@sunshaobei/dsh-workflow 0.0.0-stage → 2.1.2

package/vendor/dynamic-workflow/analysis/classes.js

@@ -0,0 +1,264 @@
+import ts from "typescript";
+import { addPlaceholder, cloneValue, emptyValue, liveField, mergeInto, peelPlace, staticIndexKey, } from "./domain.js";
+import { applyConstructor } from "./promise-ops.js";
+/**
+ * Class modeling: one shared abstract instance per class, evaluated flow-insensitively.
+ * Split out of the core evaluator (taint.ts) like calls.ts / literals.ts — same
+ * `Evaluator` instance, free-function shape.
+ * Field/static initializers and static blocks evaluate with `this` bound to the instance;
+ * constructors, methods and accessors are tracked functions whose `this` resolves to it;
+ * `new C(args)` applies the constructor and returns a reference to the shared instance;
+ * `extends` weak-merges the base instance in. All instances of a class are conflated
+ * (weak): a write through any instance, through `this`, or through the class name is
+ * visible through every other.
+ */
+/** Evaluate every class body once per fixpoint pass (driven from Evaluator.iterate). */
+export function evalClasses(ev) {
+    const ctx = { onReturn: () => { }, regionStack: ["top"] };
+    for (const cls of ev.s.classes)
+        evalClassBody(ev, cls, ctx);
+}
+function evalClassBody(ev, cls, ctx) {
+    const instance = ev.s.instanceOf(cls);
+    // `extends`: cheap sound approximation — weak-merge the base class's shared instance
+    // into the derived one each pass, so inherited fields carry taint and inherited
+    // methods/accessors dispatch through the derived instance. Deliberately conflates the
+    // two class instances (weak); per-instance/per-class precision is out of scope.
+    for (const clause of cls.heritageClauses ?? []) {
+        if (clause.token !== ts.SyntaxKind.ExtendsKeyword)
+            continue;
+        for (const type of clause.types) {
+            const base = resolveClassNode(ev, type.expression);
+            if (base !== undefined && mergeInto(instance, ev.s.instanceOf(base)))
+                ev.s.changed = true;
+        }
+    }
+    for (const member of cls.members) {
+        if (ts.isPropertyDeclaration(member)) {
+            const key = staticMemberKey(ev, member.name);
+            if (key === undefined || member.initializer === undefined)
+                continue;
+            // Field/static initializer: `this` in the initializer resolves to the instance
+            // (ThisExpression parent-walks to this class). Weak-merge its value into the field.
+            mergeInstanceField(ev, instance, key, ev.evalExpr(member.initializer, ctx));
+        }
+        else if (ts.isClassStaticBlockDeclaration(member)) {
+            for (const stmt of member.body.statements)
+                ev.visit(stmt, ctx);
+        }
+        else if (ts.isMethodDeclaration(member)) {
+            // A method is a function-valued field, callable through it (`inst.run(x)`). A computed
+            // name that is a static string/number literal (`["run"]`) registers under that name;
+            // a genuinely-dynamic name registers in the instance's top-level fns (see registerMember).
+            registerMember(ev, instance, staticMemberKey(ev, member.name), member);
+        }
+        else if (ts.isGetAccessorDeclaration(member)) {
+            // Getter: the field's read value IS the getter's return summary (re-read each pass;
+            // the fixpoint converges), mirroring object-literal getters in literals.ts.
+            const id = ev.s.fnId.get(member);
+            if (id === undefined)
+                continue;
+            const key = staticMemberKey(ev, member.name);
+            const summary = cloneValue(ev.s.summaryOf(id));
+            // A genuinely-dynamic getter name can only be read through a dynamic-key access, which
+            // collapses the instance — smear its value (inexact) into the container so a `w[k]` read
+            // still surfaces it (a sound over-approximation, never a drop).
+            if (key === undefined)
+                mergeInstanceField(ev, instance, undefined, summary);
+            else
+                mergeInstanceField(ev, instance, key, summary);
+        }
+        else if (ts.isConstructorDeclaration(member)) {
+            applyParameterProperties(ev, instance, member);
+        }
+        // SetAccessorDeclaration: writes are handled globally by settersByProp (collected in
+        // TaintState). ConstructorDeclaration body: applied at `new C(...)` / `super(...)`.
