@ryanstark24/sfgraph-core 1.2.0 → 1.6.0

package/dist/analyze/apex-platform.d.ts

@@ -0,0 +1,23 @@
+import { APEX_PLATFORM_NAMESPACES } from "../domain/apex-platform.js";
+/** The one shared list lives in domain/apex-platform.ts (the parser uses it too). */
+export { APEX_PLATFORM_NAMESPACES };
+/**
+ * The dangling-edge audit's platform set: the ORIGINAL 76-entry core list,
+ * deliberately narrower than `APEX_PLATFORM_NAMESPACES` (the parser's
+ * 200-entry superset). The audit decides whether a dangling ApexClass /
+ * ApexInterface / ApexMethod target is an expected platform ref or a missing
+ * org class; the superset holds common words (Location, Request, Domain,
+ * Page, ...) that are also typical user class names, and calling those
+ * "expected platform" would hide real missing classes. The trace pseudo
+ * filter keeps the superset because it also requires that no org class of
+ * that name exists (`hasClass`). Lower-cased.
+ */
+export declare const AUDIT_PLATFORM_CORE: ReadonlySet<string>;
+/**
+ * True for an ApexClass / ApexInterface / ApexMethod qname whose class part
+ * is an Apex platform class or namespace (`ApexMethod:Database.query(1)`,
+ * `ApexClass:System`). Name-only: callers that can see the node row should
+ * also require that it has none.
+ */
+export declare function isApexPlatformQname(qname: string): boolean;
+//# sourceMappingURL=apex-platform.d.ts.map

package/dist/analyze/apex-platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apex-platform.d.ts","sourceRoot":"","sources":["../../src/analyze/apex-platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,qFAAqF;AACrF,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CA+EnD,CAAC;AAOF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM1D"}

package/dist/analyze/apex-platform.js

@@ -0,0 +1,112 @@
+import { APEX_PLATFORM_NAMESPACES } from "../domain/apex-platform.js";
+/** The one shared list lives in domain/apex-platform.ts (the parser uses it too). */
+export { APEX_PLATFORM_NAMESPACES };
+/**
+ * The dangling-edge audit's platform set: the ORIGINAL 76-entry core list,
+ * deliberately narrower than `APEX_PLATFORM_NAMESPACES` (the parser's
+ * 200-entry superset). The audit decides whether a dangling ApexClass /
+ * ApexInterface / ApexMethod target is an expected platform ref or a missing
+ * org class; the superset holds common words (Location, Request, Domain,
+ * Page, ...) that are also typical user class names, and calling those
+ * "expected platform" would hide real missing classes. The trace pseudo
+ * filter keeps the superset because it also requires that no org class of
+ * that name exists (`hasClass`). Lower-cased.
+ */
+export const AUDIT_PLATFORM_CORE = new Set([
+    "System",
+    "Assert",
+    "Database",
+    "Schema",
+    "Test",
+    "Limits",
+    "UserInfo",
+    "Math",
+    "String",
+    "Integer",
+    "Long",
+    "Decimal",
+    "Double",
+    "Boolean",
+    "Date",
+    "Datetime",
+    "Time",
+    "TimeZone",
+    "Blob",
+    "Id",
+    "Object",
+    "List",
+    "Map",
+    "Set",
+    "JSON",
+    "JSONParser",
+    "JSONGenerator",
+    "Type",
+    "Url",
+    "Pattern",
+    "Matcher",
+    "Crypto",
+    "EncodingUtil",
+    "Http",
+    "HttpRequest",
+    "HttpResponse",
+    "Messaging",
+    "ApexPages",
+    "PageReference",
+    "Site",
+    "Network",
+    "Label",
+    "Approval",
+    "Auth",
+    "Cache",
+    "ConnectApi",
+    "EventBus",
+    "Flow",
+    "Process",
+    "QuickAction",
+    "Search",
+    "Security",
+    "Trigger",
+    "Exception",
+    "DmlException",
+    "QueryException",
+    "Dom",
+    "XmlStreamReader",
+    "XmlStreamWriter",
+    "SObject",
+    "SObjectType",
+    "SObjectField",
+    "DescribeSObjectResult",
+    "DescribeFieldResult",
+    "Queueable",
+    "Schedulable",
+    "Batchable",
+    "Iterable",
+    "Iterator",
+    "Comparable",
+    "Callable",
+    "Savepoint",
+    "Reports",
+    "Metadata",
+    "Canvas",
+    "Invocable",
+].map((c) => c.toLowerCase()));
+/** First dotted segment of a qname's name part (`ApexMethod:System.debug(1)` -> `System`). */
+function headOfName(name) {
+    return name.split(/[.(]/, 1)[0] ?? name;
+}
+/**
+ * True for an ApexClass / ApexInterface / ApexMethod qname whose class part
+ * is an Apex platform class or namespace (`ApexMethod:Database.query(1)`,
+ * `ApexClass:System`). Name-only: callers that can see the node row should
+ * also require that it has none.
