@launchsecure/launch-kit 0.0.24 → 0.0.26

package/dist/server/chart-serve.js

@@ -57,14 +57,20 @@ var init_config = __esm({
 // src/server/graph/core/ts-extractor.ts
 var ts_extractor_exports = {};
 __export(ts_extractor_exports, {
+  ParseCascadeError: () => ParseCascadeError,
   classifyFile: () => classifyFile,
+  classifyRouteAgainstMiddleware: () => classifyRouteAgainstMiddleware,
   createQuery: () => createQuery,
   extractAuthWrappersTS: () => extractAuthWrappersTS,
   extractDbCallsTS: () => extractDbCallsTS,
   extractDeep: () => extractDeep,
+  extractEffects: () => extractEffects,
+  extractMiddlewareAuthTS: () => extractMiddlewareAuthTS,
   initTreeSitter: () => initTreeSitter,
+  middlewarePatternToRegex: () => middlewarePatternToRegex,
   parseCodeTS: () => parseCodeTS,
   parseFileTS: () => parseFileTS,
+  parseSource: () => parseSource,
   setExtractorConfig: () => setExtractorConfig
 });
 async function initTreeSitter() {
@@ -98,8 +104,38 @@ function getQuery(name) {
 }
 function parseSource(absPath) {
   ensureInit();
-  const content = (0, import_node_fs4.readFileSync)(absPath, "utf-8");
-  return parserInstance.parse(content);
+  let content;
+  try {
+    const stat = (0, import_node_fs4.statSync)(absPath);
+    if (stat.size > MAX_PARSEABLE_BYTES) {
+      process.stderr.write(`[lc-extractor] skipping ${absPath}: ${stat.size} bytes exceeds max ${MAX_PARSEABLE_BYTES}
+`);
+      return null;
+    }
+    content = (0, import_node_fs4.readFileSync)(absPath, "utf-8");
+  } catch (e) {
+    process.stderr.write(`[lc-extractor] read failed for ${absPath}: ${e instanceof Error ? e.message : String(e)}
+`);
+    return null;
+  }
+  try {
+    const tree = parserInstance.parse(content);
+    consecutiveParseFailures = 0;
+    return tree;
+  } catch (e) {
+    consecutiveParseFailures++;
+    const msg = e instanceof Error ? e.message : String(e);
+    process.stderr.write(
+      `[lc-extractor] parse failed for ${absPath}: ${msg} (consecutive failures: ${consecutiveParseFailures}/${MAX_CONSECUTIVE_PARSE_FAILURES})
+`
+    );
+    if (consecutiveParseFailures >= MAX_CONSECUTIVE_PARSE_FAILURES) {
+      const tripCount = consecutiveParseFailures;
+      consecutiveParseFailures = 0;
+      throw new ParseCascadeError(absPath, tripCount);
+    }
+    return null;
+  }
 }
 function parseCodeTS(code) {
   ensureInit();
@@ -139,8 +175,20 @@ function childrenOfType(node, type) {
 function childOfType(node, type) {
   return node.children.find((n) => n.type === type);
 }
+function emptyParsedFile(absPath) {
+  return {
+    name: absPath.split("/").pop() ?? absPath,
+    exports: [],
+    imports: [],
+    reExports: [],
+    jsxElements: /* @__PURE__ */ new Set(),
+    navigations: [],
+    fetchCalls: []
+  };
+}
 function parseFileTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return emptyParsedFile(absPath);
   const root = tree.rootNode;
   const imports = [];
   const importStatements = childrenOfType(root, "import_statement");
@@ -335,6 +383,7 @@ function parseFileTS(absPath) {
 }
 function extractDbCallsTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return [];
   const root = tree.rootNode;
   const dbQuery = getQuery("db-calls");
   const matches = dbQuery.matches(root);
@@ -395,7 +444,9 @@ function classifyFile(absPath) {
   const fileName = require("path").basename(absPath);
   if (fileName.includes(".test.") || fileName.includes(".spec.") || fileName.includes("__test")) return "test";
   if (fileName.includes(".stories.")) return "story";
+  if (fileName === "middleware.ts" || fileName === "middleware.tsx") return "middleware";
   const tree = parseSource(absPath);
+  if (!tree) return "util";
   const root = tree.rootNode;
   const classifyQuery = getQuery("classify");
   const captures = classifyQuery.captures(root);
@@ -414,6 +465,7 @@ function classifyFile(absPath) {
 }
 function extractAuthWrappersTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return /* @__PURE__ */ new Set();
   const root = tree.rootNode;
   const wrapperQuery = getQuery("wrappers");
   const matches = wrapperQuery.matches(root);
@@ -456,11 +508,354 @@ function extractAuthWrappersTS(absPath) {
   }
   return wrappers;
 }
+function inferIntentFromName(name) {
+  if (TRUST_AS_PROTECT_KEYS.has(name)) {
+    return { intent: "protect", hint: `Next.js config.${name} \u2014 paths matched run through middleware` };
+  }
+  for (const re of EXEMPT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "exempt", hint: `name "${name}" matches /${re.source}/` };
+  }
+  for (const re of PROTECT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "protect", hint: `name "${name}" matches /${re.source}/` };
+  }
+  return { intent: "ambiguous", hint: `name "${name}" has no exempt/protect signal` };
+}
+function looksLikeRoutePattern(s) {
+  return s.startsWith("/") && !s.startsWith("//");
+}
+function collectStringsFromArray(arrNode) {
+  const out = [];
+  for (const child of arrNode.children) {
+    if (child.type !== "string") continue;
+    const frag = childOfType(child, "string_fragment");
+    if (frag) out.push(frag.text);
+  }
+  return out;
+}
+function findArrayInValue(valueNode) {
+  if (!valueNode) return null;
+  if (valueNode.type === "array") return valueNode;
+  if (valueNode.type === "call_expression") {
+    const args = childOfType(valueNode, "arguments");
+    if (!args) return null;
+    for (const c of args.children) {
+      if (c.type === "array") return c;
+    }
+  }
+  return null;
+}
+function extractMatcherFromDeclarator(decl) {
+  const nameNode = childOfType(decl, "identifier");
+  if (!nameNode) return null;
+  let valueNode;
+  for (const c of decl.children) {
+    if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+    valueNode = c;
+  }
+  const arr = findArrayInValue(valueNode);
+  if (!arr) return null;
+  const strings = collectStringsFromArray(arr);
+  const routes = strings.filter(looksLikeRoutePattern);
+  if (routes.length === 0) return null;
+  const { intent, hint } = inferIntentFromName(nameNode.text);
+  return { name: nameNode.text, patterns: routes, intent, hint };
+}
+function extractMatchersFromObject(objNode) {
+  const out = [];
+  for (const pair of childrenOfType(objNode, "pair")) {
+    const key = childOfType(pair, "property_identifier");
+    if (!key) continue;
+    const arr = pair.children.find((c) => c.type === "array");
+    if (!arr) continue;
+    const routes = collectStringsFromArray(arr).filter(looksLikeRoutePattern);
+    if (routes.length === 0) continue;
+    const { intent, hint } = inferIntentFromName(key.text);
+    out.push({ name: key.text, patterns: routes, intent, hint });
+  }
+  return out;
+}
+function detectFallthroughProtect(root) {
+  const text = root.text;
+  const signals = [
+    /\bauth\.protect\s*\(/,
+    /\bauth\(\)\.protect\s*\(/,
+    /\bredirect\s*\(\s*['"`]\/(sign-?in|log-?in|auth)/i,
+    /\bNextResponse\.redirect\s*\(/,
+    /\bthrow\s+new\s+\w*Unauthorized/i
+  ];
+  return signals.some((re) => re.test(text));
+}
+function extractMiddlewareAuthTS(absPath) {
+  if (!require("node:fs").existsSync(absPath)) return null;
+  const tree = parseSource(absPath);
+  if (!tree) return null;
+  const root = tree.rootNode;
+  const matchers = [];
+  for (const stmt of root.children) {
+    if (stmt.type !== "lexical_declaration" && stmt.type !== "variable_declaration") continue;
+    for (const decl of childrenOfType(stmt, "variable_declarator")) {
+      const m = extractMatcherFromDeclarator(decl);
+      if (m) matchers.push(m);
+      let valueNode;
+      for (const c of decl.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+    }
+  }
+  for (const stmt of root.children) {
+    if (stmt.type !== "export_statement") continue;
+    const decl = childOfType(stmt, "lexical_declaration") ?? childOfType(stmt, "variable_declaration");
+    if (!decl) continue;
+    for (const d of childrenOfType(decl, "variable_declarator")) {
+      let valueNode;
+      for (const c of d.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+      const m = extractMatcherFromDeclarator(d);
+      if (m && !matchers.some((x) => x.name === m.name && x.patterns.join() === m.patterns.join())) {
+        matchers.push(m);
+      }
+    }
+  }
+  return {
+    file: absPath,
+    matchers,
+    hasFallthroughProtect: detectFallthroughProtect(root)
+  };
+}
+function middlewarePatternToRegex(pattern) {
+  const negLookaheadMatch = /^(\/?)\(\(\?\!([^)]+)\)(\.\*|\.\+)\)$/.exec(pattern);
+  if (negLookaheadMatch) {
+    const [, lead, altsRaw, body] = negLookaheadMatch;
+    const escapedAlts = altsRaw.split("|").map((alt) => alt.trim().replace(/[.+*?^${}()|[\]\\]/g, "\\$&")).join("|");
+    try {
+      return new RegExp(`^${lead}(?!${escapedAlts})${body}$`);
+    } catch {
+      return null;
+    }
+  }
+  if (/\(\?\!/.test(pattern)) return null;
+  if (pattern.startsWith("(")) return null;
+  let src = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "(" && pattern.slice(i, i + 4) === "(.*)") {
+      src += ".*";
+      i += 4;
+      continue;
+    }
+    if (ch === ":") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      src += "[^/]+";
+      continue;
+    }
+    if (ch === "*") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      if (pattern[i] === "?") {
+        i++;
+        src += ".*";
+        continue;
+      }
+      src += ".+";
+      continue;
+    }
+    if (/[.\\+?^${}()|[\]]/.test(ch)) {
+      src += "\\" + ch;
+      i++;
+      continue;
+    }
+    src += ch;
+    i++;
+  }
+  src += "$";
+  try {
+    return new RegExp(src);
+  } catch {
+    return null;
+  }
+}
+function classifyRouteAgainstMiddleware(routePath, info) {
+  for (const m of info.matchers) {
+    if (m.intent === "ambiguous") continue;
+    for (const pat of m.patterns) {
+      const re = middlewarePatternToRegex(pat);
+      if (!re) continue;
+      if (re.test(routePath)) return { intent: m.intent, matcher: m.name, pattern: pat };
+    }
+  }
+  return null;
+}
 function trunc(s, max = 120) {
   return s.length > max ? s.slice(0, max) + "..." : s;
 }
+function dedup(arr) {
+  return Array.from(new Set(arr));
+}
+function firstStringArg(callExpr) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return null;
+  for (const c of args.namedChildren) {
+    if (c.type === "string") {
+      const frag = c.namedChildren.find((cc) => cc.type === "string_fragment");
+      return frag ? frag.text : c.text.replace(/^['"`]|['"`]$/g, "");
+    }
+    if (c.type === "template_string") {
+      return c.text.replace(/^`|`$/g, "");
+    }
+  }
+  return null;
+}
+function isFunctionLike(node) {
+  return node.type === "arrow_function" || node.type === "function_expression" || node.type === "function_declaration" || node.type === "method_definition" || node.type === "generator_function" || node.type === "generator_function_declaration";
+}
+function stringLiteralValue(n) {
+  if (n.type !== "string") return null;
+  const frag = n.namedChildren.find((c) => c.type === "string_fragment");
