@cplieger/deadset-ts 3.12.1 → 3.13.0

package/src/reporters/sarif.ts

@@ -1,9 +1,8 @@
 import type { Confidence, Severity } from "../config.ts";
-import { KINDS } from "../kinds.ts";
+import { KINDS, type KindRow } from "../kinds.ts";
 import type { Report, WireFinding, WireStaleSuppression } from "../report.ts";
 import { lineHashes, symbolFingerprint } from "./fingerprint.ts";
 import { RenderError, type RenderOptions } from "./reporter.ts";
-import { RULE_TEXTS } from "./rules.ts";
 import { utf8Bytes } from "./sha256.ts";
 
 const SCHEMA =
@@ -12,7 +11,7 @@ const VERSION = "2.1.0";
 /** The unit a finding's column counts. */
 const COLUMN_KIND = "utf16CodeUnits";
 const URI_BASE_ID = "%SRCROOT%";
-const ROOT_DESCRIPTION = "The target root, the directory the analyzer was run on.";
+const ROOT_DESCRIPTION = "The target root.";
 
 /** The most related locations one result carries; the report stays complete beyond them. */
 const MAX_RELATED = 100;
@@ -41,23 +40,26 @@ function firstSentence(text: string): string {
   return text;
 }
 
+/** Every live kind whose languages include one of the run's, in code order. */
+function kindsOf(languages: readonly string[]): readonly KindRow[] {
+  return [...KINDS.values()].filter((kind) =>
+    kind.languages.some((language) => languages.includes(language)),
+  );
+}
+
 /**
- * One rule per live kind of this analyzer's language, in code order, whether or not a result
+ * One rule per live kind of the run's languages, in code order, whether or not a result
  * names it, so a rule's index is the same in every run and under every configuration.
  */
-function rules(): readonly Record<string, unknown>[] {
-  return [...RULE_TEXTS].map(([code, text]) => {
-    const kind = KINDS.get(code);
-    if (kind === undefined) {
-      throw new RenderError(`the rule ${code} names no live kind`);
-    }
+function rules(kinds: readonly KindRow[]): readonly Record<string, unknown>[] {
+  return kinds.map((kind) => {
     return {
-      id: code,
+      id: kind.code,
       name: kind.name,
-      shortDescription: { text: firstSentence(text.rule) },
-      fullDescription: { text: text.rule },
+      shortDescription: { text: firstSentence(kind.rule) },
+      fullDescription: { text: kind.rule },
       help: {
-        text: text.precondition === undefined ? text.rule : `${text.rule}\n\n${text.precondition}`,
+        text: kind.precondition === undefined ? kind.rule : `${kind.rule}\n\n${kind.precondition}`,
       },
       defaultConfiguration: { level: LEVEL[kind.defaultSeverity] },
       properties: {
@@ -155,6 +157,11 @@ function relatedOf(found: WireFinding): readonly Related[] {
   for (const at of found.details.write_positions ?? []) {
     related.push({ label: "write", at, endLine: at.end_line });
   }
+  for (const one of found.component.members ?? []) {
+    if (one.ref !== found.symbol.ref) {
+      related.push({ label: "member", at: one.position, endLine: one.position.end_line });
+    }
+  }
   return related.slice(0, MAX_RELATED);
 }
 
@@ -254,8 +261,9 @@ function staleResult(
  * rendering, because a line fingerprint computed from other bytes opens a second alert.
  */
 export function sarif(report: Report, options: RenderOptions): string {
-  const ruleList = rules();
-  const index = new Map([...RULE_TEXTS.keys()].map((code, at) => [code, at]));
+  const kinds = kindsOf(report.analyzer.languages);
+  const ruleList = rules(kinds);
+  const index = new Map(kinds.map((kind, at) => [kind.code, at]));
   const hashOf = lineHashCache(options.readSource);
   const results = [
     ...report.findings.map((found) => findingResult(found, index, hashOf)),

