@ryanstark24/sfgraph-core 1.1.0

package/dist/analyze/deployment-manifest/member-types.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Map node label → Salesforce metadata API type used in package.xml.
+ * Covers the ~30 most-common metadata types Phase 6 ships parsers for.
+ */
+export declare const LABEL_TO_METADATA_TYPE: Record<string, string>;
+//# sourceMappingURL=member-types.d.ts.map

package/dist/analyze/deployment-manifest/member-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-types.d.ts","sourceRoot":"","sources":["../../../src/analyze/deployment-manifest/member-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyCzD,CAAC"}

package/dist/analyze/deployment-manifest/member-types.js

@@ -0,0 +1,47 @@
+/**
+ * Map node label → Salesforce metadata API type used in package.xml.
+ * Covers the ~30 most-common metadata types Phase 6 ships parsers for.
+ */
+export const LABEL_TO_METADATA_TYPE = {
+    ApexClass: "ApexClass",
+    ApexTrigger: "ApexTrigger",
+    ApexPage: "ApexPage",
+    ApexComponent: "ApexComponent",
+    LightningComponentBundle: "LightningComponentBundle",
+    AuraDefinitionBundle: "AuraDefinitionBundle",
+    Flow: "Flow",
+    CustomObject: "CustomObject",
+    CustomField: "CustomField",
+    Profile: "Profile",
+    PermissionSet: "PermissionSet",
+    PermissionSetGroup: "PermissionSetGroup",
+    SharingRule: "SharingRules",
+    NamedCredential: "NamedCredential",
+    ExternalServiceRegistration: "ExternalServiceRegistration",
+    PlatformEventChannel: "PlatformEventChannel",
+    CustomLabel: "CustomLabels",
+    CustomMetadataType: "CustomObject",
+    CustomMetadataRecord: "CustomMetadata",
+    StaticResource: "StaticResource",
+    Layout: "Layout",
+    RecordType: "RecordType",
+    ValidationRule: "ValidationRule",
+    Workflow: "Workflow",
+    WorkflowRule: "WorkflowRule",
+    ApprovalProcess: "ApprovalProcess",
+    Queue: "Queue",
+    Group: "Group",
+    Role: "Role",
+    ConnectedApp: "ConnectedApp",
+    RemoteSiteSetting: "RemoteSiteSetting",
+    EmailTemplate: "EmailTemplate",
+    Report: "Report",
+    Dashboard: "Dashboard",
+    FlexiPage: "FlexiPage",
+    DuplicateRule: "DuplicateRule",
+    MatchingRule: "MatchingRules",
+    Network: "Network",
+    GenAiPlanner: "GenAiPlanner",
+    GenAiPlugin: "GenAiPlugin",
+};
+//# sourceMappingURL=member-types.js.map

package/dist/analyze/deployment-manifest/member-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-types.js","sourceRoot":"","sources":["../../../src/analyze/deployment-manifest/member-types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;IAC1B,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,wBAAwB,EAAE,0BAA0B;IACpD,oBAAoB,EAAE,sBAAsB;IAC5C,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;IAClB,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IACxC,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,iBAAiB;IAClC,2BAA2B,EAAE,6BAA6B;IAC1D,oBAAoB,EAAE,sBAAsB;IAC5C,WAAW,EAAE,cAAc;IAC3B,kBAAkB,EAAE,cAAc;IAClC,oBAAoB,EAAE,gBAAgB;IACtC,cAAc,EAAE,gBAAgB;IAChC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,cAAc,EAAE,gBAAgB;IAChC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,iBAAiB,EAAE,mBAAmB;IACtC,aAAa,EAAE,eAAe;IAC9B,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,eAAe;IAC7B,OAAO,EAAE,SAAS;IAClB,YAAY,EAAE,cAAc;IAC5B,WAAW,EAAE,aAAa;CAC3B,CAAC"}

package/dist/analyze/freshness.d.ts

@@ -0,0 +1,9 @@
+import type { NodeFact } from "../domain/index.js";
+/**
+ * Returns a 0-1 freshness score. 1 = recently modified, 0 = very stale.
+ * Uses lastModifiedAt; default 0.5 if missing.
+ */
+export declare function freshnessScore(node: NodeFact, now?: number): number;
+export type FreshnessBucket = "hot" | "current" | "stale" | "dead";
+export declare function freshnessBucket(score: number): FreshnessBucket;
+//# sourceMappingURL=freshness.d.ts.map

