@ryanstark24/sfgraph-core 1.2.0 → 1.6.0

package/dist/analyze/edge-filters.d.ts

@@ -0,0 +1,62 @@
+import type { EdgeFact } from "../domain/index.js";
+/**
+ * Edge classification + filtering shared by the traversal tools
+ * (trace_upstream / trace_downstream).
+ *
+ * Real-org traces are dominated by two kinds of edge that are technically
+ * correct but almost never what "what depends on X / what does X depend on"
+ * is asking for:
+ *
+ *   1. Security grants — every Profile/PermissionSet that can see an Apex
+ *      class emits a GRANTS_APEX_ACCESS edge. A class used by 111 profiles
+ *      buries its single IS_TEST_FOR / CALLS edge under 111 grant edges.
+ *   2. Reflection-walker inferences — low-confidence REFERENCES edges tagged
+ *      `source: "reflection"`, emitted when a node's blob string happens to
+ *      match another node's bare name. On Vlocity nodes these produce
+ *      spurious links like DataRaptor:Foo → CustomApplication:DataRaptor.
+ *
+ * Dependency/dependent traces exclude both by default; callers can opt back
+ * in (a dedicated security view, or "show inferred references").
+ */
+/** Security / sharing grant edges — relationship of access, not of code dependency. */
+export declare const SECURITY_GRANT_RELTYPES: ReadonlySet<string>;
+/**
+ * False for a Profile/PermissionSet entry that grants nothing. Retrieved profiles list most
+ * fields, objects and classes with every flag false (`<readable>false</readable>`); the parsers
+ * keep those entries as GRANTS_* edges with the flags as attributes. Counting them as access
+ * inflated "who can see this field" and hid real FLS gaps. An edge without the flags (another
+ * source, an older graph) still counts.
+ */
+export declare function isEffectiveGrant(e: Pick<EdgeFact, "relType" | "attributes">): boolean;
+/** True for a low-confidence reflection-walker REFERENCES edge. */
+export declare function isReflectionEdge(e: EdgeFact): boolean;
+export interface EdgeFilterOpts {
+    /** Only keep these relTypes (applied before excludes). */
+    includeRelTypes?: ReadonlySet<string>;
+    /** Drop these relTypes. */
+    excludeRelTypes?: ReadonlySet<string>;
+    /** Drop security/sharing grant edges. Default true for dependency traces. */
+    excludeSecurity?: boolean;
+    /** Drop reflection-inferred REFERENCES edges. Default true for traces. */
+    excludeReflection?: boolean;
+}
+/** Decide whether an edge survives the filter. */
+export declare function keepEdge(e: EdgeFact, opts: EdgeFilterOpts): boolean;
+/**
+ * Downstream "containment is not a dependency" rule.
+ *
+ * A trace that reaches a CustomObject would otherwise walk DEFINES_FIELD to
+ * every field of the object (hundreds on a standard object), then field ->
+ * field formula READS_FIELD, then HAS_VALIDATION_RULE etc. None of that is
+ * something the traced component depends on — the object *contains* those
+ * members. When `leafStructure` is on, a non-root node whose label is in
+ * STRUCTURE_LEAF_LABELS is not expanded along STRUCTURAL_RELTYPES; the node
+ * itself stays in the result as a leaf.
+ */
+export declare const STRUCTURE_LEAF_LABELS: ReadonlySet<string>;
+export declare const STRUCTURAL_RELTYPES: ReadonlySet<string>;
+/** Label of a qname from its `<Label>:` prefix ("" when there is none). */
+export declare function labelOfQname(qname: string): string;
+/** True when `e` is a containment edge out of an object/field-like node. */
+export declare function isStructuralEdge(e: EdgeFact): boolean;
+//# sourceMappingURL=edge-filters.d.ts.map

package/dist/analyze/edge-filters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-filters.d.ts","sourceRoot":"","sources":["../../src/analyze/edge-filters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGnD;;;;;;;;;;;;;;;;;;GAkBG;AAEH,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAWtD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,YAAY,CAAC,GAAG,OAAO,CA0BrF;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO,CAKrD;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,2BAA2B;IAC3B,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,6EAA6E;IAC7E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,kDAAkD;AAClD,wBAAgB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CASnE;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAMpD,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CASlD,CAAC;AAEH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,GAAG,OAAO,CAKrD"}

