@launchsecure/launch-kit 0.0.13 → 0.0.14

package/dist/server/graph-mcp-entry.js

@@ -155,7 +155,45 @@ var init_config = __esm({
   }
 });
 
+// src/server/graph/core/resolve-paths.ts
+function resolveProjectPaths(rootDir, config) {
+  if (config.paths?.appDir) {
+    const appDir = (0, import_node_path3.join)(rootDir, config.paths.appDir);
+    const srcDir = config.paths.srcDir ? (0, import_node_path3.join)(rootDir, config.paths.srcDir) : (0, import_node_path3.dirname)(appDir);
+    return { srcDir, appDir, apiDir: (0, import_node_path3.join)(appDir, "api") };
+  }
+  const srcApp = (0, import_node_path3.join)(rootDir, "src", "app");
+  if ((0, import_node_fs3.existsSync)(srcApp)) {
+    return { srcDir: (0, import_node_path3.join)(rootDir, "src"), appDir: srcApp, apiDir: (0, import_node_path3.join)(srcApp, "api") };
+  }
+  const rootApp = (0, import_node_path3.join)(rootDir, "app");
+  if ((0, import_node_fs3.existsSync)(rootApp)) {
+    return { srcDir: rootDir, appDir: rootApp, apiDir: (0, import_node_path3.join)(rootApp, "api") };
+  }
+  return null;
+}
+var import_node_fs3, import_node_path3;
+var init_resolve_paths = __esm({
+  "src/server/graph/core/resolve-paths.ts"() {
+    "use strict";
+    import_node_fs3 = require("node:fs");
+    import_node_path3 = require("node:path");
+  }
+});
+
 // src/server/graph/core/ts-extractor.ts
+var ts_extractor_exports = {};
+__export(ts_extractor_exports, {
+  classifyFile: () => classifyFile,
+  createQuery: () => createQuery,
+  extractAuthWrappersTS: () => extractAuthWrappersTS,
+  extractDbCallsTS: () => extractDbCallsTS,
+  extractDeep: () => extractDeep,
+  initTreeSitter: () => initTreeSitter,
+  parseCodeTS: () => parseCodeTS,
+  parseFileTS: () => parseFileTS,
+  setExtractorConfig: () => setExtractorConfig
+});
 async function initTreeSitter() {
   if (initialized) return;
   if (initPromise) return initPromise;
@@ -179,17 +217,25 @@ function getQuery(name) {
   ensureInit();
   const cached = queryCache.get(name);
   if (cached) return cached;
-  const scmPath = (0, import_node_path3.join)(queriesDir, `${name}.scm`);
-  const scm = (0, import_node_fs3.readFileSync)(scmPath, "utf-8");
+  const scmPath = (0, import_node_path4.join)(queriesDir, `${name}.scm`);
+  const scm = (0, import_node_fs4.readFileSync)(scmPath, "utf-8");
   const query = tsxLanguage.query(scm);
   queryCache.set(name, query);
   return query;
 }
 function parseSource(absPath) {
   ensureInit();
-  const content = (0, import_node_fs3.readFileSync)(absPath, "utf-8");
+  const content = (0, import_node_fs4.readFileSync)(absPath, "utf-8");
   return parserInstance.parse(content);
 }
+function parseCodeTS(code) {
+  ensureInit();
+  return parserInstance.parse(code);
+}
+function createQuery(pattern) {
+  ensureInit();
+  return tsxLanguage.query(pattern);
+}
 function setExtractorConfig(config) {
   extraDbIdentifiers = config.dbIdentifiers ?? [];
   extraMutationMethods = config.mutationMethods ?? [];
@@ -644,17 +690,17 @@ function extractDeep(absPath) {
   }
   return { elements, stateVars, conditions, variables, responses, params };
 }
-var import_node_fs3, import_node_path3, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods;
+var import_node_fs4, import_node_path4, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
-    import_node_fs3 = require("node:fs");
-    import_node_path3 = require("node:path");
+    import_node_fs4 = require("node:fs");
+    import_node_path4 = require("node:path");
     initialized = false;
     queriesDir = (() => {
-      const srcPath = (0, import_node_path3.join)((0, import_node_path3.dirname)(__filename), "..", "queries");
+      const srcPath = (0, import_node_path4.join)((0, import_node_path4.dirname)(__filename), "..", "queries");
       if (require("fs").existsSync(srcPath)) return srcPath;
-      return (0, import_node_path3.join)((0, import_node_path3.dirname)(__filename), "graph", "queries");
+      return (0, import_node_path4.join)((0, import_node_path4.dirname)(__filename), "graph", "queries");
     })();
     queryCache = /* @__PURE__ */ new Map();
     PRISMA_MUTATION_METHODS_BUILTIN = [
@@ -674,15 +720,15 @@ var init_ts_extractor = __esm({
   }
 });
 
-// src/server/graph/parsers/ui/react-nextjs.ts
+// src/server/graph/parsers/ts/typescript-project.ts
 function walk(dir, exts) {
   const results = [];
-  if (!(0, import_node_fs4.existsSync)(dir)) return results;
-  for (const entry of (0, import_node_fs4.readdirSync)(dir, { withFileTypes: true })) {
-    const full = (0, import_node_path4.join)(dir, entry.name);
+  if (!(0, import_node_fs5.existsSync)(dir)) return results;
+  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
+    const full = (0, import_node_path5.join)(dir, entry.name);
     if (entry.isDirectory()) {
       results.push(...walk(full, exts));
-    } else if (exts.includes((0, import_node_path4.extname)(entry.name))) {
+    } else if (exts.includes((0, import_node_path5.extname)(entry.name))) {
       results.push(full);
     }
   }
@@ -690,33 +736,33 @@ function walk(dir, exts) {
 }
 function walkWithIgnore(dir, exts, ignoreDirs) {
   const results = [];
-  if (!(0, import_node_fs4.existsSync)(dir)) return results;
-  for (const entry of (0, import_node_fs4.readdirSync)(dir, { withFileTypes: true })) {
+  if (!(0, import_node_fs5.existsSync)(dir)) return results;
+  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (ignoreDirs.has(entry.name)) continue;
-      results.push(...walkWithIgnore((0, import_node_path4.join)(dir, entry.name), exts, ignoreDirs));
-    } else if (exts.includes((0, import_node_path4.extname)(entry.name))) {
-      results.push((0, import_node_path4.join)(dir, entry.name));
+      results.push(...walkWithIgnore((0, import_node_path5.join)(dir, entry.name), exts, ignoreDirs));
+    } else if (exts.includes((0, import_node_path5.extname)(entry.name))) {
+      results.push((0, import_node_path5.join)(dir, entry.name));
     }
   }
   return results;
 }
 function toNodeId(srcDir, absPath) {
-  return (0, import_node_path4.relative)(srcDir, absPath).replace(/\\/g, "/");
+  return (0, import_node_path5.relative)(srcDir, absPath).replace(/\\/g, "/");
 }
 function resolveImport(srcDir, specifier) {
   if (!specifier.startsWith("@/")) return null;
   const rel = specifier.slice(2);
-  const base = (0, import_node_path4.join)(srcDir, rel);
-  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path4.join)(base, "index.ts"), (0, import_node_path4.join)(base, "index.tsx")]) {
-    if ((0, import_node_fs4.existsSync)(c) && (0, import_node_fs4.statSync)(c).isFile()) return c;
+  const base = (0, import_node_path5.join)(srcDir, rel);
+  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path5.join)(base, "index.ts"), (0, import_node_path5.join)(base, "index.tsx")]) {
+    if ((0, import_node_fs5.existsSync)(c) && (0, import_node_fs5.statSync)(c).isFile()) return c;
   }
   return null;
 }
 function resolveRelativeImport(fromFile, specifier) {
-  const base = (0, import_node_path4.join)((0, import_node_path4.dirname)(fromFile), specifier);
-  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path4.join)(base, "index.ts"), (0, import_node_path4.join)(base, "index.tsx")]) {
-    if ((0, import_node_fs4.existsSync)(c) && (0, import_node_fs4.statSync)(c).isFile()) return c;
+  const base = (0, import_node_path5.join)((0, import_node_path5.dirname)(fromFile), specifier);
+  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path5.join)(base, "index.ts"), (0, import_node_path5.join)(base, "index.tsx")]) {
+    if ((0, import_node_fs5.existsSync)(c) && (0, import_node_fs5.statSync)(c).isFile()) return c;
   }
   return null;
 }
@@ -737,7 +783,7 @@ function resolveBarrelMap(barrelAbsPath, parsedByPath, memo, visiting) {
     const resolved = resolveRelativeImport(barrelAbsPath, re.from);
     if (!resolved) continue;
     if (re.isWildcard) {
-      const targetBn = (0, import_node_path4.basename)(resolved);
+      const targetBn = (0, import_node_path5.basename)(resolved);
       const targetIsBarrel = targetBn === "index.ts" || targetBn === "index.tsx";
       if (targetIsBarrel) {
         const nested = resolveBarrelMap(resolved, parsedByPath, memo, visiting);
@@ -764,12 +810,12 @@ function buildAllBarrelMaps(srcDir, parsedByPath) {
   const barrels = /* @__PURE__ */ new Map();
   const memo = /* @__PURE__ */ new Map();
   for (const [absPath, parsed] of parsedByPath) {
-    const bn = (0, import_node_path4.basename)(absPath);
+    const bn = (0, import_node_path5.basename)(absPath);
     if (bn !== "index.ts" && bn !== "index.tsx") continue;
     if (parsed.reExports.length === 0) continue;
     const map = resolveBarrelMap(absPath, parsedByPath, memo, /* @__PURE__ */ new Set());
     if (map.size > 0) {
-      const barrelId = (0, import_node_path4.relative)(srcDir, (0, import_node_path4.dirname)(absPath)).replace(/\\/g, "/");
+      const barrelId = (0, import_node_path5.relative)(srcDir, (0, import_node_path5.dirname)(absPath)).replace(/\\/g, "/");
       barrels.set(barrelId, map);
     }
   }
@@ -790,7 +836,18 @@ function extractRoute(id) {
   return route || "/";
 }
 function nameFromFilename(absPath) {
-  return (0, import_node_path4.basename)(absPath, (0, import_node_path4.extname)(absPath)).replace(/[-_](\w)/g, (_, c) => c.toUpperCase()).replace(/^(\w)/, (_, c) => c.toUpperCase());
+  return (0, import_node_path5.basename)(absPath, (0, import_node_path5.extname)(absPath)).replace(/[-_](\w)/g, (_, c) => c.toUpperCase()).replace(/^(\w)/, (_, c) => c.toUpperCase());
+}
+function filePathToApiRoute(apiDir, absPath) {
+  let route = "/" + (0, import_node_path5.relative)(apiDir, absPath).replace(/\\/g, "/").replace(/\/route\.tsx?$/, "");
+  route = route.replace(/\[([^\]]+)\]/g, ":$1");
+  route = route.replace(/\/+/g, "/");
+  if (route === "/") return "/api";
+  return "/api" + route;
+}
+function camelToPascal(s) {
+  if (!s) return s;
+  return s.charAt(0).toUpperCase() + s.slice(1);
 }
 function resolveTemplateLiteralRoute(template, routeToNodeId) {
   const parameterized = template.replace(/\$\{([^}]+)\}/g, (_, expr) => {
@@ -871,7 +928,7 @@ function matchRouteToPage(route, routeToNodeId) {
   if (routeToNodeId.has(normalized)) return routeToNodeId.get(normalized);
   return null;
 }
-function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap, barrelMaps, routeToNodeId) {
+function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, barrelMaps, routeToNodeId) {
   const edges = [];
   const flagged = [];
   const seen = /* @__PURE__ */ new Set();
@@ -883,7 +940,7 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap,
     if (label) edge.label = label;
     edges.push(edge);
   }
-  function edgeTypeFor(_targetId, isTypeOnlyImport, importedNames) {
+  function edgeTypeFor(isTypeOnlyImport, importedNames) {
     if (isTypeOnlyImport) return "imports";
     const anyRendered = importedNames.some((n) => parsed.jsxElements.has(n));
     if (anyRendered) return "renders";
@@ -908,14 +965,14 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap,
         }
         for (const [targetId, targetNames] of byTarget) {
           const allType = isTypeOnly || targetNames.every((n) => typeNames.has(n));
-          addEdge(targetId, edgeTypeFor(targetId, allType, targetNames));
+          addEdge(targetId, edgeTypeFor(allType, targetNames));
         }
       } else {
         const resolved = resolveImport(srcDir, specifier);
         if (resolved) {
           const targetId = toNodeId(srcDir, resolved);
           if (nodeIdSet.has(targetId) && !targetId.endsWith("/index.ts") && !targetId.endsWith("/index.tsx")) {
-            addEdge(targetId, edgeTypeFor(targetId, isTypeOnly, names));
+            addEdge(targetId, edgeTypeFor(isTypeOnly, names));
           }
         }
       }
@@ -924,7 +981,7 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap,
       if (resolved) {
         const targetId = toNodeId(srcDir, resolved);
         if (nodeIdSet.has(targetId) && !targetId.endsWith("/index.ts") && !targetId.endsWith("/index.tsx")) {
-          addEdge(targetId, edgeTypeFor(targetId, isTypeOnly, names));
+          addEdge(targetId, edgeTypeFor(isTypeOnly, names));
         }
       }
     }
@@ -966,74 +1023,113 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, nodeTypeMap,
   }
   return { edges, flagged };
 }
+function hasNextConfig(rootDir) {
+  return (0, import_node_fs5.existsSync)((0, import_node_path5.join)(rootDir, "next.config.ts")) || (0, import_node_fs5.existsSync)((0, import_node_path5.join)(rootDir, "next.config.js")) || (0, import_node_fs5.existsSync)((0, import_node_path5.join)(rootDir, "next.config.mjs"));
+}
 function detect(rootDir) {
-  return (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "src", "app")) && (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.ts")) || (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.js")) || (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.mjs"));
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  return paths !== null && hasNextConfig(rootDir);
 }
 function generate(rootDir) {
-  const srcDir = (0, import_node_path4.join)(rootDir, "src");
-  const appFiles = walk((0, import_node_path4.join)(srcDir, "app"), [".tsx", ".ts"]).filter(
-    (f) => (0, import_node_path4.basename)(f) !== "route.ts" && (0, import_node_path4.basename)(f) !== "route.tsx"
-  );
-  const clientFiles = walk((0, import_node_path4.join)(srcDir, "client"), [".tsx", ".ts"]);
-  const serverFiles = walk((0, import_node_path4.join)(srcDir, "server"), [".ts", ".tsx"]).filter(
-    (f) => (0, import_node_path4.basename)(f) !== "route.ts" && (0, import_node_path4.basename)(f) !== "route.tsx"
-  );
-  const libFiles = walk((0, import_node_path4.join)(srcDir, "lib"), [".ts", ".tsx"]);
-  const configFiles = walk((0, import_node_path4.join)(srcDir, "config"), [".ts", ".tsx"]);
+  const config = loadConfig(rootDir);
+  const paths = resolveProjectPaths(rootDir, config);
+  const srcDir = paths.srcDir;
+  const apiDir = paths.apiDir;
+  const appFiles = walk(paths.appDir, [".tsx", ".ts"]);
+  const clientFiles = walk((0, import_node_path5.join)(srcDir, "client"), [".tsx", ".ts"]);
+  const serverFiles = walk((0, import_node_path5.join)(srcDir, "server"), [".ts", ".tsx"]);
+  const libFiles = walk((0, import_node_path5.join)(srcDir, "lib"), [".ts", ".tsx"]);
+  const configFiles = walk((0, import_node_path5.join)(srcDir, "config"), [".ts", ".tsx"]);
   const allDiscovered = [...appFiles, ...clientFiles, ...serverFiles, ...libFiles, ...configFiles];
   const parsedByPath = /* @__PURE__ */ new Map();
   for (const absPath of allDiscovered) {
     parsedByPath.set(absPath, parseFileTS(absPath));
   }
   const barrelMaps = buildAllBarrelMaps(srcDir, parsedByPath);
-  const fileSet = allDiscovered.filter((f) => !(0, import_node_path4.basename)(f).startsWith("index."));
-  const nodes = [];
+  const uiNodes = [];
+  const apiNodes = [];
   const nodeIdSet = /* @__PURE__ */ new Set();
-  const nodeTypeMap = /* @__PURE__ */ new Map();
   const routeToNodeId = /* @__PURE__ */ new Map();
+  const fileSet = allDiscovered.filter((f) => !(0, import_node_path5.basename)(f).startsWith("index."));
   for (const absPath of fileSet) {
     const id = toNodeId(srcDir, absPath);
     const type = classifyType(absPath, id);
+    if (type === "test" || type === "story") continue;
     const parsed = parsedByPath.get(absPath);
     const name = parsed.name || nameFromFilename(absPath);
-    const route = extractRoute(id);
-    const deep = extractDeep(absPath);
-    nodes.push({
-      id,
-      type,
-      name,
-      route,
-      exports: parsed.exports,
-      elements: deep.elements,
-      stateVars: deep.stateVars,
-      conditions: deep.conditions,
-      variables: deep.variables
-    });
+    const layer = CLASSIFICATION_TO_LAYER[type] ?? "ui";
     nodeIdSet.add(id);
-    nodeTypeMap.set(id, type);
-    if (route) routeToNodeId.set(route, id);
+    if (layer === "api") {
+      const methods = [];
+      for (const exp of parsed.exports) {
+        if (HTTP_METHODS.has(exp)) methods.push(exp);
+      }
+      const dbCalls = extractDbCallsTS(absPath);
+      const authWrappers = extractAuthWrappersTS(absPath);
+      const deep = extractDeep(absPath);
+      const routePath = (0, import_node_fs5.existsSync)(apiDir) ? filePathToApiRoute(apiDir, absPath) : `/api/${id.replace(/\/route\.tsx?$/, "")}`;
+      const mutations = dbCalls.filter((c) => c.isMutation);
+      const mutates = mutations.length > 0;
+      const authStrategy = [...authWrappers];
+      apiNodes.push({
+        id,
+        type: "endpoint",
+        name: routePath,
+        layer: "api",
+        path: routePath,
+        methods,
+        handler: id,
+        mutates,
+        auth: authStrategy.length > 0 ? authStrategy : ["public"],
+        db_models: [...new Set(dbCalls.map((c) => c.model))],
+        db_operations: [...new Set(dbCalls.map((c) => `${c.model}.${c.method}`))],
+        conditions: deep.conditions,
+        variables: deep.variables,
+        responses: deep.responses,
+        params: deep.params,
+        _dbCalls: dbCalls
+        // temp: used for cross-ref building below
+      });
+    } else {
+      const route = extractRoute(id);
+      const deep = extractDeep(absPath);
+      uiNodes.push({
+        id,
+        type,
+        name,
+        layer: "ui",
+        route,
+        exports: parsed.exports,
+        elements: deep.elements,
+        stateVars: deep.stateVars,
+        conditions: deep.conditions,
+        variables: deep.variables
+      });
+      if (route) routeToNodeId.set(route, id);
+    }
   }
-  const allEdges = [];
-  const allFlagged = [];
+  const uiEdges = [];
+  const uiFlagged = [];
   for (const absPath of fileSet) {
-    const sourceId = toNodeId(srcDir, absPath);
+    const id = toNodeId(srcDir, absPath);
+    if (!nodeIdSet.has(id)) continue;
     const parsed = parsedByPath.get(absPath);
     const { edges, flagged } = extractEdges(
       srcDir,
       absPath,
-      sourceId,
+      id,
       parsed,
       nodeIdSet,
-      nodeTypeMap,
       barrelMaps,
       routeToNodeId
     );
-    allEdges.push(...edges);
-    allFlagged.push(...flagged);
+    uiEdges.push(...edges);
+    uiFlagged.push(...flagged);
   }
   const fetchCallEntries = [];
   for (const absPath of fileSet) {
     const sourceId = toNodeId(srcDir, absPath);
+    if (!nodeIdSet.has(sourceId)) continue;
     const parsed = parsedByPath.get(absPath);
     if (parsed.fetchCalls.length === 0) continue;
     fetchCallEntries.push({
@@ -1048,7 +1144,7 @@ function generate(rootDir) {
     });
   }
   const externalScanned = new Set(allDiscovered.map((f) => f.replace(/\\/g, "/")));
-  const IGNORE_DIRS = /* @__PURE__ */ new Set([
+  const IGNORE_DIRS2 = /* @__PURE__ */ new Set([
     "node_modules",
     ".next",
     "dist",
@@ -1061,7 +1157,7 @@ function generate(rootDir) {
     "out",
     ".vercel"
   ]);
-  const externalCandidates = walkWithIgnore(rootDir, [".ts", ".tsx"], IGNORE_DIRS);
+  const externalCandidates = walkWithIgnore(rootDir, [".ts", ".tsx"], IGNORE_DIRS2);
   for (const absPath of externalCandidates) {
     const normalized = absPath.replace(/\\/g, "/");
     if (externalScanned.has(normalized)) continue;
@@ -1071,11 +1167,11 @@ function generate(rootDir) {
     } catch {
       continue;
     }
-    const externalId = (0, import_node_path4.relative)(rootDir, absPath).replace(/\\/g, "/");
+    const externalId = (0, import_node_path5.relative)(rootDir, absPath).replace(/\\/g, "/");
     const edgesFromThis = [];
     const seen = /* @__PURE__ */ new Set();
     for (const imp of parsed.imports) {
-      const { specifier, isTypeOnly, names } = imp;
+      const { specifier, names } = imp;
       let resolved = null;
       if (specifier.startsWith("@/")) {
         const relToSrc = specifier.slice(2);
@@ -1101,25 +1197,52 @@ function generate(rootDir) {
       const targetId = toNodeId(srcDir, resolved);
       if (!nodeIdSet.has(targetId)) continue;
       if (targetId.endsWith("/index.ts") || targetId.endsWith("/index.tsx")) continue;
-      const key = `${externalId}\u2192${targetId}\u2192${isTypeOnly ? "type" : "value"}`;
+      const key = `${externalId}\u2192${targetId}`;
       if (seen.has(key)) continue;
       seen.add(key);
       edgesFromThis.push({ source: externalId, target: targetId, type: "imports" });
     }
     if (edgesFromThis.length === 0) continue;
-    nodes.push({
+    uiNodes.push({
       id: externalId,
       type: "external",
       name: parsed.name || nameFromFilename(absPath),
+      layer: "ui",
       route: null,
       exports: parsed.exports
     });
     nodeIdSet.add(externalId);
-    nodeTypeMap.set(externalId, "external");
-    allEdges.push(...edgesFromThis);
+    uiEdges.push(...edgesFromThis);
+  }
+  const apiCrossRefs = [];
+  for (const node of apiNodes) {
+    const dbCalls = node._dbCalls;
+    if (!dbCalls) continue;
+    const seenModels = /* @__PURE__ */ new Set();
+    for (const call of dbCalls) {
+      if (seenModels.has(call.model)) continue;
+      seenModels.add(call.model);
+      apiCrossRefs.push({
+        source: node.id,
+        target: camelToPascal(call.model),
+        type: call.isMutation ? "mutates" : "reads",
+        layer: "db"
+      });
+    }
+    delete node._dbCalls;
+  }
+  const apiNodeIds = new Set(apiNodes.map((n) => n.id));
+  const apiEdges = [];
+  const uiOnlyEdges = [];
+  for (const edge of uiEdges) {
+    if (apiNodeIds.has(edge.source)) {
+      apiEdges.push(edge);
+    } else {
+      uiOnlyEdges.push(edge);
+    }
   }
   const flaggedSet = /* @__PURE__ */ new Set();
-  const dedupedFlagged = allFlagged.filter((f) => {
+  const dedupedFlagged = uiFlagged.filter((f) => {
     const key = `${f.source}\u2192${f.target}\u2192${f.label}`;
     if (flaggedSet.has(key)) return false;
     flaggedSet.add(key);
@@ -1136,10 +1259,12 @@ function generate(rootDir) {
     hook: 7,
     lib: 8
   };
-  nodes.sort((a, b) => (typePriority[a.type] ?? 99) - (typePriority[b.type] ?? 99) || a.id.localeCompare(b.id));
-  allEdges.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
-  const byType = (t) => nodes.filter((n) => n.type === t).length;
-  const stats = {
+  uiNodes.sort((a, b) => (typePriority[a.type] ?? 99) - (typePriority[b.type] ?? 99) || a.id.localeCompare(b.id));
+  uiOnlyEdges.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  apiNodes.sort((a, b) => (a.path ?? "").localeCompare(b.path ?? ""));
+  apiCrossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  const byType = (t) => uiNodes.filter((n) => n.type === t).length;
+  const uiStats = {
     total_pages: byType("page"),
     total_layouts: byType("layout"),
     total_components: byType("component"),
@@ -1150,196 +1275,122 @@ function generate(rootDir) {
     total_utils: byType("util"),
     total_libs: byType("lib"),
     total_external: byType("external"),
-    total_edges: allEdges.length,
+    total_edges: uiOnlyEdges.length,
     total_flagged: dedupedFlagged.length
   };
-  return {
+  const stripLayer = (nodes) => nodes.map(({ layer: _, ...rest }) => rest);
+  const result = /* @__PURE__ */ new Map();
+  result.set("ui", {
     metadata: {
       generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
       scope: "main-app-only",
       app_root: "src/",
       layer: "ui",
-      parser: "react-nextjs-ast",
-      ...stats,
+      parser: "typescript-project",
+      ...uiStats,
       notes: "Auto-generated via TypeScript AST \u2014 edges derived from actual imports, renders from JSX usage, navigations from router/Link calls."
