@optave/codegraph 3.13.0 → 3.15.0

package/src/extractors/javascript.ts

@@ -6,6 +6,7 @@ import type {
   CallAssignment,
   ClassRelation,
   Definition,
+  DynamicKind,
   Export,
   ExtractorOutput,
   FnRefBinding,
@@ -96,6 +97,13 @@ const BUILTIN_GLOBALS: Set<string> = new Set([
 const MAX_PROPAGATION_DEPTH = 3;
 /** Confidence penalty applied per propagation hop (1.0 → 0.9 → 0.8 → 0.7). */
 export const PROPAGATION_HOP_PENALTY = 0.1;
+/**
+ * Confidence score for a return type inferred from `return new Constructor()` with no
+ * explicit TypeScript annotation.  Registered as `analysis.typeInferenceConfidence` in
+ * `src/infrastructure/config.ts` DEFAULTS — kept in sync manually until config is
+ * threaded through to `extractSymbols`.
+ */
+const INFERRED_RETURN_TYPE_CONFIDENCE = 0.85;
 
 /**
  * Extract symbols from a JS/TS parsed AST.
@@ -304,12 +312,14 @@ function dispatchQueryMatch(
   } else if (c.exp_node) {
     handleExportCapture(c, exps, imports);
   } else if (c.callfn_node) {
-    calls.push({
-      name: c.callfn_name!.text,
-      line: nodeStartLine(c.callfn_node),
-    });
+    // Route through extractCallInfo so special identifier calls (eval) get classified.
+    const callfnInfo = extractCallInfo(c.callfn_name!, c.callfn_node);
+    if (callfnInfo) calls.push(callfnInfo);
     calls.push(...extractCallbackReferenceCalls(c.callfn_node));
   } else if (c.callmem_node) {
+    // extractCallInfo → extractMemberExprCallInfo applies the plain-identifier guard for
+    // .call/.apply/.bind: when the object is a bare identifier (e.g. `fn.call(ctx)`),
+    // the call is emitted as static (no dynamic flag), matching the walk path and native engine.
     const callInfo = extractCallInfo(c.callmem_fn!, c.callmem_node);
     if (callInfo) calls.push(callInfo);
     const cbDef = extractCallbackDefinition(c.callmem_node, c.callmem_fn);
@@ -320,10 +330,20 @@ function dispatchQueryMatch(
     if (callInfo) calls.push(callInfo);
     calls.push(...extractCallbackReferenceCalls(c.callsub_node));
   } else if (c.newfn_node) {
-    calls.push({
-      name: c.newfn_name!.text,
-      line: nodeStartLine(c.newfn_node),
-    });
+    if (c.newfn_name!.text === 'Function') {
+      // new Function(body) — dynamic code execution; classify as eval kind
+      calls.push({
+        name: '<dynamic:eval>',
+        line: nodeStartLine(c.newfn_node),
+        dynamic: true,
+        dynamicKind: 'eval',
+      });
+    } else {
+      calls.push({
+        name: c.newfn_name!.text,
+        line: nodeStartLine(c.newfn_node),
+      });
+    }
   } else if (c.newmem_node) {
     const callInfo = extractCallInfo(c.newmem_fn!, c.newmem_node);
     if (callInfo) calls.push(callInfo);
@@ -382,8 +402,11 @@ function extractSymbolsQuery(tree: TreeSitterTree, query: TreeSitterQuery): Extr
     arrayCallbackBindings,
   });
 
-  // Extract definitions from destructured bindings (query patterns don't match object_pattern)
-  extractDestructuredBindingsWalk(tree.rootNode, definitions);
+  // Extract definitions from destructured bindings (query patterns don't match object_pattern).
+  // Also collects CJS require bindings (const { X } = require('…')) into a separate list so
+  // importedNames can classify them as import artifacts without creating DB edges (#1661).
+  const cjsRequireBindings: Array<{ names: string[]; source: string }> = [];
+  extractDestructuredBindingsWalk(tree.rootNode, definitions, cjsRequireBindings);
 
   // Everything without bespoke traversal semantics is collected in ONE pass:
   // dynamic import() calls, prototype-method definitions, param bindings,
@@ -426,6 +449,7 @@ function extractSymbolsQuery(tree: TreeSitterTree, query: TreeSitterQuery): Extr
     thisCallBindings,
     newExpressions,
     ...(definePropertyReceivers.size > 0 ? { definePropertyReceivers } : {}),
+    ...(cjsRequireBindings.length > 0 ? { cjsRequireBindings } : {}),
   };
 }
 
@@ -474,6 +498,7 @@ function extractConstantsWalk(node: TreeSitterNode, definitions: Definition[]):
     }
 
     extractConstDeclarators(declNode, definitions);
+    extractLetVarObjLiteralDeclarators(declNode, definitions);
 
