith(".java")) return true;
   return false;
 }
@@ -3897,7 +4223,7 @@ function computeCoverage(graph, scope) {
   }
   const baseNameToTestFiles = /* @__PURE__ */ new Map();
   for (const testPath of testFilePaths) {
-    const base = path31.basename(testPath);
+    const base = path32.basename(testPath);
     const stripped = base.replace(/\.test\.[^.]+$/, "").replace(/\.spec\.[^.]+$/, "").replace(/_test\.[^.]+$/, "").replace(/_test$/, "");
     const existing = baseNameToTestFiles.get(stripped) ?? [];
     existing.push(testPath);
@@ -3930,7 +4256,7 @@ function computeCoverage(graph, scope) {
         }
       }
     }
-    const nodeBase = path31.basename(node.filePath).replace(/\.[^.]+$/, "");
+    const nodeBase = path32.basename(node.filePath).replace(/\.[^.]+$/, "");
     const matchingTestFiles = baseNameToTestFiles.get(nodeBase) ?? [];
     for (const tf of matchingTestFiles) {
       if (!testFiles.includes(tf)) testFiles.push(tf);
@@ -4000,7 +4326,7 @@ var init_secret_scanner = __esm({
         const ignorePatterns = [...options?.ignorePatterns ?? []];
         if (options?.workspaceRoot) {
           try {
-            const raw = fs24.readFileSync(path31.join(options.workspaceRoot, ".codeintelignore"), "utf-8");
+            const raw = fs26.readFileSync(path32.join(options.workspaceRoot, ".codeintelignore"), "utf-8");
             for (const line of raw.split("\n")) {
               const trimmed = line.trim();
               if (trimmed && !trimmed.startsWith("#")) ignorePatterns.push(trimmed);
@@ -4288,10 +4614,10 @@ var init_codes = __esm({
   }
 });
 function secureMkdir(dir) {
-  fs24.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  fs26.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
   if (process.platform !== "win32") {
     try {
-      fs24.chmodSync(dir, SECURE_DIR_MODE);
+      fs26.chmodSync(dir, SECURE_DIR_MODE);
     } catch {
     }
   }
@@ -4299,17 +4625,17 @@ function secureMkdir(dir) {
 function secureChmodFile(file) {
   if (process.platform === "win32") return;
   try {
-    fs24.chmodSync(file, SECURE_FILE_MODE);
+    fs26.chmodSync(file, SECURE_FILE_MODE);
   } catch {
   }
 }
 function tightenDbFiles(dir) {
   if (process.platform === "win32") return;
-  if (!fs24.existsSync(dir)) return;
-  for (const name of fs24.readdirSync(dir)) {
+  if (!fs26.existsSync(dir)) return;
+  for (const name of fs26.readdirSync(dir)) {
     if (name.endsWith(".db") || name.endsWith(".db-wal") || name.endsWith(".db-shm")) {
       try {
-        fs24.chmodSync(path31.join(dir, name), SECURE_FILE_MODE);
+        fs26.chmodSync(path32.join(dir, name), SECURE_FILE_MODE);
       } catch {
       }
     }
@@ -4323,7 +4649,7 @@ var init_fs_secure = __esm({
   }
 });
 function getUsersDBPath() {
-  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path31.join(os13.homedir(), ".code-intel", "users.db");
+  return process.env["CODE_INTEL_USERS_DB_PATH"] ?? path32.join(os13.homedir(), ".code-intel", "users.db");
 }
 function getOrCreateUsersDB() {
   if (!_usersDB) {
@@ -4339,9 +4665,9 @@ var init_users_db = __esm({
     UsersDB = class {
       db;
       constructor(dbPath) {
-        const dir = path31.dirname(dbPath);
+        const dir = path32.dirname(dbPath);
         secureMkdir(dir);
-        this.db = new Database3(dbPath);
+        this.db = new Database2(dbPath);
         this.db.pragma("journal_mode = WAL");
         this.db.pragma("foreign_keys = ON");
         this.createTables();
@@ -4616,7 +4942,7 @@ function getScryptN() {
   return Number.isInteger(v) && v >= 1024 ? v : 1 << 14;
 }
 function getSecretsPath() {
-  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path31.join(os13.homedir(), ".code-intel", ".secrets");
+  return process.env["CODE_INTEL_SECRETS_PATH"] ?? path32.join(os13.homedir(), ".code-intel", ".secrets");
 }
 function getMasterPassword() {
   const fromEnv = process.env["CODE_INTEL_SECRET_KEY"];
@@ -4647,8 +4973,8 @@ function decryptSecrets(encrypted) {
   return JSON.parse(plaintext.toString("utf8"));
 }
 function loadSecrets(secretsPath = getSecretsPath()) {
-  if (!fs24.existsSync(secretsPath)) return {};
-  const blob = fs24.readFileSync(secretsPath);
+  if (!fs26.existsSync(secretsPath)) return {};
+  const blob = fs26.readFileSync(secretsPath);
   return decryptSecrets(blob);
 }
 function getSecret(key, secretsPath = getSecretsPath()) {
@@ -4669,11 +4995,18 @@ function getSessionTtlMs() {
   const hours = parseInt(process.env["CODE_INTEL_SESSION_TTL_HOURS"] ?? "8", 10);
   return (isNaN(hours) ? 8 : hours) * 60 * 60 * 1e3;
 }
-function createSession(user) {
+function createSession(user, rememberMe = false) {
   const sessionId = v4();
-  const expiresAt = Date.now() + getSessionTtlMs();
-  sessionStore.set(sessionId, { userId: user.id, username: user.username, role: user.role, expiresAt });
-  return sessionId;
+  const ttlMs = rememberMe ? REMEMBER_ME_TTL_MS : getSessionTtlMs();
+  const expiresAt = Date.now() + ttlMs;
+  sessionStore.set(sessionId, {
+    userId: user.id,
+    username: user.username,
+    role: user.role,
+    expiresAt,
+    ttlMs
+  });
+  return { sessionId, ttlMs };
 }
 function getSession(sessionId) {
   const entry = sessionStore.get(sessionId);
@@ -4682,10 +5015,9 @@ function getSession(sessionId) {
     sessionStore.delete(sessionId);
     return null;
   }
-  const ttlMs = getSessionTtlMs();
   const remaining = entry.expiresAt - Date.now();
-  if (remaining < ttlMs * 0.75) {
-    entry.expiresAt = Date.now() + ttlMs;
+  if (remaining < entry.ttlMs * 0.75) {
+    entry.expiresAt = Date.now() + entry.ttlMs;
   }
   return entry;
 }
@@ -4705,7 +5037,7 @@ function authMiddleware(req, res, next) {
     const session = getSession(sessionId);
     if (session) {
       req.user = { id: session.userId, username: session.username, role: session.role, authMethod: "session" };
-      res.setHeader("Set-Cookie", buildSessionCookie(sessionId));
+      res.setHeader("Set-Cookie", buildSessionCookie(sessionId, session.ttlMs));
       next();
       return;
     }
@@ -4875,9 +5207,9 @@ function parseCookies(cookieHeader) {
   }
   return result;
 }
-function buildSessionCookie(sessionId) {
+function buildSessionCookie(sessionId, ttlMs) {
   const isProduction = process.env["NODE_ENV"] === "production";
-  const maxAge = Math.floor(getSessionTtlMs() / 1e3);
+  const maxAge = Math.floor((ttlMs ?? getSessionTtlMs()) / 1e3);
   const parts = [
     `${SESSION_COOKIE_NAME}=${encodeURIComponent(sessionId)}`,
     `HttpOnly`,
@@ -4894,7 +5226,7 @@ function clearSessionCookie() {
 async function verifyPassword(plain, hash) {
   return bcrypt.compare(plain, hash);
 }
-var sessionStore, SESSION_COOKIE_NAME, ROLE_RANK;
+var sessionStore, SESSION_COOKIE_NAME, REMEMBER_ME_TTL_MS, ROLE_RANK;
 var init_middleware = __esm({
   "src/auth/middleware.ts"() {
     init_users_db();
@@ -4902,6 +5234,7 @@ var init_middleware = __esm({
     init_secret_store();
     sessionStore = /* @__PURE__ */ new Map();
     SESSION_COOKIE_NAME = "code_intel_session";
+    REMEMBER_ME_TTL_MS = 12 * 60 * 60 * 1e3;
     ROLE_RANK = {
       viewer: 1,
       "repo-owner": 2,
@@ -5034,130 +5367,23 @@ var init_websocket_server = __esm({
   }
 });
 
-// src/graph/knowledge-graph.ts
-function createKnowledgeGraph() {
-  const nodes = /* @__PURE__ */ new Map();
-  const edges = /* @__PURE__ */ new Map();
-  const edgesByKind = /* @__PURE__ */ new Map();
-  const edgesFromNode = /* @__PURE__ */ new Map();
-  const edgesToNode = /* @__PURE__ */ new Map();
-  function indexEdge(edge) {
-    let kindSet = edgesByKind.get(edge.kind);
-    if (!kindSet) {
-      kindSet = /* @__PURE__ */ new Set();
-      edgesByKind.set(edge.kind, kindSet);
-    }
-    kindSet.add(edge.id);
-    let fromSet = edgesFromNode.get(edge.source);
-    if (!fromSet) {
-      fromSet = /* @__PURE__ */ new Set();
-      edgesFromNode.set(edge.source, fromSet);
-    }
-    fromSet.add(edge.id);
-    let toSet = edgesToNode.get(edge.target);
-    if (!toSet) {
-      toSet = /* @__PURE__ */ new Set();
-      edgesToNode.set(edge.target, toSet);
-    }
-    toSet.add(edge.id);
-  }
-  function unindexEdge(edge) {
-    edgesByKind.get(edge.kind)?.delete(edge.id);
-    edgesFromNode.get(edge.source)?.delete(edge.id);
-    edgesToNode.get(edge.target)?.delete(edge.id);
-  }
-  return {
-    addNode(node) {
-      nodes.set(node.id, node);
-    },
-    addEdge(edge) {
-      edges.set(edge.id, edge);
-      indexEdge(edge);
-    },
-    getNode(id) {
-      return nodes.get(id);
-    },
-    getEdge(id) {
-      return edges.get(id);
-    },
-    *findEdgesByKind(kind) {
-      const ids = edgesByKind.get(kind);
-      if (!ids) return;
-      for (const id of ids) {
-        const edge = edges.get(id);
-        if (edge) yield edge;
-      }
-    },
-    *findEdgesFrom(sourceId) {
-      const ids = edgesFromNode.get(sourceId);
-      if (!ids) return;
-      for (const id of ids) {
-        const edge = edges.get(id);
-        if (edge) yield edge;
-      }
-    },
-    *findEdgesTo(targetId) {
-      const ids = edgesToNode.get(targetId);
-      if (!ids) return;
-      for (const id of ids) {
-        const edge = edges.get(id);
-        if (edge) yield edge;
-      }
-    },
-    removeNodeCascade(id) {
-      const fromEdges = edgesFromNode.get(id);
-      if (fromEdges) {
-        for (const edgeId of [...fromEdges]) {
-          const edge = edges.get(edgeId);
-          if (edge) {
-            unindexEdge(edge);
-            edges.delete(edgeId);
-          }
-        }
-      }
-      const toEdges = edgesToNode.get(id);
-      if (toEdges) {
-        for (const edgeId of [...toEdges]) {
-          const edge = edges.get(edgeId);
-          if (edge) {
-            unindexEdge(edge);
-            edges.delete(edgeId);
-          }
-        }
-      }
-      edgesFromNode.delete(id);
-      edgesToNode.delete(id);
-      nodes.delete(id);
-    },
-    removeEdge(id) {
-      const edge = edges.get(id);
-      if (edge) {
-        unindexEdge(edge);
-        edges.delete(id);
-      }
-    },
-    *allNodes() {
-      yield* nodes.values();
-    },
-    *allEdges() {
-      yield* edges.values();
-    },
-    get size() {
-      return { nodes: nodes.size, edges: edges.size };
-    },
-    clear() {
-      nodes.clear();
-      edges.clear();
-      edgesByKind.clear();
-      edgesFromNode.clear();
-      edgesToNode.clear();
-    }
-  };
-}
-
 // src/graph/index.ts
+init_knowledge_graph();
 init_id_generator();
 
+// src/graph/lazy-knowledge-graph.ts
+init_schema();
+init_logger();
+Object.fromEntries(
+  Object.entries(NODE_TABLE_MAP).map(([kind, table]) => [table, kind])
+);
+function isLazyGraph(g) {
+  return "lazy" in g && g.lazy === true;
+}
+
+// src/graph/compact-knowledge-graph.ts
+init_logger();
+
 // src/parsing/index.ts
 init_parser_manager();
 init_query_runner();
@@ -5215,7 +5441,7 @@ init_shared();
 init_shared();
 init_typescript();
 function resolveRelative(rawPath, fromFile, workspace) {
-  const fromDir = path31.dirname(fromFile);
+  const fromDir = path32.dirname(fromFile);
   const cleaned = rawPath.replace(/['"]/g, "");
   const extensions = [".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.js"];
   const resolved = workspace.resolve(fromDir, cleaned);
@@ -5267,7 +5493,7 @@ var pythonModule = {
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/['"]/g, "");
     const parts = cleaned.split(".");
-    const fromDir = path31.dirname(fromFile);
+    const fromDir = path32.dirname(fromFile);
     const relPath = parts.join("/");
     for (const suffix of ["/__init__.py", ".py"]) {
       const r = workspace.resolve(fromDir, relPath + suffix);
@@ -5346,7 +5572,7 @@ var cModule = {
   inheritanceStrategy: "none",
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/[<>"']/g, "");
-    const fromDir = path31.dirname(fromFile);
+    const fromDir = path32.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(_node) {
@@ -5369,7 +5595,7 @@ var cppModule = {
   inheritanceStrategy: "depth-first",
   resolveImport(rawPath, fromFile, workspace) {
     const cleaned = rawPath.replace(/[<>"']/g, "");
-    const fromDir = path31.dirname(fromFile);
+    const fromDir = path32.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(_node) {
@@ -5531,7 +5757,7 @@ var dartModule = {
       const pkg = cleaned.replace("package:", "");
       return workspace.findByPackage(pkg);
     }
-    const fromDir = path31.dirname(fromFile);
+    const fromDir = path32.dirname(fromFile);
     return workspace.resolve(fromDir, cleaned);
   },
   isExported(node) {
@@ -5886,25 +6112,25 @@ function validateDAG(phases) {
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
   const phaseMap = new Map(phases.map((p) => [p.name, p]));
-  function dfs(name, path32) {
+  function dfs(name, path33) {
     if (visiting.has(name)) {
-      const cycleStart = path32.indexOf(name);
-      const cycle = path32.slice(cycleStart).concat(name);
+      const cycleStart = path33.indexOf(name);
+      const cycle = path33.slice(cycleStart).concat(name);
       errors.push({ type: "cycle", message: `Cycle detected: ${cycle.join(" \u2192 ")}` });
       return true;
     }
     if (visited.has(name)) return false;
     visiting.add(name);
-    path32.push(name);
+    path33.push(name);
     const phase = phaseMap.get(name);
     if (phase) {
