@aroman22/codegraph-vba 1.6.2 → 1.7.0

package/README.md

@@ -51,11 +51,11 @@ This repository is a fork of [`colbymchenry/codegraph`](https://github.com/colby
 
 **Why fork?** To add VBA / Access language support that does not exist upstream, so agents can navigate Microsoft Access projects managed by Dysflow the same way they navigate TypeScript or Python today. See the [VBA / Access + Dysflow integration](#vba--access--dysflow-integration) section below for the feature spec, the pattern table, and the hard invariants.
 
-**The fork is published to npm as `codegraph-vba`.** The upstream package `@colbymchenry/codegraph` does **not** have VBA / Access support — install `codegraph-vba` to get it:
+**The fork is published to npm as `@aroman22/codegraph-vba`.** The upstream package `@colbymchenry/codegraph` does **not** have VBA / Access support — install `@aroman22/codegraph-vba` to get it:
 
 ```bash
 # Option A — install from npm (easiest; gets you the codegraph-vba CLI on PATH):
-npm i -g codegraph-vba
+npm i -g @aroman22/codegraph-vba
 # or with pnpm:
 pnpm add -g codegraph-vba
 # or the one-line OS installer (no Node required) — see Get Started below.
@@ -96,7 +96,7 @@ irm https://raw.githubusercontent.com/ardelperal/codegraph-vba/main/install.ps1
 <summary><b>Already have Node? Use npm instead (works on any version)</b></summary>
 
 ```bash
-npm i -g codegraph-vba
+npm i -g @aroman22/codegraph-vba
 ```
 
 <sub>CodeGraph bundles its own runtime — nothing to compile, no native build, works the same everywhere. The installer puts `codegraph-vba` on your PATH but **doesn't change your current shell** — open a new terminal before the next step so the command resolves.</sub>
@@ -470,7 +470,7 @@ That's it — your agent will use CodeGraph tools automatically when a `.codegra
 
 **Install globally:**
 ```bash
-npm i -g codegraph-vba
+npm i -g @aroman22/codegraph-vba
 ```
 
 **Add to `~/.claude.json`:**
@@ -837,7 +837,7 @@ Framework routing is validated the same way, on a canonical app per framework: E
 
 **MCP hits `database is locked`** — current builds shouldn't: CodeGraph bundles its own Node runtime and uses Node's built-in `node:sqlite` in WAL mode, where concurrent reads never block on a writer. If you still see it:
 
-- **You're on an old (pre-0.9) install.** Reinstall to get the bundled runtime — `curl -fsSL https://raw.githubusercontent.com/ardelperal/codegraph-vba/main/install.sh | sh` (macOS/Linux), `irm https://raw.githubusercontent.com/ardelperal/codegraph-vba/main/install.ps1 | iex` (Windows), or `npm i -g codegraph-vba@latest`.
+- **You're on an old (pre-0.9) install.** Reinstall to get the bundled runtime — `curl -fsSL https://raw.githubusercontent.com/ardelperal/codegraph-vba/main/install.sh | sh` (macOS/Linux), `irm https://raw.githubusercontent.com/ardelperal/codegraph-vba/main/install.ps1 | iex` (Windows), or `npm i -g @aroman22/codegraph-vba@latest`.
 - **`codegraph-vba status` shows `Journal:` other than `wal`** — WAL couldn't be enabled on this filesystem (common on network shares and WSL2 `/mnt`), so reads can block on writes. Move the project (with its `.codegraph-vba/` folder) onto a local disk.
 
 **MCP server not connecting** — Your agent starts the server itself, so you don't launch it by hand. Make sure the project is initialized and indexed (`codegraph-vba status`) and that the path in your MCP config is correct. If it still won't connect, re-run `codegraph-vba install` to rewrite the config.

package/dist/extraction/vba/calls.d.ts

@@ -20,9 +20,13 @@ export declare function splitSingleLineIfClauses(line: string): string[];
 export declare function detectStatementCall(line: string): string | null;
 /**
  * H1: emit a same-file `calls` edge for a statement-form Sub call to the
- * already-emitted function node named `procName`.
+ * already-emitted function node named `procName`. Returns `true` when a
+ * `calls` edge was pushed, `false` when the call was silenced
+ * (blacklist / runtime / self-call / unresolvable). Round-3 (issue
+ * #108) needs that boolean so the call sweep can fall through to push
+ * an `unqualified-ident` unresolved reference.
