reverseport 0.0.0-stage → 1.2.0

package/dist/domain/javascript/javascriptApplicationVersionKeys.js

@@ -0,0 +1,199 @@
+import { canonicalJson } from "../comparisonSemantics.js";
+import { compareUnicodeCodePoints, compositeKey, } from "../unicodeCodePointOrder.js";
+const matchTiers = () => [
+    {
+        match: { basis: "exact-content-digest", confidence: "exact" },
+        key: contentDigestKey,
+    },
+    {
+        match: { basis: "exact-module-source-digest", confidence: "exact" },
+        key: moduleSourceDigestKey,
+    },
+    {
+        match: { basis: "exact-node-identity", confidence: "exact" },
+        key: nodeIdentityKey,
+    },
+    {
+        match: { basis: "source-map-identity", confidence: "high" },
+        key: sourceMapKey,
+    },
+    {
+        match: { basis: "structural-fingerprint", confidence: "medium" },
+        key: structuralFingerprintKey,
+    },
+    {
+        match: { basis: "semantic-key", confidence: "medium" },
+        key: semanticKey,
+    },
+];
+/** Apply ordered, unique-only matching tiers without fuzzy pairing. */
+export const matchJavaScriptApplicationVersions = (leftNodes, rightNodes) => {
+    const left = new Map(leftNodes.map((node) => [node.node_id, node]));
+    const right = new Map(rightNodes.map((node) => [node.node_id, node]));
+    const leftCandidates = new Map();
+    const rightCandidates = new Map();
+    const pairs = [];
+    for (const tier of matchTiers())
+        applyTier({ left, right, pairs, leftCandidates, rightCandidates, tier });
+    const remainingLeft = sortedNodes(left.values());
+    const remainingRight = sortedNodes(right.values());
+    const leftIds = new Set(remainingLeft.map(({ node_id: id }) => id));
+    const rightIds = new Set(remainingRight.map(({ node_id: id }) => id));
+    return {
+        pairs: pairs.sort((a, b) => compareUnicodeCodePoints(`${a.left.node_id}\0${a.right.node_id}`, `${b.left.node_id}\0${b.right.node_id}`)),
+        unmatchedLeft: remainingLeft,
+        unmatchedRight: remainingRight,
+        candidatesForLeft: filteredCandidates(leftCandidates, rightIds),
+        candidatesForRight: filteredCandidates(rightCandidates, leftIds),
+    };
+};
+const applyTier = (context) => {
+    const leftByKey = nodesByKey(context.left.values(), context.tier.key);
+    const rightByKey = nodesByKey(context.right.values(), context.tier.key);
+    for (const key of [...leftByKey.keys()].sort(compareUnicodeCodePoints)) {
+        const leftGroup = leftByKey.get(key) ?? [];
+        const rightGroup = rightByKey.get(key) ?? [];
+        if (rightGroup.length === 0)
+            continue;
+        recordCandidates(leftGroup, rightGroup, context.leftCandidates, context.rightCandidates);
+        if (leftGroup.length !== 1 || rightGroup.length !== 1)
+            continue;
+        const leftNode = leftGroup[0];
+        const rightNode = rightGroup[0];
+        if (leftNode === undefined || rightNode === undefined)
+            continue;
+        context.pairs.push({
+            left: leftNode,
+            right: rightNode,
+            ...context.tier.match,
+        });
+        context.left.delete(leftNode.node_id);
+        context.right.delete(rightNode.node_id);
+    }
+};
+const nodesByKey = (nodes, keyFor) => {
+    const output = new Map();
+    for (const node of nodes) {
+        const key = keyFor(node);
+        if (key === null)
+            continue;
+        output.set(key, [...(output.get(key) ?? []), node]);
+    }
+    return output;
+};
+const recordCandidates = (left, right, leftCandidates, rightCandidates) => {
+    for (const leftNode of left) {
+        const candidates = leftCandidates.get(leftNode.node_id) ?? new Set();
+        for (const rightNode of right)
+            candidates.add(rightNode.node_id);
+        leftCandidates.set(leftNode.node_id, candidates);
+    }
+    for (const rightNode of right) {
+        const candidates = rightCandidates.get(rightNode.node_id) ?? new Set();
+        for (const leftNode of left)
+            candidates.add(leftNode.node_id);
+        rightCandidates.set(rightNode.node_id, candidates);
+    }
+};
