optave-codegraph 3.13.0

package/src/domain/graph/resolver/points-to.ts

@@ -0,0 +1,377 @@
+/**
+ * Phase 8.3 — Lightweight field-based points-to analysis for JS/TS.
+ *
+ * Resolves higher-order function calls where a named variable is an alias for
+ * a function that the syntactic extractor cannot connect directly. Common
+ * patterns resolved:
+ *
+ *   const fn = handler;        arr.map(fn)        → edge to handler
+ *   const fn = obj.method;     router.use(fn)     → edge to obj.method
+ *   const m = authMiddleware;  app.use(m)         → edge to authMiddleware
+ *
+ * Algorithm: Andersen-style inclusion-based analysis with allocation-site
+ * abstraction and fixed-point constraint propagation.
+ *
+ * Field-based (not field-sensitive): all instances of obj.field are treated as
+ * a single abstract location, matching ACG's sweet spot of 99% precision.
+ *
+ * Scope: intra-module + cross-module via importedNames (the importedNames map
+ * that build-edges.ts already builds per file is the cross-module link — if
+ * a variable aliases an imported name, resolveCallTargets follows it).
+ */
+import type {
+  ArrayCallbackBinding,
+  ArrayElemBinding,
+  FnRefBinding,
+  ForOfBinding,
+  ObjectPropBinding,
+  ObjectRestParamBinding,
+  ParamBinding,
+  SpreadArgBinding,
+} from '../../../types.js';
+
+export type PointsToMap = Map<string, Set<string>>;
+
+/**
+ * Maximum fixed-point iterations before bailing out (prevents divergence).
+ * Mirrors `DEFAULTS.analysis.pointsToMaxIterations` in config.ts.
+ * TODO(Phase 8.3): thread config through buildPointsToMap so this can be tuned
+ * per-repo via `.codegraphrc.json` (tracked alongside typePropagationDepth).
+ */
+const MAX_SOLVER_ITERATIONS = 50;
+
+/**
+ * Seed the pts map from locally-defined functions, imported names, and
+ * fnRefBindings (direct assignment aliases: `const fn = handler`).
+ *
+ * Returns the seeded pts map and the base constraint list built from
+ * fnRefBindings (member-expression aliases: `const fn = obj.method`).
+ */
+function buildThisAssignmentMap(
+  fnRefBindings: readonly FnRefBinding[],
+  definitionNames: ReadonlySet<string>,
+  importedNames: ReadonlyMap<string, string>,
+): { pts: PointsToMap; constraints: Array<{ lhs: string; rhsKey: string }> } {
+  const pts: PointsToMap = new Map();
+
+  // Seed: each locally-defined function points to itself.
+  for (const name of definitionNames) {
+    pts.set(name, new Set([name]));
+  }
+
+  // Seed: each imported name points to itself (importedNames resolves it to
+  // the source file when resolveCallTargets is called with that name).
+  for (const name of importedNames.keys()) {
+    if (!pts.has(name)) pts.set(name, new Set([name]));
+  }
+
+  // Build constraint list: pts(lhs) ⊇ pts(rhsKey).
+  // For member expressions (const fn = obj.method), key is "obj.method".
+  // These composite keys won't be in pts unless a prior statement seeded them
+  // (e.g. handlers.auth = authMiddleware); they produce no flow otherwise,
+  // which is safe — no false edges.
+  const constraints: Array<{ lhs: string; rhsKey: string }> = fnRefBindings.map((b) => ({
+    lhs: b.lhs,
+    rhsKey: b.rhsReceiver ? `${b.rhsReceiver}.${b.rhs}` : b.rhs,
+  }));
+
+  return { pts, constraints };
+}
+
+/**
+ * Append parameter-flow and array/spread/forOf/callback constraints (Phases 8.3c and 8.3e).
+ *
+ * Mutates `pts` (seeds array-element entries) and appends to `constraints`.
+ */
+function buildParamAndArrayConstraints(
+  pts: PointsToMap,
+  constraints: Array<{ lhs: string; rhsKey: string }>,
+  paramBindings?: readonly ParamBinding[],
+  definitionParams?: ReadonlyMap<string, readonly string[]>,
+  arrayElemBindings?: readonly ArrayElemBinding[],
+  spreadArgBindings?: readonly SpreadArgBinding[],
+  forOfBindings?: readonly ForOfBinding[],
+  arrayCallbackBindings?: readonly ArrayCallbackBinding[],
+): void {
+  // Phase 8.3c: parameter-flow constraints.
