@chappibunny/repolens 1.16.2 → 1.16.4

package/src/analyzers/dependency-graph.js

@@ -1,6 +1,9 @@
 // Dependency graph analysis with cycle detection.
 // JavaScript, TypeScript, Python, and Go imports become edges.
-// Comments and strings are ignored. Type-only TypeScript imports are not runtime edges.
+// Comments and strings are ignored. Type-only TypeScript imports are not runtime edges:
+// `import type` / `export type` / all-`type` specifier lists (syntax), and imports the
+// TypeScript compiler removes because every binding is used only as a type or names
+// an interface or type alias (inferred, see ts-elision.js).
 // Cycle priority is in cycle-priority.js: mutual recursion and type-only cycles are
 // not "Priority: High refactor". Large multi-module cycles stay high.
 
@@ -19,6 +22,9 @@ import {
   parseGoModule,
 } from "./import-parsers.js";
 import { isNonProductPath } from "../utils/path-roles.js";
+import { computeLanguageCoverage, coverageLine } from "./language-coverage.js";
+import { listWorkspacePackages } from "./workspace-packages.js";
+import { usageByName, declaredKinds, createElisionSettings, isTypeScriptFile } from "./ts-elision.js";
 import {
   classifyRuntimeCycles,
   priorityCounts,
@@ -72,6 +78,77 @@ function normalizeFileKey(file) {
   return key;
 }
 
+// Source-tree candidates for `pkg` or `pkg/subpath` inside a workspace package.
+// `exports`/`main` usually point at build output (dist/, lib/, build/), so those
+// paths are mapped back to src/ as well as tried as written.
+function workspaceCandidates(pkg, subpath) {
+  const base = pkg.dir ? `${pkg.dir}/` : "";
+  const out = [];
+  const push = (rel) => {
+    if (typeof rel !== "string" || !rel) return;
+    let clean = rel.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+    // exports/main targets must stay inside the package: no absolute paths, no `..`,
+    // no wildcards or URLs.
+    if (clean.startsWith("/") || /^[A-Za-z]:/.test(clean) || clean.includes("*") || clean.includes(":")) return;
+    if (clean.split("/").includes("..")) return;
+    clean = clean.replace(/\.d\.[cm]?ts$/, "").replace(/\.(js|ts|jsx|tsx|mjs|cjs)$/, "");
+    if (!clean || clean === ".") {
+      out.push(pkg.dir || ".");
+      return;
+    }
+    out.push(`${base}${clean}`);
+    const mapped = clean.replace(/^(dist|lib|build|out|esm|cjs)(\/(esm|cjs|es|src))?\//, "src/");
+    if (mapped !== clean) out.push(`${base}${mapped}`);
+  };
+  const manifest = pkg.manifest || {};
+  const exportKey = subpath ? `./${subpath}` : ".";
+  const exportsField = manifest.exports;
+  let target = null;
+  if (typeof exportsField === "string" && !subpath) target = exportsField;
+  else if (exportsField && typeof exportsField === "object") {
+    const entry = exportKey in exportsField ? exportsField[exportKey] : (!subpath && !Object.keys(exportsField).some((k) => k.startsWith(".")) ? exportsField : undefined);
+    target = pickExportTarget(entry);
+  }
+  if (target) push(target);
+  if (subpath) {
+    push(`src/${subpath}`);
+    push(subpath);
+    push(`lib/${subpath}`);
+  } else {
+    for (const field of ["source", "module", "main"]) {
+      if (typeof manifest[field] === "string") push(manifest[field]);
+    }
+    push("src/index");
+    push("index");
+    push("lib/index");
+  }
+  return out;
+}
+
+function pickExportTarget(entry) {
+  if (typeof entry === "string") return entry;
+  if (Array.isArray(entry)) {
+    for (const item of entry) {
+      const found = pickExportTarget(item);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (entry && typeof entry === "object") {
+    for (const condition of ["source", "development", "import", "module", "default", "require", "node", "types"]) {
+      if (condition in entry) {
+        const found = pickExportTarget(entry[condition]);
+        if (found) return found;
+      }
+    }
+    for (const value of Object.values(entry)) {
+      const found = pickExportTarget(value);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+
 function emptyResult() {
   return {
     nodes: [],
@@ -79,6 +156,7 @@ function emptyResult() {
     cycles: [],
     cycleReports: [],
     typeOnlyReports: [],
+    typeOnlyEdges: [],
     externalDeps: [],
     externalRuntime: [],
     externalDev: [],
@@ -151,8 +229,14 @@ function goFilesInDir(goFiles, dir) {
   });
 }
 
