@launchsecure/launch-kit 0.0.14 → 0.0.16

package/dist/server/graph-mcp-entry.js

@@ -156,19 +156,26 @@ var init_config = __esm({
 });
 
 // src/server/graph/core/resolve-paths.ts
+function detectDbDir(rootDir, config) {
+  if (config.paths?.dbDir) return (0, import_node_path3.join)(rootDir, config.paths.dbDir);
+  const prismaDir = (0, import_node_path3.join)(rootDir, "prisma");
+  if ((0, import_node_fs3.existsSync)(prismaDir)) return prismaDir;
+  return null;
+}
 function resolveProjectPaths(rootDir, config) {
+  const dbDir = detectDbDir(rootDir, config);
   if (config.paths?.appDir) {
     const appDir = (0, import_node_path3.join)(rootDir, config.paths.appDir);
     const srcDir = config.paths.srcDir ? (0, import_node_path3.join)(rootDir, config.paths.srcDir) : (0, import_node_path3.dirname)(appDir);
-    return { srcDir, appDir, apiDir: (0, import_node_path3.join)(appDir, "api") };
+    return { srcDir, appDir, apiDir: (0, import_node_path3.join)(appDir, "api"), dbDir };
   }
   const srcApp = (0, import_node_path3.join)(rootDir, "src", "app");
   if ((0, import_node_fs3.existsSync)(srcApp)) {
-    return { srcDir: (0, import_node_path3.join)(rootDir, "src"), appDir: srcApp, apiDir: (0, import_node_path3.join)(srcApp, "api") };
+    return { srcDir: (0, import_node_path3.join)(rootDir, "src"), appDir: srcApp, apiDir: (0, import_node_path3.join)(srcApp, "api"), dbDir };
   }
   const rootApp = (0, import_node_path3.join)(rootDir, "app");
   if ((0, import_node_fs3.existsSync)(rootApp)) {
-    return { srcDir: rootDir, appDir: rootApp, apiDir: (0, import_node_path3.join)(rootApp, "api") };
+    return { srcDir: rootDir, appDir: rootApp, apiDir: (0, import_node_path3.join)(rootApp, "api"), dbDir };
   }
   return null;
 }
@@ -2111,6 +2118,7 @@ var init_fetch_resolver = __esm({
     fetchResolverParser = {
       id: "fetch-resolver",
       layer: "crosslayer",
+      concern: "api-binding",
       detect(_rootDir) {
         return true;
       },
@@ -2231,6 +2239,7 @@ var init_api_annotations = __esm({
     apiAnnotationsParser = {
       id: "api-annotations",
       layer: "crosslayer",
+      concern: "api-binding",
       detect(rootDir) {
         return (0, import_node_fs8.existsSync)((0, import_node_path8.join)(rootDir, "src"));
       },
@@ -2325,6 +2334,7 @@ var init_url_literal_scanner = __esm({
     urlLiteralScannerParser = {
       id: "url-literal-scanner",
       layer: "crosslayer",
+      concern: "api-binding",
       detect(rootDir) {
         const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
         return paths !== null;
@@ -2949,6 +2959,7 @@ var init_static_ref_scanner = __esm({
     staticRefScannerParser = {
       id: "static-ref-scanner",
       layer: "crosslayer",
+      concern: "static-ref",
       detect(rootDir) {
         const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
         return paths !== null;
@@ -3083,6 +3094,9 @@ function loadCustomParsers(registry, config, rootDir, disabled) {
 `
         );
       }
+      if (parser.layer === "crosslayer" && entry.concern && !("concern" in parser && parser.concern)) {
+        parser.concern = entry.concern;
+      }
       registry.register(parser);
     } catch (err2) {
       process.stderr.write(`[launch-chart] failed to load custom parser from ${entry.path}: ${err2}
@@ -3247,44 +3261,21 @@ function dedupCrossRefs(refs) {
   }
   return result;
 }
-function applyCrossLayerResults(uiOutput, results, primaryId) {
-  const allCrossRefs = [...uiOutput.cross_refs];
-  const allFlagged = [...uiOutput.flagged_edges];
-  const allWarnings = [...uiOutput.warnings];
-  const primaryResult = results.find((r) => r.parserId === primaryId);
-  const secondaryResults = results.filter((r) => r.parserId !== primaryId);
-  if (primaryResult) {
-    allCrossRefs.push(...primaryResult.output.cross_refs);
-    allFlagged.push(...primaryResult.output.flagged_edges);
-    allWarnings.push(...primaryResult.output.warnings);
-  }
-  const primarySet = new Set(
-    (primaryResult?.output.cross_refs ?? []).map((r) => `${r.source}|${r.target}|${r.type}`)
-  );
-  for (const sec of secondaryResults) {
-    for (const ref of sec.output.cross_refs) {
-      const key = `${ref.source}|${ref.target}|${ref.type}`;
-      if (primarySet.has(key)) {
-        allCrossRefs.push(ref);
-      } else {
-        allFlagged.push({
-          source: ref.source,
-          target: ref.target,
-          type: "out_of_pattern",
-          label: `API call detected by ${sec.parserId} but not by primary (${primaryId})`,
-          confidence: "medium"
-        });
-        allCrossRefs.push(ref);
-      }
-    }
-    allFlagged.push(...sec.output.flagged_edges);
-    allWarnings.push(...sec.output.warnings);
-  }
+function applyCrossLayerResults(uiOutput, results) {
   return {
     ...uiOutput,
-    cross_refs: dedupCrossRefs(allCrossRefs),
-    flagged_edges: allFlagged,
-    warnings: allWarnings
+    cross_refs: dedupCrossRefs([
+      ...uiOutput.cross_refs,
+      ...results.flatMap((r) => r.output.cross_refs)
+    ]),
+    flagged_edges: [
+      ...uiOutput.flagged_edges,
+      ...results.flatMap((r) => r.output.flagged_edges)
+    ],
+    warnings: [
+      ...uiOutput.warnings,
+      ...results.flatMap((r) => r.output.warnings)
+    ]
   };
 }
 var init_merge = __esm({
@@ -3328,10 +3319,9 @@ function generateLayer(rootDir, layer) {
