rea-agents 4.0.1 → 5.0.0

package/dist/domain/javascript/javascriptRecovery.js

@@ -0,0 +1,88 @@
+import { z } from "zod";
+import { digestSchema } from "../digests.js";
+import { analyzeJavaScriptApplicationInputSchema } from "./javascriptApplicationAnalysis.js";
+/** Recover derived readable modules from one explicitly selected local script. */
+export const javascriptRecoveryInputSchema = z.strictObject({
+    path: z
+        .string()
+        .min(1)
+        .describe("Absolute path to a UTF-8 JavaScript file; never executed"),
+    output_directory: z
+        .string()
+        .min(1)
+        .describe("Absolute absent output directory; parent must exist"),
+    extraction_mode: z
+        .enum(["structural", "heuristic", "inspection"])
+        .default("structural")
+        .describe("Structural module boundaries, heuristic fallback, or finer inspection-only regions"),
+    rewrite_level: z
+        .enum(["minimal", "standard", "aggressive"])
+        .default("standard")
+        .describe("Upstream syntax recovery level; runtime equivalence remains unverified"),
+});
+const fileSchema = z.strictObject({
+    path: z.string().min(1),
+    sha256: digestSchema,
+    bytes: z.number().int().nonnegative(),
+});
+const rangeSchema = z.strictObject({
+    start: z.number().int().nonnegative(),
+    end: z.number().int().nonnegative(),
+});
+/** Complete published artifacts and exact producer provenance for source recovery. */
+export const javascriptRecoveryResultSchema = z.strictObject({
+    source: fileSchema.extend({
+        snapshot_path: z.string().min(1),
+        published_copy: fileSchema,
+    }),
+    engine: z.strictObject({
+        id: z.string().min(1),
+        version: z.string().min(1),
+        executable: fileSchema,
+        audited_source_revision: z.string().min(1),
+        executed_source_revision: z.string().nullable(),
+    }),
+    options: z.strictObject({
+        extraction_mode: javascriptRecoveryInputSchema.shape.extraction_mode.removeDefault(),
+        rewrite_level: javascriptRecoveryInputSchema.shape.rewrite_level.removeDefault(),
+    }),
+    status: z.enum(["complete", "partial"]),
+    detected_formats: z.array(z.string()),
+    reported_safety: z.string(),
+    reported_strategy: z.string(),
+    reported_format: z.string(),
+    total: z.number().int().nonnegative(),
+    failed: z.number().int().nonnegative(),
+    modules: z.array(z.strictObject({
+        reported_filename: z.string().min(1),
+        reported_status: z.string().min(1),
+        artifact: fileSchema,
+        source_map: fileSchema.nullable(),
+        provenance: z.strictObject({
+            reported_input: z.string(),
+            original_path: z.string(),
+            original_sha256: digestSchema,
+            extraction: z.string(),
+            byte_ranges: z.array(rangeSchema),
+            context_byte_ranges: z.array(rangeSchema),
+            range_semantics: z.literal("half-open-utf8-bytes"),
+        }),
+    })),
+    warnings: z.array(z.strictObject({
+        filename: z.string(),
+        kind: z.string(),
+        is_error: z.boolean(),
+        message: z.string(),
+    })),
+    report: fileSchema,
+    provenance: fileSchema,
+    manifest: fileSchema,
+    analysis_input: z
+        .strictObject({
+        input_path: analyzeJavaScriptApplicationInputSchema.shape.input_path,
+        format: z.literal("directory"),
+    })
+        .nullable(),
+    runtime_equivalence: z.literal("unknown"),
+    limitations: z.array(z.string()),
+});

package/dist/domain/{javascriptRuntimeLoadState.js → javascript/javascriptRuntimeLoadState.js}

@@ -1,4 +1,5 @@
-import { compareCodePoints, } from "./javascriptApplicationGraph.js";
+import {} from "./javascriptApplicationGraph.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
 import { createStaticRuntimeScope, mappedRuntimePaths, staticNodeWithinRuntimeScope, } from "./javascriptRuntimeStaticCandidates.js";
 /** Classify static code presence without claiming bundled module execution. */
 export const classifyStaticLoadStates = (layers, runtimeEntities, matches, options) => {
@@ -98,4 +99,3 @@ const state = (layer, node, input) => ({
     runtime_node_ids: [...input.runtimeNodeIds],
     reason: input.reason,
 });
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/{javascriptRuntimeObservation.js → javascript/javascriptRuntimeObservation.js}

