@launchsecure/launch-kit 0.0.30 → 0.0.32

package/dist/server/graph-mcp-entry.js

@@ -8361,9 +8361,13 @@ function runReadGraphQueryRaw(rootDir, args) {
   const minimal = args.minimal ?? layerIsDb;
   const includeEdges = args.include_edges;
   const includeFindings = args.include_findings === true;
+  const tagPredicates = Array.isArray(args.tag_predicates) ? args.tag_predicates : void 0;
+  const includeCrossRefs = args.include_cross_refs === true;
+  const crossRefType = args.cross_ref_type;
+  const edgeConfidence = Array.isArray(args.edge_confidence) ? new Set(args.edge_confidence.map((s) => String(s).toLowerCase())) : void 0;
   const offset = args.offset ?? 0;
   const limit = args.limit;
-  const hasFilter = !!(search || type || module_ || nodeId || tagKey && tagValue);
+  const hasFilter = !!(search || type || module_ || nodeId || tagKey && tagValue || tagPredicates && tagPredicates.length > 0);
   if (layer) {
     const available = getAvailableLayers(rootDir);
     if (available.length > 0 && !available.includes(layer)) {
@@ -8414,6 +8418,14 @@ function runReadGraphQueryRaw(rootDir, args) {
       result2.contradictions = graph.contradictions ?? [];
       result2.flagged_edges = graph.flagged_edges ?? [];
     }
+    const neighborhoodIds = new Set(nb.nodes.map((n) => n.id));
+    attachCrossRefsAndFlagged(result2, graph, neighborhoodIds, {
+      includeCrossRefs,
+      crossRefType,
+      edgeConfidence,
+      scopeToIds: true,
+      layer
+    });
     return result2;
   }
   if (!hasFilter) {
@@ -8434,6 +8446,11 @@ function runReadGraphQueryRaw(rootDir, args) {
     const nodeTags = n.tags;
     if (module_ && nodeTags?.module !== module_) return false;
     if (tagKey && tagValue && nodeTags?.[tagKey] !== tagValue) return false;
+    if (tagPredicates && tagPredicates.length > 0) {
+      for (const p of tagPredicates) {
+        if (!evaluatePredicate(n, p)) return false;
+      }
+    }
     return true;
   });
   if (matched.length === 0) {
@@ -8481,8 +8498,89 @@ function runReadGraphQueryRaw(rootDir, args) {
     result.contradictions = graph.contradictions ?? [];
     result.flagged_edges = graph.flagged_edges ?? [];
   }
+  attachCrossRefsAndFlagged(result, graph, returnedIds, {
+    includeCrossRefs,
+    crossRefType,
+    edgeConfidence,
+    scopeToIds: true,
+    layer
+  });
   return result;
 }
+function attachCrossRefsAndFlagged(result, graph, scopeIds, opts) {
+  if (opts.includeCrossRefs) {
+    const allCrossRefs = graph.cross_refs ?? [];
+    const crossRefsByNode = {};
+    for (const id of scopeIds) {
+      crossRefsByNode[id] = { outgoing: [], incoming: [] };
+    }
+    for (const cr of allCrossRefs) {
+      if (opts.crossRefType && cr.type !== opts.crossRefType) continue;
+      if (crossRefsByNode[cr.source]) crossRefsByNode[cr.source].outgoing.push(cr);
+      if (crossRefsByNode[cr.target]) crossRefsByNode[cr.target].incoming.push(cr);
+    }
+    result.cross_refs = crossRefsByNode;
+    if (opts.crossRefType) result.cross_ref_type = opts.crossRefType;
+    if (allCrossRefs.length === 0) {
+      result.parser_warning = parserWarning([opts.layer], "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)");
+    }
+  }
+  if (opts.edgeConfidence && opts.edgeConfidence.size > 0) {
+    const allFlagged = graph.flagged_edges ?? [];
+    const useScope = opts.scopeToIds && scopeIds.size > 0;
+    result.flagged_edges = allFlagged.filter((fe) => {
+      if (!opts.edgeConfidence.has(String(fe.confidence).toLowerCase())) return false;
+      if (useScope && !scopeIds.has(fe.source) && !scopeIds.has(fe.target)) return false;
+      return true;
+    });
+    if (allFlagged.length === 0 && !result.parser_warning) {
+      result.parser_warning = parserWarning([opts.layer], "flagged_edges", opts.layer === "db" ? "sql-migrations parser" : "cross-layer parsers");
+    }
+  }
+}
+function parserWarning(layers, capability, parserName) {
+  return `The ${capability} data is empty in scanned layer(s): ${layers.join(", ")}. This likely means the ${parserName} did not produce output for this project \u2014 run detect_project_stack to verify parser configuration, then generate_graph to refresh. (If the parser IS configured and the source data is genuinely empty, ignore this warning.)`;
+}
+function evaluatePredicate(node, p) {
+  if (!p.field || !p.op) return true;
+  const tags = node.tags;
+  const fromTag = tags?.[p.field];
+  const fromField = node[p.field];
+  const present = fromTag !== void 0 || fromField !== void 0;
+  if (p.op === "exists") return present;
+  if (p.op === "not_exists") return !present;
+  if (!present) return false;
+  const raw = fromTag !== void 0 ? coerceTagValue(fromTag, p.value) : fromField;
+  switch (p.op) {
+    case "eq":
+      return raw === p.value;
+    case "ne":
+      return raw !== p.value;
+    case "gt":
+      return typeof raw === "number" && typeof p.value === "number" && raw > p.value;
+    case "lt":
+      return typeof raw === "number" && typeof p.value === "number" && raw < p.value;
