rea-agents 2.0.0 → 2.1.0

package/dist/domain/javascriptSemanticValues.js

@@ -0,0 +1,352 @@
+import * as t from "@babel/types";
+import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { compareCodePoints, propertyName, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+/** Evaluate one binding in the bounded constant-value lattice. */
+export const evaluateSemanticBinding = (binding, state) => evaluateBinding(binding, { state, bindings: new Set(), depth: 0 });
+/** Follow module provenance through destructuring, members, and aliases. */
+export const evaluateSemanticProvenance = (binding, state) => provenanceForBinding(binding, { state, bindings: new Set(), depth: 0 });
+const evaluateBinding = (binding, context) => {
+    if (context.bindings.has(binding.bindingId))
+        return { status: "cycle", reason: `Alias cycle at ${binding.name}.` };
+    if (context.depth >= context.state.limits.maxValueDepth)
+        return limitValue(context.state, "maxValueDepth");
+    if (binding.initializers.length === 0)
+        return {
+            status: "unknown",
+            reason: `Binding ${binding.name} has no constant initializer.`,
+        };
+    if (binding.initializers.length > 1)
+        return {
+            status: "ambiguous",
+            reason: `Binding ${binding.name} has multiple possible assignments.`,
+        };
+    const initializer = binding.initializers[0];
+    if (initializer === undefined)
+        return { status: "unknown", reason: "Missing binding initializer." };
+    const nested = nestedContext(context, binding.bindingId);
+    return projectValue(evaluateExpression(initializer.node, nested), initializer.projection);
+};
+const evaluateExpression = (node, context) => {
+    if (context.depth >= context.state.limits.maxValueDepth)
+        return limitValue(context.state, "maxValueDepth");
+    const literal = primitiveValue(node);
+    if (literal.found)
+        return { status: "literal", value: literal.value };
+    if (t.isIdentifier(node)) {
+        const binding = resolveSemanticBindingState(context.state, node, node.name);
+        return binding === undefined
+            ? { status: "unknown", reason: `Unbound identifier ${node.name}.` }
+            : evaluateBinding(binding, nestedContext(context));
+    }
+    if (t.isTemplateLiteral(node))
+        return evaluateTemplate(node, context);
+    if (t.isConditionalExpression(node))
+        return mergeValues([
+            evaluateExpression(node.consequent, nestedContext(context)),
+            evaluateExpression(node.alternate, nestedContext(context)),
+        ], context.state);
+    if (t.isLogicalExpression(node))
+        return mergeValues([
+            evaluateExpression(node.left, nestedContext(context)),
+            evaluateExpression(node.right, nestedContext(context)),
+        ], context.state);
+    if (t.isObjectExpression(node))
+        return evaluateObject(node, context);
+    if (t.isArrayExpression(node))
+        return evaluateArray(node, context);
+    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node))
+        return evaluateMember(node, context);
+    if (t.isBinaryExpression(node, { operator: "+" }))
+        return evaluateAddition(node, context);
+    if (t.isUnaryExpression(node))
+        return evaluateUnary(node, context);
+    if ((t.isTSAsExpression(node) ||
+        t.isTSTypeAssertion(node) ||
+        t.isTSNonNullExpression(node)) &&
+        t.isExpression(node.expression))
+        return evaluateExpression(node.expression, nestedContext(context));
+    return { status: "unknown", reason: `Unsupported ${node.type} value.` };
+};
+const evaluateTemplate = (node, context) => {
+    let candidates = [""];
+    for (let index = 0; index < node.quasis.length; index += 1) {