+  if (frag) return frag.text;
+  return n.text.replace(/^['"`]|['"`]$/g, "");
+}
+function nthStringArg(callExpr, idx) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return null;
+  const child = args.namedChildren[idx];
+  return child ? stringLiteralValue(child) : null;
+}
+function objectArgIdValues(callExpr) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return [];
+  const out = [];
+  for (const arg of args.namedChildren) {
+    if (arg.type !== "object") continue;
+    for (const pair of arg.namedChildren) {
+      if (pair.type !== "pair") continue;
+      const key = pair.childForFieldName("key");
+      const val = pair.childForFieldName("value");
+      if (!key || !val) continue;
+      const keyText = key.type === "property_identifier" ? key.text : stringLiteralValue(key) ?? key.text;
+      if (keyText !== "id") continue;
+      const strVal = stringLiteralValue(val);
+      if (strVal) out.push(strVal);
+    }
+  }
+  return out;
+}
+function extractEffects(node, moduleOnly = false) {
+  const calls = [];
+  const dom_writes = [];
+  const subscribes = [];
+  const timers = [];
+  const persists = [];
+  const fetches = [];
+  const globals = [];
+  const dom_ids = [];
+  const window_events = [];
+  const storage_keys = [];
+  const fetch_urls = [];
+  function visit(n, depth) {
+    if (moduleOnly && depth > 0 && isFunctionLike(n)) return;
+    if (n.type === "call_expression") {
+      const fn = n.childForFieldName("function");
+      if (fn) {
+        const fnText = fn.text;
+        calls.push(fnText);
+        for (const id of objectArgIdValues(n)) dom_ids.push(id);
+        if (fn.type === "identifier") {
+          if (TIMER_FNS.has(fnText)) timers.push(fnText);
+          if (fnText === "fetch") {
+            const url = firstStringArg(n);
+            fetches.push(url ? `fetch("${url}")` : "fetch(...)");
+            if (url) fetch_urls.push(url);
+          }
+        } else if (fn.type === "member_expression") {
+          const obj = fn.childForFieldName("object");
+          const prop = fn.childForFieldName("property");
+          const objText = obj?.text ?? "";
+          const propText = prop?.text ?? "";
+          if (STORAGE_OBJECTS.has(objText)) {
+            const key = firstStringArg(n);
+            persists.push(key ? `${objText}.${propText}("${key}")` : `${objText}.${propText}(\u2026)`);
+            if (key) storage_keys.push(key);
+          } else if (propText === "addEventListener") {
+            const event = firstStringArg(n);
+            subscribes.push(event ? `${objText}.addEventListener("${event}")` : `${objText}.addEventListener(\u2026)`);
+            if (event && (objText === "window" || objText === "document")) {
+              window_events.push(`${objText}:${event}`);
+            }
+          } else if (propText === "removeEventListener") {
+            const event = firstStringArg(n);
+            subscribes.push(event ? `${objText}.removeEventListener("${event}")` : `${objText}.removeEventListener(\u2026)`);
+          } else if (propText === "subscribe" || propText === "on") {
+            subscribes.push(`${objText}.${propText}(\u2026)`);
+          } else if (DOM_METHOD_NAMES.has(propText)) {
+            dom_writes.push(`${objText}.${propText}(\u2026)`);
+            if (propText === "setAttribute" && nthStringArg(n, 0) === "id") {
+              const idVal = nthStringArg(n, 1);
+              if (idVal) dom_ids.push(idVal);
+            }
+          } else if (objText.endsWith(".classList") && CLASSLIST_METHODS.has(propText)) {
+            dom_writes.push(`${objText}.${propText}(\u2026)`);
+          } else if (objText === "history" && HISTORY_METHODS.has(propText)) {
+            globals.push(`history.${propText}(\u2026)`);
+          } else if (objText === "location" && LOCATION_METHODS.has(propText)) {
+            globals.push(`location.${propText}(\u2026)`);
+          } else if (objText === "window" && propText === "matchMedia") {
+            globals.push("window.matchMedia(\u2026)");
+          }
+        }
+      }
+    } else if (n.type === "assignment_expression") {
+      const lhs = n.children.find((c) => c.type !== "=");
+      const rhs = n.childForFieldName("right");
+      if (lhs?.type === "member_expression") {
+        const prop = lhs.childForFieldName("property");
+        const propText = prop?.text ?? "";
+        const lhsText = lhs.text;
+        if (lhsText.startsWith("document.cookie")) {
+          persists.push("document.cookie =");
+        } else if (lhsText.startsWith("document.title") || lhsText.startsWith("location.")) {
+          globals.push(`${lhsText} =`);
+        } else if (ASSIGN_DOM_PROPS.has(propText) || lhsText.includes(".style.") || lhsText.includes(".dataset.")) {
+          dom_writes.push(`${lhsText} =`);
+          if (propText === "id" && rhs) {
+            const idVal = stringLiteralValue(rhs);
+            if (idVal) dom_ids.push(idVal);
+          }
+        }
+      }
+    }
+    for (const child of n.children) visit(child, depth + 1);
+  }
+  visit(node, 0);
+  const out = {};
+  if (calls.length) out.calls = dedup(calls);
+  if (dom_writes.length) out.dom_writes = dedup(dom_writes);
+  if (subscribes.length) out.subscribes = dedup(subscribes);
+  if (timers.length) out.timers = dedup(timers);
+  if (persists.length) out.persists = dedup(persists);
+  if (fetches.length) out.fetches = dedup(fetches);
+  if (globals.length) out.globals = dedup(globals);
+  if (dom_ids.length) out.dom_ids = dedup(dom_ids);
+  if (window_events.length) out.window_events = dedup(window_events);
+  if (storage_keys.length) out.storage_keys = dedup(storage_keys);
+  if (fetch_urls.length) out.fetch_urls = dedup(fetch_urls);
+  return out;
+}
 function extractDeep(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) {
+    return { elements: [], stateVars: [], conditions: [], variables: [], responses: [], params: [] };
+  }
   const root = tree.rootNode;
   const elements = [];
   const elQuery = getQuery("deep/jsx-semantic");
@@ -553,12 +948,18 @@ function extractDeep(absPath) {
     const caps = captureMap(m);
     const declNode = m.captures.find((c) => c.name === "var.decl" || c.name === "var.destructured" || c.name === "var.array")?.node;
     const kind = declNode?.children.find((n) => n.type === "const" || n.type === "let" || n.type === "var")?.type ?? "const";
+    const initNode = m.captures.find((c) => c.name === "var.init")?.node;
     if (caps["var.name"] && caps["var.init"]) {
-      variables.push({
+      const variable = {
         name: caps["var.name"],
         kind,
         init: trunc(caps["var.init"], 100)
-      });
+      };
+      if (initNode && isFunctionLike(initNode)) {
+        const eff = extractEffects(initNode);
+        if (Object.keys(eff).length > 0) variable.effects = eff;
+      }
+      variables.push(variable);
     }
     if (caps["var.destructured.obj"]) {
       variables.push({
@@ -610,9 +1011,23 @@ function extractDeep(absPath) {
       params.push({ name: caps["param.body"], source: "body" });
     }
   }
-  return { elements, stateVars, conditions, variables, responses, params };
+  const fileEffects = extractEffects(
+    root,
+    /* moduleOnly */
+    false
+  );
+  const hasEffects = Object.keys(fileEffects).length > 0;
+  return {
+    elements,
+    stateVars,
+    conditions,
+    variables,
+    responses,
+    params,
+    ...hasEffects ? { effects: fileEffects } : {}
+  };
 }
-var import_node_fs4, import_node_path4, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS;
+var import_node_fs4, import_node_path4, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, MAX_PARSEABLE_BYTES, MAX_CONSECUTIVE_PARSE_FAILURES, consecutiveParseFailures, ParseCascadeError, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS, TRUST_AS_PROTECT_KEYS, TIMER_FNS, DOM_METHOD_NAMES, CLASSLIST_METHODS, STORAGE_OBJECTS, HISTORY_METHODS, LOCATION_METHODS, ASSIGN_DOM_PROPS;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
@@ -625,6 +1040,19 @@ var init_ts_extractor = __esm({
       return (0, import_node_path4.join)((0, import_node_path4.dirname)(__filename), "graph", "queries");
     })();
     queryCache = /* @__PURE__ */ new Map();
+    MAX_PARSEABLE_BYTES = 2 * 1024 * 1024;
+    MAX_CONSECUTIVE_PARSE_FAILURES = 10;
+    consecutiveParseFailures = 0;
+    ParseCascadeError = class extends Error {
+      constructor(lastPath, failureCount) {
+        super(
+          `tree-sitter parse cascade: ${failureCount} consecutive WASM failures (last file: ${lastPath}). The shared Parser's WASM heap is likely corrupted; aborting regen so the graph isn't silently degraded. Restart the chart server to reinitialize, then re-run generate_graph.`
+        );
+        this.lastPath = lastPath;
+        this.failureCount = failureCount;
+        this.name = "ParseCascadeError";
+      }
+    };
     PRISMA_MUTATION_METHODS_BUILTIN = [
       "create",
       "createMany",
@@ -651,6 +1079,72 @@ var init_ts_extractor = __esm({
       { module: /^@auth\//, helpers: ["auth"] },
       { module: /^@supabase\/auth-helpers/, helpers: ["createServerClient"] }
     ];
+    EXEMPT_NAME_PATTERNS = [
+      /^is_?public/i,
+      /^public_?routes?/i,
+      /^public_?paths?/i,
+      /^whitelist/i,
+      /^allowlist/i,
+      /^unauthenticated/i,
+      /^anonymous/i,
+      /^guest/i,
+      /^skip_?auth/i,
+      /^bypass/i
+    ];
+    PROTECT_NAME_PATTERNS = [
+      /^is_?protected/i,
+      /^protected_?routes?/i,
+      /^protected_?paths?/i,
+      /^require_?auth/i,
+      /^auth_?required/i,
+      /^private_?routes?/i,
+      /^is_?admin/i,
+      /^admin_?routes?/i,
+      /^secured/i
+    ];
+    TRUST_AS_PROTECT_KEYS = /* @__PURE__ */ new Set(["matcher", "matchers"]);
+    TIMER_FNS = /* @__PURE__ */ new Set([
+      "setInterval",
+      "setTimeout",
+      "clearInterval",
+      "clearTimeout",
+      "requestAnimationFrame",
+      "cancelAnimationFrame",
+      "queueMicrotask"
+    ]);
+    DOM_METHOD_NAMES = /* @__PURE__ */ new Set([
+      "setAttribute",
+      "removeAttribute",
+      "appendChild",
+      "removeChild",
+      "replaceChildren",
+      "replaceWith",
+      "insertBefore",
+      "append",
+      "prepend",
+      "remove",
+      "before",
+      "after",
+      "insertAdjacentHTML",
+      "insertAdjacentElement"
+    ]);
+    CLASSLIST_METHODS = /* @__PURE__ */ new Set(["add", "remove", "toggle", "replace"]);
+    STORAGE_OBJECTS = /* @__PURE__ */ new Set(["localStorage", "sessionStorage"]);
+    HISTORY_METHODS = /* @__PURE__ */ new Set(["pushState", "replaceState", "back", "forward", "go"]);
+    LOCATION_METHODS = /* @__PURE__ */ new Set(["assign", "replace", "reload"]);
+    ASSIGN_DOM_PROPS = /* @__PURE__ */ new Set([
+      "textContent",
+      "innerHTML",
+      "innerText",
+      "value",
+      "src",
+      "href",
+      "className",
+      "id",
+      "checked",
+      "selected",
+      "disabled"
+    ]);
   }
 });
 
