@launchsecure/launch-kit 0.0.12 → 0.0.14

package/dist/server/chart-serve.js

@@ -54,46 +54,19 @@ var init_config = __esm({
   }
 });
 
-// src/server/chart-serve.ts
-var chart_serve_exports = {};
-__export(chart_serve_exports, {
-  runServeCli: () => runServeCli,
-  startChartServer: () => startChartServer
-});
-module.exports = __toCommonJS(chart_serve_exports);
-var import_node_http = __toESM(require("node:http"));
-var import_node_fs13 = __toESM(require("node:fs"));
-var import_node_path15 = __toESM(require("node:path"));
-
-// src/server/graph/index.ts
-var import_node_fs11 = require("node:fs");
-var import_node_path13 = require("node:path");
-
-// src/server/graph/core/graph-builder.ts
-var import_node_fs8 = require("node:fs");
-var import_node_path9 = require("node:path");
-init_config();
-
-// src/server/graph/core/parser-registry.ts
-var import_node_path8 = require("node:path");
-
-// src/server/graph/parsers/ui/react-nextjs.ts
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
-
 // src/server/graph/core/ts-extractor.ts
-var import_node_fs2 = require("node:fs");
-var import_node_path2 = require("node:path");
-var tsxLanguage;
-var parserInstance;
-var initPromise;
-var initialized = false;
-var queriesDir = (() => {
-  const srcPath = (0, import_node_path2.join)((0, import_node_path2.dirname)(__filename), "..", "queries");
-  if (require("fs").existsSync(srcPath)) return srcPath;
-  return (0, import_node_path2.join)((0, import_node_path2.dirname)(__filename), "graph", "queries");
-})();
-var queryCache = /* @__PURE__ */ new Map();
+var ts_extractor_exports = {};
+__export(ts_extractor_exports, {
+  classifyFile: () => classifyFile,
+  createQuery: () => createQuery,
+  extractAuthWrappersTS: () => extractAuthWrappersTS,
+  extractDbCallsTS: () => extractDbCallsTS,
+  extractDeep: () => extractDeep,
+  initTreeSitter: () => initTreeSitter,
+  parseCodeTS: () => parseCodeTS,
+  parseFileTS: () => parseFileTS,
+  setExtractorConfig: () => setExtractorConfig
+});
 async function initTreeSitter() {
   if (initialized) return;
   if (initPromise) return initPromise;
@@ -117,31 +90,25 @@ function getQuery(name) {
   ensureInit();
   const cached = queryCache.get(name);
   if (cached) return cached;
-  const scmPath = (0, import_node_path2.join)(queriesDir, `${name}.scm`);
-  const scm = (0, import_node_fs2.readFileSync)(scmPath, "utf-8");
+  const scmPath = (0, import_node_path3.join)(queriesDir, `${name}.scm`);
+  const scm = (0, import_node_fs3.readFileSync)(scmPath, "utf-8");
   const query = tsxLanguage.query(scm);
   queryCache.set(name, query);
   return query;
 }
 function parseSource(absPath) {
   ensureInit();
-  const content = (0, import_node_fs2.readFileSync)(absPath, "utf-8");
+  const content = (0, import_node_fs3.readFileSync)(absPath, "utf-8");
   return parserInstance.parse(content);
 }
-var PRISMA_MUTATION_METHODS_BUILTIN = [
-  "create",
-  "createMany",
-  "createManyAndReturn",
-  "update",
-  "updateMany",
-  "updateManyAndReturn",
-  "upsert",
-  "delete",
-  "deleteMany"
-];
-var DB_IDENTIFIERS_FALLBACK = ["db", "prisma"];
-var extraDbIdentifiers = [];
-var extraMutationMethods = [];
+function parseCodeTS(code) {
+  ensureInit();
+  return parserInstance.parse(code);
+}
+function createQuery(pattern) {
+  ensureInit();
+  return tsxLanguage.query(pattern);
+}
 function setExtractorConfig(config) {
   extraDbIdentifiers = config.dbIdentifiers ?? [];
   extraMutationMethods = config.mutationMethods ?? [];
@@ -408,6 +375,24 @@ function extractDbCallsTS(absPath) {
   }
   return calls;
 }
+function classifyFile(absPath) {
+  const fileName = require("path").basename(absPath);
+  if (fileName.includes(".test.") || fileName.includes(".spec.") || fileName.includes("__test")) return "test";
+  if (fileName.includes(".stories.")) return "story";
+  const tree = parseSource(absPath);
+  const root = tree.rootNode;
+  const classifyQuery = getQuery("classify");
+  const captures = classifyQuery.captures(root);
+  const capNames = new Set(captures.map((c) => c.name));
+  if (capNames.has("http_export") || capNames.has("http_export_fn")) return "endpoint";
+  if (fileName === "page.tsx" && capNames.has("has_jsx")) return "page";
+  if (fileName === "layout.tsx" && capNames.has("has_jsx")) return "layout";
+  if (capNames.has("has_create_context") || capNames.has("has_create_context_bare")) return "context";
+  if (capNames.has("has_jsx")) return "component";
+  if (capNames.has("hook_decl") || capNames.has("hook_const")) return "hook";
+  if (fileName.includes("config") || fileName.includes(".config.")) return "config";
+  return "lib";
+}
 function extractAuthWrappersTS(absPath) {
   const tree = parseSource(absPath);
   const root = tree.rootNode;
@@ -578,17 +563,108 @@ function extractDeep(absPath) {
   }
   return { elements, stateVars, conditions, variables, responses, params };
 }
+var import_node_fs3, import_node_path3, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods;
+var init_ts_extractor = __esm({
+  "src/server/graph/core/ts-extractor.ts"() {
+    "use strict";
+    import_node_fs3 = require("node:fs");
+    import_node_path3 = require("node:path");
+    initialized = false;
+    queriesDir = (() => {
+      const srcPath = (0, import_node_path3.join)((0, import_node_path3.dirname)(__filename), "..", "queries");
+      if (require("fs").existsSync(srcPath)) return srcPath;
+      return (0, import_node_path3.join)((0, import_node_path3.dirname)(__filename), "graph", "queries");
+    })();
+    queryCache = /* @__PURE__ */ new Map();
+    PRISMA_MUTATION_METHODS_BUILTIN = [
+      "create",
+      "createMany",
+      "createManyAndReturn",
+      "update",
+      "updateMany",
+      "updateManyAndReturn",
+      "upsert",
+      "delete",
+      "deleteMany"
+    ];
+    DB_IDENTIFIERS_FALLBACK = ["db", "prisma"];
+    extraDbIdentifiers = [];
+    extraMutationMethods = [];
+  }
+});
+
+// src/server/chart-serve.ts
+var chart_serve_exports = {};
+__export(chart_serve_exports, {
+  runServeCli: () => runServeCli,
+  startChartServer: () => startChartServer
+});
+module.exports = __toCommonJS(chart_serve_exports);
+var import_node_http = __toESM(require("node:http"));
+var import_node_fs17 = __toESM(require("node:fs"));
+var import_node_path19 = __toESM(require("node:path"));
+
+// src/server/graph/index.ts
+var import_node_fs14 = require("node:fs");
+var import_node_path16 = require("node:path");
+
+// src/server/graph/core/graph-builder.ts
+var import_node_fs11 = require("node:fs");
+var import_node_path12 = require("node:path");
+init_config();
+
+// src/server/graph/core/parser-registry.ts
+var import_node_path11 = require("node:path");
+
+// src/server/graph/parsers/ts/typescript-project.ts
+var import_node_fs4 = require("node:fs");
+var import_node_path4 = require("node:path");
+init_config();
+
+// src/server/graph/core/resolve-paths.ts
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+function resolveProjectPaths(rootDir, config) {
+  if (config.paths?.appDir) {
+    const appDir = (0, import_node_path2.join)(rootDir, config.paths.appDir);
+    const srcDir = config.paths.srcDir ? (0, import_node_path2.join)(rootDir, config.paths.srcDir) : (0, import_node_path2.dirname)(appDir);
+    return { srcDir, appDir, apiDir: (0, import_node_path2.join)(appDir, "api") };
+  }
+  const srcApp = (0, import_node_path2.join)(rootDir, "src", "app");
+  if ((0, import_node_fs2.existsSync)(srcApp)) {
+    return { srcDir: (0, import_node_path2.join)(rootDir, "src"), appDir: srcApp, apiDir: (0, import_node_path2.join)(srcApp, "api") };
+  }
+  const rootApp = (0, import_node_path2.join)(rootDir, "app");
+  if ((0, import_node_fs2.existsSync)(rootApp)) {
+    return { srcDir: rootDir, appDir: rootApp, apiDir: (0, import_node_path2.join)(rootApp, "api") };
+  }
+  return null;
+}
 
