fix(javascript): preserve SQLite constructor provenance

Use Database spelling only to select a candidate. Reuse shared expression
provenance and indexed mutation facts to omit proven local constructors and
retain known SQLite API origins separately from uncertain names. Match ESM
default/namespace and CommonJS export forms without collapsing their identity.
Keep type-only import origins as ambiguous runtime values, including aliases.

Carry candidate interpretation through the worker schema and graph nodes and
edges with low confidence, explicit limitations and distinct identities.
Remove the name-only SQLite storage classifier. Other storage APIs retain
existing handling; PR4863's separate Map endpoint work is not integrated.

Validation: initial9negative controls fail unchangedf5fcf5216 while4positive
controls pass; final67focused checks/8files plus60provenance-consumer checks/
4files pass. Static/docs/discovery1557 pass. Two source reviewers clear after
correcting namespace constructor identity. Public CLI checks worker/schema
projection and separate exact/candidate identities with the same filename.

Twelve small completed CLI workflows preserve exact known-API replies and
remove false local-class storage facts. No speedup/large-case memory or real
SQLite execution claim. Direct eval's existing generic invalidation defect
remains tracked separately in #4875. Heavy tests/profiling remain stopped.

Additional consumer validation caught and corrected runtime import-equals
classification: require-mode import origins remain runtime values. Three new
SQLite controls cover runtime and erased import-equals forms; compiled
child-process CLI/MCP stdio workflows pass after the correction.

Fixes #4854
This commit is contained in:
morluto committed 2026-10-18 05:06:46 +08:00
1 parent f5fcf5216f
commit fc847ffe35
10 files changed
+234 -14

No files matched your search

@@ -227,6 +227,20 @@ export const evaluateSemanticExpression = (
);
};
/** Resolve an expression using the same alias and module provenance owner. */
export const evaluateSemanticExpressionProvenance = (
node: t.Node,
state: JavaScriptSemanticAnalysisState,
): JavaScriptBindingProvenance =>
provenanceForExpression(node, {
state,
bindings: new Map(),
expressionDepth: 0,
primitiveBindingValues: primitiveBindingValuesFor(state),
dependence: { lowest: CALLER_INDEPENDENT },
memo: createEvaluationMemo(state),
});
/** Follow module provenance through destructuring, members, and aliases. */
export const evaluateSemanticProvenance = (
binding: JavaScriptSemanticBindingState,
@@ -963,7 +977,16 @@ const provenanceForBindingValue = (
: "Catch binding provenance depends on the thrown value.",
);
if (binding.directOrigins.length > 0)
return semanticOriginsProvenance(binding.directOrigins);
return binding.kind === "import" &&
!binding.runtimeImport &&
binding.directOrigins.every(
({ resolutionMode }) => resolutionMode !== "require",
)
? semanticAmbiguousProvenance(
binding.directOrigins,
"A type-only import does not establish a runtime module value.",
)
: semanticOriginsProvenance(binding.directOrigins);
if (binding.initializers.length === 0) return semanticLocalProvenance();
if (binding.initializers.length > 1)
return semanticAmbiguousProvenance(
@@ -1151,8 +1174,10 @@ const isLocallyCreatedValue = (node: t.Node): boolean =>
t.isObjectExpression(node) ||
t.isArrayExpression(node) ||
t.isFunctionExpression(node) ||
t.isFunctionDeclaration(node) ||
t.isArrowFunctionExpression(node) ||
t.isClassExpression(node) ||
t.isClassDeclaration(node) ||
t.isTemplateLiteral(node) ||
t.isUnaryExpression(node) ||
t.isBinaryExpression(node) ||