@@ -662,20 +1156,20 @@ __export(chart_serve_exports, {
 });
 module.exports = __toCommonJS(chart_serve_exports);
 var import_node_http = __toESM(require("node:http"));
-var import_node_fs18 = __toESM(require("node:fs"));
-var import_node_path19 = __toESM(require("node:path"));
+var import_node_fs20 = __toESM(require("node:fs"));
+var import_node_path22 = __toESM(require("node:path"));
 
 // src/server/graph/index.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path18 = require("node:path");
 
 // src/server/graph/core/graph-builder.ts
 var import_node_fs12 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_path13 = require("node:path");
 init_config();
 
 // src/server/graph/core/parser-registry.ts
-var import_node_path11 = require("node:path");
+var import_node_path12 = require("node:path");
 
 // src/server/graph/parsers/ts/typescript-project.ts
 var import_node_fs5 = require("node:fs");
@@ -691,15 +1185,9 @@ var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
 var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
-  ".git",
-  ".next",
-  ".launchsecure",
-  ".claude",
   "dist",
   "build",
   "out",
-  ".turbo",
-  ".vercel",
   "coverage"
 ]);
 function walk(dir, exts) {
@@ -721,6 +1209,7 @@ function walkWithIgnore(dir, exts, opts = {}) {
   const skip = opts.extraIgnore ? /* @__PURE__ */ new Set([...DEFAULT_IGNORE_DIRS, ...opts.extraIgnore]) : DEFAULT_IGNORE_DIRS;
   for (const entry of (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
+      if (entry.name.startsWith(".")) continue;
       if (skip.has(entry.name)) continue;
       results.push(...walkWithIgnore((0, import_node_path2.join)(dir, entry.name), exts, opts));
     } else if (exts.includes((0, import_node_path2.extname)(entry.name))) {
@@ -931,6 +1420,7 @@ var CLASSIFICATION_TO_LAYER = {
   config: "ui",
   lib: "ui",
   "mcp-tool": "ui",
+  middleware: "ui",
   external: "ui"
 };
 function toNodeId(srcDir, rootDir, absPath) {
@@ -1014,6 +1504,8 @@ function buildAllBarrelMaps(srcDir, parsedByPath) {
 function classifyType(absPath, id) {
   const contentType = classifyFile(absPath);
   if (contentType === "lib" && id.startsWith("server/mcp/")) return "mcp-tool";
+  if (/^app\/(.+\/)?page\.tsx$/.test(id)) return "page";
+  if (/^app\/(.+\/)?layout\.tsx$/.test(id)) return "layout";
   return contentType;
 }
 function extractRoute(id) {
@@ -1324,6 +1816,7 @@ function generate(rootDir) {
         variables: deep.variables,
         responses: deep.responses,
         params: deep.params,
+        ...deep.effects ? { effects: deep.effects } : {},
         _dbCalls: dbCalls
         // temp: used for cross-ref building below
       });
@@ -1343,6 +1836,7 @@ function generate(rootDir) {
         stateVars: deep.stateVars,
         conditions: deep.conditions,
         variables: deep.variables,
+        ...deep.effects ? { effects: deep.effects } : {},
         ...authWrappers.length > 0 ? { auth: authWrappers } : {},
         ...dbCalls.length > 0 ? { _dbCalls: dbCalls } : {}
       });
@@ -1472,43 +1966,169 @@ function generate(rootDir) {
     nodeIdSet.add(externalId);
     uiEdges.push(...edgesFromThis);
   }
+  const tablesByFile = /* @__PURE__ */ new Map();
+  const allDbNodes = [...apiNodes, ...uiNodes];
+  for (const node of allDbNodes) {
+    const calls = node._dbCalls;
+    if (!calls || calls.length === 0) continue;
+    const map = /* @__PURE__ */ new Map();
+    for (const c of calls) {
+      const key = `${c.kind}:${c.model}:${c.isMutation ? "m" : "r"}`;
+      if (!map.has(key)) {
+        map.set(key, { model: c.model, method: c.method, isMutation: c.isMutation, kind: c.kind, via: [] });
+      }
+    }
+    tablesByFile.set(node.id, map);
+  }
+  const reverseRuntimeImports = /* @__PURE__ */ new Map();
+  for (const edge of uiEdges) {
+    if (edge.type !== "imports" && edge.type !== "renders") continue;
+    if (!reverseRuntimeImports.has(edge.target)) {
+      reverseRuntimeImports.set(edge.target, /* @__PURE__ */ new Set());
+    }
+    reverseRuntimeImports.get(edge.target).add(edge.source);
+  }
+  let changed = true;
+  let iterations = 0;
+  while (changed && iterations < 50) {
+    changed = false;
+    iterations++;
+    for (const [target, tableMap] of [...tablesByFile]) {
+      const importers = reverseRuntimeImports.get(target);
+      if (!importers) continue;
+      for (const importer of importers) {
+        if (importer === target) continue;
+        let importerMap = tablesByFile.get(importer);
+        if (!importerMap) {
+          importerMap = /* @__PURE__ */ new Map();
+          tablesByFile.set(importer, importerMap);
+        }
+        for (const [key, call] of tableMap) {
+          if (importerMap.has(key)) continue;
+          importerMap.set(key, {
+            model: call.model,
+            method: null,
+            isMutation: call.isMutation,
+            kind: call.kind,
+            via: [...call.via, target]
+          });
+          changed = true;
+        }
+      }
+    }
+  }
+  for (const node of apiNodes) {
+    const map = tablesByFile.get(node.id);
+    if (!map) continue;
+    node.db_models = [...new Set([...map.values()].map((c) => c.model))];
+    node.db_operations = [...new Set(
+      [...map.values()].filter((c) => c.via.length === 0 && c.method).map((c) => `${c.model}.${c.method}`)
+    )];
+    node.mutates = [...map.values()].some((c) => c.isMutation);
+  }
   const apiCrossRefs = [];
   for (const node of apiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
       const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
-      if (seenModels.has(target)) continue;
-      seenModels.add(target);
-      apiCrossRefs.push({
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
         target,
-        type: call.isMutation ? "mutates" : "reads",
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      apiCrossRefs.push(ref);
     }
     delete node._dbCalls;
   }
   const uiCrossRefs = [];
   for (const node of uiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      if (node._dbCalls) delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
       const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
-      if (seenModels.has(target)) continue;
-      seenModels.add(target);
-      uiCrossRefs.push({
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
         target,
-        type: call.isMutation ? "mutates" : "reads",
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      uiCrossRefs.push(ref);
     }
-    delete node._dbCalls;
+    if (node._dbCalls) delete node._dbCalls;
   }
   uiCrossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  const middlewareInfos = [];
+  for (const conv of paths.conventionFiles) {
+    if (!/middleware\.tsx?$/.test(conv)) continue;
+    try {
+      const info = extractMiddlewareAuthTS(conv);
+      if (info && info.matchers.length > 0) middlewareInfos.push(info);
+    } catch {
+    }
+  }
+  if (middlewareInfos.length > 0) {
+    let setAuth2 = function(node, newTags, replaceAll) {
+      const existing = node.auth ?? [];
+      const meaningful = existing.filter((a) => a !== "public");
+      const merged = replaceAll ? newTags : [.../* @__PURE__ */ new Set([...newTags, ...meaningful])];
+      node.auth = merged.length > 0 ? merged : ["public"];
+    }, applyMiddleware2 = function(node, routePath) {
+      let resolved = null;
+      let label = "";
+      let hasAnyExemptMatcher = false;
+      let hasAnyFallthrough = false;
+      for (const info of middlewareInfos) {
+        if (info.hasFallthroughProtect) hasAnyFallthrough = true;
+        if (info.matchers.some((m) => m.intent === "exempt")) hasAnyExemptMatcher = true;
+        const c = classifyRouteAgainstMiddleware(routePath, info);
+        if (!c) continue;
+        if (!resolved) {
+          resolved = c.intent;
+          label = c.matcher;
+        }
+      }
+      if (resolved === "exempt") {
+        setAuth2(node, ["public"], true);
+        return;
+      }
+      if (resolved === "protect") {
+        setAuth2(node, [`middleware:${label}`], false);
+        return;
+      }
+      if (hasAnyExemptMatcher && hasAnyFallthrough) {
+        setAuth2(node, ["middleware-protected"], false);
+      }
+    };
+    var setAuth = setAuth2, applyMiddleware = applyMiddleware2;
+    for (const node of apiNodes) {
+      const routePath = node.path;
+      if (!routePath) continue;
+      applyMiddleware2(node, routePath);
+    }
+    for (const node of uiNodes) {
+      const route = node.route;
+      if (!route) continue;
+      applyMiddleware2(node, route);
+    }
+  }
   const apiNodeIds = new Set(apiNodes.map((n) => n.id));
   const apiEdges = [];
   const uiOnlyEdges = [];
@@ -3487,6 +4107,112 @@ var staticRefScannerParser = {
   }
 };
 
