@geastack/compiler 1.0.15

package/dist/semantics/normalize/flow/export-importers.d.ts

@@ -0,0 +1,24 @@
+import ts from 'typescript';
+import type { ValueFlowIndex } from './model.js';
+/**
+ * Every in-program mention of the import bindings that name this export -- an
+ * importer's local identifier, or `ns.name` for a namespace import whose
+ * every use selects a member -- or null when any path could expose the
+ * binding to code outside the compiled program.
+ *
+ * Null (open) when: the module set is unstated; the declaring file is not an
+ * ES module of the set, is CommonJS, or is an entry; some dynamic module
+ * reference is non-literal; the module (or any module re-exporting the
+ * binding) is reached by `import()`/`require`/`import = require`, is an
+ * entry, or matches an unresolved specifier; a namespace import of such a
+ * module is used other than by static member selection; `export * as ns`
+ * re-exports it; or `export =` publishes the import.
+ *
+ * Followed (closed): named and default imports, local `export { x }` /
+ * `export default x` of an import, and `export { x } from` / `export * from`
+ * re-exports -- each re-exporting module is itself subjected to the same
+ * proof. References inside the declaring module are NOT included; the caller
+ * has them from value flow. Type-only mentions are omitted. An export no
+ * module imports answers `[]`.
+ */
+export declare const inProgramImportReferencesOf: (checker: ts.TypeChecker, flow: ValueFlowIndex, specifierOrDeclaration: ts.ExportSpecifier | ts.Declaration) => readonly ts.Expression[] | null;

package/dist/semantics/normalize/flow/export-importers.js

@@ -0,0 +1,269 @@
+import ts from 'typescript';
+import { isTypePositionReference, resolveFlowSymbolAlias, statedModuleSetOf } from './targets.js';
+import { nodeIsReachable } from '../reachability.js';
+const graphs = new WeakMap();
+const lastSegment = (path) => path.replace(/^.*[\\/]/, '').replace(/\.[^.]*$/, '');
+const DYNAMIC_MODULE_REFERENCE = /\bimport\s*\(|\brequire\s*\(/;
+const importGraphOf = (checker, modules) => {
+    const known = graphs.get(modules);
+    if (known)
+        return known;
+    const edges = new Map();
+    const dynamic = new Set();
+    const unresolved = new Set();
+    let opaque = false;
+    const moduleAt = (specifier) => {
+        if (!specifier || !ts.isStringLiteralLike(specifier)) {
+            opaque = true;
+            return null;
+        }
+        const module = checker.getSymbolAtLocation(specifier);
+        if (!module)
+            unresolved.add(lastSegment(specifier.text));
+        return module ?? null;
+    };
+    const dynamicAt = (specifier) => {
+        const module = moduleAt(specifier);
+        if (module)
+            dynamic.add(module);
+    };
+    const scan = (node) => {
+        if (ts.isCallExpression(node) &&
+            (node.expression.kind === ts.SyntaxKind.ImportKeyword || (ts.isIdentifier(node.expression) && node.expression.text === 'require')))
+            dynamicAt(node.arguments[0]);
+        ts.forEachChild(node, scan);
+    };
+    for (const file of modules.files) {
+        if (file.isDeclarationFile)
+            continue;
+        for (const statement of file.statements) {
+            if (ts.isImportDeclaration(statement) || (ts.isExportDeclaration(statement) && statement.moduleSpecifier)) {
+                const typeOnly = ts.isImportDeclaration(statement) ? statement.importClause?.isTypeOnly === true : statement.isTypeOnly;
+                const module = moduleAt(statement.moduleSpecifier);
+                if (!module || typeOnly)
+                    continue;
+                const list = edges.get(module) ?? [];
+                list.push({ file, declaration: statement });
+                edges.set(module, list);
+            }
+            else if (ts.isImportEqualsDeclaration(statement) && ts.isExternalModuleReference(statement.moduleReference)) {
+                dynamicAt(statement.moduleReference.expression);
+            }
+        }
+        if (DYNAMIC_MODULE_REFERENCE.test(file.text))
+            ts.forEachChild(file, scan);
+    }
+    const graph = {
+        opaque,
+        unresolved,
+        dynamic,
+        edges,
+        files: new Set(modules.files),
+        entries: new Set(modules.entries),
+        mentions: new Map()
+    };
+    graphs.set(modules, graph);
+    return graph;
+};
+/** Every identifier in `file` the checker resolves to `symbol`. */
