@scriptc/compiler 0.4.6 → 0.4.8

package/dist/node-islands/detect.js

@@ -67,6 +67,20 @@ const BUILTIN_GLOBALS = new Set([
     "queueMicrotask",
     "structuredClone",
 ]);
+/** CommonJS module-scope names and JavaScript's value keywords: provided by
+ * the module wrapper or the language, never the global object. */
+const MODULE_SCOPE_NAMES = new Set([
+    "require",
+    "module",
+    "exports",
+    "__dirname",
+    "__filename",
+    "arguments",
+    "eval",
+    "undefined",
+    "NaN",
+    "Infinity",
+]);
 /** Writes to builtin members that the native subset models (process
  * state, tuning knobs). */
 const ALLOWED_BUILTIN_WRITES = new Set([
@@ -96,6 +110,21 @@ function builtinModuleName(spec) {
         return bare;
     return null;
 }
+/** Parentheses and the TypeScript wrappers Node erases (`as`,
+ * `satisfies`, `!` and the angle-bracket assertion). */
+function stripWrappers(node) {
+    let value = node;
+    for (;;) {
+        if (ts.isParenthesizedExpression(value) ||
+            ts.isAsExpression(value) ||
+            ts.isTypeAssertion(value) ||
+            ts.isNonNullExpression(value) ||
+            ts.isSatisfiesExpression(value))
+            value = value.expression;
+        else
+            return value;
+    }
+}
 function literalText(node) {
     if (node === undefined)
         return null;
@@ -103,6 +132,15 @@ function literalText(node) {
         return node.text;
     return null;
 }
+/** A property name the scan can spell: an identifier, a string or number
+ * literal, or a computed literal key. */
+function staticKey(node) {
+    if (ts.isIdentifier(node) || ts.isNumericLiteral(node))
+        return node.text;
+    if (ts.isComputedPropertyName(node))
+        return literalText(stripWrappers(node.expression));
+    return literalText(node);
+}
 /** A specifier that folds at build time: a literal, or a concatenation of
  * literals. */
 function isFoldableSpecifier(node) {
@@ -117,6 +155,15 @@ function isFoldableSpecifier(node) {
 function isAssignmentOperator(kind) {
     return kind >= ts.SyntaxKind.FirstAssignment && kind <= ts.SyntaxKind.LastAssignment;
 }
+/** The key of an object-literal property (`name`, `"name"` or a
+ * template without substitutions). */
+function literalKeyName(name) {
+    if (name === undefined)
+        return null;
+    if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNoSubstitutionTemplateLiteral(name))
+        return name.text;
+    return null;
+}
 function propertyName(node) {
     if (ts.isPropertyAccessExpression(node)) {
         const name = node.name;
@@ -129,15 +176,14 @@ function propertyName(node) {
 /** `a.b.c` as "a.b.c" (element accesses with literal keys included), or
  * null when the chain has a computed key or does not start at a name. */
 function chainText(node) {
-    if (ts.isIdentifier(node))
-        return node.text;
-    if (node.kind === ts.SyntaxKind.ThisKeyword)
+    const value = stripWrappers(node);
+    if (ts.isIdentifier(value))
+        return value.text;
+    if (value.kind === ts.SyntaxKind.ThisKeyword)
         return "this";
-    if (ts.isParenthesizedExpression(node))
-        return chainText(node.expression);
-    if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
-        const base = chainText(node.expression);
-        const name = propertyName(node);
+    if (ts.isPropertyAccessExpression(value) || ts.isElementAccessExpression(value)) {
+        const base = chainText(value.expression);
+        const name = propertyName(value);
         if (base === null || name === null)
             return null;
         return `${base}.${name}`;
@@ -146,32 +192,29 @@ function chainText(node) {
