grepmax 0.26.27 → 0.26.28

package/dist/lib/daemon/graph-handler.js

@@ -0,0 +1,853 @@
+"use strict";
+/**
+ * Daemon-side handlers for the `graph.*` read verbs.
+ *
+ * The commands that used to open LanceDB themselves (`test`, `impact`, `trace`,
+ * `peek`, `dead`, `audit`) now send one IPC line and render the answer. The work
+ * they used to do between `ensureTable()` and the first `console.log` lives
+ * here, so both paths run the *same* code:
+ *
+ *   - the daemon runs `runGraph*` against its warm `VectorDB`
+ *   - a CLI with no daemon runs the identical `runGraph*` against a local one
+ *
+ * That is what makes the two paths byte-identical: the commands hold only
+ * argument parsing and rendering, and every clamp lives inside the `runGraph*`
+ * function rather than in one of the two callers.
+ *
+ * Results are finished answers, never raw rows. `graph.audit` reads up to 500k
+ * chunks and returns a few dozen ranked lines; `graph.dead` reads the whole
+ * caller set and returns a count plus three locations. Nothing here streams.
+ *
+ * Scope on the wire: the CLI resolves `--in`/`--exclude` locally (that needs its
+ * cwd and the filesystem) and sends absolute prefixes. The daemon re-validates
+ * every one with `resolveContainedPath` — exactly as the `search` case does —
+ * and rebuilds the same `ResolvedScope` with `scopeFromPrefixes`, including the
+ * single-`--in`-collapses-into-pathPrefix rule, so the WHERE clauses match.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GRAPH_VERB_TIMEOUT_MS = void 0;
+exports.scopeFromPrefixes = scopeFromPrefixes;
+exports.inPrefixesOf = inPrefixesOf;
+exports.encodeScope = encodeScope;
+exports.encodeSymbolFamilies = encodeSymbolFamilies;
+exports.decodeSymbolFamilies = decodeSymbolFamilies;
+exports.isDaemonReadableProject = isDaemonReadableProject;
+exports.runGraphResolve = runGraphResolve;
+exports.runGraphTests = runGraphTests;
+exports.runGraphDependents = runGraphDependents;
+exports.runGraphTrace = runGraphTrace;
+exports.runGraphPeek = runGraphPeek;
+exports.runGraphDead = runGraphDead;
+exports.runGraphNeighbors = runGraphNeighbors;
+exports.runGraphPaths = runGraphPaths;
+exports.runGraphSubgraph = runGraphSubgraph;
+exports.runGraphRisk = runGraphRisk;
+exports.computeAudit = computeAudit;
+exports.runGraphAudit = runGraphAudit;
+exports.createGraphVerbs = createGraphVerbs;
+exports.callGraphVerb = callGraphVerb;
+const path = __importStar(require("node:path"));
+const languages_1 = require("../core/languages");
+const callsites_1 = require("../graph/callsites");
+const graph_builder_1 = require("../graph/graph-builder");
+const impact_1 = require("../graph/impact");
+const arrow_1 = require("../utils/arrow");
+const daemon_client_1 = require("../utils/daemon-client");
+const filter_builder_1 = require("../utils/filter-builder");
+const path_containment_1 = require("../utils/path-containment");
+const project_registry_1 = require("../utils/project-registry");
+const scope_filter_1 = require("../utils/scope-filter");
+const store_access_1 = require("../utils/store-access");
+const tests_footer_1 = require("../utils/tests-footer");
+const MAX_DEPTH = 3;
+const AUDIT_ROW_LIMIT = 500000;
+const MAX_AUDIT_TOP = 1000;
+const DEAD_TOP_CALLERS = 3;
+/** `get_neighbors` caps hops at 5; the daemon re-clamps rather than trusting it. */
+const MAX_NEIGHBOR_HOPS = 5;
+/** `find_paths` caps hops at 10. */
+const MAX_PATH_HOPS = 10;
+/** A subgraph request builds one OR clause per file; bound it. */
+const MAX_SUBGRAPH_FILES = 500;
+/** A diff can name many symbols; each costs three graph queries. */
+const MAX_RISK_SYMBOLS = 200;
+function clampInt(value, min, max, fallback) {
+    const n = typeof value === "number" ? value : Number.NaN;
+    if (!Number.isFinite(n))
+        return fallback;
+    return Math.min(Math.max(Math.trunc(n), min), max);
+}
+function withTrailingSlash(p) {
+    return p.endsWith("/") ? p : `${p}/`;
+}
+/**
+ * Rebuild the CLI's `ResolvedScope` from the prefixes on the wire.
