rea-agents 4.1.0 → 6.0.0

package/dist/domain/javascript/javascriptSemanticTraversal.js

@@ -0,0 +1,55 @@
+import * as t from "@babel/types";
+/**
+ * Visit every Babel AST node in deterministic source-tree order.
+ *
+ * `readAncestors` returns a snapshot during `enter`, outermost-first and
+ * ending with the direct parent. Callers
+ * need it whenever meaning depends on where a node sits, not just what its
+ * immediate parent is — a binding inside `catch ({message})` or `({a} = o)`
+ * has an ObjectProperty parent, so the parent alone cannot say whether the
+ * identifier declares a binding or is assigned to.
+ */
+export const traverseJavaScriptAst = (root, visitor) => {
+    const ancestors = [];
+    const enter = (node, parent) => {
+        visitor.enter(node, parent, () => [...ancestors]);
+        ancestors.push(node);
+        return { node, parent, children: childNodes(node), nextIndex: 0 };
+    };
+    const pending = [enter(root, null)];
+    while (pending.length > 0) {
+        const current = pending.at(-1);
+        if (current === undefined)
+            break;
+        const child = current.children[current.nextIndex];
+        if (child !== undefined) {
+            current.nextIndex += 1;
+            pending.push(enter(child, current.node));
+        }
+        else {
+            visitor.exit?.(current.node, current.parent);
+            ancestors.pop();
+            pending.pop();
+        }
+    }
+};
+const childNodes = (node) => {
+    const keys = t.VISITOR_KEYS[node.type];
+    if (keys === undefined)
+        return [];
+    const children = [];
+    for (const key of keys) {
+        const value = Reflect.get(node, key);
+        if (t.isNode(value)) {
+            children.push(value);
+            continue;
+        }
+        if (!Array.isArray(value))
+            continue;
+        for (const item of value) {
+            if (t.isNode(item))
+                children.push(item);
+        }
+    }
+    return children;
+};

package/dist/domain/javascript/javascriptSemanticValueTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/{javascriptSemanticValues.js → javascript/javascriptSemanticValues.js}