-// src/server/graph/parsers/ui/react-nextjs.ts
-var RENDER_TYPES = /* @__PURE__ */ new Set(["component", "ui", "layout", "context"]);
+// src/server/graph/parsers/ts/typescript-project.ts
+init_ts_extractor();
+var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
+var CLASSIFICATION_TO_LAYER = {
+  endpoint: "api",
+  page: "ui",
+  layout: "ui",
+  component: "ui",
+  ui: "ui",
+  hook: "ui",
+  context: "ui",
+  config: "ui",
+  lib: "ui",
+  "mcp-tool": "ui",
+  external: "ui"
+};
 function walk(dir, exts) {
   const results = [];
-  if (!(0, import_node_fs3.existsSync)(dir)) return results;
-  for (const entry of (0, import_node_fs3.readdirSync)(dir, { withFileTypes: true })) {
-    const full = (0, import_node_path3.join)(dir, entry.name);
+  if (!(0, import_node_fs4.existsSync)(dir)) return results;
+  for (const entry of (0, import_node_fs4.readdirSync)(dir, { withFileTypes: true })) {
+    const full = (0, import_node_path4.join)(dir, entry.name);
     if (entry.isDirectory()) {
       results.push(...walk(full, exts));
-    } else if (exts.includes((0, import_node_path3.extname)(entry.name))) {
+    } else if (exts.includes((0, import_node_path4.extname)(entry.name))) {
       results.push(full);
     }
   }
@@ -596,33 +672,33 @@ function walk(dir, exts) {
 }
 function walkWithIgnore(dir, exts, ignoreDirs) {
   const results = [];
-  if (!(0, import_node_fs3.existsSync)(dir)) return results;
-  for (const entry of (0, import_node_fs3.readdirSync)(dir, { withFileTypes: true })) {
+  if (!(0, import_node_fs4.existsSync)(dir)) return results;
+  for (const entry of (0, import_node_fs4.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (ignoreDirs.has(entry.name)) continue;
-      results.push(...walkWithIgnore((0, import_node_path3.join)(dir, entry.name), exts, ignoreDirs));
-    } else if (exts.includes((0, import_node_path3.extname)(entry.name))) {
-      results.push((0, import_node_path3.join)(dir, entry.name));
+      results.push(...walkWithIgnore((0, import_node_path4.join)(dir, entry.name), exts, ignoreDirs));
+    } else if (exts.includes((0, import_node_path4.extname)(entry.name))) {
+      results.push((0, import_node_path4.join)(dir, entry.name));
     }
   }
   return results;
 }
 function toNodeId(srcDir, absPath) {
-  return (0, import_node_path3.relative)(srcDir, absPath).replace(/\\/g, "/");
+  return (0, import_node_path4.relative)(srcDir, absPath).replace(/\\/g, "/");
 }
 function resolveImport(srcDir, specifier) {
   if (!specifier.startsWith("@/")) return null;
   const rel = specifier.slice(2);
-  const base = (0, import_node_path3.join)(srcDir, rel);
-  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path3.join)(base, "index.ts"), (0, import_node_path3.join)(base, "index.tsx")]) {
-    if ((0, import_node_fs3.existsSync)(c) && (0, import_node_fs3.statSync)(c).isFile()) return c;
+  const base = (0, import_node_path4.join)(srcDir, rel);
+  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path4.join)(base, "index.ts"), (0, import_node_path4.join)(base, "index.tsx")]) {
+    if ((0, import_node_fs4.existsSync)(c) && (0, import_node_fs4.statSync)(c).isFile()) return c;
   }
   return null;
 }
 function resolveRelativeImport(fromFile, specifier) {
-  const base = (0, import_node_path3.join)((0, import_node_path3.dirname)(fromFile), specifier);
-  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path3.join)(base, "index.ts"), (0, import_node_path3.join)(base, "index.tsx")]) {
-    if ((0, import_node_fs3.existsSync)(c) && (0, import_node_fs3.statSync)(c).isFile()) return c;
+  const base = (0, import_node_path4.join)((0, import_node_path4.dirname)(fromFile), specifier);
+  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path4.join)(base, "index.ts"), (0, import_node_path4.join)(base, "index.tsx")]) {
+    if ((0, import_node_fs4.existsSync)(c) && (0, import_node_fs4.statSync)(c).isFile()) return c;
   }
   return null;
 }
@@ -643,7 +719,7 @@ function resolveBarrelMap(barrelAbsPath, parsedByPath, memo, visiting) {
     const resolved = resolveRelativeImport(barrelAbsPath, re.from);
     if (!resolved) continue;
     if (re.isWildcard) {
-      const targetBn = (0, import_node_path3.basename)(resolved);
+      const targetBn = (0, import_node_path4.basename)(resolved);
       const targetIsBarrel = targetBn === "index.ts" || targetBn === "index.tsx";
       if (targetIsBarrel) {
         const nested = resolveBarrelMap(resolved, parsedByPath, memo, visiting);
@@ -670,31 +746,21 @@ function buildAllBarrelMaps(srcDir, parsedByPath) {
   const barrels = /* @__PURE__ */ new Map();
   const memo = /* @__PURE__ */ new Map();
   for (const [absPath, parsed] of parsedByPath) {
-    const bn = (0, import_node_path3.basename)(absPath);
+    const bn = (0, import_node_path4.basename)(absPath);
     if (bn !== "index.ts" && bn !== "index.tsx") continue;
     if (parsed.reExports.length === 0) continue;
     const map = resolveBarrelMap(absPath, parsedByPath, memo, /* @__PURE__ */ new Set());
     if (map.size > 0) {
-      const barrelId = (0, import_node_path3.relative)(srcDir, (0, import_node_path3.dirname)(absPath)).replace(/\\/g, "/");
+      const barrelId = (0, import_node_path4.relative)(srcDir, (0, import_node_path4.dirname)(absPath)).replace(/\\/g, "/");
       barrels.set(barrelId, map);
     }
   }
   return barrels;
 }
-function classifyType(id) {
-  if (id.endsWith("/page.tsx")) return "page";
-  if (id.endsWith("/layout.tsx")) return "layout";
-  if (id.startsWith("client/components/ui/")) return "ui";
-  if (id.startsWith("client/components/")) return "component";
-  if (id.startsWith("client/hooks/")) return "hook";
-  if (/client\/lib\/.*-context\./.test(id)) return "context";
-  if (id.startsWith("client/lib/")) return id.includes("config") ? "config" : "util";
-  if (id.startsWith("client/api/")) return "util";
-  if (id.startsWith("server/mcp/")) return "mcp-tool";
-  if (id.startsWith("server/lib/")) return "lib";
-  if (id.startsWith("server/")) return "lib";
-  if (id.startsWith("lib/") || id.startsWith("config/")) return "lib";
-  return "component";
+function classifyType(absPath, id) {
+  const contentType = classifyFile(absPath);
+  if (contentType === "lib" && id.startsWith("server/mcp/")) return "mcp-tool";
+  return contentType;
 }
 function extractRoute(id) {
   if (!id.endsWith("/page.tsx")) return null;
@@ -706,7 +772,18 @@ function extractRoute(id) {
   return route || "/";
 }
 function nameFromFilename(absPath) {
-  return (0, import_node_path3.basename)(absPath, (0, import_node_path3.extname)(absPath)).replace(/[-_](\w)/g, (_, c) => c.toUpperCase()).replace(/^(\w)/, (_, c) => c.toUpperCase());
+  return (0, import_node_path4.basename)(absPath, (0, import_node_path4.extname)(absPath)).replace(/[-_](\w)/g, (_, c) => c.toUpperCase()).replace(/^(\w)/, (_, c) => c.toUpperCase());
+}
+function filePathToApiRoute(apiDir, absPath) {
+  let route = "/" + (0, import_node_path4.relative)(apiDir, absPath).replace(/\\/g, "/").replace(/\/route\.tsx?$/, "");
+  route = route.replace(/\[([^\]]+)\]/g, ":$1");
+  route = route.replace(/\/+/g, "/");
+  if (route === "/") return "/api";
+  return "/api" + route;
+}
+function camelToPascal(s) {
+  if (!s) return s;
+  return s.charAt(0).toUpperCase() + s.slice(1);
 }
 function resolveTemplateLiteralRoute(template, routeToNodeId) {
   const parameterized = template.replace(/\$\{([^}]+)\}/g, (_, expr) => {
@@ -787,7 +864,7 @@ function matchRouteToPage(route, routeToNodeId) {
   if (routeToNodeId.has(normalized)) return routeToNodeId.get(normalized);
   return null;
 }
-function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap, barrelMaps, routeToNodeId) {
+function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, barrelMaps, routeToNodeId) {
   const edges = [];
   const flagged = [];
   const seen = /* @__PURE__ */ new Set();
@@ -799,13 +876,10 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap,
     if (label) edge.label = label;
     edges.push(edge);
   }
-  function edgeTypeFor(targetId, isTypeOnlyImport, importedNames) {
+  function edgeTypeFor(isTypeOnlyImport, importedNames) {
     if (isTypeOnlyImport) return "imports";
-    const targetType = nodeTypeMap.get(targetId);
-    if (targetType && RENDER_TYPES.has(targetType)) {
-      const anyRendered = importedNames.some((n) => parsed.jsxElements.has(n));
-      if (anyRendered) return "renders";
-    }
+    const anyRendered = importedNames.some((n) => parsed.jsxElements.has(n));
+    if (anyRendered) return "renders";
     return "imports";
   }
   for (const imp of parsed.imports) {
@@ -827,14 +901,14 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap,
         }
         for (const [targetId, targetNames] of byTarget) {
           const allType = isTypeOnly || targetNames.every((n) => typeNames.has(n));
-          addEdge(targetId, edgeTypeFor(targetId, allType, targetNames));
+          addEdge(targetId, edgeTypeFor(allType, targetNames));
         }
       } else {
         const resolved = resolveImport(srcDir, specifier);
         if (resolved) {
           const targetId = toNodeId(srcDir, resolved);
           if (nodeIdSet.has(targetId) && !targetId.endsWith("/index.ts") && !targetId.endsWith("/index.tsx")) {
-            addEdge(targetId, edgeTypeFor(targetId, isTypeOnly, names));
+            addEdge(targetId, edgeTypeFor(isTypeOnly, names));
           }
         }
       }
@@ -843,7 +917,7 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap,
       if (resolved) {
         const targetId = toNodeId(srcDir, resolved);
         if (nodeIdSet.has(targetId) && !targetId.endsWith("/index.ts") && !targetId.endsWith("/index.tsx")) {
-          addEdge(targetId, edgeTypeFor(targetId, isTypeOnly, names));
+          addEdge(targetId, edgeTypeFor(isTypeOnly, names));
         }
       }
     }
@@ -885,74 +959,113 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap,
   }
   return { edges, flagged };
 }
+function hasNextConfig(rootDir) {
+  return (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.ts")) || (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.js")) || (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.mjs"));
+}
 function detect(rootDir) {
-  return (0, import_node_fs3.existsSync)((0, import_node_path3.join)(rootDir, "src", "app")) && (0, import_node_fs3.existsSync)((0, import_node_path3.join)(rootDir, "next.config.ts")) || (0, import_node_fs3.existsSync)((0, import_node_path3.join)(rootDir, "next.config.js")) || (0, import_node_fs3.existsSync)((0, import_node_path3.join)(rootDir, "next.config.mjs"));
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  return paths !== null && hasNextConfig(rootDir);
 }
 function generate(rootDir) {
-  const srcDir = (0, import_node_path3.join)(rootDir, "src");
-  const appFiles = walk((0, import_node_path3.join)(srcDir, "app"), [".tsx", ".ts"]).filter(
-    (f) => (0, import_node_path3.basename)(f) !== "route.ts" && (0, import_node_path3.basename)(f) !== "route.tsx"
-  );
-  const clientFiles = walk((0, import_node_path3.join)(srcDir, "client"), [".tsx", ".ts"]);
-  const serverFiles = walk((0, import_node_path3.join)(srcDir, "server"), [".ts", ".tsx"]).filter(
-    (f) => (0, import_node_path3.basename)(f) !== "route.ts" && (0, import_node_path3.basename)(f) !== "route.tsx"
-  );
-  const libFiles = walk((0, import_node_path3.join)(srcDir, "lib"), [".ts", ".tsx"]);
-  const configFiles = walk((0, import_node_path3.join)(srcDir, "config"), [".ts", ".tsx"]);
+  const config = loadConfig(rootDir);
+  const paths = resolveProjectPaths(rootDir, config);
+  const srcDir = paths.srcDir;
+  const apiDir = paths.apiDir;
+  const appFiles = walk(paths.appDir, [".tsx", ".ts"]);
+  const clientFiles = walk((0, import_node_path4.join)(srcDir, "client"), [".tsx", ".ts"]);
+  const serverFiles = walk((0, import_node_path4.join)(srcDir, "server"), [".ts", ".tsx"]);
+  const libFiles = walk((0, import_node_path4.join)(srcDir, "lib"), [".ts", ".tsx"]);
+  const configFiles = walk((0, import_node_path4.join)(srcDir, "config"), [".ts", ".tsx"]);
   const allDiscovered = [...appFiles, ...clientFiles, ...serverFiles, ...libFiles, ...configFiles];
   const parsedByPath = /* @__PURE__ */ new Map();
   for (const absPath of allDiscovered) {
     parsedByPath.set(absPath, parseFileTS(absPath));
   }
   const barrelMaps = buildAllBarrelMaps(srcDir, parsedByPath);
-  const fileSet = allDiscovered.filter((f) => !(0, import_node_path3.basename)(f).startsWith("index."));
-  const nodes = [];
+  const uiNodes = [];
+  const apiNodes = [];
   const nodeIdSet = /* @__PURE__ */ new Set();
-  const nodeTypeMap = /* @__PURE__ */ new Map();
   const routeToNodeId = /* @__PURE__ */ new Map();
+  const fileSet = allDiscovered.filter((f) => !(0, import_node_path4.basename)(f).startsWith("index."));
   for (const absPath of fileSet) {
     const id = toNodeId(srcDir, absPath);
-    const type = classifyType(id);
+    const type = classifyType(absPath, id);
+    if (type === "test" || type === "story") continue;
     const parsed = parsedByPath.get(absPath);
     const name = parsed.name || nameFromFilename(absPath);
-    const route = extractRoute(id);
-    const deep = extractDeep(absPath);
-    nodes.push({
-      id,
-      type,
-      name,
-      route,
-      exports: parsed.exports,
-      elements: deep.elements,
-      stateVars: deep.stateVars,
-      conditions: deep.conditions,
-      variables: deep.variables
-    });
+    const layer = CLASSIFICATION_TO_LAYER[type] ?? "ui";
     nodeIdSet.add(id);
-    nodeTypeMap.set(id, type);
-    if (route) routeToNodeId.set(route, id);
+    if (layer === "api") {
+      const methods = [];
+      for (const exp of parsed.exports) {
+        if (HTTP_METHODS.has(exp)) methods.push(exp);
+      }
+      const dbCalls = extractDbCallsTS(absPath);
+      const authWrappers = extractAuthWrappersTS(absPath);
+      const deep = extractDeep(absPath);
+      const routePath = (0, import_node_fs4.existsSync)(apiDir) ? filePathToApiRoute(apiDir, absPath) : `/api/${id.replace(/\/route\.tsx?$/, "")}`;
+      const mutations = dbCalls.filter((c) => c.isMutation);
+      const mutates = mutations.length > 0;
+      const authStrategy = [...authWrappers];
+      apiNodes.push({
+        id,
+        type: "endpoint",
+        name: routePath,
+        layer: "api",
+        path: routePath,
+        methods,
+        handler: id,
+        mutates,
+        auth: authStrategy.length > 0 ? authStrategy : ["public"],
+        db_models: [...new Set(dbCalls.map((c) => c.model))],
+        db_operations: [...new Set(dbCalls.map((c) => `${c.model}.${c.method}`))],
+        conditions: deep.conditions,
+        variables: deep.variables,
+        responses: deep.responses,
+        params: deep.params,
+        _dbCalls: dbCalls
+        // temp: used for cross-ref building below
+      });
+    } else {
+      const route = extractRoute(id);
+      const deep = extractDeep(absPath);
+      uiNodes.push({
+        id,
+        type,
+        name,
+        layer: "ui",
+        route,
+        exports: parsed.exports,
+        elements: deep.elements,
+        stateVars: deep.stateVars,
+        conditions: deep.conditions,
+        variables: deep.variables
+      });
+      if (route) routeToNodeId.set(route, id);
+    }
   }
-  const allEdges = [];
-  const allFlagged = [];
+  const uiEdges = [];
+  const uiFlagged = [];
   for (const absPath of fileSet) {
-    const sourceId = toNodeId(srcDir, absPath);
+    const id = toNodeId(srcDir, absPath);
+    if (!nodeIdSet.has(id)) continue;
     const parsed = parsedByPath.get(absPath);
     const { edges, flagged } = extractEdges(
       srcDir,
       absPath,
-      sourceId,
+      id,
       parsed,
       nodeIdSet,
-      nodeTypeMap,
       barrelMaps,
       routeToNodeId
     );
-    allEdges.push(...edges);
-    allFlagged.push(...flagged);
+    uiEdges.push(...edges);
+    uiFlagged.push(...flagged);
   }
   const fetchCallEntries = [];
   for (const absPath of fileSet) {
     const sourceId = toNodeId(srcDir, absPath);
+    if (!nodeIdSet.has(sourceId)) continue;
     const parsed = parsedByPath.get(absPath);
     if (parsed.fetchCalls.length === 0) continue;
     fetchCallEntries.push({
@@ -990,11 +1103,11 @@ function generate(rootDir) {
     } catch {
       continue;
     }
-    const externalId = (0, import_node_path3.relative)(rootDir, absPath).replace(/\\/g, "/");
+    const externalId = (0, import_node_path4.relative)(rootDir, absPath).replace(/\\/g, "/");
     const edgesFromThis = [];
     const seen = /* @__PURE__ */ new Set();
     for (const imp of parsed.imports) {
-      const { specifier, isTypeOnly, names } = imp;
+      const { specifier, names } = imp;
       let resolved = null;
       if (specifier.startsWith("@/")) {
         const relToSrc = specifier.slice(2);
@@ -1020,25 +1133,52 @@ function generate(rootDir) {
       const targetId = toNodeId(srcDir, resolved);
       if (!nodeIdSet.has(targetId)) continue;
       if (targetId.endsWith("/index.ts") || targetId.endsWith("/index.tsx")) continue;
-      const key = `${externalId}\u2192${targetId}\u2192${isTypeOnly ? "type" : "value"}`;
+      const key = `${externalId}\u2192${targetId}`;
       if (seen.has(key)) continue;
       seen.add(key);
       edgesFromThis.push({ source: externalId, target: targetId, type: "imports" });
     }
     if (edgesFromThis.length === 0) continue;
-    nodes.push({
+    uiNodes.push({
       id: externalId,
       type: "external",
       name: parsed.name || nameFromFilename(absPath),
+      layer: "ui",
       route: null,
       exports: parsed.exports
     });
     nodeIdSet.add(externalId);
-    nodeTypeMap.set(externalId, "external");
-    allEdges.push(...edgesFromThis);
+    uiEdges.push(...edgesFromThis);
+  }
+  const apiCrossRefs = [];
+  for (const node of apiNodes) {
+    const dbCalls = node._dbCalls;
+    if (!dbCalls) continue;
+    const seenModels = /* @__PURE__ */ new Set();
+    for (const call of dbCalls) {
+      if (seenModels.has(call.model)) continue;
+      seenModels.add(call.model);
+      apiCrossRefs.push({
+        source: node.id,
+        target: camelToPascal(call.model),
+        type: call.isMutation ? "mutates" : "reads",
+        layer: "db"
+      });
+    }
+    delete node._dbCalls;
+  }
+  const apiNodeIds = new Set(apiNodes.map((n) => n.id));
+  const apiEdges = [];
+  const uiOnlyEdges = [];
+  for (const edge of uiEdges) {
+    if (apiNodeIds.has(edge.source)) {
+      apiEdges.push(edge);
+    } else {
+      uiOnlyEdges.push(edge);
+    }
   }
   const flaggedSet = /* @__PURE__ */ new Set();
-  const dedupedFlagged = allFlagged.filter((f) => {
+  const dedupedFlagged = uiFlagged.filter((f) => {
     const key = `${f.source}\u2192${f.target}\u2192${f.label}`;
     if (flaggedSet.has(key)) return false;
     flaggedSet.add(key);
@@ -1055,10 +1195,12 @@ function generate(rootDir) {
     hook: 7,
     lib: 8
   };
-  nodes.sort((a, b) => (typePriority[a.type] ?? 99) - (typePriority[b.type] ?? 99) || a.id.localeCompare(b.id));
-  allEdges.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
-  const byType = (t) => nodes.filter((n) => n.type === t).length;
-  const stats = {
+  uiNodes.sort((a, b) => (typePriority[a.type] ?? 99) - (typePriority[b.type] ?? 99) || a.id.localeCompare(b.id));
+  uiOnlyEdges.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  apiNodes.sort((a, b) => (a.path ?? "").localeCompare(b.path ?? ""));
+  apiCrossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  const byType = (t) => uiNodes.filter((n) => n.type === t).length;
+  const uiStats = {
     total_pages: byType("page"),
     total_layouts: byType("layout"),
     total_components: byType("component"),
@@ -1069,182 +1211,99 @@ function generate(rootDir) {
     total_utils: byType("util"),
     total_libs: byType("lib"),
     total_external: byType("external"),
-    total_edges: allEdges.length,
+    total_edges: uiOnlyEdges.length,
     total_flagged: dedupedFlagged.length
   };
-  return {
+  const stripLayer = (nodes) => nodes.map(({ layer: _, ...rest }) => rest);
+  const result = /* @__PURE__ */ new Map();
+  result.set("ui", {
     metadata: {
       generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
       scope: "main-app-only",
       app_root: "src/",
       layer: "ui",
-      parser: "react-nextjs-ast",
-      ...stats,
+      parser: "typescript-project",
+      ...uiStats,
       notes: "Auto-generated via TypeScript AST \u2014 edges derived from actual imports, renders from JSX usage, navigations from router/Link calls."
     },
-    nodes,
-    edges: allEdges,
+    nodes: stripLayer(uiNodes),
+    edges: uiOnlyEdges,
     cross_refs: [],
     contradictions: [],
     warnings: [],
     flagged_edges: dedupedFlagged,
     patterns: {
-      total_nodes: nodes.length,
-      by_type: stats,
+      total_nodes: uiNodes.length,
+      by_type: uiStats,
       by_edge_type: {
-        renders: allEdges.filter((e) => e.type === "renders").length,
-        imports: allEdges.filter((e) => e.type === "imports").length,
-        navigates: allEdges.filter((e) => e.type === "navigates").length
+        renders: uiOnlyEdges.filter((e) => e.type === "renders").length,
+        imports: uiOnlyEdges.filter((e) => e.type === "imports").length,
+        navigates: uiOnlyEdges.filter((e) => e.type === "navigates").length
       },
       fetch_calls: fetchCallEntries
     }
-  };
-}
-var reactNextjsParser = {
-  id: "react-nextjs",
-  layer: "ui",
-  detect,
-  generate
-};
-
-// src/server/graph/parsers/api/nextjs-routes.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path4 = require("node:path");
-var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
-function walk2(dir) {
-  const results = [];
-  if (!(0, import_node_fs4.existsSync)(dir)) return results;
-  for (const entry of (0, import_node_fs4.readdirSync)(dir, { withFileTypes: true })) {
-    const full = (0, import_node_path4.join)(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...walk2(full));
-    } else if (entry.name === "route.ts" || entry.name === "route.tsx") {
-      results.push(full);
+  });
+  if (apiNodes.length > 0) {
+    const mutatorNodes = apiNodes.filter((n) => n.mutates).length;
+    const readOnlyNodes = apiNodes.filter((n) => !n.mutates).length;
+    const authUsage = {};
+    let endpointsWithAuth = 0;
+    for (const n of apiNodes) {
+      const auth = n.auth;
+      if (auth.length > 0 && auth[0] !== "public") {
+        endpointsWithAuth++;
+        for (const w of auth) {
+          authUsage[w] = (authUsage[w] ?? 0) + 1;
+        }
+      }
     }
-  }
-  return results;
-}
-function filePathToRoute(apiDir, absPath) {
-  let route = "/" + (0, import_node_path4.relative)(apiDir, absPath).replace(/\\/g, "/").replace(/\/route\.tsx?$/, "");
-  route = route.replace(/\[([^\]]+)\]/g, ":$1");
-  route = route.replace(/\/+/g, "/");
-  if (route === "/") return "/api";
-  return "/api" + route;
-}
-function camelToPascal(s) {
-  if (!s) return s;
-  return s.charAt(0).toUpperCase() + s.slice(1);
-}
-function detect2(rootDir) {
-  return (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "src", "app", "api"));
-}
-function generate2(rootDir) {
-  const apiDir = (0, import_node_path4.join)(rootDir, "src", "app", "api");
-  const routeFiles = walk2(apiDir);
-  const nodes = [];
-  const edges = [];
-  const crossRefs = [];
-  const mutatorCount = {};
-  const authUsage = {};
-  let endpointsWithAuth = 0;
-  let endpointsWithDbAccess = 0;
-  for (const absPath of routeFiles) {
-    const parsed = parseFileTS(absPath);
-    const dbCalls = extractDbCallsTS(absPath);
-    const authWrappers = extractAuthWrappersTS(absPath);
-    const methods = [];
-    for (const exp of parsed.exports) {
-      if (HTTP_METHODS.has(exp)) methods.push(exp);
-    }
-    const routePath = filePathToRoute(apiDir, absPath);
-    const relPath = (0, import_node_path4.relative)(rootDir, absPath).replace(/\\/g, "/");
-    const mutations = dbCalls.filter((c) => c.isMutation);
-    const reads = dbCalls.filter((c) => !c.isMutation);
-    const mutates = mutations.length > 0;
-    if (mutates) {
-      for (const m of mutations) {
-        mutatorCount[m.method] = (mutatorCount[m.method] ?? 0) + 1;
-      }
-    }
-    if (dbCalls.length > 0) endpointsWithDbAccess++;
-    const authStrategy = [];
-    for (const w of authWrappers) {
-      authStrategy.push(w);
-      authUsage[w] = (authUsage[w] ?? 0) + 1;
-    }
-    if (authStrategy.length > 0) endpointsWithAuth++;
-    const deep = extractDeep(absPath);
-    nodes.push({
-      id: relPath,
-      type: "endpoint",
-      name: routePath,
-      path: routePath,
-      methods,
-      handler: relPath,
-      // Behavioral classification from handler body (AST-derived).
-      mutates,
-      auth: authStrategy.length > 0 ? authStrategy : ["public"],
-      db_models: [...new Set(dbCalls.map((c) => c.model))],
-      db_operations: [...new Set(dbCalls.map((c) => `${c.model}.${c.method}`))],
-      // Deep extraction fields
-      conditions: deep.conditions,
-      variables: deep.variables,
-      responses: deep.responses,
-      params: deep.params
-    });
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
-      if (seenModels.has(call.model)) continue;
-      seenModels.add(call.model);
-      crossRefs.push({
-        source: relPath,
-        target: camelToPascal(call.model),
-        type: call.isMutation ? "mutates" : "reads",
-        layer: "db"
-      });
+    const mutatorCount = {};
+    for (const n of apiNodes) {
+      const ops = n.db_operations;
+      for (const op of ops) {
+        const method = op.split(".")[1];
+        if (method) mutatorCount[method] = (mutatorCount[method] ?? 0) + 1;
+      }
     }
+    result.set("api", {
+      metadata: {
+        generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+        scope: "main-app-only",
+        stack: "nextjs-app-router",
+        layer: "api",
+        parser: "typescript-project",
+        total_endpoints: apiNodes.length,
+        total_methods: apiNodes.reduce((sum, n) => sum + n.methods.length, 0),
+        endpoints_with_auth: endpointsWithAuth,
+        endpoints_with_db_access: apiNodes.filter((n) => n.db_models.length > 0).length,
+        mutator_endpoints: mutatorNodes,
+        read_only_endpoints: readOnlyNodes
+      },
+      nodes: stripLayer(apiNodes),
+      edges: apiEdges,
+      cross_refs: apiCrossRefs,
+      contradictions: [],
+      warnings: [],
+      flagged_edges: [],
+      patterns: {
+        total_endpoints: apiNodes.length,
+        methods_breakdown: [...HTTP_METHODS].reduce((acc, m) => {
+          acc[m] = apiNodes.filter((n) => n.methods.includes(m)).length;
+          return acc;
+        }, {}),
+        auth_strategies: authUsage,
+        mutation_operations: mutatorCount,
+        mutator_vs_reader: { mutators: mutatorNodes, readers: readOnlyNodes }
+      }
+    });
   }
-  nodes.sort((a, b) => a.path.localeCompare(b.path));
-  crossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
-  const mutatorNodes = nodes.filter((n) => n.mutates).length;
-  const readOnlyNodes = nodes.filter((n) => !n.mutates).length;
-  return {
-    metadata: {
-      generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
-      scope: "main-app-only",
-      stack: "nextjs-app-router",
-      layer: "api",
-      parser: "nextjs-routes-ast",
-      total_endpoints: nodes.length,
-      total_methods: nodes.reduce((sum, n) => sum + n.methods.length, 0),
-      endpoints_with_auth: endpointsWithAuth,
-      endpoints_with_db_access: endpointsWithDbAccess,
-      mutator_endpoints: mutatorNodes,
-      read_only_endpoints: readOnlyNodes
-    },
-    nodes,
-    edges,
-    cross_refs: crossRefs,
-    contradictions: [],
-    warnings: [],
-    flagged_edges: [],
-    patterns: {
-      total_endpoints: nodes.length,
-      methods_breakdown: [...HTTP_METHODS].reduce((acc, m) => {
-        acc[m] = nodes.filter((n) => n.methods.includes(m)).length;
-        return acc;
-      }, {}),
-      auth_strategies: authUsage,
-      mutation_operations: mutatorCount,
-      mutator_vs_reader: { mutators: mutatorNodes, readers: readOnlyNodes }
-    }
-  };
+  return result;
 }
-var nextjsRoutesParser = {
-  id: "nextjs-routes",
-  layer: "api",
-  detect: detect2,
-  generate: generate2
+var typescriptProjectParser = {
+  id: "typescript-project",
+  layers: ["ui", "api"],
+  detect,
+  generate
 };
 
