@launchsecure/launch-kit 0.0.25 → 0.0.27

package/dist/server/{server/chart-serve.js → parse-worker-entry.js}

@@ -30,41 +30,171 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/server/graph/core/config.ts
-var config_exports = {};
-__export(config_exports, {
-  loadConfig: () => loadConfig
-});
-function loadConfig(rootDir) {
-  const configPath = (0, import_node_path.join)(rootDir, CONFIG_FILENAME);
-  if (!(0, import_node_fs.existsSync)(configPath)) return {};
-  try {
-    return JSON.parse((0, import_node_fs.readFileSync)(configPath, "utf-8"));
-  } catch {
-    return {};
+// src/server/launch-kit-paths.ts
+var LAUNCHSECURE_DIR, LAUNCHCHART_CONFIG_FILE;
+var init_launch_kit_paths = __esm({
+  "src/server/launch-kit-paths.ts"() {
+    "use strict";
+    LAUNCHSECURE_DIR = ".launchsecure";
+    LAUNCHCHART_CONFIG_FILE = ".launchchart.json";
   }
+});
+
+// src/server/graph/core/parse-failure-cache.ts
+function hashContent(content) {
+  return "sha256:" + (0, import_node_crypto.createHash)("sha256").update(content).digest("hex");
+}
+function setActiveFailureCache(cache) {
+  activeCache = cache;
 }
-var import_node_fs, import_node_path, CONFIG_FILENAME;
-var init_config = __esm({
-  "src/server/graph/core/config.ts"() {
+function getActiveFailureCache() {
+  return activeCache;
+}
+var import_node_crypto, import_node_fs4, import_node_path4, SCHEMA_VERSION, ParseFailureCache, activeCache;
+var init_parse_failure_cache = __esm({
+  "src/server/graph/core/parse-failure-cache.ts"() {
     "use strict";
-    import_node_fs = require("node:fs");
-    import_node_path = require("node:path");
-    CONFIG_FILENAME = ".launchchart.json";
+    import_node_crypto = require("node:crypto");
+    import_node_fs4 = require("node:fs");
+    import_node_path4 = require("node:path");
+    init_launch_kit_paths();
+    SCHEMA_VERSION = 1;
+    ParseFailureCache = class {
+      constructor(rootDir, treeSitterFingerprint) {
+        this.failures = /* @__PURE__ */ new Map();
+        this.dirty = false;
+        this.cacheFilePath = (0, import_node_path4.join)(rootDir, LAUNCHSECURE_DIR, "graphs", ".failures.json");
+        this.fingerprint = treeSitterFingerprint;
+        this.load();
+      }
+      /** Path the cache persists to. Exposed so tier 3 can audit it. */
+      get filePath() {
+        return this.cacheFilePath;
+      }
+      /**
+       * Return the entry for absPath IF the cached entry's contentHash matches the
+       * current bytes. Otherwise null (caller should attempt a real parse).
+       */
+      shouldSkip(absPath, content) {
+        const cached = this.failures.get(absPath);
+        if (!cached) return null;
+        if (cached.contentHash !== hashContent(content)) return null;
+        return cached;
+      }
+      /** Record a parse failure. Increments consecutiveAttempts when hash matches. */
+      recordFailure(absPath, content, error) {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const hash = hashContent(content);
+        const prior = this.failures.get(absPath);
+        const entry = {
+          contentHash: hash,
+          failedAt: prior && prior.contentHash === hash ? prior.failedAt : now,
+          lastAttemptAt: now,
+          lastError: error,
+          consecutiveAttempts: prior && prior.contentHash === hash ? prior.consecutiveAttempts + 1 : 1
+        };
+        this.failures.set(absPath, entry);
+        this.dirty = true;
+      }
+      /** Bump the lastAttemptAt timestamp on a skip without changing the failure record. */
+      bumpAttempt(absPath) {
+        const cached = this.failures.get(absPath);
+        if (!cached) return;
+        cached.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+        this.dirty = true;
+      }
+      /** Clear a single entry (call on successful parse). */
+      clear(absPath) {
+        if (!this.failures.has(absPath)) return false;
+        this.failures.delete(absPath);
+        this.dirty = true;
+        return true;
+      }
+      /** Wipe the entire cache (call after a successful tier-3 full regen). */
+      clearAll() {
+        if (this.failures.size === 0) return;
+        this.failures.clear();
+        this.dirty = true;
+      }
+      /** Snapshot for meta/status surfacing. */
+      list() {
+        const out = [];
+        for (const [path, entry] of this.failures) out.push({ path, ...entry });
+        return out;
+      }
+      size() {
+        return this.failures.size;
+      }
+      /**
+       * Atomically persist to disk. No-op if nothing has changed since last flush.
+       * Uses temp + rename so a torn write never corrupts the cache.
+       */
+      flush() {
+        if (!this.dirty) return;
+        const payload = {
+          schemaVersion: SCHEMA_VERSION,
+          treeSitterFingerprint: this.fingerprint,
+          failures: Object.fromEntries(this.failures)
+        };
+        const dir = (0, import_node_path4.dirname)(this.cacheFilePath);
+        const tmp = this.cacheFilePath + ".tmp";
+        try {
+          require("node:fs").mkdirSync(dir, { recursive: true });
+          (0, import_node_fs4.writeFileSync)(tmp, JSON.stringify(payload, null, 2) + "\n", "utf-8");
+          (0, import_node_fs4.renameSync)(tmp, this.cacheFilePath);
+          this.dirty = false;
+        } catch (e) {
+          process.stderr.write(`[lc-failure-cache] flush failed for ${this.cacheFilePath}: ${e.message}
+`);
+        }
+      }
+      load() {
+        if (!(0, import_node_fs4.existsSync)(this.cacheFilePath)) return;
+        let parsed;
+        try {
+          parsed = JSON.parse((0, import_node_fs4.readFileSync)(this.cacheFilePath, "utf-8"));
+        } catch (e) {
+          process.stderr.write(`[lc-failure-cache] cache file unreadable, starting fresh: ${e.message}
+`);
+          return;
+        }
+        if (!parsed || parsed.schemaVersion !== SCHEMA_VERSION) {
+          process.stderr.write(`[lc-failure-cache] schema version mismatch, discarding cache
+`);
+          return;
+        }
+        if (parsed.treeSitterFingerprint !== this.fingerprint) {
+          process.stderr.write(`[lc-failure-cache] tree-sitter fingerprint changed, retrying all cached failures
+`);
+          return;
+        }
+        for (const [path, entry] of Object.entries(parsed.failures)) {
+          this.failures.set(path, entry);
+        }
+      }
+    };
+    activeCache = null;
   }
 });
 
 // src/server/graph/core/ts-extractor.ts
 var ts_extractor_exports = {};
 __export(ts_extractor_exports, {
+  ParseCascadeError: () => ParseCascadeError,
   classifyFile: () => classifyFile,
+  classifyRouteAgainstMiddleware: () => classifyRouteAgainstMiddleware,
   createQuery: () => createQuery,
   extractAuthWrappersTS: () => extractAuthWrappersTS,
   extractDbCallsTS: () => extractDbCallsTS,
   extractDeep: () => extractDeep,
+  extractEffects: () => extractEffects,
+  extractMiddlewareAuthTS: () => extractMiddlewareAuthTS,
+  getTreeSitterFingerprint: () => getTreeSitterFingerprint,
   initTreeSitter: () => initTreeSitter,
+  middlewarePatternToRegex: () => middlewarePatternToRegex,
   parseCodeTS: () => parseCodeTS,
   parseFileTS: () => parseFileTS,
+  parseSource: () => parseSource,
   setExtractorConfig: () => setExtractorConfig
 });
 async function initTreeSitter() {
@@ -75,7 +205,8 @@ async function initTreeSitter() {
     await TreeSitter.init();
     const wasmPath = require.resolve("tree-sitter-typescript/tree-sitter-tsx.wasm");
     tsxLanguage = await TreeSitter.Language.load(wasmPath);
-    parserInstance = new TreeSitter();
+    TreeSitterCtor = TreeSitter;
+    parserInstance = new TreeSitterCtor();
     parserInstance.setLanguage(tsxLanguage);
     initialized = true;
   })();
@@ -86,20 +217,92 @@ function ensureInit() {
     throw new Error("Tree-sitter not initialized. Call initTreeSitter() first.");
   }
 }
+function getTreeSitterFingerprint() {
+  const read = (pkg) => {
+    try {
+      return String(require(`${pkg}/package.json`).version ?? "unknown");
+    } catch {
+      return "unknown";
+    }
+  };
+  return `web-tree-sitter@${read("web-tree-sitter")}+tree-sitter-typescript@${read("tree-sitter-typescript")}`;
+}
 function getQuery(name) {
   ensureInit();
   const cached = queryCache.get(name);
   if (cached) return cached;
-  const scmPath = (0, import_node_path3.join)(queriesDir, `${name}.scm`);
-  const scm = (0, import_node_fs3.readFileSync)(scmPath, "utf-8");
+  const scmPath = (0, import_node_path5.join)(queriesDir, `${name}.scm`);
+  const scm = (0, import_node_fs5.readFileSync)(scmPath, "utf-8");
   const query = tsxLanguage.query(scm);
   queryCache.set(name, query);
   return query;
 }
+function recreateParser() {
+  if (!TreeSitterCtor || !tsxLanguage) {
+    throw new Error("recreateParser() called before initTreeSitter()");
+  }
+  try {
+    parserInstance?.delete?.();
+  } catch {
+  }
+  parserInstance = new TreeSitterCtor();
+  parserInstance.setLanguage(tsxLanguage);
+}
 function parseSource(absPath) {
   ensureInit();
-  const content = (0, import_node_fs3.readFileSync)(absPath, "utf-8");
-  return parserInstance.parse(content);
+  let content;
+  try {
+    const stat = (0, import_node_fs5.statSync)(absPath);
+    if (stat.size > MAX_PARSEABLE_BYTES) {
+      process.stderr.write(`[lc-extractor] skipping ${absPath}: ${stat.size} bytes exceeds max ${MAX_PARSEABLE_BYTES}
+`);
+      return null;
+    }
+    content = (0, import_node_fs5.readFileSync)(absPath, "utf-8");
+  } catch (e) {
+    process.stderr.write(`[lc-extractor] read failed for ${absPath}: ${e instanceof Error ? e.message : String(e)}
+`);
+    return null;
+  }
+  const cache = getActiveFailureCache();
+  if (cache) {
+    const skipEntry = cache.shouldSkip(absPath, content);
+    if (skipEntry) {
+      cache.bumpAttempt(absPath);
+      process.stderr.write(`[lc-extractor] skipping ${absPath}: known-bad (${skipEntry.consecutiveAttempts} attempts, last error: ${skipEntry.lastError})
+`);
+      return null;
+    }
+  }
+  try {
+    const tree = parserInstance.parse(content);
+    consecutiveParseFailures = 0;
+    cache?.clear(absPath);
+    return tree;
+  } catch (e) {
+    consecutiveParseFailures++;
+    const msg = e instanceof Error ? e.message : String(e);
+    process.stderr.write(
+      `[lc-extractor] parse failed for ${absPath}: ${msg} (consecutive failures: ${consecutiveParseFailures}/${MAX_CONSECUTIVE_PARSE_FAILURES})
+`
+    );
+    cache?.recordFailure(absPath, content, msg);
+    try {
+      recreateParser();
+    } catch (recreateErr) {
+      const rmsg = recreateErr instanceof Error ? recreateErr.message : String(recreateErr);
+      process.stderr.write(`[lc-extractor] FATAL: recreateParser failed after ${absPath}: ${rmsg}
+`);
+      consecutiveParseFailures = 0;
+      throw recreateErr;
+    }
+    if (consecutiveParseFailures >= MAX_CONSECUTIVE_PARSE_FAILURES) {
+      const tripCount = consecutiveParseFailures;
+      consecutiveParseFailures = 0;
+      throw new ParseCascadeError(absPath, tripCount);
+    }
+    return null;
+  }
 }
 function parseCodeTS(code) {
   ensureInit();
@@ -139,8 +342,20 @@ function childrenOfType(node, type) {
 function childOfType(node, type) {
   return node.children.find((n) => n.type === type);
 }
+function emptyParsedFile(absPath) {
+  return {
+    name: absPath.split("/").pop() ?? absPath,
+    exports: [],
+    imports: [],
+    reExports: [],
+    jsxElements: /* @__PURE__ */ new Set(),
+    navigations: [],
+    fetchCalls: []
+  };
+}
 function parseFileTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return emptyParsedFile(absPath);
   const root = tree.rootNode;
   const imports = [];
   const importStatements = childrenOfType(root, "import_statement");
@@ -285,6 +500,12 @@ function parseFileTS(absPath) {
     if (linkTemplate) {
       navigations.push({ kind: "link-href", target: linkTemplate, isTemplate: true });
     }
+    if (caps["nav.redirect.literal"]) {
+      navigations.push({ kind: "router-replace", target: caps["nav.redirect.literal"], isTemplate: false });
+    }
+    if (caps["nav.redirect.template"]) {
+      navigations.push({ kind: "router-replace", target: caps["nav.redirect.template"], isTemplate: true });
+    }
     if (caps["nav.window.literal"]) {
       navigations.push({ kind: "window-location", target: caps["nav.window.literal"], isTemplate: false });
     }
@@ -329,6 +550,7 @@ function parseFileTS(absPath) {
 }
 function extractDbCallsTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return [];
   const root = tree.rootNode;
   const dbQuery = getQuery("db-calls");
   const matches = dbQuery.matches(root);
@@ -363,15 +585,25 @@ function extractDbCallsTS(absPath) {
   const seen = /* @__PURE__ */ new Set();
   for (const m of matches) {
     const caps = captureMap(m);
+    const sbTable = caps["sb.table"];
+    const sbMethod = caps["sb.method"];
+    if (sbTable && sbMethod) {
+      const key2 = `sql:${sbTable}.${sbMethod}`;
+      if (seen.has(key2)) continue;
+      seen.add(key2);
+      const isMutation = SUPABASE_MUTATION_METHODS_BUILTIN.has(sbMethod) || extraMutationMethods.includes(sbMethod);
+      calls.push({ model: sbTable, method: sbMethod, isMutation, kind: "sql" });
+      continue;
+    }
     const identifier = caps["db.identifier"];
     const model = caps["db.model"];
     const method = caps["db.method"];
     if (!identifier || !model || !method) continue;
     if (!dbIdentifiers.has(identifier)) continue;
-    const key = `${model}.${method}`;
+    const key = `orm:${model}.${method}`;
     if (seen.has(key)) continue;
     seen.add(key);
-    calls.push({ model, method, isMutation: getMutationMethods().has(method) });
+    calls.push({ model, method, isMutation: getMutationMethods().has(method), kind: "orm" });
   }
   return calls;
 }
@@ -379,12 +611,17 @@ function classifyFile(absPath) {
   const fileName = require("path").basename(absPath);
   if (fileName.includes(".test.") || fileName.includes(".spec.") || fileName.includes("__test")) return "test";
   if (fileName.includes(".stories.")) return "story";
+  if (fileName === "middleware.ts" || fileName === "middleware.tsx") return "middleware";
   const tree = parseSource(absPath);
+  if (!tree) return "util";
   const root = tree.rootNode;
   const classifyQuery = getQuery("classify");
   const captures = classifyQuery.captures(root);
   const capNames = new Set(captures.map((c) => c.name));
   if (capNames.has("http_export") || capNames.has("http_export_fn")) return "endpoint";
+  if (capNames.has("use_server_directive") && fileName !== "page.tsx" && fileName !== "layout.tsx") {
+    return "server-action";
+  }
   if (fileName === "page.tsx" && capNames.has("has_jsx")) return "page";
   if (fileName === "layout.tsx" && capNames.has("has_jsx")) return "layout";
   if (capNames.has("has_create_context") || capNames.has("has_create_context_bare")) return "context";
@@ -395,6 +632,7 @@ function classifyFile(absPath) {
 }
 function extractAuthWrappersTS(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) return /* @__PURE__ */ new Set();
   const root = tree.rootNode;
   const wrapperQuery = getQuery("wrappers");
   const matches = wrapperQuery.matches(root);
@@ -405,13 +643,386 @@ function extractAuthWrappersTS(absPath) {
       wrappers.add(caps["wrapper.fn_name"]);
     }
   }
+  const inlineHelpers = /* @__PURE__ */ new Set();
+  for (const stmt of childrenOfType(root, "import_statement")) {
+    const sourceNode = childOfType(stmt, "string");
+    const frag = sourceNode ? childOfType(sourceNode, "string_fragment") : void 0;
+    if (!frag) continue;
+    const provider = INLINE_AUTH_IMPORTS.find((p) => p.module.test(frag.text));
+    if (!provider) continue;
+    const clause = childOfType(stmt, "import_clause");
+    if (!clause) continue;
+    const named = childOfType(clause, "named_imports");
+    if (!named) continue;
+    for (const specNode of childrenOfType(named, "import_specifier")) {
+      const ids = childrenOfType(specNode, "identifier");
+      const importedName = ids[0]?.text;
+      const localName = ids[ids.length - 1]?.text;
+      if (importedName && provider.helpers.includes(importedName) && localName) {
+        inlineHelpers.add(localName);
+      }
+    }
+  }
+  if (inlineHelpers.size > 0) {
+    const text = root.text;
+    for (const name of inlineHelpers) {
+      const re = new RegExp(`\\b${name}\\s*\\(`);
+      if (re.test(text)) {
+        wrappers.add("inline");
+        break;
+      }
+    }
+  }
   return wrappers;
 }
+function inferIntentFromName(name) {
+  if (TRUST_AS_PROTECT_KEYS.has(name)) {
+    return { intent: "protect", hint: `Next.js config.${name} \u2014 paths matched run through middleware` };
+  }
+  for (const re of EXEMPT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "exempt", hint: `name "${name}" matches /${re.source}/` };
+  }
+  for (const re of PROTECT_NAME_PATTERNS) {
+    if (re.test(name)) return { intent: "protect", hint: `name "${name}" matches /${re.source}/` };
+  }
+  return { intent: "ambiguous", hint: `name "${name}" has no exempt/protect signal` };
+}
+function looksLikeRoutePattern(s) {
+  return s.startsWith("/") && !s.startsWith("//");
+}
+function collectStringsFromArray(arrNode) {
+  const out = [];
+  for (const child of arrNode.children) {
+    if (child.type !== "string") continue;
+    const frag = childOfType(child, "string_fragment");
+    if (frag) out.push(frag.text);
+  }
+  return out;
+}
+function findArrayInValue(valueNode) {
+  if (!valueNode) return null;
+  if (valueNode.type === "array") return valueNode;
+  if (valueNode.type === "call_expression") {
+    const args = childOfType(valueNode, "arguments");
+    if (!args) return null;
+    for (const c of args.children) {
+      if (c.type === "array") return c;
+    }
+  }
+  return null;
+}
+function extractMatcherFromDeclarator(decl) {
+  const nameNode = childOfType(decl, "identifier");
+  if (!nameNode) return null;
+  let valueNode;
+  for (const c of decl.children) {
+    if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+    valueNode = c;
+  }
+  const arr = findArrayInValue(valueNode);
+  if (!arr) return null;
+  const strings = collectStringsFromArray(arr);
+  const routes = strings.filter(looksLikeRoutePattern);
+  if (routes.length === 0) return null;
+  const { intent, hint } = inferIntentFromName(nameNode.text);
+  return { name: nameNode.text, patterns: routes, intent, hint };
+}
+function extractMatchersFromObject(objNode) {
+  const out = [];
+  for (const pair of childrenOfType(objNode, "pair")) {
+    const key = childOfType(pair, "property_identifier");
+    if (!key) continue;
+    const arr = pair.children.find((c) => c.type === "array");
+    if (!arr) continue;
+    const routes = collectStringsFromArray(arr).filter(looksLikeRoutePattern);
+    if (routes.length === 0) continue;
+    const { intent, hint } = inferIntentFromName(key.text);
+    out.push({ name: key.text, patterns: routes, intent, hint });
+  }
+  return out;
+}
+function detectFallthroughProtect(root) {
+  const text = root.text;
+  const signals = [
+    /\bauth\.protect\s*\(/,
+    /\bauth\(\)\.protect\s*\(/,
+    /\bredirect\s*\(\s*['"`]\/(sign-?in|log-?in|auth)/i,
+    /\bNextResponse\.redirect\s*\(/,
+    /\bthrow\s+new\s+\w*Unauthorized/i
+  ];
+  return signals.some((re) => re.test(text));
+}
+function extractMiddlewareAuthTS(absPath) {
+  if (!require("node:fs").existsSync(absPath)) return null;
+  const tree = parseSource(absPath);
+  if (!tree) return null;
+  const root = tree.rootNode;
+  const matchers = [];
+  for (const stmt of root.children) {
+    if (stmt.type !== "lexical_declaration" && stmt.type !== "variable_declaration") continue;
+    for (const decl of childrenOfType(stmt, "variable_declarator")) {
+      const m = extractMatcherFromDeclarator(decl);
+      if (m) matchers.push(m);
+      let valueNode;
+      for (const c of decl.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+    }
+  }
+  for (const stmt of root.children) {
+    if (stmt.type !== "export_statement") continue;
+    const decl = childOfType(stmt, "lexical_declaration") ?? childOfType(stmt, "variable_declaration");
+    if (!decl) continue;
+    for (const d of childrenOfType(decl, "variable_declarator")) {
+      let valueNode;
+      for (const c of d.children) {
+        if (c.type === "identifier" || c.type === "=" || c.type === "type_annotation") continue;
+        valueNode = c;
+      }
+      if (valueNode?.type === "object") {
+        for (const inner of extractMatchersFromObject(valueNode)) matchers.push(inner);
+      }
+      const m = extractMatcherFromDeclarator(d);
+      if (m && !matchers.some((x) => x.name === m.name && x.patterns.join() === m.patterns.join())) {
+        matchers.push(m);
+      }
+    }
+  }
+  return {
+    file: absPath,
+    matchers,
+    hasFallthroughProtect: detectFallthroughProtect(root)
+  };
+}
+function middlewarePatternToRegex(pattern) {
+  const negLookaheadMatch = /^(\/?)\(\(\?\!([^)]+)\)(\.\*|\.\+)\)$/.exec(pattern);
+  if (negLookaheadMatch) {
+    const [, lead, altsRaw, body] = negLookaheadMatch;
+    const escapedAlts = altsRaw.split("|").map((alt) => alt.trim().replace(/[.+*?^${}()|[\]\\]/g, "\\$&")).join("|");
+    try {
+      return new RegExp(`^${lead}(?!${escapedAlts})${body}$`);
+    } catch {
+      return null;
+    }
+  }
+  if (/\(\?\!/.test(pattern)) return null;
+  if (pattern.startsWith("(")) return null;
+  let src = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "(" && pattern.slice(i, i + 4) === "(.*)") {
+      src += ".*";
+      i += 4;
+      continue;
+    }
+    if (ch === ":") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      src += "[^/]+";
+      continue;
+    }
+    if (ch === "*") {
+      i++;
+      while (i < pattern.length && /[a-zA-Z0-9_]/.test(pattern[i])) i++;
+      if (pattern[i] === "?") {
+        i++;
+        src += ".*";
+        continue;
+      }
+      src += ".+";
+      continue;
+    }
+    if (/[.\\+?^${}()|[\]]/.test(ch)) {
+      src += "\\" + ch;
+      i++;
+      continue;
+    }
+    src += ch;
+    i++;
+  }
+  src += "$";
+  try {
+    return new RegExp(src);
+  } catch {
+    return null;
+  }
+}
+function classifyRouteAgainstMiddleware(routePath, info) {
+  for (const m of info.matchers) {
+    if (m.intent === "ambiguous") continue;
+    for (const pat of m.patterns) {
+      const re = middlewarePatternToRegex(pat);
+      if (!re) continue;
+      if (re.test(routePath)) return { intent: m.intent, matcher: m.name, pattern: pat };
+    }
+  }
+  return null;
+}
 function trunc(s, max = 120) {
   return s.length > max ? s.slice(0, max) + "..." : s;
 }
+function dedup(arr) {
+  return Array.from(new Set(arr));
+}
+function firstStringArg(callExpr) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return null;
+  for (const c of args.namedChildren) {
+    if (c.type === "string") {
+      const frag = c.namedChildren.find((cc) => cc.type === "string_fragment");
+      return frag ? frag.text : c.text.replace(/^['"`]|['"`]$/g, "");
+    }
+    if (c.type === "template_string") {
+      return c.text.replace(/^`|`$/g, "");
+    }
+  }
+  return null;
+}
+function isFunctionLike(node) {
+  return node.type === "arrow_function" || node.type === "function_expression" || node.type === "function_declaration" || node.type === "method_definition" || node.type === "generator_function" || node.type === "generator_function_declaration";
+}
+function stringLiteralValue(n) {
+  if (n.type !== "string") return null;
+  const frag = n.namedChildren.find((c) => c.type === "string_fragment");
+  if (frag) return frag.text;
+  return n.text.replace(/^['"`]|['"`]$/g, "");
+}
+function nthStringArg(callExpr, idx) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return null;
+  const child = args.namedChildren[idx];
+  return child ? stringLiteralValue(child) : null;
+}
+function objectArgIdValues(callExpr) {
+  const args = callExpr.childForFieldName("arguments");
+  if (!args) return [];
+  const out = [];
+  for (const arg of args.namedChildren) {
+    if (arg.type !== "object") continue;
+    for (const pair of arg.namedChildren) {
+      if (pair.type !== "pair") continue;
+      const key = pair.childForFieldName("key");
+      const val = pair.childForFieldName("value");
+      if (!key || !val) continue;
+      const keyText = key.type === "property_identifier" ? key.text : stringLiteralValue(key) ?? key.text;
+      if (keyText !== "id") continue;
+      const strVal = stringLiteralValue(val);
+      if (strVal) out.push(strVal);
+    }
+  }
+  return out;
+}
+function extractEffects(node, moduleOnly = false) {
+  const calls = [];
+  const dom_writes = [];
+  const subscribes = [];
+  const timers = [];
+  const persists = [];
+  const fetches = [];
+  const globals = [];
+  const dom_ids = [];
+  const window_events = [];
+  const storage_keys = [];
+  const fetch_urls = [];
+  function visit(n, depth) {
+    if (moduleOnly && depth > 0 && isFunctionLike(n)) return;
+    if (n.type === "call_expression") {
+      const fn = n.childForFieldName("function");
+      if (fn) {
+        const fnText = fn.text;
+        calls.push(fnText);
+        for (const id of objectArgIdValues(n)) dom_ids.push(id);
+        if (fn.type === "identifier") {
+          if (TIMER_FNS.has(fnText)) timers.push(fnText);
+          if (fnText === "fetch") {
+            const url = firstStringArg(n);
+            fetches.push(url ? `fetch("${url}")` : "fetch(...)");
+            if (url) fetch_urls.push(url);
+          }
+        } else if (fn.type === "member_expression") {
+          const obj = fn.childForFieldName("object");
+          const prop = fn.childForFieldName("property");
+          const objText = obj?.text ?? "";
+          const propText = prop?.text ?? "";
+          if (STORAGE_OBJECTS.has(objText)) {
+            const key = firstStringArg(n);
+            persists.push(key ? `${objText}.${propText}("${key}")` : `${objText}.${propText}(\u2026)`);
+            if (key) storage_keys.push(key);
+          } else if (propText === "addEventListener") {
+            const event = firstStringArg(n);
+            subscribes.push(event ? `${objText}.addEventListener("${event}")` : `${objText}.addEventListener(\u2026)`);
+            if (event && (objText === "window" || objText === "document")) {
+              window_events.push(`${objText}:${event}`);
+            }
+          } else if (propText === "removeEventListener") {
+            const event = firstStringArg(n);
+            subscribes.push(event ? `${objText}.removeEventListener("${event}")` : `${objText}.removeEventListener(\u2026)`);
+          } else if (propText === "subscribe" || propText === "on") {
+            subscribes.push(`${objText}.${propText}(\u2026)`);
+          } else if (DOM_METHOD_NAMES.has(propText)) {
+            dom_writes.push(`${objText}.${propText}(\u2026)`);
+            if (propText === "setAttribute" && nthStringArg(n, 0) === "id") {
+              const idVal = nthStringArg(n, 1);
+              if (idVal) dom_ids.push(idVal);
+            }
+          } else if (objText.endsWith(".classList") && CLASSLIST_METHODS.has(propText)) {
+            dom_writes.push(`${objText}.${propText}(\u2026)`);
+          } else if (objText === "history" && HISTORY_METHODS.has(propText)) {
+            globals.push(`history.${propText}(\u2026)`);
+          } else if (objText === "location" && LOCATION_METHODS.has(propText)) {
+            globals.push(`location.${propText}(\u2026)`);
+          } else if (objText === "window" && propText === "matchMedia") {
+            globals.push("window.matchMedia(\u2026)");
+          }
+        }
+      }
+    } else if (n.type === "assignment_expression") {
+      const lhs = n.children.find((c) => c.type !== "=");
+      const rhs = n.childForFieldName("right");
+      if (lhs?.type === "member_expression") {
+        const prop = lhs.childForFieldName("property");
+        const propText = prop?.text ?? "";
+        const lhsText = lhs.text;
+        if (lhsText.startsWith("document.cookie")) {
+          persists.push("document.cookie =");
+        } else if (lhsText.startsWith("document.title") || lhsText.startsWith("location.")) {
+          globals.push(`${lhsText} =`);
+        } else if (ASSIGN_DOM_PROPS.has(propText) || lhsText.includes(".style.") || lhsText.includes(".dataset.")) {
+          dom_writes.push(`${lhsText} =`);
+          if (propText === "id" && rhs) {
+            const idVal = stringLiteralValue(rhs);
+            if (idVal) dom_ids.push(idVal);
+          }
+        }
+      }
+    }
+    for (const child of n.children) visit(child, depth + 1);
+  }
+  visit(node, 0);
+  const out = {};
+  if (calls.length) out.calls = dedup(calls);
+  if (dom_writes.length) out.dom_writes = dedup(dom_writes);
+  if (subscribes.length) out.subscribes = dedup(subscribes);
+  if (timers.length) out.timers = dedup(timers);
+  if (persists.length) out.persists = dedup(persists);
+  if (fetches.length) out.fetches = dedup(fetches);
+  if (globals.length) out.globals = dedup(globals);
+  if (dom_ids.length) out.dom_ids = dedup(dom_ids);
+  if (window_events.length) out.window_events = dedup(window_events);
+  if (storage_keys.length) out.storage_keys = dedup(storage_keys);
+  if (fetch_urls.length) out.fetch_urls = dedup(fetch_urls);
+  return out;
+}
 function extractDeep(absPath) {
   const tree = parseSource(absPath);
+  if (!tree) {
+    return { elements: [], stateVars: [], conditions: [], variables: [], responses: [], params: [] };
+  }
   const root = tree.rootNode;
   const elements = [];
   const elQuery = getQuery("deep/jsx-semantic");
@@ -504,12 +1115,18 @@ function extractDeep(absPath) {
     const caps = captureMap(m);
     const declNode = m.captures.find((c) => c.name === "var.decl" || c.name === "var.destructured" || c.name === "var.array")?.node;
     const kind = declNode?.children.find((n) => n.type === "const" || n.type === "let" || n.type === "var")?.type ?? "const";
+    const initNode = m.captures.find((c) => c.name === "var.init")?.node;
     if (caps["var.name"] && caps["var.init"]) {
-      variables.push({
+      const variable = {
         name: caps["var.name"],
         kind,
         init: trunc(caps["var.init"], 100)
-      });
+      };
+      if (initNode && isFunctionLike(initNode)) {
+        const eff = extractEffects(initNode);
+        if (Object.keys(eff).length > 0) variable.effects = eff;
+      }
+      variables.push(variable);
     }
     if (caps["var.destructured.obj"]) {
       variables.push({
@@ -561,21 +1178,49 @@ function extractDeep(absPath) {
       params.push({ name: caps["param.body"], source: "body" });
     }
   }
-  return { elements, stateVars, conditions, variables, responses, params };
+  const fileEffects = extractEffects(
+    root,
+    /* moduleOnly */
+    false
+  );
+  const hasEffects = Object.keys(fileEffects).length > 0;
+  return {
+    elements,
+    stateVars,
+    conditions,
+    variables,
+    responses,
+    params,
+    ...hasEffects ? { effects: fileEffects } : {}
+  };
 }
-var import_node_fs3, import_node_path3, tsxLanguage, parserInstance, initPromise, initialized, queriesDir, queryCache, PRISMA_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods;
+var import_node_fs5, import_node_path5, tsxLanguage, parserInstance, TreeSitterCtor, initPromise, initialized, queriesDir, queryCache, MAX_PARSEABLE_BYTES, MAX_CONSECUTIVE_PARSE_FAILURES, consecutiveParseFailures, ParseCascadeError, PRISMA_MUTATION_METHODS_BUILTIN, SUPABASE_MUTATION_METHODS_BUILTIN, DB_IDENTIFIERS_FALLBACK, extraDbIdentifiers, extraMutationMethods, INLINE_AUTH_IMPORTS, EXEMPT_NAME_PATTERNS, PROTECT_NAME_PATTERNS, TRUST_AS_PROTECT_KEYS, TIMER_FNS, DOM_METHOD_NAMES, CLASSLIST_METHODS, STORAGE_OBJECTS, HISTORY_METHODS, LOCATION_METHODS, ASSIGN_DOM_PROPS;
 var init_ts_extractor = __esm({
   "src/server/graph/core/ts-extractor.ts"() {
     "use strict";
-    import_node_fs3 = require("node:fs");
-    import_node_path3 = require("node:path");
+    import_node_fs5 = require("node:fs");
+    import_node_path5 = require("node:path");
+    init_parse_failure_cache();
     initialized = false;
     queriesDir = (() => {
-      const srcPath = (0, import_node_path3.join)((0, import_node_path3.dirname)(__filename), "..", "queries");
+      const srcPath = (0, import_node_path5.join)((0, import_node_path5.dirname)(__filename), "..", "queries");
       if (require("fs").existsSync(srcPath)) return srcPath;
-      return (0, import_node_path3.join)((0, import_node_path3.dirname)(__filename), "graph", "queries");
+      return (0, import_node_path5.join)((0, import_node_path5.dirname)(__filename), "graph", "queries");
     })();
     queryCache = /* @__PURE__ */ new Map();
+    MAX_PARSEABLE_BYTES = 2 * 1024 * 1024;
+    MAX_CONSECUTIVE_PARSE_FAILURES = 10;
+    consecutiveParseFailures = 0;
+    ParseCascadeError = class extends Error {
+      constructor(lastPath, failureCount) {
+        super(
+          `tree-sitter parse cascade: ${failureCount} consecutive WASM failures (last file: ${lastPath}). The shared Parser's WASM heap is likely corrupted; aborting regen so the graph isn't silently degraded. Restart the chart server to reinitialize, then re-run generate_graph.`
+        );
+        this.lastPath = lastPath;
+        this.failureCount = failureCount;
+        this.name = "ParseCascadeError";
+      }
+    };
     PRISMA_MUTATION_METHODS_BUILTIN = [
       "create",
       "createMany",
@@ -587,148 +1232,411 @@ var init_ts_extractor = __esm({
       "delete",
       "deleteMany"
     ];
+    SUPABASE_MUTATION_METHODS_BUILTIN = /* @__PURE__ */ new Set([
+      "insert",
+      "update",
+      "delete",
+      "upsert"
+    ]);
     DB_IDENTIFIERS_FALLBACK = ["db", "prisma"];
     extraDbIdentifiers = [];
     extraMutationMethods = [];
+    INLINE_AUTH_IMPORTS = [
+      { module: /^@clerk\/nextjs(\/server)?$/, helpers: ["auth", "currentUser"] },
+      { module: /^next-auth(\/.+)?$/, helpers: ["auth", "getServerSession"] },
+      { module: /^@auth\//, helpers: ["auth"] },
+      { module: /^@supabase\/auth-helpers/, helpers: ["createServerClient"] }
+    ];
+    EXEMPT_NAME_PATTERNS = [
+      /^is_?public/i,
+      /^public_?routes?/i,
+      /^public_?paths?/i,
+      /^whitelist/i,
+      /^allowlist/i,
+      /^unauthenticated/i,
+      /^anonymous/i,
+      /^guest/i,
+      /^skip_?auth/i,
+      /^bypass/i
+    ];
+    PROTECT_NAME_PATTERNS = [
+      /^is_?protected/i,
+      /^protected_?routes?/i,
+      /^protected_?paths?/i,
+      /^require_?auth/i,
+      /^auth_?required/i,
+      /^private_?routes?/i,
+      /^is_?admin/i,
+      /^admin_?routes?/i,
+      /^secured/i
+    ];
+    TRUST_AS_PROTECT_KEYS = /* @__PURE__ */ new Set(["matcher", "matchers"]);
+    TIMER_FNS = /* @__PURE__ */ new Set([
+      "setInterval",
+      "setTimeout",
+      "clearInterval",
+      "clearTimeout",
+      "requestAnimationFrame",
+      "cancelAnimationFrame",
+      "queueMicrotask"
+    ]);
+    DOM_METHOD_NAMES = /* @__PURE__ */ new Set([
+      "setAttribute",
+      "removeAttribute",
+      "appendChild",
+      "removeChild",
+      "replaceChildren",
+      "replaceWith",
+      "insertBefore",
+      "append",
+      "prepend",
+      "remove",
+      "before",
+      "after",
+      "insertAdjacentHTML",
+      "insertAdjacentElement"
+    ]);
+    CLASSLIST_METHODS = /* @__PURE__ */ new Set(["add", "remove", "toggle", "replace"]);
+    STORAGE_OBJECTS = /* @__PURE__ */ new Set(["localStorage", "sessionStorage"]);
+    HISTORY_METHODS = /* @__PURE__ */ new Set(["pushState", "replaceState", "back", "forward", "go"]);
+    LOCATION_METHODS = /* @__PURE__ */ new Set(["assign", "replace", "reload"]);
+    ASSIGN_DOM_PROPS = /* @__PURE__ */ new Set([
+      "textContent",
+      "innerHTML",
+      "innerText",
+      "value",
+      "src",
+      "href",
+      "className",
+      "id",
+      "checked",
+      "selected",
+      "disabled"
+    ]);
   }
 });
 
