@optave/codegraph 3.11.2 → 3.12.0

package/dist/extractors/javascript.js

@@ -55,7 +55,15 @@ const BUILTIN_GLOBALS = new Set([
     'Buffer',
     'EventEmitter',
     'Stream',
+    'process',
+    'window',
+    'document',
+    'globalThis',
 ]);
+/** Maximum chain depth for inter-procedural return-type propagation (Phase 8.2). */
+const MAX_PROPAGATION_DEPTH = 3;
+/** Confidence penalty applied per propagation hop (1.0 → 0.9 → 0.8 → 0.7). */
+export const PROPAGATION_HOP_PENALTY = 0.1;
 /**
  * Extract symbols from a JS/TS parsed AST.
  * When a compiled tree-sitter Query is provided (from parser.js),
@@ -138,7 +146,9 @@ function handleExportCapture(c, exps, imports) {
         const declType = decl.type;
         const kindMap = {
             function_declaration: 'function',
+            generator_function_declaration: 'function',
             class_declaration: 'class',
+            abstract_class_declaration: 'class',
             interface_declaration: 'interface',
             type_alias_declaration: 'type',
         };
@@ -261,6 +271,7 @@ function dispatchQueryMatch(c, definitions, calls, imports, classes, exps) {
     }
     else if (c.assign_node) {
         handleCommonJSAssignment(c.assign_left, c.assign_right, c.assign_node, imports);
+        handleFuncPropAssignment(c.assign_left, c.assign_right, definitions);
     }
 }
 function extractSymbolsQuery(tree, query) {
@@ -270,6 +281,17 @@ function extractSymbolsQuery(tree, query) {
     const classes = [];
     const exps = [];
     const typeMap = new Map();
+    const returnTypeMap = new Map();
+    const callAssignments = [];
+    const fnRefBindings = [];
+    const paramBindings = [];
+    const arrayElemBindings = [];
+    const spreadArgBindings = [];
+    const forOfBindings = [];
+    const arrayCallbackBindings = [];
+    const objectRestParamBindings = [];
+    const objectPropBindings = [];
+    const thisCallBindings = [];
     const matches = query.matches(tree.rootNode);
     for (const match of matches) {
         // Build capture lookup for this match (1-3 captures each, very fast)
@@ -280,13 +302,65 @@ function extractSymbolsQuery(tree, query) {
     }
     // Extract top-level constants via targeted walk (query patterns don't cover these)
     extractConstantsWalk(tree.rootNode, definitions);
-    // Extract dynamic import() calls via targeted walk (query patterns don't match `import` function type)
-    extractDynamicImportsWalk(tree.rootNode, imports);
-    // Extract typeMap from type annotations and new expressions
-    extractTypeMapWalk(tree.rootNode, typeMap);
+    // Phase 8.2: Extract function return types first — runContextCollectorWalk's
+    // declarator handler reads the *complete* per-file map for inter-procedural
+    // propagation, so this cannot be folded into that pass.
+    extractReturnTypeMapWalk(tree.rootNode, returnTypeMap);
+    // Context-tracking collector pass: typeMap (with return-type propagation),
+    // object-rest param bindings, and spread/for-of/Array.from bindings.
+    runContextCollectorWalk(tree.rootNode, {
+        typeMap,
+        returnTypeMap,
+        callAssignments,
+        fnRefBindings,
+        objectRestParamBindings,
+        spreadArgBindings,
+        forOfBindings,
+        arrayCallbackBindings,
+    });
     // Extract definitions from destructured bindings (query patterns don't match object_pattern)
     extractDestructuredBindingsWalk(tree.rootNode, definitions);
-    return { definitions, calls, imports, classes, exports: exps, typeMap };
+    // Everything without bespoke traversal semantics is collected in ONE pass:
+    // dynamic import() calls, prototype-method definitions, param bindings,
+    // array-element bindings, object-prop bindings, `new X()` names,
+    // Object.defineProperty receivers, class members (fields/static blocks,
+    // which query patterns don't capture), and this()/call/apply bindings.
+    const newExpressions = [];
+    const definePropertyReceivers = new Map();
+    runCollectorWalk(tree.rootNode, {
+        definitions,
+        typeMap,
+        paramBindings,
+        arrayElemBindings,
+        objectPropBindings,
+        newExpressions,
+        definePropertyReceivers,
+        imports,
+        calls,
+        thisCallBindings,
+        classMemberDefs: definitions,
+    });
+    return {
+        definitions,
+        calls,
+        imports,
+        classes,
+        exports: exps,
+        typeMap,
+        returnTypeMap,
+        callAssignments,
+        fnRefBindings,
+        paramBindings,
+        arrayElemBindings,
+        spreadArgBindings,
+        forOfBindings,
+        arrayCallbackBindings,
+        objectRestParamBindings,
+        objectPropBindings,
+        thisCallBindings,
+        newExpressions,
+        ...(definePropertyReceivers.size > 0 ? { definePropertyReceivers } : {}),
+    };
 }
 /** Node types that define a function scope — constants inside these are skipped. */
 const FUNCTION_SCOPE_TYPES = new Set([
@@ -338,6 +412,10 @@ function extractConstantsWalk(node, definitions) {
         }
     }
 }
+// Class field definitions and static initializer blocks (which query patterns
+// don't capture) are collected inline in runCollectorWalk's field_definition /
+// class_static_block cases when `classMemberDefs` is set. The walk-based path
+// (extractSymbolsWalk) handles these node types via walkJavaScriptNode instead.
 /**
  * Walk the AST to find destructured const bindings (query patterns don't match object_pattern).
  * e.g. `const { handleToken, checkPermissions } = initAuth(config)`
@@ -360,7 +438,7 @@ function extractDestructuredBindingsWalk(node, definitions) {
             declNode.text.startsWith('const ')) {
             for (let j = 0; j < declNode.childCount; j++) {
                 const declarator = declNode.child(j);
-                if (!declarator || declarator.type !== 'variable_declarator')
+                if (declarator?.type !== 'variable_declarator')
                     continue;
                 const nameN = declarator.childForFieldName('name');
                 if (nameN && nameN.type === 'object_pattern') {
@@ -382,15 +460,18 @@ function extractConstDeclarators(declNode, definitions) {
         return;
     for (let j = 0; j < declNode.childCount; j++) {
         const declarator = declNode.child(j);
-        if (!declarator || declarator.type !== 'variable_declarator')
+        if (declarator?.type !== 'variable_declarator')
             continue;
         const nameN = declarator.childForFieldName('name');
         const valueN = declarator.childForFieldName('value');
-        if (!nameN || nameN.type !== 'identifier' || !valueN)
+        if (nameN?.type !== 'identifier' || !valueN)
             continue;
         // Skip functions — already captured by query patterns
         const valType = valueN.type;
-        if (valType === 'arrow_function' || valType === 'function_expression' || valType === 'function')
+        if (valType === 'arrow_function' ||
+            valType === 'function_expression' ||
+            valType === 'function' ||
+            valType === 'generator_function')
             continue;
         if (isConstantValue(valueN)) {
             definitions.push({
@@ -399,6 +480,14 @@ function extractConstDeclarators(declNode, definitions) {
                 line: nodeStartLine(declNode),
                 endLine: nodeEndLine(declNode),
             });
+            // Phase 8.3f: extract function/arrow properties from object literals.
+            // Scope guard: extractConstDeclarators is only called from extractConstantsWalk, which
+            // already skips const declarations inside function scopes (line ~412). So these definitions
+            // are always top-level. Any new call site must add a hasFunctionScopeAncestor guard
+            // (the walk path at handleVariableDecl does this).
+            if (valueN.type === 'object') {
+                extractObjectLiteralFunctions(valueN, nameN.text, definitions);
+            }
         }
     }
 }
@@ -407,33 +496,36 @@ function extractConstDeclarators(declNode, definitions) {
  * Query patterns match call_expression with identifier/member_expression/subscript_expression
  * functions, but import() has function type `import` which none of those patterns cover.
  */
-function extractDynamicImportsWalk(node, imports) {
-    if (node.type === 'call_expression') {
-        const fn = node.childForFieldName('function');
-        if (fn && fn.type === 'import') {
-            const args = node.childForFieldName('arguments') || findChild(node, 'arguments');
-            if (args) {
-                const strArg = findChild(args, 'string');
-                if (strArg) {
-                    const modPath = strArg.text.replace(/['"]/g, '');
-                    const names = extractDynamicImportNames(node);
-                    imports.push({
-                        source: modPath,
-                        names,
-                        line: nodeStartLine(node),
-                        dynamicImport: true,
-                    });
-                }
-                else {
-                    debug(`Skipping non-static dynamic import() at line ${nodeStartLine(node)} (template literal or variable)`);
-                }
-            }
-            return; // no need to recurse into import() children
+/**
+ * Collect a dynamic `import()` call at `node` (a call_expression).
+ * Returns true when the node *is* an import() call — the collector walk uses
+ * this to suppress dynamic-import collection inside the import's own argument
+ * subtree, preserving the former standalone walk's "don't recurse into
+ * import() children" behaviour without hiding those children from the other
+ * collectors.
+ */
+function collectDynamicImport(node, imports) {
+    const fn = node.childForFieldName('function');
+    if (fn?.type !== 'import')
+        return false;
+    const args = node.childForFieldName('arguments') || findChild(node, 'arguments');
+    if (args) {
+        const strArg = findChild(args, 'string');
+        if (strArg) {
+            const modPath = strArg.text.replace(/['"]/g, '');
+            const names = extractDynamicImportNames(node);
+            imports.push({
+                source: modPath,
+                names,
+                line: nodeStartLine(node),
+                dynamicImport: true,
+            });
+        }
+        else {
+            debug(`Skipping non-static dynamic import() at line ${nodeStartLine(node)} (template literal or variable)`);
         }
     }
-    for (let i = 0; i < node.childCount; i++) {
-        extractDynamicImportsWalk(node.child(i), imports);
-    }
+    return true;
 }
 function handleCommonJSAssignment(left, right, node, imports) {
     if (!left || !right)
@@ -489,20 +581,76 @@ function extractSymbolsWalk(tree) {
         classes: [],
         exports: [],
         typeMap: new Map(),
+        returnTypeMap: new Map(),
+        callAssignments: [],
+        fnRefBindings: [],
+        paramBindings: [],
+        arrayElemBindings: [],
+        spreadArgBindings: [],
+        forOfBindings: [],
+        arrayCallbackBindings: [],
+        objectRestParamBindings: [],
+        objectPropBindings: [],
+        thisCallBindings: [],
     };
     walkJavaScriptNode(tree.rootNode, ctx);
-    // Populate typeMap for variables and parameter type annotations
-    extractTypeMapWalk(tree.rootNode, ctx.typeMap);
+    // Phase 8.2: Extract function return types first — runContextCollectorWalk's
+    // declarator handler reads the *complete* per-file map for inter-procedural
+    // propagation, so this cannot be folded into that pass.
+    extractReturnTypeMapWalk(tree.rootNode, ctx.returnTypeMap);
+    // Context-tracking collector pass: typeMap (with return-type propagation),
+    // object-rest param bindings, and spread/for-of/Array.from bindings.
