@defold-typescript/transpiler 0.30.0 → 0.31.0

package/src/scene-object-path-index.ts

@@ -1,3 +1,5 @@
+import type { SceneCollectionRoles } from "./scene-collection-roles";
+import { collectComponentDeclarations } from "./scene-component-index";
 import { parseSceneTextFormat, type SceneMessage, SceneTextFormatError } from "./scene-text-format";
 
 // Every game-object path the project declares, `/`-prefixed and composed the way
@@ -5,14 +7,38 @@ import { parseSceneTextFormat, type SceneMessage, SceneTextFormatError } from ".
 // settle. Shaped like `SceneComponentIndex`: a non-empty `incomplete` means the
 // universe is not provably whole, so no consumer may conclude a path is absent.
 export interface SceneObjectPathIndex {
+  // Two axes, in one key: which world, then which path inside it. A bare
+  // `/enemy` is the bootstrap world; `mylevel:/enemy` is the proxy world the
+  // proxied collection's `name:` opened. A collection factory's prototype has
+  // no static address at all, so it contributes neither form.
   readonly paths: ReadonlySet<string>;
   // The documents declaring each path's *leaf* segment, sorted — the files an
   // author would open to rename that object. A composed address is attributed to
   // the collection that names the object, never to the ones that prefixed it.
   readonly declaredIn: ReadonlyMap<string, readonly string[]>;
+  // The component ids the object *at* each path owns, sorted — the join that
+  // turns two id universes into one address. A path whose prototype could not be
+  // read carries no entry at all rather than an empty one: an empty array is
+  // indistinguishable from an object that genuinely owns no component, and the
+  // reason is named in `incomplete` instead.
+  readonly componentsOf: ReadonlyMap<string, readonly string[]>;
+  // For each object, the resource each of its *referenced* components names —
+  // the `component: "/src/player.ts.script"` edge that says this object hosts
+  // that script. An *embedded* component is absent by construction rather than
+  // withheld: its payload is the component, so it names no resource. Withheld
+  // for exactly the keys `componentsOf` withholds, on the same rule.
+  readonly componentResourcesOf: ReadonlyMap<string, ReadonlyMap<string, string>>;
   readonly incomplete: readonly string[];
 }
 
+// One composed path's leaf: the document that declared it, and the components
+// its prototype owns — `undefined` where that prototype could not be read.
+interface PathLeaf {
+  readonly declarer: string;
+  readonly components: readonly string[] | undefined;
+  readonly resources: ReadonlyMap<string, string> | undefined;
+}
+
 // The two blocks whose `id` is a leaf segment. `collection_instances` is handled
 // apart, because its id is a namespace rather than an object.
 const LEAF_BLOCKS = ["instances", "embedded_instances"];
@@ -36,18 +62,31 @@ function childrenOf(message: SceneMessage, name: string): readonly SceneMessage[
 // display paths, values are file text. Pure the same way `buildSceneComponentIndex`
 // is — the filesystem walk belongs to the caller.
 //
+// `roles` says which world each collection is, and is required rather than
+// defaulted: an optional parameter falling back to today's every-collection-is-a-
+// root behaviour would keep the wrong-world suggestion reachable from any call
+// site that forgot to pass it.
+//
 // A `children:` edge is deliberately not a path segment. Defold ids are unique
 // inside one collection and a child object is still addressed `/child`, so
 // parenting is a transform relation; nesting comes from a collection instanced
 // inside another.
 export function buildSceneObjectPathIndex(
   documents: ReadonlyMap<string, string>,
+  roles: SceneCollectionRoles,
 ): SceneObjectPathIndex {
   const incomplete: string[] = [];
 
   if (documents.size === 0) {
     incomplete.push("no scene sources were read, so no game-object path can be proven absent");
-    return { paths: new Set(), declaredIn: new Map(), incomplete };
+    incomplete.push(...roles.incomplete);
+    return {
+      paths: new Set(),
+      declaredIn: new Map(),
+      componentsOf: new Map(),
+      componentResourcesOf: new Map(),
+      incomplete,
+    };
   }
 
   const parsed = new Map<string, SceneMessage>();
@@ -60,26 +99,36 @@ export function buildSceneObjectPathIndex(
     }
   }
 