+        const quasi = node.quasis[index];
+        const text = quasi?.value.cooked ?? quasi?.value.raw ?? "";
+        candidates = candidates.map((prefix) => `${prefix}${text}`);
+        const expression = node.expressions[index];
+        if (expression === undefined)
+            continue;
+        const values = primitiveCandidates(evaluateExpression(expression, nestedContext(context)));
+        if (values === null)
+            return {
+                status: "unknown",
+                reason: "Template expression is not a bounded primitive.",
+            };
+        candidates = candidates.flatMap((prefix) => values.map((value) => `${prefix}${String(value)}`));
+        if (candidates.length > context.state.limits.maxUnionValues)
+            return limitValue(context.state, "maxUnionValues");
+    }
+    return primitiveSet(candidates, context.state);
+};
+const evaluateObject = (node, context) => {
+    const properties = [];
+    let unknownProperties = false;
+    for (const property of node.properties) {
+        if (t.isSpreadElement(property) || property.computed) {
+            unknownProperties = true;
+            continue;
+        }
+        const name = propertyName(property.key);
+        if (name === "" || !t.isObjectProperty(property)) {
+            unknownProperties = true;
+            continue;
+        }
+        if (properties.length >= context.state.limits.maxObjectProperties) {
+            markLimit(context.state, "maxObjectProperties");
+            unknownProperties = true;
+            continue;
+        }
+        properties.push({
+            name,
+            value: evaluateExpression(property.value, nestedContext(context)),
+        });
+    }
+    properties.sort((left, right) => compareCodePoints(left.name, right.name));
+    return { status: "object", properties, unknownProperties };
+};
+const evaluateArray = (node, context) => {
+    const items = [];
+    let unknownItems = false;
+    for (const element of node.elements) {
+        if (element === null || t.isSpreadElement(element)) {
+            unknownItems = true;
+            continue;
+        }
+        if (items.length >= context.state.limits.maxObjectProperties) {
+            markLimit(context.state, "maxObjectProperties");
+            unknownItems = true;
+            continue;
+        }
+        items.push(evaluateExpression(element, nestedContext(context)));
+    }
+    return { status: "array", items, unknownItems };
+};
+const evaluateMember = (node, context) => {
+    if (!t.isNode(node.object))
+        return { status: "unknown", reason: "Unsupported member base." };
+    const key = memberKey(node);
+    if (key === undefined)
+        return { status: "unknown", reason: "Dynamic member key." };
+    return projectValue(evaluateExpression(node.object, nestedContext(context)), [
+        key,
+    ]);
+};
+const evaluateAddition = (node, context) => {
+    const left = primitiveCandidates(evaluateExpression(node.left, nestedContext(context)));
+    const right = primitiveCandidates(evaluateExpression(node.right, nestedContext(context)));
+    if (left === null || right === null)
+        return { status: "unknown", reason: "Non-primitive addition." };
+    const values = left.flatMap((leftValue) => right.map((rightValue) => typeof leftValue === "number" && typeof rightValue === "number"
+        ? leftValue + rightValue
+        : `${String(leftValue)}${String(rightValue)}`));
+    return primitiveSet(values, context.state);
+};
+const evaluateUnary = (node, context) => {
+    const argument = primitiveCandidates(evaluateExpression(node.argument, nestedContext(context)));
+    if (argument === null)
+        return { status: "unknown", reason: "Non-primitive unary operand." };
+    if (node.operator === "!")
