@weftlet/toolkit 0.6.1 → 0.7.1

package/dist/extraction/mapping-provider.js

@@ -0,0 +1,60 @@
+import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resolveConsumerModule } from '../infrastructure/module-resolution.js';
+import { sha256, stableJson } from '../infrastructure/util.js';
+import { prepareCodexAuthentication } from './codex-auth.js';
+import { resolveCodexInvocation } from './codex-command.js';
+import { runSemanticProcess, SemanticProviderError } from './semantic-process.js';
+import { mappingOutputSchema } from './mapping-output.js';
+import { mappingPrompt } from './mapping-prompt.js';
+import { mappingVersion } from './mapping-request.js';
+export const mappingProviderIdentity = (config) => sha256(stableJson({ version: mappingVersion, provider: config.provider,
+    model: config.model, reasoningEffort: config.reasoningEffort, providerModule: config.providerModule,
+    providerIdentity: config.providerIdentity, authMode: config.auth?.mode ?? 'chatgpt' }));
+/** Same Codex authentication choice as extraction; one bounded request, with no automatic retry. */
+export function createMappingProvider(config, repositoryRoot, runtime = {}) {
+    const identity = mappingProviderIdentity(config);
+    return { identity, async propose(input, options) {
+            if (config.provider === 'module') {
+                let factory;
+                try {
+                    factory = (await import(resolveConsumerModule(config.providerModule, repositoryRoot))).createMappingProposalProvider;
+                }
+                catch {
+                    throw new SemanticProviderError('unavailable', 'Mapping provider module could not be loaded');
+                }
+                if (typeof factory !== 'function')
+                    throw new SemanticProviderError('unavailable', 'Module must export createMappingProposalProvider(config); semantic providers are not implicitly compatible');
+                const provider = await factory(config);
+                if (provider?.identity !== config.providerIdentity || typeof provider.propose !== 'function')
+                    throw new SemanticProviderError('unavailable', 'Mapping provider identity/contract mismatch');
+                options.signal.throwIfAborted();
+                return provider.propose(input, options);
+            }
+            const command = 'codex';
+            const env = await (runtime.authenticate ?? prepareCodexAuthentication)(config.auth, process.env, command, options);
+            const invocation = await (runtime.invocation ?? resolveCodexInvocation)(command, env, process.platform, options);
+            options.signal.throwIfAborted();
+            const root = await mkdtemp(join(tmpdir(), 'weftlet-mapping-'));
+            try {
+                const schema = join(root, 'schema.json'), output = join(root, 'output.json');
+                await writeFile(schema, JSON.stringify(mappingOutputSchema));
+                const args = ['exec', '--ephemeral', '--ignore-user-config', '--ignore-rules', '--skip-git-repo-check',
+                    '--disable', 'shell_tool', '--cd', root, '--sandbox', 'read-only', '--model', config.model,
+                    '-c', `model_reasoning_effort="${config.reasoningEffort}"`, '--output-schema', schema, '--output-last-message', output, '-'];
+                await (runtime.run ?? runSemanticProcess)(invocation.command, [...invocation.prefixArgs, ...args], root, mappingPrompt(input), env, options);
+                if ((await stat(output)).size > 131_072)
+                    throw new SemanticProviderError('invalid-output', 'Mapping output exceeds 128 KiB');
+                try {
+                    return JSON.parse(await readFile(output, 'utf8'));
+                }
+                catch {
+                    throw new SemanticProviderError('invalid-output', 'Mapping output is not JSON');
+                }
+            }
+            finally {
+                await rm(root, { recursive: true, force: true });
+            }
+        } };
+}

package/dist/extraction/mapping-request.d.ts

@@ -0,0 +1,3 @@
+import type { MappingProposalRequest } from '@weftlet/core';
+export declare const mappingVersion: "mapping-proposal-v1";
+export declare function parseMappingRequest(value: unknown): Required<MappingProposalRequest>;

