@ryanstark24/sfgraph-core 1.2.0 → 1.6.0

package/dist/parsers/apex/class.js

@@ -2,8 +2,88 @@ import { createHash } from "node:crypto";
 import { asOrgId, asQualifiedName, asSha256 } from "@ryanstark24/sfgraph-shared";
 import { METADATA_CATEGORY, REL_TYPES } from "../../domain/index.js";
 import { makeEdge, makeNode, stripNs } from "../common.js";
+import { APEX_NODE_HASH_SALT } from "../hash-salts.js";
+import { NEW_INSTANCE_RE, STATIC_CALL_RE, emitClassRefEdges, emitDescribeRefEdges, emitStaticCallEdges, emitTypeRefEdges, isUserClassName, localVarNames, } from "./class-refs.js";
 import { parseAnnotations, stripCommentsAndStrings } from "./common.js";
-const METHOD_RE = /(?:@[\w()=,'"\s.]+\s+)*(?:(public|private|protected|global|virtual|override|abstract|static|webservice|with\s+sharing|without\s+sharing|inherited\s+sharing|testmethod|final)\s+)+([A-Za-z_][\w<>,.\s\[\]]*?)\s+([A-Za-z_]\w*)\s*\(([^)]*)\)\s*\{/gi;
+import { PLACEHOLDER, dynamicSoqlClauseFields, foldDynamicSoql, maskApex, parseDynamicSoql, } from "./dynamic-soql.js";
+import { classScopes, collectDecls, extractFieldAccesses, paramDecls, } from "./field-access.js";
+import { emitInstanceCallEdges, emitNameRefEdges, makeTypeLookup, recordTypeAt, } from "./name-refs.js";
+import { emitPageRefEdges } from "./page-refs.js";
+import { blankBracketGroups, findInlineQueries, soqlFieldRefs } from "./soql-fields.js";
+import { classStringConstants, extractVlocityCalls, extractVlocityDispatch, stripCommentsOnly, } from "./vlocity-calls.js";
+export { APEX_NODE_HASH_SALT } from "../hash-salts.js";
+/**
+ * apex-parser (antlr4ts) keeps a DFA cache on each grammar's static ATN. It is
+ * per isolate, it is never trimmed, and it grows with every distinct input:
+ * over a large Vlocity corpus it held ~190 MB live (and a 2-4x larger V8 heap) in each
+ * parse worker. The cache is only a memo for prediction, so dropping it does
+ * not change any parse result. Release it after this many syntax checks in the
+ * current isolate (each parse worker, or the main thread in serial mode).
+ * Measured on a large Vlocity repo, 4 workers: 50 cut peak RSS by ~1.07 GB for ~5% more parse
+ * time.
+ */
+export const APEX_DFA_CLEAR_INTERVAL = 50;
+let apexChecksSinceDfaClear = 0;
+/** Count one apex-parser syntax check; clear the lexer and parser DFA when due. */
+function noteApexSyntaxCheck(lexer, parser) {
+    apexChecksSinceDfaClear++;
+    if (apexChecksSinceDfaClear < APEX_DFA_CLEAR_INTERVAL)
+        return;
+    apexChecksSinceDfaClear = 0;
+    lexer?.interpreter?.clearDFA();
+    parser?.interpreter?.clearDFA();
+}
+/** Test hook: restart the DFA-release counter for this isolate. */
+export function resetApexDfaCounterForTest() {
+    apexChecksSinceDfaClear = 0;
+}
+// Modifiers are optional (`*`, not `+`): a method with NO explicit access
+// modifier is implicitly private in Apex and is still a real method — the old
+// `+` silently dropped every unmodified helper/inner-class method. Allowing
+// zero modifiers means the regex can also touch control-flow that happens to
+// look like `<word> <word>(...) {` (notably `else if (x) {`), so findMethods
+// rejects any match whose return-type or name is a reserved keyword.
+const METHOD_RE = /(?:@[\w()=,'"\s.]+\s+)*(?:(public|private|protected|global|virtual|override|abstract|static|webservice|with\s+sharing|without\s+sharing|inherited\s+sharing|testmethod|final)\s+)*([A-Za-z_][\w<>,.\s\[\]]*?)\s+([A-Za-z_]\w*)\s*\(([^)]*)\)\s*\{/gi;
+// Apex reserved words that can appear as `<kw> <kw>(...) {` but are NOT method
+// declarations. If the captured return-type or method-name is one of these, the
+// match is control flow / a statement, not a method.
+const NON_METHOD_KEYWORDS = new Set([
+    "if",
+    "else",
+    "for",
+    "while",
+    "do",
+    "switch",
+    "catch",
+    "try",
+    "finally",
+    "return",
+    "new",
+    "throw",
+    "when",
+]);
+// Access/sharing/definition modifiers. When the regex makes modifiers optional,
+// a CONSTRUCTOR `public Foo(...) {` backtracks to returnType="public", name="Foo"
+// (the class name) — a phantom method. A real method's return type is a TYPE,
+// never a modifier, so a modifier captured AS the return type means we matched a
+// constructor (or other non-method) and must drop it.
+const MODIFIER_KEYWORDS = new Set([
+    "public",
+    "private",
+    "protected",
+    "global",
+    "virtual",
+    "override",
+    "abstract",
+    "static",
+    "webservice",
+    "with",
+    "without",
+    "inherited",
+    "sharing",
+    "testmethod",
+    "final",
+]);
 function findMatchingBrace(src, openIdx) {
     let depth = 0;
     for (let i = openIdx; i < src.length; i++) {
@@ -18,48 +98,208 @@ function findMatchingBrace(src, openIdx) {
     }
     return -1;
 }
+/**
+ * Split `raw` on commas at generic/bracket/paren depth 0, so
+ * `Map<Id, Contact> a, List<String> b` is two items, not three.
+ */
+function splitTopLevel(raw) {
+    const out = [];
+    let depth = 0;
+    let cur = "";
+    for (const c of raw) {
+        if (c === "<" || c === "(" || c === "[" || c === "{")
+            depth++;
+        else if ((c === ">" || c === ")" || c === "]" || c === "}") && depth > 0)
+            depth--;
+        if (c === "," && depth === 0) {
+            out.push(cur);
+            cur = "";
+        }
+        else
+            cur += c;
+    }
+    out.push(cur);
+    return out.map((x) => x.trim()).filter((x) => x.length > 0);
+}
 function parseParams(raw) {
-    const t = raw.trim();
-    if (!t)
-        return [];
-    return t.split(",").map((s) => s.trim());
+    return splitTopLevel(raw);
+}
+/** `Database.Batchable<SObject>` -> `Database.Batchable` (whitespace-normalised). */
+function stripTypeArgs(t) {
+    const lt = t.indexOf("<");
+    return (lt >= 0 ? t.slice(0, lt) : t).replace(/\s+/g, "");
+}
+/** Remove `@Name` / `@Name(...)` annotations (balanced parens) from `text`. */
+function stripAnnotations(text) {
+    let out = "";
+    for (let i = 0; i < text.length; i++) {
+        if (text[i] !== "@") {
+            out += text[i];
+            continue;
+        }
+        let j = i + 1;
+        while (j < text.length && /\w/.test(text[j] ?? ""))
+            j++;
+        let k = j;
+        while (k < text.length && /\s/.test(text[k] ?? ""))
+            k++;
+        if (text[k] === "(") {
+            let d = 0;
+            for (; k < text.length; k++) {
+                if (text[k] === "(")
+                    d++;
+                else if (text[k] === ")" && --d === 0)
+                    break;
+            }
+            j = k + 1;
+        }
+        out += " ";
+        i = j - 1;
+    }
+    return out;
 }
+/**
+ * Header of the file's OUTER type: the first `class`/`interface`/`enum` keyword at
+ * brace depth 0 (so an inner class can never be taken for the outer one),
+ * with `extends` / `implements` clauses parsed by a depth-aware split so
+ * generic arguments (`Database.Batchable<SObject>`) neither break the match
+ * nor split the list. Type arguments are dropped from the emitted names.
+ * `src` must have comments and strings stripped.
+ */
 function extractClassHeader(src) {
-    const headerMatch = src.match(/(?:@[\w()=,'"\s.]+\s+)*((?:public|private|global|virtual|abstract|with\s+sharing|without\s+sharing|inherited\s+sharing|\s)+)?(class|interface)\s+([A-Za-z_]\w*)(?:\s+extends\s+([A-Za-z_][\w.]*))?(?:\s+implements\s+([A-Za-z_][\w.,\s]*))?\s*\{/i);
-    if (!headerMatch) {
-        return {
-            name: "",
-            extendsClass: null,
-            implementsList: [],
-            isInterface: false,
-            isTest: false,
-            modifiers: [],
-        };
+    const empty = {
+        name: "",
+        extendsClass: null,
+        extendsList: [],
+        implementsList: [],
+        isInterface: false,
+        isTest: false,
+        modifiers: [],
+    };
+    // `enum` too: a top-level enum file declares its modifiers like a class does (cycle 3 T6 fix 1).