+        return primitiveSet(argument.map((value) => !value), context.state);
+    if (node.operator === "+")
+        return primitiveSet(argument.map((value) => Number(value)), context.state);
+    if (node.operator === "-")
+        return primitiveSet(argument.map((value) => -Number(value)), context.state);
+    return { status: "unknown", reason: `Unsupported unary ${node.operator}.` };
+};
+const projectValue = (value, projection) => {
+    let current = value;
+    for (const key of projection) {
+        if (key === null)
+            return {
+                status: "unknown",
+                reason: "Cannot project a dynamic property.",
+            };
+        if (current.status === "object" && typeof key === "string") {
+            const property = current.properties.find(({ name }) => name === key);
+            if (property === undefined)
+                return {
+                    status: current.unknownProperties ? "unknown" : "unknown",
+                    reason: `Object property ${key} was not observed.`,
+                };
+            current = property.value;
+        }
+        else if (current.status === "array" && typeof key === "number") {
+            const item = current.items[key];
+            if (item === undefined)
+                return {
+                    status: "unknown",
+                    reason: `Array item ${String(key)} missing.`,
+                };
+            current = item;
+        }
+        else
+            return {
+                status: "unknown",
+                reason: `Cannot project ${String(key)} from ${current.status}.`,
+            };
+    }
+    return current;
+};
+const provenanceForBinding = (binding, context) => {
+    if (context.bindings.has(binding.bindingId))
+        return provenance("cycle", [], `Alias cycle at ${binding.name}.`);
+    if (context.depth >= context.state.limits.maxValueDepth)
+        return limitProvenance(context.state, "maxValueDepth");
+    if (binding.directOrigins.length > 0)
+        return originsProvenance(binding.directOrigins, context.state);
+    if (binding.initializers.length === 0)
+        return provenance("local", [], null);
+    if (binding.initializers.length > 1)
+        return provenance("ambiguous", [], `Binding ${binding.name} has multiple possible assignments.`);
+    const initializer = binding.initializers[0];
+    if (initializer === undefined)
+        return provenance("unknown", [], "Missing binding initializer.");
+    if (initializer.projection.includes(null))
+        return provenance("unknown", [], "Dynamic provenance projection.");
+    const resolved = provenanceForExpression(initializer.node, nestedContext(context, binding.bindingId));
+    if (resolved.status !== "module" || initializer.projection.length === 0)
+        return resolved;
+    return originsProvenance(resolved.origins.map((origin) => ({
+        ...origin,
+        importedPath: [
+            ...origin.importedPath,
+            ...initializer.projection.map((segment) => String(segment)),
+        ],
+    })), context.state);
+};
+const provenanceForExpression = (node, context) => {
+    const required = requireOrigin(node);
+    if (required !== undefined)
+        return originsProvenance([required], context.state);
+    if (t.isIdentifier(node)) {
+        const binding = resolveSemanticBindingState(context.state, node, node.name);
+        return binding === undefined
+            ? provenance("unknown", [], `Unbound identifier ${node.name}.`)
+            : provenanceForBinding(binding, nestedContext(context));
+    }
+    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        if (!t.isNode(node.object))
+            return provenance("unknown", [], "Unsupported member base.");
+        const member = memberKey(node);
+        if (typeof member !== "string")
+            return provenance("unknown", [], "Dynamic provenance member.");
+        const base = provenanceForExpression(node.object, nestedContext(context));
+        return base.status !== "module"
+            ? base
+            : originsProvenance(base.origins.map((origin) => ({
+                ...origin,
+                importedPath: [...origin.importedPath, member],
+            })), context.state);
+    }
+    if (t.isConditionalExpression(node) || t.isLogicalExpression(node)) {
+        const left = t.isConditionalExpression(node) ? node.consequent : node.left;
+        const right = t.isConditionalExpression(node) ? node.alternate : node.right;
+        const candidates = [
+            provenanceForExpression(left, nestedContext(context)),
+            provenanceForExpression(right, nestedContext(context)),
+        ];
+        const origins = candidates.flatMap((candidate) => candidate.origins);
+        return origins.length > 0
+            ? provenance("ambiguous", uniqueOrigins(origins), "Multiple module origins.")