-  // A collection another document instances is not a world of its own: at
-  // runtime its objects only exist under that instance's id, so contributing its
-  // own unprefixed paths as well would offer addresses that resolve to nothing.
-  const instanced = new Set<string>();
-  for (const document of parsed.values()) {
-    for (const block of childrenOf(document, "collection_instances")) {
-      const collection = firstField(block, "collection");
-      if (collection !== undefined) instanced.add(resourceKey(collection));
-    }
-  }
-
   // Memo keyed by display path, so a collection instanced twice is read once;
   // `inProgress` is the cycle guard, without which two collections instancing
   // each other would recur until the stack ran out. Each entry maps a composed
   // path to the document that declared its leaf, so the attribution is carried
   // by the same walk that builds the path rather than recovered afterwards.
-  const composed = new Map<string, ReadonlyMap<string, string>>();
+  const composed = new Map<string, ReadonlyMap<string, PathLeaf>>();
   const inProgress = new Set<string>();
 
-  function pathsOf(displayPath: string): ReadonlyMap<string, string> {
+  // A `.go` instanced twenty times is read once: the components it declares are
+  // a property of the prototype, not of the instance that named it.
+  interface PrototypeDeclarations {
+    readonly components: readonly string[];
+    readonly resources: ReadonlyMap<string, string>;
+  }
+  const prototypeDeclarations = new Map<string, PrototypeDeclarations | undefined>();
+
+  function declarationsOfPrototype(key: string): PrototypeDeclarations | undefined {
+    const done = prototypeDeclarations.get(key);
+    if (done !== undefined || prototypeDeclarations.has(key)) return done;
+    const document = parsed.get(key);
+    let declarations: PrototypeDeclarations | undefined;
+    if (document !== undefined) {
+      const collected = collectComponentDeclarations(document, key, incomplete);
+      declarations = { components: [...collected.ids].sort(), resources: collected.resources };
+    }
+    prototypeDeclarations.set(key, declarations);
+    return declarations;
+  }
+
+  function pathsOf(displayPath: string): ReadonlyMap<string, PathLeaf> {
     const done = composed.get(displayPath);
     if (done !== undefined) return done;
     if (inProgress.has(displayPath)) {
@@ -92,12 +141,48 @@ export function buildSceneObjectPathIndex(
     if (document === undefined) return new Map();
 
     inProgress.add(displayPath);
-    const paths = new Map<string, string>();
+    const paths = new Map<string, PathLeaf>();
 
     for (const blockName of LEAF_BLOCKS) {
       for (const block of childrenOf(document, blockName)) {
         const id = firstField(block, "id");
-        if (id !== undefined && id !== "") paths.set(`/${id}`, displayPath);
+        if (id === undefined || id === "") continue;
+        let components: readonly string[] | undefined;
+        let resources: ReadonlyMap<string, string> | undefined;
+        if (blockName === "embedded_instances") {
+          // The payload declares the object outright, so the same collector the
+          // flat index uses reads it — and names the document itself when the
+          // escaped text will not parse.
+          const before = incomplete.length;
+          const declarations = collectComponentDeclarations(
+            block,
+            displayPath,
+            incomplete,
+            blockName,
+          );
+          if (incomplete.length === before) {
+            components = [...declarations.ids].sort();
+            resources = declarations.resources;
+          }
+        } else {
+          const prototype = firstField(block, "prototype");
+          if (prototype === undefined) {
+            // Distinct from an unresolvable resource: nothing was named, so
+            // there is no document to go looking for.
+            incomplete.push(
+              `${displayPath}: the instance "${id}" declares no prototype, so the components it owns cannot be read`,
+            );
+          } else if (parsed.has(resourceKey(prototype))) {
+            const declarations = declarationsOfPrototype(resourceKey(prototype));
+            components = declarations?.components;
+            resources = declarations?.resources;
+          } else {
+            incomplete.push(
+              `${displayPath}: the instance "${id}" names ${prototype}, which is not among the project's readable scene documents`,
+            );
+          }
+        }
+        paths.set(`/${id}`, { declarer: displayPath, components, resources });
       }
     }
 
@@ -112,8 +197,8 @@ export function buildSceneObjectPathIndex(
         );
         continue;
       }
-      for (const [nested, declarer] of pathsOf(key)) {
-        paths.set(`/${id}${nested}`, declarer);
+      for (const [nested, leaf] of pathsOf(key)) {
+        paths.set(`/${id}${nested}`, leaf);
       }
     }
 
