@launchsecure/launch-kit 0.0.25 → 0.0.26

package/dist/server/graph-mcp-entry.js

@@ -398,17 +398,20 @@ var init_resolve_paths = __esm({
 // src/server/graph/core/ts-extractor.ts
 var ts_extractor_exports = {};
 __export(ts_extractor_exports, {
+  ParseCascadeError: () => ParseCascadeError,
   classifyFile: () => classifyFile,
   classifyRouteAgainstMiddleware: () => classifyRouteAgainstMiddleware,
   createQuery: () => createQuery,
   extractAuthWrappersTS: () => extractAuthWrappersTS,
   extractDbCallsTS: () => extractDbCallsTS,
   extractDeep: () => extractDeep,
+  extractEffects: () => extractEffects,
   extractMiddlewareAuthTS: () => extractMiddlewareAuthTS,
   initTreeSitter: () => initTreeSitter,
   middlewarePatternToRegex: () => middlewarePatternToRegex,
   parseCodeTS: () => parseCodeTS,
   parseFileTS: () => parseFileTS,
+  parseSource: () => parseSource,
   setExtractorConfig: () => setExtractorConfig
 });
 async function initTreeSitter() {
@@ -442,8 +445,38 @@ function getQuery(name) {
 }
 function parseSource(absPath) {
   ensureInit();
-  const content = (0, import_node_fs5.readFileSync)(absPath, "utf-8");
-  return parserInstance.parse(content);
+  let content;
+  try {
+    const stat = (0, import_node_fs5.statSync)(absPath);
+    if (stat.size > MAX_PARSEABLE_BYTES) {
+      process.stderr.write(`[lc-extractor] skipping ${absPath}: ${stat.size} bytes exceeds max ${MAX_PARSEABLE_BYTES}
+`);
+      return null;
+    }
+    content = (0, import_node_fs5.readFileSync)(absPath, "utf-8");
+  } catch (e) {
+    process.stderr.write(`[lc-extractor] read failed for ${absPath}: ${e instanceof Error ? e.message : String(e)}
+`);
+    return null;
+  }
+  try {
+    const tree = parserInstance.parse(content);
+    consecutiveParseFailures = 0;
+    return tree;
+  } catch (e) {
+    consecutiveParseFailures++;
+    const msg = e instanceof Error ? e.message : String(e);
+    process.stderr.write(
+      `[lc-extractor] parse failed for ${absPath}: ${msg} (consecutive failures: ${consecutiveParseFailures}/${MAX_CONSECUTIVE_PARSE_FAILURES})
+`
+    );
+    if (consecutiveParseFailures >= MAX_CONSECUTIVE_PARSE_FAILURES) {
+      const tripCount = consecutiveParseFailures;
+      consecutiveParseFailures = 0;
+      throw new ParseCascadeError(absPath, tripCount);
+    }
+    return null;
+  }
 }
 function parseCodeTS(code) {
   ensureInit();
@@ -483,8 +516,20 @@ function childrenOfType(node, type) {
 function childOfType(node, type) {
   return node.children.find((n) => n.type === type);
 }
+function emptyParsedFile(absPath) {
+  return {
+    name: absPath.split("/").pop() ?? absPath,
+    exports: [],
+    imports: [],
+    reExports: [],
+    jsxElements: /* @__PURE__ */ new Set(),
+    navigations: [],
+    fetchCalls: []
+  };
+}
 function parseFileTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return emptyParsedFile(absPath);
   const root = tree.rootNode;
   const imports = [];
   const importStatements = childrenOfType(root, "import_statement");
@@ -679,6 +724,7 @@ function parseFileTS(absPath) {
 }
 function extractDbCallsTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return [];
   const root = tree.rootNode;
   const dbQuery = getQuery("db-calls");
   const matches = dbQuery.matches(root);
@@ -739,7 +785,9 @@ function classifyFile(absPath) {
   const fileName = require("path").basename(absPath);
   if (fileName.includes(".test.") || fileName.includes(".spec.") || fileName.includes("__test")) return "test";
   if (fileName.includes(".stories.")) return "story";
+  if (fileName === "middleware.ts" || fileName === "middleware.tsx") return "middleware";
   const tree = parseSource(absPath);
+  if (!tree) return "util";
   const root = tree.rootNode;
   const classifyQuery = getQuery("classify");
   const captures = classifyQuery.captures(root);
@@ -758,6 +806,7 @@ function classifyFile(absPath) {
 }
 function extractAuthWrappersTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return /* @__PURE__ */ new Set();
   const root = tree.rootNode;
   const wrapperQuery = getQuery("wrappers");
   const matches = wrapperQuery.matches(root);
@@ -801,6 +850,9 @@ function extractAuthWrappersTS(absPath) {
   return wrappers;
 }
 function inferIntentFromName(name) {
+  if (TRUST_AS_PROTECT_KEYS.has(name)) {
+    return { intent: "protect", hint: `Next.js config.${name} \u2014 paths matched run through middleware` };
+  }
   for (const re of EXEMPT_NAME_PATTERNS) {
     if (re.test(name)) return { intent: "exempt", hint: `name "${name}" matches /${re.source}/` };
   }
@@ -877,6 +929,7 @@ function detectFallthroughProtect(root) {
 function extractMiddlewareAuthTS(absPath) {
   if (!require("node:fs").existsSync(absPath)) return null;
   const tree = parseSource(absPath);
+  if (!tree) return null;
   const root = tree.rootNode;
   const matchers = [];
   for (const stmt of root.children) {
@@ -920,6 +973,16 @@ function extractMiddlewareAuthTS(absPath) {
   };
 }
 function middlewarePatternToRegex(pattern) {
+  const negLookaheadMatch = /^(\/?)\(\(\?\!([^)]+)\)(\.\*|\.\+)\)$/.exec(pattern);
+  if (negLookaheadMatch) {
+    const [, lead, altsRaw, body] = negLookaheadMatch;
+    const escapedAlts = altsRaw.split("|").map((alt) => alt.trim().replace(/[.+*?^${}()|[\]\\]/g, "\\$&")).join("|");
+    try {
+      return new RegExp(`^${lead}(?!${escapedAlts})${body}$`);
+    } catch {
+      return null;
+    }
+  }
   if (/\(\?\!/.test(pattern)) return null;
   if (pattern.startsWith("(")) return null;
   let src = "^";
@@ -977,8 +1040,163 @@ function classifyRouteAgainstMiddleware(routePath, info) {
 function trunc(s, max = 120) {
   return s.length > max ? s.slice(0, max) + "..." : s;
 }
+function dedup(arr) {
+  return Array.from(new Set(arr));
+}
+function firstStringArg(callExpr) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return null;
+  for (const c of args.namedChildren) {
+    if (c.type === "string") {
+      const frag = c.namedChildren.find((cc) => cc.type === "string_fragment");
+      return frag ? frag.text : c.text.replace(/^['"`]|['"`]$/g, "");
+    }
+    if (c.type === "template_string") {
+      return c.text.replace(/^`|`$/g, "");
+    }
+  }
+  return null;
+}
+function isFunctionLike(node) {
+  return node.type === "arrow_function" || node.type === "function_expression" || node.type === "function_declaration" || node.type === "method_definition" || node.type === "generator_function" || node.type === "generator_function_declaration";
+}
+function stringLiteralValue(n) {
+  if (n.type !== "string") return null;
+  const frag = n.namedChildren.find((c) => c.type === "string_fragment");
+  if (frag) return frag.text;
+  return n.text.replace(/^['"`]|['"`]$/g, "");
+}
+function nthStringArg(callExpr, idx) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return null;
+  const child = args.namedChildren[idx];
+  return child ? stringLiteralValue(child) : null;
+}
+function objectArgIdValues(callExpr) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return [];
+  const out = [];
+  for (const arg of args.namedChildren) {
+    if (arg.type !== "object") continue;
+    for (const pair of arg.namedChildren) {
+      if (pair.type !== "pair") continue;
+      const key = pair.childForFieldName("key");
+      const val = pair.childForFieldName("value");
+      if (!key || !val) continue;
+      const keyText = key.type === "property_identifier" ? key.text : stringLiteralValue(key) ?? key.text;
+      if (keyText !== "id") continue;
+      const strVal = stringLiteralValue(val);
+      if (strVal) out.push(strVal);
+    }
+  }
+  return out;
+}
+function extractEffects(node, moduleOnly = false) {
+  const calls = [];
+  const dom_writes = [];
+  const subscribes = [];
+  const timers = [];
+  const persists = [];
+  const fetches = [];
+  const globals = [];
+  const dom_ids = [];
+  const window_events = [];
+  const storage_keys = [];
+  const fetch_urls = [];
+  function visit(n, depth) {
+    if (moduleOnly && depth > 0 && isFunctionLike(n)) return;
+    if (n.type === "call_expression") {
+      const fn = n.childForFieldName("function");
+      if (fn) {
+        const fnText = fn.text;
+        calls.push(fnText);
+        for (const id of objectArgIdValues(n)) dom_ids.push(id);
+        if (fn.type === "identifier") {
+          if (TIMER_FNS.has(fnText)) timers.push(fnText);
+          if (fnText === "fetch") {
+            const url = firstStringArg(n);
+            fetches.push(url ? `fetch("${url}")` : "fetch(...)");
+            if (url) fetch_urls.push(url);
+          }
+        } else if (fn.type === "member_expression") {
+          const obj = fn.childForFieldName("object");
+          const prop = fn.childForFieldName("property");
+          const objText = obj?.text ?? "";
+          const propText = prop?.text ?? "";
+          if (STORAGE_OBJECTS.has(objText)) {
+            const key = firstStringArg(n);
+            persists.push(key ? `${objText}.${propText}("${key}")` : `${objText}.${propText}(\u2026)`);
+            if (key) storage_keys.push(key);
+          } else if (propText === "addEventListener") {
+            const event = firstStringArg(n);
+            subscribes.push(event ? `${objText}.addEventListener("${event}")` : `${objText}.addEventListener(\u2026)`);
+            if (event && (objText === "window" || objText === "document")) {
+              window_events.push(`${objText}:${event}`);
+            }
+          } else if (propText === "removeEventListener") {
+            const event = firstStringArg(n);
+            subscribes.push(event ? `${objText}.removeEventListener("${event}")` : `${objText}.removeEventListener(\u2026)`);
+          } else if (propText === "subscribe" || propText === "on") {
+            subscribes.push(`${objText}.${propText}(\u2026)`);
+          } else if (DOM_METHOD_NAMES.has(propText)) {
+            dom_writes.push(`${objText}.${propText}(\u2026)`);
+            if (propText === "setAttribute" && nthStringArg(n, 0) === "id") {
+              const idVal = nthStringArg(n, 1);
+              if (idVal) dom_ids.push(idVal);
+            }
+          } else if (objText.endsWith(".classList") && CLASSLIST_METHODS.has(propText)) {
+            dom_writes.push(`${objText}.${propText}(\u2026)`);
+          } else if (objText === "history" && HISTORY_METHODS.has(propText)) {
+            globals.push(`history.${propText}(\u2026)`);
+          } else if (objText === "location" && LOCATION_METHODS.has(propText)) {
+            globals.push(`location.${propText}(\u2026)`);
+          } else if (objText === "window" && propText === "matchMedia") {
+            globals.push("window.matchMedia(\u2026)");
+          }
+        }
+      }
+    } else if (n.type === "assignment_expression") {
+      const lhs = n.children.find((c) => c.type !== "=");
+      const rhs = n.childForFieldName("right");
+      if (lhs?.type === "member_expression") {
+        const prop = lhs.childForFieldName("property");
+        const propText = prop?.text ?? "";
+        const lhsText = lhs.text;
+        if (lhsText.startsWith("document.cookie")) {
+          persists.push("document.cookie =");
+        } else if (lhsText.startsWith("document.title") || lhsText.startsWith("location.")) {
+          globals.push(`${lhsText} =`);
+        } else if (ASSIGN_DOM_PROPS.has(propText) || lhsText.includes(".style.") || lhsText.includes(".dataset.")) {
+          dom_writes.push(`${lhsText} =`);
+          if (propText === "id" && rhs) {
+            const idVal = stringLiteralValue(rhs);
+            if (idVal) dom_ids.push(idVal);
+          }
+        }
+      }
+    }
+    for (const child of n.children) visit(child, depth + 1);
+  }
+  visit(node, 0);
+  const out = {};
+  if (calls.length) out.calls = dedup(calls);
+  if (dom_writes.length) out.dom_writes = dedup(dom_writes);
+  if (subscribes.length) out.subscribes = dedup(subscribes);
+  if (timers.length) out.timers = dedup(timers);
+  if (persists.length) out.persists = dedup(persists);
+  if (fetches.length) out.fetches = dedup(fetches);
+  if (globals.length) out.globals = dedup(globals);
+  if (dom_ids.length) out.dom_ids = dedup(dom_ids);
+  if (window_events.length) out.window_events = dedup(window_events);
+  if (storage_keys.length) out.storage_keys = dedup(storage_keys);
+  if (fetch_urls.length) out.fetch_urls = dedup(fetch_urls);
+  return out;
+}
 function extractDeep(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) {
+    return { elements: [], stateVars: [], conditions: [], variables: [], responses: [], params: [] };
+  }
   const root = tree.rootNode;
   const elements = [];
   const elQuery = getQuery("deep/jsx-semantic");
@@ -1071,12 +1289,18 @@ function extractDeep(absPath) {
     const caps = captureMap(m);
     const declNode = m.captures.find((c) => c.name === "var.decl" || c.name === "var.destructured" || c.name === "var.array")?.node;
     const kind = declNode?.children.find((n) => n.type === "const" || n.type === "let" || n.type === "var")?.type ?? "const";
+    const initNode = m.captures.find((c) => c.name === "var.init")?.node;
     if (caps["var.name"] && caps["var.init"]) {
-      variables.push({
+      const variable = {
         name: caps["var.name"],
         kind,
         init: trunc(caps["var.init"], 100)
-      });
+      };
+      if (initNode && isFunctionLike(initNode)) {
+        const eff = extractEffects(initNode);
+        if (Object.keys(eff).length > 0) variable.effects = eff;
+      }
+      variables.push(variable);
     }
     if (caps["var.destructured.obj"]) {
       variables.push({
@@ -1128,9 +1352,23 @@ function extractDeep(absPath) {
       params.push({ name: caps["param.body"], source: "body" });
     }
   }
-  return { elements, stateVars, conditions, variables, responses, params };
+  const fileEffects = extractEffects(
+    root,
+    /* moduleOnly */
+    false
+  );
+  const hasEffects = Object.keys(fileEffects).length > 0;
+  return {
+    elements,
+    stateVars,
+    conditions,
+    variables,
+    responses,
+    params,
+    ...hasEffects ? { effects: fileEffects } : {}
+  };
 }
-var import_node_fs5, import_node_path5, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS;
+var import_node_fs5, import_node_path5, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, MAX_PARSEABLE_BYTES, MAX_CONSECUTIVE_PARSE_FAILURES, consecutiveParseFailures, ParseCascadeError, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS, TRUST_AS_PROTECT_KEYS, TIMER_FNS, DOM_METHOD_NAMES, CLASSLIST_METHODS, STORAGE_OBJECTS, HISTORY_METHODS, LOCATION_METHODS, ASSIGN_DOM_PROPS;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
@@ -1143,6 +1381,19 @@ var init_ts_extractor = __esm({
       return (0, import_node_path5.join)((0, import_node_path5.dirname)(__filename), "graph", "queries");
     })();
     queryCache = /* @__PURE__ */ new Map();
+    MAX_PARSEABLE_BYTES = 2 * 1024 * 1024;
+    MAX_CONSECUTIVE_PARSE_FAILURES = 10;
+    consecutiveParseFailures = 0;
+    ParseCascadeError = class extends Error {
+      constructor(lastPath, failureCount) {
+        super(
+          `tree-sitter parse cascade: ${failureCount} consecutive WASM failures (last file: ${lastPath}). The shared Parser's WASM heap is likely corrupted; aborting regen so the graph isn't silently degraded. Restart the chart server to reinitialize, then re-run generate_graph.`
+        );
+        this.lastPath = lastPath;
+        this.failureCount = failureCount;
+        this.name = "ParseCascadeError";
+      }
+    };
     PRISMA_MUTATION_METHODS_BUILTIN = [
       "create",
       "createMany",
@@ -1192,6 +1443,49 @@ var init_ts_extractor = __esm({
       /^admin_?routes?/i,
       /^secured/i
     ];
+    TRUST_AS_PROTECT_KEYS = /* @__PURE__ */ new Set(["matcher", "matchers"]);
+    TIMER_FNS = /* @__PURE__ */ new Set([
+      "setInterval",
+      "setTimeout",
+      "clearInterval",
+      "clearTimeout",
+      "requestAnimationFrame",
+      "cancelAnimationFrame",
+      "queueMicrotask"
+    ]);
+    DOM_METHOD_NAMES = /* @__PURE__ */ new Set([
+      "setAttribute",
+      "removeAttribute",
+      "appendChild",
+      "removeChild",
+      "replaceChildren",
+      "replaceWith",
+      "insertBefore",
+      "append",
+      "prepend",
+      "remove",
+      "before",
+      "after",
+      "insertAdjacentHTML",
+      "insertAdjacentElement"
+    ]);
+    CLASSLIST_METHODS = /* @__PURE__ */ new Set(["add", "remove", "toggle", "replace"]);
+    STORAGE_OBJECTS = /* @__PURE__ */ new Set(["localStorage", "sessionStorage"]);
+    HISTORY_METHODS = /* @__PURE__ */ new Set(["pushState", "replaceState", "back", "forward", "go"]);
+    LOCATION_METHODS = /* @__PURE__ */ new Set(["assign", "replace", "reload"]);
+    ASSIGN_DOM_PROPS = /* @__PURE__ */ new Set([
+      "textContent",
+      "innerHTML",
+      "innerText",
+      "value",
+      "src",
+      "href",
+      "className",
+      "id",
+      "checked",
+      "selected",
+      "disabled"
+    ]);
   }
 });
 
