[{"data":1,"prerenderedAt":795},["ShallowReactive",2],{"navigation":3,"\u002Fdocs\u002Fvalidation":135,"\u002Fdocs\u002Fvalidation-surround":790},[4],{"title":5,"path":6,"stem":7,"children":8,"page":134},"Docs","\u002Fdocs","docs",[9,13,17,21,25,29,33,37,41,45,49,53,57,61,70,74,78,82,86,90,94,98,102,106,110,114,118,122,126,130],{"title":10,"path":11,"stem":12},"AI harnesses: LLM tools, MCP servers and agents","\u002Fdocs\u002Fai-tools","docs\u002Fai-tools",{"title":14,"path":15,"stem":16},"Architecture","\u002Fdocs\u002Farchitecture","docs\u002Farchitecture",{"title":18,"path":19,"stem":20},"Web \u002F native bridges","\u002Fdocs\u002Fbridges","docs\u002Fbridges",{"title":22,"path":23,"stem":24},"Broadcast channels and tests","\u002Fdocs\u002Fchannels-and-tests","docs\u002Fchannels-and-tests",{"title":26,"path":27,"stem":28},"CLI reference","\u002Fdocs\u002Fcli","docs\u002Fcli",{"title":30,"path":31,"stem":32},"Completeness: how far an answer reaches","\u002Fdocs\u002Fcompleteness","docs\u002Fcompleteness",{"title":34,"path":35,"stem":36},"Configuration","\u002Fdocs\u002Fconfiguration","docs\u002Fconfiguration",{"title":38,"path":39,"stem":40},"External systems","\u002Fdocs\u002Fexternal","docs\u002Fexternal",{"title":42,"path":43,"stem":44},"Generated, copied and vendored files","\u002Fdocs\u002Fgenerated","docs\u002Fgenerated",{"title":46,"path":47,"stem":48},"Installing and updating cg","\u002Fdocs\u002Finstall","docs\u002Finstall",{"title":50,"path":51,"stem":52},"Java","\u002Fdocs\u002Fjava","docs\u002Fjava",{"title":54,"path":55,"stem":56},"Kotlin","\u002Fdocs\u002Fkotlin","docs\u002Fkotlin",{"title":58,"path":59,"stem":60},"Known limitations","\u002Fdocs\u002Flimitations","docs\u002Flimitations",{"title":62,"path":63,"stem":64,"children":65},"MCP server","\u002Fdocs\u002Fmcp","docs\u002Fmcp",[66],{"title":67,"path":68,"stem":69},"code-graph MCP: sample outputs (real calls via the MCP Python SDK stdio client)","\u002Fdocs\u002Fmcp\u002Fsample_outputs","docs\u002Fmcp\u002Fsample_outputs",{"title":71,"path":72,"stem":73},"Rust, C and C++","\u002Fdocs\u002Fnative","docs\u002Fnative",{"title":75,"path":76,"stem":77},"Port gaps: cg parity","\u002Fdocs\u002Fparity","docs\u002Fparity",{"title":79,"path":80,"stem":81},"PHP","\u002Fdocs\u002Fphp","docs\u002Fphp",{"title":83,"path":84,"stem":85},"Planned changes","\u002Fdocs\u002Fplans","docs\u002Fplans",{"title":87,"path":88,"stem":89},"Platform-specific code","\u002Fdocs\u002Fplatforms","docs\u002Fplatforms",{"title":91,"path":92,"stem":93},"Protocol links","\u002Fdocs\u002Fprotocols","docs\u002Fprotocols",{"title":95,"path":96,"stem":97},"Python","\u002Fdocs\u002Fpython","docs\u002Fpython",{"title":99,"path":100,"stem":101},"Quick start","\u002Fdocs\u002Fquickstart","docs\u002Fquickstart",{"title":103,"path":104,"stem":105},"Graph schema","\u002Fdocs\u002Fschema","docs\u002Fschema",{"title":107,"path":108,"stem":109},"Attack surface","\u002Fdocs\u002Fsurface","docs\u002Fsurface",{"title":111,"path":112,"stem":113},"Swift","\u002Fdocs\u002Fswift","docs\u002Fswift",{"title":115,"path":116,"stem":117},"TypeScript \u002F