@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { browserEndpointSchema } from "./browserObservation.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { browserEndpointSchema } from "../browserObservation.js";
+import { prefixedDigestSchema } from "../digests.js";
 const observationTextSchema = z.string().min(1);
 const runtimeEndpoint = {
     inspector_endpoint: browserEndpointSchema,

package/dist/domain/{javascriptRuntimeReconciliationActive.js → javascript/javascriptRuntimeReconciliationActive.js}

@@ -1,9 +1,8 @@
-import { createHash } from "node:crypto";
 import { isAbsolute } from "node:path";
-import { isPathWithinRoot } from "./localPath.js";
-import canonicalize from "canonicalize";
+import { canonicalDigest } from "../comparisonSemantics.js";
+import { isPathWithinRoot } from "../localPath.js";
 import { z } from "zod";
-import { classifyBrowserCompleteness, } from "./browserCompleteness.js";
+import { classifyBrowserCompleteness, } from "../browserCompleteness.js";
 import { electronActiveObservationResultSchema, } from "./electronActiveObservation.js";
 /** Parse active Electron Evidence as a bounded, target-only runtime capture. */
 export const parseActiveElectronCapture = (evidence) => {
@@ -23,7 +22,7 @@ export const parseActiveElectronCapture = (evidence) => {
         kind: "electron-active",
         evidence,
         inspection: normalizeInspection(result),
-        captureSha256: digestCanonical(result),
+        captureSha256: canonicalDigest(result, "Runtime reconciliation"),
         scriptsCompleteWithinScope: false,
     };
 };
@@ -41,7 +40,7 @@ const assertIdentity = (evidence) => {
 };
 const normalizeInspection = (result) => ({
     target: {
-        target_id: `electron-active:${digestCanonical(result.application.application_path).slice(0, 32)}`,
+        target_id: `electron-active:${canonicalDigest(result.application.application_path, "Runtime reconciliation").slice(0, 32)}`,
         type: "electron-application",
         title: result.application.application_path,
         attached: true,
@@ -72,9 +71,3 @@ const normalizeInspection = (result) => ({
         },
     }),
 });
-const digestCanonical = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Runtime reconciliation could not canonicalize input");
-    return createHash("sha256").update(encoded).digest("hex");
-};

package/dist/domain/{javascriptRuntimeReconciliationGraph.js → javascript/javascriptRuntimeReconciliationGraph.js}

@@ -1,4 +1,5 @@
-import { compareCodePoints, createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
+import { createJavaScriptApplicationGraph, createJavaScriptApplicationNode, } from "./javascriptApplicationGraph.js";
+import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
 /** Merge source graphs, runtime nodes, and inferred mappings into one valid JAG. */
 export const buildReconciledApplicationGraph = (input) => {
     const merged = mergeNodes([
@@ -154,4 +155,3 @@ const mergeNodes = (nodes) => {
 const uniqueEdges = (edges) => [
     ...new Map(edges.map((edge) => [edge.edge_id, edge])).values(),
 ];
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/{javascriptRuntimeReconciliationMatching.js → javascript/javascriptRuntimeReconciliationMatching.js}

@@ -1,5 +1,6 @@
-import { compareCodePoints, createJavaScriptApplicationEdge, } from "./javascriptApplicationGraph.js";
-import { digestCanonical, } from "./javascriptRuntimeReconciliationParsing.js";
+import { createJavaScriptApplicationEdge, } from "./javascriptApplicationGraph.js";
+import { canonicalDigest } from "../comparisonSemantics.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { mappedRuntimePaths, } from "./javascriptRuntimeStaticCandidates.js";
 /** Match runtime entities conservatively and emit only inferred observed_as edges. */
 export const reconcileRuntimeEntities = (input) => {
@@ -188,7 +189,7 @@ const createItem = (entity, input) => {
         candidate_static_nodes: candidateReferences.items,
     };
     return {
-        reconciliation_id: `jrr_item_${digestCanonical(semantic)}`,
+        reconciliation_id: `jrr_item_${canonicalDigest(semantic, "Runtime reconciliation")}`,
         ...semantic,
     };
 };

package/dist/domain/{javascriptRuntimeReconciliationParsing.js → javascript/javascriptRuntimeReconciliationParsing.js}

