rea-agents 4.0.0 → 4.1.0

package/dist/domain/javascriptRuntimeReconciliationSchemas.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { evidenceSchema } from "./evidence.js";
 import { javascriptRuntimeUnresolvedLocationSchema } from "./javascriptRuntimeObservation.js";
-import { compareCodePoints, javascriptApplicationGraphSchema, } from "./javascriptApplicationGraph.js";
+import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
 import { digestSchema } from "./../domain/digests.js";
 import { prefixedDigestSchema } from "./../domain/digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
@@ -32,7 +33,9 @@ const normalizeRuntimeUrlPrefix = (value) => {
     try {
         url = new URL(value);
     }
-    catch {
+    catch (cause) {
+        // Invalid input is represented by the null return.
+        void cause;
         return null;
     }
     if (!["http:", "https:"].includes(url.protocol) ||

package/dist/domain/javascriptRuntimeStaticCandidates.js

@@ -1,5 +1,6 @@
 import { posix, relative, win32 } from "node:path";
-import { compareCodePoints, } from "./javascriptApplicationGraph.js";
+import {} from "./javascriptApplicationGraph.js";
+import { compareCodePoints, uniqueSorted } from "./canonicalOrdering.js";
 /** Index statically reconstructed entities that can receive runtime matches. */
 export const collectStaticRuntimeCandidates = (layers) => layers
     .flatMap((layer) => candidatesForLayer(layer))
@@ -156,7 +157,9 @@ const pathBelowUrlPrefix = (prefix, value) => {
         base = new URL(prefix);
         candidate = new URL(value);
     }
-    catch {
+    catch (cause) {
+        // Invalid input is represented by the null return.
+        void cause;
         return null;
     }
     if (base.origin !== candidate.origin ||
@@ -165,7 +168,9 @@ const pathBelowUrlPrefix = (prefix, value) => {
     try {
         return normalizeArtifactPath(decodeURIComponent(candidate.pathname.slice(base.pathname.length)));
     }
-    catch {
+    catch (cause) {
+        // Undecodable path segments are represented by the null return.
+        void cause;
         return null;
     }
 };
@@ -202,4 +207,3 @@ const uniqueMappedPaths = (values) => [
     ...new Map(values.map((value) => [`${value.basis}:${value.path}`, value])).values(),
 ].sort((left, right) => compareCodePoints(left.path, right.path) ||
     compareCodePoints(left.basis, right.basis));
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/javascriptSemanticAnalysis.js

@@ -174,8 +174,43 @@ const bindInnerDeclaration = (node, parent, scope, state) => {
             mutable: true,
             kind: "catch",
         });
-    else if (t.isAssignmentExpression(node) && t.isIdentifier(node.left))
-        addAssignment(node.left, node.right, scope, state);
+    else if (t.isAssignmentExpression(node)) {
+        if (t.isIdentifier(node.left))
+            addAssignment(node.left, node.right, scope, state);
+        else
+            for (const identifier of assignedPatternIdentifiers(node.left))
+                addAssignment(identifier, node, scope, state);
+    }
+    else if (t.isUpdateExpression(node) && t.isIdentifier(node.argument))
+        addAssignment(node.argument, node, scope, state);
+    else if (t.isForOfStatement(node) || t.isForInStatement(node))
+        for (const identifier of assignedPatternIdentifiers(node.left))
+            addAssignment(identifier, node, scope, state);
+};
+const assignedPatternIdentifiers = (pattern) => {
+    const identifiers = [];
+    const pending = [pattern];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        if (node === undefined)
+            continue;
+        if (t.isIdentifier(node))
+            identifiers.push(node);
+        else if (t.isRestElement(node))
+            pending.push(node.argument);
+        else if (t.isAssignmentPattern(node))
+            pending.push(node.left);
+        else if (t.isArrayPattern(node)) {
+            for (const element of node.elements)
+                if (element !== null)
+                    pending.push(element);
+        }
+        else if (t.isObjectPattern(node)) {
+            for (const property of node.properties)
+                pending.push(t.isRestElement(property) ? property.argument : property.value);
+        }
+    }
+    return identifiers;
 };
 const nestedScope = (node, parent, parentScope, state) => {
     const switchOwner = t.isSwitchCase(node) && parent !== null && t.isSwitchStatement(parent)
@@ -290,7 +325,9 @@ const bindPattern = (input) => {
         bindPattern({
             ...input,
             pattern: pattern.left,
-            initializer: initializer ?? pattern.right,
+            initializer: kind === "parameter" || kind === "catch"
+                ? initializer
+                : (initializer ?? pattern.right),
         });
         return;
     }