+    const kwRe = /\b(class|interface|enum)\s+([A-Za-z_]\w*)/gi;
+    let depth = 0;
+    let scanned = 0;
+    let hit = null;
+    for (let m = kwRe.exec(src); m !== null; m = kwRe.exec(src)) {
+        for (; scanned < m.index; scanned++) {
+            if (src[scanned] === "{")
+                depth++;
+            else if (src[scanned] === "}")
+                depth--;
+        }
+        if (depth === 0) {
+            hit = m;
+            break;
+        }
     }
-    const mods = (headerMatch[1] ?? "")
+    if (!hit)
+        return empty;
+    const open = src.indexOf("{", hit.index + hit[0].length);
+    if (open < 0)
+        return empty;
+    const isInterface = (hit[1] ?? "").toLowerCase() === "interface";
+    const name = hit[2] ?? "";
+    // Everything before the keyword at depth 0 is annotations + modifiers. Only
+    // the trailing statement matters (a preceding `}`/`;` cannot occur before
+    // the outer type, but be defensive).
+    const prefixStart = Math.max(src.lastIndexOf("}", hit.index), src.lastIndexOf(";", hit.index));
+    const prefix = src.slice(prefixStart + 1, hit.index);
+    const isTest = parseAnnotations(prefix).some((a) => a.name.toLowerCase() === "istest");
+    const modifiers = stripAnnotations(prefix)
         .trim()
         .split(/\s+/)
         .filter((s) => s.length > 0);
-    const isInterface = (headerMatch[2] ?? "").toLowerCase() === "interface";
-    const name = headerMatch[3] ?? "";
-    const extendsClass = headerMatch[4] ?? null;
-    const implementsList = (headerMatch[5] ?? "")
-        .split(",")
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0);
-    // Class-level annotations live INSIDE headerMatch[0] (the regex consumes
-    // them via the leading `(?:@[\w()=,'"\\s.]+\\s+)*` group), not before it.
-    // Slicing src up to headerStart yielded an empty string and always returned
-    // isTest=false — fixed: parse annotations out of the matched header text
-    // up to the `class`/`interface` keyword.
-    const headerText = headerMatch[0];
-    const keywordIdx = headerText.search(/\b(class|interface)\b/i);
-    const annotationsRegion = keywordIdx > 0 ? headerText.slice(0, keywordIdx) : "";
-    const classAnnotations = parseAnnotations(annotationsRegion).map((a) => a.name.toLowerCase());
-    const isTest = classAnnotations.includes("istest");
-    return { name, extendsClass, implementsList, isInterface, isTest, modifiers: mods };
-}
-function findMethods(src) {
+    const tail = src.slice(hit.index + hit[0].length, open);
+    const extIdx = tail.search(/\bextends\b/i);
+    const implIdx = tail.search(/\bimplements\b/i);
+    const clause = (from, kwLen) => {
+        if (from < 0)
+            return "";
+        const ends = [extIdx, implIdx].filter((x) => x > from);
+        return tail.slice(from + kwLen, ends.length > 0 ? Math.min(...ends) : tail.length);
+    };
+    const extendsRaw = clause(extIdx, "extends".length);
+    const implementsRaw = clause(implIdx, "implements".length);
+    // An interface may extend several interfaces; a class extends one class.
+    const extendsList = splitTopLevel(extendsRaw)
+        .map(stripTypeArgs)
+        .filter((x) => x);
+    const implementsList = splitTopLevel(implementsRaw)
+        .map(stripTypeArgs)
+        .filter((x) => x.length > 0);
+    return {
+        name,
+        extendsClass: extendsList[0] ?? null,
+        extendsList,
+        implementsList,
+        isInterface,
+        isTest,
+        modifiers,
+    };
+}
+/**
+ * The bundled apex-parser grammar predates Apex's null-coalescing operator, so
+ * `a ?? b` is a syntax error to it. For grammar validation only, rewrite every
+ * code-level `??` (never inside comments or strings) to `||`: same length, so
+ * token offsets stay valid, and the same binary-expression shape. The original
+ * source is still used for every extraction and snippet.
+ */
+export function rewriteNullCoalescing(src) {
+    if (!src.includes("??"))
+        return src;
+    const masked = maskApex(src);
+    const out = src.split("");
+    for (let i = masked.indexOf("??"); i >= 0; i = masked.indexOf("??", i + 2)) {
+        out[i] = "|";
+        out[i + 1] = "|";
+    }
+    return out.join("");
+}
+/**
+ * Human-readable message for a parse failure. apex-parser's
+ * ThrowingErrorListener throws a plain `{ line, column, message }` object (not
+ * an Error), which `String(err)` turned into "[object Object]".
+ */
+export function formatParseError(err) {
+    const MAX = 300;
+    const clip = (s) => (s.length > MAX ? `${s.slice(0, MAX)}…` : s);
+    if (err instanceof Error)
+        return clip(err.message);
+    if (err && typeof err === "object") {
+        const e = err;
+        const msg = typeof e.message === "string" ? e.message : JSON.stringify(err);
+        const pos = typeof e.line === "number" ? `${e.line}:${typeof e.column === "number" ? e.column : 0} ` : "";
+        return clip(`${pos}${msg}`);
+    }
+    return clip(String(err));
+}
+/**
+ * Raw (comment/string-preserving) body of the method's declaration: the first
+ * not-yet-used `name(<same arity>) {` in `masked` that isn't a call (`.name(`)
+ * or constructor invocation. Matching and brace-balancing run on `masked`; the
+ * slice is taken from `src` at the same offsets. Null when not found.
+ */
+function declRawBody(src, masked, m, used) {
+    const re = new RegExp(`(?<![.\\w])${m.name}\\s*\\(([^)]*)\\)\\s*\\{`, "g");
+    for (const hit of masked.matchAll(re)) {
+        const at = hit.index ?? 0;
+        if (used.has(at))
+            continue;
+        if (/\bnew\s+$/.test(masked.slice(Math.max(0, at - 5), at)))
+            continue;
+        if (parseParams(hit[1] ?? "").length !== m.params.length)
+            continue;
+        const open = at + hit[0].length - 1;
+        const close = findMatchingBrace(masked, open);
+        if (close <= 0)
+            return null;
+        used.add(at);
+        return { text: src.slice(open + 1, close), start: open + 1 };
+    }
+    return null;
+}
+function findMethods(src, className) {
     const out = [];
     const re = new RegExp(METHOD_RE.source, "gi");
     let m = re.exec(src);
@@ -67,6 +307,19 @@ function findMethods(src) {
         const returnType = (m[2] ?? "").trim();
         const name = m[3] ?? "";
         const params = parseParams(m[4] ?? "");
+        // Reject non-methods that share the `<word> <word>(...) {` shape:
+        //  - control flow: `else if (x) {` → returnType="else", name="if".
+        //  - a CONSTRUCTOR: `public Foo(...) {` backtracks to returnType="public"
+        //    (a modifier) / name=<class name>. A real method's return type is a
+        //    type, never a modifier, and its name is never the class name.
+        if (NON_METHOD_KEYWORDS.has(returnType.toLowerCase()) ||
+            NON_METHOD_KEYWORDS.has(name.toLowerCase()) ||
+            MODIFIER_KEYWORDS.has(returnType.toLowerCase()) ||
+            (className !== undefined && name === className)) {
+            re.lastIndex = (m.index ?? 0) + 1;
+            m = re.exec(src);
+            continue;
+        }
         // Skip constructors (returnType empty or equals class name when first letter is uppercase)
         // We'll keep ctor handling outside.
         const openBraceIdx = (m.index ?? 0) + m[0].length - 1;
@@ -110,95 +363,507 @@ function extractApiVersion(metaXml) {
     const m = metaXml.match(/<apiVersion>([^<]+)<\/apiVersion>/);
     return m?.[1] ? m[1].trim() : null;
 }
+/**
+ * `<shadowsManaged>ns</shadowsManaged>` entries the live extractor adds to the
+ * metaXml envelope when this local class shares its (namespace-less) qname
+ * with managed-package classes. Not a Salesforce field.
