@launchsecure/launch-kit 0.0.24 → 0.0.25

package/dist/server/chart-serve.js

@@ -58,11 +58,14 @@ var init_config = __esm({
 var ts_extractor_exports = {};
 __export(ts_extractor_exports, {
   classifyFile: () => classifyFile,
+  classifyRouteAgainstMiddleware: () => classifyRouteAgainstMiddleware,
   createQuery: () => createQuery,
   extractAuthWrappersTS: () => extractAuthWrappersTS,
   extractDbCallsTS: () => extractDbCallsTS,
   extractDeep: () => extractDeep,
+  extractMiddlewareAuthTS: () => extractMiddlewareAuthTS,
   initTreeSitter: () => initTreeSitter,
+  middlewarePatternToRegex: () => middlewarePatternToRegex,
   parseCodeTS: () => parseCodeTS,
   parseFileTS: () => parseFileTS,
   setExtractorConfig: () => setExtractorConfig
@@ -456,6 +459,180 @@ function extractAuthWrappersTS(absPath) {
   }
   return wrappers;
 }
+function inferIntentFromName(name) {
+  for (const re of EXEMPT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "exempt", hint: `name "${name}" matches /${re.source}/` };
+  }
+  for (const re of PROTECT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "protect", hint: `name "${name}" matches /${re.source}/` };
+  }
+  return { intent: "ambiguous", hint: `name "${name}" has no exempt/protect signal` };
+}
+function looksLikeRoutePattern(s) {
+  return s.startsWith("/") && !s.startsWith("//");
+}
+function collectStringsFromArray(arrNode) {
+  const out = [];
+  for (const child of arrNode.children) {
+    if (child.type !== "string") continue;
+    const frag = childOfType(child, "string_fragment");
+    if (frag) out.push(frag.text);
+  }
+  return out;
+}
+function findArrayInValue(valueNode) {
+  if (!valueNode) return null;
+  if (valueNode.type === "array") return valueNode;
+  if (valueNode.type === "call_expression") {
+    const args = childOfType(valueNode, "arguments");
+    if (!args) return null;
+    for (const c of args.children) {
+      if (c.type === "array") return c;
+    }
+  }
+  return null;
+}
+function extractMatcherFromDeclarator(decl) {
+  const nameNode = childOfType(decl, "identifier");
+  if (!nameNode) return null;
+  let valueNode;
+  for (const c of decl.children) {
+    if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+    valueNode = c;
+  }
+  const arr = findArrayInValue(valueNode);
+  if (!arr) return null;
+  const strings = collectStringsFromArray(arr);
+  const routes = strings.filter(looksLikeRoutePattern);
+  if (routes.length === 0) return null;
+  const { intent, hint } = inferIntentFromName(nameNode.text);
+  return { name: nameNode.text, patterns: routes, intent, hint };
+}
+function extractMatchersFromObject(objNode) {
+  const out = [];
+  for (const pair of childrenOfType(objNode, "pair")) {
+    const key = childOfType(pair, "property_identifier");
+    if (!key) continue;
+    const arr = pair.children.find((c) => c.type === "array");
+    if (!arr) continue;
+    const routes = collectStringsFromArray(arr).filter(looksLikeRoutePattern);
+    if (routes.length === 0) continue;
+    const { intent, hint } = inferIntentFromName(key.text);
+    out.push({ name: key.text, patterns: routes, intent, hint });
+  }
+  return out;
+}
+function detectFallthroughProtect(root) {
+  const text = root.text;
+  const signals = [
+    /\bauth\.protect\s*\(/,
+    /\bauth\(\)\.protect\s*\(/,
+    /\bredirect\s*\(\s*['"`]\/(sign-?in|log-?in|auth)/i,
+    /\bNextResponse\.redirect\s*\(/,
+    /\bthrow\s+new\s+\w*Unauthorized/i
+  ];
+  return signals.some((re) => re.test(text));
+}
+function extractMiddlewareAuthTS(absPath) {
+  if (!require("node:fs").existsSync(absPath)) return null;
+  const tree = parseSource(absPath);
+  const root = tree.rootNode;
+  const matchers = [];
+  for (const stmt of root.children) {
+    if (stmt.type !== "lexical_declaration" && stmt.type !== "variable_declaration") continue;
+    for (const decl of childrenOfType(stmt, "variable_declarator")) {
+      const m = extractMatcherFromDeclarator(decl);
+      if (m) matchers.push(m);
+      let valueNode;
+      for (const c of decl.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+    }
+  }
+  for (const stmt of root.children) {
+    if (stmt.type !== "export_statement") continue;
+    const decl = childOfType(stmt, "lexical_declaration") ?? childOfType(stmt, "variable_declaration");
+    if (!decl) continue;
+    for (const d of childrenOfType(decl, "variable_declarator")) {
+      let valueNode;
+      for (const c of d.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+      const m = extractMatcherFromDeclarator(d);
+      if (m && !matchers.some((x) => x.name === m.name && x.patterns.join() === m.patterns.join())) {
+        matchers.push(m);
+      }
+    }
+  }
+  return {
+    file: absPath,
+    matchers,
+    hasFallthroughProtect: detectFallthroughProtect(root)
+  };
+}
+function middlewarePatternToRegex(pattern) {
+  if (/\(\?\!/.test(pattern)) return null;
+  if (pattern.startsWith("(")) return null;
+  let src = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "(" && pattern.slice(i, i + 4) === "(.*)") {
+      src += ".*";
+      i += 4;
+      continue;
+    }
+    if (ch === ":") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      src += "[^/]+";
