dsh-plugin-compat-check 0.1.6 → 0.1.7

package/kernel/lib/source-analysis.mjs

@@ -1,5 +1,10 @@
 import { parseSource, childNodes } from "./syntax.mjs";
 import { hasEvidence, hasProof, mergedValue } from "./flow-values.mjs";
+import {
+  captureSemanticArguments,
+  mergeSemanticArguments,
+  semanticTarget,
+} from "./api-semantics.mjs";
 
 const members = new Set(["MemberExpression", "OptionalMemberExpression"]);
 const calls = new Set(["CallExpression", "OptionalCallExpression"]);
@@ -85,7 +90,8 @@ export function analyzeSources(
   const provideSiteKeys = new Set();
   let scopeId = 0,
     invocationCount = 0,
-    constantCalls = 0;
+    constantCalls = 0,
+    semanticGeneration = 0;
   const identifierCache = new WeakMap();
   const guardSets = new Set();
   const guardSet = (values = []) => {
@@ -95,7 +101,7 @@ export function analyzeSources(
   };
   const serviceCache = new WeakMap();
   const stateFor = (value) => {
-    if (value?.kind === "object") return value;
+    if (value?.kind === "object" || value?.kind === "literal") return value;
     if (value?.kind === "context" || value?.kind === "service")
       return (value.state ||= { fields: new Map(), opaque: false });
     return null;
@@ -208,6 +214,7 @@ export function analyzeSources(
   };
   const writeField = (object, key, value) => {
     noteMutation(object);
+    if (object.injectMetadata || object.kind === "literal") markOpaque(object);
     if (journals.length) object.fields = new Map(object.fields);
     object.fields.set(key, value);
   };
@@ -307,6 +314,7 @@ export function analyzeSources(
     };
     modules.set(file, module);
     const callResults = new WeakMap();
+    const semanticSnapshots = new WeakMap();
     const effects = new WeakMap();
     const hasEffect = (node, scope) => effects.get(node)?.has(scope.id);
     const effectValue = (node, scope) =>
@@ -353,6 +361,8 @@ export function analyzeSources(
       kind: "object",
       fields: new Map([["exports", cjsExports]]),
     };
+    const cjsInjectCandidates = [],
+      entryInjectCandidates = [];
     let currentDeferred = null;
     const imported = (spec, name) => ({
       kind: "import",
@@ -478,8 +488,12 @@ export function analyzeSources(
             !args.every((v) => v?.kind === "constant") ||
             !constantOnly(body) ||
             ++constantCalls > 512
-          )
+          ) {
+            // Ordinary closures are not expanded. Their writes can invalidate
+            // scalar/options evidence without changing Context value-flow rules.
+            semanticGeneration++;
             return null;
+          }
         }
         if (invoking.has(key)) {
           diagnose(
@@ -577,7 +591,7 @@ export function analyzeSources(
       declared.add(service);
       if (kind === "optional-read" || kind === "read")
         softDeclared.add(service);
-      dependencies.push({
+      const row = {
         service,
         kind,
         inferred,
@@ -586,7 +600,9 @@ export function analyzeSources(
         start: node.start,
         end: node.end,
         sides: [...(activeSides || sides)],
-      });
+      };
+      dependencies.push(row);
+      return row;
     };
     const provide = (service, node) => {
       provided.add(service);
@@ -617,6 +633,24 @@ export function analyzeSources(
         return value === null ? [] : [value];
       });
     };
+    // Cordis Inject.resolve treats object keys as service names, not lists
+    // named required/optional. Unknown spreads/accessors cannot prove a map.