+ */
+export function isApexPlatformQname(qname) {
+    const i = qname.indexOf(":");
+    if (i <= 0)
+        return false;
+    const label = qname.slice(0, i);
+    if (label !== "ApexClass" && label !== "ApexInterface" && label !== "ApexMethod")
+        return false;
+    return APEX_PLATFORM_NAMESPACES.has(headOfName(qname.slice(i + 1)).toLowerCase());
+}
+//# sourceMappingURL=apex-platform.js.map

package/dist/analyze/apex-platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apex-platform.js","sourceRoot":"","sources":["../../src/analyze/apex-platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,qFAAqF;AACrF,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAC7D;IACE,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;IACV,MAAM;IACN,UAAU;IACV,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,YAAY;IACZ,eAAe;IACf,MAAM;IACN,KAAK;IACL,SAAS;IACT,SAAS;IACT,QAAQ;IACR,cAAc;IACd,MAAM;IACN,aAAa;IACb,cAAc;IACd,WAAW;IACX,WAAW;IACX,eAAe;IACf,MAAM;IACN,SAAS;IACT,OAAO;IACP,UAAU;IACV,MAAM;IACN,OAAO;IACP,YAAY;IACZ,UAAU;IACV,MAAM;IACN,SAAS;IACT,aAAa;IACb,QAAQ;IACR,UAAU;IACV,SAAS;IACT,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,KAAK;IACL,iBAAiB;IACjB,iBAAiB;IACjB,SAAS;IACT,aAAa;IACb,cAAc;IACd,uBAAuB;IACvB,qBAAqB;IACrB,WAAW;IACX,aAAa;IACb,WAAW;IACX,UAAU;IACV,UAAU;IACV,YAAY;IACZ,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,QAAQ;IACR,WAAW;CACZ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC9B,CAAC;AAEF,8FAA8F;AAC9F,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/F,OAAO,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACpF,CAAC"}

package/dist/analyze/audit-graph.d.ts

@@ -1,5 +1,5 @@
 import type { OrgId } from "@ryanstark24/sfgraph-shared";
-import type { EdgeFact } from "../domain/index.js";
+import { type EdgeFact } from "../domain/index.js";
 import type { GraphStore } from "../storage/interfaces.js";
 /**
  * Edges whose `dst` qualified name has no matching node row. Surfaced
@@ -25,6 +25,16 @@ export interface DanglingEdgeSample {
 export interface AuditResult {
     totalEdges: number;
     danglingCount: number;
+    /** Dangling edges whose dst can never have a source in the org's own
+     *  metadata (`isPlatformBuiltinRef`): standard tabs, standard objects and
+     *  fields, managed-package metadata and Apex platform classes.
+     *  These are *expected* — the reference data is real and useful (e.g.
