@getmikk/core 1.8.1 → 1.8.3

package/src/graph/graph-builder.ts

@@ -4,7 +4,18 @@ import type { ParsedFile, ParsedFunction, ParsedClass } from '../parser/types.js
 
 /**
  * GraphBuilder — takes parsed files and builds the dependency graph.
- * Two-pass approach: first add all nodes, then add all edges.
+ *
+ * Three-pass approach:
+ *   Pass 1: Register all nodes (files, functions, classes, generics)
+ *   Pass 2: Add all edges (imports, calls, containment)
+ *   Pass 3: Build adjacency maps for O(1) traversal
+ *
+ * Key correctness guarantees:
+ *   - No duplicate edges (tracked via edgeKey Set)
+ *   - Method nodes are resolved correctly via ClassName.method lookup
+ *   - Default imports are handled separately from named imports
+ *   - moduleId is propagated from ParsedFunction/ParsedClass to graph nodes
+ *   - Unresolved calls are tracked and emitted as low-confidence edges where possible
  */
 export class GraphBuilder {
     /** Main entry point — takes all parsed files and returns the complete graph */
@@ -16,45 +27,57 @@ export class GraphBuilder {
             inEdges: new Map(),
         }
 
-        // First pass: add all nodes
+        // Used to deduplicate edges: "source->target:type"
+        const edgeKeys = new Set<string>()
+
+        // Pass 1: add all nodes
         for (const file of files) {
             this.addFileNode(graph, file)
             for (const fn of file.functions) {
                 this.addFunctionNode(graph, fn)
             }
-            for (const cls of file.classes || []) {
+            for (const cls of file.classes ?? []) {
                 this.addClassNode(graph, cls, file.path)
             }
-            for (const gen of file.generics || []) {
+            for (const gen of file.generics ?? []) {
                 this.addGenericNode(graph, gen)
             }
         }
 
-        // Second pass: add all edges
+        // Pass 2: add all edges
         for (const file of files) {
-            this.addImportEdges(graph, file)
-            this.addCallEdges(graph, file)
-            this.addContainmentEdges(graph, file)
+            this.addImportEdges(graph, file, edgeKeys)
+            this.addCallEdges(graph, file, edgeKeys)
+            this.addContainmentEdges(graph, file, edgeKeys)
         }
 
-        // Third pass: build adjacency maps for fast lookup
+        // Pass 3: build adjacency maps for fast lookup
         this.buildAdjacencyMaps(graph)
 
         return graph
     }
 
+    // -------------------------------------------------------------------------
+    // Node registration
+    // -------------------------------------------------------------------------
+
     private addFileNode(graph: DependencyGraph, file: ParsedFile): void {
         graph.nodes.set(file.path, {
             id: file.path,
             type: 'file',
             label: path.basename(file.path),
             file: file.path,
+            // moduleId on file nodes is not set here — it comes from the lock compiler
+            // which maps files to declared modules after graph construction.
             metadata: { hash: file.hash },
         })
     }
 
     private addFunctionNode(graph: DependencyGraph, fn: ParsedFunction): void {
-        graph.nodes.set(fn.id, {
+        // Use fn.moduleId if the parser/compiler populated it; otherwise leave undefined.
+        // The lock compiler sets moduleId on MikkLockFunction; the graph node mirrors it
+        // when graph is rebuilt from lock. For fresh parse output moduleId may be absent.
+        const node: GraphNode = {
             id: fn.id,
             type: 'function',
             label: fn.name,
@@ -66,18 +89,26 @@ export class GraphBuilder {
                 isAsync: fn.isAsync,
                 hash: fn.hash,
                 purpose: fn.purpose,
-                params: fn.params?.map(p => ({ name: p.name, type: p.type, ...(p.optional ? { optional: true } : {}) })),
+                params: fn.params?.map(p => ({
+                    name: p.name,
+                    type: p.type,
+                    ...(p.optional ? { optional: true } : {}),
+                })),
                 returnType: fn.returnType !== 'void' ? fn.returnType : undefined,
                 edgeCasesHandled: fn.edgeCasesHandled,
                 errorHandling: fn.errorHandling,
                 detailedLines: fn.detailedLines,
             },
-        })
+        }
+        // Propagate moduleId if available on the parsed function
+        if (fn.moduleId) {
+            node.moduleId = fn.moduleId
+        }
+        graph.nodes.set(fn.id, node)
     }
 
