@cplieger/deadset-ts 3.12.0 → 3.13.0

package/src/kinds.ts

@@ -8,6 +8,12 @@ export interface KindRow {
   readonly code: string;
   /** The kind's name, which a finding carries as its `kind`. */
   readonly name: string;
+  /** The languages whose analyzers report the kind. */
+  readonly languages: readonly ("go" | "ts")[];
+  /** The kind's rule, whole, which a SARIF rule describes the kind with. */
+  readonly rule: string;
+  /** The condition the kind reports under, where it declares one. */
+  readonly precondition?: string;
   /** The severity a finding carries where no severity key names its code or its family. */
   readonly defaultSeverity: Severity;
   /** The highest confidence a finding of the kind carries. */
@@ -18,6 +24,8 @@ export interface KindRow {
    * naming the code, or a family prefix whose range holds it, is an unimplemented key.
    */
   readonly fixed: boolean;
+  /** The external rules that report the same kind in TypeScript, where the row names them. */
+  readonly overlap?: readonly string[];
 }
 
 /**
@@ -27,49 +35,355 @@ export interface KindRow {
  * Contract release the analyzer is written against.
  */
 const ROWS: readonly KindRow[] = [
-  row("DS1001", "unused-exported", "deny", "deletable"),
-  row("DS1002", "unused-unexported", "deny", "deletable"),
-  row("DS1003", "unused-member", "deny", "deletable"),
-  row("DS1004", "test-only-use", "deny", "deletable"),
-  row("DS1005", "test-of-dead-code", "deny", "deletable"),
-  row("DS1006", "deprecated-unused", "deny", "deletable"),
-  row("DS1101", "unnecessary-export", "warn", "narrowable"),
-  row("DS1102", "unnecessary-exposure", "warn", "narrowable"),
-  row("DS1103", "unreachable-export", "deny", "deletable"),
-  row("DS1104", "redundant-export-keyword", "warn", "narrowable"),
-  row("DS1201", "unused-interface", "deny", "deletable"),
-  row("DS1203", "uncalled-interface-method", "warn", "manual"),
-  row("DS1204", "unused-satisfaction-assertion", "deny", "deletable"),
-  row("DS1301", "write-only-symbol", "deny", "deletable"),
-  row("DS1302", "unused-enum-member", "deny", "deletable"),
-  row("DS1303", "unused-type-parameter", "deny", "deletable"),
-  row("DS1501", "file-never-built", "deny", "deletable"),
-  row("DS1502", "file-never-imported", "deny", "deletable"),
-  row("DS1601", "unused-dependency", "deny", "manual"),
-  row("DS1605", "unused-module-directive", "warn", "deletable"),
-  row("DS1701", "suppression-without-reason", "deny", "none"),
-  row("DS1702", "unscoped-ignore-entry", "deny", "none"),
-  { ...row("DS1703", "stale-suppression", "deny", "none"), fixed: true },
-  { ...row("DS1704", "unmatched-root", "deny", "none"), fixed: true },
-  row("DS1705", "stale-cross-language-edge", "deny", "none"),
-  row("DS1801", "unused-parameter", "warn", "manual"),
-  row("DS1802", "unused-receiver", "warn", "deletable"),
-  row("DS1803", "unused-result", "warn", "manual"),
-  row("DS1805", "unreachable-statement", "deny", "deletable"),
-  row("DS1807", "dead-store", "deny", "deletable"),
-  row("DS1809", "unreachable-case", "deny", "deletable"),
+  {
+    code: "DS1001",
+    name: "unused-exported",
+    languages: ["go", "ts"],
+    rule: "An exported symbol with no reference in the target and no reference from any loaded consumer. A symbol referenced only from its own declaration site counts as unreferenced.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1002",
+    name: "unused-unexported",
+    languages: ["go", "ts"],
+    rule: "An unexported symbol with no reference in the target. A symbol referenced only from its own declaration site counts as unreferenced.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1003",
+    name: "unused-member",
+    languages: ["go", "ts"],
+    rule: "A struct field, class member or type member with no reference, a private member included. A member referenced only from its own declaration site counts as unreferenced.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1004",
+    name: "test-only-use",
+    languages: ["go", "ts"],
+    rule: "A symbol with zero production references and at least one test reference: an unused-exported, unused-unexported or unused-member candidate whose test reference count is not zero, reported once under this code. A reference from a consumer's test files is a test reference unless the configuration counts consumer tests as production.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1005",
+    name: "test-of-dead-code",
+    languages: ["go", "ts"],
+    rule: "A test symbol whose set of referenced target symbols is non-empty and every member of that set is reported dead. A test that references at least one live target symbol is never reported, no notion of a test's subject and no name matching enters the rule, and the message states the rule. The test joins the dead component of the symbols it references, and it and each of them count as referencing each other, so the test is a member of their cycle and never a dead symbol outside it.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1006",
