rea-agents 5.0.0 → 6.1.0

package/dist/domain/javascript/javascriptSemanticPrimitives.js

@@ -1,16 +1,32 @@
 import * as t from "@babel/types";
 import { compareCodePoints } from "../canonicalOrdering.js";
 import { semanticPrimitiveKey } from "./javascriptSemanticProvenance.js";
+import { readExactJavaScriptLiteral } from "./javascriptAstValues.js";
+import { SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, exceedsSemanticPrimitiveStringByteBudget, semanticResourceLimitUnknown, } from "./javascriptSemanticResourceLimits.js";
+/**
+ * Keep eight independent binary choices exact, while bounding the next
+ * exponential expansion before it allocates hundreds more alternatives.
+ */
+export const MAX_SEMANTIC_PRIMITIVE_CANDIDATES = SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT;
 /** Normalize one bounded collection of possible primitive values. */
 export const semanticPrimitiveSet = (values) => {
-    if (values.some((value) => typeof value === "number" && !Number.isFinite(value)))
-        return {
-            status: "unknown",
-            reason: "Nonfinite numbers are outside the JSON primitive lattice.",
-        };
-    const unique = [
-        ...new Map(values.map((value) => [semanticPrimitiveKey(value), value])).values(),
-    ].sort((left, right) => compareCodePoints(semanticPrimitiveKey(left), semanticPrimitiveKey(right)));
+    const uniqueValues = new Set();
+    for (const value of values) {
+        if (typeof value === "number" && !Number.isFinite(value))
+            return {
+                status: "unknown",
+                reason: "Nonfinite numbers are outside the JSON primitive lattice.",
+            };
+        uniqueValues.add(value);
+        if (uniqueValues.size > MAX_SEMANTIC_PRIMITIVE_CANDIDATES)
+            return semanticResourceLimitUnknown("primitive-candidates");
+    }
+    if (exceedsSemanticPrimitiveStringByteBudget([...uniqueValues].flatMap((value) => typeof value === "string" ? [value] : [])))
+        return semanticResourceLimitUnknown("primitive-bytes");
+    const unique = [...uniqueValues]
+        .map((value) => ({ key: semanticPrimitiveKey(value), value }))
+        .sort((left, right) => compareCodePoints(left.key, right.key))
+        .map(({ value }) => value);
     const only = unique[0];
     return unique.length === 1 && only !== undefined
         ? { status: "literal", value: only }
@@ -24,13 +40,5 @@ export const semanticPrimitiveCandidates = (value) => value.status === "literal"
         : null;
 /** Parse one Babel primitive literal without evaluating code. */
 export const semanticPrimitiveValue = (node) => {
-    if (t.isStringLiteral(node))
-        return { found: true, value: node.value };
-    if (t.isNumericLiteral(node) && Number.isFinite(node.value))
-        return { found: true, value: node.value };
-    if (t.isBooleanLiteral(node))
-        return { found: true, value: node.value };
-    if (t.isNullLiteral(node))
-        return { found: true, value: null };
-    return { found: false };
+    return readExactJavaScriptLiteral(node);
 };

package/dist/domain/javascript/javascriptSemanticQuerySchemas.js

@@ -4,12 +4,16 @@ import { jsonValueSchema } from "../jsonValue.js";
 import { digestSchema } from "../digests.js";
 import { prefixedDigestSchema } from "../digests.js";
 const semanticNodeIdSchema = prefixedDigestSchema("jsrg_node");
+const literalValueSchema = jsonValueSchema.refine((value) => value === null ||
+    typeof value === "string" ||
+    typeof value === "number" ||
+    typeof value === "boolean", "Literal seeds accept only JSON primitive values");
+// Zod derivations drop the shared schema's JSON Schema projection override;
+// re-apply it so MCP catalog generation keeps projecting `{}`.
+literalValueSchema._zod.toJSONSchema = () => ({});
 const literalSeedSchema = z.strictObject({
     kind: z.literal("literal"),
-    value: jsonValueSchema.refine((value) => value === null ||
-        typeof value === "string" ||
-        typeof value === "number" ||
-        typeof value === "boolean", "Literal seeds accept only JSON primitive values"),
+    value: literalValueSchema,
 });
 /** Authenticated starting points accepted by semantic tracing. */
 export const javaScriptSemanticQuerySeedSchema = z.discriminatedUnion("kind", [