package/dist/analyze/freshness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness.d.ts","sourceRoot":"","sources":["../../src/analyze/freshness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,SAAa,GAAG,MAAM,CAUvE;AAED,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AAEnE,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAK9D"}

package/dist/analyze/freshness.js

@@ -0,0 +1,31 @@
+/**
+ * Returns a 0-1 freshness score. 1 = recently modified, 0 = very stale.
+ * Uses lastModifiedAt; default 0.5 if missing.
+ */
+export function freshnessScore(node, now = Date.now()) {
+    const t = node.lastModifiedAt;
+    if (!t || t <= 0)
+        return 0.5;
+    const ageDays = (now - t) / (1000 * 60 * 60 * 24);
+    if (ageDays <= 7)
+        return 1;
+    if (ageDays <= 30)
+        return 0.8;
+    if (ageDays <= 90)
+        return 0.6;
+    if (ageDays <= 180)
+        return 0.4;
+    if (ageDays <= 365)
+        return 0.2;
+    return 0.05;
+}
+export function freshnessBucket(score) {
+    if (score >= 0.8)
+        return "hot";
+    if (score >= 0.5)
+        return "current";
+    if (score >= 0.2)
+        return "stale";
+    return "dead";
+}
+//# sourceMappingURL=freshness.js.map

package/dist/analyze/freshness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness.js","sourceRoot":"","sources":["../../src/analyze/freshness.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;IAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7B,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAO,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,OAAO,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAC/B,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAID,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,OAAO,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analyze/git-diff.d.ts

@@ -0,0 +1,6 @@
+export interface DiffFile {
+    path: string;
+    status: "added" | "modified" | "deleted";
+}
+export declare function parseUnifiedDiff(text: string): DiffFile[];
+//# sourceMappingURL=git-diff.d.ts.map

package/dist/analyze/git-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-diff.d.ts","sourceRoot":"","sources":["../../src/analyze/git-diff.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;CAC1C;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAgCzD"}

package/dist/analyze/git-diff.js

@@ -0,0 +1,38 @@
+export function parseUnifiedDiff(text) {
+    const files = new Map();
+    const lines = text.split(/\r?\n/);
+    let curOld = null;
+    let curNew = null;
+    for (const line of lines) {
+        if (line.startsWith("--- ")) {
+            const raw = line.slice(4).trim();
+            curOld = raw === "/dev/null" ? null : raw.replace(/^a\//, "");
+        }
+        else if (line.startsWith("+++ ")) {
+            const raw = line.slice(4).trim();
+            curNew = raw === "/dev/null" ? null : raw.replace(/^b\//, "");
+            let status;
+            let path;
+            if (curOld === null && curNew) {
+                status = "added";
+                path = curNew;
+            }
+            else if (curNew === null && curOld) {
+                status = "deleted";
+                path = curOld;
+            }
+            else if (curNew) {
+                status = "modified";
+                path = curNew;
+            }
+            else {
+                continue;
+            }
+            files.set(path, { path, status });
+            curOld = null;
+            curNew = null;
+        }
+    }
+    return Array.from(files.values());
+}
+//# sourceMappingURL=git-diff.js.map

package/dist/analyze/git-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-diff.js","sourceRoot":"","sources":["../../src/analyze/git-diff.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,MAA0B,CAAC;YAC/B,IAAI,IAAY,CAAC;YACjB,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC9B,MAAM,GAAG,OAAO,CAAC;gBACjB,IAAI,GAAG,MAAM,CAAC;YAChB,CAAC;iBAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,EAAE,CAAC;gBACrC,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,GAAG,MAAM,CAAC;YAChB,CAAC;iBAAM,IAAI,MAAM,EAAE,CAAC;gBAClB,MAAM,GAAG,UAAU,CAAC;gBACpB,IAAI,GAAG,MAAM,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,SAAS;YACX,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAClC,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC"}