+     *  profile tab visibility), the target just isn't org metadata. Included
+     *  in `danglingCount`; broken out so the headline number isn't dominated
+     *  by ~60k standard-tab grants on a vanilla org. */
+    platformRefCount: number;
+    /** danglingCount - platformRefCount: the subset worth investigating. */
+    unexpectedCount: number;
     byRel: Record<string, number>;
     byDstPrefix: Record<string, number>;
     sample: DanglingEdgeSample[];
@@ -35,14 +45,52 @@ export interface AuditOpts {
     /** Hard upper bound on rows scanned per edge table. Default unlimited. */
     scanLimit?: number;
 }
+/**
+ * Namespaces the refs themselves use in `<ns>__Name` form (any dotted
+ * segment of the name). Apex writes a managed type as `ns.Type`
+ * (`vlocity_cmt.VlocityOpenInterface`), which is not distinguishable from an
+ * inner class `Outer.Inner` by syntax alone; a head the same org also uses as
+ * `ns__` is a namespace.
+ */
+export declare function namespacesIn(dsts: Iterable<string>): Set<string>;
+/** True when a dangling dst names something no extractor of the org's own
+ *  source can ever materialize:
+ *   - standard tabs (`CustomTab:standard-*`);
+ *   - standard-schema objects (no custom suffix) and their unsuffixed fields;
+ *     on a custom object only its real standard fields (`X__c.Name`,
+ *     `X__c.OwnerId`, `Y__mdt.DeveloperName`, ...);
+ *   - managed-package metadata (`<ns>__Name`, `<ns>__Obj__c.<ns>__F__c`, and
+ *     `ns.Type` for a namespace in `knownNamespaces` or the
+ *     `%vlocity_namespace%` placeholder);
+ *   - Apex platform classes and calls into them (`System.assertEquals`,
+ *     `Assert.areEqual`);
+ *   - standard DOM events (`LWCEvent:click`).
+ *  Custom-suffixed, unnamespaced targets are NEVER platform refs — a missing
+ *  `__c` target is a real gap worth surfacing — and neither is an empty
+ *  object or field name, which is a parser bug (`CustomObject:`). */
+export declare function isPlatformBuiltinRef(dst: string, knownNamespaces?: ReadonlySet<string>, customSettings?: ReadonlySet<string>): boolean;
+/** Edge-level classification: `isPlatformBuiltinRef` on the target, plus
+ *  what only the edge knows. A `lightning-*` tag is a base component
+ *  (`LWC:button` from `<lightning-button>`); an `IS_TEST_FOR` target is
+ *  always an org class, so a dangling one is a parser gap even when its name
+ *  is a platform class (`ApexClass:Test` from `Test.startTest()`). */
+export declare function isExpectedDanglingEdge(e: Pick<EdgeFact, "relType" | "dstQualifiedName" | "attributes">, knownNamespaces?: ReadonlySet<string>, customSettings?: ReadonlySet<string>): boolean;
 export declare function auditDanglingEdges(store: GraphStore, orgIdIn: OrgId | string, opts?: AuditOpts): AuditResult;
 /**
- * Destructive companion to `auditDanglingEdges`: deletes every dangling edge.
+ * Destructive companion to `auditDanglingEdges`: deletes dangling edges.
  * Reserved for the CLI `--delete-dangling --yes` flag; callers must own the
  * authorization decision (we just do the work).
+ *
+ * Platform-builtin references (standard-tab grants, standard-schema field
+ * grants) are KEPT by default — they're real, queryable security data whose
+ * target simply has no metadata source. Pass `includePlatformRefs: true` to
+ * delete those too.