-// src/server/chart-serve.ts
-var chart_serve_exports = {};
-__export(chart_serve_exports, {
-  runServeCli: () => runServeCli,
-  startChartServer: () => startChartServer
-});
-module.exports = __toCommonJS(chart_serve_exports);
-var import_node_http = __toESM(require("node:http"));
-var import_node_fs17 = __toESM(require("node:fs"));
-var import_node_path19 = __toESM(require("node:path"));
+// src/server/parse-worker-entry.ts
+var parse_worker_entry_exports = {};
+module.exports = __toCommonJS(parse_worker_entry_exports);
+var import_node_worker_threads = require("node:worker_threads");
 
-// src/server/graph/index.ts
-var import_node_fs14 = require("node:fs");
-var import_node_path16 = require("node:path");
+// src/server/graph/core/config.ts
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+init_launch_kit_paths();
+function loadConfig(rootDir) {
+  const configPath = (0, import_node_path.join)(rootDir, LAUNCHCHART_CONFIG_FILE);
+  if (!(0, import_node_fs.existsSync)(configPath)) return {};
+  try {
+    return JSON.parse((0, import_node_fs.readFileSync)(configPath, "utf-8"));
+  } catch {
+    return {};
+  }
+}
 
 // src/server/graph/core/graph-builder.ts
-var import_node_fs11 = require("node:fs");
-var import_node_path12 = require("node:path");
-init_config();
+var import_node_fs13 = require("node:fs");
+var import_node_path14 = require("node:path");
+init_launch_kit_paths();
 
 // src/server/graph/core/parser-registry.ts
-var import_node_path11 = require("node:path");
+var import_node_path13 = require("node:path");
 
 // src/server/graph/parsers/ts/typescript-project.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path4 = require("node:path");
-init_config();
+var import_node_fs6 = require("node:fs");
+var import_node_path6 = require("node:path");
 