+    runContextCollectorWalk(tree.rootNode, {
+        typeMap: ctx.typeMap,
+        returnTypeMap: ctx.returnTypeMap,
+        callAssignments: ctx.callAssignments,
+        fnRefBindings: ctx.fnRefBindings,
+        objectRestParamBindings: ctx.objectRestParamBindings,
+        spreadArgBindings: ctx.spreadArgBindings,
+        forOfBindings: ctx.forOfBindings,
+        arrayCallbackBindings: ctx.arrayCallbackBindings,
+    });
+    // Single collector pass for everything else: prototype-method and func-prop
+    // definitions, param bindings, array-element bindings, object-prop bindings,
+    // `new X()` names, and Object.defineProperty receivers. Dynamic imports,
+    // this()/call/apply bindings, and class members are omitted here —
+    // walkJavaScriptNode already covers those node types on this path.
+    const newExpressions = [];
+    const definePropertyReceivers = new Map();
+    runCollectorWalk(tree.rootNode, {
+        definitions: ctx.definitions,
+        typeMap: ctx.typeMap,
+        paramBindings: ctx.paramBindings,
+        arrayElemBindings: ctx.arrayElemBindings,
+        objectPropBindings: ctx.objectPropBindings,
+        newExpressions,
+        definePropertyReceivers,
+        funcPropDefs: ctx.definitions,
+    });
+    ctx.newExpressions = newExpressions;
+    if (definePropertyReceivers.size > 0)
+        ctx.definePropertyReceivers = definePropertyReceivers;
     return ctx;
 }
 function walkJavaScriptNode(node, ctx) {
     switch (node.type) {
         case 'function_declaration':
+        case 'generator_function_declaration':
             handleFunctionDecl(node, ctx);
             break;
         case 'class_declaration':
+        case 'abstract_class_declaration':
+        // class expressions: `return class Foo extends Bar { ... }` or `const X = class Foo { ... }`
+        case 'class':
             handleClassDecl(node, ctx);
             break;
+        case 'class_static_block':
+            handleStaticBlock(node, ctx.definitions);
+            break;
+        case 'field_definition':
+        case 'public_field_definition':
+            handleFieldDef(node, ctx.definitions);
+            break;
         case 'method_definition':
             handleMethodDef(node, ctx);
             break;
@@ -596,6 +744,71 @@ function handleMethodDef(node, ctx) {
         });
     }
 }
+/**
+ * Create a synthetic `ClassName.<static:L:C>` definition for a class static block
+ * so that calls inside the block can be attributed to a method-kind node and
+ * `resolveThisDispatch` can walk up to the parent class for `super.method()`.
+ *
+ * The start line and column are appended to the name to ensure uniqueness when a
+ * class has multiple `static { }` blocks (each has a distinct start position even
+ * if on the same line).
+ *
+ * Tree-sitter uses `class_static_block` (not `static_block`) for `static { ... }`.
+ */
+function handleStaticBlock(node, definitions) {
+    const parentClass = findParentClass(node);
+    if (!parentClass)
+        return;
+    const line = nodeStartLine(node);
+    const col = node.startPosition.column;
+    definitions.push({
+        name: `${parentClass}.<static:${line}:${col}>`,
+        kind: 'method',
+        line,
+        endLine: nodeEndLine(node),
+    });
+}
+/**
+ * Emit a `ClassName.fieldName` definition for class fields that have an initializer.
+ * This lets `findCaller` attribute calls inside field initializers (e.g. static field
+ * side-effects) to the field rather than the enclosing class.
+ *
+ * JS `field_definition` uses the `'property'` field name; TS
+ * `public_field_definition` uses `'name'`. As a third fallback (Rust/TS parity) we
+ * also check for a positional `property_identifier` child.
+ */
+const CALLABLE_FIELD_TYPES = new Set([
+    'arrow_function',
+    'function_expression',
+    'generator_function',
+]);
+function handleFieldDef(node, definitions) {
+    // JS field_definition uses 'property' field; TS public_field_definition uses 'name' field
+    const nameNode = node.childForFieldName('name') ||
+        node.childForFieldName('property') ||
+        findChild(node, 'property_identifier');
+    const valueNode = node.childForFieldName('value');
+    if (!nameNode || !valueNode)
+        return;
+    if (nameNode.type === 'computed_property_name')
+        return;
+    // Only emit a callable definition when the initializer is a function/arrow expression.
+    // Scalar fields like `static x = 42` should not appear as method-kind nodes.
+    if (!CALLABLE_FIELD_TYPES.has(valueNode.type))
+        return;
+    const fieldName = nameNode.text;
+    if (!fieldName)
+        return;
+    const parentClass = findParentClass(node);
+    if (!parentClass)
+        return;
+    definitions.push({
+        name: `${parentClass}.${fieldName}`,
+        kind: 'method',
+        line: nodeStartLine(node),
+        endLine: nodeEndLine(node),
+    });
+}
 function handleInterfaceDecl(node, ctx) {
     const nameNode = node.childForFieldName('name');
     if (!nameNode)
@@ -660,7 +873,8 @@ function handleVariableDecl(node, ctx) {
                 const valType = valueN.type;
                 if (valType === 'arrow_function' ||
                     valType === 'function_expression' ||
-                    valType === 'function') {
+                    valType === 'function' ||
+                    valType === 'generator_function') {
                     const varFnChildren = extractParameters(valueN);
                     ctx.definitions.push({
                         name: nameN.text,
@@ -670,13 +884,26 @@ function handleVariableDecl(node, ctx) {
                         children: varFnChildren.length > 0 ? varFnChildren : undefined,
                     });
                 }
-                else if (isConst && nameN.type === 'identifier' && isConstantValue(valueN)) {
+                else if (isConst &&
+                    nameN.type === 'identifier' &&
+                    isConstantValue(valueN) &&
+                    !hasFunctionScopeAncestor(node)) {
                     ctx.definitions.push({
                         name: nameN.text,
                         kind: 'constant',
                         line: nodeStartLine(node),
                         endLine: nodeEndLine(node),
                     });
+                    // Phase 8.3f: extract function/arrow properties from object literals so that
+                    // this.method() calls inside Object.defineProperty accessors can resolve them.
+                    // Scope guard: hasFunctionScopeAncestor mirrors the Rust path's find_parent_of_types
+                    // check and the sibling destructured-binding branch below — skips object literals
+                    // inside function bodies to avoid polluting the global definition index with
+                    // local variable properties (e.g. `localObj.fn` from `const localObj = { fn: ... }`
+                    // inside a function).
+                    if (valueN.type === 'object') {
+                        extractObjectLiteralFunctions(valueN, nameN.text, ctx.definitions);
+                    }
                 }
                 else if (isConst && nameN.type === 'object_pattern' && !hasFunctionScopeAncestor(node)) {
                     // Destructured bindings: const { handleToken, checkPermissions } = initAuth(...)
@@ -692,6 +919,55 @@ function handleVariableDecl(node, ctx) {
         }
     }
 }
+/**
+ * Phase 8.3f: extract function/arrow function properties from an object literal as standalone
+ * definitions so that `this.method()` calls inside Object.defineProperty accessor functions can
+ * resolve them via the same-file definition lookup.
+ *
+ * Definitions are emitted as qualified names (`obj.baz` rather than bare `baz`) to avoid
+ * polluting the global definition index with common property names like `init`, `run`, or
+ * `render`. The typeMap value stored by the caller also uses the qualified name so the resolver
+ * looks up `lookup.byName('obj.baz')` rather than `lookup.byName('baz')`.
+ *
+ * `const obj = { baz: () => {} }` → emits Definition { name: 'obj.baz', kind: 'function' }
+ */
+function extractObjectLiteralFunctions(objNode, varName, definitions) {
+    for (let i = 0; i < objNode.childCount; i++) {
+        const child = objNode.child(i);
+        if (!child)
+            continue;
+        if (child.type === 'pair') {
+            const keyNode = child.childForFieldName('key');
+            const valueNode = child.childForFieldName('value');
+            if (!keyNode || !valueNode)
+                continue;
+            const keyName = keyNode.type === 'string' ? keyNode.text.replace(/^['"]|['"]$/g, '') : keyNode.text;
+            if (!keyName)
+                continue;
+            if (valueNode.type === 'arrow_function' ||
+                valueNode.type === 'function_expression' ||
+                valueNode.type === 'function') {
+                definitions.push({
+                    name: `${varName}.${keyName}`,
+                    kind: 'function',
+                    line: nodeStartLine(child),
+                    endLine: nodeEndLine(valueNode),
+                });
+            }
+        }
+        else if (child.type === 'method_definition') {
+            const nameNode = child.childForFieldName('name');
+            if (nameNode) {
+                definitions.push({
+                    name: `${varName}.${nameNode.text}`,
+                    kind: 'function',
+                    line: nodeStartLine(child),
+                    endLine: nodeEndLine(child),
+                });
+            }
+        }
+    }
+}
 function handleEnumDecl(node, ctx) {
     const nameNode = node.childForFieldName('name');
     if (!nameNode)
@@ -731,6 +1007,11 @@ function handleCallExpr(node, ctx) {
         handleDynamicImportCall(node, ctx.imports);
     }
     else {
+        // this() calls: `this` used as a function (not as a receiver).
+        if (fn.type === 'this') {
+            ctx.calls.push({ name: 'this', line: nodeStartLine(node) });
+            return; // no further processing needed for this()-style calls
+        }
         const callInfo = extractCallInfo(fn, node);
         if (callInfo)
             ctx.calls.push(callInfo);
@@ -738,6 +1019,32 @@ function handleCallExpr(node, ctx) {
             const cbDef = extractCallbackDefinition(node, fn);
             if (cbDef)
                 ctx.definitions.push(cbDef);
+            // this-call bindings: `fn.call(namedCtx, ...)` / `fn.apply(namedCtx, ...)`
+            const obj = fn.childForFieldName('object');
+            const prop = fn.childForFieldName('property');
+            if (obj?.type === 'identifier' &&
+                prop &&
+                (prop.text === 'call' || prop.text === 'apply') &&
+                !BUILTIN_GLOBALS.has(obj.text)) {
+                const args = node.childForFieldName('arguments') || findChild(node, 'arguments');
+                if (args) {
+                    for (let i = 0; i < args.childCount; i++) {
+                        const child = args.child(i);
+                        if (!child)
+                            continue;
+                        const t = child.type;
+                        if (t === '(' || t === ')' || t === ',')
+                            continue;
+                        if (t === 'identifier' &&
+                            !BUILTIN_GLOBALS.has(child.text) &&
+                            child.text !== 'undefined' &&
+                            child.text !== 'null') {
+                            ctx.thisCallBindings.push({ callee: obj.text, thisArg: child.text });
+                        }
+                        break;
+                    }
+                }
+            }
         }
         ctx.calls.push(...extractCallbackReferenceCalls(node));
     }
@@ -791,7 +1098,9 @@ function handleExportStmt(node, ctx) {
         const declType = decl.type;
         const kindMap = {
             function_declaration: 'function',
+            generator_function_declaration: 'function',
             class_declaration: 'class',
+            abstract_class_declaration: 'class',
             interface_declaration: 'interface',
             type_alias_declaration: 'type',
         };
@@ -1010,7 +1319,7 @@ function extractSimpleTypeName(typeAnnotationNode) {
     return null;
 }
 function extractNewExprTypeName(newExprNode) {
-    if (!newExprNode || newExprNode.type !== 'new_expression')
+    if (newExprNode?.type !== 'new_expression')
         return null;
     const ctor = newExprNode.childForFieldName('constructor') || newExprNode.child(1);
     if (!ctor)
@@ -1023,40 +1332,458 @@ function extractNewExprTypeName(newExprNode) {
     }
     return null;
 }
+// ── Phase 8.2: Inter-Procedural Return Type Propagation ─────────────────────
 /**
- * Extract variable-to-type assignments into a per-file type map.