@@ -1,8 +1,9 @@
 import * as t from "@babel/types";
-import { resolveSemanticBindingState, semanticResolutionBlocked, } from "./javascriptSemanticState.js";
-import { stringValue } from "./javascriptStaticAnalysisHelpers.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
-import { semanticStaticPropertyName } from "./javascriptAstValues.js";
+import { invalidateSemanticMutationPath } from "./javascriptSemanticMutationValues.js";
+import { resolveSemanticBindingState, } from "./javascriptSemanticState.js";
+import { semanticRequireOrigin } from "./javascriptSemanticRequireOrigin.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
+import { semanticStaticPropertyKey } from "./javascriptAstValues.js";
 import { semanticAmbiguousProvenance, semanticLocalProvenance, semanticOriginsProvenance, semanticUnresolvedProvenance, uniqueSemanticOrigins, } from "./javascriptSemanticProvenance.js";
 import { semanticPrimitiveCandidates as primitiveCandidates, semanticPrimitiveSet as primitiveSet, semanticPrimitiveValue as primitiveValue, } from "./javascriptSemanticPrimitives.js";
 /** Evaluate one binding in the bounded constant-value lattice. */
@@ -28,7 +29,8 @@ const evaluateBinding = (binding, context) => {
     if (initializer === undefined)
         return { status: "unknown", reason: "Missing binding initializer." };
     const nested = nestedContext(context, binding.bindingId);
-    return projectValue(evaluateExpression(initializer.node, nested), initializer.projection);
+    const value = projectValue(evaluateExpression(initializer.node, nested), initializer.projection);
+    return binding.mutatedPaths.reduce(invalidateSemanticMutationPath, value);
 };
 const evaluateExpression = (node, context) => {
     const literal = primitiveValue(node);
@@ -109,8 +111,8 @@ const evaluateObject = (node, context) => {
             invalidateEarlierProperties();
             continue;
         }
-        const name = semanticStaticPropertyName(property.key, property.computed);
-        if (name === "" && !t.isStringLiteral(property.key, { value: "" })) {
+        const name = semanticStaticPropertyKey(property.key, property.computed);
+        if (name === null) {
             unknownProperties = true;
             if (omittedProperties !== null)
                 omittedProperties += 1;
@@ -180,18 +182,55 @@ const evaluateArray = (node, context) => {
         : { status: "array", items, unknownItems: false, omittedItems: 0 };
 };
 const evaluateMember = (node, context) => {
-    if (!t.isNode(node.object))
-        return { status: "unknown", reason: "Unsupported member base." };
-    const key = memberKey(node);
-    if (key === undefined)
-        return { status: "unknown", reason: "Dynamic member key." };
-    return projectValue(evaluateExpression(node.object, nestedContext(context)), [
-        key,
-    ]);
+    const keys = [];
+    let current = node;
+    let value;
+    while (t.isMemberExpression(current) ||
+        t.isOptionalMemberExpression(current)) {
+        if (!t.isNode(current.object)) {
+            value = { status: "unknown", reason: "Unsupported member base." };
+            break;
+        }
+        const key = semanticStaticPropertyKey(current.property, current.computed);
+        if (key === null) {
+            value = { status: "unknown", reason: "Dynamic member key." };
+            break;
+        }
+        keys.push(key);
+        current = current.object;
+    }
+    value ??= evaluateExpression(current, nestedContext(context));
+    for (const key of keys.reverse())
+        value = projectValue(value, [key]);
+    return value;
 };
 const evaluateAddition = (node, context) => {
-    const left = primitiveCandidates(evaluateExpression(node.left, nestedContext(context)));
-    const right = primitiveCandidates(evaluateExpression(node.right, nestedContext(context)));
+    const pending = [];
+    let current = node;
+    while (true) {
+        if (t.isBinaryExpression(current, { operator: "+" })) {
+            pending.push({ node: current, left: undefined });
+            current = current.left;
+            continue;
+        }
+        let value = evaluateExpression(current, nestedContext(context));
+        while (true) {
+            const parent = pending.at(-1);
+            if (parent === undefined)
+                return value;
+            if (parent.left === undefined) {
