@launchsecure/launch-kit 0.0.20 → 0.0.22

package/dist/server/graph-mcp-entry.js

@@ -631,6 +631,12 @@ function parseFileTS(absPath) {
     if (linkTemplate) {
       navigations.push({ kind: "link-href", target: linkTemplate, isTemplate: true });
     }
+    if (caps["nav.redirect.literal"]) {
+      navigations.push({ kind: "router-replace", target: caps["nav.redirect.literal"], isTemplate: false });
+    }
+    if (caps["nav.redirect.template"]) {
+      navigations.push({ kind: "router-replace", target: caps["nav.redirect.template"], isTemplate: true });
+    }
     if (caps["nav.window.literal"]) {
       navigations.push({ kind: "window-location", target: caps["nav.window.literal"], isTemplate: false });
     }
@@ -709,15 +715,25 @@ function extractDbCallsTS(absPath) {
   const seen = /* @__PURE__ */ new Set();
   for (const m of matches) {
     const caps = captureMap(m);
+    const sbTable = caps["sb.table"];
+    const sbMethod = caps["sb.method"];
+    if (sbTable && sbMethod) {
+      const key2 = `sql:${sbTable}.${sbMethod}`;
+      if (seen.has(key2)) continue;
+      seen.add(key2);
+      const isMutation = SUPABASE_MUTATION_METHODS_BUILTIN.has(sbMethod) || extraMutationMethods.includes(sbMethod);
+      calls.push({ model: sbTable, method: sbMethod, isMutation, kind: "sql" });
+      continue;
+    }
     const identifier = caps["db.identifier"];
     const model = caps["db.model"];
     const method = caps["db.method"];
     if (!identifier || !model || !method) continue;
     if (!dbIdentifiers.has(identifier)) continue;
-    const key = `${model}.${method}`;
+    const key = `orm:${model}.${method}`;
     if (seen.has(key)) continue;
     seen.add(key);
-    calls.push({ model, method, isMutation: getMutationMethods().has(method) });
+    calls.push({ model, method, isMutation: getMutationMethods().has(method), kind: "orm" });
   }
   return calls;
 }
@@ -731,6 +747,9 @@ function classifyFile(absPath) {
   const captures = classifyQuery.captures(root);
   const capNames = new Set(captures.map((c) => c.name));
   if (capNames.has("http_export") || capNames.has("http_export_fn")) return "endpoint";
+  if (capNames.has("use_server_directive") && fileName !== "page.tsx" && fileName !== "layout.tsx") {
+    return "server-action";
+  }
   if (fileName === "page.tsx" && capNames.has("has_jsx")) return "page";
   if (fileName === "layout.tsx" && capNames.has("has_jsx")) return "layout";
   if (capNames.has("has_create_context") || capNames.has("has_create_context_bare")) return "context";
@@ -751,6 +770,36 @@ function extractAuthWrappersTS(absPath) {
       wrappers.add(caps["wrapper.fn_name"]);
     }
   }
+  const inlineHelpers = /* @__PURE__ */ new Set();
+  for (const stmt of childrenOfType(root, "import_statement")) {
+    const sourceNode = childOfType(stmt, "string");
+    const frag = sourceNode ? childOfType(sourceNode, "string_fragment") : void 0;
+    if (!frag) continue;
+    const provider = INLINE_AUTH_IMPORTS.find((p) => p.module.test(frag.text));
+    if (!provider) continue;
+    const clause = childOfType(stmt, "import_clause");
+    if (!clause) continue;
+    const named = childOfType(clause, "named_imports");
+    if (!named) continue;
+    for (const specNode of childrenOfType(named, "import_specifier")) {
+      const ids = childrenOfType(specNode, "identifier");
+      const importedName = ids[0]?.text;
+      const localName = ids[ids.length - 1]?.text;
+      if (importedName && provider.helpers.includes(importedName) && localName) {
+        inlineHelpers.add(localName);
+      }
+    }
+  }
+  if (inlineHelpers.size > 0) {
+    const text = root.text;
+    for (const name of inlineHelpers) {
+      const re = new RegExp(`\\b${name}\\s*\\(`);
+      if (re.test(text)) {
+        wrappers.add("inline");
+        break;
+      }
+    }
+  }
   return wrappers;
 }
 function trunc(s, max = 120) {
@@ -909,7 +958,7 @@ function extractDeep(absPath) {
   }
   return { elements, stateVars, conditions, variables, responses, params };