     // Recurse into non-function, non-export-statement children (blocks, if-statements, etc.)
     if (child.type !== 'export_statement') {
@@ -490,8 +515,15 @@ function extractConstantsWalk(node: TreeSitterNode, definitions: Definition[]):
 /**
  * Walk the AST to find destructured const bindings (query patterns don't match object_pattern).
  * e.g. `const { handleToken, checkPermissions } = initAuth(config)`
+ *
+ * When `cjsRequireBindings` is provided, also records `const { X } = require('./path')` patterns
+ * so the edge builder can classify X as an import artifact rather than a local definition (#1661).
  */
-function extractDestructuredBindingsWalk(node: TreeSitterNode, definitions: Definition[]): void {
+function extractDestructuredBindingsWalk(
+  node: TreeSitterNode,
+  definitions: Definition[],
+  cjsRequireBindings?: Array<{ names: string[]; source: string }>,
+): void {
   for (let i = 0; i < node.childCount; i++) {
     const child = node.child(i);
     if (!child) continue;
@@ -519,6 +551,43 @@ function extractDestructuredBindingsWalk(node: TreeSitterNode, definitions: Defi
             nodeEndLine(declNode),
             definitions,
           );
+          // Record CJS require bindings so importedNames can classify these names
+          // as import artifacts, preventing false local-definition blocking (#1661).
+          if (cjsRequireBindings) {
+            const valueN = declarator.childForFieldName('value');
+            if (valueN?.type === 'call_expression') {
+              const fn = valueN.childForFieldName('function');
+              if (fn?.text === 'require') {
+                const args = valueN.childForFieldName('arguments');
+                const strArg = args && findChild(args, 'string');
+                if (strArg) {
+                  const modPath = strArg.text.replace(/['"]/g, '');
+                  const names: string[] = [];
+                  for (let k = 0; k < nameN.childCount; k++) {
+                    const prop = nameN.child(k);
+                    if (!prop) continue;
+                    if (
+                      prop.type === 'shorthand_property_identifier_pattern' ||
+                      prop.type === 'shorthand_property_identifier'
+                    ) {
+                      names.push(prop.text);
+                    } else if (prop.type === 'pair_pattern' || prop.type === 'pair') {
+                      const val = prop.childForFieldName('value');
+                      if (
+                        val?.type === 'identifier' ||
+                        val?.type === 'shorthand_property_identifier_pattern'
+                      ) {
+                        names.push(val.text);
+                      }
+                    }
+                  }
+                  if (names.length > 0) {
+                    cjsRequireBindings.push({ names, source: modPath });
+                  }
+                }
+              }
+            }
+          }
         } else if (nameN && nameN.type === 'array_pattern') {
           // `const [x, y] = ...` — emit a single constant node whose name is the
           // full array pattern text (e.g. `[x, y]`), matching native engine behaviour.
@@ -533,7 +602,7 @@ function extractDestructuredBindingsWalk(node: TreeSitterNode, definitions: Defi
     }
 
     if (child.type !== 'export_statement') {
-      extractDestructuredBindingsWalk(child, definitions);
+      extractDestructuredBindingsWalk(child, definitions, cjsRequireBindings);
     }
   }
 }
@@ -578,6 +647,34 @@ function extractConstDeclarators(declNode: TreeSitterNode, definitions: Definiti
   }
 }
 