+ */
+function extractShadowsManaged(metaXml) {
+    if (!metaXml)
+        return [];
+    const out = [];
+    for (const m of metaXml.matchAll(/<shadowsManaged>([^<]+)<\/shadowsManaged>/g)) {
+        const ns = m[1]?.trim();
+        if (ns)
+            out.push(ns);
+    }
+    return out;
+}
 function sha256(s) {
     return createHash("sha256").update(s).digest("hex");
 }
-const SOQL_RE = /\[\s*SELECT\b([^\]]*?)\bFROM\s+([A-Za-z_][\w.]*)/gi;
-const SOSL_RE = /\[\s*FIND\b/gi;
-const DML_RE = /\b(insert|update|delete|upsert|undelete|merge)\s+([A-Za-z_][\w.]*)/gi;
-const FIELD_ACCESS_RE = /\b([A-Z][A-Za-z0-9_]*(?:__r)?)\.([A-Za-z_][\w]*?)(?:__c)?\b/g;
-const NEW_INSTANCE_RE = /\bnew\s+([A-Z][A-Za-z0-9_]*)\s*\(/g;
-const STATIC_CALL_RE = /\b([A-Z][A-Za-z0-9_]*)\.([a-z][A-Za-z0-9_]*)\s*\(/g;
 /**
- * Count the arguments in a balanced parenthesised arg list starting one
- * character after `openParenIdx` (which must point at the `(` opening the
- * call). Handles nested parens, string literals, and single-line `//`
- * plus block `/* * /` comments. Returns the arg count, or `null` if the
- * caller's parens never close inside `body` (truncated source / unbalanced).
+ * Compute the character ranges of loop BODIES (`{ … }` opened by for/while/
+ * do) within a method body. Used to stamp `inLoop: true` on SOQL/DML edges in
+ * the regex extraction path so governor-risk detection works on the DEFAULT
+ * parser mode — not only under SFGRAPH_APEX_PARSER=ast (the AST extractor
+ * stamps inLoop separately). The body passed here has strings/comments
+ * stripped, so brace counting is reliable.
  *
- * Used by the regex pass to emit `ApexMethod:Foo.bar(2)` instead of the
- * `(?)` ambiguity placeholder — turning most regex-mode CALLS edges into
- * precise-arity edges that bypass the arity resolver's overload fan-out.
- * Cases that genuinely can't be counted (lambdas, splat, comment-split
- * args) fall back to `(?)` — preserving the existing ambiguous-fan-out
- * semantics on the long tail.
+ * A for-EACH header query — `for (Account a : [SELECT …]) {…}` — runs once and
+ * is correctly EXCLUDED: its index falls before the loop body's opening brace,
+ * not inside the recorded range. Known limitation (shared with the populate
+ * body-scan): a braceless single-statement loop body isn't tracked.
  */
-function countCallArgs(body, openParenIdx) {
-    // empty args → arity 0; we detect by peeking for the matching `)` after
-    // any whitespace before counting commas.
-    let depth = 1;
-    let i = openParenIdx + 1;
-    let argCount = 0;
-    let sawNonWhitespace = false;
-    while (i < body.length && depth > 0) {
+export function computeLoopRanges(body) {
+    const ranges = [];
+    const stack = [];
+    // Brace positions known to open a loop body. Marking the SPECIFIC `{` (rather
+    // than a sticky `pendingLoop` flag) is what fixes braceless loops: a
+    // `for (...) doIt();` or `do x(); while(y);` has no brace, so the next
+    // UNRELATED `{` is no longer mis-marked as a loop body (the old flag bled into
+    // it, producing false SOQL/DML-in-loop governor findings).
+    const loopBraces = new Set();
+    const wordBefore = (i) => /\W/.test(body[i - 1] ?? " ");
+    const boundaryAt = (i) => /\W/.test(body[i] ?? " ");
+    const skipWs = (i) => {
+        let j = i;
+        while (j < body.length && /\s/.test(body[j] ?? ""))
+            j += 1;
+        return j;
+    };
+    // Index of the `)` matching the `(` at `open`, or -1.
+    const matchParen = (open) => {
+        let d = 0;
+        for (let j = open; j < body.length; j++) {
+            if (body[j] === "(")
+                d += 1;
+            else if (body[j] === ")" && --d === 0)
+                return j;
+        }
+        return -1;
+    };
+    // End (`;` at depth 0) of the single statement starting at `from`.
+    const stmtEnd = (from) => {
+        let d = 0;
+        for (let j = from; j < body.length; j++) {
+            const c = body[j];
+            if (c === "(" || c === "{" || c === "[")
+                d += 1;
+            else if (c === ")" || c === "}" || c === "]")
+                d -= 1;
+            else if (c === ";" && d === 0)
+                return j;
+        }
+        return body.length - 1;
+    };
+    for (let i = 0; i < body.length; i++) {
         const ch = body[i];
-        // Line comment
-        if (ch === "/" && body[i + 1] === "/") {
-            const nl = body.indexOf("\n", i + 2);
-            i = nl < 0 ? body.length : nl + 1;
+        let kwLen = 0;
+        if (ch === "f" && body.startsWith("for", i) && wordBefore(i) && boundaryAt(i + 3))
+            kwLen = 3;
+        else if (ch === "w" && body.startsWith("while", i) && wordBefore(i) && boundaryAt(i + 5))
+            kwLen = 5;
+        else if (ch === "d" && body.startsWith("do", i) && wordBefore(i) && boundaryAt(i + 2))
+            kwLen = 2;
+        if (kwLen > 0) {
+            let j = skipWs(i + kwLen);
+            // for/while carry a `(condition)` before the body; `do` does not. Skip the
+            // condition so its inner `;`s (e.g. `for (i=0; i<n; i++)`) aren't read as a
+            // braceless body terminator.
+            if ((kwLen === 3 || kwLen === 5) && body[j] === "(") {
+                const close = matchParen(j);
+                if (close < 0)
+                    continue;
+                j = skipWs(close + 1);
+            }
+            if (body[j] === "{") {
+                loopBraces.add(j); // braced body — recorded when the stack pops it
+            }
+            else {
+                ranges.push({ start: j - 1, end: stmtEnd(j) }); // braceless single statement
+            }
+            i = j - 1;
             continue;
         }
-        // Block comment
-        if (ch === "/" && body[i + 1] === "*") {
-            const close = body.indexOf("*/", i + 2);
-            i = close < 0 ? body.length : close + 2;
+        if (ch === "{") {
+            stack.push({ openIdx: i, isLoop: loopBraces.has(i) });
+        }
+        else if (ch === "}") {
+            const top = stack.pop();
+            if (top?.isLoop)
+                ranges.push({ start: top.openIdx, end: i });
+        }
+    }
+    return ranges;
+}
+// Inline SOQL queries are found by soql-fields findInlineQueries: from
+// `[SELECT` to the `]` that closes it at bracket depth 0, outside string
+// literals (a bind such as `:ids[0]` does not end the query). The object is
+// taken by parseSoql, which finds the FROM at paren-depth 0 so a child subquery
+// (`(SELECT … FROM Contacts)`) or a semi-join (`WHERE Id IN (SELECT … FROM
+// Contact)`) doesn't get mistaken for the outer object.
+export const SOSL_RE = /\[\s*FIND\b/gi;
+/** Dynamic query entry points (the query text is a runtime string). */
+export const DYNAMIC_QUERY_RE = /\b(Database|Search)\s*\.\s*(query|queryWithBinds|countQuery|countQueryWithBinds|getQueryLocator|getQueryLocatorWithBinds)\s*\(/gi;
+/**
+ * T15 I-5: one EXECUTES_SOSL `SOSL:*` edge when `code` has an inline SOSL
+ * query, stamped `inLoop` when any of them sits inside a loop body.
+ */
+export function emitSoslEdge(ctx, srcQname, code, inLoopAt, edges) {
+    let found = false;
+    let inLoop = false;
+    for (const m of code.matchAll(new RegExp(SOSL_RE.source, "gi"))) {
+        found = true;
+        if (inLoopAt(m.index ?? 0))
+            inLoop = true;
+    }
+    if (found) {
+        edges.push(makeEdge(ctx, srcQname, REL_TYPES.EXECUTES_SOSL, "SOSL:*", inLoop ? { inLoop: true } : {}));
+    }
+}
+/**
+ * T15 I-5: the dynamic query calls (`Database.query`, `Search.query`, ...)
+ * inside a loop body of `code` (strings/comments stripped), as sorted
+ * distinct canonical names. Stamped on the method / trigger node as
+ * `dynamicQueryInLoop`; empty when none.
+ */
+export function dynamicQueriesInLoop(code, inLoopAt) {
+    const out = new Set();
+    for (const m of code.matchAll(new RegExp(DYNAMIC_QUERY_RE.source, "gi"))) {
+        if (!inLoopAt(m.index ?? 0))
             continue;
+        const cls = (m[1] ?? "").toLowerCase() === "search" ? "Search" : "Database";
+        const op = (m[2] ?? "").toLowerCase();
+        const canon = [
+            "query",
+            "queryWithBinds",
+            "countQuery",
+            "countQueryWithBinds",
+            "getQueryLocator",
+            "getQueryLocatorWithBinds",
+        ].find((k) => k.toLowerCase() === op) ?? op;
+        out.add(`${cls}.${canon}`);
+    }
+    return [...out].sort();
+}
+/**
+ * Extract the outer object + SELECT clause from a SOQL query's inner text (the
+ * part after `[SELECT`). The object is the identifier after the first `FROM`
+ * encountered at parenthesis depth 0; subquery/semi-join FROMs (depth > 0) are
+ * skipped. Returns object=null for a malformed query.
