Module graphql 

Minimal GraphQL lexer (Phase 11) — the 8th custom parser in this crate (fuzzed, see ARCHITECTURE §13). It does NOT build an AST: it makes a single linear, UTF-8-safe, allocation-free pass over the query text and computes the structural metrics the graphql detection module enforces (depth / aliases / fields / directives / introspection). It is evasion-robust at the LEXICAL level — braces, colons and names inside strings, block strings ("""…""") and # comments are skipped, so they cannot inflate or deflate the counts.

Paren-aware depth. { } delimits a selection set (which is what “depth” means for a GraphQL DoS) but ALSO an input object inside an argument list (field(arg: { … })). To count only selection-set nesting, a { increments the depth ONLY while not inside ( … ). So a query with a deeply nested input object but a flat selection set reports a small depth (no false positive).

Structs

GraphqlStats

Structural metrics of one GraphQL query/operation text.

Functions

graphql_lex

Lex s and compute its GraphqlStats. Linear time, no allocation, never panics.

unwrap_query_envelope

If s is a JSON envelope carrying GraphQL operation text(s) — a {"query":"<doc>"} object or a [{"query":…}, …] batch array — return those operation strings; None when s is a bare GraphQL document or not such an envelope (the caller then lexes s directly).