@tekyzinc/gsd-t 5.22.10 → 5.24.10

package/bin/gsd-t-graph-edge-extract.cjs

@@ -173,7 +173,7 @@ function extractImportedNames(importNode) {
  * SCIP upgrade will replace these with fully-resolved funcIds.
  *
  * [RULE] who-calls-function-identity-disambiguated: src is the funcId of the
- * enclosing function (or a synthetic _anon@line if top-level); dst is the
+ * enclosing function (or a synthetic route/anonymous caller id, else _toplevel); dst is the
  * callee's best-effort funcId.
  */
 function resolveCalleeName(fnNode) {
@@ -185,6 +185,313 @@ function resolveCalleeName(fnNode) {
   return null;
 }
 
+// ── Anonymous callers (route handlers + callbacks) ───────────────────────────
+//
+// A call inside an anonymous function has no named caller. Before this, such a
+// call was credited to `file#_toplevel` (and a const-arrow body was walked twice,
+// crediting every call in it to _toplevel as well as to the real function). A
+// Hono/Express route file is almost entirely `router.get('/p', mw, async (c) =>
+// { helper() })`, so who-calls answered with one meaningless "_toplevel" caller
+// or — when the dst never resolved — nothing at all.
+//
+// Now every anonymous body gets a caller identity that says where it is:
+//   route handler   → `file#GET /locations/:id@3217`   (method + path + line)
+//   other callback  → the enclosing NAMED function, when there is one
+//   top-level cb    → `file#anonymous@<line>`
+// [RULE] anonymous-caller-synthesized-never-dropped
+
+const ROUTE_METHODS = new Set(['get', 'post', 'put', 'patch', 'delete', 'del', 'all', 'options', 'head', 'use']);
+
+function isAnonymousFn(node) {
+  if (!node) return false;
+  if (node.type === 'arrow_function') return true;
+  if (node.type === 'function' || node.type === 'function_expression') {
+    return !node.childForFieldName('name');
+  }
+  return false;
+}
+
+/**
+ * `router.get('/path', ...)` → "GET /path"; anything else → null.
+ * The method match is case-insensitive (a domain value, not an identifier).
+ */
+function routeLabel(fnNode, argsNode) {
+  if (!fnNode || fnNode.type !== 'member_expression' || !argsNode) return null;
+  const prop = fnNode.childForFieldName('property');
+  if (!prop) return null;
+  const method = prop.text.toLowerCase();
+  if (!ROUTE_METHODS.has(method)) return null;
+  const first = argsNode.namedChild(0);
+  if (!first || (first.type !== 'string' && first.type !== 'template_string')) return null;
+  return `${method.toUpperCase()} ${first.text.slice(1, -1)}`;
+}
+
+/**
+ * A registration with no anonymous handler (`router.get('/x', requireAuth(), handler)`)
+ * is only treated as a route when its first argument looks like a URL path, so a
+ * `cache.get('key', compute())` is never mistaken for one.
+ */
+function isRoutePath(firstArg) {
+  if (!firstArg) return false;
+  return firstArg.text.slice(1).startsWith('/');
+}
+
+// ── Drizzle database tables ──────────────────────────────────────────────────
+//
+// `export const scheduleEvents = pgTable('schedule_events', { ...columns }, (t) => [...])`
+// declares a database table. Before this, it was a constant with no entity, so
+// `body scheduleEvents` said not-found and every table question dead-ended.
+//
+// Now each declaration is a `table` (or `enum`) entity whose meta carries the SQL
+// name and the columns (code name, SQL name, type builder, notNull, primaryKey,
+// foreign key). Every use of a table in code becomes an edge from the function,
+// method or route handler that uses it:
+//   TABLE-READ   .from(T) / .innerJoin(T) / db.query.T.* / a column ref T.col
+//   TABLE-WRITE  .insert(T) / .update(T) / .delete(T) / a column ref inside one
+// dst = `TABLE#<code name>#<operation>@<line>`. The query layer keeps only dsts
+// that name an indexed table. [RULE] drizzle-table-entity-and-usage-edges
+
+const TABLE_BUILDERS = { pgTable: 'pg', mysqlTable: 'mysql', sqliteTable: 'sqlite' };
+const ENUM_BUILDERS = { pgEnum: 'pg' };
+const TABLE_READ_OPS = new Set(['from', 'innerJoin', 'leftJoin', 'rightJoin', 'fullJoin', 'crossJoin']);
+const TABLE_WRITE_OPS = new Set(['insert', 'update', 'delete']);
+const TABLE_OPS = new Set([...TABLE_READ_OPS, ...TABLE_WRITE_OPS]);
+// Identifier positions that declare or re-export a name rather than use it.