package/dist/analyze/governor.d.ts

@@ -0,0 +1,14 @@
+import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { GraphStore } from "../storage/interfaces.js";
+export interface GovernorRisk {
+    qualifiedName: string;
+    risk: "soql_in_loop" | "dml_in_loop" | "no_bulk" | "unbounded_query";
+    evidence: string;
+}
+/**
+ * Placeholder implementation. Real impl Phase 6. We scan ApexClass attribute
+ * hints (`hasSoqlInLoop`, `hasDmlInLoop`) if parsers ever emit them, otherwise
+ * empty.
+ */
+export declare function findGovernorRisks(store: GraphStore, orgId: OrgId): GovernorRisk[];
+//# sourceMappingURL=governor.d.ts.map

package/dist/analyze/governor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governor.d.ts","sourceRoot":"","sources":["../../src/analyze/governor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,iBAAiB,CAAC;IACrE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,YAAY,EAAE,CAoBjF"}

package/dist/analyze/governor.js

@@ -0,0 +1,28 @@
+import { METADATA_CATEGORY } from "../domain/metadata-category.js";
+/**
+ * Placeholder implementation. Real impl Phase 6. We scan ApexClass attribute
+ * hints (`hasSoqlInLoop`, `hasDmlInLoop`) if parsers ever emit them, otherwise
+ * empty.
+ */
+export function findGovernorRisks(store, orgId) {
+    const out = [];
+    for (const n of store.listNodesByLabel(orgId, METADATA_CATEGORY.APEX_CLASS, 5000)) {
+        const a = n.attributes;
+        if (a.hasSoqlInLoop === true) {
+            out.push({
+                qualifiedName: n.qualifiedName,
+                risk: "soql_in_loop",
+                evidence: "attribute hasSoqlInLoop=true",
+            });
+        }
+        if (a.hasDmlInLoop === true) {
+            out.push({
+                qualifiedName: n.qualifiedName,
+                risk: "dml_in_loop",
+                evidence: "attribute hasDmlInLoop=true",
+            });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=governor.js.map

package/dist/analyze/governor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governor.js","sourceRoot":"","sources":["../../src/analyze/governor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AASnE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAiB,EAAE,KAAY;IAC/D,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,GAAG,CAAC,CAAC,UAAqC,CAAC;QAClD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,8BAA8B;aACzC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC;gBACP,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,6BAA6B;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/analyze/index.d.ts

@@ -0,0 +1,14 @@
+export * from "./dependents.js";
+export * from "./dependencies.js";
+export * from "./test-coverage.js";
+export * from "./git-diff.js";
+export * from "./path-to-qname.js";
+export * from "./freshness.js";
+export * from "./cross-org.js";
+export * from "./governor.js";
+export * from "./dead-code.js";
+export * from "./security.js";
+export * from "./populate.js";
+export * from "./deployment-manifest/generate.js";
+export * from "./wip-impact.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/analyze/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyze/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,iBAAiB,CAAC"}

package/dist/analyze/index.js

@@ -0,0 +1,14 @@
+export * from "./dependents.js";
+export * from "./dependencies.js";
+export * from "./test-coverage.js";
+export * from "./git-diff.js";
+export * from "./path-to-qname.js";
+export * from "./freshness.js";
+export * from "./cross-org.js";
+export * from "./governor.js";
+export * from "./dead-code.js";
+export * from "./security.js";
+export * from "./populate.js";
+export * from "./deployment-manifest/generate.js";
+export * from "./wip-impact.js";
+//# sourceMappingURL=index.js.map

package/dist/analyze/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analyze/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,iBAAiB,CAAC"}

package/dist/analyze/path-to-qname.d.ts

@@ -0,0 +1,3 @@
+import { type QualifiedName } from "@ryanstark24/sfgraph-shared";
+export declare function pathToQualifiedName(p: string): QualifiedName | null;
+//# sourceMappingURL=path-to-qname.d.ts.map

package/dist/analyze/path-to-qname.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-to-qname.d.ts","sourceRoot":"","sources":["../../src/analyze/path-to-qname.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,6BAA6B,CAAC;AAElF,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAsBnE"}