@@ -1277,6 +1571,8 @@ function buildAllBarrelMaps(srcDir, parsedByPath) {
 function classifyType(absPath, id) {
   const contentType = classifyFile(absPath);
   if (contentType === "lib" && id.startsWith("server/mcp/")) return "mcp-tool";
+  if (/^app\/(.+\/)?page\.tsx$/.test(id)) return "page";
+  if (/^app\/(.+\/)?layout\.tsx$/.test(id)) return "layout";
   return contentType;
 }
 function extractRoute(id) {
@@ -1587,6 +1883,7 @@ function generate(rootDir) {
         variables: deep.variables,
         responses: deep.responses,
         params: deep.params,
+        ...deep.effects ? { effects: deep.effects } : {},
         _dbCalls: dbCalls
         // temp: used for cross-ref building below
       });
@@ -1606,6 +1903,7 @@ function generate(rootDir) {
         stateVars: deep.stateVars,
         conditions: deep.conditions,
         variables: deep.variables,
+        ...deep.effects ? { effects: deep.effects } : {},
         ...authWrappers.length > 0 ? { auth: authWrappers } : {},
         ...dbCalls.length > 0 ? { _dbCalls: dbCalls } : {}
       });
@@ -2053,6 +2351,7 @@ var init_typescript_project = __esm({
       config: "ui",
       lib: "ui",
       "mcp-tool": "ui",
+      middleware: "ui",
       external: "ui"
     };
     typescriptProjectParser = {
@@ -3962,6 +4261,119 @@ var init_static_ref_scanner = __esm({
   }
 });
 
+// src/server/graph/parsers/crosslayer/middleware-gates.ts
+function toNodeId4(srcDir, rootDir, absPath) {
+  const relFromSrc = (0, import_node_path12.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path12.relative)(rootDir, absPath).replace(/\\/g, "/");
+  }
+  return relFromSrc;
+}
+function collectTargets(apiOutput, uiOutput) {
+  const out = [];
+  for (const n of apiOutput?.nodes ?? []) {
+    if (n.type !== "endpoint") continue;
+    const path3 = n.path;
+    if (typeof path3 !== "string" || !path3) continue;
+    out.push({ id: n.id, route: path3, layer: "api" });
+  }
+  for (const n of uiOutput?.nodes ?? []) {
+    if (n.type !== "page") continue;
+    const route = n.route;
+    if (typeof route !== "string" || !route) continue;
+    out.push({ id: n.id, route, layer: "ui" });
+  }
+  return out;
+}
+var import_node_path12, middlewareGatesParser;
+var init_middleware_gates = __esm({
+  "src/server/graph/parsers/crosslayer/middleware-gates.ts"() {
+    "use strict";
+    import_node_path12 = require("node:path");
+    init_ts_extractor();
+    init_config();
+    init_resolve_paths();
+    middlewareGatesParser = {
+      id: "middleware-gates",
+      layer: "crosslayer",
+      concern: "auth-gate",
+      detect(rootDir) {
+        const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+        if (!paths) return false;
+        return paths.conventionFiles.some((f) => /middleware\.tsx?$/.test(f));
+      },
+      generate(rootDir, layerOutputs) {
+        const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+        if (!paths) return { cross_refs: [], flagged_edges: [], warnings: [] };
+        const middlewareFiles = paths.conventionFiles.filter((f) => /middleware\.tsx?$/.test(f));
+        if (middlewareFiles.length === 0) {
+          return { cross_refs: [], flagged_edges: [], warnings: [] };
+        }
+        const apiOutput = layerOutputs.get("api");
+        const uiOutput = layerOutputs.get("ui");
+        const targets = collectTargets(apiOutput, uiOutput);
+        const crossRefs = [];
+        const flagged = [];
+        const seenEdge = /* @__PURE__ */ new Set();
+        const seenUnparseable = /* @__PURE__ */ new Set();
+        let protectMatcherCount = 0;
+        for (const file of middlewareFiles) {
+          let info = null;
+          try {
+            info = extractMiddlewareAuthTS(file);
+          } catch {
+          }
+          if (!info || info.matchers.length === 0) continue;
+          const middlewareId = toNodeId4(paths.srcDir, rootDir, file);
+          for (const matcher of info.matchers) {
+            if (matcher.intent !== "protect") continue;
+            protectMatcherCount += 1;
+            for (const pattern of matcher.patterns) {
+              const re = middlewarePatternToRegex(pattern);
+              if (!re) {
+                const key = `${middlewareId}|${pattern}`;
+                if (seenUnparseable.has(key)) continue;
+                seenUnparseable.add(key);
+                flagged.push({
+                  source: middlewareId,
+                  target: "UNRESOLVED",
+                  type: "middleware_pattern_unparseable",
+                  label: `pattern "${pattern}" in matcher "${matcher.name}" \u2014 coverage unknown`,
+                  confidence: "high"
+                });
+                continue;
+              }
+              for (const target of targets) {
+                if (!re.test(target.route)) continue;
+                const key = `${middlewareId}|${target.id}|protects`;
+                if (seenEdge.has(key)) continue;
+                seenEdge.add(key);
+                crossRefs.push({
+                  source: middlewareId,
+                  target: target.id,
+                  type: "protects",
+                  layer: target.layer
+                });
+              }
+            }
+          }
+        }
+        return {
+          cross_refs: crossRefs,
+          flagged_edges: flagged,
+          warnings: [],
+          patterns: {
+            middleware_files: middlewareFiles.length,
+            protect_matchers: protectMatcherCount,
+            protects_edges: crossRefs.length,
+            unparseable_patterns: flagged.length
+          }
+        };
+      }
+    };
+  }
+});
+
 // src/server/graph/core/parser-registry.ts
 function isMultiLayerParser(p) {
   return "layers" in p && Array.isArray(p.layers);
@@ -3975,7 +4387,8 @@ function registerBuiltins(registry, disabled) {
     fetchResolverParser,
     apiAnnotationsParser,
     urlLiteralScannerParser,
-    staticRefScannerParser
+    staticRefScannerParser,
+    middlewareGatesParser
   ];
   for (const parser of builtins) {
     if (disabled.has(parser.id)) continue;
@@ -3985,7 +4398,7 @@ function registerBuiltins(registry, disabled) {
 function loadCustomParsers(registry, config, rootDir, disabled) {
   for (const entry of config.parsers?.custom ?? []) {
     try {
-      const absPath = (0, import_node_path12.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path13.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const parser = "default" in mod ? mod.default : mod;
       if (disabled.has(parser.id)) continue;
@@ -4012,11 +4425,11 @@ function createRegistry(config, rootDir) {
   loadCustomParsers(registry, config, rootDir, disabled);
   return registry;
 }
-var import_node_path12, ParserRegistry;
+var import_node_path13, ParserRegistry;
 var init_parser_registry = __esm({
   "src/server/graph/core/parser-registry.ts"() {
     "use strict";
-    import_node_path12 = require("node:path");
+    import_node_path13 = require("node:path");
     init_typescript_project();
     init_prisma_schema();
     init_sql_migrations();
@@ -4025,6 +4438,7 @@ var init_parser_registry = __esm({
     init_url_literal_scanner();
     init_static_values();
     init_static_ref_scanner();
+    init_middleware_gates();
     ParserRegistry = class {
       constructor() {
         this.singleLayerParsers = /* @__PURE__ */ new Map();
@@ -4187,7 +4601,7 @@ var init_merge = __esm({
 
 // src/server/graph/core/graph-builder.ts
 function readGraphFromDisk(rootDir, layer) {
-  const filePath = (0, import_node_path13.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  const filePath = (0, import_node_path14.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
   if (!(0, import_node_fs13.existsSync)(filePath)) return null;
   try {
     return JSON.parse((0, import_node_fs13.readFileSync)(filePath, "utf-8"));
@@ -4286,12 +4700,12 @@ function generateAll(rootDir) {
   const extras = [...byLayer.keys()].filter((l) => !wellKnownOrder.includes(l)).sort();
   return [...wellKnownOrder, ...extras].map((l) => byLayer.get(l)).filter((r) => !!r);
 }
-var import_node_fs13, import_node_path13;
+var import_node_fs13, import_node_path14;
 var init_graph_builder = __esm({
   "src/server/graph/core/graph-builder.ts"() {
     "use strict";
     import_node_fs13 = require("node:fs");
-    import_node_path13 = require("node:path");
+    import_node_path14 = require("node:path");
     init_config();
     init_parser_registry();
     init_merge();
@@ -4330,13 +4744,13 @@ function detectConventionDirs(rootDir, extraConventionDirs = []) {
   const conventionDirs = [...CONVENTION_DIRS_BUILTIN, ...extraConventionDirs];
   const searchDirs = [
     rootDir,
-    (0, import_node_path14.join)(rootDir, "src"),
-    (0, import_node_path14.join)(rootDir, "app"),
-    (0, import_node_path14.join)(rootDir, "lib")
+    (0, import_node_path15.join)(rootDir, "src"),
+    (0, import_node_path15.join)(rootDir, "app"),
+    (0, import_node_path15.join)(rootDir, "lib")
   ];
   for (const base of searchDirs) {
     for (const convention of conventionDirs) {
-      const dir = (0, import_node_path14.join)(base, convention);
+      const dir = (0, import_node_path15.join)(base, convention);
       if (!(0, import_node_fs14.existsSync)(dir)) continue;
       try {
         const stat = (0, import_node_fs14.statSync)(dir);
@@ -4417,12 +4831,12 @@ function extractModuleFromPath(id, extraTrivial, extraSkipSegments, extraGeneric
   }
   return "root";
 }
-var import_node_fs14, import_node_path14, CONVENTION_DIRS_BUILTIN, GENERIC_ROLE_NAMES_BUILTIN, SKIP_SEGMENTS_BUILTIN, TRIVIAL_GROUPS, cachedRootDir, cachedConventionDirs, moduleTagger;
+var import_node_fs14, import_node_path15, CONVENTION_DIRS_BUILTIN, GENERIC_ROLE_NAMES_BUILTIN, SKIP_SEGMENTS_BUILTIN, TRIVIAL_GROUPS, cachedRootDir, cachedConventionDirs, moduleTagger;
 var init_module_tagger = __esm({
   "src/server/graph/taggers/module-tagger.ts"() {
     "use strict";
     import_node_fs14 = require("node:fs");
-    import_node_path14 = require("node:path");
+    import_node_path15 = require("node:path");
     CONVENTION_DIRS_BUILTIN = ["features", "modules", "domains", "areas"];
     GENERIC_ROLE_NAMES_BUILTIN = /* @__PURE__ */ new Set([
       // JS/TS
@@ -4637,7 +5051,7 @@ function loadCustomTaggers(registry, config, rootDir, disabled) {
   for (const entry of config.taggers?.custom ?? []) {
     if (disabled.has(entry.id)) continue;
     try {
-      const absPath = (0, import_node_path15.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path16.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const tagger = "default" in mod ? mod.default : mod;
       const override = config.taggers?.trackUntagged?.[tagger.id];
@@ -4658,11 +5072,11 @@ function createTaggerRegistry(config, rootDir) {
   loadCustomTaggers(registry, config, rootDir, disabled);
   return registry;
 }
-var import_node_path15, TaggerRegistry, BUILTIN_TAGGERS;
+var import_node_path16, TaggerRegistry, BUILTIN_TAGGERS;
 var init_tagger_registry = __esm({
   "src/server/graph/core/tagger-registry.ts"() {
     "use strict";
-    import_node_path15 = require("node:path");
+    import_node_path16 = require("node:path");
     init_module_tagger();
     init_screen_tagger();
     TaggerRegistry = class {
@@ -4690,7 +5104,7 @@ var init_tagger_registry = __esm({
 
 // src/server/graph/core/tag-store.ts
 function tagsFilePath(rootDir) {
-  return (0, import_node_path16.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
+  return (0, import_node_path17.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
 }
 function readTagStore(rootDir) {
   const filePath = tagsFilePath(rootDir);
@@ -4711,7 +5125,7 @@ function readTagStore(rootDir) {
 }
 function writeTagStore(rootDir, store) {
   const filePath = tagsFilePath(rootDir);
-  const dir = (0, import_node_path16.dirname)(filePath);
+  const dir = (0, import_node_path17.dirname)(filePath);
   (0, import_node_fs15.mkdirSync)(dir, { recursive: true });
   const cleaned = {};
   for (const [nodeId, tags] of Object.entries(store)) {
@@ -4737,36 +5151,102 @@ function removeTag(rootDir, nodeId, key) {
   }
   writeTagStore(rootDir, store);
 }
-var import_node_fs15, import_node_path16, TAGS_FILENAME, GRAPHS_DIR, tagCache;
+var import_node_fs15, import_node_path17, TAGS_FILENAME, GRAPHS_DIR, tagCache;
 var init_tag_store = __esm({
   "src/server/graph/core/tag-store.ts"() {
     "use strict";
     import_node_fs15 = require("node:fs");
-    import_node_path16 = require("node:path");
+    import_node_path17 = require("node:path");
     TAGS_FILENAME = "tags.json";
     GRAPHS_DIR = ".launchsecure/graphs";
     tagCache = /* @__PURE__ */ new Map();
   }
 });
 
