@cplieger/deadset-ts 7.2.0-dev.4 → 8.0.0-dev.10

package/dist/src/references.js

@@ -1,12 +1,12 @@
-import { isArrayLiteralExpression, isAsExpression, isBinaryExpression, isCallExpression, isDecorator, isDeleteExpression, isElementAccessExpression, isExportDeclaration, isExpressionStatement, isExternalModuleReference, isForInStatement, isForOfStatement, isForStatement, isIdentifier, isImportDeclaration, isImportEqualsDeclaration, isMetaProperty, isNewExpression, isNamespaceExport, isNoSubstitutionTemplateLiteral, isObjectLiteralExpression, isParenthesizedExpression, isPostfixUnaryExpression, isPrefixUnaryExpression, isPropertyAccessExpression, isPropertyAssignment, isShorthandPropertyAssignment, isSpreadAssignment, isSpreadElement, isStringLiteral, isVoidExpression, SyntaxKind, } from "@typescript/native/ast";
+import { isArrayLiteralExpression, isAsExpression, isBinaryExpression, isCallExpression, isDecorator, isDeleteExpression, isElementAccessExpression, isExportDeclaration, isExpressionStatement, isExternalModuleReference, isForInStatement, isForOfStatement, isForStatement, isIdentifier, isImportDeclaration, isImportEqualsDeclaration, isInterfaceDeclaration, isMetaProperty, isModuleBlock, isModuleDeclaration, isNewExpression, isNamespaceExport, isNoSubstitutionTemplateLiteral, isObjectLiteralExpression, isParenthesizedExpression, isPostfixUnaryExpression, isPrefixUnaryExpression, isPropertyAccessExpression, isPropertyAssignment, isShorthandPropertyAssignment, isSpreadAssignment, isSpreadElement, isStringLiteral, isVoidExpression, SyntaxKind, } from "@typescript/native/ast";
+import { parenthesesRemoved } from "./unwrap.js";
 import { aliasChains } from "./alias-chain.js";
 import { contextualUses } from "./contextual-uses.js";
 import { destructuring, propertyReadsOf } from "./destructuring.js";
 import { specifierCandidates } from "./configuration-files.js";
 import { namespaceUses } from "./namespace-objects.js";
-import { globExpression } from "./glob.js";
 import { declarationsByName, isParameterProperty, nodeKey, } from "./inventory.js";
-import { augmentationReferences } from "./augmentations.js";
+import { ambientGlobalInterfaces, augmentationReferences } from "./augmentations.js";
 import { elementAccessReferences } from "./element-access.js";
 import { indexedAccessReferences } from "./indexed-access.js";
 import { keyofComparisonReferences } from "./keyof-comparisons.js";
@@ -16,9 +16,12 @@ import { overrideReferences } from "./overrides.js";
 import { dirnamePath, queriedModulePath, relativePath, resolvePath } from "./paths.js";
 import { byPosition, isComponentFile, renderPosition } from "./position.js";
 import { DEFAULT_BATCH_CAP, propertyTables, UNANSWERED } from "./query.js";
+import { typeParameterReads } from "./type-parameter-reads.js";
 import { typeQueryAliases } from "./type-query-alias.js";
-import { computedKeyNames, keyNameOf, keyedUses } from "./symbol-keys.js";
+import { computedKeyNames, iterationReferences, keyNameOf, keyedUses, } from "./symbol-keys.js";
 import { handedOn, valuesOf } from "./value-flow.js";
+import { bytewise } from "./text/compare.js";
+import { globExpression } from "./text/glob.js";
 /**
  * The operators whose left side one assignment stores into. A compound assignment is
  * among them: where its value is discarded it reads its target only to write the result
@@ -76,14 +79,6 @@ function valueDiscarded(node) {
 function isName(node) {
     return node.kind === SyntaxKind.Identifier || node.kind === SyntaxKind.PrivateIdentifier;
 }
-/** The expression one node is, through however many parentheses are written around it. */
-function unparenthesized(node) {
-    let held = node;
-    while (isParenthesizedExpression(held)) {
-        held = held.expression;
-    }
-    return held;
-}
 /**
  * Records the name one store writes into.
