@filipebraida/adonis-function-points 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -6,6 +6,99 @@ release moves the number for unchanged code, the rule set version moves with it
 otherwise the difference would measure the tool's change rather than the work, and
 that difference becomes an invoice.
 
+## 0.11.0
+
+Rule set unchanged (`afp@1.9.0`); no number moves. What changes is what the **coverage**
+means: it measures what of the application the walk could not follow, and nothing else.
+
+### Fixed
+
+- **A call into a package is outside the boundary — noted, not an unresolved call.** An
+  authorisation service from a package injected into the application's façade, a variant of an
+  attachment whose column type is a package's, a content collection built by a package factory,
+  a mailer method inherited from a package base: none is code the analysis should follow, so none
+  is a gap it failed to follow. What a package does with its own tables is technical (§4); what it
+  hands back is a value. Read structurally — the injected property's declared type, the model
+  property's declared type, the exported const's factory, the class's base, each resolving to a
+  specifier the application does not — never by package name. One note per site in
+  `inventory.notes`, naming the transactions that reach it; behind the same noise gate as an
+  unresolved call, so what was silent stays silent. A receiver typed by the application stays a
+  gap. Fixture `fronteira_pacote` (23 FP before and after; four unresolved calls become three
+  notes and the one gap of the application).
+- **A `Map` or `Set` that arrives through the constructor, one level down a named type**
+  (`this.extras?.panel?.get(id)` with `extras?: Extras`, `Extras = { panel: Map<…> }`) is noise,
+  as `private names = new Map()` already was. Fixture `patterns/native_receivers`.
+- **A command's `@flags.*` / `@args.*` property is a string, a number or a boolean**: a method on
+  it (`this.name.trim()`) is the language's, not a gap.
+- **A method of an interface says so**: "interface method: the implementation is injected at
+  runtime and cannot be followed statically" — a gap, with the right words, where "probably
+  inherited from a package class" pointed the reader at the wrong place.
+- **A local mixin factory whose returned class declares no `@column`** adds behaviour, not
+  attributes: a note. One that declares a column stays a gap — reading its columns off the
+  returned class is a rule for a release that moves numbers.
+
+On the three validated applications, unresolved calls go from 13 / 8 / 12 to **0 / 0 / 1** —
+the one an interface method, which is a gap of the application — with no point moved.
+
+### Documented
+
+- counting-decisions §4 gains "A call into a package is outside the boundary".
+
+## 0.10.1
+
+Rule set unchanged (`afp@1.9.0`); no number moves.
+
+### Fixed
+
+- **A base class or a mixin from a package is a fact about the declaration, not an
+  unresolved call.** `compose(Base, Auditable)`, `withAuthFinder(…)` inline or through a local
+  const (which came out as "base class not found in the application" — code that is in the
+  application, built by a package's factory). Nobody follows a mixin, and in function points
+  it is nothing: what it adds is technical, never a user-recognisable attribute; the model's
+  own columns and the schema decide. Listed as a **note** by `fp:inventory` and in
+  `inventory.notes`, kept out of the coverage number. A base of the application that was not
+  found stays an unresolved call.
+
+## 0.10.0
+
+**Rule set `afp@1.9.0`.** One rule and two report fixes, from a team's third review of their
+own count — the one they accepted as a baseline. The rule moves no point on the three
+validated applications and no point on its fixture: it moves a gap from the wrong line to
+the right one. A 0.9.0 baseline still has to be recounted, because the rule set says so.
+
+### Fixed
+
+- **A warning names a transaction the way the table and the config keys do.** Four warnings
+  printed the route's own pattern (`GET /orders/:id`) where the table, `fp:explain` and the
+  keys of `overrides` / `boundary.ignoreEntryPoints` use the identity (`GET /orders/:param`,
+  §5). Copying from a warning into the configuration required a translation nobody was told
+  about. All of them print the identity now.
+- **"leaves whole — page never reads X" contradicted itself.** The rule was right — a store
+  handed to a page that uses nothing of it the reader can see leaves whole, in the open, never
+  as a floor — and the sentence was not. It says now: "handed to page "x", and nothing the
+  reader can see uses X: every column counted, in the open".
+
+### Counting
+
+- **The value of a transaction callback is what it returns.** `const { row } = await
+db.transaction(async (trx) => { … return { row: created } })`, then `row.save()`: the write
+  was an unreadable receiver. The callback is a body — its own locals are bound first, in
+  source order — and every `return` names the store the value holds, whole or under one key
+  of a returned literal; `Model.transaction` and `trx.transaction` are the same shape. A
+  returned number binds nothing; a raw-query row nobody can type stays reported. On the three
+  applications the value of a transaction callback is used 17 times. The 0.8 rule "a value a
+  package built is not a store" narrows to a call with no function argument: `db` is a
+  package import, and `db.transaction(cb)` hands back the application's value.
+
+### Documented
+
+- counting-decisions §3 gains the transaction-callback row of the bindings table.
+- Fixtures: `transacao_valor` (18 FP — the same before and after; one unresolved call moves
+  from `row.save` to the raw-query row that deserves it); `inertia_pages` grows a page that
+  uses nothing of its rows (29 FP).
+- Measured and set aside: a model's instance method that writes — one in 52 models on the
+  three applications, not a rule.
