monkeypatchlist 0.0.0-stage → 0.1.0

package/dist/packages/analysis/lib/binding.d.ts

@@ -0,0 +1,36 @@
+import { type ArrowFunctionExpression, type CatchClause, type Class, type Function as FunctionNode, type IdentifierReference, type ImportDeclaration, type Program, type VariableDeclaration } from 'oxc-parser';
+/** A program as `oxc-parser` returns it, parsed with the options §5 fixes. */
+export type OxcProgram = Program;
+/** An identifier in a reference position: `fetch` in `fetch = w`, `window` in `window.fetch = w`. */
+export type IdentifierNode = IdentifierReference;
+/**
+ * The node that declares a name:
+ * - a `var`, `let`, `const` or `using` declaration: its `VariableDeclaration`, whose `kind` says which
+ * - a function's name: its `FunctionDeclaration` (declared in the enclosing scope) or `FunctionExpression` (declared in
+ *   a `function-expression-name` scope)
+ * - a parameter, or a function's implicit `arguments`: the function, declared in its `function` scope
+ * - a class's name: its class
+ * - a catch parameter: its `CatchClause`
+ * - an import binding: its `ImportDeclaration`
+ */
+export type DeclarationNode = VariableDeclaration | FunctionNode | ArrowFunctionExpression | Class | CatchClause | ImportDeclaration;
+/** The kind of scope a name is declared in, as ES2015+ scoping gives it. */
+export declare const scopeKinds: readonly ["global", "module", "function", "function-expression-name", "block", "switch", "for", "catch", "with", "class", "class-field-initializer", "class-static-block"];
+export type ScopeKind = (typeof scopeKinds)[number];
+/** What a reference resolves to: a declaration and the kind of scope it is in, or no declaration at all. */
+export type Resolution = {
+    declaration: DeclarationNode;
+    scopeKind: ScopeKind;
+} | 'unresolved';
+/**
+ * The binding-resolution seam (§19). `resolve` scopes one program with its `sourceType`, and `reference` answers for
+ * any identifier reference in it. It knows nothing of monkeypatchlist's rules: a classic script's global `var` is simply a
+ * declaration in the `global` scope, and a block-level function is block-scoped (no Annex B).
+ */
+export interface BindingResolver {
+    resolve(program: OxcProgram, sourceType: 'script' | 'module'): {
+        reference(id: IdentifierNode): Resolution;
+    };
+}
+/** `eslint-scope`, the implementation §5 names: `optimistic: true`, and `ecmaVersion` ≥ 2015 for block scoping. */
+export declare const eslintScopeBindings: BindingResolver;

package/dist/packages/analysis/lib/binding.js

@@ -0,0 +1,66 @@
+// The binding-resolution seam (§19): it sits inside the JS resolver, between parsing and monkeypatchlist's own scope rules.
+// An implementation answers one question, what an identifier reference resolves to, under standard ES2015+ scoping.
+// monkeypatchlist's four post-passes (§5) run above it, so swapping implementations never touches them.
