monkeypatchlist 0.0.0-stage → 0.1.0

package/dist/packages/analysis/lib/nested-code.d.ts

@@ -0,0 +1,38 @@
+import { type AstNode } from './ast.ts';
+/** A piece of code, and where each of its UTF-16 offsets lies in the host artifact. */
+export interface CodeText {
+    text: string;
+    /** The host artifact's offset for an offset in `text`, from 0 to `text.length`. It never decreases. */
+    host(offset: number): number;
+}
+/** Direct-eval code grafted into the host's AST in place of its literal, with the eval call it is the code of. */
+export interface Graft {
+    call: AstNode;
+}
+export interface NestedCode {
+    /** The code a code literal holds, located in the host artifact. */
+    code(literal: AstNode): CodeText;
+    /**
+     * The code a number, bigint, boolean or `null` literal given to `Function` stands for: its value converted with ToString
+     * (ECMA-262 CreateDynamicFunction, Principle 2), every offset of it located at the literal.
+     */
+    converted(literal: AstNode): CodeText;
+    /** The program nested code parses to as a script, re-based into the host artifact, or none when it doesn't parse. */
+    program(code: CodeText): AstNode | undefined;
+    /**
+     * The program the `Function` constructor compiles from its arguments' code (the parameters, then the body), re-based
+     * into the host artifact, or none when the parameters and body don't parse as they are.
+     */
+    functionProgram(parts: readonly CodeText[]): AstNode | undefined;
+    /**
+     * Grafts the code of every direct eval of a code literal in `program` (`eval("…")`) in place of its literal, as an
+     * arrow function whose body is that code, and records each graft in `grafts`. Code that doesn't parse is left alone:
+     * the eval would throw a SyntaxError. The names are not resolved here, so a graft only stands for eval code when
+     * its call's `eval` turns out to be the global one.
+     */
+    graftDirectEvals(program: AstNode, grafts: Map<AstNode, Graft>): void;
+}
+/** Whether a node is a code literal: a string literal, or a template literal without substitutions. */
+export declare function isCodeLiteral(node: AstNode): boolean;
+/** Nested code in one host artifact, whose source text is `hostText`. */
+export declare function nestedCode(hostText: string): NestedCode;

package/dist/packages/analysis/lib/nested-code.js

@@ -0,0 +1,200 @@
+// Nested code (§2 Content that isn't JavaScript, §19 Raw occurrences): the code a literal `eval`, `new Function` or
+// string timer compiles is parsed and analyzed inside the resolver, and located inside its host artifact.
+//
+// Every nested program is re-based into its host artifact's offsets: each UTF-16 offset of the code a literal holds is
+// mapped through the literal's escapes to where that character is written in the host. So a nested node's range lies
+// inside its literal, its line and column come from the host's line-start table, and code nested in nested code maps
+// through each literal in turn.
+//
+// A direct eval's code runs in its caller's scope, so it is grafted into the host's AST in place of its literal, as an
+// arrow function the scope rules treat as eval code (`Graft`). Its names then resolve through the binding-resolution
+// seam exactly as the caller's would. Other nested code is global code, analyzed as a program of its own.
+import { isEvalCall, walkTree } from "./ast.js";
+import { parse } from "./parse.js";
+/** Whether a node is a code literal: a string literal, or a template literal without substitutions. */
+export function isCodeLiteral(node) {
+    if (node.type === 'Literal')
+        return typeof node['value'] === 'string';
+    if (node.type !== 'TemplateLiteral' || node['expressions'].length > 0)
+        return false;
+    return cooked(node) !== null;
+}
+/** Nested code in one host artifact, whose source text is `hostText`. */
+export function nestedCode(hostText) {
+    // Where each code literal inside nested code was written. A literal in the host's own code is written in the host.
+    const sources = new WeakMap();
+    const sourceOf = (literal) => sources.get(literal) ?? { raw: hostText.slice(literal.start, literal.end), host: (offset) => literal.start + offset };
+    function code(literal) {
+        const source = sourceOf(literal);
+        const text = literal.type === 'Literal' ? literal['value'] : cooked(literal);
+        // Both kinds of literal have a one-character delimiter on each side.