package/dist/extraction/mapping-request.js

@@ -0,0 +1,32 @@
+export const mappingVersion = 'mapping-proposal-v1';
+export function parseMappingRequest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw Error('Mapping request must be an object');
+    const item = value;
+    if (Object.keys(item).some(key => !['snapshotId', 'ruleId', 'documentPath', 'files', 'maxCandidates', 'maxInputBytes'].includes(key)))
+        throw Error('Unknown mapping request field');
+    const text = (value, max) => {
+        if (typeof value !== 'string' || !value.trim() || value.length > max)
+            throw Error('Invalid mapping request string');
+        return value;
+    };
+    const path = (value) => {
+        const s = text(value, 8192);
+        if (/[:\\\x00-\x1f\x7f]/.test(s) || s.split('/').some(part => !part || ['.', '..', '.git'].includes(part)))
+            throw Error('Mapping paths must be repository relative regular source paths');
+        return s;
+    };
+    const limit = (key, fallback, max) => {
+        const n = item[key] === undefined ? fallback : item[key];
+        if (!Number.isSafeInteger(n) || Number(n) < 1 || Number(n) > max)
+            throw Error(`Invalid ${key}; maximum ${max}`);
+        return Number(n);
+    };
+    if (!Array.isArray(item.files) || !item.files.length || item.files.length > 4)
+        throw Error('Select between one and four mapping files');
+    const files = item.files.map(path).sort();
+    if (new Set(files).size !== files.length)
+        throw Error('Duplicate mapping file');
+    return { snapshotId: text(item.snapshotId, 256), ruleId: text(item.ruleId, 8192), documentPath: path(item.documentPath), files,
+        maxCandidates: limit('maxCandidates', 8, 20), maxInputBytes: limit('maxInputBytes', 32_768, 131_072) };
+}

package/dist/extraction/ontology.d.ts

@@ -29,4 +29,6 @@ export declare class DirectRdfOntologyCompiler implements OntologyCompiler {
     constructor(storageRoot: string);
     compile(snapshotId: string, artifacts: readonly SemanticArtifact[]): Promise<OntologyCompileResult>;
 }
+/** Exact legacy stableJson([{content, path}, ...]) digest, including UTF-8 decoding/escaping. */
+export declare function digestRdfFiles(root: string, files: readonly string[]): Promise<string>;
 export {};