+ */
+export function parseSoql(inner) {
+    let depth = 0;
+    for (let i = 0; i < inner.length; i++) {
+        const c = inner[i];
+        if (c === "(")
+            depth += 1;
+        else if (c === ")") {
+            if (depth > 0)
+                depth -= 1;
         }
-        // String literal — Apex uses single-quoted strings with `\\` and `\'` escapes
-        if (ch === "'") {
-            i += 1;
-            while (i < body.length) {
-                const c = body[i];
-                if (c === "\\") {
-                    i += 2;
-                    continue;
-                }
-                if (c === "'") {
-                    i += 1;
-                    break;
-                }
-                i += 1;
-            }
-            sawNonWhitespace = true;
+        else if (depth === 0 &&
+            (c === "f" || c === "F") &&
+            /^from\b/i.test(inner.slice(i)) &&
+            /\W/.test(inner[i - 1] ?? " ")) {
+            const m = inner.slice(i + 4).match(/^\s+([A-Za-z_][\w.]*)/);
+            if (m?.[1])
+                return { object: m[1], selectClause: inner.slice(0, i) };
+        }
+    }
+    return { object: null, selectClause: inner };
+}
+export const DML_RE = /\b(insert|update|delete|upsert|undelete|merge)\s+([A-Za-z_][\w.]*|\[)/gi;
+/** `Database.insert(recs)`, `Database.update(recs, false)`, `Database.INSERT(…)`:
+ *  the Database class DML methods (Apex is case-insensitive). Group 2 is the
+ *  first argument when it is a plain name. */
+export const DATABASE_DML_RE = /\bDatabase\s*\.\s*(insert|update|upsert|delete|undelete|merge)\s*\(\s*([A-Za-z_][\w.]*)?/gi;
+/**
+ * EXECUTES_DML `DML:<op>` for DML statements (`insert x;`, `delete [SELECT …]`)
+ * and Database DML calls (`Database.insert(x)`) in `code` (strings/comments
+ * stripped), stamped `inLoop` when inside a loop body. `target` is the record
+ * expression's name when there is one.
+ *
+ * When the record expression's sObject type is known (see `recordTypeAt`:
+ * `new T(…)`, an inline query, a variable `objects.lookup` types, or
+ * `Trigger.new` / `Trigger.old`), also EXECUTES_DML `CustomObject:<T>`, like
+ * EXECUTES_SOQL, one per object with the sorted operations in `ops`. That edge
+ * carries no `inLoop`: the governor checks read the `DML:<op>` marker, so a
+ * statement in a loop is reported once.
+ */
+export function emitDmlEdges(ctx, srcQname, code, inLoopAt, edges, objects = {}) {
+    const found = [];
+    for (const m of code.matchAll(new RegExp(DML_RE.source, "gi"))) {
+        const raw = m[2] ?? "";
+        const i = m.index ?? 0;
+        const target = raw === "[" || raw.toLowerCase() === "new" ? undefined : raw;
+        found.push({ i, op: (m[1] ?? "").toLowerCase(), target, arg: i + m[0].length - raw.length });
+    }
+    for (const m of code.matchAll(new RegExp(DATABASE_DML_RE.source, "gi"))) {
+        const t = m[2] && m[2].toLowerCase() !== "new" ? m[2] : undefined;
+        const i = m.index ?? 0;
+        const arg = i + m[0].length - (m[2] ?? "").length;
+        found.push({ i, op: (m[1] ?? "").toLowerCase(), target: t, arg });
+    }
+    found.sort((a, b) => a.i - b.i);
+    const byObject = new Map();
+    for (const f of found) {
+        edges.push(makeEdge(ctx, srcQname, REL_TYPES.EXECUTES_DML, `DML:${f.op}`, {
+            ...(f.target !== undefined ? { target: f.target } : {}),
+            ...(inLoopAt(f.i) ? { inLoop: true } : {}),
+        }));
+        const object = recordTypeAt(code, f.arg, objects);
+        if (!object)
+            continue;
+        const obj = stripNs(object, ctx.namespace);
+        const hit = byObject.get(obj.toLowerCase()) ?? { object: obj, ops: new Set() };
+        hit.ops.add(f.op);
+        byObject.set(obj.toLowerCase(), hit);
+    }
+    for (const { object, ops } of byObject.values()) {
+        edges.push(makeEdge(ctx, srcQname, REL_TYPES.EXECUTES_DML, `CustomObject:${object}`, {
+            ops: [...ops].sort(),
+        }));
+    }
+}
+/**
+ * Inline `[SELECT …]` queries in `code`: EXECUTES_SOQL on the outer FROM
+ * object (with `query`, `inLoop`) and READS_FIELD for every plain field the
+ * outer query names (SELECT list, WHERE / HAVING operands, GROUP BY, ORDER
+ * BY). Dotted relationship fields are not this object's fields: they are
+ * appended to `paths`.
+ */
+export function emitInlineSoqlEdges(ctx, srcQname, code, inLoopAt, edges, paths, children) {
+    for (const sq of findInlineQueries(code)) {
+        // Bind expressions (`:ids[0]`, an inline query held in a bind) are Apex,
+        // not this query's SOQL: blank their bracket groups for the grammar pass.
+        const inner = blankBracketGroups(sq.inner);
+        const { object } = parseSoql(inner);
+        const obj = stripNs(object ?? "", ctx.namespace);
+        edges.push(makeEdge(ctx, srcQname, REL_TYPES.EXECUTES_SOQL, `CustomObject:${obj}`, {
+            query: sq.text.trim(),
+            ...(inLoopAt(sq.index) ? { inLoop: true } : {}),
+        }));
+        if (!obj)
             continue;
+        const refs = soqlFieldRefs(inner);
+        for (const f of refs.fields)
+            edges.push(makeEdge(ctx, srcQname, REL_TYPES.READS_FIELD, `CustomField:${obj}.${f}`));
+        for (const p of refs.paths)
+            paths.push({ object: obj, path: p, rel: REL_TYPES.READS_FIELD });
+        // `TYPEOF What WHEN Account THEN Name …`: branch fields are read on the branch's type.
+        for (const b of refs.typeOf) {
+            const bObj = stripNs(b.object, ctx.namespace);
+            for (const f of b.fields)
+                edges.push(makeEdge(ctx, srcQname, REL_TYPES.READS_FIELD, `CustomField:${bObj}.${f}`));
+            for (const p of b.paths)
+                paths.push({ object: bObj, path: p, rel: REL_TYPES.READS_FIELD });
         }
-        if (ch === "(")
+        if (children)
+            addChildRelationships(children, obj, parseSoql(inner).selectClause);
+    }
+}
+/** Literal custom-field names: `'Name__c'` (optional namespace), nothing else in the quotes. */
+const FIELD_LITERAL_RE = /'((?:[A-Za-z][A-Za-z0-9]*__)?[A-Za-z][A-Za-z0-9_]*__c)'/g;
+/** Declared types that are never an sObject. */
+const NOT_SOBJECT = new Set(["sobject", "string", "object", "id", "map", "list", "set"]);
+/** Records `apexFieldNameLiterals` on a method node (see ApexFieldNameLiteral). */
+function setFieldNameLiterals(node, rawDecl, decls) {
+    const objects = new Set();
+    for (const d of decls) {
+        for (const t of [d.type, d.elem]) {
+            if (!t || t.includes(".") || NOT_SOBJECT.has(t.toLowerCase()))
+                continue;
+            if (/^[A-Za-z]\w*$/.test(t))
+                objects.add(t);
+        }
+    }
+    if (objects.size === 0)
+        return;
+    const fields = new Set();
+    for (const m of stripCommentsOnly(rawDecl).matchAll(FIELD_LITERAL_RE)) {
+        if (m[1])
+            fields.add(m[1]);
+    }
+    if (fields.size === 0)
+        return;
+    const objs = [...objects].sort().slice(0, 20);
+    node.attributes.apexFieldNameLiterals = [...fields]
+        .sort()
+        .slice(0, 200)
+        .map((field) => ({ field, objects: objs }));
+}
+/** Append the depth-1 `(SELECT …)` groups of `selectClause`, deduped on
+ *  (object, relationship) with their fields merged. One linear pass. */
+function addChildRelationships(into, object, selectClause) {
+    let depth = 0;
+    let start = -1;
+    for (let i = 0; i < selectClause.length; i++) {
+        const c = selectClause[i];
+        if (c === "(") {
             depth += 1;
-        else if (ch === ")") {
+            if (depth === 1)
+                start = i + 1;
+        }
+        else if (c === ")" && depth > 0) {
             depth -= 1;
-            if (depth === 0)
-                break;
+            if (depth !== 0)
+                continue;
+            const sub = /^\s*select\b/i.exec(selectClause.slice(start, i));
+            if (!sub)
+                continue;
+            const refs = soqlFieldRefs(selectClause.slice(start + sub[0].length, i));
+            if (!refs.object || refs.object.includes("."))