package/dist/analyze/edge-filters.js

@@ -0,0 +1,127 @@
+import { REL_TYPES } from "../domain/index.js";
+/**
+ * Edge classification + filtering shared by the traversal tools
+ * (trace_upstream / trace_downstream).
+ *
+ * Real-org traces are dominated by two kinds of edge that are technically
+ * correct but almost never what "what depends on X / what does X depend on"
+ * is asking for:
+ *
+ *   1. Security grants — every Profile/PermissionSet that can see an Apex
+ *      class emits a GRANTS_APEX_ACCESS edge. A class used by 111 profiles
+ *      buries its single IS_TEST_FOR / CALLS edge under 111 grant edges.
+ *   2. Reflection-walker inferences — low-confidence REFERENCES edges tagged
+ *      `source: "reflection"`, emitted when a node's blob string happens to
+ *      match another node's bare name. On Vlocity nodes these produce
+ *      spurious links like DataRaptor:Foo → CustomApplication:DataRaptor.
+ *
+ * Dependency/dependent traces exclude both by default; callers can opt back
+ * in (a dedicated security view, or "show inferred references").
+ */
+/** Security / sharing grant edges — relationship of access, not of code dependency. */
+export const SECURITY_GRANT_RELTYPES = new Set([
+    REL_TYPES.GRANTS_OBJECT_ACCESS,
+    REL_TYPES.GRANTS_FIELD_ACCESS,
+    REL_TYPES.GRANTS_APEX_ACCESS,
+    REL_TYPES.GRANTS_PAGE_ACCESS,
+    REL_TYPES.GRANTS_TAB_ACCESS,
+    REL_TYPES.GRANTS_USER_PERMISSION,
+    REL_TYPES.SHARING_GRANTS,
+    REL_TYPES.SHARING_TO_GROUP,
+    REL_TYPES.SHARING_TO_ROLE,
+    REL_TYPES.SHARING_FROM_OWNER_GROUP,
+]);
+/**
+ * False for a Profile/PermissionSet entry that grants nothing. Retrieved profiles list most
+ * fields, objects and classes with every flag false (`<readable>false</readable>`); the parsers
+ * keep those entries as GRANTS_* edges with the flags as attributes. Counting them as access
+ * inflated "who can see this field" and hid real FLS gaps. An edge without the flags (another
+ * source, an older graph) still counts.
+ */
+export function isEffectiveGrant(e) {
+    const a = (e.attributes ?? {});
+    const anyTrue = (keys) => {
+        const present = keys.filter((k) => a[k] !== undefined);
+        return present.length === 0 || present.some((k) => a[k] === true);
+    };
+    switch (e.relType) {
+        case REL_TYPES.GRANTS_FIELD_ACCESS:
+            return anyTrue(["readable", "editable"]);
+        case REL_TYPES.GRANTS_OBJECT_ACCESS:
+            return anyTrue([
+                "allowRead",
+                "allowEdit",
+                "allowCreate",
+                "allowDelete",
+                "viewAllRecords",
+                "modifyAllRecords",
+            ]);
+        case REL_TYPES.GRANTS_APEX_ACCESS:
+        case REL_TYPES.GRANTS_PAGE_ACCESS:
+            return a.enabled !== false;
+        case REL_TYPES.GRANTS_TAB_ACCESS:
+            return a.visibility !== "Hidden";
+        default:
+            return true;
+    }
+}
+/** True for a low-confidence reflection-walker REFERENCES edge. */
+export function isReflectionEdge(e) {
+    return (e.relType === REL_TYPES.REFERENCES &&
+        e.attributes?.source === "reflection");
+}
+/** Decide whether an edge survives the filter. */
+export function keepEdge(e, opts) {
+    if (opts.includeRelTypes && !opts.includeRelTypes.has(e.relType))
+        return false;
+    if (opts.excludeRelTypes?.has(e.relType))
+        return false;
+    if (SECURITY_GRANT_RELTYPES.has(e.relType)) {
+        if (opts.excludeSecurity !== false)
+            return false;
+        if (!isEffectiveGrant(e))
+            return false;
+    }
+    if (opts.excludeReflection !== false && isReflectionEdge(e))
+        return false;
+    return true;
+}
+/**
+ * Downstream "containment is not a dependency" rule.
+ *
+ * A trace that reaches a CustomObject would otherwise walk DEFINES_FIELD to
+ * every field of the object (hundreds on a standard object), then field ->
+ * field formula READS_FIELD, then HAS_VALIDATION_RULE etc. None of that is
+ * something the traced component depends on — the object *contains* those
+ * members. When `leafStructure` is on, a non-root node whose label is in
+ * STRUCTURE_LEAF_LABELS is not expanded along STRUCTURAL_RELTYPES; the node
+ * itself stays in the result as a leaf.
+ */
+export const STRUCTURE_LEAF_LABELS = new Set([
+    "CustomObject",
+    "CustomField",
+    "ValidationRule",
+    "RecordType",
+    "NamedCredential",
+]);
+export const STRUCTURAL_RELTYPES = new Set([
+    REL_TYPES.DEFINES_FIELD,
+    REL_TYPES.HAS_VALIDATION_RULE,
+    REL_TYPES.HAS_RECORD_TYPE,
+    REL_TYPES.CONTAINS,
+    // field -> field (formula) and ValidationRule -> field reads
+    REL_TYPES.READS_FIELD,
+    // dependent picklist -> controlling field
+    REL_TYPES.DEPENDS_ON_FIELD,
+]);
+/** Label of a qname from its `<Label>:` prefix ("" when there is none). */
+export function labelOfQname(qname) {
+    const i = qname.indexOf(":");
+    return i > 0 ? qname.slice(0, i) : "";
+}
+/** True when `e` is a containment edge out of an object/field-like node. */
+export function isStructuralEdge(e) {
+    return (STRUCTURAL_RELTYPES.has(e.relType) &&
+        STRUCTURE_LEAF_LABELS.has(labelOfQname(e.srcQualifiedName)));
+}
+//# sourceMappingURL=edge-filters.js.map