     },
-    nodes,
-    edges: allEdges,
+    nodes: stripLayer(uiNodes),
+    edges: uiOnlyEdges,
     cross_refs: [],
     contradictions: [],
     warnings: [],
     flagged_edges: dedupedFlagged,
     patterns: {
-      total_nodes: nodes.length,
-      by_type: stats,
+      total_nodes: uiNodes.length,
+      by_type: uiStats,
       by_edge_type: {
-        renders: allEdges.filter((e) => e.type === "renders").length,
-        imports: allEdges.filter((e) => e.type === "imports").length,
-        navigates: allEdges.filter((e) => e.type === "navigates").length
+        renders: uiOnlyEdges.filter((e) => e.type === "renders").length,
+        imports: uiOnlyEdges.filter((e) => e.type === "imports").length,
+        navigates: uiOnlyEdges.filter((e) => e.type === "navigates").length
       },
       fetch_calls: fetchCallEntries
     }
-  };
-}
-var import_node_fs4, import_node_path4, reactNextjsParser;
-var init_react_nextjs = __esm({
-  "src/server/graph/parsers/ui/react-nextjs.ts"() {
-    "use strict";
-    import_node_fs4 = require("node:fs");
-    import_node_path4 = require("node:path");
-    init_ts_extractor();
-    reactNextjsParser = {
-      id: "react-nextjs",
-      layer: "ui",
-      detect,
-      generate
-    };
-  }
-});
-
-// src/server/graph/parsers/api/nextjs-routes.ts
-function walk2(dir) {
-  const results = [];
-  if (!(0, import_node_fs5.existsSync)(dir)) return results;
-  for (const entry of (0, import_node_fs5.readdirSync)(dir, { withFileTypes: true })) {
-    const full = (0, import_node_path5.join)(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...walk2(full));
-    } else if (entry.name === "route.ts" || entry.name === "route.tsx") {
-      results.push(full);
-    }
-  }
-  return results;
-}
-function filePathToRoute(apiDir, absPath) {
-  let route = "/" + (0, import_node_path5.relative)(apiDir, absPath).replace(/\\/g, "/").replace(/\/route\.tsx?$/, "");
-  route = route.replace(/\[([^\]]+)\]/g, ":$1");
-  route = route.replace(/\/+/g, "/");
-  if (route === "/") return "/api";
-  return "/api" + route;
-}
-function camelToPascal(s) {
-  if (!s) return s;
-  return s.charAt(0).toUpperCase() + s.slice(1);
-}
-function detect2(rootDir) {
-  return (0, import_node_fs5.existsSync)((0, import_node_path5.join)(rootDir, "src", "app", "api"));
-}
-function generate2(rootDir) {
-  const apiDir = (0, import_node_path5.join)(rootDir, "src", "app", "api");
-  const routeFiles = walk2(apiDir);
-  const nodes = [];
-  const edges = [];
-  const crossRefs = [];
-  const mutatorCount = {};
-  const authUsage = {};
-  let endpointsWithAuth = 0;
-  let endpointsWithDbAccess = 0;
-  for (const absPath of routeFiles) {
-    const parsed = parseFileTS(absPath);
-    const dbCalls = extractDbCallsTS(absPath);
-    const authWrappers = extractAuthWrappersTS(absPath);
-    const methods = [];
-    for (const exp of parsed.exports) {
-      if (HTTP_METHODS.has(exp)) methods.push(exp);
-    }
-    const routePath = filePathToRoute(apiDir, absPath);
-    const relPath = (0, import_node_path5.relative)(rootDir, absPath).replace(/\\/g, "/");
-    const mutations = dbCalls.filter((c) => c.isMutation);
-    const reads = dbCalls.filter((c) => !c.isMutation);
-    const mutates = mutations.length > 0;
-    if (mutates) {
-      for (const m of mutations) {
-        mutatorCount[m.method] = (mutatorCount[m.method] ?? 0) + 1;
+  });
+  if (apiNodes.length > 0) {
+    const mutatorNodes = apiNodes.filter((n) => n.mutates).length;
+    const readOnlyNodes = apiNodes.filter((n) => !n.mutates).length;
+    const authUsage = {};
+    let endpointsWithAuth = 0;
+    for (const n of apiNodes) {
+      const auth = n.auth;
+      if (auth.length > 0 && auth[0] !== "public") {
+        endpointsWithAuth++;
+        for (const w of auth) {
+          authUsage[w] = (authUsage[w] ?? 0) + 1;
+        }
       }
     }
-    if (dbCalls.length > 0) endpointsWithDbAccess++;
-    const authStrategy = [];
-    for (const w of authWrappers) {
-      authStrategy.push(w);
-      authUsage[w] = (authUsage[w] ?? 0) + 1;
+    const mutatorCount = {};
+    for (const n of apiNodes) {
+      const ops = n.db_operations;
+      for (const op of ops) {
+        const method = op.split(".")[1];
+        if (method) mutatorCount[method] = (mutatorCount[method] ?? 0) + 1;
+      }
     }
-    if (authStrategy.length > 0) endpointsWithAuth++;
-    const deep = extractDeep(absPath);
-    nodes.push({
-      id: relPath,
-      type: "endpoint",
-      name: routePath,
-      path: routePath,
-      methods,
-      handler: relPath,
-      // Behavioral classification from handler body (AST-derived).
-      mutates,
-      auth: authStrategy.length > 0 ? authStrategy : ["public"],
-      db_models: [...new Set(dbCalls.map((c) => c.model))],
-      db_operations: [...new Set(dbCalls.map((c) => `${c.model}.${c.method}`))],
-      // Deep extraction fields
-      conditions: deep.conditions,
-      variables: deep.variables,
-      responses: deep.responses,
-      params: deep.params
+    result.set("api", {
+      metadata: {
+        generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+        scope: "main-app-only",
+        stack: "nextjs-app-router",
+        layer: "api",
+        parser: "typescript-project",
+        total_endpoints: apiNodes.length,
+        total_methods: apiNodes.reduce((sum, n) => sum + n.methods.length, 0),
+        endpoints_with_auth: endpointsWithAuth,
+        endpoints_with_db_access: apiNodes.filter((n) => n.db_models.length > 0).length,
+        mutator_endpoints: mutatorNodes,
+        read_only_endpoints: readOnlyNodes
+      },
+      nodes: stripLayer(apiNodes),
+      edges: apiEdges,
+      cross_refs: apiCrossRefs,
+      contradictions: [],
+      warnings: [],
+      flagged_edges: [],
+      patterns: {
+        total_endpoints: apiNodes.length,
+        methods_breakdown: [...HTTP_METHODS].reduce((acc, m) => {
+          acc[m] = apiNodes.filter((n) => n.methods.includes(m)).length;
+          return acc;
+        }, {}),
+        auth_strategies: authUsage,
+        mutation_operations: mutatorCount,
+        mutator_vs_reader: { mutators: mutatorNodes, readers: readOnlyNodes }
+      }
     });
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
-      if (seenModels.has(call.model)) continue;
-      seenModels.add(call.model);
-      crossRefs.push({
-        source: relPath,
-        target: camelToPascal(call.model),
-        type: call.isMutation ? "mutates" : "reads",
-        layer: "db"
-      });
-    }
   }
-  nodes.sort((a, b) => a.path.localeCompare(b.path));
-  crossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
-  const mutatorNodes = nodes.filter((n) => n.mutates).length;
-  const readOnlyNodes = nodes.filter((n) => !n.mutates).length;
-  return {
-    metadata: {
-      generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
-      scope: "main-app-only",
-      stack: "nextjs-app-router",
-      layer: "api",
-      parser: "nextjs-routes-ast",
-      total_endpoints: nodes.length,
-      total_methods: nodes.reduce((sum, n) => sum + n.methods.length, 0),
-      endpoints_with_auth: endpointsWithAuth,
-      endpoints_with_db_access: endpointsWithDbAccess,
-      mutator_endpoints: mutatorNodes,
-      read_only_endpoints: readOnlyNodes
-    },
-    nodes,
-    edges,
-    cross_refs: crossRefs,
-    contradictions: [],
-    warnings: [],
-    flagged_edges: [],
-    patterns: {
-      total_endpoints: nodes.length,
-      methods_breakdown: [...HTTP_METHODS].reduce((acc, m) => {
-        acc[m] = nodes.filter((n) => n.methods.includes(m)).length;
-        return acc;
-      }, {}),
-      auth_strategies: authUsage,
-      mutation_operations: mutatorCount,
-      mutator_vs_reader: { mutators: mutatorNodes, readers: readOnlyNodes }
-    }
-  };
+  return result;
 }
-var import_node_fs5, import_node_path5, HTTP_METHODS, nextjsRoutesParser;
-var init_nextjs_routes = __esm({
-  "src/server/graph/parsers/api/nextjs-routes.ts"() {
+var import_node_fs5, import_node_path5, HTTP_METHODS, CLASSIFICATION_TO_LAYER, typescriptProjectParser;
+var init_typescript_project = __esm({
+  "src/server/graph/parsers/ts/typescript-project.ts"() {
     "use strict";
     import_node_fs5 = require("node:fs");
     import_node_path5 = require("node:path");
+    init_config();
+    init_resolve_paths();
     init_ts_extractor();
     HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
-    nextjsRoutesParser = {
-      id: "nextjs-routes",
-      layer: "api",
-      detect: detect2,
-      generate: generate2
+    CLASSIFICATION_TO_LAYER = {
+      endpoint: "api",
+      page: "ui",
+      layout: "ui",
+      component: "ui",
+      ui: "ui",
+      hook: "ui",
+      context: "ui",
+      config: "ui",
+      lib: "ui",
+      "mcp-tool": "ui",
+      external: "ui"
+    };
+    typescriptProjectParser = {
+      id: "typescript-project",
+      layers: ["ui", "api"],
+      detect,
+      generate
     };
   }
 });
@@ -1434,10 +1485,10 @@ function parseEnums(content) {
   }
   return nodes;
 }
-function detect3(rootDir) {
+function detect2(rootDir) {
   return (0, import_node_fs6.existsSync)((0, import_node_path6.join)(rootDir, "prisma", "schema.prisma"));
 }
-function generate3(rootDir) {
+function generate2(rootDir) {
   const schemaPath = (0, import_node_path6.join)(rootDir, "prisma", "schema.prisma");
   const content = (0, import_node_fs6.readFileSync)(schemaPath, "utf-8");
   const { nodes: modelNodes, relations } = parseModels(content);
@@ -1497,6 +1548,430 @@ var init_prisma_schema = __esm({
     prismaSchemaParser = {
       id: "prisma-schema",
       layer: "db",
+      detect: detect2,
+      generate: generate2
+    };
+  }
+});
+
+// src/server/graph/parsers/db/sql-migrations.ts
+function pgTypeToPrisma(pgType) {
+  const upper = pgType.toUpperCase().trim();
+  return PG_TO_PRISMA[upper] ?? upper;
+}
+function parseCreateTable(sql, state) {
+  const re = /CREATE\s+TABLE\s+"(\w+)"\s*\(([\s\S]*?)\);/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    const tableName = m[1];
+    const body = m[2];
+    const columns = /* @__PURE__ */ new Map();
+    let primaryCol = null;
+    for (const line of body.split("\n")) {
+      const trimmed = line.trim().replace(/,\s*$/, "");
+      if (!trimmed || trimmed.startsWith("--")) continue;
+      const pkMatch = trimmed.match(/CONSTRAINT\s+"[^"]+"\s+PRIMARY\s+KEY\s*\("(\w+)"\)/i);
+      if (pkMatch) {
+        primaryCol = pkMatch[1];
+        continue;
+      }
+      if (/^\s*CONSTRAINT\s/i.test(trimmed)) continue;
+      const colMatch = trimmed.match(/^"(\w+)"\s+(.+)/);
+      if (!colMatch) continue;
+      const colName = colMatch[1];
+      let rest = colMatch[2];
+      const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
+      const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)(?:\s*,?\s*$)/i);
+      const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
+      let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim().replace(/,\s*$/, "").trim();
+      columns.set(colName, {
+        name: colName,
+        type: colType,
+        nullable: !isNotNull,
+        primary: false,
+        unique: false,
+        default: defaultVal
+      });
+    }
+    if (primaryCol && columns.has(primaryCol)) {
+      columns.get(primaryCol).primary = true;
+    }
+    state.tables.set(tableName, { name: tableName, columns });
+  }
+}
+function parseCreateEnum(sql, state) {
+  const re = /CREATE\s+TYPE\s+"(\w+)"\s+AS\s+ENUM\s*\(([^)]+)\)/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    const enumName = m[1];
+    const valuesStr = m[2];
+    const values = new Set(
+      valuesStr.split(",").map((v) => v.trim().replace(/^'(.*)'$/, "$1")).filter(Boolean)
+    );
+    state.enums.set(enumName, { name: enumName, values });
+  }
+}
+function parseAlterTable(sql, state) {
+  const addColRe = /ALTER\s+TABLE\s+"(\w+)"\s+ADD\s+COLUMN\s+"(\w+)"\s+(.+?);/gi;
+  let m;
+  while ((m = addColRe.exec(sql)) !== null) {
+    const tableName = m[1];
+    const colName = m[2];
+    let rest = m[3];
+    const table = state.tables.get(tableName);
+    if (!table) continue;
+    const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
+    const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)$/i);
+    const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
+    let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim();
+    table.columns.set(colName, {
+      name: colName,
+      type: colType,
+      nullable: !isNotNull,
+      primary: false,
+      unique: false,
+      default: defaultVal
+    });
+  }
+  const dropColRe = /ALTER\s+TABLE\s+"(\w+)"\s+DROP\s+COLUMN\s+"(\w+)"/gi;
+  while ((m = dropColRe.exec(sql)) !== null) {
+    const table = state.tables.get(m[1]);
+    if (table) table.columns.delete(m[2]);
+  }
+  const fkRe = /ALTER\s+TABLE\s+"(\w+)"\s+ADD\s+CONSTRAINT\s+"([^"]+)"\s+FOREIGN\s+KEY\s*\("(\w+)"\)\s+REFERENCES\s+"(\w+)"\("(\w+)"\)(?:\s+ON\s+DELETE\s+(\w+(?:\s+\w+)?))?/gi;
+  while ((m = fkRe.exec(sql)) !== null) {
+    state.fks.push({
+      constraintName: m[2],
+      sourceTable: m[1],
+      sourceColumn: m[3],
+      targetTable: m[4],
+      targetColumn: m[5],
+      onDelete: m[6] ?? null
+    });
+  }
+}
+function parseAlterEnum(sql, state) {
+  const re = /ALTER\s+TYPE\s+"(\w+)"\s+ADD\s+VALUE\s+'([^']+)'/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    const en = state.enums.get(m[1]);
+    if (en) en.values.add(m[2]);
+  }
+}
+function parseDropTable(sql, state) {
+  const re = /DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?"(\w+)"/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    state.tables.delete(m[1]);
+    state.fks = state.fks.filter((fk) => fk.sourceTable !== m[1] && fk.targetTable !== m[1]);
+  }
+}
+function parseUniqueIndex(sql, state) {
+  const re = /CREATE\s+UNIQUE\s+INDEX\s+"[^"]+"\s+ON\s+"(\w+)"\("(\w+)"\)/gi;
+  let m;
+  while ((m = re.exec(sql)) !== null) {
+    const table = state.tables.get(m[1]);
+    const col = table?.columns.get(m[2]);
+    if (col) col.unique = true;
+    if (!state.uniqueIndexes.has(m[1])) state.uniqueIndexes.set(m[1], /* @__PURE__ */ new Set());
+    state.uniqueIndexes.get(m[1]).add(m[2]);
+  }
+}
+function parseMigrations(rootDir) {
+  const migrationsDir = (0, import_node_path7.join)(rootDir, "prisma", "migrations");
+  const state = {
+    tables: /* @__PURE__ */ new Map(),
+    enums: /* @__PURE__ */ new Map(),
+    fks: [],
+    uniqueIndexes: /* @__PURE__ */ new Map()
+  };
+  if (!(0, import_node_fs7.existsSync)(migrationsDir)) return state;
+  const dirs = (0, import_node_fs7.readdirSync)(migrationsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  for (const dir of dirs) {
+    const sqlPath = (0, import_node_path7.join)(migrationsDir, dir, "migration.sql");
+    if (!(0, import_node_fs7.existsSync)(sqlPath)) continue;
+    const sql = (0, import_node_fs7.readFileSync)(sqlPath, "utf-8");
+    parseCreateEnum(sql, state);
+    parseCreateTable(sql, state);
+    parseAlterTable(sql, state);
+    parseAlterEnum(sql, state);
+    parseDropTable(sql, state);
+    parseUniqueIndex(sql, state);
+  }
+  return state;
+}
+function loadPrismaState(rootDir) {
+  const schemaPath = (0, import_node_path7.join)(rootDir, "prisma", "schema.prisma");
+  if (!(0, import_node_fs7.existsSync)(schemaPath)) return null;
+  const content = (0, import_node_fs7.readFileSync)(schemaPath, "utf-8");
+  const tables = /* @__PURE__ */ new Map();
+  const enums = /* @__PURE__ */ new Map();
+  const relations = [];
+  const modelRe = /model\s+(\w+)\s*\{([^}]+)\}/g;
+  let m;
+  while ((m = modelRe.exec(content)) !== null) {
+    const modelName = m[1];
+    const body = m[2];
+    const cols = [];
+    for (const line of body.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("//") && !l.startsWith("@@"))) {
+      const fm = line.match(/^(\w+)\s+(\S+)(.*)/);
+      if (!fm) continue;
+      const fieldName = fm[1];
+      const fieldType = fm[2];
+      const rest = fm[3] ?? "";
+      const baseType = fieldType.replace(/[?\[\]]/g, "");
+      const isRelation = rest.includes("@relation");
+      if (isRelation) {
+        const relArgs = rest.match(/@relation\(([^)]*)\)/)?.[1] ?? "";
+        const fieldsMatch = relArgs.match(/fields:\s*\[([^\]]+)\]/);
+        if (fieldsMatch) {
+          relations.push({ source: modelName, target: baseType, fk: fieldsMatch[1].trim() });
+        }
+        continue;
+      }
+      if (fieldType.endsWith("[]") || fieldType.endsWith("?") && content.includes(`model ${baseType}`)) {
+        if (new RegExp(`model\\s+${baseType}\\s*\\{`).test(content)) continue;
+      }
+      cols.push({
+        name: fieldName,
+        type: fieldType.replace("?", ""),
+        nullable: fieldType.endsWith("?") || fieldType.includes("?"),
+        primary: rest.includes("@id"),
+        unique: rest.includes("@unique")
+      });
+    }
+    tables.set(modelName, { columns: cols });
+  }
+  const enumRe = /enum\s+(\w+)\s*\{([^}]+)\}/g;
+  while ((m = enumRe.exec(content)) !== null) {
+    const values = m[2].split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("//"));
+    enums.set(m[1], values);
+  }
+  return { tables, enums, relations };
+}
+function verify(sqlState, prisma) {
+  const contradictions = [];
+  const flaggedEdges = [];
+  for (const [name] of sqlState.tables) {
+    if (!prisma.tables.has(name)) {
+      contradictions.push({
+        entity: name,
+        source_a: "sql-migrations",
+        source_b: "prisma-schema",
+        detail: `Table "${name}" exists in migrations but not in schema.prisma`
+      });
+    }
+  }
+  for (const [name] of prisma.tables) {
+    if (!sqlState.tables.has(name)) {
+      contradictions.push({
+        entity: name,
+        source_a: "prisma-schema",
+        source_b: "sql-migrations",
+        detail: `Table "${name}" in schema.prisma has no CREATE TABLE in migrations`
+      });
+    }
+  }
+  for (const [tableName, prismaTable] of prisma.tables) {
+    const sqlTable = sqlState.tables.get(tableName);
+    if (!sqlTable) continue;
+    for (const prismaCol of prismaTable.columns) {
+      const sqlCol = sqlTable.columns.get(prismaCol.name);
+      if (!sqlCol) {
+        contradictions.push({
+          entity: `${tableName}.${prismaCol.name}`,
+          source_a: "prisma-schema",
+          source_b: "sql-migrations",
+          detail: `Column "${tableName}.${prismaCol.name}" in schema.prisma but not in migrations`
+        });
+        continue;
+      }
+      const mappedSqlType = pgTypeToPrisma(sqlCol.type);
+      const prismaBaseType = prismaCol.type.replace(/[?\[\]]/g, "");
+      if (mappedSqlType !== prismaBaseType && mappedSqlType !== prismaCol.type) {
