homegraph 1.1.3 → 1.4.1

package/dist/resolution/name-matcher.js

@@ -12,12 +12,41 @@ exports.crossesKnownFamily = crossesKnownFamily;
 exports.matchFunctionRef = matchFunctionRef;
 exports.matchByExactName = matchByExactName;
 exports.matchByQualifiedName = matchByQualifiedName;
+exports.preferCallSiteFile = preferCallSiteFile;
+exports.resolveMethodOnType = resolveMethodOnType;
 exports.matchCppCallChain = matchCppCallChain;
 exports.matchScopedCallChain = matchScopedCallChain;
 exports.matchDottedCallChain = matchDottedCallChain;
 exports.matchMethodCall = matchMethodCall;
 exports.matchFuzzy = matchFuzzy;
 exports.matchReference = matchReference;
+/**
+ * Ceiling on how many same-named definitions a FUZZY name-match strategy will
+ * score. A name defined more times than this is "ubiquitous" — a method/symbol
+ * re-declared across a vendored theme or SDK (e.g. `init`/`update`/`render` on
+ * every widget of a committed Metronic theme — #999). No directory-proximity or
+ * receiver-word-overlap score can reliably pick THE one true target among
+ * thousands, so the fuzzy strategies (matchByExactName's findBestMatch, and
+ * matchMethodCall Strategy 3) decline above the ceiling instead of emitting a
+ * low-confidence, almost-certainly-wrong edge. This also caps their per-ref cost
+ * at O(ceiling): without it, K same-named refs each scored K candidates — the
+ * O(K²) blow-up that pinned a core for 15-28 min at "Resolving refs … 94%" on a
+ * repo vendoring a large JS/TS theme (#999). The PRECISE strategies are
+ * unaffected: qualified-name, import-based, and class-name (Strategy 1/2)
+ * resolution all still run and resolve a ubiquitous name when the context names
+ * its exact target. Real repos top out near ~40 same-named methods, so a normal
+ * codebase never reaches this; only bulk-vendored code does. Tune via
+ * `CODEGRAPH_AMBIGUOUS_NAME_CEILING`.
+ */
+const DEFAULT_AMBIGUOUS_NAME_CEILING = 500;
+function resolveAmbiguousNameCeiling() {
+    const raw = process.env.CODEGRAPH_AMBIGUOUS_NAME_CEILING;
+    if (!raw)
+        return DEFAULT_AMBIGUOUS_NAME_CEILING;
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_AMBIGUOUS_NAME_CEILING;
+}
+const AMBIGUOUS_NAME_CEILING = resolveAmbiguousNameCeiling();
 /**
  * Try to resolve a path-like reference (e.g., "snippets/drawer-menu.liquid")
  * by matching the filename against file nodes.
@@ -111,7 +140,9 @@ function pickClosestFileNode(candidates, ref) {
 const LANGUAGE_FAMILY = {
     java: 'jvm', kotlin: 'jvm', scala: 'jvm',
     swift: 'apple', objc: 'apple',
-    typescript: 'web', tsx: 'web', javascript: 'web', jsx: 'web',
+    // ArkTS is a TS superset — every HarmonyOS project mixes `.ets` UI with
+    // `.ts` logic modules, so refs must cross freely between them.
+    typescript: 'web', tsx: 'web', javascript: 'web', jsx: 'web', arkts: 'web',
     c: 'c', cpp: 'c',
     // Razor/Blazor markup names C# types — same family so `@model Foo` /
     // `<MyComponent/>` resolve to their `.cs` class through the cross-family gate.
@@ -193,6 +224,7 @@ function matchFunctionRef(ref, context) {
     // implicit-self, Java/Kotlin method references.
     const bareFnOnly = ref.language === 'typescript' || ref.language === 'tsx' ||
         ref.language === 'javascript' || ref.language === 'jsx' ||
+        ref.language === 'arkts' ||
         ref.language === 'cpp' || ref.language === 'python' ||
         ref.language === 'php';
     // Qualified member-pointer (`&Widget::on_click` → "Widget::on_click"):
@@ -324,6 +356,14 @@ function matchByExactName(ref, context) {
             resolvedBy: 'exact-match',
         };
     }
+    // Ubiquitous-name ceiling (#999): above it, picking one target among K
+    // same-named defs by directory proximity is unreliable AND O(K) per ref — the
+    // quadratic behind the "Resolving refs" wedge on theme/SDK-vendoring repos.
+    // Decline; the precise strategies (qualified-name, import, class-name) already
+    // ran. Falls through to fuzzy, which itself only resolves a UNIQUE candidate.
+    if (candidates.length > AMBIGUOUS_NAME_CEILING) {
+        return null;
+    }
     // Multiple matches - try to narrow down
     const bestMatch = findBestMatch(ref, candidates, context);
     if (bestMatch) {
@@ -347,7 +387,17 @@ function matchByQualifiedName(ref, context) {
     if (!ref.referenceName.includes('::') && !ref.referenceName.includes('.')) {
         return null;
     }
-    const candidates = context.getNodesByQualifiedName(ref.referenceName);
+    // A method call `receiver.method()` can share an exact qualified name with a
+    // config-file key: `service.process()` (a `calls` ref named `service.process`)
+    // vs the yaml key `service.process`. Config keys are bound to their code refs
+    // upstream by the framework resolvers (`@Value` → `references`); a `calls` ref
+    // must never resolve to a yaml/properties config node — that's a wrong edge
+    // AND it hides the real callee. Drop those from both the exact and the partial
+    // candidate sets so resolution falls through to method resolution below (#1180).