+ *
+ * Mirrors `resolveScope`: a single `--in` collapses into `pathPrefix` (which
+ * keeps the WHERE clause simple), two or more stay in `inPrefixes` with
+ * `pathPrefix` back at the project root.
+ */
+function scopeFromPrefixes(projectRoot, inPrefixes, excludePrefixes) {
+    if (inPrefixes.length === 1) {
+        return { pathPrefix: inPrefixes[0], inPrefixes: [], excludePrefixes };
+    }
+    return {
+        pathPrefix: withTrailingSlash(projectRoot),
+        inPrefixes,
+        excludePrefixes,
+    };
+}
+/**
+ * The inverse, for the client: flatten a `ResolvedScope` back into the
+ * uncollapsed prefix list the wire carries.
+ */
+function inPrefixesOf(projectRoot, scope) {
+    if (scope.inPrefixes.length > 0)
+        return scope.inPrefixes;
+    return scope.pathPrefix === withTrailingSlash(projectRoot)
+        ? []
+        : [scope.pathPrefix];
+}
+/** Build the scope half of any graph verb payload. */
+function encodeScope(projectRoot, scope) {
+    return {
+        projectRoot,
+        inPrefixes: inPrefixesOf(projectRoot, scope),
+        excludePrefixes: scope.excludePrefixes,
+    };
+}
+function encodeSymbolFamilies(families) {
+    return families ? [...families.entries()] : null;
+}
+function decodeSymbolFamilies(wire) {
+    if (!Array.isArray(wire))
+        return undefined;
+    const map = new Map();
+    for (const entry of wire) {
+        if (!Array.isArray(entry) || typeof entry[0] !== "string")
+            continue;
+        map.set(entry[0], typeof entry[1] === "string" ? entry[1] : null);
+    }
+    return map;
+}
+/**
+ * True when a project is eligible for the daemon read path at all.
+ *
+ * The client consults this before sending: an unregistered directory has no
+ * chunks in the shared table, and the daemon rejects it (fail closed). Falling
+ * straight to the in-process path there keeps the old answer — "Symbol not
+ * found" — instead of turning an empty result into a daemon error.
+ */
+function isDaemonReadableProject(root) {
+    const project = (0, project_registry_1.getProject)(root);
+    return project !== undefined && project.status !== "error";
+}
+function requireString(payload, key) {
+    const value = payload[key];
+    if (typeof value !== "string" || value === "") {
+        throw new Error(`missing ${key}`);
+    }
+    return value;
+}
+function requirePrefixes(projectRoot, raw, key) {
+    if (raw === undefined || raw === null)
+        return [];
+    if (!Array.isArray(raw))
+        throw new Error(`invalid ${key}`);
+    return raw.map((prefix) => {
+        if (typeof prefix !== "string")
+            throw new Error(`invalid ${key}`);
+        // Same containment rule the `search` case applies to its scope prefixes;
+        // throwing here surfaces as an ordinary error response.
+        return withTrailingSlash((0, path_containment_1.resolveContainedPath)(projectRoot, prefix));
+    });
+}
+/**
+ * Validate the scope half of a payload: the project must be registered and not
+ * in `error` status, and every prefix must resolve inside it.
+ */
+function decodeScopePayload(payload) {
+    const projectRoot = path.resolve(requireString(payload, "projectRoot"));
+    if (!isDaemonReadableProject(projectRoot)) {
+        throw new Error("project not registered");
+    }
+    const inPrefixes = requirePrefixes(projectRoot, payload.inPrefixes, "inPrefixes");
+    const excludePrefixes = requirePrefixes(projectRoot, payload.excludePrefixes, "excludePrefixes");
+    return {
+        projectRoot,
+        scope: scopeFromPrefixes(projectRoot, inPrefixes, excludePrefixes),
+        scoped: inPrefixes.length > 0,
+    };
+}
+function requireStore(deps) {
+    if (!deps.vectorDb)
+        throw new Error("daemon not ready");
+    deps.touchActivity();
+    return deps.vectorDb;
+}
+function requireSymbols(payload) {
+    const raw = payload.symbols;
+    if (!Array.isArray(raw) || raw.length === 0)
+        throw new Error("missing symbols");
+    return raw.map((s) => {
+        if (typeof s !== "string")
+            throw new Error("invalid symbols");
+        return s;
+    });
+}
+/**
+ * The traversal direction. Anything other than the two literals is a bug in the
+ * client, so it is rejected rather than silently defaulted — `callers` and
+ * `callees` answer opposite questions.
