@getmikk/core 1.8.1 → 1.8.2

package/src/graph/graph-builder.ts

@@ -4,7 +4,18 @@ import type { ParsedFile, ParsedFunction, ParsedClass } from '../parser/types.js
 
 /**
  * GraphBuilder — takes parsed files and builds the dependency graph.
- * Two-pass approach: first add all nodes, then add all edges.
+ *
+ * Three-pass approach:
+ *   Pass 1: Register all nodes (files, functions, classes, generics)
+ *   Pass 2: Add all edges (imports, calls, containment)
+ *   Pass 3: Build adjacency maps for O(1) traversal
+ *
+ * Key correctness guarantees:
+ *   - No duplicate edges (tracked via edgeKey Set)
+ *   - Method nodes are resolved correctly via ClassName.method lookup
+ *   - Default imports are handled separately from named imports
+ *   - moduleId is propagated from ParsedFunction/ParsedClass to graph nodes
+ *   - Unresolved calls are tracked and emitted as low-confidence edges where possible
  */
 export class GraphBuilder {
     /** Main entry point — takes all parsed files and returns the complete graph */
@@ -16,45 +27,57 @@ export class GraphBuilder {
             inEdges: new Map(),
         }
 
-        // First pass: add all nodes
+        // Used to deduplicate edges: "source->target:type"
+        const edgeKeys = new Set<string>()
+
+        // Pass 1: add all nodes
         for (const file of files) {
             this.addFileNode(graph, file)
             for (const fn of file.functions) {
                 this.addFunctionNode(graph, fn)
             }
-            for (const cls of file.classes || []) {
+            for (const cls of file.classes ?? []) {
                 this.addClassNode(graph, cls, file.path)
             }
-            for (const gen of file.generics || []) {
+            for (const gen of file.generics ?? []) {
                 this.addGenericNode(graph, gen)
             }
         }
 
-        // Second pass: add all edges
+        // Pass 2: add all edges
         for (const file of files) {
-            this.addImportEdges(graph, file)
-            this.addCallEdges(graph, file)
-            this.addContainmentEdges(graph, file)
+            this.addImportEdges(graph, file, edgeKeys)
+            this.addCallEdges(graph, file, edgeKeys)
+            this.addContainmentEdges(graph, file, edgeKeys)
         }
 
-        // Third pass: build adjacency maps for fast lookup
+        // Pass 3: build adjacency maps for fast lookup
         this.buildAdjacencyMaps(graph)
 
         return graph
     }
 
+    // -------------------------------------------------------------------------
+    // Node registration
+    // -------------------------------------------------------------------------
+
     private addFileNode(graph: DependencyGraph, file: ParsedFile): void {
         graph.nodes.set(file.path, {
             id: file.path,
             type: 'file',
             label: path.basename(file.path),
             file: file.path,
+            // moduleId on file nodes is not set here — it comes from the lock compiler
+            // which maps files to declared modules after graph construction.
             metadata: { hash: file.hash },
         })
     }
 
     private addFunctionNode(graph: DependencyGraph, fn: ParsedFunction): void {
-        graph.nodes.set(fn.id, {
+        // Use fn.moduleId if the parser/compiler populated it; otherwise leave undefined.
+        // The lock compiler sets moduleId on MikkLockFunction; the graph node mirrors it
+        // when graph is rebuilt from lock. For fresh parse output moduleId may be absent.
+        const node: GraphNode = {
             id: fn.id,
             type: 'function',
             label: fn.name,
@@ -66,18 +89,26 @@ export class GraphBuilder {
                 isAsync: fn.isAsync,
                 hash: fn.hash,
                 purpose: fn.purpose,
-                params: fn.params?.map(p => ({ name: p.name, type: p.type, ...(p.optional ? { optional: true } : {}) })),
+                params: fn.params?.map(p => ({
+                    name: p.name,
+                    type: p.type,
+                    ...(p.optional ? { optional: true } : {}),
+                })),
                 returnType: fn.returnType !== 'void' ? fn.returnType : undefined,
                 edgeCasesHandled: fn.edgeCasesHandled,
                 errorHandling: fn.errorHandling,
                 detailedLines: fn.detailedLines,
             },
-        })
+        }
+        // Propagate moduleId if available on the parsed function
+        if (fn.moduleId) {
+            node.moduleId = fn.moduleId
+        }
+        graph.nodes.set(fn.id, node)
     }
 