package/src/reporters/template.ts

@@ -115,7 +115,11 @@ const ESCAPES: Readonly<Record<string, string>> = {
 const ESCAPE_WIDTHS: Readonly<Record<string, number>> = { x: 2, u: 4, U: 8 };
 
 const IDENTIFIER = /[A-Za-z_][A-Za-z0-9_]*/uy;
-const NUMBER = /[+-]?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/uy;
+/** A number as the lexer reads one, before the subset decides whether it is a decimal integer. */
+const NUMBER = /[+-]?[0-9][0-9A-Za-z_.]*/uy;
+
+/** The one number form the subset admits: a decimal integer with no leading zero. */
+const DECIMAL_INTEGER = /^[+-]?(?:0|[1-9][0-9]*)$/u;
 
 function lineOf(source: string, at: number): number {
   let line = 1;
@@ -224,6 +228,11 @@ function lexAction(
     NUMBER.lastIndex = i;
     const number = NUMBER.exec(source)?.[0];
     if (number !== undefined) {
+      if (!DECIMAL_INTEGER.test(number)) {
+        throw new TemplateError(
+          `line ${String(line)}: ${JSON.stringify(number)} is not a decimal integer`,
+        );
+      }
       tokens.push({ t: "lit", value: Number(number) });
       i += number.length;
       continue;
@@ -636,7 +645,61 @@ function compareBasic(name: string, a: Value, b: Value): number {
   if (kind === "boolean") {
     return Number.NaN;
   }
-  return (a as number | string) < (b as number | string) ? -1 : 1;
+  if (kind === "string") {
+    return byCodePoints(a as string, b as string);
+  }
+  return (a as number) < (b as number) ? -1 : 1;
+}
+
+/**
+ * Two strings ordered by the bytes of their UTF-8 encodings, which is the order of their
+ * code points: the order of their UTF-16 code units differs above U+FFFF.
+ */
+function byCodePoints(a: string, b: string): number {
+  let at = 0;
+  while (at < a.length && at < b.length) {
+    const x = a.codePointAt(at) ?? 0;
+    const y = b.codePointAt(at) ?? 0;
+    if (x !== y) {
+      return x < y ? -1 : 1;
+    }
+    at += x > 0xffff ? 2 : 1;
+  }
+  return a.length - b.length;
+}
+
+/** The escapes `%q` writes for the control characters that have one of their own. */
+const QUOTED_ESCAPES: Readonly<Record<string, string>> = {
+  '"': '\\"',
+  "\\": "\\\\",
+  "\u0007": "\\a",
+  "\b": "\\b",
+  "\f": "\\f",
+  "\n": "\\n",
+  "\r": "\\r",
+  "\t": "\\t",
+  "\v": "\\v",
+};
+
+/**
+ * The text `%q` writes: double quotes around the text, a quote and a backslash escaped,
+ * each control character with an escape of its own written as it, every other character
+ * below U+0020 and U+007F written as `\x` and two lowercase hexadecimal digits, and every
+ * other character as itself.
+ */
+function goQuoted(text: string): string {
+  let out = '"';
+  for (const char of text) {
+    const code = char.codePointAt(0) ?? 0;
+    if (Object.hasOwn(QUOTED_ESCAPES, char)) {
+      out += QUOTED_ESCAPES[char] ?? "";
+    } else if (code < 0x20 || code === 0x7f) {
+      out += `\\x${code.toString(16).padStart(2, "0")}`;
+    } else {
+      out += char;
+    }
+  }
+  return `${out}"`;
 }
 
