rea-agents 2.4.0 → 2.5.0

package/dist/domain/javascriptSemanticObjects.js

@@ -0,0 +1,115 @@
+import * as t from "@babel/types";
+import { reachSemanticLimit, semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
+import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
+import { propertyName, range } from "./javascriptStaticAnalysisHelpers.js";
+/** Recover bounded static property reads, writes, spreads, and destructuring. */
+export const collectJavaScriptSemanticObjects = (program, state, callables) => {
+    const output = [];
+    const callableIds = new Set(callables.map(({ callableId }) => callableId));
+    const callableStack = [];
+    const context = { state, output };
+    traverseJavaScriptAst(program, {
+        enter: (node, parent) => {
+            const callableId = semanticCallableIdForNode(node);
+            if (callableId !== null && callableIds.has(callableId))
+                callableStack.push(callableId);
+            const ownerCallableId = callableStack.at(-1) ?? null;
+            if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node))
+                collectMember(node, parent, ownerCallableId, context);
+            else if (t.isSpreadElement(node) &&
+                parent !== null &&
+                t.isObjectExpression(parent))
+                addObjectOperation({
+                    node,
+                    kind: "spread",
+                    ownerCallableId,
+                    objectBindingId: expressionBindingId(node.argument, state),
+                    targetBindingId: null,
+                    propertyName: null,
+                }, state, output);
+            else if (t.isVariableDeclarator(node) && t.isObjectPattern(node.id))
+                collectDestructuring(node, ownerCallableId, state, output);
+        },
+        exit: (node) => {
+            const callableId = semanticCallableIdForNode(node);
+            if (callableId !== null && callableStack.at(-1) === callableId)
+                callableStack.pop();
+        },
+    });
+    return output;
+};
+const collectMember = (node, parent, ownerCallableId, context) => {
+    const { state, output } = context;
+    const name = semanticStaticPropertyName(node.property, node.computed);
+    if (name.length === 0)
+        return;
+    const write = (t.isAssignmentExpression(parent) && parent.left === node) ||
+        (t.isUpdateExpression(parent) && parent.argument === node);
+    addObjectOperation({
+        node,
+        kind: write ? "write" : "read",
+        ownerCallableId,
+        objectBindingId: expressionBindingId(node.object, state),
+        targetBindingId: null,
+        propertyName: name,
+    }, state, output);
+};
+const collectDestructuring = (node, ownerCallableId, state, output) => {
+    if (!t.isObjectPattern(node.id))
+        return;
+    const objectBindingId = expressionBindingId(node.init, state);
+    for (const property of node.id.properties) {
+        if (!t.isObjectProperty(property))
+            continue;
+        const name = propertyName(property.key);
+        if (name.length === 0)
+            continue;
+        const target = bindingIdentifier(property.value);
+        addObjectOperation({
+            node: property,
+            kind: "destructure",
+            ownerCallableId,
+            objectBindingId,
+            targetBindingId: target === null
+                ? null
+                : (resolveSemanticBindingState(state, target, target.name)
+                    ?.bindingId ?? null),
+            propertyName: name,
+        }, state, output);
+    }
+};
+const addObjectOperation = (input, state, output) => {
+    if (output.length >= state.limits.maxObjectOperations) {
+        reachSemanticLimit(state, "maxObjectOperations");
+        return;
+    }
+    output.push({
+        objectOperationId: `object:${input.kind}:${String(input.node.start ?? -1)}:${String(input.node.end ?? -1)}`,
+        kind: input.kind,
+        location: range(input.node),
+        ownerCallableId: input.ownerCallableId,
+        objectBindingId: input.objectBindingId,
+        targetBindingId: input.targetBindingId,
+        propertyName: input.propertyName,
+        resolution: input.kind === "spread"
+            ? input.objectBindingId === null
+                ? "partial"
+                : "complete"
+            : input.objectBindingId === null ||
+                input.propertyName === null ||
+                (input.kind === "destructure" && input.targetBindingId === null)
+                ? "partial"
+                : "complete",
+    });
+};
+const expressionBindingId = (node, state) => t.isIdentifier(node)
+    ? (resolveSemanticBindingState(state, node, node.name)?.bindingId ?? null)
+    : null;
+const bindingIdentifier = (node) => {
+    if (t.isIdentifier(node))
+        return node;
+    if (t.isAssignmentPattern(node) && t.isIdentifier(node.left))
+        return node.left;
+    return null;
+};