+    const keepForRef = (nodes) => ref.referenceKind === 'calls'
+        ? nodes.filter((n) => !(n.kind === 'constant' && (n.language === 'yaml' || n.language === 'properties')))
+        : nodes;
+    const candidates = keepForRef(context.getNodesByQualifiedName(ref.referenceName));
     if (candidates.length === 1) {
         return {
             original: ref,
@@ -356,24 +406,63 @@ function matchByQualifiedName(ref, context) {
             resolvedBy: 'qualified-name',
         };
     }
-    // Try partial qualified name match
+    // Several symbols share this exact qualified name (e.g. `Logger::log` declared
+    // in two files — an ODR clash or separate translation units): prefer the one
+    // in the call site's own file before the partial-match fallback below, else
+    // the first-indexed def wins and a call in `b/svc` targets `a/svc` (#1079).
+    if (candidates.length > 1) {
+        const ordered = preferCallSiteFile(candidates, ref.filePath);
+        if (ordered[0].filePath === ref.filePath) {
+            return {
+                original: ref,
+                targetNodeId: ordered[0].id,
+                confidence: 0.95,
+                resolvedBy: 'qualified-name',
+            };
+        }
+    }
+    // Try partial qualified name match — again preferring the call site's own
+    // file when more than one symbol's qualifiedName ends with the reference.
     const parts = ref.referenceName.split(/[:.]/);
     const lastName = parts[parts.length - 1];
     if (lastName) {
-        const partialCandidates = context.getNodesByName(lastName);
-        for (const candidate of partialCandidates) {
-            if (candidate.qualifiedName.endsWith(ref.referenceName)) {
-                return {
-                    original: ref,
-                    targetNodeId: candidate.id,
-                    confidence: 0.85,
-                    resolvedBy: 'qualified-name',
-                };
-            }
+        const partialCandidates = keepForRef(context.getNodesByName(lastName))
+            .filter((candidate) => candidate.qualifiedName.endsWith(ref.referenceName));
+        const chosen = preferCallSiteFile(partialCandidates, ref.filePath)[0];
+        if (chosen) {
+            return {
+                original: ref,
+                targetNodeId: chosen.id,
+                confidence: 0.85,
+                resolvedBy: 'qualified-name',
+            };
         }
     }
     return null;
 }
+/**
+ * When a symbol name is ambiguous across files, prefer the candidate(s) declared
+ * in the call site's own file, keeping the rest in their original order (#1079).
+ * A same-file definition is the strongest language-agnostic signal for which of
+ * several same-named symbols a call means; without it, resolution collapses onto
+ * whichever was indexed first, so a call in `b/svc` wrongly targets `a/svc`.
+ * No-op when there are <2 candidates or none share the call site's file.
+ */
+function preferCallSiteFile(nodes, callSiteFile) {
+    if (nodes.length < 2)
+        return nodes;
+    const same = [];
+    const other = [];
+    for (const n of nodes) {
+        if (n.filePath === callSiteFile)
+            same.push(n);
+        else
+            other.push(n);
+    }
+    return same.length ? [...same, ...other] : nodes;
+}
+// Exported for the precedence unit tests (#1079): they assert the
+// preferredFqn → same-file → matches[0] ordering directly.
 function resolveMethodOnType(typeName, methodName, ref, context, confidence, resolvedBy, 
 /**
  * Optional FQN that identifies WHICH class declaration `typeName`
@@ -391,17 +480,28 @@ depth = 0) {
     // in-class (`class Foo { int bar() { ... } }`) or out-of-line in a separate
     // file (`int Foo::bar() { ... }` in foo.cpp while class Foo is in foo.hpp).
     // The previous same-file approach missed the latter — the typical C++ layout.
-    const methodCandidates = context.getNodesByName(methodName);
-    const want = `${typeName}::${methodName}`;
-    const matches = [];
-    for (const m of methodCandidates) {
-        if (m.kind !== 'method')
-            continue;
-        if (m.language !== ref.language)
-            continue;
-        const qn = m.qualifiedName;
-        if (qn === want || qn.endsWith(`::${want}`)) {
-            matches.push(m);
+    // Prefer the context's per-(type, method) memo: the raw name lookup fetches
+    // EVERY node sharing the method name — tens of thousands of rows for a
+    // collision-heavy Java name like `execute` — and re-filtering that per ref
+    // was a dominant term in the #1122 watchdog kill on large repos. Only the
+    // ref-independent filter is memoized; per-ref disambiguation stays below.
+    let matches;
+    if (context.getMethodMatches) {
+        matches = context.getMethodMatches(typeName, methodName, ref.language);
+    }
+    else {
+        const methodCandidates = context.getNodesByName(methodName);
+        const want = `${typeName}::${methodName}`;
+        matches = [];
+        for (const m of methodCandidates) {
+            if (m.kind !== 'method')
+                continue;
+            if (m.language !== ref.language)
+                continue;
+            const qn = m.qualifiedName;
+            if (qn === want || qn.endsWith(`::${want}`)) {
+                matches.push(m);
+            }
         }
     }
     if (matches.length === 0) {
@@ -437,9 +537,19 @@ depth = 0) {
             };
         }
     }
+    // Language-agnostic disambiguation: when several same-named methods survive
+    // (e.g. two files each declaring `class Logger { void log(); }` — an ODR
+    // clash, an anonymous-namespace type, or separate translation units), prefer
+    // the definition in the CALL SITE's own file. Without this, every ambiguous
+    // call collapses onto the first-indexed definition, so a call in `b/svc.cpp`
+    // wrongly points at `a/svc.cpp` (#1079). This runs AFTER the `preferredFqn`
+    // block, so Java/Kotlin import disambiguation — whose target is intentionally
+    // in ANOTHER file (#314) — is unaffected: that block returns early whenever
+    // an import FQN pins the class.
