internal/

Package analyze derives the human-facing insights the report surfaces: the most-connected "god nodes", surprising cross-file connections, and file-level import cycles.

Package cache persists per-file extraction results so `graphify update` can rebuild the graph after re-parsing only the files that changed.

Package cluster runs community detection (Louvain, via gonum) on the graph, then post-processes the result the way the Python original does: oversized communities are split, and IDs are assigned by descending size with a lexical tie-break so the same grouping always yields the same IDs across runs.

Package detect walks a project tree and returns the source files worth graphing.

Package export writes the assembled graph to disk.

Package extract turns a source file into graph fragments using tree-sitter.

Package graph assembles extraction output into the undirected knowledge graph the rest of the pipeline operates on.

Package idutil builds stable node IDs from name parts.

Package model holds the graph data types shared across the pipeline: the extraction schema (nodes + edges) emitted by extractors and the assembled undirected Graph that downstream stages cluster, analyze, and export.

Package query answers questions against a built graph.json without rebuilding: find nodes by name, explain a node and its neighbours, and find the shortest dependency path between two nodes.

Package report renders GRAPH_REPORT.md, the human-readable audit trail that accompanies graph.json: corpus summary, the core abstractions, surprising connections, import cycles, and the community breakdown.

Package security holds the guards every piece of external input passes through: URL validation (SSRF), graph-file path containment, file-size caps, and label sanitisation.