@cplieger/deadset-ts 7.1.0-dev.2 → 7.2.0-dev.1

package/src/intra-function-parts.ts

@@ -19,6 +19,7 @@ import {
   isCatchClause,
   isClassDeclaration,
   isClassExpression,
+  isConstructorDeclaration,
   isContinueStatement,
   isDecorator,
   isDefaultClause,
@@ -37,6 +38,7 @@ import {
   isMethodDeclaration,
   isModuleDeclaration,
   isNamespaceImport,
+  isNewExpression,
   isNoSubstitutionTemplateLiteral,
   isNumericLiteral,
   isObjectBindingPattern,
@@ -61,6 +63,7 @@ import {
   type Block,
   type CallExpression,
   type CatchClause,
+  type ConstructorDeclaration,
   type FunctionExpression,
   type Identifier,
   type Node,
@@ -68,7 +71,7 @@ import {
   type Statement,
 } from "@typescript/native/ast";
 import type { FindingPosition } from "./finding.ts";
-import { nodeKey, type Inventory } from "./inventory.ts";
+import { isParameterProperty, nodeKey, type Inventory } from "./inventory.ts";
 import { positionKey, renderPosition } from "./position.ts";
 import { isAnswered, UNANSWERED, type Answer } from "./query.ts";
 import type { Reference } from "./references.ts";
@@ -117,8 +120,10 @@ interface SignatureFact {
   readonly declaration: string;
   /** Whether the body is empty or does nothing but throw. */
   readonly stub: boolean;
-  /** Whether a class hierarchy fixes the signature: the method overrides, or is overridden. */
+  /** Whether a class hierarchy fixes the signature, or a decorator a constructor's. */
   readonly fixed: boolean;
+  /** Whether the signature is a constructor's, which its class's identifier stands for. */
+  readonly constructor: boolean;
 }
 
 /** What one project answers about the parts of its declarations. */
@@ -129,6 +134,8 @@ export interface ProjectParts {
   readonly calls: ReadonlyMap<string, CallUse>;
   /** Each name an import or an export specifier writes, by position, which uses no value. */
   readonly specifiers: ReadonlySet<string>;
+  /** Each name of {@link constructionNames}, by position, which uses no constructor as a value. */
+  readonly constructions: ReadonlySet<string>;
 }
 
 /** The codes of the parts this module reads. */
@@ -391,6 +398,50 @@ function hierarchyFixes(declared: Node, extended: ReadonlySet<string>): boolean
   return owner.name !== undefined && extended.has(owner.name.text);
 }
 
+/** Whether a decorator on a constructor's class or on one of its parameters fixes its signature. */
+function decoratorFixes(constructor: ConstructorDeclaration): boolean {
+  const owner = constructor.parent;
+  return (
+    ((owner as { readonly modifiers?: readonly Node[] }).modifiers ?? []).some(isDecorator) ||
+    constructor.parameters.some((parameter) =>
+      ((parameter as { readonly modifiers?: readonly Node[] }).modifiers ?? []).some(isDecorator),
+    )
+  );
+}
+
+/** The name an expression spells a class by: an identifier, or the member a property access names. */
+function spelledName(expression: Node): Identifier | undefined {
+  const node = unwrapped(expression);
+  if (isIdentifier(node)) {
+    return node;
+  }
+  return isPropertyAccessExpression(node) && isIdentifier(node.name) ? node.name : undefined;
+}
+
+/**
+ * The names one node writes that use a class without using its constructor as a value:
+ * the class a `new` expression calls, the class an `extends` or `implements` clause
+ * names, and the name a type reference spells.
+ */
+function constructionNames(node: Node): readonly Identifier[] {
+  if (isNewExpression(node)) {
+    return [spelledName(node.expression) ?? []].flat();
+  }
+  if (
+    isHeritageClause(node) &&
+    (isClassDeclaration(node.parent) || isClassExpression(node.parent))
+  ) {
+    return node.types.flatMap((type) =>
+      isTypeReferenceNode(type) ? [] : (spelledName(type.expression) ?? []),
+    );
+  }
+  if (isTypeReferenceNode(node)) {
+    const named = isQualifiedName(node.typeName) ? node.typeName.right : node.typeName;
+    return isIdentifier(named) ? [named] : [];
+  }
+  return [];
+}
+
 /** One declaration of the inventory that declares a function, and that function. */
 interface Declared {
   readonly id: string;
@@ -483,13 +534,17 @@ export function projectParts<Brand>(
   const signatures: SignatureFact[] = [];
   const calls = new Map<string, CallUse>();
   const specifiers = new Set<string>();
+  const constructions = new Set<string>();
   const sites: { readonly file: SourceFile; readonly declared: Declared }[] = [];
   const contextual: ContextualParameter[] = [];
 