+ */
+function requireDirection(payload) {
+    const raw = payload.direction;
+    if (raw === undefined || raw === null)
+        return "callees";
+    if (raw !== "callers" && raw !== "callees") {
+        throw new Error("invalid direction");
+    }
+    return raw;
+}
+/**
+ * A file list for `graph.subgraph`, every entry re-resolved inside the project.
+ * The paths land in an `OR` of `path = '…'` equalities, so containment is what
+ * keeps a caller from naming rows belonging to another project in the shared
+ * table.
+ */
+function requireContainedFiles(projectRoot, raw) {
+    if (!Array.isArray(raw) || raw.length === 0) {
+        throw new Error("missing files");
+    }
+    return raw.map((file) => {
+        if (typeof file !== "string" || file === "") {
+            throw new Error("invalid files");
+        }
+        return (0, path_containment_1.resolveContainedPath)(projectRoot, file);
+    });
+}
+/**
+ * The root `findTests`/`findDependents` query against. With any `--in` the CLI
+ * narrows to the scope prefix; otherwise it is the project root.
+ */
+function queryRootFor(decoded) {
+    return decoded.scoped
+        ? decoded.scope.pathPrefix.replace(/\/$/, "")
+        : decoded.projectRoot;
+}
+// --- Shared implementations (daemon and in-process run these) ---------------
+function runGraphResolve(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const resolved = yield (0, impact_1.resolveTargetSymbols)(args.target, db, args.projectRoot);
+        return {
+            symbols: resolved.symbols,
+            resolvedAsFile: resolved.resolvedAsFile,
+            symbolFamilies: encodeSymbolFamilies(resolved.symbolFamilies),
+        };
+    });
+}
+function runGraphTests(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return (0, impact_1.findTests)(args.symbols, db, args.queryRoot, clampInt(args.depth, 1, MAX_DEPTH, 1), args.excludePrefixes, args.families);
+    });
+}
+function runGraphDependents(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const excludePaths = args.excludePaths && args.excludePaths.length > 0
+            ? new Set(args.excludePaths)
+            : undefined;
+        // `undefined` keeps findDependents' own default of 10 — the shape the flat
+        // (non-rollup) call has always used.
+        const limit = typeof args.limit === "number"
+            ? clampInt(args.limit, 1, 10000, 10)
+            : undefined;
+        return args.detailed
+            ? (0, impact_1.findDependentsDetailed)(args.symbols, db, args.queryRoot, excludePaths, limit, args.excludePrefixes, args.families)
+            : (0, impact_1.findDependents)(args.symbols, db, args.queryRoot, excludePaths, limit, args.excludePrefixes, args.families);
+    });
+}
+function runGraphTrace(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const builder = new graph_builder_1.GraphBuilder(db, args.scope.pathPrefix, args.scope.excludePrefixes);
+        return builder.buildGraphMultiHop(args.symbol, clampInt(args.hops, 1, MAX_DEPTH, 1));
+    });
+}
+function runGraphPeek(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const depth = clampInt(args.depth, 1, MAX_DEPTH, 1);
+        const scopeWhere = (cond) => (0, scope_filter_1.buildScopeWhere)(args.scope, cond);
+        const definedWhere = scopeWhere(`array_contains(defined_symbols, '${(0, filter_builder_1.escapeSqlString)(args.symbol)}')`);
+        const table = yield db.ensureTable();
+        const defRows = yield table
+            .query()
+            .select(["path", "start_line"])
+            .where(definedWhere)
+            .limit(20)
+            .toArray();
+        const defChunks = defRows.map((row) => ({
+            path: String(row.path || ""),
+            startLine: Number(row.start_line || 0),
+        }));
+        const builder = new graph_builder_1.GraphBuilder(db, args.scope.pathPrefix, args.scope.excludePrefixes);
+        const graph = yield builder.buildGraph(args.symbol);
+        const metaRows = yield table
+            .query()
