gitnexus 1.6.11-rc.2 → 1.6.11-rc.21

package/dist/core/group/extractors/java-workspace-extractor.js

@@ -1,7 +1,20 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { XMLParser } from 'fast-xml-parser';
 import { shouldIgnorePath, loadIgnoreRules } from '../../../config/ignore-service.js';
 import { logger } from '../../logger.js';
+// POMs are static metadata. Parse hierarchy with a real XML parser, but do not
+// invoke Maven or resolve the effective model. Properties, profiles, and remote
+// parent resolution remain outside this extractor's deterministic boundary.
+const pomParser = new XMLParser({
+    ignoreAttributes: true,
+    removeNSPrefix: true,
+    trimValues: true,
+    parseTagValue: false,
+    processEntities: false,
+    ignoreDeclaration: true,
+    ignorePiTags: true,
+});
 async function parseJavaManifest(repoPath) {
     const pomPath = path.join(repoPath, 'pom.xml');
     try {
@@ -9,13 +22,14 @@ async function parseJavaManifest(repoPath) {
         return parsePom(content);
     }
     catch {
-        // fall through to Gradle
+        // Missing pom.xml — fall through to Gradle.
     }
+    const gradleSidecars = await readGradleSidecars(repoPath);
     for (const name of ['build.gradle.kts', 'build.gradle']) {
         const gradlePath = path.join(repoPath, name);
         try {
             const content = await fs.readFile(gradlePath, 'utf-8');
-            return parseGradle(content, repoPath);
+            return parseGradle(content, repoPath, gradleSidecars);
         }
         catch {
             continue;
@@ -23,45 +37,244 @@ async function parseJavaManifest(repoPath) {
     }
     return null;
 }
+async function readIfPresent(filePath) {
+    try {
+        return await fs.readFile(filePath, 'utf-8');
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readGradleSidecars(repoPath) {
+    const [properties, settingsKts, settingsGroovy, catalog] = await Promise.all([
+        readIfPresent(path.join(repoPath, 'gradle.properties')),
+        readIfPresent(path.join(repoPath, 'settings.gradle.kts')),
+        readIfPresent(path.join(repoPath, 'settings.gradle')),
+        readIfPresent(path.join(repoPath, 'gradle', 'libs.versions.toml')),
+    ]);
+    const sidecars = {
+        catalogLibraries: new Map(),
+        catalogBundles: new Map(),
+    };
+    const groupMatch = properties?.match(/(?:^|\n)\s*group\s*=\s*([^\s#]+)/);
+    if (groupMatch)
+        sidecars.propertiesGroup = groupMatch[1];
+    const settings = settingsKts ?? settingsGroovy;
+    const nameMatch = settings?.match(/rootProject\.name\s*=\s*['"]([^'"]+)['"]/);
+    if (nameMatch)
+        sidecars.rootProjectName = nameMatch[1];
+    if (catalog) {
+        const parsed = parseGradleVersionCatalog(catalog);
+        sidecars.catalogLibraries = parsed.libraries;
+        sidecars.catalogBundles = parsed.bundles;
+    }
+    return sidecars;
+}
+function catalogAccessors(alias) {
+    const dotted = alias.replace(/[-_]/g, '.');
+    const camel = alias.replace(/[-_]+([A-Za-z0-9])/g, (_, char) => char.toUpperCase());
+    return [...new Set([alias, dotted, camel])];
+}
+function projectAccessorToArtifactId(accessor) {
+    const last = accessor.split('.').pop();
+    return last.replace(/[A-Z]/g, (char) => `-${char.toLowerCase()}`).replace(/^-/, '');
+}
+function moduleToGa(module) {
+    const parts = module.split(':');
+    return parts.length >= 2 ? `${parts[0]}:${parts[1]}` : undefined;
+}
+function parseInlineTomlTable(rhs) {
+    const fields = {};
+    for (const match of rhs.matchAll(/([A-Za-z0-9_-]+)\s*=\s*['"]([^'"]+)['"]/g)) {
+        fields[match[1]] = match[2];
+    }
+    return fields;
+}
+/** Default Gradle catalog (`gradle/libs.versions.toml`) — aliases only, no version resolution. */
+function parseGradleVersionCatalog(toml) {
+    const libraries = new Map();
+    const bundles = new Map();
+    let section = 'other';
+    const addLibrary = (alias, ga) => {
+        for (const accessor of catalogAccessors(alias))
+            libraries.set(accessor, ga);
+    };
+    for (const raw of toml.split(/\r?\n/)) {
+        const line = raw.replace(/#.*$/, '').trim();
+        if (!line)
+            continue;
+        const header = line.match(/^\[([^\]]+)\]$/);
+        if (header) {
+            const name = header[1];
+            section =
+                name === 'libraries' || name.endsWith('.libraries')
+                    ? 'libraries'
+                    : name === 'bundles' || name.endsWith('.bundles')