 }
-var import_node_fs5, import_node_path5, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods;
+var import_node_fs5, import_node_path5, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
@@ -933,9 +982,21 @@ var init_ts_extractor = __esm({
       "delete",
       "deleteMany"
     ];
+    SUPABASE_MUTATION_METHODS_BUILTIN = /* @__PURE__ */ new Set([
+      "insert",
+      "update",
+      "delete",
+      "upsert"
+    ]);
     DB_IDENTIFIERS_FALLBACK = ["db", "prisma"];
     extraDbIdentifiers = [];
     extraMutationMethods = [];
+    INLINE_AUTH_IMPORTS = [
+      { module: /^@clerk\/nextjs(\/server)?$/, helpers: ["auth", "currentUser"] },
+      { module: /^next-auth(\/.+)?$/, helpers: ["auth", "getServerSession"] },
+      { module: /^@auth\//, helpers: ["auth"] },
+      { module: /^@supabase\/auth-helpers/, helpers: ["createServerClient"] }
+    ];
   }
 });
 
@@ -1027,6 +1088,8 @@ function extractRoute(id) {
   if (!id.endsWith("/page.tsx")) return null;
   let route = id.replace(/^app\//, "/").replace(/\/page\.tsx$/, "");
   route = route.replace(/\/\([^)]+\)/g, "");
+  route = route.replace(/\[\[\.\.\.([^\]]+)\]\]/g, "*$1?");
+  route = route.replace(/\[\.\.\.([^\]]+)\]/g, "*$1");
   route = route.replace(/\[([^\]]+)\]/g, ":$1");
   route = route.replace(/\/+/g, "/");
   if (!route.startsWith("/")) route = "/" + route;
@@ -1038,6 +1101,7 @@ function nameFromFilename(absPath) {
 function filePathToAppRoute(appDir, absPath) {
   let route = ("/" + (0, import_node_path6.relative)(appDir, absPath).replace(/\\/g, "/")).replace(/\/route\.tsx?$/, "");
   route = route.replace(/\/\([^)]+\)/g, "");
+  route = route.replace(/\[\[\.\.\.([^\]]+)\]\]/g, "*$1?");
   route = route.replace(/\[\.\.\.([^\]]+)\]/g, "*$1");
   route = route.replace(/\[([^\]]+)\]/g, ":$1");
   route = route.replace(/\/+/g, "/");
@@ -1086,25 +1150,52 @@ function resolveTemplateLiteralRoute(template, routeToNodeId) {
 function routeMatchScore(candidate, known) {
   const segsA = candidate.split("/");
   const segsB = known.split("/");
-  if (segsA.length !== segsB.length) return -1;
   let score = 0;
-  for (let i = 0; i < segsA.length; i++) {
-    const a = segsA[i], b = segsB[i];
+  let i = 0, j = 0;
+  while (i < segsA.length && j < segsB.length) {
+    const a = segsA[i], b = segsB[j];
+    if (b.startsWith("*") && b.endsWith("?")) {
+      score += 1;
+      return score;
+    }
+    if (b.startsWith("*")) {
+      const remaining = segsA.length - i;
+      if (remaining < 1) return -1;
+      score += 1 + remaining;
+      return score;
+    }
     if (a === b) {
       score += 3;
+      i++;
+      j++;
       continue;
     }
     if (a.startsWith(":") && b.startsWith(":")) {
       score += 2;
+      i++;
+      j++;
       continue;
     }
     if (a.startsWith(":") || b.startsWith(":")) {
-      score += 0;
+      i++;
+      j++;
       continue;
     }
     return -1;
   }
-  return score;
+  if (i === segsA.length) {
+    while (j < segsB.length) {
+      const b = segsB[j];
+      if (b.startsWith("*") && b.endsWith("?")) {
+        score += 1;
+        j++;
+        continue;
+      }
+      return -1;
+    }
+    return score;
+  }
+  return -1;
 }
 function templateToRoute(template) {
   return template.replace(/\$\{([^}]+)\}/g, (_, expr) => {
@@ -1139,7 +1230,7 @@ function extractEdges(srcDir, rootDir, absPath, sourceId, parsed, nodeIdSet, bar
     edges.push(edge);
   }
   function edgeTypeFor(isTypeOnlyImport, importedNames) {
-    if (isTypeOnlyImport) return "imports";
+    if (isTypeOnlyImport) return "imports_type";
     const anyRendered = importedNames.some((n) => parsed.jsxElements.has(n));
     if (anyRendered) return "renders";
     return "imports";
@@ -1170,7 +1261,8 @@ function extractEdges(srcDir, rootDir, absPath, sourceId, parsed, nodeIdSet, bar
         if (resolved) {
           const targetId = toNodeId(srcDir, rootDir, resolved);
           if (nodeIdSet.has(targetId) && !targetId.endsWith("/index.ts") && !targetId.endsWith("/index.tsx")) {