+const mentionsOf = (checker, graph, file, symbol) => {
+    let index = graph.mentions.get(file);
+    if (!index) {
+        const built = new Map();
+        const visit = (node) => {
+            if (ts.isIdentifier(node)) {
+                const resolved = ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node
+                    ? checker.getShorthandAssignmentValueSymbol(node.parent)
+                    : checker.getSymbolAtLocation(node);
+                if (resolved) {
+                    const list = built.get(resolved) ?? [];
+                    list.push(node);
+                    built.set(resolved, list);
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        ts.forEachChild(file, visit);
+        graph.mentions.set(file, (index = built));
+    }
+    return index.get(symbol) ?? [];
+};
+/** A mention that constructs, calls or reads nothing. */
+const typeOnlyMention = (reference) => isTypePositionReference(reference) || ts.isTypeQueryNode(reference.parent) || ts.isImportTypeNode(reference.parent);
+const exportedSymbolOf = (checker, specifierOrDeclaration) => {
+    if (ts.isExportSpecifier(specifierOrDeclaration))
+        return checker.getExportSpecifierLocalTargetSymbol(specifierOrDeclaration);
+    const name = ts.getNameOfDeclaration(specifierOrDeclaration);
+    return name ? checker.getSymbolAtLocation(name) : undefined;
+};
+/**
+ * Every in-program mention of the import bindings that name this export -- an
+ * importer's local identifier, or `ns.name` for a namespace import whose
+ * every use selects a member -- or null when any path could expose the
+ * binding to code outside the compiled program.
+ *
+ * Null (open) when: the module set is unstated; the declaring file is not an
+ * ES module of the set, is CommonJS, or is an entry; some dynamic module
+ * reference is non-literal; the module (or any module re-exporting the
+ * binding) is reached by `import()`/`require`/`import = require`, is an
+ * entry, or matches an unresolved specifier; a namespace import of such a
+ * module is used other than by static member selection; `export * as ns`
+ * re-exports it; or `export =` publishes the import.
+ *
+ * Followed (closed): named and default imports, local `export { x }` /
+ * `export default x` of an import, and `export { x } from` / `export * from`
+ * re-exports -- each re-exporting module is itself subjected to the same
+ * proof. References inside the declaring module are NOT included; the caller
+ * has them from value flow. Type-only mentions are omitted. An export no
+ * module imports answers `[]`.
+ */
+export const inProgramImportReferencesOf = (checker, flow, specifierOrDeclaration) => {
+    const modules = statedModuleSetOf(flow);
+    const watched = process.env['GEA_IMPORTERS_DEBUG'];
+    const refuse = (reason, at) => {
+        if (watched !== undefined) {
+            const site = at ?? specifierOrDeclaration;
+            const source = site.getSourceFile();
+            const line = source.getLineAndCharacterOfPosition(site.getStart()).line + 1;
+            console.error(`[IMPORTERS] ${reason} ${source.fileName}:${line} ${site.getText().replace(/\s+/g, ' ').slice(0, 60)}`);
+        }
+        return null;
+    };
+    if (!modules)
+        return refuse('no-stated-module-set');
+    const file = specifierOrDeclaration.getSourceFile();
+    if (file.isDeclarationFile || !ts.isExternalModule(file) || file.commonJsModuleIndicator)
+        return refuse('not-an-es-module');
+    const graph = importGraphOf(checker, modules);
+    if (graph.opaque)
+        return refuse('import-graph-opaque');
+    const target = resolveFlowSymbolAlias(checker, exportedSymbolOf(checker, specifierOrDeclaration));
+    const module = checker.getSymbolAtLocation(file);
+    if (!target || (target.flags & ts.SymbolFlags.Alias) !== 0 || !module)
+        return refuse('export-target-unresolved');
+    const references = [];
+    const visited = new Set();
+    const resolvesToTarget = (symbol) => resolveFlowSymbolAlias(checker, symbol) === target;
+    // A mention in code the program never runs reads nothing and hands nothing
+    // on. `files` is every module the checker loaded, which is more than the
+    // program evaluates: three's `ColorSpaceNode.js` imports `ColorManagement`
+    // and passes it a fresh `Matrix3`, and counting that dead call left every
+    // `ColorManagement` method's parameters open -- boxed, and dispatched
+    // dynamically on the three.js app's first frame.