@@ -1,13 +1,13 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
 import { z } from "zod";
-import { browserAllowedOriginsSchema, browserEndpointSchema, webPageInspectionSchema, } from "./browserObservation.js";
-import { classifyBrowserCompleteness, } from "./browserCompleteness.js";
+import { browserAllowedOriginsSchema, browserEndpointSchema, webPageInspectionSchema, } from "../browserObservation.js";
+import { classifyBrowserCompleteness, } from "../browserCompleteness.js";
 import { electronPageInspectionSchema, } from "./electronObservation.js";
 import { javascriptRuntimeObservationSchema, javascriptRuntimeKindSchema, } from "./javascriptRuntimeObservation.js";
-import { parseEvidence } from "./evidence.js";
+import { canonicalDigest } from "../comparisonSemantics.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { parseEvidence } from "../evidence.js";
 import { javascriptApplicationAnalysisResultSchema, } from "./javascriptApplicationAnalysis.js";
-import { compareCodePoints, } from "./javascriptApplicationGraph.js";
+import {} from "./javascriptApplicationGraph.js";
 import { parseActiveElectronCapture } from "./javascriptRuntimeReconciliationActive.js";
 /** Parse and semantically bind every static analysis Evidence layer. */
 export const parseStaticLayers = (layers) => layers
@@ -17,12 +17,6 @@ export const parseStaticLayers = (layers) => layers
 export const parseRuntimeCaptures = (observations) => observations
     .map((observation) => parseRuntimeCapture(observation))
     .sort((left, right) => compareCodePoints(left.evidence.evidence_id, right.evidence.evidence_id));
-export const digestCanonical = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Runtime reconciliation could not canonicalize input");
-    return createHash("sha256").update(encoded).digest("hex");
-};
 const parseStaticLayer = (layer) => {
     const evidence = parseEvidence(layer.analysis);
     const result = javascriptApplicationAnalysisResultSchema.parse(evidence.normalized_result);
@@ -41,11 +35,11 @@ const parseStaticLayer = (layer) => {
         evidence.subject.local_path !== result.input_path)
         throw new TypeError("JavaScript application Evidence subject disagrees with its result");
     return {
-        layerId: `jrl_${digestCanonical({
+        layerId: `jrl_${canonicalDigest({
             role: layer.role,
             evidence_id: evidence.evidence_id,
             runtime_mappings: layer.runtime_mappings,
-        })}`,
+        }, "Runtime reconciliation")}`,
         role: layer.role,
         evidence,
         result,
@@ -76,7 +70,7 @@ const parseRuntimeCapture = (input) => {
             kind: "browser",
             evidence,
             inspection,
-            captureSha256: digestCanonical(inspection),
+            captureSha256: canonicalDigest(inspection, "Runtime reconciliation"),
             scriptsCompleteWithinScope: scriptsComplete(inspection.completeness),
         };
     }
@@ -100,7 +94,7 @@ const parseRuntimeCapture = (input) => {
             kind: "electron",
             evidence,
             inspection,
-            captureSha256: digestCanonical(inspection),
+            captureSha256: canonicalDigest(inspection, "Runtime reconciliation"),
             scriptsCompleteWithinScope: scriptsComplete(inspection.completeness),
         };
     }
@@ -121,7 +115,7 @@ const parseRuntimeCapture = (input) => {
             kind: "v8-inspector",
             evidence,
             inspection,
-            captureSha256: digestCanonical(result),
+            captureSha256: canonicalDigest(result, "Runtime reconciliation"),
             scriptsCompleteWithinScope: false,
         };
     }

package/dist/domain/{javascriptRuntimeReconciliationResult.js → javascript/javascriptRuntimeReconciliationResult.js}