+
 ## 0.9.0
 
 **Rule set `afp@1.8.0`.** Two rules from a team's second review of their own count, one

package/README.md

@@ -13,7 +13,7 @@ node ace fp:count
 
 ```
 Unadjusted count: 46 FP
-Ruleset: afp@1.8.0
+Ruleset: afp@1.9.0
 
 type      n     FP
 ILF       2     14

package/build/commands/main.js

@@ -14,27 +14,27 @@
 const commands = [
 	{
 		commandName: "fp:inventory",
-		importer: () => import("../fp_inventory-B4Pv8Thz.js")
+		importer: () => import("../fp_inventory-D3_6QCD2.js")
 	},
 	{
 		commandName: "fp:metrics",
-		importer: () => import("../fp_metrics-DoS5riGr.js")
+		importer: () => import("../fp_metrics-lnnhnVaw.js")
 	},
 	{
 		commandName: "fp:count",
-		importer: () => import("../fp_count-Bjviq8dz.js")
+		importer: () => import("../fp_count-mDQgQeEq.js")
 	},
 	{
 		commandName: "fp:explain",
-		importer: () => import("../fp_explain-CrFcMeXU.js")
+		importer: () => import("../fp_explain-CQESTS5W.js")
 	},
 	{
 		commandName: "fp:diff",
-		importer: () => import("../fp_diff-BSK1kKLQ.js")
+		importer: () => import("../fp_diff-BnWi2Fx8.js")
 	},
 	{
 		commandName: "fp:calibrate",
-		importer: () => import("../fp_calibrate-DJspMFHc.js")
+		importer: () => import("../fp_calibrate-U5xdt5Qe.js")
 	}
 ];
 let cache = null;

package/build/{fp_calibrate-DJspMFHc.js → fp_calibrate-U5xdt5Qe.js}

@@ -1,4 +1,4 @@
-import { s as printResult, t as runCalibrate } from "./runners-BuZNr-FE.js";
+import { s as printResult, t as runCalibrate } from "./runners-CzzlX7h-.js";
 import { n as printerFor, t as __decorate } from "./decorate-D6enDn9D.js";
 import { BaseCommand, args } from "@adonisjs/core/ace";
 //#region commands/fp_calibrate.ts

package/build/{fp_count-Bjviq8dz.js → fp_count-mDQgQeEq.js}

@@ -1,4 +1,4 @@
-import { n as runCount, s as printResult } from "./runners-BuZNr-FE.js";
+import { n as runCount, s as printResult } from "./runners-CzzlX7h-.js";
 import { n as printerFor, t as __decorate } from "./decorate-D6enDn9D.js";
 import { BaseCommand, flags } from "@adonisjs/core/ace";
 //#region commands/fp_count.ts

package/build/{fp_diff-BSK1kKLQ.js → fp_diff-BnWi2Fx8.js}

@@ -1,4 +1,4 @@
-import { r as runDiff, s as printResult } from "./runners-BuZNr-FE.js";
+import { r as runDiff, s as printResult } from "./runners-CzzlX7h-.js";
 import { n as printerFor, t as __decorate } from "./decorate-D6enDn9D.js";
 import { BaseCommand, args } from "@adonisjs/core/ace";
 //#region commands/fp_diff.ts

package/build/{fp_explain-CrFcMeXU.js → fp_explain-CQESTS5W.js}

@@ -1,4 +1,4 @@
-import { i as runExplain, s as printResult } from "./runners-BuZNr-FE.js";
+import { i as runExplain, s as printResult } from "./runners-CzzlX7h-.js";
 import { n as printerFor, t as __decorate } from "./decorate-D6enDn9D.js";
 import { BaseCommand, args } from "@adonisjs/core/ace";
 //#region commands/fp_explain.ts

package/build/{fp_inventory-B4Pv8Thz.js → fp_inventory-D3_6QCD2.js}

@@ -1,4 +1,4 @@
-import { a as runInventory, s as printResult } from "./runners-BuZNr-FE.js";
+import { a as runInventory, s as printResult } from "./runners-CzzlX7h-.js";
 import { n as printerFor, t as __decorate } from "./decorate-D6enDn9D.js";
 import { BaseCommand, flags } from "@adonisjs/core/ace";
 //#region commands/fp_inventory.ts

package/build/{fp_metrics-DoS5riGr.js → fp_metrics-lnnhnVaw.js}

@@ -1,4 +1,4 @@
-import { o as runMetrics, s as printResult } from "./runners-BuZNr-FE.js";
+import { o as runMetrics, s as printResult } from "./runners-CzzlX7h-.js";
 import { n as printerFor, t as __decorate } from "./decorate-D6enDn9D.js";
 import { BaseCommand, flags } from "@adonisjs/core/ace";
 //#region commands/fp_metrics.ts

package/build/index.js

@@ -1,6 +1,6 @@
 import { configure } from "./configure.js";
 import { a as AEP_FACTORS, c as IncomparableSourcesError, f as defineConfig, i as measureStructure, l as SISP_FACTORS, n as parseSamples, o as FACTOR_PRESETS, r as measureConformance, s as IncomparableRulesetsError, t as calibrate, u as diffCounts } from "./calibration-DVIf8hcE.js";
 import "./src/types.js";
-import { n as ignoreCalls, t as BUILTIN_CALL_RESOLVERS } from "./resolvers-CneCj3sT.js";
-import { a as DEFAULT_TECHNICAL_PATTERNS, i as RULESET_VERSION, n as analyze, r as RULESET, t as CoverageTooLowError } from "./pipeline-DqPrDZfD.js";
+import { n as ignoreCalls, t as BUILTIN_CALL_RESOLVERS } from "./resolvers-Bz1F-Tgf.js";
+import { a as DEFAULT_TECHNICAL_PATTERNS, i as RULESET_VERSION, n as analyze, r as RULESET, t as CoverageTooLowError } from "./pipeline-CdDJRsLM.js";
 export { AEP_FACTORS, BUILTIN_CALL_RESOLVERS, CoverageTooLowError, DEFAULT_TECHNICAL_PATTERNS, FACTOR_PRESETS, IncomparableRulesetsError, IncomparableSourcesError, RULESET, RULESET_VERSION, SISP_FACTORS, analyze, calibrate, configure, defineConfig, diffCounts, ignoreCalls, measureConformance, measureStructure, parseSamples };

package/build/{pipeline-DqPrDZfD.js → pipeline-CdDJRsLM.js}

@@ -1,4 +1,4 @@
-import { _ as relativeTo, a as chainShapeOf, c as unwrap$1, d as collectEventBindings, f as detectAccess, g as isSeeder, h as isApplicationCode, i as resolveCall, l as DISPATCH_METHODS, m as rootSymbolOf, o as mappedLiteralOf, p as hooksFiredBy, r as isTechnicalWrite, s as outputFieldsIn, t as BUILTIN_CALL_RESOLVERS, u as EXECUTION_METHODS, v as samePath, y as toPosix } from "./resolvers-CneCj3sT.js";
+import { _ as isSeeder, a as chainShapeOf, b as toPosix, c as transformerResourceOf, d as EXECUTION_METHODS, f as collectEventBindings, g as isApplicationCode, h as rootSymbolOf, i as resolveCall, l as unwrap$1, m as hooksFiredBy, o as mappedLiteralOf, p as detectAccess, r as isTechnicalWrite, s as outputFieldsIn, t as BUILTIN_CALL_RESOLVERS, u as DISPATCH_METHODS, v as relativeTo, y as samePath } from "./resolvers-Bz1F-Tgf.js";
 import fs from "node:fs/promises";
 import path, { dirname, join, resolve } from "node:path";
 import { Node, Project, SyntaxKind } from "ts-morph";
@@ -384,6 +384,7 @@ async function collectDataStores(app) {
 	if (app.generated.dataSchema) project.addSourceFileAtPathIfExists(app.generated.dataSchema);
 	const candidates = [];
 	const unresolved = [];
+	const notes = [];
 	/**
 	* Classes appearing as an ANCESTOR of some model.
 	*
@@ -395,7 +396,7 @@ async function collectDataStores(app) {
 	for (const file of project.getSourceFiles()) {
 		if (samePath(file.getFilePath(), app.generated.dataSchema)) continue;
 		for (const cls of file.getClasses()) {
-			const described = describeStore(cls, app, project, unresolved);
+			const described = describeStore(cls, app, project, unresolved, notes);
 			if (!described) continue;
 			candidates.push(described.store);
 			for (const ancestor of described.ancestors) ancestors.add(ancestor);
@@ -403,18 +404,20 @@ async function collectDataStores(app) {
 	}
 	return {
 		stores: candidates.filter((store) => !ancestors.has(store.id)).sort(byName),
-		unresolved
+		unresolved,
+		notes
 	};
 }
 /** stable identity of a class, to separate a base from a store */
 const classKey = (cls) => `${cls.getSourceFile().getFilePath()}#${cls.getName()}`;
 const byName = (a, b) => a.name.localeCompare(b.name);
-function describeStore(cls, app, project, unresolved) {
+function describeStore(cls, app, project, unresolved, notes) {
 	const name = cls.getName();
 	if (!name) return null;
 	const chain = walkChain(cls, app, project);
 	if (!chain.reachesLucid) return null;
 	unresolved.push(...chain.unresolved);
+	notes.push(...chain.notes);
 	const file = cls.getSourceFile().getFilePath();
 	return {
 		store: {
@@ -455,6 +458,7 @@ function walkChain(start, app, project) {
 	* the coverage report.