+    const ordered = preferCallSiteFile(matches, ref.filePath);
     return {
         original: ref,
-        targetNodeId: matches[0].id,
+        targetNodeId: ordered[0].id,
         confidence,
         resolvedBy,
     };
@@ -478,10 +588,14 @@ function buildDeclaratorRegex(escapedReceiver) {
     return new RegExp(`([A-Za-z_][\\w:]*(?:\\s*<[^;=(){}]+>)?(?:\\s*[*&]+)?)\\s*\\b${escapedReceiver}\\b\\s*(?=[;=,)\\[{(]|$)`);
 }
 function inferCppReceiverType(receiverName, ref, context, depth = 0) {
-    const source = context.readFile(ref.filePath);
-    if (!source)
+    // Per-file lines cache when available — this runs per `receiver->method()`
+    // ref and re-splitting the file each time is the same quadratic as the
+    // shared inferrer's (#1122).
+    const lines = context.getFileLines
+        ? context.getFileLines(ref.filePath)
+        : (context.readFile(ref.filePath)?.split(/\r?\n/) ?? null);
+    if (!lines || lines.length === 0)
         return null;
-    const lines = source.split(/\r?\n/);
     const callLineIndex = Math.max(0, Math.min(lines.length - 1, ref.line - 1));
     const escapedReceiver = receiverName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     const receiverPattern = new RegExp(`\\b${escapedReceiver}\\b`);
@@ -514,10 +628,12 @@ function inferCppReceiverType(receiverName, ref, context, depth = 0) {
     for (const headerPath of headerCandidates) {
         if (!context.fileExists(headerPath))
             continue;
-        const headerSource = context.readFile(headerPath);
-        if (!headerSource)
+        const headerLines = context.getFileLines
+            ? context.getFileLines(headerPath)
+            : (context.readFile(headerPath)?.split(/\r?\n/) ?? null);
+        if (!headerLines)
             continue;
-        for (const line of headerSource.split(/\r?\n/)) {
+        for (const line of headerLines) {
             if (!receiverPattern.test(line))
                 continue;
             const declaratorMatch = line.match(declaratorRegex);
@@ -845,6 +961,394 @@ function inferJavaFieldReceiverType(receiverName, ref, context) {
         return null; // primitives / lowercase → skip
     return lastPart;
 }
+// ── Local-variable receiver-type inference (#1108) ──────────────────────────
+//
+// Instance calls through a local variable (`const lg = new Logger(); lg.log()`)
+// only resolved in C++ before this — no other language could learn the
+// receiver's type. Local variables are not indexed as nodes (node-explosion),
+// so, like the C++ inferrer above, we read the enclosing function's source and
+// match the receiver's declaration/initializer to recover its type. The type is
+// then handed to resolveMethodOnType, which VALIDATES that the type actually
+// declares the method, so a mis-inference produces NO edge — the safety net
+// that lets the patterns below stay simple. C++ keeps its dedicated inferrer
+// (header scan + `auto`); this covers every other language.
+// Tokens a loose pattern might capture that are never a user-defined type.
+const NON_TYPE_RECEIVER_TOKENS = new Set([
+    'this', 'self', 'super', 'new', 'return', 'await', 'yield', 'typeof',
+    'null', 'nil', 'None', 'true', 'false', 'True', 'False', 'undefined',
+]);
+/**
+ * Normalize a captured type expression to a simple type name: drop generic
+ * args and pointer/ref markers, take the last `.`/`::`-qualified segment, and
+ * reject obvious non-types.
+ */
+function normalizeInferredTypeName(raw) {
+    const cleaned = raw.replace(/<[^>]*>/g, '').replace(/[&*]/g, '').trim();
+    const seg = cleaned.split(/[.:]+/).filter(Boolean).pop();
+    if (!seg)
+        return null;
+    if (NON_TYPE_RECEIVER_TOKENS.has(seg))
+        return null;
+    return seg;
+}
+/**
+ * Per-language patterns that recover a local variable's (or typed parameter's)
+ * type from its declaration/initializer. Each regex captures the type in group
+ * 1; `r` is the already-escaped receiver name. Ordered most-specific first.
+ * PascalCase is required in the capture where the language convention allows,
+ * as a cheap false-positive guard on top of resolveMethodOnType's validation.
+ */
+function localReceiverTypePatterns(language, r) {
+    switch (language) {
+        case 'typescript':
+        case 'javascript':
+        case 'tsx':
+        case 'jsx':
+        case 'arkts':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*new\\s+([A-Za-z_$][\\w.$]*)`), // = new Logger()
+                // No keyword requirement, so this matches BOTH a local annotation
+                // (`const lg: Logger`) and a typed parameter (`function use(lg: Logger)`
+                // / `(lg: Logger) =>`) — the parameter case the old `const|let|var`
+                // prefix excluded (#1125). Mirrors Kotlin/Swift/Scala; the capture stops
+                // at `<` so a generic-typed param (`repo: Repository<User>`) still yields
+                // `Repository`. resolveMethodOnType validates the type actually declares
+                // the method, so the looser match produces no edge on a mis-inference.
+                new RegExp(`\\b${r}\\b\\s*:\\s*([A-Z][\\w.$]*)`), // lg: Logger  (annotation or typed param)
+            ];
+        case 'python':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*([A-Z][\\w.]*)\\s*\\(`), // lg = Logger(...)
+                new RegExp(`\\b${r}\\b\\s*:\\s*([A-Z][\\w.]*)`), // lg: Logger  (PEP 526)
+            ];
+        case 'java':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*new\\s+([A-Za-z_][\\w.]*)`), // = new Logger()
+                new RegExp(`\\b([A-Z][\\w.]*)\\s+${r}\\b\\s*[=;,)]`), // Logger lg;  / param
+            ];
+        case 'kotlin':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*([A-Z][\\w.]*)\\s*\\(`), // val lg = Logger(...)