       for (const dep of phase.dependencies) {
-        if (dfs(dep, path32)) return true;
+        if (dfs(dep, path33)) return true;
       }
     }
     visiting.delete(name);
     visited.add(name);
-    path32.pop();
+    path33.pop();
     return false;
   }
   for (const phase of phases) {
@@ -6032,6 +6258,7 @@ ${errors.map((e) => e.message).join("\n")}`);
   for (const phase of sorted) {
     context2.onProgress?.(phase.name, "running");
     const phaseStart = Date.now();
+    const memBefore = context2.profile ? Math.round(process.memoryUsage().heapUsed / 1024 / 1024) : void 0;
     const runPhase = async () => {
       const depResults = /* @__PURE__ */ new Map();
       for (const dep of phase.dependencies) {
@@ -6055,6 +6282,10 @@ ${errors.map((e) => e.message).join("\n")}`);
       }
       const durationSec = (Date.now() - phaseStart) / 1e3;
       pipelinePhaseDurationSeconds.observe({ phase: phase.name, status: result.status }, durationSec);
+      if (memBefore !== void 0) {
+        result.memoryBeforeMB = memBefore;
+        result.memoryAfterMB = Math.round(process.memoryUsage().heapUsed / 1024 / 1024);
+      }
       results.set(phase.name, result);
       context2.onProgress?.(phase.name, result.status);
       if (result.status === "failed") {
@@ -6065,7 +6296,9 @@ ${errors.map((e) => e.message).join("\n")}`);
       const result = {
         status: "failed",
         duration: Date.now() - phaseStart,
-        message: err instanceof Error ? err.message : String(err)
+        message: err instanceof Error ? err.message : String(err),
+        memoryBeforeMB: memBefore,
+        memoryAfterMB: memBefore !== void 0 ? Math.round(process.memoryUsage().heapUsed / 1024 / 1024) : void 0
       };
       pipelinePhaseDurationSeconds.observe({ phase: phase.name, status: "failed" }, (Date.now() - phaseStart) / 1e3);
       results.set(phase.name, result);
@@ -6117,7 +6350,7 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
 ]);
 function loadIgnorePatterns(workspaceRoot) {
   try {
-    const raw = fs24.readFileSync(path31.join(workspaceRoot, ".codeintelignore"), "utf-8");
+    const raw = fs26.readFileSync(path32.join(workspaceRoot, ".codeintelignore"), "utf-8");
     const extras = /* @__PURE__ */ new Set();
     for (const line of raw.split("\n")) {
       const trimmed = line.trim();
@@ -6141,7 +6374,7 @@ var scanPhase = {
     function walk(dir) {
       let entries;
       try {
-        entries = fs24.readdirSync(dir, { withFileTypes: true });
+        entries = fs26.readdirSync(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -6150,15 +6383,15 @@ var scanPhase = {
           if (entry.name.startsWith(".")) continue;
           if (IGNORED_DIRS.has(entry.name)) continue;
           if (extraIgnore.has(entry.name)) continue;
-          walk(path31.join(dir, entry.name));
+          walk(path32.join(dir, entry.name));
         } else if (entry.isFile()) {
           const name = entry.name;
           if (IGNORED_FILE_SUFFIXES.some((s) => name.endsWith(s))) continue;
-          const ext = path31.extname(name);
+          const ext = path32.extname(name);
           if (!extensions.has(ext)) continue;
-          const fullPath = path31.join(dir, name);
+          const fullPath = path32.join(dir, name);
           try {
-            const stat = fs24.statSync(fullPath);
+            const stat = fs26.statSync(fullPath);
             if (stat.size > MAX_FILE_SIZE_BYTES) continue;
           } catch {
             continue;
@@ -6185,20 +6418,20 @@ var structurePhase = {
     const dirs = /* @__PURE__ */ new Set();
     let structDone = 0;
     for (const filePath of context2.filePaths) {
-      const relativePath = path31.relative(context2.workspaceRoot, filePath);
+      const relativePath = path32.relative(context2.workspaceRoot, filePath);
       const lang = detectLanguage(filePath);
       context2.graph.addNode({
         id: generateNodeId("file", relativePath, relativePath),
         kind: "file",
-        name: path31.basename(filePath),
+        name: path32.basename(filePath),
         filePath: relativePath,
         metadata: lang ? { language: lang } : void 0
       });
-      let dir = path31.dirname(relativePath);
+      let dir = path32.dirname(relativePath);
       while (dir && dir !== "." && dir !== "") {
         if (dirs.has(dir)) break;
         dirs.add(dir);
-        dir = path31.dirname(dir);
+        dir = path32.dirname(dir);
       }
       structDone++;
       context2.onPhaseProgress?.("structure", structDone, context2.filePaths.length);
@@ -6207,7 +6440,7 @@ var structurePhase = {
       context2.graph.addNode({
         id: generateNodeId("directory", dir, dir),
         kind: "directory",
-        name: path31.basename(dir),
+        name: path32.basename(dir),
         filePath: dir
       });
     }
@@ -6318,22 +6551,22 @@ var flowPhase = {
       const queue = [{ nodeId: ep.id, path: [ep.id] }];
       const visited = /* @__PURE__ */ new Set();
       while (queue.length > 0 && flowCount < maxFlows) {
-        const { nodeId, path: path32 } = queue.shift();
-        if (path32.length > maxDepth) continue;
+        const { nodeId, path: path33 } = queue.shift();
+        if (path33.length > maxDepth) continue;
         const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-        if (callEdges.length === 0 && path32.length >= 3) {
+        if (callEdges.length === 0 && path33.length >= 3) {
           const flowId = generateNodeId("flow", ep.filePath, `flow-${flowCount}`);
           graph.addNode({
             id: flowId,
             kind: "flow",
             name: `${ep.name} flow ${flowCount}`,
             filePath: ep.filePath,
-            metadata: { steps: path32, entryPoint: ep.name }
+            metadata: { steps: path33, entryPoint: ep.name }
           });
-          for (let i = 0; i < path32.length; i++) {
+          for (let i = 0; i < path33.length; i++) {
             graph.addEdge({
-              id: generateEdgeId(path32[i], flowId, `step_of_${i}`),
-              source: path32[i],
+              id: generateEdgeId(path33[i], flowId, `step_of_${i}`),
+              source: path33[i],
               target: flowId,
               kind: "step_of",
               weight: 1,
@@ -6346,7 +6579,7 @@ var flowPhase = {
         for (const edge of callEdges) {
           if (visited.has(edge.target)) continue;
           visited.add(edge.target);
-          queue.push({ nodeId: edge.target, path: [...path32, edge.target] });
+          queue.push({ nodeId: edge.target, path: [...path33, edge.target] });
         }
       }
     }
@@ -6364,7 +6597,7 @@ var LLMGovernanceLogger = class {
   }
   /** Path to the JSONL log file. */
   getLogPath() {
-    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path31.join(os13.homedir(), ".code-intel", "llm-governance.jsonl");
+    return process.env["CODE_INTEL_GOVERNANCE_LOG_PATH"] ?? path32.join(os13.homedir(), ".code-intel", "llm-governance.jsonl");
   }
   /**
    * Append an entry to the governance log.
@@ -6380,8 +6613,8 @@ var LLMGovernanceLogger = class {
         ...entry
       };
       const logPath = this.getLogPath();
-      fs24.mkdirSync(path31.dirname(logPath), { recursive: true });
-      fs24.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
+      fs26.mkdirSync(path32.dirname(logPath), { recursive: true });
+      fs26.appendFileSync(logPath, JSON.stringify(full) + "\n", "utf-8");
     } catch {
     }
   }
@@ -6391,7 +6624,7 @@ var LLMGovernanceLogger = class {
    */
   readLog(limit = 100) {
     try {
-      const raw = fs24.readFileSync(this.getLogPath(), "utf-8");
+      const raw = fs26.readFileSync(this.getLogPath(), "utf-8");
       const lines = raw.split("\n").filter((l) => l.trim().length > 0).slice(-limit);
       return lines.map((l) => JSON.parse(l));
     } catch {
@@ -6401,6 +6634,9 @@ var LLMGovernanceLogger = class {
 };
 var governanceLogger = new LLMGovernanceLogger();
 
+// src/pipeline/phases/summarize-phase.ts
+init_logger();
+
 // src/pipeline/workers/parse-phase-parallel.ts
 init_shared();
 init_id_generator();
@@ -6535,17 +6771,17 @@ function traceFlow(entryId, graph, maxDepth = 10, maxBranching = 4) {
     const queue = [{ nodeId: entryId, path: [entryId] }];
     const visited = /* @__PURE__ */ new Set();
     while (queue.length > 0 && flows.length < maxFlows) {
-      const { nodeId, path: path32 } = queue.shift();
-      if (path32.length > maxDepth) continue;
+      const { nodeId, path: path33 } = queue.shift();
+      if (path33.length > maxDepth) continue;
       const callEdges = [...graph.findEdgesFrom(nodeId)].filter((e) => e.kind === "calls").slice(0, maxBranching);
-      if (callEdges.length === 0 && path32.length >= 3) {
-        flows.push({ entryPointId: entryId, steps: [...path32] });
+      if (callEdges.length === 0 && path33.length >= 3) {
+        flows.push({ entryPointId: entryId, steps: [...path33] });
         continue;
       }
       for (const edge of callEdges) {
         if (visited.has(edge.target)) continue;
         visited.add(edge.target);
-        queue.push({ nodeId: edge.target, path: [...path32, edge.target] });
+        queue.push({ nodeId: edge.target, path: [...path33, edge.target] });
       }
     }
   }
@@ -6646,7 +6882,7 @@ var VectorIndex = class {
     this.sqlitePath = sqlitePath;
   }
   async init() {
-    this.db = new Database3(this.sqlitePath);
+    this.db = new Database2(this.sqlitePath);
     this.db.pragma("journal_mode = WAL");
     this.db.exec(`
       CREATE TABLE IF NOT EXISTS ${EMBED_TABLE} (
@@ -6777,9 +7013,9 @@ function siftDown(arr, i, score) {
 }
 init_embedder();
 async function hybridSearch(graph, query, limit, options = {}) {
-  const { vectorDbPath, bm25Limit = 50, vectorLimit = 50 } = options;
-  const bm25Promise = Promise.resolve(textSearch(graph, query, bm25Limit));
-  const hasVectorDb = Boolean(vectorDbPath && fs24.existsSync(vectorDbPath));
+  const { vectorDbPath, bm25Limit = 50, vectorLimit = 50, bm25Results: precomputedBm25 } = options;
+  const bm25Promise = precomputedBm25 ? Promise.resolve(precomputedBm25) : Promise.resolve(textSearch(graph, query, bm25Limit));
+  const hasVectorDb = Boolean(vectorDbPath && fs26.existsSync(vectorDbPath));
   if (!hasVectorDb) {
     const bm25Results2 = await bm25Promise;
     return {
@@ -6828,105 +7064,317 @@ async function runVectorSearch(vectorDbPath, query, topK) {
     return null;
   }
 }
-var DbManager = class {
-  db = null;
-  conn = null;
-  dbPath;
+
+// src/search/bm25-index.ts
+init_logger();
+var K1 = 1.2;
+var B = 0.75;
+function tokenize(text) {
+  return text.toLowerCase().split(/[\s\-_./\\:(){}[\]<>,"'`~!@#$%^&*+=|;?]+/).filter((t) => t.length >= 2 && t.length <= 64);
+}
+function nodeToDoc(node) {
+  return [
+    node.name,
+    node.kind,
+    node.filePath,
+    (node.content ?? "").slice(0, 1e3)
+  ].join(" ");
+}
+function heapTopK(scores, k) {
+  if (k <= 0) return [];
+  const heap = [];
+  function heapifyUp(i) {
+    while (i > 0) {
+      const parent = i - 1 >> 1;
+      if (heap[parent][1] > heap[i][1]) {
+        [heap[parent], heap[i]] = [heap[i], heap[parent]];
+        i = parent;
+      } else break;
+    }
+  }
+  function heapifyDown(i) {
+    const n = heap.length;
+    while (true) {
+      let smallest = i;
+      const l = 2 * i + 1, r = 2 * i + 2;
+      if (l < n && heap[l][1] < heap[smallest][1]) smallest = l;
+      if (r < n && heap[r][1] < heap[smallest][1]) smallest = r;
+      if (smallest === i) break;
+      [heap[smallest], heap[i]] = [heap[i], heap[smallest]];
+      i = smallest;
+    }
+  }
+  for (const [nodeId, score] of scores) {
+    if (heap.length < k) {
+      heap.push([nodeId, score]);
+      heapifyUp(heap.length - 1);
+    } else if (score > heap[0][1]) {
+      heap[0] = [nodeId, score];
+      heapifyDown(0);
+    }
+  }
+  return heap.sort((a, b) => b[1] - a[1]);
+}
+var Bm25Index = class {
   constructor(dbPath) {
     this.dbPath = dbPath;
   }
-  async init() {
-    fs24.mkdirSync(path31.dirname(this.dbPath), { recursive: true });
-    this.db = new Database(this.dbPath);
-    await this.db.init();
-    this.conn = new Connection(this.db);
-    await this.conn.init();
-  }
-  async query(cypher) {
-    if (!this.conn) throw new Error("Database not initialized");
-    const result = await this.conn.query(cypher);
-    const qr = Array.isArray(result) ? result[0] : result;
-    const rows = await qr.getAll();
-    qr.close();
-    return rows;
-  }
-  async execute(cypher) {
-    if (!this.conn) throw new Error("Database not initialized");
-    const result = await this.conn.query(cypher);
-    const qr = Array.isArray(result) ? result[0] : result;
-    qr.close();
-  }
-  close() {
-    try {
-      this.conn?.closeSync();
-    } catch {
+  dbPath;
+  /** In-memory inverted index (populated after `load()`). */
+  invertedIndex = /* @__PURE__ */ new Map();
+  docLengths = /* @__PURE__ */ new Map();
+  nodeMeta = /* @__PURE__ */ new Map();
+  avgdl = 1;
+  docCount = 0;
+  _loaded = false;
+  get isLoaded() {
+    return this._loaded;
+  }
+  // ── Build ───────────────────────────────────────────────────────────────────
+  /**
+   * Build the inverted index from a KnowledgeGraph and persist to SQLite.
+   * Called once at analysis time after the main pipeline completes.