+                continue;
+            const hit = into.find((r) => r.object.toLowerCase() === object.toLowerCase() &&
+                r.relationship.toLowerCase() === refs.object?.toLowerCase());
+            const rec = hit ?? { object, relationship: refs.object, fields: [] };
+            if (!hit)
+                into.push(rec);
+            for (const f of refs.fields)
+                if (!rec.fields.some((x) => x.toLowerCase() === f.toLowerCase()))
+                    rec.fields.push(f);
         }
-        else if (ch === "," && depth === 1) {
-            argCount += 1;
+    }
+}
+/** Store child-relationship subqueries on a node (only when there are any). */
+function setChildRelationships(node, rels) {
+    if (!node || rels.length === 0)
+        return;
+    node.attributes.apexChildRelationships = rels;
+}
+/** Append `add` to `into`, deduped on (object, path, rel) case-insensitively. */
+function mergePaths(into, add) {
+    const seen = new Set(into.map((p) => `${p.object}|${p.path}|${p.rel}`.toLowerCase()));
+    for (const p of add) {
+        const k = `${p.object}|${p.path}|${p.rel}`.toLowerCase();
+        if (seen.has(k))
+            continue;
+        seen.add(k);
+        into.push(p);
+    }
+}
+const FIELD_ACCESS_RE = /\b([A-Z][A-Za-z0-9_]*(?:__r)?)\.([A-Za-z_][\w]*?)(?:__c)?\b/g;
+const NAMED_CRED_RE = /['"]callout:([A-Za-z_][\w]*)/g;
+/**
+ * Push READS_FIELD / WRITES_FIELD edges for member-access field refs, skipping
+ * any (rel, dst) already emitted for this source since `fromIdx` (e.g. a
+ * READS_FIELD from a SOQL select list) so existing edge attributes are kept.
+ */
+export function emitFieldAccessEdges(ctx, srcQname, accesses, edges, fromIdx) {
+    const seen = new Set();
+    for (let i = fromIdx; i < edges.length; i++) {
+        const e = edges[i];
+        if (e && String(e.srcQualifiedName) === srcQname)
+            seen.add(`${e.relType}|${String(e.dstQualifiedName).toLowerCase()}`);
+    }
+    const push = (rel, dst) => {
+        const key = `${rel}|${dst.toLowerCase()}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        edges.push(makeEdge(ctx, srcQname, rel, dst, { via: "member-access" }));
+    };
+    for (const a of accesses) {
+        const dst = `CustomField:${stripNs(a.object, ctx.namespace)}.${a.field}`;
+        if (a.read)
+            push(REL_TYPES.READS_FIELD, dst);
+        if (a.write)
+            push(REL_TYPES.WRITES_FIELD, dst);
+    }
+}
+/**
+ * READS_FIELD `dynamic: true` for the outer SELECT fields and the WHERE /
+ * HAVING / GROUP BY / ORDER BY field operands of each folded dynamic SOQL
+ * string in `queries` (see foldDynamicSoql, dynamicSoqlClauseFields). Only
+ * when the FROM object is literal text; computed fields are skipped. A
+ * (src, dst) READS_FIELD already emitted since `fromIdx` is not repeated.
+ * Returns the number of clause field operands skipped because FROM is
+ * computed (see setDynamicSoqlSkips).
+ */
+export function emitDynamicSoqlEdges(ctx, srcQname, queries, edges, fromIdx) {
+    const seen = new Set();
+    // Objects this source already queries (static SOQL): an added dynamic edge
+    // would replace that edge (the store merges last-wins) and could drop its
+    // `inLoop`, so those keep the static edge alone.
+    const queried = new Set();
+    for (let i = fromIdx; i < edges.length; i++) {
+        const e = edges[i];
+        if (!e || String(e.srcQualifiedName) !== srcQname)
+            continue;
+        if (e.relType === REL_TYPES.READS_FIELD)
+            seen.add(String(e.dstQualifiedName).toLowerCase());
+        else if (e.relType === REL_TYPES.EXECUTES_SOQL)
+            queried.add(String(e.dstQualifiedName).toLowerCase());
+    }
+    let skipped = 0;
+    for (const q of queries) {
+        const parsed = parseDynamicSoql(q);
+        const clause = dynamicSoqlClauseFields(q, parsed);
+        skipped += clause.skipped;
+        if (!parsed)
+            continue;
+        const obj = stripNs(parsed.object, ctx.namespace);
+        // The object the query reads, like a static `[SELECT …]`. No `inLoop`:
+        // loop detection for dynamic queries is `dynamicQueryInLoop` on the node.
+        const objDst = `CustomObject:${obj}`;
+        if (!queried.has(objDst.toLowerCase())) {
+            queried.add(objDst.toLowerCase());
+            edges.push(makeEdge(ctx, srcQname, REL_TYPES.EXECUTES_SOQL, objDst, {
+                query: q.split(PLACEHOLDER).join("…").trim().slice(0, 500),
+                dynamic: true,
+            }));
         }
-        else if (ch && /\S/.test(ch)) {
-            sawNonWhitespace = true;
+        for (const fname of [...parsed.fields, ...clause.fields]) {
+            const dst = `CustomField:${obj}.${fname}`;
+            if (seen.has(dst.toLowerCase()))
+                continue;
+            seen.add(dst.toLowerCase());
+            edges.push(makeEdge(ctx, srcQname, REL_TYPES.READS_FIELD, dst, { dynamic: true }));
         }
-        i += 1;
     }
-    if (depth !== 0)
-        return null; // unbalanced — let caller emit `(?)`
-    // No commas + no non-whitespace content between parens = arity 0.
-    // Any non-whitespace + N commas = N+1 args.
-    return sawNonWhitespace ? argCount + 1 : 0;
+    return skipped;
 }
-const NAMED_CRED_RE = /['"]callout:([A-Za-z_][\w]*)/g;
+/**
+ * Parse stat on a source node: `dynamicSoqlFieldsSkipped`, the dynamic SOQL
+ * clause field operands not attributed because the query's FROM is computed
+ * (only when there are any). The apex ref resolver sums it.
+ */
+export function setDynamicSoqlSkips(node, skipped) {
+    if (!node || skipped <= 0)
+        return;
+    const attrs = node.attributes;
+    attrs.dynamicSoqlFieldsSkipped = (attrs.dynamicSoqlFieldsSkipped ?? 0) + skipped;
+}
+/**
+ * Collapse repeated EXECUTES_SOQL / EXECUTES_DML facts with the same
+ * (src, rel, dst) into one, in place of first occurrence. The store merges
+ * edges last-wins on that key, so without this an out-of-loop query after an
+ * in-loop one on the same object erased `inLoop`. The kept fact carries
+ * `inLoop: true` if any occurrence did (taking that occurrence's attributes),
+ * and `count` = number of occurrences when more than one.
+ */
+export function aggregateGovernorFacts(edges) {
+    const out = [];
+    const byKey = new Map();
+    for (const e of edges) {
+        if (e.relType !== REL_TYPES.EXECUTES_SOQL && e.relType !== REL_TYPES.EXECUTES_DML) {
+            out.push(e);
+            continue;
+        }
+        const key = `${e.relType}|${String(e.srcQualifiedName)}|${String(e.dstQualifiedName).toLowerCase()}`;
+        const prev = byKey.get(key);
+        if (!prev) {
+            const copy = { ...e, attributes: { ...e.attributes } };
+            byKey.set(key, { edge: copy, count: 1 });
+            out.push(copy);
+            continue;
+        }
+        prev.count += 1;
+        const attrs = e.attributes;
+        if (attrs.inLoop === true && prev.edge.attributes.inLoop !== true)
+            prev.edge.attributes = { ...attrs };
+        prev.edge.attributes.count = prev.count;
+    }
+    return out;
+}
+const LOWER_NEW_RE = /\bnew\s+([a-z][A-Za-z0-9_]*)\s*\(/g;
+const LOWER_STATIC_CALL_RE = /(?<![\w.])([a-z][A-Za-z0-9_]*)\.([A-Za-z][A-Za-z0-9_]*)\s*\(/g;
+const NOT_A_CLASS = new Set(["this", "super"]);
 function parseClassNameAndIsTest(body) {
     const testTargets = new Set();
+    const lowerTargets = [];
     const m = body.match(/@isTest\s*\(\s*seeAllData\s*=\s*[^)]*\)|@isTest/i);
     if (!m)
-        return { isTest: false, testTargets };
+        return { isTest: false, testTargets, lowerTargets };
+    for (const re of [LOWER_NEW_RE, LOWER_STATIC_CALL_RE]) {
+        for (const x of body.matchAll(new RegExp(re.source, "g"))) {
+            const t = x[1] ?? "";
+            if (t && !NOT_A_CLASS.has(t))
+                lowerTargets.push(t);
+        }
+    }
     // crude: find class names referenced via `new X(` or `X.foo(`
     const re1 = new RegExp(NEW_INSTANCE_RE.source, "g");
     let mm = re1.exec(body);
@@ -214,7 +879,7 @@ function parseClassNameAndIsTest(body) {
             testTargets.add(mm[1]);
         mm = re2.exec(body);
     }
-    return { isTest: true, testTargets };
+    return { isTest: true, testTargets, lowerTargets };
 }
 export class ApexClassParser {
     category = METADATA_CATEGORY.APEX_CLASS;
@@ -224,7 +889,29 @@ export class ApexClassParser {
         const edges = [];
         const snippets = [];
         const className = stripNs(input.className, ctx.namespace);
-        const fileHash = sha256(input.body);
+        const shadowsManaged = extractShadowsManaged(input.metaXml);
+        const shadowAttr = shadowsManaged.length > 0 ? { shadowsManaged } : {};
+        // Fold the collision into the hash (only when present, so every other
+        // node keeps its hash): node merge skips attributes when the hash is
+        // unchanged, and the stored local node must pick up the attr.
