@ryanstark24/sfgraph-core 1.1.8 → 1.2.0

package/dist/analyze/__tests__/find-nodes.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=find-nodes.test.d.ts.map

package/dist/analyze/__tests__/find-nodes.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-nodes.test.d.ts","sourceRoot":"","sources":["../../../src/analyze/__tests__/find-nodes.test.ts"],"names":[],"mappings":""}

package/dist/analyze/__tests__/find-nodes.test.js

@@ -0,0 +1,129 @@
+import { asOrgId, asQualifiedName, asSha256 } from "@ryanstark24/sfgraph-shared";
+import { describe, expect, it } from "vitest";
+import { SqliteGraphStore } from "../../storage/sqlite/graph-store.js";
+import { findNodesByGlob } from "../find-nodes.js";
+const ORG = asOrgId("org_test");
+async function setupStore() {
+    const store = new SqliteGraphStore({ dbPath: ":memory:" });
+    await store.init();
+    store.upsertOrg({
+        id: ORG,
+        alias: "test",
+        instanceUrl: "https://example.test",
+        apiVersion: "59.0",
+        createdAt: Date.now(),
+    });
+    return store;
+}
+function node(label, qname) {
+    const ts = Date.now();
+    return {
+        orgId: ORG,
+        qualifiedName: asQualifiedName(qname),
+        label,
+        attributes: {},
+        sourceHash: asSha256(qname),
+        firstSeenAt: ts,
+        lastSeenAt: ts,
+        lastModifiedAt: ts,
+    };
+}
+describe("W3-04: findNodesByGlob", () => {
+    it("matches every Apex class with a label-anchored pattern", async () => {
+        const store = await setupStore();
+        store.mergeNodes([
+            node("ApexClass", "ApexClass:AccountController"),
+            node("ApexClass", "ApexClass:ContactController"),
+            node("ApexClass", "ApexClass:UtilityClass"),
+            node("CustomField", "CustomField:Account.Name"),
+        ]);
+        const result = findNodesByGlob(store, ORG, "ApexClass:*");
+        expect(result.matches.map((n) => String(n.qualifiedName)).sort()).toEqual([
+            "ApexClass:AccountController",
+            "ApexClass:ContactController",
+            "ApexClass:UtilityClass",
+        ]);
+        expect(result.truncated).toBe(false);
+        expect(result.total).toBe(3);
+        await store.close();
+    });
+    it("treats `.` as the segment separator: `CustomField:Account.*` matches all Account fields", async () => {
+        const store = await setupStore();
+        store.mergeNodes([
+            node("CustomField", "CustomField:Account.Name"),
+            node("CustomField", "CustomField:Account.Phone"),
+            node("CustomField", "CustomField:Contact.Email"),
+        ]);
+        const result = findNodesByGlob(store, ORG, "CustomField:Account.*");
+        expect(result.matches.map((n) => String(n.qualifiedName)).sort()).toEqual([
+            "CustomField:Account.Name",
+            "CustomField:Account.Phone",
+        ]);
+        await store.close();
+    });
+    it("supports brace expansion: `Flow:{Lead,Account}_*`", async () => {
+        const store = await setupStore();
+        store.mergeNodes([
+            node("Flow", "Flow:Lead_Convert"),
+            node("Flow", "Flow:Lead_Score"),
+            node("Flow", "Flow:Account_Sync"),
+            node("Flow", "Flow:Opportunity_Close"),
+        ]);
+        const result = findNodesByGlob(store, ORG, "Flow:{Lead,Account}_*");
+        expect(result.matches.map((n) => String(n.qualifiedName)).sort()).toEqual([
+            "Flow:Account_Sync",
+            "Flow:Lead_Convert",
+            "Flow:Lead_Score",
+        ]);
+        await store.close();
+    });
+    it("returns truncated=true and caps results when matches exceed limit", async () => {
+        const store = await setupStore();
+        const nodes = [];
+        for (let i = 0; i < 600; i += 1) {
+            nodes.push(node("ApexClass", `ApexClass:Class${String(i).padStart(4, "0")}`));
+        }
+        store.mergeNodes(nodes);
+        const result = findNodesByGlob(store, ORG, "ApexClass:*", { limit: 500 });
+        expect(result.matches.length).toBe(500);
+        expect(result.total).toBe(600);
+        expect(result.truncated).toBe(true);
+        await store.close();
+    });
+    it("explicit label option short-circuits cross-label scan", async () => {
+        const store = await setupStore();
+        store.mergeNodes([
+            node("ApexClass", "ApexClass:Foo"),
+            node("CustomField", "CustomField:Account.Foo"),
+        ]);
+        const labelResult = findNodesByGlob(store, ORG, "*:Foo*", { label: "ApexClass" });
+        expect(labelResult.matches.length).toBe(1);
+        expect(String(labelResult.matches[0]?.qualifiedName)).toBe("ApexClass:Foo");
+        await store.close();
+    });
+    it("returns empty result with truncated=false when no matches", async () => {
+        const store = await setupStore();
+        store.mergeNodes([node("ApexClass", "ApexClass:Foo")]);
+        const result = findNodesByGlob(store, ORG, "Flow:*");
+        expect(result.matches).toEqual([]);
+        expect(result.total).toBe(0);
+        expect(result.truncated).toBe(false);
+        await store.close();
+    });
+    it("returns matches sorted lexicographically by qualifiedName", async () => {
+        const store = await setupStore();
+        store.mergeNodes([
+            node("ApexClass", "ApexClass:Zeta"),
+            node("ApexClass", "ApexClass:Alpha"),
+            node("ApexClass", "ApexClass:Beta"),
+        ]);
+        const result = findNodesByGlob(store, ORG, "ApexClass:*");
+        expect(result.matches.map((n) => String(n.qualifiedName))).toEqual([
+            "ApexClass:Alpha",
+            "ApexClass:Beta",
+            "ApexClass:Zeta",
+        ]);
+        await store.close();
+    });
+});
+//# sourceMappingURL=find-nodes.test.js.map