 // src/server/graph/parsers/db/prisma-schema.ts
@@ -1339,10 +1398,10 @@ function parseEnums(content) {
   }
   return nodes;
 }
-function detect3(rootDir) {
+function detect2(rootDir) {
   return (0, import_node_fs5.existsSync)((0, import_node_path5.join)(rootDir, "prisma", "schema.prisma"));
 }
-function generate3(rootDir) {
+function generate2(rootDir) {
   const schemaPath = (0, import_node_path5.join)(rootDir, "prisma", "schema.prisma");
   const content = (0, import_node_fs5.readFileSync)(schemaPath, "utf-8");
   const { nodes: modelNodes, relations } = parseModels(content);
@@ -1396,6 +1455,424 @@ function generate3(rootDir) {
 var prismaSchemaParser = {
   id: "prisma-schema",
   layer: "db",
+  detect: detect2,
+  generate: generate2
+};
+
+// src/server/graph/parsers/db/sql-migrations.ts
+var import_node_fs6 = require("node:fs");
+var import_node_path6 = require("node:path");
+var PG_TO_PRISMA = {
+  "TEXT": "String",
+  "VARCHAR": "String",
+  "CHAR": "String",
+  "INTEGER": "Int",
+  "INT": "Int",
+  "SMALLINT": "Int",
+  "BIGINT": "BigInt",
+  "SERIAL": "Int",
+  "BOOLEAN": "Boolean",
+  "BOOL": "Boolean",
+  "TIMESTAMP(3)": "DateTime",
+  "TIMESTAMP": "DateTime",
+  "TIMESTAMPTZ": "DateTime",
+  "DATE": "DateTime",
+  "DOUBLE PRECISION": "Float",
+  "FLOAT": "Float",
+  "REAL": "Float",
+  "DECIMAL": "Decimal",
+  "NUMERIC": "Decimal",
+  "JSONB": "Json",
+  "JSON": "Json",
+  "BYTEA": "Bytes",
+  "UUID": "String",
+  "TEXT[]": "String[]"
+};
+function pgTypeToPrisma(pgType) {
+  const upper = pgType.toUpperCase().trim();
+  return PG_TO_PRISMA[upper] ?? upper;
+}
+function parseCreateTable(sql, state) {
+  const re = /CREATE\s+TABLE\s+"(\w+)"\s*\(([\s\S]*?)\);/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    const tableName = m[1];
+    const body = m[2];
+    const columns = /* @__PURE__ */ new Map();
+    let primaryCol = null;
+    for (const line of body.split("\n")) {
+      const trimmed = line.trim().replace(/,\s*$/, "");
+      if (!trimmed || trimmed.startsWith("--")) continue;
+      const pkMatch = trimmed.match(/CONSTRAINT\s+"[^"]+"\s+PRIMARY\s+KEY\s*\("(\w+)"\)/i);
+      if (pkMatch) {
+        primaryCol = pkMatch[1];
+        continue;
+      }
+      if (/^\s*CONSTRAINT\s/i.test(trimmed)) continue;
+      const colMatch = trimmed.match(/^"(\w+)"\s+(.+)/);
+      if (!colMatch) continue;
+      const colName = colMatch[1];
+      let rest = colMatch[2];
+      const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
+      const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)(?:\s*,?\s*$)/i);
+      const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
+      let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim().replace(/,\s*$/, "").trim();
+      columns.set(colName, {
+        name: colName,
+        type: colType,
+        nullable: !isNotNull,
+        primary: false,
+        unique: false,
+        default: defaultVal
+      });
+    }
+    if (primaryCol && columns.has(primaryCol)) {
+      columns.get(primaryCol).primary = true;
+    }
+    state.tables.set(tableName, { name: tableName, columns });
+  }
+}
+function parseCreateEnum(sql, state) {
+  const re = /CREATE\s+TYPE\s+"(\w+)"\s+AS\s+ENUM\s*\(([^)]+)\)/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    const enumName = m[1];
+    const valuesStr = m[2];
+    const values = new Set(
+      valuesStr.split(",").map((v) => v.trim().replace(/^'(.*)'$/, "$1")).filter(Boolean)
+    );
+    state.enums.set(enumName, { name: enumName, values });
+  }
+}
+function parseAlterTable(sql, state) {
+  const addColRe = /ALTER\s+TABLE\s+"(\w+)"\s+ADD\s+COLUMN\s+"(\w+)"\s+(.+?);/gi;
+  let m;
+  while ((m = addColRe.exec(sql)) !== null) {
+    const tableName = m[1];
+    const colName = m[2];
+    let rest = m[3];
+    const table = state.tables.get(tableName);
+    if (!table) continue;
+    const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
+    const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)$/i);
+    const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
+    let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim();
+    table.columns.set(colName, {
+      name: colName,
+      type: colType,
+      nullable: !isNotNull,
+      primary: false,
+      unique: false,
+      default: defaultVal
+    });
+  }
+  const dropColRe = /ALTER\s+TABLE\s+"(\w+)"\s+DROP\s+COLUMN\s+"(\w+)"/gi;
+  while ((m = dropColRe.exec(sql)) !== null) {
+    const table = state.tables.get(m[1]);
+    if (table) table.columns.delete(m[2]);
+  }
+  const fkRe = /ALTER\s+TABLE\s+"(\w+)"\s+ADD\s+CONSTRAINT\s+"([^"]+)"\s+FOREIGN\s+KEY\s*\("(\w+)"\)\s+REFERENCES\s+"(\w+)"\("(\w+)"\)(?:\s+ON\s+DELETE\s+(\w+(?:\s+\w+)?))?/gi;
+  while ((m = fkRe.exec(sql)) !== null) {
+    state.fks.push({
+      constraintName: m[2],
+      sourceTable: m[1],
+      sourceColumn: m[3],
+      targetTable: m[4],
+      targetColumn: m[5],
+      onDelete: m[6] ?? null
+    });
+  }
+}
+function parseAlterEnum(sql, state) {
+  const re = /ALTER\s+TYPE\s+"(\w+)"\s+ADD\s+VALUE\s+'([^']+)'/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    const en = state.enums.get(m[1]);
+    if (en) en.values.add(m[2]);
+  }
+}
+function parseDropTable(sql, state) {
+  const re = /DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?"(\w+)"/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    state.tables.delete(m[1]);
+    state.fks = state.fks.filter((fk) => fk.sourceTable !== m[1] && fk.targetTable !== m[1]);
+  }
+}
+function parseUniqueIndex(sql, state) {
+  const re = /CREATE\s+UNIQUE\s+INDEX\s+"[^"]+"\s+ON\s+"(\w+)"\("(\w+)"\)/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    const table = state.tables.get(m[1]);
+    const col = table?.columns.get(m[2]);
+    if (col) col.unique = true;
+    if (!state.uniqueIndexes.has(m[1])) state.uniqueIndexes.set(m[1], /* @__PURE__ */ new Set());
+    state.uniqueIndexes.get(m[1]).add(m[2]);
+  }
+}
+function parseMigrations(rootDir) {
+  const migrationsDir = (0, import_node_path6.join)(rootDir, "prisma", "migrations");
+  const state = {
+    tables: /* @__PURE__ */ new Map(),
+    enums: /* @__PURE__ */ new Map(),
+    fks: [],
+    uniqueIndexes: /* @__PURE__ */ new Map()
+  };
+  if (!(0, import_node_fs6.existsSync)(migrationsDir)) return state;
+  const dirs = (0, import_node_fs6.readdirSync)(migrationsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  for (const dir of dirs) {
+    const sqlPath = (0, import_node_path6.join)(migrationsDir, dir, "migration.sql");
+    if (!(0, import_node_fs6.existsSync)(sqlPath)) continue;
+    const sql = (0, import_node_fs6.readFileSync)(sqlPath, "utf-8");
+    parseCreateEnum(sql, state);
+    parseCreateTable(sql, state);
+    parseAlterTable(sql, state);
+    parseAlterEnum(sql, state);
+    parseDropTable(sql, state);
+    parseUniqueIndex(sql, state);
+  }
+  return state;
+}
+function loadPrismaState(rootDir) {
+  const schemaPath = (0, import_node_path6.join)(rootDir, "prisma", "schema.prisma");
+  if (!(0, import_node_fs6.existsSync)(schemaPath)) return null;
+  const content = (0, import_node_fs6.readFileSync)(schemaPath, "utf-8");
+  const tables = /* @__PURE__ */ new Map();
+  const enums = /* @__PURE__ */ new Map();
+  const relations = [];
+  const modelRe = /model\s+(\w+)\s*\{([^}]+)\}/g;
+  let m;
+  while ((m = modelRe.exec(content)) !== null) {
+    const modelName = m[1];
+    const body = m[2];
+    const cols = [];
+    for (const line of body.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("//") && !l.startsWith("@@"))) {
+      const fm = line.match(/^(\w+)\s+(\S+)(.*)/);
+      if (!fm) continue;
+      const fieldName = fm[1];
+      const fieldType = fm[2];
+      const rest = fm[3] ?? "";
+      const baseType = fieldType.replace(/[?\[\]]/g, "");
+      const isRelation = rest.includes("@relation");
+      if (isRelation) {
+        const relArgs = rest.match(/@relation\(([^)]*)\)/)?.[1] ?? "";
+        const fieldsMatch = relArgs.match(/fields:\s*\[([^\]]+)\]/);
+        if (fieldsMatch) {
+          relations.push({ source: modelName, target: baseType, fk: fieldsMatch[1].trim() });
+        }
+        continue;
+      }
+      if (fieldType.endsWith("[]") || fieldType.endsWith("?") && content.includes(`model ${baseType}`)) {
+        if (new RegExp(`model\\s+${baseType}\\s*\\{`).test(content)) continue;
+      }
+      cols.push({
+        name: fieldName,
+        type: fieldType.replace("?", ""),
+        nullable: fieldType.endsWith("?") || fieldType.includes("?"),
+        primary: rest.includes("@id"),
+        unique: rest.includes("@unique")
+      });
+    }
+    tables.set(modelName, { columns: cols });
+  }
+  const enumRe = /enum\s+(\w+)\s*\{([^}]+)\}/g;
+  while ((m = enumRe.exec(content)) !== null) {
+    const values = m[2].split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("//"));
+    enums.set(m[1], values);
+  }
+  return { tables, enums, relations };
+}
+function verify(sqlState, prisma) {
+  const contradictions = [];
+  const flaggedEdges = [];
+  for (const [name] of sqlState.tables) {
+    if (!prisma.tables.has(name)) {
+      contradictions.push({
+        entity: name,
+        source_a: "sql-migrations",
+        source_b: "prisma-schema",
+        detail: `Table "${name}" exists in migrations but not in schema.prisma`
+      });
+    }
+  }
+  for (const [name] of prisma.tables) {
+    if (!sqlState.tables.has(name)) {
+      contradictions.push({
+        entity: name,
+        source_a: "prisma-schema",
+        source_b: "sql-migrations",
+        detail: `Table "${name}" in schema.prisma has no CREATE TABLE in migrations`
+      });
+    }
+  }
+  for (const [tableName, prismaTable] of prisma.tables) {
+    const sqlTable = sqlState.tables.get(tableName);
+    if (!sqlTable) continue;
+    for (const prismaCol of prismaTable.columns) {
+      const sqlCol = sqlTable.columns.get(prismaCol.name);
+      if (!sqlCol) {
+        contradictions.push({
+          entity: `${tableName}.${prismaCol.name}`,
+          source_a: "prisma-schema",
+          source_b: "sql-migrations",
+          detail: `Column "${tableName}.${prismaCol.name}" in schema.prisma but not in migrations`
+        });
+        continue;
+      }
+      const mappedSqlType = pgTypeToPrisma(sqlCol.type);
+      const prismaBaseType = prismaCol.type.replace(/[?\[\]]/g, "");
+      if (mappedSqlType !== prismaBaseType && mappedSqlType !== prismaCol.type) {
+        if (!sqlState.enums.has(prismaBaseType)) {
+          contradictions.push({
+            entity: `${tableName}.${prismaCol.name}`,
+            source_a: "sql-migrations",
+            source_b: "prisma-schema",
+            detail: `Column "${tableName}.${prismaCol.name}": SQL type "${sqlCol.type}" (\u2192${mappedSqlType}) vs Prisma type "${prismaCol.type}"`
+          });
+        }
+      }
+      if (sqlCol.nullable !== prismaCol.nullable) {
+        contradictions.push({
+          entity: `${tableName}.${prismaCol.name}`,
+          source_a: "sql-migrations",
+          source_b: "prisma-schema",
+          detail: `Column "${tableName}.${prismaCol.name}": ${sqlCol.nullable ? "nullable" : "NOT NULL"} in SQL vs ${prismaCol.nullable ? "optional" : "required"} in Prisma`
+        });
+      }
+    }
+    for (const [colName] of sqlTable.columns) {
+      const inPrisma = prismaTable.columns.some((c) => c.name === colName);
+      if (!inPrisma) {
+        contradictions.push({
+          entity: `${tableName}.${colName}`,
+          source_a: "sql-migrations",
+          source_b: "prisma-schema",
+          detail: `Column "${tableName}.${colName}" in migrations but not in schema.prisma`
+        });
+      }
+    }
+  }
+  for (const [name, sqlEnum] of sqlState.enums) {
+    const prismaValues = prisma.enums.get(name);
+    if (!prismaValues) {
+      contradictions.push({
+        entity: name,
+        source_a: "sql-migrations",
+        source_b: "prisma-schema",
+        detail: `Enum "${name}" exists in migrations but not in schema.prisma`
+      });
+      continue;
+    }
+    const prismaSet = new Set(prismaValues);
+    for (const val of sqlEnum.values) {
+      if (!prismaSet.has(val)) {
+        contradictions.push({
+          entity: `${name}.${val}`,
+          source_a: "sql-migrations",
+          source_b: "prisma-schema",
+          detail: `Enum "${name}": value "${val}" in migrations but not in schema.prisma`
+        });
+      }
+    }
+    for (const val of prismaValues) {
+      if (!sqlEnum.values.has(val)) {
+        contradictions.push({
+          entity: `${name}.${val}`,
+          source_a: "prisma-schema",
+          source_b: "sql-migrations",
+          detail: `Enum "${name}": value "${val}" in schema.prisma but not in migrations`
+        });
+      }
+    }
+  }
+  const prismaFkSet = new Set(prisma.relations.map((r) => `${r.source}|${r.target}|${r.fk}`));
+  for (const fk of sqlState.fks) {
+    const key = `${fk.sourceTable}|${fk.targetTable}|${fk.sourceColumn}`;
+    if (!prismaFkSet.has(key)) {
+      flaggedEdges.push({
+        source: fk.sourceTable,
+        target: fk.targetTable,
+        type: "belongs_to",
+        label: `FK "${fk.constraintName}" (${fk.sourceColumn}\u2192${fk.targetTable}) in migrations but no @relation in schema.prisma`,
+        confidence: "high"
+      });
+    }
+  }
+  return { contradictions, flaggedEdges };
+}
+function detect3(rootDir) {
+  const migrationsDir = (0, import_node_path6.join)(rootDir, "prisma", "migrations");
+  if (!(0, import_node_fs6.existsSync)(migrationsDir)) return false;
+  return (0, import_node_fs6.readdirSync)(migrationsDir, { withFileTypes: true }).some((d) => d.isDirectory() && (0, import_node_fs6.existsSync)((0, import_node_path6.join)(migrationsDir, d.name, "migration.sql")));
+}
+function generate3(rootDir) {
+  const sqlState = parseMigrations(rootDir);
+  const prisma = loadPrismaState(rootDir);
+  const prismaTableIds = prisma ? new Set(prisma.tables.keys()) : /* @__PURE__ */ new Set();
+  const prismaEnumIds = prisma ? new Set(prisma.enums.keys()) : /* @__PURE__ */ new Set();
+  const nodes = [];
+  for (const [name, table] of sqlState.tables) {
+    if (prismaTableIds.has(name)) continue;
+    nodes.push({
+      id: name,
+      type: "table",
+      name,
+      source: "sql",
+      columns: [...table.columns.values()].map((c) => ({
+        name: c.name,
+        type: c.type,
+        primary: c.primary,
+        unique: c.unique,
+        nullable: c.nullable,
+        default: c.default,
+        isRelation: false,
+        comment: null
+      }))
+    });
+  }
+  for (const [name, sqlEnum] of sqlState.enums) {
+    if (prismaEnumIds.has(name)) continue;
+    nodes.push({
+      id: name,
+      type: "enum",
+      name,
+      source: "sql",
+      values: [...sqlEnum.values]
+    });
+  }
+  const sqlOnlyTables = new Set(nodes.filter((n) => n.type === "table").map((n) => n.id));
+  const edges = sqlState.fks.filter((fk) => sqlOnlyTables.has(fk.sourceTable)).map((fk) => ({
+    source: fk.sourceTable,
+    target: fk.targetTable,
+    type: "belongs_to",
+    fk: fk.sourceColumn,
+    onDelete: fk.onDelete
+  }));
+  const { contradictions, flaggedEdges } = prisma ? verify(sqlState, prisma) : { contradictions: [], flaggedEdges: [] };
+  return {
+    metadata: {
+      generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+      scope: "sql-migrations",
+      source: "prisma/migrations/",
+      layer: "db",
+      sql_tables: sqlState.tables.size,
+      sql_enums: sqlState.enums.size,
+      sql_fks: sqlState.fks.length,
+      additive_nodes: nodes.length,
+      contradictions_found: contradictions.length,
+      flagged_edges_found: flaggedEdges.length
+    },
+    nodes,
+    edges,
+    cross_refs: [],
+    contradictions,
+    warnings: [],
+    flagged_edges: flaggedEdges
+  };
+}
+var sqlMigrationsParser = {
+  id: "sql-migrations",
+  layer: "db",
   detect: detect3,
   generate: generate3
 };
@@ -1613,31 +2090,31 @@ var fetchResolverParser = {
 };
 