+// src/server/graph/core/effects-index.ts
+function addTo(map, key, nodeId) {
+  const list = map[key];
+  if (!list) {
+    map[key] = [nodeId];
+  } else if (!list.includes(nodeId)) {
+    list.push(nodeId);
+  }
+}
+function collisionList(map) {
+  const out = [];
+  for (const [key, nodes] of Object.entries(map)) {
+    if (nodes.length > 1) out.push({ key, nodes: nodes.slice().sort() });
+  }
+  out.sort((a, b) => b.nodes.length - a.nodes.length || a.key.localeCompare(b.key));
+  return out;
+}
+function buildEffectsIndex(layerOutputs) {
+  const idx = {
+    generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+    dom_ids: {},
+    window_events: {},
+    storage_keys: {},
+    fetch_urls: {},
+    timers: {},
+    singleton_risks: [],
+    collisions: { dom_ids: [], storage_keys: [], window_events: [] }
+  };
+  const singletonSet = /* @__PURE__ */ new Set();
+  for (const output of Object.values(layerOutputs)) {
+    for (const node of output.nodes) {
+      const eff = node.effects;
+      if (!eff) continue;
+      for (const id of eff.dom_ids ?? []) addTo(idx.dom_ids, id, node.id);
+      for (const ev of eff.window_events ?? []) addTo(idx.window_events, ev, node.id);
+      for (const k of eff.storage_keys ?? []) addTo(idx.storage_keys, k, node.id);
+      for (const u of eff.fetch_urls ?? []) addTo(idx.fetch_urls, u, node.id);
+      for (const t of eff.timers ?? []) addTo(idx.timers, t, node.id);
+      const hasTimer = (eff.timers?.length ?? 0) > 0;
+      const hasWindowListener = (eff.window_events?.length ?? 0) > 0;
+      const hasGlobalMutation = (eff.globals?.length ?? 0) > 0;
+      if (hasTimer || hasWindowListener || hasGlobalMutation) {
+        singletonSet.add(node.id);
+      }
+    }
+  }
+  idx.singleton_risks = Array.from(singletonSet).sort();
+  idx.collisions.dom_ids = collisionList(idx.dom_ids);
+  idx.collisions.storage_keys = collisionList(idx.storage_keys);
+  idx.collisions.window_events = collisionList(idx.window_events);
+  return idx;
+}
+function writeEffectsIndex(rootDir, idx) {
+  const path3 = (0, import_node_path18.join)(rootDir, ".launchsecure", "graphs", "effects-index.json");
+  (0, import_node_fs16.writeFileSync)(path3, JSON.stringify(idx, null, 2) + "\n", "utf-8");
+  return path3;
+}
+var import_node_fs16, import_node_path18;
+var init_effects_index = __esm({
+  "src/server/graph/core/effects-index.ts"() {
+    "use strict";
+    import_node_fs16 = require("node:fs");
+    import_node_path18 = require("node:path");
+  }
+});
+
 // src/server/graph/index.ts
 function getAvailableLayers(rootDir) {
-  const dir = (0, import_node_path17.join)(rootDir, GRAPHS_DIR2);
-  if (!(0, import_node_fs16.existsSync)(dir)) return [];
-  return (0, import_node_fs16.readdirSync)(dir).filter((f) => f.endsWith(".json") && f !== "tags.json").map((f) => f.replace(".json", ""));
+  const dir = (0, import_node_path19.join)(rootDir, GRAPHS_DIR2);
+  if (!(0, import_node_fs17.existsSync)(dir)) return [];
+  return (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".json") && !NON_LAYER_GRAPH_FILES.has(f)).map((f) => f.replace(".json", ""));
 }
 function graphsDir(rootDir) {
-  return (0, import_node_path17.join)(rootDir, GRAPHS_DIR2);
+  return (0, import_node_path19.join)(rootDir, GRAPHS_DIR2);
 }
 function graphFilePath(rootDir, layer) {
-  return (0, import_node_path17.join)(graphsDir(rootDir), `${layer}.json`);
+  return (0, import_node_path19.join)(graphsDir(rootDir), `${layer}.json`);
 }
 function tagsFilePath2(rootDir) {
-  return (0, import_node_path17.join)(graphsDir(rootDir), "tags.json");
+  return (0, import_node_path19.join)(graphsDir(rootDir), "tags.json");
 }
 function getMtimeMs(filePath) {
-  if (!(0, import_node_fs16.existsSync)(filePath)) return 0;
-  return (0, import_node_fs16.statSync)(filePath).mtimeMs;
+  if (!(0, import_node_fs17.existsSync)(filePath)) return 0;
+  return (0, import_node_fs17.statSync)(filePath).mtimeMs;
 }
 function invalidateCache(filePath) {
   graphCache.delete(filePath);
@@ -4805,20 +5285,20 @@ function applyTags(graph, layer, rootDir) {
 }
 function readGraphRaw(rootDir, layer) {
   const filePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs16.existsSync)(filePath)) return null;
-  const stat = (0, import_node_fs16.statSync)(filePath);
+  if (!(0, import_node_fs17.existsSync)(filePath)) return null;
+  const stat = (0, import_node_fs17.statSync)(filePath);
   const cached = graphCache.get(filePath);
   if (cached && cached.mtimeMs === stat.mtimeMs) {
     return cached.graph;
   }
-  const content = (0, import_node_fs16.readFileSync)(filePath, "utf-8");
+  const content = (0, import_node_fs17.readFileSync)(filePath, "utf-8");
   const graph = JSON.parse(content);
   graphCache.set(filePath, { mtimeMs: stat.mtimeMs, graph });
   return graph;
 }
 function readGraph(rootDir, layer) {
   const rawFilePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs16.existsSync)(rawFilePath)) return null;
+  if (!(0, import_node_fs17.existsSync)(rawFilePath)) return null;
   const rawMtime = getMtimeMs(rawFilePath);
   const tagsMtime = getMtimeMs(tagsFilePath2(rootDir));
   const cacheKey = `${rootDir}:${layer}`;
@@ -4848,24 +5328,24 @@ async function generateGraph(rootDir, layer) {
     mutationMethods: config.parsers?.patterns?.mutationMethods
   });
   const dir = graphsDir(rootDir);
-  (0, import_node_fs16.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs17.mkdirSync)(dir, { recursive: true });
   const results = layer ? [generateLayer(rootDir, layer)].filter((r) => r !== null) : generateAll(rootDir);
   for (const result of results) {
     const filePath = graphFilePath(rootDir, result.layer);
-    (0, import_node_fs16.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
+    (0, import_node_fs17.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
     invalidateCache(filePath);
     invalidateTaggedCache(rootDir, result.layer);
   }
   if (!layer) {
     const producedLayers = new Set(results.map((r) => r.layer));
     try {
-      for (const f of (0, import_node_fs16.readdirSync)(dir)) {
-        if (!f.endsWith(".json") || f === "tags.json") continue;
+      for (const f of (0, import_node_fs17.readdirSync)(dir)) {
+        if (!f.endsWith(".json") || f === "tags.json" || f === "effects-index.json") continue;
         const layerName = f.replace(/\.json$/, "");
         if (producedLayers.has(layerName)) continue;
-        const orphan = (0, import_node_path17.join)(dir, f);
+        const orphan = (0, import_node_path19.join)(dir, f);
         try {
-          (0, import_node_fs16.unlinkSync)(orphan);
+          (0, import_node_fs17.unlinkSync)(orphan);
           invalidateCache(orphan);
           invalidateTaggedCache(rootDir, layerName);
           process.stderr.write(`[launch-chart] removed orphan layer file: ${f} (no parser produced ${layerName} this run)
@@ -4876,32 +5356,404 @@ async function generateGraph(rootDir, layer) {
     } catch {
     }
   }
+  try {
+    const allLayers = {};
+    for (const r of results) allLayers[r.layer] = r.output;
+    if (layer) {
+      for (const f of (0, import_node_fs17.readdirSync)(dir)) {
+        if (!f.endsWith(".json") || f === "tags.json" || f === "effects-index.json") continue;
+        const layerName = f.replace(/\.json$/, "");
+        if (allLayers[layerName]) continue;
+        const existing = readGraphRaw(rootDir, layerName);
+        if (existing) allLayers[layerName] = existing;
+      }
+    }
+    const idx = buildEffectsIndex(allLayers);
+    writeEffectsIndex(rootDir, idx);
+  } catch (e) {
+    process.stderr.write(`[launch-chart] effects-index build failed: ${e.message}
+`);
+  }
   return results;
 }
-var import_node_fs16, import_node_path17, GRAPHS_DIR2, graphCache, taggedCache;
+function readEffectsIndex(rootDir) {
+  const path3 = (0, import_node_path19.join)(rootDir, GRAPHS_DIR2, "effects-index.json");
+  if (!(0, import_node_fs17.existsSync)(path3)) return null;
+  try {
+    return JSON.parse((0, import_node_fs17.readFileSync)(path3, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+var import_node_fs17, import_node_path19, GRAPHS_DIR2, NON_LAYER_GRAPH_FILES, graphCache, taggedCache;
 var init_graph = __esm({
   "src/server/graph/index.ts"() {
     "use strict";
-    import_node_fs16 = require("node:fs");
-    import_node_path17 = require("node:path");
+    import_node_fs17 = require("node:fs");
+    import_node_path19 = require("node:path");
     init_graph_builder();
     init_config();
     init_tagger_registry();
     init_tag_store();
     init_ts_extractor();
+    init_effects_index();
     init_tag_store();
     GRAPHS_DIR2 = ".launchsecure/graphs";
+    NON_LAYER_GRAPH_FILES = /* @__PURE__ */ new Set(["tags.json", "effects-index.json"]);
     graphCache = /* @__PURE__ */ new Map();
     taggedCache = /* @__PURE__ */ new Map();
   }
 });
 