       if (existing) layerOutputs.set(otherLayer, existing);
     }
     const crossParsers = registry.getCrossLayerParsers();
-    const primaryId = config.parsers?.primary?.crosslayer ?? crossParsers[0]?.id ?? null;
     const crossResults = crossParsers.filter((p) => p.detect(rootDir)).map((p) => ({ parserId: p.id, output: p.generate(rootDir, layerOutputs) }));
     if (crossResults.length > 0) {
-      merged = applyCrossLayerResults(merged, crossResults, primaryId);
+      merged = applyCrossLayerResults(merged, crossResults);
     }
   }
   return {
@@ -3378,11 +3368,10 @@ function generateAll(rootDir) {
     });
   }
   const crossParsers = registry.getCrossLayerParsers();
-  const primaryId = config.parsers?.primary?.crosslayer ?? crossParsers[0]?.id ?? null;
   const crossResults = crossParsers.filter((p) => p.detect(rootDir)).map((p) => ({ parserId: p.id, output: p.generate(rootDir, layerOutputs) }));
   if (crossResults.length > 0 && layerOutputs.has("ui")) {
     const uiOutput = layerOutputs.get("ui");
-    const merged = applyCrossLayerResults(uiOutput, crossResults, primaryId);
+    const merged = applyCrossLayerResults(uiOutput, crossResults);
     layerOutputs.set("ui", merged);
     const uiResult = results.find((r) => r.layer === "ui");
     if (uiResult) {
@@ -4496,17 +4485,23 @@ async function startChartServer(opts = {}) {
       if (req.method === "GET" && url2.pathname === "/api/parser-config") {
         const config2 = loadConfig(reqRoot);
         const registry = createRegistry(config2, reqRoot);
+        const toLabel = (id) => id.split("-").map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
         const detection = [];
         for (const parser of registry.getAll()) {
           if ("layers" in parser && Array.isArray(parser.layers)) {
             const mp = parser;
-            detection.push({ id: mp.id, layers: mp.layers, detected: mp.detect(reqRoot) });
+            detection.push({ id: mp.id, layers: mp.layers, label: toLabel(mp.id), detected: mp.detect(reqRoot) });
           } else if ("layer" in parser && parser.layer !== "crosslayer") {
             const sp = parser;
-            detection.push({ id: sp.id, layers: [sp.layer], detected: sp.detect(reqRoot) });
+            detection.push({ id: sp.id, layers: [sp.layer], label: toLabel(sp.id), detected: sp.detect(reqRoot) });
           }
         }
-        const crosslayerParsers = registry.getCrossLayerParsers().map((p) => ({ id: p.id }));
+        const crosslayerParsers = {};
+        for (const p of registry.getCrossLayerParsers()) {
+          const concern = p.concern ?? "api-binding";
+          if (!crosslayerParsers[concern]) crosslayerParsers[concern] = [];
+          crosslayerParsers[concern].push({ id: p.id, label: toLabel(p.id) });
+        }
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ config: config2, detection, crosslayerParsers }));
         return;
@@ -4619,16 +4614,21 @@ async function startChartServer(opts = {}) {
       if (req.method === "GET" && url2.pathname === "/api/detected-paths") {
         const config2 = loadConfig(reqRoot);
         const paths = resolveProjectPaths(reqRoot, config2);
-        const isOverride = !!config2.paths?.appDir;
+        const overrides = {
+          appDir: !!config2.paths?.appDir,
+          dbDir: !!config2.paths?.dbDir
+        };
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({
           projectRoot: reqRoot,
           detected: paths ? {
             srcDir: import_node_path19.default.relative(reqRoot, paths.srcDir) || ".",
             appDir: import_node_path19.default.relative(reqRoot, paths.appDir),
-            apiDir: import_node_path19.default.relative(reqRoot, paths.apiDir)
+            apiDir: import_node_path19.default.relative(reqRoot, paths.apiDir),
+            dbDir: paths.dbDir ? import_node_path19.default.relative(reqRoot, paths.dbDir) : null
           } : null,
-          isOverride
+          overrides,
+          isOverride: overrides.appDir
         }));
         return;
       }
@@ -4774,13 +4774,221 @@ var init_chart_serve = __esm({
   }
 });
 
+// src/server/blast-radius-builder.ts
+function loadDefaults(rootDir) {
+  const filePath = (0, import_node_path20.join)(rootDir, ".launchsecure", "blast-radius-defaults.json");
+  try {
+    if (import_node_fs18.default.existsSync(filePath)) {
+      const raw = import_node_fs18.default.readFileSync(filePath, "utf-8");
+      return JSON.parse(raw);
+    }
+  } catch {
+  }
+  return FALLBACK_DEFAULTS;
+}
+function generateAcceptance(node, inspect) {
+  const criteria = [];
+  const t = node.type?.toLowerCase() ?? "";
+  if (t === "endpoint" || t === "mcp-tool") {
+    const methods = inspect?.methods ?? [];
+    const path3 = inspect?.path ?? node.id;
+    if (methods.length > 0) {
+      criteria.push(`${methods.join("/")} ${path3} still returns correct responses for authorized users`);
+    } else {
+      criteria.push(`${path3} still responds correctly`);
+    }
+    if (inspect?.auth && inspect.auth.includes("withAuth")) {
+      criteria.push("Authentication and authorization still enforced");
+    }
+    if (inspect?.db_models && inspect.db_models.length > 0) {
+      criteria.push(`DB operations on ${inspect.db_models.join(", ")} still work correctly`);
+    }
+  } else if (t === "page" || t === "component" || t === "layout") {