+                new RegExp(`\\b${r}\\b\\s*:\\s*([A-Z][\\w.]*)`), // val lg: Logger  / param
+            ];
+        case 'csharp':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*new\\s+([A-Za-z_][\\w.]*)`), // = new Logger()
+                new RegExp(`\\b([A-Z][\\w.]*)\\s+${r}\\b\\s*[=;,)]`), // Logger lg;  / param
+            ];
+        case 'swift':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*([A-Z][\\w.]*)\\s*\\(`), // let lg = Logger(...)
+                new RegExp(`\\b${r}\\b\\s*:\\s*([A-Z][\\w.]*)`), // let lg: Logger  / param
+            ];
+        case 'rust':
+            return [
+                new RegExp(`\\blet\\s+(?:mut\\s+)?${r}\\b(?:\\s*:[^=]+)?=\\s*&?(?:mut\\s+)?([A-Z][\\w]*)`), // let lg = Logger::new()/Logger{}/Logger
+                // No `let`, so this covers a `let lg: Logger` binding AND a typed
+                // parameter (`fn use(lg: &Logger)`, a closure `|lg: Logger|`) — the
+                // parameter case the old `let`-anchored pattern excluded (#1125).
+                new RegExp(`\\b${r}\\s*:\\s*&?(?:mut\\s+)?([A-Z][\\w]*)`), // lg: Logger  (binding or typed param)
+            ];
+        case 'go':
+            return [
+                new RegExp(`\\b${r}\\b\\s*:=\\s*&?([A-Za-z_][\\w.]*)\\s*{`), // lg := Logger{} / &Logger{}
+                new RegExp(`\\bvar\\s+${r}\\s+\\*?([A-Za-z_][\\w.]*)`), // var lg Logger / *Logger
+                // A typed parameter / method receiver (`func use(lg Logger)`,
+                // `func (l Logger) M()`) — name-before-type with no `var`/`:=` (#1125).
+                // PascalCase-guarded (unlike the anchored patterns above) to keep the
+                // keyword-free `ident Type` shape from matching unrelated pairs; the
+                // enclosing-scope bound already excludes package-level struct fields.
+                new RegExp(`\\b${r}\\s+\\*?([A-Z][\\w.]*)`), // func use(lg Logger) / (l Logger)
+            ];
+        case 'ruby':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*([A-Z][\\w:]*)\\.new\\b`), // lg = Logger.new
+            ];
+        case 'scala':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*(?:new\\s+)?([A-Z][\\w.]*)`), // val lg = new Logger / Logger(...)
+                new RegExp(`\\b${r}\\b\\s*:\\s*([A-Z][\\w.]*)`), // val lg: Logger  / param
+            ];
+        case 'dart':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*([A-Z][\\w.]*)\\s*\\(`), // var lg = Logger(...)
+                // Trailing `[=;,)]` (not just `[=;]`) so a typed parameter — `Logger lg)`
+                // / `Logger lg,` — matches too, not only `Logger lg = ...` / `Logger lg;`
+                // (#1125). Mirrors Java/C#.
+                new RegExp(`\\b([A-Z][\\w.]*)\\s+${r}\\b\\s*[=;,)]`), // Logger lg = ...  / param
+            ];
+        case 'php':
+            return [
+                new RegExp(`\\$?${r}\\b\\s*=\\s*new\\s+([A-Za-z_\\\\][\\w\\\\]*)`), // $lg = new Logger()
+                // A typed parameter (`function use(Logger $lg)`, `?Logger $lg`,
+                // `\\App\\Logger $lg`, `&$lg` by-ref) and a typed `catch (E $e)` — the
+                // type sits before the `$`-variable (#1125). Namespace `\\` allowed.
+                new RegExp(`\\b([A-Za-z_\\\\][\\w\\\\]*)\\s+&?\\$${r}\\b`), // Logger $lg  (typed param)
+            ];
+        case 'lua':
+        case 'luau':
+            return [
+                new RegExp(`\\b${r}\\b\\s*=\\s*([A-Z][\\w]*)\\.new\\b`), // local lg = Logger.new()
+                new RegExp(`\\b${r}\\b\\s*=\\s*([A-Z][\\w]*)\\s*\\(`), // local lg = Logger(...)  (callable table)
+                // Luau annotation (`local lg: Logger`) / typed param — but Lua's
+                // method-call syntax is the IDENTICAL `receiver:Name` shape, and the
+                // backward scan starts on the call's own line, so without a gate any
+                // PascalCase method call (`lg:Log()`, the Roblox convention)
+                // self-matches as "type = Log" before the scan reaches the real
+                // declaration (#1124). The lookahead rejects a capture followed by
+                // any of Lua's three call forms — `(args)`, `"s"`/`'s'`/`[[s]]`,
+                // `{t}` — and its leading `[\w.]` alternative stops backtracking from
+                // shrinking the capture to dodge the gate (`lg:Log()` would otherwise
+                // still match, as `Lo`).
+                new RegExp(`\\b${r}\\b\\s*:\\s*([A-Z][\\w.]*)(?![\\w.]|\\s*[({"'\\[])`), // local lg: Logger  / typed param
+            ];
+        case 'r':
+            return [
+                new RegExp(`\\b${r}\\b\\s*(?:<-|<<-|=)\\s*([A-Z][\\w.]*)\\$new\\b`), // lg <- Logger$new()  (R6)
+            ];
+        case 'pascal':
+            return [
+                new RegExp(`\\b${r}\\b\\s*:\\s*([A-Z][\\w]*)`), // var lg: TLogger  / param lg: TLogger
+                new RegExp(`\\b${r}\\b\\s*:=\\s*([A-Z][\\w.]*)\\.Create\\b`), // lg := TLogger.Create
+            ];
+        case 'cfml':
+        case 'cfscript':
+            return [
+                // svc = new UserService() / new path.to.UserService() — dotted component
+                // paths reduce to their final segment via normalizeInferredTypeName.