  */
-export declare function deleteDanglingEdges(store: GraphStore, orgIdIn: OrgId | string): {
+export declare function deleteDanglingEdges(store: GraphStore, orgIdIn: OrgId | string, opts?: {
+    includePlatformRefs?: boolean;
+}): {
     deleted: number;
+    keptPlatformRefs: number;
 };
 export type { EdgeFact };
 //# sourceMappingURL=audit-graph.d.ts.map

package/dist/analyze/audit-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-graph.d.ts","sourceRoot":"","sources":["../../src/analyze/audit-graph.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAiB,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAOD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,KAAK,GAAG,MAAM,EACvB,IAAI,GAAE,SAAc,GACnB,WAAW,CA8Bb;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,KAAK,GAAG,MAAM,GACtB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAgBrB;AAED,YAAY,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"audit-graph.d.ts","sourceRoot":"","sources":["../../src/analyze/audit-graph.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAiB,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,KAAK,QAAQ,EAA2B,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAmB,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAG5E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;wDAMoD;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAUhE;AA6GD;;;;;;;;;;;;;;qEAcqE;AACrE,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,eAAe,GAAE,WAAW,CAAC,MAAM,CAAa,EAChD,cAAc,GAAE,WAAW,CAAC,MAAM,CAAa,GAC9C,OAAO,CAyCT;AAED;;;;sEAIsE;AACtE,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,kBAAkB,GAAG,YAAY,CAAC,EAChE,eAAe,GAAE,WAAW,CAAC,MAAM,CAAa,EAChD,cAAc,GAAE,WAAW,CAAC,MAAM,CAAa,GAC9C,OAAO,CAKT;AA0DD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,KAAK,GAAG,MAAM,EACvB,IAAI,GAAE,SAAc,GACnB,WAAW,CA2Eb;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,KAAK,GAAG,MAAM,EACvB,IAAI,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAqB/C;AAED,YAAY,EAAE,QAAQ,EAAE,CAAC"}

package/dist/analyze/audit-graph.js

@@ -1,50 +1,418 @@
-import { asOrgId } from "@ryanstark24/sfgraph-shared";
+import { asOrgId, asQualifiedName } from "@ryanstark24/sfgraph-shared";
+import { REL_TYPES } from "../domain/index.js";
+import { AUDIT_PLATFORM_CORE } from "./apex-platform.js";
 function prefix(qname) {
     const idx = qname.indexOf(":");
     return idx > 0 ? qname.slice(0, idx) : "(unlabeled)";
 }
+const CUSTOM_SUFFIX_RE = /__(?:c|e|b|mdt|x|kav)$/i;
+/** The DataPack namespace placeholder, in `__` and dotted form alike. */
+const NS_PLACEHOLDER = "%vlocity_namespace%";
+const NS_IDENT_RE = /^(?:%vlocity_namespace%|[A-Za-z][A-Za-z0-9]*(?:_[A-Za-z0-9]+)*)$/i;
+const NAME_SEG_RE = /^[A-Za-z0-9]/;
+/** Suffixes of a named member (`ns__Name__c`, `ns__Parent__r`, `ns__Ext__x`). */
+const MEMBER_SUFFIXES = new Set(["c", "r", "x", "mdt", "e", "b", "kav"]);
+/** Tails that make a single-segment `X__tail` an unmanaged name: the member
+ *  suffixes plus relationship, geolocation and derived-object tails
+ *  (`CaseId__r`, `Loc__s`, `Foo__History`, `Foo__Share`, `City__cy`). */
+const UNMANAGED_TAILS = new Set([
+    ...MEMBER_SUFFIXES,
+    "s",
+    "share",
+    "history",
+    "feed",
+    "changeevent",
+    "tag",
+    "cy",
+]);
+/** `name` split at `__` when its head is a namespace-shaped identifier. */
+function managedParts(name) {
+    const segs = name.split("__");
+    if (segs.length < 2)
+        return null;
+    if (!NS_IDENT_RE.test(segs[0] ?? ""))
+        return null;
+    if (!segs.slice(1).every((x) => NAME_SEG_RE.test(x)))
+        return null;
+    return segs;
+}
+/** A managed-package name: `<ns>__Name`, or `<ns>__Name__<tail>`. Unmanaged
+ *  API names carry `__` only before a suffix (Apex identifiers cannot contain
+ *  `__` at all), so a single-segment `X__tail` is unmanaged when the tail is a
+ *  member, relationship or derived-object suffix (`CaseId__r`, `Foo__History`).