+    }
+}
+/**
+ * The static field key a class member is registered / dispatched under: the member name for a
+ * plain name, or the static string/number literal of a computed name (`["run"]`). Returns
+ * undefined for a genuinely-dynamic computed name (`[expr]`) — such a member cannot be
+ * dispatched by name, so it degrades to the sound catch-all (top-level fns / container smear).
+ */
+function staticMemberKey(ev, name) {
+    if (ts.isComputedPropertyName(name))
+        return staticIndexKey(name.expression);
+    return name.getText(ev.s.scriptFile);
+}
+/**
+ * Synthesize the implicit `this.x = x` a TS parameter property performs: a constructor
+ * parameter carrying an accessibility / `readonly` modifier declares AND initializes an
+ * instance field from the argument. Model it by merging the ctor's param placeholder into
+ * the named instance field (resolved to the `new`'s actual at emission). Parameter
+ * properties are Parameters, not PropertyDeclarations; their implicit field writes are not
+ * explicit statements in the constructor body and must be modeled here.
+ */
+function applyParameterProperties(ev, instance, ctor) {
+    const id = ev.s.fnId.get(ctor);
+    if (id === undefined)
+        return;
+    ctor.parameters.forEach((param, index) => {
+        if (!ts.isParameterPropertyDeclaration(param, ctor) || !ts.isIdentifier(param.name))
+            return;
+        const val = emptyValue();
+        addPlaceholder(val, { fnId: id, param: index });
+        mergeInstanceField(ev, instance, param.name.text, val);
+    });
+}
+function mergeInstanceField(ev, instance, key, value) {
+    // A dynamic (undefined) key smears into the container itself (collapse surfaces it).
+    const field = key === undefined ? instance : liveField(instance, key);
+    if (field !== value && mergeInto(field, value))
+        ev.s.changed = true;
+}
+function registerMember(ev, instance, key, fn) {
+    // A static-named method lives in a named field (`inst.run` dispatches via readField); a
+    // dynamically-named one lives in the instance's TOP-LEVEL fns, reachable only through the
+    // collapse a dynamic-key call (`inst[k]()`) performs — never picked up by a named field read,
+    // so it adds no false static-name dispatch while keeping the callee sound (never dropped).
+    const target = key === undefined ? instance : liveField(instance, key);
+    if (!target.fns.has(fn)) {
+        target.fns.add(fn);
+        ev.s.changed = true;
+    }
+}
+/**
+ * The class node an expression names (a class-name identifier, or a `this`/`super` that
+ * resolves to one), or undefined for a non-class expression. `new C()`, `super(...)` and
+ * every class-name read go through this so static and instance access conflate into the
+ * one shared instance.
+ */
+export function resolveClassNode(ev, expr) {
+    const sym = ev.checker.getSymbolAtLocation(expr);
+    return sym === undefined ? undefined : classNodeOfSymbol(ev, sym);
+}
+/** The class node a symbol declares, following alias / field bindings to a class. */
+export function classNodeOfSymbol(ev, sym, seen = new Set()) {
+    if (seen.has(sym))
+        return undefined;
+    seen.add(sym);
+    for (const decl of sym.declarations ?? []) {
+        if ((ts.isClassDeclaration(decl) || ts.isClassExpression(decl)) && ev.s.classInstances.has(decl))
+            return decl;
+        // A class bound through a variable alias (`const Alias = Cfg`) or stored in an
+        // object-literal field (`{ C: class {} }`): resolve the initializer to the class node so
+        // `new Alias(...)` / `new box.C()` applies the constructor and returns that class's shared
+        // instance. Otherwise only the class's own symbol and a directly class-expression-initialized
+        // variable would be recognized, and an alias / field binding would escape to emptyValue.
+        const init = ts.isVariableDeclaration(decl) || ts.isPropertyAssignment(decl) ? decl.initializer : undefined;
+        if (init !== undefined) {
+            const via = classNodeFromExpr(ev, init, seen);
+            if (via !== undefined)
+                return via;
+        }
+    }
+    return undefined;
+}
+/** The class node an initializer expression denotes: a class expression, or an identifier /
+ * property access aliasing another class binding (cycle-guarded through `seen`). */
+function classNodeFromExpr(ev, expr, seen) {
+    const e = peelPlace(expr);
