contract-driven-delivery 2.0.20 → 2.1.0

package/dist/cli/index.js

@@ -2774,7 +2774,7 @@ var require_fast_deep_equal = __commonJS({
 var require_json_schema_traverse = __commonJS({
   "node_modules/json-schema-traverse/index.js"(exports, module) {
     "use strict";
-    var traverse = module.exports = function(schema, opts, cb) {
+    var traverse2 = module.exports = function(schema, opts, cb) {
       if (typeof opts == "function") {
         cb = opts;
         opts = {};
@@ -2786,7 +2786,7 @@ var require_json_schema_traverse = __commonJS({
       };
       _traverse(opts, pre, post, schema, "", schema);
     };
-    traverse.keywords = {
+    traverse2.keywords = {
       additionalItems: true,
       items: true,
       contains: true,
@@ -2797,20 +2797,20 @@ var require_json_schema_traverse = __commonJS({
       then: true,
       else: true
     };
-    traverse.arrayKeywords = {
+    traverse2.arrayKeywords = {
       items: true,
       allOf: true,
       anyOf: true,
       oneOf: true
     };
-    traverse.propsKeywords = {
+    traverse2.propsKeywords = {
       $defs: true,
       definitions: true,
       properties: true,
       patternProperties: true,
       dependencies: true
     };
-    traverse.skipKeywords = {
+    traverse2.skipKeywords = {
       default: true,
       enum: true,
       const: true,
@@ -2836,16 +2836,16 @@ var require_json_schema_traverse = __commonJS({
         for (var key in schema) {
           var sch = schema[key];
           if (Array.isArray(sch)) {
-            if (key in traverse.arrayKeywords) {
+            if (key in traverse2.arrayKeywords) {
               for (var i = 0; i < sch.length; i++)
                 _traverse(opts, pre, post, sch[i], jsonPtr + "/" + key + "/" + i, rootSchema, jsonPtr, key, schema, i);
             }
-          } else if (key in traverse.propsKeywords) {
+          } else if (key in traverse2.propsKeywords) {
             if (sch && typeof sch == "object") {
               for (var prop in sch)
                 _traverse(opts, pre, post, sch[prop], jsonPtr + "/" + key + "/" + escapeJsonPtr(prop), rootSchema, jsonPtr, key, schema, prop);
             }
-          } else if (key in traverse.keywords || opts.allKeys && !(key in traverse.skipKeywords)) {
+          } else if (key in traverse2.keywords || opts.allKeys && !(key in traverse2.skipKeywords)) {
             _traverse(opts, pre, post, sch, jsonPtr + "/" + key, rootSchema, jsonPtr, key, schema);
           }
         }
@@ -2866,7 +2866,7 @@ var require_resolve = __commonJS({
     exports.getSchemaRefs = exports.resolveUrl = exports.normalizeId = exports._getFullPath = exports.getFullPath = exports.inlineRef = void 0;
     var util_1 = require_util();
     var equal = require_fast_deep_equal();
-    var traverse = require_json_schema_traverse();
+    var traverse2 = require_json_schema_traverse();
     var SIMPLE_INLINED = /* @__PURE__ */ new Set([
       "type",
       "format",
@@ -2962,7 +2962,7 @@ var require_resolve = __commonJS({
       const pathPrefix = getFullPath(uriResolver, schId, false);
       const localRefs = {};
       const schemaRefs = /* @__PURE__ */ new Set();
-      traverse(schema, { allKeys: true }, (sch, jsonPtr, _, parentJsonPtr) => {
+      traverse2(schema, { allKeys: true }, (sch, jsonPtr, _, parentJsonPtr) => {
         if (parentJsonPtr === void 0)
           return;
         const fullPath = pathPrefix + jsonPtr;
@@ -7499,20 +7499,50 @@ var require_dist = __commonJS({
   }
 });
 
+// src/utils/gitignore.ts
+import { existsSync as existsSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
+function ensureGitignoreEntry(cwd, entry, comment = "cdd-kit generated backups (do not commit)") {
+  const path = join13(cwd, ".gitignore");
+  const trimmed = entry.trim();
+  if (!trimmed)
+    return false;
+  const re = new RegExp(`^\\s*${trimmed.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*$`, "m");
+  let existing = "";
+  if (existsSync12(path))
+    existing = readFileSync11(path, "utf8");
+  if (re.test(existing))
+    return false;
+  const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+  const block = existing.length === 0 ? `# ${comment}
+${trimmed}
+` : `${sep}
+# ${comment}
+${trimmed}
+`;
+  writeFileSync6(path, existing + block, "utf8");
+  return true;
+}
+var init_gitignore = __esm({
+  "src/utils/gitignore.ts"() {
+    "use strict";
+  }
+});
+
 // src/commands/migrate.ts
 var migrate_exports = {};
 __export(migrate_exports, {
   migrate: () => migrate
 });
-import { join as join13 } from "path";
-import { cpSync as cpSync2, existsSync as existsSync12, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join14 } from "path";
+import { cpSync as cpSync2, existsSync as existsSync13, mkdirSync as mkdirSync6, readdirSync as readdirSync7, readFileSync as readFileSync12, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
 import yaml2 from "js-yaml";
 function backupChangeDir(cwd, changeId, sessionStamp) {
-  const backupRoot = join13(cwd, ".cdd", "migrate-backup", sessionStamp);
-  const backupDir2 = join13(backupRoot, changeId);
+  const backupRoot = join14(cwd, ".cdd", "migrate-backup", sessionStamp);
+  const backupDir2 = join14(backupRoot, changeId);
   mkdirSync6(backupRoot, { recursive: true });
-  const sourceDir = join13(cwd, "specs", "changes", changeId);
-  if (existsSync12(sourceDir)) {
+  const sourceDir = join14(cwd, "specs", "changes", changeId);
+  if (existsSync13(sourceDir)) {
     cpSync2(sourceDir, backupDir2, { recursive: true });
   }
   return backupDir2;
@@ -7645,16 +7675,16 @@ function parseLegacyTaskList(body) {
   return rows;
 }
 function migrateTasksFile(changeId, changeDir, enableContextGovernance, detectedTier, changed, warnings, pendingWrites, pendingDeletes) {
-  const newPath = join13(changeDir, "tasks.yml");
-  const legacyPath = join13(changeDir, "tasks.md");
-  if (existsSync12(newPath)) {
+  const newPath = join14(changeDir, "tasks.yml");
+  const legacyPath = join14(changeDir, "tasks.md");
+  if (existsSync13(newPath)) {
     return;
   }
-  if (!existsSync12(legacyPath)) {
+  if (!existsSync13(legacyPath)) {
     warnings.push("tasks.md not found and tasks.yml missing \u2014 skipping tasks migration");
     return;
   }
-  const raw = readFileSync11(legacyPath, "utf8");
+  const raw = readFileSync12(legacyPath, "utf8");
   const fm = parseLegacyFrontmatter(raw);
   const bodyMatch = raw.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n?([\s\S]*)$/);
   const body = bodyMatch ? bodyMatch[1] : raw;
@@ -7738,17 +7768,17 @@ function parseLegacyAgentLog(content) {
   return data;
 }
 function migrateAgentLogs(changeDir, changed, pendingWrites, pendingDeletes) {
-  const agentLogDir = join13(changeDir, "agent-log");
-  if (!existsSync12(agentLogDir))
+  const agentLogDir = join14(changeDir, "agent-log");
+  if (!existsSync13(agentLogDir))
     return;
   const mdLogs = readdirSync7(agentLogDir).filter((f) => f.endsWith(".md"));
   for (const f of mdLogs) {
-    const fullPath = join13(agentLogDir, f);
+    const fullPath = join14(agentLogDir, f);
     const yamlName = f.replace(/\.md$/, ".yml");
-    const yamlFull = join13(agentLogDir, yamlName);
-    if (existsSync12(yamlFull))
+    const yamlFull = join14(agentLogDir, yamlName);
+    if (existsSync13(yamlFull))
       continue;
-    const raw = readFileSync11(fullPath, "utf8");
+    const raw = readFileSync12(fullPath, "utf8");
     const parsed = parseLegacyAgentLog(raw);
     const yamlOut = yaml2.dump(parsed, { lineWidth: -1, noRefs: true });
     pendingWrites.push({ path: yamlFull, content: yamlOut });
@@ -7757,15 +7787,15 @@ function migrateAgentLogs(changeDir, changed, pendingWrites, pendingDeletes) {
   }
 }
 function ensureImplementationPlanScaffold(changeId, changeDir, changed, warnings, pendingWrites) {
-  const planPath = join13(changeDir, "implementation-plan.md");
-  if (existsSync12(planPath))
+  const planPath = join14(changeDir, "implementation-plan.md");
+  if (existsSync13(planPath))
     return;
-  const templatePath = join13(ASSET.specsTemplates, "implementation-plan.md");
-  if (!existsSync12(templatePath)) {
+  const templatePath = join14(ASSET.specsTemplates, "implementation-plan.md");
+  if (!existsSync13(templatePath)) {
     warnings.push("implementation-plan.md template not found; run cdd-kit upgrade --yes after updating cdd-kit");
     return;
   }
-  const template = readFileSync11(templatePath, "utf8").replace(/<change-id>/g, changeId).replace(/<id>/g, changeId);
+  const template = readFileSync12(templatePath, "utf8").replace(/<change-id>/g, changeId).replace(/<id>/g, changeId);
   pendingWrites.push({ path: planPath, content: template });
   changed.push("implementation-plan.md: added scaffold");
   warnings.push("implementation-plan.md scaffold added; fill it before implementation agents continue");
@@ -7776,9 +7806,9 @@ function migrateOne(changeId, changeDir, enableContextGovernance) {
   const pending = [];
   const deletes = [];
   let detectedTier = null;
-  const classifPath = join13(changeDir, "change-classification.md");
-  if (existsSync12(classifPath)) {
-    const content = readFileSync11(classifPath, "utf8");
+  const classifPath = join14(changeDir, "change-classification.md");
+  if (existsSync13(classifPath)) {
+    const content = readFileSync12(classifPath, "utf8");
     const hasNewTierFormat = /^## Tier\s*\n\s*-\s*\d\s*$/m.test(content);
     const oldMatch = content.match(/\*\*Tier[:\*]+\s*(?:Tier\s*)?(\d)/i) ?? content.match(/^-?\s*Tier:\s*(?:Tier\s*)?(\d)/mi);
     if (oldMatch)
@@ -7809,8 +7839,8 @@ function migrateOne(changeId, changeDir, enableContextGovernance) {
   migrateTasksFile(changeId, changeDir, enableContextGovernance, detectedTier, changed, warnings, pending, deletes);
   ensureImplementationPlanScaffold(changeId, changeDir, changed, warnings, pending);
   migrateAgentLogs(changeDir, changed, pending, deletes);
-  const manifestPath = join13(changeDir, "context-manifest.md");
-  if (!existsSync12(manifestPath)) {
+  const manifestPath = join14(changeDir, "context-manifest.md");
+  if (!existsSync13(manifestPath)) {
     changed.push(enableContextGovernance ? "context-manifest.md: added context-governance v1 manifest scaffold" : "context-manifest.md: added legacy context manifest scaffold");
     pending.push({
       path: manifestPath,
@@ -7826,7 +7856,7 @@ function commitWritesAtomically(pending, deletes) {
   try {
     for (const write of pending) {
       const tmp = `${write.path}.cdd-migrate.tmp`;
-      writeFileSync6(tmp, write.content, "utf8");
+      writeFileSync7(tmp, write.content, "utf8");
       renames.push({ tmp, final: write.path });
     }
   } catch (err) {
@@ -7855,8 +7885,8 @@ async function migrate(changeId, opts = {}) {
   const noBackup = opts.noBackup ?? false;
   const idsToMigrate = [];
   if (opts.all) {
-    const changesDir = join13(cwd, "specs", "changes");
-    if (!existsSync12(changesDir)) {
+    const changesDir = join14(cwd, "specs", "changes");
+    if (!existsSync13(changesDir)) {
       log.info("No specs/changes/ directory found \u2014 nothing to migrate.");
       return;
     }
@@ -7864,8 +7894,8 @@ async function migrate(changeId, opts = {}) {
       ...readdirSync7(changesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name)
     );
   } else if (changeId) {
-    const specificDir = join13(cwd, "specs", "changes", changeId);
-    if (!existsSync12(specificDir)) {
+    const specificDir = join14(cwd, "specs", "changes", changeId);
+    if (!existsSync13(specificDir)) {
       log.error(`Change not found: specs/changes/${changeId}`);
       process.exit(1);
     }
@@ -7885,10 +7915,10 @@ async function migrate(changeId, opts = {}) {
   const sessionStamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   let migratedCount = 0;
   let upToDateCount = 0;
-  const backupRoot = join13(cwd, ".cdd", "migrate-backup", sessionStamp);
+  const backupRoot = join14(cwd, ".cdd", "migrate-backup", sessionStamp);
   for (const id of idsToMigrate) {
-    const changeDir = join13(cwd, "specs", "changes", id);
-    if (!existsSync12(changeDir)) {
+    const changeDir = join14(cwd, "specs", "changes", id);
+    if (!existsSync13(changeDir)) {
       log.warn(`  ${id}: directory not found \u2014 skipping`);
       continue;
     }
@@ -7936,32 +7966,12 @@ async function migrate(changeId, opts = {}) {
     }
   }
 }
-function ensureGitignoreEntry(cwd, entry) {
-  const path = join13(cwd, ".gitignore");
-  const trimmed = entry.trim();
-  if (!trimmed)
-    return false;
-  const re = new RegExp(`^\\s*${trimmed.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\\s*$`, "m");
-  let existing = "";
-  if (existsSync12(path))
-    existing = readFileSync11(path, "utf8");
-  if (re.test(existing))
-    return false;
-  const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  const block = existing.length === 0 ? `# cdd-kit generated backups (do not commit)
-${trimmed}
-` : `${sep}
-# cdd-kit generated backups (do not commit)
-${trimmed}
-`;
-  writeFileSync6(path, existing + block, "utf8");
-  return true;
-}
 var init_migrate = __esm({
   "src/commands/migrate.ts"() {
     "use strict";
     init_logger();
     init_paths();
+    init_gitignore();
   }
 });
 
@@ -7970,34 +7980,34 @@ var upgrade_exports = {};
 __export(upgrade_exports, {
   upgrade: () => upgrade
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, readdirSync as readdirSync8, copyFileSync as copyFileSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname4, join as join14, relative as relative4 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, readdirSync as readdirSync8, copyFileSync as copyFileSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname4, join as join15, relative as relative4 } from "path";
 function planMissingFiles(srcDir, destDir, label, planned) {
-  if (!existsSync13(srcDir))
+  if (!existsSync14(srcDir))
     return;
   for (const entry of readdirSync8(srcDir, { withFileTypes: true })) {
-    const src = join14(srcDir, entry.name);
-    const dest = join14(destDir, entry.name);
+    const src = join15(srcDir, entry.name);
+    const dest = join15(destDir, entry.name);
     if (entry.isDirectory()) {
-      planMissingFiles(src, dest, join14(label, entry.name), planned);
+      planMissingFiles(src, dest, join15(label, entry.name), planned);
       continue;
     }
-    if (!existsSync13(dest)) {
-      planned.push({ src, dest, rel: join14(label, relative4(srcDir, src)) });
+    if (!existsSync14(dest)) {
+      planned.push({ src, dest, rel: join15(label, relative4(srcDir, src)) });
     }
   }
 }
 function planProviderGuidance(cwd, provider, planned) {
   if (provider === "claude" || provider === "both") {
-    if (!existsSync13(join14(cwd, "CLAUDE.md"))) {
-      planned.push({ src: ASSET.claudeTemplate, dest: join14(cwd, "CLAUDE.md"), rel: "CLAUDE.md" });
+    if (!existsSync14(join15(cwd, "CLAUDE.md"))) {
+      planned.push({ src: ASSET.claudeTemplate, dest: join15(cwd, "CLAUDE.md"), rel: "CLAUDE.md" });
     }
-    if (!existsSync13(join14(cwd, "AGENTS.md"))) {
-      planned.push({ src: ASSET.agentsTemplate, dest: join14(cwd, "AGENTS.md"), rel: "AGENTS.md" });
+    if (!existsSync14(join15(cwd, "AGENTS.md"))) {
+      planned.push({ src: ASSET.agentsTemplate, dest: join15(cwd, "AGENTS.md"), rel: "AGENTS.md" });
     }
   }
-  if ((provider === "codex" || provider === "both") && !existsSync13(join14(cwd, "CODEX.md"))) {
-    planned.push({ src: ASSET.codexTemplate, dest: join14(cwd, "CODEX.md"), rel: "CODEX.md" });
+  if ((provider === "codex" || provider === "both") && !existsSync14(join15(cwd, "CODEX.md"))) {
+    planned.push({ src: ASSET.codexTemplate, dest: join15(cwd, "CODEX.md"), rel: "CODEX.md" });
   }
 }
 function applyCopy(plan) {
@@ -8015,12 +8025,12 @@ async function upgrade(opts = {}) {
   }
   const provider = inferProvider(cwd, requestedProvider);
   const plan = [];
-  planMissingFiles(ASSET.contracts, join14(cwd, "contracts"), "contracts", plan);
-  planMissingFiles(ASSET.specsTemplates, join14(cwd, "specs", "templates"), "specs/templates", plan);
-  planMissingFiles(ASSET.testsTemplates, join14(cwd, "tests", "templates"), "tests/templates", plan);
-  planMissingFiles(ASSET.ci, join14(cwd, "ci"), "ci", plan);
-  planMissingFiles(ASSET.githubWorkflows, join14(cwd, ".github", "workflows"), ".github/workflows", plan);
-  planMissingFiles(ASSET.cddConfig, join14(cwd, ".cdd"), ".cdd", plan);
+  planMissingFiles(ASSET.contracts, join15(cwd, "contracts"), "contracts", plan);
+  planMissingFiles(ASSET.specsTemplates, join15(cwd, "specs", "templates"), "specs/templates", plan);
+  planMissingFiles(ASSET.testsTemplates, join15(cwd, "tests", "templates"), "tests/templates", plan);
+  planMissingFiles(ASSET.ci, join15(cwd, "ci"), "ci", plan);
+  planMissingFiles(ASSET.githubWorkflows, join15(cwd, ".github", "workflows"), ".github/workflows", plan);
+  planMissingFiles(ASSET.cddConfig, join15(cwd, ".cdd"), ".cdd", plan);
   planProviderGuidance(cwd, provider, plan);
   log.blank();
   log.info(`Upgrade provider: ${provider}`);
@@ -8057,11 +8067,11 @@ async function upgrade(opts = {}) {
     return;
   }
   applyCopy(plan);
-  const modelPolicyPath = join14(cwd, ".cdd", "model-policy.json");
-  if (existsSync13(modelPolicyPath)) {
+  const modelPolicyPath = join15(cwd, ".cdd", "model-policy.json");
+  if (existsSync14(modelPolicyPath)) {
     let existing = {};
     try {
-      existing = JSON.parse(readFileSync12(modelPolicyPath, "utf8"));
+      existing = JSON.parse(readFileSync13(modelPolicyPath, "utf8"));
     } catch {
     }
     const merged = {
@@ -8070,7 +8080,7 @@ async function upgrade(opts = {}) {
       generated_at: (/* @__PURE__ */ new Date()).toISOString(),
       roles: existing.roles && typeof existing.roles === "object" ? existing.roles : {}
     };
-    writeFileSync7(modelPolicyPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    writeFileSync8(modelPolicyPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
   }
   log.blank();
   log.ok(`Upgrade complete: ${plan.length} missing file(s) added.`);
@@ -8230,8 +8240,8 @@ var init_yaml_writer = __esm({
 });
 
 // src/code-map/config.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync14 } from "fs";
+import { join as join16 } from "path";
 import { load as yamlLoad } from "js-yaml";
 function asStringArray(value, key, where) {
   if (value === void 0)
@@ -8247,8 +8257,8 @@ function asStringArray(value, key, where) {
   return value;
 }
 function loadCodeMapConfig(cwd) {
-  const filePath = join15(cwd, CONFIG_REL_PATH);
-  if (!existsSync14(filePath)) {
+  const filePath = join16(cwd, CONFIG_REL_PATH);
+  if (!existsSync15(filePath)) {
     return {
       include: [...BUILTIN_INCLUDE],
       exclude: [...BUILTIN_EXCLUDE],
@@ -8257,7 +8267,7 @@ function loadCodeMapConfig(cwd) {
   }
   let text;
   try {
-    text = readFileSync13(filePath, "utf8");
+    text = readFileSync14(filePath, "utf8");
   } catch (err) {
     throw new Error(`failed to read ${CONFIG_REL_PATH}: ${err.message}`);
   }
@@ -8328,7 +8338,7 @@ var init_config = __esm({
 