+        if (!sqlState.enums.has(prismaBaseType)) {
+          contradictions.push({
+            entity: `${tableName}.${prismaCol.name}`,
+            source_a: "sql-migrations",
+            source_b: "prisma-schema",
+            detail: `Column "${tableName}.${prismaCol.name}": SQL type "${sqlCol.type}" (\u2192${mappedSqlType}) vs Prisma type "${prismaCol.type}"`
+          });
+        }
+      }
+      if (sqlCol.nullable !== prismaCol.nullable) {
+        contradictions.push({
+          entity: `${tableName}.${prismaCol.name}`,
+          source_a: "sql-migrations",
+          source_b: "prisma-schema",
+          detail: `Column "${tableName}.${prismaCol.name}": ${sqlCol.nullable ? "nullable" : "NOT NULL"} in SQL vs ${prismaCol.nullable ? "optional" : "required"} in Prisma`
+        });
+      }
+    }
+    for (const [colName] of sqlTable.columns) {
+      const inPrisma = prismaTable.columns.some((c) => c.name === colName);
+      if (!inPrisma) {
+        contradictions.push({
+          entity: `${tableName}.${colName}`,
+          source_a: "sql-migrations",
+          source_b: "prisma-schema",
+          detail: `Column "${tableName}.${colName}" in migrations but not in schema.prisma`
+        });
+      }
+    }
+  }
+  for (const [name, sqlEnum] of sqlState.enums) {
+    const prismaValues = prisma.enums.get(name);
+    if (!prismaValues) {
+      contradictions.push({
+        entity: name,
+        source_a: "sql-migrations",
+        source_b: "prisma-schema",
+        detail: `Enum "${name}" exists in migrations but not in schema.prisma`
+      });
+      continue;
+    }
+    const prismaSet = new Set(prismaValues);
+    for (const val of sqlEnum.values) {
+      if (!prismaSet.has(val)) {
+        contradictions.push({
+          entity: `${name}.${val}`,
+          source_a: "sql-migrations",
+          source_b: "prisma-schema",
+          detail: `Enum "${name}": value "${val}" in migrations but not in schema.prisma`
+        });
+      }
+    }
+    for (const val of prismaValues) {
+      if (!sqlEnum.values.has(val)) {
+        contradictions.push({
+          entity: `${name}.${val}`,
+          source_a: "prisma-schema",
+          source_b: "sql-migrations",
+          detail: `Enum "${name}": value "${val}" in schema.prisma but not in migrations`
+        });
+      }
+    }
+  }
+  const prismaFkSet = new Set(prisma.relations.map((r) => `${r.source}|${r.target}|${r.fk}`));
+  for (const fk of sqlState.fks) {
+    const key = `${fk.sourceTable}|${fk.targetTable}|${fk.sourceColumn}`;
+    if (!prismaFkSet.has(key)) {
+      flaggedEdges.push({
+        source: fk.sourceTable,
+        target: fk.targetTable,
+        type: "belongs_to",
+        label: `FK "${fk.constraintName}" (${fk.sourceColumn}\u2192${fk.targetTable}) in migrations but no @relation in schema.prisma`,
+        confidence: "high"
+      });
+    }
+  }
+  return { contradictions, flaggedEdges };
+}
+function detect3(rootDir) {
+  const migrationsDir = (0, import_node_path7.join)(rootDir, "prisma", "migrations");
+  if (!(0, import_node_fs7.existsSync)(migrationsDir)) return false;
+  return (0, import_node_fs7.readdirSync)(migrationsDir, { withFileTypes: true }).some((d) => d.isDirectory() && (0, import_node_fs7.existsSync)((0, import_node_path7.join)(migrationsDir, d.name, "migration.sql")));
+}
+function generate3(rootDir) {
+  const sqlState = parseMigrations(rootDir);
+  const prisma = loadPrismaState(rootDir);
+  const prismaTableIds = prisma ? new Set(prisma.tables.keys()) : /* @__PURE__ */ new Set();
+  const prismaEnumIds = prisma ? new Set(prisma.enums.keys()) : /* @__PURE__ */ new Set();
+  const nodes = [];
+  for (const [name, table] of sqlState.tables) {
+    if (prismaTableIds.has(name)) continue;
+    nodes.push({
+      id: name,
+      type: "table",
+      name,
+      source: "sql",
+      columns: [...table.columns.values()].map((c) => ({
+        name: c.name,
+        type: c.type,
+        primary: c.primary,
+        unique: c.unique,
+        nullable: c.nullable,
+        default: c.default,
+        isRelation: false,
+        comment: null
+      }))
+    });
+  }
+  for (const [name, sqlEnum] of sqlState.enums) {
+    if (prismaEnumIds.has(name)) continue;
+    nodes.push({
+      id: name,
+      type: "enum",
+      name,
+      source: "sql",
+      values: [...sqlEnum.values]
+    });
+  }
+  const sqlOnlyTables = new Set(nodes.filter((n) => n.type === "table").map((n) => n.id));
+  const edges = sqlState.fks.filter((fk) => sqlOnlyTables.has(fk.sourceTable)).map((fk) => ({
+    source: fk.sourceTable,
+    target: fk.targetTable,
+    type: "belongs_to",
+    fk: fk.sourceColumn,
+    onDelete: fk.onDelete
+  }));
+  const { contradictions, flaggedEdges } = prisma ? verify(sqlState, prisma) : { contradictions: [], flaggedEdges: [] };
+  return {
+    metadata: {
+      generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+      scope: "sql-migrations",
+      source: "prisma/migrations/",
+      layer: "db",
+      sql_tables: sqlState.tables.size,
+      sql_enums: sqlState.enums.size,
+      sql_fks: sqlState.fks.length,
+      additive_nodes: nodes.length,
+      contradictions_found: contradictions.length,
+      flagged_edges_found: flaggedEdges.length
+    },
+    nodes,
+    edges,
+    cross_refs: [],
+    contradictions,
+    warnings: [],
+    flagged_edges: flaggedEdges
+  };
+}
+var import_node_fs7, import_node_path7, PG_TO_PRISMA, sqlMigrationsParser;
+var init_sql_migrations = __esm({
+  "src/server/graph/parsers/db/sql-migrations.ts"() {
+    "use strict";
+    import_node_fs7 = require("node:fs");
+    import_node_path7 = require("node:path");
+    PG_TO_PRISMA = {
+      "TEXT": "String",
+      "VARCHAR": "String",
+      "CHAR": "String",
+      "INTEGER": "Int",
+      "INT": "Int",
+      "SMALLINT": "Int",
+      "BIGINT": "BigInt",
+      "SERIAL": "Int",
+      "BOOLEAN": "Boolean",
+      "BOOL": "Boolean",
+      "TIMESTAMP(3)": "DateTime",
+      "TIMESTAMP": "DateTime",
+      "TIMESTAMPTZ": "DateTime",
+      "DATE": "DateTime",
+      "DOUBLE PRECISION": "Float",
+      "FLOAT": "Float",
+      "REAL": "Float",
+      "DECIMAL": "Decimal",
+      "NUMERIC": "Decimal",
+      "JSONB": "Json",
+      "JSON": "Json",
+      "BYTEA": "Bytes",
+      "UUID": "String",
+      "TEXT[]": "String[]"
+    };
+    sqlMigrationsParser = {
+      id: "sql-migrations",
+      layer: "db",
       detect: detect3,
       generate: generate3
     };
@@ -1728,36 +2203,36 @@ var init_fetch_resolver = __esm({
 });
 
 // src/server/graph/parsers/crosslayer/api-annotations.ts
-function walk3(dir, exts) {
-  if (!(0, import_node_fs7.existsSync)(dir)) return [];
+function walk2(dir, exts) {
+  if (!(0, import_node_fs8.existsSync)(dir)) return [];
   const results = [];
-  for (const entry of (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true })) {
+  for (const entry of (0, import_node_fs8.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const full = (0, import_node_path7.join)(dir, entry.name);
+    const full = (0, import_node_path8.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      results.push(...walk3(full, exts));
-    } else if (exts.includes((0, import_node_path7.extname)(entry.name))) {
+      results.push(...walk2(full, exts));
+    } else if (exts.includes((0, import_node_path8.extname)(entry.name))) {
       results.push(full);
     }
   }
   return results;
 }
 function toNodeId2(srcDir, absPath) {
-  return (0, import_node_path7.relative)(srcDir, absPath).replace(/\\/g, "/");
+  return (0, import_node_path8.relative)(srcDir, absPath).replace(/\\/g, "/");
 }
-var import_node_fs7, import_node_path7, API_ANNOTATION_RE, apiAnnotationsParser;
+var import_node_fs8, import_node_path8, API_ANNOTATION_RE, apiAnnotationsParser;
 var init_api_annotations = __esm({
   "src/server/graph/parsers/crosslayer/api-annotations.ts"() {
     "use strict";
-    import_node_fs7 = require("node:fs");
-    import_node_path7 = require("node:path");
+    import_node_fs8 = require("node:fs");
+    import_node_path8 = require("node:path");
     init_api_route_matching();
     API_ANNOTATION_RE = /@api\s+(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\s+(\/\S+)/g;
     apiAnnotationsParser = {
       id: "api-annotations",
       layer: "crosslayer",
       detect(rootDir) {
-        return (0, import_node_fs7.existsSync)((0, import_node_path7.join)(rootDir, "src"));
+        return (0, import_node_fs8.existsSync)((0, import_node_path8.join)(rootDir, "src"));
       },
       generate(rootDir, layerOutputs) {
         const apiOutput = layerOutputs.get("api");
@@ -1768,13 +2243,13 @@ var init_api_annotations = __esm({
         const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
         const apiRoutes = loadApiRoutesFromOutput(apiOutput);
         const apiPathMap = buildApiPathMap(apiRoutes);
-        const srcDir = (0, import_node_path7.join)(rootDir, "src");
-        const files = walk3(srcDir, [".ts", ".tsx"]);
+        const srcDir = (0, import_node_path8.join)(rootDir, "src");
+        const files = walk2(srcDir, [".ts", ".tsx"]);
         const crossRefs = [];
         const flaggedEdges = [];
         const seen = /* @__PURE__ */ new Set();
         for (const absPath of files) {
-          const content = (0, import_node_fs7.readFileSync)(absPath, "utf-8");
+          const content = (0, import_node_fs8.readFileSync)(absPath, "utf-8");
           const sourceId = toNodeId2(srcDir, absPath);
           if (!uiNodeIds.has(sourceId)) continue;
           let match;
@@ -1820,73 +2295,741 @@ var init_api_annotations = __esm({
 });
 
 // src/server/graph/parsers/crosslayer/url-literal-scanner.ts
-function walk4(dir, exts) {
-  if (!(0, import_node_fs8.existsSync)(dir)) return [];
+function walk3(dir, exts) {
+  if (!(0, import_node_fs9.existsSync)(dir)) return [];
   const results = [];
-  for (const entry of (0, import_node_fs8.readdirSync)(dir, { withFileTypes: true })) {
+  for (const entry of (0, import_node_fs9.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const full = (0, import_node_path8.join)(dir, entry.name);
+    const full = (0, import_node_path9.join)(dir, entry.name);
     if (entry.isDirectory()) {
-      results.push(...walk4(full, exts));
-    } else if (exts.includes((0, import_node_path8.extname)(entry.name))) {
+      results.push(...walk3(full, exts));
+    } else if (exts.includes((0, import_node_path9.extname)(entry.name))) {
       results.push(full);
     }
   }
-  return results;
-}
-function toNodeId3(srcDir, absPath) {
-  return (0, import_node_path8.relative)(srcDir, absPath).replace(/\\/g, "/");
+  return results;
+}
+function toNodeId3(srcDir, absPath) {
+  return (0, import_node_path9.relative)(srcDir, absPath).replace(/\\/g, "/");
+}
+var import_node_fs9, import_node_path9, URL_LITERAL_RE, urlLiteralScannerParser;
+var init_url_literal_scanner = __esm({
+  "src/server/graph/parsers/crosslayer/url-literal-scanner.ts"() {
+    "use strict";
+    import_node_fs9 = require("node:fs");
+    import_node_path9 = require("node:path");
+    init_api_route_matching();
+    init_config();
+    init_resolve_paths();
+    URL_LITERAL_RE = /['"`](\/api\/[^'"`\s]+?)['"`]/g;
+    urlLiteralScannerParser = {
+      id: "url-literal-scanner",
+      layer: "crosslayer",
+      detect(rootDir) {
+        const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+        return paths !== null;
+      },
+      generate(rootDir, layerOutputs) {
+        const apiOutput = layerOutputs.get("api");
+        if (!apiOutput) {
+          return { cross_refs: [], flagged_edges: [], warnings: [] };
+        }
+        const uiOutput = layerOutputs.get("ui");
+        const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
+        const apiRoutes = loadApiRoutesFromOutput(apiOutput);
+        const apiPathMap = buildApiPathMap(apiRoutes);
+        const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+        const srcDir = paths.srcDir;
+        const clientDir = (0, import_node_path9.join)(srcDir, "client");
+        const files = [
+          ...walk3(clientDir, [".ts", ".tsx"]),
+          ...walk3(paths.appDir, [".ts", ".tsx"])
+        ];
+        const crossRefs = [];
+        const seen = /* @__PURE__ */ new Set();
+        for (const absPath of files) {
+          const sourceId = toNodeId3(srcDir, absPath);
+          if (!uiNodeIds.has(sourceId)) continue;
+          const content = (0, import_node_fs9.readFileSync)(absPath, "utf-8");
+          let match;
+          URL_LITERAL_RE.lastIndex = 0;
+          while ((match = URL_LITERAL_RE.exec(content)) !== null) {
+            const urlPath = match[1];
+            const result = resolveUrlPath(urlPath, apiPathMap, apiRoutes);
+            if (result.kind === "resolved" && result.nodeId) {
+              const key = `${sourceId}|${result.nodeId}|references_api`;
+              if (seen.has(key)) continue;
+              seen.add(key);
+              crossRefs.push({
+                source: sourceId,
+                target: result.nodeId,
+                type: "references_api",
+                layer: "api"
+              });
+            }
+          }
+        }
+        return {
+          cross_refs: crossRefs,
+          flagged_edges: [],
+          warnings: [],
+          patterns: {
+            url_literals_resolved: crossRefs.length
+          }
+        };
+      }
+    };
+  }
+});
+
+// src/server/graph/parsers/static/static-values.ts
+function tryLoadTreeSitter() {
+  if (parseCode) return true;
+  try {
+    const extractor = (init_ts_extractor(), __toCommonJS(ts_extractor_exports));
+    if (typeof extractor.parseCodeTS === "function") {
+      parseCode = extractor.parseCodeTS;
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+function classifyScope(source, model) {
+  if (source.includes("prisma/schema.prisma")) return "shared";
+  if (source.includes("prisma/seed") && model) {
+    if (SHARED_MODELS.has(model)) return "shared";
+    if (DB_MODELS.has(model)) return "db";
+    return "shared";
+  }
+  if (source.startsWith("src/client/") || source.startsWith("src/app/")) return "fe";
+  if (source.startsWith("src/server/")) return "be";
+  if (source.startsWith("src/config/")) return "be";
+  if (source.startsWith("src/lib/")) return "shared";
+  return "shared";
+}
+function extractEnumValues(rootDir) {
+  const nodes = [];
+  const edges = [];
+  const schemaPaths = [
+    (0, import_node_path10.join)(rootDir, "prisma", "schema.prisma"),
+    (0, import_node_path10.join)(rootDir, "prisma", "schema")
+  ];
+  let content = "";
+  for (const p of schemaPaths) {
+    if ((0, import_node_fs10.existsSync)(p)) {
+      try {
+        const stat = (0, import_node_fs10.statSync)(p);
+        if (stat.isFile()) {
+          content = (0, import_node_fs10.readFileSync)(p, "utf-8");
+        } else if (stat.isDirectory()) {
+          const files = (0, import_node_fs10.readdirSync)(p).filter((f) => f.endsWith(".prisma"));
+          content = files.map((f) => (0, import_node_fs10.readFileSync)((0, import_node_path10.join)(p, f), "utf-8")).join("\n");
+        }
+      } catch {
+        continue;
+      }
+      break;
+    }
+  }
+  if (!content) return { nodes, edges };
+  const enumRe = /enum\s+(\w+)\s*\{([^}]+)\}/g;
+  let m;
+  while ((m = enumRe.exec(content)) !== null) {
+    const enumName = m[1];
+    const body = m[2];
+    const values = body.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("//"));
+    const scope = classifyScope("prisma/schema.prisma");
+    for (const val of values) {
+      const nodeId = `${enumName}.${val}`;
+      nodes.push({
+        id: nodeId,
+        type: "enum_value",
+        name: val,
+        parentEnum: enumName,
+        value: val,
+        scope,
+        source: "prisma/schema.prisma"
+      });
+      edges.push({
+        source: nodeId,
+        target: `enum:${enumName}`,
+        type: "member_of"
+      });
+    }
+    nodes.push({
+      id: `enum:${enumName}`,
+      type: "enum_group",
+      name: enumName,
+      valueCount: values.length,
+      scope,
+      source: "prisma/schema.prisma"
+    });
+  }
+  return { nodes, edges };
+}
+function extractPropsFromObjectNode(node) {
+  const props = {};
+  for (const child of node.namedChildren) {
+    if (child.type !== "pair") continue;
+    const keyNode = child.childForFieldName("key");
+    const valNode = child.childForFieldName("value");
+    if (!keyNode || !valNode) continue;
+    const key = keyNode.type === "property_identifier" ? keyNode.text : keyNode.text.replace(/['"]/g, "");
+    if (valNode.type === "string" || valNode.type === "template_string") {
+      const fragment = valNode.namedChildren.find((c) => c.type === "string_fragment" || c.type === "template_substitution");
+      props[key] = fragment ? fragment.text : valNode.text.replace(/^['"`]|['"`]$/g, "");
+    } else if (valNode.type === "number") {
+      props[key] = valNode.text;
+    } else if (valNode.type === "true" || valNode.type === "false") {
+      props[key] = valNode.text;
+    }
+  }
+  return props;
+}
+function extractStringArrayFromNode(node) {
+  const values = [];
+  for (const child of node.namedChildren) {
+    if (child.type === "string") {
+      const frag = child.namedChildren.find((c) => c.type === "string_fragment");
+      if (frag) values.push(frag.text);
+    }
+  }
+  return values;
+}
+function findArrayDecl(root, varName) {
+  function walk5(node) {
+    if (node.type === "variable_declarator") {
+      const nameNode = node.childForFieldName("name");
+      const valueNode = node.childForFieldName("value");
+      if (nameNode?.text === varName && valueNode?.type === "array") {
+        return valueNode;
+      }
+      if (nameNode?.text === varName && valueNode?.type === "as_expression") {
+        const inner = valueNode.namedChildren.find((c) => c.type === "array");
+        if (inner) return inner;
+      }
+    }
+    for (const child of node.namedChildren) {
+      const found = walk5(child);
+      if (found) return found;
+    }
+    return null;
+  }
+  return walk5(root);
+}
+function extractObjectPropsRegex(objStr) {
+  const props = {};
+  const propRe = /(\w+):\s*['"]([^'"]*)['"]/g;
+  let m;
+  while ((m = propRe.exec(objStr)) !== null) props[m[1]] = m[2];
+  const numRe = /(\w+):\s*(-?\d+(?:\.\d+)?)\s*[,\n}]/g;
+  while ((m = numRe.exec(objStr)) !== null) if (!props[m[1]]) props[m[1]] = m[2];
+  return props;
+}
+function extractStringArrayRegex(arrStr) {
+  return (arrStr.match(/'([^']+)'/g) ?? []).map((s) => s.replace(/'/g, ""));
+}
+function splitArrayObjectsRegex(arrayBody) {
+  const objects = [];
+  let depth = 0;
+  let start = -1;
