@sunshaobei/dsh-workflow 0.0.0-stage → 2.1.0

package/vendor/dynamic-workflow/analysis/causality-order.d.ts

@@ -0,0 +1,60 @@
+import type { WorkflowProgram } from "../compiler/compile.js";
+import type { SiteTable } from "./sites.js";
+import type { OrderOracle, OrderTrace } from "./causality-order-types.js";
+export { UNPHASED_ID, type JumpKind, type StructuralRegionKind, type TraceRegionKind, } from "./constants.js";
+export type { ActorEvent, ControlFact, IssueEvent, JumpEvent, MarkEvent, OrderEvent, OrderRegion, OrderTrace, PhaseInfo, SettleEvent, } from "./causality-order-types.js";
+/**
+ * The ordering trace: one evaluation-order walk over the authored script body that
+ * records WHEN each step is issued, WHERE each `await` barrier sits, and which
+ * syntactic region encloses each event. It is the only new machinery the causality
+ * graph needs.
+ *
+ * This module reads the site table, the AST, and the taint pass's ORACLE facts. It
+ * collects nothing into the site table and the oracle is keyed by source position, so
+ * every site id stays bit-for-bit identical.
+ *
+ * Await resolution has two halves:
+ *
+ *  - **syntactic** — the steps ISSUED WHILE EVALUATING the awaited expression settle
+ *    certainly. That one rule covers `await x.ask(…)`, `await Promise.all(xs.map(…))`
+ *    and `await helper()` uniformly, and it is all of phase 1.
+ *  - **the oracle** — the step labels the awaited VALUE carries, which is what resolves a
+ *    promise stored in a variable, passed into a helper, or joined. Split into certain and
+ *    may-claims by the settle-certainty rule; see `claimAt` (causality-order-settle.ts).
+ *
+ * The barrier covers the union, and widens over everything in flight only when BOTH halves
+ * are empty (`await 5`, an unknown call's promise). Widening over-orders, which understates
+ * parallelism — the honest direction. UNDER-ordering is the one thing this walk must never
+ * do, and phase 1 did: on `await Promise.all([stored, fresh])` the syntactic half found
+ * `fresh`, so the barrier never widened and `stored` was left unsettled, inventing
+ * concurrency the script does not have (order-mixed-join-stored-promise).
+ *
+ * Function bodies run only when called, so the walk never descends into a
+ * function-like node on its own; it inlines the body at each call site instead. WHICH
+ * bodies a call invokes is not guessed from syntax: the walk reads the CALL ORACLE
+ * (`OrderOracle.applications`) — the functions
+ * the converged taint interpreter applied at that node, as callee (direct, through a
+ * parameter, a field, a class member) or as an argument a library may invoke (a registry
+ * `each` / `once` entry, or the keystone default). A helper called twice therefore
+ * contributes two issue events for the same step id (phase 1 has one step per site;
+ * per-call-site specialization is phase 3). Recursion is precomputed as call-graph
+ * self-reachability over the same oracle: a recursive function's inlined body gets a
+ * `loop` region and re-entry is cut, which is what turns recursion into the same
+ * self-arrow any other sequential repetition gets. The end-of-walk sweep is left with
+ * bodies no call ever applies — genuine dead code.
+ *
+ * The trace is also a STRUCTURED CONTROL TREE read in pre-order: besides the ordering regions above it
+ * records the structural ones — `choice` grouping the arms of one if / ternary / switch /
+ * short-circuit, `call` for each inlined body, `try` / `attempt` / `catch` / `finally` —
+ * and two extra leaves, `mark` (a phase marker evaluated) and `jump` (an unstructured
+ * transfer with its target region already resolved). The causality projection looks
+ * through all of it; the control-flow projection is built from it.
