knodin 0.13.1 → 0.14.0

package/dist/bin/cli.js

@@ -157,7 +157,17 @@ function formatRepairHuman(result) {
         result.after.missing.files.length + result.after.missing.records.length;
     const firstIssue = result.after.missing.files[0] ?? result.after.missing.records[0];
     const detail = firstIssue ? ` First issue: ${firstIssue}.` : "";
-    return `Repair finished with ${outstanding.toLocaleString()} remaining issue(s).${detail} Run \`knodin status --deep\` for details.\n`;
+    // Say when nothing moved: on nova the same 111-issue graph went through
+    // status -> repair -> status unchanged, and "Repair finished with 141
+    // remaining issue(s)" read as progress. Then print the audit's own remedy
+    // rather than a generic pointer; for a legacy epoch-less graph the audit
+    // already knows repair cannot fix it and index --clean can (KNODIN-50).
+    const unchanged = result.repaired.length === 0 &&
+        result.before.missing.files.length === result.after.missing.files.length &&
+        result.before.missing.records.length === result.after.missing.records.length;
+    const progress = unchanged ? "Repair made no changes; " : "Repair finished with ";
+    const remedy = result.after.repairSteps[0] ?? "Run `knodin status --deep` for details.";
+    return `${progress}${outstanding.toLocaleString()} remaining issue(s).${detail} ${remedy}\n`;
 }
 /**
  * The semantic gap, stated rather than left to be discovered.
@@ -198,7 +208,8 @@ function formatIndexVerificationError(result) {
     const condition = result.verification.issueCount > 0
         ? `${result.verification.issueCount.toLocaleString()} graph issue(s) remain`
         : `graph verification reported status "${result.verification.status}"`;
-    return `knodin index: requested work completed, but ${condition}.${detail} Run \`knodin repair\`.\n`;
+    const remedy = result.verification.repairSteps[0] ?? "Run `knodin repair`.";
+    return `knodin index: requested work completed, but ${condition}.${detail} ${remedy}\n`;
 }
 /**
  * The hooks/lifecycle line of `status`.
@@ -501,7 +512,14 @@ function formatStatusHuman(result) {
     const lifecycleOnly = result.lifecycle?.status === "degraded" &&
         (result.coverage.countsUnknown || result.missing.files.length === 0) &&
         result.missing.records.every((record) => result.lifecycle?.issues.includes(record));
-    const repairCommand = worktreeStep ?? (lifecycleOnly ? "Run `knodin repair --lifecycle`." : "Run `knodin repair`.");
+    // Otherwise the engine's first step is authoritative too: it distinguishes
+    // "rebuild damaged rows" from "this graph predates the content-proof epoch
+    // and only index --clean can certify it" — a case where sending the user to
+    // repair costs two failing round trips (KNODIN-50).
+    const repairCommand = worktreeStep ??
+        (lifecycleOnly
+            ? "Run `knodin repair --lifecycle`."
+            : (result.repairSteps?.[0] ?? "Run `knodin repair`."));
     return `Graph or lifecycle needs repair: ${outstanding} issue(s) found (${coverage}).${detail} ${repairCommand}\n${lifecycleLine}${integrationLine}`;
 }
 function humanLabel(key) {
@@ -2236,10 +2254,34 @@ async function main() {
                     throw new Error("knodin hook-refresh: invalid lifecycle event");
                 }
                 const shared = await opportunisticSharedRestore();
+                // Keep the audit that the scoped index already ran. Before this the
+                // hook reported only the paths it wrote and exited 0, so a graph the
+                // audit refused to certify — nova's 0.13.0 graph after the 0.13.1
+                // upgrade, 33 commits behind with lifecycle "healthy" — looked like a
+                // success on every commit (KNODIN-49).