package/dist/analyze/__tests__/find-nodes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-nodes.test.js","sourceRoot":"","sources":["../../../src/analyze/__tests__/find-nodes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEhC,KAAK,UAAU,UAAU;IACvB,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnB,KAAK,CAAC,SAAS,CAAC;QACd,EAAE,EAAE,GAAG;QACP,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,sBAAsB;QACnC,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,KAAa;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,OAAO;QACL,KAAK,EAAE,GAAG;QACV,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC;QACrC,KAAK;QACL,UAAU,EAAE,EAAE;QACd,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC;QAC3B,WAAW,EAAE,EAAE;QACf,UAAU,EAAE,EAAE;QACd,cAAc,EAAE,EAAE;KACnB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC;YACf,IAAI,CAAC,WAAW,EAAE,6BAA6B,CAAC;YAChD,IAAI,CAAC,WAAW,EAAE,6BAA6B,CAAC;YAChD,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC;YAC3C,IAAI,CAAC,aAAa,EAAE,0BAA0B,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACxE,6BAA6B;YAC7B,6BAA6B;YAC7B,wBAAwB;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC;YACf,IAAI,CAAC,aAAa,EAAE,0BAA0B,CAAC;YAC/C,IAAI,CAAC,aAAa,EAAE,2BAA2B,CAAC;YAChD,IAAI,CAAC,aAAa,EAAE,2BAA2B,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACxE,0BAA0B;YAC1B,2BAA2B;SAC5B,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC;YACf,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC;YACjC,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACxE,mBAAmB;YACnB,mBAAmB;YACnB,iBAAiB;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC;YACf,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC;YAClC,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC;YACf,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC;YACnC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACjE,iBAAiB;YACjB,gBAAgB;YAChB,gBAAgB;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/analyze/__tests__/findings.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=findings.test.d.ts.map

package/dist/analyze/__tests__/findings.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.test.d.ts","sourceRoot":"","sources":["../../../src/analyze/__tests__/findings.test.ts"],"names":[],"mappings":""}