+ * Walk the AST and record the return type of every function/method definition.
  *
- * Values are `{ type: string, confidence: number }`:
- *   - 1.0: explicit constructor (`new Foo()`)
- *   - 0.9: type annotation (`: Foo`) or typed parameter
- *   - 0.7: factory method call (`Foo.create()` — uppercase-first heuristic)
+ * Keys: plain name (e.g. "createUser") or "ClassName.methodName" for methods.
+ * Confidence:
+ *   - 1.0: explicit TypeScript return type annotation
+ *   - 0.85: inferred from the first `return new Constructor()` in the body
+ */
+function extractReturnTypeMapWalk(rootNode, returnTypeMap) {
+    function walk(node, depth, currentClass) {
+        if (depth >= MAX_WALK_DEPTH)
+            return;
+        const t = node.type;
+        if (t === 'class_declaration' || t === 'abstract_class_declaration' || t === 'class') {
+            const nameNode = node.childForFieldName('name');
+            const className = nameNode?.text ?? null;
+            for (let i = 0; i < node.childCount; i++) {
+                walk(node.child(i), depth + 1, className);
+            }
+            return;
+        }
+        if (t === 'function_declaration' || t === 'generator_function_declaration') {
+            const nameNode = node.childForFieldName('name');
+            if (nameNode?.type === 'identifier' && nameNode.text !== 'constructor') {
+                const fnName = currentClass ? `${currentClass}.${nameNode.text}` : nameNode.text;
+                storeReturnType(node, fnName, returnTypeMap);
+            }
+            // Recurse into the function body with null currentClass so nested
+            // function declarations are not stored under the enclosing class name.
+            for (let i = 0; i < node.childCount; i++) {
+                walk(node.child(i), depth + 1, null);
+            }
+            return;
+        }
+        else if (t === 'method_definition') {
+            const nameNode = node.childForFieldName('name');
+            if (nameNode && currentClass && nameNode.text !== 'constructor') {
+                storeReturnType(node, `${currentClass}.${nameNode.text}`, returnTypeMap);
+            }
+            // Recurse into the method body with null currentClass so nested
+            // function declarations are not stored under the enclosing class name.
+            for (let i = 0; i < node.childCount; i++) {
+                walk(node.child(i), depth + 1, null);
+            }
+            return;
+        }
+        else if (t === 'variable_declarator') {
+            // const foo = (): ReturnType => …  or  const foo = function(): ReturnType { … }
+            const nameN = node.childForFieldName('name');
+            const valueN = node.childForFieldName('value');
+            if (nameN?.type === 'identifier' && valueN) {
+                const vt = valueN.type;
+                if (vt === 'arrow_function' ||
+                    vt === 'function_expression' ||
+                    vt === 'generator_function') {
+                    const fnName = currentClass ? `${currentClass}.${nameN.text}` : nameN.text;
+                    storeReturnType(valueN, fnName, returnTypeMap);
+                }
+            }
+        }
+        for (let i = 0; i < node.childCount; i++) {
+            walk(node.child(i), depth + 1, currentClass);
+        }
+    }
+    walk(rootNode, 0, null);
+}
+/** Extract the return type of a function node and store it in the returnTypeMap. */
+function storeReturnType(fnNode, fnName, returnTypeMap) {
+    const returnTypeNode = fnNode.childForFieldName('return_type');
+    if (returnTypeNode) {
+        const typeName = extractSimpleTypeName(returnTypeNode);
+        if (typeName) {
+            const existing = returnTypeMap.get(fnName);
+            if (!existing || existing.confidence < 1.0)
+                returnTypeMap.set(fnName, { type: typeName, confidence: 1.0 });
+            return;
+        }
+    }
+    // Infer from first `return new Constructor()` in the function body
+    const body = fnNode.childForFieldName('body');
+    if (body) {
+        const inferred = findReturnNewExprType(body);
+        if (inferred) {
+            const existing = returnTypeMap.get(fnName);
+            if (!existing || 0.85 > existing.confidence)
+                returnTypeMap.set(fnName, { type: inferred, confidence: 0.85 });
+        }
+    }
+}
+/** Return the constructor name from the first `return new Constructor()` in a body, or null. */
+function findReturnNewExprType(bodyNode) {
+    for (let i = 0; i < bodyNode.childCount; i++) {
+        const child = bodyNode.child(i);
+        if (child?.type !== 'return_statement')
+            continue;
+        for (let j = 0; j < child.childCount; j++) {
+            const expr = child.child(j);
+            if (expr?.type === 'new_expression')
+                return extractNewExprTypeName(expr);
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the return type of a call_expression node using returnTypeMap.
+ * Handles: createUser() (identifier), service.getRepo() (member), and
+ * getService().getRepo() (chained call) up to MAX_PROPAGATION_DEPTH hops.
+ *
+ * `depth` tracks total chain hops consumed so far.  Each call boundary — both
+ * resolving the receiver and resolving the final return type — costs one hop.
+ * Confidence = annotated return type confidence − 0.1 × (depth + 1).
+ *
+ * Examples (annotated sources → confidence 1.0):
+ *   createUser()          depth=0 → 1.0 − 0.1 = 0.9 (1 hop)
+ *   svc.getUser()         depth=0 → 1.0 − 0.1 = 0.9 (1 hop; receiver from typeMap)
+ *   getService().getRepo() depth=0 → inner resolved at depth=1, outer at depth+1 → 0.8 (2 hops)
+ */
+function resolveCallExprReturnType(callNode, typeMap, returnTypeMap, depth) {
+    if (depth >= MAX_PROPAGATION_DEPTH)
+        return null;
+    const fn = callNode.childForFieldName('function');
+    if (!fn)
+        return null;
+    if (fn.type === 'identifier') {
+        const entry = returnTypeMap.get(fn.text);
+        if (!entry)
+            return null;
+        const confidence = entry.confidence - PROPAGATION_HOP_PENALTY * (depth + 1);
+        return confidence > 0 ? { type: entry.type, confidence } : null;
+    }
+    if (fn.type === 'member_expression') {
+        const obj = fn.childForFieldName('object');
+        const prop = fn.childForFieldName('property');
+        if (!obj || !prop)
+            return null;
+        let receiverType = null;
+        // effectiveDepth tracks the depth at which THIS call's return type is charged.
+        // When the receiver is itself a call expression (chain), we've already consumed
+        // a hop resolving it, so charge this call at depth+1.
+        let effectiveDepth = depth;
+        if (obj.type === 'identifier') {
+            const typeEntry = typeMap.get(obj.text);
+            receiverType = typeEntry ? typeEntry.type : null;
+        }
+        else if (obj.type === 'call_expression') {
+            // Each link in a call chain costs an extra hop.
+            const innerResult = resolveCallExprReturnType(obj, typeMap, returnTypeMap, depth + 1);
+            receiverType = innerResult ? innerResult.type : null;
+            effectiveDepth = depth + 1;
+        }
+        if (receiverType) {
+            const entry = returnTypeMap.get(`${receiverType}.${prop.text}`);
+            if (entry) {
+                const confidence = entry.confidence - PROPAGATION_HOP_PENALTY * (effectiveDepth + 1);
+                return confidence > 0 ? { type: entry.type, confidence } : null;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Record a call assignment into callAssignments for cross-file propagation.
+ * Only records cases where the callee is a simple identifier or a method call
+ * on a known-typed variable — chain expressions are skipped (handled locally).
+ */
+function recordCallAssignment(callNode, varName, typeMap, callAssignments) {
+    const fn = callNode.childForFieldName('function');
+    if (!fn)
+        return;
+    if (fn.type === 'identifier') {
+        callAssignments.push({ varName, calleeName: fn.text });
+    }
+    else if (fn.type === 'member_expression') {
+        const obj = fn.childForFieldName('object');
+        const prop = fn.childForFieldName('property');
+        if (obj?.type === 'identifier' && prop) {
+            const receiverEntry = typeMap.get(obj.text);
+            callAssignments.push({
+                varName,
+                calleeName: prop.text,
+                receiverTypeName: receiverEntry?.type,
+            });
+        }
+    }
+}
+/**
+ * Phase 8.5 (RTA): collect all constructor names from `new X()` expressions
+ * in the file. Captures both assigned (`const x = new Foo()`) and unassigned
+ * (`doSomething(new Foo())`) usages that the typeMap-based approach would miss.
+ */
+// `new X()` constructor-name collection (Phase 8.5 RTA instantiation tracking)
+// happens inline in runCollectorWalk's new_expression case.
+/**
+ * Walk the AST to find `Object.defineProperty(obj, "bar", { get: getter })` patterns
+ * and record which functions are used as getter/setter accessors for which objects.
+ *
+ * Result is stored in the provided map as `funcName → receiverVarName`.
+ */
+function collectDefinePropertyReceiver(node, out) {
+    const fn = node.childForFieldName('function');
+    // Match `Object.defineProperty`
+    if (fn?.type !== 'member_expression')
+        return;
+    const obj = fn.childForFieldName('object');
+    const prop = fn.childForFieldName('property');
+    if (obj?.type !== 'identifier' || obj.text !== 'Object' || prop?.text !== 'defineProperty') {
+        return;
+    }
+    const argsNode = node.childForFieldName('arguments') ?? findChild(node, 'arguments');
+    if (!argsNode)
+        return;
+    // Collect non-punctuation children: arg0 (target obj), arg1 (prop name string), arg2 (descriptor)
+    const argChildren = [];
+    for (let i = 0; i < argsNode.childCount; i++) {
+        const c = argsNode.child(i);
+        if (!c)
+            continue;
+        if (c.type === ',' || c.type === '(' || c.type === ')')
+            continue;
+        argChildren.push(c);
+    }
+    if (argChildren.length < 3)
+        return;
+    const targetObj = argChildren[0];
+    const descriptor = argChildren[2];
+    if (targetObj?.type !== 'identifier' || descriptor?.type !== 'object')
+        return;
+    const targetName = targetObj.text;
+    // Walk the descriptor object's pair children looking for get/set
+    for (let i = 0; i < descriptor.childCount; i++) {
+        const pair = descriptor.child(i);
+        if (pair?.type !== 'pair')
+            continue;
+        const key = pair.childForFieldName('key');
+        const val = pair.childForFieldName('value');
+        if (key &&
+            (key.text === 'get' || key.text === 'set') &&
+            val?.type === 'identifier' &&
+            !BUILTIN_GLOBALS.has(val.text)) {
+            // Known limitation: if the same function is registered as an
+            // accessor on multiple objects, last-write-wins — only the
+            // last target object is retained. This is an unusual pattern
+            // (sharing one function across multiple defineProperty calls)
+            // and covering it would require Map<string, string[]> which
+            // changes the consumer API. Tracked as a known edge case.