+                let verification;
                 const indexed = shared?.restored
                     ? []
-                    : await refreshFromGitEvent(repo, event, (target, files) => engine.index(target, files));
-                result = { indexed, ...(shared ? { sharedRestore: shared } : {}) };
+                    : await refreshFromGitEvent(repo, event, async (target, files) => {
+                        const indexResult = await engine.index(target, files);
+                        verification = indexResult.verification;
+                        return indexResult;
+                    });
+                if (verification?.status === "repair-needed") {
+                    const firstIssue = verification.missing.records[0] ?? verification.missing.files[0] ?? "unknown issue";
+                    const remedy = verification.repairSteps[0] ?? "Run `knodin repair`.";
+                    throw new Error(`knodin hook-refresh: indexed ${indexed.length} path(s) but the graph audit refused to certify the result (${verification.issueCount.toLocaleString()} issue(s); first: ${firstIssue}). ${remedy}`);
+                }
+                // `at` and `event` make each indexer.log record self-describing; the
+                // background script supplies the queued event's sequence through
+                // KNODIN_HOOK_EVENT_SEQUENCE so the line can be tied to its Git event.
+                result = {
+                    at: new Date().toISOString(),
+                    event: { ...event, sequence: process.env.KNODIN_HOOK_EVENT_SEQUENCE ?? null },
+                    indexed,
+                    ...(verification ? { verification } : {}),
+                    ...(shared ? { sharedRestore: shared } : {}),
+                };
             }
             finally {
                 lifecycleLease.release();
@@ -2593,6 +2635,7 @@ async function main() {
                     ? {
                         mode: "source",
                         identity: explained.identity,
+                        platformEntry: explained.platformEntry,
                         symbol: explained.symbol,
                         source: explained.source,
                         staleness: explained.staleness,

package/dist/src/class-consumer-cursor.js

@@ -3,10 +3,12 @@ import { canonicalCoveragePath } from "./engine/index-coverage.js";
 const PREFIX = "cc1";
 const DIGEST = /^[a-f0-9]{64}$/;
 const KINDS = [
+    "static_method_receiver",
     "static_field_read",
     "constructor",
     "variable_type",
     "cast",
+    "instanceof_type",
     "class_literal",
     "parameter_type",
     "generic_parameter_type",

package/dist/src/compact-structural.js

@@ -87,10 +87,15 @@ export function compactExplainResult(result, selectorFile, byteBudget) {
         .map((line) => line.replace(/^\d+: /, ""))
         .join("\n");
     const header = `${freshness(result.staleness)} ${compactIdentity(result.identity)} ${selectorFile ?? "?"}:${firstLine || "?"}`;
-    const output = `${header}\n${source}`;
+    const platform = result.platformEntry
+        ? `\nplatformEntry ${JSON.stringify(result.platformEntry)}`
+        : "";
+    const output = `${header}${platform}\n${source}`;
     if (byteBudget === undefined || Buffer.byteLength(output, "utf8") <= byteBudget)
         return output;
-    const omitted = `${header}\nomitted ${Buffer.byteLength(source, "utf8")}B`;
+    const omitted = `${header}${platform}\nomitted ${Buffer.byteLength(source, "utf8")}B`;
+    if (platform && Buffer.byteLength(omitted, "utf8") > byteBudget)
+        throw new RangeError("explain budget cannot preserve platformEntry; increase the budget");
     return Buffer.byteLength(omitted, "utf8") <= byteBudget ? omitted : "";
 }
 function compactAmbiguity(candidates, staleness) {

package/dist/src/engine/apex-class-uses.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { deflateSync, inflateSync } from "node:zlib";
+import { apexDeclaration } from "./apex-receiver.js";
 const fold = (value) => value.toLowerCase();
 const qualifiedIdentifier = /^[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*$/;
 const spelling = (node) => node.text.replace(/\s+/g, "");
@@ -122,7 +124,7 @@ export function extractApexClassUses(root, source, file) {
         }
         return null;
     };
-    const add = (node, kind, typePath = spelling(node), memberName = null) => {
+    const add = (node, kind, typePath = spelling(node), memberName = null, arity) => {
         if (!qualifiedIdentifier.test(typePath))
             return;
         sites.push({
@@ -131,9 +133,10 @@ export function extractApexClassUses(root, source, file) {
             qualifiedSpelling: node.text,
             typePath,
             memberName,
+            ...(arity === undefined ? {} : { arity }),
             lexicalOwner: owner(node),
             ...range(node),
-            blockedReason: kind === "static_field_read"