 }
 /** Like chainText, with computed keys spelled `[…]`: `process.env[…]`. */
 function memberText(node) {
-    const text = chainText(node);
+    const value = stripWrappers(node);
+    const text = chainText(value);
     if (text !== null)
         return text;
-    if (ts.isElementAccessExpression(node)) {
-        const base = memberText(node.expression);
+    if (ts.isElementAccessExpression(value)) {
+        const base = memberText(value.expression);
         return base === null ? null : `${base}[…]`;
     }
-    if (ts.isPropertyAccessExpression(node)) {
-        const base = memberText(node.expression);
-        const name = propertyName(node);
+    if (ts.isPropertyAccessExpression(value)) {
+        const base = memberText(value.expression);
+        const name = propertyName(value);
         return base === null || name === null ? null : `${base}.${name}`;
     }
     return null;
 }
 /** The identifier a member chain starts at (`a` of `a.b[c].d`). */
 function chainRoot(node) {
-    let cur = node;
+    let cur = stripWrappers(node);
     for (;;) {
         if (ts.isIdentifier(cur))
             return cur;
         if (ts.isPropertyAccessExpression(cur) || ts.isElementAccessExpression(cur)) {
-            cur = cur.expression;
-            continue;
-        }
-        if (ts.isParenthesizedExpression(cur)) {
-            cur = cur.expression;
+            cur = stripWrappers(cur.expression);
             continue;
         }
         return null;
@@ -212,6 +255,83 @@ function isFunctionBoundary(node) {
         ts.isGetAccessorDeclaration(node) ||
         ts.isSetAccessorDeclaration(node));
 }
+/** Whether `node`, an identifier, is read rather than written, declared or
+ * used as a name. A shorthand property and a `typeof` operand are reads. */
+function isReadPosition(node, parent) {
+    if (ts.isPropertyAccessExpression(parent) && parent.name === node)
+        return false;
+    if ((ts.isPropertyAssignment(parent) ||
+        ts.isMethodDeclaration(parent) ||
+        ts.isPropertyDeclaration(parent) ||
+        ts.isGetAccessorDeclaration(parent) ||
+        ts.isSetAccessorDeclaration(parent)) &&
+        parent.name === node)
+        return false;
+    if ((ts.isPropertySignature(parent) || ts.isMethodSignatureDeclaration(parent)) &&
+        parent.name === node)
+        return false;
+    if (ts.isLabeledStatement(parent) && parent.label === node)
+        return false;
+    if ((ts.isBreakStatement(parent) || ts.isContinueStatement(parent)) && parent.label === node)
+        return false;
+    if (ts.isBinaryExpression(parent) &&
+        parent.left === node &&
+        isAssignmentOperator(parent.operatorToken.kind))
+        return false;
+    if ((ts.isPrefixUnaryExpression(parent) || ts.isPostfixUnaryExpression(parent)) &&
+        parent.operand === node &&
+        (parent.operator === ts.SyntaxKind.PlusPlusToken ||
+            parent.operator === ts.SyntaxKind.MinusMinusToken))
+        return false;
+    if (ts.isDeleteExpression(parent) && parent.expression === node)
+        return false;
+    if ((ts.isForOfStatement(parent) || ts.isForInStatement(parent)) && parent.initializer === node)
+        return false;
+    return true;
+}
+/** Whether `node` sits in a type position: a name there is a type, not a
+ * value the global object could provide. */
+function isTypePosition(node) {
+    let current = node;
+    let parent = current.parent;
+    while (parent !== undefined) {
+        if (ts.isTypeNode(parent))
+            return true;
+        // A declaration's annotation (`const x: T`), a return type, `as` and
+        // `satisfies` all hold their type in a `type` child.