+  // For each call f(x) at argIndex i where f is locally defined, add
+  // constraint: pts(f::paramName_i) ⊇ pts(x). This makes the pts solver
+  // inter-procedural within the module so that `fn()` inside `f` resolves
+  // to the concrete function passed at each call site.
+  //
+  // Keys are scoped as "callee::paramName" to prevent name collisions: bare
+  // parameter names like `fn`, `cb`, and `callback` appear in many functions
+  // within the same file. Without scoping, pts(fn) from runA and runB would
+  // merge into a single set, producing spurious call edges. The scoped key is
+  // resolved in buildFileCallEdges by combining the enclosing caller's name
+  // with the call's name (see callerName::call.name lookup there).
+  //
+  // Scope: intra-module only (definitionParams contains local defs only).
+  if (paramBindings && definitionParams) {
+    for (const { callee, argIndex, argName } of paramBindings) {
+      const params = definitionParams.get(callee);
+      if (!params || argIndex >= params.length) continue;
+      const paramName = params[argIndex];
+      if (paramName) constraints.push({ lhs: `${callee}::${paramName}`, rhsKey: argName });
+    }
+  }
+
+  // Phase 8.3e: array-element bindings — seed concrete elements and wildcard.
+  // `arr[0]` etc. are seeded from literal arrays; `arr[*]` collects all elements.
+  if (arrayElemBindings && arrayElemBindings.length > 0) {
+    for (const { arrayName, index, elemName } of arrayElemBindings) {
+      const elemKey = `${arrayName}[${index}]`;
+      const wildcardKey = `${arrayName}[*]`;
+      // Seed the per-index entry if the elemName is a concrete function.
+      if (!pts.has(elemKey)) pts.set(elemKey, new Set());
+      pts.get(elemKey)!.add(elemName);
+      // Wildcard: array[*] collects all element targets for imprecise spread/for-of.
+      constraints.push({ lhs: wildcardKey, rhsKey: elemKey });
+    }
+  }
+
+  // Phase 8.3e: spread-argument constraints.
+  // f(...arr) → pts[f::param_i] ⊇ pts[arr[i]] for each known element.
+  if (spreadArgBindings && spreadArgBindings.length > 0 && definitionParams) {
+    // Build a per-array index count from arrayElemBindings for precise per-index constraints.
+    const arrayMaxIndex = new Map<string, number>();
+    for (const { arrayName, index } of arrayElemBindings ?? []) {
+      const cur = arrayMaxIndex.get(arrayName) ?? -1;
+      if (index > cur) arrayMaxIndex.set(arrayName, index);
+    }
+
+    for (const { callee, arrayName, startIndex } of spreadArgBindings) {
+      const params = definitionParams.get(callee);
+      if (!params) continue;
+      const maxIdx = arrayMaxIndex.get(arrayName) ?? -1;
+      if (maxIdx >= 0) {
+        // Precise: per-element constraints.
+        for (let i = 0; i <= maxIdx; i++) {
+          const paramIdx = startIndex + i;
+          if (paramIdx >= params.length) break;
+          constraints.push({ lhs: `${callee}::${params[paramIdx]}`, rhsKey: `${arrayName}[${i}]` });
+        }
+      } else {
+        // Unknown array size: all params at/after startIndex get the wildcard.
+        for (let j = startIndex; j < params.length; j++) {
+          constraints.push({ lhs: `${callee}::${params[j]}`, rhsKey: `${arrayName}[*]` });
+        }
+      }
+    }
+  }
+
+  // Phase 8.3e: for-of iteration constraints.
+  // `for (const x of arr)` inside `outer` → pts[outer::x] ⊇ pts[arr[*]]
+  if (forOfBindings) {
+    for (const { varName, sourceName, enclosingFunc } of forOfBindings) {
+      constraints.push({ lhs: `${enclosingFunc}::${varName}`, rhsKey: `${sourceName}[*]` });
+    }
+  }
+
+  // Phase 8.3e: Array.from / callback constraints.