+// src/server/graph/core/audit-security.ts
+function collectSourceFiles(rootDir) {
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  if (!paths) return null;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const root of paths.srcRoots) {
+    for (const f of walk(root, [".ts", ".tsx"])) {
+      if (!seen.has(f)) {
+        seen.add(f);
+        out.push(f);
+      }
+    }
+  }
+  for (const conv of paths.conventionFiles) {
+    if (!seen.has(conv)) {
+      seen.add(conv);
+      out.push(conv);
+    }
+  }
+  return out;
+}
+function toNodeId5(rootDir, srcDir, absPath) {
+  const relFromSrc = (0, import_node_path20.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path20.relative)(rootDir, absPath).replace(/\\/g, "/");
+  }
+  return relFromSrc;
+}
+function scanResponseSecretsInFile(absPath) {
+  const tree = parseSource(absPath);
+  if (!tree) return [];
+  const query = createQuery(`
+    (call_expression
+      function: (member_expression
+        property: (property_identifier) @method
+        (#eq? @method "json"))
+      arguments: (arguments
+        (object) @payload))
+  `);
+  const matches = query.matches(tree.rootNode);
+  const hits = [];
+  for (const m of matches) {
+    const caps = m.captures;
+    const payload = caps.find((c) => c.name === "payload")?.node;
+    if (!payload) continue;
+    walkPairKeys(payload, (keyName, node) => {
+      const trimmed = keyName.replace(/^["']|["']$/g, "");
+      if (SECRET_KEY_ALLOWLIST.has(trimmed)) return;
+      if (!SECRET_KEY_RE.test(trimmed)) return;
+      hits.push({
+        file: absPath,
+        line: node.startPosition.row + 1,
+        keyName: trimmed,
+        callShape: payload.text.slice(0, 40).replace(/\s+/g, " ")
+      });
+    });
+  }
+  return hits;
+}
+function walkPairKeys(node, visit) {
+  for (const child of node.children) {
+    if (child.type === "pair") {
+      const keyChild = child.children[0];
+      if (keyChild && (keyChild.type === "property_identifier" || keyChild.type === "string")) {
+        visit(keyChild.text, keyChild);
+      }
+      const valueChild = child.children[child.children.length - 1];
+      if (valueChild && valueChild.type === "object") walkPairKeys(valueChild, visit);
+    } else if (child.type === "shorthand_property_identifier") {
+      visit(child.text, child);
+    } else if (child.type === "object") {
+      walkPairKeys(child, visit);
+    }
+  }
+}
+function checkResponseSecretLeak(rootDir, core) {
+  const files = collectSourceFiles(rootDir);
+  if (files === null || files.length === 0) {
+    return core.buildSkipped(
+      "security",
+      "response_secret_leak",
+      `no source files detected \u2014 not a TypeScript project, or src roots aren't configured`
+    );
+  }
+  const findings = [];
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  for (const abs of files) {
+    let hits = [];
+    try {
+      hits = scanResponseSecretsInFile(abs);
+    } catch {
+    }
+    for (const h of hits) {
+      const fileId = toNodeId5(rootDir, paths.srcDir, abs);
+      findings.push({
+        id: `secret-leak:${fileId}:${h.line}:${h.keyName}`,
+        severity: "error",
+        category: "response_secret_leak",
+        title: `${h.keyName} in response payload`,
+        detail: `Response body includes a "${h.keyName}" key \u2014 likely leaking a secret to the client. If this is a public identifier or anti-CSRF token, add it to the allow-list in audit-security.ts.`,
+        file: fileId,
+        line: h.line
+      });
+    }
+  }
+  return core.buildReport("security", "response_secret_leak", findings);
+}
+function collectDeclaredEnvKeys(rootDir) {
+  const keys = /* @__PURE__ */ new Set();
+  const files = [];
+  let entries = [];
+  try {
+    entries = (0, import_node_fs18.readdirSync)(rootDir);
+  } catch {
+    return { keys, files };
+  }
+  for (const name of entries) {
+    if (!name.startsWith(".env")) continue;
+    const abs = (0, import_node_path20.join)(rootDir, name);
+    if (!(0, import_node_fs18.existsSync)(abs)) continue;
+    files.push(name);
+    let content = "";
+    try {
+      content = (0, import_node_fs18.readFileSync)(abs, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const line of content.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq < 0) continue;
+      const key = trimmed.slice(0, eq).trim();
+      if (/^[A-Z_][A-Z0-9_]*$/.test(key)) keys.add(key);
+    }
+  }
+  return { keys, files };
+}
+function scanEnvRefsInFile(absPath) {
+  const tree = parseSource(absPath);
+  if (!tree) return [];
+  const query = createQuery(`
+    ; process.env.X
+    (member_expression
+      object: (member_expression
+        object: (identifier) @_proc
+        property: (property_identifier) @_env)
+      property: (property_identifier) @env_name
+      (#eq? @_proc "process")
+      (#eq? @_env "env"))
+
+    ; process.env["X"]
+    (subscript_expression
+      object: (member_expression
+        object: (identifier) @_proc2
+        property: (property_identifier) @_env2)
+      index: (string (string_fragment) @env_name_str)
+      (#eq? @_proc2 "process")
+      (#eq? @_env2 "env"))
+  `);
+  const matches = query.matches(tree.rootNode);
+  const refs = [];
+  for (const m of matches) {
+    const caps = m.captures;
+    const key = caps.find((c) => c.name === "env_name" || c.name === "env_name_str");
+    if (!key) continue;
+    refs.push({ file: absPath, line: key.node.startPosition.row + 1, envKey: key.node.text });
+  }
+  return refs;
+}
+function checkEnvDeadAlias(rootDir, core) {
+  const { keys: declared, files: envFiles } = collectDeclaredEnvKeys(rootDir);
+  if (envFiles.length === 0) {
+    return core.buildSkipped(
+      "security",
+      "env_dead_alias",
+      `no .env* files in project root \u2014 this check needs a declared-env inventory to compare against`
+    );
+  }
+  const files = collectSourceFiles(rootDir);
+  if (files === null || files.length === 0) {
+    return core.buildSkipped("security", "env_dead_alias", `no source files detected`);
+  }
+  const findings = [];
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  const seen = /* @__PURE__ */ new Set();
+  for (const abs of files) {
+    let refs = [];
+    try {
+      refs = scanEnvRefsInFile(abs);
+    } catch {
+    }
+    for (const r of refs) {
+      if (declared.has(r.envKey)) continue;
+      if (FRAMEWORK_ENV_KEYS.has(r.envKey)) continue;
+      if (r.envKey.startsWith("npm_")) continue;
+      const fileId = toNodeId5(rootDir, paths.srcDir, abs);
+      const dedupeKey = `${fileId}:${r.envKey}`;
+      if (seen.has(dedupeKey)) continue;
+      seen.add(dedupeKey);
+      findings.push({
+        id: `dead-env:${fileId}:${r.envKey}`,
+        severity: "warning",
+        category: "env_dead_alias",
+        title: `process.env.${r.envKey} not declared in any .env file`,
+        detail: `Reference to env var "${r.envKey}" but no .env* file declares it (${envFiles.join(", ")}). Likely a rename left behind, a typo, or an env var that's only set in deployment but should be documented in .env.example.`,
+        file: fileId,
+        line: r.line
+      });
+    }
+  }
+  return core.buildReport("security", "env_dead_alias", findings);
+}
+function scanUrlFallbacksInFile(absPath) {
+  const tree = parseSource(absPath);
+  if (!tree) return [];
+  const query = createQuery(`
+    ; process.env.X || "https://..."   or   process.env.X ?? "https://..."
+    (binary_expression
+      left: (member_expression
+        object: (member_expression
+          object: (identifier) @_proc
+          property: (property_identifier) @_env)
+        property: (property_identifier) @env_var)
+      right: (string (string_fragment) @url)
+      (#eq? @_proc "process")
+      (#eq? @_env "env")
+      (#match? @url "^https?://")) @expr
+  `);
+  const matches = query.matches(tree.rootNode);
+  const hits = [];
+  for (const m of matches) {
+    const caps = m.captures;
+    const envVar = caps.find((c) => c.name === "env_var")?.node;
+    const url = caps.find((c) => c.name === "url")?.node;
+    const expr = caps.find((c) => c.name === "expr")?.node;
+    if (!envVar || !url || !expr) continue;
+    const opMatch = / (\|\||\?\?) /.exec(expr.text);
+    const operator = opMatch ? opMatch[1] : "||";
+    hits.push({
+      file: absPath,
+      line: envVar.startPosition.row + 1,
+      envKey: envVar.text,
+      url: url.text,
+      operator
+    });
+  }
+  return hits;
+}
+function checkHardcodedUrlFallback(rootDir, core) {
+  const files = collectSourceFiles(rootDir);
+  if (files === null || files.length === 0) {
+    return core.buildSkipped("security", "hardcoded_url_fallback", `no source files detected`);
+  }
+  const findings = [];
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  for (const abs of files) {
+    let hits = [];
+    try {
+      hits = scanUrlFallbacksInFile(abs);
+    } catch {
+    }
+    for (const h of hits) {
+      const fileId = toNodeId5(rootDir, paths.srcDir, abs);
+      findings.push({
+        id: `url-fallback:${fileId}:${h.line}:${h.envKey}`,
+        severity: "warning",
+        category: "hardcoded_url_fallback",
+        title: `${h.envKey} ${h.operator} "${h.url}"`,
+        detail: `Hardcoded URL fallback for env var "${h.envKey}". If the env var is unset in prod, requests will silently route to "${h.url}" \u2014 common cause of dev/prod URL leaks and stale localhost ports. Make the env var required, or move the default to a deployment-aware config.`,
+        file: fileId,
+        line: h.line
+      });
+    }
+  }
+  return core.buildReport("security", "hardcoded_url_fallback", findings);
+}
+var import_node_fs18, import_node_path20, SECRET_KEY_RE, SECRET_KEY_ALLOWLIST, FRAMEWORK_ENV_KEYS;
+var init_audit_security = __esm({
+  "src/server/graph/core/audit-security.ts"() {
+    "use strict";
+    import_node_fs18 = require("node:fs");
+    import_node_path20 = require("node:path");
+    init_ts_extractor();
+    init_config();
+    init_resolve_paths();
+    init_walk();
+    SECRET_KEY_RE = /^(.*_)?(token|secret|password|passwd|credential|credentials|apikey|api_key|access_?token|refresh_?token|client_?secret|private_?key|signing_?key|webhook_?secret|auth_?token|bearer)$/i;
+    SECRET_KEY_ALLOWLIST = /* @__PURE__ */ new Set([
+      "csrfToken",
+      "csrf_token",
+      "publicKey",
+      "public_key",
+      "clientId",
+      "idempotencyKey",
+      "idempotency_key",
+      "requestKey",
+      "request_key",
+      "sessionId",
+      "session_id",
+      "apiKeyId",
+      "api_key_id",
+      "tokenType",
+      "token_type",
+      "tokenExpiry",
+      "token_expiry",
+      "isAccessToken",
+      "hasToken"
+    ]);
+    FRAMEWORK_ENV_KEYS = /* @__PURE__ */ new Set([
+      "NODE_ENV",
+      "NODE_OPTIONS",
+      "NODE_PATH",
+      "PATH",
+      "HOME",
+      "USER",
+      "PWD",
+      "CI",
+      "GITHUB_ACTIONS",
+      "GITHUB_WORKFLOW",
+      "GITHUB_RUN_ID",
+      "GITHUB_SHA",
+      "VERCEL",
+      "VERCEL_ENV",
+      "VERCEL_URL",
+      "VERCEL_REGION",
+      "VERCEL_GIT_COMMIT_SHA",
+      "VERCEL_GIT_COMMIT_REF",
+      "VERCEL_GIT_REPO_SLUG",
+      "VERCEL_GIT_REPO_OWNER",
+      "PORT",
+      "TZ",
+      "LANG",
+      "LC_ALL",
+      "TERM",
+      "DEBUG",
+      "NEXT_RUNTIME",
+      "NEXT_PUBLIC_VERCEL_URL"
+    ]);
+  }
+});
+
 // src/server/graph/core/audit-core.ts
 function readGraphFile(rootDir, layer) {
-  const filePath = (0, import_node_path18.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
-  if (!(0, import_node_fs17.existsSync)(filePath)) return null;
+  const filePath = (0, import_node_path21.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  if (!(0, import_node_fs19.existsSync)(filePath)) return null;
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)(filePath, "utf-8"));
+    return JSON.parse((0, import_node_fs19.readFileSync)(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -4910,8 +5762,7 @@ function checkSchemaDrift(rootDir) {
   const findings = [];
   const db = readGraphFile(rootDir, "db");
   if (!db) {
-    findings.push({ id: "no-db-graph", severity: "info", category: "schema_drift", title: "No DB graph", detail: "Run generate_graph first to populate the DB layer." });
-    return buildReport("db", "schema_drift", findings);
+    return buildSkipped("db", "schema_drift", "no db graph \u2014 generate_graph first, or this project has no Prisma schema");
   }
   for (const c of db.contradictions ?? []) {
     const isTableLevel = c.detail.includes("Table ") && (c.detail.includes("has no CREATE TABLE") || c.detail.includes("not in schema.prisma"));
@@ -4928,7 +5779,7 @@ function checkSchemaDrift(rootDir) {
 function checkOrphanFks(rootDir) {
   const findings = [];
   const db = readGraphFile(rootDir, "db");
-  if (!db) return buildReport("db", "orphan_fks", findings);
+  if (!db) return buildSkipped("db", "orphan_fks", "no db graph");
   for (const f of db.flagged_edges ?? []) {
     findings.push({
       id: `fk:${f.source}->${f.target}`,
@@ -4943,13 +5794,16 @@ function checkOrphanFks(rootDir) {
 function checkUnprotectedRoutes(rootDir) {
   const findings = [];
   const api = readGraphFile(rootDir, "api");
-  const staticGraph = readGraphFile(rootDir, "static");
-  if (!api) return buildReport("api", "unprotected_routes", findings);
-  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
-  let routePermsContent = "";
-  if ((0, import_node_fs17.existsSync)(routePermsPath)) {
-    routePermsContent = (0, import_node_fs17.readFileSync)(routePermsPath, "utf-8");
+  if (!api) return buildSkipped("api", "unprotected_routes", "no api graph");
+  const routePermsPath = (0, import_node_path21.join)(rootDir, "src", "config", "route-permissions.ts");
+  if (!(0, import_node_fs19.existsSync)(routePermsPath)) {
+    return buildSkipped(
+      "api",
+      "unprotected_routes",
+      `no src/config/route-permissions.ts \u2014 this check needs a centralized ROUTE_PERMISSIONS inventory to compare endpoints against`
+    );
   }
+  const routePermsContent = (0, import_node_fs19.readFileSync)(routePermsPath, "utf-8");
   const registeredRoutes = /* @__PURE__ */ new Set();
   const routeEntryRe = /path:\s*'([^']+)'/g;
   let rm;
@@ -4993,7 +5847,7 @@ function routeMatchesPattern(route, pattern) {
 function checkDeadScreens(rootDir) {
   const findings = [];
   const ui = readGraphFile(rootDir, "ui");
-  if (!ui) return buildReport("ui", "dead_screens", findings);
+  if (!ui) return buildSkipped("ui", "dead_screens", "no ui graph");
   const pages = ui.nodes.filter((n) => n.type === "page" || n.type === "layout");
   const navTargets = /* @__PURE__ */ new Set();
   for (const e of ui.edges) {
@@ -5025,13 +5879,24 @@ function checkDeadScreens(rootDir) {
 function checkUnenforcedPermissions(rootDir) {
   const findings = [];
   const staticGraph = readGraphFile(rootDir, "static");
-  if (!staticGraph) return buildReport("static", "unenforced_permissions", findings);
+  if (!staticGraph) return buildSkipped("static", "unenforced_permissions", "no static graph");
   const permissions = staticGraph.nodes.filter((n) => n.type === "seed_permission").map((n) => ({ id: n.id, key: n.value, name: n.name }));
-  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
-  let routePermsContent = "";
-  if ((0, import_node_fs17.existsSync)(routePermsPath)) {
-    routePermsContent = (0, import_node_fs17.readFileSync)(routePermsPath, "utf-8");
+  if (permissions.length === 0) {
+    return buildSkipped(
+      "static",
+      "unenforced_permissions",
+      `no seed_permission nodes \u2014 this project either has no seed permissions or hasn't tagged them in seed.ts`
+    );
+  }
+  const routePermsPath = (0, import_node_path21.join)(rootDir, "src", "config", "route-permissions.ts");
+  if (!(0, import_node_fs19.existsSync)(routePermsPath)) {
+    return buildSkipped(
+      "static",
+      "unenforced_permissions",
+      `no src/config/route-permissions.ts to compare seed permissions against`
+    );
   }
+  const routePermsContent = (0, import_node_fs19.readFileSync)(routePermsPath, "utf-8");
   for (const perm of permissions) {
     const regex = new RegExp(`permission:\\s*['"]${perm.key}['"]`);
     if (!regex.test(routePermsContent)) {
@@ -5049,20 +5914,27 @@ function checkUnenforcedPermissions(rootDir) {
 function checkHardcodedValues(rootDir) {
   const findings = [];
   const staticGraph = readGraphFile(rootDir, "static");
-  if (!staticGraph) return buildReport("static", "hardcoded_values", findings);
+  if (!staticGraph) return buildSkipped("static", "hardcoded_values", "no static graph");
   const knownValues = /* @__PURE__ */ new Set();
   for (const n of staticGraph.nodes) {
     if (n.type === "enum_value") knownValues.add(n.value);
   }
+  if (knownValues.size === 0) {
+    return buildSkipped(
+      "static",
+      "hardcoded_values",
+      `no enum_value nodes in static graph \u2014 without an inventory of known ALL_CAPS constants, this scan would flag every legitimate constant in your codebase`
+    );
+  }
   const api = readGraphFile(rootDir, "api");
-  if (!api) return buildReport("static", "hardcoded_values", findings);
+  if (!api) return buildSkipped("static", "hardcoded_values", "no api graph");
   const allCapsRe = /['"]([A-Z][A-Z_]{2,})['"]/g;
   const seen = /* @__PURE__ */ new Set();
   for (const node of api.nodes) {
     if (node.type !== "endpoint") continue;
-    const filePath = (0, import_node_path18.join)(rootDir, "src", node.id);
-    if (!(0, import_node_fs17.existsSync)(filePath)) continue;
-    const content = (0, import_node_fs17.readFileSync)(filePath, "utf-8");
+    const filePath = (0, import_node_path21.join)(rootDir, "src", node.id);
+    if (!(0, import_node_fs19.existsSync)(filePath)) continue;
+    const content = (0, import_node_fs19.readFileSync)(filePath, "utf-8");
     let m;
     allCapsRe.lastIndex = 0;
     while ((m = allCapsRe.exec(content)) !== null) {
@@ -5094,7 +5966,19 @@ function buildReport(layer, check, findings) {
       warnings: findings.filter((f) => f.severity === "warning").length,
       info: findings.filter((f) => f.severity === "info").length
     },
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    status: "ok"
+  };
+}
+function buildSkipped(layer, check, reason) {
+  return {
+    layer,
+    check,
+    findings: [],
+    summary: { errors: 0, warnings: 0, info: 0 },
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    status: "skipped",
+    skipReason: reason
   };
 }
 function getAvailableChecks() {
@@ -5141,7 +6025,12 @@ function runAudit(rootDir, layer, check) {
 }
 function formatAsPrompt(reports) {
   const lines = [];
+  const skipped = [];
   for (const report of reports) {
+    if (report.status === "skipped") {
+      skipped.push(report);
+      continue;
+    }
     if (report.findings.length === 0) continue;
     lines.push(`## ${report.layer.toUpperCase()} \u2014 ${report.check} (${report.findings.length} findings)`);
     lines.push("");
@@ -5153,15 +6042,24 @@ function formatAsPrompt(reports) {
     }
     lines.push("");
   }
+  if (skipped.length > 0) {
+    lines.push("## Skipped checks (no comparison target \u2014 NOT passes)");
+    lines.push("");
+    for (const r of skipped) {
+      lines.push(`- ${r.layer}/${r.check}: ${r.skipReason ?? "comparison target missing"}`);
+    }
+    lines.push("");
+  }
   if (lines.length === 0) return "No audit findings.";
   return lines.join("\n");
 }
-var import_node_fs17, import_node_path18, CHECKS;
+var import_node_fs19, import_node_path21, CHECKS;
 var init_audit_core = __esm({
   "src/server/graph/core/audit-core.ts"() {
     "use strict";
-    import_node_fs17 = require("node:fs");
-    import_node_path18 = require("node:path");
+    import_node_fs19 = require("node:fs");
+    import_node_path21 = require("node:path");
+    init_audit_security();
     CHECKS = {
       db: {
         schema_drift: checkSchemaDrift,
@@ -5176,6 +6074,11 @@ var init_audit_core = __esm({
       static: {
         unenforced_permissions: checkUnenforcedPermissions,
         hardcoded_values: checkHardcodedValues
+      },
+      security: {
+        response_secret_leak: (rootDir) => checkResponseSecretLeak(rootDir, { buildReport, buildSkipped }),
+        env_dead_alias: (rootDir) => checkEnvDeadAlias(rootDir, { buildReport, buildSkipped }),
+        hardcoded_url_fallback: (rootDir) => checkHardcodedUrlFallback(rootDir, { buildReport, buildSkipped })
       }
     };
   }
@@ -5193,16 +6096,16 @@ function randomPort() {
 function findProjectRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 8; i++) {
-    const graphsDir2 = import_node_path19.default.join(dir, ".launchsecure", "graphs");
-    if (import_node_fs18.default.existsSync(import_node_path19.default.join(graphsDir2, "ui.json")) || import_node_fs18.default.existsSync(import_node_path19.default.join(graphsDir2, "api.json")) || import_node_fs18.default.existsSync(import_node_path19.default.join(graphsDir2, "db.json"))) return dir;
-    const parent = import_node_path19.default.dirname(dir);
+    const graphsDir2 = import_node_path22.default.join(dir, ".launchsecure", "graphs");
+    if (import_node_fs20.default.existsSync(import_node_path22.default.join(graphsDir2, "ui.json")) || import_node_fs20.default.existsSync(import_node_path22.default.join(graphsDir2, "api.json")) || import_node_fs20.default.existsSync(import_node_path22.default.join(graphsDir2, "db.json"))) return dir;
+    const parent = import_node_path22.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   dir = startDir;
   for (let i = 0; i < 8; i++) {
-    if (import_node_fs18.default.existsSync(import_node_path19.default.join(dir, ".git"))) return dir;
-    const parent = import_node_path19.default.dirname(dir);
+    if (import_node_fs20.default.existsSync(import_node_path22.default.join(dir, ".git"))) return dir;
+    const parent = import_node_path22.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -5211,7 +6114,7 @@ function findProjectRoot(startDir) {
 function resolveRequestRoot(url, monorepoRoot, projects) {
   const projectParam = url.searchParams.get("project");
   if (!projectParam || projects.length === 0) return monorepoRoot;
-  const resolved = import_node_path19.default.resolve(monorepoRoot, projectParam);
+  const resolved = import_node_path22.default.resolve(monorepoRoot, projectParam);
   if (!resolved.startsWith(monorepoRoot)) {
     throw new Error("Project path outside monorepo root");
   }
@@ -5262,16 +6165,16 @@ async function buildMergedGraph(root) {
   };
 }
 function serveStatic(res, filePath) {
-  if (!import_node_fs18.default.existsSync(filePath) || !import_node_fs18.default.statSync(filePath).isFile()) return false;
-  const ext = import_node_path19.default.extname(filePath).toLowerCase();
+  if (!import_node_fs20.default.existsSync(filePath) || !import_node_fs20.default.statSync(filePath).isFile()) return false;
+  const ext = import_node_path22.default.extname(filePath).toLowerCase();
   const mime = MIME_TYPES[ext] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": mime, "Cache-Control": "no-cache" });
-  import_node_fs18.default.createReadStream(filePath).pipe(res);
+  import_node_fs20.default.createReadStream(filePath).pipe(res);
   return true;
 }
 function serveIndex(res, clientDir) {
-  const indexPath = import_node_path19.default.join(clientDir, "index.html");
-  if (!import_node_fs18.default.existsSync(indexPath)) {
+  const indexPath = import_node_path22.default.join(clientDir, "index.html");
+  if (!import_node_fs20.default.existsSync(indexPath)) {
     res.writeHead(500, { "Content-Type": "text/plain" });
     res.end(`LaunchChart client bundle not found at ${clientDir}. Run 'npm run build:chart-client'.`);
     return;
@@ -5279,14 +6182,14 @@ function serveIndex(res, clientDir) {
   serveStatic(res, indexPath);
 }
 function tryListen(server, port) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const onError = (err2) => {
       server.off("listening", onListening);
       reject(err2);
     };
     const onListening = () => {
       server.off("error", onError);
-      resolve4(port);
+      resolve5(port);
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -5323,7 +6226,7 @@ async function startChartServer(opts = {}) {
     }
     return { port: existing.port, url: existing.url };
   }
-  const clientDir = opts.clientDir ?? import_node_path19.default.join(__dirname, "..", "chart-client");
+  const clientDir = opts.clientDir ?? import_node_path22.default.join(__dirname, "..", "chart-client");
   const rootConfig = loadConfig(projectRoot);
   const projects = rootConfig.projects ?? [];
   const server = import_node_http.default.createServer((req, res) => {
@@ -5339,11 +6242,11 @@ async function startChartServer(opts = {}) {
       }
       if (req.method === "GET" && url2.pathname === "/api/projects") {
         const projectList = projects.length > 0 ? projects.map((p) => {
-          const absRoot = import_node_path19.default.resolve(projectRoot, p.root);
-          const hasGraphs = import_node_fs18.default.existsSync(import_node_path19.default.join(absRoot, ".launchsecure", "graphs"));
-          const hasNextConfig = import_node_fs18.default.existsSync(import_node_path19.default.join(absRoot, "next.config.ts")) || import_node_fs18.default.existsSync(import_node_path19.default.join(absRoot, "next.config.js")) || import_node_fs18.default.existsSync(import_node_path19.default.join(absRoot, "next.config.mjs"));
+          const absRoot = import_node_path22.default.resolve(projectRoot, p.root);
+          const hasGraphs = import_node_fs20.default.existsSync(import_node_path22.default.join(absRoot, ".launchsecure", "graphs"));
+          const hasNextConfig = import_node_fs20.default.existsSync(import_node_path22.default.join(absRoot, "next.config.ts")) || import_node_fs20.default.existsSync(import_node_path22.default.join(absRoot, "next.config.js")) || import_node_fs20.default.existsSync(import_node_path22.default.join(absRoot, "next.config.mjs"));
           return { name: p.name, root: p.root, hasGraphs, hasNextConfig };
-        }) : [{ name: import_node_path19.default.basename(projectRoot), root: ".", hasGraphs: import_node_fs18.default.existsSync(import_node_path19.default.join(projectRoot, ".launchsecure", "graphs")), hasNextConfig: true }];
+        }) : [{ name: import_node_path22.default.basename(projectRoot), root: ".", hasGraphs: import_node_fs20.default.existsSync(import_node_path22.default.join(projectRoot, ".launchsecure", "graphs")), hasNextConfig: true }];
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ projects: projectList, monorepoRoot: projectRoot }));
         return;
@@ -5389,20 +6292,20 @@ async function startChartServer(opts = {}) {
       }
       if (req.method === "GET" && url2.pathname === "/api/file-content") {
         const relPath = url2.searchParams.get("path");
-        if (!relPath || relPath.includes("..") || import_node_path19.default.isAbsolute(relPath)) {
+        if (!relPath || relPath.includes("..") || import_node_path22.default.isAbsolute(relPath)) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "Invalid path" }));
           return;
         }
-        const filePath = import_node_path19.default.join(reqRoot, relPath);
-        if (!filePath.startsWith(reqRoot) || !import_node_fs18.default.existsSync(filePath) || !import_node_fs18.default.statSync(filePath).isFile()) {
+        const filePath = import_node_path22.default.join(reqRoot, relPath);
+        if (!filePath.startsWith(reqRoot) || !import_node_fs20.default.existsSync(filePath) || !import_node_fs20.default.statSync(filePath).isFile()) {
           res.writeHead(404, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ error: "File not found" }));
           return;
         }
-        const ext = import_node_path19.default.extname(filePath).toLowerCase();
+        const ext = import_node_path22.default.extname(filePath).toLowerCase();
         const langMap = { ".ts": "typescript", ".tsx": "tsx", ".js": "javascript", ".jsx": "jsx", ".prisma": "prisma", ".json": "json", ".css": "css" };
-        const content = import_node_fs18.default.readFileSync(filePath, "utf-8");
+        const content = import_node_fs20.default.readFileSync(filePath, "utf-8");
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ content, language: langMap[ext] ?? "text", path: relPath }));
         return;
@@ -5444,8 +6347,8 @@ async function startChartServer(opts = {}) {
         req.on("end", () => {
           try {
             const newConfig = JSON.parse(body);
-            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
-            import_node_fs18.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path22.default.join(reqRoot, ".launchchart.json");
+            import_node_fs20.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err2) {
@@ -5478,8 +6381,8 @@ async function startChartServer(opts = {}) {
             const taggerConfig = JSON.parse(body);
             const config2 = loadConfig(reqRoot);
             config2.taggers = taggerConfig;
-            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
-            import_node_fs18.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path22.default.join(reqRoot, ".launchchart.json");
+            import_node_fs20.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ ok: true }));
           } catch (err2) {
@@ -5549,7 +6452,7 @@ async function startChartServer(opts = {}) {
           dbDir: !!config2.paths?.dbDir,
           srcRoots: !!(config2.paths?.srcRoots && config2.paths.srcRoots.length > 0)
         };
-        const relFromRoot = (abs) => import_node_path19.default.relative(reqRoot, abs) || ".";
+        const relFromRoot = (abs) => import_node_path22.default.relative(reqRoot, abs) || ".";
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(JSON.stringify({
           projectRoot: reqRoot,
@@ -5571,19 +6474,19 @@ async function startChartServer(opts = {}) {
       }
       if (req.method === "GET" && url2.pathname === "/api/browse-dir") {
         const browsePath = url2.searchParams.get("path") || projectRoot;
-        const abs = import_node_path19.default.resolve(browsePath);
-        const twoUp = import_node_path19.default.resolve(projectRoot, "..", "..");
+        const abs = import_node_path22.default.resolve(browsePath);
+        const twoUp = import_node_path22.default.resolve(projectRoot, "..", "..");
         if (!abs.startsWith(twoUp)) {
           res.writeHead(403, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ ok: false, error: "Path outside allowed range" }));
           return;
         }
         try {
-          const entries = import_node_fs18.default.readdirSync(abs, { withFileTypes: true });
+          const entries = import_node_fs20.default.readdirSync(abs, { withFileTypes: true });
           const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules" && e.name !== "dist" && e.name !== ".next").map((e) => e.name).sort();
-          const parent = abs !== twoUp ? import_node_path19.default.dirname(abs) : null;
+          const parent = abs !== twoUp ? import_node_path22.default.dirname(abs) : null;
           res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ current: abs, parent, dirs, relative: import_node_path19.default.relative(projectRoot, abs) || "." }));
+          res.end(JSON.stringify({ current: abs, parent, dirs, relative: import_node_path22.default.relative(projectRoot, abs) || "." }));
         } catch (err2) {
           res.writeHead(400, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ ok: false, error: String(err2) }));
@@ -5609,8 +6512,8 @@ async function startChartServer(opts = {}) {
             const { projects: newProjects } = JSON.parse(body);
             const config2 = loadConfig(projectRoot);
             config2.projects = newProjects.length > 0 ? newProjects : void 0;
-            const configPath = import_node_path19.default.join(projectRoot, ".launchchart.json");
-            import_node_fs18.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+            const configPath = import_node_path22.default.join(projectRoot, ".launchchart.json");
+            import_node_fs20.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
             projects.length = 0;
             if (config2.projects) projects.push(...config2.projects);
             res.writeHead(200, { "Content-Type": "application/json" });
@@ -5623,7 +6526,7 @@ async function startChartServer(opts = {}) {
         return;
       }
       if (url2.pathname !== "/") {
-        const staticPath = import_node_path19.default.join(clientDir, url2.pathname);
+        const staticPath = import_node_path22.default.join(clientDir, url2.pathname);
         if (serveStatic(res, staticPath)) return;
       }
       serveIndex(res, clientDir);
@@ -5683,13 +6586,13 @@ function runServeCli(argv) {
     process.exit(1);
   });
 }
-var import_node_http, import_node_fs18, import_node_path19, MAX_PORT_SCAN, MIME_TYPES;
+var import_node_http, import_node_fs20, import_node_path22, MAX_PORT_SCAN, MIME_TYPES;
 var init_chart_serve = __esm({
   "src/server/chart-serve.ts"() {
     "use strict";
     import_node_http = __toESM(require("node:http"));
-    import_node_fs18 = __toESM(require("node:fs"));
-    import_node_path19 = __toESM(require("node:path"));
+    import_node_fs20 = __toESM(require("node:fs"));
+    import_node_path22 = __toESM(require("node:path"));
     init_graph();
     init_lockfile();
     init_config();
@@ -5711,13 +6614,183 @@ var init_chart_serve = __esm({
   }
 });
 