 	*/
 	const unresolved = [];
+	const notes = [];
 	let reachesLucid = false;
 	let columnSource = "ast";
 	const visit = (cls) => {
@@ -475,6 +479,31 @@ function walkChain(start, app, project) {
 				visit(resolved);
 				continue;
 			}
+			/**
+			* A base or a mixin from a PACKAGE — `compose(Base, Auditable)` imported from
+			* outside, `withAuthFinder(…)` inline or through a local const — is a fact about
+			* the declaration, not a gap in the walk: nobody follows a mixin. What it adds is
+			* technical (a hashed password, audit stamps) and never a user-recognisable
+			* attribute (§7.2); the model's own columns and the schema decide. Noted, and kept
+			* out of the coverage number. A base of the application that was not found stays
+			* a gap.
+			*/
+			/**
+			* A mixin factory OF THE APPLICATION whose returned class declares no `@column`
+			* adds methods, not attributes: a fact, not a gap. One that declares columns
+			* stays a gap — reading them off the returned class is a rule for a release
+			* that moves numbers (plan 0.11 §E).
+			*/
+			const columnless = localFactoryWithoutColumns(parent, cls.getSourceFile(), app, project);
+			if (columnless) {
+				notes.push(`${cls.getName() ?? "?"}: local mixin factory ${columnless} declares no column — adds behaviour, not attributes`);
+				continue;
+			}
+			const packaged = packageOriginOf(parent, cls.getSourceFile(), app);
+			if (packaged) {
+				notes.push(`${cls.getName() ?? "?"}: base or mixin from ${packaged.specifier} (${packaged.expression}) — technical, adds no user-recognisable attribute; the model's own columns and the schema decide`);
+				continue;
+			}
 			unresolved.push({
 				file: cls.getSourceFile().getFilePath(),
 				line: parent.getStartLineNumber(),
@@ -489,10 +518,77 @@ function walkChain(start, app, project) {
 		classes,
 		attributes: [...attributes.values()],
 		columnSource,
-		unresolved
+		unresolved,
+		notes
 	};
 }
 /**
+* `compose(Base, withTracking())` where `withTracking` is a function of the application
+* whose body returns a class expression: the factory's name when that class declares no
+* `@column`, `null` when it declares one (or when the factory cannot be read).
+*/
+function localFactoryWithoutColumns(parent, file, app, project) {
+	if (!Node.isCallExpression(parent)) return null;
+	const callee = parent.getExpression();
+	if (!Node.isIdentifier(callee)) return null;
+	const name = callee.getText();
+	let declared = file.getFunction(name);
+	if (!declared) {
+		const origin = originOf$1(name, file);
+		const target = origin ? app.resolveSpecifier(origin.specifier) : null;
+		declared = (target ? project.getSourceFile(target) ?? project.addSourceFileAtPathIfExists(target) : null)?.getFunction(origin?.exportedName === "default" ? name : origin?.exportedName ?? name) ?? void 0;
+	}
+	if (!declared) return null;
+	return [...declared.getDescendantsOfKind(SyntaxKind.ClassExpression), ...declared.getDescendantsOfKind(SyntaxKind.ClassDeclaration)].some((c) => c.getProperties().some((p) => p.getDecorators().some((d) => /^column\b/.test(d.getFullName())))) ? null : `${name}()`;
+}
+/**
+* Where a base or a mixin comes from, when it comes from a package: the class
+* imported from a specifier the application does not resolve, a factory call whose
+* callee is, or a local const initialised by such a call.
+*/
+function packageOriginOf(parent, file, app) {
+	const fromPackage = (local) => {
+		const origin = originOf$1(local, file);
+		return origin && !app.resolveSpecifier(origin.specifier) ? origin.specifier : null;
+	};
+	const rootOf = (node) => {
+		let current = node;
+		for (let depth = 0; depth < 20; depth++) {
+			if (Node.isCallExpression(current) || Node.isPropertyAccessExpression(current)) {
+				current = current.getExpression();
+				continue;
+			}
+			return Node.isIdentifier(current) ? current.getText() : null;
+		}
+		return null;
+	};
+	const brief = (text) => text.replace(/\s+/g, " ").slice(0, 60);
+	if (Node.isCallExpression(parent)) {
+		const root = rootOf(parent);
+		const specifier = root ? fromPackage(root) : null;
+		return specifier ? {
+			specifier,
+			expression: brief(parent.getText())
+		} : null;
+	}
+	if (!Node.isIdentifier(parent)) return null;
+	const direct = fromPackage(parent.getText());
+	if (direct) return {
+		specifier: direct,
+		expression: parent.getText()
+	};
+	const initializer = file.getVariableDeclaration(parent.getText())?.getInitializer();
+	if (initializer && Node.isCallExpression(initializer)) {
+		const root = rootOf(initializer);
+		const specifier = root ? fromPackage(root) : null;
+		if (specifier) return {
+			specifier,
+			expression: `${parent.getText()} = ${brief(initializer.getText())}`
+		};
+	}
+	return null;
+}
+/**
 * Why the base class could not be resolved.
 *
 * The right reason matters as much as the fact: saying "outside the
@@ -1193,8 +1289,7 @@ const FRAMEWORK_SERVICES = new Set([
 	"app",
 	"prompt"
 ]);
-/** Is this call one that cannot reach a data store? */
-function isNoise(call, owner) {
+function isNoise(call, owner, membersOf) {
 	const expression = call.getExpression();
 	if (!Node.isPropertyAccessExpression(expression)) return false;
 	if (NEVER_DATA_METHODS.has(expression.getName())) return true;
@@ -1207,7 +1302,7 @@ function isNoise(call, owner) {
 	* than a bare identifier.
 	*/
 	if (Node.isPropertyAccessExpression(receiver) && Node.isThisExpression(receiver.getExpression()) && FRAMEWORK_SERVICES.has(receiver.getName())) return true;
-	return isNativeReceiver(receiver, owner);
+	return isNativeReceiver(receiver, owner, membersOf);
 }
 /**
 * Iteration over a list, checked BEFORE the resolvers run.
