knodin 0.13.0 → 0.14.0

package/dist/src/engine/apex-class-uses.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { deflateSync, inflateSync } from "node:zlib";
+import { apexDeclaration } from "./apex-receiver.js";
 const fold = (value) => value.toLowerCase();
 const qualifiedIdentifier = /^[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*$/;
 const spelling = (node) => node.text.replace(/\s+/g, "");
@@ -122,7 +124,7 @@ export function extractApexClassUses(root, source, file) {
         }
         return null;
     };
-    const add = (node, kind, typePath = spelling(node), memberName = null) => {
+    const add = (node, kind, typePath = spelling(node), memberName = null, arity) => {
         if (!qualifiedIdentifier.test(typePath))
             return;
         sites.push({
@@ -131,9 +133,10 @@ export function extractApexClassUses(root, source, file) {
             qualifiedSpelling: node.text,
             typePath,
             memberName,
+            ...(arity === undefined ? {} : { arity }),
             lexicalOwner: owner(node),
             ...range(node),
-            blockedReason: kind === "static_field_read"
+            blockedReason: kind === "static_field_read" || kind === "static_method_receiver"
                 ? blockReason(node, typePath)
                 : malformed
                     ? "malformed-source"
@@ -242,17 +245,37 @@ export function extractApexClassUses(root, source, file) {
             typeUses(node.childForFieldName("type"), "loop_variable_type");
         if (node.type === "cast_expression")
             typeUses(node.childForFieldName("type"), "cast");
+        if (node.type === "instanceof_expression")
+            typeUses(node.childForFieldName("right"), "instanceof_type");
         if (node.type === "object_creation_expression")
             typeUses(node.childForFieldName("type"), "constructor");
         if (node.type === "method_declaration") {
+            const name = node.childForFieldName("name");
+            const ownerPath = owner(node);
+            const metadata = apexDeclaration(node);
+            if (name && ownerPath && metadata.arity !== null)
+                declarations.push({
+                    version: 1,
+                    kind: "method",
+                    ownerPath,
+                    name: metadata.name,
+                    arity: metadata.arity,
+                    static: metadata.static,
+                    annotations: metadata.annotations,
+                    superclass: null,
+                    ...range(name),
+                    declarationRange: range(node),
+                });
             const type = node.childForFieldName("type");
             if (type)
                 unsupported(type, "return_type");
         }
         if (node.type === "method_invocation") {
             const receiver = node.childForFieldName("object");
-            if (receiver && qualifiedIdentifier.test(spelling(receiver)))
-                unsupported(receiver, "static_method_receiver");
+            const name = node.childForFieldName("name");
+            const argumentsNode = node.childForFieldName("arguments");
+            if (receiver && name && argumentsNode && qualifiedIdentifier.test(spelling(receiver)))
+                add(receiver, "static_method_receiver", spelling(receiver), name.text, argumentsNode.namedChildren.filter((child) => !child.type.includes("comment")).length);
         }
         if (node.type !== "field_access" || node.parent?.type === "field_access")
             continue;
@@ -286,9 +309,22 @@ export function extractApexClassUses(root, source, file) {
         unsupportedUses,
         heritage,
         heritageComplete,
+        methodReceiverVersion: 1,
+        instanceofTypeVersion: 1,
         coverage: "supported-syntax-only",
     };
 }
+/** Lossless, process-local retention only; persisted facts and binding evidence are unchanged. */
+export function packApexConsumerCatalog(catalog) {
+    return deflateSync(JSON.stringify([Array.from(catalog.classes), Array.from(catalog.members)]), {
+        level: 1,
+    });
+}
+/** Only accepts buffers produced by this process, never user or database input. */
+export function unpackApexConsumerCatalog(packed) {
+    const [classes, members] = JSON.parse(inflateSync(packed).toString("utf8"));
+    return { classes: new Map(classes), members: new Map(members) };
+}
 /** Build once per indexed catalog revision, never once per use or by walking the filesystem. */
 export function createApexConsumerCatalog(files) {