+        const raw = rawOffsets(source.raw.slice(1, -1), text, literal.type === 'TemplateLiteral');
+        return { text, host: (offset) => source.host(1 + raw[offset]) };
+    }
+    function converted(literal) {
+        const text = String(literal['value']);
+        const { start, end } = literal;
+        return { text, host: (offset) => (offset < text.length ? start : end) };
+    }
+    /** Parses `code` as a script and re-bases it into the host, if it parses and has the shape `shaped` wants. */
+    function located(code, shaped = () => true) {
+        const parsed = parse(code.text, 'script');
+        if ('error' in parsed || !shaped(parsed.program))
+            return undefined;
+        walkTree(parsed.program, {
+            enter(node) {
+                const { start, end } = node;
+                if (isCodeLiteral(node)) {
+                    sources.set(node, { raw: code.text.slice(start, end), host: (offset) => code.host(start + offset) });
+                }
+                node.start = code.host(start);
+                node.end = code.host(end);
+                if (Array.isArray(node['range']))
+                    node['range'] = [node.start, node.end];
+            },
+        });
+        return parsed.program;
+    }
+    function functionProgram(parts) {
+        // ECMA-262 CreateDynamicFunction: the source text is `function anonymous(<parameters>\n) {\n<body>\n}`, which is
+        // parsed here as a parenthesized function expression.
+        const body = parts.at(-1);
+        if (body === undefined)
+            return undefined;
+        const segments = [];
+        let text = '(function anonymous(';
+        parts.slice(0, -1).forEach((part, index) => {
+            if (index > 0)
+                text += ',';
+            segments.push({ from: text.length, code: part });
+            text += part.text;
+        });
+        text += '\n) ';
+        const brace = text.length;
+        text += '{\n';
+        segments.push({ from: text.length, code: body });
+        text += `${body.text}\n})`;
+        // The glue between the parts is located at the start of the part after it, or at the end of the last part.
+        const host = (offset) => {
+            for (const { from, code } of segments) {
+                if (offset < from)
+                    return code.host(0);
+                if (offset <= from + code.text.length)
+                    return code.host(offset - from);
+            }
+            return body.host(body.text.length);
+        };
+        // The parameters and the body parse on their own, so neither can close the function early and add code after it.
+        return located({ text, host }, (program) => {
+            const [statement, ...more] = program['body'];
+            const made = statement?.['expression'];
+            return (more.length === 0 &&
+                made?.type === 'FunctionExpression' &&
+                made.start === 1 &&
+                made.end === text.length - 1 &&
+                made['body'].start === brace);
+        });
+    }
+    function graftDirectEvals(program, grafts) {
+        const calls = [];
+        walkTree(program, {
+            enter(node) {
+                if (!isEvalCall(node))
+                    return;
+                const [argument] = node['arguments'];
+                if (argument !== undefined && isCodeLiteral(argument))
+                    calls.push(node);
+            },
+        });
+        for (const call of calls) {
+            const args = call['arguments'];
+            const literal = args[0];
+            const nested = located(code(literal));
+            if (nested === undefined)
+                continue;
+            graftDirectEvals(nested, grafts);
+            const { start, end } = literal;
+            const graft = {
+                type: 'ArrowFunctionExpression',
+                start,
+                end,
+                range: [start, end],
+                id: null,
+                expression: false,
+                generator: false,
+                async: false,
+                params: [],
+                body: { type: 'BlockStatement', start, end, range: [start, end], body: nested['body'] },
+            };
+            args[0] = graft;
+            grafts.set(graft, { call });
+        }
+    }
+    return { code, converted, program: (code) => located(code), functionProgram, graftDirectEvals };
+}
+/** A template literal's cooked text, or null when an escape in it is invalid. */
+function cooked(template) {
+    const [quasi] = template['quasis'];
+    return quasi['value'].cooked;
+}
+/**
+ * For each UTF-16 offset of a literal's cooked text, from 0 to its length, the offset in `content` (the literal's
+ * source between its delimiters) where the character is written. Every unit an escape gives is at the escape's
+ * backslash, a line continuation gives nothing, and in a template a CR or CRLF gives one LF.