+    if (ts.isClassExpression(e) && ev.s.classInstances.has(e))
+        return e;
+    if (ts.isIdentifier(e) || ts.isPropertyAccessExpression(e)) {
+        const sym = ev.checker.getSymbolAtLocation(e);
+        if (sym !== undefined)
+            return classNodeOfSymbol(ev, sym, seen);
+    }
+    return undefined;
+}
+/**
+ * The constructor to apply for `new C(...)`: C's own constructor (with a body), else the
+ * nearest inherited one up the `extends` chain (an implicit super forwards the arguments).
+ * Overload signatures without a body are skipped. Cycle-guarded.
+ */
+export function classConstructor(ev, cls, seen = new Set()) {
+    if (seen.has(cls))
+        return undefined;
+    seen.add(cls);
+    for (const member of cls.members) {
+        if (ts.isConstructorDeclaration(member) && member.body !== undefined)
+            return member;
+    }
+    for (const clause of cls.heritageClauses ?? []) {
+        if (clause.token !== ts.SyntaxKind.ExtendsKeyword)
+            continue;
+        for (const type of clause.types) {
+            const base = resolveClassNode(ev, type.expression);
+            if (base !== undefined) {
+                const inherited = classConstructor(ev, base, seen);
+                if (inherited !== undefined)
+                    return inherited;
+            }
+        }
+    }
+    return undefined;
+}
+/** The shared instance of the class lexically enclosing `node`, or undefined. */
+export function enclosingClassInstance(ev, node) {
+    for (let cur = node.parent; cur !== undefined; cur = cur.parent) {
+        if (ts.isClassLike(cur))
+            return ev.s.instanceOf(cur);
+    }
+    return undefined;
+}
+/**
+ * The shared instance of the BASE class of the class lexically enclosing `node` — the value
+ * `super` denotes inside a derived method: `super.m()` dispatches to the base method summary
+ * and `super.x` reads the base field. Only the innermost enclosing class's (resolvable) base
+ * counts. Undefined outside a derived class or when the base is an unresolvable heritage.
+ */
+export function enclosingBaseInstance(ev, node) {
+    for (let cur = node.parent; cur !== undefined; cur = cur.parent) {
+        if (!ts.isClassLike(cur))
+            continue;
+        for (const clause of cur.heritageClauses ?? []) {
+            if (clause.token !== ts.SyntaxKind.ExtendsKeyword)
+                continue;
+            for (const type of clause.types) {
+                const base = resolveClassNode(ev, type.expression);
+                if (base !== undefined)
+                    return ev.s.instanceOf(base);
+            }
+        }
+        return undefined; // innermost enclosing class only
+    }
+    return undefined;
+}
+/** True iff a class has an `extends` clause whose base cannot be resolved to a class node (a
+ * mixin CALL, `class D extends mix(Base)`). The inherited constructor is then unreachable, so
+ * `new D(args)` must over-approximate the argument flow (see applyMixinConstructor). */
+export function hasUnresolvedHeritage(ev, cls) {
+    for (const clause of cls.heritageClauses ?? []) {
+        if (clause.token !== ts.SyntaxKind.ExtendsKeyword)
+            continue;
+        for (const type of clause.types) {
+            if (resolveClassNode(ev, type.expression) === undefined)
+                return true;
+        }
+    }
+    return false;
+}
+/** Apply the base-class constructor for a `super(args)` call inside a derived ctor. */
+export function applySuperCall(ev, node, ctx) {
+    for (let cur = node.parent; cur !== undefined; cur = cur.parent) {
+        if (!ts.isClassLike(cur))
+            continue;
+        for (const clause of cur.heritageClauses ?? []) {
+            if (clause.token !== ts.SyntaxKind.ExtendsKeyword)
+                continue;
+            for (const type of clause.types) {
+                const base = resolveClassNode(ev, type.expression);
+                const ctor = base === undefined ? undefined : classConstructor(ev, base);
+                const id = ctor === undefined ? undefined : ev.s.fnId.get(ctor);
+                if (id !== undefined) {
+                    const argVals = node.arguments.map((arg) => ev.evalExpr(arg, ctx));
+                    const argPlaces = node.arguments.map((arg) => ev.resolvePlace(arg));
+                    applyConstructor(ev, id, ctx, argVals, argPlaces, node);
+                }
+            }
+        }
+        return; // only the innermost enclosing class's base is the super target
+    }
+}

