@cplieger/deadset-ts 3.12.1 → 4.0.0

package/src/references.ts

@@ -28,12 +28,13 @@ import {
   type SourceFile,
 } from "@typescript/native/unstable/ast";
 import type { Symbol as TSSymbol } from "@typescript/native/unstable/sync";
-import { aliasChains } from "./alias-chain.ts";
+import { aliasChains, type ChainTarget } from "./alias-chain.ts";
 import { destructuring, propertyReadsOf, type PropertyRead } from "./destructuring.ts";
 import { globExpression } from "./glob.ts";
-import { nodeKey, type Inventory } from "./inventory.ts";
+import { declarationsByName, nodeKey, type Inventory } from "./inventory.ts";
 import { relativePath } from "./paths.ts";
 import { byPosition, renderPosition, type Position } from "./position.ts";
+import { DEFAULT_BATCH_CAP, UNANSWERED, type Answer } from "./query.ts";
 import type { ProjectView } from "./session.ts";
 
 /**
@@ -63,21 +64,15 @@ import type { ProjectView } from "./session.ts";
 export type Use = "read" | "write" | "evaluation" | "decorator";
 
 /**
- * Which accessor answered for one reference, so that the cost of a run is attributable
- * and a table of references shows the path each row took.
- *
- * - `batch` is the batched lookup over a file's name nodes, which answers for almost
- *   every one of them.
- * - `resolved-symbol` is the per-node lookup for the residue a batch left.
- * - `shorthand` is the per-node lookup for `{ a }`, whose name resolves to the property
- *   the literal declares rather than to the declaration that name reads.
- * - `alias` is a step along an import or export chain, from one link to what it names.
- * - `syntax` is the tree alone, which says what a decorator is attached to.
- * - `destructured` is the property a pattern names, looked up on the type of the value
- *   the pattern destructures.
+ * Which path answered for one reference: `batch`, the batched lookup over a file's name
+ * nodes; `resolved-symbol`, the per-node lookup for the residue a batch left;
+ * `shorthand`, the lookup for the value `{ a }` reads; `alias`, a step along an import
+ * or export chain; `syntax`, the tree alone, which says what a decorator is attached to;
+ * `destructured`, the property a pattern names, on the destructured value's type; and
+ * `by-name`, every declaration bearing the name a site spells, where the checker failed.
  */
 export type Resolution =
-  "batch" | "resolved-symbol" | "shorthand" | "alias" | "syntax" | "destructured";
+  "batch" | "resolved-symbol" | "shorthand" | "alias" | "syntax" | "destructured" | "by-name";
 
 /** One use of one declaration by one declaration. */
 export interface Reference {
@@ -187,13 +182,6 @@ export interface ReferenceOptions {
   readonly consumer?: ConsumerSide;
 }
 
-/**
- * The batch cap a run takes when the configuration names none. It bounds the size of
- * one answer rather than the work: the median file is one batch at this cap and the
- * largest production file a handful.
- */
-export const DEFAULT_BATCH_CAP = 4096;
-
 /**
  * The operators whose left side one assignment stores into. A compound assignment is
  * among them: it reads its target only to write the result back, so nothing else
@@ -564,6 +552,53 @@ export function testFileRulesOf(
     .sort((a, b) => compare(a.rule, b.rule));
 }
 