+                        ? 'bundles'
+                        : 'other';
+            continue;
+        }
+        if (section === 'libraries') {
+            const dottedModule = line.match(/^([A-Za-z0-9._-]+)\.module\s*=\s*['"]([^'"]+)['"]$/);
+            if (dottedModule) {
+                const ga = moduleToGa(dottedModule[2]);
+                if (ga)
+                    addLibrary(dottedModule[1], ga);
+                continue;
+            }
+            const assignment = line.match(/^([A-Za-z0-9._-]+)\s*=\s*(.+)$/);
+            if (!assignment)
+                continue;
+            const alias = assignment[1];
+            const rhs = assignment[2].trim();
+            const quoted = rhs.match(/^['"]([^'"]+)['"]$/);
+            if (quoted) {
+                const ga = moduleToGa(quoted[1]);
+                if (ga)
+                    addLibrary(alias, ga);
+                continue;
+            }
+            const table = parseInlineTomlTable(rhs);
+            const ga = table.module
+                ? moduleToGa(table.module)
+                : table.group && table.name
+                    ? `${table.group}:${table.name}`
+                    : undefined;
+            if (ga)
+                addLibrary(alias, ga);
+            continue;
+        }
+        if (section === 'bundles') {
+            const assignment = line.match(/^([A-Za-z0-9._-]+)\s*=\s*\[([^\]]*)\]$/);
+            if (!assignment)
+                continue;
+            const members = [...assignment[2].matchAll(/['"]([^'"]+)['"]/g)].map((match) => match[1]);
+            for (const accessor of catalogAccessors(assignment[1]))
+                bundles.set(accessor, members);
+        }
+    }
+    return { libraries, bundles };
+}
+const GRADLE_GROUP_PATTERNS = [
+    /(?:^|[\n{;])\s*(?:rootProject\.)?group\s*=\s*['"]([^'"]+)['"]/,
+    /(?:^|[\n{;])\s*group\s+['"]([^'"]+)['"]/,
+];
+const GRADLE_COORD_CONFIGS = 'implementation|api|compileOnly|runtimeOnly|testImplementation|testApi|testCompileOnly|compile|kapt|ksp|commonMainImplementation|commonMainApi';
+const CATALOG_ALIAS = '([A-Za-z0-9_]+(?:\\.[A-Za-z0-9_]+)*)(?:\\.get\\(\\)|\\.asProvider\\(\\))?';
+function gradleDepRe(suffix) {
+    return new RegExp(`(?:${GRADLE_COORD_CONFIGS})\\s*${suffix}`, 'g');
+}
+function parseGradleGroup(content) {
+    for (const pattern of GRADLE_GROUP_PATTERNS) {
+        const match = content.match(pattern);
+        if (match?.[1])
+            return match[1];
+    }
+    return undefined;
+}
+function asXmlNode(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function xmlText(value) {
+    if (typeof value === 'string' || typeof value === 'number') {
+        const text = String(value).trim();
+        return text || undefined;
+    }
+    const nested = asXmlNode(value)?.['#text'];
+    if (nested === undefined)
+        return undefined;
+    return xmlText(nested);
+}
+function xmlChildText(node, name) {
+    return node ? xmlText(node[name]) : undefined;
+}
+function asList(value) {
+    if (value === undefined || value === null)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}
+/** Direct project dependencies only — not BOM, profiles, or plugin classpath. */
+function collectProjectDependencies(project, deps) {
+    const dependencies = asXmlNode(project.dependencies);
+    if (!dependencies)
+        return;
+    for (const dep of asList(dependencies.dependency)) {
+        const depNode = asXmlNode(dep);
+        const groupId = xmlChildText(depNode, 'groupId');
+        const artifactId = xmlChildText(depNode, 'artifactId');
+        if (groupId && artifactId)
+            deps.push(`${groupId}:${artifactId}`);
+    }
+}
 function parsePom(content) {
-    const projectGroupMatch = content.match(/<project[^>]*>[\s\S]*?<groupId>([^<]+)<\/groupId>/);
-    const projectArtifactMatch = content.match(/<project[^>]*>[\s\S]*?<artifactId>([^<]+)<\/artifactId>/);
-    if (!projectGroupMatch || !projectArtifactMatch)
+    let parsed;
+    try {
+        // parseSourceSafe guards tree-sitter's Windows SIGSEGV by switching to a
+        // chunked input callback above 16 KB; XMLParser only accepts XML text, so
+        // routing POMs through it silently yields an empty document.
+        // eslint-disable-next-line gitnexus/require-safe-parse
+        parsed = pomParser.parse(content);
+    }
+    catch {
         return null;
-    const groupId = projectGroupMatch[1].trim();
-    const artifactId = projectArtifactMatch[1].trim();
-    const deps = [];