+import { analyze } from 'eslint-scope';
+import { visitorKeys, } from 'oxc-parser';
+/** The kind of scope a name is declared in, as ES2015+ scoping gives it. */
+export const scopeKinds = [
+    'global',
+    'module',
+    'function',
+    'function-expression-name',
+    'block',
+    'switch',
+    'for',
+    'catch',
+    'with',
+    'class',
+    'class-field-initializer',
+    'class-static-block',
+];
+/** `eslint-scope`, the implementation §5 names: `optimistic: true`, and `ecmaVersion` ≥ 2015 for block scoping. */
+export const eslintScopeBindings = {
+    resolve(program, sourceType) {
+        const manager = analyze(program, {
+            ecmaVersion: 2025,
+            sourceType,
+            optimistic: true,
+            childVisitorKeys: visitorKeys,
+            fallback: 'iteration',
+        });
+        const references = new Map();
+        for (const scope of manager.scopes) {
+            for (const reference of scope.references)
+                references.set(reference.identifier, reference);
+        }
+        return {
+            reference(id) {
+                const reference = references.get(id);
+                if (reference === undefined)
+                    throw new Error(`eslint-scope recorded no reference for \`${id.name}\` at ${id.start}`);
+                const variable = reference.resolved;
+                if (variable === null)
+                    return 'unresolved';
+                return { declaration: declarationOf(variable), scopeKind: variable.scope.type };
+            },
+        };
+    },
+};
+/** The node that declares a variable: its first definition's, or for `arguments`, the function's. */
+function declarationOf(variable) {
+    const [definition] = variable.defs;
+    if (definition === undefined)
+        return variable.scope.block;
+    switch (definition.type) {
+        case 'Variable':
+        case 'ImportBinding':
+            return definition.parent;
+        case 'FunctionName':
+        case 'ClassName':
+        case 'Parameter':
+        case 'CatchClause':
+            return definition.node;
+        case 'ImplicitGlobalVariable':
+            throw new Error(`eslint-scope resolved \`${variable.name}\` to an implicit global`);
+    }
+}

package/dist/packages/analysis/lib/budget.d.ts

@@ -0,0 +1,80 @@
+/** The caps (§18 Context policy), each a count. A cap hit is counted in the scan statistics, whatever it cuts. */
+export interface Caps {
+    /**
+     * The `alternatives` cap: more alternatives than this in one value collapse into unknown, all but its native holders.
+     * Chains of the global object's names have a handful.
+     */
+    alternatives: number;
+    /**
+     * The `fold-length` cap: a string fold longer than this, in UTF-16 code units, is unknown. No member is named by
+     * anything near it, and it keeps doubling folds (`const b = a + a, c = b + b, …`) from exhausting memory.
+     */
+    foldLength: number;
+    /**
+     * How many frames a chain holds before the next call widens: deep enough for helper chains 2–4 deep (§5), and for
+     * the chains of calls carrying no native that core-js's install helpers make.
+     */
+    depth: number;
+    /**
+     * How many frames of one function a write is instantiated in before the rest merge: enough for the per-element calls
+     * of iteration natives' callbacks (§5 Resolver capabilities 4) over the corpus's constant lists.
+     * A frame that carries a native function (the original `window.fetch`) is kept apart before the others.
+     */
+    contexts: number;
+    /**
+     * The iteration cap: how many iterations one loop, or one iteration native's callback, is unrolled for in one frame
+     * of the code around it (§5 Resolver capabilities 4). A loop that runs past it is cut there (Principle 5).
+     */
+    iterations: number;
+    /**
+     * How many constants are evaluated one within another before the next one read waits for them to stop: deep enough
+     * for any constant a person writes, and shallow enough for the stack (§5 Resolver capabilities 1).
+     */
+    nesting: number;
+    /**
+     * How many rounds the dynamic-call index is built in, each with the frames the last one found. Each round reaches one
+     * call further along a chain of calls the syntax doesn't name. Rounds that run out are a cap hit, counted on the
+     * calls of the frames the last round found whose code calls on, and raised as `analysis-budget` when one of them
+     * carries a native (Principle 5).
+     */
+    indexRounds: number;
+    /** How many aliases deep a patch-shaped write's original is followed (§5 Partially resolved writes). */
+    aliasDepth: number;
+    /** How deep a write-back is followed through heap fields whose values are heap fields (§3). */
+    heapDepth: number;
+    /**
+     * The descriptor-alternatives cap: how many combinations of maybe-absent fields one descriptor object is expanded
+     * into.
+     */
+    descriptorAlternatives: number;
+    /**
+     * The candidate-runs cap: how many runs of `writesOf`, one per combination of alternatives, a node's candidate sets
+     * are worked out in (§5 Candidate sets). Past it, the node's candidate sites give nothing: counted, and raised as
+     * `analysis-budget` when a holder they write can be the global object or a native holder (Principle 5).