@@ -1233,14 +1328,40 @@ function isIteration(method, call) {
 	return first !== void 0 && (Node.isArrowFunction(first) || Node.isFunctionExpression(first));
 }
 /** Does the receiver resolve to a built-in, by its declaration? */
-function isNativeReceiver(receiver, owner) {
+function isNativeReceiver(receiver, owner, membersOf) {
 	if (Node.isArrayLiteralExpression(receiver) || Node.isStringLiteral(receiver)) return true;
-	if (Node.isPropertyAccessExpression(receiver) && receiver.getExpression().getKind()) {
+	if (Node.isPropertyAccessExpression(receiver)) {
 		const inner = receiver.getExpression();
-		if (Node.isThisExpression(inner) && owner) return isNativeProperty(owner, receiver.getName());
+		if (Node.isThisExpression(inner) && owner) return isNativeProperty(owner, receiver.getName()) || isPrimitiveInput(owner, receiver.getName());
+		/**
+		* `this.extras?.painel?.get(id)` where `constructor(protected extras?: Extras)` and
+		* `type Extras = { painel: Map<number, Row> }`: the lookups a transformer receives
+		* arrive one level down, through a named type. The caller resolves the type; here
+		* only its member's type is read.
+		*/
+		if (Node.isPropertyAccessExpression(inner) && Node.isThisExpression(inner.getExpression()) && owner && membersOf) {
+			const typeNode = declaredOn(owner, inner.getName())?.getTypeNode();
+			if (!typeNode) return false;
+			const memberType = membersOf(typeNode).get(receiver.getName());
+			return !!memberType && NATIVE_TYPES.has(memberType.replace(/<.*/, "").trim());
+		}
 	}
 	return false;
 }
+/** a class property or a constructor parameter property by name */
+function declaredOn(owner, name) {
+	return owner.getProperty(name) ?? owner.getConstructors()[0]?.getParameters().find((parameter) => parameter.getName() === name);
+}
+/** an ace command's `@flags.*` / `@args.*` property is a string, a number or a boolean: any method on it is the language's */
+function isPrimitiveInput(owner, name) {
+	const property = owner.getProperty(name);
+	if (!property) return false;
+	return property.getDecorators().some((decorator) => {
+		const callee = decorator.getCallExpression()?.getExpression();
+		const root = callee && Node.isPropertyAccessExpression(callee) ? callee.getExpression().getText() : "";
+		return root === "flags" || root === "args";
+	});
+}
 function isNativeProperty(owner, name) {
 	/**
 	* Both shapes declare a field: a class property, and a constructor parameter
@@ -2168,7 +2289,7 @@ function readPages(deliveries, env) {
 		for (const { store } of readable) {
 			if (reading.columns.has(store) || reading.unreadable.has(store)) continue;
 			const members = [...reading.unknownMembers.get(store) ?? []];
-			markUnreadable(reading, store, members.length > 0 ? `page "${page}" reads ${members.slice(0, 4).map((m) => `\`${m}\``).join(", ")} off ${store}, none of them a column of it` : `page "${page}" never reads ${store}`);
+			markUnreadable(reading, store, members.length > 0 ? `page "${page}" reads ${members.slice(0, 4).map((m) => `\`${m}\``).join(", ")} off ${store}, none of them a column of it` : `handed to page "${page}", and nothing the reader can see uses ${store}: every column counted, in the open`);
 		}
 	}
 	return reading;
@@ -3065,6 +3186,59 @@ function createAnalyzer(app, stores, options = {}) {
 			}
 			return found.size === 1 ? [...found][0] : null;
 		};
+		/**
+		* `await db.transaction(async (trx) => { … return … })` — also `Model.transaction`
+		* and `trx.transaction` (a savepoint): a body whose VALUE is what it returns. The
+		* callback's own locals are bound first, in source order, so `return { row: created }`
+		* can be read; then every return names one store, or nothing binds (plan 0.10 §B).
+		*/
+		const transactionCallbackOf = (call) => {
+			const callee = call.getExpression();
+			if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "transaction") return null;
+			return call.getArguments().find((a) => Node.isArrowFunction(a) || Node.isFunctionExpression(a)) ?? null;
+		};
+		const returnsOf = (callback) => {
+			if (!Node.isArrowFunction(callback) && !Node.isFunctionExpression(callback)) return [];
+			const callbackBody = callback.getBody();
+			if (!Node.isBlock(callbackBody)) return [callbackBody];
+			const returned = [];
+			for (const statement of callbackBody.getDescendantsOfKind(SyntaxKind.ReturnStatement)) {
+				const owner = statement.getFirstAncestor((n) => Node.isArrowFunction(n) || Node.isFunctionExpression(n) || Node.isFunctionDeclaration(n) || Node.isMethodDeclaration(n));
+				const expression = statement.getExpression();
+				if (owner === callback && expression) returned.push(expression);
+			}
+			return returned;
+		};
+		const bindCallbackLocals = (callback) => {
+			for (const declaration of callback.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+				const nameNode = declaration.getNameNode();
+				const initializer = declaration.getInitializer();
+				if (!initializer || !Node.isIdentifier(nameNode)) continue;
+				const store = storeOfValue(initializer);
+				if (store) symbols.set(nameNode.getText(), store);
+			}
+		};
+		/** the store every return of the callback names — whole, or under one key of a returned literal */
+		const transactionValueStore = (callback, key) => {
+			bindCallbackLocals(callback);
+			const returned = returnsOf(callback);
+			if (returned.length === 0) return null;
+			const found = /* @__PURE__ */ new Set();
+			for (const expression of returned) {
+				let value = unwrapAwait(expression);
+				if (key) {
+					if (!Node.isObjectLiteralExpression(value)) return null;
+					const property = value.getProperty(key);
+					if (!property) return null;
+					value = Node.isPropertyAssignment(property) ? property.getInitializer() : Node.isShorthandPropertyAssignment(property) ? property.getNameNode() : void 0;
+					if (!value) return null;
+				}
+				const store = storeOfValue(value);
+				if (!store) return null;
+				found.add(store);
+			}
+			return found.size === 1 ? [...found][0] : null;
+		};
 		const isAuthUser = (node) => {
 			if (!authUserStore) return false;
 			const chain = Node.isCallExpression(node) ? node.getExpression() : node;
@@ -3097,6 +3271,8 @@ function createAnalyzer(app, stores, options = {}) {
 			if (Node.isPropertyAccessExpression(node)) return storeOfExpression(node, symbols, relationsByStore);
 			if (Node.isCallExpression(node)) {
 				const callee = node.getExpression();
+				const callback = transactionCallbackOf(node);
+				if (callback) return transactionValueStore(callback);
 				if (Node.isPropertyAccessExpression(callee)) {
 					/**
 					* `q.forUpdate()`, `q.where(…)`: a query-builder chain hands the same rows on —
@@ -3144,6 +3320,14 @@ function createAnalyzer(app, stores, options = {}) {
 					*/
 					const store = storeOfValue(initializer);
 					if (store) symbols.set(nameNode.getText(), store);
+				} else if (Node.isObjectBindingPattern(nameNode)) {
+					const call = unwrapAwait(initializer);
+					const callback = Node.isCallExpression(call) ? transactionCallbackOf(call) : null;
+					if (!callback) return;
+					for (const element of nameNode.getElements()) {
+						const store = transactionValueStore(callback, element.getPropertyNameNode()?.getText() ?? element.getName());
+						if (store) symbols.set(element.getName(), store);
+					}
 				}
 				return;
 			}
@@ -3189,6 +3373,7 @@ function createAnalyzer(app, stores, options = {}) {
 		const accesses = [];
 		const followUps = [];
 		const unresolved = [];
+		const packageCalls = [];
 		const reads = [];
 		/** calls a strategy claimed, and where they lead: a nested transformer's keys arrive through its body */
 		const followedCalls = /* @__PURE__ */ new Map();
@@ -3308,7 +3493,14 @@ function createAnalyzer(app, stores, options = {}) {
 			* counted as EOs under a coverage of 99.5%, because a write on an unknown
 			* local was dropped without a word. It lowers coverage and is named.