package/dist/domain/javascript/javascriptSemanticResourceLimits.js

@@ -0,0 +1,77 @@
+/** Maximum distinct alternatives retained in one normalized primitive value. */
+export const SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT = 256;
+/** Maximum active expression nesting during inert semantic evaluation. */
+export const SEMANTIC_EXPRESSION_DEPTH_LIMIT = 256;
+/** Bound normalized strings and transient keys independently of transport limits. */
+export const SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT = 1_048_576;
+const RESOURCE_LIMIT_REASON = {
+    "primitive-candidates": "Primitive candidate budget exceeded (maximum 256 alternatives).",
+    "primitive-bytes": "Primitive string-byte budget exceeded (maximum 1048576 estimated JSON bytes).",
+    "expression-depth": "Semantic expression depth budget exceeded (maximum 256 nested expressions).",
+};
+/** Check UTF-16 length against worst-case JSON escaping without flattening. */
+const jsonStringBytesFromLength = (codeUnits) => codeUnits * 6 + 2;
+/** Bound string payload before JSON key serialization or candidate creation. */
+export const exceedsSemanticPrimitiveStringByteBudget = (strings) => {
+    let total = 0;
+    for (const value of strings) {
+        total += jsonStringBytesFromLength(value.length);
+        if (total > SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT)
+            return true;
+    }
+    return false;
+};
+/** Bound all outputs of a primitive addition before concatenating any. */
+export const exceedsSemanticPrimitiveAdditionByteBudget = (left, right) => {
+    let total = 0;
+    for (const leftValue of left) {
+        for (const rightValue of right) {
+            if (typeof leftValue !== "string" && typeof rightValue !== "string")
+                continue;
+            const length = String(leftValue).length + String(rightValue).length;
+            total += jsonStringBytesFromLength(length);
+            if (total > SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT)
+                return true;
+        }
+    }
+    return false;
+};
+/** Bound template interpolation outputs before creating concatenated strings. */
+export const exceedsSemanticTemplateByteBudget = (prefixes, suffixes) => {
+    let total = 0;
+    for (const prefix of prefixes) {
+        for (const suffix of suffixes) {
+            total += jsonStringBytesFromLength(prefix.length + suffix.length);
+            if (total > SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT)
+                return true;
+        }
+    }
+    return false;
+};
+/** Make an explicit unknown value tagged with the semantic resource bound. */
+export const semanticResourceLimitUnknown = (resourceLimit) => ({
+    status: "unknown",
+    reason: RESOURCE_LIMIT_REASON[resourceLimit],
+    resourceLimit,
+});
+/** Collect resource-limit classifications from nested semantic values. */
+export const semanticResourceLimitsIn = (values) => {
+    const found = new Set();
+    const pending = [...values];
+    while (pending.length > 0) {
+        const value = pending.pop();
+        if (value === undefined)
+            continue;
+        if (value.status === "unknown" && value.resourceLimit !== undefined)
+            found.add(value.resourceLimit);
+        else if (value.status === "object")
+            for (const property of value.properties)
+                pending.push(property.value);
+        else if (value.status === "array")
+            for (const item of value.items)
+                pending.push(item);
+    }
+    return [...found].sort();
+};
+/** Display label for one stable resource classification. */
+export const semanticResourceLimitReason = (resourceLimit) => RESOURCE_LIMIT_REASON[resourceLimit];