+     */
+    candidateRuns: number;
+    /** The test-reads cap: how many reads of a guard's test the classifier evaluates to find a native read in it (§7). */
+    testReads: number;
+    /** The throw-depth cap: how many calls into the code's own functions are followed to judge that a `try` can't throw. */
+    throwDepth: number;
+    /** The flag-depth cap: how many calls deep a once-flag's assignment is followed from the path its test lets through. */
+    flagDepth: number;
+}
+/** What bounds one link group's analysis. */
+export interface Budget {
+    /**
+     * The step budget per source byte (UTF-8) of a link group's members: a group of `n` bytes has `n *
+     * stepsPerByte` steps, rounded down. Set with margin over the validation corpus, the scale fixture and the test
+     * fixtures, so that it never fires on them (§18).
+     */
+    stepsPerByte: number;
+    caps: Caps;
+}
+/**
+ * The budget monkeypatchlist ships. The costliest group per byte measured on 2026-09-29 took 162 steps per byte on the
+ * validation corpus (a 4 KB zone.js-style sweep), 130 on the scale fixture (react-dom) and 45 in the test fixtures, so
+ * 1024 left about a sixfold margin. At `depth` 24 / `contexts` 256, webpack promise-polyfill takes about 3,150
+ * steps per byte (its recursion found provisionally once per heap instance), so R1 raises the budget to 4096, where it
+ * fires on no corpus site, rather than lose results to it.
+ */
+export declare const defaultBudget: Budget;

package/dist/packages/analysis/lib/budget.js

@@ -0,0 +1,31 @@
+// Budgets and caps (§18 Budgets are deterministic, Context policy). Each link group has a step budget, scaled with its
+// size: `stepsPerByte` steps per source byte of its members. The caps bound single pieces of work. All of them
+// are implementation detail, tuned on the corpus, and never a user flag: the scan's deps can replace them, so the cost
+// benchmark can rerun the corpus with each one multiplied on its own.
+/**
+ * The budget monkeypatchlist ships. The costliest group per byte measured on 2026-09-29 took 162 steps per byte on the
+ * validation corpus (a 4 KB zone.js-style sweep), 130 on the scale fixture (react-dom) and 45 in the test fixtures, so
+ * 1024 left about a sixfold margin. At `depth` 24 / `contexts` 256, webpack promise-polyfill takes about 3,150
+ * steps per byte (its recursion found provisionally once per heap instance), so R1 raises the budget to 4096, where it
+ * fires on no corpus site, rather than lose results to it.
+ */
+export const defaultBudget = {
+    stepsPerByte: 4096,
+    caps: {
+        alternatives: 16,
+        foldLength: 1 << 20,
+        // Where the corpus results converge: raising both ×4 again changes nothing more.