+      continue;
+    }
+    if (ch === "*") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      if (pattern[i] === "?") {
+        i++;
+        src += ".*";
+        continue;
+      }
+      src += ".+";
+      continue;
+    }
+    if (/[.\\+?^${}()|[\]]/.test(ch)) {
+      src += "\\" + ch;
+      i++;
+      continue;
+    }
+    src += ch;
+    i++;
+  }
+  src += "$";
+  try {
+    return new RegExp(src);
+  } catch {
+    return null;
+  }
+}
+function classifyRouteAgainstMiddleware(routePath, info) {
+  for (const m of info.matchers) {
+    if (m.intent === "ambiguous") continue;
+    for (const pat of m.patterns) {
+      const re = middlewarePatternToRegex(pat);
+      if (!re) continue;
+      if (re.test(routePath)) return { intent: m.intent, matcher: m.name, pattern: pat };
+    }
+  }
+  return null;
+}
 function trunc(s, max = 120) {
   return s.length > max ? s.slice(0, max) + "..." : s;
 }
@@ -612,7 +789,7 @@ function extractDeep(absPath) {
   }
   return { elements, stateVars, conditions, variables, responses, params };
 }
-var import_node_fs4, import_node_path4, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS;
+var import_node_fs4, import_node_path4, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
@@ -651,6 +828,29 @@ var init_ts_extractor = __esm({
       { module: /^@auth\//, helpers: ["auth"] },
       { module: /^@supabase\/auth-helpers/, helpers: ["createServerClient"] }
     ];
+    EXEMPT_NAME_PATTERNS = [
+      /^is_?public/i,
+      /^public_?routes?/i,
+      /^public_?paths?/i,
+      /^whitelist/i,
+      /^allowlist/i,
+      /^unauthenticated/i,
+      /^anonymous/i,
+      /^guest/i,
+      /^skip_?auth/i,
+      /^bypass/i
+    ];
+    PROTECT_NAME_PATTERNS = [
+      /^is_?protected/i,
+      /^protected_?routes?/i,
+      /^protected_?paths?/i,
+      /^require_?auth/i,
+      /^auth_?required/i,
+      /^private_?routes?/i,
+      /^is_?admin/i,
+      /^admin_?routes?/i,
+      /^secured/i
+    ];
   }
 });
 
@@ -691,15 +891,9 @@ var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
 var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
-  ".git",
-  ".next",
-  ".launchsecure",
-  ".claude",
   "dist",
   "build",
   "out",
-  ".turbo",
-  ".vercel",
   "coverage"
 ]);
 function walk(dir, exts) {
@@ -721,6 +915,7 @@ function walkWithIgnore(dir, exts, opts = {}) {
   const skip = opts.extraIgnore ? /* @__PURE__ */ new Set([...DEFAULT_IGNORE_DIRS, ...opts.extraIgnore]) : DEFAULT_IGNORE_DIRS;
   for (const entry of (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
+      if (entry.name.startsWith(".")) continue;
       if (skip.has(entry.name)) continue;
       results.push(...walkWithIgnore((0, import_node_path2.join)(dir, entry.name), exts, opts));
     } else if (exts.includes((0, import_node_path2.extname)(entry.name))) {
@@ -1472,43 +1667,169 @@ function generate(rootDir) {
     nodeIdSet.add(externalId);
     uiEdges.push(...edgesFromThis);
   }
+  const tablesByFile = /* @__PURE__ */ new Map();
+  const allDbNodes = [...apiNodes, ...uiNodes];
+  for (const node of allDbNodes) {
+    const calls = node._dbCalls;
+    if (!calls || calls.length === 0) continue;
+    const map = /* @__PURE__ */ new Map();
+    for (const c of calls) {
+      const key = `${c.kind}:${c.model}:${c.isMutation ? "m" : "r"}`;
+      if (!map.has(key)) {
+        map.set(key, { model: c.model, method: c.method, isMutation: c.isMutation, kind: c.kind, via: [] });
+      }
+    }
+    tablesByFile.set(node.id, map);
+  }
+  const reverseRuntimeImports = /* @__PURE__ */ new Map();
+  for (const edge of uiEdges) {
+    if (edge.type !== "imports" && edge.type !== "renders") continue;
+    if (!reverseRuntimeImports.has(edge.target)) {
+      reverseRuntimeImports.set(edge.target, /* @__PURE__ */ new Set());
+    }
+    reverseRuntimeImports.get(edge.target).add(edge.source);
+  }
+  let changed = true;
+  let iterations = 0;
+  while (changed && iterations < 50) {
+    changed = false;
+    iterations++;
+    for (const [target, tableMap] of [...tablesByFile]) {
+      const importers = reverseRuntimeImports.get(target);
+      if (!importers) continue;
+      for (const importer of importers) {
+        if (importer === target) continue;
+        let importerMap = tablesByFile.get(importer);
+        if (!importerMap) {
+          importerMap = /* @__PURE__ */ new Map();
+          tablesByFile.set(importer, importerMap);
+        }
+        for (const [key, call] of tableMap) {
+          if (importerMap.has(key)) continue;
+          importerMap.set(key, {
+            model: call.model,
+            method: null,
+            isMutation: call.isMutation,
+            kind: call.kind,
+            via: [...call.via, target]
+          });
+          changed = true;
+        }
+      }
+    }
+  }
+  for (const node of apiNodes) {
+    const map = tablesByFile.get(node.id);
+    if (!map) continue;
+    node.db_models = [...new Set([...map.values()].map((c) => c.model))];
+    node.db_operations = [...new Set(
+      [...map.values()].filter((c) => c.via.length === 0 && c.method).map((c) => `${c.model}.${c.method}`)
+    )];