+const importedCache = new WeakMap<
+  SourceFile,
+  ReadonlyMap<string, readonly (string | undefined)[]>
+>();
+
+/**
+ * Each local name one file's imports bind, mapped to the names it imports: the
+ * exported name of a named import, `default` for a default import, and `undefined` for
+ * a namespace import or an import assignment, which binds a whole module.
+ */
+function importedNames(file: SourceFile): ReadonlyMap<string, readonly (string | undefined)[]> {
+  const known = importedCache.get(file);
+  if (known !== undefined) {
+    return known;
+  }
+  const names = new Map<string, (string | undefined)[]>();
+  const bind = (local: string, imported: string | undefined): void => {
+    names.set(local, [...(names.get(local) ?? []), imported]);
+  };
+  for (const statement of file.statements) {
+    if (isImportEqualsDeclaration(statement)) {
+      bind(statement.name.text, undefined);
+      continue;
+    }
+    const clause = isImportDeclaration(statement) ? statement.importClause : undefined;
+    if (clause === undefined) {
+      continue;
+    }
+    if (clause.name !== undefined) {
+      bind(clause.name.text, "default");
+    }
+    const bindings = clause.namedBindings;
+    if (bindings === undefined) {
+      continue;
+    }
+    if (bindings.kind === SyntaxKind.NamespaceImport) {
+      bind(bindings.name.text, undefined);
+    } else {
+      for (const element of bindings.elements) {
+        bind(element.name.text, element.propertyName?.text ?? element.name.text);
+      }
+    }
+  }
+  importedCache.set(file, names);
+  return names;
+}
+
 /** Two strings ordered bytewise, which is the order every set of a run is read in. */
 function compare(a: string, b: string): number {
   if (a === b) {
@@ -633,17 +668,42 @@ export function references<Brand>(
    * Each later link is a declaration of its own that references the next, so one link
    * per re-export is what lets a chain be followed one declaration at a time.
    */
-  const carriedBy = (link: Link, symbol: TSSymbol): readonly string[] =>
-    link.alias ? chains.nextDeclared(symbol) : chains.declarationsOf(symbol);
+  const carriedBy = (link: Link, symbol: TSSymbol): readonly ChainTarget[] =>
+    link.alias
+      ? chains.nextDeclared(symbol)
+      : chains.declarationsOf(symbol).map((id) => ({ id, stepped: false, guessed: false }));
+
+  /**
+   * Every declaration bearing the name one node spells, or the name an import of its
+   * file binds that name to, which is what a reference the checker could not resolve is
+   * counted as: it may be a use of any of them, and a declaration it may use is kept
+   * live. A name a namespace import binds may be a use of any file.
+   */
+  const named = (node: Node): readonly string[] => {
+    const byName = declarationsByName(held);
+    const text = node.getText();
+    const imported = importedNames(node.getSourceFile()).get(text) ?? [];
+    return [
+      ...new Set([
+        ...(byName.get(text) ?? []),
+        ...imported.flatMap((name) =>
+          name === undefined ? [...fileIds] : (byName.get(name) ?? []),
+        ),
+      ]),
+    ];
+  };
 