-            addEdge(targetId, edgeTypeFor(isTypeOnly, names));
+            const allType = isTypeOnly || names.length > 0 && names.every((n) => typeNames.has(n));
+            addEdge(targetId, edgeTypeFor(allType, names));
           }
         }
       }
@@ -1179,7 +1271,8 @@ function extractEdges(srcDir, rootDir, absPath, sourceId, parsed, nodeIdSet, bar
       if (resolved) {
         const targetId = toNodeId(srcDir, rootDir, resolved);
         if (nodeIdSet.has(targetId) && !targetId.endsWith("/index.ts") && !targetId.endsWith("/index.tsx")) {
-          addEdge(targetId, edgeTypeFor(isTypeOnly, names));
+          const allType = isTypeOnly || names.length > 0 && names.every((n) => typeNames.has(n));
+          addEdge(targetId, edgeTypeFor(allType, names));
         }
       }
     }
@@ -1264,26 +1357,34 @@ function generate(rootDir) {
     const layer = CLASSIFICATION_TO_LAYER[type] ?? "ui";
     nodeIdSet.add(id);
     if (layer === "api") {
-      const methods = [];
-      for (const exp of parsed.exports) {
-        if (HTTP_METHODS.has(exp)) methods.push(exp);
-      }
       const dbCalls = extractDbCallsTS(absPath);
       const authWrappers = extractAuthWrappersTS(absPath);
       const deep = extractDeep(absPath);
-      const routePath = filePathToAppRoute(paths.appDir, absPath);
       const mutations = dbCalls.filter((c) => c.isMutation);
       const mutates = mutations.length > 0;
       const authStrategy = [...authWrappers];
+      const isServerAction = type === "server-action";
+      const methods = [];
+      if (!isServerAction) {
+        for (const exp of parsed.exports) {
+          if (HTTP_METHODS.has(exp)) methods.push(exp);
+        }
+      }
+      const routePath = isServerAction ? null : filePathToAppRoute(paths.appDir, absPath);
+      const actions = isServerAction ? parsed.exports.filter((e) => !HTTP_METHODS.has(e)) : [];
       apiNodes.push({
         id,
-        type: "endpoint",
-        name: routePath,
+        type: isServerAction ? "server-action" : "endpoint",
+        // For HTTP routes: name = URL path. For Server Actions: name = file id +
+        // exported action names — the callable surface, not a URL.
+        name: isServerAction ? actions.length > 0 ? `${id} (${actions.join(", ")})` : id : routePath,
         layer: "api",
         path: routePath,
+        // null for Server Actions
         methods,
         handler: id,
         mutates,
+        ...isServerAction ? { actions } : {},
         auth: authStrategy.length > 0 ? authStrategy : ["public"],
         db_models: [...new Set(dbCalls.map((c) => c.model))],
         db_operations: [...new Set(dbCalls.map((c) => `${c.model}.${c.method}`))],
@@ -1297,6 +1398,8 @@ function generate(rootDir) {
     } else {
       const route = extractRoute(id);
       const deep = extractDeep(absPath);
+      const dbCalls = extractDbCallsTS(absPath);
+      const authWrappers = type === "page" || type === "layout" ? [...extractAuthWrappersTS(absPath)] : [];
       uiNodes.push({
         id,
         type,
@@ -1307,7 +1410,9 @@ function generate(rootDir) {
         elements: deep.elements,
         stateVars: deep.stateVars,
         conditions: deep.conditions,
-        variables: deep.variables
+        variables: deep.variables,
+        ...authWrappers.length > 0 ? { auth: authWrappers } : {},
+        ...dbCalls.length > 0 ? { _dbCalls: dbCalls } : {}
       });
       if (route) routeToNodeId.set(route, id);
     }
@@ -1331,6 +1436,29 @@ function generate(rootDir) {
     uiEdges.push(...edges);
     uiFlagged.push(...flagged);
   }
+  const layoutsById = /* @__PURE__ */ new Set();
+  for (const n of uiNodes) {
+    if (n.type === "layout") layoutsById.add(n.id);
+  }
+  function findClosestLayout(pageId) {
+    let dir = pageId.replace(/\/page\.tsx$/, "");
+    while (dir.length > 0) {
+      const candidate = `${dir}/layout.tsx`;
+      if (layoutsById.has(candidate)) return candidate;