  */
-export declare function emitStatementCallEdge(ctx: VbaExtractorContext, caller: ProcInfo, procName: string, lineNum: number): void;
+export declare function emitStatementCallEdge(ctx: VbaExtractorContext, caller: ProcInfo, procName: string, lineNum: number): boolean;
 /**
  * Fix 7: detect a qualified statement-form call — `Receiver.Member <args>`
  * where `Receiver.Member` is NOT followed by `(`. Distinct from the paren

package/dist/extraction/vba/controls.d.ts

@@ -11,6 +11,15 @@ import { VbaExtractorContext, ProcInfo } from './context';
  * `metadata.synthesizedBy: 'vba-me-control'`. Operates on the masked
  * `callScanLine`. The +3 column offset skips the 3-char `Me.` / `Me!`
  * prefix (both are 3 chars).
+ *
+ * Round-3 (issue #108): the `referenceKind` is keyed off the operator
+ * (`.` vs `!`) at the match position. The same-line `=` heuristic
+ * distinguishes reads from assignments: `x = Me.Name` → `property-get`,
+ * `Me.Name = "X"` → `property-set`. Cross-line property-set is out of
+ * scope; the `=` rule is satisfied when the assignment appears on the
+ * SAME line at any position AFTER the matched control name (allowing
+ * trailing `.Caption = value` chained assignments too — they still
+ * flow a write into the captured control identifier).
  */
 export declare function scanMeControlReferences(ctx: VbaExtractorContext, line: string, from: ProcInfo, lineNum: number): void;
 /**
@@ -19,6 +28,14 @@ export declare function scanMeControlReferences(ctx: VbaExtractorContext, line:
  * emit ONE UnresolvedReference per match with `metadata.synthesizedBy
  * = 'vba-forms-bang'`. Operates on the ORIGINAL (unmasked) line. The form
  * identifier is unwrapped of surrounding `"` quotes and `[…]` brackets.
+ *
+ * Round-3 (issue #108): cross-form bang is always a property access
+ * (VBA semantics: there's no bang-call). The reference name is the FORM
+ * module — the resolver matches it against the indexed `Form_*` nodes
+ * downstream — so the kind is `'bang-get'` regardless of the read/write
+ * direction. A direct cross-form bang assignment
+ * (`Forms!FormX!Ctl = value`) is rare; round-3 emits `'bang-get'`
+ * uniformly and the resolvers do not care about access direction here.
  */
 export declare function scanFormsBang(ctx: VbaExtractorContext, line: string, from: ProcInfo, lineNum: number): void;
 //# sourceMappingURL=controls.d.ts.map

package/dist/mcp/server-instructions.d.ts

@@ -17,7 +17,7 @@
  * tools (node/search/callers/…) stay defined and are re-enablable via
  * CODEGRAPH_MCP_TOOLS, but they are NOT listed to agents, so don't name them.
  */
-export declare const SERVER_INSTRUCTIONS = "# Codegraph \u2014 code intelligence over an indexed knowledge graph\n\nCodegraph is a SQLite knowledge graph of every symbol, edge, and file in\nthe workspace \u2014 pre-computed structure you would otherwise re-derive by\nreading files (cached intelligence: thousands of parse/trace decisions you\ndon't pay to re-reason each run). Reads are sub-millisecond; the index lags\nwrites by ~1s through the file watcher. Reach for it BEFORE *and* while\nwriting or editing code \u2014 not just for questions: one call returns the\nverbatim source PLUS who calls it and what it affects, so you edit with the\nblast radius in view. More accurate context, in far fewer tokens and\nround-trips than reading files yourself.\n\n## One tool: codegraph_explore \u2014 use it instead of reading files\n\nThere is a single tool, `codegraph_explore`, and it is Read-equivalent. It\ntakes either a natural-language question or a bag of symbol/file names and\nreturns the **verbatim, line-numbered source** of the relevant symbols\ngrouped by file \u2014 the same `<n>\\t<line>` shape `Read` gives you, safe to\n`Edit` from \u2014 PLUS the call path among them (including dynamic-dispatch hops\nlike callbacks, React re-render, and JSX children that grep can't follow) and\na blast-radius summary of what depends on them.\n\nWhether you're answering \"how does X work\" or implementing a change (fixing a\nbug, adding a feature), call `codegraph_explore` before you Read. ONE call\nusually answers the whole question. Codegraph IS the pre-built search index \u2014\nso running your own grep + read loop, or delegating the lookup to a separate\nfile-reading sub-task/agent, repeats work codegraph already did and costs more\nfor the same answer. A direct codegraph answer is typically one to a few\ncalls; a grep/read exploration is dozens.