-    const depBlocks = content.matchAll(/<dependency>\s*([\s\S]*?)<\/dependency>/g);
-    for (const block of depBlocks) {
-        const gMatch = block[1].match(/<groupId>([^<]+)<\/groupId>/);
-        const aMatch = block[1].match(/<artifactId>([^<]+)<\/artifactId>/);
-        if (gMatch && aMatch) {
-            deps.push(`${gMatch[1].trim()}:${aMatch[1].trim()}`);
-        }
     }
+    const project = asXmlNode(asXmlNode(parsed)?.project);
+    if (!project)
+        return null;
+    // Maven inherits groupId from <parent>, but artifactId is always the
+    // project's own direct child and must never fall back to parent.artifactId.
+    const groupId = xmlChildText(project, 'groupId') ?? xmlChildText(asXmlNode(project.parent), 'groupId');
+    const artifactId = xmlChildText(project, 'artifactId');
+    if (!groupId || !artifactId)
+        return null;
+    const deps = [];
+    collectProjectDependencies(project, deps);
     return { groupId, artifactId, deps: [...new Set(deps)] };
 }
-function parseGradle(content, repoPath) {
-    const groupMatch = content.match(/group\s*=\s*['"]([^'"]+)['"]/);
-    const dirName = path.basename(repoPath);
-    const groupId = groupMatch ? groupMatch[1] : '';
+function parseGradle(content, repoPath, sidecars = { catalogLibraries: new Map(), catalogBundles: new Map() }) {
+    // Static text + default catalog file. Do not execute Gradle.
+    const groupId = parseGradleGroup(content) ?? sidecars.propertiesGroup ?? '';
     if (!groupId)
         return null;
-    const artifactId = dirName;
+    const artifactId = sidecars.rootProjectName ?? path.basename(repoPath);
+    const { catalogLibraries, catalogBundles } = sidecars;
     const deps = [];
-    // implementation("group:artifact:version") or api("group:artifact:version")
-    const depMatches = content.matchAll(/(?:implementation|api|compileOnly|runtimeOnly)\s*\(\s*['"]([^'"]+)['"]\s*\)/g);
-    for (const m of depMatches) {
-        const parts = m[1].split(':');
-        if (parts.length >= 2) {
-            deps.push(`${parts[0]}:${parts[1]}`);
+    const pushCatalogAlias = (alias) => {
+        const ga = catalogLibraries.get(alias);
+        if (ga)
+            deps.push(ga);
+    };
+    const namedPattern = gradleDepRe(`(?:\\(\\s*)?(?:group\\s*=\\s*['"](?<group1>[^'"]+)['"]\\s*,\\s*name\\s*=\\s*['"](?<name1>[^'"]+)['"]|name\\s*=\\s*['"](?<name2>[^'"]+)['"]\\s*,\\s*group\\s*=\\s*['"](?<group2>[^'"]+)['"]|group:\\s*['"](?<group3>[^'"]+)['"]\\s*,\\s*name:\\s*['"](?<name3>[^'"]+)['"]|name:\\s*['"](?<name4>[^'"]+)['"]\\s*,\\s*group:\\s*['"](?<group4>[^'"]+)['"])`);
+    for (const match of content.matchAll(namedPattern)) {
+        const group = match.groups?.group1 ?? match.groups?.group2 ?? match.groups?.group3 ?? match.groups?.group4;
+        const name = match.groups?.name1 ?? match.groups?.name2 ?? match.groups?.name3 ?? match.groups?.name4;
+        if (group && name)
+            deps.push(`${group}:${name}`);
+    }
+    for (const match of content.matchAll(gradleDepRe(`(?:\\(\\s*)?libs(?:\\.libraries)?\\.(?!bundles\\.|plugins\\.)${CATALOG_ALIAS}`))) {
+        pushCatalogAlias(match[1]);
+    }
+    for (const match of content.matchAll(gradleDepRe(`(?:\\(\\s*)?libs\\.bundles\\.${CATALOG_ALIAS}`))) {
+        for (const member of catalogBundles.get(match[1]) ?? []) {
+            for (const accessor of catalogAccessors(member))
+                pushCatalogAlias(accessor);
         }
     }
-    // implementation(project(":subproject"))
-    const projDeps = content.matchAll(/(?:implementation|api)\s*\(\s*project\s*\(\s*['"]([^'"]+)['"]\s*\)\s*\)/g);
-    for (const m of projDeps) {
-        const subName = m[1].replace(/^:/, '');
-        deps.push(`${groupId}:${subName}`);
+    for (const match of content.matchAll(gradleDepRe(`\\(\\s*projects\\.([A-Za-z][A-Za-z0-9.]*)`))) {
+        deps.push(`${groupId}:${projectAccessorToArtifactId(match[1])}`);
+    }
+    for (const match of content.matchAll(gradleDepRe(`(?:\\(\\s*['"]([^'"]+)['"]\\s*\\)|['"]([^'"]+)['"])`))) {
+        const coord = match[1] ?? match[2];
+        if (!coord)
+            continue;
+        const parts = coord.split(':');
+        if (parts.length >= 2)
+            deps.push(`${parts[0]}:${parts[1]}`);
+    }
+    for (const match of content.matchAll(gradleDepRe(`(?:\\(\\s*)?project\\s*\\(\\s*['"]([^'"]+)['"]\\s*\\)`))) {
+        deps.push(`${groupId}:${match[1].replace(/^:/, '')}`);
     }
     return { groupId, artifactId, deps: [...new Set(deps)] };
 }