+    criteria.push(`${node.name} renders without errors`);
+    if (inspect?.stateVars && inspect.stateVars.length > 0) {
+      criteria.push("State management still works correctly");
+    }
+    if (inspect?.elements && inspect.elements.length > 5) {
+      criteria.push("All child components render correctly");
+    }
+  } else if (t === "table" || t === "enum") {
+    criteria.push(`${node.name} schema unchanged or migration applies cleanly`);
+    criteria.push("Existing queries against this table still work");
+  } else if (t === "hook") {
+    criteria.push(`${node.name} returns expected shape`);
+    if (inspect?.stateVars && inspect.stateVars.length > 0) {
+      criteria.push(`State variables [${inspect.stateVars.map((s) => s.name).join(", ")}] still returned`);
+    }
+  } else if (t === "context") {
+    criteria.push(`${node.name} provides correct context to consumers`);
+  } else if (t === "lib" || t === "config" || t === "types") {
+    criteria.push(`${node.name} exports still conform to expected interface`);
+  } else if (t === "seed" || t === "seed_role" || t === "seed_permission") {
+    criteria.push("Seed runs without errors");
+    criteria.push("Expected rows created in database");
+  } else {
+    criteria.push("Verify no regression");
+  }
+  return criteria;
+}
+function buildManifest(input) {
+  const { mode, title, description, subtitle, blastResults, createNodes, inspectData, defaults } = input;
+  const nodeMap = /* @__PURE__ */ new Map();
+  const centerNodeIds = /* @__PURE__ */ new Set();
+  for (const result of blastResults) {
+    centerNodeIds.add(result.center.id);
+    for (const node of result.affected) {
+      const existing = nodeMap.get(node.id);
+      if (!existing || node.hop < existing.hop) {
+        nodeMap.set(node.id, node);
+      }
+    }
+  }
+  for (const id of centerNodeIds) {
+    nodeMap.delete(id);
+  }
+  const manifestNodes = [];
+  for (const result of blastResults) {
+    const c = result.center;
+    if (manifestNodes.some((n) => n.id === c.id)) continue;
+    const inspect = inspectData[c.id];
+    manifestNodes.push({
+      id: c.id,
+      name: c.name,
+      layer: c.layer,
+      ring: "modify",
+      type: c.type,
+      reason: `Direct change target`,
+      acceptance: generateAcceptance(
+        { id: c.id, name: c.name, type: c.type, layer: c.layer, hop: 0 },
+        inspect
+      )
+    });
+  }
+  for (const [, node] of nodeMap) {
+    const ring = node.hop <= 1 ? "modify" : "ripple";
+    const inspect = inspectData[node.id];
+    const reason = node.hop <= 1 ? `Directly depends on changed node` : `Indirect dependency (${node.hop} hops away)`;
+    manifestNodes.push({
+      id: node.id,
+      name: node.name,
+      layer: node.layer,
+      ring,
+      type: node.type,
+      reason,
+      acceptance: generateAcceptance(node, inspect)
+    });
+  }
+  for (const cn of createNodes) {
+    manifestNodes.push({
+      id: cn.id,
+      name: cn.name,
+      layer: cn.layer,
+      ring: "create",
+      type: cn.type ?? "unknown",
+      reason: cn.reason,
+      acceptance: cn.acceptance ?? ["Verify implementation matches spec"]
+    });
+  }
+  const layerIds = /* @__PURE__ */ new Set();
+  for (const n of manifestNodes) {
+    layerIds.add(n.layer);
+  }
+  const layers = [];
+  for (const id of layerIds) {
+    const def = defaults.layers[id];
+    if (def) {
+      layers.push({ id, name: def.name, icon: def.icon, color: def.color });
+    } else {
+      layers.push({ id, name: id, icon: "box", color: "#cbd5e1" });
+    }
+  }
+  const edgeSet = /* @__PURE__ */ new Set();
+  const edges = [];
+  const allNodeIds = new Set(manifestNodes.map((n) => n.id));
+  for (const cId of centerNodeIds) {
+    for (const result of blastResults) {
+      for (const affected of result.affected) {
+        if (affected.hop === 1 && result.center.id === cId && allNodeIds.has(affected.id)) {
+          const key = `${cId}->${affected.id}`;
+          if (!edgeSet.has(key)) {
+            edgeSet.add(key);
+            edges.push({ source: cId, target: affected.id });
+          }
+        }
+      }
+    }
+  }
+  for (const result of blastResults) {
+    if (result.edges) {
+      for (const edge of result.edges) {
+        if (allNodeIds.has(edge.source) && allNodeIds.has(edge.target)) {
+          const key = `${edge.source}->${edge.target}`;
+          if (!edgeSet.has(key)) {
+            edgeSet.add(key);
+            edges.push({ source: edge.source, target: edge.target });
+          }
+        }
+      }
+    }
+  }
+  for (const cn of createNodes) {
+    edges.push({ source: "center", target: cn.id });
+    if (cn.connects_to) {
+      for (const targetId of cn.connects_to) {
+        if (allNodeIds.has(targetId) || createNodes.some((c) => c.id === targetId)) {
+          const key = `${cn.id}->${targetId}`;
+          if (!edgeSet.has(key)) {
+            edgeSet.add(key);
+            edges.push({ source: cn.id, target: targetId });
+          }
+        }
+      }
+    }
+  }
+  return {
+    mode,
+    title,
+    subtitle,
+    layers,
+    rings: defaults.rings,
+    center: { name: title, description },
+    nodes: manifestNodes,
+    edges
+  };
+}
+var import_node_fs18, import_node_path20, FALLBACK_DEFAULTS;
+var init_blast_radius_builder = __esm({
+  "src/server/blast-radius-builder.ts"() {