+            blockedReason: kind === "static_field_read" || kind === "static_method_receiver"
                 ? blockReason(node, typePath)
                 : malformed
                     ? "malformed-source"
@@ -242,17 +245,37 @@ export function extractApexClassUses(root, source, file) {
             typeUses(node.childForFieldName("type"), "loop_variable_type");
         if (node.type === "cast_expression")
             typeUses(node.childForFieldName("type"), "cast");
+        if (node.type === "instanceof_expression")
+            typeUses(node.childForFieldName("right"), "instanceof_type");
         if (node.type === "object_creation_expression")
             typeUses(node.childForFieldName("type"), "constructor");
         if (node.type === "method_declaration") {
+            const name = node.childForFieldName("name");
+            const ownerPath = owner(node);
+            const metadata = apexDeclaration(node);
+            if (name && ownerPath && metadata.arity !== null)
+                declarations.push({
+                    version: 1,
+                    kind: "method",
+                    ownerPath,
+                    name: metadata.name,
+                    arity: metadata.arity,
+                    static: metadata.static,
+                    annotations: metadata.annotations,
+                    superclass: null,
+                    ...range(name),
+                    declarationRange: range(node),
+                });
             const type = node.childForFieldName("type");
             if (type)
                 unsupported(type, "return_type");
         }
         if (node.type === "method_invocation") {
             const receiver = node.childForFieldName("object");
-            if (receiver && qualifiedIdentifier.test(spelling(receiver)))
-                unsupported(receiver, "static_method_receiver");
+            const name = node.childForFieldName("name");
+            const argumentsNode = node.childForFieldName("arguments");
+            if (receiver && name && argumentsNode && qualifiedIdentifier.test(spelling(receiver)))
+                add(receiver, "static_method_receiver", spelling(receiver), name.text, argumentsNode.namedChildren.filter((child) => !child.type.includes("comment")).length);
         }
         if (node.type !== "field_access" || node.parent?.type === "field_access")
             continue;
@@ -286,9 +309,22 @@ export function extractApexClassUses(root, source, file) {
         unsupportedUses,
         heritage,
         heritageComplete,
+        methodReceiverVersion: 1,
+        instanceofTypeVersion: 1,
         coverage: "supported-syntax-only",
     };
 }
+/** Lossless, process-local retention only; persisted facts and binding evidence are unchanged. */
+export function packApexConsumerCatalog(catalog) {
+    return deflateSync(JSON.stringify([Array.from(catalog.classes), Array.from(catalog.members)]), {
+        level: 1,
+    });
+}
+/** Only accepts buffers produced by this process, never user or database input. */
+export function unpackApexConsumerCatalog(packed) {
+    const [classes, members] = JSON.parse(inflateSync(packed).toString("utf8"));
+    return { classes: new Map(classes), members: new Map(members) };
+}
 /** Build once per indexed catalog revision, never once per use or by walking the filesystem. */
 export function createApexConsumerCatalog(files) {
     const classes = new Map();
@@ -376,8 +412,10 @@ export function resolveApexClassUses(catalog, facts) {
                     parents[0].declaration.kind !== "class")
                     return result("blocked");
                 const ancestorPath = parents[0].declaration.ownerPath;
-                if (site.kind === "static_field_read" &&
-                    catalog.members.has(fold(`${ancestorPath}.${first}`)))
+                if ((site.kind === "static_field_read" || site.kind === "static_method_receiver") &&
+                    catalog.members
+                        .get(fold(`${ancestorPath}.${first}`))
+                        ?.some((entry) => entry.declaration.kind !== "method"))
                     return result("blocked");
                 const inheritedPrefix = catalog.classes.get(fold(`${ancestorPath}.${first}`));
                 if (inheritedPrefix?.length) {
@@ -409,14 +447,22 @@ export function resolveApexClassUses(catalog, facts) {
             !["class", "interface"].includes(target.declaration.kind))
             return result("blocked");
         if (target.declaration.kind === "interface" &&
-            (site.kind === "constructor" || site.kind === "static_field_read"))
+            (site.kind === "constructor" ||
+                site.kind === "static_field_read" ||
+                site.kind === "static_method_receiver"))
             return result("blocked");
         // Every owning class must be unique too: nested declarations cannot bypass an outer collision.