+    name: "deprecated-unused",
+    languages: ["go", "ts"],
+    rule: "A symbol carrying a deprecation marker and no production reference: an unused-exported, unused-unexported or unused-member candidate whose symbol is deprecated, reported once under this code. Go identifies the marker by the convention the standard tools recognize, TypeScript by the documentation tag its tools recognize.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1101",
+    name: "unnecessary-export",
+    languages: ["go", "ts"],
+    rule: "An exported symbol whose every reference is inside the symbol's own package or module, reported as a candidate for unexporting. The subject is a package-level declaration or a method, and three subjects are excluded: an interface method, whose exportedness is the contract of the interface that declares it; a struct field, which an encoder reads by name; and a method that satisfies an interface some symbol uses as a type, which cannot be unexported without its type ceasing to satisfy that interface. The finding names the narrower visibility the references support. A declared cross-language edge counts as an out-of-package reference; where the edge's other side is unknown to the analyzer the finding is emitted pending.",
+    precondition:
+      "Closed world only. Reported always for a main package and an internal/ directory tree, and for a published package only when the configuration declares the consumer set complete and every declared consumer loads. A library with no consumer loaded and no complete consumer set declared gets this finding on its internal/ tree and its main packages and never on its published API. A symbol the rule of DS1301 holds for is not reported under this code, whatever severity the configuration gives DS1301, because the write-only finding names the defect to fix first.",
+    defaultSeverity: "warn",
+    maxClass: "certain",
+    fixability: "narrowable",
+    fixed: false,
+  },
+  {
+    code: "DS1102",
+    name: "unnecessary-exposure",
+    languages: ["go"],
+    rule: "An exported symbol of a non-internal package whose every reference is inside the target module, reported as a candidate for relocation behind an internal boundary. The subject is a package-level declaration or a method, and three subjects are excluded: an interface method, whose exportedness is the contract of the interface that declares it; a struct field, which an encoder reads by name; and a method that satisfies an interface some symbol uses as a type, which cannot be unexported without its type ceasing to satisfy that interface. The finding names the narrower visibility the references support. A declared cross-language edge counts as an out-of-package reference; where the edge's other side is unknown to the analyzer the finding is emitted pending.",
+    precondition:
+      "Closed world only. Reported always for a main package and an internal/ directory tree, and for a published package only when the configuration declares the consumer set complete and every declared consumer loads. A library with no consumer loaded and no complete consumer set declared gets this finding on its internal/ tree and its main packages and never on its published API. A symbol the rule of DS1301 holds for is not reported under this code, whatever severity the configuration gives DS1301, because the write-only finding names the defect to fix first.",
+    defaultSeverity: "warn",
+    maxClass: "certain",
+    fixability: "narrowable",
+    fixed: false,
+  },
+  {
+    code: "DS1103",
+    name: "unreachable-export",
+    languages: ["go", "ts"],
+    rule: "An unused exported symbol in a package or file no external code can import: an unused-exported candidate whose enclosing package or file is unimportable from outside, reported once under this code at the certain class, because unimportability is a property of the package graph rather than of the consumer set.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1104",
+    name: "redundant-export-keyword",
+    languages: ["ts"],
+    rule: "An exported declaration used only inside its own file, reported as a candidate for removing the export keyword. The finding names the narrower visibility the references support.",
+    precondition:
+      "Closed world only. Reported in a file that is not an entry file and that either belongs to a project whose consumer set the configuration declares complete or is reached by no manifest export. A declared cross-language edge counts as a reference from outside the file; where the edge's other side is unknown to the analyzer the finding is emitted pending. A symbol the rule of DS1301 holds for is not reported under this code, whatever severity the configuration gives DS1301, because the write-only finding names the defect to fix first.",