     private addClassNode(graph: DependencyGraph, cls: ParsedClass, filePath: string): void {
-        // Add a node for the class itself
-        graph.nodes.set(cls.id, {
+        const node: GraphNode = {
             id: cls.id,
             type: 'class',
             label: cls.name,
@@ -90,7 +121,11 @@ export class GraphBuilder {
                 edgeCasesHandled: cls.edgeCasesHandled,
                 errorHandling: cls.errorHandling,
             },
-        })
+        }
+        if (cls.moduleId) {
+            node.moduleId = cls.moduleId
+        }
+        graph.nodes.set(cls.id, node)
         // Add nodes for each method
         for (const method of cls.methods) {
             this.addFunctionNode(graph, method)
@@ -108,109 +143,229 @@ export class GraphBuilder {
                 endLine: gen.endLine,
                 isExported: gen.isExported,
                 purpose: gen.purpose,
-                hash: gen.type, // reusing hash or just storing the type string
+                // Store the declaration kind (interface|type|const) separately from the
+                // content hash.  gen.hash is the actual content hash; gen.type is the
+                // declaration kind string — they are different things and must not be mixed.
+                hash: gen.hash ?? undefined,
+                genericKind: gen.type,
             },
         })
     }
 
-    /** Creates edges for import statements: fileA imports fileB → edge(A, B, 'imports') */
-    private addImportEdges(graph: DependencyGraph, file: ParsedFile): void {
+    // -------------------------------------------------------------------------
+    // Edge construction
+    // -------------------------------------------------------------------------
+
+    /**
+     * Import edges: fileA → fileB via 'imports'.
+     * Only created when resolvedPath is non-empty AND the target file node exists.
+     * When resolvedPath is empty the import was unresolved — no edge is created,
+     * avoiding false positive graph connections to non-existent paths.
+     */
+    private addImportEdges(
+        graph: DependencyGraph,
+        file: ParsedFile,
+        edgeKeys: Set<string>,
+    ): void {
         for (const imp of file.imports) {
-            if (imp.resolvedPath && graph.nodes.has(imp.resolvedPath)) {
-                graph.edges.push({
-                    source: file.path,
-                    target: imp.resolvedPath,
-                    type: 'imports',
-                    confidence: 1.0, // Import edges are always deterministic from AST
-                })
-            }
+            if (!imp.resolvedPath || !graph.nodes.has(imp.resolvedPath)) continue
+            this.pushEdge(graph, edgeKeys, {
+                source: file.path,
+                target: imp.resolvedPath,
+                type: 'imports',
+                confidence: 1.0,
+            })
         }
     }
 
-    /** Creates edges for function calls: fnA calls fnB → edge(A, B, 'calls') */
-    private addCallEdges(graph: DependencyGraph, file: ParsedFile): void {
-        // Build a map of import names to function IDs for resolving calls
+    /**
+     * Call edges: fnA → fnB via 'calls'.
+     *
+     * Resolution strategy (in priority order):
+     *   1. Named imports: `import { foo } from './x'` → maps foo → fn:./x:foo
+     *   2. Default import aliased calls: `import jwt from 'x'; jwt.verify()` →
+     *      the receiver (jwt) is matched against default import bindings.
+     *      The method name (verify) is looked up in the resolved module.
+     *   3. Local function in the same file (exact name match)
+     *   4. Local class method (ClassName.method format)
+     *
+     * Confidence levels:
+     *   1.0 — exact name, same file
+     *   0.8 — resolved through named import
+     *   0.6 — resolved through default import + method name lookup
+     *   0.5 — dotted-access name stripped to simple name (uncertain receiver)
+     */
+    private addCallEdges(
+        graph: DependencyGraph,
+        file: ParsedFile,
+        edgeKeys: Set<string>,
+    ): void {
+        // Build named-import map: importedName → canonicalFunctionId
         const importedNames = new Map<string, string>()
+        // Build default-import map: localAlias → resolvedFilePath
+        const defaultImports = new Map<string, string>()
+
         for (const imp of file.imports) {
-            if (imp.resolvedPath) {
-                for (const name of imp.names) {
+            if (!imp.resolvedPath) continue
+            for (const name of imp.names) {
+                if (imp.isDefault) {
+                    // `import jwt from 'x'` → defaultImports.set('jwt', 'src/x.ts')
+                    defaultImports.set(name, imp.resolvedPath)
+                } else {
+                    // `import { foo } from 'x'` → importedNames.set('foo', 'fn:src/x.ts:foo')
                     importedNames.set(name, `fn:${imp.resolvedPath}:${name}`)
                 }
             }
         }
 