package/dist/analyze/edge-filters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge-filters.js","sourceRoot":"","sources":["../../src/analyze/edge-filters.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AAEH,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAClE,SAAS,CAAC,oBAAoB;IAC9B,SAAS,CAAC,mBAAmB;IAC7B,SAAS,CAAC,kBAAkB;IAC5B,SAAS,CAAC,kBAAkB;IAC5B,SAAS,CAAC,iBAAiB;IAC3B,SAAS,CAAC,sBAAsB;IAChC,SAAS,CAAC,cAAc;IACxB,SAAS,CAAC,gBAAgB;IAC1B,SAAS,CAAC,eAAe;IACzB,SAAS,CAAC,wBAAwB;CACnC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAA2C;IAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG,CAAC,IAAuB,EAAW,EAAE;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QAClB,KAAK,SAAS,CAAC,mBAAmB;YAChC,OAAO,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAC3C,KAAK,SAAS,CAAC,oBAAoB;YACjC,OAAO,OAAO,CAAC;gBACb,WAAW;gBACX,WAAW;gBACX,aAAa;gBACb,aAAa;gBACb,gBAAgB;gBAChB,kBAAkB;aACnB,CAAC,CAAC;QACL,KAAK,SAAS,CAAC,kBAAkB,CAAC;QAClC,KAAK,SAAS,CAAC,kBAAkB;YAC/B,OAAO,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC;QAC7B,KAAK,SAAS,CAAC,iBAAiB;YAC9B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;QACnC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,CAAW;IAC1C,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,UAAU;QACjC,CAAC,CAAC,UAA+C,EAAE,MAAM,KAAK,YAAY,CAC5E,CAAC;AACJ,CAAC;AAaD,kDAAkD;AAClD,MAAM,UAAU,QAAQ,CAAC,CAAW,EAAE,IAAoB;IACxD,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,eAAe,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,IAAI,gBAAgB,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,SAAS,CAAC,aAAa;IACvB,SAAS,CAAC,mBAAmB;IAC7B,SAAS,CAAC,eAAe;IACzB,SAAS,CAAC,QAAQ;IAClB,6DAA6D;IAC7D,SAAS,CAAC,WAAW;IACrB,0CAA0C;IAC1C,SAAS,CAAC,gBAAgB;CAC3B,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,CAAW;IAC1C,OAAO,CACL,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAC5D,CAAC;AACJ,CAAC"}