+    node.mutates = [...map.values()].some((c) => c.isMutation);
+  }
   const apiCrossRefs = [];
   for (const node of apiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
       const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
-      if (seenModels.has(target)) continue;
-      seenModels.add(target);
-      apiCrossRefs.push({
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
         target,
-        type: call.isMutation ? "mutates" : "reads",
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      apiCrossRefs.push(ref);
     }
     delete node._dbCalls;
   }
   const uiCrossRefs = [];
   for (const node of uiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      if (node._dbCalls) delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
       const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
-      if (seenModels.has(target)) continue;
-      seenModels.add(target);
-      uiCrossRefs.push({
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
         target,
-        type: call.isMutation ? "mutates" : "reads",
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      uiCrossRefs.push(ref);
     }
-    delete node._dbCalls;
+    if (node._dbCalls) delete node._dbCalls;
   }
   uiCrossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  const middlewareInfos = [];
+  for (const conv of paths.conventionFiles) {
+    if (!/middleware\.tsx?$/.test(conv)) continue;
+    try {
+      const info = extractMiddlewareAuthTS(conv);
+      if (info && info.matchers.length > 0) middlewareInfos.push(info);
+    } catch {
+    }
+  }
+  if (middlewareInfos.length > 0) {
+    let setAuth2 = function(node, newTags, replaceAll) {
+      const existing = node.auth ?? [];
+      const meaningful = existing.filter((a) => a !== "public");
+      const merged = replaceAll ? newTags : [.../* @__PURE__ */ new Set([...newTags, ...meaningful])];
+      node.auth = merged.length > 0 ? merged : ["public"];
+    }, applyMiddleware2 = function(node, routePath) {
+      let resolved = null;
+      let label = "";
+      let hasAnyExemptMatcher = false;
+      let hasAnyFallthrough = false;
+      for (const info of middlewareInfos) {
+        if (info.hasFallthroughProtect) hasAnyFallthrough = true;
+        if (info.matchers.some((m) => m.intent === "exempt")) hasAnyExemptMatcher = true;
+        const c = classifyRouteAgainstMiddleware(routePath, info);
+        if (!c) continue;
+        if (!resolved) {
+          resolved = c.intent;
+          label = c.matcher;
+        }
+      }
+      if (resolved === "exempt") {
+        setAuth2(node, ["public"], true);
+        return;
+      }
+      if (resolved === "protect") {
+        setAuth2(node, [`middleware:${label}`], false);
+        return;
+      }
+      if (hasAnyExemptMatcher && hasAnyFallthrough) {
+        setAuth2(node, ["middleware-protected"], false);
+      }
+    };
+    var setAuth = setAuth2, applyMiddleware = applyMiddleware2;
+    for (const node of apiNodes) {
+      const routePath = node.path;
+      if (!routePath) continue;
+      applyMiddleware2(node, routePath);
+    }
+    for (const node of uiNodes) {
+      const route = node.route;
+      if (!route) continue;
+      applyMiddleware2(node, route);
+    }
+  }
   const apiNodeIds = new Set(apiNodes.map((n) => n.id));
   const apiEdges = [];
   const uiOnlyEdges = [];

package/dist/server/cli.js

@@ -3733,11 +3733,14 @@ var init_config = __esm({
 var ts_extractor_exports = {};
 __export(ts_extractor_exports, {
   classifyFile: () => classifyFile,
+  classifyRouteAgainstMiddleware: () => classifyRouteAgainstMiddleware,
   createQuery: () => createQuery,
   extractAuthWrappersTS: () => extractAuthWrappersTS,
   extractDbCallsTS: () => extractDbCallsTS,
   extractDeep: () => extractDeep,
+  extractMiddlewareAuthTS: () => extractMiddlewareAuthTS,
   initTreeSitter: () => initTreeSitter,
+  middlewarePatternToRegex: () => middlewarePatternToRegex,
   parseCodeTS: () => parseCodeTS,
   parseFileTS: () => parseFileTS,
   setExtractorConfig: () => setExtractorConfig
@@ -4131,6 +4134,180 @@ function extractAuthWrappersTS(absPath) {
   }
   return wrappers;
 }
+function inferIntentFromName(name) {
+  for (const re of EXEMPT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "exempt", hint: `name "${name}" matches /${re.source}/` };
+  }
+  for (const re of PROTECT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "protect", hint: `name "${name}" matches /${re.source}/` };
+  }
+  return { intent: "ambiguous", hint: `name "${name}" has no exempt/protect signal` };
+}
+function looksLikeRoutePattern(s) {
+  return s.startsWith("/") && !s.startsWith("//");
+}
+function collectStringsFromArray(arrNode) {
+  const out = [];
+  for (const child of arrNode.children) {
+    if (child.type !== "string") continue;
+    const frag = childOfType(child, "string_fragment");
+    if (frag) out.push(frag.text);
+  }
+  return out;
+}
+function findArrayInValue(valueNode) {
+  if (!valueNode) return null;
+  if (valueNode.type === "array") return valueNode;
+  if (valueNode.type === "call_expression") {
+    const args = childOfType(valueNode, "arguments");
+    if (!args) return null;
+    for (const c of args.children) {