+    "use strict";
+    import_node_fs18 = __toESM(require("node:fs"));
+    import_node_path20 = require("node:path");
+    FALLBACK_DEFAULTS = {
+      rings: [
+        { id: "modify", name: "Modify", color: "#ff6b00" },
+        { id: "ripple", name: "Ripple (verify)", color: "#ffff00" },
+        { id: "create", name: "Create", color: "#00ff00" }
+      ],
+      layers: {
+        db: { name: "Database", icon: "database", color: "#cbd5e1" },
+        api: { name: "API", icon: "server", color: "#cbd5e1" },
+        middleware: { name: "Middleware", icon: "shield", color: "#cbd5e1" },
+        ui: { name: "UI", icon: "layout-dashboard", color: "#cbd5e1" },
+        config: { name: "Config / Seed", icon: "settings", color: "#cbd5e1" },
+        shared: { name: "Shared Types", icon: "box", color: "#cbd5e1" }
+      },
+      center: { color: "#ff0000" }
+    };
+  }
+});
+
 // src/server/graph/core/language-detection.ts
 function walkForExtensions(dir, extCounts, depth = 0) {
   if (depth > 10) return;
-  if (!(0, import_node_fs18.existsSync)(dir)) return;
+  if (!(0, import_node_fs19.existsSync)(dir)) return;
   let entries;
   try {
-    entries = (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true });
+    entries = (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -4788,9 +4996,9 @@ function walkForExtensions(dir, extCounts, depth = 0) {
     if (entry.name.startsWith(".") && entry.isDirectory()) continue;
     if (entry.isDirectory()) {
       if (IGNORE_DIRS.has(entry.name)) continue;
-      walkForExtensions((0, import_node_path20.join)(dir, entry.name), extCounts, depth + 1);
+      walkForExtensions((0, import_node_path21.join)(dir, entry.name), extCounts, depth + 1);
     } else {
-      const ext = (0, import_node_path20.extname)(entry.name).toLowerCase();
+      const ext = (0, import_node_path21.extname)(entry.name).toLowerCase();
       if (ext && EXTENSION_TO_LANGUAGE[ext]) {
         extCounts.set(ext, (extCounts.get(ext) ?? 0) + 1);
       }
@@ -4829,12 +5037,12 @@ function detectLanguages(rootDir, supportedLanguages) {
   });
   return results;
 }
-var import_node_fs18, import_node_path20, EXTENSION_TO_LANGUAGE, IGNORE_DIRS, AUXILIARY_LANGUAGES;
+var import_node_fs19, import_node_path21, EXTENSION_TO_LANGUAGE, IGNORE_DIRS, AUXILIARY_LANGUAGES;
 var init_language_detection = __esm({
   "src/server/graph/core/language-detection.ts"() {
     "use strict";
-    import_node_fs18 = require("node:fs");
-    import_node_path20 = require("node:path");
+    import_node_fs19 = require("node:fs");
+    import_node_path21 = require("node:path");
     EXTENSION_TO_LANGUAGE = {
       // Web / Frontend
       ".ts": "typescript",
@@ -5048,6 +5256,263 @@ function neighborhood(graph, centerId, hops, layer, minimal) {
   const edges = graph.edges.filter((e) => visited.has(e.source) && visited.has(e.target));
   return { nodes, edges, budgetExceeded, stoppedAtHop };
 }
+function reverseNeighborhood(graph, centerId, hops, direction) {
+  const center = graph.nodes.find((n) => n.id === centerId);
+  if (!center) return { nodes: /* @__PURE__ */ new Map(), edges: [] };
+  const visited = /* @__PURE__ */ new Map();
+  visited.set(centerId, { node: center, hop: 0 });
+  let frontier = /* @__PURE__ */ new Set([centerId]);
+  for (let h = 0; h < hops; h++) {
+    const next = /* @__PURE__ */ new Set();
+    for (const edge of graph.edges) {
+      if (direction === "reverse") {
+        if (frontier.has(edge.target) && !visited.has(edge.source)) next.add(edge.source);
+      } else {
+        if (frontier.has(edge.source) && !visited.has(edge.target)) next.add(edge.target);
+        if (frontier.has(edge.target) && !visited.has(edge.source)) next.add(edge.source);
+      }
+    }
+    for (const id of next) {
+      const node = graph.nodes.find((n) => n.id === id);
+      if (node) visited.set(id, { node, hop: h + 1 });
+    }
+    frontier = next;
+    if (frontier.size === 0) break;
+  }
+  const nodeIds = new Set(visited.keys());
+  const edges = graph.edges.filter((e) => nodeIds.has(e.source) && nodeIds.has(e.target));
+  return { nodes: visited, edges };
+}
+function handleBlastPoints(args) {
+  const rootDir = process.cwd();
+  const nodeId = args.node_id;
+  const requestedLayer = args.layer;
+  const hops = args.hops ?? 2;
+  const direction = args.direction ?? "reverse";
+  let targetLayer = requestedLayer;
+  if (!targetLayer) {
+    const graphs = readAllGraphs(rootDir);
+    for (const [layer, graph2] of Object.entries(graphs)) {
+      if (graph2 && graph2.nodes.some((n) => n.id === nodeId)) {
+        targetLayer = layer;
+        break;
+      }
+    }
+    if (!targetLayer) {
+      return err(`Node "${nodeId}" not found in any layer. Available layers: ${getAvailableLayers(rootDir).join(", ")}`);
+    }
+  }
+  const graph = readGraph(rootDir, targetLayer);
+  if (!graph) {
+    return err(`No graph for layer "${targetLayer}". Run generate_graph first.`);
+  }
+  const center = graph.nodes.find((n) => n.id === nodeId);
+  if (!center) {
+    return err(`Node "${nodeId}" not found in ${targetLayer} layer.`);
+  }
+  const result = reverseNeighborhood(graph, nodeId, hops, direction);
+  const affected = [];
+  for (const [id, { node, hop }] of result.nodes) {
+    if (id === nodeId) continue;
+    const tags = node.tags;
+    affected.push({
+      id: node.id,