-export async function analyzeDependencyGraph(files, repoRoot) {
+export async function analyzeDependencyGraph(files, repoRoot, { coverageFiles = files } = {}) {
   const result = emptyResult();
+  const coverage = computeLanguageCoverage(coverageFiles || files);
+  result.coverage = coverage;
+  if (coverage.status === "unsupported") {
+    info(`Dependency graph: not built — ${coverageLine(coverage, "import analysis")}`);
+    return result;
+  }
 
   const jsFiles = files.filter((file) => JS_EXTENSIONS.has(path.extname(file)));
   const pyFiles = files.filter((file) => PY_EXTENSIONS.has(path.extname(file)));
@@ -191,38 +275,66 @@ export async function analyzeDependencyGraph(files, repoRoot) {
 
   // A package importing its own name (examples, docs, tests written like user code)
   // is not a dependency. Resolve the nearest package.json for each file.
-  const packageNameByDir = new Map();
-  async function ownPackageName(file) {
-    let dir = path.dirname(file);
+  const packageByDir = new Map();
+  async function ownPackage(file) {
+    let dir = path.posix.dirname(String(file).replace(/\\/g, "/"));
     const visited = [];
     for (;;) {
-      if (packageNameByDir.has(dir)) {
-        const cached = packageNameByDir.get(dir);
-        for (const d of visited) packageNameByDir.set(d, cached);
+      if (packageByDir.has(dir)) {
+        const cached = packageByDir.get(dir);
+        for (const d of visited) packageByDir.set(d, cached);
         return cached;
       }
       visited.push(dir);
       const raw = await readFileSafe(path.join(repoRoot, dir, "package.json"));
       if (raw) {
-        let name = null;
+        let found = null;
         try {
           const parsed = JSON.parse(raw);
-          if (typeof parsed?.name === "string") name = parsed.name;
+          if (typeof parsed?.name === "string" && parsed.name) found = { name: parsed.name, manifest: parsed };
         } catch {
           // invalid package.json: keep walking up
         }
-        if (name) {
-          for (const d of visited) packageNameByDir.set(d, name);
-          return name;
+        if (found) {
+          for (const d of visited) packageByDir.set(d, found);
+          return found;
         }
       }
-      if (dir === "." || dir === "" || dir === path.dirname(dir)) break;
-      dir = path.dirname(dir);
+      if (dir === "." || dir === "" || dir === path.posix.dirname(dir)) break;
+      dir = path.posix.dirname(dir);
     }
-    for (const d of visited) packageNameByDir.set(d, null);
+    for (const d of visited) packageByDir.set(d, null);
     return null;
   }
 
+  // Declared workspace members only (package.json workspaces, pnpm-workspace.yaml,
+  // lerna.json). In a monorepo, `@scope/pkg` naming a member is an internal edge.
+  const workspacePackages = new Map();
+  if (jsFiles.length > 0) {
+    const { packages } = await listWorkspacePackages(repoRoot);
+    for (const pkg of packages) workspacePackages.set(pkg.name, pkg);
+  }
+
+  function resolveWorkspaceImport(specifier, importer) {
+    const name = externalPackageName(specifier);
+    if (!name) return null;
+    const pkg = workspacePackages.get(name);
+    if (!pkg) return null;
+    // `"name": "npm:other@1"` (or a registry version of a same-named package installed
+    // under an alias) means the importer uses the registry package, not the member.
+    const manifest = importer?.manifest || {};
+    for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+      const spec = manifest[field]?.[name];
+      if (typeof spec === "string" && spec.startsWith("npm:")) return null;
+    }
+    const subpath = specifier.slice(name.length).replace(/^\/+/, "");
+    for (const candidate of workspaceCandidates(pkg, subpath)) {
+      const key = normalizeFileKey(candidate);
+      if (allFileKeys.has(key)) return { name, key };
+    }
+    return { name, key: null };
+  }
+
   const pyIndex = indexPythonModules(pyFiles);
   const goModulePath = goFiles.length > 0 ? await loadGoModule(repoRoot) : null;
 