package/dist/domain/javascriptSemanticPromises.js

@@ -0,0 +1,290 @@
+import * as t from "@babel/types";
+import { reachSemanticLimit, semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
+import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
+import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
+import { compareCodePoints, range, sourceRangesEqual, } from "./javascriptStaticAnalysisHelpers.js";
+/** Recover explicit Promise construction, chaining, aggregation, and ownership. */
+export const collectJavaScriptSemanticPromises = (program, state, callables) => {
+    const candidates = collectCandidates(program, state, callables);
+    const candidateByNode = new WeakMap();
+    for (const candidate of candidates)
+        candidateByNode.set(candidate.node, candidate);
+    return candidates.map((candidate) => {
+        const ownership = promiseOwnership(candidate, candidateByNode, state, callables);
+        const sources = promiseSources(candidate, candidateByNode, state);
+        return {
+            promiseId: candidate.promiseId,
+            kind: candidate.kind,
+            method: candidate.method,
+            location: range(candidate.node),
+            ownerCallableId: candidate.ownerCallableId,
+            ...ownership,
+            sourcePromiseIds: [...new Set(sources.promiseIds)].sort(compareCodePoints),
+            sourceResolution: sources.status,
+        };
+    });
+};
+const collectCandidates = (program, state, callables) => {
+    const output = [];
+    const admittedCallables = new Set(callables.map(({ callableId }) => callableId));
+    const callableStack = [];
+    const ancestors = [];
+    traverseJavaScriptAst(program, {
+        enter: (node) => {
+            const callableId = semanticCallableIdForNode(node);
+            if (callableId !== null && admittedCallables.has(callableId))
+                callableStack.push(callableId);
+            const details = promiseCandidateDetails(node, state);
+            if (details !== null) {
+                if (output.length >= state.limits.maxPromiseOperations)
+                    reachSemanticLimit(state, "maxPromiseOperations");
+                else
+                    output.push({
+                        node,
+                        ...details,
+                        promiseId: semanticPromiseId(details.kind, node),
+                        ownerCallableId: callableStack.at(-1) ?? null,
+                        ancestors: [...ancestors],
+                    });
+            }
+            ancestors.push(node);
+        },
+        exit: (node) => {
+            ancestors.pop();
+            const callableId = semanticCallableIdForNode(node);
+            if (callableId !== null && callableStack.at(-1) === callableId)
+                callableStack.pop();
+        },
+    });
+    return output;
+};
+const promiseCandidateDetails = (node, state) => {
+    if (t.isNewExpression(node) &&
+        t.isIdentifier(node.callee, { name: "Promise" }) &&
+        isUnshadowedGlobalPromise(node.callee, state))
+        return { kind: "constructor", method: "new" };
+    if (t.isCallExpression(node) || t.isOptionalCallExpression(node)) {
+        const member = memberCallee(node);
+        if (member === null)
+            return null;
+        const method = semanticStaticPropertyName(member.property, member.computed);
+        if (t.isIdentifier(member.object, { name: "Promise" }) &&
+            isUnshadowedGlobalPromise(member.object, state)) {
+            if (method === "all" || method === "allSettled")
+                return { kind: "aggregate", method };
+            if (method === "resolve" || method === "reject")
+                return { kind: "static", method };
+        }
+        if (method === "then" || method === "catch" || method === "finally")
+            return { kind: "chain", method };
+    }
+    if (t.isAwaitExpression(node) && !isPromiseProducer(node.argument, state))
+        return { kind: "awaited-expression", method: "await" };
+    return null;
+};
+const isUnshadowedGlobalPromise = (node, state) => resolveSemanticBindingState(state, node, "Promise") === undefined &&
+    !semanticResolutionBlocked(state, node, "Promise");
+const isPromiseProducer = (node, state) => promiseCandidateDetails(unwrapExpression(node), state) !== null;
