rea-agents 3.2.1 → 4.0.1

package/dist/domain/javascriptSemanticGraphSchemas.js

@@ -1,9 +1,10 @@
 import { z } from "zod";
 import { applicationGraphEvidenceSchema } from "./javascriptApplicationEvidenceSchemas.js";
 import { jsonValueSchema } from "./jsonValue.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
 const boundedTextSchema = z.string().min(1);
-const semanticNodeIdSchema = z.string().regex(/^jsrg_node_[a-f0-9]{64}$/u);
+const semanticNodeIdSchema = prefixedDigestSchema("jsrg_node");
 const semanticRelationIdSchema = z
     .string()
     .regex(/^jsrg_relation_[a-f0-9]{64}$/u);
@@ -180,7 +181,7 @@ export const javaScriptSemanticNodeInputSchema = z.strictObject({
     kind: z.enum(JAVASCRIPT_SEMANTIC_NODE_KINDS),
     identity: semanticNodeIdentitySchema,
     function_node_id: semanticNodeIdSchema.nullable(),
-    application_node_ids: z.array(z.string().regex(/^jag_node_[a-f0-9]{64}$/u)),
+    application_node_ids: z.array(prefixedDigestSchema("jag_node")),
     label: z.string().min(1).nullable(),
     properties: semanticPropertiesSchema,
     evidence: applicationGraphEvidenceSchema,
@@ -216,6 +217,7 @@ export const JAVASCRIPT_SEMANTIC_UNKNOWN_REASONS = [
     "bound-reached",
     "dynamic-call",
     "dynamic-property",
+    "dynamic-scope",
     "eval-or-generated-code",
     "incomplete-module",
     "missing-source",
@@ -262,7 +264,7 @@ export const javaScriptSemanticFingerprintInputSchema = z.strictObject({
 });
 /** One canonical function fingerprint record. */
 export const javaScriptSemanticFingerprintSchema = javaScriptSemanticFingerprintInputSchema.extend({
-    fingerprint_id: z.string().regex(/^jsrg_fingerprint_[a-f0-9]{64}$/u),
+    fingerprint_id: prefixedDigestSchema("jsrg_fingerprint"),
     fingerprint_sha256: digestSchema,
 });
 const familyCoverageSchema = z.strictObject({
@@ -288,7 +290,7 @@ const graphCoverageSchema = z.strictObject({
 export const javaScriptSemanticGraphInputSchema = z.strictObject({
     schema: z.literal("JavaScriptSemanticRelationGraph"),
     root_artifact_sha256: digestSchema,
-    application_graph_id: z.string().regex(/^jag_[a-f0-9]{64}$/u),
+    application_graph_id: prefixedDigestSchema("jag"),
     root_node_ids: z.array(semanticNodeIdSchema).min(1),
     nodes: z.array(javaScriptSemanticNodeSchema).min(1),
     relations: z.array(javaScriptSemanticRelationSchema),
@@ -299,5 +301,5 @@ export const javaScriptSemanticGraphInputSchema = z.strictObject({
 });
 /** Stored JavaScript Semantic Relation Graph. */
 export const javaScriptSemanticGraphRecordSchema = javaScriptSemanticGraphInputSchema.extend({
-    graph_id: z.string().regex(/^jsrg_[a-f0-9]{64}$/u),
+    graph_id: prefixedDigestSchema("jsrg"),
 });