package/vendor/dynamic-workflow/analysis/constants.d.ts

@@ -0,0 +1,35 @@
+/**
+ * 追踪词汇：区域种类、跳转种类与兜底阶段 id。它们原本住在 causality-order.ts，但那个文件
+ * 在运行时 import `typescript`（走 AST 的 walk 本身），而只读 core 的纯投影（causality-graph /
+ * flow-phase / phase-graph）只需要这几个值。把它们放进一个零依赖的小文件，投影模块就不再
+ * 把 `typescript` 拖进运行时闭包——这是作品集浏览器包（
+ * `@zcode/dynamic-workflow/projections`）能成立的前提。causality-order.ts 原样再导出，
+ * 所有既有引用位置与行为不变。
+ */
+/**
+ * Region kinds. The analyzer emits `seq` (the root), `loop`,
+ * `fanout` and `branch`. `parallel` stays derived — incomparability in the ordering
+ * already defines concurrency, and storing it would be a second source of truth.
+ * `shared` is reserved for the future specialization cap.
+ */
+export type RegionKind = "seq" | "parallel" | "loop" | "fanout" | "branch" | "shared";
+/**
+ * STRUCTURAL region kinds: the tree nodes
+ * the walk always saw but did not record before the control-flow projection needed them.
+ * The causality projection looks THROUGH every one of them (its "transparency rule"), which
+ * is what keeps the three older views byte-identical while the trace grows.
+ *
+ *  - `choice`: one if / ternary / switch / short-circuit; its arms are `branch` children
+ *  - `call`: one inlined helper body (a `return` target)
+ *  - `try` / `attempt` / `catch` / `finally`: one try statement and its three parts
+ */
+export type StructuralRegionKind = "choice" | "call" | "try" | "attempt" | "catch" | "finally";
+/** Every kind the trace can hold. The public causality `RegionKind` stays the narrow union. */
+export type TraceRegionKind = RegionKind | StructuralRegionKind;
+export declare function isStructuralRegionKind(kind: TraceRegionKind): kind is StructuralRegionKind;
+/** The reserved fallback phase: the root block's initial current phase, and where every
+ * step issued before the script's first marker lands. It has no `name` — the UI shows a
+ * localized word, exactly as it does for the `workspace` / `unknown` lanes. */
+export declare const UNPHASED_ID = "unphased";
+export type JumpKind = "continue" | "break" | "return" | "throw" | "recur";
+//# sourceMappingURL=constants.d.ts.map

package/vendor/dynamic-workflow/analysis/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/analysis/constants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEtF;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/F,+FAA+F;AAC/F,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,oBAAoB,CAAC;AAWhE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,IAAI,oBAAoB,CAE1F;AAED;;+EAE+E;AAC/E,eAAO,MAAM,WAAW,aAAa,CAAC;AAEtC,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC"}