+const NON_USE_PARENTS = new Set([
+  'import_specifier', 'export_specifier', 'namespace_import', 'required_parameter', 'optional_parameter',
+]);
+
+function stringValue(node) {
+  if (!node) return null;
+  if (node.type === 'string') return node.text.slice(1, -1);
+  if (node.type === 'template_string' && !node.text.includes('${')) return node.text.slice(1, -1);
+  return null;
+}
+
+function unwrapParens(node) {
+  let n = node;
+  while (n && n.type === 'parenthesized_expression') n = n.namedChild(0);
+  return n;
+}
+
+/** The columns argument: an object literal, or `(t) => ({ ... })`. */
+function columnsObject(node) {
+  if (!node) return null;
+  if (node.type === 'object') return node;
+  if (node.type === 'arrow_function') {
+    const body = unwrapParens(node.childForFieldName('body'));
+    return body && body.type === 'object' ? body : null;
+  }
+  return null;
+}
+
+/** `T` or `schema.T` → "T". Anything else → null. */
+function tableNameOf(node) {
+  const n = unwrapParens(node);
+  if (!n) return null;
+  if (n.type === 'identifier') return n.text;
+  if (n.type === 'member_expression') {
+    const prop = n.childForFieldName('property');
+    const obj = n.childForFieldName('object');
+    if (prop && obj && obj.type === 'identifier') return prop.text;
+  }
+  return null;
+}
+
+/** `() => users.id` (or `(): AnyPgColumn => users.id`) → { table: 'users', column: 'id' }. */
+function referenceTarget(arrow) {
+  if (!arrow || arrow.type !== 'arrow_function') return null;
+  let body = unwrapParens(arrow.childForFieldName('body'));
+  if (body && body.type === 'statement_block') {
+    const ret = body.namedChildren.find((c) => c.type === 'return_statement');
+    body = ret ? unwrapParens(ret.namedChild(0)) : null;
+  }
+  if (!body || body.type !== 'member_expression') return null;
+  const table = tableNameOf(body.childForFieldName('object'));
+  const prop = body.childForFieldName('property');
+  return table && prop ? { table, column: prop.text } : null;
+}
+
+/** One column: `uuid('flight_school_id').notNull().references(() => flightSchools.id)`. */
+function parseColumn(key, value) {
+  const col = { name: key, sqlName: null, type: null, notNull: false, primaryKey: false };
+  let n = value;
+  while (n && n.type === 'call_expression') {
+    const fn = n.childForFieldName('function');
+    const args = n.childForFieldName('arguments');
+    const obj = fn && fn.type === 'member_expression' ? fn.childForFieldName('object') : null;
+    if (obj && obj.type === 'call_expression') {
+      const method = fn.childForFieldName('property').text;
+      if (method === 'notNull') col.notNull = true;
+      else if (method === 'primaryKey') col.primaryKey = true;
+      else if (method === 'unique') col.unique = true;
+      else if (method === 'references') {
+        const ref = referenceTarget(args && args.namedChild(0));
+        if (ref) col.references = ref;
+        else col.unresolved = `references(${(args ? args.text : '').slice(1, 81)}) — target not a plain table.column`;
+      }
+      n = obj;
+      continue;
+    }
+    // The type builder at the root: uuid('x'), t.uuid('x'), statusEnum('x').