+const semanticPromiseId = (kind, node) => `promise:${kind}:${String(node.start ?? -1)}:${String(node.end ?? -1)}`;
+const memberCallee = (node) => t.isMemberExpression(node.callee) || t.isOptionalMemberExpression(node.callee)
+    ? node.callee
+    : null;
+const promiseOwnership = (candidate, candidateByNode, state, callables) => {
+    if (candidate.kind === "awaited-expression")
+        return emptyOwnership("awaited");
+    const context = {
+        candidate,
+        candidateByNode,
+        state,
+        callables,
+    };
+    for (let index = candidate.ancestors.length - 1; index >= 0; index -= 1) {
+        const ancestor = candidate.ancestors[index];
+        if (ancestor === undefined)
+            continue;
+        const ownership = ownershipAtAncestor(ancestor, context);
+        if (ownership === "boundary")
+            break;
+        if (ownership !== null)
+            return ownership;
+    }
+    return emptyOwnership("unknown");
+};
+const ownershipAtAncestor = (ancestor, context) => {
+    const { candidate, candidateByNode, state, callables } = context;
+    if (t.isAwaitExpression(ancestor))
+        return emptyOwnership("awaited");
+    const outer = candidateByNode.get(ancestor);
+    if (outer !== undefined &&
+        outer.ownerCallableId === candidate.ownerCallableId &&
+        outerConsumesCandidate(outer, candidate))
+        return outer.kind === "chain"
+            ? emptyOwnership("chained")
+            : emptyOwnership("aggregated");
+    const assigned = assignedPromiseBinding(ancestor, state);
+    if (assigned !== undefined)
+        return {
+            ownership: "assigned",
+            ownerBindingId: assigned,
+            returnSiteId: null,
+        };
+    if (t.isReturnStatement(ancestor))
+        return returnedPromiseOwnership(candidate.ownerCallableId, range(ancestor), callables);
+    if (t.isExpressionStatement(ancestor))
+        return emptyOwnership("detached");
+    const callableId = semanticCallableIdForNode(ancestor);
+    if (callableId === null || callableId !== candidate.ownerCallableId)
+        return null;
+    return t.isArrowFunctionExpression(ancestor) &&
+        ancestor.body === candidate.node
+        ? returnedPromiseOwnership(candidate.ownerCallableId, range(candidate.node), callables)
+        : "boundary";
+};
+const assignedPromiseBinding = (ancestor, state) => {
+    if (t.isVariableDeclarator(ancestor) &&
+        ancestor.init !== null &&
+        t.isIdentifier(ancestor.id))
+        return (resolveSemanticBindingState(state, ancestor.id, ancestor.id.name)
+            ?.bindingId ?? null);
+    if (t.isAssignmentExpression(ancestor) && t.isIdentifier(ancestor.left))
+        return (resolveSemanticBindingState(state, ancestor.left, ancestor.left.name)
+            ?.bindingId ?? null);
+    return undefined;
+};
+const returnedPromiseOwnership = (callableId, location, callables) => ({
+    ownership: "returned",
+    ownerBindingId: null,
+    returnSiteId: matchingReturnSite(callableId, location, callables),
+});
+const outerConsumesCandidate = (outer, candidate) => {
+    if (outer.kind === "chain" &&
+        (t.isCallExpression(outer.node) || t.isOptionalCallExpression(outer.node))) {
+        const member = memberCallee(outer.node);
+        return member !== null && containsNode(member.object, candidate.node);
+    }
+    if (outer.kind === "aggregate" &&
+        (t.isCallExpression(outer.node) || t.isOptionalCallExpression(outer.node))) {
+        const input = outer.node.arguments[0];
+        return t.isNode(input) && containsNode(input, candidate.node);
+    }
+    return false;
+};
+const containsNode = (outer, inner) => outer.start !== null &&
+    outer.start !== undefined &&
+    outer.end !== null &&
+    outer.end !== undefined &&
+    inner.start !== null &&
+    inner.start !== undefined &&
+    inner.end !== null &&
+    inner.end !== undefined &&
+    outer.start <= inner.start &&
+    outer.end >= inner.end;
+const emptyOwnership = (ownership) => ({
+    ownership,
+    ownerBindingId: null,
+    returnSiteId: null,
+});
+const matchingReturnSite = (callableId, location, callables) => callables
+    .find(({ callableId: candidate }) => candidate === callableId)