package/dist/domain/javascriptSemanticCallResolution.js

@@ -1,7 +1,8 @@
 import * as t from "@babel/types";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { semanticCallableIdForNode } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
-import { compareCodePoints, range } from "./javascriptStaticAnalysisHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
 /** Resolve local callable candidates without following dynamic properties. */
 export const resolveLocalCallables = (input) => resolveCallables(input.node, {
     state: input.state,

package/dist/domain/javascriptSemanticChildProcesses.js

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
 import { semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { compareCodePoints, range } from "./javascriptStaticAnalysisHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
 import { dataEffectLiteralString, dataEffectMemberCallee, assignedSemanticResultBindings, scalarAssignedResultBinding, semanticProjectedBindingFacts, } from "./javascriptSemanticDataEffectHelpers.js";
 const CHILD_PROCESS_METHODS = ["spawn", "exec", "execFile", "fork"];
 const CHILD_LISTENER_METHODS = ["on", "once", "addListener"];

package/dist/domain/javascriptSemanticDataEffects.js

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { semanticStaticPropertyName } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
 import { builtinDataEffectMethod as builtinMethod, containsSemanticNode as containsNode, dataEffectArgumentBindingId as argumentBindingId, dataEffectLiteralString as literalString, dataEffectMemberCallee as memberCallee, dataEffectMemberObject as memberObject, dataEffectPrimitive as primitiveValue, isSemanticProcessObject as isProcessObject, outerDataEffectBinding as outerAssignedBinding, assignedSemanticResultBindings, semanticProjectedBindingFacts, traverseDataEffects as traverseWithContext, } from "./javascriptSemanticDataEffectHelpers.js";
-import { compareCodePoints, range } from "./javascriptStaticAnalysisHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
 /** Recover configuration, request, and boundary candidates from inert syntax. */
 export const collectJavaScriptSemanticDataEffects = (program, state, callables) => {
     const context = {

package/dist/domain/javascriptSemanticFingerprints.js

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
 import * as t from "@babel/types";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { semanticCallableIdForNode } from "./javascriptSemanticProjection.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { compareCodePoints } from "./javascriptStaticAnalysisHelpers.js";
 /** Build bounded rename- and formatting-resistant components per callable. */
 export const collectJavaScriptSemanticFingerprints = (input) => {
     const { state, callables, calls, promises, events, timers, childProcessSpawns, childProcessInteractions, requestOperations, resourceOperations, parserPartial, } = input;