 /** `printf`'s verbs, each over one operand. */
@@ -663,10 +726,10 @@ function printf(format: string, args: readonly Value[]): string {
     switch (verb) {
       case "v":
       case "s":
-        out += formatted(arg, false);
+        out += formatted(arg, true);
         break;
       case "q":
-        out += JSON.stringify(formatted(arg, false));
+        out += goQuoted(formatted(arg, true));
         break;
       case "d":
         if (typeof arg !== "number" || !Number.isInteger(arg)) {
@@ -768,11 +831,11 @@ function call(name: string, args: readonly Value[]): Value {
       return args
         .map((arg, i) => {
           const spaced = i > 0 && typeof arg !== "string" && typeof args[i - 1] !== "string";
-          return `${spaced ? " " : ""}${formatted(arg, false)}`;
+          return `${spaced ? " " : ""}${formatted(arg, true)}`;
         })
         .join("");
     case "println":
-      return `${args.map((arg) => formatted(arg, false)).join(" ")}\n`;
+      return `${args.map((arg) => formatted(arg, true)).join(" ")}\n`;
     case "printf":
       if (typeof first !== "string") {
         throw new RenderError("printf takes a format string first");

package/src/serialization-contract.ts

@@ -1,11 +1,12 @@
 /**
- * The serialization-contract class: the properties of a class whose values reach
- * `JSON.stringify` or a call `ts.serializers` names, and those and `toJSON` and
- * `toString` where a value is passed to an `unknown` or `any` parameter of a function
- * outside the analysis. A function of the project handing such a parameter of its own
- * to a destination is one, holding back what that destination does, to a fixpoint. A
- * function invoked through `Function.prototype.call`, `apply` or `bind` is the callee,
- * given the arguments those methods pass it.
+ * The serialization-contract class: the data members and `toJSON` of every class,
+ * interface and object type a value's static type names, and of every such type its
+ * data members' types reach, where the value reaches `JSON.stringify` or a call
+ * `ts.serializers` names, and those and `toString` where it is passed to an `unknown`
+ * or `any` parameter of a function outside the analysis. A function of the project
+ * handing such a parameter of its own to a destination is one, holding back what that
+ * destination does, to a fixpoint. A function invoked through `Function.prototype.call`,
+ * `apply` or `bind` is the callee, given the arguments those methods pass it.
  */
 
 import {
@@ -57,7 +58,7 @@ import type { DetectorInput, Evidence } from "./exempt.ts";
 import { nodeKey, type Inventory } from "./inventory.ts";
 import { renderPosition } from "./position.ts";
 import type { ProjectView } from "./session.ts";
-import { valueReach } from "./value-reach.ts";
+import { valueReach, type Reached } from "./value-reach.ts";
 
 /** The serializer every run reads, whatever the configuration names. */
 const JSON_STRINGIFY: DeclarationEntry = { shape: "global", global: "JSON.stringify" };
@@ -65,6 +66,9 @@ const JSON_STRINGIFY: DeclarationEntry = { shape: "global", global: "JSON.string
 /** The methods a serializer and a formatter resolve by name on a value that left the analysis. */
 const CONVERSIONS: ReadonlySet<string> = new Set(["toJSON", "toString"]);
 
+/** The method a serializer calls on a value that carries one, wherever the value goes. */
+const SERIALIZED_CONVERSION = "toJSON";
+
 /** The parameter types that keep nothing of the value they are given. */
 const ERASED = TypeFlags.Any | TypeFlags.Unknown;
 
@@ -521,10 +525,12 @@ function destinations<Brand>(
   return { invocation, at, mayReceive };
 }
 
-/** One argument whose value carries classes of the target into a destination. */
+/** One argument whose value carries classes and object types of the target into a destination. */
 interface Flow {
   readonly site: Node;
   readonly classes: ReadonlySet<string>;
+  /** The members of the interfaces and object types the value carries. */
+  readonly members: readonly TSSymbol[];
   readonly to: Destination;
 }
 
@@ -554,31 +560,34 @@ function flowsOf<Brand>(
   );
   return arguments_.flatMap((one) => {
     const type = typeOf.get(one.value);
-    let classes: ReadonlySet<string> = new Set<string>();
+    let reached: Reached = { classes: new Set<string>(), members: [] };
     if (one.value.kind === SyntaxKind.ThisKeyword) {
-      classes = new Set(one.site.self === undefined ? [] : [one.site.self]);
+      reached = {
+        classes: new Set(one.site.self === undefined ? [] : [one.site.self]),
+        members: [],
+      };
     } else if (type !== undefined) {
-      classes = reach.classesOf(type);
+      reached = reach.reachedFrom(type);
     }
-    const destination = classes.size === 0 ? undefined : to.at(one.site.call, one.argument);
-    return destination === undefined ? [] : [{ site: one.value, classes, to: destination }];
+    const carries = reached.classes.size > 0 || reached.members.length > 0;
+    const destination = carries ? to.at(one.site.call, one.argument) : undefined;
+    return destination === undefined
+      ? []
+      : [{ site: one.value, classes: reached.classes, members: reached.members, to: destination }];
   });
 }
 