+            : provenance("unknown", [], "Conditional provenance is unresolved.");
+    }
+    return provenance("local", [], null);
+};
+const requireOrigin = (node) => {
+    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        if (!t.isNode(node.object))
+            return undefined;
+        const nested = requireOrigin(node.object);
+        const member = memberKey(node);
+        return nested === undefined || typeof member !== "string"
+            ? undefined
+            : { ...nested, importedPath: [...nested.importedPath, member] };
+    }
+    if (!t.isCallExpression(node) ||
+        !t.isIdentifier(node.callee, { name: "require" }))
+        return undefined;
+    const specifier = stringValue(node.arguments[0]);
+    return specifier === undefined ? undefined : { specifier, importedPath: [] };
+};
+const mergeValues = (values, state) => {
+    const primitives = values.flatMap((value) => primitiveCandidates(value) ?? []);
+    return primitives.length === values.length ||
+        values.every((value) => value.status === "union" || value.status === "literal")
+        ? primitiveSet(primitives, state)
+        : { status: "ambiguous", reason: "Branches have incompatible values." };
+};
+const primitiveSet = (values, state) => {
+    const unique = [
+        ...new Map(values.map((value) => [primitiveKey(value), value])).values(),
+    ].sort((left, right) => compareCodePoints(primitiveKey(left), primitiveKey(right)));
+    if (unique.length > state.limits.maxUnionValues)
+        return limitValue(state, "maxUnionValues");
+    const only = unique[0];
+    return unique.length === 1 && only !== undefined
+        ? { status: "literal", value: only }
+        : { status: "union", values: unique };
+};
+const primitiveCandidates = (value) => value.status === "literal"
+    ? [value.value]
+    : value.status === "union"
+        ? value.values
+        : null;
+const primitiveValue = (node) => {
+    if (t.isStringLiteral(node) || t.isNumericLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isBooleanLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isNullLiteral(node))
+        return { found: true, value: null };
+    return { found: false };
+};
+const memberKey = (node) => {
+    if (!node.computed)
+        return propertyName(node.property) || undefined;
+    if (t.isStringLiteral(node.property) || t.isNumericLiteral(node.property))
+        return node.property.value;
+    return undefined;
+};
+const originsProvenance = (origins, state) => {
+    const unique = uniqueOrigins(origins);
+    if (unique.length > state.limits.maxUnionValues)
+        return limitProvenance(state, "maxUnionValues");
+    return unique.length === 1
+        ? provenance("module", unique, null)
+        : provenance("ambiguous", unique, "Multiple module origins.");
+};
+const uniqueOrigins = (origins) => [
+    ...new Map(origins.map((origin) => [originKey(origin), origin])).values(),
+].sort((left, right) => compareCodePoints(originKey(left), originKey(right)));
+const provenance = (status, origins, reason) => ({ status, origins, reason });
+const limitValue = (state, limit) => {
+    markLimit(state, limit);
+    return { status: "limit-reached", reason: `${limit} reached.` };
+};
+const limitProvenance = (state, limit) => {
+    markLimit(state, limit);
+    return provenance("limit-reached", [], `${limit} reached.`);
+};
+const markLimit = (state, limit) => {
+    state.limitsReached.add(limit);
+    state.omittedCount += 1;
+};
+const nestedContext = (context, bindingId) => ({
+    state: context.state,
+    depth: context.depth + 1,
+    bindings: bindingId === undefined
+        ? context.bindings
+        : new Set([...context.bindings, bindingId]),
+});
+const primitiveKey = (value) => `${value === null ? "null" : typeof value}:${JSON.stringify(value)}`;
+const originKey = (origin) => `${origin.specifier}\0${origin.importedPath.join("\0")}`;

package/dist/domain/javascriptStaticAnalysis.js

@@ -1,10 +1,11 @@
 import { parse } from "@babel/parser";
 import * as t from "@babel/types";
-import { collectJavaScriptExports, fingerprintJavaScriptAst, } from "./javascriptAstFingerprint.js";
-import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, chunkRuntime, compareCodePoints, detectVendors, endpointArgument, failedJavaScriptStaticAnalysis, factoryRequireName, moduleFactory, modulePropertyName, prefixedArgument, propertyName, range, rangeForOffsets, registrationKey, sanitizeCandidate, sha256Text, sortedUnique, sourceSlice, staticArrayValues, staticPath, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
-import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