\n\n## How to query\n\n- **Almost any question \u2014 \"how does X work\", architecture, a bug, \"what/where is X\", or surveying an area** \u2192 `codegraph_explore` with a natural-language question or the relevant names. ONE capped call returns the verbatim source grouped by file; most often the ONLY call you need.\n- **\"How does X reach/become Y? / the flow / the path from X to Y\"** \u2192 `codegraph_explore`, naming the symbols that span the flow (e.g. `mutateElement renderScene`) \u2014 it surfaces the call path among them, riding dynamic-dispatch hops, and returns their source.\n- **Reading or editing a file/symbol you can name** \u2192 put its name or file path in the `codegraph_explore` query \u2014 it returns that current line-numbered source (safe to `Edit` from) with the call path and blast radius attached, so you don't Read it separately. For an overloaded name it returns every matching definition's body in one call.\n- **Need more?** Call `codegraph_explore` again with more specific names \u2014 treat the source it returns as already Read.\n\n## Anti-patterns\n\n- **Trust codegraph's results \u2014 don't re-verify them with grep.** They come from a full AST parse; re-checking with grep is slower, less accurate, and wastes context.\n- **Don't grep or Read first** to find or understand indexed code \u2014 ONE `codegraph_explore` returns the relevant symbols' source together in a single round-trip. Reach for raw `Read`/`Grep` only to confirm a specific detail codegraph didn't cover, or for what codegraph doesn't index (configs, docs).\n- **Don't reconstruct a flow by hand** \u2014 name the endpoints in one `codegraph_explore` and it surfaces the path between them, dynamic-dispatch hops included.\n- **After editing, check the staleness banner.** When a tool response starts with \"\u26A0\uFE0F Some files referenced below were edited since the last index sync\u2026\", the listed files are pending re-index \u2014 Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust codegraph. A different, rarer banner \u2014 \"\u26A0\uFE0F CodeGraph auto-sync is DISABLED\u2026\" \u2014 means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.\n\n## Limitations\n\n- If a tool reports a project isn't indexed (no `.codegraph/`), stop calling codegraph tools for that project for the rest of the session and use your built-in tools there instead. Indexing is the user's decision \u2014 mention they can run `codegraph init` if it comes up, but don't run it yourself.\n- Index lags file writes by ~1 second.\n- Cross-file resolution is best-effort name matching; ambiguous calls may return multiple candidates.\n- No live correctness validation \u2014 that's still the TypeScript compiler / test suite / linter's job. Codegraph supplements those with structural context they don't have.\n\n## Supported Languages\n\nThe indexer recognizes a fixed set of languages; if you ask about symbols in a\nfile with an unsupported extension, codegraph will report the project isn't\nindexed for that file and you should fall back to Read/Grep. The fork-specific\naddition beyond upstream codegraph is **VBA / Access** (Dysflow export\nformat):\n\n- **VBA / Access** - Dysflow exports Access/VBA source as `.bas`/`.cls`/\n  `.form.txt`/`.report.txt`. Codegraph extracts `.bas`/`.cls` as `module`/\n  `class`/`function` nodes with `calls`/`implements`/`references` edges\n  (procedural-level; regex-based, not full AST). Cross-module calls, qualified\n  `Dim As`, `WithEvents`, and SQL table references inside string literals\n  emit synthesized edges tagged `metadata.synthesizedBy` (`vba-name-resolution`,\n  `vba-withevents`, `vba-sql-table`). `.form.txt` and `.report.txt` are\n  extracted as a `module` plus one `property` per Access control - **no**\n  `function`/`sub`/`class` nodes come from form files; the canonical code\n  lives in the sibling `.cls`, parsed by the same extractor on that file.\n  Dysflow test manifests (`tests.*.json`) link each registered `Test_*`\n  procedure to its manifest with a `references` edge tagged\n  `vba-test-manifest` carrying the test name + tags, so `getCallers` of a\n  production symbol reaches its covering test atoms with the manifest and tags\n  to run.\n  Pass `projectPath` to a codegraph index that includes VBA files.\n";