package/vendor/dynamic-workflow/analysis/constants.js

@@ -0,0 +1,23 @@
+/**
+ * 追踪词汇：区域种类、跳转种类与兜底阶段 id。它们原本住在 causality-order.ts，但那个文件
+ * 在运行时 import `typescript`（走 AST 的 walk 本身），而只读 core 的纯投影（causality-graph /
+ * flow-phase / phase-graph）只需要这几个值。把它们放进一个零依赖的小文件，投影模块就不再
+ * 把 `typescript` 拖进运行时闭包——这是作品集浏览器包（
+ * `@zcode/dynamic-workflow/projections`）能成立的前提。causality-order.ts 原样再导出，
+ * 所有既有引用位置与行为不变。
+ */
+const STRUCTURAL_REGION_KINDS = new Set([
+    "choice",
+    "call",
+    "try",
+    "attempt",
+    "catch",
+    "finally",
+]);
+export function isStructuralRegionKind(kind) {
+    return STRUCTURAL_REGION_KINDS.has(kind);
+}
+/** The reserved fallback phase: the root block's initial current phase, and where every
+ * step issued before the script's first marker lands. It has no `name` — the UI shows a
+ * localized word, exactly as it does for the `workspace` / `unknown` lanes. */
+export const UNPHASED_ID = "unphased";

package/vendor/dynamic-workflow/analysis/control-flow.d.ts

@@ -0,0 +1,26 @@
+import ts from "typescript";
+import type { EvalContext, Evaluator } from "./taint.js";
+/**
+ * Loop / iteration statement handlers: `for`, `for-of`, and `for-in`. Split out of the core
+ * evaluator (taint.ts) like the call/relay rules in calls.ts and the assignment rules in
+ * assign.ts — same `Evaluator` instance, free-function shape. The `visit` dispatcher in
+ * taint.ts routes the three loop statement kinds here. Plain `while`/`do` carry no binding, so
+ * they stay inline in `visit`. Gen-only weak updates over-approximate every iteration order at once,
+ * so a loop body is evaluated exactly like straight-line code.
+ */
+/** `for (init; cond; incr) body`: evaluate every clause for effect, then the body. */
+export declare function visitForStatement(ev: Evaluator, node: ts.ForStatement, ctx: EvalContext): void;
+/**
+ * `for (x of xs) body`: the element value is the collapsed iterable (+ a fan-out label when the
+ * loop is a promoted iteration candidate), bound through the same machinery as any other loop
+ * variable. Derived, not a place, so binding keeps value semantics.
+ */
+export declare function handleForOf(ev: Evaluator, node: ts.ForOfStatement, ctx: EvalContext): void;
+/**
+ * `for (k in obj) body`: for-in enumerates the object's KEYS; each key string is derived from
+ * that object ("strings launder nothing"), so the loop variable carries its collapsed taint.
+ * For-in used to share the while/do arm (which binds nothing), so key-derived flow
+ * (`keys += k`) was dropped for both the declaration and assignment initializer forms.
+ */
+export declare function handleForIn(ev: Evaluator, node: ts.ForInStatement, ctx: EvalContext): void;
+//# sourceMappingURL=control-flow.d.ts.map

package/vendor/dynamic-workflow/analysis/control-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-flow.d.ts","sourceRoot":"","sources":["../../src/analysis/control-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;;GAOG;AAEH,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAW9F;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAqD1F;AAgCD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CAG1F"}