+      name: node.name,
+      type: node.type,
+      layer: targetLayer,
+      hop,
+      module: tags?.module
+    });
+  }
+  const otherLayers = getAvailableLayers(rootDir).filter((l) => l !== targetLayer && l !== "static");
+  for (const otherLayer of otherLayers) {
+    const otherGraph = readGraph(rootDir, otherLayer);
+    if (!otherGraph) continue;
+    for (const edge of otherGraph.edges) {
+      if (edge.target === nodeId || edge.source === nodeId) {
+        const dependentId = edge.target === nodeId ? edge.source : edge.target;
+        if (affected.some((a) => a.id === dependentId)) continue;
+        const depNode = otherGraph.nodes.find((n) => n.id === dependentId);
+        if (depNode) {
+          const tags = depNode.tags;
+          affected.push({
+            id: depNode.id,
+            name: depNode.name,
+            type: depNode.type,
+            layer: otherLayer,
+            hop: 1,
+            module: tags?.module
+          });
+        }
+      }
+    }
+  }
+  const byLayer = {};
+  const byHop = {};
+  const modulesSet = /* @__PURE__ */ new Set();
+  for (const a of affected) {
+    byLayer[a.layer] = (byLayer[a.layer] ?? 0) + 1;
+    byHop[String(a.hop)] = (byHop[String(a.hop)] ?? 0) + 1;
+    if (a.module) modulesSet.add(a.module);
+  }
+  const crossesLayers = Object.keys(byLayer).length > 1;
+  const centerTags = center.tags;
+  return okJson({
+    center: {
+      id: center.id,
+      name: center.name,
+      type: center.type,
+      layer: targetLayer,
+      module: centerTags?.module
+    },
+    affected,
+    summary: {
+      total: affected.length,
+      by_layer: byLayer,
+      by_hop: byHop,
+      modules_touched: Array.from(modulesSet).sort(),
+      crosses_layers: crossesLayers
+    }
+  });
+}
+function handleGenerateBlastRadius(args) {
+  const rootDir = process.cwd();
+  const mode = args.mode ?? "structural";
+  const title = args.title;
+  const description = args.description ?? title;
+  const subtitle = args.subtitle;
+  const hops = args.hops ?? 2;
+  const defaults = loadDefaults(rootDir);
+  let centerNodeIds = [];
+  if (mode === "structural") {
+    const nodeId = args.node_id;
+    if (!nodeId) return err("structural mode requires node_id");
+    centerNodeIds = [nodeId];
+  } else {
+    centerNodeIds = args.center_nodes ?? [];
+    if (centerNodeIds.length === 0) return err("feature mode requires center_nodes[]");
+  }
+  const createNodes = args.create_nodes ?? [];
+  const blastResults = [];
+  for (const nodeId of centerNodeIds) {
+    let targetLayer;
+    const graphs = readAllGraphs(rootDir);
+    for (const [layer, graph2] of Object.entries(graphs)) {
+      if (graph2 && graph2.nodes.some((n) => n.id === nodeId)) {
+        targetLayer = layer;
+        break;
+      }
+    }
+    if (!targetLayer) continue;
+    const graph = readGraph(rootDir, targetLayer);
+    if (!graph) continue;
+    const center = graph.nodes.find((n) => n.id === nodeId);
+    if (!center) continue;
+    const result2 = reverseNeighborhood(graph, nodeId, hops, "reverse");
+    const affected = [];
+    for (const [id, { node, hop }] of result2.nodes) {
+      if (id === nodeId) continue;
+      const tags = node.tags;
+      affected.push({ id: node.id, name: node.name, type: node.type, layer: targetLayer, hop, module: tags?.module });
+    }
+    const otherLayers = getAvailableLayers(rootDir).filter((l) => l !== targetLayer && l !== "static");
+    for (const otherLayer of otherLayers) {
+      const otherGraph = readGraph(rootDir, otherLayer);
+      if (!otherGraph) continue;
+      for (const edge of otherGraph.edges) {
+        if (edge.target === nodeId || edge.source === nodeId) {
+          const dependentId = edge.target === nodeId ? edge.source : edge.target;
+          if (affected.some((a) => a.id === dependentId)) continue;
+          const depNode = otherGraph.nodes.find((n) => n.id === dependentId);
+          if (depNode) {
+            const tags = depNode.tags;
+            affected.push({ id: depNode.id, name: depNode.name, type: depNode.type, layer: otherLayer, hop: 1, module: tags?.module });
+          }
+        }
+      }
+    }
+    const centerTags = center.tags;
+    const edges = result2.edges.map((e) => ({ source: e.source, target: e.target }));
+    blastResults.push({
+      center: { id: center.id, name: center.name, type: center.type, layer: targetLayer, module: centerTags?.module },
+      affected,
+      edges
+    });
+  }
+  if (blastResults.length === 0) {
+    return err(`None of the center nodes were found in any graph layer: ${centerNodeIds.join(", ")}`);
+  }
+  const inspectData = {};
+  const allAffectedIds = /* @__PURE__ */ new Set();
+  for (const r of blastResults) {
+    allAffectedIds.add(r.center.id);
+    for (const a of r.affected) allAffectedIds.add(a.id);
+  }
+  const allGraphs = readAllGraphs(rootDir);
+  for (const id of allAffectedIds) {
+    for (const [, graph] of Object.entries(allGraphs)) {
+      if (!graph) continue;
+      const node = graph.nodes.find((n) => n.id === id);
+      if (node) {
+        inspectData[id] = {
+          type: node.type,
+          name: node.name,
+          methods: node.methods,
+          path: node.path ?? node.handler,
+          auth: node.auth,
+          db_models: node.db_models
+        };
+        break;
+      }
+    }
+  }