package/dist/domain/javascriptSemanticObjects.js

@@ -1,8 +1,8 @@
 import * as t from "@babel/types";
-import { semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
+import { semanticCallableIdForNode, semanticReadsBeforeWrite, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { propertyName, range } from "./javascriptStaticAnalysisHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
 /** Recover bounded static property reads, writes, spreads, and destructuring. */
 export const collectJavaScriptSemanticObjects = (program, state, callables) => {
     const output = [];
@@ -46,6 +46,16 @@ const collectMember = (node, parent, ownerCallableId, context) => {
         return;
     const write = (t.isAssignmentExpression(parent) && parent.left === node) ||
         (t.isUpdateExpression(parent) && parent.argument === node);
+    const readsBeforeWrite = write && semanticReadsBeforeWrite(node, parent);
+    if (readsBeforeWrite)
+        addObjectOperation({
+            node,
+            kind: "read",
+            ownerCallableId,
+            objectBindingId: expressionBindingId(node.object, state),
+            targetBindingId: null,
+            propertyName: name,
+        }, state, output);
     addObjectOperation({
         node,
         kind: write ? "write" : "read",
@@ -62,7 +72,7 @@ const collectDestructuring = (node, ownerCallableId, state, output) => {
     for (const property of node.id.properties) {
         if (!t.isObjectProperty(property))
             continue;
-        const name = propertyName(property.key);
+        const name = semanticStaticPropertyName(property.key, property.computed);
         if (name.length === 0)
             continue;
         const target = bindingIdentifier(property.value);