package/dist/domain/javascript/javascriptSemanticValues.js

@@ -5,16 +5,46 @@ import { semanticRequireOrigin } from "./javascriptSemanticRequireOrigin.js";
 import { compareCodePoints } from "../canonicalOrdering.js";
 import { semanticStaticPropertyKey } from "./javascriptAstValues.js";
 import { semanticAmbiguousProvenance, semanticLocalProvenance, semanticOriginsProvenance, semanticUnresolvedProvenance, uniqueSemanticOrigins, } from "./javascriptSemanticProvenance.js";
-import { semanticPrimitiveCandidates as primitiveCandidates, semanticPrimitiveSet as primitiveSet, semanticPrimitiveValue as primitiveValue, } from "./javascriptSemanticPrimitives.js";
+import { MAX_SEMANTIC_PRIMITIVE_CANDIDATES, semanticPrimitiveCandidates as primitiveCandidates, semanticPrimitiveSet as primitiveSet, semanticPrimitiveValue as primitiveValue, } from "./javascriptSemanticPrimitives.js";
+import { SEMANTIC_EXPRESSION_DEPTH_LIMIT, SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT, exceedsSemanticPrimitiveAdditionByteBudget, exceedsSemanticTemplateByteBudget, semanticResourceLimitUnknown, semanticResourceLimitReason, } from "./javascriptSemanticResourceLimits.js";
+const primitiveBindingValuesByState = new WeakMap();
+const primitiveBindingValuesFor = (state) => {
+    const existing = primitiveBindingValuesByState.get(state);
+    if (existing !== undefined)
+        return existing;
+    const values = new Map();
+    primitiveBindingValuesByState.set(state, values);
+    return values;
+};
+// Cap expression recursion independently from graph nodes and primitive unions.
+const isSemanticResourceLimit = (value) => value.status === "unknown" && value.resourceLimit !== undefined;
 /** Evaluate one binding in the bounded constant-value lattice. */
-export const evaluateSemanticBinding = (binding, state) => evaluateBinding(binding, { state, bindings: new Set() });
+export const evaluateSemanticBinding = (binding, state) => evaluateBinding(binding, {
+    state,
+    bindings: new Set(),
+    expressionDepth: 0,
+    primitiveBindingValues: primitiveBindingValuesFor(state),
+});
 /** Evaluate one arbitrary inert expression in the established lexical state. */
-export const evaluateSemanticExpression = (node, state) => evaluateExpression(node, { state, bindings: new Set() });
+export const evaluateSemanticExpression = (node, state) => evaluateExpression(node, {
+    state,
+    bindings: new Set(),
+    expressionDepth: 0,
+    primitiveBindingValues: primitiveBindingValuesFor(state),
+});
 /** Follow module provenance through destructuring, members, and aliases. */
-export const evaluateSemanticProvenance = (binding, state) => provenanceForBinding(binding, { state, bindings: new Set() });
+export const evaluateSemanticProvenance = (binding, state) => provenanceForBinding(binding, {
+    state,
+    bindings: new Set(),
+    expressionDepth: 0,
+    primitiveBindingValues: primitiveBindingValuesFor(state),
+});
 const evaluateBinding = (binding, context) => {
     if (context.bindings.has(binding.bindingId))
         return { status: "cycle", reason: `Alias cycle at ${binding.name}.` };
+    const cached = context.primitiveBindingValues.get(binding.bindingId);
+    if (cached !== undefined)
+        return cached;
     if (binding.initializers.length === 0)
         return {
             status: "unknown",
@@ -30,9 +60,18 @@ const evaluateBinding = (binding, context) => {
         return { status: "unknown", reason: "Missing binding initializer." };
     const nested = nestedContext(context, binding.bindingId);
     const value = projectValue(evaluateExpression(initializer.node, nested), initializer.projection);
-    return binding.mutatedPaths.reduce(invalidateSemanticMutationPath, value);
+    const projected = binding.mutatedPaths.reduce(invalidateSemanticMutationPath, value);
+    if (projected.status === "literal" ||
+        projected.status === "union" ||
+        (isSemanticResourceLimit(projected) &&
+            (projected.resourceLimit === "primitive-bytes" ||
+                projected.resourceLimit === "primitive-candidates")))
+        context.primitiveBindingValues.set(binding.bindingId, projected);
+    return projected;
 };
 const evaluateExpression = (node, context) => {
+    if (context.expressionDepth > SEMANTIC_EXPRESSION_DEPTH_LIMIT)
+        return semanticResourceLimitUnknown("expression-depth");
     const literal = primitiveValue(node);
     if (literal.found)
         return { status: "literal", value: literal.value };
@@ -75,18 +114,31 @@ const evaluateTemplate = (node, context) => {
     let candidates = [""];
     for (let index = 0; index < node.quasis.length; index += 1) {
         const quasi = node.quasis[index];
+        // Semantic template evaluation retains its established raw fallback for