package/vendor/dynamic-workflow/analysis/control-flow.js

@@ -0,0 +1,132 @@
+import ts from "typescript";
+import { addOcc, cloneValue, collapse, mergeInto, provisionalFanoutId } from "./domain.js";
+import { bindForInitializer } from "./assign.js";
+/**
+ * Loop / iteration statement handlers: `for`, `for-of`, and `for-in`. Split out of the core
+ * evaluator (taint.ts) like the call/relay rules in calls.ts and the assignment rules in
+ * assign.ts — same `Evaluator` instance, free-function shape. The `visit` dispatcher in
+ * taint.ts routes the three loop statement kinds here. Plain `while`/`do` carry no binding, so
+ * they stay inline in `visit`. Gen-only weak updates over-approximate every iteration order at once,
+ * so a loop body is evaluated exactly like straight-line code.
+ */
+/** `for (init; cond; incr) body`: evaluate every clause for effect, then the body. */
+export function visitForStatement(ev, node, ctx) {
+    if (node.initializer !== undefined) {
+        if (ts.isVariableDeclarationList(node.initializer)) {
+            for (const decl of node.initializer.declarations)
+                ev.handleDeclaration(decl, ctx);
+        }
+        else {
+            ev.evalExpr(node.initializer, ctx);
+        }
+    }
+    if (node.condition !== undefined)
+        ev.recordGuard(node.condition, ev.evalExpr(node.condition, ctx));
+    if (node.incrementor !== undefined)
+        ev.evalExpr(node.incrementor, ctx);
+    ev.visit(node.statement, ctx);
+}
+/**
+ * `for (x of xs) body`: the element value is the collapsed iterable (+ a fan-out label when the
+ * loop is a promoted iteration candidate), bound through the same machinery as any other loop
+ * variable. Derived, not a place, so binding keeps value semantics.
+ */
+export function handleForOf(ev, node, ctx) {
+    const cand = ev.s.candByForOf.get(node);
+    const iterated = collapse(ev.evalExpr(node.expression, ctx));
+    // `for await (… of …)` awaits every element, so the ITERATED expression is the settle
+    // oracle for the loop's per-iteration barrier — and the ordering walk puts that barrier
+    // at exactly this expression's position, which is the key it looks the oracle up under.
+    if (node.awaitModifier !== undefined) {
+        ev.s.mergeSink(ev.s.awaitVal, node.expression.getStart(ev.s.scriptFile), iterated);
+    }
+    const element = cloneValue(iterated);
+    let regionStack = ctx.regionStack;
+    if (cand !== undefined) {
+        const fanoutId = provisionalFanoutId(cand.order);
+        if (ev.s.promotedOrders.has(cand.order)) {
+            ev.s.mergeSink(ev.s.fanoutInVal, fanoutId, iterated);
+            addOcc(element, { exact: true, site: fanoutId });
+        }
+        regionStack = [...ctx.regionStack, `cand@${cand.order}`];
+    }
+    // The element value is derived (collapsed iterable + fan-out label), not a place, so for-of
+    // binding keeps value semantics. Only the declaration form used to be bound; an
+    // assignment-form initializer (`for (cur of xs)`, or a destructuring target) bound nothing,
+    // dropping the element's taint into every read of the loop variable.
+    bindForInitializer(ev, node.initializer, element, ctx);
+    ev.visit(node.statement, { onReturn: ctx.onReturn, regionStack });
+    // Element-mutation write-back: the loop variable may-aliases the iterable's elements, so a
+    // field written through it (`for (const y of b) y.note = t`) reaches the collection. Weak-
+    // merge the element's FIELD effects (collapsed) into the collection place — a later
+    // `b[k].note` read smears them out. Mirrors the array-method fan-out write-back. Without
+    // this write-back, for-of element writes would be invisible to the collection.
+    //
+    // The write-back used to scan only THIS pass's fresh `element` clone, but
+    // body writes land on the loop variable's persistent env slot — bindSymbol ADOPTS the pass-1
+    // object and later passes merely merge the fresh clone INTO it. A clone of the collapsed
+    // iterable has no fields, so element-field taint first arriving on pass >= 2 (exactly the
+    // loop-carried flows) was never written back, and a DESTRUCTURED loop variable
+    // (`for (const { doc } of items) doc.note = t`), whose sub-bindings hold their own slots,
+    // never populated `element.fields` at all. Write back from the slots the body actually
+    // wrote through: every binding of the initializer, plus `element` itself (which still
+    // carries pass-1 writes for the identifier form).
+    const collectionPlace = ev.resolvePlace(node.expression);
+    if (collectionPlace !== undefined) {
+        const writeBackFields = (holder) => {
+            for (const field of holder.fields.values()) {
+                if (mergeInto(collectionPlace, collapse(field)))
+                    ev.s.changed = true;
+            }
+        };
+        writeBackFields(element);
+        for (const sym of boundSymbolsOfForInitializer(ev, node.initializer)) {
+            const slot = ev.s.env.get(sym);
+            if (slot !== undefined && slot !== collectionPlace)
+                writeBackFields(slot);
+        }
+    }
+}
+/**
+ * The symbols a for-of initializer binds — the slots its body writes element mutations
+ * through. Declaration form walks the (possibly destructuring) binding name; assignment
+ * form covers the plain-identifier target (destructuring assignment targets write through
+ * the heap paths of assign.ts, which need no loop write-back).
+ */
+function boundSymbolsOfForInitializer(ev, initializer) {
+    const out = [];
+    const addName = (name) => {
+        if (ts.isIdentifier(name)) {
+            const sym = ev.checker.getSymbolAtLocation(name);
+            if (sym !== undefined)
+                out.push(sym);
+            return;
+        }
+        for (const el of name.elements) {
+            if (ts.isBindingElement(el))
+                addName(el.name);
+        }
+    };
+    if (ts.isVariableDeclarationList(initializer)) {
+        const decl = initializer.declarations[0];
+        if (decl !== undefined)
+            addName(decl.name);
+        return out;
+    }
+    if (ts.isIdentifier(initializer)) {
+        const sym = ev.checker.getSymbolAtLocation(initializer);
+        if (sym !== undefined)
+            out.push(sym);
+    }
+    return out;
+}
+/**
+ * `for (k in obj) body`: for-in enumerates the object's KEYS; each key string is derived from
+ * that object ("strings launder nothing"), so the loop variable carries its collapsed taint.
+ * For-in used to share the while/do arm (which binds nothing), so key-derived flow
+ * (`keys += k`) was dropped for both the declaration and assignment initializer forms.
+ */
+export function handleForIn(ev, node, ctx) {
+    bindForInitializer(ev, node.initializer, collapse(ev.evalExpr(node.expression, ctx)), ctx);
+    ev.visit(node.statement, ctx);
+}