   for (const file of files) {
+    // A parameter property's own parts stay with the parameter when its member goes.
     const declarationAt = (node: Node): string | undefined => {
       const id = held.declarations.get(nodeKey(file, node));
-      return id === undefined || kinds.get(id) === "file" ? undefined : id;
+      return id === undefined || kinds.get(id) === "file" || isParameterProperty(node)
+        ? undefined
+        : id;
     };
     // A part no declaration holds belongs to the file, which is judged while the file is live.
     const fileId = held.declarations.get(nodeKey(file, file));
@@ -543,6 +598,18 @@ export function projectParts<Brand>(
         walk.declared.push({ id, node, signature });
         covered.add(signature);
       }
+      // A constructor is no declaration, so the class it belongs to holds its parts.
+      const constructs =
+        isConstructorDeclaration(node) && node.body !== undefined
+          ? declarationAt(node.parent)
+          : undefined;
+      if (constructs !== undefined && isConstructorDeclaration(node)) {
+        walk.declared.push({ id: constructs, node, signature: node });
+        covered.add(node);
+      }
+      for (const name of constructionNames(node)) {
+        constructions.add(position(name));
+      }
       const value = covered.has(node) ? undefined : valueSignature(node);
       const valueHolder = id ?? holderOf(node);
       if (value !== undefined && valueHolder !== undefined && !isStub(value)) {
@@ -628,11 +695,15 @@ export function projectParts<Brand>(
     const ids = resolvedIds(project, [...new Set(asked)]);
 
     for (const one of walk.declared) {
-      sites.push({ file, declared: one });
+      const constructor = isConstructorDeclaration(one.node);
+      if (!constructor) {
+        sites.push({ file, declared: one });
+      }
       signatures.push({
         declaration: one.id,
         stub: isStub(one.signature),
-        fixed: hierarchyFixes(one.node, extended),
+        fixed: constructor ? decoratorFixes(one.node) : hierarchyFixes(one.node, extended),
+        constructor,
       });
       const reader = readers.get(one.signature);
       if (reader !== undefined) {
@@ -699,7 +770,13 @@ export function projectParts<Brand>(
   }
 
   parts.push(...resultParts(project, targetRoot, sites, references, calls));
-  return { parts: withContextualRead(project, parts, contextual), signatures, calls, specifiers };
+  return {
+    parts: withContextualRead(project, parts, contextual),
+    signatures,
+    calls,
+    specifiers,
+    constructions,
+  };
 }
 
 /**
@@ -722,8 +799,8 @@ function valueSignature(node: Node): SignatureNode | undefined {
 
 /**
  * Every name one function's parameters bind, a binding pattern's names one by one. A
- * `this` parameter receives no argument and a decorated one is read by its decorator, so
- * neither binds a subject.
+ * `this` parameter receives no argument, a decorated one is read by its decorator, and a
+ * parameter property is read by the write to its member, so none binds a subject.
  */
 function parameterNames(signature: SignatureNode): ParameterName[] {
   const found: ParameterName[] = [];
@@ -750,7 +827,8 @@ function parameterNames(signature: SignatureNode): ParameterName[] {
   signature.parameters.forEach((parameter, at) => {
     const name = parameter.name;
     if (
-      ((parameter as { readonly modifiers?: readonly Node[] }).modifiers ?? []).some(isDecorator)
+      ((parameter as { readonly modifiers?: readonly Node[] }).modifiers ?? []).some(isDecorator) ||
+      isParameterProperty(parameter)
     ) {
       return;
     }
@@ -1096,7 +1174,7 @@ export function intraFunctionFacts(
     for (const [at, value] of one.calls) {
       calls.set(at, value);
     }
-    for (const at of one.specifiers) {
+    for (const at of [...one.specifiers, ...one.constructions]) {
       specifiers.add(at);
     }
   }
@@ -1127,10 +1205,16 @@ export function intraFunctionFacts(
       .map((one) => one.declaration)
       .filter((id) => !fixed.has(id) && !exempted.has(id) && !valued.has(id)),
   );
+  // A class used as a value fixes its constructor's whole signature, whatever reads follow.
+  const constructors = new Set(
+    signatures.filter((one) => one.constructor).map((one) => one.declaration),
+  );
   const freeButValued = new Set(
     signatures
       .map((one) => one.declaration)
-      .filter((id) => !fixed.has(id) && !exempted.has(id) && valued.has(id)),
+      .filter(
+        (id) => !fixed.has(id) && !exempted.has(id) && valued.has(id) && !constructors.has(id),
+      ),
   );
   // Awaiting a thenable result sequences on it, so a call that awaits one uses it.
   const sequenced = new Set(