+  // Array.from(source, cb) → pts[cb::param0] ⊇ pts[source[*]]
+  if (arrayCallbackBindings && definitionParams) {
+    for (const { sourceName, calleeName } of arrayCallbackBindings) {
+      const params = definitionParams.get(calleeName);
+      if (!params || params.length === 0) continue;
+      constraints.push({ lhs: `${calleeName}::${params[0]}`, rhsKey: `${sourceName}[*]` });
+    }
+  }
+}
+
+/**
+ * Seed pts entries for object-rest parameter dispatch (Phase 8.3f).
+ *
+ * `function f({ ...rest }) {}` + `f(obj)` + `const obj = { prop: fn }` →
+ * seeds pts["rest.prop"] = {"fn"} so that `rest.prop()` resolves to `fn`.
+ *
+ * Mutates `pts` in place.
+ */
+function buildObjectRestConstraints(
+  pts: PointsToMap,
+  definitionNames: ReadonlySet<string>,
+  importedNames: ReadonlyMap<string, string>,
+  paramBindings: readonly ParamBinding[],
+  objectRestParamBindings: readonly ObjectRestParamBinding[],
+  objectPropBindings: readonly ObjectPropBinding[],
+): void {
+  // Index paramBindings: "callee::argIndex" → argName[] (O(|paramBindings|) build,
+  // O(1) lookup — avoids scanning paramBindings for each rest binding).
+  const paramByCalleeIdx = new Map<string, string[]>();
+  for (const { callee, argIndex, argName } of paramBindings) {
+    const k = `${callee}::${argIndex}`;
+    const list = paramByCalleeIdx.get(k);
+    if (list) list.push(argName);
+    else paramByCalleeIdx.set(k, [argName]);
+  }
+
+  // Index objectPropBindings: objectName → {propName, valueName}[]
+  const propsByObject = new Map<string, Array<{ propName: string; valueName: string }>>();
+  for (const { objectName, propName, valueName } of objectPropBindings) {
+    const list = propsByObject.get(objectName);
+    if (list) list.push({ propName, valueName });
+    else propsByObject.set(objectName, [{ propName, valueName }]);
+  }
+
+  for (const { callee, restName, argIndex } of objectRestParamBindings) {
+    const argNames = paramByCalleeIdx.get(`${callee}::${argIndex}`) ?? [];
+    for (const argName of argNames) {
+      const props = propsByObject.get(argName) ?? [];
+      for (const { propName, valueName } of props) {
+        if (!definitionNames.has(valueName) && !importedNames.has(valueName)) continue;
+        const key = `${restName}.${propName}`;
+        if (!pts.has(key)) pts.set(key, new Set());
+        pts.get(key)!.add(valueName);
+      }
+    }
+  }
+}
+
+/**
+ * Append higher-order constraints to the constraint list based on how
+ * function values flow through call sites, arrays, for-of loops, callbacks,
+ * and object rest-param destructuring.
+ *
+ * Coordinates buildParamAndArrayConstraints (Phase 8.3c/e) and
+ * buildObjectRestConstraints (Phase 8.3f).
+ *
+ * Mutates `pts` (seeds array-element and object-rest entries) and appends to `constraints`.
+ */
+function appendAdvancedConstraints(
+  pts: PointsToMap,
+  constraints: Array<{ lhs: string; rhsKey: string }>,
+  definitionNames: ReadonlySet<string>,
+  importedNames: ReadonlyMap<string, string>,
+  paramBindings?: readonly ParamBinding[],
+  definitionParams?: ReadonlyMap<string, readonly string[]>,
+  arrayElemBindings?: readonly ArrayElemBinding[],
+  spreadArgBindings?: readonly SpreadArgBinding[],
+  forOfBindings?: readonly ForOfBinding[],
+  arrayCallbackBindings?: readonly ArrayCallbackBinding[],
+  objectRestParamBindings?: readonly ObjectRestParamBinding[],
+  objectPropBindings?: readonly ObjectPropBinding[],
+): void {
+  buildParamAndArrayConstraints(
+    pts,
+    constraints,
+    paramBindings,
+    definitionParams,
+    arrayElemBindings,
+    spreadArgBindings,
+    forOfBindings,
+    arrayCallbackBindings,
+  );
+
+  if (objectRestParamBindings && objectPropBindings && paramBindings) {
+    buildObjectRestConstraints(
+      pts,
+      definitionNames,
+      importedNames,
+      paramBindings,
+      objectRestParamBindings,
+      objectPropBindings,
+    );
+  }
+}
+
+/**
+ * Run the fixed-point solver: propagate pts sets through constraints until
+ * no new information flows (or MAX_SOLVER_ITERATIONS is reached).