+// src/server/graph/parsers/crosslayer/middleware-gates.ts
+var import_node_path11 = require("node:path");
+init_ts_extractor();
+init_config();
+function toNodeId4(srcDir, rootDir, absPath) {
+  const relFromSrc = (0, import_node_path11.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path11.relative)(rootDir, absPath).replace(/\\/g, "/");
+  }
+  return relFromSrc;
+}
+function collectTargets(apiOutput, uiOutput) {
+  const out = [];
+  for (const n of apiOutput?.nodes ?? []) {
+    if (n.type !== "endpoint") continue;
+    const path2 = n.path;
+    if (typeof path2 !== "string" || !path2) continue;
+    out.push({ id: n.id, route: path2, layer: "api" });
+  }
+  for (const n of uiOutput?.nodes ?? []) {
+    if (n.type !== "page") continue;
+    const route = n.route;
+    if (typeof route !== "string" || !route) continue;
+    out.push({ id: n.id, route, layer: "ui" });
+  }
+  return out;
+}
+var middlewareGatesParser = {
+  id: "middleware-gates",
+  layer: "crosslayer",
+  concern: "auth-gate",
+  detect(rootDir) {
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    if (!paths) return false;
+    return paths.conventionFiles.some((f) => /middleware\.tsx?$/.test(f));
+  },
+  generate(rootDir, layerOutputs) {
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    if (!paths) return { cross_refs: [], flagged_edges: [], warnings: [] };
+    const middlewareFiles = paths.conventionFiles.filter((f) => /middleware\.tsx?$/.test(f));
+    if (middlewareFiles.length === 0) {
+      return { cross_refs: [], flagged_edges: [], warnings: [] };
+    }
+    const apiOutput = layerOutputs.get("api");
+    const uiOutput = layerOutputs.get("ui");
+    const targets = collectTargets(apiOutput, uiOutput);
+    const crossRefs = [];
+    const flagged = [];
+    const seenEdge = /* @__PURE__ */ new Set();
+    const seenUnparseable = /* @__PURE__ */ new Set();
+    let protectMatcherCount = 0;
+    for (const file of middlewareFiles) {
+      let info = null;
+      try {
+        info = extractMiddlewareAuthTS(file);
+      } catch {
+      }
+      if (!info || info.matchers.length === 0) continue;
+      const middlewareId = toNodeId4(paths.srcDir, rootDir, file);
+      for (const matcher of info.matchers) {
+        if (matcher.intent !== "protect") continue;
+        protectMatcherCount += 1;
+        for (const pattern of matcher.patterns) {
+          const re = middlewarePatternToRegex(pattern);
+          if (!re) {
+            const key = `${middlewareId}|${pattern}`;
+            if (seenUnparseable.has(key)) continue;
+            seenUnparseable.add(key);
+            flagged.push({
+              source: middlewareId,
+              target: "UNRESOLVED",
+              type: "middleware_pattern_unparseable",
+              label: `pattern "${pattern}" in matcher "${matcher.name}" \u2014 coverage unknown`,
+              confidence: "high"
+            });
+            continue;
+          }
+          for (const target of targets) {
+            if (!re.test(target.route)) continue;
+            const key = `${middlewareId}|${target.id}|protects`;
+            if (seenEdge.has(key)) continue;
+            seenEdge.add(key);
+            crossRefs.push({
+              source: middlewareId,
+              target: target.id,
+              type: "protects",
+              layer: target.layer
+            });
+          }
+        }
+      }
+    }
+    return {
+      cross_refs: crossRefs,
+      flagged_edges: flagged,
+      warnings: [],
+      patterns: {
+        middleware_files: middlewareFiles.length,
+        protect_matchers: protectMatcherCount,
+        protects_edges: crossRefs.length,
+        unparseable_patterns: flagged.length
+      }
+    };
+  }
+};
+
 // src/server/graph/core/parser-registry.ts
 function isMultiLayerParser(p) {
   return "layers" in p && Array.isArray(p.layers);
@@ -3552,7 +4278,8 @@ function registerBuiltins(registry, disabled) {
     fetchResolverParser,
     apiAnnotationsParser,
     urlLiteralScannerParser,
-    staticRefScannerParser
+    staticRefScannerParser,
+    middlewareGatesParser
   ];
   for (const parser of builtins) {
     if (disabled.has(parser.id)) continue;
@@ -3562,7 +4289,7 @@ function registerBuiltins(registry, disabled) {
 function loadCustomParsers(registry, config, rootDir, disabled) {
   for (const entry of config.parsers?.custom ?? []) {
     try {
-      const absPath = (0, import_node_path11.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path12.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const parser = "default" in mod ? mod.default : mod;
       if (disabled.has(parser.id)) continue;
@@ -3692,7 +4419,7 @@ function applyCrossLayerResults(uiOutput, results) {
 
 // src/server/graph/core/graph-builder.ts
 function readGraphFromDisk(rootDir, layer) {
-  const filePath = (0, import_node_path12.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  const filePath = (0, import_node_path13.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
   if (!(0, import_node_fs12.existsSync)(filePath)) return null;
   try {
     return JSON.parse((0, import_node_fs12.readFileSync)(filePath, "utf-8"));
@@ -3796,11 +4523,11 @@ function generateAll(rootDir) {
 init_config();
 
 // src/server/graph/core/tagger-registry.ts
-var import_node_path14 = require("node:path");
+var import_node_path15 = require("node:path");
 
 // src/server/graph/taggers/module-tagger.ts
 var import_node_fs13 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_path14 = require("node:path");
 function matchGlob(pattern, id) {
   const patParts = pattern.split("/");
   const idParts = id.split("/");
@@ -3833,13 +4560,13 @@ function detectConventionDirs(rootDir, extraConventionDirs = []) {
   const conventionDirs = [...CONVENTION_DIRS_BUILTIN, ...extraConventionDirs];
   const searchDirs = [
     rootDir,
-    (0, import_node_path13.join)(rootDir, "src"),
-    (0, import_node_path13.join)(rootDir, "app"),
-    (0, import_node_path13.join)(rootDir, "lib")
+    (0, import_node_path14.join)(rootDir, "src"),
+    (0, import_node_path14.join)(rootDir, "app"),
+    (0, import_node_path14.join)(rootDir, "lib")
   ];
   for (const base of searchDirs) {
     for (const convention of conventionDirs) {
-      const dir = (0, import_node_path13.join)(base, convention);
+      const dir = (0, import_node_path14.join)(base, convention);
       if (!(0, import_node_fs13.existsSync)(dir)) continue;
       try {
         const stat = (0, import_node_fs13.statSync)(dir);
@@ -4145,7 +4872,7 @@ function loadCustomTaggers(registry, config, rootDir, disabled) {
   for (const entry of config.taggers?.custom ?? []) {
     if (disabled.has(entry.id)) continue;
     try {
-      const absPath = (0, import_node_path14.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path15.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const tagger = "default" in mod ? mod.default : mod;
       const override = config.taggers?.trackUntagged?.[tagger.id];
@@ -4169,12 +4896,12 @@ function createTaggerRegistry(config, rootDir) {
 
 // src/server/graph/core/tag-store.ts
 var import_node_fs14 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_path16 = require("node:path");
 var TAGS_FILENAME = "tags.json";
 var GRAPHS_DIR = ".launchsecure/graphs";
 var tagCache = /* @__PURE__ */ new Map();
 function tagsFilePath(rootDir) {
-  return (0, import_node_path15.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
+  return (0, import_node_path16.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
 }
 function readTagStore(rootDir) {
   const filePath = tagsFilePath(rootDir);
@@ -4195,7 +4922,7 @@ function readTagStore(rootDir) {
 }
 function writeTagStore(rootDir, store) {
   const filePath = tagsFilePath(rootDir);
-  const dir = (0, import_node_path15.dirname)(filePath);
+  const dir = (0, import_node_path16.dirname)(filePath);
   (0, import_node_fs14.mkdirSync)(dir, { recursive: true });
   const cleaned = {};
   for (const [nodeId, tags] of Object.entries(store)) {
@@ -4224,26 +4951,89 @@ function removeTag(rootDir, nodeId, key) {
 
