monkeypatchlist 0.0.0-stage → 0.1.0

package/dist/packages/analysis/lib/writes.js

@@ -0,0 +1,1612 @@
+// Writes (§3 Mechanisms): the native members a node writes, by which mechanism, and what the syntax says about the new
+// value. Whether a write is a platform mutation, and its effect, is for the catalog to decide (`effect.ts`).
+//
+// - `assign`: `h.m = v`, `h["m"] = v`, a bare global `m = v`, and `Reflect.set(h, "m", v)`, whose receiver, when it is
+//   given, is the object written: `Reflect.set(h, "m", v, r)` is a [[Set]] of r through h's chain
+// - `define-property`, `reflect-define` and `define-properties`: `Object.defineProperty(h, "m", d)`,
+//   `Reflect.defineProperty(h, "m", d)` and `Object.defineProperties(h, { m: d, … })`. `h.__defineGetter__("m", g)` and
+//   `h.__defineSetter__("m", s)` are a `define-property` of an enumerable, configurable accessor. A descriptor keeps the
+//   parts the syntax doesn't show, for the outcome to weigh (§3 Undecidable outcomes).
+// - `bulk-assign`: `Object.assign(h, { m: v, … }, …)`. A source's own `__proto__` key calls h's `__proto__` setter, as
+//   `h.__proto__ = p` does, so it is a `set-prototype`.
+// - `delete`: `delete h.m`, `Reflect.deleteProperty(h, "m")`, and an unqualified `delete m` of a global (§5 post-pass 4)
+// - `set-prototype`: `Object.setPrototypeOf(h, p)`, `Reflect.setPrototypeOf(h, p)`, and `h.__proto__ = p` (or
+//   `Reflect.set(h, "__proto__", p)`), which calls `Object.prototype.__proto__`'s setter
+//
+// `h` is an expression that denotes exactly one native holder (§5 Global resolution). A key is a name, or a key that
+// folds to a constant (§5 Resolver capabilities 1): `h["add" + "EventListener"]`, `h[method]` with a `const method`,
+// `h[0]`, `h[Symbol.iterator]`, converted as ToPropertyKey converts it (§4 Property keys). The native functions a call
+// mechanism uses are recognized through the same global resolution: `window.Object.defineProperty(…)` is one too. Each
+// write keeps the folds its holder, key and descriptor come from.
+import { calleeExpression, setsLiteralPrototype, walkTree } from "./ast.js";
+import { inDocumentOrder, instanceOf, mergedFolds, opaque, sameWindow, truthiness } from "./global-object.js";
+import { literalKey, memberName, patternName, toPropertyKey } from "./keys.js";
+import { boundNames } from "./scope.js";
+/** The most candidates a site's candidate set gives findings for (§5 Candidate sets, ADR 0019). */
+export const maxCandidates = 4;
+/**
+ * The member of a wildcard write (§5 Partially resolved writes): a key the analyzer can't fold. It names no member, so
+ * each member the wildcard matches takes its place when the outcome is judged (`effect.ts`).
+ */
+export const unknownMember = Symbol('unknown member');
+/** The native functions that write a member, by catalog name, with their mechanism. */
+const nativeWriters = {
+    'Object.defineProperty': 'define-property',
+    'Reflect.defineProperty': 'reflect-define',
+    'Object.defineProperties': 'define-properties',
+    'Object.assign': 'bulk-assign',
+    'Object.setPrototypeOf': 'set-prototype',
+    'Reflect.setPrototypeOf': 'set-prototype',
+    'Reflect.set': 'assign',
+    'Reflect.deleteProperty': 'delete',
+};
+/** The legacy methods that define an accessor on their `this` (§3), with the accessor field each gives. */
+const accessorDefiners = { __defineGetter__: 'get', __defineSetter__: 'set' };
+/** The member names of the native writer functions. */
+const writerMembers = new Set(Object.keys(nativeWriters).map((name) => name.slice(name.indexOf('.') + 1)));
+/**
+ * The native members `node` writes directly, in source order. When a fold in the key, holder or descriptor of the write
+ * passed the `fold-length` cap, and its holder can be the global object or a native holder, it goes to `budget`, whether
+ * or not the write resolves (Principle 5, §13): the value written, and a call's native function, are no part of it.
+ */
+export function writesAt(node, at, context) {
+    return sitesAt(node, at, context).writes;
+}
+/**
+ * The native members `node` writes directly, as `writesAt` gives them, and the write sites in it whose member folds
+ * but whose holder may be an object the analyzer can't resolve (§5 Partially resolved writes).
+ */
+export function sitesAt(node, where, context) {
+    // Whether a holder written can be a native holder: one alternative of it is enough (Principle 3).
+    let native = false;
+    const cuts = [];
+    const run = (choice, wildKeys) => {
+        const open = [];
+        const wild = [];
+        const splits = new Map();
+        const chooser = { choice, wildKeys, splits };
+        const writes = writesOf(node, where, context, (reached) => (native ||= reached), open, cuts, wild, chooser);
+        return { writes, open, wild, splits };
+    };
+    let cut = false;
+    const { value: sites, capped } = context.resolution.tracked(() => {
+        const first = run(new Map(), new Set());
+        if (first.splits.size === 0)
+            return { ...first, wide: [] };
+        return candidateSites(first, run, context.caps.candidateRuns, () => (cut = true));
+    });
+    if (cut)
+        context.candidatesCut(node, native);
+    if (native && capped.length > 0)
+        context.budget(capped);
+    if (cuts.length > 0)
+        context.descriptorsCut([...new Set(cuts)], native);
+    return sites;
+}
+/**
+ * Every run of `writesOf` that decides each branch it meets, one per combination of alternatives, in source order.
+ * Undefined past `maxRuns` runs (the `candidateRuns` cap).
+ */
+function enumerated(first, run, wildKeys, maxRuns) {
+    const done = [];
+    const stack = [[new Map(), first]];
+    let runs = 0;
+    while (stack.length > 0) {
+        const [choice, given] = stack.pop();
+        if (++runs > maxRuns)
+            return undefined;
+        const result = given ?? run(choice, wildKeys);
+        const fresh = [...result.splits].find(([node]) => !choice.has(node));
+        if (fresh === undefined) {
+            done.push({ run: result, choice });
+            continue;
+        }
+        const [node, split] = fresh;
+        const alternatives = split.kind === 'holder'
+            ? split.holders.map((reached) => ({ kind: 'holder', reached }))
+            : [
+                ...split.keys.map((key) => ({ kind: 'key', key, unresolved: split.unresolved, tested: split.tested })),
+                ...split.prefixes.map((prefix) => ({ kind: 'prefix', prefix, unresolved: split.unresolved, tested: split.tested })),
+            ];
+        for (const chosen of alternatives.reverse())
+            stack.push([new Map([...choice, [node, chosen]]), undefined]);
+    }
+    return done;
+}
+/** The name of the target a write names, before the catalog decides its outcome. */
+export function candidateName(write) {
+    const { change } = write;
+    if (change.kind === 'prototype')
+        return `${write.holder}.[[Prototype]]`;
+    const { pattern } = write;
+    if (pattern !== undefined)
+        return patternName(write.holder, pattern);
+    return change.member === unknownMember ? `${write.holder}.*` : memberName(write.holder, change.member);
+}
+/** The member a write names, as a candidate: a key, or the prototype. */
+const candidateMember = (write) => write.change.kind === 'prototype' ? '[[Prototype]]' : write.change.member;
+/**
+ * The write sites at a node whose holder or key has several candidates (§5 Candidate sets, ADR 0019): every
+ * combination of alternatives is a run of `writesOf`, and each site's candidate set is the targets those runs give it,
+ * the cross product of its holders and members, capped on distinct targets:
+ * - up to `maxCandidates` targets give one write each, which carries its candidate set
+ * - more, with one member that folds, are a `WideSite`, an `unresolved-holder` limitation at most (§5)
+ * - more, with several members and at most `maxCandidates` holders, give a wildcard per holder, its matched set
+ *   narrowed to the members; with more holders, nothing
+ * - wildcard writes, whose key doesn't fold, on up to `maxCandidates` holders give one each, and on more a `WideSite`
+ * Past `maxRuns` runs (the `candidateRuns` cap), the sites the runs decide give nothing, and `cut` hears it.
+ */
+function candidateSites(first, run, maxRuns, cut) {
+    const complete = enumerated(first, run, new Set(), maxRuns);
+    if (complete === undefined) {
+        cut();
+        return { writes: [], open: [], wild: [], wide: [] };
+    }
+    const sites = new Map();
+    const siteOf = (site) => {
+        let found = sites.get(site);
+        if (found === undefined)
+            sites.set(site, (found = { named: [], wild: [], open: [] }));
+        return found;
+    };
+    for (const { run: each, choice } of complete) {
+        for (const write of each.writes)
+            siteOf(write.site).named.push({ write, choice });
+        for (const write of each.wild)
+            siteOf(write.site).wild.push({ write, choice });
+        for (const write of each.open) {
+            const { open } = siteOf(write.site);
+            if (!open.some((other) => other.change.member === write.change.member))
+                open.push(write);
+        }
+    }
+    /**
+     * The branch a candidate's holder or member comes from: the first branch of its kind whose choice gives it. A pattern
+     * wildcard's member comes from the branch that gives its prefix.
+     */
+    const branchOf = (choice, holder, member, prefix) => {
+        for (const [node, chosen] of choice) {
+            if (holder !== undefined && chosen.kind === 'holder' && chosen.reached.holder === holder)
+                return node;
+            if (member !== undefined && chosen.kind === 'key' && chosen.key.member === member)
+                return node;
+            if (prefix !== undefined && chosen.kind === 'prefix' && chosen.prefix === prefix)
+                return node;
+        }
+        return undefined;
+    };
+    /**
+     * The candidates of a site, one per target, the first run's that gives it. The `<holder>.*` of several prefixes some
+     * catalog member starts with is one target, narrowed to the members that start with any of them (Principle 3).