+ *
+ * Mutates `pts` in place.
+ */
+function buildCallSiteTypeMap(
+  pts: PointsToMap,
+  constraints: ReadonlyArray<{ lhs: string; rhsKey: string }>,
+): void {
+  for (let iter = 0; iter < MAX_SOLVER_ITERATIONS; iter++) {
+    let changed = false;
+    for (const { lhs, rhsKey } of constraints) {
+      const rhsPts = pts.get(rhsKey);
+      if (!rhsPts || rhsPts.size === 0) continue;
+      let lhsPts = pts.get(lhs);
+      if (!lhsPts) {
+        lhsPts = new Set();
+        pts.set(lhs, lhsPts);
+      }
+      const before = lhsPts.size;
+      for (const target of rhsPts) lhsPts.add(target);
+      if (lhsPts.size !== before) changed = true;
+    }
+    if (!changed) break;
+  }
+}
+
+/**
+ * Build a points-to map for one file.
+ *
+ * Seeds concrete function names (locally-defined functions + imported names),
+ * then propagates assignments through fixed-point iteration until stable.
+ *
+ * Each "concrete target" in a pts set is a name that `resolveCallTargets` can
+ * look up — either a locally-defined function name (found via byNameAndFile) or
+ * an imported name (found via importedNames → byNameAndFile in the source file).
+ *
+ * @param fnRefBindings         - identifier/member-expr bindings from the extractor
+ * @param definitionNames       - locally-defined callable names in this file
+ * @param importedNames         - names imported into this file (name → resolved file)
+ * @param paramBindings         - call-site arg→param bindings (Phase 8.3c)
+ * @param definitionParams      - per-function ordered parameter names (Phase 8.3c)
+ * @param arrayElemBindings     - array literal element bindings (Phase 8.3e)
+ * @param spreadArgBindings     - spread-argument bindings (Phase 8.3e)
+ * @param forOfBindings         - for-of iteration variable bindings (Phase 8.3e)
+ * @param arrayCallbackBindings - Array.from/callback bindings (Phase 8.3e)
+ */
+export function buildPointsToMap(
+  fnRefBindings: readonly FnRefBinding[],
+  definitionNames: ReadonlySet<string>,
+  importedNames: ReadonlyMap<string, string>,
+  paramBindings?: readonly ParamBinding[],
+  definitionParams?: ReadonlyMap<string, readonly string[]>,
+  arrayElemBindings?: readonly ArrayElemBinding[],
+  spreadArgBindings?: readonly SpreadArgBinding[],
+  forOfBindings?: readonly ForOfBinding[],
+  arrayCallbackBindings?: readonly ArrayCallbackBinding[],
+  objectRestParamBindings?: readonly ObjectRestParamBinding[],
+  objectPropBindings?: readonly ObjectPropBinding[],
+): PointsToMap {
+  const { pts, constraints } = buildThisAssignmentMap(
+    fnRefBindings,
+    definitionNames,
+    importedNames,
+  );
+
+  appendAdvancedConstraints(
+    pts,
+    constraints,
+    definitionNames,
+    importedNames,
+    paramBindings,
+    definitionParams,
+    arrayElemBindings,
+    spreadArgBindings,
+    forOfBindings,
+    arrayCallbackBindings,
+    objectRestParamBindings,
+    objectPropBindings,
+  );
+
+  if (constraints.length === 0) return pts;
+
+  buildCallSiteTypeMap(pts, constraints);
+
+  return pts;
+}
+
+/**
+ * Return the concrete function names that `callName` flows to, excluding
+ * itself to prevent circular self-reference edges.
+ *
+ * Returns an empty array when callName is not in the pts map (i.e., it is
+ * not an alias — the caller should fall back to normal resolution failure).