-import { addBoundedFinding, addLocatedFinding, finalizeLocatedFindings, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
 import { inspectElectronStaticNode } from "./electronStaticAnalysis.js";
+import { detectVendors, failedJavaScriptStaticAnalysis, registrationKey, sortedUnique, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty, inspectRoleProperty, } from "./javascriptStaticAnalysisCalls.js";
+import { inspectBundlerRegistration } from "./javascriptStaticAnalysisBundler.js";
+import { finalizeLocatedFindings } from "./javascriptStaticAnalysisFindings.js";
+import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
 /** Parse one bounded JavaScript artifact and recover static structure only. */
 export const analyzeJavaScriptStaticSource = (source, limits) => {
     let file;
@@ -127,220 +128,3 @@ const inspectNode = (source, node, accumulator, limits) => {
         inspectRoleProperty(node, findings);
     }
 };
-const inspectCall = (node, context) => {
-    const { accumulator } = context;
-    const name = calleeName(node.callee);
-    const first = stringValue(node.arguments[0]);
-    const module = moduleAtOffset(node.start, accumulator.modules);
-    const moduleRequire = module?.requireName !== null && name === module?.requireName;
-    if (name === "require" ||
-        name.endsWith(".require") ||
-        name.includes("__webpack_require__") ||
-        moduleRequire)
-        addReference(context, {
-            node,
-            kind: "require",
-            specifier: argumentValue(node.arguments[0]),
-        });
-    if (name.endsWith(".e") && name.includes("require"))
-        addReference(context, {
-            node,
-            kind: "dynamic-import",
-            specifier: prefixedArgument("chunk:", node.arguments[0]),
-        });
-    if (name === "Worker" || name.endsWith(".Worker"))
-        addReference(context, { node, kind: "worker", specifier: first });
-    if (name.endsWith("serviceWorker.register"))
-        addReference(context, { node, kind: "service-worker", specifier: first });
-    inspectEndpointCall(node, name, first, context);
-    inspectStorageCall(node, name, first, context);
-    if (name.endsWith("loadFile") && first !== undefined)
-        addLocatedFinding(context, {
-            collection: accumulator.roles,
-            key: `role\0renderer\0${first}`,
-            node,
-            value: {
-                role: "renderer",
-                path: first,
-                mechanism: `call:${name}`,
-                module_key: null,
-                location: range(node),
-            },
-        });
-};
-const inspectBundlerRegistration = (source, call, accumulator, limits) => {
-    const runtime = chunkRuntime(call);
-    const entry = call.arguments[0];
-    if (runtime === undefined || !t.isArrayExpression(entry))
-        return;
-    const chunkIds = entry.elements[0];
-    const table = entry.elements[1];
-    if (!t.isArrayExpression(chunkIds) || !t.isObjectExpression(table))
-        return;
-    const modules = [];
-    for (const property of table.properties) {
-        const factory = moduleFactory(property);
-        if (factory === undefined)
-            continue;
-        if (accumulator.moduleCount >= limits.maxModules) {
-            accumulator.droppedFindings += 1;
-            continue;
-        }
-        accumulator.moduleCount += 1;
-        const key = modulePropertyName(property);
-        if (key.startsWith("[computed@") || key.startsWith("[unknown@"))
-            accumulator.unknownFindings += 1;
-        const exactSource = sourceSlice(source, factory);
-        const fingerprint = fingerprintJavaScriptAst(factory, Math.min(limits.maxAstNodes, 100_000));
-        const exportsValue = collectJavaScriptExports(factory, 256);
-        if (fingerprint.truncated || exportsValue.truncated) {
-            accumulator.droppedFindings += 1;
-            accumulator.structuralTruncation = true;
-        }
-        modules.push({
-            module_key: key,
-            source_sha256: sha256Text(exactSource),
-            structural_fingerprint_sha256: fingerprint.truncated
-                ? null
-                : fingerprint.sha256,
-            structural_fingerprint_algorithm: fingerprint.truncated
-                ? null
-                : "babel-ast-v1",
-            structural_fingerprint_status: fingerprint.truncated
-                ? "truncated"
-                : "complete",
-            exports: exportsValue.values,
-            exports_truncated: exportsValue.truncated,
-            location: range(factory),
-        });
-        if (typeof factory.start === "number" && typeof factory.end === "number")