+                // Also matches inside tag markup (`<cfset svc = new UserService()>`)
+                // since the scan reads raw source lines.
+                new RegExp(`\\b${r}\\b\\s*=\\s*new\\s+([A-Za-z_][\\w.]*)`),
+                // The classic form: svc = createObject("component", "path.to.UserService")
+                // (casing of createObject varies in the wild), plus the modern
+                // single-argument form createObject("path.to.UserService").
+                new RegExp(`\\b${r}\\b\\s*=\\s*[Cc]reate[Oo]bject\\s*\\(\\s*["']component["']\\s*,\\s*["']([\\w.]+)["']`),
+                new RegExp(`\\b${r}\\b\\s*=\\s*[Cc]reate[Oo]bject\\s*\\(\\s*["']([\\w.]+)["']\\s*\\)`),
+                // Typed cfscript parameter: `function save(UserService svc)` /
+                // `required UserService svc` — CFML's built-in types (string, numeric,
+                // any, struct…) are lowercase by convention, so the PascalCase guard
+                // excludes them.
+                new RegExp(`\\b([A-Z][\\w.]*)\\s+${r}\\b\\s*[=;,)]`),
+                // Tag-form typed argument, either attribute order:
+                // <cfargument name="svc" type="path.to.UserService">
+                new RegExp(`\\bcfargument[^>\\n]*\\bname\\s*=\\s*["']${r}["'][^>\\n]*\\btype\\s*=\\s*["']([\\w.]+)["']`, 'i'),
+                new RegExp(`\\bcfargument[^>\\n]*\\btype\\s*=\\s*["']([\\w.]+)["'][^>\\n]*\\bname\\s*=\\s*["']${r}["']`, 'i'),
+                // Component property (incl. WireBox DI): `property name="svc"
+                // inject="UserService";` / `<cfproperty name="svc" type="UserService">`,
+                // either attribute order. An inject DSL value with a namespace
+                // (`inject="svc@core"`) captures only the leading name and simply
+                // fails type-validation — no edge, never a wrong one.
+                new RegExp(`\\b(?:cf)?property\\b[^;\\n]*\\bname\\s*=\\s*["']${r}["'][^;\\n]*\\b(?:type|inject)\\s*=\\s*["']([\\w.]+)["']`, 'i'),
+                new RegExp(`\\b(?:cf)?property\\b[^;\\n]*\\b(?:type|inject)\\s*=\\s*["']([\\w.]+)["'][^;\\n]*\\bname\\s*=\\s*["']${r}["']`, 'i'),
+            ];
+        default:
+            return [];
+    }
+}
+/** 1-based start line of the tightest function/method enclosing the call. */
+function enclosingScopeStartLine(ref, context) {
+    let start = 1;
+    for (const n of context.getNodesInFile(ref.filePath)) {
+        if (n.kind !== 'function' && n.kind !== 'method')
+            continue;
+        if (n.language !== ref.language)
+            continue;
+        const end = n.endLine ?? n.startLine;
+        if (n.startLine <= ref.line && end >= ref.line && n.startLine >= start) {
+            start = n.startLine;
+        }
+    }
+    return start;
+}
+/**
+ * Infer a receiver's type from its local declaration/initializer in the
+ * enclosing function body. Language-dispatched; returns null for languages
+ * without patterns or when no declaration is found. Bounded to the enclosing
+ * scope so a same-named variable in another function can't leak in.
+ */
+function inferLocalReceiverType(receiverName, ref, context) {
+    // CFML scope prefixes: `variables.svc` / `this.svc` name a COMPONENT-scoped
+    // field whose assignment or `property` declaration usually lives outside the
+    // calling function (the init-pseudoconstructor / WireBox-injection pattern),
+    // and `local.svc` is an explicit function-local. Strip the prefix so the
+    // declaration patterns match (`variables.svc = new X()`, `property
+    // name="svc" …`, `var svc = …` all bind the bare name), and widen the scan
+    // to the whole file for the component-scoped forms — nearest-declaration-
+    // backward still wins, so a function-local shadowing the field is preferred.
+    let scanReceiver = receiverName;
+    let componentScoped = false;
+    if (ref.language === 'cfml' || ref.language === 'cfscript') {
+        const scoped = receiverName.match(/^(variables|this|local|arguments)\.(.+)$/i);
+        if (scoped) {
+            scanReceiver = scoped[2];
+            const scope = scoped[1].toLowerCase();
+            componentScoped = scope === 'variables' || scope === 'this';
+        }
+    }
+    // PHP `$this->prop` receiver — the property's declaration lives outside the
+    // calling method (a promoted constructor parameter `private readonly Foo $prop`,
+    // a typed property `private Foo $prop;`, or a classic constructor parameter
+    // `Foo $prop` assigned in __construct). Strip the prefix and widen the scan to
+    // the whole file (the constructor may sit below the calling method), but —
+    // unlike CFML's scopes above — switch to PROPERTY-shaped patterns: a plain
+    // `$prop` local or parameter lives in a different namespace than `$this->prop`
+    // and can never shadow it, so the generic local patterns would type the
+    // property from unrelated same-named variables in other methods (a wrong
+    // 0.9-confidence edge, not a missing one).