+        if (parent.type === current)
+            return true;
+        if (ts.isExpression(parent) || ts.isStatement(parent))
+            return false;
+        current = parent;
+        parent = parent.parent;
+    }
+    return false;
+}
+/** The name a plain function value is bound to in the same file
+ * (`function f`, `var f = function`), for the constructor refinement. */
+function boundFunctionName(fn) {
+    if (ts.isFunctionDeclaration(fn))
+        return fn.name?.text ?? null;
+    const parent = fn.parent;
+    if (parent === undefined)
+        return null;
+    if (ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name))
+        return parent.name.text;
+    if (ts.isPropertyAssignment(parent))
+        return propertyName(parent.name);
+    return null;
+}
+/** `X.prototype.name = function () {}`: a method assignment, whose every
+ * call through the same spelling has a receiver. */
+function isPrototypeFunctionAssignment(left, right) {
+    let value = right;
+    while (ts.isParenthesizedExpression(value))
+        value = value.expression;
+    return (ts.isFunctionExpression(value) &&
+        ts.isPropertyAccessExpression(left.expression) &&
+        propertyName(left.expression) === "prototype");
+}
 /** One module's pre-scan. */
 class ModuleScanner {
     sf;
@@ -227,6 +347,25 @@ class ModuleScanner {
     builtinBindings = new Map();
     /** Local names bound to a createRequire(...) result. */
     createdRequires = new Set();
+    /** Local names bound to a builtin module's CommonJS object: require(),
+     * a createRequire'd require's result, a default import, or an alias of
+     * one. Writes through these names are patches of the module object. */
+    cjsBuiltinObjects = new Set();
+    /** Members read through a CommonJS builtin object (H3.4). */
+    cjsReads = [];
+    /** Reads of names the file declares nowhere and no builtin provides: each
+     * resolves on the global object at run time. */
+    globalReads = [];
+    globalReadNames = new Set();
+    /** Names the file constructs with `new`: a constructor's `this` is never
+     * the global object, so its `this` uses need no island (decision S5). */
+    constructed = new Set();
+    /** Names the file calls as a bare identifier, `f(...)`: a name used both
+     * ways is a constructor and a plain function, so it still marks. */
+    bareCalled = new Set();
+    /** Function expressions the file assigns to `X.prototype.name`: every
+     * same-file call of them is a receiver call (decision S5). */
+    prototypeFunctions = new Set();
     strictness = new Map();
     moduleStrict;
     constructor(sf) {
@@ -248,7 +387,7 @@ class ModuleScanner {
         });
         return this.markers;
     }
-    add(rule, reason, construct, node) {
+    add(rule, reason, construct, node, member) {
         if (this.markers.length >= MARKER_CAP)
             return;
         this.markers.push({
@@ -256,6 +395,7 @@ class ModuleScanner {
             reason,
             construct,
             loc: { file: this.sf.fileName, start: ts.tokenStartOfNode(node), end: node.end },
+            ...(member === undefined ? {} : { member }),
         });
     }
     bindName(name, init) {
@@ -265,21 +405,23 @@ class ModuleScanner {
             this.declared.add(name.text);
             if (init === undefined)
                 return;
-            let value = init;
-            while (ts.isParenthesizedExpression(value))
-                value = value.expression;
+            const value = stripWrappers(init);
             if (ts.isFunctionExpression(value) || ts.isArrowFunction(value))
                 this.functions.add(name.text);
             else if (ts.isClassExpression(value))
                 this.classes.add(name.text);
             const bound = this.builtinOf(value);
-            if (bound !== null)
+            if (bound !== null) {
                 this.builtinBindings.set(name.text, bound);
+                if (!bound.includes(".") && this.isCjsObjectValue(value))
+                    this.cjsBuiltinObjects.add(name.text);
+            }
             if (ts.isCallExpression(value) && this.isCreateRequireCallee(value.expression))
                 this.createdRequires.add(name.text);
             return;
         }
         if (ts.isObjectBindingPattern(name)) {
+            this.recordCjsPatternReads(name, init);
             const base = init === undefined ? null : this.builtinOf(init);
             for (const element of name.elements.nodes) {
                 if (!ts.isBindingElement(element))
@@ -301,12 +443,22 @@ class ModuleScanner {
             }
         }
     }
+    /** A value that is a builtin module's CommonJS object: a require() or a
+     * createRequire'd require's result of a builtin, or an alias of one. */
+    isCjsObjectValue(value) {
+        if (ts.isIdentifier(value))