 // src/code-map/include-exclude.ts
 import { readdirSync as readdirSync9, statSync as statSync2 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import picomatch from "picomatch";
 function walkRepo(root, opts = {}) {
   const includes = opts.include ?? [];
@@ -8347,7 +8357,7 @@ function walkRepo(root, opts = {}) {
     }
     for (const entry of entries) {
       const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
-      const absPath = join16(dir, entry.name);
+      const absPath = join17(dir, entry.name);
       if (entry.isDirectory() || entry.isSymbolicLink()) {
         const dirPattern = `${relPath}/**`;
         if (isExcluded(relPath) || isExcluded(dirPattern))
@@ -8418,89 +8428,713 @@ var init_orchestrator = __esm({
   }
 });
 
-// src/code-map/scanners/common.ts
-import { relative as relative5 } from "path";
-function canonicalRelPath(absolutePath, repoRoot) {
-  const rel = relative5(repoRoot, absolutePath);
-  return rel.replace(/\\/g, "/").normalize("NFC");
-}
-function isAllCapsConst(name) {
-  return name.length >= 2 && /^[A-Z][A-Z0-9_]*$/.test(name);
+// src/code-map/freshness.ts
+import { existsSync as existsSync16, readFileSync as readFileSync15, statSync as statSync3 } from "fs";
+import { join as join18 } from "path";
+function checkCodeMapFreshness(cwd, mapRel = ".cdd/code-map.yml", include, exclude) {
+  const mapPath = join18(cwd, mapRel);
+  let cfg;
+  try {
+    cfg = loadCodeMapConfig(cwd);
+  } catch (err) {
+    return {
+      status: "config-error",
+      staleFiles: [],
+      staleCount: 0,
+      mapPath,
+      configError: err.message
+    };
+  }
+  const includeFinal = [...cfg.include, ...include ?? []];
+  const excludeFinal = [...cfg.exclude, ...exclude ?? []];
+  const sourceFiles = walkRepo(cwd, { include: includeFinal, exclude: excludeFinal });
+  if (!existsSync16(mapPath)) {
+    if (sourceFiles.length === 0) {
+      return { status: "missing-greenfield", staleFiles: [], staleCount: 0, mapPath };
+    }
+    return { status: "missing-with-sources", staleFiles: [], staleCount: 0, mapPath };
+  }
+  const mapMtime = statSync3(mapPath).mtimeMs;
+  const staleAll = [];
+  for (const absPath of sourceFiles) {
+    try {
+      const mtime = statSync3(absPath).mtimeMs;
+      if (mtime > mapMtime) {
+        const rel = absPath.replace(/\\/g, "/").replace(cwd.replace(/\\/g, "/") + "/", "");
+        staleAll.push(rel);
+      }
+    } catch {
+    }
+  }
+  if (staleAll.length === 0) {
+    return { status: "ok", staleFiles: [], staleCount: 0, mapPath };
+  }
+  const declaredDigest = readSourcesDigest(mapPath);
+  if (declaredDigest !== null) {
+    const actualDigest = computeSourcesDigest(sourceFiles, cwd);
+    if (actualDigest === declaredDigest) {
+      return { status: "ok", staleFiles: [], staleCount: 0, mapPath };
+    }
+  }
+  return {
+    status: "stale",
+    staleFiles: staleAll.slice(0, 5),
+    staleCount: staleAll.length,
+    mapPath
+  };
 }
-function isBinary(content) {
-  const head = content.slice(0, 4096);
-  return head.includes("\0");
+function readSourcesDigest(mapPath) {
+  try {
+    const head = readFileSync15(mapPath, "utf8").slice(0, 2048);
+    const m = head.match(/^# sources-digest:\s*([a-f0-9]+)/m);
+    return m ? m[1] : null;
+  } catch {
+    return null;
+  }
 }
-var init_common = __esm({
-  "src/code-map/scanners/common.ts"() {
+var init_freshness = __esm({
+  "src/code-map/freshness.ts"() {
     "use strict";
+    init_include_exclude();
+    init_config();
+    init_code_map();
   }
 });
 