package/dist/analyze/__tests__/findings.test.js

@@ -0,0 +1,90 @@
+import { describe, expect, it } from "vitest";
+import { collectFindings, danglingEdgesToFindings, deadCodeToFindings, governorRisksToFindings, RULE_CATALOG, securityAuditToFindings, } from "../findings.js";
+describe("W3-01: Finding adapters", () => {
+    it("RULE_CATALOG includes every ruleId the adapters can emit", () => {
+        const referenced = new Set();
+        // Exercise every adapter on a representative input
+        governorRisksToFindings([
+            { qualifiedName: "X", risk: "soql_in_loop", evidence: "" },
+            { qualifiedName: "X", risk: "dml_in_loop", evidence: "" },
+            { qualifiedName: "X", risk: "unbounded_query", evidence: "" },
+            { qualifiedName: "X", risk: "no_bulk", evidence: "" },
+        ]).forEach((f) => referenced.add(f.ruleId));
+        securityAuditToFindings({
+            sharingFullAccess: ["CustomObject:X"],
+            flsGaps: ["CustomField:X.Y"],
+            fieldAccessMatrix: [],
+        }).forEach((f) => referenced.add(f.ruleId));
+        deadCodeToFindings([
+            {
+                orgId: "org",
+                qualifiedName: "X",
+                label: "ApexClass",
+                attributes: {},
+                sourceHash: "h",
+                firstSeenAt: 0,
+                lastSeenAt: 0,
+                lastModifiedAt: 0,
+            },
+        ]).forEach((f) => referenced.add(f.ruleId));
+        danglingEdgesToFindings({
+            totalEdges: 1,
+            danglingCount: 1,
+            byRel: {},
+            byDstPrefix: {},
+            sample: [{ src: "X", rel: "CALLS", dst: "Y" }],
+        }).forEach((f) => referenced.add(f.ruleId));
+        for (const id of referenced) {
+            expect(RULE_CATALOG[id], `RULE_CATALOG should contain ${id}`).toBeDefined();
+        }
+    });
+    it("governorRisksToFindings maps risk codes to dotted ruleIds", () => {
+        const risks = [
+            { qualifiedName: "ApexClass:Foo", risk: "soql_in_loop", evidence: "x" },
+            { qualifiedName: "ApexClass:Bar", risk: "dml_in_loop", evidence: "y" },
+        ];
+        const findings = governorRisksToFindings(risks);
+        expect(findings.map((f) => f.ruleId).sort()).toEqual([
+            "governor.dml-in-loop",
+            "governor.soql-in-loop",
+        ]);
+    });
+    it("securityAuditToFindings emits both fls-gap and sharing-full-access", () => {
+        const audit = {
+            sharingFullAccess: ["CustomObject:Account"],
+            flsGaps: ["CustomField:Account.SSN__c"],
+            fieldAccessMatrix: [],
+        };
+        const findings = securityAuditToFindings(audit);
+        const byId = new Map(findings.map((f) => [f.ruleId, f]));
+        expect(byId.get("security.fls-gap")?.location.qualifiedName).toBe("CustomField:Account.SSN__c");
+        expect(byId.get("security.sharing-full-access")?.location.qualifiedName).toBe("CustomObject:Account");
+    });
+    it("collectFindings merges multiple audit outputs into a single array", () => {
+        const findings = collectFindings({
+            governor: [{ qualifiedName: "X", risk: "soql_in_loop", evidence: "" }],
+            security: { sharingFullAccess: [], flsGaps: ["CustomField:X.Y"], fieldAccessMatrix: [] },
+        });
+        expect(findings.length).toBe(2);
+        expect(findings.map((f) => f.ruleId).sort()).toEqual([
+            "governor.soql-in-loop",
+            "security.fls-gap",
+        ]);
+    });
+    it("deadCodeToFindings preserves sourceUri from node attributes for SARIF physicalLocation", () => {
+        const findings = deadCodeToFindings([
+            {
+                orgId: "org",
+                qualifiedName: "ApexClass:Unused",
+                label: "ApexClass",
+                attributes: { sourceUri: "sf://org/ApexClass/Unused.cls" },
+                sourceHash: "h",
+                firstSeenAt: 0,
+                lastSeenAt: 0,
+                lastModifiedAt: 0,
+            },
+        ]);
+        expect(findings[0]?.location.sourceUri).toBe("sf://org/ApexClass/Unused.cls");
+    });
+});
+//# sourceMappingURL=findings.test.js.map