         if (!uniqueOwner(target))
             return result("ambiguous");
         if (!site.memberName)
             return result("resolved", target);
-        const members = catalog.members.get(fold(`${target.declaration.ownerPath}.${site.memberName}`));
+        const members = catalog.members
+            .get(fold(`${target.declaration.ownerPath}.${site.memberName}`))
+            ?.filter((entry) => site.kind === "static_method_receiver"
+            ? entry.declaration.kind === "method" &&
+                site.arity !== undefined &&
+                entry.declaration.arity === site.arity
+            : entry.declaration.kind !== "method");
         if (!members?.length)
             return result("missing");
         if (members.length !== 1)

package/dist/src/engine/apex-dead-chains.js

@@ -0,0 +1,368 @@
+import { createHash } from "node:crypto";
+import { compareBytes } from "../compare.js";
+import { apexPlatformEntryPoints } from "./apex-entry-points.js";
+import { apexReferenceReadGuard, parseApexCall, parseApexDeclaration } from "./apex-receiver.js";
+/** Conditional indexed-source hypotheses; never a closed-world liveness analysis. */
+export function apexDeadChains(db, isTest) {
+    const analysis = {
+        version: 1,
+        model: "apex-indexed-roots-v1",
+        scope: "indexed-source",
+        runtimeInvocation: "not-established",
+        safeToDelete: false,
+        roots: 0,
+        exactEdges: 0,
+        possibleEdges: 0,
+        unknownCalls: 0,
+        partial: false,
+        chains: [],
+        limitations: [
+            "Only modeled roots and calls in the indexed source inventory are considered; omitted callers, org configuration and runtime dispatch are not established.",
+            "Chain owners describe structural membership, not class-wide nonuse. Candidates are not permission to delete source.",
+        ],
+    };
+    const candidates = new Map();
+    const columns = (table) => new Set(db
+        .query(`PRAGMA table_info("${table}")`)
+        .all()
+        .map((row) => row.name));
+    const symbolColumns = columns("symbols");
+    const referenceColumns = columns("references");
+    if (!symbolColumns.has("apexDeclaration") ||
+        !symbolColumns.has("identity") ||
+        ["apexCall", "callerIdentity", "calleeIdentity", "column"].some((column) => !referenceColumns.has(column))) {
+        analysis.partial = true;
+        analysis.limitations.push("Legacy graph lacks root-analysis provenance; repair the indexed Apex scope.");
+        return { candidates, protected: new Set(), analysis };
+    }
+    if (!db
+        .query("SELECT count(*) count FROM symbols WHERE filePath LIKE '%.cls'")
+        .get()?.count)
+        return { candidates, protected: new Set(), analysis };
+    const definitions = db
+        .query("SELECT id,identity,name,kind,filePath,startLine,endLine,startCol,endCol,apexDeclaration FROM symbols LIMIT 50001")
+        .all();
+    const refs = db
+        .query('SELECT callerSymbol,callerFile,callerIdentity,calleeSymbol,calleeFile,calleeIdentity,line,column,kind,apexCall FROM "references" LIMIT 500001')
+        .all();
+    if (definitions.length > 50000 || refs.length > 500000) {
+        analysis.partial = true;
+        analysis.limitations.push("Root analysis inventory exceeds its bounded node/edge limit; no chain candidates were established.");
+        return { candidates, protected: new Set(), analysis };
+    }
+    const byIdentity = new Map(definitions.filter((d) => d.identity).map((d) => [d.identity, d]));
+    const apex = definitions.filter((d) => /\.cls$/i.test(d.filePath) && ["class", "method"].includes(d.kind));
+    const parsed = new Map(apex.map((d) => [d.id, parseApexDeclaration(d.apexDeclaration)]));
+    const testFiles = new Set(apex
+        .filter((d) => parsed
+        .get(d.id)
+        ?.annotations.some((name) => name.replace(/^@/, "").toLowerCase() === "istest"))
+        .map((d) => d.filePath));
+    const testFile = (file) => isTest(file) || testFiles.has(file);
+    const invalidFiles = new Set(apex.filter((d) => !parsed.get(d.id) || !d.identity).map((d) => d.filePath));