-// src/code-map/scanners/python.ts
-var python_exports = {};
-__export(python_exports, {
-  pythonScanner: () => pythonScanner
-});
-import { spawnSync as spawnSync2 } from "child_process";
-import { writeFileSync as writeFileSync8, unlinkSync } from "fs";
-import { join as join17 } from "path";
-import { tmpdir } from "os";
-function detectPython2() {
-  for (const candidate of ["python3", "python"]) {
-    try {
-      const result = spawnSync2(candidate, ["--version"], {
-        encoding: "utf8",
-        timeout: 5e3
-      });
-      if (result.status === 0)
-        return candidate;
-    } catch {
+// src/code-map/index-reader.ts
+import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
+import yaml3 from "js-yaml";
+async function ensureCodeMapFresh(mapPath, refresh2) {
+  if (!refresh2)
+    return { refreshed: false };
+  const freshness = checkCodeMapFreshness(process.cwd(), mapPath);
+  if (freshness.status === "config-error") {
+    return {
+      refreshed: false,
+      error: `.cdd/code-map-config.yml is invalid: ${freshness.configError}`
+    };
+  }
+  if (freshness.status === "missing-with-sources" || freshness.status === "missing-greenfield" || freshness.status === "stale") {
+    const { codeMap: codeMap2 } = await Promise.resolve().then(() => (init_code_map(), code_map_exports));
+    const exit = await codeMap2({
+      path: ".",
+      out: mapPath,
+      include: [],
+      exclude: [],
+      check: false,
+      maxLines: 1e5,
+      silent: true
+    });
+    if (exit !== 0) {
+      return {
+        refreshed: false,
+        error: `could not refresh ${mapPath}; run \`cdd-kit code-map\` for details.`
+      };
+    }
+    return { refreshed: true };
+  }
+  return { refreshed: false };
+}
+function sidecarPathFor(mapPath) {
+  return `${mapPath.replace(/\.ya?ml$/i, "")}.index.json`;
+}
+function tryLoadSidecar(mapPath, mapText) {
+  const sidecarPath = sidecarPathFor(mapPath);
+  if (!existsSync17(sidecarPath))
+    return null;
+  const headerDigest = mapText.match(/^# sources-digest:\s*([a-f0-9]+)/m)?.[1];
+  if (!headerDigest)
+    return null;
+  try {
+    const raw = JSON.parse(readFileSync16(sidecarPath, "utf8"));
+    if (raw && raw.sourcesDigest === headerDigest && Array.isArray(raw.entries)) {
+      return raw.entries;
     }
+  } catch {
   }
   return null;
 }
-var TIMEOUT_MS, PythonScanner, pythonScanner;
-var init_python = __esm({
-  "src/code-map/scanners/python.ts"() {
+function loadCodeMapEntries(mapPath) {
+  if (!existsSync17(mapPath)) {
+    throw new Error(`${mapPath} is missing; run \`cdd-kit code-map\` first.`);
+  }
+  const text = readFileSync16(mapPath, "utf8");
+  const fromSidecar = tryLoadSidecar(mapPath, text);
+  if (fromSidecar)
+    return fromSidecar;
+  const totalLinesByPath = extractTotalLines(text);
+  const raw = yaml3.load(text, { schema: yaml3.JSON_SCHEMA });
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return [];
+  const entries = [];
+  for (const [path, value] of Object.entries(raw)) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      continue;
+    const obj = value;
+    entries.push({
+      path,
+      total_lines: totalLinesByPath.get(path) ?? (typeof obj.total_lines === "number" ? obj.total_lines : 0),
+      imports: Array.isArray(obj.imports) ? obj.imports : [],
+      constants: Array.isArray(obj.constants) ? obj.constants : [],
+      classes: Array.isArray(obj.classes) ? obj.classes : [],
+      functions: Array.isArray(obj.functions) ? obj.functions : [],
+      interfaces: Array.isArray(obj.interfaces) ? obj.interfaces : [],
+      types: Array.isArray(obj.types) ? obj.types : [],
+      enums: Array.isArray(obj.enums) ? obj.enums : []
+    });
+  }
+  return entries;
+}
+function extractTotalLines(text) {
+  const totals = /* @__PURE__ */ new Map();
+  for (const line of text.split(/\r?\n/)) {
+    const m = line.match(/^((?:'[^']*(?:''[^']*)*')|[^#:\s][^#]*?):\s*#\s*(\d+)\s+lines\b/);
+    if (!m)
+      continue;
+    totals.set(unquoteYamlKey(m[1].trim()), Number(m[2]));
+  }
+  return totals;
+}
+function unquoteYamlKey(key) {
+  if (key.startsWith("'") && key.endsWith("'")) {
+    return key.slice(1, -1).replace(/''/g, "'");
+  }
+  return key;
+}
+var init_index_reader = __esm({
+  "src/code-map/index-reader.ts"() {
     "use strict";
-    init_paths();
-    init_common();
-    TIMEOUT_MS = parseInt(process.env["CDD_CODE_MAP_TIMEOUT_MS"] ?? "30000", 10);
-    PythonScanner = class {
-      extensions = [".py"];
-      _interpreter = void 0;
-      getInterpreter() {
-        if (this._interpreter === void 0) {
-          this._interpreter = detectPython2();
-        }
-        return this._interpreter;
-      }
-      async scan(absolutePath, repoRoot) {
-        const result = await this.scanBatch([absolutePath], repoRoot);
-        return result.entries[0] ?? null;
-      }
-      async scanBatch(absolutePaths, repoRoot) {
-        const interpreter = this.getInterpreter();
-        const entries = [];
-        const warnings = [];
-        if (!interpreter) {
-          const count = absolutePaths.length;
-          warnings.push({
-            path: "",
-            message: `python interpreter not found on PATH; skipping ${count} .py file${count === 1 ? "" : "s"}`
-          });
-          return { entries, warnings };
-        }
-        const scriptPath = ASSET.codeMapPython;
-        const rand = Math.random().toString(36).slice(2);
-        const listFile = join17(tmpdir(), `cdd-codemap-${process.pid}-${rand}.txt`);
-        writeFileSync8(listFile, absolutePaths.join("\n") + "\n", "utf8");
-        let stdout = "";
-        let stderr = "";
-        let exitCode = 0;
-        try {
-          const result = spawnSync2(
+    init_freshness();
+  }
+});
+
+// src/code-graph/builder.ts
+import { createHash as createHash5 } from "crypto";
+import { posix } from "path";
+function stableId(parts) {
+  return createHash5("sha1").update(parts.join("\0")).digest("hex").slice(0, 16);
+}
+function nodeId(filePath, kind, name, startLine) {
+  return `n:${stableId([filePath, kind, name, String(startLine)])}`;
+}
+function edgeId(source, target, kind, line, name) {
+  return `e:${stableId([source, target, kind, String(line ?? 0), name ?? ""])}`;
+}
+function fileNode(path, totalLines) {
+  return {
+    id: nodeId(path, "file", path, 1),
+    kind: "file",
+    name: posix.basename(path),
+    qualified_name: path,
+    file_path: path,
+    start_line: totalLines > 0 ? 1 : 0,
+    end_line: totalLines
+  };
+}
+function symbolNode(filePath, kind, name, lines, exported) {
+  const start = lines[0] ?? 1;
+  const end = lines[1] ?? start;
+  return {
+    id: nodeId(filePath, kind, name, start),
+    kind,
+    name,
+    qualified_name: `${filePath}::${name}`,
+    file_path: filePath,
+    start_line: start,
+    end_line: end,
+    ...exported !== void 0 ? { exported } : {}
+  };
+}
+function addEdge(edges, source, target, kind, line, provenance, metadata) {
+  edges.push({
+    id: edgeId(source, target, kind, line, metadata?.name),
+    source,
+    target,
+    kind,
+    ...line ? { line } : {},
+    provenance,
+    ...metadata ? { metadata } : {}
+  });
+}
+function isLocalImport(moduleName) {
+  return moduleName.startsWith(".");
+}
+function resolvePythonRelativeImport(importerPath, moduleName) {
+  const match = moduleName.match(/^(\.+)(.*)$/);
+  if (!match)
+    return moduleName;
+  const upLevels = Math.max(0, match[1].length - 1);
+  let baseDir = posix.dirname(importerPath);
+  for (let i = 0; i < upLevels; i++) {
+    baseDir = posix.dirname(baseDir);
+  }
+  const rest = match[2].replace(/^\./, "").replace(/\./g, "/");
+  return rest ? posix.normalize(posix.join(baseDir, rest)) : baseDir;
+}
+function resolutionCandidates(base) {
+  const ext = posix.extname(base);
+  const candidates = [];
+  if (ext) {
+    candidates.push(base);
+    const withoutExt = base.slice(0, -ext.length);
+    if ([".js", ".jsx", ".mjs", ".cjs"].includes(ext)) {
+      candidates.push(`${withoutExt}.ts`, `${withoutExt}.tsx`, `${withoutExt}.vue`);
+    }
+  } else {
+    for (const candidateExt of RESOLUTION_EXTENSIONS) {
+      candidates.push(`${base}${candidateExt}`);
+    }
+  }
+  for (const candidateExt of RESOLUTION_EXTENSIONS) {
+    candidates.push(posix.join(base, `index${candidateExt}`));
+  }
+  candidates.push(posix.join(base, "__init__.py"));
+  return [...new Set(candidates)];
+}
+function resolveLocalModule(importerPath, moduleName, pathSet) {
+  if (!isLocalImport(moduleName))
+    return void 0;
+  const base = moduleName.startsWith("./") || moduleName.startsWith("../") ? posix.normalize(posix.join(posix.dirname(importerPath), moduleName)) : resolvePythonRelativeImport(importerPath, moduleName);
+  for (const candidate of resolutionCandidates(base)) {
+    if (pathSet.has(candidate))
+      return candidate;
+  }
+  return void 0;
+}
+function importedBindings(imp, resolvedPath) {
+  const out = [];
+  for (const item of imp.items ?? []) {
+    if (item.startsWith("default:")) {
+      const local = item.slice("default:".length);
+      out.push({ local, imported: "default", ...resolvedPath ? { resolvedPath } : {} });
+    } else if (item.startsWith("*:")) {
+      const local = item.slice("*:".length);
+      out.push({ local, imported: "*", ...resolvedPath ? { resolvedPath } : {} });
+    } else if (/^[A-Za-z_$][\w$]*:[A-Za-z_$][\w$]*$/.test(item)) {
+      const [imported, local] = item.split(":");
+      out.push({ local, imported, ...resolvedPath ? { resolvedPath } : {} });
+    } else {
+      out.push({ local: item, imported: item, ...resolvedPath ? { resolvedPath } : {} });
+    }
+  }
+  return out;
+}
+function simpleName(name) {
+  return name.replace(/^async\s+/, "").split(".").pop() ?? name;
+}
+function isWithin(node, line) {
+  return node.start_line <= line && line <= node.end_line;
+}
+function findCallerNode(nodes, caller, line) {
+  const exact = nodes.find((n) => n.name === caller || n.qualified_name.endsWith(`::${caller}`));
+  if (exact)
+    return exact;
+  return nodes.filter((n) => (n.kind === "function" || n.kind === "method") && isWithin(n, line)).sort((a, b) => a.end_line - a.start_line - (b.end_line - b.start_line))[0];
+}
+function buildCodeGraph(entries, opts) {
+  const nodes = [];
+  const edges = [];
+  const unresolved = [];
+  const files = [];
+  const pathSet = new Set(entries.map((e) => e.path));
+  const fileNodes = /* @__PURE__ */ new Map();
+  const nodesByFile = /* @__PURE__ */ new Map();
+  const symbolsByFile = /* @__PURE__ */ new Map();
+  const globalSymbols = /* @__PURE__ */ new Map();
+  const registerSymbol = (filePath, node, exported) => {
+    nodes.push(node);
+    const fileMap = symbolsByFile.get(filePath) ?? /* @__PURE__ */ new Map();
+    const target = { node, exported };
+    fileMap.set(node.name, [...fileMap.get(node.name) ?? [], target]);
+    const shortName = simpleName(node.name);
+    if (shortName !== node.name) {
+      fileMap.set(shortName, [...fileMap.get(shortName) ?? [], target]);
+    }
+    symbolsByFile.set(filePath, fileMap);
+    globalSymbols.set(node.name, [...globalSymbols.get(node.name) ?? [], target]);
+    if (shortName !== node.name) {
+      globalSymbols.set(shortName, [...globalSymbols.get(shortName) ?? [], target]);
+    }
+  };
+  for (const entry of entries) {
+    const file = fileNode(entry.path, entry.total_lines);
+    fileNodes.set(entry.path, file);
+    nodesByFile.set(entry.path, [file]);
+    nodes.push(file);
+  }
+  for (const entry of entries) {
+    const file = fileNodes.get(entry.path);
+    const localNodes = nodesByFile.get(entry.path);
+    for (const c of entry.classes) {
+      const n = symbolNode(entry.path, "class", c.name, c.lines, c.exported);
+      localNodes.push(n);
+      registerSymbol(entry.path, n, c.exported === true);
+      addEdge(edges, file.id, n.id, "contains", c.lines[0], "codemap");
+      for (const m of c.methods ?? []) {
+        const methodName = `${c.name}.${m.name}`;
+        const mn = symbolNode(entry.path, "method", methodName, m.lines);
+        localNodes.push(mn);
+        registerSymbol(entry.path, mn, false);
+        addEdge(edges, n.id, mn.id, "contains", m.lines[0], "codemap");
+      }
+    }
+    for (const f of entry.functions) {
+      const n = symbolNode(entry.path, "function", f.name, f.lines, f.exported);
+      localNodes.push(n);
+      registerSymbol(entry.path, n, f.exported === true);
+      addEdge(edges, file.id, n.id, "contains", f.lines[0], "codemap");
+    }
+    for (const t of entry.interfaces ?? []) {
+      const n = symbolNode(entry.path, "interface", t.name, t.lines, t.exported);
+      localNodes.push(n);
+      registerSymbol(entry.path, n, t.exported === true);
+      addEdge(edges, file.id, n.id, "contains", t.lines[0], "codemap");
+    }
+    for (const t of entry.types ?? []) {
+      const n = symbolNode(entry.path, "type_alias", t.name, t.lines, t.exported);
+      localNodes.push(n);
+      registerSymbol(entry.path, n, t.exported === true);
+      addEdge(edges, file.id, n.id, "contains", t.lines[0], "codemap");
+    }
+    for (const e of entry.enums ?? []) {
+      const n = symbolNode(entry.path, "enum", e.name, e.lines, e.exported);
+      localNodes.push(n);
+      registerSymbol(entry.path, n, e.exported === true);
+      addEdge(edges, file.id, n.id, "contains", e.lines[0], "codemap");
+    }
+    for (const c of entry.constants) {
+      const n = symbolNode(entry.path, "constant", c.name, [c.line, c.line], true);
+      localNodes.push(n);
+      registerSymbol(entry.path, n, true);
+      addEdge(edges, file.id, n.id, "contains", c.line, "codemap");
+    }
+  }
+  const importBindingsByFile = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const file = fileNodes.get(entry.path);
+    const bindings = /* @__PURE__ */ new Map();
+    importBindingsByFile.set(entry.path, bindings);
+    for (const imp of entry.imports) {
+      const resolved = resolveLocalModule(entry.path, imp.module, pathSet);
+      if (resolved) {
+        addEdge(edges, file.id, fileNodes.get(resolved).id, "imports", imp.line, "ast", { module: imp.module });
+      }
+      for (const binding of importedBindings(imp, resolved)) {
+        if (!binding.resolvedPath)
+          continue;
+        const fileSymbols = symbolsByFile.get(binding.resolvedPath);
+        const candidates = binding.imported === "*" ? Array.from(fileSymbols?.values() ?? []).flat() : fileSymbols?.get(binding.imported) ?? [];
+        const exported = candidates.filter((c) => c.exported || candidates.length === 1);
+        if (exported.length > 0) {
+          bindings.set(binding.local, [...bindings.get(binding.local) ?? [], ...exported]);
+        }
+      }
+    }
+  }
+  for (const entry of entries) {
+    const localNodes = nodesByFile.get(entry.path) ?? [];
+    const localSymbols = symbolsByFile.get(entry.path) ?? /* @__PURE__ */ new Map();
+    const importBindings = importBindingsByFile.get(entry.path) ?? /* @__PURE__ */ new Map();
+    for (const c of entry.classes) {
+      const source = localSymbols.get(c.name)?.[0]?.node;
+      if (!source)
+        continue;
+      for (const base of c.extends ?? []) {
+        const target = resolveSymbol(base, entry.path, localSymbols, importBindings, globalSymbols);
+        if (target)
+          addEdge(edges, source.id, target.node.id, "extends", c.lines[0], "ast", { name: base });
+        else
+          unresolved.push({ from: source.id, kind: "extends", name: base, line: c.lines[0], file_path: entry.path });
+      }
+      for (const iface of c.implements ?? []) {
+        const target = resolveSymbol(iface, entry.path, localSymbols, importBindings, globalSymbols);
+        if (target)
+          addEdge(edges, source.id, target.node.id, "implements", c.lines[0], "ast", { name: iface });
+        else
+          unresolved.push({ from: source.id, kind: "implements", name: iface, line: c.lines[0], file_path: entry.path });
+      }
+    }
+    for (const call of entry.calls ?? []) {
+      const caller = findCallerNode(localNodes, call.caller, call.line);
+      if (!caller)
+        continue;
+      const target = resolveSymbol(call.callee, entry.path, localSymbols, importBindings, globalSymbols);
+      if (target) {
+        addEdge(edges, caller.id, target.node.id, "calls", call.line, "ast", { name: call.callee });
+      } else {
+        unresolved.push({ from: caller.id, kind: "calls", name: call.callee, line: call.line, file_path: entry.path });
+      }
+    }
+  }
+  const uniqueNodes = dedupeBy(nodes, (n) => n.id);
+  const uniqueEdges = dedupeBy(edges, (e) => e.id);
+  for (const entry of entries) {
+    files.push({
+      path: entry.path,
+      total_lines: entry.total_lines,
+      node_count: uniqueNodes.filter((n) => n.file_path === entry.path).length
+    });
+  }
+  return {
+    schema_version: "1.0",
+    generator: opts.generator,
+    sources_digest: opts.sourcesDigest,
+    files,
+    nodes: uniqueNodes.sort((a, b) => a.file_path.localeCompare(b.file_path) || a.start_line - b.start_line || a.kind.localeCompare(b.kind) || a.name.localeCompare(b.name)),
+    edges: uniqueEdges.sort((a, b) => a.source.localeCompare(b.source) || a.kind.localeCompare(b.kind) || a.target.localeCompare(b.target)),
+    unresolved: unresolved.sort((a, b) => a.file_path.localeCompare(b.file_path) || a.line - b.line || a.name.localeCompare(b.name))
+  };
+}
+function resolveSymbol(rawName, filePath, localSymbols, importBindings, globalSymbols) {
+  const candidates = symbolLookupNames(rawName);
+  for (const name of candidates) {
+    const imported = importBindings.get(name);
+    if (imported?.length === 1)
+      return imported[0];
+  }
+  for (const name of candidates) {
+    const local = localSymbols.get(name);
+    if (local?.length === 1)
+      return local[0];
+  }
+  for (const name of candidates) {
+    const global = (globalSymbols.get(name) ?? []).filter((t) => t.node.file_path !== filePath || t.exported);
+    if (global.length === 1)
+      return global[0];
+  }
+  return void 0;
+}
+function symbolLookupNames(name) {
+  const cleaned = name.replace(/^this\./, "").replace(/^self\./, "");
+  const parts = cleaned.split(".").filter(Boolean);
+  return [.../* @__PURE__ */ new Set([cleaned, parts[parts.length - 1] ?? cleaned])];
+}
+function dedupeBy(items, key) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const item of items) {
+    const k = key(item);
+    if (seen.has(k))
+      continue;
+    seen.add(k);
+    out.push(item);
+  }
+  return out;
+}
+var RESOLUTION_EXTENSIONS;
+var init_builder = __esm({
+  "src/code-graph/builder.ts"() {
+    "use strict";
+    RESOLUTION_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".vue", ".py"];
+  }
+});
+
+// src/code-graph/reader.ts
+import { existsSync as existsSync18, readFileSync as readFileSync17 } from "fs";
+function graphPathFor(mapPath) {
+  const match = mapPath.match(/^(.*?)(?:code-map)(.*)\.ya?ml$/i);
+  if (match)
+    return `${match[1]}code-graph${match[2]}.index.json`;
+  return `${mapPath.replace(/\.ya?ml$/i, "")}.graph.json`;
+}
+function loadCodeGraph(graphPath) {
+  if (!existsSync18(graphPath)) {
+    throw new Error(`${graphPath} is missing; run \`cdd-kit code-map\` first.`);
+  }
+  const raw = JSON.parse(readFileSync17(graphPath, "utf8"));
+  if (!raw || raw.schema_version !== "1.0" || !Array.isArray(raw.nodes) || !Array.isArray(raw.edges)) {
+    throw new Error(`${graphPath} is not a cdd-kit code graph v1 index.`);
+  }
+  return raw;
+}
+var init_reader = __esm({
+  "src/code-graph/reader.ts"() {
+    "use strict";
+  }
+});
+
+// src/code-map/worker-dispatch.ts
+var worker_dispatch_exports = {};
+__export(worker_dispatch_exports, {
+  scanLangWithWorkers: () => scanLangWithWorkers
+});
+import { execFile } from "child_process";
+import { writeFileSync as writeFileSync9, unlinkSync } from "fs";
+import { randomBytes } from "crypto";
+import { join as join19 } from "path";
+import { tmpdir } from "os";
+function chunk(arr, parts) {
+  const size = Math.ceil(arr.length / parts);
+  const out = [];
+  for (let i = 0; i < arr.length; i += size)
+    out.push(arr.slice(i, i + size));
+  return out;
+}
+function scanChunkInChild(cliEntry, lang, files, repoRoot) {
+  return new Promise((resolve2, reject) => {
+    if (!ALLOWED_LANGS.has(lang)) {
+      return reject(new Error(`refusing to spawn worker for unknown lang: ${lang}`));
+    }
+    const listFile = join19(
+      tmpdir(),
+      `cdd-cm-worker-${process.pid}-${randomBytes(12).toString("hex")}.txt`
+    );
+    writeFileSync9(listFile, files.join("\n") + "\n", { encoding: "utf8", mode: 384 });
+    execFile(
+      process.execPath,
+      [cliEntry, "__code-map-scan", "--lang", lang, "--batch-file", listFile, "--repo-root", repoRoot],
+      { encoding: "utf8", timeout: CHILD_TIMEOUT_MS, maxBuffer: 100 * 1024 * 1024, shell: false, windowsHide: true },
+      (err, stdout) => {
+        try {
+          unlinkSync(listFile);
+        } catch {
+        }
+        if (err)
+          return reject(err);
+        try {
+          const parsed = JSON.parse(stdout);
+          resolve2({ entries: parsed.entries ?? [], warnings: parsed.warnings ?? [] });
+        } catch (e) {
+          reject(e);
+        }
+      }
+    );
+  });
+}
+async function scanLangWithWorkers(scanner, lang, files, repoRoot, workers, cliEntry) {
+  if (files.length === 0)
+    return { entries: [], warnings: [] };
+  const chunks = chunk(files, Math.max(1, Math.min(workers, files.length)));
+  try {
+    const results = await Promise.all(
+      chunks.map((c) => scanChunkInChild(cliEntry, lang, c, repoRoot))
+    );
+    return {
+      entries: results.flatMap((r) => r.entries),
+      warnings: results.flatMap((r) => r.warnings)
+    };
+  } catch {
+    return scanInProcess(scanner, files, repoRoot);
+  }
+}
+var CHILD_TIMEOUT_MS, ALLOWED_LANGS;
+var init_worker_dispatch = __esm({
+  "src/code-map/worker-dispatch.ts"() {
+    "use strict";
+    init_orchestrator();
+    CHILD_TIMEOUT_MS = parseInt(process.env["CDD_CODE_MAP_WORKER_TIMEOUT_MS"] ?? "120000", 10);
+    ALLOWED_LANGS = /* @__PURE__ */ new Set(["js", "ts", "vue"]);
+  }
+});
+
+// src/code-map/scanners/common.ts
+import { relative as relative5 } from "path";
+function canonicalRelPath(absolutePath, repoRoot) {
+  const rel = relative5(repoRoot, absolutePath);
+  return rel.replace(/\\/g, "/").normalize("NFC");
+}
+function isAllCapsConst(name) {
+  return name.length >= 2 && /^[A-Z][A-Z0-9_]*$/.test(name);
+}
+function isBinary(content) {
+  const head = content.slice(0, 4096);
+  return head.includes("\0");
+}
+var init_common = __esm({
+  "src/code-map/scanners/common.ts"() {
+    "use strict";
+  }
+});
+
+// src/code-map/scanners/python.ts
+var python_exports = {};
+__export(python_exports, {
+  pythonScanner: () => pythonScanner
+});
+import { spawnSync as spawnSync2 } from "child_process";
+import { writeFileSync as writeFileSync10, unlinkSync as unlinkSync2 } from "fs";
+import { randomBytes as randomBytes2 } from "crypto";
+import { join as join20 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+function detectPython2() {
+  for (const candidate of ["python3", "python"]) {
+    try {
+      const result = spawnSync2(candidate, ["--version"], {
+        encoding: "utf8",
+        timeout: 5e3
+      });
+      if (result.status === 0)
+        return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+var TIMEOUT_MS, BATCH_SIZE, PythonScanner, pythonScanner;
+var init_python = __esm({
+  "src/code-map/scanners/python.ts"() {
+    "use strict";
+    init_paths();
+    init_common();
+    TIMEOUT_MS = parseInt(process.env["CDD_CODE_MAP_TIMEOUT_MS"] ?? "30000", 10);
+    BATCH_SIZE = Math.max(
+      1,
+      parseInt(process.env["CDD_CODE_MAP_BATCH_SIZE"] ?? "400", 10) || 400
+    );
+    PythonScanner = class {
+      extensions = [".py"];
+      _interpreter = void 0;
+      getInterpreter() {
+        if (this._interpreter === void 0) {
+          this._interpreter = detectPython2();
+        }
+        return this._interpreter;
+      }
+      async scan(absolutePath, repoRoot) {
+        const result = await this.scanBatch([absolutePath], repoRoot);
+        return result.entries[0] ?? null;
+      }
+      async scanBatch(absolutePaths, repoRoot) {
+        const interpreter = this.getInterpreter();
+        const entries = [];
+        const warnings = [];
+        if (!interpreter) {
+          const count = absolutePaths.length;
+          warnings.push({
+            path: "",
+            message: `python interpreter not found on PATH; skipping ${count} .py file${count === 1 ? "" : "s"}`
+          });
+          return { entries, warnings };
+        }
+        for (let i = 0; i < absolutePaths.length; i += BATCH_SIZE) {
+          const chunk2 = absolutePaths.slice(i, i + BATCH_SIZE);
+          const result = this.scanChunk(interpreter, chunk2, repoRoot);
+          entries.push(...result.entries);
+          warnings.push(...result.warnings);
+          if (result.abortRemaining) {
+            const remaining = absolutePaths.length - (i + chunk2.length);
+            if (remaining > 0) {
+              warnings.push({
+                path: "",
+                message: `skipping ${remaining} more .py file(s) after fatal interpreter error`
+              });
+            }
+            break;
+          }
+        }
+        return { entries, warnings };
+      }
+      scanChunk(interpreter, absolutePaths, repoRoot) {
+        const entries = [];
+        const warnings = [];
+        const scriptPath = ASSET.codeMapPython;
+        const listFile = join20(tmpdir2(), `cdd-codemap-${process.pid}-${randomBytes2(12).toString("hex")}.txt`);
+        writeFileSync10(listFile, absolutePaths.join("\n") + "\n", { encoding: "utf8", mode: 384 });
+        let stdout = "";
+        let stderr = "";
+        let exitCode = 0;
+        try {
+          const result = spawnSync2(
             interpreter,
             [scriptPath, "--batch-file", listFile, "--repo-root", repoRoot],
             {
@@ -8520,24 +9154,24 @@ var init_python = __esm({
                 path: "",
                 message: `python interpreter not found (ENOENT); skipping ${absolutePaths.length} .py file(s)`
               });
-              return { entries, warnings };
+              return { entries, warnings, abortRemaining: true };
             }
             if (errMsg.includes("ETIMEDOUT") || errMsg.includes("timeout")) {
               warnings.push({
                 path: "",
-                message: `python scanner timed out after ${TIMEOUT_MS}ms; skipping .py files`
+                message: `python scanner timed out after ${TIMEOUT_MS}ms on a batch of ${absolutePaths.length} file(s); skipping this batch (raise CDD_CODE_MAP_TIMEOUT_MS or lower CDD_CODE_MAP_BATCH_SIZE)`
               });
               return { entries, warnings };
             }
             warnings.push({
               path: "",
-              message: `python scanner error: ${errMsg}; skipping .py files`
+              message: `python scanner error: ${errMsg}; skipping this batch of ${absolutePaths.length} .py file(s)`
             });
             return { entries, warnings };
           }
         } finally {
           try {
-            unlinkSync(listFile);
+            unlinkSync2(listFile);
           } catch {
           }
         }
@@ -8546,7 +9180,7 @@ var init_python = __esm({
             path: "",
             message: "python interpreter is < 3.9 (need ast.unparse); skipping .py files"
           });
-          return { entries, warnings };
+          return { entries, warnings, abortRemaining: true };
         }
         for (const line of stdout.split("\n")) {
           const trimmed = line.trim();
@@ -8564,7 +9198,7 @@ var init_python = __esm({
           }
           const r = parsed;
           entries.push({
-            path: canonicalRelPath(join17(repoRoot, r.path), repoRoot),
+            path: canonicalRelPath(join20(repoRoot, r.path), repoRoot),
             total_lines: r.total_lines,
             imports: r.imports ?? [],
             constants: r.constants ?? [],
@@ -8575,14 +9209,20 @@ var init_python = __esm({
                 name: m.name,
                 lines: [m.lines[0], m.lines[1]],
                 async: m.async
-              }))
+              })),
+              extends: c.extends ?? [],
+              implements: c.implements ?? [],
+              exported: c.exported
             })),
             functions: (r.functions ?? []).map((f) => ({
               name: f.name,
               lines: [f.lines[0], f.lines[1]],
               decorators: f.decorators ?? [],
-              async: f.async
-            }))
+              async: f.async,
+              exported: f.exported
+            })),
+            calls: r.calls ?? [],
+            exports: r.exports ?? []
           });
         }
         if (exitCode === 2) {
@@ -8608,7 +9248,7 @@ __export(javascript_exports, {
   parseJsSource: () => parseJsSource,
   parseSourceWithPlugins: () => parseSourceWithPlugins
 });
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync19 } from "fs";
 import { parse } from "@babel/parser";
 function parseSourceWithPlugins(source, plugins) {
   return parse(source, {
@@ -8641,6 +9281,51 @@ function getLineRange(node) {
   const end = node.loc?.end.line ?? start;
   return [start, end];
 }
+function expressionName(node) {
+  if (!node)
+    return null;
+  if (node.type === "Identifier")
+    return node.name;
+  if (node.type === "ThisExpression")
+    return "this";
+  if (node.type === "Super")
+    return "super";
+  if (node.type === "PrivateName")
+    return `#${node.id?.name ?? "private"}`;
+  if (node.type === "StringLiteral")
+    return node.value;
+  if (node.type === "MemberExpression" || node.type === "OptionalMemberExpression") {
+    const object = expressionName(node.object);
+    const prop = node.computed ? expressionName(node.property) : expressionName(node.property);
+    if (object && prop)
+      return `${object}.${prop}`;
+    return prop ?? object;
+  }
+  if (node.type === "CallExpression" || node.type === "OptionalCallExpression")
+    return expressionName(node.callee);
+  if (node.type === "TSExpressionWithTypeArguments")
+    return expressionName(node.expression);
+  return null;
+}
+function collectCalls(node, caller, calls) {
+  if (!node || typeof node !== "object")
+    return;
+  if (node.type === "CallExpression" || node.type === "OptionalCallExpression" || node.type === "NewExpression") {
+    const callee = expressionName(node.callee);
+    if (callee)
+      calls.push({ caller, callee, line: node.loc?.start.line ?? 1 });
+  }
+  for (const value of Object.values(node)) {
+    if (!value)
+      continue;
+    if (Array.isArray(value)) {
+      for (const item of value)
+        collectCalls(item, caller, calls);
+    } else if (typeof value === "object" && "type" in value) {
+      collectCalls(value, caller, calls);
+    }
+  }
+}
 function processImportDeclaration(node) {
   const items = [];
   for (const spec of node.specifiers) {
@@ -8650,7 +9335,8 @@ function processImportDeclaration(node) {
       items.push(`*:${spec.local.name}`);
     } else if (spec.type === "ImportSpecifier") {
       const imported = spec.imported;
-      items.push(imported.type === "Identifier" ? imported.name : spec.local.name);
+      const importedName = imported.type === "Identifier" ? imported.name : imported.value;
+      items.push(spec.local.name !== importedName ? `${importedName}:${spec.local.name}` : importedName);
     }
   }
   return {
@@ -8659,7 +9345,7 @@ function processImportDeclaration(node) {
     line: node.loc?.start.line ?? 1
   };
 }
-function processFunctionDeclaration(node, nameOverride) {
+function processFunctionDeclaration(node, nameOverride, exported = false) {
   const name = nameOverride ?? node.id?.name;
   if (!name)
     return null;
@@ -8667,10 +9353,11 @@ function processFunctionDeclaration(node, nameOverride) {
     name,
     lines: getLineRange(node),
     decorators: [],
-    async: node.async
+    async: node.async,
+    exported
   };
 }
-function processClassDeclaration(node, nameOverride) {
+function processClassDeclaration(node, nameOverride, exported = false) {
   const name = nameOverride ?? node.id?.name;
   if (!name)
     return null;
@@ -8689,17 +9376,20 @@ function processClassDeclaration(node, nameOverride) {
       methods.push({
         name: methodName,
         lines: getLineRange(m),
-        async: m.async
+        async: m.async ?? false
       });
     }
   }
   return {
     name,
     lines: getLineRange(node),
-    methods
+    methods,
+    extends: node.superClass ? [expressionName(node.superClass) ?? "<computed>"] : [],
+    implements: (node.implements ?? []).map((impl) => impl?.expression ? expressionName(impl.expression) : impl?.id?.name).filter(Boolean),
+    exported
   };
 }
-function processVariableDeclaration(node, imports, constants, functions) {
+function processVariableDeclaration(node, imports, constants, functions, calls, exports, exportedFromWrapper = false) {
   for (const decl of node.declarations) {
     if (!decl.id || decl.id.type !== "Identifier")
       continue;
@@ -8714,6 +9404,8 @@ function processVariableDeclaration(node, imports, constants, functions) {
     }
     if (isAllCapsConst(varName) && init2 !== null && init2 !== void 0) {
       constants.push({ name: varName, line: node.loc?.start.line ?? 1 });
+      if (exportedFromWrapper)
+        exports.push({ name: varName, kind: "constant", line: node.loc?.start.line ?? 1 });
       continue;
     }
     if (init2 && (init2.type === "ArrowFunctionExpression" || init2.type === "FunctionExpression")) {
@@ -8721,15 +9413,23 @@ function processVariableDeclaration(node, imports, constants, functions) {
         name: varName,
         lines: getLineRange(node),
         decorators: [],
-        async: init2.async
+        async: init2.async,
+        exported: exportedFromWrapper
       });
+      collectCalls(init2.body, varName, calls);
+      if (exportedFromWrapper)
+        exports.push({ name: varName, kind: "function", line: node.loc?.start.line ?? 1 });
     } else if (init2 && init2.type === "CallExpression" && /^[A-Z]/.test(varName)) {
       functions.push({
         name: varName,
         lines: getLineRange(node),
         decorators: [],
-        async: false
+        async: false,
+        exported: exportedFromWrapper
       });
+      collectCalls(init2, varName, calls);
+      if (exportedFromWrapper)
+        exports.push({ name: varName, kind: "function", line: node.loc?.start.line ?? 1 });
     }
   }
 }
@@ -8781,16 +9481,31 @@ function processStatement(stmt, buckets, extractTsTypes, exportedFromWrapper = f
     processStatement(stmt.declaration, buckets, extractTsTypes, true);
     return;
   }
+  if (stmt.type === "ExportNamedDeclaration" && !stmt.declaration) {
+    for (const spec of stmt.specifiers ?? []) {
+      if (spec.type === "ExportSpecifier") {
+        const exported = spec.exported.type === "Identifier" ? spec.exported.name : spec.exported.value;
+        buckets.exports.push({ name: exported, kind: "unknown", line: stmt.loc?.start.line ?? 1 });
+      }
+    }
+    return;
+  }
   if (stmt.type === "ExportDefaultDeclaration") {
     const decl = stmt.declaration;
     if (decl.type === "FunctionDeclaration") {
-      const fe = processFunctionDeclaration(decl, decl.id?.name ?? "default");
+      const fe = processFunctionDeclaration(decl, decl.id?.name ?? "default", true);
       if (fe)
         buckets.functions.push(fe);
+      if (fe)
+        buckets.exports.push({ name: fe.name, kind: "function", line: fe.lines[0] });
+      if (fe)
+        collectCalls(decl.body, fe.name, buckets.calls);
     } else if (decl.type === "ClassDeclaration") {
-      const ce = processClassDeclaration(decl, decl.id?.name ?? "default");
+      const ce = processClassDeclaration(decl, decl.id?.name ?? "default", true);
       if (ce)
         buckets.classes.push(ce);
+      if (ce)
+        buckets.exports.push({ name: ce.name, kind: "class", line: ce.lines[0] });
     }
     return;
   }
@@ -8799,19 +9514,35 @@ function processStatement(stmt, buckets, extractTsTypes, exportedFromWrapper = f
     return;
   }
   if (stmt.type === "FunctionDeclaration") {
-    const fe = processFunctionDeclaration(stmt);
+    const fe = processFunctionDeclaration(stmt, void 0, exportedFromWrapper);
     if (fe)
       buckets.functions.push(fe);
+    if (fe) {
+      collectCalls(stmt.body, fe.name, buckets.calls);
+      if (exportedFromWrapper)
+        buckets.exports.push({ name: fe.name, kind: "function", line: fe.lines[0] });
+    }
     return;
   }
   if (stmt.type === "ClassDeclaration") {
-    const ce = processClassDeclaration(stmt);
+    const ce = processClassDeclaration(stmt, void 0, exportedFromWrapper);
     if (ce)
       buckets.classes.push(ce);
+    if (ce && exportedFromWrapper)
+      buckets.exports.push({ name: ce.name, kind: "class", line: ce.lines[0] });
+    if (ce) {
+      for (const member of stmt.body.body) {
+        if (member.type === "ClassMethod" || member.type === "ClassPrivateMethod") {
+          const method = ce.methods.find((m) => m.lines[0] === (member.loc?.start.line ?? 0));
+          if (method)
+            collectCalls(member.body, `${ce.name}.${method.name}`, buckets.calls);
+        }
+      }
+    }
     return;
   }
   if (stmt.type === "VariableDeclaration") {
-    processVariableDeclaration(stmt, buckets.imports, buckets.constants, buckets.functions);
+    processVariableDeclaration(stmt, buckets.imports, buckets.constants, buckets.functions, buckets.calls, buckets.exports, exportedFromWrapper);
     return;
   }
   if (extractTsTypes) {
@@ -8820,18 +9551,24 @@ function processStatement(stmt, buckets, extractTsTypes, exportedFromWrapper = f
       const e = processTsInterfaceDeclaration(anyStmt, exportedFromWrapper);
       if (e)
         buckets.interfaces.push(e);
+      if (e && exportedFromWrapper)
+        buckets.exports.push({ name: e.name, kind: "interface", line: e.lines[0] });
       return;
     }
     if (anyStmt.type === "TSTypeAliasDeclaration") {
       const e = processTsTypeAliasDeclaration(anyStmt, exportedFromWrapper);
       if (e)
         buckets.types.push(e);
+      if (e && exportedFromWrapper)
+        buckets.exports.push({ name: e.name, kind: "type", line: e.lines[0] });
       return;
     }
     if (anyStmt.type === "TSEnumDeclaration") {
       const e = processTsEnumDeclaration(anyStmt, exportedFromWrapper);
       if (e)
         buckets.enums.push(e);
+      if (e && exportedFromWrapper)
+        buckets.exports.push({ name: e.name, kind: "enum", line: e.lines[0] });
       return;
     }
   }
@@ -8859,7 +9596,9 @@ function parseAndExtract(source, opts) {
     classes: [],
     interfaces: [],
     types: [],
-    enums: []
+    enums: [],
+    calls: [],
+    exports: []
   };
   for (const stmt of ast.program.body) {
     processStatement(stmt, buckets, !!opts.extractTsTypes);
@@ -8882,7 +9621,9 @@ function parseJsSource(source, relPath) {
     imports: r.imports,
     constants: r.constants,
     classes: r.classes,
-    functions: r.functions
+    functions: r.functions,
+    calls: r.calls,
+    exports: r.exports
   };
 }
 var COMMON_PLUGINS, JS_PLUGINS, JavaScriptScanner, jsScanner;
@@ -8910,7 +9651,7 @@ var init_javascript = __esm({
       async scan(absolutePath, repoRoot) {
         let source;
         try {
-          source = readFileSync15(absolutePath, "utf8");
+          source = readFileSync19(absolutePath, "utf8");
         } catch (err) {
           throw err;
         }
@@ -8930,7 +9671,7 @@ var typescript_exports = {};
 __export(typescript_exports, {
   tsScanner: () => tsScanner
 });
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 var TypeScriptScanner, tsScanner;
 var init_typescript = __esm({
   "src/code-map/scanners/typescript.ts"() {
@@ -8942,7 +9683,7 @@ var init_typescript = __esm({
       async scan(absolutePath, repoRoot) {
         let source;
         try {
-          source = readFileSync16(absolutePath, "utf8");
+          source = readFileSync20(absolutePath, "utf8");
         } catch (err) {
           throw err;
         }
@@ -8963,6 +9704,8 @@ var init_typescript = __esm({
           constants: r.constants,
           classes: r.classes,
           functions: r.functions,
+          calls: r.calls,
+          exports: r.exports,
           interfaces: r.interfaces,
           types: r.types,
           enums: r.enums
@@ -8978,7 +9721,7 @@ var vue_exports = {};
 __export(vue_exports, {
   vueScanner: () => vueScanner
 });
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 import { parse as parse2 } from "@vue/compiler-sfc";
 var VueScanner, vueScanner;
 var init_vue = __esm({
@@ -8991,7 +9734,7 @@ var init_vue = __esm({
       async scan(absolutePath, repoRoot) {
         let source;
         try {
-          source = readFileSync17(absolutePath, "utf8");
+          source = readFileSync21(absolutePath, "utf8");
         } catch (err) {
           throw err;
         }
@@ -9005,6 +9748,8 @@ var init_vue = __esm({
         const allConstants = [];
         const allFunctions = [];
         const allClasses = [];
+        const allCalls = [];
+        const allExports = [];
         const warnings = [];
         const scriptBlocks = [descriptor.script, descriptor.scriptSetup].filter(Boolean);
         if (scriptBlocks.length === 0) {
@@ -9057,6 +9802,12 @@ var init_vue = __esm({
               }))
             });
           }
+          for (const call of scriptEntry.calls ?? []) {
+            allCalls.push({ ...call, line: call.line + offset });
+          }
+          for (const exp of scriptEntry.exports ?? []) {
+            allExports.push({ ...exp, line: exp.line + offset });
+          }
         }
         return {
           path: relPath,
@@ -9064,7 +9815,9 @@ var init_vue = __esm({
           imports: allImports,
           constants: allConstants,
           classes: allClasses,
-          functions: allFunctions
+          functions: allFunctions,
+          calls: allCalls,
+          exports: allExports
         };
       }
     };
@@ -9078,23 +9831,35 @@ __export(code_map_exports, {
   codeMap: () => codeMap,
   computeSourcesDigest: () => computeSourcesDigest
 });
-import { existsSync as existsSync15, mkdirSync as mkdirSync8, readFileSync as readFileSync18, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync8, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "fs";
 import { resolve, dirname as dirname5, relative as relative6 } from "path";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { createRequire } from "module";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { join as join18 } from "path";
+import { join as join21 } from "path";
 function computeSourcesDigest(absolutePaths, cwd) {
   const lines = absolutePaths.slice().sort().map((p) => {
     const rel = relative6(cwd, p).replace(/\\/g, "/");
     const contentHash = sha256OfFileNormalized(p) || "missing";
     return `${rel}:${contentHash}`;
   });
-  return createHash5("sha256").update(lines.join("\n")).digest("hex");
+  return createHash6("sha256").update(lines.join("\n")).digest("hex");
+}
+function slugifySurface(surface) {
+  return surface.replace(/^[./]+/, "").replace(/\/+$/, "").replace(/[\\/]+/g, "-") || "root";
 }
 async function codeMap(opts) {
-  const root = resolve(process.cwd(), opts.path);
   const start = Date.now();
+  if (opts.surface) {
+    const resolvedSurface = resolve(process.cwd(), opts.surface);
+    if (!existsSync19(resolvedSurface)) {
+      log.error(`code-map --surface path not found: ${opts.surface}`);
+      return 1;
+    }
+  }
+  const scanPath = opts.surface ?? opts.path;
+  const root = resolve(process.cwd(), scanPath);
+  const out = opts.out ?? (opts.surface ? `.cdd/code-map.${slugifySurface(opts.surface)}.yml` : ".cdd/code-map.yml");
   let cfg;
   try {
     cfg = loadCodeMapConfig(root);
@@ -9107,6 +9872,15 @@ async function codeMap(opts) {
   const files = walkRepo(root, { include, exclude });
   const buckets = bucketByExtension(files);
   const result = { entries: [], warnings: [] };
+  const cliEntry = process.argv[1];
+  const workers = opts.workers ?? 0;
+  const useWorkers = workers > 1 && typeof cliEntry === "string" && cliEntry.length > 0;
+  const dispatch = async (scanner, lang, langFiles) => {
+    if (!useWorkers)
+      return scanInProcess(scanner, langFiles, root);
+    const { scanLangWithWorkers: scanLangWithWorkers2 } = await Promise.resolve().then(() => (init_worker_dispatch(), worker_dispatch_exports));
+    return scanLangWithWorkers2(scanner, lang, langFiles, root, workers, cliEntry);
+  };
   const tasks = [];
   if (buckets[".py"]?.length) {
     const { pythonScanner: pythonScanner2 } = await Promise.resolve().then(() => (init_python(), python_exports));
@@ -9122,7 +9896,7 @@ async function codeMap(opts) {
   ];
   if (jsFiles.length) {
     const { jsScanner: jsScanner2 } = await Promise.resolve().then(() => (init_javascript(), javascript_exports));
-    tasks.push(scanInProcess(jsScanner2, jsFiles, root));
+    tasks.push(dispatch(jsScanner2, "js", jsFiles));
   }
   const tsFiles = [
     ...buckets[".ts"] ?? [],
@@ -9130,11 +9904,11 @@ async function codeMap(opts) {
   ];
   if (tsFiles.length) {
     const { tsScanner: tsScanner2 } = await Promise.resolve().then(() => (init_typescript(), typescript_exports));
-    tasks.push(scanInProcess(tsScanner2, tsFiles, root));
+    tasks.push(dispatch(tsScanner2, "ts", tsFiles));
   }
   if (buckets[".vue"]?.length) {
     const { vueScanner: vueScanner2 } = await Promise.resolve().then(() => (init_vue(), vue_exports));
-    tasks.push(scanInProcess(vueScanner2, buckets[".vue"], root));
+    tasks.push(dispatch(vueScanner2, "vue", buckets[".vue"]));
   }
   for (const r of await Promise.all(tasks)) {
     result.entries.push(...r.entries);
@@ -9157,25 +9931,44 @@ async function codeMap(opts) {
   const totalSrc = result.entries.reduce((s, e) => s + e.total_lines, 0);
   const mapLines = yamlBody.split("\n").length;
   const compression = totalSrc === 0 ? 0 : totalSrc / mapLines;
-  const summaryLine = `scanned ${result.entries.length} files, ${totalSrc} src lines -> ${opts.out} (${mapLines} lines, compression ${compression.toFixed(1)}x)`;
+  const summaryLine = `scanned ${result.entries.length} files, ${totalSrc} src lines -> ${out} (${mapLines} lines, compression ${compression.toFixed(1)}x)`;
   for (const w of result.warnings) {
     if (!opts.silent)
       log.warn(`${w.path}: ${w.message}`);
   }
   if (opts.check) {
-    const existing = existsSync15(opts.out) ? readFileSync18(opts.out, "utf8") : "";
+    const existing = existsSync19(out) ? readFileSync22(out, "utf8") : "";
     const normalize = (s) => s.replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/^# generated: [^\n]+\n/m, "# generated: <normalized>\n");
     if (normalize(existing) !== normalize(yamlBody)) {
       if (!opts.silent)
-        log.error(`code-map out of date: ${opts.out} would change. Run \`cdd-kit code-map\` to regenerate.`);
+        log.error(`code-map out of date: ${out} would change. Run \`cdd-kit code-map\` to regenerate.`);
       return 1;
     }
     if (!opts.silent)
-      log.ok(`code-map up to date: ${opts.out}`);
+      log.ok(`code-map up to date: ${out}`);
     return 0;
   }
-  mkdirSync8(dirname5(opts.out), { recursive: true });
-  writeFileSync9(opts.out, yamlBody, "utf8");
+  mkdirSync8(dirname5(out), { recursive: true });
+  writeFileSync11(out, yamlBody, "utf8");
+  try {
+    const sidecarPath = sidecarPathFor(out);
+    writeFileSync11(sidecarPath, JSON.stringify({ sourcesDigest, entries: result.entries }), "utf8");
+    const rel = relative6(process.cwd(), sidecarPath).replace(/\\/g, "/");
+    if (!rel.startsWith("..")) {
+      ensureGitignoreEntry(process.cwd(), rel, "cdd-kit local cache (do not commit)");
+    }
+    const graphPath = graphPathFor(out);
+    const graph2 = buildCodeGraph(result.entries, {
+      generator: `cdd-kit ${_pkg.version}`,
+      sourcesDigest
+    });
+    writeFileSync11(graphPath, JSON.stringify(graph2, null, 2) + "\n", "utf8");
+    const graphRel = relative6(process.cwd(), graphPath).replace(/\\/g, "/");
+    if (!graphRel.startsWith("..")) {
+      ensureGitignoreEntry(process.cwd(), graphRel, "cdd-kit local cache (do not commit)");
+    }
+  } catch {
+  }
   if (!opts.silent)
     log.ok(`${summaryLine} (${Date.now() - start}ms)`);
   return 0;
@@ -9188,10 +9981,14 @@ var init_code_map = __esm({
     init_yaml_writer();
     init_orchestrator();
     init_config();
+    init_index_reader();
+    init_builder();
+    init_reader();
     init_digest();
+    init_gitignore();
     _require = createRequire(import.meta.url);
-    _pkgPath = join18(fileURLToPath2(import.meta.url), "..", "..", "..", "package.json");
-    _pkg = JSON.parse(readFileSync18(_pkgPath, "utf8"));
+    _pkgPath = join21(fileURLToPath2(import.meta.url), "..", "..", "..", "package.json");
+    _pkg = JSON.parse(readFileSync22(_pkgPath, "utf8"));
   }
 });
 