+        const fileHash = sha256(`${APEX_NODE_HASH_SALT}\n${input.body}${shadowsManaged.length > 0 ? `\nshadowsManaged:${shadowsManaged.join(",")}` : ""}`);
+        // Managed-package Apex (and any member whose Body the extractor couldn't
+        // fetch) arrives with an empty body. That is NOT a parse failure — the
+        // class exists, we just can't see its source. Emit a bare node so
+        // referencing edges resolve to a real target, instead of a misleading
+        // ParseError (the apex-parser throws a non-Error on empty input, which the
+        // catch below would record as the useless message "[object Object]").
+        if (input.body.trim() === "") {
+            nodes.push(makeNode(ctx, "ApexClass", `ApexClass:${className}`, {
+                name: className,
+                modifiers: [],
+                isTest: false,
+                apiVersion: extractApiVersion(input.metaXml),
+                bodyUnavailable: true,
+                ...shadowAttr,
+            }, fileHash));
+            return { nodes, edges, snippets };
+        }
         // Read parser mode once per parse — env var lets us flip between
         // regex (the legacy path), ast (the new precise extractor), and both
         // (regex authoritative; ast diff logged for shadow validation).
@@ -238,25 +925,48 @@ export class ApexClassParser {
         // When parserMode != "regex", retain the parsed compilationUnit tree
         // so the AST extractor can walk it without parsing twice.
         let parsedTree = null;
+        let lexer = null;
+        let parser = null;
         try {
             // Lazy-load to avoid pulling apex-parser into other parsers' worker.
             const apex = await import("apex-parser");
             const { ApexLexer, ApexParser, CommonTokenStream, CaseInsensitiveInputStream, ThrowingErrorListener, } = apex;
-            const input1 = new CaseInsensitiveInputStream("file", input.body);
-            const lexer = new ApexLexer(input1);
+            const input1 = new CaseInsensitiveInputStream("file", rewriteNullCoalescing(input.body));
+            lexer = new ApexLexer(input1);
             lexer.removeErrorListeners();
             lexer.addErrorListener(new ThrowingErrorListener());
             const tokens = new CommonTokenStream(lexer);
-            const parser = new ApexParser(tokens);
+            parser = new ApexParser(tokens);
             parser.removeErrorListeners();
             parser.addErrorListener(new ThrowingErrorListener());
             parsedTree = parser.compilationUnit();
         }
         catch (err) {
-            const errMsg = err instanceof Error ? err.message : String(err);
+            const errMsg = formatParseError(err);
             nodes.push(makeNode(ctx, "ParseError", `ParseError:ApexClass:${className}`, { className, message: errMsg }, sha256(`${className}:${errMsg}`)));
+            // Keep a stub for the type itself so grants, references and calls to it
+            // still resolve; `parseFailed` marks it as having no extracted body.
+            const stubSrc = stripCommentsAndStrings(input.body);
+            const stubHeader = extractClassHeader(stubSrc);
+            const stubLabel = stubHeader.isInterface ? "ApexInterface" : "ApexClass";
+            // Cheap fallback when the broken body defeats the header scan: an
+            // `@isTest` annotation before the first class keyword.
+            const stubIsTest = stubHeader.isTest || /@istest\b[^{;]*?\bclass\b/i.test(stubSrc);
+            nodes.push(makeNode(ctx, stubLabel, `${stubLabel}:${className}`, {
+                name: className,
+                modifiers: [],
+                isTest: stubIsTest,
+                apiVersion: extractApiVersion(input.metaXml),
+                parseFailed: true,
+                ...shadowAttr,
+            }, fileHash));
             return { nodes, edges };
         }
+        finally {
+            // The tree (if kept) does not depend on the DFA cache.
+            if (parser)
+                noteApexSyntaxCheck(lexer, parser);
+        }
         const cleaned = stripCommentsAndStrings(input.body);
         const header = extractClassHeader(cleaned);
         const effectiveName = header.name || className;
@@ -264,21 +974,78 @@ export class ApexClassParser {
             ? `ApexInterface:${effectiveName}`
             : `ApexClass:${effectiveName}`;
         const apiVersion = extractApiVersion(input.metaXml);
+        const dispatch = extractVlocityDispatch(input.body, header.implementsList);
+        // `final` String fields: an IP / DataRaptor name passed as a constant.
+        const stringConstants = classStringConstants(input.body);
         nodes.push(makeNode(ctx, header.isInterface ? "ApexInterface" : "ApexClass", classQname, {
             name: effectiveName,
             modifiers: header.modifiers,
             isTest: header.isTest,
             apiVersion,
+            ...(dispatch ? { vlocityDispatch: dispatch } : {}),
+            ...shadowAttr,
         }, fileHash));
-        if (header.extendsClass) {
+        if (header.isInterface) {
+            // An interface extends interfaces, possibly several.
+            for (const parent of header.extendsList) {
+                edges.push(makeEdge(ctx, classQname, REL_TYPES.EXTENDS, `ApexInterface:${stripNs(parent, ctx.namespace)}`));
+            }
+        }
+        else if (header.extendsClass) {
             edges.push(makeEdge(ctx, classQname, REL_TYPES.EXTENDS, `ApexClass:${stripNs(header.extendsClass, ctx.namespace)}`));
         }
         for (const impl of header.implementsList) {
             edges.push(makeEdge(ctx, classQname, REL_TYPES.IMPLEMENTS, `ApexInterface:${stripNs(impl, ctx.namespace)}`));
         }
         // Methods
-        const methods = findMethods(cleaned);
+        const usedDecls = new Set();
+        const maskedBody = maskApex(input.body);
+        const methods = findMethods(cleaned, effectiveName);
+        // Member-access field refs: each method falls back to the fields/properties
+        // declared directly in ITS enclosing class body (constructor/initializer
+        // locals and other inner classes' fields are excluded); types declared in
+        // this file (inner classes, enums, interfaces) are never SObjects.
+        const scopes = classScopes(cleaned);
+        const localTypes = new Set([...cleaned.matchAll(/\b(?:class|enum|interface)\s+([A-Za-z_]\w*)/gi)].map((x) => (x[1] ?? "").toLowerCase()));
+        // Fields of the method's class and of every enclosing class: an inner
+        // class can use its outer class's (static) fields.
+        const enclosingFields = (pos) => {
+            const out = [];
+            const seen = new Set();
+            for (let c = scopes.classAt(pos); c >= 0 && !seen.has(c); c = scopes.classAt(c)) {
+                seen.add(c);
+                out.push(...scopes.fields(c));
+            }
+            return out;
+        };
+        const refScope = {
+            selfName: effectiveName,
+            localTypes,
+            // File-wide set: used for code outside method bodies and for test-class
+            // linkage. Each method gets its own set below (its params, its body's
+            // declarations and its enclosing class's fields).
+            localVars: localVarNames([
+                ...collectDecls(cleaned),
+                ...methods.flatMap((m) => paramDecls(m.params)),
+            ]),
+        };
+        // Methods declared in this file (inner classes' too: all are qnamed
+        // under the outer class), for same-class call targets.