 // src/server/graph/core/resolve-paths.ts
+var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
+
+// src/server/graph/core/walk.ts
 var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
-function detectDbDir(rootDir, config) {
-  if (config.paths?.dbDir) return (0, import_node_path2.join)(rootDir, config.paths.dbDir);
-  const prismaDir = (0, import_node_path2.join)(rootDir, "prisma");
-  if ((0, import_node_fs2.existsSync)(prismaDir)) return prismaDir;
-  return null;
-}
-function resolveProjectPaths(rootDir, config) {
-  const dbDir = detectDbDir(rootDir, config);
-  if (config.paths?.appDir) {
-    const appDir = (0, import_node_path2.join)(rootDir, config.paths.appDir);
-    const srcDir = config.paths.srcDir ? (0, import_node_path2.join)(rootDir, config.paths.srcDir) : (0, import_node_path2.dirname)(appDir);
-    return { srcDir, appDir, apiDir: (0, import_node_path2.join)(appDir, "api"), dbDir };
-  }
-  const srcApp = (0, import_node_path2.join)(rootDir, "src", "app");
-  if ((0, import_node_fs2.existsSync)(srcApp)) {
-    return { srcDir: (0, import_node_path2.join)(rootDir, "src"), appDir: srcApp, apiDir: (0, import_node_path2.join)(srcApp, "api"), dbDir };
-  }
-  const rootApp = (0, import_node_path2.join)(rootDir, "app");
-  if ((0, import_node_fs2.existsSync)(rootApp)) {
-    return { srcDir: rootDir, appDir: rootApp, apiDir: (0, import_node_path2.join)(rootApp, "api"), dbDir };
-  }
-  return null;
-}
-
-// src/server/graph/parsers/ts/typescript-project.ts
-init_ts_extractor();
-var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
-var CLASSIFICATION_TO_LAYER = {
-  endpoint: "api",
-  page: "ui",
-  layout: "ui",
-  component: "ui",
-  ui: "ui",
-  hook: "ui",
-  context: "ui",
-  config: "ui",
-  lib: "ui",
-  "mcp-tool": "ui",
-  external: "ui"
-};
+var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "coverage"
+]);
 function walk(dir, exts) {
   const results = [];
-  if (!(0, import_node_fs4.existsSync)(dir)) return results;
-  for (const entry of (0, import_node_fs4.readdirSync)(dir, { withFileTypes: true })) {
-    const full = (0, import_node_path4.join)(dir, entry.name);
+  if (!(0, import_node_fs2.existsSync)(dir)) return results;
+  for (const entry of (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true })) {
+    const full = (0, import_node_path2.join)(dir, entry.name);
     if (entry.isDirectory()) {
       results.push(...walk(full, exts));
-    } else if (exts.includes((0, import_node_path4.extname)(entry.name))) {
+    } else if (exts.includes((0, import_node_path2.extname)(entry.name))) {
       results.push(full);
     }
   }
   return results;
 }
-function walkWithIgnore(dir, exts, ignoreDirs) {
+function walkWithIgnore(dir, exts, opts = {}) {
   const results = [];
-  if (!(0, import_node_fs4.existsSync)(dir)) return results;
-  for (const entry of (0, import_node_fs4.readdirSync)(dir, { withFileTypes: true })) {
+  if (!(0, import_node_fs2.existsSync)(dir)) return results;
+  const skip = opts.extraIgnore ? /* @__PURE__ */ new Set([...DEFAULT_IGNORE_DIRS, ...opts.extraIgnore]) : DEFAULT_IGNORE_DIRS;
+  for (const entry of (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      if (ignoreDirs.has(entry.name)) continue;
-      results.push(...walkWithIgnore((0, import_node_path4.join)(dir, entry.name), exts, ignoreDirs));
-    } else if (exts.includes((0, import_node_path4.extname)(entry.name))) {
-      results.push((0, import_node_path4.join)(dir, entry.name));
+      if (entry.name.startsWith(".")) continue;
+      if (skip.has(entry.name)) continue;
+      results.push(...walkWithIgnore((0, import_node_path2.join)(dir, entry.name), exts, opts));
+    } else if (exts.includes((0, import_node_path2.extname)(entry.name))) {
+      results.push((0, import_node_path2.join)(dir, entry.name));
     }
   }
   return results;
 }
-function toNodeId(srcDir, absPath) {
-  return (0, import_node_path4.relative)(srcDir, absPath).replace(/\\/g, "/");
+
+// src/server/graph/core/resolve-paths.ts
+function hasSqlFiles(dir) {
+  if (!(0, import_node_fs3.existsSync)(dir)) return false;
+  try {
+    return (0, import_node_fs3.readdirSync)(dir, { withFileTypes: true }).some(
+      (e) => e.isFile() && e.name.endsWith(".sql")
+    );
+  } catch {
+    return false;
+  }
 }
-function resolveImport(srcDir, specifier) {
-  if (!specifier.startsWith("@/")) return null;
-  const rel = specifier.slice(2);
-  const base = (0, import_node_path4.join)(srcDir, rel);
-  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path4.join)(base, "index.ts"), (0, import_node_path4.join)(base, "index.tsx")]) {
-    if ((0, import_node_fs4.existsSync)(c) && (0, import_node_fs4.statSync)(c).isFile()) return c;
+function hasNestedMigrationSql(dir) {
+  if (!(0, import_node_fs3.existsSync)(dir)) return false;
+  try {
+    return (0, import_node_fs3.readdirSync)(dir, { withFileTypes: true }).some(
+      (e) => e.isDirectory() && (0, import_node_fs3.existsSync)((0, import_node_path3.join)(dir, e.name, "migration.sql"))
+    );
+  } catch {
+    return false;
   }
-  return null;
 }
-function resolveRelativeImport(fromFile, specifier) {
-  const base = (0, import_node_path4.join)((0, import_node_path4.dirname)(fromFile), specifier);
-  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path4.join)(base, "index.ts"), (0, import_node_path4.join)(base, "index.tsx")]) {
-    if ((0, import_node_fs4.existsSync)(c) && (0, import_node_fs4.statSync)(c).isFile()) return c;
+function resolveDbFromDir(dir) {
+  if (!(0, import_node_fs3.existsSync)(dir)) return { kind: "none", schemaPath: null, migrationsDir: null };
+  const schemaPath = (0, import_node_path3.join)(dir, "schema.prisma");
+  if ((0, import_node_fs3.existsSync)(schemaPath)) {
+    const migrationsDir2 = (0, import_node_path3.join)(dir, "migrations");
+    return {
+      kind: "prisma",
+      schemaPath,
+      migrationsDir: (0, import_node_fs3.existsSync)(migrationsDir2) ? migrationsDir2 : null
+    };
   }
-  return null;
+  const migrationsDir = (0, import_node_path3.join)(dir, "migrations");
+  if (hasSqlFiles(migrationsDir) || hasNestedMigrationSql(migrationsDir)) {
+    return { kind: "sql-migrations", migrationsDir, schemaPath: null };
+  }
+  if (hasSqlFiles(dir) || hasNestedMigrationSql(dir)) {
+    return { kind: "sql-migrations", migrationsDir: dir, schemaPath: null };
+  }
+  return { kind: "none", schemaPath: null, migrationsDir: null };
 }
-function resolveBarrelMap(barrelAbsPath, parsedByPath, memo, visiting) {
-  const cached = memo.get(barrelAbsPath);
-  if (cached) return cached;
-  if (visiting.has(barrelAbsPath)) return /* @__PURE__ */ new Map();
-  visiting.add(barrelAbsPath);
-  const parsed = parsedByPath.get(barrelAbsPath);
-  const map = /* @__PURE__ */ new Map();
-  if (!parsed) {
-    visiting.delete(barrelAbsPath);
-    memo.set(barrelAbsPath, map);
-    return map;
+function detectDbConfig(rootDir, config) {
+  if (config.paths?.dbDir) {
+    return resolveDbFromDir((0, import_node_path3.join)(rootDir, config.paths.dbDir));
   }
-  for (const re of parsed.reExports) {
-    if (!re.from.startsWith(".")) continue;
-    const resolved = resolveRelativeImport(barrelAbsPath, re.from);
-    if (!resolved) continue;
-    if (re.isWildcard) {
-      const targetBn = (0, import_node_path4.basename)(resolved);
-      const targetIsBarrel = targetBn === "index.ts" || targetBn === "index.tsx";
-      if (targetIsBarrel) {
+  const candidates = ["prisma", "supabase", "drizzle", (0, import_node_path3.join)("db", "migrations"), "migrations"];
+  for (const c of candidates) {
+    const dir = (0, import_node_path3.join)(rootDir, c);
+    const resolved = resolveDbFromDir(dir);
+    if (resolved.kind !== "none") return resolved;
+  }
+  return { kind: "none", schemaPath: null, migrationsDir: null };
+}
+function detectDbDir(rootDir, config, dbConfig) {
+  if (config.paths?.dbDir) return (0, import_node_path3.join)(rootDir, config.paths.dbDir);
+  if (dbConfig.kind === "prisma") return (0, import_node_path3.dirname)(dbConfig.schemaPath);
+  if (dbConfig.kind === "sql-migrations") return dbConfig.migrationsDir;
+  return null;
+}
+var NON_SOURCE_DIRS = /* @__PURE__ */ new Set([
+  ...DEFAULT_IGNORE_DIRS,
+  // DB conventions (handled by db parsers)
+  "prisma",
+  "supabase",
+  "drizzle",
+  "migrations",
+  // Web assets
+  "public",
+  "static",
+  "assets",
+  // Docs
+  "docs",
+  "documentation",
+  // Test dirs (project tests aren't part of the structural graph)
+  "tests",
+  "__tests__",
+  "e2e",
+  "playwright",
+  "cypress",
+  // Monorepo workspace roots — separate graph projects per .launchchart.json
+  "packages",
+  "apps",
+  "services",
+  "libs"
+]);
+function dirHasTSFiles(dir) {
+  if (!(0, import_node_fs3.existsSync)(dir)) return false;
+  try {
+    const stack = [dir];
+    while (stack.length > 0) {
+      const cur = stack.pop();
+      const entries = (0, import_node_fs3.readdirSync)(cur, { withFileTypes: true });
+      for (const e of entries) {
+        if (e.isFile() && (e.name.endsWith(".ts") || e.name.endsWith(".tsx"))) return true;
+        if (e.isDirectory() && !e.name.startsWith(".") && !DEFAULT_IGNORE_DIRS.has(e.name)) {
+          stack.push((0, import_node_path3.join)(cur, e.name));
+        }
+      }
+    }
+  } catch {
+  }
+  return false;
+}
+function collectCodeBearingChildren(dir, extraSkip) {
+  if (!(0, import_node_fs3.existsSync)(dir)) return [];
+  const out = [];
+  try {
+    for (const entry of (0, import_node_fs3.readdirSync)(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name.startsWith(".")) continue;
+      if (NON_SOURCE_DIRS.has(entry.name)) continue;
+      if (extraSkip?.has(entry.name)) continue;
+      const full = (0, import_node_path3.join)(dir, entry.name);
+      if (dirHasTSFiles(full)) out.push(full);
+    }
+  } catch {
+  }
+  return out;
+}
+function detectSrcRoots(rootDir, srcDir, appDir, config) {
+  if (config.paths?.srcRoots && config.paths.srcRoots.length > 0) {
+    const roots2 = /* @__PURE__ */ new Set();
+    roots2.add(appDir);
+    for (const r of config.paths.srcRoots) {
+      const abs = (0, import_node_path3.isAbsolute)(r) ? r : (0, import_node_path3.resolve)(rootDir, r);
+      roots2.add(abs);
+    }
+    return [...roots2];
+  }
+  const roots = /* @__PURE__ */ new Set();
+  roots.add(appDir);
+  for (const c of collectCodeBearingChildren(srcDir)) roots.add(c);
+  if (srcDir !== rootDir) {
+    const skipSrcWrapper = /* @__PURE__ */ new Set([(0, import_node_path3.basename)(srcDir)]);
+    for (const c of collectCodeBearingChildren(rootDir, skipSrcWrapper)) roots.add(c);
+  }
+  return [...roots];
+}
+var CONVENTION_NAMES = ["middleware.ts", "middleware.tsx", "instrumentation.ts", "instrumentation.tsx"];
+function detectConventionFiles(rootDir, srcDir) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const dirs = srcDir === rootDir ? [rootDir] : [srcDir, rootDir];
+  for (const dir of dirs) {
+    for (const name of CONVENTION_NAMES) {
+      const full = (0, import_node_path3.join)(dir, name);
+      if (!seen.has(full) && (0, import_node_fs3.existsSync)(full)) {
+        try {
+          if ((0, import_node_fs3.statSync)(full).isFile()) {
+            seen.add(full);
+            out.push(full);
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  return out;
+}
+function resolveProjectPaths(rootDir, config) {
+  let srcDir;
+  let appDir;
+  if (config.paths?.appDir) {
+    appDir = (0, import_node_path3.join)(rootDir, config.paths.appDir);
+    srcDir = config.paths.srcDir ? (0, import_node_path3.join)(rootDir, config.paths.srcDir) : (0, import_node_path3.dirname)(appDir);
+  } else {
+    const srcApp = (0, import_node_path3.join)(rootDir, "src", "app");
+    const rootApp = (0, import_node_path3.join)(rootDir, "app");
+    if ((0, import_node_fs3.existsSync)(srcApp)) {
+      srcDir = (0, import_node_path3.join)(rootDir, "src");
+      appDir = srcApp;
+    } else if ((0, import_node_fs3.existsSync)(rootApp)) {
+      srcDir = rootDir;
+      appDir = rootApp;
+    } else {
+      return null;
+    }
+  }
+  const apiDir = (0, import_node_path3.join)(appDir, "api");
+  const dbConfig = detectDbConfig(rootDir, config);
+  const dbDir = detectDbDir(rootDir, config, dbConfig);
+  const srcRoots = detectSrcRoots(rootDir, srcDir, appDir, config);
+  const conventionFiles = detectConventionFiles(rootDir, srcDir);
+  return { srcDir, appDir, apiDir, dbDir, srcRoots, conventionFiles, dbConfig };
+}
+
+// src/server/graph/parsers/ts/typescript-project.ts
+init_ts_extractor();
+var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
+var CLASSIFICATION_TO_LAYER = {
+  endpoint: "api",
+  "server-action": "api",
+  page: "ui",
+  layout: "ui",
+  component: "ui",
+  ui: "ui",
+  hook: "ui",
+  context: "ui",
+  config: "ui",
+  lib: "ui",
+  "mcp-tool": "ui",
+  middleware: "ui",
+  external: "ui"
+};
+function toNodeId(srcDir, rootDir, absPath) {
+  const relFromSrc = (0, import_node_path6.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path6.relative)(rootDir, absPath).replace(/\\/g, "/");
+  }
+  return relFromSrc;
+}
+function resolveImport(srcDir, specifier) {
+  if (!specifier.startsWith("@/")) return null;
+  const rel = specifier.slice(2);
+  const base = (0, import_node_path6.join)(srcDir, rel);
+  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path6.join)(base, "index.ts"), (0, import_node_path6.join)(base, "index.tsx")]) {
+    if ((0, import_node_fs6.existsSync)(c) && (0, import_node_fs6.statSync)(c).isFile()) return c;
+  }
+  return null;
+}
+function resolveRelativeImport(fromFile, specifier) {
+  const base = (0, import_node_path6.join)((0, import_node_path6.dirname)(fromFile), specifier);
+  for (const c of [base, base + ".ts", base + ".tsx", (0, import_node_path6.join)(base, "index.ts"), (0, import_node_path6.join)(base, "index.tsx")]) {
+    if ((0, import_node_fs6.existsSync)(c) && (0, import_node_fs6.statSync)(c).isFile()) return c;
+  }
+  return null;
+}
+function resolveBarrelMap(barrelAbsPath, parsedByPath, memo, visiting) {
+  const cached = memo.get(barrelAbsPath);
+  if (cached) return cached;
+  if (visiting.has(barrelAbsPath)) return /* @__PURE__ */ new Map();
+  visiting.add(barrelAbsPath);
+  const parsed = parsedByPath.get(barrelAbsPath);
+  const map = /* @__PURE__ */ new Map();
+  if (!parsed) {
+    visiting.delete(barrelAbsPath);
+    memo.set(barrelAbsPath, map);
+    return map;
+  }
+  for (const re of parsed.reExports) {
+    if (!re.from.startsWith(".")) continue;
+    const resolved = resolveRelativeImport(barrelAbsPath, re.from);
+    if (!resolved) continue;
+    if (re.isWildcard) {
+      const targetBn = (0, import_node_path6.basename)(resolved);
+      const targetIsBarrel = targetBn === "index.ts" || targetBn === "index.tsx";
+      if (targetIsBarrel) {
         const nested = resolveBarrelMap(resolved, parsedByPath, memo, visiting);
         for (const [name, target] of nested) {
           if (!map.has(name)) map.set(name, target);
@@ -753,12 +1661,12 @@ function buildAllBarrelMaps(srcDir, parsedByPath) {
   const barrels = /* @__PURE__ */ new Map();
   const memo = /* @__PURE__ */ new Map();
   for (const [absPath, parsed] of parsedByPath) {
-    const bn = (0, import_node_path4.basename)(absPath);
+    const bn = (0, import_node_path6.basename)(absPath);
     if (bn !== "index.ts" && bn !== "index.tsx") continue;
     if (parsed.reExports.length === 0) continue;
     const map = resolveBarrelMap(absPath, parsedByPath, memo, /* @__PURE__ */ new Set());
     if (map.size > 0) {
-      const barrelId = (0, import_node_path4.relative)(srcDir, (0, import_node_path4.dirname)(absPath)).replace(/\\/g, "/");
+      const barrelId = (0, import_node_path6.relative)(srcDir, (0, import_node_path6.dirname)(absPath)).replace(/\\/g, "/");
       barrels.set(barrelId, map);
     }
   }
@@ -767,26 +1675,32 @@ function buildAllBarrelMaps(srcDir, parsedByPath) {
 function classifyType(absPath, id) {
   const contentType = classifyFile(absPath);
   if (contentType === "lib" && id.startsWith("server/mcp/")) return "mcp-tool";
+  if (/^app\/(.+\/)?page\.tsx$/.test(id)) return "page";
+  if (/^app\/(.+\/)?layout\.tsx$/.test(id)) return "layout";
   return contentType;
 }
 function extractRoute(id) {
   if (!id.endsWith("/page.tsx")) return null;
   let route = id.replace(/^app\//, "/").replace(/\/page\.tsx$/, "");
   route = route.replace(/\/\([^)]+\)/g, "");
+  route = route.replace(/\[\[\.\.\.([^\]]+)\]\]/g, "*$1?");
+  route = route.replace(/\[\.\.\.([^\]]+)\]/g, "*$1");
   route = route.replace(/\[([^\]]+)\]/g, ":$1");
   route = route.replace(/\/+/g, "/");
   if (!route.startsWith("/")) route = "/" + route;
   return route || "/";
 }
 function nameFromFilename(absPath) {
-  return (0, import_node_path4.basename)(absPath, (0, import_node_path4.extname)(absPath)).replace(/[-_](\w)/g, (_, c) => c.toUpperCase()).replace(/^(\w)/, (_, c) => c.toUpperCase());
+  return (0, import_node_path6.basename)(absPath, (0, import_node_path6.extname)(absPath)).replace(/[-_](\w)/g, (_, c) => c.toUpperCase()).replace(/^(\w)/, (_, c) => c.toUpperCase());
 }
-function filePathToApiRoute(apiDir, absPath) {
-  let route = "/" + (0, import_node_path4.relative)(apiDir, absPath).replace(/\\/g, "/").replace(/\/route\.tsx?$/, "");
+function filePathToAppRoute(appDir, absPath) {
+  let route = ("/" + (0, import_node_path6.relative)(appDir, absPath).replace(/\\/g, "/")).replace(/\/route\.tsx?$/, "");
+  route = route.replace(/\/\([^)]+\)/g, "");
+  route = route.replace(/\[\[\.\.\.([^\]]+)\]\]/g, "*$1?");
+  route = route.replace(/\[\.\.\.([^\]]+)\]/g, "*$1");
   route = route.replace(/\[([^\]]+)\]/g, ":$1");
   route = route.replace(/\/+/g, "/");
-  if (route === "/") return "/api";
-  return "/api" + route;
+  return route === "" ? "/" : route;
 }
 function camelToPascal(s) {
   if (!s) return s;
@@ -831,25 +1745,52 @@ function resolveTemplateLiteralRoute(template, routeToNodeId) {
 function routeMatchScore(candidate, known) {
   const segsA = candidate.split("/");
   const segsB = known.split("/");
-  if (segsA.length !== segsB.length) return -1;
   let score = 0;
-  for (let i = 0; i < segsA.length; i++) {
-    const a = segsA[i], b = segsB[i];
+  let i = 0, j = 0;
+  while (i < segsA.length && j < segsB.length) {
+    const a = segsA[i], b = segsB[j];
+    if (b.startsWith("*") && b.endsWith("?")) {
+      score += 1;
+      return score;
+    }
+    if (b.startsWith("*")) {
+      const remaining = segsA.length - i;
+      if (remaining < 1) return -1;
+      score += 1 + remaining;
+      return score;
+    }
     if (a === b) {
       score += 3;
+      i++;
+      j++;
       continue;
     }
     if (a.startsWith(":") && b.startsWith(":")) {
       score += 2;
+      i++;
+      j++;
       continue;
     }
     if (a.startsWith(":") || b.startsWith(":")) {
-      score += 0;
+      i++;
+      j++;
       continue;
     }
     return -1;
   }
-  return score;
+  if (i === segsA.length) {
+    while (j < segsB.length) {
+      const b = segsB[j];
+      if (b.startsWith("*") && b.endsWith("?")) {
+        score += 1;
+        j++;
+        continue;
+      }
+      return -1;
+    }
+    return score;
+  }
+  return -1;
 }
 function templateToRoute(template) {
   return template.replace(/\$\{([^}]+)\}/g, (_, expr) => {
@@ -871,7 +1812,7 @@ function matchRouteToPage(route, routeToNodeId) {
   if (routeToNodeId.has(normalized)) return routeToNodeId.get(normalized);
   return null;
 }
-function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, barrelMaps, routeToNodeId) {
+function extractEdges(srcDir, rootDir, absPath, sourceId, parsed, nodeIdSet, barrelMaps, routeToNodeId) {
   const edges = [];
   const flagged = [];
   const seen = /* @__PURE__ */ new Set();
@@ -884,7 +1825,7 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, barrelMaps,
     edges.push(edge);
   }
   function edgeTypeFor(isTypeOnlyImport, importedNames) {
-    if (isTypeOnlyImport) return "imports";
+    if (isTypeOnlyImport) return "imports_type";
     const anyRendered = importedNames.some((n) => parsed.jsxElements.has(n));
     if (anyRendered) return "renders";
     return "imports";
@@ -899,7 +1840,7 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, barrelMaps,
         for (const name of names) {
           const targetAbs = barrelMap.get(name);
           if (targetAbs) {
-            const targetId = toNodeId(srcDir, targetAbs);
+            const targetId = toNodeId(srcDir, rootDir, targetAbs);
             if (nodeIdSet.has(targetId)) {
               if (!byTarget.has(targetId)) byTarget.set(targetId, []);
               byTarget.get(targetId).push(name);
@@ -913,18 +1854,20 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, barrelMaps,
       } else {
         const resolved = resolveImport(srcDir, specifier);
         if (resolved) {
-          const targetId = toNodeId(srcDir, resolved);
+          const targetId = toNodeId(srcDir, rootDir, resolved);
           if (nodeIdSet.has(targetId) && !targetId.endsWith("/index.ts") && !targetId.endsWith("/index.tsx")) {
-            addEdge(targetId, edgeTypeFor(isTypeOnly, names));
+            const allType = isTypeOnly || names.length > 0 && names.every((n) => typeNames.has(n));
+            addEdge(targetId, edgeTypeFor(allType, names));
           }
         }
       }
     } else if (specifier.startsWith(".")) {
       const resolved = resolveRelativeImport(absPath, specifier);
       if (resolved) {
-        const targetId = toNodeId(srcDir, resolved);
+        const targetId = toNodeId(srcDir, rootDir, resolved);
         if (nodeIdSet.has(targetId) && !targetId.endsWith("/index.ts") && !targetId.endsWith("/index.tsx")) {
-          addEdge(targetId, edgeTypeFor(isTypeOnly, names));
+          const allType = isTypeOnly || names.length > 0 && names.every((n) => typeNames.has(n));
+          addEdge(targetId, edgeTypeFor(allType, names));
         }
       }
     }
@@ -966,24 +1909,30 @@ function extractEdges(srcDir, absPath, sourceId, parsed, nodeIdSet, barrelMaps,
   }
   return { edges, flagged };
 }
-function hasNextConfig(rootDir) {
-  return (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.ts")) || (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.js")) || (0, import_node_fs4.existsSync)((0, import_node_path4.join)(rootDir, "next.config.mjs"));
-}
 function detect(rootDir) {
   const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
-  return paths !== null && hasNextConfig(rootDir);
+  return paths !== null;
 }
 function generate(rootDir) {
   const config = loadConfig(rootDir);
   const paths = resolveProjectPaths(rootDir, config);
   const srcDir = paths.srcDir;
-  const apiDir = paths.apiDir;
-  const appFiles = walk(paths.appDir, [".tsx", ".ts"]);
-  const clientFiles = walk((0, import_node_path4.join)(srcDir, "client"), [".tsx", ".ts"]);
-  const serverFiles = walk((0, import_node_path4.join)(srcDir, "server"), [".ts", ".tsx"]);
-  const libFiles = walk((0, import_node_path4.join)(srcDir, "lib"), [".ts", ".tsx"]);
-  const configFiles = walk((0, import_node_path4.join)(srcDir, "config"), [".ts", ".tsx"]);
-  const allDiscovered = [...appFiles, ...clientFiles, ...serverFiles, ...libFiles, ...configFiles];
+  const allDiscovered = [];
+  const discoveredSet = /* @__PURE__ */ new Set();
+  for (const root of paths.srcRoots) {
+    for (const f of walk(root, [".tsx", ".ts"])) {
+      if (!discoveredSet.has(f)) {
+        discoveredSet.add(f);
+        allDiscovered.push(f);
+      }
+    }
+  }
+  for (const conv of paths.conventionFiles) {
+    if (!discoveredSet.has(conv)) {
+      discoveredSet.add(conv);
+      allDiscovered.push(conv);
+    }
+  }
   const parsedByPath = /* @__PURE__ */ new Map();
   for (const absPath of allDiscovered) {
     parsedByPath.set(absPath, parseFileTS(absPath));
@@ -993,9 +1942,9 @@ function generate(rootDir) {
   const apiNodes = [];
   const nodeIdSet = /* @__PURE__ */ new Set();
   const routeToNodeId = /* @__PURE__ */ new Map();
-  const fileSet = allDiscovered.filter((f) => !(0, import_node_path4.basename)(f).startsWith("index."));
+  const fileSet = allDiscovered.filter((f) => !(0, import_node_path6.basename)(f).startsWith("index."));
   for (const absPath of fileSet) {
-    const id = toNodeId(srcDir, absPath);
+    const id = toNodeId(srcDir, rootDir, absPath);
     const type = classifyType(absPath, id);
     if (type === "test" || type === "story") continue;
     const parsed = parsedByPath.get(absPath);
@@ -1003,26 +1952,34 @@ function generate(rootDir) {
     const layer = CLASSIFICATION_TO_LAYER[type] ?? "ui";
     nodeIdSet.add(id);
     if (layer === "api") {
-      const methods = [];
-      for (const exp of parsed.exports) {
-        if (HTTP_METHODS.has(exp)) methods.push(exp);
-      }
       const dbCalls = extractDbCallsTS(absPath);
       const authWrappers = extractAuthWrappersTS(absPath);
       const deep = extractDeep(absPath);
-      const routePath = (0, import_node_fs4.existsSync)(apiDir) ? filePathToApiRoute(apiDir, absPath) : `/api/${id.replace(/\/route\.tsx?$/, "")}`;
       const mutations = dbCalls.filter((c) => c.isMutation);
       const mutates = mutations.length > 0;
       const authStrategy = [...authWrappers];
+      const isServerAction = type === "server-action";
+      const methods = [];
+      if (!isServerAction) {
+        for (const exp of parsed.exports) {
+          if (HTTP_METHODS.has(exp)) methods.push(exp);
+        }
+      }
+      const routePath = isServerAction ? null : filePathToAppRoute(paths.appDir, absPath);
+      const actions = isServerAction ? parsed.exports.filter((e) => !HTTP_METHODS.has(e)) : [];
       apiNodes.push({
         id,
-        type: "endpoint",
-        name: routePath,
+        type: isServerAction ? "server-action" : "endpoint",
+        // For HTTP routes: name = URL path. For Server Actions: name = file id +
+        // exported action names — the callable surface, not a URL.
+        name: isServerAction ? actions.length > 0 ? `${id} (${actions.join(", ")})` : id : routePath,
         layer: "api",
         path: routePath,
+        // null for Server Actions
         methods,
         handler: id,
         mutates,
+        ...isServerAction ? { actions } : {},
         auth: authStrategy.length > 0 ? authStrategy : ["public"],
         db_models: [...new Set(dbCalls.map((c) => c.model))],
         db_operations: [...new Set(dbCalls.map((c) => `${c.model}.${c.method}`))],
@@ -1030,12 +1987,15 @@ function generate(rootDir) {
         variables: deep.variables,
         responses: deep.responses,
         params: deep.params,
+        ...deep.effects ? { effects: deep.effects } : {},
         _dbCalls: dbCalls
         // temp: used for cross-ref building below
       });
     } else {
       const route = extractRoute(id);
       const deep = extractDeep(absPath);
+      const dbCalls = extractDbCallsTS(absPath);
+      const authWrappers = type === "page" || type === "layout" ? [...extractAuthWrappersTS(absPath)] : [];
       uiNodes.push({
         id,
         type,
@@ -1046,19 +2006,29 @@ function generate(rootDir) {
         elements: deep.elements,
         stateVars: deep.stateVars,
         conditions: deep.conditions,
-        variables: deep.variables
+        variables: deep.variables,
+        ...deep.effects ? { effects: deep.effects } : {},
+        ...authWrappers.length > 0 ? { auth: authWrappers } : {},
+        ...dbCalls.length > 0 ? { _dbCalls: dbCalls } : {}
       });
-      if (route) routeToNodeId.set(route, id);
+      if (route) {
+        routeToNodeId.set(route, id);
+        const trimmed = route.replace(/\/\*[^/]+\?$/, "");
+        if (trimmed && trimmed !== route && !routeToNodeId.has(trimmed)) {
+          routeToNodeId.set(trimmed, id);
+        }
+      }
     }
   }
   const uiEdges = [];
   const uiFlagged = [];
   for (const absPath of fileSet) {
-    const id = toNodeId(srcDir, absPath);
+    const id = toNodeId(srcDir, rootDir, absPath);
     if (!nodeIdSet.has(id)) continue;
     const parsed = parsedByPath.get(absPath);
     const { edges, flagged } = extractEdges(
       srcDir,
+      rootDir,
       absPath,
       id,
       parsed,
@@ -1069,9 +2039,32 @@ function generate(rootDir) {
     uiEdges.push(...edges);
     uiFlagged.push(...flagged);
   }
+  const layoutsById = /* @__PURE__ */ new Set();
+  for (const n of uiNodes) {
+    if (n.type === "layout") layoutsById.add(n.id);
+  }
+  function findClosestLayout(pageId) {
+    let dir = pageId.replace(/\/page\.tsx$/, "");
+    while (dir.length > 0) {
+      const candidate = `${dir}/layout.tsx`;
+      if (layoutsById.has(candidate)) return candidate;
+      const slash = dir.lastIndexOf("/");
+      if (slash < 0) break;
+      dir = dir.slice(0, slash);
+    }
+    if (layoutsById.has("app/layout.tsx")) return "app/layout.tsx";
+    return null;
+  }
+  for (const n of uiNodes) {
+    if (n.type !== "page") continue;
+    const layoutId = findClosestLayout(n.id);
+    if (layoutId && layoutId !== n.id) {
+      uiEdges.push({ source: layoutId, target: n.id, type: "wraps" });
+    }
+  }
   const fetchCallEntries = [];
   for (const absPath of fileSet) {
-    const sourceId = toNodeId(srcDir, absPath);
+    const sourceId = toNodeId(srcDir, rootDir, absPath);
     if (!nodeIdSet.has(sourceId)) continue;
     const parsed = parsedByPath.get(absPath);
     if (parsed.fetchCalls.length === 0) continue;
@@ -1087,20 +2080,7 @@ function generate(rootDir) {
     });
   }
   const externalScanned = new Set(allDiscovered.map((f) => f.replace(/\\/g, "/")));
-  const IGNORE_DIRS = /* @__PURE__ */ new Set([
-    "node_modules",
-    ".next",
-    "dist",
-    ".launchsecure",
-    ".git",
-    "src",
-    "coverage",
-    ".turbo",
-    "build",
-    "out",
-    ".vercel"
-  ]);
-  const externalCandidates = walkWithIgnore(rootDir, [".ts", ".tsx"], IGNORE_DIRS);
+  const externalCandidates = walkWithIgnore(rootDir, [".ts", ".tsx"], { extraIgnore: /* @__PURE__ */ new Set(["src"]) });
   for (const absPath of externalCandidates) {
     const normalized = absPath.replace(/\\/g, "/");
     if (externalScanned.has(normalized)) continue;
@@ -1110,7 +2090,7 @@ function generate(rootDir) {
     } catch {
       continue;
     }
-    const externalId = (0, import_node_path4.relative)(rootDir, absPath).replace(/\\/g, "/");
+    const externalId = (0, import_node_path6.relative)(rootDir, absPath).replace(/\\/g, "/");
     const edgesFromThis = [];
     const seen = /* @__PURE__ */ new Set();
     for (const imp of parsed.imports) {
@@ -1123,7 +2103,7 @@ function generate(rootDir) {
           for (const name of names) {
             const targetAbs = barrelMap.get(name);
             if (!targetAbs) continue;
-            const targetId2 = toNodeId(srcDir, targetAbs);
+            const targetId2 = toNodeId(srcDir, rootDir, targetAbs);
             if (!nodeIdSet.has(targetId2)) continue;
             const key2 = `${externalId}\u2192${targetId2}`;
             if (seen.has(key2)) continue;
@@ -1137,7 +2117,7 @@ function generate(rootDir) {
         resolved = resolveRelativeImport(absPath, specifier);
       }
       if (!resolved) continue;
-      const targetId = toNodeId(srcDir, resolved);
+      const targetId = toNodeId(srcDir, rootDir, resolved);
       if (!nodeIdSet.has(targetId)) continue;
       if (targetId.endsWith("/index.ts") || targetId.endsWith("/index.tsx")) continue;
       const key = `${externalId}\u2192${targetId}`;
@@ -1157,23 +2137,169 @@ function generate(rootDir) {
     nodeIdSet.add(externalId);
     uiEdges.push(...edgesFromThis);
   }
+  const tablesByFile = /* @__PURE__ */ new Map();
+  const allDbNodes = [...apiNodes, ...uiNodes];
+  for (const node of allDbNodes) {
+    const calls = node._dbCalls;
+    if (!calls || calls.length === 0) continue;
+    const map = /* @__PURE__ */ new Map();
+    for (const c of calls) {
+      const key = `${c.kind}:${c.model}:${c.isMutation ? "m" : "r"}`;
+      if (!map.has(key)) {
+        map.set(key, { model: c.model, method: c.method, isMutation: c.isMutation, kind: c.kind, via: [] });
+      }
+    }
+    tablesByFile.set(node.id, map);
+  }
+  const reverseRuntimeImports = /* @__PURE__ */ new Map();
+  for (const edge of uiEdges) {
+    if (edge.type !== "imports" && edge.type !== "renders") continue;
+    if (!reverseRuntimeImports.has(edge.target)) {
+      reverseRuntimeImports.set(edge.target, /* @__PURE__ */ new Set());
+    }
+    reverseRuntimeImports.get(edge.target).add(edge.source);
+  }
+  let changed = true;
+  let iterations = 0;
+  while (changed && iterations < 50) {
+    changed = false;
+    iterations++;
+    for (const [target, tableMap] of [...tablesByFile]) {
+      const importers = reverseRuntimeImports.get(target);
+      if (!importers) continue;
+      for (const importer of importers) {
+        if (importer === target) continue;
+        let importerMap = tablesByFile.get(importer);
+        if (!importerMap) {
+          importerMap = /* @__PURE__ */ new Map();
+          tablesByFile.set(importer, importerMap);
+        }
+        for (const [key, call] of tableMap) {
+          if (importerMap.has(key)) continue;
+          importerMap.set(key, {
+            model: call.model,
+            method: null,
+            isMutation: call.isMutation,
+            kind: call.kind,
+            via: [...call.via, target]
+          });
+          changed = true;
+        }
+      }
+    }
+  }
+  for (const node of apiNodes) {
+    const map = tablesByFile.get(node.id);
+    if (!map) continue;
+    node.db_models = [...new Set([...map.values()].map((c) => c.model))];
+    node.db_operations = [...new Set(
+      [...map.values()].filter((c) => c.via.length === 0 && c.method).map((c) => `${c.model}.${c.method}`)
+    )];
+    node.mutates = [...map.values()].some((c) => c.isMutation);
+  }
   const apiCrossRefs = [];
   for (const node of apiNodes) {
-    const dbCalls = node._dbCalls;
-    if (!dbCalls) continue;
-    const seenModels = /* @__PURE__ */ new Set();
-    for (const call of dbCalls) {
-      if (seenModels.has(call.model)) continue;
-      seenModels.add(call.model);
-      apiCrossRefs.push({
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
+      const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
         source: node.id,
-        target: camelToPascal(call.model),
-        type: call.isMutation ? "mutates" : "reads",
+        target,
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
         layer: "db"
-      });
+      };
+      if (isTransitive) ref.via = call.via;
+      apiCrossRefs.push(ref);
     }
     delete node._dbCalls;
   }
+  const uiCrossRefs = [];
+  for (const node of uiNodes) {
+    const map = tablesByFile.get(node.id);
+    if (!map) {
+      if (node._dbCalls) delete node._dbCalls;
+      continue;
+    }
+    const seenTargets = /* @__PURE__ */ new Set();
+    for (const call of map.values()) {
+      const target = call.kind === "sql" ? call.model : camelToPascal(call.model);
+      if (seenTargets.has(target)) continue;
+      seenTargets.add(target);
+      const isTransitive = call.via.length > 0;
+      const ref = {
+        source: node.id,
+        target,
+        type: call.isMutation ? isTransitive ? "mutates_via" : "mutates" : isTransitive ? "reads_via" : "reads",
+        layer: "db"
+      };
+      if (isTransitive) ref.via = call.via;
+      uiCrossRefs.push(ref);
+    }
+    if (node._dbCalls) delete node._dbCalls;
+  }
+  uiCrossRefs.sort((a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target));
+  const middlewareInfos = [];
+  for (const conv of paths.conventionFiles) {
+    if (!/middleware\.tsx?$/.test(conv)) continue;
+    try {
+      const info = extractMiddlewareAuthTS(conv);
+      if (info && info.matchers.length > 0) middlewareInfos.push(info);
+    } catch {
+    }
+  }
+  if (middlewareInfos.length > 0) {
+    let setAuth2 = function(node, newTags, replaceAll) {
+      const existing = node.auth ?? [];
+      const meaningful = existing.filter((a) => a !== "public");
+      const merged = replaceAll ? newTags : [.../* @__PURE__ */ new Set([...newTags, ...meaningful])];
+      node.auth = merged.length > 0 ? merged : ["public"];
+    }, applyMiddleware2 = function(node, routePath) {
+      let resolved = null;
+      let label = "";
+      let hasAnyExemptMatcher = false;
+      let hasAnyFallthrough = false;
+      for (const info of middlewareInfos) {
+        if (info.hasFallthroughProtect) hasAnyFallthrough = true;
+        if (info.matchers.some((m) => m.intent === "exempt")) hasAnyExemptMatcher = true;
+        const c = classifyRouteAgainstMiddleware(routePath, info);
+        if (!c) continue;
+        if (!resolved) {
+          resolved = c.intent;
+          label = c.matcher;
+        }
+      }
+      if (resolved === "exempt") {
+        setAuth2(node, ["public"], true);
+        return;
+      }
+      if (resolved === "protect") {
+        setAuth2(node, [`middleware:${label}`], false);
+        return;
+      }
+      if (hasAnyExemptMatcher && hasAnyFallthrough) {
+        setAuth2(node, ["middleware-protected"], false);
+      }
+    };
+    var setAuth = setAuth2, applyMiddleware = applyMiddleware2;
+    for (const node of apiNodes) {
+      const routePath = node.path;
+      if (!routePath) continue;
+      applyMiddleware2(node, routePath);
+    }
+    for (const node of uiNodes) {
+      const route = node.route;
+      if (!route) continue;
+      applyMiddleware2(node, route);
+    }
+  }
   const apiNodeIds = new Set(apiNodes.map((n) => n.id));
   const apiEdges = [];
   const uiOnlyEdges = [];
@@ -1235,7 +2361,7 @@ function generate(rootDir) {
     },
     nodes: stripLayer(uiNodes),
     edges: uiOnlyEdges,
-    cross_refs: [],
+    cross_refs: uiCrossRefs,
     contradictions: [],
     warnings: [],
     flagged_edges: dedupedFlagged,
@@ -1314,8 +2440,7 @@ var typescriptProjectParser = {
 };
 