+ *
+ * 拆分：本文件顶到 oxlint max-lines 上限（400 行），走查按职责拆成兄弟模块——
+ * causality-order-types（产物类型）、-state（显式共享状态 + 原语）、-settle（await 屏障与
+ * 神谕读取）、-walk（节点访问器）、-loops（循环）、-calls（调用与内联）、-functions（函数
+ * 解析）。这里只剩编排：建状态、走根语句表、收尾扫尾。公开面一个不改。
+ */
+/** Walk the authored body in evaluation order and record the ordering trace. */
+export declare function traceOrder(workflow: WorkflowProgram, table: SiteTable, oracle: OrderOracle): OrderTrace;
+//# sourceMappingURL=causality-order.d.ts.map

package/vendor/dynamic-workflow/analysis/causality-order.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"causality-order.d.ts","sourceRoot":"","sources":["../../src/analysis/causality-order.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAS1E,OAAO,EACL,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,UAAU,EACV,WAAW,EACX,UAAU,EACV,SAAS,EACT,SAAS,EACT,UAAU,EACV,WAAW,EACX,UAAU,EACV,SAAS,EACT,WAAW,GACZ,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,gFAAgF;AAChF,wBAAgB,UAAU,CACxB,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,WAAW,GAClB,UAAU,CA+CZ"}

package/vendor/dynamic-workflow/analysis/causality-order.js

@@ -0,0 +1,110 @@
+import { UNPHASED_ID } from "./constants.js";
+import { enclosingFunctions, functionName } from "./causality-order-functions.js";
+import { createTraceState, issue, locOf, openRegion } from "./causality-order-state.js";
+import { walkNode, walkStatements } from "./causality-order-walk.js";
+// 追踪词汇（区域种类、跳转种类、兜底阶段 id）定义在 constants.ts——那个文件不 import
+// `typescript`，纯投影模块（causality-graph / flow-phase / phase-graph）与浏览器端的
+// `./projections` 桶都从那里取值。这里原样再导出，
+// 既有的 `from "./causality-order.js"` 引用一个不改。
+export { UNPHASED_ID, } from "./constants.js";
+/**
+ * The ordering trace: one evaluation-order walk over the authored script body that
+ * records WHEN each step is issued, WHERE each `await` barrier sits, and which
+ * syntactic region encloses each event. It is the only new machinery the causality
+ * graph needs.
+ *
+ * This module reads the site table, the AST, and the taint pass's ORACLE facts. It
+ * collects nothing into the site table and the oracle is keyed by source position, so
+ * every site id stays bit-for-bit identical.
+ *
+ * Await resolution has two halves:
+ *
+ *  - **syntactic** — the steps ISSUED WHILE EVALUATING the awaited expression settle
+ *    certainly. That one rule covers `await x.ask(…)`, `await Promise.all(xs.map(…))`
+ *    and `await helper()` uniformly, and it is all of phase 1.
+ *  - **the oracle** — the step labels the awaited VALUE carries, which is what resolves a
+ *    promise stored in a variable, passed into a helper, or joined. Split into certain and
+ *    may-claims by the settle-certainty rule; see `claimAt` (causality-order-settle.ts).
+ *
+ * The barrier covers the union, and widens over everything in flight only when BOTH halves
+ * are empty (`await 5`, an unknown call's promise). Widening over-orders, which understates
+ * parallelism — the honest direction. UNDER-ordering is the one thing this walk must never
+ * do, and phase 1 did: on `await Promise.all([stored, fresh])` the syntactic half found
+ * `fresh`, so the barrier never widened and `stored` was left unsettled, inventing
+ * concurrency the script does not have (order-mixed-join-stored-promise).
+ *
+ * Function bodies run only when called, so the walk never descends into a
+ * function-like node on its own; it inlines the body at each call site instead. WHICH
+ * bodies a call invokes is not guessed from syntax: the walk reads the CALL ORACLE
+ * (`OrderOracle.applications`) — the functions
+ * the converged taint interpreter applied at that node, as callee (direct, through a
+ * parameter, a field, a class member) or as an argument a library may invoke (a registry
+ * `each` / `once` entry, or the keystone default). A helper called twice therefore
+ * contributes two issue events for the same step id (phase 1 has one step per site;
+ * per-call-site specialization is phase 3). Recursion is precomputed as call-graph
+ * self-reachability over the same oracle: a recursive function's inlined body gets a
+ * `loop` region and re-entry is cut, which is what turns recursion into the same
+ * self-arrow any other sequential repetition gets. The end-of-walk sweep is left with
+ * bodies no call ever applies — genuine dead code.