+const filteredCandidates = (candidates, retained) => new Map([...candidates.entries()].flatMap(([nodeId, values]) => {
+    const filtered = [...values]
+        .filter((value) => retained.has(value))
+        .sort(compareUnicodeCodePoints);
+    return filtered.length === 0 ? [] : [[nodeId, filtered]];
+}));
+const nodeIdentityKey = (node) => `node\0${node.kind}\0${node.node_id}`;
+const contentDigestKey = (node) => node.identity.strategy === "content-digest"
+    ? `content\0${node.kind}\0${node.identity.sha256}`
+    : null;
+const moduleSourceDigestKey = (node) => {
+    if (node.kind !== "javascript-module")
+        return null;
+    const value = uniqueStringProperty(node, "source_sha256");
+    return value === null ? null : `module-source\0${node.kind}\0${value}`;
+};
+const sourceMapKey = (node) => node.kind === "source-module" &&
+    node.identity.strategy === "source-map-original"
+    ? `source-map\0${canonicalJson([node.identity.source_root, node.identity.original_source])}`
+    : null;
+const structuralFingerprintKey = (node) => {
+    if (node.kind !== "javascript-module")
+        return null;
+    const digest = uniqueStringProperty(node, "structural_fingerprint_sha256");
+    const algorithm = uniqueStringProperty(node, "structural_fingerprint_algorithm");
+    return digest === null || algorithm === null
+        ? null
+        : `structural\0${node.kind}\0${algorithm}\0${digest}`;
+};
+const semanticKey = (node) => {
+    if ([
+        "javascript-module",
+        "javascript-chunk",
+        "runtime-script-instance",
+        "unknown",
+    ].includes(node.kind))
+        return null;
+    const properties = firstProperties(node);
+    const value = semanticValue(node, properties);
+    return value === null ? null : `semantic\0${node.kind}\0${value}`;
+};
+const semanticValue = (node, properties) => {
+    if (node.kind === "endpoint") {
+        const kind = nonEmptyString(properties.endpoint_kind);
+        const value = exactString(properties.value);
+        return kind === null || value === null ? null : `${kind}\0${value}`;
+    }
+    if (node.kind === "storage")
+        return joined(properties.storage_kind, properties.name ?? properties.mechanism);
+    if (node.kind === "ipc-channel")
+        return properties.resolution === "dynamic"
+            ? null
+            : (exactString(properties.channel) ?? firstLabel(node));
+    if (node.kind === "context-bridge-api")
+        return (firstLabel(node) ??
+            exactString(properties.api_key) ??
+            nonEmptyString(properties.api_name));
+    if (node.kind === "native-export")
+        return (joined(properties.specifier, compositeKey([
+            stringList(properties.requested_members),
+            typeof properties.namespace_access === "boolean"
+                ? properties.namespace_access
+                : null,
+            typeof properties.dynamic_member_access === "boolean"
+                ? properties.dynamic_member_access
+                : null,
+        ])) ?? firstLabel(node));
+    if ([
+        "electron-main",
+        "electron-preload",
+        "electron-renderer",
+        "electron-utility",
+    ].includes(node.kind))
+        return joined(properties.declared_path, properties.resolved_path);
+    if (node.kind === "package")
+        return nonEmptyString(properties.name);
+    return canonicalPath(node) ?? nonEmptyString(properties.path);
+};
+const canonicalPath = (node) => node.identity.strategy === "canonical-path" ? node.identity.path : null;
+const firstProperties = (node) => node.observations[0]?.properties ?? {};
+const firstLabel = (node) => node.observations.find(({ label }) => label !== null)?.label ?? null;
+const uniqueStringProperty = (node, name) => {
+    const values = [
+        ...new Set(node.observations
+            .map(({ properties }) => properties[name])
+            .filter((value) => typeof value === "string")),
+    ];
+    return values.length === 1 ? (values[0] ?? null) : null;
+};
+const joined = (...values) => {
+    const strings = values.map(nonEmptyString);
+    return strings.some((value) => value === null) ? null : compositeKey(strings);