+     */
+    const byTarget = (candidates) => {
+        const out = new Map();
+        for (const candidate of candidates) {
+            const name = candidateName(candidate.write);
+            const first = out.get(name);
+            if (first === undefined)
+                out.set(name, candidate);
+            else {
+                const prefixes = first.write.prefixes;
+                const more = candidate.write.prefixes;
+                if (prefixes === undefined || more === undefined)
+                    continue;
+                const merged = [...new Set([...prefixes, ...more])];
+                if (merged.length > prefixes.length)
+                    out.set(name, { ...first, write: { ...first.write, prefixes: merged } });
+            }
+        }
+        return out;
+    };
+    /** The prefix of a candidate that is a pattern wildcard (§5 Pattern wildcards). */
+    const patternOf = (write) => write.pattern;
+    /**
+     * The prefix a candidate's member comes from: a pattern wildcard's, or the first of a `<holder>.*` narrowed to the
+     * members that start with its prefixes (§5 Pattern wildcards).
+     */
+    const prefixOf = (write) => patternOf(write) ?? write.prefixes?.[0];
+    /** The key alternative a candidate's member comes from, if any. */
+    const keyChosen = (choice, write) => {
+        const member = candidateMember(write);
+        const prefix = prefixOf(write);
+        return [...choice.values()].find((chosen) => (chosen.kind === 'key' && prefix === undefined && chosen.key.member === member) ||
+            (chosen.kind === 'prefix' && chosen.prefix === prefix));
+    };
+    /** Whether a candidate's member comes from a key that also has alternatives the analyzer can't resolve. */
+    const unresolvedKey = (choice, write) => keyChosen(choice, write)?.unresolved === true;
+    /**
+     * Whether a candidate's member comes from a key that lost a heap-read or once-flag boolean, `null` or `undefined` an
+     * undecided test gave back.
+     */
+    const testedKey = (choice, write) => keyChosen(choice, write)?.tested === true;
+    const together = (...groups) => {
+        const candidates = groups.flatMap((group) => [...group.values()]);
+        const keys = new Set();
+        const prefixes = new Set();
+        for (const { write } of candidates) {
+            const pattern = patternOf(write);
+            const member = candidateMember(write);
+            if (pattern !== undefined)
+                prefixes.add(pattern);
+            else if (member !== unknownMember)
+                keys.add(member);
+            for (const prefix of write.prefixes ?? [])
+                prefixes.add(prefix);
+        }
+        return { targets: groups.flatMap((group) => [...group.keys()]), keys: [...keys], prefixes: [...prefixes] };
+    };
+    /**
+     * The candidates with their candidate set, when the site has more than one, or when a member comes from a key with
+     * alternatives the analyzer can't resolve, which keeps `member-alternatives` even alone, as a
+     * configurable prefix does.
+     */
+    const tagged = (targets, site, members) => {
+        const candidates = [...targets.values()];
+        const holders = [...new Set(candidates.map(({ write }) => write.holder))];
+        const keys = members ?? site.keys;
+        const prefixes = members === undefined ? site.prefixes : [];
+        const mixed = members === undefined && candidates.some(({ write, choice }) => unresolvedKey(choice, write) || testedKey(choice, write));
+        if (site.targets.length < 2 && !mixed)
+            return candidates.map(({ write }) => write);
+        return candidates.map(({ write, choice }) => {
+            const holderNode = holders.length > 1 ? branchOf(choice, write.holder) : undefined;
+            const member = candidateMember(write);
+            const prefix = prefixOf(write);
+            const unresolved = members === undefined && unresolvedKey(choice, write);
+            const tested = members === undefined && testedKey(choice, write);
+            const memberNode = members === undefined && (keys.length + prefixes.length > 1 || unresolved || tested)
+                ? prefix !== undefined
+                    ? branchOf(choice, undefined, undefined, prefix)
+                    : member !== unknownMember
+                        ? branchOf(choice, undefined, member)
+                        : undefined
+                : undefined;
+            const alternatives = {
+                ...(holderNode === undefined ? {} : { holders: { node: holderNode, names: holders } }),
+                ...(memberNode === undefined
+                    ? {}
+                    : {
+                        members: {
+                            node: memberNode,
+                            keys: [...keys],
+                            ...(prefixes.length === 0 ? {} : { prefixes }),
+                            ...(unresolved ? { unresolved: true } : {}),
+                            ...(tested ? { tested: true } : {}),
+                        },
+                    }),
+                targets: site.targets,
+            };
+            return { ...write, alternatives };
+        });
+    };
+    const writes = [];
+    const open = [];
+    const wild = [];
+    const wide = [];
+    // The sites whose candidates are taken as a wildcard per holder, with the members each is narrowed to, and the
+    // prefixes some catalog member starts with whose members it is narrowed to as well.
+    const narrowed = new Map();
+    for (const [site, { named, wild: wilds, open: opens }] of sites) {
+        let keepOpen = true;
+        const namedTargets = byTarget(named);
+        const wildTargets = byTarget(wilds);
+        if (wilds.some(({ write }) => write.pattern !== undefined || write.prefixes !== undefined) &&
+            namedTargets.size + [...wildTargets.values()].reduce((sum, { write }) => sum + (write.prefixes?.length ?? 1), 0) > maxCandidates) {
+            // More than 4 constants and prefixes follow the wildcard rule, narrowed to the candidates (§5 Candidate sets):
+            // to the constants and the members that start with a prefix, which a pattern's prefix narrows to none.
+            const holders = new Set([...named, ...wilds].map(({ write }) => write.holder));
+            const members = [...new Set(named.map(({ write }) => candidateMember(write)))];
+            const prefixes = [...new Set(wilds.flatMap(({ write }) => write.prefixes ?? []))];
+            if (members.length + prefixes.length > 0 && holders.size <= maxCandidates)
+                narrowed.set(site, { members, prefixes });
+            continue;
+        }
+        // A key whose alternatives are constants and prefixes gives both: one candidate set (§5 Pattern wildcards).
+        const candidateSet = together(...(namedTargets.size <= maxCandidates ? [namedTargets] : []), ...(wildTargets.size <= maxCandidates ? [wildTargets] : []));
+        if (named.length > 0) {
+            const targets = namedTargets;
+            const holders = new Set(named.map(({ write }) => write.holder));
+            const members = [...new Set(named.map(({ write }) => candidateMember(write)))];
+            if (targets.size <= maxCandidates)
+                writes.push(...tagged(targets, candidateSet));
+            else if (members.length === 1) {
+                // One member on more holders than the cap: an `unresolved-holder` limitation at most (§5).
+                const [first] = opens;
+                if (first !== undefined)
+                    wide.push({ site, open: first, writes: [...targets.values()].map(({ write }) => write) });
+                keepOpen = false;
+            }
+            else {
+                if (holders.size <= maxCandidates)
+                    narrowed.set(site, { members, prefixes: [] });
+                keepOpen = false;
+            }
+        }
+        if (wilds.length > 0) {
+            const targets = wildTargets;
+            if (targets.size <= maxCandidates)
+                wild.push(...tagged(targets, candidateSet));
+            else
+                wide.push({ site, wild: [...targets.values()].map(({ write }) => write) });
+        }
+        if (keepOpen)
+            open.push(...opens);
+    }
+    if (narrowed.size > 0) {
+        // The same runs, with each key that has several candidates taken as unknown, give the wildcards.
+        const keys = new Set(complete.flatMap(({ choice }) => [...choice].flatMap(([node, chosen]) => (chosen.kind === 'holder' ? [] : [node]))));
+        const wildRuns = enumerated(run(new Map(), keys), run, keys, maxRuns);
+        if (wildRuns === undefined)
+            cut();
+        const found = new Map();
+        for (const { run: each, choice } of wildRuns ?? []) {
+            for (const write of each.wild) {
+                if (!narrowed.has(write.site))
+                    continue;
+                const list = found.get(write.site);
+                if (list === undefined)
+                    found.set(write.site, [{ write, choice }]);
+                else
+                    list.push({ write, choice });
+            }
+        }
+        for (const [site, candidates] of found) {
+            const { members, prefixes } = narrowed.get(site);
+            const narrowing = prefixes.length === 0 ? { members } : { members, prefixes };
+            const targets = byTarget(candidates.map(({ write, choice }) => ({ write: { ...write, ...narrowing }, choice })));
+            wild.push(...tagged(targets, together(targets), members));
+        }
+    }
+    return { writes, open, wild, wide };
+}
+/**
+ * The writes `node` makes. `reachesNative` hears whether each holder a write is made on (not a value, nor a call's
+ * native function) can be a native holder.
+ */
+function writesOf(node, where, context, reachesNative, open, cuts, wild, chooser) {
+    const { scope, global } = context;
+    // Where the write's parts are evaluated: at the write, or where a heap field's value is (`evaluatedAt`).
+    let at = where;
+    const evaluatedAt = (position, run) => {
+        const saved = at;
+        at = position;
+        try {
+            return run();
+        }
+        finally {
+            at = saved;
+        }
+    };
+    /**
+     * An evaluation that is no part of the write's key, holder or descriptor: the value written, or the native function a
+     * call uses. The folds it finds too long are only counted.
+     */
+    let apartDepth = 0;
+    const apart = (run) => {
+        apartDepth++;
+        try {
+            return context.resolution.tracked(run, true).value;
+        }
+        finally {
+            apartDepth--;
+        }
+    };
+    /**
+     * The one native holder an expression denotes, with its leaves and folds. Several are a candidate set (§5): the
+     * alternative the run's choice takes, or else the first, the branch going to the chooser. A value or a call's native
+     * function (`apart`) has none. `single` takes several as none, as for the object a `Reflect.set` looks its member up
+     * on when it writes another.