package/dist/core/group/extractors/manifest-extractor.d.ts

@@ -47,7 +47,7 @@ export declare class ManifestExtractor {
      * equality matching without requiring wildcard logic downstream.
      *
      * NOTE on exhaustiveness: the switch covers every current
-     * `ContractType` variant and falls through to a `never` assertion so
+     * manifest-declared contract type and falls through to a `never` assertion so
      * TypeScript fails the build if a new variant is added without a
      * corresponding case.
      */

package/dist/core/group/extractors/manifest-extractor.js

@@ -311,7 +311,7 @@ export class ManifestExtractor {
      * equality matching without requiring wildcard logic downstream.
      *
      * NOTE on exhaustiveness: the switch covers every current
-     * `ContractType` variant and falls through to a `never` assertion so
+     * manifest-declared contract type and falls through to a `never` assertion so
      * TypeScript fails the build if a new variant is added without a
      * corresponding case.
      */

package/dist/core/group/matching.js

@@ -21,7 +21,14 @@ function buildNoisyContractFilter(matchingConfig) {
         ? new Set(matchingConfig.exclude_links_paths.map((p) => p.replace(/\/+$/, '')))
         : new Set();
     const excludeParamOnly = matchingConfig?.exclude_links_param_only_paths === true;
-    return function isNoisyHttpContract(contractId) {
+    return function isNoisyContract(contractId) {
+        if (contractId.startsWith('graphql::')) {
+            const parts = contractId.split('::');
+            if (parts.length < 3)
+                return false;
+            const field = parts.slice(2).join('::');
+            return excludePaths.has(field) || excludePaths.has(`/${field}`);
+        }
         if (!contractId.startsWith('http::'))
             return false;
         const parts = contractId.split('::');