+    const reachable = modules.reachable;
+    const runs = (reference) => reachable === undefined || nodeIsReachable(reachable, reference);
+    /** Whether every module that can read `name` off `source` is enumerated. */
+    const exportedAs = (source, name) => {
+        const key = `${source.fileName}\0${name}`;
+        if (visited.has(key))
+            return true;
+        visited.add(key);
+        const sourceModule = checker.getSymbolAtLocation(source);
+        if (!sourceModule || !graph.files.has(source) || graph.entries.has(source) || graph.dynamic.has(sourceModule)) {
+            refuse(`module-${!sourceModule ? 'unnamed' : !graph.files.has(source) ? 'outside-graph' : graph.entries.has(source) ? 'is-entry' : 'dynamic'}`, source);
+            return false;
+        }
+        const segment = lastSegment(source.fileName);
+        if (graph.unresolved.has(segment)) {
+            refuse(`unresolved-specifier:${segment}`, source);
+            return false;
+        }
+        if (segment === 'index' && graph.unresolved.has(lastSegment(source.fileName.replace(/[\\/][^\\/]*$/, '')))) {
+            refuse('unresolved-index-directory', source);
+            return false;
+        }
+        for (const { file: importer, declaration } of graph.edges.get(sourceModule) ?? []) {
+            if (ts.isImportDeclaration(declaration)) {
+                const clause = declaration.importClause;
+                if (!clause)
+                    continue;
+                if (clause.name && name === 'default' && !bindingUses(importer, clause.name))
+                    return refuse('default-binding-open', clause) === null && false;
+                const bindings = clause.namedBindings;
+                if (bindings && ts.isNamespaceImport(bindings)) {
+                    if (!namespaceUses(importer, bindings.name, name))
+                        return refuse('namespace-import-open', bindings) === null && false;
+                }
+                else if (bindings) {
+                    for (const element of bindings.elements)
+                        if (!element.isTypeOnly && (element.propertyName ?? element.name).text === name && !bindingUses(importer, element.name))
+                            return false;
+                }
+                continue;
+            }
+            const clause = declaration.exportClause;
+            if (clause && ts.isNamespaceExport(clause))
+                return refuse('namespace-re-export', clause) === null && false;
+            if (!clause) {
+                // `export * from` never forwards `default`, and a local export of the
+                // same name shadows the star.
+                if (name === 'default')
+                    continue;
+                const forwarding = checker.getSymbolAtLocation(importer);
+                const forwarded = forwarding && checker.getExportsOfModule(forwarding).find((symbol) => symbol.name === name);
+                if (forwarded && resolvesToTarget(forwarded) && !exportedAs(importer, name))
+                    return false;
+                continue;
+            }
+            for (const element of clause.elements)
+                if (!element.isTypeOnly && (element.propertyName ?? element.name).text === name && !exportedAs(importer, element.name.text))
+                    return false;
+        }
+        return true;
+    };
+    /** A local import binding: its uses are references, its re-exports recurse. */
+    const bindingUses = (importer, binding) => {
+        const alias = checker.getSymbolAtLocation(binding);
+        if (!alias)
+            return false;
+        for (const statement of importer.statements) {
+            if (!ts.isExportDeclaration(statement) || statement.moduleSpecifier || statement.isTypeOnly)
+                continue;
+            const clause = statement.exportClause;
+            if (!clause || !ts.isNamedExports(clause))
+                continue;
+            for (const element of clause.elements)
+                if (!element.isTypeOnly &&
+                    checker.getExportSpecifierLocalTargetSymbol(element) === alias &&
+                    !exportedAs(importer, element.name.text))
+                    return false;
+        }
+        for (const reference of mentionsOf(checker, graph, importer, alias)) {
+            if (reference === binding || typeOnlyMention(reference) || ts.isExportSpecifier(reference.parent) || !runs(reference))
+                continue;
+            const parent = reference.parent;
+            if (ts.isExportAssignment(parent)) {