     const classes = new Map();
@@ -376,8 +412,10 @@ export function resolveApexClassUses(catalog, facts) {
                     parents[0].declaration.kind !== "class")
                     return result("blocked");
                 const ancestorPath = parents[0].declaration.ownerPath;
-                if (site.kind === "static_field_read" &&
-                    catalog.members.has(fold(`${ancestorPath}.${first}`)))
+                if ((site.kind === "static_field_read" || site.kind === "static_method_receiver") &&
+                    catalog.members
+                        .get(fold(`${ancestorPath}.${first}`))
+                        ?.some((entry) => entry.declaration.kind !== "method"))
                     return result("blocked");
                 const inheritedPrefix = catalog.classes.get(fold(`${ancestorPath}.${first}`));
                 if (inheritedPrefix?.length) {
@@ -409,14 +447,22 @@ export function resolveApexClassUses(catalog, facts) {
             !["class", "interface"].includes(target.declaration.kind))
             return result("blocked");
         if (target.declaration.kind === "interface" &&
-            (site.kind === "constructor" || site.kind === "static_field_read"))
+            (site.kind === "constructor" ||
+                site.kind === "static_field_read" ||
+                site.kind === "static_method_receiver"))
             return result("blocked");
         // Every owning class must be unique too: nested declarations cannot bypass an outer collision.
         if (!uniqueOwner(target))
             return result("ambiguous");
         if (!site.memberName)
             return result("resolved", target);
-        const members = catalog.members.get(fold(`${target.declaration.ownerPath}.${site.memberName}`));
+        const members = catalog.members
+            .get(fold(`${target.declaration.ownerPath}.${site.memberName}`))
+            ?.filter((entry) => site.kind === "static_method_receiver"
+            ? entry.declaration.kind === "method" &&
+                site.arity !== undefined &&
+                entry.declaration.arity === site.arity
+            : entry.declaration.kind !== "method");
         if (!members?.length)
             return result("missing");
         if (members.length !== 1)

package/dist/src/engine/apex-dead-chains.js

@@ -0,0 +1,368 @@
+import { createHash } from "node:crypto";
+import { compareBytes } from "../compare.js";
+import { apexPlatformEntryPoints } from "./apex-entry-points.js";
+import { apexReferenceReadGuard, parseApexCall, parseApexDeclaration } from "./apex-receiver.js";
+/** Conditional indexed-source hypotheses; never a closed-world liveness analysis. */
+export function apexDeadChains(db, isTest) {
+    const analysis = {
+        version: 1,
+        model: "apex-indexed-roots-v1",
+        scope: "indexed-source",
+        runtimeInvocation: "not-established",
+        safeToDelete: false,
+        roots: 0,
+        exactEdges: 0,
+        possibleEdges: 0,
+        unknownCalls: 0,
+        partial: false,
+        chains: [],
+        limitations: [
+            "Only modeled roots and calls in the indexed source inventory are considered; omitted callers, org configuration and runtime dispatch are not established.",
+            "Chain owners describe structural membership, not class-wide nonuse. Candidates are not permission to delete source.",
+        ],
+    };
+    const candidates = new Map();
+    const columns = (table) => new Set(db
+        .query(`PRAGMA table_info("${table}")`)
+        .all()
+        .map((row) => row.name));
+    const symbolColumns = columns("symbols");
+    const referenceColumns = columns("references");
+    if (!symbolColumns.has("apexDeclaration") ||
+        !symbolColumns.has("identity") ||
+        ["apexCall", "callerIdentity", "calleeIdentity", "column"].some((column) => !referenceColumns.has(column))) {
+        analysis.partial = true;
+        analysis.limitations.push("Legacy graph lacks root-analysis provenance; repair the indexed Apex scope.");
+        return { candidates, protected: new Set(), analysis };
+    }
+    if (!db
+        .query("SELECT count(*) count FROM symbols WHERE filePath LIKE '%.cls'")
+        .get()?.count)
+        return { candidates, protected: new Set(), analysis };
+    const definitions = db
+        .query("SELECT id,identity,name,kind,filePath,startLine,endLine,startCol,endCol,apexDeclaration FROM symbols LIMIT 50001")
+        .all();
+    const refs = db