package/dist/domain/javascriptSemanticProjection.js

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
-import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
+import { resolveSemanticBindingState, semanticResolutionBlocked, isUnshadowedGlobal, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { evaluateSemanticBinding, evaluateSemanticProvenance, } from "./javascriptSemanticValues.js";
 import { compareCodePoints, propertyName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Retain callable identity without polluting lexical bindings. */
 export const collectSemanticCallable = (input) => {
     const { node, parent, containerScope, bodyScope, state } = input;
@@ -63,26 +64,37 @@ export const collectSemanticReferences = (program, state) => {
     const output = [];
     const seen = new Set();
     traverseJavaScriptAst(program, {
-        enter: (node, parent) => {
+        enter: (node, parent, ancestors) => {
             if (!t.isIdentifier(node) || parent === null)
                 return;
-            const role = semanticReferenceRole(node, parent);
+            const role = semanticIdentifierRole(node, parent, ancestors);
             if (role === null)
                 return;
-            const key = `${String(node.start)}:${role}:${node.name}`;
-            if (seen.has(key))
-                return;
-            seen.add(key);
-            const binding = resolveSemanticBindingState(state, node, node.name);
-            const blocked = binding === undefined &&
-                semanticResolutionBlocked(state, node, node.name);
-            output.push({
-                name: node.name,
-                role,
-                location: range(node),
-                bindingId: binding?.bindingId ?? null,
-                resolution: binding !== undefined ? "resolved" : blocked ? "unknown" : "unbound",
-            });
+            // A compound assignment or update reads before it writes; emit both so
+            // reference consumers see the read they actually execute.
+            const roles = role === "write" && semanticReadsBeforeWrite(node, parent)
+                ? ["read", "write"]
+                : [role];
+            for (const resolvedRole of roles) {
+                const key = `${String(node.start)}:${resolvedRole}:${node.name}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const binding = resolveSemanticBindingState(state, node, node.name);
+                const blocked = binding === undefined &&
+                    semanticResolutionBlocked(state, node, node.name);
+                output.push({
+                    name: node.name,
+                    role: resolvedRole,
+                    location: range(node),
+                    bindingId: binding?.bindingId ?? null,
+                    resolution: binding !== undefined
+                        ? "resolved"
+                        : blocked
+                            ? "unknown"
+                            : "unbound",
+                });
+            }
         },
     });
     return output;
@@ -112,10 +124,10 @@ export const immutableSemanticBindings = (state) => [...state.bindingsById.value
 }))
     .sort((left, right) => compareCodePoints(left.bindingId, right.bindingId));
 /** Recover a literal require origin plus an optional member chain. */
-export const semanticModuleOrigin = (node, projection) => {
+const semanticModuleOrigin = (node, projection, state) => {
     if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
         const nested = t.isNode(node.object)
-            ? semanticModuleOrigin(node.object, projection)
+            ? semanticModuleOrigin(node.object, projection, state)
             : undefined;
         const member = semanticStaticPropertyName(node.property, node.computed);
         return nested === undefined || member === ""
@@ -125,6 +137,9 @@ export const semanticModuleOrigin = (node, projection) => {
     if (!t.isCallExpression(node) ||
         !t.isIdentifier(node.callee, { name: "require" }))
         return undefined;
+    if (resolveSemanticBindingState(state, node.callee, "require") !== undefined ||
+        semanticResolutionBlocked(state, node.callee, "require"))
+        return undefined;
     const specifier = stringValue(node.arguments[0]);
     return specifier === undefined || projection.includes(null)
         ? undefined
@@ -133,10 +148,7 @@ export const semanticModuleOrigin = (node, projection) => {
             importedPath: projection.map((segment) => String(segment)),
         };
 };
-/** Read a property only when its syntax commits an exact name. */
-export const semanticStaticPropertyName = (property, computed) => computed && !t.isStringLiteral(property) && !t.isNumericLiteral(property)
-    ? ""
-    : propertyName(property);
+export { semanticStaticPropertyName } from "./javascriptAstValues.js";
 const callableKind = (node) => {
     if (t.isClassMethod(node) ||
         t.isClassPrivateMethod(node) ||
@@ -160,7 +172,10 @@ const callableName = (node, parent) => {
         t.isObjectMethod(node)) {
         if (t.isPrivateName(node.key))
             return `#${node.key.id.name}`;
-        return propertyName(node.key) || `[computed@${String(node.start ?? -1)}]`;
+        // `{[key]() {}}` names nothing statically; reading `key` off the key node
+        // would report the variable name as the method name.
+        return (semanticStaticPropertyName(node.key, node.computed) ||
+            `[computed@${String(node.start ?? -1)}]`);
     }
     if (parent !== null &&
         t.isVariableDeclarator(parent) &&
@@ -216,7 +231,7 @@ const collectNamedExports = (node, state) => {
             });
 };
 const collectRequireLink = (node, state) => {
-    const origin = semanticModuleOrigin(node.init, []);
+    const origin = semanticModuleOrigin(node.init, [], state);
     if (origin === undefined)
         return;
     for (const binding of requirePatternBindings(node.id, origin.importedPath))
@@ -252,10 +267,10 @@ const requirePatternBindings = (pattern, path) => {
     return [];
 };
 const collectCommonJsExport = (node, state) => {
-    const exportedName = commonJsExportName(node.left);
+    const exportedName = commonJsExportName(node.left, state);
     if (exportedName === undefined)
         return;
-    const origin = semanticModuleOrigin(node.right, []);
+    const origin = semanticModuleOrigin(node.right, [], state);
     addModuleLink(state, {
         kind: "commonjs-export",
         specifier: origin?.specifier ?? null,
