@ryanstark24/sfgraph-core 1.1.8 → 1.4.0

package/dist/analyze/audit-graph.d.ts

@@ -25,6 +25,16 @@ export interface DanglingEdgeSample {
 export interface AuditResult {
     totalEdges: number;
     danglingCount: number;
+    /** Dangling edges whose dst is a platform built-in that can never have a
+     *  metadata source: standard tabs (`CustomTab:standard-*`) and fields /
+     *  objects of standard-schema entities (no `__c`/`__mdt`/… suffix).
+     *  These are *expected* — the reference data is real and useful (e.g.
+     *  profile tab visibility), the target just isn't org metadata. Included
+     *  in `danglingCount`; broken out so the headline number isn't dominated
+     *  by ~60k standard-tab grants on a vanilla org. */
+    platformRefCount: number;
+    /** danglingCount - platformRefCount: the subset worth investigating. */
+    unexpectedCount: number;
     byRel: Record<string, number>;
     byDstPrefix: Record<string, number>;
     sample: DanglingEdgeSample[];
@@ -35,14 +45,28 @@ export interface AuditOpts {
     /** Hard upper bound on rows scanned per edge table. Default unlimited. */
     scanLimit?: number;
 }
+/** True when a dangling dst names a platform built-in that no extractor can
+ *  ever materialize: standard tabs, or fields/objects of standard-schema
+ *  entities (Incident, Location, Case, …) the org metadata pass doesn't
+ *  enumerate. Custom-suffixed targets are NEVER platform refs — a missing
+ *  `__c` target is a real gap worth surfacing. */
+export declare function isPlatformBuiltinRef(dst: string): boolean;
 export declare function auditDanglingEdges(store: GraphStore, orgIdIn: OrgId | string, opts?: AuditOpts): AuditResult;
 /**
- * Destructive companion to `auditDanglingEdges`: deletes every dangling edge.
+ * Destructive companion to `auditDanglingEdges`: deletes dangling edges.
  * Reserved for the CLI `--delete-dangling --yes` flag; callers must own the
  * authorization decision (we just do the work).
+ *
+ * Platform-builtin references (standard-tab grants, standard-schema field
+ * grants) are KEPT by default — they're real, queryable security data whose
+ * target simply has no metadata source. Pass `includePlatformRefs: true` to
+ * delete those too.
  */
-export declare function deleteDanglingEdges(store: GraphStore, orgIdIn: OrgId | string): {
+export declare function deleteDanglingEdges(store: GraphStore, orgIdIn: OrgId | string, opts?: {
+    includePlatformRefs?: boolean;
+}): {
     deleted: number;
+    keptPlatformRefs: number;
 };
 export type { EdgeFact };
 //# sourceMappingURL=audit-graph.d.ts.map

package/dist/analyze/audit-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-graph.d.ts","sourceRoot":"","sources":["../../src/analyze/audit-graph.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAiB,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAOD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,KAAK,GAAG,MAAM,EACvB,IAAI,GAAE,SAAc,GACnB,WAAW,CA8Bb;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,KAAK,GAAG,MAAM,GACtB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAgBrB;AAED,YAAY,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"audit-graph.d.ts","sourceRoot":"","sources":["../../src/analyze/audit-graph.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAiB,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;wDAMoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AASD;;;;kDAIkD;AAClD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAczD;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,KAAK,GAAG,MAAM,EACvB,IAAI,GAAE,SAAc,GACnB,WAAW,CA2Cb;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,KAAK,GAAG,MAAM,EACvB,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAqB/C;AAED,YAAY,EAAE,QAAQ,EAAE,CAAC"}