JavaScript frameworks","\u002Fdocs\u002Fts-frameworks","docs\u002Fts-frameworks",{"title":119,"path":120,"stem":121},"How we validate","\u002Fdocs\u002Fvalidation","docs\u002Fvalidation",{"title":123,"path":124,"stem":125},"Validation log","\u002Fdocs\u002Fvalidation-log","docs\u002Fvalidation-log",{"title":127,"path":128,"stem":129},"Value facts and resolutions","\u002Fdocs\u002Fvalue-facts","docs\u002Fvalue-facts",{"title":131,"path":132,"stem":133},"Visual view","\u002Fdocs\u002Fviz","docs\u002Fviz",false,{"id":136,"title":119,"body":137,"description":784,"extension":785,"meta":786,"navigation":787,"path":120,"seo":788,"stem":121,"__hash__":789},"docs\u002Fdocs\u002Fvalidation.md",{"type":138,"value":139,"toc":778},"minimark",[140,153,161,168,173,509,513,540,544,547,683,687,771,774],[141,142,143,144,148,149,152],"p",{},"Public-project checks, not a tutorial. Each area was indexed from a shallow clone (default\nbranch, October 2026) with ",[145,146,147],"code",{},"python -m cg_code_graph.cli index \u003Crepo>"," on one 8-core Linux box. Wall\ntime includes a cold extractor cache, not a one-off ",[145,150,151],{},"dart compile exe",".",[141,154,155,156,160],{},"A ",[157,158,159],"strong",{},"spot check"," is 20 routes (or every route when there are fewer) sampled from the graph and\ncompared by hand with the cited source line: method, full path (every prefix), parameters, and\nhandler symbol. A pass means those rows match. Gaps sit next to the table that produced them.",[141,162,163,164,167],{},"Full scoreboards, timings and the \"other corpora unchanged\" notes are in\n",[165,166,123],"a",{"href":124},". This page is the method plus one headline per area.",[169,170,172],"h2",{"id":171},"headlines","Headlines",[174,175,176,192],"table",{},[177,178,179],"thead",{},[180,181,182,186,189],"tr",{},[183,184,185],"th",{},"area",[183,187,188],{},"headline",[183,190,191],{},"log",[193,194,195,210,224,242,253,273,296,317,335,348,364,389,402,415,431,444,461,479,492],"tbody",{},[180,196,197,201,204],{},[198,199,200],"td",{},"Django \u002F Python",[198,202,203],{},"7 apps; sampled routes 20\u002F20 (saleor is GraphQL: 9 routes, resolvers are endpoints)",[198,205,206],{},[165,207,209],{"href":208},"\u002Fdocs\u002Fvalidation-log#django--python","Django",[180,211,212,215,218],{},[198,213,214],{},"Flutter \u002F Dart",[198,216,217],{},"5 apps; flutter\u002Fsamples 12\u002F12 HTTP and 13\u002F13 go_router routes; lichess 18\u002F20",[198,219,220],{},[165,221,223],{"href":222},"\u002Fdocs\u002Fvalidation-log#flutter--dart","Flutter",[180,225,226,229,236],{},[198,227,228],{},"Laravel channels",[198,230,231,232,235],{},"UNIT3D, koel, invoiceninja, pixelfed, coolify: publishers matched each ",[145,233,234],{},"ShouldBroadcast"," event",[198,237,238],{},[165,239,241],{"href":240},"\u002Fdocs\u002Fvalidation-log#laravel-broadcasting-and-tests","Channels",[180,243,244,247,250],{},[198,245,246],{},"Laravel tests",[198,248,249],{},"TEST_HTTP spot check 40\u002F40 (10 per app)",[198,251,252],{},"same section",[180,254,255,258,268],{},[198,256,257],{},"Nuxt",[198,259,260,261,264,265],{},"breeze-nuxt and