package/vendor/dynamic-workflow/analysis/core-json.d.ts

@@ -0,0 +1,45 @@
+import type { OrderTrace } from "./causality-order.js";
+import type { AnalysisCore, CoreSites } from "./core.js";
+import type { TaintOcc } from "./domain.js";
+/**
+ * `AnalysisCore` 的 JSON 编解码。
+ *
+ * core 本身已是无位置依赖的纯数据，唯一挡住 `JSON.stringify` 的是 `facts.*` 与 `types.*`
+ * 里的 `Map`——它们会被序列化成 `{}`。这里把每个 Map 换成**有序** `[key, value][]`：
+ * 数组保住插入序，解码用 `new Map(entries)` 原样还回去，于是 `serializeCore(decode(encode(c)))`
+ * 与 `serializeCore(c)` 逐字节相同，投影在冻结工件上算出的图与导出当刻一致。
+ *
+ * `sites` 与 `trace` 只含普通对象、数组与可选字段，原样穿过：`JSON.stringify` 丢掉值为
+ * `undefined` 的属性，解码器**不**把它们补回来——投影全部按「字段缺席」而非「字段为
+ * undefined」判定，两种形状等价。唯一的例外是 `joinPortTypes` 的值：`(string | undefined)[]`
+ * 里的 `undefined` 落进数组会被 JSON 写成 `null`，所以编码时显式写 `null`，解码时换回
+ * `undefined`，让「该端口类型不可知」的洞在往返后仍是 `undefined` 而不是 `null`。
+ */
+/** 有序的 Map 条目：数组序即 Map 的插入序。 */
+export type MapEntries<V> = [string, V][];
+export interface AnalysisCoreJson {
+    /** 格式版本；解码器只认识它认得的版本，其余抛错而不是猜。 */
+    version: 1;
+    sites: CoreSites;
+    facts: {
+        askData: MapEntries<TaintOcc[]>;
+        askActor: MapEntries<TaintOcc[]>;
+        worldReadData: MapEntries<TaintOcc[]>;
+        joinIn: MapEntries<TaintOcc[]>;
+        fanoutIn: MapEntries<TaintOcc[]>;
+        /** 留白提示的 sink（2026-09-28 加入）；早于它冻结的样例包没有这个键，解码按空表补。 */
+        holeData?: MapEntries<TaintOcc[]>;
+        returnData: TaintOcc[];
+    };
+    trace: OrderTrace;
+    types: {
+        siteType: MapEntries<string>;
+        /** 端口类型的洞（`undefined`）在这里是 `null`——JSON 数组里没有 `undefined`。 */
+        joinPortTypes: MapEntries<(string | null)[]>;
+    };
+}
+/** 把 core 变成可直接 `JSON.stringify` 的纯对象；`sites` 与 `trace` 共享原引用。 */
+export declare function encodeAnalysisCore(core: AnalysisCore): AnalysisCoreJson;
+/** 从 JSON 形态重建 core（Map 保持原插入序）。未知版本抛普通 `Error`。 */
+export declare function decodeAnalysisCore(json: AnalysisCoreJson): AnalysisCore;
+//# sourceMappingURL=core-json.d.ts.map