+        depth: 24,
+        contexts: 256,
+        iterations: 256,
+        nesting: 64,
+        indexRounds: 3,
+        aliasDepth: 8,
+        heapDepth: 8,
+        descriptorAlternatives: 64,
+        candidateRuns: 256,
+        testReads: 64,
+        throwDepth: 4,
+        flagDepth: 4,
+    },
+};

package/dist/packages/analysis/lib/catch-arms.d.ts

@@ -0,0 +1,19 @@
+import type { CatalogTarget } from '../../../catalog.ts';
+import type { AstNode } from './ast.ts';
+import { type Value } from './global-object.ts';
+import { type Key } from './keys.ts';
+/** What judging a `try` block needs: values where it is, the catalog, and the declarations names resolve to. */
+export interface ThrowContext {
+    /** The values an expression can have where the `try` is. */
+    evaluate(node: AstNode): Value[];
+    /** The catalog target `key` names on `holder`'s chain in the unmutated catalog, if one does. */
+    target(holder: string, key: Key): CatalogTarget | undefined;
+    /** The declaration a name resolves to, or none for a free name. */
+    declaration(id: AstNode): AstNode | undefined;
+    /** How deep calls into the code's own functions are followed (the `throwDepth` cap, §18). */
+    maxDepth: number;
+    /** Counts a hit of the `throwDepth` cap at the function it kept from being followed (§18). */
+    depthCut(fn: AstNode): void;
+}
+/** Whether a `try` block may throw where it is: false only when every statement in it is shown not to. */
+export declare function mayThrow(block: AstNode, context: ThrowContext): boolean;

package/dist/packages/analysis/lib/catch-arms.js

@@ -0,0 +1,351 @@
+// Catch arms (§5 Resolver capabilities 9): a write in a `catch` arm counts only
+// when its `try` block may throw, judged against the unmutated catalog. A `try` whose statements are reads and calls
+// the catalog shows can't throw for the members swept never reaches its `catch`: rrweb's canvas observers read
+// `typeof proto[k]`, which throws only for an accessor, whose getter runs on the prototype, and call `patch`, which
+// catches internally, so its `catch` redefines only the accessors.
+//
+// The judgement is conservative: a statement or expression throws unless a rule below shows it can't, so any code the
+// analyzer can't see through keeps its `catch` reachable, as before.
+import { isHeap } from "./global-object.js";
+import { toPropertyKey } from "./keys.js";
+import { isFunction } from "./summaries.js";
+/** Whether a `try` block may throw where it is: false only when every statement in it is shown not to. */
+export function mayThrow(block, context) {
+    const judge = judgeOf(context);
+    return !judge.statement(block, 0);
+}
+function judgeOf(context) {
+    // The functions being followed, whose calls through themselves are taken to throw.
+    const active = new Set();
+    /** Whether a statement can't throw. */
+    const statement = (node, depth) => {
+        switch (node.type) {
+            case 'EmptyStatement':
+            case 'ContinueStatement':
+            case 'BreakStatement':
+            case 'FunctionDeclaration':
+                return true;
+            case 'BlockStatement':
+                return node['body'].every((each) => statement(each, depth));
+            case 'ReturnStatement': {
+                const argument = node['argument'];
+                return argument === null || expression(argument, depth);
+            }
+            case 'ExpressionStatement':
+                return expression(node['expression'], depth);
+            case 'IfStatement': {
+                const alternate = node['alternate'];
+                return (expression(node['test'], depth) &&
+                    statement(node['consequent'], depth) &&
+                    (alternate === null || statement(alternate, depth)));
+            }
+            case 'VariableDeclaration':
+                return node['declarations'].every((declarator) => {
+                    const init = declarator['init'];
+                    return declarator['id'].type === 'Identifier' && (init === null || expression(init, depth));
+                });
+            case 'TryStatement': {
+                // A `try` throws only when its block throws and its `catch` does too, or its `finally` does.
+                const handler = node['handler'];
+                const finalizer = node['finalizer'];
+                const block = statement(node['block'], depth);
+                // A destructuring catch parameter throws on a thrown value it can't destructure.
+                const param = handler === null ? null : handler['param'];
+                const catches = handler !== null && (param === null || param.type === 'Identifier') && statement(handler['body'], depth);
+                const caught = handler === null ? block : block || catches;
+                return caught && (finalizer === null || statement(finalizer, depth));
+            }
+            default:
+                return false;
+        }
+    };
+    /** Whether an expression can't throw. */
+    const expression = (node, depth) => {
+        switch (node.type) {
+            case 'Literal':
+            case 'ThisExpression':
+            case 'FunctionExpression':
+            case 'ArrowFunctionExpression':
+                return true;
+            case 'TemplateLiteral':
+                return node['expressions'].length === 0;
+            case 'Identifier':
+                return readable(node);
+            case 'ChainExpression':
+                return expression(node['expression'], depth);
+            case 'SequenceExpression':
+                return node['expressions'].every((each) => expression(each, depth));
+            case 'LogicalExpression':
+                return expression(node['left'], depth) && expression(node['right'], depth);
+            case 'ConditionalExpression':
+                return ['test', 'consequent', 'alternate'].every((key) => expression(node[key], depth));
+            case 'UnaryExpression': {
+                const argument = node['argument'];
+                const operator = node['operator'];
+                // `typeof` of a free name never throws.