package/dist/domain/javascriptSemanticGraph.js

@@ -1,26 +1,17 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
 import { z } from "zod";
-import { compareCodePoints } from "./javascriptApplicationGraph.js";
+import { canonicalDigest, canonicalJson } from "./comparisonSemantics.js";
+import { compareCodePoints, uniqueSorted } from "./canonicalOrdering.js";
 import { JAVASCRIPT_SEMANTIC_RELATION_FAMILIES, JAVASCRIPT_SEMANTIC_RELATION_FAMILY, javaScriptSemanticFingerprintInputSchema, javaScriptSemanticFingerprintSchema, javaScriptSemanticGraphInputSchema, javaScriptSemanticGraphRecordSchema, javaScriptSemanticNodeInputSchema, javaScriptSemanticNodeSchema, javaScriptSemanticRelationInputSchema, javaScriptSemanticRelationSchema, javaScriptSemanticUnknownInputSchema, javaScriptSemanticUnknownSchema, } from "./javascriptSemanticGraphSchemas.js";
-const canonicalJson = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("JavaScript semantic graph could not canonicalize data");
-    return encoded;
-};
-const digestCanonical = (value) => createHash("sha256").update(canonicalJson(value)).digest("hex");
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);
 const normalizeEvidence = (evidence) => ({
     ...evidence,
     coverage: {
         ...evidence.coverage,
-        limits: [...evidence.coverage.limits].sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right))),
+        limits: [...evidence.coverage.limits].sort((left, right) => compareCodePoints(canonicalJson(left, "JavaScript semantic graph"), canonicalJson(right, "JavaScript semantic graph"))),
     },
     limitations: uniqueSorted(evidence.limitations),
     evidence_ids: uniqueSorted(evidence.evidence_ids),
 });
-const nodeId = (node) => `jsrg_node_${digestCanonical({ kind: node.kind, identity: node.identity })}`;
+const nodeId = (node) => `jsrg_node_${canonicalDigest({ kind: node.kind, identity: node.identity }, "JavaScript semantic graph")}`;
 /** Normalize one semantic entity and derive its artifact-version identifier. */
 export const createJavaScriptSemanticGraphNode = (input) => {
     const parsed = javaScriptSemanticNodeInputSchema.parse(input);
@@ -51,7 +42,7 @@ export const createJavaScriptSemanticGraphRelation = (input) => {
     };
     return javaScriptSemanticRelationSchema.parse({
         ...semantic,
-        relation_id: `jsrg_relation_${digestCanonical(semantic)}`,
+        relation_id: `jsrg_relation_${canonicalDigest(semantic, "JavaScript semantic graph")}`,
     });
 };
 /** Normalize one unresolved semantic frontier and derive its identifier. */
@@ -65,7 +56,7 @@ export const createJavaScriptSemanticGraphUnknown = (input) => {
     };
     return javaScriptSemanticUnknownSchema.parse({
         ...semantic,
-        unknown_id: `jsrg_unknown_${digestCanonical(semantic)}`,
+        unknown_id: `jsrg_unknown_${canonicalDigest(semantic, "JavaScript semantic graph")}`,
     });
 };
 /** Normalize one function fingerprint and derive its component commitment. */
@@ -80,15 +71,15 @@ export const createJavaScriptSemanticFingerprint = (input) => {
         limitations: uniqueSorted(parsed.limitations),
         evidence: normalizeEvidence(parsed.evidence),
     };
-    const fingerprintSha256 = digestCanonical(semantic.components);
+    const fingerprintSha256 = canonicalDigest(semantic.components, "JavaScript semantic graph");
     return javaScriptSemanticFingerprintSchema.parse({
         ...semantic,
         fingerprint_sha256: fingerprintSha256,
-        fingerprint_id: `jsrg_fingerprint_${digestCanonical({
+        fingerprint_id: `jsrg_fingerprint_${canonicalDigest({
             function_node_id: semantic.function_node_id,
             algorithm: semantic.algorithm,
             fingerprint_sha256: fingerprintSha256,
-        })}`,
+        }, "JavaScript semantic graph")}`,
     });
 };
 const sortedUniqueIssue = (values, path, label, context) => {
@@ -105,8 +96,8 @@ const sortedUniqueIssue = (values, path, label, context) => {
 };
 const checkCoverage = (graph, context) => {
     const families = graph.coverage.families.map(({ family }) => family);
-    if (canonicalJson(families) !==
-        canonicalJson(JAVASCRIPT_SEMANTIC_RELATION_FAMILIES))
+    if (canonicalJson(families, "JavaScript semantic graph") !==
+        canonicalJson(JAVASCRIPT_SEMANTIC_RELATION_FAMILIES, "JavaScript semantic graph"))
         context.addIssue({
             code: "custom",
             path: ["coverage", "families"],
@@ -193,7 +184,8 @@ const checkRoots = (graph, nodes, context) => {
 const checkRelations = (graph, nodes, context) => {
     for (const [index, relation] of graph.relations.entries()) {
         const { relation_id: identifier, ...semantic } = relation;
-        if (identifier !== "jsrg_relation_" + digestCanonical(semantic))
+        if (identifier !==
+            "jsrg_relation_" + canonicalDigest(semantic, "JavaScript semantic graph"))
             context.addIssue({
                 code: "custom",
                 path: ["relations", index, "relation_id"],
@@ -224,7 +216,8 @@ const checkRelations = (graph, nodes, context) => {
 const checkUnknowns = (graph, nodes, context) => {
     for (const [index, unknown] of graph.unknowns.entries()) {
         const { unknown_id: identifier, ...semantic } = unknown;
-        if (identifier !== "jsrg_unknown_" + digestCanonical(semantic))
+        if (identifier !==
+            "jsrg_unknown_" + canonicalDigest(semantic, "JavaScript semantic graph"))
             context.addIssue({
                 code: "custom",
                 path: ["unknowns", index, "unknown_id"],
@@ -274,18 +267,19 @@ const checkFingerprints = (graph, nodes, context) => {
                 path: ["fingerprints", index, "function_node_id"],
                 message: "Fingerprint must name a function node",
             });
-        if (fingerprint.fingerprint_sha256 !== digestCanonical(fingerprint.components))
+        if (fingerprint.fingerprint_sha256 !==
+            canonicalDigest(fingerprint.components, "JavaScript semantic graph"))
             context.addIssue({
                 code: "custom",
                 path: ["fingerprints", index, "fingerprint_sha256"],
                 message: "Fingerprint component commitment is stale",
             });
         const expectedIdentifier = "jsrg_fingerprint_" +
-            digestCanonical({
+            canonicalDigest({
                 function_node_id: fingerprint.function_node_id,
                 algorithm: fingerprint.algorithm,
                 fingerprint_sha256: fingerprint.fingerprint_sha256,
-            });
+            }, "JavaScript semantic graph");
         if (fingerprint.fingerprint_id !== expectedIdentifier)
             context.addIssue({
                 code: "custom",
@@ -318,7 +312,8 @@ const checkGraph = (graph, context) => {
             message: "Non-complete graph coverage requires a limitation",
         });
     const { graph_id: identifier, ...semantic } = graph;
-    if (identifier !== "jsrg_" + digestCanonical(semantic))
+    if (identifier !==
+        "jsrg_" + canonicalDigest(semantic, "JavaScript semantic graph"))
         context.addIssue({
             code: "custom",
             path: ["graph_id"],
@@ -339,7 +334,7 @@ export const createJavaScriptSemanticGraph = (input) => {
         unknowns: [...parsed.unknowns].sort((left, right) => compareCodePoints(left.unknown_id, right.unknown_id)),
         coverage: {
             ...parsed.coverage,
-            limits: [...parsed.coverage.limits].sort((left, right) => compareCodePoints(canonicalJson(left), canonicalJson(right))),
+            limits: [...parsed.coverage.limits].sort((left, right) => compareCodePoints(canonicalJson(left, "JavaScript semantic graph"), canonicalJson(right, "JavaScript semantic graph"))),
             families: [...parsed.coverage.families]
                 .map((family) => ({
                 ...family,
@@ -351,6 +346,6 @@ export const createJavaScriptSemanticGraph = (input) => {
     };
     return javaScriptSemanticGraphSchema.parse({
         ...semantic,
-        graph_id: `jsrg_${digestCanonical(semantic)}`,
+        graph_id: `jsrg_${canonicalDigest(semantic, "JavaScript semantic graph")}`,
     });
 };