 // src/server/graph/index.ts
 init_ts_extractor();
+
+// src/server/graph/core/effects-index.ts
+var import_node_fs15 = require("node:fs");
+var import_node_path17 = require("node:path");
+function addTo(map, key, nodeId) {
+  const list = map[key];
+  if (!list) {
+    map[key] = [nodeId];
+  } else if (!list.includes(nodeId)) {
+    list.push(nodeId);
+  }
+}
+function collisionList(map) {
+  const out = [];
+  for (const [key, nodes] of Object.entries(map)) {
+    if (nodes.length > 1) out.push({ key, nodes: nodes.slice().sort() });
+  }
+  out.sort((a, b) => b.nodes.length - a.nodes.length || a.key.localeCompare(b.key));
+  return out;
+}
+function buildEffectsIndex(layerOutputs) {
+  const idx = {
+    generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+    dom_ids: {},
+    window_events: {},
+    storage_keys: {},
+    fetch_urls: {},
+    timers: {},
+    singleton_risks: [],
+    collisions: { dom_ids: [], storage_keys: [], window_events: [] }
+  };
+  const singletonSet = /* @__PURE__ */ new Set();
+  for (const output of Object.values(layerOutputs)) {
+    for (const node of output.nodes) {
+      const eff = node.effects;
+      if (!eff) continue;
+      for (const id of eff.dom_ids ?? []) addTo(idx.dom_ids, id, node.id);
+      for (const ev of eff.window_events ?? []) addTo(idx.window_events, ev, node.id);
+      for (const k of eff.storage_keys ?? []) addTo(idx.storage_keys, k, node.id);
+      for (const u of eff.fetch_urls ?? []) addTo(idx.fetch_urls, u, node.id);
+      for (const t of eff.timers ?? []) addTo(idx.timers, t, node.id);
+      const hasTimer = (eff.timers?.length ?? 0) > 0;
+      const hasWindowListener = (eff.window_events?.length ?? 0) > 0;
+      const hasGlobalMutation = (eff.globals?.length ?? 0) > 0;
+      if (hasTimer || hasWindowListener || hasGlobalMutation) {
+        singletonSet.add(node.id);
+      }
+    }
+  }
+  idx.singleton_risks = Array.from(singletonSet).sort();
+  idx.collisions.dom_ids = collisionList(idx.dom_ids);
+  idx.collisions.storage_keys = collisionList(idx.storage_keys);
+  idx.collisions.window_events = collisionList(idx.window_events);
+  return idx;
+}
+function writeEffectsIndex(rootDir, idx) {
+  const path2 = (0, import_node_path17.join)(rootDir, ".launchsecure", "graphs", "effects-index.json");
+  (0, import_node_fs15.writeFileSync)(path2, JSON.stringify(idx, null, 2) + "\n", "utf-8");
+  return path2;
+}
+
+// src/server/graph/index.ts
 var GRAPHS_DIR2 = ".launchsecure/graphs";
+var NON_LAYER_GRAPH_FILES = /* @__PURE__ */ new Set(["tags.json", "effects-index.json"]);
 function getAvailableLayers(rootDir) {
-  const dir = (0, import_node_path16.join)(rootDir, GRAPHS_DIR2);
-  if (!(0, import_node_fs15.existsSync)(dir)) return [];
-  return (0, import_node_fs15.readdirSync)(dir).filter((f) => f.endsWith(".json") && f !== "tags.json").map((f) => f.replace(".json", ""));
+  const dir = (0, import_node_path18.join)(rootDir, GRAPHS_DIR2);
+  if (!(0, import_node_fs16.existsSync)(dir)) return [];
+  return (0, import_node_fs16.readdirSync)(dir).filter((f) => f.endsWith(".json") && !NON_LAYER_GRAPH_FILES.has(f)).map((f) => f.replace(".json", ""));
 }
 var graphCache = /* @__PURE__ */ new Map();
 var taggedCache = /* @__PURE__ */ new Map();
 function graphsDir(rootDir) {
-  return (0, import_node_path16.join)(rootDir, GRAPHS_DIR2);
+  return (0, import_node_path18.join)(rootDir, GRAPHS_DIR2);
 }
 function graphFilePath(rootDir, layer) {
-  return (0, import_node_path16.join)(graphsDir(rootDir), `${layer}.json`);
+  return (0, import_node_path18.join)(graphsDir(rootDir), `${layer}.json`);
 }
 function tagsFilePath2(rootDir) {
-  return (0, import_node_path16.join)(graphsDir(rootDir), "tags.json");
+  return (0, import_node_path18.join)(graphsDir(rootDir), "tags.json");
 }
 function getMtimeMs(filePath) {
-  if (!(0, import_node_fs15.existsSync)(filePath)) return 0;
-  return (0, import_node_fs15.statSync)(filePath).mtimeMs;
+  if (!(0, import_node_fs16.existsSync)(filePath)) return 0;
+  return (0, import_node_fs16.statSync)(filePath).mtimeMs;
 }
 function invalidateCache(filePath) {
   graphCache.delete(filePath);
@@ -4282,20 +5072,20 @@ function applyTags(graph, layer, rootDir) {
 }
 function readGraphRaw(rootDir, layer) {
   const filePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs15.existsSync)(filePath)) return null;
-  const stat = (0, import_node_fs15.statSync)(filePath);
+  if (!(0, import_node_fs16.existsSync)(filePath)) return null;
+  const stat = (0, import_node_fs16.statSync)(filePath);
   const cached = graphCache.get(filePath);
   if (cached && cached.mtimeMs === stat.mtimeMs) {
     return cached.graph;
   }
-  const content = (0, import_node_fs15.readFileSync)(filePath, "utf-8");
+  const content = (0, import_node_fs16.readFileSync)(filePath, "utf-8");
   const graph = JSON.parse(content);
   graphCache.set(filePath, { mtimeMs: stat.mtimeMs, graph });
   return graph;
 }
 function readGraph(rootDir, layer) {
   const rawFilePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs15.existsSync)(rawFilePath)) return null;
+  if (!(0, import_node_fs16.existsSync)(rawFilePath)) return null;
   const rawMtime = getMtimeMs(rawFilePath);
   const tagsMtime = getMtimeMs(tagsFilePath2(rootDir));
   const cacheKey = `${rootDir}:${layer}`;
@@ -4325,24 +5115,24 @@ async function generateGraph(rootDir, layer) {
     mutationMethods: config.parsers?.patterns?.mutationMethods
   });
   const dir = graphsDir(rootDir);
-  (0, import_node_fs15.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs16.mkdirSync)(dir, { recursive: true });
   const results = layer ? [generateLayer(rootDir, layer)].filter((r) => r !== null) : generateAll(rootDir);
   for (const result of results) {
     const filePath = graphFilePath(rootDir, result.layer);
-    (0, import_node_fs15.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
+    (0, import_node_fs16.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
     invalidateCache(filePath);
     invalidateTaggedCache(rootDir, result.layer);
   }
   if (!layer) {
     const producedLayers = new Set(results.map((r) => r.layer));
     try {
-      for (const f of (0, import_node_fs15.readdirSync)(dir)) {
-        if (!f.endsWith(".json") || f === "tags.json") continue;
+      for (const f of (0, import_node_fs16.readdirSync)(dir)) {
+        if (!f.endsWith(".json") || f === "tags.json" || f === "effects-index.json") continue;
         const layerName = f.replace(/\.json$/, "");
         if (producedLayers.has(layerName)) continue;
-        const orphan = (0, import_node_path16.join)(dir, f);
+        const orphan = (0, import_node_path18.join)(dir, f);
         try {
-          (0, import_node_fs15.unlinkSync)(orphan);
+          (0, import_node_fs16.unlinkSync)(orphan);
           invalidateCache(orphan);
           invalidateTaggedCache(rootDir, layerName);
           process.stderr.write(`[launch-chart] removed orphan layer file: ${f} (no parser produced ${layerName} this run)
@@ -4353,33 +5143,51 @@ async function generateGraph(rootDir, layer) {
     } catch {
     }
   }
+  try {
+    const allLayers = {};
+    for (const r of results) allLayers[r.layer] = r.output;
+    if (layer) {
+      for (const f of (0, import_node_fs16.readdirSync)(dir)) {
+        if (!f.endsWith(".json") || f === "tags.json" || f === "effects-index.json") continue;
+        const layerName = f.replace(/\.json$/, "");
+        if (allLayers[layerName]) continue;
+        const existing = readGraphRaw(rootDir, layerName);
+        if (existing) allLayers[layerName] = existing;
+      }
+    }
+    const idx = buildEffectsIndex(allLayers);
+    writeEffectsIndex(rootDir, idx);
+  } catch (e) {
+    process.stderr.write(`[launch-chart] effects-index build failed: ${e.message}
+`);
+  }
   return results;
 }
 
 // src/server/lockfile.ts
 var import_node_child_process = require("node:child_process");
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var import_node_os = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_path19 = require("node:path");
 function lockDir(projectRoot) {
   if (projectRoot) {
-    return (0, import_node_path17.join)(projectRoot, ".launchsecure");
+    return (0, import_node_path19.join)(projectRoot, ".launchsecure");
   }
-  return (0, import_node_path17.join)((0, import_node_os.homedir)(), ".launchsecure");
+  return (0, import_node_path19.join)((0, import_node_os.homedir)(), ".launchsecure");
 }
 function lockPath(projectRoot) {
-  return (0, import_node_path17.join)(lockDir(projectRoot), "launch-chart.lock");
+  return (0, import_node_path19.join)(lockDir(projectRoot), "launch-chart.lock");
 }
 var _activeProjectRoot;
 function readLock(projectRoot) {
   const root = projectRoot ?? _activeProjectRoot;
   const p = lockPath(root);
-  if (!(0, import_node_fs16.existsSync)(p)) {
+  if (!(0, import_node_fs17.existsSync)(p)) {
     if (root) {
       const globalP = lockPath();
-      if ((0, import_node_fs16.existsSync)(globalP)) {
+      if ((0, import_node_fs17.existsSync)(globalP)) {
         try {
-          const data = JSON.parse((0, import_node_fs16.readFileSync)(globalP, "utf-8"));
+          const data = JSON.parse((0, import_node_fs17.readFileSync)(globalP, "utf-8"));
           if (typeof data.pid === "number" && typeof data.port === "number" && data.cwd === root) {
             return data;
           }
@@ -4390,7 +5198,7 @@ function readLock(projectRoot) {
     return null;
   }
   try {
-    const data = JSON.parse((0, import_node_fs16.readFileSync)(p, "utf-8"));
+    const data = JSON.parse((0, import_node_fs17.readFileSync)(p, "utf-8"));
     if (typeof data.pid !== "number" || typeof data.port !== "number") return null;
     return data;
   } catch {
@@ -4427,7 +5235,7 @@ function getLiveLock(projectRoot) {
   const live = listenerPid !== null ? listenerPid === lock.pid : isPidAlive(lock.pid);
   if (!live) {
     try {
-      (0, import_node_fs16.unlinkSync)(lockPath(root));
+      (0, import_node_fs17.unlinkSync)(lockPath(root));
     } catch {
     }
     return null;
@@ -4436,14 +5244,14 @@ function getLiveLock(projectRoot) {
 }
 function writeLock(data, projectRoot) {
   const root = projectRoot ?? _activeProjectRoot;
-  (0, import_node_fs16.mkdirSync)(lockDir(root), { recursive: true });
-  (0, import_node_fs16.writeFileSync)(lockPath(root), JSON.stringify(data, null, 2) + "\n", "utf-8");
+  (0, import_node_fs17.mkdirSync)(lockDir(root), { recursive: true });
+  (0, import_node_fs17.writeFileSync)(lockPath(root), JSON.stringify(data, null, 2) + "\n", "utf-8");
   if (root) _activeProjectRoot = root;
 }
 function clearLock(projectRoot) {
   const root = projectRoot ?? _activeProjectRoot;
   try {
-    (0, import_node_fs16.unlinkSync)(lockPath(root));
+    (0, import_node_fs17.unlinkSync)(lockPath(root));
   } catch {
   }
 }
@@ -4452,13 +5260,350 @@ function clearLock(projectRoot) {
 init_config();
 