+   */
+  build(graph) {
+    const nodeTermFreqs = /* @__PURE__ */ new Map();
+    const docLengths = /* @__PURE__ */ new Map();
+    const nodeMeta = /* @__PURE__ */ new Map();
+    for (const node of graph.allNodes()) {
+      if (["directory", "cluster", "flow"].includes(node.kind)) continue;
+      const terms = tokenize(nodeToDoc(node));
+      const tf = /* @__PURE__ */ new Map();
+      for (const t of terms) tf.set(t, (tf.get(t) ?? 0) + 1);
+      nodeTermFreqs.set(node.id, tf);
+      docLengths.set(node.id, terms.length);
+      nodeMeta.set(node.id, {
+        name: node.name,
+        kind: node.kind,
+        filePath: node.filePath,
+        snippet: node.content?.slice(0, 200)
+      });
+    }
+    const docCount = nodeTermFreqs.size;
+    const totalLen = [...docLengths.values()].reduce((a, b) => a + b, 0);
+    const avgdl = docCount > 0 ? totalLen / docCount : 1;
+    const invertedIndex = /* @__PURE__ */ new Map();
+    for (const [nodeId, tf] of nodeTermFreqs) {
+      for (const [term, count] of tf) {
+        let postings = invertedIndex.get(term);
+        if (!postings) {
+          postings = [];
+          invertedIndex.set(term, postings);
+        }
+        postings.push({ nodeId, tf: count });
+      }
+    }
+    fs26.mkdirSync(path32.dirname(this.dbPath), { recursive: true });
+    for (const f of [this.dbPath, `${this.dbPath}-shm`, `${this.dbPath}-wal`]) {
+      try {
+        if (fs26.existsSync(f)) fs26.unlinkSync(f);
+      } catch {
+      }
     }
+    const db = new Database2(this.dbPath);
+    db.pragma("journal_mode = WAL");
+    db.exec(`
+      CREATE TABLE bm25_index   (term     TEXT PRIMARY KEY, postings TEXT NOT NULL);
+      CREATE TABLE bm25_doclen  (node_id  TEXT PRIMARY KEY, doclen   INTEGER NOT NULL);
+      CREATE TABLE bm25_nodemeta(node_id  TEXT PRIMARY KEY, name TEXT, kind TEXT, file_path TEXT, snippet TEXT);
+      CREATE TABLE bm25_meta    (key      TEXT PRIMARY KEY, value    TEXT NOT NULL);
+    `);
+    const insPosting = db.prepare("INSERT OR REPLACE INTO bm25_index    VALUES (?, ?)");
+    const insDoclen = db.prepare("INSERT OR REPLACE INTO bm25_doclen   VALUES (?, ?)");
+    const insNodeMeta = db.prepare("INSERT OR REPLACE INTO bm25_nodemeta VALUES (?, ?, ?, ?, ?)");
+    const insMeta = db.prepare("INSERT OR REPLACE INTO bm25_meta     VALUES (?, ?)");
+    db.transaction(() => {
+      for (const [term, postings] of invertedIndex) {
+        insPosting.run(term, JSON.stringify(postings));
+      }
+      for (const [nodeId, len] of docLengths) {
+        insDoclen.run(nodeId, len);
+      }
+      for (const [nodeId, meta] of nodeMeta) {
+        insNodeMeta.run(nodeId, meta.name, meta.kind, meta.filePath, meta.snippet ?? null);
+      }
+      insMeta.run("avgdl", String(avgdl));
+      insMeta.run("docCount", String(docCount));
+    })();
+    db.close();
+    logger_default.info(`  [bm25] Index built: ${invertedIndex.size} terms, ${docCount} documents`);
+  }
+  // ── Load into memory ────────────────────────────────────────────────────────
+  /**
+   * Load the full inverted index into memory.
+   * Called once on `serve` startup.
+   */
+  load() {
+    if (!fs26.existsSync(this.dbPath)) return;
+    const db = new Database2(this.dbPath, { readonly: true });
     try {
-      this.db?.closeSync();
-    } catch {
+      const getMeta = db.prepare("SELECT value FROM bm25_meta WHERE key = ?");
+      this.avgdl = parseFloat(getMeta.get("avgdl")?.value ?? "1");
+      this.docCount = parseInt(getMeta.get("docCount")?.value ?? "0", 10);
+      this.invertedIndex.clear();
+      const postingRows = db.prepare("SELECT term, postings FROM bm25_index").all();
+      for (const row of postingRows) {
+        this.invertedIndex.set(row.term, JSON.parse(row.postings));
+      }
+      this.docLengths.clear();
+      const dlRows = db.prepare("SELECT node_id, doclen FROM bm25_doclen").all();
+      for (const row of dlRows) {
+        this.docLengths.set(row.node_id, row.doclen);
+      }
+      this.nodeMeta.clear();
+      const metaRows = db.prepare("SELECT node_id, name, kind, file_path, snippet FROM bm25_nodemeta").all();
+      for (const row of metaRows) {
+        this.nodeMeta.set(row.node_id, {
+          name: row.name,
+          kind: row.kind,
+          filePath: row.file_path,
+          snippet: row.snippet ?? void 0
+        });
+      }
+      this._loaded = true;
+      logger_default.info(`  [bm25] Index loaded (${this.invertedIndex.size} terms)`);
+    } finally {
+      db.close();
     }
-    this.conn = null;
-    this.db = null;
   }
-  get isOpen() {
-    return this.conn !== null;
+  // ── Search ──────────────────────────────────────────────────────────────────
+  /**
+   * BM25 search.
+   *
+   * Performance strategy:
+   *  1. Skip ultra-high-df terms (df/N > 0.6) — near-zero IDF, dominate posting
+   *     lists for common words like "function", "return", "export" in large repos.
+   *  2. Min-heap top-K selection — O(n log k) instead of full O(n log n) sort.
+   *     For k=10 and n=30,000 candidates this is ~10× faster than Array.sort.
+   */
+  search(query, limit) {
+    if (!this._loaded || this.invertedIndex.size === 0) return [];
+    const queryTerms = [...new Set(tokenize(query))];
+    if (queryTerms.length === 0) return [];
+    const scores = /* @__PURE__ */ new Map();
+    const N = this.docCount;
+    const avgdl = this.avgdl;
+    for (const term of queryTerms) {
+      const postings = this.invertedIndex.get(term);
+      if (!postings) continue;
+      const df = postings.length;
+      if (N > 100 && df / N > 0.6) continue;
+      const idf = Math.log((N - df + 0.5) / (df + 0.5) + 1);
+      for (const { nodeId, tf } of postings) {
+        const dl = this.docLengths.get(nodeId) ?? avgdl;
+        const score = idf * (tf * (K1 + 1)) / (tf + K1 * (1 - B + B * (dl / avgdl)));
+        scores.set(nodeId, (scores.get(nodeId) ?? 0) + score);
+      }
+    }
+    if (scores.size === 0) return [];
+    const topEntries = heapTopK(scores, limit);
+    return topEntries.map(([nodeId, score]) => {
+      const meta = this.nodeMeta.get(nodeId);
+      return {
+        nodeId,
+        name: meta?.name ?? nodeId,
+        kind: meta?.kind ?? "unknown",
+        filePath: meta?.filePath ?? "",
+        score,
+        snippet: meta?.snippet
+      };
+    });
   }
-};
-
-// src/storage/schema.ts
-var NODE_TABLE_MAP = {
-  file: "file_nodes",
-  directory: "dir_nodes",
-  function: "func_nodes",
-  class: "class_nodes",
-  interface: "iface_nodes",
-  method: "method_nodes",
-  constructor: "ctor_nodes",
-  variable: "var_nodes",
-  property: "prop_nodes",
-  struct: "struct_nodes",
-  enum: "enum_nodes",
-  trait: "trait_nodes",
-  namespace: "ns_nodes",
-  module: "mod_nodes",
-  type_alias: "type_nodes",
-  constant: "const_nodes",
-  route: "route_nodes",
-  cluster: "cluster_nodes",
-  flow: "flow_nodes",
-  vulnerability: "vuln_nodes"
-};
-var ALL_NODE_TABLES = [...new Set(Object.values(NODE_TABLE_MAP))];
-function getCreateNodeTableDDL(tableName) {
-  return `CREATE NODE TABLE IF NOT EXISTS ${tableName} (
-  id STRING,
-  name STRING,
-  file_path STRING,
-  start_line INT64,
-  end_line INT64,
-  exported BOOLEAN,
-  content STRING,
-  metadata STRING,
-  PRIMARY KEY (id)
-)`;
-}
-function getCreateEdgeTableDDL() {
-  const uniqueTables = ALL_NODE_TABLES;
-  const fromToPairs = [];
-  for (const from of uniqueTables) {
-    for (const to of uniqueTables) {
-      fromToPairs.push(`FROM ${from} TO ${to}`);
+  // ── Incremental update ──────────────────────────────────────────────────────
+  /**
+   * Incrementally update index for a set of changed/added nodes.
+   * Only terms that overlap with the changed nodes are rewritten.
+   * Works even if `load()` was not called (reads affected terms directly from DB).
+   */
+  updateNodes(nodes) {
+    if (!fs26.existsSync(this.dbPath)) return;
+    if (nodes.length === 0) return;
+    const changedIds = new Set(nodes.map((n) => n.id));
+    const newTermFreqs = /* @__PURE__ */ new Map();
+    for (const node of nodes) {
+      if (["directory", "cluster", "flow"].includes(node.kind)) continue;
+      const terms = tokenize(nodeToDoc(node));
+      const tf = /* @__PURE__ */ new Map();
+      for (const t of terms) tf.set(t, (tf.get(t) ?? 0) + 1);
+      newTermFreqs.set(node.id, tf);
+    }
+    const newTermSet = new Set([...newTermFreqs.values()].flatMap((m) => [...m.keys()]));
+    const db = new Database2(this.dbPath);
+    db.pragma("journal_mode = WAL");
+    const termsToRewrite = /* @__PURE__ */ new Map();
+    for (const term of newTermSet) {
+      const row = db.prepare("SELECT postings FROM bm25_index WHERE term = ?").get(term);
+      const existing = row ? JSON.parse(row.postings) : [];
+      termsToRewrite.set(term, existing.filter((p) => !changedIds.has(p.nodeId)));
+    }
+    for (const nodeId of changedIds) {
+      const rows = db.prepare("SELECT term, postings FROM bm25_index WHERE postings LIKE ?").all(`%${nodeId}%`);
+      for (const row of rows) {
+        if (termsToRewrite.has(row.term)) continue;
+        const postings = JSON.parse(row.postings);
+        if (postings.some((p) => changedIds.has(p.nodeId))) {
+          termsToRewrite.set(row.term, postings.filter((p) => !changedIds.has(p.nodeId)));
+        }
+      }
+    }
+    for (const [nodeId, tf] of newTermFreqs) {
+      for (const [term, count] of tf) {
+        const postings = termsToRewrite.get(term) ?? [];
+        postings.push({ nodeId, tf: count });
+        termsToRewrite.set(term, postings);
+      }
+    }
+    const upsertPosting = db.prepare("INSERT OR REPLACE INTO bm25_index    VALUES (?, ?)");
+    const upsertDoclen = db.prepare("INSERT OR REPLACE INTO bm25_doclen   VALUES (?, ?)");
+    const upsertNodeMeta = db.prepare("INSERT OR REPLACE INTO bm25_nodemeta VALUES (?, ?, ?, ?, ?)");
+    db.transaction(() => {
+      for (const [term, postings] of termsToRewrite) {
+        if (postings.length === 0) {
+          db.prepare("DELETE FROM bm25_index WHERE term = ?").run(term);
+        } else {
+          upsertPosting.run(term, JSON.stringify(postings));
+        }
+      }
+      for (const node of nodes) {
+        const terms = tokenize(nodeToDoc(node));
+        upsertDoclen.run(node.id, terms.length);
+        upsertNodeMeta.run(node.id, node.name, node.kind, node.filePath, node.content?.slice(0, 200) ?? null);
+      }
+    })();
+    db.close();
+    if (this._loaded) {
+      for (const [term, postings] of termsToRewrite) {
+        if (postings.length === 0) this.invertedIndex.delete(term);
+        else this.invertedIndex.set(term, postings);
+      }
+      for (const node of nodes) {
+        const terms = tokenize(nodeToDoc(node));
+        this.docLengths.set(node.id, terms.length);
+        this.nodeMeta.set(node.id, {
+          name: node.name,
+          kind: node.kind,
+          filePath: node.filePath,
+          snippet: node.content?.slice(0, 200)
+        });
+      }
     }
   }
-  return [`CREATE REL TABLE GROUP IF NOT EXISTS code_edges (
-  ${fromToPairs.join(",\n  ")},
-  kind STRING,
-  weight DOUBLE,
-  label STRING
-)`];
+};
+function getBm25DbPath(workspaceRoot) {
+  return path32.join(workspaceRoot, ".code-intel", "bm25.db");
 }
+
+// src/storage/index.ts
+init_db_manager();
+init_schema();
+
+// src/storage/csv-writer.ts
+init_schema();
 function writeNodeCSVs(graph, outputDir) {
-  fs24.mkdirSync(outputDir, { recursive: true });
+  fs26.mkdirSync(outputDir, { recursive: true });
   const header = "id,name,file_path,start_line,end_line,exported,content,metadata\n";
   const tableBuffers = /* @__PURE__ */ new Map();
   const tableFilePaths = /* @__PURE__ */ new Map();
@@ -6934,7 +7382,7 @@ function writeNodeCSVs(graph, outputDir) {
     const table = NODE_TABLE_MAP[node.kind];
     if (!tableBuffers.has(table)) {
       tableBuffers.set(table, [header]);
-      tableFilePaths.set(table, path31.join(outputDir, `${table}.csv`));
+      tableFilePaths.set(table, path32.join(outputDir, `${table}.csv`));
     }
     tableBuffers.get(table).push(
       csvRow([
@@ -6954,12 +7402,12 @@ function writeNodeCSVs(graph, outputDir) {
     );
   }
   for (const [table, lines] of tableBuffers) {
-    fs24.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
+    fs26.writeFileSync(tableFilePaths.get(table), lines.join(""), "utf-8");
   }
   return tableFilePaths;
 }
 function writeEdgeCSV(graph, outputDir) {
-  fs24.mkdirSync(outputDir, { recursive: true });
+  fs26.mkdirSync(outputDir, { recursive: true });
   const header = "from_id,to_id,kind,weight,label\n";
   const groups = /* @__PURE__ */ new Map();
   for (const edge of graph.allEdges()) {
@@ -6970,7 +7418,7 @@ function writeEdgeCSV(graph, outputDir) {
     const toTable = NODE_TABLE_MAP[targetNode.kind];
     const key = `${fromTable}->${toTable}`;
     if (!groups.has(key)) {
-      const filePath = path31.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
+      const filePath = path32.join(outputDir, `edges_${fromTable}_${toTable}.csv`);
       groups.set(key, { lines: [header], from: fromTable, to: toTable, filePath });
     }
     groups.get(key).lines.push(
@@ -6985,7 +7433,7 @@ function writeEdgeCSV(graph, outputDir) {
   }
   const result = [];
   for (const group of groups.values()) {
-    fs24.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
+    fs26.writeFileSync(group.filePath, group.lines.join(""), "utf-8");
     result.push({ fromTable: group.from, toTable: group.to, filePath: group.filePath });
   }
   return result;
@@ -7002,6 +7450,9 @@ function escapeNewlines(s) {
   if (!s.includes("\n") && !s.includes("\r")) return s;
   return s.replace(/\r/g, "\\r").replace(/\n/g, "\\n");
 }
+
+// src/storage/graph-loader.ts
+init_schema();
 async function loadGraphToDB(graph, dbManager) {
   for (const table of ALL_NODE_TABLES) {
     await dbManager.execute(getCreateNodeTableDDL(table));
@@ -7013,7 +7464,7 @@ async function loadGraphToDB(graph, dbManager) {
     } catch {
     }
   }
-  const tmpDir = fs24.mkdtempSync(path31.join(os13.tmpdir(), "code-intel-csv-"));
+  const tmpDir = fs26.mkdtempSync(path32.join(os13.tmpdir(), "code-intel-csv-"));
   try {
     const nodeTableFiles = writeNodeCSVs(graph, tmpDir);
     const edgeGroups = writeEdgeCSV(graph, tmpDir);