package/vendor/dynamic-workflow/analysis/core-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-json.d.ts","sourceRoot":"","sources":["../../src/analysis/core-json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;;;;;;;;GAaG;AAEH,gCAAgC;AAChC,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE;QACL,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjC,aAAa,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjC,uDAAuD;QACvD,QAAQ,CAAC,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClC,UAAU,EAAE,QAAQ,EAAE,CAAC;KACxB,CAAC;IACF,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE;QACL,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7B,8DAA8D;QAC9D,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;KAC9C,CAAC;CACH;AAID,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,gBAAgB,CAsBvE;AAED,oDAAoD;AACpD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,CAwBvE"}

package/vendor/dynamic-workflow/analysis/core-json.js

@@ -0,0 +1,49 @@
+const VERSION = 1;
+/** 把 core 变成可直接 `JSON.stringify` 的纯对象；`sites` 与 `trace` 共享原引用。 */
+export function encodeAnalysisCore(core) {
+    return {
+        facts: {
+            askActor: [...core.facts.askActor],
+            askData: [...core.facts.askData],
+            fanoutIn: [...core.facts.fanoutIn],
+            holeData: [...core.facts.holeData],
+            joinIn: [...core.facts.joinIn],
+            returnData: core.facts.returnData,
+            worldReadData: [...core.facts.worldReadData],
+        },
+        sites: core.sites,
+        trace: core.trace,
+        types: {
+            joinPortTypes: [...core.types.joinPortTypes].map(([id, ports]) => [
+                id,
+                ports.map((port) => (port === undefined ? null : port)),
+            ]),
+            siteType: [...core.types.siteType],
+        },
+        version: VERSION,
+    };
+}
+/** 从 JSON 形态重建 core（Map 保持原插入序）。未知版本抛普通 `Error`。 */
+export function decodeAnalysisCore(json) {
+    if (json.version !== VERSION) {
+        throw new Error(`unsupported AnalysisCoreJson version ${String(json.version)} (expected ${VERSION})`);
+    }
+    return {
+        facts: {
+            askActor: new Map(json.facts.askActor),
+            askData: new Map(json.facts.askData),
+            fanoutIn: new Map(json.facts.fanoutIn),
+            holeData: new Map(json.facts.holeData ?? []),
+            joinIn: new Map(json.facts.joinIn),
+            returnData: json.facts.returnData,
+            worldReadData: new Map(json.facts.worldReadData),
+        },
+        // 留白站点表同样是后加的键：老样例包按「没有留白」解码。
+        sites: { ...json.sites, holes: json.sites.holes ?? [] },
+        trace: json.trace,
+        types: {
+            joinPortTypes: new Map(json.types.joinPortTypes.map(([id, ports]) => [id, ports.map((port) => (port === null ? undefined : port))])),
+            siteType: new Map(json.types.siteType),
+        },
+    };
+}