@@ -9200,15 +9997,15 @@ var refresh_exports = {};
 __export(refresh_exports, {
   refresh: () => refresh
 });
-import { existsSync as existsSync16, mkdirSync as mkdirSync9, readdirSync as readdirSync10, copyFileSync as copyFileSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname6, join as join19, relative as relative7 } from "path";
-import { createHash as createHash6 } from "crypto";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readdirSync as readdirSync10, copyFileSync as copyFileSync4, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname6, join as join22, relative as relative7 } from "path";
+import { createHash as createHash7 } from "crypto";
 function fileHash2(filePath) {
-  return createHash6("sha256").update(readFileSync19(filePath)).digest("hex");
+  return createHash7("sha256").update(readFileSync23(filePath)).digest("hex");
 }
 function planForceRefresh(srcDir, destDir, sectionLabel) {
   const plan = [];
-  if (!existsSync16(srcDir))
+  if (!existsSync20(srcDir))
     return plan;
   function walk(curSrc, curDest) {
     let items;
@@ -9218,16 +10015,16 @@ function planForceRefresh(srcDir, destDir, sectionLabel) {
       return;
     }
     for (const item of items) {
-      const sp = join19(curSrc, item.name);
-      const dp = join19(curDest, item.name);
+      const sp = join22(curSrc, item.name);
+      const dp = join22(curDest, item.name);
       if (item.isDirectory()) {
         walk(sp, dp);
         continue;
       }
       if (!item.isFile())
         continue;
-      const rel = join19(sectionLabel, relative7(srcDir, sp)).replace(/\\/g, "/");
-      if (!existsSync16(dp)) {
+      const rel = join22(sectionLabel, relative7(srcDir, sp)).replace(/\\/g, "/");
+      if (!existsSync20(dp)) {
         plan.push({ src: sp, dest: dp, rel, action: "add" });
       } else if (fileHash2(sp) !== fileHash2(dp)) {
         plan.push({ src: sp, dest: dp, rel, action: "overwrite" });
@@ -9240,35 +10037,14 @@ function planForceRefresh(srcDir, destDir, sectionLabel) {
   return plan;
 }
 function planSingleFile(src, dest, rel) {
-  if (!existsSync16(src))
+  if (!existsSync20(src))
     return null;
-  if (!existsSync16(dest))
+  if (!existsSync20(dest))
     return { src, dest, rel, action: "add" };
   if (fileHash2(src) !== fileHash2(dest))
     return { src, dest, rel, action: "overwrite" };
   return { src, dest, rel, action: "skip" };
 }
-function ensureGitignoreEntry2(cwd, entry) {
-  const path = join19(cwd, ".gitignore");
-  const trimmed = entry.trim();
-  if (!trimmed)
-    return false;
-  const re = new RegExp(`^\\s*${trimmed.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\\s*$`, "m");
-  let existing = "";
-  if (existsSync16(path))
-    existing = readFileSync19(path, "utf8");
-  if (re.test(existing))
-    return false;
-  const sep = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-  const block = existing.length === 0 ? `# cdd-kit generated backups (do not commit)
-${trimmed}
-` : `${sep}
-# cdd-kit generated backups (do not commit)
-${trimmed}
-`;
-  writeFileSync10(path, existing + block, "utf8");
-  return true;
-}
 function applyPlan(plan, backupRoot) {
   let added = 0;
   let overwritten = 0;
@@ -9276,7 +10052,7 @@ function applyPlan(plan, backupRoot) {
     if (item.action === "skip")
       continue;
     if (item.action === "overwrite") {
-      const backupPath = join19(backupRoot, item.rel);
+      const backupPath = join22(backupRoot, item.rel);
       mkdirSync9(dirname6(backupPath), { recursive: true });
       copyFileSync4(item.dest, backupPath);
       overwritten += 1;
@@ -9305,14 +10081,14 @@ function parseAgentFrontmatter(content) {
   return fm;
 }
 function resyncModelPolicy(cwd) {
-  const policyPath = join19(cwd, ".cdd", "model-policy.json");
+  const policyPath = join22(cwd, ".cdd", "model-policy.json");
   const result = { changed: false, diff: [], policyPath };
-  if (!existsSync16(AGENTS_HOME))
+  if (!existsSync20(AGENTS_HOME))
     return result;
   const desired = {};
   const agentFiles = readdirSync10(AGENTS_HOME, { withFileTypes: true }).filter((d) => d.isFile() && d.name.endsWith(".md"));
   for (const f of agentFiles) {
-    const content = readFileSync19(join19(AGENTS_HOME, f.name), "utf8");
+    const content = readFileSync23(join22(AGENTS_HOME, f.name), "utf8");
     const fm = parseAgentFrontmatter(content);
     if (fm.name && fm.model)
       desired[fm.name] = fm.model;
@@ -9320,9 +10096,9 @@ function resyncModelPolicy(cwd) {
   if (Object.keys(desired).length === 0)
     return result;
   let existing = {};
-  if (existsSync16(policyPath)) {
+  if (existsSync20(policyPath)) {
     try {
-      existing = JSON.parse(readFileSync19(policyPath, "utf8"));
+      existing = JSON.parse(readFileSync23(policyPath, "utf8"));
     } catch {
     }
   }
@@ -9343,7 +10119,7 @@ function resyncModelPolicy(cwd) {
   if (!("provider" in merged))
     merged["provider"] = "claude";
   mkdirSync9(dirname6(policyPath), { recursive: true });
-  writeFileSync10(policyPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
+  writeFileSync12(policyPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
   result.changed = true;
   return result;
 }
@@ -9351,21 +10127,21 @@ function planTemplateRefresh(cwd) {
   const sections = [];
   sections.push({
     name: "specs/templates",
-    plan: planForceRefresh(ASSET.specsTemplates, join19(cwd, "specs", "templates"), "specs/templates")
+    plan: planForceRefresh(ASSET.specsTemplates, join22(cwd, "specs", "templates"), "specs/templates")
   });
   sections.push({
     name: "tests/templates",
-    plan: planForceRefresh(ASSET.testsTemplates, join19(cwd, "tests", "templates"), "tests/templates")
+    plan: planForceRefresh(ASSET.testsTemplates, join22(cwd, "tests", "templates"), "tests/templates")
   });
-  const ciTemplatesAsset = join19(ASSET.ci, "..", "ci-templates");
-  if (existsSync16(ciTemplatesAsset)) {
+  const ciTemplatesAsset = join22(ASSET.ci, "..", "ci-templates");
+  if (existsSync20(ciTemplatesAsset)) {
     sections.push({
       name: "ci-templates",
-      plan: planForceRefresh(ciTemplatesAsset, join19(cwd, "ci-templates"), "ci-templates")
+      plan: planForceRefresh(ciTemplatesAsset, join22(cwd, "ci-templates"), "ci-templates")
     });
   }
-  const wfAsset = join19(ASSET.githubWorkflows, "contract-driven-gates.yml");
-  const wfDest = join19(cwd, ".github", "workflows", "contract-driven-gates.yml");
+  const wfAsset = join22(ASSET.githubWorkflows, "contract-driven-gates.yml");
+  const wfDest = join22(cwd, ".github", "workflows", "contract-driven-gates.yml");
   const wfPlan = planSingleFile(wfAsset, wfDest, ".github/workflows/contract-driven-gates.yml");
   if (wfPlan)
     sections.push({ name: ".github/workflows/contract-driven-gates.yml", plan: [wfPlan] });
@@ -9420,14 +10196,14 @@ async function refresh(opts) {
       }
       if (apply) {
         const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        backupRoot = join19(cwd, ".cdd", ".refresh-backup", ts);
+        backupRoot = join22(cwd, ".cdd", ".refresh-backup", ts);
         const result = applyPlan(total, backupRoot);
         templateAdded = result.added;
         templateOverwritten = result.overwritten;
         log.ok(`  applied: +${templateAdded} added, ~${templateOverwritten} overwritten`);
         if (templateOverwritten > 0) {
           log.info(`  backup saved to: ${relative7(cwd, backupRoot).replace(/\\/g, "/")}`);
-          if (ensureGitignoreEntry2(cwd, ".cdd/.refresh-backup/")) {
+          if (ensureGitignoreEntry(cwd, ".cdd/.refresh-backup/")) {
             log.info("  added `.cdd/.refresh-backup/` to .gitignore");
           }
         }
@@ -9440,8 +10216,8 @@ async function refresh(opts) {
   }
   log.blank();
   if (!opts.noHooks) {
-    const markerPath = join19(cwd, HOOKS_MARKER_PATH);
-    if (existsSync16(markerPath)) {
+    const markerPath = join22(cwd, HOOKS_MARKER_PATH);
+    if (existsSync20(markerPath)) {
       log.info("[4/6] re-install code-map pre-commit hook (marker found)");
       if (apply) {
         try {
@@ -9518,6 +10294,7 @@ var init_refresh = __esm({
     "use strict";
     init_paths();
     init_logger();
+    init_gitignore();
     init_update();
     init_upgrade();
     init_code_map();
@@ -9526,76 +10303,195 @@ var init_refresh = __esm({
   }
 });
 