+  for (let i = 0; i < arrayBody.length; i++) {
+    if (arrayBody[i] === "{") {
+      if (depth === 0) start = i;
+      depth++;
+    } else if (arrayBody[i] === "}") {
+      depth--;
+      if (depth === 0 && start >= 0) {
+        objects.push(arrayBody.slice(start, i + 1));
+        start = -1;
+      }
+    }
+  }
+  return objects;
+}
+function detectSeededArrays(content, sourceFile) {
+  const results = [];
+  const forOfRe = /for\s*\(\s*const\s+\w+\s+of\s+(\w+)\s*\)\s*\{/g;
+  let fm;
+  while ((fm = forOfRe.exec(content)) !== null) {
+    const arrayName = fm[1];
+    const lookahead = content.slice(fm.index + fm[0].length, fm.index + fm[0].length + 500);
+    const prismaMatch = lookahead.match(/prisma\.(\w+)\.(create|upsert|update|createMany|findFirst)/);
+    if (!prismaMatch) continue;
+    results.push({ arrayName, prismaModel: prismaMatch[1], sourceFile });
+  }
+  return results;
+}
+function pickIdField(props) {
+  for (const key of ["key", "slug", "id", "name", "templateId"]) {
+    if (props[key]) return props[key];
+  }
+  return null;
+}
+function pickNameField(props) {
+  for (const key of ["name", "slug", "key", "id"]) {
+    if (props[key]) return props[key];
+  }
+  return null;
+}
+function modelToNodeType(model) {
+  return `seed_${model.replace(/([A-Z])/g, "_$1").toLowerCase().replace(/^_/, "")}`;
+}
+function extractSeedData(rootDir) {
+  const nodes = [];
+  const edges = [];
+  const seedFiles = [
+    (0, import_node_path10.join)(rootDir, "prisma", "seed.ts"),
+    (0, import_node_path10.join)(rootDir, "prisma", "seed.js"),
+    (0, import_node_path10.join)(rootDir, "src", "server", "lib", "system-tags.ts")
+  ].filter(import_node_fs10.existsSync);
+  const useTreeSitter = tryLoadTreeSitter();
+  for (const filePath of seedFiles) {
+    const content = (0, import_node_fs10.readFileSync)(filePath, "utf-8");
+    const relPath = (0, import_node_path10.relative)(rootDir, filePath);
+    const seeded = detectSeededArrays(content, relPath);
+    let astRoot = null;
+    if (useTreeSitter && parseCode) {
+      try {
+        const tree = parseCode(content);
+        astRoot = tree.rootNode;
+      } catch {
+      }
+    }
+    for (const { arrayName, prismaModel, sourceFile } of seeded) {
+      const nodeType = modelToNodeType(prismaModel);
+      const scope = classifyScope(sourceFile, prismaModel);
+      if (astRoot) {
+        const arrayNode = findArrayDecl(astRoot, arrayName);
+        if (!arrayNode) continue;
+        for (const child of arrayNode.namedChildren) {
+          if (child.type !== "object") continue;
+          const props = extractPropsFromObjectNode(child);
+          const idVal = pickIdField(props);
+          if (!idVal) continue;
+          const nameVal = pickNameField(props) ?? idVal;
+          const nodeId = `seed:${prismaModel}:${idVal}`;
+          const { scope: _seedScope, ...safeProps } = props;
+          nodes.push({
+            id: nodeId,
+            type: nodeType,
+            name: nameVal,
+            value: idVal,
+            model: prismaModel,
+            ...safeProps,
+            seedScope: _seedScope ?? void 0,
+            // preserve as seedScope
+            scope,
+            source: sourceFile
+          });
+          const permsArrayNode = child.namedChildren.filter((c) => c.type === "pair").find((c) => c.childForFieldName("key")?.text === "permissions");
+          if (permsArrayNode) {
+            const valNode = permsArrayNode.childForFieldName("value");
+            if (valNode?.type === "array") {
+              const permKeys = extractStringArrayFromNode(valNode);
+              for (const pk of permKeys) {
+                if (pk === "*") continue;
+                edges.push({ source: nodeId, target: `seed:permission:${pk}`, type: "grants" });
+              }
+            }
+          }
+        }
+      } else {
+        const constRe = new RegExp(`const\\s+${arrayName}\\s*(?::[^=]+)?=\\s*\\[`, "g");
+        const cm = constRe.exec(content);
+        if (!cm) continue;
+        const bracketStart = cm.index + cm[0].length - 1;
+        let depth = 1, i = bracketStart + 1;
+        while (i < content.length && depth > 0) {
+          if (content[i] === "[") depth++;
+          else if (content[i] === "]") depth--;
+          i++;
+        }
+        if (depth !== 0) continue;
+        const body = content.slice(bracketStart + 1, i - 1);
+        const objects = splitArrayObjectsRegex(body);
+        for (const objStr of objects) {
+          const props = extractObjectPropsRegex(objStr);
+          const idVal = pickIdField(props);
+          if (!idVal) continue;
+          const nameVal = pickNameField(props) ?? idVal;
+          const nodeId = `seed:${prismaModel}:${idVal}`;
+          const { scope: _rScope, ...rSafeProps } = props;
+          nodes.push({
+            id: nodeId,
+            type: nodeType,
+            name: nameVal,
+            value: idVal,
+            model: prismaModel,
+            ...rSafeProps,
+            seedScope: _rScope ?? void 0,
+            scope,
+            source: sourceFile
+          });
+          const permArrayMatch = objStr.match(/permissions:\s*\[([^\]]*)\]/);
+          if (permArrayMatch) {
+            for (const pk of extractStringArrayRegex(permArrayMatch[1])) {
+              if (pk === "*") continue;
+              edges.push({ source: nodeId, target: `seed:permission:${pk}`, type: "grants" });
+            }
+          }
+        }
+      }
+    }
+  }
+  return { nodes, edges };
+}
+function walkDir(dir, exts) {
+  if (!(0, import_node_fs10.existsSync)(dir)) return [];
+  const results = [];
+  for (const entry of (0, import_node_fs10.readdirSync)(dir, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || entry.name === ".next" || entry.name === "dist") continue;
+    const full = (0, import_node_path10.join)(dir, entry.name);
+    if (entry.isDirectory()) results.push(...walkDir(full, exts));
+    else if (exts.some((ext) => entry.name.endsWith(ext))) results.push(full);
+  }
+  return results;
+}
+function extractConstants(rootDir) {
+  const nodes = [];
+  const srcDir = (0, import_node_path10.join)(rootDir, "src");
+  if (!(0, import_node_fs10.existsSync)(srcDir)) return { nodes };
+  for (const filePath of walkDir(srcDir, [".ts", ".tsx"])) {
+    const content = (0, import_node_fs10.readFileSync)(filePath, "utf-8");
+    const relPath = (0, import_node_path10.relative)(rootDir, filePath);
+    const constArrayRe = /export\s+const\s+([A-Z][A-Z_0-9]+)\s*(?::[^=]+)?\s*=\s*\[/g;
+    let cm;
+    while ((cm = constArrayRe.exec(content)) !== null) {
+      const constName = cm[1];
+      const bracketStart = cm.index + cm[0].length - 1;
+      let depth = 1, i = bracketStart + 1;
+      while (i < content.length && depth > 0) {
+        if (content[i] === "[") depth++;
+        else if (content[i] === "]") depth--;
+        i++;
+      }
+      if (depth !== 0) continue;
+      const body = content.slice(bracketStart + 1, i - 1);
+      const stringValues = extractStringArrayRegex(body);
+      const objectCount = splitArrayObjectsRegex(body).length;
+      const valueCount = Math.max(stringValues.length, objectCount);
+      if (valueCount < 2) continue;
+      const scope = classifyScope(relPath);
+      nodes.push({
+        id: `const:${constName}`,
+        type: "constant",
+        name: constName,
+        valueCount,
+        values: stringValues.length > 0 && stringValues.length <= 30 ? stringValues : void 0,
+        scope,
+        source: relPath
+      });
+    }
+  }
+  return { nodes };
+}
+function detect4(rootDir) {
+  return (0, import_node_fs10.existsSync)((0, import_node_path10.join)(rootDir, "prisma", "schema.prisma")) || (0, import_node_fs10.existsSync)((0, import_node_path10.join)(rootDir, "prisma", "seed.ts"));
+}
+function generate4(rootDir) {
+  const enumResult = extractEnumValues(rootDir);
+  const seedResult = extractSeedData(rootDir);
+  const constResult = extractConstants(rootDir);
+  const allNodes = [...enumResult.nodes, ...seedResult.nodes, ...constResult.nodes];
+  const allEdges = [...enumResult.edges, ...seedResult.edges];
+  const typeOrder = {
+    enum_group: 0,
+    enum_value: 1,
+    seed_permission: 2,
+    seed_role: 3,
+    seed_tag: 4,
+    seed_plan: 5,
+    seed_provider: 6,
+    constant: 7
+  };
+  allNodes.sort((a, b) => {
+    const ta = typeOrder[a.type] ?? 8;
+    const tb = typeOrder[b.type] ?? 8;
+    if (ta !== tb) return ta - tb;
+    return a.name.localeCompare(b.name);
+  });
+  const enumGroups = allNodes.filter((n) => n.type === "enum_group").length;
+  const enumValues = allNodes.filter((n) => n.type === "enum_value").length;
+  const seedNodes = allNodes.filter((n) => n.type.startsWith("seed_")).length;
+  const constNodes = allNodes.filter((n) => n.type === "constant").length;
+  const byScope = {};
+  for (const n of allNodes) {
+    const s = n.scope ?? "unknown";
+    byScope[s] = (byScope[s] ?? 0) + 1;
+  }
+  return {
+    metadata: {
+      generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+      scope: "static-values",
+      layer: "static",
+      enum_groups: enumGroups,
+      enum_values: enumValues,
+      seed_records: seedNodes,
+      constants: constNodes,
+      total_nodes: allNodes.length,
+      total_edges: allEdges.length,
+      parser: tryLoadTreeSitter() ? "tree-sitter" : "regex-fallback"
+    },
+    nodes: allNodes,
+    edges: allEdges,
+    cross_refs: [],
+    contradictions: [],
+    warnings: [],
+    flagged_edges: [],
+    patterns: {
+      by_type: {
+        enum_group: enumGroups,
+        enum_value: enumValues,
+        seed_permission: allNodes.filter((n) => n.type === "seed_permission").length,
+        seed_role: allNodes.filter((n) => n.type === "seed_role").length,
+        seed_tag: allNodes.filter((n) => n.type === "seed_tag").length,
+        seed_plan: allNodes.filter((n) => n.type === "seed_plan").length,
+        seed_provider: allNodes.filter((n) => n.type === "seed_provider").length,
+        constant: constNodes
+      },
+      by_scope: byScope
+    }
+  };
+}
+var import_node_fs10, import_node_path10, parseCode, SHARED_MODELS, DB_MODELS, staticValuesParser;
+var init_static_values = __esm({
+  "src/server/graph/parsers/static/static-values.ts"() {
+    "use strict";
+    import_node_fs10 = require("node:fs");
+    import_node_path10 = require("node:path");
+    parseCode = null;
+    SHARED_MODELS = /* @__PURE__ */ new Set(["permission", "role", "tag"]);
+    DB_MODELS = /* @__PURE__ */ new Set(["subscriptionPlan", "providerDefinition", "pipelineMasterTemplate"]);
+    staticValuesParser = {
+      id: "static-values",
+      layer: "static",
+      detect: detect4,
+      generate: generate4
+    };
+  }
+});
+
+// src/server/graph/parsers/crosslayer/static-ref-scanner.ts
+function walk4(dir, exts) {
+  if (!(0, import_node_fs11.existsSync)(dir)) return [];
+  const results = [];
+  function recurse(d) {
+    for (const entry of (0, import_node_fs11.readdirSync)(d, { withFileTypes: true })) {
+      const full = (0, import_node_path11.join)(d, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules" || entry.name === ".next" || entry.name === "dist") continue;
+        recurse(full);
+      } else if (exts.some((ext) => entry.name.endsWith(ext))) {
+        results.push(full);
+      }
+    }
+  }
+  recurse(dir);
+  return results;
+}
+function isInCommentOrType(node) {
+  let current = node.parent;
+  while (current) {
+    if (current.type === "comment" || current.type === "type_annotation" || current.type === "type_alias_declaration" || current.type === "interface_declaration" || current.type === "jsdoc") {
+      return true;
+    }
+    current = current.parent;
+  }
+  return false;
+}
+function collectStaticRefs(root, valueLookup) {
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  function visit(node) {
+    if (node.type === "string_fragment") {
+      const val = node.text;
+      if (val.length >= MIN_VALUE_LENGTH && !SKIP_VALUES.has(val.toLowerCase())) {
+        const targets = valueLookup.get(val);
+        if (targets && !isInCommentOrType(node)) {
+          for (const t of targets) {
+            const key = t;
+            if (!seen.has(key)) {
+              seen.add(key);
+              refs.push({ value: val, targetIds: [t] });
+            }
+          }
+        }
+      }
+    }
+    if (node.type === "member_expression") {
+      const objNode = node.namedChildren.find((c) => c.type === "identifier");
+      const propNode = node.namedChildren.find((c) => c.type === "property_identifier");
+      if (objNode && propNode) {
+        const combined = `${objNode.text}.${propNode.text}`;
+        const targets = valueLookup.get(propNode.text);
+        const directTarget = valueLookup.get(combined);
+        if (directTarget && !isInCommentOrType(node)) {
+          for (const t of directTarget) {
+            if (!seen.has(t)) {
+              seen.add(t);
+              refs.push({ value: combined, targetIds: [t] });
+            }
+          }
+        } else if (targets && !isInCommentOrType(node)) {
+          for (const t of targets) {
+            if (!seen.has(t)) {
+              seen.add(t);
+              refs.push({ value: propNode.text, targetIds: [t] });
+            }
+          }
+        }
+      }
+    }
+    for (const child of node.namedChildren) {
+      visit(child);
+    }
+  }
+  visit(root);
+  return refs;
+}
+function collectStaticRefsRegex(content, valueLookup, allValues) {
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  const escaped = allValues.map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  const pattern = new RegExp(
+    `(?:['"\`])(${escaped.join("|")})(?:['"\`])|\\b(\\w+)\\.(${escaped.join("|")})\\b`,
+    "g"
+  );
+  let match;
+  pattern.lastIndex = 0;
+  while ((match = pattern.exec(content)) !== null) {
+    const val = match[1] ?? match[3];
+    if (!val) continue;
+    const targets = valueLookup.get(val);
+    if (!targets) continue;
+    for (const t of targets) {
+      if (!seen.has(t)) {
+        seen.add(t);
+        refs.push({ value: val, targetIds: [t] });
+      }
+    }
+  }
+  return refs;
 }
-var import_node_fs8, import_node_path8, URL_LITERAL_RE, urlLiteralScannerParser;
-var init_url_literal_scanner = __esm({
-  "src/server/graph/parsers/crosslayer/url-literal-scanner.ts"() {
+var import_node_fs11, import_node_path11, MIN_VALUE_LENGTH, SKIP_VALUES, staticRefScannerParser;
+var init_static_ref_scanner = __esm({
+  "src/server/graph/parsers/crosslayer/static-ref-scanner.ts"() {
     "use strict";
-    import_node_fs8 = require("node:fs");
-    import_node_path8 = require("node:path");
-    init_api_route_matching();
-    URL_LITERAL_RE = /['"`](\/api\/[^'"`\s]+?)['"`]/g;
-    urlLiteralScannerParser = {
-      id: "url-literal-scanner",
+    import_node_fs11 = require("node:fs");
+    import_node_path11 = require("node:path");
+    init_config();
+    init_resolve_paths();
+    MIN_VALUE_LENGTH = 4;
+    SKIP_VALUES = /* @__PURE__ */ new Set([
+      "true",
+      "false",
+      "null",
+      "undefined",
+      "none",
+      "default",
+      "name",
+      "type",
+      "data",
+      "text",
+      "info",
+      "error",
+      "open",
+      "read",
+      "user",
+      "test",
+      "json",
+      "form"
+    ]);
+    staticRefScannerParser = {
+      id: "static-ref-scanner",
       layer: "crosslayer",
       detect(rootDir) {
-        return (0, import_node_fs8.existsSync)((0, import_node_path8.join)(rootDir, "src"));
+        const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+        return paths !== null;
       },
       generate(rootDir, layerOutputs) {
-        const apiOutput = layerOutputs.get("api");
-        if (!apiOutput) {
+        const staticOutput = layerOutputs.get("static");
+        if (!staticOutput || staticOutput.nodes.length === 0) {
           return { cross_refs: [], flagged_edges: [], warnings: [] };
         }
-        const uiOutput = layerOutputs.get("ui");
-        const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
-        const apiRoutes = loadApiRoutesFromOutput(apiOutput);
-        const apiPathMap = buildApiPathMap(apiRoutes);
-        const srcDir = (0, import_node_path8.join)(rootDir, "src");
-        const clientDir = (0, import_node_path8.join)(srcDir, "client");
-        const appDir = (0, import_node_path8.join)(srcDir, "app");
+        const valueLookup = /* @__PURE__ */ new Map();
+        for (const node of staticOutput.nodes) {
+          const type = node.type;
+          let valueStr = null;
+          if (type === "enum_value") {
+            valueStr = node.value;
+            const fullId = node.id;
+            if (!valueLookup.has(fullId)) valueLookup.set(fullId, []);
+            valueLookup.get(fullId).push(node.id);
+          } else if (type.startsWith("seed_")) {
+            valueStr = node.value;
+          }
+          if (!valueStr || valueStr.length < MIN_VALUE_LENGTH || SKIP_VALUES.has(valueStr.toLowerCase())) continue;
+          if (!valueLookup.has(valueStr)) valueLookup.set(valueStr, []);
+          valueLookup.get(valueStr).push(node.id);
+        }
+        const allValues = [...valueLookup.keys()].sort((a, b) => b.length - a.length);
+        if (allValues.length === 0) {
+          return { cross_refs: [], flagged_edges: [], warnings: [] };
+        }
+        const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+        if (!paths) return { cross_refs: [], flagged_edges: [], warnings: [] };
+        const srcDir = paths.srcDir;
         const files = [
-          ...walk4(clientDir, [".ts", ".tsx"]),
-          ...walk4(appDir, [".ts", ".tsx"])
+          ...walk4((0, import_node_path11.join)(srcDir, "client"), [".ts", ".tsx"]),
+          ...walk4(paths.appDir, [".ts", ".tsx"]),
+          ...walk4((0, import_node_path11.join)(srcDir, "server"), [".ts", ".tsx"]),
+          ...walk4((0, import_node_path11.join)(srcDir, "lib"), [".ts", ".tsx"]),
+          ...walk4((0, import_node_path11.join)(srcDir, "config"), [".ts", ".tsx"])
         ];
+        const uiOutput = layerOutputs.get("ui");
+        const apiOutput = layerOutputs.get("api");
+        const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
+        const apiNodeIds = new Set(apiOutput?.nodes.map((n) => n.id) ?? []);
+        let parseCode2 = null;
+        try {
+          const extractor = (init_ts_extractor(), __toCommonJS(ts_extractor_exports));
+          if (typeof extractor.parseCodeTS === "function") {
+            parseCode2 = extractor.parseCodeTS;
+          }
+        } catch {
+        }
         const crossRefs = [];
         const seen = /* @__PURE__ */ new Set();