   /** The symbol one site resolves to, asking only the accessor the site's form names. */
-  const symbolFor = (site: Site, answered: ReadonlyMap<Node, TSSymbol>): TSSymbol | undefined => {
+  const symbolFor = (
+    site: Site,
+    answered: ReadonlyMap<Node, Answer<TSSymbol>>,
+  ): Answer<TSSymbol | undefined> => {
     if (site.shorthand !== undefined) {
       shorthandLookups += 1;
       return project.shorthandValueAt(project.handle(site.shorthand));
     }
     const batched = answered.get(site.node);
-    if (batched !== undefined) {
+    if (batched === UNANSWERED || typeof batched === "object") {
       return batched;
     }
     residueFallbacks += 1;
@@ -688,11 +748,14 @@ export function references<Brand>(
         ...evaluations.map((evaluation) => evaluation.node),
       ]),
     ];
-    const answered = new Map<Node, TSSymbol>();
+    const answered = new Map<Node, Answer<TSSymbol>>();
     batched += batching.length;
     for (let from = 0; from < batching.length; from += cap) {
       const run = batching.slice(from, from + cap);
-      const answers = project.symbolsAt(run.map((node) => project.handle(node)));
+      const answers = project.symbolsAt(
+        run.map((node) => project.handle(node)),
+        cap,
+      );
       fileBatches += 1;
       run.forEach((node, index) => {
         const symbol = answers[index];
@@ -708,13 +771,17 @@ export function references<Brand>(
         continue;
       }
       const position = renderPosition(file, root, link.at.getStart());
-      for (const id of carriedBy(link, symbol)) {
+      const carried =
+        symbol === UNANSWERED
+          ? named(link.at).map((id) => ({ id, stepped: false, guessed: true }))
+          : carriedBy(link, symbol);
+      for (const target of carried) {
         found.push({
           from: link.from,
-          to: id,
+          to: target.id,
           position,
           use: "read",
-          resolution: link.alias ? "alias" : "batch",
+          resolution: target.guessed ? "by-name" : link.alias ? "alias" : "batch",
           test,
         });
       }
@@ -726,14 +793,16 @@ export function references<Brand>(
         continue;
       }
       const position = renderPosition(file, root, evaluation.node.getStart());
-      for (const id of chains.declarationsOf(module)) {
+      // A module the checker could not resolve may be any file of the target.
+      const evaluated = module === UNANSWERED ? [...fileIds] : chains.declarationsOf(module);
+      for (const id of evaluated) {
         if (fileIds.has(id)) {
           found.push({
             from: evaluation.from,
             to: id,
             position,
             use: "evaluation",
-            resolution: "batch",
+            resolution: module === UNANSWERED ? "by-name" : "batch",
             test,
           });
         }
@@ -748,13 +817,21 @@ export function references<Brand>(
         return;
       }
       const position = renderPosition(file, root, read.key.getStart());
-      for (const target of chains.chainOf(symbol)) {
+      const targets =
+        symbol === UNANSWERED
+          ? (declarationsByName(held).get(read.name) ?? []).map((id) => ({
+              id,
+              stepped: false,
+              guessed: true,
+            }))
+          : chains.chainOf(symbol);
+      for (const target of targets) {
         found.push({
           from: read.from,
           to: target.id,
           position,
           use: "read",
-          resolution: "destructured",
+          resolution: target.guessed ? "by-name" : "destructured",
           test,
         });
       }
@@ -764,7 +841,7 @@ export function references<Brand>(
       const direct: Resolution =
         site.shorthand !== undefined
           ? "shorthand"
-          : answered.has(site.node)
+          : typeof answered.get(site.node) === "object"
             ? "batch"
             : "resolved-symbol";
       const symbol = symbolFor(site, answered);
@@ -774,13 +851,17 @@ export function references<Brand>(
       const position = renderPosition(file, root, site.node.getStart());
       // A re-export something imports is used and so is the declaration behind it, so
       // the use names every link of the chain its name stands at the head of.
-      for (const target of chains.chainOf(symbol)) {
+      const targets =
+        symbol === UNANSWERED
+          ? named(site.node).map((id) => ({ id, stepped: false, guessed: true }))
+          : chains.chainOf(symbol);
+      for (const target of targets) {
         found.push({
           from: site.from,
           to: target.id,
           position,
           use: site.use,
-          resolution: target.stepped ? "alias" : direct,
+          resolution: target.guessed ? "by-name" : target.stepped ? "alias" : direct,
           test,
         });
       }

package/src/reflective-lookup.ts

@@ -8,7 +8,9 @@
  * string reaches every member of that name on any type, static members included,
  * and every record names the string's own position. A key that is not literal text
  * holds nothing back: a computed name is the case no exact rule serves. `Reflect` is
- * the global one only: a local declaration of that name is a different object.
+ * the global one only: a local declaration of that name is a different object. An
+ * element access through a receiver whose type declares a string index signature, and is
+ * not `any`, reads that signature and holds nothing back.
  */
 
 import {
@@ -21,9 +23,12 @@ import {
   type Node,
   type SourceFile,
 } from "@typescript/native/unstable/ast";
+import { TypeFlags, type Type } from "@typescript/native/unstable/sync";
 import type { DetectorInput, Evidence } from "./exempt.ts";
 import { memberNames } from "./member-names.ts";
 import { renderPosition } from "./position.ts";
+import { isAnswered, UNANSWERED } from "./query.ts";
+import type { ProjectView } from "./session.ts";
 