package/dist/analyze/audit-graph.js

@@ -3,6 +3,29 @@ function prefix(qname) {
     const idx = qname.indexOf(":");
     return idx > 0 ? qname.slice(0, idx) : "(unlabeled)";
 }
+const CUSTOM_SUFFIX_RE = /__(?:c|e|b|mdt|x|kav)$/i;
+/** True when a dangling dst names a platform built-in that no extractor can
+ *  ever materialize: standard tabs, or fields/objects of standard-schema
+ *  entities (Incident, Location, Case, …) the org metadata pass doesn't
+ *  enumerate. Custom-suffixed targets are NEVER platform refs — a missing
+ *  `__c` target is a real gap worth surfacing. */
+export function isPlatformBuiltinRef(dst) {
+    if (dst.startsWith("CustomTab:standard-"))
+        return true;
+    if (dst.startsWith("CustomField:")) {
+        const rest = dst.slice("CustomField:".length);
+        const dot = rest.indexOf(".");
+        if (dot <= 0)
+            return false;
+        const obj = rest.slice(0, dot);
+        const field = rest.slice(dot + 1);
+        return !CUSTOM_SUFFIX_RE.test(obj) && !CUSTOM_SUFFIX_RE.test(field);
+    }
+    if (dst.startsWith("CustomObject:")) {
+        return !CUSTOM_SUFFIX_RE.test(dst.slice("CustomObject:".length));
+    }
+    return false;
+}
 export function auditDanglingEdges(store, orgIdIn, opts = {}) {
     const orgId = typeof orgIdIn === "string" ? asOrgId(orgIdIn) : orgIdIn;
     // Clamp to ≥0; a negative slice index would silently return a tail of the
@@ -12,12 +35,24 @@ export function auditDanglingEdges(store, orgIdIn, opts = {}) {
     const dangling = store.listDanglingEdges(orgId, opts.scanLimit);
     const byRel = {};
     const byDstPrefix = {};
+    let platformRefCount = 0;
     for (const e of dangling) {
         byRel[e.relType] = (byRel[e.relType] ?? 0) + 1;
-        const p = prefix(String(e.dstQualifiedName));
+        const dst = String(e.dstQualifiedName);
+        const p = prefix(dst);
         byDstPrefix[p] = (byDstPrefix[p] ?? 0) + 1;
+        if (isPlatformBuiltinRef(dst))
+            platformRefCount += 1;
     }
-    const sample = dangling.slice(0, sampleSize).map((e) => ({
+    // Sample the *unexpected* dangling edges first — those are the ones a
+    // user can act on; platform refs only pad the sample once the unexpected
+    // set is smaller than sampleSize.
+    const unexpectedFirst = [...dangling].sort((a, b) => {
+        const ap = isPlatformBuiltinRef(String(a.dstQualifiedName)) ? 1 : 0;
+        const bp = isPlatformBuiltinRef(String(b.dstQualifiedName)) ? 1 : 0;
+        return ap - bp;
+    });
+    const sample = unexpectedFirst.slice(0, sampleSize).map((e) => ({
         src: String(e.srcQualifiedName),
         rel: String(e.relType),
         dst: String(e.dstQualifiedName),
@@ -25,26 +60,38 @@ export function auditDanglingEdges(store, orgIdIn, opts = {}) {
     return {
         totalEdges,
         danglingCount: dangling.length,
+        platformRefCount,
+        unexpectedCount: dangling.length - platformRefCount,
         byRel,
         byDstPrefix,
         sample,
     };
 }
 /**
- * Destructive companion to `auditDanglingEdges`: deletes every dangling edge.
+ * Destructive companion to `auditDanglingEdges`: deletes dangling edges.
  * Reserved for the CLI `--delete-dangling --yes` flag; callers must own the
  * authorization decision (we just do the work).
+ *
+ * Platform-builtin references (standard-tab grants, standard-schema field
+ * grants) are KEPT by default — they're real, queryable security data whose
+ * target simply has no metadata source. Pass `includePlatformRefs: true` to
+ * delete those too.
  */
-export function deleteDanglingEdges(store, orgIdIn) {
+export function deleteDanglingEdges(store, orgIdIn, opts = {}) {
     const orgId = typeof orgIdIn === "string" ? asOrgId(orgIdIn) : orgIdIn;
     const dangling = store.listDanglingEdges(orgId);
     let deleted = 0;
+    let keptPlatformRefs = 0;
     store.transaction(() => {
         for (const e of dangling) {
+            if (!opts.includePlatformRefs && isPlatformBuiltinRef(String(e.dstQualifiedName))) {
+                keptPlatformRefs += 1;
+                continue;
+            }
             store.deleteEdge(orgId, e.srcQualifiedName, e.dstQualifiedName, e.relType);
             deleted += 1;
         }
     });
-    return { deleted };
+    return { deleted, keptPlatformRefs };
 }
 //# sourceMappingURL=audit-graph.js.map