+      const slash = dir.lastIndexOf("/");
+      if (slash < 0) break;
+      dir = dir.slice(0, slash);
+    }
+    if (layoutsById.has("app/layout.tsx")) return "app/layout.tsx";
+    return null;
+  }
+  for (const n of uiNodes) {
+    if (n.type !== "page") continue;
+    const layoutId = findClosestLayout(n.id);
+    if (layoutId && layoutId !== n.id) {
+      uiEdges.push({ source: layoutId, target: n.id, type: "wraps" });
+    }
+  }
   const fetchCallEntries = [];
   for (const absPath of fileSet) {
     const sourceId = toNodeId(srcDir, rootDir, absPath);
@@ -1412,17 +1540,37 @@ function generate(rootDir) {
     if (!dbCalls) continue;
     const seenModels = /* @__PURE__ */ new Set();
     for (const call of dbCalls) {
-      if (seenModels.has(call.model)) continue;
-      seenModels.add(call.model);
+      const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
+      if (seenModels.has(target)) continue;
+      seenModels.add(target);
       apiCrossRefs.push({
         source: node.id,
-        target: camelToPascal(call.model),
+        target,
+        type: call.isMutation ? "mutates" : "reads",
+        layer: "db"
+      });
+    }
+    delete node._dbCalls;
+  }
+  const uiCrossRefs = [];
+  for (const node of uiNodes) {
+    const dbCalls = node._dbCalls;
+    if (!dbCalls) continue;
+    const seenModels = /* @__PURE__ */ new Set();
+    for (const call of dbCalls) {
+      const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
+      if (seenModels.has(target)) continue;
+      seenModels.add(target);
+      uiCrossRefs.push({
+        source: node.id,
+        target,
         type: call.isMutation ? "mutates" : "reads",
         layer: "db"
       });
     }
     delete node._dbCalls;
   }
+  uiCrossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
   const apiNodeIds = new Set(apiNodes.map((n) => n.id));
   const apiEdges = [];
   const uiOnlyEdges = [];
@@ -1484,7 +1632,7 @@ function generate(rootDir) {
     },
     nodes: stripLayer(uiNodes),
     edges: uiOnlyEdges,
-    cross_refs: [],
+    cross_refs: uiCrossRefs,
     contradictions: [],
     warnings: [],
     flagged_edges: dedupedFlagged,
@@ -1568,6 +1716,7 @@ var init_typescript_project = __esm({
     HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
     CLASSIFICATION_TO_LAYER = {
       endpoint: "api",
+      "server-action": "api",
       page: "ui",
       layout: "ui",
       component: "ui",
@@ -2370,26 +2519,54 @@ function normalizeFetchUrl(raw) {
   return { path: s || "/", hadInterpolation };
 }
 function scoreApiRouteMatch(candidate, known) {
-  if (candidate.length !== known.length) return -1;
   let score = 0;
-  for (let i = 0; i < candidate.length; i++) {
+  let i = 0, j = 0;
+  while (i < candidate.length && j < known.length) {
     const a = candidate[i];
-    const b = known[i];
+    const b = known[j];
+    if (b.startsWith("*") && b.endsWith("?")) {
+      score += 1;
+      return score;
+    }
+    if (b.startsWith("*")) {
+      const remaining = candidate.length - i;
+      if (remaining < 1) return -1;
+      score += 1 + remaining;
+      return score;
+    }
     if (a === b) {
       score += 3;
+      i++;
+      j++;
       continue;
     }
     if (a.startsWith(":") && b.startsWith(":")) {
       score += 2;
+      i++;
+      j++;
       continue;
     }
     if (a.startsWith(":") || b.startsWith(":")) {
       score += 1;
+      i++;
+      j++;
       continue;
     }
     return -1;
   }
-  return score;
+  if (i === candidate.length) {
+    while (j < known.length) {
+      const b = known[j];
+      if (b.startsWith("*") && b.endsWith("?")) {
+        score += 1;
+        j++;
+        continue;
+      }
+      return -1;
+    }
+    return score;
+  }
+  return -1;
 }
 function resolveFetchCall(call, apiPathMap, apiRoutes) {
   const raw = call.url;
@@ -2556,22 +2733,12 @@ var init_fetch_resolver = __esm({
 });
 
 // src/server/graph/parsers/crosslayer/api-annotations.ts