+/**
+ * Extract qualified method definitions from `let`/`var` object-literal declarations.
+ * Mirrors `match_js_objlit_qualified_method_defs` in `javascript.rs`, which emits
+ * qualified definitions for `method_definition` (all declaration kinds) and
+ * `pair+arrow/function` (`let`/`var` only, since `const` is already handled by
+ * `extractConstDeclarators` → `extractObjectLiteralFunctions`).
+ *
+ * Called from extractConstantsWalk which already provides the function-scope guard.
+ * `var q1 = { m1() {} }` → emits Definition { name: 'q1.m1', kind: 'function' }
+ */
+function extractLetVarObjLiteralDeclarators(
+  declNode: TreeSitterNode,
+  definitions: Definition[],
+): void {
+  const t = declNode.type;
+  if (t !== 'lexical_declaration' && t !== 'variable_declaration') return;
+  if (declNode.text.startsWith('const ')) return; // handled by extractConstDeclarators
+
+  for (let j = 0; j < declNode.childCount; j++) {
+    const declarator = declNode.child(j);
+    if (declarator?.type !== 'variable_declarator') continue;
+    const nameN = declarator.childForFieldName('name');
+    const valueN = declarator.childForFieldName('value');
+    if (nameN?.type !== 'identifier' || !valueN || valueN.type !== 'object') continue;
+    extractObjectLiteralFunctions(valueN, nameN.text, definitions);
+  }
+}
+
 /**
  * Recursive walk to find dynamic import() calls.
  * Query patterns match call_expression with identifier/member_expression/subscript_expression
@@ -770,6 +867,9 @@ function walkJavaScriptNode(node: TreeSitterNode, ctx: ExtractorOutput): void {
     case 'enum_declaration':
       handleEnumDecl(node, ctx);
       break;
+    case 'decorator':
+      handleDecorator(node, ctx.calls);
+      break;
     case 'call_expression':
       handleCallExpr(node, ctx);
       break;
@@ -1036,6 +1136,18 @@ function handleVariableDecl(node: TreeSitterNode, ctx: ExtractorOutput): void {
           if (valueN.type === 'object') {
             extractObjectLiteralFunctions(valueN, nameN.text, ctx.definitions);
           }
+        } else if (
+          !isConst &&
+          nameN.type === 'identifier' &&
+          valueN.type === 'object' &&
+          !hasFunctionScopeAncestor(node)
+        ) {
+          // `let`/`var` object literals: extract qualified method definitions so that
+          // `obj.method()` calls resolve correctly. Mirrors Rust match_js_objlit_qualified_method_defs
+          // which emits method_definition qualified names for ALL declaration kinds and
+          // pair+arrow/function for let/var only (const is already handled above).
+          // Scope guard prevents local object properties from polluting the global index.
+          extractObjectLiteralFunctions(valueN, nameN.text, ctx.definitions);
         } else if (isConst && nameN.type === 'object_pattern' && !hasFunctionScopeAncestor(node)) {
           // Destructured bindings: const { handleToken, checkPermissions } = initAuth(...)
           // Each destructured property becomes a function definition so it can be
@@ -1050,6 +1162,40 @@ function handleVariableDecl(node: TreeSitterNode, ctx: ExtractorOutput): void {
             nodeEndLine(node),
             ctx.definitions,
           );
+          // Record CJS require bindings for import-artifact classification (#1661).
+          if (valueN?.type === 'call_expression') {
+            const fn = valueN.childForFieldName('function');
+            if (fn?.text === 'require') {
+              const args = valueN.childForFieldName('arguments');
+              const strArg = args && findChild(args, 'string');
+              if (strArg) {
+                const modPath = strArg.text.replace(/['"]/g, '');
+                const names: string[] = [];
+                for (let k = 0; k < nameN.childCount; k++) {
+                  const prop = nameN.child(k);
+                  if (!prop) continue;
+                  if (
+                    prop.type === 'shorthand_property_identifier_pattern' ||
+                    prop.type === 'shorthand_property_identifier'
+                  ) {
+                    names.push(prop.text);
+                  } else if (prop.type === 'pair_pattern' || prop.type === 'pair') {
+                    const val = prop.childForFieldName('value');
+                    if (
+                      val?.type === 'identifier' ||
+                      val?.type === 'shorthand_property_identifier_pattern'
+                    ) {
+                      names.push(val.text);
+                    }
+                  }
+                }
+                if (names.length > 0) {
+                  if (!ctx.cjsRequireBindings) ctx.cjsRequireBindings = [];
+                  ctx.cjsRequireBindings.push({ names, source: modPath });
+                }
+              }
+            }
+          }
         } else if (isConst && nameN.type === 'array_pattern' && !hasFunctionScopeAncestor(node)) {
           // Array destructuring: `const [x, y] = ...` — emit a single constant node
           // whose name is the full array pattern text (e.g. `[x, y]`), matching
@@ -1213,13 +1359,54 @@ function handleNewExpr(node: TreeSitterNode, ctx: ExtractorOutput): void {
   const ctor = node.childForFieldName('constructor') || node.child(1);
   if (!ctor) return;
   if (ctor.type === 'identifier') {
-    ctx.calls.push({ name: ctor.text, line: nodeStartLine(node) });
+    if (ctor.text === 'Function') {
+      // new Function(body) — dynamic code execution; undecidable static target
+      ctx.calls.push({
+        name: '<dynamic:eval>',
+        line: nodeStartLine(node),
+        dynamic: true,
+        dynamicKind: 'eval' as DynamicKind,
+      });
+    } else {
+      ctx.calls.push({ name: ctor.text, line: nodeStartLine(node) });
+    }
   } else if (ctor.type === 'member_expression') {
     const callInfo = extractCallInfo(ctor, node);
     if (callInfo) ctx.calls.push(callInfo);
   }
 }
 
+/**
+ * Handle a TypeScript/JS decorator node.
+ *
+ * Only handles bare-identifier and bare-member-expression decorators
+ * (`@Foo`, `@Foo.bar`) since decorated call expressions (`@Foo()`, `@Foo.bar()`)
+ * are already visited as `call_expression` children by the recursive walker.
+ */
+function handleDecorator(node: TreeSitterNode, calls: Call[]): void {
+  // Decorators wrap their expression; find the first non-@ child
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (!child || child.type === '@') continue;
+    const t = child.type;
+    if (t === 'identifier') {
+      // @Foo — the identifier is the decorator factory; emit as reflection call
+      calls.push({
+        name: child.text,
+        line: nodeStartLine(node),
+        dynamic: true,
+        dynamicKind: 'reflection',
+      });
+    } else if (t === 'member_expression') {
+      // @Foo.bar — emit as reflection; always mark dynamic since it's decorator dispatch
+      const callInfo = extractCallInfo(child, node);
+      if (callInfo) calls.push({ ...callInfo, dynamic: true, dynamicKind: 'reflection' });
+    }
+    // call_expression / other — handled by the recursive walker automatically
+    break;
+  }
+}
+
 /** Handle a dynamic import() call expression and add to imports if static. */
 function handleDynamicImportCall(node: TreeSitterNode, imports: Import[]): void {
   const args = node.childForFieldName('arguments') || findChild(node, 'arguments');
@@ -1592,8 +1779,8 @@ function storeReturnType(
     const inferred = findReturnNewExprType(body);
     if (inferred) {
       const existing = returnTypeMap.get(fnName);
-      if (!existing || 0.85 > existing.confidence)
-        returnTypeMap.set(fnName, { type: inferred, confidence: 0.85 });
+      if (!existing || INFERRED_RETURN_TYPE_CONFIDENCE > existing.confidence)
+        returnTypeMap.set(fnName, { type: inferred, confidence: INFERRED_RETURN_TYPE_CONFIDENCE });
     }
   }
 }
@@ -1967,7 +2154,190 @@ function runContextCollectorWalk(rootNode: TreeSitterNode, out: ContextCollector
   walk(rootNode, 0, null, null);
 }
 