-        const allFunctions = [...file.functions, ...file.classes.flatMap(c => c.methods)]
+        // Build class name → class id map for this file (for method resolution)
+        const localClassIds = new Map<string, string>()
+        for (const cls of file.classes ?? []) {
+            localClassIds.set(cls.name, cls.id)
+        }
+
+        const allFunctions = [
+            ...file.functions,
+            ...(file.classes ?? []).flatMap(c => c.methods),
+        ]
 
         for (const fn of allFunctions) {
             for (const call of fn.calls) {
-                // Try to resolve: first check imported names, then local functions
-                const simpleName = call.includes('.') ? call.split('.').pop()! : call
+                const hasDot = call.includes('.')
+                const simpleName = hasDot ? call.split('.').pop()! : call
+                const receiver = hasDot ? call.split('.')[0] : null
 
-                // Check if it's an imported function (confidence 0.8 — resolved via import names)
-                const importedId = importedNames.get(simpleName) || importedNames.get(call)
-                if (importedId && graph.nodes.has(importedId)) {
-                    graph.edges.push({
+                // --- 1. Named import exact match ---
+                // Only fall back to simpleName when there is no dotted receiver.
+                // If call = "jwt.verify", falling back to importedNames.get("verify") could
+                // match a completely different import named "verify" — wrong target, high
+                // confidence false-positive.  Only strip the receiver when there is none.
+                const namedId = importedNames.get(call) ?? (receiver === null ? importedNames.get(simpleName) : undefined)
+                if (namedId && graph.nodes.has(namedId)) {
+                    this.pushEdge(graph, edgeKeys, {
                         source: fn.id,
-                        target: importedId,
+                        target: namedId,
                         type: 'calls',
-                        confidence: 0.8, // Resolved through import names, not direct AST binding
+                        confidence: 0.8,
                     })
                     continue
                 }
 
-                // Check if it's a local function in the same file (confidence 1.0 for exact, 0.5 for fuzzy)
-                const localId = `fn:${file.path}:${simpleName}`
-                if (graph.nodes.has(localId) && localId !== fn.id) {
-                    // Direct local match — high confidence
-                    graph.edges.push({
+                // --- 2. Default import: receiver is the alias, method is simpleName ---
+                if (receiver && defaultImports.has(receiver)) {
+                    const resolvedFile = defaultImports.get(receiver)!
+                    // Try to find "fn:resolvedFile:simpleName" in graph
+                    const methodId = `fn:${resolvedFile}:${simpleName}`
+                    if (graph.nodes.has(methodId)) {
+                        this.pushEdge(graph, edgeKeys, {
+                            source: fn.id,
+                            target: methodId,
+                            type: 'calls',
+                            confidence: 0.6,
+                        })
+                        continue
+                    }
+                }
+
+                // --- 3. Local function exact match ---
+                const localExactId = `fn:${file.path}:${simpleName}`
+                if (graph.nodes.has(localExactId) && localExactId !== fn.id) {
+                    this.pushEdge(graph, edgeKeys, {
                         source: fn.id,
-                        target: localId,
+                        target: localExactId,
                         type: 'calls',
-                        confidence: simpleName === call ? 1.0 : 0.5, // exact name = 1.0, dot-access strip = 0.5
+                        confidence: simpleName === call ? 1.0 : 0.5,
                     })
+                    continue
+                }
+
+                // --- 4. Local class method: ClassName.method format ---
+                if (receiver && localClassIds.has(receiver)) {
+                    const clsId = localClassIds.get(receiver)!
+                    // Method IDs are stored as "fn:file:ClassName.methodName"
+                    const classMethodId = `fn:${file.path}:${receiver}.${simpleName}`
+                    if (graph.nodes.has(classMethodId) && classMethodId !== fn.id) {
+                        this.pushEdge(graph, edgeKeys, {
+                            source: fn.id,
+                            target: classMethodId,
+                            type: 'calls',
+                            confidence: 0.8,
+                        })
+                        continue
+                    }
                 }
+
+                // Unresolved call — not added to graph.
+                // Callers can detect incomplete coverage by comparing
+                // fn.calls.length to the number of outgoing 'calls' edges from fn.id.
             }
         }
     }
 