package/dist/analyze/__tests__/findings.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.test.js","sourceRoot":"","sources":["../../../src/analyze/__tests__/findings.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,YAAY,EACZ,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAKxB,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,mDAAmD;QACnD,uBAAuB,CAAC;YACtB,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC1D,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE;YACzD,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC7D,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE;SACtD,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,uBAAuB,CAAC;YACtB,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;YACrC,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,iBAAiB,EAAE,EAAE;SACtB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,kBAAkB,CAAC;YACjB;gBACE,KAAK,EAAE,KAAc;gBACrB,aAAa,EAAE,GAAY;gBAC3B,KAAK,EAAE,WAAW;gBAClB,UAAU,EAAE,EAAE;gBACd,UAAU,EAAE,GAAY;gBACxB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,CAAC;aAClB;SACF,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,uBAAuB,CAAC;YACtB,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SAC/C,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAE5C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,+BAA+B,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,KAAK,GAAmB;YAC5B,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,EAAE;YACvE,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE;SACvE,CAAC;QACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACnD,sBAAsB;YACtB,uBAAuB;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,KAAK,GAAkB;YAC3B,iBAAiB,EAAE,CAAC,sBAAsB,CAAC;YAC3C,OAAO,EAAE,CAAC,4BAA4B,CAAC;YACvC,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAC/D,4BAA4B,CAC7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,CAC3E,sBAAsB,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACtE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE;SAChD,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACnD,uBAAuB;YACvB,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC;gBACE,KAAK,EAAE,KAAc;gBACrB,aAAa,EAAE,kBAA2B;gBAC1C,KAAK,EAAE,WAAW;gBAClB,UAAU,EAAE,EAAE,SAAS,EAAE,+BAA+B,EAAE;gBAC1D,UAAU,EAAE,GAAY;gBACxB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,CAAC;aAClB;SACF,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/analyze/find-nodes.d.ts

@@ -0,0 +1,38 @@
+import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { NodeFact } from "../domain/index.js";
+import type { GraphStore } from "../storage/interfaces.js";
+/**
+ * Glob-pattern node lookup. Patterns use the conventional shell glob
+ * vocabulary (handled by picomatch):
+ *
+ *   - `*`   matches any non-separator characters
+ *   - `?`   matches a single character
+ *   - `**`  matches zero or more segments (separator = `.`)
+ *   - `[abc]` / `[a-z]` character classes
+ *   - `{a,b}` brace expansion
+ *
+ * The separator is `.` not `/` — node qualified names like
+ * `CustomField:Account.Name` make a dot-separator more natural than the
+ * Unix path-style. picomatch is configured accordingly.
+ *
+ * Result ordering: lexicographic by qualifiedName. The cap defaults to
+ * 500 with `truncated: true` set on overflow — at that scale the agent
+ * should refine the pattern rather than scan further.
+ */
+export interface FindNodesOpts {
+    /** When set, restrict matching to nodes of this label (e.g. `ApexClass`,
+     *  `CustomField`). Faster than scanning every label table when the
+     *  pattern is type-anchored. */
+    label?: string;
+    /** Result cap. Default 500. */
+    limit?: number;
+}
+export interface FindNodesResult {
+    matches: NodeFact[];
+    truncated: boolean;
+    /** Total matched before truncation (when truncated=false, equals
+     *  matches.length). */
+    total: number;
+}
+export declare function findNodesByGlob(store: GraphStore, orgId: OrgId, pattern: string, opts?: FindNodesOpts): FindNodesResult;
+//# sourceMappingURL=find-nodes.d.ts.map

package/dist/analyze/find-nodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-nodes.d.ts","sourceRoot":"","sources":["../../src/analyze/find-nodes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,aAAa;IAC5B;;oCAEgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB;2BACuB;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB,eAAe,CAkCjB"}

package/dist/analyze/find-nodes.js

@@ -0,0 +1,51 @@
+import picomatch from "picomatch";
+export function findNodesByGlob(store, orgId, pattern, opts = {}) {
+    const limit = Math.max(1, opts.limit ?? 500);
+    const matcher = picomatch(pattern, {
+        // Treat `.` as the separator so `apex.Class.*` matches everything inside
+        // the apex.Class.* namespace and `**` crosses dots.
+        dot: true,
+        nocase: false,
+        contains: false,
+        // Don't expand globstar to filesystem semantics — we just want it as
+        // "zero or more segments at this position."
+        bash: false,
+    });
+    const labels = opts.label ? [opts.label] : listAllLabels(store, orgId);
+    const allMatches = [];
+    for (const label of labels) {
+        // listNodesByLabel pages internally; passing a generous cap avoids
+        // truncation at the label level while still bounding memory on
+        // pathologically large labels (Salesforce orgs with 50k+ ApexClass
+        // nodes exist).
+        const nodes = store.listNodesByLabel(orgId, label, 50_000);
+        for (const n of nodes) {
+            if (matcher(String(n.qualifiedName)))
+                allMatches.push(n);
+        }
+    }
+    allMatches.sort((a, b) => String(a.qualifiedName).localeCompare(String(b.qualifiedName)));
+    const truncated = allMatches.length > limit;
+    return {
+        matches: truncated ? allMatches.slice(0, limit) : allMatches,
+        truncated,
+        total: allMatches.length,
+    };
+}
+/**
+ * List every distinct label the store knows about for this org. The
+ * GraphStore interface doesn't expose this directly; we read the
+ * label registry table that ensureNodeTable populates. Falls back to
+ * an empty list when the store doesn't expose the helper — caller can
+ * pass an explicit `label` to bypass.
+ */
+function listAllLabels(store, _orgId) {
+    // The SqliteGraphStore exposes a private nodeLabelCache; we read it
+    // through the public `listAllLabels()` method if present. Stores that
+    // don't implement it (test mocks) return [].
+    const s = store;
+    if (typeof s.listAllLabels === "function")
+        return s.listAllLabels();
+    return [];
+}
+//# sourceMappingURL=find-nodes.js.map