  *
@@ -93,7 +88,7 @@ function unparenthesized(node) {
  * target writes each name it binds, through its spreads and nested patterns.
  */
 function markWrite(target, writes, accesses) {
-    const held = unparenthesized(target);
+    const held = parenthesesRemoved(target);
     if (isName(held)) {
         writes.add(held.pos);
         return;
@@ -108,7 +103,7 @@ function markWrite(target, writes, accesses) {
         accesses.add(held);
         // A store through a member's value lands in storage every holder of the value
         // reads, so it reads the member; a variable only ever stored into stays written.
-        if (!isPropertyAccessExpression(unparenthesized(held.expression))) {
+        if (!isPropertyAccessExpression(parenthesesRemoved(held.expression))) {
             markWrite(held.expression, writes, accesses);
         }
         return;
@@ -180,7 +175,7 @@ function markStores(node, writes, reads, accesses) {
 }
 /** Whether one node is `import.meta.url`. */
 function isImportMetaURL(node) {
-    const at = unparenthesized(node);
+    const at = parenthesesRemoved(node);
     return (isPropertyAccessExpression(at) &&
         isMetaProperty(at.expression) &&
         at.expression.keywordToken === SyntaxKind.ImportKeyword &&
@@ -189,7 +184,7 @@ function isImportMetaURL(node) {
 /** The module URL one node builds, where it builds one. */
 function moduleURLOf(node) {
     const relative = (argument) => {
-        const at = argument === undefined ? undefined : unparenthesized(argument);
+        const at = argument === undefined ? undefined : parenthesesRemoved(argument);
         return at !== undefined &&
             (isStringLiteral(at) || isNoSubstitutionTemplateLiteral(at)) &&
             /^\.\.?\//u.test(at.text)
@@ -204,7 +199,7 @@ function moduleURLOf(node) {
             : undefined;
     }
     if (isCallExpression(node)) {
-        const callee = unparenthesized(node.expression);
+        const callee = parenthesesRemoved(node.expression);
         const specifier = relative(node.arguments[0]);
         if (specifier !== undefined &&
             isPropertyAccessExpression(callee) &&
@@ -489,7 +484,7 @@ export function testFileRulesOf(testFiles, paths, supportFiles = []) {
             };
         }),
         ...(support === 0 ? [] : [{ rule: TEST_SUPPORT_RULE, matched: support }]),
-    ].sort((a, b) => compare(a.rule, b.rule));
+    ].sort((a, b) => bytewise(a.rule, b.rule));
 }
 const importedCache = new WeakMap();
 /**
@@ -608,20 +603,13 @@ function aloneIn(file, uses, writes, found) {
             .filter(([, nodes]) => nodes.some((node) => inside(node, write.value)) &&
             nodes.every((node) => sameTarget.some((one) => inside(node, one.value))))
             .map(([name]) => name)
-            .sort(compare);
+            .sort(bytewise);
         if (names.length > 0) {
             result.push({ index: write.index, names });
         }
     }
     return result;
 }
-/** Two strings ordered bytewise, which is the order every set of a run is read in. */
-function compare(a, b) {
-    if (a === b) {
-        return 0;
-    }
-    return a < b ? -1 : 1;
-}
 /**
  * Every reference one project's own files make to the project's own declarations, in
  * position order, and the files the test-file rules classified.