+    const seenIdentities = new Map();
+    for (const d of definitions) {
+        if (!d.identity)
+            continue;
+        const previous = seenIdentities.get(d.identity);
+        if (previous !== undefined) {
+            invalidFiles.add(previous);
+            invalidFiles.add(d.filePath);
+        }
+        else
+            seenIdentities.set(d.identity, d.filePath);
+    }
+    const tables = new Set(db
+        .query("SELECT name FROM sqlite_master WHERE type='table'")
+        .all()
+        .map((row) => row.name));
+    const capabilities = tables.has("apex_file_capabilities")
+        ? new Map(db
+            .query("SELECT filePath,version FROM apex_file_capabilities")
+            .all()
+            .map((row) => [row.filePath, row.version]))
+        : new Map();
+    for (const d of apex)
+        if (capabilities.get(d.filePath) !== 1)
+            invalidFiles.add(d.filePath);
+    if (tables.has("apex_consumer_files"))
+        for (const row of db
+            .query("SELECT filePath FROM apex_consumer_files WHERE parseState<>'complete'")
+            .all())
+            invalidFiles.add(row.filePath);
+    const byFile = new Map();
+    const byName = new Map();
+    const classesByOwner = new Map();
+    const group = (map, key, value) => {
+        const list = map.get(key) ?? [];
+        list.push(value);
+        map.set(key, list);
+    };
+    for (const d of definitions) {
+        group(byFile, d.filePath, d);
+        if (d.kind === "method")
+            group(byName, d.name.toLowerCase(), d);
+        const declaration = parsed.get(d.id);
+        if (d.kind === "class" && declaration)
+            group(classesByOwner, declaration.owner.toLowerCase(), d);
+    }
+    const roots = new Set();
+    const exact = new Map();
+    const possible = new Map();
+    const callEdges = [];
+    const ownerByMethod = new Map();
+    const wildcardCallers = new Set();
+    const add = (map, from, to) => {
+        const targets = map.get(from) ?? new Set();
+        targets.add(to);
+        map.set(from, targets);
+    };
+    const entryRows = apex.flatMap((d) => {
+        const declaration = parsed.get(d.id);
+        return declaration && d.identity ? [{ key: d.identity, file: d.filePath, declaration }] : [];
+    });
+    for (const key of apexPlatformEntryPoints(entryRows).keys())
+        roots.add(key);
+    for (const d of definitions) {
+        if (!d.identity)
+            continue;
+        if (testFile(d.filePath) ||
+            /\.trigger$/i.test(d.filePath) ||
+            invalidFiles.has(d.filePath) ||
+            parsed.get(d.id)?.modifiers.some((value) => value.toLowerCase() === "testmethod"))
+            roots.add(d.identity);
+        const declaration = parsed.get(d.id);
+        if (d.kind !== "method" || !declaration)
+            continue;
+        const owners = (classesByOwner.get(declaration.owner.toLowerCase()) ?? []).filter((owner) => owner.kind === "class" &&
+            parsed.get(owner.id)?.owner.toLowerCase() === declaration.owner.toLowerCase());
+        if (owners.length !== 1 || !owners[0].identity) {
+            roots.add(d.identity);
+            analysis.partial = true;
+            continue;
+        }
+        ownerByMethod.set(d.identity, owners[0]);
+        // Invoking a method can activate its owner initializer; membership alone does not invoke siblings.
+        add(possible, d.identity, owners[0].identity);
+        if (d.name.toLowerCase() === owners[0].name.toLowerCase() || d.name === "constructor")
+            add(possible, owners[0].identity, d.identity);
+    }
+    const contains = (d, ref) => (d.startLine < ref.line || (d.startLine === ref.line && d.startCol <= ref.column)) &&
+        (d.endLine > ref.line || (d.endLine === ref.line && d.endCol > ref.column));
+    const guard = apexReferenceReadGuard(db);
+    for (const ref of refs) {
+        const knownTarget = ref.calleeIdentity ? byIdentity.get(ref.calleeIdentity) : undefined;
+        if (!/\.(cls|trigger)$/i.test(ref.callerFile)) {
+            // A known foreign-source/metadata binding is a conservative boundary, not a proven runtime call.