+    col.type = fn && fn.type === 'member_expression' ? fn.childForFieldName('property').text : (fn ? fn.text : null);
+    col.sqlName = stringValue(args && args.namedChild(0));
+    break;
+  }
+  if (!col.type) col.unresolved = `column value is a ${value ? value.type : 'missing node'}, not a builder call`;
+  return col;
+}
+
+/** `foreignKey({ columns: [t.a], foreignColumns: [users.id] })` inside the extras argument. */
+function collectForeignKeys(node, out) {
+  if (!node) return;
+  if (node.type === 'call_expression') {
+    const fn = node.childForFieldName('function');
+    const arg = node.childForFieldName('arguments');
+    const obj = arg && arg.namedChild(0);
+    if (fn && fn.text === 'foreignKey' && obj && obj.type === 'object') {
+      const fk = { columns: [], table: null, foreignColumns: [] };
+      for (const pair of obj.namedChildren) {
+        if (pair.type !== 'pair') continue;
+        const k = pair.childForFieldName('key').text;
+        const v = pair.childForFieldName('value');
+        if (!v || v.type !== 'array') continue;
+        for (const el of v.namedChildren) {
+          if (el.type !== 'member_expression') continue;
+          const prop = el.childForFieldName('property').text;
+          if (k === 'columns') fk.columns.push(prop);
+          if (k === 'foreignColumns') { fk.table = tableNameOf(el.childForFieldName('object')); fk.foreignColumns.push(prop); }
+        }
+      }
+      if (fk.table) out.push(fk);
+      return;
+    }
+  }
+  for (let i = 0; i < node.namedChildCount; i++) collectForeignKeys(node.namedChild(i), out);
+}
+
+/** meta for `pgTable('sql_name', { columns }, extras)`. Shape gaps are named in `unresolved`. */
+function tableMeta(builder, args) {
+  const meta = { kind: 'table', dialect: TABLE_BUILDERS[builder], builder, sqlName: stringValue(args.namedChild(0)), columns: [], foreignKeys: [] };
+  const cols = columnsObject(args.namedChild(1));
+  const problems = [];
+  if (!meta.sqlName) problems.push('table name is not a string literal');
+  if (!cols) problems.push('columns argument is not an object literal');
+  for (const child of cols ? cols.namedChildren : []) {
+    if (child.type === 'pair') meta.columns.push(parseColumn(child.childForFieldName('key').text, child.childForFieldName('value')));
+    else if (child.type === 'spread_element') meta.columns.push({ name: child.text, type: 'spread', unresolved: 'spread — columns defined elsewhere' });
+  }
+  collectForeignKeys(args.namedChild(2), meta.foreignKeys);
+  for (const c of meta.columns) if (c.unresolved) problems.push(`column ${c.name}: ${c.unresolved}`);
+  if (problems.length) meta.unresolved = problems;
+  return meta;
+}
+
+function enumMeta(builder, args) {
+  const values = args.namedChild(1);
+  const meta = { kind: 'enum', dialect: ENUM_BUILDERS[builder], builder, sqlName: stringValue(args.namedChild(0)), values: [] };
+  if (values && values.type === 'array') meta.values = values.namedChildren.map(stringValue).filter((v) => v !== null);
+  const problems = [];
+  if (!meta.sqlName) problems.push('enum name is not a string literal');
+  if (!values || values.type !== 'array') problems.push('values argument is not an array literal');
+  if (problems.length) meta.unresolved = problems;
+  return meta;
+}
+
+/**
+ * Names in this file that could be a table: imported names (local → exported
+ * name), namespace imports (`import * as schema`), and tables declared here.
+ */
+function collectTableCandidates(rootNode) {
+  const local = new Map();
+  const namespaces = new Set();
+  for (const stmt of rootNode.namedChildren) {
+    if (stmt.type === 'import_statement') {
+      const clause = stmt.namedChildren.find((c) => c.type === 'import_clause');
+      for (const sub of clause ? clause.namedChildren : []) {
+        if (sub.type === 'identifier') local.set(sub.text, sub.text);
+        if (sub.type === 'namespace_import') { const id = sub.namedChildren.find((c) => c.type === 'identifier'); if (id) namespaces.add(id.text); }
+        if (sub.type === 'named_imports') {
+          for (const spec of sub.namedChildren) {
+            const name = spec.childForFieldName('name');
+            const alias = spec.childForFieldName('alias');
+            if (name) local.set((alias || name).text, name.text);
+          }
+        }
+      }
+    }
+    const decl = stmt.type === 'export_statement' ? stmt.childForFieldName('declaration') : stmt;
+    if (decl && decl.type === 'lexical_declaration') {
+      for (const d of decl.namedChildren) {
+        const value = d.type === 'variable_declarator' ? d.childForFieldName('value') : null;
+        const fn = value && value.type === 'call_expression' ? value.childForFieldName('function') : null;
+        if (fn && (TABLE_BUILDERS[fn.text] || ENUM_BUILDERS[fn.text])) local.set(d.childForFieldName('name').text, d.childForFieldName('name').text);
+      }
+    }
+  }
+  return { local, namespaces };
+}
+
+/**
+ * The table a call chain writes (`db.update(T).set().where(...)` → 'T'), or null.