+ */
+export function resolveViaPointsTo(callName: string, pts: PointsToMap): string[] {
+  const targets = pts.get(callName);
+  if (!targets) return [];
+  return [...targets].filter((t) => t !== callName);
+}

package/src/domain/graph/resolver/strategy.ts

@@ -0,0 +1,265 @@
+/**
+ * Call resolution strategy helpers — extracted from call-resolver.ts.
+ *
+ * `resolveByMethodOrGlobal` in call-resolver.ts dispatches to two sub-strategies:
+ *   - resolveByReceiver  — receiver is a concrete object/class (not this/self/super)
+ *   - resolveByGlobal    — bare call or this/self/super receiver
+ *
+ * Splitting them here keeps each strategy unit-testable and reduces call-resolver.ts
+ * cognitive complexity from 107 to a thin dispatcher.
+ *
+ * This file intentionally does NOT import from ../builder/call-resolver.ts to avoid
+ * a circular dependency. The StrategyLookup interface mirrors CallNodeLookup structurally
+ * (TypeScript structural typing ensures compatibility without an explicit import).
+ */
+import { computeConfidence } from '../resolve.js';
+
+// ── Lookup adapter (structural mirror of CallNodeLookup) ──────────────────────
+
+/**
+ * Structural mirror of `CallNodeLookup` from call-resolver.ts.
+ * Any `CallNodeLookup` instance satisfies this type without explicit declaration.
+ * Defined here to break the circular import that would arise from importing
+ * `CallNodeLookup` directly from call-resolver.ts.
+ */
+export interface StrategyLookup {
+  byNameAndFile(
+    name: string,
+    file: string,
+  ): ReadonlyArray<{ id: number; file: string; kind?: string }>;
+  byName(name: string): ReadonlyArray<{ id: number; file: string; kind?: string }>;
+  isBarrel(file: string): boolean;
+  resolveBarrel(barrelFile: string, symbolName: string): string | null;
+  nodeId(name: string, kind: string, file: string, line: number): { id: number } | undefined;
+}
+
+// ── Module-scoped language detection ─────────────────────────────────────────
+
+/**
+ * Languages where bare `foo()` calls inside a class method are lexically scoped
+ * to the module, not the class — there is no implicit this/class binding.
+ * For these languages, the same-class fallback must not run for bare (no-receiver)
+ * calls that found no exact same-file match.
+ */
+const MODULE_SCOPED_BARE_CALL_EXTENSIONS = new Set([
+  '.js',
+  '.mjs',
+  '.cjs',
+  '.jsx',
+  '.ts',
+  '.tsx',
+  '.mts',
+  '.cts',
+]);
+
+export function isModuleScopedLanguage(relPath: string): boolean {
+  const ext = relPath.slice(relPath.lastIndexOf('.'));
+  return MODULE_SCOPED_BARE_CALL_EXTENSIONS.has(ext);
+}
+
+// ── resolveByReceiver ─────────────────────────────────────────────────────────
+
+/**
+ * Resolve a call site whose receiver is a concrete object reference
+ * (i.e. `receiver` is present and is NOT `this`, `self`, or `super`).
+ *
+ * Resolution cascade:
+ *   1. typeMap class-scoped lookup (`ClassName.prop` key) for `this.prop` receivers.
+ *   2. typeMap bare key, full-receiver key, callee-scoped rest-param key.
+ *   3. Inline `new Ctor()` heuristic for un-normalised receiver text.
+ *   4. Typed method lookup via `TypeName.methodName` in symbol DB.
+ *   5. Prototype alias: `Foo.prototype.bar = identifier` via typeMap.
+ *   6. Direct qualified method lookup: `ClassName.staticMethod()`.
+ *   7. Composite pts key: `obj.prop` → callback target function.
+ */
+export function resolveByReceiver(
+  lookup: StrategyLookup,
+  call: { name: string; receiver: string },
+  relPath: string,
+  typeMap: Map<string, unknown>,
+  callerName?: string | null,
+): ReadonlyArray<{ id: number; file: string }> {
+  // Strip "this." so `this.repo.method()` resolves via typeMap["repo"]
+  // (or the "this.repo" key seeded directly by the TSC property-declaration enricher).
+  const effectiveReceiver = call.receiver.startsWith('this.')