package/src/inventory.ts

@@ -1,6 +1,7 @@
 import {
   isClassDeclaration,
   isComputedPropertyName,
+  isConstructorDeclaration,
   isEnumDeclaration,
   isEnumMember,
   isExportAssignment,
@@ -15,6 +16,7 @@ import {
   isModuleBlock,
   isModuleDeclaration,
   isNamespaceExport,
+  isParameterDeclaration,
   isParenthesizedTypeNode,
   isPrivateIdentifier,
   isPropertyDeclaration,
@@ -26,6 +28,7 @@ import {
   isUnionTypeNode,
   isVariableStatement,
   ModifierFlags,
+  type ClassDeclaration,
   type Node,
   type SourceFile,
 } from "@typescript/native/ast";
@@ -490,6 +493,26 @@ function unnamedStart(node: Node): number {
   return prefix === null ? start : start + prefix[0].length;
 }
 
+/**
+ * Whether one node is a parameter property: a constructor parameter carrying an
+ * accessibility, `readonly` or `override` modifier, which also declares an instance
+ * member of the class, with the parameter's node as the member's declaration.
+ */
+export function isParameterProperty(node: Node): boolean {
+  return (
+    isParameterDeclaration(node) &&
+    isConstructorDeclaration(node.parent) &&
+    (modifiersOf(node) & ModifierFlags.ParameterPropertyModifier) !== 0
+  );
+}
+
+/** The parameter properties every constructor of one class declares. */
+function parameterPropertiesOf(node: ClassDeclaration): readonly Node[] {
+  return node.members.flatMap((member) =>
+    isConstructorDeclaration(member) ? member.parameters.filter(isParameterProperty) : [],
+  );
+}
+
 /** The kind a class element takes: a method, or a property or accessor. */
 function classMemberKind(node: Node): SymbolKind {
   return isMethodDeclaration(node) ? "method" : "class-member";
@@ -647,7 +670,7 @@ export function inventory<Brand>(
         owner: record,
         declaration: node,
         nameNode: node.name,
-        members: node.members,
+        members: [...node.members, ...parameterPropertiesOf(node)],
         memberKind: "class-member",
         isClass: true,
         membersAreExports: false,
@@ -974,7 +997,8 @@ export function inventory<Brand>(
         isPropertyDeclaration(node) ||
         isMethodDeclaration(node) ||
         isGetAccessorDeclaration(node) ||
-        isSetAccessorDeclaration(node)
+        isSetAccessorDeclaration(node) ||
+        isParameterProperty(node)
       ) {
         return classMemberKind(node);
       }