package/dist/domain/javascriptSemanticPrimitives.js

@@ -1,8 +1,13 @@
 import * as t from "@babel/types";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { semanticPrimitiveKey } from "./javascriptSemanticProvenance.js";
-import { compareCodePoints } from "./javascriptStaticAnalysisHelpers.js";
 /** Normalize one bounded collection of possible primitive values. */
 export const semanticPrimitiveSet = (values) => {
+    if (values.some((value) => typeof value === "number" && !Number.isFinite(value)))
+        return {
+            status: "unknown",
+            reason: "Nonfinite numbers are outside the JSON primitive lattice.",
+        };
     const unique = [
         ...new Map(values.map((value) => [semanticPrimitiveKey(value), value])).values(),
     ].sort((left, right) => compareCodePoints(semanticPrimitiveKey(left), semanticPrimitiveKey(right)));
@@ -19,7 +24,9 @@ export const semanticPrimitiveCandidates = (value) => value.status === "literal"
         : null;
 /** Parse one Babel primitive literal without evaluating code. */
 export const semanticPrimitiveValue = (node) => {
-    if (t.isStringLiteral(node) || t.isNumericLiteral(node))
+    if (t.isStringLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isNumericLiteral(node) && Number.isFinite(node.value))
         return { found: true, value: node.value };
     if (t.isBooleanLiteral(node))
         return { found: true, value: node.value };

package/dist/domain/javascriptSemanticProjection.js

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
 import { resolveSemanticBindingState, semanticResolutionBlocked, isUnshadowedGlobal, } from "./javascriptSemanticState.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { evaluateSemanticBinding, evaluateSemanticProvenance, } from "./javascriptSemanticValues.js";
-import { compareCodePoints, propertyName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { propertyName, range, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 /** Retain callable identity without polluting lexical bindings. */
 export const collectSemanticCallable = (input) => {