@@ -288,12 +303,98 @@ const declarationCallableId = (declaration, localName) => {
         ? null
         : semanticCallableIdForNode(declarator.init);
 };
+/**
+ * True when writing `node` also reads it first: a compound assignment
+ * (`+=`, `||=`, …) or an update (`++`/`--`). A plain `=` writes only.
+ *
+ * One predicate serves both member operations and identifier references so the
+ * two can never disagree about what counts as a read-modify-write.
+ */
+export const semanticReadsBeforeWrite = (node, parent) => (t.isAssignmentExpression(parent) &&
+    parent.left === node &&
+    parent.operator !== "=") ||
+    (t.isUpdateExpression(parent) && parent.argument === node);
+/**
+ * Role of one identifier occurrence, given the node's ancestry.
+ *
+ * A binding inside a destructuring pattern has an ObjectProperty/ArrayPattern
+ * as its direct parent, so the immediate parent cannot tell a declaration
+ * (`const {a} = o`, `catch ({message})`) from an assignment target
+ * (`({a} = o)`, `for (a of list)`). Walking the ancestry to the nearest
+ * pattern-owning construct is what makes the distinction possible.
+ */
+export const semanticIdentifierRole = (node, parent, ancestors) => {
+    const patternAncestor = enclosingPatternAncestor(node, parent, ancestors);
+    if (patternAncestor !== null) {
+        if (isPatternOwnerDeclaration(patternAncestor))
+            return null;
+        return "write";
+    }
+    return semanticReferenceRole(node, parent);
+};
+/**
+ * The nearest ancestor that owns this identifier as a *bound* pattern slot, or
+ * null when the identifier is not being bound. A binding inside a pattern has
+ * an ObjectProperty/ArrayPattern parent, so the immediate parent cannot say
+ * whether the identifier declares a binding or is assigned to.
+ *
+ * Only the bound side counts: `{a = compute()}` binds `a` but merely *reads*
+ * `compute`, so the default-value side must not be mistaken for a binding.
+ */
+const enclosingPatternAncestor = (node, parent, ancestors) => {
+    const chain = [...ancestors, parent];
+    for (let index = chain.length - 1; index >= 0; index -= 1) {
+        const ancestor = chain[index];
+        if (ancestor === undefined || !isPatternNode(ancestor))
+            continue;
+        if (!bindsIdentifier(ancestor, parent, node))
+            continue;
+        // Found the binding slot; now find what owns the pattern.
+        for (let owner = index - 1; owner >= 0; owner -= 1) {
+            const candidate = chain[owner];
+            if (candidate === undefined)
+                continue;
+            if (t.isAssignmentExpression(candidate) ||
+                t.isForInStatement(candidate) ||
+                t.isForOfStatement(candidate))
+                return candidate;
+            if (isPatternOwnerDeclaration(candidate))
+                return candidate;
+        }
+        return null;
+    }
+    return null;
+};
+/** True when `parent` places `node` in the bound slot of `pattern`. */
+const bindsIdentifier = (pattern, parent, node) => {
+    // The identifier sits directly in the pattern: `[b]`, `({b})`, `{b = 1}`.
+    if (parent === pattern)
+        return patternContains(pattern, node);
+    if (t.isObjectPattern(pattern))
+        return (t.isObjectProperty(parent) &&
+            (parent.value === node || (parent.shorthand && parent.key === node)));
+    if (t.isArrayPattern(pattern))
+        return pattern.elements.some((element) => element === parent);
+    if (t.isAssignmentPattern(pattern))
+        return pattern.left === parent;
+    return t.isRestElement(pattern) && pattern.argument === parent;
+};
+const isPatternNode = (node) => t.isObjectPattern(node) ||
+    t.isArrayPattern(node) ||
+    t.isAssignmentPattern(node) ||
+    t.isRestElement(node);
+const isPatternOwnerDeclaration = (node) => (t.isVariableDeclarator(node) && t.isPattern(node.id)) ||
+    (t.isFunction(node) &&
+        node.params.some((value) => t.isPattern(value))) ||
+    (t.isCatchClause(node) && node.param !== null && t.isPattern(node.param));
 /** Classify one identifier occurrence consistently with semantic references. */
 export const semanticReferenceRole = (node, parent) => {
     if (isDeclarationIdentifier(node, parent) || isNonReferenceKey(node, parent))
         return null;
     if ((t.isAssignmentExpression(parent) && parent.left === node) ||
-        t.isUpdateExpression(parent))
+        t.isUpdateExpression(parent) ||
+        ((t.isForInStatement(parent) || t.isForOfStatement(parent)) &&
+            parent.left === node))
         return "write";
     if (t.isExportSpecifier(parent) && parent.local === node)
         return "export";
@@ -361,20 +462,25 @@ const defaultDeclarationName = (declaration) => (t.isFunctionDeclaration(declara
     t.isIdentifier(declaration.id)
     ? declaration.id.name
     : null;
-const commonJsExportName = (node) => {
-    if (t.isIdentifier(node, { name: "exports" }))
+const commonJsExportName = (node, state) => {
+    if (isUnshadowedGlobal(node, state, "exports"))
         return "default";
     if (!t.isMemberExpression(node) && !t.isOptionalMemberExpression(node))
         return undefined;
-    const name = propertyName(node.property);
-    if (t.isIdentifier(node.object, { name: "exports" }))
-        return name || "*";
+    const key = memberKey(node);
+    // `exports[key]`/`module.exports[key]` assign an export whose name is not
+    // knowable. Report the wildcard rather than the variable name, and never
+    // collapse it into `default`, which would claim a real default export.
+    if (isUnshadowedGlobal(node.object, state, "exports"))
+        return key === null ? "*" : key || "*";
     if (t.isMemberExpression(node.object) &&
-        t.isIdentifier(node.object.object, { name: "module" }) &&
-        propertyName(node.object.property) === "exports")
-        return name || "default";
-    if (t.isIdentifier(node.object, { name: "module" }) &&
-        propertyName(node.property) === "exports")
+        isUnshadowedGlobal(node.object.object, state, "module") &&
+        memberKey(node.object) === "exports")
+        return key === null ? "*" : key || "default";
+    if (isUnshadowedGlobal(node.object, state, "module") &&
+        memberKey(node) === "exports")
         return "default";
     return undefined;
 };
+/** Exact member key, or null when a computed key commits no name. */
+const memberKey = (node) => semanticStaticPropertyName(node.property, node.computed) || null;