 /** The `Reflect` methods whose second argument is a property key. */
 const REFLECT_KEYED: ReadonlySet<string> = new Set(["get", "set", "has"]);
@@ -35,6 +40,8 @@ interface Lookup {
   readonly callee: string;
   /** The `Reflect` the call names, where the lookup is a `Reflect` call. */
   readonly reflect: Node | undefined;
+  /** The expression an element access reads from, where the lookup is one. */
+  readonly receiver: Node | undefined;
 }
 
 /** The text one key denotes, where it is literal text. */
@@ -57,6 +64,7 @@ function lookupsOf(file: SourceFile): readonly Lookup[] {
           name,
           callee: `[${JSON.stringify(name)}]`,
           reflect: undefined,
+          receiver: node.expression,
         });
       }
     } else if (isCallExpression(node) && isPropertyAccessExpression(node.expression)) {
@@ -72,7 +80,13 @@ function lookupsOf(file: SourceFile): readonly Lookup[] {
         key !== undefined &&
         name !== undefined
       ) {
-        found.push({ key, name, callee: `Reflect.${method.text}`, reflect: target });
+        found.push({
+          key,
+          name,
+          callee: `Reflect.${method.text}`,
+          reflect: target,
+          receiver: undefined,
+        });
       }
     }
     node.forEachChild(visit);
@@ -81,6 +95,19 @@ function lookupsOf(file: SourceFile): readonly Lookup[] {
   return found;
 }
 
+/**
+ * Whether a receiver's type is not `any` and declares a string index signature. A type
+ * whose index signatures the checker did not answer for is read as declaring none, so
+ * the lookup retains what it names.
+ */
+function readsAMapping<Brand>(project: ProjectView<Brand>, type: Type): boolean {
+  if ((type.flags & TypeFlags.Any) !== 0) {
+    return false;
+  }
+  const infos = project.queries.indexInfosOf(type);
+  return isAnswered(infos) && infos.some((info) => (info.keyType.flags & TypeFlags.String) !== 0);
+}
+
 /**
  * The reflective-lookup detector: every member whose name a literal key of a lookup
  * spells, recorded at the key.
@@ -95,7 +122,7 @@ export function reflectiveLookup<Brand>(input: DetectorInput<Brand>): readonly E
 
   // Whether each written `Reflect` is the global one, asked in one batch: a
   // declaration of that name in one of the project's own files shadows it.
-  const ownFiles = new Set(files.map((file) => file.fileName));
+  const ownFiles = project.ownPaths();
   const reflects = lookups.flatMap((lookup) =>
     lookup.reflect === undefined ? [] : [lookup.reflect],
   );
@@ -103,21 +130,44 @@ export function reflectiveLookup<Brand>(input: DetectorInput<Brand>): readonly E
   if (reflects.length > 0) {
     project.symbolsAt(reflects.map((node) => project.handle(node))).forEach((symbol, index) => {
       const node = reflects[index];
-      const declaredHere = symbol?.declarations.some((declaration) =>
-        ownFiles.has(declaration.path),
-      );
+      // A name the checker did not answer for is read as the global, which retains.
+      const declaredHere =
+        symbol === UNANSWERED
+          ? false
+          : symbol?.declarations.some((declaration) => ownFiles.has(declaration.path));
       if (node !== undefined && declaredHere === false) {
         global.add(node);
       }
     });
   }
 
+  // An element access through a receiver that maps every string key to one value type
+  // reads that mapping rather than a member, asked in one batch.
+  const receivers = lookups.flatMap((lookup) =>
+    lookup.receiver === undefined ? [] : [lookup.receiver],
+  );
+  const mapped = new Set<Node>();
+  project.queries.typesAt(receivers).forEach((type, index) => {
+    const receiver = receivers[index];
+    if (
+      receiver !== undefined &&
+      type !== undefined &&
+      isAnswered(type) &&
+      readsAMapping(project, type)
+    ) {
+      mapped.add(receiver);
+    }
+  });
+
   const members = memberNames(files, held);
   const found: Evidence[] = [];
   for (const lookup of lookups) {
     if (lookup.reflect !== undefined && !global.has(lookup.reflect)) {
       continue;
     }
+    if (lookup.receiver !== undefined && mapped.has(lookup.receiver)) {
+      continue;
+    }
     const site = renderPosition(lookup.key.getSourceFile(), targetRoot, lookup.key.getStart());
     for (const member of members.get(lookup.name) ?? []) {
       found.push({ id: member.id, detail: `looked up by ${lookup.callee}`, site });

package/src/report.ts

@@ -18,7 +18,13 @@ import type { StaleSuppression } from "./findings/self-check.ts";
 import type { TestFileRule } from "./references.ts";
 