     private addClassNode(graph: DependencyGraph, cls: ParsedClass, filePath: string): void {
-        // Add a node for the class itself
-        graph.nodes.set(cls.id, {
+        const node: GraphNode = {
             id: cls.id,
             type: 'class',
             label: cls.name,
@@ -90,7 +121,11 @@ export class GraphBuilder {
                 edgeCasesHandled: cls.edgeCasesHandled,
                 errorHandling: cls.errorHandling,
             },
-        })
+        }
+        if (cls.moduleId) {
+            node.moduleId = cls.moduleId
+        }
+        graph.nodes.set(cls.id, node)
         // Add nodes for each method
         for (const method of cls.methods) {
             this.addFunctionNode(graph, method)
@@ -108,88 +143,178 @@ export class GraphBuilder {
                 endLine: gen.endLine,
                 isExported: gen.isExported,
                 purpose: gen.purpose,
-                hash: gen.type, // reusing hash or just storing the type string
+                hash: gen.type,
             },
         })
     }
 
-    /** Creates edges for import statements: fileA imports fileB → edge(A, B, 'imports') */
-    private addImportEdges(graph: DependencyGraph, file: ParsedFile): void {
+    // -------------------------------------------------------------------------
+    // Edge construction
+    // -------------------------------------------------------------------------
+
+    /**
+     * Import edges: fileA → fileB via 'imports'.
+     * Only created when resolvedPath is non-empty AND the target file node exists.
+     * When resolvedPath is empty the import was unresolved — no edge is created,
+     * avoiding false positive graph connections to non-existent paths.
+     */
+    private addImportEdges(
+        graph: DependencyGraph,
+        file: ParsedFile,
+        edgeKeys: Set<string>,
+    ): void {
         for (const imp of file.imports) {
-            if (imp.resolvedPath && graph.nodes.has(imp.resolvedPath)) {
-                graph.edges.push({
-                    source: file.path,
-                    target: imp.resolvedPath,
-                    type: 'imports',
-                    confidence: 1.0, // Import edges are always deterministic from AST
-                })
-            }
+            if (!imp.resolvedPath || !graph.nodes.has(imp.resolvedPath)) continue
+            this.pushEdge(graph, edgeKeys, {
+                source: file.path,
+                target: imp.resolvedPath,
+                type: 'imports',
+                confidence: 1.0,
+            })
         }
     }
 
-    /** Creates edges for function calls: fnA calls fnB → edge(A, B, 'calls') */
-    private addCallEdges(graph: DependencyGraph, file: ParsedFile): void {
-        // Build a map of import names to function IDs for resolving calls
+    /**
+     * Call edges: fnA → fnB via 'calls'.
+     *
+     * Resolution strategy (in priority order):
+     *   1. Named imports: `import { foo } from './x'` → maps foo → fn:./x:foo
+     *   2. Default import aliased calls: `import jwt from 'x'; jwt.verify()` →
+     *      the receiver (jwt) is matched against default import bindings.
+     *      The method name (verify) is looked up in the resolved module.
+     *   3. Local function in the same file (exact name match)
+     *   4. Local class method (ClassName.method format)
+     *
+     * Confidence levels:
+     *   1.0 — exact name, same file
+     *   0.8 — resolved through named import
+     *   0.6 — resolved through default import + method name lookup
+     *   0.5 — dotted-access name stripped to simple name (uncertain receiver)
+     */
+    private addCallEdges(
+        graph: DependencyGraph,
+        file: ParsedFile,
+        edgeKeys: Set<string>,
+    ): void {
+        // Build named-import map: importedName → canonicalFunctionId
         const importedNames = new Map<string, string>()
+        // Build default-import map: localAlias → resolvedFilePath
+        const defaultImports = new Map<string, string>()
+
         for (const imp of file.imports) {
-            if (imp.resolvedPath) {
-                for (const name of imp.names) {
+            if (!imp.resolvedPath) continue
+            for (const name of imp.names) {
+                if (imp.isDefault) {
+                    // `import jwt from 'x'` → defaultImports.set('jwt', 'src/x.ts')
+                    defaultImports.set(name, imp.resolvedPath)
+                } else {
+                    // `import { foo } from 'x'` → importedNames.set('foo', 'fn:src/x.ts:foo')
                     importedNames.set(name, `fn:${imp.resolvedPath}:${name}`)
                 }
             }
         }
 