+ *  `%vlocity_namespace%` is the DataPack placeholder for the Vlocity one. */
+function isNamespaced(name) {
+    const segs = managedParts(name);
+    if (!segs)
+        return false;
+    if (segs.length >= 3)
+        return true;
+    if ((segs[0] ?? "").toLowerCase() === NS_PLACEHOLDER)
+        return true;
+    return !UNMANAGED_TAILS.has((segs[1] ?? "").toLowerCase());
+}
+/** The namespace a name proves, lower-cased, or null. Only the strict member
+ *  form counts: `ns__Name__<suffix>` with a member suffix (`__c`, `__r`,
+ *  `__x`, `__mdt`, ...), or the placeholder. */
+function namespaceOf(name) {
+    const segs = managedParts(name);
+    if (!segs)
+        return null;
+    const ns = (segs[0] ?? "").toLowerCase();
+    if (ns === NS_PLACEHOLDER)
+        return ns;
+    if (segs.length !== 3)
+        return null;
+    return MEMBER_SUFFIXES.has((segs[2] ?? "").toLowerCase()) ? ns : null;
+}
+/**
+ * Namespaces the refs themselves use in `<ns>__Name` form (any dotted
+ * segment of the name). Apex writes a managed type as `ns.Type`
+ * (`vlocity_cmt.VlocityOpenInterface`), which is not distinguishable from an
+ * inner class `Outer.Inner` by syntax alone; a head the same org also uses as
+ * `ns__` is a namespace.
+ */
+export function namespacesIn(dsts) {
+    const out = new Set();
+    for (const dst of dsts) {
+        const name = dst.slice(dst.indexOf(":") + 1);
+        for (const seg of name.split(".")) {
+            const ns = namespaceOf(seg);
+            if (ns)
+                out.add(ns);
+        }
+    }
+    return out;
+}
+/** Standard fields every custom object has (`X__c.Name`); any other
+ *  unsuffixed field on a custom object is a parser or source gap. */
+const CUSTOM_OBJECT_STANDARD_FIELDS = [
+    "id",
+    "name",
+    "ownerid",
+    "createddate",
+    "createdbyid",
+    "lastmodifieddate",
+    "lastmodifiedbyid",
+    "systemmodstamp",
+    "isdeleted",
+    "recordtypeid",
+    "currencyisocode",
+];
+/** Extra standard fields by custom suffix (custom metadata types, platform
+ *  events, external objects). */
+const STANDARD_FIELDS_BY_SUFFIX = {
+    c: new Set(CUSTOM_OBJECT_STANDARD_FIELDS),
+    // Custom metadata types: their own fields plus the system audit fields; no
+    // owner, record type or Name.
+    mdt: new Set([
+        "id",
+        "createdbyid",
+        "createddate",
+        "lastmodifiedbyid",
+        "lastmodifieddate",
+        "systemmodstamp",
+        "developername",
+        "masterlabel",
+        "label",
+        "namespaceprefix",
+        "qualifiedapiname",
+        "language",
+    ]),
+    e: new Set([...CUSTOM_OBJECT_STANDARD_FIELDS, "replayid", "eventuuid"]),
+    x: new Set([...CUSTOM_OBJECT_STANDARD_FIELDS, "externalid", "displayurl"]),
+};
+/** Standard DOM events (`onclick`, `addEventListener('change')`): they
+ *  never have a source in the org. Custom event names stay unexpected. */
+const DOM_EVENTS = new Set([
+    "click",
+    "dblclick",
+    "contextmenu",
+    "mousedown",
+    "mouseup",
+    "mouseover",
+    "mouseout",
+    "mouseenter",
+    "mouseleave",
+    "mousemove",
+    "wheel",
+    "keydown",
+    "keyup",
+    "keypress",
+    "focus",
+    "blur",
+    "focusin",
+    "focusout",
+    "input",
+    "change",
+    "submit",
+    "reset",
+    "select",
+    "scroll",
+    "resize",
+    "load",
+    "error",
+    "abort",
+    "drag",
+    "dragstart",
+    "dragend",
+    "dragenter",
+    "dragleave",
+    "dragover",
+    "drop",
+    "touchstart",
+    "touchend",
+    "touchmove",
+    "touchcancel",
+    "pointerdown",
+    "pointerup",
+    "pointermove",
+    "pointerover",
+    "pointerout",
+    "pointerenter",
+    "pointerleave",
+    "pointercancel",
+    "copy",
+    "cut",
+    "paste",
+    "animationstart",
+    "animationend",
+    "animationiteration",
+    "transitionend",
+    "invalid",
+    "toggle",
+    "beforeinput",
+    "compositionstart",
+    "compositionend",
+]);
+/** First dotted segment of a name (`System.assertEquals(3)` -> `System`). */
+const headOf = (name) => name.split(/[.(]/, 1)[0] ?? name;
+/** True when a dangling dst names something no extractor of the org's own
+ *  source can ever materialize:
+ *   - standard tabs (`CustomTab:standard-*`);
+ *   - standard-schema objects (no custom suffix) and their unsuffixed fields;
+ *     on a custom object only its real standard fields (`X__c.Name`,
+ *     `X__c.OwnerId`, `Y__mdt.DeveloperName`, ...);
+ *   - managed-package metadata (`<ns>__Name`, `<ns>__Obj__c.<ns>__F__c`, and
+ *     `ns.Type` for a namespace in `knownNamespaces` or the
+ *     `%vlocity_namespace%` placeholder);
+ *   - Apex platform classes and calls into them (`System.assertEquals`,
+ *     `Assert.areEqual`);
+ *   - standard DOM events (`LWCEvent:click`).