package/dist/core/group/service.js

@@ -301,8 +301,9 @@ export class GroupService {
         // group tools never need it — so deferring it here keeps that closure off
         // MCP server startup entirely and off every non-sync group call. The CLI
         // already does exactly this at `cli/group.ts`'s sync command.
-        const { syncGroup } = await import('./sync.js');
+        const { syncGroup, formatGroupSyncAmbiguousError } = await import('./sync.js');
         const { GroupSyncLockError } = await import('./group-lock.js');
+        const { RegistryAmbiguousTargetError } = await import('../../storage/repo-manager.js');
         let result;
         try {
             result = await syncGroup(config, {
@@ -315,6 +316,9 @@ export class GroupService {
             });
         }
         catch (err) {
+            if (err instanceof RegistryAmbiguousTargetError) {
+                return { error: formatGroupSyncAmbiguousError(err) };
+            }
             // Fails closed (R9): this sync could not be protected against a concurrent
             // one, so it did not run and wrote nothing. Return it through the same
             // error channel a missing group uses — NEVER as a success payload of zeroes,

package/dist/core/group/storage.js

@@ -78,6 +78,7 @@ packages: {}
 
 detect:
   http: true
+  graphql: false
   grpc: true
   topics: true
 

package/dist/core/group/sync.d.ts

@@ -1,4 +1,4 @@
-import { type RegistryEntry } from '../../storage/repo-manager.js';
+import { RegistryAmbiguousTargetError, type RegistryEntry } from '../../storage/repo-manager.js';
 import type { GroupConfig, RepoHandle, RepoSnapshot, StoredContract, CrossLink, GroupManifestLink, MatchType } from './types.js';
 export interface SyncOptions {
     extractorOverride?: ((repo: RepoHandle) => Promise<StoredContract[]>) | (() => Promise<StoredContract[]>);
@@ -64,6 +64,8 @@ export interface SyncResult {
     registryOutcome: RegistryWriteOutcome;
 }
 export declare function stableRepoPoolId(entry: RegistryEntry, allEntries: RegistryEntry[]): string;
+/** Operator copy for group sync — unique `--name`, not a path in yaml. */
+export declare function formatGroupSyncAmbiguousError(err: RegistryAmbiguousTargetError): string;
 /** A batch of manifest links whose referenced in-group repos fit one resident window. */
 export interface ManifestWindow {
     links: GroupManifestLink[];