+};
+const nonEmptyString = (value) => typeof value === "string" && value !== "" ? value : null;
+/** A literal value such as `ipcMain.handle("")` keeps its exact empty text. */
+const exactString = (value) => typeof value === "string" ? value : null;
+const stringList = (value) => Array.isArray(value)
+    ? value
+        .filter((item) => typeof item === "string")
+        .sort(compareUnicodeCodePoints)
+    : [];
+const sortedNodes = (nodes) => [...nodes].sort((left, right) => compareUnicodeCodePoints(left.node_id, right.node_id));

package/dist/domain/javascript/javascriptArtifactFiles.js

@@ -0,0 +1 @@
+export {};

package/dist/domain/javascript/javascriptAstFingerprint.js

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import * as t from "@babel/types";
+import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
+import { compareUnicodeCodePoints } from "../unicodeCodePointOrder.js";
+import { propertyName, semanticStaticPropertyKey, } from "./javascriptAstValues.js";
+import { stringValue } from "./javascriptStaticAnalysisHelpers.js";
+/** Derive a rename-resistant syntax fingerprint without code execution. */
+export const fingerprintJavaScriptAst = (node) => {
+    const tokens = [];
+    traverseJavaScriptAst(node, {
+        enter: (current) => {
+            tokens.push(...semanticTokens(current));
+            return undefined;
+        },
+    });
+    return createHash("sha256").update(JSON.stringify(tokens)).digest("hex");
+};
+/** Collect statically declared CommonJS/bundler export names from one factory. */
+export const collectJavaScriptExports = (node) => {
+    const exports = new Set();
+    traverseJavaScriptAst(node, {
+        enter: (current) => {
+            if (t.isAssignmentExpression(current))
+                collectAssignmentExports(current.left, current.right, exports);
+            if (t.isCallExpression(current))
+                collectCallExports(current, exports);
+            return undefined;
+        },
+    });
+    return {
+        values: [...exports].sort(compareUnicodeCodePoints),
+    };
+};
+const semanticTokens = (node) => {
+    const tokens = [`node:${node.type}`];
+    if (t.isStringLiteral(node))
+        tokens.push(`string:${node.value}`);
+    else if (t.isNumericLiteral(node))
+        tokens.push(`number:${String(node.value)}`);
+    else if (t.isBooleanLiteral(node))
+        tokens.push(`boolean:${String(node.value)}`);
+    else if (t.isRegExpLiteral(node))
+        tokens.push(`regexp:${node.pattern}/${node.flags}`);
+    else if (t.isBinaryExpression(node) || t.isLogicalExpression(node))
+        tokens.push(`operator:${node.operator}`);
+    else if (t.isUnaryExpression(node) || t.isUpdateExpression(node))
+        tokens.push(`operator:${node.operator}`);
+    if (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) {
+        const property = propertyName(node.property);
+        if (property !== "")
+            tokens.push(`property:${property}`);
+    }
+    if ((t.isObjectProperty(node) || t.isObjectMethod(node)) && !node.computed) {
+        const key = propertyName(node.key);
+        if (key !== "")
+            tokens.push(`key:${key}`);
+    }
+    return tokens;
+};
+const collectAssignmentExports = (left, right, output) => {
+    const path = memberPath(left);
+    if (path === null)
+        return;
+    // Rebinding the CommonJS alias does not replace module.exports.
+    if (path.length === 1 && path[0] === "exports")
+        return;
+    const exportOffset = path[0] === "exports"
+        ? 1
+        : path[0] === "module" && path[1] === "exports"
+            ? 2
+            : null;
+    if (exportOffset === null)
+        return;
+    if (path.length === exportOffset) {
+        if (t.isObjectExpression(right))
+            collectObjectKeys(right, output);
+        else
+            addExport(output, "default");
+        return;
+    }
+    // A CommonJS export assignment exposes the first property below the
+    // exports object. Deeper writes mutate that exported value, rather than
+    // creating an export whose name is the dotted member path.