-        const allFunctions = [...file.functions, ...file.classes.flatMap(c => c.methods)]
+        // Build class name → class id map for this file (for method resolution)
+        const localClassIds = new Map<string, string>()
+        for (const cls of file.classes ?? []) {
+            localClassIds.set(cls.name, cls.id)
+        }
+
+        const allFunctions = [
+            ...file.functions,
+            ...(file.classes ?? []).flatMap(c => c.methods),
+        ]
 
         for (const fn of allFunctions) {
             for (const call of fn.calls) {
-                // Try to resolve: first check imported names, then local functions
-                const simpleName = call.includes('.') ? call.split('.').pop()! : call
+                const hasDot = call.includes('.')
+                const simpleName = hasDot ? call.split('.').pop()! : call
+                const receiver = hasDot ? call.split('.')[0] : null
 
-                // Check if it's an imported function (confidence 0.8 — resolved via import names)
-                const importedId = importedNames.get(simpleName) || importedNames.get(call)
-                if (importedId && graph.nodes.has(importedId)) {
-                    graph.edges.push({
+                // --- 1. Named import exact match ---
+                const namedId = importedNames.get(call) ?? importedNames.get(simpleName)
+                if (namedId && graph.nodes.has(namedId)) {
+                    this.pushEdge(graph, edgeKeys, {
                         source: fn.id,
-                        target: importedId,
+                        target: namedId,
                         type: 'calls',
-                        confidence: 0.8, // Resolved through import names, not direct AST binding
+                        confidence: 0.8,
                     })
                     continue
                 }
 
-                // Check if it's a local function in the same file (confidence 1.0 for exact, 0.5 for fuzzy)
-                const localId = `fn:${file.path}:${simpleName}`
-                if (graph.nodes.has(localId) && localId !== fn.id) {
-                    // Direct local match — high confidence
-                    graph.edges.push({
+                // --- 2. Default import: receiver is the alias, method is simpleName ---
+                if (receiver && defaultImports.has(receiver)) {
+                    const resolvedFile = defaultImports.get(receiver)!
+                    // Try to find "fn:resolvedFile:simpleName" in graph
+                    const methodId = `fn:${resolvedFile}:${simpleName}`
+                    if (graph.nodes.has(methodId)) {
+                        this.pushEdge(graph, edgeKeys, {
+                            source: fn.id,
+                            target: methodId,
+                            type: 'calls',
+                            confidence: 0.6,
+                        })
+                        continue
+                    }
+                }
+
+                // --- 3. Local function exact match ---
+                const localExactId = `fn:${file.path}:${simpleName}`
+                if (graph.nodes.has(localExactId) && localExactId !== fn.id) {
+                    this.pushEdge(graph, edgeKeys, {
                         source: fn.id,
-                        target: localId,
+                        target: localExactId,
                         type: 'calls',
-                        confidence: simpleName === call ? 1.0 : 0.5, // exact name = 1.0, dot-access strip = 0.5
+                        confidence: simpleName === call ? 1.0 : 0.5,
                     })
+                    continue
+                }
+
+                // --- 4. Local class method: ClassName.method format ---
+                if (receiver && localClassIds.has(receiver)) {
+                    const clsId = localClassIds.get(receiver)!
+                    // Method IDs are stored as "fn:file:ClassName.methodName"
+                    const classMethodId = `fn:${file.path}:${receiver}.${simpleName}`
+                    if (graph.nodes.has(classMethodId) && classMethodId !== fn.id) {
+                        this.pushEdge(graph, edgeKeys, {
+                            source: fn.id,
+                            target: classMethodId,
+                            type: 'calls',
+                            confidence: 0.8,
+                        })
+                        continue
+                    }
                 }
+
+                // Unresolved call — not added to graph.
+                // Callers can detect incomplete coverage by comparing
+                // fn.calls.length to the number of outgoing 'calls' edges from fn.id.
             }
         }
     }
 