+  const manifest = buildManifest({
+    mode,
+    title,
+    description,
+    subtitle,
+    blastResults,
+    createNodes,
+    inspectData,
+    defaults
+  });
+  const pushToDeck = args.push_to_deck;
+  const session = args.session;
+  let deckResult;
+  if (pushToDeck) {
+    if (!session) return err("push_to_deck requires a session name");
+    const deckLockPath = (0, import_node_path22.join)(rootDir, ".launchsecure", "launch-deck.lock");
+    if (!(0, import_node_fs20.existsSync)(deckLockPath)) {
+      deckResult = { pushed: false, reason: "Deck server not running (no lock file). Push manually via deck tool." };
+    } else {
+      try {
+        const lock = JSON.parse((0, import_node_fs20.readFileSync)(deckLockPath, "utf-8"));
+        const deckUrl = lock.url;
+        const body = JSON.stringify({
+          session,
+          mode: "show",
+          blocks: [{ type: "blast-radius", label: title, manifest }]
+        });
+        (0, import_node_child_process2.execFileSync)("curl", [
+          "-s",
+          "-X",
+          "POST",
+          deckUrl + "/api/deck",
+          "-H",
+          "Content-Type: application/json",
+          "-d",
+          body
+        ], { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] });
+        deckResult = { pushed: true, session, url: deckUrl };
+      } catch (e) {
+        deckResult = { pushed: false, reason: `Failed to push to deck: ${e}` };
+      }
+    }
+  }
+  const result = { ...manifest };
+  if (deckResult) result._deck = deckResult;
+  return okJson(result);
+}
 function layerSummary(graph) {
   const typeCounts = {};
   const moduleCounts = {};
@@ -5276,12 +5741,12 @@ function handleReadGraph(args) {
   return okJson(result);
 }
 function nodeToFilePath(rootDir, layer, nodeId) {
-  if (layer === "ui" || layer === "api") return (0, import_node_path21.join)(rootDir, "src", nodeId);
-  if (layer === "db") return (0, import_node_path21.join)(rootDir, "prisma", "schema.prisma");
-  const withSrc = (0, import_node_path21.join)(rootDir, "src", nodeId);
-  if ((0, import_node_fs19.existsSync)(withSrc)) return withSrc;
-  const direct = (0, import_node_path21.join)(rootDir, nodeId);
-  if ((0, import_node_fs19.existsSync)(direct)) return direct;
+  if (layer === "ui" || layer === "api") return (0, import_node_path22.join)(rootDir, "src", nodeId);
+  if (layer === "db") return (0, import_node_path22.join)(rootDir, "prisma", "schema.prisma");
+  const withSrc = (0, import_node_path22.join)(rootDir, "src", nodeId);
+  if ((0, import_node_fs20.existsSync)(withSrc)) return withSrc;
+  const direct = (0, import_node_path22.join)(rootDir, nodeId);
+  if ((0, import_node_fs20.existsSync)(direct)) return direct;
   return null;
 }
 function handleInspectNode(args) {
@@ -5424,11 +5889,11 @@ function handleGrepNodes(args) {
   let filesSearched = 0;
   let truncated = false;
   for (const [filePath, nodeId] of filePaths) {
-    if (!(0, import_node_fs19.existsSync)(filePath)) continue;
+    if (!(0, import_node_fs20.existsSync)(filePath)) continue;
     filesSearched++;
     let content;
     try {
-      content = (0, import_node_fs19.readFileSync)(filePath, "utf-8");
+      content = (0, import_node_fs20.readFileSync)(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -5493,11 +5958,11 @@ function handleStartChartServer(args) {
     });
   }
   const entryPath = process.argv[1];
-  const logDir = (0, import_node_path21.join)((0, import_node_os2.homedir)(), ".launchsecure");
-  (0, import_node_fs19.mkdirSync)(logDir, { recursive: true });
-  const logPath = (0, import_node_path21.join)(logDir, "launch-chart.log");
-  const out = (0, import_node_fs19.openSync)(logPath, "a");
-  const err2 = (0, import_node_fs19.openSync)(logPath, "a");
+  const logDir = (0, import_node_path22.join)((0, import_node_os2.homedir)(), ".launchsecure");
+  (0, import_node_fs20.mkdirSync)(logDir, { recursive: true });
+  const logPath = (0, import_node_path22.join)(logDir, "launch-chart.log");
+  const out = (0, import_node_fs20.openSync)(logPath, "a");
+  const err2 = (0, import_node_fs20.openSync)(logPath, "a");
   const portArgs = args.port ? ["--port", String(args.port)] : [];
   const child = (0, import_node_child_process2.spawn)(process.execPath, [entryPath, "serve", ...portArgs], {
     detached: true,
@@ -5609,31 +6074,28 @@ function handleDetectProjectStack() {
       for (const l of p.layers) availableLayers.add(l);
     }
   }
-  let stats = { calls_api: 0, references_api: 0, out_of_pattern: 0, annotations: 0 };
+  const stats = { calls_api: 0, references_api: 0, annotations: 0 };
   const uiGraph = readGraph(rootDir, "ui");
   if (uiGraph) {
     for (const ref of uiGraph.cross_refs ?? []) {
       if (ref.type === "calls_api") stats.calls_api++;
       if (ref.type === "references_api") stats.references_api++;
     }
-    for (const f of uiGraph.flagged_edges ?? []) {
-      if (f.type === "out_of_pattern") stats.out_of_pattern++;
-    }
   }
-  const srcDir = (0, import_node_path21.join)(rootDir, "src");
-  if ((0, import_node_fs19.existsSync)(srcDir)) {
+  const srcDir = (0, import_node_path22.join)(rootDir, "src");
+  if ((0, import_node_fs20.existsSync)(srcDir)) {
     const scanDir = (dir) => {
-      if (!(0, import_node_fs19.existsSync)(dir)) return;
-      for (const entry of (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true })) {