@@ -1,5 +1,6 @@
-import { compareCodePoints, } from "./javascriptApplicationGraph.js";
-import { digestCanonical, } from "./javascriptRuntimeReconciliationParsing.js";
+import {} from "./javascriptApplicationGraph.js";
+import { canonicalDigest } from "../comparisonSemantics.js";
+import { uniqueSorted } from "../canonicalOrdering.js";
 import { javascriptRuntimeReconciliationResultSchema, } from "./javascriptRuntimeReconciliationSchemas.js";
 /** Build and verify the deterministic caller-visible reconciliation result. */
 export const createJavaScriptRuntimeReconciliationResult = (input) => {
@@ -20,7 +21,7 @@ export const createJavaScriptRuntimeReconciliationResult = (input) => {
         limitations: reconciliationLimitations(completion),
     };
     return javascriptRuntimeReconciliationResultSchema.parse({
-        reconciliation_id: `jrr_${digestCanonical(semantic)}`,
+        reconciliation_id: `jrr_${canonicalDigest(semantic, "Runtime reconciliation")}`,
         ...semantic,
     });
 };
@@ -124,4 +125,3 @@ const reconciliationLimitations = (completion) => uniqueSorted([
         : []),
 ]);
 const countBy = (items, key, value) => items.filter((item) => item[key] === value).length;
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/{javascriptRuntimeReconciliationSchemas.js → javascript/javascriptRuntimeReconciliationSchemas.js}

@@ -1,9 +1,10 @@
 import { z } from "zod";
-import { evidenceSchema } from "./evidence.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { evidenceSchema } from "../evidence.js";
 import { javascriptRuntimeUnresolvedLocationSchema } from "./javascriptRuntimeObservation.js";
-import { compareCodePoints, javascriptApplicationGraphSchema, } from "./javascriptApplicationGraph.js";
-import { digestSchema } from "./../domain/digests.js";
-import { prefixedDigestSchema } from "./../domain/digests.js";
+import { javascriptApplicationGraphSchema } from "./javascriptApplicationGraph.js";
+import { digestSchema } from "../digests.js";
+import { prefixedDigestSchema } from "../digests.js";
 const evidenceIdSchema = prefixedDigestSchema("ev");
 const nodeIdSchema = prefixedDigestSchema("jag_node");
 const boundedTextSchema = z.string().min(1);
@@ -32,7 +33,9 @@ const normalizeRuntimeUrlPrefix = (value) => {
     try {
         url = new URL(value);
     }
-    catch {
+    catch (cause) {
+        // Invalid input is represented by the null return.
+        void cause;
         return null;
     }
     if (!["http:", "https:"].includes(url.protocol) ||

package/dist/domain/{javascriptRuntimeStaticCandidates.js → javascript/javascriptRuntimeStaticCandidates.js}

@@ -1,5 +1,6 @@
 import { posix, relative, win32 } from "node:path";
-import { compareCodePoints, } from "./javascriptApplicationGraph.js";
+import {} from "./javascriptApplicationGraph.js";
+import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
 /** Index statically reconstructed entities that can receive runtime matches. */
 export const collectStaticRuntimeCandidates = (layers) => layers
     .flatMap((layer) => candidatesForLayer(layer))
@@ -156,7 +157,9 @@ const pathBelowUrlPrefix = (prefix, value) => {
         base = new URL(prefix);
         candidate = new URL(value);
     }
-    catch {
+    catch (cause) {
+        // Invalid input is represented by the null return.
+        void cause;
         return null;
     }
     if (base.origin !== candidate.origin ||
@@ -165,7 +168,9 @@ const pathBelowUrlPrefix = (prefix, value) => {
     try {
         return normalizeArtifactPath(decodeURIComponent(candidate.pathname.slice(base.pathname.length)));
     }
-    catch {
+    catch (cause) {
+        // Undecodable path segments are represented by the null return.
+        void cause;
         return null;
     }
 };
@@ -202,4 +207,3 @@ const uniqueMappedPaths = (values) => [
     ...new Map(values.map((value) => [`${value.basis}:${value.path}`, value])).values(),
 ].sort((left, right) => compareCodePoints(left.path, right.path) ||
     compareCodePoints(left.basis, right.basis));
-const uniqueSorted = (values) => [...new Set(values)].sort(compareCodePoints);

package/dist/domain/{javascriptSemanticAnalysis.js → javascript/javascriptSemanticAnalysis.js}