@@ -122,27 +207,81 @@ export function buildSceneObjectPathIndex(
     return paths;
   }
 
-  // Composed for every document, contributed from the un-instanced ones alone: a
-  // cycle or a dangling reference reached only from inside an instanced
-  // collection is still a gap the caller has to hear about.
+  // Composed for every document, contributed from the worlds alone: a cycle or a
+  // dangling reference reached only from a collection no world opens is still a
+  // gap the caller has to hear about.
+  for (const displayPath of parsed.keys()) pathsOf(displayPath);
+
+  // The bootstrap world's addresses are bare; every proxy world's are prefixed
+  // by the socket its collection's `name:` declares. A collection with neither
+  // role contributes nothing — including a factory prototype, whose objects only
+  // ever exist under a runtime-generated prefix.
+  const worlds: [string, string][] = [];
+  if (roles.bootstrap !== undefined) worlds.push(["", roles.bootstrap]);
+  for (const [displayPath, socket] of roles.sockets) worlds.push([`${socket}:`, displayPath]);
+
   const paths = new Set<string>();
   const declaredIn = new Map<string, string[]>();
-  for (const displayPath of parsed.keys()) {
-    const own = pathsOf(displayPath);
-    if (instanced.has(displayPath)) continue;
-    for (const [path, declarer] of own) {
-      paths.add(path);
-      const declarers = declaredIn.get(path);
+  const componentsOf = new Map<string, string[]>();
+  const componentResourcesOf = new Map<string, Map<string, string>>();
+  // An address two leaves compose is only as provable as its weakest leaf: one
+  // unread prototype withholds the claim for the whole key rather than letting
+  // the readable half stand in for both.
+  const withheld = new Set<string>();
+  for (const [prefix, displayPath] of worlds) {
+    for (const [path, leaf] of pathsOf(displayPath)) {
+      const key = `${prefix}${path}`;
+      paths.add(key);
+      const declarers = declaredIn.get(key);
       if (declarers === undefined) {
-        declaredIn.set(path, [declarer]);
-      } else if (!declarers.includes(declarer)) {
-        // Two roots instancing one collection under the same id compose the same
-        // address from the same leaf, which is one declaring file and not two.
-        declarers.push(declarer);
+        declaredIn.set(key, [leaf.declarer]);
+      } else if (!declarers.includes(leaf.declarer)) {
+        // Two worlds sharing one socket compose the same address from two
+        // different leaves, which the roles already name as a hole — both
+        // declaring files still answer for it.
+        declarers.push(leaf.declarer);
+      }
+      if (leaf.components === undefined || leaf.resources === undefined) {
+        withheld.add(key);
+        continue;
+      }
+      const owned = componentsOf.get(key);
+      if (owned === undefined) {
+        componentsOf.set(key, [...leaf.components]);
+      } else {
+        for (const id of leaf.components) if (!owned.includes(id)) owned.push(id);
+      }
+      const referenced = componentResourcesOf.get(key);
+      if (referenced === undefined) {
+        componentResourcesOf.set(key, new Map(leaf.resources));
+      } else {
+        // Same union rule as the ids above: the first leaf to name a component's
+        // resource answers for it, so two worlds sharing one socket — already a
+        // hole the roles name — cannot silently overwrite each other.
+        for (const [id, resource] of leaf.resources) {
+          if (!referenced.has(id)) referenced.set(id, resource);
+        }
       }
     }
   }
   for (const declarers of declaredIn.values()) declarers.sort();
+  for (const key of withheld) {
+    componentsOf.delete(key);
+    componentResourcesOf.delete(key);
+  }
+  for (const owned of componentsOf.values()) owned.sort();
+
+  incomplete.push(...roles.incomplete);
 