+                parent.left = value;
+                current = parent.node.right;
+                break;
+            }
+            value = addPrimitiveValues(parent.left, value);
+            pending.pop();
+        }
+    }
+};
+const addPrimitiveValues = (leftValue, rightValue) => {
+    const left = primitiveCandidates(leftValue);
+    const right = primitiveCandidates(rightValue);
     if (left === null || right === null)
         return { status: "unknown", reason: "Non-primitive addition." };
     const values = left.flatMap((leftValue) => right.map((rightValue) => typeof leftValue === "string" || typeof rightValue === "string"
@@ -279,7 +318,7 @@ const provenanceForBinding = (binding, context) => {
     })));
 };
 const provenanceForExpression = (node, context) => {
-    const required = requireOrigin(node, context.state);
+    const required = semanticRequireOrigin(node, context.state);
     if (required !== undefined)
         return semanticOriginsProvenance([required]);
     if (t.isIdentifier(node)) {
@@ -289,17 +328,25 @@ const provenanceForExpression = (node, context) => {
             : provenanceForBinding(binding, nestedContext(context));
     }
     if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
-        if (!t.isNode(node.object))
-            return semanticUnresolvedProvenance("unknown", "Unsupported member base.");
-        const member = memberKey(node);
-        if (typeof member !== "string")
-            return semanticUnresolvedProvenance("unknown", "Dynamic provenance member.");
-        const base = provenanceForExpression(node.object, nestedContext(context));
+        const members = [];
+        let current = node;
+        while (t.isMemberExpression(current) ||
+            t.isOptionalMemberExpression(current)) {
+            if (!t.isNode(current.object))
+                return semanticUnresolvedProvenance("unknown", "Unsupported member base.");
+            const member = semanticStaticPropertyKey(current.property, current.computed);
+            if (member === null)
+                return semanticUnresolvedProvenance("unknown", "Dynamic provenance member.");
+            members.push(member);
+            current = current.object;
+        }
+        const base = provenanceForExpression(current, nestedContext(context));
+        const path = members.reverse();
         return base.status !== "module"
             ? base
             : semanticOriginsProvenance(base.origins.map((origin) => ({
                 ...origin,
-                importedPath: [...origin.importedPath, member],
+                importedPath: [...origin.importedPath, ...path],
             })));
     }
     if (t.isConditionalExpression(node) || t.isLogicalExpression(node)) {
@@ -316,35 +363,12 @@ const provenanceForExpression = (node, context) => {
     }
     return semanticLocalProvenance();
 };
-const requireOrigin = (node, state) => {
-    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
-        if (!t.isNode(node.object))
-            return undefined;
-        const nested = requireOrigin(node.object, state);
-        const member = memberKey(node);
-        return nested === undefined || typeof member !== "string"
-            ? undefined
-            : { ...nested, importedPath: [...nested.importedPath, member] };
-    }
-    if (!t.isCallExpression(node) ||
-        !t.isIdentifier(node.callee, { name: "require" }))
-        return undefined;
-    if (resolveSemanticBindingState(state, node.callee, "require") !== undefined ||
-        semanticResolutionBlocked(state, node.callee, "require"))
-        return undefined;
-    const specifier = stringValue(node.arguments[0]);
-    return specifier === undefined ? undefined : { specifier, importedPath: [] };
-};
 const mergeValues = (values) => {
     const primitives = values.flatMap((value) => primitiveCandidates(value) ?? []);
     return values.every((value) => value.status === "union" || value.status === "literal")
         ? primitiveSet(primitives)
         : { status: "ambiguous", reason: "Branches have incompatible values." };
 };
-const memberKey = (node) => {
-    const name = semanticStaticPropertyName(node.property, node.computed);
-    return name === "" ? undefined : name;
-};
 const nestedContext = (context, bindingId) => ({
     state: context.state,
     bindings: bindingId === undefined