package/dist/extraction/ontology.js

@@ -1,14 +1,15 @@
 // Modified for standalone extraction; see docs/extraction-manifest.json.
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
 import { withCommittedTree } from "../repository/committed-tree.js";
 import { DataFactory, Store, Writer } from 'n3';
 import { CG, nodeIri } from "../graph/rdf.js";
-import { cp, mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { cp, mkdir, readdir, rm, writeFile } from 'node:fs/promises';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { runProcess } from "../infrastructure/process.js";
-import { sha256, stableJson } from "../infrastructure/util.js";
 const probeDocker = async (cwd) => {
     const { stdout } = await promisify(execFile)('docker', ['info', '--format', '{{.OSType}}'], {
         cwd,
@@ -130,11 +131,7 @@ export class OpenCaesarOntologyCompiler {
         const rdfFiles = await listRdfFiles(rdfRoot);
         if (rdfFiles.length === 0)
             throw new Error('openCAESAR produced no RDF files');
-        const digestParts = await Promise.all(rdfFiles.map(async (path) => ({
-            path: relative(rdfRoot, path),
-            content: await readFile(path, 'utf8'),
-        })));
-        return { root: rdfRoot, rdfFiles, digest: sha256(stableJson(digestParts)) };
+        return { root: rdfRoot, rdfFiles, digest: await digestRdfFiles(rdfRoot, rdfFiles) };
     }
 }
 /** Default compiler preserves asserted semantics without Java, Docker, or an OWL reasoner. */
@@ -152,13 +149,31 @@ export class DirectRdfOntologyCompiler {
             }
         }
         const writer = new Writer({ format: 'N-Triples' });
-        writer.addQuads(dataset.getQuads(null, null, null, null));
-        const text = await new Promise((accept, reject) => writer.end((error, value) => error ? reject(error) : accept(value)));
-        const content = text.split('\n').filter(Boolean).sort().join('\n') + '\n';
+        const lines = Array.from(dataset, quad => writer.quadToString(quad.subject, quad.predicate, quad.object, quad.graph)).sort();
         const root = join(this.storageRoot, 'work', `rdf-${randomUUID()}`);
         await mkdir(root, { recursive: true });
         const path = join(root, 'semantic.nt');
-        await writeFile(path, content);
-        return { root, rdfFiles: [path], digest: sha256(content) };
+        const digest = createHash('sha256');
+        function* content() {
+            // The legacy empty dataset encodes a single newline too.
+            for (const line of lines.length ? lines : ['\n']) {
+                digest.update(line);
+                yield line;
+            }
+        }
+        await pipeline(content(), createWriteStream(path, { flags: 'wx' }));
+        return { root, rdfFiles: [path], digest: digest.digest('hex') };
+    }
+}
+/** Exact legacy stableJson([{content, path}, ...]) digest, including UTF-8 decoding/escaping. */
+export async function digestRdfFiles(root, files) {
+    const hash = createHash('sha256').update('[');
+    for (const [index, path] of files.entries()) {
+        hash.update(`${index ? ',' : ''}{"content":"`);
+        for await (const chunk of createReadStream(path, { encoding: 'utf8' })) {
+            hash.update(JSON.stringify(chunk).slice(1, -1));
+        }
+        hash.update(`","path":${JSON.stringify(relative(root, path))}}`);
     }
+    return hash.update(']').digest('hex');
 }

package/dist/extraction/routing.js

@@ -1,4 +1,5 @@
 import { posix } from 'node:path';
+import { parseUniqueJson as uniqueJson } from '../infrastructure/unique-json.js';
 import { repositoryFileNode as fileNode } from '@weftlet/core';
 import { sha256, stableJson } from '../infrastructure/util.js';
 export const routingExtractorIdentity = { id: 'routing-declaration-extractor', version: '1.1.0' };
@@ -20,29 +21,13 @@ function repositoryPath(value) {
 }
 /** JSON.parse alone silently accepts duplicate keys, which would hide conflicting declarations. */
 function parseUniqueJson(content, path) {
-    let parsed;
     try {
-        parsed = JSON.parse(content);
+        return uniqueJson(content);
     }
-    catch {
-        throw new Error(`Invalid routing source ${path}: malformed JSON`);
+    catch (error) {
+        const reason = error instanceof Error && error.message === 'Duplicate JSON key' ? 'duplicate JSON key' : 'malformed JSON';
+        throw new Error(`Invalid routing source ${path}: ${reason}`);
     }
-    const objects = [];
-    for (const token of content.matchAll(/"(?:\\.|[^"\\])*"|[{}\[\]]/g)) {
-        const value = token[0];
-        if (value === '{' || value === '[')
-            objects.push(value === '{' ? new Set() : undefined);
-        else if (value === '}' || value === ']')
-            objects.pop();
-        else if (/^\s*:/.test(content.slice(token.index + value.length))) {
-            const keys = objects.at(-1);
-            const key = JSON.parse(value);
-            if (keys.has(key))
-                throw new Error(`Invalid routing source ${path}: duplicate JSON key ${key}`);
-            keys.add(key);
-        }
-    }
-    return parsed;
 }
 function parseRoutes(content, path) {
     if (Buffer.byteLength(content) > 65_536)