 // src/server/graph/parsers/crosslayer/api-annotations.ts
-var import_node_fs6 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path7 = require("node:path");
 var API_ANNOTATION_RE = /@api\s+(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\s+(\/\S+)/g;
-function walk3(dir, exts) {
-  if (!(0, import_node_fs6.existsSync)(dir)) return [];
+function walk2(dir, exts) {
+  if (!(0, import_node_fs7.existsSync)(dir)) return [];
   const results = [];
-  for (const entry of (0, import_node_fs6.readdirSync)(dir, { withFileTypes: true })) {
+  for (const entry of (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const full = (0, import_node_path6.join)(dir, entry.name);
+    const full = (0, import_node_path7.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      results.push(...walk3(full, exts));
-    } else if (exts.includes((0, import_node_path6.extname)(entry.name))) {
+      results.push(...walk2(full, exts));
+    } else if (exts.includes((0, import_node_path7.extname)(entry.name))) {
       results.push(full);
     }
   }
   return results;
 }
 function toNodeId2(srcDir, absPath) {
-  return (0, import_node_path6.relative)(srcDir, absPath).replace(/\\/g, "/");
+  return (0, import_node_path7.relative)(srcDir, absPath).replace(/\\/g, "/");
 }
 var apiAnnotationsParser = {
   id: "api-annotations",
   layer: "crosslayer",
   detect(rootDir) {
-    return (0, import_node_fs6.existsSync)((0, import_node_path6.join)(rootDir, "src"));
+    return (0, import_node_fs7.existsSync)((0, import_node_path7.join)(rootDir, "src"));
   },
   generate(rootDir, layerOutputs) {
     const apiOutput = layerOutputs.get("api");
@@ -1648,13 +2125,13 @@ var apiAnnotationsParser = {
     const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
     const apiRoutes = loadApiRoutesFromOutput(apiOutput);
     const apiPathMap = buildApiPathMap(apiRoutes);
-    const srcDir = (0, import_node_path6.join)(rootDir, "src");
-    const files = walk3(srcDir, [".ts", ".tsx"]);
+    const srcDir = (0, import_node_path7.join)(rootDir, "src");
+    const files = walk2(srcDir, [".ts", ".tsx"]);
     const crossRefs = [];
     const flaggedEdges = [];
     const seen = /* @__PURE__ */ new Set();
     for (const absPath of files) {
-      const content = (0, import_node_fs6.readFileSync)(absPath, "utf-8");
+      const content = (0, import_node_fs7.readFileSync)(absPath, "utf-8");
       const sourceId = toNodeId2(srcDir, absPath);
       if (!uiNodeIds.has(sourceId)) continue;
       let match;
@@ -1693,73 +2170,727 @@ var apiAnnotationsParser = {
         annotations_resolved: crossRefs.length,
         annotations_unresolved: flaggedEdges.length
       }
-    };
+    };
+  }
+};
+
+// src/server/graph/parsers/crosslayer/url-literal-scanner.ts
+var import_node_fs8 = require("node:fs");
+var import_node_path8 = require("node:path");
+init_config();
+var URL_LITERAL_RE = /['"`](\/api\/[^'"`\s]+?)['"`]/g;
+function walk3(dir, exts) {
+  if (!(0, import_node_fs8.existsSync)(dir)) return [];
+  const results = [];
+  for (const entry of (0, import_node_fs8.readdirSync)(dir, { withFileTypes: true })) {
+    if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+    const full = (0, import_node_path8.join)(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...walk3(full, exts));
+    } else if (exts.includes((0, import_node_path8.extname)(entry.name))) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+function toNodeId3(srcDir, absPath) {
+  return (0, import_node_path8.relative)(srcDir, absPath).replace(/\\/g, "/");
+}
+var urlLiteralScannerParser = {
+  id: "url-literal-scanner",
+  layer: "crosslayer",
+  detect(rootDir) {
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    return paths !== null;
+  },
+  generate(rootDir, layerOutputs) {
+    const apiOutput = layerOutputs.get("api");
+    if (!apiOutput) {
+      return { cross_refs: [], flagged_edges: [], warnings: [] };
+    }
+    const uiOutput = layerOutputs.get("ui");
+    const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
+    const apiRoutes = loadApiRoutesFromOutput(apiOutput);
+    const apiPathMap = buildApiPathMap(apiRoutes);
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    const srcDir = paths.srcDir;
+    const clientDir = (0, import_node_path8.join)(srcDir, "client");
+    const files = [
+      ...walk3(clientDir, [".ts", ".tsx"]),
+      ...walk3(paths.appDir, [".ts", ".tsx"])
+    ];
+    const crossRefs = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const absPath of files) {
+      const sourceId = toNodeId3(srcDir, absPath);
+      if (!uiNodeIds.has(sourceId)) continue;
+      const content = (0, import_node_fs8.readFileSync)(absPath, "utf-8");
+      let match;
+      URL_LITERAL_RE.lastIndex = 0;
+      while ((match = URL_LITERAL_RE.exec(content)) !== null) {
+        const urlPath = match[1];
+        const result = resolveUrlPath(urlPath, apiPathMap, apiRoutes);
+        if (result.kind === "resolved" && result.nodeId) {
+          const key = `${sourceId}|${result.nodeId}|references_api`;
+          if (seen.has(key)) continue;
+          seen.add(key);
+          crossRefs.push({
+            source: sourceId,
+            target: result.nodeId,
+            type: "references_api",
+            layer: "api"
+          });
+        }
+      }
+    }
+    return {
+      cross_refs: crossRefs,
+      flagged_edges: [],
+      warnings: [],
+      patterns: {
+        url_literals_resolved: crossRefs.length
+      }
+    };
+  }
+};
+
+// src/server/graph/parsers/static/static-values.ts
+var import_node_fs9 = require("node:fs");
+var import_node_path9 = require("node:path");
+var parseCode = null;
+function tryLoadTreeSitter() {
+  if (parseCode) return true;
+  try {
+    const extractor = (init_ts_extractor(), __toCommonJS(ts_extractor_exports));
+    if (typeof extractor.parseCodeTS === "function") {
+      parseCode = extractor.parseCodeTS;
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+var SHARED_MODELS = /* @__PURE__ */ new Set(["permission", "role", "tag"]);
+var DB_MODELS = /* @__PURE__ */ new Set(["subscriptionPlan", "providerDefinition", "pipelineMasterTemplate"]);
+function classifyScope(source, model) {
+  if (source.includes("prisma/schema.prisma")) return "shared";
+  if (source.includes("prisma/seed") && model) {
+    if (SHARED_MODELS.has(model)) return "shared";
+    if (DB_MODELS.has(model)) return "db";
+    return "shared";
+  }
+  if (source.startsWith("src/client/") || source.startsWith("src/app/")) return "fe";
+  if (source.startsWith("src/server/")) return "be";
+  if (source.startsWith("src/config/")) return "be";
+  if (source.startsWith("src/lib/")) return "shared";
+  return "shared";
+}
+function extractEnumValues(rootDir) {
+  const nodes = [];
+  const edges = [];
+  const schemaPaths = [
+    (0, import_node_path9.join)(rootDir, "prisma", "schema.prisma"),
+    (0, import_node_path9.join)(rootDir, "prisma", "schema")
+  ];
+  let content = "";
+  for (const p of schemaPaths) {
+    if ((0, import_node_fs9.existsSync)(p)) {
+      try {
+        const stat = (0, import_node_fs9.statSync)(p);
+        if (stat.isFile()) {
+          content = (0, import_node_fs9.readFileSync)(p, "utf-8");
+        } else if (stat.isDirectory()) {
+          const files = (0, import_node_fs9.readdirSync)(p).filter((f) => f.endsWith(".prisma"));
+          content = files.map((f) => (0, import_node_fs9.readFileSync)((0, import_node_path9.join)(p, f), "utf-8")).join("\n");
+        }
+      } catch {
+        continue;
+      }
+      break;
+    }
+  }
+  if (!content) return { nodes, edges };
+  const enumRe = /enum\s+(\w+)\s*\{([^}]+)\}/g;
+  let m;
+  while ((m = enumRe.exec(content)) !== null) {
+    const enumName = m[1];
+    const body = m[2];
+    const values = body.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("//"));
+    const scope = classifyScope("prisma/schema.prisma");
+    for (const val of values) {
+      const nodeId = `${enumName}.${val}`;
+      nodes.push({
+        id: nodeId,
+        type: "enum_value",
+        name: val,
+        parentEnum: enumName,
+        value: val,
+        scope,
+        source: "prisma/schema.prisma"
+      });
+      edges.push({
+        source: nodeId,
+        target: `enum:${enumName}`,
+        type: "member_of"
+      });
+    }
+    nodes.push({
+      id: `enum:${enumName}`,
+      type: "enum_group",
+      name: enumName,
+      valueCount: values.length,
+      scope,
+      source: "prisma/schema.prisma"
+    });
+  }
+  return { nodes, edges };
+}
+function extractPropsFromObjectNode(node) {
+  const props = {};
+  for (const child of node.namedChildren) {
+    if (child.type !== "pair") continue;
+    const keyNode = child.childForFieldName("key");
+    const valNode = child.childForFieldName("value");
+    if (!keyNode || !valNode) continue;
+    const key = keyNode.type === "property_identifier" ? keyNode.text : keyNode.text.replace(/['"]/g, "");
+    if (valNode.type === "string" || valNode.type === "template_string") {
+      const fragment = valNode.namedChildren.find((c) => c.type === "string_fragment" || c.type === "template_substitution");
+      props[key] = fragment ? fragment.text : valNode.text.replace(/^['"`]|['"`]$/g, "");
+    } else if (valNode.type === "number") {
+      props[key] = valNode.text;
+    } else if (valNode.type === "true" || valNode.type === "false") {
+      props[key] = valNode.text;
+    }
+  }
+  return props;
+}
+function extractStringArrayFromNode(node) {
+  const values = [];
+  for (const child of node.namedChildren) {
+    if (child.type === "string") {
+      const frag = child.namedChildren.find((c) => c.type === "string_fragment");
+      if (frag) values.push(frag.text);
+    }
+  }
+  return values;
+}
+function findArrayDecl(root, varName) {
+  function walk5(node) {
+    if (node.type === "variable_declarator") {
+      const nameNode = node.childForFieldName("name");
+      const valueNode = node.childForFieldName("value");
+      if (nameNode?.text === varName && valueNode?.type === "array") {
+        return valueNode;
+      }
+      if (nameNode?.text === varName && valueNode?.type === "as_expression") {
+        const inner = valueNode.namedChildren.find((c) => c.type === "array");
+        if (inner) return inner;
+      }
+    }
+    for (const child of node.namedChildren) {
+      const found = walk5(child);
+      if (found) return found;
+    }
+    return null;
+  }
+  return walk5(root);
+}
+function extractObjectPropsRegex(objStr) {
+  const props = {};
+  const propRe = /(\w+):\s*['"]([^'"]*)['"]/g;
+  let m;
+  while ((m = propRe.exec(objStr)) !== null) props[m[1]] = m[2];
+  const numRe = /(\w+):\s*(-?\d+(?:\.\d+)?)\s*[,\n}]/g;
+  while ((m = numRe.exec(objStr)) !== null) if (!props[m[1]]) props[m[1]] = m[2];
+  return props;
+}
+function extractStringArrayRegex(arrStr) {
+  return (arrStr.match(/'([^']+)'/g) ?? []).map((s) => s.replace(/'/g, ""));
+}
+function splitArrayObjectsRegex(arrayBody) {
+  const objects = [];
+  let depth = 0;
+  let start = -1;
+  for (let i = 0; i < arrayBody.length; i++) {
+    if (arrayBody[i] === "{") {
+      if (depth === 0) start = i;
+      depth++;
+    } else if (arrayBody[i] === "}") {
+      depth--;
+      if (depth === 0 && start >= 0) {
+        objects.push(arrayBody.slice(start, i + 1));
+        start = -1;
+      }
+    }
+  }
+  return objects;
+}
+function detectSeededArrays(content, sourceFile) {
+  const results = [];
+  const forOfRe = /for\s*\(\s*const\s+\w+\s+of\s+(\w+)\s*\)\s*\{/g;
+  let fm;
+  while ((fm = forOfRe.exec(content)) !== null) {
+    const arrayName = fm[1];
+    const lookahead = content.slice(fm.index + fm[0].length, fm.index + fm[0].length + 500);
+    const prismaMatch = lookahead.match(/prisma\.(\w+)\.(create|upsert|update|createMany|findFirst)/);
+    if (!prismaMatch) continue;
+    results.push({ arrayName, prismaModel: prismaMatch[1], sourceFile });
+  }
+  return results;
+}
+function pickIdField(props) {
+  for (const key of ["key", "slug", "id", "name", "templateId"]) {
+    if (props[key]) return props[key];
+  }
+  return null;
+}
+function pickNameField(props) {
+  for (const key of ["name", "slug", "key", "id"]) {
+    if (props[key]) return props[key];
+  }
+  return null;
+}
+function modelToNodeType(model) {
+  return `seed_${model.replace(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "")}`;
+}
+function extractSeedData(rootDir) {
+  const nodes = [];
+  const edges = [];
+  const seedFiles = [
+    (0, import_node_path9.join)(rootDir, "prisma", "seed.ts"),
+    (0, import_node_path9.join)(rootDir, "prisma", "seed.js"),
+    (0, import_node_path9.join)(rootDir, "src", "server", "lib", "system-tags.ts")
+  ].filter(import_node_fs9.existsSync);
+  const useTreeSitter = tryLoadTreeSitter();
+  for (const filePath of seedFiles) {
+    const content = (0, import_node_fs9.readFileSync)(filePath, "utf-8");
+    const relPath = (0, import_node_path9.relative)(rootDir, filePath);
+    const seeded = detectSeededArrays(content, relPath);
+    let astRoot = null;
+    if (useTreeSitter && parseCode) {
+      try {
+        const tree = parseCode(content);
+        astRoot = tree.rootNode;
+      } catch {
+      }
+    }
+    for (const { arrayName, prismaModel, sourceFile } of seeded) {
+      const nodeType = modelToNodeType(prismaModel);
+      const scope = classifyScope(sourceFile, prismaModel);
+      if (astRoot) {
+        const arrayNode = findArrayDecl(astRoot, arrayName);
+        if (!arrayNode) continue;
+        for (const child of arrayNode.namedChildren) {
+          if (child.type !== "object") continue;
+          const props = extractPropsFromObjectNode(child);
+          const idVal = pickIdField(props);
+          if (!idVal) continue;
+          const nameVal = pickNameField(props) ?? idVal;
+          const nodeId = `seed:${prismaModel}:${idVal}`;
+          const { scope: _seedScope, ...safeProps } = props;
+          nodes.push({
+            id: nodeId,
+            type: nodeType,
+            name: nameVal,
+            value: idVal,
+            model: prismaModel,
+            ...safeProps,
+            seedScope: _seedScope ?? void 0,
+            // preserve as seedScope
+            scope,
+            source: sourceFile
+          });
+          const permsArrayNode = child.namedChildren.filter((c) => c.type === "pair").find((c) => c.childForFieldName("key")?.text === "permissions");
+          if (permsArrayNode) {
+            const valNode = permsArrayNode.childForFieldName("value");
+            if (valNode?.type === "array") {
+              const permKeys = extractStringArrayFromNode(valNode);
+              for (const pk of permKeys) {
+                if (pk === "*") continue;
+                edges.push({ source: nodeId, target: `seed:permission:${pk}`, type: "grants" });
+              }
+            }
+          }
+        }
+      } else {
+        const constRe = new RegExp(`const\\s+${arrayName}\\s*(?::[^=]+)?=\\s*\\[`, "g");
+        const cm = constRe.exec(content);
+        if (!cm) continue;
+        const bracketStart = cm.index + cm[0].length - 1;
+        let depth = 1, i = bracketStart + 1;
+        while (i < content.length && depth > 0) {
+          if (content[i] === "[") depth++;
+          else if (content[i] === "]") depth--;
+          i++;
+        }
+        if (depth !== 0) continue;
+        const body = content.slice(bracketStart + 1, i - 1);
+        const objects = splitArrayObjectsRegex(body);
+        for (const objStr of objects) {
+          const props = extractObjectPropsRegex(objStr);
+          const idVal = pickIdField(props);
+          if (!idVal) continue;
+          const nameVal = pickNameField(props) ?? idVal;
+          const nodeId = `seed:${prismaModel}:${idVal}`;
+          const { scope: _rScope, ...rSafeProps } = props;
+          nodes.push({
+            id: nodeId,
+            type: nodeType,
+            name: nameVal,
+            value: idVal,
+            model: prismaModel,
+            ...rSafeProps,
+            seedScope: _rScope ?? void 0,
+            scope,
+            source: sourceFile
+          });
+          const permArrayMatch = objStr.match(/permissions:\s*\[([^\]]*)\]/);
+          if (permArrayMatch) {
+            for (const pk of extractStringArrayRegex(permArrayMatch[1])) {
+              if (pk === "*") continue;
+              edges.push({ source: nodeId, target: `seed:permission:${pk}`, type: "grants" });
+            }
+          }
+        }
+      }
+    }
+  }
+  return { nodes, edges };
+}
+function walkDir(dir, exts) {
+  if (!(0, import_node_fs9.existsSync)(dir)) return [];
+  const results = [];
+  for (const entry of (0, import_node_fs9.readdirSync)(dir, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || entry.name === ".next" || entry.name === "dist") continue;
+    const full = (0, import_node_path9.join)(dir, entry.name);
+    if (entry.isDirectory()) results.push(...walkDir(full, exts));
+    else if (exts.some((ext) => entry.name.endsWith(ext))) results.push(full);
+  }
+  return results;
+}
+function extractConstants(rootDir) {
+  const nodes = [];
+  const srcDir = (0, import_node_path9.join)(rootDir, "src");
+  if (!(0, import_node_fs9.existsSync)(srcDir)) return { nodes };
+  for (const filePath of walkDir(srcDir, [".ts", ".tsx"])) {
+    const content = (0, import_node_fs9.readFileSync)(filePath, "utf-8");
+    const relPath = (0, import_node_path9.relative)(rootDir, filePath);
+    const constArrayRe = /export\s+const\s+([A-Z][A-Z_0-9]+)\s*(?::[^=]+)?\s*=\s*\[/g;
+    let cm;
+    while ((cm = constArrayRe.exec(content)) !== null) {
+      const constName = cm[1];
+      const bracketStart = cm.index + cm[0].length - 1;
+      let depth = 1, i = bracketStart + 1;
+      while (i < content.length && depth > 0) {
+        if (content[i] === "[") depth++;
+        else if (content[i] === "]") depth--;
+        i++;
+      }
+      if (depth !== 0) continue;
+      const body = content.slice(bracketStart + 1, i - 1);
+      const stringValues = extractStringArrayRegex(body);
+      const objectCount = splitArrayObjectsRegex(body).length;
+      const valueCount = Math.max(stringValues.length, objectCount);
+      if (valueCount < 2) continue;
+      const scope = classifyScope(relPath);
+      nodes.push({
+        id: `const:${constName}`,
+        type: "constant",
+        name: constName,
+        valueCount,
+        values: stringValues.length > 0 && stringValues.length <= 30 ? stringValues : void 0,
+        scope,
+        source: relPath
+      });
+    }
+  }
+  return { nodes };
+}
+function detect4(rootDir) {
+  return (0, import_node_fs9.existsSync)((0, import_node_path9.join)(rootDir, "prisma", "schema.prisma")) || (0, import_node_fs9.existsSync)((0, import_node_path9.join)(rootDir, "prisma", "seed.ts"));
+}
+function generate4(rootDir) {
+  const enumResult = extractEnumValues(rootDir);
+  const seedResult = extractSeedData(rootDir);
+  const constResult = extractConstants(rootDir);
+  const allNodes = [...enumResult.nodes, ...seedResult.nodes, ...constResult.nodes];
+  const allEdges = [...enumResult.edges, ...seedResult.edges];
+  const typeOrder = {
+    enum_group: 0,
+    enum_value: 1,
+    seed_permission: 2,
+    seed_role: 3,
+    seed_tag: 4,
+    seed_plan: 5,
+    seed_provider: 6,
+    constant: 7
+  };
+  allNodes.sort((a, b) => {
+    const ta = typeOrder[a.type] ?? 8;
+    const tb = typeOrder[b.type] ?? 8;
+    if (ta !== tb) return ta - tb;
+    return a.name.localeCompare(b.name);
+  });
+  const enumGroups = allNodes.filter((n) => n.type === "enum_group").length;
+  const enumValues = allNodes.filter((n) => n.type === "enum_value").length;
+  const seedNodes = allNodes.filter((n) => n.type.startsWith("seed_")).length;
+  const constNodes = allNodes.filter((n) => n.type === "constant").length;
+  const byScope = {};
+  for (const n of allNodes) {
+    const s = n.scope ?? "unknown";
+    byScope[s] = (byScope[s] ?? 0) + 1;
   }
+  return {
+    metadata: {
+      generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+      scope: "static-values",
+      layer: "static",
+      enum_groups: enumGroups,
+      enum_values: enumValues,
+      seed_records: seedNodes,
+      constants: constNodes,
+      total_nodes: allNodes.length,
+      total_edges: allEdges.length,
+      parser: tryLoadTreeSitter() ? "tree-sitter" : "regex-fallback"
+    },
+    nodes: allNodes,
+    edges: allEdges,
+    cross_refs: [],
+    contradictions: [],
+    warnings: [],
+    flagged_edges: [],
+    patterns: {
+      by_type: {
+        enum_group: enumGroups,
+        enum_value: enumValues,
+        seed_permission: allNodes.filter((n) => n.type === "seed_permission").length,
+        seed_role: allNodes.filter((n) => n.type === "seed_role").length,
+        seed_tag: allNodes.filter((n) => n.type === "seed_tag").length,
+        seed_plan: allNodes.filter((n) => n.type === "seed_plan").length,
+        seed_provider: allNodes.filter((n) => n.type === "seed_provider").length,
+        constant: constNodes
+      },
+      by_scope: byScope
+    }
+  };
+}
+var staticValuesParser = {
+  id: "static-values",
+  layer: "static",
+  detect: detect4,
+  generate: generate4
 };
 