+            return this.cjsBuiltinObjects.has(value.text);
+        if (!ts.isCallExpression(value))
+            return false;
+        return (this.isRequireCallee(value.expression) ||
+            (ts.isIdentifier(value.expression) && this.createdRequires.has(value.expression.text)));
+    }
     /** `require("fs")`, `require("node:util").inherits` → "fs", "util.inherits". */
     builtinOf(node) {
-        let value = node;
-        while (ts.isParenthesizedExpression(value))
-            value = value.expression;
-        if (ts.isCallExpression(value) && this.isRequireCallee(value.expression)) {
+        const value = stripWrappers(node);
+        if (ts.isCallExpression(value) &&
+            (this.isRequireCallee(value.expression) ||
+                (ts.isIdentifier(value.expression) && this.createdRequires.has(value.expression.text)))) {
             const spec = literalText(value.arguments.nodes[0]);
             return spec === null ? null : builtinModuleName(spec);
         }
@@ -339,12 +491,43 @@ class ModuleScanner {
                 this.declared.add(node.name.text);
                 this.classes.add(node.name.text);
             }
+            else if ((ts.isInterfaceDeclaration(node) ||
+                ts.isTypeAliasDeclaration(node) ||
+                ts.isEnumDeclaration(node) ||
+                ts.isModuleDeclaration(node)) &&
+                ts.isIdentifier(node.name)) {
+                this.declared.add(node.name.text);
+            }
+            else if (ts.isTypeParameterDeclaration(node)) {
+                this.declared.add(node.name.text);
+            }
+            else if (ts.isEnumMember(node) && ts.isIdentifier(node.name)) {
+                this.declared.add(node.name.text);
+            }
             else if (ts.isVariableDeclaration(node)) {
                 this.bindName(node.name, node.initializer);
             }
             else if (ts.isParameter(node)) {
                 this.bindName(node.name, undefined);
             }
+            else if (ts.isFunctionExpression(node) && node.name !== undefined) {
+                this.declared.add(node.name.text);
+            }
+            else if (ts.isCatchClause(node) && node.variableDeclaration !== undefined) {
+                this.bindName(node.variableDeclaration.name, undefined);
+            }
+            else if (ts.isNewExpression(node) && ts.isIdentifier(node.expression)) {
+                this.constructed.add(node.expression.text);
+            }
+            else if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
+                this.bareCalled.add(node.expression.text);
+            }
+            else if (ts.isBinaryExpression(node) &&
+                node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+                ts.isPropertyAccessExpression(node.left) &&
+                isPrototypeFunctionAssignment(node.left, node.right)) {
+                this.prototypeFunctions.add(node.right);
+            }
             else if (ts.isImportDeclaration(node)) {
                 const spec = literalText(node.moduleSpecifier);
                 const module = spec === null ? null : builtinModuleName(spec);
@@ -352,8 +535,12 @@ class ModuleScanner {
                 if (clause !== undefined) {
                     if (clause.name !== undefined) {
                         this.declared.add(clause.name.text);
-                        if (module !== null)
+                        if (module !== null) {
                             this.builtinBindings.set(clause.name.text, module);
+                            // A default import is the CommonJS object (unlike a namespace
+                            // or named import, through which Node refuses writes).
+                            this.cjsBuiltinObjects.add(clause.name.text);
+                        }
                     }
                     const bindings = clause.namedBindings;
                     if (bindings !== undefined && ts.isNamespaceImport(bindings)) {
@@ -411,13 +598,79 @@ class ModuleScanner {
     isGlobal(name) {
         return BUILTIN_GLOBALS.has(name) && !this.declared.has(name);
     }
+    /** A function declaration whose parent is a block that is not a function
+     * body: Annex B.3.2's block-level declaration, which in sloppy code also
+     * creates a `var`-like binding in the enclosing function (DESIGN.md note 1
+     * §3.1, construct 5). A declaration directly in a function body or at the
+     * top level of a script is ordinary. */
+    isAnnexBBlockFunction(fn) {
+        const parent = fn.parent;
+        if (parent === undefined || !ts.isBlock(parent))
+            return false;
+        const owner = parent.parent;
+        if (owner === undefined)
+            return false;
+        // A function-like body, a class static block or a class member
+        // initializer block is not a bare block statement.