+// src/server/graph/core/projects.ts
+function listProjects(monorepoRoot) {
+  const cfg = loadConfig(monorepoRoot);
+  const entries = cfg.projects ?? [];
+  return entries.map((p) => ({
+    name: p.name,
+    root: p.root,
+    absoluteRoot: (0, import_node_path23.resolve)(monorepoRoot, p.root)
+  }));
+}
+function resolveProject(name, projects) {
+  const exact = projects.find((p) => p.name === name || p.root === name);
+  if (exact) return exact;
+  const ci = projects.find((p) => p.name.toLowerCase() === name.toLowerCase());
+  if (ci) return ci;
+  const available = projects.map((p) => `"${p.name}" (${p.root})`).join(", ");
+  throw new Error(`Unknown project "${name}". Available: ${available}.`);
+}
+function resolveProjectRoot(project, monorepoRoot) {
+  const raw = typeof project === "string" ? project.trim() : "";
+  if (!raw) return monorepoRoot;
+  const projects = listProjects(monorepoRoot);
+  if (projects.length === 0) {
+    throw new Error(
+      `project="${raw}" requested but .launchchart.json has no projects[] configured. Remove the project arg, or add the project to .launchchart.json.`
+    );
+  }
+  return resolveProject(raw, projects).absoluteRoot;
+}
+var import_node_path23, PROJECT_PARAM_DESCRIPTION;
+var init_projects = __esm({
+  "src/server/graph/core/projects.ts"() {
+    "use strict";
+    import_node_path23 = require("node:path");
+    init_config();
+    PROJECT_PARAM_DESCRIPTION = "Optional sub-project name (or root path) from .launchchart.json projects[]. Defaults to the monorepo root. Run detect_project_stack to list configured projects.";
+  }
+});
+
+// src/server/graph-cli.ts
+var graph_cli_exports = {};
+__export(graph_cli_exports, {
+  handleGraphCommand: () => handleGraphCommand
+});
+function parseLayerFlag(args) {
+  const idx = args.indexOf("--layer");
+  if (idx < 0 || idx + 1 >= args.length) return void 0;
+  return args[idx + 1];
+}
+function parseProjectFlag(args) {
+  const idx = args.indexOf("--project");
+  if (idx < 0 || idx + 1 >= args.length) return void 0;
+  return args[idx + 1];
+}
+async function handleGraphCommand(subcommand, args) {
+  const monorepoRoot = process.cwd();
+  if (subcommand === "graph:generate") {
+    const layer = parseLayerFlag(args);
+    const projectArg = parseProjectFlag(args);
+    const projects = listProjects(monorepoRoot);
+    if (projectArg) {
+      let target;
+      try {
+        target = resolveProject(projectArg, projects);
+      } catch (e) {
+        console.error(e.message);
+        process.exit(1);
+      }
+      const results2 = await generateGraph(target.absoluteRoot, layer);
+      if (results2.length === 0) {
+        console.error(
+          layer ? `No parser detected for the "${layer}" layer in project "${projectArg}".` : `No parsers detected for project "${projectArg}".`
+        );
+        process.exit(1);
+      }
+      console.log(`\u2713 "${target.name}" (${target.root}):`);
+      for (const r of results2) {
+        const warnings = r.output.warnings.length;
+        console.log(`    ${r.layer}: ${r.nodeCount} nodes, ${r.edgeCount} edges${warnings ? ` (${warnings} warnings)` : ""}`);
+      }
+      console.log(`Output: ${target.root}/.launchsecure/graphs/`);
+      return;
+    }
+    if (projects.length > 0) {
+      let okCount = 0;
+      let failCount = 0;
+      for (const proj of projects) {
+        try {
+          const results2 = await generateGraph(proj.absoluteRoot, layer);
+          if (results2.length === 0) {
+            console.error(`  \u2717 "${proj.name}" (${proj.root}): no parsers detected`);
+            failCount++;
+            continue;
+          }
+          console.log(`  \u2713 "${proj.name}" (${proj.root}):`);
+          for (const r of results2) {
+            const warnings = r.output.warnings.length;
+            console.log(`      ${r.layer}: ${r.nodeCount} nodes, ${r.edgeCount} edges${warnings ? ` (${warnings} warnings)` : ""}`);
+          }
+          okCount++;
+        } catch (e) {
+          console.error(`  \u2717 "${proj.name}" (${proj.root}): ${e.message}`);
+          failCount++;
+        }
+      }
+      console.log(`
+Regenerated ${okCount}/${projects.length} project graph(s)${failCount ? ` (${failCount} failed)` : ""}.`);
+      if (failCount > 0 && okCount === 0) process.exit(1);
+      return;
+    }
+    const results = await generateGraph(monorepoRoot, layer);
+    if (results.length === 0) {
+      console.error(
+        layer ? `No parser detected for the "${layer}" layer in this project.` : "No parsers detected for this project. Check that the project has the expected structure."
+      );
+      process.exit(1);
+    }
+    for (const r of results) {
+      const warnings = r.output.warnings.length;
+      console.log(`  ${r.layer}: ${r.nodeCount} nodes, ${r.edgeCount} edges${warnings ? ` (${warnings} warnings)` : ""}`);
+    }
+    console.log(`Output: .launchsecure/graphs/`);
+    return;
+  }
+  if (subcommand === "graph:read") {
+    const layer = parseLayerFlag(args);
+    const projectArg = parseProjectFlag(args);
+    const projects = listProjects(monorepoRoot);
+    let rootDir = monorepoRoot;
+    if (projectArg) {
+      try {
+        rootDir = resolveProject(projectArg, projects).absoluteRoot;
+      } catch (e) {
+        console.error(e.message);
+        process.exit(1);
+      }
+    }
+    if (layer) {
+      const available = getAvailableLayers(rootDir);
+      if (available.length > 0 && !available.includes(layer)) {
+        console.error(`No graph found for layer "${layer}". Available: ${available.join(", ")}`);
+        process.exit(1);
+      }
+      const graph = readGraph(rootDir, layer);
+      if (!graph) {
+        console.error(`No ${layer} graph found. Run: launchpod graph:generate${projectArg ? ` --project ${projectArg}` : ""}`);
+        process.exit(1);
+      }
+      console.log(JSON.stringify(graph, null, 2));
+    } else {
+      const graphs = readAllGraphs(rootDir);
+      if (Object.keys(graphs).length === 0) {
+        console.error(`No graphs found. Run: launchpod graph:generate${projectArg ? ` --project ${projectArg}` : ""}`);
+        process.exit(1);
+      }
+      console.log(JSON.stringify(graphs, null, 2));
+    }
+    return;
+  }
+  console.error(`Unknown graph subcommand: ${subcommand}`);
+  process.exit(1);
+}
+var init_graph_cli = __esm({
+  "src/server/graph-cli.ts"() {
+    "use strict";
+    init_graph();
+    init_projects();
+  }
+});
+
 // src/server/graph/core/language-detection.ts
 function walkForExtensions(dir, extCounts, depth = 0) {
   if (depth > 10) return;
-  if (!(0, import_node_fs19.existsSync)(dir)) return;
+  if (!(0, import_node_fs21.existsSync)(dir)) return;
   let entries;
   try {
-    entries = (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true });
+    entries = (0, import_node_fs21.readdirSync)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -5725,9 +6798,9 @@ function walkForExtensions(dir, extCounts, depth = 0) {
     if (entry.name.startsWith(".") && entry.isDirectory()) continue;
     if (entry.isDirectory()) {
       if (IGNORE_DIRS.has(entry.name)) continue;
-      walkForExtensions((0, import_node_path20.join)(dir, entry.name), extCounts, depth + 1);
+      walkForExtensions((0, import_node_path24.join)(dir, entry.name), extCounts, depth + 1);
     } else {
-      const ext = (0, import_node_path20.extname)(entry.name).toLowerCase();
+      const ext = (0, import_node_path24.extname)(entry.name).toLowerCase();
       if (ext && EXTENSION_TO_LANGUAGE[ext]) {
         extCounts.set(ext, (extCounts.get(ext) ?? 0) + 1);
       }
@@ -5766,12 +6839,12 @@ function detectLanguages(rootDir, supportedLanguages) {
   });
   return results;
 }
-var import_node_fs19, import_node_path20, EXTENSION_TO_LANGUAGE, IGNORE_DIRS, AUXILIARY_LANGUAGES;
+var import_node_fs21, import_node_path24, EXTENSION_TO_LANGUAGE, IGNORE_DIRS, AUXILIARY_LANGUAGES;
 var init_language_detection = __esm({
   "src/server/graph/core/language-detection.ts"() {
     "use strict";
-    import_node_fs19 = require("node:fs");
-    import_node_path20 = require("node:path");
+    import_node_fs21 = require("node:fs");
+    import_node_path24 = require("node:path");
     EXTENSION_TO_LANGUAGE = {
       // Web / Frontend
       ".ts": "typescript",
@@ -5884,9 +6957,128 @@ var init_language_detection = __esm({
   }
 });
 