+ */
+function rawOffsets(content, text, template) {
+    const offsets = [];
+    let at = 0;
+    while (at < content.length) {
+        const char = content[at];
+        if (char === '\\') {
+            const [length, units] = escape(content, at);
+            for (let unit = 0; unit < units; unit++)
+                offsets.push(at);
+            at += length;
+        }
+        else if (template && char === '\r') {
+            offsets.push(at);
+            at += content[at + 1] === '\n' ? 2 : 1;
+        }
+        else {
+            offsets.push(at);
+            at++;
+        }
+    }
+    offsets.push(content.length);
+    // The escapes were read as the parser reads them, so the lengths agree. Were they ever not to, locations would still
+    // stay inside the literal and never decrease.
+    if (offsets.length !== text.length + 1) {
+        return Array.from({ length: text.length + 1 }, (_, offset) => Math.min(offset, content.length));
+    }
+    return offsets;
+}
+/** The escape sequence at `at` in a literal's source: how many characters it takes, and how many UTF-16 units it gives. */
+function escape(content, at) {
+    const next = content[at + 1] ?? '';
+    // A line continuation: a backslash before a line terminator gives nothing.
+    if (next === '\r')
+        return [content[at + 2] === '\n' ? 3 : 2, 0];
+    if (next === '\n' || next === '\u2028' || next === '\u2029')
+        return [2, 0];
+    if (next === 'x')
+        return [4, 1];
+    if (next === 'u') {
+        if (content[at + 2] !== '{')
+            return [6, 1];
+        const close = content.indexOf('}', at + 3);
+        return [close + 1 - at, Number.parseInt(content.slice(at + 3, close), 16) > 0xffff ? 2 : 1];
+    }
+    // `\0` and the legacy octal escapes of sloppy strings: up to three octal digits from 0-3, or two from 4-7.
+    if (next >= '0' && next <= '7') {
+        const most = next <= '3' ? 3 : 2;
+        let digits = 1;
+        while (digits < most && (content[at + 1 + digits] ?? '') >= '0' && (content[at + 1 + digits] ?? '') <= '7')
+            digits++;
+        return [1 + digits, 1];
+    }
+    // Any other escaped character stands for itself: one code point, which may be a surrogate pair.
+    const point = content.codePointAt(at + 1) ?? 0;
+    return point > 0xffff ? [3, 2] : [2, 1];
+}

package/dist/packages/analysis/lib/numeric.d.ts

@@ -0,0 +1,16 @@
+import type { Primitive } from './global-object.ts';
+/** What an operation on constants gives: its value, or that it throws, or that its value passes the `fold-length` cap. */
+export type Outcome = {
+    value: Primitive;
+} | 'throws' | 'too-long';
+/** The unary operators that convert their operand to a numeric value (ECMA-262 13.5). */
+export declare const numericUnary: ReadonlySet<string>;
+/**
+ * The binary operators that convert both operands to numeric values (ECMA-262 ApplyStringOrNumericBinaryOperator),
+ * besides `+`, which concatenates when either operand is a string.
+ */
+export declare const numericBinary: ReadonlySet<string>;
+/** `op value` for one of `numericUnary`. */
+export declare function unaryOperation(op: string, value: Primitive, maxLength: number): Outcome;
+/** `a op b` for `+` or one of `numericBinary`. */
+export declare function binaryOperation(op: string, a: Primitive, b: Primitive, maxLength: number): Outcome;

package/dist/packages/analysis/lib/numeric.js

@@ -0,0 +1,216 @@
+// Numeric folding (Principle 2, §5 Resolver capabilities 1): the unary and binary operators on primitive constants, as
+// ECMA-262 defines them. The operation itself is JavaScript's own, so its result, and whether it throws, are the
+// engine's. Two guards come first, because a BigInt can be far too large to compute:
+//
+// - A BigInt result whose decimal string would pass the `fold-length` cap is `too-long`, judged from the operands' bit
+//   lengths before it is computed (`10n ** 2000000n`), or from its own once it is (§5, §18).
+// - A BigInt result over V8's own limit, 2^30 bits, makes Chromium throw a RangeError, so it `throws` (Principle 1).
+//
+// A BigInt literal is bounded by its source, so only an operator's result is judged.