+    addExport(output, path[exportOffset]);
+};
+const collectCallExports = (call, output) => {
+    const callee = memberPath(call.callee);
+    if (callee === null)
+        return;
+    const definePropertyCall = callee.length === 2 &&
+        callee[0] === "Object" &&
+        callee[1] === "defineProperty";
+    const declarationCall = callee.length >= 2 && callee.at(-1) === "d";
+    if (!definePropertyCall && !declarationCall)
+        return;
+    const target = memberPath(call.arguments[0]);
+    const exportTarget = target !== null &&
+        ((target.length === 1 && target[0] === "exports") ||
+            (target.length === 2 &&
+                target[0] === "module" &&
+                target[1] === "exports"));
+    if (!exportTarget)
+        return;
+    if (definePropertyCall) {
+        const name = stringValue(call.arguments[1]);
+        if (name !== undefined)
+            addExport(output, name);
+        return;
+    }
+    const declarations = call.arguments[1];
+    if (t.isObjectExpression(declarations))
+        collectObjectKeys(declarations, output);
+};
+const collectObjectKeys = (object, output) => {
+    for (const property of object.properties) {
+        if (!t.isObjectProperty(property) && !t.isObjectMethod(property))
+            continue;
+        const name = semanticStaticPropertyKey(property.key, property.computed);
+        // In an object literal, a non-computed `__proto__: value` sets the
+        // prototype instead of creating an own property. Shorthand, computed,
+        // and method forms do create own properties.
+        if (name !== null &&
+            !(t.isObjectProperty(property) &&
+                !property.computed &&
+                !property.shorthand &&
+                name === "__proto__"))
+            addExport(output, name);
+    }
+};
+const addExport = (output, name) => {
+    output.add(name);
+};
+const memberPath = (node) => {
+    const properties = [];
+    let current = node;
+    while (current !== undefined &&
+        current !== null &&
+        (t.isMemberExpression(current) || t.isOptionalMemberExpression(current))) {
+        const property = semanticStaticPropertyKey(current.property, current.computed);
+        if (property === null)
+            return null;
+        properties.push(property);
+        current = current.object;
+    }
+    if (current === undefined || current === null)
+        return null;
+    const root = t.isIdentifier(current)
+        ? current.name
+        : t.isThisExpression(current)
+            ? "this"
+            : null;
+    return root === null ? null : [root, ...properties.reverse()];
+};

package/dist/domain/javascript/javascriptAstValues.js

@@ -0,0 +1,99 @@
+import * as t from "@babel/types";
+/**
+ * Remove wrappers that affect TypeScript or Flow checking but not runtime
+ * expression identity. The returned depth lets bounded evaluators account for
+ * syntax that normalization would otherwise skip.
+ */
+export const unwrapJavaScriptExpression = (node) => {
+    let current = node;
+    let depth = 0;
+    while (t.isParenthesizedExpression(current) ||
+        t.isTSAsExpression(current) ||
+        t.isTSTypeAssertion(current) ||
+        t.isTSNonNullExpression(current) ||
+        t.isTSSatisfiesExpression(current) ||
+        t.isTSInstantiationExpression(current) ||
+        t.isTypeCastExpression(current)) {
+        current = current.expression;
+        depth += 1;
+    }
+    return { node: current, depth };
+};
+/** Read one syntax-level primitive only when its value is exact. */
+export const readExactJavaScriptLiteral = (node) => {
+    node = unwrapJavaScriptExpression(node).node;
+    if (t.isStringLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isNumericLiteral(node) && Number.isFinite(node.value))
+        return { found: true, value: node.value };
+    if (t.isBooleanLiteral(node))
+        return { found: true, value: node.value };
+    if (t.isNullLiteral(node))
+        return { found: true, value: null };
+    if (t.isTemplateLiteral(node) &&
+        node.expressions.length === 0 &&
+        node.quasis.length === 1) {