+ * A chain that reads (`.from(`) before any write is a subquery, not a write.
+ */
+function chainWriteTarget(call) {
+  let n = call;
+  while (n && n.type === 'call_expression') {
+    const fn = n.childForFieldName('function');
+    if (!fn || fn.type !== 'member_expression') return null;
+    const prop = fn.childForFieldName('property').text;
+    if (TABLE_READ_OPS.has(prop)) return null;
+    if (TABLE_WRITE_OPS.has(prop)) {
+      const args = n.childForFieldName('arguments');
+      return args ? tableNameOf(args.namedChild(0)) : null;
+    }
+    n = unwrapParens(fn.childForFieldName('object'));
+  }
+  return null;
+}
+
+const SCOPE_BOUNDARY = /(_statement|_declaration|^arrow_function$|^function$|^function_expression$|^method_definition$|^statement_block$)/;
+
+/**
+ * Is this identifier a USE of the name? Not its declaration, an import/export
+ * specifier, a parameter, a callee, or the receiver of a method call (`logger.info()`).
+ */
+function isUseSite(node) {
+  const parent = node.parent;
+  if (!parent) return false;
+  if (NON_USE_PARENTS.has(parent.type)) return false;
+  const same = (field) => { const f = parent.childForFieldName(field); return f !== null && f.startIndex === node.startIndex && f.type === node.type; };
+  if (parent.type === 'variable_declarator' && same('name')) return false;
+  if (parent.type === 'call_expression' && same('function')) return false;
+  if (parent.type === 'new_expression' && same('constructor')) return false;
+  if (parent.type === 'member_expression' && same('object')) {
+    const grand = parent.parent;
+    const callee = grand && grand.type === 'call_expression' ? grand.childForFieldName('function') : null;
+    if (callee !== null && callee.startIndex === parent.startIndex) return false;
+  }
+  return true;
+}
+
+/**
+ * A ref to table `name` is a WRITE only inside a chain that writes THAT table
+ * (`db.update(T).where(eq(T.id, …))`). A ref to another table inside it
+ * (`.values({ who: users.name })`, a `.from(users)` subquery) is a READ, and so
+ * is `hash.update(users.id)`. The nearest enclosing chain decides.
+ */
+function refAccess(node, name) {
+  for (let p = node.parent; p && !SCOPE_BOUNDARY.test(p.type); p = p.parent) {
+    if (p.type !== 'call_expression') continue;
+    const fn = p.childForFieldName('function');
+    const prop = fn && fn.type === 'member_expression' ? fn.childForFieldName('property').text : null;
+    if (prop !== null && TABLE_READ_OPS.has(prop)) return 'READ';
+    const target = chainWriteTarget(p);
+    if (target !== null) return target === name ? 'WRITE' : 'READ';
+  }
+  return 'READ';
+}
+
 // ── Python-specific extraction ────────────────────────────────────────────────
 
 function walkPython(rootNode, relPath, entities, edges) {
@@ -298,6 +605,7 @@ function walkPython(rootNode, relPath, entities, edges) {
             source: enclosingFuncId,
             target: `UNRESOLVED#${calleeName}`,
             line: node.startPosition.row + 1,
+            col: fn.startPosition.column, // [RULE] scip-tier-proportional
           });
         }
       }
@@ -319,6 +627,38 @@ function walkPython(rootNode, relPath, entities, edges) {
  * a file-qualified source funcId per [RULE] who-calls-function-identity-disambiguated.
  */
 function walkTSJS(rootNode, relPath, entities, edges) {
+  // Drizzle table tracking — see "Drizzle database tables" above.