 /**
- * The serialization-contract detector: each property of each class whose values reach
- * a destination, and the two conversion methods where the destination is outside the
- * analysis, recorded at the argument with the callee named.
+ * The serialization-contract detector: each data member and `toJSON` of each class,
+ * interface and object type a value that reaches a destination carries, and `toString`
+ * as well where the destination is outside the analysis, recorded at the argument with
+ * the callee named.
  */
 export function serializationContract<Brand>(input: DetectorInput<Brand>): readonly Evidence[] {
   const { project, held, targetRoot } = input;
   const walked = walkProject(project, held);
-  const flows = flowsOf(
-    project,
-    held,
-    walked.sites,
-    destinations(input, aliasChains(project, held), walked),
-  );
+  const chains = aliasChains(project, held);
+  const flows = flowsOf(project, held, walked.sites, destinations(input, chains, walked));
   if (flows.length === 0) {
     return [];
   }
@@ -589,22 +598,30 @@ export function serializationContract<Brand>(input: DetectorInput<Brand>): reado
     "instance",
   );
   const byId = new Map(held.symbols.map((symbol) => [symbol.id, symbol]));
+  // A destination holds back a data member and `toJSON`, and `toString` as well where
+  // the value left the analysis.
+  const holdsBack = (flags: SymbolFlags, name: string, to: Destination): boolean =>
+    (flags & SymbolFlags.Property) !== 0 ||
+    ((flags & SymbolFlags.Method) !== 0 &&
+      (name === SERIALIZED_CONVERSION || (to.reach === "conversions" && CONVERSIONS.has(name))));
   const found: Evidence[] = [];
   for (const flow of flows) {
     const site = renderPosition(flow.site.getSourceFile(), targetRoot, flow.site.getStart());
     const detail = `passed to ${flow.to.callee}`;
     for (const member of [...flow.classes].flatMap((id) => members.get(id) ?? [])) {
       const symbol = byId.get(member.id);
-      const isProperty = (member.flags & SymbolFlags.Property) !== 0;
-      const converts =
-        flow.to.reach === "conversions" &&
-        (member.flags & SymbolFlags.Method) !== 0 &&
-        symbol !== undefined &&
-        CONVERSIONS.has(memberComponent(symbol, byId) ?? "");
-      if (isProperty || converts) {
+      const name = symbol === undefined ? "" : (memberComponent(symbol, byId) ?? "");
+      if (holdsBack(member.flags, name, flow.to)) {
         found.push({ id: member.id, detail, site });
       }
     }
+    for (const member of flow.members) {
+      if (holdsBack(member.flags, member.name, flow.to)) {
+        for (const id of chains.declarationsOf(member)) {
+          found.push({ id, detail, site });
+        }
+      }
+    }
   }
   return found;
 }