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
 import { failedJavaScriptSemanticIr, } from "./javascriptSemanticIr.js";
-import { collectSemanticModuleLink, collectSemanticCallable, collectSemanticReferences, immutableSemanticBindings, immutableSemanticScopes, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
+import { collectSemanticModuleLink, collectSemanticCallable, collectSemanticReferences, immutableSemanticBindings, immutableSemanticScopes, semanticStaticPropertyKey, } from "./javascriptSemanticProjection.js";
 import { currentSemanticScope, resolveSemanticBindingFromScope, semanticScopeId, semanticVariableScope, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
+import { collectSemanticMemberMutations } from "./javascriptSemanticMemberMutations.js";
 import { collectSemanticReturns, resolveSemanticModuleCallables, } from "./javascriptSemanticReturns.js";
 import { collectJavaScriptDerivedSemantics } from "./javascriptSemanticDerivedAnalysis.js";
 import { propertyName, range } from "./javascriptStaticAnalysisHelpers.js";
@@ -15,10 +16,17 @@ export const analyzeJavaScriptSemantics = (source) => {
         ? failedJavaScriptSemanticIr()
         : analyzeParsedJavaScriptSemantics(file);
 };
+/** Recover lexical references, optionally for one name, without evaluating values or provenance. */
+export const analyzeParsedJavaScriptReferences = (file, name) => {
+    const state = createState(file.program);
+    collectDefinitions(file.program, state);
+    return collectSemanticReferences(file.program, state, name);
+};
 /** Recover semantics from an already parsed JavaScript artifact. */
 export const analyzeParsedJavaScriptSemantics = (file) => {
     const state = createState(file.program);
     collectDefinitions(file.program, state);
+    collectSemanticMemberMutations(file.program, state);
     traverseJavaScriptAst(file.program, {
         enter: (node) => collectSemanticModuleLink(node, state),
     });
@@ -174,8 +182,43 @@ const bindInnerDeclaration = (node, parent, scope, state) => {
             mutable: true,
             kind: "catch",
         });
-    else if (t.isAssignmentExpression(node) && t.isIdentifier(node.left))
-        addAssignment(node.left, node.right, scope, state);
+    else if (t.isAssignmentExpression(node)) {
+        if (t.isIdentifier(node.left))
+            addAssignment(node.left, node.right, scope, state);
+        else
+            for (const identifier of assignedPatternIdentifiers(node.left))
+                addAssignment(identifier, node, scope, state);
+    }
+    else if (t.isUpdateExpression(node) && t.isIdentifier(node.argument))
+        addAssignment(node.argument, node, scope, state);
+    else if (t.isForOfStatement(node) || t.isForInStatement(node))
+        for (const identifier of assignedPatternIdentifiers(node.left))
+            addAssignment(identifier, node, scope, state);
+};
+const assignedPatternIdentifiers = (pattern) => {
+    const identifiers = [];
+    const pending = [pattern];
+    while (pending.length > 0) {
+        const node = pending.pop();
+        if (node === undefined)
+            continue;
+        if (t.isIdentifier(node))
+            identifiers.push(node);
+        else if (t.isRestElement(node))
+            pending.push(node.argument);
+        else if (t.isAssignmentPattern(node))
+            pending.push(node.left);
+        else if (t.isArrayPattern(node)) {
+            for (const element of node.elements)
+                if (element !== null)
+                    pending.push(element);
+        }
+        else if (t.isObjectPattern(node)) {
+            for (const property of node.properties)
+                pending.push(t.isRestElement(property) ? property.argument : property.value);
+        }
+    }
+    return identifiers;
 };
 const nestedScope = (node, parent, parentScope, state) => {
     const switchOwner = t.isSwitchCase(node) && parent !== null && t.isSwitchStatement(parent)
@@ -191,7 +234,8 @@ const nestedScope = (node, parent, parentScope, state) => {
         return undefined;
     const scope = {
         scopeId: semanticScopeId(kind, switchOwner ?? node),
-        parentScopeId: parentScope.scopeId,
+        parentScopeId: functionNameScope(node, parentScope, state)?.scopeId ??
+            parentScope.scopeId,
         kind,
         location: range(switchOwner ?? node),
         bindingsComplete: true,
@@ -201,6 +245,32 @@ const nestedScope = (node, parent, parentScope, state) => {
     state.scopesById.set(scope.scopeId, scope);
     return scope;
 };
+const functionNameScope = (node, parentScope, state) => {
+    if (!t.isFunctionExpression(node) || !t.isIdentifier(node.id))
+        return undefined;
+    // A named expression has a private name environment outside its parameters
+    // and body. Parameters and local declarations may shadow that name.
+    const scope = {
+        scopeId: `${semanticScopeId("block", node)}:function-name`,
+        parentScopeId: parentScope.scopeId,
+        kind: "block",
+        location: range(node),
+        bindingsComplete: true,
+        bindings: new Map(),
+    };
+    state.scopes.push(scope);
+    state.scopesById.set(scope.scopeId, scope);
+    addBinding({
+        state,
+        scope,
+        name: node.id.name,
+        kind: "function",
+        mutable: false,
+        definitionNode: node.id,
+        initializer: node,
+    });
+    return scope;
+};
 const scopeKind = (node, parent) => {
     if (t.isFunction(node))
         return "function";
@@ -245,16 +315,6 @@ const bindImports = (node, scope, state) => {
     }
 };
 const bindFunctionLocals = (node, scope, state) => {
-    if (t.isFunctionExpression(node) && t.isIdentifier(node.id))
-        addBinding({
-            state,
-            scope,
-            name: node.id.name,
-            kind: "function",
-            mutable: false,
-            definitionNode: node.id,
-            initializer: node,
-        });
     for (const parameter of node.params)
         bindPattern({
             pattern: t.isTSParameterProperty(parameter)
@@ -290,7 +350,9 @@ const bindPattern = (input) => {
         bindPattern({
             ...input,
             pattern: pattern.left,
-            initializer: initializer ?? pattern.right,
+            initializer: kind === "parameter" || kind === "catch"
+                ? initializer
+                : (initializer ?? pattern.right),
         });
         return;
     }
@@ -314,11 +376,11 @@ const bindPattern = (input) => {
                     projection: [],
                 });
             else {
-                const name = semanticStaticPropertyName(property.key, property.computed);
+                const name = semanticStaticPropertyKey(property.key, property.computed);
                 bindPattern({
                     ...input,
                     pattern: property.value,
-                    projection: [...projection, name === "" ? null : name],
+                    projection: [...projection, name],
                 });
             }
         }
@@ -355,6 +417,7 @@ const createBinding = (scope, name, kind, mutable) => ({
     name,
     kind,
     mutable,
+    mutatedPaths: [],
     definitions: [],
     initializers: [],
     directOrigins: [],