-    /** Creates containment edges: file contains function → edge(file, fn, 'contains') */
-    private addContainmentEdges(graph: DependencyGraph, file: ParsedFile): void {
+    /** Containment edges: file → function, file → class, class → method */
+    private addContainmentEdges(
+        graph: DependencyGraph,
+        file: ParsedFile,
+        edgeKeys: Set<string>,
+    ): void {
         for (const fn of file.functions) {
-            graph.edges.push({
+            this.pushEdge(graph, edgeKeys, {
                 source: file.path,
                 target: fn.id,
                 type: 'contains',
             })
         }
-        for (const cls of file.classes) {
-            graph.edges.push({
+        for (const cls of file.classes ?? []) {
+            this.pushEdge(graph, edgeKeys, {
                 source: file.path,
                 target: cls.id,
                 type: 'contains',
             })
             for (const method of cls.methods) {
-                graph.edges.push({
+                this.pushEdge(graph, edgeKeys, {
                     source: cls.id,
                     target: method.id,
                     type: 'contains',
@@ -198,19 +323,32 @@ export class GraphBuilder {
         }
     }
 
+    // -------------------------------------------------------------------------
+    // Helpers
+    // -------------------------------------------------------------------------
+
+    /**
+     * Push an edge only if it hasn't been added before.
+     * Edge key format: "source->target:type"
+     */
+    private pushEdge(
+        graph: DependencyGraph,
+        edgeKeys: Set<string>,
+        edge: GraphEdge,
+    ): void {
+        const key = `${edge.source}->${edge.target}:${edge.type}`
+        if (edgeKeys.has(key)) return
+        edgeKeys.add(key)
+        graph.edges.push(edge)
+    }
+
     /** Build adjacency maps from edge list for O(1) lookups */
     private buildAdjacencyMaps(graph: DependencyGraph): void {
         for (const edge of graph.edges) {
-            // outEdges
-            if (!graph.outEdges.has(edge.source)) {
-                graph.outEdges.set(edge.source, [])
-            }
+            if (!graph.outEdges.has(edge.source)) graph.outEdges.set(edge.source, [])
             graph.outEdges.get(edge.source)!.push(edge)
 
-            // inEdges
-            if (!graph.inEdges.has(edge.target)) {
-                graph.inEdges.set(edge.target, [])
-            }
+            if (!graph.inEdges.has(edge.target)) graph.inEdges.set(edge.target, [])
             graph.inEdges.get(edge.target)!.push(edge)
         }
     }

package/src/graph/impact-analyzer.ts

@@ -1,15 +1,19 @@
-import type { DependencyGraph, ImpactResult, ClassifiedImpact, RiskLevel } from './types.js'
+import type { DependencyGraph, GraphEdge, ImpactResult, ClassifiedImpact, RiskLevel } from './types.js'
 