package/dist/analyze/audit-graph.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-graph.js","sourceRoot":"","sources":["../../src/analyze/audit-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AA0CtD,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,OAAuB,EACvB,OAAkB,EAAE;IAEpB,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC7C,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAyB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC/B,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;KAChC,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,UAAU;QACV,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,KAAK;QACL,WAAW;QACX,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAiB,EACjB,OAAuB;IAEvB,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QACrB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,KAAK,CAAC,UAAU,CACd,KAAK,EACL,CAAC,CAAC,gBAAiC,EACnC,CAAC,CAAC,gBAAiC,EACnC,CAAC,CAAC,OAAkB,CACrB,CAAC;YACF,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"audit-graph.js","sourceRoot":"","sources":["../../src/analyze/audit-graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAoDtD,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AACvD,CAAC;AAED,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD;;;;kDAIkD;AAClD,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,OAAuB,EACvB,OAAkB,EAAE;IAEpB,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,0EAA0E;IAC1E,8CAA8C;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,oBAAoB,CAAC,GAAG,CAAC;YAAE,gBAAgB,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,kCAAkC;IAClC,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAyB,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC/B,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;KAChC,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,UAAU;QACV,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,gBAAgB;QAChB,eAAe,EAAE,QAAQ,CAAC,MAAM,GAAG,gBAAgB;QACnD,KAAK;QACL,WAAW;QACX,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAiB,EACjB,OAAuB,EACvB,OAA0C,EAAE;IAE5C,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE;QACrB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBAClF,gBAAgB,IAAI,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,KAAK,CAAC,UAAU,CACd,KAAK,EACL,CAAC,CAAC,gBAAiC,EACnC,CAAC,CAAC,gBAAiC,EACnC,CAAC,CAAC,OAAkB,CACrB,CAAC;YACF,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AACvC,CAAC"}

package/dist/analyze/dependencies.d.ts

@@ -1,5 +1,5 @@
 import type { OrgId, QualifiedName } from "@ryanstark24/sfgraph-shared";
 import type { GraphStore } from "../storage/interfaces.js";
-import { type TraversalResult } from "./dependents.js";
-export declare function findDependencies(store: GraphStore, orgId: OrgId, qname: QualifiedName, depth?: number): TraversalResult;
+import { type TraversalOpts, type TraversalResult } from "./dependents.js";
+export declare function findDependencies(store: GraphStore, orgId: OrgId, qname: QualifiedName, depth?: number, opts?: TraversalOpts): TraversalResult;
 //# sourceMappingURL=dependencies.d.ts.map

package/dist/analyze/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/analyze/dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAA8B,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AASnF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,aAAa,EACpB,KAAK,SAAI,GACR,eAAe,CA6BjB"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../src/analyze/dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAUzB,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,aAAa,EACpB,KAAK,SAAI,EACT,IAAI,GAAE,aAAkB,GACvB,eAAe,CAkCjB"}

package/dist/analyze/dependencies.js

@@ -1,4 +1,5 @@
-import { TRAVERSAL_NODE_CAP_DEFAULT } from "./dependents.js";
+import { TRAVERSAL_NODE_CAP_DEFAULT, } from "./dependents.js";
+import { keepEdge } from "./edge-filters.js";
 function nodeCap() {
     const raw = process.env.SFGRAPH_TRAVERSAL_NODE_CAP;
     if (!raw)
@@ -6,7 +7,7 @@ function nodeCap() {
     const n = Number.parseInt(raw, 10);
     return Number.isFinite(n) && n > 0 ? n : TRAVERSAL_NODE_CAP_DEFAULT;
 }
-export function findDependencies(store, orgId, qname, depth = 3) {
+export function findDependencies(store, orgId, qname, depth = 3, opts = {}) {
     const cap = nodeCap();
     const visited = new Set();
     const nodes = [];
@@ -14,11 +15,16 @@ export function findDependencies(store, orgId, qname, depth = 3) {
     let frontier = [qname];
     visited.add(qname);
     let truncated = false;
+    let filtered = 0;
     bfs: for (let d = 0; d < depth && frontier.length > 0; d++) {
         const next = [];
         for (const cur of frontier) {
             const outgoing = store.listEdgesFrom(orgId, cur);
             for (const e of outgoing) {
+                if (!keepEdge(e, opts)) {
+                    filtered += 1;
+                    continue;
+                }
                 edges.push(e);
                 if (!visited.has(e.dstQualifiedName)) {
                     visited.add(e.dstQualifiedName);
@@ -35,6 +41,6 @@ export function findDependencies(store, orgId, qname, depth = 3) {
         }
         frontier = next;
     }
-    return { nodes, edges, truncated };
+    return { nodes, edges, truncated, filtered };
 }
 //# sourceMappingURL=dependencies.js.map

