feat(resolver): resolve property calls on object destructuring rest parameters (JS)

Adds Phase 8.3f: when a function parameter uses object destructuring with a
rest element (`function f3({ e1: eee1, ...eerest })`), and the rest object's
property is called (`eerest.e4()`), resolve the callee via a three-hop chain:

  ObjectRestParamBinding (eerest ← f3 param 0)
  + ParamBinding          (f3(obj) → obj at index 0)
  + ObjectPropBinding     (obj = { e4 } → obj.e4 = e4)
  → pts["eerest.e4"] = {"e4"} → calls edge f3 → e4

Changes:
- types.ts: add ObjectRestParamBinding and ObjectPropBinding interfaces
- javascript.ts: extractObjectRestParamBindingsWalk (finds rest params in
  object-destructured function params) and extractObjectPropBindingsWalk
  (finds shorthand/identifier properties in object literals); wired into
  both extractSymbolsQuery and extractSymbolsWalk paths
- wasm-worker-{protocol,entry,pool}.ts: serialize new binding arrays
- points-to.ts: seed pts["rest.propName"] = {"fn"} from the three-hop chain
- build-edges.ts: new Phase 8.3f receiver-pts fallback — when a receiver call
  is unresolved, check pts["receiver.name"] for rest-dispatch targets; also
  include new bindings in buildPointsToMapForFile null-check guard

Jelly micro-test benchmark (rest fixture): recall=100% TP=1 FN=0 FP=0

Closes #1336

Author: carlos-alm

src/domain/graph/builder/stages/build-edges.ts

@@ -836,7 +836,9 @@ function buildPointsToMapForFile(
     !symbols.arrayElemBindings?.length &&
     !symbols.spreadArgBindings?.length &&
     !symbols.forOfBindings?.length &&
-    !symbols.arrayCallbackBindings?.length
+    !symbols.arrayCallbackBindings?.length &&
+    !symbols.objectRestParamBindings?.length &&
+    !symbols.objectPropBindings?.length
   )
     return null;
   const defNames = new Set(
@@ -855,6 +857,8 @@ function buildPointsToMapForFile(
     symbols.spreadArgBindings,
     symbols.forOfBindings,
     symbols.arrayCallbackBindings,
+    symbols.objectRestParamBindings,
+    symbols.objectPropBindings,
   );
 }
 
@@ -1007,6 +1011,43 @@ function buildFileCallEdges(
       }
     }
 
+    // Phase 8.3f: pts fallback for receiver calls via object-rest param bindings.
+    // Fires when `rest.prop()` is encountered and `rest` was seeded as `pts["rest.prop"]`
+    // by the object-rest dispatch chain (ObjectRestParamBinding + paramBinding + ObjectPropBinding).
+    if (
+      targets.length === 0 &&
+      call.receiver &&
+      !BUILTIN_RECEIVERS.has(call.receiver) &&
+      call.receiver !== 'this' &&
+      call.receiver !== 'self' &&
+      call.receiver !== 'super' &&
+      ptsMap
+    ) {
+      const receiverKey = `${call.receiver}.${call.name}`;
+      if (ptsMap.has(receiverKey)) {
+        for (const alias of resolveViaPointsTo(receiverKey, ptsMap)) {
+          const { targets: aliasTargets, importedFrom: aliasFrom } = resolveCallTargets(
+            lookup,
+            { name: alias },
+            relPath,
+            importedNames,
+            typeMap as Map<string, unknown>,
+          );
+          for (const t of aliasTargets) {
+            const edgeKey = `${caller.id}|${t.id}`;
+            if (t.id !== caller.id && !seenCallEdges.has(edgeKey) && !ptsEdgeRows.has(edgeKey)) {
+              const conf =
+                computeConfidence(relPath, t.file, aliasFrom ?? null) - PROPAGATION_HOP_PENALTY;
+              if (conf > 0) {
+                ptsEdgeRows.set(edgeKey, allEdgeRows.length);
+                allEdgeRows.push([caller.id, t.id, 'calls', conf, isDynamic, 'points-to']);
+              }
+            }
+          }
+        }
+      }
+    }
+
     if (
       call.receiver &&
       !BUILTIN_RECEIVERS.has(call.receiver) &&

src/domain/graph/resolver/points-to.ts

@@ -24,6 +24,8 @@ import type {
   ArrayElemBinding,
   FnRefBinding,
   ForOfBinding,
+  ObjectPropBinding,
+  ObjectRestParamBinding,
   ParamBinding,
   SpreadArgBinding,
 } from '../../../types.js';
@@ -68,6 +70,8 @@ export function buildPointsToMap(
   spreadArgBindings?: readonly SpreadArgBinding[],
   forOfBindings?: readonly ForOfBinding[],
   arrayCallbackBindings?: readonly ArrayCallbackBinding[],
+  objectRestParamBindings?: readonly ObjectRestParamBinding[],
+  objectPropBindings?: readonly ObjectPropBinding[],
 ): PointsToMap {
   const pts: PointsToMap = new Map();
 