@@ -230,7 +342,7 @@ export async function analyzeDependencyGraph(files, repoRoot) {
   // and are classified on their own so they are never "Priority: High refactor".
   const edgeRecords = new Map();
 
-  function rememberEdge(fromKey, toKey, fromFile, typeOnly, calls) {
+  function rememberEdge(fromKey, toKey, fromFile, typeOnly, calls, reason = null) {
     if (!toKey || toKey === fromKey || !allFileKeys.has(toKey)) return;
     const id = `${fromKey}->${toKey}`;
     let record = edgeRecords.get(id);
@@ -241,46 +353,122 @@ export async function analyzeDependencyGraph(files, repoRoot) {
         fromFile,
         toFile: fileKeyToFile.get(toKey) || toKey,
         typeOnly: true,
+        typeOnlyReason: null,
         calls: 0,
       };
       edgeRecords.set(id, record);
     }
     if (!typeOnly) {
       record.typeOnly = false;
+      record.typeOnlyReason = null;
       record.calls += calls;
+    } else if (record.typeOnly) {
+      // "syntax" (`import type`) wins over "inferred" when both reach the same file.
+      if (reason === "syntax" || !record.typeOnlyReason) record.typeOnlyReason = reason || "syntax";
+    }
+  }
+
+  // TypeScript import elision. Contents and declared kinds are cached per file.
+  const elisionFor = createElisionSettings(repoRoot);
+  const contentByKey = new Map();
+  const kindsByKey = new Map();
+  async function contentOf(key) {
+    if (!contentByKey.has(key)) {
+      const file = fileKeyToFile.get(key);
+      contentByKey.set(key, file ? await readFileSafe(path.join(repoRoot, file)) : "");
     }
+    return contentByKey.get(key);
+  }
+  async function kindsOf(key) {
+    if (!kindsByKey.has(key)) {
+      const file = fileKeyToFile.get(key);
+      kindsByKey.set(key, file && isTypeScriptFile(file) ? declaredKinds(await contentOf(key)) : null);
+    }
+    return kindsByKey.get(key);
+  }
+
+  // True when the compiler drops this import or re-export from the JavaScript output.
+  async function elidedByCompiler(imported, toKey, file, content, state) {
+    // A declaration file (`.d.ts`) never runs: none of its imports load a module.
+    if (/\.d\.[cm]?ts$/.test(file)) return true;
+    if (!isTypeScriptFile(file)) return false;
+    if (imported.kind !== "import" && imported.kind !== "reexport") return false;
+    const bindings = imported.bindings || [];
+    if (bindings.length === 0) return false;
+    if (!state.settings) state.settings = await elisionFor(file);
+    if (!state.settings.elide) return false;
+    // `emitDecoratorMetadata` turns annotations on decorated members into runtime
+    // references (`design:paramtypes`); isolated transpilers (swc, esbuild) keep
+    // even interface imports there. A decorated file under it keeps every import.
+    if (!state.usage) state.usage = usageByName(content, { jsx: /\.[jt]sx$/.test(file) });
+    if (state.settings.decoratorMetadata && state.usage.decorators) return false;
+    const kinds = await kindsOf(toKey);
+    const declaredType = (name) => Boolean(kinds) && name !== "default" && name !== "*" && kinds.types.has(name);
+    if (imported.kind === "reexport") return bindings.every((item) => declaredType(item.imported));
+    // Usage-based inference: .ts/.mts/.cts only. In .tsx, JSX text can look like code
+    // (`list as they're posted`), so only interface / type alias names count there.
+    // When part of the tsconfig `extends` chain is not in the checkout, only
+    // interface / type alias names count (`inferUsage: false`).
+    // A file the tokenizer misread (`malformed`) gets the same treatment.
+    const useInference = !/\.tsx$/.test(file) && state.settings.inferUsage !== false && !state.usage.malformed;
+    return bindings.every((item) => {
+      if (declaredType(item.imported)) return true;
+      if (!useInference || !item.local) return false;
+      const use = state.usage.uses.get(item.local);
+      return !use || use.value === 0;
+    });
   }
 