package/dist/domain/javascriptSemanticPromises.js

@@ -3,6 +3,7 @@ import { semanticCallableIdForNode, semanticStaticPropertyName, } from "./javasc
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { compareCodePoints, range, sourceRangesEqual, } from "./javascriptStaticAnalysisHelpers.js";
+import { assignedSemanticResultBindings, containsSemanticNode, dataEffectMemberCallee, scalarAssignedResultBinding, } from "./javascriptSemanticDataEffectHelpers.js";
 /** Recover explicit Promise construction, chaining, aggregation, and ownership. */
 export const collectJavaScriptSemanticPromises = (program, state, callables) => {
     const candidates = collectCandidates(program, state, callables);
@@ -61,7 +62,7 @@ const promiseCandidateDetails = (node, state) => {
         isUnshadowedGlobalPromise(node.callee, state))
         return { kind: "constructor", method: "new" };
     if (t.isCallExpression(node) || t.isOptionalCallExpression(node)) {
-        const member = memberCallee(node);
+        const member = dataEffectMemberCallee(node);
         if (member === null)
             return null;
         const method = semanticStaticPropertyName(member.property, member.computed);
@@ -83,9 +84,6 @@ const isUnshadowedGlobalPromise = (node, state) => resolveSemanticBindingState(s
     !semanticResolutionBlocked(state, node, "Promise");
 const isPromiseProducer = (node, state) => promiseCandidateDetails(unwrapExpression(node), state) !== null;
 const semanticPromiseId = (kind, node) => `promise:${kind}:${String(node.start ?? -1)}:${String(node.end ?? -1)}`;
-const memberCallee = (node) => t.isMemberExpression(node.callee) || t.isOptionalMemberExpression(node.callee)
-    ? node.callee
-    : null;
 const promiseOwnership = (candidate, candidateByNode, state, callables) => {
     if (candidate.kind === "awaited-expression")
         return emptyOwnership("awaited");
@@ -138,15 +136,14 @@ const ownershipAtAncestor = (ancestor, context) => {
         : "boundary";
 };
 const assignedPromiseBinding = (ancestor, state) => {
-    if (t.isVariableDeclarator(ancestor) &&
-        ancestor.init !== null &&
-        t.isIdentifier(ancestor.id))
-        return (resolveSemanticBindingState(state, ancestor.id, ancestor.id.name)
-            ?.bindingId ?? null);
-    if (t.isAssignmentExpression(ancestor) && t.isIdentifier(ancestor.left))
-        return (resolveSemanticBindingState(state, ancestor.left, ancestor.left.name)
-            ?.bindingId ?? null);
-    return undefined;
+    if (!t.isVariableDeclarator(ancestor) && !t.isAssignmentExpression(ancestor))
+        return undefined;
+    const source = t.isVariableDeclarator(ancestor)
+        ? ancestor.init
+        : ancestor.right;
+    if (source == null)
+        return undefined;
+    return scalarAssignedResultBinding(assignedSemanticResultBindings(source, [ancestor], state));
 };
 const returnedPromiseOwnership = (callableId, location, callables) => ({
     ownership: "returned",
@@ -156,26 +153,16 @@ const returnedPromiseOwnership = (callableId, location, callables) => ({
 const outerConsumesCandidate = (outer, candidate) => {
     if (outer.kind === "chain" &&
         (t.isCallExpression(outer.node) || t.isOptionalCallExpression(outer.node))) {
-        const member = memberCallee(outer.node);
-        return member !== null && containsNode(member.object, candidate.node);
+        const member = dataEffectMemberCallee(outer.node);
+        return (member !== null && containsSemanticNode(member.object, candidate.node));
     }
     if (outer.kind === "aggregate" &&
         (t.isCallExpression(outer.node) || t.isOptionalCallExpression(outer.node))) {
         const input = outer.node.arguments[0];
-        return t.isNode(input) && containsNode(input, candidate.node);
+        return t.isNode(input) && containsSemanticNode(input, candidate.node);
     }
     return false;
 };
-const containsNode = (outer, inner) => outer.start !== null &&
-    outer.start !== undefined &&
-    outer.end !== null &&
-    outer.end !== undefined &&
-    inner.start !== null &&
-    inner.start !== undefined &&
-    inner.end !== null &&
-    inner.end !== undefined &&
-    outer.start <= inner.start &&
-    outer.end >= inner.end;
 const emptyOwnership = (ownership) => ({
     ownership,
     ownerBindingId: null,
@@ -188,7 +175,7 @@ const promiseSources = (candidate, candidateByNode, state) => {
     if (candidate.kind === "chain") {
         const member = t.isCallExpression(candidate.node) ||
             t.isOptionalCallExpression(candidate.node)
-            ? memberCallee(candidate.node)
+            ? dataEffectMemberCallee(candidate.node)
             : null;
         return member === null
             ? unresolvedPromise()