+export declare const SERVER_INSTRUCTIONS = "# Codegraph \u2014 code intelligence over an indexed knowledge graph\n\nCodegraph is a SQLite knowledge graph of every symbol, edge, and file in\nthe workspace \u2014 pre-computed structure you would otherwise re-derive by\nreading files (cached intelligence: thousands of parse/trace decisions you\ndon't pay to re-reason each run). Reads are sub-millisecond; the index lags\nwrites by ~1s through the file watcher. Reach for it BEFORE *and* while\nwriting or editing code \u2014 not just for questions: one call returns the\nverbatim source PLUS who calls it and what it affects, so you edit with the\nblast radius in view. More accurate context, in far fewer tokens and\nround-trips than reading files yourself.\n\n## One tool: codegraph_explore \u2014 use it instead of reading files\n\nThere is a single tool, `codegraph_explore`, and it is Read-equivalent. It\ntakes either a natural-language question or a bag of symbol/file names and\nreturns the **verbatim, line-numbered source** of the relevant symbols\ngrouped by file \u2014 the same `<n>\\t<line>` shape `Read` gives you, safe to\n`Edit` from \u2014 PLUS the call path among them (including dynamic-dispatch hops\nlike callbacks, React re-render, and JSX children that grep can't follow) and\na blast-radius summary of what depends on them.\n\nWhether you're answering \"how does X work\" or implementing a change (fixing a\nbug, adding a feature), call `codegraph_explore` before you Read. ONE call\nusually answers the whole question. Codegraph IS the pre-built search index \u2014\nso running your own grep + read loop, or delegating the lookup to a separate\nfile-reading sub-task/agent, repeats work codegraph already did and costs more\nfor the same answer. A direct codegraph answer is typically one to a few\ncalls; a grep/read exploration is dozens.\n\n## How to query\n\n- **Almost any question \u2014 \"how does X work\", architecture, a bug, \"what/where is X\", or surveying an area** \u2192 `codegraph_explore` with a natural-language question or the relevant names. ONE capped call returns the verbatim source grouped by file; most often the ONLY call you need.\n- **\"How does X reach/become Y? / the flow / the path from X to Y\"** \u2192 `codegraph_explore`, naming the symbols that span the flow (e.g. `mutateElement renderScene`) \u2014 it surfaces the call path among them, riding dynamic-dispatch hops, and returns their source.\n- **Reading or editing a file/symbol you can name** \u2192 put its name or file path in the `codegraph_explore` query \u2014 it returns that current line-numbered source (safe to `Edit` from) with the call path and blast radius attached, so you don't Read it separately. For an overloaded name it returns every matching definition's body in one call.\n- **Need more?** Call `codegraph_explore` again with more specific names \u2014 treat the source it returns as already Read.\n\n## Anti-patterns\n\n- **Trust codegraph's results \u2014 don't re-verify them with grep.** They come from a full AST parse; re-checking with grep is slower, less accurate, and wastes context.\n- **Don't grep or Read first** to find or understand indexed code \u2014 ONE `codegraph_explore` returns the relevant symbols' source together in a single round-trip. Reach for raw `Read`/`Grep` only to confirm a specific detail codegraph didn't cover, or for what codegraph doesn't index (configs, docs).\n- **Don't reconstruct a flow by hand** \u2014 name the endpoints in one `codegraph_explore` and it surfaces the path between them, dynamic-dispatch hops included.\n- **After editing, check the staleness banner.** When a tool response starts with \"\u26A0\uFE0F Some files referenced below were edited since the last index sync\u2026\", the listed files are pending re-index \u2014 Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust codegraph. A different, rarer banner \u2014 \"\u26A0\uFE0F CodeGraph auto-sync is DISABLED\u2026\" \u2014 means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.\n\n## Limitations\n\n- If a tool reports a project isn't indexed (no `.codegraph/`), stop calling codegraph tools for that project for the rest of the session and use your built-in tools there instead. Indexing is the user's decision \u2014 mention they can run `codegraph init` if it comes up, but don't run it yourself.\n- Index lags file writes by ~1 second.\n- Cross-file resolution is best-effort name matching; ambiguous calls may return multiple candidates.