+ *
+ * The trace is also a STRUCTURED CONTROL TREE read in pre-order: besides the ordering regions above it
+ * records the structural ones — `choice` grouping the arms of one if / ternary / switch /
+ * short-circuit, `call` for each inlined body, `try` / `attempt` / `catch` / `finally` —
+ * and two extra leaves, `mark` (a phase marker evaluated) and `jump` (an unstructured
+ * transfer with its target region already resolved). The causality projection looks
+ * through all of it; the control-flow projection is built from it.
+ *
+ * 拆分：本文件顶到 oxlint max-lines 上限（400 行），走查按职责拆成兄弟模块——
+ * causality-order-types（产物类型）、-state（显式共享状态 + 原语）、-settle（await 屏障与
+ * 神谕读取）、-walk（节点访问器）、-loops（循环）、-calls（调用与内联）、-functions（函数
+ * 解析）。这里只剩编排：建状态、走根语句表、收尾扫尾。公开面一个不改。
+ */
+/** Walk the authored body in evaluation order and record the ordering trace. */
+export function traceOrder(workflow, table, oracle) {
+    const state = createTraceState(workflow, table, oracle, walkNode);
+    const { controls, events, fnStack, issued, phases, regions, returnTargets, root, walkedFns } = state;
+    walkStatements(state, state.body.statements, [root]);
+    // The sweep and the terminal fallback are outside every marker's extent — a body
+    // nothing called has no call site to inherit a phase from. (`walkStatements` has
+    // already restored the root value here; the assignment is the contract, not a fix.)
+    state.currentPhase = UNPHASED_ID;
+    // Sweep: a step inside a function nothing called (a `.then` callback, a method
+    // reached dynamically, dead code) still needs a position and a region. Walk the
+    // narrowest un-walked enclosing function, in site order, to a fixpoint. The region
+    // is `branch` because we cannot show the body runs at all.
+    const stepSites = [
+        ...table.asks,
+        ...table.worldReads,
+        ...table.holes.filter((site) => site.body === undefined),
+    ].sort((a, b) => a.order - b.order);
+    let progress = true;
+    while (progress) {
+        progress = false;
+        for (const site of stepSites) {
+            if (issued.has(site.id))
+                continue;
+            const owner = enclosingFunctions(site.call).find((fn) => !walkedFns.has(fn));
+            if (owner === undefined)
+                continue;
+            walkedFns.add(owner);
+            fnStack.push(owner);
+            const detached = openRegion(state, "branch", root, {
+                detached: true,
+                entered: false,
+                loc: locOf(state, owner),
+                ...(functionName(owner) === undefined ? {} : { label: functionName(owner) }),
+            });
+            returnTargets.push(detached); // a `return` here ends the detached body, not the script
+            state.walk(owner.body, [root, detached]);
+            returnTargets.pop();
+            fnStack.pop();
+            progress = true;
+        }
+    }
+    // Anything still unreached (a site inside a construct the walk cannot place) gets a
+    // terminal issue in the root region, so every step has a position.
+    for (const site of stepSites)
+        if (!issued.has(site.id))
+            issue(state, site.id, [root]);
+    return { controls, events, phases, regions, root };
+}

package/vendor/dynamic-workflow/analysis/causality-reduce.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Type-aware transitive reduction over the happens-before relation. With one arrow
+ * style on screen, reduction carries the whole burden of keeping the picture readable —
+ * and it must stay TYPED even though rendering is not. A uniform reduction over the
+ * untyped relation deletes the wrong arrows: in `planner-reviewer`, `scan → judge` is
+ * the genuine data dependency and the incidental ordering path
+ * `scan → plan → review → judge` transitively implies it, so a uniform pass would keep
+ * the incidental chain and drop the meaningful edge.
+ *
+ * Precedence: `data` = `control` > `fifo` > `seq`.