+        const declared = new Map();
         for (const m of methods) {
+            const d = declared.get(m.name.toLowerCase()) ?? { name: m.name, arities: new Set() };
+            d.arities.add(m.params.length);
+            declared.set(m.name.toLowerCase(), d);
+        }
+        const parentName = header.isInterface ? null : header.extendsClass;
+        emitPageRefEdges(ctx, classQname, cleaned, edges);
+        const methodQueries = [];
+        const methodNodes = new Map();
+        const classPaths = [];
+        const classChildren = [];
+        const declRanges = [];
+        for (const m of methods) {
+            const methodEdgeStart = edges.length;
             const methodQname = `ApexMethod:${effectiveName}.${m.name}(${m.params.length})`;
             const annotationsLower = m.annotations.map((a) => a.toLowerCase());
             const auraEnabled = annotationsLower.includes("auraenabled");
@@ -288,7 +1055,7 @@ export class ApexClassParser {
             const isTestMethod = annotationsLower.includes("istest") || annotationsLower.includes("testsetup");
             const httpVerbs = ["httpget", "httppost", "httpput", "httppatch", "httpdelete"].filter((v) => annotationsLower.includes(v));
             const isTestLabel = isTestMethod || (header.isTest && m.modifiers.includes("static"));
-            nodes.push(makeNode(ctx, isTestLabel ? "TestMethod" : "ApexMethod", methodQname, {
+            const methodNode = makeNode(ctx, isTestLabel ? "TestMethod" : "ApexMethod", methodQname, {
                 name: m.name,
                 arity: m.params.length,
                 returnType: m.returnType,
@@ -307,7 +1074,9 @@ export class ApexClassParser {
                 // or @isTest on the enclosing class with the method static.
                 // Never derived from filename.
                 isTest: isTestLabel,
-            }, sha256(m.body)));
+            }, sha256(`${APEX_NODE_HASH_SALT}\n${m.body}`));
+            nodes.push(methodNode);
+            methodNodes.set(methodQname, methodNode);
             edges.push(makeEdge(ctx, classQname, REL_TYPES.CONTAINS_METHOD, methodQname));
             // Snippet: emit the raw method body from the ORIGINAL source (preserves
             // comments + strings) keyed on the method's qname.
@@ -340,49 +1109,67 @@ export class ApexClassParser {
             if (endLine != null)
                 snippetRec.endLine = endLine;
             snippets.push(snippetRec);
+            // Apex -> Vlocity calls (IP / DataRaptor), extracted from the raw body.
+            // `rawBody` above locates the method by first textual occurrence of its
+            // name (which can be a call site), so locate the declaration properly here.
+            const decl = declRawBody(input.body, maskedBody, m, usedDecls);
+            if (decl)
+                declRanges.push(decl);
+            const rawDecl = decl?.text ?? null;
+            const vc = extractVlocityCalls(rawDecl ?? "", stringConstants, m.params);
+            for (const k of vc.ipKeys)
+                edges.push(makeEdge(ctx, methodQname, REL_TYPES.APEX_CALLS_IP, `IntegrationProcedure:${k}`));
+            for (const d of vc.drNames)
+                edges.push(makeEdge(ctx, methodQname, REL_TYPES.APEX_CALLS_DR, `DataRaptor:${d}`));
+            if (rawDecl !== null) {
+                setFieldNameLiterals(methodNode, rawDecl, [
+                    ...paramDecls(m.params),
+                    ...collectDecls(m.body),
+                ]);
+            }
             // Body analysis (regex path — gated when parserMode === "ast").
             const body = m.body;
+            const methodPaths = [];
+            const accessPaths = [];
+            const fieldAccesses = extractFieldAccesses(body, {
+                decls: [...paramDecls(m.params), ...collectDecls(body)],
+                outer: scopes.fields(scopes.classAt(m.startIdx)),
+                excludedTypes: localTypes,
+                paths: accessPaths,
+            });
             if (parserMode === "ast") {
+                setRelationshipPaths(methodNode, accessPaths);
+                emitFieldAccessEdges(ctx, methodQname, fieldAccesses, edges, methodEdgeStart);
                 // AST mode handles per-method edges in a single tree walk after this loop;
                 // skip the regex extraction here to avoid duplicate / inconsistent edges.
                 continue;
             }
-            // SOQL
-            const soqlRe = new RegExp(SOQL_RE.source, "gi");
-            let sq = soqlRe.exec(body);
-            while (sq !== null) {
-                const obj = stripNs(sq[2] ?? "", ctx.namespace);
-                edges.push(makeEdge(ctx, methodQname, REL_TYPES.EXECUTES_SOQL, `CustomObject:${obj}`, {
-                    query: sq[0]?.trim(),
-                }));
-                // READS_FIELD for SELECT clause fields
-                const selectFields = (sq[1] ?? "")
-                    .split(",")
-                    .map((s) => s.trim())
-                    .filter((s) => s.length > 0 && !/[()*]/.test(s));
-                for (const f of selectFields) {
-                    const fname = f.split(/\s+/)[0] ?? "";
-                    if (/^[A-Za-z_][\w]*$/.test(fname)) {
-                        edges.push(makeEdge(ctx, methodQname, REL_TYPES.READS_FIELD, `CustomField:${obj}.${fname}`));
-                    }
-                }
-                sq = soqlRe.exec(body);
-            }
-            // SOSL
-            const soslRe = new RegExp(SOSL_RE.source, "gi");
-            if (soslRe.test(body)) {
-                edges.push(makeEdge(ctx, methodQname, REL_TYPES.EXECUTES_SOSL, "SOSL:*"));
-            }
-            // DML
-            const dmlRe = new RegExp(DML_RE.source, "gi");
-            let dm = dmlRe.exec(body);
-            while (dm !== null) {
-                const op = (dm[1] ?? "").toLowerCase();
-                edges.push(makeEdge(ctx, methodQname, REL_TYPES.EXECUTES_DML, `DML:${op}`, {
-                    target: dm[2],
-                }));
-                dm = dmlRe.exec(body);
+            // Loop-body ranges for governor in-loop detection (regex path). The AST
+            // extractor stamps inLoop itself; this gives the DEFAULT (regex) path the
+            // same signal so governor_risk_check works without SFGRAPH_APEX_PARSER=ast.
+            const loopRanges = computeLoopRanges(body);
+            const inLoopAt = (idx) => loopRanges.some((r) => idx > r.start && idx < r.end);
+            // SOQL: EXECUTES_SOQL + READS_FIELD for the outer query's fields.
+            const methodChildren = [];
+            emitInlineSoqlEdges(ctx, methodQname, body, inLoopAt, edges, methodPaths, methodChildren);
+            setChildRelationships(methodNode, methodChildren);
+            mergePaths(methodPaths, accessPaths);
+            setRelationshipPaths(methodNode, methodPaths);
+            emitFieldAccessEdges(ctx, methodQname, fieldAccesses, edges, methodEdgeStart);
+            // SOSL (inLoop when any SOSL sits in a loop body) and dynamic queries
+            // in a loop body (governor risks, T15 I-5).
+            emitSoslEdge(ctx, methodQname, body, inLoopAt, edges);
+            const dynInLoop = dynamicQueriesInLoop(body, inLoopAt);
+            if (dynInLoop.length > 0) {
+                methodNode.attributes.dynamicQueryInLoop = dynInLoop;
             }
+            // DML (statements and Database.<op>(…) calls), linked to the object
+            // when the record expression's type is known.
+            const outerFields = enclosingFields(m.startIdx);
+            emitDmlEdges(ctx, methodQname, body, inLoopAt, edges, {
+                lookup: makeTypeLookup([...paramDecls(m.params), ...collectDecls(body)], outerFields),
+                excludedTypes: localTypes,
+            });
             // Named credentials (scan the ORIGINAL method body — strings are stripped from `body`).
             const ncSource = (() => {
                 const idx = input.body.indexOf(m.name);
@@ -398,30 +1185,89 @@ export class ApexClassParser {
             let nc = ncRe.exec(ncSource);
             while (nc !== null) {
                 edges.push(makeEdge(ctx, methodQname, REL_TYPES.CALLS_NAMED_CREDENTIAL, `NamedCredential:${stripNs(nc[1] ?? "", ctx.namespace)}`));
-                nc = ncRe.exec(body);
+                // Continue over the SAME source we started on (ncSource). Re-executing a
+                // stateful /g regex against a different string (`body`) reset its
+                // lastIndex semantics and dropped every named credential after the first.
+                nc = ncRe.exec(ncSource);
             }
-            // Calls to other static methods (best-effort)
-            const scRe = new RegExp(STATIC_CALL_RE.source, "g");
-            let sc = scRe.exec(body);
-            while (sc !== null) {
-                const target = sc[1] ?? "";
-                const targetMethod = sc[2] ?? "";
-                if (target !== effectiveName && /^[A-Z]/.test(target)) {
-                    // The regex's match index + match length lands one char before
-                    // the `(`. Walk forward past any whitespace to find it, then
-                    // count balanced args. When counting succeeds we emit a precise
-                    // arity dst (same shape AST pass uses), which skips the
-                    // arity-resolver's overload fan-out entirely.
-                    const matchEnd = scRe.lastIndex - 1;
-                    const arity = countCallArgs(body, matchEnd);
-                    const dstArity = arity == null ? "?" : String(arity);
-                    const attrs = arity == null
-                        ? { unresolvedArity: true }
-                        : { resolvedBy: "regex-arg-count", arity };
-                    edges.push(makeEdge(ctx, methodQname, REL_TYPES.CALLS, `ApexMethod:${stripNs(target, ctx.namespace)}.${targetMethod}(${dstArity})`, attrs));
+            // Calls to other static methods (best-effort), constructors and
+            // static-member references.