+        .query('SELECT callerSymbol,callerFile,callerIdentity,calleeSymbol,calleeFile,calleeIdentity,line,column,kind,apexCall FROM "references" LIMIT 500001')
+        .all();
+    if (definitions.length > 50000 || refs.length > 500000) {
+        analysis.partial = true;
+        analysis.limitations.push("Root analysis inventory exceeds its bounded node/edge limit; no chain candidates were established.");
+        return { candidates, protected: new Set(), analysis };
+    }
+    const byIdentity = new Map(definitions.filter((d) => d.identity).map((d) => [d.identity, d]));
+    const apex = definitions.filter((d) => /\.cls$/i.test(d.filePath) && ["class", "method"].includes(d.kind));
+    const parsed = new Map(apex.map((d) => [d.id, parseApexDeclaration(d.apexDeclaration)]));
+    const testFiles = new Set(apex
+        .filter((d) => parsed
+        .get(d.id)
+        ?.annotations.some((name) => name.replace(/^@/, "").toLowerCase() === "istest"))
+        .map((d) => d.filePath));
+    const testFile = (file) => isTest(file) || testFiles.has(file);
+    const invalidFiles = new Set(apex.filter((d) => !parsed.get(d.id) || !d.identity).map((d) => d.filePath));
+    const seenIdentities = new Map();
+    for (const d of definitions) {
+        if (!d.identity)
+            continue;
+        const previous = seenIdentities.get(d.identity);
+        if (previous !== undefined) {
+            invalidFiles.add(previous);
+            invalidFiles.add(d.filePath);
+        }
+        else
+            seenIdentities.set(d.identity, d.filePath);
+    }
+    const tables = new Set(db
+        .query("SELECT name FROM sqlite_master WHERE type='table'")
+        .all()
+        .map((row) => row.name));
+    const capabilities = tables.has("apex_file_capabilities")
+        ? new Map(db
+            .query("SELECT filePath,version FROM apex_file_capabilities")
+            .all()
+            .map((row) => [row.filePath, row.version]))
+        : new Map();
+    for (const d of apex)
+        if (capabilities.get(d.filePath) !== 1)
+            invalidFiles.add(d.filePath);
+    if (tables.has("apex_consumer_files"))
+        for (const row of db
+            .query("SELECT filePath FROM apex_consumer_files WHERE parseState<>'complete'")
+            .all())
+            invalidFiles.add(row.filePath);
+    const byFile = new Map();
+    const byName = new Map();
+    const classesByOwner = new Map();
+    const group = (map, key, value) => {
+        const list = map.get(key) ?? [];
+        list.push(value);
+        map.set(key, list);
+    };
+    for (const d of definitions) {
+        group(byFile, d.filePath, d);
+        if (d.kind === "method")
+            group(byName, d.name.toLowerCase(), d);
+        const declaration = parsed.get(d.id);
+        if (d.kind === "class" && declaration)
+            group(classesByOwner, declaration.owner.toLowerCase(), d);
+    }
+    const roots = new Set();
+    const exact = new Map();
+    const possible = new Map();
+    const callEdges = [];
+    const ownerByMethod = new Map();
+    const wildcardCallers = new Set();
+    const add = (map, from, to) => {
+        const targets = map.get(from) ?? new Set();
+        targets.add(to);
+        map.set(from, targets);
+    };
+    const entryRows = apex.flatMap((d) => {
+        const declaration = parsed.get(d.id);
+        return declaration && d.identity ? [{ key: d.identity, file: d.filePath, declaration }] : [];
+    });
+    for (const key of apexPlatformEntryPoints(entryRows).keys())
+        roots.add(key);
+    for (const d of definitions) {
+        if (!d.identity)
+            continue;
+        if (testFile(d.filePath) ||
+            /\.trigger$/i.test(d.filePath) ||
+            invalidFiles.has(d.filePath) ||
+            parsed.get(d.id)?.modifiers.some((value) => value.toLowerCase() === "testmethod"))
+            roots.add(d.identity);
+        const declaration = parsed.get(d.id);
+        if (d.kind !== "method" || !declaration)
+            continue;
+        const owners = (classesByOwner.get(declaration.owner.toLowerCase()) ?? []).filter((owner) => owner.kind === "class" &&
+            parsed.get(owner.id)?.owner.toLowerCase() === declaration.owner.toLowerCase());
+        if (owners.length !== 1 || !owners[0].identity) {
+            roots.add(d.identity);
+            analysis.partial = true;
+            continue;
+        }
+        ownerByMethod.set(d.identity, owners[0]);
+        // Invoking a method can activate its owner initializer; membership alone does not invoke siblings.