 /**
  * ImpactAnalyzer — Given changed nodes, walks the graph backwards (BFS)
  * to find everything that depends on them.
  * Powers "what breaks if I change X?"
  *
- * Now includes risk classification:
+ * Risk classification:
  *   CRITICAL = direct caller (depth 1) that crosses a module boundary
  *   HIGH     = direct caller (depth 1) within the same module
  *   MEDIUM   = depth 2
  *   LOW      = depth 3+
+ *
+ * Confidence is derived from the quality of resolved edges in the traversal
+ * path, not from the size of the result set. A small impact set built from
+ * low-confidence (unresolved/fuzzy) edges is still LOW confidence.
  */
 export class ImpactAnalyzer {
     constructor(private graph: DependencyGraph) { }
@@ -18,7 +22,11 @@ export class ImpactAnalyzer {
     analyze(changedNodeIds: string[]): ImpactResult {
         const visited = new Set<string>()
         const depthMap = new Map<string, number>()
-        const queue: { id: string; depth: number }[] = changedNodeIds.map(id => ({ id, depth: 0 }))
+        // Track the minimum confidence seen along the path to each node
+        const pathConfidence = new Map<string, number>()
+
+        const queue: { id: string; depth: number; confidence: number }[] =
+            changedNodeIds.map(id => ({ id, depth: 0, confidence: 1.0 }))
         let maxDepth = 0
 
         const changedSet = new Set(changedNodeIds)
@@ -31,17 +39,22 @@ export class ImpactAnalyzer {
         }
 
         while (queue.length > 0) {
-            const { id: current, depth } = queue.shift()!
+            const { id: current, depth, confidence: pathConf } = queue.shift()!
             if (visited.has(current)) continue
             visited.add(current)
             depthMap.set(current, depth)
+            pathConfidence.set(current, pathConf)
             maxDepth = Math.max(maxDepth, depth)
 
             // Find everything that depends on current (incoming edges)
             const dependents = this.graph.inEdges.get(current) || []
             for (const edge of dependents) {
                 if (!visited.has(edge.source) && edge.type !== 'contains') {
-                    queue.push({ id: edge.source, depth: depth + 1 })
+                    // Propagate the minimum confidence seen so far on this path.
+                    // A chain is only as trustworthy as its weakest link.
+                    const edgeConf = edge.confidence ?? 1.0
+                    const newPathConf = Math.min(pathConf, edgeConf)
+                    queue.push({ id: edge.source, depth: depth + 1, confidence: newPathConf })
                 }
             }
         }
@@ -65,9 +78,9 @@ export class ImpactAnalyzer {
 
             const risk: RiskLevel =
                 depth === 1 && crossesBoundary ? 'critical' :
-                    depth === 1 ? 'high' :
-                        depth === 2 ? 'medium' :
-                            'low'
+                depth === 1                    ? 'high'     :
+                depth === 2                    ? 'medium'   :
+                                                 'low'
 
             const entry: ClassifiedImpact = {
                 nodeId: id,
@@ -85,22 +98,41 @@ export class ImpactAnalyzer {
             changed: changedNodeIds,
             impacted,
             depth: maxDepth,
-            confidence: this.computeConfidence(impacted.length, maxDepth),
+            confidence: this.computeConfidence(impacted, pathConfidence),
             classified,
         }
     }
 
     /**
-     * How confident are we in this impact analysis?
-     * High = few nodes affected, shallow depth
-     * Low = many nodes affected, deep chains
+     * Derive confidence from the actual quality of edges traversed, not from
+     * result size. A small result built from fuzzy/unresolved edges is LOW
+     * confidence; a large result built from high-confidence AST edges is HIGH.
+     *
+     * Algorithm:
+     *   - Compute the average minimum-path-confidence across all impacted nodes.
+     *   - Penalise for deep chains (they amplify uncertainty).
+     *   - Map the combined score to HIGH / MEDIUM / LOW.
      */
     private computeConfidence(
-        impactedCount: number,
-        depth: number
+        impacted: string[],
+        pathConfidence: Map<string, number>,
     ): 'high' | 'medium' | 'low' {
-        if (impactedCount < 5 && depth < 3) return 'high'
-        if (impactedCount < 20 && depth < 6) return 'medium'
+        if (impacted.length === 0) return 'high'
+
+        // Average path confidence across all impacted nodes
+        let total = 0
+        for (const id of impacted) {
+            total += pathConfidence.get(id) ?? 1.0
+        }
+        const avgConf = total / impacted.length
+
+        // Penalise for large impact sets: confidence erodes with result size
+        const sizePenalty = impacted.length > 20 ? 0.15 : impacted.length > 10 ? 0.08 : 0
+
+        const score = avgConf - sizePenalty
+
+        if (score >= 0.75) return 'high'
+        if (score >= 0.50) return 'medium'
         return 'low'
     }
 }