-/** Extract type info from a variable_declarator: type annotation, constructor, or factory. */
+/**
+ * Record function-reference bindings from a variable_declarator's value node.
+ *
+ * Captures three patterns (Phase 8.3):
+ *   - `const fn = handler`          (identifier alias)
+ *   - `const fn = obj.method`       (member_expression alias)
+ *   - `const f = fn.bind(ctx)`      (bind creates a bound alias)
+ *
+ * Must be called before any type-analysis early returns so every declarator
+ * contributes to fnRefBindings regardless of whether it has a type annotation.
+ */
+function collectFnRefBindings(
+  lhsName: string,
+  valueN: TreeSitterNode,
+  fnRefBindings: FnRefBinding[],
+): void {
+  if (valueN.type === 'identifier' && !BUILTIN_GLOBALS.has(valueN.text)) {
+    fnRefBindings.push({ lhs: lhsName, rhs: valueN.text });
+    return;
+  }
+  if (valueN.type === 'member_expression') {
+    const prop = valueN.childForFieldName('property');
+    const obj = valueN.childForFieldName('object');
+    // Guard: only static property access (property_identifier or identifier), not
+    // computed subscript expressions like obj[expr] where prop.text would be the
+    // full expression rather than a simple name — those can never match pts keys.
+    if (
+      prop &&
+      (prop.type === 'property_identifier' || prop.type === 'identifier') &&
+      obj?.type === 'identifier' &&
+      !BUILTIN_GLOBALS.has(obj.text)
+    ) {
+      fnRefBindings.push({ lhs: lhsName, rhs: prop.text, rhsReceiver: obj.text });
+    }
+    return;
+  }
+  if (valueN.type === 'call_expression') {
+    // `const f = fn.bind(ctx)` — bind returns a bound copy of fn; track f → fn so
+    // pts(f) ⊇ pts(fn) and subsequent `f(args)` calls resolve to fn.
+    // Note: only flat-identifier binds (fn.bind) are tracked here; method-receiver
+    // binds like `obj.method.bind(ctx)` are not captured (boundFn must be an identifier).
+    const callFn = valueN.childForFieldName('function');
+    if (callFn?.type === 'member_expression') {
+      const bindProp = callFn.childForFieldName('property');
+      if (bindProp?.text === 'bind') {
+        const boundFn = callFn.childForFieldName('object');
+        if (boundFn?.type === 'identifier' && !BUILTIN_GLOBALS.has(boundFn.text)) {
+          fnRefBindings.push({ lhs: lhsName, rhs: boundFn.text });
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Handle the `call_expression` branch of variable_declarator type-map seeding.
+ *
+ * Processes three sub-cases in priority order:
+ *   1. Object.create({ ... }) — seeds composite pts keys from the prototype object (Phase 8.3e)
+ *   2. Inter-procedural return-type propagation via returnTypeMap (Phase 8.2)
+ *   3. Factory method heuristic: `const x = Foo.create()` → type Foo at confidence 0.7
+ */
+function handleCallExprTypeMap(
+  lhsName: string,
+  valueN: TreeSitterNode,
+  typeMap: Map<string, TypeMapEntry>,
+  returnTypeMap: Map<string, TypeMapEntry> | undefined,
+  callAssignments: CallAssignment[] | undefined,
+): void {
+  const createFn = valueN.childForFieldName('function');
+  // Phase 8.3e: Object.create({ f1, f2 }) — seed composite pts keys obj.f1 → f1, etc.
+  if (createFn?.type === 'member_expression') {
+    const createObj = createFn.childForFieldName('object');
+    const createProp = createFn.childForFieldName('property');
+    if (createObj?.text === 'Object' && createProp?.text === 'create') {
+      const createArgs = valueN.childForFieldName('arguments') || findChild(valueN, 'arguments');
+      if (createArgs) {
+        let proto: TreeSitterNode | null = null;
+        for (let i = 0; i < createArgs.childCount; i++) {
+          const n = createArgs.child(i);
+          if (n && n.type !== '(' && n.type !== ')' && n.type !== ',') {
+            proto = n;
+            break;
+          }
+        }
+        if (proto?.type === 'object') {
+          seedProtoProperties(lhsName, proto, typeMap);
+        }
+      }
+      return;
+    }
+  }
+  // Phase 8.2: inter-procedural propagation — try to resolve return type from
+  // the local returnTypeMap before falling back to factory heuristics.
+  if (returnTypeMap) {
+    const result = resolveCallExprReturnType(valueN, typeMap, returnTypeMap, 0);
+    if (result) {
+      setTypeMapEntry(typeMap, lhsName, result.type, result.confidence);
+      return;
+    }
+  }
+  // Record for cross-file resolution in build-edges.ts (imported functions)
+  if (callAssignments) {
+    recordCallAssignment(valueN, lhsName, typeMap, callAssignments);
+  }
+  // Factory method heuristic: const x = Foo.create() → type Foo, confidence 0.7
+  if (createFn?.type === 'member_expression') {
+    const obj = createFn.childForFieldName('object');
+    if (obj?.type === 'identifier') {
+      const objName = obj.text;
+      if (objName[0] && objName[0] !== objName[0].toLowerCase() && !BUILTIN_GLOBALS.has(objName)) {
+        setTypeMapEntry(typeMap, lhsName, objName, 0.7);
+      }
+    }
+  }
+}
+
+/**
+ * Seed composite pts keys from a module-level object literal assignment (Phase 8.3f).
+ *
+ * `const obj = { baz: () => {} }` → typeMap['obj.baz'] = 'obj.baz'
+ * `const obj = { baz }` (shorthand) → typeMap['obj.baz'] = 'baz'  (bare identifier target)
+ * `const obj = { baz: otherFn }` → typeMap['obj.baz'] = 'otherFn'  (identifier alias)
+ * `const obj = { baz() {} }` (method shorthand) → typeMap['obj.baz'] = 'obj.baz'
+ *
+ * For function/arrow values, the value is the qualified name ('obj.baz') because
+ * extractObjectLiteralFunctions registers definitions under that qualified name to avoid
+ * polluting the global index with bare property names like 'init', 'run', or 'render'.
+ * Enables accessor this-dispatch: when typeMap['getter:this'] = 'obj',
+ * resolving this.baz() inside getter → typeMap['obj.baz'] → 'obj.baz' → lookup.byName('obj.baz').
+ *
+ * Scope guard: caller must ensure `node` is not inside a function body
+ * (mirrors Rust handle_var_decl's find_parent_of_types check — function-scoped
+ * `const localObj = { fn: ... }` must not shadow a module-level `const obj`).
+ */
+function handleObjectLiteralTypeMap(
+  lhsName: string,
+  valueN: TreeSitterNode,
+  typeMap: Map<string, TypeMapEntry>,
+): void {
+  for (let i = 0; i < valueN.childCount; i++) {
+    const child = valueN.child(i);
+    if (!child) continue;
+    if (child.type === 'shorthand_property_identifier') {
+      setTypeMapEntry(typeMap, `${lhsName}.${child.text}`, child.text, 0.85);
+    } else if (child.type === 'pair') {
+      const keyNode = child.childForFieldName('key');
+      const valNode = child.childForFieldName('value');
+      if (!keyNode || !valNode) continue;
+      const keyName =
+        keyNode.type === 'string' ? keyNode.text.replace(/^['"]|['"]$/g, '') : keyNode.text;
+      if (!keyName) continue;
+      const qualifiedKey = `${lhsName}.${keyName}`;
+      if (
+        valNode.type === 'arrow_function' ||
+        valNode.type === 'function_expression' ||
+        valNode.type === 'function'
+      ) {
+        // Store the qualified name so the resolver finds the qualified definition.
+        setTypeMapEntry(typeMap, qualifiedKey, qualifiedKey, 0.85);
+      } else if (valNode.type === 'identifier') {
+        setTypeMapEntry(typeMap, qualifiedKey, valNode.text, 0.85);
+      }
+    } else if (child.type === 'method_definition') {
+      // Method shorthand: `const obj = { baz() {} }` → typeMap['obj.baz'] = 'obj.baz'
+      // extractObjectLiteralFunctions registers a definition under the qualified name;
+      // seed the matching typeMap entry so the two-step accessor dispatch finds it.
+      const nameNode = child.childForFieldName('name');
+      if (!nameNode) continue;
+      setTypeMapEntry(typeMap, `${lhsName}.${nameNode.text}`, `${lhsName}.${nameNode.text}`, 0.85);
+    }
+  }
+}
+
+/**
+ * Extract type info from a variable_declarator: type annotation, constructor, or factory.
+ *
+ * Orchestrates four concerns in priority order:
+ *   1. fnRefBindings — always collected first (before any early return)
+ *   2. new_expression — constructor wins over annotation (runtime type is authoritative)
+ *   3. type_annotation — confidence 0.9 for static analysis
+ *   4. call_expression / object literal — delegated to handleCallExprTypeMap /
+ *      handleObjectLiteralTypeMap
+ */
 function handleVarDeclaratorTypeMap(
   node: TreeSitterNode,
   typeMap: Map<string, TypeMapEntry>,
@@ -1981,48 +2351,12 @@ function handleVarDeclaratorTypeMap(
   const typeAnno = findChild(node, 'type_annotation');
   const valueN = node.childForFieldName('value');
 