+ *
+ * 修复记录
+ *
+ * 一、前向边的删边决策改为逐边对 SURVIVING 集判定。旧实现对 ORIGINAL 关系一次性批量
+ * 删边，再用单调恢复环节补回「见证路径自身被删掉」的边——恢复一条边会重新给其他被删边
+ * 提供见证，但没有任何一步再删它们，于是在带环输入上收敛到严重过度恢复的边集（真实症状：
+ * jsonl-db 优化循环的图 66 条前向边里 55 条被其余边蕴含）。phase 1 的「一站点一步」规则
+ * 让共享 helper（循环前后各调一次）产出双向前向边，环是常态而非异常，删边算法必须在环上
+ * 保持无冗余。逐边对存活集判定后天然不需要恢复环节：每条被删的边在删除当刻都有存活见证，
+ * 后删的边不会作废先前的删除——后删边自己的见证可以代入先前见证（kind 允许集沿
+ * seq ⊇ fifo ⊇ data=control 单调收缩，代入后强度只增不减）。DAG 上与唯一的类型化传递
+ * 归约逐边一致，只有带残环的图行为改变。
+ *
+ * 二、新增 carry 最小化（旧规则「carry 永不删」作废）。carry 边断言 A@k → B@k+1，而
+ * 「k 轮内前向路径 → 恰好一跳 carry → k+1 轮内前向路径」的组合断言完全相同的事实，故有
+ * 此见证的 carry 是纯冗余墨水（8 步循环体曾画出 19 条 back-edge，前向链 + 一条回边就说
+ * 尽了）。逐跳按类型判强弱：见证的每一跳（carry 跳按其底层 kind，即回边被改型前的原始
+ * kind）必须不弱于被删 carry 自己的底层 kind；恰好一跳 carry，两跳断言的是 k → k+2，
+ * 严格更弱。与前向阶段同样逐边对存活集判定，互为见证的两条回边不会同时消失——闭合过环
+ * 的循环仍然闭合。
+ */
+export type OrderKind = "data" | "control" | "fifo" | "seq" | "carry";
+/**
+ * Dedup precedence when several facts hold for one ordered pair — the same kind lattice
+ * {@link JUSTIFIED_BY} reads, in the shape a dedup needs. Lives here rather than beside
+ * either consumer because the step-level dedup and the phase quotient's must agree by
+ * construction.
+ */
+export declare const KIND_RANK: Record<OrderKind, number>;
+export interface ReducibleEdge {
+    from: string;
+    to: string;
+    kind: OrderKind;
+    /**
+     * `carry` 边的底层 kind：回边在改型成 carry 之前原本的前向 kind。carry 最小化按它
+     * 判断见证需要多强；缺席时按 hard（data）处理——宁多留一条回边，不误删数据事实。
+     */
+    carryOf?: Exclude<OrderKind, "carry">;
+}
+/**
+ * Drop edges a strong-enough path of surviving edges already implies — forward edges
+ * first (each decided against the surviving set, in input order), then `carry` edges
+ * against the surviving result (one forward leg, exactly one carry hop, one forward
+ * leg). Deterministic given input order; on a DAG the forward phase is the unique
+ * typed transitive reduction, and on residual cycles (one step issued from several
+ * call sites) both phases stay sound — every drop has a surviving witness — and
+ * irredundant.
+ */
+export declare function reduceOrdering<E extends ReducibleEdge>(edges: readonly E[]): E[];
+//# sourceMappingURL=causality-reduce.d.ts.map

package/vendor/dynamic-workflow/analysis/causality-reduce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"causality-reduce.d.ts","sourceRoot":"","sources":["../../src/analysis/causality-reduce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAM/C,CAAC;AAGF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;CACvC;AAkCD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAwGhF"}

package/vendor/dynamic-workflow/analysis/causality-reduce.js

@@ -0,0 +1,198 @@
+/**
+ * Type-aware transitive reduction over the happens-before relation. With one arrow
+ * style on screen, reduction carries the whole burden of keeping the picture readable —
+ * and it must stay TYPED even though rendering is not. A uniform reduction over the
+ * untyped relation deletes the wrong arrows: in `planner-reviewer`, `scan → judge` is
+ * the genuine data dependency and the incidental ordering path
+ * `scan → plan → review → judge` transitively implies it, so a uniform pass would keep
+ * the incidental chain and drop the meaningful edge.
+ *
+ * Precedence: `data` = `control` > `fifo` > `seq`.