+    case "gte":
+      return typeof raw === "number" && typeof p.value === "number" && raw >= p.value;
+    case "lte":
+      return typeof raw === "number" && typeof p.value === "number" && raw <= p.value;
+    case "in":
+      return Array.isArray(p.value) && p.value.includes(raw);
+    default:
+      return false;
+  }
+}
+function coerceTagValue(raw, target) {
+  if (typeof target === "boolean") {
+    if (raw === "true") return true;
+    if (raw === "false") return false;
+  }
+  if (typeof target === "number") {
+    const n = Number(raw);
+    if (!Number.isNaN(n)) return n;
+  }
+  return raw;
+}
 function runReadGraphQuery(rootDir, args) {
   const raw = runReadGraphQueryRaw(rootDir, args);
   return compactResult(raw);
@@ -8593,8 +8691,23 @@ function handleInspectNode(args) {
   } else {
     matched = graph.nodes;
   }
-  const allDeepFields = ["elements", "stateVars", "conditions", "variables", "responses", "params", "effects", "ui_labels", "notes"];
+  const allDeepFields = ["elements", "stateVars", "conditions", "variables", "responses", "params", "effects", "ui_labels", "notes", "crossRefs"];
   const requestedFields = fields ?? allDeepFields;
+  const crossRefTypeArg = args.cross_ref_type;
+  const wantCrossRefs = requestedFields.includes("crossRefs");
+  let crossRefsBySource = null;
+  let crossRefsByTarget = null;
+  if (wantCrossRefs) {
+    crossRefsBySource = /* @__PURE__ */ new Map();
+    crossRefsByTarget = /* @__PURE__ */ new Map();
+    for (const cr of graph.cross_refs ?? []) {
+      if (crossRefTypeArg && cr.type !== crossRefTypeArg) continue;
+      if (!crossRefsBySource.has(cr.source)) crossRefsBySource.set(cr.source, []);
+      crossRefsBySource.get(cr.source).push(cr);
+      if (!crossRefsByTarget.has(cr.target)) crossRefsByTarget.set(cr.target, []);
+      crossRefsByTarget.get(cr.target).push(cr);
+    }
+  }
   let filterRegex = null;
   if (filter) {
     try {
@@ -8617,7 +8730,14 @@ function handleInspectNode(args) {
     const deep = { id: node.id, name: node.name, type: node.type };
     let hasData = false;
     for (const field of requestedFields) {
-      if (allDeepFields.includes(field) && node[field] != null) {
+      if (field === "crossRefs") {
+        const outgoing = crossRefsBySource?.get(node.id) ?? [];
+        const incoming = crossRefsByTarget?.get(node.id) ?? [];
+        if (outgoing.length > 0 || incoming.length > 0) {
+          deep.crossRefs = { outgoing, incoming };
+          hasData = true;
+        }
+      } else if (allDeepFields.includes(field) && node[field] != null) {
         deep[field] = node[field];
         hasData = true;
       }
@@ -8641,10 +8761,14 @@ function handleInspectNode(args) {
     const hint = filter ? `No nodes with deep fields matching /${filter}/${caseInsensitive ? "i" : ""} in ${layer} layer.` : `No nodes matching "${search}" in ${layer} layer.`;
     return err(hint);
   }
+  const wantedCrossRefs = wantCrossRefs;
+  const graphHasNoCrossRefs = (graph.cross_refs ?? []).length === 0;
+  const extraWarning = wantedCrossRefs && graphHasNoCrossRefs ? { parser_warning: parserWarning([layer], "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)") } : {};
   return okJson({
     layer,
     matched: results.length,
     ...results.length >= maxResults ? { truncated: true, hint: `Showing first ${maxResults} matches. Narrow with search param.` } : {},
+    ...extraWarning,
     nodes: results
   });
 }
@@ -8850,13 +8974,19 @@ function handleEffectsIndex(args) {
   const __resolved = resolveOrErr(args);
   if ("content" in __resolved) return __resolved;
   const { rootDir } = __resolved;
+  const kind = args.kind ?? "collisions";
+  const key = args.key;
+  const MAX_KEYS = 200;
+  if (kind === "fetch_calls") {
+    return okJson(buildFetchCallsIndex(rootDir, key, MAX_KEYS));
+  }
+  if (kind === "api_effects") {
+    return okJson(buildApiEffectsIndex(rootDir, key, MAX_KEYS));
+  }
   const idx = readEffectsIndex(rootDir);
   if (!idx) {
     return err("No effects-index.json found. Run generate_graph first (or wait for the file-watcher to fire).");
   }
-  const kind = args.kind ?? "collisions";
-  const key = args.key;
-  const MAX_KEYS = 200;
   if (kind === "singleton_risks") {
     return okJson({ kind, count: idx.singleton_risks.length, nodes: idx.singleton_risks });
   }
@@ -8870,7 +9000,7 @@ function handleEffectsIndex(args) {
   }
   const map = idx[kind];
   if (!map || typeof map !== "object") {
-    return err(`Unknown kind "${kind}". Valid: dom_ids, window_events, storage_keys, fetch_urls, timers, singleton_risks, collisions.`);
+    return err(`Unknown kind "${kind}". Valid: dom_ids, window_events, storage_keys, fetch_urls, timers, singleton_risks, collisions, fetch_calls, api_effects.`);
   }
   if (key) {
     const nodes = map[key] ?? [];
@@ -8888,6 +9018,97 @@ function handleEffectsIndex(args) {
     results
   });
 }
+function buildFetchCallsIndex(rootDir, key, maxKeys) {
+  const ui = readGraph(rootDir, "ui");