-// src/code-map/freshness.ts
-import { existsSync as existsSync17, readFileSync as readFileSync20, statSync as statSync3 } from "fs";
-import { join as join20 } from "path";
-function checkCodeMapFreshness(cwd, mapRel = ".cdd/code-map.yml", include, exclude) {
-  const mapPath = join20(cwd, mapRel);
-  let cfg;
+// src/commands/lint-agents.ts
+var lint_agents_exports = {};
+__export(lint_agents_exports, {
+  collectAgentViolations: () => collectAgentViolations,
+  lintAgentContent: () => lintAgentContent,
+  lintAgents: () => lintAgents
+});
+import { readdirSync as readdirSync11, readFileSync as readFileSync24 } from "fs";
+import { join as join23 } from "path";
+import { load as yamlLoad2 } from "js-yaml";
+function extractRequiredArtifactsSection(content) {
+  const match = content.match(
+    /### (?:Suggested|Required) artifacts for this agent\s*\n([\s\S]*?)(?=\n#{2,3} |\n---|\s*$)/
+  );
+  return match ? match[0] : null;
+}
+function extractFirstReadScopeSection(content) {
+  const match = content.match(/## Read scope\s*\n([\s\S]*?)(?=\n## |\s*$)/);
+  return match ? match[0] : null;
+}
+function extractYamlBlock(section) {
+  const match = section.match(/```ya?ml\s*\n([\s\S]*?)```/);
+  return match ? match[0] : null;
+}
+function extractYamlBody(section) {
+  const match = section.match(/```ya?ml\s*\n([\s\S]*?)```/);
+  return match ? match[1] : null;
+}
+function strayTopLevelKeys(yamlBody) {
+  let parsed;
   try {
-    cfg = loadCodeMapConfig(cwd);
-  } catch (err) {
-    return {
-      status: "config-error",
-      staleFiles: [],
-      staleCount: 0,
-      mapPath,
-      configError: err.message
-    };
+    parsed = yamlLoad2(yamlBody);
+  } catch {
+    return null;
   }
-  const includeFinal = [...cfg.include, ...include ?? []];
-  const excludeFinal = [...cfg.exclude, ...exclude ?? []];
-  const sourceFiles = walkRepo(cwd, { include: includeFinal, exclude: excludeFinal });
-  if (!existsSync17(mapPath)) {
-    if (sourceFiles.length === 0) {
-      return { status: "missing-greenfield", staleFiles: [], staleCount: 0, mapPath };
-    }
-    return { status: "missing-with-sources", staleFiles: [], staleCount: 0, mapPath };
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
   }
-  const mapMtime = statSync3(mapPath).mtimeMs;
-  const staleAll = [];
-  for (const absPath of sourceFiles) {
-    try {
-      const mtime = statSync3(absPath).mtimeMs;
-      if (mtime > mapMtime) {
-        const rel = absPath.replace(/\\/g, "/").replace(cwd.replace(/\\/g, "/") + "/", "");
-        staleAll.push(rel);
+  const keys = Object.keys(parsed);
+  return keys.filter((k) => k !== "artifacts");
+}
+function hasFlatBacktickKeysWithoutFence(section) {
+  if (/```ya?ml\s*\nartifacts:/.test(section))
+    return false;
+  const withoutFence = section.replace(/```ya?ml[\s\S]*?```/g, "");
+  return /^- `[a-z][a-z0-9-]+`:/m.test(withoutFence);
+}
+function lintAgentContent(filename, rawContent, opts = {}) {
+  const violations = [];
+  let content = rawContent;
+  if (content.charCodeAt(0) === 65279) {
+    violations.push({
+      file: filename,
+      rule: "Meta",
+      message: "file starts with UTF-8 BOM (U+FEFF); frontmatter parsers may treat the first key as invalid",
+      level: "error"
+    });
+    content = content.slice(1);
+  }
+  const artifactsSection = extractRequiredArtifactsSection(content);
+  if (!artifactsSection) {
+    violations.push({
+      file: filename,
+      rule: "A",
+      message: "missing ### Suggested artifacts for this agent section",
+      level: "error"
+    });
+  } else {
+    const yamlBlock = extractYamlBlock(artifactsSection);
+    if (!yamlBlock || !/```ya?ml\s*\nartifacts:/.test(yamlBlock)) {
+      violations.push({
+        file: filename,
+        rule: "A",
+        message: 'bad Suggested-artifacts format: missing fenced yaml block starting with "artifacts:"',
+        level: "error"
+      });
+    } else if (!yamlBlock.includes("{ type:") && !/- \{/.test(yamlBlock)) {
+      violations.push({
+        file: filename,
+        rule: "A",
+        message: "bad Suggested-artifacts format: YAML block has no { type: ..., pointer: ... } items",
+        level: "error"
+      });
+    } else {
+      const yamlBody = extractYamlBody(artifactsSection);
+      if (yamlBody) {
+        const stray = strayTopLevelKeys(yamlBody);
+        if (stray && stray.length > 0) {
+          violations.push({
+            file: filename,
+            rule: "A",
+            message: `bad Suggested-artifacts format: stray top-level key(s) alongside artifacts: [${stray.join(", ")}] -- these are item keys, not log keys`,
+            level: "error"
+          });
+        }
       }
-    } catch {
+    }
+    if (hasFlatBacktickKeysWithoutFence(artifactsSection)) {
+      violations.push({
+        file: filename,
+        rule: "A",
+        message: "bad Suggested-artifacts format: flat backtick-keyed lines found outside YAML fence (remove old `key: value` bullet style)",
+        level: "error"
+      });
     }
   }
-  if (staleAll.length === 0) {
-    return { status: "ok", staleFiles: [], staleCount: 0, mapPath };
+  const readScopeCount = (content.match(/^## Read scope\s*$/gm) ?? []).length;
+  if (readScopeCount > 1) {
+    violations.push({
+      file: filename,
+      rule: "B",
+      message: `duplicate ## Read scope headings found (${readScopeCount} occurrences -- remove all but the first)`,
+      level: "error"
+    });
   }
-  const declaredDigest = readSourcesDigest(mapPath);
-  if (declaredDigest !== null) {
-    const actualDigest = computeSourcesDigest(sourceFiles, cwd);
-    if (actualDigest === declaredDigest) {
-      return { status: "ok", staleFiles: [], staleCount: 0, mapPath };
+  if (readScopeCount >= 1) {
+    const readScopeSection = extractFirstReadScopeSection(content);
+    if (readScopeSection && !readScopeSection.includes("context-manifest.md")) {
+      violations.push({
+        file: filename,
+        rule: "C",
+        message: "## Read scope section does not reference context-manifest.md",
+        level: "error"
+      });
     }
   }
-  return {
-    status: "stale",
-    staleFiles: staleAll.slice(0, 5),
-    staleCount: staleAll.length,
-    mapPath
-  };
+  if (!content.includes("references/agent-log-protocol.md")) {
+    violations.push({
+      file: filename,
+      rule: "D",
+      message: "missing reference to references/agent-log-protocol.md",
+      level: opts.strict ? "error" : "warning"
+    });
+  }
+  return violations;
 }
-function readSourcesDigest(mapPath) {
+function collectAgentViolations(cwd, opts = {}) {
+  const agentsDir = join23(cwd, ".claude", "agents");
+  let files;
   try {
-    const head = readFileSync20(mapPath, "utf8").slice(0, 2048);
-    const m = head.match(/^# sources-digest:\s*([a-f0-9]+)/m);
-    return m ? m[1] : null;
+    files = readdirSync11(agentsDir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return null;
   }
+  const violations = [];
+  for (const filename of files) {
+    let content;
+    try {
+      content = readFileSync24(join23(agentsDir, filename), "utf8");
+    } catch {
+      violations.push({
+        file: filename,
+        rule: "A",
+        message: "cannot read file",
+        level: "error"
+      });
+      continue;
+    }
+    violations.push(...lintAgentContent(filename, content, opts));
+  }
+  return violations;
 }
-var init_freshness = __esm({
-  "src/code-map/freshness.ts"() {
+async function lintAgents(opts) {
+  const cwd = process.cwd();
+  const violations = collectAgentViolations(cwd, opts);
+  if (violations === null) {
+    log.error(
+      `lint-agents: cannot read ${join23(cwd, ".claude", "agents")} -- is this a cdd-kit project?`
+    );
+    return 1;
+  }
+  for (const v of violations) {
+    const prefix = v.level === "error" ? "error" : "warning";
+    process.stderr.write(`${v.file}: [Rule ${v.rule}] ${prefix} -- ${v.message}
+`);
+  }
+  const errorCount = violations.filter((v) => v.level === "error").length;
+  const warnCount = violations.filter((v) => v.level === "warning").length;
+  console.log(`lint-agents: ${errorCount} error(s), ${warnCount} warning(s)`);
+  if (errorCount > 0)
+    return 1;
+  if (opts.strict && warnCount > 0)
+    return 1;
+  return 0;
+}
+var init_lint_agents = __esm({
+  "src/commands/lint-agents.ts"() {
     "use strict";
-    init_include_exclude();
-    init_config();
-    init_code_map();
+    init_logger();
   }
 });
 