+                if (operator === 'typeof' && argument.type === 'Identifier')
+                    return true;
+                return (operator === 'typeof' || operator === '!' || operator === 'void') && expression(argument, depth);
+            }
+            case 'BinaryExpression': {
+                const operator = node['operator'];
+                const left = node['left'];
+                const right = node['right'];
+                if (!expression(left, depth) || !expression(right, depth))
+                    return false;
+                // Strict equality never converts its operands, loose equality between primitives doesn't either, and `in`
+                // throws only on a right side that is no object.
+                if (operator === '===' || operator === '!==')
+                    return true;
+                if (operator === '==' || operator === '!=')
+                    return primitive(left) && primitive(right);
+                // `in` converts its left side to a key, which can throw for an object: only constants are shown not to.
+                if (operator === 'in')
+                    return constants(context.evaluate(left)) && objects(context.evaluate(right));
+                return false;
+            }
+            case 'ArrayExpression':
+                return node['elements'].every((element) => element === null || (element.type !== 'SpreadElement' && expression(element, depth)));
+            case 'ObjectExpression':
+                return node['properties'].every((property) => property.type === 'Property' &&
+                    (property['computed'] !== true || expression(property['key'], depth)) &&
+                    expression(property['value'], depth));
+            case 'MemberExpression':
+                return memberRead(node, depth);
+            case 'AssignmentExpression':
+                return node['operator'] === '=' && assigned(node['left'], depth) && expression(node['right'], depth);
+            case 'CallExpression':
+                return call(node, depth);
+            default:
+                return false;
+        }
+    };
+    /** Whether reading a name can't throw: a declaration it resolves to, or a free name the catalog has. */
+    const readable = (id) => {
+        if (id['name'] === 'undefined')
+            return true;
+        const declaration = context.declaration(id);
+        // A `let`, `const` or `class` read before its declaration throws.
+        if (declaration !== undefined)
+            return isFunction(declaration) || declaration.start <= id.start;
+        const values = context.evaluate(id);
+        return values.length > 0 && values.every((value) => value.kind === 'holder' || value.kind === 'native' || value.kind === 'member');
+    };
+    /** The constant keys a member expression reads, or undefined when one isn't constant. */
+    const keysOf = (node, depth) => {
+        const property = node['property'];
+        if (node['computed'] !== true)
+            return property.type === 'Identifier' ? [property['name']] : undefined;
+        if (!expression(property, depth))
+            return undefined;
+        const keys = context.evaluate(property);
+        if (keys.length === 0 || !keys.every((key) => key.kind === 'constant'))
+            return undefined;
+        return keys.map((key) => toPropertyKey(key.value));
+    };
+    /**
+     * Whether reading a member can't throw: a data member, or none, of a native holder in the unmutated catalog (an
+     * accessor's getter runs, and throws on a prototype), or any member of an array or function the code made.
+     */
+    const memberRead = (node, depth) => {
+        const object = node['object'];
+        if (object.type === 'Super' || !expression(object, depth))
+            return false;
+        const keys = keysOf(node, depth);
+        if (keys === undefined)
+            return false;
+        const values = context.evaluate(object);
+        if (values.length === 0)
+            return false;
+        return values.every((value) => {
+            if (made(value))
+                return keys.every((key) => !poisoned(value, key));
+            if (value.kind !== 'holder')
+                return false;
+            return keys.every((key) => context.target(value.holder, key)?.descriptor.type !== 'accessor');
+        });
+    };
+    /**
+     * Whether an assignment target can't throw: a declared variable, a writable data member of a native holder (an
+     * accessor's setter runs, and throws on a prototype), or any member of an array or function the code made.