package/dist/core/group/sync.js

@@ -2,8 +2,9 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { Buffer } from 'node:buffer';
 import { initLbug, executeParameterized, pinRepo, getMaxResidentRepos, } from '../lbug/pool-adapter.js';
-import { readRegistry, readRegistryStrict, } from '../../storage/repo-manager.js';
+import { findRegistryEntryByName, canonicalizePath, registryPathEquals, readRegistry, readRegistryStrict, RegistryAmbiguousTargetError, } from '../../storage/repo-manager.js';
 import { HttpRouteExtractor } from './extractors/http-route-extractor.js';
+import { GraphqlExtractor } from './extractors/graphql-extractor.js';
 import { GrpcExtractor } from './extractors/grpc-extractor.js';
 import { ThriftExtractor } from './extractors/thrift-extractor.js';
 import { TopicExtractor } from './extractors/topic-extractor.js';
@@ -27,9 +28,16 @@ export function stableRepoPoolId(entry, allEntries) {
     }
     return base;
 }
+/** Operator copy for group sync — unique `--name`, not a path in yaml. */
+export function formatGroupSyncAmbiguousError(err) {
+    const listing = err.matches.map((m) => `  - ${m.path}`).join('\n');
+    return (`Multiple registered repos are named "${err.target}":\n${listing}\n` +
+        `Give each clone a unique registry name with \`gitnexus analyze --name\`, then re-sync. ` +
+        `Do not put a filesystem path in group.yaml.`);
+}
 function defaultResolveHandle(allEntries) {
     return async (registryName, groupPath) => {
-        const e = allEntries.find((en) => en.name === registryName);
+        const e = findRegistryEntryByName(allEntries, registryName);
         if (!e)
             return null;
         const poolId = stableRepoPoolId(e, allEntries);
@@ -135,6 +143,9 @@ export async function syncGroup(config, opts) {
     // windowed manifest resolution below (re-init + lease per window). Keyed by
     // group path because manifest links reference repos by group path.
     const repoHandles = new Map();
+    // Keep resolved disk paths even when extraction fails and removes the
+    // corresponding handle; workspace discovery does not need a readable index.
+    const resolvedRepoPaths = new Map();
     // Every eviction lease this sync holds. Window loops release their own leases
     // (bounding residency); this set is the defensive outer-finally sweep —
     // release disposers are idempotent, so double-release is a safe no-op.
@@ -152,7 +163,13 @@ export async function syncGroup(config, opts) {
             registryEntries = await readRegistryStrict();
             const entries = registryEntries;
             const resolve = opts?.resolveRepoHandle ?? defaultResolveHandle(entries);
+            if (!opts?.resolveRepoHandle) {
+                for (const regName of Object.values(config.repos)) {
+                    findRegistryEntryByName(entries, regName);
+                }
+            }
             const httpEx = new HttpRouteExtractor();
+            const graphqlEx = new GraphqlExtractor();
             const grpcEx = new GrpcExtractor();
             const thriftEx = new ThriftExtractor();
             const topicEx = new TopicExtractor();
@@ -163,6 +180,7 @@ export async function syncGroup(config, opts) {
                     missingRepos.push(groupPath);
                     continue;
                 }
+                resolvedRepoPaths.set(groupPath, handle.repoPath);
                 const poolId = handle.id;
                 const lbugPath = path.join(handle.storagePath, 'lbug');
                 // Staged per repo, not appended straight to `autoContracts`. Extractors
@@ -181,7 +199,7 @@ export async function syncGroup(config, opts) {
                     // resolution no longer reuses these executors — it re-inits + leases
                     // each repo per window (see windowed resolution below, issue #2189).
                     // Record the pool identity so windowed resolution can re-init.
-                    repoHandles.set(groupPath, { poolId, lbugPath });
+                    repoHandles.set(groupPath, { poolId, lbugPath, repoPath: handle.repoPath });
                     const executor = (query, params) => executeParameterized(poolId, query, params ?? {});
                     const boundaries = await detectServiceBoundaries(handle.repoPath);
                     if (config.detect.http) {
@@ -194,6 +212,16 @@ export async function syncGroup(config, opts) {
                             });
                         }
                     }
+                    if (config.detect.graphql === true) {
+                        const extracted = await graphqlEx.extract(executor, handle.repoPath, handle);
+                        for (const c of extracted) {
+                            repoContracts.push({
+                                ...c,
+                                repo: groupPath,
+                                service: assignService(c.symbolRef.filePath, boundaries),
+                            });
+                        }
+                    }
                     if (config.detect.grpc) {
                         const extracted = await grpcEx.extract(executor, handle.repoPath, handle);
                         for (const c of extracted) {
@@ -244,7 +272,8 @@ export async function syncGroup(config, opts) {
                         };
                     }
                     catch {
-                        const e = entries.find((en) => en.name === regName);
+                        const resolvedHandlePath = canonicalizePath(handle.repoPath);
+                        const e = entries.find((en) => registryPathEquals(canonicalizePath(en.path), resolvedHandlePath));
                         repoSnapshots[groupPath] = {
                             indexedAt: e?.indexedAt || '',
                             lastCommit: e?.lastCommit || '',
@@ -267,6 +296,8 @@ export async function syncGroup(config, opts) {
                         autoContracts.push(contract);
                 }
                 catch (err) {
+                    if (err instanceof RegistryAmbiguousTargetError)
+                        throw err;
                     // This spans initLbug plus all contract extraction for the repo. The
                     // error used to be discarded entirely, so the only trace of (say) a
                     // storage-version mismatch was an empty contracts.json and a later
@@ -297,7 +328,14 @@ export async function syncGroup(config, opts) {
             if (!registryEntries)
                 registryEntries = await readRegistry();
             for (const [groupPath, regName] of Object.entries(config.repos)) {
-                const e = registryEntries.find((en) => en.name === regName);
+                const resolvedPath = resolvedRepoPaths.get(groupPath);
+                if (resolvedPath) {
+                    repoPaths.set(groupPath, resolvedPath);
+                    continue;
+                }
+                if (opts?.resolveRepoHandle)
+                    continue;
+                const e = findRegistryEntryByName(registryEntries, regName);
                 if (e)
                     repoPaths.set(groupPath, e.path);
             }