+            if (knownTarget?.identity)
+                roots.add(knownTarget.identity);
+            else if (ref.calleeFile && /\.cls$/i.test(ref.calleeFile)) {
+                for (const d of byFile.get(ref.calleeFile) ?? [])
+                    if (d.identity)
+                        roots.add(d.identity);
+                analysis.partial = true;
+            }
+            else {
+                const name = ref.calleeSymbol.split(".").at(-1)?.toLowerCase() ?? "";
+                const potential = [
+                    ...(byName.get(name) ?? []),
+                    ...(classesByOwner.get(ref.calleeSymbol.toLowerCase()) ?? []),
+                ];
+                for (const d of potential)
+                    if (d.identity)
+                        roots.add(d.identity);
+                if (potential.length)
+                    analysis.partial = true;
+            }
+            continue;
+        }
+        if (ref.kind !== "call")
+            continue;
+        const fileDefinitions = byFile.get(ref.callerFile) ?? [];
+        const methods = fileDefinitions.filter((d) => d.kind === "method" && contains(d, ref));
+        let callers = methods;
+        if (!callers.length) {
+            const owners = fileDefinitions.filter((d) => ["class", "trigger"].includes(d.kind) && contains(d, ref));
+            const innermost = owners.filter((owner) => !owners.some((other) => other.id !== owner.id &&
+                other.startLine >= owner.startLine &&
+                other.endLine <= owner.endLine &&
+                (other.startLine > owner.startLine || other.endLine < owner.endLine)));
+            callers = innermost;
+        }
+        const exactCaller = callers.length === 1 &&
+            callers[0].identity === ref.callerIdentity &&
+            callers[0].name === ref.callerSymbol;
+        const call = parseApexCall(ref.apexCall);
+        let targets = [];
+        let exactTarget = false;
+        if (ref.apexCall && call) {
+            const ownerCandidates = classesByOwner.get(call.receiver.toLowerCase()) ?? [];
+            const localMembers = call.kind === "constructor"
+                ? ownerCandidates
+                : (byName.get(call.member.toLowerCase()) ?? []).filter((d) => parsed.get(d.id)?.arity === call.arity);
+            targets = call.blocked
+                ? localMembers
+                : localMembers.filter((d) => parsed.get(d.id)?.owner.toLowerCase() === call.receiver.toLowerCase());
+            if (!targets.length && call.kind !== "constructor")
+                targets = localMembers;
+            exactTarget =
+                ownerCandidates.length === 1 &&
+                    targets.length === 1 &&
+                    targets[0].identity === ref.calleeIdentity &&
+                    guard(ref);
+        }
+        else if (!ref.apexCall) {
+            const local = (byName.get(ref.calleeSymbol.toLowerCase()) ?? []).filter((d) => d.filePath === ref.callerFile);
+            const callerOwners = new Set(callers.map((d) => parsed.get(d.id)?.owner.toLowerCase()).filter(Boolean));
+            targets = local.filter((d) => callerOwners.has(parsed.get(d.id)?.owner.toLowerCase()));
+            if (!targets.length)
+                targets = byName.get(ref.calleeSymbol.toLowerCase()) ?? [];
+            exactTarget =
+                targets.length === 1 &&
+                    targets[0].identity === ref.calleeIdentity &&
+                    targets[0].filePath === ref.calleeFile;
+        }
+        else {
+            targets = byName.get(ref.calleeSymbol.toLowerCase()) ?? [];
+        }
+        if (!exactCaller || !exactTarget)
+            analysis.unknownCalls++;
+        // Reflection or corrupt provenance can address targets not enumerable by a literal member name.
+        const reflectiveTypeLookup = call?.kind === "static" &&
+            /^(?:System\.)?Type$/i.test(call.receiver) &&
+            /^forName$/i.test(call.member) &&
+            !exactTarget;
+        // An unresolved value's newInstance may be Type.newInstance; ordinary static
+        // Date/Datetime factories and resolved local service invoke methods are not reflection.
+        const unknownTypeInstance = call?.kind === "static" && call.blocked && /^newInstance$/i.test(call.member) && !exactTarget;
+        const wildcard = (!!ref.apexCall && !call) || reflectiveTypeLookup || unknownTypeInstance;
+        if (wildcard) {
+            if (!callers.length)
+                for (const d of apex)
+                    if (d.identity)
+                        roots.add(d.identity);
+            for (const caller of callers)
+                if (caller.identity)
+                    wildcardCallers.add(caller.identity);
+        }
+        for (const target of targets) {
+            if (!target.identity)
+                continue;
+            if (!callers.length) {
+                roots.add(target.identity);
+                analysis.partial = true;
+            }
+            for (const caller of callers) {
+                if (!caller.identity) {
+                    roots.add(target.identity);
+                    analysis.partial = true;
+                    continue;
+                }
+                const proven = exactCaller && exactTarget;
+                add(proven ? exact : possible, caller.identity, target.identity);
+                if (proven && caller.kind === "method" && target.kind === "method")
+                    callEdges.push({
+                        fromIdentity: caller.identity,
+                        toIdentity: target.identity,
+                        file: ref.callerFile,
+                        line: ref.line,
+                        column: ref.column + 1,
+                    });
+            }
+        }
+    }
+    // Metadata with only a file-level target is uncertain: protect the entire addressed Apex file.