+/** The unary operators that convert their operand to a numeric value (ECMA-262 13.5). */
+export const numericUnary = new Set(['-', '+', '~']);
+/**
+ * The binary operators that convert both operands to numeric values (ECMA-262 ApplyStringOrNumericBinaryOperator),
+ * besides `+`, which concatenates when either operand is a string.
+ */
+export const numericBinary = new Set(['-', '*', '/', '%', '**', '&', '|', '^', '<<', '>>', '>>>']);
+/** V8's largest BigInt, in bits (`BigInt::kMaxLengthBits`): a result past it throws a RangeError. */
+const maxBigIntBits = 2 ** 30;
+const log10Of2 = Math.log10(2);
+/** `op value` for one of `numericUnary`. */
+export function unaryOperation(op, value, maxLength) {
+    const numeric = toNumeric(value);
+    if (numeric === 'throws')
+        return 'throws';
+    // Unary `+` is ToNumber, which a BigInt throws on.
+    if (op === '+')
+        return typeof numeric === 'bigint' ? 'throws' : { value: numeric };
+    if (typeof numeric === 'number')
+        return { value: op === '-' ? -numeric : ~numeric };
+    return judged(op === '-' ? -numeric : ~numeric, maxLength);
+}
+/** `a op b` for `+` or one of `numericBinary`. */
+export function binaryOperation(op, a, b, maxLength) {
+    if (op === '+') {
+        // ToPrimitive of a primitive is itself. A symbol throws in ToString and in ToNumeric alike.
+        if (typeof a === 'symbol' || typeof b === 'symbol')
+            return 'throws';
+        if (typeof a === 'string' || typeof b === 'string')
+            return { value: String(a) + String(b) };
+    }
+    const x = toNumeric(a);
+    const y = toNumeric(b);
+    if (x === 'throws' || y === 'throws')
+        return 'throws';
+    // Mixing a BigInt and a Number is a TypeError.
+    if (typeof x !== typeof y)
+        return 'throws';
+    if (typeof x === 'number')
+        return { value: numberOperation(op, x, y) };
+    return bigintOperation(op, x, y, maxLength);
+}
+/** ECMA-262 ToNumeric of a primitive: a BigInt stays one, a symbol throws, and anything else is ToNumber'd. */
+function toNumeric(value) {
+    if (typeof value === 'bigint')
+        return value;
+    if (typeof value === 'symbol')
+        return 'throws';
+    return Number(value);
+}
+function numberOperation(op, x, y) {
+    switch (op) {
+        case '+':
+            return x + y;
+        case '-':
+            return x - y;
+        case '*':
+            return x * y;
+        case '/':
+            return x / y;
+        case '%':
+            return x % y;
+        case '**':
+            return x ** y;
+        case '&':
+            return x & y;
+        case '|':
+            return x | y;
+        case '^':
+            return x ^ y;
+        case '<<':
+            return x << y;
+        case '>>':
+            return x >> y;
+        default:
+            return x >>> y;
+    }
+}
+/**
+ * A BigInt operation. One that can grow its result past what the operands' sizes show (`*`, `**`, `<<`, a `>>` by a
+ * negative amount) is judged from bit lengths first.
+ */
+function bigintOperation(op, x, y, maxLength) {
+    const before = beforeComputing(op, x, y, maxLength);
+    if (before !== undefined)
+        return before;
+    let value;
+    try {
+        value = computed(op, x, y);
+    }
+    catch {
+        // `/` or `%` by zero, a negative exponent, or `>>>`, which BigInts don't have.
+        return 'throws';
+    }
+    return judged(value, maxLength);
+}
+function computed(op, x, y) {
+    switch (op) {
+        case '+':
+            return x + y;
+        case '-':
+            return x - y;
+        case '*':
+            return x * y;
+        case '/':
+            return x / y;
+        case '%':
+            return x % y;
+        case '**':
+            return x ** y;
+        case '&':
+            return x & y;
+        case '|':
+            return x | y;
+        case '^':
+            return x ^ y;
+        case '<<':
+            return x << y;
+        case '>>':
+            return x >> y;
+        default:
+            // `>>>` throws a TypeError on BigInts.
