dsh-plugin-compat-check 0.1.5 → 0.1.7

package/kernel/lib/state-lock.mjs

@@ -0,0 +1,206 @@
+/** Private local state locks. Recovery never infers death from lock age or PID reuse. */
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { createHash, randomUUID } from "node:crypto";
+const MAX_BYTES = 8192;
+const fail = (message, code = "STATE_LOCK_UNSAFE") =>
+  Object.assign(new Error(message), { code });
+const same = (a, b) => a.dev === b.dev && a.ino === b.ino;
+const guardPath = (lock) => lock + ".recovery-lock";
+export function stateDirectory(dir, { create = false } = {}) {
+  if (create) fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const st = fs.lstatSync(dir);
+  if (
+    !st.isDirectory() ||
+    st.isSymbolicLink() ||
+    (process.getuid && st.uid !== process.getuid())
+  )
+    throw fail("Unsafe state directory");
+  if (st.mode & 0o077)
+    throw fail(
+      "State directory must be private (0700); existing permissions were not changed; recovery guidance: docs/guide.md#本地状态锁恢复",
+    );
+}
+// A process-local start/instance marker, not an OS birth-time attestation.
+// Any existing PID (including a reused PID) blocks recovery, so writers never
+// need external commands or a platform process-list query to create metadata.
+const selfBirth = `node:${new Date(Date.now() - process.uptime() * 1000).toISOString()}:${randomUUID()}`;
+function record(lock) {
+  return {
+    schemaVersion: 1,
+    kind: "dsh-plugin-compat-check/state-lock",
+    lock: path.resolve(lock),
+    pid: process.pid,
+    uid: process.getuid?.() ?? null,
+    host: os.hostname(),
+    birth: selfBirth,
+    createdAt: new Date().toISOString(),
+    nonce: randomUUID(),
+  };
+}
+function readLock(lock) {
+  let fd;
+  try {
+    fd = fs.openSync(
+      lock,
+      fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK,
+    );
+    const st = fs.fstatSync(fd);
+    if (
+      !st.isFile() ||
+      st.nlink !== 1 ||
+      st.size > MAX_BYTES ||
+      (process.getuid && st.uid !== process.getuid()) ||
+      st.mode & 0o022
+    )
+      throw fail("Lock is nonregular, oversized, linked, or unsafe");
+    const buf = Buffer.alloc(MAX_BYTES + 1);
+    const n = fs.readSync(fd, buf, 0, buf.length, 0);
+    if (n > MAX_BYTES) throw fail("Lock metadata exceeds limit");
+    const bytes = buf.subarray(0, n);
+    if (!same(st, fs.lstatSync(lock))) throw fail("Lock changed while reading");
+    const token = createHash("sha256")
+      .update(`${st.dev}:${st.ino}:`)
+      .update(bytes)
+      .digest("hex");
+    return { st, bytes, token };
+  } catch (error) {
+    if (error.code === "STATE_LOCK_UNSAFE") throw error;
+    throw fail(`Lock cannot be read safely: ${error.code || error.message}`);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+function unlinkSame(lock, original) {
+  const current = readLock(lock);
+  if (!same(current.st, original.st) || !current.bytes.equals(original.bytes))
+    throw fail("Lock changed; refusing to remove replacement");
+  fs.unlinkSync(lock);
+}
+function createLock(lock) {
+  const fd = fs.openSync(
+    lock,
+    fs.constants.O_CREAT |
+      fs.constants.O_EXCL |
+      fs.constants.O_WRONLY |
+      fs.constants.O_NOFOLLOW,
+    0o600,
+  );
+  const st = fs.fstatSync(fd);
+  let owned;
+  try {
+    const bytes = Buffer.from(JSON.stringify(record(lock)) + "\n");