 /** The version of the report schema this analyzer writes a report to. */
-export const SCHEMA_VERSION = "6.0.0";
+const SCHEMA_VERSION = "6.1.0";
+
+/**
+ * Every report schema version this analyzer reads: the schema versions the Contract it
+ * implements admits, each an instance of the one it writes.
+ */
+export const SCHEMA_VERSIONS_ACCEPTED: readonly string[] = ["6.0.0", SCHEMA_VERSION];
 
 /** The name this analyzer writes every document under and mints every identifier with. */
 export const ANALYZER_NAME = "deadset-ts";
@@ -49,6 +55,7 @@ export interface WireDetails {
     readonly path?: string;
     readonly reason?: string;
   };
+  readonly overlap?: readonly string[];
 }
 
 /** One finding as the finding schema spells it. */
@@ -73,6 +80,11 @@ export interface WireFinding {
     readonly root: boolean;
     readonly symbol_count: number;
     readonly deletable_lines: number;
+    readonly members?: readonly {
+      readonly ref: string;
+      readonly name: string;
+      readonly position: WirePosition;
+    }[];
   };
   readonly retained_by: readonly string[];
   readonly configurations: readonly string[];
@@ -130,6 +142,15 @@ export interface ReportConfiguration {
   readonly project: string;
 }
 
+/** One project configuration the run derived and could not build, with why. */
+export interface ReportNotBuilt {
+  readonly id: string;
+  /** The compiler configuration file below the target root. */
+  readonly project: string;
+  /** The first line of the error that dropped it, naming no path outside the target. */
+  readonly error: string;
+}
+
 /** One consumer the run loaded, at the directory a report names it by. */
 interface ReportConsumer {
   readonly id: string;
@@ -160,7 +181,7 @@ export interface Report {
   };
   readonly target: { readonly kind: TargetKind; readonly root: string; readonly identity: string };
   readonly configurations: readonly ReportConfiguration[];
-  readonly configurations_not_built: readonly never[];
+  readonly configurations_not_built: readonly ReportNotBuilt[];
   readonly consumers: {
     readonly declared: number;
     readonly loaded: readonly {
@@ -191,6 +212,7 @@ export interface ReportInput {
   readonly declaredGaps: readonly DeclaredGap[];
   readonly target: { readonly kind: TargetKind; readonly root: string; readonly identity: string };
   readonly configurations: readonly ReportConfiguration[];
+  readonly notBuilt: readonly ReportNotBuilt[];
   readonly loaded: readonly ReportConsumer[];
   readonly unavailable: readonly UnavailableConsumer[];
   readonly result: PassResult;
@@ -247,6 +269,7 @@ function wireDetails(details: FindingDetails): WireDetails {
             ...(entry.reason === undefined ? {} : { reason: entry.reason }),
           },
         }),
+    ...(details.overlap === undefined ? {} : { overlap: details.overlap }),
   };
 }
 