+ *
+ * 修复记录
+ *
+ * 一、前向边的删边决策改为逐边对 SURVIVING 集判定。旧实现对 ORIGINAL 关系一次性批量
+ * 删边，再用单调恢复环节补回「见证路径自身被删掉」的边——恢复一条边会重新给其他被删边
+ * 提供见证，但没有任何一步再删它们，于是在带环输入上收敛到严重过度恢复的边集（真实症状：
+ * jsonl-db 优化循环的图 66 条前向边里 55 条被其余边蕴含）。phase 1 的「一站点一步」规则
+ * 让共享 helper（循环前后各调一次）产出双向前向边，环是常态而非异常，删边算法必须在环上
+ * 保持无冗余。逐边对存活集判定后天然不需要恢复环节：每条被删的边在删除当刻都有存活见证，
+ * 后删的边不会作废先前的删除——后删边自己的见证可以代入先前见证（kind 允许集沿
+ * seq ⊇ fifo ⊇ data=control 单调收缩，代入后强度只增不减）。DAG 上与唯一的类型化传递
+ * 归约逐边一致，只有带残环的图行为改变。
+ *
+ * 二、新增 carry 最小化（旧规则「carry 永不删」作废）。carry 边断言 A@k → B@k+1，而
+ * 「k 轮内前向路径 → 恰好一跳 carry → k+1 轮内前向路径」的组合断言完全相同的事实，故有
+ * 此见证的 carry 是纯冗余墨水（8 步循环体曾画出 19 条 back-edge，前向链 + 一条回边就说
+ * 尽了）。逐跳按类型判强弱：见证的每一跳（carry 跳按其底层 kind，即回边被改型前的原始
+ * kind）必须不弱于被删 carry 自己的底层 kind；恰好一跳 carry，两跳断言的是 k → k+2，
+ * 严格更弱。与前向阶段同样逐边对存活集判定，互为见证的两条回边不会同时消失——闭合过环
+ * 的循环仍然闭合。
+ */
+/**
+ * Dedup precedence when several facts hold for one ordered pair — the same kind lattice
+ * {@link JUSTIFIED_BY} reads, in the shape a dedup needs. Lives here rather than beside
+ * either consumer because the step-level dedup and the phase quotient's must agree by
+ * construction.
+ */
+export const KIND_RANK = {
+    carry: 0,
+    control: 4,
+    data: 3,
+    fifo: 2,
+    seq: 1,
+};
+/** Kinds a justifying path may consist of, per the kind of the edge under test. */
+const JUSTIFIED_BY = {
+    // A hard dependency yields only to a path of hard dependencies. `data` and `control`
+    // are both non-removable — no refactoring can make a consumer precede its producer,
+    // or a guarded step precede its guard — so either one justifies either one. What this
+    // does NOT yield to is `seq`/`fifo`: those are incidental serialization the reader is
+    // meant to be able to delete mentally, and the constraint must survive that deletion.
+    // This is what kills the phantom producer→sink edges the actor projection emitted
+    // through relays, and what keeps `scan → judge` alive against the incidental
+    // `scan → plan → review → judge`.
+    //
+    // Bug: `data` originally yielded to `data` alone, which kept every data fact that a
+    // control edge already implied. In a refine-until-approved loop that is most of the
+    // picture — `initial plan → revision` reads as a second arrow on top of
+    // `initial plan → initial review → (guards) → revision`, saying nothing the chain
+    // did not. Ordering-redundant arrows are pure ink here, because the renderer draws
+    // every kind identically; a data edge earns its place only by asserting an order no
+    // hard path already asserts.
+    control: new Set(["data", "control"]),
+    data: new Set(["data", "control"]),
+    // FIFO yields to a real dependency or to another FIFO hop (a same-actor chain
+    // already implies its own transitive closure), but never to bare serialization.
+    // For example, `assess → refine → wrap up` already implies `assess → wrap up`.
+    fifo: new Set(["data", "control", "fifo"]),
+    // Pure serialization yields to any ordering at all.
+    seq: new Set(["data", "control", "fifo", "seq"]),
+};
+/** carry 边的底层 kind；缺席按 hard 处理（见 {@link ReducibleEdge.carryOf}）。 */
+const underlyingOf = (edge) => edge.carryOf ?? "data";
+/**
+ * Drop edges a strong-enough path of surviving edges already implies — forward edges
+ * first (each decided against the surviving set, in input order), then `carry` edges
+ * against the surviving result (one forward leg, exactly one carry hop, one forward
+ * leg). Deterministic given input order; on a DAG the forward phase is the unique
+ * typed transitive reduction, and on residual cycles (one step issued from several
+ * call sites) both phases stay sound — every drop has a surviving witness — and
+ * irredundant.