package/dist/extraction/scip-occurrences.d.ts

@@ -0,0 +1,3 @@
+import { type ExtractionContext, type ExtractorIdentity, type GraphFact } from '@weftlet/core';
+import type { ScipIndex } from './scip-runtime.js';
+export declare function extractCodeOccurrences(index: ScipIndex, sources: ReadonlyMap<string, string>, context: ExtractionContext, indexDigest: string, identity: ExtractorIdentity): readonly GraphFact[];

package/dist/extraction/scip-occurrences.js

@@ -0,0 +1,102 @@
+import { codeSymbolNode, repositoryFileNode } from '@weftlet/core';
+import { sha256, stableJson } from '../infrastructure/util.js';
+import { comparePosition, containsRange, rangeText, scipRange } from './scip-ranges.js';
+function readSites(index, sources, commitSha) {
+    const result = [];
+    for (const document of index.documents) {
+        const path = document.relative_path.replaceAll('\\', '/');
+        if (!path || path.startsWith('/') || /^[A-Za-z]:/.test(path) ||
+            path.split('/').some(part => !part || part === '.' || part === '..'))
+            throw new Error('Invalid SCIP repository path');
+        const content = sources.get(path);
+        if (content === undefined)
+            throw new Error(`Missing committed SCIP source: ${path}`);
+        const lines = content.split('\n'), digest = sha256(content);
+        for (const occurrence of document.occurrences) {
+            if (!occurrence.symbol)
+                continue;
+            if (!Number.isSafeInteger(occurrence.symbol_roles) || occurrence.symbol_roles < 0)
+                throw new Error('Invalid SCIP symbol roles');
+            const range = scipRange(occurrence.range, lines, path);
+            const definition = (occurrence.symbol_roles & 1) !== 0;
+            const declarationRange = definition && occurrence.enclosing_range?.length
+                ? scipRange(occurrence.enclosing_range, lines, path) : undefined;
+            // Native extents may cover an arrow initializer after its variable name.
+            // Preserve both ranges; containment of the name is not a SCIP invariant.
+            result.push({ key: stableJson([occurrence.symbol.startsWith('local ') ? path : '', occurrence.symbol]),
+                nativeSymbol: occurrence.symbol, nativeRoles: occurrence.symbol_roles, definition,
+                label: rangeText(range, lines), span: { path, ...range, digest, commitSha },
+                ...(declarationRange ? { declarationRange } : {}) });
+        }
+    }
+    return result;
+}
+function symbolsFor(sites, context, indexDigest) {
+    const grouped = new Map();
+    for (const site of sites) {
+        const group = grouped.get(site.key) ?? [];
+        group.push(site);
+        grouped.set(site.key, group);
+    }
+    return new Map([...grouped].map(([key, group]) => {
+        const definitions = group.filter(site => site.definition);
+        const first = group[0], local = first.nativeSymbol.startsWith('local ');
+        const labels = definitions.map(site => site.label).filter(Boolean).sort();
+        const node = codeSymbolNode({ schemaVersion: 1, provider: 'scip-typescript', repositoryId: context.repositoryId,
+            nativeSymbol: first.nativeSymbol, identityScope: local ? 'index-document' : 'repository',
+            ...(local ? { documentPath: first.span.path, indexDigest } : {}),
+            resolution: definitions.length === 0 ? 'no-indexed-definition' : definitions.every(site => /\.d\.[cm]?ts$/.test(site.span.path))
+                ? 'declaration-only' : 'indexed-definition' }, labels[0] ?? first.nativeSymbol);
+        return [key, node];
+    }));
+}