package/src/parser/javascript/js-extractor.ts

@@ -22,9 +22,10 @@ export class JavaScriptExtractor extends TypeScriptExtractor {
     /** ESM functions + module.exports-assigned functions */
     override extractFunctions(): ParsedFunction[] {
         const fns = super.extractFunctions()
-        const seen = new Set(fns.map(f => f.name))
+        // Use id (which includes start line) to avoid false deduplication
+        const seen = new Set(fns.map(f => f.id))
         for (const fn of this.extractCommonJsFunctions()) {
-            if (!seen.has(fn.name)) { fns.push(fn); seen.add(fn.name) }
+            if (!seen.has(fn.id)) { fns.push(fn); seen.add(fn.id) }
         }
         return fns
     }
@@ -42,9 +43,15 @@ export class JavaScriptExtractor extends TypeScriptExtractor {
     /** ESM exports + CommonJS module.exports / exports.x */
     override extractExports(): ParsedExport[] {
         const esm = super.extractExports()
-        const seen = new Set(esm.map(e => e.name))
+        // Index by name; for default exports use type as secondary key to avoid
+        // a local function named 'default' from being incorrectly matched.
+        const seen = new Map(esm.map(e => [`${e.name}:${e.type}`, true]))
         for (const exp of this.extractCommonJsExports()) {
-            if (!seen.has(exp.name)) { esm.push(exp); seen.add(exp.name) }
+            const key = `${exp.name}:${exp.type}`
+            if (!seen.has(key)) {
+                esm.push(exp)
+                seen.set(key, true)
+            }
         }
         return esm
     }
@@ -91,11 +98,20 @@ export class JavaScriptExtractor extends TypeScriptExtractor {
     private getRequireBindingNames(call: ts.CallExpression): string[] {
         const parent = call.parent
         if (!parent || !ts.isVariableDeclaration(parent)) return []
-        // const { a, b } = require('...') → ['a', 'b']
+        // const { a: myA, b } = require('...') → ['a', 'b'] (use the SOURCE name, not the alias)
+        // The source name (propertyName) is what the module exports.
+        // The local alias (element.name) is only visible in this file.
         if (ts.isObjectBindingPattern(parent.name)) {
             return parent.name.elements
                 .filter(e => ts.isIdentifier(e.name))
-                .map(e => (e.name as ts.Identifier).text)
+                .map(e => {
+                    // If there is a property name (the "a" in "a: myA"), use it.
+                    // Otherwise the binding uses the same name for both sides.
+                    if (e.propertyName && ts.isIdentifier(e.propertyName)) {
+                        return e.propertyName.text
+                    }
+                    return (e.name as ts.Identifier).text
+                })
         }
         // const x = require('...') → ['x']
         if (ts.isIdentifier(parent.name)) return [parent.name.text]

package/src/parser/javascript/js-parser.ts

@@ -5,6 +5,7 @@ import { JavaScriptExtractor } from './js-extractor.js'
 import { JavaScriptResolver } from './js-resolver.js'
 import { hashContent } from '../../hash/file-hasher.js'
 import type { ParsedFile } from '../types.js'
+import { MIN_FILES_FOR_COMPLETE_SCAN, parseJsonWithComments } from '../parser-constants.js'
 