package/dist/analyze/dependencies.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../src/analyze/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAwB,MAAM,iBAAiB,CAAC;AAEnF,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAiB,EACjB,KAAY,EACZ,KAAoB,EACpB,KAAK,GAAG,CAAC;IAET,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAoB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAChC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBACnD,IAAI,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACrB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAC9B,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;wBACxB,SAAS,GAAG,IAAI,CAAC;wBACjB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../src/analyze/dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,0BAA0B,GAG3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAiB,EACjB,KAAY,EACZ,KAAoB,EACpB,KAAK,GAAG,CAAC,EACT,OAAsB,EAAE;IAExB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAoB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBACvB,QAAQ,IAAI,CAAC,CAAC;oBACd,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAChC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBACnD,IAAI,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACrB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAC9B,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;wBACxB,SAAS,GAAG,IAAI,CAAC;wBACjB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC"}

package/dist/analyze/dependents.d.ts

@@ -1,12 +1,17 @@
 import type { OrgId, QualifiedName } from "@ryanstark24/sfgraph-shared";
 import type { EdgeFact, NodeFact } from "../domain/index.js";
 import type { GraphStore } from "../storage/interfaces.js";
+import { type EdgeFilterOpts } from "./edge-filters.js";
 export interface TraversalResult {
     nodes: NodeFact[];
     edges: EdgeFact[];
     /** Set when the traversal hit `NODE_CAP` before exhausting the graph. */
     truncated?: boolean;
+    /** Edges dropped by the relType/security/reflection filter — surfaced so
+     *  the tool can tell the user "N security/inferred edges hidden". */
+    filtered?: number;
 }
+export type TraversalOpts = EdgeFilterOpts;
 /**
  * Hard ceiling on visited nodes per traversal. Prevents an agent — or a
  * crafted call — from blowing memory by asking for depth=5 on a hub like
@@ -15,5 +20,5 @@ export interface TraversalResult {
  * Override via `TRAVERSAL_NODE_CAP` env var if you really need more.
  */
 export declare const TRAVERSAL_NODE_CAP_DEFAULT = 500;
-export declare function findDependents(store: GraphStore, orgId: OrgId, qname: QualifiedName, depth?: number): TraversalResult;
+export declare function findDependents(store: GraphStore, orgId: OrgId, qname: QualifiedName, depth?: number, opts?: TraversalOpts): TraversalResult;
 //# sourceMappingURL=dependents.d.ts.map

package/dist/analyze/dependents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependents.d.ts","sourceRoot":"","sources":["../../src/analyze/dependents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,yEAAyE;IACzE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAQ9C,wBAAgB,cAAc,CAC5B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,aAAa,EACpB,KAAK,SAAI,GACR,eAAe,CA6BjB"}
+{"version":3,"file":"dependents.d.ts","sourceRoot":"","sources":["../../src/analyze/dependents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,KAAK,cAAc,EAAY,MAAM,mBAAmB,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,yEAAyE;IACzE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;yEACqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAQ9C,wBAAgB,cAAc,CAC5B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,aAAa,EACpB,KAAK,SAAI,EACT,IAAI,GAAE,aAAkB,GACvB,eAAe,CAsCjB"}

package/dist/analyze/dependents.js

@@ -1,3 +1,4 @@
+import { keepEdge } from "./edge-filters.js";
 /**
  * Hard ceiling on visited nodes per traversal. Prevents an agent — or a
  * crafted call — from blowing memory by asking for depth=5 on a hub like
@@ -13,7 +14,7 @@ function nodeCap() {
     const n = Number.parseInt(raw, 10);
     return Number.isFinite(n) && n > 0 ? n : TRAVERSAL_NODE_CAP_DEFAULT;
 }
-export function findDependents(store, orgId, qname, depth = 3) {
+export function findDependents(store, orgId, qname, depth = 3, opts = {}) {
     const cap = nodeCap();
     const visited = new Set();
     const nodes = [];
@@ -21,11 +22,20 @@ export function findDependents(store, orgId, qname, depth = 3) {
     let frontier = [qname];
     visited.add(qname);
     let truncated = false;
+    let filtered = 0;
     bfs: for (let d = 0; d < depth && frontier.length > 0; d++) {
         const next = [];
         for (const cur of frontier) {
             const incoming = store.listEdgesTo(orgId, cur);
             for (const e of incoming) {
+                // Filter noise (security grants / reflection inferences) before the
+                // edge contributes a node — otherwise a hub like a class granted to
+                // 100+ profiles blows the node cap on grant edges alone and the real
+                // dependency frontier never gets explored.
+                if (!keepEdge(e, opts)) {
+                    filtered += 1;
+                    continue;
+                }
                 edges.push(e);
                 if (!visited.has(e.srcQualifiedName)) {
                     visited.add(e.srcQualifiedName);
@@ -42,6 +52,6 @@ export function findDependents(store, orgId, qname, depth = 3) {
         }
         frontier = next;
     }
-    return { nodes, edges, truncated };
+    return { nodes, edges, truncated, filtered };
 }
 //# sourceMappingURL=dependents.js.map