   for (const file of jsFiles) {
     const content = await readFileSafe(path.join(repoRoot, file));
     if (!content) continue;
     const fromKey = normalizeFileKey(file);
-    const selfName = await ownPackageName(file);
+    const importer = await ownPackage(file);
+    const selfName = importer ? importer.name : null;
     const grouped = new Map();
+    const state = { settings: null, usage: null };
     for (const imported of extractJsImports(content)) {
+      let toKey = null;
       if (!isRelativeImport(imported.specifier)) {
-        if (imported.typeOnly) continue;
         const name = externalPackageName(imported.specifier);
         if (name && name === selfName) continue;
-        addExternal(fromKey, name);
-        continue;
+        const workspace = resolveWorkspaceImport(imported.specifier, importer);
+        if (workspace) {
+          // Another package in this repository is internal: an edge when it resolves
+          // to a scanned file, and never an external dependency either way.
+          if (!workspace.key) continue;
+          toKey = workspace.key;
+        } else {
+          if (imported.typeOnly) continue;
+          addExternal(fromKey, name);
+          continue;
+        }
+      } else {
+        toKey = resolveImportPath(file, imported.specifier);
       }
-      const toKey = resolveImportPath(file, imported.specifier);
       if (!toKey) continue;
+      let typeOnly = imported.typeOnly;
+      let reason = typeOnly ? "syntax" : null;
+      if (!typeOnly && allFileKeys.has(toKey) && toKey !== fromKey && await elidedByCompiler(imported, toKey, file, content, state)) {
+        typeOnly = true;
+        reason = "inferred";
+      }
       const id = `${fromKey}->${toKey}`;
       let slot = grouped.get(id);
       if (!slot) {
-        slot = { toKey, typeOnly: true, names: new Set() };
+        slot = { toKey, typeOnly: true, reason: null, names: new Set() };
         grouped.set(id, slot);
       }
-      if (!imported.typeOnly) {
+      if (!typeOnly) {
         slot.typeOnly = false;
         for (const binding of imported.names || []) slot.names.add(binding);
+      } else if (reason === "syntax" || !slot.reason) {
+        slot.reason = reason;
       }
     }
     for (const slot of grouped.values()) {
       const calls = slot.typeOnly ? 0 : countBindingCalls(content, [...slot.names]);
-      rememberEdge(fromKey, slot.toKey, file, slot.typeOnly, calls);
+      rememberEdge(fromKey, slot.toKey, file, slot.typeOnly, calls, slot.reason);
     }
   }
 
@@ -350,20 +538,49 @@ export async function analyzeDependencyGraph(files, repoRoot) {
   const runtimeEdgeList = [...edgeRecords.values()].filter((edge) => !edge.typeOnly);
   result.cycleReports = classifyRuntimeCycles(result.cycles, runtimeEdgeList, fileForKey);
 
-  const typeOnlyAdj = new Map();
+  // Type-only cycles: cycles of runtime + type-only edges that need at least one
+  // type-only edge. They are reported on their own and never as runtime cycles.
+  const combinedAdj = new Map();
+  for (const [from, deps] of adjacency) combinedAdj.set(from, new Set(deps));
+  const typeOnlyEdgeById = new Map();
   for (const edge of edgeRecords.values()) {
     if (!edge.typeOnly) continue;
-    if (!typeOnlyAdj.has(edge.from)) typeOnlyAdj.set(edge.from, new Set());
-    if (!typeOnlyAdj.has(edge.to)) typeOnlyAdj.set(edge.to, new Set());
-    typeOnlyAdj.get(edge.from).add(edge.to);
+    typeOnlyEdgeById.set(`${edge.from}->${edge.to}`, edge);
+    if (!combinedAdj.has(edge.from)) combinedAdj.set(edge.from, new Set());
+    if (!combinedAdj.has(edge.to)) combinedAdj.set(edge.to, new Set());
+    combinedAdj.get(edge.from).add(edge.to);
   }
-  result.typeOnlyReports = detectCycles(typeOnlyAdj).map((path) => typeOnlyReport(path));
+  result.typeOnlyReports = typeOnlyEdgeById.size === 0 ? [] : detectCycles(combinedAdj)
+    .map((cyclePath) => {
+      const links = [];
+      for (let i = 0; i + 1 < cyclePath.length; i += 1) {
+        const from = cyclePath[i];
+        const to = cyclePath[i + 1];
+        if (adjacency.get(from)?.has(to)) continue;
+        const edge = typeOnlyEdgeById.get(`${from}->${to}`);
+        if (edge) links.push({ from, to, reason: edge.typeOnlyReason || "syntax" });
+      }
+      if (links.length === 0) return null;
+      return { ...typeOnlyReport(cyclePath), typeOnlyLinks: links };
+    })
+    .filter(Boolean);
+  result.typeOnlyEdges = [...typeOnlyEdgeById.values()].map((edge) => ({
+    from: edge.from,
+    to: edge.to,
+    reason: edge.typeOnlyReason || "syntax",
+  }));
 
   const priorities = priorityCounts(result.cycleReports);
 