+        add(possible, d.identity, owners[0].identity);
+        if (d.name.toLowerCase() === owners[0].name.toLowerCase() || d.name === "constructor")
+            add(possible, owners[0].identity, d.identity);
+    }
+    const contains = (d, ref) => (d.startLine < ref.line || (d.startLine === ref.line && d.startCol <= ref.column)) &&
+        (d.endLine > ref.line || (d.endLine === ref.line && d.endCol > ref.column));
+    const guard = apexReferenceReadGuard(db);
+    for (const ref of refs) {
+        const knownTarget = ref.calleeIdentity ? byIdentity.get(ref.calleeIdentity) : undefined;
+        if (!/\.(cls|trigger)$/i.test(ref.callerFile)) {
+            // A known foreign-source/metadata binding is a conservative boundary, not a proven runtime call.
+            if (knownTarget?.identity)
+                roots.add(knownTarget.identity);
+            else if (ref.calleeFile && /\.cls$/i.test(ref.calleeFile)) {
+                for (const d of byFile.get(ref.calleeFile) ?? [])
+                    if (d.identity)
+                        roots.add(d.identity);
+                analysis.partial = true;
+            }
+            else {
+                const name = ref.calleeSymbol.split(".").at(-1)?.toLowerCase() ?? "";
+                const potential = [
+                    ...(byName.get(name) ?? []),
+                    ...(classesByOwner.get(ref.calleeSymbol.toLowerCase()) ?? []),
+                ];
+                for (const d of potential)
+                    if (d.identity)
+                        roots.add(d.identity);
+                if (potential.length)
+                    analysis.partial = true;
+            }
+            continue;
+        }
+        if (ref.kind !== "call")
+            continue;
+        const fileDefinitions = byFile.get(ref.callerFile) ?? [];
+        const methods = fileDefinitions.filter((d) => d.kind === "method" && contains(d, ref));
+        let callers = methods;
+        if (!callers.length) {
+            const owners = fileDefinitions.filter((d) => ["class", "trigger"].includes(d.kind) && contains(d, ref));
+            const innermost = owners.filter((owner) => !owners.some((other) => other.id !== owner.id &&
+                other.startLine >= owner.startLine &&
+                other.endLine <= owner.endLine &&
+                (other.startLine > owner.startLine || other.endLine < owner.endLine)));
+            callers = innermost;
+        }
+        const exactCaller = callers.length === 1 &&
+            callers[0].identity === ref.callerIdentity &&
+            callers[0].name === ref.callerSymbol;
+        const call = parseApexCall(ref.apexCall);
+        let targets = [];
+        let exactTarget = false;
+        if (ref.apexCall && call) {
+            const ownerCandidates = classesByOwner.get(call.receiver.toLowerCase()) ?? [];
+            const localMembers = call.kind === "constructor"
+                ? ownerCandidates
+                : (byName.get(call.member.toLowerCase()) ?? []).filter((d) => parsed.get(d.id)?.arity === call.arity);
+            targets = call.blocked
+                ? localMembers
+                : localMembers.filter((d) => parsed.get(d.id)?.owner.toLowerCase() === call.receiver.toLowerCase());
+            if (!targets.length && call.kind !== "constructor")
+                targets = localMembers;
+            exactTarget =
+                ownerCandidates.length === 1 &&
+                    targets.length === 1 &&
+                    targets[0].identity === ref.calleeIdentity &&
+                    guard(ref);
+        }
+        else if (!ref.apexCall) {