+  if (!ui) return { kind: "fetch_calls", error: "No ui graph found. Run generate_graph first." };
+  const inverted = /* @__PURE__ */ new Map();
+  let callsApiCount = 0;
+  for (const cr of ui.cross_refs ?? []) {
+    if (cr.type !== "calls_api") continue;
+    callsApiCount++;
+    if (!inverted.has(cr.target)) inverted.set(cr.target, /* @__PURE__ */ new Set());
+    inverted.get(cr.target).add(cr.source);
+  }
+  for (const n of ui.nodes) {
+    const eff = n.effects;
+    if (!eff?.fetches) continue;
+    for (const f of eff.fetches) {
+      if (!inverted.has(f)) inverted.set(f, /* @__PURE__ */ new Set());
+      inverted.get(f).add(n.id);
+    }
+  }
+  const allCrossRefs = ui.cross_refs ?? [];
+  const fetchResolverAbsent = callsApiCount === 0 && allCrossRefs.length === 0;
+  const partialResolverGap = callsApiCount === 0 && inverted.size > 0;
+  if (key) {
+    return {
+      kind: "fetch_calls",
+      key,
+      callers: [...inverted.get(key) ?? []],
+      ...fetchResolverAbsent ? { parser_warning: parserWarning(["ui"], "cross_refs", "fetch-resolver cross-layer parser") } : {},
+      ...partialResolverGap ? { parser_warning: "No calls_api cross_refs found \u2014 fetch-resolver may not be enabled. Only raw fetch() strings from ui.node.effects.fetches are indexed; resolved-to-endpoint links are missing." } : {}
+    };
+  }
+  const entries = [...inverted.entries()].sort((a, b) => b[1].size - a[1].size);
+  const truncated = entries.length > maxKeys;
+  const results = {};
+  for (const [k, v] of entries.slice(0, maxKeys)) results[k] = [...v];
+  return {
+    kind: "fetch_calls",
+    total_keys: entries.length,
+    ...truncated ? { truncated: true, showing: maxKeys, hint: "Pass `key` (endpoint path or URL template) to look up callers." } : {},
+    ...fetchResolverAbsent ? { parser_warning: parserWarning(["ui"], "cross_refs", "fetch-resolver cross-layer parser") } : {},
+    ...partialResolverGap ? { parser_warning: "No calls_api cross_refs found \u2014 fetch-resolver may not be enabled. Only raw fetch() strings from ui.node.effects.fetches are indexed; resolved-to-endpoint links are missing." } : {},
+    results
+  };
+}
+function buildApiEffectsIndex(rootDir, key, maxKeys) {
+  const api = readGraph(rootDir, "api");
+  if (!api) return { kind: "api_effects", error: "No api graph found. Run generate_graph first." };
+  const categories = ["calls", "fetches", "persists", "subscribes", "timers", "dom_writes", "globals"];
+  const inverted = {};
+  for (const c of categories) inverted[c] = /* @__PURE__ */ new Map();
+  for (const n of api.nodes) {
+    const eff = n.effects;
+    if (!eff) continue;
+    for (const c of categories) {
+      const items = eff[c];
+      if (!Array.isArray(items)) continue;
+      for (const item of items) {
+        if (!inverted[c].has(item)) inverted[c].set(item, /* @__PURE__ */ new Set());
+        inverted[c].get(item).add(n.id);
+      }
+    }
+  }
+  if (key) {
+    const hits = {};
+    for (const c of categories) {
+      const endpoints = inverted[c].get(key);
+      if (endpoints && endpoints.size > 0) hits[c] = [...endpoints];
+    }
+    return { kind: "api_effects", key, hits };
+  }
+  const TOP_CATEGORIES = Math.min(maxKeys, 50);
+  const TOP_CALLERS = 10;
+  const summary = {};
+  for (const c of categories) {
+    const entries = [...inverted[c].entries()].sort((a, b) => b[1].size - a[1].size);
+    const top = {};
+    for (const [k, v] of entries.slice(0, TOP_CATEGORIES)) {
+      const endpoints = [...v];
+      top[k] = {
+        count: endpoints.length,
+        sample_endpoints: endpoints.slice(0, TOP_CALLERS)
+      };
+    }
+    summary[c] = { total_items: entries.length, top };
+  }
+  return {
+    kind: "api_effects",
+    hint: `Summary mode: top ${TOP_CATEGORIES} items per category, top ${TOP_CALLERS} endpoints per item. Pass \`key\` (a specific call/url/event) to get the FULL caller list across all categories.`,
+    summary
+  };
+}
 function handleChartServerStatus() {
   const rootDir = process.cwd();
   const lock = getLiveLock(rootDir);
@@ -9001,6 +9222,296 @@ function handleRemoveTag(args) {
   removeTag(rootDir, nodeId, key);
   return okJson({ ok: true, node_id: nodeId, removed_key: key });
 }
+function handleMigrationAudit(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const requireOrphan = args.require_orphan_check !== false;
+  const requireBackup = args.require_sidecar_backup !== false;
+  const requirePreFlight = args.require_pre_flight_notice !== false;
+  const includeSafe = args.include_safe === true;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const db = readGraph(rootDir, "db");
+  if (!db) return err("No db graph found. Run generate_graph first.");
+  const migrations = db.nodes.filter((n) => n.type === "migration");
+  const audit = [];
+  for (const m of migrations) {
+    const isDestructive = m.is_destructive === true;
+    if (!isDestructive && !includeSafe) continue;
+    const violations = [];
+    if (isDestructive) {
+      if (requireOrphan && m.has_orphan_check !== true) violations.push("missing_orphan_check");