package/src/kinds.ts

@@ -191,7 +191,7 @@ const ROWS: readonly KindRow[] = [
     code: "DS1301",
     name: "write-only-symbol",
     languages: ["go", "ts"],
-    rule: "A package-level or module-level variable, struct field, class member, type member or collection that production code writes and never reads. In production mode a read from a test file counts as no read. A write from a loaded consumer's code counts as a read, because the deletion the finding names would break a consumer the target does not own. A write in a consumer's test file counts as a read in the run that counts test references. It counts in a production sweep only where the configuration counts consumer tests as production. A comparison of struct values reads every field of the type: in Go, a value of a struct type used as an operand of `==` or `!=`, as a map key, or as a `switch` tag or `case` expression is a read of every field of that type, transitively through the fields of every struct type it holds, recorded at the comparison, because equality reads every field and a field that decides equality carries information. In Go a type argument the program instantiates a type parameter with, where the parameter's constraint is `comparable` or embeds it, is compared as an operand of `==` of that type is, recorded at the instantiation, so the struct values `slices.Equal`, `slices.Index` or `maps.Equal` compares have every field read. `reflect.DeepEqual` is not a comparison under this rule. In Go, a conversion the compiler accepts between two struct types, or between two pointer types that are not named types and whose base types are struct types, reads every field of the two struct types where their struct type literals are distinct, recorded at the conversion, because the conversion is legal only while their fields are identical, ignoring tags, and so no field of either can be deleted alone. It reads in the same way every field of each pair of distinct struct type literals the identity of the two types compares in turn: through each field's type, and from there through the element, key, base, parameter and result types of the type literals it reaches, through the method signatures of an interface type literal, and through the type arguments of an instantiated generic type. A field reached there has no reference of its own, as grammar/symbol-ref.md states, so it is never a subject and those reads hold no finding back. It stops at a defined type, whose fields the conversion does not read, because a defined type is identical to itself whatever fields it declares. A pair whose two sides are one struct type literal, the two struct types themselves included, as where one type is declared from the other or the conversion is to the operand's own type, reads nothing, because a field deleted from that literal leaves both sides identical. Where the operand's type or the conversion's type is a type parameter, the struct type its constraint's core type is takes that side's place, and a type parameter operand reads in the same way the fields of each struct type argument an instantiation the program holds gives it, an instantiation made through another generic declaration's own type parameters included. A conversion to any other type, an interface type among them, reads no field under this rule. In TypeScript a comparison of two object references reads no member, because `===` compares identity and never a member. In TypeScript a property of an object literal writes the member of the same name that the literal's contextual type declares, whether or not the compiler checks the literal for excess properties. Where that contextual type is a union or an intersection, the property writes the member of that name on each constituent that declares one. So a literal that a declaration annotates, a function returns, a call passes or a `satisfies` expression checks writes the members of the type it is given. An object literal handed to a callee the target does not implement has its members read, as grammar/analysis.md states. A store through the value a field or a member holds reads that field or member rather than writing it, because the store lands in storage every other holder of the value reads. In Go that store is an assignment, an increment, a compound assignment or a `delete` whose target is reached through a struct field holding a map, a slice or a pointer. Examples are `s.f[k] = v`, `s.f.x = v` and `delete(s.f, k)`. The same store through a field holding an array or a struct is a store into the field itself. TypeScript holds every object by reference, so an element or property store through a member's value reads the member. The finding names each write position, so the deletion set is visible. Deleting the subject and its writes also deletes every declaration whose only uses they hold. Such a declaration is a type parameter of the subject's declaring type that the subject's type alone names, an import binding the writes alone use, or a declaration whose every use is in the type annotation of the subject or of another subject this rule reports, or in the writes those findings name. The finding's message names each such declaration, and no finding is reported about the declaration itself.",
+    rule: "A package-level or module-level variable, struct field, class member, type member or collection that production code writes and never reads. In production mode a read from a test file counts as no read. A write from a loaded consumer's code counts as a read, because the deletion the finding names would break a consumer the target does not own. A write in a consumer's test file counts as a read in the run that counts test references. It counts in a production sweep only where the configuration counts consumer tests as production. A comparison of struct values reads every field of the type: in Go, a value of a struct type used as an operand of `==` or `!=`, as a map key, or as a `switch` tag or `case` expression is a read of every field of that type, transitively through the fields of every struct type it holds, recorded at the comparison, because equality reads every field and a field that decides equality carries information. In Go a type argument the program instantiates a type parameter with, where the parameter's constraint is `comparable` or embeds it, is compared as an operand of `==` of that type is, recorded at the instantiation, so the struct values `slices.Equal`, `slices.Index` or `maps.Equal` compares have every field read. `reflect.DeepEqual` is not a comparison under this rule. In Go, a conversion the compiler accepts between two struct types, or between two pointer types that are not named types and whose base types are struct types, reads every field of the two struct types where their struct type literals are distinct, recorded at the conversion, because the conversion is legal only while their fields are identical, ignoring tags, and so no field of either can be deleted alone. It reads in the same way every field of each pair of distinct struct type literals the identity of the two types compares in turn: through each field's type, and from there through the element, key, base, parameter and result types of the type literals it reaches, through the method signatures of an interface type literal, and through the type arguments of an instantiated generic type. A field reached there has no reference of its own, as grammar/symbol-ref.md states, so it is never a subject and those reads hold no finding back. It stops at a defined type, whose fields the conversion does not read, because a defined type is identical to itself whatever fields it declares. A pair whose two sides are one struct type literal, the two struct types themselves included, as where one type is declared from the other or the conversion is to the operand's own type, reads nothing, because a field deleted from that literal leaves both sides identical. Where the operand's type or the conversion's type is a type parameter, the struct type its constraint's core type is takes that side's place, and a type parameter operand reads in the same way the fields of each struct type argument an instantiation the program holds gives it, an instantiation made