@@ -177,6 +181,24 @@ export function buildPointsToMap(
     }
   }
 
+  // Phase 8.3f: object-rest parameter dispatch.
+  // `function f({ ...rest }) {}` + `f(obj)` + `const obj = { prop: fn }` →
+  // seed pts["rest.prop"] = {"fn"} so that `rest.prop()` resolves to `fn`.
+  if (objectRestParamBindings && objectPropBindings && paramBindings) {
+    for (const { callee, restName, argIndex } of objectRestParamBindings) {
+      for (const { callee: pbCallee, argIndex: pbArgIdx, argName } of paramBindings) {
+        if (pbCallee !== callee || pbArgIdx !== argIndex) continue;
+        for (const { objectName, propName, valueName } of objectPropBindings) {
+          if (objectName !== argName) continue;
+          if (!definitionNames.has(valueName) && !importedNames.has(valueName)) continue;
+          const key = `${restName}.${propName}`;
+          if (!pts.has(key)) pts.set(key, new Set());
+          pts.get(key)!.add(valueName);
+        }
+      }
+    }
+  }
+
   if (constraints.length === 0) return pts;
 
   // Fixed-point iteration: propagate pts sets until no new information flows.

src/domain/wasm-worker-entry.ts

@@ -810,6 +810,10 @@ function serializeExtractorOutput(
     ...(symbols.arrayCallbackBindings?.length
       ? { arrayCallbackBindings: symbols.arrayCallbackBindings }
       : {}),
+    ...(symbols.objectRestParamBindings?.length
+      ? { objectRestParamBindings: symbols.objectRestParamBindings }
+      : {}),
+    ...(symbols.objectPropBindings?.length ? { objectPropBindings: symbols.objectPropBindings } : {}),
     ...(symbols.newExpressions?.length ? { newExpressions: symbols.newExpressions } : {}),
   };
 }

src/domain/wasm-worker-pool.ts

@@ -112,6 +112,8 @@ function deserializeResult(ser: SerializedExtractorOutput | null): ExtractorOutp
   if (ser.spreadArgBindings?.length) out.spreadArgBindings = ser.spreadArgBindings;
   if (ser.forOfBindings?.length) out.forOfBindings = ser.forOfBindings;
   if (ser.arrayCallbackBindings?.length) out.arrayCallbackBindings = ser.arrayCallbackBindings;
+  if (ser.objectRestParamBindings?.length) out.objectRestParamBindings = ser.objectRestParamBindings;
+  if (ser.objectPropBindings?.length) out.objectPropBindings = ser.objectPropBindings;
   if (ser.newExpressions?.length) out.newExpressions = ser.newExpressions;
   return out;
 }

src/domain/wasm-worker-protocol.ts

@@ -68,6 +68,8 @@ export interface SerializedExtractorOutput {
   spreadArgBindings?: import('../types.js').SpreadArgBinding[];
   forOfBindings?: import('../types.js').ForOfBinding[];
   arrayCallbackBindings?: import('../types.js').ArrayCallbackBinding[];
+  objectRestParamBindings?: import('../types.js').ObjectRestParamBinding[];
+  objectPropBindings?: import('../types.js').ObjectPropBinding[];
   newExpressions?: readonly string[];
 }
 

src/extractors/javascript.ts

@@ -11,6 +11,8 @@ import type {
   FnRefBinding,
   ForOfBinding,
   Import,
+  ObjectPropBinding,
+  ObjectRestParamBinding,
   ParamBinding,
   SpreadArgBinding,
   SubDeclaration,
@@ -332,6 +334,8 @@ function extractSymbolsQuery(tree: TreeSitterTree, query: TreeSitterQuery): Extr
   const spreadArgBindings: SpreadArgBinding[] = [];
   const forOfBindings: ForOfBinding[] = [];
   const arrayCallbackBindings: ArrayCallbackBinding[] = [];
+  const objectRestParamBindings: ObjectRestParamBinding[] = [];
+  const objectPropBindings: ObjectPropBinding[] = [];
 
   const matches = query.matches(tree.rootNode);
 