-  // Phase 8.3: record function-reference bindings before any type-analysis early returns.
-  // Captures `const fn = handler` (identifier) and `const fn = obj.method` (member_expression).
-  // Also handles `const f = fn.bind(ctx)` — bind returns a new function aliasing fn.
+  // 1. fnRefBindings — must run before any early return so every declarator contributes.
   if (fnRefBindings && valueN) {
-    if (valueN.type === 'identifier' && !BUILTIN_GLOBALS.has(valueN.text)) {
-      fnRefBindings.push({ lhs: nameN.text, rhs: valueN.text });
-    } else if (valueN.type === 'member_expression') {
-      const prop = valueN.childForFieldName('property');
-      const obj = valueN.childForFieldName('object');
-      // Guard: only static property access (property_identifier or identifier), not
-      // computed subscript expressions like obj[expr] where prop.text would be the
-      // full expression rather than a simple name — those can never match pts keys.
-      if (
-        prop &&
-        (prop.type === 'property_identifier' || prop.type === 'identifier') &&
-        obj?.type === 'identifier' &&
-        !BUILTIN_GLOBALS.has(obj.text)
-      ) {
-        fnRefBindings.push({ lhs: nameN.text, rhs: prop.text, rhsReceiver: obj.text });
-      }
-    } else if (valueN.type === 'call_expression') {
-      // `const f = fn.bind(ctx)` — bind returns a bound copy of fn; track f → fn so
-      // pts(f) ⊇ pts(fn) and subsequent `f(args)` calls resolve to fn.
-      // Note: only flat-identifier binds (fn.bind) are tracked here; method-receiver
-      // binds like `obj.method.bind(ctx)` are not captured (boundFn must be an identifier).
-      const callFn = valueN.childForFieldName('function');
-      if (callFn?.type === 'member_expression') {
-        const bindProp = callFn.childForFieldName('property');
-        if (bindProp?.text === 'bind') {
-          const boundFn = callFn.childForFieldName('object');
-          if (boundFn?.type === 'identifier' && !BUILTIN_GLOBALS.has(boundFn.text)) {
-            fnRefBindings.push({ lhs: nameN.text, rhs: boundFn.text });
-          }
-        }
-      }
-    }
+    collectFnRefBindings(nameN.text, valueN, fnRefBindings);
   }
 