through another generic declaration's own type parameters included. A conversion to any other type, an interface type among them, reads no field under this rule. In TypeScript a comparison of two object references reads no member, because `===` compares identity and never a member. A TypeScript parameter property, a constructor parameter that carries a modifier, declares a member of its class that the constructor writes with its argument, so the member is judged under this rule, and under every rule that reads a class member, as a member the class body declares is. In TypeScript a property of an object literal writes the member of the same name that the literal's contextual type declares, whether or not the compiler checks the literal for excess properties. Where that contextual type is a union or an intersection, the property writes the member of that name on each constituent that declares one. So a literal that a declaration annotates, a function returns, a call passes or a `satisfies` expression checks writes the members of the type it is given. An object literal handed to a callee the target does not implement has its members read, as grammar/analysis.md states. A store through the value a field or a member holds reads that field or member rather than writing it, because the store lands in storage every other holder of the value reads. In Go that store is an assignment, an increment, a compound assignment or a `delete` whose target is reached through a struct field holding a map, a slice or a pointer. Examples are `s.f[k] = v`, `s.f.x = v` and `delete(s.f, k)`. The same store through a field holding an array or a struct is a store into the field itself. TypeScript holds every object by reference, so an element or property store through a member's value reads the member. The finding names each write position, so the deletion set is visible. Deleting the subject and its writes also deletes every declaration whose only uses they hold. Such a declaration is a type parameter of the subject's declaring type that the subject's type alone names, an import binding the writes alone use, or a declaration whose every use is in the type annotation of the subject or of another subject this rule reports, or in the writes those findings name. The finding's message names each such declaration, and no finding is reported about the declaration itself.",
     defaultSeverity: "deny",
     maxClass: "certain",
     fixability: "deletable",
@@ -332,7 +332,7 @@ const ROWS: readonly KindRow[] = [
     languages: ["go", "ts"],
     rule: "A parameter with no reference inside its function body, on a function whose signature is free to change.",
     precondition:
-      "The signature must be free, defined as follows: the function is not a method retained by interface satisfaction, is not a method whose name and signature are those of a method of an exported interface type declared by a package outside the target that the import closure holds, is not used as a value, is not a go:linkname or cgo target, is not a function the Go test driver runs (a test, benchmark or fuzz test of a test file, or TestMain), and is not a stub whose body is empty or only panics. A function literal or function expression that initializes a variable the program only calls, never passing, storing, returning or assigning it, is called by name and is not used as a value. A parameter its body never names is dead whatever the callers, so a published declaration of a library is reported too, with the fixability the vocabulary gives the kind: the signature change is a breaking change. In TypeScript a caller may pass a function used as a value more arguments than it declares parameters, so in such a function whose signature is free but for that use, a parameter its body never reads is reported when its body reads no parameter after it, and an unread parameter before the last read one is not. A parameter of a TypeScript function expression or arrow function that the compiler gives a contextual type is not reported when it carries a type annotation, because the inference of the call that holds the function may read the annotation, or when it is an object binding pattern, because the pattern reads each property it names from the argument and the code that hands the argument may act on that read. No name such a pattern binds is reported either. Any other TypeScript parameter that is a binding pattern is judged by the names it binds: each name the body never reads is reported wherever the pattern stands, because removing it from the pattern moves no argument, except a name beside a rest element of the same object pattern, whose removal changes what that element holds, and the pattern counts as a read parameter when the body reads any name it binds. A rest parameter is judged as the last parameter. A TypeScript `this` parameter declares the type of `this` and receives no argument, so it is never reported. No name exempts a parameter. A TypeScript parameter whose name starts with an underscore is judged as any other is, and a Go parameter named by the blank identifier declares no name a body could read and is never reported.",
+      "The signature must be free, defined as follows: the function is not a method retained by interface satisfaction, is not a method whose name and signature are those of a method of an exported interface type declared by a package outside the target that the import closure holds, is not used as a value, is not a go:linkname or cgo target, is not a function the Go test driver runs (a test, benchmark or fuzz test of a test file, or TestMain), and is not a stub whose body is empty or only panics. A function literal or function expression that initializes a variable the program only calls, never passing, storing, returning or assigning it, is called by name and is not used as a value. A parameter its body never names is dead whatever the callers, so a published declaration of a library is reported too, with the fixability the vocabulary gives the kind: the signature change is a breaking change. In TypeScript a caller may pass a function used as a value more arguments than it declares parameters, so in such a function whose signature is free but for that use, a parameter its body never reads is reported when its body reads no parameter after it, and an unread parameter before the last read one is not. A parameter of a TypeScript function expression or arrow function that the compiler gives a contextual type is not reported when it carries a type annotation, because the inference of the call that holds the function may read the annotation, or when it is an object binding pattern, because the pattern reads each property it names from the argument and the code that hands the argument may act on that read. No name such a pattern binds is reported either. Any other TypeScript parameter that is a binding pattern is judged by the names it binds: each name the body never reads is reported wherever the pattern stands, because removing it from the pattern moves no argument, except a name beside a rest element of the same object pattern, whose removal changes what that element holds, and the pattern counts as a read parameter when the body reads any name it binds. A rest parameter is judged as the last parameter. A TypeScript `this` parameter declares the type of `this` and receives no argument, so it is never reported. A TypeScript constructor is used as a value where its class is used as a value other than as the callee of a `new` expression or the class an `extends` clause names, and its signature is not free where its class carries a decorator or a parameter of the constructor carries one, because the code that decorator or a container runs may construct the class. A parameter property is read by the write to its member the constructor makes, so it is never reported under this kind, and its member is judged under DS1301. No name exempts a parameter. A TypeScript parameter whose name starts with an underscore is judged as any other is, and a Go parameter named by the blank identifier declares no name a body could read and is never reported.",
     defaultSeverity: "warn",
     maxClass: "certain",
     fixability: "manual",