-  return { paths, declaredIn, incomplete };
+  // The roles walk opens the same escaped payloads this one does, so an
+  // unparseable `data:` reaches the list twice by two honest routes. Identical
+  // strings carry identical information, and a reader shown the same reason
+  // twice learns nothing the second time.
+  return {
+    paths,
+    declaredIn,
+    componentsOf,
+    componentResourcesOf,
+    incomplete: [...new Set(incomplete)],
+  };
 }

package/src/url-address-literals.ts

@@ -0,0 +1,115 @@
+import * as ts from "typescript";
+
+// Shared by both address checks, so neither can drift about which slot
+// expressions carry a statically-known address: the walk's ambient filter, the
+// canonical `Hash` identity, and the recovery of the string a `Hash` was hashed
+// from all live here and are imported, never re-derived.
+
+export function isAmbient(fileName: string): boolean {
+  return /[\\/]node_modules[\\/]/.test(fileName) || /(^|[\\/])lib\.[^\\/]*\.d\.ts$/.test(fileName);
+}
+
+// The symbol a generic type reference was instantiated from — `undefined` for
+// anything that is not one.
+function referenceTargetSymbol(type: ts.Type): ts.Symbol | undefined {
+  if ((type.flags & ts.TypeFlags.Object) === 0) return undefined;
+  if (((type as ts.ObjectType).objectFlags & ts.ObjectFlags.Reference) === 0) return undefined;
+  return (type as ts.TypeReference).target.symbol;
+}
+
+// What the global `Hash` *type* name means in scope at the anchor, as symbols.
+// The shipped `type Hash<S extends string = string> = Core.Hash<S>` yields the
+// `Core.Hash` symbol; a project's `Project.Hash` is not in global scope under
+// the bare name and never appears, and a project cannot add a second global
+// `Hash` type without a duplicate-identifier error — so unlike the *name*, this
+// anchor cannot be shadowed.
+function ambientHashAliasTargets(checker: ts.TypeChecker, anchor: ts.Node): ReadonlySet<ts.Symbol> {
+  const targets = new Set<ts.Symbol>();
+  for (const symbol of checker.getSymbolsInScope(anchor, ts.SymbolFlags.Type)) {
+    if (symbol.name !== "Hash") continue;
+    const target = referenceTargetSymbol(checker.getDeclaredTypeOfSymbol(symbol));
+    if (target) targets.add(target);
+  }
+  return targets;
+}
+
+// The declarations *the* `Hash` can come from, resolved from the two anchors the
+// shipped ambient declarations carry one line apart rather than from the file
+// `Hash` happens to be declared in. A path test answers differently for an
+// installed `node_modules/@defold-typescript/types/…` and a workspace-resolved
+// `packages/types/…` copy of the very same declarations, which silently emptied
+// this report for anyone consuming the package through a `paths` mapping or a
+// symlink (bug-121); a symbol identity holds under both.
+//
+// The answer is the *intersection* of the two anchors. The `hash` function is
+// the scope-and-fail-closed anchor: its scope anchor is an ambient file so that
+// no user module's own `hash` participates, and every call signature is walked
+// because a project's global-script `function hash(s: string): string` *merges*
+// into this symbol rather than replacing it — the declarations then span both
+// files and a fully-qualified-name test would reject the real one. The global
+// `Hash` alias is the identity anchor: the function alone is not enough, because
+// a merged project overload contributes its own signatures, and testing what
+// they return by *name* admits any project type called `Hash` and then reports a
+// type argument that was never an address (bug-122). Asking the checker instead
+// of the filesystem is the same discipline as `tableKey` in
+// `url-address-slots.ts`.
+export function canonicalHashSymbols(
+  checker: ts.TypeChecker,
+  program: ts.Program,
+): ReadonlySet<ts.Symbol> {
+  const files = program.getSourceFiles();
+  const anchor = files.find((file) => isAmbient(file.fileName)) ?? files[0];
+  const canonical = new Set<ts.Symbol>();
+  if (!anchor) return canonical;
+
+  const aliased = ambientHashAliasTargets(checker, anchor);
+
+  for (const symbol of checker.getSymbolsInScope(anchor, ts.SymbolFlags.Function)) {
+    if (symbol.name !== "hash") continue;
+    const declaration = symbol.declarations?.[0];
+    if (!declaration) continue;
+    for (const signature of checker
+      .getTypeOfSymbolAtLocation(symbol, declaration)
+      .getCallSignatures()) {
+      const target = referenceTargetSymbol(signature.getReturnType());
+      if (target && aliased.has(target)) canonical.add(target);
+    }
+  }
+  return canonical;
+}
+
+// The string a `Hash` was hashed from, recovered from its type argument —
+// `undefined` for anything else, including a bare `Hash`, a `Url`, a `string`,
+// and a union. `hash` records the argument in `Hash<S>` (see the `Hash` JSDoc in
+// `@defold-typescript/types`), so `const SPRITE = hash("#sprite")` carries the
+// text on the constant's type and no reassignment tracking is needed.
+//
+// The interface must be *the* `Hash`: a project's own generic type named `Hash`
+// resolves to its own declaration, and reading a type argument off it would
+// report a fragment that was never an address. `canonical` is what settles that.
+function hashedSourceOfType(
+  checker: ts.TypeChecker,
+  type: ts.Type,
+  canonical: ReadonlySet<ts.Symbol>,
+): string | undefined {
+  const target = referenceTargetSymbol(type);
+  if (!target || !canonical.has(target)) return undefined;
+  const [source] = checker.getTypeArguments(type as ts.TypeReference);
+  return source?.isStringLiteral() ? source.value : undefined;
+}
+
+/**
+ * The address text a slot expression is statically known to carry — a quoted or
+ * backtick-quoted literal's own text, or the string a `Hash`-typed value was
+ * hashed from — and `undefined` for everything a project only settles at
+ * runtime: a substituted template, a bare `Hash`, a `Url`, a `string`.
+ */
+export function staticAddressTextOf(
+  checker: ts.TypeChecker,
+  node: ts.Expression,
+  canonical: ReadonlySet<ts.Symbol>,
+): string | undefined {
+  return ts.isStringLiteralLike(node)
+    ? node.text
+    : hashedSourceOfType(checker, checker.getTypeAtLocation(node), canonical);
+}