+            out.set(val.text, targetName);
+        }
+    }
+}
+/**
+ * Single context-tracking pass combining what were three separate full-tree
+ * walks (typeMap, object-rest params, spread/for-of) — see runCollectorWalk
+ * for why traversal count dominates extraction cost on WASM trees.
+ *
+ * Each concern keeps its own enclosing-class register because their reset
+ * rules intentionally differ:
+ *
+ * - typeMap (`typeMapClass`): extracts variable-to-type assignments.
+ *   Values are `{ type: string, confidence: number }`:
+ *     - 1.0: explicit constructor (`new Foo()`)
+ *     - 0.9: type annotation (`: Foo`) or typed parameter
+ *     - 0.85: property write (`obj.prop = fn` — Phase 8.3d pts tracking)
+ *     - 0.7–0.9: inter-procedural propagation from return-type map (Phase 8.2)
+ *     - 0.7: factory method call (`Foo.create()` — uppercase-first heuristic)
+ *   Higher-confidence entries take priority when the same variable is seen
+ *   twice. Class declarations propagate their name into the subtree; class
+ *   *expressions* (`const Foo = class Bar { … }`) propagate null because the
+ *   expression-internal name is never visible to the resolver, preserving the
+ *   `this.prop` fallback in resolveByMethodOrGlobal. No reset at function
+ *   boundaries.
+ *
+ * - object-rest params (`objectRestClass`, Phase 8.3f): context flows only
+ *   class_declaration/class → class_body → method_definition so methods are
+ *   keyed "ClassName.method"; every other node type resets to null, and
+ *   function/method bodies recurse with null so nested declarations don't
+ *   inherit the class context.
  *
- * Higher-confidence entries take priority when the same variable is seen twice.
+ * - spread/for-of (`funcStack`/`classStack`, Phase 8.3e): tracks the
+ *   enclosing *function* (not just class) via push/pop so for-of bindings
+ *   record the qualified enclosing callable (e.g. 'Foo.bar', 'obj.method',
+ *   or '<module>' at top level).
+ *
+ * NOTE: returnTypeMap population stays a separate, earlier pass
+ * (extractReturnTypeMapWalk) — handleVarDeclaratorTypeMap reads it for
+ * inter-procedural propagation, so it must be complete for the whole file
+ * before any declarator is processed (a function declared *after* its first
+ * use would otherwise be missed).
  */
-function extractTypeMapWalk(rootNode, typeMap) {
-    function walk(node, depth) {
+function runContextCollectorWalk(rootNode, out) {
+    const funcStack = [];
+    const classStack = [];
+    const walk = (node, depth, typeMapClass, objectRestClass) => {
         if (depth >= MAX_WALK_DEPTH)
             return;
         const t = node.type;
+        const isClassDecl = t === 'class_declaration' || t === 'abstract_class_declaration';
+        const isClassExpr = t === 'class';
+        const isFnDecl = t === 'function_declaration' || t === 'generator_function_declaration';
+        // Class name read once, shared by every concern that needs it below.
+        let className = null;
+        let classNameIsIdentifier = false;
+        if (isClassDecl || isClassExpr) {
+            const nameNode = node.childForFieldName('name');
+            className = nameNode?.text ?? null;
+            classNameIsIdentifier = nameNode?.type === 'identifier';
+        }
+        // ── spread/for-of enclosing-context stacks (push on enter, pop after children) ──
+        let pushedFunc = false;
+        let pushedClass = false;
+        if (isClassDecl || isClassExpr) {
+            // The stack push keeps the original walk's `identifier`-only check (TS
+            // class names parse as type_identifier and were never pushed), while
+            // typeMapClass/objectRestClass below use the bare text like their
+            // original walks did.
+            if (className && classNameIsIdentifier) {
+                classStack.push(className);
+                pushedClass = true;
+            }
+        }
+        else if (isFnDecl) {
+            const nameNode = node.childForFieldName('name');
+            if (nameNode?.type === 'identifier') {
+                funcStack.push(nameNode.text);
+                pushedFunc = true;
+            }
+        }
+        else if (t === 'method_definition') {
+            const nameNode = node.childForFieldName('name');
+            if (nameNode) {
+                // Qualify with the enclosing class name so the PTS key matches
+                // callerName from findCaller (which uses def.name = 'ClassName.method').
+                const enclosingClass = classStack.length > 0 ? classStack[classStack.length - 1] : null;
+                const qualifiedName = enclosingClass ? `${enclosingClass}.${nameNode.text}` : nameNode.text;
+                funcStack.push(qualifiedName);
+                pushedFunc = true;
+            }
+        }
+        else if (t === 'variable_declarator') {
+            // `const process = (arr) => { ... }` — arrow/expression functions assigned
+            // to a variable have no `name` field on the function node itself.
+            const nameNode = node.childForFieldName('name');
+            const valueNode = node.childForFieldName('value');
+            if (nameNode?.type === 'identifier' &&
+                (valueNode?.type === 'arrow_function' || valueNode?.type === 'function_expression')) {
+                funcStack.push(nameNode.text);
+                pushedFunc = true;
+            }
+        }
+        else if (t === 'assignment_expression') {
+            // `obj.method = function() { ... }` — func-prop assignment.
+            // Mirror handleFuncPropAssignment's logic so for-of loops inside the
+            // body get the correct enclosingFunc (e.g. 'obj.method') instead of
+            // '<module>' or the wrong outer function name.
+            const lhs = node.childForFieldName('left');
+            const rhs = node.childForFieldName('right');
+            if (lhs?.type === 'member_expression' &&
+                (rhs?.type === 'function_expression' || rhs?.type === 'arrow_function')) {
+                const obj = lhs.childForFieldName('object');
+                const prop = lhs.childForFieldName('property');
+                if (obj?.type === 'identifier' &&
+                    (prop?.type === 'property_identifier' || prop?.type === 'identifier') &&
+                    !BUILTIN_GLOBALS.has(obj.text) &&
+                    prop.text !== 'prototype') {
+                    funcStack.push(`${obj.text}.${prop.text}`);
+                    pushedFunc = true;
+                }
+            }
+        }
+        // ── per-node collectors (class nodes match none of these types) ──
         if (t === 'variable_declarator') {
-            handleVarDeclaratorTypeMap(node, typeMap);
+            handleVarDeclaratorTypeMap(node, out.typeMap, out.returnTypeMap, out.callAssignments, out.fnRefBindings);
+            collectCollectionWrapBinding(node, out.fnRefBindings);
         }
         else if (t === 'required_parameter' || t === 'optional_parameter') {
-            handleParamTypeMap(node, typeMap);
+            handleParamTypeMap(node, out.typeMap);
+        }
+        else if (t === 'assignment_expression') {
+            handlePropWriteTypeMap(node, out.typeMap, typeMapClass);
+        }
+        else if (t === 'call_expression') {
+            handleDefinePropertyTypeMap(node, out.typeMap);
+            collectSpreadAndArrayFromBindings(node, out.spreadArgBindings, out.arrayCallbackBindings);
+        }
+        else if (t === 'for_in_statement') {
+            const enclosingFunc = funcStack.length > 0 ? funcStack[funcStack.length - 1] : '<module>';
+            collectForOfBinding(node, enclosingFunc, out.forOfBindings);
+        }
+        collectObjectRestParams(node, t, objectRestClass, out.objectRestParamBindings);
+        // ── child context per concern ──
+        const childTypeMapClass = isClassDecl ? className : isClassExpr ? null : typeMapClass;
+        let childObjectRestClass = null;
+        if (t === 'class_declaration' || t === 'class') {
+            childObjectRestClass = className;
+        }
+        else if (t === 'class_body') {
+            childObjectRestClass = objectRestClass;
         }
         for (let i = 0; i < node.childCount; i++) {
-            walk(node.child(i), depth + 1);
+            walk(node.child(i), depth + 1, childTypeMapClass, childObjectRestClass);
         }
-    }
-    walk(rootNode, 0);
+        if (pushedFunc)
+            funcStack.pop();
+        if (pushedClass)
+            classStack.pop();
+    };
+    walk(rootNode, 0, null, null);
 }
 /** Extract type info from a variable_declarator: type annotation, constructor, or factory. */
-function handleVarDeclaratorTypeMap(node, typeMap) {
+function handleVarDeclaratorTypeMap(node, typeMap, returnTypeMap, callAssignments, fnRefBindings) {
     const nameN = node.childForFieldName('name');
-    if (!nameN || nameN.type !== 'identifier')
+    if (nameN?.type !== 'identifier')
         return;
     const typeAnno = findChild(node, 'type_annotation');
     const valueN = node.childForFieldName('value');
+    // Phase 8.3: record function-reference bindings before any type-analysis early returns.
+    // Captures `const fn = handler` (identifier) and `const fn = obj.method` (member_expression).
+    // Also handles `const f = fn.bind(ctx)` — bind returns a new function aliasing fn.
+    if (fnRefBindings && valueN) {
+        if (valueN.type === 'identifier' && !BUILTIN_GLOBALS.has(valueN.text)) {
+            fnRefBindings.push({ lhs: nameN.text, rhs: valueN.text });
+        }
+        else if (valueN.type === 'member_expression') {
+            const prop = valueN.childForFieldName('property');
+            const obj = valueN.childForFieldName('object');
+            // Guard: only static property access (property_identifier or identifier), not
+            // computed subscript expressions like obj[expr] where prop.text would be the
+            // full expression rather than a simple name — those can never match pts keys.
+            if (prop &&
+                (prop.type === 'property_identifier' || prop.type === 'identifier') &&
+                obj?.type === 'identifier' &&
+                !BUILTIN_GLOBALS.has(obj.text)) {
+                fnRefBindings.push({ lhs: nameN.text, rhs: prop.text, rhsReceiver: obj.text });
+            }
+        }
+        else if (valueN.type === 'call_expression') {
+            // `const f = fn.bind(ctx)` — bind returns a bound copy of fn; track f → fn so
+            // pts(f) ⊇ pts(fn) and subsequent `f(args)` calls resolve to fn.
+            // Note: only flat-identifier binds (fn.bind) are tracked here; method-receiver
+            // binds like `obj.method.bind(ctx)` are not captured (boundFn must be an identifier).
+            const callFn = valueN.childForFieldName('function');
+            if (callFn?.type === 'member_expression') {
+                const bindProp = callFn.childForFieldName('property');
+                if (bindProp?.text === 'bind') {
+                    const boundFn = callFn.childForFieldName('object');
+                    if (boundFn?.type === 'identifier' && !BUILTIN_GLOBALS.has(boundFn.text)) {
+                        fnRefBindings.push({ lhs: nameN.text, rhs: boundFn.text });
+                    }
+                }
+            }
+        }
+    }
     // Constructor on the same declaration wins over annotation: the runtime type is
     // what matters for call resolution (e.g. `const x: Base = new Derived()` should
     // resolve `x.render()` to `Derived.render`, not `Base.render`).