+            throw new TypeError('BigInts have no unsigned right shift');
+    }
+}
+/**
+ * What a growing BigInt operation gives before it is computed: `throws` when its result's bit length is surely past
+ * V8's limit, `too-long` when its decimal string surely passes the cap, and undefined when it is small enough to compute.
+ * `bits` is the least bit length the result can have.
+ */
+function beforeComputing(op, x, y, maxLength) {
+    const bits = leastBits(op, x, y);
+    if (bits === undefined)
+        return undefined;
+    if (bits > maxBigIntBits)
+        return 'throws';
+    return leastDigits(bits) > maxLength ? 'too-long' : undefined;
+}
+/** The least bit length the result of a growing operation can have, or undefined when it can't grow much. */
+function leastBits(op, x, y) {
+    switch (op) {
+        case '*':
+            return x === 0n || y === 0n ? undefined : bitLength(x) + bitLength(y) - 1;
+        case '**': {
+            // A negative exponent throws, and a base of 0, 1 or -1 stays small.
+            if (y <= 0n || x === 0n || x === 1n || x === -1n)
+                return undefined;
+            // V8 refuses an exponent of 2^30 or more for any other base, whatever the result's size.
+            if (y >= BigInt(maxBigIntBits))
+                return Infinity;
+            const exponent = Number(y);
+            const magnitude = x < 0n ? -x : x;
+            // A power of 2, 2^k, gives exactly k * y + 1 bits.
+            if ((magnitude & (magnitude - 1n)) === 0n)
+                return (bitLength(magnitude) - 1) * exponent + 1;
+            // Any other |x| ** y has floor(y * log2|x|) + 1 bits. The estimate's floating-point error is below a relative
+            // 1e-14, so lowering it by a relative 1e-12 keeps it from rising past the exact count.
+            const estimate = exponent * log2(x);
+            return Math.floor(estimate * (1 - 1e-12)) + 1;
+        }
+        case '<<':
+        case '>>': {
+            const shift = op === '<<' ? y : -y;
+            if (shift <= 0n || x === 0n)
+                return undefined;
+            // Exactly, since shifting left multiplies by a power of 2.
+            return bitLength(x) + Number(shift);
+        }
+        default:
+            return undefined;
+    }
+}
+/** A computed BigInt: `too-long` when its decimal string passes the cap, else its value. */
+function judged(value, maxLength) {
+    const bits = bitLength(value);
+    // A string that surely fits, sign included, isn't made.
+    if (mostDigits(bits) + 1 <= maxLength)
+        return { value };
+    if (leastDigits(bits) > maxLength)
+        return 'too-long';
+    return String(value).length > maxLength ? 'too-long' : { value };
+}
+/** The bit length of |x|: 0 for 0n. */
+function bitLength(x) {
+    if (x === 0n)
+        return 0;
+    const hex = (x < 0n ? -x : x).toString(16);
+    return (hex.length - 1) * 4 + Number.parseInt(hex[0], 16).toString(2).length;
+}
+/** log2 |x| of a BigInt other than 0, from its leading 52 bits. */
+function log2(x) {
+    const bits = bitLength(x);
+    const magnitude = x < 0n ? -x : x;
+    const shift = Math.max(0, bits - 53);
+    return shift + Math.log2(Number(magnitude >> BigInt(shift)));
+}
+/**
+ * The fewest and most decimal digits a number of `bits` bits can have: |x| is in [2^(bits-1), 2^bits). The margin keeps
+ * floating-point error from deciding either bound wrongly, so a result between them is measured.
+ */
+const margin = 1e-6;
+function leastDigits(bits) {
+    return bits === 0 ? 1 : Math.floor((bits - 1) * log10Of2 - margin) + 1;
+}
+function mostDigits(bits) {
+    return bits === 0 ? 1 : Math.floor(bits * log10Of2 + margin) + 1;
+}

package/dist/packages/analysis/lib/once-flags.d.ts

@@ -0,0 +1,12 @@
+import { type AstNode } from './ast.ts';
+import type { Definitions, VariableKey } from './definitions.ts';
+import { type CallGraph } from './summaries.ts';
+export interface OnceFlags {
+    /** Whether a variable is a once-flag: some function tests it and then assigns it on the path the test lets through. */
+    isFlag(key: VariableKey): boolean;
+}
+/**
+ * `maxCallDepth` is how many calls deep an assignment is followed from the path a test lets through (`flagDepth`, §18),
+ * and `depthCut` hears each function it keeps from being followed, a hit of that cap.