@@ -7032,8 +7483,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let nodeCount = 0;
     for (const [table, csvPath] of nodeTableFiles) {
-      if (!fs24.existsSync(csvPath)) continue;
-      const stat = fs24.statSync(csvPath);
+      if (!fs26.existsSync(csvPath)) continue;
+      const stat = fs26.statSync(csvPath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -7046,8 +7497,8 @@ async function loadGraphToDB(graph, dbManager) {
     }
     let edgeCount = 0;
     for (const group of edgeGroups) {
-      if (!fs24.existsSync(group.filePath)) continue;
-      const stat = fs24.statSync(group.filePath);
+      if (!fs26.existsSync(group.filePath)) continue;
+      const stat = fs26.statSync(group.filePath);
       if (stat.size < 50) continue;
       try {
         await dbManager.execute(
@@ -7061,7 +7512,7 @@ async function loadGraphToDB(graph, dbManager) {
     return { nodeCount, edgeCount };
   } finally {
     try {
-      fs24.rmSync(tmpDir, { recursive: true, force: true });
+      fs26.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -7113,19 +7564,19 @@ function buildNodeProps(node) {
 function escCypher(s) {
   return s.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "");
 }
-var GLOBAL_DIR = path31.join(os13.homedir(), ".code-intel");
-var REPOS_FILE = path31.join(GLOBAL_DIR, "repos.json");
+var GLOBAL_DIR = path32.join(os13.homedir(), ".code-intel");
+var REPOS_FILE = path32.join(GLOBAL_DIR, "repos.json");
 function loadRegistry() {
   try {
-    const data = fs24.readFileSync(REPOS_FILE, "utf-8");
+    const data = fs26.readFileSync(REPOS_FILE, "utf-8");
     return JSON.parse(data);
   } catch {
     return [];
   }
 }
 function saveRegistry(entries) {
-  fs24.mkdirSync(GLOBAL_DIR, { recursive: true });
-  fs24.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
+  fs26.mkdirSync(GLOBAL_DIR, { recursive: true });
+  fs26.writeFileSync(REPOS_FILE, JSON.stringify(entries, null, 2));
 }
 function upsertRepo(entry) {
   const entries = loadRegistry();
@@ -7142,99 +7593,30 @@ function removeRepo(repoPath) {
   saveRegistry(entries);
 }
 function saveMetadata(repoDir, metadata) {
-  const metaDir = path31.join(repoDir, ".code-intel");
-  fs24.mkdirSync(metaDir, { recursive: true });
-  fs24.writeFileSync(path31.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
+  const metaDir = path32.join(repoDir, ".code-intel");
+  fs26.mkdirSync(metaDir, { recursive: true });
+  fs26.writeFileSync(path32.join(metaDir, "meta.json"), JSON.stringify(metadata, null, 2));
 }
 function loadMetadata(repoDir) {
   try {
-    const data = fs24.readFileSync(path31.join(repoDir, ".code-intel", "meta.json"), "utf-8");
+    const data = fs26.readFileSync(path32.join(repoDir, ".code-intel", "meta.json"), "utf-8");
     return JSON.parse(data);
   } catch {
     return null;
   }
 }
 function getDbPath(repoDir) {
-  return path31.join(repoDir, ".code-intel", "graph.db");
+  return path32.join(repoDir, ".code-intel", "graph.db");
 }
 function getVectorDbPath(repoDir) {
-  return path31.join(repoDir, ".code-intel", "vector.db");
+  return path32.join(repoDir, ".code-intel", "vector.db");
 }
 
 // src/mcp-server/server.ts
 init_group_registry();
-
-// src/multi-repo/graph-from-db.ts
-var TABLE_TO_KIND = Object.fromEntries(
-  Object.entries(NODE_TABLE_MAP).map(([kind, table]) => [table, kind])
-);
-function parseRow(row, kind) {
-  return {
-    id: String(row["id"] ?? ""),
-    kind,
-    name: String(row["name"] ?? ""),
-    filePath: String(row["file_path"] ?? ""),
-    startLine: row["start_line"] != null ? Number(row["start_line"]) : void 0,
-    endLine: row["end_line"] != null ? Number(row["end_line"]) : void 0,
-    exported: row["exported"] != null ? Boolean(row["exported"]) : void 0,
-    content: row["content"] ? String(row["content"]) : void 0,
-    metadata: row["metadata"] ? (() => {
-      try {
-        return JSON.parse(String(row["metadata"]));
-      } catch {
-        return void 0;
-      }
-    })() : void 0
-  };
-}
-async function loadGraphFromDB(graph, db) {
-  for (const table of ALL_NODE_TABLES) {
-    const kind = TABLE_TO_KIND[table];
-    if (!kind) continue;
-    let rows = [];
-    try {
-      rows = await db.query(`MATCH (n:${table}) RETURN n.id, n.name, n.file_path, n.start_line, n.end_line, n.exported, n.content, n.metadata`);
-    } catch {
-      continue;
-    }
-    for (const row of rows) {
-      const node = parseRow({
-        id: row["n.id"],
-        name: row["n.name"],
-        file_path: row["n.file_path"],
-        start_line: row["n.start_line"],
-        end_line: row["n.end_line"],
-        exported: row["n.exported"],
-        content: row["n.content"],
-        metadata: row["n.metadata"]
-      }, kind);
-      if (node.id && node.name) graph.addNode(node);
-    }
-  }
-  try {
-    const edgeRows = await db.query(
-      `MATCH (a)-[e:code_edges]->(b) RETURN a.id, b.id, e.kind, e.weight, e.label`
-    );
-    for (const row of edgeRows) {
-      const sourceId = String(row["a.id"] ?? "");
-      const targetId = String(row["b.id"] ?? "");
-      const kind = String(row["e.kind"] ?? "");
-      if (!sourceId || !targetId || !kind) continue;
-      const edge = {
-        id: `${sourceId}::${kind}::${targetId}`,
-        source: sourceId,
-        target: targetId,
-        kind,
-        weight: row["e.weight"] != null ? Number(row["e.weight"]) : void 0,
-        label: row["e.label"] ? String(row["e.label"]) : void 0
-      };
-      graph.addEdge(edge);
-    }
-  } catch {
-  }
-}
-
-// src/multi-repo/group-sync.ts
+init_db_manager();
+init_knowledge_graph();
+init_graph_from_db();
 init_logger();
 function scanForFiles(root, matcher, maxDepth = 2) {
   const results = [];
@@ -7242,12 +7624,12 @@ function scanForFiles(root, matcher, maxDepth = 2) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = fs24.readdirSync(dir, { withFileTypes: true });
+      entries = fs26.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = path31.join(dir, entry.name);
+      const full = path32.join(dir, entry.name);
       if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
         walk(full, depth + 1);
       } else if (entry.isFile() && matcher(entry.name)) {
@@ -7270,8 +7652,8 @@ var OPENAPI_FILENAMES = /* @__PURE__ */ new Set([
 ]);
 var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options"];
 function tryParseFile(filePath) {
-  const ext = path31.extname(filePath).toLowerCase();
-  const content = fs24.readFileSync(filePath, "utf-8");
+  const ext = path32.extname(filePath).toLowerCase();
+  const content = fs26.readFileSync(filePath, "utf-8");
   if (ext === ".json") {
     try {
       return JSON.parse(content);
@@ -7325,7 +7707,7 @@ async function parseGraphQLContracts(repoRoot) {
   const files = scanForFiles(repoRoot, (name) => name.endsWith(".graphql") || name.endsWith(".gql"));
   const contracts = [];
   for (const filePath of files) {
-    const content = fs24.readFileSync(filePath, "utf-8");
+    const content = fs26.readFileSync(filePath, "utf-8");
     const typeRegex = /type\s+(\w+)\s*\{([^}]+)\}/g;
     let match;
     while ((match = typeRegex.exec(content)) !== null) {
@@ -7356,7 +7738,7 @@ async function parseProtoContracts(repoRoot) {
   const files = scanForFiles(repoRoot, (name) => name.endsWith(".proto"));
   const contracts = [];
   for (const filePath of files) {
-    const content = fs24.readFileSync(filePath, "utf-8");
+    const content = fs26.readFileSync(filePath, "utf-8");
     const serviceRegex = /service\s+(\w+)\s*\{([^}]+)\}/g;
     let serviceMatch;
     while ((serviceMatch = serviceRegex.exec(content)) !== null) {
@@ -7561,13 +7943,13 @@ async function syncGroup(group) {
       logger_default.warn(`  \u26A0 Registry entry "${member.registryName}" not found \u2014 skipping ${member.groupPath}`);
       continue;
     }
-    const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs24.existsSync(dbPath)) {
+    const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs26.existsSync(dbPath)) {
       logger_default.warn(`  \u26A0 No index at ${dbPath} \u2014 run \`code-intel analyze ${regEntry.path}\` first`);
       continue;
     }
     const graph = createKnowledgeGraph();
-    const db = new DbManager(dbPath);
+    const db = new DbManager(dbPath, true);
     try {
       await db.init();
       await loadGraphFromDB(graph, db);
@@ -7628,6 +8010,9 @@ async function syncGroup(group) {
     links
   };
 }
+init_db_manager();
+init_knowledge_graph();
+init_graph_from_db();
 async function queryGroup(group, query, limit = 20) {
   const registry = loadRegistry();
   const perRepo = [];
@@ -7635,10 +8020,10 @@ async function queryGroup(group, query, limit = 20) {
   for (const member of group.members) {
     const regEntry = registry.find((r) => r.name === member.registryName);
     if (!regEntry) continue;
-    const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
-    if (!fs24.existsSync(dbPath)) continue;
+    const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+    if (!fs26.existsSync(dbPath)) continue;
     const graph = createKnowledgeGraph();
-    const db = new DbManager(dbPath);
+    const db = new DbManager(dbPath, true);
     try {
       await db.init();
       await loadGraphFromDB(graph, db);
@@ -8136,22 +8521,22 @@ function suggestTests(graph, symbolName) {
   const callPaths = [];
   const pathQueue = [{ id: targetId, path: [symbolName], depth: 0 }];
   while (pathQueue.length > 0 && callPaths.length < 5) {
-    const { id, path: path32, depth } = pathQueue.shift();
+    const { id, path: path33, depth } = pathQueue.shift();
     let hasCallers2 = false;
     for (const edge of graph.findEdgesTo(id)) {
       if (edge.kind !== "calls") continue;
       const callerNode = graph.getNode(edge.source);
       if (!callerNode) continue;
       hasCallers2 = true;
-      const newPath = [callerNode.name, ...path32];
+      const newPath = [callerNode.name, ...path33];
       if (depth + 1 >= 3 || callPaths.length >= 5) {
         if (callPaths.length < 5) callPaths.push(newPath);
         continue;
       }
       pathQueue.push({ id: edge.source, path: newPath, depth: depth + 1 });
     }
-    if (!hasCallers2 && path32.length > 1) {
-      callPaths.push(path32);
+    if (!hasCallers2 && path33.length > 1) {
+      callPaths.push(path33);
     }
   }
   if (callPaths.length === 0) {
@@ -8284,11 +8669,30 @@ function summarizeCluster(graph, cluster) {
 }
 
 // src/mcp-server/server.ts
+function compact(obj) {
+  return JSON.stringify(obj, (_key, value) => value === null || value === void 0 ? void 0 : value);
+}
 function createMcpServer(graph, repoName, workspaceRoot) {
   const server = new Server(
     { name: "code-intel", version: "0.1.0" },
     { capabilities: { tools: {}, resources: {} } }
   );
+  let bm25Index = null;
+  function ensureBm25Index() {
+    if (bm25Index) return bm25Index;
+    if (!workspaceRoot) return null;
+    try {
+      const idx = new Bm25Index(getBm25DbPath(workspaceRoot));
+      idx.load();
+      bm25Index = idx;
+      return bm25Index;
+    } catch {
+      return null;
+    }
+  }
+  if (workspaceRoot) {
+    setImmediate(() => ensureBm25Index());
+  }
   const _tokenProp = {
     _token: { type: "string", description: "Required if CODE_INTEL_TOKEN is configured" }
   };
@@ -8308,13 +8712,15 @@ function createMcpServer(graph, repoName, workspaceRoot) {
       // ── Search & inspect ─────────────────────────────────────────────────
       {
         name: "search",
-        description: "BM25 keyword search across all indexed symbols \u2014 functions, classes, files, routes, etc.",
+        description: "BM25 keyword search across all indexed symbols \u2014 functions, classes, files, routes, etc. Optionally scope to a specific repo or group.",
         inputSchema: {
           type: "object",
           properties: {
             query: { type: "string", description: "Search query (symbol name, keyword, or partial match)" },
             offset: { type: "number", description: "Number of results to skip for pagination (default: 0)" },
-            limit: { type: "number", description: "Max results per page (default: 50, max: 500)" },
+            limit: { type: "number", description: "Max results per page (default: 10, max: 500)" },
+            repo: { type: "string", description: "Scope search to a specific indexed repo name (optional; defaults to current repo)" },
+            group: { type: "string", description: "Scope search across all repos in a group via cross-repo RRF merge (optional; overrides repo)" },
             ..._tokenProp
           },
           required: ["query"]
@@ -8344,7 +8750,7 @@ function createMcpServer(graph, repoName, workspaceRoot) {
               enum: ["callers", "callees", "both"],
               description: "Which direction to trace \u2014 callers (who depends on it), callees (what it depends on), or both (default: both)"
             },
-            max_hops: { type: "number", description: "Maximum traversal depth (default: 5)" },
+            max_hops: { type: "number", description: "Maximum traversal depth (default: 2, max: 10)" },
             ..._tokenProp
           },
           required: ["target"]
@@ -8358,7 +8764,7 @@ function createMcpServer(graph, repoName, workspaceRoot) {
           properties: {
             file_path: { type: "string", description: 'File path (partial match is supported, e.g. "auth/login.ts")' },
             offset: { type: "number", description: "Number of results to skip for pagination (default: 0)" },
-            limit: { type: "number", description: "Max results per page (default: 50, max: 500)" },
+            limit: { type: "number", description: "Max results per page (default: 10, max: 500)" },
             ..._tokenProp
           },
           required: ["file_path"]
@@ -8389,7 +8795,7 @@ function createMcpServer(graph, repoName, workspaceRoot) {
               description: "Filter by node kind: function | class | interface | method | type_alias | constant | enum (optional)"
             },
             offset: { type: "number", description: "Number of results to skip for pagination (default: 0)" },
-            limit: { type: "number", description: "Max results per page (default: 50, max: 500)" },
+            limit: { type: "number", description: "Max results per page (default: 10, max: 500)" },