+        // synthetic AST inputs; exact atom readers remain cooked-only.
         const text = quasi?.value.cooked ?? quasi?.value.raw ?? "";
+        if (exceedsSemanticTemplateByteBudget(candidates, [text]))
+            return semanticResourceLimitUnknown("primitive-bytes");
         candidates = candidates.map((prefix) => `${prefix}${text}`);
         const expression = node.expressions[index];
         if (expression === undefined)
             continue;
-        const values = primitiveCandidates(evaluateExpression(expression, nestedContext(context)));
-        if (values === null)
+        const evaluated = evaluateExpression(expression, nestedContext(context));
+        const values = primitiveCandidates(evaluated);
+        if (values === null) {
+            if (isSemanticResourceLimit(evaluated))
+                return evaluated;
             return {
                 status: "unknown",
                 reason: "Template expression is not a bounded primitive.",
             };
-        candidates = candidates.flatMap((prefix) => values.map((value) => `${prefix}${String(value)}`));
+        }
+        if (candidates.length > SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT / values.length)
+            return semanticResourceLimitUnknown("primitive-candidates");
+        const suffixes = values.map((value) => String(value));
+        if (exceedsSemanticTemplateByteBudget(candidates, suffixes))
+            return semanticResourceLimitUnknown("primitive-bytes");
+        candidates = candidates.flatMap((prefix) => suffixes.map((suffix) => `${prefix}${suffix}`));
     }
     return primitiveSet(candidates);
 };
@@ -231,17 +283,30 @@ const evaluateAddition = (node, context) => {
 const addPrimitiveValues = (leftValue, rightValue) => {
     const left = primitiveCandidates(leftValue);
     const right = primitiveCandidates(rightValue);
-    if (left === null || right === null)
+    if (left === null || right === null) {
+        if (isSemanticResourceLimit(leftValue))
+            return leftValue;
+        if (isSemanticResourceLimit(rightValue))
+            return rightValue;
         return { status: "unknown", reason: "Non-primitive addition." };
+    }
+    if (left.length > MAX_SEMANTIC_PRIMITIVE_CANDIDATES / right.length)
+        return semanticResourceLimitUnknown("primitive-candidates");
+    if (exceedsSemanticPrimitiveAdditionByteBudget(left, right))
+        return semanticResourceLimitUnknown("primitive-bytes");
     const values = left.flatMap((leftValue) => right.map((rightValue) => typeof leftValue === "string" || typeof rightValue === "string"
         ? `${String(leftValue)}${String(rightValue)}`
         : Number(leftValue) + Number(rightValue)));
     return primitiveSet(values);
 };
 const evaluateUnary = (node, context) => {
-    const argument = primitiveCandidates(evaluateExpression(node.argument, nestedContext(context)));
-    if (argument === null)
+    const evaluated = evaluateExpression(node.argument, nestedContext(context));
+    const argument = primitiveCandidates(evaluated);
+    if (argument === null) {
+        if (isSemanticResourceLimit(evaluated))
+            return evaluated;
         return { status: "unknown", reason: "Non-primitive unary operand." };
+    }
     if (node.operator === "!")
         return primitiveSet(argument.map((value) => !value));
     if (node.operator === "+")
@@ -318,6 +383,8 @@ const provenanceForBinding = (binding, context) => {
     })));
 };
 const provenanceForExpression = (node, context) => {
+    if (context.expressionDepth > SEMANTIC_EXPRESSION_DEPTH_LIMIT)
+        return semanticUnresolvedProvenance("unknown", semanticResourceLimitReason("expression-depth"));
     const required = semanticRequireOrigin(node, context.state);
     if (required !== undefined)
         return semanticOriginsProvenance([required]);
@@ -364,6 +431,9 @@ const provenanceForExpression = (node, context) => {
     return semanticLocalProvenance();
 };
 const mergeValues = (values) => {
+    const resourceLimit = values.find(isSemanticResourceLimit);
+    if (resourceLimit !== undefined)
+        return resourceLimit;
     const primitives = values.flatMap((value) => primitiveCandidates(value) ?? []);
     return values.every((value) => value.status === "union" || value.status === "literal")
         ? primitiveSet(primitives)
@@ -371,6 +441,8 @@ const mergeValues = (values) => {
 };
 const nestedContext = (context, bindingId) => ({
     state: context.state,
+    primitiveBindingValues: context.primitiveBindingValues,
+    expressionDepth: context.expressionDepth + 1,
     bindings: bindingId === undefined
         ? context.bindings
         : new Set([...context.bindings, bindingId]),