+    defaultSeverity: "warn",
+    maxClass: "certain",
+    fixability: "narrowable",
+    fixed: false,
+  },
+  {
+    code: "DS1201",
+    name: "unused-interface",
+    languages: ["go", "ts"],
+    rule: "An interface no symbol uses as a type, counting uses from every loaded module. The finding names the concrete implementations and their positions, and the interface's members join its dead component rather than being reported as independent unused declarations.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1203",
+    name: "uncalled-interface-method",
+    languages: ["go", "ts"],
+    rule: "An interface method that no call site invokes or selects through the interface, whatever the number of implementations. The finding names the concrete implementations and their positions.",
+    precondition:
+      "Exempt: in Go, every method of an interface that declares an unexported method, the sum-type shape whose method set exists to restrict the implementors, a shape a TypeScript interface cannot take because it declares no member less visible than itself; and, in both languages, every marker method, an interface method whose every implementation carries an empty body.",
+    defaultSeverity: "warn",
+    maxClass: "certain",
+    fixability: "manual",
+    fixed: false,
+  },
+  {
+    code: "DS1204",
+    name: "unused-satisfaction-assertion",
+    languages: ["go"],
+    rule: "A compile-time satisfaction assertion whose interface no symbol uses as a type.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1301",
+    name: "write-only-symbol",
+    languages: ["go", "ts"],
+    rule: "A package-level or module-level variable, struct field, class member or collection that production code writes and never reads. In production mode a read from a test file counts as no read. A comparison of struct values reads every field of the type: in Go, a value of a struct type used as an operand of `==` or `!=`, as a map key, or as a `switch` tag or `case` expression is a read of every field of that type, transitively through the fields of every struct type it holds, recorded at the comparison, because equality reads every field and a field that decides equality carries information. In TypeScript a comparison of two object references reads no member, because `===` compares identity and never a member. The finding names each write position, so the deletion set is visible.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1302",
+    name: "unused-enum-member",
+    languages: ["go", "ts"],
+    rule: "An enumerated member that no symbol names, at the reachability class derived for the member and with no confidence ceiling below it. Every member of a type that carries a string, text or binary conversion method, or that a conversion from an integer or a wire value produces, is retained by the enum-group exemption first, so a member reached only by value is never a candidate.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1303",
+    name: "unused-type-parameter",
+    languages: ["go", "ts"],
+    rule: "A type parameter of a function or method that no part of the declaration's signature and no part of the declaration's body names, at the certain class. The deletion is local to the declaration and the explicit instantiations the reference set already lists. A type parameter of a function or method that is itself dead falls with it and is reported under no code of its own.",
+    precondition:
+      "Function and method type parameters only. A type parameter of a type declaration is never reported, because a phantom type parameter such as `type ID[T any] int` makes two instantiations distinct types while naming the parameter nowhere, so deleting it changes the program. A method signature an interface or an object type declares belongs to that type declaration, so its type parameters are never reported either.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1501",
+    name: "file-never-built",
+    languages: ["go", "ts"],
+    rule: "A source file no configuration in the build matrix builds. On the Go side the finding names the build constraint that excluded the file. A file whose build constraint is the ignore tag is never reported: the toolchain applies no build constraint to a file named on its own command line, so that tag is the toolchain's convention for a file built by hand. A file any other custom tag excludes is reported under a matrix the configuration declares complete, because completeness is the maintainer's assertion that the listed configurations are every one the target builds, and a configuration the maintainer builds by hand belongs in that list.",
+    precondition:
+      'Reported only when the configuration declares the build matrix complete, and never for a file the toolchain ignored solely because it imports "C" under a build with cgo disabled; such a file is recorded as excluded by cgo rather than as never built.',
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1502",
+    name: "file-never-imported",
+    languages: ["go", "ts"],
+    rule: "A source file that no import reaches, that no root names, and in which no declared cross-language edge names a declaration. An import written in a loaded consumer reaches a file of the target as an import written in the target does. An edge's side names a declaration as a root names one, so a file holding a declaration an edge names is evaluated with the edge rather than reported: whether that declaration is dead is the edge evaluation's to say, and the merge resolves it against the paired side.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1601",
+    name: "unused-dependency",
+    languages: ["go", "ts"],
+    rule: "A directly declared dependency that no import in the target needs. On the Go side, a direct require whose module provides no package any target package or test variant imports. On the TypeScript side, a manifest dependency, development dependency or peer dependency the project's import closure does not need. A deletion finding whose fix would remove the last use of a dependency names that dependency.",
+    precondition:
+      "On the Go side the rule is the semantics of `go mod tidy -diff` exactly: a requirement marked indirect is never reported, because it exists to pin a transitive version and removing it changes the build list. On the TypeScript side the import closure is the files of the run's projects, and three more dependencies are needed: one whose installed manifest declares a command, because a command is run by name rather than imported; one that the installed manifest of a needed dependency declares as a peer and does not mark optional; and, to a fixpoint, the required peers of every dependency so held. An installed manifest is the package's manifest in the nearest node_modules directory at or above the target, and a dependency with none is decided by the import closure alone.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "manual",
+    fixed: false,
+  },
+  {
+    code: "DS1605",
+    name: "unused-module-directive",
+    languages: ["go"],
+    rule: "A replace directive whose target module is absent from the build list, the one case in which the directive is exactly a no-op.",
+    precondition:
+      "Only a replace whose target is absent from the build list. No other module-file directive is reported: not an exclude directive, because not selected is a counterfactual about a resolution that did not happen; not a workspace use entry and not a tool directive, because each is an external entry point whose invocation lives outside anything the analysis reads.",
+    defaultSeverity: "warn",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+  },
+  {
+    code: "DS1701",
+    name: "suppression-without-reason",
+    languages: ["go", "ts"],
+    rule: "A suppression that carries no reason, in any of the three documents: an inline directive, an ignore-file entry or a baseline row. For the ignore file and the baseline, an entry or a row whose reason field is absent, empty or whitespace only is refused and reported rather than matched.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "none",
+    fixed: false,
+  },
+  {
+    code: "DS1702",
+    name: "unscoped-ignore-entry",
+    languages: ["go", "ts"],
+    rule: "An ignore-file entry or a baseline row that names a symbol and no file path. The entry is reported rather than matched, so a bare name cannot mask a match anywhere else in the project; the inline directive is scoped by its position and cannot be unscoped.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "none",
+    fixed: false,
+  },
+  {
+    code: "DS1703",
+    name: "stale-suppression",
+    languages: ["go", "ts"],
+    rule: "A suppression that matches no current finding, at either mechanism and in the baseline alike. The run exits with the findings code when at least one is reported. The kind is fixed on at deny: no flag, no severity setting and no per-mechanism exception reduces it below a finding, and a configuration naming this code under a severity key is an unimplemented key.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "none",
+    fixed: true,
+  },
+  {
+    code: "DS1704",
+    name: "unmatched-root",
+    languages: ["go", "ts"],
+    rule: "A configured root that matches no symbol, or a configured root pattern that matches no symbol. A root set nobody checks silently changes every result, so a stale one is a finding. The kind is fixed on at deny: no flag, no severity setting and no exception reduces it below a finding, and a configuration naming this code under a severity key is an unimplemented key.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "none",