package/src/url-address-slots.ts

@@ -17,14 +17,18 @@ import * as ts from "typescript";
 // fragment. `addressText` is the statically-known text of the sibling argument
 // the entry names as its address companion — present only for a class that
 // declares one, and only when that argument is a plain string literal.
-// `resourceExtensions` is the same shape for the file extensions a resource slot
-// accepts: present only when the entry declares them.
+// `nodeParameter` is the alternative companion, carried through as the entry
+// wrote it: it names a gui node rather than an address, so nothing is read out
+// of the argument and its presence alone says the candidates are scoped by the
+// scene owning the script. `resourceExtensions` is the same shape for the file
+// extensions a resource slot accepts: present only when the entry declares them.
 export interface ClassifiedSlot {
   readonly class: UrlParameterClass;
   readonly text: string;
   readonly textStart: number;
   readonly fragmentStart: number;
   readonly addressText?: string;
+  readonly nodeParameter?: string;
   readonly resourceExtensions?: readonly string[];
 }
 
@@ -192,6 +196,20 @@ function slotThroughHashedCall(
   return ascended?.entry.fqn === "hash" ? undefined : ascended;
 }
 
+// The table entry governing the argument slot this expression occupies, but only
+// when that slot names something in the scene graph by address — `undefined`
+// otherwise. Filtering the entry through the same `isAddressClass` the class
+// accessor is judged by is what stops a caller from reading a slot's
+// `socketScope` off an entry whose class was never an address.
+export function addressEntryOfArgument(
+  checker: ts.TypeChecker,
+  table: UrlParameterTable,
+  argument: ts.Expression,
+): UrlParameterEntry | undefined {
+  const entry = classifiedEntryOfArgument(checker, table, argument)?.entry;
+  return entry !== undefined && isAddressClass(entry.class) ? entry : undefined;
+}
+
 // How the committed table classifies the argument slot this expression occupies
 // — `"none"` when nothing resolves, which is also the answer for any node that
 // is not a call argument at all.
@@ -283,6 +301,9 @@ export function resolveClassifiedSlotAtPosition(input: {
     textStart,
     fragmentStart: hash === -1 ? -1 : textStart + hash + 1,
     ...(addressText === undefined ? {} : { addressText }),
+    ...(classified.entry.nodeParameter === undefined
+      ? {}
+      : { nodeParameter: classified.entry.nodeParameter }),
     ...(classified.entry.resourceExtensions === undefined
       ? {}
       : { resourceExtensions: classified.entry.resourceExtensions }),