@@ -1134,6 +1122,37 @@ export function references(project, held, targetRoot, options) {
             }
         }
     }
+    /** The ambient global interfaces of the walked files that merge into a declaration outside the project's own files. */
+    const libraryMerged = (scripts) => {
+        const names = new Map();
+        const visit = (node) => {
+            if (isInterfaceDeclaration(node)) {
+                const id = declaredAt(node);
+                if (id !== undefined) {
+                    names.set(id, node.name);
+                }
+            }
+            else if (isModuleDeclaration(node) || isModuleBlock(node)) {
+                node.forEachChild(visit);
+            }
+        };
+        for (const { file } of walked) {
+            file.forEachChild(visit);
+        }
+        const global = new Set(ambientGlobalInterfaces(held, [...names.keys()], scripts));
+        const asked = [...names].filter(([id]) => global.has(id));
+        if (asked.length === 0) {
+            return new Set();
+        }
+        const answers = project.symbolsAt(asked.map(([, name]) => project.handle(name)));
+        return new Set(asked.flatMap(([id], at) => {
+            const symbol = answers[at];
+            return typeof symbol === "object" &&
+                symbol.declarations.some((handle) => !ownPaths.has(handle.path))
+                ? [id]
+                : [];
+        }));
+    };
     const usesOf = new Map(walked.map((one) => [one.file, one.uses]));
     for (const [file, writes] of valued) {
         const uses = usesOf.get(file) ?? [];
@@ -1151,21 +1170,23 @@ export function references(project, held, targetRoot, options) {
         found.push(...indexedAccessReferences(project, held, chains, root, new Set(tests)));
         found.push(...elementAccessReferences(project, held, chains, root, new Set(tests)));
         found.push(...keyofComparisonReferences(project, held, chains, root, new Set(tests)));
+        found.push(...iterationReferences(project, held, chains, root, new Set(tests)));
+        found.push(...typeParameterReads(project, held, chains, root, new Set(tests)));
         found.push(...unimplementedCalleeReads(project, held, chains, root, new Set(tests)));
         found.push(...moduleDeclarationReferences(project, held, root, new Set(tests)));
         typedLookups = (options.requestCount?.() ?? 0) - before;
     }
     const scripts = new Set(walked.filter((one) => one.file.externalModuleIndicator === undefined).map((one) => one.fileId));
-    found.push(...augmentationReferences(held, found, scripts));
+    found.push(...augmentationReferences(held, found, scripts, libraryMerged(scripts)));
     found.sort((a, b) => byPosition(a.position, b.position) ||
-        compare(a.to, b.to) ||
-        compare(a.from, b.from) ||
-        compare(a.use, b.use));
+        bytewise(a.to, b.to) ||
+        bytewise(a.from, b.from) ||
+        bytewise(a.use, b.use));
     return {
         references: consumer === undefined
             ? found
             : found.map((reference) => ({ ...reference, consumer: consumer.id })),
-        testFilePaths: tests.sort(compare),
+        testFilePaths: tests.sort(bytewise),
         cost: {
             batched,
             fileBatches,

package/dist/src/report-schema.js

@@ -0,0 +1,51 @@
+/**
+ * Holds a report to `contract/report.schema.json` and `contract/finding.schema.json`
+ * before it is written, reading the schemas the generator copies from the Contract, so
+ * this analyzer never writes a document a reader refuses.
+ */
+import { REPORT_SCHEMAS } from "./contract/report.generated.js";
+import { schemaRefusals } from "./schema.js";
+const reportSchema = schemaRefusals(REPORT_SCHEMAS, "report.schema.json");
+/**
+ * What the report schema refuses in one report document, none for an instance, and, as
+ * no schema keyword can state it, a components listing that is not one entry per
+ * component a finding or an edge evaluation's finding names.