-// src/server/graph/parsers/crosslayer/url-literal-scanner.ts
-var import_node_fs7 = require("node:fs");
-var import_node_path7 = require("node:path");
-var URL_LITERAL_RE = /['"`](\/api\/[^'"`\s]+?)['"`]/g;
+// src/server/graph/parsers/crosslayer/static-ref-scanner.ts
+var import_node_fs10 = require("node:fs");
+var import_node_path10 = require("node:path");
+init_config();
 function walk4(dir, exts) {
-  if (!(0, import_node_fs7.existsSync)(dir)) return [];
+  if (!(0, import_node_fs10.existsSync)(dir)) return [];
   const results = [];
-  for (const entry of (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true })) {
-    if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const full = (0, import_node_path7.join)(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...walk4(full, exts));
-    } else if (exts.includes((0, import_node_path7.extname)(entry.name))) {
-      results.push(full);
+  function recurse(d) {
+    for (const entry of (0, import_node_fs10.readdirSync)(d, { withFileTypes: true })) {
+      const full = (0, import_node_path10.join)(d, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules" || entry.name === ".next" || entry.name === "dist") continue;
+        recurse(full);
+      } else if (exts.some((ext) => entry.name.endsWith(ext))) {
+        results.push(full);
+      }
     }
   }
+  recurse(dir);
   return results;
 }
-function toNodeId3(srcDir, absPath) {
-  return (0, import_node_path7.relative)(srcDir, absPath).replace(/\\/g, "/");
+var MIN_VALUE_LENGTH = 4;
+var SKIP_VALUES = /* @__PURE__ */ new Set([
+  "true",
+  "false",
+  "null",
+  "undefined",
+  "none",
+  "default",
+  "name",
+  "type",
+  "data",
+  "text",
+  "info",
+  "error",
+  "open",
+  "read",
+  "user",
+  "test",
+  "json",
+  "form"
+]);
+function isInCommentOrType(node) {
+  let current = node.parent;
+  while (current) {
+    if (current.type === "comment" || current.type === "type_annotation" || current.type === "type_alias_declaration" || current.type === "interface_declaration" || current.type === "jsdoc") {
+      return true;
+    }
+    current = current.parent;
+  }
+  return false;
 }
-var urlLiteralScannerParser = {
-  id: "url-literal-scanner",
+function collectStaticRefs(root, valueLookup) {
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  function visit(node) {
+    if (node.type === "string_fragment") {
+      const val = node.text;
+      if (val.length >= MIN_VALUE_LENGTH && !SKIP_VALUES.has(val.toLowerCase())) {
+        const targets = valueLookup.get(val);
+        if (targets && !isInCommentOrType(node)) {
+          for (const t of targets) {
+            const key = t;
+            if (!seen.has(key)) {
+              seen.add(key);
+              refs.push({ value: val, targetIds: [t] });
+            }
+          }
+        }
+      }
+    }
+    if (node.type === "member_expression") {
+      const objNode = node.namedChildren.find((c) => c.type === "identifier");
+      const propNode = node.namedChildren.find((c) => c.type === "property_identifier");
+      if (objNode && propNode) {
+        const combined = `${objNode.text}.${propNode.text}`;
+        const targets = valueLookup.get(propNode.text);
+        const directTarget = valueLookup.get(combined);
+        if (directTarget && !isInCommentOrType(node)) {
+          for (const t of directTarget) {
+            if (!seen.has(t)) {
+              seen.add(t);
+              refs.push({ value: combined, targetIds: [t] });
+            }
+          }
+        } else if (targets && !isInCommentOrType(node)) {
+          for (const t of targets) {
+            if (!seen.has(t)) {
+              seen.add(t);
+              refs.push({ value: propNode.text, targetIds: [t] });
+            }
+          }
+        }
+      }
+    }
+    for (const child of node.namedChildren) {
+      visit(child);
+    }
+  }
+  visit(root);
+  return refs;
+}
+function collectStaticRefsRegex(content, valueLookup, allValues) {
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  const escaped = allValues.map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  const pattern = new RegExp(
+    `(?:['"\`])(${escaped.join("|")})(?:['"\`])|\\b(\\w+)\\.(${escaped.join("|")})\\b`,
+    "g"
+  );
+  let match;
+  pattern.lastIndex = 0;
+  while ((match = pattern.exec(content)) !== null) {
+    const val = match[1] ?? match[3];
+    if (!val) continue;
+    const targets = valueLookup.get(val);
+    if (!targets) continue;
+    for (const t of targets) {
+      if (!seen.has(t)) {
+        seen.add(t);
+        refs.push({ value: val, targetIds: [t] });
+      }
+    }
+  }
+  return refs;
+}
+var staticRefScannerParser = {
+  id: "static-ref-scanner",
   layer: "crosslayer",
   detect(rootDir) {
-    return (0, import_node_fs7.existsSync)((0, import_node_path7.join)(rootDir, "src"));
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    return paths !== null;
   },
   generate(rootDir, layerOutputs) {
-    const apiOutput = layerOutputs.get("api");
-    if (!apiOutput) {
+    const staticOutput = layerOutputs.get("static");
+    if (!staticOutput || staticOutput.nodes.length === 0) {
       return { cross_refs: [], flagged_edges: [], warnings: [] };
     }
-    const uiOutput = layerOutputs.get("ui");
-    const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
-    const apiRoutes = loadApiRoutesFromOutput(apiOutput);
-    const apiPathMap = buildApiPathMap(apiRoutes);
-    const srcDir = (0, import_node_path7.join)(rootDir, "src");
-    const clientDir = (0, import_node_path7.join)(srcDir, "client");
-    const appDir = (0, import_node_path7.join)(srcDir, "app");
+    const valueLookup = /* @__PURE__ */ new Map();
+    for (const node of staticOutput.nodes) {
+      const type = node.type;
+      let valueStr = null;
+      if (type === "enum_value") {
+        valueStr = node.value;
+        const fullId = node.id;
+        if (!valueLookup.has(fullId)) valueLookup.set(fullId, []);
+        valueLookup.get(fullId).push(node.id);
+      } else if (type.startsWith("seed_")) {
+        valueStr = node.value;
+      }
+      if (!valueStr || valueStr.length < MIN_VALUE_LENGTH || SKIP_VALUES.has(valueStr.toLowerCase())) continue;
+      if (!valueLookup.has(valueStr)) valueLookup.set(valueStr, []);
+      valueLookup.get(valueStr).push(node.id);
+    }
+    const allValues = [...valueLookup.keys()].sort((a, b) => b.length - a.length);
+    if (allValues.length === 0) {
+      return { cross_refs: [], flagged_edges: [], warnings: [] };
+    }
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    if (!paths) return { cross_refs: [], flagged_edges: [], warnings: [] };
+    const srcDir = paths.srcDir;
     const files = [
-      ...walk4(clientDir, [".ts", ".tsx"]),
-      ...walk4(appDir, [".ts", ".tsx"])
+      ...walk4((0, import_node_path10.join)(srcDir, "client"), [".ts", ".tsx"]),
+      ...walk4(paths.appDir, [".ts", ".tsx"]),
+      ...walk4((0, import_node_path10.join)(srcDir, "server"), [".ts", ".tsx"]),
+      ...walk4((0, import_node_path10.join)(srcDir, "lib"), [".ts", ".tsx"]),
+      ...walk4((0, import_node_path10.join)(srcDir, "config"), [".ts", ".tsx"])
     ];
+    const uiOutput = layerOutputs.get("ui");
+    const apiOutput = layerOutputs.get("api");
+    const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
+    const apiNodeIds = new Set(apiOutput?.nodes.map((n) => n.id) ?? []);
+    let parseCode2 = null;
+    try {
+      const extractor = (init_ts_extractor(), __toCommonJS(ts_extractor_exports));
+      if (typeof extractor.parseCodeTS === "function") {
+        parseCode2 = extractor.parseCodeTS;
+      }
+    } catch {
+    }
     const crossRefs = [];
     const seen = /* @__PURE__ */ new Set();
+    let filesScanned = 0;
     for (const absPath of files) {
-      const sourceId = toNodeId3(srcDir, absPath);
-      if (!uiNodeIds.has(sourceId)) continue;
-      const content = (0, import_node_fs7.readFileSync)(absPath, "utf-8");
-      let match;
-      URL_LITERAL_RE.lastIndex = 0;
-      while ((match = URL_LITERAL_RE.exec(content)) !== null) {
-        const urlPath = match[1];
-        const result = resolveUrlPath(urlPath, apiPathMap, apiRoutes);
-        if (result.kind === "resolved" && result.nodeId) {
-          const key = `${sourceId}|${result.nodeId}|references_api`;
+      const sourceId = (0, import_node_path10.relative)(srcDir, absPath).replace(/\\/g, "/");
+      const sourceLayer = uiNodeIds.has(sourceId) ? "ui" : apiNodeIds.has(sourceId) ? "api" : null;
+      if (!sourceLayer) continue;
+      const content = (0, import_node_fs10.readFileSync)(absPath, "utf-8");
+      filesScanned++;
+      let fileRefs;
+      if (parseCode2) {
+        try {
+          const tree = parseCode2(content);
+          fileRefs = collectStaticRefs(tree.rootNode, valueLookup);
+        } catch {
+          fileRefs = collectStaticRefsRegex(content, valueLookup, allValues);
+        }
+      } else {
+        fileRefs = collectStaticRefsRegex(content, valueLookup, allValues);
+      }
+      for (const ref of fileRefs) {
+        for (const targetId of ref.targetIds) {
+          const key = `${sourceId}|${targetId}`;
           if (seen.has(key)) continue;
           seen.add(key);
           crossRefs.push({
             source: sourceId,
-            target: result.nodeId,
-            type: "references_api",
-            layer: "api"
+            target: targetId,
+            type: "references_static",
+            layer: "static"
           });
         }
       }
@@ -1769,16 +2900,23 @@ var urlLiteralScannerParser = {
       flagged_edges: [],
       warnings: [],
       patterns: {
-        url_literals_resolved: crossRefs.length
+        files_scanned: filesScanned,
+        static_values_tracked: valueLookup.size,
+        references_found: crossRefs.length,
+        parser: parseCode2 ? "tree-sitter" : "regex-fallback"
       }
     };
   }
 };
 