+        const cooked = node.quasis[0]?.value.cooked;
+        return cooked === null || cooked === undefined
+            ? { found: false }
+            : { found: true, value: cooked };
+    }
+    return { found: false };
+};
+/** Read an identifier or literal property name without evaluating syntax. */
+export const propertyName = (node) => {
+    if (t.isIdentifier(node))
+        return node.name;
+    if (t.isStringLiteral(node) || t.isNumericLiteral(node))
+        return String(node.value);
+    return "";
+};
+/** Read a property name only when its syntax commits to one exact key. */
+export const semanticStaticPropertyName = (property, computed) => semanticStaticPropertyKey(property, computed) ?? "";
+/** Read an exact property key, preserving the legal empty-string key. */
+export const semanticStaticPropertyKey = (property, computed) => {
+    property = unwrapJavaScriptExpression(property).node;
+    if (t.isStringLiteral(property) || t.isNumericLiteral(property))
+        return String(property.value);
+    return !computed && t.isIdentifier(property) ? property.name : null;
+};
+/** Read exact consumed object-pattern keys, leaving dynamic keys unknown. */
+export const semanticObjectPatternKeys = (pattern) => pattern.properties.flatMap((property) => {
+    if (t.isRestElement(property))
+        return [];
+    const key = semanticStaticPropertyKey(property.key, property.computed);
+    return key === null ? [] : [key];
+});
+/** Visit binding and member leaves in direct and destructuring write targets. */
+export function* semanticWriteTargets(root) {
+    const pending = [root];
+    while (pending.length > 0) {
+        const next = pending.pop();
+        if (next === undefined)
+            break;
+        const node = unwrapJavaScriptExpression(next).node;
+        if (t.isIdentifier(node) ||
+            t.isMemberExpression(node) ||
+            t.isOptionalMemberExpression(node))
+            yield node;
+        else if (t.isRestElement(node))
+            pending.push(node.argument);
+        else if (t.isAssignmentPattern(node))
+            pending.push(node.left);
+        else if (t.isArrayPattern(node)) {
+            for (const element of node.elements.toReversed())
+                if (element !== null)
+                    pending.push(element);
+        }
+        else if (t.isObjectPattern(node)) {
+            for (const property of node.properties.toReversed())
+                pending.push(t.isRestElement(property) ? property.argument : property.value);
+        }
+    }
+}
+/**
+ * Display an exact JavaScript string as nonempty label text. Graph labels and
+ * artifact-local keys are nonempty, so the legal empty value is shown as `""`;
+ * producers keep the exact value in their properties.
+ */
+export const javascriptDisplayText = (value) => value === "" ? '""' : value;

package/dist/domain/javascript/javascriptBootstrap.js

@@ -0,0 +1,94 @@
+import * as t from "@babel/types";
+import { semanticStaticPropertyKey } from "./javascriptAstValues.js";
+import { moduleFactory } from "./javascriptStaticAnalysisHelpers.js";
+import { traverseJavaScriptAst } from "./javascriptSemanticTraversal.js";
+import { resolveSemanticBindingState, semanticStableInitializer, } from "./javascriptSemanticState.js";
+/** Recognize syntax, never invoke a bootstrap or infer it from variable names. */
+export const javascriptBootstrapAt = (call, state) => {
+    if ((!t.isFunctionExpression(call.callee) &&
+        !t.isArrowFunctionExpression(call.callee)) ||
+        !t.isBlockStatement(call.callee.body) ||
+        call.callee.params.length !== 0 ||
+        call.arguments.length !== 0)
+        return undefined;
+    const body = call.callee.body;
+    const tables = new Map();
+    for (const statement of body.body) {
+        if (!t.isVariableDeclaration(statement))
+            continue;
+        for (const declaration of statement.declarations) {
+            if (t.isIdentifier(declaration.id) &&
+                t.isObjectExpression(declaration.init) &&
+                declaration.init.properties.length > 0 &&