+        let filesScanned = 0;
         for (const absPath of files) {
-          const sourceId = toNodeId3(srcDir, absPath);
-          if (!uiNodeIds.has(sourceId)) continue;
-          const content = (0, import_node_fs8.readFileSync)(absPath, "utf-8");
-          let match;
-          URL_LITERAL_RE.lastIndex = 0;
-          while ((match = URL_LITERAL_RE.exec(content)) !== null) {
-            const urlPath = match[1];
-            const result = resolveUrlPath(urlPath, apiPathMap, apiRoutes);
-            if (result.kind === "resolved" && result.nodeId) {
-              const key = `${sourceId}|${result.nodeId}|references_api`;
+          const sourceId = (0, import_node_path11.relative)(srcDir, absPath).replace(/\\/g, "/");
+          const sourceLayer = uiNodeIds.has(sourceId) ? "ui" : apiNodeIds.has(sourceId) ? "api" : null;
+          if (!sourceLayer) continue;
+          const content = (0, import_node_fs11.readFileSync)(absPath, "utf-8");
+          filesScanned++;
+          let fileRefs;
+          if (parseCode2) {
+            try {
+              const tree = parseCode2(content);
+              fileRefs = collectStaticRefs(tree.rootNode, valueLookup);
+            } catch {
+              fileRefs = collectStaticRefsRegex(content, valueLookup, allValues);
+            }
+          } else {
+            fileRefs = collectStaticRefsRegex(content, valueLookup, allValues);
+          }
+          for (const ref of fileRefs) {
+            for (const targetId of ref.targetIds) {
+              const key = `${sourceId}|${targetId}`;
               if (seen.has(key)) continue;
               seen.add(key);
               crossRefs.push({
                 source: sourceId,
-                target: result.nodeId,
-                type: "references_api",
-                layer: "api"
+                target: targetId,
+                type: "references_static",
+                layer: "static"
               });
             }
           }
@@ -1896,7 +3039,10 @@ var init_url_literal_scanner = __esm({
           flagged_edges: [],
           warnings: [],
           patterns: {
-            url_literals_resolved: crossRefs.length
+            files_scanned: filesScanned,
+            static_values_tracked: valueLookup.size,
+            references_found: crossRefs.length,
+            parser: parseCode2 ? "tree-sitter" : "regex-fallback"
           }
         };
       }
@@ -1905,14 +3051,19 @@ var init_url_literal_scanner = __esm({
 });
 
 // src/server/graph/core/parser-registry.ts
+function isMultiLayerParser(p) {
+  return "layers" in p && Array.isArray(p.layers);
+}
 function registerBuiltins(registry, disabled) {
   const builtins = [
-    reactNextjsParser,
-    nextjsRoutesParser,
+    typescriptProjectParser,
     prismaSchemaParser,
+    sqlMigrationsParser,
+    staticValuesParser,
     fetchResolverParser,
     apiAnnotationsParser,
-    urlLiteralScannerParser
+    urlLiteralScannerParser,
+    staticRefScannerParser
   ];
   for (const parser of builtins) {
     if (disabled.has(parser.id)) continue;
@@ -1922,11 +3073,11 @@ function registerBuiltins(registry, disabled) {
 function loadCustomParsers(registry, config, rootDir, disabled) {
   for (const entry of config.parsers?.custom ?? []) {
     try {
-      const absPath = (0, import_node_path9.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path12.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const parser = "default" in mod ? mod.default : mod;
       if (disabled.has(parser.id)) continue;
-      if (parser.layer !== entry.layer) {
+      if (!isMultiLayerParser(parser) && parser.layer !== entry.layer) {
         process.stderr.write(
           `[launch-chart] custom parser "${parser.id}" declares layer "${parser.layer}" but config says "${entry.layer}" \u2014 using parser's layer
 `
@@ -1946,20 +3097,23 @@ function createRegistry(config, rootDir) {
   loadCustomParsers(registry, config, rootDir, disabled);
   return registry;
 }
-var import_node_path9, ParserRegistry;
+var import_node_path12, ParserRegistry;
 var init_parser_registry = __esm({
   "src/server/graph/core/parser-registry.ts"() {
     "use strict";
-    import_node_path9 = require("node:path");
-    init_react_nextjs();
-    init_nextjs_routes();
+    import_node_path12 = require("node:path");
+    init_typescript_project();
     init_prisma_schema();
+    init_sql_migrations();
     init_fetch_resolver();
     init_api_annotations();
     init_url_literal_scanner();
+    init_static_values();
+    init_static_ref_scanner();
     ParserRegistry = class {
       constructor() {
-        this.parsers = /* @__PURE__ */ new Map();
+        this.singleLayerParsers = /* @__PURE__ */ new Map();
+        this.multiLayerParsers = [];
         this.ids = /* @__PURE__ */ new Set();
       }
       register(parser) {
@@ -1967,19 +3121,44 @@ var init_parser_registry = __esm({
           throw new Error(`Duplicate parser id: ${parser.id}`);
         }
         this.ids.add(parser.id);
-        const list = this.parsers.get(parser.layer) ?? [];
-        list.push(parser);
-        this.parsers.set(parser.layer, list);
+        if (isMultiLayerParser(parser)) {
+          this.multiLayerParsers.push(parser);
+        } else {
+          const list = this.singleLayerParsers.get(parser.layer) ?? [];
+          list.push(parser);
+          this.singleLayerParsers.set(parser.layer, list);
+        }
       }
+      /** Get single-layer parsers for a specific layer. */
       getParsers(layer) {
-        return this.parsers.get(layer) ?? [];
+        return this.singleLayerParsers.get(layer) ?? [];
+      }
+      /** Get multi-layer parsers that can produce output for the given layer. */
+      getMultiLayerParsersFor(layer) {
+        return this.multiLayerParsers.filter((p) => p.layers.includes(layer));
+      }
+      /** Get all multi-layer parsers. */
+      getMultiLayerParsers() {
+        return [...this.multiLayerParsers];
       }
       getCrossLayerParsers() {
-        return this.parsers.get("crosslayer") ?? [];
+        return this.singleLayerParsers.get("crosslayer") ?? [];
+      }
+      /** All layers that registered parsers can produce (single + multi). */
+      getAvailableLayers() {
+        const layers = /* @__PURE__ */ new Set();
+        for (const key of this.singleLayerParsers.keys()) {
+          if (key !== "crosslayer") layers.add(key);
+        }
+        for (const mp of this.multiLayerParsers) {
+          for (const l of mp.layers) layers.add(l);
+        }
+        return [...layers];
       }
       getAll() {
         const all = [];
-        for (const list of this.parsers.values()) all.push(...list);
+        for (const list of this.singleLayerParsers.values()) all.push(...list);
+        all.push(...this.multiLayerParsers);
         return all;
       }
     };
@@ -2116,10 +3295,10 @@ var init_merge = __esm({
 
 // src/server/graph/core/graph-builder.ts
 function readGraphFromDisk(rootDir, layer) {
-  const filePath = (0, import_node_path10.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
-  if (!(0, import_node_fs9.existsSync)(filePath)) return null;
+  const filePath = (0, import_node_path13.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  if (!(0, import_node_fs12.existsSync)(filePath)) return null;
   try {
-    return JSON.parse((0, import_node_fs9.readFileSync)(filePath, "utf-8"));
+    return JSON.parse((0, import_node_fs12.readFileSync)(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -2127,18 +3306,24 @@ function readGraphFromDisk(rootDir, layer) {
 function generateLayer(rootDir, layer) {
   const config = loadConfig(rootDir);
   const registry = createRegistry(config, rootDir);
-  const parsers = registry.getParsers(layer);
   const outputs = [];
-  for (const parser of parsers) {
+  for (const parser of registry.getParsers(layer)) {
     if (!parser.detect(rootDir)) continue;
     outputs.push(parser.generate(rootDir));
   }
+  for (const mp of registry.getMultiLayerParsersFor(layer)) {
+    if (!mp.detect(rootDir)) continue;
+    const multiOutput = mp.generate(rootDir);
+    const layerOutput = multiOutput.get(layer);
+    if (layerOutput) outputs.push(layerOutput);
+  }
   if (outputs.length === 0) return null;
   let merged = outputs.length === 1 ? outputs[0] : mergeGraphOutputs(outputs, layer);
   if (layer === "ui") {
     const layerOutputs = /* @__PURE__ */ new Map();
     layerOutputs.set("ui", merged);
-    for (const otherLayer of ["api", "db"]) {
+    for (const otherLayer of registry.getAvailableLayers()) {
+      if (otherLayer === "ui") continue;
       const existing = readGraphFromDisk(rootDir, otherLayer);
       if (existing) layerOutputs.set(otherLayer, existing);
     }
@@ -2159,16 +3344,29 @@ function generateLayer(rootDir, layer) {
 function generateAll(rootDir) {
   const config = loadConfig(rootDir);
   const registry = createRegistry(config, rootDir);
-  const layerOrder = ["api", "db", "ui"];
+  const allLayers = registry.getAvailableLayers();
+  const layerOrder = [
+    ...allLayers.filter((l) => l !== "ui"),
+    ...allLayers.filter((l) => l === "ui")
+  ];
   const layerOutputs = /* @__PURE__ */ new Map();
   const results = [];
+  const multiLayerResults = /* @__PURE__ */ new Map();
   for (const layer of layerOrder) {
-    const parsers = registry.getParsers(layer);
     const outputs = [];
-    for (const parser of parsers) {
+    for (const parser of registry.getParsers(layer)) {
       if (!parser.detect(rootDir)) continue;
       outputs.push(parser.generate(rootDir));
     }
+    for (const mp of registry.getMultiLayerParsersFor(layer)) {
+      if (!mp.detect(rootDir)) continue;
+      if (!multiLayerResults.has(mp.id)) {
+        multiLayerResults.set(mp.id, mp.generate(rootDir));
+      }
+      const cached = multiLayerResults.get(mp.id);
+      const layerOutput = cached.get(layer);
+      if (layerOutput) outputs.push(layerOutput);
+    }
     if (outputs.length === 0) continue;
     const merged = outputs.length === 1 ? outputs[0] : mergeGraphOutputs(outputs, layer);
     layerOutputs.set(layer, merged);
@@ -2194,14 +3392,16 @@ function generateAll(rootDir) {
     }
   }
   const byLayer = new Map(results.map((r) => [r.layer, r]));
-  return ["ui", "api", "db"].map((l) => byLayer.get(l)).filter((r) => !!r);
+  const wellKnownOrder = ["ui", "api", "db"];
+  const extras = [...byLayer.keys()].filter((l) => !wellKnownOrder.includes(l)).sort();
+  return [...wellKnownOrder, ...extras].map((l) => byLayer.get(l)).filter((r) => !!r);
 }
-var import_node_fs9, import_node_path10;
+var import_node_fs12, import_node_path13;
 var init_graph_builder = __esm({
   "src/server/graph/core/graph-builder.ts"() {
     "use strict";
-    import_node_fs9 = require("node:fs");
-    import_node_path10 = require("node:path");
+    import_node_fs12 = require("node:fs");
+    import_node_path13 = require("node:path");
     init_config();
     init_parser_registry();
     init_merge();
@@ -2240,18 +3440,18 @@ function detectConventionDirs(rootDir, extraConventionDirs = []) {
   const conventionDirs = [...CONVENTION_DIRS_BUILTIN, ...extraConventionDirs];
   const searchDirs = [
     rootDir,
-    (0, import_node_path11.join)(rootDir, "src"),
-    (0, import_node_path11.join)(rootDir, "app"),
-    (0, import_node_path11.join)(rootDir, "lib")
+    (0, import_node_path14.join)(rootDir, "src"),
+    (0, import_node_path14.join)(rootDir, "app"),
+    (0, import_node_path14.join)(rootDir, "lib")
   ];
   for (const base of searchDirs) {
     for (const convention of conventionDirs) {
-      const dir = (0, import_node_path11.join)(base, convention);
-      if (!(0, import_node_fs10.existsSync)(dir)) continue;
+      const dir = (0, import_node_path14.join)(base, convention);
+      if (!(0, import_node_fs13.existsSync)(dir)) continue;
       try {
-        const stat = (0, import_node_fs10.statSync)(dir);
+        const stat = (0, import_node_fs13.statSync)(dir);
         if (!stat.isDirectory()) continue;
-        const entries = (0, import_node_fs10.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
+        const entries = (0, import_node_fs13.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
         if (entries.length > 0) {
           const relPath = dir.replace(rootDir + "/", "").replace(rootDir + "\\", "");
           result.set(relPath, entries);
@@ -2323,12 +3523,12 @@ function extractModuleFromPath(id, extraTrivial, extraSkipSegments) {
   }
   return "root";
 }
-var import_node_fs10, import_node_path11, CONVENTION_DIRS_BUILTIN, GENERIC_ROLE_NAMES_BUILTIN, SKIP_SEGMENTS_BUILTIN, TRIVIAL_GROUPS, cachedRootDir, cachedConventionDirs, moduleTagger;
+var import_node_fs13, import_node_path14, CONVENTION_DIRS_BUILTIN, GENERIC_ROLE_NAMES_BUILTIN, SKIP_SEGMENTS_BUILTIN, TRIVIAL_GROUPS, cachedRootDir, cachedConventionDirs, moduleTagger;
 var init_module_tagger = __esm({
   "src/server/graph/taggers/module-tagger.ts"() {
     "use strict";
-    import_node_fs10 = require("node:fs");
-    import_node_path11 = require("node:path");
+    import_node_fs13 = require("node:fs");
+    import_node_path14 = require("node:path");
     CONVENTION_DIRS_BUILTIN = ["features", "modules", "domains", "areas"];
     GENERIC_ROLE_NAMES_BUILTIN = /* @__PURE__ */ new Set([
       // JS/TS
@@ -2540,7 +3740,7 @@ function loadCustomTaggers(registry, config, rootDir, disabled) {
   for (const entry of config.taggers?.custom ?? []) {
     if (disabled.has(entry.id)) continue;
     try {
-      const absPath = (0, import_node_path12.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path15.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const tagger = "default" in mod ? mod.default : mod;
       const override = config.taggers?.trackUntagged?.[tagger.id];
@@ -2561,11 +3761,11 @@ function createTaggerRegistry(config, rootDir) {
   loadCustomTaggers(registry, config, rootDir, disabled);
   return registry;
 }
-var import_node_path12, TaggerRegistry, BUILTIN_TAGGERS;
+var import_node_path15, TaggerRegistry, BUILTIN_TAGGERS;
 var init_tagger_registry = __esm({
   "src/server/graph/core/tagger-registry.ts"() {
     "use strict";
-    import_node_path12 = require("node:path");
+    import_node_path15 = require("node:path");
     init_module_tagger();
     init_screen_tagger();
     TaggerRegistry = class {
@@ -2593,18 +3793,18 @@ var init_tagger_registry = __esm({
 
 // src/server/graph/core/tag-store.ts
 function tagsFilePath(rootDir) {
-  return (0, import_node_path13.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
+  return (0, import_node_path16.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
 }
 function readTagStore(rootDir) {
   const filePath = tagsFilePath(rootDir);
-  if (!(0, import_node_fs11.existsSync)(filePath)) return {};
-  const stat = (0, import_node_fs11.statSync)(filePath);
+  if (!(0, import_node_fs14.existsSync)(filePath)) return {};
+  const stat = (0, import_node_fs14.statSync)(filePath);
   const cached = tagCache.get(filePath);
   if (cached && cached.mtimeMs === stat.mtimeMs) {
     return cached.store;
   }
   try {
-    const content = (0, import_node_fs11.readFileSync)(filePath, "utf-8");
+    const content = (0, import_node_fs14.readFileSync)(filePath, "utf-8");
     const store = JSON.parse(content);
     tagCache.set(filePath, { mtimeMs: stat.mtimeMs, store });
     return store;
@@ -2614,15 +3814,15 @@ function readTagStore(rootDir) {
 }
 function writeTagStore(rootDir, store) {
   const filePath = tagsFilePath(rootDir);
-  const dir = (0, import_node_path13.dirname)(filePath);
-  (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_node_path16.dirname)(filePath);
+  (0, import_node_fs14.mkdirSync)(dir, { recursive: true });
   const cleaned = {};
   for (const [nodeId, tags] of Object.entries(store)) {
     if (Object.keys(tags).length > 0) {
       cleaned[nodeId] = tags;
     }
   }
-  (0, import_node_fs11.writeFileSync)(filePath, JSON.stringify(cleaned, null, 2) + "\n", "utf-8");
+  (0, import_node_fs14.writeFileSync)(filePath, JSON.stringify(cleaned, null, 2) + "\n", "utf-8");
   tagCache.delete(filePath);
 }
 function setTag(rootDir, nodeId, key, value) {
@@ -2640,12 +3840,12 @@ function removeTag(rootDir, nodeId, key) {
   }
   writeTagStore(rootDir, store);
 }
-var import_node_fs11, import_node_path13, TAGS_FILENAME, GRAPHS_DIR, tagCache;
+var import_node_fs14, import_node_path16, TAGS_FILENAME, GRAPHS_DIR, tagCache;
 var init_tag_store = __esm({
   "src/server/graph/core/tag-store.ts"() {
     "use strict";
-    import_node_fs11 = require("node:fs");
-    import_node_path13 = require("node:path");
+    import_node_fs14 = require("node:fs");
+    import_node_path16 = require("node:path");
     TAGS_FILENAME = "tags.json";
     GRAPHS_DIR = ".launchsecure/graphs";
     tagCache = /* @__PURE__ */ new Map();
@@ -2653,18 +3853,23 @@ var init_tag_store = __esm({
 });
 
 // src/server/graph/index.ts
+function getAvailableLayers(rootDir) {
+  const dir = (0, import_node_path17.join)(rootDir, GRAPHS_DIR2);
+  if (!(0, import_node_fs15.existsSync)(dir)) return [];
+  return (0, import_node_fs15.readdirSync)(dir).filter((f) => f.endsWith(".json") && f !== "tags.json").map((f) => f.replace(".json", ""));
+}
 function graphsDir(rootDir) {
-  return (0, import_node_path14.join)(rootDir, GRAPHS_DIR2);
+  return (0, import_node_path17.join)(rootDir, GRAPHS_DIR2);
 }
 function graphFilePath(rootDir, layer) {
-  return (0, import_node_path14.join)(graphsDir(rootDir), `${layer}.json`);
+  return (0, import_node_path17.join)(graphsDir(rootDir), `${layer}.json`);
 }
 function tagsFilePath2(rootDir) {
-  return (0, import_node_path14.join)(graphsDir(rootDir), "tags.json");
+  return (0, import_node_path17.join)(graphsDir(rootDir), "tags.json");
 }
 function getMtimeMs(filePath) {
-  if (!(0, import_node_fs12.existsSync)(filePath)) return 0;
-  return (0, import_node_fs12.statSync)(filePath).mtimeMs;
+  if (!(0, import_node_fs15.existsSync)(filePath)) return 0;
+  return (0, import_node_fs15.statSync)(filePath).mtimeMs;
 }
 function invalidateCache(filePath) {
   graphCache.delete(filePath);
@@ -2703,20 +3908,20 @@ function applyTags(graph, layer, rootDir) {
 }
 function readGraphRaw(rootDir, layer) {
   const filePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs12.existsSync)(filePath)) return null;
-  const stat = (0, import_node_fs12.statSync)(filePath);
+  if (!(0, import_node_fs15.existsSync)(filePath)) return null;
+  const stat = (0, import_node_fs15.statSync)(filePath);
   const cached = graphCache.get(filePath);
   if (cached && cached.mtimeMs === stat.mtimeMs) {
     return cached.graph;
   }
-  const content = (0, import_node_fs12.readFileSync)(filePath, "utf-8");
+  const content = (0, import_node_fs15.readFileSync)(filePath, "utf-8");