+ *  Custom-suffixed, unnamespaced targets are NEVER platform refs — a missing
+ *  `__c` target is a real gap worth surfacing — and neither is an empty
+ *  object or field name, which is a parser bug (`CustomObject:`). */
+export function isPlatformBuiltinRef(dst, knownNamespaces = new Set(), customSettings = new Set()) {
+    const i = dst.indexOf(":");
+    if (i <= 0)
+        return false;
+    const label = dst.slice(0, i);
+    const name = dst.slice(i + 1);
+    if (name.length === 0)
+        return false;
+    const head = headOf(name);
+    // `ns.Type`: a dotted head that is a namespace.
+    const dottedNs = name.length > head.length &&
+        (head.toLowerCase() === NS_PLACEHOLDER || knownNamespaces.has(head.toLowerCase()));
+    if (label === "CustomTab" && name.startsWith("standard-"))
+        return true;
+    if (label === "LWCEvent")
+        return DOM_EVENTS.has(name.toLowerCase());
+    if (label === "CustomField") {
+        const dot = name.indexOf(".");
+        if (dot <= 0 || dot === name.length - 1)
+            return false;
+        const obj = name.slice(0, dot);
+        const field = name.slice(dot + 1);
+        if (isNamespaced(obj) || isNamespaced(field))
+            return true;
+        // A custom, relationship or derived field (`X__c`, `CaseId__r`, `City__cy`).
+        if (field.includes("__"))
+            return false;
+        const suffix = CUSTOM_SUFFIX_RE.exec(obj)?.[0].slice(2).toLowerCase();
+        if (suffix === undefined && !obj.includes("__"))
+            return true; // standard object
+        if (field.toLowerCase() === "setupownerid")
+            return customSettings.has(obj.toLowerCase());
+        return ((STANDARD_FIELDS_BY_SUFFIX[suffix ?? "c"] ?? STANDARD_FIELDS_BY_SUFFIX.c)?.has(field.toLowerCase()) === true);
+    }
+    if (label === "CustomObject") {
+        // Standard objects never contain `__` (`Foo__History` is derived from a custom one).
+        return isNamespaced(name) || !name.includes("__");
+    }
+    if (label === "ApexClass" || label === "ApexInterface" || label === "ApexMethod") {
+        // The narrow core set, not the parser superset (see AUDIT_PLATFORM_CORE).
+        return AUDIT_PLATFORM_CORE.has(head.toLowerCase()) || isNamespaced(head) || dottedNs;
+    }
+    // Any other metadata named in a managed namespace (ApexPage, CustomTab,
+    // CustomMetadataType, StaticResource, Remote, ...).
+    return isNamespaced(head) || dottedNs;
+}
+/** Edge-level classification: `isPlatformBuiltinRef` on the target, plus
+ *  what only the edge knows. A `lightning-*` tag is a base component
+ *  (`LWC:button` from `<lightning-button>`); an `IS_TEST_FOR` target is
+ *  always an org class, so a dangling one is a parser gap even when its name
+ *  is a platform class (`ApexClass:Test` from `Test.startTest()`). */
+export function isExpectedDanglingEdge(e, knownNamespaces = new Set(), customSettings = new Set()) {
+    return (edgeVerdict(String(e.relType), () => e.attributes) ??