+/** Sweep sorted sites against active native declaration extents, not every declaration in the file. */
+function enclosures(sites, symbols) {
+    const result = new Map();
+    const files = new Map();
+    for (const site of sites) {
+        const group = files.get(site.span.path) ?? [];
+        group.push(site);
+        files.set(site.span.path, group);
+    }
+    for (const group of files.values()) {
+        const ordered = [...group].sort((a, b) => comparePosition(a.span.startLine, a.span.startColumn, b.span.startLine, b.span.startColumn));
+        const scopes = group.filter(site => site.declarationRange).sort((a, b) => comparePosition(a.declarationRange.startLine, a.declarationRange.startColumn, b.declarationRange.startLine, b.declarationRange.startColumn));
+        let cursor = 0;
+        let active = [];
+        for (const site of ordered) {
+            while (cursor < scopes.length && comparePosition(scopes[cursor].declarationRange.startLine, scopes[cursor].declarationRange.startColumn, site.span.startLine, site.span.startColumn) <= 0)
+                active.push(scopes[cursor++]);
+            active = active.filter(scope => comparePosition(scope.declarationRange.endLine, scope.declarationRange.endColumn, site.span.startLine, site.span.startColumn) >= 0);
+            // A recursive reference is enclosed by its own symbol; its definition is not self-enclosed.
+            const candidates = active.filter(scope => !(site.definition && scope.key === site.key) && containsRange(scope.declarationRange, site.span));
+            const narrowest = candidates.filter(scope => !candidates.some(other => containsRange(scope.declarationRange, other.declarationRange) && !containsRange(other.declarationRange, scope.declarationRange)));
+            const ids = [...new Set(narrowest.map(scope => symbols.get(scope.key).id))];
+            result.set(site, ids.length === 1 ? { enclosure: 'native-range', enclosingSymbolId: ids[0] }
+                : { enclosure: ids.length ? 'ambiguous' : 'file' });
+        }
+    }
+    return result;
+}
+export function extractCodeOccurrences(index, sources, context, indexDigest, identity) {
+    const sites = readSites(index, sources, context.commitSha);
+    const symbols = symbolsFor(sites, context, indexDigest);
+    const byId = new Map([...symbols.values()].map(symbol => [symbol.id, symbol]));
+    const scopes = enclosures(sites, symbols);
+    const facts = sites.map(site => {
+        const symbol = symbols.get(site.key);
+        const scope = scopes.get(site);
+        const file = repositoryFileNode(site.span.path);
+        const codeOccurrence = { schemaVersion: 1, role: site.definition ? 'definition' : 'reference',
+            locationKind: site.span.startLine === site.span.endLine && site.span.startColumn === site.span.endColumn ? 'zero-width-anchor' : 'name',
+            nativeRoles: site.nativeRoles, ...scope, ...(site.declarationRange ? { declarationRange: site.declarationRange } : {}) };
+        const fact = {
+            subject: site.definition ? symbol : scope.enclosingSymbolId ? byId.get(scope.enclosingSymbolId) : file,
+            predicate: site.definition ? 'definedBy' : 'references', object: site.definition ? file : symbol,
+            provenance: site.span, codeOccurrence, extractor: identity, authority: 'implemented', extractionReview: 'deterministic', confidence: 1,
+        };
+        return { ...fact, id: sha256(stableJson(fact)), snapshotId: context.snapshotId };
+    });
+    // Duplicate native entries at the identical target/range/role add no distinct evidence.
+    return [...new Map(facts.map(fact => [fact.id, fact])).values()].sort((a, b) => a.id.localeCompare(b.id));
+}