+        return owner.body !== parent;
+    }
+    /** Whether the file shows the function is only ever called with a
+     * receiver, so native's missing sloppy `this` cannot be observed: it is
+     * constructed with `new`, or it is a `X.prototype.name` method (decision
+     * S5 — the marker islands what native gets wrong, and native passes the
+     * receiver for both shapes). */
+    receiverSafe(fn) {
+        if (this.prototypeFunctions.has(fn))
+            return true;
+        const name = boundFunctionName(fn);
+        return name !== null && this.constructed.has(name) && !this.bareCalled.has(name);
+    }
+    /** `this` in a plain function call: a sloppy function that is not a
+     * method, constructor, accessor or class member, and is not an arrow
+     * function (whose `this` is its enclosing function's). Conservative
+     * (decision S2): a file-level scan cannot see cross-file call sites, so
+     * any `this` in such a function marks the module, except the shapes the
+     * file itself proves are receiver calls (decision S5). Top-level `this`
+     * is not this marker: it is the module's exports object, and the test262
+     * profile's script-environment exclusion covers the script form. */
+    visitThis(node) {
+        if (this.isStrict(node))
+            return;
+        for (let cur = node.parent; cur !== undefined; cur = cur.parent) {
+            // An arrow function has no `this` of its own: keep looking outward.
+            if (ts.isArrowFunction(cur))
+                continue;
+            if (ts.isFunctionDeclaration(cur) || ts.isFunctionExpression(cur)) {
+                if (this.receiverSafe(cur))
+                    return;
+                this.add("R2.4", "sloppy-this", "'this' in a plain call in sloppy mode", node);
+                return;
+            }
+            // A method, constructor or accessor has a receiver; a class member
+            // initializer and a class static block have their own `this`; a
+            // property assignment's function is commonly a method too.
+            if (isFunctionBoundary(cur) ||
+                ts.isClassDeclaration(cur) ||
+                ts.isClassExpression(cur) ||
+                ts.isClassStaticBlockDeclaration(cur) ||
+                ts.isPropertyDeclaration(cur) ||
+                ts.isPropertyAssignment(cur))
+                return;
+            // Top-level `this` is the module's exports object, not a call site.
+            if (ts.isSourceFile(cur))
+                return;
+        }
+    }
     visit(node) {
         if (ts.isCallExpression(node))
             this.visitCall(node);
         else if (ts.isNewExpression(node))
             this.visitNew(node);
-        else if (ts.isBinaryExpression(node) && isAssignmentOperator(node.operatorToken.kind))
+        else if (ts.isBinaryExpression(node) && isAssignmentOperator(node.operatorToken.kind)) {
             this.visitWrite(node.left, node, "write");
+            if (node.operatorToken.kind === ts.SyntaxKind.EqualsToken)
+                this.recordCjsPatternReads(node.left, node.right);
+        }
         else if (ts.isDeleteExpression(node))
             this.visitDelete(node);
         else if (ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) {
@@ -426,7 +679,10 @@ class ModuleScanner {
                 this.visitWrite(node.operand, node, "write");
         }
         else if (ts.isWithStatement(node)) {
-            this.add("R2.4", "with", "a 'with' statement", node);
+            // A `with` in strict code is an early error (Node refuses the file
+            // too), so only sloppy code carries the sloppy-semantics marker.