-function walk2(dir, exts) {
-  if (!(0, import_node_fs9.existsSync)(dir)) return [];
-  const results = [];
-  for (const entry of (0, import_node_fs9.readdirSync)(dir, { withFileTypes: true })) {
-    if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const full = (0, import_node_path8.join)(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...walk2(full, exts));
-    } else if (exts.includes((0, import_node_path8.extname)(entry.name))) {
-      results.push(full);
-    }
+function toNodeId2(srcDir, rootDir, absPath) {
+  const relFromSrc = (0, import_node_path8.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path8.relative)(rootDir, absPath).replace(/\\/g, "/");
   }
-  return results;
-}
-function toNodeId2(srcDir, absPath) {
-  return (0, import_node_path8.relative)(srcDir, absPath).replace(/\\/g, "/");
+  return relFromSrc;
 }
 var import_node_fs9, import_node_path8, API_ANNOTATION_RE, apiAnnotationsParser;
 var init_api_annotations = __esm({
@@ -2580,31 +2747,53 @@ var init_api_annotations = __esm({
     import_node_fs9 = require("node:fs");
     import_node_path8 = require("node:path");
     init_api_route_matching();
+    init_config();
+    init_resolve_paths();
+    init_walk();
     API_ANNOTATION_RE = /@api\s+(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\s+(\/\S+)/g;
     apiAnnotationsParser = {
       id: "api-annotations",
       layer: "crosslayer",
       concern: "api-binding",
       detect(rootDir) {
-        return (0, import_node_fs9.existsSync)((0, import_node_path8.join)(rootDir, "src"));
+        return resolveProjectPaths(rootDir, loadConfig(rootDir)) !== null;
       },
       generate(rootDir, layerOutputs) {
         const apiOutput = layerOutputs.get("api");
         if (!apiOutput) {
           return { cross_refs: [], flagged_edges: [], warnings: [] };
         }
+        const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+        if (!paths) {
+          return { cross_refs: [], flagged_edges: [], warnings: [] };
+        }
         const uiOutput = layerOutputs.get("ui");
         const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
         const apiRoutes = loadApiRoutesFromOutput(apiOutput);
         const apiPathMap = buildApiPathMap(apiRoutes);
-        const srcDir = (0, import_node_path8.join)(rootDir, "src");
-        const files = walk2(srcDir, [".ts", ".tsx"]);
+        const srcDir = paths.srcDir;
+        const seen = /* @__PURE__ */ new Set();
+        const files = [];
+        for (const root of paths.srcRoots) {
+          for (const f of walk(root, [".ts", ".tsx"])) {
+            if (!seen.has(f)) {
+              seen.add(f);
+              files.push(f);
+            }
+          }
+        }
+        for (const conv of paths.conventionFiles) {
+          if (!seen.has(conv)) {
+            seen.add(conv);
+            files.push(conv);
+          }
+        }
         const crossRefs = [];
         const flaggedEdges = [];
-        const seen = /* @__PURE__ */ new Set();
+        const seenEdge = /* @__PURE__ */ new Set();
         for (const absPath of files) {
           const content = (0, import_node_fs9.readFileSync)(absPath, "utf-8");
-          const sourceId = toNodeId2(srcDir, absPath);
+          const sourceId = toNodeId2(srcDir, rootDir, absPath);
           if (!uiNodeIds.has(sourceId)) continue;
           let match;
           API_ANNOTATION_RE.lastIndex = 0;
@@ -2614,8 +2803,8 @@ var init_api_annotations = __esm({
             const result = resolveUrlPath(urlPath, apiPathMap, apiRoutes);
             if (result.kind === "resolved" && result.nodeId) {
               const key = `${sourceId}|${result.nodeId}|calls_api`;
-              if (seen.has(key)) continue;
-              seen.add(key);
+              if (seenEdge.has(key)) continue;
+              seenEdge.add(key);
               crossRefs.push({
                 source: sourceId,
                 target: result.nodeId,
@@ -2649,22 +2838,12 @@ var init_api_annotations = __esm({