+            const local = (byName.get(ref.calleeSymbol.toLowerCase()) ?? []).filter((d) => d.filePath === ref.callerFile);
+            const callerOwners = new Set(callers.map((d) => parsed.get(d.id)?.owner.toLowerCase()).filter(Boolean));
+            targets = local.filter((d) => callerOwners.has(parsed.get(d.id)?.owner.toLowerCase()));
+            if (!targets.length)
+                targets = byName.get(ref.calleeSymbol.toLowerCase()) ?? [];
+            exactTarget =
+                targets.length === 1 &&
+                    targets[0].identity === ref.calleeIdentity &&
+                    targets[0].filePath === ref.calleeFile;
+        }
+        else {
+            targets = byName.get(ref.calleeSymbol.toLowerCase()) ?? [];
+        }
+        if (!exactCaller || !exactTarget)
+            analysis.unknownCalls++;
+        // Reflection or corrupt provenance can address targets not enumerable by a literal member name.
+        const reflectiveTypeLookup = call?.kind === "static" &&
+            /^(?:System\.)?Type$/i.test(call.receiver) &&
+            /^forName$/i.test(call.member) &&
+            !exactTarget;
+        // An unresolved value's newInstance may be Type.newInstance; ordinary static
+        // Date/Datetime factories and resolved local service invoke methods are not reflection.
+        const unknownTypeInstance = call?.kind === "static" && call.blocked && /^newInstance$/i.test(call.member) && !exactTarget;
+        const wildcard = (!!ref.apexCall && !call) || reflectiveTypeLookup || unknownTypeInstance;
+        if (wildcard) {
+            if (!callers.length)
+                for (const d of apex)
+                    if (d.identity)
+                        roots.add(d.identity);
+            for (const caller of callers)
+                if (caller.identity)
+                    wildcardCallers.add(caller.identity);
+        }
+        for (const target of targets) {
+            if (!target.identity)
+                continue;
+            if (!callers.length) {
+                roots.add(target.identity);
+                analysis.partial = true;
+            }
+            for (const caller of callers) {
+                if (!caller.identity) {
+                    roots.add(target.identity);
+                    analysis.partial = true;
+                    continue;
+                }
+                const proven = exactCaller && exactTarget;
+                add(proven ? exact : possible, caller.identity, target.identity);
+                if (proven && caller.kind === "method" && target.kind === "method")
+                    callEdges.push({
+                        fromIdentity: caller.identity,
+                        toIdentity: target.identity,
+                        file: ref.callerFile,
+                        line: ref.line,
+                        column: ref.column + 1,
+                    });
+            }
+        }
+    }
+    // Metadata with only a file-level target is uncertain: protect the entire addressed Apex file.
+    for (const dep of db
+        .query("SELECT fromFile,toFile FROM dependencies")
+        .all()) {
+        if (/\.(cls|trigger)$/i.test(dep.fromFile) || !/\.cls$/i.test(dep.toFile))
+            continue;
+        for (const d of byFile.get(dep.toFile) ?? [])
+            if (d.identity)
+                roots.add(d.identity);
+    }
+    const reached = new Set(roots);
+    const queue = [...roots];
+    let wildcardExpanded = false;
+    // The array iterator sees elements pushed while iterating, so this walks the
+    // whole reachable set as a queue.
