# Cross-file analysis (`audit --graph`) By default the engine audits **each file in isolation**. `--graph` (alias `--cross-file`) adds a pass that **resolves imports between files**, builds a dependency + component graph, and applies rules only the cross-file context makes visible — **without a browser** (no Playwright). It complements the per-file static engine and the optional dynamic tier (`scan`): all three feed the **same** `AuditResult`. ``` node scripts/ultra11y.mjs audit "src/**/*.tsx" --graph --json > audit.json node scripts/ultra11y.mjs audit --changed --graph # git diff, graph over the whole scope ``` ## How it works (and why it scales) - **Real AST**: `.jsx/.tsx` are parsed by a real JS/TS/JSX parser (`@babel/parser`, embedded in the bundle — still "no install"), not regex normalization. `PascalCase` components keep their case (per-file rules ignore them; only cross-file rules resolve them); native elements stay lowercase. - **Two passes, bounded memory**: pass 1 — read each file, extract a small *graph node* (imports, components + render-control signals, ids, ``), then **drop** the AST/Doc. Pass 2 — the usual audit loop, which also runs the cross-file rules with the graph in hand. The whole repo is never held in memory: O(number of files) small nodes. - **`--changed --graph`**: the graph indexes the **whole** scope (to resolve a reference into an unchanged definition), but only the diffed files are audited. - **Plain `.ts`/`.js` modules are graphed, never audited.** The graph's own discovery widens to `.ts`/`.js`/`.mjs`/`.cjs` on top of the markup allowlist: a **barrel** (`components/index.ts` re-exporting `Button.tsx`) or a plain-JS component definition is real cross-file structure that imports resolve through — chained re-exports (`export { Button } from "./Button"`, barrels of barrels) are followed to the real definition. Those files feed imports/re-exports/definitions/ids into the graph but never enter the audit loop (no markup rule ever runs on them). - **`.vue`/`.svelte`/`.astro` SFCs are first-class graph nodes.** Parsed with component case preserved (same as the audit); the file's own `