+    fs.writeFileSync(fd, bytes);
+    fs.fsyncSync(fd);
+    owned = { st, bytes };
+  } catch (error) {
+    // An incomplete record is deliberately left for explicit operator diagnosis.
+    fs.closeSync(fd);
+    throw error;
+  }
+  let released = false;
+  return {
+    release() {
+      if (released) return;
+      released = true;
+      try {
+        unlinkSame(lock, owned);
+      } catch {
+      } finally {
+        fs.closeSync(fd);
+      }
+    },
+  };
+}
+function noRecovery(lock) {
+  try {
+    fs.lstatSync(guardPath(lock));
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  throw fail(
+    "State lock recovery is in progress or interrupted; recovery guard requires operator diagnosis",
+    "EEXIST",
+  );
+}
+export function acquireStateLock(lock) {
+  stateDirectory(path.dirname(lock), { create: true });
+  noRecovery(lock);
+  const held = createLock(lock);
+  try {
+    noRecovery(lock);
+    return held;
+  } catch (error) {
+    held.release();
+    throw error;
+  }
+}
+function orphan(lock) {
+  const observed = readLock(lock);
+  let value;
+  try {
+    value = JSON.parse(observed.bytes.toString("utf8"));
+  } catch {
+    throw fail("Legacy empty or malformed lock; automatic recovery refused");
+  }
+  if (
+    value?.schemaVersion !== 1 ||
+    value.kind !== "dsh-plugin-compat-check/state-lock" ||
+    value.lock !== lock ||
+    !Number.isSafeInteger(value.pid) ||
+    value.pid <= 1 ||
+    typeof value.host !== "string" ||
+    typeof value.birth !== "string" ||
+    !value.birth ||
+    typeof value.nonce !== "string" ||
+    value.nonce.length < 16 ||
+    typeof value.createdAt !== "string" ||
+    !Number.isFinite(Date.parse(value.createdAt))
+  )
+    throw fail("Legacy or incomplete holder identity; recovery refused");
+  if (
+    value.host !== os.hostname() ||
+    value.uid !== (process.getuid?.() ?? null)
+  )
+    throw fail("Holder host or user identity differs; recovery refused");
+  try {
+    process.kill(value.pid, 0);
+  } catch (error) {
+    if (error.code === "ESRCH") return { ...observed, holder: value };
+    throw fail(
+      `Holder identity is unknown (${error.code || "signal failed"}); recovery refused`,
+    );
+  }
+  throw fail(
+    "Holder PID is active, reused or identity cannot be confirmed; recovery refused",
+  );
+}
+/** Trusted local entry point only. Tool/path-bound state lock, no wildcard cleanup. */
+export function recoverStateLock(lock, { confirm } = {}) {
+  lock = path.resolve(lock);
+  if (!path.basename(lock).endsWith(".lock") || path.basename(lock) === ".lock")
+    throw fail("Expected an exact state .lock path");
+  stateDirectory(path.dirname(lock));
+  const guard = createLock(guardPath(lock));
+  try {
+    const observed = orphan(lock);
+    if (confirm === undefined)
+      return {
+        status: "orphan",
+        lock,
+        token: observed.token,
+        holder: observed.holder,
+      };
+    if (typeof confirm !== "string" || confirm !== observed.token)
+      throw fail("Confirmation token is stale; inspect this exact lock again");
+    const checked = orphan(lock);
+    if (checked.token !== observed.token)
+      throw fail("Lock changed during recovery");
+    unlinkSame(lock, observed);
+    return { status: "recovered", lock };
+  } finally {
+    guard.release();
+  }
+}