\n- No live correctness validation \u2014 that's still the TypeScript compiler / test suite / linter's job. Codegraph supplements those with structural context they don't have.\n\n## Supported Languages\n\nThe indexer recognizes a fixed set of languages; if you ask about symbols in a\nfile with an unsupported extension, codegraph will report the project isn't\nindexed for that file and you should fall back to Read/Grep. The fork-specific\naddition beyond upstream codegraph is **VBA / Access** (Dysflow export\nformat):\n\n- **VBA / Access** - Dysflow exports Access/VBA source as `.bas`/`.cls`/\n  `.form.txt`/`.report.txt`. Codegraph extracts `.bas`/`.cls` as `module`/\n  `class`/`function` nodes with `calls`/`implements`/`references` edges\n  (procedural-level; regex-based, not full AST). Cross-module calls, qualified\n  `Dim As`, `WithEvents`, and SQL table references inside string literals\n  emit synthesized edges tagged `metadata.synthesizedBy` (`vba-name-resolution`,\n  `vba-withevents`, `vba-sql-table`). `.form.txt` and `.report.txt` are\n  extracted as a `module` plus one `property` per Access control - **no**\n  `function`/`sub`/`class` nodes come from form files; the canonical code\n  lives in the sibling `.cls`, parsed by the same extractor on that file.\n  Dysflow test manifests (`tests.*.json`) link each registered `Test_*`\n  procedure to its manifest with a `references` edge tagged\n  `vba-test-manifest` carrying the test name + tags, so `getCallers` of a\n  production symbol reaches its covering test atoms with the manifest and tags\n  to run.\n  Pass `projectPath` to a codegraph index that includes VBA files.\n- **VBA unresolved refs carry syntactic shape** (v1.7+). `unresolved_refs.reference_kind` is no longer the literal string `\"references\"` \u2014 it reports what the syntactic shape actually was. Values: `call` (paren-form or statement-form call site), `qualified-call` (`obj.Foo(...)` with runtime receiver), `property-get` / `property-set` (`Me.Name`, `obj.Prop = value`), `bang-get` / `bang-set` (`Me!SubCtl`, `obj!Field = value`), `unqualified-ident` (bare identifier like `HayErrorEnRiesgo` in an `If` condition), `member-with` (`.Member` inside a `With` block), `dao-query` (`DoCmd.OpenQuery \"X\"` argument). The legacy value `references` is retained on any path the round did not reclassify, so older SQL filters that key on it keep working. To find real missing callees, filter `WHERE reference_kind IN ('call','qualified-call','unqualified-ident','member-with','bang-get')` \u2014 that set has <10% false positives (DAO-field accesses, form-property reads, and bang refs no longer pollute the bucket).\n- **Post-extraction stub resolver** (v1.7+). Edges with `metadata.synthesizedBy='vba-name-resolution'` start life pointing at a synthetic function node; the resolver at `src/resolution/index.ts:resolveVbaCallStubs` (invoked from `indexAll` and `sync`) walks them and repoints each `target` to the real `nodes.id` when one exists. Runtime-object calls (`DAO.*`, `fso.*`, `ListBox.*`, `Collection.*`, `err.*`, `VBA.*`, `Application.*`, `Screen.*`, `DoCmd.*`, `CurrentDb.*`, `Forms`, `Reports`, `Debug`, `Modules`, `References`, `CommandBars`, `SysCmd`, `CreateObject`, `GetObject`, `Fields`) are explicitly declined \u2014 they remain `stub:true` because they can never link to user code. Shadow user classes (e.g. a user class actually named `DAO` with an `Execute` method) are preserved and linked normally. Every stub edge carries `metadata.repointDecision` with one of `reponted-to-real`, `declined-runtime`, `declined-ambiguous`, `declined-not-found`, so consumers can tell apart a runtime-object decline from a genuinely-missing callee at the SQL layer.\n";
 /**
  * Instructions variant sent when the server's own root has NO codegraph index.
  *

package/dist/resolution/index.d.ts

@@ -7,6 +7,18 @@ import { UnresolvedReference, Edge } from '../types';
 import { QueryBuilder } from '../db/queries';
 import { UnresolvedRef, ResolvedRef, ResolutionResult } from './types';
 import { type MaybeYield } from './cooperative-yield';
+/**
+ * Outcome of resolving a single VBA call-stub (issue #110). Recorded on the
+ * stub's incoming `calls` edge as `metadata.repointDecision` for
+ * observability so a consumer can tell a runtime-object decline apart from a
+ * genuinely-missing callee:
+ *   - `reponted-to-real`    — a real user target was found; edge repointed (stub:false).