+      if (!(0, import_node_fs20.existsSync)(dir)) return;
+      for (const entry of (0, import_node_fs20.readdirSync)(dir, { withFileTypes: true })) {
         if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-        const full = (0, import_node_path21.join)(dir, entry.name);
+        const full = (0, import_node_path22.join)(dir, entry.name);
         if (entry.isDirectory()) {
           scanDir(full);
           continue;
         }
-        if (![".ts", ".tsx"].includes((0, import_node_path21.extname)(entry.name))) continue;
+        if (![".ts", ".tsx"].includes((0, import_node_path22.extname)(entry.name))) continue;
         try {
-          const content = (0, import_node_fs19.readFileSync)(full, "utf-8");
+          const content = (0, import_node_fs20.readFileSync)(full, "utf-8");
           const matches = content.match(/@api\s+(GET|POST|PUT|DELETE|PATCH)\s+\/\S+/g);
           if (matches) stats.annotations += matches.length;
         } catch {
@@ -5642,12 +6104,6 @@ function handleDetectProjectStack() {
     };
     scanDir(srcDir);
   }
-  let recommendedPrimary = "fetch-resolver";
-  if (stats.annotations > 0 && stats.annotations >= stats.calls_api) {
-    recommendedPrimary = "api-annotations";
-  } else if (stats.calls_api === 0 && stats.references_api > 0) {
-    recommendedPrimary = "url-literal-scanner";
-  }
   const supportedLanguages = /* @__PURE__ */ new Map();
   supportedLanguages.set("typescript", parserResults.filter((p) => p.detected && p.layers.some((l) => l === "ui" || l === "api")).map((p) => p.id));
   supportedLanguages.set("prisma", parserResults.filter((p) => p.detected && p.layers.includes("db")).map((p) => p.id));
@@ -5658,13 +6114,22 @@ function handleDetectProjectStack() {
     languages,
     parsers: parserResults,
     available_layers: [...availableLayers],
-    crosslayer_parsers: [
-      { id: "fetch-resolver", description: "Detects direct fetch()/api.get() calls with inline URLs" },
-      { id: "api-annotations", description: "Scans for @api METHOD /path annotations in JSDoc/comments" },
-      { id: "url-literal-scanner", description: "Finds /api/... string literals as fallback detection" }
-    ],
+    crosslayer_parsers: (() => {
+      const descriptions = {
+        "fetch-resolver": "Detects direct fetch()/api.get() calls with inline URLs",
+        "api-annotations": "Scans for @api METHOD /path annotations in JSDoc/comments",
+        "url-literal-scanner": "Finds /api/... string literals as fallback detection",
+        "static-ref-scanner": "Finds references to static values (enums, permissions, roles)"
+      };
+      const grouped = {};
+      for (const p of registry.getCrossLayerParsers()) {
+        const concern = p.concern ?? "api-binding";
+        if (!grouped[concern]) grouped[concern] = [];
+        grouped[concern].push({ id: p.id, description: descriptions[p.id] ?? p.id });
+      }
+      return grouped;
+    })(),
     stats,
-    recommended_primary: recommendedPrimary,
     ...unsupportedHint ? { unsupported_hint: unsupportedHint } : {},
     current_config: Object.keys(config).length > 0 ? config : null,
     config_path: ".launchchart.json"
@@ -5745,6 +6210,14 @@ async function handleMessage(msg) {
       respond(id ?? null, handleAuditLayer(args));
       return;
     }
+    if (toolName === "blast_points") {
+      respond(id ?? null, handleBlastPoints(args));
+      return;
+    }
+    if (toolName === "generate_blast_radius") {
+      respond(id ?? null, handleGenerateBlastRadius(args));
+      return;
+    }
     respondError(id ?? null, -32601, `Unknown tool: ${toolName}`);
     return;
   }
@@ -5780,15 +6253,16 @@ function startGraphMcpServer() {
   process.stderr.write(`[launchsecure-graph] MCP server started (cwd: ${process.cwd()})
 `);
 }
-var import_node_fs19, import_node_path21, import_node_child_process2, import_node_os2, SERVER_INFO, TOOLS, COMPACT_SCHEMA, COMPACT_NODE_KNOWN_KEYS, DEEP_FIELDS, EST_CHARS_PER_NODE_FULL, EST_CHARS_PER_NODE_MIN, EST_CHARS_PER_EDGE, DEFAULT_EST_NODE_FULL, DEFAULT_EST_NODE_MIN, DEFAULT_EST_EDGE, NEIGHBORHOOD_BUDGET_CHARS, BATCH_BUDGET_CHARS;
+var import_node_fs20, import_node_path22, import_node_child_process2, import_node_os2, SERVER_INFO, TOOLS, COMPACT_SCHEMA, COMPACT_NODE_KNOWN_KEYS, DEEP_FIELDS, EST_CHARS_PER_NODE_FULL, EST_CHARS_PER_NODE_MIN, EST_CHARS_PER_EDGE, DEFAULT_EST_NODE_FULL, DEFAULT_EST_NODE_MIN, DEFAULT_EST_EDGE, NEIGHBORHOOD_BUDGET_CHARS, BATCH_BUDGET_CHARS;
 var init_graph_mcp = __esm({
   "src/server/graph-mcp.ts"() {
     "use strict";
-    import_node_fs19 = require("node:fs");
-    import_node_path21 = require("node:path");
+    import_node_fs20 = require("node:fs");
+    import_node_path22 = require("node:path");
     import_node_child_process2 = require("node:child_process");
     import_node_os2 = require("node:os");
     init_graph();
+    init_blast_radius_builder();
     init_lockfile();
     init_config();
     init_parser_registry();
@@ -6070,6 +6544,116 @@ Use this when the user asks "is the chart running", "show me the project graph U
           },
           required: ["layer"]
         }
+      },
+      {
+        name: "blast_points",
+        description: `Calculate the blast radius for a node \u2014 what depends on it across all project layers. Returns reverse dependencies aggregated with hop distance and summary stats.