+      if (c.type === "array") return c;
+    }
+  }
+  return null;
+}
+function extractMatcherFromDeclarator(decl) {
+  const nameNode = childOfType(decl, "identifier");
+  if (!nameNode) return null;
+  let valueNode;
+  for (const c of decl.children) {
+    if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+    valueNode = c;
+  }
+  const arr = findArrayInValue(valueNode);
+  if (!arr) return null;
+  const strings = collectStringsFromArray(arr);
+  const routes = strings.filter(looksLikeRoutePattern);
+  if (routes.length === 0) return null;
+  const { intent, hint } = inferIntentFromName(nameNode.text);
+  return { name: nameNode.text, patterns: routes, intent, hint };
+}
+function extractMatchersFromObject(objNode) {
+  const out = [];
+  for (const pair of childrenOfType(objNode, "pair")) {
+    const key = childOfType(pair, "property_identifier");
+    if (!key) continue;
+    const arr = pair.children.find((c) => c.type === "array");
+    if (!arr) continue;
+    const routes = collectStringsFromArray(arr).filter(looksLikeRoutePattern);
+    if (routes.length === 0) continue;
+    const { intent, hint } = inferIntentFromName(key.text);
+    out.push({ name: key.text, patterns: routes, intent, hint });
+  }
+  return out;
+}
+function detectFallthroughProtect(root) {
+  const text = root.text;
+  const signals = [
+    /\bauth\.protect\s*\(/,
+    /\bauth\(\)\.protect\s*\(/,
+    /\bredirect\s*\(\s*['"`]\/(sign-?in|log-?in|auth)/i,
+    /\bNextResponse\.redirect\s*\(/,
+    /\bthrow\s+new\s+\w*Unauthorized/i
+  ];
+  return signals.some((re) => re.test(text));
+}
+function extractMiddlewareAuthTS(absPath) {
+  if (!require("node:fs").existsSync(absPath)) return null;
+  const tree = parseSource(absPath);
+  const root = tree.rootNode;
+  const matchers = [];
+  for (const stmt of root.children) {
+    if (stmt.type !== "lexical_declaration" && stmt.type !== "variable_declaration") continue;
+    for (const decl of childrenOfType(stmt, "variable_declarator")) {
+      const m = extractMatcherFromDeclarator(decl);
+      if (m) matchers.push(m);
+      let valueNode;
+      for (const c of decl.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+    }
+  }
+  for (const stmt of root.children) {
+    if (stmt.type !== "export_statement") continue;
+    const decl = childOfType(stmt, "lexical_declaration") ?? childOfType(stmt, "variable_declaration");
+    if (!decl) continue;
+    for (const d of childrenOfType(decl, "variable_declarator")) {
+      let valueNode;
+      for (const c of d.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+      const m = extractMatcherFromDeclarator(d);
+      if (m && !matchers.some((x) => x.name === m.name && x.patterns.join() === m.patterns.join())) {
+        matchers.push(m);
+      }
+    }
+  }
+  return {
+    file: absPath,
+    matchers,
+    hasFallthroughProtect: detectFallthroughProtect(root)
+  };
+}
+function middlewarePatternToRegex(pattern) {
+  if (/\(\?\!/.test(pattern)) return null;
+  if (pattern.startsWith("(")) return null;
+  let src = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "(" && pattern.slice(i, i + 4) === "(.*)") {
+      src += ".*";
+      i += 4;
+      continue;
+    }
+    if (ch === ":") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      src += "[^/]+";
+      continue;
+    }
+    if (ch === "*") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      if (pattern[i] === "?") {
+        i++;
+        src += ".*";
+        continue;
+      }
+      src += ".+";
+      continue;
+    }
+    if (/[.\\+?^${}()|[\]]/.test(ch)) {
+      src += "\\" + ch;
+      i++;
+      continue;
+    }
+    src += ch;
+    i++;
+  }
+  src += "$";
+  try {
+    return new RegExp(src);
+  } catch {
+    return null;
+  }
+}
+function classifyRouteAgainstMiddleware(routePath, info) {
+  for (const m of info.matchers) {
+    if (m.intent === "ambiguous") continue;
+    for (const pat of m.patterns) {
+      const re = middlewarePatternToRegex(pat);
+      if (!re) continue;
+      if (re.test(routePath)) return { intent: m.intent, matcher: m.name, pattern: pat };
+    }
+  }
+  return null;
+}
 function trunc(s, max = 120) {
   return s.length > max ? s.slice(0, max) + "..." : s;
 }
@@ -4287,7 +4464,7 @@ function extractDeep(absPath) {
   }
   return { elements, stateVars, conditions, variables, responses, params };
 }
-var import_node_fs4, import_node_path4, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS;
+var import_node_fs4, import_node_path4, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
@@ -4326,6 +4503,29 @@ var init_ts_extractor = __esm({
       { module: /^@auth\//, helpers: ["auth"] },
       { module: /^@supabase\/auth-helpers/, helpers: ["createServerClient"] }
     ];
+    EXEMPT_NAME_PATTERNS = [
+      /^is_?public/i,
+      /^public_?routes?/i,
+      /^public_?paths?/i,
+      /^whitelist/i,
+      /^allowlist/i,
+      /^unauthenticated/i,
+      /^anonymous/i,
+      /^guest/i,
+      /^skip_?auth/i,
+      /^bypass/i
+    ];
+    PROTECT_NAME_PATTERNS = [
+      /^is_?protected/i,
+      /^protected_?routes?/i,
+      /^protected_?paths?/i,
+      /^require_?auth/i,