package/dist/extraction/scip-ranges.d.ts

@@ -0,0 +1,6 @@
+import type { CodeRange } from '@weftlet/core';
+export declare function comparePosition(line: number, column: number, otherLine: number, otherColumn: number): number;
+export declare function containsRange(outer: CodeRange, inner: CodeRange): boolean;
+/** SCIP TypeScript uses zero-based UTF-16 positions; graph citations are one-based. */
+export declare function scipRange(raw: readonly number[], lines: readonly string[], path: string): CodeRange;
+export declare function rangeText(range: CodeRange, lines: readonly string[]): string;

package/dist/extraction/scip-ranges.js

@@ -0,0 +1,31 @@
+export function comparePosition(line, column, otherLine, otherColumn) {
+    return line - otherLine || column - otherColumn;
+}
+export function containsRange(outer, inner) {
+    return comparePosition(outer.startLine, outer.startColumn, inner.startLine, inner.startColumn) <= 0 &&
+        comparePosition(outer.endLine, outer.endColumn, inner.endLine, inner.endColumn) >= 0;
+}
+/** SCIP TypeScript uses zero-based UTF-16 positions; graph citations are one-based. */
+export function scipRange(raw, lines, path) {
+    if ((raw.length !== 3 && raw.length !== 4) || raw.some(value => !Number.isSafeInteger(value) || value < 0)) {
+        throw new Error(`Invalid SCIP range in ${path}`);
+    }
+    const startLine = raw[0] + 1;
+    const endLine = (raw.length === 3 ? raw[0] : raw[2]) + 1;
+    // TypeScript's file reader strips a leading UTF-8 BOM. Citations address the
+    // original committed text, whose first line retains that UTF-16 code unit.
+    const firstLineOffset = lines[0]?.startsWith('\uFEFF') ? 1 : 0;
+    const startColumn = raw[1] + 1 + (startLine === 1 ? firstLineOffset : 0);
+    const endColumn = raw.at(-1) + 1 + (endLine === 1 ? firstLineOffset : 0);
+    if (startLine > lines.length || endLine > lines.length || startColumn > lines[startLine - 1].length + 1 ||
+        endColumn > lines[endLine - 1].length + 1 || comparePosition(startLine, startColumn, endLine, endColumn) > 0) {
+        throw new Error(`SCIP range is outside committed source in ${path}`);
+    }
+    return { startLine, startColumn, endLine, endColumn, columnEncoding: 'utf-16' };
+}
+export function rangeText(range, lines) {
+    if (range.startLine === range.endLine)
+        return lines[range.startLine - 1].slice(range.startColumn - 1, range.endColumn - 1);
+    return [lines[range.startLine - 1].slice(range.startColumn - 1),
+        ...lines.slice(range.startLine, range.endLine - 1), lines[range.endLine - 1].slice(0, range.endColumn - 1)].join('\n');
+}

package/dist/extraction/scip-runtime.d.ts

@@ -0,0 +1,39 @@
+export interface ScipOccurrence {
+    readonly range: readonly number[];
+    readonly symbol: string;
+    readonly symbol_roles: number;
+    readonly enclosing_range?: readonly number[];
+}
+export interface ScipDocument {
+    readonly relative_path: string;
+    readonly occurrences: readonly ScipOccurrence[];
+    readonly symbols: readonly ScipSymbolInformation[];
+}
+interface ScipSymbolInformation {
+    documentation: string[];
+}
+export interface ScipIndex {
+    readonly documents: readonly ScipDocument[];
+    readonly external_symbols: readonly ScipSymbolInformation[];
+    readonly metadata?: {
+        project_root: string;
+    };
+    serializeBinary(): Uint8Array;
+}
+interface ScipRuntime {
+    readonly scip: {
+        readonly Index: {
+            deserializeBinary(bytes: Uint8Array): ScipIndex;
+        };
+    };
+}
+export declare function loadScipRuntime(): ScipRuntime;
+export interface ScipIndexResult {
+    readonly path: string;
+    readonly digest: string;
+    readonly mode: 'full' | 'package';
+    readonly version: string;
+    /** Exact document paths observed in the normalized index, including zero-occurrence documents. */
+    readonly indexedPaths?: readonly string[];
+}
+export {};

package/dist/extraction/scip-runtime.js

@@ -0,0 +1,8 @@
+// Modified for standalone extraction; see docs/extraction-manifest.json.
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+export function loadScipRuntime() {
+    const require = createRequire(import.meta.url);
+    const main = require.resolve('@sourcegraph/scip-typescript');
+    return require(join(dirname(main), 'scip.js'));
+}