+     */
+    const holderOf = (expression, unresolved, single = false) => {
+        const values = context.resolution.evaluate(expression, at);
+        const holders = values.filter((value) => value.kind === 'holder');
+        if (apartDepth === 0)
+            reachesNative(holders.length > 0);
+        // An alternative the analyzer can't resolve may be any object (§5 Partially resolved writes).
+        const unknown = values.some(opaque);
+        if (unresolved !== undefined && unknown)
+            unresolved();
+        const reached = ({ holder, leaves, folds = [] }) => ({ holder, leaves: inDocumentOrder(leaves), folds });
+        if (holders.length === 1)
+            return reached(holders[0]);
+        if (holders.length === 0 || apartDepth > 0 || single)
+            return undefined;
+        const chosen = chooser.choice.get(expression);
+        if (chosen?.kind === 'holder') {
+            // More holders than the cap with one member are an open write site too (§5 Candidate sets).
+            if (unresolved !== undefined && !unknown && holders.length > maxCandidates)
+                unresolved();
+            return chosen.reached;
+        }
+        if (!chooser.splits.has(expression))
+            chooser.splits.set(expression, { kind: 'holder', holders: holders.map(reached) });
+        return reached(holders[0]);
+    };
+    /**
+     * A key that folds to a constant: a literal, a template literal, a `+`, a `const`, converted as ECMA-262
+     * ToPropertyKey converts it (§4 Property keys): `0` and `"0"` are the same key. Several constants are a candidate
+     * set (§5), taken as `holderOf` takes several holders; a value or a call's native function (`apart`) takes only one.
+     * A key whose alternatives mix constants and values the analyzer can't resolve has its constants as candidates, even
+     * one alone, and the unknown part gives nothing.
+     */
+    const constantKey = (key) => {
+        const values = keyValues(key);
+        if (apartDepth > 0) {
+            const [value] = values;
+            if (values.length !== 1 || value?.kind !== 'constant')
+                return undefined;
+            return { member: toPropertyKey(value.value), folds: value.folds ?? [] };
+        }
+        if (chooser.wildKeys.has(key))
+            return undefined;
+        const chosen = keyChoice(key);
+        return chosen?.kind === 'key' ? chosen.key : undefined;
+    };
+    /**
+     * The alternative of a key a run takes: a constant (`constantKey`), or a constant prefix a string the analyzer can't
+     * fold whole starts with (§5 Pattern wildcards); undefined when the key has neither, or is no key at all (an object).
+     * Several are a candidate set, and so is one beside values the analyzer can't resolve, which give nothing.
+     */
+    const keyChoice = (key) => {
+        const values = keyValues(key);
+        const tested = testedKeys.has(key);
+        const keys = [];
+        const prefixes = [];
+        let unresolved = false;
+        for (const value of values) {
+            if (value.kind === 'unknown' && value.prefix !== undefined) {
+                if (!prefixes.includes(value.prefix))
+                    prefixes.push(value.prefix);
+                continue;
+            }
+            if (opaque(value)) {
+                unresolved = true;
+                continue;
+            }
+            if (value.kind !== 'constant')
+                return undefined;
+            const member = toPropertyKey(value.value);
+            if (!keys.some((each) => each.member === member))
+                keys.push({ member, folds: value.folds ?? [] });
+        }
+        // With no constant, a key the analyzer can't resolve is a wildcard's (§5 Partially resolved writes).
+        if (keys.length + prefixes.length === 0)
+            return undefined;
+        const first = () => keys.length > 0
+            ? { kind: 'key', key: keys[0], unresolved, tested }
+            : { kind: 'prefix', prefix: prefixes[0], unresolved, tested };
+        if (keys.length + prefixes.length === 1 && !unresolved && !tested)
+            return first();
+        const chosen = chooser.choice.get(key);
+        if (chosen?.kind === 'key' || chosen?.kind === 'prefix')
+            return chosen;
+        if (!chooser.splits.has(key))
+            chooser.splits.set(key, { kind: 'key', keys, prefixes, unresolved, tested });
+        return first();
+    };
+    /**
+     * The values a key can have, evaluated once where the write is, so that a key read again to tell whether it is
+     * unknown counts no cap twice (§18).
+     */
+    let lastKey;
+    // The keys that lost such a value, whose other constants keep `member-alternatives`.
+    const testedKeys = new Set();
+    const keyValues = (key) => {
+        if (lastKey?.node === key && lastKey.at === at)
+            return lastKey.values;
+        // A heap-read or once-flag boolean, `null` or `undefined` an undecided test gives back is never a key (§5 Candidate
+        // sets).
+        const evaluated = context.resolution.evaluate(key, at);
+        const values = evaluated.filter((value) => value.kind !== 'constant' || value.tested !== true);
+        if (values.length < evaluated.length)
+            testedKeys.add(key);
+        lastKey = { node: key, at, values };
+        return values;
+    };
+    /** Whether a key folds to nothing the analyzer knows: every value it can have is unknown (§5 Partially resolved writes). */
+    const unknownKey = (key) => {
+        if (chooser.wildKeys.has(key))
+            return true;
+        const chosen = keyChoice(key);
+        if (chosen !== undefined)
+            return chosen.kind === 'prefix';
+        const values = keyValues(key);
+        return values.length > 0 && values.every(opaque);
+    };
+    /** A wildcard write of `holder`'s member `key`, as the write `site` makes it, with what the syntax shows of it. */
+    const wildWrite = (site, reached, object, key, mechanism, change, lookup, extra = {}) => {
+        const { leaves = reached.leaves, folds = [], ...rest } = extra;
+        // A key that folds to a constant prefix (§5 Pattern wildcards): a pattern wildcard when no catalog member of the
+        // holder or its chain starts with it, otherwise `<holder>.*` narrowed to the members that do.
+        const chosen = chooser.wildKeys.has(key) ? undefined : keyChoice(key);
+        const prefixed = chosen?.kind !== 'prefix'
+            ? {}
+            : {
+                ...(context.patternPrefix(reached.holder, chosen.prefix) ? { pattern: chosen.prefix } : { prefixes: [chosen.prefix] }),
+                ...(chosen.unresolved ? { configurable: true } : {}),
+            };
+        wild.push({
+            site,
+            holder: reached.holder,
+            leaves,
+            realmInstance: instanceOf(reached.leaves),
+            mechanism,
+            change,
+            folds: [...folds, ...reached.folds],
+            parts: { holder: reached.folds, member: [] },
+            lookup,
+            key,
+            object,
+            ...prefixed,
+            ...rest,
+        });
+    };
+    /** The member a member expression names: `h.m`, or `h[k]` with a key that folds to a constant. */
+    const memberKey = (member) => {
+        const property = member['property'];
+        if (member['computed'] === true)
+            return constantKey(property);
+        return property.type === 'Identifier' ? { member: property['name'], folds: [] } : undefined;
+    };
+    /** A property's key in an object literal: a name, a string or number literal, or a computed key that folds. */
+    const propertyKey = (property) => {
+        const key = property['key'];
+        if (property['computed'] === true)
+            return constantKey(key);
+        if (key.type === 'Identifier')
+            return { member: key['name'], folds: [] };
+        const member = literalKey(key);
+        return member === undefined ? undefined : { member, folds: [] };
+    };
+    /**
+     * The native member an assignment target or a `delete` operand denotes: a bare global, or a holder's member, with the
+     * leaves its holder was reached from.
+     */
+    const memberOf = (target, unresolved, wildcard) => {
+        if (target.type === 'Identifier') {
+            const leaf = bareGlobal(target, scope, context.instance);
+            if (leaf === undefined)
+                return undefined;
+            const lookup = { node: target, token: leaf.name };
+            const parts = { holder: [], member: [] };
+            return { holder: global, member: leaf.name, realmInstance: leaf.instance, leaves: [leaf], folds: [], parts, lookup };
+        }
+        if (target.type !== 'MemberExpression' || target['object'].type === 'Super')
+            return undefined;
+        const { value: key, capped } = context.resolution.tracked(() => memberKey(target));
+        const object = target['object'];
+        // A key the analyzer knows nothing of, on one native holder, may be a wildcard write (§5).
+        if (key === undefined && capped.length === 0 && wildcard !== undefined && target['computed'] === true) {
+            const property = target['property'];
+            if (!unknownKey(property))
+                return undefined;
+            const reached = holderOf(object);
+            if (reached !== undefined)
+                wildcard(object, property, reached);
+            return undefined;
+        }
+        // A key too long to fold still cuts the write when its holder is native (Principle 5).
+        const reached = key === undefined && capped.length === 0
+            ? undefined
+            : holderOf(object, key === undefined || unresolved === undefined ? undefined : () => unresolved(object, key));
+        if (reached === undefined || key === undefined)
+            return undefined;
+        const { holder, leaves } = reached;
+        const folds = [...reached.folds, ...key.folds];
+        // A write with no member, `h.__proto__ = p`, looks up its holder.
+        const lookup = key.member === '__proto__' ? holderLookup(object) : memberLookup(target, object);
+        const parts = { holder: reached.folds, member: key.folds };
+        return { holder, member: key.member, realmInstance: instanceOf(leaves), leaves, folds, parts, lookup };
+    };
+    /**
+     * The lookup of a member expression's write: its member token when the member is written at the site, as a name
+     * (`h.m`), a string (`h["m"]`) or a template with no substitutions. A computed member (`h[k]`) or a number
+     * (`h[0]`) has no token, and its holder is looked up.