-    /** Creates containment edges: file contains function → edge(file, fn, 'contains') */
-    private addContainmentEdges(graph: DependencyGraph, file: ParsedFile): void {
+    /** Containment edges: file → function, file → class, class → method, file → generic */
+    private addContainmentEdges(
+        graph: DependencyGraph,
+        file: ParsedFile,
+        edgeKeys: Set<string>,
+    ): void {
         for (const fn of file.functions) {
-            graph.edges.push({
+            this.pushEdge(graph, edgeKeys, {
                 source: file.path,
                 target: fn.id,
                 type: 'contains',
             })
         }
-        for (const cls of file.classes) {
-            graph.edges.push({
+        for (const cls of file.classes ?? []) {
+            this.pushEdge(graph, edgeKeys, {
                 source: file.path,
                 target: cls.id,
                 type: 'contains',
             })
             for (const method of cls.methods) {
-                graph.edges.push({
+                this.pushEdge(graph, edgeKeys, {
                     source: cls.id,
                     target: method.id,
                     type: 'contains',
                 })
             }
         }
+        // Generic declarations (interfaces, type aliases, top-level constants) are also
+        // contained by their file — needed so dead-code and impact analysis can trace them.
+        for (const gen of file.generics ?? []) {
+            this.pushEdge(graph, edgeKeys, {
+                source: file.path,
+                target: gen.id,
+                type: 'contains',
+            })
+        }
+    }
+
+    // -------------------------------------------------------------------------
+    // Helpers
+    // -------------------------------------------------------------------------
+
+    /**
+     * Push an edge only if it hasn't been added before.
+     * Edge key format: "source->target:type"
+     */
+    private pushEdge(
+        graph: DependencyGraph,
+        edgeKeys: Set<string>,
+        edge: GraphEdge,
+    ): void {
+        const key = `${edge.source}->${edge.target}:${edge.type}`
+        if (edgeKeys.has(key)) return
+        edgeKeys.add(key)
+        graph.edges.push(edge)
     }
 
     /** Build adjacency maps from edge list for O(1) lookups */
     private buildAdjacencyMaps(graph: DependencyGraph): void {
         for (const edge of graph.edges) {
-            // outEdges
-            if (!graph.outEdges.has(edge.source)) {
-                graph.outEdges.set(edge.source, [])
-            }
+            if (!graph.outEdges.has(edge.source)) graph.outEdges.set(edge.source, [])
             graph.outEdges.get(edge.source)!.push(edge)
 
-            // inEdges
-            if (!graph.inEdges.has(edge.target)) {
-                graph.inEdges.set(edge.target, [])
-            }
+            if (!graph.inEdges.has(edge.target)) graph.inEdges.set(edge.target, [])
             graph.inEdges.get(edge.target)!.push(edge)
         }
     }

package/src/graph/impact-analyzer.ts

@@ -1,15 +1,19 @@
-import type { DependencyGraph, ImpactResult, ClassifiedImpact, RiskLevel } from './types.js'
+import type { DependencyGraph, GraphEdge, ImpactResult, ClassifiedImpact, RiskLevel } from './types.js'
 