+        isPlatformBuiltinRef(String(e.dstQualifiedName), knownNamespaces, customSettings));
+}
+/** The part of `isExpectedDanglingEdge` only the edge decides: false for
+ *  IS_TEST_FOR, true for a `lightning-*` tag, undefined when the target
+ *  decides. `attrs` is called only when the tag matters. */
+function edgeVerdict(relType, attrs) {
+    if (relType === REL_TYPES.IS_TEST_FOR)
+        return false;
+    const tag = attrs()?.tag;
+    if (typeof tag === "string" && tag.toLowerCase().startsWith("lightning-"))
+        return true;
+    return undefined;
+}
+/** Parsed attributes of a stored edge row, skipping the parse when the JSON
+ *  cannot hold a top-level `tag` key (the only key the classifier reads). */
+function rowAttrs(json) {
+    return json.includes('"tag"') ? JSON.parse(json) : undefined;
+}
+/** Classification key of a dangling edge: its edge verdict plus its target.
+ *  Edges with the same key are classified alike, so the audit classifies
+ *  each distinct key once. */
+function verdictKey(e) {
+    const v = edgeVerdict(e.relType, () => rowAttrs(e.attributes));
+    return `${v === undefined ? "P" : v ? "E" : "U"}${e.dst}`;
+}
+function keyIsExpected(key, knownNamespaces, customSettings) {
+    const v = key[0];
+    if (v === "E")
+        return true;
+    if (v === "U")
+        return false;
+    return isPlatformBuiltinRef(key.slice(1), knownNamespaces, customSettings);
+}
+/** Lower-cased objects, among those with a dangling `SetupOwnerId` ref, that
+ *  the graph knows to be custom settings: the object node carries
+ *  `customSettingsType`, or a `CustomSetting:<obj>` node exists. */
+function customSettingsIn(store, orgId, dsts) {
+    const out = new Set();
+    const seen = new Set();
+    for (const dst of dsts) {
+        if (!dst.startsWith("CustomField:") || !/\.setupownerid$/i.test(dst))
+            continue;
+        const obj = dst.slice("CustomField:".length, dst.lastIndexOf("."));
+        if (seen.has(obj))
+            continue;
+        seen.add(obj);
+        const node = store.getNode(orgId, asQualifiedName(`CustomObject:${obj}`));
+        const type = node?.attributes?.customSettingsType;
+        const known = (typeof type === "string" && type.length > 0) ||
+            store.getNode(orgId, asQualifiedName(`CustomSetting:${obj}`)) !== null;
+        if (known)
+            out.add(obj.toLowerCase());
+    }
+    return out;
+}
 export function auditDanglingEdges(store, orgIdIn, opts = {}) {
     const orgId = typeof orgIdIn === "string" ? asOrgId(orgIdIn) : orgIdIn;
     // Clamp to ≥0; a negative slice index would silently return a tail of the
-    // dangling array rather than an empty sample.
-    const sampleSize = Math.max(0, opts.sampleSize ?? 25);
+    // dangling array rather than an empty sample. Truncate as slice() did
+    // (2.5 -> 2; NaN stays NaN and, like slice(0, NaN), yields no sample).
+    const sampleSize = Math.trunc(Math.max(0, opts.sampleSize ?? 25));
     const totalEdges = store.countEdges(orgId);
-    const dangling = store.listDanglingEdges(orgId, opts.scanLimit);
+    // Streamed: a large org has ~1M dangling edges (645k of them
+    // GRANTS_APEX_ACCESS), so they are never held at once. Pass 1 counts, and keeps each
+    // distinct classification key once plus the first `sampleSize` edges.
     const byRel = {};
     const byDstPrefix = {};
-    for (const e of dangling) {
+    let danglingCount = 0;
+    const keyCounts = new Map();
+    const head = [];
+    for (const e of store.iterateDanglingEdges(orgId, opts.scanLimit)) {
+        danglingCount += 1;
         byRel[e.relType] = (byRel[e.relType] ?? 0) + 1;
-        const p = prefix(String(e.dstQualifiedName));
+        const p = prefix(e.dst);
         byDstPrefix[p] = (byDstPrefix[p] ?? 0) + 1;
+        const k = verdictKey(e);
+        keyCounts.set(k, (keyCounts.get(k) ?? 0) + 1);
+        if (head.length < sampleSize)
+            head.push(e);
+    }
+    // Both sets depend only on the distinct targets.