package/dist/analyze/path-to-qname.js

@@ -0,0 +1,32 @@
+import { asQualifiedName } from "@ryanstark24/sfgraph-shared";
+export function pathToQualifiedName(p) {
+    const norm = p.replace(/\\/g, "/");
+    // ApexClass
+    let m = norm.match(/classes\/([^/]+)\.cls(-meta\.xml)?$/);
+    if (m)
+        return asQualifiedName(`ApexClass:${m[1]}`);
+    m = norm.match(/triggers\/([^/]+)\.trigger(-meta\.xml)?$/);
+    if (m)
+        return asQualifiedName(`ApexTrigger:${m[1]}`);
+    // LWC: lwc/<bundle>/...
+    m = norm.match(/lwc\/([^/]+)\/.*$/);
+    if (m)
+        return asQualifiedName(`LWC:${m[1]}`);
+    // Flow
+    m = norm.match(/flows\/([^/]+)\.flow(-meta\.xml)?$/);
+    if (m)
+        return asQualifiedName(`Flow:${m[1]}`);
+    // CustomField: objects/<obj>/fields/<field>.field-meta.xml
+    m = norm.match(/objects\/([^/]+)\/fields\/([^/]+)\.field-meta\.xml$/);
+    if (m)
+        return asQualifiedName(`CustomField:${m[1]}.${m[2]}`);
+    // CustomObject: objects/<obj>/<obj>.object-meta.xml or objects/<obj>.object
+    m = norm.match(/objects\/([^/]+)\/\1\.object-meta\.xml$/);
+    if (m)
+        return asQualifiedName(`CustomObject:${m[1]}`);
+    m = norm.match(/objects\/([^/]+)\.object$/);
+    if (m)
+        return asQualifiedName(`CustomObject:${m[1]}`);
+    return null;
+}
+//# sourceMappingURL=path-to-qname.js.map

package/dist/analyze/path-to-qname.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-to-qname.js","sourceRoot":"","sources":["../../src/analyze/path-to-qname.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAElF,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,YAAY;IACZ,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC1D,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC3D,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,wBAAwB;IACxB,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACpC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO;IACP,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrD,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACtE,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,4EAA4E;IAC5E,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC1D,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC5C,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/analyze/populate.d.ts

@@ -0,0 +1,15 @@
+import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { BetterSqlite3Database, GraphStore } from "../storage/interfaces.js";
+export interface PopulateCounts {
+    findings: number;
+    deadCode: number;
+    governor: number;
+    testCov: number;
+}
+/** Detect governor risks by scanning Apex source attribute (if available) plus parser-emitted flags. */
+export declare function populateGovernorRisks(store: GraphStore, orgId: OrgId, db: BetterSqlite3Database): number;
+export declare function populateDeadCodeScores(store: GraphStore, orgId: OrgId, db: BetterSqlite3Database): number;
+export declare function populateTestCoverage(store: GraphStore, orgId: OrgId, db: BetterSqlite3Database): number;
+export declare function populateSecurityFindings(store: GraphStore, orgId: OrgId, db: BetterSqlite3Database): number;
+export declare function populateAnalysisTables(store: GraphStore, orgId: OrgId, db: BetterSqlite3Database): Promise<PopulateCounts>;
+//# sourceMappingURL=populate.d.ts.map

package/dist/analyze/populate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"populate.d.ts","sourceRoot":"","sources":["../../src/analyze/populate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAGzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAGlF,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wGAAwG;AACxG,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,EAAE,EAAE,qBAAqB,GACxB,MAAM,CA0GR;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,EAAE,EAAE,qBAAqB,GACxB,MAAM,CAoCR;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,EAAE,EAAE,qBAAqB,GACxB,MAAM,CAcR;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,EAAE,EAAE,qBAAqB,GACxB,MAAM,CAyBR;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,EAAE,EAAE,qBAAqB,GACxB,OAAO,CAAC,cAAc,CAAC,CAMzB"}