   // Stats
   const totalImports = result.edges.length;
-  const orphans = result.nodes.filter(n => n.imports.length === 0 && n.importedBy.length === 0);
+  // A file connected only by type-only imports (a types module) is not dead code.
+  const typeConnected = new Set();
+  for (const edge of result.typeOnlyEdges) {
+    typeConnected.add(edge.from);
+    typeConnected.add(edge.to);
+  }
+  const orphans = result.nodes.filter(n => n.imports.length === 0 && n.importedBy.length === 0 && !typeConnected.has(n.key));
   const sourceNodeCount = result.nodes.filter((n) => !isNonProductPath(n.file || n.key)).length;
   const hubThreshold = Math.max(5, Math.round(sourceNodeCount * 0.07));
   const hubs = aggregateHubs(result.nodes, fileKeyToFile, goModulePath, hubThreshold);
@@ -384,16 +601,22 @@ export async function analyzeDependencyGraph(files, repoRoot) {
     highCycles: priorities.high,
     mediumCycles: priorities.medium,
     lowCycles: priorities.low,
+    typeOnlyCycles: result.typeOnlyReports.length,
+    typeOnlyEdges: result.typeOnlyEdges.length,
+    inferredTypeOnlyEdges: result.typeOnlyEdges.filter((edge) => edge.reason === "inferred").length,
     orphanFiles: orphans.length,
     hubs,
   };
 
   result.summary = buildSummary(result);
 
+  const typeOnlyNote = result.typeOnlyReports.length > 0
+    ? ` (${result.typeOnlyReports.length} type-only cycle(s) not counted)`
+    : "";
   if (result.cycles.length > 0) {
-    warn(`Dependency graph: ${result.cycles.length} circular dependency cycle(s) detected`);
+    warn(`Dependency graph: ${result.cycles.length} circular dependency cycle(s) detected${typeOnlyNote}`);
   } else {
-    info(`Dependency graph: ${totalImports} edges across ${codeFiles.length} files, no cycles`);
+    info(`Dependency graph: ${totalImports} edges across ${codeFiles.length} files, no cycles${typeOnlyNote}`);
   }
 
   return result;
@@ -509,7 +732,15 @@ function buildSummary(result) {
   if (result.stats.cycles > 0) {
     parts.push(`⚠️ ${result.stats.cycles} circular dependency cycle(s)`);
   } else {
-    parts.push("✓ no circular dependencies");
+    parts.push(result.coverage?.status === "partial"
+      ? "✓ no circular dependencies among analyzed files"
+      : "✓ no circular dependencies");
+  }
+  if (result.stats.typeOnlyCycles > 0) {
+    parts.push(`${result.stats.typeOnlyCycles} type-only cycle(s), not runtime`);
+  }
+  if (result.coverage?.status === "partial") {
+    parts.push(`partial coverage: ${result.coverage.analyzedBase} of ${result.coverage.totalBase} source files`);
   }
   if (result.stats.orphanFiles > 0) {
     parts.push(`${result.stats.orphanFiles} orphan file(s)`);

package/src/analyzers/flow-inference.js

@@ -114,7 +114,7 @@ function inferFlowsFromEntryPoints(scanResult, depGraph) {
     // Classify each step in the chain
     const steps = chain.map((nodeKey, i) => {
       const node = depGraph.nodes.find(n => n.key === nodeKey);
-      const name = nodeKey.split("/").pop();
+      const name = stepName(nodeKey);
       const fanIn = node?.importedBy?.length || 0;
       const fanOut = node?.imports?.length || 0;
       
@@ -342,3 +342,12 @@ function inferExternalDependencies(flow) {
   
   return external;
 }
+
+// A package entry is keyed by its folder (`packages/server/src` for src/index.ts), so
+// "src" or "lib" alone says nothing. Name it after the package folder instead.
+function stepName(nodeKey) {
+  const parts = String(nodeKey).split("/");
+  const last = parts.pop();
+  if (/^(src|lib|source)$/i.test(last) && parts.length > 0) return `${parts[parts.length - 1]}/${last}`;
+  return last;
+}

package/src/analyzers/graphql-analyzer.js

@@ -3,6 +3,8 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { info } from "../utils/logger.js";
+import { extractJsImports, externalPackageName } from "./import-parsers.js";
+import { stripJsComments } from "../utils/js-lexer.js";
 
 const GRAPHQL_EXTENSIONS = [".graphql", ".gql"];
 