package/dist/analyze/field-scope.d.ts

@@ -0,0 +1,25 @@
+import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { GraphStore } from "../storage/interfaces.js";
+/**
+ * True for a CustomField qname whose field name has no custom `__<suffix>`
+ * (`CustomField:Account.Name`, `CustomField:Case.OwnerId`): a standard field.
+ * False for every other label and for custom fields (`Account.X__c`).
+ */
+export declare function isStandardFieldQname(qname: string): boolean;
+/**
+ * The namespace prefix of one API-name part, by the suffix grammar:
+ * `ns__Name__c` (any NAMESPACED_SUFFIXES suffix) and `ns__Field__Sub__s`
+ * -> `ns`. `Name__c`, `Loc__Latitude__s`, standard names, unknown suffixes
+ * and malformed parts -> null.
+ */
+export declare function namespaceOfApiName(part: string): string | null;
+/**
+ * The managed-package namespaces the org's own schema shows, lower-cased:
+ * every `ns` of an object or field API name shaped `ns__Name__c` (any
+ * namespaced custom suffix, `namespaceOfApiName`). Read from the graph, never from a fixed list. Cached per store and
+ * org until the sync generation or the object/field counts change.
+ */
+export declare function managedNamespaces(store: GraphStore, orgId: OrgId): ReadonlySet<string>;
+/** `managedNamespaces` as the `isManagedNamespace` pseudo-endpoint option. */
+export declare function managedNamespaceCheck(store: GraphStore, orgId: OrgId): (ns: string) => boolean;
+//# sourceMappingURL=field-scope.d.ts.map

package/dist/analyze/field-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-scope.d.ts","sourceRoot":"","sources":["../../src/analyze/field-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAmB3D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI3D;AAWD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ9D;AAKD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CA2BtF;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAG9F"}