@@ -275,6 +298,9 @@ export function wireFinding(finding: CompletedFinding): WireFinding {
       root: finding.component.root,
       symbol_count: finding.component.symbolCount,
       deletable_lines: finding.component.deletableLines,
+      ...(finding.component.members === undefined
+        ? {}
+        : { members: finding.component.members.map(wireSymbol) }),
     },
     retained_by: finding.retainedBy,
     configurations: finding.configurations,
@@ -409,7 +435,7 @@ export function buildReport(input: ReportInput): Report {
       name: ANALYZER_NAME,
       version: input.version,
       languages: [LANGUAGE],
-      schema_versions_accepted: [SCHEMA_VERSION],
+      schema_versions_accepted: SCHEMA_VERSIONS_ACCEPTED,
       conformance: {
         corpus_version: input.conformance.corpusVersion,
         result: input.conformance.result,
@@ -420,7 +446,9 @@ export function buildReport(input: ReportInput): Report {
     configurations: [...input.configurations]
       .sort((a, b) => compare(a.id, b.id))
       .map((one) => ({ id: one.id, project: one.project })),
-    configurations_not_built: [],
+    configurations_not_built: [...input.notBuilt]
+      .sort((a, b) => compare(a.id, b.id))
+      .map((one) => ({ id: one.id, project: one.project, error: one.error })),
     consumers: { declared: loaded.length + unavailable.length, loaded, unavailable },
     findings,
     edge_evaluations: input.result.edgeEvaluations.map(wireEvaluation).sort(byEdge),

package/src/reporters/annotations.ts

@@ -1,4 +1,5 @@
 import { fails } from "../config.ts";
+import { coalesced } from "../json-chunks.ts";
 import { KINDS } from "../kinds.ts";
 import type { Report } from "../report.ts";
 import type { RenderOptions } from "./reporter.ts";
@@ -42,26 +43,27 @@ function command(
  * failing severity is an error and one below it a warning; a stale suppression is an error,
  * because its kind is fixed on at the failing severity.
  */
-export function annotations(report: Report, options: RenderOptions): string {
-  const lines = report.findings.map((found) =>
-    command(
-      fails(found.severity, options.failOn) ? "error" : "warning",
-      found.position,
-      found.position.end_line,
-      `${found.code} ${found.kind}`,
-      found.message,
-    ),
+export function annotations(report: Report, options: RenderOptions): Iterable<string> {
+  return coalesced(
+    (function* lines(): Generator<string, void, undefined> {
+      for (const found of report.findings) {
+        yield `${command(
+          fails(found.severity, options.failOn) ? "error" : "warning",
+          found.position,
+          found.position.end_line,
+          `${found.code} ${found.kind}`,
+          found.message,
+        )}\n`;
+      }
+      for (const stale of report.stale_suppressions) {
+        yield `${command(
+          "error",
+          stale.position,
+          stale.position.line,
+          `${stale.code} ${kindName(stale.code)}`,
+          stale.message,
+        )}\n`;
+      }
+    })(),
   );
-  for (const stale of report.stale_suppressions) {
-    lines.push(
-      command(
-        "error",
-        stale.position,
-        stale.position.line,
-        `${stale.code} ${kindName(stale.code)}`,
-        stale.message,
-      ),
-    );
-  }
-  return lines.map((line) => `${line}\n`).join("");
 }

package/src/reporters/json.ts

@@ -1,7 +1,8 @@
+import { jsonChunks } from "../json-chunks.ts";
 import type { Report } from "../report.ts";
 
 /** The indentation of the report document, which with the schema's member order fixes its bytes. */
 const INDENT = 2;
 
-/** The report document itself: the report, indented, with a closing newline. */
-export const json = (report: Report): string => `${JSON.stringify(report, null, INDENT)}\n`;
+/** The report document itself, in pieces: the report, indented, with a closing newline. */
+export const json = (report: Report): Iterable<string> => jsonChunks(report, INDENT);

package/src/reporters/reporter.ts

@@ -12,8 +12,8 @@ export interface RenderOptions {
   readonly template: Template | undefined;
 }
 
-/** One rendering of a report, as the text of the file it is written to. */
-type Reporter = (report: Report, options: RenderOptions) => string;
+/** One rendering of a report, as the pieces of the file it is written to, in order. */
+type Reporter = (report: Report, options: RenderOptions) => Iterable<string>;
 