             ..._tokenProp
           }
         }
@@ -8407,7 +8813,7 @@ function createMcpServer(graph, repoName, workspaceRoot) {
           type: "object",
           properties: {
             offset: { type: "number", description: "Number of results to skip for pagination (default: 0)" },
-            limit: { type: "number", description: "Max clusters per page (default: 50, max: 500)" },
+            limit: { type: "number", description: "Max clusters per page (default: 10, max: 500)" },
             ..._tokenProp
           }
         }
@@ -8419,7 +8825,7 @@ function createMcpServer(graph, repoName, workspaceRoot) {
           type: "object",
           properties: {
             offset: { type: "number", description: "Number of results to skip for pagination (default: 0)" },
-            limit: { type: "number", description: "Max flows per page (default: 50, max: 500)" },
+            limit: { type: "number", description: "Max flows per page (default: 10, max: 500)" },
             ..._tokenProp
           }
         }
@@ -8573,7 +8979,7 @@ function createMcpServer(graph, repoName, workspaceRoot) {
             },
             maxHops: {
               type: "number",
-              description: "Maximum BFS depth for blast radius (default: 5)"
+              description: "Maximum BFS depth for blast radius (default: 2, max: 10)"
             },
             ..._tokenProp
           }
@@ -8701,31 +9107,51 @@ function createMcpServer(graph, repoName, workspaceRoot) {
       const providedToken = a._token;
       if (providedToken !== expectedToken) {
         return {
-          content: [{ type: "text", text: JSON.stringify({ error: "Unauthorized: invalid or missing CODE_INTEL_TOKEN" }) }],
+          content: [{ type: "text", text: compact({ error: "Unauthorized: invalid or missing CODE_INTEL_TOKEN" }) }],
           isError: true
         };
       }
     }
     const startMs = Date.now();
-    const dispatch = () => dispatchTool(name, a, graph, repoName, workspaceRoot);
+    const dispatch = () => dispatchTool(name, a, graph, repoName, workspaceRoot, ensureBm25Index);
+    const MCP_TIMEOUT_MS = parseInt(process.env["CODE_INTEL_MCP_TIMEOUT_MS"] ?? "30000", 10);
+    let timeoutHandle = null;
+    let timedOut = false;
+    const timeoutPromise = new Promise((_, reject) => {
+      timeoutHandle = setTimeout(() => {
+        timedOut = true;
+        reject(new Error(`MCP tool '${name}' timed out after ${MCP_TIMEOUT_MS}ms`));
+      }, MCP_TIMEOUT_MS);
+    });
     let result;
     let status = "success";
     try {
       if (isTracingEnabled()) {
-        result = await withSpan(
-          `mcp.tool.${name}`,
-          sanitizeAttrs({ "mcp.tool": name, "mcp.repo": repoName }),
-          dispatch
-        );
+        result = await Promise.race([
+          withSpan(
+            `mcp.tool.${name}`,
+            sanitizeAttrs({ "mcp.tool": name, "mcp.repo": repoName }),
+            dispatch
+          ),
+          timeoutPromise
+        ]);
       } else {
-        result = await dispatch();
+        result = await Promise.race([dispatch(), timeoutPromise]);
       }
       if (result.isError) status = "error";
     } catch (err) {
       status = "error";
       mcpToolCallsTotal.inc({ tool: name, status });
       mcpToolDurationSeconds.observe({ tool: name }, (Date.now() - startMs) / 1e3);
+      if (timedOut) {
+        return {
+          content: [{ type: "text", text: compact({ truncated: true, reason: `Tool '${name}' timed out after ${MCP_TIMEOUT_MS}ms`, partialResults: [] }) }],
+          isError: false
+        };
+      }
       throw err;
+    } finally {
+      if (timeoutHandle) clearTimeout(timeoutHandle);
     }
     mcpToolCallsTotal.inc({ tool: name, status });
     mcpToolDurationSeconds.observe({ tool: name }, (Date.now() - startMs) / 1e3);
@@ -8734,7 +9160,7 @@ function createMcpServer(graph, repoName, workspaceRoot) {
   registerResources(server, graph, repoName);
   return server;
 }
-async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
+async function dispatchTool(name, a, graph, repoName, workspaceRoot, bm25Resolver) {
   switch (name) {
     // ── repos ──────────────────────────────────────────────────────────────
     case "repos": {
@@ -8742,10 +9168,8 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify(
-            registry.map((r) => ({ name: r.name, path: r.path, indexedAt: r.indexedAt, stats: r.stats })),
-            null,
-            2
+          text: compact(
+            registry.map((r) => ({ name: r.name, path: r.path, indexedAt: r.indexedAt, stats: r.stats }))
           )
         }]
       };
@@ -8773,13 +9197,13 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             repo: repoName,
             stats: graph.size,
             nodeCounts: kindCounts,
             edgeCounts,
             health
-          }, null, 2)
+          })
         }]
       };
     }
@@ -8787,15 +9211,59 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
     case "search": {
       const query = a.query;
       const offset = a.offset ?? 0;
-      const effectiveLimit = Math.min(a.limit ?? 50, 500);
+      const effectiveLimit = Math.min(a.limit ?? 10, 500);
+      if (a.group) {
+        const grp = loadGroup(a.group);
+        if (!grp) {
+          return { content: [{ type: "text", text: `Group "${a.group}" not found. Use list_groups to see available groups.` }] };
+        }
+        const { perRepo, merged } = await queryGroup(grp, query, effectiveLimit + offset);
+        const paged = merged.slice(offset, offset + effectiveLimit);
+        return {
+          content: [{
+            type: "text",
+            text: compact({
+              results: paged,
+              perRepo,
+              searchMode: "bm25-cross-repo",
+              group: a.group,
+              total: merged.length,
+              offset,
+              limit: effectiveLimit,
+              hasMore: offset + effectiveLimit < merged.length
+            })
+          }]
+        };
+      }
+      const repoGraph = a.repo ? await (async () => {
+        const registry = loadRegistry();
+        const entry = registry.find((r) => r.name === a.repo || r.path === a.repo);
+        if (!entry) return graph;
+        const { DbManager: DbMgr } = await Promise.resolve().then(() => (init_db_manager(), db_manager_exports));
+        const { loadGraphFromDB: loadG } = await Promise.resolve().then(() => (init_graph_from_db(), graph_from_db_exports));
+        const { createKnowledgeGraph: createG } = await Promise.resolve().then(() => (init_knowledge_graph(), knowledge_graph_exports));
+        const dbPath = path32.join(entry.path, ".code-intel", "graph.db");
+        if (!fs26.existsSync(dbPath)) return graph;
+        const db = new DbMgr(dbPath, true);
+        await db.init();
+        const g = createG();
+        await loadG(g, db);
+        db.close();
+        return g;
+      })() : graph;
       const vdbPath = workspaceRoot ? getVectorDbPath(workspaceRoot) : void 0;
       const fetchLimit = Math.min(offset + effectiveLimit, 500);
-      const { results: allResults, searchMode } = await hybridSearch(graph, query, fetchLimit, { vectorDbPath: vdbPath });
+      const bm25 = !a.repo || a.repo === repoName ? bm25Resolver ? bm25Resolver() : null : null;
+      const bm25Results = bm25 ? bm25.search(query, fetchLimit * 3) : void 0;
+      const { results: allResults, searchMode } = await hybridSearch(repoGraph, query, fetchLimit, {
+        vectorDbPath: vdbPath,
+        bm25Results: bm25Results ?? void 0
+      });
       const total = allResults.length;
       const results = allResults.slice(offset, offset + effectiveLimit);
       const hasMore = offset + effectiveLimit < total;
       const suggestNextTools = [];
-      const suggestEnabled = process.env["CODE_INTEL_SUGGEST_NEXT_TOOLS"] !== "false";
+      const suggestEnabled = process.env["CODE_INTEL_SUGGEST_NEXT_TOOLS"] === "true";
       if (suggestEnabled && results.length > 0) {
         const topName = results[0].name;
         suggestNextTools.push(
@@ -8806,15 +9274,16 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             results,
             searchMode,
+            repo: a.repo ?? repoName,
             total,
             offset,
             limit: effectiveLimit,
             hasMore,
             ...suggestEnabled ? { suggested_next_tools: suggestNextTools } : {}
-          }, null, 2)
+          })
         }]
       };
     }
@@ -8836,7 +9305,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
         file: graph.getNode(e.target)?.filePath
       }));
       const cluster = incoming.filter((e) => e.kind === "belongs_to").map((e) => graph.getNode(e.target)?.name)[0];
-      const suggestEnabled = process.env["CODE_INTEL_SUGGEST_NEXT_TOOLS"] !== "false";
+      const suggestEnabled = process.env["CODE_INTEL_SUGGEST_NEXT_TOOLS"] === "true";
       const suggestNextTools = [];
       if (suggestEnabled) {
         const topCallerName = callers[0]?.name;
@@ -8848,7 +9317,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             node: {
               id: node.id,
               kind: node.kind,
@@ -8871,7 +9340,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
             cluster,
             content: node.content?.slice(0, 500),
             ...suggestEnabled ? { suggested_next_tools: suggestNextTools } : {}
-          }, null, 2)
+          })
         }]
       };
     }
@@ -8879,7 +9348,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
     case "blast_radius": {
       const target = a.target;
       const direction = a.direction ?? "both";
-      const maxHops = a.max_hops ?? 5;
+      const maxHops = a.max_hops ?? 2;
       const node = findNodeByName(graph, target);
       if (!node) return { content: [{ type: "text", text: `Symbol "${target}" not found.` }] };
       const affected = /* @__PURE__ */ new Set();
@@ -8906,7 +9375,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
         return n ? { id, name: n.name, kind: n.kind, filePath: n.filePath } : { id };
       });
       const risk = affected.size > 10 ? "HIGH" : affected.size > 5 ? "MEDIUM" : "LOW";
-      const suggestEnabled = process.env["CODE_INTEL_SUGGEST_NEXT_TOOLS"] !== "false";
+      const suggestEnabled = process.env["CODE_INTEL_SUGGEST_NEXT_TOOLS"] === "true";
       const suggestNextTools = [];
       if (suggestEnabled) {
         const highestRiskSymbol = node.name;
@@ -8919,13 +9388,13 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             target: node.name,
             affectedCount: affected.size,
             riskLevel: risk,
             affected: affectedDetails,
             ...suggestEnabled ? { suggested_next_tools: suggestNextTools } : {}
-          }, null, 2)
+          })
         }]
       };
     }
@@ -8933,7 +9402,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
     case "file_symbols": {
       const filePath = a.file_path;
       const offset = a.offset ?? 0;
-      const effectiveLimit = Math.min(a.limit ?? 50, 500);
+      const effectiveLimit = Math.min(a.limit ?? 10, 500);
       const allMatches = [];
       for (const node of graph.allNodes()) {
         if (node.filePath && node.filePath.includes(filePath)) {
@@ -8950,7 +9419,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({ symbols: matches, total, offset, limit: effectiveLimit, hasMore }, null, 2)
+          text: compact({ symbols: matches, total, offset, limit: effectiveLimit, hasMore })
         }]
       };
     }
@@ -8991,7 +9460,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({ from: fromName, to: toName, hops: foundPath.length - 1, path: pathDetails }, null, 2)
+          text: compact({ from: fromName, to: toName, hops: foundPath.length - 1, path: pathDetails })
         }]
       };
     }
@@ -8999,7 +9468,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
     case "list_exports": {
       const kindFilter = a.kind;
       const offset = a.offset ?? 0;
-      const effectiveLimit = Math.min(a.limit ?? 50, 500);
+      const effectiveLimit = Math.min(a.limit ?? 10, 500);
       const allExports = [];
       for (const node of graph.allNodes()) {
         if (!node.exported) continue;
@@ -9012,7 +9481,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({ exports: exports$1, total, offset, limit: effectiveLimit, hasMore }, null, 2)
+          text: compact({ exports: exports$1, total, offset, limit: effectiveLimit, hasMore })
         }]
       };
     }
@@ -9024,12 +9493,12 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
           routes.push({ name: node.name, filePath: node.filePath, startLine: node.startLine });
         }
       }
-      return { content: [{ type: "text", text: JSON.stringify(routes, null, 2) }] };
+      return { content: [{ type: "text", text: compact(routes) }] };
     }
     // ── clusters ───────────────────────────────────────────────────────────
     case "clusters": {
       const offset = a.offset ?? 0;
-      const effectiveLimit = Math.min(a.limit ?? 50, 500);
+      const effectiveLimit = Math.min(a.limit ?? 10, 500);
       const allClusters = [];
       for (const node of graph.allNodes()) {
         if (node.kind === "cluster") {
@@ -9056,14 +9525,14 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({ clusters, total, offset, limit: effectiveLimit, hasMore }, null, 2)
+          text: compact({ clusters, total, offset, limit: effectiveLimit, hasMore })
         }]
       };
     }
     // ── flows ──────────────────────────────────────────────────────────────
     case "flows": {
       const offset = a.offset ?? 0;
-      const effectiveLimit = Math.min(a.limit ?? 50, 500);
+      const effectiveLimit = Math.min(a.limit ?? 10, 500);
       const allFlows = [];
       for (const node of graph.allNodes()) {
         if (node.kind === "flow") {
@@ -9083,7 +9552,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({ flows, total, offset, limit: effectiveLimit, hasMore }, null, 2)
+          text: compact({ flows, total, offset, limit: effectiveLimit, hasMore })
         }]
       };
     }
@@ -9113,7 +9582,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       for (const { filePath: changedFile, changedLines } of changedFiles) {
         for (const node of graph.allNodes()) {