+ */
+export function reportRefusals(document) {
+    const found = reportSchema(document);
+    return found.length > 0 ? found : listingRefusals(document);
+}
+/** The components listing held to the components the findings name, once each. */
+function listingRefusals(report) {
+    if (report.components === undefined) {
+        return [];
+    }
+    const refuse = (pointer, reason) => [
+        { pointer, keyword: "components", reason, member: "" },
+    ];
+    const listed = new Set();
+    for (const [i, entry] of report.components.entries()) {
+        if (listed.has(entry.id)) {
+            return refuse(`/components/${String(i)}`, `the entry lists component ${entry.id} a second time`);
+        }
+        listed.add(entry.id);
+    }
+    const named = [
+        ...report.findings.map((finding, i) => [`/findings/${String(i)}`, finding.component.id]),
+        ...report.edge_evaluations.flatMap((one, i) => one.finding === undefined
+            ? []
+            : [[`/edge_evaluations/${String(i)}/finding`, one.finding.component.id]]),
+    ];
+    for (const [pointer, id] of named) {
+        if (!listed.has(id)) {
+            return refuse(pointer, `the finding names component ${id}, which the components listing lacks`);
+        }
+    }
+    const ids = new Set(named.map(([, id]) => id));
+    for (const [i, entry] of report.components.entries()) {
+        if (!ids.has(entry.id)) {
+            return refuse(`/components/${String(i)}`, `the entry lists component ${entry.id}, which no finding names`);
+        }
+    }
+    return [];
+}

package/dist/src/report.js

@@ -3,20 +3,26 @@
  * in the order its schema lists them, built from what one run answered. Every reporter
  * renders this document, so no two renderings disagree about which findings exist.
  */
-/** The version of the report schema this analyzer writes a report to. */
-const SCHEMA_VERSION = "8.2.0";
-/** Every report schema version this analyzer reads: the one the Contract it implements admits. */
-export const SCHEMA_VERSIONS_ACCEPTED = [SCHEMA_VERSION];
-/** The name this analyzer writes every document under and mints every identifier with. */
-export const ANALYZER_NAME = "deadset-ts";
-/** The language this analyzer claims. */
-export const LANGUAGE = "ts";
-/** Two strings ordered bytewise. */
-function compare(a, b) {
-    if (a === b) {
-        return 0;
+import { SCHEMA_VERSION, SCHEMA_VERSIONS } from "./contract/contract.generated.js";
+import { bytewise } from "./text/compare.js";
+import { LANGUAGE, PRODUCT } from "./product.js";
+/**
+ * Each component the findings name, once, with the members the first finding naming it
+ * carries, in the order the findings are: `findings` paired with their wire forms and
+ * sorted, then the edge evaluations' findings.
+ */
+function componentsOf(findings) {
+    const listed = new Map();
+    for (const [written, finding] of findings) {
+        const { members } = finding.component;
+        if (members !== undefined && !listed.has(written.component.id)) {
+            listed.set(written.component.id, {
+                id: written.component.id,
+                members: members.map(wireSymbol),
+            });
+        }
     }
-    return a < b ? -1 : 1;
+    return [...listed.values()];
 }
 function wirePosition(position) {
     return {
@@ -85,9 +91,6 @@ export function wireFinding(finding) {
             root: finding.component.root,
             symbol_count: finding.component.symbolCount,
             deletable_lines: finding.component.deletableLines,
-            ...(finding.component.members === undefined
-                ? {}
-                : { members: finding.component.members.map(wireSymbol) }),
         },
         retained_by: finding.retainedBy,
         configurations: finding.configurations,
@@ -128,19 +131,19 @@ function wireStale(stale) {
 }
 /** The canonical key over two findings: path, line, column, code, then the symbol reference. */
 function canonical(a, b) {
-    return (compare(a.position.path, b.position.path) ||
+    return (bytewise(a.position.path, b.position.path) ||
         a.position.line - b.position.line ||
         a.position.column - b.position.column ||