@@ -9604,17 +10500,17 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctor: () => doctor
 });
-import { existsSync as existsSync18, readdirSync as readdirSync11, readFileSync as readFileSync21 } from "fs";
-import { createHash as createHash7 } from "crypto";
-import { join as join21, relative as relative8 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync12, readFileSync as readFileSync25 } from "fs";
+import { createHash as createHash8 } from "crypto";
+import { join as join24, relative as relative8 } from "path";
 function fileExists(cwd, relPath) {
-  return existsSync18(join21(cwd, relPath));
+  return existsSync21(join24(cwd, relPath));
 }
 function findFiles(dir, predicate, found = []) {
-  if (!existsSync18(dir))
+  if (!existsSync21(dir))
     return found;
-  for (const entry of readdirSync11(dir, { withFileTypes: true })) {
-    const fullPath = join21(dir, entry.name);
+  for (const entry of readdirSync12(dir, { withFileTypes: true })) {
+    const fullPath = join24(dir, entry.name);
     if (entry.isDirectory())
       findFiles(fullPath, predicate, found);
     else if (entry.isFile() && predicate(entry.name))
@@ -9627,12 +10523,12 @@ function inputDigest(paths, cwd) {
     const rel = relative8(cwd, p).replace(/\\/g, "/");
     return `${rel}:${sha256OfFileNormalized(p)}`;
   }).join("\n");
-  return createHash7("sha256").update(combined).digest("hex");
+  return createHash8("sha256").update(combined).digest("hex");
 }
 function readContextIndexMetadata(filePath) {
-  if (!existsSync18(filePath))
+  if (!existsSync21(filePath))
     return {};
-  const text = readFileSync21(filePath, "utf8");
+  const text = readFileSync25(filePath, "utf8");
   const out = {};
   const digestMatch = text.match(/^inputs-digest:\s*([a-f0-9]+)/m);
   if (digestMatch)
@@ -9644,14 +10540,14 @@ function readContextIndexMetadata(filePath) {
 }
 function checkContextFreshness(cwd) {
   const findings = [];
-  const projectMap = join21(cwd, "specs", "context", "project-map.md");
-  const contractsIndex = join21(cwd, "specs", "context", "contracts-index.md");
-  const contextPolicy = join21(cwd, ".cdd", "context-policy.json");
+  const projectMap = join24(cwd, "specs", "context", "project-map.md");
+  const contractsIndex = join24(cwd, "specs", "context", "contracts-index.md");
+  const contextPolicy = join24(cwd, ".cdd", "context-policy.json");
   const contractFiles = findFiles(
-    join21(cwd, "contracts"),
+    join24(cwd, "contracts"),
     (name) => name.endsWith(".md") && name !== "INDEX.md" && name !== "CHANGELOG.md"
   );
-  if (!existsSync18(projectMap) || !existsSync18(contractsIndex)) {
+  if (!existsSync21(projectMap) || !existsSync21(contractsIndex)) {
     findings.push({
       level: "warning",
       message: "specs/context indexes are missing; run cdd-kit context-scan before classification"
@@ -9660,7 +10556,7 @@ function checkContextFreshness(cwd) {
   }
   const projectMapMeta = readContextIndexMetadata(projectMap);
   const contractsIndexMeta = readContextIndexMetadata(contractsIndex);
-  const projectInputDigest = inputDigest([contextPolicy].filter(existsSync18), cwd);
+  const projectInputDigest = inputDigest([contextPolicy].filter(existsSync21), cwd);
   if (projectMapMeta.inputsDigest === void 0) {
     findings.push({
       level: "warning",
@@ -9697,7 +10593,7 @@ function checkContextFreshness(cwd) {
 }
 function readAgentModel(path) {
   try {
-    const text = readFileSync21(path, "utf8");
+    const text = readFileSync25(path, "utf8");
     const m = text.match(/^model:\s*(\S+)/m);
     return m ? m[1] : null;
   } catch {
@@ -9705,12 +10601,12 @@ function readAgentModel(path) {
   }
 }
 function checkModelPolicyDrift(cwd) {
-  const policyPath = join21(cwd, ".cdd", "model-policy.json");
-  if (!existsSync18(policyPath))
+  const policyPath = join24(cwd, ".cdd", "model-policy.json");
+  if (!existsSync21(policyPath))
     return [];
   let policy;
   try {
-    policy = JSON.parse(readFileSync21(policyPath, "utf8"));
+    policy = JSON.parse(readFileSync25(policyPath, "utf8"));
   } catch {
     return [{ level: "warning", message: ".cdd/model-policy.json is not valid JSON" }];
   }
@@ -9722,18 +10618,18 @@ function checkModelPolicyDrift(cwd) {
     }];
   }
   const candidateDirs = [
-    join21(cwd, ".claude", "agents"),
-    process.env.HOME ? join21(process.env.HOME, ".claude", "agents") : "",
-    process.env.USERPROFILE ? join21(process.env.USERPROFILE, ".claude", "agents") : ""
-  ].filter((p) => p && existsSync18(p));
+    join24(cwd, ".claude", "agents"),
+    process.env.HOME ? join24(process.env.HOME, ".claude", "agents") : "",
+    process.env.USERPROFILE ? join24(process.env.USERPROFILE, ".claude", "agents") : ""
+  ].filter((p) => p && existsSync21(p));
   if (candidateDirs.length === 0)
     return [];
   const findings = [];
   for (const [role, expected] of Object.entries(roles)) {
     let foundAny = false;
     for (const dir of candidateDirs) {
-      const path = join21(dir, `${role}.md`);
-      if (!existsSync18(path))
+      const path = join24(dir, `${role}.md`);
+      if (!existsSync21(path))
         continue;
       foundAny = true;
       const actual = readAgentModel(path);
@@ -9752,47 +10648,30 @@ function checkModelPolicyDrift(cwd) {
   }
   return findings;
 }
-async function checkAgentLint(cwd) {
-  const agentsDir = join21(cwd, ".claude", "agents");
-  if (!existsSync18(agentsDir))
-    return [];
-  try {
-    const { readdirSync: rds, readFileSync: rfs } = await import("fs");
-    const files = rds(agentsDir).filter((f) => f.endsWith(".md"));
-    if (files.length === 0)
-      return [];
-    const findings = [];
-    for (const filename of files) {
-      const content = rfs(join21(agentsDir, filename), "utf8");
-      const artifactsSection = content.match(
-        /### Required artifacts for this agent\s*\n[\s\S]*?(?=\n#{2,3} |\n---|\s*$)/
-      )?.[0];
-      if (!artifactsSection || !/```ya?ml\s*\nartifacts:/.test(artifactsSection)) {
-        findings.push({
-          level: "warning",
-          message: `lint-agents: ${filename}: missing artifacts YAML block in Required artifacts section`
-        });
-      }
-      const readScopeCount = (content.match(/^## Read scope\s*$/gm) ?? []).length;
-      if (readScopeCount > 1) {
-        findings.push({
-          level: "warning",
-          message: `lint-agents: ${filename}: duplicate ## Read scope headings (${readScopeCount})`
-        });
-      }
-    }
-    if (findings.length === 0) {
-      findings.push({ level: "ok", message: "lint-agents: all agent prompts pass shape checks" });
-    }
-    return findings;
-  } catch {
+function checkAgentLint(cwd) {
+  const agentsDir = join24(cwd, ".claude", "agents");
+  if (!existsSync21(agentsDir))
     return [];
+  const violations = collectAgentViolations(cwd);
+  if (violations === null) {
+    return [{
+      level: "warning",
+      message: `lint-agents: could not read ${join24(".claude", "agents")} -- agent prompts were not scanned`
+    }];
+  }
+  const findings = violations.map((v) => ({
+    level: "warning",
+    message: `lint-agents: ${v.file}: [Rule ${v.rule}] ${v.message}`
+  }));
+  if (findings.length === 0) {
+    findings.push({ level: "ok", message: "lint-agents: all agent prompts pass shape checks" });
   }
+  return findings;
 }
 function checkCodeMap(cwd) {
   const findings = [];
-  const mapPath = join21(cwd, ".cdd", "code-map.yml");
-  if (!existsSync18(mapPath)) {
+  const mapPath = join24(cwd, ".cdd", "code-map.yml");
+  if (!existsSync21(mapPath)) {
     const probe2 = checkCodeMapFreshness(cwd);
     if (probe2.status === "config-error") {
       findings.push({ level: "warning", message: `.cdd/code-map-config.yml is invalid: ${probe2.configError}` });
@@ -9811,7 +10690,7 @@ function checkCodeMap(cwd) {
     const more = probe.staleCount > 3 ? ` (+${probe.staleCount - 3} more)` : "";
     findings.push({ level: "warning", message: `code-map stale: ${top}${more}; run \`cdd-kit code-map\`` });
   }
-  const text = readFileSync21(mapPath, "utf8");
+  const text = readFileSync25(mapPath, "utf8");
   const m = text.match(/^# files: (\d+), src-lines: (\d+), map-lines: (\d+), compression: ([\d.]+)x/m);
   if (m) {
     findings.push({ level: "ok", message: `code-map: ${m[1]} files, ${m[4]}x compression` });
@@ -9843,7 +10722,7 @@ async function buildDoctorReport(cwd, opts) {
   }
   findings.push(...checkContextFreshness(cwd));
   findings.push(...checkModelPolicyDrift(cwd));
-  findings.push(...await checkAgentLint(cwd));
+  findings.push(...checkAgentLint(cwd));
   findings.push(...checkCodeMap(cwd));
   const errors = findings.filter((finding) => finding.level === "error").length;
   const warnings = findings.filter((finding) => finding.level === "warning").length;
@@ -9887,11 +10766,11 @@ async function attemptAutoFixes(cwd, report) {
       }
     }
     if (/model-policy\.json has no role bindings/i.test(finding.message)) {
-      const policyPath = join21(cwd, ".cdd", "model-policy.json");
+      const policyPath = join24(cwd, ".cdd", "model-policy.json");
       try {
         let existing = {};
         try {
-          existing = JSON.parse(readFileSync21(policyPath, "utf8"));
+          existing = JSON.parse(readFileSync25(policyPath, "utf8"));
         } catch {
         }
         const merged = {
@@ -9902,6 +10781,7 @@ async function attemptAutoFixes(cwd, report) {
             "qa-reviewer": "opus",
             "contract-reviewer": "sonnet",
             "test-strategist": "sonnet",
+            "bug-fix-engineer": "sonnet",
             "backend-engineer": "sonnet",
             "frontend-engineer": "sonnet",
             "ci-cd-gatekeeper": "sonnet",
@@ -9915,8 +10795,8 @@ async function attemptAutoFixes(cwd, report) {
             "repo-context-scanner": "haiku"
           }
         };
-        const { writeFileSync: writeFileSync14 } = await import("fs");
-        writeFileSync14(policyPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
+        const { writeFileSync: writeFileSync16 } = await import("fs");
+        writeFileSync16(policyPath, JSON.stringify(merged, null, 2) + "\n", "utf8");
         fixed.push(`populated .cdd/model-policy.json with default role bindings`);
         continue;
       } catch (err) {
@@ -9956,305 +10836,88 @@ async function doctor(opts = {}) {
       process.exit(1);
     return;
   }
-  log.blank();
-  log.info(`Doctor provider: ${report.provider}`);
-  for (const finding of report.findings) {
-    if (finding.level === "ok")
-      log.ok(finding.message);
-    else if (finding.level === "warning")
-      log.warn(finding.message);
-    else
-      log.error(finding.message);
-  }
-  log.blank();
-  if (!report.ok) {
-    log.error(report.strict && report.errors === 0 ? `doctor failed in strict mode with ${report.warnings} warning(s)` : `doctor failed with ${report.errors} error(s)`);
-    process.exit(1);
-  }
-  if (report.warnings > 0) {
-    log.warn(`doctor completed with ${report.warnings} warning(s)`);
-  } else {
-    log.ok("doctor passed");
-  }
-  log.blank();
-}
-var init_doctor = __esm({
-  "src/commands/doctor.ts"() {
-    "use strict";
-    init_logger();
-    init_provider();
-    init_freshness();
-    init_digest();
-  }
-});
-
-// src/commands/lint-agents.ts
-var lint_agents_exports = {};
-__export(lint_agents_exports, {
-  lintAgents: () => lintAgents
-});
-import { readdirSync as readdirSync12, readFileSync as readFileSync22 } from "fs";
-import { join as join22 } from "path";
-import { load as yamlLoad2 } from "js-yaml";
-function extractRequiredArtifactsSection(content) {
-  const match = content.match(
-    /### (?:Suggested|Required) artifacts for this agent\s*\n([\s\S]*?)(?=\n#{2,3} |\n---|\s*$)/
-  );
-  return match ? match[0] : null;
-}
-function extractFirstReadScopeSection(content) {
-  const match = content.match(/## Read scope\s*\n([\s\S]*?)(?=\n## |\s*$)/);
-  return match ? match[0] : null;
-}
-function extractYamlBlock(section) {
-  const match = section.match(/```ya?ml\s*\n([\s\S]*?)```/);
-  return match ? match[0] : null;
-}
-function extractYamlBody(section) {
-  const match = section.match(/```ya?ml\s*\n([\s\S]*?)```/);
-  return match ? match[1] : null;
-}
-function strayTopLevelKeys(yamlBody) {
-  let parsed;
-  try {
-    parsed = yamlLoad2(yamlBody);
-  } catch {
-    return null;
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return null;
-  }
-  const keys = Object.keys(parsed);
-  return keys.filter((k) => k !== "artifacts");
-}
-function hasFlatBacktickKeysWithoutFence(section) {
-  if (/```ya?ml\s*\nartifacts:/.test(section))
-    return false;
-  const withoutFence = section.replace(/```ya?ml[\s\S]*?```/g, "");
-  return /^- `[a-z][a-z0-9-]+`:/m.test(withoutFence);
-}
-async function lintAgents(opts) {
-  const cwd = process.cwd();
-  const agentsDir = join22(cwd, ".claude", "agents");
-  let files;
-  try {
-    files = readdirSync12(agentsDir).filter((f) => f.endsWith(".md")).sort();
-  } catch {
-    log.error(`lint-agents: cannot read ${agentsDir} ??is this a cdd-kit project?`);
-    return 1;
-  }
-  const violations = [];
-  for (const filename of files) {
-    const filePath = join22(agentsDir, filename);
-    let content;
-    try {
-      content = readFileSync22(filePath, "utf8");
-    } catch {
-      violations.push({
-        file: filename,
-        rule: "A",
-        message: "cannot read file",
-        level: "error"
-      });
-      continue;
-    }
-    if (content.charCodeAt(0) === 65279) {
-      violations.push({
-        file: filename,
-        rule: "Meta",
-        message: "file starts with UTF-8 BOM (U+FEFF); frontmatter parsers may treat the first key as invalid",
-        level: "error"
-      });
-      content = content.slice(1);
-    }
-    const artifactsSection = extractRequiredArtifactsSection(content);
-    if (!artifactsSection) {
-      violations.push({
-        file: filename,
-        rule: "A",
-        message: "missing ### Suggested artifacts for this agent section",
-        level: "error"
-      });
-    } else {
-      const yamlBlock = extractYamlBlock(artifactsSection);
-      if (!yamlBlock || !/```ya?ml\s*\nartifacts:/.test(yamlBlock)) {
-        violations.push({
-          file: filename,
-          rule: "A",
-          message: 'bad Suggested-artifacts format: missing fenced yaml block starting with "artifacts:"',
-          level: "error"
-        });
-      } else if (!yamlBlock.includes("{ type:") && !/- \{/.test(yamlBlock)) {
-        violations.push({
-          file: filename,
-          rule: "A",
-          message: "bad Suggested-artifacts format: YAML block has no { type: ..., pointer: ... } items",
-          level: "error"
-        });
-      } else {
-        const yamlBody = extractYamlBody(artifactsSection);
-        if (yamlBody) {
-          const stray = strayTopLevelKeys(yamlBody);
-          if (stray && stray.length > 0) {
-            violations.push({
-              file: filename,
-              rule: "A",
-              message: `bad Suggested-artifacts format: stray top-level key(s) alongside artifacts: [${stray.join(", ")}] ??these are item keys, not log keys`,
-              level: "error"
-            });
-          }
-        }
-      }
-      if (hasFlatBacktickKeysWithoutFence(artifactsSection)) {
-        violations.push({
-          file: filename,
-          rule: "A",
-          message: "bad Suggested-artifacts format: flat backtick-keyed lines found outside YAML fence (remove old `key: value` bullet style)",
-          level: "error"
-        });
-      }
-    }
-    const readScopeCount = (content.match(/^## Read scope\s*$/gm) ?? []).length;
-    if (readScopeCount > 1) {
-      violations.push({
-        file: filename,
-        rule: "B",
-        message: `duplicate ## Read scope headings found (${readScopeCount} occurrences ??remove all but the first)`,
-        level: "error"
-      });
-    }
-    if (readScopeCount >= 1) {
-      const readScopeSection = extractFirstReadScopeSection(content);
-      if (readScopeSection && !readScopeSection.includes("context-manifest.md")) {
-        violations.push({
-          file: filename,
-          rule: "C",
-          message: "## Read scope section does not reference context-manifest.md",
-          level: "error"
-        });
-      }
-    }
-    if (!content.includes("references/agent-log-protocol.md")) {
-      violations.push({
-        file: filename,
-        rule: "D",
-        message: "missing reference to references/agent-log-protocol.md",
-        level: opts.strict ? "error" : "warning"
-      });
-    }
-  }
-  for (const v of violations) {
-    const prefix = v.level === "error" ? "error" : "warning";
-    process.stderr.write(`${v.file}: [Rule ${v.rule}] ${prefix} ??${v.message}
-`);
-  }
-  const errorCount = violations.filter((v) => v.level === "error").length;
-  const warnCount = violations.filter((v) => v.level === "warning").length;
-  console.log(`lint-agents: ${errorCount} error(s), ${warnCount} warning(s)`);
-  if (errorCount > 0)
-    return 1;
-  if (opts.strict && warnCount > 0)
-    return 1;
-  return 0;
-}
-var init_lint_agents = __esm({
-  "src/commands/lint-agents.ts"() {
-    "use strict";
-    init_logger();
-  }
-});
-
-// src/code-map/index-reader.ts
-import { existsSync as existsSync19, readFileSync as readFileSync23 } from "fs";
-import yaml3 from "js-yaml";
-async function ensureCodeMapFresh(mapPath, refresh2) {
-  if (!refresh2)
-    return { refreshed: false };
-  const freshness = checkCodeMapFreshness(process.cwd(), mapPath);
-  if (freshness.status === "config-error") {
-    return {
-      refreshed: false,
-      error: `.cdd/code-map-config.yml is invalid: ${freshness.configError}`
-    };
-  }
-  if (freshness.status === "missing-with-sources" || freshness.status === "missing-greenfield" || freshness.status === "stale") {
-    const { codeMap: codeMap2 } = await Promise.resolve().then(() => (init_code_map(), code_map_exports));
-    const exit = await codeMap2({
-      path: ".",
-      out: mapPath,
-      include: [],
-      exclude: [],
-      check: false,
-      maxLines: 1e5,
-      silent: true
-    });
-    if (exit !== 0) {
-      return {
-        refreshed: false,
-        error: `could not refresh ${mapPath}; run \`cdd-kit code-map\` for details.`
-      };
-    }
-    return { refreshed: true };
-  }
-  return { refreshed: false };
-}
-function loadCodeMapEntries(mapPath) {
-  if (!existsSync19(mapPath)) {
-    throw new Error(`${mapPath} is missing; run \`cdd-kit code-map\` first.`);
-  }
-  const text = readFileSync23(mapPath, "utf8");
-  const totalLinesByPath = extractTotalLines(text);
-  const raw = yaml3.load(text, { schema: yaml3.JSON_SCHEMA });
-  if (!raw || typeof raw !== "object" || Array.isArray(raw))
-    return [];
-  const entries = [];
-  for (const [path, value] of Object.entries(raw)) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      continue;
-    const obj = value;
-    entries.push({
-      path,
-      total_lines: totalLinesByPath.get(path) ?? (typeof obj.total_lines === "number" ? obj.total_lines : 0),
-      imports: Array.isArray(obj.imports) ? obj.imports : [],
-      constants: Array.isArray(obj.constants) ? obj.constants : [],
-      classes: Array.isArray(obj.classes) ? obj.classes : [],
-      functions: Array.isArray(obj.functions) ? obj.functions : [],
-      interfaces: Array.isArray(obj.interfaces) ? obj.interfaces : [],
-      types: Array.isArray(obj.types) ? obj.types : [],
-      enums: Array.isArray(obj.enums) ? obj.enums : []
-    });
+  log.blank();
+  log.info(`Doctor provider: ${report.provider}`);
+  for (const finding of report.findings) {
+    if (finding.level === "ok")
+      log.ok(finding.message);
+    else if (finding.level === "warning")
+      log.warn(finding.message);
+    else
+      log.error(finding.message);
   }
-  return entries;
-}
-function extractTotalLines(text) {
-  const totals = /* @__PURE__ */ new Map();
-  for (const line of text.split(/\r?\n/)) {
-    const m = line.match(/^((?:'[^']*(?:''[^']*)*')|[^#:\s][^#]*?):\s*#\s*(\d+)\s+lines\b/);
-    if (!m)
-      continue;
-    totals.set(unquoteYamlKey(m[1].trim()), Number(m[2]));
+  log.blank();
+  if (!report.ok) {
+    log.error(report.strict && report.errors === 0 ? `doctor failed in strict mode with ${report.warnings} warning(s)` : `doctor failed with ${report.errors} error(s)`);
+    process.exit(1);
   }
-  return totals;
-}
-function unquoteYamlKey(key) {
-  if (key.startsWith("'") && key.endsWith("'")) {
-    return key.slice(1, -1).replace(/''/g, "'");
+  if (report.warnings > 0) {
+    log.warn(`doctor completed with ${report.warnings} warning(s)`);
+  } else {
+    log.ok("doctor passed");
   }
-  return key;
+  log.blank();
 }
-var init_index_reader = __esm({
-  "src/code-map/index-reader.ts"() {
+var init_doctor = __esm({
+  "src/commands/doctor.ts"() {
     "use strict";
+    init_logger();
+    init_provider();
     init_freshness();
+    init_lint_agents();
+    init_digest();
+  }
+});
+
+// src/commands/code-map-scan-worker.ts
+var code_map_scan_worker_exports = {};
+__export(code_map_scan_worker_exports, {
+  runScanWorker: () => runScanWorker
+});
+import { readFileSync as readFileSync26 } from "fs";
+async function runScanWorker(opts) {
+  let scanner;
+  switch (opts.lang) {
+    case "js":
+      scanner = (await Promise.resolve().then(() => (init_javascript(), javascript_exports))).jsScanner;
+      break;
+    case "ts":
+      scanner = (await Promise.resolve().then(() => (init_typescript(), typescript_exports))).tsScanner;
+      break;
+    case "vue":
+      scanner = (await Promise.resolve().then(() => (init_vue(), vue_exports))).vueScanner;
+      break;
+    default:
+      process.stderr.write(`__code-map-scan: unknown --lang "${opts.lang}"
+`);
+      return 1;
+  }
+  let files;
+  try {
+    files = readFileSync26(opts.batchFile, "utf8").split("\n").map((s) => s.trim()).filter(Boolean);
+  } catch (err) {
+    process.stderr.write(`__code-map-scan: cannot read --batch-file: ${err.message}
+`);
+    return 1;
+  }
+  const result = await scanInProcess(scanner, files, opts.repoRoot);
+  process.stdout.write(JSON.stringify(result));
+  return 0;
+}
+var init_code_map_scan_worker = __esm({
+  "src/commands/code-map-scan-worker.ts"() {
+    "use strict";
+    init_orchestrator();
   }
 });
 