+      if (requireBackup && m.has_sidecar_backup !== true) violations.push("missing_sidecar_backup");
+      if (requirePreFlight && m.has_pre_flight_notice !== true) violations.push("missing_pre_flight_notice");
+    }
+    if (!isDestructive && includeSafe && violations.length === 0) {
+      audit.push({ id: m.id, name: m.name, timestamp: m.timestamp, is_destructive: false, status: "safe" });
+      continue;
+    }
+    if (violations.length === 0 && !includeSafe) continue;
+    audit.push({
+      id: m.id,
+      name: m.name,
+      timestamp: m.timestamp,
+      filepath: m.filepath,
+      is_destructive: isDestructive,
+      contains_drop_column: m.contains_drop_column === true,
+      contains_drop_table: m.contains_drop_table === true,
+      contains_backfill: m.contains_backfill === true,
+      has_orphan_check: m.has_orphan_check === true,
+      has_sidecar_backup: m.has_sidecar_backup === true,
+      has_pre_flight_notice: m.has_pre_flight_notice === true,
+      statement_count: m.statement_count,
+      violations,
+      status: violations.length === 0 ? "safe" : "unsafe"
+    });
+  }
+  audit.sort((a, b) => String(b.timestamp ?? "").localeCompare(String(a.timestamp ?? "")));
+  const total = audit.length;
+  const page = audit.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  return okJson({
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    items: page,
+    discipline: "Layer 1 (expand-and-contract) + Layer 2 (pg_dump wrapper) + Layer 3 (in-migration SQL guards) per CLAUDE.md. This tool checks Layer 3 only."
+  });
+}
+function handleDriftReport(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const layerArg = args.layer;
+  const kind = args.kind ?? "all";
+  const confidenceArg = Array.isArray(args.confidence) ? new Set(args.confidence.map((s) => String(s).toLowerCase())) : void 0;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const layers = layerArg ? [layerArg] : getAvailableLayers(rootDir);
+  const items = [];
+  const layersWithAnyFinding = [];
+  for (const layer of layers) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    const cs = g.contradictions ?? [];
+    const fes = g.flagged_edges ?? [];
+    if (cs.length > 0 || fes.length > 0) layersWithAnyFinding.push(layer);
+    if (kind === "all" || kind === "contradictions") {
+      for (const c of cs) {
+        items.push({ layer, kind: "contradiction", entity: c.entity, source_a: c.source_a, source_b: c.source_b, detail: c.detail });
+      }
+    }
+    if (kind === "all" || kind === "flagged_edges") {
+      for (const fe of fes) {
+        if (confidenceArg && !confidenceArg.has(String(fe.confidence).toLowerCase())) continue;
+        items.push({
+          layer,
+          kind: "flagged_edge",
+          source: fe.source,
+          target: fe.target,
+          edge_type: fe.type,
+          confidence: fe.confidence,
+          label: fe.label
+        });
+      }
+    }
+  }
+  const total = items.length;
+  const page = items.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layers.length > 0 && layersWithAnyFinding.length === 0;
+  return okJson({
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    layers_scanned: layers,
+    ...parserAbsent ? { parser_warning: parserWarning(layers, "contradictions + flagged_edges", layers.includes("db") ? "sql-migrations parser and/or cross-layer parsers" : "cross-layer parsers") } : {},
+    items: page
+  });
+}
+function handleWhoUses(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const target = args.target;
+  if (!target) return err("target is required");
+  const filterType = args.cross_ref_type;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const hits = [];
+  const layersScanned = [];
+  const layersWithCrossRefs = [];
+  for (const layer of getAvailableLayers(rootDir)) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    layersScanned.push(layer);
+    const crs = g.cross_refs ?? [];
+    if (crs.length > 0) layersWithCrossRefs.push(layer);
+    for (const cr of crs) {
+      if (cr.target !== target) continue;
+      if (filterType && cr.type !== filterType) continue;
+      const entry = {
+        source_layer: layer,
+        source: cr.source,
+        cross_ref_type: cr.type,
+        target_layer: cr.layer
+      };
+      const via = cr.via;
+      if (Array.isArray(via)) entry.via = via;
+      hits.push(entry);
+    }
+  }
+  hits.sort((a, b) => String(a.source).localeCompare(String(b.source)));
+  const total = hits.length;
+  const page = hits.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layersScanned.length > 0 && layersWithCrossRefs.length === 0;
+  return okJson({
+    target,
+    ...filterType ? { cross_ref_type: filterType } : {},
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    ...parserAbsent ? { parser_warning: parserWarning(layersScanned, "cross_refs", "cross-layer references parser(s) (fetch-resolver / api-annotations / url-literal-scanner / static-ref-scanner)") } : {},
+    items: page
+  });
+}