-        compare(a.code, b.code) ||
-        compare(a.symbol.ref, b.symbol.ref));
+        bytewise(a.code, b.code) ||
+        bytewise(a.symbol.ref, b.symbol.ref));
 }
 /** The canonical key over two stale suppressions, each component from the record's own member. */
 function canonicalStale(a, b) {
-    return (compare(a.position.path, b.position.path) ||
+    return (bytewise(a.position.path, b.position.path) ||
         a.position.line - b.position.line ||
         a.position.column - b.position.column ||
-        compare(a.code, b.code) ||
-        compare(a.symbol, b.symbol));
+        bytewise(a.code, b.code) ||
+        bytewise(a.symbol, b.symbol));
 }
 /** One declared gap as a report carries it, its members in the schema's order. */
 function wireGap(gap) {
@@ -153,9 +156,9 @@ function wireGap(gap) {
 }
 /** Edge evaluations by edge, then side, then their compact encodings. */
 function byEdge(a, b) {
-    return (compare(a.edge, b.edge) ||
-        compare(a.side, b.side) ||
-        compare(JSON.stringify(a), JSON.stringify(b)));
+    return (bytewise(a.edge, b.edge) ||
+        bytewise(a.side, b.side) ||
+        bytewise(JSON.stringify(a), JSON.stringify(b)));
 }
 /**
  * The lines a reader deletes by acting on every finding: each distinct component a root
@@ -198,21 +201,25 @@ function totalsOf(findings, result) {
 }
 /** Builds the report of one run, every array in the order the Contract fixes for it. */
 export function buildReport(input) {
-    const findings = input.result.findings.map(wireFinding).sort(canonical);
+    const paired = input.result.findings
+        .map((finding) => [wireFinding(finding), finding])
+        .sort(([a], [b]) => canonical(a, b));
+    const findings = paired.map(([wire]) => wire);
+    const evaluated = input.result.edgeEvaluations.flatMap((one) => one.finding === undefined ? [] : [[wireFinding(one.finding), one.finding]]);
     const unavailable = [...new Map(input.unavailable.map((one) => [one.id, one])).values()]
-        .sort((a, b) => compare(a.id, b.id))
+        .sort((a, b) => bytewise(a.id, b.id))
         .map((one) => ({ id: one.id, role: "consumer", reason: one.reason }));
     const loaded = [...input.loaded]
-        .sort((a, b) => compare(a.id, b.id) || compare(a.path, b.path))
+        .sort((a, b) => bytewise(a.id, b.id) || bytewise(a.path, b.path))
         .map((one) => ({ id: one.id, role: "consumer", path: one.path }));
     return {
         schema_version: SCHEMA_VERSION,
         contract_version: input.contractVersion,
         analyzer: {
-            name: ANALYZER_NAME,
+            name: PRODUCT,
             version: input.version,
             languages: [LANGUAGE],
-            schema_versions_accepted: SCHEMA_VERSIONS_ACCEPTED,
+            schema_versions_accepted: SCHEMA_VERSIONS,
             conformance: {
                 corpus_version: input.conformance.corpusVersion,
                 result: input.conformance.result,
@@ -221,23 +228,26 @@ export function buildReport(input) {
         },
         target: { kind: input.target.kind, root: input.target.root, identity: input.target.identity },
         configurations: [...input.configurations]
-            .sort((a, b) => compare(a.id, b.id))
+            .sort((a, b) => bytewise(a.id, b.id))
             .map((one) => ({ id: one.id, project: one.project })),
         configurations_not_built: [...input.notBuilt]
-            .sort((a, b) => compare(a.id, b.id))
+            .sort((a, b) => bytewise(a.id, b.id))
             .map((one) => ({ id: one.id, project: one.project, error: one.error })),
         consumers: { declared: loaded.length + unavailable.length, loaded, unavailable },
         findings,
+        ...(input.listsComponents === true
+            ? { components: componentsOf([...paired, ...evaluated]) }
+            : {}),
         edge_evaluations: input.result.edgeEvaluations.map(wireEvaluation).sort(byEdge),
         stale_suppressions: input.result.staleSuppressions.map(wireStale).sort(canonicalStale),
         // Every gap shares the one component of the canonical key a gap supplies, the analyzer's
         // name, so the compact encodings alone order them.