package/dist/extraction/scip-symbols.d.ts

@@ -0,0 +1,21 @@
+import { type ExtractionContext, type FactExtractor, type GraphFact } from '@weftlet/core';
+import type { GitRepository } from '../repository/git.js';
+import type { ScipIndexResult } from './scip-runtime.js';
+export declare const scipSymbolExtractorIdentity: {
+    readonly id: "scip-symbol-extractor";
+    readonly version: "2.1.0";
+};
+export declare class ScipSymbolExtractor implements FactExtractor {
+    private readonly repository;
+    private readonly index;
+    readonly identity: {
+        readonly id: "scip-symbol-extractor";
+        readonly version: "2.1.0";
+    };
+    constructor(repository: GitRepository, index: ScipIndexResult);
+    extract(context: ExtractionContext): Promise<readonly GraphFact[]>;
+    extractWithDiagnostics(context: ExtractionContext): Promise<{
+        facts: GraphFact[];
+        diagnostics: import("@weftlet/core").GraphDiagnostic[];
+    }>;
+}

package/dist/extraction/scip-symbols.js

@@ -0,0 +1,91 @@
+// Modified for standalone extraction; see docs/extraction-manifest.json.
+import { readFile } from 'node:fs/promises';
+import { repositoryFileNode } from '@weftlet/core';
+import { loadScipRuntime } from './scip-runtime.js';
+import { extractCodeOccurrences } from './scip-occurrences.js';
+import { extractStaticCalls } from './static-calls.js';
+import { sha256, stableJson } from '../infrastructure/util.js';
+export const scipSymbolExtractorIdentity = { id: 'scip-symbol-extractor', version: '2.1.0' };
+export class ScipSymbolExtractor {
+    repository;
+    index;
+    identity = scipSymbolExtractorIdentity;
+    constructor(repository, index) {
+        this.repository = repository;
+        this.index = index;
+    }
+    async extract(context) {
+        return (await this.extractWithDiagnostics(context)).facts;
+    }
+    async extractWithDiagnostics(context) {
+        const parsed = loadScipRuntime().scip.Index.deserializeBinary(await readFile(this.index.path));
+        const symbols = new Map();
+        const sources = new Map();
+        for (const document of parsed.documents) {
+            const path = document.relative_path.replace(/\\/g, '/');
+            const content = await this.repository.readFileAt(context.commitSha, path);
+            sources.set(path, content);
+            const digest = sha256(content);
+            const component = repositoryFileNode(path);
+            for (const occurrence of document.occurrences) {
+                if (!occurrence.symbol || occurrence.symbol.startsWith('local '))
+                    continue;
+                const definition = (occurrence.symbol_roles & 1) === 1;
+                const sites = symbols.get(occurrence.symbol) ?? {
+                    definitions: new Map(),
+                    references: new Map(),
+                };
+                symbols.set(occurrence.symbol, sites);
+                const target = definition ? sites.definitions : sites.references;
+                if (target.has(path))
+                    continue;
+                target.set(path, {
+                    path,
+                    line: (occurrence.range[0] ?? 0) + 1,
+                    digest,
+                    component,
+                });
+            }
+        }
+        const facts = [];
+        for (const [symbolText, sites] of [...symbols.entries()].sort(([left], [right]) => left.localeCompare(right))) {
+            const definitionPaths = new Set(sites.definitions.keys());
+            const downstream = [...sites.references.values()].filter((site) => !definitionPaths.has(site.path));
+            if (sites.definitions.size === 0 || downstream.length === 0)
+                continue;
+            const symbol = {
+                id: `symbol:scip:${sha256(symbolText)}`,
+                kind: 'Contract',
+                label: symbolText,
+                attributes: { scipIndexDigest: this.index.digest },
+            };
+            const relationships = [
+                ...[...sites.definitions.values()].map((site) => ({ site, definition: true })),
+                ...downstream.map((site) => ({ site, definition: false })),
+            ];
+            for (const { site, definition } of relationships) {
+                const relation = definition ? 'definition' : 'reference';
+                const provenance = {
+                    path: site.path,
+                    startLine: site.line,
+                    endLine: site.line,
+                    digest: site.digest,
+                    commitSha: context.commitSha,
+                };
+                facts.push({
+                    id: sha256(stableJson({ relation, path: site.path, symbol: symbolText, provenance })),
+                    subject: site.component,
+                    predicate: definition ? 'contains' : 'consumes',
+                    object: symbol,
+                    provenance,
+                    extractor: this.identity,
+                    confidence: 1,
+                    snapshotId: context.snapshotId,
+                });
+            }
+        }
+        const occurrences = extractCodeOccurrences(parsed, sources, context, this.index.digest, this.identity);
+        const calls = extractStaticCalls(sources, occurrences, context);
+        return { facts: [...facts, ...occurrences, ...calls.facts], diagnostics: calls.diagnostics };
+    }
+}