-            accumulator.modules.push({
-                start: factory.start,
-                end: factory.end,
-                key,
-                requireName: factoryRequireName(factory),
-            });
-    }
-    const chunkKeys = staticArrayValues(chunkIds, Math.min(256, limits.maxFindings));
-    if (chunkKeys.omitted > 0) {
-        accumulator.droppedFindings += chunkKeys.omitted;
-        accumulator.structuralTruncation = true;
-    }
-    accumulator.unknownFindings += chunkKeys.unknown;
-    const registration = {
-        bundler: runtime.toLowerCase().includes("rspack")
-            ? "rspack"
-            : "webpack",
-        runtime,
-        chunk_keys: chunkKeys.values,
-        omitted_chunk_keys: chunkKeys.omitted,
-        unknown_chunk_keys: chunkKeys.unknown,
-        modules: modules.sort((left, right) => compareCodePoints(left.module_key, right.module_key)),
-        location: range(call),
-    };
-    addBoundedFinding(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
-};
-const inspectEndpointCall = (node, name, first, context) => {
-    const route = STATIC_ROUTE_CALL_NAMES.some((candidate) => name === candidate || name.endsWith(`.${candidate}`));
-    if (route && first !== undefined)
-        addEndpoint(context, {
-            node,
-            kind: "route",
-            value: first,
-            mechanism: `call:${name}`,
-        });
-    const endpoint = endpointArgument(name, node.arguments);
-    if (endpoint !== undefined)
-        addEndpoint(context, {
-            node,
-            kind: "network",
-            value: endpoint,
-            mechanism: `call:${name}`,
-        });
-};
-const inspectRouteProperty = (node, context) => {
-    const key = propertyName(node.key);
-    if ((key === "path" || key === "route") && t.isStringLiteral(node.value))
-        addEndpoint(context, {
-            node,
-            kind: "route",
-            value: node.value.value,
-            mechanism: `property:${key}`,
-        });
-};
-const inspectRoleProperty = (node, context) => {
-    if (propertyName(node.key) !== "preload")
-        return;
-    const path = staticPath(node.value);
-    if (path === undefined)
-        return;
-    addLocatedFinding(context, {
-        collection: context.accumulator.roles,
-        key: `role\0preload\0${path}`,
-        node,
-        value: {
-            role: "preload",
-            path,
-            mechanism: "property:preload",
-            module_key: null,
-            location: range(node),
-        },
-    });
-};
-const inspectStorageCall = (node, name, first, context) => {
-    const storage = storageKind(name);
-    if (storage === undefined)
-        return;
-    addLocatedFinding(context, {
-        collection: context.accumulator.storage,
-        key: `storage\0${storage}\0${first ?? ""}`,
-        node,
-        value: {
-            kind: storage,
-            name: first ?? null,
-            mechanism: `call:${name}`,
-            module_key: null,
-            location: range(node),
-        },
-    });
-};
-const addReference = (context, input) => {
-    const boundedSpecifier = input.specifier?.slice(0, 4_096) ?? null;
-    const expression = boundedSpecifier === null
-        ? sourceSlice(context.source, input.node).slice(0, 4_096)
-        : null;
-    addLocatedFinding(context, {
-        collection: context.accumulator.references,
-        key: `reference\0${input.kind}\0${boundedSpecifier ?? expression}`,
-        node: input.node,
-        value: {
-            kind: input.kind,
-            specifier: boundedSpecifier,
-            expression,
-            module_key: null,
-            location: range(input.node),
-        },
-    });
-};
-const addEndpoint = (context, input) => addLocatedFinding(context, {
-    collection: context.accumulator.endpoints,
-    key: `endpoint\0${input.kind}\0${input.value}`,
-    node: input.node,
-    value: {
-        kind: input.kind,
-        value: sanitizeCandidate(input.value),
-        mechanism: input.mechanism,
-        module_key: null,
-        location: range(input.node),
-    },
-});
-const addSourceMapDirectives = (source, accumulator, maximum) => {
-    for (const match of source.matchAll(/\/\/[#@]\s*sourceMappingURL\s*=\s*([^\s]+)/gu)) {
-        const declared = match[1]?.slice(0, 4_096);
-        if (declared === undefined)
-            continue;
-        const start = match.index;
-        const location = rangeForOffsets(source, start, start + match[0].length);
-        addBoundedFinding(accumulator, `source-map\0${declared}`, maximum, () => accumulator.sourceMaps.push({ declared_url: declared, location }));
-    }
-};