+ */
+export function reduceOrdering(edges) {
+    const dropped = new Set();
+    const forward = edges.filter((edge) => edge.kind !== "carry");
+    const carries = edges.filter((edge) => edge.kind === "carry");
+    const outgoing = new Map();
+    for (const edge of forward) {
+        const list = outgoing.get(edge.from);
+        if (list === undefined)
+            outgoing.set(edge.from, [edge]);
+        else
+            list.push(edge);
+    }
+    /**
+     * Is `to` reachable from `from` over surviving `allowed`-kind forward edges without
+     * using any direct `from → to` hop? Any such path has length ≥ 2, which is exactly
+     * the reduction condition. Cycle-safe: the visited set bounds the walk.
+     *
+     * Deliberately certainty-BLIND. A certainty-aware variant (an unconditional ordering
+     * may only yield to an unconditional path) is strictly sounder per-execution, and was
+     * tried: it restores an edge from every ancestor of the returned artifact in 30 corpus
+     * fixtures, because a path through any conditional step stops justifying anything.
+     * That is precisely the phantom producer→sink noise the design exists to remove, and
+     * the reader is not doing per-execution case analysis — they read a chain as a chain.
+     * Certainty stays a model-only property of the surviving edges.
+     */
+    const reaches = (from, to, allowed) => {
+        const seen = new Set([from]);
+        const stack = [];
+        for (const edge of outgoing.get(from) ?? []) {
+            if (edge.to === to || !allowed.has(edge.kind) || dropped.has(edge))
+                continue;
+            if (!seen.has(edge.to)) {
+                seen.add(edge.to);
+                stack.push(edge.to);
+            }
+        }
+        while (stack.length > 0) {
+            const node = stack.pop();
+            for (const edge of outgoing.get(node) ?? []) {
+                if (!allowed.has(edge.kind) || dropped.has(edge))
+                    continue;
+                if (edge.to === to)
+                    return true;
+                if (!seen.has(edge.to)) {
+                    seen.add(edge.to);
+                    stack.push(edge.to);
+                }
+            }
+        }
+        return false;
+    };
+    for (const edge of forward) {
+        const allowed = JUSTIFIED_BY[edge.kind];
+        if (allowed === undefined)
+            continue; // defensive: `carry` is already filtered out
+        if (edge.from === edge.to)
+            continue;
+        if (reaches(edge.from, edge.to, allowed))
+            dropped.add(edge);
+    }
+    const carryOutgoing = new Map();
+    for (const edge of carries) {
+        const list = carryOutgoing.get(edge.from);
+        if (list === undefined)
+            carryOutgoing.set(edge.from, [edge]);
+        else
+            list.push(edge);
+    }
+    /**
+     * Does a surviving composition `forward* → one carry hop → forward*` (every hop of
+     * an `allowed` kind, the carry hop judged by its underlying kind) connect `from` to
+     * `to` without using `candidate` itself? Two-state walk: state 1 is "the carry hop
+     * is spent". Parallel edges cannot occur (facts are deduped per ordered pair before
+     * back-edge typing), so any witness found here has length ≥ 2 by construction.
+     */
+    const carryWitness = (candidate, allowed) => {
+        const seen = new Set([`${candidate.from}0`]);
+        const stack = [[candidate.from, 0]];
+        while (stack.length > 0) {
+            const [node, spent] = stack.pop();
+            const push = (next, state) => {
+                if (state === 1 && next === candidate.to)
+                    return true;
+                const key = `${next}${state}`;
+                if (!seen.has(key)) {
+                    seen.add(key);
+                    stack.push([next, state]);
+                }
+                return false;
+            };
+            for (const edge of outgoing.get(node) ?? []) {
+                if (!allowed.has(edge.kind) || dropped.has(edge))
+                    continue;
+                if (push(edge.to, spent))
+                    return true;
+            }
+            if (spent === 1)
+                continue;
+            for (const edge of carryOutgoing.get(node) ?? []) {
+                if (edge === candidate || dropped.has(edge) || !allowed.has(underlyingOf(edge)))
+                    continue;
+                if (push(edge.to, 1))
+                    return true;
+            }
+        }
+        return false;
+    };
+    for (const edge of carries) {
+        const allowed = JUSTIFIED_BY[underlyingOf(edge)];
+        if (allowed === undefined)
+            continue;
+        if (carryWitness(edge, allowed))
+            dropped.add(edge);
+    }
+    return edges.filter((edge) => !dropped.has(edge));
+}

package/vendor/dynamic-workflow/analysis/classes.d.ts

@@ -0,0 +1,47 @@
+import ts from "typescript";
+import { type AbstractValue } from "./domain.js";
+import type { EvalContext, Evaluator } from "./taint.js";
+/**
+ * Class modeling: one shared abstract instance per class, evaluated flow-insensitively.