 });
 
 // src/server/graph/parsers/crosslayer/url-literal-scanner.ts
-function walk3(dir, exts) {
-  if (!(0, import_node_fs10.existsSync)(dir)) return [];
-  const results = [];
-  for (const entry of (0, import_node_fs10.readdirSync)(dir, { withFileTypes: true })) {
-    if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const full = (0, import_node_path9.join)(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...walk3(full, exts));
-    } else if (exts.includes((0, import_node_path9.extname)(entry.name))) {
-      results.push(full);
-    }
+function toNodeId3(srcDir, rootDir, absPath) {
+  const relFromSrc = (0, import_node_path9.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path9.relative)(rootDir, absPath).replace(/\\/g, "/");
   }
-  return results;
-}
-function toNodeId3(srcDir, absPath) {
-  return (0, import_node_path9.relative)(srcDir, absPath).replace(/\\/g, "/");
+  return relFromSrc;
 }
 var import_node_fs10, import_node_path9, URL_LITERAL_RE, urlLiteralScannerParser;
 var init_url_literal_scanner = __esm({
@@ -2675,7 +2854,8 @@ var init_url_literal_scanner = __esm({
     init_api_route_matching();
     init_config();
     init_resolve_paths();
-    URL_LITERAL_RE = /['"`](\/api\/[^'"`\s]+?)['"`]/g;
+    init_walk();
+    URL_LITERAL_RE = /['"`](\/[a-zA-Z][^'"`\s]*?)['"`]/g;
     urlLiteralScannerParser = {
       id: "url-literal-scanner",
       layer: "crosslayer",
@@ -2695,15 +2875,26 @@ var init_url_literal_scanner = __esm({
         const apiPathMap = buildApiPathMap(apiRoutes);
         const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
         const srcDir = paths.srcDir;
-        const clientDir = (0, import_node_path9.join)(srcDir, "client");
-        const files = [
-          ...walk3(clientDir, [".ts", ".tsx"]),
-          ...walk3(paths.appDir, [".ts", ".tsx"])
-        ];
+        const seenFile = /* @__PURE__ */ new Set();
+        const files = [];
+        for (const root of paths.srcRoots) {
+          for (const f of walk(root, [".ts", ".tsx"])) {
+            if (!seenFile.has(f)) {
+              seenFile.add(f);
+              files.push(f);
+            }
+          }
+        }
+        for (const conv of paths.conventionFiles) {
+          if (!seenFile.has(conv)) {
+            seenFile.add(conv);
+            files.push(conv);
+          }
+        }
         const crossRefs = [];
         const seen = /* @__PURE__ */ new Set();
         for (const absPath of files) {
-          const sourceId = toNodeId3(srcDir, absPath);
+          const sourceId = toNodeId3(srcDir, rootDir, absPath);
           if (!uiNodeIds.has(sourceId)) continue;
           const content = (0, import_node_fs10.readFileSync)(absPath, "utf-8");
           let match;
@@ -2766,10 +2957,15 @@ function classifyScope(source, model) {
 function extractEnumValues(rootDir) {
   const nodes = [];
   const edges = [];
-  const schemaPaths = [
-    (0, import_node_path10.join)(rootDir, "prisma", "schema.prisma"),
-    (0, import_node_path10.join)(rootDir, "prisma", "schema")
-  ];
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  const schemaPaths = [];
+  if (paths?.dbConfig.kind === "prisma" && paths.dbConfig.schemaPath) {
+    schemaPaths.push(paths.dbConfig.schemaPath);
+    schemaPaths.push((0, import_node_path10.join)((0, import_node_path10.dirname)(paths.dbConfig.schemaPath), "schema"));
+  } else {
+    schemaPaths.push((0, import_node_path10.join)(rootDir, "prisma", "schema.prisma"));
+    schemaPaths.push((0, import_node_path10.join)(rootDir, "prisma", "schema"));
+  }
   let content = "";
   for (const p of schemaPaths) {
     if ((0, import_node_fs11.existsSync)(p)) {
@@ -2853,7 +3049,7 @@ function extractStringArrayFromNode(node) {
   return values;
 }
 function findArrayDecl(root, varName) {
-  function walk4(node) {
+  function walk2(node) {
     if (node.type === "variable_declarator") {
       const nameNode = node.childForFieldName("name");
       const valueNode = node.childForFieldName("value");