package/dist/core/group/types.d.ts

@@ -1,4 +1,6 @@
-export type ContractType = 'http' | 'grpc' | 'thrift' | 'topic' | 'lib' | 'custom' | 'include';
+import type { ImpactRisk, ImpactRiskResult } from '../../_shared/index.js';
+export type ContractType = 'http' | 'graphql' | 'grpc' | 'thrift' | 'topic' | 'lib' | 'custom' | 'include';
+export type ManifestContractType = Exclude<ContractType, 'graphql'>;
 export type MatchType = 'exact' | 'manifest' | 'wildcard';
 export type ContractRole = 'provider' | 'consumer';
 export interface GroupConfig {
@@ -14,12 +16,13 @@ export interface GroupConfig {
 export interface GroupManifestLink {
     from: string;
     to: string;
-    type: ContractType;
+    type: ManifestContractType;
     contract: string;
     role: ContractRole;
 }
 export interface DetectConfig {
     http: boolean;
+    graphql?: boolean;
     grpc: boolean;
     thrift: boolean;
     topics: boolean;
@@ -28,11 +31,12 @@ export interface DetectConfig {
 }
 export interface MatchingConfig {
     /**
-     * HTTP paths to exclude from cross-link matching. Contracts at these paths
+     * HTTP paths or GraphQL root fields to exclude from cross-link matching. Contracts at these paths
      * are still extracted and visible in the registry, but they don't produce
      * cross-repo links. Useful for health-check endpoints (`/ping`, `/health`)
      * that every service exposes and would otherwise create N×M false links.
-     * Trailing slashes are normalized before comparison.
+     * Trailing slashes are normalized before comparison. GraphQL fields may be
+     * written as `health` or `/health`.
      * @default []
      */
     exclude_links_paths?: string[];
@@ -163,7 +167,17 @@ export interface GroupImpactResult {
         modules_affected: number;
         cross_repo_hits: number;
     };
-    risk: string;
+    risk: ImpactRisk;
+    /**
+     * Two-axis (direct + total) risk from the local leg, then `mergeRisk` with
+     * crossings — compare File vs symbol here, not via top-level `risk`.
+     */
+    riskSharedAxes?: ImpactRisk;
+    /**
+     * Local-leg scale metadata (File / skipped enrichment). Crossings do not
+     * invent process/module membership for File nodes.
+     */
+    riskScale?: ImpactRiskResult['riskScale'];
     /**
      * `'lower-bound'` when the fan-out was cut short, so `risk` is a FLOOR, not a
      * verdict. Same vocabulary as single-repo `impact`'s `epistemic` field.

package/dist/core/incremental/derived-writeback.d.ts

@@ -0,0 +1,36 @@
+import type { KnowledgeGraph } from '../graph/types.js';
+import type { FileHashDiff } from '../../storage/file-hash.js';
+/** The FTS-backed members of `tables`. */
+export declare const ftsTablesAmong: (tables: Iterable<string>) => Set<string>;
+/**
+ * Whether a surgical incremental write may reuse the persisted derived layer.
+ *
+ * Deletions disqualify it: the persisted Community/Process rows and their
+ * MEMBER_OF / STEP_IN_PROCESS edges can reference nodes that no longer exist
+ * after this run, and nothing short of re-deriving can tell which.
+ *
+ * Added or content-changed files also disqualify it: they can introduce,
+ * rename, or retarget symbols and CALLS edges that Leiden and flow extraction
+ * consume. File-deletion-only was too weak a proof that the derived graph is
+ * still valid.
+ */
+export declare const shouldPreservePersistedDerivedGraph: (diff: Pick<FileHashDiff, "deleted" | "added" | "changed">) => boolean;
+/**
+ * FTS-backed node tables that the fresh graph will WRITE rows into for
+ * `fileSet` — the inserting half of the DML.
+ *
+ * Callers must union this with a DB probe for the deleting half
+ * (`nodeTablesWithRowsForFiles`): a table whose last row in these files was
+ * just removed by the edit has nothing here, but still holds a stale row that
+ * the writeback must delete, and deleting it means taking its index down too.
+ */
+export declare const incrementalFtsTablesFromGraph: (graph: KnowledgeGraph, fileSet: ReadonlySet<string>) => Set<string>;
+/**
+ * The node tables an incremental DETACH DELETE should target, given the FTS
+ * tables this run is rebuilding.
+ *
+ * Every non-FTS table (Folder, CodeElement, …) deletes as before. An FTS-backed
+ * table only deletes when its index is being rebuilt anyway, because deleting
+ * from it otherwise would mean DML against a live FTS index (#2589).
+ */
+export declare const nodeTablesForIncrementalDelete: (allNodeTables: readonly string[], rebuildingFtsTables: ReadonlySet<string>) => string[];