package/dist/domain/{javascriptStaticAnalysis.js → javascript/javascriptStaticAnalysis.js}

@@ -1,4 +1,5 @@
 import * as t from "@babel/types";
+import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { inspectElectronStaticNode } from "./electronStaticAnalysis.js";
 import { detectVendors, failedJavaScriptStaticAnalysis, registrationKey, sortedUnique, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty, inspectRoleProperty, } from "./javascriptStaticAnalysisCalls.js";
@@ -21,10 +22,12 @@ export const analyzeParsedJavaScriptStaticSource = (source, file) => {
     return finalizeStaticAnalysis(source, file, accumulator);
 };
 const traverseStaticSource = (source, file, accumulator) => {
-    t.traverseFast(file, (node) => {
-        accumulator.visitedNodes += 1;
-        inspectNode(source, node, accumulator);
-        return undefined;
+    traverseJavaScriptAst(file, {
+        enter: (node) => {
+            accumulator.visitedNodes += 1;
+            inspectNode(source, node, accumulator);
+            return undefined;
+        },
     });
 };
 const finalizeStaticAnalysis = (source, file, accumulator) => {

package/dist/domain/{javascriptStaticAnalysisBundler.js → javascript/javascriptStaticAnalysisBundler.js}

@@ -1,6 +1,7 @@
 import * as t from "@babel/types";
+import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
 import { collectJavaScriptExports, fingerprintJavaScriptAst, } from "./javascriptAstFingerprint.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 import { addFindingOnce } from "./javascriptStaticAnalysisFindings.js";
 import { argumentValue, calleeName, chunkRuntime, factoryRequireName, moduleFactory, modulePropertyName, range, registrationKey, sha256Text, sourceSlice, staticArrayValues, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect a bundler registration call and recover its module table. */
@@ -160,17 +161,19 @@ const collectBundlerAsyncChunkKeys = (factory, requireName) => requireName === n
 const collectBundlerCallArgumentValues = (factory, callee) => {
     const values = [];
     let unknown = 0;
-    t.traverseFast(factory, (node) => {
-        if (!t.isCallExpression(node) && !t.isNewExpression(node))
+    traverseJavaScriptAst(factory, {
+        enter: (node) => {
+            if (!t.isCallExpression(node) && !t.isNewExpression(node))
+                return undefined;
+            if (calleeName(node.callee) !== callee)
+                return undefined;
+            const value = argumentValue(node.arguments[0]);
+            if (value === undefined)
+                unknown += 1;
+            else
+                values.push(value);
             return undefined;
-        if (calleeName(node.callee) !== callee)
-            return undefined;
-        const value = argumentValue(node.arguments[0]);
-        if (value === undefined)
-            unknown += 1;
-        else
-            values.push(value);
-        return undefined;
+        },
     });
     return uniqueValues(values, unknown);
 };