@@ -373,6 +377,10 @@ function extractSymbolsQuery(tree: TreeSitterTree, query: TreeSitterQuery): Extr
   // Extract definitions from destructured bindings (query patterns don't match object_pattern)
   extractDestructuredBindingsWalk(tree.rootNode, definitions);
 
+  // Phase 8.3f: Extract object-rest parameter and object-property bindings
+  extractObjectRestParamBindingsWalk(tree.rootNode, objectRestParamBindings);
+  extractObjectPropBindingsWalk(tree.rootNode, objectPropBindings);
+
   // Phase 8.5: collect all `new X()` constructor names for RTA instantiation tracking
   const newExpressions: string[] = [];
   extractNewExpressionsWalk(tree.rootNode, newExpressions);
@@ -392,6 +400,8 @@ function extractSymbolsQuery(tree: TreeSitterTree, query: TreeSitterQuery): Extr
     spreadArgBindings,
     forOfBindings,
     arrayCallbackBindings,
+    objectRestParamBindings,
+    objectPropBindings,
     newExpressions,
   };
 }
@@ -629,6 +639,8 @@ function extractSymbolsWalk(tree: TreeSitterTree): ExtractorOutput {
     spreadArgBindings: [],
     forOfBindings: [],
     arrayCallbackBindings: [],
+    objectRestParamBindings: [],
+    objectPropBindings: [],
   };
 
   walkJavaScriptNode(tree.rootNode, ctx);
@@ -657,6 +669,9 @@ function extractSymbolsWalk(tree: TreeSitterTree): ExtractorOutput {
     ctx.arrayCallbackBindings!,
     ctx.fnRefBindings!,
   );
+  // Phase 8.3f: Extract object-rest parameter and object-property bindings
+  extractObjectRestParamBindingsWalk(tree.rootNode, ctx.objectRestParamBindings!);
+  extractObjectPropBindingsWalk(tree.rootNode, ctx.objectPropBindings!);
   // Phase 8.5: collect all `new X()` constructor names for RTA instantiation tracking
   const newExpressions: string[] = [];
   extractNewExpressionsWalk(tree.rootNode, newExpressions);
@@ -1871,6 +1886,101 @@ function extractSpreadForOfWalk(
   walk(rootNode, 0);
 }
 
+/**
+ * Phase 8.3f: collect object-rest parameter bindings.
+ *
+ * `function f({ a, ...rest }) {}` → `{ callee: "f", restName: "rest", argIndex: 0 }`
+ *
+ * Enables resolving `rest.prop()` when a known object is passed as that parameter.
+ */
+function extractObjectRestParamBindingsWalk(
+  rootNode: TreeSitterNode,
+  bindings: ObjectRestParamBinding[],
+): void {
+  function walk(node: TreeSitterNode, depth: number): void {
+    if (depth >= MAX_WALK_DEPTH) return;
+    const t = node.type;
+    if (t === 'function_declaration' || t === 'function_expression' || t === 'arrow_function') {
+      const nameNode = node.childForFieldName('name');
+      const funcName = nameNode?.text;
+      if (funcName) {
+        const paramsNode =
+          node.childForFieldName('parameters') || findChild(node, 'formal_parameters');
+        if (paramsNode) {
+          let argIndex = 0;
+          for (let i = 0; i < paramsNode.childCount; i++) {
+            const param = paramsNode.child(i);
+            if (!param) continue;
+            const pt = param.type;
+            if (pt === ',' || pt === '(' || pt === ')') continue;
+            if (pt === 'object_pattern') {
+              for (let j = 0; j < param.childCount; j++) {
+                const child = param.child(j);
+                if (!child) continue;
+                if (child.type !== 'rest_pattern' && child.type !== 'rest_element') continue;
+                const restNameNode = child.child(1) ?? child.childForFieldName('name');
+                if (restNameNode?.type === 'identifier') {
+                  bindings.push({ callee: funcName, restName: restNameNode.text, argIndex });
+                }
+              }
+            }
+            argIndex++;
+          }
+        }
+      }
+    }
+    for (let i = 0; i < node.childCount; i++) {
+      walk(node.child(i)!, depth + 1);
+    }
+  }
+  walk(rootNode, 0);
+}
+
+/**
+ * Phase 8.3f: collect object-property bindings from object literals.
+ *
+ * `const obj = { e4 }` → `{ objectName: "obj", propName: "e4", valueName: "e4" }`
+ * `const obj = { e1: fn }` → `{ objectName: "obj", propName: "e1", valueName: "fn" }`
+ *
+ * Only tracks shorthand and `key: identifier` pairs; skips function literals.
+ */
+function extractObjectPropBindingsWalk(
+  rootNode: TreeSitterNode,
+  bindings: ObjectPropBinding[],
+): void {
+  function walk(node: TreeSitterNode, depth: number): void {
+    if (depth >= MAX_WALK_DEPTH) return;
+    if (node.type === 'variable_declarator') {
+      const nameN = node.childForFieldName('name');
+      const valueN = node.childForFieldName('value');
+      if (nameN?.type === 'identifier' && valueN?.type === 'object') {
+        const objectName = nameN.text;
+        for (let i = 0; i < valueN.childCount; i++) {
+          const child = valueN.child(i);
+          if (!child) continue;
+          if (child.type === 'shorthand_property_identifier') {
+            bindings.push({ objectName, propName: child.text, valueName: child.text });
+          } else if (child.type === 'pair') {
+            const keyN = child.childForFieldName('key');
+            const valN = child.childForFieldName('value');
+            if (
+              keyN?.type === 'property_identifier' &&
+              valN?.type === 'identifier' &&
+              !BUILTIN_GLOBALS.has(valN.text)
+            ) {
+              bindings.push({ objectName, propName: keyN.text, valueName: valN.text });
+            }
+          }
+        }
+      }
+    }
+    for (let i = 0; i < node.childCount; i++) {
+      walk(node.child(i)!, depth + 1);
+    }
+  }
+  walk(rootNode, 0);
+}
+
 function extractReceiverName(objNode: TreeSitterNode | null): string | undefined {
   if (!objNode) return undefined;
   const t = objNode.type;