+    ?.returnSites.find(({ location: candidate }) => sourceRangesEqual(candidate, location))?.returnSiteId ?? null;
+const promiseSources = (candidate, candidateByNode, state) => {
+    if (candidate.kind === "chain") {
+        const member = t.isCallExpression(candidate.node) ||
+            t.isOptionalCallExpression(candidate.node)
+            ? memberCallee(candidate.node)
+            : null;
+        return member === null
+            ? unresolvedPromise()
+            : resolvePromiseExpression(member.object, promiseResolutionContext(candidate, candidateByNode, state));
+    }
+    if (candidate.kind === "aggregate")
+        return aggregateSources(candidate, candidateByNode, state);
+    if (candidate.kind === "awaited-expression")
+        return t.isAwaitExpression(candidate.node)
+            ? resolvePromiseExpression(candidate.node.argument, promiseResolutionContext(candidate, candidateByNode, state))
+            : unresolvedPromise();
+    return { promiseIds: [], status: "complete" };
+};
+const aggregateSources = (candidate, candidateByNode, state) => {
+    if (!t.isCallExpression(candidate.node) &&
+        !t.isOptionalCallExpression(candidate.node))
+        return unresolvedPromise();
+    const input = candidate.node.arguments[0];
+    if (!t.isArrayExpression(input))
+        return unresolvedPromise();
+    const resolutions = input.elements.map((element) => {
+        if (element === null)
+            return completePromise();
+        if (t.isSpreadElement(element))
+            return unresolvedPromise();
+        if (isObviouslyNonPromise(element))
+            return completePromise();
+        return resolvePromiseExpression(element, promiseResolutionContext(candidate, candidateByNode, state));
+    });
+    return combinePromiseResolutions(resolutions);
+};
+const resolvePromiseExpression = (rawNode, context) => {
+    const { current, candidateByNode, state, seenBindings, depth } = context;
+    if (depth >= state.limits.maxValueDepth)
+        return unresolvedPromise();
+    const node = unwrapExpression(rawNode);
+    const direct = candidateByNode.get(node);
+    if (direct !== undefined && direct.promiseId !== current.promiseId)
+        return { promiseIds: [direct.promiseId], status: "complete" };
+    if (!t.isIdentifier(node))
+        return unresolvedPromise();
+    const binding = resolveSemanticBindingState(state, node, node.name);
+    if (binding === undefined ||
+        binding.mutable ||
+        binding.initializers.length !== 1 ||
+        seenBindings.has(binding.bindingId))
+        return unresolvedPromise();
+    const initializer = binding.initializers[0];
+    if (initializer === undefined || initializer.projection.length > 0)
+        return unresolvedPromise();
+    const nestedSeen = new Set(seenBindings);
+    nestedSeen.add(binding.bindingId);
+    return resolvePromiseExpression(initializer.node, {
+        ...context,
+        seenBindings: nestedSeen,
+        depth: depth + 1,
+    });
+};
+const promiseResolutionContext = (current, candidateByNode, state) => ({
+    current,
+    candidateByNode,
+    state,
+    seenBindings: new Set(),
+    depth: 0,
+});
+const unwrapExpression = (node) => {
+    if (t.isParenthesizedExpression(node) ||
+        t.isTSAsExpression(node) ||
+        t.isTSSatisfiesExpression(node) ||
+        t.isTSNonNullExpression(node) ||
+        t.isTypeCastExpression(node))
+        return unwrapExpression(node.expression);
+    return node;
+};
+const combinePromiseResolutions = (resolutions) => ({
+    promiseIds: resolutions.flatMap(({ promiseIds }) => promiseIds),
+    status: resolutions.some(({ status }) => status === "unresolved")
+        ? resolutions.some(({ status }) => status === "complete")
+            ? "partial"
+            : "unresolved"
+        : resolutions.some(({ status }) => status === "partial")
+            ? "partial"
+            : "complete",
+});
+const completePromise = () => ({
+    promiseIds: [],
+    status: "complete",
+});
+const unresolvedPromise = () => ({
+    promiseIds: [],
+    status: "unresolved",
+});
+const isObviouslyNonPromise = (node) => t.isLiteral(node) ||
+    t.isObjectExpression(node) ||
+    t.isFunction(node) ||
+    t.isClassExpression(node);