+     */
+    const assigned = (left, depth) => {
+        if (left.type === 'Identifier') {
+            const declaration = context.declaration(left);
+            return declaration !== undefined && declaration.start <= left.start && mutable(left, declaration);
+        }
+        if (left.type !== 'MemberExpression')
+            return false;
+        const object = left['object'];
+        if (object.type === 'Super' || !expression(object, depth))
+            return false;
+        const keys = keysOf(left, depth);
+        if (keys === undefined)
+            return false;
+        const values = context.evaluate(object);
+        if (values.length === 0)
+            return false;
+        return values.every((value) => {
+            if (made(value))
+                return keys.every((key) => !poisoned(value, key) && !fixed(value, key));
+            if (value.kind !== 'holder')
+                return false;
+            return keys.every((key) => {
+                const descriptor = context.target(value.holder, key)?.descriptor;
+                return descriptor !== undefined && descriptor.type === 'data' && descriptor.writable;
+            });
+        });
+    };
+    /**
+     * Whether a call can't throw: its arguments can't, and it calls a function the code made whose body can't throw
+     * (one that catches internally), `push` on an array the code made, or a descriptor read or a define of a configurable
+     * member on a native holder.
+     */
+    const call = (node, depth) => {
+        const args = node['arguments'];
+        if (args.some((arg) => arg.type === 'SpreadElement' || !expression(arg, depth)))
+            return false;
+        const callee = node['callee'];
+        if (callee.type === 'MemberExpression' && callee['computed'] !== true) {
+            const name = callee['property']['name'];
+            if (name === 'push' && expression(callee['object'], depth)) {
+                const values = context.evaluate(callee['object']);
+                if (values.length > 0 && values.every((value) => isHeap(value) && value.heap.kind === 'array'))
+                    return true;
+            }
+        }
+        if (callee.type !== 'Identifier' && !expression(callee, depth))
+            return false;
+        if (callee.type === 'Identifier' && !readable(callee))
+            return false;
+        const values = context.evaluate(callee);
+        if (values.length === 0)
+            return false;
+        return values.every((value) => {
+            if (value.kind === 'native')
+                return nativeCall(value.name, args);
+            if (!isHeap(value) || value.heap.kind !== 'function')
+                return false;
+            return body(value.heap.node, depth);
+        });
+    };
+    /** Whether a native call can't throw on a native holder's member, as the unmutated catalog has it. */
+    const nativeCall = (name, args) => {
+        if (name !== 'Object.getOwnPropertyDescriptor' && name !== 'Object.defineProperty' && name !== 'Reflect.defineProperty') {
+            return false;
+        }
+        const [object, key, descriptor] = args;
+        if (object === undefined || key === undefined)
+            return false;
+        const holders = context.evaluate(object);
+        if (holders.length === 0 || !holders.every((value) => value.kind === 'holder'))
+            return false;
+        // Both convert the key, which can throw for an object: only constants are shown not to.
+        const keys = context.evaluate(key);
+        if (!constants(keys))
+            return false;
+        if (name === 'Object.getOwnPropertyDescriptor')
+            return true;
+        // A define throws when its descriptor is no object or mixes accessor and data fields, and `Object.defineProperty`
+        // when the member is there and can't be configured.
+        if (descriptor === undefined || descriptor.type !== 'ObjectExpression')
+            return false;
+        // Each field a plain one, named by an identifier: an accessor field's getter would run, and can throw.
+        const properties = descriptor['properties'];
+        const fields = properties.map((property) => property.type === 'Property' && property['computed'] !== true && property['kind'] === 'init'
+            ? property['key']['name']
+            : undefined);
+        if (fields.includes(undefined))
+            return false;
+        // A getter or setter that is neither a function nor `undefined` throws.