+    ? call.receiver.slice('this.'.length)
+    : call.receiver;
+
+  // For this.prop receivers, prefer the class-scoped key (ClassName.prop) seeded by
+  // handlePropWriteTypeMap / handleFieldDefTypeMap — prevents false edges when multiple
+  // classes define the same property name (issues #1323, #1458).
+  // Class-scoped lookup runs first so bare fallback keys (confidence 0.6) don't shadow
+  // the correct per-class entry when callerName is available.
+  let typeEntry: unknown;
+  if (call.receiver.startsWith('this.') && callerName) {
+    const dotIdx = callerName.lastIndexOf('.');
+    if (dotIdx > -1) {
+      const callerClass = callerName.slice(0, dotIdx);
+      typeEntry = typeMap.get(`${callerClass}.${effectiveReceiver}`);
+    }
+  }
+  typeEntry ??=
+    typeMap.get(effectiveReceiver) ??
+    typeMap.get(call.receiver) ??
+    // Phase 8.3f: callee-scoped rest-param key (`callee::restName`) to avoid
+    // same-name rest-binding collision across functions in the same file (#1358).
+    (callerName ? typeMap.get(`${callerName}::${effectiveReceiver}`) : undefined);
+
+  let typeName = typeEntry
+    ? typeof typeEntry === 'string'
+      ? typeEntry
+      : (typeEntry as { type?: string }).type
+    : null;
+
+  // Belt-and-suspenders fallback for inline new-expression receivers that
+  // extractReceiverName did not normalise (e.g. raw text leaked from an
+  // unhandled AST node type).  extractReceiverName already handles the common
+  // `new_expression` / `parenthesized_expression(new_expression)` shapes by
+  // returning the constructor name directly, so this branch is exercised only
+  // by future node types or constructs that fall through to the raw-text path.
+  // The uppercase-initial restriction ([A-Z_$]) is a heuristic to distinguish
+  // constructors (PascalCase) from regular functions and avoids false positives
+  // on `(new xmlParser()).parse()` style calls.
+  if (!typeName && call.receiver) {
+    const m = /^\(?\s*new\s+([A-Z_$][A-Za-z0-9_$]*)/.exec(call.receiver);
+    if (m?.[1]) typeName = m[1];
+  }
+
+  if (typeName) {
+    const typed = lookup
+      .byName(`${typeName}.${call.name}`)
+      .filter((n) => n.kind === 'method' && computeConfidence(relPath, n.file, null) >= 0.5);
+    if (typed.length > 0) return typed;
+
+    // Prototype alias: `Foo.prototype.bar = identifier` seeds typeMap['Foo.bar'] = { type: identifier }.
+    // Checked after the symbol-DB lookup so an actual method definition always wins.
+    const protoEntry = typeMap.get(`${typeName}.${call.name}`);
+    const protoTarget = protoEntry
+      ? typeof protoEntry === 'string'
+        ? protoEntry
+        : (protoEntry as { type?: string }).type
+      : null;
+    if (protoTarget) {
+      const resolved = lookup
+        .byName(protoTarget)
+        .filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+      if (resolved.length > 0) return resolved;
+    }
+  }
+
+  // Direct qualified method lookup: ClassName.staticMethod() or ClassName.instanceMethod()
+  // when the receiver is a class name with no typeMap entry. Handles static method calls
+  // like `C6.staticMethod()` or `D.d()` where the receiver IS the class.
+  // Matches both 'method' and 'function' kinds to cover field-initializer synthetic defs.
+  if (!typeName) {
+    const qualifiedName = `${effectiveReceiver}.${call.name}`;
+    const direct = lookup
+      .byName(qualifiedName)
+      .filter(
+        (n) =>
+          (n.kind === 'method' || n.kind === 'function') &&
+          computeConfidence(relPath, n.file, null) >= 0.5,
+      );
+    if (direct.length > 0) return direct;
+  }
+
+  // Phase 8.3d: composite pts key — `obj.prop = fn` seeds typeMap['obj.prop'] = { type: 'fn' }.
+  // When a call site references `obj.prop` as a callback, resolve directly to the target fn.