package/dist/analyze/dependents.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependents.js","sourceRoot":"","sources":["../../src/analyze/dependents.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAiB,EACjB,KAAY,EACZ,KAAoB,EACpB,KAAK,GAAG,CAAC;IAET,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAoB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAChC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBACnD,IAAI,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACrB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAC9B,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;wBACxB,SAAS,GAAG,IAAI,CAAC;wBACjB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC"}
+{"version":3,"file":"dependents.js","sourceRoot":"","sources":["../../src/analyze/dependents.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAclE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAiB,EACjB,KAAY,EACZ,KAAoB,EACpB,KAAK,GAAG,CAAC,EACT,OAAsB,EAAE;IAExB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAoB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,2CAA2C;gBAC3C,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;oBACvB,QAAQ,IAAI,CAAC,CAAC;oBACd,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACrC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAChC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBACnD,IAAI,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACrB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAC9B,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;wBACxB,SAAS,GAAG,IAAI,CAAC;wBACjB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC"}

package/dist/analyze/edge-filters.d.ts

@@ -0,0 +1,37 @@
+import type { EdgeFact } from "../domain/index.js";
+/**
+ * Edge classification + filtering shared by the traversal tools
+ * (trace_upstream / trace_downstream).
+ *
+ * Real-org traces are dominated by two kinds of edge that are technically
+ * correct but almost never what "what depends on X / what does X depend on"
+ * is asking for:
+ *
+ *   1. Security grants — every Profile/PermissionSet that can see an Apex
+ *      class emits a GRANTS_APEX_ACCESS edge. A class used by 111 profiles
+ *      buries its single IS_TEST_FOR / CALLS edge under 111 grant edges.
+ *   2. Reflection-walker inferences — low-confidence REFERENCES edges tagged
+ *      `source: "reflection"`, emitted when a node's blob string happens to
+ *      match another node's bare name. On Vlocity nodes these produce
+ *      spurious links like DataRaptor:Foo → CustomApplication:DataRaptor.
+ *
+ * Dependency/dependent traces exclude both by default; callers can opt back
+ * in (a dedicated security view, or "show inferred references").
+ */
+/** Security / sharing grant edges — relationship of access, not of code dependency. */
+export declare const SECURITY_GRANT_RELTYPES: ReadonlySet<string>;
+/** True for a low-confidence reflection-walker REFERENCES edge. */
+export declare function isReflectionEdge(e: EdgeFact): boolean;
+export interface EdgeFilterOpts {
+    /** Only keep these relTypes (applied before excludes). */
+    includeRelTypes?: ReadonlySet<string>;
+    /** Drop these relTypes. */
+    excludeRelTypes?: ReadonlySet<string>;
+    /** Drop security/sharing grant edges. Default true for dependency traces. */
+    excludeSecurity?: boolean;
+    /** Drop reflection-inferred REFERENCES edges. Default true for traces. */
+    excludeReflection?: boolean;
+}
+/** Decide whether an edge survives the filter. */
+export declare function keepEdge(e: EdgeFact, opts: EdgeFilterOpts): boolean;
+//# sourceMappingURL=edge-filters.d.ts.map

package/dist/analyze/edge-filters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-filters.d.ts","sourceRoot":"","sources":["../../src/analyze/edge-filters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;;;;;;;;;;;;;;;;;GAkBG;AAEH,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAWtD,CAAC;AAEH,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO,CAKrD;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,2BAA2B;IAC3B,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,6EAA6E;IAC7E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,kDAAkD;AAClD,wBAAgB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAMnE"}