 // src/server/graph/core/parser-registry.ts
+function isMultiLayerParser(p) {
+  return "layers" in p && Array.isArray(p.layers);
+}
 var ParserRegistry = class {
   constructor() {
-    this.parsers = /* @__PURE__ */ new Map();
+    this.singleLayerParsers = /* @__PURE__ */ new Map();
+    this.multiLayerParsers = [];
     this.ids = /* @__PURE__ */ new Set();
   }
   register(parser) {
@@ -1786,30 +2924,57 @@ var ParserRegistry = class {
       throw new Error(`Duplicate parser id: ${parser.id}`);
     }
     this.ids.add(parser.id);
-    const list = this.parsers.get(parser.layer) ?? [];
-    list.push(parser);
-    this.parsers.set(parser.layer, list);
+    if (isMultiLayerParser(parser)) {
+      this.multiLayerParsers.push(parser);
+    } else {
+      const list = this.singleLayerParsers.get(parser.layer) ?? [];
+      list.push(parser);
+      this.singleLayerParsers.set(parser.layer, list);
+    }
   }
+  /** Get single-layer parsers for a specific layer. */
   getParsers(layer) {
-    return this.parsers.get(layer) ?? [];
+    return this.singleLayerParsers.get(layer) ?? [];
+  }
+  /** Get multi-layer parsers that can produce output for the given layer. */
+  getMultiLayerParsersFor(layer) {
+    return this.multiLayerParsers.filter((p) => p.layers.includes(layer));
+  }
+  /** Get all multi-layer parsers. */
+  getMultiLayerParsers() {
+    return [...this.multiLayerParsers];
   }
   getCrossLayerParsers() {
-    return this.parsers.get("crosslayer") ?? [];
+    return this.singleLayerParsers.get("crosslayer") ?? [];
+  }
+  /** All layers that registered parsers can produce (single + multi). */
+  getAvailableLayers() {
+    const layers = /* @__PURE__ */ new Set();
+    for (const key of this.singleLayerParsers.keys()) {
+      if (key !== "crosslayer") layers.add(key);
+    }
+    for (const mp of this.multiLayerParsers) {
+      for (const l of mp.layers) layers.add(l);
+    }
+    return [...layers];
   }
   getAll() {
     const all = [];
-    for (const list of this.parsers.values()) all.push(...list);
+    for (const list of this.singleLayerParsers.values()) all.push(...list);
+    all.push(...this.multiLayerParsers);
     return all;
   }
 };
 function registerBuiltins(registry, disabled) {
   const builtins = [
-    reactNextjsParser,
-    nextjsRoutesParser,
+    typescriptProjectParser,
     prismaSchemaParser,
+    sqlMigrationsParser,
+    staticValuesParser,
     fetchResolverParser,
     apiAnnotationsParser,
-    urlLiteralScannerParser
+    urlLiteralScannerParser,
+    staticRefScannerParser
   ];
   for (const parser of builtins) {
     if (disabled.has(parser.id)) continue;
@@ -1819,11 +2984,11 @@ function registerBuiltins(registry, disabled) {
 function loadCustomParsers(registry, config, rootDir, disabled) {
   for (const entry of config.parsers?.custom ?? []) {
     try {
-      const absPath = (0, import_node_path8.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path11.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const parser = "default" in mod ? mod.default : mod;
       if (disabled.has(parser.id)) continue;
-      if (parser.layer !== entry.layer) {
+      if (!isMultiLayerParser(parser) && parser.layer !== entry.layer) {
         process.stderr.write(
           `[launch-chart] custom parser "${parser.id}" declares layer "${parser.layer}" but config says "${entry.layer}" \u2014 using parser's layer
 `
@@ -1969,10 +3134,10 @@ function applyCrossLayerResults(uiOutput, results, primaryId) {
 
 // src/server/graph/core/graph-builder.ts
 function readGraphFromDisk(rootDir, layer) {
-  const filePath = (0, import_node_path9.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
-  if (!(0, import_node_fs8.existsSync)(filePath)) return null;
+  const filePath = (0, import_node_path12.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  if (!(0, import_node_fs11.existsSync)(filePath)) return null;
   try {
-    return JSON.parse((0, import_node_fs8.readFileSync)(filePath, "utf-8"));
+    return JSON.parse((0, import_node_fs11.readFileSync)(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -1980,18 +3145,24 @@ function readGraphFromDisk(rootDir, layer) {
 function generateLayer(rootDir, layer) {
   const config = loadConfig(rootDir);
   const registry = createRegistry(config, rootDir);
-  const parsers = registry.getParsers(layer);
   const outputs = [];
-  for (const parser of parsers) {
+  for (const parser of registry.getParsers(layer)) {
     if (!parser.detect(rootDir)) continue;
     outputs.push(parser.generate(rootDir));
   }
+  for (const mp of registry.getMultiLayerParsersFor(layer)) {
+    if (!mp.detect(rootDir)) continue;
+    const multiOutput = mp.generate(rootDir);
+    const layerOutput = multiOutput.get(layer);
+    if (layerOutput) outputs.push(layerOutput);
+  }
   if (outputs.length === 0) return null;
   let merged = outputs.length === 1 ? outputs[0] : mergeGraphOutputs(outputs, layer);
   if (layer === "ui") {
     const layerOutputs = /* @__PURE__ */ new Map();
     layerOutputs.set("ui", merged);
-    for (const otherLayer of ["api", "db"]) {
+    for (const otherLayer of registry.getAvailableLayers()) {
+      if (otherLayer === "ui") continue;
       const existing = readGraphFromDisk(rootDir, otherLayer);
       if (existing) layerOutputs.set(otherLayer, existing);
     }
@@ -2012,16 +3183,29 @@ function generateLayer(rootDir, layer) {
 function generateAll(rootDir) {
   const config = loadConfig(rootDir);
   const registry = createRegistry(config, rootDir);
-  const layerOrder = ["api", "db", "ui"];
+  const allLayers = registry.getAvailableLayers();
+  const layerOrder = [
+    ...allLayers.filter((l) => l !== "ui"),
+    ...allLayers.filter((l) => l === "ui")
+  ];
   const layerOutputs = /* @__PURE__ */ new Map();
   const results = [];
+  const multiLayerResults = /* @__PURE__ */ new Map();
   for (const layer of layerOrder) {
-    const parsers = registry.getParsers(layer);
     const outputs = [];
-    for (const parser of parsers) {
+    for (const parser of registry.getParsers(layer)) {
       if (!parser.detect(rootDir)) continue;
       outputs.push(parser.generate(rootDir));
     }
+    for (const mp of registry.getMultiLayerParsersFor(layer)) {
+      if (!mp.detect(rootDir)) continue;
+      if (!multiLayerResults.has(mp.id)) {
+        multiLayerResults.set(mp.id, mp.generate(rootDir));
+      }
+      const cached = multiLayerResults.get(mp.id);
+      const layerOutput = cached.get(layer);
+      if (layerOutput) outputs.push(layerOutput);
+    }
     if (outputs.length === 0) continue;
     const merged = outputs.length === 1 ? outputs[0] : mergeGraphOutputs(outputs, layer);
     layerOutputs.set(layer, merged);
@@ -2047,18 +3231,20 @@ function generateAll(rootDir) {
     }
   }
   const byLayer = new Map(results.map((r) => [r.layer, r]));
-  return ["ui", "api", "db"].map((l) => byLayer.get(l)).filter((r) => !!r);
+  const wellKnownOrder = ["ui", "api", "db"];
+  const extras = [...byLayer.keys()].filter((l) => !wellKnownOrder.includes(l)).sort();
+  return [...wellKnownOrder, ...extras].map((l) => byLayer.get(l)).filter((r) => !!r);
 }
 
 // src/server/graph/index.ts
 init_config();
 
 // src/server/graph/core/tagger-registry.ts
-var import_node_path11 = require("node:path");
+var import_node_path14 = require("node:path");
 
 // src/server/graph/taggers/module-tagger.ts
-var import_node_fs9 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_fs12 = require("node:fs");
+var import_node_path13 = require("node:path");
 function matchGlob(pattern, id) {
   const patParts = pattern.split("/");
   const idParts = id.split("/");
@@ -2091,18 +3277,18 @@ function detectConventionDirs(rootDir, extraConventionDirs = []) {
   const conventionDirs = [...CONVENTION_DIRS_BUILTIN, ...extraConventionDirs];
   const searchDirs = [
     rootDir,
-    (0, import_node_path10.join)(rootDir, "src"),
-    (0, import_node_path10.join)(rootDir, "app"),
-    (0, import_node_path10.join)(rootDir, "lib")
+    (0, import_node_path13.join)(rootDir, "src"),
+    (0, import_node_path13.join)(rootDir, "app"),
+    (0, import_node_path13.join)(rootDir, "lib")
   ];
   for (const base of searchDirs) {
     for (const convention of conventionDirs) {
-      const dir = (0, import_node_path10.join)(base, convention);
-      if (!(0, import_node_fs9.existsSync)(dir)) continue;
+      const dir = (0, import_node_path13.join)(base, convention);
+      if (!(0, import_node_fs12.existsSync)(dir)) continue;
       try {
-        const stat = (0, import_node_fs9.statSync)(dir);
+        const stat = (0, import_node_fs12.statSync)(dir);
         if (!stat.isDirectory()) continue;
-        const entries = (0, import_node_fs9.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
+        const entries = (0, import_node_fs12.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
         if (entries.length > 0) {
           const relPath = dir.replace(rootDir + "/", "").replace(rootDir + "\\", "");
           result.set(relPath, entries);
@@ -2396,7 +3582,7 @@ function loadCustomTaggers(registry, config, rootDir, disabled) {
   for (const entry of config.taggers?.custom ?? []) {
     if (disabled.has(entry.id)) continue;
     try {
-      const absPath = (0, import_node_path11.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path14.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const tagger = "default" in mod ? mod.default : mod;
       const override = config.taggers?.trackUntagged?.[tagger.id];
@@ -2419,24 +3605,24 @@ function createTaggerRegistry(config, rootDir) {
 }
 
 // src/server/graph/core/tag-store.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs13 = require("node:fs");
+var import_node_path15 = require("node:path");
 var TAGS_FILENAME = "tags.json";
 var GRAPHS_DIR = ".launchsecure/graphs";
 var tagCache = /* @__PURE__ */ new Map();
 function tagsFilePath(rootDir) {
-  return (0, import_node_path12.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
+  return (0, import_node_path15.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
 }
 function readTagStore(rootDir) {
   const filePath = tagsFilePath(rootDir);
-  if (!(0, import_node_fs10.existsSync)(filePath)) return {};
-  const stat = (0, import_node_fs10.statSync)(filePath);
+  if (!(0, import_node_fs13.existsSync)(filePath)) return {};
+  const stat = (0, import_node_fs13.statSync)(filePath);
   const cached = tagCache.get(filePath);
   if (cached && cached.mtimeMs === stat.mtimeMs) {
     return cached.store;
   }
   try {
-    const content = (0, import_node_fs10.readFileSync)(filePath, "utf-8");
+    const content = (0, import_node_fs13.readFileSync)(filePath, "utf-8");
     const store = JSON.parse(content);
     tagCache.set(filePath, { mtimeMs: stat.mtimeMs, store });
     return store;
@@ -2446,15 +3632,15 @@ function readTagStore(rootDir) {
 }
 function writeTagStore(rootDir, store) {
   const filePath = tagsFilePath(rootDir);
-  const dir = (0, import_node_path12.dirname)(filePath);
-  (0, import_node_fs10.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_node_path15.dirname)(filePath);
+  (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
   const cleaned = {};
   for (const [nodeId, tags] of Object.entries(store)) {
     if (Object.keys(tags).length > 0) {
       cleaned[nodeId] = tags;
     }
   }
-  (0, import_node_fs10.writeFileSync)(filePath, JSON.stringify(cleaned, null, 2) + "\n", "utf-8");
+  (0, import_node_fs13.writeFileSync)(filePath, JSON.stringify(cleaned, null, 2) + "\n", "utf-8");
   tagCache.delete(filePath);
 }
 function setTag(rootDir, nodeId, key, value) {
@@ -2474,22 +3660,27 @@ function removeTag(rootDir, nodeId, key) {
 }
 