+// src/server/graph/core/watcher.ts
+var watcher_exports = {};
+__export(watcher_exports, {
+  startGraphWatcher: () => startGraphWatcher
+});
+function isIgnoredPath(rel) {
+  if (rel.startsWith(GRAPHS_RELATIVE)) return true;
+  if (rel.endsWith(".lock") || rel.endsWith(".log")) return true;
+  for (const part of rel.split(import_node_path25.sep)) {
+    if (IGNORE_SEGMENTS.has(part)) return true;
+  }
+  return false;
+}
+function isTriggerFile(rel) {
+  if (isIgnoredPath(rel)) return false;
+  const dot = rel.lastIndexOf(".");
+  if (dot < 0) return false;
+  return TRIGGER_EXTENSIONS.has(rel.slice(dot));
+}
+function startGraphWatcher(rootDir, opts = {}) {
+  const debounceMs = opts.debounceMs ?? 500;
+  const pending = /* @__PURE__ */ new Set();
+  let timer = null;
+  let regenerating = false;
+  let lastAt = null;
+  let lastErr = null;
+  async function flush() {
+    if (regenerating) {
+      timer = setTimeout(flush, debounceMs);
+      return;
+    }
+    const changedFiles = Array.from(pending);
+    pending.clear();
+    timer = null;
+    if (changedFiles.length === 0) return;
+    regenerating = true;
+    const start = Date.now();
+    try {
+      await generateGraph(rootDir);
+      lastAt = Date.now();
+      lastErr = null;
+      opts.onRegen?.({ changedFiles, durationMs: lastAt - start });
+    } catch (e) {
+      const err2 = e instanceof Error ? e : new Error(String(e));
+      lastErr = err2.message;
+      opts.onError?.(err2);
+    } finally {
+      regenerating = false;
+    }
+  }
+  const watcher = (0, import_node_fs22.watch)(rootDir, { recursive: true }, (event, filename) => {
+    if (!filename) return;
+    const rel = filename.toString();
+    if (process.env.LAUNCH_CHART_WATCH_TRACE === "1") {
+      process.stderr.write(`[lc-watcher trace] event=${event} file=${rel} trigger=${isTriggerFile(rel)}
+`);
+    }
+    if (!isTriggerFile(rel)) return;
+    pending.add(rel);
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(flush, debounceMs);
+  });
+  watcher.on("error", (e) => {
+    const err2 = e instanceof Error ? e : new Error(String(e));
+    lastErr = `watcher: ${err2.message}`;
+    opts.onError?.(err2);
+  });
+  return {
+    rootDir,
+    stop() {
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
+      watcher.close();
+    },
+    isRegenerating: () => regenerating,
+    lastRegenAt: () => lastAt,
+    lastError: () => lastErr,
+    pendingCount: () => pending.size
+  };
+}
+var import_node_fs22, import_node_path25, IGNORE_SEGMENTS, TRIGGER_EXTENSIONS, GRAPHS_RELATIVE;
+var init_watcher = __esm({
+  "src/server/graph/core/watcher.ts"() {
+    "use strict";
+    import_node_fs22 = require("node:fs");
+    import_node_path25 = require("node:path");
+    init_graph();
+    IGNORE_SEGMENTS = /* @__PURE__ */ new Set([
+      "node_modules",
+      ".git",
+      ".claude",
+      ".next",
+      ".turbo",
+      "dist",
+      "build",
+      "coverage",
+      ".cache",
+      ".vite",
+      ".parcel-cache"
+    ]);
+    TRIGGER_EXTENSIONS = /* @__PURE__ */ new Set([
+      ".ts",
+      ".tsx",
+      ".js",
+      ".jsx",
+      ".mts",
+      ".cts",
+      ".mjs",
+      ".cjs",
+      ".prisma",
+      ".sql"
+    ]);
+    GRAPHS_RELATIVE = (0, import_node_path25.join)(".launchsecure", "graphs");
+  }
+});
+
 // src/server/graph-mcp.ts
 var graph_mcp_exports = {};
 __export(graph_mcp_exports, {
+  getWatcherHandle: () => getWatcherHandle,
   startGraphMcpServer: () => startGraphMcpServer
 });
 function matchesSearch(node, query) {
@@ -5906,6 +7098,14 @@ function toMinimal(nodes) {
     return out;
   });
 }
+function crossRefsAsEdges(graph) {
+  return (graph.cross_refs ?? []).map((c) => ({
+    source: c.source,
+    target: c.target,
+    type: c.type,
+    target_layer: c.layer
+  }));
+}
 function toCompactNode(n) {
   const out = { i: n.id, t: n.type, n: n.name };
   const tags = n.tags;
@@ -5930,6 +7130,8 @@ function toCompactEdges(edges, idx) {
       t: e.type
     };
     if (e.label != null) o.l = e.label;
+    const targetLayer = e.target_layer;
+    if (targetLayer != null) o.tl = targetLayer;
     return o;
   });
 }
@@ -5970,6 +7172,9 @@ function neighborhood(graph, centerId, hops, layer, minimal) {
       const dstIn = visited.has(e.target) || next.has(e.target);
       if (srcIn && dstIn) projectedEdges++;
     }
+    for (const c of graph.cross_refs ?? []) {
+      if (visited.has(c.source) || next.has(c.source)) projectedEdges++;
+    }
     const perNode = minimal ? EST_CHARS_PER_NODE_MIN[layer] ?? DEFAULT_EST_NODE_MIN : EST_CHARS_PER_NODE_FULL[layer] ?? DEFAULT_EST_NODE_FULL;
     const projectedChars = projectedVisited * perNode + projectedEdges * (EST_CHARS_PER_EDGE[layer] ?? DEFAULT_EST_EDGE);
     if (projectedChars > NEIGHBORHOOD_BUDGET_CHARS) {
@@ -5982,8 +7187,9 @@ function neighborhood(graph, centerId, hops, layer, minimal) {
     if (frontier.size === 0) break;
   }
   const nodes = graph.nodes.filter((n) => visited.has(n.id));
-  const edges = graph.edges.filter((e) => visited.has(e.source) && visited.has(e.target));
-  return { nodes, edges, budgetExceeded, stoppedAtHop };
+  const sameLayerEdges = graph.edges.filter((e) => visited.has(e.source) && visited.has(e.target));
+  const crossLayerEdges = crossRefsAsEdges(graph).filter((e) => visited.has(e.source));
+  return { nodes, edges: [...sameLayerEdges, ...crossLayerEdges], budgetExceeded, stoppedAtHop };
 }
 function reverseNeighborhood(graph, centerId, hops, direction) {
   const center = graph.nodes.find((n) => n.id === centerId);
@@ -6013,7 +7219,9 @@ function reverseNeighborhood(graph, centerId, hops, direction) {
   return { nodes: visited, edges };
 }
 function handleBlastPoints(args) {
-  const rootDir = process.cwd();
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
   const nodeId = args.node_id;
   const requestedLayer = args.layer;
   const hops = args.hops ?? 2;
@@ -6057,7 +7265,11 @@ function handleBlastPoints(args) {
   for (const otherLayer of otherLayers) {
     const otherGraph = readGraph(rootDir, otherLayer);
     if (!otherGraph) continue;
-    for (const edge of otherGraph.edges) {
+    const candidates = [
+      ...otherGraph.edges,
+      ...otherGraph.cross_refs ?? []
+    ];
+    for (const edge of candidates) {
       if (edge.target === nodeId || edge.source === nodeId) {
         const dependentId = edge.target === nodeId ? edge.source : edge.target;
         if (affected.some((a) => a.id === dependentId)) continue;
@@ -6084,7 +7296,7 @@ function handleBlastPoints(args) {
     byHop[String(a.hop)] = (byHop[String(a.hop)] ?? 0) + 1;
     if (a.module) modulesSet.add(a.module);
   }
-  const crossesLayers = Object.keys(byLayer).length > 1;
+  const crossesLayers = Object.keys(byLayer).some((l) => l !== targetLayer);
   const centerTags = center.tags;
   return okJson({
     center: {
@@ -6135,26 +7347,89 @@ function okJson(data) {
 function err(text) {
   return { content: [{ type: "text", text }], isError: true };
 }
+function resolveOrErr(args) {
+  try {
+    return { rootDir: resolveProjectRoot(args.project, process.cwd()) };
+  } catch (e) {
+    return err(e.message);
+  }
+}
 async function handleGenerateGraph(args) {
-  const rootDir = process.cwd();
+  const monorepoRoot = process.cwd();
   const layer = args.layer;
-  const results = await generateGraph(rootDir, layer);
+  const projectArg = typeof args.project === "string" ? args.project.trim() : "";
+  function formatProjectResult(results2, relativeRoot) {
+    return results2.map((r) => {
+      const warnings = r.output.warnings.length;
+      return `  ${r.layer}: ${r.nodeCount} nodes, ${r.edgeCount} edges${warnings ? ` (${warnings} warnings)` : ""}`;
+    }).join("\n") + `
+  \u2192 ${relativeRoot}/.launchsecure/graphs/`;
+  }
+  if (projectArg) {
+    let rootDir;
+    try {
+      rootDir = resolveProjectRoot(projectArg, monorepoRoot);
+    } catch (e) {
+      return err(e.message);
+    }
+    const results2 = await generateGraph(rootDir, layer);
+    if (results2.length === 0) {
+      return err(
+        layer ? `No parser detected for the "${layer}" layer in project "${projectArg}".` : `No parsers detected for project "${projectArg}". Check that the project root has the expected structure.`
+      );
+    }
+    return ok(
+      `Graph generated successfully for project "${projectArg}".
+
+${formatProjectResult(results2, projectArg)}
+
+Use read_graph (with project="${projectArg}") to query.`
+    );
+  }
+  const projects = listProjects(monorepoRoot);
+  if (projects.length > 0) {
+    const lines = [];
+    let okCount = 0;
+    let failCount = 0;
+    for (const proj of projects) {
+      try {
+        const results2 = await generateGraph(proj.absoluteRoot, layer);
+        if (results2.length === 0) {
+          lines.push(`  \u2717 "${proj.name}" (${proj.root}): no parsers detected`);
+          failCount++;
+          continue;
+        }
+        lines.push(`  \u2713 "${proj.name}" (${proj.root}):`);
+        for (const r of results2) {
+          const warnings = r.output.warnings.length;
+          lines.push(`      ${r.layer}: ${r.nodeCount} nodes, ${r.edgeCount} edges${warnings ? ` (${warnings} warnings)` : ""}`);
+        }
+        okCount++;
+      } catch (e) {
+        lines.push(`  \u2717 "${proj.name}" (${proj.root}): ${e.message}`);
+        failCount++;
+      }
+    }
+    const header = `Regenerated ${okCount}/${projects.length} project graph(s)${failCount ? ` (${failCount} failed)` : ""}.`;
+    return failCount > 0 && okCount === 0 ? err(`${header}
+
+${lines.join("\n")}`) : ok(`${header}
+
+${lines.join("\n")}
+
+Use read_graph (with optional project="<name>") to query.`);
+  }
+  const results = await generateGraph(monorepoRoot, layer);
   if (results.length === 0) {
     return err(
       layer ? `No parser detected for the "${layer}" layer in this project.` : "No parsers detected for this project. Check that the project has the expected structure."
     );
   }
-  const summary = results.map((r) => {
-    const warnings = r.output.warnings.length;
-    return `  ${r.layer}: ${r.nodeCount} nodes, ${r.edgeCount} edges${warnings ? ` (${warnings} warnings)` : ""}`;
-  }).join("\n");
   return ok(
     `Graph generated successfully.
 
 Layers:
-${summary}
-
-Output: .launchsecure/graphs/
+${formatProjectResult(results, ".")}
 