           if (!node.filePath) continue;
-          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path31.sep, "");
+          const normNode = node.filePath.replace(repoRoot + "/", "").replace(repoRoot + path32.sep, "");
           const normChanged = changedFile.replace(/^a\/|^b\//, "");
           if (!normNode.endsWith(normChanged) && !normChanged.endsWith(normNode)) continue;
           if (node.startLine !== void 0 && node.endLine !== void 0) {
@@ -9151,14 +9620,14 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             baseRef,
             changedFiles: changedFiles.map((f) => f.filePath),
             directlyChangedSymbols: changedSymbols,
             transitivelyAffectedSymbols: affectedSymbols,
             totalAffected: allAffected.size,
             riskLevel: risk
-          }, null, 2)
+          })
         }]
       };
     }
@@ -9166,14 +9635,14 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
     case "query": {
       const gqlInput = a.gql;
       if (!gqlInput) {
-        return { content: [{ type: "text", text: JSON.stringify({ error: "Missing required parameter: gql" }) }], isError: true };
+        return { content: [{ type: "text", text: compact({ error: "Missing required parameter: gql" }) }], isError: true };
       }
       const { parseGQL: parseGQL2, isGQLParseError: isGQLParseError2 } = await Promise.resolve().then(() => (init_gql_parser(), gql_parser_exports));
       const { executeGQL: executeGQL2 } = await Promise.resolve().then(() => (init_gql_executor(), gql_executor_exports));
       const ast = parseGQL2(gqlInput);
       if (isGQLParseError2(ast)) {
         return {
-          content: [{ type: "text", text: JSON.stringify({ error: `GQL parse error: ${ast.message}`, pos: ast.pos, expected: ast.expected, got: ast.got }) }],
+          content: [{ type: "text", text: compact({ error: `GQL parse error: ${ast.message}`, pos: ast.pos, expected: ast.expected, got: ast.got }) }],
           isError: true
         };
       }
@@ -9184,7 +9653,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             nodes: result.nodes,
             edges: result.edges,
             groups: result.groups,
@@ -9192,7 +9661,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
             executionTimeMs: result.executionTimeMs,
             truncated: result.truncated,
             totalCount: result.totalCount
-          }, null, 2)
+          })
         }]
       };
     }
@@ -9206,7 +9675,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
         for (const node of graph.allNodes()) {
           if (node.name === nameMatch[1]) results.push(node);
         }
-        return { content: [{ type: "text", text: JSON.stringify({ deprecation: deprecationWarning, results }, null, 2) }] };
+        return { content: [{ type: "text", text: compact({ deprecation: deprecationWarning, results }) }] };
       }
       const kindMatch = q?.match(/:\s*(\w+)/);
       if (kindMatch) {
@@ -9215,9 +9684,9 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
           if (node.kind === kindMatch[1]) results.push(node);
           if (results.length >= 50) break;
         }
-        return { content: [{ type: "text", text: JSON.stringify({ deprecation: deprecationWarning, results }, null, 2) }] };
+        return { content: [{ type: "text", text: compact({ deprecation: deprecationWarning, results }) }] };
       }
-      return { content: [{ type: "text", text: JSON.stringify({ deprecation: deprecationWarning, error: "Query not recognized. Use name='X' or :kind syntax. Or use the query tool with GQL instead." }) }] };
+      return { content: [{ type: "text", text: compact({ deprecation: deprecationWarning, error: "Query not recognized. Use name='X' or :kind syntax. Or use the query tool with GQL instead." }) }] };
     }
     // ── group_list ─────────────────────────────────────────────────────────
     case "group_list": {
@@ -9225,16 +9694,14 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       if (groupName) {
         const group = loadGroup(groupName);
         if (!group) return { content: [{ type: "text", text: `Group "${groupName}" not found.` }] };
-        return { content: [{ type: "text", text: JSON.stringify(group, null, 2) }] };
+        return { content: [{ type: "text", text: compact(group) }] };
       }
       const groups = listGroups();
       return {
         content: [{
           type: "text",
-          text: JSON.stringify(
-            groups.map((g) => ({ name: g.name, createdAt: g.createdAt, lastSync: g.lastSync, memberCount: g.members.length, members: g.members })),
-            null,
-            2
+          text: compact(
+            groups.map((g) => ({ name: g.name, createdAt: g.createdAt, lastSync: g.lastSync, memberCount: g.members.length, members: g.members }))
           )
         }]
       };
@@ -9252,14 +9719,14 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             groupName: result.groupName,
             syncedAt: result.syncedAt,
             memberCount: result.memberCount,
             contractCount: result.contracts.length,
             linkCount: result.links.length,
             topLinks: result.links.slice(0, 20)
-          }, null, 2)
+          })
         }]
       };
     }
@@ -9279,7 +9746,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({ syncedAt: result.syncedAt, contracts, links }, null, 2)
+          text: compact({ syncedAt: result.syncedAt, contracts, links })
         }]
       };
     }
@@ -9294,7 +9761,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({ query, merged, perRepo }, null, 2)
+          text: compact({ query, merged, perRepo })
         }]
       };
     }
@@ -9326,12 +9793,12 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             group: groupName,
             lastSync: group.lastSync ?? null,
             syncAgeMinutes: syncAge,
             members: memberStatus
-          }, null, 2)
+          })
         }]
       };
     }
@@ -9340,11 +9807,11 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       const fromName = a.from;
       const toName = a.to;
       const result = explainRelationship(graph, fromName, toName);
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      return { content: [{ type: "text", text: compact(result) }] };
     }
     // ── pr_impact ──────────────────────────────────────────────────────────
     case "pr_impact": {
-      const maxHops = a.maxHops ?? 5;
+      const maxHops = a.maxHops ?? 2;
       let changedFiles = a.changedFiles ?? [];
       if (a.diff && typeof a.diff === "string") {
         const diffFiles = parseDiffFiles(a.diff);
@@ -9354,37 +9821,37 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
         return {
           content: [{
             type: "text",
-            text: JSON.stringify({ error: 'No changed files provided. Supply "changedFiles" or "diff".' })
+            text: compact({ error: 'No changed files provided. Supply "changedFiles" or "diff".' })
           }]
         };
       }
       const result = computePRImpact(graph, changedFiles, maxHops);
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      return { content: [{ type: "text", text: compact(result) }] };
     }
     // ── similar_symbols ────────────────────────────────────────────────────
     case "similar_symbols": {
       const symbolName = a.symbol;
       const limit = a.limit ?? 10;
       const result = findSimilarSymbols(graph, symbolName, limit);
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      return { content: [{ type: "text", text: compact(result) }] };
     }
     // ── health_report ──────────────────────────────────────────────────────
     case "health_report": {
       const scope = a.scope ?? ".";
       const result = computeHealthReport(graph, scope);
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      return { content: [{ type: "text", text: compact(result) }] };
     }
     // ── suggest_tests ──────────────────────────────────────────────────────
     case "suggest_tests": {
       const sym = a.symbol;
       const result = suggestTests(graph, sym);
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      return { content: [{ type: "text", text: compact(result) }] };
     }
     // ── cluster_summary ────────────────────────────────────────────────────
     case "cluster_summary": {
       const cluster = a.cluster;
       const result = summarizeCluster(graph, cluster);
-      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      return { content: [{ type: "text", text: compact(result) }] };
     }
     case "deprecated_usage": {
       const scope = a.scope;
@@ -9392,7 +9859,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       const detector = new DeprecatedDetector2();
       detector.tagDeprecated(graph);
       const findings = detector.detect(graph, scope);
-      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+      return { content: [{ type: "text", text: compact({ findings, total: findings.length }) }] };
     }
     // ── complexity_hotspots ────────────────────────────────────────────────
     case "complexity_hotspots": {
@@ -9400,7 +9867,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       const scope = a.scope;
       const limit = typeof a.limit === "number" ? a.limit : 20;
       const hotspots = computeComplexity2(graph, scope).slice(0, limit);
-      return { content: [{ type: "text", text: JSON.stringify({ hotspots, total: hotspots.length }, null, 2) }] };
+      return { content: [{ type: "text", text: compact({ hotspots, total: hotspots.length }) }] };
     }
     // ── coverage_gaps ──────────────────────────────────────────────────────
     case "coverage_gaps": {
@@ -9412,12 +9879,12 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       return {
         content: [{
           type: "text",
-          text: JSON.stringify({
+          text: compact({
             untestedByRisk,
             coveragePct: summary.coveragePct,
             totalExported: summary.totalExported,
             testedExported: summary.testedExported
-          }, null, 2)
+          })
         }]
       };
     }
@@ -9428,7 +9895,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       const scope = a.scope;
       const includeTestFiles = a.includeTestFiles ?? false;
       const findings = scanner.scan(graph, { scope, includeTestFiles });
-      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+      return { content: [{ type: "text", text: compact({ findings, total: findings.length }) }] };
     }
     // ── vulnerability_scan ─────────────────────────────────────────────────
     case "vulnerability_scan": {
@@ -9441,7 +9908,7 @@ async function dispatchTool(name, a, graph, repoName, workspaceRoot) {
       const minRank = sevRank[minSev] ?? 1;
       let findings = detector.detect(graph, { scope, types });
       findings = findings.filter((f) => (sevRank[f.severity] ?? 1) >= minRank);
-      return { content: [{ type: "text", text: JSON.stringify({ findings, total: findings.length }, null, 2) }] };
+      return { content: [{ type: "text", text: compact({ findings, total: findings.length }) }] };
     }
     default:
       return { content: [{ type: "text", text: `Unknown tool: ${name}` }] };
@@ -9462,21 +9929,21 @@ function registerResources(server, graph, repoName) {
       for (const node of graph.allNodes()) {
         kindCounts[node.kind] = (kindCounts[node.kind] ?? 0) + 1;
       }
-      return { contents: [{ uri, mimeType: "application/json", text: JSON.stringify({ repo: repoName, stats: graph.size, nodeCounts: kindCounts }) }] };
+      return { contents: [{ uri, mimeType: "application/json", text: compact({ repo: repoName, stats: graph.size, nodeCounts: kindCounts }) }] };
     }
     if (uri.endsWith("/clusters")) {
       const clusters = [];
       for (const node of graph.allNodes()) {
         if (node.kind === "cluster") clusters.push({ id: node.id, name: node.name, memberCount: node.metadata?.memberCount });
       }
-      return { contents: [{ uri, mimeType: "application/json", text: JSON.stringify(clusters) }] };
+      return { contents: [{ uri, mimeType: "application/json", text: compact(clusters) }] };
     }
     if (uri.endsWith("/flows")) {
       const flows = [];
       for (const node of graph.allNodes()) {
         if (node.kind === "flow") flows.push({ id: node.id, name: node.name, steps: node.metadata?.steps, entryPoint: node.metadata?.entryPoint });
       }
-      return { contents: [{ uri, mimeType: "application/json", text: JSON.stringify(flows) }] };
+      return { contents: [{ uri, mimeType: "application/json", text: compact(flows) }] };
     }
     throw new Error(`Unknown resource: ${uri}`);
   });
@@ -9526,6 +9993,8 @@ function parseDiff(diffText) {
   return result;
 }
 init_group_registry();
+init_knowledge_graph();
+init_graph_from_db();
 init_logger();
 init_codes();
 init_middleware();
@@ -9536,8 +10005,8 @@ var STUCK_THRESHOLD_MINUTES = 30;
 var JobsDB = class {
   db;
   constructor(dbPath) {
-    fs24.mkdirSync(path31.dirname(dbPath), { recursive: true });
-    this.db = new Database3(dbPath);
+    fs26.mkdirSync(path32.dirname(dbPath), { recursive: true });
+    this.db = new Database2(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("foreign_keys = ON");
     this.createTables();
@@ -9678,7 +10147,7 @@ var JobsDB = class {
   }
 };
 function getJobsDBPath() {
-  return path31.join(os13.homedir(), ".code-intel", "jobs.db");
+  return path32.join(os13.homedir(), ".code-intel", "jobs.db");
 }
 var _jobsDB = null;
 function getOrCreateJobsDB() {
@@ -9770,7 +10239,7 @@ var BACKUP_VERSION = "1.0";
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 function getBackupDir() {
-  return path31.join(os13.homedir(), ".code-intel", "backups");
+  return path32.join(os13.homedir(), ".code-intel", "backups");
 }
 function getBackupKey() {
   const keyHex = process.env["CODE_INTEL_BACKUP_KEY"];
@@ -9801,30 +10270,30 @@ var BackupService = class {
   constructor(backupDir) {
     this.backupDir = backupDir ?? getBackupDir();
     this.key = getBackupKey();
-    fs24.mkdirSync(this.backupDir, { recursive: true });
+    fs26.mkdirSync(this.backupDir, { recursive: true });
   }
   /**
    * Create a backup for a repository.
    * Returns the backup entry.