+    for (const current of queue) {
+        if (wildcardCallers.has(current)) {
+            if (!wildcardExpanded)
+                for (const d of apex)
+                    if (d.identity && !reached.has(d.identity)) {
+                        reached.add(d.identity);
+                        queue.push(d.identity);
+                    }
+            analysis.partial = true;
+            wildcardExpanded = true;
+        }
+        for (const next of [...(exact.get(current) ?? []), ...(possible.get(current) ?? [])])
+            if (!reached.has(next)) {
+                reached.add(next);
+                queue.push(next);
+            }
+    }
+    const adjacency = new Map();
+    for (const edge of callEdges) {
+        if (reached.has(edge.fromIdentity) || reached.has(edge.toIdentity))
+            continue;
+        add(adjacency, edge.fromIdentity, edge.toIdentity);
+        add(adjacency, edge.toIdentity, edge.fromIdentity);
+    }
+    const visited = new Set();
+    const edgesByCaller = new Map();
+    for (const edge of callEdges) {
+        const list = edgesByCaller.get(edge.fromIdentity) ?? [];
+        list.push(edge);
+        edgesByCaller.set(edge.fromIdentity, list);
+    }
+    const member = (d) => ({
+        identity: d.identity,
+        symbol: d.name,
+        file: d.filePath,
+        line: d.startLine,
+        kind: d.kind,
+    });
+    for (const start of [...adjacency.keys()].sort(compareBytes)) {
+        if (visited.has(start))
+            continue;
+        const component = [start];
+        visited.add(start);
+        for (const member of component)
+            for (const next of adjacency.get(member) ?? [])
+                if (!visited.has(next)) {
+                    visited.add(next);
+                    component.push(next);
+                }
+        const members = component
+            .map((id) => byIdentity.get(id))
+            .filter((d) => !!d && d.kind === "method" && !invalidFiles.has(d.filePath) && !testFile(d.filePath));
+        if (!members.length || members.length !== component.length)
+            continue;
+        const ids = new Set(component);
+        const identity = `chain_${createHash("sha256")
+            .update([...ids].sort(compareBytes).join("\0"))
+            .digest("hex")
+            .slice(0, 24)}`;
+        const owners = new Map(members.flatMap((d) => {
+            const owner = ownerByMethod.get(d.identity);
+            return owner?.identity ? [[owner.identity, owner]] : [];
+        }));
+        analysis.chains.push({
+            identity,
+            members: members.map(member).sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line),
+            owners: [...owners.values()].map(member),
+            edges: component
+                .flatMap((id) => edgesByCaller.get(id) ?? [])
+                .filter((edge) => ids.has(edge.toIdentity)),
+        });
+        for (const d of members)
+            candidates.set(d.identity, identity);
+    }
+    analysis.roots = roots.size;
+    analysis.exactEdges = [...exact.values()].reduce((sum, targets) => sum + targets.size, 0);
+    analysis.possibleEdges = [...possible.values()].reduce((sum, targets) => sum + targets.size, 0);
+    analysis.partial ||= invalidFiles.size > 0 || analysis.unknownCalls > 0;
+    return { candidates, protected: reached, analysis };
+}

package/dist/src/engine/apex-entry-points.js

@@ -35,9 +35,26 @@ function callbackSignature(contract, declaration) {
     }
     return false;
 }
+const contractNames = new Map([
+    ["queueable", "Queueable"],
+    ["system.queueable", "System.Queueable"],
+    ["database.batchable", "Database.Batchable"],
+    ["schedulable", "Schedulable"],
+    ["system.schedulable", "System.Schedulable"],
+    ["messaging.inboundemailhandler", "Messaging.InboundEmailHandler"],
+]);
+const contractName = (name) => contractNames.get(normalized(name)) ?? name;
 /** Static org-facing declarations, never a claim that an org actually invokes them. */
-export function apexOrgEntryPoints(rows) {
+export function apexPlatformEntryPoints(rows) {
     const protectedSymbols = new Map();
+    const protect = (key, reason, contracts, owner) => {
+        const previous = protectedSymbols.get(key);