+  const candidates = collectTableCandidates(rootNode);
+  const consumed = new Set();     // startIndex of table args already recorded as an operation
+  const declRanges = [];          // [start, end] of table declarations (FKs live in meta, not edges)
+  const refSeen = new Set();      // one column-ref edge per (user, access, table)
+  const inDecl = (i) => declRanges.some(([s, e]) => i >= s && i < e);
+  const userOf = (enclosingFuncId) => (enclosingFuncId === null ? `${relPath}#_toplevel` : enclosingFuncId);
+  const tableEdge = (access, src, name, op, node) => edges.push({
+    kind: `TABLE-${access}`,
+    source: src,
+    target: `TABLE#${name}#${op}@${node.startPosition.row + 1}`,
+    line: node.startPosition.row + 1,
+  });
+  /** The exported table name `node` refers to, when it is a candidate (`T`, `alias`, `schema.T`); else null. */
+  function candidateName(node) {
+    if (node.type === 'identifier') return candidates.local.has(node.text) ? candidates.local.get(node.text) : null;
+    if (node.type !== 'member_expression') return null;
+    const obj = node.childForFieldName('object');
+    if (obj.type !== 'identifier' || !candidates.namespaces.has(obj.text)) return null;
+    return node.childForFieldName('property').text;
+  }
+  function tableRef(node, name, enclosingFuncId) {
+    if (consumed.has(node.startIndex)) return;
+    if (inDecl(node.startIndex)) return;
+    const src = userOf(enclosingFuncId);
+    const access = refAccess(node, name);
+    const key = `${src}\u0000${access}\u0000${name}`;
+    if (refSeen.has(key)) return;
+    refSeen.add(key);
+    tableEdge(access, src, name, 'ref', node);
+  }
+
   /**
    * @param {object} node  - tree-sitter ASTNode
    * @param {string|null} enclosingFuncId  - funcId of innermost function containing this node
@@ -374,13 +714,91 @@ function walkTSJS(rootNode, relPath, entities, edges) {
             source: srcId,
             target: `UNRESOLVED#${calleeName}`,
             line: node.startPosition.row + 1,
+            // callee column — lets the SCIP upgrader tell a call the compiler saw
+            // from one it never looked at. [RULE] scip-tier-proportional
+            col: fn.startPosition.column,
+          });
+        }
+
+        // Table operation: `.from(T)`, `.innerJoin(T, …)`, `.insert(T)`, `.update(T)`, `.delete(T)`.
+        // [RULE] drizzle-table-entity-and-usage-edges
+        const op = fn.type === 'member_expression' ? fn.childForFieldName('property').text : null;
+        const tableArg = op !== null && TABLE_OPS.has(op) && args ? unwrapParens(args.namedChild(0)) : null;
+        const tableName = tableArg ? candidateName(tableArg) : null;
+        if (tableName !== null) {
+          tableEdge(TABLE_WRITE_OPS.has(op) ? 'WRITE' : 'READ', userOf(enclosingFuncId), tableName, op, fn.childForFieldName('property'));
+          consumed.add(tableArg.startIndex);
+          if (tableArg.type === 'member_expression') consumed.add(tableArg.childForFieldName('property').startIndex);
+        }
+
+        // Route registration: the route itself becomes the caller, named by
+        // method + path + line — for its anonymous handler AND for every
+        // middleware call in its arguments (`requireAuth()`, `requireLocationTenant()`).
+        // Crediting middleware to the enclosing scope collapsed 95 routes into one
+        // `_toplevel` caller per file. [RULE] anonymous-caller-synthesized-never-dropped
+        // [RULE] route-middleware-args-credited-to-route
+        const label = routeLabel(fn, args);
+        const handlers = label ? args.namedChildren.filter(isAnonymousFn) : [];
+        const middlewareCalls = label && isRoutePath(args.namedChild(0))
+          ? args.namedChildren.slice(1).filter((a) => a.type === 'call_expression') : [];
+        if (handlers.length || middlewareCalls.length) {
+          const line = node.startPosition.row + 1;
+          const routeId = `${relPath}#${label}@${line}`;
+          entities.push({
+            id: routeId,
+            name: label,
+            type: 'function',
+            line,
+            endLine: node.endPosition.row + 1,
+            exported: false,
+            synthetic: 'route-handler',
           });
+          // Node objects are re-created per access, so match handlers by position.
+          const handlerStarts = new Set(handlers.map((h) => h.startIndex));
+          walk(fn, enclosingFuncId, enclosingClass);
+          for (let i = 0; i < args.childCount; i++) {
+            const arg = args.child(i);
+            if (!handlerStarts.has(arg.startIndex) || !isAnonymousFn(arg)) { walk(arg, routeId, enclosingClass); continue; }
+            for (let j = 0; j < arg.childCount; j++) walk(arg.child(j), routeId, enclosingClass);
+          }
+          return;
         }
       }
 
       // Fall through to walk children (the call_expression can contain more nodes)
     }
 
+    // ── table references: `eq(T.id, …)`, `getTableColumns(T)`, `db.query.T.findMany()` ──
+    // [RULE] drizzle-table-entity-and-usage-edges
+    if (t === 'identifier' || t === 'shorthand_property_identifier') {
+      if (candidates.local.has(node.text) && isUseSite(node)) tableRef(node, candidates.local.get(node.text), enclosingFuncId);
+      return;
+    }
+    if (t === 'member_expression') {
+      const obj = node.childForFieldName('object');
+      const prop = node.childForFieldName('property');
+      // Drizzle's relational API only: `<db>.query.<table>.findMany|findFirst(…)`.