package/src/ref.ts

@@ -27,10 +27,11 @@ const TS_COMPUTED = String.raw`\[[^\]\r\n\t ]+\]`;
 const TS_HEAD = `(?:${TS_IDENT}|${TS_QUOTED})`;
 const TS_MEMBER = `(?:${TS_IDENT}|#${TS_IDENT}|${TS_QUOTED}|${TS_COMPUTED})`;
 const TS_PACKAGE = String.raw`(?:@[A-Za-z0-9._-]+/)?[A-Za-z0-9._-]+`;
-const TS_FILE = String.raw`(?:[^/#\r\n]+/)*[^/#\r\n]+(?:(?:\.d)?\.[mc]?ts|\.tsx|\.[mc]?js|\.jsx)`;
+const TS_DIRS = String.raw`(?:[^/#\r\n]+/)*`;
+const TS_FILE = String.raw`${TS_DIRS}[^/#\r\n]+(?:(?:\.d)?\.[mc]?ts|\.tsx|\.[mc]?js|\.jsx)`;
 
 const SCOPE = `${PREFIX}${TS_PACKAGE}/${TS_FILE}`;
-const MANIFEST_SCOPE = `${PREFIX}${TS_PACKAGE}/package\\.json`;
+const MANIFEST_SCOPE = `${PREFIX}${TS_PACKAGE}/${TS_DIRS}package\\.json`;
 
 /**
  * One expression per form the grammar defines, each anchored and each the whole of

package/src/references.ts

@@ -32,6 +32,7 @@ import {
   isVoidExpression,
   SyntaxKind,
   type Node,
+  type ParameterDeclaration,
   type SourceFile,
 } from "@typescript/native/ast";
 import type { Symbol as TSSymbol } from "@typescript/native/sync";
@@ -41,7 +42,13 @@ import { destructuring, propertyReadsOf, type PropertyRead } from "./destructuri
 import { specifierCandidates } from "./configuration-files.ts";
 import { namespaceUses } from "./namespace-objects.ts";
 import { globExpression } from "./glob.ts";
-import { declarationsByName, nodeKey, type Inventory, type InventorySymbol } from "./inventory.ts";
+import {
+  declarationsByName,
+  isParameterProperty,
+  nodeKey,
+  type Inventory,
+  type InventorySymbol,
+} from "./inventory.ts";
 import { augmentationReferences } from "./augmentations.ts";
 import { elementAccessReferences } from "./element-access.ts";
 import { indexedAccessReferences } from "./indexed-access.ts";
@@ -478,6 +485,13 @@ interface Decorated {
   readonly declaration: string;
 }
 
+/** One parameter property, which its constructor writes, and the declaration that writes it. */
+interface ParameterWrite {
+  readonly name: Node;
+  readonly from: string;
+  readonly member: string;
+}
+
 /** One property a pattern reads, and the declaration the pattern is written inside. */
 interface Read extends PropertyRead {
   readonly from: string;
@@ -494,6 +508,7 @@ interface FileSites {
   readonly wholes: readonly WholeRead[];
   readonly urls: readonly ModuleURL[];
   readonly decorated: readonly Decorated[];
+  readonly parameterWrites: readonly ParameterWrite[];
   readonly keyed: readonly KeyedAccess[];
 }
 
@@ -682,6 +697,7 @@ function sitesOf(
   const wholes: WholeRead[] = [];
   const urls: ModuleURL[] = [];
   const decorated: Decorated[] = [];
+  const parameterWrites: ParameterWrite[] = [];
   const namespaces = namespaceUses(file);
   const literals: LiteralAt[] = [];
   const flows: FlowAt[] = [];
@@ -766,7 +782,15 @@ function sitesOf(
     }
     const held = declarations.get(nodeKey(file, node));
     const outer = enclosing;
-    if (held !== undefined) {
+    // A parameter property's annotation, initializer and decorators stay with the
+    // parameter when the member goes, so they are written inside the constructor's class.
+    if (held !== undefined && isParameterProperty(node)) {
+      parameterWrites.push({
+        name: (node as ParameterDeclaration).name,
+        from: outer,
+        member: held,
+      });
+    } else if (held !== undefined) {
       enclosing = held;
       for (const modifier of (node as { readonly modifiers?: readonly Node[] }).modifiers ?? []) {
         if (isDecorator(modifier)) {
@@ -789,6 +813,7 @@ function sitesOf(
     wholes,
     urls,
     decorated,
+    parameterWrites,
     keyed,
   };
 }
@@ -884,15 +909,12 @@ function importedNames(file: SourceFile): ReadonlyMap<string, readonly (string |
   return names;
 }
 