+    const dsts = new Set();
+    for (const k of keyCounts.keys())
+        dsts.add(k.slice(1));
+    const namespaces = namespacesIn(dsts);
+    const customSettings = customSettingsIn(store, orgId, dsts);
+    const expectedKeys = new Set();
+    let platformRefCount = 0;
+    for (const [k, n] of keyCounts) {
+        if (!keyIsExpected(k, namespaces, customSettings))
+            continue;
+        expectedKeys.add(k);
+        platformRefCount += n;
+    }
+    const unexpectedCount = danglingCount - platformRefCount;
+    // Sample the *unexpected* dangling edges first — those are the ones a
+    // user can act on; platform refs only pad the sample once the unexpected
+    // set is smaller than sampleSize. Same result as a stable sort of every
+    // edge, unexpected first: the first unexpected edges in scan order (pass 2,
+    // stopped as soon as enough are found), then the first expected ones, which
+    // all lie within the first `sampleSize` edges (`head`).
+    const picked = [];
+    const wantUnexpected = Math.min(sampleSize, unexpectedCount);
+    if (wantUnexpected > 0) {
+        for (const e of store.iterateDanglingEdges(orgId, opts.scanLimit)) {
+            if (expectedKeys.has(verdictKey(e)))
+                continue;
+            picked.push(e);
+            if (picked.length >= wantUnexpected)
+                break;
+        }
+    }
+    for (const e of head) {
+        if (picked.length >= sampleSize)
+            break;
+        if (expectedKeys.has(verdictKey(e)))
+            picked.push(e);
     }
-    const sample = dangling.slice(0, sampleSize).map((e) => ({
-        src: String(e.srcQualifiedName),
-        rel: String(e.relType),
-        dst: String(e.dstQualifiedName),
+    const sample = picked.map((e) => ({
+        src: e.src,
+        rel: e.relType,
+        dst: e.dst,
     }));
     return {
         totalEdges,
-        danglingCount: dangling.length,
+        danglingCount,
+        platformRefCount,
+        unexpectedCount,
         byRel,
         byDstPrefix,
         sample,
     };
 }
 /**
- * Destructive companion to `auditDanglingEdges`: deletes every dangling edge.
+ * Destructive companion to `auditDanglingEdges`: deletes dangling edges.
  * Reserved for the CLI `--delete-dangling --yes` flag; callers must own the
  * authorization decision (we just do the work).
+ *
+ * Platform-builtin references (standard-tab grants, standard-schema field
+ * grants) are KEPT by default — they're real, queryable security data whose
+ * target simply has no metadata source. Pass `includePlatformRefs: true` to
+ * delete those too.
  */
-export function deleteDanglingEdges(store, orgIdIn) {
+export function deleteDanglingEdges(store, orgIdIn, opts = {}) {
     const orgId = typeof orgIdIn === "string" ? asOrgId(orgIdIn) : orgIdIn;
     const dangling = store.listDanglingEdges(orgId);
     let deleted = 0;
+    let keptPlatformRefs = 0;
     store.transaction(() => {
         for (const e of dangling) {
+            if (!opts.includePlatformRefs && isPlatformBuiltinRef(String(e.dstQualifiedName))) {
+                keptPlatformRefs += 1;
+                continue;
+            }
             store.deleteEdge(orgId, e.srcQualifiedName, e.dstQualifiedName, e.relType);
             deleted += 1;
         }
     });
-    return { deleted };
+    return { deleted, keptPlatformRefs };
 }
 //# sourceMappingURL=audit-graph.js.map