package/dist/extraction/semantic.d.ts

@@ -14,7 +14,7 @@ export interface ExtractedAssertion {
         readonly kind: GraphNodeKind;
         readonly label: string;
     };
-    readonly predicate: GraphPredicate;
+    readonly predicate: Exclude<GraphPredicate, 'calls'>;
     readonly object: {
         readonly id: string;
         readonly kind: GraphNodeKind;

package/dist/extraction/semantic.js

@@ -7,6 +7,9 @@ export { semanticCommandEnvironment } from './codex-auth.js';
 import { resolveCodexInvocation } from './codex-command.js';
 import { runSemanticProcess, SemanticProviderError } from "./semantic-process.js";
 export { SemanticProviderError } from "./semantic-process.js";
+import { graphPredicates } from "@weftlet/core";
+// Calls require indexed syntax/proofs. Keep the prose schema and its cache identity unchanged.
+const predicates = graphPredicates.filter(predicate => predicate !== 'calls');
 import { sha256, stableJson } from "../infrastructure/util.js";
 import { canonicalizeRepositoryDocumentNode } from './repository-nodes.js';
 import { semanticArtifactKey, semanticArtifactOutputDigest, semanticProviderIdentity } from './semantic-identity.js';
@@ -79,6 +82,8 @@ function renderOml(key, assertions) {
     const instances = [...nodes.entries()]
         .sort(([left], [right]) => left.localeCompare(right))
         .map(([id, node]) => {
+        if (node.kind === 'CodeSymbol')
+            throw new Error('Code symbols require deterministic code extraction');
         const local = localNames.get(id);
         const properties = [
             `    cg:hasIdentifier "${omlEscape(node.id)}"`,
@@ -119,23 +124,6 @@ const kinds = [
     'PersistenceModel',
     'Scope',
 ];
-const predicates = [
-    'realizes',
-    'implementedBy',
-    'consumes',
-    'emits',
-    'persistsTo',
-    'governedBy',
-    'definedBy',
-    'verifiedBy',
-    'operationallyOwnedBy',
-    'decisionAuthority',
-    'routesThrough',
-    'authorizedBy',
-    'sourcedFrom',
-    'references',
-    'contains',
-];
 export function semanticOutputSchema(lineCount) {
     const node = {
         type: 'object',

package/dist/extraction/static-calls.d.ts

@@ -0,0 +1,10 @@
+import { type ExtractionContext, type GraphDiagnostic, type GraphFact } from '@weftlet/core';
+export declare const staticCallIdentity: {
+    readonly id: "typescript-call-extractor";
+    readonly version: "1.0.0";
+};
+/** Parse only the exact committed documents already indexed by SCIP. No second resolver or name guessing. */
+export declare function extractStaticCalls(sources: ReadonlyMap<string, string>, codeFacts: readonly GraphFact[], context: ExtractionContext): {
+    facts: GraphFact[];
+    diagnostics: GraphDiagnostic[];
+};