package/dist/analyze/populate.js

@@ -0,0 +1,188 @@
+import { METADATA_CATEGORY } from "../domain/metadata-category.js";
+import { REL_TYPES } from "../domain/rel-types.js";
+import { freshnessScore } from "./freshness.js";
+/** Detect governor risks by scanning Apex source attribute (if available) plus parser-emitted flags. */
+export function populateGovernorRisks(store, orgId, db) {
+    const now = Date.now();
+    const stmt = db.prepare(`INSERT OR REPLACE INTO _sfgraph_governor_risks
+     (org_id, qualified_name, risk_type, evidence, line, computed_at)
+     VALUES (?, ?, ?, ?, ?, ?)`);
+    let n = 0;
+    const detect = (body) => {
+        const out = [];
+        if (!body)
+            return out;
+        // Walk character by character, tracking brace depth at the entry-point of each loop.
+        // While any loop is open, scan ahead for SOQL/DML patterns at each character position.
+        const loopOpenDepths = []; // brace-depth at the moment the loop body { opens
+        let depth = 0;
+        let pendingLoop = false; // saw `for(` or `while(` waiting for `{`
+        const inLoop = () => loopOpenDepths.length > 0;
+        const lineOf = (idx) => {
+            let n = 1;
+            for (let k = 0; k < idx; k++)
+                if (body[k] === "\n")
+                    n += 1;
+            return n;
+        };
+        const emit = (idx, type, evidence) => {
+            out.push({ type, evidence: evidence.trim().slice(0, 200), line: lineOf(idx) });
+        };
+        for (let i = 0; i < body.length; i++) {
+            const ch = body[i];
+            // loop keyword detection
+            if ((ch === "f" && body.startsWith("for", i) && /\W/.test(body[i - 1] ?? " ")) ||
+                (ch === "w" && body.startsWith("while", i) && /\W/.test(body[i - 1] ?? " "))) {
+                // ensure followed by `(`
+                const after = body.indexOf("(", i);
+                if (after !== -1 && after - i <= 6) {
+                    pendingLoop = true;
+                }
+            }
+            if (ch === "{") {
+                depth += 1;
+                if (pendingLoop) {
+                    loopOpenDepths.push(depth);
+                    pendingLoop = false;
+                }
+            }
+            else if (ch === "}") {
+                if (loopOpenDepths.length && loopOpenDepths[loopOpenDepths.length - 1] === depth) {
+                    loopOpenDepths.pop();
+                }
+                depth -= 1;
+            }
+            // detect patterns at this position
+            if (inLoop()) {
+                if (body.startsWith("[", i)) {
+                    const close = body.indexOf("]", i);
+                    const seg = close !== -1 ? body.slice(i, close + 1) : body.slice(i, i + 80);
+                    if (/^\[\s*SELECT\b/i.test(seg)) {
+                        emit(i, "soql_in_loop", seg);
+                        i = close === -1 ? i : close;
+                        continue;
+                    }
+                }
+                const dmlMatch = body
+                    .slice(i, i + 40)
+                    .match(/^(insert|update|upsert|delete|undelete)\s+\w/i);
+                if (dmlMatch && /\W/.test(body[i - 1] ?? " ")) {
+                    emit(i, "dml_in_loop", dmlMatch[0] ?? "");
+                }
+            }
+        }
+        // unbounded query: search globally for SELECT without WHERE/LIMIT
+        for (const m of body.matchAll(/\[\s*SELECT\b[\s\S]*?\]/gi)) {
+            const seg = m[0] ?? "";
+            if (!/\bLIMIT\b/i.test(seg) && !/\bWHERE\b/i.test(seg)) {
+                emit(m.index ?? 0, "unbounded_query", seg);
+            }
+        }
+        // simple no-bulkify: trigger with single-record DML pattern
+        if (/trigger\s+\w+\s+on\s+\w+/i.test(body) && !/Trigger\.new/i.test(body)) {
+            out.push({ type: "no_bulk", evidence: "trigger without Trigger.new iteration", line: -1 });
+        }
+        return out;
+    };
+    for (const lbl of [METADATA_CATEGORY.APEX_CLASS, METADATA_CATEGORY.APEX_TRIGGER]) {
+        for (const node of store.listNodesByLabel(orgId, lbl, 10000)) {
+            const a = node.attributes;
+            const body = String(a.source ?? a.body ?? "");