+            .select(["is_exported", "start_line", "end_line"])
+            .where(definedWhere)
+            .limit(1)
+            .toArray();
+        const metaRow = metaRows[0];
+        const meta = metaRow
+            ? {
+                isExported: Boolean(metaRow.is_exported),
+                startLine: Number(metaRow.start_line || 0),
+                endLine: Number(metaRow.end_line || 0),
+            }
+            : null;
+        const callerTree = depth > 1
+            ? (yield builder.buildGraphMultiHop(args.symbol, depth)).callerTree
+            : null;
+        const footerTests = args.includeTests
+            ? yield (0, tests_footer_1.fetchTestsForFooter)(args.symbol, db, args.scope.pathPrefix, args.scope.excludePrefixes)
+            : null;
+        return { defChunks, graph, meta, callerTree, footerTests };
+    });
+}
+function runGraphDead(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const table = yield db.ensureTable();
+        const defRows = yield table
+            .query()
+            .select(["path", "start_line", "is_exported"])
+            .where((0, scope_filter_1.buildScopeWhere)(args.scope, `array_contains(defined_symbols, '${(0, filter_builder_1.escapeSqlString)(args.symbol)}')`))
+            .limit(1)
+            .toArray();
+        if (defRows.length === 0) {
+            return {
+                found: false,
+                defPath: "",
+                defLine: 0,
+                isExported: false,
+                callerCount: 0,
+                topCallers: [],
+            };
+        }
+        const defRow = defRows[0];
+        const defPath = String(defRow.path || "");
+        const builder = new graph_builder_1.GraphBuilder(db, args.scope.pathPrefix, args.scope.excludePrefixes);
+        const callers = yield builder.getCallers(args.symbol, (0, languages_1.languageFamilyForPath)(defPath));
+        return {
+            found: true,
+            defPath,
+            defLine: Number(defRow.start_line || 0),
+            isExported: Boolean(defRow.is_exported),
+            callerCount: callers.length,
+            topCallers: callers
+                .slice(0, DEAD_TOP_CALLERS)
+                .map((c) => ({ file: c.file, line: c.line })),
+        };
+    });
+}
+// --- graph primitives (MCP's get_neighbors / find_paths / subgraph_for_files)
+/**
+ * `GraphBuilder.getNeighbors` behind a verb.
+ *
+ * `graph.trace` cannot serve this: it walks a *caller tree* at a fixed shape,
+ * while these three are the raw traversal primitives MCP exposes — bounded BFS
+ * in either direction, shortest path between two symbols, and the local
+ * subgraph of a file set. Each is a distinct GraphBuilder entry point with its
+ * own bound, so each gets its own verb rather than an option on trace.
+ */
+function runGraphNeighbors(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const builder = new graph_builder_1.GraphBuilder(db, args.scope.pathPrefix, args.scope.excludePrefixes);
+        return builder.getNeighbors(args.symbol, args.direction, clampInt(args.maxHops, 1, MAX_NEIGHBOR_HOPS, 2));
+    });
+}
+/** `GraphBuilder.findPaths` behind a verb; null when unreachable. */
+function runGraphPaths(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const builder = new graph_builder_1.GraphBuilder(db, args.scope.pathPrefix, args.scope.excludePrefixes);
+        return builder.findPaths(args.from, args.to, args.direction, clampInt(args.maxHops, 1, MAX_PATH_HOPS, 6));
+    });
+}
+/** `GraphBuilder.subgraphForFiles` behind a verb. Paths arrive absolute. */
+function runGraphSubgraph(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const builder = new graph_builder_1.GraphBuilder(db, args.scope.pathPrefix, args.scope.excludePrefixes);
+        return builder.subgraphForFiles(args.files.slice(0, MAX_SUBGRAPH_FILES));
+    });
+}
+/**
+ * The store-backed half of the risk ranking: for each changed symbol, its
+ * inbound caller count, its defining location, and whether any test reaches it.