+    let phpProperty = false;
+    if (ref.language === 'php') {
+        const scoped = receiverName.match(/^this->(.+)$/);
+        if (scoped) {
+            scanReceiver = scoped[1];
+            componentScoped = true;
+            phpProperty = true;
+        }
+    }
+    const escapedReceiver = scanReceiver.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const patterns = phpProperty
+        ? phpPropertyTypePatterns(escapedReceiver)
+        : localReceiverTypePatterns(ref.language, escapedReceiver);
+    if (patterns.length === 0)
+        return null;
+    // Split through the context's per-file lines cache when available: this runs
+    // for EVERY `receiver.method()` ref, and re-splitting the whole file per ref
+    // was ~20% of total index CPU on Java-heavy repos (#1122).
+    const lines = context.getFileLines
+        ? context.getFileLines(ref.filePath)
+        : (context.readFile(ref.filePath)?.split(/\r?\n/) ?? null);
+    if (!lines || lines.length === 0)
+        return null;
+    const callIdx = Math.max(0, Math.min(lines.length - 1, ref.line - 1));
+    const startIdx = componentScoped
+        ? 0
+        : Math.max(0, enclosingScopeStartLine(ref, context) - 1);
+    const matchLine = (i) => {
+        const line = lines[i];
+        if (!line)
+            return null;
+        // A generated/minified line (one multi-KB statement) is not something a
+        // human-written local declaration lives on, and regexing it per ref is
+        // pure waste — skip it rather than scan it.
+        if (line.length > 10_000)
+            return null;
+        for (const re of patterns) {
+            const m = line.match(re);
+            if (m && m[1]) {
+                const type = normalizeInferredTypeName(m[1]);
+                if (type)
+                    return type;
+            }
+        }
+        return null;
+    };
+    // Nearest declaration wins: scan backward from the call to the scope start.
+    for (let i = callIdx; i >= startIdx; i--) {
+        const type = matchLine(i);
+        if (type)
+            return type;
+    }
+    // A component-scoped field's declaration is position-independent — the
+    // `variables.svc = new X()` pseudoconstructor assignment or `property`
+    // declaration may sit BELOW the calling function in the file — so when the
+    // backward pass finds nothing, sweep the remainder of the file too.
+    if (componentScoped) {
+        for (let i = callIdx + 1; i < lines.length; i++) {
+            const type = matchLine(i);
+            if (type)
+                return type;
+        }
+    }
+    // A PHP property with no statically-typed declaration (classic pre-7.4
+    // style) may still be typed by what gets ASSIGNED to it — follow the
+    // `$this->prop = $var` assignment to the assigned variable's own typed
+    // declaration (a classic or multi-line constructor parameter, or a typed
+    // setter's parameter).
+    if (phpProperty) {
+        return inferPhpAssignedPropertyType(escapedReceiver, lines, callIdx);
+    }
+    return null;
+}
+/**
+ * Patterns that recover a PHP class property's declared type for a
+ * `$this->prop` receiver. Deliberately NOT localReceiverTypePatterns: only
+ * property-shaped declarations qualify —
+ *   1. a modifier-prefixed typed declaration, which covers both a typed
+ *      property (`private ?Foo $prop;`) and a promoted constructor parameter
+ *      (`private readonly Foo $prop`), and
+ *   2. the pseudoconstructor assignment (`$this->prop = new Foo(...)`).
+ * A bare `X $prop` parameter or `$prop = new X()` local elsewhere in the
+ * file must NOT match: those variables can never alias `$this->prop`.
+ * Union-typed properties (`Foo|Bar $prop`) yield no match and thus no edge —
+ * silent beats wrong. The classic untyped-property-assigned-in-constructor
+ * shape is handled by inferPhpAssignedPropertyType instead.
+ */
+function phpPropertyTypePatterns(r) {
+    return [
+        new RegExp(`\\b(?:(?:private|protected|public|readonly|static|final)(?:\\(set\\))?\\s+)+\\??([A-Za-z_\\\\][\\w\\\\]*)\\s+&?\\$${r}\\b`), // private readonly ?Foo $prop  (typed property / promoted param)
+        new RegExp(`\\$this->${r}\\b\\s*=\\s*new\\s+([A-Za-z_\\\\][\\w\\\\]*)`), // $this->prop = new Foo()
+    ];
+}
+/**
+ * Second-chance typing for a PHP `$this->prop` receiver whose property
+ * declaration carries no static type (classic pre-7.4 style): find the
+ * `$this->prop = $var` assignment, then recover `$var`'s type from its own
+ * declaration WITHIN the assignment's function — the constructor's (possibly
+ * multi-line) parameter list, a typed setter's parameter, or a `= new X()`
+ * local. The backward scan stops at the enclosing `function` line (checked
+ * for a match first — a single-line `__construct(Foo $var) { ... }` carries
+ * the typed parameter itself), so a same-named variable in another method
+ * can never type the property.
+ */
+function inferPhpAssignedPropertyType(escapedProp, lines, callIdx) {
+    const assignRe = new RegExp(`\\$this->${escapedProp}\\b\\s*=\\s*\\$(\\w+)\\b`);
+    const assignAt = (i) => {
+        const line = lines[i];
+        if (!line || line.length > 10_000)
+            return null;
+        return line.match(assignRe);
+    };
+    // The assignment is position-independent relative to the call — nearest-
+    // backward first, then sweep forward, same order as the componentScoped scan.