   const graph = JSON.parse(content);
   graphCache.set(filePath, { mtimeMs: stat.mtimeMs, graph });
   return graph;
 }
 function readGraph(rootDir, layer) {
   const rawFilePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs12.existsSync)(rawFilePath)) return null;
+  if (!(0, import_node_fs15.existsSync)(rawFilePath)) return null;
   const rawMtime = getMtimeMs(rawFilePath);
   const tagsMtime = getMtimeMs(tagsFilePath2(rootDir));
   const cacheKey = `${rootDir}:${layer}`;
@@ -2732,7 +3937,7 @@ function readGraph(rootDir, layer) {
 }
 function readAllGraphs(rootDir) {
   const result = {};
-  for (const layer of LAYERS) {
+  for (const layer of getAvailableLayers(rootDir)) {
     const graph = readGraph(rootDir, layer);
     if (graph) result[layer] = graph;
   }
@@ -2746,22 +3951,22 @@ async function generateGraph(rootDir, layer) {
     mutationMethods: config.parsers?.patterns?.mutationMethods
   });
   const dir = graphsDir(rootDir);
-  (0, import_node_fs12.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs15.mkdirSync)(dir, { recursive: true });
   const results = layer ? [generateLayer(rootDir, layer)].filter((r) => r !== null) : generateAll(rootDir);
   for (const result of results) {
     const filePath = graphFilePath(rootDir, result.layer);
-    (0, import_node_fs12.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
+    (0, import_node_fs15.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
     invalidateCache(filePath);
     invalidateTaggedCache(rootDir, result.layer);
   }
   return results;
 }
-var import_node_fs12, import_node_path14, GRAPHS_DIR2, LAYERS, graphCache, taggedCache;
+var import_node_fs15, import_node_path17, GRAPHS_DIR2, graphCache, taggedCache;
 var init_graph = __esm({
   "src/server/graph/index.ts"() {
     "use strict";
-    import_node_fs12 = require("node:fs");
-    import_node_path14 = require("node:path");
+    import_node_fs15 = require("node:fs");
+    import_node_path17 = require("node:path");
     init_graph_builder();
     init_config();
     init_tagger_registry();
@@ -2769,12 +3974,294 @@ var init_graph = __esm({
     init_ts_extractor();
     init_tag_store();
     GRAPHS_DIR2 = ".launchsecure/graphs";
-    LAYERS = ["ui", "api", "db"];
     graphCache = /* @__PURE__ */ new Map();
     taggedCache = /* @__PURE__ */ new Map();
   }
 });
 
+// src/server/graph/core/audit-core.ts
+function readGraphFile(rootDir, layer) {
+  const filePath = (0, import_node_path18.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  if (!(0, import_node_fs16.existsSync)(filePath)) return null;
+  try {
+    return JSON.parse((0, import_node_fs16.readFileSync)(filePath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function checkSchemaDrift(rootDir) {
+  const findings = [];
+  const db = readGraphFile(rootDir, "db");
+  if (!db) {
+    findings.push({ id: "no-db-graph", severity: "info", category: "schema_drift", title: "No DB graph", detail: "Run generate_graph first to populate the DB layer." });
+    return buildReport("db", "schema_drift", findings);
+  }
+  for (const c of db.contradictions ?? []) {
+    const isTableLevel = c.detail.includes("Table ") && (c.detail.includes("has no CREATE TABLE") || c.detail.includes("not in schema.prisma"));
+    findings.push({
+      id: `drift:${c.entity}`,
+      severity: isTableLevel ? "error" : "warning",
+      category: "schema_drift",
+      title: c.entity,
+      detail: c.detail
+    });
+  }
+  return buildReport("db", "schema_drift", findings);
+}
+function checkOrphanFks(rootDir) {
+  const findings = [];
+  const db = readGraphFile(rootDir, "db");
+  if (!db) return buildReport("db", "orphan_fks", findings);
+  for (const f of db.flagged_edges ?? []) {
+    findings.push({
+      id: `fk:${f.source}->${f.target}`,
+      severity: "warning",
+      category: "orphan_fks",
+      title: `${f.source} \u2192 ${f.target}`,
+      detail: f.label
+    });
+  }
+  return buildReport("db", "orphan_fks", findings);
+}
+function checkUnprotectedRoutes(rootDir) {
+  const findings = [];
+  const api = readGraphFile(rootDir, "api");
+  const staticGraph = readGraphFile(rootDir, "static");
+  if (!api) return buildReport("api", "unprotected_routes", findings);
+  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
+  let routePermsContent = "";
+  if ((0, import_node_fs16.existsSync)(routePermsPath)) {
+    routePermsContent = (0, import_node_fs16.readFileSync)(routePermsPath, "utf-8");
+  }
+  const registeredRoutes = /* @__PURE__ */ new Set();
+  const routeEntryRe = /path:\s*'([^']+)'/g;
+  let rm;
+  while ((rm = routeEntryRe.exec(routePermsContent)) !== null) {
+    registeredRoutes.add(rm[1].replace(/:(\w+)/g, "[$1]"));
+  }
+  for (const node of api.nodes) {
+    if (node.type !== "endpoint") continue;
+    const route = node.route ?? "";
+    if (!route) continue;
+    const normalized = "/api" + (route.startsWith("/") ? route : "/" + route);
+    const isRegistered = registeredRoutes.has(normalized) || [...registeredRoutes].some((r) => routeMatchesPattern(normalized, r));
+    if (!isRegistered) {
+      const methods = node.methods ?? [];
+      findings.push({
+        id: `unprotected:${node.id}`,
+        severity: "warning",
+        category: "unprotected_routes",
+        title: `${methods.join(",")} ${route}`,
+        detail: `API endpoint has no entry in ROUTE_PERMISSIONS. Methods: ${methods.join(", ")}`,
+        file: node.id
+      });
+    }
+  }
+  return buildReport("api", "unprotected_routes", findings);
+}
+function routeMatchesPattern(route, pattern) {
+  const routeParts = route.split("/");
+  const patternParts = pattern.split("/");
+  if (routeParts.length !== patternParts.length) return false;
+  for (let i = 0; i < routeParts.length; i++) {
+    const rp = routeParts[i];
+    const pp = patternParts[i];
+    if (rp === pp) continue;
+    if (pp.startsWith("[") || pp.startsWith(":")) continue;
+    if (rp.startsWith("[") || rp.startsWith(":")) continue;
+    return false;
+  }
+  return true;
+}
+function checkDeadScreens(rootDir) {
+  const findings = [];
+  const ui = readGraphFile(rootDir, "ui");
+  if (!ui) return buildReport("ui", "dead_screens", findings);
+  const pages = ui.nodes.filter((n) => n.type === "page" || n.type === "layout");
+  const navTargets = /* @__PURE__ */ new Set();
+  for (const e of ui.edges) {
+    if (e.type === "navigates" || e.type === "renders" || e.type === "imports") {
+      navTargets.add(e.target);
+    }
+  }
+  for (const cr of ui.cross_refs ?? []) {
+    navTargets.add(cr.target);
+  }
+  for (const page of pages) {
+    if (page.id.endsWith("layout.tsx") && page.id.split("/").length <= 2) continue;
+    if (["error.tsx", "loading.tsx", "not-found.tsx", "template.tsx"].some((s) => page.id.endsWith(s))) continue;
+    if (!navTargets.has(page.id)) {
+      findings.push({
+        id: `dead:${page.id}`,
+        severity: "info",
+        category: "dead_screens",
+        title: page.name,
+        detail: `Page "${page.id}" has no incoming navigation, render, or import edges.`,
+        file: page.id
+      });
+    }
+  }
+  return buildReport("ui", "dead_screens", findings);
+}
+function checkUnenforcedPermissions(rootDir) {
+  const findings = [];
+  const staticGraph = readGraphFile(rootDir, "static");
+  if (!staticGraph) return buildReport("static", "unenforced_permissions", findings);
+  const permissions = staticGraph.nodes.filter((n) => n.type === "seed_permission").map((n) => ({ id: n.id, key: n.value, name: n.name }));
+  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
+  let routePermsContent = "";
+  if ((0, import_node_fs16.existsSync)(routePermsPath)) {
+    routePermsContent = (0, import_node_fs16.readFileSync)(routePermsPath, "utf-8");
+  }
+  for (const perm of permissions) {
+    const regex = new RegExp(`permission:\\s*['"]${perm.key}['"]`);
+    if (!regex.test(routePermsContent)) {
+      findings.push({
+        id: `unenforced:${perm.key}`,
+        severity: "warning",
+        category: "unenforced_permissions",
+        title: `${perm.name} (${perm.key})`,
+        detail: `Permission "${perm.key}" exists in seed data but has no entry in ROUTE_PERMISSIONS \u2014 no API route requires it.`
+      });
+    }
+  }
+  return buildReport("static", "unenforced_permissions", findings);
+}
+function checkHardcodedValues(rootDir) {
+  const findings = [];
+  const staticGraph = readGraphFile(rootDir, "static");
+  if (!staticGraph) return buildReport("static", "hardcoded_values", findings);
+  const knownValues = /* @__PURE__ */ new Set();
+  for (const n of staticGraph.nodes) {
+    if (n.type === "enum_value") knownValues.add(n.value);
+  }
+  const api = readGraphFile(rootDir, "api");
+  if (!api) return buildReport("static", "hardcoded_values", findings);
+  const allCapsRe = /['"]([A-Z][A-Z_]{2,})['"]/g;
+  const seen = /* @__PURE__ */ new Set();
+  for (const node of api.nodes) {
+    if (node.type !== "endpoint") continue;
+    const filePath = (0, import_node_path18.join)(rootDir, "src", node.id);
+    if (!(0, import_node_fs16.existsSync)(filePath)) continue;
+    const content = (0, import_node_fs16.readFileSync)(filePath, "utf-8");
+    let m;
+    allCapsRe.lastIndex = 0;
+    while ((m = allCapsRe.exec(content)) !== null) {
+      const val = m[1];
+      if (knownValues.has(val)) continue;
+      if (["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS", "UTF", "NULL", "TRUE", "FALSE", "JSON", "HTML", "CSS", "ENV"].includes(val)) continue;
+      const key = `${node.id}:${val}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({
+        id: `hardcoded:${key}`,
+        severity: "info",
+        category: "hardcoded_values",
+        title: `"${val}" in ${node.id}`,
+        detail: `ALL_CAPS string literal "${val}" appears in API code but is not in the enum/seed inventory. May be an unregistered constant.`,
+        file: node.id
+      });
+    }
+  }
+  return buildReport("static", "hardcoded_values", findings);
+}
+function buildReport(layer, check, findings) {
+  return {
+    layer,
+    check,
+    findings,
+    summary: {
+      errors: findings.filter((f) => f.severity === "error").length,
+      warnings: findings.filter((f) => f.severity === "warning").length,
+      info: findings.filter((f) => f.severity === "info").length
+    },
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function getAvailableChecks() {
+  const result = {};
+  for (const [layer, checks] of Object.entries(CHECKS)) {
+    result[layer] = Object.keys(checks);
+  }
+  return result;
+}
+function runAudit(rootDir, layer, check) {
+  if (layer === "all") {
+    const reports = [];
+    for (const [l, checks] of Object.entries(CHECKS)) {
+      for (const fn of Object.values(checks)) {
+        reports.push(fn(rootDir));
+      }
+    }
+    return reports;
+  }
+  const layerChecks = CHECKS[layer];
+  if (!layerChecks) {
+    return [{
+      layer,
+      check: "unknown",
+      findings: [{ id: "invalid-layer", severity: "error", category: "system", title: "Invalid layer", detail: `Layer "${layer}" has no audit checks. Available: ${Object.keys(CHECKS).join(", ")}` }],
+      summary: { errors: 1, warnings: 0, info: 0 },
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    }];
+  }
+  if (check) {
+    const fn = layerChecks[check];
+    if (!fn) {
+      return [{
+        layer,
+        check,
+        findings: [{ id: "invalid-check", severity: "error", category: "system", title: "Invalid check", detail: `Check "${check}" not found for layer "${layer}". Available: ${Object.keys(layerChecks).join(", ")}` }],
+        summary: { errors: 1, warnings: 0, info: 0 },
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }];
+    }
+    return [fn(rootDir)];
+  }
+  return Object.values(layerChecks).map((fn) => fn(rootDir));
+}
+function formatAsPrompt(reports) {
+  const lines = [];
+  for (const report of reports) {
+    if (report.findings.length === 0) continue;
+    lines.push(`## ${report.layer.toUpperCase()} \u2014 ${report.check} (${report.findings.length} findings)`);
+    lines.push("");
+    for (const f of report.findings) {
+      const tag = f.severity === "error" ? "ERROR" : f.severity === "warning" ? "WARNING" : "INFO";
+      const filePart = f.file ? ` (${f.file}${f.line ? `:${f.line}` : ""})` : "";
+      lines.push(`- [${tag}] ${f.title}${filePart}`);
+      lines.push(`  ${f.detail}`);
+    }
+    lines.push("");
+  }
+  if (lines.length === 0) return "No audit findings.";
+  return lines.join("\n");
+}
+var import_node_fs16, import_node_path18, CHECKS;
+var init_audit_core = __esm({
+  "src/server/graph/core/audit-core.ts"() {
+    "use strict";
+    import_node_fs16 = require("node:fs");
+    import_node_path18 = require("node:path");
+    CHECKS = {
+      db: {
+        schema_drift: checkSchemaDrift,
+        orphan_fks: checkOrphanFks
+      },
+      api: {
+        unprotected_routes: checkUnprotectedRoutes
+      },
+      ui: {
+        dead_screens: checkDeadScreens
+      },
+      static: {
+        unenforced_permissions: checkUnenforcedPermissions,
+        hardcoded_values: checkHardcodedValues
+      }
+    };
+  }
+});
+
 // src/server/chart-serve.ts
 var chart_serve_exports = {};
 __export(chart_serve_exports, {
@@ -2787,31 +4274,39 @@ function randomPort() {
 function findProjectRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 8; i++) {
-    const graphsDir2 = import_node_path15.default.join(dir, ".launchsecure", "graphs");
-    if (import_node_fs13.default.existsSync(import_node_path15.default.join(graphsDir2, "ui.json")) || import_node_fs13.default.existsSync(import_node_path15.default.join(graphsDir2, "api.json")) || import_node_fs13.default.existsSync(import_node_path15.default.join(graphsDir2, "db.json"))) return dir;
-    const parent = import_node_path15.default.dirname(dir);
+    const graphsDir2 = import_node_path19.default.join(dir, ".launchsecure", "graphs");
+    if (import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "ui.json")) || import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "api.json")) || import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "db.json"))) return dir;
+    const parent = import_node_path19.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   dir = startDir;
   for (let i = 0; i < 8; i++) {
-    if (import_node_fs13.default.existsSync(import_node_path15.default.join(dir, ".git"))) return dir;
-    const parent = import_node_path15.default.dirname(dir);
+    if (import_node_fs17.default.existsSync(import_node_path19.default.join(dir, ".git"))) return dir;
+    const parent = import_node_path19.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return startDir;
 }
-async function buildMergedGraph(projectRoot) {
-  let graphs = readAllGraphs(projectRoot);
-  if (!graphs.ui && !graphs.api && !graphs.db) {
-    await generateGraph(projectRoot);
-    graphs = readAllGraphs(projectRoot);
+function resolveRequestRoot(url, monorepoRoot, projects) {
+  const projectParam = url.searchParams.get("project");
+  if (!projectParam || projects.length === 0) return monorepoRoot;
+  const resolved = import_node_path19.default.resolve(monorepoRoot, projectParam);
+  if (!resolved.startsWith(monorepoRoot)) {
+    throw new Error("Project path outside monorepo root");
+  }
+  return resolved;
+}
+async function buildMergedGraph(root) {
+  let graphs = readAllGraphs(root);
+  if (Object.keys(graphs).length === 0) {
+    await generateGraph(root);
+    graphs = readAllGraphs(root);
   }
   const nodes = [];
   const rawLinks = [];
-  const LAYERS2 = ["ui", "api", "db"];
-  for (const layer of LAYERS2) {
+  for (const layer of Object.keys(graphs)) {
     const g = graphs[layer];
     if (!g) continue;
     for (const n of g.nodes) {
@@ -2848,16 +4343,16 @@ async function buildMergedGraph(projectRoot) {
   };
 }
 function serveStatic(res, filePath) {
-  if (!import_node_fs13.default.existsSync(filePath) || !import_node_fs13.default.statSync(filePath).isFile()) return false;
-  const ext = import_node_path15.default.extname(filePath).toLowerCase();
+  if (!import_node_fs17.default.existsSync(filePath) || !import_node_fs17.default.statSync(filePath).isFile()) return false;
+  const ext = import_node_path19.default.extname(filePath).toLowerCase();
   const mime = MIME_TYPES[ext] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": mime, "Cache-Control": "no-cache" });
-  import_node_fs13.default.createReadStream(filePath).pipe(res);
+  import_node_fs17.default.createReadStream(filePath).pipe(res);
   return true;
 }
 function serveIndex(res, clientDir) {
-  const indexPath = import_node_path15.default.join(clientDir, "index.html");
-  if (!import_node_fs13.default.existsSync(indexPath)) {
+  const indexPath = import_node_path19.default.join(clientDir, "index.html");
+  if (!import_node_fs17.default.existsSync(indexPath)) {
     res.writeHead(500, { "Content-Type": "text/plain" });
     res.end(`LaunchChart client bundle not found at ${clientDir}. Run 'npm run build:chart-client'.`);
     return;
@@ -2909,19 +4404,40 @@ async function startChartServer(opts = {}) {
     }
     return { port: existing.port, url: existing.url };
   }
-  const clientDir = opts.clientDir ?? import_node_path15.default.join(__dirname, "..", "chart-client");
+  const clientDir = opts.clientDir ?? import_node_path19.default.join(__dirname, "..", "chart-client");
+  const rootConfig = loadConfig(projectRoot);
+  const projects = rootConfig.projects ?? [];
   const server = import_node_http.default.createServer((req, res) => {
     try {
       const url2 = new URL(req.url ?? "/", `http://${req.headers.host}`);
+      let reqRoot;
+      try {
+        reqRoot = resolveRequestRoot(url2, projectRoot, projects);
+      } catch (err2) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: String(err2) }));
+        return;
+      }
+      if (req.method === "GET" && url2.pathname === "/api/projects") {
+        const projectList = projects.length > 0 ? projects.map((p) => {
+          const absRoot = import_node_path19.default.resolve(projectRoot, p.root);
+          const hasGraphs = import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, ".launchsecure", "graphs"));
+          const hasNextConfig2 = import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.ts")) || import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.js")) || import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.mjs"));
+          return { name: p.name, root: p.root, hasGraphs, hasNextConfig: hasNextConfig2 };
+        }) : [{ name: import_node_path19.default.basename(projectRoot), root: ".", hasGraphs: import_node_fs17.default.existsSync(import_node_path19.default.join(projectRoot, ".launchsecure", "graphs")), hasNextConfig: true }];