+                declaration.init.properties.every((property) => moduleFactory(property) !== undefined)) {
+                const binding = resolveSemanticBindingState(state, declaration.id, declaration.id.name);
+                if (binding !== undefined &&
+                    semanticStableInitializer(binding, state)?.node === declaration.init)
+                    tables.set(binding.bindingId, declaration.init);
+            }
+        }
+    }
+    if (tables.size === 0)
+        return undefined;
+    for (const loader of body.body) {
+        if (!t.isFunctionDeclaration(loader) ||
+            loader.id === null ||
+            loader.id === undefined ||
+            loader.params.length !== 1)
+            continue;
+        const parameter = loader.params[0];
+        if (!t.isIdentifier(parameter))
+            continue;
+        const loaderName = loader.id.name;
+        const loaderBindingId = bindingId(state, loader.id);
+        const parameterBindingId = bindingId(state, parameter);
+        if (loaderBindingId === undefined || parameterBindingId === undefined)
+            continue;
+        let tableBindingId;
+        traverseJavaScriptAst(loader.body, {
+            enter: (node, _parent, ancestors) => {
+                if (!t.isCallExpression(node) ||
+                    ancestors().some((node) => t.isFunction(node)))
+                    return;
+                const candidate = dispatchedTableBinding(node, loaderBindingId, parameterBindingId, state);
+                if (candidate !== undefined && tables.has(candidate))
+                    tableBindingId = candidate;
+            },
+        });
+        const table = tableBindingId === undefined ? undefined : tables.get(tableBindingId);
+        if (table !== undefined && tableBindingId !== undefined)
+            return { body, table, loaderName, loaderBindingId, tableBindingId };
+    }
+    return undefined;
+};
+const dispatchedTableBinding = (call, loaderBindingId, keyBindingId, state) => {
+    const member = call.callee;
+    const viaCall = t.isMemberExpression(member) &&
+        semanticStaticPropertyKey(member.property, member.computed) === "call";
+    const dispatch = viaCall && t.isMemberExpression(member) ? member.object : member;
+    if (!t.isMemberExpression(dispatch) ||
+        !dispatch.computed ||
+        !t.isIdentifier(dispatch.object) ||
+        !t.isIdentifier(dispatch.property) ||
+        bindingId(state, dispatch.property) !== keyBindingId)
+        return undefined;
+    const args = viaCall ? call.arguments.slice(1) : call.arguments;
+    const [module, exports, require] = args;
+    if (args.length !== 3 ||
+        !t.isIdentifier(module) ||
+        bindingId(state, module) === undefined ||
+        !t.isMemberExpression(exports) ||
+        !t.isIdentifier(exports.object) ||
+        bindingId(state, exports.object) !== bindingId(state, module) ||
+        semanticStaticPropertyKey(exports.property, exports.computed) !==
+            "exports" ||
+        !t.isIdentifier(require) ||
+        bindingId(state, require) !== loaderBindingId)
+        return undefined;
+    if (viaCall &&
+        (!t.isNode(call.arguments[0]) ||
+            !t.isNodesEquivalent(call.arguments[0], exports)))
+        return undefined;
+    return bindingId(state, dispatch.object);
+};
+const bindingId = (state, identifier) => resolveSemanticBindingState(state, identifier, identifier.name)?.bindingId;

package/dist/domain/javascript/javascriptElectronMemberWrites.js

@@ -0,0 +1,119 @@
+import * as t from "@babel/types";
+import { semanticStaticPropertyKey, semanticWriteTargets, unwrapJavaScriptExpression, } from "./javascriptAstValues.js";
+import { traverseJavaScriptAstSteps } from "./javascriptSemanticTraversal.js";
+/** Match Electron's supported module entry points. */
+export const ELECTRON_MODULE = /^electron(?:\/(?:common|main|renderer|utility))?$/u;
+/**
+ * Electron's CommonJS exports define no `default` member, so a leading
+ * `default` segment can only denote the module object itself, as an ES module
+ * default import (`import electron from "electron"`) binds it.