package/dist/domain/javascriptSemanticResources.js

@@ -0,0 +1,136 @@
+import * as t from "@babel/types";
+import { semanticStaticPropertyName } from "./javascriptSemanticProjection.js";
+import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { dataEffectLimitReached, outerDataEffectBinding, traverseDataEffects, } from "./javascriptSemanticDataEffectHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
+const ACQUIRE_METHODS = [
+    "open",
+    "openSync",
+    "createReadStream",
+    "createWriteStream",
+    "connect",
+    "createConnection",
+];
+const RELEASE_METHODS = ["close", "destroy", "end"];
+/** Recover built-in filesystem/network acquisition and local release handles. */
+export const collectJavaScriptSemanticResources = (program, state, callables) => {
+    const context = {
+        state,
+        callableIds: new Set(callables.map(({ callableId }) => callableId)),
+        callableStack: [],
+        ancestors: [],
+    };
+    const acquisitions = collectAcquisitions(program, context);
+    return [
+        ...acquisitions.map(immutableAcquisition),
+        ...collectReleases(program, context, acquisitions),
+    ];
+};
+const collectAcquisitions = (program, context) => {
+    const output = [];
+    traverseDataEffects(program, context, (node) => {
+        if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
+            return;
+        const method = acquisitionMethod(node.callee, context.state);
+        if (method === null)
+            return;
+        if (resourceLimitReached(output.length, context.state))
+            return;
+        output.push({
+            node,
+            method,
+            ownerCallableId: context.callableStack.at(-1) ?? null,
+            resultBindingId: outerDataEffectBinding(node, context),
+        });
+    });
+    return output;
+};
+const collectReleases = (program, context, acquisitions) => {
+    const byBinding = new Map();
+    for (const acquisition of acquisitions) {
+        if (acquisition.resultBindingId === null)
+            continue;
+        const existing = byBinding.get(acquisition.resultBindingId) ?? [];
+        existing.push(acquisition);
+        byBinding.set(acquisition.resultBindingId, existing);
+    }
+    const output = [];
+    traverseDataEffects(program, context, (node) => {
+        if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
+            return;
+        const member = memberCallee(node);
+        if (member === null || !t.isIdentifier(member.object))
+            return;
+        const method = RELEASE_METHODS.find((candidate) => candidate ===
+            semanticStaticPropertyName(member.property, member.computed));
+        if (method === undefined)
+            return;
+        const binding = resolveSemanticBindingState(context.state, member.object, member.object.name);
+        const linked = binding === undefined ? [] : (byBinding.get(binding.bindingId) ?? []);
+        if (linked.length === 0)
+            return;
+        if (resourceLimitReached(acquisitions.length + output.length, context.state))
+            return;
+        output.push({
+            resourceId: `resource:release:${String(node.start ?? -1)}:${String(node.end ?? -1)}`,
+            kind: "release",
+            method,
+            location: range(node),
+            ownerCallableId: context.callableStack.at(-1) ?? null,
+            resultBindingId: binding?.bindingId ?? null,
+            linkedResourceIds: linked.map(resourceCandidateId).sort(),
+            resolution: linked.length === 1 ? "complete" : "partial",
+        });
+    });
+    return output;
+};
+const immutableAcquisition = (candidate) => ({
+    resourceId: resourceCandidateId(candidate),
+    kind: "acquire",
+    method: candidate.method,
+    location: range(candidate.node),
+    ownerCallableId: candidate.ownerCallableId,
+    resultBindingId: candidate.resultBindingId,
+    linkedResourceIds: [],
+    resolution: "complete",
+});
+const acquisitionMethod = (callee, state) => {
+    if (t.isIdentifier(callee)) {
+        const binding = resolveSemanticBindingState(state, callee, callee.name);
+        return methodFromBinding(binding);
+    }
+    if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee))
+        return null;
+    const method = ACQUIRE_METHODS.find((candidate) => candidate ===
+        semanticStaticPropertyName(callee.property, callee.computed));
+    if (method === undefined || !t.isIdentifier(callee.object))
+        return null;
+    const binding = resolveSemanticBindingState(state, callee.object, callee.object.name);
+    return resourceNamespace(binding) ? method : null;
+};
+const methodFromBinding = (binding) => {
+    for (const { specifier, importedPath } of binding?.directOrigins ?? []) {
+        if (!resourceModule(specifier))
+            continue;
+        const method = ACQUIRE_METHODS.find((candidate) => candidate === importedPath.at(-1));
+        if (method !== undefined)
+            return method;
+    }
+    return null;
+};
+const resourceNamespace = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => resourceModule(specifier) && importedPath.length === 0) ?? false;
+const resourceModule = (specifier) => [
+    "fs",
+    "fs/promises",
+    "net",
+    "node:fs",
+    "node:fs/promises",
+    "node:net",
+    "node:tls",
+    "tls",
+].includes(specifier);
+const resourceLimitReached = (retained, state) => dataEffectLimitReached(retained, state.limits.maxResourceOperations, "maxResourceOperations", state);
+const resourceCandidateId = (candidate) => `resource:acquire:${String(candidate.node.start ?? -1)}:${String(candidate.node.end ?? -1)}`;
+const memberCallee = (node) => t.isMemberExpression(node.callee) || t.isOptionalMemberExpression(node.callee)
+    ? node.callee
+    : null;