         declared_gaps: input.declaredGaps
             .map(wireGap)
-            .sort((a, b) => compare(JSON.stringify(a), JSON.stringify(b))),
+            .sort((a, b) => bytewise(JSON.stringify(a), JSON.stringify(b))),
         excluded_by_cgo: [],
         test_file_rules: [...input.testFileRules]
-            .sort((a, b) => compare(a.rule, b.rule) || a.matched - b.matched)
+            .sort((a, b) => bytewise(a.rule, b.rule) || a.matched - b.matched)
             .map((one) => ({ rule: one.rule, matched: one.matched })),
         type_error_skips: [
             ...new Map(input.typeErrorSkips.map((one) => {
@@ -245,12 +255,14 @@ export function buildReport(input) {
                 return [JSON.stringify(skip), skip];
             })),
         ]
-            .sort(([a, x], [b, y]) => compare(x.path, y.path) || x.line - y.line || compare(a, b))
+            .sort(([a, x], [b, y]) => bytewise(x.path, y.path) || x.line - y.line || bytewise(a, b))
             .map(([, skip]) => skip),
-        notes: [],
+        notes: [...new Map((input.notes ?? []).map((one) => [JSON.stringify(one), one])).entries()]
+            .sort(([a, x], [b, y]) => bytewise(x.kind, y.kind) || bytewise(x.path, y.path) || bytewise(a, b))
+            .map(([, note]) => note),
         unanswered_questions: [...input.unanswered]
-            .sort((a, b) => compare(a.configuration, b.configuration) ||
-            compare(JSON.stringify(a), JSON.stringify(b)))
+            .sort((a, b) => bytewise(a.configuration, b.configuration) ||
+            bytewise(JSON.stringify(a), JSON.stringify(b)))
             .map((one) => ({
             configuration: one.configuration,
             questions: one.questions,
@@ -277,16 +289,22 @@ export function sortFindings(report, by) {
     return { ...report, findings: [...report.findings].sort(by === "size" ? bySize : canonical) };
 }
 /**
- * The report holding the first `most` findings of its order, the rest counted as omitted.
- * Every other total keeps describing the whole set. Zero keeps every finding.
+ * The report holding the first `most` findings of its order, the rest counted as omitted,
+ * and listing only the components those findings name. Every other total keeps describing
+ * the whole set. Zero keeps every finding.
  */
 export function capFindings(report, most) {
     if (most <= 0 || report.findings.length <= most) {
         return report;
     }
+    const findings = report.findings.slice(0, most);
+    const named = new Set([...findings, ...report.edge_evaluations.flatMap((one) => one.finding ?? [])].map((finding) => finding.component.id));
     return {
         ...report,
-        findings: report.findings.slice(0, most),
+        findings,
+        ...(report.components === undefined
+            ? {}
+            : { components: report.components.filter((listed) => named.has(listed.id)) }),
         totals: { ...report.totals, omitted: report.findings.length - most },
     };
 }

package/dist/src/reporters/annotations.js

@@ -1,4 +1,3 @@
-import { fails } from "../config.js";
 import { coalesced } from "../json-chunks.js";
 import { KINDS } from "../kinds.js";
 /** The escapes a workflow command's message needs, so a line break does not end the command. */
@@ -19,6 +18,12 @@ function escapeProperty(value) {
 function kindName(code) {
     return KINDS.get(code)?.name ?? code;
 }
+/** The command each finding severity is annotated with, whatever the failing severity. */
+const LEVELS = {
+    deny: "error",
+    warn: "warning",
+    allow: "notice",
+};
 function command(level, at, endLine, title, message) {
     return `::${level} file=${escapeProperty(at.path)},line=${String(at.line)},col=${String(at.column)},endLine=${String(endLine)},title=${escapeProperty(title)}::${escapeData(message)}`;
 }
@@ -26,16 +31,15 @@ function command(level, at, endLine, title, message) {
 const SKIP_TITLE = "type error skipped";
 const SKIP_MESSAGE = "the analysis did not evaluate the function or statement holding this type error: ";
 /**
- * One workflow annotation per finding, then one per stale suppression, each naming its
- * file, line, column and last line, titled by its code and kind, then one warning per
- * type-error skip naming its file and line. A finding at or above the failing severity is
- * an error and one below it a warning; a stale suppression is an error, because its kind
- * is fixed on at the failing severity.