 /**
  * ImpactAnalyzer — Given changed nodes, walks the graph backwards (BFS)
  * to find everything that depends on them.
  * Powers "what breaks if I change X?"
  *
- * Now includes risk classification:
+ * Risk classification:
  *   CRITICAL = direct caller (depth 1) that crosses a module boundary
  *   HIGH     = direct caller (depth 1) within the same module
  *   MEDIUM   = depth 2
  *   LOW      = depth 3+
+ *
+ * Confidence is derived from the quality of resolved edges in the traversal
+ * path, not from the size of the result set. A small impact set built from
+ * low-confidence (unresolved/fuzzy) edges is still LOW confidence.
  */
 export class ImpactAnalyzer {
     constructor(private graph: DependencyGraph) { }
@@ -18,30 +22,43 @@ export class ImpactAnalyzer {
     analyze(changedNodeIds: string[]): ImpactResult {
         const visited = new Set<string>()
         const depthMap = new Map<string, number>()
-        const queue: { id: string; depth: number }[] = changedNodeIds.map(id => ({ id, depth: 0 }))
+        // Track the minimum confidence seen along the path to each node
+        const pathConfidence = new Map<string, number>()
+
+        const queue: { id: string; depth: number; confidence: number }[] =
+            changedNodeIds.map(id => ({ id, depth: 0, confidence: 1.0 }))
+        // Use an index pointer instead of queue.shift() to avoid O(n) cost per dequeue.
+        let queueHead = 0
         let maxDepth = 0
 
         const changedSet = new Set(changedNodeIds)
 
-        // Collect module IDs of the changed nodes
-        const changedModules = new Set<string | undefined>()
+        // Collect module IDs of the changed nodes — filter out undefined so that
+        // nodes without a moduleId don't accidentally match every other unmoduled node
+        // and cause everything to appear "same module".
+        const changedModules = new Set<string>()
         for (const id of changedNodeIds) {
             const node = this.graph.nodes.get(id)
-            if (node) changedModules.add(node.moduleId)
+            if (node?.moduleId) changedModules.add(node.moduleId)
         }
 
-        while (queue.length > 0) {
-            const { id: current, depth } = queue.shift()!
+        while (queueHead < queue.length) {
+            const { id: current, depth, confidence: pathConf } = queue[queueHead++]
             if (visited.has(current)) continue
             visited.add(current)
             depthMap.set(current, depth)
+            pathConfidence.set(current, pathConf)
             maxDepth = Math.max(maxDepth, depth)
 
             // Find everything that depends on current (incoming edges)
             const dependents = this.graph.inEdges.get(current) || []
             for (const edge of dependents) {
                 if (!visited.has(edge.source) && edge.type !== 'contains') {
-                    queue.push({ id: edge.source, depth: depth + 1 })
+                    // Propagate the minimum confidence seen so far on this path.
+                    // A chain is only as trustworthy as its weakest link.
+                    const edgeConf = edge.confidence ?? 1.0
+                    const newPathConf = Math.min(pathConf, edgeConf)
+                    queue.push({ id: edge.source, depth: depth + 1, confidence: newPathConf })
                 }
             }
         }
@@ -61,13 +78,15 @@ export class ImpactAnalyzer {
             if (!node) continue
 
             const depth = depthMap.get(id) ?? 999
-            const crossesBoundary = !changedModules.has(node.moduleId)
+            // A node crosses a module boundary when its module differs from ALL changed modules.
+            // If the node has no moduleId, treat it as crossing a boundary (unknown module ≠ known).
+            const crossesBoundary = !node.moduleId || !changedModules.has(node.moduleId)
 
             const risk: RiskLevel =
                 depth === 1 && crossesBoundary ? 'critical' :
-                    depth === 1 ? 'high' :
-                        depth === 2 ? 'medium' :
-                            'low'
+                depth === 1                    ? 'high'     :
+                depth === 2                    ? 'medium'   :
+                                                 'low'
 
             const entry: ClassifiedImpact = {
                 nodeId: id,
@@ -85,22 +104,41 @@ export class ImpactAnalyzer {
             changed: changedNodeIds,
             impacted,
             depth: maxDepth,
-            confidence: this.computeConfidence(impacted.length, maxDepth),
+            confidence: this.computeConfidence(impacted, pathConfidence),
             classified,
         }
     }
 