package/dist/domain/javascriptSemanticQuerySchemas.js

@@ -1,8 +1,9 @@
 import { z } from "zod";
 import { JAVASCRIPT_SEMANTIC_NODE_KINDS, JAVASCRIPT_SEMANTIC_RELATIONS, javaScriptSemanticNodeSchema, javaScriptSemanticRelationSchema, javaScriptSemanticUnknownSchema, } from "./javascriptSemanticGraphSchemas.js";
 import { jsonValueSchema } from "./jsonValue.js";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const semanticNodeIdSchema = z.string().regex(/^jsrg_node_[a-f0-9]{64}$/u);
+import { digestSchema } from "./../domain/digests.js";
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const semanticNodeIdSchema = prefixedDigestSchema("jsrg_node");
 const literalSeedSchema = z.strictObject({
     kind: z.literal("literal"),
     value: jsonValueSchema.refine((value) => value === null ||
@@ -18,7 +19,7 @@ export const javaScriptSemanticQuerySeedSchema = z.discriminatedUnion("kind", [
     }),
     z.strictObject({
         kind: z.literal("application-node"),
-        node_id: z.string().regex(/^jag_node_[a-f0-9]{64}$/u),
+        node_id: prefixedDigestSchema("jag_node"),
     }),
     literalSeedSchema,
     z.strictObject({
@@ -42,9 +43,6 @@ export const javaScriptSemanticQuerySeedSchema = z.discriminatedUnion("kind", [
         field: z.string().min(1),
     }),
 ]);
-const sourceMapAuthoritySchema = z.strictObject({
-    authority: z.literal("none"),
-});
 /** Parsed pure-domain query over one authenticated companion graph. */
 export const javaScriptSemanticQueryInputSchema = z.strictObject({
     seed: javaScriptSemanticQuerySeedSchema,
@@ -66,12 +64,11 @@ export const javaScriptSemanticQueryInputSchema = z.strictObject({
     })
         .nullable()
         .default(null),
-    source_map_authority: sourceMapAuthoritySchema.default({ authority: "none" }),
 });
 /** Deterministic semantic trace result. */
 export const javaScriptSemanticQueryResultSchema = z.strictObject({
-    query_id: z.string().regex(/^jsrq_[a-f0-9]{64}$/u),
-    source_graph_id: z.string().regex(/^jsrg_[a-f0-9]{64}$/u),
+    query_id: prefixedDigestSchema("jsrq"),
+    source_graph_id: prefixedDigestSchema("jsrg"),
     seed: javaScriptSemanticQuerySeedSchema,
     direction: javaScriptSemanticQueryInputSchema.shape.direction,
     status: z.enum(["found", "no-match", "ambiguous", "partial", "unsupported"]),