package/src/signatures.ts

@@ -0,0 +1,55 @@
+/**
+ * The function a declaration of the inventory declares, where it declares one: the node
+ * whose parameters, body and result are the declaration's own parts.
+ */
+
+import {
+  isArrowFunction,
+  isClassDeclaration,
+  isClassExpression,
+  isFunctionDeclaration,
+  isFunctionExpression,
+  isMethodDeclaration,
+  isPropertyDeclaration,
+  isVariableDeclaration,
+  type ArrowFunction,
+  type FunctionDeclaration,
+  type FunctionExpression,
+  type MethodDeclaration,
+  type Node,
+} from "@typescript/native/unstable/ast";
+
+/** A function-like node that carries a body of its own. */
+export type SignatureNode =
+  FunctionDeclaration | MethodDeclaration | ArrowFunction | FunctionExpression;
+
+/** Whether one node is a function value written in place: an arrow or a function expression. */
+function isFunctionValue(node: Node | undefined): node is ArrowFunction | FunctionExpression {
+  return node !== undefined && (isArrowFunction(node) || isFunctionExpression(node));
+}
+
+/**
+ * The function one declaration declares: a function declaration and a class method with
+ * a body are their own; a variable and a class property whose initializer is an arrow or
+ * a function expression declare that function. Any other declaration declares none, an
+ * overload signature and an abstract or ambient method among them, because no body is
+ * there to read its parts.
+ */
+export function signatureOf(node: Node): SignatureNode | undefined {
+  if (isFunctionDeclaration(node)) {
+    return node.body === undefined ? undefined : node;
+  }
+  if (isMethodDeclaration(node)) {
+    const owner = node.parent;
+    return node.body !== undefined && (isClassDeclaration(owner) || isClassExpression(owner))
+      ? node
+      : undefined;
+  }
+  if (
+    (isVariableDeclaration(node) || isPropertyDeclaration(node)) &&
+    isFunctionValue(node.initializer)
+  ) {
+    return node.initializer;
+  }
+  return undefined;
+}

package/src/suppress-file.ts

@@ -154,6 +154,15 @@ function readRecord(value: unknown, site: Position, byReference: ByReference, sh
   return { records: named.map((one) => ({ ...written, bound: one.id })), refusals: [] };
 }
 
+function byReferenceOf(symbols: readonly InventorySymbol[]): ByReference {
+  const byReference = new Map<string, InventorySymbol[]>();
+  for (const symbol of symbols) {
+    const key = referenceKey(symbol.ref, symbol.position.path);
+    byReference.set(key, [...(byReference.get(key) ?? []), symbol]);
+  }
+  return byReference;
+}
+
 /** Reads one document at the target root, binding each record against the run's declarations. */
 function readDocument(
   host: Host,
@@ -196,11 +205,7 @@ function readDocument(
     return malformed(shape.file);
   }
 
-  const byReference = new Map<string, InventorySymbol[]>();
-  for (const symbol of symbols) {
-    const key = referenceKey(symbol.ref, symbol.position.path);
-    byReference.set(key, [...(byReference.get(key) ?? []), symbol]);
-  }
+  const byReference = byReferenceOf(symbols);
   const records: SuppressionRecord[] = [];
   const refusals: Refusal[] = [];
   (held as readonly unknown[]).forEach((value, index) => {
@@ -247,6 +252,24 @@ export interface Recorded {
   readonly path: string;
 }
 
+/**
+ * Rows a baseline write holds in memory, bound against the run's declarations as the same
+ * rows read back from the document would be, each carrying the reason given.
+ */
+export function bindRows(
+  rows: readonly Recorded[],
+  reason: string,
+  symbols: readonly InventorySymbol[],
+): Suppressions {
+  const byReference = byReferenceOf(symbols);
+  const site = documentSite(BASELINE_SHAPE);
+  const read = rows.map((row) => readRecord({ ...row, reason }, site, byReference, BASELINE_SHAPE));
+  return {
+    records: read.flatMap((one) => one.records),
+    refusals: read.flatMap((one) => one.refusals),
+  };
+}
+
 /** The analyzer a written row names as its provenance, as the same run's report names it. */
 export interface Provenance {
   readonly analyzer: string;
@@ -258,6 +281,11 @@ const BASELINE_DESCRIPTION =
   "Recorded findings: a run fails only on a finding this document does not hold. " +
   "Every reason is the analyzer that recorded the row, never an adjudication.";
 