-  // Constructor on the same declaration wins over annotation: the runtime type is
-  // what matters for call resolution (e.g. `const x: Base = new Derived()` should
-  // resolve `x.render()` to `Derived.render`, not `Base.render`).
-  // When no constructor is present, annotation still takes precedence over factory.
+  // 2. Constructor wins over annotation: `const x: Base = new Derived()` resolves to Derived.
   if (valueN?.type === 'new_expression') {
     const ctorType = extractNewExprTypeName(valueN);
     if (ctorType) {
@@ -2031,7 +2365,7 @@ function handleVarDeclaratorTypeMap(
     }
   }
 
-  // Type annotation: const x: Foo = … → confidence 0.9
+  // 3. Type annotation — confidence 0.9.
   if (typeAnno) {
     const typeName = extractSimpleTypeName(typeAnno);
     if (typeName) {
@@ -2043,108 +2377,15 @@ function handleVarDeclaratorTypeMap(
   if (!valueN) return;
   if (valueN.type === 'new_expression') return;
 
+  // 4a. call_expression — Object.create / return-type propagation / factory heuristic.
   if (valueN.type === 'call_expression') {
-    // Phase 8.3e: Object.create({ f1, f2 }) — seed composite pts keys obj.f1 → f1, etc.
-    const createFn = valueN.childForFieldName('function');
-    if (createFn?.type === 'member_expression') {
-      const createObj = createFn.childForFieldName('object');
-      const createProp = createFn.childForFieldName('property');
-      if (createObj?.text === 'Object' && createProp?.text === 'create') {
-        const createArgs = valueN.childForFieldName('arguments') || findChild(valueN, 'arguments');
-        if (createArgs) {
-          let proto: TreeSitterNode | null = null;
-          for (let i = 0; i < createArgs.childCount; i++) {
-            const n = createArgs.child(i);
-            if (n && n.type !== '(' && n.type !== ')' && n.type !== ',') {
-              proto = n;
-              break;
-            }
-          }
-          if (proto?.type === 'object') {
-            seedProtoProperties(nameN.text, proto, typeMap);
-          }
-        }
-        return;
-      }
-    }
-    // Phase 8.2: inter-procedural propagation — try to resolve return type from
-    // the local returnTypeMap before falling back to factory heuristics.
-    if (returnTypeMap) {
-      const result = resolveCallExprReturnType(valueN, typeMap, returnTypeMap, 0);
-      if (result) {
-        setTypeMapEntry(typeMap, nameN.text, result.type, result.confidence);
-        return;
-      }
-    }
-    // Record for cross-file resolution in build-edges.ts (imported functions)
-    if (callAssignments) {
-      recordCallAssignment(valueN, nameN.text, typeMap, callAssignments);
-    }
-    // Factory method heuristic: const x = Foo.create() → type Foo, confidence 0.7
-    const fn = valueN.childForFieldName('function');
-    if (fn?.type === 'member_expression') {
-      const obj = fn.childForFieldName('object');
-      if (obj?.type === 'identifier') {
-        const objName = obj.text;
-        if (
-          objName[0] &&
-          objName[0] !== objName[0].toLowerCase() &&
-          !BUILTIN_GLOBALS.has(objName)
-        ) {
-          setTypeMapEntry(typeMap, nameN.text, objName, 0.7);
-        }
-      }
-    }
+    handleCallExprTypeMap(nameN.text, valueN, typeMap, returnTypeMap, callAssignments);
+    return;
   }
 
-  // Phase 8.3f: seed composite pts keys for object literal properties.
-  // `const obj = { baz: () => {} }` → typeMap['obj.baz'] = 'obj.baz'
-  // `const obj = { baz }` (shorthand) → typeMap['obj.baz'] = 'baz'  (bare identifier target)
-  // `const obj = { baz: otherFn }` → typeMap['obj.baz'] = 'otherFn'  (identifier alias)
-  //
-  // For function/arrow values, the value is the qualified name ('obj.baz') because
-  // extractObjectLiteralFunctions now registers definitions under that qualified name to avoid
-  // polluting the global index with bare property names like 'init', 'run', or 'render'.
-  // Enables accessor this-dispatch: when typeMap['getter:this'] = 'obj',
-  // resolving this.baz() inside getter → typeMap['obj.baz'] → 'obj.baz' → lookup.byName('obj.baz').
-  //
-  // Scope guard: mirrors Rust handle_var_decl's find_parent_of_types check — skip object literals
-  // inside function bodies so function-scoped `const localObj = { fn: ... }` never seeds
-  // the typeMap (which would shadow a module-level `const obj` with the same property names).
+  // 4b. Object literal — seed composite pts keys for module-level const objects.
   if (valueN.type === 'object' && !hasFunctionScopeAncestor(node)) {
-    for (let i = 0; i < valueN.childCount; i++) {
-      const child = valueN.child(i);
-      if (!child) continue;
-      if (child.type === 'shorthand_property_identifier') {
-        setTypeMapEntry(typeMap, `${nameN.text}.${child.text}`, child.text, 0.85);
-      } else if (child.type === 'pair') {
-        const keyNode = child.childForFieldName('key');
-        const valNode = child.childForFieldName('value');
-        if (!keyNode || !valNode) continue;
-        const keyName =
-          keyNode.type === 'string' ? keyNode.text.replace(/^['"]|['"]$/g, '') : keyNode.text;
-        if (!keyName) continue;
-        const qualifiedKey = `${nameN.text}.${keyName}`;
-        if (
-          valNode.type === 'arrow_function' ||
-          valNode.type === 'function_expression' ||
-          valNode.type === 'function'
-        ) {
-          // Store the qualified name so the resolver finds the qualified definition.
-          setTypeMapEntry(typeMap, qualifiedKey, qualifiedKey, 0.85);
-        } else if (valNode.type === 'identifier') {
-          setTypeMapEntry(typeMap, qualifiedKey, valNode.text, 0.85);
-        }
-      } else if (child.type === 'method_definition') {
-        // Method shorthand: `const obj = { baz() {} }` → typeMap['obj.baz'] = 'obj.baz'
-        // extractObjectLiteralFunctions registers a definition under the qualified name;
-        // seed the matching typeMap entry so the two-step accessor dispatch finds it.
-        const nameNode = child.childForFieldName('name');
-        if (!nameNode) continue;
-        const qualifiedKey = `${nameN.text}.${nameNode.text}`;
-        setTypeMapEntry(typeMap, qualifiedKey, qualifiedKey, 0.85);
-      }
-    }
+    handleObjectLiteralTypeMap(nameN.text, valueN, typeMap);
   }
 }
 