 			*/
-			if (isUnreadableWrite(call, symbols, imports, packageImports, body) && !isNoise(call, owner)) {
+			/**
+			* A call INTO a package — `this.authz.can()` on an injected package type,
+			* `row.avatar.getVariant()` on a package-typed column, `catalogue.load()` on a
+			* package factory's product — is outside the boundary: what a package does with
+			* its own tables is technical (§4), what it hands back is a value. Not a gap
+			* the walk failed at; noted (plan 0.11 §A).
+			*/
+			if (isUnreadableWrite(call, symbols, imports, packageImports, body) && !isNoise(call, owner, (typeNode) => membersOfType(typeNode, file, app))) {
 				unresolved.push({
 					file: ref.file,
 					line: call.getStartLineNumber(),
@@ -3317,12 +3509,24 @@ function createAnalyzer(app, stores, options = {}) {
 				});
 				continue;
 			}
-			if (isWorthReporting(call, symbols, imports) && !isNoise(call, owner)) unresolved.push({
-				file: ref.file,
-				line: call.getStartLineNumber(),
-				expression: call.getExpression().getText().replace(/\s+/g, ""),
-				reason: "call that no strategy knew how to follow"
-			});
+			if (isWorthReporting(call, symbols, imports) && !isNoise(call, owner, (typeNode) => membersOfType(typeNode, file, app))) {
+				const specifier = packageTargetOf(call, owner, file, symbols, app, storesByName, sourceFile);
+				if (specifier) {
+					packageCalls.push({
+						file: ref.file,
+						line: call.getStartLineNumber(),
+						expression: call.getExpression().getText().replace(/\s+/g, ""),
+						specifier
+					});
+					continue;
+				}
+				unresolved.push({
+					file: ref.file,
+					line: call.getStartLineNumber(),
+					expression: call.getExpression().getText().replace(/\s+/g, ""),
+					reason: "call that no strategy knew how to follow"
+				});
+			}
 		}
 		/**
 		* Read after the loop: whether a key holds a nested transformer is known only
@@ -3342,6 +3546,7 @@ function createAnalyzer(app, stores, options = {}) {
 			followUps,
 			unresolved,
 			validators: validator.fields,
+			packageCalls,
 			commandFields,
 			opaqueValidators: validator.opaque,
 			requestFields: request.fields,
@@ -3451,6 +3656,7 @@ function createAnalyzer(app, stores, options = {}) {
 		const writtenStores = /* @__PURE__ */ new Set();
 		const inputFields = /* @__PURE__ */ new Set();
 		const commandFields = /* @__PURE__ */ new Set();
+		const packageCalls = [];
 		const opaqueInputFields = /* @__PURE__ */ new Set();
 		const requestFields = /* @__PURE__ */ new Set();
 		let opaqueRequest = false;
@@ -3614,12 +3820,36 @@ function createAnalyzer(app, stores, options = {}) {
 				* Dropping it silently is the worst possible defect: the transaction
 				* loses a path and nobody knows.
 				*/
-				if (!isNoiseMember(ref.file, ref.member)) unresolved.push({
-					file: ref.file,
-					line: ref.line ?? 0,
-					expression: `${pathOf(ref.file)}.${ref.member ?? "handle"}`,
-					reason: "body not found in the resolved file: probably inherited from a package class"
-				});
+				if (!isNoiseMember(ref.file, ref.member)) {
+					/**
+					* `catalogue.load()` where `catalogue` is `defineCollection(…)` from a package,
+					* or a class extending a package base without the member: the body is the
+					* package's. Outside the boundary — noted, not a gap (plan 0.11 §A).
+					*/
+					const source = sourceFile(ref.file);
+					const fromPackage = source ? packageMemberOriginOf(source, ref.member, app) : null;
+					if (fromPackage) {
+						packageCalls.push({
+							file: ref.file,
+							line: ref.line ?? 0,
+							expression: `${pathOf(ref.file)}.${ref.member ?? "handle"}`,
+							specifier: fromPackage
+						});
+						return;
+					}
+					/**
+					* `fonte.varrerPorDocumento()` where the file declares an INTERFACE with that
+					* member and no class: there is no body because the implementation is injected
+					* at runtime — a gap, and the right words for it.
+					*/
+					const declaredAsInterface = !!ref.member && !!source && source.getInterfaces().some((i) => i.getMethod(ref.member) || i.getProperty(ref.member));
+					unresolved.push({
+						file: ref.file,
+						line: ref.line ?? 0,
+						expression: `${pathOf(ref.file)}.${ref.member ?? "handle"}`,
+						reason: declaredAsInterface ? "interface method: the implementation is injected at runtime and cannot be followed statically" : "body not found in the resolved file: probably inherited from a package class"
+					});
+				}
 				return;
 			}
 			let bodyWrites = false;
@@ -3639,6 +3869,7 @@ function createAnalyzer(app, stores, options = {}) {
 			unresolved.push(...facts.unresolved);
 			for (const field of facts.validators) inputFields.add(field);
 			for (const field of facts.commandFields) commandFields.add(field);
+			for (const packaged of facts.packageCalls) packageCalls.push(packaged);
 			for (const field of facts.opaqueValidators) opaqueInputFields.add(field);
 			for (const field of facts.requestFields) requestFields.add(field);
 			if (facts.opaqueRequest) opaqueRequest = true;
@@ -3705,6 +3936,7 @@ function createAnalyzer(app, stores, options = {}) {
 			writtenStores: [...writtenStores].sort(),
 			inputFields: [...inputFields].sort(),
 			commandFields: [...commandFields].sort(),
+			packageCalls,
 			opaqueInputFields: [...opaqueInputFields].sort(),
 			requestFields: [...requestFields].sort(),
 			opaqueRequest,
@@ -3939,7 +4171,91 @@ function dependencyTypeOf(node) {
 		if (Node.isIdentifier(target)) return target.getText();
 	}
 }
-/** type identifier -> application file where it is declared */
+/** the specifier a type name is imported from in `file`, when the application does not resolve it */
+function packageSpecifierOfType(typeName, file, app) {
+	const bare = typeName.replace(/<.*/, "").replace(/\|.*$/, "").replace(/\[\]$/, "").trim();
+	for (const declaration of file.getImportDeclarations()) {
+		const specifier = declaration.getModuleSpecifierValue();
+		if (![declaration.getDefaultImport()?.getText(), ...declaration.getNamedImports().map((n) => n.getAliasNode()?.getText() ?? n.getName())].includes(bare)) continue;
+		return app.resolveSpecifier(specifier) ? null : specifier;
+	}
+	return null;
+}
+/** the declared type of `this.<property>` on the owner class: a constructor parameter or a property */
+function declaredTypeOfProperty(owner, property) {
+	if (!owner) return void 0;
+	const parameter = owner.getConstructors()[0]?.getParameters().find((p) => p.getName() === property);
+	if (parameter) return dependencyTypeOf(parameter);
+	const declared = owner.getProperties().find((p) => p.getName() === property);
+	return declared ? dependencyTypeOf(declared) : void 0;
+}
+/**
+* Does this call go INTO a package? Structurally, never by name:
+*
+*   this.authz.can(…)              `authz` injected as a type imported from a package
+*   this.resource.avatar.getVariant  a column of the store whose declared type is a package's
+*   attachmentManager.create(…)    the receiver itself imported from a package
+*
+* The specifier comes back so the note can say which package.