package/dist/analyze/edge-filters.js

@@ -0,0 +1,51 @@
+import { REL_TYPES } from "../domain/index.js";
+/**
+ * Edge classification + filtering shared by the traversal tools
+ * (trace_upstream / trace_downstream).
+ *
+ * Real-org traces are dominated by two kinds of edge that are technically
+ * correct but almost never what "what depends on X / what does X depend on"
+ * is asking for:
+ *
+ *   1. Security grants — every Profile/PermissionSet that can see an Apex
+ *      class emits a GRANTS_APEX_ACCESS edge. A class used by 111 profiles
+ *      buries its single IS_TEST_FOR / CALLS edge under 111 grant edges.
+ *   2. Reflection-walker inferences — low-confidence REFERENCES edges tagged
+ *      `source: "reflection"`, emitted when a node's blob string happens to
+ *      match another node's bare name. On Vlocity nodes these produce
+ *      spurious links like DataRaptor:Foo → CustomApplication:DataRaptor.
+ *
+ * Dependency/dependent traces exclude both by default; callers can opt back
+ * in (a dedicated security view, or "show inferred references").
+ */
+/** Security / sharing grant edges — relationship of access, not of code dependency. */
+export const SECURITY_GRANT_RELTYPES = new Set([
+    REL_TYPES.GRANTS_OBJECT_ACCESS,
+    REL_TYPES.GRANTS_FIELD_ACCESS,
+    REL_TYPES.GRANTS_APEX_ACCESS,
+    REL_TYPES.GRANTS_PAGE_ACCESS,
+    REL_TYPES.GRANTS_TAB_ACCESS,
+    REL_TYPES.GRANTS_USER_PERMISSION,
+    REL_TYPES.SHARING_GRANTS,
+    REL_TYPES.SHARING_TO_GROUP,
+    REL_TYPES.SHARING_TO_ROLE,
+    REL_TYPES.SHARING_FROM_OWNER_GROUP,
+]);
+/** True for a low-confidence reflection-walker REFERENCES edge. */
+export function isReflectionEdge(e) {
+    return (e.relType === REL_TYPES.REFERENCES &&
+        e.attributes?.source === "reflection");
+}
+/** Decide whether an edge survives the filter. */
+export function keepEdge(e, opts) {
+    if (opts.includeRelTypes && !opts.includeRelTypes.has(e.relType))
+        return false;
+    if (opts.excludeRelTypes?.has(e.relType))
+        return false;
+    if (opts.excludeSecurity !== false && SECURITY_GRANT_RELTYPES.has(e.relType))
+        return false;
+    if (opts.excludeReflection !== false && isReflectionEdge(e))
+        return false;
+    return true;
+}
+//# sourceMappingURL=edge-filters.js.map

package/dist/analyze/edge-filters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-filters.js","sourceRoot":"","sources":["../../src/analyze/edge-filters.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAClE,SAAS,CAAC,oBAAoB;IAC9B,SAAS,CAAC,mBAAmB;IAC7B,SAAS,CAAC,kBAAkB;IAC5B,SAAS,CAAC,kBAAkB;IAC5B,SAAS,CAAC,iBAAiB;IAC3B,SAAS,CAAC,sBAAsB;IAChC,SAAS,CAAC,cAAc;IACxB,SAAS,CAAC,gBAAgB;IAC1B,SAAS,CAAC,eAAe;IACzB,SAAS,CAAC,wBAAwB;CACnC,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,CAAW;IAC1C,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,UAAU;QACjC,CAAC,CAAC,UAA+C,EAAE,MAAM,KAAK,YAAY,CAC5E,CAAC;AACJ,CAAC;AAaD,kDAAkD;AAClD,MAAM,UAAU,QAAQ,CAAC,CAAW,EAAE,IAAoB;IACxD,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,IAAI,CAAC,eAAe,KAAK,KAAK,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,IAAI,gBAAgB,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/analyze/find-nodes.d.ts

@@ -0,0 +1,38 @@
+import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { NodeFact } from "../domain/index.js";
+import type { GraphStore } from "../storage/interfaces.js";
+/**
+ * Glob-pattern node lookup. Patterns use the conventional shell glob
+ * vocabulary (handled by picomatch):
+ *
+ *   - `*`   matches any non-separator characters
+ *   - `?`   matches a single character
+ *   - `**`  matches zero or more segments (separator = `.`)
+ *   - `[abc]` / `[a-z]` character classes
+ *   - `{a,b}` brace expansion
+ *
+ * The separator is `.` not `/` — node qualified names like
+ * `CustomField:Account.Name` make a dot-separator more natural than the
+ * Unix path-style. picomatch is configured accordingly.
+ *
+ * Result ordering: lexicographic by qualifiedName. The cap defaults to
+ * 500 with `truncated: true` set on overflow — at that scale the agent
+ * should refine the pattern rather than scan further.
+ */
+export interface FindNodesOpts {
+    /** When set, restrict matching to nodes of this label (e.g. `ApexClass`,
+     *  `CustomField`). Faster than scanning every label table when the
+     *  pattern is type-anchored. */
+    label?: string;
+    /** Result cap. Default 500. */
+    limit?: number;
+}
+export interface FindNodesResult {
+    matches: NodeFact[];
+    truncated: boolean;
+    /** Total matched before truncation (when truncated=false, equals
+     *  matches.length). */
+    total: number;
+}
+export declare function findNodesByGlob(store: GraphStore, orgId: OrgId, pattern: string, opts?: FindNodesOpts): FindNodesResult;
+//# sourceMappingURL=find-nodes.d.ts.map