 Use read_graph with filters (search/type/module/node_id) to query.`
   );
@@ -6237,8 +7512,6 @@ function runReadGraphQueryRaw(rootDir, args) {
     if (tagKey && tagValue && nodeTags?.[tagKey] !== tagValue) return false;
     return true;
   });
-  const matchedIds = new Set(matched.map((n) => n.id));
-  const matchedEdges = graph.edges.filter((e) => matchedIds.has(e.source) && matchedIds.has(e.target));
   if (matched.length === 0) {
     return {
       layer,
@@ -6252,7 +7525,9 @@ function runReadGraphQueryRaw(rootDir, args) {
   const hasMore = offset + paginatedNodes.length < totalMatched;
   const wantEdges = includeEdges ?? false;
   const returnedIds = new Set(paginatedNodes.map((n) => n.id));
-  const returnedEdges = graph.edges.filter((e) => returnedIds.has(e.source) && returnedIds.has(e.target));
+  const sameLayerReturnedEdges = graph.edges.filter((e) => returnedIds.has(e.source) && returnedIds.has(e.target));
+  const crossLayerReturnedEdges = crossRefsAsEdges(graph).filter((e) => returnedIds.has(e.source));
+  const returnedEdges = [...sameLayerReturnedEdges, ...crossLayerReturnedEdges];
   const result = {
     layer,
     filter: { search, type, module: module_ },
@@ -6267,7 +7542,14 @@ function runReadGraphQueryRaw(rootDir, args) {
     result.next_offset = offset + paginatedNodes.length;
   }
   if (wantEdges) {
-    result.edges = returnedEdges;
+    if (returnedEdges.length > MAX_FILTER_EDGES) {
+      result.edges = returnedEdges.slice(0, MAX_FILTER_EDGES);
+      result.edges_truncated = true;
+      result.total_edges = returnedEdges.length;
+      result.edges_hint = `Showing first ${MAX_FILTER_EDGES} of ${returnedEdges.length} edges. Narrow with type/module/node_id, or call read_graph on a single node_id to walk its neighborhood with full edges.`;
+    } else {
+      result.edges = returnedEdges;
+    }
   } else if (returnedEdges.length > 0) {
     result.edges_hint = `${returnedEdges.length} edges between matched nodes omitted. Pass include_edges:true to retrieve them (only do this when you actually need edge data).`;
   }
@@ -6278,12 +7560,13 @@ function runReadGraphQuery(rootDir, args) {
   return compactResult(raw);
 }
 function handleReadGraph(args) {
-  const rootDir = process.cwd();
+  const monorepoRoot = process.cwd();
   if (Array.isArray(args.queries)) {
     const queries = args.queries;
     if (queries.length === 0) {
       return err("queries array is empty. Provide at least one query object.");
     }
+    const inheritedProject = typeof args.project === "string" ? args.project : void 0;
     const results = [];
     let cumulativeChars = 0;
     let budgetHit = false;
@@ -6301,7 +7584,15 @@ function handleReadGraph(args) {
         });
         continue;
       }
-      const r = runReadGraphQuery(rootDir, q);
+      const qWithProject = inheritedProject && !q.project ? { ...q, project: inheritedProject } : q;
+      let perQueryRoot;
+      try {
+        perQueryRoot = resolveProjectRoot(qWithProject.project, monorepoRoot);
+      } catch (e) {
+        results.push({ index: i, query: q, result: { error: e.message } });
+        continue;
+      }
+      const r = runReadGraphQuery(perQueryRoot, qWithProject);
       const entry = { index: i, query: q, result: r };
       const entrySize = JSON.stringify(entry, null, 2).length;
       if (cumulativeChars + entrySize > BATCH_BUDGET_CHARS && results.length > 0) {
@@ -6328,20 +7619,24 @@ function handleReadGraph(args) {
       results
     });
   }
-  const result = runReadGraphQuery(rootDir, args);
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const result = runReadGraphQuery(__resolved.rootDir, args);
   return okJson(result);
 }
 function nodeToFilePath(rootDir, layer, nodeId) {
-  if (layer === "ui" || layer === "api") return (0, import_node_path21.join)(rootDir, "src", nodeId);
-  if (layer === "db") return (0, import_node_path21.join)(rootDir, "prisma", "schema.prisma");
-  const withSrc = (0, import_node_path21.join)(rootDir, "src", nodeId);
-  if ((0, import_node_fs20.existsSync)(withSrc)) return withSrc;
-  const direct = (0, import_node_path21.join)(rootDir, nodeId);
-  if ((0, import_node_fs20.existsSync)(direct)) return direct;
+  if (layer === "ui" || layer === "api") return (0, import_node_path26.join)(rootDir, "src", nodeId);
+  if (layer === "db") return (0, import_node_path26.join)(rootDir, "prisma", "schema.prisma");
+  const withSrc = (0, import_node_path26.join)(rootDir, "src", nodeId);
+  if ((0, import_node_fs23.existsSync)(withSrc)) return withSrc;
+  const direct = (0, import_node_path26.join)(rootDir, nodeId);
+  if ((0, import_node_fs23.existsSync)(direct)) return direct;
   return null;
 }
 function handleInspectNode(args) {
-  const rootDir = process.cwd();
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
   const layer = args.layer;
   const nodeId = args.node_id;
   const search = args.search;
@@ -6365,7 +7660,7 @@ function handleInspectNode(args) {
   } else {
     matched = graph.nodes;
   }
-  const allDeepFields = ["elements", "stateVars", "conditions", "variables", "responses", "params"];
+  const allDeepFields = ["elements", "stateVars", "conditions", "variables", "responses", "params", "effects"];
   const requestedFields = fields ?? allDeepFields;
   let filterRegex = null;
   if (filter) {
@@ -6421,7 +7716,9 @@ function handleInspectNode(args) {
   });
 }
 function handleGrepNodes(args) {
-  const rootDir = process.cwd();
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
   const pattern = args.pattern;
   const layer = args.layer;
   if (!pattern) return err("pattern is required");
@@ -6480,11 +7777,11 @@ function handleGrepNodes(args) {
   let filesSearched = 0;
   let truncated = false;
   for (const [filePath, nodeId] of filePaths) {
-    if (!(0, import_node_fs20.existsSync)(filePath)) continue;
+    if (!(0, import_node_fs23.existsSync)(filePath)) continue;
     filesSearched++;
     let content;
     try {
-      content = (0, import_node_fs20.readFileSync)(filePath, "utf-8");
+      content = (0, import_node_fs23.readFileSync)(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -6521,11 +7818,61 @@ function handleGrepNodes(args) {
     truncated
   });
 }
+function handleEffectsIndex(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const idx = readEffectsIndex(rootDir);
+  if (!idx) {
+    return err("No effects-index.json found. Run generate_graph first (or wait for the file-watcher to fire).");
+  }
+  const kind = args.kind ?? "collisions";
+  const key = args.key;
+  const MAX_KEYS = 200;
+  if (kind === "singleton_risks") {
+    return okJson({ kind, count: idx.singleton_risks.length, nodes: idx.singleton_risks });
+  }
+  if (kind === "collisions") {
+    return okJson({
+      kind,
+      dom_ids: idx.collisions.dom_ids,
+      storage_keys: idx.collisions.storage_keys,
+      window_events: idx.collisions.window_events
+    });
+  }
+  const map = idx[kind];
+  if (!map || typeof map !== "object") {
+    return err(`Unknown kind "${kind}". Valid: dom_ids, window_events, storage_keys, fetch_urls, timers, singleton_risks, collisions.`);
+  }
+  if (key) {
+    const nodes = map[key] ?? [];
+    return okJson({ kind, key, nodes });
+  }
+  const entries = Object.entries(map);
+  const truncated = entries.length > MAX_KEYS;
+  const slice = entries.slice(0, MAX_KEYS);
+  const results = {};
+  for (const [k, v] of slice) results[k] = v;
+  return okJson({
+    kind,
+    total_keys: entries.length,
+    ...truncated ? { truncated: true, showing: MAX_KEYS, hint: "Pass `key` to look up a specific value." } : {},
+    results
+  });
+}
 function handleChartServerStatus() {
   const rootDir = process.cwd();
   const lock = getLiveLock(rootDir);
+  const watcher = getWatcherHandle();
+  const watcherInfo = watcher ? {
+    active: true,
+    regenerating: watcher.isRegenerating(),
+    last_regen_at: watcher.lastRegenAt(),
+    pending_events: watcher.pendingCount(),
+    ...watcher.lastError() ? { last_error: watcher.lastError() } : {}
+  } : { active: false };
   if (!lock) {
-    return okJson({ running: false });
+    return okJson({ running: false, watcher: watcherInfo });
   }
   return okJson({
     running: true,
@@ -6533,7 +7880,8 @@ function handleChartServerStatus() {
     port: lock.port,
     pid: lock.pid,
     cwd: lock.cwd,
-    startedAt: lock.startedAt
+    startedAt: lock.startedAt,
+    watcher: watcherInfo
   });
 }
 function handleStartChartServer(args) {
@@ -6549,11 +7897,11 @@ function handleStartChartServer(args) {
     });
   }
   const entryPath = process.argv[1];
-  const logDir = (0, import_node_path21.join)((0, import_node_os2.homedir)(), ".launchsecure");
-  (0, import_node_fs20.mkdirSync)(logDir, { recursive: true });
-  const logPath = (0, import_node_path21.join)(logDir, "launch-chart.log");
-  const out = (0, import_node_fs20.openSync)(logPath, "a");
-  const err2 = (0, import_node_fs20.openSync)(logPath, "a");
+  const logDir = (0, import_node_path26.join)((0, import_node_os2.homedir)(), ".launchsecure");
+  (0, import_node_fs23.mkdirSync)(logDir, { recursive: true });
+  const logPath = (0, import_node_path26.join)(logDir, "launch-chart.log");
+  const out = (0, import_node_fs23.openSync)(logPath, "a");
+  const err2 = (0, import_node_fs23.openSync)(logPath, "a");
   const portArgs = args.port ? ["--port", String(args.port)] : [];
   const child = (0, import_node_child_process2.spawn)(process.execPath, [entryPath, "serve", ...portArgs], {
     detached: true,
@@ -6586,7 +7934,9 @@ function handleStopChartServer() {
   }
 }
 function handleAddTag(args) {
-  const rootDir = process.cwd();
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
   const nodeId = args.node_id;
   const key = args.key;
   const value = args.value;
@@ -6608,7 +7958,9 @@ function handleAddTag(args) {
   return okJson({ ok: true, node_id: nodeId, tag: { [key]: value } });
 }
 function handleRemoveTag(args) {
-  const rootDir = process.cwd();
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
   const nodeId = args.node_id;
   const key = args.key;
   if (!nodeId) return err("node_id is required");
@@ -6617,7 +7969,9 @@ function handleRemoveTag(args) {
   return okJson({ ok: true, node_id: nodeId, removed_key: key });
 }
 function handleAuditLayer(args) {
-  const rootDir = process.cwd();
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
   const layer = args.layer;
   const check = args.check;
   if (!layer) return err("layer is required");
@@ -6630,6 +7984,10 @@ function handleAuditLayer(args) {
   lines.push(`Audit: ${layer}${check ? ` / ${check}` : ""} \u2014 ${totalFindings} findings (${totalErrors} errors, ${totalWarnings} warnings, ${totalInfo} info)`);
   lines.push("");
   for (const report of reports) {
+    if (report.status === "skipped") {
+      lines.push(`\u2298 ${report.check}: skipped \u2014 ${report.skipReason ?? "comparison target missing"} (NOT a pass)`);
+      continue;
+    }
     if (report.findings.length === 0) {
       lines.push(`\u2713 ${report.check}: no issues found`);
       continue;
@@ -6673,20 +8031,20 @@ function handleDetectProjectStack() {
       if (ref.type === "references_api") stats.references_api++;
     }
   }
-  const srcDir = (0, import_node_path21.join)(rootDir, "src");
-  if ((0, import_node_fs20.existsSync)(srcDir)) {
+  const srcDir = (0, import_node_path26.join)(rootDir, "src");
+  if ((0, import_node_fs23.existsSync)(srcDir)) {
     const scanDir = (dir) => {
-      if (!(0, import_node_fs20.existsSync)(dir)) return;
-      for (const entry of (0, import_node_fs20.readdirSync)(dir, { withFileTypes: true })) {
+      if (!(0, import_node_fs23.existsSync)(dir)) return;
+      for (const entry of (0, import_node_fs23.readdirSync)(dir, { withFileTypes: true })) {
         if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-        const full = (0, import_node_path21.join)(dir, entry.name);
+        const full = (0, import_node_path26.join)(dir, entry.name);
         if (entry.isDirectory()) {
           scanDir(full);
           continue;
         }
-        if (![".ts", ".tsx"].includes((0, import_node_path21.extname)(entry.name))) continue;
+        if (![".ts", ".tsx"].includes((0, import_node_path26.extname)(entry.name))) continue;
         try {
-          const content = (0, import_node_fs20.readFileSync)(full, "utf-8");
+          const content = (0, import_node_fs23.readFileSync)(full, "utf-8");
           const matches = content.match(/@api\s+(GET|POST|PUT|DELETE|PATCH)\s+\/\S+/g);
           if (matches) stats.annotations += matches.length;
         } catch {
@@ -6701,6 +8059,12 @@ function handleDetectProjectStack() {
   const languages = detectLanguages(rootDir, supportedLanguages);
   const unsupported = languages.filter((l) => !l.supported);
   const unsupportedHint = unsupported.length > 0 ? unsupported.map((l) => `${l.id} (${l.fileCount} files)`).join(", ") + " \u2014 detected but not yet supported" : null;
+  const projects = listProjects(rootDir).map((p) => ({
+    name: p.name,
+    root: p.root,
+    absolute_root: p.absoluteRoot,
+    has_graph: (0, import_node_fs23.existsSync)((0, import_node_path26.join)(p.absoluteRoot, ".launchsecure", "graphs"))
+  }));
   return okJson({
     languages,
     parsers: parserResults,
@@ -6723,7 +8087,11 @@ function handleDetectProjectStack() {
     stats,
     ...unsupportedHint ? { unsupported_hint: unsupportedHint } : {},
     current_config: Object.keys(config).length > 0 ? config : null,
-    config_path: ".launchchart.json"
+    config_path: ".launchchart.json",
+    ...projects.length > 0 && {
+      projects,
+      projects_hint: 'Pass `project: "<name>"` (or its root path) to other tools to target a sub-project. Omitting `project` targets the monorepo root. `generate_graph` with no `project` regenerates ALL configured projects.'
+    }
   });
 }
 function send(msg) {
@@ -6773,6 +8141,10 @@ async function handleMessage(msg) {
       respond(id ?? null, handleInspectNode(args));
       return;
     }
+    if (toolName === "effects_index") {
+      respond(id ?? null, handleEffectsIndex(args));
+      return;
+    }
     if (toolName === "chart_server_status") {
       respond(id ?? null, handleChartServerStatus());
       return;
@@ -6816,6 +8188,9 @@ async function handleMessage(msg) {
     respondError(id, -32601, `Method not found: ${method}`);
   }
 }
+function getWatcherHandle() {
+  return watcherHandle;
+}
 function startGraphMcpServer() {
   process.stdin.setEncoding("utf-8");
   let buffer = "";
@@ -6835,17 +8210,39 @@ function startGraphMcpServer() {
     }
   });
   process.stdin.on("end", () => {
+    watcherHandle?.stop();
     process.exit(0);
   });
+  if (process.env.LAUNCH_CHART_WATCH !== "0") {
+    try {
+      const { startGraphWatcher: startGraphWatcher2 } = (init_watcher(), __toCommonJS(watcher_exports));
+      watcherHandle = startGraphWatcher2(process.cwd(), {
+        onRegen: ({ changedFiles, durationMs }) => {
+          const sample = changedFiles.slice(0, 3).join(", ") + (changedFiles.length > 3 ? `, +${changedFiles.length - 3} more` : "");
+          process.stderr.write(`[launchsecure-graph] regen ${durationMs}ms (${sample})
+`);
+        },
+        onError: (err2) => {
+          process.stderr.write(`[launchsecure-graph] watcher error: ${err2.message}
+`);
+        }
+      });
+      process.stderr.write(`[launchsecure-graph] watcher started (LAUNCH_CHART_WATCH=0 to disable)
+`);
+    } catch (err2) {
+      process.stderr.write(`[launchsecure-graph] watcher failed to start: ${err2}
+`);
+    }
+  }
   process.stderr.write(`[launchsecure-graph] MCP server started (cwd: ${process.cwd()})
 `);
 }
-var import_node_fs20, import_node_path21, import_node_child_process2, import_node_os2, SERVER_INFO, TOOLS, COMPACT_SCHEMA, COMPACT_NODE_KNOWN_KEYS, DEEP_FIELDS, EST_CHARS_PER_NODE_FULL, EST_CHARS_PER_NODE_MIN, EST_CHARS_PER_EDGE, DEFAULT_EST_NODE_FULL, DEFAULT_EST_NODE_MIN, DEFAULT_EST_EDGE, NEIGHBORHOOD_BUDGET_CHARS, BATCH_BUDGET_CHARS;
+var import_node_fs23, import_node_path26, import_node_child_process2, import_node_os2, SERVER_INFO, TOOLS, COMPACT_SCHEMA, COMPACT_NODE_KNOWN_KEYS, DEEP_FIELDS, EST_CHARS_PER_NODE_FULL, EST_CHARS_PER_NODE_MIN, EST_CHARS_PER_EDGE, DEFAULT_EST_NODE_FULL, DEFAULT_EST_NODE_MIN, DEFAULT_EST_EDGE, NEIGHBORHOOD_BUDGET_CHARS, MAX_FILTER_EDGES, BATCH_BUDGET_CHARS, watcherHandle;
 var init_graph_mcp = __esm({
   "src/server/graph-mcp.ts"() {
     "use strict";
-    import_node_fs20 = require("node:fs");
-    import_node_path21 = require("node:path");
+    import_node_fs23 = require("node:fs");
+    import_node_path26 = require("node:path");
     import_node_child_process2 = require("node:child_process");
     import_node_os2 = require("node:os");
     init_graph();
@@ -6854,6 +8251,7 @@ var init_graph_mcp = __esm({
     init_parser_registry();
     init_language_detection();
     init_audit_core();
+    init_projects();
     SERVER_INFO = {
       name: "launchsecure-graph",
       version: "0.0.1"
@@ -6861,20 +8259,24 @@ var init_graph_mcp = __esm({
     TOOLS = [
       {
         name: "generate_graph",
-        description: "Regenerate the structural project graph by scanning source code in the current working directory. Auto-detects project languages and frameworks, then parses into layers (e.g. ui, api, db) based on content classification. Writes JSON to .launchsecure/graphs/{layer}.json and returns node/edge counts. Run this when project structure has changed (new files, moved components, schema updates). Fast: typically <1s. After generation, use read_graph with filters to query.",
+        description: "Regenerate the structural project graph by scanning source code in the current working directory. Auto-detects project languages and frameworks, then parses into layers (e.g. ui, api, db) based on content classification. Writes JSON to .launchsecure/graphs/{layer}.json and returns node/edge counts. Run this when project structure has changed (new files, moved components, schema updates). Fast: typically <1s. After generation, use read_graph with filters to query.\n\nMONOREPO BEHAVIOR: when .launchchart.json declares projects[] and no `project` arg is given, regenerates EVERY configured project (each writes to its own <root>/.launchsecure/graphs/). Pass `project` to limit regeneration to a single sub-project.",
         inputSchema: {
           type: "object",
           properties: {
             layer: {
               type: "string",
               description: "Specific layer to regenerate (e.g. 'ui', 'api', 'db'). Omit to regenerate all detectable layers. Run detect_project_stack to see available layers."
+            },
+            project: {
+              type: "string",
+              description: PROJECT_PARAM_DESCRIPTION + " Special: omit to regenerate ALL configured projects."
             }
           }
         }
       },
       {
         name: "read_graph",
-        description: 'Query the structural project graph \u2014 use INSTEAD of Glob and Grep for locating files, understanding structure, and navigating the codebase. Faster and more accurate than file-system search because it returns typed nodes with metadata and relationships. \n\nUSE THIS FOR: "where is X", "what files are in module Y", "what pages exist under /admin", "what components does Z render", "what tables relate to User", "list all hooks in auth module", "which endpoints touch the User table", "what auth strategy does this endpoint use". \n\nDO NOT USE FOR: understanding what\'s INSIDE a component (use inspect_node for elements, conditions, state, variables, responses), reading actual source code (use Read). \n\nQUERY PARAMS (at least one required for node data \u2014 unfiltered calls return summary only to stay in context):\n- search: substring match on node id, name, or route\n- type: filter by node type (ui layer: page, layout, component, ui, hook, context, config, util; api layer: endpoint; db layer: table, enum)\n- module: filter by module tag (computed from directory structure, e.g. "auth", "admin", "settings")\n- node_id: return this node + its neighborhood (incoming+outgoing edges within `hops`)\n- hops: neighborhood radius when node_id is set (default 1)\n- minimal: return only id/type/name/module/route per node (skip heavy fields like columns, exports)\n- include_edges: return the actual edge list. Default: TRUE for neighborhood queries (node_id), FALSE for filter queries (search/type/module). Filter responses always include `edge_count`; only pass include_edges:true when you actually need to inspect individual edges (e.g. "which components render X"). This default cuts typical filter responses in half.\n\nBATCH MODE: pass `queries` (array of query objects) to run multiple independent queries in a single call. Each query object uses the same params (layer/search/type/module/node_id/hops/minimal). Returns { batch: true, count, results: [{index, query, result}, ...] }. Use this when you need multiple graph views up-front (e.g. scoping a feature across ui+api+db layers) to save round-trips. When batch mode is used, top-level params are ignored.\n\nReturns: filtered nodes + edges between them. If no filter given, returns per-layer counts and type breakdown only.\n\nWIRE FORMAT (compact): responses that include nodes/edges use short keys and edge-by-index refs to cut payload ~40-60%. Every such response carries a `_schema` legend. Quick reference:\n  nodes[]: { i: id, t: type, n: name, m: module, r: route, mt: methods, x: exports, c: columns }\n  edges[]: { s: source_node_index, d: target_node_index, t: type, l: label }\nedges.s / edges.d are 0-based indices into THIS response\'s nodes array. If a referenced node is not in the response (boundary case), s/d may instead contain the full node id string \u2014 always check the type.\n\nPAGINATION (filter queries):\n- Use `offset` and `limit` to paginate through large result sets.\n- Response includes: `total` (matched), `returned` (in this page), `has_more`, `next_offset`.\n- If `has_more: true`, call again with `offset: next_offset` to get the next page.\n\nBUDGET GUARDS:\n- Neighborhood queries stop expanding when the projected response exceeds budget. The response then contains `budget_exceeded: true` plus `hops_traversed < hops_requested`. When this happens, drill into a specific neighbor with another node_id call rather than retrying with larger hops \u2014 it will just truncate again.\n- Batch mode caps total response size. Once the budget is hit, later queries return `{skipped: true, reason: "batch_budget_exhausted"}` and you must re-run them individually.',
+        description: 'Query the structural project graph \u2014 use INSTEAD of Glob and Grep for locating files, understanding structure, and navigating the codebase. Faster and more accurate than file-system search because it returns typed nodes with metadata and relationships. \n\nUSE THIS FOR: "where is X", "what files are in module Y", "what pages exist under /admin", "what components does Z render", "what tables relate to User", "list all hooks in auth module", "which endpoints touch the User table", "what auth strategy does this endpoint use". \n\nDO NOT USE FOR: understanding what\'s INSIDE a component (use inspect_node for elements, conditions, state, variables, responses), reading actual source code (use Read). \n\nQUERY PARAMS (at least one required for node data \u2014 unfiltered calls return summary only to stay in context):\n- search: substring match on node id, name, or route\n- type: filter by node type (ui layer: page, layout, component, ui, hook, context, config, util; api layer: endpoint; db layer: table, enum)\n- module: filter by module tag (computed from directory structure, e.g. "auth", "admin", "settings")\n- node_id: return this node + its neighborhood (incoming+outgoing edges within `hops`)\n- hops: neighborhood radius when node_id is set (default 1)\n- minimal: return only id/type/name/module/route per node (skip heavy fields like columns, exports)\n- include_edges: return the actual edge list. Default: TRUE for neighborhood queries (node_id), FALSE for filter queries (search/type/module). Filter responses always include `edge_count`; only pass include_edges:true when you actually need to inspect individual edges (e.g. "which components render X"). This default cuts typical filter responses in half.\n\nBATCH MODE: pass `queries` (array of query objects) to run multiple independent queries in a single call. Each query object uses the same params (layer/search/type/module/node_id/hops/minimal). Returns { batch: true, count, results: [{index, query, result}, ...] }. Use this when you need multiple graph views up-front (e.g. scoping a feature across ui+api+db layers) to save round-trips. When batch mode is used, top-level params are ignored.\n\nReturns: filtered nodes + edges between them. If no filter given, returns per-layer counts and type breakdown only.\n\nWIRE FORMAT (compact): responses that include nodes/edges use short keys and edge-by-index refs to cut payload ~40-60%. Every such response carries a `_schema` legend. Quick reference:\n  nodes[]: { i: id, t: type, n: name, m: module, r: route, mt: methods, x: exports, c: columns }\n  edges[]: { s: source_node_index, d: target_node_index, t: type, l: label }\nedges.s / edges.d are 0-based indices into THIS response\'s nodes array. If a referenced node is not in the response (boundary case), s/d may instead contain the full node id string \u2014 always check the type.\n\nPAGINATION (filter queries):\n- Use `offset` and `limit` to paginate through large result sets.\n- Response includes: `total` (matched), `returned` (in this page), `has_more`, `next_offset`.\n- If `has_more: true`, call again with `offset: next_offset` to get the next page.\n\nBUDGET GUARDS:\n- Neighborhood queries stop expanding when the projected response exceeds budget. The response then contains `budget_exceeded: true` plus `hops_traversed < hops_requested`. When this happens, drill into a specific neighbor with another node_id call rather than retrying with larger hops \u2014 it will just truncate again.\n- Batch mode caps total response size. Once the budget is hit, later queries return `{skipped: true, reason: "batch_budget_exhausted"}` and you must re-run them individually.\n\nMONOREPOS: pass `project: "<name>"` to query a sub-project graph (defined in .launchchart.json projects[]). Omitting `project` targets the monorepo root. In batch mode the top-level `project` is inherited by sub-queries that do not set their own. Run detect_project_stack to list configured projects.',
         inputSchema: {
           type: "object",
           properties: {
@@ -6928,7 +8330,7 @@ var init_graph_mcp = __esm({
             },
             queries: {
               type: "array",
-              description: "Batch mode \u2014 array of query objects to run in a single call. Each uses the same param schema. When set, top-level params are ignored. Subject to an aggregate size budget \u2014 later queries may return a skipped stub.",
+              description: "Batch mode \u2014 array of query objects to run in a single call. Each uses the same param schema (including `project`). When set, top-level params are ignored. Subject to an aggregate size budget \u2014 later queries may return a skipped stub.",
               items: {
                 type: "object",
                 properties: {
@@ -6939,9 +8341,14 @@ var init_graph_mcp = __esm({
                   node_id: { type: "string" },
                   hops: { type: "number" },
                   minimal: { type: "boolean" },
-                  include_edges: { type: "boolean" }
+                  include_edges: { type: "boolean" },
+                  project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
                 }
               }
+            },
+            project: {
+              type: "string",
+              description: PROJECT_PARAM_DESCRIPTION
             }
           }
         }
@@ -6988,16 +8395,17 @@ Returns: { pattern, filter, files_searched, total_matches, matches: [{file, line
             case_insensitive: { type: "boolean", description: "Case-insensitive regex. Default false." },
             context: { type: "number", description: "Context lines around each match. Default 2." },
             max_matches: { type: "number", description: "Max matches to return total. Default 50." },
-            max_files: { type: "number", description: "Max files to search. Default 50." }
+            max_files: { type: "number", description: "Max files to search. Default 50." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
           },
           required: ["layer", "pattern"]
         }
       },
       {
         name: "inspect_node",
-        description: `Get deep AST data for specific graph nodes \u2014 what's INSIDE a component or endpoint. Returns elements (JSX), state hooks, conditions, variables, responses, and request params. Use INSTEAD of Grep/Read when you need to understand component internals without reading source.
+        description: `Get deep AST data for specific graph nodes \u2014 what's INSIDE a component or endpoint. Returns elements (JSX), state hooks, conditions, variables, responses, request params, and effects. Use INSTEAD of Grep/Read when you need to understand component internals without reading source.
 