+*/
+function packageTargetOf(call, owner, file, symbols, app, stores, sourceFile) {
+	const callee = call.getExpression();
+	if (!Node.isPropertyAccessExpression(callee)) return null;
+	const receiver = unwrapAwait(callee.getExpression());
+	if (Node.isPropertyAccessExpression(receiver) && Node.isThisExpression(receiver.getExpression())) {
+		const declared = declaredTypeOfProperty(owner, receiver.getName());
+		if (declared) return packageSpecifierOfType(declared, file, app);
+	}
+	if (Node.isPropertyAccessExpression(receiver)) {
+		const holder = receiver.getExpression();
+		const holderText = holder.getText();
+		const store = symbols.get(rootSymbolOf(holder) ?? "") ?? (holderText === "this.resource" && owner ? transformerResourceOf(owner) : null);
+		const declared = store ? stores.get(store) : void 0;
+		const modelFile = declared ? sourceFile(declared.provenance.file) : null;
+		if (declared && modelFile) {
+			const type = modelFile.getClasses().flatMap((c) => c.getProperties()).find((p) => p.getName() === receiver.getName())?.getTypeNode()?.getText() ?? declared.attributes.find((a) => a.name === receiver.getName())?.type;
+			if (type) return packageSpecifierOfType(type, modelFile, app);
+		}
+	}
+	if (Node.isIdentifier(receiver)) return packageSpecifierOfType(receiver.getText(), file, app);
+	return null;
+}
+/**
+* A member the resolved file does not declare, because it is a package's: the
+* exported symbol is a const built by a package factory, or a class extending a
+* package base. Returns the package's specifier.
+*/
+function packageMemberOriginOf(file, member, app) {
+	const rootOf = (node) => {
+		let current = node;
+		for (let depth = 0; depth < 20; depth++) {
+			if (Node.isCallExpression(current) || Node.isPropertyAccessExpression(current)) {
+				current = current.getExpression();
+				continue;
+			}
+			return Node.isIdentifier(current) ? current.getText() : null;
+		}
+		return null;
+	};
+	const defaultExported = file.getExportAssignments().map((e) => e.getExpression().getText());
+	const declarations = file.getVariableDeclarations();
+	const exported = declarations.filter((d) => d.getVariableStatement()?.isExported() || defaultExported.includes(d.getName()));
+	for (const declaration of exported.length > 0 ? exported : declarations) {
+		const initializer = declaration.getInitializer();
+		if (!initializer || !Node.isCallExpression(initializer)) continue;
+		const root = rootOf(initializer);
+		const specifier = root ? packageSpecifierOfType(root, file, app) : null;
+		if (specifier) return specifier;
+	}
+	for (const cls of file.getClasses()) {
+		if (member && cls.getMethod(member)) return null;
+		const parent = cls.getExtends()?.getExpression();
+		const root = parent ? rootOf(parent) : null;
+		const specifier = root ? packageSpecifierOfType(root, file, app) : null;
+		if (specifier) return specifier;
+	}
+	return null;
+}
 function resolveTypeToFile(typeName, file, app) {
 	const bare = typeName.replace(/<.*/, "").trim();
 	for (const declaration of file.getImportDeclarations()) {
@@ -4194,8 +4510,15 @@ function isUnreadableWrite(call, symbols, imports, packageImports, body) {
 		const nameNode = declaration.getNameNode();
 		if (!Node.isIdentifier(nameNode) || nameNode.getText() !== root) continue;
 		const initializer = declaration.getInitializer();
-		const origin = initializer ? rootSymbolOf(unwrapAwait(initializer)) : null;
-		if (origin && packageImports.has(origin)) return false;
+		const initialized = initializer ? unwrapAwait(initializer) : null;
+		/**
+		* `await db.transaction(async (trx) => …)` is rooted at a package too, but its value
+		* is what the CALLBACK returns — the application's. Only a call with no function
+		* argument is a package's own object.
+		*/
+		const handsBackACallback = initialized && Node.isCallExpression(initialized) && initialized.getArguments().some((a) => Node.isArrowFunction(a) || Node.isFunctionExpression(a));
+		const origin = initialized ? rootSymbolOf(initialized) : null;
+		if (origin && packageImports.has(origin) && !handsBackACallback) return false;
 	}
 	return true;
 }
@@ -5142,13 +5465,14 @@ const RULESET = "afp";
 * the guard's user, a service the container made — and a write nobody can type is
 * an unresolved call instead of silence. Two in 1.8.0: a method the model
 * declares names the store its caller writes, and a listener written inline on a
-* string event is followed like a listener class.
+* string event is followed like a listener class. One in 1.9.0: the value of a
+* transaction callback is what its returns name.
 *
 * Without the bump, a baseline saved by the previous version compares cleanly
 * against this one and bills the tool's own improvement as work done. The guard
 * exists for exactly that, and only this constant arms it.
