candor-ts 0.5.15 → 0.5.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.5)",
   "type": "module",
   "dependencies": {

package/scan.mjs

@@ -442,6 +442,19 @@ function localName(node) {
   }
   return null;
 }
+// True when `node` is lexically inside a FUNCTION body — so its bare local name can collide with a
+// module-level or sibling-scope unit of the same name (see the qual disambiguation below). A namespace/
+// module block and the source file are NOT function scopes (their members are top-level units).
+function isFunctionScoped(node) {
+  for (let p = node.parent; p; p = p.parent) {
+    if (ts.isSourceFile(p) || ts.isModuleBlock(p)) return false;
+    if (ts.isFunctionDeclaration(p) || ts.isFunctionExpression(p) || ts.isArrowFunction(p)
+        || ts.isMethodDeclaration(p) || ts.isConstructorDeclaration(p)
+        || ts.isGetAccessorDeclaration(p) || ts.isSetAccessorDeclaration(p))
+      return true;
+  }
+  return false;
+}
 for (const sf of sources) {
   const mod = moduleOf(sf);
   (function collect(node) {
@@ -491,8 +504,15 @@ for (const sf of sources) {
     const n = localName(node);
     const isCjsExport = _lastCjs; // captured immediately: localName set it for THIS node only
     if (n) {
-      const qual = `${mod}.${n}`;
       const { line, character } = sf.getLineAndCharacterOfPosition(node.getStart());
+      // Disambiguate FUNCTION-SCOPED local function units by position. A `const persist = () => …` (or a
+      // nested `function persist(){}`) inside a fn body shares the bare `mod.name` key with a module-level
+      // OR sibling-scope unit of the same name, so the second `fns.set` CLOBBERS the first and a call that
+      // resolves (correctly, via the checker) to the LOCAL decl reads the OTHER unit's effects off the
+      // shared entry — FABRICATING them onto a pure caller. `nodeName` is keyed by NODE identity, so a
+      // per-node-unique key keeps resolution exact; only TOP-LEVEL units need the stable bare name a
+      // consumer's hash-join targets (a function-scoped local is never an export, so nothing joins to it).
+      const qual = isFunctionScoped(node) ? `${mod}.${n}#${line + 1}:${character + 1}` : `${mod}.${n}`;
       fns.set(qual, { local: n, direct: new Set(), edges: new Set(), hosts: new Set(), tables: new Set(),
                       cmds: new Set(), paths: new Set(), blind: new Set(), incomplete: new Set(), why: new Set(), entry: false, isCjsExport,
                       loc: `${path.relative(rootDir, sf.fileName)}:${line + 1}:${character + 1}` });
@@ -791,9 +811,30 @@ function visitCalls(node) {
           }
         }
         if (!edged && !externalClass) {
-          rec.direct.add("Unknown"); // unresolvable call → Unknown, never silent-pure (SPEC §4)
-          const callee = (node.expression?.getText?.() ?? "?").replace(/\s+/g, "").slice(0, 60);
-          rec.why.add(`call:${callee}`); // an `any`-typed/indeterminate callee — named, so triage starts here
+          // Blind PACKAGE member call: the receiver is a NAMESPACE import from a bare specifier
+          // (`import * as winstonm from "winston"; winstonm.info()`) that didn't resolve — typically the
+          // package isn't installed in this tree. The κ table may still MODEL it, so classify by the import
+          // SPECIFIER (the syntactic path, mirroring how the Rust scanner classifies a crate path without
+          // building). Only fires for κ-modeled packages (winston/pino/pg/…); everything else still → Unknown.
+          let kEff = null;
+          if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)
+              && ts.isIdentifier(node.expression.expression)) {
+            const sym = checker.getSymbolAtLocation(node.expression.expression);
+            for (const d of sym?.declarations ?? []) {
+              if (ts.isNamespaceImport(d)) {
+                const spec = d.parent?.parent?.moduleSpecifier;
+                if (spec && ts.isStringLiteralLike(spec)) kEff = kappa(spec.text, node.expression.name.text);
+                break;
+              }
+            }
+          }
+          if (kEff) {
+            rec.direct.add(kEff); // κ-modeled package reached via an uninstalled namespace import
+          } else {
+            rec.direct.add("Unknown"); // unresolvable call → Unknown, never silent-pure (SPEC §4)
+            const callee = (node.expression?.getText?.() ?? "?").replace(/\s+/g, "").slice(0, 60);
+            rec.why.add(`call:${callee}`); // an `any`-typed/indeterminate callee — named, so triage starts here
+          }
         }
       } else {
         const mod = declModule(decl);