package/kernel/lib/state-store.mjs

@@ -4,6 +4,9 @@ import os from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { diffAgainstBaseline, badgeFor } from "./baseline.mjs";
 import { TOOL_VERSION } from "./version.mjs";
+import { acquireStateLock, stateDirectory } from "./state-lock.mjs";
+import { readStaticFile } from "./static-input.mjs";
+import { validateBaseline } from "./contracts.mjs";
 
 export const digest = (value) =>
   createHash("sha256").update(JSON.stringify(value)).digest("hex");
@@ -41,11 +44,31 @@ export function baselinePath(nm, mode = "catalogue", profile = null) {
 }
 export function readBaseline(file) {
   try {
-    if (!fs.existsSync(file))
-      return { prev: null, note: "还没有基线（这是第一次体检）" };
-    return { prev: JSON.parse(fs.readFileSync(file, "utf8")), note: null };
-  } catch {
-    return { prev: null, note: "基线读不出来，这次不做比较" };
+    stateDirectory(path.dirname(file));
+    const prev = JSON.parse(
+      readStaticFile(file, 8 * 1024 * 1024).toString("utf8"),
+    );
+    if (validateBaseline(prev).length)
+      throw new Error("Invalid baseline structure");
+    return {
+      prev,
+      note: null,
+      status: "valid",
+    };
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return {
+        prev: null,
+        note: "还没有基线（这是第一次体检）",
+        status: "missing",
+      };
+    return {
+      prev: null,
+      status: "unavailable",
+      note:
+        "基线格式不支持、损坏或不可安全读取，已保留原件；请人工核实或恢复可信备份后重试，本次不比较或覆盖" +
+        (error.code === "STATE_LOCK_UNSAFE" ? "；" + error.message : ""),
+    };
   }
 }
 /** Atomic replace never follows an existing output-file symlink. */
@@ -55,7 +78,7 @@ export function writeBaseline(file, snapshot) {
     `.baseline-${randomUUID()}.tmp`,
   );
   try {
-    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    stateDirectory(path.dirname(file), { create: true });
     fs.writeFileSync(temporary, JSON.stringify(snapshot, null, 2) + "\n", {
       flag: "wx",
       mode: 0o600,
@@ -73,27 +96,20 @@ export function writeBaseline(file, snapshot) {
 
 /** Serialize read/compare/replace across processes. Busy locks never overwrite newer state. */
 export function baselineTransaction(file, snapshot, { advance = true } = {}) {
-  let fd = null;
+  let heldLock = null;
   const lock = file + ".lock";
   try {
-    const dir = path.dirname(file);
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const stat = fs.lstatSync(dir);
-    if (
-      !stat.isDirectory() ||
-      stat.isSymbolicLink() ||
-      (typeof process.getuid === "function" && stat.uid !== process.getuid())
-    )
-      throw new Error("Unsafe baseline directory");
-    if (stat.mode & 0o077) fs.chmodSync(dir, 0o700);
-    fd = fs.openSync(
-      lock,
-      fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY,
-      0o600,
-    );
-    const { prev, note } = readBaseline(file),
+    heldLock = acquireStateLock(lock);
+    if (validateBaseline(snapshot).length)
+      throw new Error("新基线结构无效，未写入；保留原状态");
+    const { prev, note, status } = readBaseline(file),
       diff = diffAgainstBaseline(prev, snapshot);
+    if (status === "unavailable") diff.reason = note;
     const out = { file, note, diff, badge: badgeFor(diff), wrote: false };
+    if (status === "unavailable") {
+      out.writeError = note;
+      return out;
+    }
     if (advance) {
       const error = writeBaseline(file, snapshot);
       if (error) out.writeError = error;
@@ -112,15 +128,10 @@ export function baselineTransaction(file, snapshot, { advance = true } = {}) {
       wrote: false,
       writeError:
         error.code === "EEXIST"
-          ? "另一个进程正在更新基线；本次保留上次状态"
+          ? `另一个进程正在更新基线或锁已遗留；本次保留上次状态。可用对应源码仓库的 bin/recover-lock.mjs 检查 ${lock}`
           : error.message,
     };
   } finally {
-    if (fd !== null) {
-      fs.closeSync(fd);
-      try {
-        fs.unlinkSync(lock);
-      } catch {}
-    }
+    heldLock?.release();
   }
 }