+        protectedSymbols.set(key, {
+            reason,
+            contracts: [...new Set([...(previous?.contracts ?? []), ...contracts])],
+            ...(owner ? { ownerKey: owner } : {}),
+        });
+    };
     const classes = new Map();
     for (const row of rows) {
         const decl = row.declaration;
@@ -46,9 +63,9 @@ export function apexOrgEntryPoints(rows) {
         const key = ownerKey(row);
         classes.set(key, [...(classes.get(key) ?? []), row]);
         if (decl.annotations.some((name) => normalized(name) === "restresource"))
-            protectedSymbols.set(row.key, "REST resource declaration");
+            protect(row.key, "REST resource declaration", ["@RestResource"]);
         if (decl.implements.some((name) => callbacks.has(normalized(name))))
-            protectedSymbols.set(row.key, "Salesforce platform callback contract");
+            protect(row.key, "Salesforce platform callback contract", decl.implements.filter((name) => callbacks.has(normalized(name))).map(contractName));
     }
     for (const row of rows) {
         const decl = row.declaration;
@@ -62,6 +79,15 @@ export function apexOrgEntryPoints(rows) {
         const annotations = new Set(decl.annotations.map(normalized));
         const modifiers = new Set(decl.modifiers.map(normalized));
         let reason;
+        const contracts = [];
+        if (annotations.has("invocablemethod") && decl.static)
+            contracts.push("@InvocableMethod");
+        if (annotations.has("auraenabled") && decl.static)
+            contracts.push("@AuraEnabled");
+        if (annotations.has("future") && decl.static)
+            contracts.push("@future");
+        if (modifiers.has("webservice") && decl.static)
+            contracts.push("webservice");
         if (annotations.has("invocablemethod") && decl.static)
             reason = "Invocable Apex declaration";
         if (annotations.has("auraenabled") && decl.static)
@@ -72,15 +98,21 @@ export function apexOrgEntryPoints(rows) {
             reason = "SOAP Apex declaration";
         if (decl.static &&
             owner.declaration.annotations.some((name) => normalized(name) === "restresource") &&
-            ["httpget", "httppost", "httpput", "httppatch", "httpdelete"].some((name) => annotations.has(name)))
+            ["httpget", "httppost", "httpput", "httppatch", "httpdelete"].some((name) => annotations.has(name))) {
             reason = "REST Apex method declaration";
+            contracts.push("@RestResource");
+        }
         if (!decl.static &&
             (modifiers.has("public") || modifiers.has("global")) &&
-            owner.declaration.implements.some((name) => callbackSignature(normalized(name), decl)))
+            owner.declaration.implements.some((name) => callbackSignature(normalized(name), decl))) {
             reason = "Salesforce platform callback method";
+            contracts.push(...owner.declaration.implements
+                .filter((name) => callbackSignature(normalized(name), decl))
+                .map(contractName));
+        }
         if (reason) {
-            protectedSymbols.set(row.key, reason);
-            protectedSymbols.set(owner.key, "Owner of an org-facing Apex declaration");
+            protect(row.key, reason, contracts, owner.key);
+            protect(owner.key, "Owner of an org-facing Apex declaration", contracts);
         }
     }
     // A constructor of an org-facing class is a boundary, not an ordinary helper.
@@ -92,7 +124,11 @@ export function apexOrgEntryPoints(rows) {
         if (owners.length === 1 &&
             protectedSymbols.has(owners[0].key) &&
             normalized(decl.name) === normalized(owners[0].declaration.name))
-            protectedSymbols.set(row.key, "Constructor of an org-facing Apex class");
+            protect(row.key, "Constructor of an org-facing Apex class", protectedSymbols.get(owners[0].key)?.contracts ?? [], owners[0].key);
     }
     return protectedSymbols;
 }
+/** Compatibility projection used by dead-code exclusion; reasons retain their original precedence. */
+export function apexOrgEntryPoints(rows) {
+    return new Map([...apexPlatformEntryPoints(rows)].map(([key, entry]) => [key, entry.reason]));
+}