package/dist/analyze/field-scope.js

@@ -0,0 +1,94 @@
+/**
+ * Field and namespace grammar for the dependency answers (Batch R / S2).
+ *
+ * Salesforce API names carry their kind in a suffix: a custom field ends in
+ * `__c` (`__pc` on person accounts, `__s` for a compound sub-field), a
+ * managed-package member also carries its namespace prefix (`ns__Name__c`).
+ * A field name with no `__<suffix>` is a standard field (`Account.Name`).
+ */
+const SUFFIXED = /__[A-Za-z0-9]+$/;
+/** The field part of a `CustomField:Object.Field` qname (after the last dot). */
+function fieldPart(qname) {
+    const name = qname.slice(qname.indexOf(":") + 1);
+    return name.slice(name.lastIndexOf(".") + 1);
+}
+/**
+ * True for a CustomField qname whose field name has no custom `__<suffix>`
+ * (`CustomField:Account.Name`, `CustomField:Case.OwnerId`): a standard field.
+ * False for every other label and for custom fields (`Account.X__c`).
+ */
+export function isStandardFieldQname(qname) {
+    if (!qname.startsWith("CustomField:"))
+        return false;
+    const f = fieldPart(qname);
+    return f.length > 0 && !SUFFIXED.test(f);
+}
+/** Custom API-name suffixes after which a third `__` part is a namespace
+ *  (`ns__Name__c`): fields/objects, relationships, platform events, custom
+ *  metadata types, external and big objects, person-account fields. */
+const NAMESPACED_SUFFIXES = new Set(["c", "r", "e", "mdt", "x", "b", "pc"]);
+/** A compound-field sub-field is `Field__Sub__s` (`Loc__Latitude__s`), so a
+ *  namespace is a fourth part (`ns__Loc__Latitude__s`). */
+const SUBFIELD_SUFFIX = "s";
+const NS_GRAMMAR = /^[A-Za-z][A-Za-z0-9_]*$/;
+/**
+ * The namespace prefix of one API-name part, by the suffix grammar:
+ * `ns__Name__c` (any NAMESPACED_SUFFIXES suffix) and `ns__Field__Sub__s`
+ * -> `ns`. `Name__c`, `Loc__Latitude__s`, standard names, unknown suffixes
+ * and malformed parts -> null.
+ */
+export function namespaceOfApiName(part) {
+    const bits = part.split("__");
+    const suffix = bits[bits.length - 1] ?? "";
+    const want = NAMESPACED_SUFFIXES.has(suffix) ? 3 : suffix === SUBFIELD_SUFFIX ? 4 : 0;
+    if (want === 0 || bits.length !== want)
+        return null;
+    if (bits.some((b) => b.length === 0))
+        return null;
+    const ns = bits[0];
+    return NS_GRAMMAR.test(ns) ? ns : null;
+}
+const nsCache = new WeakMap();
+/**
+ * The managed-package namespaces the org's own schema shows, lower-cased:
+ * every `ns` of an object or field API name shaped `ns__Name__c` (any
+ * namespaced custom suffix, `namespaceOfApiName`). Read from the graph, never from a fixed list. Cached per store and
+ * org until the sync generation or the object/field counts change.
+ */
+export function managedNamespaces(store, orgId) {
+    let gen = 0;
+    try {
+        gen = store.getSyncStatus(orgId).generation;
+    }
+    catch {
+        gen = -1;
+    }
+    const key = `${gen}:${store.countNodesByLabel(orgId, "CustomObject")}:${store.countNodesByLabel(orgId, "CustomField")}`;
+    let byOrg = nsCache.get(store);
+    if (!byOrg) {
+        byOrg = new Map();
+        nsCache.set(store, byOrg);
+    }
+    const hit = byOrg.get(String(orgId));
+    if (hit && hit.key === key)
+        return hit.set;
+    const set = new Set();
+    for (const label of ["CustomObject", "CustomField"]) {
+        for (const n of store.listNodesByLabel(orgId, label)) {
+            const q = String(n.qualifiedName);
+            for (const part of q.slice(q.indexOf(":") + 1).split(".")) {
+                const ns = namespaceOfApiName(part);
+                if (ns)
+                    set.add(ns.toLowerCase());
+            }
+        }
+    }
+    byOrg.set(String(orgId), { key, set });
+    return set;
+}
+/** `managedNamespaces` as the `isManagedNamespace` pseudo-endpoint option. */
+export function managedNamespaceCheck(store, orgId) {
+    const set = managedNamespaces(store, orgId);
+    return (ns) => set.has(ns.toLowerCase());
+}
+//# sourceMappingURL=field-scope.js.map

package/dist/analyze/field-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-scope.js","sourceRoot":"","sources":["../../src/analyze/field-scope.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC,iFAAiF;AACjF,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;uEAEuE;AACvE,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AACjG;2DAC2D;AAC3D,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAGD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAyC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAiB,EAAE,KAAY;IAC/D,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,CAAC,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;IACxH,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,EAAE;oBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,KAAiB,EAAE,KAAY;IACnE,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3C,CAAC"}