 // src/server/graph/parsers/db/prisma-schema.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path5 = require("node:path");
+var import_node_fs7 = require("node:fs");
 function parseModels(content) {
   const nodes = [];
   const relations = [];
@@ -1406,11 +2531,25 @@ function parseEnums(content) {
   return nodes;
 }
 function detect2(rootDir) {
-  return (0, import_node_fs5.existsSync)((0, import_node_path5.join)(rootDir, "prisma", "schema.prisma"));
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  return paths?.dbConfig.kind === "prisma" && (0, import_node_fs7.existsSync)(paths.dbConfig.schemaPath);
 }
 function generate2(rootDir) {
-  const schemaPath = (0, import_node_path5.join)(rootDir, "prisma", "schema.prisma");
-  const content = (0, import_node_fs5.readFileSync)(schemaPath, "utf-8");
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  if (paths.dbConfig.kind !== "prisma") {
+    return {
+      metadata: { generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), layer: "db", source: "none" },
+      nodes: [],
+      edges: [],
+      cross_refs: [],
+      contradictions: [],
+      warnings: [],
+      flagged_edges: [],
+      patterns: { total_tables: 0, total_enums: 0, total_relations: 0 }
+    };
+  }
+  const schemaPath = paths.dbConfig.schemaPath;
+  const content = (0, import_node_fs7.readFileSync)(schemaPath, "utf-8");
   const { nodes: modelNodes, relations } = parseModels(content);
   const enumNodes = parseEnums(content);
   const allNodes = [...modelNodes, ...enumNodes];
@@ -1430,7 +2569,7 @@ function generate2(rootDir) {
     metadata: {
       generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
       scope: "prisma-schema",
-      source: "prisma/schema.prisma",
+      source: schemaPath,
       provider: "postgresql",
       layer: "db",
       total_models: modelNodes.length,
@@ -1467,8 +2606,8 @@ var prismaSchemaParser = {
 };
 