@@ -19,28 +21,57 @@ const TYPE_PATTERNS = {
   directive: /directive\s+@(\w+)/g,
 };
 
+// Word boundaries matter: `useQuery: {` (a React Query hook map) is not `Query: {`.
 const RESOLVER_PATTERNS = [
-  /(?:Query|Mutation|Subscription)\s*:\s*\{/,
-  /resolvers?\s*=\s*\{/,
-  /createResolversMap/,
+  /(?:^|[^\w$])(?:Query|Mutation|Subscription)\s*:\s*\{/m,
+  /\bresolvers?\s*=\s*\{/,
+  /\bcreateResolversMap\b/,
   /\bresolveType\b/,
-  /fieldResolver/,
+  /\bfieldResolver\b/,
 ];
 
-const SCHEMA_LIBRARY_PATTERNS = [
-  { name: "Apollo Server", pattern: /ApolloServer|@apollo\/server|apollo-server/ },
-  { name: "GraphQL Yoga", pattern: /graphql-yoga|createYoga/ },
-  { name: "Mercurius", pattern: /mercurius/ },
-  { name: "graphql-js", pattern: /graphql\b.*\bbuildSchema\b|\bGraphQLSchema\b|\bGraphQLObjectType\b/ },
-  { name: "type-graphql", pattern: /type-graphql|@Resolver|@Query|@Mutation/ },
-  { name: "Nexus", pattern: /nexus|makeSchema|objectType\(/ },
-  { name: "Pothos", pattern: /pothos|SchemaBuilder/ },
-  { name: "Hasura", pattern: /hasura/ },
-  { name: "Relay", pattern: /relay-runtime|RelayEnvironment/ },
-  { name: "urql", pattern: /urql|@urql/ },
-  { name: "Apollo Client", pattern: /ApolloClient|@apollo\/client|apollo-client|useQuery|useMutation/ },
+// Libraries count only when a file imports them. A comment that mentions Apollo or urql,
+// or a React Query `useQuery` hook, is not GraphQL.
+const SCHEMA_LIBRARY_PACKAGES = [
+  { name: "Apollo Server", match: (pkg) => pkg === "@apollo/server" || pkg === "@apollo/subgraph" || pkg === "apollo-server" || pkg.startsWith("apollo-server-") },
+  { name: "GraphQL Yoga", match: (pkg) => pkg === "graphql-yoga" || pkg.startsWith("@graphql-yoga/") },
+  { name: "Mercurius", match: (pkg) => pkg === "mercurius" },
+  { name: "graphql-js", match: (pkg) => pkg === "graphql" },
+  { name: "type-graphql", match: (pkg) => pkg === "type-graphql" },
+  { name: "Nexus", match: (pkg) => pkg === "nexus" || pkg === "@nexus/schema" },
+  { name: "Pothos", match: (pkg) => pkg.startsWith("@pothos/") },
+  { name: "Relay", match: (pkg) => pkg === "relay-runtime" || pkg === "react-relay" },
+  { name: "urql", match: (pkg) => pkg === "urql" || pkg.startsWith("@urql/") },
+  { name: "Apollo Client", match: (pkg) => pkg === "@apollo/client" || pkg === "apollo-client" || pkg === "react-apollo" || pkg === "apollo-boost" },
+  { name: "graphql-request", match: (pkg) => pkg === "graphql-request" },
+  { name: "graphql-tag", match: (pkg) => pkg === "graphql-tag" },
+  // Hasura has no server SDK; its client and tooling packages are the grounded signal.
+  // A bare "hasura" mention in text is no longer enough (see CHANGELOG).
+  { name: "Hasura", match: (pkg) => pkg.startsWith("@hasura/") || pkg.startsWith("hasura-") },
 ];
 