package/dist/domain/{javascriptSemanticAsyncEffects.js → javascript/javascriptSemanticAsyncEffects.js}

@@ -1,4 +1,5 @@
 import * as t from "@babel/types";
+import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js";
 import { semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
@@ -230,7 +231,7 @@ const timerMethodFromBinding = (binding) => {
     }
     return null;
 };
-const timerNamespaceBinding = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => timerModule(specifier) && importedPath.length === 0) ?? false;
+const timerNamespaceBinding = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => timerModule(specifier) && semanticBuiltinNamespacePath(importedPath)) ?? false;
 const timerModule = (specifier) => specifier === "timers" || specifier === "node:timers";
 const bindingId = (node, state) => t.isIdentifier(node)
     ? (resolveSemanticBindingState(state, node, node.name)?.bindingId ?? null)

package/dist/domain/{javascriptSemanticCallResolution.js → javascript/javascriptSemanticCallResolution.js}

@@ -1,7 +1,8 @@
 import * as t from "@babel/types";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { semanticCallableIdForNode } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
-import { compareCodePoints, range } from "./javascriptStaticAnalysisHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
 /** Resolve local callable candidates without following dynamic properties. */
 export const resolveLocalCallables = (input) => resolveCallables(input.node, {
     state: input.state,
@@ -101,14 +102,19 @@ export const parameterBindings = (callable, index, state) => {
     return [...scope.bindings.values()]
         .filter((binding) => binding.kind === "parameter" &&
         binding.definitions.some(({ kind, location }) => kind === "parameter" &&
-            parameterIndex(callable, location, state) === index))
+            parameterAcceptsArgument(callable, location, index, state)))
         .sort((left, right) => compareCodePoints(left.bindingId, right.bindingId));
 };
-const parameterIndex = (callable, location, state) => {
+const parameterAcceptsArgument = (callable, location, argumentIndex, state) => {
     const node = state.callableNodesById.get(callable.callableId);
     if (!t.isFunction(node))
-        return -1;
-    return node.params.findIndex((parameter) => rangeContains(range(parameter), location));
+        return false;
+    const parameterIndex = node.params.findIndex((parameter) => rangeContains(range(parameter), location));
+    if (parameterIndex === argumentIndex)
+        return true;
+    return (parameterIndex >= 0 &&
+        parameterIndex < argumentIndex &&
+        t.isRestElement(node.params[parameterIndex]));
 };
 const rangeContains = (outer, inner) => (outer.start.line < inner.start.line ||
     (outer.start.line === inner.start.line &&

package/dist/domain/{javascriptSemanticCalls.js → javascript/javascriptSemanticCalls.js}