package/dist/analyze/find-nodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-nodes.d.ts","sourceRoot":"","sources":["../../src/analyze/find-nodes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,aAAa;IAC5B;;oCAEgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB;2BACuB;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB,eAAe,CAkCjB"}

package/dist/analyze/find-nodes.js

@@ -0,0 +1,51 @@
+import picomatch from "picomatch";
+export function findNodesByGlob(store, orgId, pattern, opts = {}) {
+    const limit = Math.max(1, opts.limit ?? 500);
+    const matcher = picomatch(pattern, {
+        // Treat `.` as the separator so `apex.Class.*` matches everything inside
+        // the apex.Class.* namespace and `**` crosses dots.
+        dot: true,
+        nocase: false,
+        contains: false,
+        // Don't expand globstar to filesystem semantics — we just want it as
+        // "zero or more segments at this position."
+        bash: false,
+    });
+    const labels = opts.label ? [opts.label] : listAllLabels(store, orgId);
+    const allMatches = [];
+    for (const label of labels) {
+        // listNodesByLabel pages internally; passing a generous cap avoids
+        // truncation at the label level while still bounding memory on
+        // pathologically large labels (Salesforce orgs with 50k+ ApexClass
+        // nodes exist).
+        const nodes = store.listNodesByLabel(orgId, label, 50_000);
+        for (const n of nodes) {
+            if (matcher(String(n.qualifiedName)))
+                allMatches.push(n);
+        }
+    }
+    allMatches.sort((a, b) => String(a.qualifiedName).localeCompare(String(b.qualifiedName)));
+    const truncated = allMatches.length > limit;
+    return {
+        matches: truncated ? allMatches.slice(0, limit) : allMatches,
+        truncated,
+        total: allMatches.length,
+    };
+}
+/**
+ * List every distinct label the store knows about for this org. The
+ * GraphStore interface doesn't expose this directly; we read the
+ * label registry table that ensureNodeTable populates. Falls back to
+ * an empty list when the store doesn't expose the helper — caller can
+ * pass an explicit `label` to bypass.
+ */
+function listAllLabels(store, _orgId) {
+    // The SqliteGraphStore exposes a private nodeLabelCache; we read it
+    // through the public `listAllLabels()` method if present. Stores that
+    // don't implement it (test mocks) return [].
+    const s = store;
+    if (typeof s.listAllLabels === "function")
+        return s.listAllLabels();
+    return [];
+}
+//# sourceMappingURL=find-nodes.js.map