@@ -2866,12 +3062,12 @@ function findArrayDecl(root, varName) {
       }
     }
     for (const child of node.namedChildren) {
-      const found = walk4(child);
+      const found = walk2(child);
       if (found) return found;
     }
     return null;
   }
-  return walk4(root);
+  return walk2(root);
 }
 function extractObjectPropsRegex(objStr) {
   const props = {};
@@ -2934,11 +3130,26 @@ function modelToNodeType(model) {
 function extractSeedData(rootDir) {
   const nodes = [];
   const edges = [];
-  const seedFiles = [
-    (0, import_node_path10.join)(rootDir, "prisma", "seed.ts"),
-    (0, import_node_path10.join)(rootDir, "prisma", "seed.js"),
-    (0, import_node_path10.join)(rootDir, "src", "server", "lib", "system-tags.ts")
-  ].filter(import_node_fs11.existsSync);
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  const candidates = [];
+  if (paths?.dbDir) {
+    candidates.push((0, import_node_path10.join)(paths.dbDir, "seed.ts"));
+    candidates.push((0, import_node_path10.join)(paths.dbDir, "seed.js"));
+  } else {
+    candidates.push((0, import_node_path10.join)(rootDir, "prisma", "seed.ts"));
+    candidates.push((0, import_node_path10.join)(rootDir, "prisma", "seed.js"));
+  }
+  const baseRoots = paths?.srcRoots ?? [(0, import_node_path10.join)(rootDir, "src")];
+  for (const root of baseRoots) {
+    candidates.push((0, import_node_path10.join)(root, "server", "lib", "system-tags.ts"));
+  }
+  const seedFiles = candidates.filter((p) => {
+    try {
+      return (0, import_node_fs11.existsSync)(p) && (0, import_node_fs11.statSync)(p).isFile();
+    } catch {
+      return false;
+    }
+  });
   const useTreeSitter = tryLoadTreeSitter();
   for (const filePath of seedFiles) {
     const content = (0, import_node_fs11.readFileSync)(filePath, "utf-8");
@@ -3048,9 +3259,20 @@ function walkDir(dir, exts) {
 }
 function extractConstants(rootDir) {
   const nodes = [];
-  const srcDir = (0, import_node_path10.join)(rootDir, "src");
-  if (!(0, import_node_fs11.existsSync)(srcDir)) return { nodes };
-  for (const filePath of walkDir(srcDir, [".ts", ".tsx"])) {
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  const roots = paths?.srcRoots ?? [(0, import_node_path10.join)(rootDir, "src")];
+  const seenFile = /* @__PURE__ */ new Set();
+  const allFiles = [];
+  for (const root of roots) {
+    for (const f of walkDir(root, [".ts", ".tsx"])) {
+      if (!seenFile.has(f)) {
+        seenFile.add(f);
+        allFiles.push(f);
+      }
+    }
+  }
+  if (allFiles.length === 0) return { nodes };
+  for (const filePath of allFiles) {
     const content = (0, import_node_fs11.readFileSync)(filePath, "utf-8");
     const relPath = (0, import_node_path10.relative)(rootDir, filePath);
     const constArrayRe = /export\s+const\s+([A-Z][A-Z_0-9]+)\s*(?::[^=]+)?\s*=\s*\[/g;
@@ -3085,6 +3307,13 @@ function extractConstants(rootDir) {
   return { nodes };
 }
 function detect4(rootDir) {
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  if (paths?.dbConfig.kind === "prisma" && paths.dbConfig.schemaPath && (0, import_node_fs11.existsSync)(paths.dbConfig.schemaPath)) {
+    return true;
+  }
+  if (paths?.dbDir) {
+    if ((0, import_node_fs11.existsSync)((0, import_node_path10.join)(paths.dbDir, "seed.ts")) || (0, import_node_fs11.existsSync)((0, import_node_path10.join)(paths.dbDir, "seed.js"))) return true;
+  }
   return (0, import_node_fs11.existsSync)((0, import_node_path10.join)(rootDir, "prisma", "schema.prisma")) || (0, import_node_fs11.existsSync)((0, import_node_path10.join)(rootDir, "prisma", "seed.ts"));
 }
 function generate4(rootDir) {
@@ -3158,6 +3387,8 @@ var init_static_values = __esm({
     "use strict";
     import_node_fs11 = require("node:fs");
     import_node_path10 = require("node:path");
+    init_config();
+    init_resolve_paths();
     parseCode = null;
     SHARED_MODELS = /* @__PURE__ */ new Set(["permission", "role", "tag"]);
