candor-ts 0.5.7 → 0.5.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "candor-ts",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.5)",
   "type": "module",
   "dependencies": {

package/scan-core.mjs

@@ -79,9 +79,17 @@ export const KAPPA_RULES = [
   [/^mongoose$/,
    /^(find|save|create|insertMany|updateOne|updateMany|replaceOne|deleteOne|deleteMany|aggregate|countDocuments|estimatedDocumentCount|distinct|exec|bulkWrite)/,
    "Db"],
-  [/^(sequelize|drizzle-orm)$/,
-   /^(find|create|update|destroy|upsert|count|max|min|sum|query|select|insert|delete|execute|transaction)/,
+  // Sequelize is EXECUTE-ON-CALL: `Model.findAll()/create()/update()/destroy()` issue the query and
+  // return a promise — so its verbs are the I/O boundary.
+  [/^sequelize$/,
+   /^(find|create|update|destroy|upsert|count|max|min|sum|increment|decrement|reload|save|query|transaction)/,
    "Db"],
+  // Drizzle is a BUILDER: `db.select().from().where()` / `db.insert().values()` / `db.update().set()` /
+  // `db.delete().where()` issue NOTHING until a terminal `.execute()`/await/`.all()`/`.get()`/`.run()` (or
+  // the relational `db.query.x.findMany/findFirst`). Listing select/insert/update/delete as Db fabricated
+  // the effect onto a pure builder chain (the typeorm rule's `createQueryBuilder` discipline, violated).
+  // VERB-PRECISE: only the terminal execution verbs; the builder heads under-report (sound) until executed.
+  [/^drizzle-orm$/, /^(execute|transaction|findMany|findFirst|all|get|run)$/, "Db"],
   // Nest's HttpService wraps axios — the request verbs are Net.
   [/^@nestjs\/axios$/, /^(get|post|put|patch|delete|head|request)$/, "Net"],
 ];

package/scan.mjs

@@ -724,6 +724,17 @@ function edgeToTargets(rec, decls) {
   for (const d of decls) { const t = nodeName.get(d); if (t) rec.edges.add(t); }
 }
 
+// Callee names that INVOKE a function/method argument (so a fn-reference passed to one is reachable
+// through it). Array/iterable HOFs, the timer/microtask schedulers, and Promise continuations. A
+// STORE/compare/log sink (`set`/`push`/`add`/`includes`/`indexOf`/`concat`/`log`/`stringify`/…) is
+// deliberately ABSENT — edging there would fabricate the fn's effects on a pure path (the cardinal sin).
+const HOF_INVOKERS = new Set([
+  "map", "forEach", "filter", "reduce", "reduceRight", "find", "findIndex", "findLast", "findLastIndex",
+  "some", "every", "flatMap", "sort", "group", "groupBy", "partition", "mapValues", "flatMapDeep",
+  "setTimeout", "setInterval", "setImmediate", "queueMicrotask", "requestAnimationFrame", "requestIdleCallback",
+  "then", "catch", "finally", "nextTick",
+]);
+
 // ---- pass 2: per call site, the (CLASSIFY)/(EDGE)/(UNKNOWN) resolution of SEMANTICS §4 ------------
 function visitCalls(node) {
   if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
@@ -761,7 +772,15 @@ function visitCalls(node) {
         // the Rust engine's fn-as-value edge. An inline closure is already charged lexically; a non-fn
         // argument resolves to no minted unit (`nodeName` miss) and adds nothing — no fabrication. Gated
         // on a non-local callee so a local callee that merely STORES (never invokes) keeps its precision.
-        if (mod !== "<local>") {
+        // ONLY a callee that actually INVOKES its fn argument makes the reference reachable here. The
+        // earlier version edged for ANY non-local callee — fabricating the fn's effects onto a pure path
+        // (the cardinal sin) for STORE/compare/log sinks that never call it (`map.set(k, fn)`,
+        // `arr.push(fn)`, `arr.includes(fn)`, `console.log(fn)`, `[fn]`). Gate on a known INVOKING HOF by
+        // callee name; a custom non-local HOF that invokes its arg is an honest under-report (sound),
+        // never a fabrication. (A LOCAL callee keeps its precise callback-flow below.)
+        const calleeName = ts.isPropertyAccessExpression(node.expression) ? node.expression.name.text
+          : ts.isIdentifier(node.expression) ? node.expression.text : null;
+        if (mod !== "<local>" && calleeName && HOF_INVOKERS.has(calleeName)) {
           for (const a of node.arguments ?? []) {
             if (!ts.isIdentifier(a) && !ts.isPropertyAccessExpression(a)) continue;
             const d2 = realDecl(checker.getSymbolAtLocation(a));