+ *
+ * Split this way because `gatherRiskInputs` mixes two kinds of work — git
+ * (`extractDiff`, `fileChurn`) and the graph (`callersOf`, `resolveLocation`,
+ * `findTests`) — and only the second half belongs on the daemon's warm store.
+ * The caller keeps the git half and assembles the `RiskInput` rows, so the
+ * scoring stays exactly where it was.
+ */
+function runGraphRisk(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const builder = new graph_builder_1.GraphBuilder(db, args.scope.pathPrefix, args.scope.excludePrefixes);
+        return Promise.all(args.symbols.slice(0, MAX_RISK_SYMBOLS).map((symbol) => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const [callers, loc, tests] = yield Promise.all([
+                builder.callersOf(symbol).catch(() => []),
+                builder.resolveLocation(symbol).catch(() => null),
+                (0, impact_1.findTests)([symbol], db, args.queryRoot).catch(() => []),
+            ]);
+            return {
+                symbol,
+                file: (_a = loc === null || loc === void 0 ? void 0 : loc.file) !== null && _a !== void 0 ? _a : "",
+                line: (_b = loc === null || loc === void 0 ? void 0 : loc.line) !== null && _b !== void 0 ? _b : 0,
+                callerCount: callers.length,
+                hasTests: tests.length > 0,
+            };
+        })));
+    });
+}
+// Names too generic to be useful as god-node signal (`id`, `el`, `fn`, …).
+const MIN_GOD_NAME_LEN = 3;
+function rel(p, prefix) {
+    return p.startsWith(prefix) ? p.slice(prefix.length) : p;
+}
+function findFileCycles(deps, prefix, top) {
+    const indexByFile = new Map();
+    const lowlink = new Map();
+    const stack = [];
+    const onStack = new Set();
+    const components = [];
+    let index = 0;
+    const strongConnect = (file) => {
+        var _a, _b, _c, _d, _e;
+        indexByFile.set(file, index);
+        lowlink.set(file, index);
+        index++;
+        stack.push(file);
+        onStack.add(file);
+        for (const dep of (_a = deps.get(file)) !== null && _a !== void 0 ? _a : []) {
+            if (!indexByFile.has(dep)) {
+                strongConnect(dep);
+                lowlink.set(file, Math.min((_b = lowlink.get(file)) !== null && _b !== void 0 ? _b : 0, (_c = lowlink.get(dep)) !== null && _c !== void 0 ? _c : 0));
+            }
+            else if (onStack.has(dep)) {
+                lowlink.set(file, Math.min((_d = lowlink.get(file)) !== null && _d !== void 0 ? _d : 0, (_e = indexByFile.get(dep)) !== null && _e !== void 0 ? _e : 0));
+            }
+        }
+        if (lowlink.get(file) !== indexByFile.get(file))
+            return;
+        const component = [];
+        while (stack.length > 0) {
+            const dep = stack.pop();
+            onStack.delete(dep);
+            component.push(dep);
+            if (dep === file)
+                break;
+        }
+        if (component.length > 1)
+            components.push(component);
+    };
+    const files = new Set();
+    for (const [file, targets] of deps) {
+        files.add(file);
+        for (const target of targets)
+            files.add(target);
+    }
+    for (const file of [...files].sort()) {
+        if (!indexByFile.has(file))
+            strongConnect(file);
+    }
+    return components
+        .map((component) => {
+        var _a;
+        const set = new Set(component);
+        let edgeCount = 0;
+        for (const file of component) {
+            for (const dep of (_a = deps.get(file)) !== null && _a !== void 0 ? _a : []) {
+                if (set.has(dep))
+                    edgeCount++;
+            }
+        }
+        return {
+            files: component.map((f) => rel(f, prefix)).sort(),
+            edgeCount,
+        };
+    })
+        .sort((a, b) => b.files.length - a.files.length ||
+        b.edgeCount - a.edgeCount ||
+        a.files.join("\0").localeCompare(b.files.join("\0")))
+        .slice(0, top);
+}
+/**
+ * Pure aggregation over chunk rows — no DB, no I/O. Builds the symbol→def map,
+ * cross-file inbound edges, and per-file fan-in/out, then derives god nodes
+ * (most depended-upon symbols), hub files (most depended-upon files), and
+ * dead-code candidates (non-exported symbols with zero inbound references).