+      // `req.query.page` / `data.query?.pages` are not table reads.
+      const outer = node.parent;
+      const method = outer && outer.type === 'member_expression' ? outer.childForFieldName('property').text : null;
+      const viaQuery = obj.type === 'member_expression' && obj.childForFieldName('property').text === 'query' &&
+        (method === 'findMany' || method === 'findFirst');
+      if (viaQuery && prop.type === 'property_identifier') {
+        tableEdge('READ', userOf(enclosingFuncId), prop.text, 'query', node);
+      } else if (obj.type === 'identifier' && candidates.namespaces.has(obj.text) && isUseSite(node)) {
+        tableRef(node, prop.text, enclosingFuncId);
+      }
+    }
+
+    // ── anonymous function with no named scope around it ─────────────────
+    // Inside a named function, a callback's calls belong to that function
+    // (enclosingFuncId passes through). Outside one, give it a located id.
+    if (!enclosingFuncId && isAnonymousFn(node)) {
+      const anonId = `${relPath}#anonymous@${node.startPosition.row + 1}`;
+      for (let i = 0; i < node.childCount; i++) walk(node.child(i), anonId, enclosingClass);
+      return;
+    }
+
     // ── function_declaration ──────────────────────────────────────────────
     if (t === 'function_declaration' || t === 'function') {
       const nameNode = node.childForFieldName('name');
@@ -451,6 +869,7 @@ function walkTSJS(rootNode, relPath, entities, edges) {
     // const foo = () => ... or const foo = function...
     if (t === 'lexical_declaration' || t === 'variable_declaration') {
       const isExp = isExportedNode(node);
+      const walkedValues = new Set(); // bodies already walked under their own funcId
       for (let i = 0; i < node.namedChildCount; i++) {
         const decl = node.namedChild(i);
         if (decl.type === 'variable_declarator') {
@@ -474,10 +893,43 @@ function walkTSJS(rootNode, relPath, entities, edges) {
             for (let j = 0; j < valueNode.childCount; j++) {
               walk(valueNode.child(j), funcId, enclosingClass);
             }
+            walkedValues.add(valueNode.startIndex);
+          } else if (nameNode && valueNode && valueNode.type === 'call_expression') {
+            // `const scheduleEvents = pgTable('schedule_events', {...})` → table entity.
+            // [RULE] drizzle-table-entity-and-usage-edges
+            const builder = valueNode.childForFieldName('function').text;
+            const args = valueNode.childForFieldName('arguments');
+            const isTable = Object.prototype.hasOwnProperty.call(TABLE_BUILDERS, builder);
+            const isEnum = Object.prototype.hasOwnProperty.call(ENUM_BUILDERS, builder);
+            if (args && (isTable || isEnum)) {
+              const meta = isTable ? tableMeta(builder, args) : enumMeta(builder, args);
+              entities.push({
+                id: `${relPath}#${nameNode.text}@${decl.startPosition.row + 1}`,
+                name: nameNode.text,
+                type: meta.kind,
+                line: decl.startPosition.row + 1,
+                endLine: valueNode.endPosition.row + 1,
+                exported: isExp,
+                meta,
+              });
+              declRanges.push([valueNode.startIndex, valueNode.endIndex]);
+            }
           }
         }
       }
-      // Continue walking children for the declaration itself
+      // Walk the rest of the declaration, but NOT a function body already walked
+      // above — walking it again credited each of its calls to a second, wrong
+      // caller (_toplevel). [RULE] anonymous-caller-synthesized-never-dropped
+      for (let i = 0; i < node.childCount; i++) {
+        const child = node.child(i);
+        if (child.type !== 'variable_declarator') { walk(child, enclosingFuncId, enclosingClass); continue; }
+        for (let j = 0; j < child.childCount; j++) {
+          const part = child.child(j);
+          if (walkedValues.has(part.startIndex) && part.type !== 'identifier') continue;
+          walk(part, enclosingFuncId, enclosingClass);
+        }
+      }
+      return;
     }
 
     // ── export_statement (bare re-exports: export { x, y }) ──────────────

package/bin/gsd-t-graph-exclude.cjs

@@ -0,0 +1,106 @@
+'use strict';
+/**
+ * gsd-t-graph-exclude.cjs — per-project exclude list for the code graph.