src/types.ts

@@ -603,6 +603,33 @@ export interface ArrayCallbackBinding {
   calleeName: string;
 }
 
+/**
+ * An object-rest parameter binding: `function f({ a, ...rest })` records that
+ * `rest` is the rest of the object passed as argument `argIndex` to `f`.
+ * Phase 8.3f: object destructuring rest dispatch.
+ */
+export interface ObjectRestParamBinding {
+  /** Function that owns this rest parameter, e.g. "f3" */
+  callee: string;
+  /** Name of the rest binding, e.g. "eerest" */
+  restName: string;
+  /** Zero-based index of the argument whose rest is bound, e.g. 0 */
+  argIndex: number;
+}
+
+/**
+ * An object-property binding: `const obj = { e4 }` or `const obj = { e4: fn }` records
+ * that `obj.e4` points to the named function `fn`. Phase 8.3f.
+ */
+export interface ObjectPropBinding {
+  /** Variable holding the object, e.g. "obj" */
+  objectName: string;
+  /** Property name, e.g. "e4" */
+  propName: string;
+  /** Named function value, e.g. "e4" or "fn" */
+  valueName: string;
+}
+
 /** The normalized output shape returned by every language extractor. */
 export interface ExtractorOutput {
   definitions: Definition[];
@@ -642,6 +669,10 @@ export interface ExtractorOutput {
   forOfBindings?: ForOfBinding[];
   /** Phase 8.3e: array callback bindings from Array.from/forEach/etc. */
   arrayCallbackBindings?: ArrayCallbackBinding[];
+  /** Phase 8.3f: object-rest parameter bindings from `function f({ ...rest })` patterns. */
+  objectRestParamBindings?: ObjectRestParamBinding[];
+  /** Phase 8.3f: object-property bindings from `const obj = { fn }` patterns. */
+  objectPropBindings?: ObjectPropBinding[];
   /**
    * Phase 8.5 (RTA): constructor names from all `new X()` expressions in the file,
    * including unassigned ones (e.g. `doSomething(new Foo())`). Used to build the

tests/benchmarks/resolution/fixtures/jelly-micro/rest/expected-edges.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "../../expected-edges.schema.json",
+  "language": "javascript",
+  "description": "Object destructuring rest parameter dispatch — eerest.e4() → e4",
+  "edges": [
+    {
+      "source": { "name": "f3", "file": "rest.js" },
+      "target": { "name": "e4", "file": "rest.js" },
+      "kind": "calls",
+      "mode": "pts-obj-rest"
+    }
+  ]
+}

tests/benchmarks/resolution/fixtures/jelly-micro/rest/rest.js

@@ -0,0 +1,14 @@
+// Jelly micro-test: rest — object destructuring rest parameter dispatch
+
+function e1() {}
+function e2() {}
+function e3() {}
+function e4() {}
+
+const obj = { e1, e2, e3, e4 };
+
+function f3({ e1: eee1, ...eerest }) {
+    eee1();
+    eerest.e4();  // eerest.e4 === obj.e4 === e4 when called as f3(obj)
+}
+f3(obj);