+ * The annotations `contract/grammar/annotations.md` states: one per finding, at the
+ * command its severity names, and one error per stale suppression, each naming its file,
+ * line, column and last line and titled by its code and kind; then one warning per
+ * type-error skip naming its file and line, and one per note naming its directory.
  */
-export function annotations(report, options) {
+export function annotations(report) {
     return coalesced((function* lines() {
         for (const found of report.findings) {
-            yield `${command(fails(found.severity, options.failOn) ? "error" : "warning", found.position, found.position.end_line, `${found.code} ${found.kind}`, found.message)}\n`;
+            yield `${command(LEVELS[found.severity], found.position, found.position.end_line, `${found.code} ${found.kind}`, found.message)}\n`;
         }
         for (const stale of report.stale_suppressions) {
             yield `${command("error", stale.position, stale.position.line, `${stale.code} ${kindName(stale.code)}`, stale.message)}\n`;
@@ -43,5 +47,8 @@ export function annotations(report, options) {
         for (const skip of report.type_error_skips) {
             yield `::warning file=${escapeProperty(skip.path)},line=${String(skip.line)},title=${escapeProperty(SKIP_TITLE)}::${escapeData(SKIP_MESSAGE + skip.message)}\n`;
         }
+        for (const note of report.notes) {
+            yield `::warning file=${escapeProperty(note.path)},title=${escapeProperty(note.kind)}::${escapeData(note.message)}\n`;
+        }
     })());
 }

package/dist/src/reporters/sarif.js

@@ -5,6 +5,8 @@ import { lineHashes, symbolFingerprint } from "./fingerprint.js";
 import { RenderError } from "./reporter.js";
 import { utf8Bytes } from "./sha256.js";
 import { withheldLine } from "./text.js";
+import { bytewise } from "../text/compare.js";
+import { message } from "../product.js";
 const SCHEMA = "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json";
 const VERSION = "2.1.0";
 /** The unit a finding's column counts. */
@@ -101,7 +103,7 @@ function lineHashCache(read) {
                 text = read(at.path);
             }
             catch (error) {
-                throw new RenderError(`read ${at.path} for its line fingerprint: ${error instanceof Error ? error.message : String(error)}`);
+                throw new RenderError(`read ${at.path} for its line fingerprint: ${message(error)}`);
             }
             hashes = lineHashes(text);
             held.set(at.path, hashes);
@@ -114,7 +116,7 @@ function lineHashCache(read) {
     };
 }
 /** Every position a finding names beyond its own, in the mapping's order, the first hundred. */
-function relatedOf(found) {
+function relatedOf(found, members) {
     const related = [];
     for (const one of found.details.implementations ?? []) {
         related.push({ label: "implementation", at: one.position, endLine: one.position.end_line });
@@ -126,7 +128,7 @@ function relatedOf(found) {
         const at = found.details.name_literal;
         related.push({ label: "name", at, endLine: at.end_line });
     }
-    for (const one of found.component.members ?? []) {
+    for (const one of members(found.component.id)) {
         if (declarationKey(one.ref, one.position.path) !==
             declarationKey(found.symbol.ref, found.position.path)) {
             related.push({ label: "member", at: one.position, endLine: one.position.end_line });
@@ -143,7 +145,9 @@ function messageWithLinks(message, related) {
     return `${message} (see ${links.join(", ")})`;
 }
 /** Every member of the finding the mapping places nowhere else, under its schema name. */
-function propertiesOf(found) {
+/** A result's member bag, its component holding the members the report lists for it once. */
+function propertiesOf(found, members) {
+    const listed = members(found.component.id);
     return {
         language: found.language,
         symbol: found.symbol,
@@ -154,7 +158,7 @@ function propertiesOf(found) {