+            const risks = detect(body);
+            // Attribute hints from earlier phases
+            if (a.hasSoqlInLoop === true) {
+                risks.push({ type: "soql_in_loop", evidence: "attribute hint", line: -1 });
+            }
+            if (a.hasDmlInLoop === true) {
+                risks.push({ type: "dml_in_loop", evidence: "attribute hint", line: -1 });
+            }
+            const seen = new Set();
+            for (const r of risks) {
+                const k = `${r.type}|${r.line}`;
+                if (seen.has(k))
+                    continue;
+                seen.add(k);
+                stmt.run(orgId, node.qualifiedName, r.type, r.evidence, r.line, now);
+                n += 1;
+            }
+        }
+    }
+    return n;
+}
+export function populateDeadCodeScores(store, orgId, db) {
+    const now = Date.now();
+    const stmt = db.prepare(`INSERT OR REPLACE INTO _sfgraph_dead_code_scores
+     (org_id, qualified_name, score, confidence, reasons, computed_at)
+     VALUES (?, ?, ?, ?, ?, ?)`);
+    let n = 0;
+    const labels = [
+        METADATA_CATEGORY.APEX_CLASS,
+        METADATA_CATEGORY.LWC,
+        METADATA_CATEGORY.FLOW,
+        METADATA_CATEGORY.APEX_PAGE,
+        METADATA_CATEGORY.APEX_COMPONENT,
+    ];
+    for (const lbl of labels) {
+        for (const node of store.listNodesByLabel(orgId, lbl, 10000)) {
+            const incoming = store.listEdgesTo(orgId, node.qualifiedName).length;
+            const fresh = freshnessScore(node, now);
+            const reasons = [];
+            // Score formula: lower = more dead. weight 0.6 freshness + 0.4 incoming.
+            const incomingScore = incoming === 0 ? 0 : Math.min(1, incoming / 5);
+            if (incoming === 0)
+                reasons.push("no_incoming_edges");
+            if (fresh < 0.4)
+                reasons.push("stale_freshness");
+            const score = 0.6 * fresh + 0.4 * incomingScore;
+            let confidence;
+            if (score < 0.2)
+                confidence = "high";
+            else if (score < 0.45)
+                confidence = "medium";
+            else
+                confidence = "low";
+            // Only persist potentially-dead candidates
+            if (incoming > 0 && fresh >= 0.5)
+                continue;
+            stmt.run(orgId, node.qualifiedName, score, confidence, JSON.stringify(reasons), now);
+            n += 1;
+        }
+    }
+    return n;
+}
+export function populateTestCoverage(store, orgId, db) {
+    const now = Date.now();
+    const stmt = db.prepare(`INSERT OR REPLACE INTO _sfgraph_test_coverage
+     (org_id, qualified_name, test_count, computed_at)
+     VALUES (?, ?, ?, ?)`);
+    let n = 0;
+    for (const node of store.listNodesByLabel(orgId, METADATA_CATEGORY.APEX_CLASS, 10000)) {
+        const tests = store.listEdgesTo(orgId, node.qualifiedName, REL_TYPES.IS_TEST_FOR).length;
+        stmt.run(orgId, node.qualifiedName, tests, now);
+        n += 1;
+    }
+    return n;
+}
+export function populateSecurityFindings(store, orgId, db) {
+    const now = Date.now();
+    const stmt = db.prepare(`INSERT OR REPLACE INTO _sfgraph_findings
+     (org_id, qualified_name, rule_id, line, severity, message, evidence, computed_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`);
+    let n = 0;
+    for (const node of store.listNodesByLabel(orgId, METADATA_CATEGORY.SHARING_RULE, 10000)) {
+        const a = node.attributes;
+        if (a.accessLevel === "All" || a.access === "Edit" || a.accessLevel === "Edit") {
+            stmt.run(orgId, node.qualifiedName, "sharing.full_access", -1, "high", "sharing rule grants full access (All/Edit)", JSON.stringify({ accessLevel: a.accessLevel ?? a.access ?? null }), now);
+            n += 1;
+        }
+    }
+    return n;
+}
+export async function populateAnalysisTables(store, orgId, db) {
+    const findings = populateSecurityFindings(store, orgId, db);
+    const deadCode = populateDeadCodeScores(store, orgId, db);
+    const governor = populateGovernorRisks(store, orgId, db);
+    const testCov = populateTestCoverage(store, orgId, db);
+    return { findings, deadCode, governor, testCov };
+}
+//# sourceMappingURL=populate.js.map