+     */
+    const memberLookup = (member, object) => {
+        const property = member['property'];
+        if (member['computed'] !== true)
+            return { node: property, token: property['name'] };
+        const written = writtenString(property);
+        return written === undefined ? { node: object, token: null } : { node: property, token: written };
+    };
+    /**
+     * The lookup of a write at its holder argument (§10): its token is its name only when it is written as a free global
+     * (`window`) or a literal property name (`history` in `window.history`), never as a local binding.
+     */
+    const holderLookup = (holder) => {
+        const expression = holder.type === 'ChainExpression' ? holder['expression'] : holder;
+        if (expression.type === 'Identifier') {
+            return { node: holder, token: scope.resolve(expression) === 'local' ? null : expression['name'] };
+        }
+        if (expression.type !== 'MemberExpression')
+            return { node: holder, token: null };
+        const property = expression['property'];
+        const token = expression['computed'] === true ? writtenString(property) : property['name'];
+        return { node: holder, token: token ?? null };
+    };
+    /**
+     * The lookup of an object literal's property in a bulk mechanism: its key when written as a name or a string
+     * (`fetch: w`, `'fetch': w`, `['fetch']: w`, or a template with no substitutions, as `h['fetch']` is for a member).
+     * Any other key, a number included, has no token, and the holder argument is looked up.
+     */
+    const propertyLookup = (property, object) => {
+        const key = property['key'];
+        if (property['computed'] !== true && key.type === 'Identifier')
+            return { node: key, token: key['name'] };
+        const written = writtenString(key);
+        return written === undefined ? { node: object, token: null } : { node: key, token: written };
+    };
+    /**
+     * The lookup of a call's key argument (`defineProperty(h, 'fetch', d)`, `Reflect.set(h, 'fetch', v)`): the key when
+     * it is written at the site as a string or a template with no substitutions. Any other key has no token, and the
+     * holder argument `object` is looked up.
+     */
+    const keyLookup = (key, object) => {
+        const written = writtenString(key);
+        return written === undefined ? { node: object, token: null } : { node: key, token: written };
+    };
+    /**
+     * Whether `value` reads the slot being written: `h.m` of the same holder and member, or the bare global `m`. The same
+     * member of two windows is two slots, so the read must reach the member through the same window expression as the
+     * write (§3 Undecidable outcomes), with nothing in `evaluated`, the expressions the write evaluates, changing which
+     * window that is.
+     */
+    const readsSlot = (value, written, evaluated, depth = 0) => {
+        const read = value.type === 'ChainExpression' ? value['expression'] : value;
+        const slot = read.type === 'Identifier' || read.type === 'MemberExpression' ? apart(() => memberOf(read)) : undefined;
+        if (slot === undefined) {
+            // A field of objects the heap holds reads the slot when every value written to it does (§5 Resolver
+            // capabilities 5): `s.orig = window.fetch; window.fetch = s.orig` writes back.
+            if (read.type !== 'MemberExpression')
+                return false;
+            if (depth >= context.caps.heapDepth) {
+                context.capHit('heapDepth', read);
+                return false;
+            }
+            const sources = apart(() => context.resolution.fieldSources(read, at));
+            return (sources !== undefined &&
+                sources.every((source) => evaluatedAt(source.at, () => readsSlot(source.node, written, [...evaluated, source.node], depth + 1))));
+        }
+        return slot.holder === written.holder && slot.member === written.member && sameWindow(slot.leaves, written.leaves, evaluated);
+    };
+    /** Whether a value that reads the slot reads it through a heap field, not as `h.m` or the bare global (`readsSlot`). */
+    const throughHeap = (value) => {
+        const read = value.type === 'ChainExpression' ? value['expression'] : value;
+        return read.type === 'MemberExpression' && apart(() => memberOf(read)) === undefined;
+    };
+    /**
+     * What the syntax shows of the value a [[Set]] of `member` writes, for the one member whose outcome follows it
+     * (`opener`, §3): whether it is `null`. `value` is the expression written, `getter` when a getter gives the value, or
+     * `primitive` when the write computes a new primitive or writes a missing argument's `undefined`, neither ever
+     * `null`. A write-back of the slot may be `null` whatever the resolver finds, since the getter may return `null`.
+     */
+    const writtenValue = (member, value, site, same) => {
+        if (member !== 'opener')
+            return {};
+        if (value === 'primitive')
+            return { value: { isNull: false, site } };
+        if (value === 'getter' || same)
+            return { value: { isNull: 'unknown', site } };
+        const values = apart(() => context.resolution.evaluate(value, at));
+        const isNull = (each) => each.kind === 'constant' && each.value === null;
+        const known = values.length > 0 && values.every((each) => !opaque(each));
+        const decided = known && values.every(isNull) ? true : known && !values.some(isNull) ? false : 'unknown';
+        return { value: { isNull: decided, site } };
+    };
+    /** Whether `node` is plainly a primitive: every value it can have is a constant. */
+    const primitive = (node) => context.resolution.evaluate(node, at).every((value) => value.kind === 'constant');
+    /**
+     * The descriptors `node` gives, as far as the analyzer sees them (§3 Undecidable outcomes): for each object the heap
+     * holds that it can be (§5 Resolver capabilities 5), its parts, with every field that may be absent present and
+     * absent in turn, and the parts the analyzer can't see. Anything else is one descriptor with no field seen.
+     * Undefined when ECMA-262 ToPropertyDescriptor refuses every one with a TypeError, so nothing is written (Principle
+     * 1): a primitive, a literal with both accessor and data fields, or one whose `get` or `set` is a primitive other
+     * than `undefined`. `slot` is the slot defined, when its key folds. The folds the fields' keys and attributes come
+     * from go to `folds`.
+     */
+    const descriptorOf = (node, slot, evaluated, folds) => {
+        const { objects, primitive: mayBePrimitive, unseen } = context.resolution.descriptorValues(node, at);
+        if (objects.length === 0)
+            return unseen ? { descriptor: unseenDescriptor(node) } : undefined;
+        // Every value the descriptor can be is an alternative (Principle 3): each object the heap holds, a value the
+        // analyzer can't see, which is one unseen descriptor, and a primitive, which ToPropertyDescriptor refuses.
+        const several = objects.length > 1 || unseen || mayBePrimitive;
+        const alternatives = [];
+        const found = [];
+        for (const { node: object, parts } of objects) {
+            const shown = presentOrAbsent(parts, context.caps.descriptorAlternatives);
+            // Past the cap, the fields that may be absent are taken as parts the analyzer can't see (Principle 5).
+            if (shown === undefined && !cuts.includes(node))
+                cuts.push(node);
+            const each = shown ?? [parts.map((part) => (isMaybe(part) ? { kind: 'unseen', node: part.maybe } : part))];
+            const evidence = [
+                ...(several ? [object] : []),
+                ...(shown === undefined ? [] : parts.filter(isMaybe).map((part) => part.maybe)),
+            ];
+            for (const [alternative, split] of each.flatMap(byPrototype)) {
+                const descriptor = fromParts(alternative, slot, evaluated, found);
+                const all = split === undefined ? evidence : [...evidence, split];
+                alternatives.push(descriptor === undefined ? 'refused' : all.length === 0 ? descriptor : { ...descriptor, evidence: all });
+            }
+        }
+        if (unseen)
+            alternatives.push({ ...unseenDescriptor(node), evidence: [node] });
+        if (mayBePrimitive)
+            alternatives.push('refused');
+        const [descriptor] = alternatives.filter((each) => each !== 'refused');
+        if (descriptor === undefined)
+            return undefined;
+        folds.push(...mergedFolds([], found));
+        return alternatives.length === 1 ? { descriptor } : { descriptor, alternatives };
+    };
+    /**
+     * The parts of one descriptor per candidate of its `__proto__:` field, when the field has several candidates and every
+     * one is a catalog holder, each with the field as what makes it one (§3, §5 Candidate sets). Otherwise the parts
+     * as they are: a candidate set with any other value stays unseen.
+     */
+    const byPrototype = (parts) => {
+        const index = parts.findIndex((part) => part.kind === 'proto');
+        const proto = parts[index];
+        if (proto?.kind !== 'proto' || !proto.values.every((value) => value.kind === 'holder'))
+            return [[parts, undefined]];
+        const candidates = new Map();
+        for (const value of proto.values)
+            if (value.kind === 'holder' && !candidates.has(value.holder))
+                candidates.set(value.holder, value);
+        if (candidates.size < 2)
+            return [[parts.with(index, { ...proto, values: [...candidates.values()] }), undefined]];
+        return [...candidates.values()].map((value) => [parts.with(index, { ...proto, values: [value] }), proto.site]);
+    };
+    /** A descriptor as `parts` give it, or undefined when ToPropertyDescriptor refuses it (`descriptorOf`). */
+    const fromParts = (parts, slot, evaluated, folds) => {
+        let descriptor = unseenDescriptor();
+        // The fields whose attribute can't be decided, the folds of the fields read, and the accessor fields that are plainly
+        // not callable, since the last spread.
+        let undecided = new Map();
+        let found = [];
+        let uncallable = new Set();
+        // The fields the literal has. A later spread or key that doesn't fold may give a field another value, but never
+        // takes it away.
+        const has = new Set();
+        // The folds that show what a `__proto__` field's value is, which no later part undoes, and the fields that value
+        // supplies where the literal has none of its own.
+        const prototypeFolds = [];
+        let prototypeFields = { functions: new Set(), throwing: new Set() };
+        // The getter a field may have (ECMA-262 PropertyDefinitionEvaluation): the last `get` of it since its last value,
+        // or any `get` whose key doesn't fold. A setter after it joins it, and a setter alone leaves the field `undefined`.
+        const getters = new Map();
+        let anyGetter;
+        for (const part of parts) {
+            if (part.kind === 'unseen') {
+                // A spread, a key that doesn't fold, or an object's unseen base, may give any field, over the fields before it.