+  const compositeEntry = typeMap.get(`${call.receiver}.${call.name}`);
+  const ptsTarget = compositeEntry
+    ? typeof compositeEntry === 'string'
+      ? compositeEntry
+      : (compositeEntry as { type?: string }).type
+    : null;
+  if (ptsTarget) {
+    const resolved = lookup
+      .byName(ptsTarget)
+      .filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+    if (resolved.length > 0) return resolved;
+  }
+
+  return [];
+}
+
+// ── resolveByGlobal ───────────────────────────────────────────────────────────
+
+/**
+ * Resolve a call site with no receiver, or whose receiver is `this`, `self`,
+ * or `super`.
+ *
+ * Resolution cascade:
+ *   1. Accessor this-dispatch via Object.defineProperty (Phase 8.3f).
+ *   2. Exact global name lookup with confidence filter.
+ *   3. Same-class sibling method fallback (C#/Java static siblings, this.method()).
+ */
+export function resolveByGlobal(
+  lookup: StrategyLookup,
+  call: { name: string; receiver?: string | null },
+  relPath: string,
+  typeMap: Map<string, unknown>,
+  callerName?: string | null,
+): ReadonlyArray<{ id: number; file: string }> {
+  // Phase 8.3f: accessor this-dispatch via Object.defineProperty.
+  // When a plain function (no class prefix) is registered as a get/set accessor for `obj`
+  // via Object.defineProperty, typeMap seeds 'callerName:this' = 'obj'.
+  // We then resolve this.method() → typeMap['obj.method'] → the concrete definition.
+  // This runs before the broad exact-name lookup to avoid false positives from
+  // unrelated same-file definitions.
+  if (call.receiver === 'this' && callerName && !callerName.includes('.')) {
+    const accessorThisEntry = typeMap.get(`${callerName}:this`);
+    const objName = accessorThisEntry
+      ? typeof accessorThisEntry === 'string'
+        ? accessorThisEntry
+        : (accessorThisEntry as { type?: string }).type
+      : null;
+    if (objName) {
+      const objMethodEntry = typeMap.get(`${objName}.${call.name}`);
+      const targetFn = objMethodEntry
+        ? typeof objMethodEntry === 'string'
+          ? objMethodEntry
+          : (objMethodEntry as { type?: string }).type
+        : null;
+      if (targetFn) {
+        const resolved = lookup
+          .byName(targetFn)
+          .filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+        if (resolved.length > 0) return resolved;
+      }
+    }
+  }
+
+  const exact = lookup
+    .byName(call.name)
+    .filter((t) => computeConfidence(relPath, t.file, null) >= 0.5);
+  if (exact.length > 0) return exact;
+
+  // Try same-class method lookup via callerName.
+  // e.g. `this.area()` inside `Shape.describe` → try `Shape.area`.
+  // Also covers no-receiver calls inside class methods, e.g. `IsValidEmail(x)` inside
+  // `Validators.ValidateUser` → try `Validators.IsValidEmail` (C#/Java static siblings).
+  // This seeds the initial edge that runChaPostPass later expands to subclass overrides.
+  //
+  // For JS/TS, bare (no-receiver) calls are module-scoped — there is no implicit class
+  // binding. Skip the same-class fallback for bare calls in those languages to prevent
+  // false positives (e.g. `flush()` inside `Processor.run` must not resolve to
+  // `Processor.flush`). this.method() calls are unaffected: they still reach the fallback
+  // because `call.receiver === 'this'` is truthy, not a bare call.
+  const isBareCall = !call.receiver;
+  if (callerName && !(isBareCall && isModuleScopedLanguage(relPath))) {
+    const dotIdx = callerName.lastIndexOf('.');
+    if (dotIdx > -1) {
+      // Extract only the segment immediately before the method name so that
+      // 'Namespace.ClassName.method' yields 'ClassName', not 'Namespace.ClassName'.
+      // Symbols are stored under their bare class name, not their qualified path.
+      const prevDot = callerName.lastIndexOf('.', dotIdx - 1);
+      const callerClass = callerName.slice(prevDot + 1, dotIdx);
+      const qualifiedName = `${callerClass}.${call.name}`;
+      const sameClass = lookup
+        .byName(qualifiedName)
+        .filter((t) => t.kind === 'method' && computeConfidence(relPath, t.file, null) >= 0.5);
+      if (sameClass.length > 0) return sameClass;
+    }
+  }
+
+  return exact; // empty
+}