+            if (!this.isStrict(node))
+                this.add("R2.4", "with", "a 'with' statement", node);
         }
         else if (ts.isImportDeclaration(node)) {
             const spec = literalText(node.moduleSpecifier);
@@ -445,6 +701,13 @@ class ModuleScanner {
             const text = chainText(node);
             if ((text === "arguments.callee" || text === "arguments.caller") && !this.isStrict(node))
                 this.add("R2.4", "sloppy-arguments", `'${text}'`, node);
+            this.recordCjsRead(node);
+        }
+        else if (ts.isElementAccessExpression(node)) {
+            this.recordCjsRead(node);
+        }
+        else if (node.kind === ts.SyntaxKind.ThisKeyword) {
+            this.visitThis(node);
         }
         else if (ts.isObjectLiteralExpression(node)) {
             for (const prop of node.properties.nodes) {
@@ -460,6 +723,100 @@ class ModuleScanner {
             this.visitFunction(node);
         }
     }
+    /** Records a read of a member of a builtin module's CommonJS object, so
+     * a patch installed by an island module can be checked against it
+     * (H3.4). The left of an assignment (and a delete or ++/-- target) is a
+     * write, not a read. A computed key reads a member the scan cannot name,
+     * so it is recorded as the whole module ("fs.*"). */
+    recordCjsRead(node) {
+        const root = chainRoot(node);
+        if (root === null || !this.cjsBuiltinObjects.has(root.text))
+            return;
+        const module = this.builtinBindings.get(root.text);
+        if (module === undefined)
+            return;
+        const text = chainText(node);
+        const parent = node.parent;
+        if (parent !== undefined) {
+            if (ts.isBinaryExpression(parent) &&
+                isAssignmentOperator(parent.operatorToken.kind) &&
+                parent.left === node)
+                return;
+            if (ts.isDeleteExpression(parent) ||
+                ts.isPrefixUnaryExpression(parent) ||
+                ts.isPostfixUnaryExpression(parent))
+                return;
+        }
+        this.pushCjsRead(text === null ? `${module}.*` : module + text.slice(root.text.length), node);
+    }
+    pushCjsRead(member, node) {
+        this.cjsReads.push({
+            member,
+            loc: { file: this.sf.fileName, start: ts.tokenStartOfNode(node), end: node.end },
+        });
+    }
+    /** The reads of a destructuring whose source is a builtin module's
+     * CommonJS object (`const { readFileSync } = require("fs")`,
+     * `({ readFileSync } = fs)`): each property it takes is read when the
+     * destructuring runs, so it sees a patch installed before. A rest element
+     * or a computed key reads members the scan cannot name ("fs.*"). */
+    recordCjsPatternReads(pattern, source) {
+        if (source === undefined)
+            return;
+        const value = stripWrappers(source);
+        if (!this.isCjsObjectValue(value))
+            return;
+        const module = this.builtinOf(value);
+        if (module === null || module.includes("."))
+            return;
+        this.recordPatternReads(pattern, module);
+    }
+    recordPatternReads(pattern, base) {
+        const target = stripWrappers(pattern);
+        const elements = [];
+        if (ts.isObjectBindingPattern(target)) {
+            for (const element of target.elements.nodes) {
+                if (!ts.isBindingElement(element))
+                    continue;
+                elements.push({
+                    key: element.propertyName ?? element.name,
+                    value: element.name,
+                    rest: element.dotDotDotToken !== undefined,
+                    node: element,
+                });
+            }
+        }
+        else if (ts.isObjectLiteralExpression(target)) {
+            for (const prop of target.properties.nodes) {
+                if (ts.isPropertyAssignment(prop))
+                    elements.push({ key: prop.name, value: prop.initializer, rest: false, node: prop });
+                else if (ts.isShorthandPropertyAssignment(prop))
+                    elements.push({ key: prop.name, value: undefined, rest: false, node: prop });
+                else if (ts.isSpreadAssignment(prop))
+                    elements.push({ key: undefined, value: undefined, rest: true, node: prop });
+            }
+        }
+        else
+            return;
+        for (const element of elements) {
+            const key = element.rest || element.key === undefined ? null : staticKey(element.key);
+            if (key === null) {
+                this.pushCjsRead(`${base.split(".")[0]}.*`, element.node);
+                continue;
+            }
+            const member = `${base}.${key}`;
+            this.pushCjsRead(member, element.node);
+            // A nested pattern reads the member's own properties too.
+            if (element.value !== undefined) {
+                let inner = stripWrappers(element.value);
+                // `{ readFileSync = fallback }` (a default) and `{ a: { b } = {} }`.