+    const injectServices = (node, scope, value = resolve(node, scope)) => {
+      if (value) value.injectMetadata = true;
+      if (value?.kind === "literal" && value.complete && !value.opaque)
+        return value.strings;
+      if (value?.kind === "object" && !value.opaque)
+        return [...value.fields.keys()].filter(
+          (key) => typeof key === "string",
+        );
+      diagnose(
+        "inject-unresolved",
+        file,
+        node,
+        "Injection declaration cannot be established as an array or service map",
+      );
+      return [];
+    };
     const keyFor = (node, scope, guards) =>
       node?.computed
         ? constant(node.property, scope, guards)
@@ -690,7 +724,7 @@ export function analyzeSources(
           node.type,
         )
       )
-        return { kind: "constant", value: node.value };
+        return { kind: "constant", value: node.value, semanticGeneration };
       if (node.type === "TemplateLiteral") {
         const values = node.expressions.map((n) => resolve(n, scope, guards));
         if (values.every((v) => v?.kind === "constant")) {
@@ -707,7 +741,14 @@ export function analyzeSources(
             );
             return null;
           }
-          return { kind: "constant", value: chunks.join("") };
+          return {
+            kind: "constant",
+            value: chunks.join(""),
+            semanticGeneration: values.reduce(
+              (min, v) => Math.min(min, v.semanticGeneration ?? -1),
+              semanticGeneration,
+            ),
+          };
         }
       }
       if (node.type === "BinaryExpression" && node.operator === "+") {
@@ -727,7 +768,14 @@ export function analyzeSources(
             );
             return null;
           }
-          return { kind: "constant", value: left.value + right.value };
+          return {
+            kind: "constant",
+            value: left.value + right.value,
+            semanticGeneration: Math.min(
+              left.semanticGeneration ?? -1,
+              right.semanticGeneration ?? -1,
+            ),
+          };
         }
       }
       if (node.type === "ConditionalExpression") {
@@ -772,17 +820,51 @@ export function analyzeSources(
       }
       if (node.type === "ThisExpression")
         return scope.functionScope().receiver || { kind: "instance" };
-      if (node.type === "ArrayExpression")
-        return { kind: "literal", strings: literalNames(node, scope) };
+      if (node.type === "ArrayExpression") {
+        const strings = [];
+        let complete = true;
+        for (const element of node.elements) {
+          const spread = element?.type === "SpreadElement";
+          const value = resolve(
+            spread ? element.argument : element,
+            scope,
+            guards,
+          );
+          if (
+            spread &&
+            value?.kind === "literal" &&
+            value.complete &&
+            !value.opaque
+          )
+            strings.push(...value.strings);
+          else if (
+            !spread &&
+            value?.kind === "constant" &&
+            typeof value.value === "string"
+          )
+            strings.push(value.value);
+          else complete = false;
+        }
+        return {
+          kind: "literal",
+          strings,
+          complete,
+          fields: new Map(),
+          opaque: false,
+          node,
+        };
+      }
       if (node.type === "ObjectExpression") {
         const fields = new Map();
         for (const p of node.properties)
-          if (p.type === "ObjectProperty")
-            fields.set(
-              p.computed ? constant(p.key, scope, guards) : keyName(p),
-              resolve(p.value, scope, guards),
-            );
-          else if (p.type === "ObjectMethod")
+          if (p.type === "ObjectProperty") {
+            const key = p.computed
+              ? constant(p.key, scope, guards)
+              : keyName(p);
+            const value = resolve(p.value, scope, guards);
+            if (key === "inject" && value) value.injectMetadata = true;
+            fields.set(key, value);
+          } else if (p.type === "ObjectMethod")
             fields.set(
               p.computed ? constant(p.key, scope, guards) : keyName(p),
               fnValue(p, scope),
@@ -793,7 +875,7 @@ export function analyzeSources(
             (p.type === "ObjectMethod" && p.kind !== "method") ||
             (p.computed && constant(p.key, scope, guards) === null),
         );
-        return { kind: "object", fields, opaque };
+        return { kind: "object", fields, opaque, node, semanticGeneration };
       }
       if (members.has(node.type)) {
         const object = transparent(resolve(node.object, scope, guards), node),
@@ -825,16 +907,14 @@ export function analyzeSources(
         if (value?.kind === "context")
           heads.add(text.slice(node.start, node.end));
         return value;
-        return null;
       }
       if (calls.has(node.type)) {
         if (
           node.callee.type === "Identifier" &&
           node.callee.name === "require" &&
-          !scope.find("require") &&
-          node.arguments[0]?.type === "StringLiteral"
+          !scope.find("require")
         )
-          return namespace(moduleLinks.get(file)?.get(node.arguments[0].value));
+          return namespace(moduleLinks.get(file)?.get("require@" + node.start));
         let memo = callResults.get(node);
         if (!memo) {
           memo = new Map();
@@ -853,6 +933,24 @@ export function analyzeSources(
           visit(arg, scope, guards);
           return resolve(arg, scope, guards);