 // src/server/graph/index.ts
+init_ts_extractor();
 var GRAPHS_DIR2 = ".launchsecure/graphs";
-var LAYERS = ["ui", "api", "db"];
+function getAvailableLayers(rootDir) {
+  const dir = (0, import_node_path16.join)(rootDir, GRAPHS_DIR2);
+  if (!(0, import_node_fs14.existsSync)(dir)) return [];
+  return (0, import_node_fs14.readdirSync)(dir).filter((f) => f.endsWith(".json") && f !== "tags.json").map((f) => f.replace(".json", ""));
+}
 var graphCache = /* @__PURE__ */ new Map();
 var taggedCache = /* @__PURE__ */ new Map();
 function graphsDir(rootDir) {
-  return (0, import_node_path13.join)(rootDir, GRAPHS_DIR2);
+  return (0, import_node_path16.join)(rootDir, GRAPHS_DIR2);
 }
 function graphFilePath(rootDir, layer) {
-  return (0, import_node_path13.join)(graphsDir(rootDir), `${layer}.json`);
+  return (0, import_node_path16.join)(graphsDir(rootDir), `${layer}.json`);
 }
 function tagsFilePath2(rootDir) {
-  return (0, import_node_path13.join)(graphsDir(rootDir), "tags.json");
+  return (0, import_node_path16.join)(graphsDir(rootDir), "tags.json");
 }
 function getMtimeMs(filePath) {
-  if (!(0, import_node_fs11.existsSync)(filePath)) return 0;
-  return (0, import_node_fs11.statSync)(filePath).mtimeMs;
+  if (!(0, import_node_fs14.existsSync)(filePath)) return 0;
+  return (0, import_node_fs14.statSync)(filePath).mtimeMs;
 }
 function invalidateCache(filePath) {
   graphCache.delete(filePath);
@@ -2528,20 +3719,20 @@ function applyTags(graph, layer, rootDir) {
 }
 function readGraphRaw(rootDir, layer) {
   const filePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs11.existsSync)(filePath)) return null;
-  const stat = (0, import_node_fs11.statSync)(filePath);
+  if (!(0, import_node_fs14.existsSync)(filePath)) return null;
+  const stat = (0, import_node_fs14.statSync)(filePath);
   const cached = graphCache.get(filePath);
   if (cached && cached.mtimeMs === stat.mtimeMs) {
     return cached.graph;
   }
-  const content = (0, import_node_fs11.readFileSync)(filePath, "utf-8");
+  const content = (0, import_node_fs14.readFileSync)(filePath, "utf-8");
   const graph = JSON.parse(content);
   graphCache.set(filePath, { mtimeMs: stat.mtimeMs, graph });
   return graph;
 }
 function readGraph(rootDir, layer) {
   const rawFilePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs11.existsSync)(rawFilePath)) return null;
+  if (!(0, import_node_fs14.existsSync)(rawFilePath)) return null;
   const rawMtime = getMtimeMs(rawFilePath);
   const tagsMtime = getMtimeMs(tagsFilePath2(rootDir));
   const cacheKey = `${rootDir}:${layer}`;
@@ -2557,7 +3748,7 @@ function readGraph(rootDir, layer) {
 }
 function readAllGraphs(rootDir) {
   const result = {};
-  for (const layer of LAYERS) {
+  for (const layer of getAvailableLayers(rootDir)) {
     const graph = readGraph(rootDir, layer);
     if (graph) result[layer] = graph;
   }
@@ -2571,11 +3762,11 @@ async function generateGraph(rootDir, layer) {
     mutationMethods: config.parsers?.patterns?.mutationMethods
   });
   const dir = graphsDir(rootDir);
-  (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs14.mkdirSync)(dir, { recursive: true });
   const results = layer ? [generateLayer(rootDir, layer)].filter((r) => r !== null) : generateAll(rootDir);
   for (const result of results) {
     const filePath = graphFilePath(rootDir, result.layer);
-    (0, import_node_fs11.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
+    (0, import_node_fs14.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
     invalidateCache(filePath);
     invalidateTaggedCache(rootDir, result.layer);
   }
@@ -2584,28 +3775,28 @@ async function generateGraph(rootDir, layer) {
 
 // src/server/lockfile.ts
 var import_node_child_process = require("node:child_process");
-var import_node_fs12 = require("node:fs");
+var import_node_fs15 = require("node:fs");
 var import_node_os = require("node:os");
-var import_node_path14 = require("node:path");
+var import_node_path17 = require("node:path");
 function lockDir(projectRoot) {
   if (projectRoot) {
-    return (0, import_node_path14.join)(projectRoot, ".launchsecure");
+    return (0, import_node_path17.join)(projectRoot, ".launchsecure");
   }
-  return (0, import_node_path14.join)((0, import_node_os.homedir)(), ".launchsecure");
+  return (0, import_node_path17.join)((0, import_node_os.homedir)(), ".launchsecure");
 }
 function lockPath(projectRoot) {
-  return (0, import_node_path14.join)(lockDir(projectRoot), "launch-chart.lock");
+  return (0, import_node_path17.join)(lockDir(projectRoot), "launch-chart.lock");
 }
 var _activeProjectRoot;
 function readLock(projectRoot) {
   const root = projectRoot ?? _activeProjectRoot;
   const p = lockPath(root);
-  if (!(0, import_node_fs12.existsSync)(p)) {
+  if (!(0, import_node_fs15.existsSync)(p)) {
     if (root) {
       const globalP = lockPath();
-      if ((0, import_node_fs12.existsSync)(globalP)) {
+      if ((0, import_node_fs15.existsSync)(globalP)) {
         try {
-          const data = JSON.parse((0, import_node_fs12.readFileSync)(globalP, "utf-8"));
+          const data = JSON.parse((0, import_node_fs15.readFileSync)(globalP, "utf-8"));
           if (typeof data.pid === "number" && typeof data.port === "number" && data.cwd === root) {
             return data;
           }
@@ -2616,7 +3807,7 @@ function readLock(projectRoot) {
     return null;
   }
   try {
-    const data = JSON.parse((0, import_node_fs12.readFileSync)(p, "utf-8"));
+    const data = JSON.parse((0, import_node_fs15.readFileSync)(p, "utf-8"));
     if (typeof data.pid !== "number" || typeof data.port !== "number") return null;
     return data;
   } catch {
@@ -2653,7 +3844,7 @@ function getLiveLock(projectRoot) {
   const live = listenerPid !== null ? listenerPid === lock.pid : isPidAlive(lock.pid);
   if (!live) {
     try {
-      (0, import_node_fs12.unlinkSync)(lockPath(root));
+      (0, import_node_fs15.unlinkSync)(lockPath(root));
     } catch {
     }
     return null;
@@ -2662,20 +3853,299 @@ function getLiveLock(projectRoot) {
 }
 function writeLock(data, projectRoot) {
   const root = projectRoot ?? _activeProjectRoot;
-  (0, import_node_fs12.mkdirSync)(lockDir(root), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(lockPath(root), JSON.stringify(data, null, 2) + "\n", "utf-8");
+  (0, import_node_fs15.mkdirSync)(lockDir(root), { recursive: true });
+  (0, import_node_fs15.writeFileSync)(lockPath(root), JSON.stringify(data, null, 2) + "\n", "utf-8");
   if (root) _activeProjectRoot = root;
 }
 function clearLock(projectRoot) {
   const root = projectRoot ?? _activeProjectRoot;
   try {
-    (0, import_node_fs12.unlinkSync)(lockPath(root));
+    (0, import_node_fs15.unlinkSync)(lockPath(root));
   } catch {
   }
 }
 