+                if (ts.isBinaryExpression(inner) && inner.operatorToken.kind === ts.SyntaxKind.EqualsToken)
+                    inner = stripWrappers(inner.left);
+                if (ts.isObjectBindingPattern(inner) || ts.isObjectLiteralExpression(inner))
+                    this.recordPatternReads(inner, member);
+            }
+        }
+    }
     visitSpecifier(spec, node) {
         const builtin = builtinModuleName(spec);
         if (builtin === "vm")
@@ -500,15 +857,24 @@ class ModuleScanner {
         let target = callee;
         while (ts.isParenthesizedExpression(target))
             target = target.expression;
+        // A bare `eval(...)` is the intrinsic's DIRECT call: it reads and
+        // creates bindings in the caller's scope, and in sloppy mode creates
+        // globals (DESIGN.md note 1 §3.1). `globalThis.eval(...)`, the
+        // comma-operator idiom `(0, eval)(...)` and the other spellings are
+        // indirect: they observe no caller scope, so only R1.1.
+        const direct = ts.isIdentifier(target) && target.text === "eval" && !this.declared.has("eval");
         if (ts.isBinaryExpression(target) && target.operatorToken.kind === ts.SyntaxKind.CommaToken)
             target = target.right;
         const text = chainText(target);
         if (text === null)
             return;
-        if ((text === "eval" && !this.declared.has("eval")) ||
-            text === "globalThis.eval" ||
-            text === "global.eval" ||
-            text === "window.eval") {
+        if (text === "eval" && !this.declared.has("eval")) {
+            this.add("R1.1", "code-from-string", "eval()", call);
+            if (direct && !this.isStrict(call))
+                this.add("R2.4", "direct-eval", "a direct call of eval() in sloppy mode", call);
+            return;
+        }
+        if (text === "globalThis.eval" || text === "global.eval" || text === "window.eval") {
             this.add("R1.1", "code-from-string", "eval()", call);
             return;
         }
@@ -560,10 +926,45 @@ class ModuleScanner {
         if (((text === "Object.defineProperty" || text === "Object.defineProperties") &&
             this.isGlobal("Object")) ||
             (text === "Reflect.defineProperty" && this.isGlobal("Reflect"))) {
+            // A definition on a builtin module's CommonJS object is a patch the
+            // code loading that object must see (R2.5, H3.1.4).
+            const target = first === undefined ? undefined : stripWrappers(first);
+            const builtin = target !== undefined && ts.isIdentifier(target) && this.cjsBuiltinObjects.has(target.text)
+                ? (this.builtinBindings.get(target.text) ?? null)
+                : null;
+            if (builtin !== null) {
+                const key = literalText(args[1] === undefined ? undefined : stripWrappers(args[1]));
+                this.add("R2.5", "builtin-patch", `'${text}()' on the builtin module '${builtin}'`, call, key === null ? `${builtin}.*` : `${builtin}.${key}`);
+                return;
+            }
             if (first !== undefined && !this.isModuleObject(first) && !this.inInteropHelper(call))
                 this.add("R2.3", "define-property", `'${text}()'`, call);
             return;
         }
+        // Object.assign(fs, …) on a builtin module's CommonJS object: every
+        // literal key is a patch (R2.5, H3.1.4).