+function handleTracePath(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const from = args.from;
+  const to = args.to;
+  if (!from || !to) return err("from and to are required");
+  const maxHops = args.max_hops ?? 5;
+  const maxPaths = args.max_paths ?? 10;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const outgoing = /* @__PURE__ */ new Map();
+  const layersScanned = [];
+  const layersWithCrossRefs = [];
+  for (const layer of getAvailableLayers(rootDir)) {
+    const g = readGraph(rootDir, layer);
+    if (!g) continue;
+    layersScanned.push(layer);
+    if ((g.cross_refs ?? []).length > 0) layersWithCrossRefs.push(layer);
+    for (const cr of g.cross_refs ?? []) {
+      const via = cr.via;
+      if (Array.isArray(via) && via.length > 0) {
+        let prev = cr.source;
+        for (const step of via) {
+          pushEdge(outgoing, { from: prev, to: step, type: cr.type, layer: cr.layer });
+          prev = step;
+        }
+        pushEdge(outgoing, { from: prev, to: cr.target, type: cr.type, layer: cr.layer });
+      } else {
+        pushEdge(outgoing, { from: cr.source, to: cr.target, type: cr.type, layer: cr.layer });
+      }
+    }
+    for (const e of g.edges ?? []) {
+      pushEdge(outgoing, { from: e.source, to: e.target, type: e.type, layer });
+    }
+  }
+  const paths = [];
+  const queue = [{ nodes: [from], edges: [] }];
+  while (queue.length > 0 && paths.length < maxPaths) {
+    const p = queue.shift();
+    const tail = p.nodes[p.nodes.length - 1];
+    if (tail === to && p.nodes.length > 1) {
+      paths.push(p);
+      continue;
+    }
+    if (p.nodes.length > maxHops) continue;
+    const next = outgoing.get(tail) ?? [];
+    for (const e of next) {
+      if (p.nodes.includes(e.to)) continue;
+      queue.push({ nodes: [...p.nodes, e.to], edges: [...p.edges, e] });
+    }
+  }
+  paths.sort((a, b) => a.nodes.length - b.nodes.length);
+  const total = paths.length;
+  const page = paths.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  const parserAbsent = layersScanned.length > 0 && layersWithCrossRefs.length === 0;
+  return okJson({
+    from,
+    to,
+    max_hops: maxHops,
+    max_paths: maxPaths,
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    ...total === maxPaths ? { search_capped: true, hint: "Hit max_paths cap \u2014 more paths may exist. Raise max_paths or narrow from/to." } : {},
+    ...parserAbsent ? { parser_warning: parserWarning(layersScanned, "cross_refs", "cross-layer references parser(s)") + " Cross-layer paths are unreachable without cross_refs; only same-layer paths (imports/renders/belongs_to) are visible." } : {},
+    paths: page.map((p) => ({ hops: p.nodes.length - 1, nodes: p.nodes, edges: p.edges }))
+  });
+}
+function pushEdge(map, e) {
+  if (!map.has(e.from)) map.set(e.from, []);
+  map.get(e.from).push(e);
+}
+function handleAuthCoverageReport(args) {
+  const __resolved = resolveOrErr(args);
+  if ("content" in __resolved) return __resolved;
+  const { rootDir } = __resolved;
+  const moduleFilter = args.module;
+  const strategyFilter = args.strategy;
+  const offset = args.offset ?? 0;
+  const limit = args.limit ?? 10;
+  const api = readGraph(rootDir, "api");
+  if (!api) return err("No api graph found. Run generate_graph first.");
+  const byStrategy = {};
+  const byModule = {};
+  const unauthenticated = [];
+  const matchedEndpoints = [];
+  for (const n of api.nodes) {
+    const tags = n.tags;
+    const moduleTag = tags?.module ?? "root";
+    const auth = n.auth ?? [];
+    const strategyKey = auth.length === 0 ? "none" : auth.slice().sort().join("+");
+    byStrategy[strategyKey] = (byStrategy[strategyKey] ?? 0) + 1;
+    if (!byModule[moduleTag]) byModule[moduleTag] = { total: 0, by_strategy: {} };
+    byModule[moduleTag].total += 1;
+    byModule[moduleTag].by_strategy[strategyKey] = (byModule[moduleTag].by_strategy[strategyKey] ?? 0) + 1;
+    if (auth.length === 0) unauthenticated.push(n.id);
+    if (moduleFilter && moduleTag !== moduleFilter) continue;
+    if (strategyFilter && strategyKey !== strategyFilter) continue;
+    matchedEndpoints.push({
+      id: n.id,
+      path: n.path,
+      methods: n.methods,
+      module: moduleTag,
+      auth,
+      mutates: n.mutates === true
+    });
+  }
+  matchedEndpoints.sort((a, b) => String(a.path ?? a.id).localeCompare(String(b.path ?? b.id)));
+  const total = matchedEndpoints.length;
+  const page = matchedEndpoints.slice(offset, offset + limit);
+  const hasMore = offset + page.length < total;
+  return okJson({
+    total_endpoints: api.nodes.length,
+    by_strategy: byStrategy,
+    unauthenticated_count: unauthenticated.length,
+    by_module: byModule,
+    filter: { module: moduleFilter, strategy: strategyFilter },
+    total,
+    returned: page.length,
+    offset,
+    has_more: hasMore,
+    ...hasMore ? { next_offset: offset + page.length } : {},
+    items: page
+  });
+}
 function handleAuditLayer(args) {
   const __resolved = resolveOrErr(args);
   if ("content" in __resolved) return __resolved;