@@ -1078,15 +1805,50 @@ function handleVarDeclaratorTypeMap(node, typeMap) {
     }
     if (!valueN)
         return;
-    // Constructor already handled above — only factory path remains.
     if (valueN.type === 'new_expression')
         return;
-    // Factory method: const x = Foo.create() → confidence 0.7
-    else if (valueN.type === 'call_expression') {
+    if (valueN.type === 'call_expression') {
+        // Phase 8.3e: Object.create({ f1, f2 }) — seed composite pts keys obj.f1 → f1, etc.
+        const createFn = valueN.childForFieldName('function');
+        if (createFn?.type === 'member_expression') {
+            const createObj = createFn.childForFieldName('object');
+            const createProp = createFn.childForFieldName('property');
+            if (createObj?.text === 'Object' && createProp?.text === 'create') {
+                const createArgs = valueN.childForFieldName('arguments') || findChild(valueN, 'arguments');
+                if (createArgs) {
+                    let proto = null;
+                    for (let i = 0; i < createArgs.childCount; i++) {
+                        const n = createArgs.child(i);
+                        if (n && n.type !== '(' && n.type !== ')' && n.type !== ',') {
+                            proto = n;
+                            break;
+                        }
+                    }
+                    if (proto?.type === 'object') {
+                        seedProtoProperties(nameN.text, proto, typeMap);
+                    }
+                }
+                return;
+            }
+        }
+        // Phase 8.2: inter-procedural propagation — try to resolve return type from
+        // the local returnTypeMap before falling back to factory heuristics.
+        if (returnTypeMap) {
+            const result = resolveCallExprReturnType(valueN, typeMap, returnTypeMap, 0);
+            if (result) {
+                setTypeMapEntry(typeMap, nameN.text, result.type, result.confidence);
+                return;
+            }
+        }
+        // Record for cross-file resolution in build-edges.ts (imported functions)
+        if (callAssignments) {
+            recordCallAssignment(valueN, nameN.text, typeMap, callAssignments);
+        }
+        // Factory method heuristic: const x = Foo.create() → type Foo, confidence 0.7
         const fn = valueN.childForFieldName('function');
-        if (fn && fn.type === 'member_expression') {
+        if (fn?.type === 'member_expression') {
             const obj = fn.childForFieldName('object');
-            if (obj && obj.type === 'identifier') {
+            if (obj?.type === 'identifier') {
                 const objName = obj.text;
                 if (objName[0] &&
                     objName[0] !== objName[0].toLowerCase() &&
@@ -1096,11 +1858,64 @@ function handleVarDeclaratorTypeMap(node, typeMap) {
             }
         }
     }
+    // Phase 8.3f: seed composite pts keys for object literal properties.
+    // `const obj = { baz: () => {} }` → typeMap['obj.baz'] = 'obj.baz'
+    // `const obj = { baz }` (shorthand) → typeMap['obj.baz'] = 'baz'  (bare identifier target)
+    // `const obj = { baz: otherFn }` → typeMap['obj.baz'] = 'otherFn'  (identifier alias)
+    //
+    // For function/arrow values, the value is the qualified name ('obj.baz') because
+    // extractObjectLiteralFunctions now registers definitions under that qualified name to avoid
+    // polluting the global index with bare property names like 'init', 'run', or 'render'.
+    // Enables accessor this-dispatch: when typeMap['getter:this'] = 'obj',
+    // resolving this.baz() inside getter → typeMap['obj.baz'] → 'obj.baz' → lookup.byName('obj.baz').
+    //
+    // Scope guard: mirrors Rust handle_var_decl's find_parent_of_types check — skip object literals
+    // inside function bodies so function-scoped `const localObj = { fn: ... }` never seeds
+    // the typeMap (which would shadow a module-level `const obj` with the same property names).
+    if (valueN.type === 'object' && !hasFunctionScopeAncestor(node)) {
+        for (let i = 0; i < valueN.childCount; i++) {
+            const child = valueN.child(i);
+            if (!child)
+                continue;
+            if (child.type === 'shorthand_property_identifier') {
+                setTypeMapEntry(typeMap, `${nameN.text}.${child.text}`, child.text, 0.85);
+            }
+            else if (child.type === 'pair') {
+                const keyNode = child.childForFieldName('key');
+                const valNode = child.childForFieldName('value');
+                if (!keyNode || !valNode)
+                    continue;
+                const keyName = keyNode.type === 'string' ? keyNode.text.replace(/^['"]|['"]$/g, '') : keyNode.text;
+                if (!keyName)
+                    continue;
+                const qualifiedKey = `${nameN.text}.${keyName}`;
+                if (valNode.type === 'arrow_function' ||
+                    valNode.type === 'function_expression' ||
+                    valNode.type === 'function') {
+                    // Store the qualified name so the resolver finds the qualified definition.
+                    setTypeMapEntry(typeMap, qualifiedKey, qualifiedKey, 0.85);
+                }
+                else if (valNode.type === 'identifier') {
+                    setTypeMapEntry(typeMap, qualifiedKey, valNode.text, 0.85);
+                }
+            }
+            else if (child.type === 'method_definition') {
+                // Method shorthand: `const obj = { baz() {} }` → typeMap['obj.baz'] = 'obj.baz'
+                // extractObjectLiteralFunctions registers a definition under the qualified name;
+                // seed the matching typeMap entry so the two-step accessor dispatch finds it.
+                const nameNode = child.childForFieldName('name');
+                if (!nameNode)
+                    continue;
+                const qualifiedKey = `${nameN.text}.${nameNode.text}`;
+                setTypeMapEntry(typeMap, qualifiedKey, qualifiedKey, 0.85);
+            }
+        }
+    }
 }
 /** Extract type info from a required_parameter or optional_parameter. */
 function handleParamTypeMap(node, typeMap) {
     const nameNode = node.childForFieldName('pattern') || node.childForFieldName('left') || node.child(0);
-    if (!nameNode || nameNode.type !== 'identifier')
+    if (nameNode?.type !== 'identifier')
         return;
     const typeAnno = findChild(node, 'type_annotation');
     if (typeAnno) {
@@ -1109,12 +1924,527 @@ function handleParamTypeMap(node, typeMap) {
             setTypeMapEntry(typeMap, nameNode.text, typeName, 0.9);
     }
 }
+/**
+ * Phase 8.3d: seed the pts map from object property writes.
+ *
+ * `handlers.auth = authMiddleware` → typeMap.set('handlers.auth', { type: 'authMiddleware', confidence: 0.85 })
+ * `this.logger = new Logger(...)` → typeMap.set('UserService.logger', { type: 'Logger', confidence: 1.0 })
+ *   (keyed as ClassName.prop when currentClass is known, to avoid collisions across classes)
+ *
+ * Only simple `obj.prop = identifier` and `this.prop = new Ctor()` writes are tracked
+ * (not chained `a.b.c = x`). BUILTIN_GLOBALS are skipped (e.g. `console.log = fn`).
+ */
+function handlePropWriteTypeMap(node, typeMap, currentClass) {
+    const lhsN = node.childForFieldName('left');
+    const rhsN = node.childForFieldName('right');
+    if (!lhsN || !rhsN)
+        return;
+    if (lhsN.type !== 'member_expression')
+        return;
+    const obj = lhsN.childForFieldName('object');
+    const prop = lhsN.childForFieldName('property');
+    if (!obj || !prop)
+        return;
+    // Guard: only static property access (property_identifier or identifier), not
+    // computed subscript expressions — consistent with the adjacent fnRefBindings block.
+    if (prop.type !== 'property_identifier' && prop.type !== 'identifier')
+        return;
+    // this.prop = new ClassName(...) — constructor-assigned property type.
+    // Key as ClassName.prop (class-scoped) so two classes with identically-named
+    // properties don't overwrite each other's typeMap entry.
+    if (obj.type === 'this' && rhsN.type === 'new_expression') {
+        const ctorType = extractNewExprTypeName(rhsN);
+        if (ctorType) {
+            const key = currentClass ? `${currentClass}.${prop.text}` : `this.${prop.text}`;
+            setTypeMapEntry(typeMap, key, ctorType, 1.0);
+        }
+        return;
+    }
+    // obj.prop = identifier — existing behaviour (skip chained a.b.c = x and builtins)
+    if (rhsN.type !== 'identifier')
+        return;
+    if (obj.type !== 'identifier')
+        return;
+    const objName = obj.text;
+    if (BUILTIN_GLOBALS.has(objName))
+        return;
+    setTypeMapEntry(typeMap, `${objName}.${prop.text}`, rhsN.text, 0.85);
+}
+/**
+ * Phase 8.3e/8.3f: seed composite pts keys from Object.defineProperty / defineProperties.
+ *
+ * `Object.defineProperty(obj, "key", { value: fn })` → typeMap.set('obj.key', fn, 0.85)
+ * `Object.defineProperties(obj, { "k1": { value: v1 } })` → typeMap.set('obj.k1', v1, 0.85)
+ * `Object.defineProperty(obj, "key", { get: getter })` → typeMap.set('getter:this', obj, 0.85)
+ */
+function handleDefinePropertyTypeMap(node, typeMap) {
+    const fn = node.childForFieldName('function');
+    if (fn?.type !== 'member_expression')
+        return;
+    const fnObj = fn.childForFieldName('object');
+    const fnProp = fn.childForFieldName('property');
+    if (fnObj?.text !== 'Object')
+        return;
+    const method = fnProp?.text;
+    if (method !== 'defineProperty' && method !== 'defineProperties')
+        return;
+    const argsNode = node.childForFieldName('arguments') || findChild(node, 'arguments');
+    if (!argsNode)
+        return;
+    const args = [];
+    for (let i = 0; i < argsNode.childCount; i++) {
+        const n = argsNode.child(i);
+        if (n && n.type !== '(' && n.type !== ')' && n.type !== ',')
+            args.push(n);
+    }
+    if (method === 'defineProperty') {
+        if (args.length < 3)
+            return;
+        const arg0 = args[0], arg1 = args[1], arg2 = args[2];
+        if (arg0.type !== 'identifier')
+            return;
+        if (arg1.type !== 'string')
+            return;
+        const key = arg1.text.replace(/^['"]|['"]$/g, '');
+        if (!key)
+            return;
+        // Phase 8.3e: { value: fn } → obj.key pts to fn
+        const target = findDescriptorValue(arg2);
+        if (target) {
+            setTypeMapEntry(typeMap, `${arg0.text}.${key}`, target, 0.85);
+        }
+        // Phase 8.3f: { get: getter } and/or { set: setter } → this inside each accessor is arg0 (obj)
+        // Key format: '<accessorName>:this' — colon is a reserved separator used only by this phase.
+        // JS identifiers cannot contain ':', so this key never collides with real variable names.