+ *   - `declined-runtime`    — receiver is a runtime object with no user shadow; kept stub:true.
+ *   - `declined-ambiguous`  — 2+ real candidates; can't safely pick one; kept stub:true.
+ *   - `declined-not-found`  — no real target and not a runtime object (genuine miss); kept stub:true.
+ * (The `reponted-to-real` spelling is the wire value consumers already key on.)
+ */
+export type RepointDecision = 'reponted-to-real' | 'declined-runtime' | 'declined-ambiguous' | 'declined-not-found';
 export * from './types';
 /**
  * Reference Resolver

package/dist/resolution/vba-runtime-objects.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Canonical list of VBA/Access runtime objects and singletons whose
+ * `Receiver.Member` calls are NEVER user-defined code — DAO, FileSystemObject
+ * (`fso`), intrinsic collections, error/debug intrinsics, and Access
+ * application singletons.
+ *
+ * Consumed by the post-extraction call-stub resolver
+ * (`ReferenceResolver.resolveVbaCallStubTarget`, see `./index.ts`) to DECLINE
+ * repointing a synthetic `calls` stub whose receiver is a runtime object and
+ * has no real user declaration in the project. Declining keeps the edge
+ * `stub:true`, so a consumer's `WHERE stub=true` guardrail returns GENUINE
+ * missing callees only, free of runtime-object noise (issue #110, supersedes
+ * #109).
+ *
+ * A user class or module that happens to share a runtime-object name (a
+ * "shadow" declaration, e.g. a user `.cls` literally named `DAO`) is still
+ * linked: the resolver runs its normal two-step name resolution FIRST and
+ * only falls back to this list when no real target exists, so a shadow
+ * declaration is repointed exactly like any other real symbol (FR-2.1).
+ *
+ * NOTE — this is complementary to, NOT a duplicate of, the VBA extractor's
+ * own `RUNTIME_RECEIVER_BLACKLIST` (`src/extraction/vba/constants.ts`). That
+ * set is case-sensitive PascalCase and suppresses stub SYNTHESIS for the
+ * common receivers at extraction time; this set is lowercased and catches the
+ * runtime-object stubs that still reached the graph (lowercase receivers,
+ * `Dim x As DAO.*` typed locals whose receiver survives as raw text, etc.).
+ * The extractor blacklist deliberately stays untouched (AC-4: `src/extraction`
+ * has 0 diff); the two layers are independent by design.
+ *
+ * Entries are lowercased so matching is case-insensitive against a stub's
+ * receiver.
+ */
+export declare const RUNTIME_OBJECTS: ReadonlySet<string>;
+/**
+ * True iff `receiver` (any case) names a known VBA/Access runtime object.
+ * Leading/trailing brackets and surrounding whitespace are stripped
+ * defensively so a bracketed receiver (`[DAO]`) still matches.
+ */
+export declare function isRuntimeObject(receiver: string | null | undefined): boolean;
+//# sourceMappingURL=vba-runtime-objects.d.ts.map

package/dist/types.d.ts

@@ -169,8 +169,40 @@ export interface ExtractionError {
  * a function name used as a VALUE (callback registration, #756). It never
  * becomes an edge kind: resolution maps it to a `references` edge targeting
  * function/method nodes only (see `matchFunctionRef`).
+ *
+ * Round-3 (issue #108) extends the union with shape-based classifiers so
+ * the consumer can filter `unresolved_refs` by syntactic shape at the SQL
+ * layer. The legacy `EdgeKind` literal `'references'` is preserved as
+ * `references` here via `EdgeKind` — back-compat for any push site this
+ * round does not reclassify (e.g. the Implements emitter). New literals:
+ *   - `call`             paren-form `Name(...)` or statement-form Sub call
+ *   - `qualified-call`   `Receiver.Member(...)` (qualified-paren) or
+ *                        `Receiver.Member args` (qualified-statement)
+ *   - `property-get`     `Me.Name` (dot access, read)
+ *   - `property-set`     `Me.Name = value` (dot access, assignment)
+ *   - `bang-get`         `Me!SubCtl` (bang read) or
+ *                        `Forms!FormX!Ctl` / `Forms("FormX")!Ctl` (cross-form)
+ *   - `bang-set`         `Me!SubCtl = value` (bang assignment)
+ *   - `unqualified-ident` bare identifier without `(` after; default for
+ *                        `HayErrorEnRiesgo`-style hits — Const-read takes
+ *                        priority via FR-3.1 disambiguation
+ *   - `member-with`      `.Member` inside a `With <receiver>` block
+ *   - `dao-query`        `DoCmd.OpenQuery "X"` argument
+ * `dao-field-get` / `dao-field-set` are deliberately deferred to round-4.