+ *
+ * Some repos carry large trees that are not the production application —
+ * design exports, Figma-generated component dumps, prototypes, archived
+ * scripts. They bloat the index, slow SCIP, and put look-alike symbols into
+ * who-calls. A project lists them in `.gsd-t/graph-exclude.json`:
+ *
+ *   { "exclude": ["design/", "figma-exports/**", "scripts/archive/", "**\/*.figma.tsx"] }
+ *
+ * Pattern rules (paths are repo-relative, forward slashes, matched case-insensitively):
+ *   - no `*`            → a path prefix: "design/" or "design" excludes that folder
+ *   - `*`               → any run of characters except "/"
+ *   - `**`              → any run of characters including "/"
+ *
+ * The indexer AND the freshness walker both read this module, so a file the
+ * indexer skipped never shows up as a phantom "new file" on the next query.
+ * [RULE] freshness-excludes-match-indexer-skipdirs
+ *
+ * A malformed file HALTS (throws): silently ignoring it would index exactly the
+ * trees the user asked to keep out, with nothing saying so.
+ *
+ * DEFAULT exclude (no file needed): GSD-T's own tools, which `gsd-t update-all`
+ * copies into every project's bin/ (PROJECT_BIN_TOOLS in bin/gsd-t.js). They are
+ * not the project's code; indexed, they put GSD-T's functions into its who-calls.
+ * Not applied in GSD-T's own repo, where bin/ IS the application. The pattern is
+ * checked against PROJECT_BIN_TOOLS by test/graph-drizzle-tables.test.js.
+ * [RULE] graph-excludes-gsdt-copied-tools-by-default
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const EXCLUDE_FILE = path.join('.gsd-t', 'graph-exclude.json');
+const REGEX_SPECIALS = /[.+?^${}()|[\]\\]/g;
+const GSDT_TOOL_FILES = /^bin\/(gsd-t-[^/]+|archive-progress|cli-preflight|parallel-cli|parallel-cli-tee)\.cjs$/i;
+const GSDT_TOOL_DEFAULT = "bin/<GSD-T's copied tools: gsd-t-*.cjs, archive-progress.cjs, cli-preflight.cjs, parallel-cli*.cjs>";
+
+/** GSD-T's own source repo — its bin/ is the application, never excluded. */
+function isGsdtSourceRepo(projectRoot) {
+  const pkg = path.join(projectRoot, 'package.json');
+  if (!fs.existsSync(pkg)) return false;
+  let parsed;
+  try { parsed = JSON.parse(fs.readFileSync(pkg, 'utf8')); }
+  catch (e) { throw new Error(`package.json is not valid JSON (${e.message}) — cannot tell whether bin/ holds GSD-T's copied tools`); }
+  return parsed !== null && parsed.name === '@tekyzinc/gsd-t';
+}
+
+function toRegex(pattern) {
+  const p = String(pattern).trim().replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+/, '');
+  if (!p) return null;
+  if (!p.includes('*')) {
+    // Plain prefix: the path itself, or anything under it.
+    const base = p.replace(/\/+$/, '').replace(REGEX_SPECIALS, '\\$&');
+    return new RegExp(`^${base}(/|$)`, 'i');
+  }
+  let re = '';
+  for (let i = 0; i < p.length; i++) {
+    const c = p[i];
+    if (c === '*' && p[i + 1] === '*') {
+      i++;
+      if (p[i + 1] === '/') { i++; re += '(?:.*/)?'; } else re += '.*';
+    } else if (c === '*') re += '[^/]*';
+    else re += c.replace(REGEX_SPECIALS, '\\$&');
+  }
+  return new RegExp(`^${re}(/|$)`, 'i');
+}
+
+function validateList(parsed) {
+  const list = parsed ? parsed.exclude : undefined;
+  if (!Array.isArray(list)) return false;
+  return list.every((x) => typeof x === 'string');
+}
+
+/**
+ * Load the project's exclude list. Throws on a malformed file.