package/dist/analyze/populate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"populate.js","sourceRoot":"","sources":["../../src/analyze/populate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAShD,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CACnC,KAAiB,EACjB,KAAY,EACZ,EAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;+BAE2B,CAC5B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,MAAM,GAAG,CAAC,IAAY,EAA2D,EAAE;QACvF,MAAM,GAAG,GAA4D,EAAE,CAAC;QACxE,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC;QAEtB,qFAAqF;QACrF,uFAAuF;QACvF,MAAM,cAAc,GAAa,EAAE,CAAC,CAAC,kDAAkD;QACvF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,WAAW,GAAG,KAAK,CAAC,CAAC,yCAAyC;QAClE,MAAM,MAAM,GAAG,GAAY,EAAE,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;YACrC,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,QAAgB,EAAQ,EAAE;YACjE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC,CAAC;QACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,yBAAyB;YACzB,IACE,CAAC,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC1E,CAAC,EAAE,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAC5E,CAAC;gBACD,yBAAyB;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACnC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,WAAW,EAAE,CAAC;oBAChB,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC3B,WAAW,GAAG,KAAK,CAAC;gBACtB,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,IAAI,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACjF,cAAc,CAAC,GAAG,EAAE,CAAC;gBACvB,CAAC;gBACD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,mCAAmC;YACnC,IAAI,MAAM,EAAE,EAAE,CAAC;gBACb,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACnC,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC5E,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,IAAI,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;wBAC7B,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;wBAC7B,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI;qBAClB,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;qBAChB,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC1D,IAAI,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBAC9C,IAAI,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QACD,kEAAkE;QAClE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,4DAA4D;QAC5D,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;QACjF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,UAAqC,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,sCAAsC;YACtC,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACZ,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrE,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAiB,EACjB,KAAY,EACZ,EAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;+BAE2B,CAC5B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,MAAM,GAAG;QACb,iBAAiB,CAAC,UAAU;QAC5B,iBAAiB,CAAC,GAAG;QACrB,iBAAiB,CAAC,IAAI;QACtB,iBAAiB,CAAC,SAAS;QAC3B,iBAAiB,CAAC,cAAc;KACjC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;YACrE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,yEAAyE;YACzE,MAAM,aAAa,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,QAAQ,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACtD,IAAI,KAAK,GAAG,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,GAAG,GAAG,KAAK,GAAG,GAAG,GAAG,aAAa,CAAC;YAChD,IAAI,UAAqC,CAAC;YAC1C,IAAI,KAAK,GAAG,GAAG;gBAAE,UAAU,GAAG,MAAM,CAAC;iBAChC,IAAI,KAAK,GAAG,IAAI;gBAAE,UAAU,GAAG,QAAQ,CAAC;;gBACxC,UAAU,GAAG,KAAK,CAAC;YACxB,2CAA2C;YAC3C,IAAI,QAAQ,GAAG,CAAC,IAAI,KAAK,IAAI,GAAG;gBAAE,SAAS;YAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YACrF,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAiB,EACjB,KAAY,EACZ,EAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;yBAEqB,CACtB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QACtF,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QACzF,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiB,EACjB,KAAY,EACZ,EAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;qCAEiC,CAClC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,GAAG,IAAI,CAAC,UAAqC,CAAC;QACrD,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CACN,KAAK,EACL,IAAI,CAAC,aAAa,EAClB,qBAAqB,EACrB,CAAC,CAAC,EACF,MAAM,EACN,4CAA4C,EAC5C,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,EAClE,GAAG,CACJ,CAAC;YACF,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAiB,EACjB,KAAY,EACZ,EAAyB;IAEzB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC"}