+                descriptor = unseenDescriptor(...descriptor.unseen, part.node);
+                undecided = new Map();
+                found = [];
+                uncallable = new Set();
+                if (part.node.type === 'Property' && part.node['kind'] === 'get')
+                    anyGetter = part.node;
+                continue;
+            }
+            // `__proto__: p` gives the literal a prototype, whose fields ToPropertyDescriptor reads where the literal has
+            // none of its own. `null`, or a primitive, which sets no prototype, gives none.
+            // A catalog holder is read through, against the unmutated catalog.
+            if (part.kind === 'proto') {
+                const proto = part.values;
+                const [only] = proto;
+                const inherited = proto.length === 1 && only?.kind === 'holder' ? context.descriptorFields(only.holder) : undefined;
+                if (proto.every((value) => value.kind === 'constant')) {
+                    prototypeFolds.push(...proto.flatMap((value) => (value.kind === 'constant' ? (value.folds ?? []) : [])));
+                }
+                else if (inherited !== undefined) {
+                    prototypeFields = inherited;
+                    prototypeFolds.push(...(only?.kind === 'holder' ? (only.folds ?? []) : []));
+                }
+                else
+                    descriptor.unseen.push(part.site);
+                continue;
+            }
+            const member = part.key;
+            // A symbol-keyed property is no field.
+            if (typeof member === 'symbol' || !descriptorFields.has(member))
+                continue;
+            has.add(member);
+            found.push(...part.folds);
+            undecided.delete(member);
+            const kind = part.accessor ?? 'init';
+            if (kind === 'get')
+                getters.set(member, part.site);
+            else if (kind === 'init')
+                getters.delete(member);
+            switch (member) {
+                case 'value': {
+                    // A getter gives the value whatever it returns, and a setter alone gives `undefined`: a new value either way.
+                    // A fresh object or function differs from every value a member holds already (§3 No-op or ineffective): every
+                    // value the field's writes can give is one.
+                    const init = kind === 'init' && part.sources.length > 0;
+                    const same = init &&
+                        slot !== undefined &&
+                        part.sources.every((source) => evaluatedAt(source.at, () => readsSlot(source.node, slot, evaluated)));
+                    descriptor.value = {
+                        same,
+                        fresh: init && part.values.length > 0 && part.values.every((each) => each.kind === 'object'),
+                        ...(init ? { sources: part.sources } : {}),
+                        // Read through a heap field, the value may be the native saved before an install (§3 Restores).
+                        ...(same && part.sources.some((source) => throughHeap(source.node)) ? { throughHeap: true } : {}),
+                    };
+                    break;
+                }
+                case 'get':
+                case 'set': {
+                    // An accessor field must be callable or `undefined`.
+                    const values = kind === 'init' ? part.values : [];
+                    const refused = values.length > 0 && values.every((each) => each.kind === 'constant' && each.value !== undefined);
+                    if (refused)
+                        uncallable.add(member);
+                    else
+                        uncallable.delete(member);
+                    break;
+                }
+                default: {
+                    const field = member;
+                    if (kind !== 'init') {
+                        // A getter gives the attribute whatever it returns. A setter with no getter gives it `undefined`, which
+                        // ToBoolean makes false.
+                        const getter = getters.get(member) ?? anyGetter;
+                        descriptor[field] = getter === undefined ? false : 'unknown';
+                        if (getter !== undefined)
+                            undecided.set(member, getter);
+                        break;
+                    }
+                    const values = part.values;
+                    const attribute = truthiness(values);
+                    descriptor[field] = attribute ?? 'unknown';
+                    if (attribute === undefined)
+                        undecided.set(member, part.site);
+                    else {
+                        found.push(...values.flatMap((each) => (each.kind === 'constant' || each.kind === 'holder' ? (each.folds ?? []) : [])));
+                    }
+                }
+            }
+        }
+        // A field the prototype supplies as a Web IDL attribute throws when read, unless the literal has its own (Principle
+        // 1). A spread or a key that doesn't fold may give it one, so the descriptor then stays unseen.
+        for (const field of prototypeFields.throwing) {
+            if (has.has(field))
+                continue;
+            if (descriptor.unseen.length === 0)
+                return undefined;
+            has.add(field);
+        }
+        // The fields the prototype supplies as a function, which is callable and truthy. A spread or a key that doesn't fold
+        // may give such a field another value, but the literal still has it.
+        for (const field of prototypeFields.functions) {
+            if (has.has(field))
+                continue;
+            has.add(field);
+            if (descriptor.unseen.length > 0)
+                continue;
+            if (field === 'value')
+                descriptor.value = { same: false, fresh: false };
+            else if (field === 'writable' || field === 'enumerable' || field === 'configurable')
+                descriptor[field] = true;
+        }
+        // A literal with an accessor field is an accessor descriptor, whatever a later part gives the field.
+        descriptor.get = has.has('get');
+        descriptor.set = has.has('set');
+        const data = has.has('value') || has.has('writable');
+        if (((descriptor.get || descriptor.set) && data) || uncallable.size > 0)
+            return undefined;
+        descriptor.undecided = [...undecided.values()].sort((a, b) => a.start - b.start);
+        folds.push(...prototypeFolds, ...found);
+        return descriptor;
+    };
+    switch (node.type) {
+        case 'AssignmentExpression': {
+            const left = node['left'];
+            const operator = node['operator'];
+            const target = memberOf(left, (object, { member }) => {
+                // A `__proto__` write has no member: on an unknown object it gives nothing (§5).
+                if (member === '__proto__')
+                    return;
+                const value = node['right'];
+                const keepsPresent = operator === '||=' || operator === '??=';
+                const change = { kind: 'set', member, same: false };
+                open.push({ site: node, holder: object, mechanism: 'assign', change, value, target: left, keepsPresent });
+            }, (object, key, reached) => {
+                const value = node['right'];
+                const keepsPresent = operator === '||=' || operator === '??=';
+                const sources = writeBackOperators.has(operator) ? { sources: [{ node: value, at }] } : {};
+                const change = { kind: 'set', member: unknownMember, same: false, ...sources };
+                const lookup = memberLookup(left, object);
+                wildWrite(node, reached, object, key, 'assign', change, lookup, { target: left, value, keepsPresent });
+            });
+            if (target === undefined)
+                return [];
+            const { holder, member, leaves, realmInstance, folds, parts, lookup } = target;
+            const value = node['right'];
+            // `h.__proto__ = p` calls `Object.prototype.__proto__`'s setter, which sets h's prototype (§3).
+            if (member === '__proto__') {
+                const change = prototypeChange(value, true, leaves, [node['left'], value]);
+                return [{ site: node, holder, leaves, realmInstance, mechanism: 'set-prototype', change, folds, parts, lookup }];
+            }
+            // `h.m += h.m` writes a new value, so only `=` and the logical assignments can write back what is there (§3).
+            const writesBack = writeBackOperators.has(node['operator']);
+            const same = writesBack && readsSlot(value, target, [node['left'], value]);
+            // Any other operator writes a new primitive, which is never `null`.
+            const written = writtenValue(member, writesBack ? value : 'primitive', value, same);
+            const heap = same && throughHeap(value) ? { throughHeap: true } : {};
+            const change = { kind: 'set', member, same, ...heap, ...written, ...(writesBack ? { sources: [{ node: value, at }] } : {}) };
+            return [{ site: node, holder, leaves, realmInstance, mechanism: 'assign', change, folds, parts, lookup }];
+        }
+        case 'UnaryExpression': {
+            if (node['operator'] !== 'delete')
+                return [];
+            let operand = node['argument'];
+            if (operand.type === 'ChainExpression')
+                operand = operand['expression'];
+            // Post-pass 4 (§5): an unqualified delete of a name bound on the global object deletes the global object's
+            // property. In strict code it is a SyntaxError, so the script never runs.
+            if (operand.type === 'Identifier' && scope.isStrict(node.start))
+                return [];
+            const target = memberOf(operand, (object, { member }) => {
+                open.push({ site: node, holder: object, mechanism: 'delete', change: { kind: 'delete', member }, target: operand });
+            }, (object, key, reached) => {
+                const change = { kind: 'delete', member: unknownMember };
+                wildWrite(node, reached, object, key, 'delete', change, memberLookup(operand, object), { target: operand });
+            });
+            if (target === undefined)
+                return [];
+            const { holder, member, leaves, realmInstance, folds, parts, lookup } = target;
+            const change = { kind: 'delete', member };
+            return [{ site: node, holder, leaves, realmInstance, mechanism: 'delete', change, folds, parts, lookup }];
+        }
+        case 'CallExpression': {
+            // A method read from an object can write, `h.m(…)`, `(0, h.m)(…)`, and so can a name that aliases a writer
+            // (`Ae = Object.defineProperty; Ae(h, k, d)`, §5 Resolver capabilities 2).
+            const callee = calleeExpression(node['callee']);
+            if (callee.type === 'Identifier') {
+                return apart(() => aliasedWriters(callee)).flatMap((writer) => callWrites(node, writer));
+            }
+            if (callee.type !== 'MemberExpression' || callee['object'].type === 'Super')
+                return [];
+            const method = apart(() => memberKey(callee));
+            if (method === undefined || typeof method.member !== 'string')
+                return [];
+            const named = { expression: callee, member: method.member, folds: method.folds };
+            if (!Object.hasOwn(accessorDefiners, named.member))
+                return callWrites(node, named);
+            // `(0, h.__defineGetter__)(…)` calls it with no `this`, which ToObject refuses (Principle 1).