elk, no ",[145,262,263],{},"npm install",", no ",[145,266,267],{},".nuxt",[198,269,270],{},[165,271,257],{"href":272},"\u002Fdocs\u002Fvalidation-log#nuxt-layouts-and-clean-checkouts",[180,274,275,278,290],{},[198,276,277],{},"Presets \u002F guards",[198,279,280,283,284,264,287],{},[145,281,282],{},"cg starters"," and ",[145,285,286],{},"cg routes --unguarded",[145,288,289],{},".cg.yaml",[198,291,292],{},[165,293,295],{"href":294},"\u002Fdocs\u002Fvalidation-log#presets-starter-queries-and-route-guards","Presets",[180,297,298,301,312],{},[198,299,300],{},"Monorepo",[198,302,303,304,307,308,311],{},"one index per app (",[145,305,306],{},"immich\u002Fserver",", ",[145,309,310],{},"cal.com\u002Fapps\u002Fweb",", …)",[198,313,314],{},[165,315,300],{"href":316},"\u002Fdocs\u002Fvalidation-log#monorepo-apps",[180,318,319,322,329],{},[198,320,321],{},"Generated files",[198,323,324,325,328],{},"Capacitor copies and OpenAPI \u002F protoc output excluded; ",[145,326,327],{},"cg coverage"," lists them",[198,330,331],{},[165,332,334],{"href":333},"\u002Fdocs\u002Fvalidation-log#generated-and-copied-files","Generated",[180,336,337,340,343],{},[198,338,339],{},"Platforms",[198,341,342],{},"ripgrep, alacritty, libuv, curl, dart-lang\u002Fhttp, localsend, social-app",[198,344,345],{},[165,346,339],{"href":347},"\u002Fdocs\u002Fvalidation-log#platform-specific-code",[180,349,350,353,356],{},[198,351,352],{},"Kotlin \u002F Swift",[198,354,355],{},"heuristic calls, then scip-java and the Swift index store",[198,357,358,307,361],{},[165,359,54],{"href":360},"\u002Fdocs\u002Fvalidation-log#kotlin",[165,362,111],{"href":363},"\u002Fdocs\u002Fvalidation-log#swift",[180,365,366,369,384],{},[198,367,368],{},"Spring",[198,370,371,372,375,376,379,380,383],{},"spring-petclinic: 17\u002F17 heuristic routes (PetController class prefix included). Exact-mode figures are from the original run (scip-java 0.13.1, JDK 21, ",[145,373,374],{},"--build-tool=maven",", which runs ",[145,377,378],{},"mvn clean verify -DskipTests"," and cleans build caches), not re-measured in this tree: 50\u002F50 Java files in the index, 364 definitions matched and 4 unmatched. A sample of 20 heuristic ",[145,381,382],{},"CALLS"," edges, sorted by source then target, agrees with the exact edges on 19; the full heuristic call set the exact layer compares agrees on 324 of 328 (precision 0.988, recall 0.973)",[198,385,386],{},[165,387,50],{"href":388},"\u002Fdocs\u002Fjava#spring",[180,390,391,394,397],{},[198,392,393],{},"Bridges",[198,395,396],{},"Capacitor, React Native, Flutter, Cordova, Pigeon, Electron, Tauri",[198,398,399],{},[165,400,393],{"href":401},"\u002Fdocs\u002Fvalidation-log#web--native-bridges",[180,403,404,407,410],{},[198,405,406],{},"Protocols",[198,408,409],{},"Socket.IO, WS\u002FSSE, webhooks, IPC, sockets, gRPC, GraphQL, jobs, brokers",[198,411,412],{},[165,413,406],{"href":414},"\u002Fdocs\u002Fvalidation-log#protocol-links-shared-endpoint-model-31",[180,416,417,420,426],{},[198,418,419],{},"TS frameworks",[198,421,422,423],{},"immich, Nest samples, Ghost, dub, Next examples, realworld ",[145,424,425],{},"cg