package/src/url-cross-world-address.ts

@@ -0,0 +1,109 @@
+// Type-only, and deliberately so: `@defold-typescript/types` resolves its
+// runtime `exports` target to TypeScript source, so importing a *value* from it
+// here would survive `--packages=external` into the packed CLI and fail under
+// plain node exactly the way bug-88 did. The judgment is read off the entry the
+// slot lookup already resolved, and `url-cross-world-address.test.ts` binds that
+// reading to `slotAcceptsForeignSocket` over the committed table so the two
+// cannot drift.
+import type { UrlParameterEntry, UrlParameterTable } from "@defold-typescript/types";
+import * as ts from "typescript";
+import { socketOfAddress } from "./scene-naming-context";
+import { canonicalHashSymbols, isAmbient, staticAddressTextOf } from "./url-address-literals";
+import { addressEntryOfArgument } from "./url-address-slots";
+
+/** One address naming a world the script writing it cannot reach. */
+export interface CrossWorldAddressFinding {
+  readonly fileName: string;
+  readonly start: number;
+  readonly length: number;
+  /** The statically-known address text, as written or as hashed. */
+  readonly address: string;
+  /** The foreign proxy socket that text names. */
+  readonly socket: string;
+  readonly message: string;
+}
+
+/**
+ * Whether this slot refuses a socket-qualified address naming another world.
+ *
+ * The negation of `slotAcceptsForeignSocket` in `@defold-typescript/types`, and
+ * deliberately fails open the same way: a slot carrying no judgment refuses
+ * nothing, so nothing is reported on a slot nobody classified.
+ */
+export function slotRejectsForeignSocket(entry: UrlParameterEntry): boolean {
+  return entry.socketScope === "same-world";
+}
+
+// How a caller's own world reads in a message. The bootstrap world has no
+// socket, and naming it by its absence would produce `the world ""`.
+function worldPhrase(sockets: readonly (string | undefined)[]): string {
+  const named = [...new Set(sockets)].map((socket) =>
+    socket === undefined ? "the bootstrap world" : `"${socket}"`,
+  );
+  return named.join(" and ");
+}
+
+/**
+ * Report every address-slot expression whose statically-known text names a proxy
+ * socket the script writing it does not run in, at a slot that resolves through
+ * an instance or component handle rather than the message bus.
+ *
+ * Deliberately not folded into `checkUrlFragmentReachability`: that check
+ * suppresses index-wide on an incomplete component universe, while this one's
+ * honesty rule is per file — a script whose naming contexts could not be
+ * resolved is reported on at all, because unknown is not wrong. Fusing them
+ * would put one check's early return in front of the other's findings.
+ *
+ * `worldsOf` answers with the sockets of every naming context the file's script
+ * runs in; an empty answer is the unknown case and yields nothing.
+ */
+export function checkCrossWorldAddresses(input: {
+  program: ts.Program;
+  table: UrlParameterTable;
+  worldsOf: (fileName: string) => readonly (string | undefined)[];
+  sourceFiles?: readonly ts.SourceFile[];
+}): readonly CrossWorldAddressFinding[] {
+  const { program, table, worldsOf, sourceFiles } = input;
+
+  const checker = program.getTypeChecker();
+  const canonical = canonicalHashSymbols(checker, program);
+  const findings: CrossWorldAddressFinding[] = [];
+  const targets = sourceFiles ?? program.getSourceFiles();
+
+  for (const sourceFile of targets) {
+    if (isAmbient(sourceFile.fileName)) continue;
+    const worlds = worldsOf(sourceFile.fileName);
+    if (worlds.length === 0) continue;
+
+    const visit = (node: ts.Node): void => {
+      if (ts.isExpression(node)) {
+        const entry = addressEntryOfArgument(checker, table, node);
+        if (entry !== undefined && slotRejectsForeignSocket(entry)) {
+          const address = staticAddressTextOf(checker, node, canonical);
+          const socket = address === undefined ? undefined : socketOfAddress(address);
+          if (
+            address !== undefined &&
+            socket !== undefined &&
+            worlds.every((world) => world !== socket)
+          ) {
+            findings.push({
+              fileName: sourceFile.fileName,
+              start: node.getStart(sourceFile),
+              length: node.getWidth(sourceFile),
+              address,
+              socket,
+              message:
+                `this address names the world "${socket}", but \`${entry.fqn}\` resolves it in ` +
+                `the world the script runs in (${worldPhrase(worlds)}), so it cannot resolve at ` +
+                `runtime — only \`msg.post\` and \`msg.url\` cross a collection proxy`,
+            });
+          }
+        }
+      }
+      ts.forEachChild(node, visit);
+    };
+    ts.forEachChild(sourceFile, visit);
+  }
+
+  return findings;
+}