+                if (parent.isExportEquals || !exportedAs(importer, 'default'))
+                    return false;
+                continue;
+            }
+            references.push(reference);
+        }
+        return true;
+    };
+    /** A namespace import is closed only while every use selects a member statically. */
+    const namespaceUses = (importer, binding, name) => {
+        const alias = checker.getSymbolAtLocation(binding);
+        if (!alias)
+            return false;
+        for (const reference of mentionsOf(checker, graph, importer, alias)) {
+            if (reference === binding || typeOnlyMention(reference) || !runs(reference))
+                continue;
+            const parent = reference.parent;
+            const selected = ts.isPropertyAccessExpression(parent)
+                ? parent.name.text
+                : ts.isElementAccessExpression(parent) && ts.isStringLiteralLike(parent.argumentExpression)
+                    ? parent.argumentExpression.text
+                    : null;
+            if (selected === null || parent.expression !== reference)
+                return false;
+            if (selected === name)
+                references.push(parent);
+        }
+        return true;
+    };
+    for (const exported of checker.getExportsOfModule(module))
+        if (resolvesToTarget(exported) && !exportedAs(file, exported.name))
+            return null;
+    return references;
+};

package/dist/semantics/normalize/flow/host-text-sink.d.ts

@@ -0,0 +1,25 @@
+import ts from 'typescript';
+/**
+ * Whether stringifying a value of this type can execute code this program
+ * wrote. Only the intrinsic hooks matter: a data member is read by the
+ * emitter's own rendering, never by a source body.
+ */
+/** Whether every coercion hook this type answers is the host's own. */
+export declare const coercionHooksAreHost: (checker: ts.TypeChecker, type: ts.Type) => boolean;
+export declare const coercesWithoutSourceCode: (checker: ts.TypeChecker, type: ts.Type) => boolean;
+/**
+ * Whether `reference` is an argument of a `console.log`/`console.error` call on
+ * the host's own `console`, and is therefore CONSUMED AS TEXT rather than
+ * published.
+ *
+ * `host-members.ts` claims exactly these two members and lowers them to
+ * `gea::host::console::log/error(<text>)`, with `emit-tostring.ts`'s
+ * `consoleArgumentsText` rendering every operand at the call site. The host
+ * never receives the object, only characters -- so an argument is not a
+ * publication of the value, provided the rendering itself runs no source code.
+ * Three's `Object3D.add` reports `object` to the console on its
+ * added-to-itself guard, and that one argument was the terminal of 35 escapes.
+ *
+ * `null` means the site is not a text sink and the caller's other rules apply.
+ */
+export declare const hostTextSinkArgumentOf: (checker: ts.TypeChecker, reference: ts.Expression) => boolean | null;

package/dist/semantics/normalize/flow/host-text-sink.js

@@ -0,0 +1,87 @@
+import ts from 'typescript';
+import { unwrapErasedExpression } from '../producers/erasure.js';
+const TEXT_SINK_MEMBERS = new Set(['log', 'error']);
+/** The three hooks a ToString/ToPrimitive conversion can reach. */
+const coercionHook = (name) => name === 'toString' || name === 'valueOf' || name.startsWith('__@toPrimitive');
+const declaredByHost = (symbol) => (symbol.declarations?.length ?? 0) > 0 && symbol.declarations.every((declaration) => declaration.getSourceFile().hasNoDefaultLib);
+/**
+ * Whether stringifying a value of this type can execute code this program
+ * wrote. Only the intrinsic hooks matter: a data member is read by the
+ * emitter's own rendering, never by a source body.
+ */
+/** Whether every coercion hook this type answers is the host's own. */
+export const coercionHooksAreHost = (checker, type) => checker
+    .getPropertiesOfType(checker.getApparentType(type))
+    .every((property) => !coercionHook(property.escapedName) || declaredByHost(property));
+export const coercesWithoutSourceCode = (checker, type) => {
+    if (type.isUnion() || type.isIntersection())
+        return type.types.every((arm) => coercesWithoutSourceCode(checker, arm));
+    if ((type.flags & ts.TypeFlags.Any) !== 0 || (type.flags & ts.TypeFlags.Unknown) !== 0)
+        return false;
+    if ((type.flags & ts.TypeFlags.Object) === 0)
+        return true;
+    // An array is rendered by joining its elements, which reaches each element's
+    // own hooks. Following that is the element proof's job, not this one's.