+ */
+export declare function onceFlags(program: AstNode, definitions: Definitions, calls: CallGraph, maxCallDepth: number, depthCut?: (fn: AstNode) => void): OnceFlags;

package/dist/packages/analysis/lib/once-flags.js

@@ -0,0 +1,190 @@
+// Once-flags (§5 Resolver capabilities 6). A once-flag is recognized by use: a variable or parameter is a flag when a
+// function tests it (`if`, `?:`, `&&`, `||`, `!`, an early return) and then assigns it on the path that test lets
+// through, directly or in a call on that path, whatever value it assigns. A flag's tests are never decided as
+// constants, so Rollup's `if (Ki) return Xi; Ki = 1`, `ge || (ge = 1, …)` and esbuild's `t && (e = t(t = 0))` keep the
+// code after them. A variable that no function tests before assigning it (esbuild's init-thunk constants, `Nl = 4`) is
+// no flag, and its tests still decide. Whether the variable reads a catalog native, which keeps its test a §7 guard, is
+// the evaluator's to judge from its values.
+import { walkTree } from "./ast.js";
+import { isFunction } from "./summaries.js";
+/**
+ * `maxCallDepth` is how many calls deep an assignment is followed from the path a test lets through (`flagDepth`, §18),
+ * and `depthCut` hears each function it keeps from being followed, a hit of that cap.
+ */
+export function onceFlags(program, definitions, calls, maxCallDepth, depthCut = () => { }) {
+    /** The nodes that test a name (an `if`, a `?:`, a `&&`/`||`, a `||=`/`&&=`), by the names they test. */
+    let testers;
+    /** Each statement's list and index in it, for the statements after an early return. */
+    const lists = new Map();
+    const memo = new Map();
+    function indexed() {
+        if (testers !== undefined)
+            return testers;
+        const found = new Map();
+        const add = (tester, test) => {
+            for (const id of testedNames(test)) {
+                const name = id['name'];
+                const list = found.get(name);
+                if (list === undefined)
+                    found.set(name, [tester]);
+                else if (list.at(-1) !== tester)
+                    list.push(tester);
+            }
+        };
+        walkTree(program, {
+            enter(node) {
+                for (const key of ['body', 'consequent']) {
+                    const list = node[key];
+                    if (Array.isArray(list))
+                        list.forEach((statement, at) => lists.set(statement, { list: list, at }));
+                }
+                switch (node.type) {
+                    case 'IfStatement':
+                    case 'ConditionalExpression':
+                        add(node, node['test']);
+                        break;
+                    case 'LogicalExpression':
+                        if (node['operator'] !== '??')
+                            add(node, node['left']);
+                        break;
+                    case 'AssignmentExpression':
+                        if (node['operator'] === '||=' || node['operator'] === '&&=')
+                            add(node, node['left']);
+                        break;
+                }
+            },
+        });
+        return (testers = found);
+    }
+    /** Whether a test reads the variable `key` as a test does: itself, under `!`, `typeof` or a comparison. */
+    const tests = (test, key) => testedNames(test).some((id) => {
+        const read = definitions.keyOf(id);
+        return read !== undefined && read.scope === key.scope && read.name === key.name;
+    });
+    /** The code a test lets through: its arms, the right side, and the statements after an arm that always leaves. */
+    function letThrough(tester) {
+        switch (tester.type) {
+            case 'IfStatement': {
+                const consequent = tester['consequent'];
+                const alternate = tester['alternate'];
+                const arms = alternate === null ? [consequent] : [consequent, alternate];
+                const place = lists.get(tester);
+                const early = place !== undefined && arms.some(leaves);
+                return early ? [...arms, ...place.list.slice(place.at + 1)] : arms;
+            }
+            case 'ConditionalExpression':
+                return [tester['consequent'], tester['alternate']];
+            case 'LogicalExpression':
+                return [tester['right']];
+            default:
+                // `k ||= …` assigns what it tests.