+            return callee === node['callee'] ? definerWrites(node, named) : [];
+        }
+        case 'VariableDeclaration':
+        case 'FunctionDeclaration':
+        case 'ClassDeclaration':
+            return declarationWrites(node);
+        default:
+            return [];
+    }
+    /**
+     * The global object's members a declaration writes (§3 Declarations in classic scripts), with mechanism `declare`:
+     * one per name it binds, as the change a [[Set]] of the name's value makes. Whether that is a mutation, and how, is
+     * for the declaration's form and the catalog to decide (`effect.ts`). A binding's value is its initializer, a
+     * function or class, `undefined` when it has none, or a value the analyzer doesn't take apart (a loop's, or a pattern
+     * element's), except that `{ m } = h` reads `h.m`.
+     */
+    function declarationWrites(declaration) {
+        const declared = scope.declared(declaration);
+        if (declared === undefined)
+            return [];
+        const bound = [];
+        if (declaration.type !== 'VariableDeclaration') {
+            bound.push({ id: declaration['id'], value: 'function' });
+        }
+        else {
+            for (const declarator of declaration['declarations']) {
+                const id = declarator['id'];
+                const init = declarator['init'];
+                if (id.type === 'Identifier') {
+                    bound.push({ id, value: declared.loop === true ? 'unknown' : (init ?? 'undefined') });
+                    continue;
+                }
+                for (const name of patternIdentifiers(id)) {
+                    const key = init === null || declared.loop === true ? undefined : readKey(id, name);
+                    bound.push({ id: name, value: key === undefined ? 'unknown' : { holder: init, key } });
+                }
+            }
+        }
+        return bound.map(({ id, value }) => {
+            const name = id['name'];
+            const leaf = {
+                form: 'global-property',
+                node: id,
+                name,
+                binding: { withs: [], evals: [], declaration: { kind: declared.kind, node: declaration } },
+                instance: context.instance,
+            };
+            const slot = { holder: global, member: name, realmInstance: context.instance, leaves: [leaf], folds: [] };
+            let same = false;
+            let written;
+            let sources = [];
+            let heap = {};
+            if (typeof value === 'string') {
+                // A function, a class or `undefined` is never `null`; a value not taken apart may be.
+                const site = value === 'function' ? declaration : id;
+                written = value === 'unknown' ? writtenValue(name, id, id, true) : writtenValue(name, 'primitive', site, false);
+                if (value === 'function')
+                    sources = [{ node: declaration, at }];
+            }
+            else if ('type' in value) {
+                same = readsSlot(value, slot, [value]);
+                if (same && throughHeap(value))
+                    heap = { throughHeap: true };
+                written = writtenValue(name, value, value, same);
+                sources = [{ node: value, at }];
+            }
+            else {
+                const reached = apart(() => holderOf(value.holder));
+                same = reached !== undefined && reached.holder === global && value.key === name && sameWindow(reached.leaves, [leaf], [value.holder]);
+                written = writtenValue(name, id, id, true);
+            }
+            const bare = declared.kind === 'var' && value === 'undefined';
+            const change = { kind: 'set', member: name, same, ...heap, ...written, ...(sources.length > 0 ? { sources } : {}) };
+            return {
+                site: id,
+                holder: global,
+                leaves: [leaf],
+                realmInstance: context.instance,
+                mechanism: 'declare',
+                change,
+                folds: [],
+                parts: { holder: [], member: [] },
+                lookup: { node: id, token: name },
+                declaration: bare ? { ...declared, bare } : declared,
+            };
+        });
+    }
+    /**
+     * The key a name bound by a pattern reads from the value destructured, when the pattern is an object pattern whose
+     * property binds the name directly, with no default: `m` in `{ m }` or `{ m: x }`, and `"m"` in `{ "m": x }` or
+     * `{ ["m"]: x }`.
+     */
+    function readKey(pattern, id) {
+        if (pattern.type !== 'ObjectPattern')
+            return undefined;
+        const property = pattern['properties'].find((each) => each['value'] === id);
+        if (property === undefined)
+            return undefined;
+        const key = property['key'];
+        if (key.type === 'Identifier' && property['computed'] !== true)
+            return key['name'];
+        const literal = literalKey(key);
+        return typeof literal === 'string' ? literal : undefined;
+    }
+    /**
+     * The write `h.__defineGetter__(k, g)` or `h.__defineSetter__(k, s)` makes (ECMA-262 B.2.2.2, B.2.2.3): a define of
+     * an enumerable, configurable accessor on h, its `this` (§3), through the method h inherits from `Object.prototype`.
+     * A bare call, or one through a comma sequence, has no `this`, so ToObject throws, and is never one.
+     */
+    function definerWrites(call, method) {
+        const via = method.member;
+        const object = method.expression['object'];
+        let unresolved = false;
+        const reached = holderOf(object, () => (unresolved = true));
+        const [name, accessor] = call['arguments'];
+        if (unresolved && name !== undefined && name.type !== 'SpreadElement' && accessor !== undefined) {
+            const key = accessor.type === 'SpreadElement' || primitive(accessor) ? undefined : constantKey(name);
+            if (key !== undefined && key.member !== '__proto__') {
+                const field = accessorDefiners[via];
+                const descriptor = { ...unseenDescriptor(), get: field === 'get', set: field === 'set', enumerable: true, configurable: true };
+                open.push({ site: call, holder: object, mechanism: 'define-property', change: { kind: 'define', member: key.member, descriptor } });
+            }
+        }
+        if (reached === undefined || name === undefined || accessor === undefined)
+            return [];
+        if (name.type === 'SpreadElement' || accessor.type === 'SpreadElement')
+            return [];
+        // The accessor must be callable: a primitive is a TypeError.
+        if (primitive(accessor))
+            return [];
+        const key = constantKey(name);
+        if (key === undefined) {
+            // A key the analyzer knows nothing of may be a wildcard define (§5 Partially resolved writes).
+            if (unknownKey(name)) {
+                const field = accessorDefiners[via];
+                const descriptor = { ...unseenDescriptor(), get: field === 'get', set: field === 'set', enumerable: true, configurable: true };
+                const change = { kind: 'define', member: unknownMember, descriptor, via };
+                wildWrite(call, reached, object, name, 'define-property', change, keyLookup(name, object), { writer: via, folds: method.folds });
+            }
+            return [];
+        }
+        const { holder, leaves } = reached;
+        const field = accessorDefiners[via];
+        const descriptor = {
+            ...unseenDescriptor(),
+            get: field === 'get',
+            set: field === 'set',
+            enumerable: true,
+            configurable: true,
+        };
+        const change = { kind: 'define', member: key.member, descriptor, via };
+        const folds = [...reached.folds, ...method.folds, ...key.folds];
+        const lookup = keyLookup(name, object);
+        const realmInstance = instanceOf(leaves);
+        const parts = { holder: reached.folds, member: key.folds };
+        return [{ site: call, holder, leaves, realmInstance, mechanism: 'define-property', writer: via, change, folds, parts, lookup }];
+    }
+    /**
+     * A change to the prototype `value` gives of the holder reached from `leaves`: unknown when a getter gives it.
+     * `evaluated` is what the write evaluates, which could change the window a window expression reaches.
+     */
+    function prototypeChange(value, setter, leaves, evaluated) {
+        const proto = value === undefined ? [{ kind: 'unknown' }] : apart(() => context.resolution.evaluate(value, at));
+        const [only] = proto;
+        const same = proto.length === 1 && only?.kind === 'holder' && sameWindow(only.leaves, leaves, evaluated);
+        return { kind: 'prototype', proto, setter, sameWindow: same };
+    }
+    /** The writes a call to one of the native writer functions makes. */
+    function callWrites(call, method) {
+        const callee = 'expression' in method ? apart(() => nativeFunction(method)) : method;
+        if (callee === undefined || !Object.hasOwn(nativeWriters, callee.name))
+            return [];
+        const mechanism = nativeWriters[callee.name];
+        const args = call['arguments'];
+        const [object, second, third] = args;
+        if (object === undefined || object.type === 'SpreadElement')
+            return [];
+        let unresolved = false;
+        // `Reflect.set(t, k, v, r)` writes r: several holders t may be are no candidate set of what is written.
+        const lookupOnly = callee.name === 'Reflect.set' && args.length > 3;
+        const reached = holderOf(object, () => (unresolved = true), lookupOnly);
+        if (callee.name === 'Reflect.set') {
+            openReflectSet(call, mechanism, unresolved);
+            return reflectSetWrites(call, callee, reached);
+        }
+        if (unresolved)
+            openCallWrites(call, mechanism, callee.name, object);
+        if (reached === undefined)
+            return [];
+        const { holder } = reached;
+        const leaves = inDocumentOrder([...reached.leaves, ...callee.leaves]);
+        // The native writer function may be another window's: the holder written decides the realm instance.
+        const realmInstance = instanceOf(reached.leaves);
+        const slot = ({ member, folds }) => ({
+            holder,
+            member,
+            realmInstance,
+            leaves: reached.leaves,
+            folds: [...reached.folds, ...folds],
+        });
+        const write = (site, change, folds, lookup, member, as = mechanism) => ({
+            site,
+            holder,
+            leaves,
+            realmInstance,
+            mechanism: as,
+            writer: callee.name,
+            change,
+            folds: [...callee.folds, ...reached.folds, ...folds],
+            parts: { holder: reached.folds, member },
+            lookup,
+        });
+        switch (callee.name) {
+            case 'Object.defineProperty':
+            case 'Reflect.defineProperty': {
+                if ([second, third].some((arg) => arg === undefined || arg.type === 'SpreadElement'))
+                    return [];
+                const key = constantKey(second);
+                if (key === undefined) {
+                    if (unknownKey(second)) {
+                        const described = descriptorOf(third, undefined, args, []);
+                        const change = described && { kind: 'define', member: unknownMember, ...described };
+                        if (change !== undefined) {
+                            const extra = { writer: callee.name, leaves, folds: callee.folds };
+                            wildWrite(call, reached, object, second, mechanism, change, keyLookup(second, object), extra);
+                        }
+                    }
+                    return [];
+                }
+                const folds = [...key.folds];
+                const lookup = keyLookup(second, object);
+                const described = descriptorOf(third, slot(key), args, folds);
+                if (described === undefined)
+                    return [];
+                const source = { node: third, at };
+                return [write(call, { kind: 'define', member: key.member, ...described, source }, folds, lookup, key.folds)];
+            }
+            case 'Object.defineProperties': {
+                if (second?.type !== 'ObjectExpression')
+                    return [];
+                // ObjectDefineProperties converts every descriptor before it defines any, so one that ToPropertyDescriptor
+                // refuses, whatever its key, throws before anything is written (Principle 1).