+    if (checker.isArrayLikeType(type))
+        return false;
+    return coercionHooksAreHost(checker, type);
+};
+/**
+ * Whether `reference` is an argument of a `console.log`/`console.error` call on
+ * the host's own `console`, and is therefore CONSUMED AS TEXT rather than
+ * published.
+ *
+ * `host-members.ts` claims exactly these two members and lowers them to
+ * `gea::host::console::log/error(<text>)`, with `emit-tostring.ts`'s
+ * `consoleArgumentsText` rendering every operand at the call site. The host
+ * never receives the object, only characters -- so an argument is not a
+ * publication of the value, provided the rendering itself runs no source code.
+ * Three's `Object3D.add` reports `object` to the console on its
+ * added-to-itself guard, and that one argument was the terminal of 35 escapes.
+ *
+ * `null` means the site is not a text sink and the caller's other rules apply.
+ */
+export const hostTextSinkArgumentOf = (checker, reference) => {
+    // A spread argument is not one value the sink might keep: it is however many
+    // the array holds, each rendered on its own. `console.error( message,
+    // ...params )` is the shape three's logging shim ends in.
+    const spread = ts.isSpreadElement(reference.parent) && reference.parent.expression === reference ? reference.parent : null;
+    const call = spread?.parent ?? reference.parent;
+    if (!ts.isCallExpression(call) || !call.arguments.includes(spread ?? reference))
+        return null;
+    if (spread === null && call.arguments.some(ts.isSpreadElement))
+        return null;
+    const callee = unwrapErasedExpression(call.expression);
+    // `String(value)` is ToString spelled as a call. It is the same consumption:
+    // characters come out, the value stays where it was. Source transforms emit
+    // it wherever a concatenation's operand has to be converted explicitly.
+    if (spread === null && ts.isIdentifier(callee) && callee.text === 'String' && call.arguments.length === 1) {
+        const intrinsic = checker.getSymbolAtLocation(callee);
+        if (!intrinsic || intrinsic.name !== 'String' || !declaredByHost(intrinsic))
+            return null;
+        return coercesWithoutSourceCode(checker, checker.getTypeAtLocation(reference));
+    }
+    if (!ts.isPropertyAccessExpression(callee) && !ts.isElementAccessExpression(callee))
+        return null;
+    const member = ts.isPropertyAccessExpression(callee)
+        ? callee.name.text
+        : ts.isStringLiteralLike(callee.argumentExpression)
+            ? callee.argumentExpression.text
+            : null;
+    if (member === null || !TEXT_SINK_MEMBERS.has(member))
+        return null;
+    const receiver = unwrapErasedExpression(callee.expression);
+    if (!ts.isIdentifier(receiver) || receiver.text !== 'console')
+        return null;
+    const console = checker.getSymbolAtLocation(receiver);
+    if (!console || console.name !== 'console' || !declaredByHost(console))
+        return null;
+    const method = checker.getPropertyOfType(checker.getTypeAtLocation(receiver), member);
+    if (!method || !declaredByHost(method))
+        return null;
+    const rendered = checker.getTypeAtLocation(reference);
+    if (spread === null)
+        return coercesWithoutSourceCode(checker, rendered);
+    const element = checker.getIndexTypeOfType(rendered, ts.IndexKind.Number);
+    return element !== undefined && coercesWithoutSourceCode(checker, element);
+};

package/dist/semantics/normalize/flow/intrinsic-array-callback-frames.d.ts

@@ -0,0 +1,84 @@
+import ts from 'typescript';
+import type { FlowCallSite, ValueFlowIndex } from './model.js';
+import type { IntrinsicProtocolRequirement } from '../deferred-intrinsic-protocols.js';