+        const callable = (value) => isFunction(value) || (value.type === 'Identifier' && value['name'] === 'undefined');
+        if (properties.some((property, index) => (fields[index] === 'get' || fields[index] === 'set') && !callable(property['value']))) {
+            return false;
+        }
+        if (fields.some((field) => field === 'get' || field === 'set') && fields.some((field) => field === 'value' || field === 'writable')) {
+            return false;
+        }
+        if (name === 'Reflect.defineProperty')
+            return true;
+        return holders.every((value) => keys.every((each) => {
+            const target = context.target(value.holder, toPropertyKey(each.value));
+            return target === undefined || target.descriptor.configurable;
+        }));
+    };
+    /** Whether calling a function the code made can't throw: simple parameters, and a body that can't. */
+    const body = (fn, depth) => {
+        if (active.has(fn) || !isFunction(fn))
+            return false;
+        if (depth >= context.maxDepth) {
+            context.depthCut(fn);
+            return false;
+        }
+        if (fn['async'] === true || fn['generator'] === true)
+            return false;
+        if (!fn['params'].every((param) => param.type === 'Identifier' || param.type === 'RestElement')) {
+            return false;
+        }
+        active.add(fn);
+        try {
+            const inside = fn['body'];
+            return inside.type === 'BlockStatement' ? statement(inside, depth + 1) : expression(inside, depth + 1);
+        }
+        finally {
+            active.delete(fn);
+        }
+    };
+    return { statement, expression };
+}
+/** Whether an expression is a primitive by its form: a literal other than a regular expression, or a `typeof`. */
+function primitive(node) {
+    if (node.type === 'Literal')
+        return node['regex'] === undefined;
+    return node.type === 'UnaryExpression' && node['operator'] === 'typeof';
+}
+/** Whether every value is a constant, which converting to a property key never throws on. */
+function constants(values) {
+    return values.length > 0 && values.every((value) => value.kind === 'constant');
+}
+/**
+ * Whether assigning a name can't throw for what declares it: not a `const` (or `using`), an import, a class's name or
+ * a function expression's own name, which strict code can't assign.
+ */
+function mutable(id, declaration) {
+    switch (declaration.type) {
+        case 'VariableDeclaration':
+            return declaration['kind'] === 'var' || declaration['kind'] === 'let';
+        case 'ImportDeclaration':
+        case 'ClassDeclaration':
+        case 'ClassExpression':
+            return false;
+        case 'FunctionExpression': {
+            // The seam gives the function for its parameters too: a parameter of that name is assignable.
+            if (declaration['id']?.['name'] !== id['name'])
+                return true;
+            return declaration['params'].some((param) => param.type === 'Identifier' && param['name'] === id['name']);
+        }
+        default:
+            return true;
+    }
+}
+/** Whether reading `key` off a function the code made can throw: a strict function's `caller` and `arguments`. */
+function poisoned(value, key) {
+    return isHeap(value) && value.heap.kind === 'function' && (key === 'caller' || key === 'arguments');
+}
+/**
+ * Whether writing `key` on an array or function the code made can throw: a function's non-writable `name` and
+ * `length` in strict code, and an array's `length`, which throws on a value that is no valid length.
+ */
+function fixed(value, key) {
+    if (!isHeap(value))
+        return true;
+    return key === 'length' || (value.heap.kind === 'function' && key === 'name');
+}
+/** Whether every value is an object, which `in` never throws on: a native holder, or one the code made. */
+function objects(values) {
+    return values.length > 0 && values.every((value) => value.kind === 'holder' || isHeap(value));
+}
+/** Whether a value is an array or a function the code made, whose own members have no accessors it doesn't show. */
+function made(value) {
+    return isHeap(value) && (value.heap.kind === 'array' || value.heap.kind === 'function');
+}