+      /^auth_?required/i,
+      /^private_?routes?/i,
+      /^is_?admin/i,
+      /^admin_?routes?/i,
+      /^secured/i
+    ];
   }
 });
 
@@ -7048,15 +7248,9 @@ var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
 var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
-  ".git",
-  ".next",
-  ".launchsecure",
-  ".claude",
   "dist",
   "build",
   "out",
-  ".turbo",
-  ".vercel",
   "coverage"
 ]);
 function walk(dir, exts) {
@@ -7078,6 +7272,7 @@ function walkWithIgnore(dir, exts, opts = {}) {
   const skip = opts.extraIgnore ? /* @__PURE__ */ new Set([...DEFAULT_IGNORE_DIRS, ...opts.extraIgnore]) : DEFAULT_IGNORE_DIRS;
   for (const entry of (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
+      if (entry.name.startsWith(".")) continue;
       if (skip.has(entry.name)) continue;
       results.push(...walkWithIgnore((0, import_node_path2.join)(dir, entry.name), exts, opts));
     } else if (exts.includes((0, import_node_path2.extname)(entry.name))) {
@@ -7829,43 +8024,169 @@ function generate(rootDir) {
     nodeIdSet.add(externalId);
     uiEdges.push(...edgesFromThis);
   }
+  const tablesByFile = /* @__PURE__ */ new Map();
+  const allDbNodes = [...apiNodes, ...uiNodes];
+  for (const node of allDbNodes) {
+    const calls = node._dbCalls;
+    if (!calls || calls.length === 0) continue;
+    const map = /* @__PURE__ */ new Map();
+    for (const c of calls) {
+      const key = `${c.kind}:${c.model}:${c.isMutation ? "m" : "r"}`;
+      if (!map.has(key)) {
+        map.set(key, { model: c.model, method: c.method, isMutation: c.isMutation, kind: c.kind, via: [] });
+      }
+    }
+    tablesByFile.set(node.id, map);
+  }
+  const reverseRuntimeImports = /* @__PURE__ */ new Map();
+  for (const edge of uiEdges) {
+    if (edge.type !== "imports" && edge.type !== "renders") continue;
+    if (!reverseRuntimeImports.has(edge.target)) {
+      reverseRuntimeImports.set(edge.target, /* @__PURE__ */ new Set());
+    }
+    reverseRuntimeImports.get(edge.target).add(edge.source);
+  }
+  let changed = true;
+  let iterations = 0;
+  while (changed && iterations < 50) {
+    changed = false;
+    iterations++;
+    for (const [target, tableMap] of [...tablesByFile]) {
+      const importers = reverseRuntimeImports.get(target);
+      if (!importers) continue;
+      for (const importer of importers) {
+        if (importer === target) continue;
+        let importerMap = tablesByFile.get(importer);
+        if (!importerMap) {
+          importerMap = /* @__PURE__ */ new Map();
+          tablesByFile.set(importer, importerMap);
+        }
+        for (const [key, call] of tableMap) {
+          if (importerMap.has(key)) continue;
+          importerMap.set(key, {
+            model: call.model,
+            method: null,
+            isMutation: call.isMutation,
+            kind: call.kind,
+            via: [...call.via, target]
+          });
+          changed = true;
+        }
+      }
+    }
+  }
+  for (const node of apiNodes) {
+    const map = tablesByFile.get(node.id);
+    if (!map) continue;
+    node.db_models = [...new Set([...map.values()].map((c) => c.model))];
+    node.db_operations = [...new Set(
+      [...map.values()].filter((c) => c.via.length === 0 && c.method).map((c) => `${c.model}.${c.method}`)
+    )];
+    node.mutates = [...map.values()].some((c) => c.isMutation);
+  }
   const apiCrossRefs = [];
   for (const node of apiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
       const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
-      if (seenModels.has(target)) continue;
-      seenModels.add(target);
-      apiCrossRefs.push({
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
         target,
-        type: call.isMutation ? "mutates" : "reads",
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      apiCrossRefs.push(ref);
     }
     delete node._dbCalls;
   }
   const uiCrossRefs = [];
   for (const node of uiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      if (node._dbCalls) delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
       const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
-      if (seenModels.has(target)) continue;
-      seenModels.add(target);
-      uiCrossRefs.push({
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
         target,
-        type: call.isMutation ? "mutates" : "reads",
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      uiCrossRefs.push(ref);
     }
-    delete node._dbCalls;
+    if (node._dbCalls) delete node._dbCalls;
   }
   uiCrossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  const middlewareInfos = [];
+  for (const conv of paths.conventionFiles) {
+    if (!/middleware\.tsx?$/.test(conv)) continue;
+    try {
+      const info = extractMiddlewareAuthTS(conv);
+      if (info && info.matchers.length > 0) middlewareInfos.push(info);
+    } catch {
+    }
+  }
+  if (middlewareInfos.length > 0) {
+    let setAuth2 = function(node, newTags, replaceAll) {
+      const existing = node.auth ?? [];
+      const meaningful = existing.filter((a) => a !== "public");
+      const merged = replaceAll ? newTags : [.../* @__PURE__ */ new Set([...newTags, ...meaningful])];