    */
   createBackup(repoPath) {
-    const codeIntelDir = path31.join(repoPath, ".code-intel");
+    const codeIntelDir = path32.join(repoPath, ".code-intel");
     const id = v4();
     const createdAt = (/* @__PURE__ */ new Date()).toISOString();
     const filesToBackup = [];
     const candidates = ["graph.db", "vector.db", "meta.json"];
     for (const f of candidates) {
-      const fp = path31.join(codeIntelDir, f);
-      if (fs24.existsSync(fp)) {
+      const fp = path32.join(codeIntelDir, f);
+      if (fs26.existsSync(fp)) {
         filesToBackup.push({ name: f, localPath: fp });
       }
     }
-    const registryPath = path31.join(os13.homedir(), ".code-intel", "registry.json");
-    if (fs24.existsSync(registryPath)) {
+    const registryPath = path32.join(os13.homedir(), ".code-intel", "registry.json");
+    if (fs26.existsSync(registryPath)) {
       filesToBackup.push({ name: "registry.json", localPath: registryPath });
     }
-    const usersDbPath = path31.join(os13.homedir(), ".code-intel", "users.db");
-    if (fs24.existsSync(usersDbPath)) {
+    const usersDbPath = path32.join(os13.homedir(), ".code-intel", "users.db");
+    if (fs26.existsSync(usersDbPath)) {
       filesToBackup.push({ name: "users.db", localPath: usersDbPath });
     }
     if (filesToBackup.length === 0) {
@@ -9835,7 +10304,7 @@ var BackupService = class {
       createdAt,
       version: BACKUP_VERSION,
       files: filesToBackup.map((f) => {
-        const data = fs24.readFileSync(f.localPath);
+        const data = fs26.readFileSync(f.localPath);
         return {
           name: f.name,
           sha256: crypto5.createHash("sha256").update(data).digest("hex"),
@@ -9849,7 +10318,7 @@ var BackupService = class {
     manifestLenBuf.writeUInt32BE(manifestBuf.length, 0);
     parts.push(manifestLenBuf, manifestBuf);
     for (const f of filesToBackup) {
-      const data = fs24.readFileSync(f.localPath);
+      const data = fs26.readFileSync(f.localPath);
       const nameBuf = Buffer.from(f.name, "utf-8");
       const nameLenBuf = Buffer.alloc(2);
       nameLenBuf.writeUInt16BE(nameBuf.length, 0);
@@ -9860,8 +10329,8 @@ var BackupService = class {
     const plaintext = Buffer.concat(parts);
     const encrypted = encryptBuffer(plaintext, this.key);
     const backupFileName = `backup-${id}.cib`;
-    const backupPath = path31.join(this.backupDir, backupFileName);
-    fs24.writeFileSync(backupPath, encrypted);
+    const backupPath = path32.join(this.backupDir, backupFileName);
+    fs26.writeFileSync(backupPath, encrypted);
     const entry = {
       id,
       createdAt,
@@ -9888,9 +10357,9 @@ var BackupService = class {
   async uploadToS3(entry) {
     const cfg = getS3Config();
     if (!cfg) throw new Error("S3 not configured. Set CODE_INTEL_BACKUP_S3_BUCKET, CODE_INTEL_BACKUP_S3_ACCESS_KEY_ID, CODE_INTEL_BACKUP_S3_SECRET_ACCESS_KEY.");
-    const fileName = path31.basename(entry.path);
+    const fileName = path32.basename(entry.path);
     const s3Key = `${cfg.prefix}${fileName}`;
-    const body = fs24.readFileSync(entry.path);
+    const body = fs26.readFileSync(entry.path);
     const result = await s3Request({ method: "PUT", cfg, key: s3Key, body });
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 upload failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
@@ -9907,8 +10376,8 @@ var BackupService = class {
     if (result.statusCode < 200 || result.statusCode >= 300) {
       throw new Error(`S3 download failed (HTTP ${result.statusCode}): ${result.body.slice(0, 200)}`);
     }
-    fs24.mkdirSync(path31.dirname(destPath), { recursive: true });
-    fs24.writeFileSync(destPath, Buffer.from(result.body, "binary"));
+    fs26.mkdirSync(path32.dirname(destPath), { recursive: true });
+    fs26.writeFileSync(destPath, Buffer.from(result.body, "binary"));
   }
   /**
    * List backup objects in S3 with the configured prefix.
@@ -9954,10 +10423,10 @@ var BackupService = class {
     if (!entry) {
       throw new Error(`Backup "${backupId}" not found.`);
     }
-    if (!fs24.existsSync(entry.path)) {
+    if (!fs26.existsSync(entry.path)) {
       throw new Error(`Backup file not found at: ${entry.path}`);
     }
-    const encrypted = fs24.readFileSync(entry.path);
+    const encrypted = fs26.readFileSync(entry.path);
     let plaintext;
     try {
       plaintext = decryptBuffer(encrypted, this.key);
@@ -9971,8 +10440,8 @@ var BackupService = class {
     offset += manifestLen;
     const manifest = JSON.parse(manifestStr);
     const restoreBase = targetRepoPath ?? entry.repoPath;
-    const codeIntelDir = path31.join(restoreBase, ".code-intel");
-    fs24.mkdirSync(codeIntelDir, { recursive: true });
+    const codeIntelDir = path32.join(restoreBase, ".code-intel");
+    fs26.mkdirSync(codeIntelDir, { recursive: true });
     for (const fileEntry of manifest.files) {
       const nameLen = plaintext.readUInt16BE(offset);
       offset += 2;
@@ -9989,18 +10458,18 @@ var BackupService = class {
       }
       let destPath;
       if (name === "registry.json" || name === "users.db") {
-        destPath = path31.join(os13.homedir(), ".code-intel", name);
+        destPath = path32.join(os13.homedir(), ".code-intel", name);
       } else {
-        destPath = path31.join(codeIntelDir, name);
+        destPath = path32.join(codeIntelDir, name);
       }
-      fs24.writeFileSync(destPath, data);
+      fs26.writeFileSync(destPath, data);
     }
   }
   /**
    * Apply retention policy: keep N daily, M weekly, L monthly backups.
    */
   applyRetention(options = { daily: 7, weekly: 4, monthly: 12 }) {
-    const entries = this._loadIndex().filter((e) => fs24.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    const entries = this._loadIndex().filter((e) => fs26.existsSync(e.path)).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
     const keep = /* @__PURE__ */ new Set();
     const now = /* @__PURE__ */ new Date();
     const dailyCutoff = new Date(now);
@@ -10030,7 +10499,7 @@ var BackupService = class {
     for (const e of entries) {
       if (!keep.has(e.id)) {
         try {
-          fs24.unlinkSync(e.path);
+          fs26.unlinkSync(e.path);
           deleted++;
         } catch {
         }
@@ -10042,17 +10511,17 @@ var BackupService = class {
   }
   // ── Index helpers ──────────────────────────────────────────────────────────
   _indexPath() {
-    return path31.join(this.backupDir, "index.json");
+    return path32.join(this.backupDir, "index.json");
   }
   _loadIndex() {
     try {
-      return JSON.parse(fs24.readFileSync(this._indexPath(), "utf-8"));
+      return JSON.parse(fs26.readFileSync(this._indexPath(), "utf-8"));
     } catch {
       return [];
     }
   }
   _saveIndex(entries) {
-    fs24.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
+    fs26.writeFileSync(this._indexPath(), JSON.stringify(entries, null, 2));
   }
   _appendIndex(entry) {
     const entries = this._loadIndex();
@@ -10845,11 +11314,11 @@ var openApiSpec = {
 };
 
 // src/http/app.ts
-var __dirname$1 = path31.dirname(fileURLToPath(import.meta.url));
+var __dirname$1 = path32.dirname(fileURLToPath(import.meta.url));
 var WEB_DIST = (() => {
-  const bundled = path31.resolve(__dirname$1, "..", "web");
-  if (fs24.existsSync(bundled)) return bundled;
-  return path31.resolve(__dirname$1, "..", "..", "..", "web", "dist");
+  const bundled = path32.resolve(__dirname$1, "..", "web");
+  if (fs26.existsSync(bundled)) return bundled;
+  return path32.resolve(__dirname$1, "..", "..", "..", "web", "dist");
 })();
 function getAllowedOrigins() {
   const env = process.env["CODE_INTEL_CORS_ORIGINS"];
@@ -10858,13 +11327,17 @@ function getAllowedOrigins() {
 }
 function createDefaultLimiter() {
   const max = parseInt(process.env["CODE_INTEL_RATE_LIMIT_MAX"] ?? "100", 10);
-  const windowMs = parseInt(process.env["CODE_INTEL_RATE_LIMIT_WINDOW_MS"] ?? `${15 * 60 * 1e3}`, 10);
+  const windowMs = parseInt(process.env["CODE_INTEL_RATE_LIMIT_WINDOW_MS"] ?? `${60 * 1e3}`, 10);
   return rateLimit({
     windowMs,
     max,
     standardHeaders: true,
     legacyHeaders: false,
-    skip: (req) => req.path.startsWith("/health") || req.path === "/metrics",
+    // Skip health checks, metrics, and read-only listing/pagination endpoints.
+    // The node pagination and group/repo listing endpoints are hit many times
+    // when loading a large graph — rate-limiting them only hurts the user's own
+    // session without providing meaningful abuse protection.
+    skip: (req) => req.path.startsWith("/health") || req.path === "/metrics" || req.path === "/api/v1/repos" || req.path === "/api/v1/groups" || req.method === "GET" && req.path.startsWith("/api/v1/groups/") || /^\/api\/v1\/graph\/[^/]+\/nodes$/.test(req.path),
     message: {
       error: {
         code: ErrorCodes.RATE_LIMIT_EXCEEDED,
@@ -10923,12 +11396,31 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
   });
   app.use(requestIdMiddleware);
   app.use(authMiddleware);
+  let dbUnavailableSince = null;
   app.use((_req, res, next) => {
     if (workspaceRoot) {
+      const metaFilePath = path32.join(workspaceRoot, ".code-intel", "meta.json");
+      let metaOk = false;
       try {
-        const meta = loadMetadata(workspaceRoot);
-        if (meta?.indexVersion) res.setHeader("X-Index-Version", meta.indexVersion);
-      } catch {
+        if (fs26.existsSync(metaFilePath)) {
+          const raw = fs26.readFileSync(metaFilePath, "utf-8");
+          const meta = JSON.parse(raw);
+          if (meta?.indexVersion) res.setHeader("X-Index-Version", meta.indexVersion);
+        }
+        metaOk = true;
+        if (dbUnavailableSince !== null) {
+          dbUnavailableSince = null;
+          logger_default.info("[serve] DB back online \u2014 cleared stale flag");
+        }
+      } catch (err) {
+        if (dbUnavailableSince === null) {
+          dbUnavailableSince = (/* @__PURE__ */ new Date()).toISOString();
+          logger_default.warn(`[serve] DB unavailable since ${dbUnavailableSince}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      if (!metaOk) {
+        res.setHeader("X-Stale", "true");
+        res.setHeader("X-Stale-Since", dbUnavailableSince);
       }
     }
     next();
@@ -10984,6 +11476,21 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
   let vectorIndex = null;
   let vectorIndexBuilding = false;
   let vectorIndexReady = false;
+  let bm25Index = null;
+  function ensureBm25Index() {
+    if (bm25Index) return bm25Index;
+    if (!workspaceRoot) return null;
+    const idx = new Bm25Index(getBm25DbPath(workspaceRoot));
+    idx.load();
+    if (idx.isLoaded) {
+      bm25Index = idx;
+      return idx;
+    }
+    return null;
+  }
+  if (workspaceRoot && process.env["NODE_ENV"] !== "test") {
+    setImmediate(() => ensureBm25Index());
+  }
   async function ensureVectorIndex() {
     if (vectorIndexReady && vectorIndex) return vectorIndex;
     if (!workspaceRoot || vectorIndexBuilding) return null;
@@ -11087,12 +11594,12 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       return;
     }
     const user = db.createUser(username, password, "admin");
-    const sessionId = createSession({ id: user.id, username: user.username, role: user.role });
-    res.setHeader("Set-Cookie", buildSessionCookie(sessionId));
+    const { sessionId, ttlMs } = createSession({ id: user.id, username: user.username, role: user.role });
+    res.setHeader("Set-Cookie", buildSessionCookie(sessionId, ttlMs));
     res.status(201).json({ user: { id: user.id, username: user.username, role: user.role } });
   });
   app.post("/auth/login", async (req, res) => {
-    const { username, password } = req.body;
+    const { username, password, rememberMe } = req.body;
     if (!username || !password) {
       res.status(400).json({
         error: {
@@ -11136,10 +11643,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       });
       return;
     }
-    const sessionId = createSession({ id: user.id, username: user.username, role: user.role });
+    const { sessionId, ttlMs } = createSession({ id: user.id, username: user.username, role: user.role }, rememberMe === true);
     db.logAccess(user.id, "/auth/login", "login", "allow", req.ip ?? "unknown");
     authAttemptsTotal.inc({ method: "local", outcome: "success" });
-    res.setHeader("Set-Cookie", buildSessionCookie(sessionId));
+    res.setHeader("Set-Cookie", buildSessionCookie(sessionId, ttlMs));
     res.json({ user: { id: user.id, username: user.username, role: user.role } });
   });
   app.post("/auth/logout", (req, res) => {
@@ -11261,9 +11768,9 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
         authAttemptsTotal.inc({ method: "oidc", outcome: "success" });
         logger_default.info(`[oidc] Auto-provisioned new user: ${finalUsername} (${cfg.defaultRole})`);
       }
-      const sessionId = createSession({ id: user.id, username: user.username, role: user.role });
+      const { sessionId, ttlMs } = createSession({ id: user.id, username: user.username, role: user.role });
       db.logAccess(user.id, "/auth/callback", "oidc-login", "allow", req.ip ?? "unknown");
-      res.setHeader("Set-Cookie", buildSessionCookie(sessionId));
+      res.setHeader("Set-Cookie", buildSessionCookie(sessionId, ttlMs));
       res.redirect(302, "/");
     } catch (err) {
       logger_default.warn("[oidc] Callback failed:", err instanceof Error ? err.message : err);
@@ -11380,10 +11887,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const registry = loadRegistry();
     const entry = registry.find((r) => r.name === requestedRepo || r.path === requestedRepo);
     if (!entry) return null;
-    const dbPath = path31.join(entry.path, ".code-intel", "graph.db");
-    if (!fs24.existsSync(dbPath)) return null;
+    const dbPath = path32.join(entry.path, ".code-intel", "graph.db");
+    if (!fs26.existsSync(dbPath)) return null;
     const repoGraph = createKnowledgeGraph();
-    const db = new DbManager(dbPath);
+    const db = new DbManager(dbPath, true);
     try {
       await db.init();
       await loadGraphFromDB(repoGraph, db);
@@ -11394,10 +11901,33 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       return null;
     }
   }
+  async function loadGroupGraph(groupName) {
+    const group = loadGroup(groupName);
+    if (!group) return null;
+    const registry = loadRegistry();
+    const mergedGraph = createKnowledgeGraph();
+    for (const member of group.members) {
+      const regEntry = registry.find((r) => r.name === member.registryName);
+      if (!regEntry) continue;
+      const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+      if (!fs26.existsSync(dbPath)) continue;
+      const db = new DbManager(dbPath, true);
+      try {
+        await db.init();
+        await loadGraphFromDB(mergedGraph, db);
+        db.close();
+      } catch {
+        db.close();
+      }
+    }
+    return mergedGraph.size.nodes > 0 ? mergedGraph : null;
+  }
   async function getGraphForRepo(requestedRepo) {
     if (!requestedRepo || requestedRepo === repoName) return graph;
     const g = await loadRepoGraph(requestedRepo);
-    return g ?? graph;
+    if (g) return g;
+    const gg = await loadGroupGraph(requestedRepo);
+    return gg ?? graph;
   }