package/dist/domain/javascriptStaticAnalysis.js

@@ -3,7 +3,7 @@ import * as t from "@babel/types";
 import { inspectElectronStaticNode } from "./electronStaticAnalysis.js";
 import { detectVendors, failedJavaScriptStaticAnalysis, registrationKey, sortedUnique, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty, inspectRoleProperty, } from "./javascriptStaticAnalysisCalls.js";
-import { inspectBundlerRegistration } from "./javascriptStaticAnalysisBundler.js";
+import { inspectBundlerRegistration, inspectEsbuildWrapper, } from "./javascriptStaticAnalysisBundler.js";
 import { finalizeLocatedFindings } from "./javascriptStaticAnalysisFindings.js";
 import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
 /** Parse one bounded JavaScript artifact and recover static structure only. */
@@ -100,10 +100,11 @@ const inspectNode = (source, node, accumulator, limits) => {
     inspectElectronStaticNode(node, findings);
     if (t.isCallExpression(node)) {
         inspectBundlerRegistration(source, node, accumulator, limits);
-        inspectCall(node, findings);
+        inspectEsbuildWrapper(source, node, accumulator, limits);
+        inspectCall(source, node, findings);
     }
     else if (t.isNewExpression(node))
-        inspectCall(node, findings);
+        inspectCall(source, node, findings);
     if ((t.isImportDeclaration(node) || t.isExportAllDeclaration(node)) &&
         node.source !== undefined)
         addReference(findings, {

package/dist/domain/javascriptStaticAnalysisBundler.js

@@ -61,6 +61,44 @@ export const inspectBundlerRegistration = (source, call, accumulator, limits) =>
     };
     addBoundedFinding(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
 };
+/** Inspect esbuild helper wrappers and recover their literal module tables. */
+export const inspectEsbuildWrapper = (source, call, accumulator, limits) => {
+    const name = calleeName(call.callee);
+    const wrapperKind = name === "__commonJS" || name.endsWith(".__commonJS")
+        ? "commonjs"
+        : name === "__esm" || name.endsWith(".__esm")
+            ? "esm"
+            : null;
+    const table = call.arguments[0];
+    if (wrapperKind === null || !t.isObjectExpression(table))
+        return;
+    const recovered = recoverBundlerModules(source, table, accumulator, limits);
+    if (recovered.modules.length === 0)
+        return;
+    if (recovered.omittedAsyncChunkKeys > 0) {
+        accumulator.droppedFindings += recovered.omittedAsyncChunkKeys;
+        accumulator.structuralTruncation = true;
+    }
+    accumulator.unknownFindings += recovered.unknownAsyncChunkKeys;
+    const registration = {
+        bundler: "esbuild",
+        runtime: `esbuild-${wrapperKind}`,
+        chunk_keys: [`${wrapperKind}@${String(call.start ?? 0)}`],
+        omitted_chunk_keys: 0,
+        unknown_chunk_keys: 0,
+        runtime_require_name: null,
+        runtime_module_cache_status: "not-observed",
+        entry_module_keys: [],
+        omitted_entry_module_keys: 0,
+        unknown_entry_module_keys: 0,
+        async_chunk_keys: recovered.asyncChunkKeys,
+        omitted_async_chunk_keys: recovered.omittedAsyncChunkKeys,
+        unknown_async_chunk_keys: recovered.unknownAsyncChunkKeys,
+        modules: recovered.modules.sort((left, right) => compareCodePoints(left.module_key, right.module_key)),
+        location: range(call),
+    };
+    addBoundedFinding(accumulator, `registration\0${registrationKey(registration)}`, limits.maxFindings, () => accumulator.registrations.push(registration));
+};
 const recoverBundlerModules = (source, table, accumulator, limits) => {
     const modules = [];
     const asyncChunkKeys = [];