+        for (const accessor of findDescriptorAccessors(arg2)) {
+            setTypeMapEntry(typeMap, `${accessor}:this`, arg0.text, 0.85);
+        }
+    }
+    else {
+        // defineProperties
+        if (args.length < 2)
+            return;
+        const arg0 = args[0], arg1 = args[1];
+        if (arg0.type !== 'identifier')
+            return;
+        if (arg1.type !== 'object')
+            return;
+        for (let i = 0; i < arg1.childCount; i++) {
+            const pair = arg1.child(i);
+            if (pair?.type !== 'pair')
+                continue;
+            const keyN = pair.childForFieldName('key');
+            const valN = pair.childForFieldName('value');
+            if (!keyN || !valN)
+                continue;
+            const key = keyN.type === 'string' ? keyN.text.replace(/^['"]|['"]$/g, '') : keyN.text;
+            const target = findDescriptorValue(valN);
+            if (!target)
+                continue;
+            setTypeMapEntry(typeMap, `${arg0.text}.${key}`, target, 0.85);
+        }
+    }
+}
+/** Return the identifier text of the `value` field in a property descriptor object. */
+function findDescriptorValue(desc) {
+    if (desc.type !== 'object')
+        return undefined;
+    for (let i = 0; i < desc.childCount; i++) {
+        const pair = desc.child(i);
+        if (pair?.type !== 'pair')
+            continue;
+        const key = pair.childForFieldName('key');
+        const val = pair.childForFieldName('value');
+        if (key?.text === 'value' && val?.type === 'identifier')
+            return val.text;
+    }
+    return undefined;
+}
+/**
+ * Phase 8.3f: return the identifier texts of all `get` and `set` accessors in a property
+ * descriptor. `{ get: getter, set: setter }` → ['getter', 'setter'].
+ * Returns all accessors so that each one gets a `callerName:this = obj` typeMap entry.
+ */
+function findDescriptorAccessors(desc) {
+    if (desc.type !== 'object')
+        return [];
+    const result = [];
+    for (let i = 0; i < desc.childCount; i++) {
+        const pair = desc.child(i);
+        if (pair?.type !== 'pair')
+            continue;
+        const key = pair.childForFieldName('key');
+        const val = pair.childForFieldName('value');
+        if ((key?.text === 'get' || key?.text === 'set') && val?.type === 'identifier') {
+            result.push(val.text);
+        }
+    }
+    return result;
+}
+/** Seed composite pts keys for each property in a prototype object literal. */
+function seedProtoProperties(varName, proto, typeMap) {
+    for (let i = 0; i < proto.childCount; i++) {
+        const child = proto.child(i);
+        if (!child)
+            continue;
+        if (child.type === 'shorthand_property_identifier') {
+            setTypeMapEntry(typeMap, `${varName}.${child.text}`, child.text, 0.85);
+        }
+        else if (child.type === 'pair') {
+            const keyN = child.childForFieldName('key');
+            const valN = child.childForFieldName('value');
+            if (!keyN || !valN || valN.type !== 'identifier')
+                continue;
+            const key = keyN.type === 'string' ? keyN.text.replace(/^['"]|['"]$/g, '') : keyN.text;
+            setTypeMapEntry(typeMap, `${varName}.${key}`, valN.text, 0.85);
+        }
+    }
+}
+/**
+ * Phase 8.3c: record argument-to-parameter bindings at call sites.
+ *
+ * For each `f(x, y)` where the callee is a simple identifier and an argument
+ * is a simple identifier, emits a ParamBinding so the pts solver can add
+ * constraint: pts(param_i_of_f) ⊇ pts(arg_i). The solver uses the
+ * definitionParams map to resolve the actual parameter names.
+ *
+ * Scope: intra-module only (the solver only materialises constraints for
+ * locally-defined callees, so cross-module calls produce no spurious flow).
+ */
+function collectParamBindings(node, paramBindings) {
+    const fn = node.childForFieldName('function');
+    const args = node.childForFieldName('arguments') ?? findChild(node, 'arguments');
+    if (fn?.type === 'identifier' && !BUILTIN_GLOBALS.has(fn.text) && args) {
+        let argIdx = 0;
+        for (let i = 0; i < args.childCount; i++) {
+            const child = args.child(i);
+            if (!child)
+                continue;
+            const ct = child.type;
+            if (ct === ',' || ct === '(' || ct === ')')
+                continue;
+            if (ct === 'identifier' && !BUILTIN_GLOBALS.has(child.text)) {
+                paramBindings.push({ callee: fn.text, argIndex: argIdx, argName: child.text });
+            }
+            else if (ct === 'spread_element') {
+                // f(...[a, b]) — inline array literal: expand each element as a direct param binding.
+                const inner = child.childForFieldName('argument') ?? (child.childCount > 1 ? child.child(1) : null);
+                if (inner?.type === 'array') {
+                    let elemCount = 0;
+                    for (let j = 0; j < inner.childCount; j++) {
+                        const elem = inner.child(j);
+                        if (!elem)
+                            continue;
+                        if (elem.type === ',' || elem.type === '[' || elem.type === ']')
+                            continue;
+                        if (elem.type === 'identifier' && !BUILTIN_GLOBALS.has(elem.text)) {
+                            paramBindings.push({
+                                callee: fn.text,
+                                argIndex: argIdx + elemCount,
+                                argName: elem.text,
+                            });
+                        }
+                        elemCount++;
+                    }
+                    // Advance by the exact number of slots this spread occupies and skip
+                    // the unconditional argIdx++ below so that zero-element spreads (...[])
+                    // do not shift subsequent argument indices.
+                    argIdx += elemCount;
+                    continue;
+                }
+            }
+            argIdx++;
+        }
+    }
+}
+/** Collection constructors whose argument is treated as an element source. */
+const COLLECTION_CTOR_SET = new Set(['Set', 'Map']);
+/**
+ * Phase 8.3e: Extract array-element bindings from `const arr = [fn1, fn2]` patterns.
+ * Emits an ArrayElemBinding for each identifier element in an array literal assigned
+ * to a variable.
+ */
+function collectArrayElemBindings(node, arrayElemBindings) {
+    const nameN = node.childForFieldName('name');
+    const valueN = node.childForFieldName('value');
+    if (nameN?.type === 'identifier' && valueN?.type === 'array') {
+        let idx = 0;
+        for (let i = 0; i < valueN.childCount; i++) {
+            const elem = valueN.child(i);
+            if (!elem)
+                continue;
+            if (elem.type === ',' || elem.type === '[' || elem.type === ']')
+                continue;
+            if (elem.type === 'identifier' && !BUILTIN_GLOBALS.has(elem.text)) {
+                arrayElemBindings.push({ arrayName: nameN.text, index: idx, elemName: elem.text });
+            }
+            idx++;
+        }
+    }
+}
+/**
+ * Phase 8.3e collectors (spread-argument, Array.from, collection-wrap, for-of
+ * bindings), invoked from runContextCollectorWalk:
+ *
+ * - Spread: `f(...arr)` → SpreadArgBinding
+ * - Array.from: `Array.from(src, cb)` → ArrayCallbackBinding
+ * - Collection wrap: `new Set(arr)` / `new Map(arr)` → FnRefBinding lhs=s[*] rhs=arr[*]
+ * - For-of: `for (const x of arr)` → ForOfBinding
+ */
+function collectSpreadAndArrayFromBindings(node, spreadArgBindings, arrayCallbackBindings) {
+    const fn = node.childForFieldName('function');
+    const argsNode = node.childForFieldName('arguments') ?? findChild(node, 'arguments');
+    // Spread: f(...arr)
+    if (fn?.type === 'identifier' && !BUILTIN_GLOBALS.has(fn.text) && argsNode) {
+        let argIdx = 0;
+        for (let i = 0; i < argsNode.childCount; i++) {
+            const child = argsNode.child(i);
+            if (!child)
+                continue;
+            if (child.type === ',' || child.type === '(' || child.type === ')')
+                continue;
+            if (child.type === 'spread_element') {
+                const spreadTarget = child.childForFieldName('argument') ?? (child.childCount > 1 ? child.child(1) : null);
+                if (spreadTarget?.type === 'identifier' && !BUILTIN_GLOBALS.has(spreadTarget.text)) {
+                    spreadArgBindings.push({
+                        callee: fn.text,
+                        arrayName: spreadTarget.text,
+                        startIndex: argIdx,
+                    });
+                }
+            }
+            argIdx++;
+        }
+    }
+    // Array.from(source, cb)
+    if (fn?.type === 'member_expression' && argsNode) {
+        const obj = fn.childForFieldName('object');
+        const prop = fn.childForFieldName('property');
+        if (obj?.text === 'Array' && prop?.text === 'from') {
+            const fnArgs = [];
+            for (let i = 0; i < argsNode.childCount; i++) {
+                const child = argsNode.child(i);
+                if (!child)
+                    continue;
+                if (child.type === ',' || child.type === '(' || child.type === ')')
+                    continue;
+                fnArgs.push(child);
+            }
+            if (fnArgs.length >= 2) {
+                const srcArg = fnArgs[0];
+                const cbArg = fnArgs[1];
+                if (srcArg.type === 'identifier' &&
+                    !BUILTIN_GLOBALS.has(srcArg.text) &&
+                    cbArg.type === 'identifier' &&
+                    !BUILTIN_GLOBALS.has(cbArg.text)) {
+                    arrayCallbackBindings.push({ sourceName: srcArg.text, calleeName: cbArg.text });
+                }
+            }
+        }
+    }
+}
+/** Collection wrap: `const s = new Set(arr)` or `new Map(arr)` (variable_declarator). */
+function collectCollectionWrapBinding(node, fnRefBindings) {
+    const nameN = node.childForFieldName('name');
+    const valueN = node.childForFieldName('value');
+    if (nameN?.type === 'identifier' && valueN?.type === 'new_expression') {
+        const ctor = valueN.childForFieldName('constructor');
+        const args = valueN.childForFieldName('arguments');
+        if (ctor && COLLECTION_CTOR_SET.has(ctor.text) && args) {
+            for (let i = 0; i < args.childCount; i++) {
+                const arg = args.child(i);
+                if (!arg || arg.type === '(' || arg.type === ')')
+                    continue;
+                if (arg.type === 'identifier' && !BUILTIN_GLOBALS.has(arg.text)) {
+                    fnRefBindings.push({ lhs: `${nameN.text}[*]`, rhs: `${arg.text}[*]` });
+                    break;
+                }
+            }
+        }
+    }
+}
+/** For-of: `for (const x of arr)` (for_in_statement with an `of` keyword). */
+function collectForOfBinding(node, enclosingFunc, forOfBindings) {
+    let isForOf = false;
+    for (let i = 0; i < node.childCount; i++) {
+        if (node.child(i)?.text === 'of') {
+            isForOf = true;
+            break;
+        }
+    }
+    if (!isForOf)
+        return;
+    const right = node.childForFieldName('right');
+    if (right?.type !== 'identifier' || BUILTIN_GLOBALS.has(right.text))
+        return;
+    const left = node.childForFieldName('left');
+    let varName = null;
+    if (left?.type === 'identifier') {
+        varName = left.text;
+    }
+    else if (left) {
+        for (let i = 0; i < left.childCount; i++) {
+            const lc = left.child(i);
+            if (lc?.type === 'variable_declarator') {
+                const nc = lc.childForFieldName('name');
+                if (nc?.type === 'identifier') {
+                    varName = nc.text;
+                    break;
+                }
+            }
+            else if (lc?.type === 'identifier' &&
+                lc.text !== 'const' &&
+                lc.text !== 'let' &&
+                lc.text !== 'var') {
+                varName = lc.text;
+                break;
+            }
+        }
+    }
+    if (varName && !BUILTIN_GLOBALS.has(varName)) {
+        forOfBindings.push({ varName, sourceName: right.text, enclosingFunc });
+    }
+}
+/**
+ * Phase 8.3f: record object-destructuring rest-parameter bindings from function definitions.