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ projects: projectList, monorepoRoot: projectRoot }));
+        return;
+      }
       if (req.method === "GET" && url2.pathname === "/api/project-graph") {
         const regenerate = url2.searchParams.get("regenerate") === "1";
         (async () => {
-          if (regenerate) await generateGraph(projectRoot);
-          const merged = await buildMergedGraph(projectRoot);
+          if (regenerate) await generateGraph(reqRoot);
+          const merged = await buildMergedGraph(reqRoot);
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({
             ...merged,
-            debug: { cwd, projectRoot }
+            debug: { cwd, projectRoot: reqRoot }
           }));
         })().catch((e) => {
           res.writeHead(500);
@@ -2930,15 +4446,15 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/raw-graphs") {
-        const graphs = readAllGraphs(projectRoot);
+        const graphs = readAllGraphs(reqRoot);
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ui: graphs.ui ?? null, api: graphs.api ?? null, db: graphs.db ?? null }));
         return;
       }
       if (req.method === "POST" && url2.pathname === "/api/generate-graph") {
         (async () => {
-          await generateGraph(projectRoot);
-          const graphs = readAllGraphs(projectRoot);
+          await generateGraph(reqRoot);
+          const graphs = readAllGraphs(reqRoot);
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({
             ok: true,
@@ -2954,41 +4470,43 @@ async function startChartServer(opts = {}) {
       }
       if (req.method === "GET" && url2.pathname === "/api/file-content") {
         const relPath = url2.searchParams.get("path");
-        if (!relPath || relPath.includes("..") || import_node_path15.default.isAbsolute(relPath)) {
+        if (!relPath || relPath.includes("..") || import_node_path19.default.isAbsolute(relPath)) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "Invalid path" }));
           return;
         }
-        const filePath = import_node_path15.default.join(projectRoot, relPath);
-        if (!filePath.startsWith(projectRoot) || !import_node_fs13.default.existsSync(filePath) || !import_node_fs13.default.statSync(filePath).isFile()) {
+        const filePath = import_node_path19.default.join(reqRoot, relPath);
+        if (!filePath.startsWith(reqRoot) || !import_node_fs17.default.existsSync(filePath) || !import_node_fs17.default.statSync(filePath).isFile()) {
           res.writeHead(404, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "File not found" }));
           return;
         }
-        const ext = import_node_path15.default.extname(filePath).toLowerCase();
+        const ext = import_node_path19.default.extname(filePath).toLowerCase();
         const langMap = { ".ts": "typescript", ".tsx": "tsx", ".js": "javascript", ".jsx": "jsx", ".prisma": "prisma", ".json": "json", ".css": "css" };
-        const content = import_node_fs13.default.readFileSync(filePath, "utf-8");
+        const content = import_node_fs17.default.readFileSync(filePath, "utf-8");
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ content, language: langMap[ext] ?? "text", path: relPath }));
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/health") {
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: true, projectRoot }));
+        res.end(JSON.stringify({ ok: true, projectRoot: reqRoot }));
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/parser-config") {
-        const config2 = loadConfig(projectRoot);
-        const detection = [
-          { id: "react-nextjs", layer: "ui", label: "React + Next.js", detected: reactNextjsParser.detect(projectRoot) },
-          { id: "nextjs-routes", layer: "api", label: "Next.js API Routes", detected: nextjsRoutesParser.detect(projectRoot) },
-          { id: "prisma-schema", layer: "db", label: "Prisma Schema", detected: prismaSchemaParser.detect(projectRoot) }
-        ];
-        const crosslayerParsers = [
-          { id: "fetch-resolver", label: "Fetch / api.method() calls" },
-          { id: "api-annotations", label: "@api annotations" },
-          { id: "url-literal-scanner", label: "/api/... URL literals" }
-        ];
+        const config2 = loadConfig(reqRoot);
+        const registry = createRegistry(config2, reqRoot);
+        const detection = [];
+        for (const parser of registry.getAll()) {
+          if ("layers" in parser && Array.isArray(parser.layers)) {
+            const mp = parser;
+            detection.push({ id: mp.id, layers: mp.layers, detected: mp.detect(reqRoot) });
+          } else if ("layer" in parser && parser.layer !== "crosslayer") {
+            const sp = parser;
+            detection.push({ id: sp.id, layers: [sp.layer], detected: sp.detect(reqRoot) });
+          }
+        }
+        const crosslayerParsers = registry.getCrossLayerParsers().map((p) => ({ id: p.id }));
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ config: config2, detection, crosslayerParsers }));
         return;
@@ -3001,8 +4519,8 @@ async function startChartServer(opts = {}) {
         req.on("end", () => {
           try {
             const newConfig = JSON.parse(body);
-            const configPath = import_node_path15.default.join(projectRoot, ".launchchart.json");
-            import_node_fs13.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
+            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err2) {
@@ -3013,7 +4531,7 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/tagger-config") {
-        const config2 = loadConfig(projectRoot);
+        const config2 = loadConfig(reqRoot);
         const builtinTaggers = [
           { id: "module", tagKey: "module", trackUntagged: config2.taggers?.trackUntagged?.module ?? true },
           { id: "screen", tagKey: "screen", trackUntagged: config2.taggers?.trackUntagged?.screen ?? true }
@@ -3033,10 +4551,10 @@ async function startChartServer(opts = {}) {
         req.on("end", () => {
           try {
             const taggerConfig = JSON.parse(body);
-            const config2 = loadConfig(projectRoot);
+            const config2 = loadConfig(reqRoot);
             config2.taggers = taggerConfig;
-            const configPath = import_node_path15.default.join(projectRoot, ".launchchart.json");
-            import_node_fs13.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
+            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err2) {
@@ -3047,7 +4565,7 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (req.method === "GET" && url2.pathname === "/api/tags") {
-        const store = readTagStore(projectRoot);
+        const store = readTagStore(reqRoot);
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify(store));
         return;
@@ -3065,7 +4583,7 @@ async function startChartServer(opts = {}) {
               res.end(JSON.stringify({ ok: false, error: "nodeId, key, and value are required" }));
               return;
             }
-            setTag(projectRoot, nodeId, key, value);
+            setTag(reqRoot, nodeId, key, value);
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err2) {
@@ -3088,7 +4606,76 @@ async function startChartServer(opts = {}) {
               res.end(JSON.stringify({ ok: false, error: "nodeId and key are required" }));
               return;
             }
-            removeTag(projectRoot, nodeId, key);
+            removeTag(reqRoot, nodeId, key);
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err2) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: String(err2) }));
+          }
+        });
+        return;
+      }
+      if (req.method === "GET" && url2.pathname === "/api/detected-paths") {
+        const config2 = loadConfig(reqRoot);
+        const paths = resolveProjectPaths(reqRoot, config2);
+        const isOverride = !!config2.paths?.appDir;
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+          projectRoot: reqRoot,
+          detected: paths ? {
+            srcDir: import_node_path19.default.relative(reqRoot, paths.srcDir) || ".",
+            appDir: import_node_path19.default.relative(reqRoot, paths.appDir),
+            apiDir: import_node_path19.default.relative(reqRoot, paths.apiDir)
+          } : null,
+          isOverride
+        }));
+        return;
+      }
+      if (req.method === "GET" && url2.pathname === "/api/browse-dir") {
+        const browsePath = url2.searchParams.get("path") || projectRoot;
+        const abs = import_node_path19.default.resolve(browsePath);
+        const twoUp = import_node_path19.default.resolve(projectRoot, "..", "..");
+        if (!abs.startsWith(twoUp)) {
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Path outside allowed range" }));
+          return;
+        }
+        try {
+          const entries = import_node_fs17.default.readdirSync(abs, { withFileTypes: true });
+          const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules" && e.name !== "dist" && e.name !== ".next").map((e) => e.name).sort();
+          const parent = abs !== twoUp ? import_node_path19.default.dirname(abs) : null;
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ current: abs, parent, dirs, relative: import_node_path19.default.relative(projectRoot, abs) || "." }));
+        } catch (err2) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: String(err2) }));
+        }
+        return;
+      }
+      if (req.method === "GET" && url2.pathname === "/api/audit") {
+        const layer = url2.searchParams.get("layer") ?? "all";
+        const check = url2.searchParams.get("check") ?? void 0;
+        const reports = runAudit(reqRoot, layer, check);
+        const prompt = formatAsPrompt(reports);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ reports, prompt, checks: getAvailableChecks() }));
+        return;
+      }
+      if (req.method === "POST" && url2.pathname === "/api/projects") {
+        let body = "";
+        req.on("data", (chunk) => {
+          body += chunk.toString();
+        });
+        req.on("end", () => {
+          try {
+            const { projects: newProjects } = JSON.parse(body);
+            const config2 = loadConfig(projectRoot);
+            config2.projects = newProjects.length > 0 ? newProjects : void 0;
+            const configPath = import_node_path19.default.join(projectRoot, ".launchchart.json");
+            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+            projects.length = 0;
+            if (config2.projects) projects.push(...config2.projects);
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err2) {
@@ -3099,7 +4686,7 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (url2.pathname !== "/") {
-        const staticPath = import_node_path15.default.join(clientDir, url2.pathname);
+        const staticPath = import_node_path19.default.join(clientDir, url2.pathname);
         if (serveStatic(res, staticPath)) return;
       }
       serveIndex(res, clientDir);
@@ -3137,6 +4724,10 @@ async function startChartServer(opts = {}) {
 `);
     process.stderr.write(`[launch-chart] project root: ${projectRoot}
 `);
+    if (projects.length > 0) {
+      process.stderr.write(`[launch-chart] multi-project mode: ${projects.length} projects
+`);
+    }
   }
   return { port, url };
 }
@@ -3155,19 +4746,19 @@ function runServeCli(argv) {
     process.exit(1);
   });
 }
-var import_node_http, import_node_fs13, import_node_path15, MAX_PORT_SCAN, MIME_TYPES;
+var import_node_http, import_node_fs17, import_node_path19, MAX_PORT_SCAN, MIME_TYPES;
 var init_chart_serve = __esm({
   "src/server/chart-serve.ts"() {
     "use strict";
     import_node_http = __toESM(require("node:http"));
-    import_node_fs13 = __toESM(require("node:fs"));
-    import_node_path15 = __toESM(require("node:path"));
+    import_node_fs17 = __toESM(require("node:fs"));
+    import_node_path19 = __toESM(require("node:path"));
     init_graph();
     init_lockfile();
     init_config();
-    init_react_nextjs();
-    init_nextjs_routes();
-    init_prisma_schema();
+    init_parser_registry();
+    init_resolve_paths();
+    init_audit_core();
     MAX_PORT_SCAN = 3;
     MIME_TYPES = {
       ".html": "text/html; charset=utf-8",
@@ -3183,6 +4774,179 @@ var init_chart_serve = __esm({
   }
 });
 
+// src/server/graph/core/language-detection.ts
+function walkForExtensions(dir, extCounts, depth = 0) {
+  if (depth > 10) return;
+  if (!(0, import_node_fs18.existsSync)(dir)) return;
+  let entries;
+  try {
+    entries = (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name.startsWith(".") && entry.isDirectory()) continue;
+    if (entry.isDirectory()) {
+      if (IGNORE_DIRS.has(entry.name)) continue;
+      walkForExtensions((0, import_node_path20.join)(dir, entry.name), extCounts, depth + 1);
+    } else {
+      const ext = (0, import_node_path20.extname)(entry.name).toLowerCase();
+      if (ext && EXTENSION_TO_LANGUAGE[ext]) {
+        extCounts.set(ext, (extCounts.get(ext) ?? 0) + 1);
+      }
+    }
+  }
+}
+function detectLanguages(rootDir, supportedLanguages) {
+  const extCounts = /* @__PURE__ */ new Map();
+  walkForExtensions(rootDir, extCounts);
+  const langData = /* @__PURE__ */ new Map();
+  for (const [ext, count] of extCounts) {
+    const lang = EXTENSION_TO_LANGUAGE[ext];
+    if (!lang) continue;
+    if (!langData.has(lang)) {
+      langData.set(lang, { extensions: /* @__PURE__ */ new Set(), fileCount: 0 });
+    }
+    const data = langData.get(lang);
+    data.extensions.add(ext);
+    data.fileCount += count;
+  }
+  const results = [];
+  for (const [lang, data] of langData) {
+    if (AUXILIARY_LANGUAGES.has(lang)) continue;
+    const parserIds = supportedLanguages.get(lang) ?? [];
+    results.push({
+      id: lang,
+      extensions: [...data.extensions].sort(),
+      fileCount: data.fileCount,
+      supported: parserIds.length > 0,
+      parserIds
+    });
+  }
+  results.sort((a, b) => {
+    if (a.supported !== b.supported) return a.supported ? -1 : 1;
+    return b.fileCount - a.fileCount;
+  });
+  return results;
+}
+var import_node_fs18, import_node_path20, EXTENSION_TO_LANGUAGE, IGNORE_DIRS, AUXILIARY_LANGUAGES;
+var init_language_detection = __esm({
+  "src/server/graph/core/language-detection.ts"() {
+    "use strict";
+    import_node_fs18 = require("node:fs");
+    import_node_path20 = require("node:path");
+    EXTENSION_TO_LANGUAGE = {
+      // Web / Frontend
+      ".ts": "typescript",
+      ".tsx": "typescript",
+      ".js": "javascript",
+      ".jsx": "javascript",
+      ".mjs": "javascript",
+      ".cjs": "javascript",
+      ".vue": "vue",
+      ".svelte": "svelte",
+      ".html": "html",
+      ".css": "css",
+      ".scss": "scss",
+      ".less": "less",
+      // Backend
+      ".py": "python",
+      ".go": "go",
+      ".rs": "rust",
+      ".rb": "ruby",
+      ".java": "java",
+      ".kt": "kotlin",
+      ".kts": "kotlin",
+      ".scala": "scala",
+      ".cs": "csharp",
+      ".fs": "fsharp",
+      ".php": "php",
+      ".ex": "elixir",
+      ".exs": "elixir",
+      ".erl": "erlang",
+      ".hs": "haskell",
+      ".lua": "lua",
+      ".pl": "perl",
+      ".r": "r",
+      ".R": "r",
+      ".jl": "julia",
+      ".dart": "dart",
+      ".clj": "clojure",
+      ".cljs": "clojure",
+      // Systems
+      ".c": "c",
+      ".h": "c",
+      ".cpp": "cpp",
+      ".cc": "cpp",
+      ".cxx": "cpp",
+      ".hpp": "cpp",
+      ".swift": "swift",
+      ".m": "objective-c",
+      ".mm": "objective-c",
+      ".zig": "zig",
+      ".nim": "nim",
+      // Shell / Config
+      ".sh": "shell",
+      ".bash": "shell",
+      ".zsh": "shell",
+      ".fish": "shell",
+      // Data / Schema
+      ".prisma": "prisma",
+      ".sql": "sql",
+      ".graphql": "graphql",
+      ".gql": "graphql",
+      ".proto": "protobuf",
+      // Config
+      ".json": "json",
+      ".yaml": "yaml",
+      ".yml": "yaml",
+      ".toml": "toml",
+      ".xml": "xml",
+      // Docs
+      ".md": "markdown",
+      ".mdx": "mdx",
+      ".rst": "restructuredtext"
+    };
+    IGNORE_DIRS = /* @__PURE__ */ new Set([
+      "node_modules",
+      ".next",
+      "dist",
+      ".launchsecure",
+      ".git",
+      "coverage",
+      ".turbo",
+      "build",
+      "out",
+      ".vercel",
+      ".cache",
+      "__pycache__",
+      ".tox",
+      "venv",
+      ".venv",
+      "target",
+      "vendor",
+      "Pods",
+      ".gradle",
+      ".idea",
+      ".vscode"
+    ]);
+    AUXILIARY_LANGUAGES = /* @__PURE__ */ new Set([
+      "json",
+      "yaml",
+      "toml",
+      "xml",
+      "markdown",
+      "mdx",
+      "restructuredtext",
+      "html",
+      "css",
+      "scss",
+      "less",
+      "shell"
+    ]);
+  }
+});
+
 // src/server/graph-mcp.ts
 var graph_mcp_exports = {};
 __export(graph_mcp_exports, {
@@ -3269,8 +5033,8 @@ function neighborhood(graph, centerId, hops, layer, minimal) {
       const dstIn = visited.has(e.target) || next.has(e.target);
       if (srcIn && dstIn) projectedEdges++;
     }
-    const perNode = minimal ? EST_CHARS_PER_NODE_MIN[layer] : EST_CHARS_PER_NODE_FULL[layer];
-    const projectedChars = projectedVisited * perNode + projectedEdges * EST_CHARS_PER_EDGE[layer];
+    const perNode = minimal ? EST_CHARS_PER_NODE_MIN[layer] ?? DEFAULT_EST_NODE_MIN : EST_CHARS_PER_NODE_FULL[layer] ?? DEFAULT_EST_NODE_FULL;
+    const projectedChars = projectedVisited * perNode + projectedEdges * (EST_CHARS_PER_EDGE[layer] ?? DEFAULT_EST_EDGE);
     if (projectedChars > NEIGHBORHOOD_BUDGET_CHARS) {
       budgetExceeded = true;
       break;
@@ -3318,9 +5082,6 @@ function err(text) {
 async function handleGenerateGraph(args) {
   const rootDir = process.cwd();
   const layer = args.layer;
-  if (layer && !["ui", "api", "db"].includes(layer)) {
-    return err(`Invalid layer "${layer}". Must be one of: ui, api, db`);
-  }
   const results = await generateGraph(rootDir, layer);
   if (results.length === 0) {
     return err(
@@ -3357,8 +5118,11 @@ function runReadGraphQueryRaw(rootDir, args) {
   const offset = args.offset ?? 0;
   const limit = args.limit;
   const hasFilter = !!(search || type || module_ || nodeId || tagKey && tagValue);
-  if (layer && !["ui", "api", "db"].includes(layer)) {
-    return { error: `Invalid layer "${layer}". Must be one of: ui, api, db` };
+  if (layer) {
+    const available = getAvailableLayers(rootDir);
+    if (available.length > 0 && !available.includes(layer)) {
+      return { error: `No graph found for layer "${layer}". Available: ${available.join(", ")}. Run generate_graph first.` };
+    }
   }
   if (!layer) {
     const graphs = readAllGraphs(rootDir);