+    let assignIdx = -1;
+    let varName = null;
+    for (let i = callIdx; i >= 0; i--) {
+        const m = assignAt(i);
+        if (m) {
+            assignIdx = i;
+            varName = m[1];
+            break;
+        }
+    }
+    if (varName === null) {
+        for (let i = callIdx + 1; i < lines.length; i++) {
+            const m = assignAt(i);
+            if (m) {
+                assignIdx = i;
+                varName = m[1];
+                break;
+            }
+        }
+    }
+    if (varName === null)
+        return null;
+    const varPatterns = localReceiverTypePatterns('php', varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    for (let i = assignIdx; i >= 0; i--) {
+        const line = lines[i];
+        if (line && line.length <= 10_000) {
+            for (const re of varPatterns) {
+                const m = line.match(re);
+                if (m && m[1]) {
+                    const type = normalizeInferredTypeName(m[1]);
+                    if (type)
+                        return type;
+                }
+            }
+        }
+        if (line && /\bfunction\b/.test(line))
+            break;
+    }
+    return null;
+}
 /**
  * Try to resolve by method name on a class/object
  */
@@ -860,15 +1364,60 @@ function matchMethodCall(ref, context) {
     // `Guard.Against.X()`) matched no pattern and never resolved.
     const dotMatch = ref.referenceName.match(/^([\w.]+)\.(\w+:?(?:\w+:)*)$/);
     const colonMatch = ref.referenceName.match(/^(\w+)::(\w+)$/);
-    const match = dotMatch || colonMatch;
+    // Lua/Luau method calls use a single colon (`lg:log`); R uses `$` (`lg$log`).
+    // Recognize these receiver/method separators so local-variable receiver-type
+    // inference (#1108) applies to them too — extraction already emits the ref in
+    // this shape, but the resolver otherwise only understood `.` and `::`.
+    const luaColonMatch = (ref.language === 'lua' || ref.language === 'luau')
+        ? ref.referenceName.match(/^([\w.]+):(\w+)$/)
+        : null;
+    const rDollarMatch = ref.language === 'r'
+        ? ref.referenceName.match(/^([\w.]+)\$(\w+)$/)
+        : null;
+    // PHP property receiver: `$this->prop->method()` reaches the resolver as
+    // `this->prop.method` (the extractor records the receiver's raw text with the
+    // leading `$` stripped). Resolve it EXCLUSIVELY through declared-type
+    // inference + resolveMethodOnType validation — the name-similarity strategies
+    // below must never see this shape, so a property whose type can't be
+    // recovered stays unlinked rather than guessed (a wrong inference produces no
+    // edge rather than a wrong one). Deeper chains (`this->a->b.method`) don't
+    // match the single-property pattern and stay unlinked, same as before.
+    const phpThisPropMatch = ref.language === 'php'
+        ? ref.referenceName.match(/^(this->\w+)\.(\w+)$/)
+        : null;
+    if (phpThisPropMatch) {
+        const [, receiver, phpMethodName] = phpThisPropMatch;
+        const inferredType = inferLocalReceiverType(receiver, ref, context);
+        if (!inferredType)
+            return null;
+        return resolveMethodOnType(inferredType, phpMethodName, ref, context, 0.9, 'instance-method', importedFqnOf(inferredType, ref, context));
+    }
+    const match = dotMatch || colonMatch || luaColonMatch || rDollarMatch;
     if (!match) {
         return null;
     }
     const [, objectOrClass, methodName] = match;
-    if (ref.language === 'cpp' && dotMatch) {
-        const inferredType = inferCppReceiverType(objectOrClass, ref, context);
+    // A simple `receiver.method` / `receiver:method` / `receiver$method` shape whose
+    // receiver type we can try to infer from its local declaration.
+    const inferableReceiver = dotMatch || luaColonMatch || rDollarMatch;
+    // Infer the receiver's type from its local declaration/initializer in the
+    // enclosing scope, then resolve the method on that type (#1108). C++ keeps its
+    // dedicated inferrer (header scan + `auto`); every other language uses the
+    // shared source-based inferrer. resolveMethodOnType validates the method
+    // exists on the inferred type, so a mis-inference produces no edge.
+    if (inferableReceiver) {
+        const inferredType = ref.language === 'cpp'
+            ? inferCppReceiverType(objectOrClass, ref, context)
+            : inferLocalReceiverType(objectOrClass, ref, context);
         if (inferredType) {
-            const typedMatch = resolveMethodOnType(inferredType, methodName, ref, context, 0.9, 'instance-method');
+            // Java/Kotlin: when two classes share the simple name, the file's import
+            // pins WHICH one (#314). Other languages disambiguate by call-site file.
+            const importedFqn = ref.language === 'java' || ref.language === 'kotlin'
+                ? context
+                    .getImportMappings(ref.filePath, ref.language)
+                    .find((i) => i.localName === inferredType)?.source
+                : undefined;
+            const typedMatch = resolveMethodOnType(inferredType, methodName, ref, context, 0.9, 'instance-method', importedFqn);
             if (typedMatch) {
                 return typedMatch;
             }
@@ -893,8 +1442,12 @@ function matchMethodCall(ref, context) {
             }
         }
     }
-    // Strategy 1: Direct class name match (existing logic)
-    const classCandidates = context.getNodesByName(objectOrClass);
+    // Strategy 1: Direct class name match (existing logic). When the receiver
+    // names a class that exists in several files (`Logger.log()` / `Logger::log()`
+    // with a `Logger` in both `a/` and `b/`), try the class in the call site's
+    // own file first — otherwise the first-indexed class wins and a call in `b/`
+    // resolves to `a/`'s method (#1079).