package/dist/analyze/find-nodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-nodes.js","sourceRoot":"","sources":["../../src/analyze/find-nodes.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAyClC,MAAM,UAAU,eAAe,CAC7B,KAAiB,EACjB,KAAY,EACZ,OAAe,EACf,OAAsB,EAAE;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE;QACjC,yEAAyE;QACzE,oDAAoD;QACpD,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,KAAK;QACf,qEAAqE;QACrE,4CAA4C;QAC5C,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,UAAU,GAAe,EAAE,CAAC;IAElC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,mEAAmE;QACnE,+DAA+D;QAC/D,mEAAmE;QACnE,gBAAgB;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU;QAC5D,SAAS;QACT,KAAK,EAAE,UAAU,CAAC,MAAM;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAiB,EAAE,MAAa;IACrD,oEAAoE;IACpE,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,CAAC,GAAG,KAAsD,CAAC;IACjE,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACpE,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/analyze/findings.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Canonical finding shape for everything in sfgraph that produces
+ * actionable diagnostics: governor-risk scan, security audit, dead-code
+ * audit, dangling-edge audit, future rule-engine outputs. Aligned with
+ * PMD's rule metadata vocabulary (name / message / description /
+ * priority / externalInfoUrl / properties) so the SARIF emitter can
+ * map a single shape rather than a switch over every producer.
+ *
+ * NOTE: the YAML files in parsers/rules/* are NOT lint rules — they're
+ * declarative metadata-to-graph extraction shortcuts. The Wave 3 plan's
+ * "PMD-aligned YAML rule schema" was a category error from the
+ * competitive analysis. The real PMD-aligned schema is this Finding
+ * type plus the rule catalog below — the producers stay where they are
+ * (analyze/governor.ts, analyze/security.ts, etc.) and emit Findings
+ * via the adapters in `findingAdapters` below.
+ */
+export type Severity = "error" | "warning" | "note";
+export interface FindingLocation {
+    /** Graph node qualified name that the finding is anchored to. */
+    qualifiedName: string;
+    /** Optional: file URI when the finding maps to a parsed source artifact. */
+    sourceUri?: string;
+    /** Optional: 1-indexed line / column for SARIF physicalLocation. */
+    line?: number;
+    column?: number;
+}
+export interface Finding {
+    /** PMD-style stable rule identifier, e.g. `governor.soql-in-loop`. */
+    ruleId: string;
+    /** One-line problem statement shown verbatim in SARIF / IDE diagnostics. */
+    message: string;
+    level: Severity;
+    /** Where the finding lives in the graph (and optionally in source). */
+    location: FindingLocation;
+    /** Free-form key/value pairs for downstream consumers (SARIF
+     *  `properties` bag carries this verbatim). */
+    properties?: Record<string, string | number | boolean | null>;
+}
+/**
+ * Static catalog of every rule sfgraph emits today. SARIF requires a rule
+ * definition (`reportingDescriptor`) for each unique `ruleId` referenced
+ * by a result, so we index findings against this map at emit time. New
+ * audits register their ruleIds here so SARIF stays valid without per-emit
+ * boilerplate.
+ *
+ * Fields mirror PMD's `name / description / priority / externalInfoUrl`:
+ * - `name`: short display name
+ * - `shortDescription`: 1-line summary
+ * - `fullDescription`: paragraph-length explanation (markdown ok)
+ * - `defaultLevel`: severity floor; per-Finding `level` can downgrade
+ * - `helpUri`: optional documentation link
+ */
+export interface RuleDescriptor {
+    id: string;
+    name: string;
+    shortDescription: string;
+    fullDescription: string;
+    defaultLevel: Severity;
+    helpUri?: string;
+}
+export declare const RULE_CATALOG: Record<string, RuleDescriptor>;
+import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { NodeFact } from "../domain/index.js";
+import { findDeadCode } from "./dead-code.js";
+import type { AuditResult } from "./audit-graph.js";
+import type { GovernorRisk } from "./governor.js";
+import type { SecurityAudit } from "./security.js";
+export declare function governorRisksToFindings(risks: GovernorRisk[]): Finding[];
+export declare function securityAuditToFindings(audit: SecurityAudit): Finding[];
+export declare function deadCodeToFindings(nodes: NodeFact[]): Finding[];
+export declare function danglingEdgesToFindings(audit: AuditResult): Finding[];
+/**
+ * Convenience: run every adapter against an org and return a unified
+ * Finding[]. Caller controls which audits to invoke and threads the
+ * GraphStore + orgId. SARIF emitter consumes this directly.
+ */
+export interface AllFindingsOpts {
+    governor?: GovernorRisk[];
+    security?: SecurityAudit;
+    deadCode?: NodeFact[];
+    dangling?: AuditResult;
+}
+export declare function collectFindings(opts: AllFindingsOpts): Finding[];
+export { findDeadCode };
+export type { OrgId };
+//# sourceMappingURL=findings.d.ts.map