 /**
  * One format this analyzer renders: its reporter, and the suffix appended to the report's

package/src/reporters/sarif.ts

@@ -1,9 +1,9 @@
 import type { Confidence, Severity } from "../config.ts";
-import { KINDS } from "../kinds.ts";
+import { jsonChunks } from "../json-chunks.ts";
+import { KINDS, type KindRow } from "../kinds.ts";
 import type { Report, WireFinding, WireStaleSuppression } from "../report.ts";
 import { lineHashes, symbolFingerprint } from "./fingerprint.ts";
 import { RenderError, type RenderOptions } from "./reporter.ts";
-import { RULE_TEXTS } from "./rules.ts";
 import { utf8Bytes } from "./sha256.ts";
 
 const SCHEMA =
@@ -12,7 +12,7 @@ const VERSION = "2.1.0";
 /** The unit a finding's column counts. */
 const COLUMN_KIND = "utf16CodeUnits";
 const URI_BASE_ID = "%SRCROOT%";
-const ROOT_DESCRIPTION = "The target root, the directory the analyzer was run on.";
+const ROOT_DESCRIPTION = "The target root.";
 
 /** The most related locations one result carries; the report stays complete beyond them. */
 const MAX_RELATED = 100;
@@ -41,23 +41,26 @@ function firstSentence(text: string): string {
   return text;
 }
 
+/** Every live kind whose languages include one of the run's, in code order. */
+function kindsOf(languages: readonly string[]): readonly KindRow[] {
+  return [...KINDS.values()].filter((kind) =>
+    kind.languages.some((language) => languages.includes(language)),
+  );
+}
+
 /**
- * One rule per live kind of this analyzer's language, in code order, whether or not a result
+ * One rule per live kind of the run's languages, in code order, whether or not a result
  * names it, so a rule's index is the same in every run and under every configuration.
  */
-function rules(): readonly Record<string, unknown>[] {
-  return [...RULE_TEXTS].map(([code, text]) => {
-    const kind = KINDS.get(code);
-    if (kind === undefined) {
-      throw new RenderError(`the rule ${code} names no live kind`);
-    }
+function rules(kinds: readonly KindRow[]): readonly Record<string, unknown>[] {
+  return kinds.map((kind) => {
     return {
-      id: code,
+      id: kind.code,
       name: kind.name,
-      shortDescription: { text: firstSentence(text.rule) },
-      fullDescription: { text: text.rule },
+      shortDescription: { text: firstSentence(kind.rule) },
+      fullDescription: { text: kind.rule },
       help: {
-        text: text.precondition === undefined ? text.rule : `${text.rule}\n\n${text.precondition}`,
+        text: kind.precondition === undefined ? kind.rule : `${kind.rule}\n\n${kind.precondition}`,
       },
       defaultConfiguration: { level: LEVEL[kind.defaultSeverity] },
       properties: {
@@ -155,6 +158,11 @@ function relatedOf(found: WireFinding): readonly Related[] {
   for (const at of found.details.write_positions ?? []) {
     related.push({ label: "write", at, endLine: at.end_line });
   }
+  for (const one of found.component.members ?? []) {
+    if (one.ref !== found.symbol.ref) {
+      related.push({ label: "member", at: one.position, endLine: one.position.end_line });
+    }
+  }
   return related.slice(0, MAX_RELATED);
 }
 
@@ -253,9 +261,10 @@ function staleResult(
  * count it. A file the rendering cannot read, or a line it does not hold, fails the
  * rendering, because a line fingerprint computed from other bytes opens a second alert.
  */
-export function sarif(report: Report, options: RenderOptions): string {
-  const ruleList = rules();
-  const index = new Map([...RULE_TEXTS.keys()].map((code, at) => [code, at]));
+export function sarif(report: Report, options: RenderOptions): Iterable<string> {
+  const kinds = kindsOf(report.analyzer.languages);
+  const ruleList = rules(kinds);
+  const index = new Map(kinds.map((kind, at) => [kind.code, at]));
   const hashOf = lineHashCache(options.readSource);
   const results = [
     ...report.findings.map((found) => findingResult(found, index, hashOf)),
@@ -283,5 +292,5 @@ export function sarif(report: Report, options: RenderOptions): string {
       },
     ],
   };
-  return `${JSON.stringify(log, null, INDENT)}\n`;
+  return jsonChunks(log, INDENT);
 }