+
+USE THIS when assessing the impact of changing a file, table, or endpoint. Replaces multiple read_graph calls with a single query that:
+- Traverses REVERSE edges (who imports/depends on this node)
+- Searches across ALL layers if layer is omitted
+- Returns affected nodes with hop distance, type, layer, and module
+- Provides a summary with counts by layer, by hop, and risk assessment
+
+Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 returns all files that import middleware.ts, and all files that import THOSE files.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            node_id: {
+              type: "string",
+              description: "The node to analyze (file path, table name, etc.)"
+            },
+            layer: {
+              type: "string",
+              description: "Layer the node lives in (e.g. 'ui', 'api', 'db'). Omit to auto-detect by searching all layers."
+            },
+            hops: {
+              type: "number",
+              description: "Max hops to traverse outward. Default 2."
+            },
+            direction: {
+              type: "string",
+              enum: ["reverse", "both"],
+              description: "'reverse' (default) = only what depends on this node. 'both' = full neighborhood."
+            }
+          },
+          required: ["node_id"]
+        }
+      },
+      {
+        name: "generate_blast_radius",
+        description: `Generate a complete BlastRadiusManifest from graph data \u2014 ready to push to deck.
+
+Two modes:
+- **Structural**: single node changed \u2192 auto-discover what's affected via reverse BFS
+  Example: generate_blast_radius({ mode: "structural", node_id: "CommentChannel", title: "CommentChannel refactor" })
+- **Feature**: new feature \u2192 multiple starting nodes + new nodes to create
+  Example: generate_blast_radius({ mode: "feature", title: "Client Role", description: "...", center_nodes: ["CommentChannel", "ProjectMember"], create_nodes: [{ id: "ChannelMember", name: "ChannelMember table", layer: "db", reason: "..." }] })
+
+Output is a BlastRadiusManifest JSON that passes directly to the deck tool's blast-radius block.
+Reads ring/layer/center colors from .launchsecure/blast-radius-defaults.json.
+Auto-generates acceptance criteria per node using inspect_node AST data.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            mode: {
+              type: "string",
+              enum: ["structural", "feature"],
+              description: '"structural" = single node changed. "feature" = new feature with multiple nodes.'
+            },
+            title: {
+              type: "string",
+              description: "Title for the blast radius (shown in center node and header)."
+            },
+            description: {
+              type: "string",
+              description: "Description of the change or feature."
+            },
+            subtitle: {
+              type: "string",
+              description: "Optional subtitle shown above title in the viz."
+            },
+            node_id: {
+              type: "string",
+              description: "Structural mode only: the node being changed."
+            },
+            center_nodes: {
+              type: "array",
+              items: { type: "string" },
+              description: "Feature mode: existing graph node IDs that are the starting points for traversal."
+            },
+            create_nodes: {
+              type: "array",
+              items: {
+                type: "object",
+                properties: {
+                  id: { type: "string" },
+                  name: { type: "string" },
+                  layer: { type: "string" },
+                  type: { type: "string" },
+                  reason: { type: "string" },
+                  acceptance: { type: "array", items: { type: "string" } },
+                  connects_to: { type: "array", items: { type: "string" }, description: "IDs of existing nodes this new node has FK/relationship edges to." }
+                },
+                required: ["id", "name", "layer", "reason"]
+              },
+              description: "Feature mode: new nodes that need to be created (not in graph yet)."
+            },
+            hops: {
+              type: "number",
+              description: "Max hops for traversal. Default 2. Hop 1 = modify ring, hop 2+ = ripple ring."
+            },
+            push_to_deck: {
+              type: "boolean",
+              description: "If true, pushes the manifest directly to LaunchDeck browser (requires deck server running). Default false."
+            },
+            session: {
+              type: "string",
+              description: "Session name for the deck tab. Required when push_to_deck is true."
+            }
+          },
+          required: ["title"]
+        }
       }
     ];
     COMPACT_SCHEMA = {
@@ -6136,10 +6720,10 @@ Use this when the user asks "is the chart running", "show me the project graph U
 
 // src/server/graph-mcp-entry.ts
 var import_node_child_process3 = require("node:child_process");
-var import_node_fs20 = require("node:fs");
-var import_node_path22 = __toESM(require("node:path"));
-var import_node_os3 = require("node:os");
 var import_node_fs21 = require("node:fs");
+var import_node_path23 = __toESM(require("node:path"));
+var import_node_os3 = require("node:os");
+var import_node_fs22 = require("node:fs");
 init_lockfile();
 function logStderr(msg) {
   process.stderr.write(`[launch-chart] ${msg}
@@ -6155,11 +6739,11 @@ function maybeAutoServe() {
     return;
   }
   try {
-    const logDir = import_node_path22.default.join((0, import_node_os3.homedir)(), ".launchsecure");
-    (0, import_node_fs21.mkdirSync)(logDir, { recursive: true });
-    const logPath = import_node_path22.default.join(logDir, "launch-chart.log");
-    const out = (0, import_node_fs20.openSync)(logPath, "a");
-    const err2 = (0, import_node_fs20.openSync)(logPath, "a");
+    const logDir = import_node_path23.default.join((0, import_node_os3.homedir)(), ".launchsecure");
+    (0, import_node_fs22.mkdirSync)(logDir, { recursive: true });
+    const logPath = import_node_path23.default.join(logDir, "launch-chart.log");
+    const out = (0, import_node_fs21.openSync)(logPath, "a");
+    const err2 = (0, import_node_fs21.openSync)(logPath, "a");
     const entryPath = process.argv[1];
     const child = (0, import_node_child_process3.spawn)(process.execPath, [entryPath, "serve"], {
       detached: true,