link",[198,427,428],{},[165,429,419],{"href":430},"\u002Fdocs\u002Fvalidation-log#typescript--javascript-frameworks",[180,432,433,436,439],{},[198,434,435],{},"External",[198,437,438],{},"Prisma \u002F ORM datasources, third-party HTTP hosts, cloud SDKs",[198,440,441],{},[165,442,435],{"href":443},"\u002Fdocs\u002Fvalidation-log#external-systems-40",[180,445,446,449,456],{},[198,447,448],{},"Attack surface (#47)",[198,450,451,452,455],{},"12 corpora; recall 2 of 11 documented items on juice-shop, NodeGoat, DVWA; sampled precision per finding type; ",[145,453,454],{},"unguarded"," cut by 82% to 97.5% on netbox, outline and the cal.com web app in part 2d, with juice-shop's 4 true positives kept; 1 wrong redaction and 1 unredacted doc comment found and fixed",[198,457,458],{},[165,459,107],{"href":460},"\u002Fdocs\u002Fvalidation-log#attack-surface-47",[180,462,463,466,473],{},[198,464,465],{},"External systems: mail, SMS, push, infra (#42 part 3)",[198,467,468,469,472],{},"6 corpora, no new external nodes or edges from 3a \u002F 3b (no matched SDK in use); index time +26% (outline) and +31% (cal.com ",[145,470,471],{},"apps\u002Fweb",") over three runs, from the 2a \u002F 2b passes",[198,474,475],{},[165,476,478],{"href":477},"\u002Fdocs\u002Fvalidation-log#mail--sms--push--infra-sdks-42-parts-3a-and-3b","Mail \u002F SMS \u002F push \u002F infra",[180,480,481,484,487],{},[198,482,483],{},"AI tools",[198,485,486],{},"MCP \u002F LLM tool endpoints on public harnesses",[198,488,489],{},[165,490,483],{"href":491},"\u002Fdocs\u002Fvalidation-log#ai-harnesses-llm-tools-mcp-servers-and-agents-66",[180,493,494,497,503],{},[198,495,496],{},"Parity",[198,498,499,500],{},"Bitwarden and Element X, name match and ",[145,501,502],{},"--structure",[198,504,505],{},[165,506,508],{"href":507},"\u002Fdocs\u002Fparity#how-far-to-trust-missing","how far to trust missing",[169,510,512],{"id":511},"how-to-read-a-gap","How to read a gap",[514,515,516,524,534,537],"ul",{},[517,518,519,520,523],"li",{},"A handler marked external (Django ",[145,521,522],{},"LoginView",", allauth) was compared and left unresolved on\npurpose.",[517,525,526,529,530,533],{},[145,527,528],{},"{?}"," in a path is a setting or f-string cg did not evaluate (netbox ",[145,531,532],{},"BASE_PATH",").",[517,535,536],{},"A route count that matches the decorator count is a census, not a spot check. The spot check\nis the hand sample.",[517,538,539],{},"Exact mode (Kotlin scip-java, Swift index store) is a second index of the same ids. Heuristic\nedges that the compiler does not confirm stay in the log's precision \u002F recall note.",[169,541,543],{"id":542},"more-log-sections","More log sections",[141,545,546],{},"These are the same runs, split by change. Open the log for the table.",[174,548,549,558],{},[177,550,551],{},[180,552,553,556],{},[183,554,555],{},"topic",[183,557,191],{},[193,559,560,571,582,597,612,631,649,664],{},[180,561,562,565],{},[198,563,564],{},"Overrides, inherited specs, class hierarchy",[198,566,567],{},[165,568,570],{"href":569},"\u002Fdocs\u002Fvalidation-log#overrides-in-tests--reaches-inherited-specs-typescript-class-hierarchy","Overrides",[180,572,573,576],{},[198,574,575],{},"Receiver