+            // Scanned on the length-preserving mask (quotes kept, contents blanked)
+            // so a string argument still counts toward the call's arity.
+            const callCode = rawDecl === null ? body : maskApex(rawDecl);
+            const methodScope = {
+                ...refScope,
+                localVars: localVarNames([
+                    ...paramDecls(m.params),
+                    ...collectDecls(body),
+                    ...enclosingFields(m.startIdx),
+                ]),
+            };
+            emitStaticCallEdges(ctx, methodQname, callCode, effectiveName, edges, methodScope.localVars);
+            const callLookup = makeTypeLookup([...paramDecls(m.params), ...collectDecls(callCode)], outerFields);
+            emitInstanceCallEdges(ctx, methodQname, callCode, {
+                lookup: callLookup,
+                scope: methodScope,
+                selfName: effectiveName,
+                parentName,
+                declared,
+                fields: outerFields,
+            }, edges, methodEdgeStart);
+            emitNameRefEdges(ctx, methodQname, callCode, rawDecl, { lookup: callLookup, scope: methodScope }, edges, methodEdgeStart);
+            emitClassRefEdges(ctx, methodQname, callCode, methodScope, edges);
+            // The signature is outside `callCode`: prepend it so parameter and
+            // return types count for the method too.
+            const sig = `${m.returnType} ${m.name}(${m.params.join(", ")});\n`;
+            emitTypeRefEdges(ctx, methodQname, sig + callCode, methodScope, edges, methodEdgeStart);
+            emitDescribeRefEdges(ctx, methodQname, callCode, edges);
+            const queries = rawDecl === null ? [] : foldDynamicSoql(rawDecl);
+            methodQueries.push(...queries);
+            setDynamicSoqlSkips(methodNode, emitDynamicSoqlEdges(ctx, methodQname, queries, edges, methodEdgeStart));
+        }
+        // Code outside method bodies (field initializers, constructors, static
+        // blocks, method signatures) is attributed to the class itself.
+        if (parserMode !== "ast") {
+            const outside = maskedBody.split("");
+            for (const d of declRanges) {
+                for (let k = d.start; k < d.start + d.text.length; k++) {
+                    if (outside[k] !== "\n")
+                        outside[k] = " ";
                 }
-                sc = scRe.exec(body);
             }
+            const rest = outside.join("");
+            emitStaticCallEdges(ctx, classQname, rest, effectiveName, edges, refScope.localVars);
+            // Outside method bodies a name is typed only when every declaration of
+            // it agrees (no positional scoping across constructors / initialisers).
+            const restDecls = collectDecls(rest);
+            const restLookup = makeTypeLookup([], restDecls);
+            emitInstanceCallEdges(ctx, classQname, rest, {
+                lookup: restLookup,
+                scope: refScope,
+                selfName: effectiveName,
+                parentName,
+                declared,
+                fields: restDecls,
+            }, edges);
+            emitNameRefEdges(ctx, classQname, rest, input.body, { lookup: restLookup, scope: refScope }, edges);
+            emitClassRefEdges(ctx, classQname, rest, refScope, edges);
+            emitTypeRefEdges(ctx, classQname, rest, refScope, edges);
+            emitDescribeRefEdges(ctx, classQname, rest, edges);
+            // Dynamic SOQL outside method bodies (constants, constructors): every
+            // folded query in the file minus those already attributed to a method.
+            const left = new Map();
+            for (const q of methodQueries)
+                left.set(q, (left.get(q) ?? 0) + 1);
+            const classQueries = foldDynamicSoql(input.body).filter((q) => {
+                const n = left.get(q) ?? 0;
+                if (n > 0)
+                    left.set(q, n - 1);
+                return n === 0;
+            });
+            setDynamicSoqlSkips(nodes.find((n) => String(n.qualifiedName) === classQname), emitDynamicSoqlEdges(ctx, classQname, classQueries, edges, 0));
+            // Inline SOQL outside method bodies (static field initialisers,
+            // constructors, initializer blocks) belongs to the class.
+            const restLoops = computeLoopRanges(rest);
+            emitInlineSoqlEdges(ctx, classQname, rest, (idx) => restLoops.some((r) => idx > r.start && idx < r.end), edges, classPaths, classChildren);
         }
         // AST-mode (and shadow mode): walk the parsed compilationUnit and emit
         // edges that the regex pass cannot derive (real call arity, dotted field
@@ -438,13 +1284,33 @@ export class ApexClassParser {
                 if (parserMode === "both") {
                     // Tag AST edges so a shadow diff can distinguish overlap.
                     for (const e of extraction.edges) {
-                        e.attributes.resolvedBy = "ast-shadow";
+                        e.attributes.callResolution = "ast-shadow";
                         edges.push(e);
                     }
                 }
                 else {
-                    for (const e of extraction.edges)
+                    // Member-access field edges were already emitted per method; the AST
+                    // dotted-ref / select-list READS_FIELD to the same (src, dst) would
+                    // only duplicate them.
+                    const fieldKeys = new Set(edges
+                        .filter((e) => e.relType === REL_TYPES.READS_FIELD || e.relType === REL_TYPES.WRITES_FIELD)
+                        .map((e) => `${e.relType}|${String(e.srcQualifiedName)}|${String(e.dstQualifiedName).toLowerCase()}`));
+                    for (const e of extraction.edges) {
+                        const key = `${e.relType}|${String(e.srcQualifiedName)}|${String(e.dstQualifiedName).toLowerCase()}`;
+                        if (fieldKeys.has(key))
+                            continue;
+                        if (e.relType === REL_TYPES.READS_FIELD || e.relType === REL_TYPES.WRITES_FIELD)
+                            fieldKeys.add(key);
                         edges.push(e);
+                    }
+                }
+                if (parserMode === "ast") {
+                    // "both" keeps the regex paths (regex is authoritative there).
+                    for (const [qn, paths] of extraction.relationshipPaths) {
+                        const target = methodNodes.get(qn) ?? nodes.find((n) => String(n.qualifiedName) === classQname);
+                        if (target)
+                            setRelationshipPaths(target, paths);
+                    }
                 }
                 if (process.env.SFGRAPH_DEBUG_INGEST === "1" && extraction.diagnostics.length > 0) {
                     ctx.logger?.debug?.("apex ast diagnostics", {
@@ -462,16 +1328,51 @@ export class ApexClassParser {
         }
         // Test class linkage
         if (header.isTest) {
-            const { testTargets } = parseClassNameAndIsTest(cleaned);
+            const { testTargets, lowerTargets } = parseClassNameAndIsTest(cleaned);
+            // Lowercase-initial names (`new myController()`) are legal class
+            // names but indistinguishable from variables here: keep them as
+            // candidates the post-merge resolver matches against known classes.
+            const candidates = [];
+            for (const t of lowerTargets) {
+                if (t.toLowerCase() === effectiveName.toLowerCase())
+                    continue;
+                if (!isUserClassName(t, refScope) || refScope.localVars.has(t.toLowerCase()))
+                    continue;
+                if (candidates.some((c) => c.toLowerCase() === t.toLowerCase()))
+                    continue;
+                candidates.push(t);
+            }
+            const classNode = nodes.find((n) => String(n.qualifiedName) === classQname);
+            if (classNode && candidates.length > 0)
+                classNode.attributes.testTargetCandidates = candidates;
             for (const t of testTargets) {
                 if (t === effectiveName)
                     continue;
-                if (!/^[A-Z]/.test(t))
+                // Only plausible user classes: not Apex system types/namespaces
+                // (Database, System, Test, String), SObjects, types declared in this
+                // file, or declared variables/fields used as call receivers.
+                if (!isUserClassName(t, refScope) || refScope.localVars.has(t.toLowerCase()))
                     continue;
                 edges.push(makeEdge(ctx, classQname, REL_TYPES.IS_TEST_FOR, `ApexClass:${stripNs(t, ctx.namespace)}`));
             }
         }
-        return { nodes, edges, snippets };
+        setChildRelationships(nodes.find((n) => String(n.qualifiedName) === classQname), classChildren);
+        if (classPaths.length > 0) {
+            const classNode = nodes.find((n) => String(n.qualifiedName) === classQname);
+            if (classNode)
+                setRelationshipPaths(classNode, classPaths);
+        }
+        return { nodes, edges: aggregateGovernorFacts(edges), snippets };
     }
 }
+/** Store relationship paths on a node (only when there are any). */
+function setRelationshipPaths(node, paths) {
+    if (paths.length === 0)
+        return;
+    const attrs = node.attributes;
+    const cur = attrs.apexRelationshipPaths ?? [];
+    const merged = [...cur];
+    mergePaths(merged, paths);
+    attrs.apexRelationshipPaths = merged;
+}
 //# sourceMappingURL=class.js.map