package/dist/domain/javascriptSemanticPromises.js

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
 import { semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { compareCodePoints, range, sourceRangesEqual, } from "./javascriptStaticAnalysisHelpers.js";
+import { range, sourceRangesEqual } from "./javascriptStaticAnalysisHelpers.js";
 import { assignedSemanticResultBindings, containsSemanticNode, dataEffectMemberCallee, scalarAssignedResultBinding, } from "./javascriptSemanticDataEffectHelpers.js";
 /** Recover explicit Promise construction, chaining, aggregation, and ownership. */
 export const collectJavaScriptSemanticPromises = (program, state, callables) => {

package/dist/domain/javascriptSemanticProvenance.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "./javascriptStaticAnalysisHelpers.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 /** Construct exact local provenance without inventing module origins. */
 export const semanticLocalProvenance = () => ({
     status: "local",

package/dist/domain/javascriptSemanticQuery.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "./javascriptApplicationGraph.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { isJavaScriptSemanticOwnershipRelation as ownershipRelation } from "./javascriptSemanticQueryRelations.js";
 import { javaScriptSemanticQueryInputSchema, javaScriptSemanticQueryResultSchema, } from "./javascriptSemanticQuerySchemas.js";
 import { assessJavaScriptSemanticQuery } from "./javascriptSemanticQueryAssessment.js";
@@ -153,13 +153,12 @@ const relevantUnknownFrontiers = (graph, nodeIds, input) => {
             unknown.relation_kinds.some((relation) => allowed.has(relation))));
 };
 const relevantCandidateRelationCount = (graph, nodeIds, input) => {
-    const allowed = input.allowed_relations === undefined
-        ? null
-        : new Set(input.allowed_relations);
-    return graph.relations.filter((relation) => relation.resolution === "candidate" &&
-        (allowed === null || allowed.has(relation.relation)) &&
-        (nodeIds.has(relation.source_node_id) ||
-            nodeIds.has(relation.target_node_id))).length;
+    const adjacency = buildAdjacency(graph.relations.filter(({ resolution }) => resolution === "candidate"), { ...input, include_ambiguous_dynamic_edges: true });
+    const relevant = new Set();
+    for (const nodeId of nodeIds)
+        for (const { relation } of adjacency.get(nodeId) ?? [])
+            relevant.add(relation.relation_id);
+    return relevant.size;
 };
 const expectedMatchesFor = (nodes, relations, input) => {
     if (input.expected === null)

package/dist/domain/javascriptSemanticQueryAssessment.js

@@ -1,4 +1,4 @@
-import { compareCodePoints } from "./javascriptApplicationGraph.js";
+import { uniqueSorted } from "./canonicalOrdering.js";
 /** Classify a complete semantic traversal without promoting unknowns to absence. */
 export const assessJavaScriptSemanticQuery = (input) => ({
     status: queryStatus(input),
@@ -43,4 +43,3 @@ const queryLimitations = (input) => uniqueSorted([
             "Candidate relations remain ambiguous and do not establish a resolved semantic path.",
         ]),
 ]);
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/javascriptSemanticQueryIdentity.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import canonicalize from "canonicalize";
-import { compareCodePoints } from "./javascriptApplicationGraph.js";
+import { compareCodePoints, uniqueSorted } from "./canonicalOrdering.js";
 /** Canonical JSON used by semantic query commitments and ordering. */
 export const canonicalJavaScriptSemanticQueryJson = (value) => {
     const encoded = canonicalize(value);
@@ -11,7 +11,6 @@ export const canonicalJavaScriptSemanticQueryJson = (value) => {
 const digest = (value) => createHash("sha256")
     .update(canonicalJavaScriptSemanticQueryJson(value))
     .digest("hex");
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);
 /** Derive the stable identity for one graph-bound query. */
 export const javaScriptSemanticQueryIdentifier = (graph, input) => {
     const semantic = input;

package/dist/domain/javascriptSemanticReturns.js

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { semanticCallableIdForNode } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
 import { evaluateSemanticExpression } from "./javascriptSemanticValues.js";
-import { compareCodePoints, range } from "./javascriptStaticAnalysisHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
 import { semanticReturnCoverage } from "./javascriptSemanticCoverage.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 /** Evaluate direct returns while excluding every nested callable. */