+/** The reason every row a baseline write records carries. */
+export function rowReason(provenance: Provenance): string {
+  return `recorded by ${provenance.analyzer} ${provenance.version}`;
+}
+
 /**
  * A baseline holding one row per finding, in the order given, which is the report's. Every
  * row carries the provenance as its reason. A finding missing a value a row needs, and an
@@ -270,7 +298,7 @@ export function writeBaseline(findings: readonly Recorded[], provenance: Provena
       `a baseline row would carry no reason: the analyzer identity names ${JSON.stringify(provenance.analyzer)} at version ${JSON.stringify(provenance.version)}`,
     );
   }
-  const reason = `recorded by ${provenance.analyzer} ${provenance.version}`;
+  const reason = rowReason(provenance);
   const baseline = findings.map((found) => {
     if (found.code === "" || found.symbol === "" || found.path === "") {
       throw new Error(

package/src/suppress-inline.ts

@@ -8,6 +8,7 @@ import { SyntaxKind, type Node, type SourceFile } from "@typescript/native/unsta
 import { nodeKey, type Inventory } from "./inventory.ts";
 import { byPosition, positionKey, renderPosition, type Position } from "./position.ts";
 import type { ProjectView } from "./session.ts";
+import { signatureOf } from "./signatures.ts";
 import {
   SUPPRESSION_WITHOUT_REASON,
   SuppressionError,
@@ -168,7 +169,8 @@ interface Declared {
 /**
  * The declarations of one file by the line each begins on, the line of its first token: a
  * decorator, a modifier or the keyword. A variable's first token is its statement's
- * keyword, and a variable written on a later line of the statement also begins there.
+ * keyword, and a variable written on a later line of the statement also begins there. A
+ * function also begins, for a directive, on the line of each of its parameters.
  */
 function declarationLines(
   file: SourceFile,
@@ -189,6 +191,11 @@ function declarationLines(
     const one = id === undefined ? undefined : symbols.get(id);
     if (one !== undefined) {
       add(node.pos, one);
+      // A parameter on a later line of a wrapped signature takes its directive on the
+      // line above it, inside the parameter list, and the directive binds the function.
+      for (const parameter of signatureOf(node)?.parameters ?? []) {
+        add(parameter.pos, one);
+      }
       const list = node.parent;
       if (
         node.kind === SyntaxKind.VariableDeclaration &&

package/src/suppress.ts

@@ -169,6 +169,7 @@ const ROW_SUBJECTS: ReadonlySet<string> = new Set([
   "dependency",
   "module-directive",
   "root",
+  "configured-declaration",
   "suppression",
   "edge",
 ]);
@@ -178,6 +179,36 @@ export function isRowSubject(kind: string): boolean {
   return ROW_SUBJECTS.has(kind);
 }
 
+/**
+ * The subject kinds that are a part of a declaration rather than a declaration: a part
+ * has no reference of its own, so a finding about one names the declaration that holds
+ * it, and the part is decided inside that declaration whatever uses it.
+ */
+const PART_SUBJECTS: ReadonlySet<string> = new Set([
+  "parameter",
+  "receiver",
+  "result",
+  "statement",
+  "case",
+  "store",
+]);
+
+/** Whether a finding's subject is a part of the declaration its reference names. */
+export function isPartSubject(kind: string): boolean {
+  return PART_SUBJECTS.has(kind);
+}
+
+/** The prefix of the codes of the part kinds, the intra-function range. */
+const PART_KIND_PREFIX = "DS18";
+
+/**
+ * Whether a code is a part kind, whose record withholds its finding and marks nothing:
+ * the record says the part is wanted, not that the declaration holding it is.
+ */
+export function isPartKind(code: string): boolean {
+  return code.startsWith(PART_KIND_PREFIX);
+}
+
 /** One finding's identity: its code and the position of the thing it names. */
 function claimKey(finding: Finding): string {
   return `${finding.code}\u0000${positionKey(finding.position)}`;