 // src/commands/index-query.ts
 var index_query_exports = {};
 __export(index_query_exports, {
-  indexQuery: () => indexQuery
+  indexQuery: () => indexQuery,
+  queryEntries: () => queryEntries
 });
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 async function indexQuery(term, opts) {
   const mapPath = opts.map || ".cdd/code-map.yml";
   const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? Math.floor(opts.limit) : 10;
@@ -10264,7 +10927,7 @@ async function indexQuery(term, opts) {
     return printFailure(freshness.error, opts.json);
   }
   refreshed = freshness.refreshed;
-  if (!existsSync20(mapPath)) {
+  if (!existsSync22(mapPath)) {
     return printFailure(`${mapPath} is missing; run \`cdd-kit code-map\` first.`, opts.json);
   }
   let entries;
@@ -10432,8 +11095,8 @@ var index_impact_exports = {};
 __export(index_impact_exports, {
   indexImpact: () => indexImpact
 });
-import { existsSync as existsSync21 } from "fs";
-import { posix } from "path";
+import { existsSync as existsSync23 } from "fs";
+import { posix as posix2 } from "path";
 async function indexImpact(term, opts) {
   const mapPath = opts.map || ".cdd/code-map.yml";
   const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? Math.floor(opts.limit) : 20;
@@ -10441,7 +11104,7 @@ async function indexImpact(term, opts) {
   if (freshness.error) {
     return printFailure2(freshness.error, opts.json);
   }
-  if (!existsSync21(mapPath)) {
+  if (!existsSync23(mapPath)) {
     return printFailure2(`${mapPath} is missing; run \`cdd-kit code-map\` first.`, opts.json);
   }
   let entries;
@@ -10458,7 +11121,7 @@ async function indexImpact(term, opts) {
   const target = targetResult.entry;
   const targetImports = target.imports.map((imp) => resolveImport(target.path, imp, pathSet));
   const imports = targetImports.filter((imp) => imp.resolved);
-  const unresolvedLocalImports = targetImports.filter((imp) => !imp.resolved && isLocalImport(imp.module));
+  const unresolvedLocalImports = targetImports.filter((imp) => !imp.resolved && isLocalImport2(imp.module));
   const dependents = entries.filter((entry) => entry.path !== target.path).map((entry) => ({
     entry,
     imports: entry.imports.map((imp) => resolveImport(entry.path, imp, pathSet)).filter((imp) => imp.resolved === target.path)
@@ -10494,7 +11157,7 @@ function findTarget(entries, term) {
   if (exact)
     return { entry: exact };
   const pathMatches2 = entries.filter(
-    (entry) => entry.path.toLowerCase().includes(query.toLowerCase()) || posix.basename(entry.path).toLowerCase() === query.toLowerCase()
+    (entry) => entry.path.toLowerCase().includes(query.toLowerCase()) || posix2.basename(entry.path).toLowerCase() === query.toLowerCase()
   );
   if (pathMatches2.length === 1)
     return { entry: pathMatches2[0] };
@@ -10530,7 +11193,7 @@ function normalizeQueryPath(term) {
   return term.trim().replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function resolveImport(importerPath, imp, pathSet) {
-  const resolved = resolveLocalModule(importerPath, imp.module, pathSet);
+  const resolved = resolveLocalModule2(importerPath, imp.module, pathSet);
   return {
     module: imp.module,
     items: Array.isArray(imp.items) ? imp.items : [],
@@ -10538,30 +11201,30 @@ function resolveImport(importerPath, imp, pathSet) {
     ...resolved ? { resolved } : {}
   };
 }
-function resolveLocalModule(importerPath, moduleName, pathSet) {
-  if (!isLocalImport(moduleName))
+function resolveLocalModule2(importerPath, moduleName, pathSet) {
+  if (!isLocalImport2(moduleName))
     return void 0;
-  const base = moduleName.startsWith("./") || moduleName.startsWith("../") ? posix.normalize(posix.join(posix.dirname(importerPath), moduleName)) : resolvePythonRelativeImport(importerPath, moduleName);
-  for (const candidate of resolutionCandidates(base)) {
+  const base = moduleName.startsWith("./") || moduleName.startsWith("../") ? posix2.normalize(posix2.join(posix2.dirname(importerPath), moduleName)) : resolvePythonRelativeImport2(importerPath, moduleName);
+  for (const candidate of resolutionCandidates2(base)) {
     if (pathSet.has(candidate))
       return candidate;
   }
   return void 0;
 }
-function resolvePythonRelativeImport(importerPath, moduleName) {
+function resolvePythonRelativeImport2(importerPath, moduleName) {
   const match = moduleName.match(/^(\.+)(.*)$/);
   if (!match)
     return moduleName;
   const upLevels = Math.max(0, match[1].length - 1);
-  let baseDir = posix.dirname(importerPath);
+  let baseDir = posix2.dirname(importerPath);
   for (let i = 0; i < upLevels; i++) {
-    baseDir = posix.dirname(baseDir);
+    baseDir = posix2.dirname(baseDir);
   }
   const rest = match[2].replace(/^\./, "").replace(/\./g, "/");
-  return rest ? posix.normalize(posix.join(baseDir, rest)) : baseDir;
+  return rest ? posix2.normalize(posix2.join(baseDir, rest)) : baseDir;
 }
-function resolutionCandidates(base) {
-  const ext = posix.extname(base);
+function resolutionCandidates2(base) {
+  const ext = posix2.extname(base);
   const candidates = [];
   if (ext) {
     candidates.push(base);
@@ -10570,17 +11233,17 @@ function resolutionCandidates(base) {
       candidates.push(`${withoutExt}.ts`, `${withoutExt}.tsx`, `${withoutExt}.vue`);
     }
   } else {
-    for (const candidateExt of RESOLUTION_EXTENSIONS) {
+    for (const candidateExt of RESOLUTION_EXTENSIONS2) {
       candidates.push(`${base}${candidateExt}`);
     }
   }
-  for (const candidateExt of RESOLUTION_EXTENSIONS) {
-    candidates.push(posix.join(base, `index${candidateExt}`));
+  for (const candidateExt of RESOLUTION_EXTENSIONS2) {
+    candidates.push(posix2.join(base, `index${candidateExt}`));
   }
-  candidates.push(posix.join(base, "__init__.py"));
+  candidates.push(posix2.join(base, "__init__.py"));
   return [...new Set(candidates)];
 }
-function isLocalImport(moduleName) {
+function isLocalImport2(moduleName) {
   return moduleName.startsWith(".");
 }
 function summarizeSymbols(entry) {
@@ -10670,12 +11333,486 @@ function printFailure2(message, json) {
   }
   return 1;
 }
-var RESOLUTION_EXTENSIONS;
+var RESOLUTION_EXTENSIONS2;
 var init_index_impact = __esm({
   "src/commands/index-impact.ts"() {
     "use strict";
     init_index_reader();
-    RESOLUTION_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".vue", ".py"];
+    RESOLUTION_EXTENSIONS2 = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".vue", ".py"];
+  }
+});
+
+// src/code-graph/queries.ts
+function searchGraph(graph2, term, limit) {
+  const query = term.trim().toLowerCase();
+  if (!query)
+    return [];
+  return graph2.nodes.map((node) => {
+    const score = Math.max(
+      scoreText2(node.name, query, 120),
+      scoreText2(node.qualified_name, query, 100),
+      scoreText2(node.file_path, query, 80)
+    );
+    return {
+      node,
+      score,
+      edges: {
+        incoming: graph2.edges.filter((e) => e.target === node.id).length,
+        outgoing: graph2.edges.filter((e) => e.source === node.id).length
+      }
+    };
+  }).filter((result) => result.score > 0).sort((a, b) => b.score - a.score || a.node.file_path.localeCompare(b.node.file_path) || a.node.start_line - b.node.start_line).slice(0, limit);
+}
+function findGraphNode(graph2, term) {
+  const query = term.trim().toLowerCase().replace(/\\/g, "/").replace(/^\.\//, "");
+  const exact = graph2.nodes.find((n) => n.id === term || n.qualified_name.toLowerCase() === query || n.file_path.toLowerCase() === query);
+  if (exact)
+    return exact;
+  const pathMatches2 = graph2.nodes.filter((n) => n.kind === "file" && n.file_path.toLowerCase().includes(query));
+  if (pathMatches2.length === 1)
+    return pathMatches2[0];
+  const symbolMatches = graph2.nodes.filter((n) => n.name.toLowerCase() === query || n.qualified_name.toLowerCase().endsWith(`::${query}`));
+  if (symbolMatches.length === 1)
+    return symbolMatches[0];
+  return searchGraph(graph2, term, 1)[0]?.node;
+}
+function graphImpact(graph2, term, depth, limit) {
+  const target = findGraphNode(graph2, term);
+  if (!target)
+    return void 0;
+  return traverse(graph2, target, ["calls", "imports", "references", "extends", "implements"], "both", depth, limit);
+}
+function graphContext(graph2, task, maxNodes) {
+  const entryPoints = searchGraph(graph2, task, Math.min(maxNodes, 10));
+  const nodeIds = new Set(entryPoints.map((r) => r.node.id));
+  const edgeMap = /* @__PURE__ */ new Map();
+  for (const entry of entryPoints) {
+    const neighborhood = traverse(graph2, entry.node, ["contains", "calls", "imports", "references", "extends", "implements"], "both", 1, maxNodes);
+    for (const node of neighborhood.nodes)
+      nodeIds.add(node.id);
+    for (const edge of neighborhood.edges)
+      edgeMap.set(edge.id, edge);
+  }
+  const nodes = graph2.nodes.filter((n) => nodeIds.has(n.id)).slice(0, maxNodes);
+  return { query: task, entry_points: entryPoints, nodes, edges: [...edgeMap.values()] };
+}
+function traverse(graph2, target, kinds, direction, depth, limit) {
+  const maxDepth = Math.max(1, depth || 1);
+  const maxNodes = Math.max(1, limit || 50);
+  const nodeById = new Map(graph2.nodes.map((n) => [n.id, n]));
+  const visited = /* @__PURE__ */ new Set([target.id]);
+  const keptEdges = /* @__PURE__ */ new Map();
+  let frontier = [target.id];
+  for (let d = 0; d < maxDepth && frontier.length > 0 && visited.size < maxNodes; d++) {
+    const next = [];
+    for (const nodeId2 of frontier) {
+      const edges = graph2.edges.filter(
+        (e) => kinds.includes(e.kind) && (direction === "both" ? e.source === nodeId2 || e.target === nodeId2 : direction === "incoming" ? e.target === nodeId2 : e.source === nodeId2)
+      );
+      for (const edge of edges) {
+        const other = edge.source === nodeId2 ? edge.target : edge.source;
+        if (!nodeById.has(other))
+          continue;
+        keptEdges.set(edge.id, edge);
+        if (!visited.has(other)) {
+          visited.add(other);
+          next.push(other);
+          if (visited.size >= maxNodes)
+            break;
+        }
+      }
+    }
+    frontier = next;
+  }
+  return {
+    target,
+    depth: maxDepth,
+    nodes: [...visited].map((id) => nodeById.get(id)).filter((node) => !!node),
+    edges: [...keptEdges.values()]
+  };
+}
+function scoreText2(text, query, weight) {
+  const haystack = text.toLowerCase();
+  if (haystack === query)
+    return weight + 40;
+  if (haystack.endsWith(`/${query}`) || haystack.endsWith(`.${query}`) || haystack.endsWith(`::${query}`))
+    return weight + 30;
+  if (haystack.startsWith(query))
+    return weight + 20;
+  if (haystack.includes(query))
+    return weight;
+  return 0;
+}
+var init_queries = __esm({
+  "src/code-graph/queries.ts"() {
+    "use strict";
+  }
+});
+
+// src/commands/graph.ts
+var graph_exports = {};
+__export(graph_exports, {
+  graphContext: () => graphContext2,
+  graphImpact: () => graphImpact2,
+  graphQuery: () => graphQuery,
+  graphStatus: () => graphStatus,
+  graphSync: () => graphSync
+});
+import { existsSync as existsSync24 } from "fs";
+import { join as join25 } from "path";
+import { spawnSync as spawnSync3 } from "child_process";
+function codeGraphCommand() {
+  return process.env.CDD_CODEGRAPH_BIN || "codegraph";
+}
+function runCodeGraph(args, cwd = process.cwd()) {
+  const command = codeGraphCommand();
+  if (command.toLowerCase().endsWith(".js")) {
+    return spawnSync3(process.execPath, [command, ...args], { cwd, encoding: "buffer" });
+  }
+  return spawnSync3(command, args, { cwd, encoding: "buffer" });
+}
+function probeCodeGraph(cwd = process.cwd()) {
+  const command = codeGraphCommand();
+  const initialized = existsSync24(join25(cwd, ".codegraph"));
+  const version = runCodeGraph(["--version"], cwd);
+  if (version.error) {
+    return {
+      available: false,
+      command,
+      initialized,
+      reason: version.error.message
+    };
+  }
+  if (version.status !== 0) {
+    return {
+      available: false,
+      command,
+      initialized,
+      reason: (version.stderr?.toString("utf8") || version.stdout?.toString("utf8") || `exit ${version.status}`).trim()
+    };
+  }
+  return { available: true, command, initialized };
+}
+function selectEngine(opts, cwd = process.cwd()) {
+  const requested = opts.engine ?? "auto";
+  const probe = probeCodeGraph(cwd);
+  if (!["auto", "native", "codegraph", "codemap"].includes(requested)) {
+    return { error: `Invalid graph engine: ${requested}. Use auto, native, codegraph, or codemap.`, probe };
+  }
+  if (requested === "codemap")
+    return { engine: "codemap", probe };
+  if (requested === "native" || requested === "auto")
+    return { engine: "native", probe };
+  if (requested === "codegraph") {
+    if (!probe.available) {
+      return {
+        error: `CodeGraph is not available (${probe.command}): ${probe.reason ?? "command not found"}`,
+        probe
+      };
+    }
+    return { engine: "codegraph", probe };
+  }
+  return { engine: "native", probe };
+}
+function writeJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function pipeResult(result) {
+  if (result.stdout?.length)
+    process.stdout.write(result.stdout);
+  if (result.stderr?.length)
+    process.stderr.write(result.stderr);
+  if (result.error) {
+    process.stderr.write(`${result.error.message}
+`);
+    return 1;
+  }
+  return result.status ?? 1;
+}
+function printEngineError(message, json, probe) {
+  if (json) {
+    writeJson({ error: message, codegraph: probe });
+  } else {
+    console.error(message);
+  }
+  return 1;
+}
+async function ensureNativeGraph(mapPath, refresh2) {
+  const freshness = await ensureCodeMapFresh(mapPath, refresh2);
+  if (freshness.error)
+    return { graphPath: graphPathFor(mapPath), refreshed: freshness.refreshed, error: freshness.error };
+  const graphPath = graphPathFor(mapPath);
+  if (!existsSync24(graphPath) && refresh2) {
+    const { codeMap: codeMap2 } = await Promise.resolve().then(() => (init_code_map(), code_map_exports));
+    const exit = await codeMap2({
+      path: ".",
+      out: mapPath,
+      include: [],
+      exclude: [],
+      check: false,
+      maxLines: 1e5,
+      silent: true
+    });
+    if (exit !== 0) {
+      return { graphPath, refreshed: freshness.refreshed, error: `could not refresh ${graphPath}; run \`cdd-kit code-map\` for details.` };
+    }
+    return { graphPath, refreshed: true };
+  }
+  return { graphPath, refreshed: freshness.refreshed };
+}
+async function graphStatus(opts = {}) {
+  const cwd = process.cwd();
+  const selected = selectEngine(opts, cwd);
+  if ("error" in selected)
+    return printEngineError(selected.error, opts.json, selected.probe);
+  if (selected.engine === "codegraph") {
+    const args = ["status"];
+    if (opts.path)
+      args.push(opts.path);
+    return pipeResult(runCodeGraph(args, cwd));
+  }
+  const mapPath = opts.map || ".cdd/code-map.yml";
+  const graphPath = graphPathFor(mapPath);
+  const freshness = checkCodeMapFreshness(cwd, mapPath);
+  let graphStats;
+  if (existsSync24(graphPath)) {
+    try {
+      const graph2 = loadCodeGraph(graphPath);
+      graphStats = { graph: graphPath, nodes: graph2.nodes.length, edges: graph2.edges.length, unresolved: graph2.unresolved.length };
+    } catch {
+      graphStats = { graph: graphPath, nodes: 0, edges: 0, unresolved: 0 };
+    }
+  }
+  const payload = {
+    engine: selected.engine,
+    codegraph: selected.probe,
+    code_map: {
+      map: mapPath,
+      status: freshness.status,
+      stale_count: "staleCount" in freshness ? freshness.staleCount : 0,
+      stale_files: "staleFiles" in freshness ? freshness.staleFiles.slice(0, 10) : [],
+      config_error: "configError" in freshness ? freshness.configError : void 0
+    },
+    native_graph: graphStats ?? { graph: graphPath, missing: true }
+  };
+  if (opts.json) {
+    writeJson(payload);
+  } else {
+    console.log(`graph engine: ${selected.engine === "native" ? "native cdd-kit graph" : "code-map fallback"}`);
+    console.log(`code-map: ${payload.code_map.status}`);
+    if (graphStats) {
+      console.log(`code-graph: ${graphStats.nodes} nodes, ${graphStats.edges} edges, ${graphStats.unresolved} unresolved`);
+    } else {
+      console.log(`code-graph: missing (${graphPath}); run cdd-kit code-map`);
+    }
+    if (!selected.probe.available) {
+      console.log(`CodeGraph: unavailable (${selected.probe.command})`);
+    } else if (!selected.probe.initialized) {
+      console.log("CodeGraph: available but project is not initialized (.codegraph/ missing)");
+    }
+    console.log("Next: run `codegraph init -i` to enable semantic graph queries, or continue with code-map fallback.");
+  }
+  return freshness.status === "config-error" ? 1 : 0;
+}
+async function graphSync(opts = {}) {
+  const selected = selectEngine({ ...opts, engine: opts.engine ?? "codegraph" });
+  if ("error" in selected)
+    return printEngineError(selected.error, opts.json, selected.probe);
+  if (selected.engine !== "codegraph") {
+    return printEngineError("graph sync requires CodeGraph; code-map fallback refreshes during query/impact.", opts.json, selected.probe);
+  }
+  const args = ["sync"];
+  if (opts.path)
+    args.push(opts.path);
+  return pipeResult(runCodeGraph(args));
+}
+async function graphQuery(term, opts) {
+  const selected = selectEngine(opts);
+  if ("error" in selected)
+    return printEngineError(selected.error, opts.json, selected.probe);
+  if (selected.engine === "codegraph") {
+    const args = ["query", term, "--limit", String(opts.limit)];
+    if (opts.json)
+      args.push("--json");
+    return pipeResult(runCodeGraph(args));
+  }
+  if (selected.engine === "native") {
+    const mapPath = opts.map || ".cdd/code-map.yml";
+    const ensured = await ensureNativeGraph(mapPath, opts.refresh !== false);
+    if (ensured.error)
+      return printEngineError(ensured.error, opts.json, selected.probe);
+    try {
+      const graph2 = loadCodeGraph(ensured.graphPath);
+      const results = searchGraph(graph2, term, opts.limit);
+      if (opts.json) {
+        writeJson({ engine: "native", graph: ensured.graphPath, query: term, refreshed: ensured.refreshed, results });
+      } else {
+        console.log(`graph: ${ensured.graphPath}${ensured.refreshed ? " (refreshed)" : ""}`);
+        console.log(`query: ${term}`);
+        console.log(`results: ${results.length}`);
+        for (const result of results) {
+          const n = result.node;
+          console.log(`- ${n.kind}: ${n.qualified_name} lines ${n.start_line}-${n.end_line}`);
+          console.log(`  edges: ${result.edges.incoming} incoming, ${result.edges.outgoing} outgoing`);
+        }
+        console.log("Next: run cdd-kit graph impact <node/file/symbol> before editing.");
+      }
+      return results.length === 0 ? 1 : 0;
+    } catch (err) {
+      return printEngineError(err.message, opts.json, selected.probe);
+    }
+  }
+  return indexQuery(term, {
+    map: opts.map || ".cdd/code-map.yml",
+    limit: opts.limit,
+    json: opts.json === true,
+    refresh: opts.refresh !== false
+  });
+}
+async function graphImpact2(term, opts) {
+  const selected = selectEngine(opts);
+  if ("error" in selected)
+    return printEngineError(selected.error, opts.json, selected.probe);
+  if (selected.engine === "codegraph") {
+    const args = ["impact", term, "--depth", String(opts.depth)];
+    if (opts.json)
+      args.push("--json");
+    return pipeResult(runCodeGraph(args));
+  }
+  if (selected.engine === "native") {
+    const mapPath = opts.map || ".cdd/code-map.yml";
+    const ensured = await ensureNativeGraph(mapPath, opts.refresh !== false);
+    if (ensured.error)
+      return printEngineError(ensured.error, opts.json, selected.probe);
+    try {
+      const graph2 = loadCodeGraph(ensured.graphPath);
+      const impact = graphImpact(graph2, term, opts.depth, opts.limit);
+      if (!impact)
+        return printEngineError(`No graph node matched "${term}". Try \`cdd-kit graph query "${term}"\` first.`, opts.json, selected.probe);
+      if (opts.json) {
+        writeJson({ engine: "native", graph: ensured.graphPath, query: term, refreshed: ensured.refreshed, ...impact });
+      } else {
+        console.log(`graph: ${ensured.graphPath}${ensured.refreshed ? " (refreshed)" : ""}`);
+        console.log(`target: ${impact.target.qualified_name} (${impact.target.kind})`);
+        console.log(`impact depth: ${impact.depth}`);
+        console.log("nodes:");
+        for (const node of impact.nodes) {
+          console.log(`- ${node.kind}: ${node.qualified_name} lines ${node.start_line}-${node.end_line}`);
+        }
+        console.log("edges:");
+        for (const edge of impact.edges.slice(0, opts.limit)) {
+          const source = graph2.nodes.find((n) => n.id === edge.source)?.qualified_name ?? edge.source;
+          const target = graph2.nodes.find((n) => n.id === edge.target)?.qualified_name ?? edge.target;
+          console.log(`- ${edge.kind}: ${source} -> ${target}${edge.line ? ` line ${edge.line}` : ""} (${edge.provenance})`);
+        }
+        console.log("Next: inspect target plus listed callers/callees/imports before editing.");
+      }
+      return 0;
+    } catch (err) {
+      return printEngineError(err.message, opts.json, selected.probe);
+    }
+  }
+  if (!opts.json && opts.depth > 1) {
+    console.log("graph engine: code-map fallback (depth is limited to direct imports/dependents)");
+  }
+  return indexImpact(term, {
+    map: opts.map || ".cdd/code-map.yml",
+    limit: opts.limit,
+    json: opts.json === true,
+    refresh: opts.refresh !== false
+  });
+}
+async function graphContext2(task, opts) {
+  const selected = selectEngine(opts);
+  if ("error" in selected)
+    return printEngineError(selected.error, opts.json, selected.probe);
+  if (selected.engine === "codegraph") {
+    const args = ["context", task, "--max-nodes", String(opts.maxNodes), "--format", opts.json ? "json" : "markdown"];
+    return pipeResult(runCodeGraph(args));
+  }
+  if (selected.engine === "native") {
+    const mapPath2 = opts.map || ".cdd/code-map.yml";
+    const ensured = await ensureNativeGraph(mapPath2, opts.refresh !== false);
+    if (ensured.error)
+      return printEngineError(ensured.error, opts.json, selected.probe);
+    try {
+      const graph2 = loadCodeGraph(ensured.graphPath);
+      const context2 = graphContext(graph2, task, opts.maxNodes);
+      if (opts.json) {
+        writeJson({ engine: "native", graph: ensured.graphPath, refreshed: ensured.refreshed, ...context2 });
+      } else {
+        console.log(`graph: ${ensured.graphPath}${ensured.refreshed ? " (refreshed)" : ""}`);
+        console.log(`task: ${task}`);
+        console.log("entry-points:");
+        for (const entry of context2.entry_points) {
+          console.log(`- ${entry.node.kind}: ${entry.node.qualified_name} lines ${entry.node.start_line}-${entry.node.end_line}`);
+        }
+        console.log("related edges:");
+        for (const edge of context2.edges.slice(0, opts.maxNodes)) {
+          const source = graph2.nodes.find((n) => n.id === edge.source)?.qualified_name ?? edge.source;
+          const target = graph2.nodes.find((n) => n.id === edge.target)?.qualified_name ?? edge.target;
+          console.log(`- ${edge.kind}: ${source} -> ${target}${edge.line ? ` line ${edge.line}` : ""}`);
+        }
+        console.log("Next: run cdd-kit graph impact on the most relevant entry point before editing.");
+      }
+      return context2.entry_points.length === 0 ? 1 : 0;
+    } catch (err) {
+      return printEngineError(err.message, opts.json, selected.probe);
+    }
+  }
+  const mapPath = opts.map || ".cdd/code-map.yml";
+  const freshness = await ensureCodeMapFresh(mapPath, opts.refresh !== false);
+  if (freshness.error)
+    return printEngineError(freshness.error, opts.json, selected.probe);
+  if (!existsSync24(mapPath))
+    return printEngineError(`${mapPath} is missing; run \`cdd-kit code-map\` first.`, opts.json, selected.probe);
+  let entries;
+  try {
+    entries = loadCodeMapEntries(mapPath);
+  } catch (err) {
+    return printEngineError(`${mapPath} is not readable YAML: ${err.message}`, opts.json, selected.probe);
+  }
+  const results = queryEntries(entries, task).slice(0, opts.maxNodes);
+  const payload = {
+    engine: "codemap",
+    query: task,
+    refreshed: freshness.refreshed,
+    warning: "CodeGraph is not active; context is built from code-map symbol/file matches only.",
+    candidates: results,
+    next: results.length > 0 ? "Run cdd-kit graph impact <candidate path or symbol> before editing." : "Try a symbol name, file stem, route/component name, or initialize CodeGraph for semantic context."
+  };
+  if (opts.json) {
+    writeJson(payload);
+  } else {
+    console.log(`graph engine: code-map fallback${freshness.refreshed ? " (refreshed)" : ""}`);
+    console.log(`task: ${task}`);
+    if (results.length === 0) {
+      console.log("candidates: none");
+      console.log(payload.next);
+      return 1;
+    }
+    console.log("candidates:");
+    for (const result of results) {
+      console.log(`- ${result.path} (${result.total_lines} lines)`);
+      for (const match of result.matches.slice(0, 5)) {
+        const loc = match.lines ? ` lines ${match.lines}` : match.line ? ` line ${match.line}` : "";
+        console.log(`  - ${match.kind}: ${match.name}${loc}`);
+      }
+    }
+    console.log(payload.next);
+  }
+  return results.length === 0 ? 1 : 0;
+}
+var init_graph = __esm({
+  "src/commands/graph.ts"() {
+    "use strict";
+    init_freshness();
+    init_index_reader();
+    init_reader();
+    init_queries();
+    init_index_query();
+    init_index_impact();
   }
 });
 