package/dist/domain/javascriptSemanticValues.js

@@ -1,6 +1,7 @@
 import * as t from "@babel/types";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
-import { compareCodePoints, propertyName, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
+import { stringValue } from "./javascriptStaticAnalysisHelpers.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
 import { semanticAmbiguousProvenance, semanticLocalProvenance, semanticOriginsProvenance, semanticUnresolvedProvenance, uniqueSemanticOrigins, } from "./javascriptSemanticProvenance.js";
 import { semanticPrimitiveCandidates as primitiveCandidates, semanticPrimitiveSet as primitiveSet, semanticPrimitiveValue as primitiveValue, } from "./javascriptSemanticPrimitives.js";
@@ -88,34 +89,55 @@ const evaluateTemplate = (node, context) => {
     return primitiveSet(candidates);
 };
 const evaluateObject = (node, context) => {
-    const properties = [];
+    const propertiesByName = new Map();
     let unknownProperties = false;
     let omittedProperties = 0;
+    const invalidateEarlierProperties = () => {
+        for (const [name] of propertiesByName)
+            propertiesByName.set(name, {
+                name,
+                value: {
+                    status: "unknown",
+                    reason: "A later property may overwrite this value.",
+                },
+            });
+    };
     for (const property of node.properties) {
         if (t.isSpreadElement(property)) {
             unknownProperties = true;
             omittedProperties = null;
+            invalidateEarlierProperties();
             continue;
         }
-        if (property.computed) {
+        const name = semanticStaticPropertyName(property.key, property.computed);
+        if (name === "" && !t.isStringLiteral(property.key, { value: "" })) {
             unknownProperties = true;
             if (omittedProperties !== null)
                 omittedProperties += 1;
+            invalidateEarlierProperties();
             continue;
         }
-        const name = propertyName(property.key);
-        if (name === "" || !t.isObjectProperty(property)) {
+        // This spelling changes the prototype instead of defining an own slot.
+        if (t.isObjectProperty(property) &&
+            !property.computed &&
+            !property.shorthand &&
+            name === "__proto__") {
             unknownProperties = true;
             if (omittedProperties !== null)
                 omittedProperties += 1;
             continue;
         }
-        properties.push({
+        propertiesByName.set(name, {
             name,
-            value: evaluateExpression(property.value, nestedContext(context)),
+            value: t.isObjectProperty(property)
+                ? evaluateExpression(property.value, nestedContext(context))
+                : {
+                    status: "unknown",
+                    reason: "Object method or accessor value is not a primitive.",
+                },
         });
     }
-    properties.sort((left, right) => compareCodePoints(left.name, right.name));
+    const properties = [...propertiesByName.values()].sort((left, right) => compareCodePoints(left.name, right.name));
     return unknownProperties
         ? {
             status: "object",
@@ -138,12 +160,17 @@ const evaluateArray = (node, context) => {
         if (t.isSpreadElement(element)) {
             unknownItems = true;
             omittedItems = null;
-            continue;
+            // Subsequent elements have no fixed index after an unknown-length spread.
+            break;
         }
         if (element === null) {
             unknownItems = true;
             if (omittedItems !== null)
                 omittedItems += 1;
+            items.push({
+                status: "unknown",
+                reason: "Array hole has no primitive value.",
+            });
             continue;
         }
         items.push(evaluateExpression(element, nestedContext(context)));
@@ -167,9 +194,9 @@ const evaluateAddition = (node, context) => {
     const right = primitiveCandidates(evaluateExpression(node.right, nestedContext(context)));
     if (left === null || right === null)
         return { status: "unknown", reason: "Non-primitive addition." };
-    const values = left.flatMap((leftValue) => right.map((rightValue) => typeof leftValue === "number" && typeof rightValue === "number"
-        ? leftValue + rightValue
-        : `${String(leftValue)}${String(rightValue)}`));
+    const values = left.flatMap((leftValue) => right.map((rightValue) => typeof leftValue === "string" || typeof rightValue === "string"
+        ? `${String(leftValue)}${String(rightValue)}`
+        : Number(leftValue) + Number(rightValue)));
     return primitiveSet(values);
 };
 const evaluateUnary = (node, context) => {
@@ -201,8 +228,16 @@ const projectValue = (value, projection) => {
                 };
             current = property.value;
         }
-        else if (current.status === "array" && typeof key === "number") {
-            const item = current.items[key];
+        else if (current.status === "array") {
+            const index = typeof key === "number" ? key : Number(key);
+            if (!Number.isSafeInteger(index) ||
+                index < 0 ||
+                String(index) !== String(key))
+                return {
+                    status: "unknown",
+                    reason: `Array property ${String(key)} is not a canonical index.`,
+                };
+            const item = current.items[index];
             if (item === undefined)
                 return {
                     status: "unknown",
@@ -302,8 +337,7 @@ const requireOrigin = (node, state) => {
 };
 const mergeValues = (values) => {
     const primitives = values.flatMap((value) => primitiveCandidates(value) ?? []);
-    return primitives.length === values.length ||
-        values.every((value) => value.status === "union" || value.status === "literal")
+    return values.every((value) => value.status === "union" || value.status === "literal")
         ? primitiveSet(primitives)
         : { status: "ambiguous", reason: "Branches have incompatible values." };
 };