             : { liveness_relation: found.liveness_relation }),
         test_only: found.test_only,
         generated: found.generated,
-        component: found.component,
+        component: listed.length === 0 ? found.component : { ...found.component, members: listed },
         retained_by: found.retained_by,
         configurations: found.configurations,
         consumers_loaded: found.consumers_loaded,
@@ -169,8 +173,8 @@ function ruleIndex(index, code) {
     }
     return at;
 }
-function findingResult(found, index, hashOf) {
-    const related = relatedOf(found);
+function findingResult(found, index, hashOf, members) {
+    const related = relatedOf(found, members);
     return {
         ruleId: found.code,
         ruleIndex: ruleIndex(index, found.code),
@@ -190,7 +194,7 @@ function findingResult(found, index, hashOf) {
             primaryLocationLineHash: hashOf(found.position),
             "deadsetSymbolRef/v1": symbolFingerprint(found.code, found.symbol.ref),
         },
-        properties: propertiesOf(found),
+        properties: propertiesOf(found, members),
     };
 }
 /** A stale suppression at the failing level, at its own site; it is no finding, so it carries no member bag. */
@@ -218,11 +222,13 @@ export function sarif(report, options) {
     const ruleList = rules(kinds);
     const index = new Map(kinds.map((kind, at) => [kind.code, at]));
     const hashOf = lineHashCache(options.readSource);
+    const listed = new Map((report.components ?? []).map((one) => [one.id, one.members]));
+    const members = (id) => listed.get(id) ?? [];
     const results = [
-        ...report.findings.map((found) => findingResult(found, index, hashOf)),
+        ...report.findings.map((found) => findingResult(found, index, hashOf, members)),
         ...report.stale_suppressions.map((stale) => staleResult(stale, index, hashOf)),
     ];
-    const languages = [...report.analyzer.languages].sort().join("+");
+    const languages = [...report.analyzer.languages].sort(bytewise).join("+");
     const withheld = withheldLine(report.totals);
     const log = {
         $schema: SCHEMA,

package/dist/src/reporters/template.js

@@ -9,6 +9,7 @@
 import { CHUNK_LENGTH } from "../json-chunks.js";
 import { RenderError } from "./reporter.js";
 import { utf8Bytes } from "./sha256.js";
+import { bytewise } from "../text/compare.js";
 /** A template that does not parse, which refuses the invocation before any analysis. */
 export class TemplateError extends Error {
     constructor(message) {
@@ -513,7 +514,7 @@ function formatted(value, nested) {
     }
     const object = value;
     const entries = Object.keys(object)
-        .sort()
+        .sort(bytewise)
         .map((key) => `${key}:${formatted(object[key] ?? null, true)}`);
     return `map[${entries.join(" ")}]`;
 }
@@ -538,26 +539,10 @@ function compareBasic(name, a, b) {
         return Number.NaN;
     }
     if (kind === "string") {
-        return byCodePoints(a, b);
+        return bytewise(a, b);
     }
     return a < b ? -1 : 1;
 }
-/**
- * Two strings ordered by the bytes of their UTF-8 encodings, which is the order of their
- * code points: the order of their UTF-16 code units differs above U+FFFF.
- */
-function byCodePoints(a, b) {
-    let at = 0;
-    while (at < a.length && at < b.length) {
-        const x = a.codePointAt(at) ?? 0;
-        const y = b.codePointAt(at) ?? 0;
-        if (x !== y) {
-            return x < y ? -1 : 1;
-        }
-        at += x > 0xffff ? 2 : 1;
-    }
-    return a.length - b.length;
-}
 /** The escapes `%q` writes for the control characters that have one of their own. */
 const QUOTED_ESCAPES = {
     '"': '\\"',
@@ -903,7 +888,7 @@ class Execution {
             }
             else if (isObject(value)) {
                 entries = Object.keys(value)
-                    .sort()
+                    .sort(bytewise)
                     .map((key) => [key, value[key] ?? null]);
             }
             else {