package/dist/domain/javascriptStaticAnalysisCalls.js

@@ -2,7 +2,7 @@ import * as t from "@babel/types";
 import { addBoundedFinding, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
 import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, propertyName, range, rangeForOffsets, sanitizeCandidate, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
-export const inspectCall = (node, context) => {
+export const inspectCall = (source, node, context) => {
     const { accumulator } = context;
     const name = calleeName(node.callee);
     const first = stringValue(node.arguments[0]);
@@ -22,6 +22,8 @@ export const inspectCall = (node, context) => {
             kind: "dynamic-import",
             specifier: chunkLoad.specifier,
         });
+    for (const specifier of vitePreloadDependencySpecifiers(source, node, name))
+        addReference(context, { node, kind: "dynamic-import", specifier });
     if (name === "Worker" || name.endsWith(".Worker"))
         addReference(context, { node, kind: "worker", specifier: first });
     if (name.endsWith("serviceWorker.register"))
@@ -73,6 +75,26 @@ const chunkLoadSpecifier = (node, name, moduleRequireName) => {
         return null;
     return { specifier: prefixedArgument("chunk:", node.arguments[0]) };
 };
+const vitePreloadDependencySpecifiers = (source, node, name) => {
+    if (name !== "__vite__mapDeps" || !t.isArrayExpression(node.arguments[0]))
+        return [];
+    const indexes = node.arguments[0].elements.flatMap((element) => t.isNumericLiteral(element) ? [element.value] : []);
+    if (indexes.length !== node.arguments[0].elements.length)
+        return [];
+    const table = vitePreloadDependencyTable(source);
+    return indexes.flatMap((index) => table[index] ?? []);
+};
+const vitePreloadDependencyTable = (source) => {
+    const match = /\.\s*f\s*\|\|\s*\(\s*[^)]*?\.f\s*=\s*\[([\s\S]*?)\]\s*\)/u.exec(source);
+    const body = match?.[1];
+    if (body === undefined)
+        return [];
+    return [
+        ...body.matchAll(/"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gu),
+    ]
+        .map((literal) => (literal[1] ?? literal[2] ?? "").slice(0, 4_096))
+        .slice(0, 256);
+};
 const inspectEndpointCall = (node, name, first, context) => {
     const route = STATIC_ROUTE_CALL_NAMES.some((candidate) => name === candidate || name.endsWith(`.${candidate}`));
     if (route && first !== undefined)

package/dist/domain/javascriptStaticAnalysisHelpers.js

@@ -294,6 +294,12 @@ export const rangeForOffsets = (source, start, end) => ({
     start: pointForOffset(source, start),
     end: pointForOffset(source, end),
 });
+/** Compare two exact source ranges. */
+export const sourceRangesEqual = (left, right) => left !== null &&
+    left.start.line === right.start.line &&
+    left.start.column === right.start.column &&
+    left.end.line === right.end.line &&
+    left.end.column === right.end.column;
 const pointForOffset = (source, offset) => {
     const before = source.slice(0, offset);
     const lines = before.split("\n");
@@ -335,6 +341,8 @@ const vendorPatterns = [
     { name: "webpack", patterns: ["__webpack_require__", "webpackChunk"] },
     { name: "Rspack", patterns: ["__webpack_require__.f", "rspackChunk"] },
     { name: "Vite", patterns: ["__vite__", "import.meta.hot"] },
+    { name: "Rollup", patterns: ["ROLLUP_FILE_URL", "import.meta.ROLLUP"] },
+    { name: "esbuild", patterns: ["__commonJS", "__esm"] },
     { name: "React", patterns: ["React.createElement", "react/jsx-runtime"] },
     { name: "Vue", patterns: ["__VUE__", "createApp("] },
     { name: "Next.js", patterns: ["__NEXT_DATA__", "/_next/"] },