package/dist/analyze/security.d.ts

@@ -0,0 +1,25 @@
+import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { GraphStore } from "../storage/interfaces.js";
+export interface SecurityAudit {
+    sharingFullAccess: string[];
+    fieldAccessMatrix: Array<{
+        field: string;
+        grantedBy: string[];
+    }>;
+    flsGaps: string[];
+    /**
+     * True when one of the underlying per-label scans hit
+     * `SECURITY_PER_LABEL_CAP`. When set, results are incomplete and the
+     * caller should narrow the scope (`object` / `field` filter) or paginate.
+     */
+    truncated?: boolean;
+}
+export declare const SECURITY_PER_LABEL_CAP = 5000;
+export interface SecurityAuditOptions {
+    /** Restrict the field-access matrix + FLS gaps to fields of this object (qualifiedName prefix, e.g. `CustomObject:Account`). */
+    object?: string;
+    /** Restrict to a single field qualifiedName (e.g. `CustomField:Account.Tier__c`). Implies `object`. */
+    field?: string;
+}
+export declare function securityAudit(store: GraphStore, orgId: OrgId, opts?: SecurityAuditOptions): SecurityAudit;
+//# sourceMappingURL=security.d.ts.map

package/dist/analyze/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/analyze/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAGzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,MAAM,WAAW,oBAAoB;IACnC,gIAAgI;IAChI,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiBD,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,IAAI,CAAC,EAAE,oBAAoB,GAC1B,aAAa,CAyDf"}

package/dist/analyze/security.js

@@ -0,0 +1,70 @@
+import { METADATA_CATEGORY } from "../domain/metadata-category.js";
+import { REL_TYPES } from "../domain/rel-types.js";
+export const SECURITY_PER_LABEL_CAP = 5000;
+function matchesFilter(qname, opts) {
+    if (!opts)
+        return true;
+    if (opts.field)
+        return qname === opts.field;
+    if (opts.object) {
+        // Match `<anything>:<object>.<field>` heuristically. Strip the label
+        // prefix before `:` so the caller can pass either the full qname
+        // (`CustomObject:Account`) or just the object name (`Account`).
+        const objName = (opts.object.includes(":") ? opts.object.split(":")[1] : opts.object) ?? opts.object;
+        const tail = (qname.includes(":") ? qname.split(":")[1] : qname) ?? qname;
+        return tail.startsWith(`${objName}.`) || tail === objName;
+    }
+    return true;
+}
+export function securityAudit(store, orgId, opts) {
+    const sharingFullAccess = [];
+    let truncated = false;
+    // SharingRule attribute scan
+    const sharingRules = store.listNodesByLabel(orgId, METADATA_CATEGORY.SHARING_RULE, SECURITY_PER_LABEL_CAP);
+    if (sharingRules.length >= SECURITY_PER_LABEL_CAP)
+        truncated = true;
+    for (const n of sharingRules) {
+        const a = n.attributes;
+        if (a.access === "Edit" || a.accessLevel === "Edit" || a.accessLevel === "All") {
+            sharingFullAccess.push(n.qualifiedName);
+        }
+    }
+    // Field access matrix
+    const fieldAccessMatrix = new Map();
+    const permSets = store.listNodesByLabel(orgId, METADATA_CATEGORY.PERMISSION_SET, SECURITY_PER_LABEL_CAP);
+    if (permSets.length >= SECURITY_PER_LABEL_CAP)
+        truncated = true;
+    for (const n of permSets) {
+        const grants = store.listEdgesFrom(orgId, n.qualifiedName, REL_TYPES.GRANTS_FIELD_ACCESS);
+        for (const e of grants) {
+            let set = fieldAccessMatrix.get(e.dstQualifiedName);
+            if (!set) {
+                set = new Set();
+                fieldAccessMatrix.set(e.dstQualifiedName, set);
+            }
+            set.add(n.qualifiedName);
+        }
+    }
+    // FLS gaps: fields with no grants. Honour the object/field filter.
+    const flsGaps = [];
+    const fields = store.listNodesByLabel(orgId, METADATA_CATEGORY.FIELD, SECURITY_PER_LABEL_CAP);
+    if (fields.length >= SECURITY_PER_LABEL_CAP)
+        truncated = true;
+    for (const n of fields) {
+        if (!matchesFilter(n.qualifiedName, opts))
+            continue;
+        if (!fieldAccessMatrix.has(n.qualifiedName))
+            flsGaps.push(n.qualifiedName);
+    }
+    // Filter the matrix too so a narrowed audit returns a narrowed matrix.
+    const filteredMatrix = Array.from(fieldAccessMatrix.entries())
+        .filter(([field]) => matchesFilter(field, opts))
+        .map(([field, set]) => ({ field, grantedBy: Array.from(set) }));
+    return {
+        sharingFullAccess,
+        fieldAccessMatrix: filteredMatrix,
+        flsGaps,
+        truncated,
+    };
+}
+//# sourceMappingURL=security.js.map