+export type IntrinsicArrayCallbackMethod = 'forEach' | 'map' | 'filter' | 'some' | 'every' | 'find' | 'findIndex' | 'findLast' | 'findLastIndex' | 'flatMap' | 'sort' | 'toSorted' | 'reduce' | 'reduceRight';
+export type IntrinsicArrayCallbackRole = 'element' | 'index' | 'array' | 'sort-left' | 'sort-right' | 'reduce-accumulator' | 'reduce-current';
+export type IntrinsicArrayCallbackValueSource = {
+    readonly kind: 'array-elements';
+    readonly receiver: ts.Expression;
+    readonly excludesSeedElement?: 'first' | 'last';
+} | {
+    readonly kind: 'array-index';
+} | {
+    readonly kind: 'receiver';
+    readonly receiver: ts.Expression;
+} | {
+    readonly kind: 'reduce-accumulator';
+    readonly receiver: ts.Expression;
+    readonly initialValue: ts.Expression | null;
+    readonly seedElement: 'first' | 'last' | null;
+    /** Later callback invocations can receive the prior callback result. */
+    readonly feedback: 'callback-completion';
+};
+export interface IntrinsicArrayCallbackArgument {
+    /** Runtime callback argument position; callback `this` is described separately. */
+    readonly position: number;
+    readonly role: IntrinsicArrayCallbackRole;
+    readonly source: IntrinsicArrayCallbackValueSource;
+}
+export interface IntrinsicArrayCallbackFrame {
+    readonly call: ts.CallExpression;
+    readonly method: IntrinsicArrayCallbackMethod;
+    readonly receiver: ts.Expression;
+    readonly memberKey: string;
+    /** The expression occupying the intrinsic callback operand. The graph resolves its callable values. */
+    readonly callback: ts.Expression;
+    readonly callbackOperandPosition: number;
+    readonly arguments: readonly IntrinsicArrayCallbackArgument[];
+    readonly initialValue: ts.Expression | null;
+    readonly thisBinding: {
+        readonly kind: 'callback-thisArg';
+        /** null means the intrinsic supplies undefined; target strictness governs JS this conversion. */
+        readonly value: ts.Expression | null;
+        /** Arrow callback targets ignore thisArg and retain their lexical receiver. */
+        readonly arrowsUseLexicalThis: true;
+    };
+    /** The graph must prove a runtime Array root and no own receiver slot shadowing. */
+    readonly receiverObligations: {
+        readonly arrayBrand: true;
+        readonly unshadowedMember: true;
+        readonly memberKey: string;
+    };
+    /** Must be included by the graph's final seal; this helper does not discharge it. */
+    readonly protocolRequirements: readonly IntrinsicProtocolRequirement[];
+    /** Whether the method declaration itself was authenticated by checker identity. */
+    readonly identity: 'standard-array-member' | 'runtime-array-lookup';
+}
+export type IntrinsicArrayCallbackFrameResult = {
+    readonly kind: 'not-intrinsic';
+} | {
+    readonly kind: 'unresolved';
+    readonly reason: string;
+} | {
+    readonly kind: 'no-callback';
+    readonly call: ts.CallExpression;
+    readonly method: 'sort' | 'toSorted';
+    readonly receiver: ts.Expression;
+    readonly memberKey: string;
+    readonly receiverObligations: IntrinsicArrayCallbackFrame['receiverObligations'];
+    readonly protocolRequirements: readonly IntrinsicProtocolRequirement[];
+    readonly identity: IntrinsicArrayCallbackFrame['identity'];
+} | {
+    readonly kind: 'frame';
+    readonly frame: IntrinsicArrayCallbackFrame;
+};
+/**
+ * Describe callback frames for authenticated Array/ReadonlyArray methods.
+ * This is an inventory leaf: it never resolves callback values, array
+ * contents, aliases, receiver closure, or callable completion. The caller
+ * must discharge the receiver and intrinsic-prototype obligations in its
+ * shared proof graph. A method name alone never authenticates a source
+ * lookalike; when checker attribution is absent on an `any` receiver, the
+ * result is explicitly only a runtime-array candidate.