+                const writes = [];
+                const wildDefines = [];
+                for (const property of second['properties']) {
+                    if (property.type !== 'Property')
+                        continue;
+                    const key = propertyKey(property);
+                    if (key !== undefined && typeof key.member === 'string' && setsLiteralPrototype(property, key.member))
+                        continue;
+                    const folds = [...(key?.folds ?? [])];
+                    // A getter in the literal gives a descriptor the syntax doesn't show.
+                    const described = property['kind'] === 'init'
+                        ? descriptorOf(property['value'], key && slot(key), args, folds)
+                        : { descriptor: unseenDescriptor(property) };
+                    if (described === undefined)
+                        return [];
+                    if (key === undefined) {
+                        // A computed key the analyzer knows nothing of may be a wildcard define (§5 Partially resolved writes).
+                        const computed = property['key'];
+                        if (property['computed'] === true && unknownKey(computed))
+                            wildDefines.push({ property, computed, described });
+                        continue;
+                    }
+                    const lookup = propertyLookup(property, object);
+                    const source = property['kind'] === 'init' ? { source: { node: property['value'], at } } : {};
+                    writes.push(write(property, { kind: 'define', member: key.member, ...described, ...source }, folds, lookup, key.folds));
+                }
+                for (const { property, computed, described } of wildDefines) {
+                    const change = { kind: 'define', member: unknownMember, ...described };
+                    const extra = { writer: callee.name, leaves, folds: callee.folds };
+                    wildWrite(property, reached, object, computed, mechanism, change, propertyLookup(property, object), extra);
+                }
+                return writes;
+            }
+            case 'Object.assign': {
+                // Each source's own enumerable properties are [[Set]] on the target in turn. A source that isn't an object
+                // literal has keys the syntax doesn't show.
+                const literals = args.slice(1).filter((source) => source.type === 'ObjectExpression');
+                // A computed key the analyzer knows nothing of may be a wildcard assign (§5 Partially resolved writes).
+                for (const source of literals) {
+                    for (const property of source['properties']) {
+                        if (property.type !== 'Property' || property['computed'] !== true)
+                            continue;
+                        const computed = property['key'];
+                        if (constantKey(computed) !== undefined || !unknownKey(computed))
+                            continue;
+                        const value = property['kind'] === 'init' ? property['value'] : undefined;
+                        const written = value === undefined ? {} : { sources: [{ node: value, at }] };
+                        const change = { kind: 'set', member: unknownMember, same: false, ...written };
+                        const extra = { writer: callee.name, leaves, folds: callee.folds, ...(value === undefined ? {} : { value }) };
+                        wildWrite(property, reached, object, computed, mechanism, change, propertyLookup(property, object), extra);
+                    }
+                }
+                return literals
+                    .flatMap((source) => properties(source).map(({ property, key }) => {
+                    // A getter in the literal gives whatever it returns.
+                    const value = property['kind'] === 'init' ? property['value'] : undefined;
+                    // An own `__proto__` key (computed, shorthand or a method) is [[Set]] through the target's setter. Such a
+                    // write has no member, so it looks up its holder.
+                    if (key.member === '__proto__') {
+                        const change = prototypeChange(value, true, reached.leaves, args);
+                        return write(property, change, key.folds, holderLookup(object), [], 'set-prototype');
+                    }
+                    const lookup = propertyLookup(property, object);
+                    const same = value !== undefined && readsSlot(value, slot(key), args);
+                    const written = writtenValue(key.member, value ?? 'getter', value ?? property, same);
+                    const sources = value === undefined ? {} : { sources: [{ node: value, at }] };
+                    const heap = same && throughHeap(value) ? { throughHeap: true } : {};
+                    return write(property, { kind: 'set', member: key.member, same, ...heap, ...written, ...sources }, key.folds, lookup, key.folds);
+                }));
+            }
+            case 'Reflect.deleteProperty': {
+                // `delete h[k]` (§3): a missing key would be `"undefined"`, which no holder has as a configurable member.
+                if (second === undefined || second.type === 'SpreadElement')
+                    return [];
+                const key = constantKey(second);
+                if (key === undefined) {
+                    if (unknownKey(second)) {
+                        const extra = { writer: callee.name, leaves, folds: callee.folds };
+                        const change = { kind: 'delete', member: unknownMember };
+                        wildWrite(call, reached, object, second, mechanism, change, keyLookup(second, object), extra);
+                    }
+                    return [];
+                }
+                return [write(call, { kind: 'delete', member: key.member }, key.folds, keyLookup(second, object), key.folds)];
+            }
+            default:
+                // Object.setPrototypeOf and Reflect.setPrototypeOf.
+                if (second === undefined || second.type === 'SpreadElement')
+                    return [];
+                return [write(call, prototypeChange(second, false, reached.leaves, args), [], holderLookup(object), [])];
+        }
+    }
+    /**
+     * The write sites of a call to a native writer function whose holder argument `object` may be an object the analyzer
+     * can't resolve (§5 Partially resolved writes): a define or delete of a key that folds, and each property of a bulk
+     * mechanism's object literal whose key folds. A prototype change has no member, so it has none.
+     */
+    function openCallWrites(call, mechanism, name, object) {
+        const args = call['arguments'];
+        const [, second, third] = args;
+        const push = (site, change, value) => {
+            if (change.member === '__proto__')
+                return;
+            open.push({ site, holder: object, mechanism, change, ...(value === undefined ? {} : { value }) });
+        };
+        switch (name) {
+            case 'Object.defineProperty':
+            case 'Reflect.defineProperty': {
+                if ([second, third].some((arg) => arg === undefined || arg.type === 'SpreadElement'))
+                    return;
+                const key = constantKey(second);
+                const described = key && descriptorOf(third, undefined, args, []);
+                if (key !== undefined && described !== undefined)
+                    push(call, { kind: 'define', member: key.member, ...described });
+                return;
+            }
+            case 'Object.defineProperties':
+                if (second?.type !== 'ObjectExpression')
+                    return;
+                for (const { property, key } of properties(second)) {
+                    const described = property['kind'] === 'init' ? descriptorOf(property['value'], undefined, args, []) : { descriptor: unseenDescriptor(property) };
+                    if (described !== undefined)
+                        push(property, { kind: 'define', member: key.member, ...described });
+                }
+                return;
+            case 'Object.assign':
+                for (const source of args.slice(1)) {
+                    if (source.type !== 'ObjectExpression')
+                        continue;
+                    for (const { property, key } of properties(source)) {
+                        const value = property['kind'] === 'init' ? property['value'] : undefined;
+                        push(property, { kind: 'set', member: key.member, same: false }, value);
+                    }
+                }
+                return;
+            case 'Reflect.deleteProperty': {
+                if (second === undefined || second.type === 'SpreadElement')
+                    return;
+                const key = constantKey(second);
+                if (key !== undefined)
+                    push(call, { kind: 'delete', member: key.member });
+                return;
+            }
+            default:
+        }
+    }
+    /**
+     * The write site of `Reflect.set(t, k, v, r)`, an assign (§3), when its receiver (r, or t when not given) may be an
+     * object the analyzer can't resolve and k folds (§5 Partially resolved writes). `tUnresolved` says t may be. A
+     * `__proto__` key has no member.
+     */
+    function openReflectSet(call, mechanism, tUnresolved) {
+        const args = call['arguments'];
+        const [object, second, third, fourth] = args;
+        if (object === undefined || second === undefined || args.slice(1).some((arg) => arg.type === 'SpreadElement'))
+            return;
+        const receiver = fourth ?? object;
+        const unresolved = fourth === undefined ? tUnresolved : context.resolution.evaluate(fourth, at).some(opaque);
+        if (!unresolved)
+            return;
+        const key = constantKey(second);
+        if (key === undefined || key.member === '__proto__')
+            return;
+        const change = { kind: 'set', member: key.member, same: false };
+        open.push({ site: call, holder: receiver, mechanism, change, ...(third === undefined ? {} : { value: third }) });
+    }
+    /**
+     * The write `Reflect.set(t, k, v, r)` makes (§3): a [[Set]] that looks k up on t's chain and writes its receiver r, t
+     * when not given (ECMA-262 OrdinarySet). A receiver that is t's holder is `r[k] = v`. Another native holder is written
+     * as [[Set]] decides from what t's chain gives and r's own property, or, when t denotes no native holder, as if t's
+     * chain lacked k. A receiver that doesn't resolve, as a spread may give, gives nothing.
+     */
+    function reflectSetWrites(call, callee, reached) {
+        const args = call['arguments'];
+        const [object, second, third, fourth] = args;
+        if (second === undefined || args.slice(1).some((arg) => arg.type === 'SpreadElement'))
+            return [];
+        const key = constantKey(second);
+        const receiver = fourth === undefined ? reached : holderOf(fourth);
+        // `Reflect.set(h, k, v)` with a key the analyzer knows nothing of is `h[k] = v` (§3).