         });
+        if (callee?.kind === "method") {
+          const captured = captureSemanticArguments(
+            callee.service,
+            callee.method,
+            values,
+            node.arguments,
+            (arg) =>
+              arg?.type === "Identifier" &&
+              arg.name === "undefined" &&
+              !scope.find("undefined"),
+            semanticGeneration,
+          );
+          if (captured) {
+            if (!semanticSnapshots.has(node))
+              semanticSnapshots.set(node, new Map());
+            semanticSnapshots.get(node).set(scope.id, captured);
+          }
+        }
         if (callee?.kind === "function") {
           const result = callee.invoke(
             values,
@@ -863,6 +961,17 @@ export function analyzeSources(
           memo.set(scope.id, result);
           return result;
         }
+        if (
+          !callee ||
+          !["method", "service"].includes(callee.kind) ||
+          (!semanticTarget(callee.service, callee.method) &&
+            values.some((v) =>
+              ["object", "literal", "function"].includes(v?.kind),
+            ))
+        )
+          semanticGeneration++;
+        if (receiver?.injectMetadata || receiver?.kind === "literal")
+          taint(receiver);
       }
       if (
         calls.has(node.type) &&
@@ -973,6 +1082,7 @@ export function analyzeSources(
         condition = body[0].argument;
       else if (
         body[0]?.type === "IfStatement" &&
+        !body[0].alternate &&
         body[0].consequent.type === "ReturnStatement" &&
         body[0].consequent.argument?.value === true &&
         body.at(-1)?.type === "ReturnStatement" &&
@@ -1096,7 +1206,7 @@ export function analyzeSources(
         guards.has(`${value.service}.${value.method}`);
       if (!callMap.has(value.service)) callMap.set(value.service, new Set());
       callMap.get(value.service).add(value.method);
-      sites.push({
+      const site = {
         service: value.service,
         method: value.method,
         plugin: pkgName,
@@ -1117,7 +1227,9 @@ export function analyzeSources(
         evidenceSource: "ast",
         inferredReceiver: value.receiver?.inferred === true,
         sides: [...(activeSides || sides)],
-      });
+      };
+      sites.push(site);
+      return site;
     };
     const visitFunction = (
       node,
@@ -1346,6 +1458,13 @@ export function analyzeSources(
       }
       if (node.type === "Program")
         return statementList(node.body, scope, guards, depth);
+      if (node.type === "StaticBlock")
+        return statementList(
+          node.body,
+          new Scope(scope, ++scopeId, true),
+          guards,
+          depth,
+        );
       if (node.type === "BlockStatement")
         return statementList(
           node.body,
@@ -1392,15 +1511,20 @@ export function analyzeSources(
         );
         if (node.id.type === "Identifier") {
           const field = node.id.name;
-          if (injectNames.has(field) || /^inject(?:Deps|Scope|s)?$/.test(field))
-            for (const s of literalNames(node.init, scope))
-              dependency(
-                s,
-                scope === root && isEntry && injectNames.has(field)
-                  ? "required-inject"
-                  : "descriptor-inject",
-                node,
-              );
+          if (
+            injectNames.has(field) ||
+            /^inject(?:Deps|Scope|s)?$/.test(field)
+          ) {
+            const kind =
+              scope === root && isEntry && injectNames.has(field)
+                ? "required-inject"
+                : "descriptor-inject";
+            const rows = injectServices(node.init, scope, value).map((s) =>
+              dependency(s, kind, node),
+            );
+            if (kind === "required-inject")
+              entryInjectCandidates.push({ value, node, rows });
+          }
           if (provideNames.has(field))
             for (const s of literalNames(node.init, scope)) {
               provide(s, node);
@@ -1458,7 +1582,16 @@ export function analyzeSources(
             "Unknown write key may replace existing fields",
           );
         } else {
-          writeField(state, slot.key, value);
+          if (
+            node.type === "UnaryExpression" &&
+            node.operator === "delete" &&
+            slot.object.kind === "object"
+          ) {
+            noteMutation(state);
+            if (state.injectMetadata) markOpaque(state);
+            if (journals.length) state.fields = new Map(state.fields);
+            state.fields.delete(slot.key);
+          } else writeField(state, slot.key, value);
           if (["context", "service"].includes(slot.object.kind))
             diagnose(
               "flow-service-mutation",
@@ -1523,11 +1656,19 @@ export function analyzeSources(
           ) {
             const result = slot.old.value + right.value;
             if (typeof result !== "string" || result.length <= 8192)
-              value = { kind: "constant", value: result };
+              value = {
+                kind: "constant",
+                value: result,
+                semanticGeneration: Math.min(
+                  slot.old.semanticGeneration ?? -1,
+                  right.semanticGeneration ?? -1,
+                ),
+              };
           }
         } else if (slot.old?.kind === "constant")
           value = {
             kind: "constant",
+            semanticGeneration: slot.old.semanticGeneration ?? -1,
             value: Number(slot.old.value) + (node.operator === "++" ? 1 : -1),
           };