 // src/server/graph/parsers/db/sql-migrations.ts
-var import_node_fs6 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_fs8 = require("node:fs");
+var import_node_path7 = require("node:path");
 var PG_TO_PRISMA = {
   "TEXT": "String",
   "VARCHAR": "String",
@@ -1499,51 +2638,149 @@ function pgTypeToPrisma(pgType) {
   const upper = pgType.toUpperCase().trim();
   return PG_TO_PRISMA[upper] ?? upper;
 }
+var ID = `(?:"[\\w$]+"|[\\w$]+)`;
+var QID = `(?:${ID}\\.)?${ID}`;
+function bareName(captured) {
+  const parts = captured.split(".");
+  const last = parts[parts.length - 1];
+  return last.replace(/^"(.*)"$/, "$1").trim();
+}
 function parseCreateTable(sql, state) {
-  const re = /CREATE\s+TABLE\s+"(\w+)"\s*\(([\s\S]*?)\);/gi;
+  const re = new RegExp(
+    `CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(${QID})\\s*\\(([\\s\\S]*?)\\);`,
+    "gi"
+  );
   let m;
   while ((m = re.exec(sql)) !== null) {
-    const tableName = m[1];
+    const tableName = bareName(m[1]);
     const body = m[2];
     const columns = /* @__PURE__ */ new Map();
     let primaryCol = null;
-    for (const line of body.split("\n")) {
-      const trimmed = line.trim().replace(/,\s*$/, "");
+    const inlineFks = [];
+    const lines = splitTopLevelCommas(body);
+    for (const raw of lines) {
+      const trimmed = raw.trim().replace(/,\s*$/, "");
       if (!trimmed || trimmed.startsWith("--")) continue;
-      const pkMatch = trimmed.match(/CONSTRAINT\s+"[^"]+"\s+PRIMARY\s+KEY\s*\("(\w+)"\)/i);
-      if (pkMatch) {
-        primaryCol = pkMatch[1];
+      const namedPk = trimmed.match(new RegExp(`^CONSTRAINT\\s+${ID}\\s+PRIMARY\\s+KEY\\s*\\(\\s*(${QID})`, "i"));
+      if (namedPk) {
+        primaryCol = bareName(namedPk[1]);
+        continue;
+      }
+      const tablePk = trimmed.match(new RegExp(`^PRIMARY\\s+KEY\\s*\\(\\s*(${QID})`, "i"));
+      if (tablePk) {
+        primaryCol = bareName(tablePk[1]);
+        continue;
+      }
+      if (/^UNIQUE\s*\(/i.test(trimmed)) continue;
+      const namedFk = trimmed.match(new RegExp(
+        `^CONSTRAINT\\s+(${ID})\\s+FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
+        "i"
+      ));
+      if (namedFk) {
+        inlineFks.push({
+          constraintName: bareName(namedFk[1]),
+          sourceTable: tableName,
+          sourceColumn: bareName(namedFk[2]),
+          targetTable: bareName(namedFk[3]),
+          targetColumn: bareName(namedFk[4]),
+          onDelete: namedFk[5] ?? null
+        });
+        continue;
+      }
+      const bareFk = trimmed.match(new RegExp(
+        `^FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
+        "i"
+      ));
+      if (bareFk) {
+        inlineFks.push({
+          constraintName: `${tableName}_${bareName(bareFk[1])}_fkey`,
+          sourceTable: tableName,
+          sourceColumn: bareName(bareFk[1]),
+          targetTable: bareName(bareFk[2]),
+          targetColumn: bareName(bareFk[3]),
+          onDelete: bareFk[4] ?? null
+        });
         continue;
       }
-      if (/^\s*CONSTRAINT\s/i.test(trimmed)) continue;
-      const colMatch = trimmed.match(/^"(\w+)"\s+(.+)/);
+      if (/^CONSTRAINT\s/i.test(trimmed)) continue;
+      const colMatch = trimmed.match(new RegExp(`^(${ID})\\s+(.+)`, "i"));
       if (!colMatch) continue;
-      const colName = colMatch[1];
+      const colName = bareName(colMatch[1]);
       let rest = colMatch[2];
+      const inlineRefMatch = rest.match(new RegExp(
+        `\\bREFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
+        "i"
+      ));
+      if (inlineRefMatch) {
+        inlineFks.push({
+          constraintName: `${tableName}_${colName}_fkey`,
+          sourceTable: tableName,
+          sourceColumn: colName,
+          targetTable: bareName(inlineRefMatch[1]),
+          targetColumn: bareName(inlineRefMatch[2]),
+          onDelete: inlineRefMatch[3] ?? null
+        });
+        rest = rest.replace(inlineRefMatch[0], "").trim();
+      }
       const isNotNull = /\bNOT\s+NULL\b/i.test(rest);
+      const isPrimaryKey = /\bPRIMARY\s+KEY\b/i.test(rest);
+      const isUnique = /\bUNIQUE\b/i.test(rest);
       const defaultMatch = rest.match(/\bDEFAULT\s+(.+?)(?:\s*,?\s*$)/i);
       const defaultVal = defaultMatch ? defaultMatch[1].trim() : null;
-      let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim().replace(/,\s*$/, "").trim();
+      let colType = rest.replace(/\bNOT\s+NULL\b/gi, "").replace(/\bPRIMARY\s+KEY\b/gi, "").replace(/\bUNIQUE\b/gi, "").replace(/\bDEFAULT\s+.*/gi, "").trim().replace(/,\s*$/, "").trim();
       columns.set(colName, {
         name: colName,
         type: colType,
-        nullable: !isNotNull,
-        primary: false,
-        unique: false,
+        nullable: !isNotNull && !isPrimaryKey,
+        primary: isPrimaryKey,
+        unique: isUnique,
         default: defaultVal
       });
+      if (isPrimaryKey) primaryCol = colName;
     }
     if (primaryCol && columns.has(primaryCol)) {
       columns.get(primaryCol).primary = true;
     }
     state.tables.set(tableName, { name: tableName, columns });
+    state.fks.push(...inlineFks);
+  }
+}
+function splitTopLevelCommas(body) {
+  const out = [];
+  let depth = 0;
+  let buf = "";
+  let inString = null;
+  for (const ch of body) {
+    if (inString) {
+      buf += ch;
+      if (ch === inString) inString = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      inString = ch;
+      buf += ch;
+      continue;
+    }
+    if (ch === "(") depth++;
+    else if (ch === ")") depth--;
+    if (ch === "," && depth === 0) {
+      out.push(buf);
+      buf = "";
+      continue;
+    }
+    buf += ch;
   }
+  if (buf.trim()) out.push(buf);
+  return out;
 }
 function parseCreateEnum(sql, state) {
-  const re = /CREATE\s+TYPE\s+"(\w+)"\s+AS\s+ENUM\s*\(([^)]+)\)/gi;
+  const re = new RegExp(
+    `CREATE\\s+TYPE\\s+(${QID})\\s+AS\\s+ENUM\\s*\\(([^)]+)\\)`,
+    "gi"
+  );
   let m;
   while ((m = re.exec(sql)) !== null) {
-    const enumName = m[1];
+    const enumName = bareName(m[1]);
     const valuesStr = m[2];
     const values = new Set(
       valuesStr.split(",").map((v) => v.trim().replace(/^'(.*)'$/, "$1")).filter(Boolean)
@@ -1552,11 +2789,14 @@ function parseCreateEnum(sql, state) {
   }
 }
 function parseAlterTable(sql, state) {
-  const addColRe = /ALTER\s+TABLE\s+"(\w+)"\s+ADD\s+COLUMN\s+"(\w+)"\s+(.+?);/gi;
+  const addColRe = new RegExp(
+    `ALTER\\s+TABLE\\s+(${QID})\\s+ADD\\s+COLUMN\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(${QID})\\s+(.+?);`,
+    "gi"
+  );
   let m;
   while ((m = addColRe.exec(sql)) !== null) {
-    const tableName = m[1];
-    const colName = m[2];
+    const tableName = bareName(m[1]);
+    const colName = bareName(m[2]);
     let rest = m[3];
     const table = state.tables.get(tableName);
     if (!table) continue;
@@ -1573,64 +2813,92 @@ function parseAlterTable(sql, state) {
       default: defaultVal
     });
   }
-  const dropColRe = /ALTER\s+TABLE\s+"(\w+)"\s+DROP\s+COLUMN\s+"(\w+)"/gi;
+  const dropColRe = new RegExp(
+    `ALTER\\s+TABLE\\s+(${QID})\\s+DROP\\s+COLUMN\\s+(?:IF\\s+EXISTS\\s+)?(${QID})`,
+    "gi"
+  );
   while ((m = dropColRe.exec(sql)) !== null) {
-    const table = state.tables.get(m[1]);
-    if (table) table.columns.delete(m[2]);
+    const table = state.tables.get(bareName(m[1]));
+    if (table) table.columns.delete(bareName(m[2]));
   }
-  const fkRe = /ALTER\s+TABLE\s+"(\w+)"\s+ADD\s+CONSTRAINT\s+"([^"]+)"\s+FOREIGN\s+KEY\s*\("(\w+)"\)\s+REFERENCES\s+"(\w+)"\("(\w+)"\)(?:\s+ON\s+DELETE\s+(\w+(?:\s+\w+)?))?/gi;
+  const fkRe = new RegExp(
+    `ALTER\\s+TABLE\\s+(${QID})\\s+ADD\\s+CONSTRAINT\\s+(${ID})\\s+FOREIGN\\s+KEY\\s*\\(\\s*(${QID})\\s*\\)\\s+REFERENCES\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)(?:\\s+ON\\s+DELETE\\s+(\\w+(?:\\s+\\w+)?))?`,
+    "gi"
+  );
   while ((m = fkRe.exec(sql)) !== null) {
     state.fks.push({
-      constraintName: m[2],
-      sourceTable: m[1],
-      sourceColumn: m[3],
-      targetTable: m[4],
-      targetColumn: m[5],
+      constraintName: bareName(m[2]),
+      sourceTable: bareName(m[1]),
+      sourceColumn: bareName(m[3]),
+      targetTable: bareName(m[4]),
+      targetColumn: bareName(m[5]),
       onDelete: m[6] ?? null
     });
   }
 }
 function parseAlterEnum(sql, state) {
-  const re = /ALTER\s+TYPE\s+"(\w+)"\s+ADD\s+VALUE\s+'([^']+)'/gi;
+  const re = new RegExp(
+    `ALTER\\s+TYPE\\s+(${QID})\\s+ADD\\s+VALUE\\s+'([^']+)'`,
+    "gi"
+  );
   let m;
   while ((m = re.exec(sql)) !== null) {
-    const en = state.enums.get(m[1]);
+    const en = state.enums.get(bareName(m[1]));
     if (en) en.values.add(m[2]);
   }
 }
 function parseDropTable(sql, state) {
-  const re = /DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?"(\w+)"/gi;
+  const re = new RegExp(
+    `DROP\\s+TABLE\\s+(?:IF\\s+EXISTS\\s+)?(${QID})`,
+    "gi"
+  );
   let m;
   while ((m = re.exec(sql)) !== null) {
-    state.tables.delete(m[1]);
-    state.fks = state.fks.filter((fk) => fk.sourceTable !== m[1] && fk.targetTable !== m[1]);
+    const dropped = bareName(m[1]);
+    state.tables.delete(dropped);
+    state.fks = state.fks.filter((fk) => fk.sourceTable !== dropped && fk.targetTable !== dropped);
   }
 }
 function parseUniqueIndex(sql, state) {
-  const re = /CREATE\s+UNIQUE\s+INDEX\s+"[^"]+"\s+ON\s+"(\w+)"\("(\w+)"\)/gi;
+  const re = new RegExp(
+    `CREATE\\s+UNIQUE\\s+INDEX\\s+(?:(?:IF\\s+NOT\\s+EXISTS\\s+)?(?:${ID}\\s+)?)?ON\\s+(${QID})\\s*\\(\\s*(${QID})\\s*\\)`,
+    "gi"
+  );
   let m;
   while ((m = re.exec(sql)) !== null) {
-    const table = state.tables.get(m[1]);
-    const col = table?.columns.get(m[2]);
+    const tableName = bareName(m[1]);
+    const colName = bareName(m[2]);
+    const table = state.tables.get(tableName);
+    const col = table?.columns.get(colName);
     if (col) col.unique = true;
-    if (!state.uniqueIndexes.has(m[1])) state.uniqueIndexes.set(m[1], /* @__PURE__ */ new Set());
-    state.uniqueIndexes.get(m[1]).add(m[2]);
+    if (!state.uniqueIndexes.has(tableName)) state.uniqueIndexes.set(tableName, /* @__PURE__ */ new Set());
+    state.uniqueIndexes.get(tableName).add(colName);
+  }
+}
+function discoverMigrationFiles(migrationsDir) {
+  if (!(0, import_node_fs8.existsSync)(migrationsDir)) return [];
+  const out = [];
+  const entries = (0, import_node_fs8.readdirSync)(migrationsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      const sqlPath = (0, import_node_path7.join)(migrationsDir, entry.name, "migration.sql");
+      if ((0, import_node_fs8.existsSync)(sqlPath)) out.push(sqlPath);
+    } else if (entry.isFile() && entry.name.endsWith(".sql")) {
+      out.push((0, import_node_path7.join)(migrationsDir, entry.name));
+    }
   }
+  return out;
 }
-function parseMigrations(rootDir) {
-  const migrationsDir = (0, import_node_path6.join)(rootDir, "prisma", "migrations");
+function parseMigrations(migrationsDir) {
   const state = {
     tables: /* @__PURE__ */ new Map(),
     enums: /* @__PURE__ */ new Map(),
     fks: [],
     uniqueIndexes: /* @__PURE__ */ new Map()
   };
-  if (!(0, import_node_fs6.existsSync)(migrationsDir)) return state;
-  const dirs = (0, import_node_fs6.readdirSync)(migrationsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
-  for (const dir of dirs) {
-    const sqlPath = (0, import_node_path6.join)(migrationsDir, dir, "migration.sql");
-    if (!(0, import_node_fs6.existsSync)(sqlPath)) continue;
-    const sql = (0, import_node_fs6.readFileSync)(sqlPath, "utf-8");
+  if (!migrationsDir) return state;
+  for (const sqlPath of discoverMigrationFiles(migrationsDir)) {
+    const sql = (0, import_node_fs8.readFileSync)(sqlPath, "utf-8");
     parseCreateEnum(sql, state);
     parseCreateTable(sql, state);
     parseAlterTable(sql, state);
@@ -1640,10 +2908,9 @@ function parseMigrations(rootDir) {
   }
   return state;
 }
-function loadPrismaState(rootDir) {
-  const schemaPath = (0, import_node_path6.join)(rootDir, "prisma", "schema.prisma");
-  if (!(0, import_node_fs6.existsSync)(schemaPath)) return null;
-  const content = (0, import_node_fs6.readFileSync)(schemaPath, "utf-8");
+function loadPrismaState(schemaPath) {
+  if (!schemaPath || !(0, import_node_fs8.existsSync)(schemaPath)) return null;
+  const content = (0, import_node_fs8.readFileSync)(schemaPath, "utf-8");
   const tables = /* @__PURE__ */ new Map();
   const enums = /* @__PURE__ */ new Map();
   const relations = [];
@@ -1807,14 +3074,28 @@ function verify(sqlState, prisma) {
   }
   return { contradictions, flaggedEdges };
 }
+function migrationsDirFor(rootDir) {
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  if (!paths) return null;
+  if (paths.dbConfig.kind === "prisma" || paths.dbConfig.kind === "sql-migrations") {
+    return paths.dbConfig.migrationsDir;
+  }
+  return null;
+}
+function schemaPathFor(rootDir) {
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  if (!paths) return null;
+  return paths.dbConfig.kind === "prisma" ? paths.dbConfig.schemaPath : null;
+}
 function detect3(rootDir) {
-  const migrationsDir = (0, import_node_path6.join)(rootDir, "prisma", "migrations");
-  if (!(0, import_node_fs6.existsSync)(migrationsDir)) return false;
-  return (0, import_node_fs6.readdirSync)(migrationsDir, { withFileTypes: true }).some((d) => d.isDirectory() && (0, import_node_fs6.existsSync)((0, import_node_path6.join)(migrationsDir, d.name, "migration.sql")));
+  const dir = migrationsDirFor(rootDir);
+  if (!dir) return false;
+  return discoverMigrationFiles(dir).length > 0;
 }
 function generate3(rootDir) {
-  const sqlState = parseMigrations(rootDir);
-  const prisma = loadPrismaState(rootDir);
+  const migrationsDir = migrationsDirFor(rootDir);
+  const sqlState = parseMigrations(migrationsDir);
+  const prisma = loadPrismaState(schemaPathFor(rootDir));
   const prismaTableIds = prisma ? new Set(prisma.tables.keys()) : /* @__PURE__ */ new Set();
   const prismaEnumIds = prisma ? new Set(prisma.enums.keys()) : /* @__PURE__ */ new Set();
   const nodes = [];
@@ -1860,7 +3141,7 @@ function generate3(rootDir) {
     metadata: {
       generated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
       scope: "sql-migrations",
-      source: "prisma/migrations/",
+      source: migrationsDir ?? "none",
       layer: "db",
       sql_tables: sqlState.tables.size,
       sql_enums: sqlState.enums.size,
@@ -1885,15 +3166,16 @@ var sqlMigrationsParser = {
 };
 
 // src/server/graph/core/api-route-matching.ts
+init_launch_kit_paths();
 function loadApiRoutesFromOutput(apiOutput) {
   const routes = [];
   for (const n of apiOutput.nodes) {
-    const path2 = n.path;
-    if (!path2 || typeof path2 !== "string") continue;
+    const path = n.path;
+    if (!path || typeof path !== "string") continue;
     routes.push({
-      path: path2,
+      path,
       nodeId: n.id,
-      segments: path2.split("/").filter(Boolean)
+      segments: path.split("/").filter(Boolean)
     });
   }
   return routes;
@@ -1902,6 +3184,10 @@ function buildApiPathMap(routes) {
   const map = /* @__PURE__ */ new Map();
   for (const r of routes) {
     if (!map.has(r.path)) map.set(r.path, r.nodeId);
+    const trimmed = r.path.replace(/\/\*[^/]+\?$/, "");
+    if (trimmed && trimmed !== r.path && !map.has(trimmed)) {
+      map.set(trimmed, r.nodeId);
+    }
   }
   return map;
 }
@@ -1924,26 +3210,54 @@ function normalizeFetchUrl(raw) {
   return { path: s || "/", hadInterpolation };
 }
 function scoreApiRouteMatch(candidate, known) {
-  if (candidate.length !== known.length) return -1;
   let score = 0;
-  for (let i = 0; i < candidate.length; i++) {
+  let i = 0, j = 0;
+  while (i < candidate.length && j < known.length) {
     const a = candidate[i];
-    const b = known[i];
+    const b = known[j];
+    if (b.startsWith("*") && b.endsWith("?")) {
+      score += 1;
+      return score;
+    }
+    if (b.startsWith("*")) {
+      const remaining = candidate.length - i;
+      if (remaining < 1) return -1;
+      score += 1 + remaining;
+      return score;
+    }
     if (a === b) {
       score += 3;
+      i++;
+      j++;
       continue;
     }
     if (a.startsWith(":") && b.startsWith(":")) {
       score += 2;
+      i++;
+      j++;
       continue;
     }
     if (a.startsWith(":") || b.startsWith(":")) {
       score += 1;
+      i++;
+      j++;
       continue;
     }
     return -1;
   }
-  return score;
+  if (i === candidate.length) {
+    while (j < known.length) {
+      const b = known[j];
+      if (b.startsWith("*") && b.endsWith("?")) {
+        score += 1;
+        j++;
+        continue;
+      }
+      return -1;
+    }
+    return score;
+  }
+  return -1;
 }
 function resolveFetchCall(call, apiPathMap, apiRoutes) {
   const raw = call.url;
@@ -1953,16 +3267,16 @@ function resolveFetchCall(call, apiPathMap, apiRoutes) {
   if (call.isConcat) {
     return { kind: "dynamic", normalizedUrl: raw };
   }
-  const { path: path2, hadInterpolation } = normalizeFetchUrl(raw);
-  if (!path2.startsWith("/")) {
-    return { kind: "unresolved", normalizedUrl: path2 };
+  const { path, hadInterpolation } = normalizeFetchUrl(raw);
+  if (!path.startsWith("/")) {
+    return { kind: "unresolved", normalizedUrl: path };
   }
-  const segs = path2.split("/").filter(Boolean);
+  const segs = path.split("/").filter(Boolean);
   if (hadInterpolation && segs.length > 0 && segs[0].startsWith(":")) {
-    return { kind: "dynamic", normalizedUrl: path2 };
+    return { kind: "dynamic", normalizedUrl: path };
   }
-  const exact = apiPathMap.get(path2);
-  if (exact) return { kind: "resolved", nodeId: exact, normalizedUrl: path2 };
+  const exact = apiPathMap.get(path);
+  if (exact) return { kind: "resolved", nodeId: exact, normalizedUrl: path };
   let bestScore = -1;
   let bestId = null;
   for (const r of apiRoutes) {
@@ -1973,21 +3287,21 @@ function resolveFetchCall(call, apiPathMap, apiRoutes) {
     }
   }
   if (bestId && bestScore > 0) {
-    return { kind: "resolved", nodeId: bestId, normalizedUrl: path2 };
+    return { kind: "resolved", nodeId: bestId, normalizedUrl: path };
   }
-  return { kind: "unresolved", normalizedUrl: path2 };
+  return { kind: "unresolved", normalizedUrl: path };
 }
 function resolveUrlPath(urlPath, apiPathMap, apiRoutes) {
-  const { path: path2, hadInterpolation } = normalizeFetchUrl(urlPath);
-  if (!path2.startsWith("/")) {
-    return { kind: "unresolved", normalizedUrl: path2 };
+  const { path, hadInterpolation } = normalizeFetchUrl(urlPath);
+  if (!path.startsWith("/")) {
+    return { kind: "unresolved", normalizedUrl: path };
   }
-  const segs = path2.split("/").filter(Boolean);
+  const segs = path.split("/").filter(Boolean);
   if (hadInterpolation && segs.length > 0 && segs[0].startsWith(":")) {
-    return { kind: "dynamic", normalizedUrl: path2 };
+    return { kind: "dynamic", normalizedUrl: path };
   }
-  const exact = apiPathMap.get(path2);
-  if (exact) return { kind: "resolved", nodeId: exact, normalizedUrl: path2 };
+  const exact = apiPathMap.get(path);
+  if (exact) return { kind: "resolved", nodeId: exact, normalizedUrl: path };
   let bestScore = -1;
   let bestId = null;
   for (const r of apiRoutes) {
@@ -1998,9 +3312,9 @@ function resolveUrlPath(urlPath, apiPathMap, apiRoutes) {
     }
   }
   if (bestId && bestScore > 0) {
-    return { kind: "resolved", nodeId: bestId, normalizedUrl: path2 };
+    return { kind: "resolved", nodeId: bestId, normalizedUrl: path };
   }
-  return { kind: "unresolved", normalizedUrl: path2 };
+  return { kind: "unresolved", normalizedUrl: path };
 }
 
 // src/server/graph/parsers/crosslayer/fetch-resolver.ts
@@ -2098,50 +3412,59 @@ var fetchResolverParser = {
 };
 
 // src/server/graph/parsers/crosslayer/api-annotations.ts
-var import_node_fs7 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs9 = require("node:fs");
+var import_node_path8 = require("node:path");
 var API_ANNOTATION_RE = /@api\s+(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\s+(\/\S+)/g;
-function walk2(dir, exts) {
-  if (!(0, import_node_fs7.existsSync)(dir)) return [];
-  const results = [];
-  for (const entry of (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true })) {
-    if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const full = (0, import_node_path7.join)(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...walk2(full, exts));
-    } else if (exts.includes((0, import_node_path7.extname)(entry.name))) {
-      results.push(full);
-    }
+function toNodeId2(srcDir, rootDir, absPath) {
+  const relFromSrc = (0, import_node_path8.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path8.relative)(rootDir, absPath).replace(/\\/g, "/");
   }
-  return results;
-}
-function toNodeId2(srcDir, absPath) {
-  return (0, import_node_path7.relative)(srcDir, absPath).replace(/\\/g, "/");
+  return relFromSrc;
 }
 var apiAnnotationsParser = {
   id: "api-annotations",
   layer: "crosslayer",
   concern: "api-binding",
   detect(rootDir) {
-    return (0, import_node_fs7.existsSync)((0, import_node_path7.join)(rootDir, "src"));
+    return resolveProjectPaths(rootDir, loadConfig(rootDir)) !== null;
   },
   generate(rootDir, layerOutputs) {
     const apiOutput = layerOutputs.get("api");
     if (!apiOutput) {
       return { cross_refs: [], flagged_edges: [], warnings: [] };
     }
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    if (!paths) {
+      return { cross_refs: [], flagged_edges: [], warnings: [] };
+    }
     const uiOutput = layerOutputs.get("ui");
     const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
     const apiRoutes = loadApiRoutesFromOutput(apiOutput);
     const apiPathMap = buildApiPathMap(apiRoutes);
-    const srcDir = (0, import_node_path7.join)(rootDir, "src");
-    const files = walk2(srcDir, [".ts", ".tsx"]);
+    const srcDir = paths.srcDir;
+    const seen = /* @__PURE__ */ new Set();
+    const files = [];
+    for (const root of paths.srcRoots) {
+      for (const f of walk(root, [".ts", ".tsx"])) {
+        if (!seen.has(f)) {
+          seen.add(f);
+          files.push(f);
+        }
+      }
+    }
+    for (const conv of paths.conventionFiles) {
+      if (!seen.has(conv)) {
+        seen.add(conv);
+        files.push(conv);
+      }
+    }
     const crossRefs = [];
     const flaggedEdges = [];
-    const seen = /* @__PURE__ */ new Set();
+    const seenEdge = /* @__PURE__ */ new Set();
     for (const absPath of files) {
-      const content = (0, import_node_fs7.readFileSync)(absPath, "utf-8");
-      const sourceId = toNodeId2(srcDir, absPath);
+      const content = (0, import_node_fs9.readFileSync)(absPath, "utf-8");
+      const sourceId = toNodeId2(srcDir, rootDir, absPath);
       if (!uiNodeIds.has(sourceId)) continue;
       let match;
       API_ANNOTATION_RE.lastIndex = 0;
@@ -2151,8 +3474,8 @@ var apiAnnotationsParser = {
         const result = resolveUrlPath(urlPath, apiPathMap, apiRoutes);
         if (result.kind === "resolved" && result.nodeId) {
           const key = `${sourceId}|${result.nodeId}|calls_api`;
-          if (seen.has(key)) continue;
-          seen.add(key);
+          if (seenEdge.has(key)) continue;
+          seenEdge.add(key);
           crossRefs.push({
             source: sourceId,
             target: result.nodeId,
@@ -2184,26 +3507,15 @@ var apiAnnotationsParser = {
 };
 
 // src/server/graph/parsers/crosslayer/url-literal-scanner.ts
-var import_node_fs8 = require("node:fs");
-var import_node_path8 = require("node:path");
-init_config();
-var URL_LITERAL_RE = /['"`](\/api\/[^'"`\s]+?)['"`]/g;
-function walk3(dir, exts) {
-  if (!(0, import_node_fs8.existsSync)(dir)) return [];
-  const results = [];
-  for (const entry of (0, import_node_fs8.readdirSync)(dir, { withFileTypes: true })) {
-    if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const full = (0, import_node_path8.join)(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...walk3(full, exts));
-    } else if (exts.includes((0, import_node_path8.extname)(entry.name))) {
-      results.push(full);
-    }
-  }
-  return results;
-}
-function toNodeId3(srcDir, absPath) {
-  return (0, import_node_path8.relative)(srcDir, absPath).replace(/\\/g, "/");
+var import_node_fs10 = require("node:fs");
+var import_node_path9 = require("node:path");
+var URL_LITERAL_RE = /['"`](\/[a-zA-Z][^'"`\s]*?)['"`]/g;
+function toNodeId3(srcDir, rootDir, absPath) {
+  const relFromSrc = (0, import_node_path9.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path9.relative)(rootDir, absPath).replace(/\\/g, "/");
+  }
+  return relFromSrc;
 }
 var urlLiteralScannerParser = {
   id: "url-literal-scanner",
@@ -2224,17 +3536,28 @@ var urlLiteralScannerParser = {
     const apiPathMap = buildApiPathMap(apiRoutes);
     const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
     const srcDir = paths.srcDir;
-    const clientDir = (0, import_node_path8.join)(srcDir, "client");
-    const files = [
-      ...walk3(clientDir, [".ts", ".tsx"]),
-      ...walk3(paths.appDir, [".ts", ".tsx"])
-    ];
+    const seenFile = /* @__PURE__ */ new Set();
+    const files = [];
+    for (const root of paths.srcRoots) {
+      for (const f of walk(root, [".ts", ".tsx"])) {
+        if (!seenFile.has(f)) {
+          seenFile.add(f);
+          files.push(f);
+        }
+      }
+    }
+    for (const conv of paths.conventionFiles) {
+      if (!seenFile.has(conv)) {
+        seenFile.add(conv);
+        files.push(conv);
+      }
+    }
     const crossRefs = [];
     const seen = /* @__PURE__ */ new Set();
     for (const absPath of files) {
-      const sourceId = toNodeId3(srcDir, absPath);
+      const sourceId = toNodeId3(srcDir, rootDir, absPath);
       if (!uiNodeIds.has(sourceId)) continue;
-      const content = (0, import_node_fs8.readFileSync)(absPath, "utf-8");
+      const content = (0, import_node_fs10.readFileSync)(absPath, "utf-8");
       let match;
       URL_LITERAL_RE.lastIndex = 0;
       while ((match = URL_LITERAL_RE.exec(content)) !== null) {
@@ -2265,8 +3588,8 @@ var urlLiteralScannerParser = {
 };
 