package/dist/domain/{javascriptStaticAnalysisCalls.js → javascript/javascriptStaticAnalysisCalls.js}

@@ -1,5 +1,5 @@
 import * as t from "@babel/types";
-import { sanitizeEndpointCandidate } from "./browserObservation.js";
+import { sanitizeEndpointCandidate } from "../browserObservation.js";
 import { addFindingOnce, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
 import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, semanticStaticPropertyName, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
@@ -103,7 +103,7 @@ const inspectEndpointCall = (node, name, first, context) => {
             value: first,
             mechanism: `call:${name}`,
         });
-    const endpoint = endpointArgumentHelper(name, node.arguments);
+    const endpoint = endpointArgumentHelper(name, node.arguments, node.callee);
     if (endpoint !== undefined)
         addEndpoint(context, {
             node,

package/dist/domain/{javascriptStaticAnalysisHelpers.js → javascript/javascriptStaticAnalysisHelpers.js}

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
 import { posix } from "node:path";
+import { fileURLToPath } from "node:url";
 import * as t from "@babel/types";
 import { semanticStaticPropertyName } from "./javascriptAstValues.js";
-import { compareCodePoints } from "./canonicalOrdering.js";
+import { compareCodePoints } from "../canonicalOrdering.js";
 export { propertyName, semanticStaticPropertyName, } from "./javascriptAstValues.js";
 /** Explicit result for source text that Babel cannot parse. */
 export const failedJavaScriptStaticAnalysis = () => ({
@@ -42,20 +43,34 @@ export const chunkRuntime = (call) => {
     return findChunkRuntime(call.callee.object);
 };
 const findChunkRuntime = (node) => {
-    if (t.isIdentifier(node) && /(?:webpack|rspack)Chunk/iu.test(node.name))
-        return node.name;
-    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
-        const property = semanticStaticPropertyName(node.property, node.computed);
-        if (/(?:webpack|rspack)Chunk/iu.test(property))
-            return property;
-        return t.isNode(node.object) ? findChunkRuntime(node.object) : undefined;
+    const pending = [node];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current === undefined)
+            continue;
+        if (t.isIdentifier(current) &&
+            /(?:webpack|rspack)Chunk/iu.test(current.name))
+            return current.name;
+        if (t.isMemberExpression(current) ||
+            t.isOptionalMemberExpression(current)) {
+            const property = semanticStaticPropertyName(current.property, current.computed);
+            if (/(?:webpack|rspack)Chunk/iu.test(property))
+                return property;
+            if (t.isNode(current.object))
+                pending.push(current.object);
+            continue;
+        }
+        if (t.isAssignmentExpression(current)) {
+            pending.push(current.right, current.left);
+            continue;
+        }
+        if (t.isLogicalExpression(current) || t.isBinaryExpression(current)) {
+            pending.push(current.right, current.left);
+            continue;
+        }
+        if (t.isParenthesizedExpression(current) || t.isTSAsExpression(current))
+            pending.push(current.expression);
     }
-    if (t.isAssignmentExpression(node))
-        return findChunkRuntime(node.left) ?? findChunkRuntime(node.right);
-    if (t.isLogicalExpression(node) || t.isBinaryExpression(node))
-        return findChunkRuntime(node.left) ?? findChunkRuntime(node.right);
-    if (t.isParenthesizedExpression(node) || t.isTSAsExpression(node))
-        return findChunkRuntime(node.expression);
     return undefined;
 };
 /** Return a literal function factory from one module-table property. */
@@ -125,8 +140,7 @@ const staticCallPath = (node) => {
             ? stringValue(node.arguments[0])
             : undefined;
     if (name === "fileURLToPath" || name.endsWith(".fileURLToPath")) {
-        const argument = argumentNode(node.arguments[0]);
-        return argument === undefined ? undefined : staticPathAt(argument);
+        return staticFileUrlPath(argumentNode(node.arguments[0]));
     }
     if ((name === "dirname" || name.endsWith(".dirname")) &&
         isFileIdentity(argumentNode(node.arguments[0])))
@@ -148,6 +162,53 @@ const staticCallPath = (node) => {
     }
     return parts.length === 0 ? undefined : posix.join(...parts);
 };
+const staticFileUrlPath = (argument) => {
+    if (argument === undefined)
+        return undefined;
+    return isSourceFileUrl(argument)
+        ? sourceRelativeFileUrlPath(argument)
+        : staticPathAt(argument);
+};
+/** Project a known source-relative URL through the actual file URL decoder. */
+const sourceRelativeFileUrlPath = (node) => {
+    if (!isSourceFileUrl(node))
+        return undefined;
+    const value = stringValue(node.arguments[0]);
+    if (value === undefined ||
+        (value.split(/[?#]/u, 1)[0] ?? "") === "" ||
+        value !== value.trim() ||
+        value.includes("\\") ||
+        [...value].some((character) => character.charCodeAt(0) < 32) ||
+        /^[a-z][a-z0-9+.-]*:/iu.test(value) ||