+      node.auth = merged.length > 0 ? merged : ["public"];
+    }, applyMiddleware2 = function(node, routePath) {
+      let resolved = null;
+      let label = "";
+      let hasAnyExemptMatcher = false;
+      let hasAnyFallthrough = false;
+      for (const info of middlewareInfos) {
+        if (info.hasFallthroughProtect) hasAnyFallthrough = true;
+        if (info.matchers.some((m) => m.intent === "exempt")) hasAnyExemptMatcher = true;
+        const c = classifyRouteAgainstMiddleware(routePath, info);
+        if (!c) continue;
+        if (!resolved) {
+          resolved = c.intent;
+          label = c.matcher;
+        }
+      }
+      if (resolved === "exempt") {
+        setAuth2(node, ["public"], true);
+        return;
+      }
+      if (resolved === "protect") {
+        setAuth2(node, [`middleware:${label}`], false);
+        return;
+      }
+      if (hasAnyExemptMatcher && hasAnyFallthrough) {
+        setAuth2(node, ["middleware-protected"], false);
+      }
+    };
+    var setAuth = setAuth2, applyMiddleware = applyMiddleware2;
+    for (const node of apiNodes) {
+      const routePath = node.path;
+      if (!routePath) continue;
+      applyMiddleware2(node, routePath);
+    }
+    for (const node of uiNodes) {
+      const route = node.route;
+      if (!route) continue;
+      applyMiddleware2(node, route);
+    }
+  }
   const apiNodeIds = new Set(apiNodes.map((n) => n.id));
   const apiEdges = [];
   const uiOnlyEdges = [];

package/dist/server/graph-mcp-entry.js

@@ -175,6 +175,7 @@ function walkWithIgnore(dir, exts, opts = {}) {
   const skip = opts.extraIgnore ? /* @__PURE__ */ new Set([...DEFAULT_IGNORE_DIRS, ...opts.extraIgnore]) : DEFAULT_IGNORE_DIRS;
   for (const entry of (0, import_node_fs3.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
+      if (entry.name.startsWith(".")) continue;
       if (skip.has(entry.name)) continue;
       results.push(...walkWithIgnore((0, import_node_path3.join)(dir, entry.name), exts, opts));
     } else if (exts.includes((0, import_node_path3.extname)(entry.name))) {
@@ -191,15 +192,9 @@ var init_walk = __esm({
     import_node_path3 = require("node:path");
     DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
       "node_modules",
-      ".git",
-      ".next",
-      ".launchsecure",
-      ".claude",
       "dist",
       "build",
       "out",
-      ".turbo",
-      ".vercel",
       "coverage"
     ]);
   }
@@ -404,11 +399,14 @@ var init_resolve_paths = __esm({
 var ts_extractor_exports = {};
 __export(ts_extractor_exports, {
   classifyFile: () => classifyFile,
+  classifyRouteAgainstMiddleware: () => classifyRouteAgainstMiddleware,
   createQuery: () => createQuery,
   extractAuthWrappersTS: () => extractAuthWrappersTS,
   extractDbCallsTS: () => extractDbCallsTS,
   extractDeep: () => extractDeep,
+  extractMiddlewareAuthTS: () => extractMiddlewareAuthTS,
   initTreeSitter: () => initTreeSitter,
+  middlewarePatternToRegex: () => middlewarePatternToRegex,
   parseCodeTS: () => parseCodeTS,
   parseFileTS: () => parseFileTS,
   setExtractorConfig: () => setExtractorConfig
@@ -802,6 +800,180 @@ function extractAuthWrappersTS(absPath) {
   }
   return wrappers;
 }
+function inferIntentFromName(name) {
+  for (const re of EXEMPT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "exempt", hint: `name "${name}" matches /${re.source}/` };
+  }
+  for (const re of PROTECT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "protect", hint: `name "${name}" matches /${re.source}/` };
+  }
+  return { intent: "ambiguous", hint: `name "${name}" has no exempt/protect signal` };
+}
+function looksLikeRoutePattern(s) {
+  return s.startsWith("/") && !s.startsWith("//");
+}
+function collectStringsFromArray(arrNode) {
+  const out = [];
+  for (const child of arrNode.children) {
+    if (child.type !== "string") continue;
+    const frag = childOfType(child, "string_fragment");
+    if (frag) out.push(frag.text);
+  }
+  return out;
+}
+function findArrayInValue(valueNode) {
+  if (!valueNode) return null;
+  if (valueNode.type === "array") return valueNode;
+  if (valueNode.type === "call_expression") {
+    const args = childOfType(valueNode, "arguments");
+    if (!args) return null;
+    for (const c of args.children) {
+      if (c.type === "array") return c;
+    }
+  }
+  return null;
+}
+function extractMatcherFromDeclarator(decl) {
+  const nameNode = childOfType(decl, "identifier");
+  if (!nameNode) return null;
+  let valueNode;
+  for (const c of decl.children) {
+    if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+    valueNode = c;
+  }
+  const arr = findArrayInValue(valueNode);
+  if (!arr) return null;
+  const strings = collectStringsFromArray(arr);
+  const routes = strings.filter(looksLikeRoutePattern);
+  if (routes.length === 0) return null;
+  const { intent, hint } = inferIntentFromName(nameNode.text);
+  return { name: nameNode.text, patterns: routes, intent, hint };
+}
+function extractMatchersFromObject(objNode) {
+  const out = [];
+  for (const pair of childrenOfType(objNode, "pair")) {
+    const key = childOfType(pair, "property_identifier");
+    if (!key) continue;