 // src/server/graph/core/audit-core.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_fs19 = require("node:fs");
+var import_node_path21 = require("node:path");
+
+// src/server/graph/core/audit-security.ts
+var import_node_fs18 = require("node:fs");
+var import_node_path20 = require("node:path");
+init_ts_extractor();
+init_config();
+function collectSourceFiles(rootDir) {
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  if (!paths) return null;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const root of paths.srcRoots) {
+    for (const f of walk(root, [".ts", ".tsx"])) {
+      if (!seen.has(f)) {
+        seen.add(f);
+        out.push(f);
+      }
+    }
+  }
+  for (const conv of paths.conventionFiles) {
+    if (!seen.has(conv)) {
+      seen.add(conv);
+      out.push(conv);
+    }
+  }
+  return out;
+}
+function toNodeId5(rootDir, srcDir, absPath) {
+  const relFromSrc = (0, import_node_path20.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path20.relative)(rootDir, absPath).replace(/\\/g, "/");
+  }
+  return relFromSrc;
+}
+var SECRET_KEY_RE = /^(.*_)?(token|secret|password|passwd|credential|credentials|apikey|api_key|access_?token|refresh_?token|client_?secret|private_?key|signing_?key|webhook_?secret|auth_?token|bearer)$/i;
+var SECRET_KEY_ALLOWLIST = /* @__PURE__ */ new Set([
+  "csrfToken",
+  "csrf_token",
+  "publicKey",
+  "public_key",
+  "clientId",
+  "idempotencyKey",
+  "idempotency_key",
+  "requestKey",
+  "request_key",
+  "sessionId",
+  "session_id",
+  "apiKeyId",
+  "api_key_id",
+  "tokenType",
+  "token_type",
+  "tokenExpiry",
+  "token_expiry",
+  "isAccessToken",
+  "hasToken"
+]);
+function scanResponseSecretsInFile(absPath) {
+  const tree = parseSource(absPath);
+  if (!tree) return [];
+  const query = createQuery(`
+    (call_expression
+      function: (member_expression
+        property: (property_identifier) @method
+        (#eq? @method "json"))
+      arguments: (arguments
+        (object) @payload))
+  `);
+  const matches = query.matches(tree.rootNode);
+  const hits = [];
+  for (const m of matches) {
+    const caps = m.captures;
+    const payload = caps.find((c) => c.name === "payload")?.node;
+    if (!payload) continue;
+    walkPairKeys(payload, (keyName, node) => {
+      const trimmed = keyName.replace(/^["']|["']$/g, "");
+      if (SECRET_KEY_ALLOWLIST.has(trimmed)) return;
+      if (!SECRET_KEY_RE.test(trimmed)) return;
+      hits.push({
+        file: absPath,
+        line: node.startPosition.row + 1,
+        keyName: trimmed,
+        callShape: payload.text.slice(0, 40).replace(/\s+/g, " ")
+      });
+    });
+  }
+  return hits;
+}
+function walkPairKeys(node, visit) {
+  for (const child of node.children) {
+    if (child.type === "pair") {
+      const keyChild = child.children[0];
+      if (keyChild && (keyChild.type === "property_identifier" || keyChild.type === "string")) {
+        visit(keyChild.text, keyChild);
+      }
+      const valueChild = child.children[child.children.length - 1];
+      if (valueChild && valueChild.type === "object") walkPairKeys(valueChild, visit);
+    } else if (child.type === "shorthand_property_identifier") {
+      visit(child.text, child);
+    } else if (child.type === "object") {
+      walkPairKeys(child, visit);
+    }
+  }
+}
+function checkResponseSecretLeak(rootDir, core) {
+  const files = collectSourceFiles(rootDir);
+  if (files === null || files.length === 0) {
+    return core.buildSkipped(
+      "security",
+      "response_secret_leak",
+      `no source files detected \u2014 not a TypeScript project, or src roots aren't configured`
+    );
+  }
+  const findings = [];
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  for (const abs of files) {
+    let hits = [];
+    try {
+      hits = scanResponseSecretsInFile(abs);
+    } catch {
+    }
+    for (const h of hits) {
+      const fileId = toNodeId5(rootDir, paths.srcDir, abs);
+      findings.push({
+        id: `secret-leak:${fileId}:${h.line}:${h.keyName}`,
+        severity: "error",
+        category: "response_secret_leak",
+        title: `${h.keyName} in response payload`,
+        detail: `Response body includes a "${h.keyName}" key \u2014 likely leaking a secret to the client. If this is a public identifier or anti-CSRF token, add it to the allow-list in audit-security.ts.`,
+        file: fileId,
+        line: h.line
+      });
+    }
+  }
+  return core.buildReport("security", "response_secret_leak", findings);
+}
+function collectDeclaredEnvKeys(rootDir) {
+  const keys = /* @__PURE__ */ new Set();
+  const files = [];
+  let entries = [];
+  try {
+    entries = (0, import_node_fs18.readdirSync)(rootDir);
+  } catch {
+    return { keys, files };
+  }
+  for (const name of entries) {
+    if (!name.startsWith(".env")) continue;
+    const abs = (0, import_node_path20.join)(rootDir, name);
+    if (!(0, import_node_fs18.existsSync)(abs)) continue;
+    files.push(name);
+    let content = "";
+    try {
+      content = (0, import_node_fs18.readFileSync)(abs, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const line of content.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq < 0) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (/^[A-Z_][A-Z0-9_]*$/.test(key)) keys.add(key);
+    }
+  }
+  return { keys, files };
+}
+var FRAMEWORK_ENV_KEYS = /* @__PURE__ */ new Set([
+  "NODE_ENV",
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "PATH",
+  "HOME",
+  "USER",
+  "PWD",
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITHUB_WORKFLOW",
+  "GITHUB_RUN_ID",
+  "GITHUB_SHA",
+  "VERCEL",
+  "VERCEL_ENV",
+  "VERCEL_URL",
+  "VERCEL_REGION",
+  "VERCEL_GIT_COMMIT_SHA",
+  "VERCEL_GIT_COMMIT_REF",
+  "VERCEL_GIT_REPO_SLUG",
+  "VERCEL_GIT_REPO_OWNER",
+  "PORT",
+  "TZ",
+  "LANG",
+  "LC_ALL",
+  "TERM",
+  "DEBUG",
+  "NEXT_RUNTIME",
+  "NEXT_PUBLIC_VERCEL_URL"
+]);
+function scanEnvRefsInFile(absPath) {
+  const tree = parseSource(absPath);
+  if (!tree) return [];
+  const query = createQuery(`
+    ; process.env.X
+    (member_expression
+      object: (member_expression
+        object: (identifier) @_proc
+        property: (property_identifier) @_env)
+      property: (property_identifier) @env_name
+      (#eq? @_proc "process")
+      (#eq? @_env "env"))
+
+    ; process.env["X"]
+    (subscript_expression
+      object: (member_expression
+        object: (identifier) @_proc2
+        property: (property_identifier) @_env2)
+      index: (string (string_fragment) @env_name_str)
+      (#eq? @_proc2 "process")
+      (#eq? @_env2 "env"))
+  `);
+  const matches = query.matches(tree.rootNode);
+  const refs = [];
+  for (const m of matches) {
+    const caps = m.captures;
+    const key = caps.find((c) => c.name === "env_name" || c.name === "env_name_str");
+    if (!key) continue;
+    refs.push({ file: absPath, line: key.node.startPosition.row + 1, envKey: key.node.text });
+  }
+  return refs;
+}
+function checkEnvDeadAlias(rootDir, core) {
+  const { keys: declared, files: envFiles } = collectDeclaredEnvKeys(rootDir);
+  if (envFiles.length === 0) {
+    return core.buildSkipped(
+      "security",
+      "env_dead_alias",
+      `no .env* files in project root \u2014 this check needs a declared-env inventory to compare against`
+    );
+  }
+  const files = collectSourceFiles(rootDir);
+  if (files === null || files.length === 0) {
+    return core.buildSkipped("security", "env_dead_alias", `no source files detected`);
+  }
+  const findings = [];
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  const seen = /* @__PURE__ */ new Set();
+  for (const abs of files) {
+    let refs = [];
+    try {
+      refs = scanEnvRefsInFile(abs);
+    } catch {
+    }
+    for (const r of refs) {
+      if (declared.has(r.envKey)) continue;
+      if (FRAMEWORK_ENV_KEYS.has(r.envKey)) continue;
+      if (r.envKey.startsWith("npm_")) continue;
+      const fileId = toNodeId5(rootDir, paths.srcDir, abs);
+      const dedupeKey = `${fileId}:${r.envKey}`;
+      if (seen.has(dedupeKey)) continue;
+      seen.add(dedupeKey);
+      findings.push({
+        id: `dead-env:${fileId}:${r.envKey}`,
+        severity: "warning",
+        category: "env_dead_alias",
+        title: `process.env.${r.envKey} not declared in any .env file`,
+        detail: `Reference to env var "${r.envKey}" but no .env* file declares it (${envFiles.join(", ")}). Likely a rename left behind, a typo, or an env var that's only set in deployment but should be documented in .env.example.`,
+        file: fileId,
+        line: r.line
+      });
+    }
+  }
+  return core.buildReport("security", "env_dead_alias", findings);
+}
+function scanUrlFallbacksInFile(absPath) {
+  const tree = parseSource(absPath);
+  if (!tree) return [];
+  const query = createQuery(`
+    ; process.env.X || "https://..."   or   process.env.X ?? "https://..."
+    (binary_expression
+      left: (member_expression
+        object: (member_expression
+          object: (identifier) @_proc
+          property: (property_identifier) @_env)
+        property: (property_identifier) @env_var)
+      right: (string (string_fragment) @url)
+      (#eq? @_proc "process")
+      (#eq? @_env "env")
+      (#match? @url "^https?://")) @expr
+  `);
+  const matches = query.matches(tree.rootNode);
+  const hits = [];
+  for (const m of matches) {
+    const caps = m.captures;
+    const envVar = caps.find((c) => c.name === "env_var")?.node;
+    const url = caps.find((c) => c.name === "url")?.node;
+    const expr = caps.find((c) => c.name === "expr")?.node;
+    if (!envVar || !url || !expr) continue;
+    const opMatch = / (\|\||\?\?) /.exec(expr.text);
+    const operator = opMatch ? opMatch[1] : "||";
+    hits.push({
+      file: absPath,
+      line: envVar.startPosition.row + 1,
+      envKey: envVar.text,
+      url: url.text,
+      operator
+    });
+  }
+  return hits;
+}
+function checkHardcodedUrlFallback(rootDir, core) {
+  const files = collectSourceFiles(rootDir);
+  if (files === null || files.length === 0) {
+    return core.buildSkipped("security", "hardcoded_url_fallback", `no source files detected`);
+  }
+  const findings = [];
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  for (const abs of files) {
+    let hits = [];
+    try {
+      hits = scanUrlFallbacksInFile(abs);
+    } catch {
+    }
+    for (const h of hits) {
+      const fileId = toNodeId5(rootDir, paths.srcDir, abs);
+      findings.push({