 */
-const RULESET_VERSION = "1.8.0";
+const RULESET_VERSION = "1.9.0";
 function count(input, options = {}) {
 	const warnings = [];
 	const usage = usageOf(input);
@@ -5296,7 +5620,7 @@ function unreadableDeliveryWarnings(input) {
 	if (blind.length === 0) return [];
 	return [
 		`${blind.length} transaction(s) deliver a value the analysis cannot read — a generated document, a call nobody followed — counted as 1 DET each, a FLOOR. This UNDERSTATES the output:`,
-		...blind.slice(0, 10).map(({ entry, behavior }) => `  ${entry.trigger} ${entry.signature}: ${behavior.delivered.opaqueFields.join(", ")}`),
+		...blind.slice(0, 10).map(({ entry, behavior }) => `  ${entry.identity}: ${behavior.delivered.opaqueFields.join(", ")}`),
 		...blind.length > 10 ? [`  … and ${blind.length - 10} more`] : []
 	];
 }
@@ -5312,7 +5636,7 @@ function unreadablePageWarnings(input) {
 	for (const entry of input.entryPoints) {
 		const behavior = input.behaviors.get(entry.id);
 		if (!behavior || behavior.writes) continue;
-		for (const [store, reason] of Object.entries(behavior.unreadablePages ?? {})) lines.push(`  ${entry.trigger} ${entry.signature}: ${store} leaves whole — ${reason}`);
+		for (const [store, reason] of Object.entries(behavior.unreadablePages ?? {})) lines.push(`  ${entry.identity}: ${store} leaves whole — ${reason}`);
 	}
 	if (lines.length === 0) return [];
 	return [
@@ -5446,7 +5770,7 @@ function unreadableInputWarnings(input) {
 	if (blind.length === 0) return [];
 	return [
 		`${blind.length} transaction(s) read the request without enumerating fields (\`all()\`, \`body()\`, \`except()\`), so their input DETs could not be counted and each sits at the floor of its band. This UNDERSTATES the total — the fix is a validator, not a configuration:`,
-		...blind.slice(0, 10).map(({ entry }) => `  ${entry.trigger} ${entry.signature}`),
+		...blind.slice(0, 10).map(({ entry }) => `  ${entry.identity}`),
 		...blind.length > 10 ? [`  … and ${blind.length - 10} more`] : []
 	];
 }
@@ -5467,7 +5791,7 @@ function unreadableOutputWarnings(input) {
 	if (blind.length === 0) return [];
 	return [
 		`${blind.length} transaction(s) pass through a transformer that spreads something the analysis cannot read, counted as 1 DET each — a FLOOR. This UNDERSTATES the output; the fix is in the transformer (\`this.pick(...)\` or named keys), not a configuration:`,
-		...blind.slice(0, 10).map(({ entry, behavior }) => `  ${entry.trigger} ${entry.signature}: ${behavior.opaqueOutputFields.join(", ")}`),
+		...blind.slice(0, 10).map(({ entry, behavior }) => `  ${entry.identity}: ${behavior.opaqueOutputFields.join(", ")}`),
 		...blind.length > 10 ? [`  … and ${blind.length - 10} more`] : []
 	];
 }
@@ -5692,9 +6016,32 @@ var CoverageTooLowError = class extends Error {
 		this.name = "CoverageTooLowError";
 	}
 };
+/**
+* One note per call site into a package, naming the transactions that reach it —
+* outside the boundary (§4): what a package does with its own tables is technical,
+* what it hands back is a value. Never in coverage (plan 0.11 §A).
+*/
+function packageCallNotes(entryPoints, behaviors, emit) {
+	const sites = /* @__PURE__ */ new Map();
+	for (const entry of entryPoints) {
+		const behavior = behaviors.get(entry.id);
+		for (const call of behavior?.packageCalls ?? []) {
+			const key = `${call.file}:${call.line}:${call.expression}`;
+			const site = sites.get(key) ?? {
+				specifier: call.specifier,
+				expression: call.expression,
+				where: call.line > 0 ? `${emit(call.file)}:${call.line}` : emit(call.file),
+				reached: []
+			};
+			if (!site.reached.includes(entry.identity)) site.reached.push(entry.identity);
+			sites.set(key, site);
+		}
+	}
+	return [...sites.values()].sort((a, b) => a.where.localeCompare(b.where)).map((site) => `${site.reached.join(", ")}: call into ${site.specifier} (${site.expression}) — outside the boundary; what a package does with its own tables is technical (§4), what it hands back is a value [${site.where}]`);
+}
 async function analyze(root, options = {}) {
 	const app = await discoverApp(root);
-	const { stores, unresolved: storeProblems } = await collectDataStores(app);
+	const { stores, unresolved: storeProblems, notes: storeNotes } = await collectDataStores(app);
 	const routes = await collectEntryPoints(app);
 	const routeProblems = routes.unresolved;
 	const entryPoints = [...routes.entryPoints, ...collectCommands(app)];
@@ -5824,6 +6171,10 @@ async function analyze(root, options = {}) {
 			transformedStores: behavior.transformedStores,
 			delivered: behavior.delivered,
 			pageReads: behavior.pageReads,
+			packageCalls: behavior.packageCalls.map((c) => ({
+				...c,
+				file: emit(c.file)
+			})),
 			unreadablePages: behavior.unreadablePages,
 			outputReads: behavior.outputReads,
 			trace: behavior.trace.map((step) => ({
@@ -5844,7 +6195,8 @@ async function analyze(root, options = {}) {
 		unresolved: unresolvedSites.map((site) => ({
 			...site,
 			file: emit(site.file)
-		}))
+		})),
+		notes: [...storeNotes, ...packageCallNotes(entryPoints, behaviors, emit)]
 	};
 	const minimum = options.minCoverage ?? 0;
 	if (inventory.coverage.ratio < minimum) throw new CoverageTooLowError(inventory.coverage.ratio, minimum);

package/build/{resolvers-CneCj3sT.js → resolvers-Bz1F-Tgf.js}

@@ -1368,4 +1368,4 @@ function ignoreCalls(options) {
 	};
 }
 //#endregion
-export { relativeTo as _, chainShapeOf as a, unwrap as c, collectEventBindings as d, detectAccess as f, isSeeder as g, isApplicationCode as h, resolveCall as i, DISPATCH_METHODS as l, rootSymbolOf as m, ignoreCalls as n, mappedLiteralOf as o, hooksFiredBy as p, isTechnicalWrite as r, outputFieldsIn as s, BUILTIN_CALL_RESOLVERS as t, EXECUTION_METHODS as u, samePath as v, toPosix as y };
+export { isSeeder as _, chainShapeOf as a, toPosix as b, transformerResourceOf as c, EXECUTION_METHODS as d, collectEventBindings as f, isApplicationCode as g, rootSymbolOf as h, resolveCall as i, unwrap as l, hooksFiredBy as m, ignoreCalls as n, mappedLiteralOf as o, detectAccess as p, isTechnicalWrite as r, outputFieldsIn as s, BUILTIN_CALL_RESOLVERS as t, DISPATCH_METHODS as u, relativeTo as v, samePath as y };

package/build/{runners-BuZNr-FE.js → runners-CzzlX7h-.js}

@@ -1,6 +1,6 @@
 import { c as IncomparableSourcesError, d as DEFAULTS, f as defineConfig, i as measureStructure, n as parseSamples, o as FACTOR_PRESETS, r as measureConformance, s as IncomparableRulesetsError, t as calibrate, u as diffCounts } from "./calibration-DVIf8hcE.js";
-import { y as toPosix } from "./resolvers-CneCj3sT.js";
-import { n as analyze } from "./pipeline-DqPrDZfD.js";
+import { b as toPosix } from "./resolvers-Bz1F-Tgf.js";
+import { n as analyze } from "./pipeline-CdDJRsLM.js";
 import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { existsSync } from "node:fs";
@@ -312,7 +312,8 @@ async function runInventory(options) {
 			`data stores:   ${inventory.dataStores.length}`,
 			`entry points:  ${coverage.entryPointsTotal}`,
 			`coverage:      ${(coverage.ratio * 100).toFixed(1)}% (${coverage.unresolvedCalls} unresolved calls)`,
-			...inventory.unresolved.map((site) => `  ${describeSite(site)}`)
+			...inventory.unresolved.map((site) => `  ${describeSite(site)}`),
+			...inventory.notes.length > 0 ? ["notes (declarations, not gaps):", ...inventory.notes.map((note) => `  ${note}`)] : []
 		].join("\n")
 	};
 }

package/build/src/albrecht/counter.d.ts

@@ -46,13 +46,14 @@ export declare const RULESET = "afp";
  * the guard's user, a service the container made — and a write nobody can type is
  * an unresolved call instead of silence. Two in 1.8.0: a method the model
  * declares names the store its caller writes, and a listener written inline on a
- * string event is followed like a listener class.