@@ -9214,6 +9725,26 @@ async function handleMessage(msg) {
       respond(id ?? null, withFreshnessMeta(handleListNotes(args), args));
       return;
     }
+    if (toolName === "migration_audit") {
+      respond(id ?? null, withFreshnessMeta(handleMigrationAudit(args), args));
+      return;
+    }
+    if (toolName === "drift_report") {
+      respond(id ?? null, withFreshnessMeta(handleDriftReport(args), args));
+      return;
+    }
+    if (toolName === "who_uses") {
+      respond(id ?? null, withFreshnessMeta(handleWhoUses(args), args));
+      return;
+    }
+    if (toolName === "trace_path") {
+      respond(id ?? null, withFreshnessMeta(handleTracePath(args), args));
+      return;
+    }
+    if (toolName === "auth_coverage_report") {
+      respond(id ?? null, withFreshnessMeta(handleAuthCoverageReport(args), args));
+      return;
+    }
     respondError(id ?? null, -32601, `Unknown tool: ${toolName}`);
     return;
   }
@@ -9371,6 +9902,32 @@ var init_graph_mcp = __esm({
               type: "boolean",
               description: "DB layer only. When true, response includes `contradictions[]` and `flagged_edges[]` arrays from the SQL migrations parser \u2014 SQL\u2194ORM schema drift findings (missing columns/tables, type mismatches, nullability drift, FKs in SQL but no ORM @relation). Default false."
             },
+            tag_predicates: {
+              type: "array",
+              description: 'Multi-condition AND filter over node attributes. Each predicate is { field, op, value }. `field` matches either a top-level node attribute (e.g. is_destructive, mutates, statement_count) OR a tag key (tag values take precedence when both exist). `op` \u2208 {eq, ne, gt, lt, gte, lte, exists, not_exists, in}. Example: [{field:"is_destructive",op:"eq",value:true},{field:"has_orphan_check",op:"eq",value:false}] returns destructive migrations missing an orphan check.',
+              items: {
+                type: "object",
+                properties: {
+                  field: { type: "string", description: "Node attribute or tag key." },
+                  op: { type: "string", enum: ["eq", "ne", "gt", "lt", "gte", "lte", "exists", "not_exists", "in"] },
+                  value: { description: "Comparison value. Required for all ops except exists/not_exists. Pass an array for `in`." }
+                },
+                required: ["field", "op"]
+              }
+            },
+            include_cross_refs: {
+              type: "boolean",
+              description: "When true, attach `cross_refs` (incoming + outgoing) to each returned node. Unlocks the cross-layer reference data (references_static, calls_api, reads_via, mutates_via, reads, mutates, references_api) that is otherwise dropped from responses. Combine with `cross_ref_type` to narrow."
+            },
+            cross_ref_type: {
+              type: "string",
+              description: "Narrow attached cross_refs by kind. Common values: calls_api, references_static, reads_via, mutates_via, reads, mutates, references_api. Only applies when include_cross_refs is true."
+            },
+            edge_confidence: {
+              type: "array",
+              description: 'Filter to surface low/medium/high-confidence flagged_edges in the response. Pass e.g. ["medium","high"] to get DYNAMIC navigation targets, FK drift, etc. Scoped to matched nodes when a node filter is in play; otherwise returns all flagged_edges at the requested confidence levels. Layer-independent.',
+              items: { type: "string", enum: ["low", "medium", "high"] }
+            },
             offset: {
               type: "number",
               description: "Skip first N matched nodes (pagination). Default 0. Use next_offset from a previous response to get the next page."
@@ -9394,6 +9951,10 @@ var init_graph_mcp = __esm({
                   minimal: { type: "boolean" },
                   include_edges: { type: "boolean" },
                   include_findings: { type: "boolean" },
+                  tag_predicates: { type: "array" },
+                  include_cross_refs: { type: "boolean" },
+                  cross_ref_type: { type: "string" },
+                  edge_confidence: { type: "array" },
                   project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
                   worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
                   project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
@@ -9492,12 +10053,16 @@ Returns deep fields only \u2014 not structural metadata (use read_graph for that
             fields: {
               type: "array",
               items: { type: "string" },
-              description: 'Specific deep fields to return. Options: elements, stateVars, conditions, variables, responses, params, effects. Omit for all. "effects" returns the file-level side-effect summary (calls, dom_writes, subscribes, timers, persists, fetches, globals); per-arrow-function effects are also attached to each entry in "variables".'