-/**
- * The name node of every import binding one file's top level declares, and whether it
- * binds a whole module.
- */
-function importBindings(file: SourceFile): readonly { node: Node; whole: boolean }[] {
-  const found: { node: Node; whole: boolean }[] = [];
+/** The name node of every import binding one file's top level declares. */
+function importBindings(file: SourceFile): readonly { node: Node }[] {
+  const found: { node: Node }[] = [];
   for (const statement of file.statements) {
     if (isImportEqualsDeclaration(statement)) {
-      found.push({ node: statement.name, whole: true });
+      found.push({ node: statement.name });
       continue;
     }
     const clause = isImportDeclaration(statement) ? statement.importClause : undefined;
@@ -900,16 +922,16 @@ function importBindings(file: SourceFile): readonly { node: Node; whole: boolean
       continue;
     }
     if (clause.name !== undefined) {
-      found.push({ node: clause.name, whole: false });
+      found.push({ node: clause.name });
     }
     const bindings = clause.namedBindings;
     if (bindings === undefined) {
       continue;
     }
     if (bindings.kind === SyntaxKind.NamespaceImport) {
-      found.push({ node: bindings.name, whole: true });
+      found.push({ node: bindings.name });
     } else {
-      found.push(...bindings.elements.map((element) => ({ node: element.name, whole: false })));
+      found.push(...bindings.elements.map((element) => ({ node: element.name })));
     }
   }
   return found;
@@ -1286,6 +1308,7 @@ export function references<Brand>(
     wholes,
     urls,
     decorated,
+    parameterWrites,
     keyed,
   } of walked) {
     const test = testFile.get(file) === true;
@@ -1307,6 +1330,18 @@ export function references<Brand>(
       });
     }
 
+    // The constructor stores its argument in the member a parameter property declares.
+    for (const { name, from, member } of parameterWrites) {
+      found.push({
+        from,
+        to: member,
+        position: renderPosition(file, root, name.getStart()),
+        use: "write",
+        resolution: "syntax",
+        test,
+      });
+    }
+
     // One batch per capped run of the file's name nodes, the re-exports' nodes after
     // the uses and the evaluated modules' specifiers last, each node once: a bare star
     // re-export's specifier is a link and an evaluation both. A shorthand is left out
@@ -1456,15 +1491,14 @@ export function references<Brand>(
           symbol === UNANSWERED
             ? named(binding.node).map((id) => ({ id, stepped: false, guessed: true }))
             : chains.chainOf(symbol);
-        // The markup may name any export of a module a binding holds whole.
-        const targets = binding.whole
-          ? chained.flatMap((target) => [
-              target,
-              ...declaredIn(target.id)
-                .filter((one) => one.exported)
-                .map((one) => ({ ...target, id: one.id })),
-            ])
-          : chained;
+        // The markup may name any export of a module a binding's chain reaches, whether a
+        // namespace import binds it or a named or default import of a namespace re-export.
+        const targets = chained.flatMap((target) => [
+          target,
+          ...declaredIn(target.id)
+            .filter((one) => one.exported)
+            .map((one) => ({ ...target, id: one.id })),
+        ]);
         for (const target of targets) {
           found.push({
             from: fileId,

package/src/report.ts

@@ -19,7 +19,7 @@ import type { StaleSuppression } from "./findings/self-check.ts";
 import type { TestFileRule } from "./references.ts";
 
 /** The version of the report schema this analyzer writes a report to. */
-const SCHEMA_VERSION = "8.1.0";
+const SCHEMA_VERSION = "8.2.0";
 
 /** Every report schema version this analyzer reads: the one the Contract it implements admits. */
 export const SCHEMA_VERSIONS_ACCEPTED: readonly string[] = [SCHEMA_VERSION];

package/src/resolve.ts

@@ -19,6 +19,7 @@ import {
   type Sort,
   type Source,
   type TargetKind,
+  type TargetKindSetting,
   type TemplateDelimiters,
 } from "./config.ts";
 import { CONVENTION_ROWS } from "./convention-rows.ts";
@@ -57,9 +58,9 @@ const PROJECT_MEMBER = "project";
 