package/dist/analyze/find-nodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-nodes.js","sourceRoot":"","sources":["../../src/analyze/find-nodes.ts"],"names":[],"mappings":"AACA,OAAO,SAAS,MAAM,WAAW,CAAC;AAwClC,MAAM,UAAU,eAAe,CAC7B,KAAiB,EACjB,KAAY,EACZ,OAAe,EACf,OAAsB,EAAE;IAExB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE;QACjC,yEAAyE;QACzE,oDAAoD;QACpD,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,KAAK;QACf,qEAAqE;QACrE,4CAA4C;QAC5C,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,UAAU,GAAe,EAAE,CAAC;IAElC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,mEAAmE;QACnE,+DAA+D;QAC/D,mEAAmE;QACnE,gBAAgB;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,GAAG,KAAK,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU;QAC5D,SAAS;QACT,KAAK,EAAE,UAAU,CAAC,MAAM;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAiB,EAAE,MAAa;IACrD,oEAAoE;IACpE,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,CAAC,GAAG,KAAsD,CAAC;IACjE,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IACpE,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/analyze/findings.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Canonical finding shape for everything in sfgraph that produces
+ * actionable diagnostics: governor-risk scan, security audit, dead-code
+ * audit, dangling-edge audit, future rule-engine outputs. Aligned with
+ * PMD's rule metadata vocabulary (name / message / description /
+ * priority / externalInfoUrl / properties) so the SARIF emitter can
+ * map a single shape rather than a switch over every producer.
+ *
+ * NOTE: the YAML files in parsers/rules/* are NOT lint rules — they're
+ * declarative metadata-to-graph extraction shortcuts. The Wave 3 plan's
+ * "PMD-aligned YAML rule schema" was a category error from the
+ * competitive analysis. The real PMD-aligned schema is this Finding
+ * type plus the rule catalog below — the producers stay where they are
+ * (analyze/governor.ts, analyze/security.ts, etc.) and emit Findings
+ * via the adapters in `findingAdapters` below.
+ */
+export type Severity = "error" | "warning" | "note";
+export interface FindingLocation {
+    /** Graph node qualified name that the finding is anchored to. */
+    qualifiedName: string;
+    /** Optional: file URI when the finding maps to a parsed source artifact. */
+    sourceUri?: string;
+    /** Optional: 1-indexed line / column for SARIF physicalLocation. */
+    line?: number;
+    column?: number;
+}
+export interface Finding {
+    /** PMD-style stable rule identifier, e.g. `governor.soql-in-loop`. */
+    ruleId: string;
+    /** One-line problem statement shown verbatim in SARIF / IDE diagnostics. */
+    message: string;
+    level: Severity;
+    /** Where the finding lives in the graph (and optionally in source). */
+    location: FindingLocation;
+    /** Free-form key/value pairs for downstream consumers (SARIF
+     *  `properties` bag carries this verbatim). */
+    properties?: Record<string, string | number | boolean | null>;
+}
+/**
+ * Static catalog of every rule sfgraph emits today. SARIF requires a rule
+ * definition (`reportingDescriptor`) for each unique `ruleId` referenced
+ * by a result, so we index findings against this map at emit time. New
+ * audits register their ruleIds here so SARIF stays valid without per-emit
+ * boilerplate.
+ *
+ * Fields mirror PMD's `name / description / priority / externalInfoUrl`:
+ * - `name`: short display name
+ * - `shortDescription`: 1-line summary
+ * - `fullDescription`: paragraph-length explanation (markdown ok)
+ * - `defaultLevel`: severity floor; per-Finding `level` can downgrade
+ * - `helpUri`: optional documentation link
+ */
+export interface RuleDescriptor {
+    id: string;
+    name: string;
+    shortDescription: string;
+    fullDescription: string;
+    defaultLevel: Severity;
+    helpUri?: string;
+}
+export declare const RULE_CATALOG: Record<string, RuleDescriptor>;
+import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { NodeFact } from "../domain/index.js";
+import type { AuditResult } from "./audit-graph.js";
+import { findDeadCode } from "./dead-code.js";
+import type { GovernorRisk } from "./governor.js";
+import type { SecurityAudit } from "./security.js";
+export declare function governorRisksToFindings(risks: GovernorRisk[]): Finding[];
+export declare function securityAuditToFindings(audit: SecurityAudit): Finding[];
+export declare function deadCodeToFindings(nodes: NodeFact[]): Finding[];
+export declare function danglingEdgesToFindings(audit: AuditResult): Finding[];
+/**
+ * Convenience: run every adapter against an org and return a unified
+ * Finding[]. Caller controls which audits to invoke and threads the
+ * GraphStore + orgId. SARIF emitter consumes this directly.
+ */
+export interface AllFindingsOpts {
+    governor?: GovernorRisk[];
+    security?: SecurityAudit;
+    deadCode?: NodeFact[];
+    dangling?: AuditResult;
+}
+export declare function collectFindings(opts: AllFindingsOpts): Finding[];
+export { findDeadCode };
+export type { OrgId };
+//# sourceMappingURL=findings.d.ts.map

package/dist/analyze/findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/analyze/findings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,QAAQ,CAAC;IAChB,uEAAuE;IACvE,QAAQ,EAAE,eAAe,CAAC;IAC1B;mDAC+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,QAAQ,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAiEvD,CAAC;AAMF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,CAQxE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAmBvE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAW/D;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,EAAE,CAQrE;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,EAAE,CAOhE;AAID,OAAO,EAAE,YAAY,EAAE,CAAC;AACxB,YAAY,EAAE,KAAK,EAAE,CAAC"}