+ * @returns {{ patterns: string[], source: string|null, isExcluded: (relPath: string) => boolean }}
+ */
+function loadGraphExcludes(projectRoot) {
+  const file = path.join(projectRoot, EXCLUDE_FILE);
+  const toolsExcluded = !isGsdtSourceRepo(projectRoot);
+  const defaults = toolsExcluded ? [GSDT_TOOL_DEFAULT] : [];
+  const isDefault = (rel) => toolsExcluded && GSDT_TOOL_FILES.test(rel);
+  if (!fs.existsSync(file)) {
+    return { patterns: [], defaults, source: null, isExcluded: (relPath) => isDefault(String(relPath).split(path.sep).join('/')) };
+  }
+  let parsed;
+  try { parsed = JSON.parse(fs.readFileSync(file, 'utf8')); }
+  catch (e) { throw new Error(`${EXCLUDE_FILE} is not valid JSON (${e.message}) — fix it or delete it`); }
+  if (!validateList(parsed)) {
+    throw new Error(`${EXCLUDE_FILE} must be { "exclude": ["folder/", "glob/**", ...] }`);
+  }
+  const regexes = parsed.exclude.map(toRegex).filter(Boolean);
+  return {
+    patterns: parsed.exclude,
+    defaults,
+    source: EXCLUDE_FILE,
+    isExcluded: (relPath) => {
+      const rel = String(relPath).split(path.sep).join('/');
+      return isDefault(rel) || regexes.some((r) => r.test(rel));
+    },
+  };
+}
+
+module.exports = { loadGraphExcludes, EXCLUDE_FILE, GSDT_TOOL_FILES, _toRegex: toRegex };

package/bin/gsd-t-graph-freshness.cjs

@@ -107,12 +107,13 @@ function walkTree(dir, results = []) {
   try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
   catch { return results; }
   for (const e of entries) {
-    if (e.name.startsWith('.') && e.name !== '.claude') {
-      if (shouldExcludeDir(e.name)) continue;
-    }
-    if (shouldExcludeDir(e.name)) continue;
     const full = path.join(dir, e.name);
     if (e.isDirectory()) {
+      // The skip list names DIRECTORIES, as in the indexer. Applied to file names
+      // it dropped `build-analytics.ts` / `build_guides.py` (prefix "build"),
+      // so every query deleted 7 indexed hilo files from the graph as "gone".
+      // [RULE] freshness-excludes-match-indexer-skipdirs
+      if (shouldExcludeDir(e.name)) continue;
       walkTree(full, results);
     } else if (e.isFile() && TRACKED_EXTS.has(path.extname(e.name))) {
       results.push(full);
@@ -220,7 +221,11 @@ function compute_touched_files(db, projectRoot) {
   }
 
   // Walk the current working tree
-  const liveFiles = walkTree(projectRoot);
+  // Same exclude list as the indexer, so an excluded file is never a phantom ADD
+  // and a newly-excluded one drops out as a DELETE. [RULE] freshness-excludes-match-indexer-skipdirs
+  const { isExcluded } = require('./gsd-t-graph-exclude.cjs').loadGraphExcludes(projectRoot);
+  const liveFiles = walkTree(projectRoot)
+    .filter((abs) => !isExcluded(path.relative(projectRoot, abs)));
 
   const liveRelSet = new Set();
   const edits = [];
@@ -286,6 +291,12 @@ function revalidateOneHopImporters(db, fileRel, op) {
       db.prepare(`DELETE FROM nodes WHERE id=? AND kind='FILE'`).run(fileRel);
       // Remove entity nodes belonging to this file
       db.prepare(`DELETE FROM nodes WHERE file=? AND kind != 'FILE'`).run(fileRel);
+      // …its call / table-usage edges (src is `file#fn`, not the bare file) and its
+      // files-table row. Left behind, a deleted or newly-excluded file stayed in
+      // `graph status` and was re-flagged as a DELETE on every query.
+      // [RULE] status-counts-files-table
+      db.prepare(`DELETE FROM edges WHERE src LIKE ?`).run(`${fileRel}#%`);
+      if (hasTable(db, 'files')) db.prepare(`DELETE FROM files WHERE file=?`).run(fileRel);
       return { revalidated: true, op: 'DELETE', file: fileRel };
     }