@@ -10684,28 +11821,28 @@ var archive_exports = {};
 __export(archive_exports, {
   archive: () => archive
 });
-import { join as join23 } from "path";
-import { existsSync as existsSync22, mkdirSync as mkdirSync10, renameSync as renameSync2, readFileSync as readFileSync24, writeFileSync as writeFileSync11, appendFileSync, cpSync as cpSync3, rmSync as rmSync3 } from "fs";
+import { join as join26 } from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync10, renameSync as renameSync2, readFileSync as readFileSync27, writeFileSync as writeFileSync13, appendFileSync, cpSync as cpSync3, rmSync as rmSync3 } from "fs";
 import yaml4 from "js-yaml";
 async function archive(changeId) {
   const cwd = process.cwd();
-  const changeDir = join23(cwd, "specs", "changes", changeId);
+  const changeDir = join26(cwd, "specs", "changes", changeId);
   const archiveYear = (/* @__PURE__ */ new Date()).getFullYear().toString();
-  const archiveBase = join23(cwd, "specs", "archive", archiveYear);
-  const archiveDir = join23(archiveBase, changeId);
-  const indexPath = join23(cwd, "specs", "archive", "INDEX.md");
-  if (!existsSync22(changeDir)) {
+  const archiveBase = join26(cwd, "specs", "archive", archiveYear);
+  const archiveDir = join26(archiveBase, changeId);
+  const indexPath = join26(cwd, "specs", "archive", "INDEX.md");
+  if (!existsSync25(changeDir)) {
     log.error(`Change not found: specs/changes/${changeId}`);
     process.exit(1);
   }
-  if (existsSync22(archiveDir)) {
+  if (existsSync25(archiveDir)) {
     log.error(`Already archived: specs/archive/${archiveYear}/${changeId}`);
     process.exit(1);
   }
-  const tasksPath = join23(changeDir, "tasks.yml");
-  if (existsSync22(tasksPath)) {
+  const tasksPath = join26(changeDir, "tasks.yml");
+  if (existsSync25(tasksPath)) {
     try {
-      const raw = readFileSync24(tasksPath, "utf8");
+      const raw = readFileSync27(tasksPath, "utf8");
       const data = yaml4.load(raw);
       if (data?.status === "gate-blocked") {
         log.warn("tasks.yml has status: gate-blocked \u2014 archiving anyway (change was paused).");
@@ -10718,7 +11855,7 @@ async function archive(changeId) {
       log.warn("tasks.yml could not be parsed \u2014 archiving anyway.");
     }
   }
-  if (!existsSync22(archiveBase)) {
+  if (!existsSync25(archiveBase)) {
     mkdirSync10(archiveBase, { recursive: true });
   }
   try {
@@ -10735,8 +11872,8 @@ async function archive(changeId) {
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const indexLine = `| ${changeId} | ${archiveYear} | ${today} | specs/archive/${archiveYear}/${changeId}/ |
 `;
-  if (!existsSync22(indexPath)) {
-    writeFileSync11(indexPath, `# Archive Index
+  if (!existsSync25(indexPath)) {
+    writeFileSync13(indexPath, `# Archive Index
 
 | change-id | year | archived-date | path |
 |---|---|---|---|
@@ -10760,37 +11897,37 @@ var abandon_exports = {};
 __export(abandon_exports, {
   abandon: () => abandon
 });
-import { join as join24 } from "path";
-import { existsSync as existsSync23, readFileSync as readFileSync25, writeFileSync as writeFileSync12, appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
+import { join as join27 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync28, writeFileSync as writeFileSync14, appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
 import yaml5 from "js-yaml";
 async function abandon(changeId, opts) {
   const cwd = process.cwd();
-  const changeDir = join24(cwd, "specs", "changes", changeId);
-  const tasksPath = join24(changeDir, "tasks.yml");
-  if (!existsSync23(changeDir)) {
+  const changeDir = join27(cwd, "specs", "changes", changeId);
+  const tasksPath = join27(changeDir, "tasks.yml");
+  if (!existsSync26(changeDir)) {
     log.error(`Change not found: specs/changes/${changeId}`);
     process.exit(1);
   }
-  if (existsSync23(tasksPath)) {
-    const raw = readFileSync25(tasksPath, "utf8");
+  if (existsSync26(tasksPath)) {
+    const raw = readFileSync28(tasksPath, "utf8");
     const data = yaml5.load(raw) ?? {};
     data["status"] = "abandoned";
     if (!data["change-id"]) {
       data["change-id"] = changeId;
     }
-    writeFileSync12(tasksPath, yaml5.dump(data, { lineWidth: -1, noRefs: true }), "utf8");
+    writeFileSync14(tasksPath, yaml5.dump(data, { lineWidth: -1, noRefs: true }), "utf8");
   }
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-  const archiveDir = join24(cwd, "specs", "archive");
-  const indexPath = join24(archiveDir, "INDEX.md");
+  const archiveDir = join27(cwd, "specs", "archive");
+  const indexPath = join27(archiveDir, "INDEX.md");
   const reason = opts.reason ?? "no reason given";
   const indexLine = `| ${changeId} | abandoned | ${today} | ${reason} |
 `;
-  if (!existsSync23(archiveDir)) {
+  if (!existsSync26(archiveDir)) {
     mkdirSync11(archiveDir, { recursive: true });
   }
-  if (!existsSync23(indexPath)) {
-    writeFileSync12(indexPath, `# Archive Index
+  if (!existsSync26(indexPath)) {
+    writeFileSync14(indexPath, `# Archive Index
 
 | change-id | status | date | notes |
 |---|---|---|---|
@@ -10814,15 +11951,15 @@ var list_changes_exports = {};
 __export(list_changes_exports, {
   listChanges: () => listChanges
 });
-import { join as join25 } from "path";
-import { existsSync as existsSync24, readdirSync as readdirSync13, readFileSync as readFileSync26 } from "fs";
+import { join as join28 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync13, readFileSync as readFileSync29 } from "fs";
 import yaml6 from "js-yaml";
 async function listChanges() {
   const cwd = process.cwd();
-  const changesDir = join25(cwd, "specs", "changes");
+  const changesDir = join28(cwd, "specs", "changes");
   log.blank();
   const active = [];
-  if (existsSync24(changesDir)) {
+  if (existsSync27(changesDir)) {
     active.push(...readdirSync13(changesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name));
   }
   if (active.length === 0) {
@@ -10830,12 +11967,12 @@ async function listChanges() {
   } else {
     log.info("Active changes:");
     for (const id of active) {
-      const tasksPath = join25(changesDir, id, "tasks.yml");
+      const tasksPath = join28(changesDir, id, "tasks.yml");
       let status = "in-progress";
       let pending = 0;
-      if (existsSync24(tasksPath)) {
+      if (existsSync27(tasksPath)) {
         try {
-          const raw = readFileSync26(tasksPath, "utf8");
+          const raw = readFileSync29(tasksPath, "utf8");
           const data = yaml6.load(raw);
           if (data?.status)
             status = data.status;
@@ -10867,8 +12004,8 @@ __export(context_exports, {
   rejectContextExpansion: () => rejectContextExpansion,
   requestContextExpansion: () => requestContextExpansion
 });
-import { existsSync as existsSync25, readFileSync as readFileSync27, writeFileSync as writeFileSync13 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync30, writeFileSync as writeFileSync15 } from "fs";
+import { join as join29 } from "path";
 import picomatch2 from "picomatch";
 function normalizePath(path) {
   return path.replace(/\\/g, "/").replace(/^\.\//, "").trim();
@@ -10883,18 +12020,18 @@ function validateRepoRelativePath(path) {
   return null;
 }
 function manifestPathFor(changeId) {
-  return join26(process.cwd(), "specs", "changes", changeId, "context-manifest.md");
+  return join29(process.cwd(), "specs", "changes", changeId, "context-manifest.md");
 }
 function readManifest(changeId) {
   const manifestPath = manifestPathFor(changeId);
-  if (!existsSync25(manifestPath)) {
+  if (!existsSync28(manifestPath)) {
     log.error(`context manifest not found: specs/changes/${changeId}/context-manifest.md`);
     process.exit(1);
   }
-  return readFileSync27(manifestPath, "utf8");
+  return readFileSync30(manifestPath, "utf8");
 }
 function writeManifest(changeId, content) {
-  writeFileSync13(manifestPathFor(changeId), content.endsWith("\n") ? content : `${content}
+  writeFileSync15(manifestPathFor(changeId), content.endsWith("\n") ? content : `${content}
 `, "utf8");
 }
 function sectionBody(content, heading) {
@@ -10933,11 +12070,11 @@ function pathMatches(relPath, patterns, currentChangeId) {
   });
 }
 function loadContextPolicy() {
-  const policyPath = join26(process.cwd(), ".cdd", "context-policy.json");
-  if (!existsSync25(policyPath))
+  const policyPath = join29(process.cwd(), ".cdd", "context-policy.json");
+  if (!existsSync28(policyPath))
     return { forbiddenPaths: DEFAULT_FORBIDDEN_PATHS };
   try {
-    const custom = JSON.parse(readFileSync27(policyPath, "utf8"));
+    const custom = JSON.parse(readFileSync30(policyPath, "utf8"));
     return {
       forbiddenPaths: Array.from(/* @__PURE__ */ new Set([
         ...DEFAULT_FORBIDDEN_PATHS,
@@ -11219,9 +12356,10 @@ var init_context = __esm({
 });
 
 // src/cli/index.ts
-import { readFileSync as readFileSync28 } from "fs";
+import { readFileSync as readFileSync31 } from "fs";
+import os from "os";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname7, join as join27 } from "path";
+import { dirname as dirname7, join as join30 } from "path";
 import { Command } from "commander";
 
 // src/commands/init.ts
@@ -12327,7 +13465,7 @@ async function installHooks() {
 
 // src/cli/index.ts
 var __dirname2 = dirname7(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync28(join27(__dirname2, "..", "..", "package.json"), "utf8"));
+var pkg = JSON.parse(readFileSync31(join30(__dirname2, "..", "..", "package.json"), "utf8"));
 var program = new Command();
 program.name("cdd-kit").description("Contract-Driven Delivery Kit CLI").version(pkg.version);
 program.command("init").description(
@@ -12388,11 +13526,24 @@ function collectRepeatable(val, acc) {
   acc.push(val);
   return acc;
 }
-program.command("code-map [path]").description("Scan source files and emit a structural index at .cdd/code-map.yml").option("--out <path>", "Output YAML path", ".cdd/code-map.yml").option("--include <glob>", "Additional include glob (repeatable)", collectRepeatable, []).option("--exclude <glob>", "Additional exclude glob (repeatable)", collectRepeatable, []).option("--check", "Exit 1 if regenerating would change the file (no write)", false).option("--max-lines <n>", "Warn for files exceeding this line count (default 100000)", "100000").action(async (path, opts) => {
+function resolveWorkers(value) {
+  if (value === void 0)
+    return 0;
+  const cpus = Math.max(1, (os.cpus()?.length ?? 2) - 1);
+  if (value === true)
+    return Math.min(cpus, 16);
+  const n = parseInt(String(value), 10);
+  if (!Number.isFinite(n) || n < 1)
+    return 1;
+  return Math.min(n, 16);
+}
+program.command("code-map [path]").description("Scan source files and emit a structural index at .cdd/code-map.yml").option("--out <path>", "Output YAML path (default .cdd/code-map.yml; with --surface, .cdd/code-map.<surface>.yml)").option("--surface <subpath>", "Scope the scan to a monorepo subtree and name the map after it").option("--workers [n]", "Parallelize JS/TS/Vue scanning across N child processes (default: CPU count - 1)").option("--include <glob>", "Additional include glob (repeatable)", collectRepeatable, []).option("--exclude <glob>", "Additional exclude glob (repeatable)", collectRepeatable, []).option("--check", "Exit 1 if regenerating would change the file (no write)", false).option("--max-lines <n>", "Warn for files exceeding this line count (default 100000)", "100000").action(async (path, opts) => {
   const { codeMap: codeMap2 } = await Promise.resolve().then(() => (init_code_map(), code_map_exports));
   const exit = await codeMap2({
     path: path ?? ".",
     out: opts.out,
+    surface: opts.surface,
+    workers: resolveWorkers(opts.workers),
     include: opts.include,
     exclude: opts.exclude,
     check: opts.check,
@@ -12400,6 +13551,11 @@ program.command("code-map [path]").description("Scan source files and emit a str
   });
   process.exit(exit);
 });
+program.command("__code-map-scan", { hidden: true }).requiredOption("--lang <lang>", "js | ts | vue").requiredOption("--batch-file <path>", "File listing absolute source paths, one per line").requiredOption("--repo-root <path>", "Repo root the scanned paths are relative to").action(async (opts) => {
+  const { runScanWorker: runScanWorker2 } = await Promise.resolve().then(() => (init_code_map_scan_worker(), code_map_scan_worker_exports));
+  const exit = await runScanWorker2({ lang: opts.lang, batchFile: opts.batchFile, repoRoot: opts.repoRoot });
+  process.exit(exit);
+});
 var index = program.command("index").description("Query machine-readable project indexes before opening source files");
 index.command("query <term>").description("Search .cdd/code-map.yml for files, symbols, imports, and line ranges").option("--map <path>", "Code-map YAML path", ".cdd/code-map.yml").option("--limit <n>", "Maximum result files to print", "10").option("--json", "Print machine-readable JSON", false).option("--no-refresh", "Do not auto-regenerate stale or missing code-map before querying").action(async (term, opts) => {
   const { indexQuery: indexQuery2 } = await Promise.resolve().then(() => (init_index_query(), index_query_exports));
@@ -12421,6 +13577,51 @@ index.command("impact <path-or-symbol>").description("Show indexed local imports
   });
   process.exit(exit);
 });
+var graph = program.command("graph").description("Query native cdd-kit code graph context with optional CodeGraph adapter and code-map fallback");
+graph.command("status [path]").description("Show active graph engine and index health").option("--engine <engine>", "Graph engine: auto, native, codegraph, or codemap", "auto").option("--map <path>", "Code-map YAML path for fallback status", ".cdd/code-map.yml").option("--json", "Print machine-readable JSON", false).action(async (path, opts) => {
+  const { graphStatus: graphStatus2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+  const exit = await graphStatus2({ path, engine: opts.engine, map: opts.map, json: opts.json === true });
+  process.exit(exit);
+});
+graph.command("sync [path]").description("Run CodeGraph incremental sync (requires CodeGraph)").option("--engine <engine>", "Graph engine: codegraph", "codegraph").option("--json", "Print machine-readable JSON on errors", false).action(async (path, opts) => {
+  const { graphSync: graphSync2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+  const exit = await graphSync2({ path, engine: opts.engine, json: opts.json === true });
+  process.exit(exit);
+});
+graph.command("query <term>").description("Search native graph symbols, optionally delegating to CodeGraph or code-map").option("--engine <engine>", "Graph engine: auto, native, codegraph, or codemap", "auto").option("--map <path>", "Code-map YAML path for fallback", ".cdd/code-map.yml").option("--limit <n>", "Maximum results to print", "10").option("--json", "Print machine-readable JSON", false).option("--no-refresh", "Do not auto-regenerate stale or missing fallback code-map").action(async (term, opts) => {
+  const { graphQuery: graphQuery2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+  const exit = await graphQuery2(term, {
+    engine: opts.engine,
+    map: opts.map,
+    limit: parseInt(opts.limit, 10),
+    json: opts.json === true,
+    refresh: opts.refresh !== false
+  });
+  process.exit(exit);
+});
+graph.command("impact <path-or-symbol>").description("Analyze impact radius with native graph calls/imports, CodeGraph, or code-map fallback").option("--engine <engine>", "Graph engine: auto, native, codegraph, or codemap", "auto").option("--map <path>", "Code-map YAML path for fallback", ".cdd/code-map.yml").option("--limit <n>", "Maximum fallback dependent files to print", "20").option("--depth <n>", "CodeGraph traversal depth (fallback is direct only)", "2").option("--json", "Print machine-readable JSON", false).option("--no-refresh", "Do not auto-regenerate stale or missing fallback code-map").action(async (term, opts) => {
+  const { graphImpact: graphImpact3 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+  const exit = await graphImpact3(term, {
+    engine: opts.engine,
+    map: opts.map,
+    limit: parseInt(opts.limit, 10),
+    depth: parseInt(opts.depth, 10),
+    json: opts.json === true,
+    refresh: opts.refresh !== false
+  });
+  process.exit(exit);
+});
+graph.command("context <task>").description("Build task context with native graph, CodeGraph, or code-map candidates").option("--engine <engine>", "Graph engine: auto, native, codegraph, or codemap", "auto").option("--map <path>", "Code-map YAML path for fallback", ".cdd/code-map.yml").option("--max-nodes <n>", "Maximum context candidates/nodes", "20").option("--json", "Print machine-readable JSON", false).option("--no-refresh", "Do not auto-regenerate stale or missing fallback code-map").action(async (task, opts) => {
+  const { graphContext: graphContext3 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+  const exit = await graphContext3(task, {
+    engine: opts.engine,
+    map: opts.map,
+    maxNodes: parseInt(opts.maxNodes, 10),
+    json: opts.json === true,
+    refresh: opts.refresh !== false
+  });
+  process.exit(exit);
+});
 program.command("gate <change-id>").description("Run delivery-quality gate for a change (required artifacts, tasks, tier, contracts)").option("--strict", "Treat pending tasks (except section 7) as errors", false).action(async (id, opts) => {
   await gate(id, { strict: opts.strict });
 });