+ * Split out of the core evaluator (taint.ts) like calls.ts / literals.ts — same
+ * `Evaluator` instance, free-function shape.
+ * Field/static initializers and static blocks evaluate with `this` bound to the instance;
+ * constructors, methods and accessors are tracked functions whose `this` resolves to it;
+ * `new C(args)` applies the constructor and returns a reference to the shared instance;
+ * `extends` weak-merges the base instance in. All instances of a class are conflated
+ * (weak): a write through any instance, through `this`, or through the class name is
+ * visible through every other.
+ */
+/** Evaluate every class body once per fixpoint pass (driven from Evaluator.iterate). */
+export declare function evalClasses(ev: Evaluator): void;
+/**
+ * The class node an expression names (a class-name identifier, or a `this`/`super` that
+ * resolves to one), or undefined for a non-class expression. `new C()`, `super(...)` and
+ * every class-name read go through this so static and instance access conflate into the
+ * one shared instance.
+ */
+export declare function resolveClassNode(ev: Evaluator, expr: ts.Expression): ts.Node | undefined;
+/** The class node a symbol declares, following alias / field bindings to a class. */
+export declare function classNodeOfSymbol(ev: Evaluator, sym: ts.Symbol, seen?: Set<ts.Symbol>): ts.Node | undefined;
+/**
+ * The constructor to apply for `new C(...)`: C's own constructor (with a body), else the
+ * nearest inherited one up the `extends` chain (an implicit super forwards the arguments).
+ * Overload signatures without a body are skipped. Cycle-guarded.
+ */
+export declare function classConstructor(ev: Evaluator, cls: ts.Node, seen?: Set<ts.Node>): ts.ConstructorDeclaration | undefined;
+/** The shared instance of the class lexically enclosing `node`, or undefined. */
+export declare function enclosingClassInstance(ev: Evaluator, node: ts.Node): AbstractValue | undefined;
+/**
+ * The shared instance of the BASE class of the class lexically enclosing `node` — the value
+ * `super` denotes inside a derived method: `super.m()` dispatches to the base method summary
+ * and `super.x` reads the base field. Only the innermost enclosing class's (resolvable) base
+ * counts. Undefined outside a derived class or when the base is an unresolvable heritage.
+ */
+export declare function enclosingBaseInstance(ev: Evaluator, node: ts.Node): AbstractValue | undefined;
+/** True iff a class has an `extends` clause whose base cannot be resolved to a class node (a
+ * mixin CALL, `class D extends mix(Base)`). The inherited constructor is then unreachable, so
+ * `new D(args)` must over-approximate the argument flow (see applyMixinConstructor). */
+export declare function hasUnresolvedHeritage(ev: Evaluator, cls: ts.Node): boolean;
+/** Apply the base-class constructor for a `super(args)` call inside a derived ctor. */
+export declare function applySuperCall(ev: Evaluator, node: ts.CallExpression, ctx: EvalContext): void;
+//# sourceMappingURL=classes.d.ts.map

package/vendor/dynamic-workflow/analysis/classes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classes.d.ts","sourceRoot":"","sources":["../../src/analysis/classes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAQL,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;;;;;GAUG;AAEH,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAG/C;AAiGD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,IAAI,GAAG,SAAS,CAGxF;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,iBAAuB,GAAG,EAAE,CAAC,IAAI,GAAG,SAAS,CAiBjH;AAcD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,EAAE,CAAC,IAAI,EACZ,IAAI,eAAqB,GACxB,EAAE,CAAC,sBAAsB,GAAG,SAAS,CAiBvC;AAED,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAK9F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,aAAa,GAAG,SAAS,CAa7F;AAED;;wFAEwF;AACxF,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,OAAO,CAQ1E;AAED,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAkB7F"}