 // src/server/graph/parsers/static/static-values.ts
-var import_node_fs9 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_path10 = require("node:path");
 var parseCode = null;
 function tryLoadTreeSitter() {
   if (parseCode) return true;
@@ -2298,20 +3621,25 @@ function classifyScope(source, model) {
 function extractEnumValues(rootDir) {
   const nodes = [];
   const edges = [];
-  const schemaPaths = [
-    (0, import_node_path9.join)(rootDir, "prisma", "schema.prisma"),
-    (0, import_node_path9.join)(rootDir, "prisma", "schema")
-  ];
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  const schemaPaths = [];
+  if (paths?.dbConfig.kind === "prisma" && paths.dbConfig.schemaPath) {
+    schemaPaths.push(paths.dbConfig.schemaPath);
+    schemaPaths.push((0, import_node_path10.join)((0, import_node_path10.dirname)(paths.dbConfig.schemaPath), "schema"));
+  } else {
+    schemaPaths.push((0, import_node_path10.join)(rootDir, "prisma", "schema.prisma"));
+    schemaPaths.push((0, import_node_path10.join)(rootDir, "prisma", "schema"));
+  }
   let content = "";
   for (const p of schemaPaths) {
-    if ((0, import_node_fs9.existsSync)(p)) {
+    if ((0, import_node_fs11.existsSync)(p)) {
       try {
-        const stat = (0, import_node_fs9.statSync)(p);
+        const stat = (0, import_node_fs11.statSync)(p);
         if (stat.isFile()) {
-          content = (0, import_node_fs9.readFileSync)(p, "utf-8");
+          content = (0, import_node_fs11.readFileSync)(p, "utf-8");
         } else if (stat.isDirectory()) {
-          const files = (0, import_node_fs9.readdirSync)(p).filter((f) => f.endsWith(".prisma"));
-          content = files.map((f) => (0, import_node_fs9.readFileSync)((0, import_node_path9.join)(p, f), "utf-8")).join("\n");
+          const files = (0, import_node_fs11.readdirSync)(p).filter((f) => f.endsWith(".prisma"));
+          content = files.map((f) => (0, import_node_fs11.readFileSync)((0, import_node_path10.join)(p, f), "utf-8")).join("\n");
         }
       } catch {
         continue;
@@ -2385,7 +3713,7 @@ function extractStringArrayFromNode(node) {
   return values;
 }
 function findArrayDecl(root, varName) {
-  function walk5(node) {
+  function walk2(node) {
     if (node.type === "variable_declarator") {
       const nameNode = node.childForFieldName("name");
       const valueNode = node.childForFieldName("value");
@@ -2398,12 +3726,12 @@ function findArrayDecl(root, varName) {
       }
     }
     for (const child of node.namedChildren) {
-      const found = walk5(child);
+      const found = walk2(child);
       if (found) return found;
     }
     return null;
   }
-  return walk5(root);
+  return walk2(root);
 }
 function extractObjectPropsRegex(objStr) {
   const props = {};
@@ -2466,15 +3794,30 @@ function modelToNodeType(model) {
 function extractSeedData(rootDir) {
   const nodes = [];
   const edges = [];
-  const seedFiles = [
-    (0, import_node_path9.join)(rootDir, "prisma", "seed.ts"),
-    (0, import_node_path9.join)(rootDir, "prisma", "seed.js"),
-    (0, import_node_path9.join)(rootDir, "src", "server", "lib", "system-tags.ts")
-  ].filter(import_node_fs9.existsSync);
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  const candidates = [];
+  if (paths?.dbDir) {
+    candidates.push((0, import_node_path10.join)(paths.dbDir, "seed.ts"));
+    candidates.push((0, import_node_path10.join)(paths.dbDir, "seed.js"));
+  } else {
+    candidates.push((0, import_node_path10.join)(rootDir, "prisma", "seed.ts"));
+    candidates.push((0, import_node_path10.join)(rootDir, "prisma", "seed.js"));
+  }
+  const baseRoots = paths?.srcRoots ?? [(0, import_node_path10.join)(rootDir, "src")];
+  for (const root of baseRoots) {
+    candidates.push((0, import_node_path10.join)(root, "server", "lib", "system-tags.ts"));
+  }
+  const seedFiles = candidates.filter((p) => {
+    try {
+      return (0, import_node_fs11.existsSync)(p) && (0, import_node_fs11.statSync)(p).isFile();
+    } catch {
+      return false;
+    }
+  });
   const useTreeSitter = tryLoadTreeSitter();
   for (const filePath of seedFiles) {
-    const content = (0, import_node_fs9.readFileSync)(filePath, "utf-8");
-    const relPath = (0, import_node_path9.relative)(rootDir, filePath);
+    const content = (0, import_node_fs11.readFileSync)(filePath, "utf-8");
+    const relPath = (0, import_node_path10.relative)(rootDir, filePath);
     const seeded = detectSeededArrays(content, relPath);
     let astRoot = null;
     if (useTreeSitter && parseCode) {
@@ -2568,11 +3911,11 @@ function extractSeedData(rootDir) {
   return { nodes, edges };
 }
 function walkDir(dir, exts) {
-  if (!(0, import_node_fs9.existsSync)(dir)) return [];
+  if (!(0, import_node_fs11.existsSync)(dir)) return [];
   const results = [];
-  for (const entry of (0, import_node_fs9.readdirSync)(dir, { withFileTypes: true })) {
+  for (const entry of (0, import_node_fs11.readdirSync)(dir, { withFileTypes: true })) {
     if (entry.name === "node_modules" || entry.name === ".next" || entry.name === "dist") continue;
-    const full = (0, import_node_path9.join)(dir, entry.name);
+    const full = (0, import_node_path10.join)(dir, entry.name);
     if (entry.isDirectory()) results.push(...walkDir(full, exts));
     else if (exts.some((ext) => entry.name.endsWith(ext))) results.push(full);
   }
@@ -2580,11 +3923,22 @@ function walkDir(dir, exts) {
 }
 function extractConstants(rootDir) {
   const nodes = [];
-  const srcDir = (0, import_node_path9.join)(rootDir, "src");
-  if (!(0, import_node_fs9.existsSync)(srcDir)) return { nodes };
-  for (const filePath of walkDir(srcDir, [".ts", ".tsx"])) {
-    const content = (0, import_node_fs9.readFileSync)(filePath, "utf-8");
-    const relPath = (0, import_node_path9.relative)(rootDir, filePath);
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  const roots = paths?.srcRoots ?? [(0, import_node_path10.join)(rootDir, "src")];
+  const seenFile = /* @__PURE__ */ new Set();
+  const allFiles = [];
+  for (const root of roots) {
+    for (const f of walkDir(root, [".ts", ".tsx"])) {
+      if (!seenFile.has(f)) {
+        seenFile.add(f);
+        allFiles.push(f);
+      }
+    }
+  }
+  if (allFiles.length === 0) return { nodes };
+  for (const filePath of allFiles) {
+    const content = (0, import_node_fs11.readFileSync)(filePath, "utf-8");
+    const relPath = (0, import_node_path10.relative)(rootDir, filePath);
     const constArrayRe = /export\s+const\s+([A-Z][A-Z_0-9]+)\s*(?::[^=]+)?\s*=\s*\[/g;
     let cm;
     while ((cm = constArrayRe.exec(content)) !== null) {
@@ -2617,7 +3971,14 @@ function extractConstants(rootDir) {
   return { nodes };
 }
 function detect4(rootDir) {
-  return (0, import_node_fs9.existsSync)((0, import_node_path9.join)(rootDir, "prisma", "schema.prisma")) || (0, import_node_fs9.existsSync)((0, import_node_path9.join)(rootDir, "prisma", "seed.ts"));
+  const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+  if (paths?.dbConfig.kind === "prisma" && paths.dbConfig.schemaPath && (0, import_node_fs11.existsSync)(paths.dbConfig.schemaPath)) {
+    return true;
+  }
+  if (paths?.dbDir) {
+    if ((0, import_node_fs11.existsSync)((0, import_node_path10.join)(paths.dbDir, "seed.ts")) || (0, import_node_fs11.existsSync)((0, import_node_path10.join)(paths.dbDir, "seed.js"))) return true;
+  }
+  return (0, import_node_fs11.existsSync)((0, import_node_path10.join)(rootDir, "prisma", "schema.prisma")) || (0, import_node_fs11.existsSync)((0, import_node_path10.join)(rootDir, "prisma", "seed.ts"));
 }
 function generate4(rootDir) {
   const enumResult = extractEnumValues(rootDir);
@@ -2692,26 +4053,8 @@ var staticValuesParser = {
 };
 
 // src/server/graph/parsers/crosslayer/static-ref-scanner.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path10 = require("node:path");
-init_config();
-function walk4(dir, exts) {
-  if (!(0, import_node_fs10.existsSync)(dir)) return [];
-  const results = [];
-  function recurse(d) {
-    for (const entry of (0, import_node_fs10.readdirSync)(d, { withFileTypes: true })) {
-      const full = (0, import_node_path10.join)(d, entry.name);
-      if (entry.isDirectory()) {
-        if (entry.name === "node_modules" || entry.name === ".next" || entry.name === "dist") continue;
-        recurse(full);
-      } else if (exts.some((ext) => entry.name.endsWith(ext))) {
-        results.push(full);
-      }
-    }
-  }
-  recurse(dir);
-  return results;
-}
+var import_node_fs12 = require("node:fs");
+var import_node_path11 = require("node:path");
 var MIN_VALUE_LENGTH = 4;
 var SKIP_VALUES = /* @__PURE__ */ new Set([
   "true",
@@ -2827,7 +4170,7 @@ var staticRefScannerParser = {
   },
   generate(rootDir, layerOutputs) {
     const staticOutput = layerOutputs.get("static");
-    if (!staticOutput || staticOutput.nodes.length === 0) {
+    if (!staticOutput || !Array.isArray(staticOutput.nodes) || staticOutput.nodes.length === 0) {
       return { cross_refs: [], flagged_edges: [], warnings: [] };
     }
     const valueLookup = /* @__PURE__ */ new Map();
@@ -2853,13 +4196,22 @@ var staticRefScannerParser = {
     const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
     if (!paths) return { cross_refs: [], flagged_edges: [], warnings: [] };
     const srcDir = paths.srcDir;
-    const files = [
-      ...walk4((0, import_node_path10.join)(srcDir, "client"), [".ts", ".tsx"]),
-      ...walk4(paths.appDir, [".ts", ".tsx"]),
-      ...walk4((0, import_node_path10.join)(srcDir, "server"), [".ts", ".tsx"]),
-      ...walk4((0, import_node_path10.join)(srcDir, "lib"), [".ts", ".tsx"]),
-      ...walk4((0, import_node_path10.join)(srcDir, "config"), [".ts", ".tsx"])
-    ];
+    const seenFile = /* @__PURE__ */ new Set();
+    const files = [];
+    for (const root of paths.srcRoots) {
+      for (const f of walkWithIgnore(root, [".ts", ".tsx"])) {
+        if (!seenFile.has(f)) {
+          seenFile.add(f);
+          files.push(f);
+        }
+      }
+    }
+    for (const conv of paths.conventionFiles) {
+      if (!seenFile.has(conv)) {
+        seenFile.add(conv);
+        files.push(conv);
+      }
+    }
     const uiOutput = layerOutputs.get("ui");
     const apiOutput = layerOutputs.get("api");
     const uiNodeIds = new Set(uiOutput?.nodes.map((n) => n.id) ?? []);
@@ -2876,10 +4228,11 @@ var staticRefScannerParser = {
     const seen = /* @__PURE__ */ new Set();
     let filesScanned = 0;
     for (const absPath of files) {
-      const sourceId = (0, import_node_path10.relative)(srcDir, absPath).replace(/\\/g, "/");
+      const relFromSrc = (0, import_node_path11.relative)(srcDir, absPath).replace(/\\/g, "/");
+      const sourceId = relFromSrc.startsWith("..") ? (0, import_node_path11.relative)(rootDir, absPath).replace(/\\/g, "/") : relFromSrc;
       const sourceLayer = uiNodeIds.has(sourceId) ? "ui" : apiNodeIds.has(sourceId) ? "api" : null;
       if (!sourceLayer) continue;
-      const content = (0, import_node_fs10.readFileSync)(absPath, "utf-8");
+      const content = (0, import_node_fs12.readFileSync)(absPath, "utf-8");
       filesScanned++;
       let fileRefs;
       if (parseCode2) {
@@ -2920,6 +4273,111 @@ var staticRefScannerParser = {
   }
 };
 
+// src/server/graph/parsers/crosslayer/middleware-gates.ts
+var import_node_path12 = require("node:path");
+init_ts_extractor();
+function toNodeId4(srcDir, rootDir, absPath) {
+  const relFromSrc = (0, import_node_path12.relative)(srcDir, absPath).replace(/\\/g, "/");
+  if (relFromSrc.startsWith("..")) {
+    return (0, import_node_path12.relative)(rootDir, absPath).replace(/\\/g, "/");
+  }
+  return relFromSrc;
+}
+function collectTargets(apiOutput, uiOutput) {
+  const out = [];
+  for (const n of apiOutput?.nodes ?? []) {
+    if (n.type !== "endpoint") continue;
+    const path = n.path;
+    if (typeof path !== "string" || !path) continue;
+    out.push({ id: n.id, route: path, layer: "api" });
+  }
+  for (const n of uiOutput?.nodes ?? []) {
+    if (n.type !== "page") continue;
+    const route = n.route;
+    if (typeof route !== "string" || !route) continue;
+    out.push({ id: n.id, route, layer: "ui" });
+  }
+  return out;
+}
+var middlewareGatesParser = {
+  id: "middleware-gates",
+  layer: "crosslayer",
+  concern: "auth-gate",
+  detect(rootDir) {
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    if (!paths) return false;
+    return paths.conventionFiles.some((f) => /middleware\.tsx?$/.test(f));
+  },
+  generate(rootDir, layerOutputs) {
+    const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
+    if (!paths) return { cross_refs: [], flagged_edges: [], warnings: [] };
+    const middlewareFiles = paths.conventionFiles.filter((f) => /middleware\.tsx?$/.test(f));
+    if (middlewareFiles.length === 0) {
+      return { cross_refs: [], flagged_edges: [], warnings: [] };
+    }
+    const apiOutput = layerOutputs.get("api");
+    const uiOutput = layerOutputs.get("ui");
+    const targets = collectTargets(apiOutput, uiOutput);
+    const crossRefs = [];
+    const flagged = [];
+    const seenEdge = /* @__PURE__ */ new Set();
+    const seenUnparseable = /* @__PURE__ */ new Set();
+    let protectMatcherCount = 0;
+    for (const file of middlewareFiles) {
+      let info = null;
+      try {
+        info = extractMiddlewareAuthTS(file);
+      } catch {
+      }
+      if (!info || info.matchers.length === 0) continue;
+      const middlewareId = toNodeId4(paths.srcDir, rootDir, file);
+      for (const matcher of info.matchers) {
+        if (matcher.intent !== "protect") continue;
+        protectMatcherCount += 1;
+        for (const pattern of matcher.patterns) {
+          const re = middlewarePatternToRegex(pattern);
+          if (!re) {
+            const key = `${middlewareId}|${pattern}`;
+            if (seenUnparseable.has(key)) continue;
+            seenUnparseable.add(key);
+            flagged.push({
+              source: middlewareId,
+              target: "UNRESOLVED",
+              type: "middleware_pattern_unparseable",
+              label: `pattern "${pattern}" in matcher "${matcher.name}" \u2014 coverage unknown`,
+              confidence: "high"
+            });
+            continue;
+          }
+          for (const target of targets) {
+            if (!re.test(target.route)) continue;
+            const key = `${middlewareId}|${target.id}|protects`;
+            if (seenEdge.has(key)) continue;
+            seenEdge.add(key);
+            crossRefs.push({
+              source: middlewareId,
+              target: target.id,
+              type: "protects",
+              layer: target.layer
+            });
+          }
+        }
+      }
+    }
+    return {
+      cross_refs: crossRefs,
+      flagged_edges: flagged,
+      warnings: [],
+      patterns: {
+        middleware_files: middlewareFiles.length,
+        protect_matchers: protectMatcherCount,
+        protects_edges: crossRefs.length,
+        unparseable_patterns: flagged.length
+      }
+    };
+  }
+};
+
 // src/server/graph/core/parser-registry.ts
 function isMultiLayerParser(p) {
   return "layers" in p && Array.isArray(p.layers);
@@ -2985,7 +4443,8 @@ function registerBuiltins(registry, disabled) {
     fetchResolverParser,
     apiAnnotationsParser,
     urlLiteralScannerParser,
-    staticRefScannerParser
+    staticRefScannerParser,
+    middlewareGatesParser
   ];
   for (const parser of builtins) {
     if (disabled.has(parser.id)) continue;
@@ -2995,7 +4454,7 @@ function registerBuiltins(registry, disabled) {
 function loadCustomParsers(registry, config, rootDir, disabled) {
   for (const entry of config.parsers?.custom ?? []) {
     try {
-      const absPath = (0, import_node_path11.resolve)(rootDir, entry.path);
+      const absPath = (0, import_node_path13.resolve)(rootDir, entry.path);
       const mod = require(absPath);
       const parser = "default" in mod ? mod.default : mod;
       if (disabled.has(parser.id)) continue;
@@ -3125,10 +4584,10 @@ function applyCrossLayerResults(uiOutput, results) {
 
 // src/server/graph/core/graph-builder.ts
 function readGraphFromDisk(rootDir, layer) {
-  const filePath = (0, import_node_path12.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
-  if (!(0, import_node_fs11.existsSync)(filePath)) return null;
+  const filePath = (0, import_node_path14.join)(rootDir, LAUNCHSECURE_DIR, "graphs", `${layer}.json`);
+  if (!(0, import_node_fs13.existsSync)(filePath)) return null;
   try {
-    return JSON.parse((0, import_node_fs11.readFileSync)(filePath, "utf-8"));
+    return JSON.parse((0, import_node_fs13.readFileSync)(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -3225,1419 +4684,38 @@ function generateAll(rootDir) {
   return [...wellKnownOrder, ...extras].map((l) => byLayer.get(l)).filter((r) => !!r);
 }
 