+              description: `Specific deep fields to return. Options: elements, stateVars, conditions, variables, responses, params, effects, crossRefs. Omit for all. "effects" returns the file-level side-effect summary (calls, dom_writes, subscribes, timers, persists, fetches, globals); per-arrow-function effects are also attached to each entry in "variables". "crossRefs" returns this node's incoming + outgoing cross-layer references (calls_api, references_static, reads_via, mutates_via, reads, mutates, references_api) \u2014 the cross-layer linking data otherwise dropped from responses.`
             },
             filter: {
               type: "string",
               description: "Regex pattern to search WITHIN deep field values. Only returns nodes where at least one deep field matches. Searches across all string values in the requested fields (condition tests, variable inits, element tags/props, response bodies, etc.). When set, search becomes optional and node limit is raised to 50."
             },
+            cross_ref_type: {
+              type: "string",
+              description: 'Narrow returned crossRefs by kind (e.g. calls_api, references_static, reads_via). Only applies when "crossRefs" is included in fields (or fields is omitted).'
+            },
             case_insensitive: {
               type: "boolean",
               description: "Case-insensitive filter matching. Default true."
@@ -9542,18 +10107,18 @@ Use this when the user asks "is the chart running", "show me the project graph U
       },
       {
         name: "effects_index",
-        description: 'Cross-layer inverted index over per-node side effects. Answers "who else touches X?" without re-walking every node. Built automatically when generate_graph runs (or whenever the watcher regenerates). \n\nUSE THIS FOR: "is mountFoo safe to instantiate twice?" (kind="singleton_risks"), "who writes DOM id moon-shadow-blur?" (kind="dom_ids", key="moon-shadow-blur"), "which files attach a window keydown listener?" (kind="window_events", key="window:keydown"), "who else writes localStorage key panchang.settings.v1?" (kind="storage_keys", key="..."), "any DOM-id collisions?" (kind="collisions"). \n\nReturns: { kind, results } where results is a {key: [nodeIds]} map for the chosen kind, or a list of multi-writer collisions when kind="collisions", or a flat node-id list when kind="singleton_risks".',
+        description: 'Cross-layer inverted index over per-node side effects. Answers "who else touches X?" without re-walking every node. Most kinds load from a precomputed effects-index.json (built when generate_graph runs); fetch_calls and api_effects are computed on demand from the ui/api graphs so they always reflect current state.\n\nUSE THIS FOR: "is mountFoo safe to instantiate twice?" (kind="singleton_risks"), "who writes DOM id moon-shadow-blur?" (kind="dom_ids", key="moon-shadow-blur"), "which files attach a window keydown listener?" (kind="window_events", key="window:keydown"), "who else writes localStorage key panchang.settings.v1?" (kind="storage_keys", key="..."), "any DOM-id collisions?" (kind="collisions"), "who calls /api/work-items?" (kind="fetch_calls", key="app/api/.../work-items/route.ts"), "which endpoints call db.user.findUnique?" (kind="api_effects", key="db.user.findUnique"). \n\nReturns vary by kind: {key:[nodeIds]} map for standard kinds; {dom_ids, storage_keys, window_events} for collisions; flat node-id list for singleton_risks; {api_endpoint|url_template: [ui_files]} for fetch_calls; {category: {item: [endpoint_ids]}} summary for api_effects (or {category, key, hits} when key is set).',
         inputSchema: {
           type: "object",
           properties: {
             kind: {
               type: "string",
-              enum: ["dom_ids", "window_events", "storage_keys", "fetch_urls", "timers", "singleton_risks", "collisions"],
-              description: "Which inverted index to query. Default: collisions (most actionable signal)."
+              enum: ["dom_ids", "window_events", "storage_keys", "fetch_urls", "timers", "singleton_risks", "collisions", "fetch_calls", "api_effects"],
+              description: 'Which inverted index to query. Default: collisions (most actionable signal). fetch_calls = "UI\u2192API call inventory" (resolved via ui cross_refs + raw fetch strings). api_effects = "what does each endpoint touch" inverted across all effect categories (calls / fetches / persists / subscribes / timers / dom_writes / globals).'
             },
             key: {
               type: "string",
-              description: 'Optional specific key to look up within the chosen kind (e.g. "moon-shadow-blur"). When omitted, returns the full {key:nodes} map for the kind.'
+              description: 'Optional specific key to look up within the chosen kind (e.g. "moon-shadow-blur" for dom_ids, "/api/work-items" for fetch_calls, "db.user.findUnique" for api_effects). When omitted, returns the full {key:nodes} map (or per-category summary for api_effects).'
             },
             project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
             worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
@@ -9561,6 +10126,95 @@ Use this when the user asks "is the chart running", "show me the project graph U
           }
         }
       },
+      {
+        name: "migration_audit",
+        description: `List Prisma migrations that violate the migration-safety discipline: destructive migrations missing one or more guards (orphan check, sidecar backup, pre-flight notice). Codifies the three-layer migration safety rules \u2014 derived from each migration node's extracted attributes (is_destructive, has_orphan_check, has_sidecar_backup, has_pre_flight_notice, contains_backfill, contains_drop_column, contains_drop_table).