+ */
+export declare const intrinsicArrayCallbackFrameOf: (checker: ts.TypeChecker, flow: ValueFlowIndex, site: FlowCallSite) => IntrinsicArrayCallbackFrameResult;

package/dist/semantics/normalize/flow/intrinsic-array-callback-frames.js

@@ -0,0 +1,180 @@
+import ts from 'typescript';
+const callbackShape = (method, optionalCallback, thisArgumentPosition, callbackRoles) => ({ method, optionalCallback, thisArgumentPosition, callbackRoles });
+const methodShapes = new Map([
+    ...['forEach', 'map', 'filter', 'some', 'every', 'find', 'findIndex', 'findLast', 'findLastIndex', 'flatMap'].map((method) => [method, callbackShape(method, false, 1, ['element', 'index', 'array'])]),
+    ...['sort', 'toSorted'].map((method) => [
+        method,
+        callbackShape(method, true, null, ['sort-left', 'sort-right'])
+    ]),
+    ...['reduce', 'reduceRight'].map((method) => [
+        method,
+        callbackShape(method, false, null, ['reduce-accumulator', 'reduce-current', 'index', 'array'])
+    ])
+]);
+const literalMemberKey = (callee) => {
+    if (ts.isPropertyAccessExpression(callee))
+        return callee.name.text;
+    if (!ts.isElementAccessExpression(callee) || !callee.argumentExpression)
+        return null;
+    const key = callee.argumentExpression;
+    return ts.isStringLiteralLike(key) || ts.isNumericLiteral(key) ? key.text : null;
+};
+const unionParts = (type) => (type.isUnion() ? type.types.flatMap(unionParts) : [type]);
+const standardArrayMember = (checker, anchor, declaration) => {
+    const owner = declaration.parent;
+    return (ts.isInterfaceDeclaration(owner) &&
+        (owner.name.text === 'Array' || owner.name.text === 'ReadonlyArray') &&
+        declaration.getSourceFile().hasNoDefaultLib &&
+        checker.getSymbolAtLocation(owner.name) === checker.resolveName(owner.name.text, anchor, ts.SymbolFlags.Interface, false));
+};
+const isUndefinedValue = (checker, flow, expression) => {
+    const value = ts.isParenthesizedExpression(expression) ? expression.expression : expression;
+    if (ts.isVoidExpression(value))
+        return true;
+    if (!ts.isIdentifier(value) || value.text !== 'undefined' || flow.targetOf(value)?.declaration)
+        return false;
+    const symbol = checker.getSymbolAtLocation(value);
+    const declarations = symbol?.declarations ?? [];
+    const globalUndefined = checker.resolveName('undefined', value, ts.SymbolFlags.Value, false);
+    return (symbol !== undefined &&
+        symbol === globalUndefined &&
+        (checker.getTypeAtLocation(value).flags & ts.TypeFlags.Undefined) !== 0 &&
+        (declarations.length === 0 || declarations.every((declaration) => declaration.getSourceFile().hasNoDefaultLib)));
+};
+const sourceForRole = (role, receiver, initialValue, method) => {
+    switch (role) {
+        case 'element':
+        case 'sort-left':
+        case 'sort-right':
+        case 'reduce-current':
+            return {
+                kind: 'array-elements',
+                receiver,
+                ...(method === 'reduce' && initialValue === null ? { excludesSeedElement: 'first' } : {}),
+                ...(method === 'reduceRight' && initialValue === null ? { excludesSeedElement: 'last' } : {})
+            };
+        case 'index':
+            return { kind: 'array-index' };
+        case 'array':
+            return { kind: 'receiver', receiver };
+        case 'reduce-accumulator':
+            return {
+                kind: 'reduce-accumulator',
+                receiver,
+                initialValue,
+                seedElement: initialValue === null ? (method === 'reduce' ? 'first' : 'last') : null,
+                feedback: 'callback-completion'
+            };
+    }
+};
+/**
+ * Describe callback frames for authenticated Array/ReadonlyArray methods.
+ * This is an inventory leaf: it never resolves callback values, array
+ * contents, aliases, receiver closure, or callable completion. The caller
+ * must discharge the receiver and intrinsic-prototype obligations in its
+ * shared proof graph. A method name alone never authenticates a source
+ * lookalike; when checker attribution is absent on an `any` receiver, the
+ * result is explicitly only a runtime-array candidate.