+        if (key === undefined && fourth === undefined && reached !== undefined && unknownKey(second)) {
+            const sources = third === undefined || third.type === 'SpreadElement' ? {} : { sources: [{ node: third, at }] };
+            const change = { kind: 'set', member: unknownMember, same: false, ...sources };
+            const extra = { writer: callee.name, leaves: inDocumentOrder([...reached.leaves, ...callee.leaves]), folds: callee.folds };
+            wildWrite(call, reached, object, second, 'assign', change, keyLookup(second, object), {
+                ...extra,
+                ...(third === undefined ? {} : { value: third }),
+            });
+        }
+        if (key === undefined || receiver === undefined)
+            return [];
+        // What k is looked up on, when it isn't the holder written. A t that denotes no native holder may be any object,
+        // unless it is plainly no object, which throws before any write (Principle 1). One that may be several native
+        // holders is a candidate set (§5). Neither of those is written.
+        let through;
+        // A t known to be an ordinary object whose chain reaches `Object.prototype` gives the `__proto__` setter there
+        // (§3): its chain, from the prototype its literal has, decides the write.
+        const ordinary = reached === undefined && key.member === '__proto__' ? ordinaryPrototype(object) : undefined;
+        if (ordinary !== undefined)
+            through = { holder: ordinary };
+        else if (reached === undefined) {
+            const values = context.resolution.evaluate(object, at);
+            if (values.every((value) => value.kind === 'constant') || values.some((value) => value.kind === 'holder'))
+                return [];
+            through = { unresolved: object };
+        }
+        else if (reached.holder !== receiver.holder)
+            through = { holder: reached.holder };
+        const own = receiver === reached;
+        const realmInstance = instanceOf(receiver.leaves);
+        const written = { holder: receiver.holder, member: key.member, realmInstance, leaves: receiver.leaves, folds: [] };
+        const write = (change, as, lookup) => ({
+            site: call,
+            holder: receiver.holder,
+            leaves: inDocumentOrder([...(reached?.leaves ?? []), ...callee.leaves, ...(own ? [] : receiver.leaves)]),
+            realmInstance,
+            mechanism: as,
+            writer: callee.name,
+            change,
+            folds: [...callee.folds, ...(reached?.folds ?? []), ...key.folds, ...(own ? [] : receiver.folds)],
+            parts: { holder: receiver.folds, member: as === 'set-prototype' ? [] : key.folds },
+            lookup,
+        });
+        // The object written: r, or t when not given.
+        const target = fourth ?? object;
+        // `r.__proto__ = p` calls the setter t's chain gives, `Object.prototype.__proto__`'s, which ignores a missing
+        // (undefined) value. Such a write has no member, so it looks up the object written.
+        if (key.member === '__proto__' && (through === undefined || 'holder' in through)) {
+            if (third === undefined)
+                return [];
+            const change = { ...prototypeChange(third, true, receiver.leaves, args), through: through?.holder };
+            return [write(change, 'set-prototype', holderLookup(target))];
+        }
+        // A missing value sets `undefined`, a new value.
+        const same = third !== undefined && readsSlot(third, written, args);
+        const value = writtenValue(key.member, third ?? 'primitive', third ?? call, same);
+        const sources = third === undefined || third.type === 'SpreadElement' ? {} : { sources: [{ node: third, at }] };
+        return [write({ kind: 'set', member: key.member, same, through, ...value, ...sources }, 'assign', keyLookup(second, target))];
+    }
+    /**
+     * The prototype holder of an object that `node` is known to create with no own `__proto__`: an object literal with
+     * no own `__proto__`, and no spread or key that doesn't fold, which could give it one (`Object.prototype`, or the
+     * native holder its `__proto__:` field gives); an array literal (`Array.prototype`); or a function literal
+     * (`Function.prototype`).
+     */
+    function ordinaryPrototype(node) {
+        switch (node.type) {
+            case 'ArrayExpression':
+                return 'Array.prototype';
+            case 'FunctionExpression':
+            case 'ArrowFunctionExpression':
+                return 'Function.prototype';
+            case 'ObjectExpression': {
+                let prototype = 'Object.prototype';
+                for (const property of node['properties']) {
+                    if (property.type !== 'Property')
+                        return undefined;
+                    const key = propertyKey(property);
+                    if (key === undefined)
+                        return undefined;
+                    if (key.member !== '__proto__')
+                        continue;
+                    if (!setsLiteralPrototype(property, key.member))
+                        return undefined;
+                    // `__proto__: p` gives the literal p as its prototype: a native holder, or `null`, where the chain ends. Any
+                    // other primitive sets none.
+                    const values = context.resolution.evaluate(property['value'], at);
+                    const [only] = values;
+                    if (values.length !== 1 || only === undefined)
+                        return undefined;
+                    if (only.kind === 'holder')
+                        prototype = only.holder;
+                    else if (only.kind !== 'constant' || only.value === null)
+                        return undefined;
+                }
+                return prototype;
+            }
+            default:
+                return undefined;
+        }
+    }
+    /**
+     * An object literal's own properties with keys that fold to constants, in source order. Spread properties are left
+     * out, and so is `__proto__: p`, which gives the literal a prototype rather than an own property.
+     */
+    function properties(literal) {
+        return literal['properties'].flatMap((property) => {
+            if (property.type !== 'Property')
+                return [];
+            const key = propertyKey(property);
+            if (key === undefined || (typeof key.member === 'string' && setsLiteralPrototype(property, key.member)))
+                return [];
+            return [{ property, key }];
+        });
+    }
+    /** The native writer functions a name aliases: each alternative that is one counts (Principle 3). */
+    function aliasedWriters(id) {
+        return context.resolution.aliasCallee(id, at).flatMap((value) => value.kind === 'native' && Object.hasOwn(nativeWriters, value.name)
+            ? [{ name: value.name, leaves: inDocumentOrder(value.leaves), folds: value.folds ?? [] }]
+            : []);
+    }
+    /**
+     * The native function a called method denotes, by catalog name (`Object.defineProperty`), with its holder's leaves,
+     * and the folds its holder and key come from.
+     */
+    function nativeFunction({ expression, member, folds }) {
+        // Most calls are to other functions: only a writer's name is worth resolving the holder for.
+        if (!writerMembers.has(member))
+            return undefined;
+        const reached = holderOf(expression['object']);
+        return reached && { name: `${reached.holder}.${member}`, leaves: reached.leaves, folds: [...reached.folds, ...folds] };
+    }
+}
+/** The fields ECMA-262 ToPropertyDescriptor reads. */
+export const descriptorFields = new Set(['value', 'get', 'set', 'writable', 'enumerable', 'configurable']);
+/** A descriptor with no field the syntax shows, and `unseen` the parts that may give it any. */
+function unseenDescriptor(...unseen) {
+    return { get: false, set: false, unseen, undecided: [] };
+}
+/**
+ * The name a key is written as at the site when it is a string key: a string literal, or a template literal with no
+ * substitutions, by its cooked value (§10 Token check). A number, a template with substitutions, or any other
+ * expression is no token.
+ */
+function writtenString(key) {
+    if (key.type === 'Literal')
+        return typeof key['value'] === 'string' ? key['value'] : undefined;
+    if (key.type !== 'TemplateLiteral' || key['expressions'].length > 0)
+        return undefined;
+    const cooked = key['quasis'][0]?.['value']?.cooked;
+    return typeof cooked === 'string' ? cooked : undefined;
+}
+/**
+ * The assignment operators whose value is the right side as read: `=`, and the logical assignments, which write it only
+ * when they write at all. The others (`+=`, `|=`, `**=`) write a new value computed from both sides.
+ */
+const writeBackOperators = new Set(['=', '||=', '&&=', '??=']);
+/** The identifiers a binding pattern binds, as `boundNames` names them. */
+function patternIdentifiers(pattern) {
+    const found = [];
+    walkTree(pattern, {
+        enter(node, parent) {
+            // A default value, or a computed key, is an expression, whose identifiers are read, not bound.
+            if (parent?.type === 'AssignmentPattern' && parent['right'] === node)
+                return false;
+            if (parent?.type === 'Property' && parent['key'] === node)
+                return false;
+            if (node.type === 'Identifier')
+                found.push(node);
+            return undefined;
+        },
+    });
+    const names = new Set(boundNames(pattern));
+    return found.filter((id) => names.has(id['name']));
+}
+/** A bare name bound on the global object: the global object's property of that name (§5), in the window `instance`. */
+function bareGlobal(id, scope, instance) {
+    const binding = scope.resolve(id);
+    if (binding === 'local')
+        return undefined;
+    return { form: 'global-property', node: id, name: id['name'], binding, instance };
+}
+const isMaybe = (part) => part.kind === 'field' && part.maybe !== undefined;
+/**
+ * Every way an object's fields that may be absent can be present or absent, as the parts each gives, or undefined
+ * past the descriptor-alternatives cap, `maxDescriptorAlternatives`. Only the last present write of a field decides it,
+ * so each field is absent, or has exactly one of its maybe-absent writes: the product of one more than each field's
+ * writes.
+ */
+function presentOrAbsent(parts, maxDescriptorAlternatives) {
+    const byKey = new Map();
+    for (const part of parts) {
+        if (!isMaybe(part))
+            continue;
+        const same = byKey.get(part.key);
+        if (same === undefined)
+            byKey.set(part.key, [part]);
+        else
+            same.push(part);
+    }
+    let count = 1;
+    for (const writes of byKey.values())
+        count *= writes.length + 1;
+    if (count > maxDescriptorAlternatives)
+        return undefined;
+    let chosen = [new Set()];
+    for (const writes of byKey.values()) {
+        chosen = chosen.flatMap((set) => [set, ...writes.map((write) => new Set([...set, write]))]);
+    }
+    return chosen.map((set) => parts.filter((part) => !isMaybe(part) || set.has(part)));
+}