package/dist/analyze/findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/analyze/findings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,QAAQ,CAAC;IAChB,uEAAuE;IACvE,QAAQ,EAAE,eAAe,CAAC;IAC1B;mDAC+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,QAAQ,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAiEvD,CAAC;AAMF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,CAQxE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAmBvE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAa/D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,EAAE,CAQrE;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,EAAE,CAOhE;AAID,OAAO,EAAE,YAAY,EAAE,CAAC;AACxB,YAAY,EAAE,KAAK,EAAE,CAAC"}

package/dist/analyze/findings.js

@@ -0,0 +1,143 @@
+/**
+ * Canonical finding shape for everything in sfgraph that produces
+ * actionable diagnostics: governor-risk scan, security audit, dead-code
+ * audit, dangling-edge audit, future rule-engine outputs. Aligned with
+ * PMD's rule metadata vocabulary (name / message / description /
+ * priority / externalInfoUrl / properties) so the SARIF emitter can
+ * map a single shape rather than a switch over every producer.
+ *
+ * NOTE: the YAML files in parsers/rules/* are NOT lint rules — they're
+ * declarative metadata-to-graph extraction shortcuts. The Wave 3 plan's
+ * "PMD-aligned YAML rule schema" was a category error from the
+ * competitive analysis. The real PMD-aligned schema is this Finding
+ * type plus the rule catalog below — the producers stay where they are
+ * (analyze/governor.ts, analyze/security.ts, etc.) and emit Findings
+ * via the adapters in `findingAdapters` below.
+ */
+export const RULE_CATALOG = {
+    "governor.soql-in-loop": {
+        id: "governor.soql-in-loop",
+        name: "SOQL in loop",
+        shortDescription: "Apex method executes SOQL inside a loop.",
+        fullDescription: "Detected via the `hasSoqlInLoop` attribute set by Apex parsing. Each loop iteration consumes one of the 100 SOQL queries the platform allows per transaction — bulkify by moving the query outside the loop and consuming the results inline.",
+        defaultLevel: "error",
+    },
+    "governor.dml-in-loop": {
+        id: "governor.dml-in-loop",
+        name: "DML in loop",
+        shortDescription: "Apex method executes DML inside a loop.",
+        fullDescription: "Detected via the `hasDmlInLoop` attribute set by Apex parsing. Each loop iteration consumes one of the 150 DML statements the platform allows per transaction — bulkify by collecting records into a list and committing once after the loop.",
+        defaultLevel: "error",
+    },
+    "governor.unbounded-query": {
+        id: "governor.unbounded-query",
+        name: "Unbounded query",
+        shortDescription: "Apex method runs SOQL with no LIMIT or WHERE.",
+        fullDescription: "Queries without a LIMIT or selective WHERE clause hit the 50,000-row query-row governor on large objects. Add a LIMIT or filter even if the developer believes the underlying data set is small.",
+        defaultLevel: "warning",
+    },
+    "governor.no-bulk": {
+        id: "governor.no-bulk",
+        name: "Trigger not bulk-safe",
+        shortDescription: "Trigger touches a single record per fire — fails on bulk DML.",
+        fullDescription: "Bulk DML produces triggers with up to 200 records in `Trigger.new`. Triggers that assume a single record will silently mis-process the other 199 — refactor to iterate over the collection.",
+        defaultLevel: "error",
+    },
+    "security.fls-gap": {
+        id: "security.fls-gap",
+        name: "Field-level security gap",
+        shortDescription: "CustomField has no FLS grant on any profile/permission set.",
+        fullDescription: "Fields with no FLS grant are invisible to every user in API and UI alike. Either remove the field if unused or grant access on the appropriate permission set.",
+        defaultLevel: "warning",
+    },
+    "security.sharing-full-access": {
+        id: "security.sharing-full-access",