+        if (text === "Object.assign" && this.isGlobal("Object") && first !== undefined) {
+            const target = stripWrappers(first);
+            if (ts.isIdentifier(target) && this.cjsBuiltinObjects.has(target.text)) {
+                const builtin = this.builtinBindings.get(target.text) ?? null;
+                if (builtin !== null) {
+                    const source = args.length === 2 ? stripWrappers(args[1]) : undefined;
+                    const keys = source !== undefined && ts.isObjectLiteralExpression(source)
+                        ? source.properties.nodes
+                            .map((property) => ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property)
+                            ? literalKeyName(property.name)
+                            : null)
+                            .filter((key) => key !== null)
+                        : [];
+                    if (keys.length === 0)
+                        this.add("R2.5", "builtin-patch", `'Object.assign()' on the builtin module '${builtin}'`, call, `${builtin}.*`);
+                    else
+                        for (const key of keys)
+                            this.add("R2.5", "builtin-patch", `'Object.assign()' on the builtin module '${builtin}'`, call, `${builtin}.${key}`);
+                    return;
+                }
+            }
+        }
         if (text.endsWith(".__defineGetter__") || text.endsWith(".__defineSetter__")) {
             this.add("R2.3", "define-property", `'${text.slice(text.lastIndexOf(".") + 1)}()'`, call);
             return;
@@ -706,7 +1107,10 @@ class ModuleScanner {
         if (binding !== undefined) {
             const member = binding + spelled.slice(root.text.length);
             if (!this.allowedWrite(member)) {
-                this.add("R2.5", "builtin-write", `a ${what} of the builtin module member '${member}'`, node);
+                // A write through a builtin module's CommonJS object patches that
+                // object; only code sharing Node's builtin can see it (H3.1).
+                const patch = this.cjsBuiltinObjects.has(root.text);
+                this.add("R2.5", patch ? "builtin-patch" : "builtin-write", `a ${what} of the builtin module member '${member}'`, node, patch ? member : undefined);
             }
             return;
         }
@@ -738,6 +1142,7 @@ class ModuleScanner {
     }
     visitIdentifier(node) {
         const name = node.text;
+        this.collectGlobalRead(node);
         if (name !== "WeakRef" && name !== "FinalizationRegistry")
             return;
         if (this.declared.has(name))
@@ -754,9 +1159,29 @@ class ModuleScanner {
             return;
         this.add("R1.6", "weak-ref", `'${name}'`, node);
     }
+    /** Records a read of a name the file declares nowhere and no builtin
+     * provides: Node resolves it on the global object at run time, where an
+     * island module's sloppy implicit-global write may have created it. */
+    collectGlobalRead(node) {
+        const name = node.text;
+        if (this.declared.has(name) || this.isGlobal(name) || MODULE_SCOPE_NAMES.has(name))
+            return;
+        if (this.globalReadNames.has(name) || this.globalReads.length >= MARKER_CAP)
+            return;
+        const parent = node.parent;
+        if (parent === undefined || isTypePosition(node) || !isReadPosition(node, parent))
+            return;
+        this.globalReadNames.add(name);
+        this.globalReads.push({
+            name,
+            loc: { file: this.sf.fileName, start: ts.tokenStartOfNode(node), end: node.end },
+        });
+    }
     /** Observable `arguments` aliasing in a sloppy function: writes to
      * arguments[i], or to a parameter while `arguments` is read. */
     visitFunction(fn) {
+        if (ts.isFunctionDeclaration(fn) && this.isAnnexBBlockFunction(fn) && !this.isStrict(fn))
+            this.add("R2.4", "annexb-block-function", "a function declaration in a block in sloppy mode", fn);
         const body = fn.body;
         if (body === undefined || !ts.isBlock(body))
             return;
@@ -797,9 +1222,19 @@ class ModuleScanner {
             this.add("R2.4", "sloppy-arguments", "a parameter write while 'arguments' is read in sloppy mode", seen.paramWrite);
     }
 }
-/** The R1/R2 markers of one JavaScript module, in source order. */
+/** The R1/R2 markers and CommonJS-object reads of one module, in source
+ * order. */
+export function scanModuleFacts(sf) {
+    const scanner = new ModuleScanner(sf);
+    const markers = scanner.scan();
+    return {
+        markers: markers.sort((a, b) => a.loc.start - b.loc.start),
+        cjsReads: scanner.cjsReads.sort((a, b) => a.loc.start - b.loc.start),
+        globalReads: scanner.globalReads.sort((a, b) => a.loc.start - b.loc.start),
+    };
+}
+/** The R1/R2 markers of one module, in source order. */
 export function scanModule(sf) {
-    const markers = new ModuleScanner(sf).scan();
-    return markers.sort((a, b) => a.loc.start - b.loc.start);
+    return scanModuleFacts(sf).markers;
 }
 //# sourceMappingURL=detect.js.map