+export function graphqlLibrariesImported(source) {
+  const names = [];
+  let imports = [];
+  try { imports = extractJsImports(source); } catch { imports = []; }
+  for (const imported of imports) {
+    const pkg = externalPackageName(imported.specifier);
+    if (!pkg) continue;
+    for (const { name, match } of SCHEMA_LIBRARY_PACKAGES) {
+      if (match(pkg) && !names.includes(name)) names.push(name);
+    }
+  }
+  return names;
+}
+
+async function hasHasuraProject(repoRoot) {
+  for (const rel of ["hasura/config.yaml", "config.yaml"]) {
+    const text = await readFileSafe(path.join(repoRoot, rel));
+    if (/^\s*metadata_directory\s*:/m.test(text)) return true;
+  }
+  return false;
+}
+
 function parseFieldsFromBlock(block) {
   const fields = [];
   const lines = block.split("\n").map(l => l.trim()).filter(l => l && !l.startsWith("#"));
@@ -102,40 +133,57 @@ export async function analyzeGraphQL(files, repoRoot) {
   }
 
   // Scan code files for inline schemas, resolvers, and libraries
+  const resolverCandidates = [];
   for (const file of codeFiles) {
     const content = await readFileSafe(path.join(repoRoot, file));
     if (!content) continue;
 
-    // Detect GraphQL libraries
-    for (const { name, pattern } of SCHEMA_LIBRARY_PATTERNS) {
-      if (pattern.test(content) && !result.libraries.includes(name)) {
-        result.libraries.push(name);
-      }
+    // Detect GraphQL libraries from real imports
+    const fileLibraries = graphqlLibrariesImported(content);
+    for (const name of fileLibraries) {
+      if (!result.libraries.includes(name)) result.libraries.push(name);
     }
 
+    const code = stripJsComments(content);
+    const typesBefore = result.types.length + result.queries.length + result.mutations.length + result.subscriptions.length;
+
     // Detect inline SDL (template literals with gql tag or type definitions)
-    const inlineSdlPattern = /(?:gql|graphql)\s*`([^`]+)`/gs;
+    const inlineSdlPattern = /\b(?:gql|graphql)\s*`([^`]+)`/gs;
     let match;
-    while ((match = inlineSdlPattern.exec(content)) !== null) {
+    while ((match = inlineSdlPattern.exec(code)) !== null) {
       extractSchemaTypes(match[1], file, result);
     }
 
     // Also detect raw type definitions in string literals
-    if (/type\s+(?:Query|Mutation|Subscription)\s*\{/.test(content)) {
-      extractSchemaTypes(content, file, result);
+    if (/\btype\s+(?:Query|Mutation|Subscription)\s*\{/.test(code)) {
+      extractSchemaTypes(code, file, result);
     }
+    const hasSdl = result.types.length + result.queries.length + result.mutations.length + result.subscriptions.length > typesBefore;
 
-    // Detect resolver files
-    const isResolver = RESOLVER_PATTERNS.some(p => p.test(content));
-    if (isResolver && !result.resolverFiles.includes(file)) {
-      result.resolverFiles.push(file);
+    // Resolver candidates are confirmed after the whole scan: a resolver map needs
+    // GraphQL evidence in the file or somewhere in the repository.
+    if (RESOLVER_PATTERNS.some(p => p.test(code))) {
+      // `resolvers = { Query: { ... } }` together is a resolver map on its own.
+      const resolverMap = RESOLVER_PATTERNS[0].test(code) && RESOLVER_PATTERNS[1].test(code);
+      resolverCandidates.push({ file, local: fileLibraries.length > 0 || hasSdl || resolverMap });
     }
   }
 
-  result.detected = result.schemaFiles.length > 0 ||
-    result.types.length > 0 ||
-    result.resolverFiles.length > 0 ||
+  // Hasura projects are recognized by their CLI project file, not by the word "hasura".
+  if (!result.libraries.includes("Hasura") && await hasHasuraProject(repoRoot)) {
+    result.libraries.push("Hasura");
+  }
+
+  const repoHasGraphQL = result.schemaFiles.length > 0 ||
+    result.types.length > 0 || result.queries.length > 0 || result.mutations.length > 0 ||
     result.libraries.length > 0;
+  for (const candidate of resolverCandidates) {
+    if ((candidate.local || repoHasGraphQL) && !result.resolverFiles.includes(candidate.file)) {
+      result.resolverFiles.push(candidate.file);
+    }
+  }
+
+  result.detected = repoHasGraphQL || result.resolverFiles.length > 0;
 
   if (result.detected) {
     result.summary = buildSummary(result);