package/src/value-reach.ts

@@ -1,9 +1,11 @@
 /**
- * The classes of the target a value of one type carries, as a serializer walking the
- * value reaches them: through union and intersection constituents, array and tuple
- * elements, and the data members of the target's classes and of object types the
- * target writes. The walk stops at `any`, `unknown`, a type parameter, a function and
- * an interface or class of another program, so an instance held only there is missed.
+ * The classes of the target a value of one type carries, and the members of the other
+ * object types the target writes that it carries, as a serializer walking the value
+ * reaches them: through union and intersection constituents, array and tuple elements,
+ * and the data members and index signatures of the target's classes and of the
+ * interfaces and object types the target writes. The walk stops at `any`, `unknown`, a
+ * type parameter, a function and an interface or class of another program, so an
+ * instance held only there is missed.
  */
 
 import {
@@ -23,12 +25,25 @@ const WRITTEN = ObjectFlags.ObjectLiteral | ObjectFlags.Mapped;
 /** The symbols of an anonymous object type the target writes as a type. */
 const LITERAL_SYMBOLS = SymbolFlags.TypeLiteral | SymbolFlags.ObjectLiteral;
 
-/** The classes a type's values carry, each asked of the checker once. */
+/** What a value of one type carries that the target declares. */
+export interface Reached {
+  /** The identifiers of the target's classes. */
+  readonly classes: ReadonlySet<string>;
+  /**
+   * The members of the interfaces and object types the target writes, other than its
+   * classes: each data member, and each method named `toJSON` or `toString`.
+   */
+  readonly members: readonly TSSymbol[];
+}
+
+/** What each type's values carry, each type asked of the checker once. */
 export interface ValueReach {
-  /** The identifiers of the target's classes a value of `type` carries. */
-  classesOf(type: Type): ReadonlySet<string>;
+  reachedFrom(type: Type): Reached;
 }
 
+/** The two conversion methods a serializer or a formatter resolves on a value's own shape. */
+const CONVERSION_NAMES: ReadonlySet<string> = new Set(["toJSON", "toString"]);
+
 /** The global array types, whose element type is what an array value carries. */
 function arrayTargets<Brand>(project: ProjectView<Brand>): ReadonlySet<number> {
   const checker = project.checker;
@@ -105,6 +120,29 @@ export function valueReach<Brand>(project: ProjectView<Brand>, held: Inventory):
     ];
   };
 
+  /** Whether the walk reads one type's members because the target writes the type, not as a class. */
+  const writtenObject = (type: Type): boolean => {
+    if (!type.isObjectType() || classOf(type) !== undefined) {
+      return false;
+    }
+    const target = targetOf(type);
+    const isList =
+      type.isTypeReference() &&
+      (arrays.has(target.id) ||
+        (target.isObjectType() && (target.objectFlags & ObjectFlags.Tuple) !== 0));
+    return !isList && isWritten(type);
+  };
+
+  /** The data members and conversion methods of one written object type. */
+  const carried = (type: Type): readonly TSSymbol[] =>
+    checker
+      .getPropertiesOfType(type)
+      .filter(
+        (property) =>
+          (property.flags & SymbolFlags.Property) !== 0 ||
+          ((property.flags & SymbolFlags.Method) !== 0 && CONVERSION_NAMES.has(property.name)),
+      );
+
   /** The types a value of one type holds, read once per type. */
   const childrenOf = (type: Type): readonly Type[] => {
     const known = children.get(type.id);
@@ -131,8 +169,9 @@ export function valueReach<Brand>(project: ProjectView<Brand>, held: Inventory):
   };
 
   return {
-    classesOf: (type) => {
-      const found = new Set<string>();
+    reachedFrom: (type) => {
+      const classes = new Set<string>();
+      const members: TSSymbol[] = [];
       const seen = new Set<number>();
       const pending: Type[] = [type];
       for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
@@ -142,11 +181,13 @@ export function valueReach<Brand>(project: ProjectView<Brand>, held: Inventory):
         seen.add(next.id);
         const owner = classOf(next);
         if (owner !== undefined) {
-          found.add(owner);
+          classes.add(owner);
+        } else if (writtenObject(next)) {
+          members.push(...carried(next));
         }
         pending.push(...childrenOf(next));
       }
-      return found;
+      return { classes, members };
     },
   };
 }