-// src/server/graph/index.ts
-init_config();
-
-// src/server/graph/core/tagger-registry.ts
-var import_node_path14 = require("node:path");
-
-// src/server/graph/taggers/module-tagger.ts
-var import_node_fs12 = require("node:fs");
-var import_node_path13 = require("node:path");
-function matchGlob(pattern, id) {
-  const patParts = pattern.split("/");
-  const idParts = id.split("/");
-  return matchParts(patParts, 0, idParts, 0);
-}
-function matchParts(pat, pi, id, ii) {
-  while (pi < pat.length && ii < id.length) {
-    const p = pat[pi];
-    if (p === "**") {
-      for (let skip = ii; skip <= id.length; skip++) {
-        if (matchParts(pat, pi + 1, id, skip)) return true;
-      }
-      return false;
-    }
-    if (p === "*") {
-      pi++;
-      ii++;
-      continue;
-    }
-    if (p !== id[ii]) return false;
-    pi++;
-    ii++;
-  }
-  while (pi < pat.length && pat[pi] === "**") pi++;
-  return pi === pat.length && ii === id.length;
-}
-var CONVENTION_DIRS_BUILTIN = ["features", "modules", "domains", "areas"];
-function detectConventionDirs(rootDir, extraConventionDirs = []) {
-  const result = /* @__PURE__ */ new Map();
-  const conventionDirs = [...CONVENTION_DIRS_BUILTIN, ...extraConventionDirs];
-  const searchDirs = [
-    rootDir,
-    (0, import_node_path13.join)(rootDir, "src"),
-    (0, import_node_path13.join)(rootDir, "app"),
-    (0, import_node_path13.join)(rootDir, "lib")
-  ];
-  for (const base of searchDirs) {
-    for (const convention of conventionDirs) {
-      const dir = (0, import_node_path13.join)(base, convention);
-      if (!(0, import_node_fs12.existsSync)(dir)) continue;
-      try {
-        const stat = (0, import_node_fs12.statSync)(dir);
-        if (!stat.isDirectory()) continue;
-        const entries = (0, import_node_fs12.readdirSync)(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
-        if (entries.length > 0) {
-          const relPath = dir.replace(rootDir + "/", "").replace(rootDir + "\\", "");
-          result.set(relPath, entries);
-        }
-      } catch {
-      }
-    }
-  }
-  return result;
-}
-function extractRouteGroups(id) {
-  const groups = [];
-  const re = /\(([^)]+)\)/g;
-  let m;
-  while ((m = re.exec(id)) !== null) {
-    groups.push(m[1]);
-  }
-  return groups;
-}
-var GENERIC_ROLE_NAMES_BUILTIN = /* @__PURE__ */ new Set([
-  // JS/TS
-  "components",
-  "hooks",
-  "pages",
-  "views",
-  "screens",
-  "layouts",
-  "utils",
-  "helpers",
-  "lib",
-  "libs",
-  "services",
-  "api",
-  "apis",
-  "stores",
-  "state",
-  "store",
-  "context",
-  "contexts",
-  "providers",
-  "types",
-  "interfaces",
-  "models",
-  "schemas",
-  "constants",
-  "config",
-  "configs",
-  "assets",
-  "styles",
-  "public",
-  "middleware",
-  "middlewares",
-  "routes",
-  "router",
-  "tests",
-  "test",
-  "__tests__",
-  "spec",
-  "specs",
-  // Go
-  "cmd",
-  "pkg",
-  "internal",
-  // Python
-  "management",
-  "migrations",
-  "templatetags",
-  "templates",
-  // Java
-  "controller",
-  "controllers",
-  "service",
-  "repository",
-  "repositories",
-  "entity",
-  "entities",
-  "dto",
-  "dtos",
-  // General
-  "shared",
-  "common",
-  "core",
-  "base",
-  "app",
-  // Next.js specific
-  "client",
-  "server"
-]);
-var SKIP_SEGMENTS_BUILTIN = /* @__PURE__ */ new Set([
-  "src",
-  "app",
-  "client",
-  "server",
-  "lib",
-  "config"
-]);
-function isRouteGroup(segment) {
-  return segment.startsWith("(") && segment.endsWith(")");
-}
-function isDynamicSegment(segment) {
-  return segment.startsWith("[") || segment.startsWith(":");
-}
-function isDomainDir(segment) {
-  return segment.includes(".") && !segment.endsWith(".tsx") && !segment.endsWith(".ts") && !segment.endsWith(".js") && !segment.endsWith(".jsx") && !segment.endsWith(".vue");
-}
-var TRIVIAL_GROUPS = /* @__PURE__ */ new Set([
-  // Generic app wrappers
-  "app",
-  "all",
-  "ee",
-  "home",
-  "root",
-  "main",
-  "site",
-  // Auth/access boundary wrappers — protect routes, not feature modules
-  "protected",
-  "authenticated",
-  "authed",
-  "private",
-  "public",
-  "logged-in",
-  "logged-out",
-  "unprotected",
-  "unauthenticated",
-  "auth-required",
-  "no-auth",
-  "guest-only"
-]);
-function isTrivialGroup(name, extraTrivial) {
-  const lower = name.toLowerCase();
-  if (TRIVIAL_GROUPS.has(lower)) return true;
-  if (extraTrivial && [...extraTrivial].some((t) => t.toLowerCase() === lower)) return true;
-  const wrapperPatterns = [
-    /^.*-?wrapper$/,
-    // "page-wrapper", "use-page-wrapper"
-    /^.*-?layout$/,
-    // "admin-layout", "settings-layout"
-    /^use-/,
-    // "use-page-wrapper"
-    /^default$/
-  ];
-  return wrapperPatterns.some((p) => p.test(lower));
-}
-function normalizeGroupName(name) {
-  return name.toLowerCase().replace(/-pages?$/, "").replace(/-layout$/, "").replace(/-wrapper$/, "");
-}
-function extractModuleFromPath(id, extraTrivial, extraSkipSegments) {
-  const segments = id.split("/");
-  const routeGroups = extractRouteGroups(id);
-  const skipSegments = new Set(SKIP_SEGMENTS_BUILTIN);
-  if (extraSkipSegments) {
-    for (const s of extraSkipSegments) skipSegments.add(s);
-  }
-  const moduleGroups = routeGroups.filter((g) => !isTrivialGroup(g, extraTrivial)).map(normalizeGroupName);
-  if (moduleGroups.length > 0) {
-    return moduleGroups[moduleGroups.length - 1];
-  }
-  const meaningful = [];
-  for (const seg of segments) {
-    if (seg.includes(".")) continue;
-    if (isRouteGroup(seg)) continue;
-    if (isDynamicSegment(seg)) continue;
-    if (isDomainDir(seg)) continue;
-    if (skipSegments.has(seg)) continue;
-    meaningful.push(seg);
-  }
-  if (meaningful.length > 0) {
-    return meaningful[0];
-  }
-  return "root";
-}
-var cachedRootDir = null;
-var cachedConventionDirs = /* @__PURE__ */ new Map();
-var moduleTagger = {
-  id: "module",
-  tagKey: "module",
-  trackUntagged: true,
-  layers: null,
-  // applies to all layers
-  tag(nodes, layer, rootDir) {
-    let configRules = [];
-    let extraTrivial;
-    let extraSkipSegments;
-    let extraConventionDirs = [];
-    try {
-      const { loadConfig: loadConfig2 } = (init_config(), __toCommonJS(config_exports));
-      const config = loadConfig2(rootDir);
-      configRules = config.taggers?.module?.rules ?? [];
-      const trivialFromConfig = config.taggers?.module?.trivialGroups;
-      if (trivialFromConfig?.length) {
-        extraTrivial = new Set(trivialFromConfig);
-      }
-      const skipFromConfig = config.taggers?.module?.skipSegments;
-      if (skipFromConfig?.length) {
-        extraSkipSegments = new Set(skipFromConfig);
-      }
-      extraConventionDirs = config.taggers?.module?.conventionDirs ?? [];
-      const roleNamesFromConfig = config.taggers?.module?.genericRoleNames;
-      if (roleNamesFromConfig?.length) {
-        for (const name of roleNamesFromConfig) GENERIC_ROLE_NAMES_BUILTIN.add(name);
-      }
-    } catch {
-    }
-    if (cachedRootDir !== rootDir) {
-      cachedConventionDirs = detectConventionDirs(rootDir, extraConventionDirs);
-      cachedRootDir = rootDir;
-    }
-    const result = /* @__PURE__ */ new Map();
-    for (const node of nodes) {
-      const id = node.id;
-      let matched = false;
-      for (const rule of configRules) {
-        if (matchGlob(rule.match, id)) {
-          result.set(id, rule.module);
-          matched = true;
-          break;
-        }
-      }
-      if (matched) continue;
-      matched = false;
-      for (const [convDir, moduleNames] of cachedConventionDirs) {
-        if (id.startsWith(convDir + "/")) {
-          const rest = id.slice(convDir.length + 1);
-          const firstSeg = rest.split("/")[0];
-          if (moduleNames.includes(firstSeg)) {
-            result.set(id, firstSeg);
-            matched = true;
-            break;
-          }
-        }
-      }
-      if (matched) continue;
-      const module2 = extractModuleFromPath(id, extraTrivial, extraSkipSegments);
-      result.set(id, module2);
-    }
-    return result;
-  }
-};
-
-// src/server/graph/taggers/screen-tagger.ts
-var SCREEN_TYPES = /* @__PURE__ */ new Set(["page", "layout"]);
-var screenTagger = {
-  id: "screen",
-  tagKey: "screen",
-  trackUntagged: true,
-  layers: ["ui"],
-  tag(nodes, layer) {
-    if (layer !== "ui") return /* @__PURE__ */ new Map();
-    const result = /* @__PURE__ */ new Map();
-    for (const node of nodes) {
-      if (SCREEN_TYPES.has(node.type)) {
-        result.set(node.id, "true");
-      }
-    }
-    return result;
-  }
-};
-
-// src/server/graph/core/tagger-registry.ts
-var TaggerRegistry = class {
-  constructor() {
-    this.taggers = [];
-    this.ids = /* @__PURE__ */ new Set();
-  }
-  register(tagger) {
-    if (this.ids.has(tagger.id)) {
-      throw new Error(`Duplicate tagger id: ${tagger.id}`);
-    }
-    this.ids.add(tagger.id);
-    this.taggers.push(tagger);
-  }
-  getAll() {
-    return this.taggers;
-  }
-  getForLayer(layer) {
-    return this.taggers.filter((t) => t.layers === null || t.layers.includes(layer));
-  }
-};
-var BUILTIN_TAGGERS = [moduleTagger, screenTagger];
-function registerBuiltins2(registry, disabled, config) {
-  for (const tagger of BUILTIN_TAGGERS) {
-    if (disabled.has(tagger.id)) continue;
-    const override = config.taggers?.trackUntagged?.[tagger.id];
-    if (override !== void 0) {
-      tagger.trackUntagged = override;
-    }
-    registry.register(tagger);
-  }
-}
-function loadCustomTaggers(registry, config, rootDir, disabled) {
-  for (const entry of config.taggers?.custom ?? []) {
-    if (disabled.has(entry.id)) continue;
-    try {
-      const absPath = (0, import_node_path14.resolve)(rootDir, entry.path);
-      const mod = require(absPath);
-      const tagger = "default" in mod ? mod.default : mod;
-      const override = config.taggers?.trackUntagged?.[tagger.id];
-      if (override !== void 0) {
-        tagger.trackUntagged = override;
-      }
-      registry.register(tagger);
-    } catch (err) {
-      process.stderr.write(`[launch-chart] failed to load custom tagger from ${entry.path}: ${err}
-`);
-    }
-  }
-}
-function createTaggerRegistry(config, rootDir) {
-  const registry = new TaggerRegistry();
-  const disabled = new Set(config.taggers?.disabled ?? []);
-  registerBuiltins2(registry, disabled, config);
-  loadCustomTaggers(registry, config, rootDir, disabled);
-  return registry;
-}
-
-// src/server/graph/core/tag-store.ts
-var import_node_fs13 = require("node:fs");
-var import_node_path15 = require("node:path");
-var TAGS_FILENAME = "tags.json";
-var GRAPHS_DIR = ".launchsecure/graphs";
-var tagCache = /* @__PURE__ */ new Map();
-function tagsFilePath(rootDir) {
-  return (0, import_node_path15.join)(rootDir, GRAPHS_DIR, TAGS_FILENAME);
-}
-function readTagStore(rootDir) {
-  const filePath = tagsFilePath(rootDir);
-  if (!(0, import_node_fs13.existsSync)(filePath)) return {};
-  const stat = (0, import_node_fs13.statSync)(filePath);
-  const cached = tagCache.get(filePath);
-  if (cached && cached.mtimeMs === stat.mtimeMs) {
-    return cached.store;
-  }
-  try {
-    const content = (0, import_node_fs13.readFileSync)(filePath, "utf-8");
-    const store = JSON.parse(content);
-    tagCache.set(filePath, { mtimeMs: stat.mtimeMs, store });
-    return store;
-  } catch {
-    return {};
-  }
-}
-function writeTagStore(rootDir, store) {
-  const filePath = tagsFilePath(rootDir);
-  const dir = (0, import_node_path15.dirname)(filePath);
-  (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
-  const cleaned = {};
-  for (const [nodeId, tags] of Object.entries(store)) {
-    if (Object.keys(tags).length > 0) {
-      cleaned[nodeId] = tags;
-    }
-  }
-  (0, import_node_fs13.writeFileSync)(filePath, JSON.stringify(cleaned, null, 2) + "\n", "utf-8");
-  tagCache.delete(filePath);
-}
-function setTag(rootDir, nodeId, key, value) {
-  const store = readTagStore(rootDir);
-  if (!store[nodeId]) store[nodeId] = {};
-  store[nodeId][key] = value;
-  writeTagStore(rootDir, store);
-}
-function removeTag(rootDir, nodeId, key) {
-  const store = readTagStore(rootDir);
-  if (!store[nodeId]) return;
-  delete store[nodeId][key];
-  if (Object.keys(store[nodeId]).length === 0) {
-    delete store[nodeId];
-  }
-  writeTagStore(rootDir, store);
-}
-
-// src/server/graph/index.ts
+// src/server/parse-worker-entry.ts
+init_parse_failure_cache();
 init_ts_extractor();
-var GRAPHS_DIR2 = ".launchsecure/graphs";
-function getAvailableLayers(rootDir) {
-  const dir = (0, import_node_path16.join)(rootDir, GRAPHS_DIR2);
-  if (!(0, import_node_fs14.existsSync)(dir)) return [];
-  return (0, import_node_fs14.readdirSync)(dir).filter((f) => f.endsWith(".json") && f !== "tags.json").map((f) => f.replace(".json", ""));
-}
-var graphCache = /* @__PURE__ */ new Map();
-var taggedCache = /* @__PURE__ */ new Map();
-function graphsDir(rootDir) {
-  return (0, import_node_path16.join)(rootDir, GRAPHS_DIR2);
-}
-function graphFilePath(rootDir, layer) {
-  return (0, import_node_path16.join)(graphsDir(rootDir), `${layer}.json`);
-}
-function tagsFilePath2(rootDir) {
-  return (0, import_node_path16.join)(graphsDir(rootDir), "tags.json");
-}
-function getMtimeMs(filePath) {
-  if (!(0, import_node_fs14.existsSync)(filePath)) return 0;
-  return (0, import_node_fs14.statSync)(filePath).mtimeMs;
-}
-function invalidateCache(filePath) {
-  graphCache.delete(filePath);
-}
-function invalidateTaggedCache(rootDir, layer) {
-  taggedCache.delete(`${rootDir}:${layer}`);
-}
-function applyTags(graph, layer, rootDir) {
-  const config = loadConfig(rootDir);
-  const registry = createTaggerRegistry(config, rootDir);
-  const manualTags = readTagStore(rootDir);
-  const taggedNodes = graph.nodes.map((n) => ({ ...n }));
-  const taggers = registry.getForLayer(layer);
-  for (const tagger of taggers) {
-    const assignments = tagger.tag(taggedNodes, layer, rootDir);
-    for (const node of taggedNodes) {
-      if (!node.tags) node.tags = {};
-      const tags = node.tags;
-      const value = assignments.get(node.id);
-      if (value !== void 0) {
-        tags[tagger.tagKey] = value;
-      } else if (tagger.trackUntagged) {
-        tags[tagger.tagKey] = "untagged";
-      }
-    }
-  }
-  for (const node of taggedNodes) {
-    const manual = manualTags[node.id];
-    if (manual) {
-      if (!node.tags) node.tags = {};
-      const tags = node.tags;
-      Object.assign(tags, manual);
-    }
-  }
-  return { ...graph, nodes: taggedNodes };
-}
-function readGraphRaw(rootDir, layer) {
-  const filePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs14.existsSync)(filePath)) return null;
-  const stat = (0, import_node_fs14.statSync)(filePath);
-  const cached = graphCache.get(filePath);
-  if (cached && cached.mtimeMs === stat.mtimeMs) {
-    return cached.graph;
-  }
-  const content = (0, import_node_fs14.readFileSync)(filePath, "utf-8");
-  const graph = JSON.parse(content);
-  graphCache.set(filePath, { mtimeMs: stat.mtimeMs, graph });
-  return graph;
-}
-function readGraph(rootDir, layer) {
-  const rawFilePath = graphFilePath(rootDir, layer);
-  if (!(0, import_node_fs14.existsSync)(rawFilePath)) return null;
-  const rawMtime = getMtimeMs(rawFilePath);
-  const tagsMtime = getMtimeMs(tagsFilePath2(rootDir));
-  const cacheKey = `${rootDir}:${layer}`;
-  const cached = taggedCache.get(cacheKey);
-  if (cached && cached.rawMtimeMs === rawMtime && cached.tagsMtimeMs === tagsMtime) {
-    return cached.graph;
-  }
-  const raw = readGraphRaw(rootDir, layer);
-  if (!raw) return null;
-  const tagged = applyTags(raw, layer, rootDir);
-  taggedCache.set(cacheKey, { rawMtimeMs: rawMtime, tagsMtimeMs: tagsMtime, graph: tagged });
-  return tagged;
-}
-function readAllGraphs(rootDir) {
-  const result = {};
-  for (const layer of getAvailableLayers(rootDir)) {
-    const graph = readGraph(rootDir, layer);
-    if (graph) result[layer] = graph;
-  }
-  return result;
-}
-async function generateGraph(rootDir, layer) {
-  await initTreeSitter();
-  const config = loadConfig(rootDir);
-  setExtractorConfig({
-    dbIdentifiers: config.parsers?.patterns?.dbIdentifiers,
-    mutationMethods: config.parsers?.patterns?.mutationMethods
-  });
-  const dir = graphsDir(rootDir);
-  (0, import_node_fs14.mkdirSync)(dir, { recursive: true });
-  const results = layer ? [generateLayer(rootDir, layer)].filter((r) => r !== null) : generateAll(rootDir);
-  for (const result of results) {
-    const filePath = graphFilePath(rootDir, result.layer);
-    (0, import_node_fs14.writeFileSync)(filePath, JSON.stringify(result.output, null, 2) + "\n", "utf-8");
-    invalidateCache(filePath);
-    invalidateTaggedCache(rootDir, result.layer);
-  }
-  return results;
-}
-
-// src/server/lockfile.ts
-var import_node_child_process = require("node:child_process");
-var import_node_fs15 = require("node:fs");
-var import_node_os = require("node:os");
-var import_node_path17 = require("node:path");
-function lockDir(projectRoot) {
-  if (projectRoot) {
-    return (0, import_node_path17.join)(projectRoot, ".launchsecure");
-  }
-  return (0, import_node_path17.join)((0, import_node_os.homedir)(), ".launchsecure");
-}
-function lockPath(projectRoot) {
-  return (0, import_node_path17.join)(lockDir(projectRoot), "launch-chart.lock");
-}
-var _activeProjectRoot;
-function readLock(projectRoot) {
-  const root = projectRoot ?? _activeProjectRoot;
-  const p = lockPath(root);
-  if (!(0, import_node_fs15.existsSync)(p)) {
-    if (root) {
-      const globalP = lockPath();
-      if ((0, import_node_fs15.existsSync)(globalP)) {
-        try {
-          const data = JSON.parse((0, import_node_fs15.readFileSync)(globalP, "utf-8"));
-          if (typeof data.pid === "number" && typeof data.port === "number" && data.cwd === root) {
-            return data;
-          }
-        } catch {
-        }
-      }
-    }
-    return null;
-  }
-  try {
-    const data = JSON.parse((0, import_node_fs15.readFileSync)(p, "utf-8"));
-    if (typeof data.pid !== "number" || typeof data.port !== "number") return null;
-    return data;
-  } catch {
-    return null;
-  }
+if (!import_node_worker_threads.parentPort) {
+  throw new Error("parse-worker-entry must be spawned as a worker thread");
 }
-function isPidAlive(pid) {
+async function run(req) {
   try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function getListenerPid(port) {
-  try {
-    const out = (0, import_node_child_process.execFileSync)("lsof", ["-nP", "-iTCP:" + port, "-sTCP:LISTEN", "-t"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 500
-    }).trim();
-    if (!out) return null;
-    const pid = parseInt(out.split("\n")[0], 10);
-    return Number.isFinite(pid) ? pid : null;
-  } catch {
-    return null;
-  }
-}
-function getLiveLock(projectRoot) {
-  const root = projectRoot ?? _activeProjectRoot;
-  const lock = readLock(root);
-  if (!lock) return null;
-  const listenerPid = getListenerPid(lock.port);
-  const live = listenerPid !== null ? listenerPid === lock.pid : isPidAlive(lock.pid);
-  if (!live) {
-    try {
-      (0, import_node_fs15.unlinkSync)(lockPath(root));
-    } catch {
-    }
-    return null;
-  }
-  return lock;
-}
-function writeLock(data, projectRoot) {
-  const root = projectRoot ?? _activeProjectRoot;
-  (0, import_node_fs15.mkdirSync)(lockDir(root), { recursive: true });
-  (0, import_node_fs15.writeFileSync)(lockPath(root), JSON.stringify(data, null, 2) + "\n", "utf-8");
-  if (root) _activeProjectRoot = root;
-}
-function clearLock(projectRoot) {
-  const root = projectRoot ?? _activeProjectRoot;
-  try {
-    (0, import_node_fs15.unlinkSync)(lockPath(root));
-  } catch {
-  }
-}
-
-// src/server/chart-serve.ts
-init_config();
-
-// src/server/graph/core/audit-core.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path18 = require("node:path");
-function readGraphFile(rootDir, layer) {
-  const filePath = (0, import_node_path18.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
-  if (!(0, import_node_fs16.existsSync)(filePath)) return null;
-  try {
-    return JSON.parse((0, import_node_fs16.readFileSync)(filePath, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function checkSchemaDrift(rootDir) {
-  const findings = [];
-  const db = readGraphFile(rootDir, "db");
-  if (!db) {
-    findings.push({ id: "no-db-graph", severity: "info", category: "schema_drift", title: "No DB graph", detail: "Run generate_graph first to populate the DB layer." });
-    return buildReport("db", "schema_drift", findings);
-  }
-  for (const c of db.contradictions ?? []) {
-    const isTableLevel = c.detail.includes("Table ") && (c.detail.includes("has no CREATE TABLE") || c.detail.includes("not in schema.prisma"));
-    findings.push({
-      id: `drift:${c.entity}`,
-      severity: isTableLevel ? "error" : "warning",
-      category: "schema_drift",
-      title: c.entity,
-      detail: c.detail
-    });
-  }
-  return buildReport("db", "schema_drift", findings);
-}
-function checkOrphanFks(rootDir) {
-  const findings = [];
-  const db = readGraphFile(rootDir, "db");
-  if (!db) return buildReport("db", "orphan_fks", findings);
-  for (const f of db.flagged_edges ?? []) {
-    findings.push({
-      id: `fk:${f.source}->${f.target}`,
-      severity: "warning",
-      category: "orphan_fks",
-      title: `${f.source} \u2192 ${f.target}`,
-      detail: f.label
+    await initTreeSitter();
+    const config = loadConfig(req.rootDir);
+    setExtractorConfig({
+      dbIdentifiers: config.parsers?.patterns?.dbIdentifiers,
+      mutationMethods: config.parsers?.patterns?.mutationMethods
     });
-  }
-  return buildReport("db", "orphan_fks", findings);
-}
-function checkUnprotectedRoutes(rootDir) {
-  const findings = [];
-  const api = readGraphFile(rootDir, "api");
-  const staticGraph = readGraphFile(rootDir, "static");
-  if (!api) return buildReport("api", "unprotected_routes", findings);
-  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
-  let routePermsContent = "";
-  if ((0, import_node_fs16.existsSync)(routePermsPath)) {
-    routePermsContent = (0, import_node_fs16.readFileSync)(routePermsPath, "utf-8");
-  }
-  const registeredRoutes = /* @__PURE__ */ new Set();
-  const routeEntryRe = /path:\s*'([^']+)'/g;
-  let rm;
-  while ((rm = routeEntryRe.exec(routePermsContent)) !== null) {
-    registeredRoutes.add(rm[1].replace(/:(\w+)/g, "[$1]"));
-  }
-  for (const node of api.nodes) {
-    if (node.type !== "endpoint") continue;
-    const route = node.route ?? "";
-    if (!route) continue;
-    const normalized = "/api" + (route.startsWith("/") ? route : "/" + route);
-    const isRegistered = registeredRoutes.has(normalized) || [...registeredRoutes].some((r) => routeMatchesPattern(normalized, r));
-    if (!isRegistered) {
-      const methods = node.methods ?? [];
-      findings.push({
-        id: `unprotected:${node.id}`,
-        severity: "warning",
-        category: "unprotected_routes",
-        title: `${methods.join(",")} ${route}`,
-        detail: `API endpoint has no entry in ROUTE_PERMISSIONS. Methods: ${methods.join(", ")}`,
-        file: node.id
-      });
-    }
-  }
-  return buildReport("api", "unprotected_routes", findings);
-}
-function routeMatchesPattern(route, pattern) {
-  const routeParts = route.split("/");
-  const patternParts = pattern.split("/");
-  if (routeParts.length !== patternParts.length) return false;
-  for (let i = 0; i < routeParts.length; i++) {
-    const rp = routeParts[i];
-    const pp = patternParts[i];
-    if (rp === pp) continue;
-    if (pp.startsWith("[") || pp.startsWith(":")) continue;
-    if (rp.startsWith("[") || rp.startsWith(":")) continue;
-    return false;
-  }
-  return true;
-}
-function checkDeadScreens(rootDir) {
-  const findings = [];
-  const ui = readGraphFile(rootDir, "ui");
-  if (!ui) return buildReport("ui", "dead_screens", findings);
-  const pages = ui.nodes.filter((n) => n.type === "page" || n.type === "layout");
-  const navTargets = /* @__PURE__ */ new Set();
-  for (const e of ui.edges) {
-    if (e.type === "navigates" || e.type === "renders" || e.type === "imports") {
-      navTargets.add(e.target);
-    }
-  }
-  for (const cr of ui.cross_refs ?? []) {
-    navTargets.add(cr.target);
-  }
-  for (const page of pages) {
-    if (page.id.endsWith("layout.tsx") && page.id.split("/").length <= 2) continue;
-    if (["error.tsx", "loading.tsx", "not-found.tsx", "template.tsx"].some((s) => page.id.endsWith(s))) continue;
-    if (!navTargets.has(page.id)) {
-      findings.push({
-        id: `dead:${page.id}`,
-        severity: "info",
-        category: "dead_screens",
-        title: page.name,
-        detail: `Page "${page.id}" has no incoming navigation, render, or import edges.`,
-        file: page.id
-      });
-    }
-  }
-  return buildReport("ui", "dead_screens", findings);
-}
-function checkUnenforcedPermissions(rootDir) {
-  const findings = [];
-  const staticGraph = readGraphFile(rootDir, "static");
-  if (!staticGraph) return buildReport("static", "unenforced_permissions", findings);
-  const permissions = staticGraph.nodes.filter((n) => n.type === "seed_permission").map((n) => ({ id: n.id, key: n.value, name: n.name }));
-  const routePermsPath = (0, import_node_path18.join)(rootDir, "src", "config", "route-permissions.ts");
-  let routePermsContent = "";
-  if ((0, import_node_fs16.existsSync)(routePermsPath)) {
-    routePermsContent = (0, import_node_fs16.readFileSync)(routePermsPath, "utf-8");
-  }
-  for (const perm of permissions) {