   app.get("/api/v1/graph/:repo", requireRepoAccess((req) => {
     const p = req.params["repo"];
@@ -11421,12 +11951,71 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     }
     res.json({ nodes: [...g.allNodes()], edges: [...g.allEdges()] });
   });
+  app.get("/api/v1/graph/:repo/nodes", requireRepoAccess((req) => {
+    const p = req.params["repo"];
+    const repo = Array.isArray(p) ? p[0] : p;
+    return repo ? decodeURIComponent(repo) : void 0;
+  }), async (req, res) => {
+    const rawRepo = req.params["repo"];
+    const requestedRepo = decodeURIComponent(Array.isArray(rawRepo) ? rawRepo[0] ?? "" : rawRepo ?? "");
+    const limit = Math.min(parseInt(req.query["limit"] ?? "200", 10), 1e3);
+    const offset = Math.max(parseInt(req.query["offset"] ?? "0", 10), 0);
+    const g = requestedRepo === repoName ? graph : await loadRepoGraph(requestedRepo);
+    if (!g) {
+      res.status(404).json({
+        error: {
+          code: ErrorCodes.NOT_FOUND,
+          message: `Repo "${requestedRepo}" not found or not indexed`,
+          hint: `Run: code-intel analyze <path>`,
+          requestId: req.requestId,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+      return;
+    }
+    let nodes;
+    if (isLazyGraph(g)) {
+      nodes = await g.getNodePage(offset, limit);
+    } else {
+      const eager = g;
+      if (!eager._nodeArray) {
+        eager._nodeArray = [...g.allNodes()];
+      }
+      nodes = eager._nodeArray.slice(offset, offset + limit);
+    }
+    res.json({
+      nodes,
+      offset,
+      limit,
+      total: g.size.nodes,
+      hasMore: offset + nodes.length < g.size.nodes
+    });
+  });
   app.post("/api/v1/search", requireToolScope("search"), async (req, res) => {
-    const { query, limit, repo } = req.body;
+    const { query, limit, repo, group } = req.body;
+    if (group) {
+      const grp = loadGroup(group);
+      if (!grp) {
+        res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: `Group '${group}' not found`, hint: "Use /api/v1/groups to list available groups" } });
+        return;
+      }
+      try {
+        const { perRepo, merged } = await queryGroup(grp, query ?? "", limit ?? 20);
+        res.json({ results: merged, perRepo, searchMode: "bm25", group });
+      } catch (err) {
+        res.status(500).json({ error: { code: ErrorCodes.INTERNAL_ERROR, message: err instanceof Error ? err.message : String(err) } });
+      }
+      return;
+    }
     const g = await getGraphForRepo(repo);
     const vdbPath = workspaceRoot ? getVectorDbPath(workspaceRoot) : void 0;
-    const { results, searchMode } = await hybridSearch(g, query ?? "", limit ?? 20, { vectorDbPath: vdbPath });
-    res.json({ results, searchMode });
+    const bm25 = !repo || repo === repoName ? ensureBm25Index() : null;
+    const bm25Results = bm25 ? bm25.search(query ?? "", (limit ?? 20) * 3) : null;
+    const { results, searchMode } = await hybridSearch(g, query ?? "", limit ?? 20, {
+      vectorDbPath: vdbPath,
+      bm25Results: bm25Results ?? void 0
+    });
+    res.json({ results, searchMode, repo: repo ?? repoName });
   });
   app.post("/api/v1/vector-search", async (req, res) => {
     const { query, limit = 10 } = req.body;
@@ -11468,7 +12057,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       return;
     }
     try {
-      const content = fs24.readFileSync(file_path, "utf-8");
+      const content = fs26.readFileSync(file_path, "utf-8");
       res.json({ content });
     } catch {
       res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: "File not found" } });
@@ -11505,7 +12094,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     if (workspaceRoot) {
       try {
         const dbPath = getDbPath(workspaceRoot);
-        const dbm = new DbManager(dbPath);
+        const dbm = new DbManager(dbPath, true);
         await dbm.init();
         const rows = await dbm.query(q);
         dbm.close();
@@ -11546,33 +12135,53 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
   app.get("/api/v1/nodes/:id", async (req, res) => {
     const nodeId = decodeURIComponent(req.params.id);
     const g = await getGraphForRepo(req.query["repo"]);
-    const node = g.getNode(nodeId);
+    const node = isLazyGraph(g) ? await g.getNodeAsync(nodeId) : g.getNode(nodeId);
     if (!node) {
       res.status(404).json({ error: { code: ErrorCodes.NOT_FOUND, message: "Node not found", requestId: req.requestId } });
       return;
     }
     const incoming = [...g.findEdgesTo(nodeId)];
     const outgoing = [...g.findEdgesFrom(nodeId)];
+    const resolveName = isLazyGraph(g) ? async (id) => {
+      const n = g.getNode(id) ?? await g.getNodeAsync(id);
+      return n?.name;
+    } : (id) => Promise.resolve(g.getNode(id)?.name);
+    const resolveKind = isLazyGraph(g) ? async (id) => {
+      const n = g.getNode(id) ?? await g.getNodeAsync(id);
+      return n?.kind;
+    } : (id) => Promise.resolve(g.getNode(id)?.kind);
     res.json({
       node,
-      callers: incoming.filter((e) => e.kind === "calls").map((e) => ({ id: e.source, name: g.getNode(e.source)?.name, weight: e.weight })),
-      callees: outgoing.filter((e) => e.kind === "calls").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name, weight: e.weight })),
-      imports: outgoing.filter((e) => e.kind === "imports").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name })),
-      importedBy: incoming.filter((e) => e.kind === "imports").map((e) => ({ id: e.source, name: g.getNode(e.source)?.name })),
-      extends: outgoing.filter((e) => e.kind === "extends").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name })),
-      implementsEdges: outgoing.filter((e) => e.kind === "implements").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name })),
-      members: outgoing.filter((e) => e.kind === "has_member").map((e) => ({ id: e.target, name: g.getNode(e.target)?.name, kind: g.getNode(e.target)?.kind })),
-      cluster: incoming.filter((e) => e.kind === "belongs_to").map((e) => g.getNode(e.target)?.name)[0]
+      callers: await Promise.all(incoming.filter((e) => e.kind === "calls").map(async (e) => ({ id: e.source, name: await resolveName(e.source), weight: e.weight }))),
+      callees: await Promise.all(outgoing.filter((e) => e.kind === "calls").map(async (e) => ({ id: e.target, name: await resolveName(e.target), weight: e.weight }))),
+      imports: await Promise.all(outgoing.filter((e) => e.kind === "imports").map(async (e) => ({ id: e.target, name: await resolveName(e.target) }))),
+      importedBy: await Promise.all(incoming.filter((e) => e.kind === "imports").map(async (e) => ({ id: e.source, name: await resolveName(e.source) }))),
+      extends: await Promise.all(outgoing.filter((e) => e.kind === "extends").map(async (e) => ({ id: e.target, name: await resolveName(e.target) }))),
+      implementsEdges: await Promise.all(outgoing.filter((e) => e.kind === "implements").map(async (e) => ({ id: e.target, name: await resolveName(e.target) }))),
+      members: await Promise.all(outgoing.filter((e) => e.kind === "has_member").map(async (e) => ({ id: e.target, name: await resolveName(e.target), kind: await resolveKind(e.target) }))),
+      cluster: (await Promise.all(incoming.filter((e) => e.kind === "belongs_to").map(async (e) => resolveName(e.target))))[0]
     });
   });
   app.post("/api/v1/blast-radius", async (req, res) => {
     const { target, direction = "both", max_hops = 5, repo } = req.body;
     const g = await getGraphForRepo(repo);
     let targetNode = null;
-    for (const node of g.allNodes()) {
-      if (node.name === target || node.id === target) {
-        targetNode = node;
-        break;
+    if (isLazyGraph(g) && target) {
+      targetNode = g.getNode(target) ?? await g.getNodeAsync(target) ?? null;
+      if (!targetNode) {
+        for await (const node of g.allNodesAsync()) {
+          if (node.name === target || node.id === target) {
+            targetNode = node;
+            break;
+          }
+        }
+      }
+    } else {
+      for (const node of g.allNodes()) {
+        if (node.name === target || node.id === target) {
+          targetNode = node;
+          break;
+        }
       }
     }
     if (!targetNode) {
@@ -11726,9 +12335,9 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     for (const member of group.members) {
       const regEntry = registry.find((r) => r.name === member.registryName);
       if (!regEntry) continue;
-      const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
-      if (!fs24.existsSync(dbPath)) continue;
-      const db = new DbManager(dbPath);
+      const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+      if (!fs26.existsSync(dbPath)) continue;
+      const db = new DbManager(dbPath, true);
       try {
         await db.init();
         await loadGraphFromDB(mergedGraph, db);
@@ -11753,10 +12362,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       let nodeCount = 0;
       let edgeCount = 0;
       if (regEntry) {
-        const dbPath = path31.join(regEntry.path, ".code-intel", "graph.db");
-        if (fs24.existsSync(dbPath)) {
+        const dbPath = path32.join(regEntry.path, ".code-intel", "graph.db");
+        if (fs26.existsSync(dbPath)) {
           try {
-            const db = new DbManager(dbPath);
+            const db = new DbManager(dbPath, true);
             await db.init();
             const g = createKnowledgeGraph();
             await loadGraphFromDB(g, db);
@@ -11779,7 +12388,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     res.json({ repos, edges });
   });
   app.get("/api/v1/source", requireAuth, requireRole("viewer"), (req, res) => {
-    const { file, startLine: startLineStr, endLine: endLineStr } = req.query;
+    const { file, startLine: startLineStr, endLine: endLineStr, repo } = req.query;
     if (!file) {
       res.status(400).json({
         error: {
@@ -11803,14 +12412,36 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       });
       return;
     }
-    let rawResolved = path31.normalize(file);
-    if (!path31.isAbsolute(rawResolved) && workspaceRoot) {
-      rawResolved = path31.join(workspaceRoot, rawResolved);
+    let baseDir = workspaceRoot;
+    if (repo && repo !== repoName) {
+      const registry = loadRegistry();
+      const entry = registry.find((r) => r.name === repo || r.path === repo);
+      if (entry) {
+        baseDir = entry.path;
+      } else {
+        const group = loadGroup(repo);
+        if (group) {
+          const normalizedFile = path32.normalize(file);
+          for (const member of group.members) {
+            const regEntry = registry.find((r) => r.name === member.registryName);
+            if (!regEntry) continue;
+            const candidate = path32.resolve(path32.join(regEntry.path, normalizedFile));
+            if (fs26.existsSync(candidate)) {
+              baseDir = regEntry.path;
+              break;
+            }
+          }
+        }
+      }
+    }
+    let rawResolved = path32.normalize(file);
+    if (!path32.isAbsolute(rawResolved) && baseDir) {
+      rawResolved = path32.join(baseDir, rawResolved);
     }
-    const resolvedFile = path31.resolve(rawResolved);
+    const resolvedFile = path32.resolve(rawResolved);
     function isInsideDir(fileAbs, dir) {
-      const rel = path31.relative(path31.resolve(dir), fileAbs);
-      return !rel.startsWith("..") && !path31.isAbsolute(rel);
+      const rel = path32.relative(path32.resolve(dir), fileAbs);
+      return !rel.startsWith("..") && !path32.isAbsolute(rel);
     }
     if (workspaceRoot) {
       if (!isInsideDir(resolvedFile, workspaceRoot)) {
@@ -11847,7 +12478,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     }
     let fileContent;
     try {
-      fileContent = fs24.readFileSync(resolvedFile, "utf-8");
+      fileContent = fs26.readFileSync(resolvedFile, "utf-8");
     } catch {
       res.status(404).json({
         error: {
@@ -11878,7 +12509,7 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
     const contextStart = Math.max(1, startLine - 20);
     const contextEnd = Math.min(lines.length, endLine + 20);
     const content = lines.slice(contextStart - 1, contextEnd).join("\n");
-    const ext = path31.extname(resolvedFile).toLowerCase();
+    const ext = path32.extname(resolvedFile).toLowerCase();
     const languageMap = {
       ".ts": "typescript",
       ".tsx": "typescript",
@@ -12013,10 +12644,10 @@ function createApp(graph, repoName, workspaceRoot, watcherState) {
       res.status(500).json({ error: { code: ErrorCodes.INTERNAL_ERROR, message: err instanceof Error ? err.message : String(err), requestId: req.requestId, timestamp: (/* @__PURE__ */ new Date()).toISOString() } });
     }
   });
-  if (fs24.existsSync(WEB_DIST)) {
+  if (fs26.existsSync(WEB_DIST)) {
     app.use(express.static(WEB_DIST));
     app.get("/{*path}", (_req, res) => {
-      res.sendFile(path31.join(WEB_DIST, "index.html"));
+      res.sendFile(path32.join(WEB_DIST, "index.html"));
     });
   }
   app.use("/admin", requireRole("admin"));
@@ -12170,12 +12801,13 @@ async function startHttpServer(graph, repoName, port = 4747, workspaceRoot, watc
 
 // src/multi-repo/index.ts
 init_group_registry();
+init_graph_from_db();
 
 // src/multi-repo/cross-repo-search.ts
 function mergeSearchResults(...perRepoResults) {
   return reciprocalRankFusion(...perRepoResults);
 }
 
-export { AstCache, BindingTracker, DbManager, addBinding, addClustersToGraph, addMember, buildCallEdges, buildHeritageEdges, classifyCall, clusterPhase, computeMRO, createApp, createKnowledgeGraph, createMcpServer, createScope, deleteGroup, detectCommunities, detectOverrides, findEntryPoints, flowPhase, generateEdgeId, generateNodeId, getAllLanguageModules, getDbPath, getLanguage, getLanguageModule, getParser, groupExists, initParser, isTreeSitterAvailable, listGroups, loadGraphToDB, loadGroup, loadMetadata, loadRegistry, loadSyncResult, mergeSearchResults, parsePhase, parseSource, queryGroup, reciprocalRankFusion, removeMember, removeRepo, resolveBinding, resolveImports, resolvePhase, runPipeline, runQuery, runQueryMatches, saveGroup, saveMetadata, saveSyncResult, scanPhase, startHttpServer, startMcpStdio, structurePhase, syncGroup, textSearch, topologicalSort, traceFlow, upsertRepo, validateDAG };
+export { AstCache, BindingTracker, Bm25Index, DbManager, addBinding, addClustersToGraph, addMember, buildCallEdges, buildHeritageEdges, classifyCall, clusterPhase, computeMRO, createApp, createKnowledgeGraph, createMcpServer, createScope, deleteGroup, detectCommunities, detectOverrides, findEntryPoints, flowPhase, generateEdgeId, generateNodeId, getAllLanguageModules, getBm25DbPath, getDbPath, getLanguage, getLanguageModule, getParser, groupExists, initParser, isTreeSitterAvailable, listGroups, loadGraphToDB, loadGroup, loadMetadata, loadRegistry, loadSyncResult, mergeSearchResults, parsePhase, parseSource, queryGroup, reciprocalRankFusion, removeMember, removeRepo, resolveBinding, resolveImports, resolvePhase, runPipeline, runQuery, runQueryMatches, saveGroup, saveMetadata, saveSyncResult, scanPhase, startHttpServer, startMcpStdio, structurePhase, syncGroup, textSearch, topologicalSort, traceFlow, upsertRepo, validateDAG };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map