package/dist/domain/javascript/javascriptSourceParser.js

@@ -1,6 +1,6 @@
 import { parse } from "@babel/parser";
 /** Parse JavaScript or TypeScript once without attaching comments to AST nodes. */
-export const parseJavaScriptSource = (source) => {
+export const parseJavaScriptSource = (source, sourcePath) => {
     try {
         return parse(source, {
             sourceType: "unambiguous",
@@ -10,7 +10,11 @@ export const parseJavaScriptSource = (source) => {
             // forms, including parameter decorators. Without it a decorated
             // TypeScript source fails to parse at all rather than reporting
             // recovered syntax, which loses every fact derived from that source.
-            plugins: ["decorators-legacy", "jsx", "typescript"],
+            // Plain .ts artifacts admit angle-bracket type assertions instead of JSX.
+            // Unknown paths retain the existing JSX-capable parser contract.
+            plugins: sourcePath?.toLowerCase().endsWith(".ts") === true
+                ? ["decorators-legacy", "typescript"]
+                : ["decorators-legacy", "jsx", "typescript"],
         });
     }
     catch (cause) {

package/dist/domain/javascript/javascriptStaticAnalysis.js

@@ -6,26 +6,27 @@ import { addReference, addSourceMapDirectives, inspectCall, inspectRouteProperty
 import { inspectBundlerRegistration, inspectEsbuildWrapper, } from "./javascriptStaticAnalysisBundler.js";
 import { finalizeLocatedFindings } from "./javascriptStaticAnalysisFindings.js";
 import { createJavaScriptAnalysisAccumulator, } from "./javascriptStaticAnalysisState.js";
+import { classifyParsedJavaScriptOpenReceivers, } from "./javascriptSemanticAnalysis.js";
 import { parseJavaScriptSource, } from "./javascriptSourceParser.js";
 /** Parse one JavaScript artifact and recover static structure only. */
 export const analyzeJavaScriptStaticSource = (source) => {
     const file = parseJavaScriptSource(source);
     return file === null
         ? failedJavaScriptStaticAnalysis()
-        : analyzeParsedJavaScriptStaticSource(source, file);
+        : analyzeParsedJavaScriptStaticSource(source, file, classifyParsedJavaScriptOpenReceivers(file));
 };
 /** Recover static structure from an already parsed JavaScript artifact. */
-export const analyzeParsedJavaScriptStaticSource = (source, file) => {
-    const accumulator = createJavaScriptAnalysisAccumulator();
-    traverseStaticSource(source, file, accumulator);
+export const analyzeParsedJavaScriptStaticSource = (source, file, openReceiverFacts) => {
+    const accumulator = createJavaScriptAnalysisAccumulator(source.length);
+    traverseStaticSource(source, file, accumulator, openReceiverFacts);
     addSourceMapDirectives(source, file.comments ?? [], accumulator);
     return finalizeStaticAnalysis(source, file, accumulator);
 };
-const traverseStaticSource = (source, file, accumulator) => {
+const traverseStaticSource = (source, file, accumulator, openReceiverFacts) => {
     traverseJavaScriptAst(file, {
         enter: (node) => {
             accumulator.visitedNodes += 1;
-            inspectNode(source, node, accumulator);
+            inspectNode(source, node, accumulator, openReceiverFacts);
             return undefined;
         },
     });
@@ -51,28 +52,29 @@ const finalizeStaticAnalysis = (source, file, accumulator) => {
             : "complete",
         parse_error_count: parserErrors,
         visited_ast_nodes: accumulator.visitedNodes,
-        references: finalizeLocatedFindings(accumulator.references, accumulator.modules),
-        endpoints: finalizeLocatedFindings(accumulator.endpoints, accumulator.modules),
-        storage: finalizeLocatedFindings(accumulator.storage, accumulator.modules),
+        references: finalizeLocatedFindings(accumulator.references, accumulator.moduleRangeIndex),
+        endpoints: finalizeLocatedFindings(accumulator.endpoints, accumulator.moduleRangeIndex),
+        storage: finalizeLocatedFindings(accumulator.storage, accumulator.moduleRangeIndex),
         bundler_registrations: sortedUnique(accumulator.registrations, registrationKey),
-        role_paths: finalizeLocatedFindings(accumulator.roles, accumulator.modules),
+        role_paths: finalizeLocatedFindings(accumulator.roles, accumulator.moduleRangeIndex),
         source_map_urls: accumulator.sourceMaps,
         vendors: detectVendors(source),
         electron: {
-            browser_windows: finalizeLocatedFindings(accumulator.browserWindows, accumulator.modules),
-            context_bridge_apis: finalizeLocatedFindings(accumulator.contextBridgeApis, accumulator.modules),
-            ipc: finalizeLocatedFindings(accumulator.ipc, accumulator.modules),
-            sender_validations: finalizeLocatedFindings(accumulator.senderValidations, accumulator.modules),
-            utility_processes: finalizeLocatedFindings(accumulator.utilityProcesses, accumulator.modules),
-            native_addon_bindings: finalizeLocatedFindings(accumulator.nativeAddonBindings, accumulator.modules),
+            browser_windows: finalizeLocatedFindings(accumulator.browserWindows, accumulator.moduleRangeIndex),
+            context_bridge_apis: finalizeLocatedFindings(accumulator.contextBridgeApis, accumulator.moduleRangeIndex),
+            ipc: finalizeLocatedFindings(accumulator.ipc, accumulator.moduleRangeIndex),
+            sender_validations: finalizeLocatedFindings(accumulator.senderValidations, accumulator.moduleRangeIndex),
+            utility_processes: finalizeLocatedFindings(accumulator.utilityProcesses, accumulator.moduleRangeIndex),
+            native_addon_bindings: finalizeLocatedFindings(accumulator.nativeAddonBindings, accumulator.moduleRangeIndex),
         },
         limitations,
     };
 };
-const inspectNode = (source, node, accumulator) => {
+const inspectNode = (source, node, accumulator, openReceiverFacts) => {
     const findings = {
         source,
         accumulator,
+        ...(openReceiverFacts === undefined ? {} : { openReceiverFacts }),
     };
     inspectElectronStaticNode(node, findings);
     if (t.isCallExpression(node)) {
@@ -80,6 +82,9 @@ const inspectNode = (source, node, accumulator) => {
         inspectEsbuildWrapper(source, node, accumulator);
         inspectCall(source, node, findings);
     }
+    else if (t.isOptionalCallExpression(node)) {
+        inspectCall(source, node, findings);
+    }
     else if (t.isNewExpression(node))
         inspectCall(source, node, findings);
     if ((t.isImportDeclaration(node) || t.isExportAllDeclaration(node)) &&