+
+USE THIS FOR: "are there unsafe migrations on this branch", "audit the migration history before deploy", "find migrations that drop columns without backup". Paginated. Returns one entry per offending migration with the specific missing guards listed.`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            require_orphan_check: { type: "boolean", description: "Flag destructive migrations missing an orphan-count guard. Default true." },
+            require_sidecar_backup: { type: "boolean", description: "Flag destructive migrations missing a sidecar backup table. Default true." },
+            require_pre_flight_notice: { type: "boolean", description: "Flag destructive migrations missing a RAISE NOTICE pre-flight. Default true." },
+            include_safe: { type: "boolean", description: "Also return migrations that pass all checks (no violations). Default false \u2014 by default only offenders are returned." },
+            offset: { type: "number", description: "Pagination offset. Default 0." },
+            limit: { type: "number", description: "Max migrations to return. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          }
+        }
+      },
+      {
+        name: "drift_report",
+        description: 'Aggregate cross-layer drift findings \u2014 contradictions (schema disagreements) + flagged_edges (low-confidence resolutions, FK drift, dynamic routes) \u2014 into one report. Generalizes the db-only `read_graph include_findings` flag to all layers.\n\nUSE THIS FOR: "is the codebase drifting", "show me SQL vs ORM mismatches", "list endpoints/components with unresolved routes", "audit schema health before refactor". Paginated. Returns items with { layer, kind, source, target, detail, confidence }.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            layer: { type: "string", description: "Restrict to one layer (e.g. db, ui). Omit for all layers." },
+            kind: { type: "string", enum: ["contradictions", "flagged_edges", "all"], description: "Which finding type to return. Default all." },
+            confidence: { type: "array", items: { type: "string", enum: ["low", "medium", "high"] }, description: "For flagged_edges: filter by confidence levels. Default all." },
+            offset: { type: "number", description: "Pagination offset. Default 0." },
+            limit: { type: "number", description: "Max items to return. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          }
+        }
+      },
+      {
+        name: "who_uses",
+        description: 'List everything that references a target node via cross_refs \u2014 the cross-layer references_static / calls_api / reads_via / mutates_via / reads / mutates / references_api edges that are otherwise dropped from responses.\n\nUSE THIS FOR: "where is permission `manage_billing` used", "which UI components reference enum `WorkItemPriority`", "which endpoints touch the User table", "which files call /api/work-items". Auto-scans all layers\' cross_refs for incoming edges to the target. Paginated.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            target: { type: "string", description: 'Target node id to look up (e.g. "seed:permission:manage_billing", "User", "app/api/.../work-items/route.ts", "WorkItemPriority").' },
+            cross_ref_type: { type: "string", description: "Narrow by cross-ref kind (calls_api / references_static / reads_via / mutates_via / reads / mutates / references_api). Omit for all kinds." },
+            offset: { type: "number", description: "Pagination offset. Default 0." },
+            limit: { type: "number", description: "Max references to return. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          },
+          required: ["target"]
+        }
+      },
+      {
+        name: "trace_path",
+        description: 'Find shortest paths between two nodes across layers via cross_refs (including the via[] chains that capture transitive DB access through middleware).\n\nUSE THIS FOR: "how does AdminAnalyticsPage end up reading the User table" \u2014 returns the call chain page \u2192 fetch \u2192 endpoint \u2192 middleware \u2192 db. BFS-bounded by max_hops + max_paths to keep responses tractable on hub nodes. Paginated.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            from: { type: "string", description: "Source node id." },
+            to: { type: "string", description: "Target node id." },
+            max_hops: { type: "number", description: "Hard cap on path length. Default 5." },
+            max_paths: { type: "number", description: "Hard cap on total paths discovered. Default 10. Once hit, BFS stops." },
+            offset: { type: "number", description: "Pagination offset over discovered paths. Default 0." },
+            limit: { type: "number", description: "Max paths returned per response. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          },
+          required: ["from", "to"]
+        }
+      },
+      {
+        name: "auth_coverage_report",
+        description: 'Aggregate every API endpoint by its auth[] wrapper(s) \u2014 surfaces endpoints with empty auth, groups by module, shows which auth strategies dominate. Computed from api.json endpoint auth field (100% populated).\n\nUSE THIS FOR: "are there unauthenticated endpoints", "which auth wrappers are in use", "audit auth strategy consistency across modules". Paginated. Returns { total, by_strategy: {strategy: count}, unauthenticated: [endpoint_ids], by_module: {module: {total, by_strategy}} } plus the paginated endpoint list.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            module: { type: "string", description: 'Restrict to one module tag (e.g. "orgs", "admin").' },
+            strategy: { type: "string", description: 'Restrict to endpoints using this auth wrapper (e.g. "withAuth"). Pass "none" to list unauthenticated endpoints.' },
+            offset: { type: "number", description: "Pagination offset over the endpoint list. Default 0." },
+            limit: { type: "number", description: "Max endpoints to return per response. Default 10." },
+            project: { type: "string", description: PROJECT_PARAM_DESCRIPTION },
+            worktree: { type: "string", description: WORKTREE_PARAM_DESCRIPTION2 },
+            project_root: { type: "string", description: PROJECT_ROOT_PARAM_DESCRIPTION2 }
+          }
+        }
+      },
       {
         name: "detect_project_stack",
         description: "Detect project languages, frameworks, available parsers, and recommend parser configuration. Scans the project to identify all languages present (TypeScript, Python, Go, etc.) and reports which are supported by registered parsers vs detected-but-unsupported. Also detects frameworks (Next.js, Prisma, React, etc.), provides cross-layer detection stats (fetch calls, @api annotations, URL literals), and returns available graph layers. \n\nUse this when setting up launch-chart for a new project, reviewing parser configuration, or checking what languages are in the project.",