+        value.startsWith("//") ||
+        /%(?:2e|2f|5c)/iu.test(value.split(/[?#]/u, 1)[0] ?? ""))
+        return undefined;
+    // A sufficiently deep inert anchor preserves any leading parent segments
+    // without using this host's cwd or inventing the application's directory.
+    const directory = `/${"source/".repeat(value.split("/").length + 1)}`;
+    try {
+        const resolved = new URL(value, `file://${directory}entry.js`);
+        const path = fileURLToPath(resolved, { windows: false });
+        if (value.startsWith("/"))
+            return path;
+        const relative = posix.relative(directory, path) || ".";
+        // Keep the established explicit source-directory observation spelling.
+        return value.startsWith("./") &&
+            relative !== "." &&
+            !relative.startsWith("../")
+            ? `./${relative}`
+            : relative;
+    }
+    catch (cause) {
+        // Malformed escapes and non-file URL forms remain unknown.
+        void cause;
+        return undefined;
+    }
+};
+const isSourceFileUrl = (node) => (t.isCallExpression(node) || t.isNewExpression(node)) &&
+    (calleeName(node.callee) === "URL" ||
+        calleeName(node.callee).endsWith(".URL")) &&
+    isFileIdentity(argumentNode(node.arguments[1]));
 const staticResolvedPath = (node) => {
     const parts = [];
     for (const argument of node.arguments) {
@@ -223,14 +284,135 @@ const isFileIdentity = (node) => {
     return ((name === "fileURLToPath" || name.endsWith(".fileURLToPath")) &&
         isFileIdentity(argumentNode(node.arguments[0])));
 };
+const XHR_METHODS = new Set([
+    "CONNECT",
+    "DELETE",
+    "GET",
+    "HEAD",
+    "OPTIONS",
+    "PATCH",
+    "POST",
+    "PUT",
+    "TRACE",
+]);
+/** An absolute HTTP(S)/WebSocket URL, or an absolute or relative path. */
+const isRequestUrlLiteral = (value) => /^(?:https?|wss?):\/\//iu.test(value) ||
+    value.startsWith("/") ||
+    value.startsWith("./") ||
+    value.startsWith("../");
+/**
+ * Browsing-context and document `open` take a URL or type first and a target
+ * name second. The name is only a spelling, since `parent` or `self` may be a
+ * local XHR binding, so it never overrides a literal HTTP method.
+ */
+const WINDOW_OPEN_CALL = /(?:^|\.)(?:window|self|globalThis|top|parent|opener|frames|document)\.open$/u;
+/** Node `fs.open` flag strings, which are never request URLs. */
+const FS_OPEN_FLAGS = new Set([
+    "a",
+    "a+",
+    "as",
+    "as+",
+    "ax",
+    "ax+",
+    "r",
+    "r+",
+    "rs",
+    "rs+",
+    "sa",
+    "sa+",
+    "sr",
+    "sr+",
+    "w",
+    "w+",
+    "wx",
+    "wx+",
+    "xa",
+    "xa+",
+    "xw",
+    "xw+",
+]);
+/** Reserved browsing-context names (ASCII case-insensitive). */
+const BROWSING_CONTEXT_KEYWORDS = new Set([
+    "_blank",
+    "_parent",
+    "_self",
+    "_top",
+]);
+/**
+ * Read `XMLHttpRequest.open(method, url)`. `fs.open(path, "r")` and
+ * `window.open(url, "_blank")` share the callee name. A literal method must
+ * be an HTTP method; with a computed method, the second literal is a URL
+ * unless it is provably an fs flag or a browsing-context keyword, or the
+ * receiver is spelled as a browsing context or storage. XHR normalizes the standard
+ * methods' case; extension methods such as WebDAV `PROPFIND` are
+ * conventionally uppercase tokens.
+ */
+const xhrOpenUrl = (name, methodNode, urlNode) => {
+    const url = stringValue(urlNode);
+    if (url === undefined)
+        return undefined;
+    const method = stringValue(methodNode);
+    // IndexedDB and Cache Storage `open` take a name and a version, so a
+    // receiver spelled as storage needs a standard HTTP method literal.
+    const storage = storageKind(name) !== undefined;
+    if (method === undefined)
+        return storage ||
+            WINDOW_OPEN_CALL.test(name) ||
+            FS_OPEN_FLAGS.has(url) ||
+            BROWSING_CONTEXT_KEYWORDS.has(url.toLowerCase())
+            ? undefined
+            : url;
+    return XHR_METHODS.has(method.toUpperCase()) ||
+        (!storage && /^[A-Z][A-Z-]*$/u.test(method))
+        ? url
+        : undefined;
+};
+const KEYED_COLLECTION_CONSTRUCTORS = new Set([
+    "FormData",
+    "Headers",
+    "Map",
+    "Set",
+    "URLSearchParams",
+    "WeakMap",
+    "WeakSet",
+]);
+/**
+ * Whether a get/delete receiver is spelled as a keyed collection: a
+ * constructed Map, Set, Headers, FormData, or URLSearchParams, or a
+ * `headers`/`searchParams` property. Spelling alone does not prove the
+ * binding, so callers keep URL and path literals as requests.
+ */
+const isKeyedCollectionReceiver = (callee) => {
+    if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee))
+        return false;
+    const receiver = callee.object;
+    if (t.isNewExpression(receiver))
+        return (t.isIdentifier(receiver.callee) &&
+            KEYED_COLLECTION_CONSTRUCTORS.has(receiver.callee.name));
+    if (!t.isMemberExpression(receiver) &&
+        !t.isOptionalMemberExpression(receiver))
+        return false;
+    const property = semanticStaticPropertyName(receiver.property, receiver.computed);