 /**
  * One segment of a project path: not empty, not `.` or `..`, and holding no
- * solidus, backslash or line break.
+ * solidus or control character.
  */
-const PROJECT_SEGMENT = String.raw`(?:[^/\\.\r\n][^/\\\r\n]*|\.[^/\\.\r\n][^/\\\r\n]*|\.\.[^/\\\r\n]+)`;
+const PROJECT_SEGMENT = String.raw`(?:[^/.\x00-\x1f\x7f][^/\x00-\x1f\x7f]*|\.[^/.\x00-\x1f\x7f][^/\x00-\x1f\x7f]*|\.\.[^/\x00-\x1f\x7f]+)`;
 
 /**
  * A project path: segments joined by a solidus, so the path is relative, below
@@ -85,7 +86,7 @@ const CASCADES: readonly Cascade[] = ["roots", "full"];
  */
 interface Doc {
   readonly contractVersion: string | undefined;
-  readonly targetKind: TargetKind | undefined;
+  readonly targetKind: TargetKindSetting | undefined;
   readonly languages: readonly Language[] | undefined;
   readonly minConfidence: Confidence | undefined;
   readonly generatedFiles: GeneratedFiles | undefined;
@@ -281,6 +282,55 @@ function readStrings<T extends string>(
   return value as readonly T[];
 }
 
+/**
+ * The target kind, a string or an object naming every language. The walk has
+ * already refused an undeclared member, so an object is refused for the first
+ * language it leaves out, then for the first language whose value is refused,
+ * each in the vocabulary's language order.
+ */
+function readTargetKind(
+  target: Record<string, unknown> | undefined,
+  label: string,
+): TargetKindSetting | undefined {
+  const value = member(target, "kind");
+  const perLanguage = `an object naming the kind of each of ${spell(LANGUAGES)}`;
+  if (value === undefined) {
+    return undefined;
+  }
+  if (typeof value === "string") {
+    if (!(TARGET_KINDS as readonly string[]).includes(value)) {
+      throw malformed(
+        label,
+        "target.kind",
+        `${JSON.stringify(value)} is not one of ${spell(TARGET_KINDS)}, nor ${perLanguage}`,
+      );
+    }
+    return value as TargetKind;
+  }
+  if (!isRecord(value)) {
+    throw malformed(
+      label,
+      "target.kind",
+      `${JSON.stringify(value)} is neither one of ${spell(TARGET_KINDS)} nor ${perLanguage}`,
+    );
+  }
+  const missing = LANGUAGES.find((language) => !Object.hasOwn(value, language));
+  if (missing !== undefined) {
+    throw malformed(label, `target.kind.${missing}`, `is not set, and ${perLanguage} names each`);
+  }
+  for (const language of LANGUAGES) {
+    const kind = value[language];
+    if (typeof kind !== "string" || !(TARGET_KINDS as readonly string[]).includes(kind)) {
+      throw malformed(
+        label,
+        `target.kind.${language}`,
+        `${JSON.stringify(kind)} is not one of ${spell(TARGET_KINDS)}`,
+      );
+    }
+  }
+  return { go: value["go"] as TargetKind, ts: value["ts"] as TargetKind };
+}
+
 /** A component file's extension: a full stop followed by letters and digits. */
 const COMPONENT_EXTENSION = /^\.[A-Za-z0-9]+$/u;
 
@@ -355,7 +405,7 @@ function readProject(
       label,
       path,
       `${JSON.stringify(project)} is not a path below the target root: segments joined by /, ` +
-        "none empty, . or .., and no backslash or line break",
+        "none empty, . or .., and no control character",
     );
   }
   return { shape: "project", id, project };
@@ -795,7 +845,7 @@ function readDoc(value: unknown, label: string): Doc {
 
   return {
     contractVersion,
-    targetKind: readEnum(target, "kind", "target.kind", label, TARGET_KINDS),
+    targetKind: readTargetKind(target, label),
     languages: readStrings(analysis, "languages", "analysis.languages", label, 0, LANGUAGES),
     minConfidence: readEnum(
       analysis,
@@ -1052,7 +1102,7 @@ function settleAll(inputs: Inputs): { config: Config; provenance: Map<string, Or
 
   const config: Config = {
     contractVersion: at("contract_version", defaults.contractVersion, (doc) => doc.contractVersion),
-    targetKind: at<TargetKind | "">("target.kind", "", (doc) => doc.targetKind),
+    targetKind: at<TargetKindSetting | "">("target.kind", "", (doc) => doc.targetKind),
     analysis: {
       languages: at("analysis.languages", defaults.analysis.languages, (doc) => doc.languages),
       minConfidence: at(