+    for (const dep of db
+        .query("SELECT fromFile,toFile FROM dependencies")
+        .all()) {
+        if (/\.(cls|trigger)$/i.test(dep.fromFile) || !/\.cls$/i.test(dep.toFile))
+            continue;
+        for (const d of byFile.get(dep.toFile) ?? [])
+            if (d.identity)
+                roots.add(d.identity);
+    }
+    const reached = new Set(roots);
+    const queue = [...roots];
+    let wildcardExpanded = false;
+    // The array iterator sees elements pushed while iterating, so this walks the
+    // whole reachable set as a queue.
+    for (const current of queue) {
+        if (wildcardCallers.has(current)) {
+            if (!wildcardExpanded)
+                for (const d of apex)
+                    if (d.identity && !reached.has(d.identity)) {
+                        reached.add(d.identity);
+                        queue.push(d.identity);
+                    }
+            analysis.partial = true;
+            wildcardExpanded = true;
+        }
+        for (const next of [...(exact.get(current) ?? []), ...(possible.get(current) ?? [])])
+            if (!reached.has(next)) {
+                reached.add(next);
+                queue.push(next);
+            }
+    }
+    const adjacency = new Map();
+    for (const edge of callEdges) {
+        if (reached.has(edge.fromIdentity) || reached.has(edge.toIdentity))
+            continue;
+        add(adjacency, edge.fromIdentity, edge.toIdentity);
+        add(adjacency, edge.toIdentity, edge.fromIdentity);
+    }
+    const visited = new Set();
+    const edgesByCaller = new Map();
+    for (const edge of callEdges) {
+        const list = edgesByCaller.get(edge.fromIdentity) ?? [];
+        list.push(edge);
+        edgesByCaller.set(edge.fromIdentity, list);
+    }
+    const member = (d) => ({
+        identity: d.identity,
+        symbol: d.name,
+        file: d.filePath,
+        line: d.startLine,
+        kind: d.kind,
+    });
+    for (const start of [...adjacency.keys()].sort(compareBytes)) {
+        if (visited.has(start))
+            continue;
+        const component = [start];
+        visited.add(start);
+        for (const member of component)
+            for (const next of adjacency.get(member) ?? [])
+                if (!visited.has(next)) {
+                    visited.add(next);
+                    component.push(next);
+                }
+        const members = component
+            .map((id) => byIdentity.get(id))
+            .filter((d) => !!d && d.kind === "method" && !invalidFiles.has(d.filePath) && !testFile(d.filePath));
+        if (!members.length || members.length !== component.length)
+            continue;
+        const ids = new Set(component);
+        const identity = `chain_${createHash("sha256")
+            .update([...ids].sort(compareBytes).join("\0"))
+            .digest("hex")
+            .slice(0, 24)}`;
+        const owners = new Map(members.flatMap((d) => {
+            const owner = ownerByMethod.get(d.identity);
+            return owner?.identity ? [[owner.identity, owner]] : [];
+        }));
+        analysis.chains.push({
+            identity,
+            members: members.map(member).sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line),
+            owners: [...owners.values()].map(member),
+            edges: component
+                .flatMap((id) => edgesByCaller.get(id) ?? [])
+                .filter((edge) => ids.has(edge.toIdentity)),
+        });
+        for (const d of members)
+            candidates.set(d.identity, identity);
+    }
+    analysis.roots = roots.size;
+    analysis.exactEdges = [...exact.values()].reduce((sum, targets) => sum + targets.size, 0);
+    analysis.possibleEdges = [...possible.values()].reduce((sum, targets) => sum + targets.size, 0);
+    analysis.partial ||= invalidFiles.size > 0 || analysis.unknownCalls > 0;
+    return { candidates, protected: reached, analysis };
+}