     /**
-     * How confident are we in this impact analysis?
-     * High = few nodes affected, shallow depth
-     * Low = many nodes affected, deep chains
+     * Derive confidence from the actual quality of edges traversed, not from
+     * result size. A small result built from fuzzy/unresolved edges is LOW
+     * confidence; a large result built from high-confidence AST edges is HIGH.
+     *
+     * Algorithm:
+     *   - Compute the average minimum-path-confidence across all impacted nodes.
+     *   - Penalise for deep chains (they amplify uncertainty).
+     *   - Map the combined score to HIGH / MEDIUM / LOW.
      */
     private computeConfidence(
-        impactedCount: number,
-        depth: number
+        impacted: string[],
+        pathConfidence: Map<string, number>,
     ): 'high' | 'medium' | 'low' {
-        if (impactedCount < 5 && depth < 3) return 'high'
-        if (impactedCount < 20 && depth < 6) return 'medium'
+        if (impacted.length === 0) return 'high'
+
+        // Average path confidence across all impacted nodes
+        let total = 0
+        for (const id of impacted) {
+            total += pathConfidence.get(id) ?? 1.0
+        }
+        const avgConf = total / impacted.length
+
+        // Penalise for large impact sets: confidence erodes with result size
+        const sizePenalty = impacted.length > 20 ? 0.15 : impacted.length > 10 ? 0.08 : 0
+
+        const score = avgConf - sizePenalty
+
+        if (score >= 0.75) return 'high'
+        if (score >= 0.50) return 'medium'
         return 'low'
     }
 }

package/src/graph/types.ts

@@ -19,6 +19,7 @@ export interface GraphNode {
         isAsync?: boolean
         hash?: string
         purpose?: string
+        genericKind?: string
         params?: { name: string; type: string; optional?: boolean }[]
         returnType?: string
         edgeCasesHandled?: string[]

package/src/parser/boundary-checker.ts

@@ -74,7 +74,9 @@ export class BoundaryChecker {
 
         for (const file of Object.values(this.lock.files)) {
             if (file.moduleId === 'unknown' || !file.imports?.length) continue
-            for (const importedPath of file.imports) {
+            for (const imp of file.imports) {
+                const importedPath = imp.resolvedPath
+                if (!importedPath) continue
                 const importedFile = this.lock.files[importedPath]
                 if (!importedFile || importedFile.moduleId === 'unknown' || file.moduleId === importedFile.moduleId) continue
                 const v = this.checkFileImport(file, importedFile)

package/src/parser/go/go-extractor.ts

@@ -54,6 +54,7 @@ const ROUTE_PATTERNS: RoutePattern[] = [
  */
 export class GoExtractor {
     private readonly lines: string[]
+    private cachedFunctions: ReturnType<typeof this.scanFunctions> | null = null
 
     constructor(
         private readonly filePath: string,
@@ -174,6 +175,7 @@ export class GoExtractor {
         endLine: number
         purpose: string
     }> {
+        if (this.cachedFunctions) return this.cachedFunctions
         const results: Array<{
             name: string
             receiverType?: string
@@ -237,6 +239,7 @@ export class GoExtractor {
             i = bodyEnd + 1
         }
 
+        this.cachedFunctions = results
         return results
     }
 
@@ -547,11 +550,17 @@ function findBodyBounds(lines: string[], startLine: number): { bodyStart: number
 
             if (ch === '/' && next === '/') { inLineComment = true; break }
             if (ch === '/' && next === '*') { inBlockComment = true; j++; continue }
-            if (ch === '"' || ch === '`' || ch === '\'') {
+            if (ch === '"' || ch === '`') {
                 inString = true
                 stringChar = ch
                 continue
             }
+            if (ch === '\'') {
+                // Go rune literal: consume exactly one character (or escape) then close
+                if (next === '\\') j += 3 // '\n' or '\x00' etc.
+                else j += 2 // 'a'
+                continue
+            }
 
             if (ch === '{') {
                 if (bodyStart === -1) bodyStart = i