 // src/server/chart-serve.ts
 init_config();
+
+// src/server/graph/core/audit-core.ts
+var import_node_fs16 = require("node:fs");
+var import_node_path18 = require("node:path");
+function readGraphFile(rootDir, layer) {
+  const filePath = (0, import_node_path18.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  if (!(0, import_node_fs16.existsSync)(filePath)) return null;
+  try {
+    return JSON.parse((0, import_node_fs16.readFileSync)(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function checkSchemaDrift(rootDir) {
+  const findings = [];
+  const db = readGraphFile(rootDir, "db");
+  if (!db) {
+    findings.push({ id: "no-db-graph", severity: "info", category: "schema_drift", title: "No DB graph", detail: "Run generate_graph first to populate the DB layer." });
+    return buildReport("db", "schema_drift", findings);
+  }
+  for (const c of db.contradictions ?? []) {
+    const isTableLevel = c.detail.includes("Table ") && (c.detail.includes("has no CREATE TABLE") || c.detail.includes("not in schema.prisma"));
+    findings.push({
+      id: `drift:${c.entity}`,
+      severity: isTableLevel ? "error" : "warning",
+      category: "schema_drift",
+      title: c.entity,
+      detail: c.detail
+    });
+  }
+  return buildReport("db", "schema_drift", findings);
+}
+function checkOrphanFks(rootDir) {
+  const findings = [];
+  const db = readGraphFile(rootDir, "db");
+  if (!db) return buildReport("db", "orphan_fks", findings);
+  for (const f of db.flagged_edges ?? []) {
+    findings.push({
+      id: `fk:${f.source}->${f.target}`,
+      severity: "warning",
+      category: "orphan_fks",
+      title: `${f.source} \u2192 ${f.target}`,
+      detail: f.label
+    });
+  }
+  return buildReport("db", "orphan_fks", findings);
+}
+function checkUnprotectedRoutes(rootDir) {
+  const findings = [];
+  const api = readGraphFile(rootDir, "api");
+  const staticGraph = readGraphFile(rootDir, "static");
+  if (!api) return buildReport("api", "unprotected_routes", findings);
+  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
+  let routePermsContent = "";
+  if ((0, import_node_fs16.existsSync)(routePermsPath)) {
+    routePermsContent = (0, import_node_fs16.readFileSync)(routePermsPath, "utf-8");
+  }
+  const registeredRoutes = /* @__PURE__ */ new Set();
+  const routeEntryRe = /path:\s*'([^']+)'/g;
+  let rm;
+  while ((rm = routeEntryRe.exec(routePermsContent)) !== null) {
+    registeredRoutes.add(rm[1].replace(/:(\w+)/g, "[$1]"));
+  }
+  for (const node of api.nodes) {
+    if (node.type !== "endpoint") continue;
+    const route = node.route ?? "";
+    if (!route) continue;
+    const normalized = "/api" + (route.startsWith("/") ? route : "/" + route);
+    const isRegistered = registeredRoutes.has(normalized) || [...registeredRoutes].some((r) => routeMatchesPattern(normalized, r));
+    if (!isRegistered) {
+      const methods = node.methods ?? [];
+      findings.push({
+        id: `unprotected:${node.id}`,
+        severity: "warning",
+        category: "unprotected_routes",
+        title: `${methods.join(",")} ${route}`,
+        detail: `API endpoint has no entry in ROUTE_PERMISSIONS. Methods: ${methods.join(", ")}`,
+        file: node.id
+      });
+    }
+  }
+  return buildReport("api", "unprotected_routes", findings);
+}
+function routeMatchesPattern(route, pattern) {
+  const routeParts = route.split("/");
+  const patternParts = pattern.split("/");
+  if (routeParts.length !== patternParts.length) return false;
+  for (let i = 0; i < routeParts.length; i++) {
+    const rp = routeParts[i];
+    const pp = patternParts[i];
+    if (rp === pp) continue;
+    if (pp.startsWith("[") || pp.startsWith(":")) continue;
+    if (rp.startsWith("[") || rp.startsWith(":")) continue;
+    return false;
+  }
+  return true;
+}
+function checkDeadScreens(rootDir) {
+  const findings = [];
+  const ui = readGraphFile(rootDir, "ui");
+  if (!ui) return buildReport("ui", "dead_screens", findings);
+  const pages = ui.nodes.filter((n) => n.type === "page" || n.type === "layout");
+  const navTargets = /* @__PURE__ */ new Set();
+  for (const e of ui.edges) {
+    if (e.type === "navigates" || e.type === "renders" || e.type === "imports") {
+      navTargets.add(e.target);
+    }
+  }
+  for (const cr of ui.cross_refs ?? []) {
+    navTargets.add(cr.target);
+  }
+  for (const page of pages) {
+    if (page.id.endsWith("layout.tsx") && page.id.split("/").length <= 2) continue;
+    if (["error.tsx", "loading.tsx", "not-found.tsx", "template.tsx"].some((s) => page.id.endsWith(s))) continue;
+    if (!navTargets.has(page.id)) {
+      findings.push({
+        id: `dead:${page.id}`,
+        severity: "info",
+        category: "dead_screens",
+        title: page.name,
+        detail: `Page "${page.id}" has no incoming navigation, render, or import edges.`,
+        file: page.id
+      });
+    }
+  }
+  return buildReport("ui", "dead_screens", findings);
+}
+function checkUnenforcedPermissions(rootDir) {
+  const findings = [];
+  const staticGraph = readGraphFile(rootDir, "static");
+  if (!staticGraph) return buildReport("static", "unenforced_permissions", findings);
+  const permissions = staticGraph.nodes.filter((n) => n.type === "seed_permission").map((n) => ({ id: n.id, key: n.value, name: n.name }));
+  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
+  let routePermsContent = "";
+  if ((0, import_node_fs16.existsSync)(routePermsPath)) {
+    routePermsContent = (0, import_node_fs16.readFileSync)(routePermsPath, "utf-8");
+  }
+  for (const perm of permissions) {
+    const regex = new RegExp(`permission:\\s*['"]${perm.key}['"]`);
+    if (!regex.test(routePermsContent)) {
+      findings.push({
+        id: `unenforced:${perm.key}`,
+        severity: "warning",
+        category: "unenforced_permissions",
+        title: `${perm.name} (${perm.key})`,
+        detail: `Permission "${perm.key}" exists in seed data but has no entry in ROUTE_PERMISSIONS \u2014 no API route requires it.`
+      });
+    }
+  }
+  return buildReport("static", "unenforced_permissions", findings);
+}
+function checkHardcodedValues(rootDir) {
+  const findings = [];
+  const staticGraph = readGraphFile(rootDir, "static");
+  if (!staticGraph) return buildReport("static", "hardcoded_values", findings);
+  const knownValues = /* @__PURE__ */ new Set();
+  for (const n of staticGraph.nodes) {
+    if (n.type === "enum_value") knownValues.add(n.value);
+  }
+  const api = readGraphFile(rootDir, "api");
+  if (!api) return buildReport("static", "hardcoded_values", findings);
+  const allCapsRe = /['"]([A-Z][A-Z_]{2,})['"]/g;
+  const seen = /* @__PURE__ */ new Set();
+  for (const node of api.nodes) {
+    if (node.type !== "endpoint") continue;
+    const filePath = (0, import_node_path18.join)(rootDir, "src", node.id);
+    if (!(0, import_node_fs16.existsSync)(filePath)) continue;
+    const content = (0, import_node_fs16.readFileSync)(filePath, "utf-8");
+    let m;
+    allCapsRe.lastIndex = 0;
+    while ((m = allCapsRe.exec(content)) !== null) {
+      const val = m[1];
+      if (knownValues.has(val)) continue;
+      if (["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS", "UTF", "NULL", "TRUE", "FALSE", "JSON", "HTML", "CSS", "ENV"].includes(val)) continue;
+      const key = `${node.id}:${val}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({
+        id: `hardcoded:${key}`,
+        severity: "info",
+        category: "hardcoded_values",
+        title: `"${val}" in ${node.id}`,
+        detail: `ALL_CAPS string literal "${val}" appears in API code but is not in the enum/seed inventory. May be an unregistered constant.`,
+        file: node.id
+      });
+    }
+  }
+  return buildReport("static", "hardcoded_values", findings);
+}
+function buildReport(layer, check, findings) {
+  return {
+    layer,
+    check,
+    findings,
+    summary: {
+      errors: findings.filter((f) => f.severity === "error").length,
+      warnings: findings.filter((f) => f.severity === "warning").length,
+      info: findings.filter((f) => f.severity === "info").length
+    },
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var CHECKS = {
+  db: {
+    schema_drift: checkSchemaDrift,
+    orphan_fks: checkOrphanFks
+  },
+  api: {
+    unprotected_routes: checkUnprotectedRoutes
+  },
+  ui: {
+    dead_screens: checkDeadScreens
+  },
+  static: {
+    unenforced_permissions: checkUnenforcedPermissions,
+    hardcoded_values: checkHardcodedValues
+  }
+};
+function getAvailableChecks() {
+  const result = {};
+  for (const [layer, checks] of Object.entries(CHECKS)) {
+    result[layer] = Object.keys(checks);
+  }
+  return result;
+}
+function runAudit(rootDir, layer, check) {
+  if (layer === "all") {
+    const reports = [];
+    for (const [l, checks] of Object.entries(CHECKS)) {
+      for (const fn of Object.values(checks)) {
+        reports.push(fn(rootDir));
+      }
+    }
+    return reports;
+  }
+  const layerChecks = CHECKS[layer];
+  if (!layerChecks) {
+    return [{
+      layer,
+      check: "unknown",
+      findings: [{ id: "invalid-layer", severity: "error", category: "system", title: "Invalid layer", detail: `Layer "${layer}" has no audit checks. Available: ${Object.keys(CHECKS).join(", ")}` }],
+      summary: { errors: 1, warnings: 0, info: 0 },
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    }];
+  }
+  if (check) {
+    const fn = layerChecks[check];
+    if (!fn) {
+      return [{
+        layer,
+        check,
+        findings: [{ id: "invalid-check", severity: "error", category: "system", title: "Invalid check", detail: `Check "${check}" not found for layer "${layer}". Available: ${Object.keys(layerChecks).join(", ")}` }],
+        summary: { errors: 1, warnings: 0, info: 0 },
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }];
+    }
+    return [fn(rootDir)];
+  }
+  return Object.values(layerChecks).map((fn) => fn(rootDir));
+}
+function formatAsPrompt(reports) {
+  const lines = [];
+  for (const report of reports) {
+    if (report.findings.length === 0) continue;
+    lines.push(`## ${report.layer.toUpperCase()} \u2014 ${report.check} (${report.findings.length} findings)`);
+    lines.push("");
+    for (const f of report.findings) {
+      const tag = f.severity === "error" ? "ERROR" : f.severity === "warning" ? "WARNING" : "INFO";
+      const filePart = f.file ? ` (${f.file}${f.line ? `:${f.line}` : ""})` : "";
+      lines.push(`- [${tag}] ${f.title}${filePart}`);
+      lines.push(`  ${f.detail}`);
+    }
+    lines.push("");
+  }
+  if (lines.length === 0) return "No audit findings.";
+  return lines.join("\n");
+}
+
+// src/server/chart-serve.ts
 var MAX_PORT_SCAN = 3;
 function randomPort() {
   return 49152 + Math.floor(Math.random() * (65535 - 49152));
@@ -2694,31 +4164,39 @@ var MIME_TYPES = {
 function findProjectRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 8; i++) {
-    const graphsDir2 = import_node_path15.default.join(dir, ".launchsecure", "graphs");
-    if (import_node_fs13.default.existsSync(import_node_path15.default.join(graphsDir2, "ui.json")) || import_node_fs13.default.existsSync(import_node_path15.default.join(graphsDir2, "api.json")) || import_node_fs13.default.existsSync(import_node_path15.default.join(graphsDir2, "db.json"))) return dir;
-    const parent = import_node_path15.default.dirname(dir);
+    const graphsDir2 = import_node_path19.default.join(dir, ".launchsecure", "graphs");
+    if (import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "ui.json")) || import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "api.json")) || import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "db.json"))) return dir;
+    const parent = import_node_path19.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   dir = startDir;
   for (let i = 0; i < 8; i++) {
-    if (import_node_fs13.default.existsSync(import_node_path15.default.join(dir, ".git"))) return dir;
-    const parent = import_node_path15.default.dirname(dir);
+    if (import_node_fs17.default.existsSync(import_node_path19.default.join(dir, ".git"))) return dir;
+    const parent = import_node_path19.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return startDir;
 }
-async function buildMergedGraph(projectRoot) {
-  let graphs = readAllGraphs(projectRoot);
-  if (!graphs.ui && !graphs.api && !graphs.db) {
-    await generateGraph(projectRoot);
-    graphs = readAllGraphs(projectRoot);
+function resolveRequestRoot(url, monorepoRoot, projects) {
+  const projectParam = url.searchParams.get("project");
+  if (!projectParam || projects.length === 0) return monorepoRoot;
+  const resolved = import_node_path19.default.resolve(monorepoRoot, projectParam);
+  if (!resolved.startsWith(monorepoRoot)) {
+    throw new Error("Project path outside monorepo root");
+  }
+  return resolved;
+}
+async function buildMergedGraph(root) {
+  let graphs = readAllGraphs(root);
+  if (Object.keys(graphs).length === 0) {
+    await generateGraph(root);
+    graphs = readAllGraphs(root);
   }
   const nodes = [];
   const rawLinks = [];
-  const LAYERS2 = ["ui", "api", "db"];
-  for (const layer of LAYERS2) {
+  for (const layer of Object.keys(graphs)) {
     const g = graphs[layer];
     if (!g) continue;
     for (const n of g.nodes) {
@@ -2755,16 +4233,16 @@ async function buildMergedGraph(projectRoot) {
   };
 }
 function serveStatic(res, filePath) {
-  if (!import_node_fs13.default.existsSync(filePath) || !import_node_fs13.default.statSync(filePath).isFile()) return false;
-  const ext = import_node_path15.default.extname(filePath).toLowerCase();
+  if (!import_node_fs17.default.existsSync(filePath) || !import_node_fs17.default.statSync(filePath).isFile()) return false;
+  const ext = import_node_path19.default.extname(filePath).toLowerCase();
   const mime = MIME_TYPES[ext] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": mime, "Cache-Control": "no-cache" });
-  import_node_fs13.default.createReadStream(filePath).pipe(res);
+  import_node_fs17.default.createReadStream(filePath).pipe(res);
   return true;
 }
 function serveIndex(res, clientDir) {
-  const indexPath = import_node_path15.default.join(clientDir, "index.html");
-  if (!import_node_fs13.default.existsSync(indexPath)) {
+  const indexPath = import_node_path19.default.join(clientDir, "index.html");
+  if (!import_node_fs17.default.existsSync(indexPath)) {
     res.writeHead(500, { "Content-Type": "text/plain" });
     res.end(`LaunchChart client bundle not found at ${clientDir}. Run 'npm run build:chart-client'.`);
     return;
@@ -2816,19 +4294,40 @@ async function startChartServer(opts = {}) {
     }
     return { port: existing.port, url: existing.url };
   }
-  const clientDir = opts.clientDir ?? import_node_path15.default.join(__dirname, "..", "chart-client");
+  const clientDir = opts.clientDir ?? import_node_path19.default.join(__dirname, "..", "chart-client");
+  const rootConfig = loadConfig(projectRoot);
+  const projects = rootConfig.projects ?? [];
   const server = import_node_http.default.createServer((req, res) => {
     try {
       const url2 = new URL(req.url ?? "/", `http://${req.headers.host}`);
+      let reqRoot;
+      try {
+        reqRoot = resolveRequestRoot(url2, projectRoot, projects);
+      } catch (err) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: String(err) }));
+        return;
+      }
+      if (req.method === "GET" && url2.pathname === "/api/projects") {
+        const projectList = projects.length > 0 ? projects.map((p) => {
+          const absRoot = import_node_path19.default.resolve(projectRoot, p.root);
+          const hasGraphs = import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, ".launchsecure", "graphs"));
+          const hasNextConfig2 = import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.ts")) || import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.js")) || import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.mjs"));
+          return { name: p.name, root: p.root, hasGraphs, hasNextConfig: hasNextConfig2 };
+        }) : [{ name: import_node_path19.default.basename(projectRoot), root: ".", hasGraphs: import_node_fs17.default.existsSync(import_node_path19.default.join(projectRoot, ".launchsecure", "graphs")), hasNextConfig: true }];
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ projects: projectList, monorepoRoot: projectRoot }));
+        return;
+      }
       if (req.method === "GET" && url2.pathname === "/api/project-graph") {
         const regenerate = url2.searchParams.get("regenerate") === "1";
         (async () => {
-          if (regenerate) await generateGraph(projectRoot);
-          const merged = await buildMergedGraph(projectRoot);
+          if (regenerate) await generateGraph(reqRoot);
+          const merged = await buildMergedGraph(reqRoot);
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({
             ...merged,
-            debug: { cwd, projectRoot }
+            debug: { cwd, projectRoot: reqRoot }
           }));
         })().catch((e) => {
           res.writeHead(500);
@@ -2837,15 +4336,15 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/raw-graphs") {
-        const graphs = readAllGraphs(projectRoot);
+        const graphs = readAllGraphs(reqRoot);
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ui: graphs.ui ?? null, api: graphs.api ?? null, db: graphs.db ?? null }));
         return;
       }
       if (req.method === "POST" && url2.pathname === "/api/generate-graph") {
         (async () => {
-          await generateGraph(projectRoot);
-          const graphs = readAllGraphs(projectRoot);
+          await generateGraph(reqRoot);
+          const graphs = readAllGraphs(reqRoot);
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({
             ok: true,
@@ -2861,41 +4360,43 @@ async function startChartServer(opts = {}) {
       }
       if (req.method === "GET" && url2.pathname === "/api/file-content") {
         const relPath = url2.searchParams.get("path");
-        if (!relPath || relPath.includes("..") || import_node_path15.default.isAbsolute(relPath)) {
+        if (!relPath || relPath.includes("..") || import_node_path19.default.isAbsolute(relPath)) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "Invalid path" }));
           return;
         }
-        const filePath = import_node_path15.default.join(projectRoot, relPath);
-        if (!filePath.startsWith(projectRoot) || !import_node_fs13.default.existsSync(filePath) || !import_node_fs13.default.statSync(filePath).isFile()) {
+        const filePath = import_node_path19.default.join(reqRoot, relPath);
+        if (!filePath.startsWith(reqRoot) || !import_node_fs17.default.existsSync(filePath) || !import_node_fs17.default.statSync(filePath).isFile()) {
           res.writeHead(404, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "File not found" }));
           return;
         }
-        const ext = import_node_path15.default.extname(filePath).toLowerCase();
+        const ext = import_node_path19.default.extname(filePath).toLowerCase();
         const langMap = { ".ts": "typescript", ".tsx": "tsx", ".js": "javascript", ".jsx": "jsx", ".prisma": "prisma", ".json": "json", ".css": "css" };
-        const content = import_node_fs13.default.readFileSync(filePath, "utf-8");
+        const content = import_node_fs17.default.readFileSync(filePath, "utf-8");
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ content, language: langMap[ext] ?? "text", path: relPath }));
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/health") {
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: true, projectRoot }));
+        res.end(JSON.stringify({ ok: true, projectRoot: reqRoot }));
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/parser-config") {
-        const config2 = loadConfig(projectRoot);
-        const detection = [
-          { id: "react-nextjs", layer: "ui", label: "React + Next.js", detected: reactNextjsParser.detect(projectRoot) },
-          { id: "nextjs-routes", layer: "api", label: "Next.js API Routes", detected: nextjsRoutesParser.detect(projectRoot) },
-          { id: "prisma-schema", layer: "db", label: "Prisma Schema", detected: prismaSchemaParser.detect(projectRoot) }
-        ];
-        const crosslayerParsers = [
-          { id: "fetch-resolver", label: "Fetch / api.method() calls" },
-          { id: "api-annotations", label: "@api annotations" },
-          { id: "url-literal-scanner", label: "/api/... URL literals" }
-        ];
+        const config2 = loadConfig(reqRoot);
+        const registry = createRegistry(config2, reqRoot);
+        const detection = [];
+        for (const parser of registry.getAll()) {
+          if ("layers" in parser && Array.isArray(parser.layers)) {
+            const mp = parser;
+            detection.push({ id: mp.id, layers: mp.layers, detected: mp.detect(reqRoot) });
+          } else if ("layer" in parser && parser.layer !== "crosslayer") {
+            const sp = parser;
+            detection.push({ id: sp.id, layers: [sp.layer], detected: sp.detect(reqRoot) });
+          }
+        }
+        const crosslayerParsers = registry.getCrossLayerParsers().map((p) => ({ id: p.id }));
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ config: config2, detection, crosslayerParsers }));
         return;
@@ -2908,8 +4409,8 @@ async function startChartServer(opts = {}) {
         req.on("end", () => {
           try {
             const newConfig = JSON.parse(body);
-            const configPath = import_node_path15.default.join(projectRoot, ".launchchart.json");
-            import_node_fs13.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
+            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err) {
@@ -2920,7 +4421,7 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/tagger-config") {
-        const config2 = loadConfig(projectRoot);
+        const config2 = loadConfig(reqRoot);
         const builtinTaggers = [
           { id: "module", tagKey: "module", trackUntagged: config2.taggers?.trackUntagged?.module ?? true },
           { id: "screen", tagKey: "screen", trackUntagged: config2.taggers?.trackUntagged?.screen ?? true }
@@ -2940,10 +4441,10 @@ async function startChartServer(opts = {}) {
         req.on("end", () => {
           try {
             const taggerConfig = JSON.parse(body);
-            const config2 = loadConfig(projectRoot);
+            const config2 = loadConfig(reqRoot);
             config2.taggers = taggerConfig;
-            const configPath = import_node_path15.default.join(projectRoot, ".launchchart.json");
-            import_node_fs13.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
+            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err) {
@@ -2954,7 +4455,7 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/tags") {
-        const store = readTagStore(projectRoot);
+        const store = readTagStore(reqRoot);
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify(store));
         return;
@@ -2972,7 +4473,7 @@ async function startChartServer(opts = {}) {
               res.end(JSON.stringify({ ok: false, error: "nodeId, key, and value are required" }));
               return;
             }
-            setTag(projectRoot, nodeId, key, value);
+            setTag(reqRoot, nodeId, key, value);
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err) {
@@ -2995,7 +4496,76 @@ async function startChartServer(opts = {}) {
               res.end(JSON.stringify({ ok: false, error: "nodeId and key are required" }));
               return;
             }
-            removeTag(projectRoot, nodeId, key);
+            removeTag(reqRoot, nodeId, key);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: String(err) }));
+          }
+        });
+        return;
+      }
+      if (req.method === "GET" && url2.pathname === "/api/detected-paths") {
+        const config2 = loadConfig(reqRoot);
+        const paths = resolveProjectPaths(reqRoot, config2);
+        const isOverride = !!config2.paths?.appDir;
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+          projectRoot: reqRoot,
+          detected: paths ? {
+            srcDir: import_node_path19.default.relative(reqRoot, paths.srcDir) || ".",
+            appDir: import_node_path19.default.relative(reqRoot, paths.appDir),
+            apiDir: import_node_path19.default.relative(reqRoot, paths.apiDir)
+          } : null,
+          isOverride
+        }));
+        return;
+      }
+      if (req.method === "GET" && url2.pathname === "/api/browse-dir") {
+        const browsePath = url2.searchParams.get("path") || projectRoot;
+        const abs = import_node_path19.default.resolve(browsePath);
+        const twoUp = import_node_path19.default.resolve(projectRoot, "..", "..");
+        if (!abs.startsWith(twoUp)) {
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Path outside allowed range" }));
+          return;
+        }
+        try {
+          const entries = import_node_fs17.default.readdirSync(abs, { withFileTypes: true });
+          const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules" && e.name !== "dist" && e.name !== ".next").map((e) => e.name).sort();
+          const parent = abs !== twoUp ? import_node_path19.default.dirname(abs) : null;
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ current: abs, parent, dirs, relative: import_node_path19.default.relative(projectRoot, abs) || "." }));
+        } catch (err) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(err) }));
+        }
+        return;
+      }
+      if (req.method === "GET" && url2.pathname === "/api/audit") {
+        const layer = url2.searchParams.get("layer") ?? "all";
+        const check = url2.searchParams.get("check") ?? void 0;
+        const reports = runAudit(reqRoot, layer, check);
+        const prompt = formatAsPrompt(reports);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ reports, prompt, checks: getAvailableChecks() }));
+        return;
+      }
+      if (req.method === "POST" && url2.pathname === "/api/projects") {
+        let body = "";
+        req.on("data", (chunk) => {
+          body += chunk.toString();
+        });
+        req.on("end", () => {
+          try {
+            const { projects: newProjects } = JSON.parse(body);
+            const config2 = loadConfig(projectRoot);
+            config2.projects = newProjects.length > 0 ? newProjects : void 0;
+            const configPath = import_node_path19.default.join(projectRoot, ".launchchart.json");
+            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+            projects.length = 0;
+            if (config2.projects) projects.push(...config2.projects);
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err) {
@@ -3006,7 +4576,7 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (url2.pathname !== "/") {
-        const staticPath = import_node_path15.default.join(clientDir, url2.pathname);
+        const staticPath = import_node_path19.default.join(clientDir, url2.pathname);
         if (serveStatic(res, staticPath)) return;
       }
       serveIndex(res, clientDir);
@@ -3044,6 +4614,10 @@ async function startChartServer(opts = {}) {
 `);
     process.stderr.write(`[launch-chart] project root: ${projectRoot}
 `);
+    if (projects.length > 0) {
+      process.stderr.write(`[launch-chart] multi-project mode: ${projects.length} projects
+`);
+    }
   }
   return { port, url };
 }