+ */
+export const intrinsicArrayCallbackFrameOf = (checker, flow, site) => {
+    if (!ts.isCallExpression(site.call) || site.operands.kind !== 'call' || site.operands.explicitThis)
+        return { kind: 'not-intrinsic' };
+    const callee = site.operands.callee;
+    if (!ts.isPropertyAccessExpression(callee) && !ts.isElementAccessExpression(callee))
+        return { kind: 'not-intrinsic' };
+    const memberKey = literalMemberKey(callee);
+    if (memberKey === null)
+        return { kind: 'not-intrinsic' };
+    const shape = methodShapes.get(memberKey);
+    if (!shape)
+        return { kind: 'not-intrinsic' };
+    if (site.operands.dispatch.kind !== 'member' || site.operands.receiver === null)
+        return { kind: 'unresolved', reason: 'not-a-normal-member-call' };
+    if (site.operands.receiver !== callee.expression)
+        return { kind: 'unresolved', reason: 'receiver-does-not-match-member-lookup' };
+    const receiver = site.operands.receiver;
+    const receiverType = checker.getTypeAtLocation(receiver);
+    const parts = unionParts(receiverType);
+    const anyReceiver = parts.some((part) => (part.flags & ts.TypeFlags.Any) !== 0);
+    const member = checker.getSymbolAtLocation(ts.isPropertyAccessExpression(callee) ? callee.name : callee.argumentExpression);
+    let identity;
+    if (member?.declarations?.length) {
+        if (!member.declarations.some((declaration) => standardArrayMember(checker, receiver, declaration)))
+            return { kind: 'not-intrinsic' };
+        identity = 'standard-array-member';
+    }
+    else if (anyReceiver)
+        identity = 'runtime-array-lookup';
+    else
+        return { kind: 'unresolved', reason: 'array-member-identity-unavailable' };
+    // The frame relies on the intrinsic method running with the intrinsic
+    // semantics, and what that reads off `Array.prototype` is finite: the method
+    // itself, every index (a hole read falls through to the prototype) and, for
+    // the species-creating methods (`map`/`filter`/`flatMap`/`toSorted`),
+    // `constructor` and `@@species`; `length` and the present elements are own.
+    // Demanding the whole prototype instead fails under ANY unattributed
+    // prototype-key write -- on hono-hello that was the one obligation the sealed
+    // census could not discharge (reg-exp-router `[middleware, routes].forEach`)
+    // while none of the keys the call reads was ever written. An `any` receiver
+    // proves nothing about the receiver's own shape, so the runtime lookup keeps
+    // the whole-prototype obligation.
+    const protocolRequirements = [
+        identity === 'standard-array-member'
+            ? { intrinsic: 'Array', prototypeKeys: { names: [memberKey, 'constructor', '@@species'], arrayIndices: true }, location: site.call }
+            : { intrinsic: 'Array', location: site.call }
+    ];
+    const receiverObligations = { arrayBrand: true, unshadowedMember: true, memberKey };
+    const args = site.operands.args;
+    if (args.some(ts.isSpreadElement))
+        return { kind: 'unresolved', reason: 'spread-arguments' };
+    const callback = args[0];
+    if (!callback) {
+        if (!shape.optionalCallback)
+            return { kind: 'unresolved', reason: 'missing-required-callback' };
+        return {
+            kind: 'no-callback',
+            call: site.call,
+            method: shape.method,
+            receiver,
+            memberKey,
+            receiverObligations,
+            protocolRequirements,
+            identity
+        };
+    }
+    if (shape.optionalCallback && isUndefinedValue(checker, flow, callback))
+        return {
+            kind: 'no-callback',
+            call: site.call,
+            method: shape.method,
+            receiver,
+            memberKey,
+            receiverObligations,
+            protocolRequirements,
+            identity
+        };
+    const initialValue = shape.method === 'reduce' || shape.method === 'reduceRight' ? (args[1] ?? null) : null;
+    const thisArgument = shape.thisArgumentPosition === null ? null : (args[shape.thisArgumentPosition] ?? null);
+    const arguments_ = shape.callbackRoles.map((role, position) => ({
+        position,
+        role,
+        source: sourceForRole(role, receiver, initialValue, shape.method)
+    }));
+    return {
+        kind: 'frame',
+        frame: {
+            call: site.call,
+            method: shape.method,
+            receiver,
+            memberKey,
+            callback,
+            callbackOperandPosition: 0,
+            arguments: arguments_,
+            initialValue,
+            thisBinding: { kind: 'callback-thisArg', value: thisArgument, arrowsUseLexicalThis: true },
+            receiverObligations,
+            protocolRequirements,
+            identity
+        }
+    };
+};