-    const regex = new RegExp(`permission:\\s*['"]${perm.key}['"]`);
-    if (!regex.test(routePermsContent)) {
-      findings.push({
-        id: `unenforced:${perm.key}`,
-        severity: "warning",
-        category: "unenforced_permissions",
-        title: `${perm.name} (${perm.key})`,
-        detail: `Permission "${perm.key}" exists in seed data but has no entry in ROUTE_PERMISSIONS \u2014 no API route requires it.`
-      });
-    }
-  }
-  return buildReport("static", "unenforced_permissions", findings);
-}
-function checkHardcodedValues(rootDir) {
-  const findings = [];
-  const staticGraph = readGraphFile(rootDir, "static");
-  if (!staticGraph) return buildReport("static", "hardcoded_values", findings);
-  const knownValues = /* @__PURE__ */ new Set();
-  for (const n of staticGraph.nodes) {
-    if (n.type === "enum_value") knownValues.add(n.value);
-  }
-  const api = readGraphFile(rootDir, "api");
-  if (!api) return buildReport("static", "hardcoded_values", findings);
-  const allCapsRe = /['"]([A-Z][A-Z_]{2,})['"]/g;
-  const seen = /* @__PURE__ */ new Set();
-  for (const node of api.nodes) {
-    if (node.type !== "endpoint") continue;
-    const filePath = (0, import_node_path18.join)(rootDir, "src", node.id);
-    if (!(0, import_node_fs16.existsSync)(filePath)) continue;
-    const content = (0, import_node_fs16.readFileSync)(filePath, "utf-8");
-    let m;
-    allCapsRe.lastIndex = 0;
-    while ((m = allCapsRe.exec(content)) !== null) {
-      const val = m[1];
-      if (knownValues.has(val)) continue;
-      if (["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS", "UTF", "NULL", "TRUE", "FALSE", "JSON", "HTML", "CSS", "ENV"].includes(val)) continue;
-      const key = `${node.id}:${val}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      findings.push({
-        id: `hardcoded:${key}`,
-        severity: "info",
-        category: "hardcoded_values",
-        title: `"${val}" in ${node.id}`,
-        detail: `ALL_CAPS string literal "${val}" appears in API code but is not in the enum/seed inventory. May be an unregistered constant.`,
-        file: node.id
-      });
-    }
-  }
-  return buildReport("static", "hardcoded_values", findings);
-}
-function buildReport(layer, check, findings) {
-  return {
-    layer,
-    check,
-    findings,
-    summary: {
-      errors: findings.filter((f) => f.severity === "error").length,
-      warnings: findings.filter((f) => f.severity === "warning").length,
-      info: findings.filter((f) => f.severity === "info").length
-    },
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-var CHECKS = {
-  db: {
-    schema_drift: checkSchemaDrift,
-    orphan_fks: checkOrphanFks
-  },
-  api: {
-    unprotected_routes: checkUnprotectedRoutes
-  },
-  ui: {
-    dead_screens: checkDeadScreens
-  },
-  static: {
-    unenforced_permissions: checkUnenforcedPermissions,
-    hardcoded_values: checkHardcodedValues
-  }
-};
-function getAvailableChecks() {
-  const result = {};
-  for (const [layer, checks] of Object.entries(CHECKS)) {
-    result[layer] = Object.keys(checks);
-  }
-  return result;
-}
-function runAudit(rootDir, layer, check) {
-  if (layer === "all") {
-    const reports = [];
-    for (const [l, checks] of Object.entries(CHECKS)) {
-      for (const fn of Object.values(checks)) {
-        reports.push(fn(rootDir));
-      }
-    }
-    return reports;
-  }
-  const layerChecks = CHECKS[layer];
-  if (!layerChecks) {
-    return [{
-      layer,
-      check: "unknown",
-      findings: [{ id: "invalid-layer", severity: "error", category: "system", title: "Invalid layer", detail: `Layer "${layer}" has no audit checks. Available: ${Object.keys(CHECKS).join(", ")}` }],
-      summary: { errors: 1, warnings: 0, info: 0 },
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    }];
-  }
-  if (check) {
-    const fn = layerChecks[check];
-    if (!fn) {
-      return [{
-        layer,
-        check,
-        findings: [{ id: "invalid-check", severity: "error", category: "system", title: "Invalid check", detail: `Check "${check}" not found for layer "${layer}". Available: ${Object.keys(layerChecks).join(", ")}` }],
-        summary: { errors: 1, warnings: 0, info: 0 },
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }];
-    }
-    return [fn(rootDir)];
-  }
-  return Object.values(layerChecks).map((fn) => fn(rootDir));
-}
-function formatAsPrompt(reports) {
-  const lines = [];
-  for (const report of reports) {
-    if (report.findings.length === 0) continue;
-    lines.push(`## ${report.layer.toUpperCase()} \u2014 ${report.check} (${report.findings.length} findings)`);
-    lines.push("");
-    for (const f of report.findings) {
-      const tag = f.severity === "error" ? "ERROR" : f.severity === "warning" ? "WARNING" : "INFO";
-      const filePart = f.file ? ` (${f.file}${f.line ? `:${f.line}` : ""})` : "";
-      lines.push(`- [${tag}] ${f.title}${filePart}`);
-      lines.push(`  ${f.detail}`);
-    }
-    lines.push("");
-  }
-  if (lines.length === 0) return "No audit findings.";
-  return lines.join("\n");
-}
-
-// src/server/chart-serve.ts
-var MAX_PORT_SCAN = 3;
-function randomPort() {
-  return 49152 + Math.floor(Math.random() * (65535 - 49152));
-}
-var MIME_TYPES = {
-  ".html": "text/html; charset=utf-8",
-  ".js": "application/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".png": "image/png",
-  ".svg": "image/svg+xml",
-  ".ico": "image/x-icon",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2"
-};
-function findProjectRoot(startDir) {
-  let dir = startDir;
-  for (let i = 0; i < 8; i++) {
-    const graphsDir2 = import_node_path19.default.join(dir, ".launchsecure", "graphs");
-    if (import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "ui.json")) || import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "api.json")) || import_node_fs17.default.existsSync(import_node_path19.default.join(graphsDir2, "db.json"))) return dir;
-    const parent = import_node_path19.default.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  dir = startDir;
-  for (let i = 0; i < 8; i++) {
-    if (import_node_fs17.default.existsSync(import_node_path19.default.join(dir, ".git"))) return dir;
-    const parent = import_node_path19.default.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return startDir;
-}
-function resolveRequestRoot(url, monorepoRoot, projects) {
-  const projectParam = url.searchParams.get("project");
-  if (!projectParam || projects.length === 0) return monorepoRoot;
-  const resolved = import_node_path19.default.resolve(monorepoRoot, projectParam);
-  if (!resolved.startsWith(monorepoRoot)) {
-    throw new Error("Project path outside monorepo root");
-  }
-  return resolved;
-}
-async function buildMergedGraph(root) {
-  let graphs = readAllGraphs(root);
-  if (Object.keys(graphs).length === 0) {
-    await generateGraph(root);
-    graphs = readAllGraphs(root);
-  }
-  const nodes = [];
-  const rawLinks = [];
-  for (const layer of Object.keys(graphs)) {
-    const g = graphs[layer];
-    if (!g) continue;
-    for (const n of g.nodes) {
-      nodes.push({
-        id: `${layer}:${n.id}`,
-        name: n.name,
-        type: n.type,
-        layer,
-        module: n.module ?? null,
-        path: n.path ?? n.id
-      });
-    }
-    for (const e of g.edges) {
-      rawLinks.push({ source: `${layer}:${e.source}`, target: `${layer}:${e.target}`, type: e.type, layer, cross: false });
-    }
-    for (const c of g.cross_refs ?? []) {
-      rawLinks.push({ source: `${layer}:${c.source}`, target: `${c.layer}:${c.target}`, type: c.type, layer, cross: true });
-    }
-  }
-  const nodeIds = new Set(nodes.map((n) => n.id));
-  const links = rawLinks.filter((l) => nodeIds.has(l.source) && nodeIds.has(l.target));
-  return {
-    nodes,
-    links,
-    stats: {
-      nodes: nodes.length,
-      links: links.length,
-      byLayer: {
-        ui: graphs.ui ? graphs.ui.nodes.length : 0,
-        api: graphs.api ? graphs.api.nodes.length : 0,
-        db: graphs.db ? graphs.db.nodes.length : 0
-      }
-    }
-  };
-}
-function serveStatic(res, filePath) {
-  if (!import_node_fs17.default.existsSync(filePath) || !import_node_fs17.default.statSync(filePath).isFile()) return false;
-  const ext = import_node_path19.default.extname(filePath).toLowerCase();
-  const mime = MIME_TYPES[ext] ?? "application/octet-stream";
-  res.writeHead(200, { "Content-Type": mime, "Cache-Control": "no-cache" });
-  import_node_fs17.default.createReadStream(filePath).pipe(res);
-  return true;
-}
-function serveIndex(res, clientDir) {
-  const indexPath = import_node_path19.default.join(clientDir, "index.html");
-  if (!import_node_fs17.default.existsSync(indexPath)) {
-    res.writeHead(500, { "Content-Type": "text/plain" });
-    res.end(`LaunchChart client bundle not found at ${clientDir}. Run 'npm run build:chart-client'.`);
-    return;
-  }
-  serveStatic(res, indexPath);
-}
-function tryListen(server, port) {
-  return new Promise((resolve3, reject) => {
-    const onError = (err) => {
-      server.off("listening", onListening);
-      reject(err);
-    };
-    const onListening = () => {
-      server.off("error", onError);
-      resolve3(port);
-    };
-    server.once("error", onError);
-    server.once("listening", onListening);
-    server.listen(port, "127.0.0.1");
-  });
-}
-async function bindWithFallback(server, startPort) {
-  let lastErr = null;
-  for (let i = 0; i < MAX_PORT_SCAN; i++) {
-    const port = startPort + i;
+    const failureCache = new ParseFailureCache(req.rootDir, getTreeSitterFingerprint());
+    if (!req.layer) failureCache.clearAll();
+    setActiveFailureCache(failureCache);
+    let results;
     try {
-      return await tryListen(server, port);
-    } catch (err) {
-      const code = err.code;
-      if (code === "EADDRINUSE") {
-        lastErr = err;
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw lastErr ?? new Error("Failed to bind any port");
-}
-async function startChartServer(opts = {}) {
-  const cwd = opts.cwd ?? process.cwd();
-  const projectRoot = findProjectRoot(cwd);
-  const existing = getLiveLock(projectRoot);
-  if (existing) {
-    if (!opts.quiet) {
-      process.stderr.write(
-        `[launch-chart] already running (pid ${existing.pid}) at ${existing.url}
-`
-      );
-    }
-    return { port: existing.port, url: existing.url };
-  }
-  const clientDir = opts.clientDir ?? import_node_path19.default.join(__dirname, "..", "chart-client");
-  const rootConfig = loadConfig(projectRoot);
-  const projects = rootConfig.projects ?? [];
-  const server = import_node_http.default.createServer((req, res) => {
-    try {
-      const url2 = new URL(req.url ?? "/", `http://${req.headers.host}`);
-      let reqRoot;
-      try {
-        reqRoot = resolveRequestRoot(url2, projectRoot, projects);
-      } catch (err) {
-        res.writeHead(400, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: false, error: String(err) }));
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/projects") {
-        const projectList = projects.length > 0 ? projects.map((p) => {
-          const absRoot = import_node_path19.default.resolve(projectRoot, p.root);
-          const hasGraphs = import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, ".launchsecure", "graphs"));
-          const hasNextConfig2 = import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.ts")) || import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.js")) || import_node_fs17.default.existsSync(import_node_path19.default.join(absRoot, "next.config.mjs"));
-          return { name: p.name, root: p.root, hasGraphs, hasNextConfig: hasNextConfig2 };
-        }) : [{ name: import_node_path19.default.basename(projectRoot), root: ".", hasGraphs: import_node_fs17.default.existsSync(import_node_path19.default.join(projectRoot, ".launchsecure", "graphs")), hasNextConfig: true }];
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ projects: projectList, monorepoRoot: projectRoot }));
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/project-graph") {
-        const regenerate = url2.searchParams.get("regenerate") === "1";
-        (async () => {
-          if (regenerate) await generateGraph(reqRoot);
-          const merged = await buildMergedGraph(reqRoot);
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({
-            ...merged,
-            debug: { cwd, projectRoot: reqRoot }
-          }));
-        })().catch((e) => {
-          res.writeHead(500);
-          res.end(String(e));
-        });
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/raw-graphs") {
-        const graphs = readAllGraphs(reqRoot);
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ui: graphs.ui ?? null, api: graphs.api ?? null, db: graphs.db ?? null }));
-        return;
-      }
-      if (req.method === "POST" && url2.pathname === "/api/generate-graph") {
-        (async () => {
-          await generateGraph(reqRoot);
-          const graphs = readAllGraphs(reqRoot);
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({
-            ok: true,
-            ui: graphs.ui ?? null,
-            api: graphs.api ?? null,
-            db: graphs.db ?? null
-          }));
-        })().catch((err) => {
-          res.writeHead(500, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: false, error: String(err) }));
-        });
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/file-content") {
-        const relPath = url2.searchParams.get("path");
-        if (!relPath || relPath.includes("..") || import_node_path19.default.isAbsolute(relPath)) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "Invalid path" }));
-          return;
-        }
-        const filePath = import_node_path19.default.join(reqRoot, relPath);
-        if (!filePath.startsWith(reqRoot) || !import_node_fs17.default.existsSync(filePath) || !import_node_fs17.default.statSync(filePath).isFile()) {
-          res.writeHead(404, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "File not found" }));
-          return;
-        }
-        const ext = import_node_path19.default.extname(filePath).toLowerCase();
-        const langMap = { ".ts": "typescript", ".tsx": "tsx", ".js": "javascript", ".jsx": "jsx", ".prisma": "prisma", ".json": "json", ".css": "css" };
-        const content = import_node_fs17.default.readFileSync(filePath, "utf-8");
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ content, language: langMap[ext] ?? "text", path: relPath }));
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/health") {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: true, projectRoot: reqRoot }));
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/parser-config") {
-        const config2 = loadConfig(reqRoot);
-        const registry = createRegistry(config2, reqRoot);
-        const toLabel = (id) => id.split("-").map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
-        const detection = [];
-        for (const parser of registry.getAll()) {
-          if ("layers" in parser && Array.isArray(parser.layers)) {
-            const mp = parser;
-            detection.push({ id: mp.id, layers: mp.layers, label: toLabel(mp.id), detected: mp.detect(reqRoot) });
-          } else if ("layer" in parser && parser.layer !== "crosslayer") {
-            const sp = parser;
-            detection.push({ id: sp.id, layers: [sp.layer], label: toLabel(sp.id), detected: sp.detect(reqRoot) });
-          }
-        }
-        const crosslayerParsers = {};
-        for (const p of registry.getCrossLayerParsers()) {
-          const concern = p.concern ?? "api-binding";
-          if (!crosslayerParsers[concern]) crosslayerParsers[concern] = [];
-          crosslayerParsers[concern].push({ id: p.id, label: toLabel(p.id) });
-        }
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ config: config2, detection, crosslayerParsers }));
-        return;
-      }
-      if (req.method === "POST" && url2.pathname === "/api/parser-config") {
-        let body = "";
-        req.on("data", (chunk) => {
-          body += chunk.toString();
-        });
-        req.on("end", () => {
-          try {
-            const newConfig = JSON.parse(body);
-            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
-            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(newConfig, null, 2) + "\n", "utf-8");
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true }));
-          } catch (err) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: String(err) }));
-          }
-        });
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/tagger-config") {
-        const config2 = loadConfig(reqRoot);
-        const builtinTaggers = [
-          { id: "module", tagKey: "module", trackUntagged: config2.taggers?.trackUntagged?.module ?? true },
-          { id: "screen", tagKey: "screen", trackUntagged: config2.taggers?.trackUntagged?.screen ?? true }
-        ];
-        const disabled = config2.taggers?.disabled ?? [];
-        const customTaggers = config2.taggers?.custom ?? [];
-        const moduleRules = config2.taggers?.module?.rules ?? [];
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ builtinTaggers, disabled, customTaggers, moduleRules }));
-        return;
-      }
-      if (req.method === "POST" && url2.pathname === "/api/tagger-config") {
-        let body = "";
-        req.on("data", (chunk) => {
-          body += chunk.toString();
-        });
-        req.on("end", () => {
-          try {
-            const taggerConfig = JSON.parse(body);
-            const config2 = loadConfig(reqRoot);
-            config2.taggers = taggerConfig;
-            const configPath = import_node_path19.default.join(reqRoot, ".launchchart.json");
-            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true }));
-          } catch (err) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: String(err) }));
-          }
-        });
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/tags") {
-        const store = readTagStore(reqRoot);
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(store));
-        return;
-      }
-      if (req.method === "POST" && url2.pathname === "/api/tags") {
-        let body = "";
-        req.on("data", (chunk) => {
-          body += chunk.toString();
-        });
-        req.on("end", () => {
-          try {
-            const { nodeId, key, value } = JSON.parse(body);
-            if (!nodeId || !key || !value) {
-              res.writeHead(400, { "Content-Type": "application/json" });
-              res.end(JSON.stringify({ ok: false, error: "nodeId, key, and value are required" }));
-              return;
-            }
-            setTag(reqRoot, nodeId, key, value);
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true }));
-          } catch (err) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: String(err) }));
-          }
-        });
-        return;
-      }
-      if (req.method === "DELETE" && url2.pathname === "/api/tags") {
-        let body = "";
-        req.on("data", (chunk) => {
-          body += chunk.toString();
-        });
-        req.on("end", () => {
-          try {
-            const { nodeId, key } = JSON.parse(body);
-            if (!nodeId || !key) {
-              res.writeHead(400, { "Content-Type": "application/json" });
-              res.end(JSON.stringify({ ok: false, error: "nodeId and key are required" }));
-              return;
-            }
-            removeTag(reqRoot, nodeId, key);
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true }));
-          } catch (err) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: String(err) }));
-          }
-        });
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/detected-paths") {
-        const config2 = loadConfig(reqRoot);
-        const paths = resolveProjectPaths(reqRoot, config2);
-        const overrides = {
-          appDir: !!config2.paths?.appDir,
-          dbDir: !!config2.paths?.dbDir
-        };
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({
-          projectRoot: reqRoot,
-          detected: paths ? {
-            srcDir: import_node_path19.default.relative(reqRoot, paths.srcDir) || ".",
-            appDir: import_node_path19.default.relative(reqRoot, paths.appDir),
-            apiDir: import_node_path19.default.relative(reqRoot, paths.apiDir),
-            dbDir: paths.dbDir ? import_node_path19.default.relative(reqRoot, paths.dbDir) : null
-          } : null,
-          overrides,
-          isOverride: overrides.appDir
-        }));
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/browse-dir") {
-        const browsePath = url2.searchParams.get("path") || projectRoot;
-        const abs = import_node_path19.default.resolve(browsePath);
-        const twoUp = import_node_path19.default.resolve(projectRoot, "..", "..");
-        if (!abs.startsWith(twoUp)) {
-          res.writeHead(403, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: false, error: "Path outside allowed range" }));
-          return;
-        }
-        try {
-          const entries = import_node_fs17.default.readdirSync(abs, { withFileTypes: true });
-          const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules" && e.name !== "dist" && e.name !== ".next").map((e) => e.name).sort();
-          const parent = abs !== twoUp ? import_node_path19.default.dirname(abs) : null;
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ current: abs, parent, dirs, relative: import_node_path19.default.relative(projectRoot, abs) || "." }));
-        } catch (err) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: false, error: String(err) }));
-        }
-        return;
-      }
-      if (req.method === "GET" && url2.pathname === "/api/audit") {
-        const layer = url2.searchParams.get("layer") ?? "all";
-        const check = url2.searchParams.get("check") ?? void 0;
-        const reports = runAudit(reqRoot, layer, check);
-        const prompt = formatAsPrompt(reports);
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ reports, prompt, checks: getAvailableChecks() }));
-        return;
-      }
-      if (req.method === "POST" && url2.pathname === "/api/projects") {
-        let body = "";
-        req.on("data", (chunk) => {
-          body += chunk.toString();
-        });
-        req.on("end", () => {
-          try {
-            const { projects: newProjects } = JSON.parse(body);
-            const config2 = loadConfig(projectRoot);
-            config2.projects = newProjects.length > 0 ? newProjects : void 0;
-            const configPath = import_node_path19.default.join(projectRoot, ".launchchart.json");
-            import_node_fs17.default.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
-            projects.length = 0;
-            if (config2.projects) projects.push(...config2.projects);
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: true }));
-          } catch (err) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: String(err) }));
-          }
-        });
-        return;
-      }
-      if (url2.pathname !== "/") {
-        const staticPath = import_node_path19.default.join(clientDir, url2.pathname);
-        if (serveStatic(res, staticPath)) return;
-      }
-      serveIndex(res, clientDir);
-    } catch (err) {
-      res.writeHead(500, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: String(err) }));
-    }
-  });
-  const config = loadConfig(projectRoot);
-  const startPort = opts.port ?? config.port ?? randomPort();
-  const port = await bindWithFallback(server, startPort);
-  const url = `http://localhost:${port}`;
-  writeLock({
-    pid: process.pid,
-    port,
-    cwd,
-    url,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }, projectRoot);
-  const cleanup = () => {
-    clearLock(projectRoot);
-    server.close();
-  };
-  process.once("SIGINT", () => {
-    cleanup();
-    process.exit(0);
-  });
-  process.once("SIGTERM", () => {
-    cleanup();
-    process.exit(0);
-  });
-  process.once("exit", cleanup);
-  if (!opts.quiet) {
-    process.stderr.write(`[launch-chart] serving ${url}
-`);
-    process.stderr.write(`[launch-chart] project root: ${projectRoot}
-`);
-    if (projects.length > 0) {
-      process.stderr.write(`[launch-chart] multi-project mode: ${projects.length} projects
-`);
-    }
-  }
-  return { port, url };
-}
-function runServeCli(argv) {
-  let port;
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === "--port" && argv[i + 1]) {
-      port = parseInt(argv[++i], 10);
-    } else if (argv[i].startsWith("--port=")) {
-      port = parseInt(argv[i].slice("--port=".length), 10);
+      results = req.layer ? [generateLayer(req.rootDir, req.layer)].filter((r) => r !== null) : generateAll(req.rootDir);
+    } finally {
+      failureCache.flush();
+      setActiveFailureCache(null);
     }
+    const failedFiles = failureCache.list().map((f) => f.path);
+    return { ok: true, results, failedFiles };
+  } catch (e) {
+    const err = e instanceof Error ? e : new Error(String(e));
+    return { ok: false, error: { name: err.name, message: err.message, stack: err.stack } };
   }
-  startChartServer({ port }).catch((err) => {
-    process.stderr.write(`[launch-chart] failed to start: ${err}
-`);
-    process.exit(1);
-  });
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  runServeCli,
-  startChartServer
+import_node_worker_threads.parentPort.once("message", async (msg) => {
+  const reply = await run(msg);
+  import_node_worker_threads.parentPort.postMessage(reply);
 });