     DB_MODELS = /* @__PURE__ */ new Set(["subscriptionPlan", "providerDefinition", "pipelineMasterTemplate"]);
@@ -3321,13 +3552,22 @@ var init_static_ref_scanner = __esm({
         const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
         if (!paths) return { cross_refs: [], flagged_edges: [], warnings: [] };
         const srcDir = paths.srcDir;
-        const files = [
-          ...walkWithIgnore((0, import_node_path11.join)(srcDir, "client"), [".ts", ".tsx"]),
-          ...walkWithIgnore(paths.appDir, [".ts", ".tsx"]),
-          ...walkWithIgnore((0, import_node_path11.join)(srcDir, "server"), [".ts", ".tsx"]),
-          ...walkWithIgnore((0, import_node_path11.join)(srcDir, "lib"), [".ts", ".tsx"]),
-          ...walkWithIgnore((0, import_node_path11.join)(srcDir, "config"), [".ts", ".tsx"])
-        ];
+        const seenFile = /* @__PURE__ */ new Set();
+        const files = [];
+        for (const root of paths.srcRoots) {
+          for (const f of walkWithIgnore(root, [".ts", ".tsx"])) {
+            if (!seenFile.has(f)) {
+              seenFile.add(f);
+              files.push(f);
+            }
+          }
+        }
+        for (const conv of paths.conventionFiles) {
+          if (!seenFile.has(conv)) {
+            seenFile.add(conv);
+            files.push(conv);
+          }
+        }
         const uiOutput = layerOutputs.get("ui");
         const apiOutput = layerOutputs.get("api");
         const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
@@ -3344,7 +3584,8 @@ var init_static_ref_scanner = __esm({
         const seen = /* @__PURE__ */ new Set();
         let filesScanned = 0;
         for (const absPath of files) {
-          const sourceId = (0, import_node_path11.relative)(srcDir, absPath).replace(/\\/g, "/");
+          const relFromSrc = (0, import_node_path11.relative)(srcDir, absPath).replace(/\\/g, "/");
+          const sourceId = relFromSrc.startsWith("..") ? (0, import_node_path11.relative)(rootDir, absPath).replace(/\\/g, "/") : relFromSrc;
           const sourceLayer = uiNodeIds.has(sourceId) ? "ui" : apiNodeIds.has(sourceId) ? "api" : null;
           if (!sourceLayer) continue;
           const content = (0, import_node_fs12.readFileSync)(absPath, "utf-8");
@@ -3816,13 +4057,17 @@ function isTrivialGroup(name, extraTrivial) {
 function normalizeGroupName(name) {
   return name.toLowerCase().replace(/-pages?$/, "").replace(/-layout$/, "").replace(/-wrapper$/, "");
 }
-function extractModuleFromPath(id, extraTrivial, extraSkipSegments) {
+function extractModuleFromPath(id, extraTrivial, extraSkipSegments, extraGenericRoles) {
   const segments = id.split("/");
   const routeGroups = extractRouteGroups(id);
   const skipSegments = new Set(SKIP_SEGMENTS_BUILTIN);
+  for (const r of GENERIC_ROLE_NAMES_BUILTIN) skipSegments.add(r);
   if (extraSkipSegments) {
     for (const s of extraSkipSegments) skipSegments.add(s);
   }
+  if (extraGenericRoles) {
+    for (const r of extraGenericRoles) skipSegments.add(r);
+  }
   const moduleGroups = routeGroups.filter((g) => !isTrivialGroup(g, extraTrivial)).map(normalizeGroupName);
   if (moduleGroups.length > 0) {
     return moduleGroups[moduleGroups.length - 1];
@@ -6042,7 +6287,7 @@ function handleAuditLayer(args) {
     }
     lines.push("");
   }
-  return okText(lines.join("\n"));
+  return ok(lines.join("\n"));
 }
 function handleDetectProjectStack() {
   const rootDir = process.cwd();
@@ -6108,7 +6353,7 @@ function handleDetectProjectStack() {
       const descriptions = {
         "fetch-resolver": "Detects direct fetch()/api.get() calls with inline URLs",
         "api-annotations": "Scans for @api METHOD /path annotations in JSDoc/comments",
-        "url-literal-scanner": "Finds /api/... string literals as fallback detection",
+        "url-literal-scanner": "Finds path-like string literals (any /\u2026) and resolves them to API routes",
         "static-ref-scanner": "Finds references to static values (enums, permissions, roles)"
       };
       const grouped = {};