+ */
+export const electronExportPath = (importedPath) => importedPath[0] === "default" ? importedPath.slice(1) : importedPath;
+/** Static identity recovery cannot establish the absence of Electron usage. */
+export const ELECTRON_IDENTITY_LIMITATION = "Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.";
+/** Preserve exact property segments instead of flattening literal dotted keys. */
+export const electronMemberPath = (node) => {
+    let root = unwrapJavaScriptExpression(node).node;
+    const members = [];
+    while (t.isMemberExpression(root) || t.isOptionalMemberExpression(root)) {
+        members.push(semanticStaticPropertyKey(root.property, root.computed));
+        root = unwrapJavaScriptExpression(root.object).node;
+    }
+    return { root, members: members.toReversed() };
+};
+/** Index member and binding writes through caller-proven lexical identities. */
+export function* collectJavaScriptIdentityWritesSteps(program, origin, intrinsicInvocation, staticString, freshObject, retain) {
+    const objectMutators = new Set([
+        "defineProperty",
+        "defineProperties",
+        "assign",
+        "setPrototypeOf",
+    ]);
+    const reflectMutators = new Set([
+        "set",
+        "deleteProperty",
+        "defineProperty",
+        "setPrototypeOf",
+    ]);
+    const keyedMutators = new Set(["set", "deleteProperty", "defineProperty"]);
+    yield* traverseJavaScriptAstSteps(program, {
+        enter: (node) => {
+            if (t.isCallExpression(node) || t.isOptionalCallExpression(node)) {
+                const invocation = intrinsicInvocation(node);
+                if (invocation?.kind === "opaque") {
+                    const scope = origin(node, "opaque-call");
+                    if (scope !== undefined)
+                        retain(node, scope);
+                    return;
+                }
+                const callee = invocation?.path;
+                const arguments_ = invocation?.arguments;
+                const method = callee?.at(-1);
+                const owner = callee?.length === 3 ? callee[1] : undefined;
+                if ((owner === "Object" && objectMutators.has(method ?? "")) ||
+                    (owner === "Reflect" && reflectMutators.has(method ?? ""))) {
+                    // Reflect.set can write through its explicit receiver as well as
+                    // dispatching through its target. Both identities need examination.
+                    const targets = owner === "Reflect" &&
+                        method === "set" &&
+                        arguments_ !== undefined &&
+                        (arguments_.length >= 4 || arguments_.some(t.isSpreadElement))
+                        ? [
+                            arguments_[0],
+                            arguments_.some(t.isSpreadElement)
+                                ? undefined
+                                : arguments_[3],
+                        ]
+                        : [arguments_?.[0]];
+                    for (const target of targets) {
+                        // A known mutator with an opaque argument list can overwrite any
+                        // captured intrinsic. Do not turn an unexamined target into proof.
+                        if (target === undefined || t.isSpreadElement(target)) {
+                            const scope = origin(node, "opaque-call");
+                            if (scope !== undefined)
+                                retain(node, scope);
+                        }
+                        if (t.isNode(target) && !t.isSpreadElement(target)) {
+                            const { root, members } = electronMemberPath(target);
+                            const exported = origin(root, "member");
+                            if (exported !== undefined) {
+                                const key = keyedMutators.has(method ?? "")
+                                    ? [staticString(arguments_?.[1]) ?? null]
+                                    : [];
+                                retain(node, [...exported, ...members, ...key]);
+                            }
+                            else if (!freshObject(target)) {
+                                const scope = origin(node, "opaque-call");
+                                if (scope !== undefined)
+                                    retain(node, scope);
+                            }
+                        }
+                    }
+                }
+            }
+            const target = t.isAssignmentExpression(node)
+                ? node.left
+                : t.isUpdateExpression(node)
+                    ? node.argument
+                    : t.isUnaryExpression(node, { operator: "delete" })
+                        ? node.argument
+                        : t.isForOfStatement(node) || t.isForInStatement(node)
+                            ? node.left
+                            : undefined;
+            if (target === undefined)
+                return;
+            for (const leaf of semanticWriteTargets(target)) {
+                if (t.isIdentifier(leaf)) {
+                    const exported = origin(leaf, "binding");
+                    if (exported !== undefined)
+                        retain(node, exported);
+                    continue;
+                }
+                const { root, members } = electronMemberPath(leaf);
+                const exported = origin(root, "member");
+                if (exported !== undefined)
+                    retain(node, [...exported, ...members]);
+            }
+        },
+    });
+}