+    fixed: true,
+  },
+  {
+    code: "DS1705",
+    name: "stale-cross-language-edge",
+    languages: ["go", "ts"],
+    rule: "A declared cross-language edge with a side that at least one analyzer evaluated and every evaluation of that side reports absent, so no analyzer that ran enumerates that side's symbol. Emitted by the merge, once per edge, never by an analyzer, so a stale edge is visible rather than silently inert. A dead side paired with an absent side drops its pending finding, and the edge is the reported defect: a misspelled reference must not turn a live pairing into a deletion.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "none",
+    fixed: false,
+  },
+  {
+    code: "DS1706",
+    name: "unmatched-configured-declaration",
+    languages: ["ts"],
+    rule: "An entry of a configuration key that names a declaration, being an entry of ts.injection_registrations, of the components or the bases of an entry of ts.lifecycle_contracts, or of ts.serializers, that names no declaration in any project of the run, by the resolution the ts section of contract/config.schema.json states for its shape. An entry that names a declaration no call reaches matches. An exemption whose configured declarations nobody checks silently retains nothing, so a stale entry is a finding. The kind is fixed on at deny: no flag, no severity setting and no exception reduces it below a finding, and a configuration naming this code under a severity key is an unimplemented key.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "none",
+    fixed: true,
+  },
+  {
+    code: "DS1801",
+    name: "unused-parameter",
+    languages: ["go", "ts"],
+    rule: "A parameter with no reference inside its function body, on a function whose signature is free to change.",
+    precondition:
+      "The signature must be free, defined as follows: the function is not a method retained by interface satisfaction, is not used as a value, is not a go:linkname or cgo target, and is not a stub whose body is empty or only panics. A parameter its body never names is dead whatever the callers, so a published declaration of a library is reported too, with the fixability the vocabulary gives the kind: the signature change is a breaking change.",
+    defaultSeverity: "warn",
+    maxClass: "certain",
+    fixability: "manual",
+    fixed: false,
+    overlap: ["tsc --noUnusedParameters", "@typescript-eslint/no-unused-vars"],
+  },
+  {
+    code: "DS1802",
+    name: "unused-receiver",
+    languages: ["go"],
+    rule: "A named method receiver with no reference inside the method body, on a method whose signature is free to change. Go permits a method with no receiver name, so the fix deletes an identifier and changes no signature.",
+    precondition: "The same free-signature rule as unused-parameter, applied to the receiver.",
+    defaultSeverity: "warn",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+    overlap: ["not applicable"],
+  },
+  {
+    code: "DS1803",
+    name: "unused-result",
+    languages: ["go", "ts"],
+    rule: "A result value that no call site of the function uses, on a function whose signature is free to change.",
+    precondition:
+      "The same free-signature rule as unused-parameter, plus a closed-world condition: every call site of the function must be in the loaded graph, because an unknown caller may consume the result, so the kind reports only for a function whose callers are all visible.",
+    defaultSeverity: "warn",
+    maxClass: "certain",
+    fixability: "manual",
+    fixed: false,
+    overlap: ["none known"],
+  },
+  {
+    code: "DS1805",
+    name: "unreachable-statement",
+    languages: ["go", "ts"],
+    rule: "A statement that control flow cannot reach, at the precision the language's compiler applies to the same construct.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+    overlap: ["tsc allowUnreachableCode", "eslint no-unreachable"],
+  },
+  {
+    code: "DS1807",
+    name: "dead-store",
+    languages: ["go", "ts"],
+    rule: "A write to a local variable with no read before the next write to it or the end of its scope, computed on the same read-and-write classification the write-only-symbol kind uses. The finding names the write position.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+    overlap: ["eslint no-useless-assignment"],
+  },
+  {
+    code: "DS1809",
+    name: "unreachable-case",
+    languages: ["go", "ts"],
+    rule: "A switch case whose type or value an earlier case in the same switch already covers.",
+    defaultSeverity: "deny",
+    maxClass: "certain",
+    fixability: "deletable",
+    fixed: false,
+    overlap: ["none known"],
+  },
 ];
 