+ * `top` caps each list; `deadTotal` reports the full pre-cap dead count.
+ */
+function computeAudit(rows, prefix, top) {
+    var _a, _b;
+    // First definition of a symbol wins (matches GraphBuilder semantics).
+    const defs = new Map();
+    // Distinct files defining each name — name-based edges can't tell same-name
+    // symbols apart, so multi-file definitions get flagged in the output.
+    const defFileCounts = new Map();
+    // Distinct files that reference a symbol (cross-file inbound edges).
+    const inboundFiles = new Map();
+    const inboundTotal = new Map();
+    // Per-file aggregates.
+    const fileDefs = new Map();
+    const fileOutRefs = new Map();
+    const files = new Set();
+    for (const row of rows) {
+        const file = String(row.path || "");
+        const line = Number(row.start_line || 0);
+        const exported = Boolean(row.is_exported);
+        const defSyms = (0, arrow_1.toArr)(row.defined_symbols);
+        const refSyms = (0, arrow_1.toArr)(row.referenced_symbols);
+        files.add(file);
+        for (const s of defSyms) {
+            if (!defs.has(s)) {
+                defs.set(s, { file, line, exported, complexity: 0 });
+            }
+            if (!defFileCounts.has(s))
+                defFileCounts.set(s, new Set());
+            defFileCounts.get(s).add(file);
+            if (!fileDefs.has(file))
+                fileDefs.set(file, new Set());
+            fileDefs.get(file).add(s);
+        }
+        for (const s of refSyms) {
+            if (!inboundFiles.has(s))
+                inboundFiles.set(s, new Set());
+            inboundFiles.get(s).add(file);
+            inboundTotal.set(s, (inboundTotal.get(s) || 0) + 1);
+            if (!fileOutRefs.has(file))
+                fileOutRefs.set(file, new Set());
+            fileOutRefs.get(file).add(s);
+        }
+    }
+    // God nodes — in-project symbols by distinct external inbound files.
+    const godNodes = [];
+    for (const [symbol, info] of defs) {
+        if (symbol.length < MIN_GOD_NAME_LEN)
+            continue;
+        // Builtin method names (get, set, push, …) leak in via prototype/member
+        // definitions and their inbound counts are meaningless name collisions.
+        if ((0, callsites_1.isBuiltinCallee)(symbol))
+            continue;
+        const refFiles = inboundFiles.get(symbol);
+        if (!refFiles)
+            continue;
+        let external = 0;
+        for (const f of refFiles)
+            if (f !== info.file)
+                external++;
+        if (external === 0)
+            continue;
+        godNodes.push({
+            symbol,
+            file: rel(info.file, prefix),
+            line: info.line,
+            inboundFiles: external,
+            totalRefs: inboundTotal.get(symbol) || 0,
+            defFiles: (_b = (_a = defFileCounts.get(symbol)) === null || _a === void 0 ? void 0 : _a.size) !== null && _b !== void 0 ? _b : 1,
+        });
+    }
+    godNodes.sort((a, b) => b.inboundFiles - a.inboundFiles || b.totalRefs - a.totalRefs);
+    // Hub files — distinct external files depending on each file (a file G
+    // depends on F if G references any symbol F defines).
+    const hubFiles = [];
+    for (const [file, syms] of fileDefs) {
+        const dependents = new Set();
+        for (const s of syms) {
+            const refFiles = inboundFiles.get(s);
+            if (!refFiles)
+                continue;
+            for (const f of refFiles)
+                if (f !== file)
+                    dependents.add(f);
+        }
+        // Fan-out: distinct referenced symbols that are defined somewhere
+        // in-project (external-library calls don't count as coupling).