@@ -3512,9 +5276,12 @@ function handleReadGraph(args) {
   return okJson(result);
 }
 function nodeToFilePath(rootDir, layer, nodeId) {
-  if (layer === "ui") return (0, import_node_path16.join)(rootDir, "src", nodeId);
-  if (layer === "api") return (0, import_node_path16.join)(rootDir, nodeId);
-  if (layer === "db") return (0, import_node_path16.join)(rootDir, "prisma", "schema.prisma");
+  if (layer === "ui" || layer === "api") return (0, import_node_path21.join)(rootDir, "src", nodeId);
+  if (layer === "db") return (0, import_node_path21.join)(rootDir, "prisma", "schema.prisma");
+  const withSrc = (0, import_node_path21.join)(rootDir, "src", nodeId);
+  if ((0, import_node_fs19.existsSync)(withSrc)) return withSrc;
+  const direct = (0, import_node_path21.join)(rootDir, nodeId);
+  if ((0, import_node_fs19.existsSync)(direct)) return direct;
   return null;
 }
 function handleInspectNode(args) {
@@ -3603,7 +5370,10 @@ function handleGrepNodes(args) {
   const layer = args.layer;
   if (!pattern) return err("pattern is required");
   if (!layer) return err("layer is required (ui, api, or db)");
-  if (!["ui", "api", "db"].includes(layer)) return err(`Invalid layer "${layer}". Must be one of: ui, api, db`);
+  const grepAvailable = getAvailableLayers(rootDir);
+  if (grepAvailable.length > 0 && !grepAvailable.includes(layer)) {
+    return err(`No graph found for layer "${layer}". Available: ${grepAvailable.join(", ")}. Run generate_graph first.`);
+  }
   const hasFilter = !!(args.search || args.type || args.module || args.node_id);
   if (!hasFilter) {
     return err(
@@ -3654,11 +5424,11 @@ function handleGrepNodes(args) {
   let filesSearched = 0;
   let truncated = false;
   for (const [filePath, nodeId] of filePaths) {
-    if (!(0, import_node_fs14.existsSync)(filePath)) continue;
+    if (!(0, import_node_fs19.existsSync)(filePath)) continue;
     filesSearched++;
     let content;
     try {
-      content = (0, import_node_fs14.readFileSync)(filePath, "utf-8");
+      content = (0, import_node_fs19.readFileSync)(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -3723,11 +5493,11 @@ function handleStartChartServer(args) {
     });
   }
   const entryPath = process.argv[1];
-  const logDir = (0, import_node_path16.join)((0, import_node_os2.homedir)(), ".launchsecure");
-  (0, import_node_fs14.mkdirSync)(logDir, { recursive: true });
-  const logPath = (0, import_node_path16.join)(logDir, "launch-chart.log");
-  const out = (0, import_node_fs14.openSync)(logPath, "a");
-  const err2 = (0, import_node_fs14.openSync)(logPath, "a");
+  const logDir = (0, import_node_path21.join)((0, import_node_os2.homedir)(), ".launchsecure");
+  (0, import_node_fs19.mkdirSync)(logDir, { recursive: true });
+  const logPath = (0, import_node_path21.join)(logDir, "launch-chart.log");
+  const out = (0, import_node_fs19.openSync)(logPath, "a");
+  const err2 = (0, import_node_fs19.openSync)(logPath, "a");
   const portArgs = args.port ? ["--port", String(args.port)] : [];
   const child = (0, import_node_child_process2.spawn)(process.execPath, [entryPath, "serve", ...portArgs], {
     detached: true,
@@ -3790,14 +5560,55 @@ function handleRemoveTag(args) {
   removeTag(rootDir, nodeId, key);
   return okJson({ ok: true, node_id: nodeId, removed_key: key });
 }
+function handleAuditLayer(args) {
+  const rootDir = process.cwd();
+  const layer = args.layer;
+  const check = args.check;
+  if (!layer) return err("layer is required");
+  const reports = runAudit(rootDir, layer, check);
+  const totalFindings = reports.reduce((acc, r) => acc + r.findings.length, 0);
+  const totalErrors = reports.reduce((acc, r) => acc + r.summary.errors, 0);
+  const totalWarnings = reports.reduce((acc, r) => acc + r.summary.warnings, 0);
+  const totalInfo = reports.reduce((acc, r) => acc + r.summary.info, 0);
+  const lines = [];
+  lines.push(`Audit: ${layer}${check ? ` / ${check}` : ""} \u2014 ${totalFindings} findings (${totalErrors} errors, ${totalWarnings} warnings, ${totalInfo} info)`);
+  lines.push("");
+  for (const report of reports) {
+    if (report.findings.length === 0) {
+      lines.push(`\u2713 ${report.check}: no issues found`);
+      continue;
+    }
+    lines.push(`\u2500\u2500 ${report.check} (${report.findings.length}) \u2500\u2500`);
+    for (const f of report.findings) {
+      const tag = f.severity === "error" ? "\u2717" : f.severity === "warning" ? "!" : "\xB7";
+      const filePart = f.file ? ` [${f.file}]` : "";
+      lines.push(`  ${tag} ${f.title}${filePart}`);
+      lines.push(`    ${f.detail}`);
+    }
+    lines.push("");
+  }
+  return okText(lines.join("\n"));
+}
 function handleDetectProjectStack() {
   const rootDir = process.cwd();
-  const parsers = [
-    { id: "react-nextjs", layer: "ui", detected: reactNextjsParser.detect(rootDir) },
-    { id: "nextjs-routes", layer: "api", detected: nextjsRoutesParser.detect(rootDir) },
-    { id: "prisma-schema", layer: "db", detected: prismaSchemaParser.detect(rootDir) }
-  ];
   const config = loadConfig(rootDir);
+  const registry = createRegistry(config, rootDir);
+  const parserResults = [];
+  for (const parser of registry.getAll()) {
+    if ("layers" in parser && Array.isArray(parser.layers)) {
+      const mp = parser;
+      parserResults.push({ id: mp.id, layers: mp.layers, detected: mp.detect(rootDir) });
+    } else if ("layer" in parser && parser.layer !== "crosslayer") {
+      const sp = parser;
+      parserResults.push({ id: sp.id, layers: [sp.layer], detected: sp.detect(rootDir) });
+    }
+  }
+  const availableLayers = /* @__PURE__ */ new Set();
+  for (const p of parserResults) {
+    if (p.detected) {
+      for (const l of p.layers) availableLayers.add(l);
+    }
+  }
   let stats = { calls_api: 0, references_api: 0, out_of_pattern: 0, annotations: 0 };
   const uiGraph = readGraph(rootDir, "ui");
   if (uiGraph) {
@@ -3809,20 +5620,20 @@ function handleDetectProjectStack() {
       if (f.type === "out_of_pattern") stats.out_of_pattern++;
     }
   }
-  const srcDir = (0, import_node_path16.join)(rootDir, "src");
-  if ((0, import_node_fs14.existsSync)(srcDir)) {
+  const srcDir = (0, import_node_path21.join)(rootDir, "src");
+  if ((0, import_node_fs19.existsSync)(srcDir)) {
     const scanDir = (dir) => {
-      if (!(0, import_node_fs14.existsSync)(dir)) return;
-      for (const entry of (0, import_node_fs14.readdirSync)(dir, { withFileTypes: true })) {
+      if (!(0, import_node_fs19.existsSync)(dir)) return;
+      for (const entry of (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true })) {
         if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-        const full = (0, import_node_path16.join)(dir, entry.name);
+        const full = (0, import_node_path21.join)(dir, entry.name);
         if (entry.isDirectory()) {
           scanDir(full);
           continue;
         }
-        if (![".ts", ".tsx"].includes((0, import_node_path16.extname)(entry.name))) continue;
+        if (![".ts", ".tsx"].includes((0, import_node_path21.extname)(entry.name))) continue;
         try {
-          const content = (0, import_node_fs14.readFileSync)(full, "utf-8");
+          const content = (0, import_node_fs19.readFileSync)(full, "utf-8");
           const matches = content.match(/@api\s+(GET|POST|PUT|DELETE|PATCH)\s+\/\S+/g);
           if (matches) stats.annotations += matches.length;
         } catch {
@@ -3837,8 +5648,16 @@ function handleDetectProjectStack() {
   } else if (stats.calls_api === 0 && stats.references_api > 0) {
     recommendedPrimary = "url-literal-scanner";
   }
+  const supportedLanguages = /* @__PURE__ */ new Map();
+  supportedLanguages.set("typescript", parserResults.filter((p) => p.detected && p.layers.some((l) => l === "ui" || l === "api")).map((p) => p.id));
+  supportedLanguages.set("prisma", parserResults.filter((p) => p.detected && p.layers.includes("db")).map((p) => p.id));
+  const languages = detectLanguages(rootDir, supportedLanguages);
+  const unsupported = languages.filter((l) => !l.supported);
+  const unsupportedHint = unsupported.length > 0 ? unsupported.map((l) => `${l.id} (${l.fileCount} files)`).join(", ") + " \u2014 detected but not yet supported" : null;
   return okJson({
-    parsers,
+    languages,
+    parsers: parserResults,
+    available_layers: [...availableLayers],
     crosslayer_parsers: [
       { id: "fetch-resolver", description: "Detects direct fetch()/api.get() calls with inline URLs" },
       { id: "api-annotations", description: "Scans for @api METHOD /path annotations in JSDoc/comments" },
@@ -3846,6 +5665,7 @@ function handleDetectProjectStack() {
     ],
     stats,
     recommended_primary: recommendedPrimary,
+    ...unsupportedHint ? { unsupported_hint: unsupportedHint } : {},
     current_config: Object.keys(config).length > 0 ? config : null,
     config_path: ".launchchart.json"
   });
@@ -3921,6 +5741,10 @@ async function handleMessage(msg) {
       respond(id ?? null, handleRemoveTag(args));
       return;
     }
+    if (toolName === "audit_layer") {
+      respond(id ?? null, handleAuditLayer(args));
+      return;
+    }
     respondError(id ?? null, -32601, `Unknown tool: ${toolName}`);
     return;
   }
@@ -3956,20 +5780,20 @@ function startGraphMcpServer() {
   process.stderr.write(`[launchsecure-graph] MCP server started (cwd: ${process.cwd()})
 `);
 }
-var import_node_fs14, import_node_path16, import_node_child_process2, import_node_os2, SERVER_INFO, TOOLS, COMPACT_SCHEMA, COMPACT_NODE_KNOWN_KEYS, DEEP_FIELDS, EST_CHARS_PER_NODE_FULL, EST_CHARS_PER_NODE_MIN, EST_CHARS_PER_EDGE, NEIGHBORHOOD_BUDGET_CHARS, BATCH_BUDGET_CHARS;
+var import_node_fs19, import_node_path21, import_node_child_process2, import_node_os2, SERVER_INFO, TOOLS, COMPACT_SCHEMA, COMPACT_NODE_KNOWN_KEYS, DEEP_FIELDS, EST_CHARS_PER_NODE_FULL, EST_CHARS_PER_NODE_MIN, EST_CHARS_PER_EDGE, DEFAULT_EST_NODE_FULL, DEFAULT_EST_NODE_MIN, DEFAULT_EST_EDGE, NEIGHBORHOOD_BUDGET_CHARS, BATCH_BUDGET_CHARS;
 var init_graph_mcp = __esm({
   "src/server/graph-mcp.ts"() {
     "use strict";
-    import_node_fs14 = require("node:fs");
-    import_node_path16 = require("node:path");
+    import_node_fs19 = require("node:fs");
+    import_node_path21 = require("node:path");
     import_node_child_process2 = require("node:child_process");
     import_node_os2 = require("node:os");
     init_graph();
     init_lockfile();
     init_config();
-    init_react_nextjs();
-    init_nextjs_routes();
-    init_prisma_schema();
+    init_parser_registry();
+    init_language_detection();
+    init_audit_core();
     SERVER_INFO = {
       name: "launchsecure-graph",
       version: "0.0.1"
@@ -3977,14 +5801,13 @@ var init_graph_mcp = __esm({
     TOOLS = [
       {
         name: "generate_graph",
-        description: "Regenerate the structural project graph by scanning source code in the current working directory. Parses three layers: UI (React/Next.js pages, layouts, components, hooks, imports/renders/navigation edges), API (Next.js App Router endpoints with HTTP methods), DB (Prisma schema models, enums, belongs_to/has_many relations). Writes JSON to .launchsecure/graphs/{layer}.json and returns node/edge counts. Run this when project structure has changed (new files, moved components, schema updates). Fast: typically <1s. After generation, use read_graph with filters to query.",
+        description: "Regenerate the structural project graph by scanning source code in the current working directory. Auto-detects project languages and frameworks, then parses into layers (e.g. ui, api, db) based on content classification. Writes JSON to .launchsecure/graphs/{layer}.json and returns node/edge counts. Run this when project structure has changed (new files, moved components, schema updates). Fast: typically <1s. After generation, use read_graph with filters to query.",
         inputSchema: {
           type: "object",
           properties: {
             layer: {
               type: "string",
-              enum: ["ui", "api", "db"],
-              description: "Specific layer to regenerate. Omit to regenerate all detectable layers."
+              description: "Specific layer to regenerate (e.g. 'ui', 'api', 'db'). Omit to regenerate all detectable layers. Run detect_project_stack to see available layers."
             }
           }
         }
@@ -3997,8 +5820,7 @@ var init_graph_mcp = __esm({
           properties: {
             layer: {
               type: "string",
-              enum: ["ui", "api", "db"],
-              description: "Graph layer to query: ui, api, or db. Required if any filter is provided."
+              description: "Graph layer to query (e.g. 'ui', 'api', 'db'). Required if any filter is provided. Run detect_project_stack to see available layers."
             },
             search: {
               type: "string",
@@ -4050,7 +5872,7 @@ var init_graph_mcp = __esm({
               items: {
                 type: "object",
                 properties: {
-                  layer: { type: "string", enum: ["ui", "api", "db"] },
+                  layer: { type: "string" },
                   search: { type: "string" },
                   type: { type: "string" },
                   module: { type: "string" },
@@ -4092,8 +5914,7 @@ Returns: { pattern, filter, files_searched, total_matches, matches: [{file, line
           properties: {
             layer: {
               type: "string",
-              enum: ["ui", "api", "db"],
-              description: "Graph layer to scope files (required)."
+              description: "Graph layer to scope files (required, e.g. 'ui', 'api', 'db')."
             },
             pattern: {
               type: "string",
@@ -4126,8 +5947,7 @@ Returns deep fields only \u2014 not structural metadata (use read_graph for that
           properties: {
             layer: {
               type: "string",
-              enum: ["ui", "api", "db"],
-              description: "Graph layer (required)."
+              description: "Graph layer (required, e.g. 'ui', 'api', 'db')."
             },
             node_id: {
               type: "string",
@@ -4187,7 +6007,7 @@ Use this when the user asks "is the chart running", "show me the project graph U
       },
       {
         name: "detect_project_stack",
-        description: "Detect project frameworks, available parsers, and recommend parser configuration. Scans the project to identify the tech stack (Next.js, Prisma, React, etc.), reports which built-in parsers are applicable, and provides cross-layer detection stats (fetch calls, @api annotations, URL literals). Returns a recommended primary parser and current .launchchart.json config if present. \n\nUse this when setting up launch-chart for a new project or reviewing parser configuration.",
+        description: "Detect project languages, frameworks, available parsers, and recommend parser configuration. Scans the project to identify all languages present (TypeScript, Python, Go, etc.) and reports which are supported by registered parsers vs detected-but-unsupported. Also detects frameworks (Next.js, Prisma, React, etc.), provides cross-layer detection stats (fetch calls, @api annotations, URL literals), and returns available graph layers. \n\nUse this when setting up launch-chart for a new project, reviewing parser configuration, or checking what languages are in the project.",
         inputSchema: {
           type: "object",
           properties: {}
@@ -4232,6 +6052,24 @@ Use this when the user asks "is the chart running", "show me the project graph U
           },
           required: ["node_id", "key"]
         }
+      },
+      {
+        name: "audit_layer",
+        description: "Run audit checks on a graph layer. Surfaces schema drift, unprotected routes, hardcoded values, dead screens, and other discrepancies. Returns findings with severity and file locations.\n\nAvailable layers and checks:\n- db: schema_drift (Prisma vs SQL migration mismatches), orphan_fks (FKs without @relation)\n- api: unprotected_routes (endpoints missing from ROUTE_PERMISSIONS)\n- ui: dead_screens (pages with no incoming navigation)\n- static: unenforced_permissions (seed permissions with no route enforcement), hardcoded_values (ALL_CAPS strings not in inventory)\n- all: run every check across all layers",
+        inputSchema: {
+          type: "object",
+          properties: {
+            layer: {
+              type: "string",
+              description: "Layer to audit: 'db', 'api', 'ui', 'static', or 'all'."
+            },
+            check: {
+              type: "string",
+              description: "Specific check to run (e.g. 'schema_drift', 'unprotected_routes'). Omit to run all checks for the layer."
+            }
+          },
+          required: ["layer"]
+        }
       }
     ];
     COMPACT_SCHEMA = {
@@ -4288,6 +6126,9 @@ Use this when the user asks "is the chart running", "show me the project graph U
       api: 65,
       db: 65
     };
+    DEFAULT_EST_NODE_FULL = 300;
+    DEFAULT_EST_NODE_MIN = 150;
+    DEFAULT_EST_EDGE = 65;
     NEIGHBORHOOD_BUDGET_CHARS = 55e3;
     BATCH_BUDGET_CHARS = 6e4;
   }
@@ -4295,10 +6136,10 @@ Use this when the user asks "is the chart running", "show me the project graph U
 
 // src/server/graph-mcp-entry.ts
 var import_node_child_process3 = require("node:child_process");
-var import_node_fs15 = require("node:fs");
-var import_node_path17 = __toESM(require("node:path"));
+var import_node_fs20 = require("node:fs");
+var import_node_path22 = __toESM(require("node:path"));
 var import_node_os3 = require("node:os");
-var import_node_fs16 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 init_lockfile();
 function logStderr(msg) {
   process.stderr.write(`[launch-chart] ${msg}
@@ -4314,11 +6155,11 @@ function maybeAutoServe() {
     return;
   }
   try {
-    const logDir = import_node_path17.default.join((0, import_node_os3.homedir)(), ".launchsecure");
-    (0, import_node_fs16.mkdirSync)(logDir, { recursive: true });
-    const logPath = import_node_path17.default.join(logDir, "launch-chart.log");
-    const out = (0, import_node_fs15.openSync)(logPath, "a");
-    const err2 = (0, import_node_fs15.openSync)(logPath, "a");
+    const logDir = import_node_path22.default.join((0, import_node_os3.homedir)(), ".launchsecure");
+    (0, import_node_fs21.mkdirSync)(logDir, { recursive: true });
+    const logPath = import_node_path22.default.join(logDir, "launch-chart.log");
+    const out = (0, import_node_fs20.openSync)(logPath, "a");
+    const err2 = (0, import_node_fs20.openSync)(logPath, "a");
     const entryPath = process.argv[1];
     const child = (0, import_node_child_process3.spawn)(process.execPath, [entryPath, "serve"], {
       detached: true,