package/dist/domain/javascriptSemanticResources.js

@@ -1,7 +1,7 @@
 import * as t from "@babel/types";
 import { semanticStaticPropertyName } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
-import { outerDataEffectBinding, traverseDataEffects, } from "./javascriptSemanticDataEffectHelpers.js";
+import { dataEffectMemberCallee, outerDataEffectBinding, traverseDataEffects, } from "./javascriptSemanticDataEffectHelpers.js";
 import { range } from "./javascriptStaticAnalysisHelpers.js";
 const ACQUIRE_METHODS = [
     "open",
@@ -56,7 +56,7 @@ const collectReleases = (program, context, acquisitions) => {
     traverseDataEffects(program, context, (node) => {
         if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
             return;
-        const member = memberCallee(node);
+        const member = dataEffectMemberCallee(node);
         if (member === null || !t.isIdentifier(member.object))
             return;
         const method = RELEASE_METHODS.find((candidate) => candidate ===
@@ -126,6 +126,3 @@ const resourceModule = (specifier) => [
     "tls",
 ].includes(specifier);
 const resourceCandidateId = (candidate) => `resource:acquire:${String(candidate.node.start ?? -1)}:${String(candidate.node.end ?? -1)}`;
-const memberCallee = (node) => t.isMemberExpression(node.callee) || t.isOptionalMemberExpression(node.callee)
-    ? node.callee
-    : null;

package/dist/domain/javascriptSemanticState.js

@@ -70,3 +70,7 @@ export const semanticVariableScope = (scope, parent, state) => {
     }
     return candidate;
 };
+/** Identify a global name only when no lexical or dynamic environment shadows it. */
+export const isUnshadowedGlobal = (node, state, name) => t.isIdentifier(node, { name }) &&
+    resolveSemanticBindingState(state, node, name) === undefined &&
+    !semanticResolutionBlocked(state, node, name);

package/dist/domain/javascriptSemanticTraceSchemas.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import { evidenceSchema } from "./evidence.js";
 import { javaScriptSemanticQueryInputSchema, javaScriptSemanticQueryResultSchema, } from "./javascriptSemanticQuerySchemas.js";
-const evidenceIdSchema = z.string().regex(/^ev_[a-f0-9]{64}$/u);
+import { prefixedDigestSchema } from "./../domain/digests.js";
+const evidenceIdSchema = prefixedDigestSchema("ev");
 /** Authenticated application Evidence plus one bounded semantic query. */
 export const traceJavaScriptSemanticsInputSchema = z.strictObject({
     application: evidenceSchema,