+        id: `url-fallback:${fileId}:${h.line}:${h.envKey}`,
+        severity: "warning",
+        category: "hardcoded_url_fallback",
+        title: `${h.envKey} ${h.operator} "${h.url}"`,
+        detail: `Hardcoded URL fallback for env var "${h.envKey}". If the env var is unset in prod, requests will silently route to "${h.url}" \u2014 common cause of dev/prod URL leaks and stale localhost ports. Make the env var required, or move the default to a deployment-aware config.`,
+        file: fileId,
+        line: h.line
+      });
+    }
+  }
+  return core.buildReport("security", "hardcoded_url_fallback", findings);
+}
+
+// src/server/graph/core/audit-core.ts
 function readGraphFile(rootDir, layer) {
-  const filePath = (0, import_node_path18.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
-  if (!(0, import_node_fs17.existsSync)(filePath)) return null;
+  const filePath = (0, import_node_path21.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  if (!(0, import_node_fs19.existsSync)(filePath)) return null;
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)(filePath, "utf-8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -4467,8 +5612,7 @@ function checkSchemaDrift(rootDir) {
   const findings = [];
   const db = readGraphFile(rootDir, "db");
   if (!db) {
-    findings.push({ id: "no-db-graph", severity: "info", category: "schema_drift", title: "No DB graph", detail: "Run generate_graph first to populate the DB layer." });
-    return buildReport("db", "schema_drift", findings);
+    return buildSkipped("db", "schema_drift", "no db graph \u2014 generate_graph first, or this project has no Prisma schema");
   }
   for (const c of db.contradictions ?? []) {
     const isTableLevel = c.detail.includes("Table ") && (c.detail.includes("has no CREATE TABLE") || c.detail.includes("not in schema.prisma"));
@@ -4485,7 +5629,7 @@ function checkSchemaDrift(rootDir) {
 function checkOrphanFks(rootDir) {
   const findings = [];
   const db = readGraphFile(rootDir, "db");
-  if (!db) return buildReport("db", "orphan_fks", findings);
+  if (!db) return buildSkipped("db", "orphan_fks", "no db graph");
   for (const f of db.flagged_edges ?? []) {
     findings.push({
       id: `fk:${f.source}->${f.target}`,
@@ -4500,13 +5644,16 @@ function checkOrphanFks(rootDir) {
 function checkUnprotectedRoutes(rootDir) {
   const findings = [];
   const api = readGraphFile(rootDir, "api");
-  const staticGraph = readGraphFile(rootDir, "static");
-  if (!api) return buildReport("api", "unprotected_routes", findings);
-  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
-  let routePermsContent = "";
-  if ((0, import_node_fs17.existsSync)(routePermsPath)) {
-    routePermsContent = (0, import_node_fs17.readFileSync)(routePermsPath, "utf-8");
+  if (!api) return buildSkipped("api", "unprotected_routes", "no api graph");
+  const routePermsPath = (0, import_node_path21.join)(rootDir, "src", "config", "route-permissions.ts");
+  if (!(0, import_node_fs19.existsSync)(routePermsPath)) {
+    return buildSkipped(
+      "api",
+      "unprotected_routes",
+      `no src/config/route-permissions.ts \u2014 this check needs a centralized ROUTE_PERMISSIONS inventory to compare endpoints against`
+    );
   }
+  const routePermsContent = (0, import_node_fs19.readFileSync)(routePermsPath, "utf-8");
   const registeredRoutes = /* @__PURE__ */ new Set();
   const routeEntryRe = /path:\s*'([^']+)'/g;
   let rm;
@@ -4550,7 +5697,7 @@ function routeMatchesPattern(route, pattern) {
 function checkDeadScreens(rootDir) {
   const findings = [];
   const ui = readGraphFile(rootDir, "ui");
-  if (!ui) return buildReport("ui", "dead_screens", findings);
+  if (!ui) return buildSkipped("ui", "dead_screens", "no ui graph");
   const pages = ui.nodes.filter((n) => n.type === "page" || n.type === "layout");
   const navTargets = /* @__PURE__ */ new Set();
   for (const e of ui.edges) {
@@ -4582,13 +5729,24 @@ function checkDeadScreens(rootDir) {
 function checkUnenforcedPermissions(rootDir) {
   const findings = [];
   const staticGraph = readGraphFile(rootDir, "static");
-  if (!staticGraph) return buildReport("static", "unenforced_permissions", findings);
+  if (!staticGraph) return buildSkipped("static", "unenforced_permissions", "no static graph");
   const permissions = staticGraph.nodes.filter((n) => n.type === "seed_permission").map((n) => ({ id: n.id, key: n.value, name: n.name }));
-  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
-  let routePermsContent = "";
-  if ((0, import_node_fs17.existsSync)(routePermsPath)) {
-    routePermsContent = (0, import_node_fs17.readFileSync)(routePermsPath, "utf-8");
+  if (permissions.length === 0) {
+    return buildSkipped(
+      "static",
+      "unenforced_permissions",
+      `no seed_permission nodes \u2014 this project either has no seed permissions or hasn't tagged them in seed.ts`
+    );
   }
+  const routePermsPath = (0, import_node_path21.join)(rootDir, "src", "config", "route-permissions.ts");
+  if (!(0, import_node_fs19.existsSync)(routePermsPath)) {
+    return buildSkipped(
+      "static",
+      "unenforced_permissions",
+      `no src/config/route-permissions.ts to compare seed permissions against`
+    );
+  }
+  const routePermsContent = (0, import_node_fs19.readFileSync)(routePermsPath, "utf-8");
   for (const perm of permissions) {
     const regex = new RegExp(`permission:\\s*['"]${perm.key}['"]`);
     if (!regex.test(routePermsContent)) {
@@ -4606,20 +5764,27 @@ function checkUnenforcedPermissions(rootDir) {
 function checkHardcodedValues(rootDir) {
   const findings = [];
   const staticGraph = readGraphFile(rootDir, "static");
-  if (!staticGraph) return buildReport("static", "hardcoded_values", findings);
+  if (!staticGraph) return buildSkipped("static", "hardcoded_values", "no static graph");
   const knownValues = /* @__PURE__ */ new Set();
   for (const n of staticGraph.nodes) {
     if (n.type === "enum_value") knownValues.add(n.value);
   }
+  if (knownValues.size === 0) {
+    return buildSkipped(
+      "static",
+      "hardcoded_values",
+      `no enum_value nodes in static graph \u2014 without an inventory of known ALL_CAPS constants, this scan would flag every legitimate constant in your codebase`
+    );
+  }
   const api = readGraphFile(rootDir, "api");
-  if (!api) return buildReport("static", "hardcoded_values", findings);
+  if (!api) return buildSkipped("static", "hardcoded_values", "no api graph");
   const allCapsRe = /['"]([A-Z][A-Z_]{2,})['"]/g;
   const seen = /* @__PURE__ */ new Set();
   for (const node of api.nodes) {
     if (node.type !== "endpoint") continue;
-    const filePath = (0, import_node_path18.join)(rootDir, "src", node.id);
-    if (!(0, import_node_fs17.existsSync)(filePath)) continue;
-    const content = (0, import_node_fs17.readFileSync)(filePath, "utf-8");
+    const filePath = (0, import_node_path21.join)(rootDir, "src", node.id);
+    if (!(0, import_node_fs19.existsSync)(filePath)) continue;
+    const content = (0, import_node_fs19.readFileSync)(filePath, "utf-8");
     let m;
     allCapsRe.lastIndex = 0;
     while ((m = allCapsRe.exec(content)) !== null) {
@@ -4651,7 +5816,19 @@ function buildReport(layer, check, findings) {
       warnings: findings.filter((f) => f.severity === "warning").length,
       info: findings.filter((f) => f.severity === "info").length
     },
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    status: "ok"
+  };
+}
+function buildSkipped(layer, check, reason) {
+  return {
+    layer,
+    check,
+    findings: [],
+    summary: { errors: 0, warnings: 0, info: 0 },
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    status: "skipped",
+    skipReason: reason
   };
 }
 var CHECKS = {
@@ -4668,6 +5845,11 @@ var CHECKS = {
   static: {
     unenforced_permissions: checkUnenforcedPermissions,
     hardcoded_values: checkHardcodedValues
+  },
+  security: {
+    response_secret_leak: (rootDir) => checkResponseSecretLeak(rootDir, { buildReport, buildSkipped }),
+    env_dead_alias: (rootDir) => checkEnvDeadAlias(rootDir, { buildReport, buildSkipped }),
+    hardcoded_url_fallback: (rootDir) => checkHardcodedUrlFallback(rootDir, { buildReport, buildSkipped })
   }
 };
 function getAvailableChecks() {
@@ -4714,7 +5896,12 @@ function runAudit(rootDir, layer, check) {
 }
 function formatAsPrompt(reports) {
   const lines = [];
+  const skipped = [];
   for (const report of reports) {
+    if (report.status === "skipped") {
+      skipped.push(report);
+      continue;
+    }
     if (report.findings.length === 0) continue;
     lines.push(`## ${report.layer.toUpperCase()} \u2014 ${report.check} (${report.findings.length} findings)`);
     lines.push("");
@@ -4726,6 +5913,14 @@ function formatAsPrompt(reports) {
     }
     lines.push("");
   }
+  if (skipped.length > 0) {
+    lines.push("## Skipped checks (no comparison target \u2014 NOT passes)");
+    lines.push("");
+    for (const r of skipped) {
+      lines.push(`- ${r.layer}/${r.check}: ${r.skipReason ?? "comparison target missing"}`);
+    }
+    lines.push("");
+  }
   if (lines.length === 0) return "No audit findings.";
   return lines.join("\n");
 }
@@ -4749,16 +5944,16 @@ var MIME_TYPES = {
 function findProjectRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 8; i++) {
-    const graphsDir2 = import_node_path19.default.join(dir, ".launchsecure", "graphs");
-    if (import_node_fs18.default.existsSync(import_node_path19.default.join(graphsDir2, "ui.json")) || import_node_fs18.default.existsSync(import_node_path19.default.join(graphsDir2, "api.json")) || import_node_fs18.default.existsSync(import_node_path19.default.join(graphsDir2, "db.json"))) return dir;
-    const parent = import_node_path19.default.dirname(dir);
+    const graphsDir2 = import_node_path22.default.join(dir, ".launchsecure", "graphs");
+    if (import_node_fs20.default.existsSync(import_node_path22.default.join(graphsDir2, "ui.json")) || import_node_fs20.default.existsSync(import_node_path22.default.join(graphsDir2, "api.json")) || import_node_fs20.default.existsSync(import_node_path22.default.join(graphsDir2, "db.json"))) return dir;
+    const parent = import_node_path22.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   dir = startDir;
   for (let i = 0; i < 8; i++) {
-    if (import_node_fs18.default.existsSync(import_node_path19.default.join(dir, ".git"))) return dir;
-    const parent = import_node_path19.default.dirname(dir);