+    const classCandidates = preferCallSiteFile(context.getNodesByName(objectOrClass), ref.filePath);
     for (const classNode of classCandidates) {
         if (classNode.kind === 'class' || classNode.kind === 'struct' || classNode.kind === 'interface') {
             // Skip cross-language class matches
@@ -918,7 +1471,7 @@ function matchMethodCall(ref, context) {
     // e.g., "permissionEngine" → look for classes containing "PermissionEngine"
     const capitalizedReceiver = objectOrClass.charAt(0).toUpperCase() + objectOrClass.slice(1);
     if (capitalizedReceiver !== objectOrClass) {
-        const fuzzyClassCandidates = context.getNodesByName(capitalizedReceiver);
+        const fuzzyClassCandidates = preferCallSiteFile(context.getNodesByName(capitalizedReceiver), ref.filePath);
         for (const classNode of fuzzyClassCandidates) {
             if (classNode.kind === 'class' || classNode.kind === 'struct' || classNode.kind === 'interface') {
                 // Skip cross-language class matches
@@ -944,6 +1497,15 @@ function matchMethodCall(ref, context) {
     // names like permissionEngine → PermissionRuleEngine.
     if (methodName) {
         const methodCandidates = context.getNodesByName(methodName);
+        // Ubiquitous-method ceiling (#999): a method name re-declared across a
+        // vendored theme/SDK (Metronic's `init`/`update`/… on every widget) yields
+        // K candidates that receiver-word overlap can't reliably disambiguate —
+        // and filtering + scoring all K per call is the O(K²) cost that wedged
+        // "Resolving refs" for 15-28 min. Bail before the O(K) work; Strategy 1/2
+        // (class-name match) already had their precise shot above.
+        if (methodCandidates.length > AMBIGUOUS_NAME_CEILING) {
+            return null;
+        }
         const methods = methodCandidates.filter((n) => n.kind === 'method' && n.name === methodName);
         // Filter to same-language candidates first
         const sameLanguageMethods = methods.filter(m => m.language === ref.language);
@@ -962,7 +1524,10 @@ function matchMethodCall(ref, context) {
             const receiverWords = splitCamelCase(objectOrClass);
             let bestMatch;
             let bestScore = 0;
-            for (const method of targetMethods) {
+            // Same-file candidates first, so a score tie (`score > bestScore` keeps
+            // the first seen) resolves to the call site's own file rather than the
+            // first-indexed duplicate (#1079).
+            for (const method of preferCallSiteFile(targetMethods, ref.filePath)) {
                 const classWords = splitCamelCase(method.qualifiedName);
                 let score = receiverWords.filter(w => classWords.some(cw => cw.toLowerCase() === w.toLowerCase())).length;
                 // Bonus for same language
@@ -1141,6 +1706,8 @@ function matchFuzzy(ref, context) {
 /**
  * Match all strategies in order of confidence
  */
+/** ArkUI attribute-helper decorators a `.attr(...)` chain may resolve to. */
+const ARKUI_ATTRIBUTE_DECORATORS = new Set(['Extend', 'Styles', 'AnimatableExtend', 'Builder']);
 function matchReference(ref, context) {
     // Function-as-value refs (#756) resolve ONLY through the dedicated matcher —
     // never the fuzzy/qualified fallthrough below (a wrong callback edge is
@@ -1148,6 +1715,57 @@ function matchReference(ref, context) {
     if (ref.referenceKind === 'function_ref') {
         return matchFunctionRef(ref, context);
     }
+    // ArkTS chained UI attributes — emitted with a leading dot (`.titleStyle`,
+    // `.width`) by the extractor — resolve ONLY to decorator-marked attribute
+    // helpers: `@Extend`/`@Styles`/`@AnimatableExtend` functions (and global
+    // `@Builder`s used attribute-position). Framework attributes (`.width`,
+    // `.fontSize` — on nearly every UI line) match no such helper and stay
+    // unresolved, NEVER falling through to bare-name matching: on a samples
+    // monorepo that fallthrough manufactured 36k wrong edges, giving single
+    // same-named properties thousands of false callers. Ambiguity rule matches
+    // the rest of the file: several same-named helpers → prefer the call-site
+    // file, still ambiguous → drop the ref rather than guess.
+    if (ref.language === 'arkts' && ref.referenceName.startsWith('.')) {
+        const base = ref.referenceName.slice(1);
+        const candidates = context
+            .getNodesByName(base)
+            .filter((n) => n.language === 'arkts' &&
+            n.kind === 'function' &&
+            (n.decorators ?? []).some((d) => ARKUI_ATTRIBUTE_DECORATORS.has(d)));
+        const chosen = candidates.length > 1 ? preferCallSiteFile(candidates, ref.filePath) : candidates;
+        if (chosen.length !== 1)
+            return null;
+        return {
+            original: ref,
+            targetNodeId: chosen[0].id,
+            confidence: 0.85,
+            resolvedBy: 'exact-match',
+        };
+    }
+    // Erlang `-behaviour(m)` refs target a MODULE. Letting them fall through to
+    // bare-name matching grabs any same-named symbol — on emqx,
+    // `-behaviour(supervisor)` resolved to a `-define(supervisor, …)` macro
+    // constant in an unrelated app. Resolve only to the behaviour module's
+    // namespace; an out-of-repo behaviour (OTP's gen_server/supervisor) stays
+    // unresolved rather than guessed. The same module-only rule applies to every
+    // ref an `.app`/`.app.src` resource file emits — its `{mod, …}` callback and
+    // `{applications, …}` dependency names can only mean modules, and on emqx
+    // the `ssl` OTP app otherwise resolved to a test helper FUNCTION named ssl.
+    if (ref.language === 'erlang' &&
+        (ref.referenceKind === 'implements' || /\.app(?:\.src)?$/i.test(ref.filePath))) {
+        const modules = context
+            .getNodesByName(ref.referenceName)
+            .filter((n) => n.language === 'erlang' && n.kind === 'namespace');
+        const chosen = preferCallSiteFile(modules, ref.filePath)[0];
+        if (!chosen)
+            return null;
+        return {
+            original: ref,
+            targetNodeId: chosen.id,
+            confidence: 0.9,
+            resolvedBy: 'exact-match',
+        };
+    }
     // Try strategies in order of confidence
     let result;
     // 0. File path match (e.g., "snippets/drawer-menu.liquid" → file node)