@@ -1,5 +1,5 @@
 import * as t from "@babel/types";
-import { semanticCallableIdForNode, semanticReferenceRole, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
+import { semanticCallableIdForNode, semanticReferenceRole, semanticStaticPropertyKey, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, isUnshadowedGlobal, } from "./javascriptSemanticState.js";
 import { parameterBindings, resolveLocalCallables, } from "./javascriptSemanticCallResolution.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
@@ -98,7 +98,7 @@ const collectCallSite = (node, parent, owner, context) => {
 };
 const collectCallResultFlow = (site, node, context) => {
     for (const assigned of assignedSemanticResultBindings(node, context.ancestors, context.state).filter(({ projectionPath }) => projectionPath.length === 0)) {
-        const binding = [...context.state.bindingsById.values()].find(({ bindingId }) => bindingId === assigned.bindingId);
+        const binding = context.state.bindingsById.get(assigned.bindingId);
         if (binding === undefined)
             continue;
         const identifierRange = range(assigned.identifier);
@@ -118,6 +118,9 @@ const collectCallResultFlow = (site, node, context) => {
 const retainedArguments = (nodes) => {
     const retained = [];
     for (const [index, node] of nodes.entries()) {
+        // Babel recovery can leave null slots; retain the other argument positions.
+        if (node === null)
+            continue;
         retained.push({
             index,
             location: range(node),
@@ -204,7 +207,7 @@ const collectCapture = (node, parent, owner, context) => {
 };
 const collectDynamicProperty = (node, owner, state, output) => {
     if ((t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) &&
-        semanticStaticPropertyName(node.property, node.computed) === "")
+        semanticStaticPropertyKey(node.property, node.computed) === null)
         addFrontier({
             kind: "dynamic-property",
             callableId: owner?.callableId ?? null,
@@ -213,7 +216,7 @@ const collectDynamicProperty = (node, owner, state, output) => {
         }, state, output);
     else if ((t.isObjectProperty(node) || t.isObjectMethod(node)) &&
         node.computed &&
-        semanticStaticPropertyName(node.key, true) === "")
+        semanticStaticPropertyKey(node.key, true) === null)
         addFrontier({
             kind: "dynamic-property",
             callableId: owner?.callableId ?? null,

package/dist/domain/{javascriptSemanticChildProcesses.js → javascript/javascriptSemanticChildProcesses.js}

@@ -1,8 +1,10 @@
 import * as t from "@babel/types";
+import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js";
 import { semanticCallableIdForNode, semanticStaticPropertyName, } from "./javascriptSemanticProjection.js";
 import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
-import { compareCodePoints, range } from "./javascriptStaticAnalysisHelpers.js";
+import { range } from "./javascriptStaticAnalysisHelpers.js";
 import { dataEffectLiteralString, dataEffectMemberCallee, assignedSemanticResultBindings, scalarAssignedResultBinding, semanticProjectedBindingFacts, } from "./javascriptSemanticDataEffectHelpers.js";
 const CHILD_PROCESS_METHODS = ["spawn", "exec", "execFile", "fork"];
 const CHILD_LISTENER_METHODS = ["on", "once", "addListener"];
@@ -173,7 +175,8 @@ const methodFromBinding = (binding) => {
     return null;
 };
 const admittedChildMethod = (value) => CHILD_PROCESS_METHODS.find((candidate) => candidate === value) ?? null;
-const childProcessNamespace = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => childProcessModule(specifier) && importedPath.length === 0) ?? false;
+const childProcessNamespace = (binding) => binding?.directOrigins.some(({ specifier, importedPath }) => childProcessModule(specifier) &&
+    semanticBuiltinNamespacePath(importedPath)) ?? false;
 const childProcessModule = (specifier) => specifier === "child_process" || specifier === "node:child_process";
 const resolveChildCandidates = (node, binding, spawnByNode, spawnsByBinding) => {
     const direct = spawnByNode.get(node);