types, interfaces, container bindings",[198,577,578],{},[165,579,581],{"href":580},"\u002Fdocs\u002Fvalidation-log#receiver-types-on-inherited-calls-in-kotlin-swift-dart-and-php-62","Receivers",[180,583,584,587],{},[198,585,586],{},"Swift selectors and tests",[198,588,589,307,593],{},[165,590,592],{"href":591},"\u002Fdocs\u002Fvalidation-log#swift-selectors-static-vs-instance-sdk-receivers-70","Selectors",[165,594,596],{"href":595},"\u002Fdocs\u002Fvalidation-log#swift-testing-xctest-and-kotlin-test-cases-71","Swift Testing",[180,598,599,602],{},[198,600,601],{},"Sockets, gRPC, Thrift, tRPC, JSON-RPC",[198,603,604,307,608],{},[165,605,607],{"href":606},"\u002Fdocs\u002Fvalidation-log#raw-tcp--udp-sockets-and-udp-application-protocols-39","Sockets",[165,609,611],{"href":610},"\u002Fdocs\u002Fvalidation-log#grpc-services-from-proto-contracts-33","gRPC",[180,613,614,617],{},[198,615,616],{},"GraphQL, job queues, brokers",[198,618,619,307,623,307,627],{},[165,620,622],{"href":621},"\u002Fdocs\u002Fvalidation-log#graphql-root-fields-34-part-1","GraphQL",[165,624,626],{"href":625},"\u002Fdocs\u002Fvalidation-log#job-queues-celery-rq-dramatiq-bull-laravel-messenger-36","Jobs",[165,628,630],{"href":629},"\u002Fdocs\u002Fvalidation-log#message-brokers-kafka-amqp-redis-mqtt-nats-35-part-1","Brokers",[180,632,633,636],{},[198,634,635],{},"Webhooks and local IPC",[198,637,638,307,641,307,645],{},[165,639,581],{"href":640},"\u002Fdocs\u002Fvalidation-log#webhook-receivers-37-part-1",[165,642,644],{"href":643},"\u002Fdocs\u002Fvalidation-log#webhook-senders-37-part-2","Senders",[165,646,648],{"href":647},"\u002Fdocs\u002Fvalidation-log#local-ipc-in-js--ts-38-part-1","IPC",[180,650,651,654],{},[198,652,653],{},"Plain JavaScript, C macros",[198,655,656,307,660],{},[165,657,659],{"href":658},"\u002Fdocs\u002Fvalidation-log#plain-javascript-without-tsconfig--jsconfig-136","JS",[165,661,663],{"href":662},"\u002Fdocs\u002Fvalidation-log#cc-file-level-macro-statements-and-lock-annotations-131","C\u002FC++",[180,665,666,669],{},[198,667,668],{},"Datasources and HTTP hosts",[198,670,671,307,675,307,679],{},[165,672,674],{"href":673},"\u002Fdocs\u002Fvalidation-log#prisma-datasources-as-external-systems-41","Prisma",[165,676,678],{"href":677},"\u002Fdocs\u002Fvalidation-log#third-party-http-hosts-as-external-nodes-42-part-1","HTTP hosts",[165,680,682],{"href":681},"\u002Fdocs\u002Fvalidation-log#cloud--saas-sdks-as-external-nodes-42-part-2","Cloud SDKs",[169,684,686],{"id":685},"re-run","Re-run",[688,689,694],"pre",{"className":690,"code":691,"language":692,"meta":693,"style":693},"language-bash shiki shiki-themes cg-light cg-light cg-dark","cg index \u003Crepo> --db out\u002Fcheck.db\ncg coverage --db out\u002Fcheck.db\ncg routes --unguarded --db out\u002Fcheck.db\ncg protocols --unmatched --db