+ * string event is followed like a listener class. One in 1.9.0: the value of a
+ * transaction callback is what its returns name.
  *
  * Without the bump, a baseline saved by the previous version compares cleanly
  * against this one and bills the tool's own improvement as work done. The guard
  * exists for exactly that, and only this constant arms it.
  */
-export declare const RULESET_VERSION = "1.8.0";
+export declare const RULESET_VERSION = "1.9.0";
 export type CountInput = {
     app: AppContext;
     stores: CollectedDataStore[];

package/build/src/cli.js

@@ -1,5 +1,5 @@
-import { t as CoverageTooLowError } from "../pipeline-DqPrDZfD.js";
-import { a as runInventory, c as ConfigLoadError, i as runExplain, n as runCount, o as runMetrics, r as runDiff, s as printResult, t as runCalibrate } from "../runners-BuZNr-FE.js";
+import { t as CoverageTooLowError } from "../pipeline-CdDJRsLM.js";
+import { a as runInventory, c as ConfigLoadError, i as runExplain, n as runCount, o as runMetrics, r as runDiff, s as printResult, t as runCalibrate } from "../runners-CzzlX7h-.js";
 import path from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/build/src/inventory/graph/call_graph.d.ts

@@ -1,3 +1,4 @@
+import { Node } from 'ts-morph';
 import type { ClassDeclaration, SourceFile } from 'ts-morph';
 import type { AppContext } from '../app_context.js';
 import type { CollectedDataStore } from '../sources/data_stores.js';
@@ -104,6 +105,12 @@ export type Behavior = {
      */
     pageReads: Record<string, string[]>;
     unreadablePages: Record<string, string>;
+    /**
+     * Calls into a PACKAGE the walk met on the way — an injected package type, a
+     * package-typed column, a package factory's product, a member inherited from a
+     * package base. Outside the boundary (§4): noted, never a gap (plan 0.11 §A).
+     */
+    packageCalls: PackageCall[];
     trace: TraceStep[];
     /** bodies reached, for `fp:diff` */
     scope: ScopeEntry[];
@@ -157,6 +164,15 @@ export declare function analyzeHandler(app: AppContext, stores: CollectedDataSto
  * as any import. No type checker is needed.
  */
 export declare function injectedFor(owner: ClassDeclaration | undefined, file: SourceFile, app: AppContext): Map<string, string>;
+/** type identifier -> application file where it is declared */
+/** a call whose target resolves to a package: where, what, which package */
+export type PackageCall = {
+    file: string;
+    line: number;
+    expression: string;
+    specifier: string;
+};
+export declare function membersOfType(typeNode: Node, file: SourceFile, app: AppContext): Map<string, string>;
 /**
  * Both maps a file's imports produce: where a local name resolves, and what it
  * was called where it was exported.

package/build/src/inventory/graph/noise.d.ts

@@ -1,6 +1,9 @@
+import { Node } from 'ts-morph';
 import type { CallExpression, ClassDeclaration } from 'ts-morph';
 /** Is this call one that cannot reach a data store? */
-export declare function isNoise(call: CallExpression, owner?: ClassDeclaration): boolean;
+/** resolves a type annotation to its members (`name -> type text`), when the caller can */
+export type MembersOf = (typeNode: Node) => Map<string, string>;
+export declare function isNoise(call: CallExpression, owner?: ClassDeclaration, membersOf?: MembersOf): boolean;
 /**
  * Iteration over a list, checked BEFORE the resolvers run.
  *

package/build/src/inventory/resolvers/index.js

@@ -1,2 +1,2 @@
-import { i as resolveCall, n as ignoreCalls, r as isTechnicalWrite, t as BUILTIN_CALL_RESOLVERS } from "../../../resolvers-CneCj3sT.js";
+import { i as resolveCall, n as ignoreCalls, r as isTechnicalWrite, t as BUILTIN_CALL_RESOLVERS } from "../../../resolvers-Bz1F-Tgf.js";
 export { BUILTIN_CALL_RESOLVERS, ignoreCalls, isTechnicalWrite, resolveCall };

package/build/src/inventory/sources/data_stores.d.ts

@@ -27,5 +27,12 @@ export type DataStoreCollection = {
     stores: CollectedDataStore[];
     /** chains that left the application, required by AFP §6.5.3 */
     unresolved: UnresolvedCall[];
+    /**
+     * Facts about the declarations that are not gaps: a base class or a mixin that
+     * comes from a package. What it adds is technical (a hashed password, audit
+     * stamps, a soft-delete mark) and never a user-recognisable attribute (§7.2); the
+     * model's own columns and the schema decide. Listed, never counted in coverage.
+     */
+    notes: string[];
 };
 export declare function collectDataStores(app: AppContext): Promise<DataStoreCollection>;

package/build/src/pipeline.js

@@ -1,2 +1,2 @@
-import { n as analyze, t as CoverageTooLowError } from "../pipeline-DqPrDZfD.js";
+import { n as analyze, t as CoverageTooLowError } from "../pipeline-CdDJRsLM.js";
 export { CoverageTooLowError, analyze };

package/build/src/types.d.ts

@@ -148,6 +148,13 @@ export type HandlerBehavior = {
     pageReads?: Record<string, string[]>;
     /** stores a page could not be read for, and why: they leave whole */
     unreadablePages?: Record<string, string>;
+    /** calls into a package met on the way: outside the boundary, noted, never a gap (plan 0.11 §A) */
+    packageCalls?: {
+        file: string;
+        line: number;
+        expression: string;
+        specifier: string;
+    }[];
     /**
      * How each store was read: rows whole, `.select()` columns, or one aggregate
      * scalar; by its own chain (`direct`) or preloaded through another store (`via`).
@@ -222,6 +229,11 @@ export type Inventory = {
      * on. One entry per site — a body five routes reach is one gap, not five.
      */
     unresolved: UnresolvedSite[];
+    /**
+     * Facts about the declarations that are not gaps — a base class or a mixin from a
+     * package, whose additions are technical. Listed for the reader; never in coverage.
+     */
+    notes: string[];
 };
 export type FunctionType = 'ILF' | 'EIF' | 'EI' | 'EO' | 'EQ';
 export type Complexity = 'low' | 'average' | 'high';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@filipebraida/adonis-function-points",
   "description": "Automated function point counting and code metrics for AdonisJS applications.",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "engines": {
     "node": ">=24.0.0"
   },