package/dist/domain/javascript/javascriptStaticAnalysisBundler.js

@@ -104,13 +104,15 @@ const recoverBundlerModule = (source, property, accumulator) => {
     const exportsValue = collectJavaScriptExports(factory);
     const requireName = factoryRequireName(factory);
     const asyncChunks = collectBundlerAsyncChunkKeys(factory, requireName);
-    if (typeof factory.start === "number" && typeof factory.end === "number")
-        accumulator.modules.push({
+    if (typeof factory.start === "number" && typeof factory.end === "number") {
+        const moduleRange = {
             start: factory.start,
             end: factory.end,
             key,
             requireName,
-        });
+        };
+        accumulator.moduleRangeIndex.add(moduleRange);
+    }
     return {
         module: {
             module_key: key,

package/dist/domain/javascript/javascriptStaticAnalysisCalls.js

@@ -1,13 +1,13 @@
 import * as t from "@babel/types";
 import { sanitizeEndpointCandidate } from "../browserObservation.js";
-import { addFindingOnce, addLocatedFinding, moduleAtOffset, } from "./javascriptStaticAnalysisFindings.js";
+import { addFindingOnce, addLocatedFinding, } from "./javascriptStaticAnalysisFindings.js";
 import { STATIC_ROUTE_CALL_NAMES, argumentValue, calleeName, endpointArgument as endpointArgumentHelper, prefixedArgument, semanticStaticPropertyName, range, rangeForOffsets, sourceSlice, staticPath, staticPathResolutionContext, storageKind, stringValue, } from "./javascriptStaticAnalysisHelpers.js";
 /** Inspect one call or new expression for references, endpoints, storage, and roles. */
 export const inspectCall = (source, node, context) => {
     const { accumulator } = context;
     const name = calleeName(node.callee);
     const first = stringValue(node.arguments[0]);
-    const module = moduleAtOffset(node.start, context.accumulator.modules);
+    const module = context.accumulator.moduleRangeIndex.find(node.start);
     const moduleRequireName = module?.requireName ?? null;
     const requireCall = requireCallSpecifier(node, name, moduleRequireName);
     if (requireCall !== null)
@@ -103,7 +103,8 @@ const inspectEndpointCall = (node, name, first, context) => {
             value: first,
             mechanism: `call:${name}`,
         });
-    const endpoint = endpointArgumentHelper(name, node.arguments, node.callee);
+    const receiverFact = context.openReceiverFacts?.get(node.start ?? -1);
+    const endpoint = endpointArgumentHelper(name, node.arguments, node.callee, receiverFact);
     if (endpoint !== undefined)
         addEndpoint(context, {
             node,
@@ -143,7 +144,16 @@ export const inspectRoleProperty = (node, context) => {
     });
 };
 const inspectStorageCall = (node, name, first, context) => {
-    const storage = storageKind(name);
+    const receiverFact = context.openReceiverFacts?.get(node.start ?? -1);
+    const storage = receiverFact === "local" ||
+        receiverFact === "local-indexed-db" ||
+        receiverFact === "local-cache-storage"
+        ? undefined
+        : receiverFact === "indexed-db"
+            ? "indexed-db"
+            : receiverFact === "cache-storage"
+                ? "cache-storage"
+                : storageKind(name);
     if (storage === undefined)
         return;
     addLocatedFinding(context, {