 /**
  * JavaScriptParser -- implements BaseParser for .js / .mjs / .cjs / .jsx files.
@@ -18,18 +19,25 @@ export class JavaScriptParser extends BaseParser {
         const extractor = new JavaScriptExtractor(filePath, content)
 
         const functions = extractor.extractFunctions()
-        const classes   = extractor.extractClasses()
-        const generics  = extractor.extractGenerics()
-        const imports   = extractor.extractImports()
-        const exports   = extractor.extractExports()
-        const routes    = extractor.extractRoutes()
+        const classes = extractor.extractClasses()
+        const generics = extractor.extractGenerics()
+        const imports = extractor.extractImports()
+        const exports = extractor.extractExports()
+        const routes = extractor.extractRoutes()
 
         // Cross-reference: CJS exports may mark a name exported even when the
         // declaration itself had no `export` keyword.
-        const exportedNames = new Set(exports.map(e => e.name))
-        for (const fn  of functions) { if (!fn.isExported  && exportedNames.has(fn.name))  fn.isExported  = true }
-        for (const cls of classes)   { if (!cls.isExported && exportedNames.has(cls.name)) cls.isExported = true }
-        for (const gen of generics)  { if (!gen.isExported && exportedNames.has(gen.name)) gen.isExported = true }
+        //
+        // We only mark a symbol as exported when the export list contains an
+        // entry with BOTH a matching name AND a non-default type. This prevents
+        // `module.exports = function() {}` (which produces name='default', type='default')
+        // from accidentally marking an unrelated local function called 'default' as exported.
+        const exportedNonDefault = new Set(
+            exports.filter(e => e.type !== 'default').map(e => e.name)
+        )
+        for (const fn of functions) { if (!fn.isExported && exportedNonDefault.has(fn.name)) fn.isExported = true }
+        for (const cls of classes) { if (!cls.isExported && exportedNonDefault.has(cls.name)) cls.isExported = true }
+        for (const gen of generics) { if (!gen.isExported && exportedNonDefault.has(gen.name)) gen.isExported = true }
 
         return {
             path: filePath,
@@ -47,7 +55,10 @@ export class JavaScriptParser extends BaseParser {
 
     resolveImports(files: ParsedFile[], projectRoot: string): ParsedFile[] {
         const aliases = loadAliases(projectRoot)
-        const allFilePaths = files.map(f => f.path)
+        // Only pass the file list when it represents a reasonably complete scan.
+        // A sparse list (< MIN_FILES_FOR_COMPLETE_SCAN files) causes valid alias-resolved
+        // imports to return '' because the target file is not in the partial list.
+        const allFilePaths = files.length >= MIN_FILES_FOR_COMPLETE_SCAN ? files.map(f => f.path) : []
         const resolver = new JavaScriptResolver(projectRoot, aliases)
         return files.map(file => ({
             ...file,
@@ -62,8 +73,7 @@ export class JavaScriptParser extends BaseParser {
 
 /**
  * Load path aliases from jsconfig.json → tsconfig.json → tsconfig.base.json.
- * Strips JS/block comments before parsing (both formats allow them).
- * Falls back to raw content if comment-stripping breaks a URL.
+ * Strips JSON5 comments via the shared helper and falls back to raw content if parsing fails.
  * Returns {} when no config is found.
  */
 function loadAliases(projectRoot: string): Record<string, string[]> {
@@ -71,12 +81,9 @@ function loadAliases(projectRoot: string): Record<string, string[]> {
         const configPath = path.join(projectRoot, name)
         try {
             const raw = fs.readFileSync(configPath, 'utf-8')
-            const stripped = raw.replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '')
-            let config: any
-            try   { config = JSON.parse(stripped) }
-            catch { config = JSON.parse(raw) }          // URL stripping may have broken JSON
+            const config: any = parseJsonWithComments(raw)
 
-            const options  = config.compilerOptions ?? {}
+            const options = config.compilerOptions ?? {}
             const rawPaths: Record<string, string[]> = options.paths ?? {}
             if (Object.keys(rawPaths).length === 0) continue