+        let fanOut = 0;
+        const out = fileOutRefs.get(file);
+        if (out)
+            for (const s of out)
+                if (defs.has(s))
+                    fanOut++;
+        hubFiles.push({
+            file: rel(file, prefix),
+            dependents: dependents.size,
+            defines: syms.size,
+            fanOut,
+        });
+    }
+    hubFiles.sort((a, b) => b.dependents - a.dependents || b.defines - a.defines);
+    const fileDeps = new Map();
+    for (const [file, refs] of fileOutRefs) {
+        for (const s of refs) {
+            if ((0, callsites_1.isBuiltinCallee)(s))
+                continue;
+            const defFiles = defFileCounts.get(s);
+            if (!defFiles || defFiles.size !== 1)
+                continue;
+            const [depFile] = defFiles;
+            if (!depFile || depFile === file)
+                continue;
+            if (!fileDeps.has(file))
+                fileDeps.set(file, new Set());
+            fileDeps.get(file).add(depFile);
+        }
+    }
+    const fileCycles = findFileCycles(fileDeps, prefix, top);
+    // Dead candidates — non-exported in-project symbols with zero inbound
+    // references anywhere (including their own file).
+    const deadAll = [];
+    for (const [symbol, info] of defs) {
+        if (info.exported)
+            continue;
+        if ((inboundTotal.get(symbol) || 0) > 0)
+            continue;
+        deadAll.push({ symbol, file: rel(info.file, prefix), line: info.line });
+    }
+    deadAll.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+    return {
+        scannedChunks: rows.length,
+        scannedFiles: files.size,
+        godNodes: godNodes.slice(0, top),
+        hubFiles: hubFiles.filter((h) => h.dependents > 0).slice(0, top),
+        fileCycles,
+        deadCandidates: deadAll.slice(0, top),
+        deadTotal: deadAll.length,
+    };
+}
+/**
+ * One pass over the scoped chunk rows, aggregated into the audit report.
+ *
+ * Returns null for an empty scope so the caller can print its own "no indexed
+ * data" line. Never returns rows: the 500k-row read stays daemon-side.
+ */
+function runGraphAudit(db, args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const top = clampInt(args.top, 1, MAX_AUDIT_TOP, 10);
+        const prefix = withTrailingSlash(args.projectRoot);
+        const table = yield db.ensureTable();
+        const rows = yield table
+            .query()
+            .select([
+            "path",
+            "start_line",
+            "defined_symbols",
+            "referenced_symbols",
+            "type_referenced_symbols",
+            "is_exported",
+        ])
+            .where((0, scope_filter_1.buildScopeWhere)(args.scope))
+            .limit(AUDIT_ROW_LIMIT)
+            .toArray();
+        if (rows.length === 0)
+            return null;
+        return computeAudit(rows.map((r) => {
+            const row = r;
+            return {
+                path: String(row.path || ""),
+                start_line: Number(row.start_line || 0),
+                is_exported: Boolean(row.is_exported),
+                defined_symbols: (0, arrow_1.toArr)(row.defined_symbols),
+                // Union call-position + type-position edges so god-node ranking and
+                // dead-candidate detection see references made purely in type position.
+                referenced_symbols: [
+                    ...new Set([
+                        ...(0, arrow_1.toArr)(row.referenced_symbols),
+                        ...(0, arrow_1.toArr)(row.type_referenced_symbols),
+                    ]),
+                ],
+            };
+        }), prefix, top);
+    });
+}
+// --- Verb handlers ---------------------------------------------------------
+/**
+ * Build the `graph.*` handler table over a deps supplier. `read-verbs.ts`
+ * passes one that reads the live daemon's store; tests pass a temp VectorDB.