package/kernel/lib/static-input.mjs

@@ -0,0 +1,111 @@
+/** Filesystem inputs are data. Never open a FIFO in blocking mode or read to EOF. */
+import fs from "node:fs";
+
+export const inputError = (code, message) =>
+  Object.assign(new Error(message), { code });
+const stamp = (s) => [s.dev, s.ino, s.size, s.mtimeMs, s.ctimeMs];
+const same = (a, b) => JSON.stringify(stamp(a)) === JSON.stringify(stamp(b));
+
+export function lowerInputLimits(defaults, overrides = {}) {
+  if (!overrides || typeof overrides !== "object" || Array.isArray(overrides))
+    throw inputError("STATIC_INPUT_BUDGET", "Invalid static input budget");
+  for (const [key, value] of Object.entries(overrides))
+    if (
+      !Object.hasOwn(defaults, key) ||
+      !Number.isSafeInteger(value) ||
+      value <= 0 ||
+      value > defaults[key]
+    )
+      throw inputError(
+        "STATIC_INPUT_BUDGET",
+        "Invalid static input budget: " + key,
+      );
+  return { ...defaults, ...overrides };
+}
+
+export function readStaticFile(file, maxBytes, check = () => {}) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
+    throw inputError("STATIC_INPUT_BUDGET", "Invalid static input byte budget");
+  let fd,
+    observed = false;
+  try {
+    check();
+    const before = fs.lstatSync(file);
+    observed = true;
+    if (!before.isFile())
+      throw inputError("STATIC_INPUT_TYPE", "Input is not a regular file");
+    if (before.size > maxBytes)
+      throw inputError("STATIC_INPUT_BUDGET", "Input byte budget exceeded");
+    fd = fs.openSync(
+      file,
+      fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK,
+    );
+    const opened = fs.fstatSync(fd);
+    if (!opened.isFile() || !same(before, opened))
+      throw inputError("STATIC_INPUT_CHANGED", "Input identity changed");
+    const buffer = Buffer.alloc(before.size + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      check();
+      const n = fs.readSync(
+        fd,
+        buffer,
+        length,
+        Math.min(buffer.length - length, 65536),
+        null,
+      );
+      if (!n) break;
+      length += n;
+    }
+    if (length > maxBytes)
+      throw inputError("STATIC_INPUT_BUDGET", "Input byte budget exceeded");
+    if (
+      length !== before.size ||
+      !same(before, fs.fstatSync(fd)) ||
+      !same(before, fs.lstatSync(file))
+    )
+      throw inputError(
+        "STATIC_INPUT_CHANGED",
+        "Input changed during bounded read",
+      );
+    return buffer.subarray(0, length);
+  } catch (error) {
+    if (observed && ["ENOENT", "ENOTDIR"].includes(error.code))
+      throw inputError(
+        "STATIC_INPUT_CHANGED",
+        "Input path changed during bounded read",
+      );
+    throw error;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+/** Collect only a bounded directory listing; close the handle even on timeout. */
+export function readStaticDirectory(dir, maxEntries, check = () => {}) {
+  if (!Number.isSafeInteger(maxEntries) || maxEntries < 0)
+    throw inputError(
+      "STATIC_INPUT_BUDGET",
+      "Invalid static input entry budget",
+    );
+  const handle = fs.opendirSync(dir),
+    entries = [];
+  try {
+    for (;;) {
+      check();
+      const entry = handle.readSync();
+      if (!entry) break;
+      if (entries.length >= maxEntries)
+        throw inputError(
+          "STATIC_INPUT_BUDGET",
+          "Directory entry budget exceeded",
+        );
+      entries.push(entry.name);
+    }
+    entries.sort();
+    check();
+    return entries;
+  } finally {
+    handle.closeSync();
+  }
+}