         if (!value && node.operator !== "=")
@@ -1543,18 +1684,28 @@ export function analyzeSources(
           scope,
           node.type === "UpdateExpression" && !node.prefix ? slot.old : value,
         );
-        if (node.type === "AssignmentExpression" && slot.key === "inject")
-          for (const name of literalNames(node.right, scope))
-            dependency(name, "descriptor-inject", node);
+        if (node.type === "AssignmentExpression" && slot.key === "inject") {
+          const rows = injectServices(node.right, scope, value).map((name) =>
+            dependency(name, "descriptor-inject", node),
+          );
+          cjsInjectCandidates.push({ owner: slot.object, value, node, rows });
+        }
         if (node.type === "AssignmentExpression" && slot.key === "provide")
           for (const name of literalNames(node.right, scope)) {
             provide(name, node);
           }
         return;
       }
-      if (node.type === "ObjectProperty" && keyName(node) === "inject")
-        for (const s of literalNames(node.value, scope))
-          dependency(s, "descriptor-inject", node);
+      if (node.type === "ObjectProperty" && keyName(node) === "inject") {
+        const rows = injectServices(node.value, scope).map((name) =>
+          dependency(name, "descriptor-inject", node),
+        );
+        cjsInjectCandidates.push({
+          value: resolve(node.value, scope),
+          node,
+          rows,
+        });
+      }
       if (node.type === "CatchClause") {
         const caught = new Scope(scope, ++scopeId);
         bind(node.param, null, caught);
@@ -1706,8 +1857,10 @@ export function analyzeSources(
         return;
       }
       if (calls.has(node.type)) {
-        recordCall(node, scope, guards);
+        const site = recordCall(node, scope, guards);
         resolve(node, scope, guards);
+        const captured = semanticSnapshots.get(node)?.get(scope.id);
+        if (site && captured) site.semanticArguments = captured;
         let target = resolve(node.callee, scope, guards);
         if (target?.kind === "namespace")
           target = lookupExport(target.target, "default");
@@ -1797,7 +1950,16 @@ export function analyzeSources(
           for (const v of d.declarations)
             for (const name of namesIn(v.id))
               module.exports.set(name, { local: name });
-        for (const spec of n.specifiers || [])
+        for (const spec of n.specifiers || []) {
+          if (!spec.local) {
+            diagnose(
+              "module-export-uncertain",
+              file,
+              spec,
+              "Namespace re-export binding is not established",
+            );
+            continue;
+          }
           module.exports.set(
             spec.exported.name ?? spec.exported.value,
             n.source
@@ -1807,6 +1969,7 @@ export function analyzeSources(
                 }
               : { local: spec.local.name },
           );
+        }
       }
       if (n.type === "ExportAllDeclaration") module.stars.push(n.source.value);
     }
@@ -1817,6 +1980,48 @@ export function analyzeSources(
     module.cjs = () => cjsModule.fields.get("exports");
     module.entry = () => {
       if (!isEntry) return;
+      for (const candidate of entryInjectCandidates) {
+        if (!candidate.value?.opaque) continue;
+        diagnose(
+          "inject-unresolved",
+          file,
+          candidate.node,
+          "Injection metadata was mutated or escaped before activation",
+        );
+        for (const row of candidate.rows) {
+          row.kind = "descriptor-inject";
+          row.inferred = true;
+        }
+      }
+      const exported = module.cjs();
+      const injected = readField(exported, "inject", program);
+      if (injected?.opaque || (exported?.opaque && cjsInjectCandidates.length))
+        diagnose(
+          "inject-unresolved",
+          file,
+          program,
+          "CommonJS injection metadata or its export owner was mutated or escaped",
+        );
+      if (
+        exported?.kind === "object" &&
+        !exported.opaque &&
+        injected &&
+        !injected.opaque
+      ) {
+        for (const candidate of cjsInjectCandidates) {
+          const sameOwner =
+            candidate.owner === exported ||
+            exported.node?.properties?.includes(candidate.node);
+          const sameInput =
+            candidate.value === injected ||
+            (injected.node && candidate.value?.node === injected.node);
+          if (!sameOwner || !sameInput) continue;
+          for (const row of candidate.rows) {
+            row.kind = "required-inject";
+            row.inferred = false;
+          }
+        }
+      }
       const apply = lookupExport(file, "apply");
       if (apply?.kind !== "function") return;
       const guards = guardSet();
@@ -1873,6 +2078,17 @@ export function analyzeSources(
     const old = unique.get(key);
     if (!old) unique.set(key, site);
     else {
+      if (old.semanticArguments || site.semanticArguments) {
+        if (old.inferredReceiver && !site.inferredReceiver)
+          old.semanticArguments = site.semanticArguments;
+        else if (!old.inferredReceiver && site.inferredReceiver) {
+          /* Preserve the proved call. */
+        } else
+          old.semanticArguments = mergeSemanticArguments(
+            old.semanticArguments,
+            site.semanticArguments,
+          );
+      }
       old.inferredReceiver = old.inferredReceiver && site.inferredReceiver;
       old.guarded = old.guarded && site.guarded;
       old.capabilityGuarded = old.capabilityGuarded && site.capabilityGuarded;