package/dist/analyze/find-nodes.d.ts

@@ -1,27 +1,45 @@
-import type { OrgId } from "@ryanstark24/sfgraph-shared";
+import type { OrgId, QualifiedName } from "@ryanstark24/sfgraph-shared";
 import type { NodeFact } from "../domain/index.js";
 import type { GraphStore } from "../storage/interfaces.js";
 /**
- * Glob-pattern node lookup. Patterns use the conventional shell glob
- * vocabulary (handled by picomatch):
+ * Glob-pattern node lookup, case-insensitive (like every other lookup):
  *
- *   - `*`   matches any non-separator characters
- *   - `?`   matches a single character
- *   - `**`  matches zero or more segments (separator = `.`)
- *   - `[abc]` / `[a-z]` character classes
- *   - `{a,b}` brace expansion
+ *   - `*` / `**`  any run of characters, dots and slashes included
+ *                 (`CustomField:Account.*`, `ApexMethod:Svc*`)
+ *   - `?`         a single character
+ *   - `[abc]` / `[a-z]` / `[!a]`  character classes
+ *   - `{a,b}`     alternatives, nesting allowed (`{a}` without a comma is
+ *                 literal braces, its inner groups still expand, as in bash)
+ *   - `\x`        a literal `x`
  *
- * The separator is `.` not `/` — node qualified names like
- * `CustomField:Account.Name` make a dot-separator more natural than the
- * Unix path-style. picomatch is configured accordingly.
+ * The whole pattern, every alternative included, compiles once into one
+ * position automaton (Glushkov NFA, at most one state per pattern atom) that
+ * runs as a lazily built DFA: each name is one pass over its characters, and
+ * each DFA transition is computed once and then reused for every name. There
+ * is no backtracking (audit sec-02: picomatch compiled `*?*?…` into nested
+ * lazy groups and a 30-char pattern blocked the server for 24 s; a later
+ * per-alternative matcher still took 8 s on `{,}`x8 patterns).
+ *
+ * Limits, each failing with a clear error instead of running long:
+ *   - pattern length <= MAX_GLOB_PATTERN_LENGTH;
+ *   - distinct brace expansions <= MAX_GLOB_ALTERNATIVES (deduplicated, so
+ *     `{,}{,}` is one alternative);
+ *   - DFA construction work <= MAX_GLOB_DFA_WORK (bounds a pattern whose DFA
+ *     would blow up exponentially).
  *
  * Result ordering: lexicographic by qualifiedName. The cap defaults to
  * 500 with `truncated: true` set on overflow — at that scale the agent
  * should refine the pattern rather than scan further.
  */
+export declare const MAX_GLOB_ALTERNATIVES = 64;
+export declare const MAX_GLOB_PATTERN_LENGTH = 512;
+/** Work units (position visits) allowed for building DFA transitions. */
+export declare const MAX_GLOB_DFA_WORK = 1000000;
+/** Compile a case-insensitive glob into a predicate over qualified names. */
+export declare function compileGlob(pattern: string): (qname: string) => boolean;
 export interface FindNodesOpts {
     /** When set, restrict matching to nodes of this label (e.g. `ApexClass`,
-     *  `CustomField`). Faster than scanning every label table when the
+     *  `CustomField`; case-insensitive). Faster than scanning every label table when the
      *  pattern is type-anchored. */
     label?: string;
     /** Result cap. Default 500. */
@@ -35,4 +53,22 @@ export interface FindNodesResult {
     total: number;
 }
 export declare function findNodesByGlob(store: GraphStore, orgId: OrgId, pattern: string, opts?: FindNodesOpts): FindNodesResult;
+/** A `findNodeNamesByGlob` match: just what a listing needs. */
+export interface NodeName {
+    qualifiedName: QualifiedName;
+    label: string;
+}
+export interface FindNodeNamesResult {
+    matches: NodeName[];
+    truncated: boolean;
+    total: number;
+}
+/**
+ * `findNodesByGlob` without reading node rows: the same matches, in the same
+ * order, as `{ qualifiedName, label }`. Reads only the qualified names
+ * (`listQnamesByLabel`: same rows, same order and per-label cap as
+ * `listNodesByLabel`) instead of parsing every node's attributes; stores
+ * without it fall back to `listNodesByLabel`.
+ */
+export declare function findNodeNamesByGlob(store: GraphStore, orgId: OrgId, pattern: string, opts?: FindNodesOpts): FindNodeNamesResult;
 //# sourceMappingURL=find-nodes.d.ts.map

package/dist/analyze/find-nodes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"find-nodes.d.ts","sourceRoot":"","sources":["../../src/analyze/find-nodes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,aAAa;IAC5B;;oCAEgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB;2BACuB;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB,eAAe,CAkCjB"}
+{"version":3,"file":"find-nodes.d.ts","sourceRoot":"","sources":["../../src/analyze/find-nodes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAoK3C,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAqGvE;AAED,MAAM,WAAW,aAAa;IAC5B;;oCAEgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB;2BACuB;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB,eAAe,CA6BjB;AAED,gEAAgE;AAChE,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB,mBAAmB,CAwBrB"}