package/kernel/lib/syntax.mjs

@@ -46,28 +46,250 @@ export function childNodes(node) {
   return out;
 }
 
-export function localImports(text, file) {
+/** Prove only immutable lexical primitive expressions; never evaluate target code. */
+export function localImports(text, file, check = () => {}) {
   const { ast, error } = parseSource(text, file);
-  if (!ast) return { imports: [], error };
+  if (!ast) return { imports: [], edges: [], diagnostics: [], error };
   const imports = new Set(),
-    queue = [ast];
+    edges = [],
+    diagnostics = [],
+    scopes = new WeakMap(),
+    nodes = [];
+  const names = (n, out = []) => {
+    if (!n) return out;
+    if (n.type === "Identifier") out.push(n.name);
+    else if (n.type === "RestElement") names(n.argument, out);
+    else if (n.type === "TSParameterProperty") names(n.parameter, out);
+    else if (n.type === "AssignmentPattern") names(n.left, out);
+    else if (n.type === "ObjectPattern")
+      for (const p of n.properties) names(p.value ?? p.argument, out);
+    else if (n.type === "ArrayPattern")
+      for (const p of n.elements) names(p, out);
+    return out;
+  };
+  const makeScope = (parent, fn = false) => ({
+    parent,
+    fn,
+    bindings: new Map(),
+  });
+  const root = makeScope(null, true),
+    queue = [{ node: ast, scope: root }];
+  const find = (scope, name) => {
+    for (let s = scope; s; s = s.parent)
+      if (s.bindings.has(name)) return s.bindings.get(name);
+    return null;
+  };
+  const functionScope = (scope) => {
+    while (!scope.fn) scope = scope.parent;
+    return scope;
+  };
+  const declare = (scope, name, binding = {}) =>
+    scope.bindings.set(name, binding);
+  const note = (kind, node, message) => {
+    if (diagnostics.length < 100)
+      diagnostics.push({ kind, start: node?.start ?? null, message });
+  };
   while (queue.length) {
-    const n = queue.pop();
-    const source = [
-      "ImportDeclaration",
-      "ExportNamedDeclaration",
-      "ExportAllDeclaration",
-      "ImportExpression",
-    ].includes(n.type)
-      ? n.source
-      : n.type === "CallExpression" &&
-          n.callee?.type === "Identifier" &&
-          n.callee.name === "require"
-        ? n.arguments[0]
-        : null;
-    if (source?.type === "StringLiteral" && source.value.startsWith("."))
-      imports.add(source.value);
-    queue.push(...childNodes(n));
+    if (nodes.length % 128 === 0) check();
+    if (nodes.length >= 200000) {
+      note("module-path-budget", null, "Module path AST budget exceeded");
+      return { imports: [], edges: [], diagnostics, error: null };
+    }
+    const { node, scope: parent } = queue.pop();
+    let scope = parent;
+    const fn =
+      /^(?:FunctionDeclaration|FunctionExpression|ArrowFunctionExpression|ObjectMethod|ClassMethod|ClassPrivateMethod)$/.test(
+        node.type,
+      );
+    if (node.type === "FunctionDeclaration" && node.id)
+      declare(parent, node.id.name);
+    if (
+      [
+        "ClassDeclaration",
+        "TSEnumDeclaration",
+        "TSDeclareFunction",
+        "TSImportEqualsDeclaration",
+        "TSModuleDeclaration",
+      ].includes(node.type) &&
+      node.id?.type === "Identifier"
+    )
+      declare(parent, node.id.name);
+    if (fn) {
+      scope = makeScope(parent, true);
+      if (node.id) declare(scope, node.id.name);
+      for (const p of node.params)
+        for (const name of names(p)) declare(scope, name);
+    } else if (
+      ["ClassDeclaration", "ClassExpression", "TSModuleDeclaration"].includes(
+        node.type,
+      )
+    ) {
+      scope = makeScope(parent, node.type === "TSModuleDeclaration");
+      if (node.id?.type === "Identifier") declare(scope, node.id.name);
+    } else if (node.type === "StaticBlock") scope = makeScope(parent, true);
+    else if (
+      [
+        "BlockStatement",
+        "TSModuleBlock",
+        "ForStatement",
+        "ForInStatement",
+        "ForOfStatement",
+        "CatchClause",
+        "SwitchStatement",
+        "ClassBody",
+        "WithStatement",
+      ].includes(node.type)
+    )
+      scope = makeScope(parent);
+    if (node.type === "WithStatement") scope.opaque = true;
+    if (node.type === "CatchClause")
+      for (const name of names(node.param)) declare(scope, name);
+    if (node.type === "VariableDeclaration")
+      for (const d of node.declarations)
+        for (const name of names(d.id))
+          declare(node.kind === "var" ? functionScope(scope) : scope, name, {
+            constant: node.kind === "const" && d.id.type === "Identifier",
+            init: d.init,
+            start: d.start,
+          });
+    if (node.type === "ImportDeclaration")
+      for (const spec of node.specifiers) declare(scope, spec.local.name);