-/** A row at the `certain` ceiling whose severity a configuration may set. */
-function row(
-  code: string,
-  name: string,
-  defaultSeverity: Severity,
-  fixability: Fixability,
-): KindRow {
-  return { code, name, defaultSeverity, maxClass: "certain", fixability, fixed: false };
-}
-
 /** Every live row of the issue-kind vocabulary, by its code, in ascending code order. */
 export const KINDS: ReadonlyMap<string, KindRow> = new Map(ROWS.map((one) => [one.code, one]));
 

package/src/reflective-lookup.ts

@@ -8,7 +8,9 @@
  * string reaches every member of that name on any type, static members included,
  * and every record names the string's own position. A key that is not literal text
  * holds nothing back: a computed name is the case no exact rule serves. `Reflect` is
- * the global one only: a local declaration of that name is a different object.
+ * the global one only: a local declaration of that name is a different object. An
+ * element access through a receiver whose type declares a string index signature, and is
+ * not `any`, reads that signature and holds nothing back.
  */
 
 import {
@@ -21,9 +23,12 @@ import {
   type Node,
   type SourceFile,
 } from "@typescript/native/unstable/ast";
+import { TypeFlags, type Type } from "@typescript/native/unstable/sync";
+import { typesAt } from "./class-members.ts";
 import type { DetectorInput, Evidence } from "./exempt.ts";
 import { memberNames } from "./member-names.ts";
 import { renderPosition } from "./position.ts";
+import type { ProjectView } from "./session.ts";
 
 /** The `Reflect` methods whose second argument is a property key. */
 const REFLECT_KEYED: ReadonlySet<string> = new Set(["get", "set", "has"]);
@@ -35,6 +40,8 @@ interface Lookup {
   readonly callee: string;
   /** The `Reflect` the call names, where the lookup is a `Reflect` call. */
   readonly reflect: Node | undefined;
+  /** The expression an element access reads from, where the lookup is one. */
+  readonly receiver: Node | undefined;
 }
 
 /** The text one key denotes, where it is literal text. */
@@ -57,6 +64,7 @@ function lookupsOf(file: SourceFile): readonly Lookup[] {
           name,
           callee: `[${JSON.stringify(name)}]`,
           reflect: undefined,
+          receiver: node.expression,
         });
       }
     } else if (isCallExpression(node) && isPropertyAccessExpression(node.expression)) {
@@ -72,7 +80,13 @@ function lookupsOf(file: SourceFile): readonly Lookup[] {
         key !== undefined &&
         name !== undefined
       ) {
-        found.push({ key, name, callee: `Reflect.${method.text}`, reflect: target });
+        found.push({
+          key,
+          name,
+          callee: `Reflect.${method.text}`,
+          reflect: target,
+          receiver: undefined,
+        });
       }
     }
     node.forEachChild(visit);
@@ -81,6 +95,16 @@ function lookupsOf(file: SourceFile): readonly Lookup[] {
   return found;
 }
 
+/** Whether a receiver's type is not `any` and declares a string index signature. */
+function readsAMapping<Brand>(project: ProjectView<Brand>, type: Type): boolean {
+  if ((type.flags & TypeFlags.Any) !== 0) {
+    return false;
+  }
+  return project.checker
+    .getIndexInfosOfType(type)
+    .some((info) => (info.keyType.flags & TypeFlags.String) !== 0);
+}
+
 /**
  * The reflective-lookup detector: every member whose name a literal key of a lookup
  * spells, recorded at the key.
@@ -112,12 +136,28 @@ export function reflectiveLookup<Brand>(input: DetectorInput<Brand>): readonly E
     });
   }
 