+ */
+function createGraphVerbs(getDeps) {
+    const handlers = {
+        "graph.resolve": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const { projectRoot } = decodeScopePayload(payload);
+            const result = yield runGraphResolve(db, {
+                target: requireString(payload, "target"),
+                projectRoot,
+            });
+            return Object.assign({ ok: true }, result);
+        }),
+        "graph.tests": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const hits = yield runGraphTests(db, {
+                symbols: requireSymbols(payload),
+                queryRoot: queryRootFor(decoded),
+                depth: clampInt(payload.depth, 1, MAX_DEPTH, 1),
+                excludePrefixes: decoded.scope.excludePrefixes,
+                families: decodeSymbolFamilies(payload.families),
+            });
+            return { ok: true, hits };
+        }),
+        "graph.dependents": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const excludePaths = Array.isArray(payload.excludePaths)
+                ? payload.excludePaths.filter((p) => typeof p === "string")
+                : undefined;
+            const dependents = yield runGraphDependents(db, {
+                symbols: requireSymbols(payload),
+                queryRoot: queryRootFor(decoded),
+                detailed: payload.detailed === true,
+                excludePaths,
+                limit: typeof payload.limit === "number" ? payload.limit : undefined,
+                excludePrefixes: decoded.scope.excludePrefixes,
+                families: decodeSymbolFamilies(payload.families),
+            });
+            return { ok: true, dependents };
+        }),
+        "graph.trace": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const graph = yield runGraphTrace(db, {
+                symbol: requireString(payload, "target"),
+                hops: clampInt(payload.hops, 1, MAX_DEPTH, 1),
+                scope: decoded.scope,
+            });
+            return { ok: true, graph };
+        }),
+        "graph.peek": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const result = yield runGraphPeek(db, {
+                symbol: requireString(payload, "target"),
+                depth: clampInt(payload.depth, 1, MAX_DEPTH, 1),
+                scope: decoded.scope,
+                includeTests: payload.includeTests === true,
+            });
+            return { ok: true, peek: result };
+        }),
+        "graph.dead": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const facts = yield runGraphDead(db, {
+                symbol: requireString(payload, "target"),
+                scope: decoded.scope,
+            });
+            return { ok: true, dead: facts };
+        }),
+        "graph.neighbors": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const hits = yield runGraphNeighbors(db, {
+                symbol: requireString(payload, "symbol"),
+                direction: requireDirection(payload),
+                maxHops: clampInt(payload.maxHops, 1, MAX_NEIGHBOR_HOPS, 2),
+                scope: decoded.scope,
+            });
+            return { ok: true, hits };
+        }),
+        "graph.paths": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const path = yield runGraphPaths(db, {
+                from: requireString(payload, "from"),
+                to: requireString(payload, "to"),
+                direction: requireDirection(payload),
+                maxHops: clampInt(payload.maxHops, 1, MAX_PATH_HOPS, 6),
+                scope: decoded.scope,
+            });
+            // `null` (no path) is an answer, not an error — send it as one.
+            return { ok: true, path };
+        }),
+        "graph.subgraph": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const subgraph = yield runGraphSubgraph(db, {
+                files: requireContainedFiles(decoded.projectRoot, payload.files),
+                scope: decoded.scope,
+            });
+            return { ok: true, subgraph };
+        }),
+        "graph.risk": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const facts = yield runGraphRisk(db, {
+                symbols: requireSymbols(payload),
+                queryRoot: queryRootFor(decoded),
+                scope: decoded.scope,
+            });
+            return { ok: true, facts };
+        }),
+        "graph.audit": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+            const decoded = decodeScopePayload(payload);
+            const report = yield runGraphAudit(db, {
+                projectRoot: decoded.projectRoot,
+                scope: decoded.scope,
+                top: clampInt(payload.top, 1, MAX_AUDIT_TOP, 10),
+            });
+            return { ok: true, audit: report };
+        }),
+    };
+    const wired = {};
+    for (const [name, run] of Object.entries(handlers)) {
+        wired[name] = (payload, ctx) => __awaiter(this, void 0, void 0, function* () { return run(payload, requireStore(getDeps(ctx))); });
+    }
+    return wired;
+}
+// --- Client side -----------------------------------------------------------
+/**
+ * A graph verb can walk several hops over a large table; the 5 s default would
+ * time out on a big project. Same budget `search` gives the daemon.
+ */
+exports.GRAPH_VERB_TIMEOUT_MS = 60000;
+/**
+ * Send one graph verb through the store-access policy.
+ *
+ * `fallbackOnUnknownVerb` is the one-release skew allowance: a daemon older
+ * than this CLI answers `unknown command`, and the command still works. An
+ * unregistered project skips the daemon outright — see isDaemonReadableProject.
+ */
+function callGraphVerb(verb, call) {
+    return (0, store_access_1.withStoreRead)(verb, Object.assign({ skipDaemon: !isDaemonReadableProject(call.projectRoot), fallbackOnUnknownVerb: true, daemon: () => (0, daemon_client_1.sendDaemonCommand)(Object.assign(Object.assign({ cmd: verb }, encodeScope(call.projectRoot, call.scope)), call.payload), { timeoutMs: exports.GRAPH_VERB_TIMEOUT_MS }), render: call.render, inProcess: call.inProcess }, call.fallback));
+}