+        name: "Object granted full access via sharing",
+        shortDescription: "OWD or sharing rule grants Modify All / View All to a broad audience.",
+        fullDescription: "Granting full access via OWD or sharing rules bypasses field-level security and CRUD checks. Review whether the audience genuinely needs unrestricted access; prefer scoped permission sets.",
+        defaultLevel: "warning",
+    },
+    "dead-code.unreferenced": {
+        id: "dead-code.unreferenced",
+        name: "Unreferenced metadata",
+        shortDescription: "Node has no incoming edges and is not an obvious entry point.",
+        fullDescription: "Apex/LWC/Flow components with no incoming references are candidates for deletion. Note that some entry points (AuraEnabled, REST endpoints, scheduled jobs) are only reachable from outside the org and will show up here legitimately — verify before deleting.",
+        defaultLevel: "note",
+    },
+    "graph.dangling-edge": {
+        id: "graph.dangling-edge",
+        name: "Dangling edge",
+        shortDescription: "Edge points to a destination node that doesn't exist in the graph.",
+        fullDescription: "Dangling edges usually indicate ingest gaps (a metadata type that didn't get extracted) or stale references (managed-package targets no longer installed). Investigate which extractor would own the missing dst label.",
+        defaultLevel: "note",
+    },
+};
+import { findDeadCode } from "./dead-code.js";
+export function governorRisksToFindings(risks) {
+    return risks.map((r) => ({
+        ruleId: `governor.${r.risk.replace(/_/g, "-")}`,
+        message: `${r.qualifiedName}: ${r.evidence}`,
+        level: RULE_CATALOG[`governor.${r.risk.replace(/_/g, "-")}`]?.defaultLevel ?? "warning",
+        location: { qualifiedName: r.qualifiedName },
+        properties: { evidence: r.evidence },
+    }));
+}
+export function securityAuditToFindings(audit) {
+    const out = [];
+    for (const gap of audit.flsGaps) {
+        out.push({
+            ruleId: "security.fls-gap",
+            message: `${gap}: no FLS grant on any profile/permission set`,
+            level: "warning",
+            location: { qualifiedName: gap },
+        });
+    }
+    for (const obj of audit.sharingFullAccess) {
+        out.push({
+            ruleId: "security.sharing-full-access",
+            message: `${obj}: granted full access via sharing rule or OWD`,
+            level: "warning",
+            location: { qualifiedName: obj },
+        });
+    }
+    return out;
+}
+export function deadCodeToFindings(nodes) {
+    return nodes.map((n) => ({
+        ruleId: "dead-code.unreferenced",
+        message: `${n.qualifiedName}: no incoming references`,
+        level: "note",
+        location: {
+            qualifiedName: String(n.qualifiedName),
+            ...(typeof n.attributes.sourceUri === "string"
+                ? { sourceUri: n.attributes.sourceUri }
+                : {}),
+        },
+        properties: { label: n.label },
+    }));
+}
+export function danglingEdgesToFindings(audit) {
+    return audit.sample.map((s) => ({
+        ruleId: "graph.dangling-edge",
+        message: `${s.src} --${s.rel}--> ${s.dst}: dst node missing`,
+        level: "note",
+        location: { qualifiedName: s.src },
+        properties: { relType: s.rel, danglingDst: s.dst },
+    }));
+}
+export function collectFindings(opts) {
+    const out = [];
+    if (opts.governor)
+        out.push(...governorRisksToFindings(opts.governor));
+    if (opts.security)
+        out.push(...securityAuditToFindings(opts.security));
+    if (opts.deadCode)
+        out.push(...deadCodeToFindings(opts.deadCode));
+    if (opts.dangling)
+        out.push(...danglingEdgesToFindings(opts.dangling));
+    return out;
+}
+// Re-export findDeadCode reference so callers don't need a separate import
+// when wiring up `collectFindings({ deadCode: findDeadCode(store, orgId), ... })`.
+export { findDeadCode };
+//# sourceMappingURL=findings.js.map