out\u002Fcheck.db\n","bash","",[145,695,696,729,741,756],{"__ignoreMap":693},[697,698,701,705,709,713,716,720,723,726],"span",{"class":699,"line":700},"line",1,[697,702,704],{"class":703},"sZJo5","cg",[697,706,708],{"class":707},"sha9Y"," index",[697,710,712],{"class":711},"sZ_TN"," \u003C",[697,714,715],{"class":707},"rep",[697,717,719],{"class":718},"snmWg","o",[697,721,722],{"class":711},">",[697,724,725],{"class":707}," --db",[697,727,728],{"class":707}," out\u002Fcheck.db\n",[697,730,732,734,737,739],{"class":699,"line":731},2,[697,733,704],{"class":703},[697,735,736],{"class":707}," coverage",[697,738,725],{"class":707},[697,740,728],{"class":707},[697,742,744,746,749,752,754],{"class":699,"line":743},3,[697,745,704],{"class":703},[697,747,748],{"class":707}," routes",[697,750,751],{"class":707}," --unguarded",[697,753,725],{"class":707},[697,755,728],{"class":707},[697,757,759,761,764,767,769],{"class":699,"line":758},4,[697,760,704],{"class":703},[697,762,763],{"class":707}," protocols",[697,765,766],{"class":707}," --unmatched",[697,768,725],{"class":707},[697,770,728],{"class":707},[141,772,773],{},"Language pages link the log section for their numbers. A census (decorator count equals route\ncount) is not a spot check; the spot check is the hand sample.",[775,776,777],"style",{},"html pre.shiki code .sZJo5, html code.shiki .sZJo5{--shiki-light:#65A30D;--shiki-default:#65A30D;--shiki-dark:#84CC16}html pre.shiki code .sha9Y, html code.shiki .sha9Y{--shiki-light:#9F8CFF;--shiki-default:#9F8CFF;--shiki-dark:#C4B5FD}html pre.shiki code .sZ_TN, html code.shiki .sZ_TN{--shiki-light:#71717A;--shiki-default:#71717A;--shiki-dark:#A1A1AA}html pre.shiki code .snmWg, html code.shiki .snmWg{--shiki-light:#27272A;--shiki-default:#27272A;--shiki-dark:#E4E4E7}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":693,"searchDepth":758,"depth":731,"links":779},[780,781,782,783],{"id":171,"depth":731,"text":172},{"id":511,"depth":731,"text":512},{"id":542,"depth":731,"text":543},{"id":685,"depth":731,"text":686},"Public-project checks, not a tutorial. Each area was indexed from a shallow clone (default\nbranch, October 2026) with python -m cg_code_graph.cli index \u003Crepo> on one 8-core Linux box. Wall\ntime includes a cold extractor cache, not a one-off dart compile exe.","md",{},true,{"title":119,"description":784},"sBSUxqm4F3V8DdHzySO_Mea9z9dE8Oqykht22jPwkMo",[791,793],{"title":115,"path":116,"stem":117,"description":792,"children":-1},"What NestJS, Next.js, Astro, Express-style routers and React Router \u002F Remix add on top of the TypeScript plugin. They share\none program with the Nuxt layer, so aliases and types go through the checker. Plain JavaScript\n(CommonJS or ESM, with or without jsconfig.json) is indexed with allowJs. Samples:\nexamples\u002Fbookstore-nest, bookstore-next, bookstore-express. Without a root tsconfig, the\nprogram is the per-package tsconfig.json next to a package.json one or two levels down, plus\na tsconfig.json in src\u002F, app\u002F, lib\u002F or web\u002F without one. The extractor runs under Node.js 20+ or Bun (Installing and updating cg).",{"title":123,"path":124,"stem":125,"description":794,"children":-1},"Per-corpus tables behind How we validate. Shallow clones, default branch, October 2026. \"Unchanged corpora\" notes stay here.",1792170237587]