@@ -2737,6 +2978,28 @@ function extractReceiverName(objNode: TreeSitterNode | null): string | undefined
 function extractCallInfo(fn: TreeSitterNode, callNode: TreeSitterNode): Call | null {
   const fnType = fn.type;
   if (fnType === 'identifier') {
+    if (fn.text === 'eval') {
+      // eval(code) — dynamic code execution; capture first arg if it's a string literal
+      const args = callNode.childForFieldName('arguments') || findChild(callNode, 'arguments');
+      let keyExpr: string | undefined;
+      if (args) {
+        for (let i = 0; i < args.childCount; i++) {
+          const child = args.child(i);
+          if (!child) continue;
+          const t = child.type;
+          if (t === '(' || t === ')' || t === ',') continue;
+          if (t === 'string' || t === 'template_string') keyExpr = child.text;
+          break;
+        }
+      }
+      return {
+        name: '<dynamic:eval>',
+        line: nodeStartLine(callNode),
+        dynamic: true,
+        dynamicKind: 'eval',
+        keyExpr,
+      };
+    }
     return { name: fn.text, line: nodeStartLine(callNode) };
   }
   if (fnType === 'member_expression') {
@@ -2748,6 +3011,45 @@ function extractCallInfo(fn: TreeSitterNode, callNode: TreeSitterNode): Call | n
   return null;
 }
 
+/** Return the first non-punctuation argument node from a call_expression. */
+function getFirstCallArg(callNode: TreeSitterNode): TreeSitterNode | null {
+  const args = callNode.childForFieldName('arguments') || findChild(callNode, 'arguments');
+  if (!args) return null;
+  for (let i = 0; i < args.childCount; i++) {
+    const child = args.child(i);
+    if (!child) continue;
+    const t = child.type;
+    if (t === '(' || t === ')' || t === ',') continue;
+    return child;
+  }
+  return null;
+}
+
+/** Extract the logical callee from a Reflect.apply/call/construct first-arg. */
+function extractReflectCalleeFromArg(firstArg: TreeSitterNode | null, callLine: number): Call {
+  if (firstArg?.type === 'identifier') {
+    return { name: firstArg.text, line: callLine, dynamic: true, dynamicKind: 'reflection' };
+  }
+  if (firstArg?.type === 'member_expression') {
+    const innerProp = firstArg.childForFieldName('property');
+    if (innerProp?.type === 'identifier') {
+      return {
+        name: innerProp.text,
+        line: callLine,
+        dynamic: true,
+        dynamicKind: 'reflection',
+        receiver: extractReceiverName(firstArg.childForFieldName('object')),
+      };
+    }
+  }
+  return {
+    name: '<dynamic:unresolved>',
+    line: callLine,
+    dynamic: true,
+    dynamicKind: 'unresolved-dynamic',
+  };
+}
+
 /** Extract call info from a member_expression function node (obj.method()). */
 function extractMemberExprCallInfo(fn: TreeSitterNode, callNode: TreeSitterNode): Call | null {
   const obj = fn.childForFieldName('object');
@@ -2756,23 +3058,101 @@ function extractMemberExprCallInfo(fn: TreeSitterNode, callNode: TreeSitterNode)
 
   const callLine = nodeStartLine(callNode);
   const propText = prop.text;
+  const isReflect = obj?.type === 'identifier' && obj.text === 'Reflect';
 