+ *
+ * For each `function f({ a, ...rest })` (or arrow/function-expression equivalent),
+ * records { callee: 'f', restName: 'rest', argIndex: N }. Also covers class methods
+ * (`callee: 'ClassName.method'`) and object-literal methods (`callee: 'method'`).
+ * The edge builder uses these to seed typeMap[rest] = { type: argName } when f(obj)
+ * is called with an identifier, enabling `rest.method()` calls to resolve.
+ */
+function collectObjectRestParams(node, t, currentClass, bindings) {
+    let fnName = null;
+    let paramsNode = null;
+    if (t === 'function_declaration' || t === 'generator_function_declaration') {
+        const nameN = node.childForFieldName('name');
+        if (nameN?.type === 'identifier')
+            fnName = nameN.text;
+        paramsNode = node.childForFieldName('parameters') ?? findChild(node, 'formal_parameters');
+    }
+    else if (t === 'variable_declarator') {
+        const nameN = node.childForFieldName('name');
+        const valueN = node.childForFieldName('value');
+        if (nameN?.type === 'identifier' && valueN) {
+            const vt = valueN.type;
+            if (vt === 'arrow_function' || vt === 'function_expression' || vt === 'generator_function') {
+                fnName = nameN.text;
+                paramsNode =
+                    valueN.childForFieldName('parameters') ?? findChild(valueN, 'formal_parameters');
+            }
+        }
+    }
+    else if (t === 'method_definition') {
+        // class method: `class Foo { bar({ a, ...rest }) {} }`
+        // object-literal shorthand method: `{ bar({ a, ...rest }) {} }`
+        const nameN = node.childForFieldName('name');
+        if (nameN) {
+            fnName = currentClass ? `${currentClass}.${nameN.text}` : nameN.text;
+            paramsNode = node.childForFieldName('parameters') ?? findChild(node, 'formal_parameters');
+        }
+    }
+    else if (t === 'pair') {
+        // object-literal method: `{ bar: function({ a, ...rest }) {} }`
+        // Skip computed property keys (e.g. `{ [Symbol.iterator]: function({ ...rest }) {} }`)
+        // because `callee: '[Symbol.iterator]'` can never match a paramBinding callee.
+        const keyN = node.childForFieldName('key');
+        const valueN = node.childForFieldName('value');
+        if (keyN && valueN && keyN.type !== 'computed_property_name') {
+            const vt = valueN.type;
+            if (vt === 'arrow_function' || vt === 'function_expression' || vt === 'generator_function') {
+                fnName = keyN.type === 'string' ? keyN.text.slice(1, -1) : keyN.text;
+                paramsNode =
+                    valueN.childForFieldName('parameters') ?? findChild(valueN, 'formal_parameters');
+            }
+        }
+    }
+    if (fnName && paramsNode) {
+        let paramIdx = 0;
+        for (let i = 0; i < paramsNode.childCount; i++) {
+            const child = paramsNode.child(i);
+            if (!child)
+                continue;
+            const ct = child.type;
+            if (ct === ',' || ct === '(' || ct === ')')
+                continue;
+            if (ct === 'object_pattern') {
+                for (let j = 0; j < child.childCount; j++) {
+                    const inner = child.child(j);
+                    if (!inner)
+                        continue;
+                    if (inner.type === 'rest_pattern' || inner.type === 'rest_element') {
+                        // rest_pattern node: `...identifier` — the identifier is at child index 1
+                        const restId = inner.child(1) ?? inner.childForFieldName('name');
+                        if (restId?.type === 'identifier') {
+                            bindings.push({ callee: fnName, restName: restId.text, argIndex: paramIdx });
+                        }
+                    }
+                }
+            }
+            paramIdx++;
+        }
+    }
+}
+/**
+ * Phase 8.3f: collect object-property bindings from object literals.
+ *
+ * `const obj = { e4 }` → `{ objectName: "obj", propName: "e4", valueName: "e4" }`
+ * `const obj = { e1: fn }` → `{ objectName: "obj", propName: "e1", valueName: "fn" }`
+ *
+ * Only tracks shorthand and `key: identifier` pairs; skips function literals.
+ */
+function collectObjectPropBindings(node, bindings) {
+    const nameN = node.childForFieldName('name');
+    const valueN = node.childForFieldName('value');
+    if (nameN?.type === 'identifier' && valueN?.type === 'object') {
+        const objectName = nameN.text;
+        for (let i = 0; i < valueN.childCount; i++) {
+            const child = valueN.child(i);
+            if (!child)
+                continue;
+            if (child.type === 'shorthand_property_identifier') {
+                bindings.push({ objectName, propName: child.text, valueName: child.text });
+            }
+            else if (child.type === 'pair') {
+                const keyN = child.childForFieldName('key');
+                const valN = child.childForFieldName('value');
+                if (keyN?.type === 'property_identifier' &&
+                    valN?.type === 'identifier' &&
+                    !BUILTIN_GLOBALS.has(valN.text)) {
+                    bindings.push({ objectName, propName: keyN.text, valueName: valN.text });
+                }
+            }
+        }
+    }
+}
 function extractReceiverName(objNode) {
     if (!objNode)
         return undefined;
     const t = objNode.type;
     if (t === 'identifier' || t === 'this' || t === 'super')
         return objNode.text;
+    // `(new Foo(...)).method()` — extract the constructor name so the resolver can
+    // look up `Foo.method` directly without relying on a text-based regex heuristic.
+    if (t === 'new_expression') {
+        const name = extractNewExprTypeName(objNode);
+        if (name)
+            return name;
+    }
+    if (t === 'parenthesized_expression') {
+        // Only one level of parentheses is unwrapped here. Doubly-nested parens
+        // (e.g. `((new Dog())).bark()`) and cast expressions inside parens
+        // (e.g. `(new Dog() as Animal).bark()`) fall through to raw-text handling
+        // below and are caught by the regex fallback in call-resolver.ts.
+        for (let i = 0; i < objNode.childCount; i++) {
+            const child = objNode.child(i);
+            if (child?.type === 'new_expression') {
+                const name = extractNewExprTypeName(child);
+                if (name)
+                    return name;
+            }
+        }
+    }
     return objNode.text;
 }
 function extractCallInfo(fn, callNode) {
@@ -1320,12 +2650,23 @@ function firstArgIsStringLiteral(argsNode) {
  * member-expr args are only emitted when the first argument is a string
  * literal route path — matching Express/router shape and skipping
  * `cache.get(user.id)`-style calls.
+ *
+ * `.call()` / `.apply()` / `.bind()` — the first arg is the `this` context (not a callback of
+ * the enclosing function) and subsequent args flow into the delegated function's parameters.
+ * Emitting them here would produce false-positive edges from the *calling* function.
+ * This-rebinding (fn::this → ctx) is handled separately by extractThisCallBindingsWalk.
  */
 function extractCallbackReferenceCalls(callNode) {
     const args = callNode.childForFieldName('arguments') || findChild(callNode, 'arguments');
     if (!args)
         return [];
     const calleeName = extractCalleeName(callNode);
+    // .call() / .apply() / .bind() — the first arg is the `this` context (not a callback of
+    // the enclosing function) and subsequent args flow into the delegated function's parameters.
+    // Emitting them here would produce false-positive edges from the *calling* function.
+    // This-rebinding (fn::this → ctx) is handled separately by extractThisCallBindingsWalk.
+    if (calleeName === 'call' || calleeName === 'apply' || calleeName === 'bind')
+        return [];
     let memberExprArgsAllowed = calleeName !== null && CALLBACK_ACCEPTING_CALLEES.has(calleeName);
     if (memberExprArgsAllowed && calleeName !== null && HTTP_VERB_CALLEES.has(calleeName)) {
         // HTTP verbs require a string-literal route path to be treated as a
@@ -1353,6 +2694,126 @@ function extractCallbackReferenceCalls(callNode) {
     }
     return result;
 }
+/**
+ * Collect, from a call_expression node:
+ * - `this(args)` call expressions → `{name: 'this', ...}` entries in `calls`
+ *   (where `this` is used as a function, not as a receiver)
+ * - `fn.call(namedCtx, ...)` / `fn.apply(namedCtx, ...)` bindings →
+ *   `{ callee: 'fn', thisArg: 'namedCtx' }` entries in `thisCallBindings`
+ */
+function collectThisCallAndBindings(node, calls, thisCallBindings) {
+    const fn = node.childForFieldName('function');
+    if (fn?.type === 'this') {
+        calls.push({ name: 'this', line: nodeStartLine(node) });
+    }
+    else if (fn?.type === 'member_expression') {
+        const obj = fn.childForFieldName('object');
+        const prop = fn.childForFieldName('property');
+        if (obj?.type === 'identifier' &&
+            prop &&
+            (prop.text === 'call' || prop.text === 'apply') &&
+            !BUILTIN_GLOBALS.has(obj.text)) {
+            const args = node.childForFieldName('arguments') || findChild(node, 'arguments');
+            if (args) {
+                for (let i = 0; i < args.childCount; i++) {
+                    const child = args.child(i);
+                    if (!child)
+                        continue;
+                    const t = child.type;
+                    if (t === '(' || t === ')' || t === ',')
+                        continue;
+                    // First real argument: only bind if it's a plain identifier
+                    if (t === 'identifier' &&
+                        !BUILTIN_GLOBALS.has(child.text) &&
+                        child.text !== 'undefined' &&
+                        child.text !== 'null') {
+                        thisCallBindings.push({ callee: obj.text, thisArg: child.text });
+                    }
+                    break;
+                }
+            }
+        }
+    }
+}
+/**
+ * Single-pass collector walk: one DFS that dispatches each node to every
+ * collector interested in its type.
+ *
+ * This replaces what had grown to ten independent full-tree traversals (one
+ * per collector). On WASM trees every node access (`child(i)`, `.type`,
+ * `childForFieldName`) marshals through the JS↔WASM boundary, so traversal
+ * count — not collector work — dominated extraction cost: the accumulated
+ * per-collector walks made extraction ~2.4× slower between v3.11.2 and
+ * v3.12.0 (7.5 → 17.7 ms/file on codegraph's own corpus).
+ *
+ * Collectors with bespoke traversal semantics stay separate:
+ * - extractConstantsWalk / extractDestructuredBindingsWalk prune function
+ *   scopes and unwrap export statements on the way down;
+ * - extractReturnTypeMapWalk / extractTypeMapWalk / extractSpreadForOfWalk /
+ *   extractObjectRestParamBindingsWalk thread enclosing-class context with
+ *   per-walk reset rules that intentionally differ (see each walk's comments).