+  // An element access through a receiver that maps every string key to one value type
+  // reads that mapping rather than a member, asked in one batch.
+  const receivers = lookups.flatMap((lookup) =>
+    lookup.receiver === undefined ? [] : [lookup.receiver],
+  );
+  const mapped = new Set<Node>();
+  typesAt(project, receivers).forEach((type, index) => {
+    const receiver = receivers[index];
+    if (receiver !== undefined && type !== undefined && readsAMapping(project, type)) {
+      mapped.add(receiver);
+    }
+  });
+
   const members = memberNames(files, held);
   const found: Evidence[] = [];
   for (const lookup of lookups) {
     if (lookup.reflect !== undefined && !global.has(lookup.reflect)) {
       continue;
     }
+    if (lookup.receiver !== undefined && mapped.has(lookup.receiver)) {
+      continue;
+    }
     const site = renderPosition(lookup.key.getSourceFile(), targetRoot, lookup.key.getStart());
     for (const member of members.get(lookup.name) ?? []) {
       found.push({ id: member.id, detail: `looked up by ${lookup.callee}`, site });

package/src/report.ts

@@ -18,7 +18,13 @@ import type { StaleSuppression } from "./findings/self-check.ts";
 import type { TestFileRule } from "./references.ts";
 
 /** The version of the report schema this analyzer writes a report to. */
-export const SCHEMA_VERSION = "6.0.0";
+const SCHEMA_VERSION = "6.1.0";
+
+/**
+ * Every report schema version this analyzer reads: the schema versions the Contract it
+ * implements admits, each an instance of the one it writes.
+ */
+export const SCHEMA_VERSIONS_ACCEPTED: readonly string[] = ["6.0.0", SCHEMA_VERSION];
 
 /** The name this analyzer writes every document under and mints every identifier with. */
 export const ANALYZER_NAME = "deadset-ts";
@@ -49,6 +55,7 @@ export interface WireDetails {
     readonly path?: string;
     readonly reason?: string;
   };
+  readonly overlap?: readonly string[];
 }
 
 /** One finding as the finding schema spells it. */
@@ -73,6 +80,11 @@ export interface WireFinding {
     readonly root: boolean;
     readonly symbol_count: number;
     readonly deletable_lines: number;
+    readonly members?: readonly {
+      readonly ref: string;
+      readonly name: string;
+      readonly position: WirePosition;
+    }[];
   };
   readonly retained_by: readonly string[];
   readonly configurations: readonly string[];
@@ -247,6 +259,7 @@ function wireDetails(details: FindingDetails): WireDetails {
             ...(entry.reason === undefined ? {} : { reason: entry.reason }),
           },
         }),
+    ...(details.overlap === undefined ? {} : { overlap: details.overlap }),
   };
 }
 
@@ -275,6 +288,9 @@ export function wireFinding(finding: CompletedFinding): WireFinding {
       root: finding.component.root,
       symbol_count: finding.component.symbolCount,
       deletable_lines: finding.component.deletableLines,
+      ...(finding.component.members === undefined
+        ? {}
+        : { members: finding.component.members.map(wireSymbol) }),
     },
     retained_by: finding.retainedBy,
     configurations: finding.configurations,
@@ -409,7 +425,7 @@ export function buildReport(input: ReportInput): Report {
       name: ANALYZER_NAME,
       version: input.version,
       languages: [LANGUAGE],
-      schema_versions_accepted: [SCHEMA_VERSION],
+      schema_versions_accepted: SCHEMA_VERSIONS_ACCEPTED,
       conformance: {
         corpus_version: input.conformance.corpusVersion,
         result: input.conformance.result,