-USE THIS FOR: "what elements does LoginPage have?", "what conditions does the login endpoint check?", "what state does SettingsPage manage?", "what responses can this endpoint return?", "what validation does this API do?", "what props does this component accept?", "which endpoints check for isAdmin?", "find all conditions mentioning rateLimit"
+USE THIS FOR: "what elements does LoginPage have?", "what conditions does the login endpoint check?", "what state does SettingsPage manage?", "what responses can this endpoint return?", "what validation does this API do?", "what props does this component accept?", "which endpoints check for isAdmin?", "find all conditions mentioning rateLimit", "is this function safe to instantiate twice?" (check effects.subscribes / .timers / .dom_writes / .persists / .globals)
 
 DO NOT USE FOR: structural queries (use read_graph), content search (use grep_nodes).
 
@@ -7020,7 +8428,7 @@ Returns deep fields only \u2014 not structural metadata (use read_graph for that
             fields: {
               type: "array",
               items: { type: "string" },
-              description: "Specific deep fields to return. Options: elements, stateVars, conditions, variables, responses, params. Omit for all."
+              description: 'Specific deep fields to return. Options: elements, stateVars, conditions, variables, responses, params, effects. Omit for all. "effects" returns the file-level side-effect summary (calls, dom_writes, subscribes, timers, persists, fetches, globals); per-arrow-function effects are also attached to each entry in "variables".'
             },
             filter: {
               type: "string",
@@ -7029,7 +8437,8 @@ Returns deep fields only \u2014 not structural metadata (use read_graph for that
             case_insensitive: {
               type: "boolean",
               description: "Case-insensitive filter matching. Default true."
-            }
+            },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
           },
           required: ["layer"]
         }
@@ -7065,6 +8474,25 @@ Use this when the user asks "is the chart running", "show me the project graph U
           properties: {}
         }
       },
+      {
+        name: "effects_index",
+        description: 'Cross-layer inverted index over per-node side effects. Answers "who else touches X?" without re-walking every node. Built automatically when generate_graph runs (or whenever the watcher regenerates). \n\nUSE THIS FOR: "is mountFoo safe to instantiate twice?" (kind="singleton_risks"), "who writes DOM id moon-shadow-blur?" (kind="dom_ids", key="moon-shadow-blur"), "which files attach a window keydown listener?" (kind="window_events", key="window:keydown"), "who else writes localStorage key panchang.settings.v1?" (kind="storage_keys", key="..."), "any DOM-id collisions?" (kind="collisions"). \n\nReturns: { kind, results } where results is a {key: [nodeIds]} map for the chosen kind, or a list of multi-writer collisions when kind="collisions", or a flat node-id list when kind="singleton_risks".',
+        inputSchema: {
+          type: "object",
+          properties: {
+            kind: {
+              type: "string",
+              enum: ["dom_ids", "window_events", "storage_keys", "fetch_urls", "timers", "singleton_risks", "collisions"],
+              description: "Which inverted index to query. Default: collisions (most actionable signal)."
+            },
+            key: {
+              type: "string",
+              description: 'Optional specific key to look up within the chosen kind (e.g. "moon-shadow-blur"). When omitted, returns the full {key:nodes} map for the kind.'
+            },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
+          }
+        }
+      },
       {
         name: "detect_project_stack",
         description: "Detect project languages, frameworks, available parsers, and recommend parser configuration. Scans the project to identify all languages present (TypeScript, Python, Go, etc.) and reports which are supported by registered parsers vs detected-but-unsupported. Also detects frameworks (Next.js, Prisma, React, etc.), provides cross-layer detection stats (fetch calls, @api annotations, URL literals), and returns available graph layers. \n\nUse this when setting up launch-chart for a new project, reviewing parser configuration, or checking what languages are in the project.",
@@ -7090,7 +8518,8 @@ Use this when the user asks "is the chart running", "show me the project graph U
             value: {
               type: "string",
               description: 'Tag value (e.g. "auth", "alice", "true").'
-            }
+            },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
           },
           required: ["node_id", "key", "value"]
         }
@@ -7108,7 +8537,8 @@ Use this when the user asks "is the chart running", "show me the project graph U
             key: {
               type: "string",
               description: "Tag key to remove."
-            }
+            },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
           },
           required: ["node_id", "key"]
         }
@@ -7126,7 +8556,8 @@ Use this when the user asks "is the chart running", "show me the project graph U
             check: {
               type: "string",
               description: "Specific check to run (e.g. 'schema_drift', 'unprotected_routes'). Omit to run all checks for the layer."
-            }
+            },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
           },
           required: ["layer"]
         }
@@ -7161,7 +8592,8 @@ Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 retu
               type: "string",
               enum: ["reverse", "both"],
               description: "'reverse' (default) = only what depends on this node. 'both' = full neighborhood."
-            }
+            },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION }
           },
           required: ["node_id"]
         }
@@ -7183,9 +8615,10 @@ Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 retu
         s: "source_node_index",
         d: "target_node_index",
         t: "type",
-        l: "label"
+        l: "label",
+        tl: "target_layer (only set on cross-layer edges, e.g. ui\u2192api calls_api)"
       },
-      note: "edges.s/d are 0-based indices into this response's nodes array. If a referenced node is outside the response (boundary case), s/d may contain the full node id string instead of an index."
+      note: "edges.s/d are 0-based indices into this response's nodes array. If a referenced node is outside the response (boundary case \u2014 common for cross-layer edges where the target lives in a different layer's graph), s/d may contain the full node id string instead of an index. Use tl to identify which layer the target belongs to."
     };
     COMPACT_NODE_KNOWN_KEYS = /* @__PURE__ */ new Set([
       "id",
@@ -7204,7 +8637,8 @@ Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 retu
       "conditions",
       "variables",
       "responses",
-      "params"
+      "params",
+      "effects"
     ]);
     EST_CHARS_PER_NODE_FULL = {
       ui: 300,
@@ -7225,16 +8659,18 @@ Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 retu
     DEFAULT_EST_NODE_MIN = 150;
     DEFAULT_EST_EDGE = 65;
     NEIGHBORHOOD_BUDGET_CHARS = 55e3;
+    MAX_FILTER_EDGES = 200;
     BATCH_BUDGET_CHARS = 6e4;
+    watcherHandle = null;
   }
 });
 
 // src/server/graph-mcp-entry.ts
 var import_node_child_process3 = require("node:child_process");
-var import_node_fs21 = require("node:fs");
-var import_node_path22 = __toESM(require("node:path"));
+var import_node_fs24 = require("node:fs");
+var import_node_path27 = __toESM(require("node:path"));
 var import_node_os3 = require("node:os");
-var import_node_fs22 = require("node:fs");
+var import_node_fs25 = require("node:fs");
 init_lockfile();
 function logStderr(msg) {
   process.stderr.write(`[launch-chart] ${msg}
@@ -7250,11 +8686,11 @@ function maybeAutoServe() {
     return;
   }
   try {
-    const logDir = import_node_path22.default.join((0, import_node_os3.homedir)(), ".launchsecure");
-    (0, import_node_fs22.mkdirSync)(logDir, { recursive: true });
-    const logPath = import_node_path22.default.join(logDir, "launch-chart.log");
-    const out = (0, import_node_fs21.openSync)(logPath, "a");
-    const err2 = (0, import_node_fs21.openSync)(logPath, "a");
+    const logDir = import_node_path27.default.join((0, import_node_os3.homedir)(), ".launchsecure");
+    (0, import_node_fs25.mkdirSync)(logDir, { recursive: true });
+    const logPath = import_node_path27.default.join(logDir, "launch-chart.log");
+    const out = (0, import_node_fs24.openSync)(logPath, "a");
+    const err2 = (0, import_node_fs24.openSync)(logPath, "a");
     const entryPath = process.argv[1];
     const child = (0, import_node_child_process3.spawn)(process.execPath, [entryPath, "serve"], {
       detached: true,
@@ -7276,6 +8712,12 @@ async function main() {
     runServeCli2(argv.slice(1));
     return;
   }
+  if (subcommand === "generate" || subcommand === "read") {
+    const { handleGraphCommand: handleGraphCommand2 } = await Promise.resolve().then(() => (init_graph_cli(), graph_cli_exports));
+    const mapped = subcommand === "generate" ? "graph:generate" : "graph:read";
+    await handleGraphCommand2(mapped, argv.slice(1));
+    process.exit(0);
+  }
   maybeAutoServe();
   const { startGraphMcpServer: startGraphMcpServer2 } = await Promise.resolve().then(() => (init_graph_mcp(), graph_mcp_exports));
   startGraphMcpServer2();