+    const arr = pair.children.find((c) => c.type === "array");
+    if (!arr) continue;
+    const routes = collectStringsFromArray(arr).filter(looksLikeRoutePattern);
+    if (routes.length === 0) continue;
+    const { intent, hint } = inferIntentFromName(key.text);
+    out.push({ name: key.text, patterns: routes, intent, hint });
+  }
+  return out;
+}
+function detectFallthroughProtect(root) {
+  const text = root.text;
+  const signals = [
+    /\bauth\.protect\s*\(/,
+    /\bauth\(\)\.protect\s*\(/,
+    /\bredirect\s*\(\s*['"`]\/(sign-?in|log-?in|auth)/i,
+    /\bNextResponse\.redirect\s*\(/,
+    /\bthrow\s+new\s+\w*Unauthorized/i
+  ];
+  return signals.some((re) => re.test(text));
+}
+function extractMiddlewareAuthTS(absPath) {
+  if (!require("node:fs").existsSync(absPath)) return null;
+  const tree = parseSource(absPath);
+  const root = tree.rootNode;
+  const matchers = [];
+  for (const stmt of root.children) {
+    if (stmt.type !== "lexical_declaration" && stmt.type !== "variable_declaration") continue;
+    for (const decl of childrenOfType(stmt, "variable_declarator")) {
+      const m = extractMatcherFromDeclarator(decl);
+      if (m) matchers.push(m);
+      let valueNode;
+      for (const c of decl.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+    }
+  }
+  for (const stmt of root.children) {
+    if (stmt.type !== "export_statement") continue;
+    const decl = childOfType(stmt, "lexical_declaration") ?? childOfType(stmt, "variable_declaration");
+    if (!decl) continue;
+    for (const d of childrenOfType(decl, "variable_declarator")) {
+      let valueNode;
+      for (const c of d.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+      const m = extractMatcherFromDeclarator(d);
+      if (m && !matchers.some((x) => x.name === m.name && x.patterns.join() === m.patterns.join())) {
+        matchers.push(m);
+      }
+    }
+  }
+  return {
+    file: absPath,
+    matchers,
+    hasFallthroughProtect: detectFallthroughProtect(root)
+  };
+}
+function middlewarePatternToRegex(pattern) {
+  if (/\(\?\!/.test(pattern)) return null;
+  if (pattern.startsWith("(")) return null;
+  let src = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "(" && pattern.slice(i, i + 4) === "(.*)") {
+      src += ".*";
+      i += 4;
+      continue;
+    }
+    if (ch === ":") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      src += "[^/]+";
+      continue;
+    }
+    if (ch === "*") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      if (pattern[i] === "?") {
+        i++;
+        src += ".*";
+        continue;
+      }
+      src += ".+";
+      continue;
+    }
+    if (/[.\\+?^${}()|[\]]/.test(ch)) {
+      src += "\\" + ch;
+      i++;
+      continue;
+    }
+    src += ch;
+    i++;
+  }
+  src += "$";
+  try {
+    return new RegExp(src);
+  } catch {
+    return null;
+  }
+}
+function classifyRouteAgainstMiddleware(routePath, info) {
+  for (const m of info.matchers) {
+    if (m.intent === "ambiguous") continue;
+    for (const pat of m.patterns) {
+      const re = middlewarePatternToRegex(pat);
+      if (!re) continue;
+      if (re.test(routePath)) return { intent: m.intent, matcher: m.name, pattern: pat };
+    }
+  }
+  return null;
+}
 function trunc(s, max = 120) {
   return s.length > max ? s.slice(0, max) + "..." : s;
 }
@@ -958,7 +1130,7 @@ function extractDeep(absPath) {
   }
   return { elements, stateVars, conditions, variables, responses, params };
 }
-var import_node_fs5, import_node_path5, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS;
+var import_node_fs5, import_node_path5, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
@@ -997,6 +1169,29 @@ var init_ts_extractor = __esm({
       { module: /^@auth\//, helpers: ["auth"] },
       { module: /^@supabase\/auth-helpers/, helpers: ["createServerClient"] }
     ];
+    EXEMPT_NAME_PATTERNS = [
+      /^is_?public/i,
+      /^public_?routes?/i,
+      /^public_?paths?/i,
+      /^whitelist/i,
+      /^allowlist/i,
+      /^unauthenticated/i,
+      /^anonymous/i,
+      /^guest/i,
+      /^skip_?auth/i,
+      /^bypass/i
+    ];
+    PROTECT_NAME_PATTERNS = [
+      /^is_?protected/i,
+      /^protected_?routes?/i,
+      /^protected_?paths?/i,
+      /^require_?auth/i,
+      /^auth_?required/i,
+      /^private_?routes?/i,
+      /^is_?admin/i,
+      /^admin_?routes?/i,
+      /^secured/i
+    ];
   }
 });
 
@@ -1540,43 +1735,169 @@ function generate(rootDir) {
     nodeIdSet.add(externalId);
     uiEdges.push(...edgesFromThis);
   }
+  const tablesByFile = /* @__PURE__ */ new Map();
+  const allDbNodes = [...apiNodes, ...uiNodes];
+  for (const node of allDbNodes) {
+    const calls = node._dbCalls;
+    if (!calls || calls.length === 0) continue;
+    const map = /* @__PURE__ */ new Map();
+    for (const c of calls) {
+      const key = `${c.kind}:${c.model}:${c.isMutation ? "m" : "r"}`;
+      if (!map.has(key)) {
+        map.set(key, { model: c.model, method: c.method, isMutation: c.isMutation, kind: c.kind, via: [] });
+      }
+    }
+    tablesByFile.set(node.id, map);
+  }
+  const reverseRuntimeImports = /* @__PURE__ */ new Map();
+  for (const edge of uiEdges) {
+    if (edge.type !== "imports" && edge.type !== "renders") continue;