package/dist/domain/javascriptSourceParser.js

@@ -1,5 +1,5 @@
 import { parse } from "@babel/parser";
-/** Parse JavaScript or TypeScript once without retaining unused comment nodes. */
+/** Parse JavaScript or TypeScript once without attaching comments to AST nodes. */
 export const parseJavaScriptSource = (source) => {
     try {
         return parse(source, {
@@ -13,7 +13,9 @@ export const parseJavaScriptSource = (source) => {
             plugins: ["decorators-legacy", "jsx", "typescript"],
         });
     }
-    catch {
+    catch (cause) {
+        // Unparseable source is represented by the null return.
+        void cause;
         return null;
     }
 };

package/dist/domain/javascriptStaticAnalysis.js

@@ -17,7 +17,7 @@ export const analyzeJavaScriptStaticSource = (source) => {
 export const analyzeParsedJavaScriptStaticSource = (source, file) => {
     const accumulator = createJavaScriptAnalysisAccumulator();
     traverseStaticSource(source, file, accumulator);
-    addSourceMapDirectives(source, accumulator);
+    addSourceMapDirectives(source, file.comments ?? [], accumulator);
     return finalizeStaticAnalysis(source, file, accumulator);
 };
 const traverseStaticSource = (source, file, accumulator) => {

package/dist/domain/javascriptStaticAnalysisBundler.js

@@ -1,7 +1,8 @@
 import * as t from "@babel/types";
 import { collectJavaScriptExports, fingerprintJavaScriptAst, } from "./javascriptAstFingerprint.js";
+import { compareCodePoints } from "./canonicalOrdering.js";
 import { addFindingOnce } from "./javascriptStaticAnalysisFindings.js";
-import { argumentValue, calleeName, chunkRuntime, compareCodePoints, factoryRequireName, moduleFactory, modulePropertyName, range, registrationKey, sha256Text, sourceSlice, staticArrayValues, } from "./javascriptStaticAnalysisHelpers.js";
+import { argumentValue, calleeName, chunkRuntime, factoryRequireName, moduleFactory, modulePropertyName, range, registrationKey, sha256Text, sourceSlice, staticArrayValues, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect a bundler registration call and recover its module table. */
 export const inspectBundlerRegistration = (source, call, accumulator) => {
     const runtime = chunkRuntime(call);

package/dist/domain/javascriptStaticAnalysisCalls.js

@@ -191,15 +191,23 @@ const addEndpoint = (context, input) => addLocatedFinding(context, {
         location: range(input.node),
     },
 });
-export const addSourceMapDirectives = (source, accumulator) => {
-    // Minifiers emit either `//# sourceMappingURL=` or the block form
-    // `/*# sourceMappingURL=app.js.map */`. Matching only the line form silently
-    // dropped the block form, so a real footer produced no mapping at all.
-    for (const match of source.matchAll(/(?:\/\/|\/\*)[#@]\s*sourceMappingURL\s*=\s*([^\s*]+)/gu)) {
+export const addSourceMapDirectives = (source, comments, accumulator) => {
+    // Read real comment tokens only; quoted text can contain identical markers.
+    // Keep both current/legacy line annotations and minifier block annotations.
+    for (const comment of comments) {
+        const start = comment.start;
+        const end = comment.end;
+        if (start === undefined ||
+            start === null ||
+            end === undefined ||
+            end === null)
+            continue;
+        const match = /^(?:\/\/|\/\*)[#@]\s*sourceMappingURL\s*=\s*([^\s*]+)/u.exec(source.slice(start, end));
+        if (match === null)
+            continue;
         const declared = match[1];
         if (declared === undefined || declared.length === 0)
             continue;
-        const start = match.index;
         const location = rangeForOffsets(source, start, start + match[0].length);
         addFindingOnce(accumulator, `source-map\0${declared}`, () => accumulator.sourceMaps.push({ declared_url: declared, location }));
     }