-  // .call()/.apply()/.bind() — dynamic invocation
+  // Reflect.apply(fn, thisArg, args) — extract the first arg as callee
+  // Note: Reflect.call does not exist in the ECMAScript spec (only Reflect.apply, construct, get, etc.)
+  if (isReflect && propText === 'apply') {
+    return extractReflectCalleeFromArg(getFirstCallArg(callNode), callLine);
+  }
+
+  // Reflect.construct(Target, args) — extract the constructor as the callee
+  if (isReflect && propText === 'construct') {
+    return extractReflectCalleeFromArg(getFirstCallArg(callNode), callLine);
+  }
+
+  // Reflect.get(target, prop) — property access via reflection
+  if (isReflect && propText === 'get') {
+    const args = callNode.childForFieldName('arguments') || findChild(callNode, 'arguments');
+    if (args) {
+      let argIdx = 0;
+      let firstArg: TreeSitterNode | null = null;
+      let secondArg: TreeSitterNode | null = null;
+      for (let i = 0; i < args.childCount; i++) {
+        const child = args.child(i);
+        if (!child) continue;
+        const t = child.type;
+        if (t === '(' || t === ')' || t === ',') continue;
+        if (argIdx === 0) firstArg = child;
+        else if (argIdx === 1) secondArg = child;
+        argIdx++;
+      }
+      if (secondArg) {
+        const receiver = firstArg ? extractReceiverName(firstArg) : undefined;
+        const st = secondArg.type;
+        if (st === 'string' || st === 'string_fragment') {
+          const propName = secondArg.text.replace(/['"]/g, '');
+          if (propName) {
+            return {
+              name: propName,
+              line: callLine,
+              dynamic: true,
+              dynamicKind: 'computed-literal',
+              keyExpr: secondArg.text,
+              receiver,
+            };
+          }
+        }
+        if (st === 'identifier') {
+          return {
+            name: '<dynamic:computed-key>',
+            line: callLine,
+            dynamic: true,
+            dynamicKind: 'computed-key',
+            keyExpr: secondArg.text,
+            receiver,
+          };
+        }
+      }
+    }
+    return {
+      name: '<dynamic:unresolved>',
+      line: callLine,
+      dynamic: true,
+      dynamicKind: 'unresolved-dynamic',
+    };
+  }
+
+  // .call()/.apply()/.bind() — this-rebinding; the wrapped function is the real callee.
+  // When the object is a plain identifier (e.g. `f.call({})`), the target is statically
+  // known so we emit a static call (no dynamic flag).  This keeps parity with the native
+  // Rust engine, which also resolves these as dyn=0, and prevents the dynZeroEdgeRows
+  // upgrade path in emitDirectCallEdgesForCall from wrongly converting a dyn=0 edge
+  // (emitted by a prior direct `f()` call) to dyn=1.
+  // When the object is a member_expression (e.g. `obj.method.call({})`), we still mark
+  // it dynamic/reflection because the inner callee requires a second resolution hop.
   if (propText === 'call' || propText === 'apply' || propText === 'bind') {
-    if (obj && obj.type === 'identifier') return { name: obj.text, line: callLine, dynamic: true };
+    if (obj && obj.type === 'identifier') return { name: obj.text, line: callLine };
     if (obj && obj.type === 'member_expression') {
       const innerProp = obj.childForFieldName('property');
-      if (innerProp) return { name: innerProp.text, line: callLine, dynamic: true };
+      if (innerProp)
+        return { name: innerProp.text, line: callLine, dynamic: true, dynamicKind: 'reflection' };
     }
   }
 
-  // Computed property: obj["method"]()
+  // Computed string property: obj["method"]() — target is a literal; resolvable
   const propType = prop.type;
   if (propType === 'string' || propType === 'string_fragment') {
     const methodName = propText.replace(/['"]/g, '');
     if (methodName) {
       const receiver = extractReceiverName(obj);
-      return { name: methodName, line: callLine, dynamic: true, receiver };
+      return {
+        name: methodName,
+        line: callLine,
+        dynamic: true,
+        dynamicKind: 'computed-literal',
+        receiver,
+      };
     }
   }
 
@@ -2780,7 +3160,7 @@ function extractMemberExprCallInfo(fn: TreeSitterNode, callNode: TreeSitterNode)
   return { name: propText, line: callLine, receiver };
 }
 
-/** Extract call info from a subscript_expression function node (obj["method"]()). */
+/** Extract call info from a subscript_expression function node (obj[key]()). */
 function extractSubscriptCallInfo(fn: TreeSitterNode, callNode: TreeSitterNode): Call | null {
   const obj = fn.childForFieldName('object');
   const index = fn.childForFieldName('index');
@@ -2795,11 +3175,32 @@ function extractSubscriptCallInfo(fn: TreeSitterNode, callNode: TreeSitterNode):
         name: methodName,
         line: nodeStartLine(callNode),
         dynamic: true,
+        dynamicKind: 'computed-literal',
         receiver,
       };
     }
   }
-  return null;
+
+  // obj[variable]() — key is a variable; may be resolvable via pts (RES-1), else flagged
+  if (indexType === 'identifier') {
+    const receiver = extractReceiverName(obj);
+    return {
+      name: '<dynamic:computed-key>',
+      line: nodeStartLine(callNode),
+      dynamic: true,
+      dynamicKind: 'computed-key',
+      keyExpr: index.text,
+      receiver,
+    };
+  }
+
+  // Any other index expression (binary, call, template with ${}…) — not statically resolvable
+  return {
+    name: '<dynamic:unresolved>',
+    line: nodeStartLine(callNode),
+    dynamic: true,
+    dynamicKind: 'unresolved-dynamic',
+  };
 }
 
 /**
@@ -3118,6 +3519,10 @@ function runCollectorWalk(rootNode: TreeSitterNode, targets: CollectorWalkTarget
         if (name) targets.newExpressions.push(name);
         break;
       }
+      case 'decorator': {
+        if (targets.calls) handleDecorator(node, targets.calls);
+        break;
+      }
       case 'field_definition':
       case 'public_field_definition':
         if (targets.classMemberDefs) handleFieldDef(node, targets.classMemberDefs);