package/dist/analyze/findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/analyze/findings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAkDH,MAAM,CAAC,MAAM,YAAY,GAAmC;IAC1D,uBAAuB,EAAE;QACvB,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,cAAc;QACpB,gBAAgB,EAAE,0CAA0C;QAC5D,eAAe,EACb,+OAA+O;QACjP,YAAY,EAAE,OAAO;KACtB;IACD,sBAAsB,EAAE;QACtB,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,aAAa;QACnB,gBAAgB,EAAE,yCAAyC;QAC3D,eAAe,EACb,+OAA+O;QACjP,YAAY,EAAE,OAAO;KACtB;IACD,0BAA0B,EAAE;QAC1B,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,iBAAiB;QACvB,gBAAgB,EAAE,+CAA+C;QACjE,eAAe,EACb,kMAAkM;QACpM,YAAY,EAAE,SAAS;KACxB;IACD,kBAAkB,EAAE;QAClB,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,uBAAuB;QAC7B,gBAAgB,EAAE,+DAA+D;QACjF,eAAe,EACb,6LAA6L;QAC/L,YAAY,EAAE,OAAO;KACtB;IACD,kBAAkB,EAAE;QAClB,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,0BAA0B;QAChC,gBAAgB,EAAE,6DAA6D;QAC/E,eAAe,EACb,gKAAgK;QAClK,YAAY,EAAE,SAAS;KACxB;IACD,8BAA8B,EAAE;QAC9B,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE,wCAAwC;QAC9C,gBAAgB,EAAE,uEAAuE;QACzF,eAAe,EACb,8LAA8L;QAChM,YAAY,EAAE,SAAS;KACxB;IACD,wBAAwB,EAAE;QACxB,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,uBAAuB;QAC7B,gBAAgB,EAAE,+DAA+D;QACjF,eAAe,EACb,kQAAkQ;QACpQ,YAAY,EAAE,MAAM;KACrB;IACD,qBAAqB,EAAE;QACrB,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,eAAe;QACrB,gBAAgB,EAAE,oEAAoE;QACtF,eAAe,EACb,yNAAyN;QAC3N,YAAY,EAAE,MAAM;KACrB;CACF,CAAC;AAQF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAK9C,MAAM,UAAU,uBAAuB,CAAC,KAAqB;IAC3D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE;QAC/C,OAAO,EAAE,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,QAAQ,EAAE;QAC5C,KAAK,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,YAAY,IAAI,SAAS;QACvF,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE;QAC5C,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAoB;IAC1D,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,GAAG,GAAG,8CAA8C;YAC7D,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,8BAA8B;YACtC,OAAO,EAAE,GAAG,GAAG,+CAA+C;YAC9D,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,EAAE,wBAAwB;QAChC,OAAO,EAAE,GAAG,CAAC,CAAC,aAAa,0BAA0B;QACrD,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE;YACR,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,QAAQ;gBAC5C,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE;gBACvC,CAAC,CAAC,EAAE,CAAC;SACR;QACD,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;KAC/B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAkB;IACxD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,oBAAoB;QAC5D,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE;QAClC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;KACnD,CAAC,CAAC,CAAC;AACN,CAAC;AAcD,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,mFAAmF;AACnF,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/analyze/index.d.ts

@@ -12,4 +12,6 @@ export * from "./populate.js";
 export * from "./deployment-manifest/generate.js";
 export * from "./wip-impact.js";
 export * from "./audit-graph.js";
+export * from "./findings.js";
+export * from "./find-nodes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/analyze/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyze/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyze/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}

package/dist/analyze/index.js

@@ -12,4 +12,6 @@ export * from "./populate.js";
 export * from "./deployment-manifest/generate.js";
 export * from "./wip-impact.js";
 export * from "./audit-graph.js";
+export * from "./findings.js";
+export * from "./find-nodes.js";
 //# sourceMappingURL=index.js.map

package/dist/analyze/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analyze/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analyze/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,mCAAmC,CAAC;AAClD,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}