+                return [tester];
+        }
+    }
+    function isFlag(key) {
+        let byName = memo.get(key.scope);
+        if (byName === undefined)
+            memo.set(key.scope, (byName = new Map()));
+        let flag = byName.get(key.name);
+        if (flag === undefined)
+            byName.set(key.name, (flag = recognized(key)));
+        return flag;
+    }
+    function recognized(key) {
+        const candidates = indexed().get(key.name);
+        if (candidates === undefined)
+            return false;
+        const all = definitions.of(key);
+        if (all.length === 0)
+            return false;
+        /** The functions whose own code assigns the variable. */
+        const owners = new Set(all.map((definition) => calls.functionOf(definition.site) ?? program));
+        const assigning = new Map();
+        /** Whether a call of `fn` assigns the variable, in `fn`'s own code or in a call it makes, `depth` calls deep. */
+        const assigns = (fn, depth) => {
+            if (owners.has(fn))
+                return true;
+            if (depth >= maxCallDepth) {
+                depthCut(fn);
+                return false;
+            }
+            const known = assigning.get(fn);
+            if (known !== undefined)
+                return known;
+            assigning.set(fn, false);
+            const body = fn['body'];
+            const result = callsIn(body, fn).some((call) => calls.sitesOf(call).some((site) => assigns(site.fn, depth + 1)));
+            assigning.set(fn, result);
+            return result;
+        };
+        for (const tester of candidates) {
+            if (!tests(tester.type === 'IfStatement' || tester.type === 'ConditionalExpression' ? tester['test'] : tester['left'], key)) {
+                continue;
+            }
+            const fn = calls.functionOf(tester) ?? program;
+            for (const region of letThrough(tester)) {
+                // An assignment in the tester's own code on that path.
+                const direct = all.some((definition) => region.start <= definition.site.start &&
+                    definition.site.end <= region.end &&
+                    (calls.functionOf(definition.site) ?? program) === fn);
+                if (direct)
+                    return true;
+                // Or in a call made on that path.
+                if (callsIn(region, fn).some((call) => calls.sitesOf(call).some((site) => assigns(site.fn, 1))))
+                    return true;
+            }
+        }
+        return false;
+    }
+    return { isFlag };
+}
+/** The calls and `new`s in `node` that are the own code of `fn`: not in a function nested in it. */
+function callsIn(node, fn) {
+    const found = [];
+    walkTree(node, {
+        enter(child) {
+            if (child !== node && child !== fn && isFunction(child))
+                return false;
+            if (child.type === 'CallExpression' || child.type === 'NewExpression')
+                found.push(child);
+        },
+    });
+    return found;
+}
+/** The identifiers a test reads as a test does: the test itself, under `!` or `typeof`, compared, or in `&&`/`||`. */
+function testedNames(test) {
+    switch (test.type) {
+        case 'Identifier':
+            return [test];
+        case 'UnaryExpression':
+            return test['operator'] === '!' || test['operator'] === 'typeof' ? testedNames(test['argument']) : [];
+        case 'BinaryExpression':
+            return ['==', '!=', '===', '!==', '<', '>', '<=', '>='].includes(test['operator'])
+                ? [...testedNames(test['left']), ...testedNames(test['right'])].filter((id) => !isLiteralName(id))
+                : [];
+        case 'LogicalExpression':
+            return [...testedNames(test['left']), ...testedNames(test['right'])];
+        case 'SequenceExpression':
+            return testedNames(test['expressions'].at(-1));
+        default:
+            return [];
+    }
+}
+/** `undefined`, `NaN` and `Infinity`, which a comparison reads as values rather than tests. */
+const isLiteralName = (id) => ['undefined', 'NaN', 'Infinity'].includes(id['name']);
+/** Whether a statement always leaves the code after it: a `return` or `throw`, or a block or `if` that always does. */
+function leaves(statement) {
+    switch (statement.type) {
+        case 'ReturnStatement':
+        case 'ThrowStatement':
+            return true;
+        case 'BlockStatement':
+            return statement['body'].some(leaves);
+        case 'IfStatement': {
+            const alternate = statement['alternate'];
+            return alternate !== null && leaves(statement['consequent']) && leaves(alternate);
+        }
+        default:
+            return false;
+    }
+}