+    return property === "headers" || property === "searchParams";
+};
 /** Select the literal URL argument for recognized network callees. */
-export const endpointArgument = (name, args) => {
+export const endpointArgument = (name, args, callee) => {
     if (name === "fetch" || name.endsWith(".fetch") || name === "WebSocket")
         return stringValue(args[0]);
-    if (name.endsWith(".open") && stringValue(args[1]) !== undefined)
-        return stringValue(args[1]);
-    if (["get", "post", "put", "patch", "delete", "request"].some((method) => name === method || name.endsWith(`.${method}`)))
-        return stringValue(args[0]);
+    if (name.endsWith(".open"))
+        return xhrOpenUrl(name, args[0], args[1]);
+    const method = ["get", "post", "put", "patch", "delete", "request"].find((candidate) => name === candidate || name.endsWith(`.${candidate}`));
+    if (method !== undefined) {
+        const value = stringValue(args[0]);
+        // Only get and delete also belong to the keyed-collection APIs, whose
+        // keys are header, field, and parameter names rather than URLs or paths.
+        return value !== undefined &&
+            (method === "get" || method === "delete") &&
+            !isRequestUrlLiteral(value) &&
+            isKeyedCollectionReceiver(callee)
+            ? undefined
+            : value;
+    }
     if (name.endsWith("loadURL"))
         return stringValue(args[0]);
     return undefined;
@@ -250,20 +432,24 @@ export const storageKind = (name) => {
     return undefined;
 };
 /** Produce a dotted callee name from member syntax. */
-export const calleeName = (node) => calleeNameAt(node);
-const calleeNameAt = (node) => {
-    if (t.isIdentifier(node))
-        return node.name;
-    if (t.isImport(node))
-        return "import";
-    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
-        const object = t.isNode(node.object) ? calleeNameAt(node.object) : "";
-        // A dynamic key commits no name: `target[method]()` must not be reported as
-        // `target.method`, which would fabricate a runtime call shape.
-        const property = memberPropertyName(node);
-        return object === "" ? property : `${object}.${property}`;
+export const calleeName = (node) => {
+    const segments = [];
+    while (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        // Dynamic keys retain their syntax identity instead of inventing a name.
+        segments.push(memberPropertyName(node));
+        if (!t.isNode(node.object))
+            break;
+        node = node.object;
     }
-    return "";
+    const base = t.isIdentifier(node)
+        ? node.name
+        : t.isImport(node)
+            ? "import"
+            : "";
+    segments.push(base);
+    segments.reverse();
+    const first = segments.findIndex((segment) => segment !== "");
+    return first === -1 ? "" : segments.slice(first).join(".");
 };
 /** Read a member property only when its syntax commits an exact name. */
 const memberPropertyName = (node) => node.computed &&
@@ -271,14 +457,19 @@ const memberPropertyName = (node) => node.computed &&
     !t.isNumericLiteral(node.property)
     ? `[computed@${String(node.property.start ?? -1)}]`
     : semanticStaticPropertyName(node.property, node.computed);
-/** Return a string literal value without evaluating an expression. */
-export const stringValue = (node) => (t.isStringLiteral(node) ? node.value : undefined);
-/** Return a string or numeric argument literal. */
-export const argumentValue = (node) => {
-    if (t.isStringLiteral(node) || t.isNumericLiteral(node))
-        return String(node.value);
+/**
+ * Return a string literal value without evaluating an expression. A template
+ * literal without substitutions denotes the same exact string.
+ */
+export const stringValue = (node) => {
+    if (t.isStringLiteral(node))
+        return node.value;
+    if (t.isTemplateLiteral(node) && node.expressions.length === 0)
+        return node.quasis[0]?.value.cooked ?? undefined;
     return undefined;
 };
+/** Return a string or numeric argument literal. */
+export const argumentValue = (node) => t.isNumericLiteral(node) ? String(node.value) : stringValue(node);
 /** Prefix a static argument value when one is available. */
 export const prefixedArgument = (prefix, node) => {
     const value = argumentValue(node);

package/dist/domain/{sourceToBundleComparison.js → javascript/sourceToBundleComparison.js}

@@ -1,5 +1,5 @@
-import { compareCodePoints, uniqueSorted } from "./canonicalOrdering.js";
-import { absenceClaimable, canonicalDigest } from "./comparisonSemantics.js";
+import { compareCodePoints, uniqueSorted } from "../canonicalOrdering.js";
+import { absenceClaimable, canonicalDigest } from "../comparisonSemantics.js";
 import { SOURCE_TO_BUNDLE_SIGNAL_WEIGHTS, sourceToBundleComparisonResultSchema, } from "./sourceToBundleComparisonSchemas.js";
 import { buildSourceToBundleCandidateIndex, candidateIdsForSource, historicalSourceFiles, scoreSourceToBundleCandidate, sourceBearingNodes, } from "./sourceToBundleSignals.js";
 /** Compare historical source files to static source-bearing application nodes. */