package/dist/domain/javascript/javascriptStaticAnalysisFindings.js

@@ -1,3 +1,68 @@
+/** Incremental point lookup preserving insertion-order precedence for overlaps. */
+export class JavaScriptModuleRangeIndex {
+    root = {};
+    end;
+    nextOrder = 0;
+    /** Create an empty offset index bounded by the analyzed source length. */
+    constructor(sourceLength) {
+        this.end = Math.max(1, sourceLength + 1);
+    }
+    /** Add a module range in the same discovery order used by the analysis pass. */
+    add(range) {
+        const indexed = { order: this.nextOrder, range };
+        this.nextOrder += 1;
+        const start = Math.max(0, range.start);
+        const end = Math.min(this.end, range.end + 1);
+        if (start < end)
+            this.insert(this.root, 0, this.end, start, end, indexed);
+    }
+    /** Return the first discovered inclusive range containing an offset. */
+    find(offset) {
+        if (offset === null ||
+            offset === undefined ||
+            !Number.isSafeInteger(offset) ||
+            offset < 0 ||
+            offset >= this.end)
+            return undefined;
+        let node = this.root;
+        let low = 0;
+        let high = this.end;
+        let best;
+        while (node !== undefined) {
+            if (node.best !== undefined &&
+                (best === undefined || node.best.order < best.order))
+                best = node.best;
+            if (high - low <= 1)
+                break;
+            const middle = low + Math.floor((high - low) / 2);
+            if (offset < middle) {
+                node = node.left;
+                high = middle;
+            }
+            else {
+                node = node.right;
+                low = middle;
+            }
+        }
+        return best?.range;
+    }
+    insert(node, low, high, queryLow, queryHigh, value) {
+        if (queryLow <= low && high <= queryHigh) {
+            if (node.best === undefined || value.order < node.best.order)
+                node.best = value;
+            return;
+        }
+        const middle = low + Math.floor((high - low) / 2);
+        if (queryLow < middle) {
+            node.left ??= {};
+            this.insert(node.left, low, middle, queryLow, queryHigh, value);
+        }
+        if (queryHigh > middle) {
+            node.right ??= {};
+            this.insert(node.right, middle, high, queryLow, queryHigh, value);
+        }
+    }
+}
 /** Add one module-attributable finding once per source location. */
 export const addLocatedFinding = (context, input) => addFindingOnce(context.accumulator, `${input.key}\0${String(input.node.start)}`, () => input.collection.push({
     offset: input.node.start ?? -1,
@@ -13,11 +78,5 @@ export const addFindingOnce = (accumulator, key, add) => {
 /** Attach recovered bundle-module ownership to findings after traversal. */
 export const finalizeLocatedFindings = (values, modules) => values.map(({ offset, value }) => ({
     ...value,
-    module_key: moduleAtOffset(offset, modules)?.key ?? null,
+    module_key: modules.find(offset)?.key ?? null,
 }));
-/** Locate the recovered bundle factory containing one exact source offset. */
-export const moduleAtOffset = (offset, modules) => {
-    if (offset === null || offset === undefined)
-        return undefined;
-    return modules.find(({ start, end }) => offset >= start && offset <= end);
-};