+    if (!reverseRuntimeImports.has(edge.target)) {
+      reverseRuntimeImports.set(edge.target, /* @__PURE__ */ new Set());
+    }
+    reverseRuntimeImports.get(edge.target).add(edge.source);
+  }
+  let changed = true;
+  let iterations = 0;
+  while (changed && iterations < 50) {
+    changed = false;
+    iterations++;
+    for (const [target, tableMap] of [...tablesByFile]) {
+      const importers = reverseRuntimeImports.get(target);
+      if (!importers) continue;
+      for (const importer of importers) {
+        if (importer === target) continue;
+        let importerMap = tablesByFile.get(importer);
+        if (!importerMap) {
+          importerMap = /* @__PURE__ */ new Map();
+          tablesByFile.set(importer, importerMap);
+        }
+        for (const [key, call] of tableMap) {
+          if (importerMap.has(key)) continue;
+          importerMap.set(key, {
+            model: call.model,
+            method: null,
+            isMutation: call.isMutation,
+            kind: call.kind,
+            via: [...call.via, target]
+          });
+          changed = true;
+        }
+      }
+    }
+  }
+  for (const node of apiNodes) {
+    const map = tablesByFile.get(node.id);
+    if (!map) continue;
+    node.db_models = [...new Set([...map.values()].map((c) => c.model))];
+    node.db_operations = [...new Set(
+      [...map.values()].filter((c) => c.via.length === 0 && c.method).map((c) => `${c.model}.${c.method}`)
+    )];
+    node.mutates = [...map.values()].some((c) => c.isMutation);
+  }
   const apiCrossRefs = [];
   for (const node of apiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
       const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
-      if (seenModels.has(target)) continue;
-      seenModels.add(target);
-      apiCrossRefs.push({
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
         target,
-        type: call.isMutation ? "mutates" : "reads",
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      apiCrossRefs.push(ref);
     }
     delete node._dbCalls;
   }
   const uiCrossRefs = [];
   for (const node of uiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      if (node._dbCalls) delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
       const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
-      if (seenModels.has(target)) continue;
-      seenModels.add(target);
-      uiCrossRefs.push({
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
         target,
-        type: call.isMutation ? "mutates" : "reads",
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      uiCrossRefs.push(ref);
     }
-    delete node._dbCalls;
+    if (node._dbCalls) delete node._dbCalls;
   }
   uiCrossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  const middlewareInfos = [];
+  for (const conv of paths.conventionFiles) {
+    if (!/middleware\.tsx?$/.test(conv)) continue;
+    try {
+      const info = extractMiddlewareAuthTS(conv);
+      if (info && info.matchers.length > 0) middlewareInfos.push(info);
+    } catch {
+    }
+  }
+  if (middlewareInfos.length > 0) {
+    let setAuth2 = function(node, newTags, replaceAll) {
+      const existing = node.auth ?? [];
+      const meaningful = existing.filter((a) => a !== "public");
+      const merged = replaceAll ? newTags : [.../* @__PURE__ */ new Set([...newTags, ...meaningful])];
+      node.auth = merged.length > 0 ? merged : ["public"];
+    }, applyMiddleware2 = function(node, routePath) {
+      let resolved = null;
+      let label = "";
+      let hasAnyExemptMatcher = false;
+      let hasAnyFallthrough = false;
+      for (const info of middlewareInfos) {
+        if (info.hasFallthroughProtect) hasAnyFallthrough = true;
+        if (info.matchers.some((m) => m.intent === "exempt")) hasAnyExemptMatcher = true;
+        const c = classifyRouteAgainstMiddleware(routePath, info);
+        if (!c) continue;
+        if (!resolved) {
+          resolved = c.intent;
+          label = c.matcher;
+        }
+      }
+      if (resolved === "exempt") {
+        setAuth2(node, ["public"], true);
+        return;
+      }
+      if (resolved === "protect") {
+        setAuth2(node, [`middleware:${label}`], false);
+        return;
+      }
+      if (hasAnyExemptMatcher && hasAnyFallthrough) {
+        setAuth2(node, ["middleware-protected"], false);
+      }
+    };
+    var setAuth = setAuth2, applyMiddleware = applyMiddleware2;
+    for (const node of apiNodes) {
+      const routePath = node.path;
+      if (!routePath) continue;
+      applyMiddleware2(node, routePath);
+    }
+    for (const node of uiNodes) {
+      const route = node.route;
+      if (!route) continue;
+      applyMiddleware2(node, route);
+    }
+  }
   const apiNodeIds = new Set(apiNodes.map((n) => n.id));
   const apiEdges = [];
   const uiOnlyEdges = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchsecure/launch-kit",
-  "version": "0.0.24",
+  "version": "0.0.25",
   "description": "LaunchSecure toolkit — launch-pod (pipeline), launch-chart (project graph MCP), launch-deck (visual playground MCP).",
   "license": "MIT",
   "author": "LaunchSecure - AutomateWithUs",