+ */
+export type ReferenceKind = EdgeKind | 'function_ref' | 'call' | 'qualified-call' | 'property-get' | 'property-set' | 'bang-get' | 'bang-set' | 'unqualified-ident' | 'member-with' | 'dao-query';
+/**
+ * Runtime guard for whether a `ReferenceKind` literal is also an `EdgeKind`
+ * literal (i.e. the value flows from an unresolved-ref row straight onto the
+ * kind column of a resolved edge without remapping). Round-3 (issue #108)
+ * introduced shape-based classifier literals (`call`, `qualified-call`,
+ * `property-get`, …) that are valid as a `ReferenceKind` but are NOT valid
+ * edge kinds — edges still use the `calls`/`references` family of literals.
+ * The resolver uses this guard to fall back to `'references'` for the edge
+ * kind while keeping the shape preserved on the unresolved-ref row, so the
+ * consumer's SQL filter still works after resolution.
  */
-export type ReferenceKind = EdgeKind | 'function_ref';
+export declare function isEdgeKindLiteral(value: ReferenceKind): value is EdgeKind;
 /**
  * A reference that couldn't be resolved during extraction
  */

package/dist/upgrade/index.d.ts

@@ -24,7 +24,7 @@
  * conventional Windows self-update dance (rustup/nvm-windows do the same).
  */
 export declare const REPO = "ardelperal/codegraph-vba";
-export declare const NPM_PACKAGE = "codegraph-vba";
+export declare const NPM_PACKAGE = "@aroman22/codegraph-vba";
 export declare const INSTALL_SH_URL = "https://raw.githubusercontent.com/ardelperal/codegraph-vba/main/install.sh";
 export type InstallMethod = {
     kind: 'bundle';

package/npm-shim.js

@@ -267,7 +267,7 @@ function fail(reason) {
     'A registry mirror (e.g. npmmirror/cnpm) that did not mirror the per-platform\n' +
     'package is the usual cause. Fixes:\n' +
     '  - install from the official registry:\n' +
-    '      npm i -g codegraph-vba --registry=https://registry.npmjs.org\n' +
+    '      npm i -g @aroman22/codegraph-vba --registry=https://registry.npmjs.org\n' +
     '  - or use the standalone installer (no Node required):\n' +
     '      curl -fsSL https://raw.githubusercontent.com/' + REPO + '/main/install.sh | sh\n'
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aroman22/codegraph-vba",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "description": "Local-first code intelligence for AI agents (MCP). Self-contained — bundles its own runtime.",
   "bin": {
     "codegraph-vba": "npm-shim.js"
@@ -15,12 +15,12 @@
     "./package.json": "./package.json"
   },
   "optionalDependencies": {
-    "@aroman22/codegraph-vba-darwin-arm64": "1.6.2",
-    "@aroman22/codegraph-vba-darwin-x64": "1.6.2",
-    "@aroman22/codegraph-vba-linux-arm64": "1.6.2",
-    "@aroman22/codegraph-vba-linux-x64": "1.6.2",
-    "@aroman22/codegraph-vba-win32-arm64": "1.6.2",
-    "@aroman22/codegraph-vba-win32-x64": "1.6.2"
+    "@aroman22/codegraph-vba-darwin-arm64": "1.7.0",
+    "@aroman22/codegraph-vba-darwin-x64": "1.7.0",
+    "@aroman22/codegraph-vba-linux-arm64": "1.7.0",
+    "@aroman22/codegraph-vba-linux-x64": "1.7.0",
+    "@aroman22/codegraph-vba-win32-arm64": "1.7.0",
+    "@aroman22/codegraph-vba-win32-x64": "1.7.0"
   },
   "files": [
     "npm-shim.js",