+    scopes.set(node, scope);
+    nodes.push(node);
+    for (const child of childNodes(node)) queue.push({ node: child, scope });
   }
-  return { imports: [...imports].sort(), error: null };
+  // Hoisted declarations and all writes are known before proving any path.
+  for (const [index, node] of nodes.entries()) {
+    if (index % 128 === 0) check();
+    const scope = scopes.get(node);
+    if (
+      node.type === "AssignmentExpression" ||
+      node.type === "UpdateExpression"
+    )
+      for (const name of names(node.left ?? node.argument)) {
+        const binding = find(scope, name);
+        if (binding) binding.changed = true;
+        else if (name === "require") root.requireChanged = true;
+      }
+    if (
+      node.type === "CallExpression" &&
+      node.callee.type === "Identifier" &&
+      node.callee.name === "eval" &&
+      !find(scope, "eval")
+    ) {
+      functionScope(scope).opaque = true;
+      root.requireChanged = true;
+    }
+  }
+  const opaque = (scope, key = "opaque") => {
+    for (let s = scope; s; s = s.parent) if (s[key]) return true;
+    return false;
+  };
+  for (const [index, node] of nodes.entries()) {
+    if (index % 128 === 0) check();
+    const dynamic = node.type === "ImportExpression";
+    const required =
+      ["CallExpression", "OptionalCallExpression"].includes(node.type) &&
+      node.callee?.type === "Identifier" &&
+      node.callee.name === "require";
+    const declared =
+      [
+        "ImportDeclaration",
+        "ExportNamedDeclaration",
+        "ExportAllDeclaration",
+      ].includes(node.type) && !!node.source;
+    if (!dynamic && !required && !declared) continue;
+    const scope = scopes.get(node);
+    if (required && find(scope, "require")) continue;
+    const source = required ? node.arguments[0] : node.source;
+    let steps = 0,
+      budget = false;
+    const evaluate = (n, seen = new Set(), depth = 0) => {
+      if (!n) return null;
+      if (++steps > 128 || depth > 32) {
+        budget = true;
+        return null;
+      }
+      let value;
+      if (
+        [
+          "TSAsExpression",
+          "TSTypeAssertion",
+          "TSNonNullExpression",
+          "ParenthesizedExpression",
+        ].includes(n.type)
+      )
+        return evaluate(n.expression, seen, depth + 1);
+      if (
+        ["StringLiteral", "NumericLiteral", "BooleanLiteral"].includes(n.type)
+      )
+        value = n.value;
+      else if (n.type === "Identifier") {
+        const binding = find(scopes.get(n), n.name);
+        if (
+          opaque(scopes.get(n)) ||
+          !binding?.constant ||
+          binding.changed ||
+          !binding.init ||
+          binding.start >= n.start ||
+          seen.has(binding)
+        )
+          return null;
+        const next = new Set(seen);
+        next.add(binding);
+        return evaluate(binding.init, next, depth + 1);
+      } else if (n.type === "BinaryExpression" && n.operator === "+") {
+        const a = evaluate(n.left, seen, depth + 1),
+          b = evaluate(n.right, seen, depth + 1);
+        if (a === null || b === null) return null;
+        value = a + b;
+      } else if (n.type === "TemplateLiteral") {
+        value = "";
+        for (let i = 0; i < n.quasis.length; i++) {
+          if (n.quasis[i].value.cooked === null) return null;
+          value += n.quasis[i].value.cooked;
+          if (i < n.expressions.length) {
+            const part = evaluate(n.expressions[i], seen, depth + 1);
+            if (part === null) return null;
+            value += String(part);
+          }
+          if (value.length > 8192) {
+            budget = true;
+            return null;
+          }
+        }
+      } else return null;
+      if (typeof value === "string" && value.length > 8192) {
+        budget = true;
+        return null;
+      }
+      return value;
+    };
+    const spec =
+      required && (opaque(scope) || opaque(scope, "requireChanged"))
+        ? null
+        : evaluate(source);
+    if (typeof spec !== "string" || !spec) {
+      note(
+        budget ? "module-path-budget" : "module-path-uncertain",
+        node,
+        budget
+          ? "Constant module path exceeds evaluation budget"
+          : "Module path cannot be proved as an immutable lexical string",
+      );
+      continue;
+    }
+    if (!spec.startsWith(".")) continue;
+    if (edges.length >= 4096) {
+      note("module-path-budget", node, "Module reference budget exceeded");
+      break;
+    }
+    imports.add(spec);
+    edges.push({
+      source: spec,
+      kind: required ? "require" : "import",
+      start: node.start,
+    });
+  }
+  return { imports: [...imports].sort(), edges, diagnostics, error: null };
 }