+    if (import_node_fs20.default.existsSync(import_node_path22.default.join(dir, ".git"))) return dir;
+    const parent = import_node_path22.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -4767,7 +5962,7 @@ function findProjectRoot(startDir) {
 function resolveRequestRoot(url, monorepoRoot, projects) {
   const projectParam = url.searchParams.get("project");
   if (!projectParam || projects.length === 0) return monorepoRoot;
-  const resolved = import_node_path19.default.resolve(monorepoRoot, projectParam);
+  const resolved = import_node_path22.default.resolve(monorepoRoot, projectParam);
   if (!resolved.startsWith(monorepoRoot)) {
     throw new Error("Project path outside monorepo root");
   }
@@ -4818,16 +6013,16 @@ async function buildMergedGraph(root) {
   };
 }
 function serveStatic(res, filePath) {
-  if (!import_node_fs18.default.existsSync(filePath) || !import_node_fs18.default.statSync(filePath).isFile()) return false;
-  const ext = import_node_path19.default.extname(filePath).toLowerCase();
+  if (!import_node_fs20.default.existsSync(filePath) || !import_node_fs20.default.statSync(filePath).isFile()) return false;
+  const ext = import_node_path22.default.extname(filePath).toLowerCase();
   const mime = MIME_TYPES[ext] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": mime, "Cache-Control": "no-cache" });
-  import_node_fs18.default.createReadStream(filePath).pipe(res);
+  import_node_fs20.default.createReadStream(filePath).pipe(res);
   return true;
 }
 function serveIndex(res, clientDir) {
-  const indexPath = import_node_path19.default.join(clientDir, "index.html");
-  if (!import_node_fs18.default.existsSync(indexPath)) {
+  const indexPath = import_node_path22.default.join(clientDir, "index.html");
+  if (!import_node_fs20.default.existsSync(indexPath)) {
     res.writeHead(500, { "Content-Type": "text/plain" });
     res.end(`LaunchChart client bundle not found at ${clientDir}. Run 'npm run build:chart-client'.`);
     return;
@@ -4879,7 +6074,7 @@ async function startChartServer(opts = {}) {
     }
     return { port: existing.port, url: existing.url };
   }
-  const clientDir = opts.clientDir ?? import_node_path19.default.join(__dirname, "..", "chart-client");
+  const clientDir = opts.clientDir ?? import_node_path22.default.join(__dirname, "..", "chart-client");
   const rootConfig = loadConfig(projectRoot);
   const projects = rootConfig.projects ?? [];
   const server = import_node_http.default.createServer((req, res) => {
@@ -4895,11 +6090,11 @@ async function startChartServer(opts = {}) {
       }
       if (req.method === "GET" && url2.pathname === "/api/projects") {
         const projectList = projects.length > 0 ? projects.map((p) => {
-          const absRoot = import_node_path19.default.resolve(projectRoot, p.root);
-          const hasGraphs = import_node_fs18.default.existsSync(import_node_path19.default.join(absRoot, ".launchsecure", "graphs"));
-          const hasNextConfig = import_node_fs18.default.existsSync(import_node_path19.default.join(absRoot, "next.config.ts")) || import_node_fs18.default.existsSync(import_node_path19.default.join(absRoot, "next.config.js")) || import_node_fs18.default.existsSync(import_node_path19.default.join(absRoot, "next.config.mjs"));
+          const absRoot = import_node_path22.default.resolve(projectRoot, p.root);
+          const hasGraphs = import_node_fs20.default.existsSync(import_node_path22.default.join(absRoot, ".launchsecure", "graphs"));
+          const hasNextConfig = import_node_fs20.default.existsSync(import_node_path22.default.join(absRoot, "next.config.ts")) || import_node_fs20.default.existsSync(import_node_path22.default.join(absRoot, "next.config.js")) || import_node_fs20.default.existsSync(import_node_path22.default.join(absRoot, "next.config.mjs"));
           return { name: p.name, root: p.root, hasGraphs, hasNextConfig };
-        }) : [{ name: import_node_path19.default.basename(projectRoot), root: ".", hasGraphs: import_node_fs18.default.existsSync(import_node_path19.default.join(projectRoot, ".launchsecure", "graphs")), hasNextConfig: true }];
+        }) : [{ name: import_node_path22.default.basename(projectRoot), root: ".", hasGraphs: import_node_fs20.default.existsSync(import_node_path22.default.join(projectRoot, ".launchsecure", "graphs")), hasNextConfig: true }];
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ projects: projectList, monorepoRoot: projectRoot }));
         return;
@@ -4945,20 +6140,20 @@ async function startChartServer(opts = {}) {
       }
       if (req.method === "GET" && url2.pathname === "/api/file-content") {
         const relPath = url2.searchParams.get("path");
-        if (!relPath || relPath.includes("..") || import_node_path19.default.isAbsolute(relPath)) {
+        if (!relPath || relPath.includes("..") || import_node_path22.default.isAbsolute(relPath)) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "Invalid path" }));
           return;
         }
-        const filePath = import_node_path19.default.join(reqRoot, relPath);
-        if (!filePath.startsWith(reqRoot) || !import_node_fs18.default.existsSync(filePath) || !import_node_fs18.default.statSync(filePath).isFile()) {
+        const filePath = import_node_path22.default.join(reqRoot, relPath);
+        if (!filePath.startsWith(reqRoot) || !import_node_fs20.default.existsSync(filePath) || !import_node_fs20.default.statSync(filePath).isFile()) {
           res.writeHead(404, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "File not found" }));
           return;
         }
-        const ext = import_node_path19.default.extname(filePath).toLowerCase();
+        const ext = import_node_path22.default.extname(filePath).toLowerCase();
         const langMap = { ".ts": "typescript", ".tsx": "tsx", ".js": "javascript", ".jsx": "jsx", ".prisma": "prisma", ".json": "json", ".css": "css" };
-        const content = import_node_fs18.default.readFileSync(filePath, "utf-8");
+        const content = import_node_fs20.default.readFileSync(filePath, "utf-8");
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ content, language: langMap[ext] ?? "text", path: relPath }));
         return;
@@ -5000,8 +6195,8 @@ async function startChartServer(opts = {}) {
         req.on("end", () => {
           try {
             const newConfig = JSON.parse(body);
-            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
-            import_node_fs18.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path22.default.join(reqRoot, ".launchchart.json");
+            import_node_fs20.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err) {
@@ -5034,8 +6229,8 @@ async function startChartServer(opts = {}) {
             const taggerConfig = JSON.parse(body);
             const config2 = loadConfig(reqRoot);
             config2.taggers = taggerConfig;
-            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
-            import_node_fs18.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path22.default.join(reqRoot, ".launchchart.json");
+            import_node_fs20.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err) {
@@ -5105,7 +6300,7 @@ async function startChartServer(opts = {}) {
           dbDir: !!config2.paths?.dbDir,
           srcRoots: !!(config2.paths?.srcRoots && config2.paths.srcRoots.length > 0)
         };
-        const relFromRoot = (abs) => import_node_path19.default.relative(reqRoot, abs) || ".";
+        const relFromRoot = (abs) => import_node_path22.default.relative(reqRoot, abs) || ".";
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({
           projectRoot: reqRoot,
@@ -5127,19 +6322,19 @@ async function startChartServer(opts = {}) {
       }
       if (req.method === "GET" && url2.pathname === "/api/browse-dir") {
         const browsePath = url2.searchParams.get("path") || projectRoot;
-        const abs = import_node_path19.default.resolve(browsePath);
-        const twoUp = import_node_path19.default.resolve(projectRoot, "..", "..");
+        const abs = import_node_path22.default.resolve(browsePath);
+        const twoUp = import_node_path22.default.resolve(projectRoot, "..", "..");
         if (!abs.startsWith(twoUp)) {
           res.writeHead(403, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ ok: false, error: "Path outside allowed range" }));
           return;
         }
         try {
-          const entries = import_node_fs18.default.readdirSync(abs, { withFileTypes: true });
+          const entries = import_node_fs20.default.readdirSync(abs, { withFileTypes: true });
           const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules" && e.name !== "dist" && e.name !== ".next").map((e) => e.name).sort();
-          const parent = abs !== twoUp ? import_node_path19.default.dirname(abs) : null;
+          const parent = abs !== twoUp ? import_node_path22.default.dirname(abs) : null;
           res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ current: abs, parent, dirs, relative: import_node_path19.default.relative(projectRoot, abs) || "." }));
+          res.end(JSON.stringify({ current: abs, parent, dirs, relative: import_node_path22.default.relative(projectRoot, abs) || "." }));
         } catch (err) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ ok: false, error: String(err) }));
@@ -5165,8 +6360,8 @@ async function startChartServer(opts = {}) {
             const { projects: newProjects } = JSON.parse(body);
             const config2 = loadConfig(projectRoot);
             config2.projects = newProjects.length > 0 ? newProjects : void 0;
-            const configPath = import_node_path19.default.join(projectRoot, ".launchchart.json");
-            import_node_fs18.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path22.default.join(projectRoot, ".launchchart.json");
+            import_node_fs20.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
             projects.length = 0;
             if (config2.projects) projects.push(...config2.projects);
             res.writeHead(200, { "Content-Type": "application/json" });
@@ -5179,7 +6374,7 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (url2.pathname !== "/") {
-        const staticPath = import_node_path19.default.join(clientDir, url2.pathname);
+        const staticPath = import_node_path22.default.join(clientDir, url2.pathname);
         if (serveStatic(res, staticPath)) return;
       }
       serveIndex(res, clientDir);