+ */
+function runCollectorWalk(rootNode, targets) {
+    const walk = (node, depth, inDynamicImport) => {
+        if (depth >= MAX_WALK_DEPTH)
+            return;
+        let childInDynamicImport = inDynamicImport;
+        switch (node.type) {
+            case 'call_expression': {
+                // Matched import() calls suppress *dynamic-import* collection in their
+                // argument subtree (mirrors the old walk's early return) while leaving
+                // the subtree visible to every other collector. The !inDynamicImport
+                // check runs first so nested import() calls are neither collected nor
+                // re-matched.
+                if (targets.imports && !inDynamicImport && collectDynamicImport(node, targets.imports)) {
+                    childInDynamicImport = true;
+                }
+                if (targets.calls && targets.thisCallBindings) {
+                    collectThisCallAndBindings(node, targets.calls, targets.thisCallBindings);
+                }
+                collectParamBindings(node, targets.paramBindings);
+                collectDefinePropertyReceiver(node, targets.definePropertyReceivers);
+                break;
+            }
+            case 'variable_declarator':
+                collectArrayElemBindings(node, targets.arrayElemBindings);
+                collectObjectPropBindings(node, targets.objectPropBindings);
+                break;
+            case 'expression_statement': {
+                const expr = node.child(0);
+                if (expr?.type === 'assignment_expression') {
+                    const lhs = expr.childForFieldName('left');
+                    const rhs = expr.childForFieldName('right');
+                    if (lhs && rhs) {
+                        handlePrototypeAssignment(lhs, rhs, targets.definitions, targets.typeMap);
+                        if (targets.funcPropDefs)
+                            handleFuncPropAssignment(lhs, rhs, targets.funcPropDefs);
+                    }
+                }
+                break;
+            }
+            case 'new_expression': {
+                const name = extractNewExprTypeName(node);
+                if (name)
+                    targets.newExpressions.push(name);
+                break;
+            }
+            case 'field_definition':
+            case 'public_field_definition':
+                if (targets.classMemberDefs)
+                    handleFieldDef(node, targets.classMemberDefs);
+                break;
+            case 'class_static_block':
+                if (targets.classMemberDefs)
+                    handleStaticBlock(node, targets.classMemberDefs);
+                break;
+        }
+        for (let i = 0; i < node.childCount; i++) {
+            walk(node.child(i), depth + 1, childInDynamicImport);
+        }
+    };
+    walk(rootNode, 0, false);
+}
 function findAnonymousCallback(argsNode) {
     for (let i = 0; i < argsNode.childCount; i++) {
         const child = argsNode.child(i);
@@ -1409,7 +2870,7 @@ const EVENT_METHODS = new Set(['on', 'once', 'addEventListener', 'addListener'])
 function extractCallbackDefinition(callNode, fn) {
     if (!fn)
         fn = callNode.childForFieldName('function');
-    if (!fn || fn.type !== 'member_expression')
+    if (fn?.type !== 'member_expression')
         return null;
     const prop = fn.childForFieldName('property');
     if (!prop)
@@ -1443,7 +2904,7 @@ function extractCallbackDefinition(callNode, fn) {
     // Express: app.get('/path', callback)
     if (EXPRESS_METHODS.has(method)) {
         const strArg = findFirstStringArg(args);
-        if (!strArg || !strArg.startsWith('/'))
+        if (!strArg?.startsWith('/'))
             return null;
         const cb = findAnonymousCallback(args);
         if (!cb)
@@ -1485,7 +2946,7 @@ function extractSuperclass(heritage) {
     }
     return null;
 }
-const JS_CLASS_TYPES = ['class_declaration', 'class'];
+const JS_CLASS_TYPES = ['class_declaration', 'abstract_class_declaration', 'class'];
 function findParentClass(node) {
     return findParentNode(node, JS_CLASS_TYPES);
 }
@@ -1529,7 +2990,7 @@ function extractDynamicImportNames(callNode) {
     if (current && current.type === 'await_expression')
         current = current.parent;
     // We should now be at a variable_declarator (or not, if standalone import())
-    if (!current || current.type !== 'variable_declarator')
+    if (current?.type !== 'variable_declarator')
         return [];
     const nameNode = current.childForFieldName('name');
     if (!nameNode)
@@ -1573,4 +3034,153 @@ function extractDynamicImportNames(callNode) {
     }
     return [];
 }
+// ── Phase 8.X: Prototype-based method extraction ────────────────────────────
+/**
+ * Walk the AST and extract prototype-based method definitions and aliases.
+ *
+ * Handles three patterns:
+ *   1. `Foo.prototype.bar = function(){...}` — emits Foo.bar as method definition
+ *   2. `Foo.prototype.bar = identifier`       — sets typeMap['Foo.bar'] = { type: identifier }
+ *   3. `Foo.prototype = { bar: fn, ... }`     — emits defs and typeMap entries per property
+ *
+ * Emitting definitions under the canonical `ClassName.methodName` name lets the
+ * existing typeMap-based call resolver find them when a typed receiver dispatches
+ * `instance.method()` (lookup.byName('C.foo') in resolveByMethodOrGlobal).
+ *
+ * typeMap entries for identifier aliases (`Foo.bar → { type: 'someId' }`) are
+ * consumed by the prototype-alias fallback added to resolveByMethodOrGlobal.
+ */
+// Prototype-method assignments (`Foo.prototype.bar = fn`) are collected inline
+// in runCollectorWalk's expression_statement case via handlePrototypeAssignment.
+/**
+ * Handle an assignment_expression that may be a prototype assignment.
+ *
+ * Matches:
+ *   - `Foo.prototype.bar = rhs`  (lhs ends in .prototype.bar)
+ *   - `Foo.prototype = { ... }`  (lhs ends in .prototype, rhs is object literal)
+ */
+function handlePrototypeAssignment(lhs, rhs, definitions, typeMap) {
+    if (lhs.type !== 'member_expression')
+        return;
+    const lhsObj = lhs.childForFieldName('object');
+    const lhsProp = lhs.childForFieldName('property');
+    if (!lhsObj || !lhsProp)
+        return;
+    // Pattern 1: `Foo.prototype.bar = rhs`
+    // lhs.object is `Foo.prototype` (member_expression), lhs.property is `bar`
+    if (lhsObj.type === 'member_expression' &&
+        (lhsProp.type === 'property_identifier' || lhsProp.type === 'identifier')) {
+        const protoObj = lhsObj.childForFieldName('object');
+        const protoProp = lhsObj.childForFieldName('property');
+        if (protoObj?.type === 'identifier' &&
+            protoProp?.text === 'prototype' &&
+            !BUILTIN_GLOBALS.has(protoObj.text)) {
+            emitPrototypeMethod(protoObj.text, lhsProp.text, rhs, definitions, typeMap);
+        }
+        return;
+    }
+    // Pattern 2: `Foo.prototype = { bar: fn, ... }`
+    // lhs.object is `Foo` (identifier), lhs.property is `prototype`
+    if (lhsObj.type === 'identifier' &&
+        lhsProp.text === 'prototype' &&
+        !BUILTIN_GLOBALS.has(lhsObj.text) &&
+        rhs.type === 'object') {
+        extractPrototypeObjectLiteral(lhsObj.text, rhs, definitions, typeMap);
+    }
+}
+/** Emit one prototype method definition or typeMap alias for `ClassName.methodName = rhs`. */
+function emitPrototypeMethod(className, methodName, rhs, definitions, typeMap) {
+    const fullName = `${className}.${methodName}`;
+    if (rhs.type === 'function_expression' || rhs.type === 'arrow_function') {
+        definitions.push({
+            name: fullName,
+            kind: 'method',
+            line: nodeStartLine(rhs),
+            endLine: nodeEndLine(rhs),
+        });
+    }
+    else if (rhs.type === 'identifier' && !BUILTIN_GLOBALS.has(rhs.text)) {
+        // Prototype alias: `A.prototype.t = f` → typeMap['A.t'] = { type: 'f' }
+        // Consumed by the prototype-alias fallback in resolveByMethodOrGlobal.
+        setTypeMapEntry(typeMap, fullName, rhs.text, 0.9);
+    }
+}
+/**
+ * Extract function-as-object property method definitions.
+ *
+ * Handles `fn.method = function() {}` and `fn.method = () => {}` patterns.
+ * Emits a `method` definition named `fn.method` so that:
+ *   1. `findCaller` attributes calls inside the body to `fn.method`
+ *   2. `resolveByMethodOrGlobal` resolves `this.other()` inside `fn.method` to `fn.other`
+ *
+ * Excludes BUILTIN_GLOBALS objects and `.prototype` (handled by extractPrototypeMethodsWalk).
+ */
+// Function-as-object-property assignments (`fn.method = function(){}`) are
+// collected inline in runCollectorWalk's expression_statement case (walk path
+// only — the query path captures them via the `assign_left`/`assign_right`
+// query pattern in dispatchQueryMatch).
+function handleFuncPropAssignment(lhs, rhs, definitions) {
+    if (lhs.type !== 'member_expression')
+        return;
+    if (rhs.type !== 'function_expression' && rhs.type !== 'arrow_function')
+        return;
+    const obj = lhs.childForFieldName('object');
+    const prop = lhs.childForFieldName('property');
+    if (!obj || !prop)
+        return;
+    if (obj.type !== 'identifier')
+        return;
+    if (prop.type !== 'property_identifier' && prop.type !== 'identifier')
+        return;
+    if (BUILTIN_GLOBALS.has(obj.text))
+        return;
+    if (prop.text === 'prototype')
+        return;
+    const params = extractParameters(rhs);
+    definitions.push({
+        name: `${obj.text}.${prop.text}`,
+        kind: 'method',
+        line: nodeStartLine(rhs),
+        endLine: nodeEndLine(rhs),
+        children: params.length > 0 ? params : undefined,
+    });
+}
+/** Iterate over an object literal assigned to `Foo.prototype` and emit defs/aliases. */
+function extractPrototypeObjectLiteral(className, objNode, definitions, typeMap) {
+    for (let i = 0; i < objNode.childCount; i++) {
+        const child = objNode.child(i);
+        if (!child)
+            continue;
+        if (child.type === 'method_definition') {
+            // Shorthand method: `Foo.prototype = { bar() {} }`
+            const nameNode = child.childForFieldName('name');
+            if (nameNode) {
+                definitions.push({
+                    name: `${className}.${nameNode.text}`,
+                    kind: 'method',
+                    line: nodeStartLine(child),
+                    endLine: nodeEndLine(child),
+                });
+            }
+            continue;
+        }
+        if (child.type === 'shorthand_property_identifier') {
+            // ES6 shorthand: `Foo.prototype = { bar }` → alias typeMap['Foo.bar'] = { type: 'bar' }
+            if (!BUILTIN_GLOBALS.has(child.text)) {
+                setTypeMapEntry(typeMap, `${className}.${child.text}`, child.text, 0.9);
+            }
+            continue;
+        }
+        if (child.type !== 'pair')
+            continue;
+        const keyNode = child.childForFieldName('key');
+        const valueNode = child.childForFieldName('value');
+        if (!keyNode || !valueNode)
+            continue;
+        const methodName = keyNode.type === 'string' ? keyNode.text.replace(/['"]/g, '') : keyNode.text;
+        if (!methodName)
+            continue;
+        emitPrototypeMethod(className, methodName, valueNode, definitions, typeMap);
+    }
+}
 //# sourceMappingURL=javascript.js.map