package/dist/domain/javascriptSemanticTraversal.js

@@ -1,13 +1,21 @@
 import * as t from "@babel/types";
-/** Visit every Babel AST node in deterministic source-tree order. */
+/**
+ * Visit every Babel AST node in deterministic source-tree order.
+ *
+ * `ancestors` runs outermost-first and ends with the direct parent. Callers
+ * need it whenever meaning depends on where a node sits, not just what its
+ * immediate parent is — a binding inside `catch ({message})` or `({a} = o)`
+ * has an ObjectProperty parent, so the parent alone cannot say whether the
+ * identifier declares a binding or is assigned to.
+ */
 export const traverseJavaScriptAst = (root, visitor) => {
-    const visit = (node, parent) => {
-        visitor.enter(node, parent);
+    const visit = (node, parent, ancestors) => {
+        visitor.enter(node, parent, ancestors);
         for (const child of childNodes(node))
-            visit(child, node);
+            visit(child, node, [...ancestors, node]);
         visitor.exit?.(node, parent);
     };
-    visit(root, null);
+    visit(root, null, []);
 };
 const childNodes = (node) => {
     const keys = t.VISITOR_KEYS[node.type] ?? [];

package/dist/domain/javascriptSemanticValues.js

@@ -1,6 +1,7 @@
 import * as t from "@babel/types";
-import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
 import { compareCodePoints, propertyName, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 import { semanticAmbiguousProvenance, semanticLocalProvenance, semanticOriginsProvenance, semanticUnresolvedProvenance, uniqueSemanticOrigins, } from "./javascriptSemanticProvenance.js";
 import { semanticPrimitiveCandidates as primitiveCandidates, semanticPrimitiveSet as primitiveSet, semanticPrimitiveValue as primitiveValue, } from "./javascriptSemanticPrimitives.js";
 /** Evaluate one binding in the bounded constant-value lattice. */
@@ -243,7 +244,7 @@ const provenanceForBinding = (binding, context) => {
     })));
 };
 const provenanceForExpression = (node, context) => {
-    const required = requireOrigin(node);
+    const required = requireOrigin(node, context.state);
     if (required !== undefined)
         return semanticOriginsProvenance([required]);
     if (t.isIdentifier(node)) {
@@ -280,11 +281,11 @@ const provenanceForExpression = (node, context) => {
     }
     return semanticLocalProvenance();
 };
-const requireOrigin = (node) => {
+const requireOrigin = (node, state) => {
     if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
         if (!t.isNode(node.object))
             return undefined;
-        const nested = requireOrigin(node.object);
+        const nested = requireOrigin(node.object, state);
         const member = memberKey(node);
         return nested === undefined || typeof member !== "string"
             ? undefined
@@ -293,6 +294,9 @@ const requireOrigin = (node) => {
     if (!t.isCallExpression(node) ||
         !t.isIdentifier(node.callee, { name: "require" }))
         return undefined;
+    if (resolveSemanticBindingState(state, node.callee, "require") !== undefined ||
+        semanticResolutionBlocked(state, node.callee, "require"))
+        return undefined;
     const specifier = stringValue(node.arguments[0]);
     return specifier === undefined ? undefined : { specifier, importedPath: [] };
 };
@@ -304,11 +308,8 @@ const mergeValues = (values) => {
         : { status: "ambiguous", reason: "Branches have incompatible values." };
 };
 const memberKey = (node) => {
-    if (!node.computed)
-        return propertyName(node.property) || undefined;
-    if (t.isStringLiteral(node.property) || t.isNumericLiteral(node.property))
-        return node.property.value;
-    return undefined;
+    const name = semanticStaticPropertyName(node.property, node.computed);
+    return name === "" ? undefined : name;
 };
 const nestedContext = (context, bindingId) => ({
     state: context.state,

package/dist/domain/javascriptSourceParser.js

@@ -6,7 +6,11 @@ export const parseJavaScriptSource = (source) => {
             sourceType: "unambiguous",
             errorRecovery: true,
             attachComment: false,
-            plugins: ["jsx", "typescript"],
+            // "decorators-legacy" admits both the standard and the legacy decorator
+            // forms, including parameter decorators. Without it a decorated
+            // TypeScript source fails to parse at all rather than reporting
+            // recovered syntax, which loses every fact derived from that source.
+            plugins: ["decorators-legacy", "jsx", "typescript"],
         });
     }
     catch {